diff --git a/.gitignore b/.gitignore index 369c7e8b4..e4150d65e 100644 --- a/.gitignore +++ b/.gitignore @@ -1,9 +1,11 @@ -SOURCES/kernel-abi-stablelists-5.14.0-687.5.1.el9_8.tar.bz2 -SOURCES/kernel-kabi-dw-5.14.0-687.5.1.el9_8.tar.bz2 -SOURCES/linux-5.14.0-687.5.1.el9_8.tar.xz +SOURCES/kernel-abi-stablelists-5.14.0-687.26.1.el9_8.tar.bz2 +SOURCES/kernel-kabi-dw-5.14.0-687.26.1.el9_8.tar.bz2 +SOURCES/linux-5.14.0-687.26.1.el9_8.tar.xz SOURCES/nvidiabfdpu.x509 SOURCES/nvidiagpuoot001.x509 SOURCES/nvidiajetsonsoc.x509 +SOURCES/olima1.x509 +SOURCES/olimaca1.x509 SOURCES/redhatsecureboot504.cer SOURCES/rheldup3.x509 SOURCES/rhelima.x509 diff --git a/.kernel.metadata b/.kernel.metadata index 0693a0499..bb41445a2 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,9 +1,11 @@ -f21a5c6a56106e2790e9fff02046059845b21c27 SOURCES/kernel-abi-stablelists-5.14.0-687.5.1.el9_8.tar.bz2 -5840fe94117e01fee7ab3d75d86f0f6c7182c85f SOURCES/kernel-kabi-dw-5.14.0-687.5.1.el9_8.tar.bz2 -0abcd2db91df05c71e974123c6dfd915b422fdca SOURCES/linux-5.14.0-687.5.1.el9_8.tar.xz +ecb10db2ca8e447b44d19a331eb70c40ce03c009 SOURCES/kernel-abi-stablelists-5.14.0-687.26.1.el9_8.tar.bz2 +542db2884f8984e402a66e2ff46d56186af9079f SOURCES/kernel-kabi-dw-5.14.0-687.26.1.el9_8.tar.bz2 +6c56f44f19b7f6d3700b4d35896a4a7075aded4a SOURCES/linux-5.14.0-687.26.1.el9_8.tar.xz 3dc4997e0273ca116d52a52238a57403aba5dafb SOURCES/nvidiabfdpu.x509 4fff8080e88afffc06d8ef5004db8d53bb21237f SOURCES/nvidiagpuoot001.x509 18378ab150ef13ef65609224e10a2e8501d82915 SOURCES/nvidiajetsonsoc.x509 +706ae01dd14efa38f0f565a3706acac19c78df02 SOURCES/olima1.x509 +6e3f0d61414c0b50f48dc2d4c3b3cd024e1c3a43 SOURCES/olimaca1.x509 1d51d3a037ad287095b0a13c4deeb1252d8ff0cc SOURCES/redhatsecureboot504.cer 95b9b811c7b0a6c98b2eafc4e7d6d24f2cb63289 SOURCES/rheldup3.x509 99e571f9de4188f3b5fdf1f84ff73f6cc4bb6a0e SOURCES/rhelima.x509 diff --git a/SOURCES/1100-rtnetlink-allocate-vfinfo-size-for-vf-guids-when-supported.patch b/SOURCES/1100-rtnetlink-allocate-vfinfo-size-for-vf-guids-when-supported.patch deleted file mode 100644 index 322d6e1e4..000000000 --- a/SOURCES/1100-rtnetlink-allocate-vfinfo-size-for-vf-guids-when-supported.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 07bcb984353e8e436251bdc10804e952fec12943 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 13 Apr 2026 13:56:58 -0400 -Subject: [PATCH] rtnetlink: Allocate vfinfo size for VF GUIDs when supported - -JIRA: https://issues.redhat.com/browse/RHEL-167866 - -CVE: CVE-2025-22075 - -commit 23f00807619d15063d676218f36c5dfeda1eb420 -Author: Mark Zhang -Date: Tue Mar 25 11:02:26 2025 +0200 - - rtnetlink: Allocate vfinfo size for VF GUIDs when supported - - Commit 30aad41721e0 ("net/core: Add support for getting VF GUIDs") - added support for getting VF port and node GUIDs in netlink ifinfo - messages, but their size was not taken into consideration in the - function that allocates the netlink message, causing the following - warning when a netlink message is filled with many VF port and node - GUIDs: - # echo 64 > /sys/bus/pci/devices/0000\:08\:00.0/sriov_numvfs - # ip link show dev ib0 - RTNETLINK answers: Message too long - Cannot send link get request: Message too long - - Kernel warning: - - ------------[ cut here ]------------ - WARNING: CPU: 2 PID: 1930 at net/core/rtnetlink.c:4151 rtnl_getlink+0x586/0x5a0 - Modules linked in: xt_conntrack xt_MASQUERADE nfnetlink xt_addrtype iptable_nat nf_nat br_netfilter overlay mlx5_ib macsec mlx5_core tls rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi scsi_transport_iscsi ib_umad rdma_cm iw_cm ib_ipoib fuse ib_cm ib_core - CPU: 2 UID: 0 PID: 1930 Comm: ip Not tainted 6.14.0-rc2+ #1 - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 - RIP: 0010:rtnl_getlink+0x586/0x5a0 - Code: cb 82 e8 3d af 0a 00 4d 85 ff 0f 84 08 ff ff ff 4c 89 ff 41 be ea ff ff ff e8 66 63 5b ff 49 c7 07 80 4f cb 82 e9 36 fc ff ff <0f> 0b e9 16 fe ff ff e8 de a0 56 00 66 66 2e 0f 1f 84 00 00 00 00 - RSP: 0018:ffff888113557348 EFLAGS: 00010246 - RAX: 00000000ffffffa6 RBX: ffff88817e87aa34 RCX: dffffc0000000000 - RDX: 0000000000000003 RSI: 0000000000000000 RDI: ffff88817e87afb8 - RBP: 0000000000000009 R08: ffffffff821f44aa R09: 0000000000000000 - R10: ffff8881260f79a8 R11: ffff88817e87af00 R12: ffff88817e87aa00 - R13: ffffffff8563d300 R14: 00000000ffffffa6 R15: 00000000ffffffff - FS: 00007f63a5dbf280(0000) GS:ffff88881ee00000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 00007f63a5ba4493 CR3: 00000001700fe002 CR4: 0000000000772eb0 - DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 - DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 - PKRU: 55555554 - Call Trace: - - ? __warn+0xa5/0x230 - ? rtnl_getlink+0x586/0x5a0 - ? report_bug+0x22d/0x240 - ? handle_bug+0x53/0xa0 - ? exc_invalid_op+0x14/0x50 - ? asm_exc_invalid_op+0x16/0x20 - ? skb_trim+0x6a/0x80 - ? rtnl_getlink+0x586/0x5a0 - ? __pfx_rtnl_getlink+0x10/0x10 - ? rtnetlink_rcv_msg+0x1e5/0x860 - ? __pfx___mutex_lock+0x10/0x10 - ? rcu_is_watching+0x34/0x60 - ? __pfx_lock_acquire+0x10/0x10 - ? stack_trace_save+0x90/0xd0 - ? filter_irq_stacks+0x1d/0x70 - ? kasan_save_stack+0x30/0x40 - ? kasan_save_stack+0x20/0x40 - ? kasan_save_track+0x10/0x30 - rtnetlink_rcv_msg+0x21c/0x860 - ? entry_SYSCALL_64_after_hwframe+0x76/0x7e - ? __pfx_rtnetlink_rcv_msg+0x10/0x10 - ? arch_stack_walk+0x9e/0xf0 - ? rcu_is_watching+0x34/0x60 - ? lock_acquire+0xd5/0x410 - ? rcu_is_watching+0x34/0x60 - netlink_rcv_skb+0xe0/0x210 - ? __pfx_rtnetlink_rcv_msg+0x10/0x10 - ? __pfx_netlink_rcv_skb+0x10/0x10 - ? rcu_is_watching+0x34/0x60 - ? __pfx___netlink_lookup+0x10/0x10 - ? lock_release+0x62/0x200 - ? netlink_deliver_tap+0xfd/0x290 - ? rcu_is_watching+0x34/0x60 - ? lock_release+0x62/0x200 - ? netlink_deliver_tap+0x95/0x290 - netlink_unicast+0x31f/0x480 - ? __pfx_netlink_unicast+0x10/0x10 - ? rcu_is_watching+0x34/0x60 - ? lock_acquire+0xd5/0x410 - netlink_sendmsg+0x369/0x660 - ? lock_release+0x62/0x200 - ? __pfx_netlink_sendmsg+0x10/0x10 - ? import_ubuf+0xb9/0xf0 - ? __import_iovec+0x254/0x2b0 - ? lock_release+0x62/0x200 - ? __pfx_netlink_sendmsg+0x10/0x10 - ____sys_sendmsg+0x559/0x5a0 - ? __pfx_____sys_sendmsg+0x10/0x10 - ? __pfx_copy_msghdr_from_user+0x10/0x10 - ? rcu_is_watching+0x34/0x60 - ? do_read_fault+0x213/0x4a0 - ? rcu_is_watching+0x34/0x60 - ___sys_sendmsg+0xe4/0x150 - ? __pfx____sys_sendmsg+0x10/0x10 - ? do_fault+0x2cc/0x6f0 - ? handle_pte_fault+0x2e3/0x3d0 - ? __pfx_handle_pte_fault+0x10/0x10 - ? preempt_count_sub+0x14/0xc0 - ? __down_read_trylock+0x150/0x270 - ? __handle_mm_fault+0x404/0x8e0 - ? __pfx___handle_mm_fault+0x10/0x10 - ? lock_release+0x62/0x200 - ? __rcu_read_unlock+0x65/0x90 - ? rcu_is_watching+0x34/0x60 - __sys_sendmsg+0xd5/0x150 - ? __pfx___sys_sendmsg+0x10/0x10 - ? __up_read+0x192/0x480 - ? lock_release+0x62/0x200 - ? __rcu_read_unlock+0x65/0x90 - ? rcu_is_watching+0x34/0x60 - do_syscall_64+0x6d/0x140 - entry_SYSCALL_64_after_hwframe+0x76/0x7e - RIP: 0033:0x7f63a5b13367 - Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 - RSP: 002b:00007fff8c726bc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e - RAX: ffffffffffffffda RBX: 0000000067b687c2 RCX: 00007f63a5b13367 - RDX: 0000000000000000 RSI: 00007fff8c726c30 RDI: 0000000000000004 - RBP: 00007fff8c726cb8 R08: 0000000000000000 R09: 0000000000000034 - R10: 00007fff8c726c7c R11: 0000000000000246 R12: 0000000000000001 - R13: 0000000000000000 R14: 00007fff8c726cd0 R15: 00007fff8c726cd0 - - irq event stamp: 0 - hardirqs last enabled at (0): [<0000000000000000>] 0x0 - hardirqs last disabled at (0): [] copy_process+0xd08/0x2830 - softirqs last enabled at (0): [] copy_process+0xd08/0x2830 - softirqs last disabled at (0): [<0000000000000000>] 0x0 - ---[ end trace 0000000000000000 ]--- - - Thus, when calculating ifinfo message size, take VF GUIDs sizes into - account when supported. - - Fixes: 30aad41721e0 ("net/core: Add support for getting VF GUIDs") - Signed-off-by: Mark Zhang - Reviewed-by: Maher Sanalla - Signed-off-by: Mark Bloch - Reviewed-by: Sabrina Dubroca - Link: https://patch.msgid.link/20250325090226.749730-1-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index e58604891437..cf61b887c5fc 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1005,6 +1005,9 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev, - /* IFLA_VF_STATS_TX_DROPPED */ - nla_total_size_64bit(sizeof(__u64))); - } -+ if (dev->netdev_ops->ndo_get_vf_guid) -+ size += num_vfs * 2 * -+ nla_total_size(sizeof(struct ifla_vf_guid)); - return size; - } else - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1101-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch b/SOURCES/1101-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch deleted file mode 100644 index 22840c14c..000000000 --- a/SOURCES/1101-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch +++ /dev/null @@ -1,97 +0,0 @@ -From be8f678b4eaf729472075519c05dc8a70ae4b072 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 10 Apr 2026 08:59:49 +0000 -Subject: [PATCH] net/sched: Make cake_enqueue return NET_XMIT_CN when past - buffer_limit -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-166730 -CVE: CVE-2025-39766 - -commit 15de71d06a400f7fdc15bf377a2552b0ec437cf5 -Author: William Liu -Date: Tue Aug 19 03:36:28 2025 +0000 - - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit - - The following setup can trigger a WARNING in htb_activate due to - the condition: !cl->leaf.q->q.qlen - - tc qdisc del dev lo root - tc qdisc add dev lo root handle 1: htb default 1 - tc class add dev lo parent 1: classid 1:1 \ - htb rate 64bit - tc qdisc add dev lo parent 1:1 handle f: \ - cake memlimit 1b - ping -I lo -f -c1 -s64 -W0.001 127.0.0.1 - - This is because the low memlimit leads to a low buffer_limit, which - causes packet dropping. However, cake_enqueue still returns - NET_XMIT_SUCCESS, causing htb_enqueue to call htb_activate with an - empty child qdisc. We should return NET_XMIT_CN when packets are - dropped from the same tin and flow. - - I do not believe return value of NET_XMIT_CN is necessary for packet - drops in the case of ack filtering, as that is meant to optimize - performance, not to signal congestion. - - Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") - Signed-off-by: William Liu - Reviewed-by: Savino Dicanosa - Acked-by: Toke Høiland-Jørgensen - Reviewed-by: Jamal Hadi Salim - Link: https://patch.msgid.link/20250819033601.579821-1-will@willsroot.io - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index 48dd8c88903f..aa9f31e4415a 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -1747,7 +1747,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - ktime_t now = ktime_get(); - struct cake_tin_data *b; - struct cake_flow *flow; -- u32 idx; -+ u32 idx, tin; - - /* choose flow to insert into */ - idx = cake_classify(sch, &b, skb, q->flow_mode, &ret); -@@ -1757,6 +1757,7 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - __qdisc_drop(skb, to_free); - return ret; - } -+ tin = (u32)(b - q->tins); - idx--; - flow = &b->flows[idx]; - -@@ -1924,13 +1925,22 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - q->buffer_max_used = q->buffer_used; - - if (q->buffer_used > q->buffer_limit) { -+ bool same_flow = false; - u32 dropped = 0; -+ u32 drop_id; - - while (q->buffer_used > q->buffer_limit) { - dropped++; -- cake_drop(sch, to_free); -+ drop_id = cake_drop(sch, to_free); -+ -+ if ((drop_id >> 16) == tin && -+ (drop_id & 0xFFFF) == idx) -+ same_flow = true; - } - b->drop_overlimit += dropped; -+ -+ if (same_flow) -+ return NET_XMIT_CN; - } - return NET_XMIT_SUCCESS; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1102-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch b/SOURCES/1102-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch deleted file mode 100644 index 802df6696..000000000 --- a/SOURCES/1102-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch +++ /dev/null @@ -1,162 +0,0 @@ -From d7f88307eaa11490b3ad24647bdf96922504fd5e Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 10 Apr 2026 08:59:50 +0000 -Subject: [PATCH] net/sched: sch_cake: Fix incorrect qlen reduction in - cake_drop -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-166730 -CVE: CVE-2025-39766 - -commit 9fefc78f7f02d71810776fdeb119a05a946a27cc -Author: Xiang Mei -Date: Thu Nov 27 17:14:14 2025 -0700 - - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop - - In cake_drop(), qdisc_tree_reduce_backlog() is used to update the qlen - and backlog of the qdisc hierarchy. Its caller, cake_enqueue(), assumes - that the parent qdisc will enqueue the current packet. However, this - assumption breaks when cake_enqueue() returns NET_XMIT_CN: the parent - qdisc stops enqueuing current packet, leaving the tree qlen/backlog - accounting inconsistent. This mismatch can lead to a NULL dereference - (e.g., when the parent Qdisc is qfq_qdisc). - - This patch computes the qlen/backlog delta in a more robust way by - observing the difference before and after the series of cake_drop() - calls, and then compensates the qdisc tree accounting if cake_enqueue() - returns NET_XMIT_CN. - - To ensure correct compensation when ACK thinning is enabled, a new - variable is introduced to keep qlen unchanged. - - Fixes: 15de71d06a40 ("net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit") - Signed-off-by: Xiang Mei - Reviewed-by: Toke Høiland-Jørgensen - Link: https://patch.msgid.link/20251128001415.377823-1-xmei5@asu.edu - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c -index aa9f31e4415a..ef51a9e0f621 100644 ---- a/net/sched/sch_cake.c -+++ b/net/sched/sch_cake.c -@@ -1594,7 +1594,6 @@ static unsigned int cake_drop(struct Qdisc *sch, struct sk_buff **to_free) - - qdisc_drop_reason(skb, sch, to_free, SKB_DROP_REASON_QDISC_OVERLIMIT); - sch->q.qlen--; -- qdisc_tree_reduce_backlog(sch, 1, len); - - cake_heapify(q, 0); - -@@ -1740,14 +1739,14 @@ static void cake_reconfigure(struct Qdisc *sch); - static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - struct sk_buff **to_free) - { -+ u32 idx, tin, prev_qlen, prev_backlog, drop_id; - struct cake_sched_data *q = qdisc_priv(sch); -- int len = qdisc_pkt_len(skb); -- int ret; -+ int len = qdisc_pkt_len(skb), ret; - struct sk_buff *ack = NULL; - ktime_t now = ktime_get(); - struct cake_tin_data *b; - struct cake_flow *flow; -- u32 idx, tin; -+ bool same_flow = false; - - /* choose flow to insert into */ - idx = cake_classify(sch, &b, skb, q->flow_mode, &ret); -@@ -1820,6 +1819,8 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - consume_skb(skb); - } else { - /* not splitting */ -+ int ack_pkt_len = 0; -+ - cobalt_set_enqueue_time(skb, now); - get_cobalt_cb(skb)->adjusted_len = cake_overhead(q, skb); - flow_queue_add(flow, skb); -@@ -1830,13 +1831,13 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - if (ack) { - b->ack_drops++; - sch->qstats.drops++; -- b->bytes += qdisc_pkt_len(ack); -- len -= qdisc_pkt_len(ack); -+ ack_pkt_len = qdisc_pkt_len(ack); -+ b->bytes += ack_pkt_len; - q->buffer_used += skb->truesize - ack->truesize; - if (q->rate_flags & CAKE_FLAG_INGRESS) - cake_advance_shaper(q, b, ack, now, true); - -- qdisc_tree_reduce_backlog(sch, 1, qdisc_pkt_len(ack)); -+ qdisc_tree_reduce_backlog(sch, 1, ack_pkt_len); - consume_skb(ack); - } else { - sch->q.qlen++; -@@ -1845,11 +1846,11 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - - /* stats */ - b->packets++; -- b->bytes += len; -- b->backlogs[idx] += len; -- b->tin_backlog += len; -- sch->qstats.backlog += len; -- q->avg_window_bytes += len; -+ b->bytes += len - ack_pkt_len; -+ b->backlogs[idx] += len - ack_pkt_len; -+ b->tin_backlog += len - ack_pkt_len; -+ sch->qstats.backlog += len - ack_pkt_len; -+ q->avg_window_bytes += len - ack_pkt_len; - } - - if (q->overflow_timeout) -@@ -1924,24 +1925,29 @@ static s32 cake_enqueue(struct sk_buff *skb, struct Qdisc *sch, - if (q->buffer_used > q->buffer_max_used) - q->buffer_max_used = q->buffer_used; - -- if (q->buffer_used > q->buffer_limit) { -- bool same_flow = false; -- u32 dropped = 0; -- u32 drop_id; -+ if (q->buffer_used <= q->buffer_limit) -+ return NET_XMIT_SUCCESS; - -- while (q->buffer_used > q->buffer_limit) { -- dropped++; -- drop_id = cake_drop(sch, to_free); -+ prev_qlen = sch->q.qlen; -+ prev_backlog = sch->qstats.backlog; - -- if ((drop_id >> 16) == tin && -- (drop_id & 0xFFFF) == idx) -- same_flow = true; -- } -- b->drop_overlimit += dropped; -+ while (q->buffer_used > q->buffer_limit) { -+ drop_id = cake_drop(sch, to_free); -+ if ((drop_id >> 16) == tin && -+ (drop_id & 0xFFFF) == idx) -+ same_flow = true; -+ } -+ -+ prev_qlen -= sch->q.qlen; -+ prev_backlog -= sch->qstats.backlog; -+ b->drop_overlimit += prev_qlen; - -- if (same_flow) -- return NET_XMIT_CN; -+ if (same_flow) { -+ qdisc_tree_reduce_backlog(sch, prev_qlen - 1, -+ prev_backlog - len); -+ return NET_XMIT_CN; - } -+ qdisc_tree_reduce_backlog(sch, prev_qlen, prev_backlog); - return NET_XMIT_SUCCESS; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1103-ice-fix-page-leak-for-zero-size-rx-descriptors.patch b/SOURCES/1103-ice-fix-page-leak-for-zero-size-rx-descriptors.patch deleted file mode 100644 index 9aa810976..000000000 --- a/SOURCES/1103-ice-fix-page-leak-for-zero-size-rx-descriptors.patch +++ /dev/null @@ -1,135 +0,0 @@ -From d770e24a36c555404676344d2b3a55f0aeecbde0 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Thu, 5 Mar 2026 14:22:14 +0100 -Subject: [PATCH] ice: fix page leak for zero-size Rx descriptors -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-152865 -Upstream Status: RHEL-only - -Intel E800 hardware can generate zero-size descriptors within -multi-buffer (jumbo) frames. These descriptors carry no packet data -but still occupy a slot in the Rx ring and have a page assigned to -them. - -ice_add_xdp_frag() correctly skips zero-size descriptors (returns 0 -when size == 0), so the page is never added to the xdp_buff/SKB. -However, ice_get_rx_buf() unconditionally decrements pagecnt_bias for -every descriptor, including zero-size ones. This creates a permanent -pagecnt_bias deficit for the affected page: the driver has "promised" -(via pagecnt_bias--) that someone will eventually call put_page() to -balance it, but since the page is not part of any SKB, nobody ever -does. - -The deficit accumulates and manifests as follows: - - 1. Zero-size descriptor: pagecnt_bias-- in ice_get_rx_buf(), but - the page is not added to any SKB by ice_add_xdp_frag(). - 2. The page is recycled back to the ring via ice_reuse_rx_page() - with pagecnt_bias one lower than it should be. - 3. On the next normal use of this page, pagecnt_bias-- again. - Now page_count - pagecnt_bias = 2 > 1, so ice_can_reuse_rx_page() - returns false. - 4. The page goes to __page_frag_cache_drain(page, pagecnt_bias), - but pagecnt_bias is too low by 1, leaving page_count = 2. - 5. The SKB eventually frees its reference (put_page), bringing - page_count to 1 - a phantom reference with no owner. - 6. The page is permanently leaked. ice_alloc_rx_bufs() must - allocate a fresh page to replace it. - -The previous attempt to fix the associated panic (commit ef68094cb09e -"ice: Fix kernel panic due to page refcount underflow") added -pagecnt_bias-- for zero-size descriptors in ice_get_rx_buf(). This -fixed the panic in the CONSUMED (XDP_DROP/error) path but introduced -the page leak in the PASS path described above. - -The root cause is that ice_put_rx_mbuf() used a positional counter -('i') to decide which buffers need pagecnt_bias restoration. This -counter counted all ring positions including zero-size descriptors, -but xdp_frags only counted real fragments, causing misalignment: -zero-size descriptors "stole" pagecnt_bias++ slots from real -fragments that needed them. - -Fix this by adding an 'has_data' flag to ice_rx_buf that records whether -ice_get_rx_buf() was called with actual data (size > 0). Replace -the broken positional counter in ice_put_rx_mbuf() with a direct -check on this flag: - - - has_data && !CONSUMED: call ice_rx_buf_adjust_pg_offset() — the page - is in an SKB or XDP TX buffer that will eventually call put_page() - to balance the pagecnt_bias decrement. - - - !has_data || CONSUMED: call pagecnt_bias++ — either the page carries - no data (zero-size descriptor, nobody will put_page()) or the - frame was dropped (no external reference holds any page). - -The 'has_data' field fits within existing struct padding so ice_rx_buf -size does not change. - -Signed-off-by: Petr Oros - -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c -index 499269f03c9d..2712ad743d38 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.c -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c -@@ -1081,6 +1081,7 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, - - if (!size) { - rx_buf->pagecnt_bias--; -+ rx_buf->has_data = false; - return rx_buf; - } - /* we are reusing so sync this buffer for CPU use */ -@@ -1090,6 +1091,7 @@ ice_get_rx_buf(struct ice_rx_ring *rx_ring, const unsigned int size, - - /* We have pulled a buffer for use, so decrement pagecnt_bias */ - rx_buf->pagecnt_bias--; -+ rx_buf->has_data = true; - - return rx_buf; - } -@@ -1302,25 +1304,15 @@ static void ice_put_rx_mbuf(struct ice_rx_ring *rx_ring, struct xdp_buff *xdp, - u32 idx = rx_ring->first_desc; - u32 cnt = rx_ring->count; - struct ice_rx_buf *buf; -- u32 xdp_frags = 0; -- int i = 0; -- -- if (unlikely(xdp_buff_has_frags(xdp))) -- xdp_frags = xdp_get_shared_info_from_buff(xdp)->nr_frags; - - while (idx != ntc) { - buf = &rx_ring->rx_buf[idx]; - if (++idx == cnt) - idx = 0; - -- /* An XDP program could release fragments from the end of the -- * buffer. For these, we need to keep the pagecnt_bias as-is. -- * To do this, only adjust pagecnt_bias for fragments up to -- * the total remaining after the XDP program has run. -- */ -- if (verdict != ICE_XDP_CONSUMED) -+ if (verdict != ICE_XDP_CONSUMED && buf->has_data) - ice_rx_buf_adjust_pg_offset(buf, xdp->frame_sz); -- else if (i++ <= xdp_frags) -+ else - buf->pagecnt_bias++; - - ice_put_rx_buf(rx_ring, buf); -diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.h b/drivers/net/ethernet/intel/ice/ice_txrx.h -index 841a07bfba54..70f40a5ec33f 100644 ---- a/drivers/net/ethernet/intel/ice/ice_txrx.h -+++ b/drivers/net/ethernet/intel/ice/ice_txrx.h -@@ -203,6 +203,7 @@ struct ice_rx_buf { - unsigned int page_offset; - unsigned int pgcnt; - unsigned int pagecnt_bias; -+ bool has_data; - }; - - struct ice_q_stats { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1104-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch b/SOURCES/1104-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch deleted file mode 100644 index 5c88355f9..000000000 --- a/SOURCES/1104-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 21f7e8315ba37d429d01c98365e7e33d7611eb1e Mon Sep 17 00:00:00 2001 -From: Medha Mummigatti -Date: Thu, 12 Mar 2026 13:47:24 +0530 -Subject: [PATCH] net: hv_netvsc: reject RSS hash key programming without RX - indirection table - -JIRA: https://issues.redhat.com/browse/RHEL-150569 - -commit d23564955811da493f34412d7de60fa268c8cb50 -Author Aditya Garg - - net: hv_netvsc: reject RSS hash key programming without RX indirection table - - RSS configuration requires a valid RX indirection table. When the device - reports a single receive queue, rndis_filter_device_add() does not - allocate an indirection table, accepting RSS hash key updates in this - state leads to a hang. - - Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return - -EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device - capabilities and prevents incorrect behavior. - - Fixes: 962f3fee83a4 ("netvsc: add ethtool ops to get/set RSS key") - Signed-off-by: Aditya Garg - Reviewed-by: Dipayaan Roy - Reviewed-by: Haiyang Zhang - Link: https://patch.msgid.link/1768212093-1594-1-git-send-email-gargaditya@linux.microsoft.com - Signed-off-by: Jakub Kicinski - (cherry picked from commit d23564955811da493f34412d7de60fa268c8cb50) - -Signed-off-by: Medha Mummigatti - -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 229e29498ecf..6cfef8b22cae 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -1756,6 +1756,9 @@ static int netvsc_set_rxfh(struct net_device *dev, - rxfh->hfunc != ETH_RSS_HASH_TOP) - return -EOPNOTSUPP; - -+ if (!ndc->rx_table_sz) -+ return -EOPNOTSUPP; -+ - rndis_dev = ndev->extension; - if (rxfh->indir) { - for (i = 0; i < ndc->rx_table_sz; i++) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1105-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch b/SOURCES/1105-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch deleted file mode 100644 index f66721d17..000000000 --- a/SOURCES/1105-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch +++ /dev/null @@ -1,62 +0,0 @@ -From 4f4e442a275bfa406ab9766548cb30001deb4515 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 12 Aug 2025 16:35:13 -0700 -Subject: [PATCH] RDMA/bnxt_re: Support extended stats for Thor2 VF - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 260ce16e579d375ba8f1ac945308343522f98d50 -Author: Ajit Khaparde -Date: Fri May 23 13:29:52 2025 +0530 - - RDMA/bnxt_re: Support extended stats for Thor2 VF - - The driver currently checks if the user is querying VF RoCE statistics. - It will not send the query_roce_stats_ext HWRM command if it is for a - VF. But Thor2 VF can support extended statistics. - Allow query of extended stats for Thor2 VFs. - - Signed-off-by: Ajit Khaparde - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250523075952.1267827-1-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Damodharam Ammepalli - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index 457eecb99f96..be34c605d516 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1113,7 +1113,7 @@ int bnxt_qplib_create_qp(struct bnxt_qplib_res *res, struct bnxt_qplib_qp *qp) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_FORCE_COMPLETION; - if (qp->wqe_mode == BNXT_QPLIB_WQE_MODE_VARIABLE) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_VARIABLE_SIZED_WQE_ENABLED; -- if (_is_ext_stats_supported(res->dattr->dev_cap_flags) && !res->is_vf) -+ if (bnxt_ext_stats_supported(res->cctx, res->dattr->dev_cap_flags, res->is_vf)) - qp_flags |= CMDQ_CREATE_QP_QP_FLAGS_EXT_STATS_ENABLED; - - req.qp_flags = cpu_to_le32(qp_flags); -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -index f231e886ad9d..9efd32a3dc55 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -@@ -846,7 +846,12 @@ int bnxt_qplib_qext_stat(struct bnxt_qplib_rcfw *rcfw, u32 fid, - - req.resp_size = sbuf.size / BNXT_QPLIB_CMDQE_UNITS; - req.resp_addr = cpu_to_le64(sbuf.dma_addr); -- req.function_id = cpu_to_le32(fid); -+ if (bnxt_qplib_is_chip_gen_p7(rcfw->res->cctx) && rcfw->res->is_vf) -+ req.function_id = -+ cpu_to_le32(CMDQ_QUERY_ROCE_STATS_EXT_VF_VALID | -+ (fid << CMDQ_QUERY_ROCE_STATS_EXT_VF_NUM_SFT)); -+ else -+ req.function_id = cpu_to_le32(fid); - req.flags = cpu_to_le16(CMDQ_QUERY_ROCE_STATS_EXT_FLAGS_FUNCTION_ID); - - bnxt_qplib_fill_cmdqmsg(&msg, &req, &resp, &sbuf, sizeof(req), --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1106-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch b/SOURCES/1106-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch deleted file mode 100644 index 320b6025e..000000000 --- a/SOURCES/1106-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch +++ /dev/null @@ -1,42 +0,0 @@ -From fd15899f1b6ab1026242424f9b3f9ba817c9656f Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 12 Aug 2025 16:35:35 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix size of uverbs_copy_to() in - BNXT_RE_METHOD_GET_TOGGLE_MEM - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 09d231ab569ca97478445ccc1ad44ab026de39b1 -Author: Kalesh AP -Date: Fri Jul 4 10:08:55 2025 +0530 - - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM - - Since both "length" and "offset" are of type u32, there is - no functional issue here. - - Reviewed-by: Saravanan Vajravel - Signed-off-by: Shravya KN - Signed-off-by: Kalesh AP - Link: https://patch.msgid.link/20250704043857.19158-2-kalesh-anakkur.purayil@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -index 063801384b2b..3a627acb82ce 100644 ---- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c -+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c -@@ -4738,7 +4738,7 @@ static int UVERBS_HANDLER(BNXT_RE_METHOD_GET_TOGGLE_MEM)(struct uverbs_attr_bund - return err; - - err = uverbs_copy_to(attrs, BNXT_RE_TOGGLE_MEM_MMAP_OFFSET, -- &offset, sizeof(length)); -+ &offset, sizeof(offset)); - if (err) - return err; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1107-rdma-bnxt-re-support-2g-message-size.patch b/SOURCES/1107-rdma-bnxt-re-support-2g-message-size.patch deleted file mode 100644 index b20f8dadb..000000000 --- a/SOURCES/1107-rdma-bnxt-re-support-2g-message-size.patch +++ /dev/null @@ -1,128 +0,0 @@ -From bae4a2298624cecd837e2deff15b915e6804f940 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 12 Aug 2025 16:35:48 -0700 -Subject: [PATCH] RDMA/bnxt_re: Support 2G message size - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 0aed817380d620987b2d5c573fdd2f01c30976a4 -Author: Selvin Xavier -Date: Fri Jul 4 10:08:56 2025 +0530 - - RDMA/bnxt_re: Support 2G message size - - bnxt_qplib_put_sges is calculating the length in - a signed int. So handling the 2G message size - is not working since it is considered as negative. - - Use a unsigned number to calculate the total message - length. As per the spec, IB message size shall be - between zero and 2^31 bytes (inclusive). So adding - a check for 2G message size. - - Signed-off-by: Selvin Xavier - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250704043857.19158-3-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Saravanan Vajravel - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -index be34c605d516..dfe3177123e5 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c -@@ -1750,9 +1750,9 @@ static void bnxt_qplib_fill_psn_search(struct bnxt_qplib_qp *qp, - } - } - --static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, -- struct bnxt_qplib_swqe *wqe, -- u16 *idx) -+static unsigned int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, -+ struct bnxt_qplib_swqe *wqe, -+ u32 *idx) - { - struct bnxt_qplib_hwq *hwq; - int len, t_len, offt; -@@ -1769,7 +1769,7 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, - il_src = (void *)wqe->sg_list[indx].addr; - t_len += len; - if (t_len > qp->max_inline_data) -- return -ENOMEM; -+ return BNXT_RE_INVAL_MSG_SIZE; - while (len) { - if (pull_dst) { - pull_dst = false; -@@ -1795,9 +1795,9 @@ static int bnxt_qplib_put_inline(struct bnxt_qplib_qp *qp, - return t_len; - } - --static u32 bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, -- struct bnxt_qplib_sge *ssge, -- u16 nsge, u16 *idx) -+static unsigned int bnxt_qplib_put_sges(struct bnxt_qplib_hwq *hwq, -+ struct bnxt_qplib_sge *ssge, -+ u32 nsge, u32 *idx) - { - struct sq_sge *dsge; - int indx, len = 0; -@@ -1878,14 +1878,12 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - struct bnxt_qplib_hwq *hwq; - struct bnxt_qplib_swq *swq; - bool sch_handler = false; -+ u32 wqe_idx, slots, idx; - u16 wqe_sz, qdf = 0; - bool msn_update; - void *base_hdr; - void *ext_hdr; - __le32 temp32; -- u32 wqe_idx; -- u32 slots; -- u16 idx; - - hwq = &sq->hwq; - if (qp->state != CMDQ_MODIFY_QP_NEW_STATE_RTS && -@@ -1937,8 +1935,10 @@ int bnxt_qplib_post_send(struct bnxt_qplib_qp *qp, - else - data_len = bnxt_qplib_put_sges(hwq, wqe->sg_list, wqe->num_sge, - &idx); -- if (data_len < 0) -- goto queue_err; -+ if (data_len > BNXT_RE_MAX_MSG_SIZE) { -+ rc = -EINVAL; -+ goto done; -+ } - /* Make sure we update MSN table only for wired wqes */ - msn_update = true; - /* Specifics */ -@@ -2139,8 +2139,8 @@ int bnxt_qplib_post_recv(struct bnxt_qplib_qp *qp, - struct bnxt_qplib_hwq *hwq; - struct bnxt_qplib_swq *swq; - bool sch_handler = false; -- u16 wqe_sz, idx; -- u32 wqe_idx; -+ u32 wqe_idx, idx; -+ u16 wqe_sz; - int rc = 0; - - hwq = &rq->hwq; -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.h b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -index 0d9487c889ff..ab125f1d949e 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_fp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.h -@@ -346,6 +346,9 @@ struct bnxt_qplib_qp { - u8 tos_dscp; - }; - -+#define BNXT_RE_MAX_MSG_SIZE 0x80000000 -+#define BNXT_RE_INVAL_MSG_SIZE 0xFFFFFFFF -+ - #define BNXT_QPLIB_MAX_CQE_ENTRY_SIZE sizeof(struct cq_base) - - #define CQE_CNT_PER_PG (PAGE_SIZE / BNXT_QPLIB_MAX_CQE_ENTRY_SIZE) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1108-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch b/SOURCES/1108-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch deleted file mode 100644 index 2e4be6f77..000000000 --- a/SOURCES/1108-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch +++ /dev/null @@ -1,54 +0,0 @@ -From ab6f51d337f71bac3f2fa37ef2508295fcf5323f Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 12 Aug 2025 16:36:00 -0700 -Subject: [PATCH] RDMA/bnxt_re: Use macro instead of hard coded value - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 7788278ff267f831bab39a377beaa7e08d79c2a9 -Author: Kalesh AP -Date: Fri Jul 4 10:08:57 2025 +0530 - - RDMA/bnxt_re: Use macro instead of hard coded value - - 1. Defined a macro for the hard coded value. - 2. "access" field in the request structure is of type "u8". - Updated the mask accordingly. - - Signed-off-by: Kalesh AP - Signed-off-by: Shravya KN - Link: https://patch.msgid.link/20250704043857.19158-4-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Hongguang Gao - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -index 9efd32a3dc55..68981399598d 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c -@@ -674,7 +674,7 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr, - req.log2_pbl_pg_size = cpu_to_le16(((ilog2(PAGE_SIZE) << - CMDQ_REGISTER_MR_LOG2_PBL_PG_SIZE_SFT) & - CMDQ_REGISTER_MR_LOG2_PBL_PG_SIZE_MASK)); -- req.access = (mr->access_flags & 0xFFFF); -+ req.access = (mr->access_flags & BNXT_QPLIB_MR_ACCESS_MASK); - req.va = cpu_to_le64(mr->va); - req.key = cpu_to_le32(mr->lkey); - if (_is_alloc_mr_unified(res->dattr->dev_cap_flags)) -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.h b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -index e626b05038a1..09faf4a1e849 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_sp.h -+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.h -@@ -111,6 +111,7 @@ struct bnxt_qplib_mrw { - struct bnxt_qplib_pd *pd; - int type; - u32 access_flags; -+#define BNXT_QPLIB_MR_ACCESS_MASK 0xFF - #define BNXT_QPLIB_FR_PMR 0x80000000 - u32 lkey; - u32 rkey; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1109-rdma-bnxt-re-congestion-control-settings-using-debugfs-hook.patch b/SOURCES/1109-rdma-bnxt-re-congestion-control-settings-using-debugfs-hook.patch deleted file mode 100644 index daa3686ce..000000000 --- a/SOURCES/1109-rdma-bnxt-re-congestion-control-settings-using-debugfs-hook.patch +++ /dev/null @@ -1,311 +0,0 @@ -From 8f82b5a5bc35f1760cc957cd20aa8d1b804f0076 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:28:40 -0700 -Subject: [PATCH] RDMA/bnxt_re: Congestion control settings using debugfs hook - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 656dff55da19eb889f2b1df5a5f2aa1d28f024fd -Author: Selvin Xavier -Date: Sun Jan 19 07:45:35 2025 -0800 - - RDMA/bnxt_re: Congestion control settings using debugfs hook - - Implements routines to set and get different settings of - the congestion control. This will enable the users to modify - the settings according to their network. - - Currently supporting only GEN 0 version of the parameters. - Reading these files queries the firmware and report the values - currently programmed. Writing to the files sends commands that - update the congestion control settings - - Signed-off-by: Selvin Xavier - Link: https://patch.msgid.link/1737301535-6599-1-git-send-email-selvin.xavier@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/bnxt_re.h b/drivers/infiniband/hw/bnxt_re/bnxt_re.h -index b758705e2062..6df5a2738c95 100644 ---- a/drivers/infiniband/hw/bnxt_re/bnxt_re.h -+++ b/drivers/infiniband/hw/bnxt_re/bnxt_re.h -@@ -225,6 +225,8 @@ struct bnxt_re_dev { - unsigned long event_bitmap; - struct bnxt_qplib_cc_param cc_param; - struct workqueue_struct *dcb_wq; -+ struct dentry *cc_config; -+ struct bnxt_re_dbg_cc_config_params *cc_config_params; - }; - - #define to_bnxt_re_dev(ptr, member) \ -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index 7c47039044ef..f4dd2fb51867 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -22,6 +22,23 @@ - - static struct dentry *bnxt_re_debugfs_root; - -+static const char * const bnxt_re_cc_gen0_name[] = { -+ "enable_cc", -+ "run_avg_weight_g", -+ "num_phase_per_state", -+ "init_cr", -+ "init_tr", -+ "tos_ecn", -+ "tos_dscp", -+ "alt_vlan_pcp", -+ "alt_vlan_dscp", -+ "rtt", -+ "cc_mode", -+ "tcp_cp", -+ "tx_queue", -+ "inactivity_cp", -+}; -+ - static inline const char *bnxt_re_qp_state_str(u8 state) - { - switch (state) { -@@ -110,19 +127,212 @@ void bnxt_re_debug_rem_qpinfo(struct bnxt_re_dev *rdev, struct bnxt_re_qp *qp) - debugfs_remove(qp->dentry); - } - -+static int map_cc_config_offset_gen0_ext0(u32 offset, struct bnxt_qplib_cc_param *ccparam, u32 *val) -+{ -+ u64 map_offset; -+ -+ map_offset = BIT(offset); -+ -+ switch (map_offset) { -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ENABLE_CC: -+ *val = ccparam->enable; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_G: -+ *val = ccparam->g; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_NUMPHASEPERSTATE: -+ *val = ccparam->nph_per_state; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INIT_CR: -+ *val = ccparam->init_cr; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INIT_TR: -+ *val = ccparam->init_tr; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TOS_ECN: -+ *val = ccparam->tos_ecn; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TOS_DSCP: -+ *val = ccparam->tos_dscp; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ALT_VLAN_PCP: -+ *val = ccparam->alt_vlan_pcp; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ALT_TOS_DSCP: -+ *val = ccparam->alt_tos_dscp; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_RTT: -+ *val = ccparam->rtt; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_CC_MODE: -+ *val = ccparam->cc_mode; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TCP_CP: -+ *val = ccparam->tcp_cp; -+ break; -+ default: -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ -+static ssize_t bnxt_re_cc_config_get(struct file *filp, char __user *buffer, -+ size_t usr_buf_len, loff_t *ppos) -+{ -+ struct bnxt_re_cc_param *dbg_cc_param = filp->private_data; -+ struct bnxt_re_dev *rdev = dbg_cc_param->rdev; -+ struct bnxt_qplib_cc_param ccparam = {}; -+ u32 offset = dbg_cc_param->offset; -+ char buf[16]; -+ u32 val; -+ int rc; -+ -+ rc = bnxt_qplib_query_cc_param(&rdev->qplib_res, &ccparam); -+ if (rc) -+ return rc; -+ -+ rc = map_cc_config_offset_gen0_ext0(offset, &ccparam, &val); -+ if (rc) -+ return rc; -+ -+ rc = snprintf(buf, sizeof(buf), "%d\n", val); -+ if (rc < 0) -+ return rc; -+ -+ return simple_read_from_buffer(buffer, usr_buf_len, ppos, (u8 *)(buf), rc); -+} -+ -+static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offset, u32 val) -+{ -+ u32 modify_mask; -+ -+ modify_mask = BIT(offset); -+ -+ switch (modify_mask) { -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ENABLE_CC: -+ ccparam->enable = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_G: -+ ccparam->g = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_NUMPHASEPERSTATE: -+ ccparam->nph_per_state = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INIT_CR: -+ ccparam->init_cr = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INIT_TR: -+ ccparam->init_tr = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TOS_ECN: -+ ccparam->tos_ecn = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TOS_DSCP: -+ ccparam->tos_dscp = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ALT_VLAN_PCP: -+ ccparam->alt_vlan_pcp = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_ALT_TOS_DSCP: -+ ccparam->alt_tos_dscp = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_RTT: -+ ccparam->rtt = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_CC_MODE: -+ ccparam->cc_mode = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TCP_CP: -+ ccparam->tcp_cp = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE: -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TIME_PER_PHASE: -+ ccparam->time_pph = val; -+ break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_PKTS_PER_PHASE: -+ ccparam->pkts_pph = val; -+ break; -+ } -+ -+ ccparam->mask = modify_mask; -+} -+ -+static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offset, u32 val) -+{ -+ struct bnxt_qplib_cc_param ccparam = { }; -+ -+ /* Supporting only Gen 0 now */ -+ if (gen_ext != CC_CONFIG_GEN0_EXT0) -+ bnxt_re_fill_gen0_ext0(&ccparam, offset, val); -+ else -+ return -EINVAL; -+ -+ bnxt_qplib_modify_cc(&rdev->qplib_res, &ccparam); -+ return 0; -+} -+ -+static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffer, -+ size_t count, loff_t *ppos) -+{ -+ struct bnxt_re_cc_param *dbg_cc_param = filp->private_data; -+ struct bnxt_re_dev *rdev = dbg_cc_param->rdev; -+ u32 offset = dbg_cc_param->offset; -+ u8 cc_gen = dbg_cc_param->cc_gen; -+ char buf[16]; -+ u32 val; -+ int rc; -+ -+ if (copy_from_user(buf, buffer, count)) -+ return -EFAULT; -+ -+ buf[count] = '\0'; -+ if (kstrtou32(buf, 0, &val)) -+ return -EINVAL; -+ -+ rc = bnxt_re_configure_cc(rdev, cc_gen, offset, val); -+ return rc ? rc : count; -+} -+ -+static const struct file_operations bnxt_re_cc_config_ops = { -+ .owner = THIS_MODULE, -+ .open = simple_open, -+ .read = bnxt_re_cc_config_get, -+ .write = bnxt_re_cc_config_set, -+}; -+ - void bnxt_re_debugfs_add_pdev(struct bnxt_re_dev *rdev) - { - struct pci_dev *pdev = rdev->en_dev->pdev; -+ struct bnxt_re_dbg_cc_config_params *cc_params; -+ int i; - - rdev->dbg_root = debugfs_create_dir(dev_name(&pdev->dev), bnxt_re_debugfs_root); - - rdev->qp_debugfs = debugfs_create_dir("QPs", rdev->dbg_root); -+ rdev->cc_config = debugfs_create_dir("cc_config", rdev->dbg_root); -+ -+ rdev->cc_config_params = kzalloc(sizeof(*cc_params), GFP_KERNEL); -+ -+ for (i = 0; i < BNXT_RE_CC_PARAM_GEN0; i++) { -+ struct bnxt_re_cc_param *tmp_params = &rdev->cc_config_params->gen0_parms[i]; -+ -+ tmp_params->rdev = rdev; -+ tmp_params->offset = i; -+ tmp_params->cc_gen = CC_CONFIG_GEN0_EXT0; -+ tmp_params->dentry = debugfs_create_file(bnxt_re_cc_gen0_name[i], 0400, -+ rdev->cc_config, tmp_params, -+ &bnxt_re_cc_config_ops); -+ } - } - - void bnxt_re_debugfs_rem_pdev(struct bnxt_re_dev *rdev) - { - debugfs_remove_recursive(rdev->qp_debugfs); -- -+ debugfs_remove_recursive(rdev->cc_config); -+ kfree(rdev->cc_config_params); - debugfs_remove_recursive(rdev->dbg_root); - rdev->dbg_root = NULL; - } -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.h b/drivers/infiniband/hw/bnxt_re/debugfs.h -index cd3be0a9ec7e..8f101df4e838 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.h -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.h -@@ -18,4 +18,19 @@ void bnxt_re_debugfs_rem_pdev(struct bnxt_re_dev *rdev); - void bnxt_re_register_debugfs(void); - void bnxt_re_unregister_debugfs(void); - -+#define CC_CONFIG_GEN_EXT(x, y) (((x) << 16) | (y)) -+#define CC_CONFIG_GEN0_EXT0 CC_CONFIG_GEN_EXT(0, 0) -+ -+#define BNXT_RE_CC_PARAM_GEN0 14 -+ -+struct bnxt_re_cc_param { -+ struct bnxt_re_dev *rdev; -+ struct dentry *dentry; -+ u32 offset; -+ u8 cc_gen; -+}; -+ -+struct bnxt_re_dbg_cc_config_params { -+ struct bnxt_re_cc_param gen0_parms[BNXT_RE_CC_PARAM_GEN0]; -+}; - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1110-rdma-bnxt-re-fix-buffer-overflow-in-debugfs-code.patch b/SOURCES/1110-rdma-bnxt-re-fix-buffer-overflow-in-debugfs-code.patch deleted file mode 100644 index c351e02b7..000000000 --- a/SOURCES/1110-rdma-bnxt-re-fix-buffer-overflow-in-debugfs-code.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 62a794efee2f8717d599696c8e1933b675c727e9 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:30:09 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix buffer overflow in debugfs code - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit dbc641ecf1cbd41a649e7ac6ea7175562ef599b2 -Author: Dan Carpenter -Date: Fri Feb 7 12:16:19 2025 +0300 - - RDMA/bnxt_re: Fix buffer overflow in debugfs code - - Add some bounds checking to prevent memory corruption in - bnxt_re_cc_config_set(). This is debugfs code so the bug can only be - triggered by root. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Dan Carpenter - Link: https://patch.msgid.link/a6b081ab-55fe-4d0c-8f69-c5e5a59e9141@stanley.mountain - Acked-by: Selvin Xavier - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index f4dd2fb51867..d7354e7753fe 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe - u32 val; - int rc; - -+ if (count >= sizeof(buf)) -+ return -EINVAL; -+ - if (copy_from_user(buf, buffer, count)) - return -EFAULT; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1111-rdma-bnxt-re-fix-the-condition-check-while-programming-conge.patch b/SOURCES/1111-rdma-bnxt-re-fix-the-condition-check-while-programming-conge.patch deleted file mode 100644 index a7ce6b4db..000000000 --- a/SOURCES/1111-rdma-bnxt-re-fix-the-condition-check-while-programming-conge.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 01d9de21a2cdbcaf02378da7cb143a2c5b84547a Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:31:21 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix the condition check while programming - congestion control - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit f26e648a978ae7958e0958095768363c851a736d -Author: Selvin Xavier -Date: Sat Feb 8 05:48:26 2025 -0800 - - RDMA/bnxt_re: Fix the condition check while programming congestion control - - Program the Congestion control values when the CC gen matches. - Fix the condition check for the same. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Reported-by: Kalesh AP - Reported-by: Chengchang Tang - Signed-off-by: Selvin Xavier - Link: https://patch.msgid.link/1739022506-8937-1-git-send-email-selvin.xavier@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index d7354e7753fe..af91d16c3c77 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -265,7 +265,7 @@ static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offse - struct bnxt_qplib_cc_param ccparam = { }; - - /* Supporting only Gen 0 now */ -- if (gen_ext != CC_CONFIG_GEN0_EXT0) -+ if (gen_ext == CC_CONFIG_GEN0_EXT0) - bnxt_re_fill_gen0_ext0(&ccparam, offset, val); - else - return -EINVAL; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch b/SOURCES/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch deleted file mode 100644 index 5008cc1f4..000000000 --- a/SOURCES/1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 1938524b38203de2db0bbd8ffffbc96bf23a5e9b Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:32:40 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix incorrect display of inactivity_cp in - debugfs output - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 58d7a965bb2b014d467445d38cdb07099b1f0f77 -Author: Gautam R A -Date: Tue May 20 09:29:07 2025 +0530 - - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output - - The inactivity_cp parameter in debugfs was not being read or - written correctly, resulting in "Invalid argument" errors. - - Fixed this by ensuring proper mapping of inactivity_cp in - both the map_cc_config_offset_gen0_ext0 and - bnxt_re_fill_gen0_ext0() functions. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Gautam R A - Link: https://patch.msgid.link/20250520035910.1061918-2-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index af91d16c3c77..a3aad6c3dbec 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -170,6 +170,9 @@ static int map_cc_config_offset_gen0_ext0(u32 offset, struct bnxt_qplib_cc_param - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TCP_CP: - *val = ccparam->tcp_cp; - break; -+ case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: -+ *val = ccparam->inact_th; -+ break; - default: - return -EINVAL; - } -@@ -247,7 +250,9 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - ccparam->tcp_cp = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE: -+ break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: -+ ccparam->inact_th = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TIME_PER_PHASE: - ccparam->time_pph = val; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch b/SOURCES/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch deleted file mode 100644 index 96e72f32d..000000000 --- a/SOURCES/1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch +++ /dev/null @@ -1,80 +0,0 @@ -From bc635dde20a74550cf70a2e7f5b25ce3f07db3ed Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:32:52 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix missing error handling for tx_queue - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit e3d57a00d4d1f36689e9eab80b60d5024361efec -Author: Gautam R A -Date: Tue May 20 09:29:08 2025 +0530 - - RDMA/bnxt_re: Fix missing error handling for tx_queue - - bnxt_re_fill_gen0_ext0() did not return an error when - attempting to modify CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE, - leading to silent failures. - - Fixed this by returning -EOPNOTSUPP for tx_queue modifications and - ensuring proper error propagation in bnxt_re_configure_cc(). - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Gautam R A - Link: https://patch.msgid.link/20250520035910.1061918-3-kalesh-anakkur.purayil@broadcom.com - Reviewed-by: Kalesh AP - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index a3aad6c3dbec..9f6392155d91 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -206,7 +206,7 @@ static ssize_t bnxt_re_cc_config_get(struct file *filp, char __user *buffer, - return simple_read_from_buffer(buffer, usr_buf_len, ppos, (u8 *)(buf), rc); - } - --static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offset, u32 val) -+static int bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offset, u32 val) - { - u32 modify_mask; - -@@ -250,7 +250,7 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - ccparam->tcp_cp = val; - break; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_TX_QUEUE: -- break; -+ return -EOPNOTSUPP; - case CMDQ_MODIFY_ROCE_CC_MODIFY_MASK_INACTIVITY_CP: - ccparam->inact_th = val; - break; -@@ -263,18 +263,21 @@ static void bnxt_re_fill_gen0_ext0(struct bnxt_qplib_cc_param *ccparam, u32 offs - } - - ccparam->mask = modify_mask; -+ return 0; - } - - static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offset, u32 val) - { - struct bnxt_qplib_cc_param ccparam = { }; -+ int rc; - -- /* Supporting only Gen 0 now */ -- if (gen_ext == CC_CONFIG_GEN0_EXT0) -- bnxt_re_fill_gen0_ext0(&ccparam, offset, val); -- else -+ if (gen_ext != CC_CONFIG_GEN0_EXT0) - return -EINVAL; - -+ rc = bnxt_re_fill_gen0_ext0(&ccparam, offset, val); -+ if (rc) -+ return rc; -+ - bnxt_qplib_modify_cc(&rdev->qplib_res, &ccparam); - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch b/SOURCES/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch deleted file mode 100644 index 03da2a23e..000000000 --- a/SOURCES/1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch +++ /dev/null @@ -1,43 +0,0 @@ -From a646adda44acd8b4eca1b95ed00609a27bbd390c Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:32:59 -0700 -Subject: [PATCH] RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit 990b5c07f677a0b633b41130a70771337c18343e -Author: Kalesh AP -Date: Tue May 20 09:29:09 2025 +0530 - - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc - - Driver currently supports modifying GEN0_EXT0 CC parameters - through debugfs hook. - - Fixed to return -EOPNOTSUPP instead of -EINVAL in bnxt_re_configure_cc() - when the user tries to modify any other CC parameters. - - Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook") - Signed-off-by: Kalesh AP - Link: https://patch.msgid.link/20250520035910.1061918-4-kalesh-anakkur.purayil@broadcom.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c -index 9f6392155d91..e632f1661b92 100644 ---- a/drivers/infiniband/hw/bnxt_re/debugfs.c -+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c -@@ -272,7 +272,7 @@ static int bnxt_re_configure_cc(struct bnxt_re_dev *rdev, u32 gen_ext, u32 offse - int rc; - - if (gen_ext != CC_CONFIG_GEN0_EXT0) -- return -EINVAL; -+ return -EOPNOTSUPP; - - rc = bnxt_re_fill_gen0_ext0(&ccparam, offset, val); - if (rc) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch b/SOURCES/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch deleted file mode 100644 index d82a931ae..000000000 --- a/SOURCES/1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 489b805b61b98f02178efdbe33f9d3f11f039fd0 Mon Sep 17 00:00:00 2001 -From: Sreekanth Reddy -Date: Tue, 19 Aug 2025 14:33:06 -0700 -Subject: [PATCH] RDMA/bnxt_re: convert timeouts to secs_to_jiffies() - -JIRA: https://issues.redhat.com/browse/RHEL-108696 -JIRA: https://issues.redhat.com/browse/RHEL-96539 - -commit f873136416293b786e7611d36226c9f5a8f6d20b -Author: Easwar Hariharan -Date: Tue Feb 25 20:17:30 2025 +0000 - - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() - - Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced - secs_to_jiffies(). As the value here is a multiple of 1000, use - secs_to_jiffies() instead of msecs_to_jiffies() to avoid the - multiplication - - This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with - the following Coccinelle rules: - - @depends on patch@ - expression E; - @@ - - -msecs_to_jiffies - +secs_to_jiffies - (E - - * \( 1000 \| MSEC_PER_SEC \) - ) - - Link: https://lkml.kernel.org/r/20250225-converge-secs-to-jiffies-part-two-v3-16-a43967e36c88@linux.microsoft.com - Signed-off-by: Easwar Hariharan - Cc: Carlos Maiolino - Cc: Carlos Maiolino - Cc: Chris Mason - Cc: Christoph Hellwig - Cc: Damien Le Maol - Cc: "Darrick J. Wong" - Cc: David Sterba - Cc: Dick Kennedy - Cc: Dongsheng Yang - Cc: Fabio Estevam - Cc: Frank Li - Cc: Hans de Goede - Cc: Henrique de Moraes Holschuh - Cc: Ilpo Jarvinen - Cc: Ilya Dryomov - Cc: James Bottomley - Cc: James Smart - Cc: Jaroslav Kysela - Cc: Jason Gunthorpe - Cc: Jens Axboe - Cc: Josef Bacik - Cc: Julia Lawall - Cc: Kalesh Anakkur Purayil - Cc: Keith Busch - Cc: Leon Romanovsky - Cc: Marc Kleine-Budde - Cc: Mark Brown - Cc: "Martin K. Petersen" - Cc: Nicolas Palix - Cc: Niklas Cassel - Cc: Oded Gabbay - Cc: Sagi Grimberg - Cc: Sascha Hauer - Cc: Sebastian Reichel - Cc: Selvin Thyparampil Xavier - Cc: Shawn Guo - Cc: Shyam-sundar S-k - Cc: Takashi Iwai - Cc: Takashi Iwai - Cc: Xiubo Li - Signed-off-by: Andrew Morton - -Signed-off-by: Sreekanth Reddy - -diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -index d23074383428..804bc773b4ef 100644 ---- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -+++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c -@@ -160,7 +160,7 @@ static int __wait_for_resp(struct bnxt_qplib_rcfw *rcfw, u16 cookie) - wait_event_timeout(cmdq->waitq, - !crsqe->is_in_used || - test_bit(ERR_DEVICE_DETACHED, &cmdq->flags), -- msecs_to_jiffies(rcfw->max_timeout * 1000)); -+ secs_to_jiffies(rcfw->max_timeout)); - - if (!crsqe->is_in_used) - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1116-ionic-fix-persistent-mac-address-override-on-pf.patch b/SOURCES/1116-ionic-fix-persistent-mac-address-override-on-pf.patch deleted file mode 100644 index fe65a1600..000000000 --- a/SOURCES/1116-ionic-fix-persistent-mac-address-override-on-pf.patch +++ /dev/null @@ -1,60 +0,0 @@ -From cbcb3cfcdc436d6f91a3d95ecfa9c831abe14aed Mon Sep 17 00:00:00 2001 -From: Mohammad Heib -Date: Tue, 17 Mar 2026 19:08:06 +0200 -Subject: [PATCH] ionic: fix persistent MAC address override on PF - -The use of IONIC_CMD_LIF_SETATTR in the MAC address update path causes -the ionic firmware to update the LIF's identity in its persistent state. -Since the firmware state is maintained across host warm boots and driver -reloads, any MAC change on the Physical Function (PF) becomes "sticky. - -This is problematic because it causes ethtool -P to report the -user-configured MAC as the permanent factory address, which breaks -system management tools that rely on a stable hardware identity. - -While Virtual Functions (VFs) need this hardware-level programming to -properly handle MAC assignments in guest environments, the PF should -maintain standard transient behavior. This patch gates the -ionic_program_mac call using is_virtfn so that PF MAC changes remain -local to the netdev filters and do not overwrite the firmware's -permanent identity block. - -Fixes: 19058be7c48c ("ionic: VF initial random MAC address if no assigned mac") -Signed-off-by: Mohammad Heib -Reviewed-by: Simon Horman -Reviewed-by: Brett Creeley -Link: https://patch.msgid.link/20260317170806.35390-1-mheib@redhat.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -index 8d040e611d5a..637e635bbf03 100644 ---- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c -+++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c -@@ -1719,13 +1719,18 @@ static int ionic_set_mac_address(struct net_device *netdev, void *sa) - if (ether_addr_equal(netdev->dev_addr, mac)) - return 0; - -- err = ionic_program_mac(lif, mac); -- if (err < 0) -- return err; -+ /* Only program macs for virtual functions to avoid losing the permanent -+ * Mac across warm reset/reboot. -+ */ -+ if (lif->ionic->pdev->is_virtfn) { -+ err = ionic_program_mac(lif, mac); -+ if (err < 0) -+ return err; - -- if (err > 0) -- netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n", -- __func__); -+ if (err > 0) -+ netdev_dbg(netdev, "%s: SET and GET ATTR Mac are not equal-due to old FW running\n", -+ __func__); -+ } - - err = eth_prepare_mac_addr_change(netdev, addr); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1117-smb-client-fix-krb5-mount-with-username-option.patch b/SOURCES/1117-smb-client-fix-krb5-mount-with-username-option.patch deleted file mode 100644 index e07c51c65..000000000 --- a/SOURCES/1117-smb-client-fix-krb5-mount-with-username-option.patch +++ /dev/null @@ -1,74 +0,0 @@ -From def2d2719295c70f747e7bd1cb56fc51992c6977 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 23 Mar 2026 19:10:59 -0300 -Subject: [PATCH] smb: client: fix krb5 mount with username option - -JIRA: https://issues.redhat.com/browse/RHEL-156455 - -commit 12b4c5d98cd7ca46d5035a57bcd995df614c14e1 -Author: Paulo Alcantara -Date: Fri Mar 13 00:03:38 2026 -0300 - - smb: client: fix krb5 mount with username option - - Customer reported that some of their krb5 mounts were failing against - a single server as the client was trying to mount the shares with - wrong credentials. It turned out the client was reusing SMB session - from first mount to try mounting the other shares, even though a - different username= option had been specified to the other mounts. - - By using username mount option along with sec=krb5 to search for - principals from keytab is supported by cifs.upcall(8) since - cifs-utils-4.8. So fix this by matching username mount option in - match_session() even with Kerberos. - - For example, the second mount below should fail with -ENOKEY as there - is no 'foobar' principal in keytab (/etc/krb5.keytab). The client - ends up reusing SMB session from first mount to perform the second - one, which is wrong. - - ``` - $ ktutil - ktutil: add_entry -password -p testuser -k 1 -e aes256-cts - Password for testuser@ZELDA.TEST: - ktutil: write_kt /etc/krb5.keytab - ktutil: quit - $ klist -ke - Keytab name: FILE:/etc/krb5.keytab - KVNO Principal - ---- ---------------------------------------------------------------- - 1 testuser@ZELDA.TEST (aes256-cts-hmac-sha1-96) - $ mount.cifs //w22-root2/scratch /mnt/1 -o sec=krb5,username=testuser - $ mount.cifs //w22-root2/scratch /mnt/2 -o sec=krb5,username=foobar - $ mount -t cifs | grep -Po 'username=\K\w+' - testuser - testuser - ``` - - Reported-by: Oscar Santos - Signed-off-by: Paulo Alcantara (Red Hat) - Cc: David Howells - Cc: linux-cifs@vger.kernel.org - Cc: stable@vger.kernel.org - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/connect.c b/fs/smb/client/connect.c -index 3e06f59ba8ad..0c2dea25572d 100644 ---- a/fs/smb/client/connect.c -+++ b/fs/smb/client/connect.c -@@ -1954,6 +1954,10 @@ static int match_session(struct cifs_ses *ses, - case Kerberos: - if (!uid_eq(ctx->cred_uid, ses->cred_uid)) - return 0; -+ if (strncmp(ses->user_name ?: "", -+ ctx->username ?: "", -+ CIFS_MAX_USERNAME_LEN)) -+ return 0; - break; - case NTLMv2: - case RawNTLMSSP: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1118-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch b/SOURCES/1118-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch deleted file mode 100644 index e15e66848..000000000 --- a/SOURCES/1118-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch +++ /dev/null @@ -1,54 +0,0 @@ -From b05914e695853c3784f3fd1b588cabc025cf4337 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 26 Mar 2026 20:21:27 +0000 -Subject: [PATCH] scsi: qla2xxx: Fix improper freeing of purex item - -JIRA: https://redhat.atlassian.net/browse/RHEL-161149 -CVE: CVE-2025-68741 - -commit 78b1a242fe612a755f2158fd206ee6bb577d18ca -Author: Zilin Guan -Date: Thu Nov 13 15:12:46 2025 +0000 - - scsi: qla2xxx: Fix improper freeing of purex item - - In qla2xxx_process_purls_iocb(), an item is allocated via - qla27xx_copy_multiple_pkt(), which internally calls - qla24xx_alloc_purex_item(). - - The qla24xx_alloc_purex_item() function may return a pre-allocated item - from a per-adapter pool for small allocations, instead of dynamically - allocating memory with kzalloc(). - - An error handling path in qla2xxx_process_purls_iocb() incorrectly uses - kfree() to release the item. If the item was from the pre-allocated - pool, calling kfree() on it is a bug that can lead to memory corruption. - - Fix this by using the correct deallocation function, - qla24xx_free_purex_item(), which properly handles both dynamically - allocated and pre-allocated items. - - Fixes: 875386b98857 ("scsi: qla2xxx: Add Unsolicited LS Request and Response Support for NVMe") - Signed-off-by: Zilin Guan - Reviewed-by: Himanshu Madhani - Link: https://patch.msgid.link/20251113151246.762510-1-zilin@seu.edu.cn - Signed-off-by: Martin K. Petersen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c -index 8ee2e337c9e1..6ecf3da765aa 100644 ---- a/drivers/scsi/qla2xxx/qla_nvme.c -+++ b/drivers/scsi/qla2xxx/qla_nvme.c -@@ -1292,7 +1292,7 @@ void qla2xxx_process_purls_iocb(void **pkt, struct rsp_que **rsp) - a.reason = FCNVME_RJT_RC_LOGIC; - a.explanation = FCNVME_RJT_EXP_NONE; - xmt_reject = true; -- kfree(item); -+ qla24xx_free_purex_item(item); - goto out; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1119-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch b/SOURCES/1119-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch deleted file mode 100644 index d35720fd0..000000000 --- a/SOURCES/1119-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 5133b61aaf437e5f25b1b396b14242a6bb0508e2 Mon Sep 17 00:00:00 2001 -From: Jeff Layton -Date: Tue, 24 Feb 2026 11:33:35 -0500 -Subject: [PATCH] nfsd: fix heap overflow in NFSv4.0 LOCK replay cache - -The NFSv4.0 replay cache uses a fixed 112-byte inline buffer -(rp_ibuf[NFSD4_REPLAY_ISIZE]) to store encoded operation responses. -This size was calculated based on OPEN responses and does not account -for LOCK denied responses, which include the conflicting lock owner as -a variable-length field up to 1024 bytes (NFS4_OPAQUE_LIMIT). - -When a LOCK operation is denied due to a conflict with an existing lock -that has a large owner, nfsd4_encode_operation() copies the full encoded -response into the undersized replay buffer via read_bytes_from_xdr_buf() -with no bounds check. This results in a slab-out-of-bounds write of up -to 944 bytes past the end of the buffer, corrupting adjacent heap memory. - -This can be triggered remotely by an unauthenticated attacker with two -cooperating NFSv4.0 clients: one sets a lock with a large owner string, -then the other requests a conflicting lock to provoke the denial. - -We could fix this by increasing NFSD4_REPLAY_ISIZE to allow for a full -opaque, but that would increase the size of every stateowner, when most -lockowners are not that large. - -Instead, fix this by checking the encoded response length against -NFSD4_REPLAY_ISIZE before copying into the replay buffer. If the -response is too large, set rp_buflen to 0 to skip caching the replay -payload. The status is still cached, and the client already received the -correct response on the original request. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Cc: stable@kernel.org -Reported-by: Nicholas Carlini -Tested-by: Nicholas Carlini -Signed-off-by: Jeff Layton -Signed-off-by: Chuck Lever - -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index 5172dbd0cb05..fa16b34fae50 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -6281,9 +6281,14 @@ nfsd4_encode_operation(struct nfsd4_compoundres *resp, struct nfsd4_op *op) - int len = xdr->buf->len - (op_status_offset + XDR_UNIT); - - so->so_replay.rp_status = op->status; -- so->so_replay.rp_buflen = len; -- read_bytes_from_xdr_buf(xdr->buf, op_status_offset + XDR_UNIT, -+ if (len <= NFSD4_REPLAY_ISIZE) { -+ so->so_replay.rp_buflen = len; -+ read_bytes_from_xdr_buf(xdr->buf, -+ op_status_offset + XDR_UNIT, - so->so_replay.rp_buf, len); -+ } else { -+ so->so_replay.rp_buflen = 0; -+ } - } - status: - op->status = nfsd4_map_status(op->status, -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index 6fcbf1e427d4..c0ca115c3b74 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -541,11 +541,18 @@ struct nfs4_client_reclaim { - struct xdr_netobj cr_princhash; - }; - --/* A reasonable value for REPLAY_ISIZE was estimated as follows: -- * The OPEN response, typically the largest, requires -- * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + 8(verifier) + -- * 4(deleg. type) + 8(deleg. stateid) + 4(deleg. recall flag) + -- * 20(deleg. space limit) + ~32(deleg. ace) = 112 bytes -+/* -+ * REPLAY_ISIZE is sized for an OPEN response with delegation: -+ * 4(status) + 8(stateid) + 20(changeinfo) + 4(rflags) + -+ * 8(verifier) + 4(deleg. type) + 8(deleg. stateid) + -+ * 4(deleg. recall flag) + 20(deleg. space limit) + -+ * ~32(deleg. ace) = 112 bytes -+ * -+ * Some responses can exceed this. A LOCK denial includes the conflicting -+ * lock owner, which can be up to 1024 bytes (NFS4_OPAQUE_LIMIT). Responses -+ * larger than REPLAY_ISIZE are not cached in rp_ibuf; only rp_status is -+ * saved. Enlarging this constant increases the size of every -+ * nfs4_stateowner. - */ - - #define NFSD4_REPLAY_ISIZE 112 --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1120-net-add-skb-header-pointer-careful-helper.patch b/SOURCES/1120-net-add-skb-header-pointer-careful-helper.patch deleted file mode 100644 index 5971b777e..000000000 --- a/SOURCES/1120-net-add-skb-header-pointer-careful-helper.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 13e00fdc9236bd4d0bff4109d2983171fbcb74c4 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 28 Jan 2026 14:15:38 +0000 -Subject: [PATCH] net: add skb_header_pointer_careful() helper - -This variant of skb_header_pointer() should be used in contexts -where @offset argument is user-controlled and could be negative. - -Negative offsets are supported, as long as the zone starts -between skb->head and skb->data. - -Signed-off-by: Eric Dumazet -Link: https://patch.msgid.link/20260128141539.3404400-2-edumazet@google.com -Signed-off-by: Jakub Kicinski - - -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 3f4decc..574edae 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -4043,6 +4043,18 @@ skb_header_pointer(const struct sk_buff *skb, int offset, int len, void *buffer) - skb_headlen(skb), buffer); - } - -+/* Variant of skb_header_pointer() where @offset is user-controlled -+ * and potentially negative. -+ */ -+static inline void * __must_check -+skb_header_pointer_careful(const struct sk_buff *skb, int offset, -+ int len, void *buffer) -+{ -+ if (unlikely(offset < 0 && -offset > skb_headroom(skb))) -+ return NULL; -+ return skb_header_pointer(skb, offset, len, buffer); -+} -+ - /** - * skb_needs_linearize - check if we need to linearize a given skb - * depending on the given device features. diff --git a/SOURCES/1121-net-sched-cls-u32-use-skb-header-pointer-careful.patch b/SOURCES/1121-net-sched-cls-u32-use-skb-header-pointer-careful.patch deleted file mode 100644 index 43a92a820..000000000 --- a/SOURCES/1121-net-sched-cls-u32-use-skb-header-pointer-careful.patch +++ /dev/null @@ -1,62 +0,0 @@ -From cabd1a976375780dabab888784e356f574bbaed8 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Wed, 28 Jan 2026 14:15:39 +0000 -Subject: [PATCH] net/sched: cls_u32: use skb_header_pointer_careful() - -skb_header_pointer() does not fully validate negative @offset values. - -Use skb_header_pointer_careful() instead. - -GangMin Kim provided a report and a repro fooling u32_classify(): - -BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 -net/sched/cls_u32.c:221 - -Fixes: fbc2e7d9cf49 ("cls_u32: use skb_header_pointer() to dereference data safely") -Reported-by: GangMin Kim -Closes: https://lore.kernel.org/netdev/CANn89iJkyUZ=mAzLzC4GdcAgLuPnUoivdLaOs6B9rq5_erj76w@mail.gmail.com/T/ -Signed-off-by: Eric Dumazet -Link: https://patch.msgid.link/20260128141539.3404400-3-edumazet@google.com -Signed-off-by: Jakub Kicinski - -diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c -index 2a1c00048fd6..58e849c0acf4 100644 ---- a/net/sched/cls_u32.c -+++ b/net/sched/cls_u32.c -@@ -161,10 +161,8 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb, - int toff = off + key->off + (off2 & key->offmask); - __be32 *data, hdata; - -- if (skb_headroom(skb) + toff > INT_MAX) -- goto out; -- -- data = skb_header_pointer(skb, toff, 4, &hdata); -+ data = skb_header_pointer_careful(skb, toff, 4, -+ &hdata); - if (!data) - goto out; - if ((*data ^ key->val) & key->mask) { -@@ -214,8 +212,9 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb, - if (ht->divisor) { - __be32 *data, hdata; - -- data = skb_header_pointer(skb, off + n->sel.hoff, 4, -- &hdata); -+ data = skb_header_pointer_careful(skb, -+ off + n->sel.hoff, -+ 4, &hdata); - if (!data) - goto out; - sel = ht->divisor & u32_hash_fold(*data, &n->sel, -@@ -229,7 +228,7 @@ TC_INDIRECT_SCOPE int u32_classify(struct sk_buff *skb, - if (n->sel.flags & TC_U32_VAROFFSET) { - __be16 *data, hdata; - -- data = skb_header_pointer(skb, -+ data = skb_header_pointer_careful(skb, - off + n->sel.offoff, - 2, &hdata); - if (!data) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1122-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch b/SOURCES/1122-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch deleted file mode 100644 index d43cb3661..000000000 --- a/SOURCES/1122-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 11cb63b0d1a0685e0831ae3c77223e002ef18189 Mon Sep 17 00:00:00 2001 -From: Victor Nogueira -Date: Wed, 25 Feb 2026 10:43:48 -0300 -Subject: [PATCH] net/sched: Only allow act_ct to bind to clsact/ingress qdiscs - and shared blocks - -As Paolo said earlier [1]: - -"Since the blamed commit below, classify can return TC_ACT_CONSUMED while -the current skb being held by the defragmentation engine. As reported by -GangMin Kim, if such packet is that may cause a UaF when the defrag engine -later on tries to tuch again such packet." - -act_ct was never meant to be used in the egress path, however some users -are attaching it to egress today [2]. Attempting to reach a middle -ground, we noticed that, while most qdiscs are not handling -TC_ACT_CONSUMED, clsact/ingress qdiscs are. With that in mind, we -address the issue by only allowing act_ct to bind to clsact/ingress -qdiscs and shared blocks. That way it's still possible to attach act_ct to -egress (albeit only with clsact). - -[1] https://lore.kernel.org/netdev/674b8cbfc385c6f37fb29a1de08d8fe5c2b0fbee.1771321118.git.pabeni@redhat.com/ -[2] https://lore.kernel.org/netdev/cc6bfb4a-4a2b-42d8-b9ce-7ef6644fb22b@ovn.org/ - -Reported-by: GangMin Kim -Fixes: 3f14b377d01d ("net/sched: act_ct: fix skb leak and crash on ooo frags") -CC: stable@vger.kernel.org -Signed-off-by: Victor Nogueira -Acked-by: Jamal Hadi Salim -Link: https://patch.msgid.link/20260225134349.1287037-1-victor@mojatatu.com -Signed-off-by: Jakub Kicinski - -diff --git a/include/net/act_api.h b/include/net/act_api.h -index e1e8f0f7dacb..d11b79107930 100644 ---- a/include/net/act_api.h -+++ b/include/net/act_api.h -@@ -70,6 +70,7 @@ struct tc_action { - #define TCA_ACT_FLAGS_REPLACE (1U << (TCA_ACT_FLAGS_USER_BITS + 2)) - #define TCA_ACT_FLAGS_NO_RTNL (1U << (TCA_ACT_FLAGS_USER_BITS + 3)) - #define TCA_ACT_FLAGS_AT_INGRESS (1U << (TCA_ACT_FLAGS_USER_BITS + 4)) -+#define TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT (1U << (TCA_ACT_FLAGS_USER_BITS + 5)) - - /* Update lastuse only if needed, to avoid dirtying a cache line. - * We use a temp variable to avoid fetching jiffies twice. -diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c -index bd51522c7953..7d5e50c921a0 100644 ---- a/net/sched/act_ct.c -+++ b/net/sched/act_ct.c -@@ -1360,6 +1360,12 @@ static int tcf_ct_init(struct net *net, struct nlattr *nla, - return -EINVAL; - } - -+ if (bind && !(flags & TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Attaching ct to a non ingress/clsact qdisc is unsupported"); -+ return -EOPNOTSUPP; -+ } -+ - err = nla_parse_nested(tb, TCA_CT_MAX, nla, ct_policy, extack); - if (err < 0) - return err; -diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c -index 343309e9009b..4829c27446e3 100644 ---- a/net/sched/cls_api.c -+++ b/net/sched/cls_api.c -@@ -2228,6 +2228,11 @@ static bool is_qdisc_ingress(__u32 classid) - return (TC_H_MIN(classid) == TC_H_MIN(TC_H_MIN_INGRESS)); - } - -+static bool is_ingress_or_clsact(struct tcf_block *block, struct Qdisc *q) -+{ -+ return tcf_block_shared(block) || (q && !!(q->flags & TCQ_F_INGRESS)); -+} -+ - static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, - struct netlink_ext_ack *extack) - { -@@ -2420,6 +2425,8 @@ static int tc_new_tfilter(struct sk_buff *skb, struct nlmsghdr *n, - flags |= TCA_ACT_FLAGS_NO_RTNL; - if (is_qdisc_ingress(parent)) - flags |= TCA_ACT_FLAGS_AT_INGRESS; -+ if (is_ingress_or_clsact(block, q)) -+ flags |= TCA_ACT_FLAGS_AT_INGRESS_OR_CLSACT; - err = tp->ops->change(net, skb, tp, cl, t->tcm_handle, tca, &fh, - flags, extack); - if (err == 0) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1123-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch b/SOURCES/1123-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch deleted file mode 100644 index 71fce1cb8..000000000 --- a/SOURCES/1123-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 65b8cbd50f25d2dab7050a51dd9cbd4122c29113 Mon Sep 17 00:00:00 2001 -From: Jan Stancek -Date: Mon, 9 Mar 2026 08:52:45 +0100 -Subject: [PATCH] x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths - -JIRA: https://issues.redhat.com/browse/RHEL-150459 -Upstream Status: linux.git - -Conflicts: minor context difference, rhel9 strips quotes from config value - -commit 3d1973a0c76a78a4728cff13648a188ed486cf44 -Author: Jan Stancek -Date: Wed Feb 25 20:30:23 2026 +0100 - - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths - - CONFIG_EFI_SBAT_FILE can be a relative path. When compiling using a different - output directory (O=) the build currently fails because it can't find the - filename set in CONFIG_EFI_SBAT_FILE: - - arch/x86/boot/compressed/sbat.S: Assembler messages: - arch/x86/boot/compressed/sbat.S:6: Error: file not found: kernel.sbat - - Add $(srctree) as include dir for sbat.o. - - [ bp: Massage commit message. ] - - Fixes: 61b57d35396a ("x86/efi: Implement support for embedding SBAT data for x86") - Signed-off-by: Jan Stancek - Signed-off-by: Borislav Petkov (AMD) - Reviewed-by: Vitaly Kuznetsov - Cc: - Link: https://patch.msgid.link/f4eda155b0cef91d4d316b4e92f5771cb0aa7187.1772047658.git.jstancek@redhat.com - -Signed-off-by: Jan Stancek - -diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile -index b294f0a7ac32..77e3bd5d39af 100644 ---- a/arch/x86/boot/compressed/Makefile -+++ b/arch/x86/boot/compressed/Makefile -@@ -122,6 +122,7 @@ vmlinux-objs-$(CONFIG_EFI_SBAT) += $(obj)/sbat.o - ifdef CONFIG_EFI_SBAT - # Strip quotes - $(obj)/sbat.o: $(strip $(subst ",,$(CONFIG_EFI_SBAT_FILE))) -+AFLAGS_sbat.o += -I $(srctree) - endif - - $(obj)/vmlinux: $(vmlinux-objs-y) FORCE --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1124-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch b/SOURCES/1124-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch deleted file mode 100644 index 22be68ac5..000000000 --- a/SOURCES/1124-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch +++ /dev/null @@ -1,81 +0,0 @@ -From c88e70dc8bfca9a2be74a100387b1b66de973128 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:28 +0300 -Subject: [PATCH] drm/i915/dsc: Add helper to enable the DSC configuration for - a CRTC -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Add a helper to enable the DSC compression configuration for a CRTC. -Follow-up changes will introduce tracking for the same DSC state on the -whole link, which will need to be set whenever DSC is enabled for the -CRTC. Also, according to the above, when querying the DSC state on the -link, both the CRTC's and the link's DSC state must be considered. - -Setting the DSC configuration for a CRTC and querying the DSC -configuration for the link (added by follow-up changes) is better done -via helper functions based on the above, prepare for that here. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-2-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/icl_dsi.c b/drivers/gpu/drm/i915/display/icl_dsi.c -index 37faa8f19f6e..297368ff42a5 100644 ---- a/drivers/gpu/drm/i915/display/icl_dsi.c -+++ b/drivers/gpu/drm/i915/display/icl_dsi.c -@@ -1655,7 +1655,7 @@ static int gen11_dsi_dsc_compute_config(struct intel_encoder *encoder, - if (ret) - return ret; - -- crtc_state->dsc.compression_enable = true; -+ intel_dsc_enable_on_crtc(crtc_state); - - return 0; - } -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 7059d55687cf..fc1949e0c4de 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2475,7 +2475,8 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - return ret; - } - -- pipe_config->dsc.compression_enable = true; -+ intel_dsc_enable_on_crtc(pipe_config); -+ - drm_dbg_kms(display->drm, "DP DSC computed with Input Bpp = %d " - "Compressed Bpp = " FXP_Q4_FMT " Slice Count = %d\n", - pipe_config->pipe_bpp, -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c -index bca747e24a7f..803f3b395c79 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.c -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c -@@ -372,6 +372,11 @@ int intel_dsc_compute_params(struct intel_crtc_state *pipe_config) - return 0; - } - -+void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state) -+{ -+ crtc_state->dsc.compression_enable = true; -+} -+ - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder) - { -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.h b/drivers/gpu/drm/i915/display/intel_vdsc.h -index 2139391ff881..8c7c7fb652c3 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.h -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.h -@@ -20,6 +20,7 @@ void intel_uncompressed_joiner_enable(const struct intel_crtc_state *crtc_state) - void intel_dsc_enable(const struct intel_crtc_state *crtc_state); - void intel_dsc_disable(const struct intel_crtc_state *crtc_state); - int intel_dsc_compute_params(struct intel_crtc_state *pipe_config); -+void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state); - void intel_dsc_get_config(struct intel_crtc_state *crtc_state); - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1125-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch b/SOURCES/1125-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch deleted file mode 100644 index 257ae4c4c..000000000 --- a/SOURCES/1125-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 69df31263bcabc527a5b526fb8972cb080a179b3 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:29 +0300 -Subject: [PATCH] drm/i915/dp: Ensure the FEC state stays disabled for UHBR - links -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Atm, in the DP SST case the FEC state is computed before -intel_crtc_state::port_clock is initialized, hence intel_dp_is_uhbr() -will always return false and the FEC state will be always computed -assuming a non-UHBR link. - -This happens to work, since the FEC state is recomputed later in -intel_dp_mtp_tu_compute_config(), where port_clock will be set already, -so intel_crtc_state::fec_enable will be reset as expected for UHBR. This -also depends on link rates being tried in an increasing order (i.e. from -non-UHBR -> UHBR link rates) in dsc_compute_link_config(), thus -intel_crtc_state::fec_enable being set for the non-UHBR rates and -getting reset for the first UHBR rate as expected. - -A follow-up change will reuse intel_dp_fec_compute_config() for the DP -MST state computation, prepare for that here, making sure that the -function determines the correct intel_crtc_state::fec_enable=false state -for UHBR link rates based on the above. - -The DP SST and MST state computation should be further unified to avoid -computing/setting the intel_crtc_state::fec_enable state multiple times, -but that's left for a follow-up change. For now add only code comments -about this. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-3-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index fc1949e0c4de..7c568c23134f 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2368,6 +2368,9 @@ static int intel_edp_dsc_compute_pipe_bpp(struct intel_dp *intel_dp, - static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, - struct intel_crtc_state *crtc_state) - { -+ if (intel_dp_is_uhbr(crtc_state)) -+ return; -+ - if (crtc_state->fec_enable) - return; - -@@ -2379,9 +2382,6 @@ static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, - if (intel_dp_is_edp(intel_dp)) - return; - -- if (intel_dp_is_uhbr(crtc_state)) -- return; -- - crtc_state->fec_enable = true; - } - -@@ -2400,6 +2400,10 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - bool is_mst = intel_crtc_has_type(pipe_config, INTEL_OUTPUT_DP_MST); - int ret; - -+ /* -+ * FIXME: set the FEC enabled state once pipe_config->port_clock is -+ * already known, so the UHBR/non-UHBR mode can be determined. -+ */ - intel_dp_fec_compute_config(intel_dp, pipe_config); - - if (!intel_dp_dsc_supports_format(connector, pipe_config->output_format)) -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index f2266b265304..27e952a67c34 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -293,6 +293,11 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - mst_stream_update_slots(crtc_state, mst_state); - } - -+ /* -+ * NOTE: The following must reset crtc_state->fec_enable for UHBR/DSC -+ * after it was set by intel_dp_dsc_compute_config() -> -+ * intel_dp_fec_compute_config(). -+ */ - if (dsc) { - if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) - return -EINVAL; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1126-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch b/SOURCES/1126-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch deleted file mode 100644 index fda80dfe8..000000000 --- a/SOURCES/1126-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch +++ /dev/null @@ -1,106 +0,0 @@ -From cb6c8f1f6f46ac2cbfb42ce8eb8b18257aeaa91a Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:30 +0300 -Subject: [PATCH] drm/i915/dp: Export helper to determine if FEC on non-UHBR - links is required -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Export the helper function to determine if FEC is required on a non-UHBR -(8b10b) SST or MST link. A follow up change will take this into use for -MST as well. - -While at it determine the output type from the CRTC state, which allows -dropping the intel_dp argument. Also make the function return the -required FEC state, instead of setting this in the CRTC state, which -allows only querying this requirement, without changing the state. - -Also rename the function to intel_dp_needs_8b10b_fec(), to clarify that -the function determines if FEC is required on an 8b10b link (on 128b132b -links FEC is always enabled by the HW implicitly, so the function will -return false for that case). - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-4-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 7c568c23134f..844118735998 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2365,24 +2365,29 @@ static int intel_edp_dsc_compute_pipe_bpp(struct intel_dp *intel_dp, - return 0; - } - --static void intel_dp_fec_compute_config(struct intel_dp *intel_dp, -- struct intel_crtc_state *crtc_state) -+/* -+ * Return whether FEC must be enabled for 8b10b SST or MST links. On 128b132b -+ * links FEC is always enabled implicitly by the HW, so this function returns -+ * false for that case. -+ */ -+bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, -+ bool dsc_enabled_on_crtc) - { - if (intel_dp_is_uhbr(crtc_state)) -- return; -+ return false; - - if (crtc_state->fec_enable) -- return; -+ return true; - - /* - * Though eDP v1.5 supports FEC with DSC, unlike DP, it is optional. - * Since, FEC is a bandwidth overhead, continue to not enable it for - * eDP. Until, there is a good reason to do so. - */ -- if (intel_dp_is_edp(intel_dp)) -- return; -+ if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)) -+ return false; - -- crtc_state->fec_enable = true; -+ return dsc_enabled_on_crtc; - } - - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, -@@ -2404,7 +2409,7 @@ int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - * FIXME: set the FEC enabled state once pipe_config->port_clock is - * already known, so the UHBR/non-UHBR mode can be determined. - */ -- intel_dp_fec_compute_config(intel_dp, pipe_config); -+ pipe_config->fec_enable = intel_dp_needs_8b10b_fec(pipe_config, true); - - if (!intel_dp_dsc_supports_format(connector, pipe_config->output_format)) - return -EINVAL; -diff --git a/drivers/gpu/drm/i915/display/intel_dp.h b/drivers/gpu/drm/i915/display/intel_dp.h -index 281ced3a3b39..0537be20fe7b 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.h -+++ b/drivers/gpu/drm/i915/display/intel_dp.h -@@ -73,6 +73,8 @@ void intel_dp_encoder_flush_work(struct drm_encoder *encoder); - int intel_dp_compute_config(struct intel_encoder *encoder, - struct intel_crtc_state *pipe_config, - struct drm_connector_state *conn_state); -+bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, -+ bool dsc_enabled_on_crtc); - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, - struct intel_crtc_state *pipe_config, - struct drm_connector_state *conn_state, -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index 27e952a67c34..d0590b5ffffd 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -296,7 +296,7 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - /* - * NOTE: The following must reset crtc_state->fec_enable for UHBR/DSC - * after it was set by intel_dp_dsc_compute_config() -> -- * intel_dp_fec_compute_config(). -+ * intel_dp_needs_8b10b_fec(). - */ - if (dsc) { - if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1127-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch b/SOURCES/1127-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch deleted file mode 100644 index fee2d6f6e..000000000 --- a/SOURCES/1127-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch +++ /dev/null @@ -1,40 +0,0 @@ -From b762ae48293e2cc2145cdc91eb596d057f1aff11 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:31 +0300 -Subject: [PATCH] drm/i915/dp_mst: Reuse the DP-SST helper function to compute - FEC config -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Reuse the DP-SST helper to compute the state for the FEC enabled state -for DP-MST as well. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-5-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index d0590b5ffffd..0cbb4c3a8e22 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -298,12 +298,10 @@ int intel_dp_mtp_tu_compute_config(struct intel_dp *intel_dp, - * after it was set by intel_dp_dsc_compute_config() -> - * intel_dp_needs_8b10b_fec(). - */ -- if (dsc) { -- if (!intel_dp_supports_fec(intel_dp, connector, crtc_state)) -- return -EINVAL; -- -- crtc_state->fec_enable = !intel_dp_is_uhbr(crtc_state); -- } -+ crtc_state->fec_enable = intel_dp_needs_8b10b_fec(crtc_state, dsc); -+ if (crtc_state->fec_enable && -+ !intel_dp_supports_fec(intel_dp, connector, crtc_state)) -+ return -EINVAL; - - max_dpt_bpp_x16 = fxp_q4_from_int(intel_dp_mst_max_dpt_bpp(crtc_state, dsc)); - if (max_dpt_bpp_x16 && max_bpp_x16 > max_dpt_bpp_x16) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1128-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch b/SOURCES/1128-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch deleted file mode 100644 index bf9cac3f6..000000000 --- a/SOURCES/1128-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 7c027070e98d7b515e4d3a94b54d288c61cb5918 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:32 +0300 -Subject: [PATCH] drm/i915/dp_mst: Track DSC enabled status on the MST link -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Track whether DSC is enabled on any CRTC on a link. On DP-SST (and DSI) -this will always match the CRTC's DSC state, those links having only a -single stream (aka CRTC). For instance, on DP-MST if DSC is enabled for -CRTC#0, but disabled for CRTC#1, the DSC/FEC state for these CRTCs will -be as follows: - -CRTC#0: - - compression_enable = true - - compression_enabled_on_link = true - - fec_enable = true for 8b10b, false for 128b132b - -CRTC#1: - - compression_enable = false - - compression_enabled_on_link = true - - fec_enable = true for 8b10b, false for 128b132b - -This patch only sets compression_enabled_on_link for CRTC#0 above and -enables FEC on CRTC#0 if DSC was enabled on any other CRTC on the 8b10b -MST link. A follow-up change will make sure that the state of all the -CRTCs (CRTC#1 above) on an MST link is recomputed if DSC gets enabled on -any CRTC, setting compression_enabled_on_link and fec_enable for these. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-6-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h -index 203dd38a9ec4..20747fa4d3da 100644 ---- a/drivers/gpu/drm/i915/display/intel_display_types.h -+++ b/drivers/gpu/drm/i915/display/intel_display_types.h -@@ -1279,6 +1279,8 @@ struct intel_crtc_state { - - /* Display Stream compression state */ - struct { -+ /* Only used for state computation, not read out from the HW. */ -+ bool compression_enabled_on_link; - bool compression_enable; - int num_streams; - /* Compressed Bpp in U6.4 format (first 4 bits for fractional part) */ -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 844118735998..95884af242b3 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -2387,7 +2387,7 @@ bool intel_dp_needs_8b10b_fec(const struct intel_crtc_state *crtc_state, - if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_EDP)) - return false; - -- return dsc_enabled_on_crtc; -+ return dsc_enabled_on_crtc || intel_dsc_enabled_on_link(crtc_state); - } - - int intel_dp_dsc_compute_config(struct intel_dp *intel_dp, -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.c b/drivers/gpu/drm/i915/display/intel_vdsc.c -index 803f3b395c79..dbf2cf1b896d 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.c -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.c -@@ -374,9 +374,20 @@ int intel_dsc_compute_params(struct intel_crtc_state *pipe_config) - - void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state) - { -+ crtc_state->dsc.compression_enabled_on_link = true; - crtc_state->dsc.compression_enable = true; - } - -+bool intel_dsc_enabled_on_link(const struct intel_crtc_state *crtc_state) -+{ -+ struct intel_display *display = to_intel_display(crtc_state); -+ -+ drm_WARN_ON(display->drm, crtc_state->dsc.compression_enable && -+ !crtc_state->dsc.compression_enabled_on_link); -+ -+ return crtc_state->dsc.compression_enabled_on_link; -+} -+ - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder) - { -diff --git a/drivers/gpu/drm/i915/display/intel_vdsc.h b/drivers/gpu/drm/i915/display/intel_vdsc.h -index 8c7c7fb652c3..99f64ac54b27 100644 ---- a/drivers/gpu/drm/i915/display/intel_vdsc.h -+++ b/drivers/gpu/drm/i915/display/intel_vdsc.h -@@ -21,6 +21,7 @@ void intel_dsc_enable(const struct intel_crtc_state *crtc_state); - void intel_dsc_disable(const struct intel_crtc_state *crtc_state); - int intel_dsc_compute_params(struct intel_crtc_state *pipe_config); - void intel_dsc_enable_on_crtc(struct intel_crtc_state *crtc_state); -+bool intel_dsc_enabled_on_link(const struct intel_crtc_state *crtc_state); - void intel_dsc_get_config(struct intel_crtc_state *crtc_state); - enum intel_display_power_domain - intel_dsc_power_domain(struct intel_crtc *crtc, enum transcoder cpu_transcoder); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1129-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch b/SOURCES/1129-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch deleted file mode 100644 index 9dcfb6ca3..000000000 --- a/SOURCES/1129-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch +++ /dev/null @@ -1,171 +0,0 @@ -From 470b84af457e34cbfa4d2c17dab78746736ab898 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:33 +0300 -Subject: [PATCH] drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets - enabled on the link -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The state of all the CRTCs on an MST link must be recomputed, if DSC -gets enabled on any of the CRTCs on the link. For instance an MST -docking station's Panel Replay capability may depend on whether DSC is -enabled on any of the dock's streams (aka CRTCs). To assist the Panel -Replay state computation for a CRTC based on the above, track in the -CRTC state if DSC is enabled on any CRTC on an MST link. - -The intel_link_bw_limits::force_fec_pipes mask is used for a reason -similar to the above: enable FEC on all CRTCs of a non-UHBR (8b10b) MST -link if DSC is enabled on any of the link's CRTCs. The FEC enabled state -for a CRTC doesn't indicate if DSC is enabled on a UHBR MST link (FEC is -always enabled by the HW for UHBR, hence it's not tracked by the -intel_crtc_state::fec_enable flag for such links, where this flag is -always false). - -Based on the above, to be able to determine the DSC state on both -non-UHBR and UHBR MST links, track the more generic DSC-enabled-on-link -state (instead of the FEC-enabled-on-link state) for each CRTC in -intel_link_bw_limits. - -Signed-off-by: Imre Deak -Reviewed-by: Jouni Högander -Link: https://lore.kernel.org/r/20251015161934.262108-7-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c -index bbb6ff929d64..a8b4619de347 100644 ---- a/drivers/gpu/drm/i915/display/intel_display.c -+++ b/drivers/gpu/drm/i915/display/intel_display.c -@@ -4603,7 +4603,7 @@ intel_modeset_pipe_config(struct intel_atomic_state *state, - if (ret) - return ret; - -- crtc_state->fec_enable = limits->force_fec_pipes & BIT(crtc->pipe); -+ crtc_state->dsc.compression_enabled_on_link = limits->link_dsc_pipes & BIT(crtc->pipe); - crtc_state->max_link_bpp_x16 = limits->max_bpp_x16[crtc->pipe]; - - if (crtc_state->pipe_bpp > fxp_q4_to_int(crtc_state->max_link_bpp_x16)) { -diff --git a/drivers/gpu/drm/i915/display/intel_dp_mst.c b/drivers/gpu/drm/i915/display/intel_dp_mst.c -index 0cbb4c3a8e22..a845b2612a3f 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp_mst.c -+++ b/drivers/gpu/drm/i915/display/intel_dp_mst.c -@@ -814,14 +814,14 @@ static u8 get_pipes_downstream_of_mst_port(struct intel_atomic_state *state, - return mask; - } - --static int intel_dp_mst_check_fec_change(struct intel_atomic_state *state, -+static int intel_dp_mst_check_dsc_change(struct intel_atomic_state *state, - struct drm_dp_mst_topology_mgr *mst_mgr, - struct intel_link_bw_limits *limits) - { - struct intel_display *display = to_intel_display(state); - struct intel_crtc *crtc; - u8 mst_pipe_mask; -- u8 fec_pipe_mask = 0; -+ u8 dsc_pipe_mask = 0; - int ret; - - mst_pipe_mask = get_pipes_downstream_of_mst_port(state, mst_mgr, NULL); -@@ -834,16 +834,16 @@ static int intel_dp_mst_check_fec_change(struct intel_atomic_state *state, - if (drm_WARN_ON(display->drm, !crtc_state)) - return -EINVAL; - -- if (crtc_state->fec_enable) -- fec_pipe_mask |= BIT(crtc->pipe); -+ if (intel_dsc_enabled_on_link(crtc_state)) -+ dsc_pipe_mask |= BIT(crtc->pipe); - } - -- if (!fec_pipe_mask || mst_pipe_mask == fec_pipe_mask) -+ if (!dsc_pipe_mask || mst_pipe_mask == dsc_pipe_mask) - return 0; - -- limits->force_fec_pipes |= mst_pipe_mask; -+ limits->link_dsc_pipes |= mst_pipe_mask; - -- ret = intel_modeset_pipes_in_mask_early(state, "MST FEC", -+ ret = intel_modeset_pipes_in_mask_early(state, "MST DSC", - mst_pipe_mask); - - return ret ? : -EAGAIN; -@@ -897,7 +897,7 @@ int intel_dp_mst_atomic_check_link(struct intel_atomic_state *state, - int i; - - for_each_new_mst_mgr_in_state(&state->base, mgr, mst_state, i) { -- ret = intel_dp_mst_check_fec_change(state, mgr, limits); -+ ret = intel_dp_mst_check_dsc_change(state, mgr, limits); - if (ret) - return ret; - -diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.c b/drivers/gpu/drm/i915/display/intel_link_bw.c -index f52dee0ea412..d2862de894fa 100644 ---- a/drivers/gpu/drm/i915/display/intel_link_bw.c -+++ b/drivers/gpu/drm/i915/display/intel_link_bw.c -@@ -20,6 +20,7 @@ - #include "intel_dp_tunnel.h" - #include "intel_fdi.h" - #include "intel_link_bw.h" -+#include "intel_vdsc.h" - - static int get_forced_link_bpp_x16(struct intel_atomic_state *state, - const struct intel_crtc *crtc) -@@ -55,7 +56,7 @@ void intel_link_bw_init_limits(struct intel_atomic_state *state, - struct intel_display *display = to_intel_display(state); - enum pipe pipe; - -- limits->force_fec_pipes = 0; -+ limits->link_dsc_pipes = 0; - limits->bpp_limit_reached_pipes = 0; - for_each_pipe(display, pipe) { - struct intel_crtc *crtc = intel_crtc_for_pipe(display, pipe); -@@ -65,8 +66,8 @@ void intel_link_bw_init_limits(struct intel_atomic_state *state, - - if (state->base.duplicated && crtc_state) { - limits->max_bpp_x16[pipe] = crtc_state->max_link_bpp_x16; -- if (crtc_state->fec_enable) -- limits->force_fec_pipes |= BIT(pipe); -+ if (intel_dsc_enabled_on_link(crtc_state)) -+ limits->link_dsc_pipes |= BIT(pipe); - } else { - limits->max_bpp_x16[pipe] = INT_MAX; - } -@@ -265,10 +266,10 @@ assert_link_limit_change_valid(struct intel_display *display, - bool bpps_changed = false; - enum pipe pipe; - -- /* FEC can't be forced off after it was forced on. */ -+ /* DSC can't be disabled after it was enabled. */ - if (drm_WARN_ON(display->drm, -- (old_limits->force_fec_pipes & new_limits->force_fec_pipes) != -- old_limits->force_fec_pipes)) -+ (old_limits->link_dsc_pipes & new_limits->link_dsc_pipes) != -+ old_limits->link_dsc_pipes)) - return false; - - for_each_pipe(display, pipe) { -@@ -286,8 +287,8 @@ assert_link_limit_change_valid(struct intel_display *display, - /* At least one limit must change. */ - if (drm_WARN_ON(display->drm, - !bpps_changed && -- new_limits->force_fec_pipes == -- old_limits->force_fec_pipes)) -+ new_limits->link_dsc_pipes == -+ old_limits->link_dsc_pipes)) - return false; - - return true; -diff --git a/drivers/gpu/drm/i915/display/intel_link_bw.h b/drivers/gpu/drm/i915/display/intel_link_bw.h -index 95ab7c50c61d..cb18e171037c 100644 ---- a/drivers/gpu/drm/i915/display/intel_link_bw.h -+++ b/drivers/gpu/drm/i915/display/intel_link_bw.h -@@ -15,7 +15,7 @@ struct intel_connector; - struct intel_crtc_state; - - struct intel_link_bw_limits { -- u8 force_fec_pipes; -+ u8 link_dsc_pipes; - u8 bpp_limit_reached_pipes; - /* in 1/16 bpp units */ - int max_bpp_x16[I915_MAX_PIPES]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1130-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch b/SOURCES/1130-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch deleted file mode 100644 index 02ca89c5a..000000000 --- a/SOURCES/1130-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch +++ /dev/null @@ -1,248 +0,0 @@ -From c390bf07961b3a39f3417d75850a4e721b87e595 Mon Sep 17 00:00:00 2001 -From: Imre Deak -Date: Wed, 15 Oct 2025 19:19:34 +0300 -Subject: [PATCH] drm/i915/dp: Fix panel replay when DSC is enabled -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Prevent enabling panel replay if the sink doesn't support this due to -DSC being enabled. - -Panel replay has two modes, updating full frames or only selected -regions of the frame. If the sink doesn't support Panel Replay in full -frame update mode with DSC prevent Panel Replay completely if DSC is -enabled. If the sink doesn't support Panel Replay only in the selective -update mode while DSC is enabled, it will still support Panel Replay in -the full frame update mode, so only prevent selective updates in this -case. - -v2: -- Use Panel Replay instead of PR in debug prints. (Jouni) -- Rebase on change tracking the link DSC state in the crtc state. - -Cc: Jouni Högander -Closes: https://gitlab.freedesktop.org/drm/i915/kernel/-/issues/14869 -Reviewed-by: Jouni Högander -Signed-off-by: Imre Deak -Link: https://lore.kernel.org/r/20251015161934.262108-8-imre.deak@intel.com - -diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h -index 20747fa4d3da..1e0cd81c9474 100644 ---- a/drivers/gpu/drm/i915/display/intel_display_types.h -+++ b/drivers/gpu/drm/i915/display/intel_display_types.h -@@ -955,6 +955,12 @@ struct intel_csc_matrix { - u16 postoff[3]; - }; - -+enum intel_panel_replay_dsc_support { -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED, -+ INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY, -+ INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE, -+}; -+ - struct intel_crtc_state { - /* - * uapi (drm) state. This is the software state shown to userspace. -@@ -1133,6 +1139,8 @@ struct intel_crtc_state { - bool has_panel_replay; - bool wm_level_disabled; - bool pkg_c_latency_used; -+ /* Only used for state verification. */ -+ enum intel_panel_replay_dsc_support panel_replay_dsc_support; - u32 dc3co_exitline; - u16 su_y_granularity; - u8 active_non_psr_pipes; -@@ -1706,6 +1714,7 @@ struct intel_psr { - bool source_panel_replay_support; - bool sink_panel_replay_support; - bool sink_panel_replay_su_support; -+ enum intel_panel_replay_dsc_support sink_panel_replay_dsc_support; - bool panel_replay_enabled; - u32 dc3co_exitline; - u32 dc3co_exit_delay; -diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c -index 95884af242b3..215ad690ab07 100644 ---- a/drivers/gpu/drm/i915/display/intel_dp.c -+++ b/drivers/gpu/drm/i915/display/intel_dp.c -@@ -6053,6 +6053,8 @@ intel_dp_detect(struct drm_connector *_connector, - memset(connector->dp.dsc_dpcd, 0, sizeof(connector->dp.dsc_dpcd)); - intel_dp->psr.sink_panel_replay_support = false; - intel_dp->psr.sink_panel_replay_su_support = false; -+ intel_dp->psr.sink_panel_replay_dsc_support = -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED; - - intel_dp_mst_disconnect(intel_dp); - -diff --git a/drivers/gpu/drm/i915/display/intel_psr.c b/drivers/gpu/drm/i915/display/intel_psr.c -index 703e5f6af04c..3e99a65ec988 100644 ---- a/drivers/gpu/drm/i915/display/intel_psr.c -+++ b/drivers/gpu/drm/i915/display/intel_psr.c -@@ -29,6 +29,7 @@ - #include - - #include "i915_reg.h" -+#include "i915_utils.h" - #include "intel_alpm.h" - #include "intel_atomic.h" - #include "intel_crtc.h" -@@ -50,6 +51,7 @@ - #include "intel_snps_phy.h" - #include "intel_step.h" - #include "intel_vblank.h" -+#include "intel_vdsc.h" - #include "intel_vrr.h" - #include "skl_universal_plane.h" - -@@ -580,6 +582,44 @@ static void intel_dp_get_su_granularity(struct intel_dp *intel_dp) - intel_dp->psr.su_y_granularity = y; - } - -+static enum intel_panel_replay_dsc_support -+compute_pr_dsc_support(struct intel_dp *intel_dp) -+{ -+ u8 pr_dsc_mode; -+ u8 val; -+ -+ val = intel_dp->pr_dpcd[INTEL_PR_DPCD_INDEX(DP_PANEL_REPLAY_CAP_CAPABILITY)]; -+ pr_dsc_mode = REG_FIELD_GET8(DP_PANEL_REPLAY_DSC_DECODE_CAPABILITY_IN_PR_MASK, val); -+ -+ switch (pr_dsc_mode) { -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_FULL_FRAME_ONLY: -+ return INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY; -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_SUPPORTED: -+ return INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE; -+ default: -+ MISSING_CASE(pr_dsc_mode); -+ fallthrough; -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_NOT_SUPPORTED: -+ case DP_DSC_DECODE_CAPABILITY_IN_PR_RESERVED: -+ return INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED; -+ } -+} -+ -+static const char *panel_replay_dsc_support_str(enum intel_panel_replay_dsc_support dsc_support) -+{ -+ switch (dsc_support) { -+ case INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED: -+ return "not supported"; -+ case INTEL_DP_PANEL_REPLAY_DSC_FULL_FRAME_ONLY: -+ return "full frame only"; -+ case INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE: -+ return "selective update"; -+ default: -+ MISSING_CASE(dsc_support); -+ return "n/a"; -+ }; -+} -+ - static void _panel_replay_init_dpcd(struct intel_dp *intel_dp) - { - struct intel_display *display = to_intel_display(intel_dp); -@@ -615,10 +655,13 @@ static void _panel_replay_init_dpcd(struct intel_dp *intel_dp) - DP_PANEL_REPLAY_SU_SUPPORT) - intel_dp->psr.sink_panel_replay_su_support = true; - -+ intel_dp->psr.sink_panel_replay_dsc_support = compute_pr_dsc_support(intel_dp); -+ - drm_dbg_kms(display->drm, -- "Panel replay %sis supported by panel\n", -+ "Panel replay %sis supported by panel (in DSC mode: %s)\n", - intel_dp->psr.sink_panel_replay_su_support ? -- "selective_update " : ""); -+ "selective_update " : "", -+ panel_replay_dsc_support_str(intel_dp->psr.sink_panel_replay_dsc_support)); - } - - static void _psr_init_dpcd(struct intel_dp *intel_dp) -@@ -1606,9 +1649,21 @@ static bool intel_sel_update_config_valid(struct intel_dp *intel_dp, - goto unsupported; - } - -- if (crtc_state->has_panel_replay && (DISPLAY_VER(display) < 14 || -- !intel_dp->psr.sink_panel_replay_su_support)) -- goto unsupported; -+ if (crtc_state->has_panel_replay) { -+ if (DISPLAY_VER(display) < 14) -+ goto unsupported; -+ -+ if (!intel_dp->psr.sink_panel_replay_su_support) -+ goto unsupported; -+ -+ if (intel_dsc_enabled_on_link(crtc_state) && -+ intel_dp->psr.sink_panel_replay_dsc_support != -+ INTEL_DP_PANEL_REPLAY_DSC_SELECTIVE_UPDATE) { -+ drm_dbg_kms(display->drm, -+ "Selective update with Panel Replay not enabled because it's not supported with DSC\n"); -+ goto unsupported; -+ } -+ } - - if (crtc_state->crc_enabled) { - drm_dbg_kms(display->drm, -@@ -1685,6 +1740,14 @@ _panel_replay_compute_config(struct intel_dp *intel_dp, - return false; - } - -+ if (intel_dsc_enabled_on_link(crtc_state) && -+ intel_dp->psr.sink_panel_replay_dsc_support == -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED) { -+ drm_dbg_kms(display->drm, -+ "Panel Replay not enabled because it's not supported with DSC\n"); -+ return false; -+ } -+ - if (!intel_dp_is_edp(intel_dp)) - return true; - -@@ -1790,6 +1853,8 @@ void intel_psr_compute_config(struct intel_dp *intel_dp, - return; - } - -+ /* Only used for state verification. */ -+ crtc_state->panel_replay_dsc_support = intel_dp->psr.sink_panel_replay_dsc_support; - crtc_state->has_panel_replay = _panel_replay_compute_config(intel_dp, - crtc_state, - conn_state); -@@ -2991,6 +3056,20 @@ void intel_psr_pre_plane_update(struct intel_atomic_state *state, - } - } - -+static void -+verify_panel_replay_dsc_state(const struct intel_crtc_state *crtc_state) -+{ -+ struct intel_display *display = to_intel_display(crtc_state); -+ -+ if (!crtc_state->has_panel_replay) -+ return; -+ -+ drm_WARN_ON(display->drm, -+ intel_dsc_enabled_on_link(crtc_state) && -+ crtc_state->panel_replay_dsc_support == -+ INTEL_DP_PANEL_REPLAY_DSC_NOT_SUPPORTED); -+} -+ - void intel_psr_post_plane_update(struct intel_atomic_state *state, - struct intel_crtc *crtc) - { -@@ -3002,6 +3081,8 @@ void intel_psr_post_plane_update(struct intel_atomic_state *state, - if (!crtc_state->has_psr) - return; - -+ verify_panel_replay_dsc_state(crtc_state); -+ - for_each_intel_encoder_mask_with_psr(state->base.dev, encoder, - crtc_state->uapi.encoder_mask) { - struct intel_dp *intel_dp = enc_to_intel_dp(encoder); -@@ -4031,6 +4112,8 @@ static void intel_psr_sink_capability(struct intel_dp *intel_dp, - seq_printf(m, ", Panel Replay = %s", str_yes_no(psr->sink_panel_replay_support)); - seq_printf(m, ", Panel Replay Selective Update = %s", - str_yes_no(psr->sink_panel_replay_su_support)); -+ seq_printf(m, ", Panel Replay DSC support = %s", -+ panel_replay_dsc_support_str(psr->sink_panel_replay_dsc_support)); - if (intel_dp->pr_dpcd[INTEL_PR_DPCD_INDEX(DP_PANEL_REPLAY_CAP_SUPPORT)] & - DP_PANEL_REPLAY_EARLY_TRANSPORT_SUPPORT) - seq_printf(m, " (Early Transport)"); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1131-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch b/SOURCES/1131-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch deleted file mode 100644 index 6670f1ba8..000000000 --- a/SOURCES/1131-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" -# Revert of f586e5f3f3751e4115a539e81d8dce066fb27f2d - scsi: lpfc: Update lpfc version to 14.4.0.12 - - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index f3dada5bf7c1..31c3c5abdca6 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.12" -+#define LPFC_DRIVER_VERSION "14.4.0.11" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/SOURCES/1132-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch b/SOURCES/1132-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch deleted file mode 100644 index 811d65d09..000000000 --- a/SOURCES/1132-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch +++ /dev/null @@ -1,332 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" -# Revert of 329b0632fcf901b929ca7658a8a3a4af2682011e - scsi: lpfc: Add capability to register Platform Name ID to fabric - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index ef83b8e0e9f8..42bf2fda825f 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -634,7 +634,6 @@ struct lpfc_vport { - #define FC_CT_RSPN_ID 0x8 /* RSPN_ID accepted by switch */ - #define FC_CT_RFT_ID 0x10 /* RFT_ID accepted by switch */ - #define FC_CT_RPRT_DEFER 0x20 /* Defer issuing FDMI RPRT */ --#define FC_CT_RSPNI_PNI 0x40 /* RSPNI_PNI accepted by switch */ - - struct list_head fc_nodes; - spinlock_t fc_nodes_list_lock; /* spinlock for fc_nodes list */ -@@ -1079,8 +1078,6 @@ struct lpfc_hba { - - uint32_t nport_event_cnt; /* timestamp for nlplist entry */ - -- unsigned long pni; /* 64-bit Platform Name Identifier */ -- - uint8_t wwnn[8]; - uint8_t wwpn[8]; - uint32_t RandomData[7]; -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index 1c7fa13c8728..94f612d1fef0 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -1742,28 +1742,6 @@ lpfc_cmpl_ct_cmd_rsnn_nn(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - return; - } - --static void --lpfc_cmpl_ct_cmd_rspni_pni(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, -- struct lpfc_iocbq *rspiocb) --{ -- struct lpfc_vport *vport; -- struct lpfc_dmabuf *outp; -- struct lpfc_sli_ct_request *ctrsp; -- u32 ulp_status; -- -- vport = cmdiocb->vport; -- ulp_status = get_job_ulpstatus(phba, rspiocb); -- -- if (ulp_status == IOSTAT_SUCCESS) { -- outp = cmdiocb->rsp_dmabuf; -- ctrsp = (struct lpfc_sli_ct_request *)outp->virt; -- if (be16_to_cpu(ctrsp->CommandResponse.bits.CmdRsp) == -- SLI_CT_RESPONSE_FS_ACC) -- vport->ct_flags |= FC_CT_RSPNI_PNI; -- } -- lpfc_cmpl_ct(phba, cmdiocb, rspiocb); --} -- - static void - lpfc_cmpl_ct_cmd_da_id(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - struct lpfc_iocbq *rspiocb) -@@ -1978,8 +1956,6 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, - bpl->tus.f.bdeSize = RSPN_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_RSNN_NN) - bpl->tus.f.bdeSize = RSNN_REQUEST_SZ; -- else if (cmdcode == SLI_CTNS_RSPNI_PNI) -- bpl->tus.f.bdeSize = RSPNI_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_DA_ID) - bpl->tus.f.bdeSize = DA_ID_REQUEST_SZ; - else if (cmdcode == SLI_CTNS_RFF_ID) -@@ -2101,18 +2077,6 @@ lpfc_ns_cmd(struct lpfc_vport *vport, int cmdcode, - CtReq->un.rsnn.symbname, size); - cmpl = lpfc_cmpl_ct_cmd_rsnn_nn; - break; -- case SLI_CTNS_RSPNI_PNI: -- vport->ct_flags &= ~FC_CT_RSPNI_PNI; -- CtReq->CommandResponse.bits.CmdRsp = -- cpu_to_be16(SLI_CTNS_RSPNI_PNI); -- CtReq->un.rspni.pni = cpu_to_be64(phba->pni); -- scnprintf(CtReq->un.rspni.symbname, -- sizeof(CtReq->un.rspni.symbname), "OS Host Name::%s", -- phba->os_host_name); -- CtReq->un.rspni.len = strnlen(CtReq->un.rspni.symbname, -- sizeof(CtReq->un.rspni.symbname)); -- cmpl = lpfc_cmpl_ct_cmd_rspni_pni; -- break; - case SLI_CTNS_DA_ID: - /* Implement DA_ID Nameserver request */ - CtReq->CommandResponse.bits.CmdRsp = -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index fbf2fd97f093..c07d6805dbdb 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -650,6 +650,8 @@ lpfc_cmpl_els_flogi_fabric(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | - sp->cmn.bbRcvSizeLsb; - -@@ -1354,14 +1356,6 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - /* Can't do SLI4 class2 without support sequence coalescing */ - sp->cls2.classValid = 0; - sp->cls2.seqDelivery = 0; -- -- /* Fill out Auxiliary Parameter Data */ -- if (phba->pni) { -- sp->aux.flags = -- AUX_PARM_DATA_VALID | AUX_PARM_PNI_VALID; -- sp->aux.pni = cpu_to_be64(phba->pni); -- sp->aux.npiv_cnt = cpu_to_be16(phba->max_vpi - 1); -- } - } else { - /* Historical, setting sequential-delivery bit for SLI3 */ - sp->cls2.seqDelivery = (sp->cls2.classValid) ? 1 : 0; -@@ -5662,6 +5656,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag, - sp->cls1.classValid = 0; - sp->cls2.classValid = 0; - sp->cls3.classValid = 0; -+ sp->cls4.classValid = 0; - - /* Copy our worldwide names */ - memcpy(&sp->portName, &vport->fc_sparam.portName, -@@ -11520,13 +11515,6 @@ lpfc_issue_els_fdisc(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - sp->cls2.seqDelivery = 1; - sp->cls3.seqDelivery = 1; - -- /* Fill out Auxiliary Parameter Data */ -- if (phba->pni) { -- sp->aux.flags = -- AUX_PARM_DATA_VALID | AUX_PARM_PNI_VALID; -- sp->aux.pni = cpu_to_be64(phba->pni); -- } -- - pcmd += sizeof(uint32_t); /* CSP Word 2 */ - pcmd += sizeof(uint32_t); /* CSP Word 3 */ - pcmd += sizeof(uint32_t); /* CSP Word 4 */ -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 5d2210790c0a..5a8ccdc956df 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -4373,8 +4373,6 @@ lpfc_mbx_cmpl_ns_reg_login(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) - lpfc_ns_cmd(vport, SLI_CTNS_RNN_ID, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RSNN_NN, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RSPN_ID, 0, 0); -- if (phba->pni) -- lpfc_ns_cmd(vport, SLI_CTNS_RSPNI_PNI, 0, 0); - lpfc_ns_cmd(vport, SLI_CTNS_RFT_ID, 0, 0); - - if ((vport->cfg_enable_fc4_type == LPFC_ENABLE_BOTH) || -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index b2e353590ebb..3bc0efa7453e 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -168,11 +168,6 @@ struct lpfc_sli_ct_request { - uint8_t len; - uint8_t symbname[255]; - } rspn; -- struct rspni { /* For RSPNI_PNI requests */ -- __be64 pni; -- u8 len; -- u8 symbname[255]; -- } rspni; - struct gff { - uint32_t PortId; - } gff; -@@ -218,8 +213,6 @@ struct lpfc_sli_ct_request { - sizeof(struct da_id)) - #define RSPN_REQUEST_SZ (offsetof(struct lpfc_sli_ct_request, un) + \ - sizeof(struct rspn)) --#define RSPNI_REQUEST_SZ (offsetof(struct lpfc_sli_ct_request, un) + \ -- sizeof(struct rspni)) - - /* - * FsType Definitions -@@ -316,7 +309,6 @@ struct lpfc_sli_ct_request { - #define SLI_CTNS_RIP_NN 0x0235 - #define SLI_CTNS_RIPA_NN 0x0236 - #define SLI_CTNS_RSNN_NN 0x0239 --#define SLI_CTNS_RSPNI_PNI 0x0240 - #define SLI_CTNS_DA_ID 0x0300 - - /* -@@ -520,21 +512,6 @@ struct class_parms { - uint8_t word3Reserved2; /* Fc Word 3, bit 0: 7 */ - }; - --enum aux_parm_flags { -- AUX_PARM_PNI_VALID = 0x20, /* FC Word 0, bit 29 */ -- AUX_PARM_DATA_VALID = 0x40, /* FC Word 0, bit 30 */ --}; -- --struct aux_parm { -- u8 flags; /* FC Word 0, bit 31:24 */ -- u8 ext_feat[3]; /* FC Word 0, bit 23:0 */ -- -- __be64 pni; /* FC Word 1 and 2, platform name identifier */ -- -- __be16 rsvd; /* FC Word 3, bit 31:16 */ -- __be16 npiv_cnt; /* FC Word 3, bit 15:0 */ --} __packed; -- - struct serv_parm { /* Structure is in Big Endian format */ - struct csp cmn; - struct lpfc_name portName; -@@ -542,7 +519,7 @@ struct serv_parm { /* Structure is in Big Endian format */ - struct class_parms cls1; - struct class_parms cls2; - struct class_parms cls3; -- struct aux_parm aux; -+ struct class_parms cls4; - union { - uint8_t vendorVersion[16]; - struct { -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 9e785bbf6785..e16370da3e45 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -432,6 +432,8 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = - ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | sp->cmn.bbRcvSizeLsb; - /* if already logged in, do implicit logout */ -@@ -1415,6 +1417,8 @@ lpfc_cmpl_plogi_plogi_issue(struct lpfc_vport *vport, - ndlp->nlp_class_sup |= FC_COS_CLASS2; - if (sp->cls3.classValid) - ndlp->nlp_class_sup |= FC_COS_CLASS3; -+ if (sp->cls4.classValid) -+ ndlp->nlp_class_sup |= FC_COS_CLASS4; - ndlp->nlp_maxframe = - ((sp->cmn.bbRcvSizeMsb & 0x0F) << 8) | sp->cmn.bbRcvSizeLsb; - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 2e3f77538266..66730c3e4cb9 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -27,8 +27,6 @@ - #include - #include - #include --#include --#include - - #include - #include -@@ -8451,70 +8449,6 @@ lpfc_set_host_tm(struct lpfc_hba *phba) - return rc; - } - --/** -- * lpfc_get_platform_uuid - Attempts to extract a platform uuid -- * @phba: pointer to lpfc hba data structure. -- * -- * This routine attempts to first read SMBIOS DMI data for the System -- * Information structure offset 08h called System UUID. Else, no platform -- * UUID will be advertised. -- **/ --static void --lpfc_get_platform_uuid(struct lpfc_hba *phba) --{ -- int rc; -- const char *uuid; -- char pni[17] = {0}; /* 16 characters + '\0' */ -- bool is_ff = true, is_00 = true; -- u8 i; -- -- /* First attempt SMBIOS DMI */ -- uuid = dmi_get_system_info(DMI_PRODUCT_UUID); -- if (uuid) { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2088 SMBIOS UUID %s\n", -- uuid); -- } else { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2099 Could not extract UUID\n"); -- } -- -- if (uuid && uuid_is_valid(uuid)) { -- /* Generate PNI from UUID format. -- * -- * 1.) Extract lower 64 bits from UUID format. -- * 2.) Set 3h for NAA Locally Assigned Name Identifier format. -- * -- * e.g. xxxxxxxx-xxxx-xxxx-yyyy-yyyyyyyyyyyy -- * -- * extract the yyyy-yyyyyyyyyyyy portion -- * final PNI 3yyyyyyyyyyyyyyy -- */ -- scnprintf(pni, sizeof(pni), "3%c%c%c%s", -- uuid[20], uuid[21], uuid[22], &uuid[24]); -- -- /* Sanitize the converted PNI */ -- for (i = 1; i < 16 && (is_ff || is_00); i++) { -- if (pni[i] != '0') -- is_00 = false; -- if (pni[i] != 'f' && pni[i] != 'F') -- is_ff = false; -- } -- -- /* Convert from char* to unsigned long */ -- rc = kstrtoul(pni, 16, &phba->pni); -- if (!rc && !is_ff && !is_00) { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2100 PNI 0x%016lx\n", phba->pni); -- } else { -- lpfc_printf_log(phba, KERN_INFO, LOG_INIT, -- "2101 PNI %s generation status %d\n", -- pni, rc); -- phba->pni = 0; -- } -- } --} -- - /** - * lpfc_sli4_hba_setup - SLI4 device initialization PCI function - * @phba: Pointer to HBA context object. -@@ -8598,10 +8532,6 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - clear_bit(HBA_FCOE_MODE, &phba->hba_flag); - } - -- /* Obtain platform UUID, only for SLI4 FC adapters */ -- if (!test_bit(HBA_FCOE_MODE, &phba->hba_flag)) -- lpfc_get_platform_uuid(phba); -- - if (bf_get(lpfc_mbx_rd_rev_cee_ver, &mqe->un.read_rev) == - LPFC_DCBX_CEE_MODE) - set_bit(HBA_FIP_SUPPORT, &phba->hba_flag); diff --git a/SOURCES/1133-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch b/SOURCES/1133-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch deleted file mode 100644 index bb55ccd8a..000000000 --- a/SOURCES/1133-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch +++ /dev/null @@ -1,30 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" -# Revert of a07aace5da5f860c8db0ec271438e9b46e3db858 - scsi: lpfc: Allow support for BB credit recovery in point-to-point topology - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index c07d6805dbdb..0ebd6a0b0b76 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2279,8 +2279,7 @@ lpfc_issue_els_plogi(struct lpfc_vport *vport, uint32_t did, uint8_t retry) - - sp->cmn.valid_vendor_ver_level = 0; - memset(sp->un.vendorVersion, 0, sizeof(sp->un.vendorVersion)); -- if (!test_bit(FC_PT2PT, &vport->fc_flag)) -- sp->cmn.bbRcvSizeMsb &= 0xF; -+ sp->cmn.bbRcvSizeMsb &= 0xF; - - /* Check if the destination port supports VMID */ - ndlp->vmid_support = 0; -@@ -5670,8 +5669,7 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag, - sp->cmn.valid_vendor_ver_level = 0; - memset(sp->un.vendorVersion, 0, - sizeof(sp->un.vendorVersion)); -- if (!test_bit(FC_PT2PT, &vport->fc_flag)) -- sp->cmn.bbRcvSizeMsb &= 0xF; -+ sp->cmn.bbRcvSizeMsb &= 0xF; - - /* If our firmware supports this feature, convey that - * info to the target using the vendor specific field. diff --git a/SOURCES/1134-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch b/SOURCES/1134-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch deleted file mode 100644 index 240b39b65..000000000 --- a/SOURCES/1134-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch +++ /dev/null @@ -1,234 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" -# Revert of f827c0e0303fbe9099192ebe9363b1170bc9d736 - scsi: lpfc: Modify kref handling for Fabric Controller ndlps - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 0f9ddb7d2e7b..74b1a4116aee 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3390,21 +3390,11 @@ lpfc_cmpl_els_disc_cmd(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_cmpl_els_edc(phba, cmdiocb, rspiocb); - return; - } -- - if (ulp_status) { - /* ELS discovery cmd completes with error */ - lpfc_printf_vlog(vport, KERN_WARNING, LOG_ELS | LOG_CGN_MGMT, - "4203 ELS cmd x%x error: x%x x%X\n", cmd, - ulp_status, ulp_word4); -- -- /* In the case where the ELS cmd completes with an error and -- * the node does not have RPI registered, the node is -- * outstanding and should put its initial reference. -- */ -- if ((cmd == ELS_CMD_SCR || cmd == ELS_CMD_RDF) && -- !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD) && -- !test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); - goto out; - } - -@@ -3473,7 +3463,6 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - uint8_t *pcmd; - uint16_t cmdsize; - struct lpfc_nodelist *ndlp; -- bool node_created = false; - - cmdsize = (sizeof(uint32_t) + sizeof(SCR)); - -@@ -3483,21 +3472,21 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - if (!ndlp) - return 1; - lpfc_enqueue_node(vport, ndlp); -- node_created = true; - } - - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_SCR); - if (!elsiocb) -- goto out_node_created; -+ return 1; - - if (phba->sli_rev == LPFC_SLI_REV4) { - rc = lpfc_reg_fab_ctrl_node(vport, ndlp); - if (rc) { -+ lpfc_els_free_iocb(phba, elsiocb); - lpfc_printf_vlog(vport, KERN_ERR, LOG_NODE, - "0937 %s: Failed to reg fc node, rc %d\n", - __func__, rc); -- goto out_free_iocb; -+ return 1; - } - } - pcmd = (uint8_t *)elsiocb->cmd_dmabuf->virt; -@@ -3516,27 +3505,23 @@ lpfc_issue_els_scr(struct lpfc_vport *vport, uint8_t retry) - phba->fc_stat.elsXmitSCR++; - elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->ndlp = lpfc_nlp_get(ndlp); -- if (!elsiocb->ndlp) -- goto out_free_iocb; -+ if (!elsiocb->ndlp) { -+ lpfc_els_free_iocb(phba, elsiocb); -+ return 1; -+ } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue SCR: did:x%x refcnt %d", - ndlp->nlp_DID, kref_read(&ndlp->kref), 0); - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); -- if (rc == IOCB_ERROR) -- goto out_iocb_error; -+ if (rc == IOCB_ERROR) { -+ lpfc_els_free_iocb(phba, elsiocb); -+ lpfc_nlp_put(ndlp); -+ return 1; -+ } - - return 0; -- --out_iocb_error: -- lpfc_nlp_put(ndlp); --out_free_iocb: -- lpfc_els_free_iocb(phba, elsiocb); --out_node_created: -- if (node_created) -- lpfc_nlp_put(ndlp); -- return 1; - } - - /** -@@ -3749,12 +3734,7 @@ lpfc_issue_els_farpr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry) - * - * Return code - * 0 - Successfully issued rdf command -- * < 0 - Failed to issue rdf command -- * -EACCES - RDF not required for NPIV_PORT -- * -ENODEV - No fabric controller device available -- * -ENOMEM - No available memory -- * -EIO - The mailbox failed to complete successfully. -- * -+ * 1 - Failed to issue rdf command - **/ - int - lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) -@@ -3765,30 +3745,25 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - struct lpfc_nodelist *ndlp; - uint16_t cmdsize; - int rc; -- bool node_created = false; -- int err; - - cmdsize = sizeof(*prdf); - -- /* RDF ELS is not required on an NPIV VN_Port. */ -- if (vport->port_type == LPFC_NPIV_PORT) -- return -EACCES; -- - ndlp = lpfc_findnode_did(vport, Fabric_Cntl_DID); - if (!ndlp) { - ndlp = lpfc_nlp_init(vport, Fabric_Cntl_DID); - if (!ndlp) - return -ENODEV; - lpfc_enqueue_node(vport, ndlp); -- node_created = true; - } - -+ /* RDF ELS is not required on an NPIV VN_Port. */ -+ if (vport->port_type == LPFC_NPIV_PORT) -+ return -EACCES; -+ - elsiocb = lpfc_prep_els_iocb(vport, 1, cmdsize, retry, ndlp, - ndlp->nlp_DID, ELS_CMD_RDF); -- if (!elsiocb) { -- err = -ENOMEM; -- goto out_node_created; -- } -+ if (!elsiocb) -+ return -ENOMEM; - - /* Configure the payload for the supported FPIN events. */ - prdf = (struct lpfc_els_rdf_req *)elsiocb->cmd_dmabuf->virt; -@@ -3814,8 +3789,8 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - elsiocb->cmd_cmpl = lpfc_cmpl_els_disc_cmd; - elsiocb->ndlp = lpfc_nlp_get(ndlp); - if (!elsiocb->ndlp) { -- err = -EIO; -- goto out_free_iocb; -+ lpfc_els_free_iocb(phba, elsiocb); -+ return -EIO; - } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, -@@ -3824,19 +3799,11 @@ lpfc_issue_els_rdf(struct lpfc_vport *vport, uint8_t retry) - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { -- err = -EIO; -- goto out_iocb_error; -+ lpfc_els_free_iocb(phba, elsiocb); -+ lpfc_nlp_put(ndlp); -+ return -EIO; - } - return 0; -- --out_iocb_error: -- lpfc_nlp_put(ndlp); --out_free_iocb: -- lpfc_els_free_iocb(phba, elsiocb); --out_node_created: -- if (node_created) -- lpfc_nlp_put(ndlp); -- return err; - } - - /** -@@ -3857,23 +3824,19 @@ static int - lpfc_els_rcv_rdf(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - struct lpfc_nodelist *ndlp) - { -- int rc; -- -- rc = lpfc_els_rsp_acc(vport, ELS_CMD_RDF, cmdiocb, ndlp, NULL); - /* Send LS_ACC */ -- if (rc) { -+ if (lpfc_els_rsp_acc(vport, ELS_CMD_RDF, cmdiocb, ndlp, NULL)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, -- "1623 Failed to RDF_ACC from x%x for x%x Data: %d\n", -- ndlp->nlp_DID, vport->fc_myDID, rc); -+ "1623 Failed to RDF_ACC from x%x for x%x\n", -+ ndlp->nlp_DID, vport->fc_myDID); - return -EIO; - } - -- rc = lpfc_issue_els_rdf(vport, 0); - /* Issue new RDF for reregistering */ -- if (rc) { -+ if (lpfc_issue_els_rdf(vport, 0)) { - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS | LOG_CGN_MGMT, -- "2623 Failed to re register RDF for x%x Data: %d\n", -- vport->fc_myDID, rc); -+ "2623 Failed to re register RDF for x%x\n", -+ vport->fc_myDID); - return -EIO; - } - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index f3bd42652549..e32a2dfa516a 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -3057,6 +3057,12 @@ lpfc_cleanup(struct lpfc_vport *vport) - lpfc_vmid_vport_cleanup(vport); - - list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -+ if (ndlp->nlp_DID == Fabric_Cntl_DID && -+ ndlp->nlp_state == NLP_STE_UNUSED_NODE) { -+ lpfc_nlp_put(ndlp); -+ continue; -+ } -+ - /* Fabric Ports not in UNMAPPED state are cleaned up in the - * DEVICE_RM event. - */ diff --git a/SOURCES/1135-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch b/SOURCES/1135-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch deleted file mode 100644 index 5e28f1c9f..000000000 --- a/SOURCES/1135-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch +++ /dev/null @@ -1,169 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" -# Revert of 355b54c3c42b0525403b8b17058d27d418a24106 - scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 42bf2fda825f..4d095a3bcb0e 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -312,6 +312,7 @@ struct lpfc_defer_flogi_acc { - u16 rx_id; - u16 ox_id; - struct lpfc_nodelist *ndlp; -+ - }; - - #define LPFC_VMID_TIMER 300 /* timer interval in seconds */ -diff --git a/drivers/scsi/lpfc/lpfc_disc.h b/drivers/scsi/lpfc/lpfc_disc.h -index 51cb8571c049..3d47dc7458d1 100644 ---- a/drivers/scsi/lpfc/lpfc_disc.h -+++ b/drivers/scsi/lpfc/lpfc_disc.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2013 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -@@ -208,7 +208,6 @@ enum lpfc_nlp_flag { - NPR list */ - NLP_RM_DFLT_RPI = 26, /* need to remove leftover dflt RPI */ - NLP_NODEV_REMOVE = 27, /* Defer removal till discovery ends */ -- NLP_FLOGI_DFR_ACC = 28, /* FLOGI LS_ACC was Deferred */ - NLP_SC_REQ = 29, /* Target requires authentication */ - NLP_FIRSTBURST = 30, /* Target supports FirstBurst */ - NLP_RPI_REGISTERED = 31 /* nlp_rpi is valid */ -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 74b1a4116aee..5beef9df9884 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1413,12 +1413,11 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - phba->defer_flogi_acc.ox_id; - } - -- /* The LS_ACC completion needs to drop the initial reference. -- * This is a special case for Pt2Pt because both FLOGIs need -- * to complete and lpfc defers the LS_ACC when the remote -- * FLOGI arrives before the driver's FLOGI. -- */ -- set_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag); -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -+ "3354 Xmit deferred FLOGI ACC: rx_id: x%x," -+ " ox_id: x%x, hba_flag x%lx\n", -+ phba->defer_flogi_acc.rx_id, -+ phba->defer_flogi_acc.ox_id, phba->hba_flag); - - /* Send deferred FLOGI ACC */ - lpfc_els_rsp_acc(vport, ELS_CMD_FLOGI, &defer_flogi_acc, -@@ -1434,14 +1433,6 @@ lpfc_issue_els_flogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - phba->defer_flogi_acc.ndlp = NULL; - } - -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "3354 Xmit deferred FLOGI ACC: rx_id: x%x," -- " ox_id: x%x, ndlp x%px hba_flag x%lx\n", -- phba->defer_flogi_acc.rx_id, -- phba->defer_flogi_acc.ox_id, -- phba->defer_flogi_acc.ndlp, -- phba->hba_flag); -- - vport->fc_myDID = did; - } - -@@ -5310,12 +5301,11 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - IOCB_t *irsp; - LPFC_MBOXQ_t *mbox = NULL; - u32 ulp_status, ulp_word4, tmo, did, iotag; -- u32 cmd; - - if (!vport) { - lpfc_printf_log(phba, KERN_WARNING, LOG_ELS, - "3177 null vport in ELS rsp\n"); -- goto release; -+ goto out; - } - if (cmdiocb->context_un.mbox) - mbox = cmdiocb->context_un.mbox; -@@ -5425,7 +5415,7 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - * these conditions because it doesn't need the login. - */ - if (phba->sli_rev == LPFC_SLI_REV4 && -- vport->port_type == LPFC_NPIV_PORT && -+ vport && vport->port_type == LPFC_NPIV_PORT && - !(ndlp->fc4_xpt_flags & SCSI_XPT_REGD)) { - if (ndlp->nlp_state != NLP_STE_PLOGI_ISSUE && - ndlp->nlp_state != NLP_STE_REG_LOGIN_ISSUE && -@@ -5441,27 +5431,6 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - } - } - -- /* The driver's unsolicited deferred FLOGI ACC in Pt2Pt needs to -- * release the initial reference because the put after the free_iocb -- * call removes only the reference from the defer logic. This FLOGI -- * is never registered with the SCSI transport. -- */ -- if (test_bit(FC_PT2PT, &vport->fc_flag) && -- test_and_clear_bit(NLP_FLOGI_DFR_ACC, &ndlp->nlp_flag)) { -- lpfc_printf_vlog(vport, KERN_INFO, -- LOG_ELS | LOG_NODE | LOG_DISCOVERY, -- "3357 Pt2Pt Defer FLOGI ACC ndlp x%px, " -- "nflags x%lx, fc_flag x%lx\n", -- ndlp, ndlp->nlp_flag, -- vport->fc_flag); -- cmd = *((u32 *)cmdiocb->cmd_dmabuf->virt); -- if (cmd == ELS_CMD_ACC) { -- if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); -- } -- } -- --release: - /* Release the originating I/O reference. */ - lpfc_els_free_iocb(phba, cmdiocb); - lpfc_nlp_put(ndlp); -@@ -8430,6 +8399,13 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - &wqe->xmit_els_rsp.wqe_com); - - vport->fc_myDID = did; -+ -+ lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -+ "3344 Deferring FLOGI ACC: rx_id: x%x," -+ " ox_id: x%x, hba_flag x%lx\n", -+ phba->defer_flogi_acc.rx_id, -+ phba->defer_flogi_acc.ox_id, phba->hba_flag); -+ - phba->defer_flogi_acc.flag = true; - - /* This nlp_get is paired with nlp_puts that reset the -@@ -8438,14 +8414,6 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - * processed or cancelled. - */ - phba->defer_flogi_acc.ndlp = lpfc_nlp_get(ndlp); -- -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "3344 Deferring FLOGI ACC: rx_id: x%x," -- " ox_id: x%x, ndlp x%px, hba_flag x%lx\n", -- phba->defer_flogi_acc.rx_id, -- phba->defer_flogi_acc.ox_id, -- phba->defer_flogi_acc.ndlp, -- phba->hba_flag); - return 0; - } - -@@ -10391,8 +10359,11 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - * Do not process any unsolicited ELS commands - * if the ndlp is in DEV_LOSS - */ -- if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag)) -+ if (test_bit(NLP_IN_DEV_LOSS, &ndlp->nlp_flag)) { -+ if (newnode) -+ lpfc_nlp_put(ndlp); - goto dropit; -+ } - - elsiocb->ndlp = lpfc_nlp_get(ndlp); - if (!elsiocb->ndlp) diff --git a/SOURCES/1136-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch b/SOURCES/1136-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch deleted file mode 100644 index 5a2a9b85e..000000000 --- a/SOURCES/1136-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch +++ /dev/null @@ -1,54 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" -# Revert of 35234917d9a2719b77db215e5b8dce2e2687bce9 - scsi: lpfc: Ensure unregistration of rpis for received PLOGIs - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 5beef9df9884..377add7048d7 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3263,7 +3263,7 @@ lpfc_reg_fab_ctrl_node(struct lpfc_vport *vport, struct lpfc_nodelist *fc_ndlp) - return -ENOMEM; - } - rc = lpfc_reg_rpi(phba, vport->vpi, fc_ndlp->nlp_DID, -- (u8 *)&ns_ndlp->fc_sparam, mbox, fc_ndlp->nlp_rpi); -+ (u8 *)&vport->fc_sparam, mbox, fc_ndlp->nlp_rpi); - if (rc) { - rc = -EACCES; - goto out; -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index e16370da3e45..99aefc54ac35 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -452,7 +452,18 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - */ - if (!(ndlp->nlp_type & NLP_FABRIC) && - !(phba->nvmet_support)) { -- break; -+ /* Clear ndlp info, since follow up PRLI may have -+ * updated ndlp information -+ */ -+ ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); -+ ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); -+ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; -+ ndlp->nlp_nvme_info &= ~NLP_NVME_NSLER; -+ clear_bit(NLP_FIRSTBURST, &ndlp->nlp_flag); -+ -+ lpfc_els_rsp_acc(vport, ELS_CMD_PLOGI, cmdiocb, -+ ndlp, NULL); -+ return 1; - } - if (nlp_portwwn != 0 && - nlp_portwwn != wwn_to_u64(sp->portName.u.wwn)) -@@ -474,9 +485,7 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, - lpfc_nlp_set_state(vport, ndlp, NLP_STE_NPR_NODE); - break; - } -- /* Clear ndlp info, since follow up processes may have -- * updated ndlp information -- */ -+ - ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); - ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); - ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; diff --git a/SOURCES/1137-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch b/SOURCES/1137-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch deleted file mode 100644 index bba926916..000000000 --- a/SOURCES/1137-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch +++ /dev/null @@ -1,25 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" -# Revert of 9ed3e03334ac8ffb8a7371dc760940ef8de5d0ea - scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb() - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 377add7048d7..9bc2f4975566 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5158,12 +5158,14 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) - } else { - buf_ptr1 = elsiocb->cmd_dmabuf; - lpfc_els_free_data(phba, buf_ptr1); -+ elsiocb->cmd_dmabuf = NULL; - } - } - - if (elsiocb->bpl_dmabuf) { - buf_ptr = elsiocb->bpl_dmabuf; - lpfc_els_free_bpl(phba, buf_ptr); -+ elsiocb->bpl_dmabuf = NULL; - } - lpfc_sli_release_iocbq(phba, elsiocb); - return 0; diff --git a/SOURCES/1138-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch b/SOURCES/1138-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch deleted file mode 100644 index 71e048e12..000000000 --- a/SOURCES/1138-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch +++ /dev/null @@ -1,107 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Revise discovery related function headers and comments" -# Revert of 75d230ed196c1375f5a200039c8ee4495240c57c - scsi: lpfc: Revise discovery related function headers and comments - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 9bc2f4975566..7f6ddf50c315 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3024,7 +3024,6 @@ lpfc_cmpl_els_logo(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - ndlp->nlp_DID, ulp_status, - ulp_word4); - -- /* Call NLP_EVT_DEVICE_RM if link is down or LOGO is aborted */ - if (lpfc_error_lost_link(vport, ulp_status, ulp_word4)) - skip_recovery = 1; - } -@@ -3307,8 +3306,7 @@ lpfc_reg_fab_ctrl_node(struct lpfc_vport *vport, struct lpfc_nodelist *fc_ndlp) - * - * This routine is a generic completion callback function for Discovery ELS cmd. - * Currently used by the ELS command issuing routines for the ELS State Change -- * Request (SCR), lpfc_issue_els_scr(), Exchange Diagnostic Capabilities (EDC), -- * lpfc_issue_els_edc() and the ELS RDF, lpfc_issue_els_rdf(). -+ * Request (SCR), lpfc_issue_els_scr() and the ELS RDF, lpfc_issue_els_rdf(). - * These commands will be retried once only for ELS timeout errors. - **/ - static void -@@ -3707,7 +3705,10 @@ lpfc_issue_els_farpr(struct lpfc_vport *vport, uint32_t nportid, uint8_t retry) - lpfc_nlp_put(ndlp); - return 1; - } -- -+ /* This will cause the callback-function lpfc_cmpl_els_cmd to -+ * trigger the release of the node. -+ */ -+ /* Don't release reference count as RDF is likely outstanding */ - return 0; - } - -@@ -4298,7 +4299,7 @@ lpfc_issue_els_edc(struct lpfc_vport *vport, uint8_t retry) - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { - /* The additional lpfc_nlp_put will cause the following -- * lpfc_els_free_iocb routine to trigger the release of -+ * lpfc_els_free_iocb routine to trigger the rlease of - * the node. - */ - lpfc_els_free_iocb(phba, elsiocb); -@@ -5125,7 +5126,7 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) - { - struct lpfc_dmabuf *buf_ptr, *buf_ptr1; - -- /* The I/O iocb is complete. Clear the node and first dmabuf */ -+ /* The I/O iocb is complete. Clear the node and first dmbuf */ - elsiocb->ndlp = NULL; - - /* cmd_dmabuf = cmd, cmd_dmabuf->next = rsp, bpl_dmabuf = bpl */ -@@ -8733,7 +8734,7 @@ lpfc_els_rcv_rls(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - * @cmdiocb: pointer to lpfc command iocb data structure. - * @ndlp: pointer to a node-list data structure. - * -- * This routine processes Read Timeout Value (RTV) IOCB received as an -+ * This routine processes Read Timout Value (RTV) IOCB received as an - * ELS unsolicited event. It first checks the remote port state. If the - * remote port is not in NLP_STE_UNMAPPED_NODE state or NLP_STE_MAPPED_NODE - * state, it invokes the lpfc_els_rsl_reject() routine to send the reject -@@ -10847,7 +10848,7 @@ lpfc_els_unsol_event(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - lpfc_els_unsol_buffer(phba, pring, vport, elsiocb); - /* - * The different unsolicited event handlers would tell us -- * if they are done with "mp" by setting cmd_dmabuf/bpl_dmabuf to NULL. -+ * if they are done with "mp" by setting cmd_dmabuf to NULL. - */ - if (elsiocb->cmd_dmabuf) { - lpfc_in_buf_free(phba, elsiocb->cmd_dmabuf); -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 66730c3e4cb9..e658f2a914d9 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -19867,15 +19867,13 @@ lpfc_sli4_remove_rpis(struct lpfc_hba *phba) - } - - /** -- * lpfc_sli4_resume_rpi - Resume traffic relative to an RPI -+ * lpfc_sli4_resume_rpi - Remove the rpi bitmask region - * @ndlp: pointer to lpfc nodelist data structure. - * @cmpl: completion call-back. - * @iocbq: data to load as mbox ctx_u information - * -- * Return codes -- * 0 - successful -- * -ENOMEM - No available memory -- * -EIO - The mailbox failed to complete successfully. -+ * This routine is invoked to remove the memory region that -+ * provided rpi via a bitmask. - **/ - int - lpfc_sli4_resume_rpi(struct lpfc_nodelist *ndlp, -@@ -19905,6 +19903,7 @@ lpfc_sli4_resume_rpi(struct lpfc_nodelist *ndlp, - return -EIO; - } - -+ /* Post all rpi memory regions to the port. */ - lpfc_resume_rpi(mboxq, ndlp); - if (cmpl) { - mboxq->mbox_cmpl = cmpl; diff --git a/SOURCES/1139-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch b/SOURCES/1139-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch deleted file mode 100644 index 6a88c7868..000000000 --- a/SOURCES/1139-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch +++ /dev/null @@ -1,47 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" -# Revert of 958b3db3862eeef3b1e92c877d70f57ce019740a - scsi: lpfc: Update various NPIV diagnostic log messaging - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 7f6ddf50c315..0630d109e767 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -2367,7 +2367,7 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - mode = KERN_INFO; - - /* Warn PRLI status */ -- lpfc_vlog_msg(vport, mode, LOG_ELS, -+ lpfc_printf_vlog(vport, mode, LOG_ELS, - "2754 PRLI DID:%06X Status:x%x/x%x, " - "data: x%x x%x x%lx\n", - ndlp->nlp_DID, ulp_status, -@@ -3597,8 +3597,8 @@ lpfc_issue_els_rscn(struct lpfc_vport *vport, uint8_t retry) - } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, -- "Issue RSCN: did:x%x refcnt %d", -- ndlp->nlp_DID, kref_read(&ndlp->kref), 0); -+ "Issue RSCN: did:x%x", -+ ndlp->nlp_DID, 0, 0); - - rc = lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0); - if (rc == IOCB_ERROR) { -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index e32a2dfa516a..2f3629ef64e6 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -9077,9 +9077,9 @@ lpfc_setup_fdmi_mask(struct lpfc_vport *vport) - vport->fdmi_port_mask = LPFC_FDMI2_PORT_ATTR; - } - -- lpfc_printf_vlog(vport, KERN_INFO, LOG_DISCOVERY, -- "6077 Setup FDMI mask: hba x%x port x%x\n", -- vport->fdmi_hba_mask, vport->fdmi_port_mask); -+ lpfc_printf_log(phba, KERN_INFO, LOG_DISCOVERY, -+ "6077 Setup FDMI mask: hba x%x port x%x\n", -+ vport->fdmi_hba_mask, vport->fdmi_port_mask); - } - - /** diff --git a/SOURCES/1140-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch b/SOURCES/1140-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch deleted file mode 100644 index 9eaa31974..000000000 --- a/SOURCES/1140-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch +++ /dev/null @@ -1,58 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" -# Revert of 6da7906c531c73840fecb724d4da97334ab46ca6 - scsi: lpfc: Copyright updates for 14.4.0.11 patches - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 4d095a3bcb0e..5e08f7a39702 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index a1464f8ac331..566dd84e0677 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2022 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2007-2011 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index 3bc0efa7453e..b287d39ad033 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 99aefc54ac35..1e331b76dff4 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * diff --git a/SOURCES/1141-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch b/SOURCES/1141-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch deleted file mode 100644 index b65f9521f..000000000 --- a/SOURCES/1141-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" -# Revert of 1a4e6ee8d31372eff037fed3dfc762ecbe964e98 - scsi: lpfc: Update lpfc version to 14.4.0.11 - - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index 31c3c5abdca6..9ee3a3a4ec4d 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.11" -+#define LPFC_DRIVER_VERSION "14.4.0.10" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/SOURCES/1142-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch b/SOURCES/1142-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch deleted file mode 100644 index 02d678131..000000000 --- a/SOURCES/1142-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch +++ /dev/null @@ -1,92 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" -# Revert of a20734de11ba1c0ef97622bf51ee502b626dca0a - scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 5e08f7a39702..291f0cc38f14 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -1333,7 +1333,7 @@ struct lpfc_hba { - unsigned long last_ramp_down_time; - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - struct dentry *hba_debugfs_root; -- unsigned int debugfs_vport_count; -+ atomic_t debugfs_vport_count; - - struct lpfc_debugfs_nvmeio_trc *nvmeio_trc; - atomic_t nvmeio_trc_cnt; -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index a4378c66427c..bfc0b9c40c5b 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -5752,7 +5752,7 @@ static const struct file_operations lpfc_debugfs_op_slow_ring_trc = { - }; - - static struct dentry *lpfc_debugfs_root = NULL; --static unsigned int lpfc_debugfs_hba_count; -+static atomic_t lpfc_debugfs_hba_count; - - /* - * File operations for the iDiag debugfs -@@ -6074,7 +6074,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - /* Setup lpfc root directory */ - if (!lpfc_debugfs_root) { - lpfc_debugfs_root = debugfs_create_dir("lpfc", NULL); -- lpfc_debugfs_hba_count = 0; -+ atomic_set(&lpfc_debugfs_hba_count, 0); - if (IS_ERR(lpfc_debugfs_root)) { - lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, - "0527 Cannot create debugfs lpfc\n"); -@@ -6090,13 +6090,13 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - pport_setup = true; - phba->hba_debugfs_root = - debugfs_create_dir(name, lpfc_debugfs_root); -- phba->debugfs_vport_count = 0; -+ atomic_set(&phba->debugfs_vport_count, 0); - if (IS_ERR(phba->hba_debugfs_root)) { - lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, - "0528 Cannot create debugfs %s\n", name); - return; - } -- lpfc_debugfs_hba_count++; -+ atomic_inc(&lpfc_debugfs_hba_count); - - /* Multi-XRI pools */ - debugfs_create_file("multixripools", 0644, -@@ -6268,7 +6268,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - "0529 Cannot create debugfs %s\n", name); - return; - } -- phba->debugfs_vport_count++; -+ atomic_inc(&phba->debugfs_vport_count); - } - - if (lpfc_debugfs_max_disc_trc) { -@@ -6402,10 +6402,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - if (vport->vport_debugfs_root) { - debugfs_remove(vport->vport_debugfs_root); /* vportX */ - vport->vport_debugfs_root = NULL; -- phba->debugfs_vport_count--; -+ atomic_dec(&phba->debugfs_vport_count); - } - -- if (!phba->debugfs_vport_count) { -+ if (atomic_read(&phba->debugfs_vport_count) == 0) { - kfree(phba->slow_ring_trc); - phba->slow_ring_trc = NULL; - -@@ -6415,10 +6415,10 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - if (phba->hba_debugfs_root) { - debugfs_remove(phba->hba_debugfs_root); /* fnX */ - phba->hba_debugfs_root = NULL; -- lpfc_debugfs_hba_count--; -+ atomic_dec(&lpfc_debugfs_hba_count); - } - -- if (!lpfc_debugfs_hba_count) { -+ if (atomic_read(&lpfc_debugfs_hba_count) == 0) { - debugfs_remove(lpfc_debugfs_root); /* lpfc */ - lpfc_debugfs_root = NULL; - } diff --git a/SOURCES/1143-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch b/SOURCES/1143-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch deleted file mode 100644 index 1993c32ed..000000000 --- a/SOURCES/1143-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch +++ /dev/null @@ -1,683 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Clean up extraneous phba dentries" -# Revert of 080408a120c922181dec5d5a59ee6e94b010bbc5 - scsi: lpfc: Clean up extraneous phba dentries - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 291f0cc38f14..0a43be24cee8 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -742,6 +742,12 @@ struct lpfc_vport { - struct lpfc_vmid_priority_info vmid_priority; - - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS -+ struct dentry *debug_disc_trc; -+ struct dentry *debug_nodelist; -+ struct dentry *debug_nvmestat; -+ struct dentry *debug_scsistat; -+ struct dentry *debug_ioktime; -+ struct dentry *debug_hdwqstat; - struct dentry *vport_debugfs_root; - struct lpfc_debugfs_trc *disc_trc; - atomic_t disc_trc_cnt; -@@ -1334,8 +1340,29 @@ struct lpfc_hba { - #ifdef CONFIG_SCSI_LPFC_DEBUG_FS - struct dentry *hba_debugfs_root; - atomic_t debugfs_vport_count; -- -+ struct dentry *debug_multixri_pools; -+ struct dentry *debug_hbqinfo; -+ struct dentry *debug_dumpHostSlim; -+ struct dentry *debug_dumpHBASlim; -+ struct dentry *debug_InjErrLBA; /* LBA to inject errors at */ -+ struct dentry *debug_InjErrNPortID; /* NPortID to inject errors at */ -+ struct dentry *debug_InjErrWWPN; /* WWPN to inject errors at */ -+ struct dentry *debug_writeGuard; /* inject write guard_tag errors */ -+ struct dentry *debug_writeApp; /* inject write app_tag errors */ -+ struct dentry *debug_writeRef; /* inject write ref_tag errors */ -+ struct dentry *debug_readGuard; /* inject read guard_tag errors */ -+ struct dentry *debug_readApp; /* inject read app_tag errors */ -+ struct dentry *debug_readRef; /* inject read ref_tag errors */ -+ -+ struct dentry *debug_nvmeio_trc; - struct lpfc_debugfs_nvmeio_trc *nvmeio_trc; -+ struct dentry *debug_hdwqinfo; -+#ifdef LPFC_HDWQ_LOCK_STAT -+ struct dentry *debug_lockstat; -+#endif -+ struct dentry *debug_cgn_buffer; -+ struct dentry *debug_rx_monitor; -+ struct dentry *debug_ras_log; - atomic_t nvmeio_trc_cnt; - uint32_t nvmeio_trc_size; - uint32_t nvmeio_trc_output_idx; -@@ -1352,10 +1379,19 @@ struct lpfc_hba { - sector_t lpfc_injerr_lba; - #define LPFC_INJERR_LBA_OFF (sector_t)(-1) - -+ struct dentry *debug_slow_ring_trc; - struct lpfc_debugfs_trc *slow_ring_trc; - atomic_t slow_ring_trc_cnt; - /* iDiag debugfs sub-directory */ - struct dentry *idiag_root; -+ struct dentry *idiag_pci_cfg; -+ struct dentry *idiag_bar_acc; -+ struct dentry *idiag_que_info; -+ struct dentry *idiag_que_acc; -+ struct dentry *idiag_drb_acc; -+ struct dentry *idiag_ctl_acc; -+ struct dentry *idiag_mbx_acc; -+ struct dentry *idiag_ext_acc; - uint8_t lpfc_idiag_last_eq; - #endif - uint16_t nvmeio_trc_on; -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index bfc0b9c40c5b..892e2177663a 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6075,11 +6075,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - if (!lpfc_debugfs_root) { - lpfc_debugfs_root = debugfs_create_dir("lpfc", NULL); - atomic_set(&lpfc_debugfs_hba_count, 0); -- if (IS_ERR(lpfc_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0527 Cannot create debugfs lpfc\n"); -- return; -- } - } - if (!lpfc_debugfs_start_time) - lpfc_debugfs_start_time = jiffies; -@@ -6090,96 +6085,150 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - pport_setup = true; - phba->hba_debugfs_root = - debugfs_create_dir(name, lpfc_debugfs_root); -- atomic_set(&phba->debugfs_vport_count, 0); -- if (IS_ERR(phba->hba_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0528 Cannot create debugfs %s\n", name); -- return; -- } - atomic_inc(&lpfc_debugfs_hba_count); -+ atomic_set(&phba->debugfs_vport_count, 0); - - /* Multi-XRI pools */ -- debugfs_create_file("multixripools", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_multixripools); -+ snprintf(name, sizeof(name), "multixripools"); -+ phba->debug_multixri_pools = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, -+ &lpfc_debugfs_op_multixripools); -+ if (IS_ERR(phba->debug_multixri_pools)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "0527 Cannot create debugfs multixripools\n"); -+ goto debug_failed; -+ } - - /* Congestion Info Buffer */ -- debugfs_create_file("cgn_buffer", 0644, phba->hba_debugfs_root, -- phba, &lpfc_cgn_buffer_op); -+ scnprintf(name, sizeof(name), "cgn_buffer"); -+ phba->debug_cgn_buffer = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_cgn_buffer_op); -+ if (IS_ERR(phba->debug_cgn_buffer)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6527 Cannot create debugfs " -+ "cgn_buffer\n"); -+ goto debug_failed; -+ } - - /* RX Monitor */ -- debugfs_create_file("rx_monitor", 0644, phba->hba_debugfs_root, -- phba, &lpfc_rx_monitor_op); -+ scnprintf(name, sizeof(name), "rx_monitor"); -+ phba->debug_rx_monitor = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_rx_monitor_op); -+ if (IS_ERR(phba->debug_rx_monitor)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6528 Cannot create debugfs " -+ "rx_monitor\n"); -+ goto debug_failed; -+ } - - /* RAS log */ -- debugfs_create_file("ras_log", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_ras_log); -+ snprintf(name, sizeof(name), "ras_log"); -+ phba->debug_ras_log = -+ debugfs_create_file(name, 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_ras_log); -+ if (IS_ERR(phba->debug_ras_log)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "6148 Cannot create debugfs" -+ " ras_log\n"); -+ goto debug_failed; -+ } - - /* Setup hbqinfo */ -- debugfs_create_file("hbqinfo", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_hbqinfo); -+ snprintf(name, sizeof(name), "hbqinfo"); -+ phba->debug_hbqinfo = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_hbqinfo); - - #ifdef LPFC_HDWQ_LOCK_STAT - /* Setup lockstat */ -- debugfs_create_file("lockstat", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_lockstat); -+ snprintf(name, sizeof(name), "lockstat"); -+ phba->debug_lockstat = -+ debugfs_create_file(name, S_IFREG | 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_lockstat); -+ if (IS_ERR(phba->debug_lockstat)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "4610 Can't create debugfs lockstat\n"); -+ goto debug_failed; -+ } - #endif -+ -+ /* Setup dumpHBASlim */ - if (phba->sli_rev < LPFC_SLI_REV4) { -- /* Setup dumpHBASlim */ -- debugfs_create_file("dumpHBASlim", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_dumpHBASlim); -- } -+ snprintf(name, sizeof(name), "dumpHBASlim"); -+ phba->debug_dumpHBASlim = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_dumpHBASlim); -+ } else -+ phba->debug_dumpHBASlim = NULL; - -+ /* Setup dumpHostSlim */ - if (phba->sli_rev < LPFC_SLI_REV4) { -- /* Setup dumpHostSlim */ -- debugfs_create_file("dumpHostSlim", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_dumpHostSlim); -- } -+ snprintf(name, sizeof(name), "dumpHostSlim"); -+ phba->debug_dumpHostSlim = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_dumpHostSlim); -+ } else -+ phba->debug_dumpHostSlim = NULL; - - /* Setup DIF Error Injections */ -- debugfs_create_file_aux_num("InjErrLBA", 0644, -- phba->hba_debugfs_root, phba, -- InjErrLBA, -- &lpfc_debugfs_op_dif_err); -+ phba->debug_InjErrLBA = -+ debugfs_create_file_aux_num("InjErrLBA", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrLBA, &lpfc_debugfs_op_dif_err); - phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; - -- debugfs_create_file_aux_num("InjErrNPortID", 0644, -- phba->hba_debugfs_root, phba, -- InjErrNPortID, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("InjErrWWPN", 0644, -- phba->hba_debugfs_root, phba, -- InjErrWWPN, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeGuardInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeGuard, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeAppInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeApp, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("writeRefInjErr", 0644, -- phba->hba_debugfs_root, phba, -- writeRef, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readGuardInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readGuard, -- &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readAppInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readApp, &lpfc_debugfs_op_dif_err); -- -- debugfs_create_file_aux_num("readRefInjErr", 0644, -- phba->hba_debugfs_root, phba, -- readRef, &lpfc_debugfs_op_dif_err); -+ phba->debug_InjErrNPortID = -+ debugfs_create_file_aux_num("InjErrNPortID", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrNPortID, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_InjErrWWPN = -+ debugfs_create_file_aux_num("InjErrWWPN", 0644, -+ phba->hba_debugfs_root, -+ phba, InjErrWWPN, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeGuard = -+ debugfs_create_file_aux_num("writeGuardInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeGuard, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeApp = -+ debugfs_create_file_aux_num("writeAppInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeApp, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_writeRef = -+ debugfs_create_file_aux_num("writeRefInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, writeRef, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readGuard = -+ debugfs_create_file_aux_num("readGuardInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readGuard, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readApp = -+ debugfs_create_file_aux_num("readAppInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readApp, &lpfc_debugfs_op_dif_err); -+ -+ phba->debug_readRef = -+ debugfs_create_file_aux_num("readRefInjErr", 0644, -+ phba->hba_debugfs_root, -+ phba, readRef, &lpfc_debugfs_op_dif_err); - - /* Setup slow ring trace */ - if (lpfc_debugfs_max_slow_ring_trc) { -@@ -6199,9 +6248,11 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - } - } - -- debugfs_create_file("slow_ring_trace", 0644, -- phba->hba_debugfs_root, phba, -- &lpfc_debugfs_op_slow_ring_trc); -+ snprintf(name, sizeof(name), "slow_ring_trace"); -+ phba->debug_slow_ring_trc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_slow_ring_trc); - if (!phba->slow_ring_trc) { - phba->slow_ring_trc = kcalloc( - lpfc_debugfs_max_slow_ring_trc, -@@ -6211,13 +6262,16 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, - "0416 Cannot create debugfs " - "slow_ring buffer\n"); -- goto out; -+ goto debug_failed; - } - atomic_set(&phba->slow_ring_trc_cnt, 0); - } - -- debugfs_create_file("nvmeio_trc", 0644, phba->hba_debugfs_root, -- phba, &lpfc_debugfs_op_nvmeio_trc); -+ snprintf(name, sizeof(name), "nvmeio_trc"); -+ phba->debug_nvmeio_trc = -+ debugfs_create_file(name, 0644, -+ phba->hba_debugfs_root, -+ phba, &lpfc_debugfs_op_nvmeio_trc); - - atomic_set(&phba->nvmeio_trc_cnt, 0); - if (lpfc_debugfs_max_nvmeio_trc) { -@@ -6263,11 +6317,6 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - if (!vport->vport_debugfs_root) { - vport->vport_debugfs_root = - debugfs_create_dir(name, phba->hba_debugfs_root); -- if (IS_ERR(vport->vport_debugfs_root)) { -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_INIT, -- "0529 Cannot create debugfs %s\n", name); -- return; -- } - atomic_inc(&phba->debugfs_vport_count); - } - -@@ -6295,27 +6344,54 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, - "0418 Cannot create debugfs disc trace " - "buffer\n"); -- goto out; -+ goto debug_failed; - } - atomic_set(&vport->disc_trc_cnt, 0); - -- debugfs_create_file("discovery_trace", 0644, vport->vport_debugfs_root, -- vport, &lpfc_debugfs_op_disc_trc); -- -- debugfs_create_file("nodelist", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_nodelist); -- -- debugfs_create_file("nvmestat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_nvmestat); -- -- debugfs_create_file("scsistat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_scsistat); -+ snprintf(name, sizeof(name), "discovery_trace"); -+ vport->debug_disc_trc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_disc_trc); -+ snprintf(name, sizeof(name), "nodelist"); -+ vport->debug_nodelist = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_nodelist); -+ -+ snprintf(name, sizeof(name), "nvmestat"); -+ vport->debug_nvmestat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_nvmestat); -+ -+ snprintf(name, sizeof(name), "scsistat"); -+ vport->debug_scsistat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_scsistat); -+ if (IS_ERR(vport->debug_scsistat)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "4611 Cannot create debugfs scsistat\n"); -+ goto debug_failed; -+ } - -- debugfs_create_file("ioktime", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_ioktime); -+ snprintf(name, sizeof(name), "ioktime"); -+ vport->debug_ioktime = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_ioktime); -+ if (IS_ERR(vport->debug_ioktime)) { -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_INIT, -+ "0815 Cannot create debugfs ioktime\n"); -+ goto debug_failed; -+ } - -- debugfs_create_file("hdwqstat", 0644, vport->vport_debugfs_root, vport, -- &lpfc_debugfs_op_hdwqstat); -+ snprintf(name, sizeof(name), "hdwqstat"); -+ vport->debug_hdwqstat = -+ debugfs_create_file(name, 0644, -+ vport->vport_debugfs_root, -+ vport, &lpfc_debugfs_op_hdwqstat); - - /* - * The following section is for additional directories/files for the -@@ -6323,58 +6399,93 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - */ - - if (!pport_setup) -- return; -+ goto debug_failed; - - /* - * iDiag debugfs root entry points for SLI4 device only - */ - if (phba->sli_rev < LPFC_SLI_REV4) -- return; -+ goto debug_failed; - -+ snprintf(name, sizeof(name), "iDiag"); - if (!phba->idiag_root) { - phba->idiag_root = -- debugfs_create_dir("iDiag", phba->hba_debugfs_root); -+ debugfs_create_dir(name, phba->hba_debugfs_root); - /* Initialize iDiag data structure */ - memset(&idiag, 0, sizeof(idiag)); - } - - /* iDiag read PCI config space */ -- debugfs_create_file("pciCfg", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_pciCfg); -- idiag.offset.last_rd = 0; -+ snprintf(name, sizeof(name), "pciCfg"); -+ if (!phba->idiag_pci_cfg) { -+ phba->idiag_pci_cfg = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_pciCfg); -+ idiag.offset.last_rd = 0; -+ } - - /* iDiag PCI BAR access */ -- debugfs_create_file("barAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_barAcc); -- idiag.offset.last_rd = 0; -+ snprintf(name, sizeof(name), "barAcc"); -+ if (!phba->idiag_bar_acc) { -+ phba->idiag_bar_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_barAcc); -+ idiag.offset.last_rd = 0; -+ } - - /* iDiag get PCI function queue information */ -- debugfs_create_file("queInfo", 0444, phba->idiag_root, phba, -- &lpfc_idiag_op_queInfo); -+ snprintf(name, sizeof(name), "queInfo"); -+ if (!phba->idiag_que_info) { -+ phba->idiag_que_info = -+ debugfs_create_file(name, S_IFREG|S_IRUGO, -+ phba->idiag_root, phba, &lpfc_idiag_op_queInfo); -+ } - - /* iDiag access PCI function queue */ -- debugfs_create_file("queAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_queAcc); -+ snprintf(name, sizeof(name), "queAcc"); -+ if (!phba->idiag_que_acc) { -+ phba->idiag_que_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_queAcc); -+ } - - /* iDiag access PCI function doorbell registers */ -- debugfs_create_file("drbAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_drbAcc); -+ snprintf(name, sizeof(name), "drbAcc"); -+ if (!phba->idiag_drb_acc) { -+ phba->idiag_drb_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_drbAcc); -+ } - - /* iDiag access PCI function control registers */ -- debugfs_create_file("ctlAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_ctlAcc); -+ snprintf(name, sizeof(name), "ctlAcc"); -+ if (!phba->idiag_ctl_acc) { -+ phba->idiag_ctl_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_ctlAcc); -+ } - - /* iDiag access mbox commands */ -- debugfs_create_file("mbxAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_mbxAcc); -+ snprintf(name, sizeof(name), "mbxAcc"); -+ if (!phba->idiag_mbx_acc) { -+ phba->idiag_mbx_acc = -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, &lpfc_idiag_op_mbxAcc); -+ } - - /* iDiag extents access commands */ - if (phba->sli4_hba.extents_in_use) { -- debugfs_create_file("extAcc", 0644, phba->idiag_root, phba, -- &lpfc_idiag_op_extAcc); -+ snprintf(name, sizeof(name), "extAcc"); -+ if (!phba->idiag_ext_acc) { -+ phba->idiag_ext_acc = -+ debugfs_create_file(name, -+ S_IFREG|S_IRUGO|S_IWUSR, -+ phba->idiag_root, phba, -+ &lpfc_idiag_op_extAcc); -+ } - } --out: -- /* alloc'ed items are kfree'd in lpfc_debugfs_terminate */ -+ -+debug_failed: - return; - #endif - } -@@ -6399,6 +6510,24 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - kfree(vport->disc_trc); - vport->disc_trc = NULL; - -+ debugfs_remove(vport->debug_disc_trc); /* discovery_trace */ -+ vport->debug_disc_trc = NULL; -+ -+ debugfs_remove(vport->debug_nodelist); /* nodelist */ -+ vport->debug_nodelist = NULL; -+ -+ debugfs_remove(vport->debug_nvmestat); /* nvmestat */ -+ vport->debug_nvmestat = NULL; -+ -+ debugfs_remove(vport->debug_scsistat); /* scsistat */ -+ vport->debug_scsistat = NULL; -+ -+ debugfs_remove(vport->debug_ioktime); /* ioktime */ -+ vport->debug_ioktime = NULL; -+ -+ debugfs_remove(vport->debug_hdwqstat); /* hdwqstat */ -+ vport->debug_hdwqstat = NULL; -+ - if (vport->vport_debugfs_root) { - debugfs_remove(vport->vport_debugfs_root); /* vportX */ - vport->vport_debugfs_root = NULL; -@@ -6406,12 +6535,113 @@ lpfc_debugfs_terminate(struct lpfc_vport *vport) - } - - if (atomic_read(&phba->debugfs_vport_count) == 0) { -+ -+ debugfs_remove(phba->debug_multixri_pools); /* multixripools*/ -+ phba->debug_multixri_pools = NULL; -+ -+ debugfs_remove(phba->debug_hbqinfo); /* hbqinfo */ -+ phba->debug_hbqinfo = NULL; -+ -+ debugfs_remove(phba->debug_cgn_buffer); -+ phba->debug_cgn_buffer = NULL; -+ -+ debugfs_remove(phba->debug_rx_monitor); -+ phba->debug_rx_monitor = NULL; -+ -+ debugfs_remove(phba->debug_ras_log); -+ phba->debug_ras_log = NULL; -+ -+#ifdef LPFC_HDWQ_LOCK_STAT -+ debugfs_remove(phba->debug_lockstat); /* lockstat */ -+ phba->debug_lockstat = NULL; -+#endif -+ debugfs_remove(phba->debug_dumpHBASlim); /* HBASlim */ -+ phba->debug_dumpHBASlim = NULL; -+ -+ debugfs_remove(phba->debug_dumpHostSlim); /* HostSlim */ -+ phba->debug_dumpHostSlim = NULL; -+ -+ debugfs_remove(phba->debug_InjErrLBA); /* InjErrLBA */ -+ phba->debug_InjErrLBA = NULL; -+ -+ debugfs_remove(phba->debug_InjErrNPortID); -+ phba->debug_InjErrNPortID = NULL; -+ -+ debugfs_remove(phba->debug_InjErrWWPN); /* InjErrWWPN */ -+ phba->debug_InjErrWWPN = NULL; -+ -+ debugfs_remove(phba->debug_writeGuard); /* writeGuard */ -+ phba->debug_writeGuard = NULL; -+ -+ debugfs_remove(phba->debug_writeApp); /* writeApp */ -+ phba->debug_writeApp = NULL; -+ -+ debugfs_remove(phba->debug_writeRef); /* writeRef */ -+ phba->debug_writeRef = NULL; -+ -+ debugfs_remove(phba->debug_readGuard); /* readGuard */ -+ phba->debug_readGuard = NULL; -+ -+ debugfs_remove(phba->debug_readApp); /* readApp */ -+ phba->debug_readApp = NULL; -+ -+ debugfs_remove(phba->debug_readRef); /* readRef */ -+ phba->debug_readRef = NULL; -+ - kfree(phba->slow_ring_trc); - phba->slow_ring_trc = NULL; - -+ /* slow_ring_trace */ -+ debugfs_remove(phba->debug_slow_ring_trc); -+ phba->debug_slow_ring_trc = NULL; -+ -+ debugfs_remove(phba->debug_nvmeio_trc); -+ phba->debug_nvmeio_trc = NULL; -+ - kfree(phba->nvmeio_trc); - phba->nvmeio_trc = NULL; - -+ /* -+ * iDiag release -+ */ -+ if (phba->sli_rev == LPFC_SLI_REV4) { -+ /* iDiag extAcc */ -+ debugfs_remove(phba->idiag_ext_acc); -+ phba->idiag_ext_acc = NULL; -+ -+ /* iDiag mbxAcc */ -+ debugfs_remove(phba->idiag_mbx_acc); -+ phba->idiag_mbx_acc = NULL; -+ -+ /* iDiag ctlAcc */ -+ debugfs_remove(phba->idiag_ctl_acc); -+ phba->idiag_ctl_acc = NULL; -+ -+ /* iDiag drbAcc */ -+ debugfs_remove(phba->idiag_drb_acc); -+ phba->idiag_drb_acc = NULL; -+ -+ /* iDiag queAcc */ -+ debugfs_remove(phba->idiag_que_acc); -+ phba->idiag_que_acc = NULL; -+ -+ /* iDiag queInfo */ -+ debugfs_remove(phba->idiag_que_info); -+ phba->idiag_que_info = NULL; -+ -+ /* iDiag barAcc */ -+ debugfs_remove(phba->idiag_bar_acc); -+ phba->idiag_bar_acc = NULL; -+ -+ /* iDiag pciCfg */ -+ debugfs_remove(phba->idiag_pci_cfg); -+ phba->idiag_pci_cfg = NULL; -+ -+ /* Finally remove the iDiag debugfs root */ -+ debugfs_remove(phba->idiag_root); -+ phba->idiag_root = NULL; -+ } -+ - if (phba->hba_debugfs_root) { - debugfs_remove(phba->hba_debugfs_root); /* fnX */ - phba->hba_debugfs_root = NULL; diff --git a/SOURCES/1144-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch b/SOURCES/1144-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch deleted file mode 100644 index 4ed833428..000000000 --- a/SOURCES/1144-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch +++ /dev/null @@ -1,198 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" -# Revert of ab563ef364bb83aeddbbfaa4f23f317cb3145f2e - scsi: lpfc: Use switch case statements in DIF debugfs handlers - - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 892e2177663a..cd5180151321 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2373,117 +2373,93 @@ lpfc_debugfs_dumpHostSlim_open(struct inode *inode, struct file *file) - - static ssize_t - lpfc_debugfs_dif_err_read(struct file *file, char __user *buf, -- size_t nbytes, loff_t *ppos) -+ size_t nbytes, loff_t *ppos) - { - struct lpfc_hba *phba = file->private_data; - int kind = debugfs_get_aux_num(file); -- char cbuf[32] = {0}; -+ char cbuf[32]; -+ uint64_t tmp = 0; - int cnt = 0; - -- switch (kind) { -- case writeGuard: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wgrd_cnt); -- break; -- case writeApp: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wapp_cnt); -- break; -- case writeRef: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_wref_cnt); -- break; -- case readGuard: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rgrd_cnt); -- break; -- case readApp: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rapp_cnt); -- break; -- case readRef: -- cnt = scnprintf(cbuf, sizeof(cbuf), "%u\n", -- phba->lpfc_injerr_rref_cnt); -- break; -- case InjErrNPortID: -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%06x\n", -+ if (kind == writeGuard) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt); -+ else if (kind == writeApp) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt); -+ else if (kind == writeRef) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt); -+ else if (kind == readGuard) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt); -+ else if (kind == readApp) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt); -+ else if (kind == readRef) -+ cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt); -+ else if (kind == InjErrNPortID) -+ cnt = scnprintf(cbuf, 32, "0x%06x\n", - phba->lpfc_injerr_nportid); -- break; -- case InjErrWWPN: -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%016llx\n", -- be64_to_cpu(phba->lpfc_injerr_wwpn.u.wwn_be)); -- break; -- case InjErrLBA: -- if (phba->lpfc_injerr_lba == LPFC_INJERR_LBA_OFF) -- cnt = scnprintf(cbuf, sizeof(cbuf), "off\n"); -+ else if (kind == InjErrWWPN) { -+ memcpy(&tmp, &phba->lpfc_injerr_wwpn, sizeof(struct lpfc_name)); -+ tmp = cpu_to_be64(tmp); -+ cnt = scnprintf(cbuf, 32, "0x%016llx\n", tmp); -+ } else if (kind == InjErrLBA) { -+ if (phba->lpfc_injerr_lba == (sector_t)(-1)) -+ cnt = scnprintf(cbuf, 32, "off\n"); - else -- cnt = scnprintf(cbuf, sizeof(cbuf), "0x%llx\n", -- (uint64_t)phba->lpfc_injerr_lba); -- break; -- default: -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "0547 Unknown debugfs error injection entry\n"); -- break; -- } -+ cnt = scnprintf(cbuf, 32, "0x%llx\n", -+ (uint64_t) phba->lpfc_injerr_lba); -+ } else -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0547 Unknown debugfs error injection entry\n"); - - return simple_read_from_buffer(buf, nbytes, ppos, &cbuf, cnt); - } - - static ssize_t - lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, -- size_t nbytes, loff_t *ppos) -+ size_t nbytes, loff_t *ppos) - { - struct lpfc_hba *phba = file->private_data; - int kind = debugfs_get_aux_num(file); -- char dstbuf[33] = {0}; -- unsigned long long tmp; -- unsigned long size; -+ char dstbuf[33]; -+ uint64_t tmp = 0; -+ int size; - -- size = (nbytes < (sizeof(dstbuf) - 1)) ? nbytes : (sizeof(dstbuf) - 1); -+ memset(dstbuf, 0, 33); -+ size = (nbytes < 32) ? nbytes : 32; - if (copy_from_user(dstbuf, buf, size)) - return -EFAULT; - -- if (kstrtoull(dstbuf, 0, &tmp)) { -- if (kind != InjErrLBA || !strstr(dstbuf, "off")) -- return -EINVAL; -+ if (kind == InjErrLBA) { -+ if ((dstbuf[0] == 'o') && (dstbuf[1] == 'f') && -+ (dstbuf[2] == 'f')) -+ tmp = (uint64_t)(-1); - } - -- switch (kind) { -- case writeGuard: -+ if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) -+ return -EINVAL; -+ -+ if (kind == writeGuard) - phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; -- break; -- case writeApp: -+ else if (kind == writeApp) - phba->lpfc_injerr_wapp_cnt = (uint32_t)tmp; -- break; -- case writeRef: -+ else if (kind == writeRef) - phba->lpfc_injerr_wref_cnt = (uint32_t)tmp; -- break; -- case readGuard: -+ else if (kind == readGuard) - phba->lpfc_injerr_rgrd_cnt = (uint32_t)tmp; -- break; -- case readApp: -+ else if (kind == readApp) - phba->lpfc_injerr_rapp_cnt = (uint32_t)tmp; -- break; -- case readRef: -+ else if (kind == readRef) - phba->lpfc_injerr_rref_cnt = (uint32_t)tmp; -- break; -- case InjErrLBA: -- if (strstr(dstbuf, "off")) -- phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; -- else -- phba->lpfc_injerr_lba = (sector_t)tmp; -- break; -- case InjErrNPortID: -+ else if (kind == InjErrLBA) -+ phba->lpfc_injerr_lba = (sector_t)tmp; -+ else if (kind == InjErrNPortID) - phba->lpfc_injerr_nportid = (uint32_t)(tmp & Mask_DID); -- break; -- case InjErrWWPN: -- phba->lpfc_injerr_wwpn.u.wwn_be = cpu_to_be64(tmp); -- break; -- default: -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "0548 Unknown debugfs error injection entry\n"); -- break; -- } -+ else if (kind == InjErrWWPN) { -+ tmp = cpu_to_be64(tmp); -+ memcpy(&phba->lpfc_injerr_wwpn, &tmp, sizeof(struct lpfc_name)); -+ } else -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0548 Unknown debugfs error injection entry\n"); -+ - return nbytes; - } - -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index b287d39ad033..32298285ea5e 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -366,7 +366,6 @@ struct lpfc_name { - } s; - uint8_t wwn[8]; - uint64_t name __packed __aligned(4); -- __be64 wwn_be __packed __aligned(4); - } u; - }; - diff --git a/SOURCES/1145-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch b/SOURCES/1145-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch deleted file mode 100644 index e5c092045..000000000 --- a/SOURCES/1145-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch +++ /dev/null @@ -1,18 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" -# Revert of 7188eff1a4a6e2f9144684df495ee5bcce503c8d - scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used - - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index cd5180151321..82ab7660572f 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6280,6 +6280,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - } - phba->nvmeio_trc_on = 1; - phba->nvmeio_trc_output_idx = 0; -+ phba->nvmeio_trc = NULL; - } else { - nvmeio_off: - phba->nvmeio_trc_size = 0; diff --git a/SOURCES/1146-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch b/SOURCES/1146-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch deleted file mode 100644 index 8533d599c..000000000 --- a/SOURCES/1146-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch +++ /dev/null @@ -1,20 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" -# Revert of 5eec6dfb351f6412694cfb294f1a0d153a9b8142 - scsi: lpfc: Define size of debugfs entry for xri rebalancing - - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index 566dd84e0677..f319f3af0400 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -44,9 +44,6 @@ - /* hbqinfo output buffer size */ - #define LPFC_HBQINFO_SIZE 8192 - --/* hdwqinfo output buffer size */ --#define LPFC_HDWQINFO_SIZE 8192 -- - /* nvmestat output buffer size */ - #define LPFC_NVMESTAT_SIZE 8192 - #define LPFC_IOKTIME_SIZE 8192 diff --git a/SOURCES/1147-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch b/SOURCES/1147-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch deleted file mode 100644 index 0ad7937eb..000000000 --- a/SOURCES/1147-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch +++ /dev/null @@ -1,78 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" -# Revert of 123878d674dbeccfa9efa5b489d2a538dd740f7c - scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 0630d109e767..3cc9d9829551 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -5338,12 +5338,12 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - ulp_status, ulp_word4, did); - /* ELS response tag completes */ - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "0110 ELS response tag x%x completes fc_flag x%lx" -+ "0110 ELS response tag x%x completes " - "Data: x%x x%x x%x x%x x%lx x%x x%x x%x %p %p\n", -- iotag, vport->fc_flag, ulp_status, ulp_word4, tmo, -+ iotag, ulp_status, ulp_word4, tmo, - ndlp->nlp_DID, ndlp->nlp_flag, ndlp->nlp_state, - ndlp->nlp_rpi, kref_read(&ndlp->kref), mbox, ndlp); -- if (mbox && !test_bit(FC_PT2PT, &vport->fc_flag)) { -+ if (mbox) { - if (ulp_status == 0 && - test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) { - if (!lpfc_unreg_rpi(vport, ndlp) && -@@ -5402,10 +5402,6 @@ lpfc_cmpl_els_rsp(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - } - out_free_mbox: - lpfc_mbox_rsrc_cleanup(phba, mbox, MBOX_THD_UNLOCKED); -- } else if (mbox && test_bit(FC_PT2PT, &vport->fc_flag) && -- test_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag)) { -- lpfc_mbx_cmpl_reg_login(phba, mbox); -- clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); - } - out: - if (ndlp && shost) { -diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c -index 1e331b76dff4..5aa21c683ac6 100644 ---- a/drivers/scsi/lpfc/lpfc_nportdisc.c -+++ b/drivers/scsi/lpfc/lpfc_nportdisc.c -@@ -326,14 +326,8 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox) - /* Now that REG_RPI completed successfully, - * we can now proceed with sending the PLOGI ACC. - */ -- if (test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) { -- rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -- save_iocb, ndlp, login_mbox); -- } else { -- rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -- save_iocb, ndlp, NULL); -- } -- -+ rc = lpfc_els_rsp_acc(login_mbox->vport, ELS_CMD_PLOGI, -+ save_iocb, ndlp, NULL); - if (rc) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "4576 PLOGI ACC fails pt2pt discovery: " -@@ -341,16 +335,9 @@ lpfc_defer_plogi_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *login_mbox) - } - } - -- /* If this is a fabric topology, complete the reg_rpi and prli now. -- * For Pt2Pt, the reg_rpi and PRLI are deferred until after the LS_ACC -- * completes. This ensures, in Pt2Pt, that the PLOGI LS_ACC is sent -- * before the PRLI. -- */ -- if (!test_bit(FC_PT2PT, &ndlp->vport->fc_flag)) { -- /* Now process the REG_RPI cmpl */ -- lpfc_mbx_cmpl_reg_login(phba, login_mbox); -- clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); -- } -+ /* Now process the REG_RPI cmpl */ -+ lpfc_mbx_cmpl_reg_login(phba, login_mbox); -+ clear_bit(NLP_ACC_REGLOGIN, &ndlp->nlp_flag); - kfree(save_iocb); - } - diff --git a/SOURCES/1148-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch b/SOURCES/1148-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch deleted file mode 100644 index 5521fa557..000000000 --- a/SOURCES/1148-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch +++ /dev/null @@ -1,45 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" -# Revert of 42cd66663ae18668544eaee105d82bea2a5921f4 - scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET - - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 1638fc3fc916..0f145022aaaa 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -5943,7 +5943,7 @@ lpfc_chk_tgt_mapped(struct lpfc_vport *vport, struct fc_rport *rport) - /** - * lpfc_reset_flush_io_context - - * @vport: The virtual port (scsi_host) for the flush context -- * @tgt_id: If aborting by Target context - specifies the target id -+ * @tgt_id: If aborting by Target contect - specifies the target id - * @lun_id: If aborting by Lun context - specifies the lun id - * @context: specifies the context level to flush at. - * -@@ -6117,14 +6117,8 @@ lpfc_target_reset_handler(struct scsi_cmnd *cmnd) - pnode->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; - spin_unlock_irqrestore(&pnode->lock, flags); - } -- status = lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -- LPFC_CTX_TGT); -- if (status != SUCCESS) { -- lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -- "0726 Target Reset flush status x%x\n", -- status); -- return status; -- } -+ lpfc_reset_flush_io_context(vport, tgt_id, lun_id, -+ LPFC_CTX_TGT); - return FAST_IO_FAIL; - } - -@@ -6217,7 +6211,7 @@ lpfc_host_reset_handler(struct scsi_cmnd *cmnd) - int rc, ret = SUCCESS; - - lpfc_printf_vlog(vport, KERN_ERR, LOG_FCP, -- "3172 SCSI layer issued Host Reset\n"); -+ "3172 SCSI layer issued Host Reset Data:\n"); - - lpfc_offline_prep(phba, LPFC_MBX_WAIT); - lpfc_offline(phba); diff --git a/SOURCES/1149-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch b/SOURCES/1149-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch deleted file mode 100644 index 1df5345a6..000000000 --- a/SOURCES/1149-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch +++ /dev/null @@ -1,22 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" -# Revert of 34a2ffe35bb05d7eeb7353737c22efaead84158c - scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 3cc9d9829551..729bee3c657e 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -11264,11 +11264,6 @@ lpfc_cmpl_els_fdisc(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, - "0126 FDISC cmpl status: x%x/x%x)\n", - ulp_status, ulp_word4); -- -- /* drop initial reference */ -- if (!test_and_set_bit(NLP_DROPPED, &ndlp->nlp_flag)) -- lpfc_nlp_put(ndlp); -- - goto fdisc_failed; - } - diff --git a/SOURCES/1150-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch b/SOURCES/1150-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch deleted file mode 100644 index 18ad2132c..000000000 --- a/SOURCES/1150-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" -# Revert of 0cfe4ba53cd1fe0efede8ebdc450d75daf07a3f2 - scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 729bee3c657e..853cf7649451 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -12012,11 +12012,7 @@ lpfc_sli4_els_xri_aborted(struct lpfc_hba *phba, - sglq_entry->state = SGL_FREED; - spin_unlock_irqrestore(&phba->sli4_hba.sgl_list_lock, - iflag); -- lpfc_printf_log(phba, KERN_INFO, LOG_ELS | LOG_SLI | -- LOG_DISCOVERY | LOG_NODE, -- "0732 ELS XRI ABORT on Node: ndlp=x%px " -- "xri=x%x\n", -- ndlp, xri); -+ - if (ndlp) { - lpfc_set_rrq_active(phba, ndlp, - sglq_entry->sli4_lxritag, -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 2f3629ef64e6..c681bd0ecbbc 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -3057,6 +3057,13 @@ lpfc_cleanup(struct lpfc_vport *vport) - lpfc_vmid_vport_cleanup(vport); - - list_for_each_entry_safe(ndlp, next_ndlp, &vport->fc_nodes, nlp_listp) { -+ if (vport->port_type != LPFC_PHYSICAL_PORT && -+ ndlp->nlp_DID == Fabric_DID) { -+ /* Just free up ndlp with Fabric_DID for vports */ -+ lpfc_nlp_put(ndlp); -+ continue; -+ } -+ - if (ndlp->nlp_DID == Fabric_Cntl_DID && - ndlp->nlp_state == NLP_STE_UNUSED_NODE) { - lpfc_nlp_put(ndlp); diff --git a/SOURCES/1151-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch b/SOURCES/1151-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch deleted file mode 100644 index 8a2ae0425..000000000 --- a/SOURCES/1151-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch +++ /dev/null @@ -1,27 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" -# Revert of dd7b6c550a31baa747b697cf9746e05c6d36464e - scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail - - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index e658f2a914d9..c6bfd8e97f59 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -8823,7 +8823,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - if (unlikely(rc)) { - lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, - "0381 Error %d during queue setup.\n", rc); -- goto out_destroy_queue; -+ goto out_stop_timers; - } - /* Initialize the driver internal SLI layer lists. */ - lpfc_sli4_setup(phba); -@@ -9106,6 +9106,7 @@ lpfc_sli4_hba_setup(struct lpfc_hba *phba) - lpfc_free_iocb_list(phba); - out_destroy_queue: - lpfc_sli4_queue_destroy(phba); -+out_stop_timers: - lpfc_stop_hba_timers(phba); - out_free_mbox: - mempool_free(mboxq, phba->mbox_mem_pool); diff --git a/SOURCES/1152-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch b/SOURCES/1152-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch deleted file mode 100644 index 47501c34f..000000000 --- a/SOURCES/1152-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch +++ /dev/null @@ -1,34 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" -# Revert of 70672fd3d84f298f276d2e2604b1d385e8b553fc - scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress - - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index c6bfd8e97f59..393937c727f6 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -12446,11 +12446,19 @@ lpfc_sli_issue_abort_iotag(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - } - - /* -- * Always abort the outstanding WQE and set the IA bit correctly -- * for the context. This is necessary for correctly removing -- * outstanding ndlp reference counts when the CQE completes with -- * the XB bit set. -+ * If we're unloading, don't abort iocb on the ELS ring, but change -+ * the callback so that nothing happens when it finishes. - */ -+ if (test_bit(FC_UNLOADING, &vport->load_flag) && -+ pring->ringno == LPFC_ELS_RING) { -+ if (cmdiocb->cmd_flag & LPFC_IO_FABRIC) -+ cmdiocb->fabric_cmd_cmpl = lpfc_ignore_els_cmpl; -+ else -+ cmdiocb->cmd_cmpl = lpfc_ignore_els_cmpl; -+ return retval; -+ } -+ -+ /* issue ABTS for this IOCB based on iotag */ - abtsiocbp = __lpfc_sli_get_iocbq(phba); - if (abtsiocbp == NULL) - return IOCB_NORESOURCE; diff --git a/SOURCES/1153-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch b/SOURCES/1153-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch deleted file mode 100644 index c823273d1..000000000 --- a/SOURCES/1153-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch +++ /dev/null @@ -1,61 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" -# Revert of 12503dd7ac27930b8889b15014474829c56c11f2 - scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport - - -diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h -index 0a43be24cee8..bf8ec461c0ee 100644 ---- a/drivers/scsi/lpfc/lpfc.h -+++ b/drivers/scsi/lpfc/lpfc.h -@@ -662,12 +662,15 @@ struct lpfc_vport { - uint32_t num_disc_nodes; /* in addition to hba_state */ - uint32_t gidft_inp; /* cnt of outstanding GID_FTs */ - -+ uint32_t fc_nlp_cnt; /* outstanding NODELIST requests */ - uint32_t fc_rscn_id_cnt; /* count of RSCNs payloads in list */ - uint32_t fc_rscn_flush; /* flag use of fc_rscn_id_list */ - struct lpfc_dmabuf *fc_rscn_id_list[FC_MAX_HOLD_RSCN]; - struct lpfc_name fc_nodename; /* fc nodename */ - struct lpfc_name fc_portname; /* fc portname */ - -+ struct lpfc_work_evt disc_timeout_evt; -+ - struct timer_list fc_disctmo; /* Discovery rescue timer */ - uint8_t fc_ns_retry; /* retries for fabric nameserver */ - uint32_t fc_prli_sent; /* cntr for outstanding PRLIs */ -@@ -765,6 +768,7 @@ struct lpfc_vport { - /* There is a single nvme instance per vport. */ - struct nvme_fc_local_port *localport; - uint8_t nvmei_support; /* driver supports NVME Initiator */ -+ uint32_t last_fcp_wqidx; - uint32_t rcv_flogi_cnt; /* How many unsol FLOGIs ACK'd. */ - }; - -@@ -1057,6 +1061,8 @@ struct lpfc_hba { - - struct lpfc_dmabuf hbqslimp; - -+ uint16_t pci_cfg_value; -+ - uint8_t fc_linkspeed; /* Link speed after last READ_LA */ - - uint32_t fc_eventTag; /* event tag for link attention */ -@@ -1083,6 +1089,7 @@ struct lpfc_hba { - - struct lpfc_stats fc_stat; - -+ struct lpfc_nodelist fc_fcpnodev; /* nodelist entry for no device */ - uint32_t nport_event_cnt; /* timestamp for nlplist entry */ - - uint8_t wwnn[8]; -@@ -1223,6 +1230,9 @@ struct lpfc_hba { - uint32_t hbq_count; /* Count of configured HBQs */ - struct hbq_s hbqs[LPFC_MAX_HBQS]; /* local copy of hbq indicies */ - -+ atomic_t fcp_qidx; /* next FCP WQ (RR Policy) */ -+ atomic_t nvme_qidx; /* next NVME WQ (RR Policy) */ -+ - phys_addr_t pci_bar0_map; /* Physical address for PCI BAR0 */ - phys_addr_t pci_bar1_map; /* Physical address for PCI BAR1 */ - phys_addr_t pci_bar2_map; /* Physical address for PCI BAR2 */ diff --git a/SOURCES/1154-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch b/SOURCES/1154-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch deleted file mode 100644 index cf1d689a6..000000000 --- a/SOURCES/1154-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Use int type to store negative error codes" -# Revert of dfe48c6bb068813490395974ec06f38342da2d6f - scsi: lpfc: Use int type to store negative error codes - - -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 393937c727f6..7d459a88ec5a 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -21382,7 +21382,7 @@ lpfc_sli4_issue_wqe(struct lpfc_hba *phba, struct lpfc_sli4_hdw_queue *qp, - struct lpfc_sglq *sglq; - struct lpfc_sli_ring *pring; - unsigned long iflags; -- int ret = 0; -+ uint32_t ret = 0; - - /* NVME_LS and NVME_LS ABTS requests. */ - if (pwqe->cmd_flag & LPFC_IO_NVME_LS) { diff --git a/SOURCES/1155-revert-scsi-lpfc-use-min-to-improve-code.patch b/SOURCES/1155-revert-scsi-lpfc-use-min-to-improve-code.patch deleted file mode 100644 index 74c9cec88..000000000 --- a/SOURCES/1155-revert-scsi-lpfc-use-min-to-improve-code.patch +++ /dev/null @@ -1,41 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: use min() to improve code" -# Revert of 548552ed278e8ebd0e27ae1461b7fe891f268825 - scsi: lpfc: use min() to improve code - - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index c681bd0ecbbc..b78edd11d9d4 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -8298,7 +8298,10 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - phba->cfg_total_seg_cnt, phba->cfg_scsi_seg_cnt, - phba->cfg_nvme_seg_cnt); - -- i = min(phba->cfg_sg_dma_buf_size, SLI4_PAGE_SIZE); -+ if (phba->cfg_sg_dma_buf_size < SLI4_PAGE_SIZE) -+ i = phba->cfg_sg_dma_buf_size; -+ else -+ i = SLI4_PAGE_SIZE; - - phba->lpfc_sg_dma_buf_pool = - dma_pool_create("lpfc_sg_dma_buf_pool", -diff --git a/drivers/scsi/lpfc/lpfc_nvme.c b/drivers/scsi/lpfc/lpfc_nvme.c -index 47818cf5b2f3..d539ee15a806 100644 ---- a/drivers/scsi/lpfc/lpfc_nvme.c -+++ b/drivers/scsi/lpfc/lpfc_nvme.c -@@ -1234,8 +1234,12 @@ lpfc_nvme_prep_io_cmd(struct lpfc_vport *vport, - if ((phba->cfg_nvme_enable_fb) && - test_bit(NLP_FIRSTBURST, &pnode->nlp_flag)) { - req_len = lpfc_ncmd->nvmeCmd->payload_length; -- wqe->fcp_iwrite.initial_xfer_len = min(req_len, -- pnode->nvme_fb_size); -+ if (req_len < pnode->nvme_fb_size) -+ wqe->fcp_iwrite.initial_xfer_len = -+ req_len; -+ else -+ wqe->fcp_iwrite.initial_xfer_len = -+ pnode->nvme_fb_size; - } else { - wqe->fcp_iwrite.initial_xfer_len = 0; - } diff --git a/SOURCES/1156-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch b/SOURCES/1156-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch deleted file mode 100644 index 46fe3493f..000000000 --- a/SOURCES/1156-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Fix wrong function reference in a comment" -# Revert of 2936f5bdfbcc6669ca78472d83afe96613281b41 - scsi: lpfc: Fix wrong function reference in a comment - - -diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c -index 8653839ee728..3d70cc517573 100644 ---- a/drivers/scsi/lpfc/lpfc_vport.c -+++ b/drivers/scsi/lpfc/lpfc_vport.c -@@ -666,7 +666,7 @@ lpfc_vport_delete(struct fc_vport *fc_vport) - * Take early refcount for outstanding I/O requests we schedule during - * delete processing for unreg_vpi. Always keep this before - * scsi_remove_host() as we can no longer obtain a reference through -- * scsi_host_get() after scsi_remove_host as shost is set to SHOST_DEL. -+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL. - */ - if (!scsi_host_get(shost)) - return VPORT_INVAL; diff --git a/SOURCES/1157-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch b/SOURCES/1157-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch deleted file mode 100644 index 3d9c1d694..000000000 --- a/SOURCES/1157-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch +++ /dev/null @@ -1,206 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "lpfc: don't use file->f_path.dentry for comparisons" -# Revert of 6190ea44e36d9cc8416eef6efdd1561ee22696c2 - lpfc: don't use file->f_path.dentry for comparisons - - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 82ab7660572f..52ad5449fa26 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -2375,32 +2375,32 @@ static ssize_t - lpfc_debugfs_dif_err_read(struct file *file, char __user *buf, - size_t nbytes, loff_t *ppos) - { -+ struct dentry *dent = file->f_path.dentry; - struct lpfc_hba *phba = file->private_data; -- int kind = debugfs_get_aux_num(file); - char cbuf[32]; - uint64_t tmp = 0; - int cnt = 0; - -- if (kind == writeGuard) -+ if (dent == phba->debug_writeGuard) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wgrd_cnt); -- else if (kind == writeApp) -+ else if (dent == phba->debug_writeApp) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wapp_cnt); -- else if (kind == writeRef) -+ else if (dent == phba->debug_writeRef) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_wref_cnt); -- else if (kind == readGuard) -+ else if (dent == phba->debug_readGuard) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rgrd_cnt); -- else if (kind == readApp) -+ else if (dent == phba->debug_readApp) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rapp_cnt); -- else if (kind == readRef) -+ else if (dent == phba->debug_readRef) - cnt = scnprintf(cbuf, 32, "%u\n", phba->lpfc_injerr_rref_cnt); -- else if (kind == InjErrNPortID) -+ else if (dent == phba->debug_InjErrNPortID) - cnt = scnprintf(cbuf, 32, "0x%06x\n", - phba->lpfc_injerr_nportid); -- else if (kind == InjErrWWPN) { -+ else if (dent == phba->debug_InjErrWWPN) { - memcpy(&tmp, &phba->lpfc_injerr_wwpn, sizeof(struct lpfc_name)); - tmp = cpu_to_be64(tmp); - cnt = scnprintf(cbuf, 32, "0x%016llx\n", tmp); -- } else if (kind == InjErrLBA) { -+ } else if (dent == phba->debug_InjErrLBA) { - if (phba->lpfc_injerr_lba == (sector_t)(-1)) - cnt = scnprintf(cbuf, 32, "off\n"); - else -@@ -2417,8 +2417,8 @@ static ssize_t - lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - size_t nbytes, loff_t *ppos) - { -+ struct dentry *dent = file->f_path.dentry; - struct lpfc_hba *phba = file->private_data; -- int kind = debugfs_get_aux_num(file); - char dstbuf[33]; - uint64_t tmp = 0; - int size; -@@ -2428,7 +2428,7 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - if (copy_from_user(dstbuf, buf, size)) - return -EFAULT; - -- if (kind == InjErrLBA) { -+ if (dent == phba->debug_InjErrLBA) { - if ((dstbuf[0] == 'o') && (dstbuf[1] == 'f') && - (dstbuf[2] == 'f')) - tmp = (uint64_t)(-1); -@@ -2437,23 +2437,23 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, - if ((tmp == 0) && (kstrtoull(dstbuf, 0, &tmp))) - return -EINVAL; - -- if (kind == writeGuard) -+ if (dent == phba->debug_writeGuard) - phba->lpfc_injerr_wgrd_cnt = (uint32_t)tmp; -- else if (kind == writeApp) -+ else if (dent == phba->debug_writeApp) - phba->lpfc_injerr_wapp_cnt = (uint32_t)tmp; -- else if (kind == writeRef) -+ else if (dent == phba->debug_writeRef) - phba->lpfc_injerr_wref_cnt = (uint32_t)tmp; -- else if (kind == readGuard) -+ else if (dent == phba->debug_readGuard) - phba->lpfc_injerr_rgrd_cnt = (uint32_t)tmp; -- else if (kind == readApp) -+ else if (dent == phba->debug_readApp) - phba->lpfc_injerr_rapp_cnt = (uint32_t)tmp; -- else if (kind == readRef) -+ else if (dent == phba->debug_readRef) - phba->lpfc_injerr_rref_cnt = (uint32_t)tmp; -- else if (kind == InjErrLBA) -+ else if (dent == phba->debug_InjErrLBA) - phba->lpfc_injerr_lba = (sector_t)tmp; -- else if (kind == InjErrNPortID) -+ else if (dent == phba->debug_InjErrNPortID) - phba->lpfc_injerr_nportid = (uint32_t)(tmp & Mask_DID); -- else if (kind == InjErrWWPN) { -+ else if (dent == phba->debug_InjErrWWPN) { - tmp = cpu_to_be64(tmp); - memcpy(&phba->lpfc_injerr_wwpn, &tmp, sizeof(struct lpfc_name)); - } else -@@ -6160,51 +6160,60 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - phba->debug_dumpHostSlim = NULL; - - /* Setup DIF Error Injections */ -+ snprintf(name, sizeof(name), "InjErrLBA"); - phba->debug_InjErrLBA = -- debugfs_create_file_aux_num("InjErrLBA", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrLBA, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - phba->lpfc_injerr_lba = LPFC_INJERR_LBA_OFF; - -+ snprintf(name, sizeof(name), "InjErrNPortID"); - phba->debug_InjErrNPortID = -- debugfs_create_file_aux_num("InjErrNPortID", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrNPortID, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "InjErrWWPN"); - phba->debug_InjErrWWPN = -- debugfs_create_file_aux_num("InjErrWWPN", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, InjErrWWPN, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeGuardInjErr"); - phba->debug_writeGuard = -- debugfs_create_file_aux_num("writeGuardInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeGuard, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeAppInjErr"); - phba->debug_writeApp = -- debugfs_create_file_aux_num("writeAppInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeApp, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "writeRefInjErr"); - phba->debug_writeRef = -- debugfs_create_file_aux_num("writeRefInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, writeRef, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readGuardInjErr"); - phba->debug_readGuard = -- debugfs_create_file_aux_num("readGuardInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readGuard, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readAppInjErr"); - phba->debug_readApp = -- debugfs_create_file_aux_num("readAppInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readApp, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - -+ snprintf(name, sizeof(name), "readRefInjErr"); - phba->debug_readRef = -- debugfs_create_file_aux_num("readRefInjErr", 0644, -+ debugfs_create_file(name, S_IFREG|S_IRUGO|S_IWUSR, - phba->hba_debugfs_root, -- phba, readRef, &lpfc_debugfs_op_dif_err); -+ phba, &lpfc_debugfs_op_dif_err); - - /* Setup slow ring trace */ - if (lpfc_debugfs_max_slow_ring_trc) { -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h -index f319f3af0400..8d2e8d05bbc0 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.h -+++ b/drivers/scsi/lpfc/lpfc_debugfs.h -@@ -322,17 +322,6 @@ enum { - * discovery */ - #endif /* H_LPFC_DEBUG_FS */ - --enum { -- writeGuard = 1, -- writeApp, -- writeRef, -- readGuard, -- readApp, -- readRef, -- InjErrLBA, -- InjErrNPortID, -- InjErrWWPN, --}; - - /* - * Driver debug utility routines outside of debugfs. The debug utility diff --git a/SOURCES/1158-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch b/SOURCES/1158-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch deleted file mode 100644 index f4cc60f06..000000000 --- a/SOURCES/1158-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" -# Revert of 962ac7d119e10f5ce809aea5c67e2e20415fe24e - scsi: lpfc: Update lpfc version to 14.4.0.10 - - -diff --git a/drivers/scsi/lpfc/lpfc_version.h b/drivers/scsi/lpfc/lpfc_version.h -index 9ee3a3a4ec4d..749688aa8a82 100644 ---- a/drivers/scsi/lpfc/lpfc_version.h -+++ b/drivers/scsi/lpfc/lpfc_version.h -@@ -20,7 +20,7 @@ - * included with this package. * - *******************************************************************/ - --#define LPFC_DRIVER_VERSION "14.4.0.10" -+#define LPFC_DRIVER_VERSION "14.4.0.9" - #define LPFC_DRIVER_NAME "lpfc" - - /* Used for SLI 2/3 */ diff --git a/SOURCES/1159-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch b/SOURCES/1159-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch deleted file mode 100644 index 054753910..000000000 --- a/SOURCES/1159-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch +++ /dev/null @@ -1,71 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" -# Revert of 6826b3ee8d47e7dea2f29e327e33a1a40433eaaf - scsi: lpfc: Copyright updates for 14.4.0.10 patches - - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index 94f612d1fef0..aa6c2b0f9907 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 52ad5449fa26..1b6cdadc7426 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2007-2015 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index bc709786e6af..dd9f170fbdc8 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 0f145022aaaa..0786952cd7d5 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2004-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * -diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h -index fd6dab157887..e42b44fcc7f6 100644 ---- a/drivers/scsi/lpfc/lpfc_sli4.h -+++ b/drivers/scsi/lpfc/lpfc_sli4.h -@@ -1,7 +1,7 @@ - /******************************************************************* - * This file is part of the Emulex Linux Device Driver for * - * Fibre Channel Host Bus Adapters. * -- * Copyright (C) 2017-2025 Broadcom. All Rights Reserved. The term * -+ * Copyright (C) 2017-2024 Broadcom. All Rights Reserved. The term * - * “Broadcom” refers to Broadcom Inc. and/or its subsidiaries. * - * Copyright (C) 2009-2016 Emulex. All rights reserved. * - * EMULEX and SLI are trademarks of Emulex. * diff --git a/SOURCES/1160-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch b/SOURCES/1160-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch deleted file mode 100644 index 86c733f11..000000000 --- a/SOURCES/1160-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch +++ /dev/null @@ -1,141 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" -# Revert of 19ab9fa7f11f1675a15dda0cd6606d71f7599cfd - scsi: lpfc: Modify end-of-life adapters' model descriptions - - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index b78edd11d9d4..8007c961bbd7 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -2627,33 +2627,27 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_BMID: -- m = (typeof(m)){"LP1150", "PCI-X2", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LP1150", "PCI-X2", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_BSMB: - m = (typeof(m)){"LP111", "PCI-X2", - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR: -- m = (typeof(m)){"LPe11000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR_SCSP: -- m = (typeof(m)){"LPe11000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe11000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZEPHYR_DCSP: -- m = (typeof(m)){"LP2105", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"LP2105", "PCIe", "FCoE Adapter"}; - GE = 1; - break; - case PCI_DEVICE_ID_ZMID: -- m = (typeof(m)){"LPe1150", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe1150", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_ZSMB: -- m = (typeof(m)){"LPe111", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe111", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LP101: - m = (typeof(m)){"LP101", "PCI-X", -@@ -2672,28 +2666,22 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT: -- m = (typeof(m)){"LPe12000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_MID: -- m = (typeof(m)){"LPe1250", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe1250", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_SMB: -- m = (typeof(m)){"LPe121", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe121", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_DCSP: -- m = (typeof(m)){"LPe12002-SP", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12002-SP", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_SCSP: -- m = (typeof(m)){"LPe12000-SP", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000-SP", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_SAT_S: -- m = (typeof(m)){"LPe12000-S", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe12000-S", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_PROTEUS_VF: - m = (typeof(m)){"LPev12000", "PCIe IOV", -@@ -2709,25 +2697,22 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - break; - case PCI_DEVICE_ID_TIGERSHARK: - oneConnect = 1; -- m = (typeof(m)){"OCe10100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe10100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_TOMCAT: - oneConnect = 1; -- m = (typeof(m)){"OCe11100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe11100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_FALCON: - m = (typeof(m)){"LPSe12002-ML1-E", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ "EmulexSecure Fibre"}; - break; - case PCI_DEVICE_ID_BALIUS: - m = (typeof(m)){"LPVe12002", "PCIe Shared I/O", - "Obsolete, Unsupported Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LANCER_FC: -- m = (typeof(m)){"LPe16000", "PCIe", -- "Obsolete, Unsupported Fibre Channel Adapter"}; -+ m = (typeof(m)){"LPe16000", "PCIe", "Fibre Channel Adapter"}; - break; - case PCI_DEVICE_ID_LANCER_FC_VF: - m = (typeof(m)){"LPe16000", "PCIe", -@@ -2735,13 +2720,12 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - break; - case PCI_DEVICE_ID_LANCER_FCOE: - oneConnect = 1; -- m = (typeof(m)){"OCe15100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe15100", "PCIe", "FCoE"}; - break; - case PCI_DEVICE_ID_LANCER_FCOE_VF: - oneConnect = 1; - m = (typeof(m)){"OCe15100", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ "Obsolete, Unsupported FCoE"}; - break; - case PCI_DEVICE_ID_LANCER_G6_FC: - m = (typeof(m)){"LPe32000", "PCIe", "Fibre Channel Adapter"}; -@@ -2755,8 +2739,7 @@ lpfc_get_hba_model_desc(struct lpfc_hba *phba, uint8_t *mdp, uint8_t *descp) - case PCI_DEVICE_ID_SKYHAWK: - case PCI_DEVICE_ID_SKYHAWK_VF: - oneConnect = 1; -- m = (typeof(m)){"OCe14000", "PCIe", -- "Obsolete, Unsupported FCoE Adapter"}; -+ m = (typeof(m)){"OCe14000", "PCIe", "FCoE"}; - break; - default: - m = (typeof(m)){"Unknown", "", ""}; diff --git a/SOURCES/1161-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch b/SOURCES/1161-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch deleted file mode 100644 index e4e5a1d6b..000000000 --- a/SOURCES/1161-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch +++ /dev/null @@ -1,105 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" -# Revert of 47f0e888d0df9c51919a5258f9019c6a619bb8ad - scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions - - -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index dd9f170fbdc8..2dedb273b091 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1328,9 +1328,6 @@ struct cq_context { - #define LPFC_CQ_CNT_512 0x1 - #define LPFC_CQ_CNT_1024 0x2 - #define LPFC_CQ_CNT_WORD7 0x3 --#define lpfc_cq_context_cqe_sz_SHIFT 25 --#define lpfc_cq_context_cqe_sz_MASK 0x00000003 --#define lpfc_cq_context_cqe_sz_WORD word0 - #define lpfc_cq_context_autovalid_SHIFT 15 - #define lpfc_cq_context_autovalid_MASK 0x00000001 - #define lpfc_cq_context_autovalid_WORD word0 -@@ -1386,9 +1383,9 @@ struct lpfc_mbx_cq_create_set { - #define lpfc_mbx_cq_create_set_valid_SHIFT 29 - #define lpfc_mbx_cq_create_set_valid_MASK 0x00000001 - #define lpfc_mbx_cq_create_set_valid_WORD word1 --#define lpfc_mbx_cq_create_set_cqecnt_SHIFT 27 --#define lpfc_mbx_cq_create_set_cqecnt_MASK 0x00000003 --#define lpfc_mbx_cq_create_set_cqecnt_WORD word1 -+#define lpfc_mbx_cq_create_set_cqe_cnt_SHIFT 27 -+#define lpfc_mbx_cq_create_set_cqe_cnt_MASK 0x00000003 -+#define lpfc_mbx_cq_create_set_cqe_cnt_WORD word1 - #define lpfc_mbx_cq_create_set_cqe_size_SHIFT 25 - #define lpfc_mbx_cq_create_set_cqe_size_MASK 0x00000003 - #define lpfc_mbx_cq_create_set_cqe_size_WORD word1 -@@ -1401,16 +1398,13 @@ struct lpfc_mbx_cq_create_set { - #define lpfc_mbx_cq_create_set_clswm_SHIFT 12 - #define lpfc_mbx_cq_create_set_clswm_MASK 0x00000003 - #define lpfc_mbx_cq_create_set_clswm_WORD word1 --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_SHIFT 0 --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_MASK 0x0000001F --#define lpfc_mbx_cq_create_set_cqe_cnt_hi_WORD word1 - uint32_t word2; - #define lpfc_mbx_cq_create_set_arm_SHIFT 31 - #define lpfc_mbx_cq_create_set_arm_MASK 0x00000001 - #define lpfc_mbx_cq_create_set_arm_WORD word2 --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_SHIFT 16 --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_MASK 0x00007FFF --#define lpfc_mbx_cq_create_set_cqe_cnt_lo_WORD word2 -+#define lpfc_mbx_cq_create_set_cq_cnt_SHIFT 16 -+#define lpfc_mbx_cq_create_set_cq_cnt_MASK 0x00007FFF -+#define lpfc_mbx_cq_create_set_cq_cnt_WORD word2 - #define lpfc_mbx_cq_create_set_num_cq_SHIFT 0 - #define lpfc_mbx_cq_create_set_num_cq_MASK 0x0000FFFF - #define lpfc_mbx_cq_create_set_num_cq_WORD word2 -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 7d459a88ec5a..73f8a0e3a4c0 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -16486,10 +16486,10 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp, - case 4096: - if (phba->sli4_hba.pc_sli4_params.cqv == - LPFC_Q_CREATE_VERSION_2) { -- bf_set(lpfc_mbx_cq_create_set_cqe_cnt_lo, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, -- cq->entry_count); -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ cq->entry_count); -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, - LPFC_CQ_CNT_WORD7); - break; -@@ -16505,15 +16505,15 @@ lpfc_cq_create_set(struct lpfc_hba *phba, struct lpfc_queue **cqp, - } - fallthrough; /* otherwise default to smallest */ - case 256: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_256); - break; - case 512: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_512); - break; - case 1024: -- bf_set(lpfc_mbx_cq_create_set_cqecnt, -+ bf_set(lpfc_mbx_cq_create_set_cqe_cnt, - &cq_set->u.request, LPFC_CQ_CNT_1024); - break; - } -diff --git a/drivers/scsi/lpfc/lpfc_sli4.h b/drivers/scsi/lpfc/lpfc_sli4.h -index e42b44fcc7f6..9be3da91c923 100644 ---- a/drivers/scsi/lpfc/lpfc_sli4.h -+++ b/drivers/scsi/lpfc/lpfc_sli4.h -@@ -575,10 +575,8 @@ struct lpfc_pc_sli4_params { - - #define LPFC_CQ_4K_PAGE_SZ 0x1 - #define LPFC_CQ_16K_PAGE_SZ 0x4 --#define LPFC_CQ_32K_PAGE_SZ 0x8 - #define LPFC_WQ_4K_PAGE_SZ 0x1 - #define LPFC_WQ_16K_PAGE_SZ 0x4 --#define LPFC_WQ_32K_PAGE_SZ 0x8 - - struct lpfc_iov { - uint32_t pf_number; diff --git a/SOURCES/1162-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch b/SOURCES/1162-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch deleted file mode 100644 index a9a77b793..000000000 --- a/SOURCES/1162-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch +++ /dev/null @@ -1,40 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" -# Revert of 0506fd6f9cce6d603c88619704e0281fbea553cc - scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset - - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 0786952cd7d5..9fa5de43f500 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -536,8 +536,7 @@ lpfc_sli4_io_xri_aborted(struct lpfc_hba *phba, - psb = container_of(iocbq, struct lpfc_io_buf, cur_iocbq); - psb->flags &= ~LPFC_SBUF_XBUSY; - spin_unlock_irqrestore(&phba->hbalock, iflag); -- if (test_bit(HBA_SETUP, &phba->hba_flag) && -- !list_empty(&pring->txq)) -+ if (!list_empty(&pring->txq)) - lpfc_worker_wake_up(phba); - return; - } -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 73f8a0e3a4c0..bcc7ce426fbe 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -5170,6 +5170,7 @@ lpfc_sli4_brdreset(struct lpfc_hba *phba) - phba->link_events = 0; - phba->pport->fc_myDID = 0; - phba->pport->fc_prevDID = 0; -+ clear_bit(HBA_SETUP, &phba->hba_flag); - - spin_lock_irq(&phba->hbalock); - psli->sli_flag &= ~(LPFC_PROCESS_LA); -@@ -5286,7 +5287,6 @@ lpfc_sli_brdrestart_s4(struct lpfc_hba *phba) - "0296 Restart HBA Data: x%x x%x\n", - phba->pport->port_state, psli->sli_flag); - -- clear_bit(HBA_SETUP, &phba->hba_flag); - lpfc_sli4_queue_unset(phba); - - rc = lpfc_sli4_brdreset(phba); diff --git a/SOURCES/1163-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch b/SOURCES/1163-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch deleted file mode 100644 index 1ea603d73..000000000 --- a/SOURCES/1163-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch +++ /dev/null @@ -1,20 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" -# Revert of 86faf91ba7bc2858562ae56d12d90779b9e5ca53 - scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk - - -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index d4760fa67076..bcd943722f06 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -183,8 +183,7 @@ lpfc_dev_loss_tmo_callbk(struct fc_rport *rport) - - /* Don't schedule a worker thread event if the vport is going down. */ - if (test_bit(FC_UNLOADING, &vport->load_flag) || -- (phba->sli_rev == LPFC_SLI_REV4 && -- !test_bit(HBA_SETUP, &phba->hba_flag))) { -+ !test_bit(HBA_SETUP, &phba->hba_flag)) { - - spin_lock_irqsave(&ndlp->lock, iflags); - ndlp->rport = NULL; diff --git a/SOURCES/1164-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch b/SOURCES/1164-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch deleted file mode 100644 index fce2d9a64..000000000 --- a/SOURCES/1164-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch +++ /dev/null @@ -1,48 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" -# Revert of 0bba7f35a566c624c3a3c74285b61b59f2cf68bb - scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 853cf7649451..cdac8600ae9c 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -8376,9 +8376,9 @@ lpfc_els_rcv_flogi(struct lpfc_vport *vport, struct lpfc_iocbq *cmdiocb, - clear_bit(FC_PUBLIC_LOOP, &vport->fc_flag); - lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, - "3311 Rcv Flogi PS x%x new PS x%x " -- "fc_flag x%lx new fc_flag x%lx, hba_flag x%lx\n", -+ "fc_flag x%lx new fc_flag x%lx\n", - port_state, vport->port_state, -- fc_flag, vport->fc_flag, phba->hba_flag); -+ fc_flag, vport->fc_flag); - - /* - * We temporarily set fc_myDID to make it look like we are -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index bcd943722f06..c5502272f00e 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -1266,10 +1266,6 @@ lpfc_linkdown(struct lpfc_hba *phba) - } - phba->defer_flogi_acc.flag = false; - -- /* reinitialize initial HBA flag */ -- clear_bit(HBA_FLOGI_ISSUED, &phba->hba_flag); -- clear_bit(HBA_RHBA_CMPL, &phba->hba_flag); -- - /* Clear external loopback plug detected flag */ - phba->link_flag &= ~LS_EXTERNAL_LOOPBACK; - -@@ -1440,6 +1436,10 @@ lpfc_linkup(struct lpfc_hba *phba) - phba->pport->rcv_flogi_cnt = 0; - spin_unlock_irq(shost->host_lock); - -+ /* reinitialize initial HBA flag */ -+ clear_bit(HBA_FLOGI_ISSUED, &phba->hba_flag); -+ clear_bit(HBA_RHBA_CMPL, &phba->hba_flag); -+ - return 0; - } - diff --git a/SOURCES/1165-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch b/SOURCES/1165-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch deleted file mode 100644 index 9a147dafd..000000000 --- a/SOURCES/1165-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch +++ /dev/null @@ -1,53 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" -# Revert of 58213a54e9c389dbde59a6b2714a77c7aed21eff - scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd - - -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index 8007c961bbd7..488a4bd363e3 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -7916,6 +7916,8 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - int longs; - int extra; - uint64_t wwn; -+ u32 if_type; -+ u32 if_fam; - - phba->sli4_hba.num_present_cpu = lpfc_present_cpu; - phba->sli4_hba.num_possible_cpu = cpumask_last(cpu_possible_mask) + 1; -@@ -8176,11 +8178,28 @@ lpfc_sli4_driver_resource_setup(struct lpfc_hba *phba) - */ - rc = lpfc_get_sli4_parameters(phba, mboxq); - if (rc) { -- lpfc_log_msg(phba, KERN_WARNING, LOG_INIT, -- "2999 Could not get SLI4 parameters\n"); -- rc = -EIO; -- mempool_free(mboxq, phba->mbox_mem_pool); -- goto out_free_bsmbx; -+ if_type = bf_get(lpfc_sli_intf_if_type, -+ &phba->sli4_hba.sli_intf); -+ if_fam = bf_get(lpfc_sli_intf_sli_family, -+ &phba->sli4_hba.sli_intf); -+ if (phba->sli4_hba.extents_in_use && -+ phba->sli4_hba.rpi_hdrs_in_use) { -+ lpfc_printf_log(phba, KERN_ERR, LOG_TRACE_EVENT, -+ "2999 Unsupported SLI4 Parameters " -+ "Extents and RPI headers enabled.\n"); -+ if (if_type == LPFC_SLI_INTF_IF_TYPE_0 && -+ if_fam == LPFC_SLI_INTF_FAMILY_BE2) { -+ mempool_free(mboxq, phba->mbox_mem_pool); -+ rc = -EIO; -+ goto out_free_bsmbx; -+ } -+ } -+ if (!(if_type == LPFC_SLI_INTF_IF_TYPE_0 && -+ if_fam == LPFC_SLI_INTF_FAMILY_BE2)) { -+ mempool_free(mboxq, phba->mbox_mem_pool); -+ rc = -EIO; -+ goto out_free_bsmbx; -+ } - } - - /* diff --git a/SOURCES/1166-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch b/SOURCES/1166-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch deleted file mode 100644 index 0bef87cfd..000000000 --- a/SOURCES/1166-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch +++ /dev/null @@ -1,42 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" -# Revert of 9c000843bf3d8afda0e42d382062558a239dc7f9 - scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses - - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index aa6c2b0f9907..2e1d762b75a9 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -2229,6 +2229,21 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - /* Look for a retryable error */ - if (ulp_status == IOSTAT_LOCAL_REJECT) { - switch ((ulp_word4 & IOERR_PARAM_MASK)) { -+ case IOERR_SLI_ABORTED: -+ case IOERR_SLI_DOWN: -+ /* Driver aborted this IO. No retry as error -+ * is likely Offline->Online or some adapter -+ * error. Recovery will try again, but if port -+ * is not active there's no point to continue -+ * issuing follow up FDMI commands. -+ */ -+ if (!(phba->sli.sli_flag & LPFC_SLI_ACTIVE)) { -+ free_ndlp = cmdiocb->ndlp; -+ lpfc_ct_free_iocb(phba, cmdiocb); -+ lpfc_nlp_put(free_ndlp); -+ return; -+ } -+ break; - case IOERR_ABORT_IN_PROGRESS: - case IOERR_SEQUENCE_TIMEOUT: - case IOERR_ILLEGAL_FRAME: -@@ -2254,9 +2269,6 @@ lpfc_cmpl_ct_disc_fdmi(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, - lpfc_ct_free_iocb(phba, cmdiocb); - lpfc_nlp_put(free_ndlp); - -- if (ulp_status != IOSTAT_SUCCESS) -- return; -- - ndlp = lpfc_findnode_did(vport, FDMI_DID); - if (!ndlp) - return; diff --git a/SOURCES/1167-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch b/SOURCES/1167-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch deleted file mode 100644 index 93a905a1e..000000000 --- a/SOURCES/1167-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch +++ /dev/null @@ -1,24 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" -# Revert of c21abd3cdb713b806a0a8ecbc1c161f1fa9be73b - scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set - - -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index cdac8600ae9c..0205c54bce63 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -7860,13 +7860,6 @@ lpfc_rscn_recovery_check(struct lpfc_vport *vport) - - /* Move all affected nodes by pending RSCNs to NPR state. */ - list_for_each_entry_safe(ndlp, n, &vport->fc_nodes, nlp_listp) { -- if (test_bit(FC_UNLOADING, &vport->load_flag)) { -- lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, -- "1000 %s Unloading set\n", -- __func__); -- return 0; -- } -- - if ((ndlp->nlp_state == NLP_STE_UNUSED_NODE) || - !lpfc_rscn_payload_check(vport, ndlp->nlp_DID)) - continue; diff --git a/SOURCES/1168-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch b/SOURCES/1168-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch deleted file mode 100644 index 0e727f189..000000000 --- a/SOURCES/1168-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch +++ /dev/null @@ -1,21 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" -# Revert of 22e5c00fb500e6d78967da8a034de9e950a4db49 - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure - - -diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c -index 9fa5de43f500..6309eb286a33 100644 ---- a/drivers/scsi/lpfc/lpfc_scsi.c -+++ b/drivers/scsi/lpfc/lpfc_scsi.c -@@ -390,10 +390,6 @@ lpfc_sli4_vport_delete_fcp_xri_aborted(struct lpfc_vport *vport) - if (!(vport->cfg_enable_fc4_type & LPFC_ENABLE_FCP)) - return; - -- /* may be called before queues established if hba_setup fails */ -- if (!phba->sli4_hba.hdwq) -- return; -- - spin_lock_irqsave(&phba->hbalock, iflag); - for (idx = 0; idx < phba->cfg_hdw_queue; idx++) { - qp = &phba->sli4_hba.hdwq[idx]; diff --git a/SOURCES/1169-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch b/SOURCES/1169-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch deleted file mode 100644 index aefa48761..000000000 --- a/SOURCES/1169-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch +++ /dev/null @@ -1,56 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Update debugfs trace ring initialization messages" -# Revert of 580bc25e722ca698094ef3e4aa1ac7152ed0e071 - scsi: lpfc: Update debugfs trace ring initialization messages - - -diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c -index 1b6cdadc7426..e5a31bc0f6c9 100644 ---- a/drivers/scsi/lpfc/lpfc_debugfs.c -+++ b/drivers/scsi/lpfc/lpfc_debugfs.c -@@ -6227,9 +6227,8 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_slow_ring_trc = (1 << i); -- pr_info("lpfc_debugfs_max_slow_ring_trc " -- "changed to %d\n", -- lpfc_debugfs_max_slow_ring_trc); -+ pr_err("lpfc_debugfs_max_disc_trc changed to " -+ "%d\n", lpfc_debugfs_max_disc_trc); - } - } - -@@ -6261,7 +6260,7 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - atomic_set(&phba->nvmeio_trc_cnt, 0); - if (lpfc_debugfs_max_nvmeio_trc) { - num = lpfc_debugfs_max_nvmeio_trc - 1; -- if (num & lpfc_debugfs_max_nvmeio_trc) { -+ if (num & lpfc_debugfs_max_disc_trc) { - /* Change to be a power of 2 */ - num = lpfc_debugfs_max_nvmeio_trc; - i = 0; -@@ -6270,9 +6269,10 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_nvmeio_trc = (1 << i); -- pr_info("lpfc_debugfs_max_nvmeio_trc changed " -- "to %d\n", -- lpfc_debugfs_max_nvmeio_trc); -+ lpfc_printf_log(phba, KERN_ERR, LOG_INIT, -+ "0575 lpfc_debugfs_max_nvmeio_trc " -+ "changed to %d\n", -+ lpfc_debugfs_max_nvmeio_trc); - } - phba->nvmeio_trc_size = lpfc_debugfs_max_nvmeio_trc; - -@@ -6317,8 +6317,8 @@ lpfc_debugfs_initialize(struct lpfc_vport *vport) - i++; - } - lpfc_debugfs_max_disc_trc = (1 << i); -- pr_info("lpfc_debugfs_max_disc_trc changed to %d\n", -- lpfc_debugfs_max_disc_trc); -+ pr_err("lpfc_debugfs_max_disc_trc changed to %d\n", -+ lpfc_debugfs_max_disc_trc); - } - } - diff --git a/SOURCES/1170-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch b/SOURCES/1170-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch deleted file mode 100644 index dae05f314..000000000 --- a/SOURCES/1170-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch +++ /dev/null @@ -1,32 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" -# Revert of dfd30218a269fc6f6df48cb0781977d53223f955 - scsi: lpfc: Revise logging format for failed CT MIB requests - - -diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c -index 2e1d762b75a9..0c9260dc2706 100644 ---- a/drivers/scsi/lpfc/lpfc_ct.c -+++ b/drivers/scsi/lpfc/lpfc_ct.c -@@ -264,9 +264,9 @@ lpfc_ct_reject_event(struct lpfc_nodelist *ndlp, - ct_free_mp: - kfree(mp); - ct_exit: -- lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, -- "6440 Unsol CT: Rsp err %d Data: x%lx\n", -- rc, vport->fc_flag); -+ lpfc_printf_vlog(vport, KERN_ERR, LOG_ELS, -+ "6440 Unsol CT: Rsp err %d Data: x%lx\n", -+ rc, vport->fc_flag); - } - - /** -@@ -313,7 +313,7 @@ lpfc_ct_handle_mibreq(struct lpfc_hba *phba, struct lpfc_iocbq *ctiocbq) - - mi_cmd = be16_to_cpu(ct_req->CommandResponse.bits.CmdRsp); - lpfc_vlog_msg(vport, KERN_WARNING, LOG_ELS, -- "6442 MI Cmd: x%x Not Supported\n", mi_cmd); -+ "6442 MI Cmd : x%x Not Supported\n", mi_cmd); - lpfc_ct_reject_event(ndlp, ct_req, - bf_get(wqe_ctxt_tag, - &ctiocbq->wqe.xmit_els_rsp.wqe_com), diff --git a/SOURCES/1171-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-if-nodelist-freed.patch b/SOURCES/1171-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-if-nodelist-freed.patch deleted file mode 100644 index e121be64c..000000000 --- a/SOURCES/1171-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-if-nodelist-freed.patch +++ /dev/null @@ -1,33 +0,0 @@ -From: AlmaLinux (RHEL-only, no upstream/CS9 source) -Subject: [PATCH] scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed -JIRA: RHEL-167742 -NOTE: RHEL-specific fix; no CS9 or upstream commit exists. Reconstructed change. - -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index 14ebc9c..a7064fd 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -6597,11 +6597,6 @@ lpfc_nlp_get(struct lpfc_nodelist *ndlp) - unsigned long flags; - - if (ndlp) { -- lpfc_debugfs_disc_trc(ndlp->vport, LPFC_DISC_TRC_NODE, -- "node get: did:x%x flg:x%lx refcnt:x%x", -- ndlp->nlp_DID, ndlp->nlp_flag, -- kref_read(&ndlp->kref)); -- - /* The check of ndlp usage to prevent incrementing the - * ndlp reference count that is in the process of being - * released. -@@ -6609,9 +6604,8 @@ lpfc_nlp_get(struct lpfc_nodelist *ndlp) - spin_lock_irqsave(&ndlp->lock, flags); - if (!kref_get_unless_zero(&ndlp->kref)) { - spin_unlock_irqrestore(&ndlp->lock, flags); -- lpfc_printf_vlog(ndlp->vport, KERN_WARNING, LOG_NODE, -- "0276 %s: ndlp:x%px refcnt:%d\n", -- __func__, (void *)ndlp, kref_read(&ndlp->kref)); -+ pr_info("0276 %s: NDLP has zero reference count. " -+ "Exiting\n", __func__); - return NULL; - } - spin_unlock_irqrestore(&ndlp->lock, flags); diff --git a/SOURCES/1172-libceph-make-decode-pool-more-resilient-against-corrupted-os.patch b/SOURCES/1172-libceph-make-decode-pool-more-resilient-against-corrupted-os.patch deleted file mode 100644 index 4a7218b7c..000000000 --- a/SOURCES/1172-libceph-make-decode-pool-more-resilient-against-corrupted-os.patch +++ /dev/null @@ -1,218 +0,0 @@ -From 8c738512714e8c0aa18f8a10c072d5b01c83db39 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Tue, 2 Dec 2025 10:32:31 +0100 -Subject: [PATCH] libceph: make decode_pool() more resilient against corrupted - osdmaps - -If the osdmap is (maliciously) corrupted such that the encoded length -of ceph_pg_pool envelope is less than what is expected for a particular -encoding version, out-of-bounds reads may ensue because the only bounds -check that is there is based on that length value. - -This patch adds explicit bounds checks for each field that is decoded -or skipped. - -Cc: stable@vger.kernel.org -Reported-by: ziming zhang -Signed-off-by: Ilya Dryomov -Reviewed-by: Xiubo Li -Tested-by: ziming zhang - -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index 329eeea2f922..34b3ab59602f 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -806,51 +806,49 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) - ceph_decode_need(p, end, len, bad); - pool_end = *p + len; - -+ ceph_decode_need(p, end, 4 + 4 + 4, bad); - pi->type = ceph_decode_8(p); - pi->size = ceph_decode_8(p); - pi->crush_ruleset = ceph_decode_8(p); - pi->object_hash = ceph_decode_8(p); -- - pi->pg_num = ceph_decode_32(p); - pi->pgp_num = ceph_decode_32(p); - -- *p += 4 + 4; /* skip lpg* */ -- *p += 4; /* skip last_change */ -- *p += 8 + 4; /* skip snap_seq, snap_epoch */ -+ /* lpg*, last_change, snap_seq, snap_epoch */ -+ ceph_decode_skip_n(p, end, 8 + 4 + 8 + 4, bad); - - /* skip snaps */ -- num = ceph_decode_32(p); -+ ceph_decode_32_safe(p, end, num, bad); - while (num--) { -- *p += 8; /* snapid key */ -- *p += 1 + 1; /* versions */ -- len = ceph_decode_32(p); -- *p += len; -+ /* snapid key, pool snap (with versions) */ -+ ceph_decode_skip_n(p, end, 8 + 2, bad); -+ ceph_decode_skip_string(p, end, bad); - } - -- /* skip removed_snaps */ -- num = ceph_decode_32(p); -- *p += num * (8 + 8); -+ /* removed_snaps */ -+ ceph_decode_skip_map(p, end, 64, 64, bad); - -+ ceph_decode_need(p, end, 8 + 8 + 4, bad); - *p += 8; /* skip auid */ - pi->flags = ceph_decode_64(p); - *p += 4; /* skip crash_replay_interval */ - - if (ev >= 7) -- pi->min_size = ceph_decode_8(p); -+ ceph_decode_8_safe(p, end, pi->min_size, bad); - else - pi->min_size = pi->size - pi->size / 2; - - if (ev >= 8) -- *p += 8 + 8; /* skip quota_max_* */ -+ /* quota_max_* */ -+ ceph_decode_skip_n(p, end, 8 + 8, bad); - - if (ev >= 9) { -- /* skip tiers */ -- num = ceph_decode_32(p); -- *p += num * 8; -+ /* tiers */ -+ ceph_decode_skip_set(p, end, 64, bad); - -+ ceph_decode_need(p, end, 8 + 1 + 8 + 8, bad); - *p += 8; /* skip tier_of */ - *p += 1; /* skip cache_mode */ -- - pi->read_tier = ceph_decode_64(p); - pi->write_tier = ceph_decode_64(p); - } else { -@@ -858,86 +856,76 @@ static int decode_pool(void **p, void *end, struct ceph_pg_pool_info *pi) - pi->write_tier = -1; - } - -- if (ev >= 10) { -- /* skip properties */ -- num = ceph_decode_32(p); -- while (num--) { -- len = ceph_decode_32(p); -- *p += len; /* key */ -- len = ceph_decode_32(p); -- *p += len; /* val */ -- } -- } -+ if (ev >= 10) -+ /* properties */ -+ ceph_decode_skip_map(p, end, string, string, bad); - - if (ev >= 11) { -- /* skip hit_set_params */ -- *p += 1 + 1; /* versions */ -- len = ceph_decode_32(p); -- *p += len; -+ /* hit_set_params (with versions) */ -+ ceph_decode_skip_n(p, end, 2, bad); -+ ceph_decode_skip_string(p, end, bad); - -- *p += 4; /* skip hit_set_period */ -- *p += 4; /* skip hit_set_count */ -+ /* hit_set_period, hit_set_count */ -+ ceph_decode_skip_n(p, end, 4 + 4, bad); - } - - if (ev >= 12) -- *p += 4; /* skip stripe_width */ -+ /* stripe_width */ -+ ceph_decode_skip_32(p, end, bad); - -- if (ev >= 13) { -- *p += 8; /* skip target_max_bytes */ -- *p += 8; /* skip target_max_objects */ -- *p += 4; /* skip cache_target_dirty_ratio_micro */ -- *p += 4; /* skip cache_target_full_ratio_micro */ -- *p += 4; /* skip cache_min_flush_age */ -- *p += 4; /* skip cache_min_evict_age */ -- } -+ if (ev >= 13) -+ /* target_max_*, cache_target_*, cache_min_* */ -+ ceph_decode_skip_n(p, end, 16 + 8 + 8, bad); - -- if (ev >= 14) { -- /* skip erasure_code_profile */ -- len = ceph_decode_32(p); -- *p += len; -- } -+ if (ev >= 14) -+ /* erasure_code_profile */ -+ ceph_decode_skip_string(p, end, bad); - - /* - * last_force_op_resend_preluminous, will be overridden if the - * map was encoded with RESEND_ON_SPLIT - */ - if (ev >= 15) -- pi->last_force_request_resend = ceph_decode_32(p); -+ ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); - else - pi->last_force_request_resend = 0; - - if (ev >= 16) -- *p += 4; /* skip min_read_recency_for_promote */ -+ /* min_read_recency_for_promote */ -+ ceph_decode_skip_32(p, end, bad); - - if (ev >= 17) -- *p += 8; /* skip expected_num_objects */ -+ /* expected_num_objects */ -+ ceph_decode_skip_64(p, end, bad); - - if (ev >= 19) -- *p += 4; /* skip cache_target_dirty_high_ratio_micro */ -+ /* cache_target_dirty_high_ratio_micro */ -+ ceph_decode_skip_32(p, end, bad); - - if (ev >= 20) -- *p += 4; /* skip min_write_recency_for_promote */ -+ /* min_write_recency_for_promote */ -+ ceph_decode_skip_32(p, end, bad); - - if (ev >= 21) -- *p += 1; /* skip use_gmt_hitset */ -+ /* use_gmt_hitset */ -+ ceph_decode_skip_8(p, end, bad); - - if (ev >= 22) -- *p += 1; /* skip fast_read */ -+ /* fast_read */ -+ ceph_decode_skip_8(p, end, bad); - -- if (ev >= 23) { -- *p += 4; /* skip hit_set_grade_decay_rate */ -- *p += 4; /* skip hit_set_search_last_n */ -- } -+ if (ev >= 23) -+ /* hit_set_grade_decay_rate, hit_set_search_last_n */ -+ ceph_decode_skip_n(p, end, 4 + 4, bad); - - if (ev >= 24) { -- /* skip opts */ -- *p += 1 + 1; /* versions */ -- len = ceph_decode_32(p); -- *p += len; -+ /* opts (with versions) */ -+ ceph_decode_skip_n(p, end, 2, bad); -+ ceph_decode_skip_string(p, end, bad); - } - - if (ev >= 25) -- pi->last_force_request_resend = ceph_decode_32(p); -+ ceph_decode_32_safe(p, end, pi->last_force_request_resend, bad); - - /* ignore the rest */ - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1173-libceph-prevent-potential-out-of-bounds-reads-in-handle-auth.patch b/SOURCES/1173-libceph-prevent-potential-out-of-bounds-reads-in-handle-auth.patch deleted file mode 100644 index 8ff06627d..000000000 --- a/SOURCES/1173-libceph-prevent-potential-out-of-bounds-reads-in-handle-auth.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 818156caffbf55cb4d368f9c3cac64e458fb49c9 Mon Sep 17 00:00:00 2001 -From: ziming zhang -Date: Thu, 11 Dec 2025 16:52:58 +0800 -Subject: [PATCH] libceph: prevent potential out-of-bounds reads in - handle_auth_done() - -Perform an explicit bounds check on payload_len to avoid a possible -out-of-bounds access in the callout. - -[ idryomov: changelog ] - -Cc: stable@vger.kernel.org -Signed-off-by: ziming zhang -Reviewed-by: Ilya Dryomov -Signed-off-by: Ilya Dryomov - -diff --git a/net/ceph/messenger_v2.c b/net/ceph/messenger_v2.c -index 833e57849c1d..c9d50c0dcd33 100644 ---- a/net/ceph/messenger_v2.c -+++ b/net/ceph/messenger_v2.c -@@ -2376,7 +2376,9 @@ static int process_auth_done(struct ceph_connection *con, void *p, void *end) - - ceph_decode_64_safe(&p, end, global_id, bad); - ceph_decode_32_safe(&p, end, con->v2.con_mode, bad); -+ - ceph_decode_32_safe(&p, end, payload_len, bad); -+ ceph_decode_need(&p, end, payload_len, bad); - - dout("%s con %p global_id %llu con_mode %d payload_len %d\n", - __func__, con, global_id, con->v2.con_mode, payload_len); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1174-libceph-replace-overzealous-bug-on-in-osdmap-apply-increment.patch b/SOURCES/1174-libceph-replace-overzealous-bug-on-in-osdmap-apply-increment.patch deleted file mode 100644 index e46008ebe..000000000 --- a/SOURCES/1174-libceph-replace-overzealous-bug-on-in-osdmap-apply-increment.patch +++ /dev/null @@ -1,36 +0,0 @@ -From e00c3f71b5cf75681dbd74ee3f982a99cb690c2b Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Mon, 15 Dec 2025 11:53:31 +0100 -Subject: [PATCH] libceph: replace overzealous BUG_ON in - osdmap_apply_incremental() - -If the osdmap is (maliciously) corrupted such that the incremental -osdmap epoch is different from what is expected, there is no need to -BUG. Instead, just declare the incremental osdmap to be invalid. - -Cc: stable@vger.kernel.org -Reported-by: ziming zhang -Signed-off-by: Ilya Dryomov - -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index 34b3ab59602f..3377a22e3f6c 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -1979,11 +1979,13 @@ struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end, bool msgr2, - sizeof(u64) + sizeof(u32), e_inval); - ceph_decode_copy(p, &fsid, sizeof(fsid)); - epoch = ceph_decode_32(p); -- BUG_ON(epoch != map->epoch+1); - ceph_decode_copy(p, &modified, sizeof(modified)); - new_pool_max = ceph_decode_64(p); - new_flags = ceph_decode_32(p); - -+ if (epoch != map->epoch + 1) -+ goto e_inval; -+ - /* full map? */ - ceph_decode_32_safe(p, end, len, e_inval); - if (len > 0) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1175-libceph-reset-sparse-read-state-in-osd-fault.patch b/SOURCES/1175-libceph-reset-sparse-read-state-in-osd-fault.patch deleted file mode 100644 index 50a2bc709..000000000 --- a/SOURCES/1175-libceph-reset-sparse-read-state-in-osd-fault.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 11194b416ef95012c2cfe5f546d71af07b639e93 Mon Sep 17 00:00:00 2001 -From: Sam Edwards -Date: Tue, 30 Dec 2025 20:05:06 -0800 -Subject: [PATCH] libceph: reset sparse-read state in osd_fault() - -When a fault occurs, the connection is abandoned, reestablished, and any -pending operations are retried. The OSD client tracks the progress of a -sparse-read reply using a separate state machine, largely independent of -the messenger's state. - -If a connection is lost mid-payload or the sparse-read state machine -returns an error, the sparse-read state is not reset. The OSD client -will then interpret the beginning of a new reply as the continuation of -the old one. If this makes the sparse-read machinery enter a failure -state, it may never recover, producing loops like: - - libceph: [0] got 0 extents - libceph: data len 142248331 != extent len 0 - libceph: osd0 (1)...:6801 socket error on read - libceph: data len 142248331 != extent len 0 - libceph: osd0 (1)...:6801 socket error on read - -Therefore, reset the sparse-read state in osd_fault(), ensuring retries -start from a clean state. - -Cc: stable@vger.kernel.org -Fixes: f628d7999727 ("libceph: add sparse read support to OSD client") -Signed-off-by: Sam Edwards -Reviewed-by: Ilya Dryomov -Signed-off-by: Ilya Dryomov - -diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c -index 3667319b949d..1a7be2f615dc 100644 ---- a/net/ceph/osd_client.c -+++ b/net/ceph/osd_client.c -@@ -4281,6 +4281,9 @@ static void osd_fault(struct ceph_connection *con) - goto out_unlock; - } - -+ osd->o_sparse_op_idx = -1; -+ ceph_init_sparse_read(&osd->o_sparse_read); -+ - if (!reopen_osd(osd)) - kick_osd_requests(osd); - maybe_request_map(osdc); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1176-powerpc-tools-drop-o-pipefail-in-gcc-check-scripts.patch b/SOURCES/1176-powerpc-tools-drop-o-pipefail-in-gcc-check-scripts.patch deleted file mode 100644 index 98388a101..000000000 --- a/SOURCES/1176-powerpc-tools-drop-o-pipefail-in-gcc-check-scripts.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 123d241dcfc31871e2610504c50583dce8ac832f Mon Sep 17 00:00:00 2001 -From: Jan Stancek -Date: Tue, 23 Sep 2025 17:32:16 +0200 -Subject: [PATCH] powerpc/tools: drop `-o pipefail` in gcc check scripts - -JIRA: https://redhat.atlassian.net/browse/RHEL-165107 -Upstream Status: linux.git - -Conflicts: -- RHEL commit 12e313df71b6 ("powerpc/tools: drop `-o pipefail` in gcc check scripts") - applied one of the hunks of upstream commit, because at the time RHEL9 - was missing gcc-check-fpatchable-function-entry.sh. - This has changed when RHEL commit - c3aeb790328d ("powerpc/ftrace: Add support for -fpatchable-function-entry") - introduced it. - This applies missing hunk from f1164534ad62f0cc247d99650b07bd59ad2a49fd to - arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh - -commit f1164534ad62f0cc247d99650b07bd59ad2a49fd -Author: Jan Stancek -Date: Tue Sep 23 17:32:16 2025 +0200 - - powerpc/tools: drop `-o pipefail` in gcc check scripts - - Fixes: 0f71dcfb4aef ("powerpc/ftrace: Add support for -fpatchable-function-entry") - Fixes: b71c9ffb1405 ("powerpc: Add arch/powerpc/tools directory") - Reported-by: Joe Lawrence - Acked-by: Joe Lawrence - Signed-off-by: Jan Stancek - Fixes: 8c50b72a3b4f ("powerpc/ftrace: Add Kconfig & Make glue for mprofile-kernel") - Fixes: abba759796f9 ("powerpc/kbuild: move -mprofile-kernel check to Kconfig") - Tested-by: Justin M. Forbes - Reviewed-by: Naveen N Rao (AMD) - Reviewed-by: Josh Poimboeuf - Signed-off-by: Madhavan Srinivasan - Link: https://patch.msgid.link/cc6cdd116c3ad9d990df21f13c6d8e8a83815bbd.1758641374.git.jstancek@redhat.com - -Signed-off-by: Jan Stancek - -diff --git a/arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh b/arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh -index 06706903503b..baed467a016b 100755 ---- a/arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh -+++ b/arch/powerpc/tools/gcc-check-fpatchable-function-entry.sh -@@ -2,7 +2,6 @@ - # SPDX-License-Identifier: GPL-2.0 - - set -e --set -o pipefail - - # To debug, uncomment the following line - # set -x --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1177-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch b/SOURCES/1177-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch deleted file mode 100644 index 96b344482..000000000 --- a/SOURCES/1177-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch +++ /dev/null @@ -1,79 +0,0 @@ -From aad885e774966e97b675dfe928da164214a71605 Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Thu, 5 Mar 2026 17:28:04 -0800 -Subject: [PATCH] KVM: x86/mmu: Drop/zap existing present SPTE even when - creating an MMIO SPTE - -When installing an emulated MMIO SPTE, do so *after* dropping/zapping the -existing SPTE (if it's shadow-present). While commit a54aa15c6bda3 was -right about it being impossible to convert a shadow-present SPTE to an -MMIO SPTE due to a _guest_ write, it failed to account for writes to guest -memory that are outside the scope of KVM. - -E.g. if host userspace modifies a shadowed gPTE to switch from a memslot -to emulted MMIO and then the guest hits a relevant page fault, KVM will -install the MMIO SPTE without first zapping the shadow-present SPTE. - - ------------[ cut here ]------------ - is_shadow_present_pte(*sptep) - WARNING: arch/x86/kvm/mmu/mmu.c:484 at mark_mmio_spte+0xb2/0xc0 [kvm], CPU#0: vmx_ept_stale_r/4292 - Modules linked in: kvm_intel kvm irqbypass - CPU: 0 UID: 1000 PID: 4292 Comm: vmx_ept_stale_r Not tainted 7.0.0-rc2-eafebd2d2ab0-sink-vm #319 PREEMPT - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 - RIP: 0010:mark_mmio_spte+0xb2/0xc0 [kvm] - Call Trace: - - mmu_set_spte+0x237/0x440 [kvm] - ept_page_fault+0x535/0x7f0 [kvm] - kvm_mmu_do_page_fault+0xee/0x1f0 [kvm] - kvm_mmu_page_fault+0x8d/0x620 [kvm] - vmx_handle_exit+0x18c/0x5a0 [kvm_intel] - kvm_arch_vcpu_ioctl_run+0xc55/0x1c20 [kvm] - kvm_vcpu_ioctl+0x2d5/0x980 [kvm] - __x64_sys_ioctl+0x8a/0xd0 - do_syscall_64+0xb5/0x730 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - RIP: 0033:0x47fa3f - - ---[ end trace 0000000000000000 ]--- - -Reported-by: Alexander Bulekov -Debugged-by: Alexander Bulekov -Suggested-by: Fred Griffoul -Fixes: a54aa15c6bda3 ("KVM: x86/mmu: Handle MMIO SPTEs directly in mmu_set_spte()") -Cc: stable@vger.kernel.org -Signed-off-by: Sean Christopherson - - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index c542b26..8895c98 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -2892,12 +2892,6 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, - bool prefetch = !fault || fault->prefetch; - bool write_fault = fault && fault->write; - -- if (unlikely(is_noslot_pfn(pfn))) { -- vcpu->stat.pf_mmio_spte_created++; -- mark_mmio_spte(vcpu, sptep, gfn, pte_access); -- return RET_PF_EMULATE; -- } -- - if (is_shadow_present_pte(*sptep)) { - if (prefetch) - return RET_PF_SPURIOUS; -@@ -2920,6 +2914,14 @@ static int mmu_set_spte(struct kvm_vcpu *vcpu, struct kvm_memory_slot *slot, - was_rmapped = 1; - } - -+ if (unlikely(is_noslot_pfn(pfn))) { -+ vcpu->stat.pf_mmio_spte_created++; -+ mark_mmio_spte(vcpu, sptep, gfn, pte_access); -+ if (flush) -+ kvm_flush_remote_tlbs_gfn(vcpu->kvm, gfn, level); -+ return RET_PF_EMULATE; -+ } -+ - wrprot = make_spte(vcpu, sp, slot, pte_access, gfn, pfn, *sptep, prefetch, - true, host_writable, &spte); - diff --git a/SOURCES/1178-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch b/SOURCES/1178-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch deleted file mode 100644 index ec50dc3dc..000000000 --- a/SOURCES/1178-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 00de3c031466400b8db061ae3149de8c64999974 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 12:54:18 +0800 -Subject: [PATCH] crypto: af-alg - fix NULL pointer dereference in scatterwalk - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: 62397b493e14107ae82d8b80938f293d95425bcb - -commit 62397b493e14107ae82d8b80938f293d95425bcb -Author: Norbert Szetei -Date: Wed Mar 25 18:26:13 2026 +0100 - - crypto: af-alg - fix NULL pointer dereference in scatterwalk - - The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL) - when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL - exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent - sendmsg() allocates a new SGL and chains it, but fails to clear the end - marker on the previous SGL's last data entry. - - This causes the crypto scatterwalk to hit a premature end, returning NULL - on sg_next() and leading to a kernel panic during dereference. - - Fix this by explicitly unmarking the end of the previous SGL when - performing sg_chain() in af_alg_alloc_tsgl(). - - Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations") - Signed-off-by: Norbert Szetei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 67e66729281b..25d9d907dd9f 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -513,8 +513,10 @@ static int af_alg_alloc_tsgl(struct sock *sk) - sg_init_table(sgl->sg, MAX_SGL_ENTS + 1); - sgl->cur = 0; - -- if (sg) -+ if (sg) { -+ sg_unmark_end(sg + MAX_SGL_ENTS - 1); - sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg); -+ } - - list_add_tail(&sgl->list, &ctx->tsgl_list); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1179-crypto-algif-aead-revert-to-operating-out-of-place.patch b/SOURCES/1179-crypto-algif-aead-revert-to-operating-out-of-place.patch deleted file mode 100644 index d92d14803..000000000 --- a/SOURCES/1179-crypto-algif-aead-revert-to-operating-out-of-place.patch +++ /dev/null @@ -1,325 +0,0 @@ -From ada3d4ca449018dd63cee4a4b806d7cb78e76e4c Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:52:06 +0800 -Subject: [PATCH] crypto: algif_aead - Revert to operating out-of-place - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 -CVE: CVE-2026-31431 - -Upstream Status: a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 - -commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 -Author: Herbert Xu -Date: Thu Mar 26 15:30:20 2026 +0900 - - crypto: algif_aead - Revert to operating out-of-place - - This mostly reverts commit 72548b093ee3 except for the copying of - the associated data. - - There is no benefit in operating in-place in algif_aead since the - source and destination come from different mappings. Get rid of - all the complexity added for in-place operation and just copy the - AD directly. - - Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst") - Reported-by: Taeyang Lee <0wn@theori.io> - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 25d9d907dd9f..45a058ca890a 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -527,15 +527,13 @@ static int af_alg_alloc_tsgl(struct sock *sk) - /** - * af_alg_count_tsgl - Count number of TX SG entries - * -- * The counting starts from the beginning of the SGL to @bytes. If -- * an @offset is provided, the counting of the SG entries starts at the @offset. -+ * The counting starts from the beginning of the SGL to @bytes. - * - * @sk: socket of connection to user space - * @bytes: Count the number of SG entries holding given number of bytes. -- * @offset: Start the counting of SG entries from the given offset. - * Return: Number of TX SG entries found given the constraints - */ --unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset) -+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes) - { - const struct alg_sock *ask = alg_sk(sk); - const struct af_alg_ctx *ctx = ask->private; -@@ -550,25 +548,11 @@ unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset) - const struct scatterlist *sg = sgl->sg; - - for (i = 0; i < sgl->cur; i++) { -- size_t bytes_count; -- -- /* Skip offset */ -- if (offset >= sg[i].length) { -- offset -= sg[i].length; -- bytes -= sg[i].length; -- continue; -- } -- -- bytes_count = sg[i].length - offset; -- -- offset = 0; - sgl_count++; -- -- /* If we have seen requested number of bytes, stop */ -- if (bytes_count >= bytes) -+ if (sg[i].length >= bytes) - return sgl_count; - -- bytes -= bytes_count; -+ bytes -= sg[i].length; - } - } - -@@ -580,19 +564,14 @@ EXPORT_SYMBOL_GPL(af_alg_count_tsgl); - * af_alg_pull_tsgl - Release the specified buffers from TX SGL - * - * If @dst is non-null, reassign the pages to @dst. The caller must release -- * the pages. If @dst_offset is given only reassign the pages to @dst starting -- * at the @dst_offset (byte). The caller must ensure that @dst is large -- * enough (e.g. by using af_alg_count_tsgl with the same offset). -+ * the pages. - * - * @sk: socket of connection to user space - * @used: Number of bytes to pull from TX SGL - * @dst: If non-NULL, buffer is reassigned to dst SGL instead of releasing. The - * caller must release the buffers in dst. -- * @dst_offset: Reassign the TX SGL from given offset. All buffers before -- * reaching the offset is released. - */ --void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, -- size_t dst_offset) -+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst) - { - struct alg_sock *ask = alg_sk(sk); - struct af_alg_ctx *ctx = ask->private; -@@ -617,18 +596,10 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, - * SG entries in dst. - */ - if (dst) { -- if (dst_offset >= plen) { -- /* discard page before offset */ -- dst_offset -= plen; -- } else { -- /* reassign page to dst after offset */ -- get_page(page); -- sg_set_page(dst + j, page, -- plen - dst_offset, -- sg[i].offset + dst_offset); -- dst_offset = 0; -- j++; -- } -+ /* reassign page to dst after offset */ -+ get_page(page); -+ sg_set_page(dst + j, page, plen, sg[i].offset); -+ j++; - } - - sg[i].length -= plen; -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 42493b4d8ce4..4a6a0bb1ae3c 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -96,9 +96,8 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - struct aead_tfm *aeadc = pask->private; - struct crypto_aead *tfm = aeadc->aead; - struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm; -- unsigned int i, as = crypto_aead_authsize(tfm); -+ unsigned int as = crypto_aead_authsize(tfm); - struct af_alg_async_req *areq; -- struct af_alg_tsgl *tsgl, *tmp; - struct scatterlist *rsgl_src, *tsgl_src = NULL; - int err = 0; - size_t used = 0; /* [in] TX bufs to be en/decrypted */ -@@ -178,23 +177,24 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - outlen -= less; - } - -+ /* -+ * Create a per request TX SGL for this request which tracks the -+ * SG entries from the global TX SGL. -+ */ - processed = used + ctx->aead_assoclen; -- list_for_each_entry_safe(tsgl, tmp, &ctx->tsgl_list, list) { -- for (i = 0; i < tsgl->cur; i++) { -- struct scatterlist *process_sg = tsgl->sg + i; -- -- if (!(process_sg->length) || !sg_page(process_sg)) -- continue; -- tsgl_src = process_sg; -- break; -- } -- if (tsgl_src) -- break; -- } -- if (processed && !tsgl_src) { -- err = -EFAULT; -+ areq->tsgl_entries = af_alg_count_tsgl(sk, processed); -+ if (!areq->tsgl_entries) -+ areq->tsgl_entries = 1; -+ areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -+ areq->tsgl_entries), -+ GFP_KERNEL); -+ if (!areq->tsgl) { -+ err = -ENOMEM; - goto free; - } -+ sg_init_table(areq->tsgl, areq->tsgl_entries); -+ af_alg_pull_tsgl(sk, processed, areq->tsgl); -+ tsgl_src = areq->tsgl; - - /* - * Copy of AAD from source to destination -@@ -203,81 +203,18 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - * when user space uses an in-place cipher operation, the kernel - * will copy the data as it does not see whether such in-place operation - * is initiated. -- * -- * To ensure efficiency, the following implementation ensure that the -- * ciphers are invoked to perform a crypto operation in-place. This -- * is achieved by memory management specified as follows. - */ - - /* Use the RX SGL as source (and destination) for crypto op. */ - rsgl_src = areq->first_rsgl.sgl.sg; - -- if (ctx->enc) { -- /* -- * Encryption operation - The in-place cipher operation is -- * achieved by the following operation: -- * -- * TX SGL: AAD || PT -- * | | -- * | copy | -- * v v -- * RX SGL: AAD || PT || Tag -- */ -- err = crypto_aead_copy_sgl(null_tfm, tsgl_src, -- areq->first_rsgl.sgl.sg, processed); -- if (err) -- goto free; -- af_alg_pull_tsgl(sk, processed, NULL, 0); -- } else { -- /* -- * Decryption operation - To achieve an in-place cipher -- * operation, the following SGL structure is used: -- * -- * TX SGL: AAD || CT || Tag -- * | | ^ -- * | copy | | Create SGL link. -- * v v | -- * RX SGL: AAD || CT ----+ -- */ -- -- /* Copy AAD || CT to RX SGL buffer for in-place operation. */ -- err = crypto_aead_copy_sgl(null_tfm, tsgl_src, -- areq->first_rsgl.sgl.sg, outlen); -- if (err) -- goto free; -- -- /* Create TX SGL for tag and chain it to RX SGL. */ -- areq->tsgl_entries = af_alg_count_tsgl(sk, processed, -- processed - as); -- if (!areq->tsgl_entries) -- areq->tsgl_entries = 1; -- areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -- areq->tsgl_entries), -- GFP_KERNEL); -- if (!areq->tsgl) { -- err = -ENOMEM; -- goto free; -- } -- sg_init_table(areq->tsgl, areq->tsgl_entries); -- -- /* Release TX SGL, except for tag data and reassign tag data. */ -- af_alg_pull_tsgl(sk, processed, areq->tsgl, processed - as); -- -- /* chain the areq TX SGL holding the tag with RX SGL */ -- if (usedpages) { -- /* RX SGL present */ -- struct af_alg_sgl *sgl_prev = &areq->last_rsgl->sgl; -- -- sg_unmark_end(sgl_prev->sg + sgl_prev->npages - 1); -- sg_chain(sgl_prev->sg, sgl_prev->npages + 1, -- areq->tsgl); -- } else -- /* no RX SGL present (e.g. authentication only) */ -- rsgl_src = areq->tsgl; -- } -+ err = crypto_aead_copy_sgl(null_tfm, tsgl_src, rsgl_src, -+ ctx->aead_assoclen); -+ if (err) -+ goto free; - - /* Initialize the crypto operation */ -- aead_request_set_crypt(&areq->cra_u.aead_req, rsgl_src, -+ aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src, - areq->first_rsgl.sgl.sg, used, ctx->iv); - aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen); - aead_request_set_tfm(&areq->cra_u.aead_req, tfm); -@@ -526,7 +463,7 @@ static void aead_sock_destruct(struct sock *sk) - struct crypto_aead *tfm = aeadc->aead; - unsigned int ivlen = crypto_aead_ivsize(tfm); - -- af_alg_pull_tsgl(sk, ctx->used, NULL, 0); -+ af_alg_pull_tsgl(sk, ctx->used, NULL); - sock_kzfree_s(sk, ctx->iv, ivlen); - sock_kfree_s(sk, ctx, ctx->len); - af_alg_release_parent(sk); -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index ee8890ee8f33..8b314260929f 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -89,7 +89,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - * Create a per request TX SGL for this request which tracks the - * SG entries from the global TX SGL. - */ -- areq->tsgl_entries = af_alg_count_tsgl(sk, len, 0); -+ areq->tsgl_entries = af_alg_count_tsgl(sk, len); - if (!areq->tsgl_entries) - areq->tsgl_entries = 1; - areq->tsgl = sock_kmalloc(sk, array_size(sizeof(*areq->tsgl), -@@ -100,7 +100,7 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - goto free; - } - sg_init_table(areq->tsgl, areq->tsgl_entries); -- af_alg_pull_tsgl(sk, len, areq->tsgl, 0); -+ af_alg_pull_tsgl(sk, len, areq->tsgl); - - /* Initialize the crypto operation */ - skcipher_request_set_tfm(&areq->cra_u.skcipher_req, tfm); -@@ -313,7 +313,7 @@ static void skcipher_sock_destruct(struct sock *sk) - struct alg_sock *pask = alg_sk(psk); - struct crypto_skcipher *tfm = pask->private; - -- af_alg_pull_tsgl(sk, ctx->used, NULL, 0); -+ af_alg_pull_tsgl(sk, ctx->used, NULL); - sock_kzfree_s(sk, ctx->iv, crypto_skcipher_ivsize(tfm)); - sock_kfree_s(sk, ctx, ctx->len); - af_alg_release_parent(sk); -diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h -index 249e6bbf5cb2..f18a4ca6f07c 100644 ---- a/include/crypto/if_alg.h -+++ b/include/crypto/if_alg.h -@@ -226,9 +226,8 @@ static inline bool af_alg_readable(struct sock *sk) - return PAGE_SIZE <= af_alg_rcvbuf(sk); - } - --unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes, size_t offset); --void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst, -- size_t dst_offset); -+unsigned int af_alg_count_tsgl(struct sock *sk, size_t bytes); -+void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst); - void af_alg_wmem_wakeup(struct sock *sk); - int af_alg_wait_for_data(struct sock *sk, unsigned flags, unsigned min); - int af_alg_sendmsg(struct socket *sock, struct msghdr *msg, size_t size, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1180-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch b/SOURCES/1180-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch deleted file mode 100644 index 436f3d639..000000000 --- a/SOURCES/1180-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 40240fa36eae2ed097d9191cfa568fcc702472b6 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:54:01 +0800 -Subject: [PATCH] crypto: af_alg - limit RX SG extraction by receive buffer - budget - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 -CVE: CVE-2026-31677 - -Upstream Status: 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 - -commit 8eceab19eba9dcbfd2a0daec72e1bf48aa100170 -Author: Douya Le -Date: Thu Apr 2 23:34:55 2026 +0800 - - crypto: af_alg - limit RX SG extraction by receive buffer budget - - Make af_alg_get_rsgl() limit each RX scatterlist extraction to the - remaining receive buffer budget. - - af_alg_get_rsgl() currently uses af_alg_readable() only as a gate - before extracting data into the RX scatterlist. Limit each extraction - to the remaining af_alg_rcvbuf(sk) budget so that receive-side - accounting matches the amount of data attached to the request. - - If skcipher cannot obtain enough RX space for at least one chunk while - more data remains to be processed, reject the recvmsg call instead of - rounding the request length down to zero. - - Fixes: e870456d8e7c8d57c059ea479b5aadbb55ff4c3a ("crypto: algif_skcipher - overhaul memory management") - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Signed-off-by: Douya Le - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 45a058ca890a..450869efc079 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -1135,6 +1135,8 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, - - seglen = min_t(size_t, (maxsize - len), - msg_data_left(msg)); -+ /* Never pin more pages than the remaining RX accounting budget. */ -+ seglen = min_t(size_t, seglen, af_alg_rcvbuf(sk)); - - if (list_empty(&areq->rsgl_list)) { - rsgl = &areq->first_rsgl; -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index 8b314260929f..edbdc19cdb31 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -82,8 +82,14 @@ static int _skcipher_recvmsg(struct socket *sock, struct msghdr *msg, - * If more buffers are to be expected to be processed, process only - * full block size buffers. - */ -- if (ctx->more || len < ctx->used) -+ if (ctx->more || len < ctx->used) { -+ if (len < bs) { -+ err = -EINVAL; -+ goto free; -+ } -+ - len -= len % bs; -+ } - - /* - * Create a per request TX SGL for this request which tracks the --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1181-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch b/SOURCES/1181-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch deleted file mode 100644 index 83a617f3e..000000000 --- a/SOURCES/1181-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 9e1c6ad59b9a5d325cda7cf7860d1442a1121c34 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:10:09 +0800 -Subject: [PATCH] crypto: af_alg - Fix page reassignment overflow in - af_alg_pull_tsgl - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: 31d00156e50ecad37f2cb6cbf04aaa9a260505ef - -commit 31d00156e50ecad37f2cb6cbf04aaa9a260505ef -Author: Herbert Xu -Date: Sat Apr 4 08:29:58 2026 +0800 - - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl - - When page reassignment was added to af_alg_pull_tsgl the original - loop wasn't updated so it may try to reassign one more page than - necessary. - - Add the check to the reassignment so that this does not happen. - - Also update the comment which still refers to the obsolete offset - argument. - - Reported-by: syzbot+d23888375c2737c17ba5@syzkaller.appspotmail.com - Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index 450869efc079..567e9f234ba3 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -595,8 +595,8 @@ void af_alg_pull_tsgl(struct sock *sk, size_t used, struct scatterlist *dst) - * Assumption: caller created af_alg_count_tsgl(len) - * SG entries in dst. - */ -- if (dst) { -- /* reassign page to dst after offset */ -+ if (dst && plen) { -+ /* reassign page to dst */ - get_page(page); - sg_set_page(dst + j, page, plen, sg[i].offset); - j++; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1182-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch b/SOURCES/1182-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch deleted file mode 100644 index abbb0876a..000000000 --- a/SOURCES/1182-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 3d6c89a117ab9fce6fa8240ad5b45bcd48f6d751 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:54:32 +0800 -Subject: [PATCH] crypto: authencesn - reject too-short AAD (assoclen<8) to - match ESP/ESN spec - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 -CVE: CVE-2026-23060 - -Upstream Status: 2397e9264676be7794f8f7f1e9763d90bd3c7335 - -commit 2397e9264676be7794f8f7f1e9763d90bd3c7335 -Author: Taeyang Lee <0wn@theori.io> -Date: Fri Jan 16 16:03:58 2026 +0900 - - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec - - authencesn assumes an ESP/ESN-formatted AAD. When assoclen is shorter than - the minimum expected length, crypto_authenc_esn_decrypt() can advance past - the end of the destination scatterlist and trigger a NULL pointer dereference - in scatterwalk_map_and_copy(), leading to a kernel panic (DoS). - - Add a minimum AAD length check to fail fast on invalid inputs. - - Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") - Reported-By: Taeyang Lee <0wn@theori.io> - Signed-off-by: Taeyang Lee <0wn@theori.io> - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index b60e61b1904c..6487b35851d5 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -191,6 +191,9 @@ static int crypto_authenc_esn_encrypt(struct aead_request *req) - struct scatterlist *src, *dst; - int err; - -+ if (assoclen < 8) -+ return -EINVAL; -+ - sg_init_table(areq_ctx->src, 2); - src = scatterwalk_ffwd(areq_ctx->src, req->src, assoclen); - dst = src; -@@ -284,6 +287,9 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - u32 tmp[2]; - int err; - -+ if (assoclen < 8) -+ return -EINVAL; -+ - cryptlen -= authsize; - - if (req->src != dst) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1183-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch b/SOURCES/1183-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch deleted file mode 100644 index b30c481c9..000000000 --- a/SOURCES/1183-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 4a2446436fe796a1b8cef89e30f54c2c295943fe Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:16:25 +0800 -Subject: [PATCH] crypto: authencesn - Do not place hiseq at end of dst for - out-of-place decryption - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 -CVE: CVE-2026-31431 - -Upstream Status: e02494114ebf7c8b42777c6cd6982f113bfdbec7 - -commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 -Author: Herbert Xu -Date: Fri Mar 27 15:04:17 2026 +0900 - - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - - When decrypting data that is not in-place (src != dst), there is - no need to save the high-order sequence bits in dst as it could - simply be re-copied from the source. - - However, the data to be hashed need to be rearranged accordingly. - - Reported-by: Taeyang Lee <0wn@theori.io> - Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface") - Signed-off-by: Herbert Xu - - Thanks, - - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 6487b35851d5..8664dad45792 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -164,7 +164,10 @@ static void crypto_authenc_esn_encrypt_done(struct crypto_async_request *req, - authenc_esn_request_complete(areq, err); - } - --static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) -+static int crypto_authenc_esn_copy_sg(struct aead_request *req, -+ struct scatterlist *src, -+ struct scatterlist *dst, -+ unsigned int len) - { - struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req); - struct crypto_authenc_esn_ctx *ctx = crypto_aead_ctx(authenc_esn); -@@ -173,11 +176,16 @@ static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) - skcipher_request_set_sync_tfm(skreq, ctx->null); - skcipher_request_set_callback(skreq, aead_request_flags(req), - NULL, NULL); -- skcipher_request_set_crypt(skreq, req->src, req->dst, len, NULL); -+ skcipher_request_set_crypt(skreq, src, dst, len, NULL); - - return crypto_skcipher_encrypt(skreq); - } - -+static int crypto_authenc_esn_copy(struct aead_request *req, unsigned int len) -+{ -+ return crypto_authenc_esn_copy_sg(req, req->src, req->dst, len); -+} -+ - static int crypto_authenc_esn_encrypt(struct aead_request *req) - { - struct crypto_aead *authenc_esn = crypto_aead_reqtfm(req); -@@ -233,30 +241,39 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - crypto_ahash_alignmask(auth) + 1); - unsigned int cryptlen = req->cryptlen - authsize; - unsigned int assoclen = req->assoclen; -+ struct scatterlist *src = req->src; - struct scatterlist *dst = req->dst; - u8 *ihash = ohash + crypto_ahash_digestsize(auth); - u32 tmp[2]; -+ int err; - - if (!authsize) - goto decrypt; - -- /* Move high-order bits of sequence number back. */ -- scatterwalk_map_and_copy(tmp, dst, 4, 4, 0); -- scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0); -- scatterwalk_map_and_copy(tmp, dst, 0, 8, 1); -+ if (src == dst) { -+ /* Move high-order bits of sequence number back. */ -+ scatterwalk_map_and_copy(tmp, dst, 4, 4, 0); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0); -+ scatterwalk_map_and_copy(tmp, dst, 0, 8, 1); -+ } else { -+ err = crypto_authenc_esn_copy(req, assoclen); -+ if (err) -+ return err; -+ } - - if (crypto_memneq(ihash, ohash, authsize)) - return -EBADMSG; - - decrypt: - -- sg_init_table(areq_ctx->dst, 2); -+ if (src != dst) -+ src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, - req->base.complete, req->base.data); -- skcipher_request_set_crypt(skreq, dst, dst, cryptlen, req->iv); -+ skcipher_request_set_crypt(skreq, src, dst, cryptlen, req->iv); - - return crypto_skcipher_decrypt(skreq); - } -@@ -283,6 +300,7 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - unsigned int assoclen = req->assoclen; - unsigned int cryptlen = req->cryptlen; - u8 *ihash = ohash + crypto_ahash_digestsize(auth); -+ struct scatterlist *src = req->src; - struct scatterlist *dst = req->dst; - u32 tmp[2]; - int err; -@@ -290,27 +308,31 @@ static int crypto_authenc_esn_decrypt(struct aead_request *req) - if (assoclen < 8) - return -EINVAL; - -- cryptlen -= authsize; -- -- if (req->src != dst) { -- err = crypto_authenc_esn_copy(req, assoclen + cryptlen); -- if (err) -- return err; -- } -+ if (!authsize) -+ goto tail; - -+ cryptlen -= authsize; - scatterwalk_map_and_copy(ihash, req->src, assoclen + cryptlen, - authsize, 0); - -- if (!authsize) -- goto tail; -- - /* Move high-order bits of sequence number to the end. */ -- scatterwalk_map_and_copy(tmp, dst, 0, 8, 0); -- scatterwalk_map_and_copy(tmp, dst, 4, 4, 1); -- scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1); -- -- sg_init_table(areq_ctx->dst, 2); -- dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ scatterwalk_map_and_copy(tmp, src, 0, 8, 0); -+ if (src == dst) { -+ scatterwalk_map_and_copy(tmp, dst, 4, 4, 1); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 1); -+ dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ } else { -+ scatterwalk_map_and_copy(tmp, dst, 0, 4, 1); -+ scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen - 4, 4, 1); -+ -+ src = scatterwalk_ffwd(areq_ctx->src, src, 8); -+ dst = scatterwalk_ffwd(areq_ctx->dst, dst, 4); -+ err = crypto_authenc_esn_copy_sg(req, src, dst, -+ assoclen + cryptlen - 8); -+ if (err) -+ return err; -+ dst = req->dst; -+ } - - ahash_request_set_tfm(ahreq, auth); - ahash_request_set_crypt(ahreq, dst, ohash, assoclen + cryptlen); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1184-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch b/SOURCES/1184-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch deleted file mode 100644 index 2f0ca0f9a..000000000 --- a/SOURCES/1184-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 37dc4d521edd3990b54849381ea8a82ee5f8bdc5 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 19:56:24 +0800 -Subject: [PATCH] crypto: authencesn - Fix src offset when decrypting in-place - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa - -commit 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa -Author: Herbert Xu -Date: Wed Apr 15 07:39:06 2026 +0800 - - crypto: authencesn - Fix src offset when decrypting in-place - - The src SG list offset wasn't set properly when decrypting in-place, - fix it. - - Reported-by: Wolfgang Walter - Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 8664dad45792..9a586b0b7716 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -266,9 +266,11 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - - decrypt: - -- if (src != dst) -- src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen); -+ if (req->src == req->dst) -+ src = dst; -+ else -+ src = scatterwalk_ffwd(areq_ctx->src, src, assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1185-crypto-authencesn-reject-short-ahash-digests-during-instance.patch b/SOURCES/1185-crypto-authencesn-reject-short-ahash-digests-during-instance.patch deleted file mode 100644 index 999b3ba84..000000000 --- a/SOURCES/1185-crypto-authencesn-reject-short-ahash-digests-during-instance.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 18fe1da8a470fbfaf19071dac3e9f43a61bd2ec9 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:02:19 +0800 -Subject: [PATCH] crypto: authencesn - reject short ahash digests during - instance creation - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: cryptodev - -commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 -Author: Yucheng Lu -Date: Wed Apr 22 21:45:04 2026 +0800 - - crypto: authencesn - reject short ahash digests during instance creation - - authencesn requires either a zero authsize or an authsize of at least - 4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of - high-order sequence number data at the end of the authenticated data. - - While crypto_authenc_esn_setauthsize() already rejects explicit - non-zero authsizes in the range 1..3, crypto_authenc_esn_create() - still copied auth->digestsize into inst->alg.maxauthsize without - validating it. The AEAD core then initialized the tfm's default - authsize from that value. - - As a result, selecting an ahash with digest size 1..3, such as - cbcmac(cipher_null), exposed authencesn instances whose default - authsize was invalid even though setauthsize() would have rejected the - same value. AF_ALG could then trigger the ESN tail handling with a - too-short tag and hit an out-of-bounds access. - - Reject authencesn instances whose ahash digest size is in the invalid - non-zero range 1..3 so that no tfm can inherit an unsupported default - authsize. - - Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver") - Cc: stable@kernel.org - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Tested-by: Yuhang Zheng - Reviewed-by: Eric Biggers - Signed-off-by: Yucheng Lu - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 9a586b0b7716..b0f40fe03b56 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -444,6 +444,11 @@ static int crypto_authenc_esn_create(struct crypto_template *tmpl, - auth = crypto_spawn_ahash_alg(&ctx->auth); - auth_base = &auth->base; - -+ if (auth->digestsize > 0 && auth->digestsize < 4) { -+ err = -EINVAL; -+ goto err_free_inst; -+ } -+ - err = crypto_grab_skcipher(&ctx->enc, aead_crypto_instance(inst), - crypto_attr_alg_name(tb[2]), 0, mask); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1186-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch b/SOURCES/1186-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch deleted file mode 100644 index 464df0250..000000000 --- a/SOURCES/1186-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 834916d950469022e266fb8667df2c17af47df94 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Fri, 1 May 2026 21:56:44 +0800 -Subject: [PATCH] crypto: algif_aead - Fix minimum RX size check for decryption - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: 3d14bd48e3a77091cbce637a12c2ae31b4a1687c - -commit 3d14bd48e3a77091cbce637a12c2ae31b4a1687c -Author: Herbert Xu -Date: Sun Apr 12 13:32:21 2026 +0800 - - crypto: algif_aead - Fix minimum RX size check for decryption - - The check for the minimum receive buffer size did not take the - tag size into account during decryption. Fix this by adding the - required extra length. - - Reported-by: syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com - Reported-by: Daniel Pouzzner - Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 4a6a0bb1ae3c..029f1bd72fd7 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -169,7 +169,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - if (usedpages < outlen) { - size_t less = outlen - usedpages; - -- if (used < less) { -+ if (used < less + (ctx->enc ? 0 : as)) { - err = -EINVAL; - goto free; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1187-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch b/SOURCES/1187-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch deleted file mode 100644 index cb9115ded..000000000 --- a/SOURCES/1187-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 39335f1f582fbe7006ab1d9c83f0957324ad0367 Mon Sep 17 00:00:00 2001 -From: Herbert Xu -Date: Thu, 30 Apr 2026 20:03:29 +0800 -Subject: [PATCH] crypto: algif_aead - snapshot IV for async AEAD requests - -JIRA: https://redhat.atlassian.net/browse/RHEL-172207 - -Upstream Status: 5aa58c3a572b3e3b6c786953339f7978b845cc52 - -commit 5aa58c3a572b3e3b6c786953339f7978b845cc52 -Author: Douya Le -Date: Sun Apr 19 16:52:59 2026 +0800 - - crypto: algif_aead - snapshot IV for async AEAD requests - - AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during - request processing. For async requests, later socket activity can - update that shared state before the original request has fully - completed, which can lead to inconsistent IV handling. - - Snapshot the IV into per-request storage when preparing the AEAD - request, so in-flight operations no longer depend on mutable socket - state. - - Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management") - Cc: stable@kernel.org - Reported-by: Yuan Tan - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Reported-by: Xin Liu - Co-developed-by: Luxing Yin - Signed-off-by: Luxing Yin - Tested-by: Yucheng Lu - Signed-off-by: Douya Le - Signed-off-by: Ren Wei - Signed-off-by: Herbert Xu - -Signed-off-by: Herbert Xu - -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 029f1bd72fd7..9b589ab1af20 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -97,8 +97,10 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - struct crypto_aead *tfm = aeadc->aead; - struct crypto_sync_skcipher *null_tfm = aeadc->null_tfm; - unsigned int as = crypto_aead_authsize(tfm); -+ unsigned int ivsize = crypto_aead_ivsize(tfm); - struct af_alg_async_req *areq; - struct scatterlist *rsgl_src, *tsgl_src = NULL; -+ void *iv; - int err = 0; - size_t used = 0; /* [in] TX bufs to be en/decrypted */ - size_t outlen = 0; /* [out] RX bufs produced by kernel */ -@@ -150,10 +152,14 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - - /* Allocate cipher request for current operation. */ - areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) + -- crypto_aead_reqsize(tfm)); -+ crypto_aead_reqsize(tfm) + ivsize); - if (IS_ERR(areq)) - return PTR_ERR(areq); - -+ iv = (u8 *)aead_request_ctx(&areq->cra_u.aead_req) + -+ crypto_aead_reqsize(tfm); -+ memcpy(iv, ctx->iv, ivsize); -+ - /* convert iovecs of output buffers into RX SGL */ - err = af_alg_get_rsgl(sk, msg, flags, areq, outlen, &usedpages); - if (err) -@@ -215,7 +221,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg, - - /* Initialize the crypto operation */ - aead_request_set_crypt(&areq->cra_u.aead_req, tsgl_src, -- areq->first_rsgl.sgl.sg, used, ctx->iv); -+ areq->first_rsgl.sgl.sg, used, iv); - aead_request_set_ad(&areq->cra_u.aead_req, ctx->aead_assoclen); - aead_request_set_tfm(&areq->cra_u.aead_req, tfm); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1188-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch b/SOURCES/1188-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch deleted file mode 100644 index 097279b54..000000000 --- a/SOURCES/1188-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 52a21cfbdbc63d33544aafaa89e3ac9571268065 Mon Sep 17 00:00:00 2001 -From: Sabrina Dubroca -Date: Fri, 8 May 2026 00:56:43 +0200 -Subject: [PATCH] xfrm: esp: avoid in-place decrypt on shared skb frags - -JIRA: https://redhat.atlassian.net/browse/RHEL-174565 -CVE: CVE-2026-43284 -Conflicts: rhel9 doesn't use MSG_SPLICE_PAGES in - sendmsg/ip_append_data - patch udp_sendpage/ip_append_page instead - nothing to do for ipv6, no .sendpage for UDP there - -commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 -Author: Kuan-Ting Chen -Date: Mon May 4 23:27:12 2026 +0800 - - xfrm: esp: avoid in-place decrypt on shared skb frags - - MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP - marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), - so later paths that may modify packet data can first make a private - copy. The IPv4/IPv6 datagram append paths did not set this flag when - splicing pages into UDP skbs. - - That leaves an ESP-in-UDP packet made from shared pipe pages looking - like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW - fast path for uncloned skbs without a frag_list and decrypts in place - over data that is not owned privately by the skb. - - Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching - TCP. Also make ESP input fall back to skb_cow_data() when the flag is - present, so ESP does not decrypt externally backed frags in place. - Private nonlinear skb frags still use the existing fast path. - - This intentionally does not change ESP output. In esp_output_head(), - the path that appends the ESP trailer to existing skb tailroom without - calling skb_cow_data() is not reachable for nonlinear skbs: - skb_tailroom() returns zero when skb->data_len is nonzero, while ESP - tailen is positive. Thus ESP output will either use the separate - destination-frag path or fall back to skb_cow_data(). - - Fixes: cac2661c53f3 ("esp4: Avoid skb_cow_data whenever possible") - Fixes: 03e2a30f6a27 ("esp6: Avoid skb_cow_data whenever possible") - Fixes: 7da0dde68486 ("ip, udp: Support MSG_SPLICE_PAGES") - Fixes: 6d8192bd69bb ("ip6, udp6: Support MSG_SPLICE_PAGES") - Reported-by: Hyunwoo Kim - Reported-by: Kuan-Ting Chen - Tested-by: Hyunwoo Kim - Cc: stable@vger.kernel.org - Signed-off-by: Kuan-Ting Chen - Signed-off-by: Steffen Klassert - -Signed-off-by: Sabrina Dubroca - -diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c -index 4d07a51fa9a0..8ff8489bbf37 100644 ---- a/net/ipv4/esp4.c -+++ b/net/ipv4/esp4.c -@@ -881,7 +881,8 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index ec48d434acca..9c000e0ceb39 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -1480,6 +1480,9 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, - goto error; - } - -+ if (!(flags & MSG_NO_SHARED_FRAGS)) -+ skb_shinfo(skb)->flags |= SKBFL_SHARED_FRAG; -+ - if (skb->ip_summed == CHECKSUM_NONE) { - __wsum csum; - csum = csum_page(page, offset, len); -diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c -index 07565986cf82..7e17e9e1a33b 100644 ---- a/net/ipv6/esp6.c -+++ b/net/ipv6/esp6.c -@@ -921,7 +921,8 @@ static int esp6_input(struct xfrm_state *x, struct sk_buff *skb) - nfrags = 1; - - goto skip_cow; -- } else if (!skb_has_frag_list(skb)) { -+ } else if (!skb_has_frag_list(skb) && -+ !skb_has_shared_frag(skb)) { - nfrags = skb_shinfo(skb)->nr_frags; - nfrags++; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1189-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch b/SOURCES/1189-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch deleted file mode 100644 index f0bdee0a7..000000000 --- a/SOURCES/1189-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch +++ /dev/null @@ -1,65 +0,0 @@ -From a535a9217ca3f2fccedaafb2fddb4c48f27d36dc Mon Sep 17 00:00:00 2001 -From: Samuel Page -Date: Wed, 8 Apr 2026 15:30:13 +0100 -Subject: [PATCH] can: raw: fix ro->uniq use-after-free in raw_rcv() - -raw_release() unregisters raw CAN receive filters via can_rx_unregister(), -but receiver deletion is deferred with call_rcu(). This leaves a window -where raw_rcv() may still be running in an RCU read-side critical section -after raw_release() frees ro->uniq, leading to a use-after-free of the -percpu uniq storage. - -Move free_percpu(ro->uniq) out of raw_release() and into a raw-specific -socket destructor. can_rx_unregister() takes an extra reference to the -socket and only drops it from the RCU callback, so freeing uniq from -sk_destruct ensures the percpu area is not released until the relevant -callbacks have drained. - -Fixes: 514ac99c64b2 ("can: fix multiple delivery of a single CAN frame for overlapping CAN filters") -Cc: stable@vger.kernel.org # v4.1+ -Assisted-by: Bynario AI -Signed-off-by: Samuel Page -Link: https://patch.msgid.link/26ec626d-cae7-4418-9782-7198864d070c@bynar.io -Acked-by: Oliver Hartkopp -[mkl: applied manually] -Signed-off-by: Marc Kleine-Budde - -diff --git a/net/can/raw.c b/net/can/raw.c -index eee244ffc31e..58a96e933deb 100644 ---- a/net/can/raw.c -+++ b/net/can/raw.c -@@ -361,6 +361,14 @@ static int raw_notifier(struct notifier_block *nb, unsigned long msg, - return NOTIFY_DONE; - } - -+static void raw_sock_destruct(struct sock *sk) -+{ -+ struct raw_sock *ro = raw_sk(sk); -+ -+ free_percpu(ro->uniq); -+ can_sock_destruct(sk); -+} -+ - static int raw_init(struct sock *sk) - { - struct raw_sock *ro = raw_sk(sk); -@@ -387,6 +395,8 @@ static int raw_init(struct sock *sk) - if (unlikely(!ro->uniq)) - return -ENOMEM; - -+ sk->sk_destruct = raw_sock_destruct; -+ - /* set notifier */ - spin_lock(&raw_notifier_lock); - list_add_tail(&ro->notifier, &raw_notifier_list); -@@ -436,7 +446,6 @@ static int raw_release(struct socket *sock) - ro->bound = 0; - ro->dev = NULL; - ro->count = 0; -- free_percpu(ro->uniq); - - sock_orphan(sk); - sock->sk = NULL; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1190-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch b/SOURCES/1190-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch deleted file mode 100644 index ef60ed7c9..000000000 --- a/SOURCES/1190-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 98551d7729dace772c045e8696df06ba532d4088 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 11:39:45 +0000 -Subject: [PATCH] usbip: validate number_of_packets in usbip_pack_ret_submit() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171433 -CVE: CVE-2026-31607 - -commit 2ab833a16a825373aad2ba7d54b572b277e95b71 -Author: Nathan Rebello -Date: Thu Apr 2 04:52:59 2026 -0400 - - usbip: validate number_of_packets in usbip_pack_ret_submit() - - When a USB/IP client receives a RET_SUBMIT response, - usbip_pack_ret_submit() unconditionally overwrites - urb->number_of_packets from the network PDU. This value is - subsequently used as the loop bound in usbip_recv_iso() and - usbip_pad_iso() to iterate over urb->iso_frame_desc[], a flexible - array whose size was fixed at URB allocation time based on the - *original* number_of_packets from the CMD_SUBMIT. - - A malicious USB/IP server can set number_of_packets in the response - to a value larger than what was originally submitted, causing a heap - out-of-bounds write when usbip_recv_iso() writes to - urb->iso_frame_desc[i] beyond the allocated region. - - KASAN confirmed this with kernel 7.0.0-rc5: - - BUG: KASAN: slab-out-of-bounds in usbip_recv_iso+0x46a/0x640 - Write of size 4 at addr ffff888106351d40 by task vhci_rx/69 - - The buggy address is located 0 bytes to the right of - allocated 320-byte region [ffff888106351c00, ffff888106351d40) - - The server side (stub_rx.c) and gadget side (vudc_rx.c) already - validate number_of_packets in the CMD_SUBMIT path since commits - c6688ef9f297 ("usbip: fix stub_rx: harden CMD_SUBMIT path to handle - malicious input") and b78d830f0049 ("usbip: fix vudc_rx: harden - CMD_SUBMIT path to handle malicious input"). The server side validates - against USBIP_MAX_ISO_PACKETS because no URB exists yet at that point. - On the client side we have the original URB, so we can use the tighter - bound: the response must not exceed the original number_of_packets. - - This mirrors the existing validation of actual_length against - transfer_buffer_length in usbip_recv_xbuff(), which checks the - response value against the original allocation size. - - Kelvin Mbogo's series ("usb: usbip: fix integer overflow in - usbip_recv_iso()", v2) hardens the receive-side functions themselves; - this patch complements that work by catching the bad value at its - source -- in usbip_pack_ret_submit() before the overwrite -- and - using the tighter per-URB allocation bound rather than the global - USBIP_MAX_ISO_PACKETS limit. - - Fix this by checking rpdu->number_of_packets against - urb->number_of_packets in usbip_pack_ret_submit() before the - overwrite. On violation, clamp to zero so that usbip_recv_iso() and - usbip_pad_iso() safely return early. - - Fixes: 1325f85fa49f ("staging: usbip: bugfix add number of packets for isochronous frames") - Cc: stable - Acked-by: Shuah Khan - Signed-off-by: Nathan Rebello - Link: https://patch.msgid.link/20260402085259.234-1-nathan.c.rebello@gmail.com - Signed-off-by: Greg Kroah-Hartman - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index a2b2da1255dd..ba9e7c616e12 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -470,6 +470,18 @@ static void usbip_pack_ret_submit(struct usbip_header *pdu, struct urb *urb, - urb->status = rpdu->status; - urb->actual_length = rpdu->actual_length; - urb->start_frame = rpdu->start_frame; -+ /* -+ * The number_of_packets field determines the length of -+ * iso_frame_desc[], which is a flexible array allocated -+ * at URB creation time. A response must never claim more -+ * packets than originally submitted; doing so would cause -+ * an out-of-bounds write in usbip_recv_iso() and -+ * usbip_pad_iso(). Clamp to zero on violation so both -+ * functions safely return early. -+ */ -+ if (rpdu->number_of_packets < 0 || -+ rpdu->number_of_packets > urb->number_of_packets) -+ rpdu->number_of_packets = 0; - urb->number_of_packets = rpdu->number_of_packets; - urb->error_count = rpdu->error_count; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1191-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch b/SOURCES/1191-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch deleted file mode 100644 index 38380d3dd..000000000 --- a/SOURCES/1191-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 31e26e3f09482329fb7f0fcf3893ed2dbb4e231a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 28 Apr 2026 13:24:19 -0400 -Subject: [PATCH] RDMA/umem: Fix double dma_buf_unpin in failure path - -JIRA: https://redhat.atlassian.net/browse/RHEL-163491 - -commit 104016eb671e19709721c1b0048dd912dc2e96be -Author: Jacob Moroni -Date: Tue Feb 24 23:41:53 2026 +0000 - - RDMA/umem: Fix double dma_buf_unpin in failure path - - In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to - ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf - is immediately unpinned but the umem_dmabuf->pinned flag is still - set. Then, when ib_umem_release() is called, it calls - ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. - - Fix this by removing the immediate unpin upon failure and just let - the ib_umem_release/revoke path handle it. This also ensures the - proper unmap-unpin unwind ordering if the dmabuf_map_pages call - happened to fail due to dma_resv_wait_timeout (and therefore has - a non-NULL umem_dmabuf->sgt). - - Fixes: 1e4df4a21c5a ("RDMA/umem: Allow pinned dmabuf umem usage") - Signed-off-by: Jacob Moroni - Link: https://patch.msgid.link/20260224234153.1207849-1-jmoroni@google.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/core/umem_dmabuf.c b/drivers/infiniband/core/umem_dmabuf.c -index 2023a735de20..8d6430278000 100644 ---- a/drivers/infiniband/core/umem_dmabuf.c -+++ b/drivers/infiniband/core/umem_dmabuf.c -@@ -220,13 +220,11 @@ ib_umem_dmabuf_get_pinned_with_dma_device(struct ib_device *device, - - err = ib_umem_dmabuf_map_pages(umem_dmabuf); - if (err) -- goto err_unpin; -+ goto err_release; - dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); - - return umem_dmabuf; - --err_unpin: -- dma_buf_unpin(umem_dmabuf->attach); - err_release: - dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); - ib_umem_release(&umem_dmabuf->umem); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1192-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch b/SOURCES/1192-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch deleted file mode 100644 index b1af1d9aa..000000000 --- a/SOURCES/1192-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 43ed28eec61843c0cc821683028c70c9419a7b40 Mon Sep 17 00:00:00 2001 -From: Nigel Croxon -Date: Mon, 16 Feb 2026 13:50:16 -0500 -Subject: [PATCH] md/bitmap: fix GPF in write_page caused by resize race - -JIRA: https://issues.redhat.com/browse/RHEL-129338 - -commit 46ef85f854dfa9d5226b3c1c46493d79556c9589 -Author: Jack Wang -Date: Tue Jan 20 11:24:56 2026 +0100 - - md/bitmap: fix GPF in write_page caused by resize race - - A General Protection Fault occurs in write_page() during array resize: - RIP: 0010:write_page+0x22b/0x3c0 [md_mod] - - This is a use-after-free race between bitmap_daemon_work() and - __bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` - without locking, while the resize path frees that storage via - md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, - allowing concurrent access to freed pages. - - Fix by holding `mddev->bitmap_info.mutex` during the bitmap update. - - Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com - Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u - Cc: stable@vger.kernel.org - Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.") - Signed-off-by: Jack Wang - Signed-off-by: Yu Kuai - -Signed-off-by: Nigel Croxon - -diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c -index 6280bae60526..3b86909a411e 100644 ---- a/drivers/md/md-bitmap.c -+++ b/drivers/md/md-bitmap.c -@@ -2453,6 +2453,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, - memcpy(page_address(store.sb_page), - page_address(bitmap->storage.sb_page), - sizeof(bitmap_super_t)); -+ mutex_lock(&bitmap->mddev->bitmap_info.mutex); - spin_lock_irq(&bitmap->counts.lock); - md_bitmap_file_unmap(&bitmap->storage); - bitmap->storage = store; -@@ -2560,7 +2561,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, - set_page_attr(bitmap, i, BITMAP_PAGE_DIRTY); - } - spin_unlock_irq(&bitmap->counts.lock); -- -+ mutex_unlock(&bitmap->mddev->bitmap_info.mutex); - if (!init) { - __bitmap_unplug(bitmap); - bitmap->mddev->pers->quiesce(bitmap->mddev, 0); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1193-ptrace-slightly-saner-get-dumpable-logic.patch b/SOURCES/1193-ptrace-slightly-saner-get-dumpable-logic.patch deleted file mode 100644 index a92c1449f..000000000 --- a/SOURCES/1193-ptrace-slightly-saner-get-dumpable-logic.patch +++ /dev/null @@ -1,122 +0,0 @@ -From bb79c39164a6539d01cfa3151a81da5be998840f Mon Sep 17 00:00:00 2001 -From: Ricardo Robaina -Date: Fri, 15 May 2026 10:20:50 -0300 -Subject: [PATCH] ptrace: slightly saner 'get_dumpable()' logic - -JIRA: https://issues.redhat.com/browse/RHEL-176447 -CVE: CVE-2026-46333 - -Conflicts: - - Minor context conflict due to missing upstream commit - 90383cc07895 ("exec: Distinguish in_execve from in_exec") - -commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a -Author: Linus Torvalds -Date: Wed May 13 11:37:18 2026 -0700 - - ptrace: slightly saner 'get_dumpable()' logic - - The 'dumpability' of a task is fundamentally about the memory image of - the task - the concept comes from whether it can core dump or not - and - makes no sense when you don't have an associated mm. - - And almost all users do in fact use it only for the case where the task - has a mm pointer. - - But we have one odd special case: ptrace_may_access() uses 'dumpable' to - check various other things entirely independently of the MM (typically - explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for - threads that no longer have a VM (and maybe never did, like most kernel - threads). - - It's not what this flag was designed for, but it is what it is. - - The ptrace code does check that the uid/gid matches, so you do have to - be uid-0 to see kernel thread details, but this means that the - traditional "drop capabilities" model doesn't make any difference for - this all. - - Make it all make a *bit* more sense by saying that if you don't have a - MM pointer, we'll use a cached "last dumpability" flag if the thread - ever had a MM (it will be zero for kernel threads since it is never - set), and require a proper CAP_SYS_PTRACE capability to override. - - Reported-by: Qualys Security Advisory - Cc: Oleg Nesterov - Cc: Kees Cook - Signed-off-by: Linus Torvalds - -Signed-off-by: Ricardo Robaina - - - -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 066ab5f..0ecc266 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -936,6 +936,9 @@ struct task_struct { - unsigned sched_migrated:1; - unsigned sched_task_hot:1; - -+ /* Save user-dumpable when mm goes away */ -+ RH_KABI_FILL_HOLE(unsigned user_dumpable:1) -+ - /* Force alignment to the next boundary: */ - unsigned :0; - -diff --git a/kernel/exit.c b/kernel/exit.c -index 8782a6b..aa08b46 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -534,6 +534,7 @@ static void exit_mm(void) - */ - smp_mb__after_spinlock(); - local_irq_disable(); -+ current->user_dumpable = (get_dumpable(mm) == SUID_DUMP_USER); - current->mm = NULL; - membarrier_update_current_mm(NULL); - enter_lazy_tlb(mm, current); -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index a0fd4bd..495fde1 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -282,11 +282,24 @@ static bool ptrace_has_cap(struct user_namespace *ns, unsigned int mode) - return ns_capable(ns, CAP_SYS_PTRACE); - } - -+static bool task_still_dumpable(struct task_struct *task, unsigned int mode) -+{ -+ struct mm_struct *mm = task->mm; -+ if (mm) { -+ if (get_dumpable(mm) == SUID_DUMP_USER) -+ return true; -+ return ptrace_has_cap(mm->user_ns, mode); -+ } -+ -+ if (task->user_dumpable) -+ return true; -+ return ptrace_has_cap(&init_user_ns, mode); -+} -+ - /* Returns 0 on success, -errno on denial. */ - static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - { - const struct cred *cred = current_cred(), *tcred; -- struct mm_struct *mm; - kuid_t caller_uid; - kgid_t caller_gid; - -@@ -347,11 +360,8 @@ static int __ptrace_may_access(struct task_struct *task, unsigned int mode) - * Pairs with a write barrier in commit_creds(). - */ - smp_rmb(); -- mm = task->mm; -- if (mm && -- ((get_dumpable(mm) != SUID_DUMP_USER) && -- !ptrace_has_cap(mm->user_ns, mode))) -- return -EPERM; -+ if (!task_still_dumpable(task, mode)) -+ return -EPERM; - - return security_ptrace_access_check(task, mode); - } diff --git a/SOURCES/1194-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch b/SOURCES/1194-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch deleted file mode 100644 index 5c08a0e32..000000000 --- a/SOURCES/1194-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch +++ /dev/null @@ -1,45 +0,0 @@ -From f84eca5817390257cef78013d0112481c503b4a3 Mon Sep 17 00:00:00 2001 -From: William Bowling -Date: Wed, 13 May 2026 04:16:35 +0000 -Subject: [PATCH] net: skbuff: preserve shared-frag marker during coalescing - -skb_try_coalesce() can attach paged frags from @from to @to. If @from -has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same -externally-owned or page-cache-backed frags, but the shared-frag marker -is currently lost. - -That breaks the invariant relied on by later in-place writers. In -particular, ESP input checks skb_has_shared_frag() before deciding -whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP -receive coalescing has moved shared frags into an unmarked skb, ESP can -see skb_has_shared_frag() as false and decrypt in place over page-cache -backed frags. - -Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged -frags. The tailroom copy path does not need the marker because it copies -bytes into @to's linear data rather than transferring frag descriptors. - -Fixes: cef401de7be8 ("net: fix possible wrong checksum generation") -Fixes: f4c50a4034e6 ("xfrm: esp: avoid in-place decrypt on shared skb frags") -Signed-off-by: William Bowling -Reviewed-by: Eric Dumazet -Tested-by: Jiayuan Chen -Link: https://patch.msgid.link/20260513041635.1289541-1-vakzz@zellic.io -Signed-off-by: Jakub Kicinski - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 7dad68e3b518..9c4e8d331d6d 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -6200,6 +6200,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, - from_shinfo->frags, - from_shinfo->nr_frags * sizeof(skb_frag_t)); - to_shinfo->nr_frags += from_shinfo->nr_frags; -+ if (from_shinfo->nr_frags) -+ to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG; - - if (!skb_cloned(from)) - from_shinfo->nr_frags = 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1195-net-move-skb-gro-receive-list-from-udp-to-core.patch b/SOURCES/1195-net-move-skb-gro-receive-list-from-udp-to-core.patch deleted file mode 100644 index d4deec6b3..000000000 --- a/SOURCES/1195-net-move-skb-gro-receive-list-from-udp-to-core.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 8928756d53d5b99dcd18073dc7738b8ebdbe7d96 Mon Sep 17 00:00:00 2001 -From: Felix Fietkau -Date: Thu, 2 May 2024 10:44:42 +0200 -Subject: [PATCH] net: move skb_gro_receive_list from udp to core - -This helper function will be used for TCP fraglist GRO support - -Acked-by: Paolo Abeni -Reviewed-by: Eric Dumazet -Signed-off-by: Felix Fietkau -Reviewed-by: David Ahern -Reviewed-by: Willem de Bruijn -Signed-off-by: Paolo Abeni - -diff --git a/include/net/gro.h b/include/net/gro.h -index c1d4ca0463a1..5df8bf318197 100644 ---- a/include/net/gro.h -+++ b/include/net/gro.h -@@ -438,6 +438,7 @@ static inline __wsum ip6_gro_compute_pseudo(const struct sk_buff *skb, - } - - int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb); -+int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb); - - /* Pass the currently batched GRO_NORMAL SKBs up to the stack. */ - static inline void gro_normal_list(struct napi_struct *napi) -diff --git a/net/core/gro.c b/net/core/gro.c -index 99a45a5211c9..e2f84947fb74 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -231,6 +231,33 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) - return 0; - } - -+int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) -+{ -+ if (unlikely(p->len + skb->len >= 65536)) -+ return -E2BIG; -+ -+ if (NAPI_GRO_CB(p)->last == p) -+ skb_shinfo(p)->frag_list = skb; -+ else -+ NAPI_GRO_CB(p)->last->next = skb; -+ -+ skb_pull(skb, skb_gro_offset(skb)); -+ -+ NAPI_GRO_CB(p)->last = skb; -+ NAPI_GRO_CB(p)->count++; -+ p->data_len += skb->len; -+ -+ /* sk ownership - if any - completely transferred to the aggregated packet */ -+ skb->destructor = NULL; -+ skb->sk = NULL; -+ p->truesize += skb->truesize; -+ p->len += skb->len; -+ -+ NAPI_GRO_CB(skb)->same_flow = 1; -+ -+ return 0; -+} -+ - - static void napi_gro_complete(struct napi_struct *napi, struct sk_buff *skb) - { -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 8721fe5beca2..f6d3c442e260 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -433,33 +433,6 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, - return segs; - } - --static int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) --{ -- if (unlikely(p->len + skb->len >= 65536)) -- return -E2BIG; -- -- if (NAPI_GRO_CB(p)->last == p) -- skb_shinfo(p)->frag_list = skb; -- else -- NAPI_GRO_CB(p)->last->next = skb; -- -- skb_pull(skb, skb_gro_offset(skb)); -- -- NAPI_GRO_CB(p)->last = skb; -- NAPI_GRO_CB(p)->count++; -- p->data_len += skb->len; -- -- /* sk ownership - if any - completely transferred to the aggregated packet */ -- skb->destructor = NULL; -- skb->sk = NULL; -- p->truesize += skb->truesize; -- p->len += skb->len; -- -- NAPI_GRO_CB(skb)->same_flow = 1; -- -- return 0; --} -- - - #define UDP_GRO_CNT_MAX 64 - static struct sk_buff *udp_gro_receive_segment(struct list_head *head, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1196-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch b/SOURCES/1196-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch deleted file mode 100644 index 1cc4b60b9..000000000 --- a/SOURCES/1196-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch +++ /dev/null @@ -1,68 +0,0 @@ - -diff --git a/net/core/gro.c b/net/core/gro.c -index 29a2531..a1b6fae 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -222,10 +222,12 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) - p->data_len += len; - p->truesize += delta_truesize; - p->len += len; -+ skb_shinfo(p)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; - if (lp != p) { - lp->data_len += len; - lp->truesize += delta_truesize; - lp->len += len; -+ skb_shinfo(lp)->flags |= skbinfo->flags & SKBFL_SHARED_FRAG; - } - NAPI_GRO_CB(skb)->same_flow = 1; - return 0; -@@ -253,6 +255,8 @@ int skb_gro_receive_list(struct sk_buff *p, struct sk_buff *skb) - p->truesize += skb->truesize; - p->len += skb->len; - -+ skb_shinfo(p)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; -+ - NAPI_GRO_CB(skb)->same_flow = 1; - - return 0; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 98cfb8f..799c2e8 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -2027,6 +2027,7 @@ struct sk_buff *__pskb_copy_fclone(struct sk_buff *skb, int headroom, - skb_frag_ref(skb, i); - } - skb_shinfo(n)->nr_frags = i; -+ skb_shinfo(n)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; - } - - if (skb_has_frag_list(skb)) { -@@ -4029,6 +4030,8 @@ int skb_shift(struct sk_buff *tgt, struct sk_buff *skb, int shiftlen) - tgt->ip_summed = CHECKSUM_PARTIAL; - skb->ip_summed = CHECKSUM_PARTIAL; - -+ skb_shinfo(tgt)->flags |= skb_shinfo(skb)->flags & SKBFL_SHARED_FRAG; -+ - /* Yak, is it really working this way? Some helper please? */ - skb->len -= shiftlen; - skb->data_len -= shiftlen; -@@ -4604,7 +4607,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, - skb_copy_from_linear_data_offset(head_skb, offset, - skb_put(nskb, hsize), hsize); - -- skb_shinfo(nskb)->flags |= skb_shinfo(head_skb)->flags & -+ skb_shinfo(nskb)->flags |= (skb_shinfo(head_skb)->flags | -+ skb_shinfo(frag_skb)->flags) & - SKBFL_SHARED_FRAG; - - if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC)) -@@ -4621,6 +4625,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, - nfrags = skb_shinfo(list_skb)->nr_frags; - frag = skb_shinfo(list_skb)->frags; - frag_skb = list_skb; -+ -+ skb_shinfo(nskb)->flags |= skb_shinfo(frag_skb)->flags & SKBFL_SHARED_FRAG; -+ - if (!skb_headlen(list_skb)) { - BUG_ON(!nfrags); - } else { diff --git a/SOURCES/1197-smb-client-reject-userspace-cifs.spnego-descriptions.patch b/SOURCES/1197-smb-client-reject-userspace-cifs.spnego-descriptions.patch deleted file mode 100644 index 4fbab3c28..000000000 --- a/SOURCES/1197-smb-client-reject-userspace-cifs.spnego-descriptions.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 3da1fdf4efbc490041eb4f836bf596201203f8f2 Mon Sep 17 00:00:00 2001 -From: Asim Viladi Oglu Manizada -Date: Sat, 16 May 2026 21:15:39 +0000 -Subject: smb: client: reject userspace cifs.spnego descriptions - -cifs.spnego key descriptions contain authority-bearing fields such as -pid, uid, creduid, and upcall_target that cifs.upcall treats as -kernel-originating inputs. However, userspace can also create keys of -this type through request_key(2) or add_key(2), allowing those fields to -be supplied without CIFS origin. - -Only accept cifs.spnego descriptions while CIFS is using its private -spnego_cred to request the key. - -Fixes: f1d662a7d5e5 ("[CIFS] Add upcall files for cifs to use spnego/kerberos") -Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix -Reviewed-by: David Howells -Signed-off-by: Asim Viladi Oglu Manizada -Signed-off-by: Steve French ---- - fs/smb/client/cifs_spnego.c | 16 ++++++++++++++++ - 1 file changed, 16 insertions(+) - -diff --git a/fs/smb/client/cifs_spnego.c b/fs/smb/client/cifs_spnego.c -index 3a41bbada04c76..44c40727568042 100644 ---- a/fs/smb/client/cifs_spnego.c -+++ b/fs/smb/client/cifs_spnego.c -@@ -8,6 +8,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -40,12 +41,27 @@ cifs_spnego_key_destroy(struct key *key) - kfree(key->payload.data[0]); - } - -+static int -+cifs_spnego_key_vet_description(const char *description) -+{ -+ /* -+ * cifs.spnego descriptions are authority-bearing inputs to cifs.upcall. -+ * They are only valid when produced by CIFS while using the private -+ * spnego_cred installed below. Do not let userspace create this type -+ * of key through request_key(2)/add_key(2), since the helper treats -+ * pid/uid/creduid/upcall_target as kernel-originating fields. -+ */ -+ if (current_cred() != spnego_cred) -+ return -EPERM; -+ return 0; -+} - - /* - * keytype for CIFS spnego keys - */ - struct key_type cifs_spnego_key_type = { - .name = "cifs.spnego", -+ .vet_description = cifs_spnego_key_vet_description, - .instantiate = cifs_spnego_key_instantiate, - .destroy = cifs_spnego_key_destroy, - .describe = user_describe, --- -cgit 1.3-korg - diff --git a/SOURCES/1198-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch b/SOURCES/1198-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch deleted file mode 100644 index d8bd60438..000000000 --- a/SOURCES/1198-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch +++ /dev/null @@ -1,41 +0,0 @@ -From d73f4b53aaaea4c95f245e491aa5eeb8a21874ce Mon Sep 17 00:00:00 2001 -From: Pablo Neira Ayuso -Date: Tue, 17 Mar 2026 20:00:26 +0100 -Subject: [PATCH] netfilter: nf_tables: release flowtable after rcu grace - period on error - -Call synchronize_rcu() after unregistering the hooks from error path, -since a hook that already refers to this flowtable can be already -registered, exposing this flowtable to packet path and nfnetlink_hook -control plane. - -This error path is rare, it should only happen by reaching the maximum -number hooks or by failing to set up to hardware offload, just call -synchronize_rcu(). - -There is a check for already used device hooks by different flowtable -that could result in EEXIST at this late stage. The hook parser can be -updated to perform this check earlier to this error path really becomes -rarely exercised. - -Uncovered by KASAN reported as use-after-free from nfnetlink_hook path -when dumping hooks. - -Fixes: 3b49e2e94e6e ("netfilter: nf_tables: add flow table netlink frontend") -Reported-by: Yiming Qian -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Florian Westphal - - -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 3193d8c..9b55eaa 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -8411,6 +8411,7 @@ static int nf_tables_newflowtable(struct sk_buff *skb, - return 0; - - err_flowtable_hooks: -+ synchronize_rcu(); - nft_trans_destroy(trans); - err_flowtable_trans: - nft_flowtable_hooks_destroy(&flowtable->hook_list); diff --git a/SOURCES/1199-revert-mm-pcp-increase-pcp-free-count-threshold-to-trigger-f.patch b/SOURCES/1199-revert-mm-pcp-increase-pcp-free-count-threshold-to-trigger-f.patch deleted file mode 100644 index ba60fde86..000000000 --- a/SOURCES/1199-revert-mm-pcp-increase-pcp-free-count-threshold-to-trigger-f.patch +++ /dev/null @@ -1,19 +0,0 @@ -From: AlmaLinux backport -Subject: [PATCH] Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" -# Revert of e1beaf0b7811188ccf1cf6df3fe6bf95c186873a - mm: pcp: increase pcp->free_count threshold to trigger free_high - - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 4e8615398f07..b0edd4934a16 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2476,7 +2476,7 @@ static void free_unref_page_commit(struct zone *zone, struct per_cpu_pages *pcp, - * stops will be drained from vmstat refresh context. - */ - if (order && order <= PAGE_ALLOC_COSTLY_ORDER) { -- free_high = (pcp->free_count >= (batch + pcp->high_min / 2) && -+ free_high = (pcp->free_count >= batch && - (pcp->flags & PCPF_PREV_FREE_HIGH_ORDER) && - (!(pcp->flags & PCPF_FREE_HIGH_BATCH) || - pcp->count >= batch)); diff --git a/SOURCES/1200-ice-fix-missing-tx-timestamps-interrupts-on-e825-devices.patch b/SOURCES/1200-ice-fix-missing-tx-timestamps-interrupts-on-e825-devices.patch deleted file mode 100644 index f8df58930..000000000 --- a/SOURCES/1200-ice-fix-missing-tx-timestamps-interrupts-on-e825-devices.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 99854c167cfc113ad863832b1601c4ca1a639cfe Mon Sep 17 00:00:00 2001 -From: Grzegorz Nitka -Date: Thu, 27 Nov 2025 10:25:58 +0100 -Subject: [PATCH] ice: fix missing TX timestamps interrupts on E825 devices - -Modify PTP (Precision Time Protocol) configuration on link down flow. -Previously, PHY_REG_TX_OFFSET_READY register was cleared in such case. -This register is used to determine if the timestamp is valid or not on -the hardware side. -However, there is a possibility that there is still the packet in the -HW queue which originally was supposed to be timestamped but the link -is already down and given register is cleared. -This potentially might lead to the situation in which that 'delayed' -packet's timestamp is treated as invalid one when the link is up -again. -This in turn leads to the situation in which the driver is not able to -effectively clean timestamp memory and interrupt configuration. -From the hardware perspective, that 'old' interrupt was not handled -properly and even if new timestamp packets are processed, no new -interrupts is generated. As a result, providing timestamps to the user -applications (like ptp4l) is not possible. -The solution for this problem is implemented at the driver level rather -than the firmware, and maintains the tx_ready bit high, even during -link down events. This avoids entering a potential inconsistent state -between the driver and the timestamp hardware. - -Testing hints: -- run PTP traffic at higher rate (like 16 PTP messages per second) -- observe ptp4l behaviour at the client side in the following - conditions: - a) trigger link toggle events. It needs to be physiscal - link down/up events - b) link speed change -In all above cases, PTP processing at ptp4l application should resume -always. In failure case, the following permanent error message in ptp4l -log was observed: -controller-0 ptp4l: err [6175.116] ptp4l-legacy timed out while polling - for tx timestamp - -Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") -Reviewed-by: Aleksandr Loktionov -Signed-off-by: Grzegorz Nitka -Tested-by: Sunitha Mekala (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c -index 4c8d20f2d2c0..0b7c2a13ab04 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c -@@ -1347,9 +1347,12 @@ void ice_ptp_link_change(struct ice_pf *pf, bool linkup) - /* Do not reconfigure E810 or E830 PHY */ - return; - case ICE_MAC_GENERIC: -- case ICE_MAC_GENERIC_3K_E825: - ice_ptp_port_phy_restart(ptp_port); - return; -+ case ICE_MAC_GENERIC_3K_E825: -+ if (linkup) -+ ice_ptp_port_phy_restart(ptp_port); -+ return; - default: - dev_warn(ice_pf_to_dev(pf), "%s: Unknown PHY type\n", __func__); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1201-ice-fix-ptp-timestamping-broken-by-synce-code-on-e825c.patch b/SOURCES/1201-ice-fix-ptp-timestamping-broken-by-synce-code-on-e825c.patch deleted file mode 100644 index 1dc874348..000000000 --- a/SOURCES/1201-ice-fix-ptp-timestamping-broken-by-synce-code-on-e825c.patch +++ /dev/null @@ -1,88 +0,0 @@ -From bf6dbadb72b997721e9b67348652926c076878d1 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Fri, 27 Mar 2026 08:46:58 +0100 -Subject: [PATCH] ice: fix PTP timestamping broken by SyncE code on E825C - -The E825C SyncE support added in commit ad1df4f2d591 ("ice: dpll: -Support E825-C SyncE and dynamic pin discovery") introduced a SyncE -reconfiguration block in ice_ptp_link_change() that prevents -ice_ptp_port_phy_restart() from being called in several error paths. -Without the PHY restart, PTP timestamps stop working after any link -change event. - -There are three ways the PHY restart gets blocked: - -1. When DPLL initialization fails (e.g. missing ACPI firmware node - properties), ICE_FLAG_DPLL is not set and the function returns early - before reaching the PHY restart. - -2. When ice_tspll_bypass_mux_active_e825c() fails to read the CGU - register, WARN_ON_ONCE fires and the function returns early. - -3. When ice_tspll_cfg_synce_ethdiv_e825c() fails to configure the - clock divider for an active pin, same early return. - -SyncE and PTP are independent features. SyncE reconfiguration failures -must not prevent the PTP PHY restart that is essential for timestamp -recovery after link changes. - -Fix by making the entire SyncE block conditional on ICE_FLAG_DPLL -without an early return, and replacing the WARN_ON_ONCE + return error -handling inside the loop with dev_err_once + break. The function always -proceeds to ice_ptp_port_phy_restart() regardless of SyncE errors. - -Fixes: ad1df4f2d591 ("ice: dpll: Support E825-C SyncE and dynamic pin discovery") -Signed-off-by: Petr Oros -Reviewed-by: Grzegorz Nitka -Reviewed-by: Aleksandr Loktionov -Tested-by: Sunitha Mekala (A Contingent worker at Intel) -Signed-off-by: Tony Nguyen - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c -index a3c5f0a5e09b..6cb0cf7a9891 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c -@@ -1296,12 +1296,10 @@ void ice_ptp_link_change(struct ice_pf *pf, bool linkup) - if (pf->hw.reset_ongoing) - return; - -- if (hw->mac_type == ICE_MAC_GENERIC_3K_E825) { -+ if (hw->mac_type == ICE_MAC_GENERIC_3K_E825 && -+ test_bit(ICE_FLAG_DPLL, pf->flags)) { - int pin, err; - -- if (!test_bit(ICE_FLAG_DPLL, pf->flags)) -- return; -- - mutex_lock(&pf->dplls.lock); - for (pin = 0; pin < ICE_SYNCE_CLK_NUM; pin++) { - enum ice_synce_clk clk_pin; -@@ -1314,15 +1312,19 @@ void ice_ptp_link_change(struct ice_pf *pf, bool linkup) - port_num, - &active, - clk_pin); -- if (WARN_ON_ONCE(err)) { -- mutex_unlock(&pf->dplls.lock); -- return; -+ if (err) { -+ dev_err_once(ice_pf_to_dev(pf), -+ "Failed to read SyncE bypass mux for pin %d, err %d\n", -+ pin, err); -+ break; - } - - err = ice_tspll_cfg_synce_ethdiv_e825c(hw, clk_pin); -- if (active && WARN_ON_ONCE(err)) { -- mutex_unlock(&pf->dplls.lock); -- return; -+ if (active && err) { -+ dev_err_once(ice_pf_to_dev(pf), -+ "Failed to configure SyncE ETH divider for pin %d, err %d\n", -+ pin, err); -+ break; - } - } - mutex_unlock(&pf->dplls.lock); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1202-i2c-i801-revert-i2c-i801-replace-acpi-lock-with-i2c-bus-lock.patch b/SOURCES/1202-i2c-i801-revert-i2c-i801-replace-acpi-lock-with-i2c-bus-lock.patch deleted file mode 100644 index e6982615b..000000000 --- a/SOURCES/1202-i2c-i801-revert-i2c-i801-replace-acpi-lock-with-i2c-bus-lock.patch +++ /dev/null @@ -1,168 +0,0 @@ -From b1dd99bdb35ac4c66c8d7ac288d963b2ad952b5b Mon Sep 17 00:00:00 2001 -From: David Arcari -Date: Mon, 9 Mar 2026 07:47:07 -0400 -Subject: [PATCH] i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus - lock" - -JIRA: https://issues.redhat.com/browse/RHEL-153431 -Conflicts: RHEL pm routines differ from upstream - -commit cfc69c2e6c699c96949f7b0455195b0bfb7dc715 -Author: Charles Haithcock -Date: Fri Feb 27 18:41:15 2026 -0700 - - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" - - This reverts commit f707d6b9e7c18f669adfdb443906d46cfbaaa0c1. - - Under rare circumstances, multiple udev threads can collect i801 device - info on boot and walk i801_acpi_io_handler somewhat concurrently. The - first will note the area is reserved by acpi to prevent further touches. - This ultimately causes the area to be deregistered. The second will - enter i801_acpi_io_handler after the area is unregistered but before a - check can be made that the area is unregistered. i2c_lock_bus relies on - the now unregistered area containing lock_ops to lock the bus. The end - result is a kernel panic on boot with the following backtrace; - - [ 14.971872] ioatdma 0000:09:00.2: enabling device (0100 -> 0102) - [ 14.971873] BUG: kernel NULL pointer dereference, address: 0000000000000000 - [ 14.971880] #PF: supervisor read access in kernel mode - [ 14.971884] #PF: error_code(0x0000) - not-present page - [ 14.971887] PGD 0 P4D 0 - [ 14.971894] Oops: 0000 [#1] PREEMPT SMP PTI - [ 14.971900] CPU: 5 PID: 956 Comm: systemd-udevd Not tainted 5.14.0-611.5.1.el9_7.x86_64 #1 - [ 14.971905] Hardware name: XXXXXXXXXXXXXXXXXXXXXXX BIOS 1.20.10.SV91 01/30/2023 - [ 14.971908] RIP: 0010:i801_acpi_io_handler+0x2d/0xb0 [i2c_i801] - [ 14.971929] Code: 00 00 49 8b 40 20 41 57 41 56 4d 8b b8 30 04 00 00 49 89 ce 41 55 41 89 d5 41 54 49 89 f4 be 02 00 00 00 55 4c 89 c5 53 89 fb <48> 8b 00 4c 89 c7 e8 18 61 54 e9 80 bd 80 04 00 00 00 75 09 4c 3b - [ 14.971933] RSP: 0018:ffffbaa841483838 EFLAGS: 00010282 - [ 14.971938] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff9685e01ba568 - [ 14.971941] RDX: 0000000000000008 RSI: 0000000000000002 RDI: 0000000000000000 - [ 14.971944] RBP: ffff9685ca22f028 R08: ffff9685ca22f028 R09: ffff9685ca22f028 - [ 14.971948] R10: 000000000000000b R11: 0000000000000580 R12: 0000000000000580 - [ 14.971951] R13: 0000000000000008 R14: ffff9685e01ba568 R15: ffff9685c222f000 - [ 14.971954] FS: 00007f8287c0ab40(0000) GS:ffff96a47f940000(0000) knlGS:0000000000000000 - [ 14.971959] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - [ 14.971963] CR2: 0000000000000000 CR3: 0000000168090001 CR4: 00000000003706f0 - [ 14.971966] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 - [ 14.971968] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 - [ 14.971972] Call Trace: - [ 14.971977] - [ 14.971981] ? show_trace_log_lvl+0x1c4/0x2df - [ 14.971994] ? show_trace_log_lvl+0x1c4/0x2df - [ 14.972003] ? acpi_ev_address_space_dispatch+0x16e/0x3c0 - [ 14.972014] ? __die_body.cold+0x8/0xd - [ 14.972021] ? page_fault_oops+0x132/0x170 - [ 14.972028] ? exc_page_fault+0x61/0x150 - [ 14.972036] ? asm_exc_page_fault+0x22/0x30 - [ 14.972045] ? i801_acpi_io_handler+0x2d/0xb0 [i2c_i801] - [ 14.972061] acpi_ev_address_space_dispatch+0x16e/0x3c0 - [ 14.972069] ? __pfx_i801_acpi_io_handler+0x10/0x10 [i2c_i801] - [ 14.972085] acpi_ex_access_region+0x5b/0xd0 - [ 14.972093] acpi_ex_field_datum_io+0x73/0x2e0 - [ 14.972100] acpi_ex_read_data_from_field+0x8e/0x230 - [ 14.972106] acpi_ex_resolve_node_to_value+0x23d/0x310 - [ 14.972114] acpi_ds_evaluate_name_path+0xad/0x110 - [ 14.972121] acpi_ds_exec_end_op+0x321/0x510 - [ 14.972127] acpi_ps_parse_loop+0xf7/0x680 - [ 14.972136] acpi_ps_parse_aml+0x17a/0x3d0 - [ 14.972143] acpi_ps_execute_method+0x137/0x270 - [ 14.972150] acpi_ns_evaluate+0x1f4/0x2e0 - [ 14.972158] acpi_evaluate_object+0x134/0x2f0 - [ 14.972164] acpi_evaluate_integer+0x50/0xe0 - [ 14.972173] ? vsnprintf+0x24b/0x570 - [ 14.972181] acpi_ac_get_state.part.0+0x23/0x70 - [ 14.972189] get_ac_property+0x4e/0x60 - [ 14.972195] power_supply_show_property+0x90/0x1f0 - [ 14.972205] add_prop_uevent+0x29/0x90 - [ 14.972213] power_supply_uevent+0x109/0x1d0 - [ 14.972222] dev_uevent+0x10e/0x2f0 - [ 14.972228] uevent_show+0x8e/0x100 - [ 14.972236] dev_attr_show+0x19/0x40 - [ 14.972246] sysfs_kf_seq_show+0x9b/0x100 - [ 14.972253] seq_read_iter+0x120/0x4b0 - [ 14.972262] ? selinux_file_permission+0x106/0x150 - [ 14.972273] vfs_read+0x24f/0x3a0 - [ 14.972284] ksys_read+0x5f/0xe0 - [ 14.972291] do_syscall_64+0x5f/0xe0 - ... - - The kernel panic is mitigated by setting limiting the count of udev - children to 1. Revert to using the acpi_lock to continue protecting - marking the area as owned by firmware without relying on a lock in - a potentially unmapped region of memory. - - Fixes: f707d6b9e7c1 ("i2c: i801: replace acpi_lock with I2C bus lock") - Signed-off-by: Charles Haithcock - [wsa: added Fixes-tag and updated comment stating the importance of the lock] - Signed-off-by: Wolfram Sang - -(cherry picked from commit cfc69c2e6c699c96949f7b0455195b0bfb7dc715) -Assisted-by: Patchpal -Signed-off-by: David Arcari - -diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c -index 171d29d2770e..b6a32c7c4a50 100644 ---- a/drivers/i2c/busses/i2c-i801.c -+++ b/drivers/i2c/busses/i2c-i801.c -@@ -303,9 +303,10 @@ struct i801_priv { - - /* - * If set to true the host controller registers are reserved for -- * ACPI AML use. -+ * ACPI AML use. Needs extra protection by acpi_lock. - */ - bool acpi_reserved; -+ struct mutex acpi_lock; - }; - - #define FEATURE_SMBUS_PEC BIT(0) -@@ -893,8 +894,11 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr, - int hwpec, ret; - struct i801_priv *priv = i2c_get_adapdata(adap); - -- if (priv->acpi_reserved) -+ mutex_lock(&priv->acpi_lock); -+ if (priv->acpi_reserved) { -+ mutex_unlock(&priv->acpi_lock); - return -EBUSY; -+ } - - pm_runtime_get_sync(&priv->pci_dev->dev); - -@@ -935,6 +939,7 @@ static s32 i801_access(struct i2c_adapter *adap, u16 addr, - - pm_runtime_mark_last_busy(&priv->pci_dev->dev); - pm_runtime_put_autosuspend(&priv->pci_dev->dev); -+ mutex_unlock(&priv->acpi_lock); - return ret; - } - -@@ -1462,7 +1467,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, - * further access from the driver itself. This device is now owned - * by the system firmware. - */ -- i2c_lock_bus(&priv->adapter, I2C_LOCK_SEGMENT); -+ mutex_lock(&priv->acpi_lock); - - if (!priv->acpi_reserved && i801_acpi_is_smbus_ioport(priv, address)) { - priv->acpi_reserved = true; -@@ -1482,7 +1487,7 @@ i801_acpi_io_handler(u32 function, acpi_physical_address address, u32 bits, - else - status = acpi_os_write_port(address, (u32)*value, bits); - -- i2c_unlock_bus(&priv->adapter, I2C_LOCK_SEGMENT); -+ mutex_unlock(&priv->acpi_lock); - - return status; - } -@@ -1542,6 +1547,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id) - priv->adapter.dev.parent = &dev->dev; - acpi_use_parent_companion(&priv->adapter.dev); - priv->adapter.retries = 3; -+ mutex_init(&priv->acpi_lock); - - priv->pci_dev = dev; - priv->features = id->driver_data; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1203-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch b/SOURCES/1203-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch deleted file mode 100644 index 90ef9f1b3..000000000 --- a/SOURCES/1203-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch +++ /dev/null @@ -1,158 +0,0 @@ -From 8c73bd1f496786efe542e894103b8abcc65c98a3 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 21 Apr 2026 09:53:43 +0000 -Subject: [PATCH] ima: don't clear IMA_DIGSIG flag when setting or removing - non-IMA xattr - -JIRA: https://redhat.atlassian.net/browse/RHEL-169733 -CVE: CVE-2025-68183 - -commit 88b4cbcf6b041ae0f2fc8a34554a5b6a83a2b7cd -Author: Coiby Xu -Date: Mon Sep 15 13:55:23 2025 +0800 - - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr - - Currently when both IMA and EVM are in fix mode, the IMA signature will - be reset to IMA hash if a program first stores IMA signature in - security.ima and then writes/removes some other security xattr for the - file. - - For example, on Fedora, after booting the kernel with "ima_appraise=fix - evm=fix ima_policy=appraise_tcb" and installing rpm-plugin-ima, - installing/reinstalling a package will not make good reference IMA - signature generated. Instead IMA hash is generated, - - # getfattr -m - -d -e hex /usr/bin/bash - # file: usr/bin/bash - security.ima=0x0404... - - This happens because when setting security.selinux, the IMA_DIGSIG flag - that had been set early was cleared. As a result, IMA hash is generated - when the file is closed. - - Similarly, IMA signature can be cleared on file close after removing - security xattr like security.evm or setting/removing ACL. - - Prevent replacing the IMA file signature with a file hash, by preventing - the IMA_DIGSIG flag from being reset. - - Here's a minimal C reproducer which sets security.selinux as the last - step which can also replaced by removing security.evm or setting ACL, - - #include - #include - #include - #include - #include - #include - - int main() { - const char* file_path = "/usr/sbin/test_binary"; - const char* hex_string = "030204d33204490066306402304"; - int length = strlen(hex_string); - char* ima_attr_value; - int fd; - - fd = open(file_path, O_WRONLY|O_CREAT|O_EXCL, 0644); - if (fd == -1) { - perror("Error opening file"); - return 1; - } - - ima_attr_value = (char*)malloc(length / 2 ); - for (int i = 0, j = 0; i < length; i += 2, j++) { - sscanf(hex_string + i, "%2hhx", &ima_attr_value[j]); - } - - if (fsetxattr(fd, "security.ima", ima_attr_value, length/2, 0) == -1) { - perror("Error setting extended attribute"); - close(fd); - return 1; - } - - const char* selinux_value= "system_u:object_r:bin_t:s0"; - if (fsetxattr(fd, "security.selinux", selinux_value, strlen(selinux_value), 0) == -1) { - perror("Error setting extended attribute"); - close(fd); - return 1; - } - - close(fd); - - return 0; - } - - Signed-off-by: Coiby Xu - Signed-off-by: Mimi Zohar - -Signed-off-by: CKI Backport Bot - -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index 4d88e03381b7..146268b88506 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -560,6 +560,15 @@ static int ima_protect_xattr(struct dentry *dentry, const char *xattr_name, - return 0; - } - -+/* -+ * ima_reset_appraise_flags - reset ima_iint_cache flags -+ * -+ * @digsig: whether to clear/set IMA_DIGSIG flag, tristate values -+ * 0: clear IMA_DIGSIG -+ * 1: set IMA_DIGSIG -+ * -1: don't change IMA_DIGSIG -+ * -+ */ - static void ima_reset_appraise_flags(struct inode *inode, int digsig) - { - struct integrity_iint_cache *iint; -@@ -572,9 +581,9 @@ static void ima_reset_appraise_flags(struct inode *inode, int digsig) - return; - iint->measured_pcrs = 0; - set_bit(IMA_CHANGE_XATTR, &iint->atomic_flags); -- if (digsig) -+ if (digsig == 1) - set_bit(IMA_DIGSIG, &iint->atomic_flags); -- else -+ else if (digsig == 0) - clear_bit(IMA_DIGSIG, &iint->atomic_flags); - } - -@@ -653,6 +662,8 @@ int ima_inode_setxattr(struct dentry *dentry, const char *xattr_name, - digsig = (xvalue->type == EVM_IMA_XATTR_DIGSIG); - } else if (!strcmp(xattr_name, XATTR_NAME_EVM) && xattr_value_len > 0) { - digsig = (xvalue->type == EVM_XATTR_PORTABLE_DIGSIG); -+ } else { -+ digsig = -1; - } - if (result == 1 || evm_revalidate_status(xattr_name)) { - result = validate_hash_algo(dentry, xvalue, xattr_value_len); -@@ -668,18 +679,20 @@ int ima_inode_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, - const char *acl_name, struct posix_acl *kacl) - { - if (evm_revalidate_status(acl_name)) -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ ima_reset_appraise_flags(d_backing_inode(dentry), -1); - - return 0; - } - - int ima_inode_removexattr(struct dentry *dentry, const char *xattr_name) - { -- int result; -+ int result, digsig = -1; - - result = ima_protect_xattr(dentry, xattr_name, NULL, 0); - if (result == 1 || evm_revalidate_status(xattr_name)) { -- ima_reset_appraise_flags(d_backing_inode(dentry), 0); -+ if (!strcmp(xattr_name, XATTR_NAME_IMA)) -+ digsig = 0; -+ ima_reset_appraise_flags(d_backing_inode(dentry), digsig); - if (result == 1) - result = 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1204-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch b/SOURCES/1204-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch deleted file mode 100644 index bc8361aad..000000000 --- a/SOURCES/1204-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch +++ /dev/null @@ -1,66 +0,0 @@ -From fb6ad4c7fd0157cbec8e80b5c2b2dde88074ae50 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 20 Apr 2026 15:22:22 +0000 -Subject: [PATCH] crypto: asymmetric_keys - prevent overflow in - asymmetric_key_generate_id - -JIRA: https://redhat.atlassian.net/browse/RHEL-169569 -CVE: CVE-2025-68724 - -commit df0845cf447ae1556c3440b8b155de0926cbaa56 -Author: Thorsten Blum -Date: Mon Oct 13 13:40:10 2025 +0200 - - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id - - Use check_add_overflow() to guard against potential integer overflows - when adding the binary blob lengths and the size of an asymmetric_key_id - structure and return ERR_PTR(-EOVERFLOW) accordingly. This prevents a - possible buffer overflow when copying data from potentially malicious - X.509 certificate fields that can be arbitrarily large, such as ASN.1 - INTEGER serial numbers, issuer names, etc. - - Fixes: 7901c1a8effb ("KEYS: Implement binary asymmetric key ID handling") - Signed-off-by: Thorsten Blum - Reviewed-by: Lukas Wunner - Signed-off-by: Herbert Xu - -Signed-off-by: CKI Backport Bot - -diff --git a/crypto/asymmetric_keys/asymmetric_type.c b/crypto/asymmetric_keys/asymmetric_type.c -index ad8af3d70ac0..2e3fa520d6eb 100644 ---- a/crypto/asymmetric_keys/asymmetric_type.c -+++ b/crypto/asymmetric_keys/asymmetric_type.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -138,12 +139,17 @@ struct asymmetric_key_id *asymmetric_key_generate_id(const void *val_1, - size_t len_2) - { - struct asymmetric_key_id *kid; -- -- kid = kmalloc(sizeof(struct asymmetric_key_id) + len_1 + len_2, -- GFP_KERNEL); -+ size_t kid_sz; -+ size_t len; -+ -+ if (check_add_overflow(len_1, len_2, &len)) -+ return ERR_PTR(-EOVERFLOW); -+ if (check_add_overflow(sizeof(struct asymmetric_key_id), len, &kid_sz)) -+ return ERR_PTR(-EOVERFLOW); -+ kid = kmalloc(kid_sz, GFP_KERNEL); - if (!kid) - return ERR_PTR(-ENOMEM); -- kid->len = len_1 + len_2; -+ kid->len = len; - memcpy(kid->data, val_1, len_1); - memcpy(kid->data + len_1, val_2, len_2); - return kid; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1205-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch b/SOURCES/1205-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch deleted file mode 100644 index eef18f407..000000000 --- a/SOURCES/1205-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 1aa4308d3a0b90f0bc449955df468b5adab7f2b0 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Wed, 25 Mar 2026 08:48:42 +0100 -Subject: [PATCH] netfilter: nf_conntrack_h323: check for zero length in - DecodeQ931() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-152685 -Upstream Status: commit f173d0f4c0f6 - -commit f173d0f4c0f689173f8cdac79991043a4a89bf66 -Author: Jenny Guanni Qu -Date: Thu Mar 12 14:49:50 2026 +0000 - - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() - - In DecodeQ931(), the UserUserIE code path reads a 16-bit length from - the packet, then decrements it by 1 to skip the protocol discriminator - byte before passing it to DecodeH323_UserInformation(). If the encoded - length is 0, the decrement wraps to -1, which is then passed as a - large value to the decoder, leading to an out-of-bounds read. - - Add a check to ensure len is positive after the decrement. - - Fixes: 5e35941d9901 ("[NETFILTER]: Add H.323 conntrack/NAT helper") - Reported-by: Klaudia Kloc - Reported-by: Dawid Moczadło - Tested-by: Jenny Guanni Qu - Signed-off-by: Jenny Guanni Qu - Signed-off-by: Florian Westphal - -Signed-off-by: Florian Westphal - -diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c -index c972e9488e16..7b1497ed97d2 100644 ---- a/net/netfilter/nf_conntrack_h323_asn1.c -+++ b/net/netfilter/nf_conntrack_h323_asn1.c -@@ -924,6 +924,8 @@ int DecodeQ931(unsigned char *buf, size_t sz, Q931 *q931) - break; - p++; - len--; -+ if (len <= 0) -+ break; - return DecodeH323_UserInformation(buf, p, len, - &q931->UUIE); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1206-iommu-sva-add-kernel-page-table-iotlb-flush-notification.patch b/SOURCES/1206-iommu-sva-add-kernel-page-table-iotlb-flush-notification.patch deleted file mode 100644 index 47e6448bb..000000000 --- a/SOURCES/1206-iommu-sva-add-kernel-page-table-iotlb-flush-notification.patch +++ /dev/null @@ -1,255 +0,0 @@ -From 7a48597b69032ea60c54f1ffd5083248ef2b7572 Mon Sep 17 00:00:00 2001 -From: Jerry Snitselaar -Date: Mon, 30 Mar 2026 02:41:55 +0000 -Subject: [PATCH] iommu/sva: add kernel page table IOTLB flush notification - -JIRA: https://issues.redhat.com/browse/RHEL-148781 -Upstream-Status: RHEL only -CVE: CVE-2025-71089 - -When IOMMU SVA is active, the IOMMU shares the CPU's page tables and -caches intermediate page table walk results. When kernel page table -directory pages are freed and reallocated, the IOMMU's cache retains -stale references, allowing DMA translations through arbitrary data -interpreted as page table entries. - -The upstream fix (merged in v6.19 via mm.git) introduces ptdesc-based -deferred kernel page table freeing, which is not feasible to backport -to RHEL9 due to the absence of the required mm infrastructure. - -Instead, add SVA mm tracking so that iommu_sva_invalidate_kva_range() -can iterate all mm_structs with active SVA bindings and trigger -PASID-global IOTLB flushes via -mmu_notifier_arch_invalidate_secondary_tlbs(). IOMMU drivers already -register arch_invalidate_secondary_tlbs callbacks that perform the -flush. The fast path (no SVA active) is a single atomic_read(). - -The mm tracking is hooked into iommu_sva_bind_device() and -iommu_sva_unbind_device(), covering all SVA consumers through -the generic SVA layer. - -The tracked mm list uses RCU-protected iteration on the read side, -allowing iommu_sva_invalidate_kva_range() to iterate without holding -a spinlock across hardware IOTLB flush busy-waits. Writers (bind/ -unbind) use a spinlock for mutual exclusion with list_add_rcu() and -list_del_rcu(), and kfree_rcu() defers freeing until after a grace -period. - -mmput_async() is used instead of mmput() because the flush path can -be called under rcu_read_lock() or from contexts where sleeping is -not permitted (e.g., CPA path under cpa_lock spinlock). - -iommu_sva_track_mm() returns -ENOMEM on allocation failure, causing -the SVA bind to fail cleanly rather than silently skipping IOTLB -flush tracking. - -Assisted-by: Claude:claude-opus-4-6 -Signed-off-by: Jerry Snitselaar - -diff --git a/drivers/iommu/iommu-sva.c b/drivers/iommu/iommu-sva.c -index 1a51cfd82808..f2267d22af1f 100644 ---- a/drivers/iommu/iommu-sva.c -+++ b/drivers/iommu/iommu-sva.c -@@ -6,12 +6,21 @@ - #include - #include - #include -+#include -+#include -+#include -+#include -+#include -+#include -+#include - - #include "iommu-priv.h" - - static DEFINE_MUTEX(iommu_sva_lock); - static struct iommu_domain *iommu_sva_domain_alloc(struct device *dev, - struct mm_struct *mm); -+static int iommu_sva_track_mm(struct mm_struct *mm); -+static void iommu_sva_untrack_mm(struct mm_struct *mm); - - /* Allocate a PASID for the mm within range (inclusive) */ - static struct iommu_mm_data *iommu_alloc_mm_data(struct mm_struct *mm, struct device *dev) -@@ -136,10 +145,20 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, struct mm_struct *mm - - out: - refcount_set(&handle->users, 1); -+ ret = iommu_sva_track_mm(mm); -+ if (ret) -+ goto out_unwind; - mutex_unlock(&iommu_sva_lock); - handle->dev = dev; - return handle; - -+out_unwind: -+ iommu_detach_device_pasid(domain, dev, iommu_mm->pasid); -+ if (--domain->users == 0) { -+ list_del(&domain->next); -+ iommu_domain_free(domain); -+ } -+ goto out_free_handle; - out_free_domain: - iommu_domain_free(domain); - out_free_handle: -@@ -170,6 +189,7 @@ void iommu_sva_unbind_device(struct iommu_sva *handle) - return; - } - -+ iommu_sva_untrack_mm(domain->mm); - iommu_detach_device_pasid(domain, dev, iommu_mm->pasid); - if (--domain->users == 0) { - list_del(&domain->next); -@@ -312,3 +332,127 @@ static struct iommu_domain *iommu_sva_domain_alloc(struct device *dev, - - return domain; - } -+ -+/* -+ * Track mm_structs with active SVA bindings so we can flush IOMMU -+ * cached translations when kernel page table pages are freed. -+ */ -+struct sva_mm { -+ struct mm_struct *mm; -+ struct list_head list; -+ struct rcu_head rcu; -+ int refcount; -+}; -+ -+static DEFINE_SPINLOCK(sva_mm_lock); -+static LIST_HEAD(sva_mm_list); -+static atomic_t sva_mm_count = ATOMIC_INIT(0); -+ -+/** -+ * iommu_sva_track_mm - Start tracking an mm for kernel PT change notification -+ * @mm: the mm_struct to track -+ * -+ * Called when SVA is bound for this mm. If the mm is already tracked, -+ * increments the refcount. Otherwise allocates a new tracking entry. -+ * -+ * Returns 0 on success, -ENOMEM on allocation failure. -+ */ -+static int iommu_sva_track_mm(struct mm_struct *mm) -+{ -+ struct sva_mm *smm; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&sva_mm_lock, flags); -+ list_for_each_entry(smm, &sva_mm_list, list) { -+ if (smm->mm == mm) { -+ smm->refcount++; -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ return 0; -+ } -+ } -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ -+ smm = kzalloc(sizeof(*smm), GFP_KERNEL); -+ if (!smm) -+ return -ENOMEM; -+ -+ smm->mm = mm; -+ smm->refcount = 1; -+ -+ spin_lock_irqsave(&sva_mm_lock, flags); -+ { -+ struct sva_mm *existing; -+ -+ list_for_each_entry(existing, &sva_mm_list, list) { -+ if (existing->mm == mm) { -+ existing->refcount++; -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ kfree(smm); -+ return 0; -+ } -+ } -+ } -+ list_add_rcu(&smm->list, &sva_mm_list); -+ atomic_inc(&sva_mm_count); -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ return 0; -+} -+ -+/** -+ * iommu_sva_untrack_mm - Stop tracking an mm for kernel PT change notification -+ * @mm: the mm_struct to untrack -+ * -+ * Called when SVA is unbound for this mm. Decrements the refcount and -+ * removes the tracking entry when it reaches zero. -+ */ -+static void iommu_sva_untrack_mm(struct mm_struct *mm) -+{ -+ struct sva_mm *smm; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&sva_mm_lock, flags); -+ list_for_each_entry(smm, &sva_mm_list, list) { -+ if (smm->mm == mm) { -+ if (--smm->refcount == 0) { -+ list_del_rcu(&smm->list); -+ atomic_dec(&sva_mm_count); -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ kfree_rcu(smm, rcu); -+ return; -+ } -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ return; -+ } -+ } -+ spin_unlock_irqrestore(&sva_mm_lock, flags); -+ WARN(1, "iommu_sva_untrack_mm: mm %px not found\n", mm); -+} -+ -+/** -+ * iommu_sva_invalidate_kva_range - Flush IOMMU caches before kernel PT free -+ * @start: Start of kernel virtual address range -+ * @end: End of kernel virtual address range -+ * -+ * Called from x86 mm code before freeing kernel page table pages. -+ * Iterates all tracked SVA-bound mm_structs and calls -+ * mmu_notifier_arch_invalidate_secondary_tlbs() for each, triggering -+ * IOTLB flushes via the drivers' invalidate_range callbacks. -+ * -+ * Fast path: atomic_read() returns 0 when no SVA is active. -+ */ -+void iommu_sva_invalidate_kva_range(unsigned long start, unsigned long end) -+{ -+ struct sva_mm *smm; -+ -+ if (!atomic_read(&sva_mm_count)) -+ return; -+ -+ rcu_read_lock(); -+ list_for_each_entry_rcu(smm, &sva_mm_list, list) { -+ if (mmget_not_zero(smm->mm)) { -+ mmu_notifier_arch_invalidate_secondary_tlbs(smm->mm, start, end); -+ mmput_async(smm->mm); -+ } -+ } -+ rcu_read_unlock(); -+} -diff --git a/include/linux/iommu.h b/include/linux/iommu.h -index c30d12e16473..cf266c0e4f73 100644 ---- a/include/linux/iommu.h -+++ b/include/linux/iommu.h -@@ -1615,6 +1615,7 @@ struct iommu_sva *iommu_sva_bind_device(struct device *dev, - struct mm_struct *mm); - void iommu_sva_unbind_device(struct iommu_sva *handle); - u32 iommu_sva_get_pasid(struct iommu_sva *handle); -+void iommu_sva_invalidate_kva_range(unsigned long start, unsigned long end); - #else - static inline struct iommu_sva * - iommu_sva_bind_device(struct device *dev, struct mm_struct *mm) -@@ -1630,6 +1631,8 @@ static inline u32 iommu_sva_get_pasid(struct iommu_sva *handle) - { - return IOMMU_PASID_INVALID; - } -+static inline void iommu_sva_invalidate_kva_range(unsigned long start, -+ unsigned long end) {} - static inline void mm_pasid_init(struct mm_struct *mm) {} - static inline bool mm_valid_pasid(struct mm_struct *mm) { return false; } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1207-x86-mm-flush-iommu-before-freeing-kernel-page-table-pages.patch b/SOURCES/1207-x86-mm-flush-iommu-before-freeing-kernel-page-table-pages.patch deleted file mode 100644 index 52a798545..000000000 --- a/SOURCES/1207-x86-mm-flush-iommu-before-freeing-kernel-page-table-pages.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 51cb4cded7ea7ed2f5a1ae74ceb7ae0275bd9d53 Mon Sep 17 00:00:00 2001 -From: Jerry Snitselaar -Date: Mon, 30 Mar 2026 02:43:11 +0000 -Subject: [PATCH] x86/mm: flush IOMMU before freeing kernel page table pages -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-148781 -Upstream-Status: RHEL only -CVE: CVE-2025-71089 - -When IOMMU SVA is active, the IOMMU can cache kernel page table -walk results. When kernel page table directory pages (PTE/PMD/PUD -pages) are freed and reallocated, the IOMMU's paging structure cache -retains stale references, leading to DMA translations through -arbitrary data interpreted as page table entries. - -Add iommu_sva_invalidate_kva_range() calls at all four kernel page -table freeing chokepoints, placed before the page is actually freed: - - 1. pud_free_pmd_page() — ioremap huge PUD promotion (pgtable.c) - 2. pmd_free_pte_page() — ioremap huge PMD promotion (pgtable.c) - 3. free_pagetable() — memory hotplug removal (init_64.c) - 4. try_to_free_pte_page() / try_to_free_pmd_page() - — CPA page table collapse (pat/set_memory.c) - -When no SVA is active, iommu_sva_invalidate_kva_range() returns -immediately after a single atomic_read(). - -Assisted-by: Claude:claude-opus-4-6 -Signed-off-by: Jerry Snitselaar - -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index dc4fcf3d8091..f05d65446d32 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -1017,6 +1018,9 @@ static void __meminit free_pagetable(struct page *page, int order) - unsigned long magic; - unsigned int nr_pages = 1 << order; - -+ /* Flush IOMMU paging structure caches before freeing PT page */ -+ iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL); -+ - /* bootmem page has reserved flag */ - if (PageReserved(page)) { - __ClearPageReserved(page); -diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c -index 77dca29d82f6..63cafe9f76c3 100644 ---- a/arch/x86/mm/pat/set_memory.c -+++ b/arch/x86/mm/pat/set_memory.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1204,6 +1205,8 @@ static bool try_to_free_pte_page(pte_t *pte) - if (!pte_none(pte[i])) - return false; - -+ /* Flush IOMMU paging structure caches before freeing PT page */ -+ iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL); - free_page((unsigned long)pte); - return true; - } -@@ -1216,6 +1219,8 @@ static bool try_to_free_pmd_page(pmd_t *pmd) - if (!pmd_none(pmd[i])) - return false; - -+ /* Flush IOMMU paging structure caches before freeing PT page */ -+ iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL); - free_page((unsigned long)pmd); - return true; - } -diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index d28d84f7d567..e7ed6a69e76f 100644 ---- a/arch/x86/mm/pgtable.c -+++ b/arch/x86/mm/pgtable.c -@@ -2,6 +2,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -832,6 +833,9 @@ int pud_free_pmd_page(pud_t *pud, unsigned long addr) - /* INVLPG to clear all paging-structure caches */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1); - -+ /* Flush IOMMU paging structure caches before freeing PT pages */ -+ iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL); -+ - for (i = 0; i < PTRS_PER_PMD; i++) { - if (!pmd_none(pmd_sv[i])) { - pte = (pte_t *)pmd_page_vaddr(pmd_sv[i]); -@@ -865,6 +869,8 @@ int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) - /* INVLPG to clear all paging-structure caches */ - flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1); - -+ /* Flush IOMMU paging structure caches before freeing PT page */ -+ iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL); - free_page((unsigned long)pte); - - return 1; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1208-nbd-defer-config-unlock-in-nbd-genl-connect.patch b/SOURCES/1208-nbd-defer-config-unlock-in-nbd-genl-connect.patch deleted file mode 100644 index a62500863..000000000 --- a/SOURCES/1208-nbd-defer-config-unlock-in-nbd-genl-connect.patch +++ /dev/null @@ -1,74 +0,0 @@ -From b539a2d23355e150de78c3744e77be3ce68a6d76 Mon Sep 17 00:00:00 2001 -From: Ming Lei -Date: Mon, 10 Nov 2025 20:49:20 +0800 -Subject: [PATCH] nbd: defer config unlock in nbd_genl_connect - -JIRA: https://issues.redhat.com/browse/RHEL-154215 - -commit 1649714b930f9ea6233ce0810ba885999da3b5d4 -Author: Zheng Qixing -Date: Mon Nov 10 20:49:20 2025 +0800 - - nbd: defer config unlock in nbd_genl_connect - - There is one use-after-free warning when running NBD_CMD_CONNECT and - NBD_CLEAR_SOCK: - - nbd_genl_connect - nbd_alloc_and_init_config // config_refs=1 - nbd_start_device // config_refs=2 - set NBD_RT_HAS_CONFIG_REF open nbd // config_refs=3 - recv_work done // config_refs=2 - NBD_CLEAR_SOCK // config_refs=1 - close nbd // config_refs=0 - refcount_inc -> uaf - - ------------[ cut here ]------------ - refcount_t: addition on 0; use-after-free. - WARNING: CPU: 24 PID: 1014 at lib/refcount.c:25 refcount_warn_saturate+0x12e/0x290 - nbd_genl_connect+0x16d0/0x1ab0 - genl_family_rcv_msg_doit+0x1f3/0x310 - genl_rcv_msg+0x44a/0x790 - - The issue can be easily reproduced by adding a small delay before - refcount_inc(&nbd->config_refs) in nbd_genl_connect(): - - mutex_unlock(&nbd->config_lock); - if (!ret) { - set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); - + printk("before sleep\n"); - + mdelay(5 * 1000); - + printk("after sleep\n"); - refcount_inc(&nbd->config_refs); - nbd_connect_reply(info, nbd->index); - } - - Fixes: e46c7287b1c2 ("nbd: add a basic netlink interface") - Signed-off-by: Zheng Qixing - Reviewed-by: Yu Kuai - Signed-off-by: Jens Axboe - -Signed-off-by: Ming Lei - -diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c -index be06723f1df0..f818ff2d82a3 100644 ---- a/drivers/block/nbd.c -+++ b/drivers/block/nbd.c -@@ -2243,12 +2243,13 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) - - ret = nbd_start_device(nbd); - out: -- mutex_unlock(&nbd->config_lock); - if (!ret) { - set_bit(NBD_RT_HAS_CONFIG_REF, &config->runtime_flags); - refcount_inc(&nbd->config_refs); - nbd_connect_reply(info, nbd->index); - } -+ mutex_unlock(&nbd->config_lock); -+ - nbd_config_put(nbd); - if (put_dev) - nbd_put(nbd); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1209-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch b/SOURCES/1209-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch deleted file mode 100644 index da2f2219b..000000000 --- a/SOURCES/1209-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch +++ /dev/null @@ -1,218 +0,0 @@ -From ab21a37682dbde2caf3738756ab45242c135bc7a Mon Sep 17 00:00:00 2001 -From: Jocelyn Falempe -Date: Mon, 16 Feb 2026 14:34:02 +0100 -Subject: [PATCH] drm/mgag200: fix mgag200_bmc_stop_scanout() - -JIRA: https://issues.redhat.com/browse/RHEL-148287 -Upstream Status: v6.19 - -commit 0e0c8f4d16de92520623aa1ea485cadbf64e6929 -Author: Jacob Keller -AuthorDate: Mon Feb 2 16:16:39 2026 -0800 -Commit: Thomas Zimmermann -CommitDate: Wed Feb 4 08:52:53 2026 +0100 - - The mgag200_bmc_stop_scanout() function is called by the .atomic_disable() - handler for the MGA G200 VGA BMC encoder. This function performs a few - register writes to inform the BMC of an upcoming mode change, and then - polls to wait until the BMC actually stops. - - The polling is implemented using a busy loop with udelay() and an iteration - timeout of 300, resulting in the function blocking for 300 milliseconds. - - The function gets called ultimately by the output_poll_execute work thread - for the DRM output change polling thread of the mgag200 driver: - - kworker/0:0-mm_ 3528 [000] 4555.315364: - ffffffffaa0e25b3 delay_halt.part.0+0x33 - ffffffffc03f6188 mgag200_bmc_stop_scanout+0x178 - ffffffffc087ae7a disable_outputs+0x12a - ffffffffc087c12a drm_atomic_helper_commit_tail+0x1a - ffffffffc03fa7b6 mgag200_mode_config_helper_atomic_commit_tail+0x26 - ffffffffc087c9c1 commit_tail+0x91 - ffffffffc087d51b drm_atomic_helper_commit+0x11b - ffffffffc0509694 drm_atomic_commit+0xa4 - ffffffffc05105e8 drm_client_modeset_commit_atomic+0x1e8 - ffffffffc0510ce6 drm_client_modeset_commit_locked+0x56 - ffffffffc0510e24 drm_client_modeset_commit+0x24 - ffffffffc088a743 __drm_fb_helper_restore_fbdev_mode_unlocked+0x93 - ffffffffc088a683 drm_fb_helper_hotplug_event+0xe3 - ffffffffc050f8aa drm_client_dev_hotplug+0x9a - ffffffffc088555a output_poll_execute+0x29a - ffffffffa9b35924 process_one_work+0x194 - ffffffffa9b364ee worker_thread+0x2fe - ffffffffa9b3ecad kthread+0xdd - ffffffffa9a08549 ret_from_fork+0x29 - - On a server running ptp4l with the mgag200 driver loaded, we found that - ptp4l would sometimes get blocked from execution because of this busy - waiting loop. - - Every so often, approximately once every 20 minutes -- though with large - variance -- the output_poll_execute() thread would detect some sort of - change that required performing a hotplug event which results in attempting - to stop the BMC scanout, resulting in a 300msec delay on one CPU. - - On this system, ptp4l was pinned to a single CPU. When the - output_poll_execute() thread ran on that CPU, it blocked ptp4l from - executing for its 300 millisecond duration. - - This resulted in PTP service disruptions such as failure to send a SYNC - message on time, failure to handle ANNOUNCE messages on time, and clock - check warnings from the application. All of this despite the application - being configured with FIFO_RT and a higher priority than the background - workqueue tasks. (However, note that the kernel did not use - CONFIG_PREEMPT...) - - It is unclear if the event is due to a faulty VGA connection, another bug, - or actual events causing a change in the connection. At least on the system - under test it is not a one-time event and consistently causes disruption to - the time sensitive applications. - - The function has some helpful comments explaining what steps it is - attempting to take. In particular, step 3a and 3b are explained as such: - - 3a - The third step is to verify if there is an active scan. We are - waiting on a 0 on remhsyncsts (. - - 3b - This step occurs only if the remove is actually scanning. We are - waiting for the end of the frame which is a 1 on remvsyncsts - (). - - The actual steps 3a and 3b are implemented as while loops with a - non-sleeping udelay(). The first step iterates while the tmp value at - position 0 is *not* set. That is, it keeps iterating as long as the bit is - zero. If the bit is already 0 (because there is no active scan), it will - iterate the entire 300 attempts which wastes 300 milliseconds in total. - This is opposite of what the description claims. - - The step 3b logic only executes if we do not iterate over the entire 300 - attempts in the first loop. If it does trigger, it is trying to check and - wait for a 1 on the remvsyncsts. However, again the condition is actually - inverted and it will loop as long as the bit is 1, stopping once it hits - zero (rather than the explained attempt to wait until we see a 1). - - Worse, both loops are implemented using non-sleeping waits which spin - instead of allowing the scheduler to run other processes. If the kernel is - not configured to allow arbitrary preemption, it will waste valuable CPU - time doing nothing. - - There does not appear to be any documentation for the BMC register - interface, beyond what is in the comments here. It seems more probable that - the comment here is correct and the implementation accidentally got - inverted from the intended logic. - - Reading through other DRM driver implementations, it does not appear that - the .atomic_enable or .atomic_disable handlers need to delay instead of - sleep. For example, the ast_astdp_encoder_helper_atomic_disable() function - calls ast_dp_set_phy_sleep() which uses msleep(). The "atomic" in the name - is referring to the atomic modesetting support, which is the support to - enable atomic configuration from userspace, and not to the "atomic context" - of the kernel. There is no reason to use udelay() here if a sleep would be - sufficient. - - Replace the while loops with a read_poll_timeout() based implementation - that will sleep between iterations, and which stops polling once the - condition is met (instead of looping as long as the condition is met). This - aligns with the commented behavior and avoids blocking on the CPU while - doing nothing. - - Note the RREG_DAC is implemented using a statement expression to allow - working properly with the read_poll_timeout family of functions. The other - RREG_ macros ought to be cleaned up to have better semantics, and - several places in the mgag200 driver could make use of RREG_DAC or similar - RREG_* macros should likely be cleaned up for better semantics as well, but - that task has been left as a future cleanup for a non-bugfix. - - Fixes: 414c45310625 ("mgag200: initial g200se driver (v2)") - Suggested-by: Thomas Zimmermann - Signed-off-by: Jacob Keller - Reviewed-by: Thomas Zimmermann - Reviewed-by: Jocelyn Falempe - Signed-off-by: Thomas Zimmermann - Link: https://patch.msgid.link/20260202-jk-mgag200-fix-bad-udelay-v2-1-ce1e9665987d@intel.com - -Signed-off-by: Jocelyn Falempe - -diff --git a/drivers/gpu/drm/mgag200/mgag200_bmc.c b/drivers/gpu/drm/mgag200/mgag200_bmc.c -index a689c71ff165..bbdeb791c5b3 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_bmc.c -+++ b/drivers/gpu/drm/mgag200/mgag200_bmc.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0-only - - #include -+#include - - #include - #include -@@ -12,7 +13,7 @@ - void mgag200_bmc_stop_scanout(struct mga_device *mdev) - { - u8 tmp; -- int iter_max; -+ int ret; - - /* - * 1 - The first step is to inform the BMC of an upcoming mode -@@ -42,30 +43,22 @@ void mgag200_bmc_stop_scanout(struct mga_device *mdev) - - /* - * 3a- The third step is to verify if there is an active scan. -- * We are waiting for a 0 on remhsyncsts ). -+ * We are waiting for a 0 on remhsyncsts (). - */ -- iter_max = 300; -- while (!(tmp & 0x1) && iter_max) { -- WREG8(DAC_INDEX, MGA1064_SPAREREG); -- tmp = RREG8(DAC_DATA); -- udelay(1000); -- iter_max--; -- } -+ ret = read_poll_timeout(RREG_DAC, tmp, !(tmp & 0x1), -+ 1000, 300000, false, -+ MGA1064_SPAREREG); -+ if (ret == -ETIMEDOUT) -+ return; - - /* -- * 3b- This step occurs only if the remove is actually -+ * 3b- This step occurs only if the remote BMC is actually - * scanning. We are waiting for the end of the frame which is - * a 1 on remvsyncsts (XSPAREREG<1>) - */ -- if (iter_max) { -- iter_max = 300; -- while ((tmp & 0x2) && iter_max) { -- WREG8(DAC_INDEX, MGA1064_SPAREREG); -- tmp = RREG8(DAC_DATA); -- udelay(1000); -- iter_max--; -- } -- } -+ (void)read_poll_timeout(RREG_DAC, tmp, (tmp & 0x2), -+ 1000, 300000, false, -+ MGA1064_SPAREREG); - } - - void mgag200_bmc_start_scanout(struct mga_device *mdev) -diff --git a/drivers/gpu/drm/mgag200/mgag200_drv.h b/drivers/gpu/drm/mgag200/mgag200_drv.h -index f4bf40cd7c88..a875c4bf8cbe 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_drv.h -+++ b/drivers/gpu/drm/mgag200/mgag200_drv.h -@@ -111,6 +111,12 @@ - #define DAC_INDEX 0x3c00 - #define DAC_DATA 0x3c0a - -+#define RREG_DAC(reg) \ -+ ({ \ -+ WREG8(DAC_INDEX, reg); \ -+ RREG8(DAC_DATA); \ -+ }) \ -+ - #define WREG_DAC(reg, v) \ - do { \ - WREG8(DAC_INDEX, reg); \ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1210-ice-fix-timestamp-interrupt-configuration-for-e825c.patch b/SOURCES/1210-ice-fix-timestamp-interrupt-configuration-for-e825c.patch deleted file mode 100644 index 11ec33697..000000000 --- a/SOURCES/1210-ice-fix-timestamp-interrupt-configuration-for-e825c.patch +++ /dev/null @@ -1,136 +0,0 @@ -From c0a575a801a2040eb1e0db54b488f8c548c8458a Mon Sep 17 00:00:00 2001 -From: Grzegorz Nitka -Date: Mon, 20 Apr 2026 17:51:25 -0700 -Subject: [PATCH] ice: fix timestamp interrupt configuration for E825C - -The E825C ice_phy_cfg_intr_eth56g() function is responsible for programming -the PHY interrupt for a given port. This function writes to the -PHY_REG_TS_INT_CONFIG register of the port. The register is responsible for -configuring whether the port interrupt logic is enabled, as well as -programming the threshold of waiting timestamps that will trigger an -interrupt from this port. - -This threshold value must not be programmed to zero while the interrupt is -enabled. Doing so puts the port in a misconfigured state where the PHY -timestamp interrupt for the quad of connected ports will become stuck. - -This occurs, because a threshold of zero results in the timestamp interrupt -status for the port becoming stuck high. The four ports in the connected -quad have their timestamp status indicators muxed together. A new interrupt -cannot be generated until the timestamp status indicators return low for -all four ports. - -Normally, the timestamp status for a port will clear once there are fewer -timestamps in that ports timestamp memory bank than the threshold. A -threshold of zero makes this impossible, so the timestamp status for the -port does not clear. - -The ice driver never intentionally programs the threshold to zero, indeed -the driver always programs it to a value of 1, intending to get an -interrupt immediately as soon as even a single packet is waiting for a -timestamp. - -However, there is a subtle flaw in the programming logic in the -ice_phy_cfg_intr_eth56g() function. Due to the way that the hardware -handles enabling the PHY interrupt. If the threshold value is modified at -the same time as the interrupt is enabled, the HW PHY state machine might -enable the interrupt before the new threshold value is actually updated. -This leaves a potential race condition caused by the hardware logic where -a PHY timestamp interrupt might be triggered before the non-zero threshold -is written, resulting in the PHY timestamp logic becoming stuck. - -Once the PHY timestamp status is stuck high, it will remain stuck even -after attempting to reprogram the PHY block by changing its threshold or -disabling the interrupt. Even a typical PF or CORE reset will not reset the -particular block of the PHY that becomes stuck. Even a warm power cycle is -not guaranteed to cause the PHY block to reset, and a cold power cycle is -required. - -Prevent this by always writing the PHY_REG_TS_INT_CONFIG in two stages. -First write the threshold value with the interrupt disabled, and only write -the enable bit after the threshold has been programmed. When disabling the -interrupt, leave the threshold unchanged. Additionally, re-read the -register after writing it to guarantee that the write to the PHY has been -flushed upon exit of the function. - -While we're modifying this function implementation, explicitly reject -programming a threshold of 0 when enabling the interrupt. No caller does -this today, but the consequences of doing so are significant. An explicit -rejection in the code makes this clear. - -Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") -Signed-off-by: Grzegorz Nitka -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Petr Oros -Tested-by: Sunitha Mekala -Signed-off-by: Jacob Keller -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-1-bc2240f42251@intel.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -index 5a5c511ccbb6..7f2f7440e705 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -@@ -1847,6 +1847,8 @@ static int ice_phy_cfg_mac_eth56g(struct ice_hw *hw, u8 port) - * @ena: enable or disable interrupt - * @threshold: interrupt threshold - * -+ * The threshold cannot be 0 while the interrupt is enabled. -+ * - * Configure TX timestamp interrupt for the specified port - * - * Return: -@@ -1858,19 +1860,45 @@ int ice_phy_cfg_intr_eth56g(struct ice_hw *hw, u8 port, bool ena, u8 threshold) - int err; - u32 val; - -+ if (ena && !threshold) -+ return -EINVAL; -+ - err = ice_read_ptp_reg_eth56g(hw, port, PHY_REG_TS_INT_CONFIG, &val); - if (err) - return err; - -+ val &= ~PHY_TS_INT_CONFIG_ENA_M; - if (ena) { -- val |= PHY_TS_INT_CONFIG_ENA_M; - val &= ~PHY_TS_INT_CONFIG_THRESHOLD_M; - val |= FIELD_PREP(PHY_TS_INT_CONFIG_THRESHOLD_M, threshold); -- } else { -- val &= ~PHY_TS_INT_CONFIG_ENA_M; -+ err = ice_write_ptp_reg_eth56g(hw, port, PHY_REG_TS_INT_CONFIG, -+ val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, -+ "Failed to update 'threshold' PHY_REG_TS_INT_CONFIG port=%u ena=%u threshold=%u\n", -+ port, !!ena, threshold); -+ return err; -+ } -+ val |= PHY_TS_INT_CONFIG_ENA_M; - } - -- return ice_write_ptp_reg_eth56g(hw, port, PHY_REG_TS_INT_CONFIG, val); -+ err = ice_write_ptp_reg_eth56g(hw, port, PHY_REG_TS_INT_CONFIG, val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, -+ "Failed to update 'ena' PHY_REG_TS_INT_CONFIG port=%u ena=%u threshold=%u\n", -+ port, !!ena, threshold); -+ return err; -+ } -+ -+ err = ice_read_ptp_reg_eth56g(hw, port, PHY_REG_TS_INT_CONFIG, &val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, -+ "Failed to read PHY_REG_TS_INT_CONFIG port=%u ena=%u threshold=%u\n", -+ port, !!ena, threshold); -+ return err; -+ } -+ -+ return 0; - } - - /** --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1211-ice-perform-phy-soft-reset-for-e825c-ports-at-initialization.patch b/SOURCES/1211-ice-perform-phy-soft-reset-for-e825c-ports-at-initialization.patch deleted file mode 100644 index 24e381efd..000000000 --- a/SOURCES/1211-ice-perform-phy-soft-reset-for-e825c-ports-at-initialization.patch +++ /dev/null @@ -1,192 +0,0 @@ -From 3ec46e157c7fa420c77dfc23f7030e61f2f3fd55 Mon Sep 17 00:00:00 2001 -From: Grzegorz Nitka -Date: Mon, 20 Apr 2026 17:51:26 -0700 -Subject: [PATCH] ice: perform PHY soft reset for E825C ports at initialization - -In some cases the PHY timestamp block of the E825C can become stuck. This -is known to occur if the software writes 0 to the Tx timestamp threshold, -and with older versions of the ice driver the threshold configuration is -buggy and can race in such that hardware briefly operates with a zero -threshold enabled. There are no other known ways to trigger this behavior, -but once it occurs, the hardware is not recovered by normal reset, a driver -reload, or even a warm power cycle of the system. A cold power cycle is -sufficient to recover hardware, but this is extremely invasive and can -result in significant downtime on customer deployments. - -The PHY for each port has a timestamping block which has its own reset -functionality accessible by programming the PHY_REG_GLOBAL register. -Writing to the PHY_REG_GLOBAL_SOFT_RESET_BIT triggers the hardware to -perform a complete reset of the timestamping block of the PHY. This -includes clearing the timestamp status for the port, clearing all -outstanding timestamps in the memory bank, and resetting the PHY timer. - -The new ice_ptp_phy_soft_reset_eth56g() function toggles the -PHY_REG_GLOBAL soft reset bit with the required delays, ensuring the -PHY is properly reinitialized without requiring a full device reset. -The sequence clears the reset bit, asserts it, then clears it again, -with short waits between transitions to allow hardware stabilization. - -Call this function in the new ice_ptp_init_phc_e825c(), implementing the -E825C device specific variant of the ice_ptp_init_phc(). Note that if -ice_ptp_init_phc() fails, PTP functionality may be disabled, but the driver -will still load to allow basic functionality to continue. - -This causes the clock owning PF driver to perform a PHY soft reset for -every port during initialization. This ensures the driver begins life in a -known functional state regardless of how it was previously programmed. - -This ensures that we properly reconfigure the hardware after a device reset -or when loading the driver, even if it was previously misconfigured with an -out-of-date or modified driver. - -Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") -Signed-off-by: Timothy Miskell -Signed-off-by: Grzegorz Nitka -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Petr Oros -Tested-by: Sunitha Mekala -Signed-off-by: Jacob Keller -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-2-bc2240f42251@intel.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -index 7f2f7440e705..d4c2bb084255 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -@@ -377,6 +377,31 @@ static void ice_ptp_cfg_sync_delay(const struct ice_hw *hw, u32 delay) - * The following functions operate on devices with the ETH 56G PHY. - */ - -+/** -+ * ice_ptp_init_phc_e825c - Perform E825C specific PHC initialization -+ * @hw: pointer to HW struct -+ * -+ * Perform E825C-specific PTP hardware clock initialization steps. -+ * -+ * Return: 0 on success, or a negative error value on failure. -+ */ -+static int ice_ptp_init_phc_e825c(struct ice_hw *hw) -+{ -+ int err; -+ -+ /* Soft reset all ports, to ensure everything is at a clean state */ -+ for (int port = 0; port < hw->ptp.num_lports; port++) { -+ err = ice_ptp_phy_soft_reset_eth56g(hw, port); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, "Failed to soft reset port %d, err %d\n", -+ port, err); -+ return err; -+ } -+ } -+ -+ return 0; -+} -+ - /** - * ice_ptp_get_dest_dev_e825 - get destination PHY for given port number - * @hw: pointer to the HW struct -@@ -2179,6 +2204,69 @@ int ice_ptp_read_tx_hwtstamp_status_eth56g(struct ice_hw *hw, u32 *ts_status) - return 0; - } - -+/** -+ * ice_ptp_phy_soft_reset_eth56g - Perform a PHY soft reset on ETH56G -+ * @hw: pointer to the HW structure -+ * @port: PHY port number -+ * -+ * Trigger a soft reset of the ETH56G PHY by toggling the soft reset -+ * bit in the PHY global register. The reset sequence consists of: -+ * 1. Clearing the soft reset bit -+ * 2. Asserting the soft reset bit -+ * 3. Clearing the soft reset bit again -+ * -+ * Short delays are inserted between each step to allow the hardware -+ * to settle. This provides a controlled way to reinitialize the PHY -+ * without requiring a full device reset. -+ * -+ * Return: 0 on success, or a negative error code on failure when -+ * reading or writing the PHY register. -+ */ -+int ice_ptp_phy_soft_reset_eth56g(struct ice_hw *hw, u8 port) -+{ -+ u32 global_val; -+ int err; -+ -+ err = ice_read_ptp_reg_eth56g(hw, port, PHY_REG_GLOBAL, &global_val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, "Failed to read PHY_REG_GLOBAL for port %d, err %d\n", -+ port, err); -+ return err; -+ } -+ -+ global_val &= ~PHY_REG_GLOBAL_SOFT_RESET_M; -+ ice_debug(hw, ICE_DBG_PTP, "Clearing soft reset bit for port %d, val: 0x%x\n", -+ port, global_val); -+ err = ice_write_ptp_reg_eth56g(hw, port, PHY_REG_GLOBAL, global_val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, "Failed to write PHY_REG_GLOBAL for port %d, err %d\n", -+ port, err); -+ return err; -+ } -+ -+ usleep_range(5000, 6000); -+ -+ global_val |= PHY_REG_GLOBAL_SOFT_RESET_M; -+ ice_debug(hw, ICE_DBG_PTP, "Set soft reset bit for port %d, val: 0x%x\n", -+ port, global_val); -+ err = ice_write_ptp_reg_eth56g(hw, port, PHY_REG_GLOBAL, global_val); -+ if (err) { -+ ice_debug(hw, ICE_DBG_PTP, "Failed to write PHY_REG_GLOBAL for port %d, err %d\n", -+ port, err); -+ return err; -+ } -+ usleep_range(5000, 6000); -+ -+ global_val &= ~PHY_REG_GLOBAL_SOFT_RESET_M; -+ ice_debug(hw, ICE_DBG_PTP, "Clear soft reset bit for port %d, val: 0x%x\n", -+ port, global_val); -+ err = ice_write_ptp_reg_eth56g(hw, port, PHY_REG_GLOBAL, global_val); -+ if (err) -+ ice_debug(hw, ICE_DBG_PTP, "Failed to write PHY_REG_GLOBAL for port %d, err %d\n", -+ port, err); -+ return err; -+} -+ - /** - * ice_get_phy_tx_tstamp_ready_eth56g - Read the Tx memory status register - * @hw: pointer to the HW struct -@@ -5592,7 +5680,7 @@ int ice_ptp_init_phc(struct ice_hw *hw) - case ICE_MAC_GENERIC: - return ice_ptp_init_phc_e82x(hw); - case ICE_MAC_GENERIC_3K_E825: -- return 0; -+ return ice_ptp_init_phc_e825c(hw); - default: - return -EOPNOTSUPP; - } -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -index 9bfd3e79c580..ac4611291052 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -@@ -374,6 +374,7 @@ int ice_stop_phy_timer_eth56g(struct ice_hw *hw, u8 port, bool soft_reset); - int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port); - int ice_phy_cfg_intr_eth56g(struct ice_hw *hw, u8 port, bool ena, u8 threshold); - int ice_phy_cfg_ptp_1step_eth56g(struct ice_hw *hw, u8 port); -+int ice_ptp_phy_soft_reset_eth56g(struct ice_hw *hw, u8 port); - - #define ICE_ETH56G_NOMINAL_INCVAL 0x140000000ULL - #define ICE_ETH56G_NOMINAL_PCS_REF_TUS 0x100000000ULL -@@ -676,6 +677,9 @@ static inline u64 ice_get_base_incval(struct ice_hw *hw) - #define ICE_P0_GNSS_PRSNT_N BIT(4) - - /* ETH56G PHY register addresses */ -+#define PHY_REG_GLOBAL 0x0 -+#define PHY_REG_GLOBAL_SOFT_RESET_M BIT(11) -+ - /* Timestamp PHY incval registers */ - #define PHY_REG_TIMETUS_L 0x8 - #define PHY_REG_TIMETUS_U 0xC --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1212-ice-fix-ready-bitmap-check-for-non-e822-devices.patch b/SOURCES/1212-ice-fix-ready-bitmap-check-for-non-e822-devices.patch deleted file mode 100644 index ff518227c..000000000 --- a/SOURCES/1212-ice-fix-ready-bitmap-check-for-non-e822-devices.patch +++ /dev/null @@ -1,333 +0,0 @@ -From 359dc1d41358c88955eeff1b75aee55da7a415d3 Mon Sep 17 00:00:00 2001 -From: Jacob Keller -Date: Mon, 20 Apr 2026 17:51:27 -0700 -Subject: [PATCH] ice: fix ready bitmap check for non-E822 devices - -The E800 hardware (apart from E810) has a ready bitmap for the PHY -indicating which timestamp slots currently have an outstanding timestamp -waiting to be read by software. - -This bitmap is checked in multiple places using the -ice_get_phy_tx_tstamp_ready(): - - * ice_ptp_process_tx_tstamp() calls it to determine which timestamps to - attempt reading from the PHY - * ice_ptp_tx_tstamps_pending() calls it in a loop at the end of the - miscellaneous IRQ to check if new timestamps came in while the interrupt - handler was executing. - * ice_ptp_maybe_trigger_tx_interrupt() calls it in the auxiliary work task - to trigger a software interrupt in the event that the hardware logic - gets stuck. - -For E82X devices, multiple PHYs share the same block, and the parameter -passed to the ready bitmap is a block number associated with the given -port. For E825-C devices, the PHYs have their own independent blocks and do -not share, so the parameter passed needs to be the port number. For E810 -devices, the ice_get_phy_tx_tstamp_ready() always returns all 1s regardless -of what port, since this hardware does not have a ready bitmap. Finally, -for E830 devices, each PF has its own ready bitmap accessible via register, -and the block parameter is unused. - -The first call correctly uses the Tx timestamp tracker block parameter to -check the appropriate timestamp block. This works because the tracker is -setup correctly for each timestamp device type. - -The second two callers behave incorrectly for all device types other than -the older E822 devices. They both iterate in a loop using -ICE_GET_QUAD_NUM() which is a macro only used by E822 devices. This logic -is incorrect for devices other than the E822 devices. - -For E810 the calls would always return true, causing E810 devices to always -attempt to trigger a software interrupt even when they have no reason to. -For E830, this results in duplicate work as the ready bitmap is checked -once per number of quads. Finally, for E825-C, this results in the pending -checks failing to detect timestamps on ports other than the first two. - -Fix this by introducing a new hardware API function to ice_ptp_hw.c, -ice_check_phy_tx_tstamp_ready(). This function will check if any timestamps -are available and returns a positive value if any timestamps are pending. -For E810, the function always returns false, so that the re-trigger checks -never happen. For E830, check the ready bitmap just once. For E82x -hardware, check each quad. Finally, for E825-C, check every port. - -The interface function returns an integer to enable reporting of error code -if the driver is unable read the ready bitmap. This enables callers to -handle this case properly. The previous implementation assumed that -timestamps are available if they failed to read the bitmap. This is -problematic as it could lead to continuous software IRQ triggering if the -PHY timestamp registers somehow become inaccessible. - -This change is especially important for E825-C devices, as the missing -checks could leave a window open where a new timestamp could arrive while -the existing timestamps aren't completed. As a result, the hardware -threshold logic would not trigger a new interrupt. Without the check, the -timestamp is left unhandled, and new timestamps will not cause an interrupt -again until the timestamp is handled. Since both the interrupt check and -the backup check in the auxiliary task do not function properly, the device -may have Tx timestamps permanently stuck failing on a given port. - -The faulty checks originate from commit d938a8cca88a ("ice: Auxbus devices -& driver for E822 TS") and commit 712e876371f8 ("ice: periodically kick Tx -timestamp interrupt"), however at the time of the original coding, both -functions only operated on E822 hardware. This is no longer the case, and -hasn't been since the introduction of the ETH56G PHY model in commit -7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") - -Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Petr Oros -Tested-by: Sunitha Mekala -Signed-off-by: Jacob Keller -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-3-bc2240f42251@intel.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp.c b/drivers/net/ethernet/intel/ice/ice_ptp.c -index 6cb0cf7a9891..36df742c326c 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp.c -@@ -2710,7 +2710,7 @@ static bool ice_any_port_has_timestamps(struct ice_pf *pf) - bool ice_ptp_tx_tstamps_pending(struct ice_pf *pf) - { - struct ice_hw *hw = &pf->hw; -- unsigned int i; -+ int ret; - - /* Check software indicator */ - switch (pf->ptp.tx_interrupt_mode) { -@@ -2731,16 +2731,19 @@ bool ice_ptp_tx_tstamps_pending(struct ice_pf *pf) - } - - /* Check hardware indicator */ -- for (i = 0; i < ICE_GET_QUAD_NUM(hw->ptp.num_lports); i++) { -- u64 tstamp_ready = 0; -- int err; -- -- err = ice_get_phy_tx_tstamp_ready(&pf->hw, i, &tstamp_ready); -- if (err || tstamp_ready) -- return true; -+ ret = ice_check_phy_tx_tstamp_ready(hw); -+ if (ret < 0) { -+ dev_dbg(ice_pf_to_dev(pf), "Unable to read PHY Tx timestamp ready bitmap, err %d\n", -+ ret); -+ /* Stop triggering IRQs if we're unable to read PHY */ -+ return false; - } - -- return false; -+ /* ice_check_phy_tx_tstamp_ready() returns 1 if there are timestamps -+ * available, 0 if there are no waiting timestamps, and a negative -+ * value if there was an error (which we checked for above). -+ */ -+ return ret > 0; - } - - /** -@@ -2824,8 +2827,7 @@ static void ice_ptp_maybe_trigger_tx_interrupt(struct ice_pf *pf) - { - struct device *dev = ice_pf_to_dev(pf); - struct ice_hw *hw = &pf->hw; -- bool trigger_oicr = false; -- unsigned int i; -+ int ret; - - if (!pf->ptp.port.tx.has_ready_bitmap) - return; -@@ -2833,21 +2835,11 @@ static void ice_ptp_maybe_trigger_tx_interrupt(struct ice_pf *pf) - if (!ice_pf_src_tmr_owned(pf)) - return; - -- for (i = 0; i < ICE_GET_QUAD_NUM(hw->ptp.num_lports); i++) { -- u64 tstamp_ready; -- int err; -- -- err = ice_get_phy_tx_tstamp_ready(&pf->hw, i, &tstamp_ready); -- if (!err && tstamp_ready) { -- trigger_oicr = true; -- break; -- } -- } -- -- if (trigger_oicr) { -- /* Trigger a software interrupt, to ensure this data -- * gets processed. -- */ -+ ret = ice_check_phy_tx_tstamp_ready(hw); -+ if (ret < 0) { -+ dev_dbg(dev, "PTP periodic task unable to read PHY timestamp ready bitmap, err %d\n", -+ ret); -+ } else if (ret) { - dev_dbg(dev, "PTP periodic task detected waiting timestamps. Triggering Tx timestamp interrupt now.\n"); - - wr32(hw, PFINT_OICR, PFINT_OICR_TSYN_TX_M); -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -index d4c2bb084255..4795af06b983 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -@@ -2168,6 +2168,35 @@ int ice_start_phy_timer_eth56g(struct ice_hw *hw, u8 port) - return 0; - } - -+/** -+ * ice_check_phy_tx_tstamp_ready_eth56g - Check Tx memory status for all ports -+ * @hw: pointer to the HW struct -+ * -+ * Check the PHY_REG_TX_MEMORY_STATUS for all ports. A set bit indicates -+ * a waiting timestamp. -+ * -+ * Return: 1 if any port has at least one timestamp ready bit set, -+ * 0 otherwise, and a negative error code if unable to read the bitmap. -+ */ -+static int ice_check_phy_tx_tstamp_ready_eth56g(struct ice_hw *hw) -+{ -+ int port; -+ -+ for (port = 0; port < hw->ptp.num_lports; port++) { -+ u64 tstamp_ready; -+ int err; -+ -+ err = ice_get_phy_tx_tstamp_ready(hw, port, &tstamp_ready); -+ if (err) -+ return err; -+ -+ if (tstamp_ready) -+ return 1; -+ } -+ -+ return 0; -+} -+ - /** - * ice_ptp_read_tx_hwtstamp_status_eth56g - Get TX timestamp status - * @hw: pointer to the HW struct -@@ -4318,6 +4347,35 @@ ice_get_phy_tx_tstamp_ready_e82x(struct ice_hw *hw, u8 quad, u64 *tstamp_ready) - return 0; - } - -+/** -+ * ice_check_phy_tx_tstamp_ready_e82x - Check Tx memory status for all quads -+ * @hw: pointer to the HW struct -+ * -+ * Check the Q_REG_TX_MEMORY_STATUS for all quads. A set bit indicates -+ * a waiting timestamp. -+ * -+ * Return: 1 if any quad has at least one timestamp ready bit set, -+ * 0 otherwise, and a negative error value if unable to read the bitmap. -+ */ -+static int ice_check_phy_tx_tstamp_ready_e82x(struct ice_hw *hw) -+{ -+ int quad; -+ -+ for (quad = 0; quad < ICE_GET_QUAD_NUM(hw->ptp.num_lports); quad++) { -+ u64 tstamp_ready; -+ int err; -+ -+ err = ice_get_phy_tx_tstamp_ready(hw, quad, &tstamp_ready); -+ if (err) -+ return err; -+ -+ if (tstamp_ready) -+ return 1; -+ } -+ -+ return 0; -+} -+ - /** - * ice_phy_cfg_intr_e82x - Configure TX timestamp interrupt - * @hw: pointer to the HW struct -@@ -4871,6 +4929,23 @@ ice_get_phy_tx_tstamp_ready_e810(struct ice_hw *hw, u8 port, u64 *tstamp_ready) - return 0; - } - -+/** -+ * ice_check_phy_tx_tstamp_ready_e810 - Check Tx memory status register -+ * @hw: pointer to the HW struct -+ * -+ * The E810 devices do not have a Tx memory status register. Note this is -+ * intentionally different behavior from ice_get_phy_tx_tstamp_ready_e810 -+ * which always says that all bits are ready. This function is called in cases -+ * where code will trigger interrupts if timestamps are waiting, and should -+ * not be called for E810 hardware. -+ * -+ * Return: 0. -+ */ -+static int ice_check_phy_tx_tstamp_ready_e810(struct ice_hw *hw) -+{ -+ return 0; -+} -+ - /* E810 SMA functions - * - * The following functions operate specifically on E810 hardware and are used -@@ -5125,6 +5200,21 @@ static void ice_get_phy_tx_tstamp_ready_e830(const struct ice_hw *hw, u8 port, - *tstamp_ready |= rd32(hw, E830_PRTMAC_TS_TX_MEM_VALID_L); - } - -+/** -+ * ice_check_phy_tx_tstamp_ready_e830 - Check Tx memory status register -+ * @hw: pointer to the HW struct -+ * -+ * Return: 1 if the device has waiting timestamps, 0 otherwise. -+ */ -+static int ice_check_phy_tx_tstamp_ready_e830(struct ice_hw *hw) -+{ -+ u64 tstamp_ready; -+ -+ ice_get_phy_tx_tstamp_ready_e830(hw, 0, &tstamp_ready); -+ -+ return !!tstamp_ready; -+} -+ - /** - * ice_ptp_init_phy_e830 - initialize PHY parameters - * @ptp: pointer to the PTP HW struct -@@ -5717,6 +5807,33 @@ int ice_get_phy_tx_tstamp_ready(struct ice_hw *hw, u8 block, u64 *tstamp_ready) - } - } - -+/** -+ * ice_check_phy_tx_tstamp_ready - Check PHY Tx timestamp memory status -+ * @hw: pointer to the HW struct -+ * -+ * Check the PHY for Tx timestamp memory status on all ports. If you need to -+ * see individual timestamp status for each index, use -+ * ice_get_phy_tx_tstamp_ready() instead. -+ * -+ * Return: 1 if any port has timestamps available, 0 if there are no timestamps -+ * available, and a negative error code on failure. -+ */ -+int ice_check_phy_tx_tstamp_ready(struct ice_hw *hw) -+{ -+ switch (hw->mac_type) { -+ case ICE_MAC_E810: -+ return ice_check_phy_tx_tstamp_ready_e810(hw); -+ case ICE_MAC_E830: -+ return ice_check_phy_tx_tstamp_ready_e830(hw); -+ case ICE_MAC_GENERIC: -+ return ice_check_phy_tx_tstamp_ready_e82x(hw); -+ case ICE_MAC_GENERIC_3K_E825: -+ return ice_check_phy_tx_tstamp_ready_eth56g(hw); -+ default: -+ return -EOPNOTSUPP; -+ } -+} -+ - /** - * ice_cgu_get_pin_desc_e823 - get pin description array - * @hw: pointer to the hw struct -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -index ac4611291052..1c9e77dbc770 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.h -@@ -300,6 +300,7 @@ void ice_ptp_reset_ts_memory(struct ice_hw *hw); - int ice_ptp_init_phc(struct ice_hw *hw); - void ice_ptp_init_hw(struct ice_hw *hw); - int ice_get_phy_tx_tstamp_ready(struct ice_hw *hw, u8 block, u64 *tstamp_ready); -+int ice_check_phy_tx_tstamp_ready(struct ice_hw *hw); - int ice_ptp_one_port_cmd(struct ice_hw *hw, u8 configured_port, - enum ice_ptp_tmr_cmd configured_cmd); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1213-ice-fix-ice-ptp-read-tx-hwtstamp-status-eth56g.patch b/SOURCES/1213-ice-fix-ice-ptp-read-tx-hwtstamp-status-eth56g.patch deleted file mode 100644 index 95b65f30b..000000000 --- a/SOURCES/1213-ice-fix-ice-ptp-read-tx-hwtstamp-status-eth56g.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 1f75dbc53f68f0fb2acd99f92315e426a3d0b446 Mon Sep 17 00:00:00 2001 -From: Jacob Keller -Date: Mon, 20 Apr 2026 17:51:28 -0700 -Subject: [PATCH] ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g - -The ice_ptp_read_tx_hwtstamp_status_eth56g function calls -ice_read_phy_eth56g with a PHY index. However the function actually expects -a port index. This causes the function to read the wrong PHY_PTP_INT_STATUS -registers, and effectively makes the status wrong for the second set of -ports from 4 to 7. - -The ice_read_phy_eth56g function uses the provided port index to determine -which PHY device to read. We could refactor the entire chain to take a PHY -index, but this would impact many code sites. Instead, multiply the PHY -index by the number of ports, so that we read from the first port of each -PHY. - -Fixes: 7cab44f1c35f ("ice: Introduce ETH56G PHY model for E825C products") -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Petr Oros -Tested-by: Sunitha Mekala -Signed-off-by: Jacob Keller -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260420-jk-iwl-net-2026-04-20-ptp-e825c-phy-interrupt-fixes-v1-4-bc2240f42251@intel.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -index 4795af06b983..24fb7a3e14d6 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -+++ b/drivers/net/ethernet/intel/ice/ice_ptp_hw.c -@@ -2219,13 +2219,19 @@ int ice_ptp_read_tx_hwtstamp_status_eth56g(struct ice_hw *hw, u32 *ts_status) - *ts_status = 0; - - for (phy = 0; phy < params->num_phys; phy++) { -+ u8 port; - int err; - -- err = ice_read_phy_eth56g(hw, phy, PHY_PTP_INT_STATUS, &status); -+ /* ice_read_phy_eth56g expects a port index, so use the first -+ * port of the PHY -+ */ -+ port = phy * hw->ptp.ports_per_phy; -+ -+ err = ice_read_phy_eth56g(hw, port, PHY_PTP_INT_STATUS, &status); - if (err) - return err; - -- *ts_status |= (status & mask) << (phy * hw->ptp.ports_per_phy); -+ *ts_status |= (status & mask) << port; - } - - ice_debug(hw, ICE_DBG_PTP, "PHY interrupt err: %x\n", *ts_status); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1214-cifs-make-default-value-of-retrans-as-zero.patch b/SOURCES/1214-cifs-make-default-value-of-retrans-as-zero.patch deleted file mode 100644 index 01a166c8b..000000000 --- a/SOURCES/1214-cifs-make-default-value-of-retrans-as-zero.patch +++ /dev/null @@ -1,41 +0,0 @@ -From b755987ae1e0ceffe730ce1cae499d577aa10fa8 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Fri, 24 Apr 2026 13:56:23 -0300 -Subject: [PATCH] cifs: make default value of retrans as zero - -JIRA: https://issues.redhat.com/browse/RHEL-159632 - -commit e3beefd3af09f8e460ddaf39063d3d7664d7ab59 -Author: Shyam Prasad N -Date: Wed Mar 11 10:48:54 2026 +0530 - - cifs: make default value of retrans as zero - - When retrans mount option was introduced, the default value was set - as 1. However, in the light of some bugs that this has exposed recently - we should change it to 0 and retain the old behaviour before this option - was introduced. - - Cc: - Reviewed-by: Bharath SM - Signed-off-by: Shyam Prasad N - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index 21338c06e026..296a231e8f03 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -2015,7 +2015,7 @@ int smb3_init_fs_context(struct fs_context *fc) - ctx->backupuid_specified = false; /* no backup intent for a user */ - ctx->backupgid_specified = false; /* no backup intent for a group */ - -- ctx->retrans = 1; -+ ctx->retrans = 0; - ctx->reparse_type = CIFS_REPARSE_TYPE_DEFAULT; - ctx->symlink_type = CIFS_SYMLINK_TYPE_DEFAULT; - ctx->nonativesocket = 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1215-net-sched-act-csum-validate-nested-vlan-headers.patch b/SOURCES/1215-net-sched-act-csum-validate-nested-vlan-headers.patch deleted file mode 100644 index 443a0d5bf..000000000 --- a/SOURCES/1215-net-sched-act-csum-validate-nested-vlan-headers.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 5d5232da1baa2166824e36281792850a35621cb8 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 27 Apr 2026 10:27:43 +0000 -Subject: [PATCH] net: sched: act_csum: validate nested VLAN headers - -JIRA: https://redhat.atlassian.net/browse/RHEL-171139 -CVE: CVE-2026-31684 - -commit c842743d073bdd683606cb414eb0ca84465dd834 -Author: Ruide Cao -Date: Thu Apr 2 22:46:20 2026 +0800 - - net: sched: act_csum: validate nested VLAN headers - - tcf_csum_act() walks nested VLAN headers directly from skb->data when an - skb still carries in-payload VLAN tags. The current code reads - vlan->h_vlan_encapsulated_proto and then pulls VLAN_HLEN bytes without - first ensuring that the full VLAN header is present in the linear area. - - If only part of an inner VLAN header is linearized, accessing - h_vlan_encapsulated_proto reads past the linear area, and the following - skb_pull(VLAN_HLEN) may violate skb invariants. - - Fix this by requiring pskb_may_pull(skb, VLAN_HLEN) before accessing and - pulling each nested VLAN header. If the header still is not fully - available, drop the packet through the existing error path. - - Fixes: 2ecba2d1e45b ("net: sched: act_csum: Fix csum calc for tagged packets") - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Tested-by: Ren Wei - Signed-off-by: Ruide Cao - Signed-off-by: Ren Wei - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/22df2fcb49f410203eafa5d97963dd36089f4ecf.1774892775.git.caoruide123@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c -index 5cc8e407e791..8ea37c2c3c54 100644 ---- a/net/sched/act_csum.c -+++ b/net/sched/act_csum.c -@@ -603,8 +603,12 @@ TC_INDIRECT_SCOPE int tcf_csum_act(struct sk_buff *skb, - protocol = skb->protocol; - orig_vlan_tag_present = true; - } else { -- struct vlan_hdr *vlan = (struct vlan_hdr *)skb->data; -+ struct vlan_hdr *vlan; - -+ if (!pskb_may_pull(skb, VLAN_HLEN)) -+ goto drop; -+ -+ vlan = (struct vlan_hdr *)skb->data; - protocol = vlan->h_vlan_encapsulated_proto; - skb_pull(skb, VLAN_HLEN); - skb_reset_network_header(skb); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1216-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch b/SOURCES/1216-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch deleted file mode 100644 index 796d7f844..000000000 --- a/SOURCES/1216-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch +++ /dev/null @@ -1,55 +0,0 @@ -From da41cc73d3b75bb43102c2d364b8b3df8c3e1420 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 27 Apr 2026 10:34:55 +0000 -Subject: [PATCH] netfilter: ip6t_eui64: reject invalid MAC header for all - packets - -JIRA: https://redhat.atlassian.net/browse/RHEL-171156 -CVE: CVE-2026-31685 - -commit fdce0b3590f724540795b874b4c8850c90e6b0a8 -Author: Zhengchuan Liang -Date: Sat Apr 4 17:39:47 2026 +0800 - - netfilter: ip6t_eui64: reject invalid MAC header for all packets - - `eui64_mt6()` derives a modified EUI-64 from the Ethernet source address - and compares it with the low 64 bits of the IPv6 source address. - - The existing guard only rejects an invalid MAC header when - `par->fragoff != 0`. For packets with `par->fragoff == 0`, `eui64_mt6()` - can still reach `eth_hdr(skb)` even when the MAC header is not valid. - - Fix this by removing the `par->fragoff != 0` condition so that packets - with an invalid MAC header are rejected before accessing `eth_hdr(skb)`. - - Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Co-developed-by: Yuan Tan - Signed-off-by: Yuan Tan - Suggested-by: Xin Liu - Tested-by: Ren Wei - Signed-off-by: Zhengchuan Liang - Signed-off-by: Ren Wei - Signed-off-by: Florian Westphal - -Signed-off-by: CKI Backport Bot - -diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c -index d704f7ed300c..da69a27e8332 100644 ---- a/net/ipv6/netfilter/ip6t_eui64.c -+++ b/net/ipv6/netfilter/ip6t_eui64.c -@@ -22,8 +22,7 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par) - unsigned char eui64[8]; - - if (!(skb_mac_header(skb) >= skb->head && -- skb_mac_header(skb) + ETH_HLEN <= skb->data) && -- par->fragoff != 0) { -+ skb_mac_header(skb) + ETH_HLEN <= skb->data)) { - par->hotdrop = true; - return false; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1217-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch b/SOURCES/1217-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch deleted file mode 100644 index 8f9ad784a..000000000 --- a/SOURCES/1217-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 1603e6758a3b8a26ac4e8571909826cac456d02f Mon Sep 17 00:00:00 2001 -From: Vitaly Kuznetsov -Date: Mon, 27 Apr 2026 14:44:20 +0200 -Subject: [PATCH] scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for - Hyper-V vFC - -JIRA: https://redhat.atlassian.net/browse/RHEL-159283 - -commit 9cf351b289fb2be22491fa3964f99126db67aa08 -Author: Li Tian -Date: Mon Apr 6 09:53:44 2026 +0800 - - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC - - The storvsc driver has become stricter in handling SRB status codes - returned by the Hyper-V host. When using Virtual Fibre Channel (vFC) - passthrough, the host may return SRB_STATUS_DATA_OVERRUN for - PERSISTENT_RESERVE_IN commands if the allocation length in the CDB does - not match the host's expected response size. - - Currently, this status is treated as a fatal error, propagating - Host_status=0x07 [DID_ERROR] to the SCSI mid-layer. This causes - userspace storage utilities (such as sg_persist) to fail with transport - errors, even when the host has actually returned the requested - reservation data in the buffer. - - Refactor the existing command-specific workarounds into a new helper - function, storvsc_host_mishandles_cmd(), and add PERSISTENT_RESERVE_IN - to the list of commands where SRB status errors should be suppressed for - vFC devices. This ensures that the SCSI mid-layer processes the returned - data buffer instead of terminating the command. - - Signed-off-by: Li Tian - Reviewed-by: Long Li - Reviewed-by: Laurence Oberman - Link: https://patch.msgid.link/20260406015344.12566-1-litian@redhat.com - Signed-off-by: Martin K. Petersen - -Signed-off-by: Vitaly Kuznetsov - -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index c66cfdb5eb03..9b3a964edce2 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1131,6 +1131,26 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request, - kfree(payload); - } - -+/* -+ * The current SCSI handling on the host side does not correctly handle: -+ * INQUIRY with page code 0x80, MODE_SENSE / MODE_SENSE_10 with cmd[2] == 0x1c, -+ * and (for FC) MAINTENANCE_IN / PERSISTENT_RESERVE_IN passthrough. -+ */ -+static bool storvsc_host_mishandles_cmd(u8 opcode, struct hv_device *device) -+{ -+ switch (opcode) { -+ case INQUIRY: -+ case MODE_SENSE: -+ case MODE_SENSE_10: -+ return true; -+ case MAINTENANCE_IN: -+ case PERSISTENT_RESERVE_IN: -+ return hv_dev_is_fc(device); -+ default: -+ return false; -+ } -+} -+ - static void storvsc_on_io_completion(struct storvsc_device *stor_device, - struct vstor_packet *vstor_packet, - struct storvsc_cmd_request *request) -@@ -1141,22 +1161,12 @@ static void storvsc_on_io_completion(struct storvsc_device *stor_device, - stor_pkt = &request->vstor_packet; - - /* -- * The current SCSI handling on the host side does -- * not correctly handle: -- * INQUIRY command with page code parameter set to 0x80 -- * MODE_SENSE and MODE_SENSE_10 command with cmd[2] == 0x1c -- * MAINTENANCE_IN is not supported by HyperV FC passthrough -- * - * Setup srb and scsi status so this won't be fatal. - * We do this so we can distinguish truly fatal failues - * (srb status == 0x4) and off-line the device in that case. - */ - -- if ((stor_pkt->vm_srb.cdb[0] == INQUIRY) || -- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE) || -- (stor_pkt->vm_srb.cdb[0] == MODE_SENSE_10) || -- (stor_pkt->vm_srb.cdb[0] == MAINTENANCE_IN && -- hv_dev_is_fc(device))) { -+ if (storvsc_host_mishandles_cmd(stor_pkt->vm_srb.cdb[0], device)) { - vstor_packet->vm_srb.scsi_status = 0; - vstor_packet->vm_srb.srb_status = SRB_STATUS_SUCCESS; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1218-dpll-zl3073x-add-output-pin-frequency-helper.patch b/SOURCES/1218-dpll-zl3073x-add-output-pin-frequency-helper.patch deleted file mode 100644 index 7f436dae4..000000000 --- a/SOURCES/1218-dpll-zl3073x-add-output-pin-frequency-helper.patch +++ /dev/null @@ -1,158 +0,0 @@ -From 15946df9225ee7086abe595aed92ab1ad5b63cde Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:48:36 +0000 -Subject: [PATCH] dpll: zl3073x: Add output pin frequency helper - -JIRA: https://redhat.atlassian.net/browse/RHEL-164439 - -commit 24e4336a87f5c51263535201218889b5f324511f -Author: Ivan Vecera -Date: Thu Feb 5 16:43:49 2026 +0100 - - dpll: zl3073x: Add output pin frequency helper - - Introduce zl3073x_dev_output_pin_freq_get() helper function to compute - the output pin frequency based on synthesizer frequency, output divisor, - and signal format. For N-div signal formats, the N-pin frequency is - additionally divided by esync_n_period. - - Add zl3073x_out_is_ndiv() helper to check if an output is configured - in N-div mode (2_NDIV or 2_NDIV_INV signal formats). - - Refactor zl3073x_dpll_output_pin_frequency_get() callback to use the - new helper, reducing code duplication and enabling reuse of the - frequency calculation logic in other contexts. - - This is a preparatory change for adding current frequency to the - supported frequencies list in pin properties. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260205154350.3180465-2-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index 09bca2d0926d..dddfcacea5c0 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -301,6 +301,36 @@ u8 zl3073x_dev_out_dpll_get(struct zl3073x_dev *zldev, u8 index) - return zl3073x_synth_dpll_get(synth); - } - -+/** -+ * zl3073x_dev_output_pin_freq_get - get output pin frequency -+ * @zldev: pointer to zl3073x device -+ * @id: output pin id -+ * -+ * Computes the output pin frequency based on the synth frequency, output -+ * divisor, and signal format. For N-div formats, N-pin frequency is -+ * additionally divided by esync_n_period. -+ * -+ * Return: frequency of the given output pin in Hz -+ */ -+static inline u32 -+zl3073x_dev_output_pin_freq_get(struct zl3073x_dev *zldev, u8 id) -+{ -+ const struct zl3073x_synth *synth; -+ const struct zl3073x_out *out; -+ u8 out_id; -+ u32 freq; -+ -+ out_id = zl3073x_output_pin_out_get(id); -+ out = zl3073x_out_state_get(zldev, out_id); -+ synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); -+ freq = zl3073x_synth_freq_get(synth) / out->div; -+ -+ if (zl3073x_out_is_ndiv(out) && zl3073x_is_n_pin(id)) -+ freq /= out->esync_n_period; -+ -+ return freq; -+} -+ - /** - * zl3073x_dev_out_is_diff - check if the given output is differential - * @zldev: pointer to zl3073x device -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 897ed682dbf9..78edc36b17fb 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -916,46 +916,9 @@ zl3073x_dpll_output_pin_frequency_get(const struct dpll_pin *dpll_pin, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- struct zl3073x_dev *zldev = zldpll->dev; - struct zl3073x_dpll_pin *pin = pin_priv; -- const struct zl3073x_synth *synth; -- const struct zl3073x_out *out; -- u32 synth_freq; -- u8 out_id; - -- out_id = zl3073x_output_pin_out_get(pin->id); -- out = zl3073x_out_state_get(zldev, out_id); -- -- /* Get attached synth frequency */ -- synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); -- synth_freq = zl3073x_synth_freq_get(synth); -- -- switch (zl3073x_out_signal_format_get(out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -- /* In case of divided format we have to distiguish between -- * given output pin type. -- * -- * For P-pin the resulting frequency is computed as simple -- * division of synth frequency and output divisor. -- * -- * For N-pin we have to divide additionally by divisor stored -- * in esync_n_period output mailbox register that is used as -- * N-pin divisor for these modes. -- */ -- *frequency = synth_freq / out->div; -- -- if (!zl3073x_dpll_is_p_pin(pin)) -- *frequency = (u32)*frequency / out->esync_n_period; -- -- break; -- default: -- /* In other modes the resulting frequency is computed as -- * division of synth frequency and output divisor. -- */ -- *frequency = synth_freq / out->div; -- break; -- } -+ *frequency = zl3073x_dev_output_pin_freq_get(zldpll->dev, pin->id); - - return 0; - } -diff --git a/drivers/dpll/zl3073x/out.h b/drivers/dpll/zl3073x/out.h -index e8ea7a0e0f07..318f9bb8da3a 100644 ---- a/drivers/dpll/zl3073x/out.h -+++ b/drivers/dpll/zl3073x/out.h -@@ -79,6 +79,23 @@ static inline bool zl3073x_out_is_enabled(const struct zl3073x_out *out) - return !!FIELD_GET(ZL_OUTPUT_CTRL_EN, out->ctrl); - } - -+/** -+ * zl3073x_out_is_ndiv - check if the given output is in N-div mode -+ * @out: pointer to out state -+ * -+ * Return: true if output is in N-div mode, false otherwise -+ */ -+static inline bool zl3073x_out_is_ndiv(const struct zl3073x_out *out) -+{ -+ switch (zl3073x_out_signal_format_get(out)) { -+ case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -+ case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ return true; -+ default: -+ return false; -+ } -+} -+ - /** - * zl3073x_out_synth_get - get synth connected to given output - * @out: pointer to out state --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1219-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch b/SOURCES/1219-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch deleted file mode 100644 index 22a637247..000000000 --- a/SOURCES/1219-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch +++ /dev/null @@ -1,124 +0,0 @@ -From 2e6a41a79f740a6c20f57f13fb94e92662affda5 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:48:37 +0000 -Subject: [PATCH] dpll: zl3073x: Include current frequency in supported - frequencies list - -JIRA: https://redhat.atlassian.net/browse/RHEL-164439 - -commit 85a9aaac4a38a7ce68f30bd7678fca4e8c687fe2 -Author: Ivan Vecera -Date: Thu Feb 5 16:43:50 2026 +0100 - - dpll: zl3073x: Include current frequency in supported frequencies list - - Ensure the current pin frequency is always present in the list of - supported frequencies reported to userspace. Previously, if the - firmware node was missing or didn't include the current operating - frequency in the supported-frequencies-hz property, the pin would - report a frequency that wasn't in its supported list. - - Get the current frequency early in zl3073x_pin_props_get(): - - For input pins: use zl3073x_dev_ref_freq_get() - - For output pins: use zl3073x_dev_output_pin_freq_get() - - Place the current frequency at index 0 of the supported frequencies - array, then append frequencies from the firmware node (if present), - skipping any duplicate of the current frequency. - - Signed-off-by: Ivan Vecera - Link: https://patch.msgid.link/20260205154350.3180465-3-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/prop.c b/drivers/dpll/zl3073x/prop.c -index ad1f099cbe2b..8523dc8c226e 100644 ---- a/drivers/dpll/zl3073x/prop.c -+++ b/drivers/dpll/zl3073x/prop.c -@@ -193,9 +193,10 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - { - struct dpll_pin_frequency *ranges; - struct zl3073x_pin_props *props; -- int i, j, num_freqs, rc; -+ int i, j, num_freqs = 0, rc; -+ u64 *freqs = NULL; - const char *type; -- u64 *freqs; -+ u32 curr_freq; - - props = kzalloc(sizeof(*props), GFP_KERNEL); - if (!props) -@@ -207,6 +208,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - props->dpll_props.capabilities = - DPLL_PIN_CAPABILITIES_PRIORITY_CAN_CHANGE | - DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE; -+ curr_freq = zl3073x_dev_ref_freq_get(zldev, index); - } else { - u8 out, synth; - u32 f; -@@ -220,6 +222,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - synth = zl3073x_dev_out_synth_get(zldev, out); - f = 2 * zl3073x_dev_synth_freq_get(zldev, synth); - props->dpll_props.phase_gran = f ? div_u64(PSEC_PER_SEC, f) : 1; -+ curr_freq = zl3073x_dev_output_pin_freq_get(zldev, index); - } - - props->dpll_props.phase_range.min = S32_MIN; -@@ -230,7 +233,7 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - /* Get firmware node for the given pin */ - rc = zl3073x_prop_pin_fwnode_get(zldev, props, dir, index); - if (rc) -- return props; /* Return if it does not exist */ -+ goto skip_fwnode_props; - - /* Look for label property and store the value as board label */ - fwnode_property_read_string(props->fwnode, "label", -@@ -264,9 +267,10 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - /* Read supported frequencies property if it is specified */ - num_freqs = fwnode_property_count_u64(props->fwnode, - "supported-frequencies-hz"); -- if (num_freqs <= 0) -- /* Return if the property does not exist or number is 0 */ -- return props; -+ if (num_freqs <= 0) { -+ num_freqs = 0; -+ goto skip_fwnode_props; -+ } - - /* The firmware node specifies list of supported frequencies while - * DPLL core pin properties requires list of frequency ranges. -@@ -283,19 +287,25 @@ struct zl3073x_pin_props *zl3073x_pin_props_get(struct zl3073x_dev *zldev, - "supported-frequencies-hz", freqs, - num_freqs); - -- /* Allocate frequency ranges list and fill it */ -- ranges = kcalloc(num_freqs, sizeof(*ranges), GFP_KERNEL); -+skip_fwnode_props: -+ /* Allocate frequency ranges list - extra slot for current frequency */ -+ ranges = kcalloc(num_freqs + 1, sizeof(*ranges), GFP_KERNEL); - if (!ranges) { - rc = -ENOMEM; - goto err_alloc_ranges; - } - -- /* Convert list of frequencies to list of frequency ranges but -- * filter-out frequencies that are not representable by device -+ /* Start with current frequency at index 0 */ -+ ranges[0] = (struct dpll_pin_frequency)DPLL_PIN_FREQUENCY(curr_freq); -+ -+ /* Add frequencies from firmware node, skipping current frequency -+ * and filtering out frequencies not representable by device - */ -- for (i = 0, j = 0; i < num_freqs; i++) { -+ for (i = 0, j = 1; i < num_freqs; i++) { - struct dpll_pin_frequency freq = DPLL_PIN_FREQUENCY(freqs[i]); - -+ if (freqs[i] == curr_freq) -+ continue; - if (zl3073x_pin_check_freq(zldev, dir, index, freqs[i])) { - ranges[j] = freq; - j++; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1220-dpll-zl3073x-fix-ref-frequency-setting.patch b/SOURCES/1220-dpll-zl3073x-fix-ref-frequency-setting.patch deleted file mode 100644 index 5b0862bd6..000000000 --- a/SOURCES/1220-dpll-zl3073x-fix-ref-frequency-setting.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 8823135b96c424be80d82435925a56a9e53d727a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:48:38 +0000 -Subject: [PATCH] dpll: zl3073x: Fix ref frequency setting - -JIRA: https://redhat.atlassian.net/browse/RHEL-164439 - -commit a047497f952831e377564b606dcb74a7cb309384 -Author: Ivan Vecera -Date: Mon Feb 16 20:40:07 2026 +0100 - - dpll: zl3073x: Fix ref frequency setting - - The frequency for an input reference is computed as: - - frequency = freq_base * freq_mult * freq_ratio_m / freq_ratio_n - - Before commit 5bc02b190a3fb ("dpll: zl3073x: Cache all reference - properties in zl3073x_ref"), zl3073x_dpll_input_pin_frequency_set() - explicitly wrote 1 to both the REF_RATIO_M and REF_RATIO_N hardware - registers whenever a new frequency was set. This ensured the FEC ratio - was always reset to 1:1 alongside the new base/multiplier values. - - The refactoring in that commit introduced zl3073x_ref_freq_set() to - update the cached ref state, but this helper only sets freq_base and - freq_mult without resetting freq_ratio_m and freq_ratio_n to 1. Because - zl3073x_ref_state_set() uses a compare-and-write strategy, unchanged - ratio fields are never written to the hardware. If the device previously - had non-unity FEC ratio values, they remain in effect after a frequency - change, resulting in an incorrect computed frequency. - - Explicitly set freq_ratio_m and freq_ratio_n to 1 in zl3073x_ref_freq_set() - to restore the original behavior. - - Fixes: 5bc02b190a3fb ("dpll: zl3073x: Cache all reference properties in zl3073x_ref") - Signed-off-by: Ivan Vecera - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20260216194007.680416-1-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index efc7f59cd9f9..0d8618f5ce8d 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -91,6 +91,8 @@ zl3073x_ref_freq_set(struct zl3073x_ref *ref, u32 freq) - - ref->freq_base = base; - ref->freq_mult = mult; -+ ref->freq_ratio_m = 1; -+ ref->freq_ratio_n = 1; - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1221-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch b/SOURCES/1221-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch deleted file mode 100644 index 2c4c6d416..000000000 --- a/SOURCES/1221-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch +++ /dev/null @@ -1,175 +0,0 @@ -From 991d19f0cadb6fc8c9f4e446e118a0e6121ac3ae Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:48:39 +0000 -Subject: [PATCH] dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for - some chip IDs - -JIRA: https://redhat.atlassian.net/browse/RHEL-164439 - -commit 4cfe066a82cdf9e83e48b16000f55280efc98325 -Author: Ivan Vecera -Date: Fri Feb 20 16:57:54 2026 +0100 - - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs - - The REF_PHASE_OFFSET_COMP register is 48-bit wide on most zl3073x chip - variants, but only 32-bit wide on chip IDs 0x0E30, 0x0E93..0x0E97 and - 0x1F60. The driver unconditionally uses 48-bit read/write operations, - which on 32-bit variants causes reading 2 bytes past the register - boundary (corrupting the value) and writing 2 bytes into the adjacent - register. - - Fix this by storing the chip ID in the device structure during probe - and adding a helper to detect the affected variants. Use the correct - register width for read/write operations and the matching sign extension - bit (31 vs 47) when interpreting the phase compensation value. - - Fixes: 6287262f761e ("dpll: zl3073x: Add support to adjust phase") - Signed-off-by: Ivan Vecera - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20260220155755.448185-1-ivecera@redhat.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 60bf70f3c282..83d7a124ddcd 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -1028,6 +1028,7 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - "Unknown or non-match chip ID: 0x%0x\n", - id); - } -+ zldev->chip_id = id; - - /* Read revision, firmware version and custom config version */ - rc = zl3073x_read_u16(zldev, ZL_REG_REVISION, &revision); -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index dddfcacea5c0..fd2af3c62a7d 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -35,6 +35,7 @@ struct zl3073x_dpll; - * @dev: pointer to device - * @regmap: regmap to access device registers - * @multiop_lock: to serialize multiple register operations -+ * @chip_id: chip ID read from hardware - * @ref: array of input references' invariants - * @out: array of outs' invariants - * @synth: array of synths' invariants -@@ -48,6 +49,7 @@ struct zl3073x_dev { - struct device *dev; - struct regmap *regmap; - struct mutex multiop_lock; -+ u16 chip_id; - - /* Invariants */ - struct zl3073x_ref ref[ZL3073X_NUM_REFS]; -@@ -144,6 +146,32 @@ int zl3073x_write_hwreg_seq(struct zl3073x_dev *zldev, - - int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel); - -+/** -+ * zl3073x_dev_is_ref_phase_comp_32bit - check ref phase comp register size -+ * @zldev: pointer to zl3073x device -+ * -+ * Some chip IDs have a 32-bit wide ref_phase_offset_comp register instead -+ * of the default 48-bit. -+ * -+ * Return: true if the register is 32-bit, false if 48-bit -+ */ -+static inline bool -+zl3073x_dev_is_ref_phase_comp_32bit(struct zl3073x_dev *zldev) -+{ -+ switch (zldev->chip_id) { -+ case 0x0E30: -+ case 0x0E93: -+ case 0x0E94: -+ case 0x0E95: -+ case 0x0E96: -+ case 0x0E97: -+ case 0x1F60: -+ return true; -+ default: -+ return false; -+ } -+} -+ - static inline bool - zl3073x_is_n_pin(u8 id) - { -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 78edc36b17fb..8ffbede117c6 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -475,8 +475,11 @@ zl3073x_dpll_input_pin_phase_adjust_get(const struct dpll_pin *dpll_pin, - ref_id = zl3073x_input_pin_ref_get(pin->id); - ref = zl3073x_ref_state_get(zldev, ref_id); - -- /* Perform sign extension for 48bit signed value */ -- phase_comp = sign_extend64(ref->phase_comp, 47); -+ /* Perform sign extension based on register width */ -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) -+ phase_comp = sign_extend64(ref->phase_comp, 31); -+ else -+ phase_comp = sign_extend64(ref->phase_comp, 47); - - /* Reverse two's complement negation applied during set and convert - * to 32bit signed int -diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c -index aa2de13effa8..6b65e6103999 100644 ---- a/drivers/dpll/zl3073x/ref.c -+++ b/drivers/dpll/zl3073x/ref.c -@@ -121,8 +121,16 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index) - return rc; - - /* Read phase compensation register */ -- rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -- &ref->phase_comp); -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) { -+ u32 val; -+ -+ rc = zl3073x_read_u32(zldev, ZL_REG_REF_PHASE_OFFSET_COMP_32, -+ &val); -+ ref->phase_comp = val; -+ } else { -+ rc = zl3073x_read_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -+ &ref->phase_comp); -+ } - if (rc) - return rc; - -@@ -179,9 +187,16 @@ int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - if (!rc && dref->sync_ctrl != ref->sync_ctrl) - rc = zl3073x_write_u8(zldev, ZL_REG_REF_SYNC_CTRL, - ref->sync_ctrl); -- if (!rc && dref->phase_comp != ref->phase_comp) -- rc = zl3073x_write_u48(zldev, ZL_REG_REF_PHASE_OFFSET_COMP, -- ref->phase_comp); -+ if (!rc && dref->phase_comp != ref->phase_comp) { -+ if (zl3073x_dev_is_ref_phase_comp_32bit(zldev)) -+ rc = zl3073x_write_u32(zldev, -+ ZL_REG_REF_PHASE_OFFSET_COMP_32, -+ ref->phase_comp); -+ else -+ rc = zl3073x_write_u48(zldev, -+ ZL_REG_REF_PHASE_OFFSET_COMP, -+ ref->phase_comp); -+ } - if (rc) - return rc; - -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index d837bee72b17..5573d7188406 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -194,6 +194,7 @@ - #define ZL_REF_CONFIG_DIFF_EN BIT(2) - - #define ZL_REG_REF_PHASE_OFFSET_COMP ZL_REG(10, 0x28, 6) -+#define ZL_REG_REF_PHASE_OFFSET_COMP_32 ZL_REG(10, 0x28, 4) - - #define ZL_REG_REF_SYNC_CTRL ZL_REG(10, 0x2e, 1) - #define ZL_REF_SYNC_CTRL_MODE GENMASK(2, 0) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1222-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch b/SOURCES/1222-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch deleted file mode 100644 index c71bda36c..000000000 --- a/SOURCES/1222-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch +++ /dev/null @@ -1,45 +0,0 @@ -From bc96573280f4aee125de4ca6d502831893339f63 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 2 Apr 2026 14:48:41 +0000 -Subject: [PATCH] dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() - -JIRA: https://redhat.atlassian.net/browse/RHEL-164439 - -commit 676c7af91fcd740d34e7cb788cbc58e3bcafde39 -Author: Felix Gu -Date: Tue Feb 24 19:04:04 2026 +0800 - - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() - - The devm_add_action_or_reset() function already executes the cleanup - action on failure before returning an error, so the explicit goto error - and subsequent zl3073x_dev_dpll_fini() call causes double cleanup. - - Fixes: ebb1031c5137 ("dpll: zl3073x: Refactor DPLL initialization") - Reviewed-by: Ivan Vecera - Signed-off-by: Felix Gu - Link: https://patch.msgid.link/20260224-dpll-v2-1-d7786414a830@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 83d7a124ddcd..179fff5e7d54 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -983,11 +983,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - } - - /* Add devres action to release DPLL related resources */ -- rc = devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev); -- if (rc) -- goto error; -- -- return 0; -+ return devm_add_action_or_reset(zldev->dev, zl3073x_dev_dpll_fini, zldev); - - error: - zl3073x_dev_dpll_fini(zldev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1223-ice-fix-null-pointer-dereference-in-ice-reset-all-vfs.patch b/SOURCES/1223-ice-fix-null-pointer-dereference-in-ice-reset-all-vfs.patch deleted file mode 100644 index f3c5e1683..000000000 --- a/SOURCES/1223-ice-fix-null-pointer-dereference-in-ice-reset-all-vfs.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 54ef02487914c24170c7e1c061e45212dc55365e Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Mon, 27 Apr 2026 22:22:17 -0700 -Subject: [PATCH] ice: fix NULL pointer dereference in ice_reset_all_vfs() -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -ice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi(). -When the VSI rebuild fails (e.g. during NVM firmware update via -nvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path, -leaving txq_map and rxq_map as NULL. The subsequent unconditional call -to ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in -ice_ena_vf_q_mappings() when it accesses vsi->txq_map[0]. - -The single-VF reset path in ice_reset_vf() already handles this -correctly by checking the return value of ice_vf_reconfig_vsi() and -skipping ice_vf_post_vsi_rebuild() on failure. - -Apply the same pattern to ice_reset_all_vfs(): check the return value -of ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and -ice_eswitch_attach_vf() on failure. The VF is left safely disabled -(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can -be recovered via a VFLR triggered by a PCI reset of the VF -(sysfs reset or driver rebind). - -Note that this patch does not prevent the VF VSI rebuild from failing -during NVM update — the underlying cause is firmware being in a -transitional state while the EMP reset is processed, which can cause -Admin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This -patch only prevents the subsequent NULL pointer dereference that -crashes the kernel when the rebuild does fail. - - crash> bt - PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: "kworker/u512:5" - #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee - #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba - #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540 - #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda - #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997 - #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595 - #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2 - [exception RIP: ice_ena_vf_q_mappings+0x79] - RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206 - RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000 - RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000 - RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040 - R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000 - R13: 0000000000000010 R14: R15: - ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 - #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice] - #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice] - #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice] - #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4 - #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de - #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663 - #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9 - - The panic occurs attempting to dereference the NULL pointer in RDX at - ice_sriov.c:294, which loads vsi->txq_map (offset 0x4b8 in ice_vsi). - - The faulting VSI is an allocated slab object but not fully initialized - after a failed ice_vsi_rebuild(): - - crash> struct ice_vsi 0xff34c9efc27d4828 - netdev = 0x0, - rx_rings = 0x0, - tx_rings = 0x0, - q_vectors = 0x0, - txq_map = 0x0, - rxq_map = 0x0, - alloc_txq = 0x10, - num_txq = 0x10, - alloc_rxq = 0x10, - num_rxq = 0x10, - - The nvmupdate64e process was performing NVM firmware update: - - crash> bt 0xff34c9edd1a30000 - PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: "nvmupdate64e" - #0 [ff72159bcd617618] __schedule at ffffffffab5333f8 - #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice] - #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice] - #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice] - #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice] - #8 [ff72159bcd6178b8] ice_read_flat_nvm at ffffffffc0a4034c [ice] - #9 [ff72159bcd617918] ice_devlink_nvm_snapshot at ffffffffc0a6ffa5 [ice] - - dmesg: - ice 0000:13:00.0: firmware recommends not updating fw.mgmt, as it - may result in a downgrade. continuing anyways - ice 0000:13:00.1: ice_init_nvm failed -5 - ice 0000:13:00.1: Rebuild failed, unload and reload driver - -Fixes: 12bb018c538c ("ice: Refactor VF reset") -Signed-off-by: Petr Oros -Tested-by: Rafal Romanowski -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-5-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -index 772f6b07340d..b1f46707dcc0 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -@@ -804,7 +804,12 @@ void ice_reset_all_vfs(struct ice_pf *pf) - ice_vf_ctrl_invalidate_vsi(vf); - - ice_vf_pre_vsi_rebuild(vf); -- ice_vf_rebuild_vsi(vf); -+ if (ice_vf_rebuild_vsi(vf)) { -+ dev_err(dev, "VF %u VSI rebuild failed, leaving VF disabled\n", -+ vf->vf_id); -+ mutex_unlock(&vf->cfg_lock); -+ continue; -+ } - ice_vf_post_vsi_rebuild(vf); - - ice_eswitch_attach_vf(pf, vf); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1224-ice-fix-missing-sma-pin-initialization-in-dpll-subsystem.patch b/SOURCES/1224-ice-fix-missing-sma-pin-initialization-in-dpll-subsystem.patch deleted file mode 100644 index a012174cc..000000000 --- a/SOURCES/1224-ice-fix-missing-sma-pin-initialization-in-dpll-subsystem.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 56a643aed0f0af5c29ebb4593d4917b78344dd48 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Mon, 27 Apr 2026 22:22:19 -0700 -Subject: [PATCH] ice: fix missing SMA pin initialization in DPLL subsystem -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The DPLL SMA/U.FL pin redesign introduced ice_dpll_sw_pin_frequency_get() -which gates frequency reporting on the pin's active flag. This flag is -determined by ice_dpll_sw_pins_update() from the PCA9575 GPIO expander -state. Before the redesign, SMA pins were exposed as direct HW -input/output pins and ice_dpll_frequency_get() returned the CGU -frequency unconditionally — the PCA9575 state was never consulted. - -The PCA9575 powers on with all outputs high, setting ICE_SMA1_DIR_EN, -ICE_SMA1_TX_EN, ICE_SMA2_DIR_EN and ICE_SMA2_TX_EN. Nothing in the -driver writes the register during initialization, so -ice_dpll_sw_pins_update() sees all pins as inactive and -ice_dpll_sw_pin_frequency_get() permanently returns 0 Hz for every -SW pin. - -Fix this by writing a default SMA configuration in -ice_dpll_init_info_sw_pins(): clear all SMA bits, then set SMA1 and -SMA2 as active inputs (DIR_EN=0) with U.FL1 output and U.FL2 input -disabled. Each SMA/U.FL pair shares a physical signal path so only -one pin per pair can be active at a time. U.FL pins still report -frequency 0 after this fix: U.FL1 (output-only) is disabled by -ICE_SMA1_TX_EN which keeps the TX output buffer off, and U.FL2 -(input-only) is disabled by ICE_SMA2_UFL2_RX_DIS. They can be -activated by changing the corresponding SMA pin direction via dpll -netlink. - -Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") -Signed-off-by: Petr Oros -Reviewed-by: Ivan Vecera -Reviewed-by: Arkadiusz Kubalewski -Tested-by: Alexander Nowlin -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-7-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c -index 62f75701d652..498ec2c045f3 100644 ---- a/drivers/net/ethernet/intel/ice/ice_dpll.c -+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c -@@ -4014,6 +4014,7 @@ static int ice_dpll_init_info_sw_pins(struct ice_pf *pf) - struct ice_dpll_pin *pin; - u32 phase_adj_max, caps; - int i, ret; -+ u8 data; - - if (pf->hw.device_id == ICE_DEV_ID_E810C_QSFP) - input_idx_offset = ICE_E810_RCLK_PINS_NUM; -@@ -4073,6 +4074,22 @@ static int ice_dpll_init_info_sw_pins(struct ice_pf *pf) - } - ice_dpll_phase_range_set(&pin->prop.phase_range, phase_adj_max); - } -+ -+ /* Initialize the SMA control register to a known-good default state. -+ * Without this write the PCA9575 GPIO expander retains its power-on -+ * default (all outputs high) which makes all SW pins appear inactive. -+ * Set SMA1 and SMA2 as active inputs, disable U.FL1 output and -+ * U.FL2 input. -+ */ -+ ret = ice_read_sma_ctrl(&pf->hw, &data); -+ if (ret) -+ return ret; -+ data &= ~ICE_ALL_SMA_MASK; -+ data |= ICE_SMA1_TX_EN | ICE_SMA2_TX_EN | ICE_SMA2_UFL2_RX_DIS; -+ ret = ice_write_sma_ctrl(&pf->hw, data); -+ if (ret) -+ return ret; -+ - ret = ice_dpll_pin_state_update(pf, pin, ICE_DPLL_PIN_TYPE_SOFTWARE, - NULL); - if (ret) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1225-ice-fix-sma-and-u-fl-pin-state-changes-affecting-paired-pin.patch b/SOURCES/1225-ice-fix-sma-and-u-fl-pin-state-changes-affecting-paired-pin.patch deleted file mode 100644 index b982f3825..000000000 --- a/SOURCES/1225-ice-fix-sma-and-u-fl-pin-state-changes-affecting-paired-pin.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Mon, 27 Apr 2026 22:22:20 -0700 -Subject: [PATCH] ice: fix SMA and U.FL pin state changes affecting paired pin - -SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and -SMA2/U.FL2) controlled by the PCA9575 GPIO expander. Each pair can -only have one active pin at a time: SMA1 output and U.FL1 output share -the same CGU output, SMA2 input and U.FL2 input share the same CGU -input. The PCA9575 register bits determine which connector in each -pair owns the signal path. - -The driver does not account for this pairing in two places: - -ice_dpll_ufl_pin_state_set() modifies PCA9575 bits and disables the -backing CGU pin without checking whether the U.FL pin is currently -active. Disconnecting an already inactive U.FL pin flips bits that -the paired SMA pin relies on, breaking its connection. - -ice_dpll_sma_direction_set() does not propagate direction changes to -the paired U.FL pin. For SMA2/U.FL2 the ICE_SMA2_UFL2_RX_DIS bit is -never managed, so U.FL2 stays disconnected after SMA2 switches to -output. For both pairs the backing CGU pin of the U.FL side is never -enabled when a direction change activates it, so userspace sees the -pin as disconnected even though the routing is correct. - -Fix by guarding the U.FL disconnect path against inactive pins and by -updating the paired U.FL pin fully on SMA direction changes: manage -ICE_SMA2_UFL2_RX_DIS for the SMA2/U.FL2 pair and enable the backing -CGU pin whenever the peer becomes active. - -Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") -Signed-off-by: Petr Oros -Tested-by: Alexander Nowlin -Reviewed-by: Arkadiusz Kubalewski -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-8-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c -index 498ec2c045f3..3f8cd5b8298b 100644 ---- a/drivers/net/ethernet/intel/ice/ice_dpll.c -+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c -@@ -1171,6 +1171,8 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, - enum dpll_pin_direction direction, - struct netlink_ext_ack *extack) - { -+ struct ice_dplls *d = &p->pf->dplls; -+ struct ice_dpll_pin *peer; - u8 data; - int ret; - -@@ -1189,8 +1191,9 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, - case ICE_DPLL_PIN_SW_2_IDX: - if (direction == DPLL_PIN_DIRECTION_INPUT) { - data &= ~ICE_SMA2_DIR_EN; -+ data |= ICE_SMA2_UFL2_RX_DIS; - } else { -- data &= ~ICE_SMA2_TX_EN; -+ data &= ~(ICE_SMA2_TX_EN | ICE_SMA2_UFL2_RX_DIS); - data |= ICE_SMA2_DIR_EN; - } - break; -@@ -1202,6 +1205,34 @@ static int ice_dpll_sma_direction_set(struct ice_dpll_pin *p, - ret = ice_dpll_pin_state_update(p->pf, p, - ICE_DPLL_PIN_TYPE_SOFTWARE, - extack); -+ if (ret) -+ return ret; -+ -+ /* When a direction change activates the paired U.FL pin, enable -+ * its backing CGU pin so the pin reports as connected. Without -+ * this the U.FL routing is correct but the CGU pin stays disabled -+ * and userspace sees the pin as disconnected. Do not disable the -+ * backing pin when U.FL becomes inactive because the SMA pin may -+ * still be using it. -+ */ -+ peer = &d->ufl[p->idx]; -+ if (peer->active) { -+ struct ice_dpll_pin *target; -+ enum ice_dpll_pin_type type; -+ -+ if (peer->output) { -+ target = peer->output; -+ type = ICE_DPLL_PIN_TYPE_OUTPUT; -+ } else { -+ target = peer->input; -+ type = ICE_DPLL_PIN_TYPE_INPUT; -+ } -+ ret = ice_dpll_pin_enable(&p->pf->hw, target, -+ d->eec.dpll_idx, type, extack); -+ if (!ret) -+ ret = ice_dpll_pin_state_update(p->pf, target, -+ type, extack); -+ } - - return ret; - } -@@ -1253,6 +1284,14 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, - data &= ~ICE_SMA1_MASK; - enable = true; - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -+ /* Skip if U.FL1 is not active, setting TX_EN -+ * while DIR_EN is set would also deactivate -+ * the paired SMA1 output. -+ */ -+ if (data & (ICE_SMA1_DIR_EN | ICE_SMA1_TX_EN)) { -+ ret = 0; -+ goto unlock; -+ } - data |= ICE_SMA1_TX_EN; - enable = false; - } else { -@@ -1267,6 +1306,15 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, - data &= ~ICE_SMA2_UFL2_RX_DIS; - enable = true; - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -+ /* Skip if U.FL2 is not active, setting -+ * UFL2_RX_DIS could also disable the paired -+ * SMA2 input. -+ */ -+ if (!(data & ICE_SMA2_DIR_EN) || -+ (data & ICE_SMA2_UFL2_RX_DIS)) { -+ ret = 0; -+ goto unlock; -+ } - data |= ICE_SMA2_UFL2_RX_DIS; - enable = false; - } else { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1226-dpll-export-dpll-pin-change-ntf-for-use-under-dpll-lock.patch b/SOURCES/1226-dpll-export-dpll-pin-change-ntf-for-use-under-dpll-lock.patch deleted file mode 100644 index f2832bdce..000000000 --- a/SOURCES/1226-dpll-export-dpll-pin-change-ntf-for-use-under-dpll-lock.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 620055cb1036a6125fd912e7a14b47a6572b809b Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Mon, 27 Apr 2026 22:22:21 -0700 -Subject: [PATCH] dpll: export __dpll_pin_change_ntf() for use under dpll_lock - -Export __dpll_pin_change_ntf() so that drivers can send pin change -notifications from within pin callbacks, which are already called -under dpll_lock. Using dpll_pin_change_ntf() in that context would -deadlock. - -Add lockdep_assert_held() to catch misuse without the lock held. - -Acked-by: Vadim Fedorenko -Signed-off-by: Ivan Vecera -Signed-off-by: Petr Oros -Tested-by: Alexander Nowlin -Reviewed-by: Arkadiusz Kubalewski -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index af7ce62ec55c..0ff1658c2dc1 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -900,11 +900,21 @@ int dpll_pin_delete_ntf(struct dpll_pin *pin) - return dpll_pin_event_send(DPLL_CMD_PIN_DELETE_NTF, pin); - } - -+/** -+ * __dpll_pin_change_ntf - notify that the pin has been changed -+ * @pin: registered pin pointer -+ * -+ * Context: caller must hold dpll_lock. Suitable for use inside pin -+ * callbacks which are already invoked under dpll_lock. -+ * Return: 0 if succeeds, error code otherwise. -+ */ - int __dpll_pin_change_ntf(struct dpll_pin *pin) - { -+ lockdep_assert_held(&dpll_lock); - dpll_pin_notify(pin, DPLL_PIN_CHANGED); - return dpll_pin_event_send(DPLL_CMD_PIN_CHANGE_NTF, pin); - } -+EXPORT_SYMBOL_GPL(__dpll_pin_change_ntf); - - /** - * dpll_pin_change_ntf - notify that the pin has been changed -diff --git a/drivers/dpll/dpll_netlink.h b/drivers/dpll/dpll_netlink.h -index dd28b56d27c5..a9cfd55f57fc 100644 ---- a/drivers/dpll/dpll_netlink.h -+++ b/drivers/dpll/dpll_netlink.h -@@ -11,5 +11,3 @@ int dpll_device_delete_ntf(struct dpll_device *dpll); - int dpll_pin_create_ntf(struct dpll_pin *pin); - - int dpll_pin_delete_ntf(struct dpll_pin *pin); -- --int __dpll_pin_change_ntf(struct dpll_pin *pin); -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index b7277a8b484d..f8037f1ab20b 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -286,6 +286,7 @@ int dpll_pin_ref_sync_pair_add(struct dpll_pin *pin, - - int dpll_device_change_ntf(struct dpll_device *dpll); - -+int __dpll_pin_change_ntf(struct dpll_pin *pin); - int dpll_pin_change_ntf(struct dpll_pin *pin); - - int register_dpll_notifier(struct notifier_block *nb); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1227-ice-fix-missing-dpll-notifications-for-sw-pins.patch b/SOURCES/1227-ice-fix-missing-dpll-notifications-for-sw-pins.patch deleted file mode 100644 index e2ce7e42e..000000000 --- a/SOURCES/1227-ice-fix-missing-dpll-notifications-for-sw-pins.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Mon, 27 Apr 2026 22:22:22 -0700 -Subject: [PATCH] ice: fix missing dpll notifications for SW pins - -The SMA/U.FL pin redesign (commit 2dd5d03c77e2 ("ice: redesign dpll -sma/u.fl pins control")) introduced software-controlled pins that wrap -backing CGU input/output pins, but never updated the notification and -data paths to propagate pin events to these SW wrappers. - -The periodic work sends dpll_pin_change_ntf() only for direct CGU input -pins. SW pins that wrap these inputs never receive change or phase -offset notifications, so userspace consumers such as synce4l monitoring -SMA pins via dpll netlink never learn about state transitions or phase -offset updates. Similarly, ice_dpll_phase_offset_get() reads the SW -pin's own phase_offset field which is never updated; the PPS monitor -writes to the backing CGU input's field instead. - -Fix by introducing ice_dpll_pin_ntf(), a wrapper around -dpll_pin_change_ntf() that also notifies any registered SMA/U.FL pin -whose backing CGU input matches. Replace all direct -dpll_pin_change_ntf() calls in the periodic notification paths with -this wrapper. Fix ice_dpll_phase_offset_get() to return the backing -CGU input's phase_offset for input-direction SW pins. - -Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") -Signed-off-by: Petr Oros -Tested-by: Alexander Nowlin -Reviewed-by: Arkadiusz Kubalewski -Reviewed-by: Aleksandr Loktionov -Reviewed-by: Ivan Vecera -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-10-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c -index 3f8cd5b8298b..721a3f4d6a28 100644 ---- a/drivers/net/ethernet/intel/ice/ice_dpll.c -+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c -@@ -1963,7 +1963,10 @@ ice_dpll_phase_offset_get(const struct dpll_pin *pin, void *pin_priv, - d->active_input == p->input->pin)) - *phase_offset = d->phase_offset * ICE_DPLL_PHASE_OFFSET_FACTOR; - else if (d->phase_offset_monitor_period) -- *phase_offset = p->phase_offset * ICE_DPLL_PHASE_OFFSET_FACTOR; -+ *phase_offset = (p->input && -+ p->direction == DPLL_PIN_DIRECTION_INPUT ? -+ p->input->phase_offset : -+ p->phase_offset) * ICE_DPLL_PHASE_OFFSET_FACTOR; - else - *phase_offset = 0; - mutex_unlock(&pf->dplls.lock); -@@ -2657,6 +2660,27 @@ static u64 ice_generate_clock_id(struct ice_pf *pf) - return pci_get_dsn(pf->pdev); - } - -+/** -+ * ice_dpll_pin_ntf - notify pin change including any SW pin wrappers -+ * @dplls: pointer to dplls struct -+ * @pin: the dpll_pin that changed -+ * -+ * Send a change notification for @pin and for any registered SMA/U.FL pin -+ * whose backing CGU input matches @pin. -+ */ -+static void ice_dpll_pin_ntf(struct ice_dplls *dplls, struct dpll_pin *pin) -+{ -+ dpll_pin_change_ntf(pin); -+ for (int i = 0; i < ICE_DPLL_PIN_SW_NUM; i++) { -+ if (dplls->sma[i].pin && dplls->sma[i].input && -+ dplls->sma[i].input->pin == pin) -+ dpll_pin_change_ntf(dplls->sma[i].pin); -+ if (dplls->ufl[i].pin && dplls->ufl[i].input && -+ dplls->ufl[i].input->pin == pin) -+ dpll_pin_change_ntf(dplls->ufl[i].pin); -+ } -+} -+ - /** - * ice_dpll_notify_changes - notify dpll subsystem about changes - * @d: pointer do dpll -@@ -2665,6 +2689,7 @@ static u64 ice_generate_clock_id(struct ice_pf *pf) - */ - static void ice_dpll_notify_changes(struct ice_dpll *d) - { -+ struct ice_dplls *dplls = &d->pf->dplls; - bool pin_notified = false; - - if (d->prev_dpll_state != d->dpll_state) { -@@ -2673,17 +2698,17 @@ static void ice_dpll_notify_changes(struct ice_dpll *d) - } - if (d->prev_input != d->active_input) { - if (d->prev_input) -- dpll_pin_change_ntf(d->prev_input); -+ ice_dpll_pin_ntf(dplls, d->prev_input); - d->prev_input = d->active_input; - if (d->active_input) { -- dpll_pin_change_ntf(d->active_input); -+ ice_dpll_pin_ntf(dplls, d->active_input); - pin_notified = true; - } - } - if (d->prev_phase_offset != d->phase_offset) { - d->prev_phase_offset = d->phase_offset; - if (!pin_notified && d->active_input) -- dpll_pin_change_ntf(d->active_input); -+ ice_dpll_pin_ntf(dplls, d->active_input); - } - } - -@@ -2712,6 +2737,7 @@ static bool ice_dpll_is_pps_phase_monitor(struct ice_pf *pf) - - /** - * ice_dpll_pins_notify_mask - notify dpll subsystem about bulk pin changes -+ * @dplls: pointer to dplls struct - * @pins: array of ice_dpll_pin pointers registered within dpll subsystem - * @pin_num: number of pins - * @phase_offset_ntf_mask: bitmask of pin indexes to notify -@@ -2721,15 +2747,14 @@ static bool ice_dpll_is_pps_phase_monitor(struct ice_pf *pf) - * - * Context: Must be called while pf->dplls.lock is released. - */ --static void ice_dpll_pins_notify_mask(struct ice_dpll_pin *pins, -+static void ice_dpll_pins_notify_mask(struct ice_dplls *dplls, -+ struct ice_dpll_pin *pins, - u8 pin_num, - u32 phase_offset_ntf_mask) - { -- int i = 0; -- -- for (i = 0; i < pin_num; i++) -- if (phase_offset_ntf_mask & (1 << i)) -- dpll_pin_change_ntf(pins[i].pin); -+ for (int i = 0; i < pin_num; i++) -+ if (phase_offset_ntf_mask & BIT(i)) -+ ice_dpll_pin_ntf(dplls, pins[i].pin); - } - - /** -@@ -2905,7 +2930,7 @@ static void ice_dpll_periodic_work(struct kthread_work *work) - ice_dpll_notify_changes(de); - ice_dpll_notify_changes(dp); - if (phase_offset_ntf) -- ice_dpll_pins_notify_mask(d->inputs, d->num_inputs, -+ ice_dpll_pins_notify_mask(d, d->inputs, d->num_inputs, - phase_offset_ntf); - - resched: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1228-ice-add-dpll-peer-notification-for-paired-sma-and-u-fl-pins.patch b/SOURCES/1228-ice-add-dpll-peer-notification-for-paired-sma-and-u-fl-pins.patch deleted file mode 100644 index 989bd8121..000000000 --- a/SOURCES/1228-ice-add-dpll-peer-notification-for-paired-sma-and-u-fl-pins.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 9e5dead140af10e8b5f975b8f04e46197d48d274 Mon Sep 17 00:00:00 2001 -From: Petr Oros -Date: Mon, 27 Apr 2026 22:22:23 -0700 -Subject: [PATCH] ice: add dpll peer notification for paired SMA and U.FL pins - -SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and -SMA2/U.FL2). When one pin's state changes via a PCA9575 GPIO write, -the paired pin's state also changes, but no notification is sent for -the peer pin. Userspace consumers monitoring the peer via dpll netlink -subscribe never learn about the update. - -Add ice_dpll_sw_pin_notify_peer() which sends a change notification for -the paired SW pin. Call it from ice_dpll_pin_sma_direction_set(), -ice_dpll_sma_pin_state_set(), and ice_dpll_ufl_pin_state_set() after -pf->dplls.lock is released. Use __dpll_pin_change_ntf() because -dpll_lock is still held by the dpll netlink layer (dpll_pin_pre_doit). - -Fixes: 2dd5d03c77e2 ("ice: redesign dpll sma/u.fl pins control") -Signed-off-by: Petr Oros -Tested-by: Alexander Nowlin -Reviewed-by: Arkadiusz Kubalewski -Reviewed-by: Aleksandr Loktionov -Signed-off-by: Jacob Keller -Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-11-cdcb48303fd8@intel.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/ethernet/intel/ice/ice_dpll.c b/drivers/net/ethernet/intel/ice/ice_dpll.c -index 721a3f4d6a28..27b460926bac 100644 ---- a/drivers/net/ethernet/intel/ice/ice_dpll.c -+++ b/drivers/net/ethernet/intel/ice/ice_dpll.c -@@ -1154,6 +1154,32 @@ ice_dpll_input_state_get(const struct dpll_pin *pin, void *pin_priv, - extack, ICE_DPLL_PIN_TYPE_INPUT); - } - -+/** -+ * ice_dpll_sw_pin_notify_peer - notify the paired SW pin after a state change -+ * @d: pointer to dplls struct -+ * @changed: the SW pin that was explicitly changed (already notified by dpll core) -+ * -+ * SMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and -+ * SMA2/U.FL2). When one pin's routing changes via the PCA9575 GPIO -+ * expander, the paired pin's state may also change. Send a change -+ * notification for the peer pin so userspace consumers monitoring the -+ * peer via dpll netlink learn about the update. -+ * -+ * Context: Called from dpll_pin_ops callbacks after pf->dplls.lock is -+ * released. Uses __dpll_pin_change_ntf() because dpll_lock is -+ * still held by the dpll netlink layer. -+ */ -+static void ice_dpll_sw_pin_notify_peer(struct ice_dplls *d, -+ struct ice_dpll_pin *changed) -+{ -+ struct ice_dpll_pin *peer; -+ -+ peer = (changed >= d->sma && changed < d->sma + ICE_DPLL_PIN_SW_NUM) ? -+ &d->ufl[changed->idx] : &d->sma[changed->idx]; -+ if (peer->pin) -+ __dpll_pin_change_ntf(peer->pin); -+} -+ - /** - * ice_dpll_sma_direction_set - set direction of SMA pin - * @p: pointer to a pin -@@ -1344,6 +1370,8 @@ ice_dpll_ufl_pin_state_set(const struct dpll_pin *pin, void *pin_priv, - - unlock: - mutex_unlock(&pf->dplls.lock); -+ if (!ret) -+ ice_dpll_sw_pin_notify_peer(&pf->dplls, p); - - return ret; - } -@@ -1462,6 +1490,8 @@ ice_dpll_sma_pin_state_set(const struct dpll_pin *pin, void *pin_priv, - - unlock: - mutex_unlock(&pf->dplls.lock); -+ if (!ret) -+ ice_dpll_sw_pin_notify_peer(&pf->dplls, sma); - - return ret; - } -@@ -1657,6 +1687,8 @@ ice_dpll_pin_sma_direction_set(const struct dpll_pin *pin, void *pin_priv, - mutex_lock(&pf->dplls.lock); - ret = ice_dpll_sma_direction_set(p, direction, extack); - mutex_unlock(&pf->dplls.lock); -+ if (!ret) -+ ice_dpll_sw_pin_notify_peer(&pf->dplls, p); - - return ret; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1229-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch b/SOURCES/1229-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch deleted file mode 100644 index db84b5f88..000000000 --- a/SOURCES/1229-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 43b9c8ac43d8d75a29ff462fc38a362284472817 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 20 Mar 2026 15:10:30 +0100 -Subject: [PATCH] s390/pci: Avoid deadlock between PCI error recovery and mlx5 - crdump - -JIRA: https://issues.redhat.com/browse/RHEL-157931 - -commit 0fd20f65df6aa430454a0deed8f43efa91c54835 -Author: Gerd Bayer -Date: Thu Oct 16 11:27:03 2025 +0200 - - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump - - Do not block PCI config accesses through pci_cfg_access_lock() when - executing the s390 variant of PCI error recovery: Acquire just - device_lock() instead of pci_dev_lock() as powerpc's EEH and - generig PCI AER processing do. - - During error recovery testing a pair of tasks was reported to be hung: - - mlx5_core 0000:00:00.1: mlx5_health_try_recover:338:(pid 5553): health recovery flow aborted, PCI reads still not working - INFO: task kmcheck:72 blocked for more than 122 seconds. - Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 - "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. - task:kmcheck state:D stack:0 pid:72 tgid:72 ppid:2 flags:0x00000000 - Call Trace: - [<000000065256f030>] __schedule+0x2a0/0x590 - [<000000065256f356>] schedule+0x36/0xe0 - [<000000065256f572>] schedule_preempt_disabled+0x22/0x30 - [<0000000652570a94>] __mutex_lock.constprop.0+0x484/0x8a8 - [<000003ff800673a4>] mlx5_unload_one+0x34/0x58 [mlx5_core] - [<000003ff8006745c>] mlx5_pci_err_detected+0x94/0x140 [mlx5_core] - [<0000000652556c5a>] zpci_event_attempt_error_recovery+0xf2/0x398 - [<0000000651b9184a>] __zpci_event_error+0x23a/0x2c0 - INFO: task kworker/u1664:6:1514 blocked for more than 122 seconds. - Not tainted 5.14.0-570.12.1.bringup7.el9.s390x #1 - "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. - task:kworker/u1664:6 state:D stack:0 pid:1514 tgid:1514 ppid:2 flags:0x00000000 - Workqueue: mlx5_health0000:00:00.0 mlx5_fw_fatal_reporter_err_work [mlx5_core] - Call Trace: - [<000000065256f030>] __schedule+0x2a0/0x590 - [<000000065256f356>] schedule+0x36/0xe0 - [<0000000652172e28>] pci_wait_cfg+0x80/0xe8 - [<0000000652172f94>] pci_cfg_access_lock+0x74/0x88 - [<000003ff800916b6>] mlx5_vsc_gw_lock+0x36/0x178 [mlx5_core] - [<000003ff80098824>] mlx5_crdump_collect+0x34/0x1c8 [mlx5_core] - [<000003ff80074b62>] mlx5_fw_fatal_reporter_dump+0x6a/0xe8 [mlx5_core] - [<0000000652512242>] devlink_health_do_dump.part.0+0x82/0x168 - [<0000000652513212>] devlink_health_report+0x19a/0x230 - [<000003ff80075a12>] mlx5_fw_fatal_reporter_err_work+0xba/0x1b0 [mlx5_core] - - No kernel log of the exact same error with an upstream kernel is - available - but the very same deadlock situation can be constructed there, - too: - - - task: kmcheck - mlx5_unload_one() tries to acquire devlink lock while the PCI error - recovery code has set pdev->block_cfg_access by way of - pci_cfg_access_lock() - - task: kworker - mlx5_crdump_collect() tries to set block_cfg_access through - pci_cfg_access_lock() while devlink_health_report() had acquired - the devlink lock. - - A similar deadlock situation can be reproduced by requesting a - crdump with - > devlink health dump show pci/ reporter fw_fatal - - while PCI error recovery is executed on the same physical function - by mlx5_core's pci_error_handlers. On s390 this can be injected with - > zpcictl --reset-fw - - Tests with this patch failed to reproduce that second deadlock situation, - the devlink command is rejected with "kernel answers: Permission denied" - - and we get a kernel log message of: - - mlx5_core 1ed0:00:00.1: mlx5_crdump_collect:50:(pid 254382): crdump: failed to lock vsc gw err -5 - - because the config read of VSC_SEMAPHORE is rejected by the underlying - hardware. - - Two prior attempts to address this issue have been discussed and - ultimately rejected [see link], with the primary argument that s390's - implementation of PCI error recovery is imposing restrictions that - neither powerpc's EEH nor PCI AER handling need. Tests show that PCI - error recovery on s390 is running to completion even without blocking - access to PCI config space. - - Link: https://lore.kernel.org/all/20251007144826.2825134-1-gbayer@linux.ibm.com/ - Cc: stable@vger.kernel.org - Fixes: 4cdf2f4e24ff ("s390/pci: implement minimal PCI error recovery") - Reviewed-by: Niklas Schnelle - Signed-off-by: Gerd Bayer - Signed-off-by: Heiko Carstens - -Signed-off-by: Mete Durlu - -diff --git a/arch/s390/pci/pci_event.c b/arch/s390/pci/pci_event.c -index d930416d4c90..da0de34d2e5c 100644 ---- a/arch/s390/pci/pci_event.c -+++ b/arch/s390/pci/pci_event.c -@@ -187,7 +187,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - * is unbound or probed and that userspace can't access its - * configuration space while we perform recovery. - */ -- pci_dev_lock(pdev); -+ device_lock(&pdev->dev); - if (pdev->error_state == pci_channel_io_perm_failure) { - ers_res = PCI_ERS_RESULT_DISCONNECT; - goto out_unlock; -@@ -254,7 +254,7 @@ static pci_ers_result_t zpci_event_attempt_error_recovery(struct pci_dev *pdev) - if (driver->err_handler->resume) - driver->err_handler->resume(pdev); - out_unlock: -- pci_dev_unlock(pdev); -+ device_unlock(&pdev->dev); - zpci_report_status(zdev, "recovery", status_str); - - return ers_res; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1230-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch b/SOURCES/1230-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch deleted file mode 100644 index 08756c6ab..000000000 --- a/SOURCES/1230-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 35ad416bb63cdbaf389d758699fad43ac0e7995c Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 17:38:22 +0000 -Subject: [PATCH] netfilter: nf_conntrack_helper: pass helper to expect cleanup - -JIRA: https://redhat.atlassian.net/browse/RHEL-172621 -CVE: CVE-2026-43027 - -commit a242a9ae58aa46ff7dae51ce64150a93957abe65 -Author: Qi Tang -Date: Mon Mar 30 00:50:36 2026 +0800 - - netfilter: nf_conntrack_helper: pass helper to expect cleanup - - nf_conntrack_helper_unregister() calls nf_ct_expect_iterate_destroy() - to remove expectations belonging to the helper being unregistered. - However, it passes NULL instead of the helper pointer as the data - argument, so expect_iter_me() never matches any expectation and all - of them survive the cleanup. - - After unregister returns, nfnl_cthelper_del() frees the helper - object immediately. Subsequent expectation dumps or packet-driven - init_conntrack() calls then dereference the freed exp->helper, - causing a use-after-free. - - Pass the actual helper pointer so expectations referencing it are - properly destroyed before the helper object is freed. - - BUG: KASAN: slab-use-after-free in string+0x38f/0x430 - Read of size 1 at addr ffff888003b14d20 by task poc/103 - Call Trace: - string+0x38f/0x430 - vsnprintf+0x3cc/0x1170 - seq_printf+0x17a/0x240 - exp_seq_show+0x2e5/0x560 - seq_read_iter+0x419/0x1280 - proc_reg_read+0x1ac/0x270 - vfs_read+0x179/0x930 - ksys_read+0xef/0x1c0 - Freed by task 103: - The buggy address is located 32 bytes inside of - freed 192-byte region [ffff888003b14d00, ffff888003b14dc0) - - Fixes: ac7b84839003 ("netfilter: expect: add and use nf_ct_expect_iterate helpers") - Signed-off-by: Qi Tang - Reviewed-by: Phil Sutter - Signed-off-by: Pablo Neira Ayuso - -Signed-off-by: CKI Backport Bot - -diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c -index b0ac1604600f..cc44b8f443cb 100644 ---- a/net/netfilter/nf_conntrack_helper.c -+++ b/net/netfilter/nf_conntrack_helper.c -@@ -468,7 +468,7 @@ void nf_conntrack_helper_unregister(struct nf_conntrack_helper *me) - */ - synchronize_rcu(); - -- nf_ct_expect_iterate_destroy(expect_iter_me, NULL); -+ nf_ct_expect_iterate_destroy(expect_iter_me, me); - nf_ct_iterate_destroy(unhelp, me); - } - EXPORT_SYMBOL_GPL(nf_conntrack_helper_unregister); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1231-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch b/SOURCES/1231-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch deleted file mode 100644 index f6e117346..000000000 --- a/SOURCES/1231-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 87c5d4848ddc5c9e1a1d7fe5950b12ab0a601e5a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 18:54:54 +0000 -Subject: [PATCH] HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-172741 -CVE: CVE-2026-43051 - -commit 2f1763f62909ccb6386ac50350fa0abbf5bb16a9 -Author: Benoît Sevens -Date: Tue Mar 3 13:58:28 2026 +0000 - - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq - - The wacom_intuos_bt_irq() function processes Bluetooth HID reports - without sufficient bounds checking. A maliciously crafted short report - can trigger an out-of-bounds read when copying data into the wacom - structure. - - Specifically, report 0x03 requires at least 22 bytes to safely read - the processed data and battery status, while report 0x04 (which - falls through to 0x03) requires 32 bytes. - - Add explicit length checks for these report IDs and log a warning if - a short report is received. - - Signed-off-by: Benoît Sevens - Reviewed-by: Jason Gerecke - Signed-off-by: Jiri Kosina - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 955b39d22524..da6e7410ee34 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -1207,10 +1207,20 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len) - - switch (data[0]) { - case 0x04: -+ if (len < 32) { -+ dev_warn(wacom->pen_input->dev.parent, -+ "Report 0x04 too short: %zu bytes\n", len); -+ break; -+ } - wacom_intuos_bt_process_data(wacom, data + i); - i += 10; - fallthrough; - case 0x03: -+ if (i == 1 && len < 22) { -+ dev_warn(wacom->pen_input->dev.parent, -+ "Report 0x03 too short: %zu bytes\n", len); -+ break; -+ } - wacom_intuos_bt_process_data(wacom, data + i); - i += 10; - wacom_intuos_bt_process_data(wacom, data + i); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1232-redhat-configs-enable-config-sclp-ofb-for-s390x.patch b/SOURCES/1232-redhat-configs-enable-config-sclp-ofb-for-s390x.patch deleted file mode 100644 index d8c8292ae..000000000 --- a/SOURCES/1232-redhat-configs-enable-config-sclp-ofb-for-s390x.patch +++ /dev/null @@ -1,20 +0,0 @@ -From 01a86b8bb27bf5366c60aec47a4ff38f850bfd33 Mon Sep 17 00:00:00 2001 -From: Jan Polensky -Date: Mon, 27 Apr 2026 15:58:48 +0200 -Subject: [PATCH] redhat/configs: enable CONFIG_SCLP_OFB for s390x - -JIRA: https://redhat.atlassian.net/browse/RHEL-169810 -Upstream Status: RHEL-only - -Signed-off-by: Jan Polensky - -diff --git a/redhat/configs/rhel/generic/s390x/CONFIG_SCLP_OFB b/redhat/configs/rhel/generic/s390x/CONFIG_SCLP_OFB -index 9861bafbcfd6..62cca9859dd6 100644 ---- a/redhat/configs/rhel/generic/s390x/CONFIG_SCLP_OFB -+++ b/redhat/configs/rhel/generic/s390x/CONFIG_SCLP_OFB -@@ -1 +1 @@ --# CONFIG_SCLP_OFB is not set -+CONFIG_SCLP_OFB=y --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1233-xfs-delete-attr-leaf-freemap-entries-when-empty.patch b/SOURCES/1233-xfs-delete-attr-leaf-freemap-entries-when-empty.patch deleted file mode 100644 index 317587445..000000000 --- a/SOURCES/1233-xfs-delete-attr-leaf-freemap-entries-when-empty.patch +++ /dev/null @@ -1,78 +0,0 @@ -From fdbdde5a23445e21f8e1a628cf09d1f254a3de1d Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 8 May 2026 14:37:50 +0000 -Subject: [PATCH] xfs: delete attr leaf freemap entries when empty - -JIRA: https://redhat.atlassian.net/browse/RHEL-174056 -CVE: CVE-2026-43158 - -commit 6f13c1d2a6271c2e73226864a0e83de2770b6f34 -Author: Darrick J. Wong -Date: Fri Jan 23 09:27:30 2026 -0800 - - xfs: delete attr leaf freemap entries when empty - - Back in commit 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size - underflow"), Brian Foster observed that it's possible for a small - freemap at the end of the end of the xattr entries array to experience - a size underflow when subtracting the space consumed by an expansion of - the entries array. There are only three freemap entries, which means - that it is not a complete index of all free space in the leaf block. - - This code can leave behind a zero-length freemap entry with a nonzero - base. Subsequent setxattr operations can increase the base up to the - point that it overlaps with another freemap entry. This isn't in and of - itself a problem because the code in _leaf_add that finds free space - ignores any freemap entry with zero size. - - However, there's another bug in the freemap update code in _leaf_add, - which is that it fails to update a freemap entry that begins midway - through the xattr entry that was just appended to the array. That can - result in the freemap containing two entries with the same base but - different sizes (0 for the "pushed-up" entry, nonzero for the entry - that's actually tracking free space). A subsequent _leaf_add can then - allocate xattr namevalue entries on top of the entries array, leading to - data loss. But fixing that is for later. - - For now, eliminate the possibility of confusion by zeroing out the base - of any freemap entry that has zero size. Because the freemap is not - intended to be a complete index of free space, a subsequent failure to - find any free space for a new xattr will trigger block compaction, which - regenerates the freemap. - - It looks like this bug has been in the codebase for quite a long time. - - Cc: # v2.6.12 - Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index fddb55605e0c..8577c01c83bd 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -1593,6 +1593,19 @@ xfs_attr3_leaf_add_work( - min_t(uint16_t, ichdr->freemap[i].size, - sizeof(xfs_attr_leaf_entry_t)); - } -+ -+ /* -+ * Don't leave zero-length freemaps with nonzero base lying -+ * around, because we don't want the code in _remove that -+ * matches on base address to get confused and create -+ * overlapping freemaps. If we end up with no freemap entries -+ * then the next _add will compact the leaf block and -+ * regenerate the freemaps. -+ */ -+ if (ichdr->freemap[i].size == 0 && ichdr->freemap[i].base > 0) { -+ ichdr->freemap[i].base = 0; -+ ichdr->holes = 1; -+ } - } - ichdr->usedbytes += xfs_attr_leaf_entsize(leaf, args->index); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1234-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch b/SOURCES/1234-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch deleted file mode 100644 index fe8a01437..000000000 --- a/SOURCES/1234-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 358cb992d6ec5a8dd5f81ac84a5c545b972dead3 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 8 May 2026 14:37:51 +0000 -Subject: [PATCH] xfs: fix freemap adjustments when adding xattrs to leaf - blocks - -JIRA: https://redhat.atlassian.net/browse/RHEL-174056 -CVE: CVE-2026-43158 - -commit 3eefc0c2b78444b64feeb3783c017d6adc3cd3ce -Author: Darrick J. Wong -Date: Fri Jan 23 09:27:31 2026 -0800 - - xfs: fix freemap adjustments when adding xattrs to leaf blocks - - xfs/592 and xfs/794 both trip this assertion in the leaf block freemap - adjustment code after ~20 minutes of running on my test VMs: - - ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) - + xfs_attr3_leaf_hdr_size(leaf)); - - Upon enabling quite a lot more debugging code, I narrowed this down to - fsstress trying to set a local extended attribute with namelen=3 and - valuelen=71. This results in an entry size of 80 bytes. - - At the start of xfs_attr3_leaf_add_work, the freemap looks like this: - - i 0 base 448 size 0 rhs 448 count 46 - i 1 base 388 size 132 rhs 448 count 46 - i 2 base 2120 size 4 rhs 448 count 46 - firstused = 520 - - where "rhs" is the first byte past the end of the leaf entry array. - This is inconsistent -- the entries array ends at byte 448, but - freemap[1] says there's free space starting at byte 388! - - By the end of the function, the freemap is in worse shape: - - i 0 base 456 size 0 rhs 456 count 47 - i 1 base 388 size 52 rhs 456 count 47 - i 2 base 2120 size 4 rhs 456 count 47 - firstused = 440 - - Important note: 388 is not aligned with the entries array element size - of 8 bytes. - - Based on the incorrect freemap, the name area starts at byte 440, which - is below the end of the entries array! That's why the assertion - triggers and the filesystem shuts down. - - How did we end up here? First, recall from the previous patch that the - freemap array in an xattr leaf block is not intended to be a - comprehensive map of all free space in the leaf block. In other words, - it's perfectly legal to have a leaf block with: - - * 376 bytes in use by the entries array - * freemap[0] has [base = 376, size = 8] - * freemap[1] has [base = 388, size = 1500] - * the space between 376 and 388 is free, but the freemap stopped - tracking that some time ago - - If we add one xattr, the entries array grows to 384 bytes, and - freemap[0] becomes [base = 384, size = 0]. So far, so good. But if we - add a second xattr, the entries array grows to 392 bytes, and freemap[0] - gets pushed up to [base = 392, size = 0]. This is bad, because - freemap[1] hasn't been updated, and now the entries array and the free - space claim the same space. - - The fix here is to adjust all freemap entries so that none of them - collide with the entries array. Note that this fix relies on commit - 2a2b5932db6758 ("xfs: fix attr leaf header freemap.size underflow") and - the previous patch that resets zero length freemap entries to have - base = 0. - - Cc: # v2.6.12 - Fixes: 1da177e4c3f415 ("Linux-2.6.12-rc2") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c -index 8577c01c83bd..bfcac9036c11 100644 ---- a/fs/xfs/libxfs/xfs_attr_leaf.c -+++ b/fs/xfs/libxfs/xfs_attr_leaf.c -@@ -1489,6 +1489,7 @@ xfs_attr3_leaf_add_work( - struct xfs_attr_leaf_name_local *name_loc; - struct xfs_attr_leaf_name_remote *name_rmt; - struct xfs_mount *mp; -+ int old_end, new_end; - int tmp; - int i; - -@@ -1581,17 +1582,36 @@ xfs_attr3_leaf_add_work( - if (be16_to_cpu(entry->nameidx) < ichdr->firstused) - ichdr->firstused = be16_to_cpu(entry->nameidx); - -- ASSERT(ichdr->firstused >= ichdr->count * sizeof(xfs_attr_leaf_entry_t) -- + xfs_attr3_leaf_hdr_size(leaf)); -- tmp = (ichdr->count - 1) * sizeof(xfs_attr_leaf_entry_t) -- + xfs_attr3_leaf_hdr_size(leaf); -+ new_end = ichdr->count * sizeof(struct xfs_attr_leaf_entry) + -+ xfs_attr3_leaf_hdr_size(leaf); -+ old_end = new_end - sizeof(struct xfs_attr_leaf_entry); -+ -+ ASSERT(ichdr->firstused >= new_end); - - for (i = 0; i < XFS_ATTR_LEAF_MAPSIZE; i++) { -- if (ichdr->freemap[i].base == tmp) { -- ichdr->freemap[i].base += sizeof(xfs_attr_leaf_entry_t); -+ int diff = 0; -+ -+ if (ichdr->freemap[i].base == old_end) { -+ /* -+ * This freemap entry starts at the old end of the -+ * leaf entry array, so we need to adjust its base -+ * upward to accomodate the larger array. -+ */ -+ diff = sizeof(struct xfs_attr_leaf_entry); -+ } else if (ichdr->freemap[i].size > 0 && -+ ichdr->freemap[i].base < new_end) { -+ /* -+ * This freemap entry starts in the space claimed by -+ * the new leaf entry. Adjust its base upward to -+ * reflect that. -+ */ -+ diff = new_end - ichdr->freemap[i].base; -+ } -+ -+ if (diff) { -+ ichdr->freemap[i].base += diff; - ichdr->freemap[i].size -= -- min_t(uint16_t, ichdr->freemap[i].size, -- sizeof(xfs_attr_leaf_entry_t)); -+ min_t(uint16_t, ichdr->freemap[i].size, diff); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1235-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch b/SOURCES/1235-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch deleted file mode 100644 index 420393916..000000000 --- a/SOURCES/1235-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 5dda10bce7cd3376e221d2bf7c76aa377bb21266 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 05:41:22 +0000 -Subject: [PATCH] Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to - missing sock_hold - -JIRA: https://redhat.atlassian.net/browse/RHEL-171326 -CVE: CVE-2026-31408 - -commit 598dbba9919c5e36c54fe1709b557d64120cb94b -Author: Hyunwoo Kim -Date: Fri Mar 13 05:26:16 2026 +0900 - - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold - - sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately - releases the lock without holding a reference to the socket. A concurrent - close() can free the socket between the lock release and the subsequent - sk->sk_state access, resulting in a use-after-free. - - Other functions in the same file (sco_sock_timeout(), sco_conn_del()) - correctly use sco_sock_hold() to safely hold a reference under the lock. - - Fix by using sco_sock_hold() to take a reference before releasing the - lock, and adding sock_put() on all exit paths. - - Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") - Signed-off-by: Hyunwoo Kim - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: CKI Backport Bot - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 5f6fb2c3611a..122288db9f16 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -399,7 +399,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) - struct sock *sk; - - sco_conn_lock(conn); -- sk = conn->sk; -+ sk = sco_sock_hold(conn); - sco_conn_unlock(conn); - - if (!sk) -@@ -408,11 +408,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) - BT_DBG("sk %p len %u", sk, skb->len); - - if (sk->sk_state != BT_CONNECTED) -- goto drop; -+ goto drop_put; - -- if (!sock_queue_rcv_skb(sk, skb)) -+ if (!sock_queue_rcv_skb(sk, skb)) { -+ sock_put(sk); - return; -+ } - -+drop_put: -+ sock_put(sk); - drop: - kfree_skb(skb); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1236-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch b/SOURCES/1236-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch deleted file mode 100644 index a4a768b87..000000000 --- a/SOURCES/1236-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch +++ /dev/null @@ -1,233 +0,0 @@ -From 46c275962dc805a5e4ff6e69fcf12442816371c4 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 11 May 2026 14:21:19 -0300 -Subject: [PATCH] smb: client: validate the whole DACL before rewriting it in - cifsacl - -JIRA: https://issues.redhat.com/browse/RHEL-172822 -CVE: CVE-2026-31709 - -commit 0a8cf165566ba55a39fd0f4de172119dd646d39a -Author: Michael Bommarito -Date: Sun Apr 19 20:11:31 2026 -0400 - - smb: client: validate the whole DACL before rewriting it in cifsacl - - build_sec_desc() and id_mode_to_cifs_acl() derive a DACL pointer from a - server-supplied dacloffset and then use the incoming ACL to rebuild the - chmod/chown security descriptor. - - The original fix only checked that the struct smb_acl header fits before - reading dacl_ptr->size or dacl_ptr->num_aces. That avoids the immediate - header-field OOB read, but the rewrite helpers still walk ACEs based on - pdacl->num_aces with no structural validation of the incoming DACL body. - - A malicious server can return a truncated DACL that still contains a - header, claims one or more ACEs, and then drive - replace_sids_and_copy_aces() or set_chmod_dacl() past the validated - extent while they compare or copy attacker-controlled ACEs. - - Factor the DACL structural checks into validate_dacl(), extend them to - validate each ACE against the DACL bounds, and use the shared validator - before the chmod/chown rebuild paths. parse_dacl() reuses the same - validator so the read-side parser and write-side rewrite paths agree on - what constitutes a well-formed incoming DACL. - - Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Assisted-by: Codex:gpt-5-4 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 345d788b1cb2..1b931e82f6aa 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -757,6 +757,77 @@ static void dump_ace(struct smb_ace *pace, char *end_of_acl) - } - #endif - -+static int validate_dacl(struct smb_acl *pdacl, char *end_of_acl) -+{ -+ int i, ace_hdr_size, ace_size, min_ace_size; -+ u16 dacl_size, num_aces; -+ char *acl_base, *end_of_dacl; -+ struct smb_ace *pace; -+ -+ if (!pdacl) -+ return 0; -+ -+ if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl)) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ dacl_size = le16_to_cpu(pdacl->size); -+ if (dacl_size < sizeof(struct smb_acl) || -+ end_of_acl < (char *)pdacl + dacl_size) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ num_aces = le16_to_cpu(pdacl->num_aces); -+ if (!num_aces) -+ return 0; -+ -+ ace_hdr_size = offsetof(struct smb_ace, sid) + -+ offsetof(struct smb_sid, sub_auth); -+ min_ace_size = ace_hdr_size + sizeof(__le32); -+ if (num_aces > (dacl_size - sizeof(struct smb_acl)) / min_ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ return -EINVAL; -+ } -+ -+ end_of_dacl = (char *)pdacl + dacl_size; -+ acl_base = (char *)pdacl; -+ ace_size = sizeof(struct smb_acl); -+ -+ for (i = 0; i < num_aces; ++i) { -+ if (end_of_dacl - acl_base < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ pace = (struct smb_ace *)(acl_base + ace_size); -+ acl_base = (char *)pace; -+ -+ if (end_of_dacl - acl_base < ace_hdr_size || -+ pace->sid.num_subauth == 0 || -+ pace->sid.num_subauth > SID_MAX_SUB_AUTHORITIES) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ ace_size = ace_hdr_size + sizeof(__le32) * pace->sid.num_subauth; -+ if (end_of_dacl - acl_base < ace_size || -+ le16_to_cpu(pace->size) < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ -+ ace_size = le16_to_cpu(pace->size); -+ if (end_of_dacl - acl_base < ace_size) { -+ cifs_dbg(VFS, "ACL too small to parse ACE\n"); -+ return -EINVAL; -+ } -+ } -+ -+ return 0; -+} -+ - static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - struct smb_sid *pownersid, struct smb_sid *pgrpsid, - struct cifs_fattr *fattr, bool mode_from_special_sid) -@@ -764,7 +835,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - int i; - u16 num_aces = 0; - int acl_size; -- char *acl_base; -+ char *acl_base, *end_of_dacl; - struct smb_ace **ppace; - - /* BB need to add parm so we can store the SID BB */ -@@ -776,12 +847,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - return; - } - -- /* validate that we do not go past end of acl */ -- if (end_of_acl < (char *)pdacl + sizeof(struct smb_acl) || -- end_of_acl < (char *)pdacl + le16_to_cpu(pdacl->size)) { -- cifs_dbg(VFS, "ACL too small to parse DACL\n"); -+ if (validate_dacl(pdacl, end_of_acl)) - return; -- } - - cifs_dbg(NOISY, "DACL revision %d size %d num aces %d\n", - le16_to_cpu(pdacl->revision), le16_to_cpu(pdacl->size), -@@ -792,6 +859,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - user/group/other have no permissions */ - fattr->cf_mode &= ~(0777); - -+ end_of_dacl = (char *)pdacl + le16_to_cpu(pdacl->size); - acl_base = (char *)pdacl; - acl_size = sizeof(struct smb_acl); - -@@ -799,36 +867,16 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - if (num_aces > 0) { - umode_t denied_mode = 0; - -- if (num_aces > (le16_to_cpu(pdacl->size) - sizeof(struct smb_acl)) / -- (offsetof(struct smb_ace, sid) + -- offsetof(struct smb_sid, sub_auth) + sizeof(__le16))) -- return; -- - ppace = kmalloc_array(num_aces, sizeof(struct smb_ace *), - GFP_KERNEL); - if (!ppace) - return; - - for (i = 0; i < num_aces; ++i) { -- if (end_of_acl - acl_base < acl_size) -- break; -- - ppace[i] = (struct smb_ace *) (acl_base + acl_size); -- acl_base = (char *)ppace[i]; -- acl_size = offsetof(struct smb_ace, sid) + -- offsetof(struct smb_sid, sub_auth); -- -- if (end_of_acl - acl_base < acl_size || -- ppace[i]->sid.num_subauth == 0 || -- ppace[i]->sid.num_subauth > SID_MAX_SUB_AUTHORITIES || -- (end_of_acl - acl_base < -- acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth) || -- (le16_to_cpu(ppace[i]->size) < -- acl_size + sizeof(__le32) * ppace[i]->sid.num_subauth)) -- break; - - #ifdef CONFIG_CIFS_DEBUG2 -- dump_ace(ppace[i], end_of_acl); -+ dump_ace(ppace[i], end_of_dacl); - #endif - if (mode_from_special_sid && - (compare_sids(&(ppace[i]->sid), -@@ -870,6 +918,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - (void *)ppace[i], - sizeof(struct smb_ace)); */ - -+ acl_base = (char *)ppace[i]; - acl_size = le16_to_cpu(ppace[i]->size); - } - -@@ -1293,10 +1342,9 @@ static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); -- if (end_of_acl < (char *)dacl_ptr + le16_to_cpu(dacl_ptr->size)) { -- cifs_dbg(VFS, "Server returned illegal ACL size\n"); -- return -EINVAL; -- } -+ rc = validate_dacl(dacl_ptr, end_of_acl); -+ if (rc) -+ return rc; - } - - owner_sid_ptr = (struct smb_sid *)((char *)pntsd + -@@ -1669,6 +1717,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); -+ rc = validate_dacl(dacl_ptr, (char *)pntsd + secdesclen); -+ if (rc) { -+ kfree(pntsd); -+ cifs_put_tlink(tlink); -+ return rc; -+ } - if (mode_from_sid) - nsecdesclen += - le16_to_cpu(dacl_ptr->num_aces) * sizeof(struct smb_ace); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1237-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch b/SOURCES/1237-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch deleted file mode 100644 index 757ea87c5..000000000 --- a/SOURCES/1237-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 3c728813e14f108566b7787dae86c63ac78c861c Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 11 May 2026 14:21:19 -0300 -Subject: [PATCH] smb: client: require a full NFS mode SID before reading mode - bits - -JIRA: https://issues.redhat.com/browse/RHEL-172822 - -commit 2757ad3e4b6f9e0fed4c7739594e702abc5cab21 -Author: Michael Bommarito -Date: Mon Apr 20 09:50:58 2026 -0400 - - smb: client: require a full NFS mode SID before reading mode bits - - parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS - mode SID and reads sid.sub_auth[2] to recover the mode bits. - - That assumes the ACE carries three subauthorities, but compare_sids() - only compares min(a, b) subauthorities. A malicious server can return - an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still - matches sid_unix_NFS_mode and then drives the sub_auth[2] read four - bytes past the end of the ACE. - - Require num_subauth >= 3 before treating the ACE as an NFS mode SID. - This keeps the fix local to the special-SID mode path without changing - compare_sids() semantics for the rest of cifsacl. - - Fixes: e2f8fbfb8d09 ("cifs: get mode bits from special sid on stat") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 1b931e82f6aa..114545ee58b7 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -879,6 +879,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - dump_ace(ppace[i], end_of_dacl); - #endif - if (mode_from_special_sid && -+ ppace[i]->sid.num_subauth >= 3 && - (compare_sids(&(ppace[i]->sid), - &sid_unix_NFS_mode) == 0)) { - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1238-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch b/SOURCES/1238-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch deleted file mode 100644 index 22e5cc2c0..000000000 --- a/SOURCES/1238-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 471fe53d5630a3277ae803e170a00c722ef021ec Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 11 May 2026 14:21:19 -0300 -Subject: [PATCH] smb: client: scope end_of_dacl to CIFS_DEBUG2 use in - parse_dacl - -JIRA: https://issues.redhat.com/browse/RHEL-172822 - -commit a55a60886e612bedb0e9a402ba0dca544c4c6a51 -Author: Michael Bommarito -Date: Tue Apr 21 19:40:22 2026 -0400 - - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl - - After validate_dacl() was factored out in commit 149822e5541c, the - local end_of_dacl in parse_dacl() is only read by the dump_ace() - call under #ifdef CONFIG_CIFS_DEBUG2. With CIFS_DEBUG2 off the - variable is assigned but never used, which gcc -W=1 flags as - -Wunused-but-set-variable. - - Remove the local and compute the end-of-dacl pointer inline at the - single call site inside the existing CIFS_DEBUG2 guard. No - functional change: when CIFS_DEBUG2 is enabled the argument value - is identical to what the removed local carried; when CIFS_DEBUG2 - is disabled the code was already dead. - - Reported-by: kernel test robot - Closes: https://lore.kernel.org/oe-kbuild-all/202604220046.tGkRxVtS-lkp@intel.com/ - Fixes: 149822e5541c ("smb: client: validate the whole DACL before rewriting it in cifsacl") - Signed-off-by: Michael Bommarito - Assisted-by: Claude:claude-opus-4-7 - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 114545ee58b7..8638fdfb6ffb 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -835,7 +835,7 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - int i; - u16 num_aces = 0; - int acl_size; -- char *acl_base, *end_of_dacl; -+ char *acl_base; - struct smb_ace **ppace; - - /* BB need to add parm so we can store the SID BB */ -@@ -859,7 +859,6 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - user/group/other have no permissions */ - fattr->cf_mode &= ~(0777); - -- end_of_dacl = (char *)pdacl + le16_to_cpu(pdacl->size); - acl_base = (char *)pdacl; - acl_size = sizeof(struct smb_acl); - -@@ -876,7 +875,8 @@ static void parse_dacl(struct smb_acl *pdacl, char *end_of_acl, - ppace[i] = (struct smb_ace *) (acl_base + acl_size); - - #ifdef CONFIG_CIFS_DEBUG2 -- dump_ace(ppace[i], end_of_dacl); -+ dump_ace(ppace[i], -+ (char *)pdacl + le16_to_cpu(pdacl->size)); - #endif - if (mode_from_special_sid && - ppace[i]->sid.num_subauth >= 3 && --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1239-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch b/SOURCES/1239-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch deleted file mode 100644 index fefd8a143..000000000 --- a/SOURCES/1239-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch +++ /dev/null @@ -1,57 +0,0 @@ -From aa745912584aeada31b5672155cd1014c4b5f149 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 11 May 2026 14:21:19 -0300 -Subject: [PATCH] smb: client: use kzalloc to zero-initialize security - descriptor buffer - -JIRA: https://issues.redhat.com/browse/RHEL-172822 - -commit 5e489c6c47a2ac15edbaca153b9348e42c1eacab -Author: Bjoern Doebel -Date: Thu Apr 30 08:57:17 2026 +0000 - - smb: client: use kzalloc to zero-initialize security descriptor buffer - - Commit 62e7dd0a39c2d ("smb: common: change the data type of num_aces - to le16") split struct smb_acl's __le32 num_aces field into __le16 - num_aces and __le16 reserved. The reserved field corresponds to Sbz2 - in the MS-DTYP ACL wire format, which must be zero [1]. - - When building an ACL descriptor in build_sec_desc(), we are using a - kmalloc()'ed descriptor buffer and writing the fields explicitly using - le16() writes now. This never writes to the 2 byte reserved field, - leaving it as uninitialized heap data. - - When the reserved field happens to contain non-zero slab garbage, - Samba rejects the security descriptor with "ndr_pull_security_descriptor - failed: Range Error", causing chmod to fail with EINVAL. - - Change kmalloc() to kzalloc() to ensure the entire buffer is - zero-initialized. - - Fixes: 62e7dd0a39c2d ("smb: common: change the data type of num_aces to le16") - Cc: stable@vger.kernel.org - - Signed-off-by: Bjoern Doebel - Assisted-by: Kiro:claude-opus-4.6 - [1] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/20233ed8-a6c6-4097-aafa-dd545ed24428 - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index 8638fdfb6ffb..e23bbe088221 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -1739,7 +1739,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - * descriptor parameters, and security descriptor itself - */ - nsecdesclen = max_t(u32, nsecdesclen, DEFAULT_SEC_DESC_LEN); -- pnntsd = kmalloc(nsecdesclen, GFP_KERNEL); -+ pnntsd = kzalloc(nsecdesclen, GFP_KERNEL); - if (!pnntsd) { - kfree(pntsd); - cifs_put_tlink(tlink); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1240-smb-client-validate-dacloffset-before-building-dacl-pointers.patch b/SOURCES/1240-smb-client-validate-dacloffset-before-building-dacl-pointers.patch deleted file mode 100644 index 08c7765d3..000000000 --- a/SOURCES/1240-smb-client-validate-dacloffset-before-building-dacl-pointers.patch +++ /dev/null @@ -1,123 +0,0 @@ -From 24a3f73bca32fcfcdecad0b9aaaa59def9a938fa Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Mon, 11 May 2026 14:21:20 -0300 -Subject: [PATCH] smb: client: validate dacloffset before building DACL - pointers - -JIRA: https://issues.redhat.com/browse/RHEL-172822 - -commit f98b48151cc502ada59d9778f0112d21f2586ca3 -Author: Michael Bommarito -Date: Mon Apr 20 10:47:47 2026 -0400 - - smb: client: validate dacloffset before building DACL pointers - - parse_sec_desc(), build_sec_desc(), and the chown path in - id_mode_to_cifs_acl() all add the server-supplied dacloffset to pntsd - before proving a DACL header fits inside the returned security - descriptor. - - On 32-bit builds a malicious server can return dacloffset near - U32_MAX, wrap the derived DACL pointer below end_of_acl, and then slip - past the later pointer-based bounds checks. build_sec_desc() and - id_mode_to_cifs_acl() can then dereference DACL fields from the wrapped - pointer in the chmod/chown rewrite paths. - - Validate dacloffset numerically before building any DACL pointer and - reuse the same helper at the three DACL entry points. - - Fixes: bc3e9dd9d104 ("cifs: Change SIDs in ACEs while transferring file ownership.") - Cc: stable@vger.kernel.org - Assisted-by: Claude:claude-opus-4-6 - Signed-off-by: Michael Bommarito - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/cifsacl.c b/fs/smb/client/cifsacl.c -index e23bbe088221..2206506c2e2d 100644 ---- a/fs/smb/client/cifsacl.c -+++ b/fs/smb/client/cifsacl.c -@@ -1264,6 +1264,17 @@ static int parse_sid(struct smb_sid *psid, char *end_of_acl) - return 0; - } - -+static bool dacl_offset_valid(unsigned int acl_len, __u32 dacloffset) -+{ -+ if (acl_len < sizeof(struct smb_acl)) -+ return false; -+ -+ if (dacloffset < sizeof(struct smb_ntsd)) -+ return false; -+ -+ return dacloffset <= acl_len - sizeof(struct smb_acl); -+} -+ - - /* Convert CIFS ACL to POSIX form */ - static int parse_sec_desc(struct cifs_sb_info *cifs_sb, -@@ -1284,7 +1295,6 @@ static int parse_sec_desc(struct cifs_sb_info *cifs_sb, - group_sid_ptr = (struct smb_sid *)((char *)pntsd + - le32_to_cpu(pntsd->gsidoffset)); - dacloffset = le32_to_cpu(pntsd->dacloffset); -- dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - cifs_dbg(NOISY, "revision %d type 0x%x ooffset 0x%x goffset 0x%x sacloffset 0x%x dacloffset 0x%x\n", - pntsd->revision, pntsd->type, le32_to_cpu(pntsd->osidoffset), - le32_to_cpu(pntsd->gsidoffset), -@@ -1315,11 +1325,18 @@ static int parse_sec_desc(struct cifs_sb_info *cifs_sb, - return rc; - } - -- if (dacloffset) -+ if (dacloffset) { -+ if (!dacl_offset_valid(acl_len, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ return -EINVAL; -+ } -+ -+ dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - parse_dacl(dacl_ptr, end_of_acl, owner_sid_ptr, - group_sid_ptr, fattr, get_mode_from_special_sid); -- else -+ } else { - cifs_dbg(FYI, "no ACL\n"); /* BB grant all or default perms? */ -+ } - - return rc; - } -@@ -1342,6 +1359,11 @@ static int build_sec_desc(struct smb_ntsd *pntsd, struct smb_ntsd *pnntsd, - - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -+ if (!dacl_offset_valid(secdesclen, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ return -EINVAL; -+ } -+ - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - rc = validate_dacl(dacl_ptr, end_of_acl); - if (rc) -@@ -1717,6 +1739,12 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - nsecdesclen = sizeof(struct smb_ntsd) + (sizeof(struct smb_sid) * 2); - dacloffset = le32_to_cpu(pntsd->dacloffset); - if (dacloffset) { -+ if (!dacl_offset_valid(secdesclen, dacloffset)) { -+ cifs_dbg(VFS, "Server returned illegal DACL offset\n"); -+ rc = -EINVAL; -+ goto id_mode_to_cifs_acl_exit; -+ } -+ - dacl_ptr = (struct smb_acl *)((char *)pntsd + dacloffset); - rc = validate_dacl(dacl_ptr, (char *)pntsd + secdesclen); - if (rc) { -@@ -1759,6 +1787,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, - rc = ops->set_acl(pnntsd, nsecdesclen, inode, path, aclflag); - cifs_dbg(NOISY, "set_cifs_acl rc: %d\n", rc); - } -+id_mode_to_cifs_acl_exit: - cifs_put_tlink(tlink); - - kfree(pnntsd); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1241-ice-fix-infinite-recursion-in-ice-cfg-tx-topo-via-ice-init-d.patch b/SOURCES/1241-ice-fix-infinite-recursion-in-ice-cfg-tx-topo-via-ice-init-d.patch deleted file mode 100644 index 7a873cd7e..000000000 --- a/SOURCES/1241-ice-fix-infinite-recursion-in-ice-cfg-tx-topo-via-ice-init-d.patch +++ /dev/null @@ -1,106 +0,0 @@ -From a528e9fad40ecec1f53b67c767c9dd1710b4451a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:22:52 +0000 -Subject: [PATCH] ice: fix infinite recursion in ice_cfg_tx_topo via - ice_init_dev_hw - -JIRA: https://redhat.atlassian.net/browse/RHEL-142433 - -commit 70ad216411e030f67b1743774e245601194aee6a -Author: Petr Oros -Date: Mon Apr 27 22:22:18 2026 -0700 - - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw - - On certain E810 configurations where firmware supports Tx scheduler - topology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo() - may need to apply a new 5-layer or 9-layer topology from the DDP - package. If the AQ command to set the topology fails (e.g. due to - invalid DDP data or firmware limitations), the global configuration - lock must still be cleared via a CORER reset. - - Commit 86aae43f21cf ("ice: don't leave device non-functional if Tx - scheduler config fails") correctly fixed this by refactoring - ice_cfg_tx_topo() to always trigger CORER after acquiring the global - lock and re-initialize hardware via ice_init_hw() afterwards. - - However, commit 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end - of deinit paths") later moved ice_init_dev_hw() into ice_init_hw(), - breaking the reinit path introduced by 86aae43f21cf. This creates an - infinite recursive call chain: - - ice_init_hw() - ice_init_dev_hw() - ice_cfg_tx_topo() # topology change needed - ice_deinit_hw() - ice_init_hw() # reinit after CORER - ice_init_dev_hw() # recurse - ice_cfg_tx_topo() - ... # stack overflow - - Fix by moving ice_init_dev_hw() back out of ice_init_hw() and calling - it explicitly from ice_probe() and ice_devlink_reinit_up(). The third - caller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw() - during its reinit, it only needs the core HW reinitialization. This - breaks the recursion cleanly without adding flags or guards. - - The deinit ordering changes from commit 8a37f9e2ff40 ("ice: move - ice_deinit_dev() to the end of deinit paths") which fixed slow rmmod - are preserved, only the init-side placement of ice_init_dev_hw() is - reverted. - - Fixes: 8a37f9e2ff40 ("ice: move ice_deinit_dev() to the end of deinit paths") - Signed-off-by: Petr Oros - Reviewed-by: Paul Menzel - Reviewed-by: Jacob Keller - Reviewed-by: Aleksandr Loktionov - Reviewed-by: Przemek Kitszel - Tested-by: Alexander Nowlin - Signed-off-by: Jacob Keller - Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/ice/devlink/devlink.c b/drivers/net/ethernet/intel/ice/devlink/devlink.c -index ac071c5b4ce3..cbd6de027ec0 100644 ---- a/drivers/net/ethernet/intel/ice/devlink/devlink.c -+++ b/drivers/net/ethernet/intel/ice/devlink/devlink.c -@@ -1243,6 +1243,8 @@ static int ice_devlink_reinit_up(struct ice_pf *pf) - return err; - } - -+ ice_init_dev_hw(pf); -+ - /* load MSI-X values */ - ice_set_min_max_msix(pf); - -diff --git a/drivers/net/ethernet/intel/ice/ice_common.c b/drivers/net/ethernet/intel/ice/ice_common.c -index 785bf5cc1b25..94a16872126e 100644 ---- a/drivers/net/ethernet/intel/ice/ice_common.c -+++ b/drivers/net/ethernet/intel/ice/ice_common.c -@@ -1162,8 +1162,6 @@ int ice_init_hw(struct ice_hw *hw) - if (status) - goto err_unroll_fltr_mgmt_struct; - -- ice_init_dev_hw(hw->back); -- - mutex_init(&hw->tnl_lock); - ice_init_chk_recipe_reuse_support(hw); - -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index b6dbdc343998..6b1e6eeedace 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -5339,6 +5339,8 @@ ice_probe(struct pci_dev *pdev, const struct pci_device_id __always_unused *ent) - return err; - } - -+ ice_init_dev_hw(pf); -+ - adapter = ice_adapter_get(pdev); - if (IS_ERR(adapter)) { - err = PTR_ERR(adapter); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1242-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch b/SOURCES/1242-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch deleted file mode 100644 index 4bf255cbe..000000000 --- a/SOURCES/1242-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 1103c96c17fc62af309b95a2b3c8623a7067755c Mon Sep 17 00:00:00 2001 -From: Rafael Aquini -Date: Tue, 12 May 2026 07:59:17 -0400 -Subject: [PATCH] mm/page_alloc: clear page->private in free_pages_prepare() - -JIRA: https://issues.redhat.com/browse/RHEL-174754 -CVE: CVE-2026-43303 -Conflicts: - * minor context differences due to RHEL-9 missing upstream commit dcfe378c81f7 - ("lib: introduce support for page allocation tagging") as well as commit - 53fbef56e07d ("mm: introduce memdesc_flags_t") and its series. - -commit ac1ea219590c09572ed5992dc233bbf7bb70fef9 -Author: Mikhail Gavrilov -Date: Sat Feb 7 22:36:14 2026 +0500 - - mm/page_alloc: clear page->private in free_pages_prepare() - - Several subsystems (slub, shmem, ttm, etc.) use page->private but don't - clear it before freeing pages. When these pages are later allocated as - high-order pages and split via split_page(), tail pages retain stale - page->private values. - - This causes a use-after-free in the swap subsystem. The swap code uses - page->private to track swap count continuations, assuming freshly - allocated pages have page->private == 0. When stale values are present, - swap_count_continued() incorrectly assumes the continuation list is valid - and iterates over uninitialized page->lru containing LIST_POISON values, - causing a crash: - - KASAN: maybe wild-memory-access in range [0xdead000000000100-0xdead000000000107] - RIP: 0010:__do_sys_swapoff+0x1151/0x1860 - - Fix this by clearing page->private in free_pages_prepare(), ensuring all - freed pages have clean state regardless of previous use. - - Link: https://lkml.kernel.org/r/20260207173615.146159-1-mikhail.v.gavrilov@gmail.com - Fixes: 3b8000ae185c ("mm/vmalloc: huge vmalloc backing pages should be split rather than compound") - Signed-off-by: Mikhail Gavrilov - Suggested-by: Zi Yan - Acked-by: Zi Yan - Acked-by: David Hildenbrand (Arm) - Reviewed-by: Vlastimil Babka - Cc: Brendan Jackman - Cc: Chris Li - Cc: Hugh Dickins - Cc: Johannes Weiner - Cc: Kairui Song - Cc: Matthew Wilcox (Oracle) - Cc: Michal Hocko - Cc: Nicholas Piggin - Cc: Suren Baghdasaryan - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Rafael Aquini - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 1c5610fbfb8a..d6607174b2b4 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1160,6 +1160,7 @@ static __always_inline bool free_pages_prepare(struct page *page, - - page_cpupid_reset_last(page); - page->flags &= ~PAGE_FLAGS_CHECK_AT_PREP; -+ page->private = 0; - reset_page_owner(page, order); - page_table_check_free(page, order); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1243-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch b/SOURCES/1243-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch deleted file mode 100644 index 7d3574d8f..000000000 --- a/SOURCES/1243-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 2a2ee3826b4d857b8702e51590223c1fdbb8e49b Mon Sep 17 00:00:00 2001 -From: Olga Kornievskaia -Date: Tue, 17 Mar 2026 11:43:46 -0400 -Subject: [PATCH] pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - -JIRA: https://issues.redhat.com/browse/RHEL-151429 - -commit 5248d8474e594d156bee1ed10339cc16e207a28b -Author: Olga Kornievskaia -Date: Mon Jan 26 14:15:39 2026 -0500 - - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN - - It is possible to have a task get stuck on waiting on the - NFS_LAYOUT_DRAIN in the following scenario - - 1. cpu a: waiter test NFS_LAYOUT_DRAIN (1) and plh_outstanding (1) - 2. cpu b: atomic_dec_and_test() -> clear bit -> wake up - 3. cpu c: sets NFS_LAYOUT_DRAIN again - 4. cpu a: calls wait_on_bit() sleeps forever. - - To expand on this we have say 2 outstanding pnfs write IO that get - ESTALE which causes both to call pnfs_destroy_layout() and set the - NFS_LAYOUT_DRAIN bit but the 1st one doesn't call the - pnfs_put_layout_hdr() yet (as that would prevent the 2nd ESTALE write - from trying to call pnfs_destroy_layout()). If the 1st ESTALE write - is the one that initially sets the NFS_LAYOUT_DRAIN so that new IO - on this file initiates new LAYOUTGET. Another new write would find - NFS_LAYOUT_DRAIN set and phl_outstanding>0 (step 1) and would - wait_on_bit(). LAYOUTGET completes doing step 2. Now, the 2nd of - ESTALE writes is calling pnfs_destory_layout() and set the - NFS_LAYOUT_DRAIN bit (step 3). Finally, the waiting write wakes up - to check the bit and goes back to sleep. - - The problem revolves around the fact that if NFS_LAYOUT_INVALID_STID - was already set, it should not do the work of - pnfs_mark_layout_stateid_invalid(), thus NFS_LAYOUT_DRAIN will not - be set more than once for an invalid layout. - - Suggested-by: Trond Myklebust - Fixes: 880265c77ac4 ("pNFS: Avoid a live lock condition in pnfs_update_layout()") - Signed-off-by: Olga Kornievskaia - Signed-off-by: Anna Schumaker - -Signed-off-by: Olga Kornievskaia - -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 04423ebe8f76..263b9e4855d4 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -465,7 +465,8 @@ pnfs_mark_layout_stateid_invalid(struct pnfs_layout_hdr *lo, - }; - struct pnfs_layout_segment *lseg, *next; - -- set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags); -+ if (test_and_set_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags)) -+ return !list_empty(&lo->plh_segs); - clear_bit(NFS_INO_LAYOUTCOMMIT, &NFS_I(lo->plh_inode)->flags); - list_for_each_entry_safe(lseg, next, &lo->plh_segs, pls_list) - pnfs_clear_lseg_state(lseg, lseg_list); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1244-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch b/SOURCES/1244-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch deleted file mode 100644 index 6ecd17979..000000000 --- a/SOURCES/1244-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch +++ /dev/null @@ -1,89 +0,0 @@ -From d84d98bcf5d6b56fb2f0ea2614773a969bad2c7e Mon Sep 17 00:00:00 2001 -From: Abhi Das -Date: Fri, 8 May 2026 13:36:26 -0500 -Subject: [PATCH] proc: use the same treatment to check proc_lseek as ones for - proc_read_iter et.al - -JIRA: https://redhat.atlassian.net/browse/RHEL-171801 -CVE: CVE-2025-38653 - -commit ff7ec8dc1b646296f8d94c39339e8d3833d16c05 -Author: wangzijie -Date: Sat Jun 7 10:13:53 2025 +0800 - - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al - - Check pde->proc_ops->proc_lseek directly may cause UAF in rmmod scenario. - It's a gap in proc_reg_open() after commit 654b33ada4ab("proc: fix UAF in - proc_get_inode()"). Followed by AI Viro's suggestion, fix it in same - manner. - - Link: https://lkml.kernel.org/r/20250607021353.1127963-1-wangzijie1@honor.com - Fixes: 3f61631d47f1 ("take care to handle NULL ->proc_lseek()") - Signed-off-by: wangzijie - Reviewed-by: Alexey Dobriyan - Cc: Alexei Starovoitov - Cc: Al Viro - Cc: "Edgecombe, Rick P" - Cc: Kirill A. Shuemov - Signed-off-by: Andrew Morton - -Signed-off-by: Abhi Das - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 24ceced87cfe..4e0ac5f5d99c 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -568,6 +568,8 @@ static void pde_set_flags(struct proc_dir_entry *pde) - if (pde->proc_ops->proc_compat_ioctl) - pde->flags |= PROC_ENTRY_proc_compat_ioctl; - #endif -+ if (pde->proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; - } - - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, -diff --git a/fs/proc/inode.c b/fs/proc/inode.c -index f005a3e067e7..32cf53d701fa 100644 ---- a/fs/proc/inode.c -+++ b/fs/proc/inode.c -@@ -487,7 +487,7 @@ static int proc_reg_open(struct inode *inode, struct file *file) - typeof_member(struct proc_ops, proc_release) release; - struct pde_opener *pdeo; - -- if (!pde->proc_ops->proc_lseek) -+ if (!pde_has_proc_lseek(pde)) - file->f_mode &= ~FMODE_LSEEK; - - if (pde_is_permanent(pde)) { -diff --git a/fs/proc/internal.h b/fs/proc/internal.h -index a2ff84c996c6..e85c531ec161 100644 ---- a/fs/proc/internal.h -+++ b/fs/proc/internal.h -@@ -93,6 +93,11 @@ static inline bool pde_has_proc_compat_ioctl(const struct proc_dir_entry *pde) - #endif - } - -+static inline bool pde_has_proc_lseek(const struct proc_dir_entry *pde) -+{ -+ return pde->flags & PROC_ENTRY_proc_lseek; -+} -+ - extern struct kmem_cache *proc_dir_entry_cache; - void pde_free(struct proc_dir_entry *pde); - -diff --git a/include/linux/proc_fs.h b/include/linux/proc_fs.h -index 6f7b89b520d6..b71392fe84d0 100644 ---- a/include/linux/proc_fs.h -+++ b/include/linux/proc_fs.h -@@ -27,6 +27,7 @@ enum { - - PROC_ENTRY_proc_read_iter = 1U << 1, - PROC_ENTRY_proc_compat_ioctl = 1U << 2, -+ PROC_ENTRY_proc_lseek = 1U << 3, - }; - - struct proc_ops { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1245-proc-fix-missing-pde-set-flags-for-net-proc-files.patch b/SOURCES/1245-proc-fix-missing-pde-set-flags-for-net-proc-files.patch deleted file mode 100644 index 43dc097eb..000000000 --- a/SOURCES/1245-proc-fix-missing-pde-set-flags-for-net-proc-files.patch +++ /dev/null @@ -1,140 +0,0 @@ -From f71095c72d407f60b21042f2dfbaad3cd1ab093c Mon Sep 17 00:00:00 2001 -From: Abhi Das -Date: Fri, 8 May 2026 13:37:49 -0500 -Subject: [PATCH] proc: fix missing pde_set_flags() for net proc files -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-171801 -CVE: CVE-2025-38653 - -commit 2ce3d282bd5050fca8577defeff08ada0d55d062 -Author: wangzijie -Date: Mon Aug 18 20:31:02 2025 +0800 - - proc: fix missing pde_set_flags() for net proc files - - To avoid potential UAF issues during module removal races, we use - pde_set_flags() to save proc_ops flags in PDE itself before - proc_register(), and then use pde_has_proc_*() helpers instead of directly - dereferencing pde->proc_ops->*. - - However, the pde_set_flags() call was missing when creating net related - proc files. This omission caused incorrect behavior which FMODE_LSEEK was - being cleared inappropriately in proc_reg_open() for net proc files. Lars - reported it in this link[1]. - - Fix this by ensuring pde_set_flags() is called when register proc entry, - and add NULL check for proc_ops in pde_set_flags(). - - [wangzijie1@honor.com: stash pde->proc_ops in a local const variable, per Christian] - Link: https://lkml.kernel.org/r/20250821105806.1453833-1-wangzijie1@honor.com - Link: https://lkml.kernel.org/r/20250818123102.959595-1-wangzijie1@honor.com - Link: https://lore.kernel.org/all/20250815195616.64497967@chagall.paradoxon.rec/ [1] - Fixes: ff7ec8dc1b64 ("proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al") - Signed-off-by: wangzijie - Reported-by: Lars Wendler - Tested-by: Stefano Brivio - Tested-by: Petr Vaněk - Tested by: Lars Wendler - Cc: Alexei Starovoitov - Cc: Alexey Dobriyan - Cc: Al Viro - Cc: "Edgecombe, Rick P" - Cc: Greg Kroah-Hartman - Cc: Jiri Slaby - Cc: Kirill A. Shutemov - Cc: wangzijie - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Abhi Das - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 4e0ac5f5d99c..1bfff5c905d8 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -363,6 +363,25 @@ static const struct inode_operations proc_dir_inode_operations = { - .setattr = proc_notify_change, - }; - -+static void pde_set_flags(struct proc_dir_entry *pde) -+{ -+ const struct proc_ops *proc_ops = pde->proc_ops; -+ -+ if (!proc_ops) -+ return; -+ -+ if (proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -+ pde->flags |= PROC_ENTRY_PERMANENT; -+ if (proc_ops->proc_read_iter) -+ pde->flags |= PROC_ENTRY_proc_read_iter; -+#ifdef CONFIG_COMPAT -+ if (proc_ops->proc_compat_ioctl) -+ pde->flags |= PROC_ENTRY_proc_compat_ioctl; -+#endif -+ if (proc_ops->proc_lseek) -+ pde->flags |= PROC_ENTRY_proc_lseek; -+} -+ - /* returns the registered entry, or frees dp and returns NULL on failure */ - struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - struct proc_dir_entry *dp) -@@ -370,6 +389,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -+ pde_set_flags(dp); -+ - write_lock(&proc_subdir_lock); - dp->parent = dir; - if (pde_subdir_insert(dir, dp) == false) { -@@ -558,20 +579,6 @@ struct proc_dir_entry *proc_create_reg(const char *name, umode_t mode, - return p; - } - --static void pde_set_flags(struct proc_dir_entry *pde) --{ -- if (pde->proc_ops->proc_flags & PROC_ENTRY_PERMANENT) -- pde->flags |= PROC_ENTRY_PERMANENT; -- if (pde->proc_ops->proc_read_iter) -- pde->flags |= PROC_ENTRY_proc_read_iter; --#ifdef CONFIG_COMPAT -- if (pde->proc_ops->proc_compat_ioctl) -- pde->flags |= PROC_ENTRY_proc_compat_ioctl; --#endif -- if (pde->proc_ops->proc_lseek) -- pde->flags |= PROC_ENTRY_proc_lseek; --} -- - struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - struct proc_dir_entry *parent, - const struct proc_ops *proc_ops, void *data) -@@ -582,7 +589,6 @@ struct proc_dir_entry *proc_create_data(const char *name, umode_t mode, - if (!p) - return NULL; - p->proc_ops = proc_ops; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_data); -@@ -633,7 +639,6 @@ struct proc_dir_entry *proc_create_seq_private(const char *name, umode_t mode, - p->proc_ops = &proc_seq_ops; - p->seq_ops = ops; - p->state_size = state_size; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_seq_private); -@@ -664,7 +669,6 @@ struct proc_dir_entry *proc_create_single_data(const char *name, umode_t mode, - return NULL; - p->proc_ops = &proc_single_ops; - p->single_show = show; -- pde_set_flags(p); - return proc_register(parent, p); - } - EXPORT_SYMBOL(proc_create_single_data); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1246-proc-fix-type-confusion-in-pde-set-flags.patch b/SOURCES/1246-proc-fix-type-confusion-in-pde-set-flags.patch deleted file mode 100644 index ffcfac2a7..000000000 --- a/SOURCES/1246-proc-fix-type-confusion-in-pde-set-flags.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 3dd2462bc961a43d3b0b5faaadada3287e07c973 Mon Sep 17 00:00:00 2001 -From: Abhi Das -Date: Fri, 8 May 2026 13:39:06 -0500 -Subject: [PATCH] proc: fix type confusion in pde_set_flags() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171801 -CVE: CVE-2025-38653 - -commit 0ce9398aa0830f15f92bbed73853f9861c3e74ff -Author: wangzijie -Date: Thu Sep 4 21:57:15 2025 +0800 - - proc: fix type confusion in pde_set_flags() - - Commit 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc - files") missed a key part in the definition of proc_dir_entry: - - union { - const struct proc_ops *proc_ops; - const struct file_operations *proc_dir_ops; - }; - - So dereference of ->proc_ops assumes it is a proc_ops structure results in - type confusion and make NULL check for 'proc_ops' not work for proc dir. - - Add !S_ISDIR(dp->mode) test before calling pde_set_flags() to fix it. - - Link: https://lkml.kernel.org/r/20250904135715.3972782-1-wangzijie1@honor.com - Fixes: 2ce3d282bd50 ("proc: fix missing pde_set_flags() for net proc files") - Signed-off-by: wangzijie - Reported-by: Brad Spengler - Closes: https://lore.kernel.org/all/20250903065758.3678537-1-wangzijie1@honor.com/ - Cc: Alexey Dobriyan - Cc: Al Viro - Cc: Christian Brauner - Cc: Jiri Slaby - Cc: Stefano Brivio - Cc: - Signed-off-by: Andrew Morton - -Signed-off-by: Abhi Das - -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index 1bfff5c905d8..ec49e7ac9cfa 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -389,7 +389,8 @@ struct proc_dir_entry *proc_register(struct proc_dir_entry *dir, - if (proc_alloc_inum(&dp->low_ino)) - goto out_free_entry; - -- pde_set_flags(dp); -+ if (!S_ISDIR(dp->mode)) -+ pde_set_flags(dp); - - write_lock(&proc_subdir_lock); - dp->parent = dir; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1247-crypto-tegra-disable-softirqs-before-finalizing-request.patch b/SOURCES/1247-crypto-tegra-disable-softirqs-before-finalizing-request.patch deleted file mode 100644 index c017e9d21..000000000 --- a/SOURCES/1247-crypto-tegra-disable-softirqs-before-finalizing-request.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 6dadf30d221829ac984d01bc0139550d64a62e10 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 24 Apr 2026 14:35:20 +0000 -Subject: [PATCH] crypto: tegra - Disable softirqs before finalizing request - -JIRA: https://redhat.atlassian.net/browse/RHEL-170915 - -commit 2aeec9af775fb53aa086419b953302c6f4ad4984 -Author: Herbert Xu -Date: Tue Mar 10 18:28:29 2026 +0900 - - crypto: tegra - Disable softirqs before finalizing request - - Softirqs must be disabled when calling the finalization fucntion on - a request. - - Reported-by: Guangwu Zhang - Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") - Signed-off-by: Herbert Xu - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 0e07d0523291..8b91f00b9c31 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -4,6 +4,7 @@ - * Crypto driver to handle block cipher algorithms using NVIDIA Security Engine. - */ - -+#include - #include - #include - #include -@@ -333,7 +334,9 @@ static int tegra_aes_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, key2_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_skcipher_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1261,7 +1264,9 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_aead_request(ctx->se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1347,7 +1352,9 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - - out_finalize: -+ local_bh_disable(); - crypto_finalize_aead_request(ctx->se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -@@ -1745,7 +1752,9 @@ static int tegra_cmac_do_one_req(struct crypto_engine *engine, void *areq) - if (tegra_key_is_reserved(rctx->key_id)) - tegra_key_invalidate_reserved(ctx->se, rctx->key_id, ctx->alg); - -+ local_bh_disable(); - crypto_finalize_hash_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 42d007b7af45..90bf34eb3578 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -4,6 +4,7 @@ - * Crypto driver to handle HASH algorithms using NVIDIA Security Engine. - */ - -+#include - #include - #include - #include -@@ -543,7 +544,9 @@ static int tegra_sha_do_one_req(struct crypto_engine *engine, void *areq) - } - - out: -+ local_bh_disable(); - crypto_finalize_hash_request(se->engine, req, ret); -+ local_bh_enable(); - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1248-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch b/SOURCES/1248-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch deleted file mode 100644 index cc3edb22a..000000000 --- a/SOURCES/1248-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch +++ /dev/null @@ -1,46 +0,0 @@ -From c6005c57543c679c5841d0c34e629336fba6c808 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 17:11:21 +0000 -Subject: [PATCH] Bluetooth: MGMT: validate LTK enc_size on load - -JIRA: https://redhat.atlassian.net/browse/RHEL-172573 -CVE: CVE-2026-43020 - -commit b8dbe9648d69059cfe3a28917bfbf7e61efd7f15 -Author: Keenan Dong -Date: Sat Mar 28 16:46:47 2026 +0800 - - Bluetooth: MGMT: validate LTK enc_size on load - - Load Long Term Keys stores the user-provided enc_size and later uses - it to size fixed-size stack operations when replying to LE LTK - requests. An enc_size larger than the 16-byte key buffer can therefore - overflow the reply stack buffer. - - Reject oversized enc_size values while validating the management LTK - record so invalid keys never reach the stored key state. - - Fixes: 346af67b8d11 ("Bluetooth: Add MGMT handlers for dealing with SMP LTK's") - Reported-by: Keenan Dong - Signed-off-by: Keenan Dong - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: CKI Backport Bot - -diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c -index a758452e49b5..3756c2a152d2 100644 ---- a/net/bluetooth/mgmt.c -+++ b/net/bluetooth/mgmt.c -@@ -7163,6 +7163,9 @@ static bool ltk_is_valid(struct mgmt_ltk_info *key) - if (key->initiator != 0x00 && key->initiator != 0x01) - return false; - -+ if (key->enc_size > sizeof(key->val)) -+ return false; -+ - switch (key->addr.type) { - case BDADDR_LE_PUBLIC: - return true; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1249-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch b/SOURCES/1249-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch deleted file mode 100644 index e187bb4ca..000000000 --- a/SOURCES/1249-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch +++ /dev/null @@ -1,147 +0,0 @@ -From 88665b7faa3968be4bdd33c2f3a8e17a20abe37a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 17:17:19 +0000 -Subject: [PATCH] Bluetooth: SCO: fix race conditions in sco_sock_connect() - -JIRA: https://redhat.atlassian.net/browse/RHEL-172600 -CVE: CVE-2026-43023 - -commit 8a5b0135d4a5d9683203a3d9a12a711ccec5936b -Author: Cen Zhang -Date: Thu Mar 26 23:16:45 2026 +0800 - - Bluetooth: SCO: fix race conditions in sco_sock_connect() - - sco_sock_connect() checks sk_state and sk_type without holding - the socket lock. Two concurrent connect() syscalls on the same - socket can both pass the check and enter sco_connect(), leading - to use-after-free. - - The buggy scenario involves three participants and was confirmed - with additional logging instrumentation: - - Thread A (connect): HCI disconnect: Thread B (connect): - - sco_sock_connect(sk) sco_sock_connect(sk) - sk_state==BT_OPEN sk_state==BT_OPEN - (pass, no lock) (pass, no lock) - sco_connect(sk): sco_connect(sk): - hci_dev_lock hci_dev_lock - hci_connect_sco <- blocked - -> hcon1 - sco_conn_add->conn1 - lock_sock(sk) - sco_chan_add: - conn1->sk = sk - sk->conn = conn1 - sk_state=BT_CONNECT - release_sock - hci_dev_unlock - hci_dev_lock - sco_conn_del: - lock_sock(sk) - sco_chan_del: - sk->conn=NULL - conn1->sk=NULL - sk_state= - BT_CLOSED - SOCK_ZAPPED - release_sock - hci_dev_unlock - (unblocked) - hci_connect_sco - -> hcon2 - sco_conn_add - -> conn2 - lock_sock(sk) - sco_chan_add: - sk->conn=conn2 - sk_state= - BT_CONNECT - // zombie sk! - release_sock - hci_dev_unlock - - Thread B revives a BT_CLOSED + SOCK_ZAPPED socket back to - BT_CONNECT. Subsequent cleanup triggers double sock_put() and - use-after-free. Meanwhile conn1 is leaked as it was orphaned - when sco_conn_del() cleared the association. - - Fix this by: - - Moving lock_sock() before the sk_state/sk_type checks in - sco_sock_connect() to serialize concurrent connect attempts - - Fixing the sk_type != SOCK_SEQPACKET check to actually - return the error instead of just assigning it - - Adding a state re-check in sco_connect() after lock_sock() - to catch state changes during the window between the locks - - Adding sco_pi(sk)->conn check in sco_chan_add() to prevent - double-attach of a socket to multiple connections - - Adding hci_conn_drop() on sco_chan_add failure to prevent - HCI connection leaks - - Fixes: 9a8ec9e8ebb5 ("Bluetooth: SCO: Fix possible circular locking dependency on sco_connect_cfm") - Signed-off-by: Cen Zhang - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: CKI Backport Bot - -diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c -index 5f6fb2c3611a..b4a0da780c9a 100644 ---- a/net/bluetooth/sco.c -+++ b/net/bluetooth/sco.c -@@ -298,7 +298,7 @@ static int sco_chan_add(struct sco_conn *conn, struct sock *sk, - int err = 0; - - sco_conn_lock(conn); -- if (conn->sk) -+ if (conn->sk || sco_pi(sk)->conn) - err = -EBUSY; - else - __sco_chan_add(conn, sk, parent); -@@ -353,9 +353,20 @@ static int sco_connect(struct sock *sk) - - lock_sock(sk); - -+ /* Recheck state after reacquiring the socket lock, as another -+ * thread may have changed it (e.g., closed the socket). -+ */ -+ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { -+ release_sock(sk); -+ hci_conn_drop(hcon); -+ err = -EBADFD; -+ goto unlock; -+ } -+ - err = sco_chan_add(conn, sk, NULL); - if (err) { - release_sock(sk); -+ hci_conn_drop(hcon); - goto unlock; - } - -@@ -649,13 +660,18 @@ static int sco_sock_connect(struct socket *sock, struct sockaddr *addr, int alen - addr->sa_family != AF_BLUETOOTH) - return -EINVAL; - -- if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) -+ lock_sock(sk); -+ -+ if (sk->sk_state != BT_OPEN && sk->sk_state != BT_BOUND) { -+ release_sock(sk); - return -EBADFD; -+ } - -- if (sk->sk_type != SOCK_SEQPACKET) -- err = -EINVAL; -+ if (sk->sk_type != SOCK_SEQPACKET) { -+ release_sock(sk); -+ return -EINVAL; -+ } - -- lock_sock(sk); - /* Set destination address and psm */ - bacpy(&sco_pi(sk)->dst, &sa->sco_bdaddr); - release_sock(sk); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1250-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch b/SOURCES/1250-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch deleted file mode 100644 index 065199f72..000000000 --- a/SOURCES/1250-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch +++ /dev/null @@ -1,37 +0,0 @@ -From 304950a467d83678bd0b0f46331882e2ac23b12d Mon Sep 17 00:00:00 2001 -From: Pengpeng Hou -Date: Mon, 23 Mar 2026 15:45:51 +0800 -Subject: [PATCH] wifi: brcmfmac: validate bsscfg indices in IF events - -brcmf_fweh_handle_if_event() validates the firmware-provided interface -index before it touches drvr->iflist[], but it still uses the raw -bsscfgidx field as an array index without a matching range check. - -Reject IF events whose bsscfg index does not fit in drvr->iflist[] -before indexing the interface array. - -Signed-off-by: Pengpeng Hou -Acked-by: Arend van Spriel -Link: https://patch.msgid.link/20260323074551.93530-1-pengpeng@iscas.ac.cn -[add missing wifi prefix] -Signed-off-by: Johannes Berg - -diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -index 984886481f4e..1cff4ba76943 100644 ---- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fweh.c -@@ -153,6 +153,11 @@ static void brcmf_fweh_handle_if_event(struct brcmf_pub *drvr, - bphy_err(drvr, "invalid interface index: %u\n", ifevent->ifidx); - return; - } -+ if (ifevent->bsscfgidx >= BRCMF_MAX_IFS) { -+ bphy_err(drvr, "invalid bsscfg index: %u\n", -+ ifevent->bsscfgidx); -+ return; -+ } - - ifp = drvr->iflist[ifevent->bsscfgidx]; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1251-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch b/SOURCES/1251-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch deleted file mode 100644 index 5c265f5e3..000000000 --- a/SOURCES/1251-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 037ff729f54b2fb1973a2baedd1dee11ebc75778 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 6 May 2026 20:45:56 +0000 -Subject: [PATCH] netfilter: xt_tcpmss: check remaining length before reading - optlen - -JIRA: https://redhat.atlassian.net/browse/RHEL-174215 -CVE: CVE-2026-43190 - -commit 735ee8582da3d239eb0c7a53adca61b79fb228b3 -Author: Florian Westphal -Date: Mon Jan 19 12:30:42 2026 +0100 - - netfilter: xt_tcpmss: check remaining length before reading optlen - - Quoting reporter: - In net/netfilter/xt_tcpmss.c (lines 53-68), the TCP option parser reads - op[i+1] directly without validating the remaining option length. - - If the last byte of the option field is not EOL/NOP (0/1), the code attempts - to index op[i+1]. In the case where i + 1 == optlen, this causes an - out-of-bounds read, accessing memory past the optlen boundary - (either reading beyond the stack buffer _opt or the - following payload). - - Reported-by: sungzii - Signed-off-by: Florian Westphal - -Signed-off-by: CKI Backport Bot - -diff --git a/net/netfilter/xt_tcpmss.c b/net/netfilter/xt_tcpmss.c -index 37704ab01799..0d32d4841cb3 100644 ---- a/net/netfilter/xt_tcpmss.c -+++ b/net/netfilter/xt_tcpmss.c -@@ -61,7 +61,7 @@ tcpmss_mt(const struct sk_buff *skb, struct xt_action_param *par) - return (mssval >= info->mss_min && - mssval <= info->mss_max) ^ info->invert; - } -- if (op[i] < 2) -+ if (op[i] < 2 || i == optlen - 1) - i++; - else - i += op[i+1] ? : 1; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1252-dm-thin-fix-metadata-refcount-underflow.patch b/SOURCES/1252-dm-thin-fix-metadata-refcount-underflow.patch deleted file mode 100644 index a0b257718..000000000 --- a/SOURCES/1252-dm-thin-fix-metadata-refcount-underflow.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 239cbf26626f77357ad7d15407fc24666e236138 Mon Sep 17 00:00:00 2001 -From: Benjamin Marzinski -Date: Wed, 22 Apr 2026 20:14:10 -0400 -Subject: [PATCH] dm-thin: fix metadata refcount underflow - -JIRA: https://issues.redhat.com/browse/RHEL-169624 -Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm.git - -commit 09a65adc7d8bbfce06392cb6d375468e2728ead5 -Author: Mikulas Patocka -Date: Mon Apr 20 19:56:44 2026 +0200 - - dm-thin: fix metadata refcount underflow - - There's a bug in dm-thin in the function rebalance_children. If the - internal btree node has one entry, the code tries to copy all btree - entries from the node's child to the node itself and then decrement the - child's reference count. - - If the child node is shared (it has reference count > 1), we won't free - it, so there would be two pointers to each of the grandchildren nodes. - But the reference counts of the grandchildren is not increased, thus the - reference count doesn't match the number of pointers that point to the - grandchildren. This results in "device mapper: space map common: unable - to decrement block" errors. - - Fix this bug by incrementing reference counts on the grandchildren if the - btree node is shared. - - Signed-off-by: Mikulas Patocka - Fixes: 3241b1d3e0aa ("dm: add persistent data library") - Cc: stable@vger.kernel.org - -Signed-off-by: Benjamin Marzinski - -diff --git a/drivers/md/persistent-data/dm-btree-remove.c b/drivers/md/persistent-data/dm-btree-remove.c -index 942cd47eb52d..aeec5b9a1dd5 100644 ---- a/drivers/md/persistent-data/dm-btree-remove.c -+++ b/drivers/md/persistent-data/dm-btree-remove.c -@@ -490,12 +490,20 @@ static int rebalance_children(struct shadow_spine *s, - - if (le32_to_cpu(n->header.nr_entries) == 1) { - struct dm_block *child; -+ int is_shared; - dm_block_t b = value64(n, 0); - -+ r = dm_tm_block_is_shared(info->tm, b, &is_shared); -+ if (r) -+ return r; -+ - r = dm_tm_read_lock(info->tm, b, &btree_node_validator, &child); - if (r) - return r; - -+ if (is_shared) -+ inc_children(info->tm, dm_block_data(child), vt); -+ - memcpy(n, dm_block_data(child), - dm_bm_block_size(dm_tm_get_bm(info->tm))); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1253-mm-document-gfp-nofail-must-be-blockable.patch b/SOURCES/1253-mm-document-gfp-nofail-must-be-blockable.patch deleted file mode 100644 index 5bc8b3f1c..000000000 --- a/SOURCES/1253-mm-document-gfp-nofail-must-be-blockable.patch +++ /dev/null @@ -1,105 +0,0 @@ -From dbb0b8ec49fcd597c406f3b17f28b588e96cfa14 Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:21 -0600 -Subject: [PATCH] mm: document __GFP_NOFAIL must be blockable -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 17d75422604f0b92869aa17cb44f60958212f033 -Author: Barry Song -Date: Sat Aug 31 08:28:22 2024 +1200 - - mm: document __GFP_NOFAIL must be blockable - - Non-blocking allocation with __GFP_NOFAIL is not supported and may still - result in NULL pointers (if we don't return NULL, we result in busy-loop - within non-sleepable contexts): - - static inline struct page * - __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - struct alloc_context *ac) - { - ... - /* - * Make sure that __GFP_NOFAIL request doesn't leak out and make sure - * we always retry - */ - if (gfp_mask & __GFP_NOFAIL) { - /* - * All existing users of the __GFP_NOFAIL are blockable, so warn - * of any new users that actually require GFP_NOWAIT - */ - if (WARN_ON_ONCE_GFP(!can_direct_reclaim, gfp_mask)) - goto fail; - ... - } - ... - fail: - warn_alloc(gfp_mask, ac->nodemask, - "page allocation failure: order:%u", order); - got_pg: - return page; - } - - Highlight this in the documentation of __GFP_NOFAIL so that non-mm - subsystems can reject any illegal usage of __GFP_NOFAIL with GFP_ATOMIC, - GFP_NOWAIT, etc. - - Link: https://lkml.kernel.org/r/20240830202823.21478-3-21cnbao@gmail.com - Signed-off-by: Barry Song - Acked-by: Michal Hocko - Reviewed-by: Christoph Hellwig - Acked-by: Vlastimil Babka - Acked-by: Davidlohr Bueso - Acked-by: David Hildenbrand - Cc: Christoph Lameter - Cc: David Rientjes - Cc: "Eugenio Pérez" - Cc: Hailong.Liu - Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> - Cc: Jason Wang - Cc: Joonsoo Kim - Cc: Kees Cook - Cc: Linus Torvalds - Cc: Lorenzo Stoakes - Cc: Maxime Coquelin - Cc: "Michael S. Tsirkin" - Cc: Pekka Enberg - Cc: Roman Gushchin - Cc: Uladzislau Rezki (Sony) - Cc: Xuan Zhuo - Cc: Christoph Hellwig - Cc: Xie Yongji - Cc: Yafang Shao - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h -index 6583a58670c5..373d3871f61e 100644 ---- a/include/linux/gfp_types.h -+++ b/include/linux/gfp_types.h -@@ -168,7 +168,8 @@ typedef unsigned int __bitwise gfp_t; - * the caller still has to check for failures) while costly requests try to be - * not disruptive and back off even without invoking the OOM killer. - * The following three modifiers might be used to override some of these -- * implicit rules -+ * implicit rules. Please note that all of them must be used along with -+ * %__GFP_DIRECT_RECLAIM flag. - * - * %__GFP_NORETRY: The VM implementation will try only very lightweight - * memory direct reclaim to get some memory under memory pressure (thus -@@ -199,6 +200,8 @@ typedef unsigned int __bitwise gfp_t; - * cannot handle allocation failures. The allocation could block - * indefinitely but will never return with failure. Testing for - * failure is pointless. -+ * It _must_ be blockable and used together with __GFP_DIRECT_RECLAIM. -+ * It should _never_ be used in non-sleepable contexts. - * New users should be evaluated carefully (and the flag should be - * used only when there is no reasonable failure policy) but it is - * definitely preferable to use the flag rather than opencode endless --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1254-mm-warn-about-illegal-gfp-nofail-usage-in-a-more-appropriate.patch b/SOURCES/1254-mm-warn-about-illegal-gfp-nofail-usage-in-a-more-appropriate.patch deleted file mode 100644 index 3afe64b82..000000000 --- a/SOURCES/1254-mm-warn-about-illegal-gfp-nofail-usage-in-a-more-appropriate.patch +++ /dev/null @@ -1,169 +0,0 @@ -From e7842dda471d377ae8c6aaf9ddb4a73159f505b4 Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:21 -0600 -Subject: [PATCH] mm: warn about illegal __GFP_NOFAIL usage in a more - appropriate location and manner -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -commit 903edea6c53f097f5f0c847fdbbfab0c6c44f241 -Author: Barry Song -Date: Sat Aug 31 08:28:23 2024 +1200 - - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner - - Three points for this change: - - 1. We should consolidate all warnings in one place. Currently, the - order > 1 warning is in the hotpath, while others are in less - likely scenarios. Moving all warnings to the slowpath will reduce - the overhead for order > 1 and increase the visibility of other - warnings. - - 2. We currently have two warnings for order: one for order > 1 in - the hotpath and another for order > costly_order in the laziest - path. I suggest standardizing on order > 1 since it's been in - use for a long time. - - 3. We don't need to check for __GFP_NOWARN in this case. __GFP_NOWARN - is meant to suppress allocation failure reports, but here we're - dealing with bug detection, not allocation failures. So replace - WARN_ON_ONCE_GFP by WARN_ON_ONCE. - - [v-songbaohua@oppo.com: also update the doc for __GFP_NOFAIL with order > 1] - Link: https://lkml.kernel.org/r/20240903223935.1697-1-21cnbao@gmail.com - Link: https://lkml.kernel.org/r/20240830202823.21478-4-21cnbao@gmail.com - Signed-off-by: Barry Song - Suggested-by: Vlastimil Babka - Reviewed-by: Vlastimil Babka - Acked-by: David Hildenbrand - Acked-by: Michal Hocko - Cc: Christoph Hellwig - Cc: Christoph Lameter - Cc: Davidlohr Bueso - Cc: David Rientjes - Cc: "Eugenio Pérez" - Cc: Hailong.Liu - Cc: Hyeonggon Yoo <42.hyeyoo@gmail.com> - Cc: Jason Wang - Cc: Joonsoo Kim - Cc: Kees Cook - Cc: Linus Torvalds - Cc: Lorenzo Stoakes - Cc: Maxime Coquelin - Cc: "Michael S. Tsirkin" - Cc: Pekka Enberg - Cc: Roman Gushchin - Cc: Uladzislau Rezki (Sony) - Cc: Xie Yongji - Cc: Xuan Zhuo - Cc: Yafang Shao - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/include/linux/gfp_types.h b/include/linux/gfp_types.h -index 373d3871f61e..359ed69b14d9 100644 ---- a/include/linux/gfp_types.h -+++ b/include/linux/gfp_types.h -@@ -206,7 +206,8 @@ typedef unsigned int __bitwise gfp_t; - * used only when there is no reasonable failure policy) but it is - * definitely preferable to use the flag rather than opencode endless - * loop around allocator. -- * Using this flag for costly allocations is _highly_ discouraged. -+ * Allocating pages from the buddy with __GFP_NOFAIL and order > 1 is -+ * not supported. Please consider using kvmalloc() instead. - */ - #define __GFP_IO ((__force gfp_t)___GFP_IO) - #define __GFP_FS ((__force gfp_t)___GFP_FS) -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 4e8615398f07..28cb88a3a758 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2914,12 +2914,6 @@ struct page *rmqueue(struct zone *preferred_zone, - { - struct page *page; - -- /* -- * We most definitely don't want callers attempting to -- * allocate greater than order-1 page units with __GFP_NOFAIL. -- */ -- WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1)); -- - if (likely(pcp_allowed_order(order))) { - page = rmqueue_pcplist(preferred_zone, zone, order, - migratetype, alloc_flags); -@@ -4062,6 +4056,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - { - bool can_direct_reclaim = gfp_mask & __GFP_DIRECT_RECLAIM; - bool can_compact = gfp_compaction_allowed(gfp_mask); -+ bool nofail = gfp_mask & __GFP_NOFAIL; - const bool costly_order = order > PAGE_ALLOC_COSTLY_ORDER; - struct page *page = NULL; - unsigned int alloc_flags; -@@ -4074,6 +4069,25 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - unsigned int zonelist_iter_cookie; - int reserve_flags; - -+ if (unlikely(nofail)) { -+ /* -+ * We most definitely don't want callers attempting to -+ * allocate greater than order-1 page units with __GFP_NOFAIL. -+ */ -+ WARN_ON_ONCE(order > 1); -+ /* -+ * Also we don't support __GFP_NOFAIL without __GFP_DIRECT_RECLAIM, -+ * otherwise, we may result in lockup. -+ */ -+ WARN_ON_ONCE(!can_direct_reclaim); -+ /* -+ * PF_MEMALLOC request from this context is rather bizarre -+ * because we cannot reclaim anything and only can loop waiting -+ * for somebody to do a work for us. -+ */ -+ WARN_ON_ONCE(current->flags & PF_MEMALLOC); -+ } -+ - restart: - compaction_retries = 0; - no_progress_loops = 0; -@@ -4291,29 +4305,15 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - * Make sure that __GFP_NOFAIL request doesn't leak out and make sure - * we always retry - */ -- if (gfp_mask & __GFP_NOFAIL) { -+ if (unlikely(nofail)) { - /* -- * All existing users of the __GFP_NOFAIL are blockable, so warn -- * of any new users that actually require GFP_NOWAIT -+ * Lacking direct_reclaim we can't do anything to reclaim memory, -+ * we disregard these unreasonable nofail requests and still -+ * return NULL - */ -- if (WARN_ON_ONCE_GFP(!can_direct_reclaim, gfp_mask)) -+ if (!can_direct_reclaim) - goto fail; - -- /* -- * PF_MEMALLOC request from this context is rather bizarre -- * because we cannot reclaim anything and only can loop waiting -- * for somebody to do a work for us -- */ -- WARN_ON_ONCE_GFP(current->flags & PF_MEMALLOC, gfp_mask); -- -- /* -- * non failing costly orders are a hard requirement which we -- * are not prepared for much so let's warn about these users -- * so that we can identify them and convert them to something -- * else. -- */ -- WARN_ON_ONCE_GFP(costly_order, gfp_mask); -- - /* - * Help non-failing allocations by giving some access to memory - * reserves normally used for high priority non-blocking --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1255-mm-page-alloc-c-avoid-infinite-retries-caused-by-cpuset-race.patch b/SOURCES/1255-mm-page-alloc-c-avoid-infinite-retries-caused-by-cpuset-race.patch deleted file mode 100644 index f5727e433..000000000 --- a/SOURCES/1255-mm-page-alloc-c-avoid-infinite-retries-caused-by-cpuset-race.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 76329fc4d67ac1854f97337545e428e181b1cbe5 Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:21 -0600 -Subject: [PATCH] mm/page_alloc.c: avoid infinite retries caused by cpuset race - -commit e05741fb10c38d70bbd7ec12b23c197b6355d519 -Author: Tianyang Zhang -Date: Wed Apr 16 16:24:05 2025 +0800 - - mm/page_alloc.c: avoid infinite retries caused by cpuset race - - __alloc_pages_slowpath has no change detection for ac->nodemask in the - part of retry path, while cpuset can modify it in parallel. For some - processes that set mempolicy as MPOL_BIND, this results ac->nodemask - changes, and then the should_reclaim_retry will judge based on the latest - nodemask and jump to retry, while the get_page_from_freelist only - traverses the zonelist from ac->preferred_zoneref, which selected by a - expired nodemask and may cause infinite retries in some cases - - cpu 64: - __alloc_pages_slowpath { - /* ..... */ - retry: - /* ac->nodemask = 0x1, ac->preferred->zone->nid = 1 */ - if (alloc_flags & ALLOC_KSWAPD) - wake_all_kswapds(order, gfp_mask, ac); - /* cpu 1: - cpuset_write_resmask - update_nodemask - update_nodemasks_hier - update_tasks_nodemask - mpol_rebind_task - mpol_rebind_policy - mpol_rebind_nodemask - // mempolicy->nodes has been modified, - // which ac->nodemask point to - - */ - /* ac->nodemask = 0x3, ac->preferred->zone->nid = 1 */ - if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags, - did_some_progress > 0, &no_progress_loops)) - goto retry; - } - - Simultaneously starting multiple cpuset01 from LTP can quickly reproduce - this issue on a multi node server when the maximum memory pressure is - reached and the swap is enabled - - Link: https://lkml.kernel.org/r/20250416082405.20988-1-zhangtianyang@loongson.cn - Fixes: c33d6c06f60f ("mm, page_alloc: avoid looking up the first zone in a zonelist twice") - Signed-off-by: Tianyang Zhang - Reviewed-by: Suren Baghdasaryan - Reviewed-by: Vlastimil Babka - Cc: Michal Hocko - Cc: Brendan Jackman - Cc: Johannes Weiner - Cc: Zi Yan - Cc: - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 28cb88a3a758..dc1a7637bf97 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4193,6 +4193,14 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - } - - retry: -+ /* -+ * Deal with possible cpuset update races or zonelist updates to avoid -+ * infinite retries. -+ */ -+ if (check_retry_cpuset(cpuset_mems_cookie, ac) || -+ check_retry_zonelist(zonelist_iter_cookie)) -+ goto restart; -+ - /* Ensure kswapd doesn't accidentally go to sleep as long as we loop */ - if (alloc_flags & ALLOC_KSWAPD) - wake_all_kswapds(order, gfp_mask, ac); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1256-mm-page-alloc-thp-prevent-reclaim-for-gfp-thisnode-thp-alloc.patch b/SOURCES/1256-mm-page-alloc-thp-prevent-reclaim-for-gfp-thisnode-thp-alloc.patch deleted file mode 100644 index 1c87e292d..000000000 --- a/SOURCES/1256-mm-page-alloc-thp-prevent-reclaim-for-gfp-thisnode-thp-alloc.patch +++ /dev/null @@ -1,96 +0,0 @@ -From 32e483909f993e18474e30c11e0397a82c570b6e Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:21 -0600 -Subject: [PATCH] mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP - allocations - -commit 9c9828d3ead69416d731b1238802af31760c823e -Author: Vlastimil Babka -Date: Fri Dec 19 17:31:57 2025 +0100 - - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations - - Since commit cc638f329ef6 ("mm, thp: tweak reclaim/compaction effort of - local-only and all-node allocations"), THP page fault allocations have - settled on the following scheme (from the commit log): - - 1. local node only THP allocation with no reclaim, just compaction. - 2. for madvised VMA's or when synchronous compaction is enabled always - THP - allocation from any node with effort determined by global defrag setting - and VMA madvise - 3. fallback to base pages on any node - - Recent customer reports however revealed we have a gap in step 1 above. - What we have seen is excessive reclaim due to THP page faults on a NUMA - node that's close to its high watermark, while other nodes have plenty of - free memory. - - The problem with step 1 is that it promises no reclaim after the - compaction attempt, however reclaim is only avoided for certain compaction - outcomes (deferred, or skipped due to insufficient free base pages), and - not e.g. when compaction is actually performed but fails (we did see - compact_fail vmstat counter increasing). - - THP page faults can therefore exhibit a zone_reclaim_mode-like behavior, - which is not the intention. - - Thus add a check for __GFP_THISNODE that corresponds to this exact - situation and prevents continuing with reclaim/compaction once the initial - compaction attempt isn't successful in allocating the page. - - Note that commit cc638f329ef6 has not introduced this over-reclaim - possibility; it appears to exist in some form since commit 2f0799a0ffc0 - ("mm, thp: restore node-local hugepage allocations"). Followup commits - b39d0ee2632d ("mm, page_alloc: avoid expensive reclaim when compaction may - not succeed") and cc638f329ef6 have moved in the right direction, but left - the abovementioned gap. - - Link: https://lkml.kernel.org/r/20251219-costly-noretry-thisnode-fix-v1-1-e1085a4a0c34@suse.cz - Fixes: 2f0799a0ffc0 ("mm, thp: restore node-local hugepage allocations") - Signed-off-by: Vlastimil Babka - Acked-by: Michal Hocko - Acked-by: Johannes Weiner - Acked-by: Pedro Falcato - Acked-by: Zi Yan - Cc: Brendan Jackman - Cc: "David Hildenbrand (Red Hat)" - Cc: David Rientjes - Cc: Joshua Hahn - Cc: Liam Howlett - Cc: Lorenzo Stoakes - Cc: Mike Rapoport - Cc: Suren Baghdasaryan - Cc: - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index dc1a7637bf97..ca0d42a95410 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4183,6 +4183,20 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - compact_result == COMPACT_DEFERRED) - goto nopage; - -+ /* -+ * THP page faults may attempt local node only first, -+ * but are then allowed to only compact, not reclaim, -+ * see alloc_pages_mpol(). -+ * -+ * Compaction can fail for other reasons than those -+ * checked above and we don't want such THP allocations -+ * to put reclaim pressure on a single node in a -+ * situation where other nodes might have plenty of -+ * available memory. -+ */ -+ if (gfp_mask & __GFP_THISNODE) -+ goto nopage; -+ - /* - * Looks like reclaim/compaction is worth trying, but - * sync compaction could be very expensive, so keep --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1257-mm-page-alloc-ignore-the-exact-initial-compaction-result.patch b/SOURCES/1257-mm-page-alloc-ignore-the-exact-initial-compaction-result.patch deleted file mode 100644 index 597829b32..000000000 --- a/SOURCES/1257-mm-page-alloc-ignore-the-exact-initial-compaction-result.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 37f7d4a6be45deda800131b7a9ea6d1f3e4d97ab Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:20 -0600 -Subject: [PATCH] mm/page_alloc: ignore the exact initial compaction result - -commit 66987218154918a6341a3e3eeeee58110a69e0bb -Author: Vlastimil Babka -Date: Tue Jan 6 12:52:36 2026 +0100 - - mm/page_alloc: ignore the exact initial compaction result - - Patch series "tweaks for __alloc_pages_slowpath()", v3. - - This patch (of 3): - - For allocations that are of costly order and __GFP_NORETRY (and can - perform compaction) we attempt direct compaction first. If that fails, we - continue with a single round of direct reclaim+compaction (as for other - __GFP_NORETRY allocations, except the compaction is of lower priority), - with two exceptions that fail immediately: - - - __GFP_THISNODE is specified, to prevent zone_reclaim_mode-like - behavior for e.g. THP page faults - - - compaction failed because it was deferred (i.e. has been failing - recently so further attempts are not done for a while) or skipped, - which means there are insufficient free base pages to defragment to - begin with - - Upon closer inspection, the second condition has a somewhat flawed - reasoning. If there are not enough base pages and reclaim could create - them, we instead fail. When there are enough base pages and compaction - has already ran and failed, we proceed and hope that reclaim and the - subsequent compaction attempt will succeed. But it's unclear why they - should and whether it will be as inexpensive as intended. - - It might make therefore more sense to just fail unconditionally after the - initial compaction attempt. However that would change the semantics of - __GFP_NORETRY to attempt reclaim at least once. - - Alternatively we can remove the compaction result checks and proceed with - the single reclaim and (lower priority) compaction attempt, leaving only - the __GFP_THISNODE exception for failing immediately. - - Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-0-f5d67c21a193@suse.cz - Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-1-f5d67c21a193@suse.cz - Signed-off-by: Vlastimil Babka - Acked-by: Michal Hocko - Cc: Brendan Jackman - Cc: David Hildenbrand (Red Hat) - Cc: David Rientjes - Cc: Johannes Weiner - Cc: Joshua Hahn - Cc: Liam Howlett - Cc: Lorenzo Stoakes - Cc: Mike Rapoport - Cc: Pedro Falcato - Cc: Suren Baghdasaryan - Cc: Zi Yan - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index ca0d42a95410..3301e934dafa 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4162,44 +4162,22 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - * includes some THP page fault allocations - */ - if (costly_order && (gfp_mask & __GFP_NORETRY)) { -- /* -- * If allocating entire pageblock(s) and compaction -- * failed because all zones are below low watermarks -- * or is prohibited because it recently failed at this -- * order, fail immediately unless the allocator has -- * requested compaction and reclaim retry. -- * -- * Reclaim is -- * - potentially very expensive because zones are far -- * below their low watermarks or this is part of very -- * bursty high order allocations, -- * - not guaranteed to help because isolate_freepages() -- * may not iterate over freed pages as part of its -- * linear scan, and -- * - unlikely to make entire pageblocks free on its -- * own. -- */ -- if (compact_result == COMPACT_SKIPPED || -- compact_result == COMPACT_DEFERRED) -- goto nopage; -- - /* - * THP page faults may attempt local node only first, - * but are then allowed to only compact, not reclaim, - * see alloc_pages_mpol(). - * -- * Compaction can fail for other reasons than those -- * checked above and we don't want such THP allocations -- * to put reclaim pressure on a single node in a -- * situation where other nodes might have plenty of -- * available memory. -+ * Compaction has failed above and we don't want such -+ * THP allocations to put reclaim pressure on a single -+ * node in a situation where other nodes might have -+ * plenty of available memory. - */ - if (gfp_mask & __GFP_THISNODE) - goto nopage; - - /* -- * Looks like reclaim/compaction is worth trying, but -- * sync compaction could be very expensive, so keep -+ * Proceed with single round of reclaim/compaction, but -+ * since sync compaction could be very expensive, keep - * using async compaction. - */ - compact_priority = INIT_COMPACT_PRIORITY; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1258-mm-page-alloc-refactor-the-initial-compaction-handling.patch b/SOURCES/1258-mm-page-alloc-refactor-the-initial-compaction-handling.patch deleted file mode 100644 index 4ddb0e093..000000000 --- a/SOURCES/1258-mm-page-alloc-refactor-the-initial-compaction-handling.patch +++ /dev/null @@ -1,208 +0,0 @@ -From 2490569160937bfa1556b9d2dc07998148eb5f77 Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:20 -0600 -Subject: [PATCH] mm/page_alloc: refactor the initial compaction handling - -commit 53a9b4646f67c95df1775aa5f381cb7f42cae957 -Author: Vlastimil Babka -Date: Tue Jan 6 12:52:37 2026 +0100 - - mm/page_alloc: refactor the initial compaction handling - - The initial direct compaction done in some cases in - __alloc_pages_slowpath() stands out from the main retry loop of reclaim + - compaction. - - We can simplify this by instead skipping the initial reclaim attempt via a - new local variable compact_first, and handle the compact_prority as - necessary to match the original behavior. No functional change intended. - - Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-2-f5d67c21a193@suse.cz - Signed-off-by: Vlastimil Babka - Suggested-by: Johannes Weiner - Reviewed-by: Joshua Hahn - Acked-by: Michal Hocko - Cc: Brendan Jackman - Cc: David Hildenbrand (Red Hat) - Cc: David Rientjes - Cc: Liam Howlett - Cc: Lorenzo Stoakes - Cc: Mike Rapoport - Cc: Pedro Falcato - Cc: Suren Baghdasaryan - Cc: Zi Yan - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/include/linux/gfp.h b/include/linux/gfp.h -index 3e4c0c536a3d..ac836590ba3a 100644 ---- a/include/linux/gfp.h -+++ b/include/linux/gfp.h -@@ -348,9 +348,15 @@ extern gfp_t gfp_allowed_mask; - /* Returns true if the gfp_mask allows use of ALLOC_NO_WATERMARK */ - bool gfp_pfmemalloc_allowed(gfp_t gfp_mask); - -+/* A helper for checking if gfp includes all the specified flags */ -+static inline bool gfp_has_flags(gfp_t gfp, gfp_t flags) -+{ -+ return (gfp & flags) == flags; -+} -+ - static inline bool gfp_has_io_fs(gfp_t gfp) - { -- return (gfp & (__GFP_IO | __GFP_FS)) == (__GFP_IO | __GFP_FS); -+ return gfp_has_flags(gfp, __GFP_IO | __GFP_FS); - } - - /* -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 3301e934dafa..277ed887ec7a 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4055,7 +4055,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - struct alloc_context *ac) - { - bool can_direct_reclaim = gfp_mask & __GFP_DIRECT_RECLAIM; -- bool can_compact = gfp_compaction_allowed(gfp_mask); -+ bool can_compact = can_direct_reclaim && gfp_compaction_allowed(gfp_mask); - bool nofail = gfp_mask & __GFP_NOFAIL; - const bool costly_order = order > PAGE_ALLOC_COSTLY_ORDER; - struct page *page = NULL; -@@ -4068,6 +4068,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - unsigned int cpuset_mems_cookie; - unsigned int zonelist_iter_cookie; - int reserve_flags; -+ bool compact_first = false; - - if (unlikely(nofail)) { - /* -@@ -4095,6 +4096,19 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - cpuset_mems_cookie = read_mems_allowed_begin(); - zonelist_iter_cookie = zonelist_iter_begin(); - -+ /* -+ * For costly allocations, try direct compaction first, as it's likely -+ * that we have enough base pages and don't need to reclaim. For non- -+ * movable high-order allocations, do that as well, as compaction will -+ * try prevent permanent fragmentation by migrating from blocks of the -+ * same migratetype. -+ */ -+ if (can_compact && (costly_order || (order > 0 && -+ ac->migratetype != MIGRATE_MOVABLE))) { -+ compact_first = true; -+ compact_priority = INIT_COMPACT_PRIORITY; -+ } -+ - /* - * The fast path uses conservative alloc_flags to succeed only until - * kswapd needs to be woken up, and to avoid the cost of setting up -@@ -4137,53 +4151,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - if (page) - goto got_pg; - -- /* -- * For costly allocations, try direct compaction first, as it's likely -- * that we have enough base pages and don't need to reclaim. For non- -- * movable high-order allocations, do that as well, as compaction will -- * try prevent permanent fragmentation by migrating from blocks of the -- * same migratetype. -- * Don't try this for allocations that are allowed to ignore -- * watermarks, as the ALLOC_NO_WATERMARKS attempt didn't yet happen. -- */ -- if (can_direct_reclaim && can_compact && -- (costly_order || -- (order > 0 && ac->migratetype != MIGRATE_MOVABLE)) -- && !gfp_pfmemalloc_allowed(gfp_mask)) { -- page = __alloc_pages_direct_compact(gfp_mask, order, -- alloc_flags, ac, -- INIT_COMPACT_PRIORITY, -- &compact_result); -- if (page) -- goto got_pg; -- -- /* -- * Checks for costly allocations with __GFP_NORETRY, which -- * includes some THP page fault allocations -- */ -- if (costly_order && (gfp_mask & __GFP_NORETRY)) { -- /* -- * THP page faults may attempt local node only first, -- * but are then allowed to only compact, not reclaim, -- * see alloc_pages_mpol(). -- * -- * Compaction has failed above and we don't want such -- * THP allocations to put reclaim pressure on a single -- * node in a situation where other nodes might have -- * plenty of available memory. -- */ -- if (gfp_mask & __GFP_THISNODE) -- goto nopage; -- -- /* -- * Proceed with single round of reclaim/compaction, but -- * since sync compaction could be very expensive, keep -- * using async compaction. -- */ -- compact_priority = INIT_COMPACT_PRIORITY; -- } -- } -- - retry: - /* - * Deal with possible cpuset update races or zonelist updates to avoid -@@ -4227,10 +4194,12 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - goto nopage; - - /* Try direct reclaim and then allocating */ -- page = __alloc_pages_direct_reclaim(gfp_mask, order, alloc_flags, ac, -- &did_some_progress); -- if (page) -- goto got_pg; -+ if (!compact_first) { -+ page = __alloc_pages_direct_reclaim(gfp_mask, order, alloc_flags, -+ ac, &did_some_progress); -+ if (page) -+ goto got_pg; -+ } - - /* Try direct compaction and then allocating */ - page = __alloc_pages_direct_compact(gfp_mask, order, alloc_flags, ac, -@@ -4238,6 +4207,33 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - if (page) - goto got_pg; - -+ if (compact_first) { -+ /* -+ * THP page faults may attempt local node only first, but are -+ * then allowed to only compact, not reclaim, see -+ * alloc_pages_mpol(). -+ * -+ * Compaction has failed above and we don't want such THP -+ * allocations to put reclaim pressure on a single node in a -+ * situation where other nodes might have plenty of available -+ * memory. -+ */ -+ if (gfp_has_flags(gfp_mask, __GFP_NORETRY | __GFP_THISNODE)) -+ goto nopage; -+ -+ /* -+ * For the initial compaction attempt we have lowered its -+ * priority. Restore it for further retries, if those are -+ * allowed. With __GFP_NORETRY there will be a single round of -+ * reclaim and compaction with the lowered priority. -+ */ -+ if (!(gfp_mask & __GFP_NORETRY)) -+ compact_priority = DEF_COMPACT_PRIORITY; -+ -+ compact_first = false; -+ goto retry; -+ } -+ - /* Do not loop if specifically requested */ - if (gfp_mask & __GFP_NORETRY) - goto nopage; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1259-mm-page-alloc-simplify-alloc-pages-slowpath-flow.patch b/SOURCES/1259-mm-page-alloc-simplify-alloc-pages-slowpath-flow.patch deleted file mode 100644 index 31295d697..000000000 --- a/SOURCES/1259-mm-page-alloc-simplify-alloc-pages-slowpath-flow.patch +++ /dev/null @@ -1,138 +0,0 @@ -From a17c77996e1aa930c05901e213f1441f0db7a46a Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 4 Apr 2026 19:30:20 -0600 -Subject: [PATCH] mm/page_alloc: simplify __alloc_pages_slowpath() flow - -commit 2c4c3e29897d43c431b1cf9432fb66977f262ac2 -Author: Vlastimil Babka -Date: Tue Jan 6 12:52:38 2026 +0100 - - mm/page_alloc: simplify __alloc_pages_slowpath() flow - - The actions done before entering the main retry loop include waking up - kswapds and an allocation attempt with the precise alloc_flags. Then in - the loop we keep waking up kswapds, and we retry the allocation with flags - potentially further adjusted by being allowed to use reserves (due to e.g. - becoming an OOM killer victim). - - We can adjust the retry loop to keep only one instance of waking up - kswapds and allocation attempt. Introduce the can_retry_reserves variable - for retrying once when we become eligible for reserves. It is still - useful not to evaluate reserve_flags immediately for the first allocation - attempt, because it's better to first try succeed in a non-preferred zone - above the min watermark before allocating immediately from the preferred - zone below min watermark. - - Additionally move the cpuset update checks introduced by e05741fb10c3 - ("mm/page_alloc.c: avoid infinite retries caused by cpuset race") further - down the retry loop. It's enough to do the checks only before reaching - any potentially infinite 'goto retry;' loop. - - There should be no meaningful functional changes. The change of exact - moments the retry for reserves and cpuset updates are checked should not - result in different outomes modulo races with concurrent allocator - activity. - - Link: https://lkml.kernel.org/r/20260106-thp-thisnode-tweak-v3-3-f5d67c21a193@suse.cz - Signed-off-by: Vlastimil Babka - Acked-by: Michal Hocko - Cc: Johannes Weiner - Cc: Joshua Hahn - Cc: Brendan Jackman - Cc: David Hildenbrand (Red Hat) - Cc: David Rientjes - Cc: Liam Howlett - Cc: Lorenzo Stoakes - Cc: Mike Rapoport - Cc: Pedro Falcato - Cc: Suren Baghdasaryan - Cc: Zi Yan - Signed-off-by: Andrew Morton - -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 277ed887ec7a..4c2b622a39cf 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -4069,6 +4069,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - unsigned int zonelist_iter_cookie; - int reserve_flags; - bool compact_first = false; -+ bool can_retry_reserves = true; - - if (unlikely(nofail)) { - /* -@@ -4140,6 +4141,8 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - goto nopage; - } - -+retry: -+ /* Ensure kswapd doesn't accidentally go to sleep as long as we loop */ - if (alloc_flags & ALLOC_KSWAPD) - wake_all_kswapds(order, gfp_mask, ac); - -@@ -4151,19 +4154,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - if (page) - goto got_pg; - --retry: -- /* -- * Deal with possible cpuset update races or zonelist updates to avoid -- * infinite retries. -- */ -- if (check_retry_cpuset(cpuset_mems_cookie, ac) || -- check_retry_zonelist(zonelist_iter_cookie)) -- goto restart; -- -- /* Ensure kswapd doesn't accidentally go to sleep as long as we loop */ -- if (alloc_flags & ALLOC_KSWAPD) -- wake_all_kswapds(order, gfp_mask, ac); -- - reserve_flags = __gfp_pfmemalloc_flags(gfp_mask); - if (reserve_flags) - alloc_flags = gfp_to_alloc_flags_cma(gfp_mask, reserve_flags) | -@@ -4178,12 +4168,18 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - ac->nodemask = NULL; - ac->preferred_zoneref = first_zones_zonelist(ac->zonelist, - ac->highest_zoneidx, ac->nodemask); -- } - -- /* Attempt with potentially adjusted zonelist and alloc_flags */ -- page = get_page_from_freelist(gfp_mask, order, alloc_flags, ac); -- if (page) -- goto got_pg; -+ /* -+ * The first time we adjust anything due to being allowed to -+ * ignore memory policies or watermarks, retry immediately. This -+ * allows us to keep the first allocation attempt optimistic so -+ * it can succeed in a zone that is still above watermarks. -+ */ -+ if (can_retry_reserves) { -+ can_retry_reserves = false; -+ goto retry; -+ } -+ } - - /* Caller is not willing to reclaim, we can't balance anything */ - if (!can_direct_reclaim) -@@ -4246,6 +4242,15 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - !(gfp_mask & __GFP_RETRY_MAYFAIL))) - goto nopage; - -+ /* -+ * Deal with possible cpuset update races or zonelist updates to avoid -+ * infinite retries. No "goto retry;" can be placed above this check -+ * unless it can execute just once. -+ */ -+ if (check_retry_cpuset(cpuset_mems_cookie, ac) || -+ check_retry_zonelist(zonelist_iter_cookie)) -+ goto restart; -+ - if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags, - did_some_progress > 0, &no_progress_loops)) - goto retry; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1260-mm-page-alloc-add-vm-thp-thisnode-reclaim-sysctl-to-allow-th.patch b/SOURCES/1260-mm-page-alloc-add-vm-thp-thisnode-reclaim-sysctl-to-allow-th.patch deleted file mode 100644 index a96d094e9..000000000 --- a/SOURCES/1260-mm-page-alloc-add-vm-thp-thisnode-reclaim-sysctl-to-allow-th.patch +++ /dev/null @@ -1,85 +0,0 @@ -From fe93b8af523e8f3cf1e7304d100adf6ed44f6345 Mon Sep 17 00:00:00 2001 -From: Nico Pache -Date: Sat, 28 Mar 2026 16:17:55 -0600 -Subject: [PATCH] mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow - THP reclaim on local node - -Upstream commit cd2e3c32636e ("mm, page_alloc, thp: prevent reclaim for -__GFP_THISNODE THP allocations") prevents __GFP_THISNODE THP allocations -from proceeding into reclaim after compaction failure, to avoid -zone_reclaim_mode-like excessive reclaim on a single NUMA node when other -nodes have plenty of free memory. This was further refined by upstream -commits 66987218154918a6 and 53a9b4646f67 which refactored the check -into gfp_has_flags(gfp_mask, __GFP_NORETRY | __GFP_THISNODE). -While this is the correct default, to prevent workloads regressing on older -releases, or for customers/workloads that may benefit from the more aggressive -reclaim behavior. Add a sysctl knob (vm.thp_thisnode_reclaim) to restore the -previous behavior. - -The sysctl defaults to 1 to avoid regressions and keep the pre-fix behavior. - -Upstream-status: RHEL-Only -JIRA: https://redhat.atlassian.net/browse/RHEL-148561 -Signed-off-by: Nico Pache - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 4c2b622a39cf..b26f3d53b751 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -290,6 +290,14 @@ int user_min_free_kbytes = -1; - static int watermark_boost_factor __read_mostly = 15000; - static int watermark_scale_factor = 10; - -+/* -+ * RHEL-ONLY: When set to 1, allows reclaim for __GFP_THISNODE THP allocations, -+ * restoring the behavior prior to the fix that prevents zone_reclaim_mode-like -+ * excessive reclaim on a single NUMA node when other nodes have plenty of free -+ * memory. -+ */ -+static int thp_thisnode_reclaim __read_mostly = 1; -+ - /* movable_zone is the "real" zone pages in ZONE_MOVABLE are taken from */ - int movable_zone; - EXPORT_SYMBOL(movable_zone); -@@ -4213,9 +4221,20 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, - * allocations to put reclaim pressure on a single node in a - * situation where other nodes might have plenty of available - * memory. -+ * -+ * RHEL-ONLY: vm.thp_thisnode_reclaim can override this to -+ * restore the pre-fix behavior: allow reclaim for THISNODE THP -+ * allocations, but still fail immediately when compaction was -+ * skipped (insufficient free base pages) or deferred (recent -+ * compaction failures at this order). - */ -- if (gfp_has_flags(gfp_mask, __GFP_NORETRY | __GFP_THISNODE)) -- goto nopage; -+ if (gfp_has_flags(gfp_mask, __GFP_NORETRY | __GFP_THISNODE)) { -+ if (!thp_thisnode_reclaim) -+ goto nopage; -+ if (compact_result == COMPACT_SKIPPED || -+ compact_result == COMPACT_DEFERRED) -+ goto nopage; -+ } - - /* - * For the initial compaction attempt we have lowered its -@@ -6213,6 +6232,15 @@ static struct ctl_table page_alloc_sysctl_table[] = { - .extra1 = SYSCTL_ZERO, - .extra2 = SYSCTL_ONE_HUNDRED, - }, -+ { -+ .procname = "thp_thisnode_reclaim", //RHEL-ONLY -+ .data = &thp_thisnode_reclaim, -+ .maxlen = sizeof(thp_thisnode_reclaim), -+ .mode = 0644, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = SYSCTL_ZERO, -+ .extra2 = SYSCTL_ONE, -+ }, - #endif - {} - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1261-smb-client-fix-oob-reads-parsing-symlink-error-response.patch b/SOURCES/1261-smb-client-fix-oob-reads-parsing-symlink-error-response.patch deleted file mode 100644 index bd370dd31..000000000 --- a/SOURCES/1261-smb-client-fix-oob-reads-parsing-symlink-error-response.patch +++ /dev/null @@ -1,123 +0,0 @@ -From e0c8209f463129749b824ebf8068fd75774dd5d7 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Tue, 28 Apr 2026 12:07:13 +0000 -Subject: [PATCH] smb: client: fix OOB reads parsing symlink error response - -JIRA: https://redhat.atlassian.net/browse/RHEL-171472 -CVE: CVE-2026-31613 - -commit 3df690bba28edec865cf7190be10708ad0ddd67e -Author: Greg Kroah-Hartman -Date: Mon Apr 6 15:49:38 2026 +0200 - - smb: client: fix OOB reads parsing symlink error response - - When a CREATE returns STATUS_STOPPED_ON_SYMLINK, smb2_check_message() - returns success without any length validation, leaving the symlink - parsers as the only defense against an untrusted server. - - symlink_data() walks SMB 3.1.1 error contexts with the loop test "p < - end", but reads p->ErrorId at offset 4 and p->ErrorDataLength at offset - 0. When the server-controlled ErrorDataLength advances p to within 1-7 - bytes of end, the next iteration will read past it. When the matching - context is found, sym->SymLinkErrorTag is read at offset 4 from - p->ErrorContextData with no check that the symlink header itself fits. - - smb2_parse_symlink_response() then bounds-checks the substitute name - using SMB2_SYMLINK_STRUCT_SIZE as the offset of PathBuffer from - iov_base. That value is computed as sizeof(smb2_err_rsp) + - sizeof(smb2_symlink_err_rsp), which is correct only when - ErrorContextCount == 0. - - With at least one error context the symlink data sits 8 bytes deeper, - and each skipped non-matching context shifts it further by 8 + - ALIGN(ErrorDataLength, 8). The check is too short, allowing the - substitute name read to run past iov_len. The out-of-bound heap bytes - are UTF-16-decoded into the symlink target and returned to userspace via - readlink(2). - - Fix this all up by making the loops test require the full context header - to fit, rejecting sym if its header runs past end, and bound the - substitute name against the actual position of sym->PathBuffer rather - than a fixed offset. - - Because sub_offs and sub_len are 16bits, the pointer math will not - overflow here with the new greater-than. - - Cc: Ronnie Sahlberg - Cc: Shyam Prasad N - Cc: Tom Talpey - Cc: Bharath SM - Cc: linux-cifs@vger.kernel.org - Cc: samba-technical@lists.samba.org - Cc: stable - Reviewed-by: Paulo Alcantara (Red Hat) - Assisted-by: gregkh_clanker_t1000 - Signed-off-by: Greg Kroah-Hartman - Signed-off-by: Steve French - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/smb/client/smb2file.c b/fs/smb/client/smb2file.c -index fa9726f53143..4793981e2bb7 100644 ---- a/fs/smb/client/smb2file.c -+++ b/fs/smb/client/smb2file.c -@@ -27,10 +27,11 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - { - struct smb2_err_rsp *err = iov->iov_base; - struct smb2_symlink_err_rsp *sym = ERR_PTR(-EINVAL); -+ u8 *end = (u8 *)err + iov->iov_len; - u32 len; - - if (err->ErrorContextCount) { -- struct smb2_error_context_rsp *p, *end; -+ struct smb2_error_context_rsp *p; - - len = (u32)err->ErrorContextCount * (offsetof(struct smb2_error_context_rsp, - ErrorContextData) + -@@ -39,8 +40,7 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - return ERR_PTR(-EINVAL); - - p = (struct smb2_error_context_rsp *)err->ErrorData; -- end = (struct smb2_error_context_rsp *)((u8 *)err + iov->iov_len); -- do { -+ while ((u8 *)p + sizeof(*p) <= end) { - if (le32_to_cpu(p->ErrorId) == SMB2_ERROR_ID_DEFAULT) { - sym = (struct smb2_symlink_err_rsp *)p->ErrorContextData; - break; -@@ -50,14 +50,16 @@ static struct smb2_symlink_err_rsp *symlink_data(const struct kvec *iov) - - len = ALIGN(le32_to_cpu(p->ErrorDataLength), 8); - p = (struct smb2_error_context_rsp *)(p->ErrorContextData + len); -- } while (p < end); -+ } - } else if (le32_to_cpu(err->ByteCount) >= sizeof(*sym) && - iov->iov_len >= SMB2_SYMLINK_STRUCT_SIZE) { - sym = (struct smb2_symlink_err_rsp *)err->ErrorData; - } - -- if (!IS_ERR(sym) && (le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG || -- le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK)) -+ if (!IS_ERR(sym) && -+ ((u8 *)sym + sizeof(*sym) > end || -+ le32_to_cpu(sym->SymLinkErrorTag) != SYMLINK_ERROR_TAG || -+ le32_to_cpu(sym->ReparseTag) != IO_REPARSE_TAG_SYMLINK)) - sym = ERR_PTR(-EINVAL); - - return sym; -@@ -128,8 +130,10 @@ int smb2_parse_symlink_response(struct cifs_sb_info *cifs_sb, const struct kvec - print_len = le16_to_cpu(sym->PrintNameLength); - print_offs = le16_to_cpu(sym->PrintNameOffset); - -- if (iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + sub_offs + sub_len || -- iov->iov_len < SMB2_SYMLINK_STRUCT_SIZE + print_offs + print_len) -+ if ((char *)sym->PathBuffer + sub_offs + sub_len > -+ (char *)iov->iov_base + iov->iov_len || -+ (char *)sym->PathBuffer + print_offs + print_len > -+ (char *)iov->iov_base + iov->iov_len) - return -EINVAL; - - return smb2_parse_native_symlink(path, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1262-crypto-authenc-fix-sleep-in-atomic-context-in-decrypt-tail.patch b/SOURCES/1262-crypto-authenc-fix-sleep-in-atomic-context-in-decrypt-tail.patch deleted file mode 100644 index e2a658e8e..000000000 --- a/SOURCES/1262-crypto-authenc-fix-sleep-in-atomic-context-in-decrypt-tail.patch +++ /dev/null @@ -1,46 +0,0 @@ -From b68bb0a260effb5982ab52535a3213ff03b57ed9 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Wed, 29 Apr 2026 23:04:01 +0200 -Subject: [PATCH] crypto: authenc - Fix sleep in atomic context in decrypt_tail - -JIRA: https://issues.redhat.com/browse/RHEL-172166 -Upstream Status: merged into the linux.git - -commit 66eae850333d639fc278d6f915c6fc01499ea893 -Author: Herbert Xu -Date: Wed Jan 19 17:58:40 2022 +1100 - - crypto: authenc - Fix sleep in atomic context in decrypt_tail - - The function crypto_authenc_decrypt_tail discards its flags - argument and always relies on the flags from the original request - when starting its sub-request. - - This is clearly wrong as it may cause the SLEEPABLE flag to be - set when it shouldn't. - - Fixes: 92d95ba91772 ("crypto: authenc - Convert to new AEAD interface") - Reported-by: Corentin Labbe - Signed-off-by: Herbert Xu - Tested-by: Corentin Labbe - Signed-off-by: Herbert Xu - -Assisted-by: Patchpal 0.7.1 -Signed-off-by: Vladislav Dronov - -diff --git a/crypto/authenc.c b/crypto/authenc.c -index 670bf1a01d00..17f674a7cdff 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -253,7 +253,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); - - skcipher_request_set_tfm(skreq, ctx->enc); -- skcipher_request_set_callback(skreq, aead_request_flags(req), -+ skcipher_request_set_callback(skreq, flags, - req->base.complete, req->base.data); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1263-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch b/SOURCES/1263-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch deleted file mode 100644 index 875886abe..000000000 --- a/SOURCES/1263-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch +++ /dev/null @@ -1,213 +0,0 @@ -From 6cedc3414cbe4e00b4a85ac4381edb18805194d6 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Wed, 29 Apr 2026 23:05:43 +0200 -Subject: [PATCH] crypto: authenc - Correctly pass EINPROGRESS back up to the - caller - -JIRA: https://issues.redhat.com/browse/RHEL-172166 -Upstream Status: merged into the linux.git - -Conflicts: Missing a large crypto-tree-wide upstream patch 255e48eb1768 -("crypto: api - Use data directly in completion function"). To apply: - - Change "void *data" back to "struct crypto_async_request *areq". - - Changle "struct aead_request *req = data" back to "struct aead_request - *req = areq->data". - -commit 96feb73def02d175850daa0e7c2c90c876681b5c -Author: Herbert Xu -Date: Wed Sep 24 18:20:17 2025 +0800 - - crypto: authenc - Correctly pass EINPROGRESS back up to the caller - - When authenc is invoked with MAY_BACKLOG, it needs to pass EINPROGRESS - notifications back up to the caller when the underlying algorithm - returns EBUSY synchronously. - - However, if the EBUSY comes from the second part of an authenc call, - i.e., it is asynchronous, both the EBUSY and the subsequent EINPROGRESS - notification must not be passed to the caller. - - Implement this by passing a mask to the function that starts the - second half of authenc and using it to determine whether EBUSY - and EINPROGRESS should be passed to the caller. - - This was a deficiency in the original implementation of authenc - because it was not expected to be used with MAY_BACKLOG. - - Reported-by: Ingo Franzki - Reported-by: Mikulas Patocka - Fixes: 180ce7e81030 ("crypto: authenc - Add EINPROGRESS check") - Signed-off-by: Herbert Xu - -Assisted-by: Patchpal AI 0.7.1 -Signed-off-by: Vladislav Dronov - -diff --git a/crypto/authenc.c b/crypto/authenc.c -index 17f674a7cdff..494c0b6db431 100644 ---- a/crypto/authenc.c -+++ b/crypto/authenc.c -@@ -39,7 +39,7 @@ struct authenc_request_ctx { - - static void authenc_request_complete(struct aead_request *req, int err) - { -- if (err != -EINPROGRESS) -+ if (err != -EINPROGRESS && err != -EBUSY) - aead_request_complete(req, err); - } - -@@ -109,27 +109,42 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key, - return err; - } - --static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err) -+static void authenc_geniv_ahash_finish(struct aead_request *req) - { -- struct aead_request *req = areq->data; - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); - struct authenc_instance_ctx *ictx = aead_instance_ctx(inst); - struct authenc_request_ctx *areq_ctx = aead_request_ctx(req); - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); - -- if (err) -- goto out; -- - scatterwalk_map_and_copy(ahreq->result, req->dst, - req->assoclen + req->cryptlen, - crypto_aead_authsize(authenc), 1); -+} - --out: -+static void authenc_geniv_ahash_done(struct crypto_async_request *areq, int err) -+{ -+ struct aead_request *req = areq->data; -+ -+ if (!err) -+ authenc_geniv_ahash_finish(req); - aead_request_complete(req, err); - } - --static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) -+/* -+ * Used when the ahash request was invoked in the async callback context -+ * of the previous skcipher request. Eat any EINPROGRESS notifications. -+ */ -+static void authenc_geniv_ahash_done2(struct crypto_async_request *areq, int err) -+{ -+ struct aead_request *req = areq->data; -+ -+ if (!err) -+ authenc_geniv_ahash_finish(req); -+ authenc_request_complete(req, err); -+} -+ -+static int crypto_authenc_genicv(struct aead_request *req, unsigned int mask) - { - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); -@@ -138,6 +153,7 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) - struct crypto_ahash *auth = ctx->auth; - struct authenc_request_ctx *areq_ctx = aead_request_ctx(req); - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); -+ unsigned int flags = aead_request_flags(req) & ~mask; - u8 *hash = areq_ctx->tail; - int err; - -@@ -148,7 +164,8 @@ static int crypto_authenc_genicv(struct aead_request *req, unsigned int flags) - ahash_request_set_crypt(ahreq, req->dst, hash, - req->assoclen + req->cryptlen); - ahash_request_set_callback(ahreq, flags, -- authenc_geniv_ahash_done, req); -+ mask ? authenc_geniv_ahash_done2 : -+ authenc_geniv_ahash_done, req); - - err = crypto_ahash_digest(ahreq); - if (err) -@@ -165,12 +182,11 @@ static void crypto_authenc_encrypt_done(struct crypto_async_request *req, - { - struct aead_request *areq = req->data; - -- if (err) -- goto out; -- -- err = crypto_authenc_genicv(areq, 0); -- --out: -+ if (err) { -+ aead_request_complete(areq, err); -+ return; -+ } -+ err = crypto_authenc_genicv(areq, CRYPTO_TFM_REQ_MAY_SLEEP); - authenc_request_complete(areq, err); - } - -@@ -223,11 +239,18 @@ static int crypto_authenc_encrypt(struct aead_request *req) - if (err) - return err; - -- return crypto_authenc_genicv(req, aead_request_flags(req)); -+ return crypto_authenc_genicv(req, 0); -+} -+ -+static void authenc_decrypt_tail_done(struct crypto_async_request *areq, int err) -+{ -+ struct aead_request *req = areq->data; -+ -+ authenc_request_complete(req, err); - } - - static int crypto_authenc_decrypt_tail(struct aead_request *req, -- unsigned int flags) -+ unsigned int mask) - { - struct crypto_aead *authenc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(authenc); -@@ -238,6 +261,7 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - struct skcipher_request *skreq = (void *)(areq_ctx->tail + - ictx->reqoff); - unsigned int authsize = crypto_aead_authsize(authenc); -+ unsigned int flags = aead_request_flags(req) & ~mask; - u8 *ihash = ahreq->result + authsize; - struct scatterlist *src, *dst; - -@@ -254,7 +278,9 @@ static int crypto_authenc_decrypt_tail(struct aead_request *req, - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, flags, -- req->base.complete, req->base.data); -+ mask ? authenc_decrypt_tail_done : -+ req->base.complete, -+ mask ? req : req->base.data); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); - -@@ -266,12 +292,11 @@ static void authenc_verify_ahash_done(struct crypto_async_request *areq, - { - struct aead_request *req = areq->data; - -- if (err) -- goto out; -- -- err = crypto_authenc_decrypt_tail(req, 0); -- --out: -+ if (err) { -+ aead_request_complete(req, err); -+ return; -+ } -+ err = crypto_authenc_decrypt_tail(req, CRYPTO_TFM_REQ_MAY_SLEEP); - authenc_request_complete(req, err); - } - -@@ -301,7 +326,7 @@ static int crypto_authenc_decrypt(struct aead_request *req) - if (err) - return err; - -- return crypto_authenc_decrypt_tail(req, aead_request_flags(req)); -+ return crypto_authenc_decrypt_tail(req, 0); - } - - static int crypto_authenc_init_tfm(struct crypto_aead *tfm) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1264-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch b/SOURCES/1264-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch deleted file mode 100644 index 409d615e0..000000000 --- a/SOURCES/1264-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 27fdbab4221b375de54bf91919798d88520c6e28 Mon Sep 17 00:00:00 2001 -From: Juergen Gross -Date: Fri, 27 Mar 2026 14:13:38 +0100 -Subject: [PATCH] Buffer overflow in drivers/xen/sys-hypervisor.c - -The build id returned by HYPERVISOR_xen_version(XENVER_build_id) is -neither NUL terminated nor a string. - -The first causes a buffer overflow as sprintf in buildid_show will -read and copy till it finds a NUL. - -00000000 f4 91 51 f4 dd 38 9e 9d 65 47 52 eb 10 71 db 50 |..Q..8..eGR..q.P| -00000010 b9 a8 01 42 6f 2e 32 |...Bo.2| -00000017 - -So use a memcpy instead of sprintf to have the correct value: - -00000000 f4 91 51 f4 dd 00 9e 9d 65 47 52 eb 10 71 db 50 |..Q.....eGR..q.P| -00000010 b9 a8 01 42 |...B| -00000014 - -(the above have a hack to embed a zero inside and check it's -returned correctly). - -This is XSA-485 / CVE-2026-31786 - -Fixes: 84b7625728ea ("xen: add sysfs node for hypervisor build id") -Signed-off-by: Frediano Ziglio -Reviewed-by: Juergen Gross -Signed-off-by: Juergen Gross - -diff --git a/drivers/xen/sys-hypervisor.c b/drivers/xen/sys-hypervisor.c -index b1bb01ba82f8..91923242a5ae 100644 ---- a/drivers/xen/sys-hypervisor.c -+++ b/drivers/xen/sys-hypervisor.c -@@ -366,6 +366,8 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) - ret = sprintf(buffer, ""); - return ret; - } -+ if (ret > PAGE_SIZE) -+ return -ENOSPC; - - buildid = kmalloc(sizeof(*buildid) + ret, GFP_KERNEL); - if (!buildid) -@@ -373,8 +375,10 @@ static ssize_t buildid_show(struct hyp_sysfs_attr *attr, char *buffer) - - buildid->len = ret; - ret = HYPERVISOR_xen_version(XENVER_build_id, buildid); -- if (ret > 0) -- ret = sprintf(buffer, "%s", buildid->buf); -+ if (ret > 0) { -+ /* Build id is binary, not a string. */ -+ memcpy(buffer, buildid->buf, ret); -+ } - kfree(buildid); - - return ret; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1265-nvme-nvme-fc-move-tagset-removal-to-nvme-fc-delete-ctrl.patch b/SOURCES/1265-nvme-nvme-fc-move-tagset-removal-to-nvme-fc-delete-ctrl.patch deleted file mode 100644 index a1a782c6b..000000000 --- a/SOURCES/1265-nvme-nvme-fc-move-tagset-removal-to-nvme-fc-delete-ctrl.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 75537b257b7125983cc0a54f0a2878d28677eb50 Mon Sep 17 00:00:00 2001 -From: "Ewan D. Milne" -Date: Mon, 18 May 2026 11:14:05 -0400 -Subject: [PATCH] nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171725 -Upstream Status: From upstream linux mainline - -Now target is removed from nvme_fc_ctrl_free() which is the ctrl->ref -release handler. And even admin queue is unquiesced there, this way -is definitely wrong because the ctr->ref is grabbed when submitting -command. - -And Marco observed that nvme_fc_ctrl_free() can be called from request -completion code path, and trigger kernel warning since request completes -from softirq context. - -Fix the issue by moveing target removal into nvme_fc_delete_ctrl(), -which is also aligned with nvme-tcp and nvme-rdma. - -Patch originally proposed by Ming Lei, then modified to move the tagset -removal down to after nvme_fc_delete_association() after further testing. - -Cc: Marco Patalano -Cc: Ewan Milne -Cc: James Smart -Cc: Sagi Grimberg -Signed-off-by: Ming Lei -Cc: stable@vger.kernel.org -Tested-by: Marco Patalano -Reviewed-by: Justin Tee -Signed-off-by: Ewan D. Milne -Signed-off-by: Keith Busch -(cherry picked from commit ea3442efabd0aa3930c5bab73c3901ef38ef6ac3) -Signed-off-by: Ewan D. Milne - -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index bd6cbe35dace..3e500e87e30c 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -2354,17 +2354,11 @@ nvme_fc_ctrl_free(struct kref *ref) - container_of(ref, struct nvme_fc_ctrl, ref); - unsigned long flags; - -- if (ctrl->ctrl.tagset) -- nvme_remove_io_tag_set(&ctrl->ctrl); -- - /* remove from rport list */ - spin_lock_irqsave(&ctrl->rport->lock, flags); - list_del(&ctrl->ctrl_list); - spin_unlock_irqrestore(&ctrl->rport->lock, flags); - -- nvme_unquiesce_admin_queue(&ctrl->ctrl); -- nvme_remove_admin_tag_set(&ctrl->ctrl); -- - kfree(ctrl->queues); - - put_device(ctrl->dev); -@@ -3252,11 +3246,18 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) - - cancel_work_sync(&ctrl->ioerr_work); - cancel_delayed_work_sync(&ctrl->connect_work); -+ - /* - * kill the association on the link side. this will block - * waiting for io to terminate - */ - nvme_fc_delete_association(ctrl); -+ -+ if (ctrl->ctrl.tagset) -+ nvme_remove_io_tag_set(&ctrl->ctrl); -+ -+ nvme_unquiesce_admin_queue(&ctrl->ctrl); -+ nvme_remove_admin_tag_set(&ctrl->ctrl); - } - - static void --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1266-nvme-nvme-fc-ensure-ioerr-work-is-cancelled-in-nvme-fc-delet.patch b/SOURCES/1266-nvme-nvme-fc-ensure-ioerr-work-is-cancelled-in-nvme-fc-delet.patch deleted file mode 100644 index 3f4a76f4c..000000000 --- a/SOURCES/1266-nvme-nvme-fc-ensure-ioerr-work-is-cancelled-in-nvme-fc-delet.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 08fc4018856d6e04b7517e1ea515f06e86a05128 Mon Sep 17 00:00:00 2001 -From: "Ewan D. Milne" -Date: Mon, 18 May 2026 11:19:16 -0400 -Subject: [PATCH] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in - nvme_fc_delete_ctrl() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171725 -Upstream Status: From upstream linux mainline - -nvme_fc_delete_assocation() waits for pending I/O to complete before -returning, and an error can cause ->ioerr_work to be queued after -cancel_work_sync() had been called. Move the call to cancel_work_sync() to -be after nvme_fc_delete_association() to ensure ->ioerr_work is not running -when the nvme_fc_ctrl object is freed. Otherwise the following can occur: - -[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL -[ 1135.917705] ------------[ cut here ]------------ -[ 1135.922336] kernel BUG at lib/list_debug.c:52! -[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI -[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary) -[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025 -[ 1135.950969] Workqueue: 0x0 (nvme-wq) -[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f -[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b -[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046 -[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000 -[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0 -[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08 -[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100 -[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0 -[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000 -[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0 -[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 -[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400 -[ 1136.055910] PKRU: 55555554 -[ 1136.058623] Call Trace: -[ 1136.061074] -[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0 -[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0 -[ 1136.071898] ? move_linked_works+0x4a/0xa0 -[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f -[ 1136.081744] ? __die_body.cold+0x8/0x12 -[ 1136.085584] ? die+0x2e/0x50 -[ 1136.088469] ? do_trap+0xca/0x110 -[ 1136.091789] ? do_error_trap+0x65/0x80 -[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f -[ 1136.101289] ? exc_invalid_op+0x50/0x70 -[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f -[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20 -[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f -[ 1136.120806] move_linked_works+0x4a/0xa0 -[ 1136.124733] worker_thread+0x216/0x3a0 -[ 1136.128485] ? __pfx_worker_thread+0x10/0x10 -[ 1136.132758] kthread+0xfa/0x240 -[ 1136.135904] ? __pfx_kthread+0x10/0x10 -[ 1136.139657] ret_from_fork+0x31/0x50 -[ 1136.143236] ? __pfx_kthread+0x10/0x10 -[ 1136.146988] ret_from_fork_asm+0x1a/0x30 -[ 1136.150915] - -Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context") -Cc: stable@vger.kernel.org -Tested-by: Marco Patalano -Reviewed-by: Justin Tee -Signed-off-by: Ewan D. Milne -Signed-off-by: Keith Busch -(cherry picked from commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256) -Signed-off-by: Ewan D. Milne - -diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c -index 3e500e87e30c..6cc7d11ad5c0 100644 ---- a/drivers/nvme/host/fc.c -+++ b/drivers/nvme/host/fc.c -@@ -3244,7 +3244,6 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) - { - struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl); - -- cancel_work_sync(&ctrl->ioerr_work); - cancel_delayed_work_sync(&ctrl->connect_work); - - /* -@@ -3252,6 +3251,7 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nctrl) - * waiting for io to terminate - */ - nvme_fc_delete_association(ctrl); -+ cancel_work_sync(&ctrl->ioerr_work); - - if (ctrl->ctrl.tagset) - nvme_remove_io_tag_set(&ctrl->ctrl); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1267-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch b/SOURCES/1267-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch deleted file mode 100644 index 14a740bec..000000000 --- a/SOURCES/1267-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch +++ /dev/null @@ -1,58 +0,0 @@ -From e88ced2e3c3091122785c0a2dd822b61d1839d58 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 27 Mar 2026 13:14:31 +0100 -Subject: [PATCH] s390/dasd: Fix gendisk parent after copy pair swap - -JIRA: https://issues.redhat.com/browse/RHEL-161530 - -commit c943bfc6afb8d0e781b9b7406f36caa8bbf95cb9 -Author: Stefan Haberland -Date: Wed Nov 26 17:06:31 2025 +0100 - - s390/dasd: Fix gendisk parent after copy pair swap - - After a copy pair swap the block device's "device" symlink points to - the secondary CCW device, but the gendisk's parent remained the - primary, leaving /sys/block/ under the wrong parent. - - Move the gendisk to the secondary's device with device_move(), keeping - the sysfs topology consistent after the swap. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Signed-off-by: Stefan Haberland - Signed-off-by: Jens Axboe - -Signed-off-by: Stefan Haberland -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index c60424afaf04..7e8679d7c686 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6148,6 +6148,7 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - struct dasd_copy_relation *copy; - struct dasd_block *block; - struct gendisk *gdp; -+ int rc; - - copy = device->copy; - if (!copy) -@@ -6182,6 +6183,13 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - /* swap blocklayer device link */ - gdp = block->gdp; - dasd_add_link_to_gendisk(gdp, secondary); -+ rc = device_move(disk_to_dev(gdp), &secondary->cdev->dev, DPM_ORDER_NONE); -+ if (rc) { -+ dev_err(&primary->cdev->dev, -+ "copy_pair_swap: moving blockdevice parent %s->%s failed (%d)\n", -+ dev_name(&primary->cdev->dev), -+ dev_name(&secondary->cdev->dev), rc); -+ } - - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1268-s390-dasd-move-quiesce-state-with-pprc-swap.patch b/SOURCES/1268-s390-dasd-move-quiesce-state-with-pprc-swap.patch deleted file mode 100644 index d8a2ea712..000000000 --- a/SOURCES/1268-s390-dasd-move-quiesce-state-with-pprc-swap.patch +++ /dev/null @@ -1,54 +0,0 @@ -From 02a659e928f9ef15fc673384e95def0b088c9684 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 27 Mar 2026 13:14:33 +0100 -Subject: [PATCH] s390/dasd: Move quiesce state with pprc swap - -JIRA: https://issues.redhat.com/browse/RHEL-161530 - -commit 40e9cd4ae8ec43b107ed2bff422a8fa39dcf4e4b -Author: Stefan Haberland -Date: Tue Mar 10 15:23:29 2026 +0100 - - s390/dasd: Move quiesce state with pprc swap - - Quiesce and resume is a mechanism to suspend operations on DASD devices. - In the context of a controlled copy pair swap operation, the quiesce - operation is usually issued before the actual swap and a resume - afterwards. - - During the swap operation, the underlying device is exchanged. Therefore, - the quiesce flag must be moved to the secondary device to ensure a - consistent quiesce state after the swap. - - The secondary device itself cannot be suspended separately because there - is no separate block device representation for it. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Signed-off-by: Stefan Haberland - Link: https://patch.msgid.link/20260310142330.4080106-2-sth@linux.ibm.com - Signed-off-by: Jens Axboe - -Signed-off-by: Stefan Haberland -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 7e8679d7c686..f53791c9cbe7 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6191,6 +6191,11 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - dev_name(&secondary->cdev->dev), rc); - } - -+ if (primary->stopped & DASD_STOPPED_QUIESCE) { -+ dasd_device_set_stop_bits(secondary, DASD_STOPPED_QUIESCE); -+ dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE); -+ } -+ - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); - dasd_device_remove_stop_bits(secondary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1269-s390-dasd-copy-detected-format-information-to-secondary-devi.patch b/SOURCES/1269-s390-dasd-copy-detected-format-information-to-secondary-devi.patch deleted file mode 100644 index 711f4a4a6..000000000 --- a/SOURCES/1269-s390-dasd-copy-detected-format-information-to-secondary-devi.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 85945142a2a0c5d6a104b9d86eab6648a023765d Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 27 Mar 2026 13:14:35 +0100 -Subject: [PATCH] s390/dasd: Copy detected format information to secondary - device - -JIRA: https://issues.redhat.com/browse/RHEL-161530 - -commit 4c527c7e030672efd788d0806d7a68972a7ba3c1 -Author: Stefan Haberland -Date: Tue Mar 10 15:23:30 2026 +0100 - - s390/dasd: Copy detected format information to secondary device - - During online processing for a DASD device an IO operation is started to - determine the format of the device. CDL format contains specifically - sized blocks at the beginning of the disk. - - For a PPRC secondary device no real IO operation is possible therefore - this IO request can not be started and this step is skipped for online - processing of secondary devices. This is generally fine since the - secondary is a copy of the primary device. - - In case of an additional partition detection that is run after a swap - operation the format information is needed to properly drive partition - detection IO. - - Currently the information is not passed leading to IO errors during - partition detection and a wrongly detected partition table which in turn - might lead to data corruption on the disk with the wrong partition table. - - Fix by passing the format information from primary to secondary device. - - Fixes: 413862caad6f ("s390/dasd: add copy pair swap capability") - Cc: stable@vger.kernel.org #6.1 - Reviewed-by: Jan Hoeppner - Acked-by: Eduard Shishkin - Signed-off-by: Stefan Haberland - Link: https://patch.msgid.link/20260310142330.4080106-3-sth@linux.ibm.com - Signed-off-by: Jens Axboe - -Signed-off-by: Stefan Haberland -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index f53791c9cbe7..54d6d29477e4 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -6144,6 +6144,7 @@ static void copy_pair_set_active(struct dasd_copy_relation *copy, char *new_busi - static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid, - char *sec_busid) - { -+ struct dasd_eckd_private *prim_priv, *sec_priv; - struct dasd_device *primary, *secondary; - struct dasd_copy_relation *copy; - struct dasd_block *block; -@@ -6164,6 +6165,9 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - if (!secondary) - return DASD_COPYPAIRSWAP_SECONDARY; - -+ prim_priv = primary->private; -+ sec_priv = secondary->private; -+ - /* - * usually the device should be quiesced for swap - * for paranoia stop device and requeue requests again -@@ -6196,6 +6200,13 @@ static int dasd_eckd_copy_pair_swap(struct dasd_device *device, char *prim_busid - dasd_device_remove_stop_bits(primary, DASD_STOPPED_QUIESCE); - } - -+ /* -+ * The secondary device never got through format detection, but since it -+ * is a copy of the primary device, the format is exactly the same; -+ * therefore, the detected layout can simply be copied. -+ */ -+ sec_priv->uses_cdl = prim_priv->uses_cdl; -+ - /* re-enable device */ - dasd_device_remove_stop_bits(primary, DASD_STOPPED_PPRC); - dasd_device_remove_stop_bits(secondary, DASD_STOPPED_PPRC); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1270-x86-kvm-avoid-freeing-stack-allocated-node-in-kvm-async-pf-q.patch b/SOURCES/1270-x86-kvm-avoid-freeing-stack-allocated-node-in-kvm-async-pf-q.patch deleted file mode 100644 index 21d245b2b..000000000 --- a/SOURCES/1270-x86-kvm-avoid-freeing-stack-allocated-node-in-kvm-async-pf-q.patch +++ /dev/null @@ -1,86 +0,0 @@ -From c29c799bc106385fe74e3a9a51c58087c8f9e725 Mon Sep 17 00:00:00 2001 -From: Ryosuke Yasuoka -Date: Thu, 15 Jan 2026 13:31:39 +0900 -Subject: [PATCH] x86/kvm: Avoid freeing stack-allocated node in - kvm_async_pf_queue_task - -JIRA: https://issues.redhat.com/browse/RHEL-125085 - -commit 95cc9e7cf03d3646abce4129d5c013af33a7df99 -Author: Ryosuke Yasuoka -Date: Sat Dec 6 23:09:36 2025 +0900 - - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task - - kvm_async_pf_queue_task() can incorrectly try to kfree() a node - allocated on the stack of kvm_async_pf_task_wait_schedule(). - - This occurs when a task requests a PF while another task's PF request - with the same token is still pending. Since the token is derived from - the (u32)address in exc_page_fault(), two different tasks can generate - the same token. - - Currently, kvm_async_pf_queue_task() assumes that any entry found in the - list is a dummy entry and tries to kfree() it. To fix this, add a flag - to the node structure to distinguish stack-allocated nodes, and only - kfree() the node if it is a dummy entry. - - Signed-off-by: Ryosuke Yasuoka - Message-ID: <20251206140939.144038-1-ryasuoka@redhat.com> - Signed-off-by: Paolo Bonzini - -Signed-off-by: Ryosuke Yasuoka - -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index c8b1db5c914c..16d4e504bedf 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -86,6 +86,7 @@ struct kvm_task_sleep_node { - struct swait_queue_head wq; - u32 token; - int cpu; -+ bool dummy; - }; - - static struct kvm_task_sleep_head { -@@ -117,15 +118,26 @@ static bool kvm_async_pf_queue_task(u32 token, struct kvm_task_sleep_node *n) - raw_spin_lock(&b->lock); - e = _find_apf_task(b, token); - if (e) { -- /* dummy entry exist -> wake up was delivered ahead of PF */ -- hlist_del(&e->link); -+ struct kvm_task_sleep_node *dummy = NULL; -+ -+ /* -+ * The entry can either be a 'dummy' entry (which is put on the -+ * list when wake-up happens ahead of APF handling completion) -+ * or a token from another task which should not be touched. -+ */ -+ if (e->dummy) { -+ hlist_del(&e->link); -+ dummy = e; -+ } -+ - raw_spin_unlock(&b->lock); -- kfree(e); -+ kfree(dummy); - return false; - } - - n->token = token; - n->cpu = smp_processor_id(); -+ n->dummy = false; - init_swait_queue_head(&n->wq); - hlist_add_head(&n->link, &b->list); - raw_spin_unlock(&b->lock); -@@ -228,6 +240,7 @@ void kvm_async_pf_task_wake(u32 token) - } - dummy->token = token; - dummy->cpu = smp_processor_id(); -+ dummy->dummy = true; - init_swait_queue_head(&dummy->wq); - hlist_add_head(&dummy->link, &b->list); - dummy = NULL; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1271-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch b/SOURCES/1271-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch deleted file mode 100644 index e15849eca..000000000 --- a/SOURCES/1271-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 2884bf72fb8f03409e423397319205de48adca16 Mon Sep 17 00:00:00 2001 -From: Xiang Mei -Date: Thu, 26 Mar 2026 00:55:53 -0700 -Subject: [PATCH] net: bonding: fix use-after-free in bond_xmit_broadcast() - -bond_xmit_broadcast() reuses the original skb for the last slave -(determined by bond_is_last_slave()) and clones it for others. -Concurrent slave enslave/release can mutate the slave list during -RCU-protected iteration, changing which slave is "last" mid-loop. -This causes the original skb to be double-consumed (double-freed). - -Replace the racy bond_is_last_slave() check with a simple index -comparison (i + 1 == slaves_count) against the pre-snapshot slave -count taken via READ_ONCE() before the loop. This preserves the -zero-copy optimization for the last slave while making the "last" -determination stable against concurrent list mutations. - -The UAF can trigger the following crash: - -================================================================== -BUG: KASAN: slab-use-after-free in skb_clone -Read of size 8 at addr ffff888100ef8d40 by task exploit/147 - -CPU: 1 UID: 0 PID: 147 Comm: exploit Not tainted 7.0.0-rc3+ #4 PREEMPTLAZY -Call Trace: - - dump_stack_lvl (lib/dump_stack.c:123) - print_report (mm/kasan/report.c:379 mm/kasan/report.c:482) - kasan_report (mm/kasan/report.c:597) - skb_clone (include/linux/skbuff.h:1724 include/linux/skbuff.h:1792 include/linux/skbuff.h:3396 net/core/skbuff.c:2108) - bond_xmit_broadcast (drivers/net/bonding/bond_main.c:5334) - bond_start_xmit (drivers/net/bonding/bond_main.c:5567 drivers/net/bonding/bond_main.c:5593) - dev_hard_start_xmit (include/linux/netdevice.h:5325 include/linux/netdevice.h:5334 net/core/dev.c:3871 net/core/dev.c:3887) - __dev_queue_xmit (include/linux/netdevice.h:3601 net/core/dev.c:4838) - ip6_finish_output2 (include/net/neighbour.h:540 include/net/neighbour.h:554 net/ipv6/ip6_output.c:136) - ip6_finish_output (net/ipv6/ip6_output.c:208 net/ipv6/ip6_output.c:219) - ip6_output (net/ipv6/ip6_output.c:250) - ip6_send_skb (net/ipv6/ip6_output.c:1985) - udp_v6_send_skb (net/ipv6/udp.c:1442) - udpv6_sendmsg (net/ipv6/udp.c:1733) - __sys_sendto (net/socket.c:730 net/socket.c:742 net/socket.c:2206) - __x64_sys_sendto (net/socket.c:2209) - do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) - entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) - - -Allocated by task 147: - -Freed by task 147: - -The buggy address belongs to the object at ffff888100ef8c80 - which belongs to the cache skbuff_head_cache of size 224 -The buggy address is located 192 bytes inside of - freed 224-byte region [ffff888100ef8c80, ffff888100ef8d60) - -Memory state around the buggy address: - ffff888100ef8c00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc - ffff888100ef8c80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ->ffff888100ef8d00: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc - ^ - ffff888100ef8d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb - ffff888100ef8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -================================================================== - -Fixes: 4e5bd03ae346 ("net: bonding: fix bond_xmit_broadcast return value error bug") -Reported-by: Weiming Shi -Signed-off-by: Xiang Mei -Link: https://patch.msgid.link/20260326075553.3960562-1-xmei5@asu.edu -Signed-off-by: Paolo Abeni - -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 33f414d03ab9..a5484d11553d 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -5326,7 +5326,7 @@ static netdev_tx_t bond_xmit_broadcast(struct sk_buff *skb, - if (!(bond_slave_is_up(slave) && slave->link == BOND_LINK_UP)) - continue; - -- if (bond_is_last_slave(bond, slave)) { -+ if (i + 1 == slaves_count) { - skb2 = skb; - skb_used = true; - } else { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1272-scsi-target-iscsi-fix-use-after-free-in-iscsit-dec-conn-usag.patch b/SOURCES/1272-scsi-target-iscsi-fix-use-after-free-in-iscsit-dec-conn-usag.patch deleted file mode 100644 index 5f52c494c..000000000 --- a/SOURCES/1272-scsi-target-iscsi-fix-use-after-free-in-iscsit-dec-conn-usag.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 9411a89e9e7135cc459178fa77a3f1d6191ae903 Mon Sep 17 00:00:00 2001 -From: Maurizio Lombardi -Date: Mon, 12 Jan 2026 17:53:51 +0100 -Subject: [PATCH] scsi: target: iscsi: Fix use-after-free in - iscsit_dec_conn_usage_count() - -In iscsit_dec_conn_usage_count(), the function calls complete() while -holding the conn->conn_usage_lock. As soon as complete() is invoked, the -waiter (such as iscsit_close_connection()) may wake up and proceed to free -the iscsit_conn structure. - -If the waiter frees the memory before the current thread reaches -spin_unlock_bh(), it results in a KASAN slab-use-after-free as the function -attempts to release a lock within the already-freed connection structure. - -Fix this by releasing the spinlock before calling complete(). - -Signed-off-by: Maurizio Lombardi -Reported-by: Zhaojuan Guo -Reviewed-by: Mike Christie -Link: https://patch.msgid.link/20260112165352.138606-2-mlombard@redhat.com -Signed-off-by: Martin K. Petersen - -diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c -index 5e6cf34929b5..3319394bf542 100644 ---- a/drivers/target/iscsi/iscsi_target_util.c -+++ b/drivers/target/iscsi/iscsi_target_util.c -@@ -810,8 +810,11 @@ void iscsit_dec_conn_usage_count(struct iscsit_conn *conn) - spin_lock_bh(&conn->conn_usage_lock); - conn->conn_usage_count--; - -- if (!conn->conn_usage_count && conn->conn_waiting_on_uc) -+ if (!conn->conn_usage_count && conn->conn_waiting_on_uc) { -+ spin_unlock_bh(&conn->conn_usage_lock); - complete(&conn->conn_waiting_on_uc_comp); -+ return; -+ } - - spin_unlock_bh(&conn->conn_usage_lock); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1273-net-mana-fix-use-after-free-in-add-adev-error-path.patch b/SOURCES/1273-net-mana-fix-use-after-free-in-add-adev-error-path.patch deleted file mode 100644 index effc80694..000000000 --- a/SOURCES/1273-net-mana-fix-use-after-free-in-add-adev-error-path.patch +++ /dev/null @@ -1,69 +0,0 @@ -From d23a5f0e39e18eafc25a9ac4cbc7b26fbfdea21e Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 19:22:31 +0000 -Subject: [PATCH] net: mana: fix use-after-free in add_adev() error path - -JIRA: https://redhat.atlassian.net/browse/RHEL-172769 -CVE: CVE-2026-43056 - -commit c4ea7d8907cf72b259bf70bd8c2e791e1c4ff70f -Author: Guangshuo Li -Date: Tue Mar 24 00:57:30 2026 +0800 - - net: mana: fix use-after-free in add_adev() error path - - If auxiliary_device_add() fails, add_adev() jumps to add_fail and calls - auxiliary_device_uninit(adev). - - The auxiliary device has its release callback set to adev_release(), - which frees the containing struct mana_adev. Since adev is embedded in - struct mana_adev, the subsequent fall-through to init_fail and access - to adev->id may result in a use-after-free. - - Fix this by saving the allocated auxiliary device id in a local - variable before calling auxiliary_device_add(), and use that saved id - in the cleanup path after auxiliary_device_uninit(). - - Fixes: a69839d4327d ("net: mana: Add support for auxiliary device") - Cc: stable@vger.kernel.org - Reviewed-by: Long Li - Signed-off-by: Guangshuo Li - Link: https://patch.msgid.link/20260323165730.945365-1-lgs201920130244@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c -index 055a84643d14..a64ef3e227bc 100644 ---- a/drivers/net/ethernet/microsoft/mana/mana_en.c -+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c -@@ -3196,6 +3196,7 @@ static int add_adev(struct gdma_dev *gd, const char *name) - struct auxiliary_device *adev; - struct mana_adev *madev; - int ret; -+ int id; - - madev = kzalloc(sizeof(*madev), GFP_KERNEL); - if (!madev) -@@ -3205,7 +3206,8 @@ static int add_adev(struct gdma_dev *gd, const char *name) - ret = mana_adev_idx_alloc(); - if (ret < 0) - goto idx_fail; -- adev->id = ret; -+ id = ret; -+ adev->id = id; - - adev->name = name; - adev->dev.parent = gd->gdma_context->dev; -@@ -3231,7 +3233,7 @@ static int add_adev(struct gdma_dev *gd, const char *name) - auxiliary_device_uninit(adev); - - init_fail: -- mana_adev_idx_free(adev->id); -+ mana_adev_idx_free(id); - - idx_fail: - kfree(madev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1274-alsa-6fire-fix-use-after-free-on-disconnect.patch b/SOURCES/1274-alsa-6fire-fix-use-after-free-on-disconnect.patch deleted file mode 100644 index c574e9697..000000000 --- a/SOURCES/1274-alsa-6fire-fix-use-after-free-on-disconnect.patch +++ /dev/null @@ -1,90 +0,0 @@ -From e3fcfc25d4d21b251685ba9ce984e87b674a0fad Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:31:07 +0000 -Subject: [PATCH] ALSA: 6fire: fix use-after-free on disconnect - -JIRA: https://redhat.atlassian.net/browse/RHEL-172970 -CVE: CVE-2026-31581 - -commit b9c826916fdce6419b94eb0cd8810fdac18c2386 -Author: Berk Cem Goksel -Date: Fri Apr 10 08:13:41 2026 +0300 - - ALSA: 6fire: fix use-after-free on disconnect - - In usb6fire_chip_abort(), the chip struct is allocated as the card's - private data (via snd_card_new with sizeof(struct sfire_chip)). When - snd_card_free_when_closed() is called and no file handles are open, the - card and embedded chip are freed synchronously. The subsequent - chip->card = NULL write then hits freed slab memory. - - Call trace: - usb6fire_chip_abort sound/usb/6fire/chip.c:59 [inline] - usb6fire_chip_disconnect+0x348/0x358 sound/usb/6fire/chip.c:182 - usb_unbind_interface+0x1a8/0x88c drivers/usb/core/driver.c:458 - ... - hub_event+0x1a04/0x4518 drivers/usb/core/hub.c:5953 - - Fix by moving the card lifecycle out of usb6fire_chip_abort() and into - usb6fire_chip_disconnect(). The card pointer is saved in a local - before any teardown, snd_card_disconnect() is called first to prevent - new opens, URBs are aborted while chip is still valid, and - snd_card_free_when_closed() is called last so chip is never accessed - after the card may be freed. - - Fixes: a0810c3d6dd2 ("ALSA: 6fire: Release resources at card release") - Cc: stable@vger.kernel.org - Cc: Andrey Konovalov - Signed-off-by: Berk Cem Goksel - Link: https://patch.msgid.link/20260410051341.1069716-1-berkcgoksel@gmail.com - Signed-off-by: Takashi Iwai - -Signed-off-by: CKI Backport Bot - -diff --git a/sound/usb/6fire/chip.c b/sound/usb/6fire/chip.c -index 5ff78814e687..874f6cd503ca 100644 ---- a/sound/usb/6fire/chip.c -+++ b/sound/usb/6fire/chip.c -@@ -53,11 +53,6 @@ static void usb6fire_chip_abort(struct sfire_chip *chip) - usb6fire_comm_abort(chip); - if (chip->control) - usb6fire_control_abort(chip); -- if (chip->card) { -- snd_card_disconnect(chip->card); -- snd_card_free_when_closed(chip->card); -- chip->card = NULL; -- } - } - } - -@@ -168,6 +163,7 @@ static int usb6fire_chip_probe(struct usb_interface *intf, - static void usb6fire_chip_disconnect(struct usb_interface *intf) - { - struct sfire_chip *chip; -+ struct snd_card *card; - - chip = usb_get_intfdata(intf); - if (chip) { /* if !chip, fw upload has been performed */ -@@ -178,8 +174,19 @@ static void usb6fire_chip_disconnect(struct usb_interface *intf) - chips[chip->regidx] = NULL; - } - -+ /* -+ * Save card pointer before teardown. -+ * snd_card_free_when_closed() may free card (and -+ * the embedded chip) immediately, so it must be -+ * called last and chip must not be accessed after. -+ */ -+ card = chip->card; - chip->shutdown = true; -+ if (card) -+ snd_card_disconnect(card); - usb6fire_chip_abort(chip); -+ if (card) -+ snd_card_free_when_closed(card); - } - } - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1275-dlm-validate-length-in-dlm-search-rsb-tree.patch b/SOURCES/1275-dlm-validate-length-in-dlm-search-rsb-tree.patch deleted file mode 100644 index b760e3ad8..000000000 --- a/SOURCES/1275-dlm-validate-length-in-dlm-search-rsb-tree.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 8b7b77b30a2a8619e3db6aca77b74e527570c458 Mon Sep 17 00:00:00 2001 -From: Alexander Aring -Date: Fri, 8 May 2026 17:19:36 -0400 -Subject: [PATCH] dlm: validate length in dlm_search_rsb_tree - -JIRA: https://issues.redhat.com/browse/RHEL-173996 -CVE: CVE-2026-43125 - -Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git - -Conflicts: upstream switched to rhashtables so lookup looks different - -commit 080e5563f878c64e697b89e7439d730d0daad882 -Author: Ezrak1e -Date: Tue Jan 20 10:35:06 2026 -0500 - - dlm: validate length in dlm_search_rsb_tree - - The len parameter in dlm_dump_rsb_name() is not validated and comes - from network messages. When it exceeds DLM_RESNAME_MAXLEN, it can - cause out-of-bounds write in dlm_search_rsb_tree(). - - Add length validation to prevent potential buffer overflow. - - Signed-off-by: Ezrak1e - Signed-off-by: Alexander Aring - Signed-off-by: David Teigland - -Signed-off-by: Alexander Aring - -diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c -index b8059e4c65b7..7fd7ffeb6246 100644 ---- a/fs/dlm/lock.c -+++ b/fs/dlm/lock.c -@@ -449,6 +449,9 @@ int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, - struct dlm_rsb *r; - int rc; - -+ if (len > DLM_RESNAME_MAXLEN) -+ return -EINVAL; -+ - while (node) { - r = rb_entry(node, struct dlm_rsb, res_hashnode); - rc = rsb_cmp(r, name, len); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1276-dlm-fix-buffer-overflow-from-negative-len-in-dlm-search-rsb-.patch b/SOURCES/1276-dlm-fix-buffer-overflow-from-negative-len-in-dlm-search-rsb-.patch deleted file mode 100644 index 7ac4a2617..000000000 --- a/SOURCES/1276-dlm-fix-buffer-overflow-from-negative-len-in-dlm-search-rsb-.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 46fd7c54bd6c4508d25540bdbd1c2f10ba50962a Mon Sep 17 00:00:00 2001 -From: Alexander Aring -Date: Fri, 29 May 2026 10:59:20 -0400 -Subject: [PATCH] dlm: fix buffer overflow from negative len in - dlm_search_rsb_tree - -JIRA: https://issues.redhat.com/browse/RHEL-173996 -CVE: CVE-2026-43125 - -Upstream Status: RHEL only - -Conflicts: This patch is upstream not part "yet" to fix the CVE, but the -initial fix was not enough to fix the CVE-2026-43125 vulnerability. -There are still upstream discussion about how to handle this, thats why -it is RHEL specific. - -commit 823532f62cb6db31b3b0b56de000df5034874d81 -Author: Joseph Qi -Date: Sun May 17 10:03:15 2026 +0800 - - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree - - commit 080e5563f878 only checks for len > DLM_RESNAME_MAXLEN, which does - not catch negative values. While the input 'len' can be negative and a - negative int passed to memcpy() is implicitly converted to a large - size_t, causing a stack buffer overflow on the key[] array. - - Fix this by changing the 'len' parameter type from int to unsigned int. - This ensures negative values from callers are implicitly converted to - large unsigned values that are caught by the existing - len > DLM_RESNAME_MAXLEN check. - - Signed-off-by: Joseph Qi - -Signed-off-by: Alexander Aring - -diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c -index 7fd7ffeb6246..dcfa539bd034 100644 ---- a/fs/dlm/lock.c -+++ b/fs/dlm/lock.c -@@ -442,8 +442,8 @@ static int rsb_cmp(struct dlm_rsb *r, const char *name, int nlen) - return memcmp(r->res_name, maxname, DLM_RESNAME_MAXLEN); - } - --int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, -- struct dlm_rsb **r_ret) -+int dlm_search_rsb_tree(struct rb_root *tree, char *name, -+ unsigned int len, struct dlm_rsb **r_ret) - { - struct rb_node *node = tree->rb_node; - struct dlm_rsb *r; -diff --git a/fs/dlm/lock.h b/fs/dlm/lock.h -index 456c6ec3ef6f..8cf81b512f0a 100644 ---- a/fs/dlm/lock.h -+++ b/fs/dlm/lock.h -@@ -30,8 +30,8 @@ void dlm_adjust_timeouts(struct dlm_ls *ls); - int dlm_master_lookup(struct dlm_ls *ls, int nodeid, char *name, int len, - unsigned int flags, int *r_nodeid, int *result); - --int dlm_search_rsb_tree(struct rb_root *tree, char *name, int len, -- struct dlm_rsb **r_ret); -+int dlm_search_rsb_tree(struct rb_root *tree, char *name, -+ unsigned int len, struct dlm_rsb **r_ret); - - void dlm_recover_purge(struct dlm_ls *ls); - void dlm_purge_mstcpy_locks(struct dlm_rsb *r); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1277-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch b/SOURCES/1277-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch deleted file mode 100644 index c4cebb02b..000000000 --- a/SOURCES/1277-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch +++ /dev/null @@ -1,222 +0,0 @@ -From 3cd0619e1302cfbaea374ea05b27aaab19b7b7b0 Mon Sep 17 00:00:00 2001 -From: Florian Westphal -Date: Wed, 6 May 2026 18:52:26 +0200 -Subject: [PATCH] netfilter: ctnetlink: ensure safe access to master conntrack - -JIRA: https://issues.redhat.com/browse/RHEL-173885 - -CVE: CVE-2026-43116 - -Conflict: We lack upstream del_timer/timer_delete rename. - -commit bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5 -Author: Pablo Neira Ayuso -Date: Wed Mar 25 14:11:04 2026 +0100 - - netfilter: ctnetlink: ensure safe access to master conntrack - - Holding reference on the expectation is not sufficient, the master - conntrack object can just go away, making exp->master invalid. - - To access exp->master safely: - - - Grab the nf_conntrack_expect_lock, this gets serialized with - clean_from_lists() which also holds this lock when the master - conntrack goes away. - - - Hold reference on master conntrack via nf_conntrack_find_get(). - Not so easy since the master tuple to look up for the master conntrack - is not available in the existing problematic paths. - - This patch goes for extending the nf_conntrack_expect_lock section - to address this issue for simplicity, in the cases that are described - below this is just slightly extending the lock section. - - The add expectation command already holds a reference to the master - conntrack from ctnetlink_create_expect(). - - However, the delete expectation command needs to grab the spinlock - before looking up for the expectation. Expand the existing spinlock - section to address this to cover the expectation lookup. Note that, - the nf_ct_expect_iterate_net() calls already grabs the spinlock while - iterating over the expectation table, which is correct. - - The get expectation command needs to grab the spinlock to ensure master - conntrack does not go away. This also expands the existing spinlock - section to cover the expectation lookup too. I needed to move the - netlink skb allocation out of the spinlock to keep it GFP_KERNEL. - - For the expectation events, the IPEXP_DESTROY event is already delivered - under the spinlock, just move the delivery of IPEXP_NEW under the - spinlock too because the master conntrack event cache is reached through - exp->master. - - While at it, add lockdep notations to help identify what codepaths need - to grab the spinlock. - - Signed-off-by: Florian Westphal - Signed-off-by: Pablo Neira Ayuso - -Assisted-by: Patchpal -Signed-off-by: Florian Westphal - -diff --git a/include/net/netfilter/nf_conntrack_core.h b/include/net/netfilter/nf_conntrack_core.h -index ff315e3ae75f..6ff83618e968 100644 ---- a/include/net/netfilter/nf_conntrack_core.h -+++ b/include/net/netfilter/nf_conntrack_core.h -@@ -84,6 +84,11 @@ void nf_conntrack_lock(spinlock_t *lock); - - extern spinlock_t nf_conntrack_expect_lock; - -+static inline void lockdep_nfct_expect_lock_held(void) -+{ -+ lockdep_assert_held(&nf_conntrack_expect_lock); -+} -+ - /* ctnetlink code shared by both ctnetlink and nf_conntrack_bpf */ - - #if (IS_BUILTIN(CONFIG_NF_CONNTRACK) && IS_ENABLED(CONFIG_DEBUG_INFO_BTF)) || \ -diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c -index 69948e1d6974..6526bdcca580 100644 ---- a/net/netfilter/nf_conntrack_ecache.c -+++ b/net/netfilter/nf_conntrack_ecache.c -@@ -237,6 +237,8 @@ void nf_ct_expect_event_report(enum ip_conntrack_expect_events event, - struct nf_ct_event_notifier *notify; - struct nf_conntrack_ecache *e; - -+ lockdep_nfct_expect_lock_held(); -+ - rcu_read_lock(); - notify = rcu_dereference(net->ct.nf_conntrack_event_cb); - if (!notify) -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index ce1ac3187f1c..29bd82d1715d 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -51,6 +51,7 @@ void nf_ct_unlink_expect_report(struct nf_conntrack_expect *exp, - struct net *net = nf_ct_exp_net(exp); - struct nf_conntrack_net *cnet; - -+ lockdep_nfct_expect_lock_held(); - WARN_ON(!master_help); - WARN_ON(timer_pending(&exp->timeout)); - -@@ -118,6 +119,8 @@ nf_ct_exp_equal(const struct nf_conntrack_tuple *tuple, - - bool nf_ct_remove_expect(struct nf_conntrack_expect *exp) - { -+ lockdep_nfct_expect_lock_held(); -+ - if (del_timer(&exp->timeout)) { - nf_ct_unlink_expect(exp); - nf_ct_expect_put(exp); -@@ -177,6 +180,8 @@ nf_ct_find_expectation(struct net *net, - struct nf_conntrack_expect *i, *exp = NULL; - unsigned int h; - -+ lockdep_nfct_expect_lock_held(); -+ - if (!cnet->expect_count) - return NULL; - -@@ -442,6 +447,8 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect, - unsigned int h; - int ret = 0; - -+ lockdep_nfct_expect_lock_held(); -+ - if (!master_help) { - ret = -ESHUTDOWN; - goto out; -@@ -498,8 +505,9 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, - - nf_ct_expect_insert(expect); - -- spin_unlock_bh(&nf_conntrack_expect_lock); - nf_ct_expect_event_report(IPEXP_NEW, expect, portid, report); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ - return 0; - out: - spin_unlock_bh(&nf_conntrack_expect_lock); -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 91151e5df688..e19697d16d4c 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -3329,31 +3329,37 @@ static int ctnetlink_get_expect(struct sk_buff *skb, - if (err < 0) - return err; - -+ skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ if (!skb2) -+ return -ENOMEM; -+ -+ spin_lock_bh(&nf_conntrack_expect_lock); - exp = nf_ct_expect_find_get(info->net, &zone, &tuple); -- if (!exp) -+ if (!exp) { -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ kfree_skb(skb2); - return -ENOENT; -+ } - - if (cda[CTA_EXPECT_ID]) { - __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); - - if (id != nf_expect_get_id(exp)) { - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ kfree_skb(skb2); - return -ENOENT; - } - } - -- skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -- if (!skb2) { -- nf_ct_expect_put(exp); -- return -ENOMEM; -- } -- - rcu_read_lock(); - err = ctnetlink_exp_fill_info(skb2, NETLINK_CB(skb).portid, - info->nlh->nlmsg_seq, IPCTNL_MSG_EXP_NEW, - exp); - rcu_read_unlock(); - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); -+ - if (err <= 0) { - kfree_skb(skb2); - return -ENOMEM; -@@ -3403,22 +3409,26 @@ static int ctnetlink_del_expect(struct sk_buff *skb, - if (err < 0) - return err; - -+ spin_lock_bh(&nf_conntrack_expect_lock); -+ - /* bump usage count to 2 */ - exp = nf_ct_expect_find_get(info->net, &zone, &tuple); -- if (!exp) -+ if (!exp) { -+ spin_unlock_bh(&nf_conntrack_expect_lock); - return -ENOENT; -+ } - - if (cda[CTA_EXPECT_ID]) { - __be32 id = nla_get_be32(cda[CTA_EXPECT_ID]); - - if (id != nf_expect_get_id(exp)) { - nf_ct_expect_put(exp); -+ spin_unlock_bh(&nf_conntrack_expect_lock); - return -ENOENT; - } - } - - /* after list removal, usage count == 1 */ -- spin_lock_bh(&nf_conntrack_expect_lock); - if (del_timer(&exp->timeout)) { - nf_ct_unlink_expect_report(exp, NETLINK_CB(skb).portid, - nlmsg_report(info->nlh)); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1278-rdma-rxe-fix-double-free-in-rxe-srq-from-init.patch b/SOURCES/1278-rdma-rxe-fix-double-free-in-rxe-srq-from-init.patch deleted file mode 100644 index d2c38e1e5..000000000 --- a/SOURCES/1278-rdma-rxe-fix-double-free-in-rxe-srq-from-init.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 0beefd0e15d962f497aad750b2d5e9c3570b66d1 Mon Sep 17 00:00:00 2001 -From: Jiasheng Jiang -Date: Mon, 12 Jan 2026 01:54:12 +0000 -Subject: [PATCH] RDMA/rxe: Fix double free in rxe_srq_from_init - -In rxe_srq_from_init(), the queue pointer 'q' is assigned to -'srq->rq.queue' before copying the SRQ number to user space. -If copy_to_user() fails, the function calls rxe_queue_cleanup() -to free the queue, but leaves the now-invalid pointer in -'srq->rq.queue'. - -The caller of rxe_srq_from_init() (rxe_create_srq) eventually -calls rxe_srq_cleanup() upon receiving the error, which triggers -a second rxe_queue_cleanup() on the same memory, leading to a -double free. - -The call trace looks like this: - kmem_cache_free+0x.../0x... - rxe_queue_cleanup+0x1a/0x30 [rdma_rxe] - rxe_srq_cleanup+0x42/0x60 [rdma_rxe] - rxe_elem_release+0x31/0x70 [rdma_rxe] - rxe_create_srq+0x12b/0x1a0 [rdma_rxe] - ib_create_srq_user+0x9a/0x150 [ib_core] - -Fix this by moving 'srq->rq.queue = q' after copy_to_user. - -Fixes: aae0484e15f0 ("IB/rxe: avoid srq memory leak") -Signed-off-by: Jiasheng Jiang -Link: https://patch.msgid.link/20260112015412.29458-1-jiashengjiangcool@gmail.com -Reviewed-by: Zhu Yanjun -Signed-off-by: Leon Romanovsky - -diff --git a/drivers/infiniband/sw/rxe/rxe_srq.c b/drivers/infiniband/sw/rxe/rxe_srq.c -index 2a234f26ac10..c9a7cd38953d 100644 ---- a/drivers/infiniband/sw/rxe/rxe_srq.c -+++ b/drivers/infiniband/sw/rxe/rxe_srq.c -@@ -77,9 +77,6 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, - goto err_free; - } - -- srq->rq.queue = q; -- init->attr.max_wr = srq->rq.max_wr; -- - if (uresp) { - if (copy_to_user(&uresp->srq_num, &srq->srq_num, - sizeof(uresp->srq_num))) { -@@ -88,6 +85,9 @@ int rxe_srq_from_init(struct rxe_dev *rxe, struct rxe_srq *srq, - } - } - -+ srq->rq.queue = q; -+ init->attr.max_wr = srq->rq.max_wr; -+ - return 0; - - err_free: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1279-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch b/SOURCES/1279-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch deleted file mode 100644 index 8845a85f7..000000000 --- a/SOURCES/1279-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 7c770dadfda5cbbde6aa3c4363ed513f1d212bf8 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= -Date: Wed, 18 Mar 2026 16:55:51 +0100 -Subject: [PATCH] net: openvswitch: Avoid releasing netdev before teardown - completes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -The patch cited in the Fixes tag below changed the teardown code for -OVS ports to no longer unconditionally take the RTNL. After this change, -the netdev_destroy() callback can proceed immediately to the call_rcu() -invocation if the IFF_OVS_DATAPATH flag is already cleared on the -netdev. - -The ovs_netdev_detach_dev() function clears the flag before completing -the unregistration, and if it gets preempted after clearing the flag (as -can happen on an -rt kernel), netdev_destroy() can complete and the -device can be freed before the unregistration completes. This leads to a -splat like: - -[ 998.393867] Oops: general protection fault, probably for non-canonical address 0xff00000001000239: 0000 [#1] SMP PTI -[ 998.393877] CPU: 42 UID: 0 PID: 55177 Comm: ip Kdump: loaded Not tainted 6.12.0-211.1.1.el10_2.x86_64+rt #1 PREEMPT_RT -[ 998.393886] Hardware name: Dell Inc. PowerEdge R740/0JMK61, BIOS 2.24.0 03/27/2025 -[ 998.393889] RIP: 0010:dev_set_promiscuity+0x8d/0xa0 -[ 998.393901] Code: 00 00 75 d8 48 8b 53 08 48 83 ba b0 02 00 00 00 75 ca 48 83 c4 08 5b c3 cc cc cc cc 48 83 bf 48 09 00 00 00 75 91 48 8b 47 08 <48> 83 b8 b0 02 00 00 00 74 97 eb 81 0f 1f 80 00 00 00 00 90 90 90 -[ 998.393906] RSP: 0018:ffffce5864a5f6a0 EFLAGS: 00010246 -[ 998.393912] RAX: ff00000000ffff89 RBX: ffff894d0adf5a05 RCX: 0000000000000000 -[ 998.393917] RDX: 0000000000000000 RSI: 00000000ffffffff RDI: ffff894d0adf5a05 -[ 998.393921] RBP: ffff894d19252000 R08: ffff894d19252000 R09: 0000000000000000 -[ 998.393924] R10: ffff894d19252000 R11: ffff894d192521b8 R12: 0000000000000006 -[ 998.393927] R13: ffffce5864a5f738 R14: 00000000ffffffe2 R15: 0000000000000000 -[ 998.393931] FS: 00007fad61971800(0000) GS:ffff894cc0140000(0000) knlGS:0000000000000000 -[ 998.393936] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -[ 998.393940] CR2: 000055df0a2a6e40 CR3: 000000011c7fe003 CR4: 00000000007726f0 -[ 998.393944] PKRU: 55555554 -[ 998.393946] Call Trace: -[ 998.393949] -[ 998.393952] ? show_trace_log_lvl+0x1b0/0x2f0 -[ 998.393961] ? show_trace_log_lvl+0x1b0/0x2f0 -[ 998.393975] ? dp_device_event+0x41/0x80 [openvswitch] -[ 998.394009] ? __die_body.cold+0x8/0x12 -[ 998.394016] ? die_addr+0x3c/0x60 -[ 998.394027] ? exc_general_protection+0x16d/0x390 -[ 998.394042] ? asm_exc_general_protection+0x26/0x30 -[ 998.394058] ? dev_set_promiscuity+0x8d/0xa0 -[ 998.394066] ? ovs_netdev_detach_dev+0x3a/0x80 [openvswitch] -[ 998.394092] dp_device_event+0x41/0x80 [openvswitch] -[ 998.394102] notifier_call_chain+0x5a/0xd0 -[ 998.394106] unregister_netdevice_many_notify+0x51b/0xa60 -[ 998.394110] rtnl_dellink+0x169/0x3e0 -[ 998.394121] ? rt_mutex_slowlock.constprop.0+0x95/0xd0 -[ 998.394125] rtnetlink_rcv_msg+0x142/0x3f0 -[ 998.394128] ? avc_has_perm_noaudit+0x69/0xf0 -[ 998.394130] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 -[ 998.394132] netlink_rcv_skb+0x50/0x100 -[ 998.394138] netlink_unicast+0x292/0x3f0 -[ 998.394141] netlink_sendmsg+0x21b/0x470 -[ 998.394145] ____sys_sendmsg+0x39d/0x3d0 -[ 998.394149] ___sys_sendmsg+0x9a/0xe0 -[ 998.394156] __sys_sendmsg+0x7a/0xd0 -[ 998.394160] do_syscall_64+0x7f/0x170 -[ 998.394162] entry_SYSCALL_64_after_hwframe+0x76/0x7e -[ 998.394165] RIP: 0033:0x7fad61bf4724 -[ 998.394188] Code: 89 02 b8 ff ff ff ff eb bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 80 3d c5 e9 0c 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 48 83 ec 28 89 54 24 1c 48 89 -[ 998.394189] RSP: 002b:00007ffd7e2f7cb8 EFLAGS: 00000202 ORIG_RAX: 000000000000002e -[ 998.394191] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fad61bf4724 -[ 998.394193] RDX: 0000000000000000 RSI: 00007ffd7e2f7d20 RDI: 0000000000000003 -[ 998.394194] RBP: 00007ffd7e2f7d90 R08: 0000000000000010 R09: 000000000000003f -[ 998.394195] R10: 000055df11558010 R11: 0000000000000202 R12: 00007ffd7e2f8380 -[ 998.394196] R13: 0000000069b233d7 R14: 000055df0a256040 R15: 0000000000000000 -[ 998.394200] - -To fix this, reorder the operations in ovs_netdev_detach_dev() to only -clear the flag after completing the other operations, and introduce an -smp_wmb() to make the ordering requirement explicit. The smp_wmb() is -paired with a full smp_mb() in netdev_destroy() to make sure the -call_rcu() invocation does not happen before the unregister operations -are visible. - -Reported-by: Minxi Hou -Tested-by: Minxi Hou -Fixes: 549822767630 ("net: openvswitch: Avoid needlessly taking the RTNL on vport destroy") -Signed-off-by: Toke Høiland-Jørgensen -Link: https://patch.msgid.link/20260318155554.1133405-1-toke@redhat.com -Signed-off-by: Jakub Kicinski - -diff --git a/net/openvswitch/vport-netdev.c b/net/openvswitch/vport-netdev.c -index 6574f9bcdc02..c688dee96503 100644 ---- a/net/openvswitch/vport-netdev.c -+++ b/net/openvswitch/vport-netdev.c -@@ -151,11 +151,15 @@ static void vport_netdev_free(struct rcu_head *rcu) - void ovs_netdev_detach_dev(struct vport *vport) - { - ASSERT_RTNL(); -- vport->dev->priv_flags &= ~IFF_OVS_DATAPATH; - netdev_rx_handler_unregister(vport->dev); - netdev_upper_dev_unlink(vport->dev, - netdev_master_upper_dev_get(vport->dev)); - dev_set_promiscuity(vport->dev, -1); -+ -+ /* paired with smp_mb() in netdev_destroy() */ -+ smp_wmb(); -+ -+ vport->dev->priv_flags &= ~IFF_OVS_DATAPATH; - } - - static void netdev_destroy(struct vport *vport) -@@ -174,6 +178,9 @@ static void netdev_destroy(struct vport *vport) - rtnl_unlock(); - } - -+ /* paired with smp_wmb() in ovs_netdev_detach_dev() */ -+ smp_mb(); -+ - call_rcu(&vport->rcu, vport_netdev_free); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1280-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch b/SOURCES/1280-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch deleted file mode 100644 index bdfd7e220..000000000 --- a/SOURCES/1280-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 2edfa31769a4add828a7e604b21cb82aaaa05925 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 26 Mar 2026 15:51:38 +0000 -Subject: [PATCH] ip6_tunnel: clear skb2->cb[] in ip4ip6_err() - -Oskar Kjos reported the following problem. - -ip4ip6_err() calls icmp_send() on a cloned skb whose cb[] was written -by the IPv6 receive path as struct inet6_skb_parm. icmp_send() passes -IPCB(skb2) to __ip_options_echo(), which interprets that cb[] region -as struct inet_skb_parm (IPv4). The layouts differ: inet6_skb_parm.nhoff -at offset 14 overlaps inet_skb_parm.opt.rr, producing a non-zero rr -value. __ip_options_echo() then reads optlen from attacker-controlled -packet data at sptr[rr+1] and copies that many bytes into dopt->__data, -a fixed 40-byte stack buffer (IP_OPTIONS_DATA_FIXED_SIZE). - -To fix this we clear skb2->cb[], as suggested by Oskar Kjos. - -Also add minimal IPv4 header validation (version == 4, ihl >= 5). - -Fixes: c4d3efafcc93 ("[IPV6] IP6TUNNEL: Add support to IPv4 over IPv6 tunnel.") -Reported-by: Oskar Kjos -Signed-off-by: Eric Dumazet -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/20260326155138.2429480-1-edumazet@google.com -Signed-off-by: Jakub Kicinski - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 4c29aa94e86e..0b53488a9229 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -601,11 +601,16 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - if (!skb2) - return 0; - -+ /* Remove debris left by IPv6 stack. */ -+ memset(IPCB(skb2), 0, sizeof(*IPCB(skb2))); -+ - skb_dst_drop(skb2); - - skb_pull(skb2, offset); - skb_reset_network_header(skb2); - eiph = ip_hdr(skb2); -+ if (eiph->version != 4 || eiph->ihl < 5) -+ goto out; - - /* Try to guess incoming interface */ - rt = ip_route_output_ports(dev_net(skb->dev), &fl4, NULL, eiph->saddr, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1281-ipv6-rpl-headroom.patch b/SOURCES/1281-ipv6-rpl-headroom.patch deleted file mode 100644 index af6f758d0..000000000 --- a/SOURCES/1281-ipv6-rpl-headroom.patch +++ /dev/null @@ -1,37 +0,0 @@ -Subject: [PATCH] ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CVE-2026-43501) -# AlmaLinux: reconstructed (687.13.1->687.15.1); includes RHEL kABI / RHEL-only files - -diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c -index 400ca6a..4475aa3 100644 ---- a/net/ipv6/exthdrs.c -+++ b/net/ipv6/exthdrs.c -@@ -479,6 +479,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - struct net *net = dev_net(skb->dev); - struct inet6_dev *idev; - struct ipv6hdr *oldhdr; -+ unsigned int chdr_len; - struct in6_addr addr; - unsigned char *buf; - int accept_rpl_seg; -@@ -601,8 +602,10 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - skb_pull(skb, ((hdr->hdrlen + 1) << 3)); - skb_postpull_rcsum(skb, oldhdr, - sizeof(struct ipv6hdr) + ((hdr->hdrlen + 1) << 3)); -- if (unlikely(!hdr->segments_left)) { -- if (pskb_expand_head(skb, sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3), 0, -+ chdr_len = sizeof(struct ipv6hdr) + ((chdr->hdrlen + 1) << 3); -+ if (unlikely(!hdr->segments_left || -+ skb_headroom(skb) < chdr_len + skb->mac_len)) { -+ if (pskb_expand_head(skb, chdr_len + skb->mac_len, 0, - GFP_ATOMIC)) { - __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_OUTDISCARDS); - kfree_skb(skb); -@@ -612,7 +615,7 @@ static int ipv6_rpl_srh_rcv(struct sk_buff *skb) - - oldhdr = ipv6_hdr(skb); - } -- skb_push(skb, ((chdr->hdrlen + 1) << 3) + sizeof(struct ipv6hdr)); -+ skb_push(skb, chdr_len); - skb_reset_network_header(skb); - skb_mac_header_rebuild(skb); - skb_set_transport_header(skb, sizeof(struct ipv6hdr)); diff --git a/SOURCES/1282-rdma-mlx4-srq.patch b/SOURCES/1282-rdma-mlx4-srq.patch deleted file mode 100644 index ff1beea28..000000000 --- a/SOURCES/1282-rdma-mlx4-srq.patch +++ /dev/null @@ -1,37 +0,0 @@ -Subject: [PATCH] RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181) -# AlmaLinux: reconstructed base->final - -diff --git a/drivers/net/ethernet/mellanox/mlx4/srq.c b/drivers/net/ethernet/mellanox/mlx4/srq.c -index dd890f5..b21eae5 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/srq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/srq.c -@@ -44,13 +44,14 @@ void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type) - { - struct mlx4_srq_table *srq_table = &mlx4_priv(dev)->srq_table; - struct mlx4_srq *srq; -+ unsigned long flags; - -- rcu_read_lock(); -+ spin_lock_irqsave(&srq_table->lock, flags); - srq = radix_tree_lookup(&srq_table->tree, srqn & (dev->caps.num_srqs - 1)); -- rcu_read_unlock(); -- if (srq) -- refcount_inc(&srq->refcount); -- else { -+ if (!srq || !refcount_inc_not_zero(&srq->refcount)) -+ srq = NULL; -+ spin_unlock_irqrestore(&srq_table->lock, flags); -+ if (!srq) { - mlx4_warn(dev, "Async event for bogus SRQ %08x\n", srqn); - return; - } -@@ -203,8 +204,8 @@ int mlx4_srq_alloc(struct mlx4_dev *dev, u32 pdn, u32 cqn, u16 xrcd, - if (err) - goto err_radix; - -- refcount_set(&srq->refcount, 1); - init_completion(&srq->free); -+ atomic_set_release(&srq->refcount.refs, 1); - - return 0; - diff --git a/SOURCES/1283-dpll-series-RHEL.patch b/SOURCES/1283-dpll-series-RHEL.patch deleted file mode 100644 index 28872bf78..000000000 --- a/SOURCES/1283-dpll-series-RHEL.patch +++ /dev/null @@ -1,3225 +0,0 @@ -Subject: [PATCH] dpll/zl3073x series (RHEL-167273/167833/172938; RH_KABI + RHEL chan.c/.h) -# AlmaLinux: reconstructed (687.13.1->687.15.1); includes RHEL kABI / RHEL-only files - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 83118c7..93c191b 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -250,6 +250,24 @@ in the ``DPLL_A_PIN_PHASE_OFFSET`` attribute. - ``DPLL_A_PHASE_OFFSET_MONITOR`` attr state of a feature - =============================== ======================== - -+Frequency monitor -+================= -+ -+Some DPLL devices may offer the capability to measure the actual -+frequency of all available input pins. The attribute and current feature state -+shall be included in the response message of the ``DPLL_CMD_DEVICE_GET`` -+command for supported DPLL devices. In such cases, users can also control -+the feature using the ``DPLL_CMD_DEVICE_SET`` command by setting the -+``enum dpll_feature_state`` values for the attribute. -+Once enabled the measured input frequency for each input pin shall be -+returned in the ``DPLL_A_PIN_MEASURED_FREQUENCY`` attribute. The value -+is in millihertz (mHz), using ``DPLL_PIN_MEASURED_FREQUENCY_DIVIDER`` -+as the divider. -+ -+ =============================== ======================== -+ ``DPLL_A_FREQUENCY_MONITOR`` attr state of a feature -+ =============================== ======================== -+ - Embedded SYNC - ============= - -@@ -411,6 +429,8 @@ according to attribute purpose. - ``DPLL_A_PIN_STATE`` attr state of pin on the parent - pin - ``DPLL_A_PIN_CAPABILITIES`` attr bitmask of pin capabilities -+ ``DPLL_A_PIN_MEASURED_FREQUENCY`` attr measured frequency of -+ an input pin in mHz - ==================================== ================================== - - ==================================== ================================= -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index ed58662..cb5da35 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -240,6 +240,20 @@ definitions: - integer part of a measured phase offset value. - Value of (DPLL_A_PHASE_OFFSET % DPLL_PHASE_OFFSET_DIVIDER) is a - fractional part of a measured phase offset value. -+ - -+ type: const -+ name: pin-measured-frequency-divider -+ value: 1000 -+ doc: | -+ pin measured frequency divider allows userspace to calculate -+ a value of measured input frequency as a fractional value with -+ three digit decimal precision (millihertz). -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY / -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is an integer part of -+ a measured frequency value. -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY % -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part of -+ a measured frequency value. - - - type: enum - name: feature-state -@@ -319,6 +333,13 @@ attribute-sets: - name: phase-offset-avg-factor - type: u32 - doc: Averaging factor applied to calculation of reported phase offset. -+ - -+ name: frequency-monitor -+ type: u32 -+ enum: feature-state -+ doc: Current or desired state of the frequency monitor feature. -+ If enabled, dpll device shall measure all currently available -+ inputs for their actual input frequency. - - - name: pin - enum-name: dpll_a_pin -@@ -456,6 +477,17 @@ attribute-sets: - Value is in PPT (parts per trillion, 10^-12). - Note: This attribute provides higher resolution than the standard - fractional-frequency-offset (which is in PPM). -+ - -+ name: measured-frequency -+ type: u64 -+ doc: | -+ The measured frequency of the input pin in millihertz (mHz). -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY / -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is an integer part (Hz) -+ of a measured frequency value. -+ Value of (DPLL_A_PIN_MEASURED_FREQUENCY % -+ DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part -+ of a measured frequency value. - - - - name: pin-parent-device -@@ -544,6 +576,7 @@ operations: - - type - - phase-offset-monitor - - phase-offset-avg-factor -+ - frequency-monitor - - dump: - reply: *dev-attrs -@@ -563,6 +596,7 @@ operations: - - mode - - phase-offset-monitor - - phase-offset-avg-factor -+ - frequency-monitor - - - name: device-create-ntf - doc: Notification about device appearing -@@ -643,6 +677,7 @@ operations: - - esync-frequency-supported - - esync-pulse - - reference-sync -+ - measured-frequency - - dump: - request: -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 842f733..84e1b63 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -880,7 +880,10 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, - - if (WARN_ON(!ops) || - WARN_ON(!ops->state_on_dpll_get) || -- WARN_ON(!ops->direction_get)) -+ WARN_ON(!ops->direction_get) || -+ WARN_ON(ops->measured_freq_get && -+ (!dpll_device_ops(dpll)->freq_monitor_get || -+ !dpll_device_ops(dpll)->freq_monitor_set))) - return -EINVAL; - - mutex_lock(&dpll_lock); -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 95ae786..0ff1658 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -175,6 +175,26 @@ dpll_msg_add_phase_offset_monitor(struct sk_buff *msg, struct dpll_device *dpll, - return 0; - } - -+static int -+dpll_msg_add_freq_monitor(struct sk_buff *msg, struct dpll_device *dpll, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *ops = dpll_device_ops(dpll); -+ enum dpll_feature_state state; -+ int ret; -+ -+ if (ops->freq_monitor_set && ops->freq_monitor_get) { -+ ret = ops->freq_monitor_get(dpll, dpll_priv(dpll), -+ &state, extack); -+ if (ret) -+ return ret; -+ if (nla_put_u32(msg, DPLL_A_FREQUENCY_MONITOR, state)) -+ return -EMSGSIZE; -+ } -+ -+ return 0; -+} -+ - static int - dpll_msg_add_phase_offset_avg_factor(struct sk_buff *msg, - struct dpll_device *dpll, -@@ -400,6 +420,38 @@ static int dpll_msg_add_ffo(struct sk_buff *msg, struct dpll_pin *pin, - ffo); - } - -+static int dpll_msg_add_measured_freq(struct sk_buff *msg, struct dpll_pin *pin, -+ struct dpll_pin_ref *ref, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *dev_ops = dpll_device_ops(ref->dpll); -+ const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -+ struct dpll_device *dpll = ref->dpll; -+ enum dpll_feature_state state; -+ u64 measured_freq; -+ int ret; -+ -+ if (!ops->measured_freq_get) -+ return 0; -+ ret = dev_ops->freq_monitor_get(dpll, dpll_priv(dpll), -+ &state, extack); -+ if (ret) -+ return ret; -+ if (state == DPLL_FEATURE_STATE_DISABLE) -+ return 0; -+ ret = ops->measured_freq_get(pin, dpll_pin_on_dpll_priv(dpll, pin), -+ dpll, dpll_priv(dpll), &measured_freq, -+ extack); -+ if (ret) -+ return ret; -+ if (nla_put_64bit(msg, DPLL_A_PIN_MEASURED_FREQUENCY, -+ sizeof(measured_freq), &measured_freq, -+ DPLL_A_PIN_PAD)) -+ return -EMSGSIZE; -+ -+ return 0; -+} -+ - static int - dpll_msg_add_pin_freq(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, struct netlink_ext_ack *extack) -@@ -670,6 +722,9 @@ dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - return ret; - ret = dpll_msg_add_ffo(msg, pin, ref, extack); -+ if (ret) -+ return ret; -+ ret = dpll_msg_add_measured_freq(msg, pin, ref, extack); - if (ret) - return ret; - ret = dpll_msg_add_pin_esync(msg, pin, ref, extack); -@@ -722,6 +777,9 @@ dpll_device_get_one(struct dpll_device *dpll, struct sk_buff *msg, - if (ret) - return ret; - ret = dpll_msg_add_phase_offset_avg_factor(msg, dpll, extack); -+ if (ret) -+ return ret; -+ ret = dpll_msg_add_freq_monitor(msg, dpll, extack); - if (ret) - return ret; - -@@ -958,6 +1016,32 @@ dpll_phase_offset_avg_factor_set(struct dpll_device *dpll, struct nlattr *a, - extack); - } - -+static int -+dpll_freq_monitor_set(struct dpll_device *dpll, struct nlattr *a, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_device_ops *ops = dpll_device_ops(dpll); -+ enum dpll_feature_state state = nla_get_u32(a), old_state; -+ int ret; -+ -+ if (!(ops->freq_monitor_set && ops->freq_monitor_get)) { -+ NL_SET_ERR_MSG_ATTR(extack, a, -+ "dpll device not capable of frequency monitor"); -+ return -EOPNOTSUPP; -+ } -+ ret = ops->freq_monitor_get(dpll, dpll_priv(dpll), &old_state, -+ extack); -+ if (ret) { -+ NL_SET_ERR_MSG(extack, -+ "unable to get current state of frequency monitor"); -+ return ret; -+ } -+ if (state == old_state) -+ return 0; -+ -+ return ops->freq_monitor_set(dpll, dpll_priv(dpll), state, extack); -+} -+ - static int - dpll_pin_freq_set(struct dpll_pin *pin, struct nlattr *a, - struct netlink_ext_ack *extack) -@@ -1888,6 +1972,12 @@ dpll_set_from_nlattr(struct dpll_device *dpll, struct genl_info *info) - if (ret) - return ret; - break; -+ case DPLL_A_FREQUENCY_MONITOR: -+ ret = dpll_freq_monitor_set(dpll, a, -+ info->extack); -+ if (ret) -+ return ret; -+ break; - } - } - -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index 3fb64aa..da92aa8 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -42,11 +42,12 @@ static const struct nla_policy dpll_device_get_nl_policy[DPLL_A_ID + 1] = { - }; - - /* DPLL_CMD_DEVICE_SET - do */ --static const struct nla_policy dpll_device_set_nl_policy[DPLL_A_PHASE_OFFSET_AVG_FACTOR + 1] = { -+static const struct nla_policy dpll_device_set_nl_policy[DPLL_A_FREQUENCY_MONITOR + 1] = { - [DPLL_A_ID] = { .type = NLA_U32, }, - [DPLL_A_MODE] = NLA_POLICY_RANGE(NLA_U32, 1, 2), - [DPLL_A_PHASE_OFFSET_MONITOR] = NLA_POLICY_MAX(NLA_U32, 1), - [DPLL_A_PHASE_OFFSET_AVG_FACTOR] = { .type = NLA_U32, }, -+ [DPLL_A_FREQUENCY_MONITOR] = NLA_POLICY_MAX(NLA_U32, 1), - }; - - /* DPLL_CMD_PIN_ID_GET - do */ -@@ -114,7 +115,7 @@ static const struct genl_split_ops dpll_nl_ops[] = { - .doit = dpll_nl_device_set_doit, - .post_doit = dpll_post_doit, - .policy = dpll_device_set_nl_policy, -- .maxattr = DPLL_A_PHASE_OFFSET_AVG_FACTOR, -+ .maxattr = DPLL_A_FREQUENCY_MONITOR, - .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO, - }, - { -diff --git a/drivers/dpll/zl3073x/Makefile b/drivers/dpll/zl3073x/Makefile -index bd324c7..906ec3f 100644 ---- a/drivers/dpll/zl3073x/Makefile -+++ b/drivers/dpll/zl3073x/Makefile -@@ -1,8 +1,8 @@ - # SPDX-License-Identifier: GPL-2.0 - - obj-$(CONFIG_ZL3073X) += zl3073x.o --zl3073x-objs := core.o devlink.o dpll.o flash.o fw.o \ -- out.o prop.o ref.o synth.o -+zl3073x-objs := chan.o core.o devlink.o dpll.o \ -+ flash.o fw.o out.o prop.o ref.o synth.o - - obj-$(CONFIG_ZL3073X_I2C) += zl3073x_i2c.o - zl3073x_i2c-objs := i2c.o -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -new file mode 100644 -index 0000000..2f48ca2 ---- /dev/null -+++ b/drivers/dpll/zl3073x/chan.c -@@ -0,0 +1,165 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+ -+#include -+#include -+#include -+#include -+ -+#include "chan.h" -+#include "core.h" -+ -+/** -+ * zl3073x_chan_state_update - update DPLL channel status from HW -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_chan *chan = &zldev->chan[index]; -+ int rc; -+ -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(index), -+ &chan->mon_status); -+ if (rc) -+ return rc; -+ -+ return zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -+ &chan->refsel_status); -+} -+ -+/** -+ * zl3073x_chan_state_fetch - fetch DPLL channel state from hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to fetch state for -+ * -+ * Reads the mode_refsel register and reference priority registers for -+ * the given DPLL channel and stores the raw values for later use. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_chan *chan = &zldev->chan[index]; -+ int rc, i; -+ -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -+ &chan->mode_refsel); -+ if (rc) -+ return rc; -+ -+ dev_dbg(zldev->dev, "DPLL%u mode: %u, ref: %u\n", index, -+ zl3073x_chan_mode_get(chan), zl3073x_chan_ref_get(chan)); -+ -+ rc = zl3073x_chan_state_update(zldev, index); -+ if (rc) -+ return rc; -+ -+ dev_dbg(zldev->dev, -+ "DPLL%u lock_state: %u, ho: %u, sel_state: %u, sel_ref: %u\n", -+ index, zl3073x_chan_lock_state_get(chan), -+ zl3073x_chan_is_ho_ready(chan) ? 1 : 0, -+ zl3073x_chan_refsel_state_get(chan), -+ zl3073x_chan_refsel_ref_get(chan)); -+ -+ guard(mutex)(&zldev->multiop_lock); -+ -+ /* Read DPLL configuration from mailbox */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); -+ if (rc) -+ return rc; -+ -+ /* Read reference priority registers */ -+ for (i = 0; i < ARRAY_SIZE(chan->ref_prio); i++) { -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(i), -+ &chan->ref_prio[i]); -+ if (rc) -+ return rc; -+ } -+ -+ return 0; -+} -+ -+/** -+ * zl3073x_chan_state_get - get current DPLL channel state -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to get state for -+ * -+ * Return: pointer to given DPLL channel state -+ */ -+const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, -+ u8 index) -+{ -+ return &zldev->chan[index]; -+} -+ -+/** -+ * zl3073x_chan_state_set - commit DPLL channel state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: DPLL channel index to set state for -+ * @chan: desired channel state -+ * -+ * Skips the HW write if the configuration is unchanged, and otherwise -+ * writes only the changed registers to hardware. The mode_refsel register -+ * is written directly, while the reference priority registers are written -+ * via the DPLL mailbox interface. -+ * -+ * Return: 0 on success, <0 on HW error -+ */ -+int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, -+ const struct zl3073x_chan *chan) -+{ -+ struct zl3073x_chan *dchan = &zldev->chan[index]; -+ int rc, i; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dchan->cfg, &chan->cfg, sizeof(chan->cfg))) -+ return 0; -+ -+ /* Direct register write for mode_refsel */ -+ if (dchan->mode_refsel != chan->mode_refsel) { -+ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(index), -+ chan->mode_refsel); -+ if (rc) -+ return rc; -+ dchan->mode_refsel = chan->mode_refsel; -+ } -+ -+ /* Mailbox write for ref_prio if changed */ -+ if (!memcmp(dchan->ref_prio, chan->ref_prio, sizeof(chan->ref_prio))) { -+ dchan->cfg = chan->cfg; -+ return 0; -+ } -+ -+ guard(mutex)(&zldev->multiop_lock); -+ -+ /* Read DPLL configuration into mailbox */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); -+ if (rc) -+ return rc; -+ -+ /* Update changed ref_prio registers */ -+ for (i = 0; i < ARRAY_SIZE(chan->ref_prio); i++) { -+ if (dchan->ref_prio[i] != chan->ref_prio[i]) { -+ rc = zl3073x_write_u8(zldev, -+ ZL_REG_DPLL_REF_PRIO(i), -+ chan->ref_prio[i]); -+ if (rc) -+ return rc; -+ } -+ } -+ -+ /* Commit DPLL configuration */ -+ rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_WR, -+ ZL_REG_DPLL_MB_MASK, BIT(index)); -+ if (rc) -+ return rc; -+ -+ /* After successful write store new state */ -+ dchan->cfg = chan->cfg; -+ -+ return 0; -+} -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -new file mode 100644 -index 0000000..481da21 ---- /dev/null -+++ b/drivers/dpll/zl3073x/chan.h -@@ -0,0 +1,174 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+ -+#ifndef _ZL3073X_CHAN_H -+#define _ZL3073X_CHAN_H -+ -+#include -+#include -+#include -+ -+#include "regs.h" -+ -+struct zl3073x_dev; -+ -+/** -+ * struct zl3073x_chan - DPLL channel state -+ * @mode_refsel: mode and reference selection register value -+ * @ref_prio: reference priority registers (4 bits per ref, P/N packed) -+ * @mon_status: monitor status register value -+ * @refsel_status: reference selection status register value -+ */ -+struct zl3073x_chan { -+ struct_group(cfg, -+ u8 mode_refsel; -+ u8 ref_prio[ZL3073X_NUM_REFS / 2]; -+ ); -+ struct_group(stat, -+ u8 mon_status; -+ u8 refsel_status; -+ ); -+}; -+ -+int zl3073x_chan_state_fetch(struct zl3073x_dev *zldev, u8 index); -+const struct zl3073x_chan *zl3073x_chan_state_get(struct zl3073x_dev *zldev, -+ u8 index); -+int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, -+ const struct zl3073x_chan *chan); -+ -+int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index); -+ -+/** -+ * zl3073x_chan_mode_get - get DPLL channel operating mode -+ * @chan: pointer to channel state -+ * -+ * Return: reference selection mode of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_mode_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MODE_REFSEL_MODE, chan->mode_refsel); -+} -+ -+/** -+ * zl3073x_chan_ref_get - get manually selected reference -+ * @chan: pointer to channel state -+ * -+ * Return: reference selected in forced reference lock mode -+ */ -+static inline u8 zl3073x_chan_ref_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MODE_REFSEL_REF, chan->mode_refsel); -+} -+ -+/** -+ * zl3073x_chan_mode_set - set DPLL channel operating mode -+ * @chan: pointer to channel state -+ * @mode: mode to set -+ */ -+static inline void zl3073x_chan_mode_set(struct zl3073x_chan *chan, u8 mode) -+{ -+ FIELD_MODIFY(ZL_DPLL_MODE_REFSEL_MODE, &chan->mode_refsel, mode); -+} -+ -+/** -+ * zl3073x_chan_ref_set - set manually selected reference -+ * @chan: pointer to channel state -+ * @ref: reference to set -+ */ -+static inline void zl3073x_chan_ref_set(struct zl3073x_chan *chan, u8 ref) -+{ -+ FIELD_MODIFY(ZL_DPLL_MODE_REFSEL_REF, &chan->mode_refsel, ref); -+} -+ -+/** -+ * zl3073x_chan_ref_prio_get - get reference priority -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * -+ * Return: priority of the given reference <0, 15> -+ */ -+static inline u8 -+zl3073x_chan_ref_prio_get(const struct zl3073x_chan *chan, u8 ref) -+{ -+ u8 val = chan->ref_prio[ref / 2]; -+ -+ if (!(ref & 1)) -+ return FIELD_GET(ZL_DPLL_REF_PRIO_REF_P, val); -+ else -+ return FIELD_GET(ZL_DPLL_REF_PRIO_REF_N, val); -+} -+ -+/** -+ * zl3073x_chan_ref_prio_set - set reference priority -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * @prio: priority to set -+ */ -+static inline void -+zl3073x_chan_ref_prio_set(struct zl3073x_chan *chan, u8 ref, u8 prio) -+{ -+ u8 *val = &chan->ref_prio[ref / 2]; -+ -+ if (!(ref & 1)) -+ FIELD_MODIFY(ZL_DPLL_REF_PRIO_REF_P, val, prio); -+ else -+ FIELD_MODIFY(ZL_DPLL_REF_PRIO_REF_N, val, prio); -+} -+ -+/** -+ * zl3073x_chan_ref_is_selectable - check if reference is selectable -+ * @chan: pointer to channel state -+ * @ref: input reference index -+ * -+ * Return: true if the reference priority is not NONE, false otherwise -+ */ -+static inline bool -+zl3073x_chan_ref_is_selectable(const struct zl3073x_chan *chan, u8 ref) -+{ -+ return zl3073x_chan_ref_prio_get(chan, ref) != ZL_DPLL_REF_PRIO_NONE; -+} -+ -+/** -+ * zl3073x_chan_lock_state_get - get DPLL channel lock state -+ * @chan: pointer to channel state -+ * -+ * Return: lock state of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_lock_state_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_MON_STATUS_STATE, chan->mon_status); -+} -+ -+/** -+ * zl3073x_chan_is_ho_ready - check if holdover is ready -+ * @chan: pointer to channel state -+ * -+ * Return: true if holdover is ready, false otherwise -+ */ -+static inline bool zl3073x_chan_is_ho_ready(const struct zl3073x_chan *chan) -+{ -+ return !!FIELD_GET(ZL_DPLL_MON_STATUS_HO_READY, chan->mon_status); -+} -+ -+/** -+ * zl3073x_chan_refsel_state_get - get reference selection state -+ * @chan: pointer to channel state -+ * -+ * Return: reference selection state of the given DPLL channel -+ */ -+static inline u8 zl3073x_chan_refsel_state_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_REFSEL_STATUS_STATE, chan->refsel_status); -+} -+ -+/** -+ * zl3073x_chan_refsel_ref_get - get currently selected reference in auto mode -+ * @chan: pointer to channel state -+ * -+ * Return: reference selected by the DPLL in automatic mode -+ */ -+static inline u8 zl3073x_chan_refsel_ref_get(const struct zl3073x_chan *chan) -+{ -+ return FIELD_GET(ZL_DPLL_REFSEL_STATUS_REFSEL, chan->refsel_status); -+} -+ -+#endif /* _ZL3073X_CHAN_H */ -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 179fff5..024f0a2 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -20,79 +20,30 @@ - #include "dpll.h" - #include "regs.h" - --/* Chip IDs for zl30731 */ --static const u16 zl30731_ids[] = { -- 0x0E93, -- 0x1E93, -- 0x2E93, -+#define ZL_CHIP_INFO(_id, _nchannels, _flags) \ -+ { .id = (_id), .num_channels = (_nchannels), .flags = (_flags) } -+ -+static const struct zl3073x_chip_info zl3073x_chip_ids[] = { -+ ZL_CHIP_INFO(0x0E30, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E93, 1, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E94, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E95, 3, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E96, 4, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x0E97, 5, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x1E93, 1, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E94, 2, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E95, 3, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E96, 4, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1E97, 5, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x1F60, 2, ZL3073X_FLAG_REF_PHASE_COMP_32), -+ ZL_CHIP_INFO(0x2E93, 1, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E94, 2, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E95, 3, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E96, 4, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x2E97, 5, ZL3073X_FLAG_DIE_TEMP), -+ ZL_CHIP_INFO(0x3FC4, 2, ZL3073X_FLAG_DIE_TEMP), - }; - --const struct zl3073x_chip_info zl30731_chip_info = { -- .ids = zl30731_ids, -- .num_ids = ARRAY_SIZE(zl30731_ids), -- .num_channels = 1, --}; --EXPORT_SYMBOL_NS_GPL(zl30731_chip_info, ZL3073X); -- --/* Chip IDs for zl30732 */ --static const u16 zl30732_ids[] = { -- 0x0E30, -- 0x0E94, -- 0x1E94, -- 0x1F60, -- 0x2E94, -- 0x3FC4, --}; -- --const struct zl3073x_chip_info zl30732_chip_info = { -- .ids = zl30732_ids, -- .num_ids = ARRAY_SIZE(zl30732_ids), -- .num_channels = 2, --}; --EXPORT_SYMBOL_NS_GPL(zl30732_chip_info, ZL3073X); -- --/* Chip IDs for zl30733 */ --static const u16 zl30733_ids[] = { -- 0x0E95, -- 0x1E95, -- 0x2E95, --}; -- --const struct zl3073x_chip_info zl30733_chip_info = { -- .ids = zl30733_ids, -- .num_ids = ARRAY_SIZE(zl30733_ids), -- .num_channels = 3, --}; --EXPORT_SYMBOL_NS_GPL(zl30733_chip_info, ZL3073X); -- --/* Chip IDs for zl30734 */ --static const u16 zl30734_ids[] = { -- 0x0E96, -- 0x1E96, -- 0x2E96, --}; -- --const struct zl3073x_chip_info zl30734_chip_info = { -- .ids = zl30734_ids, -- .num_ids = ARRAY_SIZE(zl30734_ids), -- .num_channels = 4, --}; --EXPORT_SYMBOL_NS_GPL(zl30734_chip_info, ZL3073X); -- --/* Chip IDs for zl30735 */ --static const u16 zl30735_ids[] = { -- 0x0E97, -- 0x1E97, -- 0x2E97, --}; -- --const struct zl3073x_chip_info zl30735_chip_info = { -- .ids = zl30735_ids, -- .num_ids = ARRAY_SIZE(zl30735_ids), -- .num_channels = 5, --}; --EXPORT_SYMBOL_NS_GPL(zl30735_chip_info, ZL3073X); -- - #define ZL_RANGE_OFFSET 0x80 - #define ZL_PAGE_SIZE 0x80 - #define ZL_NUM_PAGES 256 -@@ -588,17 +539,26 @@ zl3073x_dev_state_fetch(struct zl3073x_dev *zldev) - } - } - -+ for (i = 0; i < zldev->info->num_channels; i++) { -+ rc = zl3073x_chan_state_fetch(zldev, i); -+ if (rc) { -+ dev_err(zldev->dev, -+ "Failed to fetch channel state: %pe\n", -+ ERR_PTR(rc)); -+ return rc; -+ } -+ } -+ - return rc; - } - - static void --zl3073x_dev_ref_status_update(struct zl3073x_dev *zldev) -+zl3073x_dev_ref_states_update(struct zl3073x_dev *zldev) - { - int i, rc; - - for (i = 0; i < ZL3073X_NUM_REFS; i++) { -- rc = zl3073x_read_u8(zldev, ZL_REG_REF_MON_STATUS(i), -- &zldev->ref[i].mon_status); -+ rc = zl3073x_ref_state_update(zldev, i); - if (rc) - dev_warn(zldev->dev, - "Failed to get REF%u status: %pe\n", i, -@@ -606,6 +566,20 @@ zl3073x_dev_ref_status_update(struct zl3073x_dev *zldev) - } - } - -+static void -+zl3073x_dev_chan_states_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ for (i = 0; i < zldev->info->num_channels; i++) { -+ rc = zl3073x_chan_state_update(zldev, i); -+ if (rc) -+ dev_warn(zldev->dev, -+ "Failed to get DPLL%u state: %pe\n", i, -+ ERR_PTR(rc)); -+ } -+} -+ - /** - * zl3073x_ref_phase_offsets_update - update reference phase offsets - * @zldev: pointer to zl3073x_dev structure -@@ -658,22 +632,21 @@ int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel) - } - - /** -- * zl3073x_ref_ffo_update - update reference fractional frequency offsets -+ * zl3073x_ref_freq_meas_latch - latch reference frequency measurements - * @zldev: pointer to zl3073x_dev structure -+ * @type: measurement type (ZL_REF_FREQ_MEAS_CTRL_*) - * -- * The function asks device to update fractional frequency offsets latch -- * registers the latest measured values, reads and stores them into -+ * The function waits for the previous measurement to finish, selects all -+ * references and requests a new measurement of the given type. - * - * Return: 0 on success, <0 on error - */ - static int --zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) -+zl3073x_ref_freq_meas_latch(struct zl3073x_dev *zldev, u8 type) - { -- int i, rc; -+ int rc; - -- /* Per datasheet we have to wait for 'ref_freq_meas_ctrl' to be zero -- * to ensure that the measured data are coherent. -- */ -+ /* Wait for previous measurement to finish */ - rc = zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, - ZL_REF_FREQ_MEAS_CTRL); - if (rc) -@@ -689,15 +662,64 @@ zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) - if (rc) - return rc; - -- /* Request frequency offset measurement */ -- rc = zl3073x_write_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -- ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); -+ /* Request measurement */ -+ rc = zl3073x_write_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, type); - if (rc) - return rc; - - /* Wait for finish */ -- rc = zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -- ZL_REF_FREQ_MEAS_CTRL); -+ return zl3073x_poll_zero_u8(zldev, ZL_REG_REF_FREQ_MEAS_CTRL, -+ ZL_REF_FREQ_MEAS_CTRL); -+} -+ -+/** -+ * zl3073x_ref_freq_meas_update - update measured input reference frequencies -+ * @zldev: pointer to zl3073x_dev structure -+ * -+ * The function asks device to latch measured input reference frequencies -+ * and stores the results in the ref state. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_ref_freq_meas_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ rc = zl3073x_ref_freq_meas_latch(zldev, ZL_REF_FREQ_MEAS_CTRL_REF_FREQ); -+ if (rc) -+ return rc; -+ -+ /* Read measured frequencies in Hz (unsigned 32-bit, LSB = 1 Hz) */ -+ for (i = 0; i < ZL3073X_NUM_REFS; i++) { -+ u32 value; -+ -+ rc = zl3073x_read_u32(zldev, ZL_REG_REF_FREQ(i), &value); -+ if (rc) -+ return rc; -+ -+ zldev->ref[i].meas_freq = value; -+ } -+ -+ return 0; -+} -+ -+/** -+ * zl3073x_ref_ffo_update - update reference fractional frequency offsets -+ * @zldev: pointer to zl3073x_dev structure -+ * -+ * The function asks device to latch the latest measured fractional -+ * frequency offset values, reads and stores them into the ref state. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) -+{ -+ int i, rc; -+ -+ rc = zl3073x_ref_freq_meas_latch(zldev, -+ ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); - if (rc) - return rc; - -@@ -728,8 +750,11 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - struct zl3073x_dpll *zldpll; - int rc; - -- /* Update input references status */ -- zl3073x_dev_ref_status_update(zldev); -+ /* Update input references' states */ -+ zl3073x_dev_ref_states_update(zldev); -+ -+ /* Update DPLL channels' states */ -+ zl3073x_dev_chan_states_update(zldev); - - /* Update DPLL-to-connected-ref phase offsets registers */ - rc = zl3073x_ref_phase_offsets_update(zldev, -1); -@@ -737,6 +762,20 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - dev_warn(zldev->dev, "Failed to update phase offsets: %pe\n", - ERR_PTR(rc)); - -+ /* Update measured input reference frequencies if any DPLL has -+ * frequency monitoring enabled. -+ */ -+ list_for_each_entry(zldpll, &zldev->dplls, list) { -+ if (zldpll->freq_monitor) { -+ rc = zl3073x_ref_freq_meas_update(zldev); -+ if (rc) -+ dev_warn(zldev->dev, -+ "Failed to update measured frequencies: %pe\n", -+ ERR_PTR(rc)); -+ break; -+ } -+ } -+ - /* Update references' fractional frequency offsets */ - rc = zl3073x_ref_ffo_update(zldev); - if (rc) -@@ -766,8 +805,7 @@ int zl3073x_dev_phase_avg_factor_set(struct zl3073x_dev *zldev, u8 factor) - value = (factor + 1) & 0x0f; - - /* Update phase measurement control register */ -- dpll_meas_ctrl &= ~ZL_DPLL_MEAS_CTRL_AVG_FACTOR; -- dpll_meas_ctrl |= FIELD_PREP(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, value); -+ FIELD_MODIFY(ZL_DPLL_MEAS_CTRL_AVG_FACTOR, &dpll_meas_ctrl, value); - rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MEAS_CTRL, dpll_meas_ctrl); - if (rc) - return rc; -@@ -942,7 +980,7 @@ static void zl3073x_dev_dpll_fini(void *ptr) - } - - static int --zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) -+zl3073x_devm_dpll_init(struct zl3073x_dev *zldev) - { - struct kthread_worker *kworker; - struct zl3073x_dpll *zldpll; -@@ -952,7 +990,7 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - INIT_LIST_HEAD(&zldev->dplls); - - /* Allocate all DPLLs */ -- for (i = 0; i < num_dplls; i++) { -+ for (i = 0; i < zldev->info->num_channels; i++) { - zldpll = zl3073x_dpll_alloc(zldev, i); - if (IS_ERR(zldpll)) { - dev_err_probe(zldev->dev, PTR_ERR(zldpll), -@@ -994,14 +1032,12 @@ zl3073x_devm_dpll_init(struct zl3073x_dev *zldev, u8 num_dplls) - /** - * zl3073x_dev_probe - initialize zl3073x device - * @zldev: pointer to zl3073x device -- * @chip_info: chip info based on compatible - * - * Common initialization of zl3073x device structure. - * - * Returns: 0 on success, <0 on error - */ --int zl3073x_dev_probe(struct zl3073x_dev *zldev, -- const struct zl3073x_chip_info *chip_info) -+int zl3073x_dev_probe(struct zl3073x_dev *zldev) - { - u16 id, revision, fw_ver; - unsigned int i; -@@ -1013,18 +1049,17 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - if (rc) - return rc; - -- /* Check it matches */ -- for (i = 0; i < chip_info->num_ids; i++) { -- if (id == chip_info->ids[i]) -+ /* Detect chip variant */ -+ for (i = 0; i < ARRAY_SIZE(zl3073x_chip_ids); i++) { -+ if (zl3073x_chip_ids[i].id == id) - break; - } - -- if (i == chip_info->num_ids) { -+ if (i == ARRAY_SIZE(zl3073x_chip_ids)) - return dev_err_probe(zldev->dev, -ENODEV, -- "Unknown or non-match chip ID: 0x%0x\n", -- id); -- } -- zldev->chip_id = id; -+ "Unknown chip ID: 0x%04x\n", id); -+ -+ zldev->info = &zl3073x_chip_ids[i]; - - /* Read revision, firmware version and custom config version */ - rc = zl3073x_read_u16(zldev, ZL_REG_REVISION, &revision); -@@ -1063,7 +1098,7 @@ int zl3073x_dev_probe(struct zl3073x_dev *zldev, - "Failed to initialize mutex\n"); - - /* Register DPLL channels */ -- rc = zl3073x_devm_dpll_init(zldev, chip_info->num_channels); -+ rc = zl3073x_devm_dpll_init(zldev); - if (rc) - return rc; - -diff --git a/drivers/dpll/zl3073x/core.h b/drivers/dpll/zl3073x/core.h -index fd2af3c..9944062 100644 ---- a/drivers/dpll/zl3073x/core.h -+++ b/drivers/dpll/zl3073x/core.h -@@ -9,6 +9,7 @@ - #include - #include - -+#include "chan.h" - #include "out.h" - #include "ref.h" - #include "regs.h" -@@ -18,27 +19,39 @@ struct device; - struct regmap; - struct zl3073x_dpll; - --/* -- * Hardware limits for ZL3073x chip family -+ -+enum zl3073x_flags { -+ ZL3073X_FLAG_REF_PHASE_COMP_32_BIT, -+ ZL3073X_FLAG_DIE_TEMP_BIT, -+ ZL3073X_FLAGS_NBITS /* must be last */ -+}; -+ -+#define __ZL3073X_FLAG(name) BIT(ZL3073X_FLAG_ ## name ## _BIT) -+#define ZL3073X_FLAG_REF_PHASE_COMP_32 __ZL3073X_FLAG(REF_PHASE_COMP_32) -+#define ZL3073X_FLAG_DIE_TEMP __ZL3073X_FLAG(DIE_TEMP) -+ -+/** -+ * struct zl3073x_chip_info - chip variant identification -+ * @id: chip ID -+ * @num_channels: number of DPLL channels supported by this variant -+ * @flags: chip variant flags - */ --#define ZL3073X_MAX_CHANNELS 5 --#define ZL3073X_NUM_REFS 10 --#define ZL3073X_NUM_OUTS 10 --#define ZL3073X_NUM_SYNTHS 5 --#define ZL3073X_NUM_INPUT_PINS ZL3073X_NUM_REFS --#define ZL3073X_NUM_OUTPUT_PINS (ZL3073X_NUM_OUTS * 2) --#define ZL3073X_NUM_PINS (ZL3073X_NUM_INPUT_PINS + \ -- ZL3073X_NUM_OUTPUT_PINS) -+struct zl3073x_chip_info { -+ u16 id; -+ u8 num_channels; -+ unsigned long flags; -+}; - - /** - * struct zl3073x_dev - zl3073x device - * @dev: pointer to device - * @regmap: regmap to access device registers -+ * @info: detected chip info - * @multiop_lock: to serialize multiple register operations -- * @chip_id: chip ID read from hardware - * @ref: array of input references' invariants - * @out: array of outs' invariants - * @synth: array of synths' invariants -+ * @chan: array of DPLL channels' state - * @dplls: list of DPLLs - * @kworker: thread for periodic work - * @work: periodic work -@@ -46,15 +59,16 @@ struct zl3073x_dpll; - * @phase_avg_factor: phase offset measurement averaging factor - */ - struct zl3073x_dev { -- struct device *dev; -- struct regmap *regmap; -- struct mutex multiop_lock; -- u16 chip_id; -+ struct device *dev; -+ struct regmap *regmap; -+ const struct zl3073x_chip_info *info; -+ struct mutex multiop_lock; - - /* Invariants */ - struct zl3073x_ref ref[ZL3073X_NUM_REFS]; - struct zl3073x_out out[ZL3073X_NUM_OUTS]; - struct zl3073x_synth synth[ZL3073X_NUM_SYNTHS]; -+ struct zl3073x_chan chan[ZL3073X_MAX_CHANNELS]; - - /* DPLL channels */ - struct list_head dplls; -@@ -68,22 +82,10 @@ struct zl3073x_dev { - u8 phase_avg_factor; - }; - --struct zl3073x_chip_info { -- const u16 *ids; -- size_t num_ids; -- int num_channels; --}; -- --extern const struct zl3073x_chip_info zl30731_chip_info; --extern const struct zl3073x_chip_info zl30732_chip_info; --extern const struct zl3073x_chip_info zl30733_chip_info; --extern const struct zl3073x_chip_info zl30734_chip_info; --extern const struct zl3073x_chip_info zl30735_chip_info; - extern const struct regmap_config zl3073x_regmap_config; - - struct zl3073x_dev *zl3073x_devm_alloc(struct device *dev); --int zl3073x_dev_probe(struct zl3073x_dev *zldev, -- const struct zl3073x_chip_info *chip_info); -+int zl3073x_dev_probe(struct zl3073x_dev *zldev); - - int zl3073x_dev_start(struct zl3073x_dev *zldev, bool full); - void zl3073x_dev_stop(struct zl3073x_dev *zldev); -@@ -158,18 +160,7 @@ int zl3073x_ref_phase_offsets_update(struct zl3073x_dev *zldev, int channel); - static inline bool - zl3073x_dev_is_ref_phase_comp_32bit(struct zl3073x_dev *zldev) - { -- switch (zldev->chip_id) { -- case 0x0E30: -- case 0x0E93: -- case 0x0E94: -- case 0x0E95: -- case 0x0E96: -- case 0x0E97: -- case 0x1F60: -- return true; -- default: -- return false; -- } -+ return zldev->info->flags & ZL3073X_FLAG_REF_PHASE_COMP_32; - } - - static inline bool -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 8ffbede..55195dc 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -30,32 +31,34 @@ - * @dpll: DPLL the pin is registered to - * @dpll_pin: pointer to registered dpll_pin - * @tracker: tracking object for the acquired reference -+ * @fwnode: firmware node handle - * @label: package label - * @dir: pin direction - * @id: pin id - * @prio: pin priority <0, 14> -- * @selectable: pin is selectable in automatic mode - * @esync_control: embedded sync is controllable - * @phase_gran: phase adjustment granularity - * @pin_state: last saved pin state - * @phase_offset: last saved pin phase offset - * @freq_offset: last saved fractional frequency offset -+ * @measured_freq: last saved measured frequency - */ - struct zl3073x_dpll_pin { - struct list_head list; - struct zl3073x_dpll *dpll; - struct dpll_pin *dpll_pin; - dpll_tracker tracker; -+ struct fwnode_handle *fwnode; - char label[8]; - enum dpll_pin_direction dir; - u8 id; - u8 prio; -- bool selectable; - bool esync_control; - s32 phase_gran; - enum dpll_pin_state pin_state; - s64 phase_offset; - s64 freq_offset; -+ u32 measured_freq; - }; - - /* -@@ -133,7 +136,13 @@ zl3073x_dpll_input_pin_esync_get(const struct dpll_pin *dpll_pin, - ref_id = zl3073x_input_pin_ref_get(pin->id); - ref = zl3073x_ref_state_get(zldev, ref_id); - -- switch (FIELD_GET(ZL_REF_SYNC_CTRL_MODE, ref->sync_ctrl)) { -+ if (!pin->esync_control || zl3073x_ref_freq_get(ref) <= 1) -+ return -EOPNOTSUPP; -+ -+ esync->range = esync_freq_ranges; -+ esync->range_num = ARRAY_SIZE(esync_freq_ranges); -+ -+ switch (zl3073x_ref_sync_mode_get(ref)) { - case ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75: - esync->freq = ref->esync_n_div == ZL_REF_ESYNC_DIV_1HZ ? 1 : 0; - esync->pulse = 25; -@@ -144,17 +153,6 @@ zl3073x_dpll_input_pin_esync_get(const struct dpll_pin *dpll_pin, - break; - } - -- /* If the pin supports esync control expose its range but only -- * if the current reference frequency is > 1 Hz. -- */ -- if (pin->esync_control && zl3073x_ref_freq_get(ref) > 1) { -- esync->range = esync_freq_ranges; -- esync->range_num = ARRAY_SIZE(esync_freq_ranges); -- } else { -- esync->range = NULL; -- esync->range_num = 0; -- } -- - return 0; - } - -@@ -180,8 +178,7 @@ zl3073x_dpll_input_pin_esync_set(const struct dpll_pin *dpll_pin, - else - sync_mode = ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75; - -- ref.sync_ctrl &= ~ZL_REF_SYNC_CTRL_MODE; -- ref.sync_ctrl |= FIELD_PREP(ZL_REF_SYNC_CTRL_MODE, sync_mode); -+ zl3073x_ref_sync_mode_set(&ref, sync_mode); - - if (freq) { - /* 1 Hz is only supported frequency now */ -@@ -192,6 +189,109 @@ zl3073x_dpll_input_pin_esync_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - -+static int -+zl3073x_dpll_input_pin_ref_sync_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_pin *ref_sync_pin, -+ void *ref_sync_pin_priv, -+ enum dpll_pin_state *state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *sync_pin = ref_sync_pin_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_ref *ref; -+ u8 ref_id, mode, pair; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ mode = zl3073x_ref_sync_mode_get(ref); -+ pair = zl3073x_ref_sync_pair_get(ref); -+ -+ if (mode == ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR && -+ pair == zl3073x_input_pin_ref_get(sync_pin->id)) -+ *state = DPLL_PIN_STATE_CONNECTED; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_input_pin_ref_sync_set(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_pin *ref_sync_pin, -+ void *ref_sync_pin_priv, -+ const enum dpll_pin_state state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *sync_pin = ref_sync_pin_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ u8 mode, ref_id, sync_ref_id; -+ struct zl3073x_chan chan; -+ struct zl3073x_ref ref; -+ int rc; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ sync_ref_id = zl3073x_input_pin_ref_get(sync_pin->id); -+ ref = *zl3073x_ref_state_get(zldev, ref_id); -+ -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ const struct zl3073x_ref *sync_ref; -+ u32 ref_freq, sync_freq; -+ -+ sync_ref = zl3073x_ref_state_get(zldev, sync_ref_id); -+ ref_freq = zl3073x_ref_freq_get(&ref); -+ sync_freq = zl3073x_ref_freq_get(sync_ref); -+ -+ /* Sync signal must be 8 kHz or less and clock reference -+ * must be 1 kHz or more and higher than the sync signal. -+ */ -+ if (sync_freq > 8000) { -+ NL_SET_ERR_MSG(extack, -+ "sync frequency must be 8 kHz or less"); -+ return -EINVAL; -+ } -+ if (ref_freq < 1000) { -+ NL_SET_ERR_MSG(extack, -+ "clock frequency must be 1 kHz or more"); -+ return -EINVAL; -+ } -+ if (ref_freq <= sync_freq) { -+ NL_SET_ERR_MSG(extack, -+ "clock frequency must be higher than sync frequency"); -+ return -EINVAL; -+ } -+ -+ zl3073x_ref_sync_pair_set(&ref, sync_ref_id); -+ mode = ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR; -+ } else { -+ mode = ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR_OFF; -+ } -+ -+ zl3073x_ref_sync_mode_set(&ref, mode); -+ -+ rc = zl3073x_ref_state_set(zldev, ref_id, &ref); -+ if (rc) -+ return rc; -+ -+ /* Exclude sync source from automatic reference selection by setting -+ * its priority to NONE. On disconnect the priority is left as NONE -+ * and the user must explicitly make the pin selectable again. -+ */ -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ chan = *zl3073x_chan_state_get(zldev, zldpll->id); -+ zl3073x_chan_ref_prio_set(&chan, sync_ref_id, -+ ZL_DPLL_REF_PRIO_NONE); -+ return zl3073x_chan_state_set(zldev, zldpll->id, &chan); -+ } -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -@@ -204,6 +304,21 @@ zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - return 0; - } - -+static int -+zl3073x_dpll_input_pin_measured_freq_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, u64 *measured_freq, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ -+ *measured_freq = pin->measured_freq; -+ *measured_freq *= DPLL_PIN_MEASURED_FREQUENCY_DIVIDER; -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_input_pin_frequency_get(const struct dpll_pin *dpll_pin, - void *pin_priv, -@@ -245,156 +360,27 @@ zl3073x_dpll_input_pin_frequency_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - --/** -- * zl3073x_dpll_selected_ref_get - get currently selected reference -- * @zldpll: pointer to zl3073x_dpll -- * @ref: place to store selected reference -- * -- * Check for currently selected reference the DPLL should be locked to -- * and stores its index to given @ref. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_selected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) --{ -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 state, value; -- int rc; -- -- switch (zldpll->refsel_mode) { -- case ZL_DPLL_MODE_REFSEL_MODE_AUTO: -- /* For automatic mode read refsel_status register */ -- rc = zl3073x_read_u8(zldev, -- ZL_REG_DPLL_REFSEL_STATUS(zldpll->id), -- &value); -- if (rc) -- return rc; -- -- /* Extract reference state */ -- state = FIELD_GET(ZL_DPLL_REFSEL_STATUS_STATE, value); -- -- /* Return the reference only if the DPLL is locked to it */ -- if (state == ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -- *ref = FIELD_GET(ZL_DPLL_REFSEL_STATUS_REFSEL, value); -- else -- *ref = ZL3073X_DPLL_REF_NONE; -- break; -- case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- /* For manual mode return stored value */ -- *ref = zldpll->forced_ref; -- break; -- default: -- /* For other modes like NCO, freerun... there is no input ref */ -- *ref = ZL3073X_DPLL_REF_NONE; -- break; -- } -- -- return 0; --} -- --/** -- * zl3073x_dpll_selected_ref_set - select reference in manual mode -- * @zldpll: pointer to zl3073x_dpll -- * @ref: input reference to be selected -- * -- * Selects the given reference for the DPLL channel it should be -- * locked to. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_selected_ref_set(struct zl3073x_dpll *zldpll, u8 ref) --{ -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 mode, mode_refsel; -- int rc; -- -- mode = zldpll->refsel_mode; -- -- switch (mode) { -- case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- /* Manual mode with ref selected */ -- if (ref == ZL3073X_DPLL_REF_NONE) { -- switch (zldpll->lock_status) { -- case DPLL_LOCK_STATUS_LOCKED_HO_ACQ: -- case DPLL_LOCK_STATUS_HOLDOVER: -- /* Switch to forced holdover */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER; -- break; -- default: -- /* Switch to freerun */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_FREERUN; -- break; -- } -- /* Keep selected reference */ -- ref = zldpll->forced_ref; -- } else if (ref == zldpll->forced_ref) { -- /* No register update - same mode and same ref */ -- return 0; -- } -- break; -- case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -- case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: -- /* Manual mode without no ref */ -- if (ref == ZL3073X_DPLL_REF_NONE) -- /* No register update - keep current mode */ -- return 0; -- -- /* Switch to reflock mode and update ref selection */ -- mode = ZL_DPLL_MODE_REFSEL_MODE_REFLOCK; -- break; -- default: -- /* For other modes like automatic or NCO ref cannot be selected -- * manually -- */ -- return -EOPNOTSUPP; -- } -- -- /* Build mode_refsel value */ -- mode_refsel = FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, mode) | -- FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -- -- /* Update dpll_mode_refsel register */ -- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- mode_refsel); -- if (rc) -- return rc; -- -- /* Store new mode and forced reference */ -- zldpll->refsel_mode = mode; -- zldpll->forced_ref = ref; -- -- return rc; --} -- - /** - * zl3073x_dpll_connected_ref_get - get currently connected reference - * @zldpll: pointer to zl3073x_dpll -- * @ref: place to store selected reference - * -- * Looks for currently connected the DPLL is locked to and stores its index -- * to given @ref. -+ * Looks for currently connected reference the DPLL is locked to. - * -- * Return: 0 on success, <0 on error -+ * Return: reference index if locked, ZL3073X_DPLL_REF_NONE otherwise - */ --static int --zl3073x_dpll_connected_ref_get(struct zl3073x_dpll *zldpll, u8 *ref) -+static u8 -+zl3073x_dpll_connected_ref_get(struct zl3073x_dpll *zldpll) - { -- struct zl3073x_dev *zldev = zldpll->dev; -- int rc; -- -- /* Get currently selected input reference */ -- rc = zl3073x_dpll_selected_ref_get(zldpll, ref); -- if (rc) -- return rc; -+ const struct zl3073x_chan *chan = zl3073x_chan_state_get(zldpll->dev, -+ zldpll->id); -+ u8 state; - -- /* If the monitor indicates an error nothing is connected */ -- if (ZL3073X_DPLL_REF_IS_VALID(*ref) && -- !zl3073x_dev_ref_is_status_ok(zldev, *ref)) -- *ref = ZL3073X_DPLL_REF_NONE; -+ /* A reference is connected only when the DPLL is locked to it */ -+ state = zl3073x_chan_refsel_state_get(chan); -+ if (state == ZL_DPLL_REFSEL_STATUS_STATE_LOCK) -+ return zl3073x_chan_refsel_ref_get(chan); - -- return 0; -+ return ZL3073X_DPLL_REF_NONE; - } - - static int -@@ -410,12 +396,9 @@ zl3073x_dpll_input_pin_phase_offset_get(const struct dpll_pin *dpll_pin, - const struct zl3073x_ref *ref; - u8 conn_id, ref_id; - s64 ref_phase; -- int rc; - - /* Get currently connected reference */ -- rc = zl3073x_dpll_connected_ref_get(zldpll, &conn_id); -- if (rc) -- return rc; -+ conn_id = zl3073x_dpll_connected_ref_get(zldpll); - - /* Report phase offset only for currently connected pin if the phase - * monitor feature is disabled and only if the input pin signal is -@@ -453,7 +436,7 @@ zl3073x_dpll_input_pin_phase_offset_get(const struct dpll_pin *dpll_pin, - - *phase_offset = ref_phase * DPLL_PHASE_OFFSET_DIVIDER; - -- return rc; -+ return 0; - } - - static int -@@ -516,98 +499,6 @@ zl3073x_dpll_input_pin_phase_adjust_set(const struct dpll_pin *dpll_pin, - return zl3073x_ref_state_set(zldev, ref_id, &ref); - } - --/** -- * zl3073x_dpll_ref_prio_get - get priority for given input pin -- * @pin: pointer to pin -- * @prio: place to store priority -- * -- * Reads current priority for the given input pin and stores the value -- * to @prio. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_ref_prio_get(struct zl3073x_dpll_pin *pin, u8 *prio) --{ -- struct zl3073x_dpll *zldpll = pin->dpll; -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 ref, ref_prio; -- int rc; -- -- guard(mutex)(&zldev->multiop_lock); -- -- /* Read DPLL configuration */ -- rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); -- if (rc) -- return rc; -- -- /* Read reference priority - one value for P&N pins (4 bits/pin) */ -- ref = zl3073x_input_pin_ref_get(pin->id); -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), -- &ref_prio); -- if (rc) -- return rc; -- -- /* Select nibble according pin type */ -- if (zl3073x_dpll_is_p_pin(pin)) -- *prio = FIELD_GET(ZL_DPLL_REF_PRIO_REF_P, ref_prio); -- else -- *prio = FIELD_GET(ZL_DPLL_REF_PRIO_REF_N, ref_prio); -- -- return rc; --} -- --/** -- * zl3073x_dpll_ref_prio_set - set priority for given input pin -- * @pin: pointer to pin -- * @prio: place to store priority -- * -- * Sets priority for the given input pin. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_dpll_ref_prio_set(struct zl3073x_dpll_pin *pin, u8 prio) --{ -- struct zl3073x_dpll *zldpll = pin->dpll; -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 ref, ref_prio; -- int rc; -- -- guard(mutex)(&zldev->multiop_lock); -- -- /* Read DPLL configuration into mailbox */ -- rc = zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_RD, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); -- if (rc) -- return rc; -- -- /* Read reference priority - one value shared between P&N pins */ -- ref = zl3073x_input_pin_ref_get(pin->id); -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), &ref_prio); -- if (rc) -- return rc; -- -- /* Update nibble according pin type */ -- if (zl3073x_dpll_is_p_pin(pin)) { -- ref_prio &= ~ZL_DPLL_REF_PRIO_REF_P; -- ref_prio |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_P, prio); -- } else { -- ref_prio &= ~ZL_DPLL_REF_PRIO_REF_N; -- ref_prio |= FIELD_PREP(ZL_DPLL_REF_PRIO_REF_N, prio); -- } -- -- /* Update reference priority */ -- rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_REF_PRIO(ref / 2), ref_prio); -- if (rc) -- return rc; -- -- /* Commit configuration */ -- return zl3073x_mb_op(zldev, ZL_REG_DPLL_MB_SEM, ZL_DPLL_MB_SEM_WR, -- ZL_REG_DPLL_MB_MASK, BIT(zldpll->id)); --} -- - /** - * zl3073x_dpll_ref_state_get - get status for given input pin - * @pin: pointer to pin -@@ -624,17 +515,14 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -- u8 ref, ref_conn; -- int rc; -+ const struct zl3073x_chan *chan; -+ u8 ref; - -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); - ref = zl3073x_input_pin_ref_get(pin->id); - -- /* Get currently connected reference */ -- rc = zl3073x_dpll_connected_ref_get(zldpll, &ref_conn); -- if (rc) -- return rc; -- -- if (ref == ref_conn) { -+ /* Check if the pin reference is connected */ -+ if (ref == zl3073x_dpll_connected_ref_get(zldpll)) { - *state = DPLL_PIN_STATE_CONNECTED; - return 0; - } -@@ -643,8 +531,9 @@ zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, - * selectable and its monitor does not report any error then report - * pin as selectable. - */ -- if (zldpll->refsel_mode == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zl3073x_dev_ref_is_status_ok(zldev, ref) && pin->selectable) { -+ if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -+ zl3073x_dev_ref_is_status_ok(zldev, ref) && -+ zl3073x_chan_ref_is_selectable(chan, ref)) { - *state = DPLL_PIN_STATE_SELECTABLE; - return 0; - } -@@ -678,68 +567,81 @@ zl3073x_dpll_input_pin_state_on_dpll_set(const struct dpll_pin *dpll_pin, - { - struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dpll_pin *pin = pin_priv; -- u8 new_ref; -+ struct zl3073x_chan chan; -+ u8 mode, ref; - int rc; - -- switch (zldpll->refsel_mode) { -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ mode = zl3073x_chan_mode_get(&chan); -+ -+ switch (mode) { - case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -- case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -- case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: - if (state == DPLL_PIN_STATE_CONNECTED) { - /* Choose the pin as new selected reference */ -- new_ref = zl3073x_input_pin_ref_get(pin->id); -+ zl3073x_chan_ref_set(&chan, ref); - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -- /* No reference */ -- new_ref = ZL3073X_DPLL_REF_NONE; -+ /* Choose new mode based on lock status */ -+ switch (zldpll->lock_status) { -+ case DPLL_LOCK_STATUS_LOCKED_HO_ACQ: -+ case DPLL_LOCK_STATUS_HOLDOVER: -+ mode = ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER; -+ break; -+ default: -+ mode = ZL_DPLL_MODE_REFSEL_MODE_FREERUN; -+ break; -+ } -+ zl3073x_chan_mode_set(&chan, mode); - } else { -- NL_SET_ERR_MSG_MOD(extack, -- "Invalid pin state for manual mode"); -- return -EINVAL; -+ goto invalid_state; -+ } -+ break; -+ case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: -+ case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: -+ if (state == DPLL_PIN_STATE_CONNECTED) { -+ /* Choose the pin as new selected reference */ -+ zl3073x_chan_ref_set(&chan, ref); -+ /* Switch to reflock mode */ -+ zl3073x_chan_mode_set(&chan, -+ ZL_DPLL_MODE_REFSEL_MODE_REFLOCK); -+ } else if (state != DPLL_PIN_STATE_DISCONNECTED) { -+ goto invalid_state; - } -- -- rc = zl3073x_dpll_selected_ref_set(zldpll, new_ref); - break; -- - case ZL_DPLL_MODE_REFSEL_MODE_AUTO: - if (state == DPLL_PIN_STATE_SELECTABLE) { -- if (pin->selectable) -+ if (zl3073x_chan_ref_is_selectable(&chan, ref)) - return 0; /* Pin is already selectable */ - - /* Restore pin priority in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, pin->prio); -- if (rc) -- return rc; -- -- /* Mark pin as selectable */ -- pin->selectable = true; -+ zl3073x_chan_ref_prio_set(&chan, ref, pin->prio); - } else if (state == DPLL_PIN_STATE_DISCONNECTED) { -- if (!pin->selectable) -+ if (!zl3073x_chan_ref_is_selectable(&chan, ref)) - return 0; /* Pin is already disconnected */ - - /* Set pin priority to none in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, -- ZL_DPLL_REF_PRIO_NONE); -- if (rc) -- return rc; -- -- /* Mark pin as non-selectable */ -- pin->selectable = false; -+ zl3073x_chan_ref_prio_set(&chan, ref, -+ ZL_DPLL_REF_PRIO_NONE); - } else { -- NL_SET_ERR_MSG(extack, -- "Invalid pin state for automatic mode"); -- return -EINVAL; -+ goto invalid_state; - } - break; -- - default: - /* In other modes we cannot change input reference */ - NL_SET_ERR_MSG(extack, - "Pin state cannot be changed in current mode"); -- rc = -EOPNOTSUPP; -- break; -+ return -EOPNOTSUPP; - } - -- return rc; -+ /* Commit DPLL channel changes */ -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); -+ if (rc) -+ return rc; -+ -+ return 0; -+invalid_state: -+ NL_SET_ERR_MSG_MOD(extack, "Invalid pin state for this device mode"); -+ return -EINVAL; - } - - static int -@@ -759,15 +661,21 @@ zl3073x_dpll_input_pin_prio_set(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - u32 prio, struct netlink_ext_ack *extack) - { -+ struct zl3073x_dpll *zldpll = dpll_priv; - struct zl3073x_dpll_pin *pin = pin_priv; -+ struct zl3073x_chan chan; -+ u8 ref; - int rc; - - if (prio > ZL_DPLL_REF_PRIO_MAX) - return -EINVAL; - - /* If the pin is selectable then update HW registers */ -- if (pin->selectable) { -- rc = zl3073x_dpll_ref_prio_set(pin, prio); -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ if (zl3073x_chan_ref_is_selectable(&chan, ref)) { -+ zl3073x_chan_ref_prio_set(&chan, ref, prio); -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); - if (rc) - return rc; - } -@@ -791,8 +699,8 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; - const struct zl3073x_out *out; -- u8 clock_type, out_id; -- u32 synth_freq; -+ u32 synth_freq, out_freq; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = zl3073x_out_state_get(zldev, out_id); -@@ -801,29 +709,30 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - * for N-division is also used for the esync divider so both cannot - * be used. - */ -- switch (zl3073x_out_signal_format_get(out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ if (zl3073x_out_is_ndiv(out)) - return -EOPNOTSUPP; -- default: -- break; -- } - - /* Get attached synth frequency */ - synth = zl3073x_synth_state_get(zldev, zl3073x_out_synth_get(out)); - synth_freq = zl3073x_synth_freq_get(synth); -+ out_freq = synth_freq / out->div; -+ -+ if (!pin->esync_control || out_freq <= 1) -+ return -EOPNOTSUPP; -+ -+ esync->range = esync_freq_ranges; -+ esync->range_num = ARRAY_SIZE(esync_freq_ranges); - -- clock_type = FIELD_GET(ZL_OUTPUT_MODE_CLOCK_TYPE, out->mode); -- if (clock_type != ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC) { -+ if (zl3073x_out_clock_type_get(out) != ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC) { - /* No need to read esync data if it is not enabled */ - esync->freq = 0; - esync->pulse = 0; - -- goto finish; -+ return 0; - } - - /* Compute esync frequency */ -- esync->freq = synth_freq / out->div / out->esync_n_period; -+ esync->freq = out_freq / out->esync_n_period; - - /* By comparing the esync_pulse_width to the half of the pulse width - * the esync pulse percentage can be determined. -@@ -832,18 +741,6 @@ zl3073x_dpll_output_pin_esync_get(const struct dpll_pin *dpll_pin, - */ - esync->pulse = (50 * out->esync_n_width) / out->div; - --finish: -- /* Set supported esync ranges if the pin supports esync control and -- * if the output frequency is > 1 Hz. -- */ -- if (pin->esync_control && (synth_freq / out->div) > 1) { -- esync->range = esync_freq_ranges; -- esync->range_num = ARRAY_SIZE(esync_freq_ranges); -- } else { -- esync->range = NULL; -- esync->range_num = 0; -- } -- - return 0; - } - -@@ -859,8 +756,8 @@ zl3073x_dpll_output_pin_esync_set(const struct dpll_pin *dpll_pin, - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; - struct zl3073x_out out; -- u8 clock_type, out_id; - u32 synth_freq; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = *zl3073x_out_state_get(zldev, out_id); -@@ -869,23 +766,16 @@ zl3073x_dpll_output_pin_esync_set(const struct dpll_pin *dpll_pin, - * for N-division is also used for the esync divider so both cannot - * be used. - */ -- switch (zl3073x_out_signal_format_get(&out)) { -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV: -- case ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV: -+ if (zl3073x_out_is_ndiv(&out)) - return -EOPNOTSUPP; -- default: -- break; -- } - -- /* Select clock type */ -+ /* Update clock type in output mode */ - if (freq) -- clock_type = ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC; -+ zl3073x_out_clock_type_set(&out, -+ ZL_OUTPUT_MODE_CLOCK_TYPE_ESYNC); - else -- clock_type = ZL_OUTPUT_MODE_CLOCK_TYPE_NORMAL; -- -- /* Update clock type in output mode */ -- out.mode &= ~ZL_OUTPUT_MODE_CLOCK_TYPE; -- out.mode |= FIELD_PREP(ZL_OUTPUT_MODE_CLOCK_TYPE, clock_type); -+ zl3073x_out_clock_type_set(&out, -+ ZL_OUTPUT_MODE_CLOCK_TYPE_NORMAL); - - /* If esync is being disabled just write mailbox and finish */ - if (!freq) -@@ -937,9 +827,9 @@ zl3073x_dpll_output_pin_frequency_set(const struct dpll_pin *dpll_pin, - struct zl3073x_dev *zldev = zldpll->dev; - struct zl3073x_dpll_pin *pin = pin_priv; - const struct zl3073x_synth *synth; -- u8 out_id, signal_format; - u32 new_div, synth_freq; - struct zl3073x_out out; -+ u8 out_id; - - out_id = zl3073x_output_pin_out_get(pin->id); - out = *zl3073x_out_state_get(zldev, out_id); -@@ -949,12 +839,8 @@ zl3073x_dpll_output_pin_frequency_set(const struct dpll_pin *dpll_pin, - synth_freq = zl3073x_synth_freq_get(synth); - new_div = synth_freq / (u32)frequency; - -- /* Get used signal format for the given output */ -- signal_format = zl3073x_out_signal_format_get(&out); -- - /* Check signal format */ -- if (signal_format != ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV && -- signal_format != ZL_OUTPUT_MODE_SIGNAL_FORMAT_2_NDIV_INV) { -+ if (!zl3073x_out_is_ndiv(&out)) { - /* For non N-divided signal formats the frequency is computed - * as division of synth frequency and output divisor. - */ -@@ -1065,6 +951,25 @@ zl3073x_dpll_output_pin_state_on_dpll_get(const struct dpll_pin *dpll_pin, - return 0; - } - -+static int -+zl3073x_dpll_temp_get(const struct dpll_device *dpll, void *dpll_priv, -+ s32 *temp, struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ u16 val; -+ int rc; -+ -+ rc = zl3073x_read_u16(zldev, ZL_REG_DIE_TEMP_STATUS, &val); -+ if (rc) -+ return rc; -+ -+ /* Register value is in units of 0.1 C, convert to millidegrees */ -+ *temp = (s16)val * 100; -+ -+ return 0; -+} -+ - static int - zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_lock_status *status, -@@ -1072,11 +977,11 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- struct zl3073x_dev *zldev = zldpll->dev; -- u8 mon_status, state; -- int rc; -+ const struct zl3073x_chan *chan; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); - -- switch (zldpll->refsel_mode) { -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: - case ZL_DPLL_MODE_REFSEL_MODE_NCO: - /* In FREERUN and NCO modes the DPLL is always unlocked */ -@@ -1087,16 +992,9 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - break; - } - -- /* Read DPLL monitor status */ -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(zldpll->id), -- &mon_status); -- if (rc) -- return rc; -- state = FIELD_GET(ZL_DPLL_MON_STATUS_STATE, mon_status); -- -- switch (state) { -+ switch (zl3073x_chan_lock_state_get(chan)) { - case ZL_DPLL_MON_STATUS_STATE_LOCK: -- if (FIELD_GET(ZL_DPLL_MON_STATUS_HO_READY, mon_status)) -+ if (zl3073x_chan_is_ho_ready(chan)) - *status = DPLL_LOCK_STATUS_LOCKED_HO_ACQ; - else - *status = DPLL_LOCK_STATUS_LOCKED; -@@ -1106,8 +1004,9 @@ zl3073x_dpll_lock_status_get(const struct dpll_device *dpll, void *dpll_priv, - *status = DPLL_LOCK_STATUS_HOLDOVER; - break; - default: -- dev_warn(zldev->dev, "Unknown DPLL monitor status: 0x%02x\n", -- mon_status); -+ dev_warn(zldpll->dev->dev, -+ "Unknown DPLL monitor status: 0x%02x\n", -+ chan->mon_status); - *status = DPLL_LOCK_STATUS_UNLOCKED; - break; - } -@@ -1121,13 +1020,16 @@ zl3073x_dpll_supported_modes_get(const struct dpll_device *dpll, - struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -+ const struct zl3073x_chan *chan; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); - - /* We support switching between automatic and manual mode, except in - * a case where the DPLL channel is configured to run in NCO mode. - * In this case, report only the manual mode to which the NCO is mapped - * as the only supported one. - */ -- if (zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_NCO) -+ if (zl3073x_chan_mode_get(chan) != ZL_DPLL_MODE_REFSEL_MODE_NCO) - __set_bit(DPLL_MODE_AUTOMATIC, modes); - - __set_bit(DPLL_MODE_MANUAL, modes); -@@ -1140,8 +1042,11 @@ zl3073x_dpll_mode_get(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_mode *mode, struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -+ const struct zl3073x_chan *chan; - -- switch (zldpll->refsel_mode) { -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ -+ switch (zl3073x_chan_mode_get(chan)) { - case ZL_DPLL_MODE_REFSEL_MODE_FREERUN: - case ZL_DPLL_MODE_REFSEL_MODE_HOLDOVER: - case ZL_DPLL_MODE_REFSEL_MODE_NCO: -@@ -1220,14 +1125,12 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - enum dpll_mode mode, struct netlink_ext_ack *extack) - { - struct zl3073x_dpll *zldpll = dpll_priv; -- u8 hw_mode, mode_refsel, ref; -+ struct zl3073x_chan chan; -+ u8 hw_mode, ref; - int rc; - -- rc = zl3073x_dpll_selected_ref_get(zldpll, &ref); -- if (rc) { -- NL_SET_ERR_MSG_MOD(extack, "failed to get selected reference"); -- return rc; -- } -+ chan = *zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_chan_refsel_ref_get(&chan); - - if (mode == DPLL_MODE_MANUAL) { - /* We are switching from automatic to manual mode: -@@ -1250,44 +1153,32 @@ zl3073x_dpll_mode_set(const struct dpll_device *dpll, void *dpll_priv, - * it is selectable after switch to automatic mode - * - switch to automatic mode - */ -- struct zl3073x_dpll_pin *pin; -- -- pin = zl3073x_dpll_pin_get_by_ref(zldpll, ref); -- if (pin && !pin->selectable) { -- /* Restore pin priority in HW */ -- rc = zl3073x_dpll_ref_prio_set(pin, pin->prio); -- if (rc) { -- NL_SET_ERR_MSG_MOD(extack, -- "failed to restore pin priority"); -- return rc; -+ if (ZL3073X_DPLL_REF_IS_VALID(ref) && -+ !zl3073x_chan_ref_is_selectable(&chan, ref)) { -+ struct zl3073x_dpll_pin *pin; -+ -+ pin = zl3073x_dpll_pin_get_by_ref(zldpll, ref); -+ if (pin) { -+ /* Restore pin priority in HW */ -+ zl3073x_chan_ref_prio_set(&chan, ref, -+ pin->prio); - } -- -- pin->selectable = true; - } - - hw_mode = ZL_DPLL_MODE_REFSEL_MODE_AUTO; - } - -- /* Build mode_refsel value */ -- mode_refsel = FIELD_PREP(ZL_DPLL_MODE_REFSEL_MODE, hw_mode); -- -+ zl3073x_chan_mode_set(&chan, hw_mode); - if (ZL3073X_DPLL_REF_IS_VALID(ref)) -- mode_refsel |= FIELD_PREP(ZL_DPLL_MODE_REFSEL_REF, ref); -+ zl3073x_chan_ref_set(&chan, ref); - -- /* Update dpll_mode_refsel register */ -- rc = zl3073x_write_u8(zldpll->dev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- mode_refsel); -+ rc = zl3073x_chan_state_set(zldpll->dev, zldpll->id, &chan); - if (rc) { - NL_SET_ERR_MSG_MOD(extack, - "failed to set reference selection mode"); - return rc; - } - -- zldpll->refsel_mode = hw_mode; -- -- if (ZL3073X_DPLL_REF_IS_VALID(ref)) -- zldpll->forced_ref = ref; -- - return 0; - } - -@@ -1320,6 +1211,35 @@ zl3073x_dpll_phase_offset_monitor_set(const struct dpll_device *dpll, - return 0; - } - -+static int -+zl3073x_dpll_freq_monitor_get(const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_feature_state *state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ -+ if (zldpll->freq_monitor) -+ *state = DPLL_FEATURE_STATE_ENABLE; -+ else -+ *state = DPLL_FEATURE_STATE_DISABLE; -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_feature_state state, -+ struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ -+ zldpll->freq_monitor = (state == DPLL_FEATURE_STATE_ENABLE); -+ -+ return 0; -+} -+ - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, -@@ -1327,11 +1247,14 @@ static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .ffo_get = zl3073x_dpll_input_pin_ffo_get, - .frequency_get = zl3073x_dpll_input_pin_frequency_get, - .frequency_set = zl3073x_dpll_input_pin_frequency_set, -+ .measured_freq_get = zl3073x_dpll_input_pin_measured_freq_get, - .phase_offset_get = zl3073x_dpll_input_pin_phase_offset_get, - .phase_adjust_get = zl3073x_dpll_input_pin_phase_adjust_get, - .phase_adjust_set = zl3073x_dpll_input_pin_phase_adjust_set, - .prio_get = zl3073x_dpll_input_pin_prio_get, - .prio_set = zl3073x_dpll_input_pin_prio_set, -+ .ref_sync_get = zl3073x_dpll_input_pin_ref_sync_get, -+ .ref_sync_set = zl3073x_dpll_input_pin_ref_sync_set, - .state_on_dpll_get = zl3073x_dpll_input_pin_state_on_dpll_get, - .state_on_dpll_set = zl3073x_dpll_input_pin_state_on_dpll_set, - }; -@@ -1355,6 +1278,8 @@ static const struct dpll_device_ops zl3073x_dpll_device_ops = { - .phase_offset_avg_factor_set = zl3073x_dpll_phase_offset_avg_factor_set, - .phase_offset_monitor_get = zl3073x_dpll_phase_offset_monitor_get, - .phase_offset_monitor_set = zl3073x_dpll_phase_offset_monitor_set, -+ .freq_monitor_get = zl3073x_dpll_freq_monitor_get, -+ .freq_monitor_set = zl3073x_dpll_freq_monitor_set, - .supported_modes_get = zl3073x_dpll_supported_modes_get, - }; - -@@ -1422,24 +1347,25 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - if (IS_ERR(props)) - return PTR_ERR(props); - -- /* Save package label, esync capability and phase adjust granularity */ -+ /* Save package label, fwnode, esync capability and phase adjust -+ * granularity. -+ */ - strscpy(pin->label, props->package_label); -+ pin->fwnode = fwnode_handle_get(props->fwnode); - pin->esync_control = props->esync_control; - pin->phase_gran = props->dpll_props.phase_gran; - - if (zl3073x_dpll_is_input_pin(pin)) { -- rc = zl3073x_dpll_ref_prio_get(pin, &pin->prio); -- if (rc) -- goto err_prio_get; -+ const struct zl3073x_chan *chan; -+ u8 ref; - -- if (pin->prio == ZL_DPLL_REF_PRIO_NONE) { -- /* Clamp prio to max value & mark pin non-selectable */ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ pin->prio = zl3073x_chan_ref_prio_get(chan, ref); -+ -+ if (pin->prio == ZL_DPLL_REF_PRIO_NONE) -+ /* Clamp prio to max value */ - pin->prio = ZL_DPLL_REF_PRIO_MAX; -- pin->selectable = false; -- } else { -- /* Mark pin as selectable */ -- pin->selectable = true; -- } - } - - /* Create or get existing DPLL pin */ -@@ -1468,9 +1394,10 @@ zl3073x_dpll_pin_register(struct zl3073x_dpll_pin *pin, u32 index) - - err_register: - dpll_pin_put(pin->dpll_pin, &pin->tracker); --err_prio_get: - pin->dpll_pin = NULL; - err_pin_get: -+ fwnode_handle_put(pin->fwnode); -+ pin->fwnode = NULL; - zl3073x_pin_props_put(props); - - return rc; -@@ -1500,6 +1427,9 @@ zl3073x_dpll_pin_unregister(struct zl3073x_dpll_pin *pin) - - dpll_pin_put(pin->dpll_pin, &pin->tracker); - pin->dpll_pin = NULL; -+ -+ fwnode_handle_put(pin->fwnode); -+ pin->fwnode = NULL; - } - - /** -@@ -1540,15 +1470,18 @@ zl3073x_dpll_pin_is_registrable(struct zl3073x_dpll *zldpll, - enum dpll_pin_direction dir, u8 index) - { - struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_chan *chan; - bool is_diff, is_enabled; - const char *name; - -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ - if (dir == DPLL_PIN_DIRECTION_INPUT) { - u8 ref_id = zl3073x_input_pin_ref_get(index); - const struct zl3073x_ref *ref; - - /* Skip the pin if the DPLL is running in NCO mode */ -- if (zldpll->refsel_mode == ZL_DPLL_MODE_REFSEL_MODE_NCO) -+ if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_NCO) - return false; - - name = "REF"; -@@ -1656,20 +1589,11 @@ static int - zl3073x_dpll_device_register(struct zl3073x_dpll *zldpll) - { - struct zl3073x_dev *zldev = zldpll->dev; -- u8 dpll_mode_refsel; - int rc; - -- /* Read DPLL mode and forcibly selected reference */ -- rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MODE_REFSEL(zldpll->id), -- &dpll_mode_refsel); -- if (rc) -- return rc; -- -- /* Extract mode and selected input reference */ -- zldpll->refsel_mode = FIELD_GET(ZL_DPLL_MODE_REFSEL_MODE, -- dpll_mode_refsel); -- zldpll->forced_ref = FIELD_GET(ZL_DPLL_MODE_REFSEL_REF, -- dpll_mode_refsel); -+ zldpll->ops = zl3073x_dpll_device_ops; -+ if (zldev->info->flags & ZL3073X_FLAG_DIE_TEMP) -+ zldpll->ops.temp_get = zl3073x_dpll_temp_get; - - zldpll->dpll_dev = dpll_device_get(zldev->clock_id, zldpll->id, - THIS_MODULE, &zldpll->tracker); -@@ -1682,7 +1606,7 @@ zl3073x_dpll_device_register(struct zl3073x_dpll *zldpll) - - rc = dpll_device_register(zldpll->dpll_dev, - zl3073x_prop_dpll_type_get(zldev, zldpll->id), -- &zl3073x_dpll_device_ops, zldpll); -+ &zldpll->ops, zldpll); - if (rc) { - dpll_device_put(zldpll->dpll_dev, &zldpll->tracker); - zldpll->dpll_dev = NULL; -@@ -1705,8 +1629,7 @@ zl3073x_dpll_device_unregister(struct zl3073x_dpll *zldpll) - - cancel_work_sync(&zldpll->change_work); - -- dpll_device_unregister(zldpll->dpll_dev, &zl3073x_dpll_device_ops, -- zldpll); -+ dpll_device_unregister(zldpll->dpll_dev, &zldpll->ops, zldpll); - dpll_device_put(zldpll->dpll_dev, &zldpll->tracker); - zldpll->dpll_dev = NULL; - } -@@ -1786,6 +1709,7 @@ zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - struct zl3073x_dev *zldev = zldpll->dev; - const struct zl3073x_ref *ref; - u8 ref_id; -+ s64 ffo; - - /* Get reference monitor status */ - ref_id = zl3073x_input_pin_ref_get(pin->id); -@@ -1796,10 +1720,47 @@ zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - return false; - - /* Compare with previous value */ -- if (pin->freq_offset != ref->ffo) { -+ ffo = zl3073x_ref_ffo_get(ref); -+ if (pin->freq_offset != ffo) { - dev_dbg(zldev->dev, "%s freq offset changed: %lld -> %lld\n", -- pin->label, pin->freq_offset, ref->ffo); -- pin->freq_offset = ref->ffo; -+ pin->label, pin->freq_offset, ffo); -+ pin->freq_offset = ffo; -+ -+ return true; -+ } -+ -+ return false; -+} -+ -+/** -+ * zl3073x_dpll_pin_measured_freq_check - check for pin measured frequency -+ * change -+ * @pin: pin to check -+ * -+ * Check for the given pin's measured frequency change. -+ * -+ * Return: true on measured frequency change, false otherwise -+ */ -+static bool -+zl3073x_dpll_pin_measured_freq_check(struct zl3073x_dpll_pin *pin) -+{ -+ struct zl3073x_dpll *zldpll = pin->dpll; -+ struct zl3073x_dev *zldev = zldpll->dev; -+ const struct zl3073x_ref *ref; -+ u8 ref_id; -+ u32 freq; -+ -+ if (!zldpll->freq_monitor) -+ return false; -+ -+ ref_id = zl3073x_input_pin_ref_get(pin->id); -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ -+ freq = zl3073x_ref_meas_freq_get(ref); -+ if (pin->measured_freq != freq) { -+ dev_dbg(zldev->dev, "%s measured freq changed: %u -> %u\n", -+ pin->label, pin->measured_freq, freq); -+ pin->measured_freq = freq; - - return true; - } -@@ -1822,8 +1783,10 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - struct zl3073x_dev *zldev = zldpll->dev; - enum dpll_lock_status lock_status; - struct device *dev = zldev->dev; -+ const struct zl3073x_chan *chan; - struct zl3073x_dpll_pin *pin; - int rc; -+ u8 mode; - - zldpll->check_count++; - -@@ -1845,8 +1808,10 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - /* Input pin monitoring does make sense only in automatic - * or forced reference modes. - */ -- if (zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zldpll->refsel_mode != ZL_DPLL_MODE_REFSEL_MODE_REFLOCK) -+ chan = zl3073x_chan_state_get(zldev, zldpll->id); -+ mode = zl3073x_chan_mode_get(chan); -+ if (mode != ZL_DPLL_MODE_REFSEL_MODE_AUTO && -+ mode != ZL_DPLL_MODE_REFSEL_MODE_REFLOCK) - return; - - /* Update phase offset latch registers for this DPLL if the phase -@@ -1887,13 +1852,18 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - pin_changed = true; - } - -- /* Check for phase offset and ffo change once per second */ -+ /* Check for phase offset, ffo, and measured freq change -+ * once per second. -+ */ - if (zldpll->check_count % 2 == 0) { - if (zl3073x_dpll_pin_phase_offset_check(pin)) - pin_changed = true; - - if (zl3073x_dpll_pin_ffo_check(pin)) - pin_changed = true; -+ -+ if (zl3073x_dpll_pin_measured_freq_check(pin)) -+ pin_changed = true; - } - - if (pin_changed) -@@ -1973,6 +1943,88 @@ zl3073x_dpll_free(struct zl3073x_dpll *zldpll) - kfree(zldpll); - } - -+/** -+ * zl3073x_dpll_ref_sync_pair_register - register ref_sync pairs for a pin -+ * @pin: pointer to zl3073x_dpll_pin structure -+ * -+ * Iterates 'ref-sync-sources' phandles in the pin's firmware node and -+ * registers each declared pairing. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_dpll_ref_sync_pair_register(struct zl3073x_dpll_pin *pin) -+{ -+ struct zl3073x_dev *zldev = pin->dpll->dev; -+ struct fwnode_handle *fwnode; -+ struct dpll_pin *sync_pin; -+ dpll_tracker tracker; -+ int n, rc; -+ -+ for (n = 0; ; n++) { -+ /* Get n'th ref-sync source */ -+ fwnode = fwnode_find_reference(pin->fwnode, "ref-sync-sources", -+ n); -+ if (IS_ERR(fwnode)) { -+ rc = PTR_ERR(fwnode); -+ break; -+ } -+ -+ /* Find associated dpll pin */ -+ sync_pin = fwnode_dpll_pin_find(fwnode, &tracker); -+ fwnode_handle_put(fwnode); -+ if (!sync_pin) { -+ dev_warn(zldev->dev, "%s: ref-sync source %d not found", -+ pin->label, n); -+ continue; -+ } -+ -+ /* Register new ref-sync pair */ -+ rc = dpll_pin_ref_sync_pair_add(pin->dpll_pin, sync_pin); -+ dpll_pin_put(sync_pin, &tracker); -+ -+ /* -EBUSY means pairing already exists from another DPLL's -+ * registration. -+ */ -+ if (rc && rc != -EBUSY) { -+ dev_err(zldev->dev, -+ "%s: failed to add ref-sync source %d: %pe", -+ pin->label, n, ERR_PTR(rc)); -+ break; -+ } -+ } -+ -+ return rc != -ENOENT ? rc : 0; -+} -+ -+/** -+ * zl3073x_dpll_ref_sync_pairs_register - register ref_sync pairs for a DPLL -+ * @zldpll: pointer to zl3073x_dpll structure -+ * -+ * Iterates all registered input pins of the given DPLL and establishes -+ * ref_sync pairings declared by 'ref-sync-sources' phandles in the -+ * device tree. -+ * -+ * Return: 0 on success, <0 on error -+ */ -+static int -+zl3073x_dpll_ref_sync_pairs_register(struct zl3073x_dpll *zldpll) -+{ -+ struct zl3073x_dpll_pin *pin; -+ int rc; -+ -+ list_for_each_entry(pin, &zldpll->pins, list) { -+ if (!zl3073x_dpll_is_input_pin(pin) || !pin->fwnode) -+ continue; -+ -+ rc = zl3073x_dpll_ref_sync_pair_register(pin); -+ if (rc) -+ return rc; -+ } -+ -+ return 0; -+} -+ - /** - * zl3073x_dpll_register - register DPLL device and all its pins - * @zldpll: pointer to zl3073x_dpll structure -@@ -1996,6 +2048,13 @@ zl3073x_dpll_register(struct zl3073x_dpll *zldpll) - return rc; - } - -+ rc = zl3073x_dpll_ref_sync_pairs_register(zldpll); -+ if (rc) { -+ zl3073x_dpll_pins_unregister(zldpll); -+ zl3073x_dpll_device_unregister(zldpll); -+ return rc; -+ } -+ - return 0; - } - -diff --git a/drivers/dpll/zl3073x/dpll.h b/drivers/dpll/zl3073x/dpll.h -index c65c798..434c32a 100644 ---- a/drivers/dpll/zl3073x/dpll.h -+++ b/drivers/dpll/zl3073x/dpll.h -@@ -13,10 +13,10 @@ - * @list: this DPLL list entry - * @dev: pointer to multi-function parent device - * @id: DPLL index -- * @refsel_mode: reference selection mode -- * @forced_ref: selected reference in forced reference lock mode - * @check_count: periodic check counter - * @phase_monitor: is phase offset monitor enabled -+ * @freq_monitor: is frequency monitor enabled -+ * @ops: DPLL device operations for this instance - * @dpll_dev: pointer to registered DPLL device - * @tracker: tracking object for the acquired reference - * @lock_status: last saved DPLL lock status -@@ -27,10 +27,10 @@ struct zl3073x_dpll { - struct list_head list; - struct zl3073x_dev *dev; - u8 id; -- u8 refsel_mode; -- u8 forced_ref; - u8 check_count; - bool phase_monitor; -+ bool freq_monitor; -+ struct dpll_device_ops ops; - struct dpll_device *dpll_dev; - dpll_tracker tracker; - enum dpll_lock_status lock_status; -diff --git a/drivers/dpll/zl3073x/flash.c b/drivers/dpll/zl3073x/flash.c -index e2771dd..fa7ee9e 100644 ---- a/drivers/dpll/zl3073x/flash.c -+++ b/drivers/dpll/zl3073x/flash.c -@@ -194,8 +194,7 @@ zl3073x_flash_cmd_wait(struct zl3073x_dev *zldev, u32 operation, - if (rc) - return rc; - -- value &= ~ZL_WRITE_FLASH_OP; -- value |= FIELD_PREP(ZL_WRITE_FLASH_OP, operation); -+ FIELD_MODIFY(ZL_WRITE_FLASH_OP, &value, operation); - - rc = zl3073x_write_u8(zldev, ZL_REG_WRITE_FLASH, value); - if (rc) -diff --git a/drivers/dpll/zl3073x/i2c.c b/drivers/dpll/zl3073x/i2c.c -index a7ac128..2f36f2e 100644 ---- a/drivers/dpll/zl3073x/i2c.c -+++ b/drivers/dpll/zl3073x/i2c.c -@@ -22,40 +22,25 @@ static int zl3073x_i2c_probe(struct i2c_client *client) - return dev_err_probe(dev, PTR_ERR(zldev->regmap), - "Failed to initialize regmap\n"); - -- return zl3073x_dev_probe(zldev, i2c_get_match_data(client)); -+ return zl3073x_dev_probe(zldev); - } - - static const struct i2c_device_id zl3073x_i2c_id[] = { -- { -- .name = "zl30731", -- .driver_data = (kernel_ulong_t)&zl30731_chip_info, -- }, -- { -- .name = "zl30732", -- .driver_data = (kernel_ulong_t)&zl30732_chip_info, -- }, -- { -- .name = "zl30733", -- .driver_data = (kernel_ulong_t)&zl30733_chip_info, -- }, -- { -- .name = "zl30734", -- .driver_data = (kernel_ulong_t)&zl30734_chip_info, -- }, -- { -- .name = "zl30735", -- .driver_data = (kernel_ulong_t)&zl30735_chip_info, -- }, -+ { "zl30731" }, -+ { "zl30732" }, -+ { "zl30733" }, -+ { "zl30734" }, -+ { "zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(i2c, zl3073x_i2c_id); - - static const struct of_device_id zl3073x_i2c_of_match[] = { -- { .compatible = "microchip,zl30731", .data = &zl30731_chip_info }, -- { .compatible = "microchip,zl30732", .data = &zl30732_chip_info }, -- { .compatible = "microchip,zl30733", .data = &zl30733_chip_info }, -- { .compatible = "microchip,zl30734", .data = &zl30734_chip_info }, -- { .compatible = "microchip,zl30735", .data = &zl30735_chip_info }, -+ { .compatible = "microchip,zl30731" }, -+ { .compatible = "microchip,zl30732" }, -+ { .compatible = "microchip,zl30733" }, -+ { .compatible = "microchip,zl30734" }, -+ { .compatible = "microchip,zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(of, zl3073x_i2c_of_match); -diff --git a/drivers/dpll/zl3073x/out.c b/drivers/dpll/zl3073x/out.c -index 86829a0..eb5628a 100644 ---- a/drivers/dpll/zl3073x/out.c -+++ b/drivers/dpll/zl3073x/out.c -@@ -106,12 +106,32 @@ const struct zl3073x_out *zl3073x_out_state_get(struct zl3073x_dev *zldev, - return &zldev->out[index]; - } - -+/** -+ * zl3073x_out_state_set - commit output state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: output index to set state for -+ * @out: desired output state -+ * -+ * Validates that invariant fields have not been modified, skips the HW -+ * write if the mutable configuration is unchanged, and otherwise writes -+ * only the changed cfg fields to hardware via the mailbox interface. -+ * -+ * Return: 0 on success, -EINVAL if invariants changed, <0 on HW error -+ */ - int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_out *out) - { - struct zl3073x_out *dout = &zldev->out[index]; - int rc; - -+ /* Reject attempts to change invariant fields (set at fetch only) */ -+ if (WARN_ON(memcmp(&dout->inv, &out->inv, sizeof(out->inv)))) -+ return -EINVAL; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dout->cfg, &out->cfg, sizeof(out->cfg))) -+ return 0; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read output configuration into mailbox */ -@@ -146,12 +166,7 @@ int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - return rc; - - /* After successful commit store new state */ -- dout->div = out->div; -- dout->width = out->width; -- dout->esync_n_period = out->esync_n_period; -- dout->esync_n_width = out->esync_n_width; -- dout->mode = out->mode; -- dout->phase_comp = out->phase_comp; -+ dout->cfg = out->cfg; - - return 0; - } -diff --git a/drivers/dpll/zl3073x/out.h b/drivers/dpll/zl3073x/out.h -index 318f9bb..660889c 100644 ---- a/drivers/dpll/zl3073x/out.h -+++ b/drivers/dpll/zl3073x/out.h -@@ -4,6 +4,7 @@ - #define _ZL3073X_OUT_H - - #include -+#include - #include - - #include "regs.h" -@@ -17,17 +18,21 @@ struct zl3073x_dev; - * @esync_n_period: embedded sync or n-pin period (for n-div formats) - * @esync_n_width: embedded sync or n-pin pulse width - * @phase_comp: phase compensation -- * @ctrl: output control - * @mode: output mode -+ * @ctrl: output control - */ - struct zl3073x_out { -- u32 div; -- u32 width; -- u32 esync_n_period; -- u32 esync_n_width; -- s32 phase_comp; -- u8 ctrl; -- u8 mode; -+ struct_group(cfg, /* Config */ -+ u32 div; -+ u32 width; -+ u32 esync_n_period; -+ u32 esync_n_width; -+ s32 phase_comp; -+ u8 mode; -+ ); -+ struct_group(inv, /* Invariants */ -+ u8 ctrl; -+ ); - }; - - int zl3073x_out_state_fetch(struct zl3073x_dev *zldev, u8 index); -@@ -37,6 +42,28 @@ const struct zl3073x_out *zl3073x_out_state_get(struct zl3073x_dev *zldev, - int zl3073x_out_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_out *out); - -+/** -+ * zl3073x_out_clock_type_get - get output clock type -+ * @out: pointer to out state -+ * -+ * Return: clock type of given output (ZL_OUTPUT_MODE_CLOCK_TYPE_*) -+ */ -+static inline u8 zl3073x_out_clock_type_get(const struct zl3073x_out *out) -+{ -+ return FIELD_GET(ZL_OUTPUT_MODE_CLOCK_TYPE, out->mode); -+} -+ -+/** -+ * zl3073x_out_clock_type_set - set output clock type -+ * @out: pointer to out state -+ * @type: clock type (ZL_OUTPUT_MODE_CLOCK_TYPE_*) -+ */ -+static inline void -+zl3073x_out_clock_type_set(struct zl3073x_out *out, u8 type) -+{ -+ FIELD_MODIFY(ZL_OUTPUT_MODE_CLOCK_TYPE, &out->mode, type); -+} -+ - /** - * zl3073x_out_signal_format_get - get output signal format - * @out: pointer to out state -diff --git a/drivers/dpll/zl3073x/ref.c b/drivers/dpll/zl3073x/ref.c -index 6b65e61..825ac30 100644 ---- a/drivers/dpll/zl3073x/ref.c -+++ b/drivers/dpll/zl3073x/ref.c -@@ -51,6 +51,21 @@ zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult) - return -EINVAL; - } - -+/** -+ * zl3073x_ref_state_update - update input reference status from HW -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: input reference index -+ * -+ * Return: 0 on success, <0 on error -+ */ -+int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index) -+{ -+ struct zl3073x_ref *ref = &zldev->ref[index]; -+ -+ return zl3073x_read_u8(zldev, ZL_REG_REF_MON_STATUS(index), -+ &ref->mon_status); -+} -+ - /** - * zl3073x_ref_state_fetch - fetch input reference state from hardware - * @zldev: pointer to zl3073x_dev structure -@@ -73,18 +88,17 @@ int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index) - struct zl3073x_ref *p_ref = ref - 1; /* P-pin counterpart*/ - - /* Copy the shared items from the P-pin */ -- ref->config = p_ref->config; -- ref->esync_n_div = p_ref->esync_n_div; -- ref->freq_base = p_ref->freq_base; -- ref->freq_mult = p_ref->freq_mult; -- ref->freq_ratio_m = p_ref->freq_ratio_m; -- ref->freq_ratio_n = p_ref->freq_ratio_n; -- ref->phase_comp = p_ref->phase_comp; -- ref->sync_ctrl = p_ref->sync_ctrl; -+ ref->cfg = p_ref->cfg; -+ ref->inv = p_ref->inv; - - return 0; /* Finish - no non-shared items for now */ - } - -+ /* Read reference status */ -+ rc = zl3073x_ref_state_update(zldev, index); -+ if (rc) -+ return rc; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read reference configuration */ -@@ -154,12 +168,32 @@ zl3073x_ref_state_get(struct zl3073x_dev *zldev, u8 index) - return &zldev->ref[index]; - } - -+/** -+ * zl3073x_ref_state_set - commit input reference state changes to hardware -+ * @zldev: pointer to zl3073x_dev structure -+ * @index: input reference index to set state for -+ * @ref: desired reference state -+ * -+ * Validates that invariant fields have not been modified, skips the HW -+ * write if the mutable configuration is unchanged, and otherwise writes -+ * only the changed cfg fields to hardware via the mailbox interface. -+ * -+ * Return: 0 on success, -EINVAL if invariants changed, <0 on HW error -+ */ - int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_ref *ref) - { - struct zl3073x_ref *dref = &zldev->ref[index]; - int rc; - -+ /* Reject attempts to change invariant fields (set at init only) */ -+ if (WARN_ON(memcmp(&dref->inv, &ref->inv, sizeof(ref->inv)))) -+ return -EINVAL; -+ -+ /* Skip HW write if configuration hasn't changed */ -+ if (!memcmp(&dref->cfg, &ref->cfg, sizeof(ref->cfg))) -+ return 0; -+ - guard(mutex)(&zldev->multiop_lock); - - /* Read reference configuration into mailbox */ -@@ -207,13 +241,7 @@ int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - return rc; - - /* After successful commit store new state */ -- dref->freq_base = ref->freq_base; -- dref->freq_mult = ref->freq_mult; -- dref->freq_ratio_m = ref->freq_ratio_m; -- dref->freq_ratio_n = ref->freq_ratio_n; -- dref->esync_n_div = ref->esync_n_div; -- dref->sync_ctrl = ref->sync_ctrl; -- dref->phase_comp = ref->phase_comp; -+ dref->cfg = ref->cfg; - - return 0; - } -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index 0d8618f..55e80e4 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -5,6 +5,7 @@ - - #include - #include -+#include - #include - - #include "regs.h" -@@ -13,28 +14,36 @@ struct zl3073x_dev; - - /** - * struct zl3073x_ref - input reference state -- * @ffo: current fractional frequency offset - * @phase_comp: phase compensation - * @esync_n_div: divisor for embedded sync or n-divided signal formats - * @freq_base: frequency base - * @freq_mult: frequnecy multiplier - * @freq_ratio_m: FEC mode multiplier - * @freq_ratio_n: FEC mode divisor -- * @config: reference config - * @sync_ctrl: reference sync control -+ * @config: reference config -+ * @ffo: current fractional frequency offset -+ * @meas_freq: measured input frequency in Hz - * @mon_status: reference monitor status - */ - struct zl3073x_ref { -- s64 ffo; -- u64 phase_comp; -- u32 esync_n_div; -- u16 freq_base; -- u16 freq_mult; -- u16 freq_ratio_m; -- u16 freq_ratio_n; -- u8 config; -- u8 sync_ctrl; -- u8 mon_status; -+ struct_group(cfg, /* Configuration */ -+ u64 phase_comp; -+ u32 esync_n_div; -+ u16 freq_base; -+ u16 freq_mult; -+ u16 freq_ratio_m; -+ u16 freq_ratio_n; -+ u8 sync_ctrl; -+ ); -+ struct_group(inv, /* Invariants */ -+ u8 config; -+ ); -+ struct_group(stat, /* Status */ -+ s64 ffo; -+ u32 meas_freq; -+ u8 mon_status; -+ ); - }; - - int zl3073x_ref_state_fetch(struct zl3073x_dev *zldev, u8 index); -@@ -45,6 +54,8 @@ const struct zl3073x_ref *zl3073x_ref_state_get(struct zl3073x_dev *zldev, - int zl3073x_ref_state_set(struct zl3073x_dev *zldev, u8 index, - const struct zl3073x_ref *ref); - -+int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index); -+ - int zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult); - - /** -@@ -59,6 +70,18 @@ zl3073x_ref_ffo_get(const struct zl3073x_ref *ref) - return ref->ffo; - } - -+/** -+ * zl3073x_ref_meas_freq_get - get measured input frequency -+ * @ref: pointer to ref state -+ * -+ * Return: measured input frequency in Hz -+ */ -+static inline u32 -+zl3073x_ref_meas_freq_get(const struct zl3073x_ref *ref) -+{ -+ return ref->meas_freq; -+} -+ - /** - * zl3073x_ref_freq_get - get given input reference frequency - * @ref: pointer to ref state -@@ -97,6 +120,52 @@ zl3073x_ref_freq_set(struct zl3073x_ref *ref, u32 freq) - return 0; - } - -+/** -+ * zl3073x_ref_sync_mode_get - get sync control mode -+ * @ref: pointer to ref state -+ * -+ * Return: sync control mode (ZL_REF_SYNC_CTRL_MODE_*) -+ */ -+static inline u8 -+zl3073x_ref_sync_mode_get(const struct zl3073x_ref *ref) -+{ -+ return FIELD_GET(ZL_REF_SYNC_CTRL_MODE, ref->sync_ctrl); -+} -+ -+/** -+ * zl3073x_ref_sync_mode_set - set sync control mode -+ * @ref: pointer to ref state -+ * @mode: sync control mode (ZL_REF_SYNC_CTRL_MODE_*) -+ */ -+static inline void -+zl3073x_ref_sync_mode_set(struct zl3073x_ref *ref, u8 mode) -+{ -+ FIELD_MODIFY(ZL_REF_SYNC_CTRL_MODE, &ref->sync_ctrl, mode); -+} -+ -+/** -+ * zl3073x_ref_sync_pair_get - get sync pair reference index -+ * @ref: pointer to ref state -+ * -+ * Return: paired reference index -+ */ -+static inline u8 -+zl3073x_ref_sync_pair_get(const struct zl3073x_ref *ref) -+{ -+ return FIELD_GET(ZL_REF_SYNC_CTRL_PAIR, ref->sync_ctrl); -+} -+ -+/** -+ * zl3073x_ref_sync_pair_set - set sync pair reference index -+ * @ref: pointer to ref state -+ * @pair: paired reference index -+ */ -+static inline void -+zl3073x_ref_sync_pair_set(struct zl3073x_ref *ref, u8 pair) -+{ -+ FIELD_MODIFY(ZL_REF_SYNC_CTRL_PAIR, &ref->sync_ctrl, pair); -+} -+ - /** - * zl3073x_ref_is_diff - check if the given input reference is differential - * @ref: pointer to ref state -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 5573d71..d425dc6 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -6,6 +6,18 @@ - #include - #include - -+/* -+ * Hardware limits for ZL3073x chip family -+ */ -+#define ZL3073X_MAX_CHANNELS 5 -+#define ZL3073X_NUM_REFS 10 -+#define ZL3073X_NUM_OUTS 10 -+#define ZL3073X_NUM_SYNTHS 5 -+#define ZL3073X_NUM_INPUT_PINS ZL3073X_NUM_REFS -+#define ZL3073X_NUM_OUTPUT_PINS (ZL3073X_NUM_OUTS * 2) -+#define ZL3073X_NUM_PINS (ZL3073X_NUM_INPUT_PINS + \ -+ ZL3073X_NUM_OUTPUT_PINS) -+ - /* - * Register address structure: - * =========================== -@@ -78,6 +90,8 @@ - #define ZL_REG_RESET_STATUS ZL_REG(0, 0x18, 1) - #define ZL_REG_RESET_STATUS_RESET BIT(0) - -+#define ZL_REG_DIE_TEMP_STATUS ZL_REG(0, 0x44, 2) -+ - /************************* - * Register Page 2, Status - *************************/ -@@ -199,7 +213,9 @@ - #define ZL_REG_REF_SYNC_CTRL ZL_REG(10, 0x2e, 1) - #define ZL_REF_SYNC_CTRL_MODE GENMASK(2, 0) - #define ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR_OFF 0 -+#define ZL_REF_SYNC_CTRL_MODE_REFSYNC_PAIR 1 - #define ZL_REF_SYNC_CTRL_MODE_50_50_ESYNC_25_75 2 -+#define ZL_REF_SYNC_CTRL_PAIR GENMASK(7, 4) - - #define ZL_REG_REF_ESYNC_DIV ZL_REG(10, 0x30, 4) - #define ZL_REF_ESYNC_DIV_1HZ 0 -diff --git a/drivers/dpll/zl3073x/spi.c b/drivers/dpll/zl3073x/spi.c -index 00c5e38..ad43bf9 100644 ---- a/drivers/dpll/zl3073x/spi.c -+++ b/drivers/dpll/zl3073x/spi.c -@@ -22,40 +22,25 @@ static int zl3073x_spi_probe(struct spi_device *spi) - return dev_err_probe(dev, PTR_ERR(zldev->regmap), - "Failed to initialize regmap\n"); - -- return zl3073x_dev_probe(zldev, spi_get_device_match_data(spi)); -+ return zl3073x_dev_probe(zldev); - } - - static const struct spi_device_id zl3073x_spi_id[] = { -- { -- .name = "zl30731", -- .driver_data = (kernel_ulong_t)&zl30731_chip_info -- }, -- { -- .name = "zl30732", -- .driver_data = (kernel_ulong_t)&zl30732_chip_info, -- }, -- { -- .name = "zl30733", -- .driver_data = (kernel_ulong_t)&zl30733_chip_info, -- }, -- { -- .name = "zl30734", -- .driver_data = (kernel_ulong_t)&zl30734_chip_info, -- }, -- { -- .name = "zl30735", -- .driver_data = (kernel_ulong_t)&zl30735_chip_info, -- }, -+ { "zl30731" }, -+ { "zl30732" }, -+ { "zl30733" }, -+ { "zl30734" }, -+ { "zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(spi, zl3073x_spi_id); - - static const struct of_device_id zl3073x_spi_of_match[] = { -- { .compatible = "microchip,zl30731", .data = &zl30731_chip_info }, -- { .compatible = "microchip,zl30732", .data = &zl30732_chip_info }, -- { .compatible = "microchip,zl30733", .data = &zl30733_chip_info }, -- { .compatible = "microchip,zl30734", .data = &zl30734_chip_info }, -- { .compatible = "microchip,zl30735", .data = &zl30735_chip_info }, -+ { .compatible = "microchip,zl30731" }, -+ { .compatible = "microchip,zl30732" }, -+ { .compatible = "microchip,zl30733" }, -+ { .compatible = "microchip,zl30734" }, -+ { .compatible = "microchip,zl30735" }, - { /* sentinel */ } - }; - MODULE_DEVICE_TABLE(of, zl3073x_spi_of_match); -diff --git a/drivers/dpll/zl3073x/synth.h b/drivers/dpll/zl3073x/synth.h -index 6c55eb8..89e13ea 100644 ---- a/drivers/dpll/zl3073x/synth.h -+++ b/drivers/dpll/zl3073x/synth.h -@@ -5,6 +5,7 @@ - - #include - #include -+#include - #include - - #include "regs.h" -@@ -20,11 +21,13 @@ struct zl3073x_dev; - * @ctrl: synth control - */ - struct zl3073x_synth { -- u32 freq_mult; -- u16 freq_base; -- u16 freq_m; -- u16 freq_n; -- u8 ctrl; -+ struct_group(inv, /* Invariants */ -+ u32 freq_mult; -+ u16 freq_base; -+ u16 freq_m; -+ u16 freq_n; -+ u8 ctrl; -+ ); - }; - - int zl3073x_synth_state_fetch(struct zl3073x_dev *zldev, u8 synth_id); -@@ -32,9 +35,6 @@ int zl3073x_synth_state_fetch(struct zl3073x_dev *zldev, u8 synth_id); - const struct zl3073x_synth *zl3073x_synth_state_get(struct zl3073x_dev *zldev, - u8 synth_id); - --int zl3073x_synth_state_set(struct zl3073x_dev *zldev, u8 synth_id, -- const struct zl3073x_synth *synth); -- - /** - * zl3073x_synth_dpll_get - get DPLL ID the synth is driven by - * @synth: pointer to synth state -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index 6961f6e..7f8fa58 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -55,8 +55,12 @@ struct dpll_device_ops { - void *dpll_priv, u32 *factor, - struct netlink_ext_ack *extack); - -- RH_KABI_RESERVE(1) -- RH_KABI_RESERVE(2) -+ RH_KABI_USE(1, int (*freq_monitor_set)(const struct dpll_device *dpll, void *dpll_priv, -+ enum dpll_feature_state state, -+ struct netlink_ext_ack *extack)) -+ RH_KABI_USE(2, int (*freq_monitor_get)(const struct dpll_device *dpll, void *dpll_priv, -+ enum dpll_feature_state *state, -+ struct netlink_ext_ack *extack)) - RH_KABI_RESERVE(3) - RH_KABI_RESERVE(4) - RH_KABI_RESERVE(5) -@@ -141,7 +145,10 @@ struct dpll_pin_ops { - enum dpll_pin_state *state, - struct netlink_ext_ack *extack); - -- RH_KABI_RESERVE(1) -+ RH_KABI_USE(1, int (*measured_freq_get)(const struct dpll_pin *pin, void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, u64 *measured_freq, -+ struct netlink_ext_ack *extack)) - RH_KABI_RESERVE(2) - RH_KABI_RESERVE(3) - RH_KABI_RESERVE(4) -diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h -index 603a88c..93614cc 100644 ---- a/include/uapi/linux/dpll.h -+++ b/include/uapi/linux/dpll.h -@@ -190,7 +190,8 @@ enum dpll_pin_capabilities { - DPLL_PIN_CAPABILITIES_STATE_CAN_CHANGE = 4, - }; - --#define DPLL_PHASE_OFFSET_DIVIDER 1000 -+#define DPLL_PHASE_OFFSET_DIVIDER 1000 -+#define DPLL_PIN_MEASURED_FREQUENCY_DIVIDER 1000 - - /** - * enum dpll_feature_state - Allow control (enable/disable) and status checking -@@ -217,6 +218,7 @@ enum dpll_a { - DPLL_A_CLOCK_QUALITY_LEVEL, - DPLL_A_PHASE_OFFSET_MONITOR, - DPLL_A_PHASE_OFFSET_AVG_FACTOR, -+ DPLL_A_FREQUENCY_MONITOR, - - __DPLL_A_MAX, - DPLL_A_MAX = (__DPLL_A_MAX - 1) -@@ -253,6 +255,7 @@ enum dpll_a_pin { - DPLL_A_PIN_REFERENCE_SYNC, - DPLL_A_PIN_PHASE_ADJUST_GRAN, - DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -+ DPLL_A_PIN_MEASURED_FREQUENCY, - - __DPLL_A_PIN_MAX, - DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1) diff --git a/SOURCES/1284-ice-rss-queues-RHEL.patch b/SOURCES/1284-ice-rss-queues-RHEL.patch deleted file mode 100644 index f1ecbdb04..000000000 --- a/SOURCES/1284-ice-rss-queues-RHEL.patch +++ /dev/null @@ -1,256 +0,0 @@ -Subject: [PATCH] ice: default RSS queues series incl RHEL ice_rh (RHEL-174336/177526) -# AlmaLinux: reconstructed; includes RHEL-only ice_rh.c/.h - -diff --git a/drivers/net/ethernet/intel/ice/Makefile b/drivers/net/ethernet/intel/ice/Makefile -index 0b8cf4e..3da38fc 100644 ---- a/drivers/net/ethernet/intel/ice/Makefile -+++ b/drivers/net/ethernet/intel/ice/Makefile -@@ -43,7 +43,8 @@ ice-y := ice_main.o \ - ice_repr.o \ - ice_tc_lib.o \ - ice_debugfs.o \ -- ice_adapter.o -+ ice_adapter.o \ -+ ice_rh.o - ice-$(CONFIG_PCI_IOV) += \ - ice_sriov.o \ - virt/allowlist.o \ -diff --git a/drivers/net/ethernet/intel/ice/ice.h b/drivers/net/ethernet/intel/ice/ice.h -index a23ccd4..480db81 100644 ---- a/drivers/net/ethernet/intel/ice/ice.h -+++ b/drivers/net/ethernet/intel/ice/ice.h -@@ -837,6 +837,28 @@ static inline void ice_tx_xsk_pool(struct ice_vsi *vsi, u16 qid) - WRITE_ONCE(ring->xsk_pool, ice_get_xp_from_qid(vsi, qid)); - } - -+/** -+ * ice_get_max_txq - return the maximum number of Tx queues for in a PF -+ * @pf: PF structure -+ * -+ * Return: maximum number of Tx queues -+ */ -+static inline int ice_get_max_txq(struct ice_pf *pf) -+{ -+ return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq); -+} -+ -+/** -+ * ice_get_max_rxq - return the maximum number of Rx queues for in a PF -+ * @pf: PF structure -+ * -+ * Return: maximum number of Rx queues -+ */ -+static inline int ice_get_max_rxq(struct ice_pf *pf) -+{ -+ return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq); -+} -+ - /** - * ice_get_main_vsi - Get the PF VSI - * @pf: PF instance -diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c -index 912d800..db6adaa 100644 ---- a/drivers/net/ethernet/intel/ice/ice_ethtool.c -+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c -@@ -3744,24 +3744,6 @@ ice_get_ts_info(struct net_device *dev, struct kernel_ethtool_ts_info *info) - return 0; - } - --/** -- * ice_get_max_txq - return the maximum number of Tx queues for in a PF -- * @pf: PF structure -- */ --static int ice_get_max_txq(struct ice_pf *pf) --{ -- return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_txq); --} -- --/** -- * ice_get_max_rxq - return the maximum number of Rx queues for in a PF -- * @pf: PF structure -- */ --static int ice_get_max_rxq(struct ice_pf *pf) --{ -- return min(num_online_cpus(), pf->hw.func_caps.common_cap.num_rxq); --} -- - /** - * ice_get_combined_cnt - return the current number of combined channels - * @vsi: PF VSI pointer -diff --git a/drivers/net/ethernet/intel/ice/ice_irq.c b/drivers/net/ethernet/intel/ice/ice_irq.c -index 30801fd..4766951 100644 ---- a/drivers/net/ethernet/intel/ice/ice_irq.c -+++ b/drivers/net/ethernet/intel/ice/ice_irq.c -@@ -4,6 +4,7 @@ - #include "ice.h" - #include "ice_lib.h" - #include "ice_irq.h" -+#include "ice_rh.h" - - /** - * ice_init_irq_tracker - initialize interrupt tracker -@@ -106,9 +107,10 @@ static struct ice_irq_entry *ice_get_irq_res(struct ice_pf *pf, - #define ICE_RDMA_AEQ_MSIX 1 - static int ice_get_default_msix_amount(struct ice_pf *pf) - { -- return ICE_MIN_LAN_OICR_MSIX + num_online_cpus() + -+ return ICE_MIN_LAN_OICR_MSIX + ice_rh_get_num_default_rss_queues() + - (test_bit(ICE_FLAG_FD_ENA, pf->flags) ? ICE_FDIR_MSIX : 0) + -- (ice_is_rdma_ena(pf) ? num_online_cpus() + ICE_RDMA_AEQ_MSIX : 0); -+ (ice_is_rdma_ena(pf) ? ice_rh_get_num_default_rss_queues() + -+ ICE_RDMA_AEQ_MSIX : 0); - } - - /** -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index d668806..72c91bd 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -9,6 +9,7 @@ - #include "ice_dcb_lib.h" - #include "ice_type.h" - #include "ice_vsi_vlan_ops.h" -+#include "ice_rh.h" - - /** - * ice_vsi_type_str - maps VSI type enum to string equivalents -@@ -159,12 +160,14 @@ static void ice_vsi_set_num_desc(struct ice_vsi *vsi) - - static u16 ice_get_rxq_count(struct ice_pf *pf) - { -- return min(ice_get_avail_rxq_count(pf), num_online_cpus()); -+ return min(ice_get_avail_rxq_count(pf), -+ ice_rh_get_num_default_rss_queues()); - } - - static u16 ice_get_txq_count(struct ice_pf *pf) - { -- return min(ice_get_avail_txq_count(pf), num_online_cpus()); -+ return min(ice_get_avail_txq_count(pf), -+ ice_rh_get_num_default_rss_queues()); - } - - /** -@@ -911,13 +914,15 @@ static void ice_vsi_set_rss_params(struct ice_vsi *vsi) - if (vsi->type == ICE_VSI_CHNL) - vsi->rss_size = min_t(u16, vsi->num_rxq, max_rss_size); - else -- vsi->rss_size = min_t(u16, num_online_cpus(), -+ vsi->rss_size = min_t(u16, -+ ice_rh_get_num_default_rss_queues(), - max_rss_size); - vsi->rss_lut_type = ICE_LUT_PF; - break; - case ICE_VSI_SF: - vsi->rss_table_size = ICE_LUT_VSI_SIZE; -- vsi->rss_size = min_t(u16, num_online_cpus(), max_rss_size); -+ vsi->rss_size = min_t(u16, ice_rh_get_num_default_rss_queues(), -+ max_rss_size); - vsi->rss_lut_type = ICE_LUT_VSI; - break; - case ICE_VSI_VF: -@@ -3007,7 +3012,7 @@ ice_vsi_rebuild_set_coalesce(struct ice_vsi *vsi, - * ice_vsi_realloc_stat_arrays - Frees unused stat structures or alloc new ones - * @vsi: VSI pointer - */ --static int -+int - ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi) - { - u16 req_txq = vsi->req_txq ? vsi->req_txq : vsi->alloc_txq; -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.h b/drivers/net/ethernet/intel/ice/ice_lib.h -index 2cb1eb9..fce6f63 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.h -+++ b/drivers/net/ethernet/intel/ice/ice_lib.h -@@ -66,6 +66,7 @@ int ice_ena_vsi(struct ice_vsi *vsi, bool locked); - void ice_vsi_decfg(struct ice_vsi *vsi); - void ice_dis_vsi(struct ice_vsi *vsi, bool locked); - -+int ice_vsi_realloc_stat_arrays(struct ice_vsi *vsi); - int ice_vsi_rebuild(struct ice_vsi *vsi, u32 vsi_flags); - int ice_vsi_cfg(struct ice_vsi *vsi); - struct ice_vsi *ice_vsi_alloc(struct ice_pf *pf); -diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c -index 6b1e6ee..38356f6 100644 ---- a/drivers/net/ethernet/intel/ice/ice_main.c -+++ b/drivers/net/ethernet/intel/ice/ice_main.c -@@ -4730,8 +4730,8 @@ static int ice_cfg_netdev(struct ice_vsi *vsi) - struct net_device *netdev; - u8 mac_addr[ETH_ALEN]; - -- netdev = alloc_etherdev_mqs(sizeof(*np), vsi->alloc_txq, -- vsi->alloc_rxq); -+ netdev = alloc_etherdev_mqs(sizeof(*np), ice_get_max_txq(vsi->back), -+ ice_get_max_rxq(vsi->back)); - if (!netdev) - return -ENOMEM; - -diff --git a/drivers/net/ethernet/intel/ice/ice_rh.c b/drivers/net/ethernet/intel/ice/ice_rh.c -new file mode 100644 -index 0000000..7660eee ---- /dev/null -+++ b/drivers/net/ethernet/intel/ice/ice_rh.c -@@ -0,0 +1,33 @@ -+#include -+#include -+#include -+#include -+#include -+ -+#include "ice_rh.h" -+ -+/** -+ * ice_rh_get_num_default_rss_queues - default number of RSS queues -+ * -+ * Default value is the number of physical cores if there are only 1 or 2, or -+ * divided by 2 if there are more. -+ * -+ * This is a renamed copy of netif_get_num_default_rss_queues() from upstream. -+ */ -+int ice_rh_get_num_default_rss_queues(void) -+{ -+ cpumask_var_t cpus; -+ int cpu, count = 0; -+ -+ if (unlikely(is_kdump_kernel() || !zalloc_cpumask_var(&cpus, GFP_KERNEL))) -+ return 1; -+ -+ cpumask_copy(cpus, cpu_online_mask); -+ for_each_cpu(cpu, cpus) { -+ ++count; -+ cpumask_andnot(cpus, cpus, topology_sibling_cpumask(cpu)); -+ } -+ free_cpumask_var(cpus); -+ -+ return count > 2 ? DIV_ROUND_UP(count, 2) : count; -+} -diff --git a/drivers/net/ethernet/intel/ice/ice_rh.h b/drivers/net/ethernet/intel/ice/ice_rh.h -new file mode 100644 -index 0000000..d88e00a ---- /dev/null -+++ b/drivers/net/ethernet/intel/ice/ice_rh.h -@@ -0,0 +1,6 @@ -+#ifndef __ICE_RH_H -+#define __ICE_RH_H -+ -+int ice_rh_get_num_default_rss_queues(void); -+ -+#endif -diff --git a/drivers/net/ethernet/intel/ice/ice_vf_lib.c b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -index e53a1e4..08e3e26 100644 ---- a/drivers/net/ethernet/intel/ice/ice_vf_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_vf_lib.c -@@ -268,6 +268,13 @@ static int ice_vf_reconfig_vsi(struct ice_vf *vf) - - vsi->flags = ICE_VSI_FLAG_NO_INIT; - -+ vsi->req_txq = vf->num_req_qs; -+ vsi->req_rxq = vf->num_req_qs; -+ -+ err = ice_vsi_realloc_stat_arrays(vsi); -+ if (err) -+ return err; -+ - ice_vsi_decfg(vsi); - ice_fltr_remove_all(vsi); - diff --git a/SOURCES/1285-xen-privcmd-fix-double-free-via-vma-splitting.patch b/SOURCES/1285-xen-privcmd-fix-double-free-via-vma-splitting.patch deleted file mode 100644 index bbefc28bf..000000000 --- a/SOURCES/1285-xen-privcmd-fix-double-free-via-vma-splitting.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 2b985d3a024b9e8c24e21671b34e855569763808 Mon Sep 17 00:00:00 2001 -From: Juergen Gross -Date: Fri, 10 Apr 2026 09:20:04 +0200 -Subject: [PATCH] xen/privcmd: fix double free via VMA splitting - -commit 24daca4fc07f3ff8cd0e3f629cd982187f48436a upstream. - -privcmd_vm_ops defines .close (privcmd_close), but neither .may_split -nor .open. When userspace does a partial munmap() on a privcmd mapping, -the kernel splits the VMA via __split_vma(). Since may_split is NULL, -the split is allowed. vm_area_dup() copies vm_private_data (a pages -array allocated in alloc_empty_pages()) into the new VMA without any -fixup, because there is no .open callback. - -Both VMAs now point to the same pages array. When the unmapped portion -is closed, privcmd_close() calls: - - xen_unmap_domain_gfn_range() - - xen_free_unpopulated_pages() - - kvfree(pages) - -The surviving VMA still holds the dangling pointer. When it is later -destroyed, the same sequence runs again, which leads to a double free. - -Fix this issue by adding a .may_split callback denying the VMA split. - -This is XSA-487 / CVE-2026-31787 - -Fixes: d71f513985c2 ("xen: privcmd: support autotranslated physmap guests.") -Reported-by: Atharva Vartak -Suggested-by: Atharva Vartak -Signed-off-by: Juergen Gross -Reviewed-by: Jan Beulich -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c -index 8d0f4f2..a867792 100644 ---- a/drivers/xen/privcmd.c -+++ b/drivers/xen/privcmd.c -@@ -914,6 +914,12 @@ static void privcmd_close(struct vm_area_struct *vma) - kfree(pages); - } - -+static int privcmd_may_split(struct vm_area_struct *area, unsigned long addr) -+{ -+ /* Forbid splitting, avoids double free via privcmd_close(). */ -+ return -EINVAL; -+} -+ - static vm_fault_t privcmd_fault(struct vm_fault *vmf) - { - printk(KERN_DEBUG "privcmd_fault: vma=%p %lx-%lx, pgoff=%lx, uv=%p\n", -@@ -925,6 +931,7 @@ static vm_fault_t privcmd_fault(struct vm_fault *vmf) - - static const struct vm_operations_struct privcmd_vm_ops = { - .close = privcmd_close, -+ .may_split = privcmd_may_split, - .fault = privcmd_fault - }; - diff --git a/SOURCES/1286-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch b/SOURCES/1286-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch deleted file mode 100644 index 580f5bc10..000000000 --- a/SOURCES/1286-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 3eefd9e9213a567e4b2121832ee201264486407c Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 1 May 2026 23:14:11 +0000 -Subject: [PATCH] Bluetooth: hci_sync: fix stack buffer overflow in - hci_le_big_create_sync -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-172859 -CVE: CVE-2026-31772 - -commit bc39a094730ce062fa034a529c93147c096cb488 -Author: hkbinbin -Date: Tue Mar 31 05:39:16 2026 +0000 - - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync - - hci_le_big_create_sync() uses DEFINE_FLEX to allocate a - struct hci_cp_le_big_create_sync on the stack with room for 0x11 (17) - BIS entries. However, conn->num_bis can hold up to HCI_MAX_ISO_BIS (31) - entries — validated against ISO_MAX_NUM_BIS (0x1f) in the caller - hci_conn_big_create_sync(). When conn->num_bis is between 18 and 31, - the memcpy that copies conn->bis into cp->bis writes up to 14 bytes - past the stack buffer, corrupting adjacent stack memory. - - This is trivially reproducible: binding an ISO socket with - bc_num_bis = ISO_MAX_NUM_BIS (31) and calling listen() will - eventually trigger hci_le_big_create_sync() from the HCI command - sync worker, causing a KASAN-detectable stack-out-of-bounds write: - - BUG: KASAN: stack-out-of-bounds in hci_le_big_create_sync+0x256/0x3b0 - Write of size 31 at addr ffffc90000487b48 by task kworker/u9:0/71 - - Fix this by changing the DEFINE_FLEX count from the incorrect 0x11 to - HCI_MAX_ISO_BIS, which matches the maximum number of BIS entries that - conn->bis can actually carry. - - Fixes: 42ecf1947135 ("Bluetooth: ISO: Do not emit LE BIG Create Sync if previous is pending") - Cc: stable@vger.kernel.org - Signed-off-by: hkbinbin - Reviewed-by: Paul Menzel - Signed-off-by: Luiz Augusto von Dentz - -Signed-off-by: CKI Backport Bot - -diff --git a/net/bluetooth/hci_sync.c b/net/bluetooth/hci_sync.c -index e302afc..b571278 100644 ---- a/net/bluetooth/hci_sync.c -+++ b/net/bluetooth/hci_sync.c -@@ -7126,7 +7126,8 @@ static void create_big_complete(struct hci_dev *hdev, void *data, int err) - - static int hci_le_big_create_sync(struct hci_dev *hdev, void *data) - { -- DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 0x11); -+ DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, -+ HCI_MAX_ISO_BIS); - struct hci_conn *conn = data; - struct bt_iso_qos *qos = &conn->iso_qos; - int err; diff --git a/SOURCES/1287-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch b/SOURCES/1287-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch deleted file mode 100644 index 202bc1c83..000000000 --- a/SOURCES/1287-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 424e95d62110cdbc8fd12b40918f37e408e35a92 Mon Sep 17 00:00:00 2001 -From: Oliver Hartkopp -Date: Thu, 19 Mar 2026 16:47:45 +0100 -Subject: [PATCH] can: isotp: fix tx.buf use-after-free in isotp_sendmsg() - -isotp_sendmsg() uses only cmpxchg() on so->tx.state to serialize access -to so->tx.buf. isotp_release() waits for ISOTP_IDLE via -wait_event_interruptible() and then calls kfree(so->tx.buf). - -If a signal interrupts the wait_event_interruptible() inside close() -while tx.state is ISOTP_SENDING, the loop exits early and release -proceeds to force ISOTP_SHUTDOWN and continues to kfree(so->tx.buf) -while sendmsg may still be reading so->tx.buf for the final CAN frame -in isotp_fill_dataframe(). - -The so->tx.buf can be allocated once when the standard tx.buf length needs -to be extended. Move the kfree() of this potentially extended tx.buf to -sk_destruct time when either isotp_sendmsg() and isotp_release() are done. - -Fixes: 96d1c81e6a04 ("can: isotp: add module parameter for maximum pdu size") -Cc: stable@vger.kernel.org -Reported-by: Ali Norouzi -Co-developed-by: Ali Norouzi -Signed-off-by: Ali Norouzi -Signed-off-by: Oliver Hartkopp -Link: https://patch.msgid.link/20260319-fix-can-gw-and-can-isotp-v2-2-c45d52c6d2d8@pengutronix.de -Signed-off-by: Marc Kleine-Budde - -diff --git a/net/can/isotp.c b/net/can/isotp.c -index 7363470..311f0af 100644 ---- a/net/can/isotp.c -+++ b/net/can/isotp.c -@@ -1229,12 +1229,6 @@ static int isotp_release(struct socket *sock) - so->ifindex = 0; - so->bound = 0; - -- if (so->rx.buf != so->rx.sbuf) -- kfree(so->rx.buf); -- -- if (so->tx.buf != so->tx.sbuf) -- kfree(so->tx.buf); -- - sock_orphan(sk); - sock->sk = NULL; - -@@ -1602,6 +1596,21 @@ static int isotp_notifier(struct notifier_block *nb, unsigned long msg, - return NOTIFY_DONE; - } - -+static void isotp_sock_destruct(struct sock *sk) -+{ -+ struct isotp_sock *so = isotp_sk(sk); -+ -+ /* do the standard CAN sock destruct work */ -+ can_sock_destruct(sk); -+ -+ /* free potential extended PDU buffers */ -+ if (so->rx.buf != so->rx.sbuf) -+ kfree(so->rx.buf); -+ -+ if (so->tx.buf != so->tx.sbuf) -+ kfree(so->tx.buf); -+} -+ - static int isotp_init(struct sock *sk) - { - struct isotp_sock *so = isotp_sk(sk); -@@ -1648,6 +1657,9 @@ static int isotp_init(struct sock *sk) - list_add_tail(&so->notifier, &isotp_notifier_list); - spin_unlock(&isotp_notifier_lock); - -+ /* re-assign default can_sock_destruct() reference */ -+ sk->sk_destruct = isotp_sock_destruct; -+ - return 0; - } - diff --git a/SOURCES/1288-dpll-add-pin-operational-state.patch b/SOURCES/1288-dpll-add-pin-operational-state.patch deleted file mode 100644 index e3e414737..000000000 --- a/SOURCES/1288-dpll-add-pin-operational-state.patch +++ /dev/null @@ -1,279 +0,0 @@ -From 781c8893a5da8522ae4ded93e5ef3adbe9559300 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Tue, 28 Apr 2026 17:49:06 +0200 -Subject: [PATCH] dpll: add pin operational state - -Add pin-operstate enum and operstate_on_dpll_get callback to report -the actual hardware status of a pin with respect to its parent DPLL -device. Unlike pin-state (which reflects administrative intent set -by the user), operstate reflects what the hardware is actually doing. - -Defined operational states: - - active: pin is qualified and actively used by the DPLL - - standby: pin is qualified but not actively used by the DPLL - - no-signal: pin does not have a valid signal - - qual-failed: pin signal failed qualification - -The operstate is reported inside the pin-parent-device nested -attribute alongside the existing state and phase-offset attributes. - -Signed-off-by: Ivan Vecera -Reviewed-by: Jiri Pirko -Reviewed-by: Vadim Fedorenko -Reviewed-by: Petr Oros -Link: https://patch.msgid.link/20260428154907.2820654-2-ivecera@redhat.com -Signed-off-by: Paolo Abeni - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 93c191b..37eaef7 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -65,35 +65,43 @@ request, where user provides attributes that result in single pin match. - Pin selection - ============= - --In general, selected pin (the one which signal is driving the dpll --device) can be obtained from ``DPLL_A_PIN_STATE`` attribute, and only --one pin shall be in ``DPLL_PIN_STATE_CONNECTED`` state for any dpll --device. -+Pin state (``DPLL_A_PIN_STATE``) reflects the administrative intent set -+by the user. Pin operational state (``DPLL_A_PIN_OPERSTATE``) reflects -+what the hardware is actually doing with the pin. - - Pin selection can be done either manually or automatically, depending - on hardware capabilities and active dpll device work mode - (``DPLL_A_MODE`` attribute). The consequence is that there are --differences for each mode in terms of available pin states, as well as --for the states the user can request for a dpll device. -+differences for each mode in terms of available pin states the user can -+request for a dpll device. - --In manual mode (``DPLL_MODE_MANUAL``) the user can request or receive --one of following pin states: -+In manual mode (``DPLL_MODE_MANUAL``) the user can request one of -+following pin states: - --- ``DPLL_PIN_STATE_CONNECTED`` - the pin is used to drive dpll device --- ``DPLL_PIN_STATE_DISCONNECTED`` - the pin is not used to drive dpll -+- ``DPLL_PIN_STATE_CONNECTED`` - the pin is selected to drive dpll - device -+- ``DPLL_PIN_STATE_DISCONNECTED`` - the pin is not selected to drive -+ dpll device - --In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can request or --receive one of following pin states: -+In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can request one of -+following pin states: - - - ``DPLL_PIN_STATE_SELECTABLE`` - the pin shall be considered as valid - input for automatic selection algorithm - - ``DPLL_PIN_STATE_DISCONNECTED`` - the pin shall be not considered as - a valid input for automatic selection algorithm - --In automatic mode (``DPLL_MODE_AUTOMATIC``) the user can only receive --pin state ``DPLL_PIN_STATE_CONNECTED`` once automatic selection --algorithm locks a dpll device with one of the inputs. -+The actual hardware status of a pin is reported via the operational -+state (``DPLL_A_PIN_OPERSTATE``) attribute nested under the parent -+device: -+ -+- ``DPLL_PIN_OPERSTATE_ACTIVE`` - pin is qualified and actively used -+ by the DPLL -+- ``DPLL_PIN_OPERSTATE_STANDBY`` - pin is qualified but not actively -+ used by the DPLL -+- ``DPLL_PIN_OPERSTATE_NO_SIGNAL`` - pin does not have a valid signal -+- ``DPLL_PIN_OPERSTATE_QUAL_FAILED`` - pin signal failed qualification -+ checks - - Shared pins - =========== -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index cb5da35..a47d7da 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -212,6 +212,27 @@ definitions: - name: selectable - doc: pin enabled for automatic input selection - render-max: true -+ - -+ type: enum -+ name: pin-operstate -+ doc: | -+ defines possible operational states of a pin with respect to its -+ parent DPLL device, valid values for DPLL_A_PIN_OPERSTATE attribute -+ entries: -+ - -+ name: active -+ doc: pin is qualified and actively used by the DPLL -+ value: 1 -+ - -+ name: standby -+ doc: pin is qualified but not actively used by the DPLL -+ - -+ name: no-signal -+ doc: pin does not have a valid signal -+ - -+ name: qual-failed -+ doc: pin signal failed qualification (e.g. frequency or phase monitor) -+ render-max: true - - - type: flags - name: pin-capabilities -@@ -488,6 +509,14 @@ attribute-sets: - Value of (DPLL_A_PIN_MEASURED_FREQUENCY % - DPLL_PIN_MEASURED_FREQUENCY_DIVIDER) is a fractional part - of a measured frequency value. -+ - -+ name: operstate -+ type: u32 -+ enum: pin-operstate -+ doc: | -+ Operational state of the pin with respect to its parent DPLL -+ device. Unlike state (which reflects the administrative intent), -+ operstate reflects the actual hardware status. - - - - name: pin-parent-device -@@ -501,6 +530,8 @@ attribute-sets: - name: prio - - - name: state -+ - -+ name: operstate - - - name: phase-offset - - -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index 0ff1658..ea63602 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -324,6 +324,30 @@ dpll_msg_add_pin_on_dpll_state(struct sk_buff *msg, struct dpll_pin *pin, - return 0; - } - -+static int -+dpll_msg_add_pin_operstate(struct sk_buff *msg, struct dpll_pin *pin, -+ struct dpll_pin_ref *ref, -+ struct netlink_ext_ack *extack) -+{ -+ const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -+ struct dpll_device *dpll = ref->dpll; -+ enum dpll_pin_operstate operstate; -+ int ret; -+ -+ if (!ops->operstate_on_dpll_get) -+ return 0; -+ ret = ops->operstate_on_dpll_get(pin, -+ dpll_pin_on_dpll_priv(dpll, pin), -+ dpll, dpll_priv(dpll), -+ &operstate, extack); -+ if (ret) -+ return ret; -+ if (nla_put_u32(msg, DPLL_A_PIN_OPERSTATE, operstate)) -+ return -EMSGSIZE; -+ -+ return 0; -+} -+ - static int - dpll_msg_add_pin_direction(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, -@@ -650,6 +674,9 @@ dpll_msg_add_pin_dplls(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - goto nest_cancel; - ret = dpll_msg_add_pin_on_dpll_state(msg, pin, ref, extack); -+ if (ret) -+ goto nest_cancel; -+ ret = dpll_msg_add_pin_operstate(msg, pin, ref, extack); - if (ret) - goto nest_cancel; - ret = dpll_msg_add_pin_prio(msg, pin, ref, extack); -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index da92aa8..6439884 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -11,11 +11,12 @@ - #include - - /* Common nested types */ --const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_PHASE_OFFSET + 1] = { -+const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + 1] = { - [DPLL_A_PIN_PARENT_ID] = { .type = NLA_U32, }, - [DPLL_A_PIN_DIRECTION] = NLA_POLICY_RANGE(NLA_U32, 1, 2), - [DPLL_A_PIN_PRIO] = { .type = NLA_U32, }, - [DPLL_A_PIN_STATE] = NLA_POLICY_RANGE(NLA_U32, 1, 3), -+ [DPLL_A_PIN_OPERSTATE] = NLA_POLICY_RANGE(NLA_U32, 1, 4), - [DPLL_A_PIN_PHASE_OFFSET] = { .type = NLA_S64, }, - }; - -diff --git a/drivers/dpll/dpll_nl.h b/drivers/dpll/dpll_nl.h -index 3da10cf..8cf3b73 100644 ---- a/drivers/dpll/dpll_nl.h -+++ b/drivers/dpll/dpll_nl.h -@@ -12,7 +12,7 @@ - #include - - /* Common nested types */ --extern const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_PHASE_OFFSET + 1]; -+extern const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + 1]; - extern const struct nla_policy dpll_pin_parent_pin_nl_policy[DPLL_A_PIN_STATE + 1]; - extern const struct nla_policy dpll_reference_sync_nl_policy[DPLL_A_PIN_STATE + 1]; - -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index 7f8fa58..c5e333a 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -96,6 +96,12 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, - void *dpll_priv, enum dpll_pin_state *state, - struct netlink_ext_ack *extack); -+ int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack); - int (*state_on_pin_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_pin *parent_pin, - void *parent_pin_priv, -diff --git a/include/uapi/linux/dpll.h b/include/uapi/linux/dpll.h -index 93614cc..aa45b79 100644 ---- a/include/uapi/linux/dpll.h -+++ b/include/uapi/linux/dpll.h -@@ -177,6 +177,28 @@ enum dpll_pin_state { - DPLL_PIN_STATE_MAX = (__DPLL_PIN_STATE_MAX - 1) - }; - -+/** -+ * enum dpll_pin_operstate - defines possible operational states of a pin with -+ * respect to its parent DPLL device, valid values for DPLL_A_PIN_OPERSTATE -+ * attribute -+ * @DPLL_PIN_OPERSTATE_ACTIVE: pin is qualified and actively used by the DPLL -+ * @DPLL_PIN_OPERSTATE_STANDBY: pin is qualified but not actively used by the -+ * DPLL -+ * @DPLL_PIN_OPERSTATE_NO_SIGNAL: pin does not have a valid signal -+ * @DPLL_PIN_OPERSTATE_QUAL_FAILED: pin signal failed qualification (e.g. -+ * frequency or phase monitor) -+ */ -+enum dpll_pin_operstate { -+ DPLL_PIN_OPERSTATE_ACTIVE = 1, -+ DPLL_PIN_OPERSTATE_STANDBY, -+ DPLL_PIN_OPERSTATE_NO_SIGNAL, -+ DPLL_PIN_OPERSTATE_QUAL_FAILED, -+ -+ /* private: */ -+ __DPLL_PIN_OPERSTATE_MAX, -+ DPLL_PIN_OPERSTATE_MAX = (__DPLL_PIN_OPERSTATE_MAX - 1) -+}; -+ - /** - * enum dpll_pin_capabilities - defines possible capabilities of a pin, valid - * flags on DPLL_A_PIN_CAPABILITIES attribute -@@ -256,6 +278,7 @@ enum dpll_a_pin { - DPLL_A_PIN_PHASE_ADJUST_GRAN, - DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, - DPLL_A_PIN_MEASURED_FREQUENCY, -+ DPLL_A_PIN_OPERSTATE, - - __DPLL_A_PIN_MAX, - DPLL_A_PIN_MAX = (__DPLL_A_PIN_MAX - 1) diff --git a/SOURCES/1289-dpll-zl3073x-implement-pin-operational-state-reporting.patch b/SOURCES/1289-dpll-zl3073x-implement-pin-operational-state-reporting.patch deleted file mode 100644 index 1ebd88503..000000000 --- a/SOURCES/1289-dpll-zl3073x-implement-pin-operational-state-reporting.patch +++ /dev/null @@ -1,239 +0,0 @@ -From c53f8f8dce776e032b1a11fb4d9b6e12bb63d958 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Tue, 28 Apr 2026 17:49:07 +0200 -Subject: [PATCH] dpll: zl3073x: implement pin operational state reporting - -Implement operstate_on_dpll_get callback for input pins to report -the actual hardware status: - - - active: pin is the currently locked reference - - standby: signal is valid but pin is not actively used - - no-signal: reference monitor reports Loss of Signal (LOS) - - qual-failed: reference monitor reports a qualification failure - (SCM, CFM, GST, PFM, eSync or Split-XO) - -Separate administrative state (state_on_dpll_get) from operational -state: admin state now reports purely the user-requested intent -(connected in reflock mode, selectable in auto mode). - -Switch periodic monitoring to track operstate changes instead of -the mixed admin/oper state that was previously reported. - -Add ref_mon_status bit definitions to regs.h. - -Signed-off-by: Ivan Vecera -Reviewed-by: Petr Oros -Link: https://patch.msgid.link/20260428154907.2820654-3-ivecera@redhat.com -Signed-off-by: Paolo Abeni - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 55195dc..2c8bd21 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -38,7 +38,7 @@ - * @prio: pin priority <0, 14> - * @esync_control: embedded sync is controllable - * @phase_gran: phase adjustment granularity -- * @pin_state: last saved pin state -+ * @operstate: last saved operational state - * @phase_offset: last saved pin phase offset - * @freq_offset: last saved fractional frequency offset - * @measured_freq: last saved measured frequency -@@ -55,7 +55,7 @@ struct zl3073x_dpll_pin { - u8 prio; - bool esync_control; - s32 phase_gran; -- enum dpll_pin_state pin_state; -+ enum dpll_pin_operstate operstate; - s64 phase_offset; - s64 freq_offset; - u32 measured_freq; -@@ -500,46 +500,41 @@ zl3073x_dpll_input_pin_phase_adjust_set(const struct dpll_pin *dpll_pin, - } - - /** -- * zl3073x_dpll_ref_state_get - get status for given input pin -+ * zl3073x_dpll_ref_operstate_get - get operational state for input pin - * @pin: pointer to pin -- * @state: place to store status -+ * @operstate: place to store operational state - * -- * Checks current status for the given input pin and stores the value -- * to @state. -+ * Returns the actual hardware state of the pin: whether it is actively -+ * used by the DPLL, has no signal, failed qualification, or is simply -+ * not in use. - * - * Return: 0 on success, <0 on error - */ - static int --zl3073x_dpll_ref_state_get(struct zl3073x_dpll_pin *pin, -- enum dpll_pin_state *state) -+zl3073x_dpll_ref_operstate_get(struct zl3073x_dpll_pin *pin, -+ enum dpll_pin_operstate *operstate) - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -- const struct zl3073x_chan *chan; -- u8 ref; -- -- chan = zl3073x_chan_state_get(zldev, zldpll->id); -- ref = zl3073x_input_pin_ref_get(pin->id); -+ const struct zl3073x_ref *ref; -+ u8 ref_id; - -- /* Check if the pin reference is connected */ -- if (ref == zl3073x_dpll_connected_ref_get(zldpll)) { -- *state = DPLL_PIN_STATE_CONNECTED; -- return 0; -- } -+ ref_id = zl3073x_input_pin_ref_get(pin->id); - -- /* If the DPLL is running in automatic mode and the reference is -- * selectable and its monitor does not report any error then report -- * pin as selectable. -- */ -- if (zl3073x_chan_mode_get(chan) == ZL_DPLL_MODE_REFSEL_MODE_AUTO && -- zl3073x_dev_ref_is_status_ok(zldev, ref) && -- zl3073x_chan_ref_is_selectable(chan, ref)) { -- *state = DPLL_PIN_STATE_SELECTABLE; -+ /* Check if this pin is the currently locked reference */ -+ if (ref_id == zl3073x_dpll_connected_ref_get(zldpll)) { -+ *operstate = DPLL_PIN_OPERSTATE_ACTIVE; - return 0; - } - -- /* Otherwise report the pin as disconnected */ -- *state = DPLL_PIN_STATE_DISCONNECTED; -+ /* Check reference monitor status */ -+ ref = zl3073x_ref_state_get(zldev, ref_id); -+ if (ref->mon_status & ZL_REF_MON_STATUS_LOS) -+ *operstate = DPLL_PIN_OPERSTATE_NO_SIGNAL; -+ else if (!zl3073x_ref_is_status_ok(ref)) -+ *operstate = DPLL_PIN_OPERSTATE_QUAL_FAILED; -+ else -+ *operstate = DPLL_PIN_OPERSTATE_STANDBY; - - return 0; - } -@@ -551,10 +546,48 @@ zl3073x_dpll_input_pin_state_on_dpll_get(const struct dpll_pin *dpll_pin, - void *dpll_priv, - enum dpll_pin_state *state, - struct netlink_ext_ack *extack) -+{ -+ struct zl3073x_dpll *zldpll = dpll_priv; -+ struct zl3073x_dpll_pin *pin = pin_priv; -+ const struct zl3073x_chan *chan; -+ u8 mode, ref; -+ -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ref = zl3073x_input_pin_ref_get(pin->id); -+ mode = zl3073x_chan_mode_get(chan); -+ -+ switch (mode) { -+ case ZL_DPLL_MODE_REFSEL_MODE_REFLOCK: -+ if (ref == zl3073x_chan_ref_get(chan)) -+ *state = DPLL_PIN_STATE_CONNECTED; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ case ZL_DPLL_MODE_REFSEL_MODE_AUTO: -+ if (zl3073x_chan_ref_is_selectable(chan, ref)) -+ *state = DPLL_PIN_STATE_SELECTABLE; -+ else -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ default: -+ *state = DPLL_PIN_STATE_DISCONNECTED; -+ break; -+ } -+ -+ return 0; -+} -+ -+static int -+zl3073x_dpll_input_pin_operstate_on_dpll_get(const struct dpll_pin *dpll_pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack) - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- return zl3073x_dpll_ref_state_get(pin, state); -+ return zl3073x_dpll_ref_operstate_get(pin, operstate); - } - - static int -@@ -1248,6 +1281,7 @@ static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { - .frequency_get = zl3073x_dpll_input_pin_frequency_get, - .frequency_set = zl3073x_dpll_input_pin_frequency_set, - .measured_freq_get = zl3073x_dpll_input_pin_measured_freq_get, -+ .operstate_on_dpll_get = zl3073x_dpll_input_pin_operstate_on_dpll_get, - .phase_offset_get = zl3073x_dpll_input_pin_phase_offset_get, - .phase_adjust_get = zl3073x_dpll_input_pin_phase_adjust_get, - .phase_adjust_set = zl3073x_dpll_input_pin_phase_adjust_set, -@@ -1663,7 +1697,7 @@ zl3073x_dpll_pin_phase_offset_check(struct zl3073x_dpll_pin *pin) - * 2) For other pins use appropriate ref_phase register if the phase - * monitor feature is enabled. - */ -- if (pin->pin_state == DPLL_PIN_STATE_CONNECTED) -+ if (pin->operstate == DPLL_PIN_OPERSTATE_ACTIVE) - reg = ZL_REG_DPLL_PHASE_ERR_DATA(zldpll->id); - else if (zldpll->phase_monitor) - reg = ZL_REG_REF_PHASE(ref_id); -@@ -1828,7 +1862,7 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - } - - list_for_each_entry(pin, &zldpll->pins, list) { -- enum dpll_pin_state state; -+ enum dpll_pin_operstate operstate; - bool pin_changed = false; - - /* Output pins change checks are not necessary because output -@@ -1837,18 +1871,18 @@ zl3073x_dpll_changes_check(struct zl3073x_dpll *zldpll) - if (!zl3073x_dpll_is_input_pin(pin)) - continue; - -- rc = zl3073x_dpll_ref_state_get(pin, &state); -+ rc = zl3073x_dpll_ref_operstate_get(pin, &operstate); - if (rc) { - dev_err(dev, -- "Failed to get %s on DPLL%u state: %pe\n", -+ "Failed to get %s on DPLL%u oper state: %pe\n", - pin->label, zldpll->id, ERR_PTR(rc)); - return; - } - -- if (state != pin->pin_state) { -- dev_dbg(dev, "%s state changed: %u->%u\n", pin->label, -- pin->pin_state, state); -- pin->pin_state = state; -+ if (operstate != pin->operstate) { -+ dev_dbg(dev, "%s oper state changed: %u->%u\n", -+ pin->label, pin->operstate, operstate); -+ pin->operstate = operstate; - pin_changed = true; - } - -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index d425dc6..8015808 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -98,7 +98,14 @@ - - #define ZL_REG_REF_MON_STATUS(_idx) \ - ZL_REG_IDX(_idx, 2, 0x02, 1, ZL3073X_NUM_REFS, 1) --#define ZL_REF_MON_STATUS_OK 0 /* all bits zeroed */ -+#define ZL_REF_MON_STATUS_OK 0 -+#define ZL_REF_MON_STATUS_LOS BIT(0) -+#define ZL_REF_MON_STATUS_SCM BIT(1) -+#define ZL_REF_MON_STATUS_CFM BIT(2) -+#define ZL_REF_MON_STATUS_GST BIT(3) -+#define ZL_REF_MON_STATUS_PFM BIT(4) -+#define ZL_REF_MON_STATUS_ESYNC BIT(6) -+#define ZL_REF_MON_STATUS_SPLIT_XO BIT(7) - - #define ZL_REG_DPLL_MON_STATUS(_idx) \ - ZL_REG_IDX(_idx, 2, 0x10, 1, ZL3073X_MAX_CHANNELS, 1) diff --git a/SOURCES/1290-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch b/SOURCES/1290-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch deleted file mode 100644 index 4d6b43359..000000000 --- a/SOURCES/1290-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch +++ /dev/null @@ -1,354 +0,0 @@ -From 9c11fcb2e9a54d0f1467380831e2e4bb68f7498d Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Mon, 11 May 2026 17:58:15 +0200 -Subject: [PATCH] dpll: add fractional frequency offset to pin-parent-device - -Add both fractional-frequency-offset (PPM) and -fractional-frequency-offset-ppt (PPT) attributes to the -pin-parent-device nested attribute set, alongside the existing -top-level pin attributes. Both carry the same measurement at -different precisions. - -Introduce enum dpll_ffo_type and struct dpll_ffo_param to -distinguish FFO contexts: DPLL_FFO_PORT_RXTX_RATE for the RX vs -TX symbol rate offset reported at the top level, and -DPLL_FFO_PIN_DEVICE for the pin vs parent DPLL offset reported -in the pin-parent-device nest. - -Add a supported_ffo bitmask to struct dpll_pin_ops so drivers -declare which FFO types they support. The core only calls ffo_get -for types the driver has opted into, eliminating the need for -per-driver NULL pointer guards. Validate at pin registration time -that supported_ffo is not set without an ffo_get callback. - -Update mlx5 (DPLL_FFO_PORT_RXTX_RATE) and zl3073x -(DPLL_FFO_PORT_RXTX_RATE) drivers to use the new API. - -Add documentation for both FFO types to dpll.rst. - -Changes v3 -> v4: -- Replace dpll=NULL overloading with enum dpll_ffo_type and - struct dpll_ffo_param (Jakub Kicinski) -- Add supported_ffo opt-in bitmask in dpll_pin_ops for fail-close - driver validation (Jakub Kicinski) -- Add WARN_ON in dpll_pin_register for supported_ffo without - ffo_get callback - -Reviewed-by: Jiri Pirko -Signed-off-by: Ivan Vecera -Link: https://patch.msgid.link/20260511155816.99936-2-ivecera@redhat.com -Signed-off-by: Jakub Kicinski - -diff --git a/Documentation/driver-api/dpll.rst b/Documentation/driver-api/dpll.rst -index 37eaef7..bae1476 100644 ---- a/Documentation/driver-api/dpll.rst -+++ b/Documentation/driver-api/dpll.rst -@@ -258,6 +258,26 @@ in the ``DPLL_A_PIN_PHASE_OFFSET`` attribute. - ``DPLL_A_PHASE_OFFSET_MONITOR`` attr state of a feature - =============================== ======================== - -+Fractional frequency offset -+=========================== -+ -+The fractional frequency offset (FFO) is reported through two attributes -+that carry the same measurement at different precisions: -+ -+- ``DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET`` in PPM (parts per million) -+- ``DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT`` in PPT (parts per trillion) -+ -+Both attributes appear at the top level of a pin and inside each -+``pin-parent-device`` nest. Two FFO types are defined: -+ -+- ``DPLL_FFO_PORT_RXTX_RATE`` - RX vs TX symbol rate offset (top-level) -+- ``DPLL_FFO_PIN_DEVICE`` - pin vs parent DPLL offset (per-parent) -+ -+The driver declares which types it supports via the ``supported_ffo`` -+bitmask in ``struct dpll_pin_ops``. The core only calls the ``ffo_get`` -+callback for types the driver has opted into. The requested type is -+passed to the driver in the ``struct dpll_ffo_param``. -+ - Frequency monitor - ================= - -diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml -index a47d7da..4ba8adc 100644 ---- a/Documentation/netlink/specs/dpll.yaml -+++ b/Documentation/netlink/specs/dpll.yaml -@@ -448,12 +448,14 @@ attribute-sets: - name: fractional-frequency-offset - type: sint - doc: | -- The FFO (Fractional Frequency Offset) between the RX and TX -- symbol rate on the media associated with the pin: -- (rx_frequency-tx_frequency)/rx_frequency -+ The FFO (Fractional Frequency Offset) of the pin. -+ At top level this represents the RX vs TX symbol rate -+ offset on the media associated with the pin. Inside -+ the pin-parent-device nest it represents the frequency -+ offset between the pin and its parent DPLL device. - Value is in PPM (parts per million). -- This may be implemented for example for pin of type -- PIN_TYPE_SYNCE_ETH_PORT. -+ This is a lower-precision version of -+ fractional-frequency-offset-ppt. - - - name: esync-frequency - type: u64 -@@ -492,12 +494,14 @@ attribute-sets: - name: fractional-frequency-offset-ppt - type: sint - doc: | -- The FFO (Fractional Frequency Offset) of the pin with respect to -- the nominal frequency. -- Value = (frequency_measured - frequency_nominal) / frequency_nominal -+ The FFO (Fractional Frequency Offset) of the pin. -+ At top level this represents the RX vs TX symbol rate -+ offset on the media associated with the pin. Inside -+ the pin-parent-device nest it represents the frequency -+ offset between the pin and its parent DPLL device. - Value is in PPT (parts per trillion, 10^-12). -- Note: This attribute provides higher resolution than the standard -- fractional-frequency-offset (which is in PPM). -+ This is a higher-precision version of -+ fractional-frequency-offset. - - - name: measured-frequency - type: u64 -@@ -534,6 +538,10 @@ attribute-sets: - name: operstate - - - name: phase-offset -+ - -+ name: fractional-frequency-offset -+ - -+ name: fractional-frequency-offset-ppt - - - name: pin-parent-pin - subset-of: pin -diff --git a/drivers/dpll/dpll_core.c b/drivers/dpll/dpll_core.c -index 84e1b63..8b260a3 100644 ---- a/drivers/dpll/dpll_core.c -+++ b/drivers/dpll/dpll_core.c -@@ -883,7 +883,8 @@ dpll_pin_register(struct dpll_device *dpll, struct dpll_pin *pin, - WARN_ON(!ops->direction_get) || - WARN_ON(ops->measured_freq_get && - (!dpll_device_ops(dpll)->freq_monitor_get || -- !dpll_device_ops(dpll)->freq_monitor_set))) -+ !dpll_device_ops(dpll)->freq_monitor_set)) || -+ WARN_ON(ops->supported_ffo && !ops->ffo_get)) - return -EINVAL; - - mutex_lock(&dpll_lock); -diff --git a/drivers/dpll/dpll_netlink.c b/drivers/dpll/dpll_netlink.c -index ea63602..6a4ddd7 100644 ---- a/drivers/dpll/dpll_netlink.c -+++ b/drivers/dpll/dpll_netlink.c -@@ -417,31 +417,34 @@ dpll_msg_add_phase_offset(struct sk_buff *msg, struct dpll_pin *pin, - - static int dpll_msg_add_ffo(struct sk_buff *msg, struct dpll_pin *pin, - struct dpll_pin_ref *ref, -+ enum dpll_ffo_type type, - struct netlink_ext_ack *extack) - { - const struct dpll_pin_ops *ops = dpll_pin_ops(ref); -- struct dpll_device *dpll = ref->dpll; -- s64 ffo; -+ struct dpll_ffo_param ffo = { .type = type }; - int ret; - -- if (!ops->ffo_get) -- return 0; -- ret = ops->ffo_get(pin, dpll_pin_on_dpll_priv(dpll, pin), -- dpll, dpll_priv(dpll), &ffo, extack); -+ /* RHEL: To maintain backward compatibility with older binary modules, -+ * we must accept a value of zero for .supported_ffo when the type is -+ * DPLL_FFO_PORT_RXTX_RATE. -+ */ -+ if (!ops->ffo_get || -+ !((ops->supported_ffo & BIT(type)) || -+ (!ops->supported_ffo && type == DPLL_FFO_PORT_RXTX_RATE))) -+ return 0; -+ ret = ops->ffo_get(pin, dpll_pin_on_dpll_priv(ref->dpll, pin), -+ ref->dpll, dpll_priv(ref->dpll), &ffo, extack); - if (ret) { - if (ret == -ENODATA) - return 0; - return ret; - } -- /* Put the FFO value in PPM to preserve compatibility with older -- * programs. -- */ -- ret = nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET, -- div_s64(ffo, 1000000)); -- if (ret) -+ if (nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET, -+ div_s64(ffo.ffo, 1000000))) - return -EMSGSIZE; -- return nla_put_sint(msg, DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -- ffo); -+ return nla_put_sint(msg, -+ DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT, -+ ffo.ffo); - } - - static int dpll_msg_add_measured_freq(struct sk_buff *msg, struct dpll_pin *pin, -@@ -686,6 +689,10 @@ dpll_msg_add_pin_dplls(struct sk_buff *msg, struct dpll_pin *pin, - if (ret) - goto nest_cancel; - ret = dpll_msg_add_phase_offset(msg, pin, ref, extack); -+ if (ret) -+ goto nest_cancel; -+ ret = dpll_msg_add_ffo(msg, pin, ref, -+ DPLL_FFO_PIN_DEVICE, extack); - if (ret) - goto nest_cancel; - nla_nest_end(msg, attr); -@@ -748,7 +755,8 @@ dpll_cmd_pin_get_one(struct sk_buff *msg, struct dpll_pin *pin, - ret = dpll_msg_add_pin_phase_adjust(msg, pin, ref, extack); - if (ret) - return ret; -- ret = dpll_msg_add_ffo(msg, pin, ref, extack); -+ ret = dpll_msg_add_ffo(msg, pin, ref, -+ DPLL_FFO_PORT_RXTX_RATE, extack); - if (ret) - return ret; - ret = dpll_msg_add_measured_freq(msg, pin, ref, extack); -diff --git a/drivers/dpll/dpll_nl.c b/drivers/dpll/dpll_nl.c -index 6439884..268999d 100644 ---- a/drivers/dpll/dpll_nl.c -+++ b/drivers/dpll/dpll_nl.c -@@ -18,6 +18,8 @@ const struct nla_policy dpll_pin_parent_device_nl_policy[DPLL_A_PIN_OPERSTATE + - [DPLL_A_PIN_STATE] = NLA_POLICY_RANGE(NLA_U32, 1, 3), - [DPLL_A_PIN_OPERSTATE] = NLA_POLICY_RANGE(NLA_U32, 1, 4), - [DPLL_A_PIN_PHASE_OFFSET] = { .type = NLA_S64, }, -+ [DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET] = { .type = NLA_SINT, }, -+ [DPLL_A_PIN_FRACTIONAL_FREQUENCY_OFFSET_PPT] = { .type = NLA_SINT, }, - }; - - const struct nla_policy dpll_pin_parent_pin_nl_policy[DPLL_A_PIN_STATE + 1] = { -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index 2c8bd21..b159dff 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -295,11 +295,12 @@ zl3073x_dpll_input_pin_ref_sync_set(const struct dpll_pin *dpll_pin, - static int - zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack) -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack) - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- *ffo = pin->freq_offset; -+ ffo->ffo = pin->freq_offset; - - return 0; - } -@@ -1274,6 +1275,7 @@ zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, - } - - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { -+ .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, - .esync_set = zl3073x_dpll_input_pin_esync_set, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -index 3981dd8..3756c02 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/dpll.c -@@ -300,7 +300,8 @@ static int mlx5_dpll_state_on_dpll_set(const struct dpll_pin *pin, - - static int mlx5_dpll_ffo_get(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack) -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack) - { - struct mlx5_dpll_synce_status synce_status; - struct mlx5_dpll *mdpll = pin_priv; -@@ -309,10 +310,11 @@ static int mlx5_dpll_ffo_get(const struct dpll_pin *pin, void *pin_priv, - err = mlx5_dpll_synce_status_get(mdpll->mdev, &synce_status); - if (err) - return err; -- return mlx5_dpll_pin_ffo_get(&synce_status, ffo); -+ return mlx5_dpll_pin_ffo_get(&synce_status, &ffo->ffo); - } - - static const struct dpll_pin_ops mlx5_dpll_pins_ops = { -+ .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), - .direction_get = mlx5_dpll_pin_direction_get, - .state_on_dpll_get = mlx5_dpll_state_on_dpll_get, - .state_on_dpll_set = mlx5_dpll_state_on_dpll_set, -diff --git a/include/linux/dpll.h b/include/linux/dpll.h -index c5e333a..4a8854a 100644 ---- a/include/linux/dpll.h -+++ b/include/linux/dpll.h -@@ -71,6 +71,22 @@ struct dpll_device_ops { - RH_KABI_RESERVE(10) - }; - -+enum dpll_ffo_type { -+ DPLL_FFO_PORT_RXTX_RATE, -+ DPLL_FFO_PIN_DEVICE, -+ -+ __DPLL_FFO_TYPE_MAX, -+}; -+ -+/* RHEL: we have to keep 'ffo' field to be first to preserve compatibility -+ * with older .ffo_get() callbacks that accepts 's64 *' as parameter instead -+ * of 'struct dpll_ffo_param *' -+ */ -+struct dpll_ffo_param { -+ s64 ffo; -+ enum dpll_ffo_type type; -+}; -+ - struct dpll_pin_ops { - int (*frequency_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -@@ -96,12 +112,6 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, - void *dpll_priv, enum dpll_pin_state *state, - struct netlink_ext_ack *extack); -- int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -- void *pin_priv, -- const struct dpll_device *dpll, -- void *dpll_priv, -- enum dpll_pin_operstate *operstate, -- struct netlink_ext_ack *extack); - int (*state_on_pin_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_pin *parent_pin, - void *parent_pin_priv, -@@ -130,9 +140,13 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, void *dpll_priv, - const s32 phase_adjust, - struct netlink_ext_ack *extack); -- int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, -+ RH_KABI_REPLACE(int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, -- s64 *ffo, struct netlink_ext_ack *extack); -+ s64 *ffo, struct netlink_ext_ack *extack), -+ int (*ffo_get)(const struct dpll_pin *pin, void *pin_priv, -+ const struct dpll_device *dpll, void *dpll_priv, -+ struct dpll_ffo_param *ffo, -+ struct netlink_ext_ack *extack)) - int (*esync_set)(const struct dpll_pin *pin, void *pin_priv, - const struct dpll_device *dpll, void *dpll_priv, - u64 freq, struct netlink_ext_ack *extack); -@@ -155,8 +169,13 @@ struct dpll_pin_ops { - const struct dpll_device *dpll, - void *dpll_priv, u64 *measured_freq, - struct netlink_ext_ack *extack)) -- RH_KABI_RESERVE(2) -- RH_KABI_RESERVE(3) -+ RH_KABI_USE(2, int (*operstate_on_dpll_get)(const struct dpll_pin *pin, -+ void *pin_priv, -+ const struct dpll_device *dpll, -+ void *dpll_priv, -+ enum dpll_pin_operstate *operstate, -+ struct netlink_ext_ack *extack)) -+ RH_KABI_USE(3, unsigned long supported_ffo) - RH_KABI_RESERVE(4) - RH_KABI_RESERVE(5) - RH_KABI_RESERVE(6) diff --git a/SOURCES/1291-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch b/SOURCES/1291-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch deleted file mode 100644 index 40d929bda..000000000 --- a/SOURCES/1291-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch +++ /dev/null @@ -1,347 +0,0 @@ -From 54e65df8cf18a741745645aed7ae91514d437b43 Mon Sep 17 00:00:00 2001 -From: Ivan Vecera -Date: Mon, 11 May 2026 17:58:16 +0200 -Subject: [PATCH] dpll: zl3073x: report FFO as DPLL vs input reference offset - -Replace the per-reference frequency offset measurement (which was -redundant with measured-frequency) with a direct read of the DPLL's -delta frequency offset vs its tracked input reference. - -The new implementation uses the dpll_df_offset_x register with -ref_ofst=1 via the dpll_df_read_x semaphore mechanism. This -provides 2^-48 resolution (~3.5 fE) and reports the actual -frequency difference between the DPLL and its active input. - -Switch supported_ffo from DPLL_FFO_PORT_RXTX_RATE to -DPLL_FFO_PIN_DEVICE so FFO is reported only in the per-parent -context for the active input pin. - -Use atomic64_t for freq_offset to prevent torn reads on 32-bit -architectures between the periodic worker and netlink callbacks. - -Rewrite ffo_check to compare the cached df_offset converted to PPT -instead of using the old per-reference measurement. Remove the -ref_ffo_update periodic measurement and the ref ffo field since -they are no longer needed. - -Changes v3 -> v4: -- Switch to DPLL_FFO_PIN_DEVICE, remove dpll=NULL guard -- Use atomic64_t for freq_offset (torn read on 32-bit) - -Reviewed-by: Petr Oros -Signed-off-by: Ivan Vecera -Link: https://patch.msgid.link/20260511155816.99936-3-ivecera@redhat.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/dpll/zl3073x/chan.c b/drivers/dpll/zl3073x/chan.c -index 2f48ca2..2fe3c3d 100644 ---- a/drivers/dpll/zl3073x/chan.c -+++ b/drivers/dpll/zl3073x/chan.c -@@ -18,6 +18,7 @@ - int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) - { - struct zl3073x_chan *chan = &zldev->chan[index]; -+ u64 val; - int rc; - - rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_MON_STATUS(index), -@@ -25,8 +26,34 @@ int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index) - if (rc) - return rc; - -- return zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -- &chan->refsel_status); -+ rc = zl3073x_read_u8(zldev, ZL_REG_DPLL_REFSEL_STATUS(index), -+ &chan->refsel_status); -+ if (rc) -+ return rc; -+ -+ /* Read df_offset vs tracked reference */ -+ rc = zl3073x_poll_zero_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_write_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM | ZL_DPLL_DF_READ_REF_OFST); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_poll_zero_u8(zldev, ZL_REG_DPLL_DF_READ(index), -+ ZL_DPLL_DF_READ_SEM); -+ if (rc) -+ return rc; -+ -+ rc = zl3073x_read_u48(zldev, ZL_REG_DPLL_DF_OFFSET(index), &val); -+ if (rc) -+ return rc; -+ -+ chan->df_offset = sign_extend64(val, 47); -+ -+ return 0; - } - - /** -diff --git a/drivers/dpll/zl3073x/chan.h b/drivers/dpll/zl3073x/chan.h -index 481da21..4353809 100644 ---- a/drivers/dpll/zl3073x/chan.h -+++ b/drivers/dpll/zl3073x/chan.h -@@ -17,6 +17,7 @@ struct zl3073x_dev; - * @ref_prio: reference priority registers (4 bits per ref, P/N packed) - * @mon_status: monitor status register value - * @refsel_status: reference selection status register value -+ * @df_offset: frequency offset vs tracked reference in 2^-48 steps - */ - struct zl3073x_chan { - struct_group(cfg, -@@ -26,6 +27,7 @@ struct zl3073x_chan { - struct_group(stat, - u8 mon_status; - u8 refsel_status; -+ s64 df_offset; - ); - }; - -@@ -37,6 +39,18 @@ int zl3073x_chan_state_set(struct zl3073x_dev *zldev, u8 index, - - int zl3073x_chan_state_update(struct zl3073x_dev *zldev, u8 index); - -+/** -+ * zl3073x_chan_df_offset_get - get cached df_offset vs tracked reference -+ * @chan: pointer to channel state -+ * -+ * Return: frequency offset in 2^-48 steps -+ */ -+static inline s64 -+zl3073x_chan_df_offset_get(const struct zl3073x_chan *chan) -+{ -+ return chan->df_offset; -+} -+ - /** - * zl3073x_chan_mode_get - get DPLL channel operating mode - * @chan: pointer to channel state -diff --git a/drivers/dpll/zl3073x/core.c b/drivers/dpll/zl3073x/core.c -index 024f0a2..7d2ad4b 100644 ---- a/drivers/dpll/zl3073x/core.c -+++ b/drivers/dpll/zl3073x/core.c -@@ -704,44 +704,6 @@ zl3073x_ref_freq_meas_update(struct zl3073x_dev *zldev) - return 0; - } - --/** -- * zl3073x_ref_ffo_update - update reference fractional frequency offsets -- * @zldev: pointer to zl3073x_dev structure -- * -- * The function asks device to latch the latest measured fractional -- * frequency offset values, reads and stores them into the ref state. -- * -- * Return: 0 on success, <0 on error -- */ --static int --zl3073x_ref_ffo_update(struct zl3073x_dev *zldev) --{ -- int i, rc; -- -- rc = zl3073x_ref_freq_meas_latch(zldev, -- ZL_REF_FREQ_MEAS_CTRL_REF_FREQ_OFF); -- if (rc) -- return rc; -- -- /* Read DPLL-to-REFx frequency offset measurements */ -- for (i = 0; i < ZL3073X_NUM_REFS; i++) { -- s32 value; -- -- /* Read value stored in units of 2^-32 signed */ -- rc = zl3073x_read_u32(zldev, ZL_REG_REF_FREQ(i), &value); -- if (rc) -- return rc; -- -- /* Convert to ppt -- * ffo = (10^12 * value) / 2^32 -- * ffo = ( 5^12 * value) / 2^20 -- */ -- zldev->ref[i].ffo = mul_s64_u64_shr(value, 244140625, 20); -- } -- -- return 0; --} -- - static void - zl3073x_dev_periodic_work(struct kthread_work *work) - { -@@ -776,13 +738,6 @@ zl3073x_dev_periodic_work(struct kthread_work *work) - } - } - -- /* Update references' fractional frequency offsets */ -- rc = zl3073x_ref_ffo_update(zldev); -- if (rc) -- dev_warn(zldev->dev, -- "Failed to update fractional frequency offsets: %pe\n", -- ERR_PTR(rc)); -- - list_for_each_entry(zldpll, &zldev->dplls, list) - zl3073x_dpll_changes_check(zldpll); - -diff --git a/drivers/dpll/zl3073x/dpll.c b/drivers/dpll/zl3073x/dpll.c -index b159dff..6b714ec 100644 ---- a/drivers/dpll/zl3073x/dpll.c -+++ b/drivers/dpll/zl3073x/dpll.c -@@ -1,5 +1,6 @@ - // SPDX-License-Identifier: GPL-2.0-only - -+#include - #include - #include - #include -@@ -57,7 +58,7 @@ struct zl3073x_dpll_pin { - s32 phase_gran; - enum dpll_pin_operstate operstate; - s64 phase_offset; -- s64 freq_offset; -+ atomic64_t freq_offset; - u32 measured_freq; - }; - -@@ -300,7 +301,10 @@ zl3073x_dpll_input_pin_ffo_get(const struct dpll_pin *dpll_pin, void *pin_priv, - { - struct zl3073x_dpll_pin *pin = pin_priv; - -- ffo->ffo = pin->freq_offset; -+ if (pin->operstate != DPLL_PIN_OPERSTATE_ACTIVE) -+ return -ENODATA; -+ -+ ffo->ffo = atomic64_read(&pin->freq_offset); - - return 0; - } -@@ -1275,7 +1279,7 @@ zl3073x_dpll_freq_monitor_set(const struct dpll_device *dpll, - } - - static const struct dpll_pin_ops zl3073x_dpll_input_pin_ops = { -- .supported_ffo = BIT(DPLL_FFO_PORT_RXTX_RATE), -+ .supported_ffo = BIT(DPLL_FFO_PIN_DEVICE), - .direction_get = zl3073x_dpll_pin_direction_get, - .esync_get = zl3073x_dpll_input_pin_esync_get, - .esync_set = zl3073x_dpll_input_pin_esync_set, -@@ -1731,37 +1735,29 @@ zl3073x_dpll_pin_phase_offset_check(struct zl3073x_dpll_pin *pin) - } - - /** -- * zl3073x_dpll_pin_ffo_check - check for pin fractional frequency offset change -+ * zl3073x_dpll_pin_ffo_check - check for FFO change on active pin - * @pin: pin to check - * -- * Check for the given pin's fractional frequency change. -- * -- * Return: true on fractional frequency offset change, false otherwise -+ * Return: true on change, false otherwise - */ - static bool - zl3073x_dpll_pin_ffo_check(struct zl3073x_dpll_pin *pin) - { - struct zl3073x_dpll *zldpll = pin->dpll; - struct zl3073x_dev *zldev = zldpll->dev; -- const struct zl3073x_ref *ref; -- u8 ref_id; -+ const struct zl3073x_chan *chan; - s64 ffo; - -- /* Get reference monitor status */ -- ref_id = zl3073x_input_pin_ref_get(pin->id); -- ref = zl3073x_ref_state_get(zldev, ref_id); -- -- /* Do not report ffo changes if the reference monitor report errors */ -- if (!zl3073x_ref_is_status_ok(ref)) -+ if (pin->operstate != DPLL_PIN_OPERSTATE_ACTIVE) - return false; - -- /* Compare with previous value */ -- ffo = zl3073x_ref_ffo_get(ref); -- if (pin->freq_offset != ffo) { -- dev_dbg(zldev->dev, "%s freq offset changed: %lld -> %lld\n", -- pin->label, pin->freq_offset, ffo); -- pin->freq_offset = ffo; -+ chan = zl3073x_chan_state_get(zldpll->dev, zldpll->id); -+ ffo = mul_s64_u64_shr(zl3073x_chan_df_offset_get(chan), -+ 244140625, 36); - -+ if (atomic64_xchg(&pin->freq_offset, ffo) != ffo) { -+ dev_dbg(zldev->dev, "%s freq offset changed to: %lld\n", -+ pin->label, ffo); - return true; - } - -diff --git a/drivers/dpll/zl3073x/ref.h b/drivers/dpll/zl3073x/ref.h -index 55e80e4..e140ca3 100644 ---- a/drivers/dpll/zl3073x/ref.h -+++ b/drivers/dpll/zl3073x/ref.h -@@ -22,7 +22,6 @@ struct zl3073x_dev; - * @freq_ratio_n: FEC mode divisor - * @sync_ctrl: reference sync control - * @config: reference config -- * @ffo: current fractional frequency offset - * @meas_freq: measured input frequency in Hz - * @mon_status: reference monitor status - */ -@@ -40,7 +39,6 @@ struct zl3073x_ref { - u8 config; - ); - struct_group(stat, /* Status */ -- s64 ffo; - u32 meas_freq; - u8 mon_status; - ); -@@ -58,18 +56,6 @@ int zl3073x_ref_state_update(struct zl3073x_dev *zldev, u8 index); - - int zl3073x_ref_freq_factorize(u32 freq, u16 *base, u16 *mult); - --/** -- * zl3073x_ref_ffo_get - get current fractional frequency offset -- * @ref: pointer to ref state -- * -- * Return: the latest measured fractional frequency offset -- */ --static inline s64 --zl3073x_ref_ffo_get(const struct zl3073x_ref *ref) --{ -- return ref->ffo; --} -- - /** - * zl3073x_ref_meas_freq_get - get measured input frequency - * @ref: pointer to ref state -diff --git a/drivers/dpll/zl3073x/regs.h b/drivers/dpll/zl3073x/regs.h -index 8015808..9578f00 100644 ---- a/drivers/dpll/zl3073x/regs.h -+++ b/drivers/dpll/zl3073x/regs.h -@@ -164,6 +164,11 @@ - #define ZL_DPLL_MODE_REFSEL_MODE_NCO 4 - #define ZL_DPLL_MODE_REFSEL_REF GENMASK(7, 4) - -+#define ZL_REG_DPLL_DF_READ(_idx) \ -+ ZL_REG_IDX(_idx, 5, 0x28, 1, ZL3073X_MAX_CHANNELS, 1) -+#define ZL_DPLL_DF_READ_SEM BIT(4) -+#define ZL_DPLL_DF_READ_REF_OFST BIT(3) -+ - #define ZL_REG_DPLL_MEAS_CTRL ZL_REG(5, 0x50, 1) - #define ZL_DPLL_MEAS_CTRL_EN BIT(0) - #define ZL_DPLL_MEAS_CTRL_AVG_FACTOR GENMASK(7, 4) -@@ -176,6 +181,16 @@ - #define ZL_REG_DPLL_PHASE_ERR_DATA(_idx) \ - ZL_REG_IDX(_idx, 5, 0x55, 6, ZL3073X_MAX_CHANNELS, 6) - -+/******************************* -+ * Register Pages 6-7, DPLL Data -+ *******************************/ -+ -+#define ZL_REG_DPLL_DF_OFFSET_03(_idx) \ -+ ZL_REG_IDX(_idx, 6, 0x00, 6, 4, 0x20) -+#define ZL_REG_DPLL_DF_OFFSET_4 ZL_REG(7, 0x00, 6) -+#define ZL_REG_DPLL_DF_OFFSET(_idx) \ -+ ((_idx) < 4 ? ZL_REG_DPLL_DF_OFFSET_03(_idx) : ZL_REG_DPLL_DF_OFFSET_4) -+ - /*********************************** - * Register Page 9, Synth and Output - ***********************************/ diff --git a/SOURCES/1292-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch b/SOURCES/1292-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch deleted file mode 100644 index 82947162c..000000000 --- a/SOURCES/1292-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch +++ /dev/null @@ -1,100 +0,0 @@ -From f6e1f25fa5e733570f6d6fe37a4dfed2a0deba47 Mon Sep 17 00:00:00 2001 -From: Jiayuan Chen -Date: Mon, 6 Apr 2026 11:15:10 +0800 -Subject: [PATCH] mptcp: fix slab-use-after-free in __inet_lookup_established - -commit 9b55b253907e7431210483519c5ad711a37dafa1 upstream. - -The ehash table lookups are lockless and rely on -SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability -during RCU read-side critical sections. Both tcp_prot and -tcpv6_prot have their slab caches created with this flag -via proto_register(). - -However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into -tcpv6_prot_override during inet_init() (fs_initcall, level 5), -before inet6_init() (module_init/device_initcall, level 6) has -called proto_register(&tcpv6_prot). At that point, -tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab -remains NULL permanently. - -This causes MPTCP v6 subflow child sockets to be allocated via -kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab -cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so -when these sockets are freed without SOCK_RCU_FREE (which is -cleared for child sockets by design), the memory can be -immediately reused. Concurrent ehash lookups under -rcu_read_lock can then access freed memory, triggering a -slab-use-after-free in __inet_lookup_established. - -Fix this by splitting the IPv6-specific initialization out of -mptcp_subflow_init() into a new mptcp_subflow_v6_init(), called -from mptcp_proto_v6_init() before protocol registration. This -ensures tcpv6_prot_override.slab correctly inherits the -SLAB_TYPESAFE_BY_RCU slab cache. - -Fixes: b19bc2945b40 ("mptcp: implement delegated actions") -Cc: stable@vger.kernel.org -Signed-off-by: Jiayuan Chen -Reviewed-by: Matthieu Baerts (NGI0) -Link: https://patch.msgid.link/20260406031512.189159-1-jiayuan.chen@linux.dev -Signed-off-by: Jakub Kicinski -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c -index fae51f3..a8d345c 100644 ---- a/net/mptcp/protocol.c -+++ b/net/mptcp/protocol.c -@@ -4248,6 +4248,8 @@ int __init mptcp_proto_v6_init(void) - { - int err; - -+ mptcp_subflow_v6_init(); -+ - mptcp_v6_prot = mptcp_prot; - strscpy(mptcp_v6_prot.name, "MPTCPv6", sizeof(mptcp_v6_prot.name)); - mptcp_v6_prot.slab = NULL; -diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h -index fc9ad56..161ed3c 100644 ---- a/net/mptcp/protocol.h -+++ b/net/mptcp/protocol.h -@@ -794,6 +794,7 @@ static inline void mptcp_subflow_tcp_fallback(struct sock *sk, - void __init mptcp_proto_init(void); - #if IS_ENABLED(CONFIG_MPTCP_IPV6) - int __init mptcp_proto_v6_init(void); -+void __init mptcp_subflow_v6_init(void); - #endif - - struct sock *mptcp_sk_clone_init(const struct sock *sk, -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index a37c9cb..b6cd4d5 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -2103,7 +2103,15 @@ void __init mptcp_subflow_init(void) - tcp_prot_override.release_cb = tcp_release_cb_override; - tcp_prot_override.diag_destroy = tcp_abort_override; - -+ mptcp_diag_subflow_init(&subflow_ulp_ops); -+ -+ if (tcp_register_ulp(&subflow_ulp_ops) != 0) -+ panic("MPTCP: failed to register subflows to ULP\n"); -+} -+ - #if IS_ENABLED(CONFIG_MPTCP_IPV6) -+void __init mptcp_subflow_v6_init(void) -+{ - /* In struct mptcp_subflow_request_sock, we assume the TCP request sock - * structures for v4 and v6 have the same size. It should not changed in - * the future but better to make sure to be warned if it is no longer -@@ -2139,10 +2147,5 @@ void __init mptcp_subflow_init(void) - tcpv6_prot_override = tcpv6_prot; - tcpv6_prot_override.release_cb = tcp_release_cb_override; - tcpv6_prot_override.diag_destroy = tcp_abort_override; --#endif -- -- mptcp_diag_subflow_init(&subflow_ulp_ops); -- -- if (tcp_register_ulp(&subflow_ulp_ops) != 0) -- panic("MPTCP: failed to register subflows to ULP\n"); - } -+#endif diff --git a/SOURCES/1293-ice-fix-null-pointer-dereference-in-ice-vsi-set-napi-queues.patch b/SOURCES/1293-ice-fix-null-pointer-dereference-in-ice-vsi-set-napi-queues.patch deleted file mode 100644 index bece3cfff..000000000 --- a/SOURCES/1293-ice-fix-null-pointer-dereference-in-ice-vsi-set-napi-queues.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 6985e4baf50b86327426ca5d5cf4787ac165aacd Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 23 Apr 2026 22:42:57 +0000 -Subject: [PATCH] ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues - -JIRA: https://redhat.atlassian.net/browse/RHEL-99101 - -commit 9bb30be4d89ff9a8d7ab1aa0eb2edaca83431f85 -Author: Aaron Ma -Date: Thu Dec 25 14:21:21 2025 +0800 - - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues - - Add NULL pointer checks in ice_vsi_set_napi_queues() to prevent crashes - during resume from suspend when rings[q_idx]->q_vector is NULL. - - Tested adaptor: - 60:00.0 Ethernet controller [0200]: Intel Corporation Ethernet Controller E810-XXV for SFP [8086:159b] (rev 02) - Subsystem: Intel Corporation Ethernet Network Adapter E810-XXV-2 [8086:4003] - - SR-IOV state: both disabled and enabled can reproduce this issue. - - kernel version: v6.18 - - Reproduce steps: - Boot up and execute suspend like systemctl suspend or rtcwake. - - Log: - <1>[ 231.443607] BUG: kernel NULL pointer dereference, address: 0000000000000040 - <1>[ 231.444052] #PF: supervisor read access in kernel mode - <1>[ 231.444484] #PF: error_code(0x0000) - not-present page - <6>[ 231.444913] PGD 0 P4D 0 - <4>[ 231.445342] Oops: Oops: 0000 [#1] SMP NOPTI - <4>[ 231.446635] RIP: 0010:netif_queue_set_napi+0xa/0x170 - <4>[ 231.447067] Code: 31 f6 31 ff c3 cc cc cc cc 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 85 c9 74 0b <48> 83 79 30 00 0f 84 39 01 00 00 55 41 89 d1 49 89 f8 89 f2 48 89 - <4>[ 231.447513] RSP: 0018:ffffcc780fc078c0 EFLAGS: 00010202 - <4>[ 231.447961] RAX: ffff8b848ca30400 RBX: ffff8b848caf2028 RCX: 0000000000000010 - <4>[ 231.448443] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff8b848dbd4000 - <4>[ 231.448896] RBP: ffffcc780fc078e8 R08: 0000000000000000 R09: 0000000000000000 - <4>[ 231.449345] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 - <4>[ 231.449817] R13: ffff8b848dbd4000 R14: ffff8b84833390c8 R15: 0000000000000000 - <4>[ 231.450265] FS: 00007c7b29e9d740(0000) GS:ffff8b8c068e2000(0000) knlGS:0000000000000000 - <4>[ 231.450715] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - <4>[ 231.451179] CR2: 0000000000000040 CR3: 000000030626f004 CR4: 0000000000f72ef0 - <4>[ 231.451629] PKRU: 55555554 - <4>[ 231.452076] Call Trace: - <4>[ 231.452549] - <4>[ 231.452996] ? ice_vsi_set_napi_queues+0x4d/0x110 [ice] - <4>[ 231.453482] ice_resume+0xfd/0x220 [ice] - <4>[ 231.453977] ? __pfx_pci_pm_resume+0x10/0x10 - <4>[ 231.454425] pci_pm_resume+0x8c/0x140 - <4>[ 231.454872] ? __pfx_pci_pm_resume+0x10/0x10 - <4>[ 231.455347] dpm_run_callback+0x5f/0x160 - <4>[ 231.455796] ? dpm_wait_for_superior+0x107/0x170 - <4>[ 231.456244] device_resume+0x177/0x270 - <4>[ 231.456708] dpm_resume+0x209/0x2f0 - <4>[ 231.457151] dpm_resume_end+0x15/0x30 - <4>[ 231.457596] suspend_devices_and_enter+0x1da/0x2b0 - <4>[ 231.458054] enter_state+0x10e/0x570 - - Add defensive checks for both the ring pointer and its q_vector - before dereferencing, allowing the system to resume successfully even when - q_vectors are unmapped. - - Fixes: 2a5dc090b92cf ("ice: move netif_queue_set_napi to rtnl-protected sections") - Reviewed-by: Aleksandr Loktionov - Signed-off-by: Aaron Ma - Reviewed-by: Paul Menzel - Signed-off-by: Tony Nguyen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c -index 72c91bd..60b32b4 100644 ---- a/drivers/net/ethernet/intel/ice/ice_lib.c -+++ b/drivers/net/ethernet/intel/ice/ice_lib.c -@@ -2789,12 +2789,14 @@ void ice_vsi_set_napi_queues(struct ice_vsi *vsi) - - ASSERT_RTNL(); - ice_for_each_rxq(vsi, q_idx) -- netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, -- &vsi->rx_rings[q_idx]->q_vector->napi); -+ if (vsi->rx_rings[q_idx] && vsi->rx_rings[q_idx]->q_vector) -+ netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_RX, -+ &vsi->rx_rings[q_idx]->q_vector->napi); - - ice_for_each_txq(vsi, q_idx) -- netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, -- &vsi->tx_rings[q_idx]->q_vector->napi); -+ if (vsi->tx_rings[q_idx] && vsi->tx_rings[q_idx]->q_vector) -+ netif_queue_set_napi(netdev, q_idx, NETDEV_QUEUE_TYPE_TX, -+ &vsi->tx_rings[q_idx]->q_vector->napi); - /* Also set the interrupt number for the NAPI */ - ice_for_each_q_vector(vsi, v_idx) { - struct ice_q_vector *q_vector = vsi->q_vectors[v_idx]; diff --git a/SOURCES/1294-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch b/SOURCES/1294-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch deleted file mode 100644 index eb9557b76..000000000 --- a/SOURCES/1294-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch +++ /dev/null @@ -1,89 +0,0 @@ -From d28311539ac9f65e29308ea219ecaa48aa5e76e5 Mon Sep 17 00:00:00 2001 -From: Shuvam Pandey -Date: Fri, 8 May 2026 21:33:20 -0400 -Subject: [PATCH] Bluetooth: hci_event: fix potential UAF in SSP passkey - handlers - -[ Upstream commit 85fa3512048793076eef658f66489112dcc91993 ] - -hci_conn lookup and field access must be covered by hdev lock in -hci_user_passkey_notify_evt() and hci_keypress_notify_evt(), otherwise -the connection can be freed concurrently. - -Extend the hci_dev_lock critical section to cover all conn usage in both -handlers. - -Keep the existing keypress notification behavior unchanged by routing -the early exits through a common unlock path. - -Fixes: 92a25256f142 ("Bluetooth: mgmt: Implement support for passkey notification") -Cc: stable@vger.kernel.org -Signed-off-by: Shuvam Pandey -Signed-off-by: Luiz Augusto von Dentz -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c -index f5054bb..262a918 100644 ---- a/net/bluetooth/hci_event.c -+++ b/net/bluetooth/hci_event.c -@@ -5418,9 +5418,11 @@ static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data, - - bt_dev_dbg(hdev, ""); - -+ hci_dev_lock(hdev); -+ - conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); - if (!conn) -- return; -+ goto unlock; - - conn->passkey_notify = __le32_to_cpu(ev->passkey); - conn->passkey_entered = 0; -@@ -5429,6 +5431,9 @@ static void hci_user_passkey_notify_evt(struct hci_dev *hdev, void *data, - mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, - conn->dst_type, conn->passkey_notify, - conn->passkey_entered); -+ -+unlock: -+ hci_dev_unlock(hdev); - } - - static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, -@@ -5439,14 +5444,16 @@ static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, - - bt_dev_dbg(hdev, ""); - -+ hci_dev_lock(hdev); -+ - conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr); - if (!conn) -- return; -+ goto unlock; - - switch (ev->type) { - case HCI_KEYPRESS_STARTED: - conn->passkey_entered = 0; -- return; -+ goto unlock; - - case HCI_KEYPRESS_ENTERED: - conn->passkey_entered++; -@@ -5461,13 +5468,16 @@ static void hci_keypress_notify_evt(struct hci_dev *hdev, void *data, - break; - - case HCI_KEYPRESS_COMPLETED: -- return; -+ goto unlock; - } - - if (hci_dev_test_flag(hdev, HCI_MGMT)) - mgmt_user_passkey_notify(hdev, &conn->dst, conn->type, - conn->dst_type, conn->passkey_notify, - conn->passkey_entered); -+ -+unlock: -+ hci_dev_unlock(hdev); - } - - static void hci_simple_pair_complete_evt(struct hci_dev *hdev, void *data, diff --git a/SOURCES/1295-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch b/SOURCES/1295-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch deleted file mode 100644 index ed2216c4f..000000000 --- a/SOURCES/1295-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch +++ /dev/null @@ -1,33 +0,0 @@ -From ac8eb3e18f41e2cc8492cc1d358bcb786c850270 Mon Sep 17 00:00:00 2001 -From: Benjamin Berg -Date: Tue, 5 May 2026 15:15:40 +0200 -Subject: [PATCH] wifi: mac80211: use safe list iteration in radar detect work - -The call to ieee80211_dfs_cac_cancel can cause the iterated chanctx to -be freed and removed from the list. Guard against this to avoid a -slab-use-after-free error. - -Cc: stable@vger.kernel.org -Fixes: bca8bc0399ac ("wifi: mac80211: handle ieee80211_radar_detected() for MLO") -Signed-off-by: Benjamin Berg -Link: https://patch.msgid.link/20260505151539.236d63a1b736.I35dbb9e96a2d4a480be208770fdd99ba3b817b79@changeid -Signed-off-by: Johannes Berg - -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index c993153..62e1a37 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -3565,11 +3565,11 @@ void ieee80211_dfs_radar_detected_work(struct wiphy *wiphy, - struct ieee80211_local *local = - container_of(work, struct ieee80211_local, radar_detected_work); - struct cfg80211_chan_def chandef; -- struct ieee80211_chanctx *ctx; -+ struct ieee80211_chanctx *ctx, *tmp; - - lockdep_assert_wiphy(local->hw.wiphy); - -- list_for_each_entry(ctx, &local->chanctx_list, list) { -+ list_for_each_entry_safe(ctx, tmp, &local->chanctx_list, list) { - if (ctx->replace_state == IEEE80211_CHANCTX_REPLACES_OTHER) - continue; - diff --git a/SOURCES/1296-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch b/SOURCES/1296-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch deleted file mode 100644 index f38270f99..000000000 --- a/SOURCES/1296-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 7a5b81e0c87a075afd572f659d8eb68c9c4cd2ba Mon Sep 17 00:00:00 2001 -From: Catherine -Date: Fri, 24 Apr 2026 21:14:36 +0800 -Subject: [PATCH] wifi: mac80211: drop stray 'static' from fast-RX rx_result - -ieee80211_invoke_fast_rx() is documented as safe for parallel RX, but -its per-invocation rx_result is declared static. Concurrent callers then -share one instance and can overwrite each other's result between -ieee80211_rx_mesh_data() and the switch on res. - -That can make a packet that was queued or consumed by -ieee80211_rx_mesh_data() fall through into ieee80211_rx_8023(), or make -a packet that should continue return as queued. - -Make res an automatic variable so each invocation keeps its own result. - -Fixes: 3468e1e0c639 ("wifi: mac80211: add mesh fast-rx support") -Cc: stable@vger.kernel.org -Signed-off-by: Catherine -Link: https://patch.msgid.link/20260424131435.83212-2-enderaoelyther@gmail.com -Signed-off-by: Johannes Berg - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 4e34435..02f1315 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -4819,7 +4819,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, - struct sk_buff *skb = rx->skb; - struct ieee80211_hdr *hdr = (void *)skb->data; - struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); -- static ieee80211_rx_result res; -+ ieee80211_rx_result res; - int orig_len = skb->len; - int hdrlen = ieee80211_hdrlen(hdr->frame_control); - int snap_offs = hdrlen; diff --git a/SOURCES/1297-rdma-mana-validate-rx-hash-key-len.patch b/SOURCES/1297-rdma-mana-validate-rx-hash-key-len.patch deleted file mode 100644 index 9f04228ad..000000000 --- a/SOURCES/1297-rdma-mana-validate-rx-hash-key-len.patch +++ /dev/null @@ -1,30 +0,0 @@ -From 6dd2d4ad9c8429523b1c220c5132bd551c006425 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Tue, 28 Apr 2026 13:17:37 -0300 -Subject: [PATCH] RDMA/mana: Validate rx_hash_key_len - -Sashiko points out that rx_hash_key_len comes from a uAPI structure and is -blindly passed to memcpy, allowing the userspace to trash kernel -memory. Bounds check it so the memcpy cannot overflow. - -Cc: stable@vger.kernel.org -Fixes: 0266a177631d ("RDMA/mana_ib: Add a driver for Microsoft Azure Network Adapter") -Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 -Link: https://patch.msgid.link/r/4-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Reviewed-by: Long Li -Signed-off-by: Jason Gunthorpe - -diff --git a/drivers/infiniband/hw/mana/qp.c b/drivers/infiniband/hw/mana/qp.c -index 48c1f49..8eb956e 100644 ---- a/drivers/infiniband/hw/mana/qp.c -+++ b/drivers/infiniband/hw/mana/qp.c -@@ -21,6 +21,9 @@ static int mana_ib_cfg_vport_steering(struct mana_ib_dev *dev, - - gc = mdev_to_gc(dev); - -+ if (rx_hash_key_len > sizeof(req->hashkey)) -+ return -EINVAL; -+ - req_buf_size = struct_size(req, indir_tab, MANA_INDIRECT_TABLE_DEF_SIZE); - req = kzalloc(req_buf_size, GFP_KERNEL); - if (!req) diff --git a/SOURCES/1298-wifi-mac80211-remove-station-if-connection-prep-fails.patch b/SOURCES/1298-wifi-mac80211-remove-station-if-connection-prep-fails.patch deleted file mode 100644 index 9024721ad..000000000 --- a/SOURCES/1298-wifi-mac80211-remove-station-if-connection-prep-fails.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 283fc9e44ff5b5ac967439b4951b80bd4299f4e4 Mon Sep 17 00:00:00 2001 -From: Johannes Berg -Date: Tue, 5 May 2026 15:15:34 +0200 -Subject: [PATCH] wifi: mac80211: remove station if connection prep fails - -If connection preparation fails for MLO connections, then the -interface is completely reset to non-MLD. In this case, we must -not keep the station since it's related to the link of the vif -being removed. Delete an existing station. Any "new_sta" is -already being removed, so that doesn't need changes. - -This fixes a use-after-free/double-free in debugfs if that's -enabled, because a vif going from MLD (and to MLD, but that's -not relevant here) recreates its entire debugfs. - -Cc: stable@vger.kernel.org -Fixes: 81151ce462e5 ("wifi: mac80211: support MLO authentication/association with one link") -Reviewed-by: Miriam Rachel Korenblit -Link: https://patch.msgid.link/20260505151533.c4e52deb06ad.Iafe56cec7de8512626169496b134bce3a6c17010@changeid -Signed-off-by: Johannes Berg - -diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c -index e185f2a..7ba68a0 100644 ---- a/net/mac80211/mlme.c -+++ b/net/mac80211/mlme.c -@@ -8890,7 +8890,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - struct ieee80211_bss *bss = (void *)cbss->priv; - struct sta_info *new_sta = NULL; - struct ieee80211_link_data *link; -- bool have_sta = false; -+ struct sta_info *have_sta = NULL; - bool mlo; - int err; - u16 new_links; -@@ -8909,11 +8909,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - mlo = false; - } - -- if (assoc) { -- rcu_read_lock(); -+ if (assoc) - have_sta = sta_info_get(sdata, ap_mld_addr); -- rcu_read_unlock(); -- } - - if (mlo && !have_sta && - WARN_ON(sdata->vif.valid_links || sdata->vif.active_links)) -@@ -9072,6 +9069,8 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, - out_release_chan: - ieee80211_link_release_channel(link); - out_err: -+ if (mlo && have_sta) -+ WARN_ON(__sta_info_destroy(have_sta)); - ieee80211_vif_set_links(sdata, 0, 0); - return err; - } diff --git a/SOURCES/1299-bnxt-en-fix-rss-context-delete-logic.patch b/SOURCES/1299-bnxt-en-fix-rss-context-delete-logic.patch deleted file mode 100644 index 8e6362aab..000000000 --- a/SOURCES/1299-bnxt-en-fix-rss-context-delete-logic.patch +++ /dev/null @@ -1,57 +0,0 @@ -From e123d9302d223767bd910bfbcfe607bae909f8ac Mon Sep 17 00:00:00 2001 -From: Pavan Chebbi -Date: Thu, 19 Feb 2026 10:53:11 -0800 -Subject: [PATCH] bnxt_en: Fix RSS context delete logic - -We need to free the corresponding RSS context VNIC -in FW everytime an RSS context is deleted in driver. -Commit 667ac333dbb7 added a check to delete the VNIC -in FW only when netif_running() is true to help delete -RSS contexts with interface down. - -Having that condition will make the driver leak VNICs -in FW whenever close() happens with active RSS contexts. -On the subsequent open(), as part of RSS context restoration, -we will end up trying to create extra VNICs for which we -did not make any reservation. FW can fail this request, -thereby making us lose active RSS contexts. - -Suppose an RSS context is deleted already and we try to -process a delete request again, then the HWRM functions -will check for validity of the request and they simply -return if the resource is already freed. So, even for -delete-when-down cases, netif_running() check is not -necessary. - -Remove the netif_running() condition check when deleting -an RSS context. - -Reported-by: Jakub Kicinski -Fixes: 667ac333dbb7 ("eth: bnxt: allow deleting RSS contexts when the device is down") -Reviewed-by: Andy Gospodarek -Signed-off-by: Pavan Chebbi -Signed-off-by: Michael Chan -Link: https://patch.msgid.link/20260219185313.2682148-2-michael.chan@broadcom.com -Signed-off-by: Jakub Kicinski - -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 3177d4b..a178578 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -10731,12 +10731,10 @@ void bnxt_del_one_rss_ctx(struct bnxt *bp, struct bnxt_rss_ctx *rss_ctx, - struct bnxt_ntuple_filter *ntp_fltr; - int i; - -- if (netif_running(bp->dev)) { -- bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic); -- for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) { -- if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID) -- bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i); -- } -+ bnxt_hwrm_vnic_free_one(bp, &rss_ctx->vnic); -+ for (i = 0; i < BNXT_MAX_CTX_PER_VNIC; i++) { -+ if (vnic->fw_rss_cos_lb_ctx[i] != INVALID_HW_RING_ID) -+ bnxt_hwrm_vnic_ctx_free_one(bp, vnic, i); - } - if (!all) - return; diff --git a/SOURCES/1300-gfs2-add-metapath-dibh-helper.patch b/SOURCES/1300-gfs2-add-metapath-dibh-helper.patch deleted file mode 100644 index 8302dadca..000000000 --- a/SOURCES/1300-gfs2-add-metapath-dibh-helper.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 602fb357b195d846887987a68024330a593ab1b9 Mon Sep 17 00:00:00 2001 -From: Andreas Gruenbacher -Date: Fri, 20 Oct 2023 01:32:15 +0200 -Subject: [PATCH] gfs2: Add metapath_dibh helper - -[ Upstream commit 92099f0c92270c8c7a79e6bc6e0312ad248ea331 ] - -Add a metapath_dibh() helper for extracting the inode's buffer head from -a metapath. - -Signed-off-by: Andreas Gruenbacher -Stable-dep-of: faddeb848305 ("gfs2: Fix use-after-free in iomap inline data write path") -Signed-off-by: Sasha Levin - -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index 66e5fd0..f19f031 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -317,6 +317,12 @@ static void gfs2_metapath_ra(struct gfs2_glock *gl, __be64 *start, __be64 *end) - } - } - -+static inline struct buffer_head * -+metapath_dibh(struct metapath *mp) -+{ -+ return mp->mp_bh[0]; -+} -+ - static int __fillup_metapath(struct gfs2_inode *ip, struct metapath *mp, - unsigned int x, unsigned int h) - { -@@ -661,7 +667,7 @@ static int __gfs2_iomap_alloc(struct inode *inode, struct iomap *iomap, - { - struct gfs2_inode *ip = GFS2_I(inode); - struct gfs2_sbd *sdp = GFS2_SB(inode); -- struct buffer_head *dibh = mp->mp_bh[0]; -+ struct buffer_head *dibh = metapath_dibh(mp); - u64 bn; - unsigned n, i, blks, alloced = 0, iblks = 0, branch_start = 0; - size_t dblks = iomap->length >> inode->i_blkbits; diff --git a/SOURCES/1301-gfs2-fix-use-after-free-in-iomap-inline-data-write-path.patch b/SOURCES/1301-gfs2-fix-use-after-free-in-iomap-inline-data-write-path.patch deleted file mode 100644 index 2adde52c6..000000000 --- a/SOURCES/1301-gfs2-fix-use-after-free-in-iomap-inline-data-write-path.patch +++ /dev/null @@ -1,76 +0,0 @@ -From 1cae1bafdf9caa9b462b19af06b1a06902e4e142 Mon Sep 17 00:00:00 2001 -From: Deepanshu Kartikey -Date: Fri, 30 Jan 2026 14:51:34 +0530 -Subject: [PATCH] gfs2: Fix use-after-free in iomap inline data write path - -[ Upstream commit faddeb848305e79db89ee0479bb0e33380656321 ] - -The inline data buffer head (dibh) is being released prematurely in -gfs2_iomap_begin() via release_metapath() while iomap->inline_data -still points to dibh->b_data. This causes a use-after-free when -iomap_write_end_inline() later attempts to write to the inline data -area. - -The bug sequence: -1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode - metadata into dibh -2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) -3. Calls release_metapath() which calls brelse(dibh), dropping refcount - to 0 -4. kswapd reclaims the page (~39ms later in the syzbot report) -5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data -6. KASAN detects use-after-free write to freed memory - -Fix by storing dibh in iomap->private and incrementing its refcount -with get_bh() in gfs2_iomap_begin(). The buffer is then properly -released in gfs2_iomap_end() after the inline write completes, -ensuring the page stays alive for the entire iomap operation. - -Note: A C reproducer is not available for this issue. The fix is based -on analysis of the KASAN report and code review showing the buffer head -is freed before use. - -[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid -leaks in gfs2_iomap_get() and gfs2_iomap_alloc().] - -Reported-by: syzbot+ea1cd4aa4d1e98458a55@syzkaller.appspotmail.com -Closes: https://syzkaller.appspot.com/bug?extid=ea1cd4aa4d1e98458a55 -Fixes: d0a22a4b03b8 ("gfs2: Fix iomap write page reclaim deadlock") -Signed-off-by: Deepanshu Kartikey -Signed-off-by: Andreas Gruenbacher -Signed-off-by: Sasha Levin - -diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c -index f19f031..05f348c 100644 ---- a/fs/gfs2/bmap.c -+++ b/fs/gfs2/bmap.c -@@ -1122,10 +1122,18 @@ static int gfs2_iomap_begin(struct inode *inode, loff_t pos, loff_t length, - goto out_unlock; - break; - default: -- goto out_unlock; -+ goto out; - } - - ret = gfs2_iomap_begin_write(inode, pos, length, flags, iomap, &mp); -+ if (ret) -+ goto out_unlock; -+ -+out: -+ if (iomap->type == IOMAP_INLINE) { -+ iomap->private = metapath_dibh(&mp); -+ get_bh(iomap->private); -+ } - - out_unlock: - release_metapath(&mp); -@@ -1139,6 +1147,9 @@ static int gfs2_iomap_end(struct inode *inode, loff_t pos, loff_t length, - struct gfs2_inode *ip = GFS2_I(inode); - struct gfs2_sbd *sdp = GFS2_SB(inode); - -+ if (iomap->private) -+ brelse(iomap->private); -+ - switch (flags & (IOMAP_WRITE | IOMAP_ZERO)) { - case IOMAP_WRITE: - if (flags & IOMAP_DIRECT) diff --git a/SOURCES/1302-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch b/SOURCES/1302-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch deleted file mode 100644 index 10eb740f5..000000000 --- a/SOURCES/1302-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch +++ /dev/null @@ -1,64 +0,0 @@ -From ed98cf22bd574bbcd5906e0ee217dfe65f5f8c8a Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Fri, 13 Mar 2026 16:09:40 +0100 -Subject: [PATCH] s390/ap: Expose ap_bindings_complete_count counter via sysfs - -JIRA: https://issues.redhat.com/browse/RHEL-155897 - -commit 51d921a613b1e89a47c2c262bbef1d7b0b032ac7 -Author: Harald Freudenberger -Date: Fri Oct 17 16:51:52 2025 +0200 - - s390/ap: Expose ap_bindings_complete_count counter via sysfs - - The AP bus udev event BINDINGS=complete is sent out when the - first time all devices detected by the AP bus scan have been - bound to device drivers. This is the ideal time to for example - change the AP bus masks apmask and aqmask to re-establish a - persistent change on the decision about which cards/domains - should be available for the host and which should go into the - pool for kvm guests. - - However, if exactly this initial udev event is sent out early - in the boot process a udev rule may not have been established - yet and thus this event will never be recognized. To have - some indication about if the AP bus binding complete has - already happened, the internal ap_bindings_complete_count - counter is exposed via sysfs with this patch. - - Suggested-by: Matthew Rosato - Signed-off-by: Harald Freudenberger - Tested-by: Matthew Rosato - Signed-off-by: Heiko Carstens - -Signed-off-by: Harald Freudenberger -Signed-off-by: Mete Durlu - -diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c -index de8a250..48ffeaf 100644 ---- a/drivers/s390/crypto/ap_bus.c -+++ b/drivers/s390/crypto/ap_bus.c -@@ -1585,6 +1585,15 @@ static ssize_t bindings_show(const struct bus_type *bus, char *buf) - - static BUS_ATTR_RO(bindings); - -+static ssize_t bindings_complete_count_show(const struct bus_type *bus, -+ char *buf) -+{ -+ return sysfs_emit(buf, "%llu\n", -+ atomic64_read(&ap_bindings_complete_count)); -+} -+ -+static BUS_ATTR_RO(bindings_complete_count); -+ - static ssize_t features_show(const struct bus_type *bus, char *buf) - { - int n = 0; -@@ -1625,6 +1634,7 @@ static struct attribute *ap_bus_attrs[] = { - &bus_attr_aqmask.attr, - &bus_attr_scans.attr, - &bus_attr_bindings.attr, -+ &bus_attr_bindings_complete_count.attr, - &bus_attr_features.attr, - NULL, - }; diff --git a/SOURCES/1303-ibmveth-disable-gso-for-packets-with-small-mss.patch b/SOURCES/1303-ibmveth-disable-gso-for-packets-with-small-mss.patch deleted file mode 100644 index ee26fea14..000000000 --- a/SOURCES/1303-ibmveth-disable-gso-for-packets-with-small-mss.patch +++ /dev/null @@ -1,104 +0,0 @@ -From cd82512d5e7852beab3b8cb254c60b061fc549ac Mon Sep 17 00:00:00 2001 -From: Mamatha Inamdar -Date: Thu, 30 Apr 2026 20:30:14 -0400 -Subject: [PATCH] ibmveth: Disable GSO for packets with small MSS - -JIRA: https://issues.redhat.com/browse/RHEL-164873 - -commit cc427d24ac6442ffdeafd157a63c7c5b73ed4de4 -Author: Mingming Cao -Date: Fri Apr 24 09:29:17 2026 -0700 - - ibmveth: Disable GSO for packets with small MSS - - Some physical adapters on Power systems do not support segmentation - offload when the MSS is less than 224 bytes. Attempting to send such - packets causes the adapter to freeze, stopping all traffic until - manually reset. - - Implement ndo_features_check to disable GSO for packets with small MSS - values. The network stack will perform software segmentation instead. - - The 224-byte minimum matches ibmvnic - commit ("ibmvnic: Enforce stronger sanity checks - on GSO packets") - which uses the same physical adapters in SEA configurations. - - The issue occurs specifically when the hardware attempts to perform - segmentation (gso_segs > 1) with a small MSS. Single-segment GSO packets - (gso_segs == 1) do not trigger the problematic LSO code path and are - transmitted normally without segmentation. - - Add an ndo_features_check callback to disable GSO when MSS < 224 bytes. - Also call vlan_features_check() to ensure proper handling of VLAN packets, - particularly QinQ (802.1ad) configurations where the hardware parser may - not support certain offload features. - - Validated using iptables to force small MSS values. Without the fix, - the adapter freezes. With the fix, packets are segmented in software - and transmission succeeds. Comprehensive regression testing completedd - (MSS tests, performance, stability). - - Fixes: 8641dd85799f ("ibmveth: Add support for TSO") - Cc: stable@vger.kernel.org - Reviewed-by: Brian King - Tested-by: Shaik Abdulla - Tested-by: Naveed Ahmed - Signed-off-by: Mingming Cao - Link: https://patch.msgid.link/20260424162917.65725-1-mmc@linux.ibm.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Mamatha Inamdar - -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 7f94e84..02a95cf 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1756,6 +1756,27 @@ static int ibmveth_set_mac_addr(struct net_device *dev, void *p) - return 0; - } - -+static netdev_features_t ibmveth_features_check(struct sk_buff *skb, -+ struct net_device *dev, -+ netdev_features_t features) -+{ -+ /* Some physical adapters do not support segmentation offload with -+ * MSS < 224. Disable GSO for such packets to avoid adapter freeze. -+ * Note: Single-segment packets (gso_segs == 1) don't need this check -+ * as they bypass the LSO path and are transmitted without segmentation. -+ */ -+ if (skb_is_gso(skb)) { -+ if (skb_shinfo(skb)->gso_size < IBMVETH_MIN_LSO_MSS) { -+ netdev_warn_once(dev, -+ "MSS %u too small for LSO, disabling GSO\n", -+ skb_shinfo(skb)->gso_size); -+ features &= ~NETIF_F_GSO_MASK; -+ } -+ } -+ -+ return vlan_features_check(skb, features); -+} -+ - static const struct net_device_ops ibmveth_netdev_ops = { - .ndo_open = ibmveth_open, - .ndo_stop = ibmveth_close, -@@ -1767,6 +1788,7 @@ static const struct net_device_ops ibmveth_netdev_ops = { - .ndo_set_features = ibmveth_set_features, - .ndo_validate_addr = eth_validate_addr, - .ndo_set_mac_address = ibmveth_set_mac_addr, -+ .ndo_features_check = ibmveth_features_check, - #ifdef CONFIG_NET_POLL_CONTROLLER - .ndo_poll_controller = ibmveth_poll_controller, - #endif -diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h -index dc8aae1..059ca49 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.h -+++ b/drivers/net/ethernet/ibm/ibmveth.h -@@ -37,6 +37,7 @@ - #define IBMVETH_ILLAN_IPV4_TCP_CSUM 0x0000000000000002UL - #define IBMVETH_ILLAN_ACTIVE_TRUNK 0x0000000000000001UL - -+#define IBMVETH_MIN_LSO_MSS 224 /* Minimum MSS for LSO */ - /* hcall macros */ - #define h_register_logical_lan(ua, buflst, rxq, fltlst, mac) \ - plpar_hcall_norets(H_REGISTER_LOGICAL_LAN, ua, buflst, rxq, fltlst, mac) diff --git a/SOURCES/1304-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch b/SOURCES/1304-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch deleted file mode 100644 index 54199c094..000000000 --- a/SOURCES/1304-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch +++ /dev/null @@ -1,66 +0,0 @@ -From 532af53c2c278d6a7197be0afd8b5d3839e686e3 Mon Sep 17 00:00:00 2001 -From: Mete Durlu -Date: Thu, 16 Apr 2026 18:10:09 +0200 -Subject: [PATCH] s390/mm: Add missing secure storage access fixups for donated - memory - -JIRA: https://redhat.atlassian.net/browse/RHEL-168793 -Conflicts: Conflicts due to rhel9 kernel version, no functional changes. - -commit b00be77302d7ec4ad0367bb236494fce7172b730 -Author: Janosch Frank -Date: Wed Mar 4 10:18:37 2026 +0000 - - s390/mm: Add missing secure storage access fixups for donated memory - - There are special cases where secure storage access exceptions happen - in a kernel context for pages that don't have the PG_arch_1 bit - set. That bit is set for non-exported guest secure storage (memory) - but is absent on storage donated to the Ultravisor since the kernel - isn't allowed to export donated pages. - - Prior to this patch we would try to export the page by calling - arch_make_folio_accessible() which would instantly return since the - arch bit is absent signifying that the page was already exported and - no further action is necessary. This leads to secure storage access - exception loops which can never be resolved. - - With this patch we unconditionally try to export and if that fails we - fixup. - - Fixes: 084ea4d611a3 ("s390/mm: add (non)secure page access exceptions handlers") - Reported-by: Heiko Carstens - Suggested-by: Heiko Carstens - Reviewed-by: Claudio Imbrenda - Tested-by: Christian Borntraeger - Signed-off-by: Janosch Frank - Signed-off-by: Christian Borntraeger - -Signed-off-by: Janosch Frank -Signed-off-by: Mete Durlu - -diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c -index 78adfec..1fb5815 100644 ---- a/arch/s390/mm/fault.c -+++ b/arch/s390/mm/fault.c -@@ -547,10 +547,18 @@ void do_secure_storage_access(struct pt_regs *regs) - page = phys_to_page(addr); - if (unlikely(!try_get_page(page))) - break; -- rc = arch_make_page_accessible(page); -+ -+ rc = uv_convert_from_secure(addr); -+ if (!rc) -+ clear_bit(PG_arch_1, &page->flags); - put_page(page); -+ /* -+ * There are some valid fixup types for kernel -+ * accesses to donated secure memory. zeropad is one -+ * of them. -+ */ - if (rc) -- BUG(); -+ return handle_fault_error_nolock(regs, 0); - break; - default: - unreachable(); diff --git a/SOURCES/1305-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch b/SOURCES/1305-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch deleted file mode 100644 index 22ae62c7a..000000000 --- a/SOURCES/1305-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 0a6ada5e5f985332a38b2ab39c21a5696a4cfdfb Mon Sep 17 00:00:00 2001 -From: Jaroslav Kysela -Date: Thu, 23 Apr 2026 11:04:41 +0200 -Subject: [PATCH] ALSA: usb-audio: Add sanity check for OOB writes at silencing - -JIRA: https://issues.redhat.com/browse/RHEL-168091 - -commit fba2105a157fffcf19825e4eea498346738c9948 -Author: Takashi Iwai -Date: Mon Feb 16 15:12:07 2026 +0100 - - ALSA: usb-audio: Add sanity check for OOB writes at silencing - - At silencing the playback URB packets in the implicit fb mode before - the actual playback, we blindly assume that the received packets fit - with the buffer size. But when the setup in the capture stream - differs from the playback stream (e.g. due to the USB core limitation - of max packet size), such an inconsistency may lead to OOB writes to - the buffer, resulting in a crash. - - For addressing it, add a sanity check of the transfer buffer size at - prepare_silent_urb(), and stop the data copy if the received data - overflows. Also, report back the transfer error properly from there, - too. - - Note that this doesn't fix the root cause of the playback error - itself, but this merely covers the kernel Oops. - - Link: https://bugzilla.kernel.org/show_bug.cgi?id=221076 - Link: https://patch.msgid.link/20260216141209.1849200-4-tiwai@suse.de - Signed-off-by: Takashi Iwai - -Signed-off-by: Jaroslav Kysela - -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index fc6c0cc..d30d1d4 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -275,8 +275,8 @@ static inline bool has_tx_length_quirk(struct snd_usb_audio *chip) - return chip->quirk_flags & QUIRK_FLAG_TX_LENGTH; - } - --static void prepare_silent_urb(struct snd_usb_endpoint *ep, -- struct snd_urb_ctx *ctx) -+static int prepare_silent_urb(struct snd_usb_endpoint *ep, -+ struct snd_urb_ctx *ctx) - { - struct urb *urb = ctx->urb; - unsigned int offs = 0; -@@ -289,28 +289,34 @@ static void prepare_silent_urb(struct snd_usb_endpoint *ep, - extra = sizeof(packet_length); - - for (i = 0; i < ctx->packets; ++i) { -- unsigned int offset; -- unsigned int length; -- int counts; -- -- counts = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); -- length = counts * ep->stride; /* number of silent bytes */ -- offset = offs * ep->stride + extra * i; -- urb->iso_frame_desc[i].offset = offset; -+ int length; -+ -+ length = snd_usb_endpoint_next_packet_size(ep, ctx, i, 0); -+ if (length < 0) -+ return length; -+ length *= ep->stride; /* number of silent bytes */ -+ if (offs + length + extra > ctx->buffer_size) -+ break; -+ urb->iso_frame_desc[i].offset = offs; - urb->iso_frame_desc[i].length = length + extra; - if (extra) { - packet_length = cpu_to_le32(length); -- memcpy(urb->transfer_buffer + offset, -+ memcpy(urb->transfer_buffer + offs, - &packet_length, sizeof(packet_length)); -+ offs += extra; - } -- memset(urb->transfer_buffer + offset + extra, -+ memset(urb->transfer_buffer + offs, - ep->silence_value, length); -- offs += counts; -+ offs += length; - } - -- urb->number_of_packets = ctx->packets; -- urb->transfer_buffer_length = offs * ep->stride + ctx->packets * extra; -+ if (!offs) -+ return -EPIPE; -+ -+ urb->number_of_packets = i; -+ urb->transfer_buffer_length = offs; - ctx->queued = 0; -+ return 0; - } - - /* -@@ -332,8 +338,7 @@ static int prepare_outbound_urb(struct snd_usb_endpoint *ep, - if (data_subs && ep->prepare_data_urb) - return ep->prepare_data_urb(data_subs, urb, in_stream_lock); - /* no data provider, so send silence */ -- prepare_silent_urb(ep, ctx); -- break; -+ return prepare_silent_urb(ep, ctx); - - case SND_USB_ENDPOINT_TYPE_SYNC: - if (snd_usb_get_speed(ep->chip->dev) >= USB_SPEED_HIGH) { diff --git a/SOURCES/1306-exit-prevent-preemption-of-oopsing-task-dead-task.patch b/SOURCES/1306-exit-prevent-preemption-of-oopsing-task-dead-task.patch deleted file mode 100644 index 078b7935d..000000000 --- a/SOURCES/1306-exit-prevent-preemption-of-oopsing-task-dead-task.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 2f3e5b5a77374869a5c36c783c310be9c26493e0 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 15:18:57 +0000 -Subject: [PATCH] exit: prevent preemption of oopsing TASK_DEAD task - -JIRA: https://redhat.atlassian.net/browse/RHEL-180008 -CVE: CVE-2026-46173 -Backported from tree(s): linux - -commit c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 -Author: Jann Horn -Date: Mon May 11 08:55:11 2026 -0700 - - exit: prevent preemption of oopsing TASK_DEAD task - - When an already-exiting task oopses, make_task_dead() currently calls - do_task_dead() with preemption enabled. That is forbidden: - do_task_dead() calls __schedule(), which has a comment saying "WARNING: - must be called with preemption disabled!". - - If an oopsing task is preempted in do_task_dead(), between becoming - TASK_DEAD and entering the scheduler explicitly, bad things happen: - finish_task_switch() assumes that once the scheduler has switched away - from a TASK_DEAD task, the task can never run again and its stack is no - longer needed; but that assumption apparently doesn't hold if the dead - task was preempted (the SM_PREEMPT case). - - This means that the scheduler ends up repeatedly dropping references on - the dead task's stack, which can lead to use-after-free or double-free - of the entire task stack; in other words, two tasks can end up running - on the same stack, resulting in various kinds of memory corruption. - - (This does not just affect "recursively oopsing" tasks; it is enough to - oops once during task exit, for example in a file_operations::release - handler) - - Fixes: 7f80a2fd7db9 ("exit: Stop poorly open coding do_task_dead in make_task_dead") - Cc: stable@kernel.org - Signed-off-by: Jann Horn - Acked-by: Peter Zijlstra - Signed-off-by: Linus Torvalds - -Signed-off-by: CKI Backport Bot - -diff --git a/kernel/exit.c b/kernel/exit.c -index aa08b46..6a1081a 100644 ---- a/kernel/exit.c -+++ b/kernel/exit.c -@@ -959,6 +959,7 @@ void __noreturn make_task_dead(int signr) - futex_exit_recursive(tsk); - tsk->exit_state = EXIT_DEAD; - refcount_inc(&tsk->rcu_users); -+ preempt_disable(); - do_task_dead(); - } - diff --git a/SOURCES/1307-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch b/SOURCES/1307-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch deleted file mode 100644 index e03ee2f1a..000000000 --- a/SOURCES/1307-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 159f2efabc89d3f931d38f2d35876535d4abf0a3 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Tue, 28 Apr 2026 13:17:38 -0300 -Subject: [PATCH] RDMA/mana: Remove user triggerable WARN_ON() in - mana_ib_create_qp_rss() - -Sashiko points out that the user can specify WQs sharing the same CQ as a -part of the uAPI and this will trigger the WARN_ON() then go on to corrupt -the kernel. - -Just reject it outright and fail the QP creation. - -Cc: stable@vger.kernel.org -Fixes: c15d7802a424 ("RDMA/mana_ib: Add CQ interrupt support for RAW QP") -Link: https://sashiko.dev/#/patchset/0-v2-1c49eeb88c48%2B91-rdma_udata_rep_jgg%40nvidia.com?part=1 -Link: https://patch.msgid.link/r/5-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Reviewed-by: Long Li -Signed-off-by: Jason Gunthorpe - -diff --git a/drivers/infiniband/hw/mana/cq.c b/drivers/infiniband/hw/mana/cq.c -index 1becc87..e3c3c7e 100644 ---- a/drivers/infiniband/hw/mana/cq.c -+++ b/drivers/infiniband/hw/mana/cq.c -@@ -140,8 +140,9 @@ int mana_ib_install_cq_cb(struct mana_ib_dev *mdev, struct mana_ib_cq *cq) - - if (cq->queue.id >= gc->max_num_cqs) - return -EINVAL; -- /* Create CQ table entry */ -- WARN_ON(gc->cq_table[cq->queue.id]); -+ /* Create CQ table entry, sharing a CQ between WQs is not supported */ -+ if (gc->cq_table[cq->queue.id]) -+ return -EINVAL; - if (cq->queue.kmem) - gdma_cq = cq->queue.kmem; - else diff --git a/SOURCES/1308-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch b/SOURCES/1308-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch deleted file mode 100644 index 6e75ad667..000000000 --- a/SOURCES/1308-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch +++ /dev/null @@ -1,94 +0,0 @@ -From 5293a8882c549fab4a878bc76b0b6c951f980a61 Mon Sep 17 00:00:00 2001 -From: Chaitanya Kulkarni -Date: Wed, 8 Apr 2026 00:51:31 -0700 -Subject: [PATCH] nvmet-tcp: fix race between ICReq handling and queue teardown - -nvmet_tcp_handle_icreq() updates queue->state after sending an -Initialization Connection Response (ICResp), but it does so without -serializing against target-side queue teardown. - -If an NVMe/TCP host sends an Initialization Connection Request -(ICReq) and immediately closes the connection, target-side teardown -may start in softirq context before io_work drains the already -buffered ICReq. In that case, nvmet_tcp_schedule_release_queue() -sets queue->state to NVMET_TCP_Q_DISCONNECTING and drops the queue -reference under state_lock. - -If io_work later processes that ICReq, nvmet_tcp_handle_icreq() can -still overwrite the state back to NVMET_TCP_Q_LIVE. That defeats the -DISCONNECTING-state guard in nvmet_tcp_schedule_release_queue() and -allows a later socket state change to re-enter teardown and issue a -second kref_put() on an already released queue. - -The ICResp send failure path has the same problem. If teardown has -already moved the queue to DISCONNECTING, a send error can still -overwrite the state with NVMET_TCP_Q_FAILED, again reopening the -window for a second teardown path to drop the queue reference. - -Fix this by serializing both post-send state transitions with -state_lock and bailing out if teardown has already started. - -Use -ESHUTDOWN as an internal sentinel for that bail-out path rather -than propagating it as a transport error like -ECONNRESET. Keep -nvmet_tcp_socket_error() setting rcv_state to NVMET_TCP_RECV_ERR before -honoring that sentinel so receive-side parsing stays quiesced until the -existing release path completes. - -Fixes: c46a6465bac2 ("nvmet-tcp: add NVMe over TCP target driver") -Cc: stable@vger.kernel.org -Reported-by: Shivam Kumar -Tested-by: Shivam Kumar -Signed-off-by: Chaitanya Kulkarni -Signed-off-by: Keith Busch - -diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c -index f899bf6..515df00 100644 ---- a/drivers/nvme/target/tcp.c -+++ b/drivers/nvme/target/tcp.c -@@ -390,6 +390,19 @@ static void nvmet_tcp_fatal_error(struct nvmet_tcp_queue *queue) - - static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status) - { -+ /* -+ * Keep rcv_state at RECV_ERR even for the internal -ESHUTDOWN path. -+ * nvmet_tcp_handle_icreq() can return -ESHUTDOWN after the ICReq has -+ * already been consumed and queue teardown has started. -+ * -+ * If nvmet_tcp_data_ready() or nvmet_tcp_write_space() queues -+ * nvmet_tcp_io_work() again before nvmet_tcp_release_queue_work() -+ * cancels it, the queue must not keep that old receive state. -+ * Otherwise the next nvmet_tcp_io_work() run can reach -+ * nvmet_tcp_done_recv_pdu() and try to handle the same ICReq again. -+ * -+ * That is why queue->rcv_state needs to be updated before we return. -+ */ - queue->rcv_state = NVMET_TCP_RECV_ERR; - if (status == -EPIPE || status == -ECONNRESET) - kernel_sock_shutdown(queue->sock, SHUT_RDWR); -@@ -893,10 +906,25 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue) - iov.iov_base = icresp; - iov.iov_len = sizeof(*icresp); - ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len); -- if (ret < 0) -+ if (ret < 0) { -+ spin_lock_bh(&queue->state_lock); -+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) { -+ spin_unlock_bh(&queue->state_lock); -+ return -ESHUTDOWN; -+ } -+ queue->state = NVMET_TCP_Q_FAILED; -+ spin_unlock_bh(&queue->state_lock); - return ret; /* queue removal will cleanup */ -+ } - -+ spin_lock_bh(&queue->state_lock); -+ if (queue->state == NVMET_TCP_Q_DISCONNECTING) { -+ spin_unlock_bh(&queue->state_lock); -+ /* Tell nvmet_tcp_socket_error() teardown is in progress. */ -+ return -ESHUTDOWN; -+ } - queue->state = NVMET_TCP_Q_LIVE; -+ spin_unlock_bh(&queue->state_lock); - nvmet_prepare_receive_pdu(queue); - return 0; - } diff --git a/SOURCES/1309-scsi-qla2xxx-completely-fix-fcport-double-free.patch b/SOURCES/1309-scsi-qla2xxx-completely-fix-fcport-double-free.patch deleted file mode 100644 index ff863739a..000000000 --- a/SOURCES/1309-scsi-qla2xxx-completely-fix-fcport-double-free.patch +++ /dev/null @@ -1,39 +0,0 @@ -From c0b7da13a04bd70ef6070bfb9ea85f582294560a Mon Sep 17 00:00:00 2001 -From: Vladimir Riabchun -Date: Tue, 10 Feb 2026 11:08:22 +0100 -Subject: [PATCH] scsi: qla2xxx: Completely fix fcport double free - -In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). -When an error happens, this function is called by qla2x00_sp_release(), -when kref_put() releases the first and the last reference. - -qla2x00_els_dcmd_sp_free() frees fcport by calling qla2x00_free_fcport(). -Doing it one more time after kref_put() is a bad idea. - -Fixes: 82f522ae0d97 ("scsi: qla2xxx: Fix double free of fcport") -Fixes: 4895009c4bb7 ("scsi: qla2xxx: Prevent command send on chip reset") -Signed-off-by: Vladimir Riabchun -Signed-off-by: Farhat Abbas -Link: https://patch.msgid.link/aYsDln9NFQQsPDgg@vova-pc -Signed-off-by: Martin K. Petersen - -diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c -index 0b41e8a..faec66b 100644 ---- a/drivers/scsi/qla2xxx/qla_iocb.c -+++ b/drivers/scsi/qla2xxx/qla_iocb.c -@@ -2751,7 +2751,6 @@ qla24xx_els_dcmd_iocb(scsi_qla_host_t *vha, int els_opcode, - if (!elsio->u.els_logo.els_logo_pyld) { - /* ref: INIT */ - kref_put(&sp->cmd_kref, qla2x00_sp_release); -- qla2x00_free_fcport(fcport); - return QLA_FUNCTION_FAILED; - } - -@@ -2776,7 +2775,6 @@ qla24xx_els_dcmd_iocb(scsi_qla_host_t *vha, int els_opcode, - if (rval != QLA_SUCCESS) { - /* ref: INIT */ - kref_put(&sp->cmd_kref, qla2x00_sp_release); -- qla2x00_free_fcport(fcport); - return QLA_FUNCTION_FAILED; - } - diff --git a/SOURCES/1310-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch b/SOURCES/1310-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch deleted file mode 100644 index 991e9a9be..000000000 --- a/SOURCES/1310-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch +++ /dev/null @@ -1,106 +0,0 @@ -From 8bf586044031efd9d9883a8b63a4eb28b111fa8f Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 19:40:07 +0000 -Subject: [PATCH] rbd: eliminate a race in lock_dwork draining on unmap - -JIRA: https://redhat.atlassian.net/browse/RHEL-180190 -Backported from tree(s): linux - -commit 9fc75b71fdd38465c76c6f6a884cdd4ae3c72d90 -Author: Ilya Dryomov -Date: Tue May 19 23:07:26 2026 +0200 - - rbd: eliminate a race in lock_dwork draining on unmap - - Given how rbd_lock_add_request() and rbd_img_exclusive_lock() are - written, lock_dwork may be (re)queued more than it's actually needed: - for example in case a new I/O request comes in while we are in the - middle of rbd_acquire_lock() on behalf of another I/O request. This is - expected and with rbd_release_lock() preemptively canceling lock_dwork - is benign under normal operation. - - A more problematic example is maybe_kick_acquire(): - - if (have_requests || delayed_work_pending(&rbd_dev->lock_dwork)) { - dout("%s rbd_dev %p kicking lock_dwork\n", __func__, rbd_dev); - mod_delayed_work(rbd_dev->task_wq, &rbd_dev->lock_dwork, 0); - } - - It's not unrealistic for lock_dwork to get canceled right after - delayed_work_pending() returns true and for mod_delayed_work() to - requeue it right there anyway. This is a classic TOCTOU race. - - When it comes to unmapping the image, there is an implicit assumption - of no self-initiated exclusive lock activity past the point of return - from rbd_dev_image_unlock() which unlocks the lock if it happens to be - held. This unlock is assumed to be final and lock_dwork (as well as - all other exclusive lock tasks, really) isn't expected to get queued - again. However, lock_dwork is canceled only in cancel_tasks_sync() - (i.e. later in the unmap sequence) and on top of that the cancellation - can get in effect nullified by maybe_kick_acquire(). This may result - in rbd_acquire_lock() executing after rbd_dev_device_release() and - rbd_dev_image_release() run and free and/or reset a bunch of things. - One of the possible failure modes then is a violated - - rbd_assert(rbd_image_format_valid(rbd_dev->image_format)); - - in rbd_dev_header_info() which is called via rbd_dev_refresh() from - rbd_post_acquire_action(). - - Redo exclusive lock task draining to provide saner semantics and try - to meet the assumptions around rbd_dev_image_unlock(). - - Cc: stable@vger.kernel.org - Signed-off-by: Ilya Dryomov - Reviewed-by: Viacheslav Dubeyko - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index c82ec46..bfa3bae 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -4547,24 +4547,12 @@ static int rbd_register_watch(struct rbd_device *rbd_dev) - return ret; - } - --static void cancel_tasks_sync(struct rbd_device *rbd_dev) --{ -- dout("%s rbd_dev %p\n", __func__, rbd_dev); -- -- cancel_work_sync(&rbd_dev->acquired_lock_work); -- cancel_work_sync(&rbd_dev->released_lock_work); -- cancel_delayed_work_sync(&rbd_dev->lock_dwork); -- cancel_work_sync(&rbd_dev->unlock_work); --} -- - /* - * header_rwsem must not be held to avoid a deadlock with - * rbd_dev_refresh() when flushing notifies. - */ - static void rbd_unregister_watch(struct rbd_device *rbd_dev) - { -- cancel_tasks_sync(rbd_dev); -- - mutex_lock(&rbd_dev->watch_mutex); - if (rbd_dev->watch_state == RBD_WATCH_STATE_REGISTERED) - __rbd_unregister_watch(rbd_dev); -@@ -6541,10 +6529,18 @@ static int rbd_add_parse_args(const char *buf, - - static void rbd_dev_image_unlock(struct rbd_device *rbd_dev) - { -+ dout("%s rbd_dev %p\n", __func__, rbd_dev); -+ -+ disable_delayed_work_sync(&rbd_dev->lock_dwork); -+ disable_work_sync(&rbd_dev->unlock_work); -+ - down_write(&rbd_dev->lock_rwsem); - if (__rbd_is_lock_owner(rbd_dev)) - __rbd_release_lock(rbd_dev); - up_write(&rbd_dev->lock_rwsem); -+ -+ flush_work(&rbd_dev->acquired_lock_work); -+ flush_work(&rbd_dev->released_lock_work); - } - - /* diff --git a/SOURCES/1311-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch b/SOURCES/1311-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch deleted file mode 100644 index 637016ac4..000000000 --- a/SOURCES/1311-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch +++ /dev/null @@ -1,224 +0,0 @@ -From 899ee91156e57784090c5565e4f31bd7dbffbc5a Mon Sep 17 00:00:00 2001 -From: Rajat Gupta -Date: Sun, 31 May 2026 08:32:21 -0400 -Subject: [PATCH] net/sched: fix pedit partial COW leading to page cache - corruption -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -tcf_pedit_act() computes the COW range for skb_ensure_writable() -once before the key loop using tcfp_off_max_hint, but the hint does -not account for the runtime header offset added by typed keys. This -can leave part of the write region un-COW'd. - -Fix by moving skb_ensure_writable() inside the per-key loop where -the actual write offset is known, and add overflow checking on the -offset arithmetic. For negative offsets (e.g. Ethernet header edits -at ingress), use skb_cow() to COW the headroom instead. Guard -offset_valid() against INT_MIN, where negation is undefined. - -Fixes: 8b796475fd78 ("net/sched: act_pedit: really ensure the skb is writable") -Reported-by: Yiming Qian -Reported-by: Keenan Dong -Reported-by: Han Guidong <2045gemini@gmail.com> -Reported-by: Zhang Cen -Reviewed-by: Han Guidong <2045gemini@gmail.com> -Tested-by: Han Guidong <2045gemini@gmail.com> -Reviewed-by: Davide Caratti -Tested-by: Davide Caratti -Reviewed-by: Toke Høiland-Jørgensen -Tested-by: Toke Høiland-Jørgensen -Reviewed-by: Victor Nogueira -Tested-by: Victor Nogueira -Acked-by: Jamal Hadi Salim -Signed-off-by: Rajat Gupta -Link: https://patch.msgid.link/20260531123221.48732-1-jhs@mojatatu.com -Signed-off-by: Jakub Kicinski - -diff --git a/include/net/tc_act/tc_pedit.h b/include/net/tc_act/tc_pedit.h -index 83fe399..a26d4cd 100644 ---- a/include/net/tc_act/tc_pedit.h -+++ b/include/net/tc_act/tc_pedit.h -@@ -14,7 +14,6 @@ struct tcf_pedit_key_ex { - struct tcf_pedit_parms { - struct tc_pedit_key *tcfp_keys; - struct tcf_pedit_key_ex *tcfp_keys_ex; -- u32 tcfp_off_max_hint; - unsigned char tcfp_nkeys; - unsigned char tcfp_flags; - struct rcu_head rcu; -diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c -index fc0a35a..495cc56 100644 ---- a/net/sched/act_pedit.c -+++ b/net/sched/act_pedit.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -24,6 +25,7 @@ - #include - #include - #include -+#include - - static struct tc_action_ops act_pedit_ops; - -@@ -242,7 +244,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - goto out_free_ex; - } - -- nparms->tcfp_off_max_hint = 0; - nparms->tcfp_flags = parm->flags; - nparms->tcfp_nkeys = parm->nkeys; - -@@ -268,14 +269,6 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, - BITS_PER_TYPE(int) - 1, - nparms->tcfp_keys[i].shift); - -- /* The AT option can read a single byte, we can bound the actual -- * value with uchar max. -- */ -- cur += (0xff & offmask) >> nparms->tcfp_keys[i].shift; -- -- /* Each key touches 4 bytes starting from the computed offset */ -- nparms->tcfp_off_max_hint = -- max(nparms->tcfp_off_max_hint, cur + 4); - } - - p = to_pedit(*a); -@@ -318,15 +311,12 @@ static void tcf_pedit_cleanup(struct tc_action *a) - call_rcu(&parms->rcu, tcf_pedit_cleanup_rcu); - } - --static bool offset_valid(struct sk_buff *skb, int offset) -+static bool offset_valid(struct sk_buff *skb, int offset, int len) - { -- if (offset > 0 && offset > skb->len) -- return false; -- -- if (offset < 0 && -offset > skb_headroom(skb)) -+ if (offset < -(int)skb_headroom(skb)) - return false; - -- return true; -+ return offset <= (int)skb->len - len; - } - - static int pedit_l4_skb_offset(struct sk_buff *skb, int *hoffset, const int header_type) -@@ -393,18 +383,10 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - struct tcf_pedit_key_ex *tkey_ex; - struct tcf_pedit_parms *parms; - struct tc_pedit_key *tkey; -- u32 max_offset; - int i; - - parms = rcu_dereference_bh(p->parms); - -- max_offset = (skb_transport_header_was_set(skb) ? -- skb_transport_offset(skb) : -- skb_network_offset(skb)) + -- parms->tcfp_off_max_hint; -- if (skb_ensure_writable(skb, min(skb->len, max_offset))) -- goto done; -- - tcf_lastuse_update(&p->tcf_tm); - tcf_action_update_bstats(&p->common, skb); - -@@ -412,10 +394,11 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - tkey_ex = parms->tcfp_keys_ex; - - for (i = parms->tcfp_nkeys; i > 0; i--, tkey++) { -+ int write_offset, write_len; - int offset = tkey->off; - int hoffset = 0; -- u32 *ptr, hdata; -- u32 val; -+ u32 cur_val, val; -+ u32 *ptr; - int rc; - - if (tkey_ex) { -@@ -433,13 +416,15 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - - if (tkey->offmask) { - u8 *d, _d; -+ int at_offset; - -- if (!offset_valid(skb, hoffset + tkey->at)) { -+ if (check_add_overflow(hoffset, (int)tkey->at, &at_offset) || -+ !offset_valid(skb, at_offset, sizeof(_d))) { - pr_info_ratelimited("tc action pedit 'at' offset %d out of bounds\n", - hoffset + tkey->at); - goto bad; - } -- d = skb_header_pointer(skb, hoffset + tkey->at, -+ d = skb_header_pointer(skb, at_offset, - sizeof(_d), &_d); - if (!d) - goto bad; -@@ -451,31 +436,51 @@ TC_INDIRECT_SCOPE int tcf_pedit_act(struct sk_buff *skb, - } - } - -- if (!offset_valid(skb, hoffset + offset)) { -- pr_info_ratelimited("tc action pedit offset %d out of bounds\n", hoffset + offset); -+ if (check_add_overflow(hoffset, offset, &write_offset)) { -+ pr_info_ratelimited("tc action pedit offset overflow\n"); - goto bad; - } - -- ptr = skb_header_pointer(skb, hoffset + offset, -- sizeof(hdata), &hdata); -- if (!ptr) -+ if (!offset_valid(skb, write_offset, sizeof(*ptr))) { -+ pr_info_ratelimited("tc action pedit offset %d out of bounds\n", -+ write_offset); - goto bad; -+ } -+ -+ if (write_offset < 0) { -+ if (skb_cow(skb, -write_offset)) -+ goto bad; -+ if (write_offset + (int)sizeof(*ptr) > 0) { -+ if (skb_ensure_writable(skb, -+ min_t(int, skb->len, -+ write_offset + (int)sizeof(*ptr)))) -+ goto bad; -+ } -+ } else { -+ if (check_add_overflow(write_offset, (int)sizeof(*ptr), -+ &write_len)) -+ goto bad; -+ if (skb_ensure_writable(skb, min_t(int, skb->len, -+ write_len))) -+ goto bad; -+ } -+ -+ ptr = (u32 *)(skb->data + write_offset); -+ cur_val = get_unaligned(ptr); - /* just do it, baby */ - switch (cmd) { - case TCA_PEDIT_KEY_EX_CMD_SET: - val = tkey->val; - break; - case TCA_PEDIT_KEY_EX_CMD_ADD: -- val = (*ptr + tkey->val) & ~tkey->mask; -+ val = (cur_val + tkey->val) & ~tkey->mask; - break; - default: - pr_info_ratelimited("tc action pedit bad command (%d)\n", cmd); - goto bad; - } - -- *ptr = ((*ptr & tkey->mask) ^ val); -- if (ptr == &hdata) -- skb_store_bits(skb, hoffset + offset, ptr, 4); -+ put_unaligned((cur_val & tkey->mask) ^ val, ptr); - } - - goto done; diff --git a/SOURCES/1312-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch b/SOURCES/1312-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch deleted file mode 100644 index 84bd1aab5..000000000 --- a/SOURCES/1312-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 13031fb6b8357fbbcded2a7f4cba73e4781ee594 Mon Sep 17 00:00:00 2001 -From: Hyunwoo Kim -Date: Mon, 1 Jun 2026 23:53:26 +0900 -Subject: [PATCH] KVM: arm64: vgic-its: Drop the translation cache reference - only for the erased entry - -vgic_its_invalidate_cache() walks the per-ITS translation cache with -xa_for_each() and drops the cache's reference on each entry with -vgic_put_irq(). It puts the iterated pointer, though, rather than the -value returned by xa_erase(). - -The function is called from contexts that do not exclude one another: the -ITS command handlers hold its_lock, the GITS_CTLR write path holds -cmd_lock, and the path that clears EnableLPIs in a redistributor's -GICR_CTLR holds neither. Two or more of them can drain the same cache -concurrently, and if each one observes the same entry, erases it and then -puts it, the single reference the cache holds on that entry is dropped -more than once. The entry can then be freed while an ITE still maps it. - -xa_erase() is atomic and returns the previous entry, so put only the entry -that this context actually removed. The cache reference is then dropped -exactly once per entry even when the invalidations run concurrently, and -the behavior is unchanged when only one context runs. - -Fixes: 8201d1028caa ("KVM: arm64: vgic-its: Maintain a translation cache per ITS") -Signed-off-by: Hyunwoo Kim -Reviewed-by: Oliver Upton -Link: https://patch.msgid.link/ah2c5lu4JbUg7dj-@v4bel -Signed-off-by: Marc Zyngier -Cc: stable@vger.kernel.org - -diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c -index 1d7e5d560af4..1e3706ac3b8e 100644 ---- a/arch/arm64/kvm/vgic/vgic-its.c -+++ b/arch/arm64/kvm/vgic/vgic-its.c -@@ -597,8 +597,10 @@ static void vgic_its_invalidate_cache(struct vgic_its *its) - unsigned long idx; - - xa_for_each(&its->translation_cache, idx, irq) { -- xa_erase(&its->translation_cache, idx); -- vgic_put_irq(kvm, irq); -+ /* Only the context that erases the entry drops its cache ref. */ -+ irq = xa_erase(&its->translation_cache, idx); -+ if (irq) -+ vgic_put_irq(kvm, irq); - } - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1313-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch b/SOURCES/1313-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch deleted file mode 100644 index 3b186a1e5..000000000 --- a/SOURCES/1313-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch +++ /dev/null @@ -1,508 +0,0 @@ -From 23e3d86443306f1ab3a60ea10e0a8403ecbbdb27 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Fri, 15 May 2026 17:29:34 +0000 -Subject: [PATCH] netfilter: flowtable: strictly check for maximum number of - actions - -JIRA: https://redhat.atlassian.net/browse/RHEL-176922 -CVE: CVE-2026-43329 - -commit 76522fcdbc3a02b568f5d957f7e66fc194abb893 -Author: Pablo Neira Ayuso -Date: Thu Mar 26 00:17:09 2026 +0100 - - netfilter: flowtable: strictly check for maximum number of actions - - The maximum number of flowtable hardware offload actions in IPv6 is: - - * ethernet mangling (4 payload actions, 2 for each ethernet address) - * SNAT (4 payload actions) - * DNAT (4 payload actions) - * Double VLAN (4 vlan actions, 2 for popping vlan, and 2 for pushing) - for QinQ. - * Redirect (1 action) - - Which makes 17, while the maximum is 16. But act_ct supports for tunnels - actions too. Note that payload action operates at 32-bit word level, so - mangling an IPv6 address takes 4 payload actions. - - Update flow_action_entry_next() calls to check for the maximum number of - supported actions. - - While at it, rise the maximum number of actions per flow from 16 to 24 - so this works fine with IPv6 setups. - - Fixes: c29f74e0df7a ("netfilter: nf_flow_table: hardware offload support") - Reported-by: Hyunwoo Kim - Signed-off-by: Pablo Neira Ayuso - -Signed-off-by: CKI Backport Bot - -diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c -index e59fa3be408c..0f3bccc69b57 100644 ---- a/net/netfilter/nf_flow_table_offload.c -+++ b/net/netfilter/nf_flow_table_offload.c -@@ -13,6 +13,8 @@ - #include - #include - -+#define NF_FLOW_RULE_ACTION_MAX 24 -+ - static struct workqueue_struct *nf_flow_offload_add_wq; - static struct workqueue_struct *nf_flow_offload_del_wq; - static struct workqueue_struct *nf_flow_offload_stats_wq; -@@ -208,7 +210,12 @@ static void flow_offload_mangle(struct flow_action_entry *entry, - static inline struct flow_action_entry * - flow_action_entry_next(struct nf_flow_rule *flow_rule) - { -- int i = flow_rule->rule->action.num_entries++; -+ int i; -+ -+ if (unlikely(flow_rule->rule->action.num_entries >= NF_FLOW_RULE_ACTION_MAX)) -+ return NULL; -+ -+ i = flow_rule->rule->action.num_entries++; - - return &flow_rule->rule->action.entries[i]; - } -@@ -226,6 +233,9 @@ static int flow_offload_eth_src(struct net *net, - u32 mask, val; - u16 val16; - -+ if (!entry0 || !entry1) -+ return -E2BIG; -+ - this_tuple = &flow->tuplehash[dir].tuple; - - switch (this_tuple->xmit_type) { -@@ -276,6 +286,9 @@ static int flow_offload_eth_dst(struct net *net, - u8 nud_state; - u16 val16; - -+ if (!entry0 || !entry1) -+ return -E2BIG; -+ - this_tuple = &flow->tuplehash[dir].tuple; - - switch (this_tuple->xmit_type) { -@@ -317,16 +330,19 @@ static int flow_offload_eth_dst(struct net *net, - return 0; - } - --static void flow_offload_ipv4_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask = ~htonl(0xffffffff); - __be32 addr; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_v4.s_addr; -@@ -337,23 +353,27 @@ static void flow_offload_ipv4_snat(struct net *net, - offset = offsetof(struct iphdr, daddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset, - &addr, &mask); -+ return 0; - } - --static void flow_offload_ipv4_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask = ~htonl(0xffffffff); - __be32 addr; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - addr = flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_v4.s_addr; -@@ -364,14 +384,15 @@ static void flow_offload_ipv4_dnat(struct net *net, - offset = offsetof(struct iphdr, saddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP4, offset, - &addr, &mask); -+ return 0; - } - --static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, -+static int flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, - unsigned int offset, - const __be32 *addr, const __be32 *mask) - { -@@ -380,15 +401,20 @@ static void flow_offload_ipv6_mangle(struct nf_flow_rule *flow_rule, - - for (i = 0; i < sizeof(struct in6_addr) / sizeof(u32); i++) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; -+ - flow_offload_mangle(entry, FLOW_ACT_MANGLE_HDR_TYPE_IP6, - offset + i * sizeof(u32), &addr[i], mask); - } -+ -+ return 0; - } - --static void flow_offload_ipv6_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv6_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - u32 mask = ~htonl(0xffffffff); - const __be32 *addr; -@@ -404,16 +430,16 @@ static void flow_offload_ipv6_snat(struct net *net, - offset = offsetof(struct ipv6hdr, daddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - -- flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); -+ return flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); - } - --static void flow_offload_ipv6_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv6_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - u32 mask = ~htonl(0xffffffff); - const __be32 *addr; -@@ -429,10 +455,10 @@ static void flow_offload_ipv6_dnat(struct net *net, - offset = offsetof(struct ipv6hdr, saddr); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - -- flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); -+ return flow_offload_ipv6_mangle(flow_rule, offset, addr, &mask); - } - - static int flow_offload_l4proto(const struct flow_offload *flow) -@@ -454,15 +480,18 @@ static int flow_offload_l4proto(const struct flow_offload *flow) - return type; - } - --static void flow_offload_port_snat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_port_snat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask, port; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.dst_port); -@@ -477,22 +506,26 @@ static void flow_offload_port_snat(struct net *net, - mask = ~htonl(0xffff); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, flow_offload_l4proto(flow), offset, - &port, &mask); -+ return 0; - } - --static void flow_offload_port_dnat(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_port_dnat(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - u32 mask, port; - u32 offset; - -+ if (!entry) -+ return -E2BIG; -+ - switch (dir) { - case FLOW_OFFLOAD_DIR_ORIGINAL: - port = ntohs(flow->tuplehash[FLOW_OFFLOAD_DIR_REPLY].tuple.src_port); -@@ -507,20 +540,24 @@ static void flow_offload_port_dnat(struct net *net, - mask = ~htonl(0xffff0000); - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - flow_offload_mangle(entry, flow_offload_l4proto(flow), offset, - &port, &mask); -+ return 0; - } - --static void flow_offload_ipv4_checksum(struct net *net, -- const struct flow_offload *flow, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_ipv4_checksum(struct net *net, -+ const struct flow_offload *flow, -+ struct nf_flow_rule *flow_rule) - { - u8 protonum = flow->tuplehash[FLOW_OFFLOAD_DIR_ORIGINAL].tuple.l4proto; - struct flow_action_entry *entry = flow_action_entry_next(flow_rule); - -+ if (!entry) -+ return -E2BIG; -+ - entry->id = FLOW_ACTION_CSUM; - entry->csum_flags = TCA_CSUM_UPDATE_FLAG_IPV4HDR; - -@@ -532,12 +569,14 @@ static void flow_offload_ipv4_checksum(struct net *net, - entry->csum_flags |= TCA_CSUM_UPDATE_FLAG_UDP; - break; - } -+ -+ return 0; - } - --static void flow_offload_redirect(struct net *net, -- const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_redirect(struct net *net, -+ const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *this_tuple, *other_tuple; - struct flow_action_entry *entry; -@@ -555,21 +594,28 @@ static void flow_offload_redirect(struct net *net, - ifindex = other_tuple->iifidx; - break; - default: -- return; -+ return -EOPNOTSUPP; - } - - dev = dev_get_by_index(net, ifindex); - if (!dev) -- return; -+ return -ENODEV; - - entry = flow_action_entry_next(flow_rule); -+ if (!entry) { -+ dev_put(dev); -+ return -E2BIG; -+ } -+ - entry->id = FLOW_ACTION_REDIRECT; - entry->dev = dev; -+ -+ return 0; - } - --static void flow_offload_encap_tunnel(const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_encap_tunnel(const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *this_tuple; - struct flow_action_entry *entry; -@@ -577,7 +623,7 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, - - this_tuple = &flow->tuplehash[dir].tuple; - if (this_tuple->xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) -- return; -+ return 0; - - dst = this_tuple->dst_cache; - if (dst && dst->lwtstate) { -@@ -586,15 +632,19 @@ static void flow_offload_encap_tunnel(const struct flow_offload *flow, - tun_info = lwt_tun_info(dst->lwtstate); - if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; - entry->id = FLOW_ACTION_TUNNEL_ENCAP; - entry->tunnel = tun_info; - } - } -+ -+ return 0; - } - --static void flow_offload_decap_tunnel(const struct flow_offload *flow, -- enum flow_offload_tuple_dir dir, -- struct nf_flow_rule *flow_rule) -+static int flow_offload_decap_tunnel(const struct flow_offload *flow, -+ enum flow_offload_tuple_dir dir, -+ struct nf_flow_rule *flow_rule) - { - const struct flow_offload_tuple *other_tuple; - struct flow_action_entry *entry; -@@ -602,7 +652,7 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, - - other_tuple = &flow->tuplehash[!dir].tuple; - if (other_tuple->xmit_type == FLOW_OFFLOAD_XMIT_DIRECT) -- return; -+ return 0; - - dst = other_tuple->dst_cache; - if (dst && dst->lwtstate) { -@@ -611,9 +661,13 @@ static void flow_offload_decap_tunnel(const struct flow_offload *flow, - tun_info = lwt_tun_info(dst->lwtstate); - if (tun_info && (tun_info->mode & IP_TUNNEL_INFO_TX)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -E2BIG; - entry->id = FLOW_ACTION_TUNNEL_DECAP; - } - } -+ -+ return 0; - } - - static int -@@ -625,8 +679,9 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - const struct flow_offload_tuple *tuple; - int i; - -- flow_offload_decap_tunnel(flow, dir, flow_rule); -- flow_offload_encap_tunnel(flow, dir, flow_rule); -+ if (flow_offload_decap_tunnel(flow, dir, flow_rule) < 0 || -+ flow_offload_encap_tunnel(flow, dir, flow_rule) < 0) -+ return -1; - - if (flow_offload_eth_src(net, flow, dir, flow_rule) < 0 || - flow_offload_eth_dst(net, flow, dir, flow_rule) < 0) -@@ -642,6 +697,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - - if (tuple->encap[i].proto == htons(ETH_P_8021Q)) { - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -1; - entry->id = FLOW_ACTION_VLAN_POP; - } - } -@@ -655,6 +712,8 @@ nf_flow_rule_route_common(struct net *net, const struct flow_offload *flow, - continue; - - entry = flow_action_entry_next(flow_rule); -+ if (!entry) -+ return -1; - - switch (other_tuple->encap[i].proto) { - case htons(ETH_P_PPP_SES): -@@ -680,18 +739,22 @@ int nf_flow_rule_route_ipv4(struct net *net, struct flow_offload *flow, - return -1; - - if (test_bit(NF_FLOW_SNAT, &flow->flags)) { -- flow_offload_ipv4_snat(net, flow, dir, flow_rule); -- flow_offload_port_snat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv4_snat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_snat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_DNAT, &flow->flags)) { -- flow_offload_ipv4_dnat(net, flow, dir, flow_rule); -- flow_offload_port_dnat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv4_dnat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_dnat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_SNAT, &flow->flags) || - test_bit(NF_FLOW_DNAT, &flow->flags)) -- flow_offload_ipv4_checksum(net, flow, flow_rule); -+ if (flow_offload_ipv4_checksum(net, flow, flow_rule) < 0) -+ return -1; - -- flow_offload_redirect(net, flow, dir, flow_rule); -+ if (flow_offload_redirect(net, flow, dir, flow_rule) < 0) -+ return -1; - - return 0; - } -@@ -705,22 +768,23 @@ int nf_flow_rule_route_ipv6(struct net *net, struct flow_offload *flow, - return -1; - - if (test_bit(NF_FLOW_SNAT, &flow->flags)) { -- flow_offload_ipv6_snat(net, flow, dir, flow_rule); -- flow_offload_port_snat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv6_snat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_snat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - if (test_bit(NF_FLOW_DNAT, &flow->flags)) { -- flow_offload_ipv6_dnat(net, flow, dir, flow_rule); -- flow_offload_port_dnat(net, flow, dir, flow_rule); -+ if (flow_offload_ipv6_dnat(net, flow, dir, flow_rule) < 0 || -+ flow_offload_port_dnat(net, flow, dir, flow_rule) < 0) -+ return -1; - } - -- flow_offload_redirect(net, flow, dir, flow_rule); -+ if (flow_offload_redirect(net, flow, dir, flow_rule) < 0) -+ return -1; - - return 0; - } - EXPORT_SYMBOL_GPL(nf_flow_rule_route_ipv6); - --#define NF_FLOW_RULE_ACTION_MAX 16 -- - static struct nf_flow_rule * - nf_flow_offload_rule_alloc(struct net *net, - const struct flow_offload_work *offload, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1314-drm-amd-display-do-not-skip-unrelated-mode-changes-in-dsc-va.patch b/SOURCES/1314-drm-amd-display-do-not-skip-unrelated-mode-changes-in-dsc-va.patch deleted file mode 100644 index 2672ad9a8..000000000 --- a/SOURCES/1314-drm-amd-display-do-not-skip-unrelated-mode-changes-in-dsc-va.patch +++ /dev/null @@ -1,112 +0,0 @@ -From aed3d041ab061ec8a64f50a3edda0f4db7280025 Mon Sep 17 00:00:00 2001 -From: Yussuf Khalil -Date: Fri, 6 Mar 2026 12:06:35 +0000 -Subject: [PATCH] drm/amd/display: Do not skip unrelated mode changes in DSC - validation - -Starting with commit 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in -atomic check"), amdgpu resets the CRTC state mode_changed flag to false when -recomputing the DSC configuration results in no timing change for a particular -stream. - -However, this is incorrect in scenarios where a change in MST/DSC configuration -happens in the same KMS commit as another (unrelated) mode change. For example, -the integrated panel of a laptop may be configured differently (e.g., HDR -enabled/disabled) depending on whether external screens are attached. In this -case, plugging in external DP-MST screens may result in the mode_changed flag -being dropped incorrectly for the integrated panel if its DSC configuration -did not change during precomputation in pre_validate_dsc(). - -At this point, however, dm_update_crtc_state() has already created new streams -for CRTCs with DSC-independent mode changes. In turn, -amdgpu_dm_commit_streams() will never release the old stream, resulting in a -memory leak. amdgpu_dm_atomic_commit_tail() will never acquire a reference to -the new stream either, which manifests as a use-after-free when the stream gets -disabled later on: - -BUG: KASAN: use-after-free in dc_stream_release+0x25/0x90 [amdgpu] -Write of size 4 at addr ffff88813d836524 by task kworker/9:9/29977 - -Workqueue: events drm_mode_rmfb_work_fn -Call Trace: - - dump_stack_lvl+0x6e/0xa0 - print_address_description.constprop.0+0x88/0x320 - ? dc_stream_release+0x25/0x90 [amdgpu] - print_report+0xfc/0x1ff - ? srso_alias_return_thunk+0x5/0xfbef5 - ? __virt_addr_valid+0x225/0x4e0 - ? dc_stream_release+0x25/0x90 [amdgpu] - kasan_report+0xe1/0x180 - ? dc_stream_release+0x25/0x90 [amdgpu] - kasan_check_range+0x125/0x200 - dc_stream_release+0x25/0x90 [amdgpu] - dc_state_destruct+0x14d/0x5c0 [amdgpu] - dc_state_release.part.0+0x4e/0x130 [amdgpu] - dm_atomic_destroy_state+0x3f/0x70 [amdgpu] - drm_atomic_state_default_clear+0x8ee/0xf30 - ? drm_mode_object_put.part.0+0xb1/0x130 - __drm_atomic_state_free+0x15c/0x2d0 - atomic_remove_fb+0x67e/0x980 - -Since there is no reliable way of figuring out whether a CRTC has unrelated -mode changes pending at the time of DSC validation, remember the value of the -mode_changed flag from before the point where a CRTC was marked as potentially -affected by a change in DSC configuration. Reset the mode_changed flag to this -earlier value instead in pre_validate_dsc(). - -Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/5004 -Fixes: 17ce8a6907f7 ("drm/amd/display: Add dsc pre-validation in atomic check") -Signed-off-by: Yussuf Khalil -Reviewed-by: Harry Wentland -Signed-off-by: Alex Deucher -(cherry picked from commit cc7c7121ae082b7b82891baa7280f1ff2608f22b) - -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -index 085cc98bd875..a9c398b1516b 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c -@@ -12523,6 +12523,11 @@ static int amdgpu_dm_atomic_check(struct drm_device *dev, - } - - if (dc_resource_is_dsc_encoding_supported(dc)) { -+ for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { -+ dm_new_crtc_state = to_dm_crtc_state(new_crtc_state); -+ dm_new_crtc_state->mode_changed_independent_from_dsc = new_crtc_state->mode_changed; -+ } -+ - for_each_oldnew_crtc_in_state(state, crtc, old_crtc_state, new_crtc_state, i) { - if (drm_atomic_crtc_needs_modeset(new_crtc_state)) { - ret = add_affected_mst_dsc_crtcs(state, crtc); -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -index 800813671748..d15812d51d72 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.h -@@ -984,6 +984,7 @@ struct dm_crtc_state { - - bool freesync_vrr_info_changed; - -+ bool mode_changed_independent_from_dsc; - bool dsc_force_changed; - bool vrr_supported; - struct mod_freesync_config freesync_config; -diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -index 7be50e8c0636..5d8c4c7020b1 100644 ---- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_mst_types.c -@@ -1744,9 +1744,11 @@ int pre_validate_dsc(struct drm_atomic_state *state, - int ind = find_crtc_index_in_state_by_stream(state, stream); - - if (ind >= 0) { -+ struct dm_crtc_state *dm_new_crtc_state = to_dm_crtc_state(state->crtcs[ind].new_state); -+ - DRM_INFO_ONCE("%s:%d MST_DSC no mode changed for stream 0x%p\n", - __func__, __LINE__, stream); -- state->crtcs[ind].new_state->mode_changed = 0; -+ dm_new_crtc_state->base.mode_changed = dm_new_crtc_state->mode_changed_independent_from_dsc; - } - } - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1315-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch b/SOURCES/1315-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch deleted file mode 100644 index 8c6c89bdf..000000000 --- a/SOURCES/1315-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 0452b6526b2f54b2413b9cb4ff1ea2ac542c99c7 Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Thu, 26 Mar 2026 20:26:08 +0000 -Subject: [PATCH] ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() - -[ Upstream commit 86ab3e55673a7a49a841838776f1ab18d23a67b5 ] - -Sashiko AI-review observed: - - In ip6_err_gen_icmpv6_unreach(), the skb is an outer IPv4 ICMP error packet - where its cb contains an IPv4 inet_skb_parm. When skb is cloned into skb2 - and passed to icmp6_send(), it uses IP6CB(skb2). - - IP6CB interprets the IPv4 inet_skb_parm as an inet6_skb_parm. The cipso - offset in inet_skb_parm.opt directly overlaps with dsthao in inet6_skb_parm - at offset 18. - - If an attacker sends a forged ICMPv4 error with a CIPSO IP option, dsthao - would be a non-zero offset. Inside icmp6_send(), mip6_addr_swap() is called - and uses ipv6_find_tlv(skb, opt->dsthao, IPV6_TLV_HAO). - - This would scan the inner, attacker-controlled IPv6 packet starting at that - offset, potentially returning a fake TLV without checking if the remaining - packet length can hold the full 18-byte struct ipv6_destopt_hao. - - Could mip6_addr_swap() then perform a 16-byte swap that extends past the end - of the packet data into skb_shared_info? - - Should the cb array also be cleared in ip6_err_gen_icmpv6_unreach() and - ip6ip6_err() to prevent this? - -This patch implements the first suggestion. - -I am not sure if ip6ip6_err() needs to be changed. -A separate patch would be better anyway. - -Fixes: ca15a078bd90 ("sit: generate icmpv6 error when receiving icmpv4 error") -Reported-by: Ido Schimmel -Closes: https://sashiko.dev/#/patchset/20260326155138.2429480-1-edumazet%40google.com -Signed-off-by: Eric Dumazet -Cc: Oskar Kjos -Reviewed-by: Ido Schimmel -Link: https://patch.msgid.link/20260326202608.2976021-1-edumazet@google.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c -index 8601c76f3cc9..6f053874de74 100644 ---- a/net/ipv6/icmp.c -+++ b/net/ipv6/icmp.c -@@ -674,6 +674,9 @@ int ip6_err_gen_icmpv6_unreach(struct sk_buff *skb, int nhs, int type, - if (!skb2) - return 1; - -+ /* Remove debris left by IPv4 stack. */ -+ memset(IP6CB(skb2), 0, sizeof(*IP6CB(skb2))); -+ - skb_dst_drop(skb2); - skb_pull(skb2, nhs); - skb_reset_network_header(skb2); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1316-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch b/SOURCES/1316-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch deleted file mode 100644 index be0a77bc8..000000000 --- a/SOURCES/1316-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch +++ /dev/null @@ -1,137 +0,0 @@ -From dc9c57624e89fab59f90148b663d5171e0fa2416 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 27 May 2026 17:14:34 +0000 -Subject: [PATCH] ALSA: aloop: Fix peer runtime UAF during format-change stop -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-179312 -CVE: CVE-2026-46090 -Backported from tree(s): linux - -commit e5c33cdc6f402eab8abd36ecf436b22c9d3a8aff -Author: Cássio Gabriel -Date: Fri Apr 24 09:48:41 2026 -0300 - - ALSA: aloop: Fix peer runtime UAF during format-change stop - - loopback_check_format() may stop the capture side when playback starts - with parameters that no longer match a running capture stream. Commit - 826af7fa62e3 ("ALSA: aloop: Fix racy access at PCM trigger") moved - the peer lookup under cable->lock, but the actual snd_pcm_stop() still - runs after dropping that lock. - - A concurrent close can clear the capture entry from cable->streams[] and - detach or free its runtime while the playback trigger path still holds a - stale peer substream pointer. - - Keep a per-cable count of in-flight peer stops before dropping - cable->lock, and make free_cable() wait for those stops before - detaching the runtime. This preserves the existing behavior while - making the peer runtime lifetime explicit. - - Reported-by: syzbot+8fa95c41eafbc9d2ff6f@syzkaller.appspotmail.com - Closes: https://syzkaller.appspot.com/bug?extid=8fa95c41eafbc9d2ff6f - Fixes: 597603d615d2 ("ALSA: introduce the snd-aloop module for the PCM loopback") - Cc: stable@vger.kernel.org - Suggested-by: Takashi Iwai - Signed-off-by: Cássio Gabriel - Link: https://patch.msgid.link/20260424-alsa-aloop-peer-stop-uaf-v2-1-94e68101db8a@gmail.com - Signed-off-by: Takashi Iwai - -Signed-off-by: CKI Backport Bot - -diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c -index db137222d319..d2b9160a08dd 100644 ---- a/sound/drivers/aloop.c -+++ b/sound/drivers/aloop.c -@@ -99,6 +99,9 @@ struct loopback_ops { - struct loopback_cable { - spinlock_t lock; - struct loopback_pcm *streams[2]; -+ /* in-flight peer stops running outside cable->lock */ -+ atomic_t stop_count; -+ wait_queue_head_t stop_wait; - struct snd_pcm_hardware hw; - /* flags */ - unsigned int valid; -@@ -366,8 +369,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) - return 0; - if (stream == SNDRV_PCM_STREAM_CAPTURE) - return -EIO; -- else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) -+ else if (cruntime->state == SNDRV_PCM_STATE_RUNNING) { -+ /* close must not free the peer runtime below */ -+ atomic_inc(&cable->stop_count); - stop_capture = true; -+ } - } - - setup = get_setup(dpcm_play); -@@ -396,8 +402,11 @@ static int loopback_check_format(struct loopback_cable *cable, int stream) - } - } - -- if (stop_capture) -+ if (stop_capture) { - snd_pcm_stop(dpcm_capt->substream, SNDRV_PCM_STATE_DRAINING); -+ if (atomic_dec_and_test(&cable->stop_count)) -+ wake_up(&cable->stop_wait); -+ } - - return 0; - } -@@ -1049,23 +1058,29 @@ static void free_cable(struct snd_pcm_substream *substream) - struct loopback *loopback = substream->private_data; - int dev = get_cable_index(substream); - struct loopback_cable *cable; -+ struct loopback_pcm *dpcm; -+ bool other_alive; - - cable = loopback->cables[substream->number][dev]; - if (!cable) - return; -- if (cable->streams[!substream->stream]) { -- /* other stream is still alive */ -- guard(spinlock_irq)(&cable->lock); -- cable->streams[substream->stream] = NULL; -- } else { -- struct loopback_pcm *dpcm = substream->runtime->private_data; - -- if (cable->ops && cable->ops->close_cable && dpcm) -- cable->ops->close_cable(dpcm); -- /* free the cable */ -- loopback->cables[substream->number][dev] = NULL; -- kfree(cable); -+ scoped_guard(spinlock_irq, &cable->lock) { -+ cable->streams[substream->stream] = NULL; -+ other_alive = cable->streams[!substream->stream]; - } -+ -+ /* Pair with the stop_count increment in loopback_check_format(). */ -+ wait_event(cable->stop_wait, !atomic_read(&cable->stop_count)); -+ if (other_alive) -+ return; -+ -+ dpcm = substream->runtime->private_data; -+ if (cable->ops && cable->ops->close_cable && dpcm) -+ cable->ops->close_cable(dpcm); -+ /* free the cable */ -+ loopback->cables[substream->number][dev] = NULL; -+ kfree(cable); - } - - static int loopback_jiffies_timer_open(struct loopback_pcm *dpcm) -@@ -1260,6 +1275,8 @@ static int loopback_open(struct snd_pcm_substream *substream) - goto unlock; - } - spin_lock_init(&cable->lock); -+ atomic_set(&cable->stop_count, 0); -+ init_waitqueue_head(&cable->stop_wait); - cable->hw = loopback_pcm_hardware; - if (loopback->timer_source) - cable->ops = &loopback_snd_timer_ops; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1317-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch b/SOURCES/1317-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch deleted file mode 100644 index addd828d2..000000000 --- a/SOURCES/1317-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch +++ /dev/null @@ -1,208 +0,0 @@ -From efd0aa1426972ae0542b15484850fdd73395262f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 28 Apr 2026 13:24:18 -0400 -Subject: [PATCH] RDMA/iwcm: Fix workqueue list corruption by removing - work_list - -JIRA: https://redhat.atlassian.net/browse/RHEL-163491 - -commit 7874eeacfa42177565c01d5198726671acf7adf2 -Author: Jacob Moroni -Date: Mon Jan 12 02:00:06 2026 +0000 - - RDMA/iwcm: Fix workqueue list corruption by removing work_list - - The commit e1168f0 ("RDMA/iwcm: Simplify cm_event_handler()") - changed the work submission logic to unconditionally call - queue_work() with the expectation that queue_work() would - have no effect if work was already pending. The problem is - that a free list of struct iwcm_work is used (for which - struct work_struct is embedded), so each call to queue_work() - is basically unique and therefore does indeed queue the work. - - This causes a problem in the work handler which walks the work_list - until it's empty to process entries. This means that a single - run of the work handler could process item N+1 and release it - back to the free list while the actual workqueue entry is still - queued. It could then get reused (INIT_WORK...) and lead to - list corruption in the workqueue logic. - - Fix this by just removing the work_list. The workqueue already - does this for us. - - This fixes the following error that was observed when stress - testing with ucmatose on an Intel E830 in iWARP mode: - - [ 151.465780] list_del corruption. next->prev should be ffff9f0915c69c08, but was ffff9f0a1116be08. (next=ffff9f0a15b11c08) - [ 151.466639] ------------[ cut here ]------------ - [ 151.466986] kernel BUG at lib/list_debug.c:67! - [ 151.467349] Oops: invalid opcode: 0000 [#1] SMP NOPTI - [ 151.467753] CPU: 14 UID: 0 PID: 2306 Comm: kworker/u64:18 Not tainted 6.19.0-rc4+ #1 PREEMPT(voluntary) - [ 151.468466] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 - [ 151.469192] Workqueue: 0x0 (iw_cm_wq) - [ 151.469478] RIP: 0010:__list_del_entry_valid_or_report+0xf0/0x100 - [ 151.469942] Code: c7 58 5f 4c b2 e8 10 50 aa ff 0f 0b 48 89 ef e8 36 57 cb ff 48 8b 55 08 48 89 e9 48 89 de 48 c7 c7 a8 5f 4c b2 e8 f0 4f aa ff <0f> 0b 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 90 90 90 90 90 90 - [ 151.471323] RSP: 0000:ffffb15644e7bd68 EFLAGS: 00010046 - [ 151.471712] RAX: 000000000000006d RBX: ffff9f0915c69c08 RCX: 0000000000000027 - [ 151.472243] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff9f0a37d9c600 - [ 151.472768] RBP: ffff9f0a15b11c08 R08: 0000000000000000 R09: c0000000ffff7fff - [ 151.473294] R10: 0000000000000001 R11: ffffb15644e7bba8 R12: ffff9f092339ee68 - [ 151.473817] R13: ffff9f0900059c28 R14: ffff9f092339ee78 R15: 0000000000000000 - [ 151.474344] FS: 0000000000000000(0000) GS:ffff9f0a847b5000(0000) knlGS:0000000000000000 - [ 151.474934] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - [ 151.475362] CR2: 0000559e233a9088 CR3: 000000020296b004 CR4: 0000000000770ef0 - [ 151.475895] PKRU: 55555554 - [ 151.476118] Call Trace: - [ 151.476331] - [ 151.476497] move_linked_works+0x49/0xa0 - [ 151.476792] __pwq_activate_work.isra.46+0x2f/0xa0 - [ 151.477151] pwq_dec_nr_in_flight+0x1e0/0x2f0 - [ 151.477479] process_scheduled_works+0x1c8/0x410 - [ 151.477823] worker_thread+0x125/0x260 - [ 151.478108] ? __pfx_worker_thread+0x10/0x10 - [ 151.478430] kthread+0xfe/0x240 - [ 151.478671] ? __pfx_kthread+0x10/0x10 - [ 151.478955] ? __pfx_kthread+0x10/0x10 - [ 151.479240] ret_from_fork+0x208/0x270 - [ 151.479523] ? __pfx_kthread+0x10/0x10 - [ 151.479806] ret_from_fork_asm+0x1a/0x30 - [ 151.480103] - - Fixes: e1168f09b331 ("RDMA/iwcm: Simplify cm_event_handler()") - Signed-off-by: Jacob Moroni - Link: https://patch.msgid.link/20260112020006.1352438-1-jmoroni@google.com - Reviewed-by: Bart Van Assche - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/core/iwcm.c b/drivers/infiniband/core/iwcm.c -index 9419ab4435df..a2cf6135fcde 100644 ---- a/drivers/infiniband/core/iwcm.c -+++ b/drivers/infiniband/core/iwcm.c -@@ -95,7 +95,6 @@ static struct workqueue_struct *iwcm_wq; - struct iwcm_work { - struct work_struct work; - struct iwcm_id_private *cm_id; -- struct list_head list; - struct iw_cm_event event; - struct list_head free_list; - }; -@@ -179,7 +178,6 @@ static int alloc_work_entries(struct iwcm_id_private *cm_id_priv, int count) - return -ENOMEM; - } - work->cm_id = cm_id_priv; -- INIT_LIST_HEAD(&work->list); - put_work(work); - } - return 0; -@@ -214,7 +212,6 @@ static void free_cm_id(struct iwcm_id_private *cm_id_priv) - static bool iwcm_deref_id(struct iwcm_id_private *cm_id_priv) - { - if (refcount_dec_and_test(&cm_id_priv->refcount)) { -- BUG_ON(!list_empty(&cm_id_priv->work_list)); - free_cm_id(cm_id_priv); - return true; - } -@@ -261,7 +258,6 @@ struct iw_cm_id *iw_create_cm_id(struct ib_device *device, - refcount_set(&cm_id_priv->refcount, 1); - init_waitqueue_head(&cm_id_priv->connect_wait); - init_completion(&cm_id_priv->destroy_comp); -- INIT_LIST_HEAD(&cm_id_priv->work_list); - INIT_LIST_HEAD(&cm_id_priv->work_free_list); - - return &cm_id_priv->id; -@@ -1008,13 +1004,13 @@ static int process_event(struct iwcm_id_private *cm_id_priv, - } - - /* -- * Process events on the work_list for the cm_id. If the callback -- * function requests that the cm_id be deleted, a flag is set in the -- * cm_id flags to indicate that when the last reference is -- * removed, the cm_id is to be destroyed. This is necessary to -- * distinguish between an object that will be destroyed by the app -- * thread asleep on the destroy_comp list vs. an object destroyed -- * here synchronously when the last reference is removed. -+ * Process events for the cm_id. If the callback function requests -+ * that the cm_id be deleted, a flag is set in the cm_id flags to -+ * indicate that when the last reference is removed, the cm_id is -+ * to be destroyed. This is necessary to distinguish between an -+ * object that will be destroyed by the app thread asleep on the -+ * destroy_comp list vs. an object destroyed here synchronously -+ * when the last reference is removed. - */ - static void cm_work_handler(struct work_struct *_work) - { -@@ -1025,35 +1021,26 @@ static void cm_work_handler(struct work_struct *_work) - int ret = 0; - - spin_lock_irqsave(&cm_id_priv->lock, flags); -- while (!list_empty(&cm_id_priv->work_list)) { -- work = list_first_entry(&cm_id_priv->work_list, -- struct iwcm_work, list); -- list_del_init(&work->list); -- levent = work->event; -- put_work(work); -- spin_unlock_irqrestore(&cm_id_priv->lock, flags); -- -- if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { -- ret = process_event(cm_id_priv, &levent); -- if (ret) { -- destroy_cm_id(&cm_id_priv->id); -- WARN_ON_ONCE(iwcm_deref_id(cm_id_priv)); -- } -- } else -- pr_debug("dropping event %d\n", levent.event); -- if (iwcm_deref_id(cm_id_priv)) -- return; -- spin_lock_irqsave(&cm_id_priv->lock, flags); -- } -+ levent = work->event; -+ put_work(work); - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -+ -+ if (!test_bit(IWCM_F_DROP_EVENTS, &cm_id_priv->flags)) { -+ ret = process_event(cm_id_priv, &levent); -+ if (ret) { -+ destroy_cm_id(&cm_id_priv->id); -+ WARN_ON_ONCE(iwcm_deref_id(cm_id_priv)); -+ } -+ } else -+ pr_debug("dropping event %d\n", levent.event); -+ if (iwcm_deref_id(cm_id_priv)) -+ return; - } - - /* - * This function is called on interrupt context. Schedule events on - * the iwcm_wq thread to allow callback functions to downcall into -- * the CM and/or block. Events are queued to a per-CM_ID -- * work_list. If this is the first event on the work_list, the work -- * element is also queued on the iwcm_wq thread. -+ * the CM and/or block. - * - * Each event holds a reference on the cm_id. Until the last posted - * event has been delivered and processed, the cm_id cannot be -@@ -1095,7 +1082,6 @@ static int cm_event_handler(struct iw_cm_id *cm_id, - } - - refcount_inc(&cm_id_priv->refcount); -- list_add_tail(&work->list, &cm_id_priv->work_list); - queue_work(iwcm_wq, &work->work); - out: - spin_unlock_irqrestore(&cm_id_priv->lock, flags); -diff --git a/drivers/infiniband/core/iwcm.h b/drivers/infiniband/core/iwcm.h -index bf74639be128..b56fb12edece 100644 ---- a/drivers/infiniband/core/iwcm.h -+++ b/drivers/infiniband/core/iwcm.h -@@ -50,7 +50,6 @@ struct iwcm_id_private { - struct ib_qp *qp; - struct completion destroy_comp; - wait_queue_head_t connect_wait; -- struct list_head work_list; - spinlock_t lock; - refcount_t refcount; - struct list_head work_free_list; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1318-binder-use-cred-instead-of-task-for-selinux-checks.patch b/SOURCES/1318-binder-use-cred-instead-of-task-for-selinux-checks.patch deleted file mode 100644 index 739b88315..000000000 --- a/SOURCES/1318-binder-use-cred-instead-of-task-for-selinux-checks.patch +++ /dev/null @@ -1,332 +0,0 @@ -From 3a8d8e4f0e85b288fc43ec65f8ffac858af16239 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 15:16:45 +0200 -Subject: [PATCH] binder: use cred instead of task for selinux checks - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 52f88693378a58094c538662ba652aff0253c4fe -Author: Todd Kjos -Date: Tue Oct 12 09:56:13 2021 -0700 - - binder: use cred instead of task for selinux checks - - Since binder was integrated with selinux, it has passed - 'struct task_struct' associated with the binder_proc - to represent the source and target of transactions. - The conversion of task to SID was then done in the hook - implementations. It turns out that there are race conditions - which can result in an incorrect security context being used. - - Fix by using the 'struct cred' saved during binder_open and pass - it to the selinux subsystem. - - Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) - Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.") - Suggested-by: Jann Horn - Signed-off-by: Todd Kjos - Acked-by: Casey Schaufler - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 4ef4e2dc47cb..3a01e1862d9e 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -2049,7 +2049,7 @@ static int binder_translate_binder(struct flat_binder_object *fp, - ret = -EINVAL; - goto done; - } -- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { -+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { - ret = -EPERM; - goto done; - } -@@ -2095,7 +2095,7 @@ static int binder_translate_handle(struct flat_binder_object *fp, - proc->pid, thread->pid, fp->handle); - return -EINVAL; - } -- if (security_binder_transfer_binder(proc->tsk, target_proc->tsk)) { -+ if (security_binder_transfer_binder(proc->cred, target_proc->cred)) { - ret = -EPERM; - goto done; - } -@@ -2183,7 +2183,7 @@ static int binder_translate_fd(u32 fd, binder_size_t fd_offset, - ret = -EBADF; - goto err_fget; - } -- ret = security_binder_transfer_file(proc->tsk, target_proc->tsk, file); -+ ret = security_binder_transfer_file(proc->cred, target_proc->cred, file); - if (ret < 0) { - ret = -EPERM; - goto err_security; -@@ -2588,8 +2588,8 @@ static void binder_transaction(struct binder_proc *proc, - return_error_line = __LINE__; - goto err_invalid_target_handle; - } -- if (security_binder_transaction(proc->tsk, -- target_proc->tsk) < 0) { -+ if (security_binder_transaction(proc->cred, -+ target_proc->cred) < 0) { - return_error = BR_FAILED_REPLY; - return_error_param = -EPERM; - return_error_line = __LINE__; -@@ -4554,7 +4554,7 @@ static int binder_ioctl_set_ctx_mgr(struct file *filp, - ret = -EBUSY; - goto out; - } -- ret = security_binder_set_context_mgr(proc->tsk); -+ ret = security_binder_set_context_mgr(proc->cred); - if (ret < 0) - goto out; - if (uid_valid(context->binder_context_mgr_uid)) { -diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h -index fc89fae1ea60..1c2be7057bd9 100644 ---- a/include/linux/lsm_hook_defs.h -+++ b/include/linux/lsm_hook_defs.h -@@ -26,13 +26,13 @@ - * #undef LSM_HOOK - * }; - */ --LSM_HOOK(int, 0, binder_set_context_mgr, struct task_struct *mgr) --LSM_HOOK(int, 0, binder_transaction, struct task_struct *from, -- struct task_struct *to) --LSM_HOOK(int, 0, binder_transfer_binder, struct task_struct *from, -- struct task_struct *to) --LSM_HOOK(int, 0, binder_transfer_file, struct task_struct *from, -- struct task_struct *to, struct file *file) -+LSM_HOOK(int, 0, binder_set_context_mgr, const struct cred *mgr) -+LSM_HOOK(int, 0, binder_transaction, const struct cred *from, -+ const struct cred *to) -+LSM_HOOK(int, 0, binder_transfer_binder, const struct cred *from, -+ const struct cred *to) -+LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from, -+ const struct cred *to, struct file *file) - LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child, - unsigned int mode) - LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent) -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index 3f04476cc692..7577ecfc79e4 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -1330,22 +1330,22 @@ - * - * @binder_set_context_mgr: - * Check whether @mgr is allowed to be the binder context manager. -- * @mgr contains the task_struct for the task being registered. -+ * @mgr contains the struct cred for the current binder process. - * Return 0 if permission is granted. - * @binder_transaction: - * Check whether @from is allowed to invoke a binder transaction call - * to @to. -- * @from contains the task_struct for the sending task. -- * @to contains the task_struct for the receiving task. -+ * @from contains the struct cred for the sending process. -+ * @to contains the struct cred for the receiving process. - * @binder_transfer_binder: - * Check whether @from is allowed to transfer a binder reference to @to. -- * @from contains the task_struct for the sending task. -- * @to contains the task_struct for the receiving task. -+ * @from contains the struct cred for the sending process. -+ * @to contains the struct cred for the receiving process. - * @binder_transfer_file: - * Check whether @from is allowed to transfer @file to @to. -- * @from contains the task_struct for the sending task. -+ * @from contains the struct cred for the sending process. - * @file contains the struct file being transferred. -- * @to contains the task_struct for the receiving task. -+ * @to contains the struct cred for the receiving process. - * - * @ptrace_access_check: - * Check permission before allowing the current process to trace the -diff --git a/include/linux/security.h b/include/linux/security.h -index 16f44e78b7e6..3d216c94fd69 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -263,13 +263,13 @@ extern int security_init(void); - extern int early_security_init(void); - - /* Security operations */ --int security_binder_set_context_mgr(struct task_struct *mgr); --int security_binder_transaction(struct task_struct *from, -- struct task_struct *to); --int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to); --int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, struct file *file); -+int security_binder_set_context_mgr(const struct cred *mgr); -+int security_binder_transaction(const struct cred *from, -+ const struct cred *to); -+int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to); -+int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, struct file *file); - int security_ptrace_access_check(struct task_struct *child, unsigned int mode); - int security_ptrace_traceme(struct task_struct *parent); - int security_capget(struct task_struct *target, -@@ -520,25 +520,25 @@ static inline int early_security_init(void) - return 0; - } - --static inline int security_binder_set_context_mgr(struct task_struct *mgr) -+static inline int security_binder_set_context_mgr(const struct cred *mgr) - { - return 0; - } - --static inline int security_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+static inline int security_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - return 0; - } - --static inline int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+static inline int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { - return 0; - } - --static inline int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, -+static inline int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, - struct file *file) - { - return 0; -diff --git a/security/security.c b/security/security.c -index 5660bbab9845..2092b657af9f 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -887,25 +887,25 @@ OUT: \ - - /* Security operations */ - --int security_binder_set_context_mgr(struct task_struct *mgr) -+int security_binder_set_context_mgr(const struct cred *mgr) - { - return call_int_hook(binder_set_context_mgr, mgr); - } - --int security_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+int security_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - return call_int_hook(binder_transaction, from, to); - } - --int security_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+int security_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { - return call_int_hook(binder_transfer_binder, from, to); - } - --int security_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, struct file *file) -+int security_binder_transfer_file(const struct cred *from, -+ const struct cred *to, struct file *file) - { - return call_int_hook(binder_transfer_file, from, to, file); - } -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 9a69a2a4b31d..22173e8e88e2 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -245,29 +245,6 @@ static inline u32 task_sid_obj(const struct task_struct *task) - return sid; - } - --/* -- * get the security ID of a task for use with binder -- */ --static inline u32 task_sid_binder(const struct task_struct *task) --{ -- /* -- * In many case where this function is used we should be using the -- * task's subjective SID, but we can't reliably access the subjective -- * creds of a task other than our own so we must use the objective -- * creds/SID, which are safe to access. The downside is that if a task -- * is temporarily overriding it's creds it will not be reflected here; -- * however, it isn't clear that binder would handle that case well -- * anyway. -- * -- * If this ever changes and we can safely reference the subjective -- * creds/SID of another task, this function will make it easier to -- * identify the various places where we make use of the task SIDs in -- * the binder code. It is also likely that we will need to adjust -- * the main drivers/android binder code as well. -- */ -- return task_sid_obj(task); --} -- - static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry); - - /* -@@ -2039,18 +2016,19 @@ static inline u32 open_file_to_av(struct file *file) - - /* Hook functions begin here. */ - --static int selinux_binder_set_context_mgr(struct task_struct *mgr) -+static int selinux_binder_set_context_mgr(const struct cred *mgr) - { - return avc_has_perm(&selinux_state, -- current_sid(), task_sid_binder(mgr), SECCLASS_BINDER, -+ current_sid(), cred_sid(mgr), SECCLASS_BINDER, - BINDER__SET_CONTEXT_MGR, NULL); - } - --static int selinux_binder_transaction(struct task_struct *from, -- struct task_struct *to) -+static int selinux_binder_transaction(const struct cred *from, -+ const struct cred *to) - { - u32 mysid = current_sid(); -- u32 fromsid = task_sid_binder(from); -+ u32 fromsid = cred_sid(from); -+ u32 tosid = cred_sid(to); - int rc; - - if (mysid != fromsid) { -@@ -2061,24 +2039,24 @@ static int selinux_binder_transaction(struct task_struct *from, - return rc; - } - -- return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to), -+ return avc_has_perm(&selinux_state, fromsid, tosid, - SECCLASS_BINDER, BINDER__CALL, NULL); - } - --static int selinux_binder_transfer_binder(struct task_struct *from, -- struct task_struct *to) -+static int selinux_binder_transfer_binder(const struct cred *from, -+ const struct cred *to) - { - return avc_has_perm(&selinux_state, -- task_sid_binder(from), task_sid_binder(to), -+ cred_sid(from), cred_sid(to), - SECCLASS_BINDER, BINDER__TRANSFER, - NULL); - } - --static int selinux_binder_transfer_file(struct task_struct *from, -- struct task_struct *to, -+static int selinux_binder_transfer_file(const struct cred *from, -+ const struct cred *to, - struct file *file) - { -- u32 sid = task_sid_binder(to); -+ u32 sid = cred_sid(to); - struct file_security_struct *fsec = selinux_file(file); - struct dentry *dentry = file->f_path.dentry; - struct inode_security_struct *isec; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1319-locks-fix-toctou-race-when-granting-write-lease.patch b/SOURCES/1319-locks-fix-toctou-race-when-granting-write-lease.patch deleted file mode 100644 index b96d88b13..000000000 --- a/SOURCES/1319-locks-fix-toctou-race-when-granting-write-lease.patch +++ /dev/null @@ -1,115 +0,0 @@ -From 16ac6be5ae309b2c31c37898511025294dcadcc8 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:30:04 +0200 -Subject: [PATCH] locks: fix TOCTOU race when granting write lease - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit d6da19c9cace63290ccfccb1fc35151ffefc0bec -Author: Amir Goldstein -Date: Tue Aug 16 17:53:17 2022 +0300 - - locks: fix TOCTOU race when granting write lease - - Thread A trying to acquire a write lease checks the value of i_readcount - and i_writecount in check_conflicting_open() to verify that its own fd - is the only fd referencing the file. - - Thread B trying to open the file for read will call break_lease() in - do_dentry_open() before incrementing i_readcount, which leaves a small - window where thread A can acquire the write lease and then thread B - completes the open of the file for read without breaking the write lease - that was acquired by thread A. - - Fix this race by incrementing i_readcount before checking for existing - leases, same as the case with i_writecount. - - Use a helper put_file_access() to decrement i_readcount or i_writecount - in do_dentry_open() and __fput(). - - Fixes: 387e3746d01c ("locks: eliminate false positive conflicts for write lease") - Reviewed-by: Jeff Layton - Signed-off-by: Amir Goldstein - Signed-off-by: Al Viro - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index cdc1dea33154..845c741dc518 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -366,12 +366,7 @@ static void __fput(struct file *file) - } - fops_put(file->f_op); - put_pid(file->f_owner.pid); -- if ((mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) -- i_readcount_dec(inode); -- if (mode & FMODE_WRITER) { -- put_write_access(inode); -- __mnt_drop_write(mnt); -- } -+ put_file_access(file); - dput(dentry); - if (unlikely(mode & FMODE_NEED_UNMOUNT)) - dissolve_on_fput(mnt); -diff --git a/fs/internal.h b/fs/internal.h -index 3e8dbf777ce2..c3701d285c69 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -96,6 +96,16 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - extern struct file *alloc_empty_file(int, const struct cred *); - extern struct file *alloc_empty_file_noaccount(int, const struct cred *); - -+static inline void put_file_access(struct file *file) -+{ -+ if ((file->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { -+ i_readcount_dec(file->f_inode); -+ } else if (file->f_mode & FMODE_WRITER) { -+ put_write_access(file->f_inode); -+ __mnt_drop_write(file->f_path.mnt); -+ } -+} -+ - /* - * super.c - */ -diff --git a/fs/open.c b/fs/open.c -index 51052202ecdc..a84909d62168 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -861,7 +861,9 @@ static int do_dentry_open(struct file *f, - return 0; - } - -- if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { -+ if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { -+ i_readcount_inc(inode); -+ } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { - error = get_write_access(inode); - if (unlikely(error)) - goto cleanup_file; -@@ -901,8 +903,6 @@ static int do_dentry_open(struct file *f, - goto cleanup_all; - } - f->f_mode |= FMODE_OPENED; -- if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) -- i_readcount_inc(inode); - if ((f->f_mode & FMODE_READ) && - likely(f->f_op->read || f->f_op->read_iter)) - f->f_mode |= FMODE_CAN_READ; -@@ -948,10 +948,7 @@ static int do_dentry_open(struct file *f, - if (WARN_ON_ONCE(error > 0)) - error = -EINVAL; - fops_put(f->f_op); -- if (f->f_mode & FMODE_WRITER) { -- put_write_access(inode); -- __mnt_drop_write(f->f_path.mnt); -- } -+ put_file_access(f); - cleanup_file: - path_put(&f->f_path); - f->f_path.mnt = NULL; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1320-fs-use-a-helper-for-opening-kernel-internal-files.patch b/SOURCES/1320-fs-use-a-helper-for-opening-kernel-internal-files.patch deleted file mode 100644 index 09ee79bda..000000000 --- a/SOURCES/1320-fs-use-a-helper-for-opening-kernel-internal-files.patch +++ /dev/null @@ -1,122 +0,0 @@ -From f3196ef468589e50d09ad0edc6d2874c267418e2 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 09:46:36 +0200 -Subject: [PATCH] fs: use a helper for opening kernel internal files - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - include/linux/fs.h: context fuzz - - fs/overlayfs/util.c: previous backport introduced an - open_with_fake_path() caller that also needs to be renamed here - -commit cbb0b9d4bbcfa96e7872808a63be03202536f1bc -Author: Amir Goldstein -Date: Thu Jun 15 14:22:26 2023 +0300 - - fs: use a helper for opening kernel internal files - - cachefiles uses kernel_open_tmpfile() to open kernel internal tmpfile - without accounting for nr_files. - - cachefiles uses open_with_fake_path() for the same reason without the - need for a fake path. - - Fork open_with_fake_path() to kernel_file_open() which only does the - noaccount part and use it in cachefiles. - - Signed-off-by: Amir Goldstein - Reviewed-by: Christoph Hellwig - Message-Id: <20230615112229.2143178-3-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c -index 6f5c59baec08..bc2bb2001318 100644 ---- a/fs/cachefiles/namei.c -+++ b/fs/cachefiles/namei.c -@@ -560,8 +560,8 @@ static bool cachefiles_open_file(struct cachefiles_object *object, - */ - path.mnt = cache->mnt; - path.dentry = dentry; -- file = open_with_fake_path(&path, O_RDWR | O_LARGEFILE | O_DIRECT, -- d_backing_inode(dentry), cache->cache_cred); -+ file = kernel_file_open(&path, O_RDWR | O_LARGEFILE | O_DIRECT, -+ d_backing_inode(dentry), cache->cache_cred); - if (IS_ERR(file)) { - trace_cachefiles_vfs_error(object, d_backing_inode(dentry), - PTR_ERR(file), -diff --git a/fs/open.c b/fs/open.c -index a84909d62168..3eac96e10eb0 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1089,6 +1089,39 @@ struct file *dentry_create(const struct path *path, int flags, umode_t mode, - } - EXPORT_SYMBOL(dentry_create); - -+/** -+ * kernel_file_open - open a file for kernel internal use -+ * @path: path of the file to open -+ * @flags: open flags -+ * @inode: the inode -+ * @cred: credentials for open -+ * -+ * Open a file for use by in-kernel consumers. The file is not accounted -+ * against nr_files and must not be installed into the file descriptor -+ * table. -+ * -+ * Return: Opened file on success, an error pointer on failure. -+ */ -+struct file *kernel_file_open(const struct path *path, int flags, -+ struct inode *inode, const struct cred *cred) -+{ -+ struct file *f; -+ int error; -+ -+ f = alloc_empty_file_noaccount(flags, cred); -+ if (IS_ERR(f)) -+ return f; -+ -+ f->f_path = *path; -+ error = do_dentry_open(f, inode, NULL); -+ if (error) { -+ fput(f); -+ f = ERR_PTR(error); -+ } -+ return f; -+} -+EXPORT_SYMBOL_GPL(kernel_file_open); -+ - struct file *open_with_fake_path(const struct path *path, int flags, - struct inode *inode, const struct cred *cred) - { -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index 2cdbb70d2b5d..6b31b6587e4d 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -1370,7 +1370,7 @@ int ovl_ensure_verity_loaded(struct path *datapath) - * If this inode was not yet opened, the verity info hasn't been - * loaded yet, so we need to do that here to force it into memory. - */ -- filp = open_with_fake_path(datapath, O_RDONLY, inode, current_cred()); -+ filp = kernel_file_open(datapath, O_RDONLY, inode, current_cred()); - if (IS_ERR(filp)) - return PTR_ERR(filp); - fput(filp); -diff --git a/include/linux/fs.h b/include/linux/fs.h -index be94651061c1..363cdadb04ba 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -1833,6 +1833,8 @@ static inline int vfs_whiteout(struct mnt_idmap *idmap, - struct file *vfs_tmpfile_open(struct mnt_idmap *idmap, - const struct path *parentpath, - umode_t mode, int open_flag, const struct cred *cred); -+struct file *kernel_file_open(const struct path *path, int flags, -+ struct inode *inode, const struct cred *cred); - - int vfs_mkobj(struct dentry *, umode_t, - int (*f)(struct dentry *, umode_t, void *), --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1321-fs-move-kmem-cache-zalloc-into-alloc-empty-file-helpers.patch b/SOURCES/1321-fs-move-kmem-cache-zalloc-into-alloc-empty-file-helpers.patch deleted file mode 100644 index 5feb059f4..000000000 --- a/SOURCES/1321-fs-move-kmem-cache-zalloc-into-alloc-empty-file-helpers.patch +++ /dev/null @@ -1,124 +0,0 @@ -From f226635eb71a0c5f680f89a64ec6332e5b2f8ee7 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 15:22:00 +0200 -Subject: [PATCH] fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - only context fuzz - -commit 8a05a8c31d06c5d0d67b273a4a00f87269adde82 -Author: Amir Goldstein -Date: Thu Jun 15 14:22:27 2023 +0300 - - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers - - Use a common helper init_file() instead of __alloc_file() for - alloc_empty_file*() helpers and improrve the documentation. - - This is needed for a follow up patch that allocates a backing_file - container. - - Suggested-by: Christoph Hellwig - Signed-off-by: Amir Goldstein - Reviewed-by: Christoph Hellwig - Message-Id: <20230615112229.2143178-4-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index 845c741dc518..9fee3de138d6 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -131,20 +131,15 @@ static int __init init_fs_stat_sysctls(void) - fs_initcall(init_fs_stat_sysctls); - #endif - --static struct file *__alloc_file(int flags, const struct cred *cred) -+static int init_file(struct file *f, int flags, const struct cred *cred) - { -- struct file *f; - int error; - -- f = kmem_cache_zalloc(filp_cachep, GFP_KERNEL); -- if (unlikely(!f)) -- return ERR_PTR(-ENOMEM); -- - f->f_cred = get_cred(cred); - error = security_file_alloc(f); - if (unlikely(error)) { - file_free_rcu(&f->f_u.fu_rcuhead); -- return ERR_PTR(error); -+ return error; - } - - atomic_long_set(&f->f_count, 1); -@@ -155,7 +150,7 @@ static struct file *__alloc_file(int flags, const struct cred *cred) - f->f_mode = OPEN_FMODE(flags); - /* f->f_version: 0 */ - -- return f; -+ return 0; - } - - /* Find an unused file structure and return a pointer to it. -@@ -172,6 +167,7 @@ struct file *alloc_empty_file(int flags, const struct cred *cred) - { - static long old_max; - struct file *f; -+ int error; - - /* - * Privileged users can go above max_files -@@ -185,9 +181,15 @@ struct file *alloc_empty_file(int flags, const struct cred *cred) - goto over; - } - -- f = __alloc_file(flags, cred); -- if (!IS_ERR(f)) -- percpu_counter_inc(&nr_files); -+ f = kmem_cache_zalloc(filp_cachep, GFP_KERNEL); -+ if (unlikely(!f)) -+ return ERR_PTR(-ENOMEM); -+ -+ error = init_file(f, flags, cred); -+ if (unlikely(error)) -+ return ERR_PTR(error); -+ -+ percpu_counter_inc(&nr_files); - - return f; - -@@ -203,14 +205,23 @@ struct file *alloc_empty_file(int flags, const struct cred *cred) - /* - * Variant of alloc_empty_file() that doesn't check and modify nr_files. - * -- * Should not be used unless there's a very good reason to do so. -+ * This is only for kernel internal use, and the allocate file must not be -+ * installed into file tables or such. - */ - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - { -- struct file *f = __alloc_file(flags, cred); -+ struct file *f; -+ int error; -+ -+ f = kmem_cache_zalloc(filp_cachep, GFP_KERNEL); -+ if (unlikely(!f)) -+ return ERR_PTR(-ENOMEM); -+ -+ error = init_file(f, flags, cred); -+ if (unlikely(error)) -+ return ERR_PTR(error); - -- if (!IS_ERR(f)) -- f->f_mode |= FMODE_NOACCOUNT; -+ f->f_mode |= FMODE_NOACCOUNT; - - return f; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1322-fs-use-backing-file-container-for-internal-files-with-fake-f.patch b/SOURCES/1322-fs-use-backing-file-container-for-internal-files-with-fake-f.patch deleted file mode 100644 index 7832f4463..000000000 --- a/SOURCES/1322-fs-use-backing-file-container-for-internal-files-with-fake-f.patch +++ /dev/null @@ -1,253 +0,0 @@ -From 9e62303890ee2ae993e8c78bb442176d2467e927 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 09:49:05 +0200 -Subject: [PATCH] fs: use backing_file container for internal files with "fake" - f_path - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 62d53c4a1dfe347bd87ede46ffad38c9a3870338 -Author: Amir Goldstein -Date: Thu Jun 15 14:22:28 2023 +0300 - - fs: use backing_file container for internal files with "fake" f_path - - Overlayfs uses open_with_fake_path() to allocate internal kernel files, - with a "fake" path - whose f_path is not on the same fs as f_inode. - - Allocate a container struct backing_file for those internal files, that - is used to hold the "fake" ovl path along with the real path. - - backing_file_real_path() can be used to access the stored real path. - - Signed-off-by: Amir Goldstein - Message-Id: <20230615112229.2143178-5-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index 9fee3de138d6..3f02d00c1396 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -44,18 +44,40 @@ static struct kmem_cache *filp_cachep __read_mostly; - - static struct percpu_counter nr_files __cacheline_aligned_in_smp; - -+/* Container for backing file with optional real path */ -+struct backing_file { -+ struct file file; -+ struct path real_path; -+}; -+ -+static inline struct backing_file *backing_file(struct file *f) -+{ -+ return container_of(f, struct backing_file, file); -+} -+ -+struct path *backing_file_real_path(struct file *f) -+{ -+ return &backing_file(f)->real_path; -+} -+EXPORT_SYMBOL_GPL(backing_file_real_path); -+ - static void file_free_rcu(struct rcu_head *head) - { - struct file *f = container_of(head, struct file, f_u.fu_rcuhead); - - put_cred(f->f_cred); -- kmem_cache_free(filp_cachep, f); -+ if (unlikely(f->f_mode & FMODE_BACKING)) -+ kfree(backing_file(f)); -+ else -+ kmem_cache_free(filp_cachep, f); - } - - static inline void file_free(struct file *f) - { - security_file_free(f); -- if (!(f->f_mode & FMODE_NOACCOUNT)) -+ if (unlikely(f->f_mode & FMODE_BACKING)) -+ path_put(backing_file_real_path(f)); -+ if (likely(!(f->f_mode & FMODE_NOACCOUNT))) - percpu_counter_dec(&nr_files); - call_rcu(&f->f_u.fu_rcuhead, file_free_rcu); - } -@@ -226,6 +248,30 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return f; - } - -+/* -+ * Variant of alloc_empty_file() that allocates a backing_file container -+ * and doesn't check and modify nr_files. -+ * -+ * This is only for kernel internal use, and the allocate file must not be -+ * installed into file tables or such. -+ */ -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred) -+{ -+ struct backing_file *ff; -+ int error; -+ -+ ff = kzalloc(sizeof(struct backing_file), GFP_KERNEL); -+ if (unlikely(!ff)) -+ return ERR_PTR(-ENOMEM); -+ -+ error = init_file(&ff->file, flags, cred); -+ if (unlikely(error)) -+ return ERR_PTR(error); -+ -+ ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; -+ return &ff->file; -+} -+ - /** - * file_init_path - initialize a 'struct file' based on path - * -diff --git a/fs/internal.h b/fs/internal.h -index c3701d285c69..62b558fa6395 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -93,8 +93,9 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - /* - * file_table.c - */ --extern struct file *alloc_empty_file(int, const struct cred *); --extern struct file *alloc_empty_file_noaccount(int, const struct cred *); -+struct file *alloc_empty_file(int flags, const struct cred *cred); -+struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred); - - static inline void put_file_access(struct file *file) - { -diff --git a/fs/open.c b/fs/open.c -index 3eac96e10eb0..e2419242456e 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1122,23 +1122,44 @@ struct file *kernel_file_open(const struct path *path, int flags, - } - EXPORT_SYMBOL_GPL(kernel_file_open); - --struct file *open_with_fake_path(const struct path *path, int flags, -- struct inode *inode, const struct cred *cred) -+/** -+ * backing_file_open - open a backing file for kernel internal use -+ * @path: path of the file to open -+ * @flags: open flags -+ * @path: path of the backing file -+ * @cred: credentials for open -+ * -+ * Open a backing file for a stackable filesystem (e.g., overlayfs). -+ * @path may be on the stackable filesystem and backing inode on the -+ * underlying filesystem. In this case, we want to be able to return -+ * the @real_path of the backing inode. This is done by embedding the -+ * returned file into a container structure that also stores the path of -+ * the backing inode on the underlying filesystem, which can be -+ * retrieved using backing_file_real_path(). -+ */ -+struct file *backing_file_open(const struct path *path, int flags, -+ const struct path *real_path, -+ const struct cred *cred) - { -- struct file *f = alloc_empty_file_noaccount(flags, cred); -- if (!IS_ERR(f)) { -- int error; -+ struct file *f; -+ int error; - -- f->f_path = *path; -- error = do_dentry_open(f, inode, NULL); -- if (error) { -- fput(f); -- f = ERR_PTR(error); -- } -+ f = alloc_empty_backing_file(flags, cred); -+ if (IS_ERR(f)) -+ return f; -+ -+ f->f_path = *path; -+ path_get(real_path); -+ *backing_file_real_path(f) = *real_path; -+ error = do_dentry_open(f, d_inode(real_path->dentry), NULL); -+ if (error) { -+ fput(f); -+ f = ERR_PTR(error); - } -+ - return f; - } --EXPORT_SYMBOL(open_with_fake_path); -+EXPORT_SYMBOL_GPL(backing_file_open); - - #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) - #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC) -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 5db89c8de140..99f2ae8e3864 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -65,8 +65,8 @@ static struct file *ovl_open_realfile(const struct file *file, - if (!inode_owner_or_capable(real_idmap, realinode)) - flags &= ~O_NOATIME; - -- realfile = open_with_fake_path(&file->f_path, flags, realinode, -- current_cred()); -+ realfile = backing_file_open(&file->f_path, flags, realpath, -+ current_cred()); - } - revert_creds(old_cred); - -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 363cdadb04ba..48ec31b9d230 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -167,6 +167,9 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, - /* Supports IOCB_HAS_METADATA */ - #define FMODE_HAS_METADATA ((__force fmode_t)0x800000) - -+/* File is embedded in backing_file object */ -+#define FMODE_BACKING ((__force fmode_t)0x2000000) -+ - /* File was opened by fanotify and shouldn't generate fanotify events */ - #define FMODE_NONOTIFY ((__force fmode_t)0x4000000) - -@@ -2579,11 +2582,31 @@ static inline struct file *file_open_root_mnt(struct vfsmount *mnt, - return file_open_root(&(struct path){.mnt = mnt, .dentry = mnt->mnt_root}, - name, flags, mode); - } --extern struct file * dentry_open(const struct path *, int, const struct cred *); --extern struct file *dentry_create(const struct path *path, int flags, -- umode_t mode, const struct cred *cred); --extern struct file * open_with_fake_path(const struct path *, int, -- struct inode*, const struct cred *); -+struct file *dentry_open(const struct path *path, int flags, -+ const struct cred *creds); -+struct file *dentry_create(const struct path *path, int flags, umode_t mode, -+ const struct cred *cred); -+struct file *backing_file_open(const struct path *path, int flags, -+ const struct path *real_path, -+ const struct cred *cred); -+struct path *backing_file_real_path(struct file *f); -+ -+/* -+ * file_real_path - get the path corresponding to f_inode -+ * -+ * When opening a backing file for a stackable filesystem (e.g., -+ * overlayfs) f_path may be on the stackable filesystem and f_inode on -+ * the underlying filesystem. When the path associated with f_inode is -+ * needed, this helper should be used instead of accessing f_path -+ * directly. -+*/ -+static inline const struct path *file_real_path(struct file *f) -+{ -+ if (unlikely(f->f_mode & FMODE_BACKING)) -+ return backing_file_real_path(f); -+ return &f->f_path; -+} -+ - static inline struct file *file_clone_open(struct file *file) - { - return dentry_open(&file->f_path, file->f_flags, file->f_cred); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1323-ovl-enable-fsnotify-events-on-underlying-real-files.patch b/SOURCES/1323-ovl-enable-fsnotify-events-on-underlying-real-files.patch deleted file mode 100644 index 09ef3ebf4..000000000 --- a/SOURCES/1323-ovl-enable-fsnotify-events-on-underlying-real-files.patch +++ /dev/null @@ -1,75 +0,0 @@ -From c030fdbbb0542056bdd257409b781cee8d8b8c39 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 09:49:52 +0200 -Subject: [PATCH] ovl: enable fsnotify events on underlying real files - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit bc2473c90fca55bf95b2ab6af1dacee26a4f92f6 -Author: Amir Goldstein -Date: Thu Jun 15 14:22:29 2023 +0300 - - ovl: enable fsnotify events on underlying real files - - Overlayfs creates the real underlying files with fake f_path, whose - f_inode is on the underlying fs and f_path on overlayfs. - - Those real files were open with FMODE_NONOTIFY, because fsnotify code was - not prapared to handle fsnotify hooks on files with fake path correctly - and fanotify would report unexpected event->fd with fake overlayfs path, - when the underlying fs was being watched. - - Teach fsnotify to handle events on the real files, and do not set real - files to FMODE_NONOTIFY to allow operations on real file (e.g. open, - access, modify, close) to generate async and permission events. - - Because fsnotify does not have notifications on address space - operations, we do not need to worry about ->vm_file not reporting - events to a watched overlayfs when users are accessing a mapped - overlayfs file. - - Acked-by: Jan Kara - Signed-off-by: Amir Goldstein - Message-Id: <20230615112229.2143178-6-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 99f2ae8e3864..cd0770bb3020 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -38,8 +38,8 @@ static char ovl_whatisit(struct inode *inode, struct inode *realinode) - return 'm'; - } - --/* No atime modification nor notify on underlying */ --#define OVL_OPEN_FLAGS (O_NOATIME | FMODE_NONOTIFY) -+/* No atime modification on underlying */ -+#define OVL_OPEN_FLAGS (O_NOATIME) - - static struct file *ovl_open_realfile(const struct file *file, - const struct path *realpath) -diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h -index bb8467cd11ae..ed48e4f1e755 100644 ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -91,11 +91,13 @@ static inline void fsnotify_dentry(struct dentry *dentry, __u32 mask) - - static inline int fsnotify_file(struct file *file, __u32 mask) - { -- const struct path *path = &file->f_path; -+ const struct path *path; - - if (file->f_mode & FMODE_NONOTIFY) - return 0; - -+ /* Overlayfs internal files have fake f_path */ -+ path = file_real_path(file); - return fsnotify_parent(path->dentry, mask, path, FSNOTIFY_EVENT_PATH); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1324-fs-move-cleanup-from-init-file-into-its-callers.patch b/SOURCES/1324-fs-move-cleanup-from-init-file-into-its-callers.patch deleted file mode 100644 index d79969535..000000000 --- a/SOURCES/1324-fs-move-cleanup-from-init-file-into-its-callers.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 119b885de3aa505ccc26df2a8a074555e04be774 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 20:28:16 +0200 -Subject: [PATCH] fs: move cleanup from init_file() into its callers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -Conflicts: - - fs/file_table.c: slightly different argument to file_free_rcu() - downstream, replacement kept the same - -commit dff745c1221a402b4921d54f292288373cff500c -Author: Amir Goldstein -Date: Sat Jul 1 20:11:34 2023 +0300 - - fs: move cleanup from init_file() into its callers - - The use of file_free_rcu() in init_file() to free the struct that was - allocated by the caller was hacky and we got what we deserved. - - Let init_file() and its callers take care of cleaning up each after - their own allocated resources on error. - - Fixes: 62d53c4a1dfe ("fs: use backing_file container for internal files with "fake" f_path") # mainline only - Reported-and-tested-by: syzbot+ada42aab05cf51b00e98@syzkaller.appspotmail.com - Signed-off-by: Amir Goldstein - Message-Id: <20230701171134.239409-1-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index 3f02d00c1396..b0a8c2608530 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -160,7 +160,7 @@ static int init_file(struct file *f, int flags, const struct cred *cred) - f->f_cred = get_cred(cred); - error = security_file_alloc(f); - if (unlikely(error)) { -- file_free_rcu(&f->f_u.fu_rcuhead); -+ put_cred(f->f_cred); - return error; - } - -@@ -208,8 +208,10 @@ struct file *alloc_empty_file(int flags, const struct cred *cred) - return ERR_PTR(-ENOMEM); - - error = init_file(f, flags, cred); -- if (unlikely(error)) -+ if (unlikely(error)) { -+ kmem_cache_free(filp_cachep, f); - return ERR_PTR(error); -+ } - - percpu_counter_inc(&nr_files); - -@@ -240,8 +242,10 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return ERR_PTR(-ENOMEM); - - error = init_file(f, flags, cred); -- if (unlikely(error)) -+ if (unlikely(error)) { -+ kmem_cache_free(filp_cachep, f); - return ERR_PTR(error); -+ } - - f->f_mode |= FMODE_NOACCOUNT; - -@@ -265,8 +269,10 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) - return ERR_PTR(-ENOMEM); - - error = init_file(&ff->file, flags, cred); -- if (unlikely(error)) -+ if (unlikely(error)) { -+ kfree(ff); - return ERR_PTR(error); -+ } - - ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; - return &ff->file; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1325-lsm-constify-the-file-parameter-in-security-binder-transfer-.patch b/SOURCES/1325-lsm-constify-the-file-parameter-in-security-binder-transfer-.patch deleted file mode 100644 index 3c99a6743..000000000 --- a/SOURCES/1325-lsm-constify-the-file-parameter-in-security-binder-transfer-.patch +++ /dev/null @@ -1,119 +0,0 @@ -From f792642489a3af9cec81ca366edffd79fe1d1359 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 15:16:52 +0200 -Subject: [PATCH] lsm: constify the 'file' parameter in - security_binder_transfer_file() - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 8e4672d6f902d5c4db1e87e8aa9f530149d85bc6 -Author: Khadija Kamran -Date: Sat Aug 12 20:31:08 2023 +0500 - - lsm: constify the 'file' parameter in security_binder_transfer_file() - - SELinux registers the implementation for the "binder_transfer_file" - hook. Looking at the function implementation we observe that the - parameter "file" is not changing. - - Mark the "file" parameter of LSM hook security_binder_transfer_file() as - "const" since it will not be changing in the LSM hook. - - Signed-off-by: Khadija Kamran - [PM: subject line whitespace fix] - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h -index 1c2be7057bd9..b6fbb446bab7 100644 ---- a/include/linux/lsm_hook_defs.h -+++ b/include/linux/lsm_hook_defs.h -@@ -32,7 +32,7 @@ LSM_HOOK(int, 0, binder_transaction, const struct cred *from, - LSM_HOOK(int, 0, binder_transfer_binder, const struct cred *from, - const struct cred *to) - LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from, -- const struct cred *to, struct file *file) -+ const struct cred *to, const struct file *file) - LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child, - unsigned int mode) - LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent) -diff --git a/include/linux/security.h b/include/linux/security.h -index 3d216c94fd69..d2888c127859 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -269,7 +269,7 @@ int security_binder_transaction(const struct cred *from, - int security_binder_transfer_binder(const struct cred *from, - const struct cred *to); - int security_binder_transfer_file(const struct cred *from, -- const struct cred *to, struct file *file); -+ const struct cred *to, const struct file *file); - int security_ptrace_access_check(struct task_struct *child, unsigned int mode); - int security_ptrace_traceme(struct task_struct *parent); - int security_capget(struct task_struct *target, -@@ -539,7 +539,7 @@ static inline int security_binder_transfer_binder(const struct cred *from, - - static inline int security_binder_transfer_file(const struct cred *from, - const struct cred *to, -- struct file *file) -+ const struct file *file) - { - return 0; - } -diff --git a/security/security.c b/security/security.c -index 2092b657af9f..b59af216324f 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -905,7 +905,7 @@ int security_binder_transfer_binder(const struct cred *from, - } - - int security_binder_transfer_file(const struct cred *from, -- const struct cred *to, struct file *file) -+ const struct cred *to, const struct file *file) - { - return call_int_hook(binder_transfer_file, from, to, file); - } -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 22173e8e88e2..deacc9a63fae 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -1703,7 +1703,7 @@ static inline int file_path_has_perm(const struct cred *cred, - } - - #ifdef CONFIG_BPF_SYSCALL --static int bpf_fd_pass(struct file *file, u32 sid); -+static int bpf_fd_pass(const struct file *file, u32 sid); - #endif - - /* Check whether a task can use an open file descriptor to -@@ -1976,7 +1976,7 @@ static inline u32 file_mask_to_av(int mode, int mask) - } - - /* Convert a Linux file to an access vector. */ --static inline u32 file_to_av(struct file *file) -+static inline u32 file_to_av(const struct file *file) - { - u32 av = 0; - -@@ -2054,7 +2054,7 @@ static int selinux_binder_transfer_binder(const struct cred *from, - - static int selinux_binder_transfer_file(const struct cred *from, - const struct cred *to, -- struct file *file) -+ const struct file *file) - { - u32 sid = cred_sid(to); - struct file_security_struct *fsec = selinux_file(file); -@@ -6885,7 +6885,7 @@ static u32 bpf_map_fmode_to_av(fmode_t fmode) - * access the bpf object and that's why we have to add this additional check in - * selinux_file_receive and selinux_binder_transfer_files. - */ --static int bpf_fd_pass(struct file *file, u32 sid) -+static int bpf_fd_pass(const struct file *file, u32 sid) - { - struct bpf_security_struct *bpfsec; - struct bpf_prog *prog; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1326-cachefiles-use-kiocb-start-end-write-helpers.patch b/SOURCES/1326-cachefiles-use-kiocb-start-end-write-helpers.patch deleted file mode 100644 index 0e1c54759..000000000 --- a/SOURCES/1326-cachefiles-use-kiocb-start-end-write-helpers.patch +++ /dev/null @@ -1,73 +0,0 @@ -From 7adb9b7eb6c32cc5b7cea983ed187cf3f4122cf5 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:49:48 +0200 -Subject: [PATCH] cachefiles: use kiocb_{start,end}_write() helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit e6fa4c728fb671765291cca3a905986612c06b6e -Author: Amir Goldstein -Date: Thu Aug 17 17:13:37 2023 +0300 - - cachefiles: use kiocb_{start,end}_write() helpers - - Use helpers instead of the open coded dance to silence lockdep warnings. - - Suggested-by: Jan Kara - Signed-off-by: Amir Goldstein - Reviewed-by: Jan Kara - Reviewed-by: Jens Axboe - Message-Id: <20230817141337.1025891-8-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/cachefiles/io.c b/fs/cachefiles/io.c -index 175a25fcade8..009d23cd435b 100644 ---- a/fs/cachefiles/io.c -+++ b/fs/cachefiles/io.c -@@ -259,9 +259,7 @@ static void cachefiles_write_complete(struct kiocb *iocb, long ret) - - _enter("%ld", ret); - -- /* Tell lockdep we inherited freeze protection from submission thread */ -- __sb_writers_acquired(inode->i_sb, SB_FREEZE_WRITE); -- __sb_end_write(inode->i_sb, SB_FREEZE_WRITE); -+ kiocb_end_write(iocb); - - if (ret < 0) - trace_cachefiles_io_error(object, inode, ret, -@@ -286,7 +284,6 @@ int __cachefiles_write(struct cachefiles_object *object, - { - struct cachefiles_cache *cache; - struct cachefiles_kiocb *ki; -- struct inode *inode; - unsigned int old_nofs; - ssize_t ret; - size_t len = iov_iter_count(iter); -@@ -322,19 +319,12 @@ int __cachefiles_write(struct cachefiles_object *object, - ki->iocb.ki_complete = cachefiles_write_complete; - atomic_long_add(ki->b_writing, &cache->b_writing); - -- /* Open-code file_start_write here to grab freeze protection, which -- * will be released by another thread in aio_complete_rw(). Fool -- * lockdep by telling it the lock got released so that it doesn't -- * complain about the held lock when we return to userspace. -- */ -- inode = file_inode(file); -- __sb_start_write(inode->i_sb, SB_FREEZE_WRITE); -- __sb_writers_release(inode->i_sb, SB_FREEZE_WRITE); -+ kiocb_start_write(&ki->iocb); - - get_file(ki->iocb.ki_filp); - cachefiles_grab_object(object, cachefiles_obj_get_ioreq); - -- trace_cachefiles_write(object, inode, ki->iocb.ki_pos, len); -+ trace_cachefiles_write(object, file_inode(file), ki->iocb.ki_pos, len); - old_nofs = memalloc_nofs_save(); - ret = cachefiles_inject_write_error(); - if (ret == 0) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1327-fs-fix-kernel-doc-warnings.patch b/SOURCES/1327-fs-fix-kernel-doc-warnings.patch deleted file mode 100644 index 333e12091..000000000 --- a/SOURCES/1327-fs-fix-kernel-doc-warnings.patch +++ /dev/null @@ -1,188 +0,0 @@ -From fb0111b77bf45d069d7722682a1a1d202fbf5f7d Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 08:59:20 +0200 -Subject: [PATCH] fs: Fix kernel-doc warnings - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/fs_context.c: one docstring fix was already applied - -commit 35931eb3945b8d38c31f8e956aee3cf31c52121b -Author: Matthew Wilcox (Oracle) -Date: Fri Aug 18 21:08:24 2023 +0100 - - fs: Fix kernel-doc warnings - - These have a variety of causes and a corresponding variety of solutions. - - Signed-off-by: "Matthew Wilcox (Oracle)" - Message-Id: <20230818200824.2720007-1-willy@infradead.org> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file.c b/fs/file.c -index 236e11a38c18..70962ee8c68b 100644 ---- a/fs/file.c -+++ b/fs/file.c -@@ -679,7 +679,7 @@ EXPORT_SYMBOL(close_fd); /* for ksys_close() */ - - /** - * last_fd - return last valid index into fd table -- * @cur_fds: files struct -+ * @fdt: File descriptor table. - * - * Context: Either rcu read lock or files_lock must be held. - * -@@ -734,6 +734,7 @@ static inline void __range_close(struct files_struct *cur_fds, unsigned int fd, - * - * @fd: starting file descriptor to close - * @max_fd: last file descriptor to close -+ * @flags: CLOSE_RANGE flags. - * - * This closes a range of file descriptors. All file descriptors - * from @fd up to and including @max_fd are closed. -diff --git a/fs/fs_context.c b/fs/fs_context.c -index 648d2ee9e5fc..3473e63e8399 100644 ---- a/fs/fs_context.c -+++ b/fs/fs_context.c -@@ -162,6 +162,10 @@ EXPORT_SYMBOL(vfs_parse_fs_param); - - /** - * vfs_parse_fs_string - Convenience function to just parse a string. -+ * @fc: Filesystem context. -+ * @key: Parameter name. -+ * @value: Default value. -+ * @v_size: Maximum number of bytes in the value. - */ - int vfs_parse_fs_string(struct fs_context *fc, const char *key, - const char *value, size_t v_size) -@@ -357,7 +361,7 @@ void fc_drop_locked(struct fs_context *fc) - static void legacy_fs_context_free(struct fs_context *fc); - - /** -- * vfs_dup_fc_config: Duplicate a filesystem context. -+ * vfs_dup_fs_context - Duplicate a filesystem context. - * @src_fc: The context to copy. - */ - struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc) -@@ -403,7 +407,9 @@ EXPORT_SYMBOL(vfs_dup_fs_context); - - /** - * logfc - Log a message to a filesystem context -- * @fc: The filesystem context to log to. -+ * @log: The filesystem context to log to, or NULL to use printk. -+ * @prefix: A string to prefix the output with, or NULL. -+ * @level: 'w' for a warning, 'e' for an error. Anything else is a notice. - * @fmt: The format of the buffer. - */ - void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt, ...) -diff --git a/fs/ioctl.c b/fs/ioctl.c -index 088462ee5a81..64776891120c 100644 ---- a/fs/ioctl.c -+++ b/fs/ioctl.c -@@ -109,9 +109,6 @@ static int ioctl_fibmap(struct file *filp, int __user *p) - * Returns 0 on success, -errno on error, 1 if this was the last - * extent that will fit in user array. - */ --#define SET_UNKNOWN_FLAGS (FIEMAP_EXTENT_DELALLOC) --#define SET_NO_UNMOUNTED_IO_FLAGS (FIEMAP_EXTENT_DATA_ENCRYPTED) --#define SET_NOT_ALIGNED_FLAGS (FIEMAP_EXTENT_DATA_TAIL|FIEMAP_EXTENT_DATA_INLINE) - int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical, - u64 phys, u64 len, u32 flags) - { -@@ -127,6 +124,10 @@ int fiemap_fill_next_extent(struct fiemap_extent_info *fieinfo, u64 logical, - if (fieinfo->fi_extents_mapped >= fieinfo->fi_extents_max) - return 1; - -+#define SET_UNKNOWN_FLAGS (FIEMAP_EXTENT_DELALLOC) -+#define SET_NO_UNMOUNTED_IO_FLAGS (FIEMAP_EXTENT_DATA_ENCRYPTED) -+#define SET_NOT_ALIGNED_FLAGS (FIEMAP_EXTENT_DATA_TAIL|FIEMAP_EXTENT_DATA_INLINE) -+ - if (flags & SET_UNKNOWN_FLAGS) - flags |= FIEMAP_EXTENT_UNKNOWN; - if (flags & SET_NO_UNMOUNTED_IO_FLAGS) -@@ -913,6 +914,9 @@ SYSCALL_DEFINE3(ioctl, unsigned int, fd, unsigned int, cmd, unsigned long, arg) - #ifdef CONFIG_COMPAT - /** - * compat_ptr_ioctl - generic implementation of .compat_ioctl file operation -+ * @file: The file to operate on. -+ * @cmd: The ioctl command number. -+ * @arg: The argument to the ioctl. - * - * This is not normally called as a function, but instead set in struct - * file_operations as -diff --git a/fs/kernel_read_file.c b/fs/kernel_read_file.c -index 5d826274570c..c429c42a6867 100644 ---- a/fs/kernel_read_file.c -+++ b/fs/kernel_read_file.c -@@ -8,16 +8,16 @@ - /** - * kernel_read_file() - read file contents into a kernel buffer - * -- * @file file to read from -- * @offset where to start reading from (see below). -- * @buf pointer to a "void *" buffer for reading into (if -+ * @file: file to read from -+ * @offset: where to start reading from (see below). -+ * @buf: pointer to a "void *" buffer for reading into (if - * *@buf is NULL, a buffer will be allocated, and - * @buf_size will be ignored) -- * @buf_size size of buf, if already allocated. If @buf not -+ * @buf_size: size of buf, if already allocated. If @buf not - * allocated, this is the largest size to allocate. -- * @file_size if non-NULL, the full size of @file will be -+ * @file_size: if non-NULL, the full size of @file will be - * written here. -- * @id the kernel_read_file_id identifying the type of -+ * @id: the kernel_read_file_id identifying the type of - * file contents being read (for LSMs to examine) - * - * @offset must be 0 unless both @buf and @file_size are non-NULL -diff --git a/fs/namei.c b/fs/namei.c -index 0a4b15d9a010..23c73afe57d3 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -644,6 +644,8 @@ static bool nd_alloc_stack(struct nameidata *nd) - - /** - * path_connected - Verify that a dentry is below mnt.mnt_root -+ * @mnt: The mountpoint to check. -+ * @dentry: The dentry to check. - * - * Rename can sometimes move a file or directory outside of a bind - * mount, path_connected allows those cases to be detected. -@@ -1083,6 +1085,7 @@ fs_initcall(init_fs_namei_sysctls); - /** - * may_follow_link - Check symlink following for unsafe situations - * @nd: nameidata pathwalk data -+ * @inode: Used for idmapping. - * - * In the case of the sysctl_protected_symlinks sysctl being enabled, - * CAP_DAC_OVERRIDE needs to be specifically ignored if the symlink is -diff --git a/fs/open.c b/fs/open.c -index e2419242456e..ef2cc51d468c 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1126,7 +1126,7 @@ EXPORT_SYMBOL_GPL(kernel_file_open); - * backing_file_open - open a backing file for kernel internal use - * @path: path of the file to open - * @flags: open flags -- * @path: path of the backing file -+ * @real_path: path of the backing file - * @cred: credentials for open - * - * Open a backing file for a stackable filesystem (e.g., overlayfs). -@@ -1534,7 +1534,7 @@ SYSCALL_DEFINE1(close, unsigned int, fd) - } - - /** -- * close_range() - Close all file descriptors in a given range. -+ * sys_close_range() - Close all file descriptors in a given range. - * - * @fd: starting file descriptor to close - * @max_fd: last file descriptor to close --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1328-fs-rename-mnt-want-drop-write-helpers.patch b/SOURCES/1328-fs-rename-mnt-want-drop-write-helpers.patch deleted file mode 100644 index 6b2b43c62..000000000 --- a/SOURCES/1328-fs-rename-mnt-want-drop-write-helpers.patch +++ /dev/null @@ -1,300 +0,0 @@ -From 484050dcbd77701cd8a295037aaa6365e0dc2f4e Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 09:57:52 +0200 -Subject: [PATCH] fs: rename __mnt_{want,drop}_write*() helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/inode.c: context fuzz - - fs/internal.h: dropped one hunk that modifies a comment in - sb_start_ro_state_change(), which is not present downstream - - fs/namespace.c: needed to rename also exports because of downstream - commit fb4415394e59 ("fs: export mnt_{get,put}_write_access() to modules") - - fs/overlayfs/util.c: previous backport introduced __mnt_...() - callers that also need to be renamed here - -commit 3e15dcf77b23b8e9b9b7f3c0d4def8fe9c12c534 -Author: Amir Goldstein -Date: Fri Sep 8 16:28:59 2023 +0300 - - fs: rename __mnt_{want,drop}_write*() helpers - - Before exporting these helpers to modules, make their names more - meaningful. - - The names mnt_{get,put)_write_access*() were chosen, because they rhyme - with the inode {get,put)_write_access() helpers, which have a very close - meaning for the inode object. - - Suggested-by: Christian Brauner - Link: https://lore.kernel.org/r/20230817-anfechtbar-ruhelosigkeit-8c6cca8443fc@brauner/ - Signed-off-by: Amir Goldstein - Message-Id: <20230908132900.2983519-2-amir73il@gmail.com> - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/inode.c b/fs/inode.c -index 2bc233f8db22..fc484773431b 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -1980,7 +1980,7 @@ void touch_atime(const struct path *path) - if (!sb_start_write_trylock(inode->i_sb)) - return; - -- if (__mnt_want_write(mnt) != 0) -+ if (mnt_get_write_access(mnt) != 0) - goto skip_update; - /* - * File systems can error out when updating inodes if they need to -@@ -1993,7 +1993,7 @@ void touch_atime(const struct path *path) - */ - now = current_time(inode); - update_time(inode, &now, S_ATIME); -- __mnt_drop_write(mnt); -+ mnt_put_write_access(mnt); - skip_update: - sb_end_write(inode->i_sb); - } -@@ -2110,9 +2110,9 @@ static int __file_update_time(struct file *file, struct timespec64 *now, - struct inode *inode = file_inode(file); - - /* try to update time settings */ -- if (!__mnt_want_write_file(file)) { -+ if (!mnt_get_write_access_file(file)) { - ret = update_time(inode, now, sync_mode); -- __mnt_drop_write_file(file); -+ mnt_put_write_access_file(file); - } - - return ret; -diff --git a/fs/internal.h b/fs/internal.h -index 62b558fa6395..85bf69115cf4 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -76,8 +76,8 @@ extern int sb_prepare_remount_readonly(struct super_block *); - - extern void __init mnt_init(void); - --extern int __mnt_want_write_file(struct file *); --extern void __mnt_drop_write_file(struct file *); -+int mnt_get_write_access_file(struct file *file); -+void mnt_put_write_access_file(struct file *file); - - extern void dissolve_on_fput(struct vfsmount *); - -@@ -103,7 +103,7 @@ static inline void put_file_access(struct file *file) - i_readcount_dec(file->f_inode); - } else if (file->f_mode & FMODE_WRITER) { - put_write_access(file->f_inode); -- __mnt_drop_write(file->f_path.mnt); -+ mnt_put_write_access(file->f_path.mnt); - } - } - -diff --git a/fs/namespace.c b/fs/namespace.c -index d032d84d66ed..218f1b77bf56 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -333,16 +333,16 @@ static int mnt_is_readonly(struct vfsmount *mnt) - * can determine when writes are able to occur to a filesystem. - */ - /** -- * __mnt_want_write - get write access to a mount without freeze protection -+ * mnt_get_write_access - get write access to a mount without freeze protection - * @m: the mount on which to take a write - * - * This tells the low-level filesystem that a write is about to be performed to - * it, and makes sure that writes are allowed (mnt it read-write) before - * returning success. This operation does not protect against filesystem being -- * frozen. When the write operation is finished, __mnt_drop_write() must be -+ * frozen. When the write operation is finished, mnt_put_write_access() must be - * called. This is effectively a refcount. - */ --int __mnt_want_write(struct vfsmount *m) -+int mnt_get_write_access(struct vfsmount *m) - { - struct mount *mnt = real_mount(m); - int ret = 0; -@@ -371,7 +371,7 @@ int __mnt_want_write(struct vfsmount *m) - - return ret; - } --EXPORT_SYMBOL_GPL(__mnt_want_write); -+EXPORT_SYMBOL_GPL(mnt_get_write_access); - - /** - * mnt_want_write - get write access to a mount -@@ -387,7 +387,7 @@ int mnt_want_write(struct vfsmount *m) - int ret; - - sb_start_write(m->mnt_sb); -- ret = __mnt_want_write(m); -+ ret = mnt_get_write_access(m); - if (ret) - sb_end_write(m->mnt_sb); - return ret; -@@ -395,15 +395,15 @@ int mnt_want_write(struct vfsmount *m) - EXPORT_SYMBOL_GPL(mnt_want_write); - - /** -- * __mnt_want_write_file - get write access to a file's mount -+ * mnt_get_write_access_file - get write access to a file's mount - * @file: the file who's mount on which to take a write - * -- * This is like __mnt_want_write, but if the file is already open for writing it -+ * This is like mnt_get_write_access, but if @file is already open for write it - * skips incrementing mnt_writers (since the open file already has a reference) - * and instead only does the check for emergency r/o remounts. This must be -- * paired with __mnt_drop_write_file. -+ * paired with mnt_put_write_access_file. - */ --int __mnt_want_write_file(struct file *file) -+int mnt_get_write_access_file(struct file *file) - { - if (file->f_mode & FMODE_WRITER) { - /* -@@ -414,7 +414,7 @@ int __mnt_want_write_file(struct file *file) - return -EROFS; - return 0; - } -- return __mnt_want_write(file->f_path.mnt); -+ return mnt_get_write_access(file->f_path.mnt); - } - - /** -@@ -431,7 +431,7 @@ int mnt_want_write_file(struct file *file) - int ret; - - sb_start_write(file_inode(file)->i_sb); -- ret = __mnt_want_write_file(file); -+ ret = mnt_get_write_access_file(file); - if (ret) - sb_end_write(file_inode(file)->i_sb); - return ret; -@@ -439,20 +439,20 @@ int mnt_want_write_file(struct file *file) - EXPORT_SYMBOL_GPL(mnt_want_write_file); - - /** -- * __mnt_drop_write - give up write access to a mount -+ * mnt_put_write_access - give up write access to a mount - * @mnt: the mount on which to give up write access - * - * Tells the low-level filesystem that we are done - * performing writes to it. Must be matched with -- * __mnt_want_write() call above. -+ * mnt_get_write_access() call above. - */ --void __mnt_drop_write(struct vfsmount *mnt) -+void mnt_put_write_access(struct vfsmount *mnt) - { - preempt_disable(); - mnt_dec_writers(real_mount(mnt)); - preempt_enable(); - } --EXPORT_SYMBOL_GPL(__mnt_drop_write); -+EXPORT_SYMBOL_GPL(mnt_put_write_access); - - /** - * mnt_drop_write - give up write access to a mount -@@ -464,20 +464,20 @@ EXPORT_SYMBOL_GPL(__mnt_drop_write); - */ - void mnt_drop_write(struct vfsmount *mnt) - { -- __mnt_drop_write(mnt); -+ mnt_put_write_access(mnt); - sb_end_write(mnt->mnt_sb); - } - EXPORT_SYMBOL_GPL(mnt_drop_write); - --void __mnt_drop_write_file(struct file *file) -+void mnt_put_write_access_file(struct file *file) - { - if (!(file->f_mode & FMODE_WRITER)) -- __mnt_drop_write(file->f_path.mnt); -+ mnt_put_write_access(file->f_path.mnt); - } - - void mnt_drop_write_file(struct file *file) - { -- __mnt_drop_write_file(file); -+ mnt_put_write_access_file(file); - sb_end_write(file_inode(file)->i_sb); - } - EXPORT_SYMBOL(mnt_drop_write_file); -diff --git a/fs/open.c b/fs/open.c -index ef2cc51d468c..b75b1ab6305b 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -867,7 +867,7 @@ static int do_dentry_open(struct file *f, - error = get_write_access(inode); - if (unlikely(error)) - goto cleanup_file; -- error = __mnt_want_write(f->f_path.mnt); -+ error = mnt_get_write_access(f->f_path.mnt); - if (unlikely(error)) { - put_write_access(inode); - goto cleanup_file; -diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c -index 6b31b6587e4d..81ef76c77cab 100644 ---- a/fs/overlayfs/util.c -+++ b/fs/overlayfs/util.c -@@ -21,7 +21,7 @@ - int ovl_get_write_access(struct dentry *dentry) - { - struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -- return __mnt_want_write(ovl_upper_mnt(ofs)); -+ return mnt_get_write_access(ovl_upper_mnt(ofs)); - } - - /* Get write access to upper sb - may block if upper sb is frozen */ -@@ -40,7 +40,7 @@ int ovl_want_write(struct dentry *dentry) - void ovl_put_write_access(struct dentry *dentry) - { - struct ovl_fs *ofs = OVL_FS(dentry->d_sb); -- __mnt_drop_write(ovl_upper_mnt(ofs)); -+ mnt_put_write_access(ovl_upper_mnt(ofs)); - } - - void ovl_end_write(struct dentry *dentry) -diff --git a/include/linux/mount.h b/include/linux/mount.h -index 37dc2a161f73..0f214b0a0992 100644 ---- a/include/linux/mount.h -+++ b/include/linux/mount.h -@@ -92,8 +92,8 @@ extern bool __mnt_is_readonly(struct vfsmount *mnt); - extern bool mnt_may_suid(struct vfsmount *mnt); - - extern struct vfsmount *clone_private_mount(const struct path *path); --extern int __mnt_want_write(struct vfsmount *); --extern void __mnt_drop_write(struct vfsmount *); -+int mnt_get_write_access(struct vfsmount *mnt); -+void mnt_put_write_access(struct vfsmount *mnt); - - extern struct vfsmount *fc_mount(struct fs_context *fc); - extern struct vfsmount *fc_mount_longterm(struct fs_context *fc); -diff --git a/kernel/acct.c b/kernel/acct.c -index bbea312b9d76..b3e00389d42d 100644 ---- a/kernel/acct.c -+++ b/kernel/acct.c -@@ -235,7 +235,7 @@ static int acct_on(struct filename *pathname) - filp_close(file, NULL); - return PTR_ERR(internal); - } -- err = __mnt_want_write(internal); -+ err = mnt_get_write_access(internal); - if (err) { - mntput(internal); - kfree(acct); -@@ -260,7 +260,7 @@ static int acct_on(struct filename *pathname) - old = xchg(&ns->bacct, &acct->pin); - mutex_unlock(&acct->lock); - pin_kill(old); -- __mnt_drop_write(mnt); -+ mnt_put_write_access(mnt); - mntput(mnt); - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1329-fs-get-mnt-writers-count-for-an-open-backing-file-s-real-pat.patch b/SOURCES/1329-fs-get-mnt-writers-count-for-an-open-backing-file-s-real-pat.patch deleted file mode 100644 index beba5b7f5..000000000 --- a/SOURCES/1329-fs-get-mnt-writers-count-for-an-open-backing-file-s-real-pat.patch +++ /dev/null @@ -1,109 +0,0 @@ -From fed3cc66e15fba2f8b48257cfbe82ab6eac11a39 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:35:52 +0200 -Subject: [PATCH] fs: get mnt_writers count for an open backing file's real - path - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 83bc1d294130cc471a89ce10770daa281a93fcb0 -Author: Amir Goldstein -Date: Mon Oct 9 18:37:10 2023 +0300 - - fs: get mnt_writers count for an open backing file's real path - - A writeable mapped backing file can perform writes to the real inode. - Therefore, the real path mount must be kept writable so long as the - writable map exists. - - This may not be strictly needed for ovelrayfs private upper mount, - but it is correct to take the mnt_writers count in the vfs helper. - - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/r/20231009153712.1566422-2-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/internal.h b/fs/internal.h -index 85bf69115cf4..29369382249d 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -97,13 +97,20 @@ struct file *alloc_empty_file(int flags, const struct cred *cred); - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); - struct file *alloc_empty_backing_file(int flags, const struct cred *cred); - -+static inline void file_put_write_access(struct file *file) -+{ -+ put_write_access(file->f_inode); -+ mnt_put_write_access(file->f_path.mnt); -+ if (unlikely(file->f_mode & FMODE_BACKING)) -+ mnt_put_write_access(backing_file_real_path(file)->mnt); -+} -+ - static inline void put_file_access(struct file *file) - { - if ((file->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { - i_readcount_dec(file->f_inode); - } else if (file->f_mode & FMODE_WRITER) { -- put_write_access(file->f_inode); -- mnt_put_write_access(file->f_path.mnt); -+ file_put_write_access(file); - } - } - -diff --git a/fs/open.c b/fs/open.c -index b75b1ab6305b..64e4bbd1f28c 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -842,6 +842,30 @@ SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group) - return ksys_fchown(fd, user, group); - } - -+static inline int file_get_write_access(struct file *f) -+{ -+ int error; -+ -+ error = get_write_access(f->f_inode); -+ if (unlikely(error)) -+ return error; -+ error = mnt_get_write_access(f->f_path.mnt); -+ if (unlikely(error)) -+ goto cleanup_inode; -+ if (unlikely(f->f_mode & FMODE_BACKING)) { -+ error = mnt_get_write_access(backing_file_real_path(f)->mnt); -+ if (unlikely(error)) -+ goto cleanup_mnt; -+ } -+ return 0; -+ -+cleanup_mnt: -+ mnt_put_write_access(f->f_path.mnt); -+cleanup_inode: -+ put_write_access(f->f_inode); -+ return error; -+} -+ - static int do_dentry_open(struct file *f, - struct inode *inode, - int (*open)(struct inode *, struct file *)) -@@ -864,14 +888,9 @@ static int do_dentry_open(struct file *f, - if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { - i_readcount_inc(inode); - } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { -- error = get_write_access(inode); -+ error = file_get_write_access(f); - if (unlikely(error)) - goto cleanup_file; -- error = mnt_get_write_access(f->f_path.mnt); -- if (unlikely(error)) { -- put_write_access(inode); -- goto cleanup_file; -- } - f->f_mode |= FMODE_WRITER; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1330-fs-create-helper-file-user-path-for-user-displayed-mapped-fi.patch b/SOURCES/1330-fs-create-helper-file-user-path-for-user-displayed-mapped-fi.patch deleted file mode 100644 index 2b21a7f5b..000000000 --- a/SOURCES/1330-fs-create-helper-file-user-path-for-user-displayed-mapped-fi.patch +++ /dev/null @@ -1,153 +0,0 @@ -From f3d228ade9542a4fac0e0d4d2721e2a94f2d6d98 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:36:39 +0200 -Subject: [PATCH] fs: create helper file_user_path() for user displayed mapped - file path - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 08582d678fcf11fc86188f0b92239d3d49667d8e -Author: Amir Goldstein -Date: Mon Oct 9 18:37:11 2023 +0300 - - fs: create helper file_user_path() for user displayed mapped file path - - Overlayfs uses backing files with "fake" overlayfs f_path and "real" - underlying f_inode, in order to use underlying inode aops for mapped - files and to display the overlayfs path in /proc//maps. - - In preparation for storing the overlayfs "fake" path instead of the - underlying "real" path in struct backing_file, define a noop helper - file_user_path() that returns f_path for now. - - Use the new helper in procfs and kernel logs whenever a path of a - mapped file is displayed to users. - - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/r/20231009153712.1566422-3-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/arch/arc/kernel/troubleshoot.c b/arch/arc/kernel/troubleshoot.c -index 7654c2e42dc0..134c48374ecd 100644 ---- a/arch/arc/kernel/troubleshoot.c -+++ b/arch/arc/kernel/troubleshoot.c -@@ -90,10 +90,12 @@ static void show_faulting_vma(unsigned long address) - */ - if (vma) { - char buf[ARC_PATH_MAX]; -- char *nm = "?"; -+ char *nm = "anon"; - - if (vma->vm_file) { -- nm = file_path(vma->vm_file, buf, ARC_PATH_MAX-1); -+ /* XXX: can we use %pD below and get rid of buf? */ -+ nm = d_path(file_user_path(vma->vm_file), buf, -+ ARC_PATH_MAX-1); - if (IS_ERR(nm)) - nm = "?"; - } -diff --git a/fs/proc/base.c b/fs/proc/base.c -index dbb251465954..cb79b5f1d459 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -2190,7 +2190,7 @@ static int map_files_get_link(struct dentry *dentry, struct path *path) - rc = -ENOENT; - vma = find_exact_vma(mm, vm_start, vm_end); - if (vma && vma->vm_file) { -- *path = vma->vm_file->f_path; -+ *path = *file_user_path(vma->vm_file); - path_get(path); - rc = 0; - } -diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c -index 13452b32e2bd..b7e06be41224 100644 ---- a/fs/proc/nommu.c -+++ b/fs/proc/nommu.c -@@ -59,7 +59,7 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region) - - if (file) { - seq_pad(m, ' '); -- seq_file_path(m, file, ""); -+ seq_path(m, file_user_path(file), ""); - } - - seq_putc(m, '\n'); -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index e396e52ca096..6180dc935136 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -295,7 +295,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma) - if (anon_name) - seq_printf(m, "[anon_shmem:%s]", anon_name->name); - else -- seq_file_path(m, file, "\n"); -+ seq_path(m, file_user_path(file), "\n"); - goto done; - } - -@@ -1952,7 +1952,7 @@ static int show_numa_map(struct seq_file *m, void *v) - - if (file) { - seq_puts(m, " file="); -- seq_file_path(m, file, "\n\t= "); -+ seq_path(m, file_user_path(file), "\n\t= "); - } else if (vma_is_initial_heap(vma)) { - seq_puts(m, " heap"); - } else if (vma_is_initial_stack(vma)) { -diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c -index 4d52623e1bff..a3822c149f12 100644 ---- a/fs/proc/task_nommu.c -+++ b/fs/proc/task_nommu.c -@@ -162,7 +162,7 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma) - - if (file) { - seq_pad(m, ' '); -- seq_file_path(m, file, ""); -+ seq_path(m, file_user_path(file), ""); - } else if (mm && vma_is_initial_stack(vma)) { - seq_pad(m, ' '); - seq_puts(m, "[stack]"); -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 48ec31b9d230..4ee6ed9e2634 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2607,6 +2607,20 @@ static inline const struct path *file_real_path(struct file *f) - return &f->f_path; - } - -+/* -+ * file_user_path - get the path to display for memory mapped file -+ * -+ * When mmapping a file on a stackable filesystem (e.g., overlayfs), the file -+ * stored in ->vm_file is a backing file whose f_inode is on the underlying -+ * filesystem. When the mapped file path is displayed to user (e.g. via -+ * /proc//maps), this helper should be used to get the path to display -+ * to the user, which is the path of the fd that user has requested to map. -+ */ -+static inline const struct path *file_user_path(struct file *f) -+{ -+ return &f->f_path; -+} -+ - static inline struct file *file_clone_open(struct file *file) - { - return dentry_open(&file->f_path, file->f_flags, file->f_cred); -diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c -index 0fda3619c425..6d89bc793c96 100644 ---- a/kernel/trace/trace_output.c -+++ b/kernel/trace/trace_output.c -@@ -405,7 +405,7 @@ static int seq_print_user_ip(struct trace_seq *s, struct mm_struct *mm, - vmstart = vma->vm_start; - } - if (file) { -- ret = trace_seq_path(s, &file->f_path); -+ ret = trace_seq_path(s, file_user_path(file)); - if (ret) - trace_seq_printf(s, "[+0x%lx]", - ip - vmstart); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1331-fs-store-real-path-instead-of-fake-path-in-backing-file-f-pa.patch b/SOURCES/1331-fs-store-real-path-instead-of-fake-path-in-backing-file-f-pa.patch deleted file mode 100644 index 829a6cdfa..000000000 --- a/SOURCES/1331-fs-store-real-path-instead-of-fake-path-in-backing-file-f-pa.patch +++ /dev/null @@ -1,240 +0,0 @@ -From da5c3bc8093871a2c6c90187b645cc29cc0230ef Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:37:33 +0200 -Subject: [PATCH] fs: store real path instead of fake path in backing file - f_path - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/internal.h: context fuzz - -commit def3ae83da02f87005210fa3d448c5dd37ba4105 -Author: Amir Goldstein -Date: Mon Oct 9 18:37:12 2023 +0300 - - fs: store real path instead of fake path in backing file f_path - - A backing file struct stores two path's, one "real" path that is referring - to f_inode and one "fake" path, which should be displayed to users in - /proc//maps. - - There is a lot more potential code that needs to know the "real" path, then - code that needs to know the "fake" path. - - Instead of code having to request the "real" path with file_real_path(), - store the "real" path in f_path and require code that needs to know the - "fake" path request it with file_user_path(). - Replace the file_real_path() helper with a simple const accessor f_path(). - - After this change, file_dentry() is not expected to observe any files - with overlayfs f_path and real f_inode, so the call to ->d_real() should - not be needed. Leave the ->d_real() call for now and add an assertion - in ovl_d_real() to catch if we made wrong assumptions. - - Suggested-by: Miklos Szeredi - Link: https://lore.kernel.org/r/CAJfpegtt48eXhhjDFA1ojcHPNKj3Go6joryCPtEFAKpocyBsnw@mail.gmail.com/ - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/r/20231009153712.1566422-4-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index b0a8c2608530..e5c7b9705109 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -44,10 +44,10 @@ static struct kmem_cache *filp_cachep __read_mostly; - - static struct percpu_counter nr_files __cacheline_aligned_in_smp; - --/* Container for backing file with optional real path */ -+/* Container for backing file with optional user path */ - struct backing_file { - struct file file; -- struct path real_path; -+ struct path user_path; - }; - - static inline struct backing_file *backing_file(struct file *f) -@@ -55,11 +55,11 @@ static inline struct backing_file *backing_file(struct file *f) - return container_of(f, struct backing_file, file); - } - --struct path *backing_file_real_path(struct file *f) -+struct path *backing_file_user_path(struct file *f) - { -- return &backing_file(f)->real_path; -+ return &backing_file(f)->user_path; - } --EXPORT_SYMBOL_GPL(backing_file_real_path); -+EXPORT_SYMBOL_GPL(backing_file_user_path); - - static void file_free_rcu(struct rcu_head *head) - { -@@ -76,7 +76,7 @@ static inline void file_free(struct file *f) - { - security_file_free(f); - if (unlikely(f->f_mode & FMODE_BACKING)) -- path_put(backing_file_real_path(f)); -+ path_put(backing_file_user_path(f)); - if (likely(!(f->f_mode & FMODE_NOACCOUNT))) - percpu_counter_dec(&nr_files); - call_rcu(&f->f_u.fu_rcuhead, file_free_rcu); -diff --git a/fs/internal.h b/fs/internal.h -index 29369382249d..bd0934d0521b 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -102,7 +102,7 @@ static inline void file_put_write_access(struct file *file) - put_write_access(file->f_inode); - mnt_put_write_access(file->f_path.mnt); - if (unlikely(file->f_mode & FMODE_BACKING)) -- mnt_put_write_access(backing_file_real_path(file)->mnt); -+ mnt_put_write_access(backing_file_user_path(file)->mnt); - } - - static inline void put_file_access(struct file *file) -diff --git a/fs/open.c b/fs/open.c -index 64e4bbd1f28c..45547548a0e5 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -853,7 +853,7 @@ static inline int file_get_write_access(struct file *f) - if (unlikely(error)) - goto cleanup_inode; - if (unlikely(f->f_mode & FMODE_BACKING)) { -- error = mnt_get_write_access(backing_file_real_path(f)->mnt); -+ error = mnt_get_write_access(backing_file_user_path(f)->mnt); - if (unlikely(error)) - goto cleanup_mnt; - } -@@ -1143,20 +1143,19 @@ EXPORT_SYMBOL_GPL(kernel_file_open); - - /** - * backing_file_open - open a backing file for kernel internal use -- * @path: path of the file to open -+ * @user_path: path that the user reuqested to open - * @flags: open flags - * @real_path: path of the backing file - * @cred: credentials for open - * - * Open a backing file for a stackable filesystem (e.g., overlayfs). -- * @path may be on the stackable filesystem and backing inode on the -- * underlying filesystem. In this case, we want to be able to return -- * the @real_path of the backing inode. This is done by embedding the -- * returned file into a container structure that also stores the path of -- * the backing inode on the underlying filesystem, which can be -- * retrieved using backing_file_real_path(). -+ * @user_path may be on the stackable filesystem and @real_path on the -+ * underlying filesystem. In this case, we want to be able to return the -+ * @user_path of the stackable filesystem. This is done by embedding the -+ * returned file into a container structure that also stores the stacked -+ * file's path, which can be retrieved using backing_file_user_path(). - */ --struct file *backing_file_open(const struct path *path, int flags, -+struct file *backing_file_open(const struct path *user_path, int flags, - const struct path *real_path, - const struct cred *cred) - { -@@ -1167,9 +1166,9 @@ struct file *backing_file_open(const struct path *path, int flags, - if (IS_ERR(f)) - return f; - -- f->f_path = *path; -- path_get(real_path); -- *backing_file_real_path(f) = *real_path; -+ path_get(user_path); -+ *backing_file_user_path(f) = *user_path; -+ f->f_path = *real_path; - error = do_dentry_open(f, d_inode(real_path->dentry), NULL); - if (error) { - fput(f); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index c49b1e7575d3..0779c8290ec4 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -34,14 +34,22 @@ static struct dentry *ovl_d_real(struct dentry *dentry, - struct dentry *real = NULL, *lower; - int err; - -- /* It's an overlay file */ -+ /* -+ * vfs is only expected to call d_real() with NULL from d_real_inode() -+ * and with overlay inode from file_dentry() on an overlay file. -+ * -+ * TODO: remove @inode argument from d_real() API, remove code in this -+ * function that deals with non-NULL @inode and remove d_real() call -+ * from file_dentry(). -+ */ - if (inode && d_inode(dentry) == inode) - return dentry; -+ else if (inode) -+ goto bug; - - if (!d_is_reg(dentry)) { -- if (!inode || inode == d_inode(dentry)) -- return dentry; -- goto bug; -+ /* d_real_inode() is only relevant for regular files */ -+ return dentry; - } - - real = ovl_dentry_upper(dentry); -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 4ee6ed9e2634..1927fcdad989 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2586,26 +2586,10 @@ struct file *dentry_open(const struct path *path, int flags, - const struct cred *creds); - struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); --struct file *backing_file_open(const struct path *path, int flags, -+struct file *backing_file_open(const struct path *user_path, int flags, - const struct path *real_path, - const struct cred *cred); --struct path *backing_file_real_path(struct file *f); -- --/* -- * file_real_path - get the path corresponding to f_inode -- * -- * When opening a backing file for a stackable filesystem (e.g., -- * overlayfs) f_path may be on the stackable filesystem and f_inode on -- * the underlying filesystem. When the path associated with f_inode is -- * needed, this helper should be used instead of accessing f_path -- * directly. --*/ --static inline const struct path *file_real_path(struct file *f) --{ -- if (unlikely(f->f_mode & FMODE_BACKING)) -- return backing_file_real_path(f); -- return &f->f_path; --} -+struct path *backing_file_user_path(struct file *f); - - /* - * file_user_path - get the path to display for memory mapped file -@@ -2618,6 +2602,8 @@ static inline const struct path *file_real_path(struct file *f) - */ - static inline const struct path *file_user_path(struct file *f) - { -+ if (unlikely(f->f_mode & FMODE_BACKING)) -+ return backing_file_user_path(f); - return &f->f_path; - } - -diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h -index ed48e4f1e755..bcb6609b54b3 100644 ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -96,8 +96,7 @@ static inline int fsnotify_file(struct file *file, __u32 mask) - if (file->f_mode & FMODE_NONOTIFY) - return 0; - -- /* Overlayfs internal files have fake f_path */ -- path = file_real_path(file); -+ path = &file->f_path; - return fsnotify_parent(path->dentry, mask, path, FSNOTIFY_EVENT_PATH); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1332-fs-prepare-for-stackable-filesystems-backing-file-helpers.patch b/SOURCES/1332-fs-prepare-for-stackable-filesystems-backing-file-helpers.patch deleted file mode 100644 index 5937137c0..000000000 --- a/SOURCES/1332-fs-prepare-for-stackable-filesystems-backing-file-helpers.patch +++ /dev/null @@ -1,243 +0,0 @@ -From ecbb1b105f3616d4342dba0f840dcf9265dfbea0 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:42:36 +0200 -Subject: [PATCH] fs: prepare for stackable filesystems backing file helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit f91a704f7161c2cf0fcd41fa9fbec4355b813fff -Author: Amir Goldstein -Date: Mon Oct 2 17:19:46 2023 +0300 - - fs: prepare for stackable filesystems backing file helpers - - In preparation for factoring out some backing file io helpers from - overlayfs, move backing_file_open() into a new file fs/backing-file.c - and header. - - Add a MAINTAINERS entry for stackable filesystems and add a Kconfig - FS_STACK which stackable filesystems need to select. - - For now, the backing_file struct, the backing_file alloc/free functions - and the backing_file_real_path() accessor remain internal to file_table.c. - We may change that in the future. - - Signed-off-by: Amir Goldstein - -Signed-off-by: Ondrej Mosnacek - -diff --git a/MAINTAINERS b/MAINTAINERS -index f5dcab467670..3a29f2d3a2b1 100644 ---- a/MAINTAINERS -+++ b/MAINTAINERS -@@ -7475,6 +7475,15 @@ F: fs/mnt_idmapping.c - F: include/linux/mnt_idmapping.* - F: tools/testing/selftests/mount_setattr/ - -+FILESYSTEMS [STACKABLE] -+M: Miklos Szeredi -+M: Amir Goldstein -+L: linux-fsdevel@vger.kernel.org -+L: linux-unionfs@vger.kernel.org -+S: Maintained -+F: fs/backing-file.c -+F: include/linux/backing-file.h -+ - FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER - M: Riku Voipio - L: linux-hwmon@vger.kernel.org -diff --git a/fs/Kconfig b/fs/Kconfig -index 5378e55f87d3..a9c6fa9cff1f 100644 ---- a/fs/Kconfig -+++ b/fs/Kconfig -@@ -18,6 +18,10 @@ config VALIDATE_FS_PARSER - config FS_IOMAP - bool - -+# Stackable filesystems -+config FS_STACK -+ bool -+ - config BUFFER_HEAD - bool - -diff --git a/fs/Makefile b/fs/Makefile -index 0da17ff145c6..716c9fe04dec 100644 ---- a/fs/Makefile -+++ b/fs/Makefile -@@ -41,6 +41,7 @@ obj-$(CONFIG_COMPAT_BINFMT_ELF) += compat_binfmt_elf.o - obj-$(CONFIG_BINFMT_ELF_FDPIC) += binfmt_elf_fdpic.o - obj-$(CONFIG_BINFMT_FLAT) += binfmt_flat.o - -+obj-$(CONFIG_FS_STACK) += backing-file.o - obj-$(CONFIG_FS_MBCACHE) += mbcache.o - obj-$(CONFIG_FS_POSIX_ACL) += posix_acl.o - obj-$(CONFIG_NFS_COMMON) += nfs_common/ -diff --git a/fs/backing-file.c b/fs/backing-file.c -new file mode 100644 -index 000000000000..04b33036f709 ---- /dev/null -+++ b/fs/backing-file.c -@@ -0,0 +1,48 @@ -+// SPDX-License-Identifier: GPL-2.0-only -+/* -+ * Common helpers for stackable filesystems and backing files. -+ * -+ * Copyright (C) 2023 CTERA Networks. -+ */ -+ -+#include -+#include -+ -+#include "internal.h" -+ -+/** -+ * backing_file_open - open a backing file for kernel internal use -+ * @user_path: path that the user reuqested to open -+ * @flags: open flags -+ * @real_path: path of the backing file -+ * @cred: credentials for open -+ * -+ * Open a backing file for a stackable filesystem (e.g., overlayfs). -+ * @user_path may be on the stackable filesystem and @real_path on the -+ * underlying filesystem. In this case, we want to be able to return the -+ * @user_path of the stackable filesystem. This is done by embedding the -+ * returned file into a container structure that also stores the stacked -+ * file's path, which can be retrieved using backing_file_user_path(). -+ */ -+struct file *backing_file_open(const struct path *user_path, int flags, -+ const struct path *real_path, -+ const struct cred *cred) -+{ -+ struct file *f; -+ int error; -+ -+ f = alloc_empty_backing_file(flags, cred); -+ if (IS_ERR(f)) -+ return f; -+ -+ path_get(user_path); -+ *backing_file_user_path(f) = *user_path; -+ error = vfs_open(real_path, f); -+ if (error) { -+ fput(f); -+ f = ERR_PTR(error); -+ } -+ -+ return f; -+} -+EXPORT_SYMBOL_GPL(backing_file_open); -diff --git a/fs/open.c b/fs/open.c -index 45547548a0e5..4260d61560d4 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -1141,44 +1141,6 @@ struct file *kernel_file_open(const struct path *path, int flags, - } - EXPORT_SYMBOL_GPL(kernel_file_open); - --/** -- * backing_file_open - open a backing file for kernel internal use -- * @user_path: path that the user reuqested to open -- * @flags: open flags -- * @real_path: path of the backing file -- * @cred: credentials for open -- * -- * Open a backing file for a stackable filesystem (e.g., overlayfs). -- * @user_path may be on the stackable filesystem and @real_path on the -- * underlying filesystem. In this case, we want to be able to return the -- * @user_path of the stackable filesystem. This is done by embedding the -- * returned file into a container structure that also stores the stacked -- * file's path, which can be retrieved using backing_file_user_path(). -- */ --struct file *backing_file_open(const struct path *user_path, int flags, -- const struct path *real_path, -- const struct cred *cred) --{ -- struct file *f; -- int error; -- -- f = alloc_empty_backing_file(flags, cred); -- if (IS_ERR(f)) -- return f; -- -- path_get(user_path); -- *backing_file_user_path(f) = *user_path; -- f->f_path = *real_path; -- error = do_dentry_open(f, d_inode(real_path->dentry), NULL); -- if (error) { -- fput(f); -- f = ERR_PTR(error); -- } -- -- return f; --} --EXPORT_SYMBOL_GPL(backing_file_open); -- - #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) - #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC) - -diff --git a/fs/overlayfs/Kconfig b/fs/overlayfs/Kconfig -index 6708e54b0e30..148d9567b5c3 100644 ---- a/fs/overlayfs/Kconfig -+++ b/fs/overlayfs/Kconfig -@@ -1,6 +1,7 @@ - # SPDX-License-Identifier: GPL-2.0-only - config OVERLAY_FS - tristate "Overlay filesystem support" -+ select FS_STACK - select EXPORTFS - help - An overlay filesystem combines two filesystems - an 'upper' filesystem -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index cd0770bb3020..634a96a65bfd 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include "overlayfs.h" - - #include "../internal.h" /* for sb_init_dio_done_wq */ -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -new file mode 100644 -index 000000000000..55c9e804f780 ---- /dev/null -+++ b/include/linux/backing-file.h -@@ -0,0 +1,17 @@ -+/* SPDX-License-Identifier: GPL-2.0-only */ -+/* -+ * Common helpers for stackable filesystems and backing files. -+ * -+ * Copyright (C) 2023 CTERA Networks. -+ */ -+ -+#ifndef _LINUX_BACKING_FILE_H -+#define _LINUX_BACKING_FILE_H -+ -+#include -+ -+struct file *backing_file_open(const struct path *user_path, int flags, -+ const struct path *real_path, -+ const struct cred *cred); -+ -+#endif /* _LINUX_BACKING_FILE_H */ -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 1927fcdad989..5f3ca25c77e5 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2586,9 +2586,6 @@ struct file *dentry_open(const struct path *path, int flags, - const struct cred *creds); - struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); --struct file *backing_file_open(const struct path *user_path, int flags, -- const struct path *real_path, -- const struct cred *cred); - struct path *backing_file_user_path(struct file *f); - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1333-fs-factor-out-backing-file-read-write-iter-helpers.patch b/SOURCES/1333-fs-factor-out-backing-file-read-write-iter-helpers.patch deleted file mode 100644 index 48da62712..000000000 --- a/SOURCES/1333-fs-factor-out-backing-file-read-write-iter-helpers.patch +++ /dev/null @@ -1,600 +0,0 @@ -From 37577a7bb4d8c217f23a2b47e8fbe66640e0588d Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:51:36 +0200 -Subject: [PATCH] fs: factor out backing_file_{read,write}_iter() helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/overlayfs/file.c & fs/backing-file.c: carried over downstream - logic of calling *_start_write()/*_end_write() because of not - backported commits: 269aed7014b3 ("fs: move file_start_write() into - vfs_iter_write()") and 6ae654392bb5 ("fs: move kiocb_start_write() - into vfs_iocb_iter_write()") - those commits were skipped in this - MR, because vfs_iter_write() appears in K-A-B-I stable lists and - changing the convention could break partner modules - -commit a6293b3e285cd0d7692141d7981a5f144f0e2f0b -Author: Amir Goldstein -Date: Wed Nov 22 17:48:52 2023 +0200 - - fs: factor out backing_file_{read,write}_iter() helpers - - Overlayfs submits files io to backing files on other filesystems. - Factor out some common helpers to perform io to backing files, into - fs/backing-file.c. - - Suggested-by: Miklos Szeredi - Link: https://lore.kernel.org/r/CAJfpeguhmZbjP3JLqtUy0AdWaHOkAPWeP827BBWwRFEAUgnUcQ@mail.gmail.com - Signed-off-by: Amir Goldstein - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 04b33036f709..6d915a45e288 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -2,6 +2,9 @@ - /* - * Common helpers for stackable filesystems and backing files. - * -+ * Forked from fs/overlayfs/file.c. -+ * -+ * Copyright (C) 2017 Red Hat, Inc. - * Copyright (C) 2023 CTERA Networks. - */ - -@@ -46,3 +49,213 @@ struct file *backing_file_open(const struct path *user_path, int flags, - return f; - } - EXPORT_SYMBOL_GPL(backing_file_open); -+ -+struct backing_aio { -+ struct kiocb iocb; -+ refcount_t ref; -+ struct kiocb *orig_iocb; -+ /* used for aio completion */ -+ void (*end_write)(struct file *); -+ struct work_struct work; -+ long res; -+}; -+ -+static struct kmem_cache *backing_aio_cachep; -+ -+#define BACKING_IOCB_MASK \ -+ (IOCB_NOWAIT | IOCB_HIPRI | IOCB_DSYNC | IOCB_SYNC | IOCB_APPEND) -+ -+static rwf_t iocb_to_rw_flags(int flags) -+{ -+ return (__force rwf_t)(flags & BACKING_IOCB_MASK); -+} -+ -+static void backing_aio_put(struct backing_aio *aio) -+{ -+ if (refcount_dec_and_test(&aio->ref)) { -+ fput(aio->iocb.ki_filp); -+ kmem_cache_free(backing_aio_cachep, aio); -+ } -+} -+ -+static void backing_aio_cleanup(struct backing_aio *aio, long res) -+{ -+ struct kiocb *iocb = &aio->iocb; -+ struct kiocb *orig_iocb = aio->orig_iocb; -+ -+ if (iocb->ki_flags & IOCB_WRITE) -+ kiocb_end_write(iocb); -+ -+ if (aio->end_write) -+ aio->end_write(orig_iocb->ki_filp); -+ -+ orig_iocb->ki_pos = iocb->ki_pos; -+ backing_aio_put(aio); -+} -+ -+static void backing_aio_rw_complete(struct kiocb *iocb, long res) -+{ -+ struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb); -+ struct kiocb *orig_iocb = aio->orig_iocb; -+ -+ backing_aio_cleanup(aio, res); -+ orig_iocb->ki_complete(orig_iocb, res); -+} -+ -+static void backing_aio_complete_work(struct work_struct *work) -+{ -+ struct backing_aio *aio = container_of(work, struct backing_aio, work); -+ -+ backing_aio_rw_complete(&aio->iocb, aio->res); -+} -+ -+static void backing_aio_queue_completion(struct kiocb *iocb, long res) -+{ -+ struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb); -+ -+ /* -+ * Punt to a work queue to serialize updates of mtime/size. -+ */ -+ aio->res = res; -+ INIT_WORK(&aio->work, backing_aio_complete_work); -+ queue_work(file_inode(aio->orig_iocb->ki_filp)->i_sb->s_dio_done_wq, -+ &aio->work); -+} -+ -+static int backing_aio_init_wq(struct kiocb *iocb) -+{ -+ struct super_block *sb = file_inode(iocb->ki_filp)->i_sb; -+ -+ if (sb->s_dio_done_wq) -+ return 0; -+ -+ return sb_init_dio_done_wq(sb); -+} -+ -+ -+ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter, -+ struct kiocb *iocb, int flags, -+ struct backing_file_ctx *ctx) -+{ -+ struct backing_aio *aio = NULL; -+ const struct cred *old_cred; -+ ssize_t ret; -+ -+ if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ if (!iov_iter_count(iter)) -+ return 0; -+ -+ if (iocb->ki_flags & IOCB_DIRECT && -+ !(file->f_mode & FMODE_CAN_ODIRECT)) -+ return -EINVAL; -+ -+ old_cred = override_creds(ctx->cred); -+ if (is_sync_kiocb(iocb)) { -+ rwf_t rwf = iocb_to_rw_flags(flags); -+ -+ ret = vfs_iter_read(file, iter, &iocb->ki_pos, rwf); -+ } else { -+ ret = -ENOMEM; -+ aio = kmem_cache_zalloc(backing_aio_cachep, GFP_KERNEL); -+ if (!aio) -+ goto out; -+ -+ aio->orig_iocb = iocb; -+ kiocb_clone(&aio->iocb, iocb, get_file(file)); -+ aio->iocb.ki_complete = backing_aio_rw_complete; -+ refcount_set(&aio->ref, 2); -+ ret = vfs_iocb_iter_read(file, &aio->iocb, iter); -+ backing_aio_put(aio); -+ if (ret != -EIOCBQUEUED) -+ backing_aio_cleanup(aio, ret); -+ } -+out: -+ revert_creds(old_cred); -+ -+ if (ctx->accessed) -+ ctx->accessed(ctx->user_file); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(backing_file_read_iter); -+ -+ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter, -+ struct kiocb *iocb, int flags, -+ struct backing_file_ctx *ctx) -+{ -+ const struct cred *old_cred; -+ ssize_t ret; -+ -+ if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ if (!iov_iter_count(iter)) -+ return 0; -+ -+ ret = file_remove_privs(ctx->user_file); -+ if (ret) -+ return ret; -+ -+ if (iocb->ki_flags & IOCB_DIRECT && -+ !(file->f_mode & FMODE_CAN_ODIRECT)) -+ return -EINVAL; -+ -+ /* -+ * Stacked filesystems don't support deferred completions, don't copy -+ * this property in case it is set by the issuer. -+ */ -+ flags &= ~IOCB_DIO_CALLER_COMP; -+ -+ old_cred = override_creds(ctx->cred); -+ if (is_sync_kiocb(iocb)) { -+ rwf_t rwf = iocb_to_rw_flags(flags); -+ -+ file_start_write(file); -+ ret = vfs_iter_write(file, iter, &iocb->ki_pos, rwf); -+ file_end_write(file); -+ if (ctx->end_write) -+ ctx->end_write(ctx->user_file); -+ } else { -+ struct backing_aio *aio; -+ -+ ret = backing_aio_init_wq(iocb); -+ if (ret) -+ goto out; -+ -+ ret = -ENOMEM; -+ aio = kmem_cache_zalloc(backing_aio_cachep, GFP_KERNEL); -+ if (!aio) -+ goto out; -+ -+ aio->orig_iocb = iocb; -+ aio->end_write = ctx->end_write; -+ kiocb_clone(&aio->iocb, iocb, get_file(file)); -+ aio->iocb.ki_flags = flags; -+ aio->iocb.ki_complete = backing_aio_queue_completion; -+ refcount_set(&aio->ref, 2); -+ kiocb_start_write(&aio->iocb); -+ ret = vfs_iocb_iter_write(file, &aio->iocb, iter); -+ backing_aio_put(aio); -+ if (ret != -EIOCBQUEUED) -+ backing_aio_cleanup(aio, ret); -+ } -+out: -+ revert_creds(old_cred); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(backing_file_write_iter); -+ -+static int __init backing_aio_init(void) -+{ -+ backing_aio_cachep = kmem_cache_create("backing_aio", -+ sizeof(struct backing_aio), -+ 0, SLAB_HWCACHE_ALIGN, NULL); -+ if (!backing_aio_cachep) -+ return -ENOMEM; -+ -+ return 0; -+} -+fs_initcall(backing_aio_init); -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 634a96a65bfd..3eee9f45971e 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -16,19 +16,6 @@ - #include - #include "overlayfs.h" - --#include "../internal.h" /* for sb_init_dio_done_wq */ -- --struct ovl_aio_req { -- struct kiocb iocb; -- refcount_t ref; -- struct kiocb *orig_iocb; -- /* used for aio completion */ -- struct work_struct work; -- long res; --}; -- --static struct kmem_cache *ovl_aio_request_cachep; -- - static char ovl_whatisit(struct inode *inode, struct inode *realinode) - { - if (realinode != ovl_inode_upper(inode)) -@@ -271,83 +258,16 @@ static void ovl_file_accessed(struct file *file) - touch_atime(&file->f_path); - } - --#define OVL_IOCB_MASK \ -- (IOCB_NOWAIT | IOCB_HIPRI | IOCB_DSYNC | IOCB_SYNC | IOCB_APPEND) -- --static rwf_t iocb_to_rw_flags(int flags) --{ -- return (__force rwf_t)(flags & OVL_IOCB_MASK); --} -- --static inline void ovl_aio_put(struct ovl_aio_req *aio_req) --{ -- if (refcount_dec_and_test(&aio_req->ref)) { -- fput(aio_req->iocb.ki_filp); -- kmem_cache_free(ovl_aio_request_cachep, aio_req); -- } --} -- --static void ovl_aio_cleanup_handler(struct ovl_aio_req *aio_req) --{ -- struct kiocb *iocb = &aio_req->iocb; -- struct kiocb *orig_iocb = aio_req->orig_iocb; -- -- if (iocb->ki_flags & IOCB_WRITE) { -- kiocb_end_write(iocb); -- ovl_file_modified(orig_iocb->ki_filp); -- } -- -- orig_iocb->ki_pos = iocb->ki_pos; -- ovl_aio_put(aio_req); --} -- --static void ovl_aio_rw_complete(struct kiocb *iocb, long res) --{ -- struct ovl_aio_req *aio_req = container_of(iocb, -- struct ovl_aio_req, iocb); -- struct kiocb *orig_iocb = aio_req->orig_iocb; -- -- ovl_aio_cleanup_handler(aio_req); -- orig_iocb->ki_complete(orig_iocb, res); --} -- --static void ovl_aio_complete_work(struct work_struct *work) --{ -- struct ovl_aio_req *aio_req = container_of(work, -- struct ovl_aio_req, work); -- -- ovl_aio_rw_complete(&aio_req->iocb, aio_req->res); --} -- --static void ovl_aio_queue_completion(struct kiocb *iocb, long res) --{ -- struct ovl_aio_req *aio_req = container_of(iocb, -- struct ovl_aio_req, iocb); -- struct kiocb *orig_iocb = aio_req->orig_iocb; -- -- /* -- * Punt to a work queue to serialize updates of mtime/size. -- */ -- aio_req->res = res; -- INIT_WORK(&aio_req->work, ovl_aio_complete_work); -- queue_work(file_inode(orig_iocb->ki_filp)->i_sb->s_dio_done_wq, -- &aio_req->work); --} -- --static int ovl_init_aio_done_wq(struct super_block *sb) --{ -- if (sb->s_dio_done_wq) -- return 0; -- -- return sb_init_dio_done_wq(sb); --} -- - static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter) - { - struct file *file = iocb->ki_filp; - struct fd real; -- const struct cred *old_cred; - ssize_t ret; -+ struct backing_file_ctx ctx = { -+ .cred = ovl_creds(file_inode(file)->i_sb), -+ .user_file = file, -+ .accessed = ovl_file_accessed, -+ }; - - if (!iov_iter_count(iter)) - return 0; -@@ -356,37 +276,8 @@ static ssize_t ovl_read_iter(struct kiocb *iocb, struct iov_iter *iter) - if (ret) - return ret; - -- ret = -EINVAL; -- if (iocb->ki_flags & IOCB_DIRECT && -- !(real.file->f_mode & FMODE_CAN_ODIRECT)) -- goto out_fdput; -- -- old_cred = ovl_override_creds(file_inode(file)->i_sb); -- if (is_sync_kiocb(iocb)) { -- rwf_t rwf = iocb_to_rw_flags(iocb->ki_flags); -- -- ret = vfs_iter_read(real.file, iter, &iocb->ki_pos, rwf); -- } else { -- struct ovl_aio_req *aio_req; -- -- ret = -ENOMEM; -- aio_req = kmem_cache_zalloc(ovl_aio_request_cachep, GFP_KERNEL); -- if (!aio_req) -- goto out; -- -- aio_req->orig_iocb = iocb; -- kiocb_clone(&aio_req->iocb, iocb, get_file(real.file)); -- aio_req->iocb.ki_complete = ovl_aio_rw_complete; -- refcount_set(&aio_req->ref, 2); -- ret = vfs_iocb_iter_read(real.file, &aio_req->iocb, iter); -- ovl_aio_put(aio_req); -- if (ret != -EIOCBQUEUED) -- ovl_aio_cleanup_handler(aio_req); -- } --out: -- revert_creds(old_cred); -- ovl_file_accessed(file); --out_fdput: -+ ret = backing_file_read_iter(real.file, iter, iocb, iocb->ki_flags, -+ &ctx); - fdput(real); - - return ret; -@@ -397,9 +288,13 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter) - struct file *file = iocb->ki_filp; - struct inode *inode = file_inode(file); - struct fd real; -- const struct cred *old_cred; - ssize_t ret; - int ifl = iocb->ki_flags; -+ struct backing_file_ctx ctx = { -+ .cred = ovl_creds(inode->i_sb), -+ .user_file = file, -+ .end_write = ovl_file_modified, -+ }; - - if (!iov_iter_count(iter)) - return 0; -@@ -407,19 +302,11 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter) - inode_lock(inode); - /* Update mode */ - ovl_copyattr(inode); -- ret = file_remove_privs(file); -- if (ret) -- goto out_unlock; - - ret = ovl_real_fdget(file, &real); - if (ret) - goto out_unlock; - -- ret = -EINVAL; -- if (iocb->ki_flags & IOCB_DIRECT && -- !(real.file->f_mode & FMODE_CAN_ODIRECT)) -- goto out_fdput; -- - if (!ovl_should_sync(OVL_FS(inode->i_sb))) - ifl &= ~(IOCB_DSYNC | IOCB_SYNC); - -@@ -428,42 +315,7 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter) - * this property in case it is set by the issuer. - */ - ifl &= ~IOCB_DIO_CALLER_COMP; -- -- old_cred = ovl_override_creds(file_inode(file)->i_sb); -- if (is_sync_kiocb(iocb)) { -- rwf_t rwf = iocb_to_rw_flags(ifl); -- -- file_start_write(real.file); -- ret = vfs_iter_write(real.file, iter, &iocb->ki_pos, rwf); -- file_end_write(real.file); -- /* Update size */ -- ovl_file_modified(file); -- } else { -- struct ovl_aio_req *aio_req; -- -- ret = ovl_init_aio_done_wq(inode->i_sb); -- if (ret) -- goto out; -- -- ret = -ENOMEM; -- aio_req = kmem_cache_zalloc(ovl_aio_request_cachep, GFP_KERNEL); -- if (!aio_req) -- goto out; -- -- aio_req->orig_iocb = iocb; -- kiocb_clone(&aio_req->iocb, iocb, get_file(real.file)); -- aio_req->iocb.ki_flags = ifl; -- aio_req->iocb.ki_complete = ovl_aio_queue_completion; -- refcount_set(&aio_req->ref, 2); -- kiocb_start_write(&aio_req->iocb); -- ret = vfs_iocb_iter_write(real.file, &aio_req->iocb, iter); -- ovl_aio_put(aio_req); -- if (ret != -EIOCBQUEUED) -- ovl_aio_cleanup_handler(aio_req); -- } --out: -- revert_creds(old_cred); --out_fdput: -+ ret = backing_file_write_iter(real.file, iter, iocb, ifl, &ctx); - fdput(real); - - out_unlock: -@@ -775,19 +627,3 @@ const struct file_operations ovl_file_operations = { - .copy_file_range = ovl_copy_file_range, - .remap_file_range = ovl_remap_file_range, - }; -- --int __init ovl_aio_request_cache_init(void) --{ -- ovl_aio_request_cachep = kmem_cache_create("ovl_aio_req", -- sizeof(struct ovl_aio_req), -- 0, SLAB_HWCACHE_ALIGN, NULL); -- if (!ovl_aio_request_cachep) -- return -ENOMEM; -- -- return 0; --} -- --void ovl_aio_request_cache_destroy(void) --{ -- kmem_cache_destroy(ovl_aio_request_cachep); --} -diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h -index a4b94a74b854..8b31bc3ee7a0 100644 ---- a/fs/overlayfs/overlayfs.h -+++ b/fs/overlayfs/overlayfs.h -@@ -417,6 +417,12 @@ int ovl_want_write(struct dentry *dentry); - void ovl_drop_write(struct dentry *dentry); - struct dentry *ovl_workdir(struct dentry *dentry); - const struct cred *ovl_override_creds(struct super_block *sb); -+ -+static inline const struct cred *ovl_creds(struct super_block *sb) -+{ -+ return OVL_FS(sb)->creator_cred; -+} -+ - int ovl_can_decode_fh(struct super_block *sb); - struct dentry *ovl_indexdir(struct super_block *sb); - bool ovl_index_all(struct super_block *sb); -@@ -835,8 +841,6 @@ struct dentry *ovl_create_temp(struct ovl_fs *ofs, struct dentry *workdir, - - /* file.c */ - extern const struct file_operations ovl_file_operations; --int __init ovl_aio_request_cache_init(void); --void ovl_aio_request_cache_destroy(void); - int ovl_real_fileattr_get(const struct path *realpath, struct fileattr *fa); - int ovl_real_fileattr_set(const struct path *realpath, struct fileattr *fa); - int ovl_fileattr_get(struct dentry *dentry, struct fileattr *fa); -diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c -index 0779c8290ec4..37387fd98e34 100644 ---- a/fs/overlayfs/super.c -+++ b/fs/overlayfs/super.c -@@ -1522,14 +1522,10 @@ static int __init ovl_init(void) - if (ovl_inode_cachep == NULL) - return -ENOMEM; - -- err = ovl_aio_request_cache_init(); -- if (!err) { -- err = register_filesystem(&ovl_fs_type); -- if (!err) -- return 0; -+ err = register_filesystem(&ovl_fs_type); -+ if (!err) -+ return 0; - -- ovl_aio_request_cache_destroy(); -- } - kmem_cache_destroy(ovl_inode_cachep); - - return err; -@@ -1545,7 +1541,6 @@ static void __exit ovl_exit(void) - */ - rcu_barrier(); - kmem_cache_destroy(ovl_inode_cachep); -- ovl_aio_request_cache_destroy(); - } - - module_init(ovl_init); -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -index 55c9e804f780..0648d548a418 100644 ---- a/include/linux/backing-file.h -+++ b/include/linux/backing-file.h -@@ -9,9 +9,24 @@ - #define _LINUX_BACKING_FILE_H - - #include -+#include -+#include -+ -+struct backing_file_ctx { -+ const struct cred *cred; -+ struct file *user_file; -+ void (*accessed)(struct file *); -+ void (*end_write)(struct file *); -+}; - - struct file *backing_file_open(const struct path *user_path, int flags, - const struct path *real_path, - const struct cred *cred); -+ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter, -+ struct kiocb *iocb, int flags, -+ struct backing_file_ctx *ctx); -+ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter, -+ struct kiocb *iocb, int flags, -+ struct backing_file_ctx *ctx); - - #endif /* _LINUX_BACKING_FILE_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1334-fs-factor-out-backing-file-splice-read-write-helpers.patch b/SOURCES/1334-fs-factor-out-backing-file-splice-read-write-helpers.patch deleted file mode 100644 index ed78f51ab..000000000 --- a/SOURCES/1334-fs-factor-out-backing-file-splice-read-write-helpers.patch +++ /dev/null @@ -1,189 +0,0 @@ -From 5c28f6ec073077ce1239652c7a74555904eb0577 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:51:41 +0200 -Subject: [PATCH] fs: factor out backing_file_splice_{read,write}() helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 9b7e9e2f5d5c3d079ec46bc71b114012e362ea6e -Author: Amir Goldstein -Date: Fri Oct 13 12:13:12 2023 +0300 - - fs: factor out backing_file_splice_{read,write}() helpers - - There is not much in those helpers, but it makes sense to have them - logically next to the backing_file_{read,write}_iter() helpers as they - may grow more common logic in the future. - - Signed-off-by: Amir Goldstein - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 6d915a45e288..5cc411566ce0 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -10,6 +10,7 @@ - - #include - #include -+#include - - #include "internal.h" - -@@ -248,6 +249,56 @@ ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter, - } - EXPORT_SYMBOL_GPL(backing_file_write_iter); - -+ssize_t backing_file_splice_read(struct file *in, loff_t *ppos, -+ struct pipe_inode_info *pipe, size_t len, -+ unsigned int flags, -+ struct backing_file_ctx *ctx) -+{ -+ const struct cred *old_cred; -+ ssize_t ret; -+ -+ if (WARN_ON_ONCE(!(in->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ old_cred = override_creds(ctx->cred); -+ ret = vfs_splice_read(in, ppos, pipe, len, flags); -+ revert_creds(old_cred); -+ -+ if (ctx->accessed) -+ ctx->accessed(ctx->user_file); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(backing_file_splice_read); -+ -+ssize_t backing_file_splice_write(struct pipe_inode_info *pipe, -+ struct file *out, loff_t *ppos, size_t len, -+ unsigned int flags, -+ struct backing_file_ctx *ctx) -+{ -+ const struct cred *old_cred; -+ ssize_t ret; -+ -+ if (WARN_ON_ONCE(!(out->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ ret = file_remove_privs(ctx->user_file); -+ if (ret) -+ return ret; -+ -+ old_cred = override_creds(ctx->cred); -+ file_start_write(out); -+ ret = iter_file_splice_write(pipe, out, ppos, len, flags); -+ file_end_write(out); -+ revert_creds(old_cred); -+ -+ if (ctx->end_write) -+ ctx->end_write(ctx->user_file); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(backing_file_splice_write); -+ - static int __init backing_aio_init(void) - { - backing_aio_cachep = kmem_cache_create("backing_aio", -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 3eee9f45971e..165a92b25c0a 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -9,7 +9,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -328,20 +327,21 @@ static ssize_t ovl_splice_read(struct file *in, loff_t *ppos, - struct pipe_inode_info *pipe, size_t len, - unsigned int flags) - { -- const struct cred *old_cred; - struct fd real; - ssize_t ret; -+ struct backing_file_ctx ctx = { -+ .cred = ovl_creds(file_inode(in)->i_sb), -+ .user_file = in, -+ .accessed = ovl_file_accessed, -+ }; - - ret = ovl_real_fdget(in, &real); - if (ret) - return ret; - -- old_cred = ovl_override_creds(file_inode(in)->i_sb); -- ret = vfs_splice_read(real.file, ppos, pipe, len, flags); -- revert_creds(old_cred); -- ovl_file_accessed(in); -- -+ ret = backing_file_splice_read(real.file, ppos, pipe, len, flags, &ctx); - fdput(real); -+ - return ret; - } - -@@ -357,30 +357,23 @@ static ssize_t ovl_splice_write(struct pipe_inode_info *pipe, struct file *out, - loff_t *ppos, size_t len, unsigned int flags) - { - struct fd real; -- const struct cred *old_cred; - struct inode *inode = file_inode(out); - ssize_t ret; -+ struct backing_file_ctx ctx = { -+ .cred = ovl_creds(inode->i_sb), -+ .user_file = out, -+ .end_write = ovl_file_modified, -+ }; - - inode_lock(inode); - /* Update mode */ - ovl_copyattr(inode); -- ret = file_remove_privs(out); -- if (ret) -- goto out_unlock; - - ret = ovl_real_fdget(out, &real); - if (ret) - goto out_unlock; - -- old_cred = ovl_override_creds(inode->i_sb); -- file_start_write(real.file); -- -- ret = iter_file_splice_write(pipe, real.file, ppos, len, flags); -- -- file_end_write(real.file); -- /* Update size */ -- ovl_file_modified(out); -- revert_creds(old_cred); -+ ret = backing_file_splice_write(pipe, real.file, ppos, len, flags, &ctx); - fdput(real); - - out_unlock: -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -index 0648d548a418..0546d5b1c9f5 100644 ---- a/include/linux/backing-file.h -+++ b/include/linux/backing-file.h -@@ -28,5 +28,13 @@ ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter, - ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter, - struct kiocb *iocb, int flags, - struct backing_file_ctx *ctx); -+ssize_t backing_file_splice_read(struct file *in, loff_t *ppos, -+ struct pipe_inode_info *pipe, size_t len, -+ unsigned int flags, -+ struct backing_file_ctx *ctx); -+ssize_t backing_file_splice_write(struct pipe_inode_info *pipe, -+ struct file *out, loff_t *ppos, size_t len, -+ unsigned int flags, -+ struct backing_file_ctx *ctx); - - #endif /* _LINUX_BACKING_FILE_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1335-fs-factor-out-backing-file-mmap-helper.patch b/SOURCES/1335-fs-factor-out-backing-file-mmap-helper.patch deleted file mode 100644 index 854df3e6f..000000000 --- a/SOURCES/1335-fs-factor-out-backing-file-mmap-helper.patch +++ /dev/null @@ -1,124 +0,0 @@ -From 5176a4370a2e9f1ebe16e502bf93897820461b7f Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 10:51:45 +0200 -Subject: [PATCH] fs: factor out backing_file_mmap() helper - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit f567377e406c032fff0799bde4fdf4a977529b84 -Author: Amir Goldstein -Date: Fri Oct 13 12:49:37 2023 +0300 - - fs: factor out backing_file_mmap() helper - - Assert that the file object is allocated in a backing_file container - so that file_user_path() could be used to display the user path and - not the backing file's path in /proc//maps. - - Signed-off-by: Amir Goldstein - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 5cc411566ce0..6ea14b6214c1 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -299,6 +300,32 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe, - } - EXPORT_SYMBOL_GPL(backing_file_splice_write); - -+int backing_file_mmap(struct file *file, struct vm_area_struct *vma, -+ struct backing_file_ctx *ctx) -+{ -+ const struct cred *old_cred; -+ int ret; -+ -+ if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING)) || -+ WARN_ON_ONCE(ctx->user_file != vma->vm_file)) -+ return -EIO; -+ -+ if (!file->f_op->mmap) -+ return -ENODEV; -+ -+ vma_set_file(vma, file); -+ -+ old_cred = override_creds(ctx->cred); -+ ret = call_mmap(vma->vm_file, vma); -+ revert_creds(old_cred); -+ -+ if (ctx->accessed) -+ ctx->accessed(ctx->user_file); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(backing_file_mmap); -+ - static int __init backing_aio_init(void) - { - backing_aio_cachep = kmem_cache_create("backing_aio", -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 165a92b25c0a..d85385f37ba6 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -10,7 +10,6 @@ - #include - #include - #include --#include - #include - #include - #include "overlayfs.h" -@@ -411,23 +410,13 @@ static int ovl_fsync(struct file *file, loff_t start, loff_t end, int datasync) - static int ovl_mmap(struct file *file, struct vm_area_struct *vma) - { - struct file *realfile = file->private_data; -- const struct cred *old_cred; -- int ret; -- -- if (!realfile->f_op->mmap) -- return -ENODEV; -- -- if (WARN_ON(file != vma->vm_file)) -- return -EIO; -- -- vma_set_file(vma, realfile); -- -- old_cred = ovl_override_creds(file_inode(file)->i_sb); -- ret = call_mmap(vma->vm_file, vma); -- revert_creds(old_cred); -- ovl_file_accessed(file); -+ struct backing_file_ctx ctx = { -+ .cred = ovl_creds(file_inode(file)->i_sb), -+ .user_file = file, -+ .accessed = ovl_file_accessed, -+ }; - -- return ret; -+ return backing_file_mmap(realfile, vma, &ctx); - } - - static long ovl_fallocate(struct file *file, int mode, loff_t offset, loff_t len) -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -index 0546d5b1c9f5..3f1fe1774f1b 100644 ---- a/include/linux/backing-file.h -+++ b/include/linux/backing-file.h -@@ -36,5 +36,7 @@ ssize_t backing_file_splice_write(struct pipe_inode_info *pipe, - struct file *out, loff_t *ppos, size_t len, - unsigned int flags, - struct backing_file_ctx *ctx); -+int backing_file_mmap(struct file *file, struct vm_area_struct *vma, -+ struct backing_file_ctx *ctx); - - #endif /* _LINUX_BACKING_FILE_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1336-lsm-add-helper-for-blob-allocations.patch b/SOURCES/1336-lsm-add-helper-for-blob-allocations.patch deleted file mode 100644 index 5a371cdd2..000000000 --- a/SOURCES/1336-lsm-add-helper-for-blob-allocations.patch +++ /dev/null @@ -1,158 +0,0 @@ -From f034201051121a87f98c1651368c3883f633182f Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:47:18 +0200 -Subject: [PATCH] lsm: add helper for blob allocations - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - security/security.c: context fuzz + dropped hunks changing functions - not present downstream - -commit 09001284eebfc1b684e81d1db0f006787d35f3e1 -Author: Casey Schaufler -Date: Wed Jul 10 14:32:27 2024 -0700 - - lsm: add helper for blob allocations - - Create a helper function lsm_blob_alloc() for general use in the hook - specific functions that allocate LSM blobs. Change the hook specific - functions to use this helper. This reduces the code size by a small - amount and will make adding new instances of infrastructure managed - security blobs easier. - - Signed-off-by: Casey Schaufler - Reviewed-by: John Johansen - [PM: subject tweak] - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/security.c b/security/security.c -index b59af216324f..1e63f23a504a 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -645,27 +645,42 @@ int unregister_blocking_lsm_notifier(struct notifier_block *nb) - EXPORT_SYMBOL(unregister_blocking_lsm_notifier); - - /** -- * lsm_cred_alloc - allocate a composite cred blob -- * @cred: the cred that needs a blob -+ * lsm_blob_alloc - allocate a composite blob -+ * @dest: the destination for the blob -+ * @size: the size of the blob - * @gfp: allocation type - * -- * Allocate the cred blob for all the modules -+ * Allocate a blob for all the modules - * - * Returns 0, or -ENOMEM if memory can't be allocated. - */ --static int lsm_cred_alloc(struct cred *cred, gfp_t gfp) -+static int lsm_blob_alloc(void **dest, size_t size, gfp_t gfp) - { -- if (blob_sizes.lbs_cred == 0) { -- cred->security = NULL; -+ if (size == 0) { -+ *dest = NULL; - return 0; - } - -- cred->security = kzalloc(blob_sizes.lbs_cred, gfp); -- if (cred->security == NULL) -+ *dest = kzalloc(size, gfp); -+ if (*dest == NULL) - return -ENOMEM; - return 0; - } - -+/** -+ * lsm_cred_alloc - allocate a composite cred blob -+ * @cred: the cred that needs a blob -+ * @gfp: allocation type -+ * -+ * Allocate the cred blob for all the modules -+ * -+ * Returns 0, or -ENOMEM if memory can't be allocated. -+ */ -+static int lsm_cred_alloc(struct cred *cred, gfp_t gfp) -+{ -+ return lsm_blob_alloc(&cred->security, blob_sizes.lbs_cred, gfp); -+} -+ - /** - * lsm_early_cred - during initialization allocate a composite cred blob - * @cred: the cred that needs a blob -@@ -732,15 +747,7 @@ static int lsm_inode_alloc(struct inode *inode) - */ - static int lsm_task_alloc(struct task_struct *task) - { -- if (blob_sizes.lbs_task == 0) { -- task->security = NULL; -- return 0; -- } -- -- task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL); -- if (task->security == NULL) -- return -ENOMEM; -- return 0; -+ return lsm_blob_alloc(&task->security, blob_sizes.lbs_task, GFP_KERNEL); - } - - /** -@@ -753,15 +760,7 @@ static int lsm_task_alloc(struct task_struct *task) - */ - static int lsm_ipc_alloc(struct kern_ipc_perm *kip) - { -- if (blob_sizes.lbs_ipc == 0) { -- kip->security = NULL; -- return 0; -- } -- -- kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL); -- if (kip->security == NULL) -- return -ENOMEM; -- return 0; -+ return lsm_blob_alloc(&kip->security, blob_sizes.lbs_ipc, GFP_KERNEL); - } - - /** -@@ -774,15 +773,8 @@ static int lsm_ipc_alloc(struct kern_ipc_perm *kip) - */ - static int lsm_msg_msg_alloc(struct msg_msg *mp) - { -- if (blob_sizes.lbs_msg_msg == 0) { -- mp->security = NULL; -- return 0; -- } -- -- mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL); -- if (mp->security == NULL) -- return -ENOMEM; -- return 0; -+ return lsm_blob_alloc(&mp->security, blob_sizes.lbs_msg_msg, -+ GFP_KERNEL); - } - - /** -@@ -809,15 +801,8 @@ static void __init lsm_early_task(struct task_struct *task) - */ - static int lsm_superblock_alloc(struct super_block *sb) - { -- if (blob_sizes.lbs_superblock == 0) { -- sb->s_security = NULL; -- return 0; -- } -- -- sb->s_security = kzalloc(blob_sizes.lbs_superblock, GFP_KERNEL); -- if (sb->s_security == NULL) -- return -ENOMEM; -- return 0; -+ return lsm_blob_alloc(&sb->s_security, blob_sizes.lbs_superblock, -+ GFP_KERNEL); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1337-ovl-fix-nested-backing-file-paths.patch b/SOURCES/1337-ovl-fix-nested-backing-file-paths.patch deleted file mode 100644 index 55ac28946..000000000 --- a/SOURCES/1337-ovl-fix-nested-backing-file-paths.patch +++ /dev/null @@ -1,74 +0,0 @@ -From c884ff1e458df0e5d801f19b4e847a4673d7471b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:48:02 +0200 -Subject: [PATCH] ovl: Fix nested backing file paths -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 924577e4f6ca473de1528953a0e13505fae61d7b -Author: André Almeida -Date: Tue Apr 29 15:38:50 2025 -0300 - - ovl: Fix nested backing file paths - - When the lowerdir of an overlayfs is a merged directory of another - overlayfs, ovl_open_realfile() will fail to open the real file and point - to a lower dentry copy, without the proper parent path. After this, - d_path() will then display the path incorrectly as if the file is placed - in the root directory. - - This bug can be triggered with the following setup: - - mkdir -p ovl-A/lower ovl-A/upper ovl-A/merge ovl-A/work - mkdir -p ovl-B/upper ovl-B/merge ovl-B/work - - cp /bin/cat ovl-A/lower/ - - mount -t overlay overlay -o \ - lowerdir=ovl-A/lower,upperdir=ovl-A/upper,workdir=ovl-A/work \ - ovl-A/merge - - mount -t overlay overlay -o \ - lowerdir=ovl-A/merge,upperdir=ovl-B/upper,workdir=ovl-B/work \ - ovl-B/merge - - ovl-A/merge/cat /proc/self/maps | grep --color cat - ovl-B/merge/cat /proc/self/maps | grep --color cat - - The first cat will correctly show `/ovl-A/merge/cat`, while the second - one shows just `/cat`. - - To fix that, uses file_user_path() inside of backing_file_open() to get - the correct file path for the dentry. - - Co-developed-by: John Schoenick - Signed-off-by: John Schoenick - Signed-off-by: André Almeida - Fixes: def3ae83da02 ("fs: store real path instead of fake path in backing file f_path") - Cc: # v6.7 - Signed-off-by: Miklos Szeredi - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index d85385f37ba6..3bf52eace698 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -51,8 +51,8 @@ static struct file *ovl_open_realfile(const struct file *file, - if (!inode_owner_or_capable(real_idmap, realinode)) - flags &= ~O_NOATIME; - -- realfile = backing_file_open(&file->f_path, flags, realpath, -- current_cred()); -+ realfile = backing_file_open(file_user_path((struct file *) file), -+ flags, realpath, current_cred()); - } - revert_creds(old_cred); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1338-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch b/SOURCES/1338-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch deleted file mode 100644 index 13c2e42b9..000000000 --- a/SOURCES/1338-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch +++ /dev/null @@ -1,105 +0,0 @@ -From 3869325e0bf98aba624155c8355abe6e5db6e674 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:18:45 +0200 -Subject: [PATCH] fs: constify file ptr in backing_file accessor helpers - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - context fuzz and dropped changes to functions not present downstream - -commit 4e301d858af17ae2ce56886296e5458c5a08219a -Author: Amir Goldstein -Date: Sat Jun 7 13:53:03 2025 +0200 - - fs: constify file ptr in backing_file accessor helpers - - Add internal helper backing_file_set_user_path() for the only - two cases that need to modify backing_file fields. - - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/20250607115304.2521155-2-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 6ea14b6214c1..840b45366557 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -41,7 +41,7 @@ struct file *backing_file_open(const struct path *user_path, int flags, - return f; - - path_get(user_path); -- *backing_file_user_path(f) = *user_path; -+ backing_file_set_user_path(f, user_path); - error = vfs_open(real_path, f); - if (error) { - fput(f); -diff --git a/fs/file_table.c b/fs/file_table.c -index e5c7b9705109..fa8f4d34efa5 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -50,17 +50,20 @@ struct backing_file { - struct path user_path; - }; - --static inline struct backing_file *backing_file(struct file *f) --{ -- return container_of(f, struct backing_file, file); --} -+#define backing_file(f) container_of(f, struct backing_file, file) - --struct path *backing_file_user_path(struct file *f) -+struct path *backing_file_user_path(const struct file *f) - { - return &backing_file(f)->user_path; - } - EXPORT_SYMBOL_GPL(backing_file_user_path); - -+void backing_file_set_user_path(struct file *f, const struct path *path) -+{ -+ backing_file(f)->user_path = *path; -+} -+EXPORT_SYMBOL_GPL(backing_file_set_user_path); -+ - static void file_free_rcu(struct rcu_head *head) - { - struct file *f = container_of(head, struct file, f_u.fu_rcuhead); -diff --git a/fs/internal.h b/fs/internal.h -index bd0934d0521b..78fcdad80e53 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -96,6 +96,7 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - struct file *alloc_empty_file(int flags, const struct cred *cred); - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); - struct file *alloc_empty_backing_file(int flags, const struct cred *cred); -+void backing_file_set_user_path(struct file *f, const struct path *path); - - static inline void file_put_write_access(struct file *file) - { -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 5f3ca25c77e5..7ed9232f579d 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2586,7 +2586,7 @@ struct file *dentry_open(const struct path *path, int flags, - const struct cred *creds); - struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); --struct path *backing_file_user_path(struct file *f); -+struct path *backing_file_user_path(const struct file *f); - - /* - * file_user_path - get the path to display for memory mapped file -@@ -2597,7 +2597,7 @@ struct path *backing_file_user_path(struct file *f); - * /proc//maps), this helper should be used to get the path to display - * to the user, which is the path of the fd that user has requested to map. - */ --static inline const struct path *file_user_path(struct file *f) -+static inline const struct path *file_user_path(const struct file *f) - { - if (unlikely(f->f_mode & FMODE_BACKING)) - return backing_file_user_path(f); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1339-ovl-remove-unneeded-non-const-conversion.patch b/SOURCES/1339-ovl-remove-unneeded-non-const-conversion.patch deleted file mode 100644 index be914b9be..000000000 --- a/SOURCES/1339-ovl-remove-unneeded-non-const-conversion.patch +++ /dev/null @@ -1,38 +0,0 @@ -From c3f8db29db9e7b9bb68b107e932315f147046ac5 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:48:18 +0200 -Subject: [PATCH] ovl: remove unneeded non-const conversion - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 - -commit 3ec2529eca6f175f4e3e87c4534010e044839b38 -Author: Amir Goldstein -Date: Sat Jun 7 13:53:04 2025 +0200 - - ovl: remove unneeded non-const conversion - - file_user_path() now takes a const file ptr. - - Signed-off-by: Amir Goldstein - Link: https://lore.kernel.org/20250607115304.2521155-3-amir73il@gmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 3bf52eace698..c8e45f503db3 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -51,7 +51,7 @@ static struct file *ovl_open_realfile(const struct file *file, - if (!inode_owner_or_capable(real_idmap, realinode)) - flags &= ~O_NOATIME; - -- realfile = backing_file_open(file_user_path((struct file *) file), -+ realfile = backing_file_open(file_user_path(file), - flags, realpath, current_cred()); - } - revert_creds(old_cred); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1340-ovl-remove-redundant-iocb-dio-caller-comp-clearing.patch b/SOURCES/1340-ovl-remove-redundant-iocb-dio-caller-comp-clearing.patch deleted file mode 100644 index c1d20f1b9..000000000 --- a/SOURCES/1340-ovl-remove-redundant-iocb-dio-caller-comp-clearing.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 99a9c81094c622efebec7695e551baffdac3f89b Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 20:29:45 +0200 -Subject: [PATCH] ovl: remove redundant IOCB_DIO_CALLER_COMP clearing - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -Conflicts: - - just context fuzz - -commit 7933a585d70ee496fa341b50b8b0a95b131867ff -Author: Seong-Gwang Heo -Date: Thu Oct 9 13:41:48 2025 +0800 - - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing - - The backing_file_write_iter() function, which is called - immediately after this code, already contains identical - logic to clear the IOCB_DIO_CALLER_COMP flag along with - the same explanatory comment. There is no need to duplicate - this operation in the overlayfs code. - - Signed-off-by: Seong-Gwang Heo - Fixes: a6293b3e285c ("fs: factor out backing_file_{read,write}_iter() helpers") - Acked-by: Miklos Szeredi - Reviewed-by: Amir Goldstein - Signed-off-by: Christian Brauner - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index c8e45f503db3..3d8539909f74 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -308,11 +308,6 @@ static ssize_t ovl_write_iter(struct kiocb *iocb, struct iov_iter *iter) - if (!ovl_should_sync(OVL_FS(inode->i_sb))) - ifl &= ~(IOCB_DSYNC | IOCB_SYNC); - -- /* -- * Overlayfs doesn't support deferred completions, don't copy -- * this property in case it is set by the issuer. -- */ -- ifl &= ~IOCB_DIO_CALLER_COMP; - ret = backing_file_write_iter(real.file, iter, iocb, ifl, &ctx); - fdput(real); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1341-perf-core-fix-mmap-event-path-names-with-backing-files.patch b/SOURCES/1341-perf-core-fix-mmap-event-path-names-with-backing-files.patch deleted file mode 100644 index 3e12eb0e3..000000000 --- a/SOURCES/1341-perf-core-fix-mmap-event-path-names-with-backing-files.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 627a3d264cb85311131aef67a0ff2397999d5394 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 20:29:57 +0200 -Subject: [PATCH] perf/core: Fix MMAP event path names with backing files - -JIRA: https://issues.redhat.com/browse/RHEL-179443 - -commit 8818f507a9391019a3ec7c57b1a32e4b386e48a5 -Author: Adrian Hunter -Date: Mon Oct 13 10:22:43 2025 +0300 - - perf/core: Fix MMAP event path names with backing files - - Some file systems like FUSE-based ones or overlayfs may record the backing - file in struct vm_area_struct vm_file, instead of the user file that the - user mmapped. - - Since commit def3ae83da02f ("fs: store real path instead of fake path in - backing file f_path"), file_path() no longer returns the user file path - when applied to a backing file. There is an existing helper - file_user_path() for that situation. - - Use file_user_path() instead of file_path() to get the path for MMAP - and MMAP2 events. - - Example: - - Setup: - - # cd /root - # mkdir test ; cd test ; mkdir lower upper work merged - # cp `which cat` lower - # mount -t overlay overlay -olowerdir=lower,upperdir=upper,workdir=work merged - # perf record -e intel_pt//u -- /root/test/merged/cat /proc/self/maps - ... - 55b0ba399000-55b0ba434000 r-xp 00018000 00:1a 3419 /root/test/merged/cat - ... - [ perf record: Woken up 1 times to write data ] - [ perf record: Captured and wrote 0.060 MB perf.data ] - # - - Before: - - File name is wrong (/cat), so decoding fails: - - # perf script --no-itrace --show-mmap-events - cat 367 [016] 100.491492: PERF_RECORD_MMAP2 367/367: [0x55b0ba399000(0x9b000) @ 0x18000 00:02 3419 489959280]: r-xp /cat - ... - # perf script --itrace=e | wc -l - Warning: - 19 instruction trace errors - 19 - # - - After: - - File name is correct (/root/test/merged/cat), so decoding is ok: - - # perf script --no-itrace --show-mmap-events - cat 364 [016] 72.153006: PERF_RECORD_MMAP2 364/364: [0x55ce4003d000(0x9b000) @ 0x18000 00:02 3419 3132534314]: r-xp /root/test/merged/cat - # perf script --itrace=e - # perf script --itrace=e | wc -l - 0 - # - - Fixes: def3ae83da02f ("fs: store real path instead of fake path in backing file f_path") - Signed-off-by: Adrian Hunter - Signed-off-by: Peter Zijlstra (Intel) - Acked-by: Amir Goldstein - Cc: stable@vger.kernel.org - -Signed-off-by: Ondrej Mosnacek - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 0d3bd850fee7..5065087dd236 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -8953,7 +8953,7 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) - * need to add enough zero bytes after the string to handle - * the 64bit alignment we do later. - */ -- name = file_path(file, buf, PATH_MAX - sizeof(u64)); -+ name = d_path(file_user_path(file), buf, PATH_MAX - sizeof(u64)); - if (IS_ERR(name)) { - name = "//toolong"; - goto cpy_name; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1342-fs-prepare-for-adding-lsm-blob-to-backing-file.patch b/SOURCES/1342-fs-prepare-for-adding-lsm-blob-to-backing-file.patch deleted file mode 100644 index 76fc722fa..000000000 --- a/SOURCES/1342-fs-prepare-for-adding-lsm-blob-to-backing-file.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 644c8e296eb8628ed6ccaff5609bce2c4b591c8a Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:00:17 +0200 -Subject: [PATCH] fs: prepare for adding LSM blob to backing_file - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/file_table.c: adjusted the body and call site of - backing_file_free() to downstream state (sme intermediate commits - not backported) - -commit 880bd496ec72a6dcb00cb70c430ef752ba242ae7 -Author: Amir Goldstein -Date: Mon Mar 30 10:27:51 2026 +0200 - - fs: prepare for adding LSM blob to backing_file - - In preparation to adding LSM blob to backing_file struct, factor out - helpers init_backing_file() and backing_file_free(). - - Cc: stable@vger.kernel.org - Cc: linux-fsdevel@vger.kernel.org - Cc: linux-unionfs@vger.kernel.org - Cc: linux-erofs@lists.ozlabs.org - Signed-off-by: Amir Goldstein - Reviewed-by: Serge Hallyn - [PM: use the term "LSM blob", fix comment style to match file] - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/file_table.c b/fs/file_table.c -index fa8f4d34efa5..34e3863c95b0 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -75,11 +75,16 @@ static void file_free_rcu(struct rcu_head *head) - kmem_cache_free(filp_cachep, f); - } - -+static inline void backing_file_free(struct backing_file *ff) -+{ -+ path_put(&ff->user_path); -+} -+ - static inline void file_free(struct file *f) - { - security_file_free(f); - if (unlikely(f->f_mode & FMODE_BACKING)) -- path_put(backing_file_user_path(f)); -+ backing_file_free(backing_file(f)); - if (likely(!(f->f_mode & FMODE_NOACCOUNT))) - percpu_counter_dec(&nr_files); - call_rcu(&f->f_u.fu_rcuhead, file_free_rcu); -@@ -255,6 +260,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return f; - } - -+static int init_backing_file(struct backing_file *ff) -+{ -+ memset(&ff->user_path, 0, sizeof(ff->user_path)); -+ return 0; -+} -+ - /* - * Variant of alloc_empty_file() that allocates a backing_file container - * and doesn't check and modify nr_files. -@@ -277,7 +288,14 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) - return ERR_PTR(error); - } - -+ /* The f_mode flags must be set before fput(). */ - ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; -+ error = init_backing_file(ff); -+ if (unlikely(error)) { -+ fput(&ff->file); -+ return ERR_PTR(error); -+ } -+ - return &ff->file; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1343-lsm-add-backing-file-lsm-hooks.patch b/SOURCES/1343-lsm-add-backing-file-lsm-hooks.patch deleted file mode 100644 index d0f172424..000000000 --- a/SOURCES/1343-lsm-add-backing-file-lsm-hooks.patch +++ /dev/null @@ -1,535 +0,0 @@ -From 807cf6dc47e9871fa1f77369e69fe8666cb0a1d4 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 11:54:46 +0200 -Subject: [PATCH] lsm: add backing_file LSM hooks - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - fs/backing-file.c: - - adjust backing_file_mmap() to downstream state (missing scoped - guards, ctx->user_file instead of missing user_file variable) - - backing_tmpfile_open() not present downstream - - fs/erofs/ishare.c: hunk dropped, file not present downstream - - fs/file_table.c: context fuzz + put security_backing_file_free() in the - right place - - fs/fuse/passthrough.c: hunk dropped, file not present downstream - - fs/overlayfs/dir.c: hunk dropped, ovl_create_tmpfile() not present downstream - - fs/overlayfs/file.c: adjust to different indentation - - include/linux/backing-file.h: backing_tmpfile_open() not present downstream - - include/linux/lsm_hooks.h: adjust to downstream's definition of struct lsm_blob_sizes - - security/lsm.h: hunk dropped, file not present downstream - - security/lsm_init.c: hunk dropped, file not present downstream - - security/security.c: misc conflicts, port changes to stuff that was - already in lsm.h/lsm_init.c upstream - -commit 6af36aeb147a06dea47c49859cd6ca5659aeb987 -Author: Paul Moore -Date: Fri Dec 19 13:18:22 2025 -0500 - - lsm: add backing_file LSM hooks - - Stacked filesystems such as overlayfs do not currently provide the - necessary mechanisms for LSMs to properly enforce access controls on the - mmap() and mprotect() operations. In order to resolve this gap, a LSM - security blob is being added to the backing_file struct and the following - new LSM hooks are being created: - - security_backing_file_alloc() - security_backing_file_free() - security_mmap_backing_file() - - The first two hooks are to manage the lifecycle of the LSM security blob - in the backing_file struct, while the third provides a new mmap() access - control point for the underlying backing file. It is also expected that - LSMs will likely want to update their security_file_mprotect() callback - to address issues with their mprotect() controls, but that does not - require a change to the security_file_mprotect() LSM hook. - - There are a three other small changes to support these new LSM hooks: - * Pass the user file associated with a backing file down to - alloc_empty_backing_file() so it can be included in the - security_backing_file_alloc() hook. - * Add getter and setter functions for the backing_file struct LSM blob - as the backing_file struct remains private to fs/file_table.c. - * Constify the file struct field in the LSM common_audit_data struct to - better support LSMs that need to pass a const file struct pointer into - the common LSM audit code. - - Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL() - and supplying a fixup. - - Cc: stable@vger.kernel.org - Cc: linux-fsdevel@vger.kernel.org - Cc: linux-unionfs@vger.kernel.org - Cc: linux-erofs@lists.ozlabs.org - Reviewed-by: Amir Goldstein - Reviewed-by: Serge Hallyn - Reviewed-by: Christian Brauner - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/fs/backing-file.c b/fs/backing-file.c -index 840b45366557..e6f4fe27b58b 100644 ---- a/fs/backing-file.c -+++ b/fs/backing-file.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -29,14 +30,15 @@ - * returned file into a container structure that also stores the stacked - * file's path, which can be retrieved using backing_file_user_path(). - */ --struct file *backing_file_open(const struct path *user_path, int flags, -+struct file *backing_file_open(const struct file *user_file, int flags, - const struct path *real_path, - const struct cred *cred) - { -+ const struct path *user_path = &user_file->f_path; - struct file *f; - int error; - -- f = alloc_empty_backing_file(flags, cred); -+ f = alloc_empty_backing_file(flags, cred, user_file); - if (IS_ERR(f)) - return f; - -@@ -316,6 +318,11 @@ int backing_file_mmap(struct file *file, struct vm_area_struct *vma, - vma_set_file(vma, file); - - old_cred = override_creds(ctx->cred); -+ ret = security_mmap_backing_file(vma, file, ctx->user_file); -+ if (ret) { -+ revert_creds(old_cred); -+ return ret; -+ } - ret = call_mmap(vma->vm_file, vma); - revert_creds(old_cred); - -diff --git a/fs/file_table.c b/fs/file_table.c -index 34e3863c95b0..fc04eb48d550 100644 ---- a/fs/file_table.c -+++ b/fs/file_table.c -@@ -48,6 +48,9 @@ static struct percpu_counter nr_files __cacheline_aligned_in_smp; - struct backing_file { - struct file file; - struct path user_path; -+#ifdef CONFIG_SECURITY -+ void *security; -+#endif - }; - - #define backing_file(f) container_of(f, struct backing_file, file) -@@ -64,6 +67,18 @@ void backing_file_set_user_path(struct file *f, const struct path *path) - } - EXPORT_SYMBOL_GPL(backing_file_set_user_path); - -+#ifdef CONFIG_SECURITY -+void *backing_file_security(const struct file *f) -+{ -+ return backing_file(f)->security; -+} -+ -+void backing_file_set_security(struct file *f, void *security) -+{ -+ backing_file(f)->security = security; -+} -+#endif /* CONFIG_SECURITY */ -+ - static void file_free_rcu(struct rcu_head *head) - { - struct file *f = container_of(head, struct file, f_u.fu_rcuhead); -@@ -77,6 +92,7 @@ static void file_free_rcu(struct rcu_head *head) - - static inline void backing_file_free(struct backing_file *ff) - { -+ security_backing_file_free(&ff->file); - path_put(&ff->user_path); - } - -@@ -260,10 +276,12 @@ struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred) - return f; - } - --static int init_backing_file(struct backing_file *ff) -+static int init_backing_file(struct backing_file *ff, -+ const struct file *user_file) - { - memset(&ff->user_path, 0, sizeof(ff->user_path)); -- return 0; -+ backing_file_set_security(&ff->file, NULL); -+ return security_backing_file_alloc(&ff->file, user_file); - } - - /* -@@ -273,7 +291,8 @@ static int init_backing_file(struct backing_file *ff) - * This is only for kernel internal use, and the allocate file must not be - * installed into file tables or such. - */ --struct file *alloc_empty_backing_file(int flags, const struct cred *cred) -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred, -+ const struct file *user_file) - { - struct backing_file *ff; - int error; -@@ -290,7 +309,7 @@ struct file *alloc_empty_backing_file(int flags, const struct cred *cred) - - /* The f_mode flags must be set before fput(). */ - ff->file.f_mode |= FMODE_BACKING | FMODE_NOACCOUNT; -- error = init_backing_file(ff); -+ error = init_backing_file(ff, user_file); - if (unlikely(error)) { - fput(&ff->file); - return ERR_PTR(error); -diff --git a/fs/internal.h b/fs/internal.h -index 78fcdad80e53..f48f5fa349c9 100644 ---- a/fs/internal.h -+++ b/fs/internal.h -@@ -95,7 +95,8 @@ extern void chroot_fs_refs(const struct path *, const struct path *); - */ - struct file *alloc_empty_file(int flags, const struct cred *cred); - struct file *alloc_empty_file_noaccount(int flags, const struct cred *cred); --struct file *alloc_empty_backing_file(int flags, const struct cred *cred); -+struct file *alloc_empty_backing_file(int flags, const struct cred *cred, -+ const struct file *user_file); - void backing_file_set_user_path(struct file *f, const struct path *path); - - static inline void file_put_write_access(struct file *file) -diff --git a/fs/overlayfs/file.c b/fs/overlayfs/file.c -index 3d8539909f74..a5bc5dfc930f 100644 ---- a/fs/overlayfs/file.c -+++ b/fs/overlayfs/file.c -@@ -51,7 +51,7 @@ static struct file *ovl_open_realfile(const struct file *file, - if (!inode_owner_or_capable(real_idmap, realinode)) - flags &= ~O_NOATIME; - -- realfile = backing_file_open(file_user_path(file), -+ realfile = backing_file_open(file, - flags, realpath, current_cred()); - } - revert_creds(old_cred); -diff --git a/include/linux/backing-file.h b/include/linux/backing-file.h -index 3f1fe1774f1b..103b6992b80a 100644 ---- a/include/linux/backing-file.h -+++ b/include/linux/backing-file.h -@@ -19,7 +19,7 @@ struct backing_file_ctx { - void (*end_write)(struct file *); - }; - --struct file *backing_file_open(const struct path *user_path, int flags, -+struct file *backing_file_open(const struct file *user_file, int flags, - const struct path *real_path, - const struct cred *cred); - ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter, -diff --git a/include/linux/fs.h b/include/linux/fs.h -index 7ed9232f579d..a94f20ba2bf6 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -2588,6 +2588,19 @@ struct file *dentry_create(const struct path *path, int flags, umode_t mode, - const struct cred *cred); - struct path *backing_file_user_path(const struct file *f); - -+#ifdef CONFIG_SECURITY -+void *backing_file_security(const struct file *f); -+void backing_file_set_security(struct file *f, void *security); -+#else -+static inline void *backing_file_security(const struct file *f) -+{ -+ return NULL; -+} -+static inline void backing_file_set_security(struct file *f, void *security) -+{ -+} -+#endif /* CONFIG_SECURITY */ -+ - /* - * file_user_path - get the path to display for memory mapped file - * -diff --git a/include/linux/lsm_audit.h b/include/linux/lsm_audit.h -index 97a8b21eb033..c0a2839253fa 100644 ---- a/include/linux/lsm_audit.h -+++ b/include/linux/lsm_audit.h -@@ -93,7 +93,7 @@ struct common_audit_data { - #endif - char *kmod_name; - struct lsm_ioctlop_audit *op; -- struct file *file; -+ const struct file *file; - struct lsm_ibpkey_audit *ibpkey; - struct lsm_ibendport_audit *ibendport; - int reason; -diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h -index b6fbb446bab7..304da2a90ba7 100644 ---- a/include/linux/lsm_hook_defs.h -+++ b/include/linux/lsm_hook_defs.h -@@ -168,6 +168,9 @@ LSM_HOOK(int, 0, kernfs_init_security, struct kernfs_node *kn_dir, - LSM_HOOK(int, 0, file_permission, struct file *file, int mask) - LSM_HOOK(int, 0, file_alloc_security, struct file *file) - LSM_HOOK(void, LSM_RET_VOID, file_free_security, struct file *file) -+LSM_HOOK(int, 0, backing_file_alloc, struct file *backing_file, -+ const struct file *user_file) -+LSM_HOOK(void, LSM_RET_VOID, backing_file_free, struct file *backing_file) - LSM_HOOK(int, 0, file_ioctl, struct file *file, unsigned int cmd, - unsigned long arg) - LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, -@@ -175,6 +178,8 @@ LSM_HOOK(int, 0, file_ioctl_compat, struct file *file, unsigned int cmd, - LSM_HOOK(int, 0, mmap_addr, unsigned long addr) - LSM_HOOK(int, 0, mmap_file, struct file *file, unsigned long reqprot, - unsigned long prot, unsigned long flags) -+LSM_HOOK(int, 0, mmap_backing_file, struct vm_area_struct *vma, -+ struct file *backing_file, struct file *user_file) - LSM_HOOK(int, 0, file_mprotect, struct vm_area_struct *vma, - unsigned long reqprot, unsigned long prot) - LSM_HOOK(int, 0, file_lock, struct file *file, unsigned int cmd) -diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h -index 7577ecfc79e4..a16571929f7b 100644 ---- a/include/linux/lsm_hooks.h -+++ b/include/linux/lsm_hooks.h -@@ -1637,6 +1637,7 @@ struct security_hook_list { - struct lsm_blob_sizes { - int lbs_cred; - int lbs_file; -+ int lbs_backing_file; - int lbs_inode; - int lbs_superblock; - int lbs_ipc; -diff --git a/include/linux/security.h b/include/linux/security.h -index d2888c127859..db02db9f623a 100644 ---- a/include/linux/security.h -+++ b/include/linux/security.h -@@ -387,11 +387,17 @@ int security_kernfs_init_security(struct kernfs_node *kn_dir, - int security_file_permission(struct file *file, int mask); - int security_file_alloc(struct file *file); - void security_file_free(struct file *file); -+int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file); -+void security_backing_file_free(struct file *backing_file); - int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg); - int security_file_ioctl_compat(struct file *file, unsigned int cmd, - unsigned long arg); - int security_mmap_file(struct file *file, unsigned long prot, - unsigned long flags); -+int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file); - int security_mmap_addr(unsigned long addr); - int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot, - unsigned long prot); -@@ -976,6 +982,15 @@ static inline int security_file_alloc(struct file *file) - static inline void security_file_free(struct file *file) - { } - -+static inline int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ return 0; -+} -+ -+static inline void security_backing_file_free(struct file *backing_file) -+{ } -+ - static inline int security_file_ioctl(struct file *file, unsigned int cmd, - unsigned long arg) - { -@@ -995,6 +1010,13 @@ static inline int security_mmap_file(struct file *file, unsigned long prot, - return 0; - } - -+static inline int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file) -+{ -+ return 0; -+} -+ - static inline int security_mmap_addr(unsigned long addr) - { - return cap_mmap_addr(addr); -diff --git a/security/security.c b/security/security.c -index 1e63f23a504a..27a309ab0b97 100644 ---- a/security/security.c -+++ b/security/security.c -@@ -89,6 +89,7 @@ const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1] = { - static BLOCKING_NOTIFIER_HEAD(blocking_lsm_notifier_chain); - - static struct kmem_cache *lsm_file_cache; -+static struct kmem_cache *lsm_backing_file_cache; - static struct kmem_cache *lsm_inode_cache; - - char *lsm_names; -@@ -260,6 +261,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) - - lsm_set_blob_size(&needed->lbs_cred, &blob_sizes.lbs_cred); - lsm_set_blob_size(&needed->lbs_file, &blob_sizes.lbs_file); -+ lsm_set_blob_size(&needed->lbs_backing_file, -+ &blob_sizes.lbs_backing_file); - /* - * The inode blob gets an rcu_head in addition to - * what the modules might need. -@@ -447,14 +450,15 @@ static void __init ordered_lsm_init(void) - - report_lsm_order(); - -- init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -- init_debug("file blob size = %d\n", blob_sizes.lbs_file); -- init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -- init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); -- init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -- init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -- init_debug("task blob size = %d\n", blob_sizes.lbs_task); -- init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); -+ init_debug("cred blob size = %d\n", blob_sizes.lbs_cred); -+ init_debug("file blob size = %d\n", blob_sizes.lbs_file); -+ init_debug("backing_file blob size = %d\n", blob_sizes.lbs_backing_file); -+ init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); -+ init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); -+ init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); -+ init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); -+ init_debug("task blob size = %d\n", blob_sizes.lbs_task); -+ init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); - - /* - * Create any kmem_caches needed for blobs -@@ -463,6 +467,11 @@ static void __init ordered_lsm_init(void) - lsm_file_cache = kmem_cache_create("lsm_file_cache", - blob_sizes.lbs_file, 0, - SLAB_PANIC, NULL); -+ if (blob_sizes.lbs_backing_file) -+ lsm_backing_file_cache = kmem_cache_create( -+ "lsm_backing_file_cache", -+ blob_sizes.lbs_backing_file, -+ 0, SLAB_PANIC, NULL); - if (blob_sizes.lbs_inode) - lsm_inode_cache = kmem_cache_create("lsm_inode_cache", - blob_sizes.lbs_inode, 0, -@@ -644,6 +653,30 @@ int unregister_blocking_lsm_notifier(struct notifier_block *nb) - } - EXPORT_SYMBOL(unregister_blocking_lsm_notifier); - -+/** -+ * lsm_backing_file_alloc - allocate a composite backing file blob -+ * @backing_file: the backing file -+ * -+ * Allocate the backing file blob for all the modules. -+ * -+ * Returns 0, or -ENOMEM if memory can't be allocated. -+ */ -+static int lsm_backing_file_alloc(struct file *backing_file) -+{ -+ void *blob; -+ -+ if (!lsm_backing_file_cache) { -+ backing_file_set_security(backing_file, NULL); -+ return 0; -+ } -+ -+ blob = kmem_cache_zalloc(lsm_backing_file_cache, GFP_KERNEL); -+ backing_file_set_security(backing_file, blob); -+ if (!blob) -+ return -ENOMEM; -+ return 0; -+} -+ - /** - * lsm_blob_alloc - allocate a composite blob - * @dest: the destination for the blob -@@ -1689,6 +1722,57 @@ void security_file_free(struct file *file) - } - } - -+/** -+ * security_backing_file_alloc() - Allocate and setup a backing file blob -+ * @backing_file: the backing file -+ * @user_file: the associated user visible file -+ * -+ * Allocate a backing file LSM blob and perform any necessary initialization of -+ * the LSM blob. There will be some operations where the LSM will not have -+ * access to @user_file after this point, so any important state associated -+ * with @user_file that is important to the LSM should be captured in the -+ * backing file's LSM blob. -+ * -+ * LSM's should avoid taking a reference to @user_file in this hook as it will -+ * result in problems later when the system attempts to drop/put the file -+ * references due to a circular dependency. -+ * -+ * Return: Return 0 if the hook is successful, negative values otherwise. -+ */ -+int security_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ int rc; -+ -+ rc = lsm_backing_file_alloc(backing_file); -+ if (rc) -+ return rc; -+ rc = call_int_hook(backing_file_alloc, backing_file, user_file); -+ if (unlikely(rc)) -+ security_backing_file_free(backing_file); -+ -+ return rc; -+} -+ -+/** -+ * security_backing_file_free() - Free a backing file blob -+ * @backing_file: the backing file -+ * -+ * Free any LSM state associate with a backing file's LSM blob, including the -+ * blob itself. -+ */ -+void security_backing_file_free(struct file *backing_file) -+{ -+ void *blob = backing_file_security(backing_file); -+ -+ call_void_hook(backing_file_free, backing_file); -+ -+ if (blob) { -+ backing_file_set_security(backing_file, NULL); -+ kmem_cache_free(lsm_backing_file_cache, blob); -+ } -+} -+ - int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { - return call_int_hook(file_ioctl, file, cmd, arg); -@@ -1757,6 +1841,32 @@ int security_mmap_file(struct file *file, unsigned long prot, - return ima_file_mmap(file, prot); - } - -+/** -+ * security_mmap_backing_file - Check if mmap'ing a backing file is allowed -+ * @vma: the vm_area_struct for the mmap'd region -+ * @backing_file: the backing file being mmap'd -+ * @user_file: the user file being mmap'd -+ * -+ * Check permissions for a mmap operation on a stacked filesystem. This hook -+ * is called after the security_mmap_file() and is responsible for authorizing -+ * the mmap on @backing_file. It is important to note that the mmap operation -+ * on @user_file has already been authorized and the @vma->vm_file has been -+ * set to @backing_file. -+ * -+ * Return: Returns 0 if permission is granted. -+ */ -+int security_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file) -+{ -+ /* recommended by the stackable filesystem devs */ -+ if (WARN_ON_ONCE(!(backing_file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ return call_int_hook(mmap_backing_file, vma, backing_file, user_file); -+} -+EXPORT_SYMBOL_GPL(security_mmap_backing_file); -+ - int security_mmap_addr(unsigned long addr) - { - return call_int_hook(mmap_addr, addr); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1344-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch b/SOURCES/1344-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch deleted file mode 100644 index 3d19053cb..000000000 --- a/SOURCES/1344-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch +++ /dev/null @@ -1,444 +0,0 @@ -From df2d263e4dcf6739be4c4b51d7e1f6c1d3316200 Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Wed, 3 Jun 2026 13:01:38 +0200 -Subject: [PATCH] selinux: fix overlayfs mmap() and mprotect() access checks - -JIRA: https://issues.redhat.com/browse/RHEL-179443 -CVE: CVE-2026-46054 -Conflicts: - - security/selinux/hooks.c: - - context fuzz - - preserve passing &selinux_state to avc_has_perm() - - preserve honoring the checkreqprot setting (in case of mmap - backing file check it is ignored, but that's the best we can do - - at worst some access would be denied on overlayfs in extremely - exotic use cases) - - security/selinux/include/objsec.h: context fuzz - -commit 82544d36b1729153c8aeb179e84750f0c085d3b1 -Author: Paul Moore -Date: Thu Jan 1 17:19:18 2026 -0500 - - selinux: fix overlayfs mmap() and mprotect() access checks - - The existing SELinux security model for overlayfs is to allow access if - the current task is able to access the top level file (the "user" file) - and the mounter's credentials are sufficient to access the lower - level file (the "backing" file). Unfortunately, the current code does - not properly enforce these access controls for both mmap() and mprotect() - operations on overlayfs filesystems. - - This patch makes use of the newly created security_mmap_backing_file() - LSM hook to provide the missing backing file enforcement for mmap() - operations, and leverages the backing file API and new LSM blob to - provide the necessary information to properly enforce the mprotect() - access controls. - - Cc: stable@vger.kernel.org - Acked-by: Amir Goldstein - Signed-off-by: Paul Moore - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index deacc9a63fae..fb5b9cb027d0 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -1706,50 +1706,76 @@ static inline int file_path_has_perm(const struct cred *cred, - static int bpf_fd_pass(const struct file *file, u32 sid); - #endif - --/* Check whether a task can use an open file descriptor to -- access an inode in a given way. Check access to the -- descriptor itself, and then use dentry_has_perm to -- check a particular permission to the file. -- Access to the descriptor is implicitly granted if it -- has the same SID as the process. If av is zero, then -- access to the file is not checked, e.g. for cases -- where only the descriptor is affected like seek. */ --static int file_has_perm(const struct cred *cred, -- struct file *file, -- u32 av) -+static int __file_has_perm(const struct cred *cred, const struct file *file, -+ u32 av, bool bf_user_file) -+ - { -- struct file_security_struct *fsec = selinux_file(file); -- struct inode *inode = file_inode(file); - struct common_audit_data ad; -- u32 sid = cred_sid(cred); -+ struct inode *inode; -+ u32 ssid = cred_sid(cred); -+ u32 tsid_fd; - int rc; - -- ad.type = LSM_AUDIT_DATA_FILE; -- ad.u.file = file; -+ if (bf_user_file) { -+ struct backing_file_security_struct *bfsec; -+ const struct path *path; - -- if (sid != fsec->sid) { -+ if (WARN_ON(!(file->f_mode & FMODE_BACKING))) -+ return -EIO; -+ -+ bfsec = selinux_backing_file(file); -+ path = backing_file_user_path(file); -+ tsid_fd = bfsec->uf_sid; -+ inode = d_inode(path->dentry); -+ -+ ad.type = LSM_AUDIT_DATA_PATH; -+ ad.u.path = *path; -+ } else { -+ struct file_security_struct *fsec = selinux_file(file); -+ -+ tsid_fd = fsec->sid; -+ inode = file_inode(file); -+ -+ ad.type = LSM_AUDIT_DATA_FILE; -+ ad.u.file = file; -+ } -+ -+ if (ssid != tsid_fd) { - rc = avc_has_perm(&selinux_state, -- sid, fsec->sid, -+ ssid, tsid_fd, - SECCLASS_FD, - FD__USE, - &ad); - if (rc) -- goto out; -+ return rc; - } - - #ifdef CONFIG_BPF_SYSCALL -- rc = bpf_fd_pass(file, cred_sid(cred)); -+ /* regardless of backing vs user file, use the underlying file here */ -+ rc = bpf_fd_pass(file, ssid); - if (rc) - return rc; - #endif - - /* av is zero if only checking access to the descriptor. */ -- rc = 0; - if (av) -- rc = inode_has_perm(cred, inode, av, &ad); -+ return inode_has_perm(cred, inode, av, &ad); - --out: -- return rc; -+ return 0; -+} -+ -+/* Check whether a task can use an open file descriptor to -+ access an inode in a given way. Check access to the -+ descriptor itself, and then use dentry_has_perm to -+ check a particular permission to the file. -+ Access to the descriptor is implicitly granted if it -+ has the same SID as the process. If av is zero, then -+ access to the file is not checked, e.g. for cases -+ where only the descriptor is affected like seek. */ -+static inline int file_has_perm(const struct cred *cred, -+ const struct file *file, u32 av) -+{ -+ return __file_has_perm(cred, file, av, false); - } - - /* -@@ -3646,6 +3672,17 @@ static int selinux_file_alloc_security(struct file *file) - return 0; - } - -+static int selinux_backing_file_alloc(struct file *backing_file, -+ const struct file *user_file) -+{ -+ struct backing_file_security_struct *bfsec; -+ -+ bfsec = selinux_backing_file(backing_file); -+ bfsec->uf_sid = selinux_file(user_file)->sid; -+ -+ return 0; -+} -+ - /* - * Check whether a task has the ioctl permission and cmd - * operation to an inode. -@@ -3759,43 +3796,56 @@ static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd, - - static int default_noexec __ro_after_init; - --static int file_map_prot_check(struct file *file, unsigned long prot, int shared) -+static int __file_map_prot_check(const struct cred *cred, -+ const struct file *file, unsigned long prot, -+ bool shared, bool bf_user_file) - { -- const struct cred *cred = current_cred(); -- u32 sid = cred_sid(cred); -- int rc = 0; -+ struct inode *inode = NULL; -+ bool prot_exec = prot & PROT_EXEC; -+ bool prot_write = prot & PROT_WRITE; -+ -+ if (file) { -+ if (bf_user_file) -+ inode = d_inode(backing_file_user_path(file)->dentry); -+ else -+ inode = file_inode(file); -+ } -+ -+ if (default_noexec && prot_exec && -+ (!file || IS_PRIVATE(inode) || (!shared && prot_write))) { -+ int rc; -+ u32 sid = cred_sid(cred); - -- if (default_noexec && -- (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || -- (!shared && (prot & PROT_WRITE)))) { - /* -- * We are making executable an anonymous mapping or a -- * private file mapping that will also be writable. -- * This has an additional check. -+ * We are making executable an anonymous mapping or a private -+ * file mapping that will also be writable. - */ - rc = avc_has_perm(&selinux_state, -- sid, sid, SECCLASS_PROCESS, -- PROCESS__EXECMEM, NULL); -+ sid, sid, SECCLASS_PROCESS, PROCESS__EXECMEM, -+ NULL); - if (rc) -- goto error; -+ return rc; - } - - if (file) { -- /* read access is always possible with a mapping */ -+ /* "read" always possible, "write" only if shared */ - u32 av = FILE__READ; -- -- /* write access only matters if the mapping is shared */ -- if (shared && (prot & PROT_WRITE)) -+ if (shared && prot_write) - av |= FILE__WRITE; -- -- if (prot & PROT_EXEC) -+ if (prot_exec) - av |= FILE__EXECUTE; - -- return file_has_perm(cred, file, av); -+ return __file_has_perm(cred, file, av, bf_user_file); - } - --error: -- return rc; -+ return 0; -+} -+ -+static inline int file_map_prot_check(const struct cred *cred, -+ const struct file *file, -+ unsigned long prot, bool shared) -+{ -+ return __file_map_prot_check(cred, file, prot, shared, false); - } - - static int selinux_mmap_addr(unsigned long addr) -@@ -3812,17 +3862,17 @@ static int selinux_mmap_addr(unsigned long addr) - return rc; - } - --static int selinux_mmap_file(struct file *file, unsigned long reqprot, -- unsigned long prot, unsigned long flags) -+static int selinux_mmap_file_common(const struct cred *cred, struct file *file, -+ unsigned long reqprot, unsigned long prot, -+ bool shared) - { -- struct common_audit_data ad; -- int rc; -- - if (file) { -+ int rc; -+ struct common_audit_data ad; -+ - ad.type = LSM_AUDIT_DATA_FILE; - ad.u.file = file; -- rc = inode_has_perm(current_cred(), file_inode(file), -- FILE__MAP, &ad); -+ rc = inode_has_perm(cred, file_inode(file), FILE__MAP, &ad); - if (rc) - return rc; - } -@@ -3830,23 +3880,68 @@ static int selinux_mmap_file(struct file *file, unsigned long reqprot, - if (checkreqprot_get(&selinux_state)) - prot = reqprot; - -- return file_map_prot_check(file, prot, -- (flags & MAP_TYPE) == MAP_SHARED); -+ return file_map_prot_check(cred, file, prot, shared); -+} -+ -+static int selinux_mmap_file(struct file *file, unsigned long reqprot, -+ unsigned long prot, unsigned long flags) -+{ -+ return selinux_mmap_file_common(current_cred(), file, reqprot, prot, -+ (flags & MAP_TYPE) == MAP_SHARED); -+} -+ -+/** -+ * selinux_mmap_backing_file - Check mmap permissions on a backing file -+ * @vma: memory region -+ * @backing_file: stacked filesystem backing file -+ * @user_file: user visible file -+ * -+ * This is called after selinux_mmap_file() on stacked filesystems, and it -+ * is this function's responsibility to verify access to @backing_file and -+ * setup the SELinux state for possible later use in the mprotect() code path. -+ * -+ * By the time this function is called, mmap() access to @user_file has already -+ * been authorized and @vma->vm_file has been set to point to @backing_file. -+ * -+ * Return zero on success, negative values otherwise. -+ */ -+static int selinux_mmap_backing_file(struct vm_area_struct *vma, -+ struct file *backing_file, -+ struct file *user_file __always_unused) -+{ -+ unsigned long prot = 0; -+ -+ /* translate vma->vm_flags perms into PROT perms */ -+ if (vma->vm_flags & VM_READ) -+ prot |= PROT_READ; -+ if (vma->vm_flags & VM_WRITE) -+ prot |= PROT_WRITE; -+ if (vma->vm_flags & VM_EXEC) -+ prot |= PROT_EXEC; -+ -+ return selinux_mmap_file_common(backing_file->f_cred, backing_file, -+ prot, prot, vma->vm_flags & VM_SHARED); - } - - static int selinux_file_mprotect(struct vm_area_struct *vma, - unsigned long reqprot, - unsigned long prot) - { -+ int rc; - const struct cred *cred = current_cred(); - u32 sid = cred_sid(cred); -+ const struct file *file = vma->vm_file; -+ bool backing_file; -+ bool shared = vma->vm_flags & VM_SHARED; -+ -+ /* check if we need to trigger the "backing files are awful" mode */ -+ backing_file = file && (file->f_mode & FMODE_BACKING); - - if (checkreqprot_get(&selinux_state)) - prot = reqprot; - - if (default_noexec && - (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { -- int rc = 0; - /* - * We don't use the vma_is_initial_heap() helper as it has - * a history of problems and is currently broken on systems -@@ -3861,12 +3956,16 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - rc = avc_has_perm(&selinux_state, - sid, sid, SECCLASS_PROCESS, - PROCESS__EXECHEAP, NULL); -- } else if (!vma->vm_file && (vma_is_initial_stack(vma) || -+ if (rc) -+ return rc; -+ } else if (!file && (vma_is_initial_stack(vma) || - vma_is_stack_for_current(vma))) { - rc = avc_has_perm(&selinux_state, - sid, sid, SECCLASS_PROCESS, - PROCESS__EXECSTACK, NULL); -- } else if (vma->vm_file && vma->anon_vma) { -+ if (rc) -+ return rc; -+ } else if (file && vma->anon_vma) { - /* - * We are making executable a file mapping that has - * had some COW done. Since pages might have been -@@ -3874,13 +3973,29 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - * modified content. This typically should only - * occur for text relocations. - */ -- rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD); -+ rc = __file_has_perm(cred, file, FILE__EXECMOD, -+ backing_file); -+ if (rc) -+ return rc; -+ if (backing_file) { -+ rc = file_has_perm(file->f_cred, file, -+ FILE__EXECMOD); -+ if (rc) -+ return rc; -+ } - } -+ } -+ -+ rc = __file_map_prot_check(cred, file, prot, shared, backing_file); -+ if (rc) -+ return rc; -+ if (backing_file) { -+ rc = file_map_prot_check(file->f_cred, file, prot, shared); - if (rc) - return rc; - } - -- return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED); -+ return 0; - } - - static int selinux_file_lock(struct file *file, unsigned int cmd) -@@ -7007,6 +7122,7 @@ static void selinux_bpf_token_free(struct bpf_token *token) - struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = { - .lbs_cred = sizeof(struct task_security_struct), - .lbs_file = sizeof(struct file_security_struct), -+ .lbs_backing_file = sizeof(struct backing_file_security_struct), - .lbs_inode = sizeof(struct inode_security_struct), - .lbs_ipc = sizeof(struct ipc_security_struct), - .lbs_msg_msg = sizeof(struct msg_security_struct), -@@ -7216,9 +7332,11 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { - - LSM_HOOK_INIT(file_permission, selinux_file_permission), - LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), -+ LSM_HOOK_INIT(backing_file_alloc, selinux_backing_file_alloc), - LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), - LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat), - LSM_HOOK_INIT(mmap_file, selinux_mmap_file), -+ LSM_HOOK_INIT(mmap_backing_file, selinux_mmap_backing_file), - LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), - LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), - LSM_HOOK_INIT(file_lock, selinux_file_lock), -diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h -index 2953132408bf..b1c5a2877f7e 100644 ---- a/security/selinux/include/objsec.h -+++ b/security/selinux/include/objsec.h -@@ -60,6 +60,10 @@ struct file_security_struct { - u32 pseqno; /* Policy seqno at the time of file open */ - }; - -+struct backing_file_security_struct { -+ u32 uf_sid; /* associated user file fsec->sid */ -+}; -+ - struct superblock_security_struct { - u32 sid; /* SID of file system superblock */ - u32 def_sid; /* default SID for labeling */ -@@ -158,6 +162,13 @@ static inline struct file_security_struct *selinux_file(const struct file *file) - return file->f_security + selinux_blob_sizes.lbs_file; - } - -+static inline struct backing_file_security_struct * -+selinux_backing_file(const struct file *backing_file) -+{ -+ void *blob = backing_file_security(backing_file); -+ return blob + selinux_blob_sizes.lbs_backing_file; -+} -+ - static inline struct inode_security_struct *selinux_inode( - const struct inode *inode) - { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1345-selinux-rhel-only-hotfix-for-execmem-regression.patch b/SOURCES/1345-selinux-rhel-only-hotfix-for-execmem-regression.patch deleted file mode 100644 index 7b9fe21c0..000000000 --- a/SOURCES/1345-selinux-rhel-only-hotfix-for-execmem-regression.patch +++ /dev/null @@ -1,130 +0,0 @@ -From ec2a2e4b876c7faed3de5e85406180810cc8539a Mon Sep 17 00:00:00 2001 -From: Ondrej Mosnacek -Date: Tue, 16 Jun 2026 10:06:13 +0200 -Subject: [PATCH] selinux: RHEL-only hotfix for execmem regression -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-185118 -Upstream Status: RHEL9-only - -As discovered by image-mode/CoreOS testing, the fixes for CVE-2026-46054 -caused a regression that results in unexpected execmem denials in -specific scenarios involving overlayfs (or another stacked filesystem). - -Specifically in case of image mode / CoreOS there is often (always?) an -overlayfs filesystem mounted during early boot (before SELinux policy is -loaded), which means that overlayfs captures the kernel’s SELinux -context as part of the mounter credentials, which are later used by -overlayfs+SELinux to verify that file accesses through the overlay mount -don’t give the mounter a way to access underlying files it otherwise -wouldn’t have access to. This verification would normally pass, as the -policy grants the kernel context almost unrestricted access to the -filesystem. However, the new checks added to fix CVE-2026-46054 -erroneously include the execmem check for the mounter and in the policy -kernel_t doesn’t have the execmem permission, so mmapping an overlay -file with MAP_PRIVATE and PROT_WRITE|PROT_EXEC would now result in a -SELinux denial. - -Fix this by passing a boolean through the helper functions that allows -to distinguish the direct permission check from the mounter check and -skipping the execmem check in the mounter case. - -This is a transient RHEL-only fix to allow the CVE fix to go through -without breaking image mode/CoreOS deployments. Once an optimal solution -is figured out and applied upstream, this commit will be reverted and -replaced with the upstream fix (at least in Y-streams). I expect the -upstream solution to be functionally equivalent, though probably -cosmetically different. - -Signed-off-by: Ondrej Mosnacek - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index fb5b9cb027d0..b31b06d4440b 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -3798,7 +3798,7 @@ static int default_noexec __ro_after_init; - - static int __file_map_prot_check(const struct cred *cred, - const struct file *file, unsigned long prot, -- bool shared, bool bf_user_file) -+ bool shared, bool mounter, bool bf_user_file) - { - struct inode *inode = NULL; - bool prot_exec = prot & PROT_EXEC; -@@ -3812,7 +3812,7 @@ static int __file_map_prot_check(const struct cred *cred, - } - - if (default_noexec && prot_exec && -- (!file || IS_PRIVATE(inode) || (!shared && prot_write))) { -+ (!file || IS_PRIVATE(inode) || (!shared && prot_write)) && !mounter) { - int rc; - u32 sid = cred_sid(cred); - -@@ -3843,9 +3843,9 @@ static int __file_map_prot_check(const struct cred *cred, - - static inline int file_map_prot_check(const struct cred *cred, - const struct file *file, -- unsigned long prot, bool shared) -+ unsigned long prot, bool shared, bool mounter) - { -- return __file_map_prot_check(cred, file, prot, shared, false); -+ return __file_map_prot_check(cred, file, prot, shared, mounter, false); - } - - static int selinux_mmap_addr(unsigned long addr) -@@ -3864,7 +3864,7 @@ static int selinux_mmap_addr(unsigned long addr) - - static int selinux_mmap_file_common(const struct cred *cred, struct file *file, - unsigned long reqprot, unsigned long prot, -- bool shared) -+ bool shared, bool mounter) - { - if (file) { - int rc; -@@ -3880,14 +3880,15 @@ static int selinux_mmap_file_common(const struct cred *cred, struct file *file, - if (checkreqprot_get(&selinux_state)) - prot = reqprot; - -- return file_map_prot_check(cred, file, prot, shared); -+ return file_map_prot_check(cred, file, prot, shared, mounter); - } - - static int selinux_mmap_file(struct file *file, unsigned long reqprot, - unsigned long prot, unsigned long flags) - { - return selinux_mmap_file_common(current_cred(), file, reqprot, prot, -- (flags & MAP_TYPE) == MAP_SHARED); -+ (flags & MAP_TYPE) == MAP_SHARED, -+ false); - } - - /** -@@ -3920,7 +3921,8 @@ static int selinux_mmap_backing_file(struct vm_area_struct *vma, - prot |= PROT_EXEC; - - return selinux_mmap_file_common(backing_file->f_cred, backing_file, -- prot, prot, vma->vm_flags & VM_SHARED); -+ prot, prot, vma->vm_flags & VM_SHARED, -+ true); - } - - static int selinux_file_mprotect(struct vm_area_struct *vma, -@@ -3986,11 +3988,11 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, - } - } - -- rc = __file_map_prot_check(cred, file, prot, shared, backing_file); -+ rc = __file_map_prot_check(cred, file, prot, shared, false, backing_file); - if (rc) - return rc; - if (backing_file) { -- rc = file_map_prot_check(file->f_cred, file, prot, shared); -+ rc = file_map_prot_check(file->f_cred, file, prot, shared, true); - if (rc) - return rc; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1346-net-mlx5-hws-fix-matcher-action-template-attach.patch b/SOURCES/1346-net-mlx5-hws-fix-matcher-action-template-attach.patch deleted file mode 100644 index 9225e114c..000000000 --- a/SOURCES/1346-net-mlx5-hws-fix-matcher-action-template-attach.patch +++ /dev/null @@ -1,323 +0,0 @@ -From 0ba00ffd79bdb243b0067aa95fe5846b6c1ecbe7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:58 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix matcher action template attach - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 36ef2575e78d1a3c699dc3f1c9dee9be742c9bdd -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:31 2025 +0300 - - net/mlx5: HWS, Fix matcher action template attach - - The procedure of attaching an action template to an existing matcher had - a few issues: - - 1. Attaching accidentally overran the `at` array in bwc_matcher, which - would result in memory corruption. This bug wasn't triggered, but it - is possible to trigger it by attaching action templates beyond the - initial buffer size of 8. Fix this by converting to a dynamically - sized buffer and reallocating if needed. - - 2. Similarly, the `at` array inside the native matcher was never - reallocated. Fix this the same as above. - - 3. The bwc layer treated any error in action template attach as a signal - that the matcher should be rehashed to account for a larger number of - action STEs. In reality, there are other unrelated errors that can - arise and they should be propagated upstack. Fix this by adding a - `need_rehash` output parameter that's orthogonal to error codes. - - Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 19dce1ba512d..32de8bfc7644 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -90,13 +90,19 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - bwc_matcher->priority = priority; - bwc_matcher->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; - -+ bwc_matcher->size_of_at_array = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; -+ bwc_matcher->at = kcalloc(bwc_matcher->size_of_at_array, -+ sizeof(*bwc_matcher->at), GFP_KERNEL); -+ if (!bwc_matcher->at) -+ goto free_bwc_matcher_rules; -+ - /* create dummy action template */ - bwc_matcher->at[0] = - mlx5hws_action_template_create(action_types ? - action_types : init_action_types); - if (!bwc_matcher->at[0]) { - mlx5hws_err(table->ctx, "BWC matcher: failed creating action template\n"); -- goto free_bwc_matcher_rules; -+ goto free_bwc_matcher_at_array; - } - - bwc_matcher->num_of_at = 1; -@@ -126,6 +132,8 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - mlx5hws_match_template_destroy(bwc_matcher->mt); - free_at: - mlx5hws_action_template_destroy(bwc_matcher->at[0]); -+free_bwc_matcher_at_array: -+ kfree(bwc_matcher->at); - free_bwc_matcher_rules: - kfree(bwc_matcher->rules); - err: -@@ -192,6 +200,7 @@ int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - - for (i = 0; i < bwc_matcher->num_of_at; i++) - mlx5hws_action_template_destroy(bwc_matcher->at[i]); -+ kfree(bwc_matcher->at); - - mlx5hws_match_template_destroy(bwc_matcher->mt); - kfree(bwc_matcher->rules); -@@ -520,6 +529,23 @@ hws_bwc_matcher_extend_at(struct mlx5hws_bwc_matcher *bwc_matcher, - struct mlx5hws_rule_action rule_actions[]) - { - enum mlx5hws_action_type action_types[MLX5HWS_BWC_MAX_ACTS]; -+ void *p; -+ -+ if (unlikely(bwc_matcher->num_of_at >= bwc_matcher->size_of_at_array)) { -+ if (bwc_matcher->size_of_at_array >= MLX5HWS_MATCHER_MAX_AT) -+ return -ENOMEM; -+ bwc_matcher->size_of_at_array *= 2; -+ p = krealloc(bwc_matcher->at, -+ bwc_matcher->size_of_at_array * -+ sizeof(*bwc_matcher->at), -+ __GFP_ZERO | GFP_KERNEL); -+ if (!p) { -+ bwc_matcher->size_of_at_array /= 2; -+ return -ENOMEM; -+ } -+ -+ bwc_matcher->at = p; -+ } - - hws_bwc_rule_actions_to_action_types(rule_actions, action_types); - -@@ -777,6 +803,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_rule_attr rule_attr; - struct mutex *queue_lock; /* Protect the queue */ - u32 num_of_rules; -+ bool need_rehash; - int ret = 0; - int at_idx; - -@@ -803,10 +830,14 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - at_idx = bwc_matcher->num_of_at - 1; - - ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx]); -+ bwc_matcher->at[at_idx], -+ &need_rehash); - if (unlikely(ret)) { -- /* Action template attach failed, possibly due to -- * requiring more action STEs. -+ hws_bwc_unlock_all_queues(ctx); -+ return ret; -+ } -+ if (unlikely(need_rehash)) { -+ /* The new action template requires more action STEs. - * Need to attempt creating new matcher with all - * the action templates, including the new one. - */ -@@ -942,6 +973,7 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_rule_attr rule_attr; - struct mutex *queue_lock; /* Protect the queue */ -+ bool need_rehash; - int at_idx, ret; - u16 idx; - -@@ -973,12 +1005,17 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - at_idx = bwc_matcher->num_of_at - 1; - - ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx]); -+ bwc_matcher->at[at_idx], -+ &need_rehash); - if (unlikely(ret)) { -- /* Action template attach failed, possibly due to -- * requiring more action STEs. -- * Need to attempt creating new matcher with all -- * the action templates, including the new one. -+ hws_bwc_unlock_all_queues(ctx); -+ return ret; -+ } -+ if (unlikely(need_rehash)) { -+ /* The new action template requires more action -+ * STEs. Need to attempt creating new matcher -+ * with all the action templates, including the -+ * new one. - */ - ret = hws_bwc_matcher_rehash_at(bwc_matcher); - if (unlikely(ret)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index 47f7ed141553..bb0cf4b922ce 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -10,9 +10,7 @@ - #define MLX5HWS_BWC_MATCHER_REHASH_BURST_TH 32 - - /* Max number of AT attach operations for the same matcher. -- * When the limit is reached, next attempt to attach new AT -- * will result in creation of a new matcher and moving all -- * the rules to this matcher. -+ * When the limit is reached, a larger buffer is allocated for the ATs. - */ - #define MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM 8 - -@@ -23,10 +21,11 @@ - struct mlx5hws_bwc_matcher { - struct mlx5hws_matcher *matcher; - struct mlx5hws_match_template *mt; -- struct mlx5hws_action_template *at[MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM]; -- u32 priority; -+ struct mlx5hws_action_template **at; - u8 num_of_at; -+ u8 size_of_at_array; - u8 size_log; -+ u32 priority; - atomic_t num_of_rules; - struct list_head *rules; - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index b61864b32053..37a4497048a6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -905,18 +905,48 @@ static int hws_matcher_uninit(struct mlx5hws_matcher *matcher) - return 0; - } - -+static int hws_matcher_grow_at_array(struct mlx5hws_matcher *matcher) -+{ -+ void *p; -+ -+ if (matcher->size_of_at_array >= MLX5HWS_MATCHER_MAX_AT) -+ return -ENOMEM; -+ -+ matcher->size_of_at_array *= 2; -+ p = krealloc(matcher->at, -+ matcher->size_of_at_array * sizeof(*matcher->at), -+ __GFP_ZERO | GFP_KERNEL); -+ if (!p) { -+ matcher->size_of_at_array /= 2; -+ return -ENOMEM; -+ } -+ -+ matcher->at = p; -+ -+ return 0; -+} -+ - int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, -- struct mlx5hws_action_template *at) -+ struct mlx5hws_action_template *at, -+ bool *need_rehash) - { - bool is_jumbo = mlx5hws_matcher_mt_is_jumbo(matcher->mt); - struct mlx5hws_context *ctx = matcher->tbl->ctx; - u32 required_stes; - int ret; - -- if (!matcher->attr.max_num_of_at_attach) { -- mlx5hws_dbg(ctx, "Num of current at (%d) exceed allowed value\n", -- matcher->num_of_at); -- return -EOPNOTSUPP; -+ *need_rehash = false; -+ -+ if (unlikely(matcher->num_of_at >= matcher->size_of_at_array)) { -+ ret = hws_matcher_grow_at_array(matcher); -+ if (ret) -+ return ret; -+ -+ if (matcher->col_matcher) { -+ ret = hws_matcher_grow_at_array(matcher->col_matcher); -+ if (ret) -+ return ret; -+ } - } - - ret = hws_matcher_check_and_process_at(matcher, at); -@@ -927,12 +957,11 @@ int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, - if (matcher->action_ste.max_stes < required_stes) { - mlx5hws_dbg(ctx, "Required STEs [%d] exceeds initial action template STE [%d]\n", - required_stes, matcher->action_ste.max_stes); -- return -ENOMEM; -+ *need_rehash = true; - } - - matcher->at[matcher->num_of_at] = *at; - matcher->num_of_at += 1; -- matcher->attr.max_num_of_at_attach -= 1; - - if (matcher->col_matcher) - matcher->col_matcher->num_of_at = matcher->num_of_at; -@@ -960,8 +989,9 @@ hws_matcher_set_templates(struct mlx5hws_matcher *matcher, - if (!matcher->mt) - return -ENOMEM; - -- matcher->at = kvcalloc(num_of_at + matcher->attr.max_num_of_at_attach, -- sizeof(*matcher->at), -+ matcher->size_of_at_array = -+ num_of_at + matcher->attr.max_num_of_at_attach; -+ matcher->at = kvcalloc(matcher->size_of_at_array, sizeof(*matcher->at), - GFP_KERNEL); - if (!matcher->at) { - mlx5hws_err(ctx, "Failed to allocate action template array\n"); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index 020de70270c5..20b32012c418 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -23,6 +23,9 @@ - */ - #define MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT 1 - -+/* Maximum number of action templates that can be attached to a matcher. */ -+#define MLX5HWS_MATCHER_MAX_AT 128 -+ - enum mlx5hws_matcher_offset { - MLX5HWS_MATCHER_OFFSET_TAG_DW1 = 12, - MLX5HWS_MATCHER_OFFSET_TAG_DW0 = 13, -@@ -72,6 +75,7 @@ struct mlx5hws_matcher { - struct mlx5hws_match_template *mt; - struct mlx5hws_action_template *at; - u8 num_of_at; -+ u8 size_of_at_array; - u8 num_of_mt; - /* enum mlx5hws_matcher_flags */ - u8 flags; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 5121951f2778..8ed8a715a2eb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -399,11 +399,14 @@ int mlx5hws_matcher_destroy(struct mlx5hws_matcher *matcher); - * - * @matcher: Matcher to attach the action template to. - * @at: Action template to be attached to the matcher. -+ * @need_rehash: Output parameter that tells callers if the matcher needs to be -+ * rehashed. - * - * Return: Zero on success, non-zero otherwise. - */ - int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, -- struct mlx5hws_action_template *at); -+ struct mlx5hws_action_template *at, -+ bool *need_rehash); - - /** - * mlx5hws_matcher_resize_set_target - Link two matchers and enable moving rules. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1347-net-mlx5-hws-remove-unused-element-array.patch b/SOURCES/1347-net-mlx5-hws-remove-unused-element-array.patch deleted file mode 100644 index f286da431..000000000 --- a/SOURCES/1347-net-mlx5-hws-remove-unused-element-array.patch +++ /dev/null @@ -1,178 +0,0 @@ -From f6b3ae9e3b84ce0d94c00565a0321eb0a1502cee Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:58 -0400 -Subject: [PATCH] net/mlx5: HWS, Remove unused element array - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b2ae16214ffeda3e1c25223eebe19f85b0876181 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:32 2025 +0300 - - net/mlx5: HWS, Remove unused element array - - Remove the array of elements wrapped in a struct because in reality only - the first element was ever used. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 50a81d360bb2..35ed9bee06a6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -293,7 +293,7 @@ static int hws_pool_create_resource_on_index(struct mlx5hws_pool *pool, - } - - static struct mlx5hws_pool_elements * --hws_pool_element_create_new_elem(struct mlx5hws_pool *pool, u32 order, int idx) -+hws_pool_element_create_new_elem(struct mlx5hws_pool *pool, u32 order) - { - struct mlx5hws_pool_elements *elem; - u32 alloc_size; -@@ -311,21 +311,21 @@ hws_pool_element_create_new_elem(struct mlx5hws_pool *pool, u32 order, int idx) - elem->bitmap = hws_pool_create_and_init_bitmap(alloc_size - order); - if (!elem->bitmap) { - mlx5hws_err(pool->ctx, -- "Failed to create bitmap type: %d: size %d index: %d\n", -- pool->type, alloc_size, idx); -+ "Failed to create bitmap type: %d: size %d\n", -+ pool->type, alloc_size); - goto free_elem; - } - - elem->log_size = alloc_size - order; - } - -- if (hws_pool_create_resource_on_index(pool, alloc_size, idx)) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d index: %d\n", -- pool->type, alloc_size, idx); -+ if (hws_pool_create_resource_on_index(pool, alloc_size, 0)) { -+ mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -+ pool->type, alloc_size); - goto free_db; - } - -- pool->db.element_manager->elements[idx] = elem; -+ pool->db.element = elem; - - return elem; - -@@ -359,9 +359,9 @@ hws_pool_onesize_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, - { - struct mlx5hws_pool_elements *elem; - -- elem = pool->db.element_manager->elements[0]; -+ elem = pool->db.element; - if (!elem) -- elem = hws_pool_element_create_new_elem(pool, order, 0); -+ elem = hws_pool_element_create_new_elem(pool, order); - if (!elem) - goto err_no_elem; - -@@ -451,16 +451,14 @@ static int hws_pool_general_element_db_init(struct mlx5hws_pool *pool) - return 0; - } - --static void hws_onesize_element_db_destroy_element(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_elements *elem, -- struct mlx5hws_pool_chunk *chunk) -+static void -+hws_onesize_element_db_destroy_element(struct mlx5hws_pool *pool, -+ struct mlx5hws_pool_elements *elem) - { -- if (unlikely(!pool->resource[chunk->resource_idx])) -- pr_warn("HWS: invalid resource with index %d\n", chunk->resource_idx); -- -- hws_pool_resource_free(pool, chunk->resource_idx); -+ hws_pool_resource_free(pool, 0); -+ bitmap_free(elem->bitmap); - kfree(elem); -- pool->db.element_manager->elements[chunk->resource_idx] = NULL; -+ pool->db.element = NULL; - } - - static void hws_onesize_element_db_put_chunk(struct mlx5hws_pool *pool, -@@ -471,7 +469,7 @@ static void hws_onesize_element_db_put_chunk(struct mlx5hws_pool *pool, - if (unlikely(chunk->resource_idx)) - pr_warn("HWS: invalid resource with index %d\n", chunk->resource_idx); - -- elem = pool->db.element_manager->elements[chunk->resource_idx]; -+ elem = pool->db.element; - if (!elem) { - mlx5hws_err(pool->ctx, "No such element (%d)\n", chunk->resource_idx); - return; -@@ -483,7 +481,7 @@ static void hws_onesize_element_db_put_chunk(struct mlx5hws_pool *pool, - - if (pool->flags & MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE && - !elem->num_of_elements) -- hws_onesize_element_db_destroy_element(pool, elem, chunk); -+ hws_onesize_element_db_destroy_element(pool, elem); - } - - static int hws_onesize_element_db_get_chunk(struct mlx5hws_pool *pool, -@@ -504,18 +502,13 @@ static int hws_onesize_element_db_get_chunk(struct mlx5hws_pool *pool, - - static void hws_onesize_element_db_uninit(struct mlx5hws_pool *pool) - { -- struct mlx5hws_pool_elements *elem; -- int i; -+ struct mlx5hws_pool_elements *elem = pool->db.element; - -- for (i = 0; i < MLX5HWS_POOL_RESOURCE_ARR_SZ; i++) { -- elem = pool->db.element_manager->elements[i]; -- if (elem) { -- bitmap_free(elem->bitmap); -- kfree(elem); -- pool->db.element_manager->elements[i] = NULL; -- } -+ if (elem) { -+ bitmap_free(elem->bitmap); -+ kfree(elem); -+ pool->db.element = NULL; - } -- kfree(pool->db.element_manager); - } - - /* This memory management works as the following: -@@ -526,10 +519,6 @@ static void hws_onesize_element_db_uninit(struct mlx5hws_pool *pool) - */ - static int hws_pool_onesize_element_db_init(struct mlx5hws_pool *pool) - { -- pool->db.element_manager = kzalloc(sizeof(*pool->db.element_manager), GFP_KERNEL); -- if (!pool->db.element_manager) -- return -ENOMEM; -- - pool->p_db_uninit = &hws_onesize_element_db_uninit; - pool->p_get_chunk = &hws_onesize_element_db_get_chunk; - pool->p_put_chunk = &hws_onesize_element_db_put_chunk; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -index 621298b352b2..f4258f83fdbf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -@@ -87,14 +87,10 @@ struct mlx5hws_pool_elements { - bool is_full; - }; - --struct mlx5hws_element_manager { -- struct mlx5hws_pool_elements *elements[MLX5HWS_POOL_RESOURCE_ARR_SZ]; --}; -- - struct mlx5hws_pool_db { - enum mlx5hws_db_type type; - union { -- struct mlx5hws_element_manager *element_manager; -+ struct mlx5hws_pool_elements *element; - struct mlx5hws_buddy_manager *buddy_manager; - }; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1348-net-mlx5-hws-make-pool-single-resource.patch b/SOURCES/1348-net-mlx5-hws-make-pool-single-resource.patch deleted file mode 100644 index 9ccdbc21c..000000000 --- a/SOURCES/1348-net-mlx5-hws-make-pool-single-resource.patch +++ /dev/null @@ -1,700 +0,0 @@ -From 33eec33671fbe0444075b87f15b803b77059993f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:58 -0400 -Subject: [PATCH] net/mlx5: HWS, Make pool single resource - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 38956bea7349ce75c1519b57c27cd97580b4c822 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:33 2025 +0300 - - net/mlx5: HWS, Make pool single resource - - The pool implementation claimed to support multiple resources, but this - does not really make sense in context. Callers always allocate a single - STC or STE chunk of exactly the size provided. - - The code that handled multiple resources was unused (and likely buggy) - due to the combination of flags passed by callers. - - Simplify the pool by having it handle a single resource. As a result of - this simplification, chunks no longer contain a resource offset (there - is now only one resource per pool), and the get_base_id functions no - longer take a chunk parameter. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index b5332c54d4fb..781ba8c4f733 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -238,6 +238,7 @@ hws_action_fixup_stc_attr(struct mlx5hws_context *ctx, - enum mlx5hws_table_type table_type, - bool is_mirror) - { -+ struct mlx5hws_pool *pool; - bool use_fixup = false; - u32 fw_tbl_type; - u32 base_id; -@@ -253,13 +254,11 @@ hws_action_fixup_stc_attr(struct mlx5hws_context *ctx, - use_fixup = true; - break; - } -+ pool = stc_attr->ste_table.ste_pool; - if (!is_mirror) -- base_id = mlx5hws_pool_chunk_get_base_id(stc_attr->ste_table.ste_pool, -- &stc_attr->ste_table.ste); -+ base_id = mlx5hws_pool_get_base_id(pool); - else -- base_id = -- mlx5hws_pool_chunk_get_base_mirror_id(stc_attr->ste_table.ste_pool, -- &stc_attr->ste_table.ste); -+ base_id = mlx5hws_pool_get_base_mirror_id(pool); - - *fixup_stc_attr = *stc_attr; - fixup_stc_attr->ste_table.ste_obj_id = base_id; -@@ -337,7 +336,7 @@ __must_hold(&ctx->ctrl_lock) - if (!mlx5hws_context_cap_dynamic_reparse(ctx)) - stc_attr->reparse_mode = MLX5_IFC_STC_REPARSE_IGNORE; - -- obj_0_id = mlx5hws_pool_chunk_get_base_id(stc_pool, stc); -+ obj_0_id = mlx5hws_pool_get_base_id(stc_pool); - - /* According to table/action limitation change the stc_attr */ - use_fixup = hws_action_fixup_stc_attr(ctx, stc_attr, &fixup_stc_attr, table_type, false); -@@ -353,7 +352,7 @@ __must_hold(&ctx->ctrl_lock) - if (table_type == MLX5HWS_TABLE_TYPE_FDB) { - u32 obj_1_id; - -- obj_1_id = mlx5hws_pool_chunk_get_base_mirror_id(stc_pool, stc); -+ obj_1_id = mlx5hws_pool_get_base_mirror_id(stc_pool); - - use_fixup = hws_action_fixup_stc_attr(ctx, stc_attr, - &fixup_stc_attr, -@@ -393,11 +392,11 @@ __must_hold(&ctx->ctrl_lock) - stc_attr.action_type = MLX5_IFC_STC_ACTION_TYPE_DROP; - stc_attr.action_offset = MLX5HWS_ACTION_OFFSET_HIT; - stc_attr.stc_offset = stc->offset; -- obj_id = mlx5hws_pool_chunk_get_base_id(stc_pool, stc); -+ obj_id = mlx5hws_pool_get_base_id(stc_pool); - mlx5hws_cmd_stc_modify(ctx->mdev, obj_id, &stc_attr); - - if (table_type == MLX5HWS_TABLE_TYPE_FDB) { -- obj_id = mlx5hws_pool_chunk_get_base_mirror_id(stc_pool, stc); -+ obj_id = mlx5hws_pool_get_base_mirror_id(stc_pool); - mlx5hws_cmd_stc_modify(ctx->mdev, obj_id, &stc_attr); - } - -@@ -1581,7 +1580,6 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - u32 miss_ft_id) - { - struct mlx5hws_cmd_rtc_create_attr rtc_attr = {0}; -- struct mlx5hws_action_default_stc *default_stc; - struct mlx5hws_matcher_action_ste *table_ste; - struct mlx5hws_pool_attr pool_attr = {0}; - struct mlx5hws_pool *ste_pool, *stc_pool; -@@ -1629,7 +1627,7 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - rtc_attr.fw_gen_wqe = true; - rtc_attr.is_scnd_range = true; - -- obj_id = mlx5hws_pool_chunk_get_base_id(ste_pool, ste); -+ obj_id = mlx5hws_pool_get_base_id(ste_pool); - - rtc_attr.pd = ctx->pd_num; - rtc_attr.ste_base = obj_id; -@@ -1639,8 +1637,7 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - - /* STC is a single resource (obj_id), use any STC for the ID */ - stc_pool = ctx->stc_pool; -- default_stc = ctx->common_res.default_stc; -- obj_id = mlx5hws_pool_chunk_get_base_id(stc_pool, &default_stc->default_hit); -+ obj_id = mlx5hws_pool_get_base_id(stc_pool); - rtc_attr.stc_base = obj_id; - - ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_0_id); -@@ -1650,11 +1647,11 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - } - - /* Create mirror RTC */ -- obj_id = mlx5hws_pool_chunk_get_base_mirror_id(ste_pool, ste); -+ obj_id = mlx5hws_pool_get_base_mirror_id(ste_pool); - rtc_attr.ste_base = obj_id; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(MLX5HWS_TABLE_TYPE_FDB, true); - -- obj_id = mlx5hws_pool_chunk_get_base_mirror_id(stc_pool, &default_stc->default_hit); -+ obj_id = mlx5hws_pool_get_base_mirror_id(stc_pool); - rtc_attr.stc_base = obj_id; - - ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_1_id); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -index 696275fd0ce2..3491408c5d84 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -@@ -118,7 +118,6 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - { - enum mlx5hws_table_type tbl_type = matcher->tbl->type; - struct mlx5hws_cmd_ft_query_attr ft_attr = {0}; -- struct mlx5hws_pool_chunk *ste; - struct mlx5hws_pool *ste_pool; - u64 icm_addr_0 = 0; - u64 icm_addr_1 = 0; -@@ -134,12 +133,11 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - matcher->end_ft_id, - matcher->col_matcher ? HWS_PTR_TO_ID(matcher->col_matcher) : 0); - -- ste = &matcher->match_ste.ste; - ste_pool = matcher->match_ste.pool; - if (ste_pool) { -- ste_0_id = mlx5hws_pool_chunk_get_base_id(ste_pool, ste); -+ ste_0_id = mlx5hws_pool_get_base_id(ste_pool); - if (tbl_type == MLX5HWS_TABLE_TYPE_FDB) -- ste_1_id = mlx5hws_pool_chunk_get_base_mirror_id(ste_pool, ste); -+ ste_1_id = mlx5hws_pool_get_base_mirror_id(ste_pool); - } - - seq_printf(f, ",%d,%d,%d,%d", -@@ -148,12 +146,11 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - matcher->match_ste.rtc_1_id, - (int)ste_1_id); - -- ste = &matcher->action_ste.ste; - ste_pool = matcher->action_ste.pool; - if (ste_pool) { -- ste_0_id = mlx5hws_pool_chunk_get_base_id(ste_pool, ste); -+ ste_0_id = mlx5hws_pool_get_base_id(ste_pool); - if (tbl_type == MLX5HWS_TABLE_TYPE_FDB) -- ste_1_id = mlx5hws_pool_chunk_get_base_mirror_id(ste_pool, ste); -+ ste_1_id = mlx5hws_pool_get_base_mirror_id(ste_pool); - else - ste_1_id = -1; - } else { -@@ -387,14 +384,17 @@ static int hws_debug_dump_context_stc(struct seq_file *f, struct mlx5hws_context - if (!stc_pool) - return 0; - -- if (stc_pool->resource[0]) { -- ret = hws_debug_dump_context_stc_resource(f, ctx, stc_pool->resource[0]); -+ if (stc_pool->resource) { -+ ret = hws_debug_dump_context_stc_resource(f, ctx, -+ stc_pool->resource); - if (ret) - return ret; - } - -- if (stc_pool->mirror_resource[0]) { -- ret = hws_debug_dump_context_stc_resource(f, ctx, stc_pool->mirror_resource[0]); -+ if (stc_pool->mirror_resource) { -+ struct mlx5hws_pool_resource *res = stc_pool->mirror_resource; -+ -+ ret = hws_debug_dump_context_stc_resource(f, ctx, res); - if (ret) - return ret; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 37a4497048a6..59b14db427b4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -223,7 +223,6 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - struct mlx5hws_cmd_rtc_create_attr rtc_attr = {0}; - struct mlx5hws_match_template *mt = matcher->mt; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -- struct mlx5hws_action_default_stc *default_stc; - struct mlx5hws_matcher_action_ste *action_ste; - struct mlx5hws_table *tbl = matcher->tbl; - struct mlx5hws_pool *ste_pool, *stc_pool; -@@ -305,7 +304,7 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - return -EINVAL; - } - -- obj_id = mlx5hws_pool_chunk_get_base_id(ste_pool, ste); -+ obj_id = mlx5hws_pool_get_base_id(ste_pool); - - rtc_attr.pd = ctx->pd_num; - rtc_attr.ste_base = obj_id; -@@ -316,8 +315,7 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - - /* STC is a single resource (obj_id), use any STC for the ID */ - stc_pool = ctx->stc_pool; -- default_stc = ctx->common_res.default_stc; -- obj_id = mlx5hws_pool_chunk_get_base_id(stc_pool, &default_stc->default_hit); -+ obj_id = mlx5hws_pool_get_base_id(stc_pool); - rtc_attr.stc_base = obj_id; - - ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_0_id); -@@ -328,11 +326,11 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -- obj_id = mlx5hws_pool_chunk_get_base_mirror_id(ste_pool, ste); -+ obj_id = mlx5hws_pool_get_base_mirror_id(ste_pool); - rtc_attr.ste_base = obj_id; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, true); - -- obj_id = mlx5hws_pool_chunk_get_base_mirror_id(stc_pool, &default_stc->default_hit); -+ obj_id = mlx5hws_pool_get_base_mirror_id(stc_pool); - rtc_attr.stc_base = obj_id; - hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, rtc_type, true); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 35ed9bee06a6..0de03e17624c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -20,15 +20,14 @@ static void hws_pool_free_one_resource(struct mlx5hws_pool_resource *resource) - kfree(resource); - } - --static void hws_pool_resource_free(struct mlx5hws_pool *pool, -- int resource_idx) -+static void hws_pool_resource_free(struct mlx5hws_pool *pool) - { -- hws_pool_free_one_resource(pool->resource[resource_idx]); -- pool->resource[resource_idx] = NULL; -+ hws_pool_free_one_resource(pool->resource); -+ pool->resource = NULL; - - if (pool->tbl_type == MLX5HWS_TABLE_TYPE_FDB) { -- hws_pool_free_one_resource(pool->mirror_resource[resource_idx]); -- pool->mirror_resource[resource_idx] = NULL; -+ hws_pool_free_one_resource(pool->mirror_resource); -+ pool->mirror_resource = NULL; - } - } - -@@ -78,7 +77,7 @@ hws_pool_create_one_resource(struct mlx5hws_pool *pool, u32 log_range, - } - - static int --hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range, int idx) -+hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range) - { - struct mlx5hws_pool_resource *resource; - u32 fw_ft_type, opt_log_range; -@@ -91,7 +90,7 @@ hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range, int idx) - return -EINVAL; - } - -- pool->resource[idx] = resource; -+ pool->resource = resource; - - if (pool->tbl_type == MLX5HWS_TABLE_TYPE_FDB) { - struct mlx5hws_pool_resource *mirror_resource; -@@ -102,10 +101,10 @@ hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range, int idx) - if (!mirror_resource) { - mlx5hws_err(pool->ctx, "Failed allocating mirrored resource\n"); - hws_pool_free_one_resource(resource); -- pool->resource[idx] = NULL; -+ pool->resource = NULL; - return -EINVAL; - } -- pool->mirror_resource[idx] = mirror_resource; -+ pool->mirror_resource = mirror_resource; - } - - return 0; -@@ -129,9 +128,9 @@ static void hws_pool_buddy_db_put_chunk(struct mlx5hws_pool *pool, - { - struct mlx5hws_buddy_mem *buddy; - -- buddy = pool->db.buddy_manager->buddies[chunk->resource_idx]; -+ buddy = pool->db.buddy; - if (!buddy) { -- mlx5hws_err(pool->ctx, "No such buddy (%d)\n", chunk->resource_idx); -+ mlx5hws_err(pool->ctx, "Bad buddy state\n"); - return; - } - -@@ -139,86 +138,50 @@ static void hws_pool_buddy_db_put_chunk(struct mlx5hws_pool *pool, - } - - static struct mlx5hws_buddy_mem * --hws_pool_buddy_get_next_buddy(struct mlx5hws_pool *pool, int idx, -- u32 order, bool *is_new_buddy) -+hws_pool_buddy_get_buddy(struct mlx5hws_pool *pool, u32 order) - { - static struct mlx5hws_buddy_mem *buddy; - u32 new_buddy_size; - -- buddy = pool->db.buddy_manager->buddies[idx]; -+ buddy = pool->db.buddy; - if (buddy) - return buddy; - - new_buddy_size = max(pool->alloc_log_sz, order); -- *is_new_buddy = true; - buddy = mlx5hws_buddy_create(new_buddy_size); - if (!buddy) { -- mlx5hws_err(pool->ctx, "Failed to create buddy order: %d index: %d\n", -- new_buddy_size, idx); -+ mlx5hws_err(pool->ctx, "Failed to create buddy order: %d\n", -+ new_buddy_size); - return NULL; - } - -- if (hws_pool_resource_alloc(pool, new_buddy_size, idx) != 0) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d index: %d\n", -- pool->type, new_buddy_size, idx); -+ if (hws_pool_resource_alloc(pool, new_buddy_size) != 0) { -+ mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -+ pool->type, new_buddy_size); - mlx5hws_buddy_cleanup(buddy); - return NULL; - } - -- pool->db.buddy_manager->buddies[idx] = buddy; -+ pool->db.buddy = buddy; - - return buddy; - } - - static int hws_pool_buddy_get_mem_chunk(struct mlx5hws_pool *pool, - int order, -- u32 *buddy_idx, - int *seg) - { - struct mlx5hws_buddy_mem *buddy; -- bool new_mem = false; -- int ret = 0; -- int i; -- -- *seg = -1; -- -- /* Find the next free place from the buddy array */ -- while (*seg < 0) { -- for (i = 0; i < MLX5HWS_POOL_RESOURCE_ARR_SZ; i++) { -- buddy = hws_pool_buddy_get_next_buddy(pool, i, -- order, -- &new_mem); -- if (!buddy) { -- ret = -ENOMEM; -- goto out; -- } -- -- *seg = mlx5hws_buddy_alloc_mem(buddy, order); -- if (*seg >= 0) -- goto found; -- -- if (pool->flags & MLX5HWS_POOL_FLAGS_ONE_RESOURCE) { -- mlx5hws_err(pool->ctx, -- "Fail to allocate seg for one resource pool\n"); -- ret = -ENOMEM; -- goto out; -- } -- -- if (new_mem) { -- /* We have new memory pool, should be place for us */ -- mlx5hws_err(pool->ctx, -- "No memory for order: %d with buddy no: %d\n", -- order, i); -- ret = -ENOMEM; -- goto out; -- } -- } -- } - --found: -- *buddy_idx = i; --out: -- return ret; -+ buddy = hws_pool_buddy_get_buddy(pool, order); -+ if (!buddy) -+ return -ENOMEM; -+ -+ *seg = mlx5hws_buddy_alloc_mem(buddy, order); -+ if (*seg >= 0) -+ return 0; -+ -+ return -ENOMEM; - } - - static int hws_pool_buddy_db_get_chunk(struct mlx5hws_pool *pool, -@@ -226,9 +189,7 @@ static int hws_pool_buddy_db_get_chunk(struct mlx5hws_pool *pool, - { - int ret = 0; - -- /* Go over the buddies and find next free slot */ - ret = hws_pool_buddy_get_mem_chunk(pool, chunk->order, -- &chunk->resource_idx, - &chunk->offset); - if (ret) - mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -@@ -240,33 +201,21 @@ static int hws_pool_buddy_db_get_chunk(struct mlx5hws_pool *pool, - static void hws_pool_buddy_db_uninit(struct mlx5hws_pool *pool) - { - struct mlx5hws_buddy_mem *buddy; -- int i; -- -- for (i = 0; i < MLX5HWS_POOL_RESOURCE_ARR_SZ; i++) { -- buddy = pool->db.buddy_manager->buddies[i]; -- if (buddy) { -- mlx5hws_buddy_cleanup(buddy); -- kfree(buddy); -- pool->db.buddy_manager->buddies[i] = NULL; -- } -- } - -- kfree(pool->db.buddy_manager); -+ buddy = pool->db.buddy; -+ if (buddy) { -+ mlx5hws_buddy_cleanup(buddy); -+ kfree(buddy); -+ pool->db.buddy = NULL; -+ } - } - - static int hws_pool_buddy_db_init(struct mlx5hws_pool *pool, u32 log_range) - { -- pool->db.buddy_manager = kzalloc(sizeof(*pool->db.buddy_manager), GFP_KERNEL); -- if (!pool->db.buddy_manager) -- return -ENOMEM; -- - if (pool->flags & MLX5HWS_POOL_FLAGS_ALLOC_MEM_ON_CREATE) { -- bool new_buddy; -- -- if (!hws_pool_buddy_get_next_buddy(pool, 0, log_range, &new_buddy)) { -+ if (!hws_pool_buddy_get_buddy(pool, log_range)) { - mlx5hws_err(pool->ctx, - "Failed allocating memory on create log_sz: %d\n", log_range); -- kfree(pool->db.buddy_manager); - return -ENOMEM; - } - } -@@ -278,14 +227,13 @@ static int hws_pool_buddy_db_init(struct mlx5hws_pool *pool, u32 log_range) - return 0; - } - --static int hws_pool_create_resource_on_index(struct mlx5hws_pool *pool, -- u32 alloc_size, int idx) -+static int hws_pool_create_resource(struct mlx5hws_pool *pool, u32 alloc_size) - { -- int ret = hws_pool_resource_alloc(pool, alloc_size, idx); -+ int ret = hws_pool_resource_alloc(pool, alloc_size); - - if (ret) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d index: %d\n", -- pool->type, alloc_size, idx); -+ mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -+ pool->type, alloc_size); - return ret; - } - -@@ -319,7 +267,7 @@ hws_pool_element_create_new_elem(struct mlx5hws_pool *pool, u32 order) - elem->log_size = alloc_size - order; - } - -- if (hws_pool_create_resource_on_index(pool, alloc_size, 0)) { -+ if (hws_pool_create_resource(pool, alloc_size)) { - mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", - pool->type, alloc_size); - goto free_db; -@@ -355,7 +303,7 @@ static int hws_pool_element_find_seg(struct mlx5hws_pool_elements *elem, int *se - - static int - hws_pool_onesize_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, -- u32 *idx, int *seg) -+ int *seg) - { - struct mlx5hws_pool_elements *elem; - -@@ -370,7 +318,6 @@ hws_pool_onesize_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, - return -ENOMEM; - } - -- *idx = 0; - elem->num_of_elements++; - return 0; - -@@ -379,21 +326,17 @@ hws_pool_onesize_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, - return -ENOMEM; - } - --static int --hws_pool_general_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, -- u32 *idx, int *seg) -+static int hws_pool_general_element_get_mem_chunk(struct mlx5hws_pool *pool, -+ u32 order, int *seg) - { -- int ret, i; -- -- for (i = 0; i < MLX5HWS_POOL_RESOURCE_ARR_SZ; i++) { -- if (!pool->resource[i]) { -- ret = hws_pool_create_resource_on_index(pool, order, i); -- if (ret) -- goto err_no_res; -- *idx = i; -- *seg = 0; /* One memory slot in that element */ -- return 0; -- } -+ int ret; -+ -+ if (!pool->resource) { -+ ret = hws_pool_create_resource(pool, order); -+ if (ret) -+ goto err_no_res; -+ *seg = 0; /* One memory slot in that element */ -+ return 0; - } - - mlx5hws_err(pool->ctx, "No more resources (last request order: %d)\n", order); -@@ -409,9 +352,7 @@ static int hws_pool_general_element_db_get_chunk(struct mlx5hws_pool *pool, - { - int ret; - -- /* Go over all memory elements and find/allocate free slot */ - ret = hws_pool_general_element_get_mem_chunk(pool, chunk->order, -- &chunk->resource_idx, - &chunk->offset); - if (ret) - mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -@@ -423,11 +364,8 @@ static int hws_pool_general_element_db_get_chunk(struct mlx5hws_pool *pool, - static void hws_pool_general_element_db_put_chunk(struct mlx5hws_pool *pool, - struct mlx5hws_pool_chunk *chunk) - { -- if (unlikely(!pool->resource[chunk->resource_idx])) -- pr_warn("HWS: invalid resource with index %d\n", chunk->resource_idx); -- - if (pool->flags & MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE) -- hws_pool_resource_free(pool, chunk->resource_idx); -+ hws_pool_resource_free(pool); - } - - static void hws_pool_general_element_db_uninit(struct mlx5hws_pool *pool) -@@ -455,7 +393,7 @@ static void - hws_onesize_element_db_destroy_element(struct mlx5hws_pool *pool, - struct mlx5hws_pool_elements *elem) - { -- hws_pool_resource_free(pool, 0); -+ hws_pool_resource_free(pool); - bitmap_free(elem->bitmap); - kfree(elem); - pool->db.element = NULL; -@@ -466,12 +404,9 @@ static void hws_onesize_element_db_put_chunk(struct mlx5hws_pool *pool, - { - struct mlx5hws_pool_elements *elem; - -- if (unlikely(chunk->resource_idx)) -- pr_warn("HWS: invalid resource with index %d\n", chunk->resource_idx); -- - elem = pool->db.element; - if (!elem) { -- mlx5hws_err(pool->ctx, "No such element (%d)\n", chunk->resource_idx); -+ mlx5hws_err(pool->ctx, "Pool element was not allocated\n"); - return; - } - -@@ -489,9 +424,7 @@ static int hws_onesize_element_db_get_chunk(struct mlx5hws_pool *pool, - { - int ret = 0; - -- /* Go over all memory elements and find/allocate free slot */ - ret = hws_pool_onesize_element_get_mem_chunk(pool, chunk->order, -- &chunk->resource_idx, - &chunk->offset); - if (ret) - mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -@@ -614,13 +547,10 @@ mlx5hws_pool_create(struct mlx5hws_context *ctx, struct mlx5hws_pool_attr *pool_ - - int mlx5hws_pool_destroy(struct mlx5hws_pool *pool) - { -- int i; -- - mutex_destroy(&pool->lock); - -- for (i = 0; i < MLX5HWS_POOL_RESOURCE_ARR_SZ; i++) -- if (pool->resource[i]) -- hws_pool_resource_free(pool, i); -+ if (pool->resource) -+ hws_pool_resource_free(pool); - - hws_pool_db_unint(pool); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -index f4258f83fdbf..112a61cd2997 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -@@ -6,16 +6,12 @@ - - #define MLX5HWS_POOL_STC_LOG_SZ 15 - --#define MLX5HWS_POOL_RESOURCE_ARR_SZ 100 -- - enum mlx5hws_pool_type { - MLX5HWS_POOL_TYPE_STE, - MLX5HWS_POOL_TYPE_STC, - }; - - struct mlx5hws_pool_chunk { -- u32 resource_idx; -- /* Internal offset, relative to base index */ - int offset; - int order; - }; -@@ -72,14 +68,10 @@ enum mlx5hws_db_type { - MLX5HWS_POOL_DB_TYPE_GENERAL_SIZE, - /* One resource only, all the elements are with same one size */ - MLX5HWS_POOL_DB_TYPE_ONE_SIZE_RESOURCE, -- /* Many resources, the memory allocated with buddy mechanism */ -+ /* Entries are managed using a buddy mechanism. */ - MLX5HWS_POOL_DB_TYPE_BUDDY, - }; - --struct mlx5hws_buddy_manager { -- struct mlx5hws_buddy_mem *buddies[MLX5HWS_POOL_RESOURCE_ARR_SZ]; --}; -- - struct mlx5hws_pool_elements { - u32 num_of_elements; - unsigned long *bitmap; -@@ -91,7 +83,7 @@ struct mlx5hws_pool_db { - enum mlx5hws_db_type type; - union { - struct mlx5hws_pool_elements *element; -- struct mlx5hws_buddy_manager *buddy_manager; -+ struct mlx5hws_buddy_mem *buddy; - }; - }; - -@@ -109,8 +101,8 @@ struct mlx5hws_pool { - size_t alloc_log_sz; - enum mlx5hws_table_type tbl_type; - enum mlx5hws_pool_optimize opt_type; -- struct mlx5hws_pool_resource *resource[MLX5HWS_POOL_RESOURCE_ARR_SZ]; -- struct mlx5hws_pool_resource *mirror_resource[MLX5HWS_POOL_RESOURCE_ARR_SZ]; -+ struct mlx5hws_pool_resource *resource; -+ struct mlx5hws_pool_resource *mirror_resource; - /* DB */ - struct mlx5hws_pool_db db; - /* Functions */ -@@ -131,17 +123,13 @@ int mlx5hws_pool_chunk_alloc(struct mlx5hws_pool *pool, - void mlx5hws_pool_chunk_free(struct mlx5hws_pool *pool, - struct mlx5hws_pool_chunk *chunk); - --static inline u32 --mlx5hws_pool_chunk_get_base_id(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static inline u32 mlx5hws_pool_get_base_id(struct mlx5hws_pool *pool) - { -- return pool->resource[chunk->resource_idx]->base_id; -+ return pool->resource->base_id; - } - --static inline u32 --mlx5hws_pool_chunk_get_base_mirror_id(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static inline u32 mlx5hws_pool_get_base_mirror_id(struct mlx5hws_pool *pool) - { -- return pool->mirror_resource[chunk->resource_idx]->base_id; -+ return pool->mirror_resource->base_id; - } - #endif /* MLX5HWS_POOL_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1349-net-mlx5-hws-refactor-pool-implementation.patch b/SOURCES/1349-net-mlx5-hws-refactor-pool-implementation.patch deleted file mode 100644 index 853be9ec6..000000000 --- a/SOURCES/1349-net-mlx5-hws-refactor-pool-implementation.patch +++ /dev/null @@ -1,760 +0,0 @@ -From ac067697d1ab53a4dceeec03736f9b8bf2363665 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:59 -0400 -Subject: [PATCH] net/mlx5: HWS, Refactor pool implementation - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d171ce3d988868bed9dc3c9eeb8428f87dd9ac85 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:34 2025 +0300 - - net/mlx5: HWS, Refactor pool implementation - - Refactor the pool implementation to remove unused flags and clarify its - usage. A pool represents a single range of STEs or STCs which are - allocated at pool creation time. - - Pools are used under three patterns: - - 1. STCs are allocated one at a time from a global pool using a bitmap - based implementation. - - 2. Action STEs are allocated in power-of-two blocks using a buddy - algorithm. - - 3. Match STEs do not use allocation, since insertion into these tables - is based on hashes or direct addressing. In such cases we use a pool - only to create the STE range. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 781ba8c4f733..39904b337b81 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1602,7 +1602,6 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - - pool_attr.table_type = MLX5HWS_TABLE_TYPE_FDB; - pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -- pool_attr.flags = MLX5HWS_POOL_FLAGS_FOR_STE_ACTION_POOL; - pool_attr.alloc_log_sz = 1; - table_ste->pool = mlx5hws_pool_create(ctx, &pool_attr); - if (!table_ste->pool) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -index 9cda2774fd64..b7cb736b74d7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -@@ -34,7 +34,6 @@ static int hws_context_pools_init(struct mlx5hws_context *ctx) - - /* Create an STC pool per FT type */ - pool_attr.pool_type = MLX5HWS_POOL_TYPE_STC; -- pool_attr.flags = MLX5HWS_POOL_FLAGS_FOR_STC_POOL; - max_log_sz = min(MLX5HWS_POOL_STC_LOG_SZ, ctx->caps->stc_alloc_log_max); - pool_attr.alloc_log_sz = max(max_log_sz, ctx->caps->stc_alloc_log_gran); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 59b14db427b4..95d31fd6c976 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -265,14 +265,6 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - rtc_attr.match_definer_0 = ctx->caps->linear_match_definer; - } - } -- -- /* Match pool requires implicit allocation */ -- ret = mlx5hws_pool_chunk_alloc(ste_pool, ste); -- if (ret) { -- mlx5hws_err(ctx, "Failed to allocate STE for %s RTC", -- hws_matcher_rtc_type_to_str(rtc_type)); -- return ret; -- } - break; - - case HWS_MATCHER_RTC_TYPE_STE_ARRAY: -@@ -357,23 +349,17 @@ static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher, - { - struct mlx5hws_matcher_action_ste *action_ste; - struct mlx5hws_table *tbl = matcher->tbl; -- struct mlx5hws_pool_chunk *ste; -- struct mlx5hws_pool *ste_pool; - u32 rtc_0_id, rtc_1_id; - - switch (rtc_type) { - case HWS_MATCHER_RTC_TYPE_MATCH: - rtc_0_id = matcher->match_ste.rtc_0_id; - rtc_1_id = matcher->match_ste.rtc_1_id; -- ste_pool = matcher->match_ste.pool; -- ste = &matcher->match_ste.ste; - break; - case HWS_MATCHER_RTC_TYPE_STE_ARRAY: - action_ste = &matcher->action_ste; - rtc_0_id = action_ste->rtc_0_id; - rtc_1_id = action_ste->rtc_1_id; -- ste_pool = action_ste->pool; -- ste = &action_ste->ste; - break; - default: - return; -@@ -383,8 +369,6 @@ static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher, - mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, rtc_1_id); - - mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, rtc_0_id); -- if (rtc_type == HWS_MATCHER_RTC_TYPE_MATCH) -- mlx5hws_pool_chunk_free(ste_pool, ste); - } - - static int -@@ -557,7 +541,7 @@ static int hws_matcher_bind_at(struct mlx5hws_matcher *matcher) - /* Allocate action STE mempool */ - pool_attr.table_type = tbl->type; - pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -- pool_attr.flags = MLX5HWS_POOL_FLAGS_FOR_STE_ACTION_POOL; -+ pool_attr.flags = MLX5HWS_POOL_FLAG_BUDDY; - /* Pool size is similar to action RTC size */ - pool_attr.alloc_log_sz = ilog2(roundup_pow_of_two(action_ste->max_stes)) + - matcher->attr.table.sz_row_log + -@@ -636,7 +620,6 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - /* Create an STE pool per matcher*/ - pool_attr.table_type = matcher->tbl->type; - pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -- pool_attr.flags = MLX5HWS_POOL_FLAGS_FOR_MATCHER_STE_POOL; - pool_attr.alloc_log_sz = matcher->attr.table.sz_col_log + - matcher->attr.table.sz_row_log; - hws_matcher_set_pool_attr(&pool_attr, matcher); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 0de03e17624c..270b333faab3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -60,10 +60,8 @@ hws_pool_create_one_resource(struct mlx5hws_pool *pool, u32 log_range, - ret = -EINVAL; - } - -- if (ret) { -- mlx5hws_err(pool->ctx, "Failed to allocate resource objects\n"); -+ if (ret) - goto free_resource; -- } - - resource->pool = pool; - resource->range = 1 << log_range; -@@ -76,17 +74,17 @@ hws_pool_create_one_resource(struct mlx5hws_pool *pool, u32 log_range, - return NULL; - } - --static int --hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range) -+static int hws_pool_resource_alloc(struct mlx5hws_pool *pool) - { - struct mlx5hws_pool_resource *resource; - u32 fw_ft_type, opt_log_range; - - fw_ft_type = mlx5hws_table_get_res_fw_ft_type(pool->tbl_type, false); -- opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_ORIG ? 0 : log_range; -+ opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_ORIG ? -+ 0 : pool->alloc_log_sz; - resource = hws_pool_create_one_resource(pool, opt_log_range, fw_ft_type); - if (!resource) { -- mlx5hws_err(pool->ctx, "Failed allocating resource\n"); -+ mlx5hws_err(pool->ctx, "Failed to allocate resource\n"); - return -EINVAL; - } - -@@ -96,10 +94,11 @@ hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range) - struct mlx5hws_pool_resource *mirror_resource; - - fw_ft_type = mlx5hws_table_get_res_fw_ft_type(pool->tbl_type, true); -- opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_MIRROR ? 0 : log_range; -+ opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_MIRROR ? -+ 0 : pool->alloc_log_sz; - mirror_resource = hws_pool_create_one_resource(pool, opt_log_range, fw_ft_type); - if (!mirror_resource) { -- mlx5hws_err(pool->ctx, "Failed allocating mirrored resource\n"); -+ mlx5hws_err(pool->ctx, "Failed to allocate mirrored resource\n"); - hws_pool_free_one_resource(resource); - pool->resource = NULL; - return -EINVAL; -@@ -110,92 +109,58 @@ hws_pool_resource_alloc(struct mlx5hws_pool *pool, u32 log_range) - return 0; - } - --static unsigned long *hws_pool_create_and_init_bitmap(u32 log_range) --{ -- unsigned long *cur_bmp; -- -- cur_bmp = bitmap_zalloc(1 << log_range, GFP_KERNEL); -- if (!cur_bmp) -- return NULL; -- -- bitmap_fill(cur_bmp, 1 << log_range); -- -- return cur_bmp; --} -- --static void hws_pool_buddy_db_put_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static int hws_pool_buddy_init(struct mlx5hws_pool *pool) - { - struct mlx5hws_buddy_mem *buddy; - -- buddy = pool->db.buddy; -+ buddy = mlx5hws_buddy_create(pool->alloc_log_sz); - if (!buddy) { -- mlx5hws_err(pool->ctx, "Bad buddy state\n"); -- return; -- } -- -- mlx5hws_buddy_free_mem(buddy, chunk->offset, chunk->order); --} -- --static struct mlx5hws_buddy_mem * --hws_pool_buddy_get_buddy(struct mlx5hws_pool *pool, u32 order) --{ -- static struct mlx5hws_buddy_mem *buddy; -- u32 new_buddy_size; -- -- buddy = pool->db.buddy; -- if (buddy) -- return buddy; -- -- new_buddy_size = max(pool->alloc_log_sz, order); -- buddy = mlx5hws_buddy_create(new_buddy_size); -- if (!buddy) { -- mlx5hws_err(pool->ctx, "Failed to create buddy order: %d\n", -- new_buddy_size); -- return NULL; -+ mlx5hws_err(pool->ctx, "Failed to create buddy order: %zu\n", -+ pool->alloc_log_sz); -+ return -ENOMEM; - } - -- if (hws_pool_resource_alloc(pool, new_buddy_size) != 0) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -- pool->type, new_buddy_size); -+ if (hws_pool_resource_alloc(pool) != 0) { -+ mlx5hws_err(pool->ctx, "Failed to create resource type: %d size %zu\n", -+ pool->type, pool->alloc_log_sz); - mlx5hws_buddy_cleanup(buddy); -- return NULL; -+ return -ENOMEM; - } - - pool->db.buddy = buddy; - -- return buddy; -+ return 0; - } - --static int hws_pool_buddy_get_mem_chunk(struct mlx5hws_pool *pool, -- int order, -- int *seg) -+static int hws_pool_buddy_db_get_chunk(struct mlx5hws_pool *pool, -+ struct mlx5hws_pool_chunk *chunk) - { -- struct mlx5hws_buddy_mem *buddy; -+ struct mlx5hws_buddy_mem *buddy = pool->db.buddy; - -- buddy = hws_pool_buddy_get_buddy(pool, order); -- if (!buddy) -- return -ENOMEM; -+ if (!buddy) { -+ mlx5hws_err(pool->ctx, "Bad buddy state\n"); -+ return -EINVAL; -+ } - -- *seg = mlx5hws_buddy_alloc_mem(buddy, order); -- if (*seg >= 0) -+ chunk->offset = mlx5hws_buddy_alloc_mem(buddy, chunk->order); -+ if (chunk->offset >= 0) - return 0; - - return -ENOMEM; - } - --static int hws_pool_buddy_db_get_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static void hws_pool_buddy_db_put_chunk(struct mlx5hws_pool *pool, -+ struct mlx5hws_pool_chunk *chunk) - { -- int ret = 0; -+ struct mlx5hws_buddy_mem *buddy; - -- ret = hws_pool_buddy_get_mem_chunk(pool, chunk->order, -- &chunk->offset); -- if (ret) -- mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -- chunk->order); -+ buddy = pool->db.buddy; -+ if (!buddy) { -+ mlx5hws_err(pool->ctx, "Bad buddy state\n"); -+ return; -+ } - -- return ret; -+ mlx5hws_buddy_free_mem(buddy, chunk->offset, chunk->order); - } - - static void hws_pool_buddy_db_uninit(struct mlx5hws_pool *pool) -@@ -210,15 +175,13 @@ static void hws_pool_buddy_db_uninit(struct mlx5hws_pool *pool) - } - } - --static int hws_pool_buddy_db_init(struct mlx5hws_pool *pool, u32 log_range) -+static int hws_pool_buddy_db_init(struct mlx5hws_pool *pool) - { -- if (pool->flags & MLX5HWS_POOL_FLAGS_ALLOC_MEM_ON_CREATE) { -- if (!hws_pool_buddy_get_buddy(pool, log_range)) { -- mlx5hws_err(pool->ctx, -- "Failed allocating memory on create log_sz: %d\n", log_range); -- return -ENOMEM; -- } -- } -+ int ret; -+ -+ ret = hws_pool_buddy_init(pool); -+ if (ret) -+ return ret; - - pool->p_db_uninit = &hws_pool_buddy_db_uninit; - pool->p_get_chunk = &hws_pool_buddy_db_get_chunk; -@@ -227,234 +190,105 @@ static int hws_pool_buddy_db_init(struct mlx5hws_pool *pool, u32 log_range) - return 0; - } - --static int hws_pool_create_resource(struct mlx5hws_pool *pool, u32 alloc_size) --{ -- int ret = hws_pool_resource_alloc(pool, alloc_size); -- -- if (ret) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -- pool->type, alloc_size); -- return ret; -- } -- -- return 0; --} -- --static struct mlx5hws_pool_elements * --hws_pool_element_create_new_elem(struct mlx5hws_pool *pool, u32 order) -+static unsigned long *hws_pool_create_and_init_bitmap(u32 log_range) - { -- struct mlx5hws_pool_elements *elem; -- u32 alloc_size; -- -- alloc_size = pool->alloc_log_sz; -+ unsigned long *bitmap; - -- elem = kzalloc(sizeof(*elem), GFP_KERNEL); -- if (!elem) -+ bitmap = bitmap_zalloc(1 << log_range, GFP_KERNEL); -+ if (!bitmap) - return NULL; - -- /* Sharing the same resource, also means that all the elements are with size 1 */ -- if ((pool->flags & MLX5HWS_POOL_FLAGS_FIXED_SIZE_OBJECTS) && -- !(pool->flags & MLX5HWS_POOL_FLAGS_RESOURCE_PER_CHUNK)) { -- /* Currently all chunks in size 1 */ -- elem->bitmap = hws_pool_create_and_init_bitmap(alloc_size - order); -- if (!elem->bitmap) { -- mlx5hws_err(pool->ctx, -- "Failed to create bitmap type: %d: size %d\n", -- pool->type, alloc_size); -- goto free_elem; -- } -- -- elem->log_size = alloc_size - order; -- } -- -- if (hws_pool_create_resource(pool, alloc_size)) { -- mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %d\n", -- pool->type, alloc_size); -- goto free_db; -- } -- -- pool->db.element = elem; -+ bitmap_fill(bitmap, 1 << log_range); - -- return elem; -- --free_db: -- bitmap_free(elem->bitmap); --free_elem: -- kfree(elem); -- return NULL; -+ return bitmap; - } - --static int hws_pool_element_find_seg(struct mlx5hws_pool_elements *elem, int *seg) -+static int hws_pool_bitmap_init(struct mlx5hws_pool *pool) - { -- unsigned int segment, size; -+ unsigned long *bitmap; - -- size = 1 << elem->log_size; -- -- segment = find_first_bit(elem->bitmap, size); -- if (segment >= size) { -- elem->is_full = true; -+ bitmap = hws_pool_create_and_init_bitmap(pool->alloc_log_sz); -+ if (!bitmap) { -+ mlx5hws_err(pool->ctx, "Failed to create bitmap order: %zu\n", -+ pool->alloc_log_sz); - return -ENOMEM; - } - -- bitmap_clear(elem->bitmap, segment, 1); -- *seg = segment; -- return 0; --} -- --static int --hws_pool_onesize_element_get_mem_chunk(struct mlx5hws_pool *pool, u32 order, -- int *seg) --{ -- struct mlx5hws_pool_elements *elem; -- -- elem = pool->db.element; -- if (!elem) -- elem = hws_pool_element_create_new_elem(pool, order); -- if (!elem) -- goto err_no_elem; -- -- if (hws_pool_element_find_seg(elem, seg) != 0) { -- mlx5hws_err(pool->ctx, "No more resources (last request order: %d)\n", order); -+ if (hws_pool_resource_alloc(pool) != 0) { -+ mlx5hws_err(pool->ctx, "Failed to create resource type: %d: size %zu\n", -+ pool->type, pool->alloc_log_sz); -+ bitmap_free(bitmap); - return -ENOMEM; - } - -- elem->num_of_elements++; -- return 0; -+ pool->db.bitmap = bitmap; - --err_no_elem: -- mlx5hws_err(pool->ctx, "Failed to allocate element for order: %d\n", order); -- return -ENOMEM; -+ return 0; - } - --static int hws_pool_general_element_get_mem_chunk(struct mlx5hws_pool *pool, -- u32 order, int *seg) -+static int hws_pool_bitmap_db_get_chunk(struct mlx5hws_pool *pool, -+ struct mlx5hws_pool_chunk *chunk) - { -- int ret; -+ unsigned long *bitmap, size; - -- if (!pool->resource) { -- ret = hws_pool_create_resource(pool, order); -- if (ret) -- goto err_no_res; -- *seg = 0; /* One memory slot in that element */ -- return 0; -+ if (chunk->order != 0) { -+ mlx5hws_err(pool->ctx, "Pool only supports order 0 allocs\n"); -+ return -EINVAL; - } - -- mlx5hws_err(pool->ctx, "No more resources (last request order: %d)\n", order); -- return -ENOMEM; -- --err_no_res: -- mlx5hws_err(pool->ctx, "Failed to allocate element for order: %d\n", order); -- return -ENOMEM; --} -- --static int hws_pool_general_element_db_get_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) --{ -- int ret; -- -- ret = hws_pool_general_element_get_mem_chunk(pool, chunk->order, -- &chunk->offset); -- if (ret) -- mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -- chunk->order); -- -- return ret; --} -+ bitmap = pool->db.bitmap; -+ if (!bitmap) { -+ mlx5hws_err(pool->ctx, "Bad bitmap state\n"); -+ return -EINVAL; -+ } - --static void hws_pool_general_element_db_put_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) --{ -- if (pool->flags & MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE) -- hws_pool_resource_free(pool); --} -+ size = 1 << pool->alloc_log_sz; - --static void hws_pool_general_element_db_uninit(struct mlx5hws_pool *pool) --{ -- (void)pool; --} -+ chunk->offset = find_first_bit(bitmap, size); -+ if (chunk->offset >= size) -+ return -ENOMEM; - --/* This memory management works as the following: -- * - At start doesn't allocate no mem at all. -- * - When new request for chunk arrived: -- * allocate resource and give it. -- * - When free that chunk: -- * the resource is freed. -- */ --static int hws_pool_general_element_db_init(struct mlx5hws_pool *pool) --{ -- pool->p_db_uninit = &hws_pool_general_element_db_uninit; -- pool->p_get_chunk = &hws_pool_general_element_db_get_chunk; -- pool->p_put_chunk = &hws_pool_general_element_db_put_chunk; -+ bitmap_clear(bitmap, chunk->offset, 1); - - return 0; - } - --static void --hws_onesize_element_db_destroy_element(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_elements *elem) --{ -- hws_pool_resource_free(pool); -- bitmap_free(elem->bitmap); -- kfree(elem); -- pool->db.element = NULL; --} -- --static void hws_onesize_element_db_put_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static void hws_pool_bitmap_db_put_chunk(struct mlx5hws_pool *pool, -+ struct mlx5hws_pool_chunk *chunk) - { -- struct mlx5hws_pool_elements *elem; -+ unsigned long *bitmap; - -- elem = pool->db.element; -- if (!elem) { -- mlx5hws_err(pool->ctx, "Pool element was not allocated\n"); -+ bitmap = pool->db.bitmap; -+ if (!bitmap) { -+ mlx5hws_err(pool->ctx, "Bad bitmap state\n"); - return; - } - -- bitmap_set(elem->bitmap, chunk->offset, 1); -- elem->is_full = false; -- elem->num_of_elements--; -- -- if (pool->flags & MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE && -- !elem->num_of_elements) -- hws_onesize_element_db_destroy_element(pool, elem); -+ bitmap_set(bitmap, chunk->offset, 1); - } - --static int hws_onesize_element_db_get_chunk(struct mlx5hws_pool *pool, -- struct mlx5hws_pool_chunk *chunk) -+static void hws_pool_bitmap_db_uninit(struct mlx5hws_pool *pool) - { -- int ret = 0; -- -- ret = hws_pool_onesize_element_get_mem_chunk(pool, chunk->order, -- &chunk->offset); -- if (ret) -- mlx5hws_err(pool->ctx, "Failed to get free slot for chunk with order: %d\n", -- chunk->order); -+ unsigned long *bitmap; - -- return ret; -+ bitmap = pool->db.bitmap; -+ if (bitmap) { -+ bitmap_free(bitmap); -+ pool->db.bitmap = NULL; -+ } - } - --static void hws_onesize_element_db_uninit(struct mlx5hws_pool *pool) -+static int hws_pool_bitmap_db_init(struct mlx5hws_pool *pool) - { -- struct mlx5hws_pool_elements *elem = pool->db.element; -+ int ret; - -- if (elem) { -- bitmap_free(elem->bitmap); -- kfree(elem); -- pool->db.element = NULL; -- } --} -+ ret = hws_pool_bitmap_init(pool); -+ if (ret) -+ return ret; - --/* This memory management works as the following: -- * - At start doesn't allocate no mem at all. -- * - When new request for chunk arrived: -- * aloocate the first and only slot of memory/resource -- * when it ended return error. -- */ --static int hws_pool_onesize_element_db_init(struct mlx5hws_pool *pool) --{ -- pool->p_db_uninit = &hws_onesize_element_db_uninit; -- pool->p_get_chunk = &hws_onesize_element_db_get_chunk; -- pool->p_put_chunk = &hws_onesize_element_db_put_chunk; -+ pool->p_db_uninit = &hws_pool_bitmap_db_uninit; -+ pool->p_get_chunk = &hws_pool_bitmap_db_get_chunk; -+ pool->p_put_chunk = &hws_pool_bitmap_db_put_chunk; - - return 0; - } -@@ -464,15 +298,14 @@ static int hws_pool_db_init(struct mlx5hws_pool *pool, - { - int ret; - -- if (db_type == MLX5HWS_POOL_DB_TYPE_GENERAL_SIZE) -- ret = hws_pool_general_element_db_init(pool); -- else if (db_type == MLX5HWS_POOL_DB_TYPE_ONE_SIZE_RESOURCE) -- ret = hws_pool_onesize_element_db_init(pool); -+ if (db_type == MLX5HWS_POOL_DB_TYPE_BITMAP) -+ ret = hws_pool_bitmap_db_init(pool); - else -- ret = hws_pool_buddy_db_init(pool, pool->alloc_log_sz); -+ ret = hws_pool_buddy_db_init(pool); - - if (ret) { -- mlx5hws_err(pool->ctx, "Failed to init general db : %d (ret: %d)\n", db_type, ret); -+ mlx5hws_err(pool->ctx, "Failed to init pool type: %d (ret: %d)\n", -+ db_type, ret); - return ret; - } - -@@ -521,15 +354,10 @@ mlx5hws_pool_create(struct mlx5hws_context *ctx, struct mlx5hws_pool_attr *pool_ - pool->tbl_type = pool_attr->table_type; - pool->opt_type = pool_attr->opt_type; - -- /* Support general db */ -- if (pool->flags == (MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE | -- MLX5HWS_POOL_FLAGS_RESOURCE_PER_CHUNK)) -- res_db_type = MLX5HWS_POOL_DB_TYPE_GENERAL_SIZE; -- else if (pool->flags == (MLX5HWS_POOL_FLAGS_ONE_RESOURCE | -- MLX5HWS_POOL_FLAGS_FIXED_SIZE_OBJECTS)) -- res_db_type = MLX5HWS_POOL_DB_TYPE_ONE_SIZE_RESOURCE; -- else -+ if (pool->flags & MLX5HWS_POOL_FLAG_BUDDY) - res_db_type = MLX5HWS_POOL_DB_TYPE_BUDDY; -+ else -+ res_db_type = MLX5HWS_POOL_DB_TYPE_BITMAP; - - pool->alloc_log_sz = pool_attr->alloc_log_sz; - -@@ -545,7 +373,7 @@ mlx5hws_pool_create(struct mlx5hws_context *ctx, struct mlx5hws_pool_attr *pool_ - return NULL; - } - --int mlx5hws_pool_destroy(struct mlx5hws_pool *pool) -+void mlx5hws_pool_destroy(struct mlx5hws_pool *pool) - { - mutex_destroy(&pool->lock); - -@@ -555,5 +383,4 @@ int mlx5hws_pool_destroy(struct mlx5hws_pool *pool) - hws_pool_db_unint(pool); - - kfree(pool); -- return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -index 112a61cd2997..9a781a87f097 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -@@ -23,29 +23,10 @@ struct mlx5hws_pool_resource { - }; - - enum mlx5hws_pool_flags { -- /* Only a one resource in that pool */ -- MLX5HWS_POOL_FLAGS_ONE_RESOURCE = 1 << 0, -- MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE = 1 << 1, -- /* No sharing resources between chunks */ -- MLX5HWS_POOL_FLAGS_RESOURCE_PER_CHUNK = 1 << 2, -- /* All objects are in the same size */ -- MLX5HWS_POOL_FLAGS_FIXED_SIZE_OBJECTS = 1 << 3, -- /* Managed by buddy allocator */ -- MLX5HWS_POOL_FLAGS_BUDDY_MANAGED = 1 << 4, -- /* Allocate pool_type memory on pool creation */ -- MLX5HWS_POOL_FLAGS_ALLOC_MEM_ON_CREATE = 1 << 5, -- -- /* These values should be used by the caller */ -- MLX5HWS_POOL_FLAGS_FOR_STC_POOL = -- MLX5HWS_POOL_FLAGS_ONE_RESOURCE | -- MLX5HWS_POOL_FLAGS_FIXED_SIZE_OBJECTS, -- MLX5HWS_POOL_FLAGS_FOR_MATCHER_STE_POOL = -- MLX5HWS_POOL_FLAGS_RELEASE_FREE_RESOURCE | -- MLX5HWS_POOL_FLAGS_RESOURCE_PER_CHUNK, -- MLX5HWS_POOL_FLAGS_FOR_STE_ACTION_POOL = -- MLX5HWS_POOL_FLAGS_ONE_RESOURCE | -- MLX5HWS_POOL_FLAGS_BUDDY_MANAGED | -- MLX5HWS_POOL_FLAGS_ALLOC_MEM_ON_CREATE, -+ /* Managed by a buddy allocator. If this is not set only allocations of -+ * order 0 are supported. -+ */ -+ MLX5HWS_POOL_FLAG_BUDDY = BIT(0), - }; - - enum mlx5hws_pool_optimize { -@@ -64,25 +45,16 @@ struct mlx5hws_pool_attr { - }; - - enum mlx5hws_db_type { -- /* Uses for allocating chunk of big memory, each element has its own resource in the FW*/ -- MLX5HWS_POOL_DB_TYPE_GENERAL_SIZE, -- /* One resource only, all the elements are with same one size */ -- MLX5HWS_POOL_DB_TYPE_ONE_SIZE_RESOURCE, -+ /* Uses a bitmap, supports only allocations of order 0. */ -+ MLX5HWS_POOL_DB_TYPE_BITMAP, - /* Entries are managed using a buddy mechanism. */ - MLX5HWS_POOL_DB_TYPE_BUDDY, - }; - --struct mlx5hws_pool_elements { -- u32 num_of_elements; -- unsigned long *bitmap; -- u32 log_size; -- bool is_full; --}; -- - struct mlx5hws_pool_db { - enum mlx5hws_db_type type; - union { -- struct mlx5hws_pool_elements *element; -+ unsigned long *bitmap; - struct mlx5hws_buddy_mem *buddy; - }; - }; -@@ -103,7 +75,6 @@ struct mlx5hws_pool { - enum mlx5hws_pool_optimize opt_type; - struct mlx5hws_pool_resource *resource; - struct mlx5hws_pool_resource *mirror_resource; -- /* DB */ - struct mlx5hws_pool_db db; - /* Functions */ - mlx5hws_pool_unint_db p_db_uninit; -@@ -115,7 +86,7 @@ struct mlx5hws_pool * - mlx5hws_pool_create(struct mlx5hws_context *ctx, - struct mlx5hws_pool_attr *pool_attr); - --int mlx5hws_pool_destroy(struct mlx5hws_pool *pool); -+void mlx5hws_pool_destroy(struct mlx5hws_pool *pool); - - int mlx5hws_pool_chunk_alloc(struct mlx5hws_pool *pool, - struct mlx5hws_pool_chunk *chunk); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1350-net-mlx5-hws-cleanup-after-pool-refactoring.patch b/SOURCES/1350-net-mlx5-hws-cleanup-after-pool-refactoring.patch deleted file mode 100644 index acaf23e50..000000000 --- a/SOURCES/1350-net-mlx5-hws-cleanup-after-pool-refactoring.patch +++ /dev/null @@ -1,265 +0,0 @@ -From 333144760a660c248b241cf555a88ed2447c29b1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:59 -0400 -Subject: [PATCH] net/mlx5: HWS, Cleanup after pool refactoring - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 43a2038c6d8a810e8e70f0e7fcb965f431c92bfb -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:35 2025 +0300 - - net/mlx5: HWS, Cleanup after pool refactoring - - Remove members which are now no longer used. In fact, many of the - `struct mlx5hws_pool_chunk` were not even written to beyond being - initialized, but they were used in various internals. - - Also cleanup some local variables which made more sense when the API was - thicker. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 39904b337b81..161ad720b339 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1583,7 +1583,6 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - struct mlx5hws_matcher_action_ste *table_ste; - struct mlx5hws_pool_attr pool_attr = {0}; - struct mlx5hws_pool *ste_pool, *stc_pool; -- struct mlx5hws_pool_chunk *ste; - u32 *rtc_0_id, *rtc_1_id; - u32 obj_id; - int ret; -@@ -1613,8 +1612,6 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - rtc_0_id = &table_ste->rtc_0_id; - rtc_1_id = &table_ste->rtc_1_id; - ste_pool = table_ste->pool; -- ste = &table_ste->ste; -- ste->order = 1; - - rtc_attr.log_size = 0; - rtc_attr.log_depth = 0; -@@ -1630,7 +1627,6 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - - rtc_attr.pd = ctx->pd_num; - rtc_attr.ste_base = obj_id; -- rtc_attr.ste_offset = ste->offset; - rtc_attr.reparse_mode = mlx5hws_context_get_reparse_mode(ctx); - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(MLX5HWS_TABLE_TYPE_FDB, false); - -@@ -1833,7 +1829,6 @@ mlx5hws_action_create_dest_match_range(struct mlx5hws_context *ctx, - stc_attr.action_offset = MLX5HWS_ACTION_OFFSET_HIT; - stc_attr.action_type = MLX5_IFC_STC_ACTION_TYPE_JUMP_TO_STE_TABLE; - stc_attr.reparse_mode = MLX5_IFC_STC_REPARSE_IGNORE; -- stc_attr.ste_table.ste = table_ste->ste; - stc_attr.ste_table.ste_pool = table_ste->pool; - stc_attr.ste_table.match_definer_id = ctx->caps->trivial_match_definer; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -index e8f98c109b99..9c83753e4592 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -@@ -406,7 +406,6 @@ int mlx5hws_cmd_rtc_create(struct mlx5_core_dev *mdev, - MLX5_SET(rtc, attr, match_definer_1, rtc_attr->match_definer_1); - MLX5_SET(rtc, attr, stc_id, rtc_attr->stc_base); - MLX5_SET(rtc, attr, ste_table_base_id, rtc_attr->ste_base); -- MLX5_SET(rtc, attr, ste_table_offset, rtc_attr->ste_offset); - MLX5_SET(rtc, attr, miss_flow_table_id, rtc_attr->miss_ft_id); - MLX5_SET(rtc, attr, reparse_mode, rtc_attr->reparse_mode); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -index 51d9e0291ac1..fa6bff210266 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -@@ -70,7 +70,6 @@ struct mlx5hws_cmd_rtc_create_attr { - u32 pd; - u32 stc_base; - u32 ste_base; -- u32 ste_offset; - u32 miss_ft_id; - bool fw_gen_wqe; - u8 update_index_mode; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 95d31fd6c976..3028e0387e3f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -197,22 +197,15 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher) - - static void hws_matcher_set_rtc_attr_sz(struct mlx5hws_matcher *matcher, - struct mlx5hws_cmd_rtc_create_attr *rtc_attr, -- enum mlx5hws_matcher_rtc_type rtc_type, - bool is_mirror) - { -- struct mlx5hws_pool_chunk *ste = &matcher->action_ste.ste; - enum mlx5hws_matcher_flow_src flow_src = matcher->attr.optimize_flow_src; -- bool is_match_rtc = rtc_type == HWS_MATCHER_RTC_TYPE_MATCH; - - if ((flow_src == MLX5HWS_MATCHER_FLOW_SRC_VPORT && !is_mirror) || - (flow_src == MLX5HWS_MATCHER_FLOW_SRC_WIRE && is_mirror)) { - /* Optimize FDB RTC */ - rtc_attr->log_size = 0; - rtc_attr->log_depth = 0; -- } else { -- /* Keep original values */ -- rtc_attr->log_size = is_match_rtc ? matcher->attr.table.sz_row_log : ste->order; -- rtc_attr->log_depth = is_match_rtc ? matcher->attr.table.sz_col_log : 0; - } - } - -@@ -225,8 +218,7 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - struct mlx5hws_context *ctx = matcher->tbl->ctx; - struct mlx5hws_matcher_action_ste *action_ste; - struct mlx5hws_table *tbl = matcher->tbl; -- struct mlx5hws_pool *ste_pool, *stc_pool; -- struct mlx5hws_pool_chunk *ste; -+ struct mlx5hws_pool *ste_pool; - u32 *rtc_0_id, *rtc_1_id; - u32 obj_id; - int ret; -@@ -236,8 +228,6 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - rtc_0_id = &matcher->match_ste.rtc_0_id; - rtc_1_id = &matcher->match_ste.rtc_1_id; - ste_pool = matcher->match_ste.pool; -- ste = &matcher->match_ste.ste; -- ste->order = attr->table.sz_col_log + attr->table.sz_row_log; - - rtc_attr.log_size = attr->table.sz_row_log; - rtc_attr.log_depth = attr->table.sz_col_log; -@@ -273,16 +263,15 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - rtc_0_id = &action_ste->rtc_0_id; - rtc_1_id = &action_ste->rtc_1_id; - ste_pool = action_ste->pool; -- ste = &action_ste->ste; - /* Action RTC size calculation: - * log((max number of rules in matcher) * - * (max number of action STEs per rule) * - * (2 to support writing new STEs for update rule)) - */ -- ste->order = ilog2(roundup_pow_of_two(action_ste->max_stes)) + -- attr->table.sz_row_log + -- MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT; -- rtc_attr.log_size = ste->order; -+ rtc_attr.log_size = -+ ilog2(roundup_pow_of_two(action_ste->max_stes)) + -+ attr->table.sz_row_log + -+ MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT; - rtc_attr.log_depth = 0; - rtc_attr.update_index_mode = MLX5_IFC_RTC_STE_UPDATE_MODE_BY_OFFSET; - /* The action STEs use the default always hit definer */ -@@ -300,21 +289,19 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - - rtc_attr.pd = ctx->pd_num; - rtc_attr.ste_base = obj_id; -- rtc_attr.ste_offset = ste->offset; - rtc_attr.reparse_mode = mlx5hws_context_get_reparse_mode(ctx); - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, false); -- hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, rtc_type, false); -+ hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, false); - - /* STC is a single resource (obj_id), use any STC for the ID */ -- stc_pool = ctx->stc_pool; -- obj_id = mlx5hws_pool_get_base_id(stc_pool); -+ obj_id = mlx5hws_pool_get_base_id(ctx->stc_pool); - rtc_attr.stc_base = obj_id; - - ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_0_id); - if (ret) { - mlx5hws_err(ctx, "Failed to create matcher RTC of type %s", - hws_matcher_rtc_type_to_str(rtc_type)); -- goto free_ste; -+ return ret; - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -@@ -322,9 +309,9 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - rtc_attr.ste_base = obj_id; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, true); - -- obj_id = mlx5hws_pool_get_base_mirror_id(stc_pool); -+ obj_id = mlx5hws_pool_get_base_mirror_id(ctx->stc_pool); - rtc_attr.stc_base = obj_id; -- hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, rtc_type, true); -+ hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, true); - - ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_1_id); - if (ret) { -@@ -338,16 +325,12 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - - destroy_rtc_0: - mlx5hws_cmd_rtc_destroy(ctx->mdev, *rtc_0_id); --free_ste: -- if (rtc_type == HWS_MATCHER_RTC_TYPE_MATCH) -- mlx5hws_pool_chunk_free(ste_pool, ste); - return ret; - } - - static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher, - enum mlx5hws_matcher_rtc_type rtc_type) - { -- struct mlx5hws_matcher_action_ste *action_ste; - struct mlx5hws_table *tbl = matcher->tbl; - u32 rtc_0_id, rtc_1_id; - -@@ -357,18 +340,17 @@ static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher, - rtc_1_id = matcher->match_ste.rtc_1_id; - break; - case HWS_MATCHER_RTC_TYPE_STE_ARRAY: -- action_ste = &matcher->action_ste; -- rtc_0_id = action_ste->rtc_0_id; -- rtc_1_id = action_ste->rtc_1_id; -+ rtc_0_id = matcher->action_ste.rtc_0_id; -+ rtc_1_id = matcher->action_ste.rtc_1_id; - break; - default: - return; - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) -- mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, rtc_1_id); -+ mlx5hws_cmd_rtc_destroy(tbl->ctx->mdev, rtc_1_id); - -- mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, rtc_0_id); -+ mlx5hws_cmd_rtc_destroy(tbl->ctx->mdev, rtc_0_id); - } - - static int -@@ -564,7 +546,6 @@ static int hws_matcher_bind_at(struct mlx5hws_matcher *matcher) - stc_attr.action_offset = MLX5HWS_ACTION_OFFSET_HIT; - stc_attr.action_type = MLX5_IFC_STC_ACTION_TYPE_JUMP_TO_STE_TABLE; - stc_attr.reparse_mode = MLX5_IFC_STC_REPARSE_IGNORE; -- stc_attr.ste_table.ste = action_ste->ste; - stc_attr.ste_table.ste_pool = action_ste->pool; - stc_attr.ste_table.match_definer_id = ctx->caps->trivial_match_definer; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index 20b32012c418..0450b6175ac9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -45,14 +45,12 @@ struct mlx5hws_match_template { - }; - - struct mlx5hws_matcher_match_ste { -- struct mlx5hws_pool_chunk ste; - u32 rtc_0_id; - u32 rtc_1_id; - struct mlx5hws_pool *pool; - }; - - struct mlx5hws_matcher_action_ste { -- struct mlx5hws_pool_chunk ste; - struct mlx5hws_pool_chunk stc; - u32 rtc_0_id; - u32 rtc_1_id; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1351-net-mlx5-hws-add-fullness-tracking-to-pool.patch b/SOURCES/1351-net-mlx5-hws-add-fullness-tracking-to-pool.patch deleted file mode 100644 index 60dc621c0..000000000 --- a/SOURCES/1351-net-mlx5-hws-add-fullness-tracking-to-pool.patch +++ /dev/null @@ -1,108 +0,0 @@ -From 2cd06eab502130ff9491b0f14378269d658826c8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:59 -0400 -Subject: [PATCH] net/mlx5: HWS, Add fullness tracking to pool - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 04562694766514f00e7086d3d4884db5f3a22d4e -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:36 2025 +0300 - - net/mlx5: HWS, Add fullness tracking to pool - - Future users will need to query whether a pool is empty. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 270b333faab3..26d85fe3c417 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -324,6 +324,8 @@ int mlx5hws_pool_chunk_alloc(struct mlx5hws_pool *pool, - - mutex_lock(&pool->lock); - ret = pool->p_get_chunk(pool, chunk); -+ if (ret == 0) -+ pool->available_elems -= 1 << chunk->order; - mutex_unlock(&pool->lock); - - return ret; -@@ -334,6 +336,7 @@ void mlx5hws_pool_chunk_free(struct mlx5hws_pool *pool, - { - mutex_lock(&pool->lock); - pool->p_put_chunk(pool, chunk); -+ pool->available_elems += 1 << chunk->order; - mutex_unlock(&pool->lock); - } - -@@ -360,6 +363,7 @@ mlx5hws_pool_create(struct mlx5hws_context *ctx, struct mlx5hws_pool_attr *pool_ - res_db_type = MLX5HWS_POOL_DB_TYPE_BITMAP; - - pool->alloc_log_sz = pool_attr->alloc_log_sz; -+ pool->available_elems = 1 << pool_attr->alloc_log_sz; - - if (hws_pool_db_init(pool, res_db_type)) - goto free_pool; -@@ -377,6 +381,9 @@ void mlx5hws_pool_destroy(struct mlx5hws_pool *pool) - { - mutex_destroy(&pool->lock); - -+ if (pool->available_elems != 1 << pool->alloc_log_sz) -+ mlx5hws_err(pool->ctx, "Attempting to destroy non-empty pool\n"); -+ - if (pool->resource) - hws_pool_resource_free(pool); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -index 9a781a87f097..c82760d53e1a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -@@ -71,6 +71,7 @@ struct mlx5hws_pool { - enum mlx5hws_pool_flags flags; - struct mutex lock; /* protect the pool */ - size_t alloc_log_sz; -+ size_t available_elems; - enum mlx5hws_table_type tbl_type; - enum mlx5hws_pool_optimize opt_type; - struct mlx5hws_pool_resource *resource; -@@ -103,4 +104,28 @@ static inline u32 mlx5hws_pool_get_base_mirror_id(struct mlx5hws_pool *pool) - { - return pool->mirror_resource->base_id; - } -+ -+static inline bool -+mlx5hws_pool_empty(struct mlx5hws_pool *pool) -+{ -+ bool ret; -+ -+ mutex_lock(&pool->lock); -+ ret = pool->available_elems == 0; -+ mutex_unlock(&pool->lock); -+ -+ return ret; -+} -+ -+static inline bool -+mlx5hws_pool_full(struct mlx5hws_pool *pool) -+{ -+ bool ret; -+ -+ mutex_lock(&pool->lock); -+ ret = pool->available_elems == (1 << pool->alloc_log_sz); -+ mutex_unlock(&pool->lock); -+ -+ return ret; -+} - #endif /* MLX5HWS_POOL_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1352-net-mlx5-hws-fix-pool-size-optimization.patch b/SOURCES/1352-net-mlx5-hws-fix-pool-size-optimization.patch deleted file mode 100644 index e8a3f555e..000000000 --- a/SOURCES/1352-net-mlx5-hws-fix-pool-size-optimization.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 83591e87d75f1fbe1bad278c3b590cc83e85c276 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:41:59 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix pool size optimization - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a68334f9750f41fc36990840090ef9dbee1e2c7e -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:37 2025 +0300 - - net/mlx5: HWS, Fix pool size optimization - - The optimization to create a size-one STE range for the unused direction - was broken. The hardware prevents us from creating RTCs over unallocated - STE space, so the only reason this has worked so far is because the - optimization was never used. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-8-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 26d85fe3c417..7e37d6e9eb83 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -80,7 +80,7 @@ static int hws_pool_resource_alloc(struct mlx5hws_pool *pool) - u32 fw_ft_type, opt_log_range; - - fw_ft_type = mlx5hws_table_get_res_fw_ft_type(pool->tbl_type, false); -- opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_ORIG ? -+ opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_MIRROR ? - 0 : pool->alloc_log_sz; - resource = hws_pool_create_one_resource(pool, opt_log_range, fw_ft_type); - if (!resource) { -@@ -94,7 +94,7 @@ static int hws_pool_resource_alloc(struct mlx5hws_pool *pool) - struct mlx5hws_pool_resource *mirror_resource; - - fw_ft_type = mlx5hws_table_get_res_fw_ft_type(pool->tbl_type, true); -- opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_MIRROR ? -+ opt_log_range = pool->opt_type == MLX5HWS_POOL_OPTIMIZE_ORIG ? - 0 : pool->alloc_log_sz; - mirror_resource = hws_pool_create_one_resource(pool, opt_log_range, fw_ft_type); - if (!mirror_resource) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1353-net-mlx5-hws-implement-action-ste-pool.patch b/SOURCES/1353-net-mlx5-hws-implement-action-ste-pool.patch deleted file mode 100644 index a6ee81e99..000000000 --- a/SOURCES/1353-net-mlx5-hws-implement-action-ste-pool.patch +++ /dev/null @@ -1,585 +0,0 @@ -From be613df0e750dc94c718ad4c944fa5542870a95c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:00 -0400 -Subject: [PATCH] net/mlx5: HWS, Implement action STE pool - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 983d01b2ce0ac688bb42489f33a29a02274366d5 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:38 2025 +0300 - - net/mlx5: HWS, Implement action STE pool - - Implement a per-queue pool of action STEs that match STEs can link to, - regardless of matcher. - - The code relies on hints to optimize whether a given rule is added to - rx-only, tx-only or both. Correspondingly, action STEs need to be added - to different RTC for ingress or egress paths. For rx-and-tx rules, the - current rule implementation dictates that the offsets for a given rule - must be the same in both RTCs. - - To avoid wasting STEs, each action STE pool element holds 3 pools: - rx-only, tx-only, and rx-and-tx, corresponding to the possible values of - the pool optimization enum. The implementation then chooses at rule - creation / update which of these elements to allocate from. - - Each element holds multiple action STE tables, which wrap an RTC, an STE - range, the logic to buddy-allocate offsets from the range, and an STC - that allows match STEs to point to this table. When allocating offsets - from an element, we iterate through available action STE tables and, if - needed, create a new table. - - Similar to the previous implementation, this iteration does not free any - resources. This is implemented in a subsequent patch. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-9-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index 568bbe5f83f5..d292e6a9e22c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -154,7 +154,8 @@ mlx5_core-$(CONFIG_MLX5_HW_STEERING) += steering/hws/cmd.o \ - steering/hws/vport.o \ - steering/hws/bwc_complex.o \ - steering/hws/fs_hws_pools.o \ -- steering/hws/fs_hws.o -+ steering/hws/fs_hws.o \ -+ steering/hws/action_ste_pool.o - - # - # SF device -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c -new file mode 100644 -index 000000000000..cb6ad8411631 ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c -@@ -0,0 +1,387 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+/* Copyright (c) 2025 NVIDIA Corporation & Affiliates */ -+ -+#include "internal.h" -+ -+static const char * -+hws_pool_opt_to_str(enum mlx5hws_pool_optimize opt) -+{ -+ switch (opt) { -+ case MLX5HWS_POOL_OPTIMIZE_NONE: -+ return "rx-and-tx"; -+ case MLX5HWS_POOL_OPTIMIZE_ORIG: -+ return "rx-only"; -+ case MLX5HWS_POOL_OPTIMIZE_MIRROR: -+ return "tx-only"; -+ default: -+ return "unknown"; -+ } -+} -+ -+static int -+hws_action_ste_table_create_pool(struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_table *action_tbl, -+ enum mlx5hws_pool_optimize opt, size_t log_sz) -+{ -+ struct mlx5hws_pool_attr pool_attr = { 0 }; -+ -+ pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -+ pool_attr.table_type = MLX5HWS_TABLE_TYPE_FDB; -+ pool_attr.flags = MLX5HWS_POOL_FLAG_BUDDY; -+ pool_attr.opt_type = opt; -+ pool_attr.alloc_log_sz = log_sz; -+ -+ action_tbl->pool = mlx5hws_pool_create(ctx, &pool_attr); -+ if (!action_tbl->pool) { -+ mlx5hws_err(ctx, "Failed to allocate STE pool\n"); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ -+static int hws_action_ste_table_create_single_rtc( -+ struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_table *action_tbl, -+ enum mlx5hws_pool_optimize opt, size_t log_sz, bool tx) -+{ -+ struct mlx5hws_cmd_rtc_create_attr rtc_attr = { 0 }; -+ u32 *rtc_id; -+ -+ rtc_attr.log_depth = 0; -+ rtc_attr.update_index_mode = MLX5_IFC_RTC_STE_UPDATE_MODE_BY_OFFSET; -+ /* Action STEs use the default always hit definer. */ -+ rtc_attr.match_definer_0 = ctx->caps->trivial_match_definer; -+ rtc_attr.is_frst_jumbo = false; -+ rtc_attr.miss_ft_id = 0; -+ rtc_attr.pd = ctx->pd_num; -+ rtc_attr.reparse_mode = mlx5hws_context_get_reparse_mode(ctx); -+ -+ if (tx) { -+ rtc_attr.table_type = FS_FT_FDB_TX; -+ rtc_attr.ste_base = -+ mlx5hws_pool_get_base_mirror_id(action_tbl->pool); -+ rtc_attr.stc_base = -+ mlx5hws_pool_get_base_mirror_id(ctx->stc_pool); -+ rtc_attr.log_size = -+ opt == MLX5HWS_POOL_OPTIMIZE_ORIG ? 0 : log_sz; -+ rtc_id = &action_tbl->rtc_1_id; -+ } else { -+ rtc_attr.table_type = FS_FT_FDB_RX; -+ rtc_attr.ste_base = mlx5hws_pool_get_base_id(action_tbl->pool); -+ rtc_attr.stc_base = mlx5hws_pool_get_base_id(ctx->stc_pool); -+ rtc_attr.log_size = -+ opt == MLX5HWS_POOL_OPTIMIZE_MIRROR ? 0 : log_sz; -+ rtc_id = &action_tbl->rtc_0_id; -+ } -+ -+ return mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_id); -+} -+ -+static int -+hws_action_ste_table_create_rtcs(struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_table *action_tbl, -+ enum mlx5hws_pool_optimize opt, size_t log_sz) -+{ -+ int err; -+ -+ err = hws_action_ste_table_create_single_rtc(ctx, action_tbl, opt, -+ log_sz, false); -+ if (err) -+ return err; -+ -+ err = hws_action_ste_table_create_single_rtc(ctx, action_tbl, opt, -+ log_sz, true); -+ if (err) { -+ mlx5hws_cmd_rtc_destroy(ctx->mdev, action_tbl->rtc_0_id); -+ return err; -+ } -+ -+ return 0; -+} -+ -+static void -+hws_action_ste_table_destroy_rtcs(struct mlx5hws_action_ste_table *action_tbl) -+{ -+ mlx5hws_cmd_rtc_destroy(action_tbl->pool->ctx->mdev, -+ action_tbl->rtc_1_id); -+ mlx5hws_cmd_rtc_destroy(action_tbl->pool->ctx->mdev, -+ action_tbl->rtc_0_id); -+} -+ -+static int -+hws_action_ste_table_create_stc(struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_table *action_tbl) -+{ -+ struct mlx5hws_cmd_stc_modify_attr stc_attr = { 0 }; -+ -+ stc_attr.action_offset = MLX5HWS_ACTION_OFFSET_HIT; -+ stc_attr.action_type = MLX5_IFC_STC_ACTION_TYPE_JUMP_TO_STE_TABLE; -+ stc_attr.reparse_mode = MLX5_IFC_STC_REPARSE_IGNORE; -+ stc_attr.ste_table.ste_pool = action_tbl->pool; -+ stc_attr.ste_table.match_definer_id = ctx->caps->trivial_match_definer; -+ -+ return mlx5hws_action_alloc_single_stc(ctx, &stc_attr, -+ MLX5HWS_TABLE_TYPE_FDB, -+ &action_tbl->stc); -+} -+ -+static struct mlx5hws_action_ste_table * -+hws_action_ste_table_alloc(struct mlx5hws_action_ste_pool_element *parent_elem) -+{ -+ enum mlx5hws_pool_optimize opt = parent_elem->opt; -+ struct mlx5hws_context *ctx = parent_elem->ctx; -+ struct mlx5hws_action_ste_table *action_tbl; -+ size_t log_sz; -+ int err; -+ -+ log_sz = min(parent_elem->log_sz ? -+ parent_elem->log_sz + -+ MLX5HWS_ACTION_STE_TABLE_STEP_LOG_SZ : -+ MLX5HWS_ACTION_STE_TABLE_INIT_LOG_SZ, -+ MLX5HWS_ACTION_STE_TABLE_MAX_LOG_SZ); -+ -+ action_tbl = kzalloc(sizeof(*action_tbl), GFP_KERNEL); -+ if (!action_tbl) -+ return ERR_PTR(-ENOMEM); -+ -+ err = hws_action_ste_table_create_pool(ctx, action_tbl, opt, log_sz); -+ if (err) -+ goto free_tbl; -+ -+ err = hws_action_ste_table_create_rtcs(ctx, action_tbl, opt, log_sz); -+ if (err) -+ goto destroy_pool; -+ -+ err = hws_action_ste_table_create_stc(ctx, action_tbl); -+ if (err) -+ goto destroy_rtcs; -+ -+ action_tbl->parent_elem = parent_elem; -+ INIT_LIST_HEAD(&action_tbl->list_node); -+ list_add(&action_tbl->list_node, &parent_elem->available); -+ parent_elem->log_sz = log_sz; -+ -+ mlx5hws_dbg(ctx, -+ "Allocated %s action STE table log_sz %zu; STEs (%d, %d); RTCs (%d, %d); STC %d\n", -+ hws_pool_opt_to_str(opt), log_sz, -+ mlx5hws_pool_get_base_id(action_tbl->pool), -+ mlx5hws_pool_get_base_mirror_id(action_tbl->pool), -+ action_tbl->rtc_0_id, action_tbl->rtc_1_id, -+ action_tbl->stc.offset); -+ -+ return action_tbl; -+ -+destroy_rtcs: -+ hws_action_ste_table_destroy_rtcs(action_tbl); -+destroy_pool: -+ mlx5hws_pool_destroy(action_tbl->pool); -+free_tbl: -+ kfree(action_tbl); -+ -+ return ERR_PTR(err); -+} -+ -+static void -+hws_action_ste_table_destroy(struct mlx5hws_action_ste_table *action_tbl) -+{ -+ struct mlx5hws_context *ctx = action_tbl->parent_elem->ctx; -+ -+ mlx5hws_dbg(ctx, -+ "Destroying %s action STE table: STEs (%d, %d); RTCs (%d, %d); STC %d\n", -+ hws_pool_opt_to_str(action_tbl->parent_elem->opt), -+ mlx5hws_pool_get_base_id(action_tbl->pool), -+ mlx5hws_pool_get_base_mirror_id(action_tbl->pool), -+ action_tbl->rtc_0_id, action_tbl->rtc_1_id, -+ action_tbl->stc.offset); -+ -+ mlx5hws_action_free_single_stc(ctx, MLX5HWS_TABLE_TYPE_FDB, -+ &action_tbl->stc); -+ hws_action_ste_table_destroy_rtcs(action_tbl); -+ mlx5hws_pool_destroy(action_tbl->pool); -+ -+ list_del(&action_tbl->list_node); -+ kfree(action_tbl); -+} -+ -+static int -+hws_action_ste_pool_element_init(struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_pool_element *elem, -+ enum mlx5hws_pool_optimize opt) -+{ -+ elem->ctx = ctx; -+ elem->opt = opt; -+ INIT_LIST_HEAD(&elem->available); -+ INIT_LIST_HEAD(&elem->full); -+ -+ return 0; -+} -+ -+static void hws_action_ste_pool_element_destroy( -+ struct mlx5hws_action_ste_pool_element *elem) -+{ -+ struct mlx5hws_action_ste_table *action_tbl, *p; -+ -+ /* This should be empty, but attempt to free its elements anyway. */ -+ list_for_each_entry_safe(action_tbl, p, &elem->full, list_node) -+ hws_action_ste_table_destroy(action_tbl); -+ -+ list_for_each_entry_safe(action_tbl, p, &elem->available, list_node) -+ hws_action_ste_table_destroy(action_tbl); -+} -+ -+static int hws_action_ste_pool_init(struct mlx5hws_context *ctx, -+ struct mlx5hws_action_ste_pool *pool) -+{ -+ enum mlx5hws_pool_optimize opt; -+ int err; -+ -+ /* Rules which are added for both RX and TX must use the same action STE -+ * indices for both. If we were to use a single table, then RX-only and -+ * TX-only rules would waste the unused entries. Thus, we use separate -+ * table sets for the three cases. -+ */ -+ for (opt = MLX5HWS_POOL_OPTIMIZE_NONE; opt < MLX5HWS_POOL_OPTIMIZE_MAX; -+ opt++) { -+ err = hws_action_ste_pool_element_init(ctx, &pool->elems[opt], -+ opt); -+ if (err) -+ goto destroy_elems; -+ } -+ -+ return 0; -+ -+destroy_elems: -+ while (opt-- > MLX5HWS_POOL_OPTIMIZE_NONE) -+ hws_action_ste_pool_element_destroy(&pool->elems[opt]); -+ -+ return err; -+} -+ -+static void hws_action_ste_pool_destroy(struct mlx5hws_action_ste_pool *pool) -+{ -+ int opt; -+ -+ for (opt = MLX5HWS_POOL_OPTIMIZE_MAX - 1; -+ opt >= MLX5HWS_POOL_OPTIMIZE_NONE; opt--) -+ hws_action_ste_pool_element_destroy(&pool->elems[opt]); -+} -+ -+int mlx5hws_action_ste_pool_init(struct mlx5hws_context *ctx) -+{ -+ struct mlx5hws_action_ste_pool *pool; -+ size_t queues = ctx->queues; -+ int i, err; -+ -+ pool = kcalloc(queues, sizeof(*pool), GFP_KERNEL); -+ if (!pool) -+ return -ENOMEM; -+ -+ for (i = 0; i < queues; i++) { -+ err = hws_action_ste_pool_init(ctx, &pool[i]); -+ if (err) -+ goto free_pool; -+ } -+ -+ ctx->action_ste_pool = pool; -+ -+ return 0; -+ -+free_pool: -+ while (i--) -+ hws_action_ste_pool_destroy(&pool[i]); -+ kfree(pool); -+ -+ return err; -+} -+ -+void mlx5hws_action_ste_pool_uninit(struct mlx5hws_context *ctx) -+{ -+ size_t queues = ctx->queues; -+ int i; -+ -+ for (i = 0; i < queues; i++) -+ hws_action_ste_pool_destroy(&ctx->action_ste_pool[i]); -+ -+ kfree(ctx->action_ste_pool); -+} -+ -+static struct mlx5hws_action_ste_pool_element * -+hws_action_ste_choose_elem(struct mlx5hws_action_ste_pool *pool, -+ bool skip_rx, bool skip_tx) -+{ -+ if (skip_rx) -+ return &pool->elems[MLX5HWS_POOL_OPTIMIZE_MIRROR]; -+ -+ if (skip_tx) -+ return &pool->elems[MLX5HWS_POOL_OPTIMIZE_ORIG]; -+ -+ return &pool->elems[MLX5HWS_POOL_OPTIMIZE_NONE]; -+} -+ -+static int -+hws_action_ste_table_chunk_alloc(struct mlx5hws_action_ste_table *action_tbl, -+ struct mlx5hws_action_ste_chunk *chunk) -+{ -+ int err; -+ -+ err = mlx5hws_pool_chunk_alloc(action_tbl->pool, &chunk->ste); -+ if (err) -+ return err; -+ -+ chunk->action_tbl = action_tbl; -+ -+ return 0; -+} -+ -+int mlx5hws_action_ste_chunk_alloc(struct mlx5hws_action_ste_pool *pool, -+ bool skip_rx, bool skip_tx, -+ struct mlx5hws_action_ste_chunk *chunk) -+{ -+ struct mlx5hws_action_ste_pool_element *elem; -+ struct mlx5hws_action_ste_table *action_tbl; -+ bool found; -+ int err; -+ -+ if (skip_rx && skip_tx) -+ return -EINVAL; -+ -+ elem = hws_action_ste_choose_elem(pool, skip_rx, skip_tx); -+ -+ mlx5hws_dbg(elem->ctx, -+ "Allocating action STEs skip_rx %d skip_tx %d order %d\n", -+ skip_rx, skip_tx, chunk->ste.order); -+ -+ found = false; -+ list_for_each_entry(action_tbl, &elem->available, list_node) { -+ if (!hws_action_ste_table_chunk_alloc(action_tbl, chunk)) { -+ found = true; -+ break; -+ } -+ } -+ -+ if (!found) { -+ action_tbl = hws_action_ste_table_alloc(elem); -+ if (IS_ERR(action_tbl)) -+ return PTR_ERR(action_tbl); -+ -+ err = hws_action_ste_table_chunk_alloc(action_tbl, chunk); -+ if (err) -+ return err; -+ } -+ -+ if (mlx5hws_pool_empty(action_tbl->pool)) -+ list_move(&action_tbl->list_node, &elem->full); -+ -+ return 0; -+} -+ -+void mlx5hws_action_ste_chunk_free(struct mlx5hws_action_ste_chunk *chunk) -+{ -+ mlx5hws_dbg(chunk->action_tbl->pool->ctx, -+ "Freeing action STEs offset %d order %d\n", -+ chunk->ste.offset, chunk->ste.order); -+ mlx5hws_pool_chunk_free(chunk->action_tbl->pool, &chunk->ste); -+ list_move(&chunk->action_tbl->list_node, -+ &chunk->action_tbl->parent_elem->available); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h -new file mode 100644 -index 000000000000..2de660a63223 ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h -@@ -0,0 +1,58 @@ -+/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ -+/* Copyright (c) 2025 NVIDIA Corporation & Affiliates */ -+ -+#ifndef ACTION_STE_POOL_H_ -+#define ACTION_STE_POOL_H_ -+ -+#define MLX5HWS_ACTION_STE_TABLE_INIT_LOG_SZ 10 -+#define MLX5HWS_ACTION_STE_TABLE_STEP_LOG_SZ 1 -+#define MLX5HWS_ACTION_STE_TABLE_MAX_LOG_SZ 20 -+ -+struct mlx5hws_action_ste_pool_element; -+ -+struct mlx5hws_action_ste_table { -+ struct mlx5hws_action_ste_pool_element *parent_elem; -+ /* Wraps the RTC and STE range for this given action. */ -+ struct mlx5hws_pool *pool; -+ /* Match STEs use this STC to jump to this pool's RTC. */ -+ struct mlx5hws_pool_chunk stc; -+ u32 rtc_0_id; -+ u32 rtc_1_id; -+ struct list_head list_node; -+}; -+ -+struct mlx5hws_action_ste_pool_element { -+ struct mlx5hws_context *ctx; -+ size_t log_sz; /* Size of the largest table so far. */ -+ enum mlx5hws_pool_optimize opt; -+ struct list_head available; -+ struct list_head full; -+}; -+ -+/* Central repository of action STEs. The context contains one of these pools -+ * per queue. -+ */ -+struct mlx5hws_action_ste_pool { -+ struct mlx5hws_action_ste_pool_element elems[MLX5HWS_POOL_OPTIMIZE_MAX]; -+}; -+ -+/* A chunk of STEs and the table it was allocated from. Used by rules. */ -+struct mlx5hws_action_ste_chunk { -+ struct mlx5hws_action_ste_table *action_tbl; -+ struct mlx5hws_pool_chunk ste; -+}; -+ -+int mlx5hws_action_ste_pool_init(struct mlx5hws_context *ctx); -+ -+void mlx5hws_action_ste_pool_uninit(struct mlx5hws_context *ctx); -+ -+/* Callers are expected to fill chunk->ste.order. On success, this function -+ * populates chunk->tbl and chunk->ste.offset. -+ */ -+int mlx5hws_action_ste_chunk_alloc(struct mlx5hws_action_ste_pool *pool, -+ bool skip_rx, bool skip_tx, -+ struct mlx5hws_action_ste_chunk *chunk); -+ -+void mlx5hws_action_ste_chunk_free(struct mlx5hws_action_ste_chunk *chunk); -+ -+#endif /* ACTION_STE_POOL_H_ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -index b7cb736b74d7..428dae869706 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.c -@@ -158,10 +158,16 @@ static int hws_context_init_hws(struct mlx5hws_context *ctx, - if (ret) - goto pools_uninit; - -+ ret = mlx5hws_action_ste_pool_init(ctx); -+ if (ret) -+ goto close_queues; -+ - INIT_LIST_HEAD(&ctx->tbl_list); - - return 0; - -+close_queues: -+ mlx5hws_send_queues_close(ctx); - pools_uninit: - hws_context_pools_uninit(ctx); - uninit_pd: -@@ -174,6 +180,7 @@ static void hws_context_uninit_hws(struct mlx5hws_context *ctx) - if (!(ctx->flags & MLX5HWS_CONTEXT_FLAG_HWS_SUPPORT)) - return; - -+ mlx5hws_action_ste_pool_uninit(ctx); - mlx5hws_send_queues_close(ctx); - hws_context_pools_uninit(ctx); - hws_context_uninit_pd(ctx); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -index 38c3647444ad..e987e93bbc6e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -@@ -39,6 +39,7 @@ struct mlx5hws_context { - struct mlx5hws_cmd_query_caps *caps; - u32 pd_num; - struct mlx5hws_pool *stc_pool; -+ struct mlx5hws_action_ste_pool *action_ste_pool; /* One per queue */ - struct mlx5hws_context_common_res common_res; - struct mlx5hws_pattern_cache *pattern_cache; - struct mlx5hws_definer_cache *definer_cache; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/internal.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/internal.h -index 30ccd635b505..21279d503117 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/internal.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/internal.h -@@ -17,6 +17,7 @@ - #include "context.h" - #include "table.h" - #include "send.h" -+#include "action_ste_pool.h" - #include "rule.h" - #include "cmd.h" - #include "action.h" -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -index c82760d53e1a..33e33d5f1fb3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.h -@@ -33,6 +33,7 @@ enum mlx5hws_pool_optimize { - MLX5HWS_POOL_OPTIMIZE_NONE = 0x0, - MLX5HWS_POOL_OPTIMIZE_ORIG = 0x1, - MLX5HWS_POOL_OPTIMIZE_MIRROR = 0x2, -+ MLX5HWS_POOL_OPTIMIZE_MAX = 0x3, - }; - - struct mlx5hws_pool_attr { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1354-net-mlx5-hws-use-the-new-action-ste-pool.patch b/SOURCES/1354-net-mlx5-hws-use-the-new-action-ste-pool.patch deleted file mode 100644 index 59e15911b..000000000 --- a/SOURCES/1354-net-mlx5-hws-use-the-new-action-ste-pool.patch +++ /dev/null @@ -1,190 +0,0 @@ -From 95ecc26ff257b1b713163c5a13570543b03678f2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:00 -0400 -Subject: [PATCH] net/mlx5: HWS, Use the new action STE pool - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 593a9470a8565a59a07b577d6bcb3c199f232d4a -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:39 2025 +0300 - - net/mlx5: HWS, Use the new action STE pool - - Use the central action STE pool when creating / updating rules. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-10-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -index a27a2d5ffc7b..5b758467ed03 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -@@ -195,44 +195,30 @@ hws_rule_load_delete_info(struct mlx5hws_rule *rule, - } - } - --static int hws_rule_alloc_action_ste(struct mlx5hws_rule *rule) -+static int mlx5hws_rule_alloc_action_ste(struct mlx5hws_rule *rule, -+ u16 queue_id, bool skip_rx, -+ bool skip_tx) - { - struct mlx5hws_matcher *matcher = rule->matcher; -- struct mlx5hws_matcher_action_ste *action_ste; -- struct mlx5hws_pool_chunk ste = {0}; -- int ret; -- -- action_ste = &matcher->action_ste; -- ste.order = ilog2(roundup_pow_of_two(action_ste->max_stes)); -- ret = mlx5hws_pool_chunk_alloc(action_ste->pool, &ste); -- if (unlikely(ret)) { -- mlx5hws_err(matcher->tbl->ctx, -- "Failed to allocate STE for rule actions"); -- return ret; -- } -- -- rule->action_ste.pool = matcher->action_ste.pool; -- rule->action_ste.num_stes = matcher->action_ste.max_stes; -- rule->action_ste.index = ste.offset; -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; - -- return 0; -+ rule->action_ste.ste.order = -+ ilog2(roundup_pow_of_two(matcher->action_ste.max_stes)); -+ return mlx5hws_action_ste_chunk_alloc(&ctx->action_ste_pool[queue_id], -+ skip_rx, skip_tx, -+ &rule->action_ste); - } - --void mlx5hws_rule_free_action_ste(struct mlx5hws_rule_action_ste_info *action_ste) -+void mlx5hws_rule_free_action_ste(struct mlx5hws_action_ste_chunk *action_ste) - { -- struct mlx5hws_pool_chunk ste = {0}; -- -- if (!action_ste->num_stes) -+ if (!action_ste->action_tbl) - return; - -- ste.order = ilog2(roundup_pow_of_two(action_ste->num_stes)); -- ste.offset = action_ste->index; -- - /* This release is safe only when the rule match STE was deleted - * (when the rule is being deleted) or replaced with the new STE that - * isn't pointing to old action STEs (when the rule is being updated). - */ -- mlx5hws_pool_chunk_free(action_ste->pool, &ste); -+ mlx5hws_action_ste_chunk_free(action_ste); - } - - static void hws_rule_create_init(struct mlx5hws_rule *rule, -@@ -250,22 +236,15 @@ static void hws_rule_create_init(struct mlx5hws_rule *rule, - rule->rtc_0 = 0; - rule->rtc_1 = 0; - -- rule->action_ste.pool = NULL; -- rule->action_ste.num_stes = 0; -- rule->action_ste.index = -1; -- - rule->status = MLX5HWS_RULE_STATUS_CREATING; - } else { - rule->status = MLX5HWS_RULE_STATUS_UPDATING; -+ /* Save the old action STE info so we can free it after writing -+ * new action STEs and a corresponding match STE. -+ */ -+ rule->old_action_ste = rule->action_ste; - } - -- /* Initialize the old action STE info - shallow-copy action_ste. -- * In create flow this will set old_action_ste fields to initial values. -- * In update flow this will save the existing action STE info, -- * so that we will later use it to free old STEs. -- */ -- rule->old_action_ste = rule->action_ste; -- - rule->pending_wqes = 0; - - /* Init default send STE attributes */ -@@ -277,7 +256,6 @@ static void hws_rule_create_init(struct mlx5hws_rule *rule, - /* Init default action apply */ - apply->tbl_type = tbl->type; - apply->common_res = &ctx->common_res; -- apply->jump_to_action_stc = matcher->action_ste.stc.offset; - apply->require_dep = 0; - } - -@@ -353,17 +331,24 @@ static int hws_rule_create_hws(struct mlx5hws_rule *rule, - - if (action_stes) { - /* Allocate action STEs for rules that need more than match STE */ -- ret = hws_rule_alloc_action_ste(rule); -+ ret = mlx5hws_rule_alloc_action_ste(rule, attr->queue_id, -+ !!ste_attr.rtc_0, -+ !!ste_attr.rtc_1); - if (ret) { - mlx5hws_err(ctx, "Failed to allocate action memory %d", ret); - mlx5hws_send_abort_new_dep_wqe(queue); - return ret; - } -+ apply.jump_to_action_stc = -+ rule->action_ste.action_tbl->stc.offset; - /* Skip RX/TX based on the dep_wqe init */ -- ste_attr.rtc_0 = dep_wqe->rtc_0 ? matcher->action_ste.rtc_0_id : 0; -- ste_attr.rtc_1 = dep_wqe->rtc_1 ? matcher->action_ste.rtc_1_id : 0; -+ ste_attr.rtc_0 = dep_wqe->rtc_0 ? -+ rule->action_ste.action_tbl->rtc_0_id : 0; -+ ste_attr.rtc_1 = dep_wqe->rtc_1 ? -+ rule->action_ste.action_tbl->rtc_1_id : 0; - /* Action STEs are written to a specific index last to first */ -- ste_attr.direct_index = rule->action_ste.index + action_stes; -+ ste_attr.direct_index = -+ rule->action_ste.ste.offset + action_stes; - apply.next_direct_idx = ste_attr.direct_index; - } else { - apply.next_direct_idx = 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -index b5ee94ac449b..1c47a9c11572 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -@@ -43,12 +43,6 @@ struct mlx5hws_rule_match_tag { - }; - }; - --struct mlx5hws_rule_action_ste_info { -- struct mlx5hws_pool *pool; -- int index; /* STE array index */ -- u8 num_stes; --}; -- - struct mlx5hws_rule_resize_info { - u32 rtc_0; - u32 rtc_1; -@@ -64,8 +58,8 @@ struct mlx5hws_rule { - struct mlx5hws_rule_match_tag tag; - struct mlx5hws_rule_resize_info *resize_info; - }; -- struct mlx5hws_rule_action_ste_info action_ste; -- struct mlx5hws_rule_action_ste_info old_action_ste; -+ struct mlx5hws_action_ste_chunk action_ste; -+ struct mlx5hws_action_ste_chunk old_action_ste; - u32 rtc_0; /* The RTC into which the STE was inserted */ - u32 rtc_1; /* The RTC into which the STE was inserted */ - u8 status; /* enum mlx5hws_rule_status */ -@@ -75,7 +69,7 @@ struct mlx5hws_rule { - */ - }; - --void mlx5hws_rule_free_action_ste(struct mlx5hws_rule_action_ste_info *action_ste); -+void mlx5hws_rule_free_action_ste(struct mlx5hws_action_ste_chunk *action_ste); - - int mlx5hws_rule_move_hws_remove(struct mlx5hws_rule *rule, - void *queue, void *user_data); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1355-net-mlx5-hws-cleanup-matcher-action-ste-table.patch b/SOURCES/1355-net-mlx5-hws-cleanup-matcher-action-ste-table.patch deleted file mode 100644 index 5923edc31..000000000 --- a/SOURCES/1355-net-mlx5-hws-cleanup-matcher-action-ste-table.patch +++ /dev/null @@ -1,875 +0,0 @@ -From 0e63b341ab3882d9bf6aacf824f70c2b41ef65e7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:00 -0400 -Subject: [PATCH] net/mlx5: HWS, Cleanup matcher action STE table - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 22174f16f1218fc98e374b3653decae54aa481f8 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:40 2025 +0300 - - net/mlx5: HWS, Cleanup matcher action STE table - - Remove the matcher action STE implementation now that the code uses - per-queue action STE pools. This also allows simplifying matcher code - because it is now only handling a single type of RTC/STE. - - The matcher resize data is also going away. Matchers were saving old - action STE data because the rules still used it, but now that data lives - in the action STE pool and is no longer coupled to a matcher. - - Furthermore, matchers no longer need to rehash a due to action template - addition. If a new action template needs more action STEs, we simply - update the matcher's num_of_action_stes and future rules will allocate - the correct number. Existing rules are unaffected by such an operation - and can continue to use their existing action STEs. - - The range action was using the matcher action STE implementation, but - there was no reason to do this other than the container fitting the - purpose. Extract that information to a separate structure. - - Finally, stop dumping per-matcher information about action RTCs, - because they no longer exist. A later patch in this series will add - support for dumping action STE pools. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-11-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 161ad720b339..bef4d25c1a2a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1574,13 +1574,13 @@ hws_action_create_dest_match_range_definer(struct mlx5hws_context *ctx) - return definer; - } - --static struct mlx5hws_matcher_action_ste * -+static struct mlx5hws_range_action_table * - hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - struct mlx5hws_definer *definer, - u32 miss_ft_id) - { - struct mlx5hws_cmd_rtc_create_attr rtc_attr = {0}; -- struct mlx5hws_matcher_action_ste *table_ste; -+ struct mlx5hws_range_action_table *table_ste; - struct mlx5hws_pool_attr pool_attr = {0}; - struct mlx5hws_pool *ste_pool, *stc_pool; - u32 *rtc_0_id, *rtc_1_id; -@@ -1669,9 +1669,9 @@ hws_action_create_dest_match_range_table(struct mlx5hws_context *ctx, - return NULL; - } - --static void --hws_action_destroy_dest_match_range_table(struct mlx5hws_context *ctx, -- struct mlx5hws_matcher_action_ste *table_ste) -+static void hws_action_destroy_dest_match_range_table( -+ struct mlx5hws_context *ctx, -+ struct mlx5hws_range_action_table *table_ste) - { - mutex_lock(&ctx->ctrl_lock); - -@@ -1683,12 +1683,11 @@ hws_action_destroy_dest_match_range_table(struct mlx5hws_context *ctx, - mutex_unlock(&ctx->ctrl_lock); - } - --static int --hws_action_create_dest_match_range_fill_table(struct mlx5hws_context *ctx, -- struct mlx5hws_matcher_action_ste *table_ste, -- struct mlx5hws_action *hit_ft_action, -- struct mlx5hws_definer *range_definer, -- u32 min, u32 max) -+static int hws_action_create_dest_match_range_fill_table( -+ struct mlx5hws_context *ctx, -+ struct mlx5hws_range_action_table *table_ste, -+ struct mlx5hws_action *hit_ft_action, -+ struct mlx5hws_definer *range_definer, u32 min, u32 max) - { - struct mlx5hws_wqe_gta_data_seg_ste match_wqe_data = {0}; - struct mlx5hws_wqe_gta_data_seg_ste range_wqe_data = {0}; -@@ -1784,7 +1783,7 @@ mlx5hws_action_create_dest_match_range(struct mlx5hws_context *ctx, - u32 min, u32 max, u32 flags) - { - struct mlx5hws_cmd_stc_modify_attr stc_attr = {0}; -- struct mlx5hws_matcher_action_ste *table_ste; -+ struct mlx5hws_range_action_table *table_ste; - struct mlx5hws_action *hit_ft_action; - struct mlx5hws_definer *definer; - struct mlx5hws_action *action; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -index 64b76075f7f8..25fa0d4c9221 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -@@ -118,6 +118,12 @@ struct mlx5hws_action_template { - u8 only_term; - }; - -+struct mlx5hws_range_action_table { -+ struct mlx5hws_pool *pool; -+ u32 rtc_0_id; -+ u32 rtc_1_id; -+}; -+ - struct mlx5hws_action { - u8 type; - u8 flags; -@@ -186,7 +192,7 @@ struct mlx5hws_action { - size_t size; - } remove_header; - struct { -- struct mlx5hws_matcher_action_ste *table_ste; -+ struct mlx5hws_range_action_table *table_ste; - struct mlx5hws_action *hit_ft_action; - struct mlx5hws_definer *definer; - } range; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 32de8bfc7644..510bfbbe5991 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -478,21 +478,9 @@ hws_bwc_matcher_size_maxed_out(struct mlx5hws_bwc_matcher *bwc_matcher) - struct mlx5hws_cmd_query_caps *caps = bwc_matcher->matcher->tbl->ctx->caps; - - /* check the match RTC size */ -- if ((bwc_matcher->size_log + -- MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH + -- MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP) > -- (caps->ste_alloc_log_max - 1)) -- return true; -- -- /* check the action RTC size */ -- if ((bwc_matcher->size_log + -- MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP + -- ilog2(roundup_pow_of_two(bwc_matcher->matcher->action_ste.max_stes)) + -- MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT) > -- (caps->ste_alloc_log_max - 1)) -- return true; -- -- return false; -+ return (bwc_matcher->size_log + MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH + -+ MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP) > -+ (caps->ste_alloc_log_max - 1); - } - - static bool -@@ -779,19 +767,6 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - return hws_bwc_matcher_move(bwc_matcher); - } - --static int --hws_bwc_matcher_rehash_at(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- /* Rehash by action template doesn't require any additional checking. -- * The bwc_matcher already contains the new action template. -- * Just do the usual rehash: -- * - create new matcher -- * - move all the rules to the new matcher -- * - destroy the old matcher -- */ -- return hws_bwc_matcher_move(bwc_matcher); --} -- - int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - u32 *match_param, - struct mlx5hws_rule_action rule_actions[], -@@ -803,7 +778,6 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_rule_attr rule_attr; - struct mutex *queue_lock; /* Protect the queue */ - u32 num_of_rules; -- bool need_rehash; - int ret = 0; - int at_idx; - -@@ -830,30 +804,11 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - at_idx = bwc_matcher->num_of_at - 1; - - ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx], -- &need_rehash); -+ bwc_matcher->at[at_idx]); - if (unlikely(ret)) { - hws_bwc_unlock_all_queues(ctx); - return ret; - } -- if (unlikely(need_rehash)) { -- /* The new action template requires more action STEs. -- * Need to attempt creating new matcher with all -- * the action templates, including the new one. -- */ -- ret = hws_bwc_matcher_rehash_at(bwc_matcher); -- if (unlikely(ret)) { -- mlx5hws_action_template_destroy(bwc_matcher->at[at_idx]); -- bwc_matcher->at[at_idx] = NULL; -- bwc_matcher->num_of_at--; -- -- hws_bwc_unlock_all_queues(ctx); -- -- mlx5hws_err(ctx, -- "BWC rule insertion: rehash AT failed (%d)\n", ret); -- return ret; -- } -- } - - hws_bwc_unlock_all_queues(ctx); - mutex_lock(queue_lock); -@@ -973,7 +928,6 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_rule_attr rule_attr; - struct mutex *queue_lock; /* Protect the queue */ -- bool need_rehash; - int at_idx, ret; - u16 idx; - -@@ -1005,32 +959,11 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - at_idx = bwc_matcher->num_of_at - 1; - - ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx], -- &need_rehash); -+ bwc_matcher->at[at_idx]); - if (unlikely(ret)) { - hws_bwc_unlock_all_queues(ctx); - return ret; - } -- if (unlikely(need_rehash)) { -- /* The new action template requires more action -- * STEs. Need to attempt creating new matcher -- * with all the action templates, including the -- * new one. -- */ -- ret = hws_bwc_matcher_rehash_at(bwc_matcher); -- if (unlikely(ret)) { -- mlx5hws_action_template_destroy(bwc_matcher->at[at_idx]); -- bwc_matcher->at[at_idx] = NULL; -- bwc_matcher->num_of_at--; -- -- hws_bwc_unlock_all_queues(ctx); -- -- mlx5hws_err(ctx, -- "BWC rule update: rehash AT failed (%d)\n", -- ret); -- return ret; -- } -- } - } - - hws_bwc_unlock_all_queues(ctx); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -index 3491408c5d84..38f75dec9cfc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -@@ -146,18 +146,6 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - matcher->match_ste.rtc_1_id, - (int)ste_1_id); - -- ste_pool = matcher->action_ste.pool; -- if (ste_pool) { -- ste_0_id = mlx5hws_pool_get_base_id(ste_pool); -- if (tbl_type == MLX5HWS_TABLE_TYPE_FDB) -- ste_1_id = mlx5hws_pool_get_base_mirror_id(ste_pool); -- else -- ste_1_id = -1; -- } else { -- ste_0_id = -1; -- ste_1_id = -1; -- } -- - ft_attr.type = matcher->tbl->fw_ft_type; - ret = mlx5hws_cmd_flow_table_query(matcher->tbl->ctx->mdev, - matcher->end_ft_id, -@@ -167,10 +155,7 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - if (ret) - return ret; - -- seq_printf(f, ",%d,%d,%d,%d,%d,0x%llx,0x%llx\n", -- matcher->action_ste.rtc_0_id, (int)ste_0_id, -- matcher->action_ste.rtc_1_id, (int)ste_1_id, -- 0, -+ seq_printf(f, ",-1,-1,-1,-1,0,0x%llx,0x%llx\n", - mlx5hws_debug_icm_to_idx(icm_addr_0), - mlx5hws_debug_icm_to_idx(icm_addr_1)); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 3028e0387e3f..716502732d3d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -3,25 +3,6 @@ - - #include "internal.h" - --enum mlx5hws_matcher_rtc_type { -- HWS_MATCHER_RTC_TYPE_MATCH, -- HWS_MATCHER_RTC_TYPE_STE_ARRAY, -- HWS_MATCHER_RTC_TYPE_MAX, --}; -- --static const char * const mlx5hws_matcher_rtc_type_str[] = { -- [HWS_MATCHER_RTC_TYPE_MATCH] = "MATCH", -- [HWS_MATCHER_RTC_TYPE_STE_ARRAY] = "STE_ARRAY", -- [HWS_MATCHER_RTC_TYPE_MAX] = "UNKNOWN", --}; -- --static const char *hws_matcher_rtc_type_to_str(enum mlx5hws_matcher_rtc_type rtc_type) --{ -- if (rtc_type > HWS_MATCHER_RTC_TYPE_MAX) -- rtc_type = HWS_MATCHER_RTC_TYPE_MAX; -- return mlx5hws_matcher_rtc_type_str[rtc_type]; --} -- - static bool hws_matcher_requires_col_tbl(u8 log_num_of_rules) - { - /* Collision table concatenation is done only for large rule tables */ -@@ -209,83 +190,52 @@ static void hws_matcher_set_rtc_attr_sz(struct mlx5hws_matcher *matcher, - } - } - --static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, -- enum mlx5hws_matcher_rtc_type rtc_type) -+static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_matcher_attr *attr = &matcher->attr; - struct mlx5hws_cmd_rtc_create_attr rtc_attr = {0}; - struct mlx5hws_match_template *mt = matcher->mt; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -- struct mlx5hws_matcher_action_ste *action_ste; - struct mlx5hws_table *tbl = matcher->tbl; -- struct mlx5hws_pool *ste_pool; -- u32 *rtc_0_id, *rtc_1_id; - u32 obj_id; - int ret; - -- switch (rtc_type) { -- case HWS_MATCHER_RTC_TYPE_MATCH: -- rtc_0_id = &matcher->match_ste.rtc_0_id; -- rtc_1_id = &matcher->match_ste.rtc_1_id; -- ste_pool = matcher->match_ste.pool; -- -- rtc_attr.log_size = attr->table.sz_row_log; -- rtc_attr.log_depth = attr->table.sz_col_log; -- rtc_attr.is_frst_jumbo = mlx5hws_matcher_mt_is_jumbo(mt); -- rtc_attr.is_scnd_range = 0; -- rtc_attr.miss_ft_id = matcher->end_ft_id; -- -- if (attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_HASH) { -- /* The usual Hash Table */ -- rtc_attr.update_index_mode = MLX5_IFC_RTC_STE_UPDATE_MODE_BY_HASH; -- -- /* The first mt is used since all share the same definer */ -- rtc_attr.match_definer_0 = mlx5hws_definer_get_id(mt->definer); -- } else if (attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_INDEX) { -- rtc_attr.update_index_mode = MLX5_IFC_RTC_STE_UPDATE_MODE_BY_OFFSET; -- rtc_attr.num_hash_definer = 1; -- -- if (attr->distribute_mode == MLX5HWS_MATCHER_DISTRIBUTE_BY_HASH) { -- /* Hash Split Table */ -- rtc_attr.access_index_mode = MLX5_IFC_RTC_STE_ACCESS_MODE_BY_HASH; -- rtc_attr.match_definer_0 = mlx5hws_definer_get_id(mt->definer); -- } else if (attr->distribute_mode == MLX5HWS_MATCHER_DISTRIBUTE_BY_LINEAR) { -- /* Linear Lookup Table */ -- rtc_attr.access_index_mode = MLX5_IFC_RTC_STE_ACCESS_MODE_LINEAR; -- rtc_attr.match_definer_0 = ctx->caps->linear_match_definer; -- } -+ rtc_attr.log_size = attr->table.sz_row_log; -+ rtc_attr.log_depth = attr->table.sz_col_log; -+ rtc_attr.is_frst_jumbo = mlx5hws_matcher_mt_is_jumbo(mt); -+ rtc_attr.is_scnd_range = 0; -+ rtc_attr.miss_ft_id = matcher->end_ft_id; -+ -+ if (attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_HASH) { -+ /* The usual Hash Table */ -+ rtc_attr.update_index_mode = -+ MLX5_IFC_RTC_STE_UPDATE_MODE_BY_HASH; -+ -+ /* The first mt is used since all share the same definer */ -+ rtc_attr.match_definer_0 = mlx5hws_definer_get_id(mt->definer); -+ } else if (attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_INDEX) { -+ rtc_attr.update_index_mode = -+ MLX5_IFC_RTC_STE_UPDATE_MODE_BY_OFFSET; -+ rtc_attr.num_hash_definer = 1; -+ -+ if (attr->distribute_mode == -+ MLX5HWS_MATCHER_DISTRIBUTE_BY_HASH) { -+ /* Hash Split Table */ -+ rtc_attr.access_index_mode = -+ MLX5_IFC_RTC_STE_ACCESS_MODE_BY_HASH; -+ rtc_attr.match_definer_0 = -+ mlx5hws_definer_get_id(mt->definer); -+ } else if (attr->distribute_mode == -+ MLX5HWS_MATCHER_DISTRIBUTE_BY_LINEAR) { -+ /* Linear Lookup Table */ -+ rtc_attr.access_index_mode = -+ MLX5_IFC_RTC_STE_ACCESS_MODE_LINEAR; -+ rtc_attr.match_definer_0 = -+ ctx->caps->linear_match_definer; - } -- break; -- -- case HWS_MATCHER_RTC_TYPE_STE_ARRAY: -- action_ste = &matcher->action_ste; -- -- rtc_0_id = &action_ste->rtc_0_id; -- rtc_1_id = &action_ste->rtc_1_id; -- ste_pool = action_ste->pool; -- /* Action RTC size calculation: -- * log((max number of rules in matcher) * -- * (max number of action STEs per rule) * -- * (2 to support writing new STEs for update rule)) -- */ -- rtc_attr.log_size = -- ilog2(roundup_pow_of_two(action_ste->max_stes)) + -- attr->table.sz_row_log + -- MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT; -- rtc_attr.log_depth = 0; -- rtc_attr.update_index_mode = MLX5_IFC_RTC_STE_UPDATE_MODE_BY_OFFSET; -- /* The action STEs use the default always hit definer */ -- rtc_attr.match_definer_0 = ctx->caps->trivial_match_definer; -- rtc_attr.is_frst_jumbo = false; -- rtc_attr.miss_ft_id = 0; -- break; -- -- default: -- mlx5hws_err(ctx, "HWS Invalid RTC type\n"); -- return -EINVAL; - } - -- obj_id = mlx5hws_pool_get_base_id(ste_pool); -+ obj_id = mlx5hws_pool_get_base_id(matcher->match_ste.pool); - - rtc_attr.pd = ctx->pd_num; - rtc_attr.ste_base = obj_id; -@@ -297,15 +247,16 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - obj_id = mlx5hws_pool_get_base_id(ctx->stc_pool); - rtc_attr.stc_base = obj_id; - -- ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_0_id); -+ ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, -+ &matcher->match_ste.rtc_0_id); - if (ret) { -- mlx5hws_err(ctx, "Failed to create matcher RTC of type %s", -- hws_matcher_rtc_type_to_str(rtc_type)); -+ mlx5hws_err(ctx, "Failed to create matcher RTC\n"); - return ret; - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -- obj_id = mlx5hws_pool_get_base_mirror_id(ste_pool); -+ obj_id = mlx5hws_pool_get_base_mirror_id( -+ matcher->match_ste.pool); - rtc_attr.ste_base = obj_id; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, true); - -@@ -313,10 +264,10 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - rtc_attr.stc_base = obj_id; - hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, true); - -- ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, rtc_1_id); -+ ret = mlx5hws_cmd_rtc_create(ctx->mdev, &rtc_attr, -+ &matcher->match_ste.rtc_1_id); - if (ret) { -- mlx5hws_err(ctx, "Failed to create peer matcher RTC of type %s", -- hws_matcher_rtc_type_to_str(rtc_type)); -+ mlx5hws_err(ctx, "Failed to create mirror matcher RTC\n"); - goto destroy_rtc_0; - } - } -@@ -324,33 +275,18 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher, - return 0; - - destroy_rtc_0: -- mlx5hws_cmd_rtc_destroy(ctx->mdev, *rtc_0_id); -+ mlx5hws_cmd_rtc_destroy(ctx->mdev, matcher->match_ste.rtc_0_id); - return ret; - } - --static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher, -- enum mlx5hws_matcher_rtc_type rtc_type) -+static void hws_matcher_destroy_rtc(struct mlx5hws_matcher *matcher) - { -- struct mlx5hws_table *tbl = matcher->tbl; -- u32 rtc_0_id, rtc_1_id; -- -- switch (rtc_type) { -- case HWS_MATCHER_RTC_TYPE_MATCH: -- rtc_0_id = matcher->match_ste.rtc_0_id; -- rtc_1_id = matcher->match_ste.rtc_1_id; -- break; -- case HWS_MATCHER_RTC_TYPE_STE_ARRAY: -- rtc_0_id = matcher->action_ste.rtc_0_id; -- rtc_1_id = matcher->action_ste.rtc_1_id; -- break; -- default: -- return; -- } -+ struct mlx5_core_dev *mdev = matcher->tbl->ctx->mdev; - -- if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) -- mlx5hws_cmd_rtc_destroy(tbl->ctx->mdev, rtc_1_id); -+ if (matcher->tbl->type == MLX5HWS_TABLE_TYPE_FDB) -+ mlx5hws_cmd_rtc_destroy(mdev, matcher->match_ste.rtc_1_id); - -- mlx5hws_cmd_rtc_destroy(tbl->ctx->mdev, rtc_0_id); -+ mlx5hws_cmd_rtc_destroy(mdev, matcher->match_ste.rtc_0_id); - } - - static int -@@ -418,85 +354,17 @@ static int hws_matcher_check_and_process_at(struct mlx5hws_matcher *matcher, - return 0; - } - --static int hws_matcher_resize_init(struct mlx5hws_matcher *src_matcher) --{ -- struct mlx5hws_matcher_resize_data *resize_data; -- -- resize_data = kzalloc(sizeof(*resize_data), GFP_KERNEL); -- if (!resize_data) -- return -ENOMEM; -- -- resize_data->max_stes = src_matcher->action_ste.max_stes; -- -- resize_data->stc = src_matcher->action_ste.stc; -- resize_data->rtc_0_id = src_matcher->action_ste.rtc_0_id; -- resize_data->rtc_1_id = src_matcher->action_ste.rtc_1_id; -- resize_data->pool = src_matcher->action_ste.max_stes ? -- src_matcher->action_ste.pool : NULL; -- -- /* Place the new resized matcher on the dst matcher's list */ -- list_add(&resize_data->list_node, &src_matcher->resize_dst->resize_data); -- -- /* Move all the previous resized matchers to the dst matcher's list */ -- while (!list_empty(&src_matcher->resize_data)) { -- resize_data = list_first_entry(&src_matcher->resize_data, -- struct mlx5hws_matcher_resize_data, -- list_node); -- list_del_init(&resize_data->list_node); -- list_add(&resize_data->list_node, &src_matcher->resize_dst->resize_data); -- } -- -- return 0; --} -- --static void hws_matcher_resize_uninit(struct mlx5hws_matcher *matcher) --{ -- struct mlx5hws_matcher_resize_data *resize_data; -- -- if (!mlx5hws_matcher_is_resizable(matcher)) -- return; -- -- while (!list_empty(&matcher->resize_data)) { -- resize_data = list_first_entry(&matcher->resize_data, -- struct mlx5hws_matcher_resize_data, -- list_node); -- list_del_init(&resize_data->list_node); -- -- if (resize_data->max_stes) { -- mlx5hws_action_free_single_stc(matcher->tbl->ctx, -- matcher->tbl->type, -- &resize_data->stc); -- -- if (matcher->tbl->type == MLX5HWS_TABLE_TYPE_FDB) -- mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, -- resize_data->rtc_1_id); -- -- mlx5hws_cmd_rtc_destroy(matcher->tbl->ctx->mdev, -- resize_data->rtc_0_id); -- -- if (resize_data->pool) -- mlx5hws_pool_destroy(resize_data->pool); -- } -- -- kfree(resize_data); -- } --} -- - static int hws_matcher_bind_at(struct mlx5hws_matcher *matcher) - { - bool is_jumbo = mlx5hws_matcher_mt_is_jumbo(matcher->mt); -- struct mlx5hws_cmd_stc_modify_attr stc_attr = {0}; -- struct mlx5hws_matcher_action_ste *action_ste; -- struct mlx5hws_table *tbl = matcher->tbl; -- struct mlx5hws_pool_attr pool_attr = {0}; -- struct mlx5hws_context *ctx = tbl->ctx; -- u32 required_stes; -- u8 max_stes = 0; -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ u8 required_stes, max_stes; - int i, ret; - - if (matcher->flags & MLX5HWS_MATCHER_FLAGS_COLLISION) - return 0; - -+ max_stes = 0; - for (i = 0; i < matcher->num_of_at; i++) { - struct mlx5hws_action_template *at = &matcher->at[i]; - -@@ -512,74 +380,9 @@ static int hws_matcher_bind_at(struct mlx5hws_matcher *matcher) - /* Future: Optimize reparse */ - } - -- /* There are no additional STEs required for matcher */ -- if (!max_stes) -- return 0; -- -- matcher->action_ste.max_stes = max_stes; -- -- action_ste = &matcher->action_ste; -- -- /* Allocate action STE mempool */ -- pool_attr.table_type = tbl->type; -- pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -- pool_attr.flags = MLX5HWS_POOL_FLAG_BUDDY; -- /* Pool size is similar to action RTC size */ -- pool_attr.alloc_log_sz = ilog2(roundup_pow_of_two(action_ste->max_stes)) + -- matcher->attr.table.sz_row_log + -- MLX5HWS_MATCHER_ACTION_RTC_UPDATE_MULT; -- hws_matcher_set_pool_attr(&pool_attr, matcher); -- action_ste->pool = mlx5hws_pool_create(ctx, &pool_attr); -- if (!action_ste->pool) { -- mlx5hws_err(ctx, "Failed to create action ste pool\n"); -- return -EINVAL; -- } -- -- /* Allocate action RTC */ -- ret = hws_matcher_create_rtc(matcher, HWS_MATCHER_RTC_TYPE_STE_ARRAY); -- if (ret) { -- mlx5hws_err(ctx, "Failed to create action RTC\n"); -- goto free_ste_pool; -- } -- -- /* Allocate STC for jumps to STE */ -- stc_attr.action_offset = MLX5HWS_ACTION_OFFSET_HIT; -- stc_attr.action_type = MLX5_IFC_STC_ACTION_TYPE_JUMP_TO_STE_TABLE; -- stc_attr.reparse_mode = MLX5_IFC_STC_REPARSE_IGNORE; -- stc_attr.ste_table.ste_pool = action_ste->pool; -- stc_attr.ste_table.match_definer_id = ctx->caps->trivial_match_definer; -- -- ret = mlx5hws_action_alloc_single_stc(ctx, &stc_attr, tbl->type, -- &action_ste->stc); -- if (ret) { -- mlx5hws_err(ctx, "Failed to create action jump to table STC\n"); -- goto free_rtc; -- } -+ matcher->num_of_action_stes = max_stes; - - return 0; -- --free_rtc: -- hws_matcher_destroy_rtc(matcher, HWS_MATCHER_RTC_TYPE_STE_ARRAY); --free_ste_pool: -- mlx5hws_pool_destroy(action_ste->pool); -- return ret; --} -- --static void hws_matcher_unbind_at(struct mlx5hws_matcher *matcher) --{ -- struct mlx5hws_matcher_action_ste *action_ste; -- struct mlx5hws_table *tbl = matcher->tbl; -- -- action_ste = &matcher->action_ste; -- -- if (!action_ste->max_stes || -- matcher->flags & MLX5HWS_MATCHER_FLAGS_COLLISION || -- mlx5hws_matcher_is_in_resize(matcher)) -- return; -- -- mlx5hws_action_free_single_stc(tbl->ctx, tbl->type, &action_ste->stc); -- hws_matcher_destroy_rtc(matcher, HWS_MATCHER_RTC_TYPE_STE_ARRAY); -- mlx5hws_pool_destroy(action_ste->pool); - } - - static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) -@@ -723,10 +526,10 @@ static int hws_matcher_create_and_connect(struct mlx5hws_matcher *matcher) - /* Create matcher end flow table anchor */ - ret = hws_matcher_create_end_ft(matcher); - if (ret) -- goto unbind_at; -+ goto unbind_mt; - - /* Allocate the RTC for the new matcher */ -- ret = hws_matcher_create_rtc(matcher, HWS_MATCHER_RTC_TYPE_MATCH); -+ ret = hws_matcher_create_rtc(matcher); - if (ret) - goto destroy_end_ft; - -@@ -738,11 +541,9 @@ static int hws_matcher_create_and_connect(struct mlx5hws_matcher *matcher) - return 0; - - destroy_rtc: -- hws_matcher_destroy_rtc(matcher, HWS_MATCHER_RTC_TYPE_MATCH); -+ hws_matcher_destroy_rtc(matcher); - destroy_end_ft: - hws_matcher_destroy_end_ft(matcher); --unbind_at: -- hws_matcher_unbind_at(matcher); - unbind_mt: - hws_matcher_unbind_mt(matcher); - return ret; -@@ -750,11 +551,9 @@ static int hws_matcher_create_and_connect(struct mlx5hws_matcher *matcher) - - static void hws_matcher_destroy_and_disconnect(struct mlx5hws_matcher *matcher) - { -- hws_matcher_resize_uninit(matcher); - hws_matcher_disconnect(matcher); -- hws_matcher_destroy_rtc(matcher, HWS_MATCHER_RTC_TYPE_MATCH); -+ hws_matcher_destroy_rtc(matcher); - hws_matcher_destroy_end_ft(matcher); -- hws_matcher_unbind_at(matcher); - hws_matcher_unbind_mt(matcher); - } - -@@ -776,8 +575,6 @@ hws_matcher_create_col_matcher(struct mlx5hws_matcher *matcher) - if (!col_matcher) - return -ENOMEM; - -- INIT_LIST_HEAD(&col_matcher->resize_data); -- - col_matcher->tbl = matcher->tbl; - col_matcher->mt = matcher->mt; - col_matcher->at = matcher->at; -@@ -831,8 +628,6 @@ static int hws_matcher_init(struct mlx5hws_matcher *matcher) - struct mlx5hws_context *ctx = matcher->tbl->ctx; - int ret; - -- INIT_LIST_HEAD(&matcher->resize_data); -- - mutex_lock(&ctx->ctrl_lock); - - /* Allocate matcher resource and connect to the packet pipe */ -@@ -889,16 +684,12 @@ static int hws_matcher_grow_at_array(struct mlx5hws_matcher *matcher) - } - - int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, -- struct mlx5hws_action_template *at, -- bool *need_rehash) -+ struct mlx5hws_action_template *at) - { - bool is_jumbo = mlx5hws_matcher_mt_is_jumbo(matcher->mt); -- struct mlx5hws_context *ctx = matcher->tbl->ctx; - u32 required_stes; - int ret; - -- *need_rehash = false; -- - if (unlikely(matcher->num_of_at >= matcher->size_of_at_array)) { - ret = hws_matcher_grow_at_array(matcher); - if (ret) -@@ -916,11 +707,8 @@ int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, - return ret; - - required_stes = at->num_of_action_stes - (!is_jumbo || at->only_term); -- if (matcher->action_ste.max_stes < required_stes) { -- mlx5hws_dbg(ctx, "Required STEs [%d] exceeds initial action template STE [%d]\n", -- required_stes, matcher->action_ste.max_stes); -- *need_rehash = true; -- } -+ if (matcher->num_of_action_stes < required_stes) -+ matcher->num_of_action_stes = required_stes; - - matcher->at[matcher->num_of_at] = *at; - matcher->num_of_at += 1; -@@ -1102,7 +890,7 @@ static int hws_matcher_resize_precheck(struct mlx5hws_matcher *src_matcher, - return -EINVAL; - } - -- if (src_matcher->action_ste.max_stes > dst_matcher->action_ste.max_stes) { -+ if (src_matcher->num_of_action_stes > dst_matcher->num_of_action_stes) { - mlx5hws_err(ctx, "Src/dst matcher max STEs mismatch\n"); - return -EINVAL; - } -@@ -1131,10 +919,6 @@ int mlx5hws_matcher_resize_set_target(struct mlx5hws_matcher *src_matcher, - - src_matcher->resize_dst = dst_matcher; - -- ret = hws_matcher_resize_init(src_matcher); -- if (ret) -- src_matcher->resize_dst = NULL; -- - out: - mutex_unlock(&src_matcher->tbl->ctx->ctrl_lock); - return ret; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index 0450b6175ac9..bad1fa8f77fd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -50,23 +50,6 @@ struct mlx5hws_matcher_match_ste { - struct mlx5hws_pool *pool; - }; - --struct mlx5hws_matcher_action_ste { -- struct mlx5hws_pool_chunk stc; -- u32 rtc_0_id; -- u32 rtc_1_id; -- struct mlx5hws_pool *pool; -- u8 max_stes; --}; -- --struct mlx5hws_matcher_resize_data { -- struct mlx5hws_pool_chunk stc; -- u32 rtc_0_id; -- u32 rtc_1_id; -- struct mlx5hws_pool *pool; -- u8 max_stes; -- struct list_head list_node; --}; -- - struct mlx5hws_matcher { - struct mlx5hws_table *tbl; - struct mlx5hws_matcher_attr attr; -@@ -75,15 +58,14 @@ struct mlx5hws_matcher { - u8 num_of_at; - u8 size_of_at_array; - u8 num_of_mt; -+ u8 num_of_action_stes; - /* enum mlx5hws_matcher_flags */ - u8 flags; - u32 end_ft_id; - struct mlx5hws_matcher *col_matcher; - struct mlx5hws_matcher *resize_dst; - struct mlx5hws_matcher_match_ste match_ste; -- struct mlx5hws_matcher_action_ste action_ste; - struct list_head list_node; -- struct list_head resize_data; - }; - - static inline bool -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 8ed8a715a2eb..5121951f2778 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -399,14 +399,11 @@ int mlx5hws_matcher_destroy(struct mlx5hws_matcher *matcher); - * - * @matcher: Matcher to attach the action template to. - * @at: Action template to be attached to the matcher. -- * @need_rehash: Output parameter that tells callers if the matcher needs to be -- * rehashed. - * - * Return: Zero on success, non-zero otherwise. - */ - int mlx5hws_matcher_attach_at(struct mlx5hws_matcher *matcher, -- struct mlx5hws_action_template *at, -- bool *need_rehash); -+ struct mlx5hws_action_template *at); - - /** - * mlx5hws_matcher_resize_set_target - Link two matchers and enable moving rules. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -index 5b758467ed03..9e6f35d68445 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -@@ -203,7 +203,7 @@ static int mlx5hws_rule_alloc_action_ste(struct mlx5hws_rule *rule, - struct mlx5hws_context *ctx = matcher->tbl->ctx; - - rule->action_ste.ste.order = -- ilog2(roundup_pow_of_two(matcher->action_ste.max_stes)); -+ ilog2(roundup_pow_of_two(matcher->num_of_action_stes)); - return mlx5hws_action_ste_chunk_alloc(&ctx->action_ste_pool[queue_id], - skip_rx, skip_tx, - &rule->action_ste); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1356-net-mlx5-hws-free-unused-action-ste-tables.patch b/SOURCES/1356-net-mlx5-hws-free-unused-action-ste-tables.patch deleted file mode 100644 index 2765fcc4c..000000000 --- a/SOURCES/1356-net-mlx5-hws-free-unused-action-ste-tables.patch +++ /dev/null @@ -1,254 +0,0 @@ -From b2936ce02b8545dd8b6b4bc1a135ba7d19d63488 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:00 -0400 -Subject: [PATCH] net/mlx5: HWS, Free unused action STE tables - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 864531ca2072c55ff00ba9dfd8c15cf0f576051b -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:41 2025 +0300 - - net/mlx5: HWS, Free unused action STE tables - - Periodically check for unused action STE tables and free their - associated resources. In order to do this safely, add a per-queue lock - to synchronize the garbage collect work with regular operations on - steering rules. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-12-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c -index cb6ad8411631..5766a9c82f96 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.c -@@ -159,6 +159,7 @@ hws_action_ste_table_alloc(struct mlx5hws_action_ste_pool_element *parent_elem) - - action_tbl->parent_elem = parent_elem; - INIT_LIST_HEAD(&action_tbl->list_node); -+ action_tbl->last_used = jiffies; - list_add(&action_tbl->list_node, &parent_elem->available); - parent_elem->log_sz = log_sz; - -@@ -236,6 +237,8 @@ static int hws_action_ste_pool_init(struct mlx5hws_context *ctx, - enum mlx5hws_pool_optimize opt; - int err; - -+ mutex_init(&pool->lock); -+ - /* Rules which are added for both RX and TX must use the same action STE - * indices for both. If we were to use a single table, then RX-only and - * TX-only rules would waste the unused entries. Thus, we use separate -@@ -247,6 +250,7 @@ static int hws_action_ste_pool_init(struct mlx5hws_context *ctx, - opt); - if (err) - goto destroy_elems; -+ pool->elems[opt].parent_pool = pool; - } - - return 0; -@@ -267,6 +271,58 @@ static void hws_action_ste_pool_destroy(struct mlx5hws_action_ste_pool *pool) - hws_action_ste_pool_element_destroy(&pool->elems[opt]); - } - -+static void hws_action_ste_pool_element_collect_stale( -+ struct mlx5hws_action_ste_pool_element *elem, struct list_head *cleanup) -+{ -+ struct mlx5hws_action_ste_table *action_tbl, *p; -+ unsigned long expire_time, now; -+ -+ expire_time = secs_to_jiffies(MLX5HWS_ACTION_STE_POOL_EXPIRE_SECONDS); -+ now = jiffies; -+ -+ list_for_each_entry_safe(action_tbl, p, &elem->available, list_node) { -+ if (mlx5hws_pool_full(action_tbl->pool) && -+ time_before(action_tbl->last_used + expire_time, now)) -+ list_move(&action_tbl->list_node, cleanup); -+ } -+} -+ -+static void hws_action_ste_table_cleanup_list(struct list_head *cleanup) -+{ -+ struct mlx5hws_action_ste_table *action_tbl, *p; -+ -+ list_for_each_entry_safe(action_tbl, p, cleanup, list_node) -+ hws_action_ste_table_destroy(action_tbl); -+} -+ -+static void hws_action_ste_pool_cleanup(struct work_struct *work) -+{ -+ enum mlx5hws_pool_optimize opt; -+ struct mlx5hws_context *ctx; -+ LIST_HEAD(cleanup); -+ int i; -+ -+ ctx = container_of(work, struct mlx5hws_context, -+ action_ste_cleanup.work); -+ -+ for (i = 0; i < ctx->queues; i++) { -+ struct mlx5hws_action_ste_pool *p = &ctx->action_ste_pool[i]; -+ -+ mutex_lock(&p->lock); -+ for (opt = MLX5HWS_POOL_OPTIMIZE_NONE; -+ opt < MLX5HWS_POOL_OPTIMIZE_MAX; opt++) -+ hws_action_ste_pool_element_collect_stale( -+ &p->elems[opt], &cleanup); -+ mutex_unlock(&p->lock); -+ } -+ -+ hws_action_ste_table_cleanup_list(&cleanup); -+ -+ schedule_delayed_work(&ctx->action_ste_cleanup, -+ secs_to_jiffies( -+ MLX5HWS_ACTION_STE_POOL_CLEANUP_SECONDS)); -+} -+ - int mlx5hws_action_ste_pool_init(struct mlx5hws_context *ctx) - { - struct mlx5hws_action_ste_pool *pool; -@@ -285,6 +341,12 @@ int mlx5hws_action_ste_pool_init(struct mlx5hws_context *ctx) - - ctx->action_ste_pool = pool; - -+ INIT_DELAYED_WORK(&ctx->action_ste_cleanup, -+ hws_action_ste_pool_cleanup); -+ schedule_delayed_work( -+ &ctx->action_ste_cleanup, -+ secs_to_jiffies(MLX5HWS_ACTION_STE_POOL_CLEANUP_SECONDS)); -+ - return 0; - - free_pool: -@@ -300,6 +362,8 @@ void mlx5hws_action_ste_pool_uninit(struct mlx5hws_context *ctx) - size_t queues = ctx->queues; - int i; - -+ cancel_delayed_work_sync(&ctx->action_ste_cleanup); -+ - for (i = 0; i < queues; i++) - hws_action_ste_pool_destroy(&ctx->action_ste_pool[i]); - -@@ -330,6 +394,7 @@ hws_action_ste_table_chunk_alloc(struct mlx5hws_action_ste_table *action_tbl, - return err; - - chunk->action_tbl = action_tbl; -+ action_tbl->last_used = jiffies; - - return 0; - } -@@ -346,6 +411,8 @@ int mlx5hws_action_ste_chunk_alloc(struct mlx5hws_action_ste_pool *pool, - if (skip_rx && skip_tx) - return -EINVAL; - -+ mutex_lock(&pool->lock); -+ - elem = hws_action_ste_choose_elem(pool, skip_rx, skip_tx); - - mlx5hws_dbg(elem->ctx, -@@ -362,26 +429,39 @@ int mlx5hws_action_ste_chunk_alloc(struct mlx5hws_action_ste_pool *pool, - - if (!found) { - action_tbl = hws_action_ste_table_alloc(elem); -- if (IS_ERR(action_tbl)) -- return PTR_ERR(action_tbl); -+ if (IS_ERR(action_tbl)) { -+ err = PTR_ERR(action_tbl); -+ goto out; -+ } - - err = hws_action_ste_table_chunk_alloc(action_tbl, chunk); - if (err) -- return err; -+ goto out; - } - - if (mlx5hws_pool_empty(action_tbl->pool)) - list_move(&action_tbl->list_node, &elem->full); - -- return 0; -+ err = 0; -+ -+out: -+ mutex_unlock(&pool->lock); -+ -+ return err; - } - - void mlx5hws_action_ste_chunk_free(struct mlx5hws_action_ste_chunk *chunk) - { -+ struct mutex *lock = &chunk->action_tbl->parent_elem->parent_pool->lock; -+ - mlx5hws_dbg(chunk->action_tbl->pool->ctx, - "Freeing action STEs offset %d order %d\n", - chunk->ste.offset, chunk->ste.order); -+ -+ mutex_lock(lock); - mlx5hws_pool_chunk_free(chunk->action_tbl->pool, &chunk->ste); -+ chunk->action_tbl->last_used = jiffies; - list_move(&chunk->action_tbl->list_node, - &chunk->action_tbl->parent_elem->available); -+ mutex_unlock(lock); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h -index 2de660a63223..a8ba97359e31 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action_ste_pool.h -@@ -8,6 +8,9 @@ - #define MLX5HWS_ACTION_STE_TABLE_STEP_LOG_SZ 1 - #define MLX5HWS_ACTION_STE_TABLE_MAX_LOG_SZ 20 - -+#define MLX5HWS_ACTION_STE_POOL_CLEANUP_SECONDS 300 -+#define MLX5HWS_ACTION_STE_POOL_EXPIRE_SECONDS 300 -+ - struct mlx5hws_action_ste_pool_element; - - struct mlx5hws_action_ste_table { -@@ -19,10 +22,12 @@ struct mlx5hws_action_ste_table { - u32 rtc_0_id; - u32 rtc_1_id; - struct list_head list_node; -+ unsigned long last_used; - }; - - struct mlx5hws_action_ste_pool_element { - struct mlx5hws_context *ctx; -+ struct mlx5hws_action_ste_pool *parent_pool; - size_t log_sz; /* Size of the largest table so far. */ - enum mlx5hws_pool_optimize opt; - struct list_head available; -@@ -33,6 +38,12 @@ struct mlx5hws_action_ste_pool_element { - * per queue. - */ - struct mlx5hws_action_ste_pool { -+ /* Protects the entire pool. We have one pool per queue and only one -+ * operation can be active per rule at a given time. Thus this lock -+ * protects solely against concurrent garbage collection and we expect -+ * very little contention. -+ */ -+ struct mutex lock; - struct mlx5hws_action_ste_pool_element elems[MLX5HWS_POOL_OPTIMIZE_MAX]; - }; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -index e987e93bbc6e..3f8938c73dc0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/context.h -@@ -40,6 +40,7 @@ struct mlx5hws_context { - u32 pd_num; - struct mlx5hws_pool *stc_pool; - struct mlx5hws_action_ste_pool *action_ste_pool; /* One per queue */ -+ struct delayed_work action_ste_cleanup; - struct mlx5hws_context_common_res common_res; - struct mlx5hws_pattern_cache *pattern_cache; - struct mlx5hws_definer_cache *definer_cache; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1357-net-mlx5-hws-export-action-ste-tables-to-debugfs.patch b/SOURCES/1357-net-mlx5-hws-export-action-ste-tables-to-debugfs.patch deleted file mode 100644 index 33798c861..000000000 --- a/SOURCES/1357-net-mlx5-hws-export-action-ste-tables-to-debugfs.patch +++ /dev/null @@ -1,99 +0,0 @@ -From d1985c5a5885ee6fa478036997488534d181983c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:01 -0400 -Subject: [PATCH] net/mlx5: HWS, Export action STE tables to debugfs - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3db55f8cc8d329a97e06fb44347b64a0ca44e780 -Author: Vlad Dogaru -Date: Thu Apr 10 22:17:42 2025 +0300 - - net/mlx5: HWS, Export action STE tables to debugfs - - Introduce a new type of dump object and dump all action STE tables, - along with information on their RTCs and STEs. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Hamdan Agbariya - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Kubiak - Link: https://patch.msgid.link/1744312662-356571-13-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -index 38f75dec9cfc..91568d6c1dac 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -@@ -387,10 +387,41 @@ static int hws_debug_dump_context_stc(struct seq_file *f, struct mlx5hws_context - return 0; - } - -+static void -+hws_debug_dump_action_ste_table(struct seq_file *f, -+ struct mlx5hws_action_ste_table *action_tbl) -+{ -+ int ste_0_id = mlx5hws_pool_get_base_id(action_tbl->pool); -+ int ste_1_id = mlx5hws_pool_get_base_mirror_id(action_tbl->pool); -+ -+ seq_printf(f, "%d,0x%llx,%d,%d,%d,%d\n", -+ MLX5HWS_DEBUG_RES_TYPE_ACTION_STE_TABLE, -+ HWS_PTR_TO_ID(action_tbl), -+ action_tbl->rtc_0_id, ste_0_id, -+ action_tbl->rtc_1_id, ste_1_id); -+} -+ -+static void hws_debug_dump_action_ste_pool(struct seq_file *f, -+ struct mlx5hws_action_ste_pool *pool) -+{ -+ struct mlx5hws_action_ste_table *action_tbl; -+ enum mlx5hws_pool_optimize opt; -+ -+ mutex_lock(&pool->lock); -+ for (opt = MLX5HWS_POOL_OPTIMIZE_NONE; opt < MLX5HWS_POOL_OPTIMIZE_MAX; -+ opt++) { -+ list_for_each_entry(action_tbl, &pool->elems[opt].available, -+ list_node) { -+ hws_debug_dump_action_ste_table(f, action_tbl); -+ } -+ } -+ mutex_unlock(&pool->lock); -+} -+ - static int hws_debug_dump_context(struct seq_file *f, struct mlx5hws_context *ctx) - { - struct mlx5hws_table *tbl; -- int ret; -+ int ret, i; - - ret = hws_debug_dump_context_info(f, ctx); - if (ret) -@@ -410,6 +441,9 @@ static int hws_debug_dump_context(struct seq_file *f, struct mlx5hws_context *ct - return ret; - } - -+ for (i = 0; i < ctx->queues; i++) -+ hws_debug_dump_action_ste_pool(f, &ctx->action_ste_pool[i]); -+ - return 0; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.h -index e44e7ae28f93..89c396f9f266 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.h -@@ -26,6 +26,8 @@ enum mlx5hws_debug_res_type { - MLX5HWS_DEBUG_RES_TYPE_MATCHER_TEMPLATE_HASH_DEFINER = 4205, - MLX5HWS_DEBUG_RES_TYPE_MATCHER_TEMPLATE_RANGE_DEFINER = 4206, - MLX5HWS_DEBUG_RES_TYPE_MATCHER_TEMPLATE_COMPARE_MATCH_DEFINER = 4207, -+ -+ MLX5HWS_DEBUG_RES_TYPE_ACTION_STE_TABLE = 4300, - }; - - static inline u64 --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1358-net-mlx5e-ethtool-fix-formatting-of-ptp-rq0-csum-complete-ta.patch b/SOURCES/1358-net-mlx5e-ethtool-fix-formatting-of-ptp-rq0-csum-complete-ta.patch deleted file mode 100644 index 9cc47baaf..000000000 --- a/SOURCES/1358-net-mlx5e-ethtool-fix-formatting-of-ptp-rq0-csum-complete-ta.patch +++ /dev/null @@ -1,100 +0,0 @@ -From e0fb28731ba130ec0f45f724aa5c27a9d49f363d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:01 -0400 -Subject: [PATCH] net/mlx5e: ethtool: Fix formatting of - ptp_rq0_csum_complete_tail_slow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cfba1d1b61ae3f32e4bc06e9860711a4488d98b7 -Author: Kees Cook -Date: Tue Apr 15 19:01:14 2025 -0700 - - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow - - The new GCC 15 warning -Wunterminated-string-initialization reports: - - In file included from drivers/net/ethernet/mellanox/mlx5/core/en.h:55, - from drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:34: - drivers/net/ethernet/mellanox/mlx5/core/en_stats.h:57:46: warning: initializer-string for array of 'char' truncates NUL terminator but destination lacks 'nonstring' attribute (33 chars into 32 available) [-Wunterminated-string-initialization] - 57 | #define MLX5E_DECLARE_PTP_RQ_STAT(type, fld) "ptp_rq%d_"#fld, offsetof(type, fld) - | ^~~~~~~~~~~ - drivers/net/ethernet/mellanox/mlx5/core/en_stats.c:2279:11: note: in expansion of macro 'MLX5E_DECLARE_PTP_RQ_STAT' - 2279 | { MLX5E_DECLARE_PTP_RQ_STAT(struct mlx5e_rq_stats, csum_complete_tail_slow) }, - | ^~~~~~~~~~~~~~~~~~~~~~~~~ - - This stat string is being used in ethtool_sprintf(), so it must be a - valid NUL-terminated string. Currently the string lacks the final NUL - byte (as GCC warns), but by absolute luck, the next byte in memory is a - space (decimal 32) followed by a NUL. "format" is immediately followed - by little-endian size_t: - - struct counter_desc { - char format[32]; /* 0 32 */ - size_t offset; /* 32 8 */ - }; - - The "offset" member is populated by the stats member offset: - - #define MLX5E_DECLARE_PTP_RQ_STAT(type, fld) "ptp_rq%d_"#fld, offsetof(type, fld) - - which for this struct mlx5e_rq_stats member, csum_complete_tail_slow, is - 32, or space, and then the rest of the "offset" bytes are NULs. - - struct mlx5e_rq_stats { - ... - u64 csum_complete_tail_slow; /* 32 8 */ - - The use of vsnprintf(), within ethtool_sprintf(), reads past the end of - "format" and sees the format string as "ptp_rq%d_csum_complete_tail_slow ", - with %d getting resolved by MLX5E_PTP_CHANNEL_IX (value 0): - - ethtool_sprintf(data, ptp_rq_stats_desc[i].format, - MLX5E_PTP_CHANNEL_IX); - - With an output result of "ptp_rq0_csum_complete_tail_slow", which gets - precisely truncated to 31 characters with a trailing NUL. - - So, instead of accidentally getting this correct due to the NUL bytes - at the end of the size_t that happens to follow the format string, just - make the string initializer 1 byte shorter by replacing "%d" with "0", - since MLX5E_PTP_CHANNEL_IX is already hard-coded. This results in no - initializer truncation and no need to call sprintf(). - - Signed-off-by: Kees Cook - Reviewed-by: Dragos Tatulea - Link: https://patch.msgid.link/20250416020109.work.297-kees@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -index 1c121b435016..19664fa7f217 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -@@ -2424,8 +2424,7 @@ static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(ptp) - } - if (priv->rx_ptp_opened) { - for (i = 0; i < NUM_PTP_RQ_STATS; i++) -- ethtool_sprintf(data, ptp_rq_stats_desc[i].format, -- MLX5E_PTP_CHANNEL_IX); -+ ethtool_puts(data, ptp_rq_stats_desc[i].format); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -index 8de6fcbd3a03..def5dea1463d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -@@ -54,7 +54,7 @@ - #define MLX5E_DECLARE_PTP_TX_STAT(type, fld) "ptp_tx%d_"#fld, offsetof(type, fld) - #define MLX5E_DECLARE_PTP_CH_STAT(type, fld) "ptp_ch_"#fld, offsetof(type, fld) - #define MLX5E_DECLARE_PTP_CQ_STAT(type, fld) "ptp_cq%d_"#fld, offsetof(type, fld) --#define MLX5E_DECLARE_PTP_RQ_STAT(type, fld) "ptp_rq%d_"#fld, offsetof(type, fld) -+#define MLX5E_DECLARE_PTP_RQ_STAT(type, fld) "ptp_rq0_"#fld, offsetof(type, fld) - - #define MLX5E_DECLARE_QOS_TX_STAT(type, fld) "qos_tx%d_"#fld, offsetof(type, fld) - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1359-net-mlx5-fix-spelling-mistakes-in-mlx5-core-dbg-message-and-.patch b/SOURCES/1359-net-mlx5-fix-spelling-mistakes-in-mlx5-core-dbg-message-and-.patch deleted file mode 100644 index 16142c908..000000000 --- a/SOURCES/1359-net-mlx5-fix-spelling-mistakes-in-mlx5-core-dbg-message-and-.patch +++ /dev/null @@ -1,58 +0,0 @@ -From 3a54d4daa0cfe0a44c2f8cdc68d5b0c8b277a990 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:01 -0400 -Subject: [PATCH] net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and - comments - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1e36473215297708dbe144c65b9f242c6e604520 -Author: Colin Ian King -Date: Fri Apr 18 14:57:03 2025 +0100 - - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments - - There is a spelling mistake in a mlx5_core_dbg and two spelling mistakes - in comment blocks. Fix them. - - Signed-off-by: Colin Ian King - Acked-by: Mark Bloch - Link: https://patch.msgid.link/20250418135703.542722-1-colin.i.king@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index 2c5f850c31f6..40024cfa3099 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -148,7 +148,7 @@ int mlx5_set_msix_vec_count(struct mlx5_core_dev *dev, int function_id, - * Free the IRQ and other resources such as rmap from the system. - * BUT doesn't free or remove reference from mlx5. - * This function is very important for the shutdown flow, where we need to -- * cleanup system resoruces but keep mlx5 objects alive, -+ * cleanup system resources but keep mlx5 objects alive, - * see mlx5_irq_table_free_irqs(). - */ - static void mlx5_system_free_irq(struct mlx5_irq *irq) -@@ -588,7 +588,7 @@ static void irq_pool_free(struct mlx5_irq_pool *pool) - struct mlx5_irq *irq; - unsigned long index; - -- /* There are cases in which we are destrying the irq_table before -+ /* There are cases in which we are destroying the irq_table before - * freeing all the IRQs, fast teardown for example. Hence, free the irqs - * which might not have been freed. - */ -@@ -617,7 +617,7 @@ static int irq_pools_init(struct mlx5_core_dev *dev, int sf_vec, int pcif_vec, - if (!mlx5_sf_max_functions(dev)) - return 0; - if (sf_vec < MLX5_IRQ_VEC_COMP_BASE_SF) { -- mlx5_core_dbg(dev, "Not enught IRQs for SFs. SF may run at lower performance\n"); -+ mlx5_core_dbg(dev, "Not enough IRQs for SFs. SF may run at lower performance\n"); - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1360-net-mlx5-hws-fix-ip-version-decision.patch b/SOURCES/1360-net-mlx5-hws-fix-ip-version-decision.patch deleted file mode 100644 index 90bcbf77b..000000000 --- a/SOURCES/1360-net-mlx5-hws-fix-ip-version-decision.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 988625f598a4722c53b34743d5ddef5d48a46a20 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:02 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix IP version decision - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5f2f8d8b6800e4fc760c2eccec9b2bd2cacf80cf -Author: Vlad Dogaru -Date: Tue Apr 22 12:25:38 2025 +0300 - - net/mlx5: HWS, Fix IP version decision - - Unify the check for IP version when creating a definer. A given matcher - is deemed to match on IPv6 if any of the higher order (>31) bits of - source or destination address mask are set. - - A single packet cannot mix IP versions between source and destination - addresses, so it makes no sense that they would be decided on - independently. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250422092540.182091-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index c8cc0c8115f5..5257e706dde2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -509,9 +509,9 @@ static int - hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - u32 *match_param) - { -- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; - struct mlx5hws_definer_fc *fc = cd->fc; - struct mlx5hws_definer_fc *curr_fc; -+ bool is_ipv6, smac_set, dmac_set; - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || -@@ -570,10 +570,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - outer_headers.dst_ipv4_dst_ipv6.ipv6_layout); - - /* Assume IPv6 is used if ipv6 bits are set */ -- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; -- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; -+ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || -+ d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; - -- if (is_s_ipv6) { -+ if (is_ipv6) { - /* Handle IPv6 source address */ - HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, - outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, -@@ -587,13 +587,6 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_O, - outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv6_src_outer.ipv6_address_31_0); -- } else { -- /* Handle IPv4 source address */ -- HWS_SET_HDR(fc, match_param, IPV4_SRC_O, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, -- ipv4_src_dest_outer.source_address); -- } -- if (is_d_ipv6) { - /* Handle IPv6 destination address */ - HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_O, - outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, -@@ -608,6 +601,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv6_dst_outer.ipv6_address_31_0); - } else { -+ /* Handle IPv4 source address */ -+ HWS_SET_HDR(fc, match_param, IPV4_SRC_O, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, -+ ipv4_src_dest_outer.source_address); - /* Handle IPv4 destination address */ - HWS_SET_HDR(fc, match_param, IPV4_DST_O, - outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, -@@ -665,9 +662,9 @@ static int - hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - u32 *match_param) - { -- bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; - struct mlx5hws_definer_fc *fc = cd->fc; - struct mlx5hws_definer_fc *curr_fc; -+ bool is_ipv6, smac_set, dmac_set; - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || -@@ -728,10 +725,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - inner_headers.dst_ipv4_dst_ipv6.ipv6_layout); - - /* Assume IPv6 is used if ipv6 bits are set */ -- is_s_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; -- is_d_ipv6 = d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; -+ is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || -+ d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; - -- if (is_s_ipv6) { -+ if (is_ipv6) { - /* Handle IPv6 source address */ - HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, - inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, -@@ -745,13 +742,6 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_I, - inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv6_src_inner.ipv6_address_31_0); -- } else { -- /* Handle IPv4 source address */ -- HWS_SET_HDR(fc, match_param, IPV4_SRC_I, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, -- ipv4_src_dest_inner.source_address); -- } -- if (is_d_ipv6) { - /* Handle IPv6 destination address */ - HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_I, - inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, -@@ -766,6 +756,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv6_dst_inner.ipv6_address_31_0); - } else { -+ /* Handle IPv4 source address */ -+ HWS_SET_HDR(fc, match_param, IPV4_SRC_I, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, -+ ipv4_src_dest_inner.source_address); - /* Handle IPv4 destination address */ - HWS_SET_HDR(fc, match_param, IPV4_DST_I, - inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1361-net-mlx5-hws-harden-ip-version-definer-checks.patch b/SOURCES/1361-net-mlx5-hws-harden-ip-version-definer-checks.patch deleted file mode 100644 index 2ca5aecb8..000000000 --- a/SOURCES/1361-net-mlx5-hws-harden-ip-version-definer-checks.patch +++ /dev/null @@ -1,127 +0,0 @@ -From 024b08ee6e9f4a7d00dcdbde0e76f34bebc32c27 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:02 -0400 -Subject: [PATCH] net/mlx5: HWS, Harden IP version definer checks - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6991a975e416154576b0f5f06256aec13e23b0a7 -Author: Vlad Dogaru -Date: Tue Apr 22 12:25:39 2025 +0300 - - net/mlx5: HWS, Harden IP version definer checks - - Replicate some sanity checks that firmware does, since hardware steering - does not go through firmware. - - When creating a definer, disallow matching on IP addresses without also - matching on IP version. The latter can be satisfied by matching either - on the version field in the IP header, or on the ethertype field. - - Also refuse to match IPv4 IHL alongside IPv6. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250422092540.182091-3-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index 5257e706dde2..1061a46811ac 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -509,9 +509,9 @@ static int - hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - u32 *match_param) - { -+ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; - struct mlx5hws_definer_fc *fc = cd->fc; - struct mlx5hws_definer_fc *curr_fc; -- bool is_ipv6, smac_set, dmac_set; - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || -@@ -521,6 +521,20 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - return -EINVAL; - } - -+ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param, -+ outer_headers.src_ipv4_src_ipv6, -+ 0x80) || -+ HWS_IS_FLD_SET_SZ(match_param, -+ outer_headers.dst_ipv4_dst_ipv6, 0x80); -+ ip_ver_set = HWS_IS_FLD_SET(match_param, outer_headers.ip_version) || -+ HWS_IS_FLD_SET(match_param, outer_headers.ethertype); -+ -+ if (ip_addr_set && !ip_ver_set) { -+ mlx5hws_err(cd->ctx, -+ "Unsupported match on IP address without version or ethertype\n"); -+ return -EINVAL; -+ } -+ - /* L2 Check ethertype */ - HWS_SET_HDR(fc, match_param, ETH_TYPE_O, - outer_headers.ethertype, -@@ -573,6 +587,12 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || - d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; - -+ /* IHL is an IPv4-specific field. */ -+ if (is_ipv6 && HWS_IS_FLD_SET(match_param, outer_headers.ipv4_ihl)) { -+ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); -+ return -EINVAL; -+ } -+ - if (is_ipv6) { - /* Handle IPv6 source address */ - HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, -@@ -662,9 +682,9 @@ static int - hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - u32 *match_param) - { -+ bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; - struct mlx5hws_definer_fc *fc = cd->fc; - struct mlx5hws_definer_fc *curr_fc; -- bool is_ipv6, smac_set, dmac_set; - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || -@@ -674,6 +694,20 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - return -EINVAL; - } - -+ ip_addr_set = HWS_IS_FLD_SET_SZ(match_param, -+ inner_headers.src_ipv4_src_ipv6, -+ 0x80) || -+ HWS_IS_FLD_SET_SZ(match_param, -+ inner_headers.dst_ipv4_dst_ipv6, 0x80); -+ ip_ver_set = HWS_IS_FLD_SET(match_param, inner_headers.ip_version) || -+ HWS_IS_FLD_SET(match_param, inner_headers.ethertype); -+ -+ if (ip_addr_set && !ip_ver_set) { -+ mlx5hws_err(cd->ctx, -+ "Unsupported match on IP address without version or ethertype\n"); -+ return -EINVAL; -+ } -+ - /* L2 Check ethertype */ - HWS_SET_HDR(fc, match_param, ETH_TYPE_I, - inner_headers.ethertype, -@@ -728,6 +762,12 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - is_ipv6 = s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || - d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; - -+ /* IHL is an IPv4-specific field. */ -+ if (is_ipv6 && HWS_IS_FLD_SET(match_param, inner_headers.ipv4_ihl)) { -+ mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); -+ return -EINVAL; -+ } -+ - if (is_ipv6) { - /* Handle IPv6 source address */ - HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1362-net-mlx5-hws-disallow-matcher-ip-version-mixing.patch b/SOURCES/1362-net-mlx5-hws-disallow-matcher-ip-version-mixing.patch deleted file mode 100644 index 99e189a7c..000000000 --- a/SOURCES/1362-net-mlx5-hws-disallow-matcher-ip-version-mixing.patch +++ /dev/null @@ -1,256 +0,0 @@ -From c0c4826b9a633587cd14595358b62c40a3672204 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:02 -0400 -Subject: [PATCH] net/mlx5: HWS, Disallow matcher IP version mixing - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f41f3edf0b15d7ce0b0f71c00a6125e8d7ca735f -Author: Vlad Dogaru -Date: Tue Apr 22 12:25:40 2025 +0300 - - net/mlx5: HWS, Disallow matcher IP version mixing - - Signal clearly to the user, via an error, that mixing IPv4 and IPv6 - rules in the same matcher is not supported. Previously such cases - silently failed by adding a rule that did not work correctly. - - Rules can specify an IP version by one of two fields: IP version or - ethertype. At matcher creation, store whether the template matches on - any of these two fields. If yes, inspect each rule for its corresponding - match value and store the IP version inside the matcher to guard against - inconsistencies with subsequent rules. - - Furthermore, also check rules for internal consistency, i.e. verify that - the ethertype and IP version match values do not contradict each other. - - The logic applies to inner and outer headers independently, to account - for tunneling. - - Rules that do not match on IP addresses are not affected. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250422092540.182091-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 716502732d3d..5b0c1623499b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -385,6 +385,30 @@ static int hws_matcher_bind_at(struct mlx5hws_matcher *matcher) - return 0; - } - -+static void hws_matcher_set_ip_version_match(struct mlx5hws_matcher *matcher) -+{ -+ int i; -+ -+ for (i = 0; i < matcher->mt->fc_sz; i++) { -+ switch (matcher->mt->fc[i].fname) { -+ case MLX5HWS_DEFINER_FNAME_ETH_TYPE_O: -+ matcher->matches_outer_ethertype = 1; -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_O: -+ matcher->matches_outer_ip_version = 1; -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_TYPE_I: -+ matcher->matches_inner_ethertype = 1; -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_I: -+ matcher->matches_inner_ip_version = 1; -+ break; -+ default: -+ break; -+ } -+ } -+} -+ - static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_context *ctx = matcher->tbl->ctx; -@@ -401,6 +425,8 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - } - } - -+ hws_matcher_set_ip_version_match(matcher); -+ - /* Create an STE pool per matcher*/ - pool_attr.table_type = matcher->tbl->type; - pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index bad1fa8f77fd..8e95158a66b5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -50,6 +50,12 @@ struct mlx5hws_matcher_match_ste { - struct mlx5hws_pool *pool; - }; - -+enum { -+ MLX5HWS_MATCHER_IPV_UNSET = 0, -+ MLX5HWS_MATCHER_IPV_4 = 1, -+ MLX5HWS_MATCHER_IPV_6 = 2, -+}; -+ - struct mlx5hws_matcher { - struct mlx5hws_table *tbl; - struct mlx5hws_matcher_attr attr; -@@ -61,6 +67,12 @@ struct mlx5hws_matcher { - u8 num_of_action_stes; - /* enum mlx5hws_matcher_flags */ - u8 flags; -+ u8 matches_outer_ethertype:1; -+ u8 matches_outer_ip_version:1; -+ u8 matches_inner_ethertype:1; -+ u8 matches_inner_ip_version:1; -+ u8 outer_ip_version:2; -+ u8 inner_ip_version:2; - u32 end_ft_id; - struct mlx5hws_matcher *col_matcher; - struct mlx5hws_matcher *resize_dst; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -index 9e6f35d68445..5342a4cc7194 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -@@ -655,6 +655,124 @@ int mlx5hws_rule_move_hws_add(struct mlx5hws_rule *rule, - return 0; - } - -+static u8 hws_rule_ethertype_to_matcher_ipv(u32 ethertype) -+{ -+ switch (ethertype) { -+ case ETH_P_IP: -+ return MLX5HWS_MATCHER_IPV_4; -+ case ETH_P_IPV6: -+ return MLX5HWS_MATCHER_IPV_6; -+ default: -+ return MLX5HWS_MATCHER_IPV_UNSET; -+ } -+} -+ -+static u8 hws_rule_ip_version_to_matcher_ipv(u32 ip_version) -+{ -+ switch (ip_version) { -+ case 4: -+ return MLX5HWS_MATCHER_IPV_4; -+ case 6: -+ return MLX5HWS_MATCHER_IPV_6; -+ default: -+ return MLX5HWS_MATCHER_IPV_UNSET; -+ } -+} -+ -+static int hws_rule_check_outer_ip_version(struct mlx5hws_matcher *matcher, -+ u32 *match_param) -+{ -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ u8 outer_ipv_ether = MLX5HWS_MATCHER_IPV_UNSET; -+ u8 outer_ipv_ip = MLX5HWS_MATCHER_IPV_UNSET; -+ u8 outer_ipv, ver; -+ -+ if (matcher->matches_outer_ethertype) { -+ ver = MLX5_GET(fte_match_param, match_param, -+ outer_headers.ethertype); -+ outer_ipv_ether = hws_rule_ethertype_to_matcher_ipv(ver); -+ } -+ if (matcher->matches_outer_ip_version) { -+ ver = MLX5_GET(fte_match_param, match_param, -+ outer_headers.ip_version); -+ outer_ipv_ip = hws_rule_ip_version_to_matcher_ipv(ver); -+ } -+ -+ if (outer_ipv_ether != MLX5HWS_MATCHER_IPV_UNSET && -+ outer_ipv_ip != MLX5HWS_MATCHER_IPV_UNSET && -+ outer_ipv_ether != outer_ipv_ip) { -+ mlx5hws_err(ctx, "Rule matches on inconsistent outer ethertype and ip version\n"); -+ return -EINVAL; -+ } -+ -+ outer_ipv = outer_ipv_ether != MLX5HWS_MATCHER_IPV_UNSET ? -+ outer_ipv_ether : outer_ipv_ip; -+ if (outer_ipv != MLX5HWS_MATCHER_IPV_UNSET && -+ matcher->outer_ip_version != MLX5HWS_MATCHER_IPV_UNSET && -+ outer_ipv != matcher->outer_ip_version) { -+ mlx5hws_err(ctx, "Matcher and rule disagree on outer IP version\n"); -+ return -EINVAL; -+ } -+ matcher->outer_ip_version = outer_ipv; -+ -+ return 0; -+} -+ -+static int hws_rule_check_inner_ip_version(struct mlx5hws_matcher *matcher, -+ u32 *match_param) -+{ -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ u8 inner_ipv_ether = MLX5HWS_MATCHER_IPV_UNSET; -+ u8 inner_ipv_ip = MLX5HWS_MATCHER_IPV_UNSET; -+ u8 inner_ipv, ver; -+ -+ if (matcher->matches_inner_ethertype) { -+ ver = MLX5_GET(fte_match_param, match_param, -+ inner_headers.ethertype); -+ inner_ipv_ether = hws_rule_ethertype_to_matcher_ipv(ver); -+ } -+ if (matcher->matches_inner_ip_version) { -+ ver = MLX5_GET(fte_match_param, match_param, -+ inner_headers.ip_version); -+ inner_ipv_ip = hws_rule_ip_version_to_matcher_ipv(ver); -+ } -+ -+ if (inner_ipv_ether != MLX5HWS_MATCHER_IPV_UNSET && -+ inner_ipv_ip != MLX5HWS_MATCHER_IPV_UNSET && -+ inner_ipv_ether != inner_ipv_ip) { -+ mlx5hws_err(ctx, "Rule matches on inconsistent inner ethertype and ip version\n"); -+ return -EINVAL; -+ } -+ -+ inner_ipv = inner_ipv_ether != MLX5HWS_MATCHER_IPV_UNSET ? -+ inner_ipv_ether : inner_ipv_ip; -+ if (inner_ipv != MLX5HWS_MATCHER_IPV_UNSET && -+ matcher->inner_ip_version != MLX5HWS_MATCHER_IPV_UNSET && -+ inner_ipv != matcher->inner_ip_version) { -+ mlx5hws_err(ctx, "Matcher and rule disagree on inner IP version\n"); -+ return -EINVAL; -+ } -+ matcher->inner_ip_version = inner_ipv; -+ -+ return 0; -+} -+ -+static int hws_rule_check_ip_version(struct mlx5hws_matcher *matcher, -+ u32 *match_param) -+{ -+ int ret; -+ -+ ret = hws_rule_check_outer_ip_version(matcher, match_param); -+ if (unlikely(ret)) -+ return ret; -+ -+ ret = hws_rule_check_inner_ip_version(matcher, match_param); -+ if (unlikely(ret)) -+ return ret; -+ -+ return 0; -+} -+ - int mlx5hws_rule_create(struct mlx5hws_matcher *matcher, - u8 mt_idx, - u32 *match_param, -@@ -665,6 +783,10 @@ int mlx5hws_rule_create(struct mlx5hws_matcher *matcher, - { - int ret; - -+ ret = hws_rule_check_ip_version(matcher, match_param); -+ if (unlikely(ret)) -+ return ret; -+ - rule_handle->matcher = matcher; - - ret = hws_rule_enqueue_precheck_create(rule_handle, attr); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1363-rdma-mlx5-fix-error-flow-upon-firmware-failure-for-rq-destru.patch b/SOURCES/1363-rdma-mlx5-fix-error-flow-upon-firmware-failure-for-rq-destru.patch deleted file mode 100644 index 8d49a185b..000000000 --- a/SOURCES/1363-rdma-mlx5-fix-error-flow-upon-firmware-failure-for-rq-destru.patch +++ /dev/null @@ -1,142 +0,0 @@ -From 85e0a9a7588dbdecc6ff8e2facde4a75b8ff4299 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:02 -0400 -Subject: [PATCH] RDMA/mlx5: Fix error flow upon firmware failure for RQ - destruction - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5d2ea5aebbb2f3ebde4403f9c55b2b057e5dd2d6 -Author: Patrisious Haddad -Date: Mon Apr 28 14:34:07 2025 +0300 - - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction - - Upon RQ destruction if the firmware command fails which is the - last resource to be destroyed some SW resources were already cleaned - regardless of the failure. - - Now properly rollback the object to its original state upon such failure. - - In order to avoid a use-after free in case someone tries to destroy the - object again, which results in the following kernel trace: - refcount_t: underflow; use-after-free. - WARNING: CPU: 0 PID: 37589 at lib/refcount.c:28 refcount_warn_saturate+0xf4/0x148 - Modules linked in: rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) ib_umad(OE) mlx5_ib(OE) rfkill mlx5_core(OE) mlxdevm(OE) ib_uverbs(OE) ib_core(OE) psample mlxfw(OE) mlx_compat(OE) macsec tls pci_hyperv_intf sunrpc vfat fat virtio_net net_failover failover fuse loop nfnetlink vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_console virtio_gpu virtio_blk virtio_dma_buf virtio_mmio dm_mirror dm_region_hash dm_log dm_mod xpmem(OE) - CPU: 0 UID: 0 PID: 37589 Comm: python3 Kdump: loaded Tainted: G OE ------- --- 6.12.0-54.el10.aarch64 #1 - Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE - Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 - pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) - pc : refcount_warn_saturate+0xf4/0x148 - lr : refcount_warn_saturate+0xf4/0x148 - sp : ffff80008b81b7e0 - x29: ffff80008b81b7e0 x28: ffff000133d51600 x27: 0000000000000001 - x26: 0000000000000000 x25: 00000000ffffffea x24: ffff00010ae80f00 - x23: ffff00010ae80f80 x22: ffff0000c66e5d08 x21: 0000000000000000 - x20: ffff0000c66e0000 x19: ffff00010ae80340 x18: 0000000000000006 - x17: 0000000000000000 x16: 0000000000000020 x15: ffff80008b81b37f - x14: 0000000000000000 x13: 2e656572662d7265 x12: ffff80008283ef78 - x11: ffff80008257efd0 x10: ffff80008283efd0 x9 : ffff80008021ed90 - x8 : 0000000000000001 x7 : 00000000000bffe8 x6 : c0000000ffff7fff - x5 : ffff0001fb8e3408 x4 : 0000000000000000 x3 : ffff800179993000 - x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff000133d51600 - Call trace: - refcount_warn_saturate+0xf4/0x148 - mlx5_core_put_rsc+0x88/0xa0 [mlx5_ib] - mlx5_core_destroy_rq_tracked+0x64/0x98 [mlx5_ib] - mlx5_ib_destroy_wq+0x34/0x80 [mlx5_ib] - ib_destroy_wq_user+0x30/0xc0 [ib_core] - uverbs_free_wq+0x28/0x58 [ib_uverbs] - destroy_hw_idr_uobject+0x34/0x78 [ib_uverbs] - uverbs_destroy_uobject+0x48/0x240 [ib_uverbs] - __uverbs_cleanup_ufile+0xd4/0x1a8 [ib_uverbs] - uverbs_destroy_ufile_hw+0x48/0x120 [ib_uverbs] - ib_uverbs_close+0x2c/0x100 [ib_uverbs] - __fput+0xd8/0x2f0 - __fput_sync+0x50/0x70 - __arm64_sys_close+0x40/0x90 - invoke_syscall.constprop.0+0x74/0xd0 - do_el0_svc+0x48/0xe8 - el0_svc+0x44/0x1d0 - el0t_64_sync_handler+0x120/0x130 - el0t_64_sync+0x1a4/0x1a8 - - Fixes: e2013b212f9f ("net/mlx5_core: Add RQ and SQ event handling") - Signed-off-by: Patrisious Haddad - Link: https://patch.msgid.link/3181433ccdd695c63560eeeb3f0c990961732101.1745839855.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/qpc.c b/drivers/infiniband/hw/mlx5/qpc.c -index d3dcc272200a..146d03ae40bd 100644 ---- a/drivers/infiniband/hw/mlx5/qpc.c -+++ b/drivers/infiniband/hw/mlx5/qpc.c -@@ -21,8 +21,10 @@ mlx5_get_rsc(struct mlx5_qp_table *table, u32 rsn) - spin_lock_irqsave(&table->lock, flags); - - common = radix_tree_lookup(&table->tree, rsn); -- if (common) -+ if (common && !common->invalid) - refcount_inc(&common->refcount); -+ else -+ common = NULL; - - spin_unlock_irqrestore(&table->lock, flags); - -@@ -178,6 +180,18 @@ static int create_resource_common(struct mlx5_ib_dev *dev, - return 0; - } - -+static void modify_resource_common_state(struct mlx5_ib_dev *dev, -+ struct mlx5_core_qp *qp, -+ bool invalid) -+{ -+ struct mlx5_qp_table *table = &dev->qp_table; -+ unsigned long flags; -+ -+ spin_lock_irqsave(&table->lock, flags); -+ qp->common.invalid = invalid; -+ spin_unlock_irqrestore(&table->lock, flags); -+} -+ - static void destroy_resource_common(struct mlx5_ib_dev *dev, - struct mlx5_core_qp *qp) - { -@@ -609,8 +623,20 @@ int mlx5_core_create_rq_tracked(struct mlx5_ib_dev *dev, u32 *in, int inlen, - int mlx5_core_destroy_rq_tracked(struct mlx5_ib_dev *dev, - struct mlx5_core_qp *rq) - { -+ int ret; -+ -+ /* The rq destruction can be called again in case it fails, hence we -+ * mark the common resource as invalid and only once FW destruction -+ * is completed successfully we actually destroy the resources. -+ */ -+ modify_resource_common_state(dev, rq, true); -+ ret = destroy_rq_tracked(dev, rq->qpn, rq->uid); -+ if (ret) { -+ modify_resource_common_state(dev, rq, false); -+ return ret; -+ } - destroy_resource_common(dev, rq); -- return destroy_rq_tracked(dev, rq->qpn, rq->uid); -+ return 0; - } - - static void destroy_sq_tracked(struct mlx5_ib_dev *dev, u32 sqn, u16 uid) -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 04705078dfab..df76aece6be9 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -398,6 +398,7 @@ struct mlx5_core_rsc_common { - enum mlx5_res_type res; - refcount_t refcount; - struct completion free; -+ bool invalid; - }; - - struct mlx5_uars_page { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1364-net-mlx5-support-software-tx-timestamp.patch b/SOURCES/1364-net-mlx5-support-software-tx-timestamp.patch deleted file mode 100644 index 797cdb438..000000000 --- a/SOURCES/1364-net-mlx5-support-software-tx-timestamp.patch +++ /dev/null @@ -1,78 +0,0 @@ -From caaa5c0c5b3a539eefe31c4fe578b881ba6512bf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:03 -0400 -Subject: [PATCH] net/mlx5: support software TX timestamp - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2451d3fb388f29d87d1abd3d2952d5ce36109816 -Author: Stanislav Fomichev -Date: Thu May 8 16:51:09 2025 -0700 - - net/mlx5: support software TX timestamp - - Having a software timestamp (along with existing hardware one) is - useful to trace how the packets flow through the stack. - mlx5e_tx_skb_update_hwts_flags is called from tx paths - to setup HW timestamp; extend it to add software one as well. - - Reviewed-by: Jason Xing - Signed-off-by: Stanislav Fomichev - Reviewed-by: Vadim Fedorenko - Acked-by: Martin KaFai Lau - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250508235109.585096-1-stfomichev@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 8578f03783bc..e6c9338ddae8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1686,6 +1686,7 @@ int mlx5e_ethtool_get_ts_info(struct mlx5e_priv *priv, - return 0; - - info->so_timestamping = SOF_TIMESTAMPING_TX_HARDWARE | -+ SOF_TIMESTAMPING_TX_SOFTWARE | - SOF_TIMESTAMPING_RX_HARDWARE | - SOF_TIMESTAMPING_RAW_HARDWARE; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -index 4fd853d19e31..55a8629f0792 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -@@ -337,10 +337,11 @@ static void mlx5e_sq_calc_wqe_attr(struct sk_buff *skb, const struct mlx5e_tx_at - }; - } - --static void mlx5e_tx_skb_update_hwts_flags(struct sk_buff *skb) -+static void mlx5e_tx_skb_update_ts_flags(struct sk_buff *skb) - { - if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) - skb_shinfo(skb)->tx_flags |= SKBTX_IN_PROGRESS; -+ skb_tx_timestamp(skb); - } - - static void mlx5e_tx_check_stop(struct mlx5e_txqsq *sq) -@@ -392,7 +393,7 @@ mlx5e_txwqe_complete(struct mlx5e_txqsq *sq, struct sk_buff *skb, - cseg->opmod_idx_opcode = cpu_to_be32((sq->pc << 8) | attr->opcode); - cseg->qpn_ds = cpu_to_be32((sq->sqn << 8) | wqe_attr->ds_cnt); - -- mlx5e_tx_skb_update_hwts_flags(skb); -+ mlx5e_tx_skb_update_ts_flags(skb); - - sq->pc += wi->num_wqebbs; - -@@ -625,7 +626,7 @@ mlx5e_sq_xmit_mpwqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, - mlx5e_dma_push(sq, txd.dma_addr, txd.len, MLX5E_DMA_MAP_SINGLE); - mlx5e_skb_fifo_push(&sq->db.skb_fifo, skb); - mlx5e_tx_mpwqe_add_dseg(sq, &txd); -- mlx5e_tx_skb_update_hwts_flags(skb); -+ mlx5e_tx_skb_update_ts_flags(skb); - - if (unlikely(mlx5e_tx_mpwqe_is_full(&sq->mpwqe))) { - /* Might stop the queue and affect the retval of __netdev_tx_sent_queue. */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1365-net-mlx5-hws-expose-function-mlx5hws-table-ft-set-next-ft-in.patch b/SOURCES/1365-net-mlx5-hws-expose-function-mlx5hws-table-ft-set-next-ft-in.patch deleted file mode 100644 index 0a06f2b0c..000000000 --- a/SOURCES/1365-net-mlx5-hws-expose-function-mlx5hws-table-ft-set-next-ft-in.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 61618987cfeb590d9694abd9fbcdb68f8845d29b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:03 -0400 -Subject: [PATCH] net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft - in header - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d2338a27fcee9158d0378d759152b8e0a5933c88 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:01 2025 +0300 - - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header - - In preparation for complex matcher support, make function - mlx5hws_table_ft_set_next_ft() non-static and expose it in header. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -index ab1297531232..568f691733f3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -@@ -342,10 +342,10 @@ int mlx5hws_table_ft_set_next_rtc(struct mlx5hws_context *ctx, - return mlx5hws_cmd_flow_table_modify(ctx->mdev, &ft_attr, ft_id); - } - --static int hws_table_ft_set_next_ft(struct mlx5hws_context *ctx, -- u32 ft_id, -- u32 fw_ft_type, -- u32 next_ft_id) -+int mlx5hws_table_ft_set_next_ft(struct mlx5hws_context *ctx, -+ u32 ft_id, -+ u32 fw_ft_type, -+ u32 next_ft_id) - { - struct mlx5hws_cmd_ft_modify_attr ft_attr = {0}; - -@@ -389,10 +389,10 @@ int mlx5hws_table_connect_to_miss_table(struct mlx5hws_table *src_tbl, - if (dst_tbl) { - if (list_empty(&dst_tbl->matchers_list)) { - /* Connect src_tbl last_ft to dst_tbl start anchor */ -- ret = hws_table_ft_set_next_ft(src_tbl->ctx, -- last_ft_id, -- src_tbl->fw_ft_type, -- dst_tbl->ft_id); -+ ret = mlx5hws_table_ft_set_next_ft(src_tbl->ctx, -+ last_ft_id, -+ src_tbl->fw_ft_type, -+ dst_tbl->ft_id); - if (ret) - return ret; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -index dd50420eec9e..0400cce0c317 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -@@ -65,4 +65,9 @@ int mlx5hws_table_ft_set_next_rtc(struct mlx5hws_context *ctx, - u32 rtc_0_id, - u32 rtc_1_id); - -+int mlx5hws_table_ft_set_next_ft(struct mlx5hws_context *ctx, -+ u32 ft_id, -+ u32 fw_ft_type, -+ u32 next_ft_id); -+ - #endif /* MLX5HWS_TABLE_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1366-net-mlx5-hws-add-definer-function-to-get-field-name-str.patch b/SOURCES/1366-net-mlx5-hws-add-definer-function-to-get-field-name-str.patch deleted file mode 100644 index 613a39578..000000000 --- a/SOURCES/1366-net-mlx5-hws-add-definer-function-to-get-field-name-str.patch +++ /dev/null @@ -1,263 +0,0 @@ -From f8db8d6e3362f5fac65193f3ece0fffb4ad20588 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:03 -0400 -Subject: [PATCH] net/mlx5: HWS, add definer function to get field name str - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fed5f4831281593a4bda2f8ef6912fdbcad6e670 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:02 2025 +0300 - - net/mlx5: HWS, add definer function to get field name str - - In preparation for complex matcher support, add function for - converting definer fname to str, which will be used in following - patches. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index 1061a46811ac..5cc0dc002ac1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -158,6 +158,218 @@ struct mlx5hws_definer_conv_data { - u32 match_flags; - }; - -+#define HWS_DEFINER_ENTRY(name)[MLX5HWS_DEFINER_FNAME_##name] = #name -+ -+static const char * const hws_definer_fname_to_str[] = { -+ HWS_DEFINER_ENTRY(ETH_SMAC_47_16_O), -+ HWS_DEFINER_ENTRY(ETH_SMAC_47_16_I), -+ HWS_DEFINER_ENTRY(ETH_SMAC_15_0_O), -+ HWS_DEFINER_ENTRY(ETH_SMAC_15_0_I), -+ HWS_DEFINER_ENTRY(ETH_DMAC_47_16_O), -+ HWS_DEFINER_ENTRY(ETH_DMAC_47_16_I), -+ HWS_DEFINER_ENTRY(ETH_DMAC_15_0_O), -+ HWS_DEFINER_ENTRY(ETH_DMAC_15_0_I), -+ HWS_DEFINER_ENTRY(ETH_TYPE_O), -+ HWS_DEFINER_ENTRY(ETH_TYPE_I), -+ HWS_DEFINER_ENTRY(ETH_L3_TYPE_O), -+ HWS_DEFINER_ENTRY(ETH_L3_TYPE_I), -+ HWS_DEFINER_ENTRY(VLAN_TYPE_O), -+ HWS_DEFINER_ENTRY(VLAN_TYPE_I), -+ HWS_DEFINER_ENTRY(VLAN_FIRST_PRIO_O), -+ HWS_DEFINER_ENTRY(VLAN_FIRST_PRIO_I), -+ HWS_DEFINER_ENTRY(VLAN_CFI_O), -+ HWS_DEFINER_ENTRY(VLAN_CFI_I), -+ HWS_DEFINER_ENTRY(VLAN_ID_O), -+ HWS_DEFINER_ENTRY(VLAN_ID_I), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_TYPE_O), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_TYPE_I), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_PRIO_O), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_PRIO_I), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_CFI_O), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_CFI_I), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_ID_O), -+ HWS_DEFINER_ENTRY(VLAN_SECOND_ID_I), -+ HWS_DEFINER_ENTRY(IPV4_IHL_O), -+ HWS_DEFINER_ENTRY(IPV4_IHL_I), -+ HWS_DEFINER_ENTRY(IP_DSCP_O), -+ HWS_DEFINER_ENTRY(IP_DSCP_I), -+ HWS_DEFINER_ENTRY(IP_ECN_O), -+ HWS_DEFINER_ENTRY(IP_ECN_I), -+ HWS_DEFINER_ENTRY(IP_TTL_O), -+ HWS_DEFINER_ENTRY(IP_TTL_I), -+ HWS_DEFINER_ENTRY(IPV4_DST_O), -+ HWS_DEFINER_ENTRY(IPV4_DST_I), -+ HWS_DEFINER_ENTRY(IPV4_SRC_O), -+ HWS_DEFINER_ENTRY(IPV4_SRC_I), -+ HWS_DEFINER_ENTRY(IP_VERSION_O), -+ HWS_DEFINER_ENTRY(IP_VERSION_I), -+ HWS_DEFINER_ENTRY(IP_FRAG_O), -+ HWS_DEFINER_ENTRY(IP_FRAG_I), -+ HWS_DEFINER_ENTRY(IP_LEN_O), -+ HWS_DEFINER_ENTRY(IP_LEN_I), -+ HWS_DEFINER_ENTRY(IP_TOS_O), -+ HWS_DEFINER_ENTRY(IP_TOS_I), -+ HWS_DEFINER_ENTRY(IPV6_FLOW_LABEL_O), -+ HWS_DEFINER_ENTRY(IPV6_FLOW_LABEL_I), -+ HWS_DEFINER_ENTRY(IPV6_DST_127_96_O), -+ HWS_DEFINER_ENTRY(IPV6_DST_95_64_O), -+ HWS_DEFINER_ENTRY(IPV6_DST_63_32_O), -+ HWS_DEFINER_ENTRY(IPV6_DST_31_0_O), -+ HWS_DEFINER_ENTRY(IPV6_DST_127_96_I), -+ HWS_DEFINER_ENTRY(IPV6_DST_95_64_I), -+ HWS_DEFINER_ENTRY(IPV6_DST_63_32_I), -+ HWS_DEFINER_ENTRY(IPV6_DST_31_0_I), -+ HWS_DEFINER_ENTRY(IPV6_SRC_127_96_O), -+ HWS_DEFINER_ENTRY(IPV6_SRC_95_64_O), -+ HWS_DEFINER_ENTRY(IPV6_SRC_63_32_O), -+ HWS_DEFINER_ENTRY(IPV6_SRC_31_0_O), -+ HWS_DEFINER_ENTRY(IPV6_SRC_127_96_I), -+ HWS_DEFINER_ENTRY(IPV6_SRC_95_64_I), -+ HWS_DEFINER_ENTRY(IPV6_SRC_63_32_I), -+ HWS_DEFINER_ENTRY(IPV6_SRC_31_0_I), -+ HWS_DEFINER_ENTRY(IP_PROTOCOL_O), -+ HWS_DEFINER_ENTRY(IP_PROTOCOL_I), -+ HWS_DEFINER_ENTRY(L4_SPORT_O), -+ HWS_DEFINER_ENTRY(L4_SPORT_I), -+ HWS_DEFINER_ENTRY(L4_DPORT_O), -+ HWS_DEFINER_ENTRY(L4_DPORT_I), -+ HWS_DEFINER_ENTRY(TCP_FLAGS_I), -+ HWS_DEFINER_ENTRY(TCP_FLAGS_O), -+ HWS_DEFINER_ENTRY(TCP_SEQ_NUM), -+ HWS_DEFINER_ENTRY(TCP_ACK_NUM), -+ HWS_DEFINER_ENTRY(GTP_TEID), -+ HWS_DEFINER_ENTRY(GTP_MSG_TYPE), -+ HWS_DEFINER_ENTRY(GTP_EXT_FLAG), -+ HWS_DEFINER_ENTRY(GTP_NEXT_EXT_HDR), -+ HWS_DEFINER_ENTRY(GTP_EXT_HDR_PDU), -+ HWS_DEFINER_ENTRY(GTP_EXT_HDR_QFI), -+ HWS_DEFINER_ENTRY(GTPU_DW0), -+ HWS_DEFINER_ENTRY(GTPU_FIRST_EXT_DW0), -+ HWS_DEFINER_ENTRY(GTPU_DW2), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_0), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_1), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_2), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_3), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_4), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_5), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_6), -+ HWS_DEFINER_ENTRY(FLEX_PARSER_7), -+ HWS_DEFINER_ENTRY(VPORT_REG_C_0), -+ HWS_DEFINER_ENTRY(VXLAN_FLAGS), -+ HWS_DEFINER_ENTRY(VXLAN_VNI), -+ HWS_DEFINER_ENTRY(VXLAN_GPE_FLAGS), -+ HWS_DEFINER_ENTRY(VXLAN_GPE_RSVD0), -+ HWS_DEFINER_ENTRY(VXLAN_GPE_PROTO), -+ HWS_DEFINER_ENTRY(VXLAN_GPE_VNI), -+ HWS_DEFINER_ENTRY(VXLAN_GPE_RSVD1), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_LEN), -+ HWS_DEFINER_ENTRY(GENEVE_OAM), -+ HWS_DEFINER_ENTRY(GENEVE_PROTO), -+ HWS_DEFINER_ENTRY(GENEVE_VNI), -+ HWS_DEFINER_ENTRY(SOURCE_QP), -+ HWS_DEFINER_ENTRY(SOURCE_GVMI), -+ HWS_DEFINER_ENTRY(REG_0), -+ HWS_DEFINER_ENTRY(REG_1), -+ HWS_DEFINER_ENTRY(REG_2), -+ HWS_DEFINER_ENTRY(REG_3), -+ HWS_DEFINER_ENTRY(REG_4), -+ HWS_DEFINER_ENTRY(REG_5), -+ HWS_DEFINER_ENTRY(REG_6), -+ HWS_DEFINER_ENTRY(REG_7), -+ HWS_DEFINER_ENTRY(REG_8), -+ HWS_DEFINER_ENTRY(REG_9), -+ HWS_DEFINER_ENTRY(REG_10), -+ HWS_DEFINER_ENTRY(REG_11), -+ HWS_DEFINER_ENTRY(REG_A), -+ HWS_DEFINER_ENTRY(REG_B), -+ HWS_DEFINER_ENTRY(GRE_KEY_PRESENT), -+ HWS_DEFINER_ENTRY(GRE_C), -+ HWS_DEFINER_ENTRY(GRE_K), -+ HWS_DEFINER_ENTRY(GRE_S), -+ HWS_DEFINER_ENTRY(GRE_PROTOCOL), -+ HWS_DEFINER_ENTRY(GRE_OPT_KEY), -+ HWS_DEFINER_ENTRY(GRE_OPT_SEQ), -+ HWS_DEFINER_ENTRY(GRE_OPT_CHECKSUM), -+ HWS_DEFINER_ENTRY(INTEGRITY_O), -+ HWS_DEFINER_ENTRY(INTEGRITY_I), -+ HWS_DEFINER_ENTRY(ICMP_DW1), -+ HWS_DEFINER_ENTRY(ICMP_DW2), -+ HWS_DEFINER_ENTRY(ICMP_DW3), -+ HWS_DEFINER_ENTRY(IPSEC_SPI), -+ HWS_DEFINER_ENTRY(IPSEC_SEQUENCE_NUMBER), -+ HWS_DEFINER_ENTRY(IPSEC_SYNDROME), -+ HWS_DEFINER_ENTRY(MPLS0_O), -+ HWS_DEFINER_ENTRY(MPLS1_O), -+ HWS_DEFINER_ENTRY(MPLS2_O), -+ HWS_DEFINER_ENTRY(MPLS3_O), -+ HWS_DEFINER_ENTRY(MPLS4_O), -+ HWS_DEFINER_ENTRY(MPLS0_I), -+ HWS_DEFINER_ENTRY(MPLS1_I), -+ HWS_DEFINER_ENTRY(MPLS2_I), -+ HWS_DEFINER_ENTRY(MPLS3_I), -+ HWS_DEFINER_ENTRY(MPLS4_I), -+ HWS_DEFINER_ENTRY(FLEX_PARSER0_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER1_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER2_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER3_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER4_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER5_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER6_OK), -+ HWS_DEFINER_ENTRY(FLEX_PARSER7_OK), -+ HWS_DEFINER_ENTRY(OKS2_MPLS0_O), -+ HWS_DEFINER_ENTRY(OKS2_MPLS1_O), -+ HWS_DEFINER_ENTRY(OKS2_MPLS2_O), -+ HWS_DEFINER_ENTRY(OKS2_MPLS3_O), -+ HWS_DEFINER_ENTRY(OKS2_MPLS4_O), -+ HWS_DEFINER_ENTRY(OKS2_MPLS0_I), -+ HWS_DEFINER_ENTRY(OKS2_MPLS1_I), -+ HWS_DEFINER_ENTRY(OKS2_MPLS2_I), -+ HWS_DEFINER_ENTRY(OKS2_MPLS3_I), -+ HWS_DEFINER_ENTRY(OKS2_MPLS4_I), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_0), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_1), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_2), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_3), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_4), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_5), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_6), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_OK_7), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_0), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_1), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_2), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_3), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_4), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_5), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_6), -+ HWS_DEFINER_ENTRY(GENEVE_OPT_DW_7), -+ HWS_DEFINER_ENTRY(IB_L4_OPCODE), -+ HWS_DEFINER_ENTRY(IB_L4_QPN), -+ HWS_DEFINER_ENTRY(IB_L4_A), -+ HWS_DEFINER_ENTRY(RANDOM_NUM), -+ HWS_DEFINER_ENTRY(PTYPE_L2_O), -+ HWS_DEFINER_ENTRY(PTYPE_L2_I), -+ HWS_DEFINER_ENTRY(PTYPE_L3_O), -+ HWS_DEFINER_ENTRY(PTYPE_L3_I), -+ HWS_DEFINER_ENTRY(PTYPE_L4_O), -+ HWS_DEFINER_ENTRY(PTYPE_L4_I), -+ HWS_DEFINER_ENTRY(PTYPE_L4_EXT_O), -+ HWS_DEFINER_ENTRY(PTYPE_L4_EXT_I), -+ HWS_DEFINER_ENTRY(PTYPE_FRAG_O), -+ HWS_DEFINER_ENTRY(PTYPE_FRAG_I), -+ HWS_DEFINER_ENTRY(TNL_HDR_0), -+ HWS_DEFINER_ENTRY(TNL_HDR_1), -+ HWS_DEFINER_ENTRY(TNL_HDR_2), -+ HWS_DEFINER_ENTRY(TNL_HDR_3), -+ [MLX5HWS_DEFINER_FNAME_MAX] = "DEFINER_FNAME_UNKNOWN", -+}; -+ -+const char *mlx5hws_definer_fname_to_str(enum mlx5hws_definer_fname fname) -+{ -+ if (fname > MLX5HWS_DEFINER_FNAME_MAX) -+ fname = MLX5HWS_DEFINER_FNAME_MAX; -+ return hws_definer_fname_to_str[fname]; -+} -+ - static void - hws_definer_ones_set(struct mlx5hws_definer_fc *fc, - void *match_param, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -index 5c1a2086efba..62da55389331 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -@@ -831,4 +831,6 @@ mlx5hws_definer_conv_match_params_to_compressed_fc(struct mlx5hws_context *ctx, - u32 *match_param, - int *fc_sz); - -+const char *mlx5hws_definer_fname_to_str(enum mlx5hws_definer_fname fname); -+ - #endif /* HWS_DEFINER_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1367-net-mlx5-hws-expose-polling-function-in-header-file.patch b/SOURCES/1367-net-mlx5-hws-expose-polling-function-in-header-file.patch deleted file mode 100644 index 9045630c2..000000000 --- a/SOURCES/1367-net-mlx5-hws-expose-polling-function-in-header-file.patch +++ /dev/null @@ -1,120 +0,0 @@ -From 7287dfe961f39c52d8e7fbc0a719036457df2b41 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:04 -0400 -Subject: [PATCH] net/mlx5: HWS, expose polling function in header file - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3c739d1624e3c3186a0a0248e91851a085f6e45b -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:03 2025 +0300 - - net/mlx5: HWS, expose polling function in header file - - In preparation for complex matcher, expose the function that is - polling queue for completion (mlx5hws_bwc_queue_poll) in header - file, so that it will be used by complex matcher code. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 510bfbbe5991..27b6420678d8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -223,10 +223,10 @@ int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) - return 0; - } - --static int hws_bwc_queue_poll(struct mlx5hws_context *ctx, -- u16 queue_id, -- u32 *pending_rules, -- bool drain) -+int mlx5hws_bwc_queue_poll(struct mlx5hws_context *ctx, -+ u16 queue_id, -+ u32 *pending_rules, -+ bool drain) - { - unsigned long timeout = jiffies + - secs_to_jiffies(MLX5HWS_BWC_POLLING_TIMEOUT); -@@ -361,7 +361,8 @@ hws_bwc_rule_destroy_hws_sync(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(ret)) - return ret; - -- ret = hws_bwc_queue_poll(ctx, rule_attr->queue_id, &expected_completions, true); -+ ret = mlx5hws_bwc_queue_poll(ctx, rule_attr->queue_id, -+ &expected_completions, true); - if (unlikely(ret)) - return ret; - -@@ -442,9 +443,8 @@ hws_bwc_rule_create_sync(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(ret)) - return ret; - -- ret = hws_bwc_queue_poll(ctx, rule_attr->queue_id, &expected_completions, true); -- -- return ret; -+ return mlx5hws_bwc_queue_poll(ctx, rule_attr->queue_id, -+ &expected_completions, true); - } - - static int -@@ -465,7 +465,8 @@ hws_bwc_rule_update_sync(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(ret)) - return ret; - -- ret = hws_bwc_queue_poll(ctx, rule_attr->queue_id, &expected_completions, true); -+ ret = mlx5hws_bwc_queue_poll(ctx, rule_attr->queue_id, -+ &expected_completions, true); - if (unlikely(ret)) - mlx5hws_err(ctx, "Failed updating BWC rule (%d)\n", ret); - -@@ -651,8 +652,10 @@ static int hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_match - &bwc_matcher->rules[i]) ? - NULL : list_next_entry(bwc_rules[i], list_node); - -- ret = hws_bwc_queue_poll(ctx, rule_attr.queue_id, -- &pending_rules[i], false); -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &pending_rules[i], -+ false); - if (unlikely(ret)) { - mlx5hws_err(ctx, - "Moving BWC rule failed during rehash (%d)\n", -@@ -669,8 +672,8 @@ static int hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_match - u16 queue_id = mlx5hws_bwc_get_queue_id(ctx, i); - - mlx5hws_send_engine_flush_queue(&ctx->send_queue[queue_id]); -- ret = hws_bwc_queue_poll(ctx, queue_id, -- &pending_rules[i], true); -+ ret = mlx5hws_bwc_queue_poll(ctx, queue_id, -+ &pending_rules[i], true); - if (unlikely(ret)) { - mlx5hws_err(ctx, - "Moving BWC rule failed during rehash (%d)\n", ret); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index bb0cf4b922ce..a2aa2d5da694 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -64,6 +64,11 @@ void mlx5hws_bwc_rule_fill_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - u32 flow_source, - struct mlx5hws_rule_attr *rule_attr); - -+int mlx5hws_bwc_queue_poll(struct mlx5hws_context *ctx, -+ u16 queue_id, -+ u32 *pending_rules, -+ bool drain); -+ - static inline u16 mlx5hws_bwc_queues(struct mlx5hws_context *ctx) - { - /* Besides the control queue, half of the queues are --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1368-net-mlx5-hws-introduce-isolated-matchers.patch b/SOURCES/1368-net-mlx5-hws-introduce-isolated-matchers.patch deleted file mode 100644 index 12261d7d8..000000000 --- a/SOURCES/1368-net-mlx5-hws-introduce-isolated-matchers.patch +++ /dev/null @@ -1,414 +0,0 @@ -From e52f06951f1709e7bd3b78b3c4932d5fc69d10eb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:04 -0400 -Subject: [PATCH] net/mlx5: HWS, introduce isolated matchers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b816743a182f532faaeaa9aaed147ff09513e375 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:04 2025 +0300 - - net/mlx5: HWS, introduce isolated matchers - - In preparation for complex matcher support, introduce the isolated - matcher. - - Isolated matcher is a matcher that has its own isolated table. - It is used as the second half of the complex matcher: when the rule - is split into two parts (complex rule), then matching on the first - part will send the packet to the isolated matcher that will try to - match on the second part. In case of miss, the packet goes back to - the matcher's end flow table. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index 5b0c1623499b..ce28ee1c0e41 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -23,19 +23,199 @@ static void hws_matcher_destroy_end_ft(struct mlx5hws_matcher *matcher) - mlx5hws_table_destroy_default_ft(matcher->tbl, matcher->end_ft_id); - } - -+int mlx5hws_matcher_update_end_ft_isolated(struct mlx5hws_table *tbl, -+ u32 miss_ft_id) -+{ -+ struct mlx5hws_matcher *tmp_matcher; -+ -+ if (list_empty(&tbl->matchers_list)) -+ return -EINVAL; -+ -+ /* Update isolated_matcher_end_ft_id attribute for all -+ * the matchers in isolated table. -+ */ -+ list_for_each_entry(tmp_matcher, &tbl->matchers_list, list_node) -+ tmp_matcher->attr.isolated_matcher_end_ft_id = miss_ft_id; -+ -+ tmp_matcher = list_last_entry(&tbl->matchers_list, -+ struct mlx5hws_matcher, -+ list_node); -+ -+ return mlx5hws_table_ft_set_next_ft(tbl->ctx, -+ tmp_matcher->end_ft_id, -+ tbl->fw_ft_type, -+ miss_ft_id); -+} -+ -+static int hws_matcher_connect_end_ft_isolated(struct mlx5hws_matcher *matcher) -+{ -+ struct mlx5hws_table *tbl = matcher->tbl; -+ u32 end_ft_id; -+ int ret; -+ -+ /* Reset end_ft next RTCs */ -+ ret = mlx5hws_table_ft_set_next_rtc(tbl->ctx, -+ matcher->end_ft_id, -+ matcher->tbl->fw_ft_type, -+ 0, 0); -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to reset FT's next RTCs\n"); -+ return ret; -+ } -+ -+ /* Connect isolated matcher's end_ft to the complex matcher's end FT */ -+ end_ft_id = matcher->attr.isolated_matcher_end_ft_id; -+ ret = mlx5hws_table_ft_set_next_ft(tbl->ctx, -+ matcher->end_ft_id, -+ matcher->tbl->fw_ft_type, -+ end_ft_id); -+ -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to set FT's miss_ft_id\n"); -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static int hws_matcher_create_end_ft_isolated(struct mlx5hws_matcher *matcher) -+{ -+ struct mlx5hws_table *tbl = matcher->tbl; -+ int ret; -+ -+ ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, -+ tbl, -+ &matcher->end_ft_id); -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to create end flow table\n"); -+ return ret; -+ } -+ -+ ret = hws_matcher_connect_end_ft_isolated(matcher); -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to connect end FT\n"); -+ goto destroy_default_ft; -+ } -+ -+ return 0; -+ -+destroy_default_ft: -+ mlx5hws_table_destroy_default_ft(tbl, matcher->end_ft_id); -+ return ret; -+} -+ - static int hws_matcher_create_end_ft(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_table *tbl = matcher->tbl; - int ret; - -- ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, tbl, &matcher->end_ft_id); -+ if (mlx5hws_matcher_is_isolated(matcher)) -+ ret = hws_matcher_create_end_ft_isolated(matcher); -+ else -+ ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, tbl, -+ &matcher->end_ft_id); -+ - if (ret) { - mlx5hws_err(tbl->ctx, "Failed to create matcher end flow table\n"); - return ret; - } -+ -+ return 0; -+} -+ -+static int hws_matcher_connect_isolated_first(struct mlx5hws_matcher *matcher) -+{ -+ struct mlx5hws_table *tbl = matcher->tbl; -+ struct mlx5hws_context *ctx = tbl->ctx; -+ int ret; -+ -+ /* Isolated matcher's end_ft is already pointing to the end_ft -+ * of the complex matcher - it was set at creation of end_ft, -+ * so no need to connect it. -+ * We still need to connect the isolated table's start FT to -+ * this matcher's RTC. -+ */ -+ ret = mlx5hws_table_ft_set_next_rtc(ctx, -+ tbl->ft_id, -+ tbl->fw_ft_type, -+ matcher->match_ste.rtc_0_id, -+ matcher->match_ste.rtc_1_id); -+ if (ret) { -+ mlx5hws_err(ctx, "Isolated matcher: failed to connect start FT to match RTC\n"); -+ return ret; -+ } -+ -+ /* Reset table's FT default miss (drop refcount) */ -+ ret = mlx5hws_table_ft_set_default_next_ft(tbl, tbl->ft_id); -+ if (ret) { -+ mlx5hws_err(ctx, "Isolated matcher: failed to reset table ft default miss\n"); -+ return ret; -+ } -+ -+ list_add(&matcher->list_node, &tbl->matchers_list); -+ -+ return ret; -+} -+ -+static int hws_matcher_connect_isolated_last(struct mlx5hws_matcher *matcher) -+{ -+ struct mlx5hws_table *tbl = matcher->tbl; -+ struct mlx5hws_context *ctx = tbl->ctx; -+ struct mlx5hws_matcher *last; -+ int ret; -+ -+ last = list_last_entry(&tbl->matchers_list, -+ struct mlx5hws_matcher, -+ list_node); -+ -+ /* New matcher's end_ft is already pointing to the end_ft of -+ * the complex matcher. -+ * Connect previous matcher's end_ft to this new matcher RTC. -+ */ -+ ret = mlx5hws_table_ft_set_next_rtc(ctx, -+ last->end_ft_id, -+ tbl->fw_ft_type, -+ matcher->match_ste.rtc_0_id, -+ matcher->match_ste.rtc_1_id); -+ if (ret) { -+ mlx5hws_err(ctx, -+ "Isolated matcher: failed to connect matcher end_ft to new match RTC\n"); -+ return ret; -+ } -+ -+ /* Reset prev matcher FT default miss (drop refcount) */ -+ ret = mlx5hws_table_ft_set_default_next_ft(tbl, last->end_ft_id); -+ if (ret) { -+ mlx5hws_err(ctx, "Isolated matcher: failed to reset matcher ft default miss\n"); -+ return ret; -+ } -+ -+ /* Insert after the last matcher */ -+ list_add(&matcher->list_node, &last->list_node); -+ - return 0; - } - -+static int hws_matcher_connect_isolated(struct mlx5hws_matcher *matcher) -+{ -+ /* Isolated matcher is expected to be the only one in its table. -+ * However, it can have a collision matcher, and it can go through -+ * rehash process, in which case we will temporary have both old and -+ * new matchers in the isolated table. -+ * Check if this is the first matcher in the isolated table. -+ */ -+ if (list_empty(&matcher->tbl->matchers_list)) -+ return hws_matcher_connect_isolated_first(matcher); -+ -+ /* If this wasn't the first matcher, then we have 3 possible cases: -+ * - this is a collision matcher for the first matcher -+ * - this is a new rehash dest matcher -+ * - this is a collision matcher for the new rehash dest matcher -+ * The logic to add new matcher is the same for all these cases. -+ */ -+ return hws_matcher_connect_isolated_last(matcher); -+} -+ - static int hws_matcher_connect(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_table *tbl = matcher->tbl; -@@ -45,6 +225,9 @@ static int hws_matcher_connect(struct mlx5hws_matcher *matcher) - struct mlx5hws_matcher *tmp_matcher; - int ret; - -+ if (mlx5hws_matcher_is_isolated(matcher)) -+ return hws_matcher_connect_isolated(matcher); -+ - /* Find location in matcher list */ - if (list_empty(&tbl->matchers_list)) { - list_add(&matcher->list_node, &tbl->matchers_list); -@@ -121,6 +304,92 @@ static int hws_matcher_connect(struct mlx5hws_matcher *matcher) - return ret; - } - -+static int hws_matcher_disconnect_isolated(struct mlx5hws_matcher *matcher) -+{ -+ struct mlx5hws_matcher *first, *last, *prev, *next; -+ struct mlx5hws_table *tbl = matcher->tbl; -+ struct mlx5hws_context *ctx = tbl->ctx; -+ u32 end_ft_id; -+ int ret; -+ -+ first = list_first_entry(&tbl->matchers_list, -+ struct mlx5hws_matcher, -+ list_node); -+ last = list_last_entry(&tbl->matchers_list, -+ struct mlx5hws_matcher, -+ list_node); -+ prev = list_prev_entry(matcher, list_node); -+ next = list_next_entry(matcher, list_node); -+ -+ list_del_init(&matcher->list_node); -+ -+ if (first == last) { -+ /* This was the only matcher in the list. -+ * Reset isolated table FT next RTCs and connect it -+ * to the whole complex matcher end FT instead. -+ */ -+ ret = mlx5hws_table_ft_set_next_rtc(ctx, -+ tbl->ft_id, -+ tbl->fw_ft_type, -+ 0, 0); -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to reset FT's next RTCs\n"); -+ return ret; -+ } -+ -+ end_ft_id = matcher->attr.isolated_matcher_end_ft_id; -+ ret = mlx5hws_table_ft_set_next_ft(tbl->ctx, -+ tbl->ft_id, -+ tbl->fw_ft_type, -+ end_ft_id); -+ if (ret) { -+ mlx5hws_err(tbl->ctx, "Isolated matcher: failed to set FT's miss_ft_id\n"); -+ return ret; -+ } -+ -+ return 0; -+ } -+ -+ /* At this point we know that there are more matchers in the list */ -+ -+ if (matcher == first) { -+ /* We've disconnected the first matcher. -+ * Now update isolated table default FT. -+ */ -+ if (!next) -+ return -EINVAL; -+ return mlx5hws_table_ft_set_next_rtc(ctx, -+ tbl->ft_id, -+ tbl->fw_ft_type, -+ next->match_ste.rtc_0_id, -+ next->match_ste.rtc_1_id); -+ } -+ -+ if (matcher == last) { -+ /* If we've disconnected the last matcher - update prev -+ * matcher's end_ft to point to the complex matcher end_ft. -+ */ -+ if (!prev) -+ return -EINVAL; -+ return hws_matcher_connect_end_ft_isolated(prev); -+ } -+ -+ /* This wasn't the first or the last matcher, which means that it has -+ * both prev and next matchers. Note that this only happens if we're -+ * disconnecting collision matcher of the old matcher during rehash. -+ */ -+ if (!prev || !next || -+ !(matcher->flags & MLX5HWS_MATCHER_FLAGS_COLLISION)) -+ return -EINVAL; -+ -+ /* Update prev end FT to point to next match RTC */ -+ return mlx5hws_table_ft_set_next_rtc(ctx, -+ prev->end_ft_id, -+ tbl->fw_ft_type, -+ next->match_ste.rtc_0_id, -+ next->match_ste.rtc_1_id); -+} -+ - static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_matcher *next = NULL, *prev = NULL; -@@ -128,6 +397,9 @@ static int hws_matcher_disconnect(struct mlx5hws_matcher *matcher) - u32 prev_ft_id = tbl->ft_id; - int ret; - -+ if (mlx5hws_matcher_is_isolated(matcher)) -+ return hws_matcher_disconnect_isolated(matcher); -+ - if (!list_is_first(&matcher->list_node, &tbl->matchers_list)) { - prev = list_prev_entry(matcher, list_node); - prev_ft_id = prev->end_ft_id; -@@ -531,6 +803,8 @@ hws_matcher_process_attr(struct mlx5hws_cmd_query_caps *caps, - attr->table.sz_col_log = hws_matcher_rules_to_tbl_depth(attr->rule.num_log); - - matcher->flags |= attr->resizable ? MLX5HWS_MATCHER_FLAGS_RESIZABLE : 0; -+ matcher->flags |= attr->isolated_matcher_end_ft_id ? -+ MLX5HWS_MATCHER_FLAGS_ISOLATED : 0; - - return hws_matcher_check_attr_sz(caps, matcher); - } -@@ -617,6 +891,8 @@ hws_matcher_create_col_matcher(struct mlx5hws_matcher *matcher) - col_matcher->attr.table.sz_row_log -= MLX5HWS_MATCHER_ASSURED_ROW_RATIO; - - col_matcher->attr.max_num_of_at_attach = matcher->attr.max_num_of_at_attach; -+ col_matcher->attr.isolated_matcher_end_ft_id = -+ matcher->attr.isolated_matcher_end_ft_id; - - ret = hws_matcher_process_attr(ctx->caps, col_matcher); - if (ret) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index 8e95158a66b5..32e83cddcd60 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -34,6 +34,7 @@ enum mlx5hws_matcher_offset { - enum mlx5hws_matcher_flags { - MLX5HWS_MATCHER_FLAGS_COLLISION = 1 << 2, - MLX5HWS_MATCHER_FLAGS_RESIZABLE = 1 << 3, -+ MLX5HWS_MATCHER_FLAGS_ISOLATED = 1 << 4, - }; - - struct mlx5hws_match_template { -@@ -96,9 +97,17 @@ static inline bool mlx5hws_matcher_is_in_resize(struct mlx5hws_matcher *matcher) - return !!matcher->resize_dst; - } - -+static inline bool mlx5hws_matcher_is_isolated(struct mlx5hws_matcher *matcher) -+{ -+ return !!(matcher->flags & MLX5HWS_MATCHER_FLAGS_ISOLATED); -+} -+ - static inline bool mlx5hws_matcher_is_insert_by_idx(struct mlx5hws_matcher *matcher) - { - return matcher->attr.insert_mode == MLX5HWS_MATCHER_INSERT_BY_INDEX; - } - -+int mlx5hws_matcher_update_end_ft_isolated(struct mlx5hws_table *tbl, -+ u32 miss_ft_id); -+ - #endif /* HWS_MATCHER_H_ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 5121951f2778..fbd63369da10 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -119,6 +119,8 @@ struct mlx5hws_matcher_attr { - }; - /* Optional AT attach configuration - Max number of additional AT */ - u8 max_num_of_at_attach; -+ /* Optional end FT (miss FT ID) for match RTC (for isolated matcher) */ -+ u32 isolated_matcher_end_ft_id; - }; - - struct mlx5hws_rule_attr { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1369-net-mlx5-hws-support-complex-matchers.patch b/SOURCES/1369-net-mlx5-hws-support-complex-matchers.patch deleted file mode 100644 index 3c42b15a3..000000000 --- a/SOURCES/1369-net-mlx5-hws-support-complex-matchers.patch +++ /dev/null @@ -1,1740 +0,0 @@ -From fb9de5c73627ea7ac0cba7da4183aa9db9bd832b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:04 -0400 -Subject: [PATCH] net/mlx5: HWS, support complex matchers -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 17e0accac577fd6ea2090934d71a8c6f36702a26 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:05 2025 +0300 - - net/mlx5: HWS, support complex matchers - - This patch adds support for Complex Matchers/Rules - - Overview: - -------- - - A matcher can match on a certain set of match parameters. However, the - number and size of match params for a single matcher are limited: all - the parameters must fit within a single definer. - - A common example of this limitation is IPv6 address matching, where - matching both source and destination IPs requires more bits than a - single definer can support. - - SW Steering addresses this limitation by chaining multiple Steering - Table Entries (STEs) within the same matcher, where each STE matches - on a subset of the parameters. - - In HW Steering, such chaining is not possible — the matcher's STEs - are managed in a hash table, and a single definer is used to calculate - the hash index for STEs. - - To address this limitation in HW Steering, we introduce Complex - Matchers, which consist of two chained matchers. This allows matching - on twice as many parameters. Complex Matchers are filled with Complex - Rules — rules that are split into two parts and inserted into their - respective matchers. - - The first half of the Complex Matcher is a regular matcher and points - to the second half, which is an Isolated Matcher. An Isolated Matcher - has its own isolated table and is accessible only by traffic coming - from the first half of the Complex Matcher. - - This splitting of matchers/rules into multiple parts is transparent to - users. It is hidden under the BWC HWS API. It becomes visible only when - dumping steering debug information, where the Complex Matcher appears - as two separate matchers: one in the user-created table and another - in its isolated table. - - Some implementation details: - --------------------------- - - All user actions are performed on the second part of the rules only. - The first part handles matching and applies two actions: modify header - (set metadata, see details below) and go-to-table (directing traffic to - the isolated table containing the isolated matcher). - - Rule updates (updating rule actions) are applied to the second part of - the rule since user-provided actions are not executed in the first - matcher. - - We use REG_C_6 metadata register to set and match on unique per-rule - tag (see details below). - - Splitting rules into two parts introduces new challenges: - - 1. Invalid Combinations - - Consider two rules with different matching values: - - Rule 1: A+B - - Rule 2: C+D - - Let's split the rules into two parts as follows: - - |---| |---| - | A | | B | - |---| --> |---| - | C | | D | - |---| |---| - - Splitting these rules results in invalid combinations like A+D - and C+B. - - To resolve this, we assign unique tags to each rule on the first - matcher and match these tags on the second matcher (the tag is - implemented through modify_hdr action that sets value to metadata - register REG_C_6): - - |----------| |---------| - | A | | B, TagA | - | action: | | | - | set TagA | | | - |----------| --> |---------| - | C | | D, TagB | - | action: | | | - | set TagB | | | - |----------| |---------| - - 2. Duplicated Entries: - - Consider two rules with overlapping values: - - Rule 1: A+B - - Rule 2: A+D - - Let's split the rules into two parts as follows: - - |---| |---| - | A | | B | - |---| --> |---| - | | | D | - |---| |---| - - This leads to the duplicated entries on the first matcher, which HWS - doesn't allow: subsequent delete of either of the rules will delete - the only entry in the first matcher, leaving the remaining rule - broken. - - To address this, we use a reference count for entries in the first - matcher and delete STEs only when their refcount reaches zero. - - Both challenges are resolved by having a per-matcher data structure - (implemented with rhashtable) that manages refcounts for the first part - of the rules and holds unique tags (managed via IDA) for these rules to - set and to match on the second matcher. - - Limitations: - ----------- - - We utilize metadata register REG_C_6 in this implementation, so its - usage anywhere along the steering of the flow that might include the - need for Complex Matcher is prohibited. - - The number and size of match parameters remain limited — now it is - constrained by what can be represented by two definers instead of one. - This architectural limitation arises from the structure of Complex - Matchers. If future requirements demand more parameters, - Complex Matchers can be extended beyond two matchers. - - Additionally, there is an implementation limit of 32 match parameters - per rule (disregarding parameter size). This limit can be lifted if - needed. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 27b6420678d8..d70db6948dbb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -46,10 +46,14 @@ static void hws_bwc_unlock_all_queues(struct mlx5hws_context *ctx) - } - } - --static void hws_bwc_matcher_init_attr(struct mlx5hws_matcher_attr *attr, -+static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - u32 priority, -- u8 size_log) -+ u8 size_log, -+ struct mlx5hws_matcher_attr *attr) - { -+ struct mlx5hws_bwc_matcher *first_matcher = -+ bwc_matcher->complex_first_bwc_matcher; -+ - memset(attr, 0, sizeof(*attr)); - - attr->priority = priority; -@@ -61,6 +65,9 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_matcher_attr *attr, - attr->rule.num_log = size_log; - attr->resizable = true; - attr->max_num_of_at_attach = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; -+ -+ attr->isolated_matcher_end_ft_id = -+ first_matcher ? first_matcher->matcher->end_ft_id : 0; - } - - int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, -@@ -83,9 +90,10 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - for (i = 0; i < bwc_queues; i++) - INIT_LIST_HEAD(&bwc_matcher->rules[i]); - -- hws_bwc_matcher_init_attr(&attr, -+ hws_bwc_matcher_init_attr(bwc_matcher, - priority, -- MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG); -+ MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG, -+ &attr); - - bwc_matcher->priority = priority; - bwc_matcher->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; -@@ -217,7 +225,10 @@ int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) - "BWC matcher destroy: matcher still has %d rules\n", - num_of_rules); - -- mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -+ if (bwc_matcher->complex) -+ mlx5hws_bwc_matcher_destroy_complex(bwc_matcher); -+ else -+ mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); - - kfree(bwc_matcher); - return 0; -@@ -401,9 +412,13 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - - int mlx5hws_bwc_rule_destroy(struct mlx5hws_bwc_rule *bwc_rule) - { -- int ret; -+ bool is_complex = !!bwc_rule->bwc_matcher->complex; -+ int ret = 0; - -- ret = mlx5hws_bwc_rule_destroy_simple(bwc_rule); -+ if (is_complex) -+ ret = mlx5hws_bwc_rule_destroy_complex(bwc_rule); -+ else -+ ret = mlx5hws_bwc_rule_destroy_simple(bwc_rule); - - mlx5hws_bwc_rule_free(bwc_rule); - return ret; -@@ -692,7 +707,10 @@ static int hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_match - - static int hws_bwc_matcher_move_all(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- return hws_bwc_matcher_move_all_simple(bwc_matcher); -+ if (!bwc_matcher->complex) -+ return hws_bwc_matcher_move_all_simple(bwc_matcher); -+ -+ return mlx5hws_bwc_matcher_move_all_complex(bwc_matcher); - } - - static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) -@@ -703,9 +721,10 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) - struct mlx5hws_matcher *new_matcher; - int ret; - -- hws_bwc_matcher_init_attr(&matcher_attr, -+ hws_bwc_matcher_init_attr(bwc_matcher, - bwc_matcher->priority, -- bwc_matcher->size_log); -+ bwc_matcher->size_log, -+ &matcher_attr); - - old_matcher = bwc_matcher->matcher; - new_matcher = mlx5hws_matcher_create(old_matcher->tbl, -@@ -910,11 +929,18 @@ mlx5hws_bwc_rule_create(struct mlx5hws_bwc_matcher *bwc_matcher, - - bwc_queue_idx = hws_bwc_gen_queue_idx(ctx); - -- ret = mlx5hws_bwc_rule_create_simple(bwc_rule, -- params->match_buf, -- rule_actions, -- flow_source, -- bwc_queue_idx); -+ if (bwc_matcher->complex) -+ ret = mlx5hws_bwc_rule_create_complex(bwc_rule, -+ params, -+ flow_source, -+ rule_actions, -+ bwc_queue_idx); -+ else -+ ret = mlx5hws_bwc_rule_create_simple(bwc_rule, -+ params->match_buf, -+ rule_actions, -+ flow_source, -+ bwc_queue_idx); - if (unlikely(ret)) { - mlx5hws_bwc_rule_free(bwc_rule); - return NULL; -@@ -996,5 +1022,10 @@ int mlx5hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - return -EINVAL; - } - -- return hws_bwc_rule_action_update(bwc_rule, rule_actions); -+ /* For complex rule, the update should happen on the second matcher */ -+ if (bwc_rule->isolated_bwc_rule) -+ return hws_bwc_rule_action_update(bwc_rule->isolated_bwc_rule, -+ rule_actions); -+ else -+ return hws_bwc_rule_action_update(bwc_rule, rule_actions); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index a2aa2d5da694..cf2b65146317 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -18,10 +18,13 @@ - - #define MLX5HWS_BWC_POLLING_TIMEOUT 60 - -+struct mlx5hws_bwc_matcher_complex_data; - struct mlx5hws_bwc_matcher { - struct mlx5hws_matcher *matcher; - struct mlx5hws_match_template *mt; - struct mlx5hws_action_template **at; -+ struct mlx5hws_bwc_matcher_complex_data *complex; -+ struct mlx5hws_bwc_matcher *complex_first_bwc_matcher; - u8 num_of_at; - u8 size_of_at_array; - u8 size_log; -@@ -33,6 +36,8 @@ struct mlx5hws_bwc_matcher { - struct mlx5hws_bwc_rule { - struct mlx5hws_bwc_matcher *bwc_matcher; - struct mlx5hws_rule *rule; -+ struct mlx5hws_bwc_rule *isolated_bwc_rule; -+ struct mlx5hws_bwc_complex_rule_hash_node *complex_hash_node; - u16 bwc_queue_idx; - struct list_head list_node; - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -index 9fb059a6511f..5d30c5b094fc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -@@ -3,6 +3,22 @@ - - #include "internal.h" - -+#define HWS_CLEAR_MATCH_PARAM(mask, field) \ -+ MLX5_SET(fte_match_param, (mask)->match_buf, field, 0) -+ -+#define HWS_SZ_MATCH_PARAM (MLX5_ST_SZ_DW_MATCH_PARAM * 4) -+ -+static const struct rhashtable_params hws_refcount_hash = { -+ .key_len = sizeof_field(struct mlx5hws_bwc_complex_rule_hash_node, -+ match_buf), -+ .key_offset = offsetof(struct mlx5hws_bwc_complex_rule_hash_node, -+ match_buf), -+ .head_offset = offsetof(struct mlx5hws_bwc_complex_rule_hash_node, -+ hash_node), -+ .automatic_shrinking = true, -+ .min_size = 1, -+}; -+ - bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, - u8 match_criteria_enable, - struct mlx5hws_match_parameters *mask) -@@ -48,20 +64,1078 @@ bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, - return is_complex; - } - -+static void -+hws_bwc_matcher_complex_params_clear_fld(struct mlx5hws_context *ctx, -+ enum mlx5hws_definer_fname fname, -+ struct mlx5hws_match_parameters *mask) -+{ -+ struct mlx5hws_cmd_query_caps *caps = ctx->caps; -+ -+ switch (fname) { -+ case MLX5HWS_DEFINER_FNAME_ETH_TYPE_O: -+ case MLX5HWS_DEFINER_FNAME_ETH_TYPE_I: -+ case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_O: -+ case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_I: -+ case MLX5HWS_DEFINER_FNAME_IP_VERSION_O: -+ case MLX5HWS_DEFINER_FNAME_IP_VERSION_I: -+ /* Because of the strict requirements for IP address matching -+ * that require ethtype/ip_version matching as well, don't clear -+ * these fields - have them in both parts of the complex matcher -+ */ -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.smac_47_16); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.smac_47_16); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.smac_15_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.smac_15_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.dmac_47_16); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.dmac_47_16); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.dmac_15_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.dmac_15_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_TYPE_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.cvlan_tag); -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.svlan_tag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_TYPE_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.cvlan_tag); -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.svlan_tag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_FIRST_PRIO_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_prio); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_FIRST_PRIO_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_prio); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_CFI_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_cfi); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_CFI_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_cfi); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_ID_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_vid); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_ID_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_vid); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_TYPE_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.outer_second_cvlan_tag); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.outer_second_svlan_tag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_TYPE_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.inner_second_cvlan_tag); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.inner_second_svlan_tag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_PRIO_O: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_prio); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_PRIO_I: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_prio); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_CFI_O: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_cfi); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_CFI_I: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_cfi); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_ID_O: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_vid); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_ID_I: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_vid); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_IHL_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ipv4_ihl); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_IHL_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ipv4_ihl); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_DSCP_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_dscp); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_DSCP_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_dscp); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_ECN_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_ecn); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_ECN_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_ecn); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_TTL_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ttl_hoplimit); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_TTL_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ttl_hoplimit); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_DST_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_SRC_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_DST_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV4_SRC_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_FRAG_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.frag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_FRAG_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.frag); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_FLOW_LABEL_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.outer_ipv6_flow_label); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_FLOW_LABEL_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.inner_ipv6_flow_label); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_95_64); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_63_32); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_95_64); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_63_32); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_95_64); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_63_32); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I: -+ case MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_95_64); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_63_32); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_PROTOCOL_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_protocol); -+ break; -+ case MLX5HWS_DEFINER_FNAME_IP_PROTOCOL_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_protocol); -+ break; -+ case MLX5HWS_DEFINER_FNAME_L4_SPORT_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_sport); -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.udp_sport); -+ break; -+ case MLX5HWS_DEFINER_FNAME_L4_SPORT_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.tcp_dport); -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.udp_dport); -+ break; -+ case MLX5HWS_DEFINER_FNAME_L4_DPORT_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_dport); -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.udp_dport); -+ break; -+ case MLX5HWS_DEFINER_FNAME_L4_DPORT_I: -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.tcp_dport); -+ HWS_CLEAR_MATCH_PARAM(mask, inner_headers.udp_dport); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TCP_FLAGS_O: -+ HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_flags); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM: -+ case MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.outer_tcp_seq_num); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.outer_tcp_ack_num); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.inner_tcp_seq_num); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.inner_tcp_ack_num); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GTP_TEID: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_teid); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GTP_MSG_TYPE: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_msg_type); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_msg_flags); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GTPU_FIRST_EXT_DW0: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.gtpu_first_ext_dw_0); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_dw_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GTPU_DW2: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_dw_2); -+ break; -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_2.outer_first_mpls_over_gre); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_2.outer_first_mpls_over_udp); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.geneve_tlv_option_0_data); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_id_0); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_value_0); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_value_1); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_id_2); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_value_2); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_id_3); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_4.prog_sample_field_value_3); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VXLAN_VNI: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.vxlan_vni); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_FLAGS: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.outer_vxlan_gpe_flags); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_RSVD0: -+ break; -+ case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_PROTO: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.outer_vxlan_gpe_next_protocol); -+ break; -+ case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_VNI: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.outer_vxlan_gpe_vni); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GENEVE_OPT_LEN: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_opt_len); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GENEVE_OAM: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_oam); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GENEVE_PROTO: -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.geneve_protocol_type); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GENEVE_VNI: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_vni); -+ break; -+ case MLX5HWS_DEFINER_FNAME_SOURCE_QP: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.source_sqn); -+ break; -+ case MLX5HWS_DEFINER_FNAME_SOURCE_GVMI: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.source_port); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.source_eswitch_owner_vhca_id); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_0: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_1: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_1); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_2: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_2); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_3: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_3); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_4: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_4); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_5: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_5); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_7: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_7); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_A: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_a); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GRE_C: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_c_present); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GRE_K: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_k_present); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GRE_S: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_s_present); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_protocol); -+ break; -+ case MLX5HWS_DEFINER_FNAME_GRE_OPT_KEY: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_key.key); -+ break; -+ case MLX5HWS_DEFINER_FNAME_ICMP_DW1: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_header_data); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_type); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_code); -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters_3.icmpv6_header_data); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmpv6_type); -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmpv6_code); -+ break; -+ case MLX5HWS_DEFINER_FNAME_MPLS0_O: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.outer_first_mpls); -+ break; -+ case MLX5HWS_DEFINER_FNAME_MPLS0_I: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.inner_first_mpls); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TNL_HDR_0: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_0); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TNL_HDR_1: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_1); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TNL_HDR_2: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_2); -+ break; -+ case MLX5HWS_DEFINER_FNAME_TNL_HDR_3: -+ HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_3); -+ break; -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER0_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER1_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER2_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER3_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER4_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER5_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER6_OK: -+ case MLX5HWS_DEFINER_FNAME_FLEX_PARSER7_OK: -+ /* assuming this is flex parser for geneve option */ -+ if ((fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER0_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 0) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER1_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 1) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER2_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 2) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER3_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 3) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER4_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 4) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER5_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 5) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER6_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 6) || -+ (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER7_OK && -+ ctx->caps->flex_parser_id_geneve_tlv_option_0 != 7)) { -+ mlx5hws_err(ctx, -+ "Complex params: unsupported field %s (%d), flex parser ID for geneve is %d\n", -+ mlx5hws_definer_fname_to_str(fname), fname, -+ caps->flex_parser_id_geneve_tlv_option_0); -+ break; -+ } -+ HWS_CLEAR_MATCH_PARAM(mask, -+ misc_parameters.geneve_tlv_option_0_exist); -+ break; -+ case MLX5HWS_DEFINER_FNAME_REG_6: -+ default: -+ mlx5hws_err(ctx, "Complex params: unsupported field %s (%d)\n", -+ mlx5hws_definer_fname_to_str(fname), fname); -+ break; -+ } -+} -+ -+static bool -+hws_bwc_matcher_complex_params_comb_is_valid(struct mlx5hws_definer_fc *fc, -+ int fc_sz, -+ u32 combination_num) -+{ -+ bool m1[MLX5HWS_DEFINER_FNAME_MAX] = {0}; -+ bool m2[MLX5HWS_DEFINER_FNAME_MAX] = {0}; -+ bool is_first_matcher; -+ int i; -+ -+ for (i = 0; i < fc_sz; i++) { -+ is_first_matcher = !(combination_num & BIT(i)); -+ if (is_first_matcher) -+ m1[fc[i].fname] = true; -+ else -+ m2[fc[i].fname] = true; -+ } -+ -+ /* Not all the fields can be split into separate matchers. -+ * Some should be together on the same matcher. -+ * For example, IPv6 parts - the whole IPv6 address should be on the -+ * same matcher in order for us to deduce if it's IPv6 or IPv4 address. -+ */ -+ if (m1[MLX5HWS_DEFINER_FNAME_IP_FRAG_O] && -+ (m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O])) -+ return false; -+ -+ if (m2[MLX5HWS_DEFINER_FNAME_IP_FRAG_O] && -+ (m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O])) -+ return false; -+ -+ if (m1[MLX5HWS_DEFINER_FNAME_IP_FRAG_I] && -+ (m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I] || -+ m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I])) -+ return false; -+ -+ if (m2[MLX5HWS_DEFINER_FNAME_IP_FRAG_I] && -+ (m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I] || -+ m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I])) -+ return false; -+ -+ /* Don't split outer IPv6 dest address. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O]) && -+ (m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O])) -+ return false; -+ -+ /* Don't split outer IPv6 source address. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O]) && -+ (m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O])) -+ return false; -+ -+ /* Don't split inner IPv6 dest address. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I]) && -+ (m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I])) -+ return false; -+ -+ /* Don't split inner IPv6 source address. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I] || -+ m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I]) && -+ (m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I] || -+ m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I])) -+ return false; -+ -+ /* Don't split GRE parameters. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_GRE_C] || -+ m1[MLX5HWS_DEFINER_FNAME_GRE_K] || -+ m1[MLX5HWS_DEFINER_FNAME_GRE_S] || -+ m1[MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL]) && -+ (m2[MLX5HWS_DEFINER_FNAME_GRE_C] || -+ m2[MLX5HWS_DEFINER_FNAME_GRE_K] || -+ m2[MLX5HWS_DEFINER_FNAME_GRE_S] || -+ m2[MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL])) -+ return false; -+ -+ /* Don't split TCP ack/seq numbers. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM] || -+ m1[MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM]) && -+ (m2[MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM] || -+ m2[MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM])) -+ return false; -+ -+ /* Don't split flex parser. */ -+ if ((m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6] || -+ m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7]) && -+ (m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6] || -+ m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7])) -+ return false; -+ -+ return true; -+} -+ -+static void -+hws_bwc_matcher_complex_params_comb_create(struct mlx5hws_context *ctx, -+ struct mlx5hws_match_parameters *m, -+ struct mlx5hws_match_parameters *m1, -+ struct mlx5hws_match_parameters *m2, -+ struct mlx5hws_definer_fc *fc, -+ int fc_sz, -+ u32 combination_num) -+{ -+ bool is_first_matcher; -+ int i; -+ -+ memcpy(m1->match_buf, m->match_buf, m->match_sz); -+ memcpy(m2->match_buf, m->match_buf, m->match_sz); -+ -+ for (i = 0; i < fc_sz; i++) { -+ is_first_matcher = !(combination_num & BIT(i)); -+ hws_bwc_matcher_complex_params_clear_fld(ctx, -+ fc[i].fname, -+ is_first_matcher ? -+ m2 : m1); -+ } -+ -+ MLX5_SET(fte_match_param, m2->match_buf, -+ misc_parameters_2.metadata_reg_c_6, -1); -+} -+ -+static void -+hws_bwc_matcher_complex_params_destroy(struct mlx5hws_match_parameters *mask_1, -+ struct mlx5hws_match_parameters *mask_2) -+{ -+ kfree(mask_1->match_buf); -+ kfree(mask_2->match_buf); -+} -+ -+static int -+hws_bwc_matcher_complex_params_create(struct mlx5hws_context *ctx, -+ u8 match_criteria, -+ struct mlx5hws_match_parameters *mask, -+ struct mlx5hws_match_parameters *mask_1, -+ struct mlx5hws_match_parameters *mask_2) -+{ -+ struct mlx5hws_definer_fc *fc; -+ u32 num_of_combinations; -+ int fc_sz = 0; -+ int res = 0; -+ u32 i; -+ -+ if (MLX5_GET(fte_match_param, mask->match_buf, -+ misc_parameters_2.metadata_reg_c_6)) { -+ mlx5hws_err(ctx, "Complex matcher: REG_C_6 matching is reserved\n"); -+ res = -EINVAL; -+ goto out; -+ } -+ -+ mask_1->match_buf = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), -+ GFP_KERNEL); -+ mask_2->match_buf = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), -+ GFP_KERNEL); -+ if (!mask_1->match_buf || !mask_2->match_buf) { -+ mlx5hws_err(ctx, "Complex matcher: failed to allocate match_param\n"); -+ res = -ENOMEM; -+ goto free_params; -+ } -+ -+ mask_1->match_sz = mask->match_sz; -+ mask_2->match_sz = mask->match_sz; -+ -+ fc = mlx5hws_definer_conv_match_params_to_compressed_fc(ctx, -+ match_criteria, -+ mask->match_buf, -+ &fc_sz); -+ if (!fc) { -+ res = -ENOMEM; -+ goto free_params; -+ } -+ -+ if (fc_sz >= sizeof(num_of_combinations) * BITS_PER_BYTE) { -+ mlx5hws_err(ctx, -+ "Complex matcher: too many match parameters (%d)\n", -+ fc_sz); -+ res = -EINVAL; -+ goto free_fc; -+ } -+ -+ /* We have list of all the match fields from the match parameter. -+ * Now try all the possibilities of splitting them into two match -+ * buffers and look for the supported combination. -+ */ -+ num_of_combinations = 1 << fc_sz; -+ -+ /* Start from combination at index 1 - we know that 0 is unsupported */ -+ for (i = 1; i < num_of_combinations; i++) { -+ if (!hws_bwc_matcher_complex_params_comb_is_valid(fc, fc_sz, i)) -+ continue; -+ -+ hws_bwc_matcher_complex_params_comb_create(ctx, -+ mask, mask_1, mask_2, -+ fc, fc_sz, i); -+ /* We now have two separate sets of match params. -+ * Check if each of them can be used in its own matcher. -+ */ -+ if (!mlx5hws_bwc_match_params_is_complex(ctx, -+ match_criteria, -+ mask_1) && -+ !mlx5hws_bwc_match_params_is_complex(ctx, -+ match_criteria, -+ mask_2)) -+ break; -+ } -+ -+ if (i == num_of_combinations) { -+ /* We've scanned all the combinations, but to no avail */ -+ mlx5hws_err(ctx, "Complex matcher: couldn't find match params combination\n"); -+ res = -EINVAL; -+ goto free_fc; -+ } -+ -+ kfree(fc); -+ return 0; -+ -+free_fc: -+ kfree(fc); -+free_params: -+ hws_bwc_matcher_complex_params_destroy(mask_1, mask_2); -+out: -+ return res; -+} -+ -+static int -+hws_bwc_isolated_table_create(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_table *table) -+{ -+ struct mlx5hws_cmd_ft_modify_attr ft_attr = {0}; -+ struct mlx5hws_context *ctx = table->ctx; -+ struct mlx5hws_table_attr tbl_attr = {0}; -+ struct mlx5hws_table *isolated_tbl; -+ int ret = 0; -+ -+ tbl_attr.type = table->type; -+ tbl_attr.level = table->level; -+ -+ bwc_matcher->complex->isolated_tbl = -+ mlx5hws_table_create(ctx, &tbl_attr); -+ isolated_tbl = bwc_matcher->complex->isolated_tbl; -+ if (!isolated_tbl) -+ return -EINVAL; -+ -+ /* Set the default miss of the isolated table to -+ * point to the end anchor of the original matcher. -+ */ -+ mlx5hws_cmd_set_attr_connect_miss_tbl(ctx, -+ isolated_tbl->fw_ft_type, -+ isolated_tbl->type, -+ &ft_attr); -+ ft_attr.table_miss_id = bwc_matcher->matcher->end_ft_id; -+ -+ ret = mlx5hws_cmd_flow_table_modify(ctx->mdev, -+ &ft_attr, -+ isolated_tbl->ft_id); -+ if (ret) { -+ mlx5hws_err(ctx, "Failed setting isolated tbl default miss\n"); -+ goto destroy_tbl; -+ } -+ -+ return 0; -+ -+destroy_tbl: -+ mlx5hws_table_destroy(isolated_tbl); -+ return ret; -+} -+ -+static void hws_bwc_isolated_table_destroy(struct mlx5hws_table *isolated_tbl) -+{ -+ /* This table is isolated - no table is pointing to it, no need to -+ * disconnect it from anywhere, it won't affect any other table's miss. -+ */ -+ mlx5hws_table_destroy(isolated_tbl); -+} -+ -+static int -+hws_bwc_isolated_matcher_create(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_table *table, -+ u8 match_criteria_enable, -+ struct mlx5hws_match_parameters *mask) -+{ -+ struct mlx5hws_table *isolated_tbl = bwc_matcher->complex->isolated_tbl; -+ struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -+ struct mlx5hws_context *ctx = table->ctx; -+ int ret; -+ -+ isolated_bwc_matcher = kzalloc(sizeof(*bwc_matcher), GFP_KERNEL); -+ if (!isolated_bwc_matcher) -+ return -ENOMEM; -+ -+ bwc_matcher->complex->isolated_bwc_matcher = isolated_bwc_matcher; -+ -+ /* Isolated BWC matcher needs access to the first BWC matcher */ -+ isolated_bwc_matcher->complex_first_bwc_matcher = bwc_matcher; -+ -+ /* Isolated matcher needs to match on REG_C_6, -+ * so make sure its criteria bit is on. -+ */ -+ match_criteria_enable |= MLX5HWS_DEFINER_MATCH_CRITERIA_MISC2; -+ -+ ret = mlx5hws_bwc_matcher_create_simple(isolated_bwc_matcher, -+ isolated_tbl, -+ 0, -+ match_criteria_enable, -+ mask, -+ NULL); -+ if (ret) { -+ mlx5hws_err(ctx, "Complex matcher: failed creating isolated BWC matcher\n"); -+ goto free_matcher; -+ } -+ -+ return 0; -+ -+free_matcher: -+ kfree(bwc_matcher->complex->isolated_bwc_matcher); -+ return ret; -+} -+ -+static void -+hws_bwc_isolated_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -+ kfree(bwc_matcher); -+} -+ -+static int -+hws_bwc_isolated_actions_create(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_table *table) -+{ -+ struct mlx5hws_table *isolated_tbl = bwc_matcher->complex->isolated_tbl; -+ u8 modify_hdr_action[MLX5_ST_SZ_BYTES(set_action_in)] = {0}; -+ struct mlx5hws_context *ctx = table->ctx; -+ struct mlx5hws_action_mh_pattern ptrn; -+ int ret = 0; -+ -+ /* Create action to jump to isolated table */ -+ -+ bwc_matcher->complex->action_go_to_tbl = -+ mlx5hws_action_create_dest_table(ctx, -+ isolated_tbl, -+ MLX5HWS_ACTION_FLAG_HWS_FDB); -+ if (!bwc_matcher->complex->action_go_to_tbl) { -+ mlx5hws_err(ctx, "Complex matcher: failed to create go-to-tbl action\n"); -+ return -EINVAL; -+ } -+ -+ /* Create modify header action to set REG_C_6 */ -+ -+ MLX5_SET(set_action_in, modify_hdr_action, -+ action_type, MLX5_MODIFICATION_TYPE_SET); -+ MLX5_SET(set_action_in, modify_hdr_action, -+ field, MLX5_MODI_META_REG_C_6); -+ MLX5_SET(set_action_in, modify_hdr_action, -+ length, 0); /* zero means length of 32 */ -+ MLX5_SET(set_action_in, modify_hdr_action, offset, 0); -+ MLX5_SET(set_action_in, modify_hdr_action, data, 0); -+ -+ ptrn.data = (void *)modify_hdr_action; -+ ptrn.sz = MLX5HWS_ACTION_DOUBLE_SIZE; -+ -+ bwc_matcher->complex->action_metadata = -+ mlx5hws_action_create_modify_header(ctx, 1, &ptrn, 0, -+ MLX5HWS_ACTION_FLAG_HWS_FDB); -+ if (!bwc_matcher->complex->action_metadata) { -+ ret = -EINVAL; -+ goto destroy_action_go_to_tbl; -+ } -+ -+ /* Create last action */ -+ -+ bwc_matcher->complex->action_last = -+ mlx5hws_action_create_last(ctx, MLX5HWS_ACTION_FLAG_HWS_FDB); -+ if (!bwc_matcher->complex->action_last) { -+ mlx5hws_err(ctx, "Complex matcher: failed to create last action\n"); -+ ret = -EINVAL; -+ goto destroy_action_metadata; -+ } -+ -+ return 0; -+ -+destroy_action_metadata: -+ mlx5hws_action_destroy(bwc_matcher->complex->action_metadata); -+destroy_action_go_to_tbl: -+ mlx5hws_action_destroy(bwc_matcher->complex->action_go_to_tbl); -+ return ret; -+} -+ -+static void -+hws_bwc_isolated_actions_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ mlx5hws_action_destroy(bwc_matcher->complex->action_last); -+ mlx5hws_action_destroy(bwc_matcher->complex->action_metadata); -+ mlx5hws_action_destroy(bwc_matcher->complex->action_go_to_tbl); -+} -+ - int mlx5hws_bwc_matcher_create_complex(struct mlx5hws_bwc_matcher *bwc_matcher, - struct mlx5hws_table *table, - u32 priority, - u8 match_criteria_enable, - struct mlx5hws_match_parameters *mask) - { -- mlx5hws_err(table->ctx, "Complex matcher is not supported yet\n"); -- return -EOPNOTSUPP; -+ enum mlx5hws_action_type complex_init_action_types[3]; -+ struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -+ struct mlx5hws_match_parameters mask_1 = {0}; -+ struct mlx5hws_match_parameters mask_2 = {0}; -+ struct mlx5hws_context *ctx = table->ctx; -+ int ret; -+ -+ ret = hws_bwc_matcher_complex_params_create(table->ctx, -+ match_criteria_enable, -+ mask, &mask_1, &mask_2); -+ if (ret) -+ goto err; -+ -+ bwc_matcher->complex = -+ kzalloc(sizeof(*bwc_matcher->complex), GFP_KERNEL); -+ if (!bwc_matcher->complex) { -+ ret = -ENOMEM; -+ goto free_masks; -+ } -+ -+ ret = rhashtable_init(&bwc_matcher->complex->refcount_hash, -+ &hws_refcount_hash); -+ if (ret) { -+ mlx5hws_err(ctx, "Complex matcher: failed to initialize rhashtable\n"); -+ goto free_complex; -+ } -+ -+ mutex_init(&bwc_matcher->complex->hash_lock); -+ ida_init(&bwc_matcher->complex->metadata_ida); -+ -+ /* Create initial action template for the first matcher. -+ * Usually the initial AT is just dummy, but in case of complex -+ * matcher we know exactly which actions should it have. -+ */ -+ -+ complex_init_action_types[0] = MLX5HWS_ACTION_TYP_MODIFY_HDR; -+ complex_init_action_types[1] = MLX5HWS_ACTION_TYP_TBL; -+ complex_init_action_types[2] = MLX5HWS_ACTION_TYP_LAST; -+ -+ /* Create the first matcher */ -+ -+ ret = mlx5hws_bwc_matcher_create_simple(bwc_matcher, -+ table, -+ priority, -+ match_criteria_enable, -+ &mask_1, -+ complex_init_action_types); -+ if (ret) -+ goto destroy_ida; -+ -+ /* Create isolated table to hold the second isolated matcher */ -+ -+ ret = hws_bwc_isolated_table_create(bwc_matcher, table); -+ if (ret) { -+ mlx5hws_err(ctx, "Complex matcher: failed creating isolated table\n"); -+ goto destroy_first_matcher; -+ } -+ -+ /* Now create the second BWC matcher - the isolated one */ -+ -+ ret = hws_bwc_isolated_matcher_create(bwc_matcher, table, -+ match_criteria_enable, &mask_2); -+ if (ret) { -+ mlx5hws_err(ctx, "Complex matcher: failed creating isolated matcher\n"); -+ goto destroy_isolated_tbl; -+ } -+ -+ /* Create action for isolated matcher's rules */ -+ -+ ret = hws_bwc_isolated_actions_create(bwc_matcher, table); -+ if (ret) { -+ mlx5hws_err(ctx, "Complex matcher: failed creating isolated actions\n"); -+ goto destroy_isolated_matcher; -+ } -+ -+ hws_bwc_matcher_complex_params_destroy(&mask_1, &mask_2); -+ return 0; -+ -+destroy_isolated_matcher: -+ isolated_bwc_matcher = bwc_matcher->complex->isolated_bwc_matcher; -+ hws_bwc_isolated_matcher_destroy(isolated_bwc_matcher); -+destroy_isolated_tbl: -+ hws_bwc_isolated_table_destroy(bwc_matcher->complex->isolated_tbl); -+destroy_first_matcher: -+ mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -+destroy_ida: -+ ida_destroy(&bwc_matcher->complex->metadata_ida); -+ mutex_destroy(&bwc_matcher->complex->hash_lock); -+ rhashtable_destroy(&bwc_matcher->complex->refcount_hash); -+free_complex: -+ kfree(bwc_matcher->complex); -+ bwc_matcher->complex = NULL; -+free_masks: -+ hws_bwc_matcher_complex_params_destroy(&mask_1, &mask_2); -+err: -+ return ret; - } - - void - mlx5hws_bwc_matcher_destroy_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- /* nothing to do here */ -+ struct mlx5hws_bwc_matcher *isolated_bwc_matcher = -+ bwc_matcher->complex->isolated_bwc_matcher; -+ -+ hws_bwc_isolated_actions_destroy(bwc_matcher); -+ hws_bwc_isolated_matcher_destroy(isolated_bwc_matcher); -+ hws_bwc_isolated_table_destroy(bwc_matcher->complex->isolated_tbl); -+ mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -+ ida_destroy(&bwc_matcher->complex->metadata_ida); -+ mutex_destroy(&bwc_matcher->complex->hash_lock); -+ rhashtable_destroy(&bwc_matcher->complex->refcount_hash); -+ kfree(bwc_matcher->complex); -+ bwc_matcher->complex = NULL; -+} -+ -+static void -+hws_bwc_matcher_complex_hash_lock(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ mutex_lock(&bwc_matcher->complex->hash_lock); -+} -+ -+static void -+hws_bwc_matcher_complex_hash_unlock(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ mutex_unlock(&bwc_matcher->complex->hash_lock); -+} -+ -+static int -+hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_match_parameters *params) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_bwc_complex_rule_hash_node *node, *old_node; -+ struct rhashtable *refcount_hash; -+ int i; -+ -+ bwc_rule->complex_hash_node = NULL; -+ -+ node = kzalloc(sizeof(*node), GFP_KERNEL); -+ if (unlikely(!node)) -+ return -ENOMEM; -+ -+ node->tag = ida_alloc(&bwc_matcher->complex->metadata_ida, GFP_KERNEL); -+ refcount_set(&node->refcount, 1); -+ -+ /* Clear match buffer - turn off all the unrelated fields -+ * in accordance with the match params mask for the first -+ * matcher out of the two parts of the complex matcher. -+ * The resulting mask is the key for the hash. -+ */ -+ for (i = 0; i < MLX5_ST_SZ_DW_MATCH_PARAM; i++) -+ node->match_buf[i] = params->match_buf[i] & -+ bwc_matcher->mt->match_param[i]; -+ -+ refcount_hash = &bwc_matcher->complex->refcount_hash; -+ old_node = rhashtable_lookup_get_insert_fast(refcount_hash, -+ &node->hash_node, -+ hws_refcount_hash); -+ if (old_node) { -+ /* Rule with the same tag already exists - update refcount */ -+ refcount_inc(&old_node->refcount); -+ /* Let the new rule use the same tag as the existing rule. -+ * Note that we don't have any indication for the rule creation -+ * process that a rule with similar matching params already -+ * exists - no harm done when this rule is be overwritten by -+ * the same STE. -+ * There's some performance advantage in skipping such cases, -+ * so this is left for future optimizations. -+ */ -+ ida_free(&bwc_matcher->complex->metadata_ida, node->tag); -+ kfree(node); -+ node = old_node; -+ } -+ -+ bwc_rule->complex_hash_node = node; -+ return 0; -+} -+ -+static void -+hws_bwc_rule_complex_hash_node_put(struct mlx5hws_bwc_rule *bwc_rule, -+ bool *is_last_rule) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_bwc_complex_rule_hash_node *node; -+ -+ if (is_last_rule) -+ *is_last_rule = false; -+ -+ node = bwc_rule->complex_hash_node; -+ if (refcount_dec_and_test(&node->refcount)) { -+ rhashtable_remove_fast(&bwc_matcher->complex->refcount_hash, -+ &node->hash_node, -+ hws_refcount_hash); -+ ida_free(&bwc_matcher->complex->metadata_ida, node->tag); -+ kfree(node); -+ if (is_last_rule) -+ *is_last_rule = true; -+ } -+ -+ bwc_rule->complex_hash_node = NULL; - } - - int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, -@@ -70,19 +1144,271 @@ int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_rule_action rule_actions[], - u16 bwc_queue_idx) - { -- mlx5hws_err(bwc_rule->bwc_matcher->matcher->tbl->ctx, -- "Complex rule is not supported yet\n"); -- return -EOPNOTSUPP; -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ u8 modify_hdr_action[MLX5_ST_SZ_BYTES(set_action_in)] = {0}; -+ struct mlx5hws_rule_action rule_actions_1[3] = {0}; -+ struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -+ u32 *match_buf_2; -+ u32 metadata_val; -+ int ret = 0; -+ -+ isolated_bwc_matcher = bwc_matcher->complex->isolated_bwc_matcher; -+ bwc_rule->isolated_bwc_rule = -+ mlx5hws_bwc_rule_alloc(isolated_bwc_matcher); -+ if (unlikely(!bwc_rule->isolated_bwc_rule)) -+ return -ENOMEM; -+ -+ hws_bwc_matcher_complex_hash_lock(bwc_matcher); -+ -+ /* Get a new hash node for this complex rule. -+ * If this is a unique set of match params for the first matcher, -+ * we will get a new hash node with newly allocated IDA. -+ * Otherwise we will get an existing node with IDA and updated refcount. -+ */ -+ ret = hws_bwc_rule_complex_hash_node_get(bwc_rule, params); -+ if (unlikely(ret)) { -+ mlx5hws_err(ctx, "Complex rule: failed getting RHT node for this rule\n"); -+ goto free_isolated_rule; -+ } -+ -+ /* No need to clear match buffer's fields in accordance to what -+ * will actually be matched on first and second matchers. -+ * Both matchers were created with the appropriate masks -+ * and each of them holds the appropriate field copy array, -+ * so rule creation will use only the fields that will be copied -+ * in accordance with setters in field copy array. -+ * We do, however, need to temporary allocate match buffer -+ * for the second (isolated) rule in order to not modify -+ * user's match params buffer. -+ */ -+ -+ match_buf_2 = kmemdup(params->match_buf, -+ MLX5_ST_SZ_BYTES(fte_match_param), -+ GFP_KERNEL); -+ if (unlikely(!match_buf_2)) { -+ mlx5hws_err(ctx, "Complex rule: failed allocating match_buf\n"); -+ ret = ENOMEM; -+ goto hash_node_put; -+ } -+ -+ /* On 2nd matcher, use unique 32-bit ID as a matching tag */ -+ metadata_val = bwc_rule->complex_hash_node->tag; -+ MLX5_SET(fte_match_param, match_buf_2, -+ misc_parameters_2.metadata_reg_c_6, metadata_val); -+ -+ /* Isolated rule's rule_actions contain all the original actions */ -+ ret = mlx5hws_bwc_rule_create_simple(bwc_rule->isolated_bwc_rule, -+ match_buf_2, -+ rule_actions, -+ flow_source, -+ bwc_queue_idx); -+ kfree(match_buf_2); -+ if (unlikely(ret)) { -+ mlx5hws_err(ctx, -+ "Complex rule: failed creating isolated BWC rule (%d)\n", -+ ret); -+ goto hash_node_put; -+ } -+ -+ /* First rule's rule_actions contain setting metadata and -+ * jump to isolated table that contains the second matcher. -+ * Set metadata value to a unique value for this rule. -+ */ -+ -+ MLX5_SET(set_action_in, modify_hdr_action, -+ action_type, MLX5_MODIFICATION_TYPE_SET); -+ MLX5_SET(set_action_in, modify_hdr_action, -+ field, MLX5_MODI_META_REG_C_6); -+ MLX5_SET(set_action_in, modify_hdr_action, -+ length, 0); /* zero means length of 32 */ -+ MLX5_SET(set_action_in, modify_hdr_action, -+ offset, 0); -+ MLX5_SET(set_action_in, modify_hdr_action, -+ data, metadata_val); -+ -+ rule_actions_1[0].action = bwc_matcher->complex->action_metadata; -+ rule_actions_1[0].modify_header.offset = 0; -+ rule_actions_1[0].modify_header.data = modify_hdr_action; -+ -+ rule_actions_1[1].action = bwc_matcher->complex->action_go_to_tbl; -+ rule_actions_1[2].action = bwc_matcher->complex->action_last; -+ -+ ret = mlx5hws_bwc_rule_create_simple(bwc_rule, -+ params->match_buf, -+ rule_actions_1, -+ flow_source, -+ bwc_queue_idx); -+ -+ if (unlikely(ret)) { -+ mlx5hws_err(ctx, -+ "Complex rule: failed creating first BWC rule (%d)\n", -+ ret); -+ goto destroy_isolated_rule; -+ } -+ -+ hws_bwc_matcher_complex_hash_unlock(bwc_matcher); -+ -+ return 0; -+ -+destroy_isolated_rule: -+ mlx5hws_bwc_rule_destroy_simple(bwc_rule->isolated_bwc_rule); -+hash_node_put: -+ hws_bwc_rule_complex_hash_node_put(bwc_rule, NULL); -+free_isolated_rule: -+ hws_bwc_matcher_complex_hash_unlock(bwc_matcher); -+ mlx5hws_bwc_rule_free(bwc_rule->isolated_bwc_rule); -+ return ret; - } - - int mlx5hws_bwc_rule_destroy_complex(struct mlx5hws_bwc_rule *bwc_rule) - { -- return 0; -+ struct mlx5hws_context *ctx = bwc_rule->bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_bwc_rule *isolated_bwc_rule; -+ int ret_isolated, ret; -+ bool is_last_rule; -+ -+ hws_bwc_matcher_complex_hash_lock(bwc_rule->bwc_matcher); -+ -+ hws_bwc_rule_complex_hash_node_put(bwc_rule, &is_last_rule); -+ bwc_rule->rule->skip_delete = !is_last_rule; -+ -+ ret = mlx5hws_bwc_rule_destroy_simple(bwc_rule); -+ if (unlikely(ret)) -+ mlx5hws_err(ctx, "BWC complex rule: failed destroying first rule\n"); -+ -+ isolated_bwc_rule = bwc_rule->isolated_bwc_rule; -+ ret_isolated = mlx5hws_bwc_rule_destroy_simple(isolated_bwc_rule); -+ if (unlikely(ret_isolated)) -+ mlx5hws_err(ctx, "BWC complex rule: failed destroying second (isolated) rule\n"); -+ -+ hws_bwc_matcher_complex_hash_unlock(bwc_rule->bwc_matcher); -+ -+ mlx5hws_bwc_rule_free(isolated_bwc_rule); -+ -+ return ret || ret_isolated; -+} -+ -+static void -+hws_bwc_matcher_clear_hash_rtcs(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ struct mlx5hws_bwc_complex_rule_hash_node *node; -+ struct rhashtable_iter iter; -+ -+ rhashtable_walk_enter(&bwc_matcher->complex->refcount_hash, &iter); -+ rhashtable_walk_start(&iter); -+ -+ while ((node = rhashtable_walk_next(&iter)) != NULL) { -+ if (IS_ERR(node)) -+ continue; -+ node->rtc_valid = false; -+ } -+ -+ rhashtable_walk_stop(&iter); -+ rhashtable_walk_exit(&iter); - } - --int mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) -+int -+mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- mlx5hws_err(bwc_matcher->matcher->tbl->ctx, -- "Moving complex rule is not supported yet\n"); -- return -EOPNOTSUPP; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_matcher *matcher = bwc_matcher->matcher; -+ bool move_error = false, poll_error = false; -+ u16 bwc_queues = mlx5hws_bwc_queues(ctx); -+ struct mlx5hws_bwc_rule *tmp_bwc_rule; -+ struct mlx5hws_rule_attr rule_attr; -+ struct mlx5hws_table *isolated_tbl; -+ struct mlx5hws_rule *tmp_rule; -+ struct list_head *rules_list; -+ u32 expected_completions = 1; -+ u32 end_ft_id; -+ int i, ret; -+ -+ /* We are rehashing the matcher that is the first part of the complex -+ * matcher. Need to update the isolated matcher to point to the end_ft -+ * of this new matcher. This needs to be done before moving any rules -+ * to prevent possible steering loops. -+ */ -+ isolated_tbl = bwc_matcher->complex->isolated_tbl; -+ end_ft_id = bwc_matcher->matcher->resize_dst->end_ft_id; -+ ret = mlx5hws_matcher_update_end_ft_isolated(isolated_tbl, end_ft_id); -+ if (ret) { -+ mlx5hws_err(ctx, -+ "Failed updating end_ft of isolated matcher (%d)\n", -+ ret); -+ return ret; -+ } -+ -+ hws_bwc_matcher_clear_hash_rtcs(bwc_matcher); -+ -+ mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); -+ -+ for (i = 0; i < bwc_queues; i++) { -+ rules_list = &bwc_matcher->rules[i]; -+ if (list_empty(rules_list)) -+ continue; -+ -+ rule_attr.queue_id = mlx5hws_bwc_get_queue_id(ctx, i); -+ -+ list_for_each_entry(tmp_bwc_rule, rules_list, list_node) { -+ /* Check if a rule with similar tag has already -+ * been moved. -+ */ -+ if (tmp_bwc_rule->complex_hash_node->rtc_valid) { -+ /* This rule is a duplicate of rule with similar -+ * tag that has already been moved earlier. -+ * Just update this rule's RTCs. -+ */ -+ tmp_bwc_rule->rule->rtc_0 = -+ tmp_bwc_rule->complex_hash_node->rtc_0; -+ tmp_bwc_rule->rule->rtc_1 = -+ tmp_bwc_rule->complex_hash_node->rtc_1; -+ tmp_bwc_rule->rule->matcher = -+ tmp_bwc_rule->rule->matcher->resize_dst; -+ continue; -+ } -+ -+ /* First time we're moving rule with this tag. -+ * Move it for real. -+ */ -+ tmp_rule = tmp_bwc_rule->rule; -+ tmp_rule->skip_delete = false; -+ ret = mlx5hws_matcher_resize_rule_move(matcher, -+ tmp_rule, -+ &rule_attr); -+ if (unlikely(ret && !move_error)) { -+ mlx5hws_err(ctx, -+ "Moving complex BWC rule failed (%d), attempting to move rest of the rules\n", -+ ret); -+ move_error = true; -+ } -+ -+ expected_completions = 1; -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &expected_completions, -+ true); -+ if (unlikely(ret && !poll_error)) { -+ mlx5hws_err(ctx, -+ "Moving complex BWC rule: poll failed (%d), attempting to move rest of the rules\n", -+ ret); -+ poll_error = true; -+ } -+ -+ /* Done moving the rule to the new matcher, -+ * now update RTCs for all the duplicated rules. -+ */ -+ tmp_bwc_rule->complex_hash_node->rtc_0 = -+ tmp_bwc_rule->rule->rtc_0; -+ tmp_bwc_rule->complex_hash_node->rtc_1 = -+ tmp_bwc_rule->rule->rtc_1; -+ -+ tmp_bwc_rule->complex_hash_node->rtc_valid = true; -+ } -+ } -+ -+ if (move_error || poll_error) -+ ret = -EINVAL; -+ -+ return ret; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -index 340f0688e394..a6887c7e39d5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -@@ -4,6 +4,27 @@ - #ifndef HWS_BWC_COMPLEX_H_ - #define HWS_BWC_COMPLEX_H_ - -+struct mlx5hws_bwc_complex_rule_hash_node { -+ u32 match_buf[MLX5_ST_SZ_DW_MATCH_PARAM]; -+ u32 tag; -+ refcount_t refcount; -+ bool rtc_valid; -+ u32 rtc_0; -+ u32 rtc_1; -+ struct rhash_head hash_node; -+}; -+ -+struct mlx5hws_bwc_matcher_complex_data { -+ struct mlx5hws_table *isolated_tbl; -+ struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -+ struct mlx5hws_action *action_metadata; -+ struct mlx5hws_action *action_go_to_tbl; -+ struct mlx5hws_action *action_last; -+ struct rhashtable refcount_hash; -+ struct mutex hash_lock; /* Protect the refcount rhashtable */ -+ struct ida metadata_ida; -+}; -+ - bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, - u8 match_criteria_enable, - struct mlx5hws_match_parameters *mask); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1370-net-mlx5-hws-force-rehash-when-rule-insertion-failed.patch b/SOURCES/1370-net-mlx5-hws-force-rehash-when-rule-insertion-failed.patch deleted file mode 100644 index 166cd18eb..000000000 --- a/SOURCES/1370-net-mlx5-hws-force-rehash-when-rule-insertion-failed.patch +++ /dev/null @@ -1,93 +0,0 @@ -From bf97c3c319b7e24f5e432eae209ee48da86864e3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:04 -0400 -Subject: [PATCH] net/mlx5: HWS, force rehash when rule insertion failed - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9d4024edce1063b616fa8bf7b2363290503cc322 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:06 2025 +0300 - - net/mlx5: HWS, force rehash when rule insertion failed - - Rules are inserted into hash table in accordance with their hash index. - When a certain number of rules is reached, the table is rehashed: - a bigger new table is allocated and all the rules are moved there. - But sometimes a new rule can't be inserted into the hash table - because its index is full, even though the number of rules in the - table is well below the threshold. The hash function is not perfect, - so such cases are not rare. When that happens, we want to do the same - rehash, in order to increase the table size and lower the probability - for such cases. - - This patch fixes the usecase where rule insertion was failing, but - rehash couldn't be initiated due to low number of rules: it adds flag - that denotes that rehash is required, even if the number of rules in - the table is below the rehash threshold. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index d70db6948dbb..dce2605fc99b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -169,6 +169,7 @@ mlx5hws_bwc_matcher_create(struct mlx5hws_table *table, - return NULL; - - atomic_set(&bwc_matcher->num_of_rules, 0); -+ atomic_set(&bwc_matcher->rehash_required, false); - - /* Check if the required match params can be all matched - * in single STE, otherwise complex matcher is needed. -@@ -769,9 +770,9 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - - /* It is possible that other rule has already performed rehash. - * Need to check again if we really need rehash. -- * If the reason for rehash was size, but not any more - skip rehash. - */ -- if (!hws_bwc_matcher_rehash_size_needed(bwc_matcher, -+ if (!atomic_read(&bwc_matcher->rehash_required) && -+ !hws_bwc_matcher_rehash_size_needed(bwc_matcher, - atomic_read(&bwc_matcher->num_of_rules))) - return 0; - -@@ -782,6 +783,8 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - * - destroy the old matcher - */ - -+ atomic_set(&bwc_matcher->rehash_required, false); -+ - ret = hws_bwc_matcher_extend_size(bwc_matcher); - if (ret) - return ret; -@@ -875,6 +878,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - * Try rehash by size and insert rule again - last chance. - */ - -+ atomic_set(&bwc_matcher->rehash_required, true); - mutex_unlock(queue_lock); - - hws_bwc_lock_all_queues(ctx); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index cf2b65146317..d21fc247a510 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -30,6 +30,7 @@ struct mlx5hws_bwc_matcher { - u8 size_log; - u32 priority; - atomic_t num_of_rules; -+ atomic_t rehash_required; - struct list_head *rules; - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1371-net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch b/SOURCES/1371-net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch deleted file mode 100644 index 3319e20cd..000000000 --- a/SOURCES/1371-net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch +++ /dev/null @@ -1,99 +0,0 @@ -From cfa1d3ecb42da569e4f38ae06c426e91a98f92ea Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:05 -0400 -Subject: [PATCH] net/mlx5: HWS, fix counting of rules in the matcher - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4c56b5cbc323a10ebb6595500fb78fd8a4762efd -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:07 2025 +0300 - - net/mlx5: HWS, fix counting of rules in the matcher - - Currently the counter that counts number of rules in a matcher is - increased only when rule insertion is completed. In a multi-threaded - usecase this can lead to a scenario that many rules can be in process - of insertion in the same matcher, while none of them has completed - the insertion and the rule counter is not updated. This results in - a rule insertion failure for many of them at first attempt, which - leads to all of them requiring rehash and requiring locking of all - the queue locks. - - This patch fixes the case by increasing the rule counter in the - beginning of insertion process and decreasing in case of any failure. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-8-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index dce2605fc99b..7d991a61eeb3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -341,16 +341,12 @@ static void hws_bwc_rule_list_add(struct mlx5hws_bwc_rule *bwc_rule, u16 idx) - { - struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; - -- atomic_inc(&bwc_matcher->num_of_rules); - bwc_rule->bwc_queue_idx = idx; - list_add(&bwc_rule->list_node, &bwc_matcher->rules[idx]); - } - - static void hws_bwc_rule_list_remove(struct mlx5hws_bwc_rule *bwc_rule) - { -- struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -- -- atomic_dec(&bwc_matcher->num_of_rules); - list_del_init(&bwc_rule->list_node); - } - -@@ -404,6 +400,7 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - mutex_lock(queue_lock); - - ret = hws_bwc_rule_destroy_hws_sync(bwc_rule, &attr); -+ atomic_dec(&bwc_matcher->num_of_rules); - hws_bwc_rule_list_remove(bwc_rule); - - mutex_unlock(queue_lock); -@@ -840,7 +837,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - } - - /* check if number of rules require rehash */ -- num_of_rules = atomic_read(&bwc_matcher->num_of_rules); -+ num_of_rules = atomic_inc_return(&bwc_matcher->num_of_rules); - - if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_matcher, num_of_rules))) { - mutex_unlock(queue_lock); -@@ -854,6 +851,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - bwc_matcher->size_log - MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP, - bwc_matcher->size_log, - ret); -+ atomic_dec(&bwc_matcher->num_of_rules); - return ret; - } - -@@ -887,6 +885,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - - if (ret) { - mlx5hws_err(ctx, "BWC rule insertion: rehash failed (%d)\n", ret); -+ atomic_dec(&bwc_matcher->num_of_rules); - return ret; - } - -@@ -902,6 +901,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(ret)) { - mutex_unlock(queue_lock); - mlx5hws_err(ctx, "BWC rule insertion failed (%d)\n", ret); -+ atomic_dec(&bwc_matcher->num_of_rules); - return ret; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1372-net-mlx5-hws-fix-redundant-extension-of-action-templates.patch b/SOURCES/1372-net-mlx5-hws-fix-redundant-extension-of-action-templates.patch deleted file mode 100644 index e9382cd40..000000000 --- a/SOURCES/1372-net-mlx5-hws-fix-redundant-extension-of-action-templates.patch +++ /dev/null @@ -1,171 +0,0 @@ -From cb05a4cab576c3226584ec674529506113f984f5 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:05 -0400 -Subject: [PATCH] net/mlx5: HWS, fix redundant extension of action templates - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 041861b40f599311214a52075140db8be29fd27f -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:08 2025 +0300 - - net/mlx5: HWS, fix redundant extension of action templates - - When a rule is inserted into a matcher, we search for the suitable - action template. If such template is not found, action template array - is extended with the new template. However, when several threads are - performing this in parallel, there is a race - we can end up with - extending the action templates array with the same template. - - This patch is doing the following: - - refactor the code to find action template index in rule create and - update, have the common code in an auxiliary function - - after locking all the queues, check again if the action template - array still needs to be extended - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-9-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 7d991a61eeb3..456fac895f5e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -789,6 +789,53 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - return hws_bwc_matcher_move(bwc_matcher); - } - -+static int hws_bwc_rule_get_at_idx(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_rule_action rule_actions[], -+ u16 bwc_queue_idx) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mutex *queue_lock; /* Protect the queue */ -+ int at_idx, ret; -+ -+ /* check if rehash needed due to missing action template */ -+ at_idx = hws_bwc_matcher_find_at(bwc_matcher, rule_actions); -+ if (likely(at_idx >= 0)) -+ return at_idx; -+ -+ /* we need to extend BWC matcher action templates array */ -+ queue_lock = hws_bwc_get_queue_lock(ctx, bwc_queue_idx); -+ mutex_unlock(queue_lock); -+ hws_bwc_lock_all_queues(ctx); -+ -+ /* check again - perhaps other thread already did extend_at */ -+ at_idx = hws_bwc_matcher_find_at(bwc_matcher, rule_actions); -+ if (at_idx >= 0) -+ goto out; -+ -+ ret = hws_bwc_matcher_extend_at(bwc_matcher, rule_actions); -+ if (unlikely(ret)) { -+ mlx5hws_err(ctx, "BWC rule: failed extending AT (%d)", ret); -+ at_idx = -EINVAL; -+ goto out; -+ } -+ -+ /* action templates array was extended, we need the last idx */ -+ at_idx = bwc_matcher->num_of_at - 1; -+ ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -+ bwc_matcher->at[at_idx]); -+ if (unlikely(ret)) { -+ mlx5hws_err(ctx, "BWC rule: failed attaching new AT (%d)", ret); -+ at_idx = -EINVAL; -+ goto out; -+ } -+ -+out: -+ hws_bwc_unlock_all_queues(ctx); -+ mutex_lock(queue_lock); -+ return at_idx; -+} -+ - int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - u32 *match_param, - struct mlx5hws_rule_action rule_actions[], -@@ -809,31 +856,12 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - - mutex_lock(queue_lock); - -- /* check if rehash needed due to missing action template */ -- at_idx = hws_bwc_matcher_find_at(bwc_matcher, rule_actions); -+ at_idx = hws_bwc_rule_get_at_idx(bwc_rule, rule_actions, bwc_queue_idx); - if (unlikely(at_idx < 0)) { -- /* we need to extend BWC matcher action templates array */ - mutex_unlock(queue_lock); -- hws_bwc_lock_all_queues(ctx); -- -- ret = hws_bwc_matcher_extend_at(bwc_matcher, rule_actions); -- if (unlikely(ret)) { -- hws_bwc_unlock_all_queues(ctx); -- return ret; -- } -- -- /* action templates array was extended, we need the last idx */ -- at_idx = bwc_matcher->num_of_at - 1; -- -- ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx]); -- if (unlikely(ret)) { -- hws_bwc_unlock_all_queues(ctx); -- return ret; -- } -- -- hws_bwc_unlock_all_queues(ctx); -- mutex_lock(queue_lock); -+ mlx5hws_err(ctx, "BWC rule create: failed getting AT (%d)", -+ ret); -+ return -EINVAL; - } - - /* check if number of rules require rehash */ -@@ -971,36 +999,11 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - - mutex_lock(queue_lock); - -- /* check if rehash needed due to missing action template */ -- at_idx = hws_bwc_matcher_find_at(bwc_matcher, rule_actions); -+ at_idx = hws_bwc_rule_get_at_idx(bwc_rule, rule_actions, idx); - if (unlikely(at_idx < 0)) { -- /* we need to extend BWC matcher action templates array */ - mutex_unlock(queue_lock); -- hws_bwc_lock_all_queues(ctx); -- -- /* check again - perhaps other thread already did extend_at */ -- at_idx = hws_bwc_matcher_find_at(bwc_matcher, rule_actions); -- if (likely(at_idx < 0)) { -- ret = hws_bwc_matcher_extend_at(bwc_matcher, rule_actions); -- if (unlikely(ret)) { -- hws_bwc_unlock_all_queues(ctx); -- mlx5hws_err(ctx, "BWC rule update: failed extending AT (%d)", ret); -- return -EINVAL; -- } -- -- /* action templates array was extended, we need the last idx */ -- at_idx = bwc_matcher->num_of_at - 1; -- -- ret = mlx5hws_matcher_attach_at(bwc_matcher->matcher, -- bwc_matcher->at[at_idx]); -- if (unlikely(ret)) { -- hws_bwc_unlock_all_queues(ctx); -- return ret; -- } -- } -- -- hws_bwc_unlock_all_queues(ctx); -- mutex_lock(queue_lock); -+ mlx5hws_err(ctx, "BWC rule update: failed getting AT\n"); -+ return -EINVAL; - } - - ret = hws_bwc_rule_update_sync(bwc_rule, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1373-net-mlx5-hws-rework-rehash-loop.patch b/SOURCES/1373-net-mlx5-hws-rework-rehash-loop.patch deleted file mode 100644 index c3732cad3..000000000 --- a/SOURCES/1373-net-mlx5-hws-rework-rehash-loop.patch +++ /dev/null @@ -1,209 +0,0 @@ -From a380ec59fea7f1801a94b324bd7f688f2d3be0dd Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:05 -0400 -Subject: [PATCH] net/mlx5: HWS, rework rehash loop - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ef94799a87415790d4297cf06075f99b70c420cd -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:09 2025 +0300 - - net/mlx5: HWS, rework rehash loop - - Reworking the rehash loop - simplifying the code and making it less - error prone: - - Instead of doing round-robin on all the queues with batch of rules in - each cycle, just go over all the queues and move all the rules that - belong to this queue. - - If at some stage of moving the rule we get a failure (which should - not happen), this can't be rolled back. So instead of aborting - rehash and leaving the matcher in a broken state, allow the loop - to continue: attempt to move the rest of the rules and delete the - old matcher. A rule that failed to move to a new matcher will loose - its match STE once the rehash is completed and the old matcher is - deleted, so the rule won't match any traffic any more. This rule's - packets will fall back to the steering pipeline w/o HW offload. - Rehash procedure will return an error, which will cause the rule - insertion to fail for the rule that started this whole rehash. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-10-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 456fac895f5e..9e057f808ea5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -610,95 +610,69 @@ hws_bwc_matcher_find_at(struct mlx5hws_bwc_matcher *bwc_matcher, - - static int hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - { -+ bool move_error = false, poll_error = false, drain_error = false; - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_matcher *matcher = bwc_matcher->matcher; - u16 bwc_queues = mlx5hws_bwc_queues(ctx); -- struct mlx5hws_bwc_rule **bwc_rules; - struct mlx5hws_rule_attr rule_attr; -- u32 *pending_rules; -- int i, j, ret = 0; -- bool all_done; -- u16 burst_th; -+ struct mlx5hws_bwc_rule *bwc_rule; -+ struct mlx5hws_send_engine *queue; -+ struct list_head *rules_list; -+ u32 pending_rules; -+ int i, ret = 0; - - mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); - -- pending_rules = kcalloc(bwc_queues, sizeof(*pending_rules), GFP_KERNEL); -- if (!pending_rules) -- return -ENOMEM; -- -- bwc_rules = kcalloc(bwc_queues, sizeof(*bwc_rules), GFP_KERNEL); -- if (!bwc_rules) { -- ret = -ENOMEM; -- goto free_pending_rules; -- } -- - for (i = 0; i < bwc_queues; i++) { - if (list_empty(&bwc_matcher->rules[i])) -- bwc_rules[i] = NULL; -- else -- bwc_rules[i] = list_first_entry(&bwc_matcher->rules[i], -- struct mlx5hws_bwc_rule, -- list_node); -- } -+ continue; - -- do { -- all_done = true; -+ pending_rules = 0; -+ rule_attr.queue_id = mlx5hws_bwc_get_queue_id(ctx, i); -+ rules_list = &bwc_matcher->rules[i]; - -- for (i = 0; i < bwc_queues; i++) { -- rule_attr.queue_id = mlx5hws_bwc_get_queue_id(ctx, i); -- burst_th = hws_bwc_get_burst_th(ctx, rule_attr.queue_id); -- -- for (j = 0; j < burst_th && bwc_rules[i]; j++) { -- rule_attr.burst = !!((j + 1) % burst_th); -- ret = mlx5hws_matcher_resize_rule_move(bwc_matcher->matcher, -- bwc_rules[i]->rule, -- &rule_attr); -- if (unlikely(ret)) { -- mlx5hws_err(ctx, -- "Moving BWC rule failed during rehash (%d)\n", -- ret); -- goto free_bwc_rules; -- } -+ list_for_each_entry(bwc_rule, rules_list, list_node) { -+ ret = mlx5hws_matcher_resize_rule_move(matcher, -+ bwc_rule->rule, -+ &rule_attr); -+ if (unlikely(ret && !move_error)) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: move failed (%d), attempting to move rest of the rules\n", -+ ret); -+ move_error = true; -+ } - -- all_done = false; -- pending_rules[i]++; -- bwc_rules[i] = list_is_last(&bwc_rules[i]->list_node, -- &bwc_matcher->rules[i]) ? -- NULL : list_next_entry(bwc_rules[i], list_node); -- -- ret = mlx5hws_bwc_queue_poll(ctx, -- rule_attr.queue_id, -- &pending_rules[i], -- false); -- if (unlikely(ret)) { -- mlx5hws_err(ctx, -- "Moving BWC rule failed during rehash (%d)\n", -- ret); -- goto free_bwc_rules; -- } -+ pending_rules++; -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &pending_rules, -+ false); -+ if (unlikely(ret && !poll_error)) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: poll failed (%d), attempting to move rest of the rules\n", -+ ret); -+ poll_error = true; - } - } -- } while (!all_done); -- -- /* drain all the bwc queues */ -- for (i = 0; i < bwc_queues; i++) { -- if (pending_rules[i]) { -- u16 queue_id = mlx5hws_bwc_get_queue_id(ctx, i); - -- mlx5hws_send_engine_flush_queue(&ctx->send_queue[queue_id]); -- ret = mlx5hws_bwc_queue_poll(ctx, queue_id, -- &pending_rules[i], true); -- if (unlikely(ret)) { -+ if (pending_rules) { -+ queue = &ctx->send_queue[rule_attr.queue_id]; -+ mlx5hws_send_engine_flush_queue(queue); -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &pending_rules, -+ true); -+ if (unlikely(ret && !drain_error)) { - mlx5hws_err(ctx, -- "Moving BWC rule failed during rehash (%d)\n", ret); -- goto free_bwc_rules; -+ "Moving BWC rule: drain failed (%d), attempting to move rest of the rules\n", -+ ret); -+ drain_error = true; - } - } - } - --free_bwc_rules: -- kfree(bwc_rules); --free_pending_rules: -- kfree(pending_rules); -+ if (move_error || poll_error || drain_error) -+ ret = -EINVAL; - - return ret; - } -@@ -742,15 +716,18 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) - } - - ret = hws_bwc_matcher_move_all(bwc_matcher); -- if (ret) { -- mlx5hws_err(ctx, "Rehash error: moving rules failed\n"); -- return -ENOMEM; -- } -+ if (ret) -+ mlx5hws_err(ctx, "Rehash error: moving rules failed, attempting to remove the old matcher\n"); -+ -+ /* Error during rehash can't be rolled back. -+ * The best option here is to allow the rehash to complete and remove -+ * the old matcher - can't leave the matcher in the 'in_resize' state. -+ */ - - bwc_matcher->matcher = new_matcher; - mlx5hws_matcher_destroy(old_matcher); - -- return 0; -+ return ret; - } - - static int --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1374-net-mlx5-hws-dump-bad-completion-details.patch b/SOURCES/1374-net-mlx5-hws-dump-bad-completion-details.patch deleted file mode 100644 index 16fb21381..000000000 --- a/SOURCES/1374-net-mlx5-hws-dump-bad-completion-details.patch +++ /dev/null @@ -1,191 +0,0 @@ -From 965036aa649e8bc7524cb8c517e5701242864867 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:05 -0400 -Subject: [PATCH] net/mlx5: HWS, dump bad completion details - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 578b856b5e72b7b8cd2390a0e525e240d3e80c92 -Author: Yevgeny Kliteynik -Date: Sun May 11 22:38:10 2025 +0300 - - net/mlx5: HWS, dump bad completion details - - Failing to insert/delete a rule should not happen. If it does happen, - it would be good to know at which stage it happened and what was the - failure. This patch adds printing of bad CQE details. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1746992290-568936-11-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -index cb6abc4ab7df..c4b22be19a9b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -@@ -344,18 +344,133 @@ hws_send_engine_update_rule_resize(struct mlx5hws_send_engine *queue, - } - } - -+static void hws_send_engine_dump_error_cqe(struct mlx5hws_send_engine *queue, -+ struct mlx5hws_send_ring_priv *priv, -+ struct mlx5_cqe64 *cqe) -+{ -+ u8 wqe_opcode = cqe ? be32_to_cpu(cqe->sop_drop_qpn) >> 24 : 0; -+ struct mlx5hws_context *ctx = priv->rule->matcher->tbl->ctx; -+ u32 opcode = cqe ? get_cqe_opcode(cqe) : 0; -+ struct mlx5hws_rule *rule = priv->rule; -+ -+ /* If something bad happens and lots of rules are failing, we don't -+ * want to pollute dmesg. Print only the first bad cqe per engine, -+ * the one that started the avalanche. -+ */ -+ if (queue->error_cqe_printed) -+ return; -+ -+ queue->error_cqe_printed = true; -+ -+ if (mlx5hws_rule_move_in_progress(rule)) -+ mlx5hws_err(ctx, -+ "--- rule 0x%08llx: error completion moving rule: phase %s, wqes left %d\n", -+ HWS_PTR_TO_ID(rule), -+ rule->resize_info->state == -+ MLX5HWS_RULE_RESIZE_STATE_WRITING ? "WRITING" : -+ rule->resize_info->state == -+ MLX5HWS_RULE_RESIZE_STATE_DELETING ? "DELETING" : -+ "UNKNOWN", -+ rule->pending_wqes); -+ else -+ mlx5hws_err(ctx, -+ "--- rule 0x%08llx: error completion %s (%d), wqes left %d\n", -+ HWS_PTR_TO_ID(rule), -+ rule->status == -+ MLX5HWS_RULE_STATUS_CREATING ? "CREATING" : -+ rule->status == -+ MLX5HWS_RULE_STATUS_DELETING ? "DELETING" : -+ rule->status == -+ MLX5HWS_RULE_STATUS_FAILING ? "FAILING" : -+ rule->status == -+ MLX5HWS_RULE_STATUS_UPDATING ? "UPDATING" : "NA", -+ rule->status, -+ rule->pending_wqes); -+ -+ mlx5hws_err(ctx, " rule 0x%08llx: matcher 0x%llx %s\n", -+ HWS_PTR_TO_ID(rule), -+ HWS_PTR_TO_ID(rule->matcher), -+ (rule->matcher->flags & MLX5HWS_MATCHER_FLAGS_ISOLATED) ? -+ "(isolated)" : ""); -+ -+ if (!cqe) { -+ mlx5hws_err(ctx, " rule 0x%08llx: no CQE\n", -+ HWS_PTR_TO_ID(rule)); -+ return; -+ } -+ -+ mlx5hws_err(ctx, " rule 0x%08llx: cqe->opcode = %d %s\n", -+ HWS_PTR_TO_ID(rule), opcode, -+ opcode == MLX5_CQE_REQ ? "(MLX5_CQE_REQ)" : -+ opcode == MLX5_CQE_REQ_ERR ? "(MLX5_CQE_REQ_ERR)" : " "); -+ -+ if (opcode == MLX5_CQE_REQ_ERR) { -+ struct mlx5_err_cqe *err_cqe = (struct mlx5_err_cqe *)cqe; -+ -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |--- hw_error_syndrome = 0x%x\n", -+ HWS_PTR_TO_ID(rule), -+ err_cqe->rsvd1[16]); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |--- hw_syndrome_type = 0x%x\n", -+ HWS_PTR_TO_ID(rule), -+ err_cqe->rsvd1[17] >> 4); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |--- vendor_err_synd = 0x%x\n", -+ HWS_PTR_TO_ID(rule), -+ err_cqe->vendor_err_synd); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |--- syndrome = 0x%x\n", -+ HWS_PTR_TO_ID(rule), -+ err_cqe->syndrome); -+ } -+ -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: cqe->byte_cnt = 0x%08x\n", -+ HWS_PTR_TO_ID(rule), be32_to_cpu(cqe->byte_cnt)); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |-- UPDATE STATUS = %s\n", -+ HWS_PTR_TO_ID(rule), -+ (be32_to_cpu(cqe->byte_cnt) & 0x80000000) ? -+ "FAILURE" : "SUCCESS"); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |------- SYNDROME = %s\n", -+ HWS_PTR_TO_ID(rule), -+ ((be32_to_cpu(cqe->byte_cnt) & 0x00000003) == 1) ? -+ "SET_FLOW_FAIL" : -+ ((be32_to_cpu(cqe->byte_cnt) & 0x00000003) == 2) ? -+ "DISABLE_FLOW_FAIL" : "UNKNOWN"); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: cqe->sop_drop_qpn = 0x%08x\n", -+ HWS_PTR_TO_ID(rule), be32_to_cpu(cqe->sop_drop_qpn)); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |-send wqe opcode = 0x%02x %s\n", -+ HWS_PTR_TO_ID(rule), wqe_opcode, -+ wqe_opcode == MLX5HWS_WQE_OPCODE_TBL_ACCESS ? -+ "(MLX5HWS_WQE_OPCODE_TBL_ACCESS)" : "(UNKNOWN)"); -+ mlx5hws_err(ctx, -+ " rule 0x%08llx: |------------ qpn = 0x%06x\n", -+ HWS_PTR_TO_ID(rule), -+ be32_to_cpu(cqe->sop_drop_qpn) & 0xffffff); -+} -+ - static void hws_send_engine_update_rule(struct mlx5hws_send_engine *queue, - struct mlx5hws_send_ring_priv *priv, - u16 wqe_cnt, -- enum mlx5hws_flow_op_status *status) -+ enum mlx5hws_flow_op_status *status, -+ struct mlx5_cqe64 *cqe) - { - priv->rule->pending_wqes--; - -- if (*status == MLX5HWS_FLOW_OP_ERROR) { -+ if (unlikely(*status == MLX5HWS_FLOW_OP_ERROR)) { - if (priv->retry_id) { -+ /* If there is a retry_id, then it's not an error yet, -+ * retry to insert this rule in the collision RTC. -+ */ - hws_send_engine_retry_post_send(queue, priv, wqe_cnt); - return; - } -+ hws_send_engine_dump_error_cqe(queue, priv, cqe); - /* Some part of the rule failed */ - priv->rule->status = MLX5HWS_RULE_STATUS_FAILING; - *priv->used_id = 0; -@@ -420,7 +535,8 @@ static void hws_send_engine_update(struct mlx5hws_send_engine *queue, - - if (priv->user_data) { - if (priv->rule) { -- hws_send_engine_update_rule(queue, priv, wqe_cnt, &status); -+ hws_send_engine_update_rule(queue, priv, wqe_cnt, -+ &status, cqe); - /* Completion is provided on the last rule WQE */ - if (priv->rule->pending_wqes) - return; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.h -index f833092235c1..3fb8e99309b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.h -@@ -140,6 +140,7 @@ struct mlx5hws_send_engine { - u16 used_entries; - u16 num_entries; - bool err; -+ bool error_cqe_printed; - struct mutex lock; /* Protects the send engine */ - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1375-net-mlx5-use-to-delayed-work.patch b/SOURCES/1375-net-mlx5-use-to-delayed-work.patch deleted file mode 100644 index 68373c1a5..000000000 --- a/SOURCES/1375-net-mlx5-use-to-delayed-work.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 5447a8c66fd43b005c3f33fe8b63145af1ce5893 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:06 -0400 -Subject: [PATCH] net/mlx5: Use to_delayed_work() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ee39bae6c141876f5b4c001f6b12b4f8ffb4cd08 -Author: Chen Ni -Date: Wed May 14 15:24:19 2025 +0800 - - net/mlx5: Use to_delayed_work() - - Use to_delayed_work() instead of open-coding it. - - Signed-off-by: Chen Ni - Acked-by: Mark Bloch - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250514072419.2707578-1-nichen@iscas.ac.cn - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index e53dbdc0a7a1..b1aeea7c4a91 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -927,8 +927,7 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - - static void cb_timeout_handler(struct work_struct *work) - { -- struct delayed_work *dwork = container_of(work, struct delayed_work, -- work); -+ struct delayed_work *dwork = to_delayed_work(work); - struct mlx5_cmd_work_ent *ent = container_of(dwork, - struct mlx5_cmd_work_ent, - cb_timeout_work); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1376-net-mlx5-sws-fix-reformat-id-error-handling.patch b/SOURCES/1376-net-mlx5-sws-fix-reformat-id-error-handling.patch deleted file mode 100644 index f902c0c0d..000000000 --- a/SOURCES/1376-net-mlx5-sws-fix-reformat-id-error-handling.patch +++ /dev/null @@ -1,196 +0,0 @@ -From d9f5ece10ab6345c8de1a61e674bcdef45d0ce56 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:06 -0400 -Subject: [PATCH] net/mlx5: SWS, fix reformat id error handling - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ca7690dae1269f454572c163ed5271feed060af5 -Author: Vlad Dogaru -Date: Tue May 20 21:46:39 2025 +0300 - - net/mlx5: SWS, fix reformat id error handling - - The firmware reformat id is a u32 and can't safely be returned as an - int. Because the functions also need a way to signal error, prefer to - return the id as an output parameter and keep the return code only for - success/error. - - While we're at it, also extract some duplicate code to fetch the - reformat id from a more generic struct pkt_reformat. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1747766802-958178-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -index a47c29571f64..1af76da8b132 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -@@ -527,7 +527,7 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev, - struct mlx5_flow_rule *dst; - void *in_flow_context, *vlan; - void *in_match_value; -- int reformat_id = 0; -+ u32 reformat_id = 0; - unsigned int inlen; - int dst_cnt_size; - u32 *in, action; -@@ -580,23 +580,21 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev, - MLX5_SET(flow_context, in_flow_context, action, action); - - if (!extended_dest && fte->act_dests.action.pkt_reformat) { -- struct mlx5_pkt_reformat *pkt_reformat = fte->act_dests.action.pkt_reformat; -- -- if (pkt_reformat->owner == MLX5_FLOW_RESOURCE_OWNER_SW) { -- reformat_id = mlx5_fs_dr_action_get_pkt_reformat_id(pkt_reformat); -- if (reformat_id < 0) { -- mlx5_core_err(dev, -- "Unsupported SW-owned pkt_reformat type (%d) in FW-owned table\n", -- pkt_reformat->reformat_type); -- err = reformat_id; -- goto err_out; -- } -- } else { -- reformat_id = fte->act_dests.action.pkt_reformat->id; -+ struct mlx5_pkt_reformat *pkt_reformat = -+ fte->act_dests.action.pkt_reformat; -+ -+ err = mlx5_fs_get_packet_reformat_id(pkt_reformat, -+ &reformat_id); -+ if (err) { -+ mlx5_core_err(dev, -+ "Unsupported pkt_reformat type (%d)\n", -+ pkt_reformat->reformat_type); -+ goto err_out; - } - } - -- MLX5_SET(flow_context, in_flow_context, packet_reformat_id, (u32)reformat_id); -+ MLX5_SET(flow_context, in_flow_context, packet_reformat_id, -+ reformat_id); - - if (fte->act_dests.action.modify_hdr) { - if (fte->act_dests.action.modify_hdr->owner == MLX5_FLOW_RESOURCE_OWNER_SW) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index a22ecf141518..c7ce9fc797c4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -1830,14 +1830,33 @@ static int create_auto_flow_group(struct mlx5_flow_table *ft, - return err; - } - -+int mlx5_fs_get_packet_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *id) -+{ -+ switch (pkt_reformat->owner) { -+ case MLX5_FLOW_RESOURCE_OWNER_FW: -+ *id = pkt_reformat->id; -+ return 0; -+ case MLX5_FLOW_RESOURCE_OWNER_SW: -+ return mlx5_fs_dr_action_get_pkt_reformat_id(pkt_reformat, id); -+ default: -+ return -EINVAL; -+ } -+} -+ - static bool mlx5_pkt_reformat_cmp(struct mlx5_pkt_reformat *p1, - struct mlx5_pkt_reformat *p2) - { -- return p1->owner == p2->owner && -- (p1->owner == MLX5_FLOW_RESOURCE_OWNER_FW ? -- p1->id == p2->id : -- mlx5_fs_dr_action_get_pkt_reformat_id(p1) == -- mlx5_fs_dr_action_get_pkt_reformat_id(p2)); -+ int err1, err2; -+ u32 id1, id2; -+ -+ if (p1->owner != p2->owner) -+ return false; -+ -+ err1 = mlx5_fs_get_packet_reformat_id(p1, &id1); -+ err2 = mlx5_fs_get_packet_reformat_id(p2, &id2); -+ -+ return !err1 && !err2 && id1 == id2; - } - - static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index 1f523fb761f6..a41d3491d2af 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -387,6 +387,9 @@ u32 mlx5_fs_get_capabilities(struct mlx5_core_dev *dev, enum mlx5_flow_namespace - - struct mlx5_flow_root_namespace *find_root(struct fs_node *node); - -+int mlx5_fs_get_packet_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *id); -+ - #define fs_get_obj(v, _node) {v = container_of((_node), typeof(*v), node); } - - #define fs_list_for_each_entry(pos, root) \ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.c -index 8007d3f523c9..f367997ab61e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.c -@@ -833,15 +833,21 @@ static u32 mlx5_cmd_dr_get_capabilities(struct mlx5_flow_root_namespace *ns, - return steering_caps; - } - --int mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat) -+int -+mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id) - { -+ struct mlx5dr_action *dr_action; -+ - switch (pkt_reformat->reformat_type) { - case MLX5_REFORMAT_TYPE_L2_TO_VXLAN: - case MLX5_REFORMAT_TYPE_L2_TO_NVGRE: - case MLX5_REFORMAT_TYPE_L2_TO_L2_TUNNEL: - case MLX5_REFORMAT_TYPE_L2_TO_L3_TUNNEL: - case MLX5_REFORMAT_TYPE_INSERT_HDR: -- return mlx5dr_action_get_pkt_reformat_id(pkt_reformat->fs_dr_action.dr_action); -+ dr_action = pkt_reformat->fs_dr_action.dr_action; -+ *reformat_id = mlx5dr_action_get_pkt_reformat_id(dr_action); -+ return 0; - } - return -EOPNOTSUPP; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.h -index 99a3b2eff6b8..f869f2daefbf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/fs_dr.h -@@ -38,7 +38,9 @@ struct mlx5_fs_dr_table { - - bool mlx5_fs_dr_is_supported(struct mlx5_core_dev *dev); - --int mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat); -+int -+mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id); - - const struct mlx5_flow_cmds *mlx5_fs_cmd_get_dr_cmds(void); - -@@ -49,9 +51,11 @@ static inline const struct mlx5_flow_cmds *mlx5_fs_cmd_get_dr_cmds(void) - return NULL; - } - --static inline u32 mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat) -+static inline int -+mlx5_fs_dr_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id) - { -- return 0; -+ return -EOPNOTSUPP; - } - - static inline bool mlx5_fs_dr_is_supported(struct mlx5_core_dev *dev) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1377-net-mlx5-hws-register-reformat-actions-with-fw.patch b/SOURCES/1377-net-mlx5-hws-register-reformat-actions-with-fw.patch deleted file mode 100644 index 815a51a5c..000000000 --- a/SOURCES/1377-net-mlx5-hws-register-reformat-actions-with-fw.patch +++ /dev/null @@ -1,246 +0,0 @@ -From a2158eb7d1e077c0cf3a4b1bad863e6bd081d31d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:06 -0400 -Subject: [PATCH] net/mlx5: HWS, register reformat actions with fw - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b206d9ec19dfc2db706883ff6b46b259831a033d -Author: Vlad Dogaru -Date: Tue May 20 21:46:40 2025 +0300 - - net/mlx5: HWS, register reformat actions with fw - - Hardware steering handles actions differently from firmware, but for - termination rules that use encapsulation the firmware needs to be aware - of the action. - - Fix this by registering reformat actions with the firmware the first - time this is needed. To do this, add a third possible owner for an - action, and also a lock to protect against registration of the same - action from different threads. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1747766802-958178-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index c7ce9fc797c4..c330b64a506b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -1839,6 +1839,8 @@ int mlx5_fs_get_packet_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, - return 0; - case MLX5_FLOW_RESOURCE_OWNER_SW: - return mlx5_fs_dr_action_get_pkt_reformat_id(pkt_reformat, id); -+ case MLX5_FLOW_RESOURCE_OWNER_HWS: -+ return mlx5_fs_hws_action_get_pkt_reformat_id(pkt_reformat, id); - default: - return -EINVAL; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index a41d3491d2af..e6a95b310b55 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -58,6 +58,7 @@ struct mlx5_flow_definer { - enum mlx5_flow_resource_owner { - MLX5_FLOW_RESOURCE_OWNER_FW, - MLX5_FLOW_RESOURCE_OWNER_SW, -+ MLX5_FLOW_RESOURCE_OWNER_HWS, - }; - - struct mlx5_modify_hdr { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index bef4d25c1a2a..aa47a7af6f50 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -72,6 +72,11 @@ enum mlx5hws_action_type mlx5hws_action_get_type(struct mlx5hws_action *action) - return action->type; - } - -+struct mlx5_core_dev *mlx5hws_action_get_dev(struct mlx5hws_action *action) -+{ -+ return action->ctx->mdev; -+} -+ - static int hws_action_get_shared_stc_nic(struct mlx5hws_context *ctx, - enum mlx5hws_context_shared_stc_type stc_type, - u8 tbl_type) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index 1b787cd66e6f..9d1c0e4b224a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -1081,13 +1081,8 @@ static int mlx5_cmd_hws_create_fte(struct mlx5_flow_root_namespace *ns, - struct mlx5hws_bwc_rule *rule; - int err = 0; - -- if (mlx5_fs_cmd_is_fw_term_table(ft)) { -- /* Packet reformat on terminamtion table not supported yet */ -- if (fte->act_dests.action.action & -- MLX5_FLOW_CONTEXT_ACTION_PACKET_REFORMAT) -- return -EOPNOTSUPP; -+ if (mlx5_fs_cmd_is_fw_term_table(ft)) - return mlx5_fs_cmd_get_fw_cmds()->create_fte(ns, ft, group, fte); -- } - - err = mlx5_fs_fte_get_hws_actions(ns, ft, group, fte, &ractions); - if (err) -@@ -1362,7 +1357,7 @@ mlx5_cmd_hws_packet_reformat_alloc(struct mlx5_flow_root_namespace *ns, - pkt_reformat->fs_hws_action.pr_data = pr_data; - } - -- pkt_reformat->owner = MLX5_FLOW_RESOURCE_OWNER_SW; -+ pkt_reformat->owner = MLX5_FLOW_RESOURCE_OWNER_HWS; - pkt_reformat->fs_hws_action.hws_action = hws_action; - return 0; - -@@ -1380,6 +1375,15 @@ static void mlx5_cmd_hws_packet_reformat_dealloc(struct mlx5_flow_root_namespace - struct mlx5_fs_hws_pr *pr_data; - struct mlx5_fs_pool *pr_pool; - -+ if (pkt_reformat->fs_hws_action.fw_reformat_id != 0) { -+ struct mlx5_pkt_reformat fw_pkt_reformat = { 0 }; -+ -+ fw_pkt_reformat.id = pkt_reformat->fs_hws_action.fw_reformat_id; -+ mlx5_fs_cmd_get_fw_cmds()-> -+ packet_reformat_dealloc(ns, &fw_pkt_reformat); -+ pkt_reformat->fs_hws_action.fw_reformat_id = 0; -+ } -+ - if (pkt_reformat->reformat_type == MLX5_REFORMAT_TYPE_REMOVE_HDR) - return; - -@@ -1499,6 +1503,7 @@ static int mlx5_cmd_hws_modify_header_alloc(struct mlx5_flow_root_namespace *ns, - err = -ENOMEM; - goto release_mh; - } -+ mutex_init(&modify_hdr->fs_hws_action.lock); - modify_hdr->fs_hws_action.mh_data = mh_data; - modify_hdr->fs_hws_action.fs_pool = pool; - modify_hdr->owner = MLX5_FLOW_RESOURCE_OWNER_SW; -@@ -1532,6 +1537,58 @@ static void mlx5_cmd_hws_modify_header_dealloc(struct mlx5_flow_root_namespace * - modify_hdr->fs_hws_action.mh_data = NULL; - } - -+int -+mlx5_fs_hws_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id) -+{ -+ enum mlx5_flow_namespace_type ns_type = pkt_reformat->ns_type; -+ struct mutex *lock = &pkt_reformat->fs_hws_action.lock; -+ u32 *id = &pkt_reformat->fs_hws_action.fw_reformat_id; -+ struct mlx5_pkt_reformat fw_pkt_reformat = { 0 }; -+ struct mlx5_pkt_reformat_params params = { 0 }; -+ struct mlx5_flow_root_namespace *ns; -+ struct mlx5_core_dev *dev; -+ int ret; -+ -+ mutex_lock(lock); -+ -+ if (*id != 0) { -+ *reformat_id = *id; -+ ret = 0; -+ goto unlock; -+ } -+ -+ dev = mlx5hws_action_get_dev(pkt_reformat->fs_hws_action.hws_action); -+ if (!dev) { -+ ret = -EINVAL; -+ goto unlock; -+ } -+ -+ ns = mlx5_get_root_namespace(dev, ns_type); -+ if (!ns) { -+ ret = -EINVAL; -+ goto unlock; -+ } -+ -+ params.type = pkt_reformat->reformat_type; -+ params.size = pkt_reformat->fs_hws_action.pr_data->data_size; -+ params.data = pkt_reformat->fs_hws_action.pr_data->data; -+ -+ ret = mlx5_fs_cmd_get_fw_cmds()-> -+ packet_reformat_alloc(ns, ¶ms, ns_type, &fw_pkt_reformat); -+ if (ret) -+ goto unlock; -+ -+ *id = fw_pkt_reformat.id; -+ *reformat_id = *id; -+ ret = 0; -+ -+unlock: -+ mutex_unlock(lock); -+ -+ return ret; -+} -+ - static int mlx5_cmd_hws_create_match_definer(struct mlx5_flow_root_namespace *ns, - u16 format_id, u32 *match_mask) - { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.h -index 8b56298288da..b92d55b2d147 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.h -@@ -41,6 +41,11 @@ struct mlx5_fs_hws_action { - struct mlx5_fs_pool *fs_pool; - struct mlx5_fs_hws_pr *pr_data; - struct mlx5_fs_hws_mh *mh_data; -+ u32 fw_reformat_id; -+ /* Protect `fw_reformat_id` against being initialized from multiple -+ * threads. -+ */ -+ struct mutex lock; - }; - - struct mlx5_fs_hws_matcher { -@@ -84,12 +89,23 @@ void mlx5_fs_put_hws_action(struct mlx5_fs_hws_data *fs_hws_data); - - #ifdef CONFIG_MLX5_HW_STEERING - -+int -+mlx5_fs_hws_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id); -+ - bool mlx5_fs_hws_is_supported(struct mlx5_core_dev *dev); - - const struct mlx5_flow_cmds *mlx5_fs_cmd_get_hws_cmds(void); - - #else - -+static inline int -+mlx5_fs_hws_action_get_pkt_reformat_id(struct mlx5_pkt_reformat *pkt_reformat, -+ u32 *reformat_id) -+{ -+ return -EOPNOTSUPP; -+} -+ - static inline bool mlx5_fs_hws_is_supported(struct mlx5_core_dev *dev) - { - return false; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index fbd63369da10..9bbadc4d8a0b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -503,6 +503,15 @@ int mlx5hws_rule_action_update(struct mlx5hws_rule *rule, - enum mlx5hws_action_type - mlx5hws_action_get_type(struct mlx5hws_action *action); - -+/** -+ * mlx5hws_action_get_dev - Get mlx5 core device. -+ * -+ * @action: The action to get the device from. -+ * -+ * Return: mlx5 core device. -+ */ -+struct mlx5_core_dev *mlx5hws_action_get_dev(struct mlx5hws_action *action); -+ - /** - * mlx5hws_action_create_dest_drop - Create a direct rule drop action. - * --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1378-net-mlx5-hws-fix-typo-nope-to-nop.patch b/SOURCES/1378-net-mlx5-hws-fix-typo-nope-to-nop.patch deleted file mode 100644 index b3857668c..000000000 --- a/SOURCES/1378-net-mlx5-hws-fix-typo-nope-to-nop.patch +++ /dev/null @@ -1,220 +0,0 @@ -From 80492ad30af1ed97b996b34f6e6daac2f98ef98d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:07 -0400 -Subject: [PATCH] net/mlx5: HWS, fix typo - 'nope' to 'nop' - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 0b6e452caf03da63aeb2e84475771d6fb6d6cd99 -Author: Yevgeny Kliteynik -Date: Tue May 20 21:46:41 2025 +0300 - - net/mlx5: HWS, fix typo - 'nope' to 'nop' - - Fix typo - rename 'nope_locations' to 'nop_locations', which describes - the locations of 'nop' actions. To shorten the lines, this renaming - also required some refactoring. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1747766802-958178-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index aa47a7af6f50..64d115feef2c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1207,16 +1207,16 @@ hws_action_create_modify_header_hws(struct mlx5hws_action *action, - for (i = 0; i < num_of_patterns; i++) { - size_t new_num_actions; - size_t cur_num_actions; -- u32 nope_location; -+ u32 nop_locations; - - cur_num_actions = pattern[i].sz / MLX5HWS_MODIFY_ACTION_SIZE; - -- mlx5hws_pat_calc_nope(pattern[i].data, cur_num_actions, -- pat_max_sz / MLX5HWS_MODIFY_ACTION_SIZE, -- &new_num_actions, &nope_location, -- &new_pattern[i * pat_max_sz]); -+ mlx5hws_pat_calc_nop(pattern[i].data, cur_num_actions, -+ pat_max_sz / MLX5HWS_MODIFY_ACTION_SIZE, -+ &new_num_actions, &nop_locations, -+ &new_pattern[i * pat_max_sz]); - -- action[i].modify_header.nope_locations = nope_location; -+ action[i].modify_header.nop_locations = nop_locations; - action[i].modify_header.num_of_actions = new_num_actions; - - max_mh_actions = max(max_mh_actions, new_num_actions); -@@ -1263,7 +1263,7 @@ hws_action_create_modify_header_hws(struct mlx5hws_action *action, - MLX5_GET(set_action_in, pattern[i].data, action_type); - } else { - /* Multiple modify actions require a pattern */ -- if (unlikely(action[i].modify_header.nope_locations)) { -+ if (unlikely(action[i].modify_header.nop_locations)) { - size_t pattern_sz; - - pattern_sz = action[i].modify_header.num_of_actions * -@@ -2105,12 +2105,12 @@ static void hws_action_modify_write(struct mlx5hws_send_engine *queue, - u32 arg_idx, - u8 *arg_data, - u16 num_of_actions, -- u32 nope_locations) -+ u32 nop_locations) - { - u8 *new_arg_data = NULL; - int i, j; - -- if (unlikely(nope_locations)) { -+ if (unlikely(nop_locations)) { - new_arg_data = kcalloc(num_of_actions, - MLX5HWS_MODIFY_ACTION_SIZE, GFP_KERNEL); - if (unlikely(!new_arg_data)) -@@ -2118,7 +2118,7 @@ static void hws_action_modify_write(struct mlx5hws_send_engine *queue, - - for (i = 0, j = 0; i < num_of_actions; i++, j++) { - memcpy(&new_arg_data[j], arg_data, MLX5HWS_MODIFY_ACTION_SIZE); -- if (BIT(i) & nope_locations) -+ if (BIT(i) & nop_locations) - j++; - } - } -@@ -2215,6 +2215,7 @@ hws_action_setter_modify_header(struct mlx5hws_actions_apply_data *apply, - struct mlx5hws_action *action; - u32 arg_sz, arg_idx; - u8 *single_action; -+ u8 max_actions; - __be32 stc_idx; - - rule_action = &apply->rule_action[setter->idx_double]; -@@ -2242,21 +2243,23 @@ hws_action_setter_modify_header(struct mlx5hws_actions_apply_data *apply, - - apply->wqe_data[MLX5HWS_ACTION_OFFSET_DW7] = - *(__be32 *)MLX5_ADDR_OF(set_action_in, single_action, data); -- } else { -- /* Argument offset multiple with number of args per these actions */ -- arg_sz = mlx5hws_arg_get_arg_size(action->modify_header.max_num_of_actions); -- arg_idx = rule_action->modify_header.offset * arg_sz; -- -- apply->wqe_data[MLX5HWS_ACTION_OFFSET_DW7] = htonl(arg_idx); -- -- if (!(action->flags & MLX5HWS_ACTION_FLAG_SHARED)) { -- apply->require_dep = 1; -- hws_action_modify_write(apply->queue, -- action->modify_header.arg_id + arg_idx, -- rule_action->modify_header.data, -- action->modify_header.num_of_actions, -- action->modify_header.nope_locations); -- } -+ return; -+ } -+ -+ /* Argument offset multiple with number of args per these actions */ -+ max_actions = action->modify_header.max_num_of_actions; -+ arg_sz = mlx5hws_arg_get_arg_size(max_actions); -+ arg_idx = rule_action->modify_header.offset * arg_sz; -+ -+ apply->wqe_data[MLX5HWS_ACTION_OFFSET_DW7] = htonl(arg_idx); -+ -+ if (!(action->flags & MLX5HWS_ACTION_FLAG_SHARED)) { -+ apply->require_dep = 1; -+ hws_action_modify_write(apply->queue, -+ action->modify_header.arg_id + arg_idx, -+ rule_action->modify_header.data, -+ action->modify_header.num_of_actions, -+ action->modify_header.nop_locations); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -index 25fa0d4c9221..55a079fdd08f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.h -@@ -136,7 +136,7 @@ struct mlx5hws_action { - u32 pat_id; - u32 arg_id; - __be64 single_action; -- u32 nope_locations; -+ u32 nop_locations; - u8 num_of_patterns; - u8 single_action_type; - u8 num_of_actions; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -index f51ed24526b9..78de19c074a7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -@@ -522,9 +522,9 @@ bool mlx5hws_pat_verify_actions(struct mlx5hws_context *ctx, __be64 pattern[], s - return true; - } - --void mlx5hws_pat_calc_nope(__be64 *pattern, size_t num_actions, -- size_t max_actions, size_t *new_size, -- u32 *nope_location, __be64 *new_pat) -+void mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -+ size_t max_actions, size_t *new_size, -+ u32 *nop_locations, __be64 *new_pat) - { - u16 prev_src_field = 0, prev_dst_field = 0; - u16 src_field, dst_field; -@@ -532,7 +532,7 @@ void mlx5hws_pat_calc_nope(__be64 *pattern, size_t num_actions, - size_t i, j; - - *new_size = num_actions; -- *nope_location = 0; -+ *nop_locations = 0; - - if (num_actions == 1) - return; -@@ -546,18 +546,18 @@ void mlx5hws_pat_calc_nope(__be64 *pattern, size_t num_actions, - if (action_type == MLX5_ACTION_TYPE_COPY && - (prev_src_field == src_field || - prev_dst_field == dst_field)) { -- /* need Nope */ -+ /* need Nop */ - *new_size += 1; -- *nope_location |= BIT(i); -+ *nop_locations |= BIT(i); - memset(&new_pat[j], 0, MLX5HWS_MODIFY_ACTION_SIZE); - MLX5_SET(set_action_in, &new_pat[j], - action_type, - MLX5_MODIFICATION_TYPE_NOP); - j++; - } else if (prev_src_field == src_field) { -- /* need Nope*/ -+ /* need Nop */ - *new_size += 1; -- *nope_location |= BIT(i); -+ *nop_locations |= BIT(i); - MLX5_SET(set_action_in, &new_pat[j], - action_type, - MLX5_MODIFICATION_TYPE_NOP); -@@ -568,7 +568,7 @@ void mlx5hws_pat_calc_nope(__be64 *pattern, size_t num_actions, - /* check if no more space */ - if (j > max_actions) { - *new_size = num_actions; -- *nope_location = 0; -+ *nop_locations = 0; - return; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -index 8ddb51980044..91bd2572a341 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -@@ -96,6 +96,7 @@ int mlx5hws_arg_write_inline_arg_data(struct mlx5hws_context *ctx, - u8 *arg_data, - size_t data_size); - --void mlx5hws_pat_calc_nope(__be64 *pattern, size_t num_actions, size_t max_actions, -- size_t *new_size, u32 *nope_location, __be64 *new_pat); -+void mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -+ size_t max_actions, size_t *new_size, -+ u32 *nop_locations, __be64 *new_pat); - #endif /* MLX5HWS_PAT_ARG_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1379-net-mlx5-hws-handle-modify-header-actions-dependency.patch b/SOURCES/1379-net-mlx5-hws-handle-modify-header-actions-dependency.patch deleted file mode 100644 index 7fc53d5a3..000000000 --- a/SOURCES/1379-net-mlx5-hws-handle-modify-header-actions-dependency.patch +++ /dev/null @@ -1,228 +0,0 @@ -From 49dd65e6ee03b3423cd69b885fdab5ae5ec32303 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:07 -0400 -Subject: [PATCH] net/mlx5: HWS, handle modify header actions dependency - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 01e035fd0380b285d72725adb5a45f1d73549db8 -Author: Yevgeny Kliteynik -Date: Tue May 20 21:46:42 2025 +0300 - - net/mlx5: HWS, handle modify header actions dependency - - Having adjacent accelerated modify header actions (so-called - pattern-argument actions) may result in inconsistent outcome. - These inconsistencies can take the form of writes to the same - field or a read coupled with a write to the same field. The - solution is to detect such dependencies and insert nops between - the offending actions. - - The existing implementation had a few issues, which pretty much - required a complete rewrite of the code that handles these - dependencies. - - In the new implementation we're doing the following: - - * Checking any two adjacent actions for conflicts (not just - odd-even pairs). - * Marking 'set' and 'add' action fields as destination, rather - than source, for the purposes of checking for conflicts. - * Checking all types of actions ('add', 'set', 'copy') for - dependencies. - * Managing offsets of the args in the buffer - copy the action - args to the right place in the buffer. - * Checking that after inserting nops we're still within the number - of supported actions - return an error otherwise. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1747766802-958178-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 64d115feef2c..fb62f3bc4bd4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1190,14 +1190,15 @@ hws_action_create_modify_header_hws(struct mlx5hws_action *action, - struct mlx5hws_action_mh_pattern *pattern, - u32 log_bulk_size) - { -+ u16 num_actions, max_mh_actions = 0, hw_max_actions; - struct mlx5hws_context *ctx = action->ctx; -- u16 num_actions, max_mh_actions = 0; - int i, ret, size_in_bytes; - u32 pat_id, arg_id = 0; - __be64 *new_pattern; - size_t pat_max_sz; - - pat_max_sz = MLX5HWS_ARG_CHUNK_SIZE_MAX * MLX5HWS_ARG_DATA_SIZE; -+ hw_max_actions = pat_max_sz / MLX5HWS_MODIFY_ACTION_SIZE; - size_in_bytes = pat_max_sz * sizeof(__be64); - new_pattern = kcalloc(num_of_patterns, size_in_bytes, GFP_KERNEL); - if (!new_pattern) -@@ -1211,10 +1212,14 @@ hws_action_create_modify_header_hws(struct mlx5hws_action *action, - - cur_num_actions = pattern[i].sz / MLX5HWS_MODIFY_ACTION_SIZE; - -- mlx5hws_pat_calc_nop(pattern[i].data, cur_num_actions, -- pat_max_sz / MLX5HWS_MODIFY_ACTION_SIZE, -- &new_num_actions, &nop_locations, -- &new_pattern[i * pat_max_sz]); -+ ret = mlx5hws_pat_calc_nop(pattern[i].data, cur_num_actions, -+ hw_max_actions, &new_num_actions, -+ &nop_locations, -+ &new_pattern[i * pat_max_sz]); -+ if (ret) { -+ mlx5hws_err(ctx, "Too many actions after nop insertion\n"); -+ goto free_new_pat; -+ } - - action[i].modify_header.nop_locations = nop_locations; - action[i].modify_header.num_of_actions = new_num_actions; -@@ -2116,10 +2121,12 @@ static void hws_action_modify_write(struct mlx5hws_send_engine *queue, - if (unlikely(!new_arg_data)) - return; - -- for (i = 0, j = 0; i < num_of_actions; i++, j++) { -- memcpy(&new_arg_data[j], arg_data, MLX5HWS_MODIFY_ACTION_SIZE); -+ for (i = 0, j = 0; j < num_of_actions; i++, j++) { - if (BIT(i) & nop_locations) - j++; -+ memcpy(&new_arg_data[j * MLX5HWS_MODIFY_ACTION_SIZE], -+ &arg_data[i * MLX5HWS_MODIFY_ACTION_SIZE], -+ MLX5HWS_MODIFY_ACTION_SIZE); - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -index 78de19c074a7..51e4c551e0ef 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -@@ -490,8 +490,8 @@ hws_action_modify_get_target_fields(u8 action_type, __be64 *pattern, - switch (action_type) { - case MLX5_ACTION_TYPE_SET: - case MLX5_ACTION_TYPE_ADD: -- *src_field = MLX5_GET(set_action_in, pattern, field); -- *dst_field = INVALID_FIELD; -+ *src_field = INVALID_FIELD; -+ *dst_field = MLX5_GET(set_action_in, pattern, field); - break; - case MLX5_ACTION_TYPE_COPY: - *src_field = MLX5_GET(copy_action_in, pattern, src_field); -@@ -522,57 +522,59 @@ bool mlx5hws_pat_verify_actions(struct mlx5hws_context *ctx, __be64 pattern[], s - return true; - } - --void mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -- size_t max_actions, size_t *new_size, -- u32 *nop_locations, __be64 *new_pat) -+int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -+ size_t max_actions, size_t *new_size, -+ u32 *nop_locations, __be64 *new_pat) - { -- u16 prev_src_field = 0, prev_dst_field = 0; -+ u16 prev_src_field = INVALID_FIELD, prev_dst_field = INVALID_FIELD; - u16 src_field, dst_field; - u8 action_type; -+ bool dependent; - size_t i, j; - - *new_size = num_actions; - *nop_locations = 0; - - if (num_actions == 1) -- return; -+ return 0; - - for (i = 0, j = 0; i < num_actions; i++, j++) { -- action_type = MLX5_GET(set_action_in, &pattern[i], action_type); -+ if (j >= max_actions) -+ return -EINVAL; - -+ action_type = MLX5_GET(set_action_in, &pattern[i], action_type); - hws_action_modify_get_target_fields(action_type, &pattern[i], - &src_field, &dst_field); -- if (i % 2) { -- if (action_type == MLX5_ACTION_TYPE_COPY && -- (prev_src_field == src_field || -- prev_dst_field == dst_field)) { -- /* need Nop */ -- *new_size += 1; -- *nop_locations |= BIT(i); -- memset(&new_pat[j], 0, MLX5HWS_MODIFY_ACTION_SIZE); -- MLX5_SET(set_action_in, &new_pat[j], -- action_type, -- MLX5_MODIFICATION_TYPE_NOP); -- j++; -- } else if (prev_src_field == src_field) { -- /* need Nop */ -- *new_size += 1; -- *nop_locations |= BIT(i); -- MLX5_SET(set_action_in, &new_pat[j], -- action_type, -- MLX5_MODIFICATION_TYPE_NOP); -- j++; -- } -- } -- memcpy(&new_pat[j], &pattern[i], MLX5HWS_MODIFY_ACTION_SIZE); -- /* check if no more space */ -- if (j > max_actions) { -- *new_size = num_actions; -- *nop_locations = 0; -- return; -+ -+ /* For every action, look at it and the previous one. The two -+ * actions are dependent if: -+ */ -+ dependent = -+ (i > 0) && -+ /* At least one of the actions is a write and */ -+ (dst_field != INVALID_FIELD || -+ prev_dst_field != INVALID_FIELD) && -+ /* One reads from the other's source */ -+ (dst_field == prev_src_field || -+ src_field == prev_dst_field || -+ /* Or both write to the same destination */ -+ dst_field == prev_dst_field); -+ -+ if (dependent) { -+ *new_size += 1; -+ *nop_locations |= BIT(i); -+ memset(&new_pat[j], 0, MLX5HWS_MODIFY_ACTION_SIZE); -+ MLX5_SET(set_action_in, &new_pat[j], action_type, -+ MLX5_MODIFICATION_TYPE_NOP); -+ j++; -+ if (j >= max_actions) -+ return -EINVAL; - } - -+ memcpy(&new_pat[j], &pattern[i], MLX5HWS_MODIFY_ACTION_SIZE); - prev_src_field = src_field; - prev_dst_field = dst_field; - } -+ -+ return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -index 91bd2572a341..7fbd8dc7aa18 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.h -@@ -96,7 +96,7 @@ int mlx5hws_arg_write_inline_arg_data(struct mlx5hws_context *ctx, - u8 *arg_data, - size_t data_size); - --void mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -- size_t max_actions, size_t *new_size, -- u32 *nop_locations, __be64 *new_pat); -+int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, -+ size_t max_actions, size_t *new_size, -+ u32 *nop_locations, __be64 *new_pat); - #endif /* MLX5HWS_PAT_ARG_H_ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1380-net-mlx5-core-add-error-handling-inmlx5-query-nic-vport-qkey.patch b/SOURCES/1380-net-mlx5-core-add-error-handling-inmlx5-query-nic-vport-qkey.patch deleted file mode 100644 index 56723ff72..000000000 --- a/SOURCES/1380-net-mlx5-core-add-error-handling-inmlx5-query-nic-vport-qkey.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 07d72a58ed409c2ba3a0099febcaf5e9186274e4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:07 -0400 -Subject: [PATCH] net/mlx5_core: Add error handling - inmlx5_query_nic_vport_qkey_viol_cntr() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f0b50730bdd8f2734e548de541e845c0d40dceb6 -Author: Wentao Liang -Date: Wed May 21 21:36:20 2025 +0800 - - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() - - The function mlx5_query_nic_vport_qkey_viol_cntr() calls the function - mlx5_query_nic_vport_context() but does not check its return value. This - could lead to undefined behavior if the query fails. A proper - implementation can be found in mlx5_nic_vport_query_local_lb(). - - Add error handling for mlx5_query_nic_vport_context(). If it fails, free - the out buffer via kvfree() and return error code. - - Fixes: 9efa75254593 ("net/mlx5_core: Introduce access functions to query vport RoCE fields") - Cc: stable@vger.kernel.org # v4.5 - Signed-off-by: Wentao Liang - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250521133620.912-1-vulab@iscas.ac.cn - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index d10d4c396040..a3c57bb8b521 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -519,19 +519,22 @@ int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev, - { - u32 *out; - int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -+ int err; - - out = kvzalloc(outlen, GFP_KERNEL); - if (!out) - return -ENOMEM; - -- mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, out); -+ if (err) -+ goto out; - - *qkey_viol_cntr = MLX5_GET(query_nic_vport_context_out, out, - nic_vport_context.qkey_violation_counter); -- -+out: - kvfree(out); - -- return 0; -+ return err; - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_qkey_viol_cntr); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1381-net-mlx5e-allow-setting-mac-address-of-representors.patch b/SOURCES/1381-net-mlx5e-allow-setting-mac-address-of-representors.patch deleted file mode 100644 index e9a3d4d64..000000000 --- a/SOURCES/1381-net-mlx5e-allow-setting-mac-address-of-representors.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 8c0cb6c3c0865ac0421987596b2b3d90ec2f2510 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:08 -0400 -Subject: [PATCH] net/mlx5e: Allow setting MAC address of representors - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f95633adc177416ac21f16db9ce1e75c74db805a -Author: Mark Bloch -Date: Thu May 22 10:13:56 2025 +0300 - - net/mlx5e: Allow setting MAC address of representors - - A representor netdev does not correspond to real hardware that needs to - be updated when setting the MAC address. The default eth_mac_addr() is - sufficient for simply updating the netdev's MAC address with validation. - - Signed-off-by: Mark Bloch - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1747898036-1121904-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 58cd153ccc61..2640cace0f76 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -803,6 +803,7 @@ static const struct net_device_ops mlx5e_netdev_ops_rep = { - .ndo_stop = mlx5e_rep_close, - .ndo_start_xmit = mlx5e_xmit, - .ndo_setup_tc = mlx5e_rep_setup_tc, -+ .ndo_set_mac_address = eth_mac_addr, - .ndo_get_stats64 = mlx5e_rep_get_stats, - .ndo_has_offload_stats = mlx5e_rep_has_offload_stats, - .ndo_get_offload_stats = mlx5e_rep_get_offload_stats, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1382-net-mlx5-add-error-handling-in-mlx5-query-nic-vport-node-gui.patch b/SOURCES/1382-net-mlx5-add-error-handling-in-mlx5-query-nic-vport-node-gui.patch deleted file mode 100644 index 22f4c58ec..000000000 --- a/SOURCES/1382-net-mlx5-add-error-handling-in-mlx5-query-nic-vport-node-gui.patch +++ /dev/null @@ -1,63 +0,0 @@ -From dd1d14ed8fcc14c857f5bcd97ad842a291d390e6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:08 -0400 -Subject: [PATCH] net/mlx5: Add error handling in - mlx5_query_nic_vport_node_guid() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c6bb8a21cdad8c975a3a646b9e5c8df01ad29783 -Author: Wentao Liang -Date: Sun May 25 00:34:25 2025 +0800 - - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() - - The function mlx5_query_nic_vport_node_guid() calls the function - mlx5_query_nic_vport_context() but does not check its return value. - A proper implementation can be found in mlx5_nic_vport_query_local_lb(). - - Add error handling for mlx5_query_nic_vport_context(). If it fails, free - the out buffer via kvfree() and return error code. - - Fixes: 9efa75254593 ("net/mlx5_core: Introduce access functions to query vport RoCE fields") - Cc: stable@vger.kernel.org # v4.5 - Signed-off-by: Wentao Liang - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250524163425.1695-1-vulab@iscas.ac.cn - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index a3c57bb8b521..da5c24fc7b30 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -465,19 +465,22 @@ int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid) - { - u32 *out; - int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -+ int err; - - out = kvzalloc(outlen, GFP_KERNEL); - if (!out) - return -ENOMEM; - -- mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, out); -+ if (err) -+ goto out; - - *node_guid = MLX5_GET64(query_nic_vport_context_out, out, - nic_vport_context.node_guid); -- -+out: - kvfree(out); - -- return 0; -+ return err; - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_vport_node_guid); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1383-net-mlx5-hws-fix-an-error-code-in-mlx5hws-bwc-rule-create-co.patch b/SOURCES/1383-net-mlx5-hws-fix-an-error-code-in-mlx5hws-bwc-rule-create-co.patch deleted file mode 100644 index 440f0e3ca..000000000 --- a/SOURCES/1383-net-mlx5-hws-fix-an-error-code-in-mlx5hws-bwc-rule-create-co.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e2f7050c9a027152fc3001519b825cfd333320c0 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:08 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix an error code in - mlx5hws_bwc_rule_create_complex() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a540ee75945a96f606c6ac955bfed5410d318f7d -Author: Dan Carpenter -Date: Fri May 23 19:00:12 2025 +0300 - - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() - - This was intended to be negative -ENOMEM but the '-' character was left - off accidentally. This typo doesn't affect runtime because the caller - treats all non-zero returns the same. - - Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") - Signed-off-by: Dan Carpenter - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/aDCbjNcquNC68Hyj@stanley.mountain - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -index 5d30c5b094fc..70768953a4f6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -@@ -1188,7 +1188,7 @@ int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, - GFP_KERNEL); - if (unlikely(!match_buf_2)) { - mlx5hws_err(ctx, "Complex rule: failed allocating match_buf\n"); -- ret = ENOMEM; -+ ret = -ENOMEM; - goto hash_node_put; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1384-net-mlx5-ensure-fw-pages-are-always-allocated-on-same-numa.patch b/SOURCES/1384-net-mlx5-ensure-fw-pages-are-always-allocated-on-same-numa.patch deleted file mode 100644 index bfad78e2b..000000000 --- a/SOURCES/1384-net-mlx5-ensure-fw-pages-are-always-allocated-on-same-numa.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 15be556a20263870bb8b7e0974d3452f4d4b3616 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:08 -0400 -Subject: [PATCH] net/mlx5: Ensure fw pages are always allocated on same NUMA - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f37258133c1e95e61db532e14067e28b4881bf24 -Author: Moshe Shemesh -Date: Tue Jun 10 18:15:06 2025 +0300 - - net/mlx5: Ensure fw pages are always allocated on same NUMA - - When firmware asks the driver to allocate more pages, using event of - give_pages, the driver should always allocate it from same NUMA, the - original device NUMA. Current code uses dev_to_node() which can result - in different NUMA as it is changed by other driver flows, such as - mlx5_dma_zalloc_coherent_node(). Instead, use saved numa node for - allocating firmware pages. - - Fixes: 311c7c71c9bb ("net/mlx5e: Allocate DMA coherent memory on reader NUMA node") - Signed-off-by: Moshe Shemesh - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -index 972e8e9df585..9bc9bd83c232 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -@@ -291,7 +291,7 @@ static void free_4k(struct mlx5_core_dev *dev, u64 addr, u32 function) - static int alloc_system_page(struct mlx5_core_dev *dev, u32 function) - { - struct device *device = mlx5_core_dma_dev(dev); -- int nid = dev_to_node(device); -+ int nid = dev->priv.numa_node; - struct page *page; - u64 zero_addr = 1; - u64 addr; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1385-net-mlx5-fix-return-value-when-searching-for-existing-flow-g.patch b/SOURCES/1385-net-mlx5-fix-return-value-when-searching-for-existing-flow-g.patch deleted file mode 100644 index 92e4328e8..000000000 --- a/SOURCES/1385-net-mlx5-fix-return-value-when-searching-for-existing-flow-g.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 92a46cdb282adb03ef6c38e4e163528e9a19f3d7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:09 -0400 -Subject: [PATCH] net/mlx5: Fix return value when searching for existing flow - group - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8ec40e3f1f72bf8f8accf18020d487caa99f46a4 -Author: Patrisious Haddad -Date: Tue Jun 10 18:15:08 2025 +0300 - - net/mlx5: Fix return value when searching for existing flow group - - When attempting to add a rule to an existing flow group, if a matching - flow group exists but is not active, the error code returned should be - EAGAIN, so that the rule can be added to the matching flow group once - it is active, rather than ENOENT, which indicates that no matching - flow group was found. - - Fixes: bd71b08ec2ee ("net/mlx5: Support multiple updates of steering rules in parallel") - Signed-off-by: Gavi Teitz - Signed-off-by: Roi Dayan - Signed-off-by: Patrisious Haddad - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index c330b64a506b..5f0f546fa126 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -2228,6 +2228,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - struct mlx5_flow_handle *rule; - struct match_list *iter; - bool take_write = false; -+ bool try_again = false; - struct fs_fte *fte; - u64 version = 0; - int err; -@@ -2292,6 +2293,7 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - nested_down_write_ref_node(&g->node, FS_LOCK_PARENT); - - if (!g->node.active) { -+ try_again = true; - up_write_ref_node(&g->node, false); - continue; - } -@@ -2313,7 +2315,8 @@ try_add_to_existing_fg(struct mlx5_flow_table *ft, - tree_put_node(&fte->node, false); - return rule; - } -- rule = ERR_PTR(-ENOENT); -+ err = try_again ? -EAGAIN : -ENOENT; -+ rule = ERR_PTR(err); - out: - kmem_cache_free(steering->ftes_cache, fte); - return rule; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1386-net-mlx5-hws-init-mutex-on-the-correct-path.patch b/SOURCES/1386-net-mlx5-hws-init-mutex-on-the-correct-path.patch deleted file mode 100644 index c6f7e023d..000000000 --- a/SOURCES/1386-net-mlx5-hws-init-mutex-on-the-correct-path.patch +++ /dev/null @@ -1,51 +0,0 @@ -From 3d6361f488b417481996a88647f6d958c09986d9 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:09 -0400 -Subject: [PATCH] net/mlx5: HWS, Init mutex on the correct path - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a002602676cdae0c9996adb75b9310559b718a93 -Author: Vlad Dogaru -Date: Tue Jun 10 18:15:09 2025 +0300 - - net/mlx5: HWS, Init mutex on the correct path - - The newly introduced mutex is only used for reformat actions, but it was - initialized for modify header instead. - - The struct that contains the mutex is zero-initialized and an all-zero - mutex is valid, so the issue only shows up with CONFIG_DEBUG_MUTEXES. - - Fixes: b206d9ec19df ("net/mlx5: HWS, register reformat actions with fw") - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index 9d1c0e4b224a..372e2be90706 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -1357,6 +1357,7 @@ mlx5_cmd_hws_packet_reformat_alloc(struct mlx5_flow_root_namespace *ns, - pkt_reformat->fs_hws_action.pr_data = pr_data; - } - -+ mutex_init(&pkt_reformat->fs_hws_action.lock); - pkt_reformat->owner = MLX5_FLOW_RESOURCE_OWNER_HWS; - pkt_reformat->fs_hws_action.hws_action = hws_action; - return 0; -@@ -1503,7 +1504,6 @@ static int mlx5_cmd_hws_modify_header_alloc(struct mlx5_flow_root_namespace *ns, - err = -ENOMEM; - goto release_mh; - } -- mutex_init(&modify_hdr->fs_hws_action.lock); - modify_hdr->fs_hws_action.mh_data = mh_data; - modify_hdr->fs_hws_action.fs_pool = pool; - modify_hdr->owner = MLX5_FLOW_RESOURCE_OWNER_SW; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1387-net-mlx5-hws-fix-missing-ip-version-handling-in-definer.patch b/SOURCES/1387-net-mlx5-hws-fix-missing-ip-version-handling-in-definer.patch deleted file mode 100644 index 088cabf7c..000000000 --- a/SOURCES/1387-net-mlx5-hws-fix-missing-ip-version-handling-in-definer.patch +++ /dev/null @@ -1,40 +0,0 @@ -From ba815e2e82f00d7211164de9c0409a7e53173ba8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:10 -0400 -Subject: [PATCH] net/mlx5: HWS, fix missing ip_version handling in definer - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b5e3c76f35ee7e814c2469c73406c5bbf110d89c -Author: Yevgeny Kliteynik -Date: Tue Jun 10 18:15:10 2025 +0300 - - net/mlx5: HWS, fix missing ip_version handling in definer - - Fix missing field handling in definer - outer IP version. - - Fixes: 74a778b4a63f ("net/mlx5: HWS, added definers handling") - Signed-off-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index 5cc0dc002ac1..d45e1145d197 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -785,6 +785,9 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - HWS_SET_HDR(fc, match_param, IP_PROTOCOL_O, - outer_headers.ip_protocol, - eth_l3_outer.protocol_next_header); -+ HWS_SET_HDR(fc, match_param, IP_VERSION_O, -+ outer_headers.ip_version, -+ eth_l3_outer.ip_version); - HWS_SET_HDR(fc, match_param, IP_TTL_O, - outer_headers.ttl_hoplimit, - eth_l3_outer.time_to_live_hop_limit); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1388-net-mlx5-hws-make-sure-the-uplink-is-the-last-destination.patch b/SOURCES/1388-net-mlx5-hws-make-sure-the-uplink-is-the-last-destination.patch deleted file mode 100644 index c81117b64..000000000 --- a/SOURCES/1388-net-mlx5-hws-make-sure-the-uplink-is-the-last-destination.patch +++ /dev/null @@ -1,98 +0,0 @@ -From cb2e3bb95bee469a17238ac30011a055ff897886 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:10 -0400 -Subject: [PATCH] net/mlx5: HWS, make sure the uplink is the last destination - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b8335829518ec5988294280e37d735799209d70d -Author: Vlad Dogaru -Date: Tue Jun 10 18:15:11 2025 +0300 - - net/mlx5: HWS, make sure the uplink is the last destination - - When there are more than one destinations, we create a FW flow - table and provide it with all the destinations. FW requires to - have wire as the last destination in the list (if it exists), - otherwise the operation fails with FW syndrome. - - This patch fixes the destination array action creation: if it - contains a wire destination, it is moved to the end. - - Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index fb62f3bc4bd4..447ea3f8722c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1370,8 +1370,8 @@ mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, - struct mlx5hws_cmd_set_fte_attr fte_attr = {0}; - struct mlx5hws_cmd_forward_tbl *fw_island; - struct mlx5hws_action *action; -- u32 i /*, packet_reformat_id*/; -- int ret; -+ int ret, last_dest_idx = -1; -+ u32 i; - - if (num_dest <= 1) { - mlx5hws_err(ctx, "Action must have multiple dests\n"); -@@ -1401,11 +1401,8 @@ mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, - dest_list[i].destination_id = dests[i].dest->dest_obj.obj_id; - fte_attr.action_flags |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; - fte_attr.ignore_flow_level = ignore_flow_level; -- /* ToDo: In SW steering we have a handling of 'go to WIRE' -- * destination here by upper layer setting 'is_wire_ft' flag -- * if the destination is wire. -- * This is because uplink should be last dest in the list. -- */ -+ if (dests[i].is_wire_ft) -+ last_dest_idx = i; - break; - case MLX5HWS_ACTION_TYP_VPORT: - dest_list[i].destination_type = MLX5_FLOW_DESTINATION_TYPE_VPORT; -@@ -1429,6 +1426,9 @@ mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, - } - } - -+ if (last_dest_idx != -1) -+ swap(dest_list[last_dest_idx], dest_list[num_dest - 1]); -+ - fte_attr.dests_num = num_dest; - fte_attr.dests = dest_list; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index 372e2be90706..bf4643d0ce17 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -966,6 +966,9 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns, - switch (attr->type) { - case MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE: - dest_action = mlx5_fs_get_dest_action_ft(fs_ctx, dst); -+ if (dst->dest_attr.ft->flags & -+ MLX5_FLOW_TABLE_UPLINK_VPORT) -+ dest_actions[num_dest_actions].is_wire_ft = true; - break; - case MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE_NUM: - dest_action = mlx5_fs_get_dest_action_table_num(fs_ctx, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 9bbadc4d8a0b..d8ac6c196211 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -213,6 +213,7 @@ struct mlx5hws_action_dest_attr { - struct mlx5hws_action *dest; - /* Optional reformat action */ - struct mlx5hws_action *reformat; -+ bool is_wire_ft; - }; - - /** --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1389-net-mlx5e-fix-leak-of-geneve-tlv-option-object.patch b/SOURCES/1389-net-mlx5e-fix-leak-of-geneve-tlv-option-object.patch deleted file mode 100644 index fd9cd7cce..000000000 --- a/SOURCES/1389-net-mlx5e-fix-leak-of-geneve-tlv-option-object.patch +++ /dev/null @@ -1,81 +0,0 @@ -From 7af56f3f1bdf8cc9ba3e4a85456cedb7a69a8b86 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:10 -0400 -Subject: [PATCH] net/mlx5e: Fix leak of Geneve TLV option object - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit aa9c44b842096c553871bc68a8cebc7861fa192b -Author: Jianbo Liu -Date: Tue Jun 10 18:15:13 2025 +0300 - - net/mlx5e: Fix leak of Geneve TLV option object - - Previously, a unique tunnel id was added for the matching on TC - non-zero chains, to support inner header rewrite with goto action. - Later, it was used to support VF tunnel offload for vxlan, then for - Geneve and GRE. To support VF tunnel, a temporary mlx5_flow_spec is - used to parse tunnel options. For Geneve, if there is TLV option, a - object is created, or refcnt is added if already exists. But the - temporary mlx5_flow_spec is directly freed after parsing, which causes - the leak because no information regarding the object is saved in - flow's mlx5_flow_spec, which is used to free the object when deleting - the flow. - - To fix the leak, call mlx5_geneve_tlv_option_del() before free the - temporary spec if it has TLV object. - - Fixes: 521933cdc4aa ("net/mlx5e: Support Geneve and GRE with VF tunnel offload") - Signed-off-by: Jianbo Liu - Reviewed-by: Tariq Toukan - Reviewed-by: Alex Lazar - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250610151514.1094735-9-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index f1d908f61134..fef418e1ed1a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -2028,9 +2028,8 @@ mlx5e_tc_add_fdb_flow(struct mlx5e_priv *priv, - return err; - } - --static bool mlx5_flow_has_geneve_opt(struct mlx5e_tc_flow *flow) -+static bool mlx5_flow_has_geneve_opt(struct mlx5_flow_spec *spec) - { -- struct mlx5_flow_spec *spec = &flow->attr->parse_attr->spec; - void *headers_v = MLX5_ADDR_OF(fte_match_param, - spec->match_value, - misc_parameters_3); -@@ -2069,7 +2068,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv, - } - complete_all(&flow->del_hw_done); - -- if (mlx5_flow_has_geneve_opt(flow)) -+ if (mlx5_flow_has_geneve_opt(&attr->parse_attr->spec)) - mlx5_geneve_tlv_option_del(priv->mdev->geneve); - - if (flow->decap_route) -@@ -2574,12 +2573,13 @@ static int parse_tunnel_attr(struct mlx5e_priv *priv, - - err = mlx5e_tc_tun_parse(filter_dev, priv, tmp_spec, f, match_level); - if (err) { -- kvfree(tmp_spec); - NL_SET_ERR_MSG_MOD(extack, "Failed to parse tunnel attributes"); - netdev_warn(priv->netdev, "Failed to parse tunnel attributes"); -- return err; -+ } else { -+ err = mlx5e_tc_set_attr_rx_tun(flow, tmp_spec); - } -- err = mlx5e_tc_set_attr_rx_tun(flow, tmp_spec); -+ if (mlx5_flow_has_geneve_opt(tmp_spec)) -+ mlx5_geneve_tlv_option_del(priv->mdev->geneve); - kvfree(tmp_spec); - if (err) - return err; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1390-net-mlx5-hws-add-error-checking-to-hws-bwc-rule-complex-hash.patch b/SOURCES/1390-net-mlx5-hws-add-error-checking-to-hws-bwc-rule-complex-hash.patch deleted file mode 100644 index b62748478..000000000 --- a/SOURCES/1390-net-mlx5-hws-add-error-checking-to-hws-bwc-rule-complex-hash.patch +++ /dev/null @@ -1,78 +0,0 @@ -From c4f4fb210193420862f49e61b6a6865512ee9636 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:10 -0400 -Subject: [PATCH] net/mlx5: HWS, Add error checking to - hws_bwc_rule_complex_hash_node_get() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1619bdf4389c829f16af5c7d5b4fa5f1673614d7 -Author: Dan Carpenter -Date: Wed Jun 11 16:14:32 2025 +0300 - - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() - - Check for if ida_alloc() or rhashtable_lookup_get_insert_fast() fails. - - Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") - Signed-off-by: Dan Carpenter - Reviewed-by: Yevgeny Kliteynik - Link: https://patch.msgid.link/aEmBONjyiF6z5yCV@stanley.mountain - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -index 70768953a4f6..ca7501c57468 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -@@ -1070,7 +1070,7 @@ hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; - struct mlx5hws_bwc_complex_rule_hash_node *node, *old_node; - struct rhashtable *refcount_hash; -- int i; -+ int ret, i; - - bwc_rule->complex_hash_node = NULL; - -@@ -1078,7 +1078,11 @@ hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(!node)) - return -ENOMEM; - -- node->tag = ida_alloc(&bwc_matcher->complex->metadata_ida, GFP_KERNEL); -+ ret = ida_alloc(&bwc_matcher->complex->metadata_ida, GFP_KERNEL); -+ if (ret < 0) -+ goto err_free_node; -+ node->tag = ret; -+ - refcount_set(&node->refcount, 1); - - /* Clear match buffer - turn off all the unrelated fields -@@ -1094,6 +1098,11 @@ hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, - old_node = rhashtable_lookup_get_insert_fast(refcount_hash, - &node->hash_node, - hws_refcount_hash); -+ if (IS_ERR(old_node)) { -+ ret = PTR_ERR(old_node); -+ goto err_free_ida; -+ } -+ - if (old_node) { - /* Rule with the same tag already exists - update refcount */ - refcount_inc(&old_node->refcount); -@@ -1112,6 +1121,12 @@ hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, - - bwc_rule->complex_hash_node = node; - return 0; -+ -+err_free_ida: -+ ida_free(&bwc_matcher->complex->metadata_ida, node->tag); -+err_free_node: -+ kfree(node); -+ return ret; - } - - static void --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1391-net-mlx5e-fix-race-between-dim-disable-and-net-dim.patch b/SOURCES/1391-net-mlx5e-fix-race-between-dim-disable-and-net-dim.patch deleted file mode 100644 index 129ad9337..000000000 --- a/SOURCES/1391-net-mlx5e-fix-race-between-dim-disable-and-net-dim.patch +++ /dev/null @@ -1,101 +0,0 @@ -From ad54bc890c4892fa93557d437d96dd787a30b98b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:11 -0400 -Subject: [PATCH] net/mlx5e: Fix race between DIM disable and net_dim() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit eb41a264a3a576dc040ee37c3d9d6b7e2d9be968 -Author: Carolina Jubran -Date: Thu Jul 10 16:53:43 2025 +0300 - - net/mlx5e: Fix race between DIM disable and net_dim() - - There's a race between disabling DIM and NAPI callbacks using the dim - pointer on the RQ or SQ. - - If NAPI checks the DIM state bit and sees it still set, it assumes - `rq->dim` or `sq->dim` is valid. But if DIM gets disabled right after - that check, the pointer might already be set to NULL, leading to a NULL - pointer dereference in net_dim(). - - Fix this by calling `synchronize_net()` before freeing the DIM context. - This ensures all in-progress NAPI callbacks are finished before the - pointer is cleared. - - Kernel log: - - BUG: kernel NULL pointer dereference, address: 0000000000000000 - ... - RIP: 0010:net_dim+0x23/0x190 - ... - Call Trace: - - ? __die+0x20/0x60 - ? page_fault_oops+0x150/0x3e0 - ? common_interrupt+0xf/0xa0 - ? sysvec_call_function_single+0xb/0x90 - ? exc_page_fault+0x74/0x130 - ? asm_exc_page_fault+0x22/0x30 - ? net_dim+0x23/0x190 - ? mlx5e_poll_ico_cq+0x41/0x6f0 [mlx5_core] - ? sysvec_apic_timer_interrupt+0xb/0x90 - mlx5e_handle_rx_dim+0x92/0xd0 [mlx5_core] - mlx5e_napi_poll+0x2cd/0xac0 [mlx5_core] - ? mlx5e_poll_ico_cq+0xe5/0x6f0 [mlx5_core] - busy_poll_stop+0xa2/0x200 - ? mlx5e_napi_poll+0x1d9/0xac0 [mlx5_core] - ? mlx5e_trigger_irq+0x130/0x130 [mlx5_core] - __napi_busy_loop+0x345/0x3b0 - ? sysvec_call_function_single+0xb/0x90 - ? asm_sysvec_call_function_single+0x16/0x20 - ? sysvec_apic_timer_interrupt+0xb/0x90 - ? pcpu_free_area+0x1e4/0x2e0 - napi_busy_loop+0x11/0x20 - xsk_recvmsg+0x10c/0x130 - sock_recvmsg+0x44/0x70 - __sys_recvfrom+0xbc/0x130 - ? __schedule+0x398/0x890 - __x64_sys_recvfrom+0x20/0x30 - do_syscall_64+0x4c/0x100 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - ... - ---[ end trace 0000000000000000 ]--- - ... - ---[ end Kernel panic - not syncing: Fatal exception in interrupt ]--- - - Fixes: 445a25f6e1a2 ("net/mlx5e: Support updating coalescing configuration without resetting channels") - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/1752155624-24095-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c -index 298bb74ec5e9..d1d629697e28 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dim.c -@@ -113,7 +113,7 @@ int mlx5e_dim_rx_change(struct mlx5e_rq *rq, bool enable) - __set_bit(MLX5E_RQ_STATE_DIM, &rq->state); - } else { - __clear_bit(MLX5E_RQ_STATE_DIM, &rq->state); -- -+ synchronize_net(); - mlx5e_dim_disable(rq->dim); - rq->dim = NULL; - } -@@ -140,7 +140,7 @@ int mlx5e_dim_tx_change(struct mlx5e_txqsq *sq, bool enable) - __set_bit(MLX5E_SQ_STATE_DIM, &sq->state); - } else { - __clear_bit(MLX5E_SQ_STATE_DIM, &sq->state); -- -+ synchronize_net(); - mlx5e_dim_disable(sq->dim); - sq->dim = NULL; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1392-net-mlx5e-add-new-prio-for-promiscuous-mode.patch b/SOURCES/1392-net-mlx5e-add-new-prio-for-promiscuous-mode.patch deleted file mode 100644 index 65eb21511..000000000 --- a/SOURCES/1392-net-mlx5e-add-new-prio-for-promiscuous-mode.patch +++ /dev/null @@ -1,116 +0,0 @@ -From bd88819cc929d1193d943400f4977a8f573b5d15 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:11 -0400 -Subject: [PATCH] net/mlx5e: Add new prio for promiscuous mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4c9fce56fa702059bbc5ab737265b68f79cbaac4 -Author: Jianbo Liu -Date: Thu Jul 10 16:53:44 2025 +0300 - - net/mlx5e: Add new prio for promiscuous mode - - An optimization for promiscuous mode adds a high-priority steering - table with a single catch-all rule to steer all traffic directly to - the TTC table. - - However, a gap exists between the creation of this table and the - insertion of the catch-all rule. Packets arriving in this brief window - would miss as no rule was inserted yet, unnecessarily incrementing the - 'rx_steer_missed_packets' counter and dropped. - - This patch resolves the issue by introducing a new prio for this - table, placing it between MLX5E_TC_PRIO and MLX5E_NIC_PRIO. By doing - so, packets arriving during the window now fall through to the next - prio (at MLX5E_NIC_PRIO) instead of being dropped. - - Fixes: 1c46d7409f30 ("net/mlx5e: Optimize promiscuous mode") - Signed-off-by: Jianbo Liu - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/1752155624-24095-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -index b5c3a2a9d2a5..9560fcba643f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -@@ -18,7 +18,8 @@ enum { - - enum { - MLX5E_TC_PRIO = 0, -- MLX5E_NIC_PRIO -+ MLX5E_PROMISC_PRIO, -+ MLX5E_NIC_PRIO, - }; - - struct mlx5e_flow_table { -@@ -68,9 +69,13 @@ struct mlx5e_l2_table { - MLX5_HASH_FIELD_SEL_DST_IP |\ - MLX5_HASH_FIELD_SEL_IPSEC_SPI) - --/* NIC prio FTS */ -+/* NIC promisc FT level */ - enum { - MLX5E_PROMISC_FT_LEVEL, -+}; -+ -+/* NIC prio FTS */ -+enum { - MLX5E_VLAN_FT_LEVEL, - MLX5E_L2_FT_LEVEL, - MLX5E_TTC_FT_LEVEL, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -index 05058710d2c7..537e732085b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -@@ -776,7 +776,7 @@ static int mlx5e_create_promisc_table(struct mlx5e_flow_steering *fs) - ft_attr.max_fte = MLX5E_PROMISC_TABLE_SIZE; - ft_attr.autogroup.max_num_groups = 1; - ft_attr.level = MLX5E_PROMISC_FT_LEVEL; -- ft_attr.prio = MLX5E_NIC_PRIO; -+ ft_attr.prio = MLX5E_PROMISC_PRIO; - - ft->t = mlx5_create_auto_grouped_flow_table(fs->ns, &ft_attr); - if (IS_ERR(ft->t)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 5f0f546fa126..b29e67466701 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -113,13 +113,16 @@ - #define ETHTOOL_PRIO_NUM_LEVELS 1 - #define ETHTOOL_NUM_PRIOS 11 - #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS) --/* Promiscuous, Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy, -+/* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy, - * {IPsec RoCE MPV,Alias table},IPsec RoCE policy - */ --#define KERNEL_NIC_PRIO_NUM_LEVELS 11 -+#define KERNEL_NIC_PRIO_NUM_LEVELS 10 - #define KERNEL_NIC_NUM_PRIOS 1 --/* One more level for tc */ --#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 1) -+/* One more level for tc, and one more for promisc */ -+#define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2) -+ -+#define KERNEL_NIC_PROMISC_NUM_PRIOS 1 -+#define KERNEL_NIC_PROMISC_NUM_LEVELS 1 - - #define KERNEL_NIC_TC_NUM_PRIOS 1 - #define KERNEL_NIC_TC_NUM_LEVELS 3 -@@ -187,6 +190,8 @@ static struct init_tree_node { - ADD_NS(MLX5_FLOW_TABLE_MISS_ACTION_DEF, - ADD_MULTIPLE_PRIO(KERNEL_NIC_TC_NUM_PRIOS, - KERNEL_NIC_TC_NUM_LEVELS), -+ ADD_MULTIPLE_PRIO(KERNEL_NIC_PROMISC_NUM_PRIOS, -+ KERNEL_NIC_PROMISC_NUM_LEVELS), - ADD_MULTIPLE_PRIO(KERNEL_NIC_NUM_PRIOS, - KERNEL_NIC_PRIO_NUM_LEVELS))), - ADD_PRIO(0, BY_PASS_MIN_LEVEL, 0, FS_CHAINING_CAPS, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1393-net-mlx5-correctly-set-gso-size-when-lro-is-used.patch b/SOURCES/1393-net-mlx5-correctly-set-gso-size-when-lro-is-used.patch deleted file mode 100644 index 1a3a2c4e0..000000000 --- a/SOURCES/1393-net-mlx5-correctly-set-gso-size-when-lro-is-used.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 07084a10593c81a6071d6f045927f1c2f52ac5b3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:11 -0400 -Subject: [PATCH] net/mlx5: Correctly set gso_size when LRO is used - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 531d0d32de3e1b6b77a87bd37de0c2c6e17b496a -Author: Christoph Paasch -Date: Tue Jul 15 13:20:53 2025 -0700 - - net/mlx5: Correctly set gso_size when LRO is used - - gso_size is expected by the networking stack to be the size of the - payload (thus, not including ethernet/IP/TCP-headers). However, cqe_bcnt - is the full sized frame (including the headers). Dividing cqe_bcnt by - lro_num_seg will then give incorrect results. - - For example, running a bpftrace higher up in the TCP-stack - (tcp_event_data_recv), we commonly have gso_size set to 1450 or 1451 even - though in reality the payload was only 1448 bytes. - - This can have unintended consequences: - - In tcp_measure_rcv_mss() len will be for example 1450, but. rcv_mss - will be 1448 (because tp->advmss is 1448). Thus, we will always - recompute scaling_ratio each time an LRO-packet is received. - - In tcp_gro_receive(), it will interfere with the decision whether or - not to flush and thus potentially result in less gro'ed packets. - - So, we need to discount the protocol headers from cqe_bcnt so we can - actually divide the payload by lro_num_seg to get the real gso_size. - - v2: - - Use "(unsigned char *)tcp + tcp->doff * 4 - skb->data)" to compute header-len - (Tariq Toukan ) - - Improve commit-message (Gal Pressman ) - - Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") - Signed-off-by: Christoph Paasch - Reviewed-by: Tariq Toukan - Reviewed-by: Gal Pressman - Link: https://patch.msgid.link/20250715-cpaasch-pf-925-investigate-incorrect-gso_size-on-cx-7-nic-v2-1-e06c3475f3ac@openai.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 12ca0a3e8514..382679838113 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1156,8 +1156,9 @@ static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp) - } - } - --static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, -- u32 cqe_bcnt) -+static unsigned int mlx5e_lro_update_hdr(struct sk_buff *skb, -+ struct mlx5_cqe64 *cqe, -+ u32 cqe_bcnt) - { - struct ethhdr *eth = (struct ethhdr *)(skb->data); - struct tcphdr *tcp; -@@ -1207,6 +1208,8 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, - tcp->check = tcp_v6_check(payload_len, &ipv6->saddr, - &ipv6->daddr, check); - } -+ -+ return (unsigned int)((unsigned char *)tcp + tcp->doff * 4 - skb->data); - } - - static void *mlx5e_shampo_get_packet_hd(struct mlx5e_rq *rq, u16 header_index) -@@ -1563,8 +1566,9 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - mlx5e_macsec_offload_handle_rx_skb(netdev, skb, cqe); - - if (lro_num_seg > 1) { -- mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); -- skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg); -+ unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); -+ -+ skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); - /* Subtract one since we already counted this as one - * "regular" packet in mlx5e_complete_rx_cqe() - */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1394-net-mlx5-fix-memory-leak-in-cmd-exec.patch b/SOURCES/1394-net-mlx5-fix-memory-leak-in-cmd-exec.patch deleted file mode 100644 index 165f31566..000000000 --- a/SOURCES/1394-net-mlx5-fix-memory-leak-in-cmd-exec.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 0e6b8d1b57695231dc16f426ca329c7fc415ff43 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:12 -0400 -Subject: [PATCH] net/mlx5: Fix memory leak in cmd_exec() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3afa3ae3db52e3c216d77bd5907a5a86833806cc -Author: Chiara Meiohas -Date: Thu Jul 17 15:06:09 2025 +0300 - - net/mlx5: Fix memory leak in cmd_exec() - - If cmd_exec() is called with callback and mlx5_cmd_invoke() returns an - error, resources allocated in cmd_exec() will not be freed. - - Fix the code to release the resources if mlx5_cmd_invoke() returns an - error. - - Fixes: f086470122d5 ("net/mlx5: cmdif, Return value improvements") - Reported-by: Alex Tereshkin - Signed-off-by: Chiara Meiohas - Reviewed-by: Moshe Shemesh - Signed-off-by: Vlad Dumitrescu - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752753970-261832-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index b1aeea7c4a91..e395ef5f356e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -1947,8 +1947,8 @@ static int cmd_exec(struct mlx5_core_dev *dev, void *in, int in_size, void *out, - - err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context, - pages_queue, token, force_polling); -- if (callback) -- return err; -+ if (callback && !err) -+ return 0; - - if (err > 0) /* Failed in FW, command didn't execute */ - err = deliv_status_to_err(err); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1395-net-mlx5-e-switch-fix-peer-miss-rules-to-use-peer-eswitch.patch b/SOURCES/1395-net-mlx5-e-switch-fix-peer-miss-rules-to-use-peer-eswitch.patch deleted file mode 100644 index f806b906a..000000000 --- a/SOURCES/1395-net-mlx5-e-switch-fix-peer-miss-rules-to-use-peer-eswitch.patch +++ /dev/null @@ -1,247 +0,0 @@ -From 52b9ece6153bacd7511923119dae3562495686df Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:42:12 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5b4c56ad4da0aa00b258ab50b1f5775b7d3108c7 -Author: Shahar Shitrit -Date: Thu Jul 17 15:06:10 2025 +0300 - - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch - - In the original design, it is assumed local and peer eswitches have the - same number of vfs. However, in new firmware, local and peer eswitches - can have different number of vfs configured by mlxconfig. In such - configuration, it is incorrect to derive the number of vfs from the - local device's eswitch. - - Fix this by updating the peer miss rules add and delete functions to use - the peer device's eswitch and vf count instead of the local device's - information, ensuring correct behavior regardless of vf configuration - differences. - - Fixes: ac004b832128 ("net/mlx5e: E-Switch, Add peer miss rules") - Signed-off-by: Shahar Shitrit - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752753970-261832-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 0e3a977d5332..bee906661282 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1182,19 +1182,19 @@ static void esw_set_peer_miss_rule_source_port(struct mlx5_eswitch *esw, - static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - struct mlx5_core_dev *peer_dev) - { -+ struct mlx5_eswitch *peer_esw = peer_dev->priv.eswitch; - struct mlx5_flow_destination dest = {}; - struct mlx5_flow_act flow_act = {0}; - struct mlx5_flow_handle **flows; -- /* total vports is the same for both e-switches */ -- int nvports = esw->total_vports; - struct mlx5_flow_handle *flow; -+ struct mlx5_vport *peer_vport; - struct mlx5_flow_spec *spec; -- struct mlx5_vport *vport; - int err, pfindex; - unsigned long i; - void *misc; - -- if (!MLX5_VPORT_MANAGER(esw->dev) && !mlx5_core_is_ecpf_esw_manager(esw->dev)) -+ if (!MLX5_VPORT_MANAGER(peer_dev) && -+ !mlx5_core_is_ecpf_esw_manager(peer_dev)) - return 0; - - spec = kvzalloc(sizeof(*spec), GFP_KERNEL); -@@ -1203,7 +1203,7 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - - peer_miss_rules_setup(esw, peer_dev, spec, &dest); - -- flows = kvcalloc(nvports, sizeof(*flows), GFP_KERNEL); -+ flows = kvcalloc(peer_esw->total_vports, sizeof(*flows), GFP_KERNEL); - if (!flows) { - err = -ENOMEM; - goto alloc_flows_err; -@@ -1213,10 +1213,10 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - misc = MLX5_ADDR_OF(fte_match_param, spec->match_value, - misc_parameters); - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- esw_set_peer_miss_rule_source_port(esw, peer_dev->priv.eswitch, -- spec, MLX5_VPORT_PF); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, spec, -+ MLX5_VPORT_PF); - - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1224,11 +1224,11 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_pf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); - MLX5_SET(fte_match_set_misc, misc, source_port, MLX5_VPORT_ECPF); - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1236,13 +1236,14 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_ecpf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) { -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { - esw_set_peer_miss_rule_source_port(esw, -- peer_dev->priv.eswitch, -- spec, vport->vport); -+ peer_esw, -+ spec, peer_vport->vport); - - flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); -@@ -1250,22 +1251,22 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - err = PTR_ERR(flow); - goto add_vf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - -- if (mlx5_core_ec_sriov_enabled(esw->dev)) { -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- if (i >= mlx5_core_max_ec_vfs(peer_dev)) -- break; -- esw_set_peer_miss_rule_source_port(esw, peer_dev->priv.eswitch, -- spec, vport->vport); -+ if (mlx5_core_ec_sriov_enabled(peer_dev)) { -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) { -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, -+ spec, -+ peer_vport->vport); - flow = mlx5_add_flow_rules(esw->fdb_table.offloads.slow_fdb, - spec, &flow_act, &dest, 1); - if (IS_ERR(flow)) { - err = PTR_ERR(flow); - goto add_ec_vf_flow_err; - } -- flows[vport->index] = flow; -+ flows[peer_vport->index] = flow; - } - } - -@@ -1282,25 +1283,27 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - return 0; - - add_ec_vf_flow_err: -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- if (!flows[vport->index]) -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) { -+ if (!flows[peer_vport->index]) - continue; -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_vf_flow_err: -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) { -- if (!flows[vport->index]) -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { -+ if (!flows[peer_vport->index]) - continue; -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_ecpf_flow_err: -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_pf_flow_err: - esw_warn(esw->dev, "FDB: Failed to add peer miss flow rule err %d\n", err); -@@ -1313,37 +1316,34 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - static void esw_del_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - struct mlx5_core_dev *peer_dev) - { -+ struct mlx5_eswitch *peer_esw = peer_dev->priv.eswitch; - u16 peer_index = mlx5_get_dev_index(peer_dev); - struct mlx5_flow_handle **flows; -- struct mlx5_vport *vport; -+ struct mlx5_vport *peer_vport; - unsigned long i; - - flows = esw->fdb_table.offloads.peer_miss_rules[peer_index]; - if (!flows) - return; - -- if (mlx5_core_ec_sriov_enabled(esw->dev)) { -- mlx5_esw_for_each_ec_vf_vport(esw, i, vport, mlx5_core_max_ec_vfs(esw->dev)) { -- /* The flow for a particular vport could be NULL if the other ECPF -- * has fewer or no VFs enabled -- */ -- if (!flows[vport->index]) -- continue; -- mlx5_del_flow_rules(flows[vport->index]); -- } -+ if (mlx5_core_ec_sriov_enabled(peer_dev)) { -+ mlx5_esw_for_each_ec_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_ec_vfs(peer_dev)) -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - -- mlx5_esw_for_each_vf_vport(esw, i, vport, mlx5_core_max_vfs(esw->dev)) -- mlx5_del_flow_rules(flows[vport->index]); -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) -+ mlx5_del_flow_rules(flows[peer_vport->index]); - -- if (mlx5_ecpf_vport_exists(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_ECPF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_ecpf_vport_exists(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_ECPF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev)) { -- vport = mlx5_eswitch_get_vport(esw, MLX5_VPORT_PF); -- mlx5_del_flow_rules(flows[vport->index]); -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); -+ mlx5_del_flow_rules(flows[peer_vport->index]); - } - - kvfree(flows); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1396-rdma-mlx5-convert-timeouts-to-secs-to-jiffies.patch b/SOURCES/1396-rdma-mlx5-convert-timeouts-to-secs-to-jiffies.patch deleted file mode 100644 index 614d34f5f..000000000 --- a/SOURCES/1396-rdma-mlx5-convert-timeouts-to-secs-to-jiffies.patch +++ /dev/null @@ -1,70 +0,0 @@ -From dc192079bc2276b1a7c8163940448e003bf856c7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:25 -0400 -Subject: [PATCH] RDMA/mlx5: convert timeouts to secs_to_jiffies() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 16b82367aa28bd31795e720548421b58824108e1 -Author: Easwar Hariharan -Date: Wed Feb 19 21:36:40 2025 +0000 - - RDMA/mlx5: convert timeouts to secs_to_jiffies() - - Commit b35108a51cf7 ("jiffies: Define secs_to_jiffies()") introduced - secs_to_jiffies(). As the value here is a multiple of 1000, use - secs_to_jiffies() instead of msecs_to_jiffies to avoid the multiplication. - - This is converted using scripts/coccinelle/misc/secs_to_jiffies.cocci with - the following Coccinelle rules: - - @depends on patch@ - expression E; - @@ - - -msecs_to_jiffies(E * 1000) - +secs_to_jiffies(E) - - -msecs_to_jiffies(E * MSEC_PER_SEC) - +secs_to_jiffies(E) - - Link: https://patch.msgid.link/r/20250219-rdma-secs-to-jiffies-v1-2-b506746561a9@linux.microsoft.com - Signed-off-by: Easwar Hariharan - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index 247f7248a0c0..5a7b234bdfd9 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -525,7 +525,7 @@ static void queue_adjust_cache_locked(struct mlx5_cache_ent *ent) - ent->fill_to_high_water = false; - if (ent->pending) - queue_delayed_work(ent->dev->cache.wq, &ent->dwork, -- msecs_to_jiffies(1000)); -+ secs_to_jiffies(1)); - else - mod_delayed_work(ent->dev->cache.wq, &ent->dwork, 0); - } -@@ -576,7 +576,7 @@ static void __cache_work_func(struct mlx5_cache_ent *ent) - "add keys command failed, err %d\n", - err); - queue_delayed_work(cache->wq, &ent->dwork, -- msecs_to_jiffies(1000)); -+ secs_to_jiffies(1)); - } - } - } else if (ent->mkeys_queue.ci > 2 * ent->limit) { -@@ -2080,7 +2080,7 @@ static int mlx5r_handle_mkey_cleanup(struct mlx5_ib_mr *mr) - ent->in_use--; - if (ent->is_tmp && !ent->tmp_cleanup_scheduled) { - mod_delayed_work(ent->dev->cache.wq, &ent->dwork, -- msecs_to_jiffies(30 * 1000)); -+ secs_to_jiffies(30)); - ent->tmp_cleanup_scheduled = true; - } - spin_unlock_irq(&ent->mkeys_queue.lock); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1397-rdma-mlx5-remove-the-redundant-mlx5-ib-stage-uar-stage.patch b/SOURCES/1397-rdma-mlx5-remove-the-redundant-mlx5-ib-stage-uar-stage.patch deleted file mode 100644 index bef25b745..000000000 --- a/SOURCES/1397-rdma-mlx5-remove-the-redundant-mlx5-ib-stage-uar-stage.patch +++ /dev/null @@ -1,103 +0,0 @@ -From a146abefb34ccd688e9923429cd51b9b7b1a3442 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 972db388d40ded1a5ef8ce09d92ef1e2b9e40f07 -Author: Yishai Hadas -Date: Tue May 13 14:02:40 2025 +0300 - - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage - - The MLX5_IB_STAGE_UAR stage in the RDMA driver is redundant and should - be removed. - - Responsibility for initializing the device's UAR pointer - (mdev->priv.uar) lies with mlx5_core, which already sets it during the - mlx5_load() process. - - At present, the RDMA UAR stage overwrites this pointer, which was - correctly initialized by mlx5_core, creating the risk of inconsistency. - - Ownership and management of the UAR pointer should remain exclusively - within mlx5_core. - - In the current upstream code, we luckily receive the same pointer, since - mlx5_get_uars_page() still finds available BF registers for that UAR, - allowing it to be shared. - - However, future changes in mlx5_core may expose this flaw. - For instance, if mlx5_alloc_bfreg() is invoked twice before the RDMA UAR - stage runs, the RDMA driver may overwrite the UAR allocated by - mlx5_core. - - This could lead to real bugs. For example, if mlx5_ib is unloaded - (rmmod), it might free the UAR, leaving mlx5_core with a dangling - reference to an invalid UAR. - - Signed-off-by: Yishai Hadas - Reviewed-by: Fan Li - Link: https://patch.msgid.link/feaa84ec6f20468b4935c439923e9266122a93d0.1747134130.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 64f1e0fafd46..6a75c5a2f6c8 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -4422,17 +4422,6 @@ static void mlx5_ib_stage_cong_debugfs_cleanup(struct mlx5_ib_dev *dev) - mlx5_core_native_port_num(dev->mdev) - 1); - } - --static int mlx5_ib_stage_uar_init(struct mlx5_ib_dev *dev) --{ -- dev->mdev->priv.uar = mlx5_get_uars_page(dev->mdev); -- return PTR_ERR_OR_ZERO(dev->mdev->priv.uar); --} -- --static void mlx5_ib_stage_uar_cleanup(struct mlx5_ib_dev *dev) --{ -- mlx5_put_uars_page(dev->mdev, dev->mdev->priv.uar); --} -- - static int mlx5_ib_stage_bfrag_init(struct mlx5_ib_dev *dev) - { - int err; -@@ -4661,9 +4650,6 @@ static const struct mlx5_ib_profile pf_profile = { - STAGE_CREATE(MLX5_IB_STAGE_CONG_DEBUGFS, - mlx5_ib_stage_cong_debugfs_init, - mlx5_ib_stage_cong_debugfs_cleanup), -- STAGE_CREATE(MLX5_IB_STAGE_UAR, -- mlx5_ib_stage_uar_init, -- mlx5_ib_stage_uar_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_BFREG, - mlx5_ib_stage_bfrag_init, - mlx5_ib_stage_bfrag_cleanup), -@@ -4721,9 +4707,6 @@ const struct mlx5_ib_profile raw_eth_profile = { - STAGE_CREATE(MLX5_IB_STAGE_CONG_DEBUGFS, - mlx5_ib_stage_cong_debugfs_init, - mlx5_ib_stage_cong_debugfs_cleanup), -- STAGE_CREATE(MLX5_IB_STAGE_UAR, -- mlx5_ib_stage_uar_init, -- mlx5_ib_stage_uar_cleanup), - STAGE_CREATE(MLX5_IB_STAGE_BFREG, - mlx5_ib_stage_bfrag_init, - mlx5_ib_stage_bfrag_cleanup), -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index c84ef94bb9fc..54ca6e010bd4 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1002,7 +1002,6 @@ enum mlx5_ib_stages { - MLX5_IB_STAGE_ODP, - MLX5_IB_STAGE_COUNTERS, - MLX5_IB_STAGE_CONG_DEBUGFS, -- MLX5_IB_STAGE_UAR, - MLX5_IB_STAGE_BFREG, - MLX5_IB_STAGE_PRE_IB_REG_UMR, - MLX5_IB_STAGE_WHITELIST_UID, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1398-rdma-mlx5-add-support-for-200gbps-per-lane-speeds.patch b/SOURCES/1398-rdma-mlx5-add-support-for-200gbps-per-lane-speeds.patch deleted file mode 100644 index 1c05337e3..000000000 --- a/SOURCES/1398-rdma-mlx5-add-support-for-200gbps-per-lane-speeds.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 1e3839f66a3dc069dc1f0b26277180792852653c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Add support for 200Gbps per lane speeds - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d00d16bcbc2553a3ac9acccf2d6444cda5502adf -Author: Patrisious Haddad -Date: Tue May 13 14:03:41 2025 +0300 - - RDMA/mlx5: Add support for 200Gbps per lane speeds - - Add support for 200Gbps per lane speeds speed when querying PTYS and - report it back correctly when needed. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Maor Gottlieb - Link: https://patch.msgid.link/b842d2f523e9b82e221378c444ebd5860d612959.1747134197.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 6a75c5a2f6c8..d5f44c83b667 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -485,6 +485,10 @@ static int translate_eth_ext_proto_oper(u32 eth_proto_oper, u16 *active_speed, - *active_width = IB_WIDTH_2X; - *active_speed = IB_SPEED_NDR; - break; -+ case MLX5E_PROT_MASK(MLX5E_200GAUI_1_200GBASE_CR1_KR1): -+ *active_width = IB_WIDTH_1X; -+ *active_speed = IB_SPEED_XDR; -+ break; - case MLX5E_PROT_MASK(MLX5E_400GAUI_8_400GBASE_CR8): - *active_width = IB_WIDTH_8X; - *active_speed = IB_SPEED_HDR; -@@ -493,10 +497,18 @@ static int translate_eth_ext_proto_oper(u32 eth_proto_oper, u16 *active_speed, - *active_width = IB_WIDTH_4X; - *active_speed = IB_SPEED_NDR; - break; -+ case MLX5E_PROT_MASK(MLX5E_400GAUI_2_400GBASE_CR2_KR2): -+ *active_width = IB_WIDTH_2X; -+ *active_speed = IB_SPEED_XDR; -+ break; - case MLX5E_PROT_MASK(MLX5E_800GAUI_8_800GBASE_CR8_KR8): - *active_width = IB_WIDTH_8X; - *active_speed = IB_SPEED_NDR; - break; -+ case MLX5E_PROT_MASK(MLX5E_800GAUI_4_800GBASE_CR4_KR4): -+ *active_width = IB_WIDTH_4X; -+ *active_speed = IB_SPEED_XDR; -+ break; - default: - return -EINVAL; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1399-rdma-mlx5-avoid-flexible-array-warning.patch b/SOURCES/1399-rdma-mlx5-avoid-flexible-array-warning.patch deleted file mode 100644 index 16aece30b..000000000 --- a/SOURCES/1399-rdma-mlx5-avoid-flexible-array-warning.patch +++ /dev/null @@ -1,109 +0,0 @@ -From 08a08451012e72442d1813506229d85d3f785535 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Avoid flexible array warning - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e91fb8b9d0edec86a1ef26490bc80af96210863d -Author: Leon Romanovsky -Date: Wed May 21 14:34:58 2025 +0300 - - RDMA/mlx5: Avoid flexible array warning - - The following warning is reported by sparse tool: - drivers/infiniband/hw/mlx5/fs.c:1664:26: warning: array of flexible - structures - - Avoid it by simply splitting array into two separate structs. - - Link: https://patch.msgid.link/7b891b96a9fc053d01284c184d25ae98d35db2d4.1747827041.git.leon@kernel.org - Reviewed-by: Zhu Yanjun - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index 0ff9f18a71e8..680627f1de33 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -1645,11 +1645,6 @@ static struct mlx5_ib_flow_handler *create_flow_rule(struct mlx5_ib_dev *dev, - return _create_flow_rule(dev, ft_prio, flow_attr, dst, 0, NULL); - } - --enum { -- LEFTOVERS_MC, -- LEFTOVERS_UC, --}; -- - static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *dev, - struct mlx5_ib_flow_prio *ft_prio, - struct ib_flow_attr *flow_attr, -@@ -1659,43 +1654,32 @@ static struct mlx5_ib_flow_handler *create_leftovers_rule(struct mlx5_ib_dev *de - struct mlx5_ib_flow_handler *handler = NULL; - - static struct { -- struct ib_flow_attr flow_attr; - struct ib_flow_spec_eth eth_flow; -- } leftovers_specs[] = { -- [LEFTOVERS_MC] = { -- .flow_attr = { -- .num_of_specs = 1, -- .size = sizeof(leftovers_specs[0]) -- }, -- .eth_flow = { -- .type = IB_FLOW_SPEC_ETH, -- .size = sizeof(struct ib_flow_spec_eth), -- .mask = {.dst_mac = {0x1} }, -- .val = {.dst_mac = {0x1} } -- } -- }, -- [LEFTOVERS_UC] = { -- .flow_attr = { -- .num_of_specs = 1, -- .size = sizeof(leftovers_specs[0]) -- }, -- .eth_flow = { -- .type = IB_FLOW_SPEC_ETH, -- .size = sizeof(struct ib_flow_spec_eth), -- .mask = {.dst_mac = {0x1} }, -- .val = {.dst_mac = {} } -- } -- } -- }; -+ struct ib_flow_attr flow_attr; -+ } leftovers_wc = { .flow_attr = { .num_of_specs = 1, -+ .size = sizeof(leftovers_wc) }, -+ .eth_flow = { -+ .type = IB_FLOW_SPEC_ETH, -+ .size = sizeof(struct ib_flow_spec_eth), -+ .mask = { .dst_mac = { 0x1 } }, -+ .val = { .dst_mac = { 0x1 } } } }; - -- handler = create_flow_rule(dev, ft_prio, -- &leftovers_specs[LEFTOVERS_MC].flow_attr, -- dst); -+ static struct { -+ struct ib_flow_spec_eth eth_flow; -+ struct ib_flow_attr flow_attr; -+ } leftovers_uc = { .flow_attr = { .num_of_specs = 1, -+ .size = sizeof(leftovers_uc) }, -+ .eth_flow = { -+ .type = IB_FLOW_SPEC_ETH, -+ .size = sizeof(struct ib_flow_spec_eth), -+ .mask = { .dst_mac = { 0x1 } }, -+ .val = { .dst_mac = {} } } }; -+ -+ handler = create_flow_rule(dev, ft_prio, &leftovers_wc.flow_attr, dst); - if (!IS_ERR(handler) && - flow_attr->type == IB_FLOW_ATTR_ALL_DEFAULT) { - handler_ucast = create_flow_rule(dev, ft_prio, -- &leftovers_specs[LEFTOVERS_UC].flow_attr, -- dst); -+ &leftovers_uc.flow_attr, dst); - if (IS_ERR(handler_ucast)) { - mlx5_del_flow_rules(handler->rule); - ft_prio->refcount--; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1400-rdma-mlx5-initialize-obj-event-obj-sub-list-before-xa-insert.patch b/SOURCES/1400-rdma-mlx5-initialize-obj-event-obj-sub-list-before-xa-insert.patch deleted file mode 100644 index c04b0f934..000000000 --- a/SOURCES/1400-rdma-mlx5-initialize-obj-event-obj-sub-list-before-xa-insert.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 06a22c7cc0922e8dbc79ec9dad2cec1493943213 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Initialize obj_event->obj_sub_list before - xa_insert - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8edab8a72d67742f87e9dc2e2b0cdfddda5dc29a -Author: Mark Zhang -Date: Tue Jun 17 11:13:55 2025 +0300 - - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert - - The obj_event may be loaded immediately after inserted, then if the - list_head is not initialized then we may get a poisonous pointer. This - fixes the crash below: - - mlx5_core 0000:03:00.0: MLX5E: StrdRq(1) RqSz(8) StrdSz(2048) RxCqeCmprss(0 enhanced) - mlx5_core.sf mlx5_core.sf.4: firmware version: 32.38.3056 - mlx5_core 0000:03:00.0 en3f0pf0sf2002: renamed from eth0 - mlx5_core.sf mlx5_core.sf.4: Rate limit: 127 rates are supported, range: 0Mbps to 195312Mbps - IPv6: ADDRCONF(NETDEV_CHANGE): en3f0pf0sf2002: link becomes ready - Unable to handle kernel NULL pointer dereference at virtual address 0000000000000060 - Mem abort info: - ESR = 0x96000006 - EC = 0x25: DABT (current EL), IL = 32 bits - SET = 0, FnV = 0 - EA = 0, S1PTW = 0 - Data abort info: - ISV = 0, ISS = 0x00000006 - CM = 0, WnR = 0 - user pgtable: 4k pages, 48-bit VAs, pgdp=00000007760fb000 - [0000000000000060] pgd=000000076f6d7003, p4d=000000076f6d7003, pud=0000000777841003, pmd=0000000000000000 - Internal error: Oops: 96000006 [#1] SMP - Modules linked in: ipmb_host(OE) act_mirred(E) cls_flower(E) sch_ingress(E) mptcp_diag(E) udp_diag(E) raw_diag(E) unix_diag(E) tcp_diag(E) inet_diag(E) binfmt_misc(E) bonding(OE) rdma_ucm(OE) rdma_cm(OE) iw_cm(OE) ib_ipoib(OE) ib_cm(OE) isofs(E) cdrom(E) mst_pciconf(OE) ib_umad(OE) mlx5_ib(OE) ipmb_dev_int(OE) mlx5_core(OE) kpatch_15237886(OEK) mlxdevm(OE) auxiliary(OE) ib_uverbs(OE) ib_core(OE) psample(E) mlxfw(OE) tls(E) sunrpc(E) vfat(E) fat(E) crct10dif_ce(E) ghash_ce(E) sha1_ce(E) sbsa_gwdt(E) virtio_console(E) ext4(E) mbcache(E) jbd2(E) xfs(E) libcrc32c(E) mmc_block(E) virtio_net(E) net_failover(E) failover(E) sha2_ce(E) sha256_arm64(E) nvme(OE) nvme_core(OE) gpio_mlxbf3(OE) mlx_compat(OE) mlxbf_pmc(OE) i2c_mlxbf(OE) sdhci_of_dwcmshc(OE) pinctrl_mlxbf3(OE) mlxbf_pka(OE) gpio_generic(E) i2c_core(E) mmc_core(E) mlxbf_gige(OE) vitesse(E) pwr_mlxbf(OE) mlxbf_tmfifo(OE) micrel(E) mlxbf_bootctl(OE) virtio_ring(E) virtio(E) ipmi_devintf(E) ipmi_msghandler(E) - [last unloaded: mst_pci] - CPU: 11 PID: 20913 Comm: rte-worker-11 Kdump: loaded Tainted: G OE K 5.10.134-13.1.an8.aarch64 #1 - Hardware name: https://www.mellanox.com BlueField-3 SmartNIC Main Card/BlueField-3 SmartNIC Main Card, BIOS 4.2.2.12968 Oct 26 2023 - pstate: a0400089 (NzCv daIf +PAN -UAO -TCO BTYPE=--) - pc : dispatch_event_fd+0x68/0x300 [mlx5_ib] - lr : devx_event_notifier+0xcc/0x228 [mlx5_ib] - sp : ffff80001005bcf0 - x29: ffff80001005bcf0 x28: 0000000000000001 - x27: ffff244e0740a1d8 x26: ffff244e0740a1d0 - x25: ffffda56beff5ae0 x24: ffffda56bf911618 - x23: ffff244e0596a480 x22: ffff244e0596a480 - x21: ffff244d8312ad90 x20: ffff244e0596a480 - x19: fffffffffffffff0 x18: 0000000000000000 - x17: 0000000000000000 x16: ffffda56be66d620 - x15: 0000000000000000 x14: 0000000000000000 - x13: 0000000000000000 x12: 0000000000000000 - x11: 0000000000000040 x10: ffffda56bfcafb50 - x9 : ffffda5655c25f2c x8 : 0000000000000010 - x7 : 0000000000000000 x6 : ffff24545a2e24b8 - x5 : 0000000000000003 x4 : ffff80001005bd28 - x3 : 0000000000000000 x2 : 0000000000000000 - x1 : ffff244e0596a480 x0 : ffff244d8312ad90 - Call trace: - dispatch_event_fd+0x68/0x300 [mlx5_ib] - devx_event_notifier+0xcc/0x228 [mlx5_ib] - atomic_notifier_call_chain+0x58/0x80 - mlx5_eq_async_int+0x148/0x2b0 [mlx5_core] - atomic_notifier_call_chain+0x58/0x80 - irq_int_handler+0x20/0x30 [mlx5_core] - __handle_irq_event_percpu+0x60/0x220 - handle_irq_event_percpu+0x3c/0x90 - handle_irq_event+0x58/0x158 - handle_fasteoi_irq+0xfc/0x188 - generic_handle_irq+0x34/0x48 - ... - - Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") - Link: https://patch.msgid.link/r/3ce7f20e0d1a03dc7de6e57494ec4b8eaf1f05c2.1750147949.git.leon@kernel.org - Signed-off-by: Mark Zhang - Signed-off-by: Leon Romanovsky - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 6485ce3208ce..fae11535b1a0 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -1958,6 +1958,7 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, - /* Level1 is valid for future use, no need to free */ - return -ENOMEM; - -+ INIT_LIST_HEAD(&obj_event->obj_sub_list); - err = xa_insert(&event->object_ids, - key_level2, - obj_event, -@@ -1966,7 +1967,6 @@ subscribe_event_xa_alloc(struct mlx5_devx_event_table *devx_event_table, - kfree(obj_event); - return err; - } -- INIT_LIST_HEAD(&obj_event->obj_sub_list); - } - - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1401-rdma-mlx5-fix-hw-counters-query-for-non-representor-devices.patch b/SOURCES/1401-rdma-mlx5-fix-hw-counters-query-for-non-representor-devices.patch deleted file mode 100644 index 707cc630a..000000000 --- a/SOURCES/1401-rdma-mlx5-fix-hw-counters-query-for-non-representor-devices.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 1607e340f1d5df6e422bdd53e34444bf73986864 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Fix HW counters query for non-representor devices - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3cc1dbfddf88dc5ecce0a75185061403b1f7352d -Author: Patrisious Haddad -Date: Mon Jun 16 12:14:52 2025 +0300 - - RDMA/mlx5: Fix HW counters query for non-representor devices - - To get the device HW counters, a non-representor switchdev device - should use the mlx5_ib_query_q_counters() function and query all of - the available counters. While a representor device in switchdev mode - should use the mlx5_ib_query_q_counters_vport() function and query only - the Q_Counters without the PPCNT counters and congestion control counters, - since they aren't relevant for a representor device. - - Currently a non-representor switchdev device skips querying the PPCNT - counters and congestion control counters, leaving them unupdated. - Fix that by properly querying those counters for non-representor devices. - - Fixes: d22467a71ebe ("RDMA/mlx5: Expand switchdev Q-counters to expose representor statistics") - Signed-off-by: Patrisious Haddad - Reviewed-by: Maher Sanalla - Link: https://patch.msgid.link/56bf8af4ca8c58e3fb9f7e47b1dca2009eeeed81.1750064969.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c -index b847084dcd99..943e9eb2ad20 100644 ---- a/drivers/infiniband/hw/mlx5/counters.c -+++ b/drivers/infiniband/hw/mlx5/counters.c -@@ -398,7 +398,7 @@ static int do_get_hw_stats(struct ib_device *ibdev, - return ret; - - /* We don't expose device counters over Vports */ -- if (is_mdev_switchdev_mode(dev->mdev) && port_num != 0) -+ if (is_mdev_switchdev_mode(dev->mdev) && dev->is_rep && port_num != 0) - goto done; - - if (MLX5_CAP_PCAM_FEATURE(dev->mdev, rx_icrc_encapsulated_counter)) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1402-rdma-mlx5-fix-cc-counters-query-for-mpv.patch b/SOURCES/1402-rdma-mlx5-fix-cc-counters-query-for-mpv.patch deleted file mode 100644 index 0463791c4..000000000 --- a/SOURCES/1402-rdma-mlx5-fix-cc-counters-query-for-mpv.patch +++ /dev/null @@ -1,40 +0,0 @@ -From daaee9898eeb1ee187247fd1ed5452440eba9edc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Fix CC counters query for MPV - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit acd245b1e33fc4b9d0f2e3372021d632f7ee0652 -Author: Patrisious Haddad -Date: Mon Jun 16 12:14:53 2025 +0300 - - RDMA/mlx5: Fix CC counters query for MPV - - In case, CC counters are querying for the second port use the correct - core device for the query instead of always using the master core device. - - Fixes: aac4492ef23a ("IB/mlx5: Update counter implementation for dual port RoCE") - Signed-off-by: Patrisious Haddad - Reviewed-by: Michael Guralnik - Link: https://patch.msgid.link/9cace74dcf106116118bebfa9146d40d4166c6b0.1750064969.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c -index 943e9eb2ad20..a506fafd2b15 100644 ---- a/drivers/infiniband/hw/mlx5/counters.c -+++ b/drivers/infiniband/hw/mlx5/counters.c -@@ -418,7 +418,7 @@ static int do_get_hw_stats(struct ib_device *ibdev, - */ - goto done; - } -- ret = mlx5_lag_query_cong_counters(dev->mdev, -+ ret = mlx5_lag_query_cong_counters(mdev, - stats->value + - cnts->num_q_counters, - cnts->num_cong_counters, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1403-rdma-mlx5-fix-vport-loopback-for-mpv-device.patch b/SOURCES/1403-rdma-mlx5-fix-vport-loopback-for-mpv-device.patch deleted file mode 100644 index 3e8314cbb..000000000 --- a/SOURCES/1403-rdma-mlx5-fix-vport-loopback-for-mpv-device.patch +++ /dev/null @@ -1,89 +0,0 @@ -From b58e4be62a28810484d1d1203db45cc311c6d48f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 17:43:26 -0400 -Subject: [PATCH] RDMA/mlx5: Fix vport loopback for MPV device - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a9a9e68954f29b1e197663f76289db4879fd51bb -Author: Patrisious Haddad -Date: Mon Jun 16 12:14:54 2025 +0300 - - RDMA/mlx5: Fix vport loopback for MPV device - - Always enable vport loopback for both MPV devices on driver start. - - Previously in some cases related to MPV RoCE, packets weren't correctly - executing loopback check at vport in FW, since it was disabled. - Due to complexity of identifying such cases for MPV always enable vport - loopback for both GVMIs when binding the slave to the master port. - - Fixes: 0042f9e458a5 ("RDMA/mlx5: Enable vport loopback when user context or QP mandate") - Signed-off-by: Patrisious Haddad - Reviewed-by: Mark Bloch - Link: https://patch.msgid.link/d4298f5ebb2197459e9e7221c51ecd6a34699847.1750064969.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index d5f44c83b667..f463b8e7cfca 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -1791,6 +1791,33 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, - context->devx_uid); - } - -+static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, -+ struct mlx5_core_dev *slave) -+{ -+ int err; -+ -+ err = mlx5_nic_vport_update_local_lb(master, true); -+ if (err) -+ return err; -+ -+ err = mlx5_nic_vport_update_local_lb(slave, true); -+ if (err) -+ goto out; -+ -+ return 0; -+ -+out: -+ mlx5_nic_vport_update_local_lb(master, false); -+ return err; -+} -+ -+static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, -+ struct mlx5_core_dev *slave) -+{ -+ mlx5_nic_vport_update_local_lb(slave, false); -+ mlx5_nic_vport_update_local_lb(master, false); -+} -+ - int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { - int err = 0; -@@ -3495,6 +3522,8 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, - - lockdep_assert_held(&mlx5_ib_multiport_mutex); - -+ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); -+ - mlx5_core_mp_event_replay(ibdev->mdev, - MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, - NULL); -@@ -3590,6 +3619,10 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, - MLX5_DRIVER_EVENT_AFFILIATION_DONE, - &key); - -+ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); -+ if (err) -+ goto unbind; -+ - return true; - - unbind: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1404-net-mlx5-expose-serial-numbers-in-devlink-info.patch b/SOURCES/1404-net-mlx5-expose-serial-numbers-in-devlink-info.patch deleted file mode 100644 index 6f0025843..000000000 --- a/SOURCES/1404-net-mlx5-expose-serial-numbers-in-devlink-info.patch +++ /dev/null @@ -1,132 +0,0 @@ -From c49aebd76637b284358e3705c4642286f996b607 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:17 -0400 -Subject: [PATCH] net/mlx5: Expose serial numbers in devlink info - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 18667214b955ef89f208d451820c39a5dfd77f27 -Author: Jiri Pirko -Date: Tue Jun 10 04:51:28 2025 +0200 - - net/mlx5: Expose serial numbers in devlink info - - Devlink info allows to expose serial number and board serial number - Get the values from PCI VPD and expose it. - - $ devlink dev info - pci/0000:08:00.0: - driver mlx5_core - serial_number e4397f872caeed218000846daa7d2f49 - board.serial_number MT2314XZ00YA - versions: - fixed: - fw.psid MT_0000000894 - running: - fw.version 28.41.1000 - fw 28.41.1000 - stored: - fw.version 28.41.1000 - fw 28.41.1000 - auxiliary/mlx5_core.eth.0: - driver mlx5_core.eth - pci/0000:08:00.1: - driver mlx5_core - serial_number e4397f872caeed218000846daa7d2f49 - board.serial_number MT2314XZ00YA - versions: - fixed: - fw.psid MT_0000000894 - running: - fw.version 28.41.1000 - fw 28.41.1000 - stored: - fw.version 28.41.1000 - fw 28.41.1000 - auxiliary/mlx5_core.eth.1: - driver mlx5_core.eth - - Signed-off-by: Jiri Pirko - Reviewed-by: Parav Pandit - Reviewed-by: Simon Horman - Reviewed-by: Kalesh AP - Acked-by: Tariq Toukan - Link: https://patch.msgid.link/20250610025128.109232-1-jiri@resnulli.us - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 3b27da79ba94..4b536b384fc0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -35,6 +35,55 @@ static u16 mlx5_fw_ver_subminor(u32 version) - return version & 0xffff; - } - -+static int mlx5_devlink_serial_numbers_put(struct mlx5_core_dev *dev, -+ struct devlink_info_req *req, -+ struct netlink_ext_ack *extack) -+{ -+ struct pci_dev *pdev = dev->pdev; -+ unsigned int vpd_size, kw_len; -+ char *str, *end; -+ u8 *vpd_data; -+ int err = 0; -+ int start; -+ -+ vpd_data = pci_vpd_alloc(pdev, &vpd_size); -+ if (IS_ERR(vpd_data)) -+ return 0; -+ -+ start = pci_vpd_find_ro_info_keyword(vpd_data, vpd_size, -+ PCI_VPD_RO_KEYWORD_SERIALNO, &kw_len); -+ if (start >= 0) { -+ str = kstrndup(vpd_data + start, kw_len, GFP_KERNEL); -+ if (!str) { -+ err = -ENOMEM; -+ goto end; -+ } -+ end = strchrnul(str, ' '); -+ *end = '\0'; -+ err = devlink_info_board_serial_number_put(req, str); -+ kfree(str); -+ if (err) -+ goto end; -+ } -+ -+ start = pci_vpd_find_ro_info_keyword(vpd_data, vpd_size, "V3", &kw_len); -+ if (start >= 0) { -+ str = kstrndup(vpd_data + start, kw_len, GFP_KERNEL); -+ if (!str) { -+ err = -ENOMEM; -+ goto end; -+ } -+ err = devlink_info_serial_number_put(req, str); -+ kfree(str); -+ if (err) -+ goto end; -+ } -+ -+end: -+ kfree(vpd_data); -+ return err; -+} -+ - #define DEVLINK_FW_STRING_LEN 32 - - static int -@@ -49,6 +98,10 @@ mlx5_devlink_info_get(struct devlink *devlink, struct devlink_info_req *req, - if (!mlx5_core_is_pf(dev)) - return 0; - -+ err = mlx5_devlink_serial_numbers_put(dev, req, extack); -+ if (err) -+ return err; -+ - err = devlink_info_version_fixed_put(req, "fw.psid", dev->board_id); - if (err) - return err; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1405-net-mlx5e-shampo-reorganize-mlx5-rq-shampo-alloc.patch b/SOURCES/1405-net-mlx5e-shampo-reorganize-mlx5-rq-shampo-alloc.patch deleted file mode 100644 index 18a17bdbf..000000000 --- a/SOURCES/1405-net-mlx5e-shampo-reorganize-mlx5-rq-shampo-alloc.patch +++ /dev/null @@ -1,242 +0,0 @@ -From 9440e62748742ac2e252b1559c6575de37da4e90 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:17 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit af4312c4c9c11da84b13b3aa8f472ab287cf1f0b -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:33 2025 +0300 - - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc - - Drop redundant SHAMPO structure alloc/free functions. - - Gather together function calls pertaining to header split info, pass - header per WQE (hd_per_wqe) as parameter to those function to avoid use - before initialization future mistakes. - - Allocate HW GRO related info outside of the header related info scope. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Dragos Tatulea - Signed-off-by: Cosmin Ratiu - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250616141441.1243044-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 5b0d03b3efe8..211ea429ea89 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -638,7 +638,6 @@ struct mlx5e_shampo_hd { - struct mlx5e_frag_page *pages; - u32 hd_per_wq; - u16 hd_per_wqe; -- u16 pages_per_wq; - unsigned long *bitmap; - u16 pi; - u16 ci; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 9bd166f489e7..a074f1eac3f4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -330,47 +330,6 @@ static inline void mlx5e_build_umr_wqe(struct mlx5e_rq *rq, - ucseg->mkey_mask = cpu_to_be64(MLX5_MKEY_MASK_FREE); - } - --static int mlx5e_rq_shampo_hd_alloc(struct mlx5e_rq *rq, int node) --{ -- rq->mpwqe.shampo = kvzalloc_node(sizeof(*rq->mpwqe.shampo), -- GFP_KERNEL, node); -- if (!rq->mpwqe.shampo) -- return -ENOMEM; -- return 0; --} -- --static void mlx5e_rq_shampo_hd_free(struct mlx5e_rq *rq) --{ -- kvfree(rq->mpwqe.shampo); --} -- --static int mlx5e_rq_shampo_hd_info_alloc(struct mlx5e_rq *rq, int node) --{ -- struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; -- -- shampo->bitmap = bitmap_zalloc_node(shampo->hd_per_wq, GFP_KERNEL, -- node); -- shampo->pages = kvzalloc_node(array_size(shampo->hd_per_wq, -- sizeof(*shampo->pages)), -- GFP_KERNEL, node); -- if (!shampo->bitmap || !shampo->pages) -- goto err_nomem; -- -- return 0; -- --err_nomem: -- bitmap_free(shampo->bitmap); -- kvfree(shampo->pages); -- -- return -ENOMEM; --} -- --static void mlx5e_rq_shampo_hd_info_free(struct mlx5e_rq *rq) --{ -- bitmap_free(rq->mpwqe.shampo->bitmap); -- kvfree(rq->mpwqe.shampo->pages); --} -- - static int mlx5e_rq_alloc_mpwqe_info(struct mlx5e_rq *rq, int node) - { - int wq_sz = mlx5_wq_ll_get_size(&rq->mpwqe.wq); -@@ -583,19 +542,18 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq - } - - static int mlx5e_create_rq_hd_umr_mkey(struct mlx5_core_dev *mdev, -- struct mlx5e_rq *rq) -+ u16 hd_per_wq, u32 *umr_mkey) - { - u32 max_ksm_size = BIT(MLX5_CAP_GEN(mdev, log_max_klm_list_size)); - -- if (max_ksm_size < rq->mpwqe.shampo->hd_per_wq) { -+ if (max_ksm_size < hd_per_wq) { - mlx5_core_err(mdev, "max ksm list size 0x%x is smaller than shampo header buffer list size 0x%x\n", -- max_ksm_size, rq->mpwqe.shampo->hd_per_wq); -+ max_ksm_size, hd_per_wq); - return -EINVAL; - } -- -- return mlx5e_create_umr_ksm_mkey(mdev, rq->mpwqe.shampo->hd_per_wq, -+ return mlx5e_create_umr_ksm_mkey(mdev, hd_per_wq, - MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE, -- &rq->mpwqe.shampo->mkey); -+ umr_mkey); - } - - static void mlx5e_init_frags_partition(struct mlx5e_rq *rq) -@@ -757,6 +715,35 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param - xdp_frag_size); - } - -+static int mlx5e_rq_shampo_hd_info_alloc(struct mlx5e_rq *rq, u16 hd_per_wq, -+ int node) -+{ -+ struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; -+ -+ shampo->hd_per_wq = hd_per_wq; -+ -+ shampo->bitmap = bitmap_zalloc_node(hd_per_wq, GFP_KERNEL, node); -+ shampo->pages = kvzalloc_node(array_size(hd_per_wq, -+ sizeof(*shampo->pages)), -+ GFP_KERNEL, node); -+ if (!shampo->bitmap || !shampo->pages) -+ goto err_nomem; -+ -+ return 0; -+ -+err_nomem: -+ kvfree(shampo->pages); -+ bitmap_free(shampo->bitmap); -+ -+ return -ENOMEM; -+} -+ -+static void mlx5e_rq_shampo_hd_info_free(struct mlx5e_rq *rq) -+{ -+ kvfree(rq->mpwqe.shampo->pages); -+ bitmap_free(rq->mpwqe.shampo->bitmap); -+} -+ - static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rqp, -@@ -764,42 +751,52 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - u32 *pool_size, - int node) - { -+ void *wqc = MLX5_ADDR_OF(rqc, rqp->rqc, wq); -+ u16 hd_per_wq; -+ int wq_size; - int err; - - if (!test_bit(MLX5E_RQ_STATE_SHAMPO, &rq->state)) - return 0; -- err = mlx5e_rq_shampo_hd_alloc(rq, node); -- if (err) -- goto out; -- rq->mpwqe.shampo->hd_per_wq = -- mlx5e_shampo_hd_per_wq(mdev, params, rqp); -- err = mlx5e_create_rq_hd_umr_mkey(mdev, rq); -+ -+ rq->mpwqe.shampo = kvzalloc_node(sizeof(*rq->mpwqe.shampo), -+ GFP_KERNEL, node); -+ if (!rq->mpwqe.shampo) -+ return -ENOMEM; -+ -+ /* split headers data structures */ -+ hd_per_wq = mlx5e_shampo_hd_per_wq(mdev, params, rqp); -+ err = mlx5e_rq_shampo_hd_info_alloc(rq, hd_per_wq, node); - if (err) -- goto err_shampo_hd; -- err = mlx5e_rq_shampo_hd_info_alloc(rq, node); -+ goto err_shampo_hd_info_alloc; -+ -+ err = mlx5e_create_rq_hd_umr_mkey(mdev, hd_per_wq, -+ &rq->mpwqe.shampo->mkey); - if (err) -- goto err_shampo_info; -+ goto err_umr_mkey; -+ -+ rq->mpwqe.shampo->key = cpu_to_be32(rq->mpwqe.shampo->mkey); -+ rq->mpwqe.shampo->hd_per_wqe = -+ mlx5e_shampo_hd_per_wqe(mdev, params, rqp); -+ wq_size = BIT(MLX5_GET(wq, wqc, log_wq_sz)); -+ *pool_size += (rq->mpwqe.shampo->hd_per_wqe * wq_size) / -+ MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; -+ -+ /* gro only data structures */ - rq->hw_gro_data = kvzalloc_node(sizeof(*rq->hw_gro_data), GFP_KERNEL, node); - if (!rq->hw_gro_data) { - err = -ENOMEM; - goto err_hw_gro_data; - } -- rq->mpwqe.shampo->key = -- cpu_to_be32(rq->mpwqe.shampo->mkey); -- rq->mpwqe.shampo->hd_per_wqe = -- mlx5e_shampo_hd_per_wqe(mdev, params, rqp); -- rq->mpwqe.shampo->pages_per_wq = -- rq->mpwqe.shampo->hd_per_wq / MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; -- *pool_size += rq->mpwqe.shampo->pages_per_wq; -+ - return 0; - - err_hw_gro_data: -- mlx5e_rq_shampo_hd_info_free(rq); --err_shampo_info: - mlx5_core_destroy_mkey(mdev, rq->mpwqe.shampo->mkey); --err_shampo_hd: -- mlx5e_rq_shampo_hd_free(rq); --out: -+err_umr_mkey: -+ mlx5e_rq_shampo_hd_info_free(rq); -+err_shampo_hd_info_alloc: -+ kvfree(rq->mpwqe.shampo); - return err; - } - -@@ -811,7 +808,7 @@ static void mlx5e_rq_free_shampo(struct mlx5e_rq *rq) - kvfree(rq->hw_gro_data); - mlx5e_rq_shampo_hd_info_free(rq); - mlx5_core_destroy_mkey(rq->mdev, rq->mpwqe.shampo->mkey); -- mlx5e_rq_shampo_hd_free(rq); -+ kvfree(rq->mpwqe.shampo); - } - - static int mlx5e_alloc_rq(struct mlx5e_params *params, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1406-net-mlx5e-shampo-remove-redundant-params.patch b/SOURCES/1406-net-mlx5e-shampo-remove-redundant-params.patch deleted file mode 100644 index 4eb8f63f9..000000000 --- a/SOURCES/1406-net-mlx5e-shampo-remove-redundant-params.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 675c166094cf502d5b037ae4a692e7c5c6f6f9fa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO: Remove redundant params - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 16142defd304d5a8e591781efe24da498ccfa51f -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:34 2025 +0300 - - net/mlx5e: SHAMPO: Remove redundant params - - Two SHAMPO params are static and always the same, remove them from the - global mlx5e_params struct. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Dragos Tatulea - Signed-off-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250616141441.1243044-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 211ea429ea89..581eef34f512 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -278,10 +278,6 @@ enum packet_merge { - struct mlx5e_packet_merge_param { - enum packet_merge type; - u32 timeout; -- struct { -- u8 match_criteria_type; -- u8 alignment_granularity; -- } shampo; - }; - - struct mlx5e_params { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 58ec5e44aa7a..fc945bce933a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -901,6 +901,7 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, - { - void *rqc = param->rqc; - void *wq = MLX5_ADDR_OF(rqc, rqc, wq); -+ u32 lro_timeout; - int ndsegs = 1; - int err; - -@@ -926,22 +927,25 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, - MLX5_SET(wq, wq, log_wqe_stride_size, - log_wqe_stride_size - MLX5_MPWQE_LOG_STRIDE_SZ_BASE); - MLX5_SET(wq, wq, log_wq_sz, mlx5e_mpwqe_get_log_rq_size(mdev, params, xsk)); -- if (params->packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO) { -- MLX5_SET(wq, wq, shampo_enable, true); -- MLX5_SET(wq, wq, log_reservation_size, -- mlx5e_shampo_get_log_rsrv_size(mdev, params)); -- MLX5_SET(wq, wq, -- log_max_num_of_packets_per_reservation, -- mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); -- MLX5_SET(wq, wq, log_headers_entry_size, -- mlx5e_shampo_get_log_hd_entry_size(mdev, params)); -- MLX5_SET(rqc, rqc, reservation_timeout, -- mlx5e_choose_lro_timeout(mdev, MLX5E_DEFAULT_SHAMPO_TIMEOUT)); -- MLX5_SET(rqc, rqc, shampo_match_criteria_type, -- params->packet_merge.shampo.match_criteria_type); -- MLX5_SET(rqc, rqc, shampo_no_match_alignment_granularity, -- params->packet_merge.shampo.alignment_granularity); -- } -+ if (params->packet_merge.type != MLX5E_PACKET_MERGE_SHAMPO) -+ break; -+ -+ MLX5_SET(wq, wq, shampo_enable, true); -+ MLX5_SET(wq, wq, log_reservation_size, -+ mlx5e_shampo_get_log_rsrv_size(mdev, params)); -+ MLX5_SET(wq, wq, -+ log_max_num_of_packets_per_reservation, -+ mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); -+ MLX5_SET(wq, wq, log_headers_entry_size, -+ mlx5e_shampo_get_log_hd_entry_size(mdev, params)); -+ lro_timeout = -+ mlx5e_choose_lro_timeout(mdev, -+ MLX5E_DEFAULT_SHAMPO_TIMEOUT); -+ MLX5_SET(rqc, rqc, reservation_timeout, lro_timeout); -+ MLX5_SET(rqc, rqc, shampo_match_criteria_type, -+ MLX5_RQC_SHAMPO_MATCH_CRITERIA_TYPE_EXTENDED); -+ MLX5_SET(rqc, rqc, shampo_no_match_alignment_granularity, -+ MLX5_RQC_SHAMPO_NO_MATCH_ALIGNMENT_GRANULARITY_STRIDE); - break; - } - default: /* MLX5_WQ_TYPE_CYCLIC */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index a074f1eac3f4..4809fc9e3522 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4026,10 +4026,6 @@ static int set_feature_hw_gro(struct net_device *netdev, bool enable) - - if (enable) { - new_params.packet_merge.type = MLX5E_PACKET_MERGE_SHAMPO; -- new_params.packet_merge.shampo.match_criteria_type = -- MLX5_RQC_SHAMPO_MATCH_CRITERIA_TYPE_EXTENDED; -- new_params.packet_merge.shampo.alignment_granularity = -- MLX5_RQC_SHAMPO_NO_MATCH_ALIGNMENT_GRANULARITY_STRIDE; - } else if (new_params.packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO) { - new_params.packet_merge.type = MLX5E_PACKET_MERGE_NONE; - } else { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1407-net-mlx5e-shampo-improve-hw-gro-capability-checking.patch b/SOURCES/1407-net-mlx5e-shampo-improve-hw-gro-capability-checking.patch deleted file mode 100644 index e470644ee..000000000 --- a/SOURCES/1407-net-mlx5e-shampo-improve-hw-gro-capability-checking.patch +++ /dev/null @@ -1,68 +0,0 @@ -From ce0ae8e829ab57ae2acd173f5053cf63c391a4e1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO: Improve hw gro capability checking - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d2760abdedde635b055a214b3a45dce3e4ecbfce -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:35 2025 +0300 - - net/mlx5e: SHAMPO: Improve hw gro capability checking - - Add missing HW capabilities, declare the feature in - netdev->vlan_features, similar to other features in mlx5e_build_nic_netdev. - No functional change here as all by default disabled features are - explicitly disabled at the bottom of the function. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Dragos Tatulea - Signed-off-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250616141441.1243044-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 4809fc9e3522..e552dcf8f13a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -77,7 +77,8 @@ - - static bool mlx5e_hw_gro_supported(struct mlx5_core_dev *mdev) - { -- if (!MLX5_CAP_GEN(mdev, shampo)) -+ if (!MLX5_CAP_GEN(mdev, shampo) || -+ !MLX5_CAP_SHAMPO(mdev, shampo_header_split_data_merge)) - return false; - - /* Our HW-GRO implementation relies on "KSM Mkey" for -@@ -5489,17 +5490,17 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) - MLX5E_MPWRQ_UMR_MODE_ALIGNED)) - netdev->vlan_features |= NETIF_F_LRO; - -+ if (mlx5e_hw_gro_supported(mdev) && -+ mlx5e_check_fragmented_striding_rq_cap(mdev, PAGE_SHIFT, -+ MLX5E_MPWRQ_UMR_MODE_ALIGNED)) -+ netdev->vlan_features |= NETIF_F_GRO_HW; -+ - netdev->hw_features = netdev->vlan_features; - netdev->hw_features |= NETIF_F_HW_VLAN_CTAG_TX; - netdev->hw_features |= NETIF_F_HW_VLAN_CTAG_RX; - netdev->hw_features |= NETIF_F_HW_VLAN_CTAG_FILTER; - netdev->hw_features |= NETIF_F_HW_VLAN_STAG_TX; - -- if (mlx5e_hw_gro_supported(mdev) && -- mlx5e_check_fragmented_striding_rq_cap(mdev, PAGE_SHIFT, -- MLX5E_MPWRQ_UMR_MODE_ALIGNED)) -- netdev->hw_features |= NETIF_F_GRO_HW; -- - if (mlx5e_tunnel_any_tx_proto_supported(mdev)) { - netdev->hw_enc_features |= NETIF_F_HW_CSUM; - netdev->hw_enc_features |= NETIF_F_TSO; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1408-net-mlx5e-shampo-separate-pool-for-headers.patch b/SOURCES/1408-net-mlx5e-shampo-separate-pool-for-headers.patch deleted file mode 100644 index a341e05f5..000000000 --- a/SOURCES/1408-net-mlx5e-shampo-separate-pool-for-headers.patch +++ /dev/null @@ -1,304 +0,0 @@ -From 65f74d0b4614133bc8ed318ed25a4532182f50fc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO: Separate pool for headers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e225d9bd93ed0bb84014f5f8e241e8e456533e30 -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:36 2025 +0300 - - net/mlx5e: SHAMPO: Separate pool for headers - - Allow allocating a separate page pool for headers when SHAMPO is on. - This will be useful for adding support to zc page pool, which has to be - different from the headers page pool. - For now, the pools are the same. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Dragos Tatulea - Signed-off-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250616141441.1243044-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 581eef34f512..c329de1d4f0a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -716,7 +716,11 @@ struct mlx5e_rq { - struct bpf_prog __rcu *xdp_prog; - struct mlx5e_xdpsq *xdpsq; - DECLARE_BITMAP(flags, 8); -+ -+ /* page pools */ - struct page_pool *page_pool; -+ struct page_pool *hd_page_pool; -+ - struct mlx5e_xdp_buff mxbuf; - - /* AF_XDP zero-copy */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index e552dcf8f13a..59e845367cfd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -745,6 +746,11 @@ static void mlx5e_rq_shampo_hd_info_free(struct mlx5e_rq *rq) - bitmap_free(rq->mpwqe.shampo->bitmap); - } - -+static bool mlx5_rq_needs_separate_hd_pool(struct mlx5e_rq *rq) -+{ -+ return false; -+} -+ - static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rqp, -@@ -753,6 +759,7 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - int node) - { - void *wqc = MLX5_ADDR_OF(rqc, rqp->rqc, wq); -+ u32 hd_pool_size; - u16 hd_per_wq; - int wq_size; - int err; -@@ -780,8 +787,34 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - rq->mpwqe.shampo->hd_per_wqe = - mlx5e_shampo_hd_per_wqe(mdev, params, rqp); - wq_size = BIT(MLX5_GET(wq, wqc, log_wq_sz)); -- *pool_size += (rq->mpwqe.shampo->hd_per_wqe * wq_size) / -- MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; -+ hd_pool_size = (rq->mpwqe.shampo->hd_per_wqe * wq_size) / -+ MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; -+ -+ if (mlx5_rq_needs_separate_hd_pool(rq)) { -+ /* Separate page pool for shampo headers */ -+ struct page_pool_params pp_params = { }; -+ -+ pp_params.order = 0; -+ pp_params.flags = PP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV; -+ pp_params.pool_size = hd_pool_size; -+ pp_params.nid = node; -+ pp_params.dev = rq->pdev; -+ pp_params.napi = rq->cq.napi; -+ pp_params.netdev = rq->netdev; -+ pp_params.dma_dir = rq->buff.map_dir; -+ pp_params.max_len = PAGE_SIZE; -+ -+ rq->hd_page_pool = page_pool_create(&pp_params); -+ if (IS_ERR(rq->hd_page_pool)) { -+ err = PTR_ERR(rq->hd_page_pool); -+ rq->hd_page_pool = NULL; -+ goto err_hds_page_pool; -+ } -+ } else { -+ /* Common page pool, reserve space for headers. */ -+ *pool_size += hd_pool_size; -+ rq->hd_page_pool = NULL; -+ } - - /* gro only data structures */ - rq->hw_gro_data = kvzalloc_node(sizeof(*rq->hw_gro_data), GFP_KERNEL, node); -@@ -793,6 +826,8 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - return 0; - - err_hw_gro_data: -+ page_pool_destroy(rq->hd_page_pool); -+err_hds_page_pool: - mlx5_core_destroy_mkey(mdev, rq->mpwqe.shampo->mkey); - err_umr_mkey: - mlx5e_rq_shampo_hd_info_free(rq); -@@ -807,6 +842,8 @@ static void mlx5e_rq_free_shampo(struct mlx5e_rq *rq) - return; - - kvfree(rq->hw_gro_data); -+ if (rq->hd_page_pool != rq->page_pool) -+ page_pool_destroy(rq->hd_page_pool); - mlx5e_rq_shampo_hd_info_free(rq); - mlx5_core_destroy_mkey(rq->mdev, rq->mpwqe.shampo->mkey); - kvfree(rq->mpwqe.shampo); -@@ -938,6 +975,8 @@ static int mlx5e_alloc_rq(struct mlx5e_params *params, - rq->page_pool = NULL; - goto err_free_by_rq_type; - } -+ if (!rq->hd_page_pool) -+ rq->hd_page_pool = rq->page_pool; - if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) - err = xdp_rxq_info_reg_mem_model(&rq->xdp_rxq, - MEM_TYPE_PAGE_POOL, rq->page_pool); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 382679838113..36a4780332d7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -273,12 +273,12 @@ static inline u32 mlx5e_decompress_cqes_start(struct mlx5e_rq *rq, - - #define MLX5E_PAGECNT_BIAS_MAX (PAGE_SIZE / 64) - --static int mlx5e_page_alloc_fragmented(struct mlx5e_rq *rq, -+static int mlx5e_page_alloc_fragmented(struct page_pool *pool, - struct mlx5e_frag_page *frag_page) - { - struct page *page; - -- page = page_pool_dev_alloc_pages(rq->page_pool); -+ page = page_pool_dev_alloc_pages(pool); - if (unlikely(!page)) - return -ENOMEM; - -@@ -292,14 +292,14 @@ static int mlx5e_page_alloc_fragmented(struct mlx5e_rq *rq, - return 0; - } - --static void mlx5e_page_release_fragmented(struct mlx5e_rq *rq, -+static void mlx5e_page_release_fragmented(struct page_pool *pool, - struct mlx5e_frag_page *frag_page) - { - u16 drain_count = MLX5E_PAGECNT_BIAS_MAX - frag_page->frags; - struct page *page = frag_page->page; - - if (page_pool_unref_page(page, drain_count) == 0) -- page_pool_put_unrefed_page(rq->page_pool, page, -1, true); -+ page_pool_put_unrefed_page(pool, page, -1, true); - } - - static inline int mlx5e_get_rx_frag(struct mlx5e_rq *rq, -@@ -313,7 +313,8 @@ static inline int mlx5e_get_rx_frag(struct mlx5e_rq *rq, - * offset) should just use the new one without replenishing again - * by themselves. - */ -- err = mlx5e_page_alloc_fragmented(rq, frag->frag_page); -+ err = mlx5e_page_alloc_fragmented(rq->page_pool, -+ frag->frag_page); - - return err; - } -@@ -332,7 +333,7 @@ static inline void mlx5e_put_rx_frag(struct mlx5e_rq *rq, - struct mlx5e_wqe_frag_info *frag) - { - if (mlx5e_frag_can_release(frag)) -- mlx5e_page_release_fragmented(rq, frag->frag_page); -+ mlx5e_page_release_fragmented(rq->page_pool, frag->frag_page); - } - - static inline struct mlx5e_wqe_frag_info *get_frag(struct mlx5e_rq *rq, u16 ix) -@@ -586,7 +587,8 @@ mlx5e_free_rx_mpwqe(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi) - struct mlx5e_frag_page *frag_page; - - frag_page = &wi->alloc_units.frag_pages[i]; -- mlx5e_page_release_fragmented(rq, frag_page); -+ mlx5e_page_release_fragmented(rq->page_pool, -+ frag_page); - } - } - } -@@ -681,11 +683,10 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); - u64 addr; - -- err = mlx5e_page_alloc_fragmented(rq, frag_page); -+ err = mlx5e_page_alloc_fragmented(rq->hd_page_pool, frag_page); - if (unlikely(err)) - goto err_unmap; - -- - addr = page_pool_get_dma_addr(frag_page->page); - - for (int j = 0; j < MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; j++) { -@@ -717,7 +718,8 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - if (!header_offset) { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); - -- mlx5e_page_release_fragmented(rq, frag_page); -+ mlx5e_page_release_fragmented(rq->hd_page_pool, -+ frag_page); - } - } - -@@ -793,7 +795,7 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) - for (i = 0; i < rq->mpwqe.pages_per_wqe; i++, frag_page++) { - dma_addr_t addr; - -- err = mlx5e_page_alloc_fragmented(rq, frag_page); -+ err = mlx5e_page_alloc_fragmented(rq->page_pool, frag_page); - if (unlikely(err)) - goto err_unmap; - addr = page_pool_get_dma_addr(frag_page->page); -@@ -838,7 +840,7 @@ static int mlx5e_alloc_rx_mpwqe(struct mlx5e_rq *rq, u16 ix) - err_unmap: - while (--i >= 0) { - frag_page--; -- mlx5e_page_release_fragmented(rq, frag_page); -+ mlx5e_page_release_fragmented(rq->page_pool, frag_page); - } - - bitmap_fill(wi->skip_release_bitmap, rq->mpwqe.pages_per_wqe); -@@ -857,7 +859,7 @@ mlx5e_free_rx_shampo_hd_entry(struct mlx5e_rq *rq, u16 header_index) - if (((header_index + 1) & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)) == 0) { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, header_index); - -- mlx5e_page_release_fragmented(rq, frag_page); -+ mlx5e_page_release_fragmented(rq->hd_page_pool, frag_page); - } - clear_bit(header_index, shampo->bitmap); - } -@@ -1102,6 +1104,8 @@ INDIRECT_CALLABLE_SCOPE bool mlx5e_post_rx_mpwqes(struct mlx5e_rq *rq) - - if (rq->page_pool) - page_pool_nid_changed(rq->page_pool, numa_mem_id()); -+ if (rq->hd_page_pool) -+ page_pool_nid_changed(rq->hd_page_pool, numa_mem_id()); - - head = rq->mpwqe.actual_wq_head; - i = missing; -@@ -2010,7 +2014,8 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - if (prog) { - /* area for bpf_xdp_[store|load]_bytes */ - net_prefetchw(page_address(frag_page->page) + frag_offset); -- if (unlikely(mlx5e_page_alloc_fragmented(rq, &wi->linear_page))) { -+ if (unlikely(mlx5e_page_alloc_fragmented(rq->page_pool, -+ &wi->linear_page))) { - rq->stats->buff_alloc_err++; - return NULL; - } -@@ -2074,7 +2079,8 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - - wi->linear_page.frags++; - } -- mlx5e_page_release_fragmented(rq, &wi->linear_page); -+ mlx5e_page_release_fragmented(rq->page_pool, -+ &wi->linear_page); - return NULL; /* page/packet was consumed by XDP */ - } - -@@ -2083,13 +2089,14 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - mxbuf->xdp.data - mxbuf->xdp.data_hard_start, 0, - mxbuf->xdp.data - mxbuf->xdp.data_meta); - if (unlikely(!skb)) { -- mlx5e_page_release_fragmented(rq, &wi->linear_page); -+ mlx5e_page_release_fragmented(rq->page_pool, -+ &wi->linear_page); - return NULL; - } - - skb_mark_for_recycle(skb); - wi->linear_page.frags++; -- mlx5e_page_release_fragmented(rq, &wi->linear_page); -+ mlx5e_page_release_fragmented(rq->page_pool, &wi->linear_page); - - if (xdp_buff_has_frags(&mxbuf->xdp)) { - struct mlx5e_frag_page *pagep; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1409-net-mlx5e-implement-queue-mgmt-ops-and-single-channel-swap.patch b/SOURCES/1409-net-mlx5e-implement-queue-mgmt-ops-and-single-channel-swap.patch deleted file mode 100644 index a0bf02b42..000000000 --- a/SOURCES/1409-net-mlx5e-implement-queue-mgmt-ops-and-single-channel-swap.patch +++ /dev/null @@ -1,150 +0,0 @@ -From d17c81e1bebf992831b10750cc1ee7c6fdc04339 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5e: Implement queue mgmt ops and single channel swap - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b2588ea40ec9472688289c1a644627c0f4a1f33f -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:39 2025 +0300 - - net/mlx5e: Implement queue mgmt ops and single channel swap - - The bulk of the work is done in mlx5e_queue_mem_alloc, where we allocate - and create the new channel resources, similar to - mlx5e_safe_switch_params, but here we do it for a single channel using - existing params, sort of a clone channel. - To swap the old channel with the new one, we deactivate and close the - old channel then replace it with the new one, since the swap procedure - doesn't fail in mlx5, we do it all in one place (mlx5e_queue_start). - - Signed-off-by: Saeed Mahameed - Reviewed-by: Dragos Tatulea - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Acked-by: Mina Almasry - Link: https://patch.msgid.link/20250616141441.1243044-11-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 59e845367cfd..9330d90c1f03 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -5479,6 +5479,103 @@ static const struct netdev_stat_ops mlx5e_stat_ops = { - .get_base_stats = mlx5e_get_base_stats, - }; - -+struct mlx5_qmgmt_data { -+ struct mlx5e_channel *c; -+ struct mlx5e_channel_param cparam; -+}; -+ -+static int mlx5e_queue_mem_alloc(struct net_device *dev, void *newq, -+ int queue_index) -+{ -+ struct mlx5_qmgmt_data *new = (struct mlx5_qmgmt_data *)newq; -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ struct mlx5e_channels *chs = &priv->channels; -+ struct mlx5e_params params = chs->params; -+ struct mlx5_core_dev *mdev; -+ int err; -+ -+ mutex_lock(&priv->state_lock); -+ if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) { -+ err = -ENODEV; -+ goto unlock; -+ } -+ -+ if (queue_index >= chs->num) { -+ err = -ERANGE; -+ goto unlock; -+ } -+ -+ if (MLX5E_GET_PFLAG(&chs->params, MLX5E_PFLAG_TX_PORT_TS) || -+ chs->params.ptp_rx || -+ chs->params.xdp_prog || -+ priv->htb) { -+ netdev_err(priv->netdev, -+ "Cloning channels with Port/rx PTP, XDP or HTB is not supported\n"); -+ err = -EOPNOTSUPP; -+ goto unlock; -+ } -+ -+ mdev = mlx5_sd_ch_ix_get_dev(priv->mdev, queue_index); -+ err = mlx5e_build_channel_param(mdev, ¶ms, &new->cparam); -+ if (err) -+ goto unlock; -+ -+ err = mlx5e_open_channel(priv, queue_index, ¶ms, NULL, &new->c); -+unlock: -+ mutex_unlock(&priv->state_lock); -+ return err; -+} -+ -+static void mlx5e_queue_mem_free(struct net_device *dev, void *mem) -+{ -+ struct mlx5_qmgmt_data *data = (struct mlx5_qmgmt_data *)mem; -+ -+ /* not supposed to happen since mlx5e_queue_start never fails -+ * but this is how this should be implemented just in case -+ */ -+ if (data->c) -+ mlx5e_close_channel(data->c); -+} -+ -+static int mlx5e_queue_stop(struct net_device *dev, void *oldq, int queue_index) -+{ -+ /* In mlx5 a txq cannot be simply stopped in isolation, only restarted. -+ * mlx5e_queue_start does not fail, we stop the old queue there. -+ * TODO: Improve this. -+ */ -+ return 0; -+} -+ -+static int mlx5e_queue_start(struct net_device *dev, void *newq, -+ int queue_index) -+{ -+ struct mlx5_qmgmt_data *new = (struct mlx5_qmgmt_data *)newq; -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ struct mlx5e_channel *old; -+ -+ mutex_lock(&priv->state_lock); -+ -+ /* stop and close the old */ -+ old = priv->channels.c[queue_index]; -+ mlx5e_deactivate_priv_channels(priv); -+ /* close old before activating new, to avoid napi conflict */ -+ mlx5e_close_channel(old); -+ -+ /* start the new */ -+ priv->channels.c[queue_index] = new->c; -+ mlx5e_activate_priv_channels(priv); -+ mutex_unlock(&priv->state_lock); -+ return 0; -+} -+ -+static const struct netdev_queue_mgmt_ops mlx5e_queue_mgmt_ops = { -+ .ndo_queue_mem_size = sizeof(struct mlx5_qmgmt_data), -+ .ndo_queue_mem_alloc = mlx5e_queue_mem_alloc, -+ .ndo_queue_mem_free = mlx5e_queue_mem_free, -+ .ndo_queue_start = mlx5e_queue_start, -+ .ndo_queue_stop = mlx5e_queue_stop, -+}; -+ - static void mlx5e_build_nic_netdev(struct net_device *netdev) - { - struct mlx5e_priv *priv = netdev_priv(netdev); -@@ -5489,6 +5586,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) - SET_NETDEV_DEV(netdev, mdev->device); - - netdev->netdev_ops = &mlx5e_netdev_ops; -+ netdev->queue_mgmt_ops = &mlx5e_queue_mgmt_ops; - netdev->xdp_metadata_ops = &mlx5e_xdp_metadata_ops; - netdev->xsk_tx_metadata_ops = &mlx5e_xsk_tx_metadata_ops; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1410-net-mlx5e-support-ethtool-tcp-data-split-settings.patch b/SOURCES/1410-net-mlx5e-support-ethtool-tcp-data-split-settings.patch deleted file mode 100644 index 4df96dc76..000000000 --- a/SOURCES/1410-net-mlx5e-support-ethtool-tcp-data-split-settings.patch +++ /dev/null @@ -1,141 +0,0 @@ -From ccdbf67ee58fe08fc65b7fa79731868afdf21c63 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:42:15 -0400 -Subject: [PATCH] net/mlx5e: Support ethtool tcp-data-split settings - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Add "#include " to avoid build failure. - -commit 46bcce5dfd330c233e59cd5efd7eb43f049b0a82 -Author: Saeed Mahameed -Date: Mon Jun 16 17:14:40 2025 +0300 - - net/mlx5e: Support ethtool tcp-data-split settings - - In mlx5, tcp header-data split requires HW GRO to be on. - - Enabling it fails when HW GRO is off. - mlx5e_fix_features now keeps HW GRO on when tcp data split is enabled. - Finally, when tcp data split is disabled, features are updated to maybe - remove the forced HW GRO. - - Signed-off-by: Saeed Mahameed - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250616141441.1243044-12-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index e6c9338ddae8..ff0b9ab2daa0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -32,6 +32,7 @@ - - #include - #include -+#include - - #include "en.h" - #include "en/channels.h" -@@ -365,11 +366,6 @@ void mlx5e_ethtool_get_ringparam(struct mlx5e_priv *priv, - param->tx_max_pending = 1 << MLX5E_PARAMS_MAXIMUM_LOG_SQ_SIZE; - param->rx_pending = 1 << priv->channels.params.log_rq_mtu_frames; - param->tx_pending = 1 << priv->channels.params.log_sq_size; -- -- kernel_param->tcp_data_split = -- (priv->channels.params.packet_merge.type == MLX5E_PACKET_MERGE_SHAMPO) ? -- ETHTOOL_TCP_DATA_SPLIT_ENABLED : -- ETHTOOL_TCP_DATA_SPLIT_DISABLED; - } - - static void mlx5e_get_ringparam(struct net_device *dev, -@@ -382,6 +378,27 @@ static void mlx5e_get_ringparam(struct net_device *dev, - mlx5e_ethtool_get_ringparam(priv, param, kernel_param); - } - -+static bool mlx5e_ethtool_set_tcp_data_split(struct mlx5e_priv *priv, -+ u8 tcp_data_split, -+ struct netlink_ext_ack *extack) -+{ -+ struct net_device *dev = priv->netdev; -+ -+ if (tcp_data_split == ETHTOOL_TCP_DATA_SPLIT_ENABLED && -+ !(dev->features & NETIF_F_GRO_HW)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "TCP-data-split is not supported when GRO HW is disabled"); -+ return false; -+ } -+ -+ /* Might need to disable HW-GRO if it was kept on due to hds. */ -+ if (tcp_data_split == ETHTOOL_TCP_DATA_SPLIT_DISABLED && -+ dev->cfg->hds_config == ETHTOOL_TCP_DATA_SPLIT_ENABLED) -+ netdev_update_features(priv->netdev); -+ -+ return true; -+} -+ - int mlx5e_ethtool_set_ringparam(struct mlx5e_priv *priv, - struct ethtool_ringparam *param, - struct netlink_ext_ack *extack) -@@ -440,6 +457,11 @@ static int mlx5e_set_ringparam(struct net_device *dev, - { - struct mlx5e_priv *priv = netdev_priv(dev); - -+ if (!mlx5e_ethtool_set_tcp_data_split(priv, -+ kernel_param->tcp_data_split, -+ extack)) -+ return -EINVAL; -+ - return mlx5e_ethtool_set_ringparam(priv, param, extack); - } - -@@ -2645,6 +2667,7 @@ const struct ethtool_ops mlx5e_ethtool_ops = { - ETHTOOL_COALESCE_USE_ADAPTIVE | - ETHTOOL_COALESCE_USE_CQE, - .supported_input_xfrm = RXH_XFRM_SYM_OR_XOR, -+ .supported_ring_params = ETHTOOL_RING_USE_TCP_DATA_SPLIT, - .get_drvinfo = mlx5e_get_drvinfo, - .get_link = ethtool_op_get_link, - .get_link_ext_state = mlx5e_get_link_ext_state, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 9330d90c1f03..4bbf10174fe8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -39,6 +39,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -4392,6 +4393,7 @@ static netdev_features_t mlx5e_fix_uplink_rep_features(struct net_device *netdev - static netdev_features_t mlx5e_fix_features(struct net_device *netdev, - netdev_features_t features) - { -+ struct netdev_config *cfg = netdev->cfg_pending; - struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5e_vlan_table *vlan; - struct mlx5e_params *params; -@@ -4458,6 +4460,13 @@ static netdev_features_t mlx5e_fix_features(struct net_device *netdev, - } - } - -+ /* The header-data split ring param requires HW GRO to stay enabled. */ -+ if (cfg && cfg->hds_config == ETHTOOL_TCP_DATA_SPLIT_ENABLED && -+ !(features & NETIF_F_GRO_HW)) { -+ netdev_warn(netdev, "Keeping HW-GRO enabled, TCP header-data split depends on it\n"); -+ features |= NETIF_F_GRO_HW; -+ } -+ - if (mlx5e_is_uplink_rep(priv)) { - features = mlx5e_fix_uplink_rep_features(netdev, features); - netdev->netns_immutable = true; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1411-net-mlx5-fs-add-multiple-prios-to-rdma-transport-steering-do.patch b/SOURCES/1411-net-mlx5-fs-add-multiple-prios-to-rdma-transport-steering-do.patch deleted file mode 100644 index ab045f171..000000000 --- a/SOURCES/1411-net-mlx5-fs-add-multiple-prios-to-rdma-transport-steering-do.patch +++ /dev/null @@ -1,103 +0,0 @@ -From d243df0a0b8c463819ec69b746ed501da46f66e6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering - domain - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 52931f55159ea5c27ad4fe66fc0cb8ad75ab795b -Author: Patrisious Haddad -Date: Tue Jun 17 11:19:15 2025 +0300 - - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain - - RDMA TRANSPORT domains were initially limited to a single priority. - This change allows the domains to have multiple priorities, making - it possible to add several rules and control the order in which - they're evaluated. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Mark Bloch - Link: https://patch.msgid.link/b299cbb4c8678a33da6e6b6988b5bf6145c54b88.1750148083.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index b29e67466701..2a855e50be95 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3250,34 +3250,48 @@ static int - init_rdma_transport_rx_root_ns_one(struct mlx5_flow_steering *steering, - int vport_idx) - { -+ struct mlx5_flow_root_namespace *root_ns; - struct fs_prio *prio; -+ int i; - - steering->rdma_transport_rx_root_ns[vport_idx] = - create_root_ns(steering, FS_FT_RDMA_TRANSPORT_RX); - if (!steering->rdma_transport_rx_root_ns[vport_idx]) - return -ENOMEM; - -- /* create 1 prio*/ -- prio = fs_create_prio(&steering->rdma_transport_rx_root_ns[vport_idx]->ns, -- MLX5_RDMA_TRANSPORT_BYPASS_PRIO, 1); -- return PTR_ERR_OR_ZERO(prio); -+ root_ns = steering->rdma_transport_rx_root_ns[vport_idx]; -+ -+ for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) { -+ prio = fs_create_prio(&root_ns->ns, i, 1); -+ if (IS_ERR(prio)) -+ return PTR_ERR(prio); -+ } -+ set_prio_attrs(root_ns); -+ return 0; - } - - static int - init_rdma_transport_tx_root_ns_one(struct mlx5_flow_steering *steering, - int vport_idx) - { -+ struct mlx5_flow_root_namespace *root_ns; - struct fs_prio *prio; -+ int i; - - steering->rdma_transport_tx_root_ns[vport_idx] = - create_root_ns(steering, FS_FT_RDMA_TRANSPORT_TX); - if (!steering->rdma_transport_tx_root_ns[vport_idx]) - return -ENOMEM; - -- /* create 1 prio*/ -- prio = fs_create_prio(&steering->rdma_transport_tx_root_ns[vport_idx]->ns, -- MLX5_RDMA_TRANSPORT_BYPASS_PRIO, 1); -- return PTR_ERR_OR_ZERO(prio); -+ root_ns = steering->rdma_transport_tx_root_ns[vport_idx]; -+ -+ for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) { -+ prio = fs_create_prio(&root_ns->ns, i, 1); -+ if (IS_ERR(prio)) -+ return PTR_ERR(prio); -+ } -+ set_prio_attrs(root_ns); -+ return 0; - } - - static int init_rdma_transport_rx_root_ns(struct mlx5_flow_steering *steering) -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index fb5f98fcc726..6ac76a0c3827 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -40,7 +40,7 @@ - - #define MLX5_SET_CFG(p, f, v) MLX5_SET(create_flow_group_in, p, f, v) - --#define MLX5_RDMA_TRANSPORT_BYPASS_PRIO 0 -+#define MLX5_RDMA_TRANSPORT_BYPASS_PRIO 16 - #define MLX5_FS_MAX_POOL_SIZE BIT(30) - - enum mlx5_flow_destination_type { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1412-net-mlx5-small-refactor-for-general-object-capabilities.patch b/SOURCES/1412-net-mlx5-small-refactor-for-general-object-capabilities.patch deleted file mode 100644 index 289c6cb8c..000000000 --- a/SOURCES/1412-net-mlx5-small-refactor-for-general-object-capabilities.patch +++ /dev/null @@ -1,75 +0,0 @@ -From a8ad8f1ee332d30aea6afc35f434dc416e5b574a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5: Small refactor for general object capabilities - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ebf8d47121b6ef3f38425a343a72f37c60fd6dbc -Author: Dragos Tatulea -Date: Thu Jun 19 14:37:17 2025 +0300 - - net/mlx5: Small refactor for general object capabilities - - Make enum for capability bits of general object types depend on - the type definitions themselves. - - Make sure that capabilities in the [64,127] bit range are - properly calculated (type id - 64). - - Signed-off-by: Dragos Tatulea - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250619113721.60201-2-mbloch@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 9521159b0857..4077f0921039 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -12500,17 +12500,6 @@ struct mlx5_ifc_affiliated_event_header_bits { - u8 obj_id[0x20]; - }; - --enum { -- MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_ENCRYPTION_KEY = BIT_ULL(0xc), -- MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_IPSEC = BIT_ULL(0x13), -- MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_SAMPLER = BIT_ULL(0x20), -- MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_FLOW_METER_ASO = BIT_ULL(0x24), --}; -- --enum { -- MLX5_HCA_CAP_2_GENERAL_OBJECT_TYPES_RDMA_CTRL = BIT_ULL(0x13), --}; -- - enum { - MLX5_GENERAL_OBJECT_TYPES_ENCRYPTION_KEY = 0xc, - MLX5_GENERAL_OBJECT_TYPES_IPSEC = 0x13, -@@ -12522,6 +12511,22 @@ enum { - MLX5_GENERAL_OBJECT_TYPES_FLOW_TABLE_ALIAS = 0xff15, - }; - -+enum { -+ MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_ENCRYPTION_KEY = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_ENCRYPTION_KEY), -+ MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_IPSEC = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_IPSEC), -+ MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_SAMPLER = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_SAMPLER), -+ MLX5_HCA_CAP_GENERAL_OBJECT_TYPES_FLOW_METER_ASO = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_FLOW_METER_ASO), -+}; -+ -+enum { -+ MLX5_HCA_CAP_2_GENERAL_OBJECT_TYPES_RDMA_CTRL = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_RDMA_CTRL - 0x40), -+}; -+ - enum { - MLX5_IPSEC_OBJECT_ICV_LEN_16B, - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1413-net-mlx5-add-ifc-bits-for-pcie-congestion-event-object.patch b/SOURCES/1413-net-mlx5-add-ifc-bits-for-pcie-congestion-event-object.patch deleted file mode 100644 index a4fd88198..000000000 --- a/SOURCES/1413-net-mlx5-add-ifc-bits-for-pcie-congestion-event-object.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 1da5dd223dd8bf1658881b80fc0124839b3b927e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:18 -0400 -Subject: [PATCH] net/mlx5: Add IFC bits for PCIe Congestion Event object - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1f6da56679d33c733aaee929fd9af962ad66edbd -Author: Dragos Tatulea -Date: Thu Jun 19 14:37:18 2025 +0300 - - net/mlx5: Add IFC bits for PCIe Congestion Event object - - Add definitions for the PCIe Congestion Event object - and the relevant FW command structures. - - Signed-off-by: Dragos Tatulea - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250619113721.60201-3-mbloch@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 4077f0921039..3ab683020fab 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -12508,6 +12508,7 @@ enum { - MLX5_GENERAL_OBJECT_TYPES_MACSEC = 0x27, - MLX5_GENERAL_OBJECT_TYPES_INT_KEK = 0x47, - MLX5_GENERAL_OBJECT_TYPES_RDMA_CTRL = 0x53, -+ MLX5_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT = 0x58, - MLX5_GENERAL_OBJECT_TYPES_FLOW_TABLE_ALIAS = 0xff15, - }; - -@@ -12525,6 +12526,8 @@ enum { - enum { - MLX5_HCA_CAP_2_GENERAL_OBJECT_TYPES_RDMA_CTRL = - BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_RDMA_CTRL - 0x40), -+ MLX5_HCA_CAP_2_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT = -+ BIT_ULL(MLX5_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT - 0x40), - }; - - enum { -@@ -13283,4 +13286,41 @@ struct mlx5_ifc_mrtcq_reg_bits { - u8 reserved_at_80[0x180]; - }; - -+struct mlx5_ifc_pcie_cong_event_obj_bits { -+ u8 modify_select_field[0x40]; -+ -+ u8 inbound_event_en[0x1]; -+ u8 outbound_event_en[0x1]; -+ u8 reserved_at_42[0x1e]; -+ -+ u8 reserved_at_60[0x1]; -+ u8 inbound_cong_state[0x3]; -+ u8 reserved_at_64[0x1]; -+ u8 outbound_cong_state[0x3]; -+ u8 reserved_at_68[0x18]; -+ -+ u8 inbound_cong_low_threshold[0x10]; -+ u8 inbound_cong_high_threshold[0x10]; -+ -+ u8 outbound_cong_low_threshold[0x10]; -+ u8 outbound_cong_high_threshold[0x10]; -+ -+ u8 reserved_at_e0[0x340]; -+}; -+ -+struct mlx5_ifc_pcie_cong_event_cmd_in_bits { -+ struct mlx5_ifc_general_obj_in_cmd_hdr_bits hdr; -+ struct mlx5_ifc_pcie_cong_event_obj_bits cong_obj; -+}; -+ -+struct mlx5_ifc_pcie_cong_event_cmd_out_bits { -+ struct mlx5_ifc_general_obj_out_cmd_hdr_bits hdr; -+ struct mlx5_ifc_pcie_cong_event_obj_bits cong_obj; -+}; -+ -+enum mlx5e_pcie_cong_event_mod_field { -+ MLX5_PCIE_CONG_EVENT_MOD_EVENT_EN = BIT(0), -+ MLX5_PCIE_CONG_EVENT_MOD_THRESH = BIT(2), -+}; -+ - #endif /* MLX5_IFC_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1414-rdma-mlx5-allocate-ib-device-with-net-namespace-supplied-fro.patch b/SOURCES/1414-rdma-mlx5-allocate-ib-device-with-net-namespace-supplied-fro.patch deleted file mode 100644 index 7f82b01b0..000000000 --- a/SOURCES/1414-rdma-mlx5-allocate-ib-device-with-net-namespace-supplied-fro.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 6fb75c0ba22d1f3c68b6c8be29545b85aae66123 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] RDMA/mlx5: Allocate IB device with net namespace supplied - from core dev - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 611d08207d313500d010d8792424346ce70d0cfb -Author: Mark Bloch -Date: Tue Jun 17 11:44:02 2025 +0300 - - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev - - Use the new ib_alloc_device_with_net() API to allocate the IB device - so that it is properly bound to the network namespace obtained via - mlx5_core_net(). This change ensures correct namespace association - (e.g., for containerized setups). - - Additionally, expose mlx5_core_net so that RDMA driver can use it. - - Signed-off-by: Shay Drory - Signed-off-by: Mark Bloch - Reviewed-by: Parav Pandit - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c -index 49af1cfbe6d1..cc8859d3c2f5 100644 ---- a/drivers/infiniband/hw/mlx5/ib_rep.c -+++ b/drivers/infiniband/hw/mlx5/ib_rep.c -@@ -88,7 +88,8 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - else - return mlx5_ib_set_vport_rep(lag_master, rep, vport_index); - -- ibdev = ib_alloc_device(mlx5_ib_dev, ib_dev); -+ ibdev = ib_alloc_device_with_net(mlx5_ib_dev, ib_dev, -+ mlx5_core_net(lag_master)); - if (!ibdev) - return -ENOMEM; - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index f463b8e7cfca..c03743daeaa8 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -4823,7 +4823,8 @@ static struct ib_device *mlx5_ib_add_sub_dev(struct ib_device *parent, - !MLX5_CAP_GEN_2(mparent->mdev, multiplane_qp_ud)) - return ERR_PTR(-EOPNOTSUPP); - -- mplane = ib_alloc_device(mlx5_ib_dev, ib_dev); -+ mplane = ib_alloc_device_with_net(mlx5_ib_dev, ib_dev, -+ mlx5_core_net(mparent->mdev)); - if (!mplane) - return ERR_PTR(-ENOMEM); - -@@ -4937,7 +4938,8 @@ static int mlx5r_probe(struct auxiliary_device *adev, - - num_ports = max(MLX5_CAP_GEN(mdev, num_ports), - MLX5_CAP_GEN(mdev, num_vhca_ports)); -- dev = ib_alloc_device(mlx5_ib_dev, ib_dev); -+ dev = ib_alloc_device_with_net(mlx5_ib_dev, ib_dev, -+ mlx5_core_net(mdev)); - if (!dev) - return -ENOMEM; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -index 37d5f445598c..b111ccd03b02 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -@@ -45,11 +45,6 @@ int mlx5_crdump_enable(struct mlx5_core_dev *dev); - void mlx5_crdump_disable(struct mlx5_core_dev *dev); - int mlx5_crdump_collect(struct mlx5_core_dev *dev, u32 *cr_data); - --static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) --{ -- return devlink_net(priv_to_devlink(dev)); --} -- - static inline struct net_device *mlx5_uplink_netdev_get(struct mlx5_core_dev *mdev) - { - return mdev->mlx5e_res.uplink_netdev; -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index df76aece6be9..39e9146e079d 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -1350,4 +1350,9 @@ enum { - }; - - bool mlx5_wc_support_get(struct mlx5_core_dev *mdev); -+ -+static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) -+{ -+ return devlink_net(priv_to_devlink(dev)); -+} - #endif /* MLX5_DRIVER_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1415-net-mlx5e-fix-error-handling-in-rq-memory-model-registration.patch b/SOURCES/1415-net-mlx5e-fix-error-handling-in-rq-memory-model-registration.patch deleted file mode 100644 index e219acfd3..000000000 --- a/SOURCES/1415-net-mlx5e-fix-error-handling-in-rq-memory-model-registration.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 531f0dfc0d82b91578d110d5c244fa6da3fd2777 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5e: Fix error handling in RQ memory model registration - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7012d4f3c7a82008113974108bf0c9c0553b424a -Author: Fushuai Wang -Date: Thu Jun 26 13:30:03 2025 +0800 - - net/mlx5e: Fix error handling in RQ memory model registration - - Currently when xdp_rxq_info_reg_mem_model() fails in the XSK path, the - error handling incorrectly jumps to err_destroy_page_pool. While this - may not cause errors, we should make it jump to the correct location. - - Signed-off-by: Fushuai Wang - Reviewed-by: Zhu Yanjun - Acked-by: Dragos Tatulea - Signed-off-by: David S. Miller - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 4bbf10174fe8..62db56b5251f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -950,6 +950,8 @@ static int mlx5e_alloc_rq(struct mlx5e_params *params, - if (xsk) { - err = xdp_rxq_info_reg_mem_model(&rq->xdp_rxq, - MEM_TYPE_XSK_BUFF_POOL, NULL); -+ if (err) -+ goto err_free_by_rq_type; - xsk_pool_set_rxq_info(rq->xsk_pool, &rq->xdp_rxq); - } else { - /* Create a page_pool and register it with rxq */ -@@ -978,12 +980,13 @@ static int mlx5e_alloc_rq(struct mlx5e_params *params, - } - if (!rq->hd_page_pool) - rq->hd_page_pool = rq->page_pool; -- if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) -+ if (xdp_rxq_info_is_reg(&rq->xdp_rxq)) { - err = xdp_rxq_info_reg_mem_model(&rq->xdp_rxq, - MEM_TYPE_PAGE_POOL, rq->page_pool); -+ if (err) -+ goto err_destroy_page_pool; -+ } - } -- if (err) -- goto err_destroy_page_pool; - - for (i = 0; i < wq_sz; i++) { - if (rq->wq_type == MLX5_WQ_TYPE_LINKED_LIST_STRIDING_RQ) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1416-net-mlx5-fs-fix-rdma-transport-init-cleanup-flow.patch b/SOURCES/1416-net-mlx5-fs-fix-rdma-transport-init-cleanup-flow.patch deleted file mode 100644 index e25a5deb0..000000000 --- a/SOURCES/1416-net-mlx5-fs-fix-rdma-transport-init-cleanup-flow.patch +++ /dev/null @@ -1,89 +0,0 @@ -From a17a4fe081ef8bc70b2779e3c6582c8874c19fe9 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 02943ac2f6fbba8fc5e57c57e7cbc2d7c67ebf0d -Author: Patrisious Haddad -Date: Wed Jul 2 13:24:04 2025 +0300 - - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow - - Failing during the initialization of root_namespace didn't cleanup - the priorities of the namespace on which the failure occurred. - - Properly cleanup said priorities on failure. - - Fixes: 52931f55159e ("net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain") - Signed-off-by: Patrisious Haddad - Link: https://patch.msgid.link/78cf89b5d8452caf1e979350b30ada6904362f66.1751451780.git.leon@kernel.org - Reviewed-by: Simon Horman - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 2a855e50be95..02808be0e88b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3252,6 +3252,7 @@ init_rdma_transport_rx_root_ns_one(struct mlx5_flow_steering *steering, - { - struct mlx5_flow_root_namespace *root_ns; - struct fs_prio *prio; -+ int ret; - int i; - - steering->rdma_transport_rx_root_ns[vport_idx] = -@@ -3263,11 +3264,17 @@ init_rdma_transport_rx_root_ns_one(struct mlx5_flow_steering *steering, - - for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) { - prio = fs_create_prio(&root_ns->ns, i, 1); -- if (IS_ERR(prio)) -- return PTR_ERR(prio); -+ if (IS_ERR(prio)) { -+ ret = PTR_ERR(prio); -+ goto err; -+ } - } - set_prio_attrs(root_ns); - return 0; -+ -+err: -+ cleanup_root_ns(root_ns); -+ return ret; - } - - static int -@@ -3276,6 +3283,7 @@ init_rdma_transport_tx_root_ns_one(struct mlx5_flow_steering *steering, - { - struct mlx5_flow_root_namespace *root_ns; - struct fs_prio *prio; -+ int ret; - int i; - - steering->rdma_transport_tx_root_ns[vport_idx] = -@@ -3287,11 +3295,17 @@ init_rdma_transport_tx_root_ns_one(struct mlx5_flow_steering *steering, - - for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) { - prio = fs_create_prio(&root_ns->ns, i, 1); -- if (IS_ERR(prio)) -- return PTR_ERR(prio); -+ if (IS_ERR(prio)) { -+ ret = PTR_ERR(prio); -+ goto err; -+ } - } - set_prio_attrs(root_ns); - return 0; -+ -+err: -+ cleanup_root_ns(root_ns); -+ return ret; - } - - static int init_rdma_transport_rx_root_ns(struct mlx5_flow_steering *steering) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1417-net-mlx5-check-device-memory-pointer-before-usage.patch b/SOURCES/1417-net-mlx5-check-device-memory-pointer-before-usage.patch deleted file mode 100644 index 0f45deab4..000000000 --- a/SOURCES/1417-net-mlx5-check-device-memory-pointer-before-usage.patch +++ /dev/null @@ -1,75 +0,0 @@ -From 3df9c01eaa62ae6dc8508bc6e068aebf01b66645 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: Check device memory pointer before usage - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 70f238c902b8c0461ae6fbb8d1a0bbddc4350eea -Author: Stav Aviram -Date: Tue Jul 1 15:08:12 2025 +0300 - - net/mlx5: Check device memory pointer before usage - - Add a NULL check before accessing device memory to prevent a crash if - dev->dm allocation in mlx5_init_once() fails. - - Fixes: c9b9dcb430b3 ("net/mlx5: Move device memory management to mlx5_core") - Signed-off-by: Stav Aviram - Link: https://patch.msgid.link/c88711327f4d74d5cebc730dc629607e989ca187.1751370035.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/dm.c b/drivers/infiniband/hw/mlx5/dm.c -index b4c97fb62abf..9ded2b7c1e31 100644 ---- a/drivers/infiniband/hw/mlx5/dm.c -+++ b/drivers/infiniband/hw/mlx5/dm.c -@@ -282,7 +282,7 @@ static struct ib_dm *handle_alloc_dm_memic(struct ib_ucontext *ctx, - int err; - u64 address; - -- if (!MLX5_CAP_DEV_MEM(dm_db->dev, memic)) -+ if (!dm_db || !MLX5_CAP_DEV_MEM(dm_db->dev, memic)) - return ERR_PTR(-EOPNOTSUPP); - - dm = kzalloc(sizeof(*dm), GFP_KERNEL); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -index 7c5516b0a844..8115071c34a4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/dm.c -@@ -30,7 +30,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) - - dm = kzalloc(sizeof(*dm), GFP_KERNEL); - if (!dm) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - spin_lock_init(&dm->lock); - -@@ -96,7 +96,7 @@ struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev) - err_steering: - kfree(dm); - -- return ERR_PTR(-ENOMEM); -+ return NULL; - } - - void mlx5_dm_cleanup(struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 250f7005e79f..42daaf8387da 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1102,9 +1102,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - } - - dev->dm = mlx5_dm_create(dev); -- if (IS_ERR(dev->dm)) -- mlx5_core_warn(dev, "Failed to init device memory %ld\n", PTR_ERR(dev->dm)); -- - dev->tracer = mlx5_fw_tracer_create(dev); - dev->hv_vhca = mlx5_hv_vhca_create(dev); - dev->rsc_dump = mlx5_rsc_dump_create(dev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1418-net-mlx5-add-no-op-implementation-for-setting-tc-bw-on-rate-.patch b/SOURCES/1418-net-mlx5-add-no-op-implementation-for-setting-tc-bw-on-rate-.patch deleted file mode 100644 index 9d4a619c3..000000000 --- a/SOURCES/1418-net-mlx5-add-no-op-implementation-for-setting-tc-bw-on-rate-.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 6e33a254f6ca43f7cccbb069278193c54713188e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: Add no-op implementation for setting tc-bw on rate - objects - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 71092821244a6a8e5bce7eb6154b4e5012302194 -Author: Carolina Jubran -Date: Sun Jun 29 17:21:34 2025 +0300 - - net/mlx5: Add no-op implementation for setting tc-bw on rate objects - - Introduce `mlx5_esw_devlink_rate_node_tc_bw_set()` and - `mlx5_esw_devlink_rate_leaf_tc_bw_set()` with no-op logic. - - Future patches will add support for setting traffic class bandwidth - on rate objects. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250629142138.361537-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 4b536b384fc0..204055be51c0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -376,6 +376,8 @@ static const struct devlink_ops mlx5_devlink_ops = { - .eswitch_encap_mode_get = mlx5_devlink_eswitch_encap_mode_get, - .rate_leaf_tx_share_set = mlx5_esw_devlink_rate_leaf_tx_share_set, - .rate_leaf_tx_max_set = mlx5_esw_devlink_rate_leaf_tx_max_set, -+ .rate_leaf_tc_bw_set = mlx5_esw_devlink_rate_leaf_tc_bw_set, -+ .rate_node_tc_bw_set = mlx5_esw_devlink_rate_node_tc_bw_set, - .rate_node_tx_share_set = mlx5_esw_devlink_rate_node_tx_share_set, - .rate_node_tx_max_set = mlx5_esw_devlink_rate_node_tx_max_set, - .rate_node_new = mlx5_esw_devlink_rate_node_new, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index ad9f6fca9b6a..9da5f94b687d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -906,6 +906,26 @@ int mlx5_esw_devlink_rate_leaf_tx_max_set(struct devlink_rate *rate_leaf, void * - return err; - } - -+int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, -+ void *priv, -+ u32 *tc_bw, -+ struct netlink_ext_ack *extack) -+{ -+ NL_SET_ERR_MSG_MOD(extack, -+ "TC bandwidth shares are not supported on leafs"); -+ return -EOPNOTSUPP; -+} -+ -+int mlx5_esw_devlink_rate_node_tc_bw_set(struct devlink_rate *rate_node, -+ void *priv, -+ u32 *tc_bw, -+ struct netlink_ext_ack *extack) -+{ -+ NL_SET_ERR_MSG_MOD(extack, -+ "TC bandwidth shares are not supported on nodes"); -+ return -EOPNOTSUPP; -+} -+ - int mlx5_esw_devlink_rate_node_tx_share_set(struct devlink_rate *rate_node, void *priv, - u64 tx_share, struct netlink_ext_ack *extack) - { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.h b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.h -index ed40ec8f027e..0a50982b0e27 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.h -@@ -21,6 +21,14 @@ int mlx5_esw_devlink_rate_leaf_tx_share_set(struct devlink_rate *rate_leaf, void - u64 tx_share, struct netlink_ext_ack *extack); - int mlx5_esw_devlink_rate_leaf_tx_max_set(struct devlink_rate *rate_leaf, void *priv, - u64 tx_max, struct netlink_ext_ack *extack); -+int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_node, -+ void *priv, -+ u32 *tc_bw, -+ struct netlink_ext_ack *extack); -+int mlx5_esw_devlink_rate_node_tc_bw_set(struct devlink_rate *rate_node, -+ void *priv, -+ u32 *tc_bw, -+ struct netlink_ext_ack *extack); - int mlx5_esw_devlink_rate_node_tx_share_set(struct devlink_rate *rate_node, void *priv, - u64 tx_share, struct netlink_ext_ack *extack); - int mlx5_esw_devlink_rate_node_tx_max_set(struct devlink_rate *rate_node, void *priv, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1419-net-mlx5-add-support-for-setting-tc-bw-on-nodes.patch b/SOURCES/1419-net-mlx5-add-support-for-setting-tc-bw-on-nodes.patch deleted file mode 100644 index 8b3b5ba19..000000000 --- a/SOURCES/1419-net-mlx5-add-support-for-setting-tc-bw-on-nodes.patch +++ /dev/null @@ -1,467 +0,0 @@ -From b098b72d471acc38ae06ebd56ec5eb24ee758514 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: Add support for setting tc-bw on nodes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 96619c485fa69195ea61a9f288a00383f40b5280 -Author: Carolina Jubran -Date: Sun Jun 29 17:21:35 2025 +0300 - - net/mlx5: Add support for setting tc-bw on nodes - - Introduce support for enabling and disabling Traffic Class (TC) - arbitration for existing devlink rate nodes. This patch adds support - for a new scheduling node type, `SCHED_NODE_TYPE_TC_ARBITER_TSAR`. - - Key changes include: - - - New helper functions for transitioning existing rate nodes to TC - arbiter nodes and vice versa. These functions handle the allocation - of TC arbiter nodes, copying of child nodes, and restoring vport QoS - settings when TC arbitration is disabled. - - - Implementation of `mlx5_esw_devlink_rate_node_tc_bw_set()` to manage - tc-bw configuration on nodes. - - - Introduced stubs for `esw_qos_tc_arbiter_scheduling_setup()` and - `esw_qos_tc_arbiter_scheduling_teardown()`, which will be extended in - future patches to provide full support for tc-bw on devlink rate - objects. - - - Validation functions for tc-bw settings, allowing graceful handling - of unsupported traffic class bandwidth configurations. - - - Updated `__esw_qos_alloc_node()` to insert the new node into the - parent’s children list only if the parent is not NULL. For the root - TSAR, the new node is inserted directly after the allocation call. - - - Don't allow `tc-bw` configuration for nodes containing non-leaf - children. - - This patch lays the groundwork for future support for configuring tc-bw - on devlink rate nodes. Although the infrastructure is in place, full - support for tc-bw is not yet implemented; attempts to set tc-bw on - nodes will return `-EOPNOTSUPP`. - - No functional changes are introduced at this stage. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250629142138.361537-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 9da5f94b687d..5394f6bb499e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -64,11 +64,13 @@ static void esw_qos_domain_release(struct mlx5_eswitch *esw) - enum sched_node_type { - SCHED_NODE_TYPE_VPORTS_TSAR, - SCHED_NODE_TYPE_VPORT, -+ SCHED_NODE_TYPE_TC_ARBITER_TSAR, - }; - - static const char * const sched_node_type_str[] = { - [SCHED_NODE_TYPE_VPORTS_TSAR] = "vports TSAR", - [SCHED_NODE_TYPE_VPORT] = "vport", -+ [SCHED_NODE_TYPE_TC_ARBITER_TSAR] = "TC Arbiter TSAR", - }; - - struct mlx5_esw_sched_node { -@@ -106,6 +108,13 @@ static void esw_qos_node_attach_to_parent(struct mlx5_esw_sched_node *node) - } - } - -+static int esw_qos_num_tcs(struct mlx5_core_dev *dev) -+{ -+ int num_tcs = mlx5_max_tc(dev) + 1; -+ -+ return num_tcs < DEVLINK_RATE_TCS_MAX ? num_tcs : DEVLINK_RATE_TCS_MAX; -+} -+ - static void - esw_qos_node_set_parent(struct mlx5_esw_sched_node *node, struct mlx5_esw_sched_node *parent) - { -@@ -116,6 +125,27 @@ esw_qos_node_set_parent(struct mlx5_esw_sched_node *node, struct mlx5_esw_sched_ - esw_qos_node_attach_to_parent(node); - } - -+static void esw_qos_nodes_set_parent(struct list_head *nodes, -+ struct mlx5_esw_sched_node *parent) -+{ -+ struct mlx5_esw_sched_node *node, *tmp; -+ -+ list_for_each_entry_safe(node, tmp, nodes, entry) { -+ esw_qos_node_set_parent(node, parent); -+ if (!list_empty(&node->children) && -+ parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ struct mlx5_esw_sched_node *child; -+ -+ list_for_each_entry(child, &node->children, entry) { -+ struct mlx5_vport *vport = child->vport; -+ -+ if (vport) -+ vport->qos.sched_node->parent = parent; -+ } -+ } -+ } -+} -+ - void mlx5_esw_qos_vport_qos_free(struct mlx5_vport *vport) - { - kfree(vport->qos.sched_node); -@@ -141,16 +171,24 @@ mlx5_esw_qos_vport_get_parent(const struct mlx5_vport *vport) - - static void esw_qos_sched_elem_warn(struct mlx5_esw_sched_node *node, int err, const char *op) - { -- if (node->vport) { -+ switch (node->type) { -+ case SCHED_NODE_TYPE_VPORT: - esw_warn(node->esw->dev, - "E-Switch %s %s scheduling element failed (vport=%d,err=%d)\n", - op, sched_node_type_str[node->type], node->vport->vport, err); -- return; -+ break; -+ case SCHED_NODE_TYPE_TC_ARBITER_TSAR: -+ case SCHED_NODE_TYPE_VPORTS_TSAR: -+ esw_warn(node->esw->dev, -+ "E-Switch %s %s scheduling element failed (err=%d)\n", -+ op, sched_node_type_str[node->type], err); -+ break; -+ default: -+ esw_warn(node->esw->dev, -+ "E-Switch %s scheduling element failed (err=%d)\n", -+ op, err); -+ break; - } -- -- esw_warn(node->esw->dev, -- "E-Switch %s %s scheduling element failed (err=%d)\n", -- op, sched_node_type_str[node->type], err); - } - - static int esw_qos_node_create_sched_element(struct mlx5_esw_sched_node *node, void *ctx, -@@ -388,6 +426,14 @@ __esw_qos_alloc_node(struct mlx5_eswitch *esw, u32 tsar_ix, enum sched_node_type - node->parent = parent; - INIT_LIST_HEAD(&node->children); - esw_qos_node_attach_to_parent(node); -+ if (!parent) { -+ /* The caller is responsible for inserting the node into the -+ * parent list if necessary. This function can also be used with -+ * a NULL parent, which doesn't necessarily indicate that it -+ * refers to the root scheduling element. -+ */ -+ list_del_init(&node->entry); -+ } - - return node; - } -@@ -426,6 +472,7 @@ __esw_qos_create_vports_sched_node(struct mlx5_eswitch *esw, struct mlx5_esw_sch - goto err_alloc_node; - } - -+ list_add_tail(&node->entry, &esw->qos.domain->nodes); - esw_qos_normalize_min_rate(esw, NULL, extack); - trace_mlx5_esw_node_qos_create(esw->dev, node, node->ix); - -@@ -498,6 +545,9 @@ static int esw_qos_create(struct mlx5_eswitch *esw, struct netlink_ext_ack *exta - SCHED_NODE_TYPE_VPORTS_TSAR, - NULL)) - esw->qos.node0 = ERR_PTR(-ENOMEM); -+ else -+ list_add_tail(&esw->qos.node0->entry, -+ &esw->qos.domain->nodes); - } - if (IS_ERR(esw->qos.node0)) { - err = PTR_ERR(esw->qos.node0); -@@ -555,6 +605,18 @@ static void esw_qos_put(struct mlx5_eswitch *esw) - esw_qos_destroy(esw); - } - -+static void -+esw_qos_tc_arbiter_scheduling_teardown(struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{} -+ -+static int esw_qos_tc_arbiter_scheduling_setup(struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ NL_SET_ERR_MSG_MOD(extack, "TC arbiter elements are not supported."); -+ return -EOPNOTSUPP; -+} -+ - static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_ack *extack) - { - struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -@@ -723,6 +785,195 @@ static int esw_qos_vport_update_parent(struct mlx5_vport *vport, struct mlx5_esw - return err; - } - -+static void -+esw_qos_switch_vport_tcs_to_vport(struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vports_tc_node, *vport_tc_node, *tmp; -+ -+ vports_tc_node = list_first_entry(&tc_arbiter_node->children, -+ struct mlx5_esw_sched_node, -+ entry); -+ -+ list_for_each_entry_safe(vport_tc_node, tmp, &vports_tc_node->children, -+ entry) -+ esw_qos_vport_update_parent(vport_tc_node->vport, node, extack); -+} -+ -+static int esw_qos_switch_tc_arbiter_node_to_vports( -+ struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ u32 parent_tsar_ix = node->parent ? -+ node->parent->ix : node->esw->qos.root_tsar_ix; -+ int err; -+ -+ err = esw_qos_create_node_sched_elem(node->esw->dev, parent_tsar_ix, -+ node->max_rate, node->bw_share, -+ &node->ix); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Failed to create scheduling element for vports node when disabliing vports TC QoS"); -+ return err; -+ } -+ -+ node->type = SCHED_NODE_TYPE_VPORTS_TSAR; -+ -+ /* Disable TC QoS for vports in the arbiter node. */ -+ esw_qos_switch_vport_tcs_to_vport(tc_arbiter_node, node, extack); -+ -+ return 0; -+} -+ -+static int esw_qos_switch_vports_node_to_tc_arbiter( -+ struct mlx5_esw_sched_node *node, -+ struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node, *tmp; -+ struct mlx5_vport *vport; -+ int err; -+ -+ /* Enable TC QoS for each vport in the node. */ -+ list_for_each_entry_safe(vport_node, tmp, &node->children, entry) { -+ vport = vport_node->vport; -+ err = esw_qos_vport_update_parent(vport, tc_arbiter_node, -+ extack); -+ if (err) -+ goto err_out; -+ } -+ -+ /* Destroy the current vports node TSAR. */ -+ err = mlx5_destroy_scheduling_element_cmd(node->esw->dev, -+ SCHEDULING_HIERARCHY_E_SWITCH, -+ node->ix); -+ if (err) -+ goto err_out; -+ -+ return 0; -+err_out: -+ /* Restore vports back into the node if an error occurs. */ -+ esw_qos_switch_vport_tcs_to_vport(tc_arbiter_node, node, NULL); -+ -+ return err; -+} -+ -+static struct mlx5_esw_sched_node * -+esw_qos_move_node(struct mlx5_esw_sched_node *curr_node) -+{ -+ struct mlx5_esw_sched_node *new_node; -+ -+ new_node = __esw_qos_alloc_node(curr_node->esw, curr_node->ix, -+ curr_node->type, NULL); -+ if (!IS_ERR(new_node)) -+ esw_qos_nodes_set_parent(&curr_node->children, new_node); -+ -+ return new_node; -+} -+ -+static int esw_qos_node_disable_tc_arbitration(struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *curr_node; -+ int err; -+ -+ if (node->type != SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ return 0; -+ -+ /* Allocate a new rate node to hold the current state, which will allow -+ * for restoring the vports back to this node after disabling TC -+ * arbitration. -+ */ -+ curr_node = esw_qos_move_node(node); -+ if (IS_ERR(curr_node)) { -+ NL_SET_ERR_MSG_MOD(extack, "Failed setting up vports node"); -+ return PTR_ERR(curr_node); -+ } -+ -+ /* Disable TC QoS for all vports, and assign them back to the node. */ -+ err = esw_qos_switch_tc_arbiter_node_to_vports(curr_node, node, extack); -+ if (err) -+ goto err_out; -+ -+ /* Clean up the TC arbiter node after disabling TC QoS for vports. */ -+ esw_qos_tc_arbiter_scheduling_teardown(curr_node, extack); -+ goto out; -+err_out: -+ esw_qos_nodes_set_parent(&curr_node->children, node); -+out: -+ __esw_qos_free_node(curr_node); -+ return err; -+} -+ -+static int esw_qos_node_enable_tc_arbitration(struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *curr_node, *child; -+ int err, new_level, max_level; -+ -+ if (node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ return 0; -+ -+ /* Increase the hierarchy level by one to account for the additional -+ * vports TC scheduling node, and verify that the new level does not -+ * exceed the maximum allowed depth. -+ */ -+ new_level = node->level + 1; -+ max_level = 1 << MLX5_CAP_QOS(node->esw->dev, log_esw_max_sched_depth); -+ if (new_level > max_level) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "TC arbitration on nodes is not supported beyond max scheduling depth"); -+ return -EOPNOTSUPP; -+ } -+ -+ /* Ensure the node does not contain non-leaf children before assigning -+ * TC bandwidth. -+ */ -+ if (!list_empty(&node->children)) { -+ list_for_each_entry(child, &node->children, entry) { -+ if (!child->vport) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Cannot configure TC bandwidth on a node with non-leaf children"); -+ return -EOPNOTSUPP; -+ } -+ } -+ } -+ -+ /* Allocate a new node that will store the information of the current -+ * node. This will be used later to restore the node if necessary. -+ */ -+ curr_node = esw_qos_move_node(node); -+ if (IS_ERR(curr_node)) { -+ NL_SET_ERR_MSG_MOD(extack, "Failed setting up node TC QoS"); -+ return PTR_ERR(curr_node); -+ } -+ -+ /* Initialize the TC arbiter node for QoS management. -+ * This step prepares the node for handling Traffic Class arbitration. -+ */ -+ err = esw_qos_tc_arbiter_scheduling_setup(node, extack); -+ if (err) -+ goto err_setup; -+ -+ /* Enable TC QoS for each vport within the current node. */ -+ err = esw_qos_switch_vports_node_to_tc_arbiter(curr_node, node, extack); -+ if (err) -+ goto err_switch_vports; -+ goto out; -+ -+err_switch_vports: -+ esw_qos_tc_arbiter_scheduling_teardown(node, NULL); -+ node->ix = curr_node->ix; -+ node->type = curr_node->type; -+err_setup: -+ esw_qos_nodes_set_parent(&curr_node->children, node); -+out: -+ __esw_qos_free_node(curr_node); -+ return err; -+} -+ - static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) - { - struct ethtool_link_ksettings lksettings; -@@ -848,6 +1099,31 @@ static int esw_qos_devlink_rate_to_mbps(struct mlx5_core_dev *mdev, const char * - return 0; - } - -+static bool esw_qos_validate_unsupported_tc_bw(struct mlx5_eswitch *esw, -+ u32 *tc_bw) -+{ -+ int i, num_tcs = esw_qos_num_tcs(esw->dev); -+ -+ for (i = num_tcs; i < DEVLINK_RATE_TCS_MAX; i++) { -+ if (tc_bw[i]) -+ return false; -+ } -+ -+ return true; -+} -+ -+static bool esw_qos_tc_bw_disabled(u32 *tc_bw) -+{ -+ int i; -+ -+ for (i = 0; i < DEVLINK_RATE_TCS_MAX; i++) { -+ if (tc_bw[i]) -+ return false; -+ } -+ -+ return true; -+} -+ - int mlx5_esw_qos_init(struct mlx5_eswitch *esw) - { - if (esw->qos.domain) -@@ -921,9 +1197,28 @@ int mlx5_esw_devlink_rate_node_tc_bw_set(struct devlink_rate *rate_node, - u32 *tc_bw, - struct netlink_ext_ack *extack) - { -- NL_SET_ERR_MSG_MOD(extack, -- "TC bandwidth shares are not supported on nodes"); -- return -EOPNOTSUPP; -+ struct mlx5_esw_sched_node *node = priv; -+ struct mlx5_eswitch *esw = node->esw; -+ bool disable; -+ int err; -+ -+ if (!esw_qos_validate_unsupported_tc_bw(esw, tc_bw)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "E-Switch traffic classes number is not supported"); -+ return -EOPNOTSUPP; -+ } -+ -+ disable = esw_qos_tc_bw_disabled(tc_bw); -+ esw_qos_lock(esw); -+ if (disable) { -+ err = esw_qos_node_disable_tc_arbitration(node, extack); -+ goto unlock; -+ } -+ -+ err = esw_qos_node_enable_tc_arbitration(node, extack); -+unlock: -+ esw_qos_unlock(esw); -+ return err; - } - - int mlx5_esw_devlink_rate_node_tx_share_set(struct devlink_rate *rate_node, void *priv, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1420-net-mlx5-add-traffic-class-scheduling-support-for-vport-qos.patch b/SOURCES/1420-net-mlx5-add-traffic-class-scheduling-support-for-vport-qos.patch deleted file mode 100644 index cdb8e71d8..000000000 --- a/SOURCES/1420-net-mlx5-add-traffic-class-scheduling-support-for-vport-qos.patch +++ /dev/null @@ -1,687 +0,0 @@ -From ef32c9409c6ac247f0f571e1c8aea433fee8e101 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: Add traffic class scheduling support for vport QoS - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 97733d1e00a001b1708247af366280154df83b93 -Author: Carolina Jubran -Date: Sun Jun 29 17:21:36 2025 +0300 - - net/mlx5: Add traffic class scheduling support for vport QoS - - Introduce support for traffic class (TC) scheduling on vports by - allowing the vport to own multiple TC scheduling nodes. This patch - enables more granular control of QoS by defining three distinct QoS - states for vports, each providing unique scheduling behavior: - - 1. Regular QoS: The `sched_node` represents the vport directly, - handling QoS as a single scheduling entity. - 2. TC QoS on the vport: The `sched_node` acts as a TC arbiter, enabling - TC scheduling directly on the vport. - 3. TC QoS on the parent node: The `sched_node` functions as a rate - limiter, with TC arbitration enabled at the parent level, associating - multiple scheduling nodes with each vport. - - Key changes include: - - - Added support for new scheduling elements, vport traffic class and - rate limiter. - - - New helper functions for creating, destroying, and restoring vport TC - scheduling nodes, handling transitions between regular QoS and TC - arbitration states. - - - Updated `esw_qos_vport_enable()` and `esw_qos_vport_disable()` to - support both regular QoS and TC arbitration states, ensuring consistent - transitions between scheduling modes. - - - Introduced a `sched_nodes` array under `vport->qos` to store multiple - TC scheduling nodes per vport, enabling finer control over per-TC QoS. - - - Enhanced `esw_qos_vport_update_parent()` to handle transitions between - the three QoS states based on the current and new parent node types. - - This patch lays the groundwork for future support for configuring tc-bw - on vports. Although the infrastructure is in place, full support for - tc-bw is not yet implemented; attempts to set tc-bw on vports will - return `-EOPNOTSUPP`. - - No functional changes are introduced at this stage. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250629142138.361537-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 5394f6bb499e..120d19eeb46b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -65,12 +65,16 @@ enum sched_node_type { - SCHED_NODE_TYPE_VPORTS_TSAR, - SCHED_NODE_TYPE_VPORT, - SCHED_NODE_TYPE_TC_ARBITER_TSAR, -+ SCHED_NODE_TYPE_RATE_LIMITER, -+ SCHED_NODE_TYPE_VPORT_TC, - }; - - static const char * const sched_node_type_str[] = { - [SCHED_NODE_TYPE_VPORTS_TSAR] = "vports TSAR", - [SCHED_NODE_TYPE_VPORT] = "vport", - [SCHED_NODE_TYPE_TC_ARBITER_TSAR] = "TC Arbiter TSAR", -+ [SCHED_NODE_TYPE_RATE_LIMITER] = "Rate Limiter", -+ [SCHED_NODE_TYPE_VPORT_TC] = "vport TC", - }; - - struct mlx5_esw_sched_node { -@@ -94,6 +98,8 @@ struct mlx5_esw_sched_node { - struct mlx5_vport *vport; - /* Level in the hierarchy. The root node level is 1. */ - u8 level; -+ /* Valid only when this node represents a traffic class. */ -+ u8 tc; - }; - - static void esw_qos_node_attach_to_parent(struct mlx5_esw_sched_node *node) -@@ -148,6 +154,15 @@ static void esw_qos_nodes_set_parent(struct list_head *nodes, - - void mlx5_esw_qos_vport_qos_free(struct mlx5_vport *vport) - { -+ if (vport->qos.sched_nodes) { -+ int num_tcs = esw_qos_num_tcs(vport->qos.sched_node->esw->dev); -+ int i; -+ -+ for (i = 0; i < num_tcs; i++) -+ kfree(vport->qos.sched_nodes[i]); -+ kfree(vport->qos.sched_nodes); -+ } -+ - kfree(vport->qos.sched_node); - memset(&vport->qos, 0, sizeof(vport->qos)); - } -@@ -172,11 +187,19 @@ mlx5_esw_qos_vport_get_parent(const struct mlx5_vport *vport) - static void esw_qos_sched_elem_warn(struct mlx5_esw_sched_node *node, int err, const char *op) - { - switch (node->type) { -+ case SCHED_NODE_TYPE_VPORT_TC: -+ esw_warn(node->esw->dev, -+ "E-Switch %s %s scheduling element failed (vport=%d,tc=%d,err=%d)\n", -+ op, -+ sched_node_type_str[node->type], -+ node->vport->vport, node->tc, err); -+ break; - case SCHED_NODE_TYPE_VPORT: - esw_warn(node->esw->dev, - "E-Switch %s %s scheduling element failed (vport=%d,err=%d)\n", - op, sched_node_type_str[node->type], node->vport->vport, err); - break; -+ case SCHED_NODE_TYPE_RATE_LIMITER: - case SCHED_NODE_TYPE_TC_ARBITER_TSAR: - case SCHED_NODE_TYPE_VPORTS_TSAR: - esw_warn(node->esw->dev, -@@ -271,6 +294,24 @@ static int esw_qos_sched_elem_config(struct mlx5_esw_sched_node *node, u32 max_r - return 0; - } - -+static int esw_qos_create_rate_limit_element(struct mlx5_esw_sched_node *node, -+ struct netlink_ext_ack *extack) -+{ -+ u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; -+ -+ if (!mlx5_qos_element_type_supported( -+ node->esw->dev, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_RATE_LIMIT, -+ SCHEDULING_HIERARCHY_E_SWITCH)) -+ return -EOPNOTSUPP; -+ -+ MLX5_SET(scheduling_context, sched_ctx, max_average_bw, node->max_rate); -+ MLX5_SET(scheduling_context, sched_ctx, element_type, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_RATE_LIMIT); -+ -+ return esw_qos_node_create_sched_element(node, sched_ctx, extack); -+} -+ - static u32 esw_qos_calculate_min_rate_divider(struct mlx5_eswitch *esw, - struct mlx5_esw_sched_node *parent) - { -@@ -388,28 +429,64 @@ esw_qos_create_node_sched_elem(struct mlx5_core_dev *dev, u32 parent_element_id, - tsar_ix); - } - --static int esw_qos_vport_create_sched_element(struct mlx5_esw_sched_node *vport_node, -- struct netlink_ext_ack *extack) -+static int -+esw_qos_vport_create_sched_element(struct mlx5_esw_sched_node *vport_node, -+ struct netlink_ext_ack *extack) - { - u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; - struct mlx5_core_dev *dev = vport_node->esw->dev; - void *attr; - -- if (!mlx5_qos_element_type_supported(dev, -- SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT, -- SCHEDULING_HIERARCHY_E_SWITCH)) -+ if (!mlx5_qos_element_type_supported( -+ dev, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT, -+ SCHEDULING_HIERARCHY_E_SWITCH)) - return -EOPNOTSUPP; - - MLX5_SET(scheduling_context, sched_ctx, element_type, - SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT); - attr = MLX5_ADDR_OF(scheduling_context, sched_ctx, element_attributes); - MLX5_SET(vport_element, attr, vport_number, vport_node->vport->vport); -- MLX5_SET(scheduling_context, sched_ctx, parent_element_id, vport_node->parent->ix); -- MLX5_SET(scheduling_context, sched_ctx, max_average_bw, vport_node->max_rate); -+ MLX5_SET(scheduling_context, sched_ctx, parent_element_id, -+ vport_node->parent->ix); -+ MLX5_SET(scheduling_context, sched_ctx, max_average_bw, -+ vport_node->max_rate); - - return esw_qos_node_create_sched_element(vport_node, sched_ctx, extack); - } - -+static int -+esw_qos_vport_tc_create_sched_element(struct mlx5_esw_sched_node *vport_tc_node, -+ u32 rate_limit_elem_ix, -+ struct netlink_ext_ack *extack) -+{ -+ u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; -+ struct mlx5_core_dev *dev = vport_tc_node->esw->dev; -+ void *attr; -+ -+ if (!mlx5_qos_element_type_supported( -+ dev, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT_TC, -+ SCHEDULING_HIERARCHY_E_SWITCH)) -+ return -EOPNOTSUPP; -+ -+ MLX5_SET(scheduling_context, sched_ctx, element_type, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_VPORT_TC); -+ attr = MLX5_ADDR_OF(scheduling_context, sched_ctx, element_attributes); -+ MLX5_SET(vport_tc_element, attr, vport_number, -+ vport_tc_node->vport->vport); -+ MLX5_SET(vport_tc_element, attr, traffic_class, vport_tc_node->tc); -+ MLX5_SET(scheduling_context, sched_ctx, max_bw_obj_id, -+ rate_limit_elem_ix); -+ MLX5_SET(scheduling_context, sched_ctx, parent_element_id, -+ vport_tc_node->parent->ix); -+ MLX5_SET(scheduling_context, sched_ctx, bw_share, -+ vport_tc_node->bw_share); -+ -+ return esw_qos_node_create_sched_element(vport_tc_node, sched_ctx, -+ extack); -+} -+ - static struct mlx5_esw_sched_node * - __esw_qos_alloc_node(struct mlx5_eswitch *esw, u32 tsar_ix, enum sched_node_type type, - struct mlx5_esw_sched_node *parent) -@@ -617,12 +694,202 @@ static int esw_qos_tc_arbiter_scheduling_setup(struct mlx5_esw_sched_node *node, - return -EOPNOTSUPP; - } - -+static int -+esw_qos_create_vport_tc_sched_node(struct mlx5_vport *vport, -+ u32 rate_limit_elem_ix, -+ struct mlx5_esw_sched_node *vports_tc_node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ struct mlx5_esw_sched_node *vport_tc_node; -+ u8 tc = vports_tc_node->tc; -+ int err; -+ -+ vport_tc_node = __esw_qos_alloc_node(vport_node->esw, 0, -+ SCHED_NODE_TYPE_VPORT_TC, -+ vports_tc_node); -+ if (!vport_tc_node) -+ return -ENOMEM; -+ -+ vport_tc_node->min_rate = vport_node->min_rate; -+ vport_tc_node->tc = tc; -+ vport_tc_node->vport = vport; -+ err = esw_qos_vport_tc_create_sched_element(vport_tc_node, -+ rate_limit_elem_ix, -+ extack); -+ if (err) -+ goto err_out; -+ -+ vport->qos.sched_nodes[tc] = vport_tc_node; -+ -+ return 0; -+err_out: -+ __esw_qos_free_node(vport_tc_node); -+ return err; -+} -+ -+static void -+esw_qos_destroy_vport_tc_sched_elements(struct mlx5_vport *vport, -+ struct netlink_ext_ack *extack) -+{ -+ int i, num_tcs = esw_qos_num_tcs(vport->qos.sched_node->esw->dev); -+ -+ for (i = 0; i < num_tcs; i++) { -+ if (vport->qos.sched_nodes[i]) { -+ __esw_qos_destroy_node(vport->qos.sched_nodes[i], -+ extack); -+ } -+ } -+ -+ kfree(vport->qos.sched_nodes); -+ vport->qos.sched_nodes = NULL; -+} -+ -+static int -+esw_qos_create_vport_tc_sched_elements(struct mlx5_vport *vport, -+ enum sched_node_type type, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ struct mlx5_esw_sched_node *tc_arbiter_node, *vports_tc_node; -+ int err, num_tcs = esw_qos_num_tcs(vport_node->esw->dev); -+ u32 rate_limit_elem_ix; -+ -+ vport->qos.sched_nodes = kcalloc(num_tcs, -+ sizeof(struct mlx5_esw_sched_node *), -+ GFP_KERNEL); -+ if (!vport->qos.sched_nodes) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Allocating the vport TC scheduling elements failed."); -+ return -ENOMEM; -+ } -+ -+ rate_limit_elem_ix = type == SCHED_NODE_TYPE_RATE_LIMITER ? -+ vport_node->ix : 0; -+ tc_arbiter_node = type == SCHED_NODE_TYPE_RATE_LIMITER ? -+ vport_node->parent : vport_node; -+ list_for_each_entry(vports_tc_node, &tc_arbiter_node->children, entry) { -+ err = esw_qos_create_vport_tc_sched_node(vport, -+ rate_limit_elem_ix, -+ vports_tc_node, -+ extack); -+ if (err) -+ goto err_create_vport_tc; -+ } -+ -+ return 0; -+ -+err_create_vport_tc: -+ esw_qos_destroy_vport_tc_sched_elements(vport, NULL); -+ -+ return err; -+} -+ -+static int -+esw_qos_vport_tc_enable(struct mlx5_vport *vport, enum sched_node_type type, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ int err, new_level, max_level; -+ -+ if (type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ /* Increase the parent's level by 2 to account for both the -+ * TC arbiter and the vports TC scheduling element. -+ */ -+ new_level = vport_node->parent->level + 2; -+ max_level = 1 << MLX5_CAP_QOS(vport_node->esw->dev, -+ log_esw_max_sched_depth); -+ if (new_level > max_level) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "TC arbitration on leafs is not supported beyond max scheduling depth"); -+ return -EOPNOTSUPP; -+ } -+ } -+ -+ esw_assert_qos_lock_held(vport->dev->priv.eswitch); -+ -+ if (type == SCHED_NODE_TYPE_RATE_LIMITER) -+ err = esw_qos_create_rate_limit_element(vport_node, extack); -+ else -+ err = esw_qos_tc_arbiter_scheduling_setup(vport_node, extack); -+ if (err) -+ return err; -+ -+ /* Rate limiters impact multiple nodes not directly connected to them -+ * and are not direct members of the QoS hierarchy. -+ * Unlink it from the parent to reflect that. -+ */ -+ if (type == SCHED_NODE_TYPE_RATE_LIMITER) { -+ list_del_init(&vport_node->entry); -+ vport_node->level = 0; -+ } -+ -+ err = esw_qos_create_vport_tc_sched_elements(vport, type, extack); -+ if (err) -+ goto err_sched_nodes; -+ -+ return 0; -+ -+err_sched_nodes: -+ if (type == SCHED_NODE_TYPE_RATE_LIMITER) { -+ esw_qos_node_destroy_sched_element(vport_node, NULL); -+ list_add_tail(&vport_node->entry, -+ &vport_node->parent->children); -+ vport_node->level = vport_node->parent->level + 1; -+ } else { -+ esw_qos_tc_arbiter_scheduling_teardown(vport_node, NULL); -+ } -+ return err; -+} -+ -+static void esw_qos_vport_tc_disable(struct mlx5_vport *vport, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ enum sched_node_type curr_type = vport_node->type; -+ -+ esw_qos_destroy_vport_tc_sched_elements(vport, extack); -+ -+ if (curr_type == SCHED_NODE_TYPE_RATE_LIMITER) -+ esw_qos_node_destroy_sched_element(vport_node, extack); -+ else -+ esw_qos_tc_arbiter_scheduling_teardown(vport_node, extack); -+} -+ -+static int esw_qos_set_vport_tcs_min_rate(struct mlx5_vport *vport, -+ u32 min_rate, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ int err, i, num_tcs = esw_qos_num_tcs(vport_node->esw->dev); -+ -+ for (i = 0; i < num_tcs; i++) { -+ err = esw_qos_set_node_min_rate(vport->qos.sched_nodes[i], -+ min_rate, extack); -+ if (err) -+ goto err_out; -+ } -+ vport_node->min_rate = min_rate; -+ -+ return 0; -+err_out: -+ for (--i; i >= 0; i--) { -+ esw_qos_set_node_min_rate(vport->qos.sched_nodes[i], -+ vport_node->min_rate, extack); -+ } -+ return err; -+} -+ - static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_ack *extack) - { - struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; - struct mlx5_esw_sched_node *parent = vport_node->parent; -+ enum sched_node_type curr_type = vport_node->type; - -- esw_qos_node_destroy_sched_element(vport_node, extack); -+ if (curr_type == SCHED_NODE_TYPE_VPORT) -+ esw_qos_node_destroy_sched_element(vport_node, extack); -+ else -+ esw_qos_vport_tc_disable(vport, extack); - - vport_node->bw_share = 0; - list_del_init(&vport_node->entry); -@@ -631,7 +898,9 @@ static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_a - trace_mlx5_esw_vport_qos_destroy(vport_node->esw->dev, vport); - } - --static int esw_qos_vport_enable(struct mlx5_vport *vport, struct mlx5_esw_sched_node *parent, -+static int esw_qos_vport_enable(struct mlx5_vport *vport, -+ enum sched_node_type type, -+ struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) - { - int err; -@@ -639,10 +908,16 @@ static int esw_qos_vport_enable(struct mlx5_vport *vport, struct mlx5_esw_sched_ - esw_assert_qos_lock_held(vport->dev->priv.eswitch); - - esw_qos_node_set_parent(vport->qos.sched_node, parent); -- err = esw_qos_vport_create_sched_element(vport->qos.sched_node, extack); -+ if (type == SCHED_NODE_TYPE_VPORT) { -+ err = esw_qos_vport_create_sched_element(vport->qos.sched_node, -+ extack); -+ } else { -+ err = esw_qos_vport_tc_enable(vport, type, extack); -+ } - if (err) - return err; - -+ vport->qos.sched_node->type = type; - esw_qos_normalize_min_rate(parent->esw, parent, extack); - trace_mlx5_esw_vport_qos_create(vport->dev, vport, - vport->qos.sched_node->max_rate, -@@ -673,9 +948,8 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - sched_node->min_rate = min_rate; - sched_node->vport = vport; - vport->qos.sched_node = sched_node; -- err = esw_qos_vport_enable(vport, parent, extack); -+ err = esw_qos_vport_enable(vport, type, parent, extack); - if (err) { -- __esw_qos_free_node(sched_node); - esw_qos_put(esw); - vport->qos.sched_node = NULL; - } -@@ -728,6 +1002,8 @@ static int mlx5_esw_qos_set_vport_min_rate(struct mlx5_vport *vport, u32 min_rat - if (!vport_node) - return mlx5_esw_qos_vport_enable(vport, SCHED_NODE_TYPE_VPORT, NULL, 0, min_rate, - extack); -+ else if (vport_node->type == SCHED_NODE_TYPE_RATE_LIMITER) -+ return esw_qos_set_vport_tcs_min_rate(vport, min_rate, extack); - else - return esw_qos_set_node_min_rate(vport_node, min_rate, extack); - } -@@ -760,12 +1036,60 @@ bool mlx5_esw_qos_get_vport_rate(struct mlx5_vport *vport, u32 *max_rate, u32 *m - return enabled; - } - -+static int esw_qos_vport_tc_check_type(enum sched_node_type curr_type, -+ enum sched_node_type new_type, -+ struct netlink_ext_ack *extack) -+{ -+ if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && -+ new_type == SCHED_NODE_TYPE_RATE_LIMITER) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Cannot switch from vport-level TC arbitration to node-level TC arbitration"); -+ return -EOPNOTSUPP; -+ } -+ -+ if (curr_type == SCHED_NODE_TYPE_RATE_LIMITER && -+ new_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Cannot switch from node-level TC arbitration to vport-level TC arbitration"); -+ return -EOPNOTSUPP; -+ } -+ -+ return 0; -+} -+ -+static int esw_qos_vport_update(struct mlx5_vport *vport, -+ enum sched_node_type type, -+ struct mlx5_esw_sched_node *parent, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *curr_parent = vport->qos.sched_node->parent; -+ enum sched_node_type curr_type = vport->qos.sched_node->type; -+ int err; -+ -+ esw_assert_qos_lock_held(vport->dev->priv.eswitch); -+ parent = parent ?: curr_parent; -+ if (curr_type == type && curr_parent == parent) -+ return 0; -+ -+ err = esw_qos_vport_tc_check_type(curr_type, type, extack); -+ if (err) -+ return err; -+ -+ esw_qos_vport_disable(vport, extack); -+ -+ err = esw_qos_vport_enable(vport, type, parent, extack); -+ if (err) -+ esw_qos_vport_enable(vport, curr_type, curr_parent, NULL); -+ -+ return err; -+} -+ - static int esw_qos_vport_update_parent(struct mlx5_vport *vport, struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) - { - struct mlx5_eswitch *esw = vport->dev->priv.eswitch; - struct mlx5_esw_sched_node *curr_parent; -- int err; -+ enum sched_node_type type; - - esw_assert_qos_lock_held(esw); - curr_parent = vport->qos.sched_node->parent; -@@ -773,16 +1097,17 @@ static int esw_qos_vport_update_parent(struct mlx5_vport *vport, struct mlx5_esw - if (curr_parent == parent) - return 0; - -- esw_qos_vport_disable(vport, extack); -- -- err = esw_qos_vport_enable(vport, parent, extack); -- if (err) { -- if (esw_qos_vport_enable(vport, curr_parent, NULL)) -- esw_warn(parent->esw->dev, "vport restore QoS failed (vport=%d)\n", -- vport->vport); -- } -+ /* Set vport QoS type based on parent node type if different from -+ * default QoS; otherwise, use the vport's current QoS type. -+ */ -+ if (parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ type = SCHED_NODE_TYPE_RATE_LIMITER; -+ else if (curr_parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ type = SCHED_NODE_TYPE_VPORT; -+ else -+ type = vport->qos.sched_node->type; - -- return err; -+ return esw_qos_vport_update(vport, type, parent, extack); - } - - static void -@@ -1112,6 +1437,16 @@ static bool esw_qos_validate_unsupported_tc_bw(struct mlx5_eswitch *esw, - return true; - } - -+static bool esw_qos_vport_validate_unsupported_tc_bw(struct mlx5_vport *vport, -+ u32 *tc_bw) -+{ -+ struct mlx5_eswitch *esw = vport->qos.sched_node ? -+ vport->qos.sched_node->parent->esw : -+ vport->dev->priv.eswitch; -+ -+ return esw_qos_validate_unsupported_tc_bw(esw, tc_bw); -+} -+ - static bool esw_qos_tc_bw_disabled(u32 *tc_bw) - { - int i; -@@ -1187,9 +1522,50 @@ int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, - u32 *tc_bw, - struct netlink_ext_ack *extack) - { -- NL_SET_ERR_MSG_MOD(extack, -- "TC bandwidth shares are not supported on leafs"); -- return -EOPNOTSUPP; -+ struct mlx5_esw_sched_node *vport_node; -+ struct mlx5_vport *vport = priv; -+ struct mlx5_eswitch *esw; -+ bool disable; -+ int err = 0; -+ -+ esw = vport->dev->priv.eswitch; -+ if (!mlx5_esw_allowed(esw)) -+ return -EPERM; -+ -+ disable = esw_qos_tc_bw_disabled(tc_bw); -+ esw_qos_lock(esw); -+ -+ if (!esw_qos_vport_validate_unsupported_tc_bw(vport, tc_bw)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "E-Switch traffic classes number is not supported"); -+ err = -EOPNOTSUPP; -+ goto unlock; -+ } -+ -+ vport_node = vport->qos.sched_node; -+ if (disable && !vport_node) -+ goto unlock; -+ -+ if (disable) { -+ if (vport_node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ err = esw_qos_vport_update(vport, SCHED_NODE_TYPE_VPORT, -+ NULL, extack); -+ goto unlock; -+ } -+ -+ if (!vport_node) { -+ err = mlx5_esw_qos_vport_enable(vport, -+ SCHED_NODE_TYPE_TC_ARBITER_TSAR, -+ NULL, 0, 0, extack); -+ vport_node = vport->qos.sched_node; -+ } else { -+ err = esw_qos_vport_update(vport, -+ SCHED_NODE_TYPE_TC_ARBITER_TSAR, -+ NULL, extack); -+ } -+unlock: -+ esw_qos_unlock(esw); -+ return err; - } - - int mlx5_esw_devlink_rate_node_tc_bw_set(struct devlink_rate *rate_node, -@@ -1311,10 +1687,16 @@ int mlx5_esw_qos_vport_update_parent(struct mlx5_vport *vport, struct mlx5_esw_s - } - - esw_qos_lock(esw); -- if (!vport->qos.sched_node && parent) -- err = mlx5_esw_qos_vport_enable(vport, SCHED_NODE_TYPE_VPORT, parent, 0, 0, extack); -- else if (vport->qos.sched_node) -+ if (!vport->qos.sched_node && parent) { -+ enum sched_node_type type; -+ -+ type = parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR ? -+ SCHED_NODE_TYPE_RATE_LIMITER : SCHED_NODE_TYPE_VPORT; -+ err = mlx5_esw_qos_vport_enable(vport, type, parent, 0, 0, -+ extack); -+ } else if (vport->qos.sched_node) { - err = esw_qos_vport_update_parent(vport, parent, extack); -+ } - esw_qos_unlock(esw); - return err; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 8573d36785f4..d59fdcb29cb8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -212,10 +212,20 @@ struct mlx5_vport { - - struct mlx5_vport_info info; - -- /* Protected with the E-Switch qos domain lock. */ -+ /* Protected with the E-Switch qos domain lock. The Vport QoS can -+ * either be disabled (sched_node is NULL) or in one of three states: -+ * 1. Regular QoS (sched_node is a vport node). -+ * 2. TC QoS enabled on the vport (sched_node is a TC arbiter). -+ * 3. TC QoS enabled on the vport's parent node -+ * (sched_node is a rate limit node). -+ * When TC is enabled in either mode, the vport owns vport TC scheduling -+ * nodes. -+ */ - struct { -- /* Vport scheduling element node. */ -+ /* Vport scheduling node. */ - struct mlx5_esw_sched_node *sched_node; -+ /* Array of vport traffic class scheduling nodes. */ -+ struct mlx5_esw_sched_node **sched_nodes; - } qos; - - u16 vport; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1421-net-mlx5-manage-tc-arbiter-nodes-and-implement-full-support-.patch b/SOURCES/1421-net-mlx5-manage-tc-arbiter-nodes-and-implement-full-support-.patch deleted file mode 100644 index dfff97348..000000000 --- a/SOURCES/1421-net-mlx5-manage-tc-arbiter-nodes-and-implement-full-support-.patch +++ /dev/null @@ -1,507 +0,0 @@ -From 68428c109ec29f2fbc9421137b13c0a91bc041d1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: Manage TC arbiter nodes and implement full support - for tc-bw - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cf7e73770d1bc0492b20e2b0222a59c6bafbd8ff -Author: Carolina Jubran -Date: Sun Jun 29 17:21:37 2025 +0300 - - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw - - Introduce support for managing Traffic Class (TC) arbiter nodes and - associated vports TC nodes within the E-Switch QoS hierarchy. This - patch adds support for the new scheduling node type, - `SCHED_NODE_TYPE_VPORTS_TC_TSAR`, and implements full support for - setting tc-bw on both vports and nodes. - - Key changes include: - - - Introduced the new scheduling node type, - `SCHED_NODE_TYPE_VPORTS_TC_TSAR`, for managing vports within the TC - arbiter node. - - - New helper functions for creating and destroying vports TC nodes - under the TC arbiter. - - - Updated the minimum rate normalization function to skip nodes of type - `SCHED_NODE_TYPE_VPORTS_TC_TSAR`. Vports TC TSARs have bandwidth - shares configured on them but not minimum rates, so their `min_rate` - cannot be normalized. - - - Implementation of `esw_qos_tc_arbiter_scheduling_setup()` and - `esw_qos_tc_arbiter_scheduling_teardown()` for initializing and - cleaning up TC arbiter scheduling elements. These functions now fully - support tc-bw configuration on TC arbiter nodes. - - - Introduced a new helper `esw_qos_calculate_tc_bw_divider()` to - compute the total TC bandwidth share, which is used as a divider for - normalizing each TC's share. - - - Added `esw_qos_tc_arbiter_get_bw_shares()` and - `esw_qos_set_tc_arbiter_bw_shares()` to handle the settings of - bandwidth shares for vports traffic class TSARs. - - - `esw_qos_set_tc_arbiter_bw_shares()` normalizes each TC share based - on the total and the firmware's maximum allowed TSAR bandwidth share. - - - Refactored `mlx5_esw_devlink_rate_node_tc_bw_set()` and - `mlx5_esw_devlink_rate_leaf_tc_bw_set()` to fully support configuring - tc-bw on devlink rate nodes and vports, respectively. - - - Refactored `mlx5_esw_qos_node_update_parent()` to ensure that tc-bw - configuration remains compatible with setting a parent on a rate - node, preserving level hierarchy functionality. - - - Refactored `esw_qos_calc_bw_share()` to generalize its input so it - can be used for both minimum rate and bandwidth share calculations. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250629142138.361537-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 120d19eeb46b..c24d1f584a46 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -67,6 +67,7 @@ enum sched_node_type { - SCHED_NODE_TYPE_TC_ARBITER_TSAR, - SCHED_NODE_TYPE_RATE_LIMITER, - SCHED_NODE_TYPE_VPORT_TC, -+ SCHED_NODE_TYPE_VPORTS_TC_TSAR, - }; - - static const char * const sched_node_type_str[] = { -@@ -75,6 +76,7 @@ static const char * const sched_node_type_str[] = { - [SCHED_NODE_TYPE_TC_ARBITER_TSAR] = "TC Arbiter TSAR", - [SCHED_NODE_TYPE_RATE_LIMITER] = "Rate Limiter", - [SCHED_NODE_TYPE_VPORT_TC] = "vport TC", -+ [SCHED_NODE_TYPE_VPORTS_TC_TSAR] = "vports TC TSAR", - }; - - struct mlx5_esw_sched_node { -@@ -187,6 +189,11 @@ mlx5_esw_qos_vport_get_parent(const struct mlx5_vport *vport) - static void esw_qos_sched_elem_warn(struct mlx5_esw_sched_node *node, int err, const char *op) - { - switch (node->type) { -+ case SCHED_NODE_TYPE_VPORTS_TC_TSAR: -+ esw_warn(node->esw->dev, -+ "E-Switch %s %s scheduling element failed (tc=%d,err=%d)\n", -+ op, sched_node_type_str[node->type], node->tc, err); -+ break; - case SCHED_NODE_TYPE_VPORT_TC: - esw_warn(node->esw->dev, - "E-Switch %s %s scheduling element failed (vport=%d,tc=%d,err=%d)\n", -@@ -345,11 +352,13 @@ static u32 esw_qos_calculate_min_rate_divider(struct mlx5_eswitch *esw, - return 0; - } - --static u32 esw_qos_calc_bw_share(u32 min_rate, u32 divider, u32 fw_max) -+static u32 esw_qos_calc_bw_share(u32 value, u32 divider, u32 fw_max) - { - if (!divider) - return 0; -- return min_t(u32, max_t(u32, DIV_ROUND_UP(min_rate, divider), MLX5_MIN_BW_SHARE), fw_max); -+ return min_t(u32, fw_max, -+ max_t(u32, -+ DIV_ROUND_UP(value, divider), MLX5_MIN_BW_SHARE)); - } - - static void esw_qos_update_sched_node_bw_share(struct mlx5_esw_sched_node *node, -@@ -376,7 +385,13 @@ static void esw_qos_normalize_min_rate(struct mlx5_eswitch *esw, - if (node->esw != esw || node->ix == esw->qos.root_tsar_ix) - continue; - -- esw_qos_update_sched_node_bw_share(node, divider, extack); -+ /* Vports TC TSARs don't have a minimum rate configured, -+ * so there's no need to update the bw_share on them. -+ */ -+ if (node->type != SCHED_NODE_TYPE_VPORTS_TC_TSAR) { -+ esw_qos_update_sched_node_bw_share(node, divider, -+ extack); -+ } - - if (list_empty(&node->children)) - continue; -@@ -385,6 +400,20 @@ static void esw_qos_normalize_min_rate(struct mlx5_eswitch *esw, - } - } - -+static u32 esw_qos_calculate_tc_bw_divider(u32 *tc_bw) -+{ -+ u32 total = 0; -+ int i; -+ -+ for (i = 0; i < DEVLINK_RATE_TCS_MAX; i++) -+ total += tc_bw[i]; -+ -+ /* If total is zero, tc-bw config is disabled and we shouldn't reach -+ * here. -+ */ -+ return WARN_ON(!total) ? 1 : total; -+} -+ - static int esw_qos_set_node_min_rate(struct mlx5_esw_sched_node *node, - u32 min_rate, struct netlink_ext_ack *extack) - { -@@ -527,6 +556,149 @@ static void esw_qos_destroy_node(struct mlx5_esw_sched_node *node, struct netlin - __esw_qos_free_node(node); - } - -+static int esw_qos_create_vports_tc_node(struct mlx5_esw_sched_node *parent, -+ u8 tc, struct netlink_ext_ack *extack) -+{ -+ u32 tsar_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; -+ struct mlx5_core_dev *dev = parent->esw->dev; -+ struct mlx5_esw_sched_node *vports_tc_node; -+ void *attr; -+ int err; -+ -+ if (!mlx5_qos_element_type_supported( -+ dev, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR, -+ SCHEDULING_HIERARCHY_E_SWITCH) || -+ !mlx5_qos_tsar_type_supported(dev, -+ TSAR_ELEMENT_TSAR_TYPE_DWRR, -+ SCHEDULING_HIERARCHY_E_SWITCH)) -+ return -EOPNOTSUPP; -+ -+ vports_tc_node = __esw_qos_alloc_node(parent->esw, 0, -+ SCHED_NODE_TYPE_VPORTS_TC_TSAR, -+ parent); -+ if (!vports_tc_node) { -+ NL_SET_ERR_MSG_MOD(extack, "E-Switch alloc node failed"); -+ esw_warn(dev, "Failed to alloc vports TC node (tc=%d)\n", tc); -+ return -ENOMEM; -+ } -+ -+ attr = MLX5_ADDR_OF(scheduling_context, tsar_ctx, element_attributes); -+ MLX5_SET(tsar_element, attr, tsar_type, TSAR_ELEMENT_TSAR_TYPE_DWRR); -+ MLX5_SET(tsar_element, attr, traffic_class, tc); -+ MLX5_SET(scheduling_context, tsar_ctx, parent_element_id, parent->ix); -+ MLX5_SET(scheduling_context, tsar_ctx, element_type, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR); -+ -+ err = esw_qos_node_create_sched_element(vports_tc_node, tsar_ctx, -+ extack); -+ if (err) -+ goto err_create_sched_element; -+ -+ vports_tc_node->tc = tc; -+ -+ return 0; -+ -+err_create_sched_element: -+ __esw_qos_free_node(vports_tc_node); -+ return err; -+} -+ -+static void -+esw_qos_tc_arbiter_get_bw_shares(struct mlx5_esw_sched_node *tc_arbiter_node, -+ u32 *tc_bw) -+{ -+ struct mlx5_esw_sched_node *vports_tc_node; -+ -+ list_for_each_entry(vports_tc_node, &tc_arbiter_node->children, entry) -+ tc_bw[vports_tc_node->tc] = vports_tc_node->bw_share; -+} -+ -+static void -+esw_qos_set_tc_arbiter_bw_shares(struct mlx5_esw_sched_node *tc_arbiter_node, -+ u32 *tc_bw, struct netlink_ext_ack *extack) -+{ -+ struct mlx5_eswitch *esw = tc_arbiter_node->esw; -+ struct mlx5_esw_sched_node *vports_tc_node; -+ u32 divider, fw_max_bw_share; -+ -+ fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share); -+ divider = esw_qos_calculate_tc_bw_divider(tc_bw); -+ list_for_each_entry(vports_tc_node, &tc_arbiter_node->children, entry) { -+ u8 tc = vports_tc_node->tc; -+ u32 bw_share; -+ -+ bw_share = tc_bw[tc] * fw_max_bw_share; -+ bw_share = esw_qos_calc_bw_share(bw_share, divider, -+ fw_max_bw_share); -+ esw_qos_sched_elem_config(vports_tc_node, 0, bw_share, extack); -+ } -+} -+ -+static void -+esw_qos_destroy_vports_tc_nodes(struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *vports_tc_node, *tmp; -+ -+ list_for_each_entry_safe(vports_tc_node, tmp, -+ &tc_arbiter_node->children, entry) -+ esw_qos_destroy_node(vports_tc_node, extack); -+} -+ -+static int -+esw_qos_create_vports_tc_nodes(struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_eswitch *esw = tc_arbiter_node->esw; -+ int err, i, num_tcs = esw_qos_num_tcs(esw->dev); -+ -+ for (i = 0; i < num_tcs; i++) { -+ err = esw_qos_create_vports_tc_node(tc_arbiter_node, i, extack); -+ if (err) -+ goto err_tc_node_create; -+ } -+ -+ return 0; -+ -+err_tc_node_create: -+ esw_qos_destroy_vports_tc_nodes(tc_arbiter_node, NULL); -+ return err; -+} -+ -+static int esw_qos_create_tc_arbiter_sched_elem( -+ struct mlx5_esw_sched_node *tc_arbiter_node, -+ struct netlink_ext_ack *extack) -+{ -+ u32 tsar_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; -+ u32 tsar_parent_ix; -+ void *attr; -+ -+ if (!mlx5_qos_tsar_type_supported(tc_arbiter_node->esw->dev, -+ TSAR_ELEMENT_TSAR_TYPE_TC_ARB, -+ SCHEDULING_HIERARCHY_E_SWITCH)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "E-Switch TC Arbiter scheduling element is not supported"); -+ return -EOPNOTSUPP; -+ } -+ -+ attr = MLX5_ADDR_OF(scheduling_context, tsar_ctx, element_attributes); -+ MLX5_SET(tsar_element, attr, tsar_type, TSAR_ELEMENT_TSAR_TYPE_TC_ARB); -+ tsar_parent_ix = tc_arbiter_node->parent ? tc_arbiter_node->parent->ix : -+ tc_arbiter_node->esw->qos.root_tsar_ix; -+ MLX5_SET(scheduling_context, tsar_ctx, parent_element_id, -+ tsar_parent_ix); -+ MLX5_SET(scheduling_context, tsar_ctx, element_type, -+ SCHEDULING_CONTEXT_ELEMENT_TYPE_TSAR); -+ MLX5_SET(scheduling_context, tsar_ctx, max_average_bw, -+ tc_arbiter_node->max_rate); -+ MLX5_SET(scheduling_context, tsar_ctx, bw_share, -+ tc_arbiter_node->bw_share); -+ -+ return esw_qos_node_create_sched_element(tc_arbiter_node, tsar_ctx, -+ extack); -+} -+ - static struct mlx5_esw_sched_node * - __esw_qos_create_vports_sched_node(struct mlx5_eswitch *esw, struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) -@@ -591,6 +763,9 @@ static void __esw_qos_destroy_node(struct mlx5_esw_sched_node *node, struct netl - { - struct mlx5_eswitch *esw = node->esw; - -+ if (node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ esw_qos_destroy_vports_tc_nodes(node, extack); -+ - trace_mlx5_esw_node_qos_destroy(esw->dev, node, node->ix); - esw_qos_destroy_node(node, extack); - esw_qos_normalize_min_rate(esw, NULL, extack); -@@ -685,13 +860,38 @@ static void esw_qos_put(struct mlx5_eswitch *esw) - static void - esw_qos_tc_arbiter_scheduling_teardown(struct mlx5_esw_sched_node *node, - struct netlink_ext_ack *extack) --{} -+{ -+ /* Clean up all Vports TC nodes within the TC arbiter node. */ -+ esw_qos_destroy_vports_tc_nodes(node, extack); -+ /* Destroy the scheduling element for the TC arbiter node itself. */ -+ esw_qos_node_destroy_sched_element(node, extack); -+} - - static int esw_qos_tc_arbiter_scheduling_setup(struct mlx5_esw_sched_node *node, - struct netlink_ext_ack *extack) - { -- NL_SET_ERR_MSG_MOD(extack, "TC arbiter elements are not supported."); -- return -EOPNOTSUPP; -+ u32 curr_ix = node->ix; -+ int err; -+ -+ err = esw_qos_create_tc_arbiter_sched_elem(node, extack); -+ if (err) -+ return err; -+ /* Initialize the vports TC nodes within created TC arbiter TSAR. */ -+ err = esw_qos_create_vports_tc_nodes(node, extack); -+ if (err) -+ goto err_vports_tc_nodes; -+ -+ node->type = SCHED_NODE_TYPE_TC_ARBITER_TSAR; -+ -+ return 0; -+ -+err_vports_tc_nodes: -+ /* If initialization fails, clean up the scheduling element -+ * for the TC arbiter node. -+ */ -+ esw_qos_node_destroy_sched_element(node, NULL); -+ node->ix = curr_ix; -+ return err; - } - - static int -@@ -1064,6 +1264,7 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - { - struct mlx5_esw_sched_node *curr_parent = vport->qos.sched_node->parent; - enum sched_node_type curr_type = vport->qos.sched_node->type; -+ u32 curr_tc_bw[DEVLINK_RATE_TCS_MAX] = {0}; - int err; - - esw_assert_qos_lock_held(vport->dev->priv.eswitch); -@@ -1075,11 +1276,23 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - if (err) - return err; - -+ if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && curr_type == type) { -+ esw_qos_tc_arbiter_get_bw_shares(vport->qos.sched_node, -+ curr_tc_bw); -+ } -+ - esw_qos_vport_disable(vport, extack); - - err = esw_qos_vport_enable(vport, type, parent, extack); -- if (err) -+ if (err) { - esw_qos_vport_enable(vport, curr_type, curr_parent, NULL); -+ extack = NULL; -+ } -+ -+ if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && curr_type == type) { -+ esw_qos_set_tc_arbiter_bw_shares(vport->qos.sched_node, -+ curr_tc_bw, extack); -+ } - - return err; - } -@@ -1563,6 +1776,8 @@ int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, - SCHED_NODE_TYPE_TC_ARBITER_TSAR, - NULL, extack); - } -+ if (!err) -+ esw_qos_set_tc_arbiter_bw_shares(vport_node, tc_bw, extack); - unlock: - esw_qos_unlock(esw); - return err; -@@ -1592,6 +1807,8 @@ int mlx5_esw_devlink_rate_node_tc_bw_set(struct devlink_rate *rate_node, - } - - err = esw_qos_node_enable_tc_arbitration(node, extack); -+ if (!err) -+ esw_qos_set_tc_arbiter_bw_shares(node, tc_bw, extack); - unlock: - esw_qos_unlock(esw); - return err; -@@ -1716,6 +1933,20 @@ int mlx5_esw_devlink_rate_leaf_parent_set(struct devlink_rate *devlink_rate, - return mlx5_esw_qos_vport_update_parent(vport, node, extack); - } - -+static bool esw_qos_is_node_empty(struct mlx5_esw_sched_node *node) -+{ -+ if (list_empty(&node->children)) -+ return true; -+ -+ if (node->type != SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ return false; -+ -+ node = list_first_entry(&node->children, struct mlx5_esw_sched_node, -+ entry); -+ -+ return esw_qos_is_node_empty(node); -+} -+ - static int - mlx5_esw_qos_node_validate_set_parent(struct mlx5_esw_sched_node *node, - struct mlx5_esw_sched_node *parent, -@@ -1729,13 +1960,26 @@ mlx5_esw_qos_node_validate_set_parent(struct mlx5_esw_sched_node *node, - return -EOPNOTSUPP; - } - -- if (!list_empty(&node->children)) { -+ if (!esw_qos_is_node_empty(node)) { - NL_SET_ERR_MSG_MOD(extack, - "Cannot reassign a node that contains rate objects"); - return -EOPNOTSUPP; - } - -+ if (parent && parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Cannot attach a node to a parent with TC bandwidth configured"); -+ return -EOPNOTSUPP; -+ } -+ - new_level = parent ? parent->level + 1 : 2; -+ if (node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ /* Increase by one to account for the vports TC scheduling -+ * element. -+ */ -+ new_level += 1; -+ } -+ - max_level = 1 << MLX5_CAP_QOS(node->esw->dev, log_esw_max_sched_depth); - if (new_level > max_level) { - NL_SET_ERR_MSG_MOD(extack, -@@ -1746,6 +1990,32 @@ mlx5_esw_qos_node_validate_set_parent(struct mlx5_esw_sched_node *node, - return 0; - } - -+static int -+esw_qos_tc_arbiter_node_update_parent(struct mlx5_esw_sched_node *node, -+ struct mlx5_esw_sched_node *parent, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_esw_sched_node *curr_parent = node->parent; -+ u32 curr_tc_bw[DEVLINK_RATE_TCS_MAX] = {0}; -+ struct mlx5_eswitch *esw = node->esw; -+ int err; -+ -+ esw_qos_tc_arbiter_get_bw_shares(node, curr_tc_bw); -+ esw_qos_tc_arbiter_scheduling_teardown(node, extack); -+ esw_qos_node_set_parent(node, parent); -+ err = esw_qos_tc_arbiter_scheduling_setup(node, extack); -+ if (err) { -+ esw_qos_node_set_parent(node, curr_parent); -+ if (esw_qos_tc_arbiter_scheduling_setup(node, extack)) { -+ esw_warn(esw->dev, "Node restore QoS failed\n"); -+ return err; -+ } -+ } -+ esw_qos_set_tc_arbiter_bw_shares(node, curr_tc_bw, extack); -+ -+ return err; -+} -+ - static int esw_qos_vports_node_update_parent(struct mlx5_esw_sched_node *node, - struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) -@@ -1792,7 +2062,13 @@ static int mlx5_esw_qos_node_update_parent(struct mlx5_esw_sched_node *node, - - esw_qos_lock(esw); - curr_parent = node->parent; -- err = esw_qos_vports_node_update_parent(node, parent, extack); -+ if (node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ err = esw_qos_tc_arbiter_node_update_parent(node, parent, -+ extack); -+ } else { -+ err = esw_qos_vports_node_update_parent(node, parent, extack); -+ } -+ - if (err) - goto out; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1422-net-mlx5-hws-remove-unused-create-dest-array-parameter.patch b/SOURCES/1422-net-mlx5-hws-remove-unused-create-dest-array-parameter.patch deleted file mode 100644 index 258d8b561..000000000 --- a/SOURCES/1422-net-mlx5-hws-remove-unused-create-dest-array-parameter.patch +++ /dev/null @@ -1,115 +0,0 @@ -From b46008ad0339b5ac38a1db24879b4e9304e368c1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: HWS, remove unused create_dest_array parameter - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 60afb51c89414b3d0061226415651f29a7eaf932 -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:22 2025 +0300 - - net/mlx5: HWS, remove unused create_dest_array parameter - - `flow_source` is not used anywhere in mlx5hws_action_create_dest_array. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Simon Horman - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250703185431.445571-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 447ea3f8722c..396804369b00 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1358,12 +1358,9 @@ mlx5hws_action_create_modify_header(struct mlx5hws_context *ctx, - } - - struct mlx5hws_action * --mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, -- size_t num_dest, -+mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest, - struct mlx5hws_action_dest_attr *dests, -- bool ignore_flow_level, -- u32 flow_source, -- u32 flags) -+ bool ignore_flow_level, u32 flags) - { - struct mlx5hws_cmd_set_fte_dest *dest_list = NULL; - struct mlx5hws_cmd_ft_create_attr ft_attr = {0}; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index bf4643d0ce17..57592b92e24b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -571,14 +571,12 @@ static void mlx5_fs_put_dest_action_sampler(struct mlx5_fs_hws_context *fs_ctx, - static struct mlx5hws_action * - mlx5_fs_create_action_dest_array(struct mlx5hws_context *ctx, - struct mlx5hws_action_dest_attr *dests, -- u32 num_of_dests, bool ignore_flow_level, -- u32 flow_source) -+ u32 num_of_dests, bool ignore_flow_level) - { - u32 flags = MLX5HWS_ACTION_FLAG_HWS_FDB | MLX5HWS_ACTION_FLAG_SHARED; - - return mlx5hws_action_create_dest_array(ctx, num_of_dests, dests, -- ignore_flow_level, -- flow_source, flags); -+ ignore_flow_level, flags); - } - - static struct mlx5hws_action * -@@ -1015,7 +1013,6 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns, - } - (*ractions)[num_actions++].action = dest_actions->dest; - } else if (num_dest_actions > 1) { -- u32 flow_source = fte->act_dests.flow_context.flow_source; - bool ignore_flow_level; - - if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || -@@ -1025,10 +1022,10 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns, - } - ignore_flow_level = - !!(fte_action->flags & FLOW_ACT_IGNORE_FLOW_LEVEL); -- tmp_action = mlx5_fs_create_action_dest_array(ctx, dest_actions, -- num_dest_actions, -- ignore_flow_level, -- flow_source); -+ tmp_action = -+ mlx5_fs_create_action_dest_array(ctx, dest_actions, -+ num_dest_actions, -+ ignore_flow_level); - if (!tmp_action) { - err = -EOPNOTSUPP; - goto free_actions; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index d8ac6c196211..a1295a311b70 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -727,18 +727,14 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags); - * @dests: The destination array. Each contains a destination action and can - * have additional actions. - * @ignore_flow_level: Whether to turn on 'ignore_flow_level' for this dest. -- * @flow_source: Source port of the traffic for this actions. - * @flags: Action creation flags (enum mlx5hws_action_flags). - * - * Return: pointer to mlx5hws_action on success NULL otherwise. - */ - struct mlx5hws_action * --mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, -- size_t num_dest, -+mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest, - struct mlx5hws_action_dest_attr *dests, -- bool ignore_flow_level, -- u32 flow_source, -- u32 flags); -+ bool ignore_flow_level, u32 flags); - - /** - * mlx5hws_action_create_insert_header - Create insert header action. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1423-net-mlx5-hws-remove-incorrect-comment.patch b/SOURCES/1423-net-mlx5-hws-remove-incorrect-comment.patch deleted file mode 100644 index f03117416..000000000 --- a/SOURCES/1423-net-mlx5-hws-remove-incorrect-comment.patch +++ /dev/null @@ -1,41 +0,0 @@ -From f894d6ec31f57af4bcee260cb6ec1df09596a8df Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:19 -0400 -Subject: [PATCH] net/mlx5: HWS, remove incorrect comment - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 26b06579d50d5f0462c45b63291b90ea85664237 -Author: Yevgeny Kliteynik -Date: Thu Jul 3 21:54:23 2025 +0300 - - net/mlx5: HWS, remove incorrect comment - - Removing incorrect comment section that is probably some - copy-paste artifact. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Reviewed-by: Simon Horman - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250703185431.445571-3-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 9e057f808ea5..665e6e285db5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -876,8 +876,6 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - - /* At this point the rule wasn't added. - * It could be because there was collision, or some other problem. -- * If we don't dive deeper than API, the only thing we know is that -- * the status of completion is RTE_FLOW_OP_ERROR. - * Try rehash by size and insert rule again - last chance. - */ - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1424-net-mlx5-hws-export-rule-skip-logic.patch b/SOURCES/1424-net-mlx5-hws-export-rule-skip-logic.patch deleted file mode 100644 index 4eefa950f..000000000 --- a/SOURCES/1424-net-mlx5-hws-export-rule-skip-logic.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 67fe87adf964e4b80fc63dbdebc34853c49aae5e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Export rule skip logic - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d8e7ab591b506b56dc96021674938d0c7905e656 -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:24 2025 +0300 - - net/mlx5: HWS, Export rule skip logic - - The bwc layer will use `mlx5hws_rule_skip` to keep track of numbers of - RX and TX rules individually, so export this function for future usage. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -index 5342a4cc7194..4883e4e1d251 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -@@ -3,10 +3,8 @@ - - #include "internal.h" - --static void hws_rule_skip(struct mlx5hws_matcher *matcher, -- struct mlx5hws_match_template *mt, -- u32 flow_source, -- bool *skip_rx, bool *skip_tx) -+void mlx5hws_rule_skip(struct mlx5hws_matcher *matcher, u32 flow_source, -+ bool *skip_rx, bool *skip_tx) - { - /* By default FDB rules are added to both RX and TX */ - *skip_rx = false; -@@ -66,7 +64,8 @@ static void hws_rule_init_dep_wqe(struct mlx5hws_send_ring_dep_wqe *dep_wqe, - attr->rule_idx : 0; - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -- hws_rule_skip(matcher, mt, attr->flow_source, &skip_rx, &skip_tx); -+ mlx5hws_rule_skip(matcher, attr->flow_source, -+ &skip_rx, &skip_tx); - - if (!skip_rx) { - dep_wqe->rtc_0 = matcher->match_ste.rtc_0_id; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -index 1c47a9c11572..d0f082b8dbf5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.h -@@ -69,6 +69,9 @@ struct mlx5hws_rule { - */ - }; - -+void mlx5hws_rule_skip(struct mlx5hws_matcher *matcher, u32 flow_source, -+ bool *skip_rx, bool *skip_tx); -+ - void mlx5hws_rule_free_action_ste(struct mlx5hws_action_ste_chunk *action_ste); - - int mlx5hws_rule_move_hws_remove(struct mlx5hws_rule *rule, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1425-net-mlx5-hws-refactor-rule-skip-logic.patch b/SOURCES/1425-net-mlx5-hws-refactor-rule-skip-logic.patch deleted file mode 100644 index 1c76c607a..000000000 --- a/SOURCES/1425-net-mlx5-hws-refactor-rule-skip-logic.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 25f4e39ec27d87699dc411f887d1b118c76f99b8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Refactor rule skip logic - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3dcac700d20b9e426386d7f59f1601db038fbf1c -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:25 2025 +0300 - - net/mlx5: HWS, Refactor rule skip logic - - Reduce nesting by adding a couple of early return statements. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -index 4883e4e1d251..a94f094e72ba 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c -@@ -12,20 +12,21 @@ void mlx5hws_rule_skip(struct mlx5hws_matcher *matcher, u32 flow_source, - - if (flow_source == MLX5_FLOW_CONTEXT_FLOW_SOURCE_LOCAL_VPORT) { - *skip_rx = true; -- } else if (flow_source == MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK) { -+ return; -+ } -+ -+ if (flow_source == MLX5_FLOW_CONTEXT_FLOW_SOURCE_UPLINK) { - *skip_tx = true; -- } else { -- /* If no flow source was set for current rule, -- * check for flow source in matcher attributes. -- */ -- if (matcher->attr.optimize_flow_src) { -- *skip_tx = -- matcher->attr.optimize_flow_src == MLX5HWS_MATCHER_FLOW_SRC_WIRE; -- *skip_rx = -- matcher->attr.optimize_flow_src == MLX5HWS_MATCHER_FLOW_SRC_VPORT; -- return; -- } -+ return; - } -+ -+ /* If no flow source was set for current rule, -+ * check for flow source in matcher attributes. -+ */ -+ *skip_tx = matcher->attr.optimize_flow_src == -+ MLX5HWS_MATCHER_FLOW_SRC_WIRE; -+ *skip_rx = matcher->attr.optimize_flow_src == -+ MLX5HWS_MATCHER_FLOW_SRC_VPORT; - } - - static void --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1426-net-mlx5-hws-create-stes-directly-from-matcher.patch b/SOURCES/1426-net-mlx5-hws-create-stes-directly-from-matcher.patch deleted file mode 100644 index b182aa9a6..000000000 --- a/SOURCES/1426-net-mlx5-hws-create-stes-directly-from-matcher.patch +++ /dev/null @@ -1,201 +0,0 @@ -From b1464c79682d1805a33f13c4bb4448ef2ef54697 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Create STEs directly from matcher - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 59807d071724f4e639fa9ebf841b12fb97e5dbf2 -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:26 2025 +0300 - - net/mlx5: HWS, Create STEs directly from matcher - - Matchers were using the pool abstraction solely as a convenience - to allocate two STE ranges. The pool's core functionality, that - of allocating individual items from the range, was unused. - Matchers rely either on the hardware to hash rules into a table, - or on a user-provided index. - - Remove the STE pool from the matcher and allocate the STE ranges - manually instead. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Simon Horman - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250703185431.445571-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -index 91568d6c1dac..f9b75aefcaa7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -@@ -118,7 +118,6 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - { - enum mlx5hws_table_type tbl_type = matcher->tbl->type; - struct mlx5hws_cmd_ft_query_attr ft_attr = {0}; -- struct mlx5hws_pool *ste_pool; - u64 icm_addr_0 = 0; - u64 icm_addr_1 = 0; - u32 ste_0_id = -1; -@@ -133,12 +132,9 @@ static int hws_debug_dump_matcher(struct seq_file *f, struct mlx5hws_matcher *ma - matcher->end_ft_id, - matcher->col_matcher ? HWS_PTR_TO_ID(matcher->col_matcher) : 0); - -- ste_pool = matcher->match_ste.pool; -- if (ste_pool) { -- ste_0_id = mlx5hws_pool_get_base_id(ste_pool); -- if (tbl_type == MLX5HWS_TABLE_TYPE_FDB) -- ste_1_id = mlx5hws_pool_get_base_mirror_id(ste_pool); -- } -+ ste_0_id = matcher->match_ste.ste_0_base; -+ if (tbl_type == MLX5HWS_TABLE_TYPE_FDB) -+ ste_1_id = matcher->match_ste.ste_1_base; - - seq_printf(f, ",%d,%d,%d,%d", - matcher->match_ste.rtc_0_id, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index ce28ee1c0e41..b0fcaf508e06 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -507,10 +507,8 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher) - } - } - -- obj_id = mlx5hws_pool_get_base_id(matcher->match_ste.pool); -- - rtc_attr.pd = ctx->pd_num; -- rtc_attr.ste_base = obj_id; -+ rtc_attr.ste_base = matcher->match_ste.ste_0_base; - rtc_attr.reparse_mode = mlx5hws_context_get_reparse_mode(ctx); - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, false); - hws_matcher_set_rtc_attr_sz(matcher, &rtc_attr, false); -@@ -527,9 +525,7 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher) - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -- obj_id = mlx5hws_pool_get_base_mirror_id( -- matcher->match_ste.pool); -- rtc_attr.ste_base = obj_id; -+ rtc_attr.ste_base = matcher->match_ste.ste_1_base; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, true); - - obj_id = mlx5hws_pool_get_base_mirror_id(ctx->stc_pool); -@@ -588,21 +584,6 @@ hws_matcher_check_attr_sz(struct mlx5hws_cmd_query_caps *caps, - return 0; - } - --static void hws_matcher_set_pool_attr(struct mlx5hws_pool_attr *attr, -- struct mlx5hws_matcher *matcher) --{ -- switch (matcher->attr.optimize_flow_src) { -- case MLX5HWS_MATCHER_FLOW_SRC_VPORT: -- attr->opt_type = MLX5HWS_POOL_OPTIMIZE_ORIG; -- break; -- case MLX5HWS_MATCHER_FLOW_SRC_WIRE: -- attr->opt_type = MLX5HWS_POOL_OPTIMIZE_MIRROR; -- break; -- default: -- break; -- } --} -- - static int hws_matcher_check_and_process_at(struct mlx5hws_matcher *matcher, - struct mlx5hws_action_template *at) - { -@@ -683,8 +664,8 @@ static void hws_matcher_set_ip_version_match(struct mlx5hws_matcher *matcher) - - static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - { -+ struct mlx5hws_cmd_ste_create_attr ste_attr = {}; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -- struct mlx5hws_pool_attr pool_attr = {0}; - int ret; - - /* Calculate match, range and hash definers */ -@@ -699,22 +680,39 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - - hws_matcher_set_ip_version_match(matcher); - -- /* Create an STE pool per matcher*/ -- pool_attr.table_type = matcher->tbl->type; -- pool_attr.pool_type = MLX5HWS_POOL_TYPE_STE; -- pool_attr.alloc_log_sz = matcher->attr.table.sz_col_log + -- matcher->attr.table.sz_row_log; -- hws_matcher_set_pool_attr(&pool_attr, matcher); -- -- matcher->match_ste.pool = mlx5hws_pool_create(ctx, &pool_attr); -- if (!matcher->match_ste.pool) { -- mlx5hws_err(ctx, "Failed to allocate matcher STE pool\n"); -- ret = -EOPNOTSUPP; -+ /* Create an STE range each for RX and TX. */ -+ ste_attr.table_type = FS_FT_FDB_RX; -+ ste_attr.log_obj_range = -+ matcher->attr.optimize_flow_src == -+ MLX5HWS_MATCHER_FLOW_SRC_VPORT ? -+ 0 : matcher->attr.table.sz_col_log + -+ matcher->attr.table.sz_row_log; -+ -+ ret = mlx5hws_cmd_ste_create(ctx->mdev, &ste_attr, -+ &matcher->match_ste.ste_0_base); -+ if (ret) { -+ mlx5hws_err(ctx, "Failed to allocate RX STE range (%d)\n", ret); - goto uninit_match_definer; - } - -+ ste_attr.table_type = FS_FT_FDB_TX; -+ ste_attr.log_obj_range = -+ matcher->attr.optimize_flow_src == -+ MLX5HWS_MATCHER_FLOW_SRC_WIRE ? -+ 0 : matcher->attr.table.sz_col_log + -+ matcher->attr.table.sz_row_log; -+ -+ ret = mlx5hws_cmd_ste_create(ctx->mdev, &ste_attr, -+ &matcher->match_ste.ste_1_base); -+ if (ret) { -+ mlx5hws_err(ctx, "Failed to allocate TX STE range (%d)\n", ret); -+ goto destroy_rx_ste_range; -+ } -+ - return 0; - -+destroy_rx_ste_range: -+ mlx5hws_cmd_ste_destroy(ctx->mdev, matcher->match_ste.ste_0_base); - uninit_match_definer: - if (!(matcher->flags & MLX5HWS_MATCHER_FLAGS_COLLISION)) - mlx5hws_definer_mt_uninit(ctx, matcher->mt); -@@ -723,9 +721,12 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - - static void hws_matcher_unbind_mt(struct mlx5hws_matcher *matcher) - { -- mlx5hws_pool_destroy(matcher->match_ste.pool); -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ -+ mlx5hws_cmd_ste_destroy(ctx->mdev, matcher->match_ste.ste_1_base); -+ mlx5hws_cmd_ste_destroy(ctx->mdev, matcher->match_ste.ste_0_base); - if (!(matcher->flags & MLX5HWS_MATCHER_FLAGS_COLLISION)) -- mlx5hws_definer_mt_uninit(matcher->tbl->ctx, matcher->mt); -+ mlx5hws_definer_mt_uninit(ctx, matcher->mt); - } - - static int -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -index 32e83cddcd60..ae20bcebfdde 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h -@@ -48,7 +48,8 @@ struct mlx5hws_match_template { - struct mlx5hws_matcher_match_ste { - u32 rtc_0_id; - u32 rtc_1_id; -- struct mlx5hws_pool *pool; -+ u32 ste_0_base; -+ u32 ste_1_base; - }; - - enum { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1427-net-mlx5-hws-decouple-matcher-rx-and-tx-sizes.patch b/SOURCES/1427-net-mlx5-hws-decouple-matcher-rx-and-tx-sizes.patch deleted file mode 100644 index f49866b1e..000000000 --- a/SOURCES/1427-net-mlx5-hws-decouple-matcher-rx-and-tx-sizes.patch +++ /dev/null @@ -1,362 +0,0 @@ -From 4c392e9f4c088dd99889101b5410690187003a43 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Decouple matcher RX and TX sizes - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c8332ce096913bc6624cdbd5276fa49dc92fa532 -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:27 2025 +0300 - - net/mlx5: HWS, Decouple matcher RX and TX sizes - - Kernel HWS only uses FDB tables and, as such, creates two lower level - containers (RTCs) for each matcher: one for RX and one for TX. Allow - these RTCs to differ in size by converting the size part of the matcher - attribute to a two element array. - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Reviewed-by: Simon Horman - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250703185431.445571-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 665e6e285db5..009641e6c874 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -48,7 +48,7 @@ static void hws_bwc_unlock_all_queues(struct mlx5hws_context *ctx) - - static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - u32 priority, -- u8 size_log, -+ u8 size_log_rx, u8 size_log_tx, - struct mlx5hws_matcher_attr *attr) - { - struct mlx5hws_bwc_matcher *first_matcher = -@@ -62,7 +62,8 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - attr->optimize_flow_src = MLX5HWS_MATCHER_FLOW_SRC_ANY; - attr->insert_mode = MLX5HWS_MATCHER_INSERT_BY_HASH; - attr->distribute_mode = MLX5HWS_MATCHER_DISTRIBUTE_BY_HASH; -- attr->rule.num_log = size_log; -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_RX].rule.num_log = size_log_rx; -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX].rule.num_log = size_log_tx; - attr->resizable = true; - attr->max_num_of_at_attach = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; - -@@ -93,6 +94,7 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - hws_bwc_matcher_init_attr(bwc_matcher, - priority, - MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG, -+ MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG, - &attr); - - bwc_matcher->priority = priority; -@@ -696,6 +698,7 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) - hws_bwc_matcher_init_attr(bwc_matcher, - bwc_matcher->priority, - bwc_matcher->size_log, -+ bwc_matcher->size_log, - &matcher_attr); - - old_matcher = bwc_matcher->matcher; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -index f9b75aefcaa7..2ec8cb10139a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/debug.c -@@ -99,17 +99,19 @@ hws_debug_dump_matcher_attr(struct seq_file *f, struct mlx5hws_matcher *matcher) - { - struct mlx5hws_matcher_attr *attr = &matcher->attr; - -- seq_printf(f, "%d,0x%llx,%d,%d,%d,%d,%d,%d,%d,%d\n", -+ seq_printf(f, "%d,0x%llx,%d,%d,%d,%d,%d,%d,%d,%d,-1,-1,%d,%d\n", - MLX5HWS_DEBUG_RES_TYPE_MATCHER_ATTR, - HWS_PTR_TO_ID(matcher), - attr->priority, - attr->mode, -- attr->table.sz_row_log, -- attr->table.sz_col_log, -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_RX].table.sz_row_log, -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_RX].table.sz_col_log, - attr->optimize_using_rule_idx, - attr->optimize_flow_src, - attr->insert_mode, -- attr->distribute_mode); -+ attr->distribute_mode, -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX].table.sz_row_log, -+ attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX].table.sz_col_log); - - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index b0fcaf508e06..f3ea09caba2b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -468,12 +468,16 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher) - struct mlx5hws_cmd_rtc_create_attr rtc_attr = {0}; - struct mlx5hws_match_template *mt = matcher->mt; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ union mlx5hws_matcher_size *size_rx, *size_tx; - struct mlx5hws_table *tbl = matcher->tbl; - u32 obj_id; - int ret; - -- rtc_attr.log_size = attr->table.sz_row_log; -- rtc_attr.log_depth = attr->table.sz_col_log; -+ size_rx = &attr->size[MLX5HWS_MATCHER_SIZE_TYPE_RX]; -+ size_tx = &attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX]; -+ -+ rtc_attr.log_size = size_rx->table.sz_row_log; -+ rtc_attr.log_depth = size_rx->table.sz_col_log; - rtc_attr.is_frst_jumbo = mlx5hws_matcher_mt_is_jumbo(mt); - rtc_attr.is_scnd_range = 0; - rtc_attr.miss_ft_id = matcher->end_ft_id; -@@ -525,6 +529,8 @@ static int hws_matcher_create_rtc(struct mlx5hws_matcher *matcher) - } - - if (tbl->type == MLX5HWS_TABLE_TYPE_FDB) { -+ rtc_attr.log_size = size_tx->table.sz_row_log; -+ rtc_attr.log_depth = size_tx->table.sz_col_log; - rtc_attr.ste_base = matcher->match_ste.ste_1_base; - rtc_attr.table_type = mlx5hws_table_get_res_fw_ft_type(tbl->type, true); - -@@ -562,23 +568,33 @@ hws_matcher_check_attr_sz(struct mlx5hws_cmd_query_caps *caps, - struct mlx5hws_matcher *matcher) - { - struct mlx5hws_matcher_attr *attr = &matcher->attr; -+ struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ union mlx5hws_matcher_size *size; -+ int i; - -- if (attr->table.sz_col_log > caps->rtc_log_depth_max) { -- mlx5hws_err(matcher->tbl->ctx, "Matcher depth exceeds limit %d\n", -- caps->rtc_log_depth_max); -- return -EOPNOTSUPP; -- } -+ for (i = 0; i < 2; i++) { -+ size = &attr->size[i]; - -- if (attr->table.sz_col_log + attr->table.sz_row_log > caps->ste_alloc_log_max) { -- mlx5hws_err(matcher->tbl->ctx, "Total matcher size exceeds limit %d\n", -- caps->ste_alloc_log_max); -- return -EOPNOTSUPP; -- } -+ if (size->table.sz_col_log > caps->rtc_log_depth_max) { -+ mlx5hws_err(ctx, "Matcher depth exceeds limit %d\n", -+ caps->rtc_log_depth_max); -+ return -EOPNOTSUPP; -+ } - -- if (attr->table.sz_col_log + attr->table.sz_row_log < caps->ste_alloc_log_gran) { -- mlx5hws_err(matcher->tbl->ctx, "Total matcher size below limit %d\n", -- caps->ste_alloc_log_gran); -- return -EOPNOTSUPP; -+ if (size->table.sz_col_log + size->table.sz_row_log > -+ caps->ste_alloc_log_max) { -+ mlx5hws_err(ctx, -+ "Total matcher size exceeds limit %d\n", -+ caps->ste_alloc_log_max); -+ return -EOPNOTSUPP; -+ } -+ -+ if (size->table.sz_col_log + size->table.sz_row_log < -+ caps->ste_alloc_log_gran) { -+ mlx5hws_err(ctx, "Total matcher size below limit %d\n", -+ caps->ste_alloc_log_gran); -+ return -EOPNOTSUPP; -+ } - } - - return 0; -@@ -666,6 +682,7 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_cmd_ste_create_attr ste_attr = {}; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ union mlx5hws_matcher_size *size; - int ret; - - /* Calculate match, range and hash definers */ -@@ -682,11 +699,11 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - - /* Create an STE range each for RX and TX. */ - ste_attr.table_type = FS_FT_FDB_RX; -+ size = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_RX]; - ste_attr.log_obj_range = - matcher->attr.optimize_flow_src == -- MLX5HWS_MATCHER_FLOW_SRC_VPORT ? -- 0 : matcher->attr.table.sz_col_log + -- matcher->attr.table.sz_row_log; -+ MLX5HWS_MATCHER_FLOW_SRC_VPORT ? -+ 0 : size->table.sz_col_log + size->table.sz_row_log; - - ret = mlx5hws_cmd_ste_create(ctx->mdev, &ste_attr, - &matcher->match_ste.ste_0_base); -@@ -696,11 +713,11 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) - } - - ste_attr.table_type = FS_FT_FDB_TX; -+ size = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_TX]; - ste_attr.log_obj_range = - matcher->attr.optimize_flow_src == -- MLX5HWS_MATCHER_FLOW_SRC_WIRE ? -- 0 : matcher->attr.table.sz_col_log + -- matcher->attr.table.sz_row_log; -+ MLX5HWS_MATCHER_FLOW_SRC_WIRE ? -+ 0 : size->table.sz_col_log + size->table.sz_row_log; - - ret = mlx5hws_cmd_ste_create(ctx->mdev, &ste_attr, - &matcher->match_ste.ste_1_base); -@@ -735,6 +752,10 @@ hws_matcher_validate_insert_mode(struct mlx5hws_cmd_query_caps *caps, - { - struct mlx5hws_matcher_attr *attr = &matcher->attr; - struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ union mlx5hws_matcher_size *size_rx, *size_tx; -+ -+ size_rx = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_RX]; -+ size_tx = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_TX]; - - switch (attr->insert_mode) { - case MLX5HWS_MATCHER_INSERT_BY_HASH: -@@ -745,7 +766,7 @@ hws_matcher_validate_insert_mode(struct mlx5hws_cmd_query_caps *caps, - break; - - case MLX5HWS_MATCHER_INSERT_BY_INDEX: -- if (attr->table.sz_col_log) { -+ if (size_rx->table.sz_col_log || size_tx->table.sz_col_log) { - mlx5hws_err(ctx, "Matcher with INSERT_BY_INDEX supports only Nx1 table size\n"); - return -EOPNOTSUPP; - } -@@ -765,7 +786,10 @@ hws_matcher_validate_insert_mode(struct mlx5hws_cmd_query_caps *caps, - return -EOPNOTSUPP; - } - -- if (attr->table.sz_row_log > MLX5_IFC_RTC_LINEAR_LOOKUP_TBL_LOG_MAX) { -+ if (size_rx->table.sz_row_log > -+ MLX5_IFC_RTC_LINEAR_LOOKUP_TBL_LOG_MAX || -+ size_tx->table.sz_row_log > -+ MLX5_IFC_RTC_LINEAR_LOOKUP_TBL_LOG_MAX) { - mlx5hws_err(ctx, "Matcher with linear distribute: rows exceed limit %d", - MLX5_IFC_RTC_LINEAR_LOOKUP_TBL_LOG_MAX); - return -EOPNOTSUPP; -@@ -789,6 +813,10 @@ hws_matcher_process_attr(struct mlx5hws_cmd_query_caps *caps, - struct mlx5hws_matcher *matcher) - { - struct mlx5hws_matcher_attr *attr = &matcher->attr; -+ union mlx5hws_matcher_size *size_rx, *size_tx; -+ -+ size_rx = &attr->size[MLX5HWS_MATCHER_SIZE_TYPE_RX]; -+ size_tx = &attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX]; - - if (hws_matcher_validate_insert_mode(caps, matcher)) - return -EOPNOTSUPP; -@@ -800,8 +828,12 @@ hws_matcher_process_attr(struct mlx5hws_cmd_query_caps *caps, - - /* Convert number of rules to the required depth */ - if (attr->mode == MLX5HWS_MATCHER_RESOURCE_MODE_RULE && -- attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_HASH) -- attr->table.sz_col_log = hws_matcher_rules_to_tbl_depth(attr->rule.num_log); -+ attr->insert_mode == MLX5HWS_MATCHER_INSERT_BY_HASH) { -+ size_rx->table.sz_col_log = -+ hws_matcher_rules_to_tbl_depth(size_rx->rule.num_log); -+ size_tx->table.sz_col_log = -+ hws_matcher_rules_to_tbl_depth(size_tx->rule.num_log); -+ } - - matcher->flags |= attr->resizable ? MLX5HWS_MATCHER_FLAGS_RESIZABLE : 0; - matcher->flags |= attr->isolated_matcher_end_ft_id ? -@@ -862,14 +894,19 @@ static int - hws_matcher_create_col_matcher(struct mlx5hws_matcher *matcher) - { - struct mlx5hws_context *ctx = matcher->tbl->ctx; -+ union mlx5hws_matcher_size *size_rx, *size_tx; - struct mlx5hws_matcher *col_matcher; -- int ret; -+ int i, ret; -+ -+ size_rx = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_RX]; -+ size_tx = &matcher->attr.size[MLX5HWS_MATCHER_SIZE_TYPE_TX]; - - if (matcher->attr.mode != MLX5HWS_MATCHER_RESOURCE_MODE_RULE || - matcher->attr.insert_mode == MLX5HWS_MATCHER_INSERT_BY_INDEX) - return 0; - -- if (!hws_matcher_requires_col_tbl(matcher->attr.rule.num_log)) -+ if (!hws_matcher_requires_col_tbl(size_rx->rule.num_log) && -+ !hws_matcher_requires_col_tbl(size_tx->rule.num_log)) - return 0; - - col_matcher = kzalloc(sizeof(*matcher), GFP_KERNEL); -@@ -886,10 +923,16 @@ hws_matcher_create_col_matcher(struct mlx5hws_matcher *matcher) - col_matcher->flags |= MLX5HWS_MATCHER_FLAGS_COLLISION; - col_matcher->attr.mode = MLX5HWS_MATCHER_RESOURCE_MODE_HTABLE; - col_matcher->attr.optimize_flow_src = matcher->attr.optimize_flow_src; -- col_matcher->attr.table.sz_row_log = matcher->attr.rule.num_log; -- col_matcher->attr.table.sz_col_log = MLX5HWS_MATCHER_ASSURED_COL_TBL_DEPTH; -- if (col_matcher->attr.table.sz_row_log > MLX5HWS_MATCHER_ASSURED_ROW_RATIO) -- col_matcher->attr.table.sz_row_log -= MLX5HWS_MATCHER_ASSURED_ROW_RATIO; -+ for (i = 0; i < 2; i++) { -+ union mlx5hws_matcher_size *dst = &col_matcher->attr.size[i]; -+ union mlx5hws_matcher_size *src = &matcher->attr.size[i]; -+ -+ dst->table.sz_row_log = src->rule.num_log; -+ dst->table.sz_col_log = MLX5HWS_MATCHER_ASSURED_COL_TBL_DEPTH; -+ if (dst->table.sz_row_log > MLX5HWS_MATCHER_ASSURED_ROW_RATIO) -+ dst->table.sz_row_log -= -+ MLX5HWS_MATCHER_ASSURED_ROW_RATIO; -+ } - - col_matcher->attr.max_num_of_at_attach = matcher->attr.max_num_of_at_attach; - col_matcher->attr.isolated_matcher_end_ft_id = -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index a1295a311b70..59c14745ed0c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -93,6 +93,23 @@ enum mlx5hws_matcher_distribute_mode { - MLX5HWS_MATCHER_DISTRIBUTE_BY_LINEAR = 0x1, - }; - -+enum mlx5hws_matcher_size_type { -+ MLX5HWS_MATCHER_SIZE_TYPE_RX, -+ MLX5HWS_MATCHER_SIZE_TYPE_TX, -+ MLX5HWS_MATCHER_SIZE_TYPE_MAX, -+}; -+ -+union mlx5hws_matcher_size { -+ struct { -+ u8 sz_row_log; -+ u8 sz_col_log; -+ } table; -+ -+ struct { -+ u8 num_log; -+ } rule; -+}; -+ - struct mlx5hws_matcher_attr { - /* Processing priority inside table */ - u32 priority; -@@ -107,16 +124,7 @@ struct mlx5hws_matcher_attr { - enum mlx5hws_matcher_distribute_mode distribute_mode; - /* Define whether the created matcher supports resizing into a bigger matcher */ - bool resizable; -- union { -- struct { -- u8 sz_row_log; -- u8 sz_col_log; -- } table; -- -- struct { -- u8 num_log; -- } rule; -- }; -+ union mlx5hws_matcher_size size[MLX5HWS_MATCHER_SIZE_TYPE_MAX]; - /* Optional AT attach configuration - Max number of additional AT */ - u8 max_num_of_at_attach; - /* Optional end FT (miss FT ID) for match RTC (for isolated matcher) */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1428-net-mlx5-hws-track-matcher-sizes-individually.patch b/SOURCES/1428-net-mlx5-hws-track-matcher-sizes-individually.patch deleted file mode 100644 index 1bf60aef5..000000000 --- a/SOURCES/1428-net-mlx5-hws-track-matcher-sizes-individually.patch +++ /dev/null @@ -1,472 +0,0 @@ -From 913991117a976a1753529cf7bc98f969cf0f7b91 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Track matcher sizes individually - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6b44fffdc7b792e1d32b104c76504c3722e9704f -Author: Vlad Dogaru -Date: Thu Jul 3 21:54:28 2025 +0300 - - net/mlx5: HWS, Track matcher sizes individually - - Track and grow matcher sizes individually for RX and TX RTCs. This - allows RX-only or TX-only use cases to effectively halve the device - resources they use. - - For testing we used a simple module that inserts 1M RX-only rules and - measured the number of pages the device requests, and memory usage as - reported by `free -h`. - - Pages Memory - Before this patch: 300k 1.5GiB - After this patch: 160k 900MiB - - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 009641e6c874..516634237cb8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -93,12 +93,11 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - - hws_bwc_matcher_init_attr(bwc_matcher, - priority, -- MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG, -- MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG, -+ bwc_matcher->rx_size.size_log, -+ bwc_matcher->tx_size.size_log, - &attr); - - bwc_matcher->priority = priority; -- bwc_matcher->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; - - bwc_matcher->size_of_at_array = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; - bwc_matcher->at = kcalloc(bwc_matcher->size_of_at_array, -@@ -150,6 +149,20 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - return -EINVAL; - } - -+static void -+hws_bwc_matcher_init_size_rxtx(struct mlx5hws_bwc_matcher_size *size) -+{ -+ size->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; -+ atomic_set(&size->num_of_rules, 0); -+ atomic_set(&size->rehash_required, false); -+} -+ -+static void hws_bwc_matcher_init_size(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ hws_bwc_matcher_init_size_rxtx(&bwc_matcher->rx_size); -+ hws_bwc_matcher_init_size_rxtx(&bwc_matcher->tx_size); -+} -+ - struct mlx5hws_bwc_matcher * - mlx5hws_bwc_matcher_create(struct mlx5hws_table *table, - u32 priority, -@@ -170,8 +183,7 @@ mlx5hws_bwc_matcher_create(struct mlx5hws_table *table, - if (!bwc_matcher) - return NULL; - -- atomic_set(&bwc_matcher->num_of_rules, 0); -- atomic_set(&bwc_matcher->rehash_required, false); -+ hws_bwc_matcher_init_size(bwc_matcher); - - /* Check if the required match params can be all matched - * in single STE, otherwise complex matcher is needed. -@@ -221,12 +233,13 @@ int mlx5hws_bwc_matcher_destroy_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - - int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- u32 num_of_rules = atomic_read(&bwc_matcher->num_of_rules); -+ u32 rx_rules = atomic_read(&bwc_matcher->rx_size.num_of_rules); -+ u32 tx_rules = atomic_read(&bwc_matcher->tx_size.num_of_rules); - -- if (num_of_rules) -+ if (rx_rules || tx_rules) - mlx5hws_err(bwc_matcher->matcher->tbl->ctx, -- "BWC matcher destroy: matcher still has %d rules\n", -- num_of_rules); -+ "BWC matcher destroy: matcher still has %u RX and %u TX rules\n", -+ rx_rules, tx_rules); - - if (bwc_matcher->complex) - mlx5hws_bwc_matcher_destroy_complex(bwc_matcher); -@@ -386,6 +399,16 @@ hws_bwc_rule_destroy_hws_sync(struct mlx5hws_bwc_rule *bwc_rule, - return 0; - } - -+static void hws_bwc_rule_cnt_dec(struct mlx5hws_bwc_rule *bwc_rule) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ -+ if (!bwc_rule->skip_rx) -+ atomic_dec(&bwc_matcher->rx_size.num_of_rules); -+ if (!bwc_rule->skip_tx) -+ atomic_dec(&bwc_matcher->tx_size.num_of_rules); -+} -+ - int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - { - struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -@@ -402,7 +425,7 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - mutex_lock(queue_lock); - - ret = hws_bwc_rule_destroy_hws_sync(bwc_rule, &attr); -- atomic_dec(&bwc_matcher->num_of_rules); -+ hws_bwc_rule_cnt_dec(bwc_rule); - hws_bwc_rule_list_remove(bwc_rule); - - mutex_unlock(queue_lock); -@@ -489,25 +512,27 @@ hws_bwc_rule_update_sync(struct mlx5hws_bwc_rule *bwc_rule, - } - - static bool --hws_bwc_matcher_size_maxed_out(struct mlx5hws_bwc_matcher *bwc_matcher) -+hws_bwc_matcher_size_maxed_out(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_bwc_matcher_size *size) - { - struct mlx5hws_cmd_query_caps *caps = bwc_matcher->matcher->tbl->ctx->caps; - - /* check the match RTC size */ -- return (bwc_matcher->size_log + MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH + -+ return (size->size_log + MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH + - MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP) > - (caps->ste_alloc_log_max - 1); - } - - static bool - hws_bwc_matcher_rehash_size_needed(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_bwc_matcher_size *size, - u32 num_of_rules) - { -- if (unlikely(hws_bwc_matcher_size_maxed_out(bwc_matcher))) -+ if (unlikely(hws_bwc_matcher_size_maxed_out(bwc_matcher, size))) - return false; - - if (unlikely((num_of_rules * 100 / MLX5HWS_BWC_MATCHER_REHASH_PERCENT_TH) >= -- (1UL << bwc_matcher->size_log))) -+ (1UL << size->size_log))) - return true; - - return false; -@@ -564,20 +589,21 @@ hws_bwc_matcher_extend_at(struct mlx5hws_bwc_matcher *bwc_matcher, - } - - static int --hws_bwc_matcher_extend_size(struct mlx5hws_bwc_matcher *bwc_matcher) -+hws_bwc_matcher_extend_size(struct mlx5hws_bwc_matcher *bwc_matcher, -+ struct mlx5hws_bwc_matcher_size *size) - { - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_cmd_query_caps *caps = ctx->caps; - -- if (unlikely(hws_bwc_matcher_size_maxed_out(bwc_matcher))) { -+ if (unlikely(hws_bwc_matcher_size_maxed_out(bwc_matcher, size))) { - mlx5hws_err(ctx, "Can't resize matcher: depth exceeds limit %d\n", - caps->rtc_log_depth_max); - return -ENOMEM; - } - -- bwc_matcher->size_log = -- min(bwc_matcher->size_log + MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP, -- caps->ste_alloc_log_max - MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH); -+ size->size_log = min(size->size_log + MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP, -+ caps->ste_alloc_log_max - -+ MLX5HWS_MATCHER_ASSURED_MAIN_TBL_DEPTH); - - return 0; - } -@@ -697,8 +723,8 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) - - hws_bwc_matcher_init_attr(bwc_matcher, - bwc_matcher->priority, -- bwc_matcher->size_log, -- bwc_matcher->size_log, -+ bwc_matcher->rx_size.size_log, -+ bwc_matcher->tx_size.size_log, - &matcher_attr); - - old_matcher = bwc_matcher->matcher; -@@ -736,21 +762,39 @@ static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) - static int - hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - { -+ bool need_rx_rehash, need_tx_rehash; - int ret; - -- /* If the current matcher size is already at its max size, we can't -- * do the rehash. Skip it and try adding the rule again - perhaps -- * there was some change. -+ need_rx_rehash = atomic_read(&bwc_matcher->rx_size.rehash_required); -+ need_tx_rehash = atomic_read(&bwc_matcher->tx_size.rehash_required); -+ -+ /* It is possible that another rule has already performed rehash. -+ * Need to check again if we really need rehash. - */ -- if (hws_bwc_matcher_size_maxed_out(bwc_matcher)) -+ if (!need_rx_rehash && !need_tx_rehash) - return 0; - -- /* It is possible that other rule has already performed rehash. -- * Need to check again if we really need rehash. -+ /* If the current matcher RX/TX size is already at its max size, -+ * it can't be rehashed. - */ -- if (!atomic_read(&bwc_matcher->rehash_required) && -- !hws_bwc_matcher_rehash_size_needed(bwc_matcher, -- atomic_read(&bwc_matcher->num_of_rules))) -+ if (need_rx_rehash && -+ hws_bwc_matcher_size_maxed_out(bwc_matcher, -+ &bwc_matcher->rx_size)) { -+ atomic_set(&bwc_matcher->rx_size.rehash_required, false); -+ need_rx_rehash = false; -+ } -+ if (need_tx_rehash && -+ hws_bwc_matcher_size_maxed_out(bwc_matcher, -+ &bwc_matcher->tx_size)) { -+ atomic_set(&bwc_matcher->tx_size.rehash_required, false); -+ need_tx_rehash = false; -+ } -+ -+ /* If both RX and TX rehash flags are now off, it means that whatever -+ * we wanted to rehash is now at its max size - no rehash can be done. -+ * Return and try adding the rule again - perhaps there was some change. -+ */ -+ if (!need_rx_rehash && !need_tx_rehash) - return 0; - - /* Now we're done all the checking - do the rehash: -@@ -759,12 +803,22 @@ hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - * - move all the rules to the new matcher - * - destroy the old matcher - */ -+ atomic_set(&bwc_matcher->rx_size.rehash_required, false); -+ atomic_set(&bwc_matcher->tx_size.rehash_required, false); - -- atomic_set(&bwc_matcher->rehash_required, false); -+ if (need_rx_rehash) { -+ ret = hws_bwc_matcher_extend_size(bwc_matcher, -+ &bwc_matcher->rx_size); -+ if (ret) -+ return ret; -+ } - -- ret = hws_bwc_matcher_extend_size(bwc_matcher); -- if (ret) -- return ret; -+ if (need_tx_rehash) { -+ ret = hws_bwc_matcher_extend_size(bwc_matcher, -+ &bwc_matcher->tx_size); -+ if (ret) -+ return ret; -+ } - - return hws_bwc_matcher_move(bwc_matcher); - } -@@ -816,6 +870,62 @@ static int hws_bwc_rule_get_at_idx(struct mlx5hws_bwc_rule *bwc_rule, - return at_idx; - } - -+static void hws_bwc_rule_cnt_inc_rxtx(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_bwc_matcher_size *size) -+{ -+ u32 num_of_rules = atomic_inc_return(&size->num_of_rules); -+ -+ if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_rule->bwc_matcher, -+ size, num_of_rules))) -+ atomic_set(&size->rehash_required, true); -+} -+ -+static void hws_bwc_rule_cnt_inc(struct mlx5hws_bwc_rule *bwc_rule) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ -+ if (!bwc_rule->skip_rx) -+ hws_bwc_rule_cnt_inc_rxtx(bwc_rule, &bwc_matcher->rx_size); -+ if (!bwc_rule->skip_tx) -+ hws_bwc_rule_cnt_inc_rxtx(bwc_rule, &bwc_matcher->tx_size); -+} -+ -+static int hws_bwc_rule_cnt_inc_with_rehash(struct mlx5hws_bwc_rule *bwc_rule, -+ u16 bwc_queue_idx) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mutex *queue_lock; /* Protect the queue */ -+ int ret; -+ -+ hws_bwc_rule_cnt_inc(bwc_rule); -+ -+ if (!atomic_read(&bwc_matcher->rx_size.rehash_required) && -+ !atomic_read(&bwc_matcher->tx_size.rehash_required)) -+ return 0; -+ -+ queue_lock = hws_bwc_get_queue_lock(ctx, bwc_queue_idx); -+ mutex_unlock(queue_lock); -+ -+ hws_bwc_lock_all_queues(ctx); -+ ret = hws_bwc_matcher_rehash_size(bwc_matcher); -+ hws_bwc_unlock_all_queues(ctx); -+ -+ mutex_lock(queue_lock); -+ -+ if (likely(!ret)) -+ return 0; -+ -+ /* Failed to rehash. Print a diagnostic and rollback the counters. */ -+ mlx5hws_err(ctx, -+ "BWC rule insertion: rehash to sizes [%d, %d] failed (%d)\n", -+ bwc_matcher->rx_size.size_log, -+ bwc_matcher->tx_size.size_log, ret); -+ hws_bwc_rule_cnt_dec(bwc_rule); -+ -+ return ret; -+} -+ - int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - u32 *match_param, - struct mlx5hws_rule_action rule_actions[], -@@ -826,7 +936,6 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_rule_attr rule_attr; - struct mutex *queue_lock; /* Protect the queue */ -- u32 num_of_rules; - int ret = 0; - int at_idx; - -@@ -844,26 +953,10 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - return -EINVAL; - } - -- /* check if number of rules require rehash */ -- num_of_rules = atomic_inc_return(&bwc_matcher->num_of_rules); -- -- if (unlikely(hws_bwc_matcher_rehash_size_needed(bwc_matcher, num_of_rules))) { -+ ret = hws_bwc_rule_cnt_inc_with_rehash(bwc_rule, bwc_queue_idx); -+ if (unlikely(ret)) { - mutex_unlock(queue_lock); -- -- hws_bwc_lock_all_queues(ctx); -- ret = hws_bwc_matcher_rehash_size(bwc_matcher); -- hws_bwc_unlock_all_queues(ctx); -- -- if (ret) { -- mlx5hws_err(ctx, "BWC rule insertion: rehash size [%d -> %d] failed (%d)\n", -- bwc_matcher->size_log - MLX5HWS_BWC_MATCHER_SIZE_LOG_STEP, -- bwc_matcher->size_log, -- ret); -- atomic_dec(&bwc_matcher->num_of_rules); -- return ret; -- } -- -- mutex_lock(queue_lock); -+ return ret; - } - - ret = hws_bwc_rule_create_sync(bwc_rule, -@@ -881,8 +974,11 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - * It could be because there was collision, or some other problem. - * Try rehash by size and insert rule again - last chance. - */ -+ if (!bwc_rule->skip_rx) -+ atomic_set(&bwc_matcher->rx_size.rehash_required, true); -+ if (!bwc_rule->skip_tx) -+ atomic_set(&bwc_matcher->tx_size.rehash_required, true); - -- atomic_set(&bwc_matcher->rehash_required, true); - mutex_unlock(queue_lock); - - hws_bwc_lock_all_queues(ctx); -@@ -891,7 +987,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - - if (ret) { - mlx5hws_err(ctx, "BWC rule insertion: rehash failed (%d)\n", ret); -- atomic_dec(&bwc_matcher->num_of_rules); -+ hws_bwc_rule_cnt_dec(bwc_rule); - return ret; - } - -@@ -907,7 +1003,7 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - if (unlikely(ret)) { - mutex_unlock(queue_lock); - mlx5hws_err(ctx, "BWC rule insertion failed (%d)\n", ret); -- atomic_dec(&bwc_matcher->num_of_rules); -+ hws_bwc_rule_cnt_dec(bwc_rule); - return ret; - } - -@@ -937,6 +1033,10 @@ mlx5hws_bwc_rule_create(struct mlx5hws_bwc_matcher *bwc_matcher, - if (unlikely(!bwc_rule)) - return NULL; - -+ bwc_rule->flow_source = flow_source; -+ mlx5hws_rule_skip(bwc_matcher->matcher, flow_source, -+ &bwc_rule->skip_rx, &bwc_rule->skip_tx); -+ - bwc_queue_idx = hws_bwc_gen_queue_idx(ctx); - - if (bwc_matcher->complex) -@@ -972,7 +1072,8 @@ hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - - idx = bwc_rule->bwc_queue_idx; - -- mlx5hws_bwc_rule_fill_attr(bwc_matcher, idx, 0, &rule_attr); -+ mlx5hws_bwc_rule_fill_attr(bwc_matcher, idx, bwc_rule->flow_source, -+ &rule_attr); - queue_lock = hws_bwc_get_queue_lock(ctx, idx); - - mutex_lock(queue_lock); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index d21fc247a510..af391d70c14f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -19,6 +19,13 @@ - #define MLX5HWS_BWC_POLLING_TIMEOUT 60 - - struct mlx5hws_bwc_matcher_complex_data; -+ -+struct mlx5hws_bwc_matcher_size { -+ u8 size_log; -+ atomic_t num_of_rules; -+ atomic_t rehash_required; -+}; -+ - struct mlx5hws_bwc_matcher { - struct mlx5hws_matcher *matcher; - struct mlx5hws_match_template *mt; -@@ -27,10 +34,9 @@ struct mlx5hws_bwc_matcher { - struct mlx5hws_bwc_matcher *complex_first_bwc_matcher; - u8 num_of_at; - u8 size_of_at_array; -- u8 size_log; - u32 priority; -- atomic_t num_of_rules; -- atomic_t rehash_required; -+ struct mlx5hws_bwc_matcher_size rx_size; -+ struct mlx5hws_bwc_matcher_size tx_size; - struct list_head *rules; - }; - -@@ -39,7 +45,10 @@ struct mlx5hws_bwc_rule { - struct mlx5hws_rule *rule; - struct mlx5hws_bwc_rule *isolated_bwc_rule; - struct mlx5hws_bwc_complex_rule_hash_node *complex_hash_node; -+ u32 flow_source; - u16 bwc_queue_idx; -+ bool skip_rx; -+ bool skip_tx; - struct list_head list_node; - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1429-net-mlx5-hws-rearrange-to-prevent-forward-declaration.patch b/SOURCES/1429-net-mlx5-hws-rearrange-to-prevent-forward-declaration.patch deleted file mode 100644 index 36d8dc67a..000000000 --- a/SOURCES/1429-net-mlx5-hws-rearrange-to-prevent-forward-declaration.patch +++ /dev/null @@ -1,293 +0,0 @@ -From cf75c92f3fa3b78a47f3cbe408f25616a0df6c02 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Rearrange to prevent forward declaration - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 29063103f864fb63f7f7c436e670c5804df1b55b -Author: Yevgeny Kliteynik -Date: Thu Jul 3 21:54:29 2025 +0300 - - net/mlx5: HWS, Rearrange to prevent forward declaration - - As a preparation for the following patch that will add support - for shrinking empty matchers, rearrange the code to prevent - forward declaration of functions. - - Signed-off-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-9-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 516634237cb8..15d817cbcd9d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -71,6 +71,130 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - first_matcher ? first_matcher->matcher->end_ft_id : 0; - } - -+static int -+hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ bool move_error = false, poll_error = false, drain_error = false; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_matcher *matcher = bwc_matcher->matcher; -+ u16 bwc_queues = mlx5hws_bwc_queues(ctx); -+ struct mlx5hws_rule_attr rule_attr; -+ struct mlx5hws_bwc_rule *bwc_rule; -+ struct mlx5hws_send_engine *queue; -+ struct list_head *rules_list; -+ u32 pending_rules; -+ int i, ret = 0; -+ -+ mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); -+ -+ for (i = 0; i < bwc_queues; i++) { -+ if (list_empty(&bwc_matcher->rules[i])) -+ continue; -+ -+ pending_rules = 0; -+ rule_attr.queue_id = mlx5hws_bwc_get_queue_id(ctx, i); -+ rules_list = &bwc_matcher->rules[i]; -+ -+ list_for_each_entry(bwc_rule, rules_list, list_node) { -+ ret = mlx5hws_matcher_resize_rule_move(matcher, -+ bwc_rule->rule, -+ &rule_attr); -+ if (unlikely(ret && !move_error)) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: move failed (%d), attempting to move rest of the rules\n", -+ ret); -+ move_error = true; -+ } -+ -+ pending_rules++; -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &pending_rules, -+ false); -+ if (unlikely(ret && !poll_error)) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: poll failed (%d), attempting to move rest of the rules\n", -+ ret); -+ poll_error = true; -+ } -+ } -+ -+ if (pending_rules) { -+ queue = &ctx->send_queue[rule_attr.queue_id]; -+ mlx5hws_send_engine_flush_queue(queue); -+ ret = mlx5hws_bwc_queue_poll(ctx, -+ rule_attr.queue_id, -+ &pending_rules, -+ true); -+ if (unlikely(ret && !drain_error)) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: drain failed (%d), attempting to move rest of the rules\n", -+ ret); -+ drain_error = true; -+ } -+ } -+ } -+ -+ if (move_error || poll_error || drain_error) -+ ret = -EINVAL; -+ -+ return ret; -+} -+ -+static int hws_bwc_matcher_move_all(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ if (!bwc_matcher->complex) -+ return hws_bwc_matcher_move_all_simple(bwc_matcher); -+ -+ return mlx5hws_bwc_matcher_move_all_complex(bwc_matcher); -+} -+ -+static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_matcher_attr matcher_attr = {0}; -+ struct mlx5hws_matcher *old_matcher; -+ struct mlx5hws_matcher *new_matcher; -+ int ret; -+ -+ hws_bwc_matcher_init_attr(bwc_matcher, -+ bwc_matcher->priority, -+ bwc_matcher->rx_size.size_log, -+ bwc_matcher->tx_size.size_log, -+ &matcher_attr); -+ -+ old_matcher = bwc_matcher->matcher; -+ new_matcher = mlx5hws_matcher_create(old_matcher->tbl, -+ &bwc_matcher->mt, 1, -+ bwc_matcher->at, -+ bwc_matcher->num_of_at, -+ &matcher_attr); -+ if (!new_matcher) { -+ mlx5hws_err(ctx, "Rehash error: matcher creation failed\n"); -+ return -ENOMEM; -+ } -+ -+ ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher); -+ if (ret) { -+ mlx5hws_err(ctx, "Rehash error: failed setting resize target\n"); -+ return ret; -+ } -+ -+ ret = hws_bwc_matcher_move_all(bwc_matcher); -+ if (ret) -+ mlx5hws_err(ctx, "Rehash error: moving rules failed, attempting to remove the old matcher\n"); -+ -+ /* Error during rehash can't be rolled back. -+ * The best option here is to allow the rehash to complete and remove -+ * the old matcher - can't leave the matcher in the 'in_resize' state. -+ */ -+ -+ bwc_matcher->matcher = new_matcher; -+ mlx5hws_matcher_destroy(old_matcher); -+ -+ return ret; -+} -+ - int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - struct mlx5hws_table *table, - u32 priority, -@@ -636,129 +760,6 @@ hws_bwc_matcher_find_at(struct mlx5hws_bwc_matcher *bwc_matcher, - return -1; - } - --static int hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- bool move_error = false, poll_error = false, drain_error = false; -- struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -- struct mlx5hws_matcher *matcher = bwc_matcher->matcher; -- u16 bwc_queues = mlx5hws_bwc_queues(ctx); -- struct mlx5hws_rule_attr rule_attr; -- struct mlx5hws_bwc_rule *bwc_rule; -- struct mlx5hws_send_engine *queue; -- struct list_head *rules_list; -- u32 pending_rules; -- int i, ret = 0; -- -- mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); -- -- for (i = 0; i < bwc_queues; i++) { -- if (list_empty(&bwc_matcher->rules[i])) -- continue; -- -- pending_rules = 0; -- rule_attr.queue_id = mlx5hws_bwc_get_queue_id(ctx, i); -- rules_list = &bwc_matcher->rules[i]; -- -- list_for_each_entry(bwc_rule, rules_list, list_node) { -- ret = mlx5hws_matcher_resize_rule_move(matcher, -- bwc_rule->rule, -- &rule_attr); -- if (unlikely(ret && !move_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: move failed (%d), attempting to move rest of the rules\n", -- ret); -- move_error = true; -- } -- -- pending_rules++; -- ret = mlx5hws_bwc_queue_poll(ctx, -- rule_attr.queue_id, -- &pending_rules, -- false); -- if (unlikely(ret && !poll_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: poll failed (%d), attempting to move rest of the rules\n", -- ret); -- poll_error = true; -- } -- } -- -- if (pending_rules) { -- queue = &ctx->send_queue[rule_attr.queue_id]; -- mlx5hws_send_engine_flush_queue(queue); -- ret = mlx5hws_bwc_queue_poll(ctx, -- rule_attr.queue_id, -- &pending_rules, -- true); -- if (unlikely(ret && !drain_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: drain failed (%d), attempting to move rest of the rules\n", -- ret); -- drain_error = true; -- } -- } -- } -- -- if (move_error || poll_error || drain_error) -- ret = -EINVAL; -- -- return ret; --} -- --static int hws_bwc_matcher_move_all(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- if (!bwc_matcher->complex) -- return hws_bwc_matcher_move_all_simple(bwc_matcher); -- -- return mlx5hws_bwc_matcher_move_all_complex(bwc_matcher); --} -- --static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -- struct mlx5hws_matcher_attr matcher_attr = {0}; -- struct mlx5hws_matcher *old_matcher; -- struct mlx5hws_matcher *new_matcher; -- int ret; -- -- hws_bwc_matcher_init_attr(bwc_matcher, -- bwc_matcher->priority, -- bwc_matcher->rx_size.size_log, -- bwc_matcher->tx_size.size_log, -- &matcher_attr); -- -- old_matcher = bwc_matcher->matcher; -- new_matcher = mlx5hws_matcher_create(old_matcher->tbl, -- &bwc_matcher->mt, 1, -- bwc_matcher->at, -- bwc_matcher->num_of_at, -- &matcher_attr); -- if (!new_matcher) { -- mlx5hws_err(ctx, "Rehash error: matcher creation failed\n"); -- return -ENOMEM; -- } -- -- ret = mlx5hws_matcher_resize_set_target(old_matcher, new_matcher); -- if (ret) { -- mlx5hws_err(ctx, "Rehash error: failed setting resize target\n"); -- return ret; -- } -- -- ret = hws_bwc_matcher_move_all(bwc_matcher); -- if (ret) -- mlx5hws_err(ctx, "Rehash error: moving rules failed, attempting to remove the old matcher\n"); -- -- /* Error during rehash can't be rolled back. -- * The best option here is to allow the rehash to complete and remove -- * the old matcher - can't leave the matcher in the 'in_resize' state. -- */ -- -- bwc_matcher->matcher = new_matcher; -- mlx5hws_matcher_destroy(old_matcher); -- -- return ret; --} -- - static int - hws_bwc_matcher_rehash_size(struct mlx5hws_bwc_matcher *bwc_matcher) - { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1430-net-mlx5-hws-shrink-empty-matchers.patch b/SOURCES/1430-net-mlx5-hws-shrink-empty-matchers.patch deleted file mode 100644 index b3bfc0ab9..000000000 --- a/SOURCES/1430-net-mlx5-hws-shrink-empty-matchers.patch +++ /dev/null @@ -1,127 +0,0 @@ -From e075f373741f00716f58d60a197e0a08abb15ffa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: HWS, Shrink empty matchers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 96e4c4a1a5bc6b6bc1ba48c6dfd2246df24f2f63 -Author: Yevgeny Kliteynik -Date: Thu Jul 3 21:54:30 2025 +0300 - - net/mlx5: HWS, Shrink empty matchers - - Matcher size is dynamic: it starts at initial size, and then it grows - through rehash as more and more rules are added to this matcher. - When rules are deleted, matcher's size is not decreased. Rehash - approach is greedy. The idea is: if the matcher got to a certain size - at some point, chances are - it will get to this size again, so it is - better to avoid costly rehash operations whenever possible. - - However, when all the rules of the matcher are deleted, this should - be viewed as special case. If the matcher actually got to the point - where it has zero rules, it might be an indication that some usecase - from the past is no longer happening. This is where some ICM can be - freed. - - This patch handles this case: when a number of rules in a matcher - goes down to zero, the matcher's tables are shrunk to the initial - size. - - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-10-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 15d817cbcd9d..92de4b761a83 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -533,6 +533,70 @@ static void hws_bwc_rule_cnt_dec(struct mlx5hws_bwc_rule *bwc_rule) - atomic_dec(&bwc_matcher->tx_size.num_of_rules); - } - -+static int -+hws_bwc_matcher_rehash_shrink(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ struct mlx5hws_bwc_matcher_size *rx_size = &bwc_matcher->rx_size; -+ struct mlx5hws_bwc_matcher_size *tx_size = &bwc_matcher->tx_size; -+ -+ /* It is possible that another thread has added a rule. -+ * Need to check again if we really need rehash/shrink. -+ */ -+ if (atomic_read(&rx_size->num_of_rules) || -+ atomic_read(&tx_size->num_of_rules)) -+ return 0; -+ -+ /* If the current matcher RX/TX size is already at its initial size. */ -+ if (rx_size->size_log == MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG && -+ tx_size->size_log == MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG) -+ return 0; -+ -+ /* Now we've done all the checking - do the shrinking: -+ * - reset match RTC size to the initial size -+ * - create new matcher -+ * - move the rules, which will not do anything as the matcher is empty -+ * - destroy the old matcher -+ */ -+ -+ rx_size->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; -+ tx_size->size_log = MLX5HWS_BWC_MATCHER_INIT_SIZE_LOG; -+ -+ return hws_bwc_matcher_move(bwc_matcher); -+} -+ -+static int hws_bwc_rule_cnt_dec_with_shrink(struct mlx5hws_bwc_rule *bwc_rule, -+ u16 bwc_queue_idx) -+{ -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mutex *queue_lock; /* Protect the queue */ -+ int ret; -+ -+ hws_bwc_rule_cnt_dec(bwc_rule); -+ -+ if (atomic_read(&bwc_matcher->rx_size.num_of_rules) || -+ atomic_read(&bwc_matcher->tx_size.num_of_rules)) -+ return 0; -+ -+ /* Matcher has no more rules - shrink it to save ICM. */ -+ -+ queue_lock = hws_bwc_get_queue_lock(ctx, bwc_queue_idx); -+ mutex_unlock(queue_lock); -+ -+ hws_bwc_lock_all_queues(ctx); -+ ret = hws_bwc_matcher_rehash_shrink(bwc_matcher); -+ hws_bwc_unlock_all_queues(ctx); -+ -+ mutex_lock(queue_lock); -+ -+ if (unlikely(ret)) -+ mlx5hws_err(ctx, -+ "BWC rule deletion: shrinking empty matcher failed (%d)\n", -+ ret); -+ -+ return ret; -+} -+ - int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - { - struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -@@ -549,8 +613,8 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - mutex_lock(queue_lock); - - ret = hws_bwc_rule_destroy_hws_sync(bwc_rule, &attr); -- hws_bwc_rule_cnt_dec(bwc_rule); - hws_bwc_rule_list_remove(bwc_rule); -+ hws_bwc_rule_cnt_dec_with_shrink(bwc_rule, idx); - - mutex_unlock(queue_lock); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1431-net-mlx5-add-hws-as-secondary-steering-mode.patch b/SOURCES/1431-net-mlx5-add-hws-as-secondary-steering-mode.patch deleted file mode 100644 index 5287b70dd..000000000 --- a/SOURCES/1431-net-mlx5-add-hws-as-secondary-steering-mode.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 301cdb8808d0dad4d74a35db3f9b28ddadb76151 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: Add HWS as secondary steering mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a9aec713d0d9d6c3d918df26c61ee42ee2c28676 -Author: Moshe Shemesh -Date: Thu Jul 3 21:54:31 2025 +0300 - - net/mlx5: Add HWS as secondary steering mode - - Add HW Steering (HWS) as a secondary option for device steering mode. If - the device does not support SW Steering (SWS), HW Steering will be used - as the default, provided it is supported. FW Steering will now be - selected as the default only if both HWS and SWS are unavailable. - - Signed-off-by: Moshe Shemesh - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250703185431.445571-11-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 02808be0e88b..0de287392c32 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3952,6 +3952,8 @@ int mlx5_fs_core_alloc(struct mlx5_core_dev *dev) - - if (mlx5_fs_dr_is_supported(dev)) - steering->mode = MLX5_FLOW_STEERING_MODE_SMFS; -+ else if (mlx5_fs_hws_is_supported(dev)) -+ steering->mode = MLX5_FLOW_STEERING_MODE_HMFS; - else - steering->mode = MLX5_FLOW_STEERING_MODE_DMFS; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1432-net-mlx5-fix-spelling-mistake-disabliing-disabling.patch b/SOURCES/1432-net-mlx5-fix-spelling-mistake-disabliing-disabling.patch deleted file mode 100644 index 8f4a81c90..000000000 --- a/SOURCES/1432-net-mlx5-fix-spelling-mistake-disabliing-disabling.patch +++ /dev/null @@ -1,38 +0,0 @@ -From b68e58157bbab0aaf4bacdef12cf8b75cd66724d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] net/mlx5: Fix spelling mistake "disabliing" -> "disabling" - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 0e86f3eb83c0d90ec082ceac925a500ec6ad604e -Author: Colin Ian King -Date: Thu Jul 3 11:22:19 2025 +0100 - - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" - - There is a spelling mistake in a NL_SET_ERR_MSG_MOD message. Fix it. - - Signed-off-by: Colin Ian King - Reviewed-by: Mark Bloch - Link: https://patch.msgid.link/20250703102219.1248399-1-colin.i.king@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index c24d1f584a46..e1cef8dd3b4d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1353,7 +1353,7 @@ static int esw_qos_switch_tc_arbiter_node_to_vports( - &node->ix); - if (err) { - NL_SET_ERR_MSG_MOD(extack, -- "Failed to create scheduling element for vports node when disabliing vports TC QoS"); -+ "Failed to create scheduling element for vports node when disabling vports TC QoS"); - return err; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1433-eth-mlx5-migrate-to-the-rxfh-context-ops.patch b/SOURCES/1433-eth-mlx5-migrate-to-the-rxfh-context-ops.patch deleted file mode 100644 index f4dbb322d..000000000 --- a/SOURCES/1433-eth-mlx5-migrate-to-the-rxfh-context-ops.patch +++ /dev/null @@ -1,352 +0,0 @@ -From 8aa720939f44d98068823c9ed8eefadc9bf00fb1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:20 -0400 -Subject: [PATCH] eth: mlx5: migrate to the *_rxfh_context ops - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit afc55a0659a60c6b5cde2907c9454ce8fcb0844f -Author: Jakub Kicinski -Date: Mon Jul 7 11:41:13 2025 -0700 - - eth: mlx5: migrate to the *_rxfh_context ops - - Convert mlx5 to dedicated RXFH ops. This is a fairly shallow - conversion, TBH, most of the driver code stays as is, but we - let the core allocate the context ID for the driver. - - mlx5e_rx_res_rss_get_rxfh() and friends are made void, since - core only calls the driver for context 0. The second call - is right after context creation so it must exist (tm). - - Tested with drivers/net/hw/rss_ctx.py on MCX6. - - Reviewed-by: Gal Pressman - Link: https://patch.msgid.link/20250707184115.2285277-4-kuba@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -index 74cd111ee320..c68ba0e58fa6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -@@ -567,7 +567,8 @@ int mlx5e_rss_packet_merge_set_param(struct mlx5e_rss *rss, - return final_err; - } - --int mlx5e_rss_get_rxfh(struct mlx5e_rss *rss, u32 *indir, u8 *key, u8 *hfunc, bool *symmetric) -+void mlx5e_rss_get_rxfh(struct mlx5e_rss *rss, u32 *indir, u8 *key, u8 *hfunc, -+ bool *symmetric) - { - if (indir) - memcpy(indir, rss->indir.table, -@@ -582,8 +583,6 @@ int mlx5e_rss_get_rxfh(struct mlx5e_rss *rss, u32 *indir, u8 *key, u8 *hfunc, bo - - if (symmetric) - *symmetric = rss->hash.symmetric; -- -- return 0; - } - - int mlx5e_rss_set_rxfh(struct mlx5e_rss *rss, const u32 *indir, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -index 8ac902190010..c6c1b2847cf5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -@@ -47,7 +47,8 @@ void mlx5e_rss_disable(struct mlx5e_rss *rss); - - int mlx5e_rss_packet_merge_set_param(struct mlx5e_rss *rss, - struct mlx5e_packet_merge_param *pkt_merge_param); --int mlx5e_rss_get_rxfh(struct mlx5e_rss *rss, u32 *indir, u8 *key, u8 *hfunc, bool *symmetric); -+void mlx5e_rss_get_rxfh(struct mlx5e_rss *rss, u32 *indir, u8 *key, u8 *hfunc, -+ bool *symmetric); - int mlx5e_rss_set_rxfh(struct mlx5e_rss *rss, const u32 *indir, - const u8 *key, const u8 *hfunc, const bool *symmetric, - u32 *rqns, u32 *vhca_ids, unsigned int num_rqns); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -index 5fcbe47337b0..e5cce2df3649 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -@@ -71,17 +71,12 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - return 0; - } - --int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 *rss_idx, unsigned int init_nch) -+int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int init_nch) - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; - struct mlx5e_rss *rss; -- int i; -- -- for (i = 1; i < MLX5E_MAX_NUM_RSS; i++) -- if (!res->rss[i]) -- break; - -- if (i == MLX5E_MAX_NUM_RSS) -+ if (WARN_ON_ONCE(res->rss[rss_idx])) - return -ENOSPC; - - rss = mlx5e_rss_init(res->mdev, inner_ft_support, res->drop_rqn, -@@ -97,8 +92,7 @@ int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 *rss_idx, unsigned int i - mlx5e_rss_enable(rss, res->rss_rqns, vhca_ids, res->rss_nch); - } - -- res->rss[i] = rss; -- *rss_idx = i; -+ res->rss[rss_idx] = rss; - - return 0; - } -@@ -193,19 +187,17 @@ void mlx5e_rx_res_rss_set_indir_uniform(struct mlx5e_rx_res *res, unsigned int n - mlx5e_rss_set_indir_uniform(res->rss[0], nch); - } - --int mlx5e_rx_res_rss_get_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, -- u32 *indir, u8 *key, u8 *hfunc, bool *symmetric) -+void mlx5e_rx_res_rss_get_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, -+ u32 *indir, u8 *key, u8 *hfunc, bool *symmetric) - { -- struct mlx5e_rss *rss; -+ struct mlx5e_rss *rss = NULL; - -- if (rss_idx >= MLX5E_MAX_NUM_RSS) -- return -EINVAL; -- -- rss = res->rss[rss_idx]; -- if (!rss) -- return -ENOENT; -+ if (rss_idx < MLX5E_MAX_NUM_RSS) -+ rss = res->rss[rss_idx]; -+ if (WARN_ON_ONCE(!rss)) -+ return; - -- return mlx5e_rss_get_rxfh(rss, indir, key, hfunc, symmetric); -+ mlx5e_rss_get_rxfh(rss, indir, key, hfunc, symmetric); - } - - int mlx5e_rx_res_rss_set_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -index 3e09d91281af..1d049e2aa264 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -@@ -48,8 +48,9 @@ void mlx5e_rx_res_xsk_update(struct mlx5e_rx_res *res, struct mlx5e_channels *ch - - /* Configuration API */ - void mlx5e_rx_res_rss_set_indir_uniform(struct mlx5e_rx_res *res, unsigned int nch); --int mlx5e_rx_res_rss_get_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, -- u32 *indir, u8 *key, u8 *hfunc, bool *symmetric); -+void mlx5e_rx_res_rss_get_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, -+ u32 *indir, u8 *key, u8 *hfunc, -+ bool *symmetric); - int mlx5e_rx_res_rss_set_rxfh(struct mlx5e_rx_res *res, u32 rss_idx, - const u32 *indir, const u8 *key, const u8 *hfunc, - const bool *symmetric); -@@ -61,7 +62,7 @@ int mlx5e_rx_res_rss_set_hash_fields(struct mlx5e_rx_res *res, u32 rss_idx, - int mlx5e_rx_res_packet_merge_set_param(struct mlx5e_rx_res *res, - struct mlx5e_packet_merge_param *pkt_merge_param); - --int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 *rss_idx, unsigned int init_nch); -+int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int init_nch); - int mlx5e_rx_res_rss_destroy(struct mlx5e_rx_res *res, u32 rss_idx); - int mlx5e_rx_res_rss_cnt(struct mlx5e_rx_res *res); - int mlx5e_rx_res_rss_index(struct mlx5e_rx_res *res, struct mlx5e_rss *rss); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index ff0b9ab2daa0..81e819f8722c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1480,61 +1480,121 @@ static u32 mlx5e_get_rxfh_indir_size(struct net_device *netdev) - static int mlx5e_get_rxfh(struct net_device *netdev, struct ethtool_rxfh_param *rxfh) - { - struct mlx5e_priv *priv = netdev_priv(netdev); -- u32 rss_context = rxfh->rss_context; - bool symmetric; -- int err; - - mutex_lock(&priv->state_lock); -- err = mlx5e_rx_res_rss_get_rxfh(priv->rx_res, rss_context, -- rxfh->indir, rxfh->key, &rxfh->hfunc, &symmetric); -+ mlx5e_rx_res_rss_get_rxfh(priv->rx_res, 0, rxfh->indir, rxfh->key, -+ &rxfh->hfunc, &symmetric); - mutex_unlock(&priv->state_lock); - -- if (err) -- return err; -- - if (symmetric) - rxfh->input_xfrm = RXH_XFRM_SYM_OR_XOR; - - return 0; - } - --static int mlx5e_set_rxfh(struct net_device *dev, struct ethtool_rxfh_param *rxfh, -- struct netlink_ext_ack *extack) -+static int mlx5e_rxfh_hfunc_check(struct mlx5e_priv *priv, -+ const struct ethtool_rxfh_param *rxfh) - { -- bool symmetric = rxfh->input_xfrm == RXH_XFRM_SYM_OR_XOR; -- struct mlx5e_priv *priv = netdev_priv(dev); -- u32 *rss_context = &rxfh->rss_context; -- u8 hfunc = rxfh->hfunc; - unsigned int count; -- int err; -- -- mutex_lock(&priv->state_lock); - - count = priv->channels.params.num_channels; - -- if (hfunc == ETH_RSS_HASH_XOR) { -+ if (rxfh->hfunc == ETH_RSS_HASH_XOR) { - unsigned int xor8_max_channels = mlx5e_rqt_max_num_channels_allowed_for_xor8(); - - if (count > xor8_max_channels) { -- err = -EINVAL; - netdev_err(priv->netdev, "%s: Cannot set RSS hash function to XOR, current number of channels (%d) exceeds the maximum allowed for XOR8 RSS hfunc (%d)\n", - __func__, count, xor8_max_channels); -- goto unlock; -+ return -EINVAL; - } - } - -- if (*rss_context && rxfh->rss_delete) { -- err = mlx5e_rx_res_rss_destroy(priv->rx_res, *rss_context); -+ return 0; -+} -+ -+static int mlx5e_set_rxfh(struct net_device *dev, -+ struct ethtool_rxfh_param *rxfh, -+ struct netlink_ext_ack *extack) -+{ -+ bool symmetric = rxfh->input_xfrm == RXH_XFRM_SYM_OR_XOR; -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ u8 hfunc = rxfh->hfunc; -+ int err; -+ -+ mutex_lock(&priv->state_lock); -+ -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ if (err) - goto unlock; -- } - -- if (*rss_context == ETH_RXFH_CONTEXT_ALLOC) { -- err = mlx5e_rx_res_rss_init(priv->rx_res, rss_context, count); -- if (err) -- goto unlock; -- } -+ err = mlx5e_rx_res_rss_set_rxfh(priv->rx_res, rxfh->rss_context, -+ rxfh->indir, rxfh->key, -+ hfunc == ETH_RSS_HASH_NO_CHANGE ? NULL : &hfunc, -+ rxfh->input_xfrm == RXH_XFRM_NO_CHANGE ? NULL : &symmetric); -+ -+unlock: -+ mutex_unlock(&priv->state_lock); -+ return err; -+} -+ -+static int mlx5e_create_rxfh_context(struct net_device *dev, -+ struct ethtool_rxfh_context *ctx, -+ const struct ethtool_rxfh_param *rxfh, -+ struct netlink_ext_ack *extack) -+{ -+ bool symmetric = rxfh->input_xfrm == RXH_XFRM_SYM_OR_XOR; -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ u8 hfunc = rxfh->hfunc; -+ int err; -+ -+ mutex_lock(&priv->state_lock); -+ -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ if (err) -+ goto unlock; -+ -+ err = mlx5e_rx_res_rss_init(priv->rx_res, rxfh->rss_context, -+ priv->channels.params.num_channels); -+ if (err) -+ goto unlock; -+ -+ err = mlx5e_rx_res_rss_set_rxfh(priv->rx_res, rxfh->rss_context, -+ rxfh->indir, rxfh->key, -+ hfunc == ETH_RSS_HASH_NO_CHANGE ? NULL : &hfunc, -+ rxfh->input_xfrm == RXH_XFRM_NO_CHANGE ? NULL : &symmetric); -+ if (err) -+ goto unlock; -+ -+ mlx5e_rx_res_rss_get_rxfh(priv->rx_res, rxfh->rss_context, -+ ethtool_rxfh_context_indir(ctx), -+ ethtool_rxfh_context_key(ctx), -+ &ctx->hfunc, &symmetric); -+ if (symmetric) -+ ctx->input_xfrm = RXH_XFRM_SYM_OR_XOR; -+ -+unlock: -+ mutex_unlock(&priv->state_lock); -+ return err; -+} - -- err = mlx5e_rx_res_rss_set_rxfh(priv->rx_res, *rss_context, -+static int mlx5e_modify_rxfh_context(struct net_device *dev, -+ struct ethtool_rxfh_context *ctx, -+ const struct ethtool_rxfh_param *rxfh, -+ struct netlink_ext_ack *extack) -+{ -+ bool symmetric = rxfh->input_xfrm == RXH_XFRM_SYM_OR_XOR; -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ u8 hfunc = rxfh->hfunc; -+ int err; -+ -+ mutex_lock(&priv->state_lock); -+ -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ if (err) -+ goto unlock; -+ -+ err = mlx5e_rx_res_rss_set_rxfh(priv->rx_res, rxfh->rss_context, - rxfh->indir, rxfh->key, - hfunc == ETH_RSS_HASH_NO_CHANGE ? NULL : &hfunc, - rxfh->input_xfrm == RXH_XFRM_NO_CHANGE ? NULL : &symmetric); -@@ -1544,6 +1604,20 @@ static int mlx5e_set_rxfh(struct net_device *dev, struct ethtool_rxfh_param *rxf - return err; - } - -+static int mlx5e_remove_rxfh_context(struct net_device *dev, -+ struct ethtool_rxfh_context *ctx, -+ u32 rss_context, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ int err; -+ -+ mutex_lock(&priv->state_lock); -+ err = mlx5e_rx_res_rss_destroy(priv->rx_res, rss_context); -+ mutex_unlock(&priv->state_lock); -+ return err; -+} -+ - #define MLX5E_PFC_PREVEN_AUTO_TOUT_MSEC 100 - #define MLX5E_PFC_PREVEN_TOUT_MAX_MSEC 8000 - #define MLX5E_PFC_PREVEN_MINOR_PRECENT 85 -@@ -2659,9 +2733,9 @@ static void mlx5e_get_ts_stats(struct net_device *netdev, - - const struct ethtool_ops mlx5e_ethtool_ops = { - .cap_link_lanes_supported = true, -- .cap_rss_ctx_supported = true, - .rxfh_per_ctx_fields = true, - .rxfh_per_ctx_key = true, -+ .rxfh_max_num_contexts = MLX5E_MAX_NUM_RSS, - .supported_coalesce_params = ETHTOOL_COALESCE_USECS | - ETHTOOL_COALESCE_MAX_FRAMES | - ETHTOOL_COALESCE_USE_ADAPTIVE | -@@ -2690,6 +2764,9 @@ const struct ethtool_ops mlx5e_ethtool_ops = { - .set_rxfh = mlx5e_set_rxfh, - .get_rxfh_fields = mlx5e_get_rxfh_fields, - .set_rxfh_fields = mlx5e_set_rxfh_fields, -+ .create_rxfh_context = mlx5e_create_rxfh_context, -+ .modify_rxfh_context = mlx5e_modify_rxfh_context, -+ .remove_rxfh_context = mlx5e_remove_rxfh_context, - .get_rxnfc = mlx5e_get_rxnfc, - .set_rxnfc = mlx5e_set_rxnfc, - .get_tunable = mlx5e_get_tunable, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1434-net-mlx5e-remove-unused-vlan-insertion-logic-in-tx-path.patch b/SOURCES/1434-net-mlx5e-remove-unused-vlan-insertion-logic-in-tx-path.patch deleted file mode 100644 index 80c31e8be..000000000 --- a/SOURCES/1434-net-mlx5e-remove-unused-vlan-insertion-logic-in-tx-path.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 3d587b868f1ba20843807f7b018fb1f51b41e34e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5e: Remove unused VLAN insertion logic in TX path - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ade89d1f2486e5189b3a3f0a9e917defa4ff0779 -Author: Carolina Jubran -Date: Wed Jul 9 00:16:23 2025 +0300 - - net/mlx5e: Remove unused VLAN insertion logic in TX path - - The VLAN insertion capability (`wqe_vlan_insert`) was never enabled on - all mlx5 devices. When VLAN TX offload is advertised but this - capability is not supported, the driver uses inline headers to insert - the VLAN tag. - - To support this, the driver used to set the - `MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE` bit to enforce L2 inline mode - when `wqe_vlan_insert` was not supported. Since the capability is - disabled on all devices, this logic was always active, and the SQ flag - has become redundant. L2 inline is enforced unconditionally for - VLAN-tagged packets. - - The `skb_vlan_tag_present()` check in the else-if block of - `mlx5e_sq_xmit_wqe()` is never true by this point in the TX flow, - as the VLAN tag has already been inserted by the driver using inline - headers. As a result, this code is never executed. - - Remove the redundant SQ state, dead VLAN insertion code block, and - related logic. - - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752009387-13300-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index c329de1d4f0a..866652575105 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -383,7 +383,6 @@ enum { - MLX5E_SQ_STATE_RECOVERING, - MLX5E_SQ_STATE_IPSEC, - MLX5E_SQ_STATE_DIM, -- MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, - MLX5E_SQ_STATE_PENDING_XSK_TX, - MLX5E_SQ_STATE_PENDING_TLS_RX_RESYNC, - MLX5E_NUM_SQ_STATES, /* Must be kept last */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 131ed97ca997..71fb20f63bc3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -339,8 +339,6 @@ static int mlx5e_ptp_alloc_txqsq(struct mlx5e_ptp *c, int txq_ix, - sq->stats = &c->priv->ptp_stats.sq[tc]; - sq->ptpsq = ptpsq; - INIT_WORK(&sq->recover_work, mlx5e_tx_err_cqe_work); -- if (!MLX5_CAP_ETH(mdev, wqe_vlan_insert)) -- set_bit(MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, &sq->state); - sq->stop_room = param->stop_room; - sq->ptp_cyc2time = mlx5_sq_ts_translator(mdev); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -index a107aad01865..2439495e36f8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -@@ -13,7 +13,6 @@ static const char * const sq_sw_state_type_name[] = { - [MLX5E_SQ_STATE_RECOVERING] = "recovering", - [MLX5E_SQ_STATE_IPSEC] = "ipsec", - [MLX5E_SQ_STATE_DIM] = "dim", -- [MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE] = "vlan_need_l2_inline", - [MLX5E_SQ_STATE_PENDING_XSK_TX] = "pending_xsk_tx", - [MLX5E_SQ_STATE_PENDING_TLS_RX_RESYNC] = "pending_tls_rx_resync", - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 62db56b5251f..0396ec0928d5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -1670,8 +1670,6 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c, - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - sq->max_sq_mpw_wqebbs = mlx5e_get_max_sq_aligned_wqebbs(mdev); - INIT_WORK(&sq->recover_work, mlx5e_tx_err_cqe_work); -- if (!MLX5_CAP_ETH(mdev, wqe_vlan_insert)) -- set_bit(MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, &sq->state); - if (mlx5_ipsec_device_caps(c->priv->mdev)) - set_bit(MLX5E_SQ_STATE_IPSEC, &sq->state); - if (param->is_mpw) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -index 55a8629f0792..e6a301ba3254 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -@@ -256,8 +256,7 @@ mlx5e_tx_wqe_inline_mode(struct mlx5e_txqsq *sq, struct sk_buff *skb, - - mode = sq->min_inline_mode; - -- if (skb_vlan_tag_present(skb) && -- test_bit(MLX5E_SQ_STATE_VLAN_NEED_L2_INLINE, &sq->state)) -+ if (skb_vlan_tag_present(skb)) - mode = max_t(u8, MLX5_INLINE_MODE_L2, mode); - - return mode; -@@ -483,12 +482,6 @@ mlx5e_sq_xmit_wqe(struct mlx5e_txqsq *sq, struct sk_buff *skb, - } - eseg->inline_hdr.sz |= cpu_to_be16(ihs); - dseg += wqe_attr->ds_cnt_inl; -- } else if (skb_vlan_tag_present(skb)) { -- eseg->insert.type = cpu_to_be16(MLX5_ETH_WQE_INSERT_VLAN); -- if (skb->vlan_proto == cpu_to_be16(ETH_P_8021AD)) -- eseg->insert.type |= cpu_to_be16(MLX5_ETH_WQE_SVLAN); -- eseg->insert.vlan_tci = cpu_to_be16(skb_vlan_tag_get(skb)); -- stats->added_vlan_packets++; - } - - dseg += wqe_attr->ds_cnt_ids; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1435-net-mlx5e-ct-extract-a-memcmp-from-a-spinlock-section.patch b/SOURCES/1435-net-mlx5e-ct-extract-a-memcmp-from-a-spinlock-section.patch deleted file mode 100644 index 80c245c50..000000000 --- a/SOURCES/1435-net-mlx5e-ct-extract-a-memcmp-from-a-spinlock-section.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 5a21b2dc63b360eb3cf2a51245c079f2b343085c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5e: CT: extract a memcmp from a spinlock section - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 122d86aa2a0c8950ea958a3d258eccbb5872bd68 -Author: Cosmin Ratiu -Date: Wed Jul 9 00:16:24 2025 +0300 - - net/mlx5e: CT: extract a memcmp from a spinlock section - - This reduces the time the lock is held and reduces contention. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752009387-13300-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -index 81332cd4a582..870d12364f99 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -@@ -1195,6 +1195,7 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft, - struct flow_action_entry *meta_action; - unsigned long cookie = flow->cookie; - struct mlx5_ct_entry *entry; -+ bool has_nat; - int err; - - meta_action = mlx5_tc_ct_get_ct_metadata_action(flow_rule); -@@ -1236,6 +1237,8 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft, - err = mlx5_tc_ct_rule_to_tuple_nat(&entry->tuple_nat, flow_rule); - if (err) - goto err_set; -+ has_nat = memcmp(&entry->tuple, &entry->tuple_nat, -+ sizeof(entry->tuple)); - - spin_lock_bh(&ct_priv->ht_lock); - -@@ -1244,7 +1247,7 @@ mlx5_tc_ct_block_flow_offload_add(struct mlx5_ct_ft *ft, - if (err) - goto err_entries; - -- if (memcmp(&entry->tuple, &entry->tuple_nat, sizeof(entry->tuple))) { -+ if (has_nat) { - err = rhashtable_lookup_insert_fast(&ct_priv->ct_tuples_nat_ht, - &entry->tuple_nat_node, - tuples_nat_ht_params); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1436-net-mlx5e-replace-recursive-vlan-push-handling-with-an-itera.patch b/SOURCES/1436-net-mlx5e-replace-recursive-vlan-push-handling-with-an-itera.patch deleted file mode 100644 index 50cee9346..000000000 --- a/SOURCES/1436-net-mlx5e-replace-recursive-vlan-push-handling-with-an-itera.patch +++ /dev/null @@ -1,89 +0,0 @@ -From d0850dc98029f973ea0cdf275fb32cf5758aedb7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5e: Replace recursive VLAN push handling with an - iterative loop - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c0ca344d796cf00c169f63f09eea0f4905778be1 -Author: Gal Pressman -Date: Wed Jul 9 00:16:25 2025 +0300 - - net/mlx5e: Replace recursive VLAN push handling with an iterative loop - - mlx5e_tc_act_vlan_add_push_action() uses tail-recursion to walk through - a stack of VLAN devices. - - There is no need for a complicated recursion with unnecessary stack - consumption and less obvious code flow, rewrite the function so that it - uses a do while loop instead. - - Signed-off-by: Gal Pressman - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752009387-13300-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan.c -index a13c5e707b83..9bdb5820c553 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/vlan.c -@@ -94,29 +94,30 @@ mlx5e_tc_act_vlan_add_push_action(struct mlx5e_priv *priv, - struct net_device **out_dev, - struct netlink_ext_ack *extack) - { -- struct net_device *vlan_dev = *out_dev; -- struct flow_action_entry vlan_act = { -- .id = FLOW_ACTION_VLAN_PUSH, -- .vlan.vid = vlan_dev_vlan_id(vlan_dev), -- .vlan.proto = vlan_dev_vlan_proto(vlan_dev), -- .vlan.prio = 0, -- }; -- int err; -- -- err = parse_tc_vlan_action(priv, &vlan_act, attr->esw_attr, &attr->action, extack, NULL); -- if (err) -- return err; -- -- rcu_read_lock(); -- *out_dev = dev_get_by_index_rcu(dev_net(vlan_dev), dev_get_iflink(vlan_dev)); -- rcu_read_unlock(); -- if (!*out_dev) -- return -ENODEV; -+ do { -+ struct net_device *vlan_dev = *out_dev; -+ struct flow_action_entry vlan_act = { -+ .id = FLOW_ACTION_VLAN_PUSH, -+ .vlan.vid = vlan_dev_vlan_id(vlan_dev), -+ .vlan.proto = vlan_dev_vlan_proto(vlan_dev), -+ .vlan.prio = 0, -+ }; -+ int err; -+ -+ err = parse_tc_vlan_action(priv, &vlan_act, attr->esw_attr, -+ &attr->action, extack, NULL); -+ if (err) -+ return err; - -- if (is_vlan_dev(*out_dev)) -- err = mlx5e_tc_act_vlan_add_push_action(priv, attr, out_dev, extack); -+ rcu_read_lock(); -+ *out_dev = dev_get_by_index_rcu(dev_net(vlan_dev), -+ dev_get_iflink(vlan_dev)); -+ rcu_read_unlock(); -+ if (!*out_dev) -+ return -ENODEV; -+ } while (is_vlan_dev(*out_dev)); - -- return err; -+ return 0; - } - - int --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1437-net-mlx5-warn-when-write-combining-is-not-supported.patch b/SOURCES/1437-net-mlx5-warn-when-write-combining-is-not-supported.patch deleted file mode 100644 index 1caf641c1..000000000 --- a/SOURCES/1437-net-mlx5-warn-when-write-combining-is-not-supported.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 93600079ef308e0d3ae39dc234c5eed7534aa941 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5: Warn when write combining is not supported - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d980f371b134d5d66d082161171a6be613975dfc -Author: Maor Gottlieb -Date: Wed Jul 9 00:16:26 2025 +0300 - - net/mlx5: Warn when write combining is not supported - - Warn if write combining is not supported, as it can impact latency. - Add the warning message to be printed only when the driver actually - run the test and detect unsupported state, rather than when - inheriting parent's result for SFs. - - Signed-off-by: Maor Gottlieb - Reviewed-by: Michael Guralnik - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752009387-13300-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wc.c b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -index 740b719e7072..2f0316616fa4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/wc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -@@ -378,6 +378,9 @@ static void mlx5_core_test_wc(struct mlx5_core_dev *mdev) - mlx5_free_bfreg(mdev, &sq->bfreg); - err_alloc_bfreg: - kfree(sq); -+ -+ if (mdev->wc_state == MLX5_WC_STATE_UNSUPPORTED) -+ mlx5_core_warn(mdev, "Write combining is not supported\n"); - } - - bool mlx5_wc_support_get(struct mlx5_core_dev *mdev) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1438-net-mlx5e-rx-remove-unnecessary-rqt-redirects.patch b/SOURCES/1438-net-mlx5e-rx-remove-unnecessary-rqt-redirects.patch deleted file mode 100644 index 001c2df58..000000000 --- a/SOURCES/1438-net-mlx5e-rx-remove-unnecessary-rqt-redirects.patch +++ /dev/null @@ -1,67 +0,0 @@ -From f7c1631cf13fab0afa3883271bdca40e09aec5c1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5e: RX, Remove unnecessary RQT redirects - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a194be578376f7365db9bf1b8193c74546c86121 -Author: Tariq Toukan -Date: Wed Jul 9 00:16:27 2025 +0300 - - net/mlx5e: RX, Remove unnecessary RQT redirects - - RQTs (Receive Queue Table) should redirect traffic to the channels' RQs - when they're active. Otherwise, redirect to the designated "drop RQ". - - RQTs are created in "inactive" state, pointing to the "drop RQ". - In activate and de-activate flows, do not "deactivate" the rest of RQTs - (beyond the num of channels), as they are already inactive. - - This cuts down unnecessary execution of FW commands (MODIFY_RQT), and - improves the latency of open/close channels or configuration change. - - Perf: - NIC: Connect-X7. - Configuration: 1 combined channel, max num channels 248. - Measure time for "interface up + interface down". - - Before: 0.313 sec - After: 0.057 sec (5.5x faster) - - 247 MODIFY_RQT commands saved in interface up. - 247 MODIFY_RQT commands saved in interface down. - - Signed-off-by: Tariq Toukan - Reviewed-by: Dragos Tatulea - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1752009387-13300-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -index e5cce2df3649..a2acbfee2b77 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -@@ -571,8 +571,6 @@ void mlx5e_rx_res_channels_activate(struct mlx5e_rx_res *res, struct mlx5e_chann - - for (ix = 0; ix < nch; ix++) - mlx5e_rx_res_channel_activate_direct(res, chs, ix); -- for (ix = nch; ix < res->max_nch; ix++) -- mlx5e_rx_res_channel_deactivate_direct(res, ix); - - if (res->features & MLX5E_RX_RES_FEATURE_PTP) { - u32 rqn; -@@ -595,7 +593,7 @@ void mlx5e_rx_res_channels_deactivate(struct mlx5e_rx_res *res) - - mlx5e_rx_res_rss_disable(res); - -- for (ix = 0; ix < res->max_nch; ix++) -+ for (ix = 0; ix < res->rss_nch; ix++) - mlx5e_rx_res_channel_deactivate_direct(res, ix); - - if (res->features & MLX5E_RX_RES_FEATURE_PTP) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1439-net-mlx5-expose-hca-capability-bits-for-mkey-max-page-size.patch b/SOURCES/1439-net-mlx5-expose-hca-capability-bits-for-mkey-max-page-size.patch deleted file mode 100644 index 89a4e1583..000000000 --- a/SOURCES/1439-net-mlx5-expose-hca-capability-bits-for-mkey-max-page-size.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 264ed9ba5b356121e93841f29b6daedae5653c16 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5: Expose HCA capability bits for mkey max page size - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8feaf9832be52be16e588029366e27940f6b88ea -Author: Michael Guralnik -Date: Wed Jul 9 09:42:08 2025 +0300 - - net/mlx5: Expose HCA capability bits for mkey max page size - - Expose the HCA capability for maximal page size that can be configured - for an mkey. Used for enforcing capabilities when working with highly - contiguous memory and using large page sizes. - - Signed-off-by: Michael Guralnik - Link: https://patch.msgid.link/3e4d3fda37934430f65f72601519e22bf396fd05.1751979184.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 3ab683020fab..ebcd5b9b648e 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -2170,7 +2170,9 @@ struct mlx5_ifc_cmd_hca_cap_2_bits { - u8 min_mkey_log_entity_size_fixed_buffer[0x5]; - u8 ec_vf_vport_base[0x10]; - -- u8 reserved_at_3a0[0xa]; -+ u8 reserved_at_3a0[0x2]; -+ u8 max_mkey_log_entity_size_fixed_buffer[0x6]; -+ u8 reserved_at_3a8[0x2]; - u8 max_mkey_log_entity_size_mtt[0x6]; - u8 max_rqt_vhca_id[0x10]; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1440-rdma-mlx5-fix-umr-modifying-of-mkey-page-size.patch b/SOURCES/1440-rdma-mlx5-fix-umr-modifying-of-mkey-page-size.patch deleted file mode 100644 index 55293fb3f..000000000 --- a/SOURCES/1440-rdma-mlx5-fix-umr-modifying-of-mkey-page-size.patch +++ /dev/null @@ -1,80 +0,0 @@ -From 44bec6a44a04c6548a35a7f6ab4072e14adde57f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] RDMA/mlx5: Fix UMR modifying of mkey page size - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c4f96972c3c206ac8f6770b5ecd5320b561d0058 -Author: Edward Srouji -Date: Wed Jul 9 09:42:09 2025 +0300 - - RDMA/mlx5: Fix UMR modifying of mkey page size - - When changing the page size on an mkey, the driver needs to set the - appropriate bits in the mkey mask to indicate which fields are being - modified. - The 6th bit of a page size in mlx5 driver is considered an extension, - and this bit has a dedicated capability and mask bits. - - Previously, the driver was not setting this mask in the mkey mask when - performing page size changes, regardless of its hardware support, - potentially leading to an incorrect page size updates. - - This fixes the issue by setting the relevant bit in the mkey mask when - performing page size changes on an mkey and the 6th bit of this field is - supported by the hardware. - - Fixes: cef7dde8836a ("net/mlx5: Expand mkey page size to support 6 bits") - Signed-off-by: Edward Srouji - Reviewed-by: Michael Guralnik - Link: https://patch.msgid.link/9f43a9c73bf2db6085a99dc836f7137e76579f09.1751979184.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index 5be4426a2884..25601dea9e30 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -32,13 +32,15 @@ static __be64 get_umr_disable_mr_mask(void) - return cpu_to_be64(result); - } - --static __be64 get_umr_update_translation_mask(void) -+static __be64 get_umr_update_translation_mask(struct mlx5_ib_dev *dev) - { - u64 result; - - result = MLX5_MKEY_MASK_LEN | - MLX5_MKEY_MASK_PAGE_SIZE | - MLX5_MKEY_MASK_START_ADDR; -+ if (MLX5_CAP_GEN_2(dev->mdev, umr_log_entity_size_5)) -+ result |= MLX5_MKEY_MASK_PAGE_SIZE_5; - - return cpu_to_be64(result); - } -@@ -654,7 +656,7 @@ static void mlx5r_umr_final_update_xlt(struct mlx5_ib_dev *dev, - flags & MLX5_IB_UPD_XLT_ENABLE || flags & MLX5_IB_UPD_XLT_ADDR; - - if (update_translation) { -- wqe->ctrl_seg.mkey_mask |= get_umr_update_translation_mask(); -+ wqe->ctrl_seg.mkey_mask |= get_umr_update_translation_mask(dev); - if (!mr->ibmr.length) - MLX5_SET(mkc, &wqe->mkey_seg, length64, 1); - } -diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h -index c9e0d0f437af..3b506482b4fa 100644 ---- a/include/linux/mlx5/device.h -+++ b/include/linux/mlx5/device.h -@@ -279,6 +279,7 @@ enum { - MLX5_MKEY_MASK_SMALL_FENCE = 1ull << 23, - MLX5_MKEY_MASK_RELAXED_ORDERING_WRITE = 1ull << 25, - MLX5_MKEY_MASK_FREE = 1ull << 29, -+ MLX5_MKEY_MASK_PAGE_SIZE_5 = 1ull << 42, - MLX5_MKEY_MASK_RELAXED_ORDERING_READ = 1ull << 47, - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1441-net-mlx5-expose-disciplined-fr-counter-through-hca-capabilit.patch b/SOURCES/1441-net-mlx5-expose-disciplined-fr-counter-through-hca-capabilit.patch deleted file mode 100644 index fba761f39..000000000 --- a/SOURCES/1441-net-mlx5-expose-disciplined-fr-counter-through-hca-capabilit.patch +++ /dev/null @@ -1,45 +0,0 @@ -From c23046bf130b75046bc7db82c78d2fd9c1a640b7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5: Expose disciplined_fr_counter through HCA - capabilities in mlx5_ifc -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cbe080f931f48bc7b054008fc2567d1c8c247a89 -Author: Carolina Jubran -Date: Wed Jul 9 15:41:06 2025 +0300 - - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc - - Introduce the `disciplined_fr_counter` capability bit to indicate that - the device’s free-running cycle counter is disciplined to real-time. - - Signed-off-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752064867-16874-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index ebcd5b9b648e..818bc0e06bf2 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -1845,7 +1845,8 @@ struct mlx5_ifc_cmd_hca_cap_bits { - - u8 log_bf_reg_size[0x5]; - -- u8 reserved_at_270[0x3]; -+ u8 disciplined_fr_counter[0x1]; -+ u8 reserved_at_271[0x2]; - u8 qp_error_syndrome[0x1]; - u8 reserved_at_274[0x2]; - u8 lag_dct[0x2]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1442-net-mlx5-ifc-updates-for-disabled-host-pf.patch b/SOURCES/1442-net-mlx5-ifc-updates-for-disabled-host-pf.patch deleted file mode 100644 index 2ded1012a..000000000 --- a/SOURCES/1442-net-mlx5-ifc-updates-for-disabled-host-pf.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 1d023170f39f56f036fcd497e7f39916968648fa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5: IFC updates for disabled host PF - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cd1746cb6555a2238c4aae9f9d60b637a61bf177 -Author: Daniel Jurgens -Date: Wed Jul 9 15:41:07 2025 +0300 - - net/mlx5: IFC updates for disabled host PF - - The port 2 host PF can be disabled, this bit reflects that setting. - - Signed-off-by: Daniel Jurgens - Reviewed-by: William Tu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752064867-16874-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 818bc0e06bf2..74b9f7c16346 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -12382,7 +12382,9 @@ struct mlx5_ifc_mtrc_ctrl_bits { - - struct mlx5_ifc_host_params_context_bits { - u8 host_number[0x8]; -- u8 reserved_at_8[0x7]; -+ u8 reserved_at_8[0x5]; -+ u8 host_pf_not_exist[0x1]; -+ u8 reserved_at_14[0x1]; - u8 host_pf_disabled[0x1]; - u8 host_num_of_vfs[0x10]; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1443-net-mlx5e-create-destroy-pcie-congestion-event-object.patch b/SOURCES/1443-net-mlx5e-create-destroy-pcie-congestion-event-object.patch deleted file mode 100644 index 8850a6318..000000000 --- a/SOURCES/1443-net-mlx5e-create-destroy-pcie-congestion-event-object.patch +++ /dev/null @@ -1,271 +0,0 @@ -From ccb319f355cbf175b471e454325000513fc581b1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:21 -0400 -Subject: [PATCH] net/mlx5e: Create/destroy PCIe Congestion Event object - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ab2b0d4d639435f382583b107997a4ce805a665b -Author: Dragos Tatulea -Date: Tue Jul 15 17:30:20 2025 +0300 - - net/mlx5e: Create/destroy PCIe Congestion Event object - - Add initial infrastructure to create and destroy the PCIe Congestion - Event object if the object is supported. - - The verb for the object creation function is "set" instead of - "create" because the function will accommodate the modify operation - as well in a subsequent patch. - - The next patches will hook it up to the event handler and will add - actual functionality. - - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752589821-145787-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index d292e6a9e22c..650df18a9216 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -29,7 +29,7 @@ mlx5_core-$(CONFIG_MLX5_CORE_EN) += en/rqt.o en/tir.o en/rss.o en/rx_res.o \ - en/reporter_tx.o en/reporter_rx.o en/params.o en/xsk/pool.o \ - en/xsk/setup.o en/xsk/rx.o en/xsk/tx.o en/devlink.o en/ptp.o \ - en/qos.o en/htb.o en/trap.o en/fs_tt_redirect.o en/selq.o \ -- lib/crypto.o lib/sd.o -+ lib/crypto.o lib/sd.o en/pcie_cong_event.o - - # - # Netdev extra -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 866652575105..a4116dfb14f4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -920,6 +920,8 @@ struct mlx5e_priv { - struct notifier_block events_nb; - struct notifier_block blocking_events_nb; - -+ struct mlx5e_pcie_cong_event *cong_event; -+ - struct udp_tunnel_nic_info nic_info; - #ifdef CONFIG_MLX5_CORE_EN_DCB - struct mlx5e_dcbx dcbx; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -new file mode 100644 -index 000000000000..9595f8f9a94d ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -@@ -0,0 +1,140 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+// Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. -+ -+#include "en.h" -+#include "pcie_cong_event.h" -+ -+struct mlx5e_pcie_cong_thresh { -+ u16 inbound_high; -+ u16 inbound_low; -+ u16 outbound_high; -+ u16 outbound_low; -+}; -+ -+struct mlx5e_pcie_cong_event { -+ u64 obj_id; -+ -+ struct mlx5e_priv *priv; -+}; -+ -+/* In units of 0.01 % */ -+static const struct mlx5e_pcie_cong_thresh default_thresh_config = { -+ .inbound_high = 9000, -+ .inbound_low = 7500, -+ .outbound_high = 9000, -+ .outbound_low = 7500, -+}; -+ -+static int -+mlx5_cmd_pcie_cong_event_set(struct mlx5_core_dev *dev, -+ const struct mlx5e_pcie_cong_thresh *config, -+ u64 *obj_id) -+{ -+ u32 in[MLX5_ST_SZ_DW(pcie_cong_event_cmd_in)] = {}; -+ u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)]; -+ void *cong_obj; -+ void *hdr; -+ int err; -+ -+ hdr = MLX5_ADDR_OF(pcie_cong_event_cmd_in, in, hdr); -+ cong_obj = MLX5_ADDR_OF(pcie_cong_event_cmd_in, in, cong_obj); -+ -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, opcode, -+ MLX5_CMD_OP_CREATE_GENERAL_OBJECT); -+ -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, obj_type, -+ MLX5_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT); -+ -+ MLX5_SET(pcie_cong_event_obj, cong_obj, inbound_event_en, 1); -+ MLX5_SET(pcie_cong_event_obj, cong_obj, outbound_event_en, 1); -+ -+ MLX5_SET(pcie_cong_event_obj, cong_obj, -+ inbound_cong_high_threshold, config->inbound_high); -+ MLX5_SET(pcie_cong_event_obj, cong_obj, -+ inbound_cong_low_threshold, config->inbound_low); -+ -+ MLX5_SET(pcie_cong_event_obj, cong_obj, -+ outbound_cong_high_threshold, config->outbound_high); -+ MLX5_SET(pcie_cong_event_obj, cong_obj, -+ outbound_cong_low_threshold, config->outbound_low); -+ -+ err = mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); -+ if (err) -+ return err; -+ -+ *obj_id = MLX5_GET(general_obj_out_cmd_hdr, out, obj_id); -+ -+ mlx5_core_dbg(dev, "PCIe congestion event (obj_id=%llu) created. Config: in: [%u, %u], out: [%u, %u]\n", -+ *obj_id, -+ config->inbound_high, config->inbound_low, -+ config->outbound_high, config->outbound_low); -+ -+ return 0; -+} -+ -+static int mlx5_cmd_pcie_cong_event_destroy(struct mlx5_core_dev *dev, -+ u64 obj_id) -+{ -+ u32 in[MLX5_ST_SZ_DW(pcie_cong_event_cmd_in)] = {}; -+ u32 out[MLX5_ST_SZ_DW(general_obj_out_cmd_hdr)]; -+ void *hdr; -+ -+ hdr = MLX5_ADDR_OF(pcie_cong_event_cmd_in, in, hdr); -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, opcode, -+ MLX5_CMD_OP_DESTROY_GENERAL_OBJECT); -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, obj_type, -+ MLX5_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT); -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, obj_id, obj_id); -+ -+ return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); -+} -+ -+int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) -+{ -+ struct mlx5e_pcie_cong_event *cong_event; -+ struct mlx5_core_dev *mdev = priv->mdev; -+ int err; -+ -+ if (!mlx5_pcie_cong_event_supported(mdev)) -+ return 0; -+ -+ cong_event = kvzalloc_node(sizeof(*cong_event), GFP_KERNEL, -+ mdev->priv.numa_node); -+ if (!cong_event) -+ return -ENOMEM; -+ -+ cong_event->priv = priv; -+ -+ err = mlx5_cmd_pcie_cong_event_set(mdev, &default_thresh_config, -+ &cong_event->obj_id); -+ if (err) { -+ mlx5_core_warn(mdev, "Error creating a PCIe congestion event object\n"); -+ goto err_free; -+ } -+ -+ priv->cong_event = cong_event; -+ -+ return 0; -+ -+err_free: -+ kvfree(cong_event); -+ -+ return err; -+} -+ -+void mlx5e_pcie_cong_event_cleanup(struct mlx5e_priv *priv) -+{ -+ struct mlx5e_pcie_cong_event *cong_event = priv->cong_event; -+ struct mlx5_core_dev *mdev = priv->mdev; -+ -+ if (!cong_event) -+ return; -+ -+ priv->cong_event = NULL; -+ -+ if (mlx5_cmd_pcie_cong_event_destroy(mdev, cong_event->obj_id)) -+ mlx5_core_warn(mdev, "Error destroying PCIe congestion event (obj_id=%llu)\n", -+ cong_event->obj_id); -+ -+ kvfree(cong_event); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.h b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.h -new file mode 100644 -index 000000000000..b1ea46bf648a ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.h -@@ -0,0 +1,10 @@ -+/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ -+/* Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. */ -+ -+#ifndef __MLX5_PCIE_CONG_EVENT_H__ -+#define __MLX5_PCIE_CONG_EVENT_H__ -+ -+int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv); -+void mlx5e_pcie_cong_event_cleanup(struct mlx5e_priv *priv); -+ -+#endif /* __MLX5_PCIE_CONG_EVENT_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 0396ec0928d5..5503882839b8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -76,6 +76,7 @@ - #include "en/trap.h" - #include "lib/devcom.h" - #include "lib/sd.h" -+#include "en/pcie_cong_event.h" - - static bool mlx5e_hw_gro_supported(struct mlx5_core_dev *mdev) - { -@@ -5972,6 +5973,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv) - if (mlx5e_monitor_counter_supported(priv)) - mlx5e_monitor_counter_init(priv); - -+ mlx5e_pcie_cong_event_init(priv); - mlx5e_hv_vhca_stats_create(priv); - if (netdev->reg_state != NETREG_REGISTERED) - return; -@@ -6002,6 +6004,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv) - - mlx5e_nic_set_rx_mode(priv); - -+ mlx5e_pcie_cong_event_cleanup(priv); - mlx5e_hv_vhca_stats_destroy(priv); - if (mlx5e_monitor_counter_supported(priv)) - mlx5e_monitor_counter_cleanup(priv); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index 2e02bdea8361..c518380c4ce7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -495,4 +495,17 @@ static inline int mlx5_max_eq_cap_get(const struct mlx5_core_dev *dev) - - return 1 << MLX5_CAP_GEN(dev, log_max_eq); - } -+ -+static inline bool mlx5_pcie_cong_event_supported(struct mlx5_core_dev *dev) -+{ -+ u64 features = MLX5_CAP_GEN_2_64(dev, general_obj_types_127_64); -+ -+ if (!(features & MLX5_HCA_CAP_2_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT)) -+ return false; -+ -+ if (dev->sd) -+ return false; -+ -+ return true; -+} - #endif /* __MLX5_CORE_H__ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1444-net-mlx5e-add-device-pcie-congestion-ethtool-stats.patch b/SOURCES/1444-net-mlx5e-add-device-pcie-congestion-ethtool-stats.patch deleted file mode 100644 index f90122146..000000000 --- a/SOURCES/1444-net-mlx5e-add-device-pcie-congestion-ethtool-stats.patch +++ /dev/null @@ -1,360 +0,0 @@ -From cd788818a76e7ddc52d8ae6184196774d92e14cd Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:22 -0400 -Subject: [PATCH] net/mlx5e: Add device PCIe congestion ethtool stats - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8890ee6dcf6e3d396677308553a8a57f29c7109e -Author: Dragos Tatulea -Date: Tue Jul 15 17:30:21 2025 +0300 - - net/mlx5e: Add device PCIe congestion ethtool stats - - Implement the PCIe Congestion Event notifier which triggers a work item - to query the PCIe Congestion Event object. The result of the congestion - state is reflected in the new ethtool stats: - - * pci_bw_inbound_high: the device has crossed the high threshold for - inbound PCIe traffic. - * pci_bw_inbound_low: the device has crossed the low threshold for - inbound PCIe traffic - * pci_bw_outbound_high: the device has crossed the high threshold for - outbound PCIe traffic. - * pci_bw_outbound_low: the device has crossed the low threshold for - outbound PCIe traffic - - The high and low thresholds are currently configured at 90% and 75%. - These are hysteresis thresholds which help to check if the - PCI bus on the device side is in a congested state. - - If low + 1 = high then the device is in a congested state. If low == high - then the device is not in a congested state. - - The counters are also documented. - - A follow-up patch will make the thresholds configurable. - - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752589821-145787-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst b/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -index 43d72c8b713b..754c81436408 100644 ---- a/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -+++ b/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -@@ -1341,3 +1341,35 @@ Device Counters - - The number of times the device owned queue had not enough buffers - allocated. - - Error -+ -+ * - `pci_bw_inbound_high` -+ - The number of times the device crossed the high inbound pcie bandwidth -+ threshold. To be compared to pci_bw_inbound_low to check if the device -+ is in a congested state. -+ If pci_bw_inbound_high == pci_bw_inbound_low then the device is not congested. -+ If pci_bw_inbound_high > pci_bw_inbound_low then the device is congested. -+ - Tnformative -+ -+ * - `pci_bw_inbound_low` -+ - The number of times the device crossed the low inbound PCIe bandwidth -+ threshold. To be compared to pci_bw_inbound_high to check if the device -+ is in a congested state. -+ If pci_bw_inbound_high == pci_bw_inbound_low then the device is not congested. -+ If pci_bw_inbound_high > pci_bw_inbound_low then the device is congested. -+ - Informative -+ -+ * - `pci_bw_outbound_high` -+ - The number of times the device crossed the high outbound pcie bandwidth -+ threshold. To be compared to pci_bw_outbound_low to check if the device -+ is in a congested state. -+ If pci_bw_outbound_high == pci_bw_outbound_low then the device is not congested. -+ If pci_bw_outbound_high > pci_bw_outbound_low then the device is congested. -+ - Informative -+ -+ * - `pci_bw_outbound_low` -+ - The number of times the device crossed the low outbound PCIe bandwidth -+ threshold. To be compared to pci_bw_outbound_high to check if the device -+ is in a congested state. -+ If pci_bw_outbound_high == pci_bw_outbound_low then the device is not congested. -+ If pci_bw_outbound_high > pci_bw_outbound_low then the device is congested. -+ - Informative -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -index 9595f8f9a94d..0ed017569a19 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -@@ -4,6 +4,13 @@ - #include "en.h" - #include "pcie_cong_event.h" - -+#define MLX5E_CONG_HIGH_STATE 0x7 -+ -+enum { -+ MLX5E_INBOUND_CONG = BIT(0), -+ MLX5E_OUTBOUND_CONG = BIT(1), -+}; -+ - struct mlx5e_pcie_cong_thresh { - u16 inbound_high; - u16 inbound_low; -@@ -11,10 +18,27 @@ struct mlx5e_pcie_cong_thresh { - u16 outbound_low; - }; - -+struct mlx5e_pcie_cong_stats { -+ u32 pci_bw_inbound_high; -+ u32 pci_bw_inbound_low; -+ u32 pci_bw_outbound_high; -+ u32 pci_bw_outbound_low; -+}; -+ - struct mlx5e_pcie_cong_event { - u64 obj_id; - - struct mlx5e_priv *priv; -+ -+ /* For event notifier and workqueue. */ -+ struct work_struct work; -+ struct mlx5_nb nb; -+ -+ /* Stores last read state. */ -+ u8 state; -+ -+ /* For ethtool stats group. */ -+ struct mlx5e_pcie_cong_stats stats; - }; - - /* In units of 0.01 % */ -@@ -25,6 +49,51 @@ static const struct mlx5e_pcie_cong_thresh default_thresh_config = { - .outbound_low = 7500, - }; - -+static const struct counter_desc mlx5e_pcie_cong_stats_desc[] = { -+ { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -+ pci_bw_inbound_high) }, -+ { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -+ pci_bw_inbound_low) }, -+ { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -+ pci_bw_outbound_high) }, -+ { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -+ pci_bw_outbound_low) }, -+}; -+ -+#define NUM_PCIE_CONG_COUNTERS ARRAY_SIZE(mlx5e_pcie_cong_stats_desc) -+ -+static MLX5E_DECLARE_STATS_GRP_OP_NUM_STATS(pcie_cong) -+{ -+ return priv->cong_event ? NUM_PCIE_CONG_COUNTERS : 0; -+} -+ -+static MLX5E_DECLARE_STATS_GRP_OP_UPDATE_STATS(pcie_cong) {} -+ -+static MLX5E_DECLARE_STATS_GRP_OP_FILL_STRS(pcie_cong) -+{ -+ if (!priv->cong_event) -+ return; -+ -+ for (int i = 0; i < NUM_PCIE_CONG_COUNTERS; i++) -+ ethtool_puts(data, mlx5e_pcie_cong_stats_desc[i].format); -+} -+ -+static MLX5E_DECLARE_STATS_GRP_OP_FILL_STATS(pcie_cong) -+{ -+ if (!priv->cong_event) -+ return; -+ -+ for (int i = 0; i < NUM_PCIE_CONG_COUNTERS; i++) { -+ u32 ctr = MLX5E_READ_CTR32_CPU(&priv->cong_event->stats, -+ mlx5e_pcie_cong_stats_desc, -+ i); -+ -+ mlx5e_ethtool_put_stat(data, ctr); -+ } -+} -+ -+MLX5E_DEFINE_STATS_GRP(pcie_cong, 0); -+ - static int - mlx5_cmd_pcie_cong_event_set(struct mlx5_core_dev *dev, - const struct mlx5e_pcie_cong_thresh *config, -@@ -89,6 +158,97 @@ static int mlx5_cmd_pcie_cong_event_destroy(struct mlx5_core_dev *dev, - return mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); - } - -+static int mlx5_cmd_pcie_cong_event_query(struct mlx5_core_dev *dev, -+ u64 obj_id, -+ u32 *state) -+{ -+ u32 in[MLX5_ST_SZ_DW(pcie_cong_event_cmd_in)] = {}; -+ u32 out[MLX5_ST_SZ_DW(pcie_cong_event_cmd_out)]; -+ void *obj; -+ void *hdr; -+ u8 cong; -+ int err; -+ -+ hdr = MLX5_ADDR_OF(pcie_cong_event_cmd_in, in, hdr); -+ -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, opcode, -+ MLX5_CMD_OP_QUERY_GENERAL_OBJECT); -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, obj_type, -+ MLX5_GENERAL_OBJECT_TYPES_PCIE_CONG_EVENT); -+ MLX5_SET(general_obj_in_cmd_hdr, hdr, obj_id, obj_id); -+ -+ err = mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); -+ if (err) -+ return err; -+ -+ obj = MLX5_ADDR_OF(pcie_cong_event_cmd_out, out, cong_obj); -+ -+ if (state) { -+ cong = MLX5_GET(pcie_cong_event_obj, obj, inbound_cong_state); -+ if (cong == MLX5E_CONG_HIGH_STATE) -+ *state |= MLX5E_INBOUND_CONG; -+ -+ cong = MLX5_GET(pcie_cong_event_obj, obj, outbound_cong_state); -+ if (cong == MLX5E_CONG_HIGH_STATE) -+ *state |= MLX5E_OUTBOUND_CONG; -+ } -+ -+ return 0; -+} -+ -+static void mlx5e_pcie_cong_event_work(struct work_struct *work) -+{ -+ struct mlx5e_pcie_cong_event *cong_event; -+ struct mlx5_core_dev *dev; -+ struct mlx5e_priv *priv; -+ u32 new_cong_state = 0; -+ u32 changes; -+ int err; -+ -+ cong_event = container_of(work, struct mlx5e_pcie_cong_event, work); -+ priv = cong_event->priv; -+ dev = priv->mdev; -+ -+ err = mlx5_cmd_pcie_cong_event_query(dev, cong_event->obj_id, -+ &new_cong_state); -+ if (err) { -+ mlx5_core_warn(dev, "Error %d when querying PCIe cong event object (obj_id=%llu).\n", -+ err, cong_event->obj_id); -+ return; -+ } -+ -+ changes = cong_event->state ^ new_cong_state; -+ if (!changes) -+ return; -+ -+ cong_event->state = new_cong_state; -+ -+ if (changes & MLX5E_INBOUND_CONG) { -+ if (new_cong_state & MLX5E_INBOUND_CONG) -+ cong_event->stats.pci_bw_inbound_high++; -+ else -+ cong_event->stats.pci_bw_inbound_low++; -+ } -+ -+ if (changes & MLX5E_OUTBOUND_CONG) { -+ if (new_cong_state & MLX5E_OUTBOUND_CONG) -+ cong_event->stats.pci_bw_outbound_high++; -+ else -+ cong_event->stats.pci_bw_outbound_low++; -+ } -+} -+ -+static int mlx5e_pcie_cong_event_handler(struct notifier_block *nb, -+ unsigned long event, void *eqe) -+{ -+ struct mlx5e_pcie_cong_event *cong_event; -+ -+ cong_event = mlx5_nb_cof(nb, struct mlx5e_pcie_cong_event, nb); -+ queue_work(cong_event->priv->wq, &cong_event->work); -+ -+ return NOTIFY_OK; -+} -+ - int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - { - struct mlx5e_pcie_cong_event *cong_event; -@@ -103,6 +263,10 @@ int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - if (!cong_event) - return -ENOMEM; - -+ INIT_WORK(&cong_event->work, mlx5e_pcie_cong_event_work); -+ MLX5_NB_INIT(&cong_event->nb, mlx5e_pcie_cong_event_handler, -+ OBJECT_CHANGE); -+ - cong_event->priv = priv; - - err = mlx5_cmd_pcie_cong_event_set(mdev, &default_thresh_config, -@@ -112,10 +276,18 @@ int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - goto err_free; - } - -+ err = mlx5_eq_notifier_register(mdev, &cong_event->nb); -+ if (err) { -+ mlx5_core_warn(mdev, "Error registering notifier for the PCIe congestion event\n"); -+ goto err_obj_destroy; -+ } -+ - priv->cong_event = cong_event; - - return 0; - -+err_obj_destroy: -+ mlx5_cmd_pcie_cong_event_destroy(mdev, cong_event->obj_id); - err_free: - kvfree(cong_event); - -@@ -132,6 +304,9 @@ void mlx5e_pcie_cong_event_cleanup(struct mlx5e_priv *priv) - - priv->cong_event = NULL; - -+ mlx5_eq_notifier_unregister(mdev, &cong_event->nb); -+ cancel_work_sync(&cong_event->work); -+ - if (mlx5_cmd_pcie_cong_event_destroy(mdev, cong_event->obj_id)) - mlx5_core_warn(mdev, "Error destroying PCIe congestion event (obj_id=%llu)\n", - cong_event->obj_id); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -index 19664fa7f217..87536f158d07 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -@@ -2612,6 +2612,7 @@ mlx5e_stats_grp_t mlx5e_nic_stats_grps[] = { - #ifdef CONFIG_MLX5_MACSEC - &MLX5E_STATS_GRP(macsec_hw), - #endif -+ &MLX5E_STATS_GRP(pcie_cong), - }; - - unsigned int mlx5e_nic_stats_grps_num(struct mlx5e_priv *priv) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -index def5dea1463d..72dbcc1928ef 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.h -@@ -535,5 +535,6 @@ extern MLX5E_DECLARE_STATS_GRP(ipsec_hw); - extern MLX5E_DECLARE_STATS_GRP(ipsec_sw); - extern MLX5E_DECLARE_STATS_GRP(ptp); - extern MLX5E_DECLARE_STATS_GRP(macsec_hw); -+extern MLX5E_DECLARE_STATS_GRP(pcie_cong); - - #endif /* __MLX5_EN_STATS_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -index dfb079e59d85..66dce17219a6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -@@ -585,6 +585,9 @@ static void gather_async_events_mask(struct mlx5_core_dev *dev, u64 mask[4]) - async_event_mask |= - (1ull << MLX5_EVENT_TYPE_OBJECT_CHANGE); - -+ if (mlx5_pcie_cong_event_supported(dev)) -+ async_event_mask |= (1ull << MLX5_EVENT_TYPE_OBJECT_CHANGE); -+ - mask[0] = async_event_mask; - - if (MLX5_CAP_GEN(dev, event_cap)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1445-net-mlx5-fix-an-is-err-vs-null-bug-in-esw-qos-move-node.patch b/SOURCES/1445-net-mlx5-fix-an-is-err-vs-null-bug-in-esw-qos-move-node.patch deleted file mode 100644 index 966233f24..000000000 --- a/SOURCES/1445-net-mlx5-fix-an-is-err-vs-null-bug-in-esw-qos-move-node.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 3896bc463eaccebeeb68c34cf97221d49c43f0b3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:22 -0400 -Subject: [PATCH] net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 49be1e245ea3e3515c5989ce1af215d8500dec85 -Author: Dan Carpenter -Date: Tue Jul 15 18:01:30 2025 -0500 - - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() - - The __esw_qos_alloc_node() function returns NULL on error. It doesn't - return error pointers. Update the error checking to match. - - Fixes: 96619c485fa6 ("net/mlx5: Add support for setting tc-bw on nodes") - Signed-off-by: Dan Carpenter - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/0ce4ec2a-2b5d-4652-9638-e715a99902a7@sabinyo.mountain - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index e1cef8dd3b4d..91d863c8c152 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1405,9 +1405,10 @@ esw_qos_move_node(struct mlx5_esw_sched_node *curr_node) - - new_node = __esw_qos_alloc_node(curr_node->esw, curr_node->ix, - curr_node->type, NULL); -- if (!IS_ERR(new_node)) -- esw_qos_nodes_set_parent(&curr_node->children, new_node); -+ if (!new_node) -+ return ERR_PTR(-ENOMEM); - -+ esw_qos_nodes_set_parent(&curr_node->children, new_node); - return new_node; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1446-net-mlx5-hws-enable-ipsec-hardware-offload-in-legacy-mode.patch b/SOURCES/1446-net-mlx5-hws-enable-ipsec-hardware-offload-in-legacy-mode.patch deleted file mode 100644 index 1bb00c3a7..000000000 --- a/SOURCES/1446-net-mlx5-hws-enable-ipsec-hardware-offload-in-legacy-mode.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 714f88650e67c8c680525cd46b6a1ba36654fce9 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:22 -0400 -Subject: [PATCH] net/mlx5: HWS, Enable IPSec hardware offload in legacy mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 159846ffbaf5e723b4eafdf6f951028cfda61601 -Author: Lama Kayal -Date: Wed Jul 16 17:17:47 2025 +0300 - - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode - - IPSec hardware offload in legacy mode should not be affected by the - steering mode, hence it should also work properly with hmfs mode. - - Remove steering mode validation when calculating the cap for packet - offload, this will also enable the missing cap MLX5_IPSEC_CAP_PRIO - needed for crypto offload. - - Signed-off-by: Lama Kayal - Reviewed-by: Jianbo Liu - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Link: https://patch.msgid.link/1752675472-201445-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -index 820debf3fbbf..ef7322d381af 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_offload.c -@@ -42,8 +42,7 @@ u32 mlx5_ipsec_device_caps(struct mlx5_core_dev *mdev) - - if (MLX5_CAP_IPSEC(mdev, ipsec_full_offload) && - (mdev->priv.steering->mode == MLX5_FLOW_STEERING_MODE_DMFS || -- (mdev->priv.steering->mode == MLX5_FLOW_STEERING_MODE_SMFS && -- is_mdev_legacy_mode(mdev)))) { -+ is_mdev_legacy_mode(mdev))) { - if (MLX5_CAP_FLOWTABLE_NIC_TX(mdev, - reformat_add_esp_trasport) && - MLX5_CAP_FLOWTABLE_NIC_RX(mdev, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1447-net-mlx5e-fix-kdoc-warning-on-eswitch-h.patch b/SOURCES/1447-net-mlx5e-fix-kdoc-warning-on-eswitch-h.patch deleted file mode 100644 index 22307dcab..000000000 --- a/SOURCES/1447-net-mlx5e-fix-kdoc-warning-on-eswitch-h.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 97e26aa456907b095f3c1ee54b720ccca2bac2e4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:22 -0400 -Subject: [PATCH] net/mlx5e: fix kdoc warning on eswitch.h - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 394d31d52fb64f622f51a461a4d7fc0c683a980f -Author: Moshe Shemesh -Date: Wed Jul 16 17:17:48 2025 +0300 - - net/mlx5e: fix kdoc warning on eswitch.h - - Fix the following kdoc warning: - git ls-files *.[ch] | egrep drivers/net/ethernet/mellanox/mlx5/core/ |\ - xargs scripts/kernel-doc --none - drivers/net/ethernet/mellanox/mlx5/core/eswitch.h:824: warning: cannot - understand function prototype: 'struct mlx5_esw_event_info ' - - Signed-off-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Link: https://patch.msgid.link/1752675472-201445-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index d59fdcb29cb8..b0b8ef3ec3c4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -827,7 +827,7 @@ void mlx5_esw_vport_vhca_id_clear(struct mlx5_eswitch *esw, u16 vport_num); - int mlx5_eswitch_vhca_id_to_vport(struct mlx5_eswitch *esw, u16 vhca_id, u16 *vport_num); - - /** -- * mlx5_esw_event_info - Indicates eswitch mode changed/changing. -+ * struct mlx5_esw_event_info - Indicates eswitch mode changed/changing. - * - * @new_mode: New mode of eswitch. - */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1448-net-mlx5e-properly-access-rcu-protected-qdisc-sleeping-varia.patch b/SOURCES/1448-net-mlx5e-properly-access-rcu-protected-qdisc-sleeping-varia.patch deleted file mode 100644 index 718adad51..000000000 --- a/SOURCES/1448-net-mlx5e-properly-access-rcu-protected-qdisc-sleeping-varia.patch +++ /dev/null @@ -1,50 +0,0 @@ -From e124614f134e8ae058d0a4bbd972e283f8f6a3cb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:03:22 -0400 -Subject: [PATCH] net/mlx5e: Properly access RCU protected qdisc_sleeping - variable - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2a601b2d35623065d31ebaf697b07502d54878c9 -Author: Leon Romanovsky -Date: Wed Jul 16 17:17:49 2025 +0300 - - net/mlx5e: Properly access RCU protected qdisc_sleeping variable - - qdisc_sleeping variable is declared as "struct Qdisc __rcu" and - as such needs proper annotation while accessing it. - - Without rtnl_dereference(), the following error is generated by sparse: - - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: warning: - incorrect type in initializer (different address spaces) - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: expected - struct Qdisc *qdisc - drivers/net/ethernet/mellanox/mlx5/core/en/qos.c:377:40: got struct - Qdisc [noderef] __rcu *qdisc_sleeping - - Signed-off-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Link: https://patch.msgid.link/1752675472-201445-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -index f0744a45db92..4e461cb03b83 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/qos.c -@@ -374,7 +374,7 @@ void mlx5e_reactivate_qos_sq(struct mlx5e_priv *priv, u16 qid, struct netdev_que - void mlx5e_reset_qdisc(struct net_device *dev, u16 qid) - { - struct netdev_queue *dev_queue = netdev_get_tx_queue(dev, qid); -- struct Qdisc *qdisc = dev_queue->qdisc_sleeping; -+ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc_sleeping); - - if (!qdisc) - return; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1449-net-mlx5-add-ifc-bits-to-support-rss-for-ipsec-offload.patch b/SOURCES/1449-net-mlx5-add-ifc-bits-to-support-rss-for-ipsec-offload.patch deleted file mode 100644 index beed06c45..000000000 --- a/SOURCES/1449-net-mlx5-add-ifc-bits-to-support-rss-for-ipsec-offload.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 5b55319dbd507f05d71a112154a2cfb085f0e6e3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5: Add IFC bits to support RSS for IPSec offload - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 438794e93f6271af93f0d16a1851725115b5fd51 -Author: Jianbo Liu -Date: Thu Jul 17 09:48:13 2025 +0300 - - net/mlx5: Add IFC bits to support RSS for IPSec offload - - This adds the capabilities, ipsec_next_header and inner/outer - l4_type_ext fields to support RSS for the decrypted packets. - - These fields are specifically for firmware steering. HWS validation - logic is updated to correctly handle the changes, ensuring the - unsupported fields are not set. - - Besides, reserved_at_c4 is fixed to reserved_at_d4 to reflect the - accurate offset within the structure. - - Signed-off-by: Jianbo Liu - Reviewed-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752734895-257735-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index d45e1145d197..c6436c3a7a83 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -727,8 +727,9 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || -- HWS_IS_FLD_SET_SZ(match_param, outer_headers.reserved_at_c2, 0xe) || -- HWS_IS_FLD_SET_SZ(match_param, outer_headers.reserved_at_c4, 0x4)) { -+ HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type_ext, 0x4) || -+ HWS_IS_FLD_SET_SZ(match_param, outer_headers.reserved_at_c6, 0xa) || -+ HWS_IS_FLD_SET_SZ(match_param, outer_headers.reserved_at_d4, 0x4)) { - mlx5hws_err(cd->ctx, "Unsupported outer parameters set\n"); - return -EINVAL; - } -@@ -903,8 +904,9 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, - u32 *s_ipv6, *d_ipv6; - - if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || -- HWS_IS_FLD_SET_SZ(match_param, inner_headers.reserved_at_c2, 0xe) || -- HWS_IS_FLD_SET_SZ(match_param, inner_headers.reserved_at_c4, 0x4)) { -+ HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type_ext, 0x4) || -+ HWS_IS_FLD_SET_SZ(match_param, inner_headers.reserved_at_c6, 0xa) || -+ HWS_IS_FLD_SET_SZ(match_param, inner_headers.reserved_at_d4, 0x4)) { - mlx5hws_err(cd->ctx, "Unsupported inner parameters set\n"); - return -EINVAL; - } -@@ -1279,7 +1281,8 @@ hws_definer_conv_misc2(struct mlx5hws_definer_conv_data *cd, - struct mlx5hws_definer_fc *curr_fc; - - if (HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.reserved_at_1a0, 0x8) || -- HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.reserved_at_1b8, 0x8) || -+ HWS_IS_FLD_SET_SZ(match_param, -+ misc_parameters_2.ipsec_next_header, 0x8) || - HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.reserved_at_1c0, 0x40) || - HWS_IS_FLD_SET(match_param, misc_parameters_2.macsec_syndrome) || - HWS_IS_FLD_SET(match_param, misc_parameters_2.ipsec_syndrome)) { -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 74b9f7c16346..f6b8a4bfab26 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -420,7 +420,8 @@ struct mlx5_ifc_flow_table_fields_supported_bits { - - /* Table 2170 - Flow Table Fields Supported 2 Format */ - struct mlx5_ifc_flow_table_fields_supported_2_bits { -- u8 reserved_at_0[0x2]; -+ u8 inner_l4_type_ext[0x1]; -+ u8 outer_l4_type_ext[0x1]; - u8 inner_l4_type[0x1]; - u8 outer_l4_type[0x1]; - u8 reserved_at_4[0xa]; -@@ -429,7 +430,11 @@ struct mlx5_ifc_flow_table_fields_supported_2_bits { - u8 tunnel_header_0_1[0x1]; - u8 reserved_at_11[0xf]; - -- u8 reserved_at_20[0x60]; -+ u8 reserved_at_20[0xf]; -+ u8 ipsec_next_header[0x1]; -+ u8 reserved_at_30[0x10]; -+ -+ u8 reserved_at_40[0x40]; - }; - - struct mlx5_ifc_flow_table_prop_layout_bits { -@@ -552,6 +557,13 @@ enum { - MLX5_PACKET_L4_TYPE_UDP, - }; - -+enum { -+ MLX5_PACKET_L4_TYPE_EXT_NONE, -+ MLX5_PACKET_L4_TYPE_EXT_TCP, -+ MLX5_PACKET_L4_TYPE_EXT_UDP, -+ MLX5_PACKET_L4_TYPE_EXT_ICMP, -+}; -+ - struct mlx5_ifc_fte_match_set_lyr_2_4_bits { - u8 smac_47_16[0x20]; - -@@ -578,10 +590,10 @@ struct mlx5_ifc_fte_match_set_lyr_2_4_bits { - u8 tcp_dport[0x10]; - - u8 l4_type[0x2]; -- u8 reserved_at_c2[0xe]; -+ u8 l4_type_ext[0x4]; -+ u8 reserved_at_c6[0xa]; - u8 ipv4_ihl[0x4]; -- u8 reserved_at_c4[0x4]; -- -+ u8 reserved_at_d4[0x4]; - u8 ttl_hoplimit[0x8]; - - u8 udp_sport[0x10]; -@@ -689,10 +701,9 @@ struct mlx5_ifc_fte_match_set_misc2_bits { - u8 metadata_reg_a[0x20]; - - u8 reserved_at_1a0[0x8]; -- - u8 macsec_syndrome[0x8]; - u8 ipsec_syndrome[0x8]; -- u8 reserved_at_1b8[0x8]; -+ u8 ipsec_next_header[0x8]; - - u8 reserved_at_1c0[0x40]; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1450-net-mlx5-add-ifc-bits-and-enums-for-buf-ownership.patch b/SOURCES/1450-net-mlx5-add-ifc-bits-and-enums-for-buf-ownership.patch deleted file mode 100644 index f5189e32f..000000000 --- a/SOURCES/1450-net-mlx5-add-ifc-bits-and-enums-for-buf-ownership.patch +++ /dev/null @@ -1,60 +0,0 @@ -From a34de299819925d89bfda50f13e278d49eabe506 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5: Add IFC bits and enums for buf_ownership - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6f09ee0b583cad4f2b6a82842c26235bee3d5c2e -Author: Oren Sidi -Date: Thu Jul 17 09:48:14 2025 +0300 - - net/mlx5: Add IFC bits and enums for buf_ownership - - Extend structure layouts and defines buf_ownership. - buf_ownership indicates whether the buffer is managed by SW or FW. - - Signed-off-by: Oren Sidi - Reviewed-by: Alex Lazar - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752734895-257735-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index f6b8a4bfab26..0bb817b8c697 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -10473,8 +10473,16 @@ struct mlx5_ifc_pifr_reg_bits { - u8 port_filter_update_en[8][0x20]; - }; - -+enum { -+ MLX5_BUF_OWNERSHIP_UNKNOWN = 0x0, -+ MLX5_BUF_OWNERSHIP_FW_OWNED = 0x1, -+ MLX5_BUF_OWNERSHIP_SW_OWNED = 0x2, -+}; -+ - struct mlx5_ifc_pfcc_reg_bits { -- u8 reserved_at_0[0x8]; -+ u8 reserved_at_0[0x4]; -+ u8 buf_ownership[0x2]; -+ u8 reserved_at_6[0x2]; - u8 local_port[0x8]; - u8 reserved_at_10[0xb]; - u8 ppan_mask_n[0x1]; -@@ -10610,7 +10618,9 @@ struct mlx5_ifc_pcam_enhanced_features_bits { - u8 fec_200G_per_lane_in_pplm[0x1]; - u8 reserved_at_1e[0x2a]; - u8 fec_100G_per_lane_in_pplm[0x1]; -- u8 reserved_at_49[0x1f]; -+ u8 reserved_at_49[0xa]; -+ u8 buffer_ownership[0x1]; -+ u8 resereved_at_54[0x14]; - u8 fec_50G_per_lane_in_pplm[0x1]; - u8 reserved_at_69[0x4]; - u8 rx_icrc_encapsulated_counter[0x1]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1451-net-mlx5-expose-cable-length-field-in-pfcc-register.patch b/SOURCES/1451-net-mlx5-expose-cable-length-field-in-pfcc-register.patch deleted file mode 100644 index fca44f5af..000000000 --- a/SOURCES/1451-net-mlx5-expose-cable-length-field-in-pfcc-register.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 028519c5490c7b257c0f4e93a467c313351e5602 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5: Expose cable_length field in PFCC register - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9a0048e0ae14cb7babfd459ec920234e8a2ab86e -Author: Oren Sidi -Date: Thu Jul 17 09:48:15 2025 +0300 - - net/mlx5: Expose cable_length field in PFCC register - - Introduce new "cable_length" field in PFCC register and related fields - to enhance rx buffer configuration management: - 1. cable_length: Shifts cable length handling to fw by storing a - manually entered length from user in PFCC.cable_length - 2. lane_rate_oper: In a case where PFCC.cable_length is not supported, - helps compute a default cable length - - Signed-off-by: Oren Sidi - Reviewed-by: Alex Lazar - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1752734895-257735-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 0bb817b8c697..21ed80a892a7 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -9993,6 +9993,10 @@ struct mlx5_ifc_pude_reg_bits { - u8 reserved_at_20[0x60]; - }; - -+enum { -+ MLX5_PTYS_CONNECTOR_TYPE_PORT_DA = 0x7, -+}; -+ - struct mlx5_ifc_ptys_reg_bits { - u8 reserved_at_0[0x1]; - u8 an_disable_admin[0x1]; -@@ -10029,7 +10033,8 @@ struct mlx5_ifc_ptys_reg_bits { - u8 ib_link_width_oper[0x10]; - u8 ib_proto_oper[0x10]; - -- u8 reserved_at_160[0x1c]; -+ u8 reserved_at_160[0x8]; -+ u8 lane_rate_oper[0x14]; - u8 connector_type[0x4]; - - u8 eth_proto_lp_advertise[0x20]; -@@ -10484,7 +10489,8 @@ struct mlx5_ifc_pfcc_reg_bits { - u8 buf_ownership[0x2]; - u8 reserved_at_6[0x2]; - u8 local_port[0x8]; -- u8 reserved_at_10[0xb]; -+ u8 reserved_at_10[0xa]; -+ u8 cable_length_mask[0x1]; - u8 ppan_mask_n[0x1]; - u8 minor_stall_mask[0x1]; - u8 critical_stall_mask[0x1]; -@@ -10513,7 +10519,10 @@ struct mlx5_ifc_pfcc_reg_bits { - u8 device_stall_minor_watermark[0x10]; - u8 device_stall_critical_watermark[0x10]; - -- u8 reserved_at_a0[0x60]; -+ u8 reserved_at_a0[0x18]; -+ u8 cable_length[0x8]; -+ -+ u8 reserved_at_c0[0x40]; - }; - - struct mlx5_ifc_pelc_reg_bits { -@@ -10614,7 +10623,9 @@ struct mlx5_ifc_mtutc_reg_bits { - struct mlx5_ifc_pcam_enhanced_features_bits { - u8 reserved_at_0[0x10]; - u8 ppcnt_recovery_counters[0x1]; -- u8 reserved_at_11[0xc]; -+ u8 reserved_at_11[0x7]; -+ u8 cable_length[0x1]; -+ u8 reserved_at_19[0x4]; - u8 fec_200G_per_lane_in_pplm[0x1]; - u8 reserved_at_1e[0x2a]; - u8 fec_100G_per_lane_in_pplm[0x1]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1452-net-mlx5e-shampo-cleanup-reservation-size-formula.patch b/SOURCES/1452-net-mlx5e-shampo-cleanup-reservation-size-formula.patch deleted file mode 100644 index a6bcf5dcb..000000000 --- a/SOURCES/1452-net-mlx5e-shampo-cleanup-reservation-size-formula.patch +++ /dev/null @@ -1,145 +0,0 @@ -From 543d15cff83bf56fc1377b9d635e9e88d981de46 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO, Cleanup reservation size formula - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bc2d44b83f2b333719560740068663a2b405deaf -Author: Lama Kayal -Date: Mon Jul 21 10:13:17 2025 +0300 - - net/mlx5e: SHAMPO, Cleanup reservation size formula - - The reservation size formula can be reduced to a simple evaluation of - MLX5E_SHAMPO_WQ_RESRV_SIZE. This leaves mlx5e_shampo_get_log_rsrv_size() - with one single use, which can be replaced with a macro for simplicity. - - Also, function mlx5e_shampo_get_log_rsrv_size() is used only throughout - params.c, make it static. - - Signed-off-by: Lama Kayal - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/1753081999-326247-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index a4116dfb14f4..8b39c49a3c2a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -85,8 +85,9 @@ struct page_pool; - #define MLX5E_SHAMPO_WQ_HEADER_PER_PAGE (PAGE_SIZE >> MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE) - #define MLX5E_SHAMPO_LOG_WQ_HEADER_PER_PAGE (PAGE_SHIFT - MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE) - #define MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE (64) --#define MLX5E_SHAMPO_WQ_RESRV_SIZE (64 * 1024) --#define MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE (4096) -+#define MLX5E_SHAMPO_WQ_RESRV_SIZE_BASE_SHIFT (12) -+#define MLX5E_SHAMPO_WQ_LOG_RESRV_SIZE (16) -+#define MLX5E_SHAMPO_WQ_RESRV_SIZE BIT(MLX5E_SHAMPO_WQ_LOG_RESRV_SIZE) - - #define MLX5_MPWRQ_MIN_LOG_STRIDE_SZ(mdev) \ - (6 + MLX5_CAP_GEN(mdev, cache_line_128byte)) /* HW restriction */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index fc945bce933a..86f6147de22b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -420,19 +420,10 @@ u8 mlx5e_shampo_get_log_hd_entry_size(struct mlx5_core_dev *mdev, - return order_base_2(DIV_ROUND_UP(MLX5E_RX_MAX_HEAD, MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE)); - } - --u8 mlx5e_shampo_get_log_rsrv_size(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params) -+static u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5e_params *params) - { -- return order_base_2(MLX5E_SHAMPO_WQ_RESRV_SIZE / MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE); --} -- --u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params) --{ -- u32 resrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -- MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; -- -- return order_base_2(DIV_ROUND_UP(resrv_size, params->sw_mtu)); -+ return order_base_2(DIV_ROUND_UP(MLX5E_SHAMPO_WQ_RESRV_SIZE, -+ params->sw_mtu)); - } - - u8 mlx5e_mpwqe_get_log_stride_size(struct mlx5_core_dev *mdev, -@@ -834,13 +825,12 @@ static u32 mlx5e_shampo_get_log_cq_size(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_xsk_param *xsk) - { -- int rsrv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -- MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; - u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, xsk)); -- int pkt_per_rsrv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); - u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, xsk); -+ int pkt_per_rsrv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(params)); - int wq_size = BIT(mlx5e_mpwqe_get_log_rq_size(mdev, params, xsk)); - int wqe_size = BIT(log_stride_sz) * num_strides; -+ int rsrv_size = MLX5E_SHAMPO_WQ_RESRV_SIZE; - - /* +1 is for the case that the pkt_per_rsrv dont consume the reservation - * so we get a filler cqe for the rest of the reservation. -@@ -932,10 +922,11 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, - - MLX5_SET(wq, wq, shampo_enable, true); - MLX5_SET(wq, wq, log_reservation_size, -- mlx5e_shampo_get_log_rsrv_size(mdev, params)); -+ MLX5E_SHAMPO_WQ_LOG_RESRV_SIZE - -+ MLX5E_SHAMPO_WQ_RESRV_SIZE_BASE_SHIFT); - MLX5_SET(wq, wq, - log_max_num_of_packets_per_reservation, -- mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); -+ mlx5e_shampo_get_log_pkt_per_rsrv(params)); - MLX5_SET(wq, wq, log_headers_entry_size, - mlx5e_shampo_get_log_hd_entry_size(mdev, params)); - lro_timeout = -@@ -1048,18 +1039,17 @@ u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rq_param) - { -- int resv_size = BIT(mlx5e_shampo_get_log_rsrv_size(mdev, params)) * -- MLX5E_SHAMPO_WQ_BASE_RESRV_SIZE; - u16 num_strides = BIT(mlx5e_mpwqe_get_log_num_strides(mdev, params, NULL)); -- int pkt_per_resv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(mdev, params)); - u8 log_stride_sz = mlx5e_mpwqe_get_log_stride_size(mdev, params, NULL); -+ int pkt_per_rsrv = BIT(mlx5e_shampo_get_log_pkt_per_rsrv(params)); - int wqe_size = BIT(log_stride_sz) * num_strides; -+ int rsrv_size = MLX5E_SHAMPO_WQ_RESRV_SIZE; - u32 hd_per_wqe; - - /* Assumption: hd_per_wqe % 8 == 0. */ -- hd_per_wqe = (wqe_size / resv_size) * pkt_per_resv; -- mlx5_core_dbg(mdev, "%s hd_per_wqe = %d rsrv_size = %d wqe_size = %d pkt_per_resv = %d\n", -- __func__, hd_per_wqe, resv_size, wqe_size, pkt_per_resv); -+ hd_per_wqe = (wqe_size / rsrv_size) * pkt_per_rsrv; -+ mlx5_core_dbg(mdev, "%s hd_per_wqe = %d rsrv_size = %d wqe_size = %d pkt_per_rsrv = %d\n", -+ __func__, hd_per_wqe, rsrv_size, wqe_size, pkt_per_rsrv); - return hd_per_wqe; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -index bd5877acc5b1..919895f64dcd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -@@ -97,10 +97,6 @@ u8 mlx5e_mpwqe_get_log_rq_size(struct mlx5_core_dev *mdev, - struct mlx5e_xsk_param *xsk); - u8 mlx5e_shampo_get_log_hd_entry_size(struct mlx5_core_dev *mdev, - struct mlx5e_params *params); --u8 mlx5e_shampo_get_log_rsrv_size(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params); --u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params); - u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rq_param); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1453-net-mlx5e-shampo-remove-mlx5e-shampo-get-log-hd-entry-size.patch b/SOURCES/1453-net-mlx5e-shampo-remove-mlx5e-shampo-get-log-hd-entry-size.patch deleted file mode 100644 index 803fe5e4f..000000000 --- a/SOURCES/1453-net-mlx5e-shampo-remove-mlx5e-shampo-get-log-hd-entry-size.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 120cdc1802d8b873c3e75e1f0bfe0f784a78b0ea Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO, Remove - mlx5e_shampo_get_log_hd_entry_size() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit eee529c0044e06959a40c6dba6d85df493f54fc3 -Author: Lama Kayal -Date: Mon Jul 21 10:13:18 2025 +0300 - - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() - - Refactor mlx5e_shampo_get_log_hd_entry_size() as macro, for more - simplicity. - - Signed-off-by: Lama Kayal - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/1753081999-326247-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 8b39c49a3c2a..765180379e62 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -84,7 +84,7 @@ struct page_pool; - #define MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE (9) - #define MLX5E_SHAMPO_WQ_HEADER_PER_PAGE (PAGE_SIZE >> MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE) - #define MLX5E_SHAMPO_LOG_WQ_HEADER_PER_PAGE (PAGE_SHIFT - MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE) --#define MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE (64) -+#define MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE_SHIFT (6) - #define MLX5E_SHAMPO_WQ_RESRV_SIZE_BASE_SHIFT (12) - #define MLX5E_SHAMPO_WQ_LOG_RESRV_SIZE (16) - #define MLX5E_SHAMPO_WQ_RESRV_SIZE BIT(MLX5E_SHAMPO_WQ_LOG_RESRV_SIZE) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 86f6147de22b..3cca06a74cf9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -414,12 +414,6 @@ u8 mlx5e_mpwqe_get_log_rq_size(struct mlx5_core_dev *mdev, - return params->log_rq_mtu_frames - log_pkts_per_wqe; - } - --u8 mlx5e_shampo_get_log_hd_entry_size(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params) --{ -- return order_base_2(DIV_ROUND_UP(MLX5E_RX_MAX_HEAD, MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE)); --} -- - static u8 mlx5e_shampo_get_log_pkt_per_rsrv(struct mlx5e_params *params) - { - return order_base_2(DIV_ROUND_UP(MLX5E_SHAMPO_WQ_RESRV_SIZE, -@@ -928,7 +922,8 @@ int mlx5e_build_rq_param(struct mlx5_core_dev *mdev, - log_max_num_of_packets_per_reservation, - mlx5e_shampo_get_log_pkt_per_rsrv(params)); - MLX5_SET(wq, wq, log_headers_entry_size, -- mlx5e_shampo_get_log_hd_entry_size(mdev, params)); -+ MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE - -+ MLX5E_SHAMPO_WQ_BASE_HEAD_ENTRY_SIZE_SHIFT); - lro_timeout = - mlx5e_choose_lro_timeout(mdev, - MLX5E_DEFAULT_SHAMPO_TIMEOUT); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -index 919895f64dcd..488ccdbc1e2c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -@@ -95,8 +95,6 @@ bool mlx5e_rx_mpwqe_is_linear_skb(struct mlx5_core_dev *mdev, - u8 mlx5e_mpwqe_get_log_rq_size(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_xsk_param *xsk); --u8 mlx5e_shampo_get_log_hd_entry_size(struct mlx5_core_dev *mdev, -- struct mlx5e_params *params); - u32 mlx5e_shampo_hd_per_wqe(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, - struct mlx5e_rq_param *rq_param); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1454-net-mlx5e-remove-duplicate-mkey-from-shampo-header.patch b/SOURCES/1454-net-mlx5e-remove-duplicate-mkey-from-shampo-header.patch deleted file mode 100644 index 3bc528947..000000000 --- a/SOURCES/1454-net-mlx5e-remove-duplicate-mkey-from-shampo-header.patch +++ /dev/null @@ -1,142 +0,0 @@ -From df022bfa01899f989571317ef32c93103244750e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:04 -0400 -Subject: [PATCH] net/mlx5e: Remove duplicate mkey from SHAMPO header - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit eeaf11464f38db9307b7d9ed6c7750b83c344ff8 -Author: Lama Kayal -Date: Mon Jul 21 10:13:19 2025 +0300 - - net/mlx5e: Remove duplicate mkey from SHAMPO header - - SHAMPO structure holds two variations of the mkey, which is unnecessary, - a duplication that's repeated per rq. - - Remove duplicate mkey information and keep only one version, the one - used in the fast path, rename field to reflect field type clearly. - - Signed-off-by: Lama Kayal - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/1753081999-326247-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 765180379e62..130756b1cc94 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -630,14 +630,13 @@ struct mlx5e_dma_info { - }; - - struct mlx5e_shampo_hd { -- u32 mkey; - struct mlx5e_frag_page *pages; - u32 hd_per_wq; - u16 hd_per_wqe; - unsigned long *bitmap; - u16 pi; - u16 ci; -- __be32 key; -+ __be32 mkey_be; - }; - - struct mlx5e_hw_gro_data { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 5503882839b8..91c1d56d79f5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -546,18 +546,26 @@ static int mlx5e_create_rq_umr_mkey(struct mlx5_core_dev *mdev, struct mlx5e_rq - } - - static int mlx5e_create_rq_hd_umr_mkey(struct mlx5_core_dev *mdev, -- u16 hd_per_wq, u32 *umr_mkey) -+ u16 hd_per_wq, __be32 *umr_mkey) - { - u32 max_ksm_size = BIT(MLX5_CAP_GEN(mdev, log_max_klm_list_size)); -+ u32 mkey; -+ int err; - - if (max_ksm_size < hd_per_wq) { - mlx5_core_err(mdev, "max ksm list size 0x%x is smaller than shampo header buffer list size 0x%x\n", - max_ksm_size, hd_per_wq); - return -EINVAL; - } -- return mlx5e_create_umr_ksm_mkey(mdev, hd_per_wq, -- MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE, -- umr_mkey); -+ -+ err = mlx5e_create_umr_ksm_mkey(mdev, hd_per_wq, -+ MLX5E_SHAMPO_LOG_HEADER_ENTRY_SIZE, -+ &mkey); -+ if (err) -+ return err; -+ -+ *umr_mkey = cpu_to_be32(mkey); -+ return 0; - } - - static void mlx5e_init_frags_partition(struct mlx5e_rq *rq) -@@ -781,11 +789,10 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - goto err_shampo_hd_info_alloc; - - err = mlx5e_create_rq_hd_umr_mkey(mdev, hd_per_wq, -- &rq->mpwqe.shampo->mkey); -+ &rq->mpwqe.shampo->mkey_be); - if (err) - goto err_umr_mkey; - -- rq->mpwqe.shampo->key = cpu_to_be32(rq->mpwqe.shampo->mkey); - rq->mpwqe.shampo->hd_per_wqe = - mlx5e_shampo_hd_per_wqe(mdev, params, rqp); - wq_size = BIT(MLX5_GET(wq, wqc, log_wq_sz)); -@@ -830,7 +837,7 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - err_hw_gro_data: - page_pool_destroy(rq->hd_page_pool); - err_hds_page_pool: -- mlx5_core_destroy_mkey(mdev, rq->mpwqe.shampo->mkey); -+ mlx5_core_destroy_mkey(mdev, be32_to_cpu(rq->mpwqe.shampo->mkey_be)); - err_umr_mkey: - mlx5e_rq_shampo_hd_info_free(rq); - err_shampo_hd_info_alloc: -@@ -847,7 +854,8 @@ static void mlx5e_rq_free_shampo(struct mlx5e_rq *rq) - if (rq->hd_page_pool != rq->page_pool) - page_pool_destroy(rq->hd_page_pool); - mlx5e_rq_shampo_hd_info_free(rq); -- mlx5_core_destroy_mkey(rq->mdev, rq->mpwqe.shampo->mkey); -+ mlx5_core_destroy_mkey(rq->mdev, -+ be32_to_cpu(rq->mpwqe.shampo->mkey_be)); - kvfree(rq->mpwqe.shampo); - } - -@@ -1115,7 +1123,8 @@ int mlx5e_create_rq(struct mlx5e_rq *rq, struct mlx5e_rq_param *param, u16 q_cou - if (test_bit(MLX5E_RQ_STATE_SHAMPO, &rq->state)) { - MLX5_SET(wq, wq, log_headers_buffer_entry_num, - order_base_2(rq->mpwqe.shampo->hd_per_wq)); -- MLX5_SET(wq, wq, headers_mkey, rq->mpwqe.shampo->mkey); -+ MLX5_SET(wq, wq, headers_mkey, -+ be32_to_cpu(rq->mpwqe.shampo->mkey_be)); - } - - mlx5_fill_page_frag_array(&rq->wq_ctrl.buf, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 36a4780332d7..724c5db20c19 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -676,7 +676,7 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - wqe_bbs = MLX5E_KSM_UMR_WQEBBS(ksm_entries); - pi = mlx5e_icosq_get_next_pi(sq, wqe_bbs); - umr_wqe = mlx5_wq_cyc_get_wqe(&sq->wq, pi); -- build_ksm_umr(sq, umr_wqe, shampo->key, index, ksm_entries); -+ build_ksm_umr(sq, umr_wqe, shampo->mkey_be, index, ksm_entries); - - WARN_ON_ONCE(ksm_entries & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)); - while (i < ksm_entries) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1455-pci-tph-expose-pcie-tph-get-st-table-size.patch b/SOURCES/1455-pci-tph-expose-pcie-tph-get-st-table-size.patch deleted file mode 100644 index 29ebd3834..000000000 --- a/SOURCES/1455-pci-tph-expose-pcie-tph-get-st-table-size.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 73ba61cbb0ce67722aa9069f6abc63761e6877b2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:08:11 -0400 -Subject: [PATCH] PCI/TPH: Expose pcie_tph_get_st_table_size() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 0a61ec9cc51b0e43981222005444508437e95b33 -Author: Yishai Hadas -Date: Thu Jul 17 15:17:25 2025 +0300 - - PCI/TPH: Expose pcie_tph_get_st_table_size() - - Expose pcie_tph_get_st_table_size() to be used by drivers as will be - done in the next patch from the series. - - Signed-off-by: Yishai Hadas - Acked-by: Bjorn Helgaas - Link: https://patch.msgid.link/9ae851e0ee42cc56d2a30276e116b65091030ceb.1752752567.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c -index 07de59ca2ebf..6822c2e3f93f 100644 ---- a/drivers/pci/tph.c -+++ b/drivers/pci/tph.c -@@ -168,7 +168,7 @@ static u32 get_st_table_loc(struct pci_dev *pdev) - * Return the size of ST table. If ST table is not in TPH Requester Extended - * Capability space, return 0. Otherwise return the ST Table Size + 1. - */ --static u16 get_st_table_size(struct pci_dev *pdev) -+u16 pcie_tph_get_st_table_size(struct pci_dev *pdev) - { - u32 reg; - u32 loc; -@@ -185,6 +185,7 @@ static u16 get_st_table_size(struct pci_dev *pdev) - - return FIELD_GET(PCI_TPH_CAP_ST_MASK, reg) + 1; - } -+EXPORT_SYMBOL(pcie_tph_get_st_table_size); - - /* Return device's Root Port completer capability */ - static u8 get_rp_completer_type(struct pci_dev *pdev) -@@ -253,7 +254,7 @@ static int write_tag_to_st_table(struct pci_dev *pdev, int index, u16 tag) - int offset; - - /* Check if index is out of bound */ -- st_table_size = get_st_table_size(pdev); -+ st_table_size = pcie_tph_get_st_table_size(pdev); - if (index >= st_table_size) - return -ENXIO; - -@@ -485,7 +486,7 @@ void pci_restore_tph_state(struct pci_dev *pdev) - pci_write_config_dword(pdev, pdev->tph_cap + PCI_TPH_CTRL, *cap++); - st_entry = (u16 *)cap; - offset = PCI_TPH_BASE_SIZEOF; -- num_entries = get_st_table_size(pdev); -+ num_entries = pcie_tph_get_st_table_size(pdev); - for (i = 0; i < num_entries; i++) { - pci_write_config_word(pdev, pdev->tph_cap + offset, - *st_entry++); -@@ -517,7 +518,7 @@ void pci_save_tph_state(struct pci_dev *pdev) - /* Save all ST entries in extended capability structure */ - st_entry = (u16 *)cap; - offset = PCI_TPH_BASE_SIZEOF; -- num_entries = get_st_table_size(pdev); -+ num_entries = pcie_tph_get_st_table_size(pdev); - for (i = 0; i < num_entries; i++) { - pci_read_config_word(pdev, pdev->tph_cap + offset, - st_entry++); -@@ -541,7 +542,7 @@ void pci_tph_init(struct pci_dev *pdev) - if (!pdev->tph_cap) - return; - -- num_entries = get_st_table_size(pdev); -+ num_entries = pcie_tph_get_st_table_size(pdev); - save_size = sizeof(u32) + num_entries * sizeof(u16); - pci_add_ext_cap_save_buffer(pdev, PCI_EXT_CAP_ID_TPH, save_size); - } -diff --git a/include/linux/pci-tph.h b/include/linux/pci-tph.h -index c3e806c13d64..9e4e331b1603 100644 ---- a/include/linux/pci-tph.h -+++ b/include/linux/pci-tph.h -@@ -28,6 +28,7 @@ int pcie_tph_get_cpu_st(struct pci_dev *dev, - unsigned int cpu_uid, u16 *tag); - void pcie_disable_tph(struct pci_dev *pdev); - int pcie_enable_tph(struct pci_dev *pdev, int mode); -+u16 pcie_tph_get_st_table_size(struct pci_dev *pdev); - #else - static inline int pcie_tph_set_st_entry(struct pci_dev *pdev, - unsigned int index, u16 tag) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1456-net-mlx5-expose-ifc-bits-for-tph.patch b/SOURCES/1456-net-mlx5-expose-ifc-bits-for-tph.patch deleted file mode 100644 index 581adafee..000000000 --- a/SOURCES/1456-net-mlx5-expose-ifc-bits-for-tph.patch +++ /dev/null @@ -1,65 +0,0 @@ -From cd08612ff17299301ce7302f125ed6c09670a1eb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Thu, 16 Apr 2026 18:04:05 -0400 -Subject: [PATCH] net/mlx5: Expose IFC bits for TPH - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5f9ec7880e6b3c4d0cf242fe28506d0b084328b1 -Author: Yishai Hadas -Date: Thu Jul 17 15:17:26 2025 +0300 - - net/mlx5: Expose IFC bits for TPH - - Expose IFC bits for the TPH functionality. - - Signed-off-by: Yishai Hadas - Reviewed-by: Edward Srouji - Reviewed-by: Moshe Shemesh - Link: https://patch.msgid.link/38ea3a0d56551364214e8edf359c9c77c9a3b71b.1752752567.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 21ed80a892a7..fd3bedd8dbcb 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -1870,7 +1870,9 @@ struct mlx5_ifc_cmd_hca_cap_bits { - u8 reserved_at_280[0x10]; - u8 max_wqe_sz_sq[0x10]; - -- u8 reserved_at_2a0[0xb]; -+ u8 reserved_at_2a0[0x7]; -+ u8 mkey_pcie_tph[0x1]; -+ u8 reserved_at_2a8[0x3]; - u8 shampo[0x1]; - u8 reserved_at_2ac[0x4]; - u8 max_wqe_sz_rq[0x10]; -@@ -4417,6 +4419,10 @@ enum { - MLX5_MKC_ACCESS_MODE_CROSSING = 0x6, - }; - -+enum { -+ MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX = 0, -+}; -+ - struct mlx5_ifc_mkc_bits { - u8 reserved_at_0[0x1]; - u8 free[0x1]; -@@ -4468,7 +4474,11 @@ struct mlx5_ifc_mkc_bits { - u8 relaxed_ordering_read[0x1]; - u8 log_page_size[0x6]; - -- u8 reserved_at_1e0[0x20]; -+ u8 reserved_at_1e0[0x5]; -+ u8 pcie_tph_en[0x1]; -+ u8 pcie_tph_ph[0x2]; -+ u8 pcie_tph_steering_tag_index[0x8]; -+ u8 reserved_at_1f0[0x10]; - }; - - struct mlx5_ifc_pkey_bits { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1457-net-mlx5-add-support-for-device-steering-tag.patch b/SOURCES/1457-net-mlx5-add-support-for-device-steering-tag.patch deleted file mode 100644 index da663705b..000000000 --- a/SOURCES/1457-net-mlx5-add-support-for-device-steering-tag.patch +++ /dev/null @@ -1,348 +0,0 @@ -From 5034908f65e9590cfbd34d152e901eca8fa0af9b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:20:02 -0400 -Subject: [PATCH] net/mlx5: Add support for device steering tag - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -A context diff due to the leftover defenition of "struct mlx5_thermal" -that was suppose to be deleted by the following commit: -c9398e30c639 ("net/mlx5: Expose NIC temperature via hardware monitoring kernel API") - -commit 888a7776f4fb04c19bec70c737c61c2f383c6b1e -Author: Yishai Hadas -Date: Thu Jul 17 15:17:27 2025 +0300 - - net/mlx5: Add support for device steering tag - - Background, from PCIe specification 6.2. - - TLP Processing Hints (TPH) - -------------------------- - TLP Processing Hints is an optional feature that provides hints in - Request TLP headers to facilitate optimized processing of Requests that - target Memory Space. These Processing Hints enable the system hardware - (e.g., the Root Complex and/or Endpoints) to optimize platform - resources such as system and memory interconnect on a per TLP basis. - Steering Tags are system-specific values used to identify a processing - resource that a Requester explicitly targets. System software discovers - and identifies TPH capabilities to determine the Steering Tag allocation - for each Function that supports TPH. - - This patch adds steering tag support for mlx5 based NICs by: - - - Enabling the TPH functionality over PCI if both FW and OS support it. - - Managing steering tags and their matching steering indexes by - writing a ST to an ST index over the PCI configuration space. - - Exposing APIs to upper layers (e.g.,mlx5_ib) to allow usage of - the PCI TPH infrastructure. - - Further details: - - Upon probing of a device, the feature will be enabled based - on both capability detection and OS support. - - - It will retrieve the appropriate ST for a given CPU ID and memory - type using the pcie_tph_get_cpu_st() API. - - - It will track available ST indices according to the configuration - space table size (expected to be 63 entries), reserving index 0 to - indicate non-TPH use. - - - It will assign a free ST index with a ST using the - pcie_tph_set_st_entry() API. - - - It will reuse the same index for identical (CPU ID + memory type) - combinations by maintaining a reference count per entry. - - - It will expose APIs to upper layers (e.g., mlx5_ib) to allow usage of - the PCI TPH infrastructure. - - - SF will use its parent PF stuff. - - Signed-off-by: Yishai Hadas - Link: https://patch.msgid.link/de1ae7398e9e34eacd8c10845683df44fc9e32f8.1752752567.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index 650df18a9216..a253c73db9e5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -167,5 +167,10 @@ mlx5_core-$(CONFIG_MLX5_SF) += sf/vhca_event.o sf/dev/dev.o sf/dev/driver.o irq_ - # - mlx5_core-$(CONFIG_MLX5_SF_MANAGER) += sf/cmd.o sf/hw_table.o sf/devlink.o - -+# -+# TPH support -+# -+mlx5_core-$(CONFIG_PCIE_TPH) += lib/st.o -+ - obj-$(CONFIG_MLX5_DPLL) += mlx5_dpll.o - mlx5_dpll-y := dpll.o -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c -new file mode 100644 -index 000000000000..47fe215f66bf ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c -@@ -0,0 +1,164 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+/* -+ * Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved -+ */ -+ -+#include -+#include -+ -+#include "mlx5_core.h" -+#include "lib/mlx5.h" -+ -+struct mlx5_st_idx_data { -+ refcount_t usecount; -+ u16 tag; -+}; -+ -+struct mlx5_st { -+ /* serialize access upon alloc/free flows */ -+ struct mutex lock; -+ struct xa_limit index_limit; -+ struct xarray idx_xa; /* key == index, value == struct mlx5_st_idx_data */ -+}; -+ -+struct mlx5_st *mlx5_st_create(struct mlx5_core_dev *dev) -+{ -+ struct pci_dev *pdev = dev->pdev; -+ struct mlx5_st *st; -+ u16 num_entries; -+ int ret; -+ -+ if (!MLX5_CAP_GEN(dev, mkey_pcie_tph)) -+ return NULL; -+ -+#ifdef CONFIG_MLX5_SF -+ if (mlx5_core_is_sf(dev)) -+ return dev->priv.parent_mdev->st; -+#endif -+ -+ /* Checking whether the device is capable */ -+ if (!pdev->tph_cap) -+ return NULL; -+ -+ num_entries = pcie_tph_get_st_table_size(pdev); -+ /* We need a reserved entry for non TPH cases */ -+ if (num_entries < 2) -+ return NULL; -+ -+ /* The OS doesn't support ST */ -+ ret = pcie_enable_tph(pdev, PCI_TPH_ST_DS_MODE); -+ if (ret) -+ return NULL; -+ -+ st = kzalloc(sizeof(*st), GFP_KERNEL); -+ if (!st) -+ goto end; -+ -+ mutex_init(&st->lock); -+ xa_init_flags(&st->idx_xa, XA_FLAGS_ALLOC); -+ /* entry 0 is reserved for non TPH cases */ -+ st->index_limit.min = MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX + 1; -+ st->index_limit.max = num_entries - 1; -+ -+ return st; -+ -+end: -+ pcie_disable_tph(dev->pdev); -+ return NULL; -+} -+ -+void mlx5_st_destroy(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_st *st = dev->st; -+ -+ if (mlx5_core_is_sf(dev) || !st) -+ return; -+ -+ pcie_disable_tph(dev->pdev); -+ WARN_ON_ONCE(!xa_empty(&st->idx_xa)); -+ kfree(st); -+} -+ -+int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type, -+ unsigned int cpu_uid, u16 *st_index) -+{ -+ struct mlx5_st_idx_data *idx_data; -+ struct mlx5_st *st = dev->st; -+ unsigned long index; -+ u32 xa_id; -+ u16 tag; -+ int ret; -+ -+ if (!st) -+ return -EOPNOTSUPP; -+ -+ ret = pcie_tph_get_cpu_st(dev->pdev, mem_type, cpu_uid, &tag); -+ if (ret) -+ return ret; -+ -+ mutex_lock(&st->lock); -+ -+ xa_for_each(&st->idx_xa, index, idx_data) { -+ if (tag == idx_data->tag) { -+ refcount_inc(&idx_data->usecount); -+ *st_index = index; -+ goto end; -+ } -+ } -+ -+ idx_data = kzalloc(sizeof(*idx_data), GFP_KERNEL); -+ if (!idx_data) { -+ ret = -ENOMEM; -+ goto end; -+ } -+ -+ refcount_set(&idx_data->usecount, 1); -+ idx_data->tag = tag; -+ -+ ret = xa_alloc(&st->idx_xa, &xa_id, idx_data, st->index_limit, GFP_KERNEL); -+ if (ret) -+ goto clean_idx_data; -+ -+ ret = pcie_tph_set_st_entry(dev->pdev, xa_id, tag); -+ if (ret) -+ goto clean_idx_xa; -+ -+ *st_index = xa_id; -+ goto end; -+ -+clean_idx_xa: -+ xa_erase(&st->idx_xa, xa_id); -+clean_idx_data: -+ kfree(idx_data); -+end: -+ mutex_unlock(&st->lock); -+ return ret; -+} -+EXPORT_SYMBOL_GPL(mlx5_st_alloc_index); -+ -+int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index) -+{ -+ struct mlx5_st_idx_data *idx_data; -+ struct mlx5_st *st = dev->st; -+ int ret = 0; -+ -+ if (!st) -+ return -EOPNOTSUPP; -+ -+ mutex_lock(&st->lock); -+ idx_data = xa_load(&st->idx_xa, st_index); -+ if (WARN_ON_ONCE(!idx_data)) { -+ ret = -EINVAL; -+ goto end; -+ } -+ -+ if (refcount_dec_and_test(&idx_data->usecount)) { -+ xa_erase(&st->idx_xa, st_index); -+ /* We leave PCI config space as was before, no mkey will refer to it */ -+ } -+ -+end: -+ mutex_unlock(&st->lock); -+ return ret; -+} -+EXPORT_SYMBOL_GPL(mlx5_st_dealloc_index); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 42daaf8387da..f6b04b2ae623 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1102,6 +1102,7 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - } - - dev->dm = mlx5_dm_create(dev); -+ dev->st = mlx5_st_create(dev); - dev->tracer = mlx5_fw_tracer_create(dev); - dev->hv_vhca = mlx5_hv_vhca_create(dev); - dev->rsc_dump = mlx5_rsc_dump_create(dev); -@@ -1150,6 +1151,7 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev) - mlx5_rsc_dump_destroy(dev); - mlx5_hv_vhca_destroy(dev->hv_vhca); - mlx5_fw_tracer_destroy(dev->tracer); -+ mlx5_st_destroy(dev); - mlx5_dm_cleanup(dev); - mlx5_fs_core_free(dev); - mlx5_sf_table_cleanup(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index c518380c4ce7..b6d53db27cd5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -300,6 +300,15 @@ int mlx5_set_mtppse(struct mlx5_core_dev *mdev, u8 pin, u8 arm, u8 mode); - struct mlx5_dm *mlx5_dm_create(struct mlx5_core_dev *dev); - void mlx5_dm_cleanup(struct mlx5_core_dev *dev); - -+#ifdef CONFIG_PCIE_TPH -+struct mlx5_st *mlx5_st_create(struct mlx5_core_dev *dev); -+void mlx5_st_destroy(struct mlx5_core_dev *dev); -+#else -+static inline struct mlx5_st * -+mlx5_st_create(struct mlx5_core_dev *dev) { return NULL; } -+static inline void mlx5_st_destroy(struct mlx5_core_dev *dev) { return; } -+#endif -+ - void mlx5_toggle_port_link(struct mlx5_core_dev *dev); - int mlx5_set_port_admin_status(struct mlx5_core_dev *dev, - enum mlx5_port_status status); -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 39e9146e079d..8c5fbfb85749 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -688,7 +689,7 @@ struct mlx5_fw_tracer; - struct mlx5_vxlan; - struct mlx5_geneve; - struct mlx5_hv_vhca; --struct mlx5_thermal; -+struct mlx5_st; - - #define MLX5_LOG_SW_ICM_BLOCK_SIZE(dev) (MLX5_CAP_DEV_MEM(dev, log_sw_icm_alloc_granularity)) - #define MLX5_SW_ICM_BLOCK_SIZE(dev) (1 << MLX5_LOG_SW_ICM_BLOCK_SIZE(dev)) -@@ -758,6 +759,7 @@ struct mlx5_core_dev { - u32 issi; - struct mlx5e_resources mlx5e_res; - struct mlx5_dm *dm; -+ struct mlx5_st *st; - struct mlx5_vxlan *vxlan; - struct mlx5_geneve *geneve; - struct { -@@ -1161,6 +1163,23 @@ int mlx5_dm_sw_icm_alloc(struct mlx5_core_dev *dev, enum mlx5_sw_icm_type type, - int mlx5_dm_sw_icm_dealloc(struct mlx5_core_dev *dev, enum mlx5_sw_icm_type type, - u64 length, u16 uid, phys_addr_t addr, u32 obj_id); - -+#ifdef CONFIG_PCIE_TPH -+int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type, -+ unsigned int cpu_uid, u16 *st_index); -+int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index); -+#else -+static inline int mlx5_st_alloc_index(struct mlx5_core_dev *dev, -+ enum tph_mem_type mem_type, -+ unsigned int cpu_uid, u16 *st_index) -+{ -+ return -EOPNOTSUPP; -+} -+static inline int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index) -+{ -+ return -EOPNOTSUPP; -+} -+#endif -+ - struct mlx5_core_dev *mlx5_vf_get_core_dev(struct pci_dev *pdev); - void mlx5_vf_put_core_dev(struct mlx5_core_dev *mdev); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1458-net-mlx5-fix-build-wframe-larger-than-warnings.patch b/SOURCES/1458-net-mlx5-fix-build-wframe-larger-than-warnings.patch deleted file mode 100644 index 70899c3f6..000000000 --- a/SOURCES/1458-net-mlx5-fix-build-wframe-larger-than-warnings.patch +++ /dev/null @@ -1,220 +0,0 @@ -From ac499e95a7f84f3fafcf362d7ea068edb6850edf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:25:38 -0400 -Subject: [PATCH] net/mlx5: Fix build -Wframe-larger-than warnings -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4335012705499aa24cec714ab746c0d3abf97cab -Author: Zhu Yanjun -Date: Tue Jul 22 14:20:23 2025 -0700 - - net/mlx5: Fix build -Wframe-larger-than warnings - - When building, the following warnings will appear. - " - pci_irq.c: In function ‘mlx5_ctrl_irq_request’: - pci_irq.c:494:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] - - pci_irq.c: In function ‘mlx5_irq_request_vector’: - pci_irq.c:561:1: warning: the frame size of 1040 bytes is larger than 1024 bytes [-Wframe-larger-than=] - - eq.c: In function ‘comp_irq_request_sf’: - eq.c:897:1: warning: the frame size of 1080 bytes is larger than 1024 bytes [-Wframe-larger-than=] - - irq_affinity.c: In function ‘irq_pool_request_irq’: - irq_affinity.c:74:1: warning: the frame size of 1048 bytes is larger than 1024 bytes [-Wframe-larger-than=] - " - - These warnings indicate that the stack frame size exceeds 1024 bytes in - these functions. - - To resolve this, instead of allocating large memory buffers on the stack, - it is better to use kvzalloc to allocate memory dynamically on the heap. - This approach reduces stack usage and eliminates these frame size warnings. - - Acked-by: Junxian Huang - Signed-off-by: Zhu Yanjun - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250722212023.244296-1-yanjun.zhu@linux.dev - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -index 66dce17219a6..1ab77159409d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -@@ -876,19 +876,25 @@ static int comp_irq_request_sf(struct mlx5_core_dev *dev, u16 vecidx) - { - struct mlx5_irq_pool *pool = mlx5_irq_table_get_comp_irq_pool(dev); - struct mlx5_eq_table *table = dev->priv.eq_table; -- struct irq_affinity_desc af_desc = {}; -+ struct irq_affinity_desc *af_desc; - struct mlx5_irq *irq; - -- /* In case SF irq pool does not exist, fallback to the PF irqs*/ -+ /* In case SF irq pool does not exist, fallback to the PF irqs */ - if (!mlx5_irq_pool_is_sf_pool(pool)) - return comp_irq_request_pci(dev, vecidx); - -- af_desc.is_managed = false; -- cpumask_copy(&af_desc.mask, cpu_online_mask); -- cpumask_andnot(&af_desc.mask, &af_desc.mask, &table->used_cpus); -- irq = mlx5_irq_affinity_request(dev, pool, &af_desc); -- if (IS_ERR(irq)) -+ af_desc = kvzalloc(sizeof(*af_desc), GFP_KERNEL); -+ if (!af_desc) -+ return -ENOMEM; -+ -+ af_desc->is_managed = false; -+ cpumask_copy(&af_desc->mask, cpu_online_mask); -+ cpumask_andnot(&af_desc->mask, &af_desc->mask, &table->used_cpus); -+ irq = mlx5_irq_affinity_request(dev, pool, af_desc); -+ if (IS_ERR(irq)) { -+ kvfree(af_desc); - return PTR_ERR(irq); -+ } - - cpumask_or(&table->used_cpus, &table->used_cpus, mlx5_irq_get_affinity_mask(irq)); - mlx5_core_dbg(pool->dev, "IRQ %u mapped to cpu %*pbl, %u EQs on this irq\n", -@@ -896,6 +902,8 @@ static int comp_irq_request_sf(struct mlx5_core_dev *dev, u16 vecidx) - cpumask_pr_args(mlx5_irq_get_affinity_mask(irq)), - mlx5_irq_read_locked(irq) / MLX5_EQ_REFS_PER_IRQ); - -+ kvfree(af_desc); -+ - return xa_err(xa_store(&table->comp_irqs, vecidx, irq, GFP_KERNEL)); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c b/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -index 2691d88cdee1..82d3c2568244 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -@@ -47,29 +47,40 @@ static int cpu_get_least_loaded(struct mlx5_irq_pool *pool, - static struct mlx5_irq * - irq_pool_request_irq(struct mlx5_irq_pool *pool, struct irq_affinity_desc *af_desc) - { -- struct irq_affinity_desc auto_desc = {}; -+ struct irq_affinity_desc *auto_desc; - struct mlx5_irq *irq; - u32 irq_index; - int err; - -+ auto_desc = kvzalloc(sizeof(*auto_desc), GFP_KERNEL); -+ if (!auto_desc) -+ return ERR_PTR(-ENOMEM); -+ - err = xa_alloc(&pool->irqs, &irq_index, NULL, pool->xa_num_irqs, GFP_KERNEL); -- if (err) -+ if (err) { -+ kvfree(auto_desc); - return ERR_PTR(err); -+ } -+ - if (pool->irqs_per_cpu) { - if (cpumask_weight(&af_desc->mask) > 1) - /* if req_mask contain more then one CPU, set the least loadad CPU - * of req_mask - */ - cpumask_set_cpu(cpu_get_least_loaded(pool, &af_desc->mask), -- &auto_desc.mask); -+ &auto_desc->mask); - else - cpu_get(pool, cpumask_first(&af_desc->mask)); - } -+ - irq = mlx5_irq_alloc(pool, irq_index, -- cpumask_empty(&auto_desc.mask) ? af_desc : &auto_desc, -+ cpumask_empty(&auto_desc->mask) ? af_desc : auto_desc, - NULL); - if (IS_ERR(irq)) - xa_erase(&pool->irqs, irq_index); -+ -+ kvfree(auto_desc); -+ - return irq; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index 40024cfa3099..692ef9c2f729 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -470,26 +470,32 @@ void mlx5_ctrl_irq_release(struct mlx5_core_dev *dev, struct mlx5_irq *ctrl_irq) - struct mlx5_irq *mlx5_ctrl_irq_request(struct mlx5_core_dev *dev) - { - struct mlx5_irq_pool *pool = ctrl_irq_pool_get(dev); -- struct irq_affinity_desc af_desc; -+ struct irq_affinity_desc *af_desc; - struct mlx5_irq *irq; - -- cpumask_copy(&af_desc.mask, cpu_online_mask); -- af_desc.is_managed = false; -+ af_desc = kvzalloc(sizeof(*af_desc), GFP_KERNEL); -+ if (!af_desc) -+ return ERR_PTR(-ENOMEM); -+ -+ cpumask_copy(&af_desc->mask, cpu_online_mask); -+ af_desc->is_managed = false; - if (!mlx5_irq_pool_is_sf_pool(pool)) { - /* In case we are allocating a control IRQ from a pci device's pool. - * This can happen also for a SF if the SFs pool is empty. - */ - if (!pool->xa_num_irqs.max) { -- cpumask_clear(&af_desc.mask); -+ cpumask_clear(&af_desc->mask); - /* In case we only have a single IRQ for PF/VF */ -- cpumask_set_cpu(cpumask_first(cpu_online_mask), &af_desc.mask); -+ cpumask_set_cpu(cpumask_first(cpu_online_mask), &af_desc->mask); - } - /* Allocate the IRQ in index 0. The vector was already allocated */ -- irq = irq_pool_request_vector(pool, 0, &af_desc, NULL); -+ irq = irq_pool_request_vector(pool, 0, af_desc, NULL); - } else { -- irq = mlx5_irq_affinity_request(dev, pool, &af_desc); -+ irq = mlx5_irq_affinity_request(dev, pool, af_desc); - } - -+ kvfree(af_desc); -+ - return irq; - } - -@@ -548,16 +554,26 @@ struct mlx5_irq *mlx5_irq_request_vector(struct mlx5_core_dev *dev, u16 cpu, - { - struct mlx5_irq_table *table = mlx5_irq_table_get(dev); - struct mlx5_irq_pool *pool = table->pcif_pool; -- struct irq_affinity_desc af_desc; - int offset = MLX5_IRQ_VEC_COMP_BASE; -+ struct irq_affinity_desc *af_desc; -+ struct mlx5_irq *irq; -+ -+ af_desc = kvzalloc(sizeof(*af_desc), GFP_KERNEL); -+ if (!af_desc) -+ return ERR_PTR(-ENOMEM); - - if (!pool->xa_num_irqs.max) - offset = 0; - -- af_desc.is_managed = false; -- cpumask_clear(&af_desc.mask); -- cpumask_set_cpu(cpu, &af_desc.mask); -- return mlx5_irq_request(dev, vecidx + offset, &af_desc, rmap); -+ af_desc->is_managed = false; -+ cpumask_clear(&af_desc->mask); -+ cpumask_set_cpu(cpu, &af_desc->mask); -+ -+ irq = mlx5_irq_request(dev, vecidx + offset, af_desc, rmap); -+ -+ kvfree(af_desc); -+ -+ return irq; - } - - static struct mlx5_irq_pool * --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1459-net-fix-typos.patch b/SOURCES/1459-net-fix-typos.patch deleted file mode 100644 index fd3b333bf..000000000 --- a/SOURCES/1459-net-fix-typos.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 51c8ae5f817c369912dd8b597d224bb562481baf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net: Fix typos - -Conflicts: -Include only the mlx5 hunk. - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fe09560f82415d6592e74821e031a76eed173a03 -Author: Bjorn Helgaas -Date: Wed Jul 23 15:15:05 2025 -0500 - - net: Fix typos - - Fix typos in comments and error messages. - - Signed-off-by: Bjorn Helgaas - Reviewed-by: David Arinzon - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250723201528.2908218-1-helgaas@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 130756b1cc94..ebe793bba8dd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -375,7 +375,7 @@ struct mlx5e_sq_dma { - enum mlx5e_dma_map_type type; - }; - --/* Keep this enum consistent with with the corresponding strings array -+/* Keep this enum consistent with the corresponding strings array - * declared in en/reporter_tx.c - */ - enum { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1460-net-mlx5e-clear-read-only-port-buffer-size-in-pbmc-before-up.patch b/SOURCES/1460-net-mlx5e-clear-read-only-port-buffer-size-in-pbmc-before-up.patch deleted file mode 100644 index b3e0ef066..000000000 --- a/SOURCES/1460-net-mlx5e-clear-read-only-port-buffer-size-in-pbmc-before-up.patch +++ /dev/null @@ -1,53 +0,0 @@ -From eb9b792b02f53bb7126f64e8739c50016165d05e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net/mlx5e: Clear Read-Only port buffer size in PBMC before - update - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fd4b97246a23c1149479b88490946bcfbd28de63 -Author: Alexei Lazar -Date: Wed Jul 23 10:44:30 2025 +0300 - - net/mlx5e: Clear Read-Only port buffer size in PBMC before update - - When updating the PBMC register, we read its current value, - modify desired fields, then write it back. - - The port_buffer_size field within PBMC is Read-Only (RO). - If this RO field contains a non-zero value when read, - attempting to write it back will cause the entire PBMC - register update to fail. - - This commit ensures port_buffer_size is explicitly cleared - to zero after reading the PBMC register but before writing - back the modified value. - This allows updates to other fields in the PBMC register to succeed. - - Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") - Signed-off-by: Alexei Lazar - Reviewed-by: Yael Chemla - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1753256672-337784-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 8e25f4ef5ccc..5ae787656a7c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -331,6 +331,9 @@ static int port_set_buffer(struct mlx5e_priv *priv, - if (err) - goto out; - -+ /* RO bits should be set to 0 on write */ -+ MLX5_SET(pbmc_reg, in, port_buffer_size, 0); -+ - err = mlx5e_port_set_pbmc(mdev, in); - out: - kfree(in); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1461-net-mlx5e-remove-skb-secpath-if-xfrm-state-is-not-found.patch b/SOURCES/1461-net-mlx5e-remove-skb-secpath-if-xfrm-state-is-not-found.patch deleted file mode 100644 index eda39b1e4..000000000 --- a/SOURCES/1461-net-mlx5e-remove-skb-secpath-if-xfrm-state-is-not-found.patch +++ /dev/null @@ -1,113 +0,0 @@ -From 5dae68507960568d99b6cd300975915c69f9b0c6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net/mlx5e: Remove skb secpath if xfrm state is not found - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6d19c44b5c6dd72f9a357d0399604ec16a77de3c -Author: Jianbo Liu -Date: Wed Jul 23 10:44:31 2025 +0300 - - net/mlx5e: Remove skb secpath if xfrm state is not found - - Hardware returns a unique identifier for a decrypted packet's xfrm - state, this state is looked up in an xarray. However, the state might - have been freed by the time of this lookup. - - Currently, if the state is not found, only a counter is incremented. - The secpath (sp) extension on the skb is not removed, resulting in - sp->len becoming 0. - - Subsequently, functions like __xfrm_policy_check() attempt to access - fields such as xfrm_input_state(skb)->xso.type (which dereferences - sp->xvec[sp->len - 1]) without first validating sp->len. This leads to - a crash when dereferencing an invalid state pointer. - - This patch prevents the crash by explicitly removing the secpath - extension from the skb if the xfrm state is not found after hardware - decryption. This ensures downstream functions do not operate on a - zero-length secpath. - - BUG: unable to handle page fault for address: ffffffff000002c8 - #PF: supervisor read access in kernel mode - #PF: error_code(0x0000) - not-present page - PGD 282e067 P4D 282e067 PUD 0 - Oops: Oops: 0000 [#1] SMP - CPU: 12 UID: 0 PID: 0 Comm: swapper/12 Not tainted 6.15.0-rc7_for_upstream_min_debug_2025_05_27_22_44 #1 NONE - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 - RIP: 0010:__xfrm_policy_check+0x61a/0xa30 - Code: b6 77 7f 83 e6 02 74 14 4d 8b af d8 00 00 00 41 0f b6 45 05 c1 e0 03 48 98 49 01 c5 41 8b 45 00 83 e8 01 48 98 49 8b 44 c5 10 <0f> b6 80 c8 02 00 00 83 e0 0c 3c 04 0f 84 0c 02 00 00 31 ff 80 fa - RSP: 0018:ffff88885fb04918 EFLAGS: 00010297 - RAX: ffffffff00000000 RBX: 0000000000000002 RCX: 0000000000000000 - RDX: 0000000000000002 RSI: 0000000000000002 RDI: 0000000000000000 - RBP: ffffffff8311af80 R08: 0000000000000020 R09: 00000000c2eda353 - R10: ffff88812be2bbc8 R11: 000000001faab533 R12: ffff88885fb049c8 - R13: ffff88812be2bbc8 R14: 0000000000000000 R15: ffff88811896ae00 - FS: 0000000000000000(0000) GS:ffff8888dca82000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: ffffffff000002c8 CR3: 0000000243050002 CR4: 0000000000372eb0 - DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 - DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 - Call Trace: - - ? try_to_wake_up+0x108/0x4c0 - ? udp4_lib_lookup2+0xbe/0x150 - ? udp_lib_lport_inuse+0x100/0x100 - ? __udp4_lib_lookup+0x2b0/0x410 - __xfrm_policy_check2.constprop.0+0x11e/0x130 - udp_queue_rcv_one_skb+0x1d/0x530 - udp_unicast_rcv_skb+0x76/0x90 - __udp4_lib_rcv+0xa64/0xe90 - ip_protocol_deliver_rcu+0x20/0x130 - ip_local_deliver_finish+0x75/0xa0 - ip_local_deliver+0xc1/0xd0 - ? ip_protocol_deliver_rcu+0x130/0x130 - ip_sublist_rcv+0x1f9/0x240 - ? ip_rcv_finish_core+0x430/0x430 - ip_list_rcv+0xfc/0x130 - __netif_receive_skb_list_core+0x181/0x1e0 - netif_receive_skb_list_internal+0x200/0x360 - ? mlx5e_build_rx_skb+0x1bc/0xda0 [mlx5_core] - gro_receive_skb+0xfd/0x210 - mlx5e_handle_rx_cqe_mpwrq+0x141/0x280 [mlx5_core] - mlx5e_poll_rx_cq+0xcc/0x8e0 [mlx5_core] - ? mlx5e_handle_rx_dim+0x91/0xd0 [mlx5_core] - mlx5e_napi_poll+0x114/0xab0 [mlx5_core] - __napi_poll+0x25/0x170 - net_rx_action+0x32d/0x3a0 - ? mlx5_eq_comp_int+0x8d/0x280 [mlx5_core] - ? notifier_call_chain+0x33/0xa0 - handle_softirqs+0xda/0x250 - irq_exit_rcu+0x6d/0xc0 - common_interrupt+0x81/0xa0 - - - Fixes: b2ac7541e377 ("net/mlx5e: IPsec: Add Connect-X IPsec Rx data path offload") - Signed-off-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Reviewed-by: Yael Chemla - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1753256672-337784-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -index 727fa7c18523..6056106edcc6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_rxtx.c -@@ -327,6 +327,10 @@ void mlx5e_ipsec_offload_handle_rx_skb(struct net_device *netdev, - if (unlikely(!sa_entry)) { - rcu_read_unlock(); - atomic64_inc(&ipsec->sw_stats.ipsec_rx_drop_sadb_miss); -+ /* Clear secpath to prevent invalid dereference -+ * in downstream XFRM policy checks. -+ */ -+ secpath_reset(skb); - return; - } - xfrm_state_hold(sa_entry->x); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1462-net-mlx5e-fix-potential-deadlock-by-deferring-rx-timeout-rec.patch b/SOURCES/1462-net-mlx5e-fix-potential-deadlock-by-deferring-rx-timeout-rec.patch deleted file mode 100644 index 72f64ab0e..000000000 --- a/SOURCES/1462-net-mlx5e-fix-potential-deadlock-by-deferring-rx-timeout-rec.patch +++ /dev/null @@ -1,157 +0,0 @@ -From 8ebb6e8e7eda49cd1bcc7bd9aded34c22d677dcc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net/mlx5e: Fix potential deadlock by deferring RX timeout - recovery - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Adjust the change to use rtnl_trylock(). - -commit e80d65561571db5024fbdd5ec3f5472cfc485d21 -Author: Shahar Shitrit -Date: Wed Jul 23 10:44:32 2025 +0300 - - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery - - mlx5e_reporter_rx_timeout() is currently invoked synchronously - in the driver's open error flow. This causes the thread holding - priv->state_lock to attempt acquiring the devlink lock, which - can result in a circular dependency with other devlink operations. - - For example: - - - Devlink health diagnose flow: - - __devlink_nl_pre_doit() acquires the devlink lock. - - devlink_nl_health_reporter_diagnose_doit() invokes the - driver's diagnose callback. - - mlx5e_rx_reporter_diagnose() then attempts to acquire - priv->state_lock. - - - Driver open flow: - - mlx5e_open() acquires priv->state_lock. - - If an error occurs, devlink_health_reporter may be called, - attempting to acquire the devlink lock. - - To prevent this circular locking scenario, defer the RX timeout - recovery by scheduling it via a workqueue. This ensures that the - recovery work acquires locks in a consistent order: first the - devlink lock, then priv->state_lock. - - Additionally, make the recovery work acquire the netdev instance - lock to safely synchronize with the open/close channel flows, - similar to mlx5e_tx_timeout_work. Repeatedly attempt to acquire - the netdev instance lock until it is taken or the target RQ is no - longer active, as indicated by the MLX5E_STATE_CHANNELS_ACTIVE bit. - - Fixes: 32c57fb26863 ("net/mlx5e: Report and recover from rx timeout") - Signed-off-by: Shahar Shitrit - Reviewed-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1753256672-337784-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index ebe793bba8dd..5e150e083829 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -726,6 +726,7 @@ struct mlx5e_rq { - struct xsk_buff_pool *xsk_pool; - - struct work_struct recover_work; -+ struct work_struct rx_timeout_work; - - /* control */ - struct mlx5_wq_ctrl wq_ctrl; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -index e106f0696486..1b9ea72abc5a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -@@ -170,16 +170,23 @@ static int mlx5e_rx_reporter_err_rq_cqe_recover(void *ctx) - static int mlx5e_rx_reporter_timeout_recover(void *ctx) - { - struct mlx5_eq_comp *eq; -+ struct mlx5e_priv *priv; - struct mlx5e_rq *rq; - int err; - - rq = ctx; -+ priv = rq->priv; -+ -+ mutex_lock(&priv->state_lock); -+ - eq = rq->cq.mcq.eq; - - err = mlx5e_health_channel_eq_recover(rq->netdev, eq, rq->cq.ch_stats); - if (err && rq->icosq) - clear_bit(MLX5E_SQ_STATE_ENABLED, &rq->icosq->state); - -+ mutex_unlock(&priv->state_lock); -+ - return err; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 91c1d56d79f5..4cc80cda8a09 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -676,6 +676,27 @@ static void mlx5e_rq_err_cqe_work(struct work_struct *recover_work) - mlx5e_reporter_rq_cqe_err(rq); - } - -+static void mlx5e_rq_timeout_work(struct work_struct *timeout_work) -+{ -+ struct mlx5e_rq *rq = container_of(timeout_work, -+ struct mlx5e_rq, -+ rx_timeout_work); -+ -+ /* Acquire netdev instance lock to synchronize with channel close and -+ * reopen flows. Either successfully obtain the lock, or detect that -+ * channels are closing for another reason, making this work no longer -+ * necessary. -+ */ -+ while (!rtnl_trylock()) { -+ if (!test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &rq->priv->state)) -+ return; -+ msleep(20); -+ } -+ -+ mlx5e_reporter_rx_timeout(rq); -+ netdev_unlock(rq->netdev); -+} -+ - static int mlx5e_alloc_mpwqe_rq_drop_page(struct mlx5e_rq *rq) - { - rq->wqe_overflow.page = alloc_page(GFP_KERNEL); -@@ -874,6 +895,7 @@ static int mlx5e_alloc_rq(struct mlx5e_params *params, - - rqp->wq.db_numa_node = node; - INIT_WORK(&rq->recover_work, mlx5e_rq_err_cqe_work); -+ INIT_WORK(&rq->rx_timeout_work, mlx5e_rq_timeout_work); - - if (params->xdp_prog) - bpf_prog_inc(params->xdp_prog); -@@ -1254,7 +1276,8 @@ int mlx5e_wait_for_min_rx_wqes(struct mlx5e_rq *rq, int wait_time) - netdev_warn(rq->netdev, "Failed to get min RX wqes on Channel[%d] RQN[0x%x] wq cur_sz(%d) min_rx_wqes(%d)\n", - rq->ix, rq->rqn, mlx5e_rqwq_get_cur_sz(rq), min_wqes); - -- mlx5e_reporter_rx_timeout(rq); -+ queue_work(rq->priv->wq, &rq->rx_timeout_work); -+ - return -ETIMEDOUT; - } - -@@ -1425,6 +1448,7 @@ void mlx5e_close_rq(struct mlx5e_rq *rq) - if (rq->dim) - cancel_work_sync(&rq->dim->work); - cancel_work_sync(&rq->recover_work); -+ cancel_work_sync(&rq->rx_timeout_work); - mlx5e_destroy_rq(rq); - mlx5e_free_rx_descs(rq); - mlx5e_free_rq(rq); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1463-net-mlx5e-support-routed-networks-during-ipsec-macs-initiali.patch b/SOURCES/1463-net-mlx5e-support-routed-networks-during-ipsec-macs-initiali.patch deleted file mode 100644 index 2cd01cafa..000000000 --- a/SOURCES/1463-net-mlx5e-support-routed-networks-during-ipsec-macs-initiali.patch +++ /dev/null @@ -1,158 +0,0 @@ -From 6f1e0e77ee9fe96ebe49a651a1131bbf6435ada0 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net/mlx5e: Support routed networks during IPsec MACs - initialization - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 71670f766b8f4c1490e07ad4394e8e27c03b2e91 -Author: Alexandre Cassen -Date: Tue Jul 22 17:23:47 2025 +0300 - - net/mlx5e: Support routed networks during IPsec MACs initialization - - Remote IPsec tunnel endpoint may refer to a network segment that is - not directly connected to the host. In such a case, IPsec tunnel - endpoints are connected to a router and reachable via a routing path. - In IPsec packet offload mode, HW is initialized with the MAC address - of both IPsec tunnel endpoints. - - Extend the current IPsec init MACs procedure to resolve nexthop for - routed networks. Direct neighbour lookup and probe is still used - for directly connected networks and as a fallback mechanism if fib - lookup fails. - - Signed-off-by: Alexandre Cassen - Signed-off-by: Leon Romanovsky - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Link: https://patch.msgid.link/1753194228-333722-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 77f61cd28a79..00e77c71e201 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - - #include "en.h" - #include "eswitch.h" -@@ -259,9 +260,15 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, - struct mlx5_accel_esp_xfrm_attrs *attrs) - { - struct mlx5_core_dev *mdev = mlx5e_ipsec_sa2dev(sa_entry); -+ struct mlx5e_ipsec_addr *addrs = &attrs->addrs; - struct net_device *netdev = sa_entry->dev; -+ struct xfrm_state *x = sa_entry->x; -+ struct dst_entry *rt_dst_entry; -+ struct flowi4 fl4 = {}; -+ struct flowi6 fl6 = {}; - struct neighbour *n; - u8 addr[ETH_ALEN]; -+ struct rtable *rt; - const void *pkey; - u8 *dst, *src; - -@@ -274,18 +281,89 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, - case XFRM_DEV_OFFLOAD_IN: - src = attrs->dmac; - dst = attrs->smac; -- pkey = &attrs->addrs.saddr.a4; -+ -+ switch (addrs->family) { -+ case AF_INET: -+ fl4.flowi4_proto = x->sel.proto; -+ fl4.daddr = addrs->saddr.a4; -+ fl4.saddr = addrs->daddr.a4; -+ pkey = &addrs->saddr.a4; -+ break; -+ case AF_INET6: -+ fl6.flowi6_proto = x->sel.proto; -+ memcpy(fl6.daddr.s6_addr32, addrs->saddr.a6, 16); -+ memcpy(fl6.saddr.s6_addr32, addrs->daddr.a6, 16); -+ pkey = &addrs->saddr.a6; -+ break; -+ default: -+ return; -+ } - break; - case XFRM_DEV_OFFLOAD_OUT: - src = attrs->smac; - dst = attrs->dmac; -- pkey = &attrs->addrs.daddr.a4; -+ switch (addrs->family) { -+ case AF_INET: -+ fl4.flowi4_proto = x->sel.proto; -+ fl4.daddr = addrs->daddr.a4; -+ fl4.saddr = addrs->saddr.a4; -+ pkey = &addrs->daddr.a4; -+ break; -+ case AF_INET6: -+ fl6.flowi6_proto = x->sel.proto; -+ memcpy(fl6.daddr.s6_addr32, addrs->daddr.a6, 16); -+ memcpy(fl6.saddr.s6_addr32, addrs->saddr.a6, 16); -+ pkey = &addrs->daddr.a6; -+ break; -+ default: -+ return; -+ } - break; - default: - return; - } - - ether_addr_copy(src, addr); -+ -+ /* Destination can refer to a routed network, so perform FIB lookup -+ * to resolve nexthop and get its MAC. Neighbour resolution is used as -+ * fallback. -+ */ -+ switch (addrs->family) { -+ case AF_INET: -+ rt = ip_route_output_key(dev_net(netdev), &fl4); -+ if (IS_ERR(rt)) -+ goto neigh; -+ -+ if (rt->rt_type != RTN_UNICAST) { -+ ip_rt_put(rt); -+ goto neigh; -+ } -+ rt_dst_entry = &rt->dst; -+ break; -+ case AF_INET6: -+ rt_dst_entry = ipv6_stub->ipv6_dst_lookup_flow( -+ dev_net(netdev), NULL, &fl6, NULL); -+ if (IS_ERR(rt_dst_entry)) -+ goto neigh; -+ break; -+ default: -+ return; -+ } -+ -+ n = dst_neigh_lookup(rt_dst_entry, pkey); -+ if (!n) { -+ dst_release(rt_dst_entry); -+ goto neigh; -+ } -+ -+ neigh_ha_snapshot(addr, n, netdev); -+ ether_addr_copy(dst, addr); -+ dst_release(rt_dst_entry); -+ neigh_release(n); -+ return; -+ -+neigh: - n = neigh_lookup(&arp_tbl, pkey, netdev); - if (!n) { - n = neigh_create(&arp_tbl, pkey, netdev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1464-net-mlx5e-expose-tis-via-devlink-tx-reporter-diagnose.patch b/SOURCES/1464-net-mlx5e-expose-tis-via-devlink-tx-reporter-diagnose.patch deleted file mode 100644 index bfc41cbd5..000000000 --- a/SOURCES/1464-net-mlx5e-expose-tis-via-devlink-tx-reporter-diagnose.patch +++ /dev/null @@ -1,78 +0,0 @@ -From f418c4b8d61a2d8f7bdb2a10e71e2bdba863f7be Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:26:59 -0400 -Subject: [PATCH] net/mlx5e: Expose TIS via devlink tx reporter diagnose - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5474ca2118191abe27ba089737eace66a9b51d8f -Author: Feng Liu -Date: Tue Jul 22 17:23:48 2025 +0300 - - net/mlx5e: Expose TIS via devlink tx reporter diagnose - - Underneath "TIS Config" tag expose TIS diagnostic information. - Expose the tisn of each TC under each lag port. - - $ sudo devlink health diagnose auxiliary/mlx5_core.eth.2/131072 reporter tx - ...... - TIS Config: - lag port: 0 tc: 0 tisn: 0 - lag port: 1 tc: 0 tisn: 8 - ...... - - Signed-off-by: Feng Liu - Reviewed-by: Aya Levin - Signed-off-by: Tariq Toukan - Reviewed-by: Michal Swiatkowski - Link: https://patch.msgid.link/1753194228-333722-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -index 2439495e36f8..069ab8aaac5c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -@@ -315,6 +315,30 @@ mlx5e_tx_reporter_diagnose_common_config(struct devlink_health_reporter *reporte - mlx5e_health_fmsg_named_obj_nest_end(fmsg); - } - -+static void -+mlx5e_tx_reporter_diagnose_tis_config(struct devlink_health_reporter *reporter, -+ struct devlink_fmsg *fmsg) -+{ -+ struct mlx5e_priv *priv = devlink_health_reporter_priv(reporter); -+ u8 num_tc = mlx5e_get_dcb_num_tc(&priv->channels.params); -+ u32 tc, i, tisn; -+ -+ devlink_fmsg_arr_pair_nest_start(fmsg, "TIS Config"); -+ for (i = 0; i < mlx5e_get_num_lag_ports(priv->mdev); i++) { -+ for (tc = 0; tc < num_tc; tc++) { -+ tisn = mlx5e_profile_get_tisn(priv->mdev, priv, -+ priv->profile, i, tc); -+ -+ devlink_fmsg_obj_nest_start(fmsg); -+ devlink_fmsg_u32_pair_put(fmsg, "lag port", i); -+ devlink_fmsg_u32_pair_put(fmsg, "tc", tc); -+ devlink_fmsg_u32_pair_put(fmsg, "tisn", tisn); -+ devlink_fmsg_obj_nest_end(fmsg); -+ } -+ } -+ devlink_fmsg_arr_pair_nest_end(fmsg); -+} -+ - static int mlx5e_tx_reporter_diagnose(struct devlink_health_reporter *reporter, - struct devlink_fmsg *fmsg, - struct netlink_ext_ack *extack) -@@ -330,6 +354,7 @@ static int mlx5e_tx_reporter_diagnose(struct devlink_health_reporter *reporter, - goto unlock; - - mlx5e_tx_reporter_diagnose_common_config(reporter, fmsg); -+ mlx5e_tx_reporter_diagnose_tis_config(reporter, fmsg); - devlink_fmsg_arr_pair_nest_start(fmsg, "SQs"); - - for (i = 0; i < priv->channels.num; i++) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1465-net-mlx5-correctly-set-gso-segs-when-lro-is-used.patch b/SOURCES/1465-net-mlx5-correctly-set-gso-segs-when-lro-is-used.patch deleted file mode 100644 index e5ebd299a..000000000 --- a/SOURCES/1465-net-mlx5-correctly-set-gso-segs-when-lro-is-used.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 44d0bcecf55051a134440d9552d7f9e5488eeb75 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: Correctly set gso_segs when LRO is used - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 77bf1c55b2acc7fa3734b14f4561e3d75aea1a90 -Author: Christoph Paasch -Date: Tue Jul 29 11:34:00 2025 -0700 - - net/mlx5: Correctly set gso_segs when LRO is used - - When gso_segs is left at 0, a number of assumptions will end up being - incorrect throughout the stack. - - For example, in the GRO-path, we set NAPI_GRO_CB()->count to gso_segs. - So, if a non-LRO'ed packet followed by an LRO'ed packet is being - processed in GRO, the first one will have NAPI_GRO_CB()->count set to 1 and - the next one to 0 (in dev_gro_receive()). - Since commit 531d0d32de3e - ("net/mlx5: Correctly set gso_size when LRO is used") - these packets will get merged (as their gso_size now matches). - So, we end up in gro_complete() with NAPI_GRO_CB()->count == 1 and thus - don't call inet_gro_complete(). Meaning, checksum-validation in - tcp_checksum_complete() will fail with a "hw csum failure". - - Even before the above mentioned commit, incorrect gso_segs means that other - things like TCP's accounting of incoming packets (tp->segs_in, - data_segs_in, rcv_ooopack) will be incorrect. Which means that if one - does bytes_received/data_segs_in, the result will be bigger than the - MTU. - - Fix this by initializing gso_segs correctly when LRO is used. - - Fixes: e586b3b0baee ("net/mlx5: Ethernet Datapath files") - Reported-by: Gal Pressman - Closes: https://lore.kernel.org/netdev/6583783f-f0fb-4fb1-a415-feec8155bc69@nvidia.com/ - Signed-off-by: Christoph Paasch - Reviewed-by: Gal Pressman - Reviewed-by: Eric Dumazet - Link: https://patch.msgid.link/20250729-mlx5_gso_segs-v1-1-b48c480c1c12@openai.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 724c5db20c19..3301d5495134 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1573,6 +1573,7 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - unsigned int hdrlen = mlx5e_lro_update_hdr(skb, cqe, cqe_bcnt); - - skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt - hdrlen, lro_num_seg); -+ skb_shinfo(skb)->gso_segs = lro_num_seg; - /* Subtract one since we already counted this as one - * "regular" packet in mlx5e_complete_rx_cqe() - */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1466-net-mlx5-hws-fix-bad-parameter-in-cq-creation.patch b/SOURCES/1466-net-mlx5-hws-fix-bad-parameter-in-cq-creation.patch deleted file mode 100644 index 5af0dbc4b..000000000 --- a/SOURCES/1466-net-mlx5-hws-fix-bad-parameter-in-cq-creation.patch +++ /dev/null @@ -1,39 +0,0 @@ -From cd9308a78bfd2a2630260ab69e87f12affdcf017 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, fix bad parameter in CQ creation - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2462c1b9217246a889ec318b3894d84e4dd709c6 -Author: Yevgeny Kliteynik -Date: Sun Aug 17 23:23:17 2025 +0300 - - net/mlx5: HWS, fix bad parameter in CQ creation - - 'cqe_sz' valid value should be 0 for 64-byte CQE. - - Fixes: 2ca62599aa0b ("net/mlx5: HWS, added send engine and context handling") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -index c4b22be19a9b..b0595c9b09e4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -@@ -964,7 +964,6 @@ static int hws_send_ring_open_cq(struct mlx5_core_dev *mdev, - return -ENOMEM; - - MLX5_SET(cqc, cqc_data, uar_page, mdev->priv.uar->index); -- MLX5_SET(cqc, cqc_data, cqe_sz, queue->num_entries); - MLX5_SET(cqc, cqc_data, log_cq_size, ilog2(queue->num_entries)); - - err = hws_send_ring_alloc_cq(mdev, numa_node, queue, cqc_data, cq); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1467-net-mlx5-hws-fix-simple-rules-rehash-error-flow.patch b/SOURCES/1467-net-mlx5-hws-fix-simple-rules-rehash-error-flow.patch deleted file mode 100644 index 9a5c96d1a..000000000 --- a/SOURCES/1467-net-mlx5-hws-fix-simple-rules-rehash-error-flow.patch +++ /dev/null @@ -1,146 +0,0 @@ -From ecf0cb0c6c0e3b29c4e807a8b13feda75d404863 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, fix simple rules rehash error flow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 615b690612b7785ab8632f6a5a941550622e4e36 -Author: Yevgeny Kliteynik -Date: Sun Aug 17 23:23:18 2025 +0300 - - net/mlx5: HWS, fix simple rules rehash error flow - - Moving rules from matcher to matcher should not fail. - However, if it does fail due to various reasons, the error flow - should allow the kernel to continue functioning (albeit with broken - steering rules) instead of going into series of soft lock-ups or - some other problematic behaviour. - - This patch fixes the error flow for moving simple rules: - - If new rule creation fails before it was even enqeued, do not - poll for completion - - If TIMEOUT happened while moving the rule, no point trying - to poll for completions for other rules. Something is broken, - completion won't come, just abort the rehash sequence. - - If some other completion with error received, don't give up. - Continue handling rest of the rules to minimize the damage. - - Make sure that the first error code that was received will - be actually returned to the caller instead of replacing it - with the generic error code. - - All the aforementioned issues stem from the same bad error flow, - so no point fixing them one by one and leaving partially broken - code - fixing them in one patch. - - Fixes: ef94799a8741 ("net/mlx5: HWS, rework rehash loop") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-3-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 92de4b761a83..0219a49b2326 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -74,9 +74,9 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - static int - hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- bool move_error = false, poll_error = false, drain_error = false; - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_matcher *matcher = bwc_matcher->matcher; -+ int drain_error = 0, move_error = 0, poll_error = 0; - u16 bwc_queues = mlx5hws_bwc_queues(ctx); - struct mlx5hws_rule_attr rule_attr; - struct mlx5hws_bwc_rule *bwc_rule; -@@ -99,11 +99,15 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - ret = mlx5hws_matcher_resize_rule_move(matcher, - bwc_rule->rule, - &rule_attr); -- if (unlikely(ret && !move_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: move failed (%d), attempting to move rest of the rules\n", -- ret); -- move_error = true; -+ if (unlikely(ret)) { -+ if (!move_error) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: move failed (%d), attempting to move rest of the rules\n", -+ ret); -+ move_error = ret; -+ } -+ /* Rule wasn't queued, no need to poll */ -+ continue; - } - - pending_rules++; -@@ -111,11 +115,19 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - rule_attr.queue_id, - &pending_rules, - false); -- if (unlikely(ret && !poll_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: poll failed (%d), attempting to move rest of the rules\n", -- ret); -- poll_error = true; -+ if (unlikely(ret)) { -+ if (ret == -ETIMEDOUT) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: timeout polling for completions (%d), aborting rehash\n", -+ ret); -+ return ret; -+ } -+ if (!poll_error) { -+ mlx5hws_err(ctx, -+ "Moving BWC rule: polling for completions failed (%d), attempting to move rest of the rules\n", -+ ret); -+ poll_error = ret; -+ } - } - } - -@@ -126,17 +138,30 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - rule_attr.queue_id, - &pending_rules, - true); -- if (unlikely(ret && !drain_error)) { -- mlx5hws_err(ctx, -- "Moving BWC rule: drain failed (%d), attempting to move rest of the rules\n", -- ret); -- drain_error = true; -+ if (unlikely(ret)) { -+ if (ret == -ETIMEDOUT) { -+ mlx5hws_err(ctx, -+ "Moving bwc rule: timeout draining completions (%d), aborting rehash\n", -+ ret); -+ return ret; -+ } -+ if (!drain_error) { -+ mlx5hws_err(ctx, -+ "Moving bwc rule: drain failed (%d), attempting to move rest of the rules\n", -+ ret); -+ drain_error = ret; -+ } - } - } - } - -- if (move_error || poll_error || drain_error) -- ret = -EINVAL; -+ /* Return the first error that happened */ -+ if (unlikely(move_error)) -+ return move_error; -+ if (unlikely(poll_error)) -+ return poll_error; -+ if (unlikely(drain_error)) -+ return drain_error; - - return ret; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1468-net-mlx5-hws-fix-complex-rules-rehash-error-flow.patch b/SOURCES/1468-net-mlx5-hws-fix-complex-rules-rehash-error-flow.patch deleted file mode 100644 index 80e64cb0e..000000000 --- a/SOURCES/1468-net-mlx5-hws-fix-complex-rules-rehash-error-flow.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 87f9d3bc475e376926bcd033f4d3779713a2f0e3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, fix complex rules rehash error flow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4a842b1bf18a32ee0c25dd6dd98728b786a76fe4 -Author: Yevgeny Kliteynik -Date: Sun Aug 17 23:23:19 2025 +0300 - - net/mlx5: HWS, fix complex rules rehash error flow - - Moving rules from matcher to matcher should not fail. - However, if it does fail due to various reasons, the error flow - should allow the kernel to continue functioning (albeit with broken - steering rules) instead of going into series of soft lock-ups or - some other problematic behaviour. - - Similar to the simple rules, complex rules rehash logic suffers - from the same problems. This patch fixes the error flow for moving - complex rules: - - If new rule creation fails before it was even enqeued, do not - poll for completion - - If TIMEOUT happened while moving the rule, no point trying - to poll for completions for other rules. Something is broken, - completion won't come, just abort the rehash sequence. - - If some other completion with error received, don't give up. - Continue handling rest of the rules to minimize the damage. - - Make sure that the first error code that was received will - be actually returned to the caller instead of replacing it - with the generic error code. - - All the aforementioned issues stem from the same bad error flow, - so no point fixing them one by one and leaving partially broken - code - fixing them in one patch. - - Fixes: 17e0accac577 ("net/mlx5: HWS, support complex matchers") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -index ca7501c57468..14e79579c719 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -@@ -1328,11 +1328,11 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - { - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_matcher *matcher = bwc_matcher->matcher; -- bool move_error = false, poll_error = false; - u16 bwc_queues = mlx5hws_bwc_queues(ctx); - struct mlx5hws_bwc_rule *tmp_bwc_rule; - struct mlx5hws_rule_attr rule_attr; - struct mlx5hws_table *isolated_tbl; -+ int move_error = 0, poll_error = 0; - struct mlx5hws_rule *tmp_rule; - struct list_head *rules_list; - u32 expected_completions = 1; -@@ -1391,11 +1391,15 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - ret = mlx5hws_matcher_resize_rule_move(matcher, - tmp_rule, - &rule_attr); -- if (unlikely(ret && !move_error)) { -- mlx5hws_err(ctx, -- "Moving complex BWC rule failed (%d), attempting to move rest of the rules\n", -- ret); -- move_error = true; -+ if (unlikely(ret)) { -+ if (!move_error) { -+ mlx5hws_err(ctx, -+ "Moving complex BWC rule: move failed (%d), attempting to move rest of the rules\n", -+ ret); -+ move_error = ret; -+ } -+ /* Rule wasn't queued, no need to poll */ -+ continue; - } - - expected_completions = 1; -@@ -1403,11 +1407,19 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - rule_attr.queue_id, - &expected_completions, - true); -- if (unlikely(ret && !poll_error)) { -- mlx5hws_err(ctx, -- "Moving complex BWC rule: poll failed (%d), attempting to move rest of the rules\n", -- ret); -- poll_error = true; -+ if (unlikely(ret)) { -+ if (ret == -ETIMEDOUT) { -+ mlx5hws_err(ctx, -+ "Moving complex BWC rule: timeout polling for completions (%d), aborting rehash\n", -+ ret); -+ return ret; -+ } -+ if (!poll_error) { -+ mlx5hws_err(ctx, -+ "Moving complex BWC rule: polling for completions failed (%d), attempting to move rest of the rules\n", -+ ret); -+ poll_error = ret; -+ } - } - - /* Done moving the rule to the new matcher, -@@ -1422,8 +1434,11 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - } - } - -- if (move_error || poll_error) -- ret = -EINVAL; -+ /* Return the first error that happened */ -+ if (unlikely(move_error)) -+ return move_error; -+ if (unlikely(poll_error)) -+ return poll_error; - - return ret; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1469-net-mlx5-hws-prevent-rehash-from-filling-up-the-queues.patch b/SOURCES/1469-net-mlx5-hws-prevent-rehash-from-filling-up-the-queues.patch deleted file mode 100644 index 0552e074b..000000000 --- a/SOURCES/1469-net-mlx5-hws-prevent-rehash-from-filling-up-the-queues.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 85b6561f38b73bc4a2ff631d7bf93e45feb6f3cf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, prevent rehash from filling up the queues - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1a72298d27ce4d41b3fd405f6921e8711815767a -Author: Yevgeny Kliteynik -Date: Sun Aug 17 23:23:20 2025 +0300 - - net/mlx5: HWS, prevent rehash from filling up the queues - - While moving the rules during rehash, CQ is not drained. The flush - and drain happens only when all the rules of a certain queue have been - moved. This behaviour can lead to accumulating large quantity of rules - that haven't got their completion yet, and eventually will fill up - the queue and will cause the rehash to fail. - - Fix this problem by requiring drain once the number of outstanding - completions reaches a certain threshold. - - Fixes: ef94799a8741 ("net/mlx5: HWS, rework rehash loop") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 0219a49b2326..2a59be11fe55 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -84,6 +84,7 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - struct list_head *rules_list; - u32 pending_rules; - int i, ret = 0; -+ bool drain; - - mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); - -@@ -111,10 +112,12 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - } - - pending_rules++; -+ drain = pending_rules >= -+ hws_bwc_get_burst_th(ctx, rule_attr.queue_id); - ret = mlx5hws_bwc_queue_poll(ctx, - rule_attr.queue_id, - &pending_rules, -- false); -+ drain); - if (unlikely(ret)) { - if (ret == -ETIMEDOUT) { - mlx5hws_err(ctx, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1470-net-mlx5-hws-don-t-rehash-on-every-kind-of-insertion-failure.patch b/SOURCES/1470-net-mlx5-hws-don-t-rehash-on-every-kind-of-insertion-failure.patch deleted file mode 100644 index 26ebdab95..000000000 --- a/SOURCES/1470-net-mlx5-hws-don-t-rehash-on-every-kind-of-insertion-failure.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 701cc59d96f2bba3314c909d9b5d62ff97e5341d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, don't rehash on every kind of insertion - failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7c60952f83584bc4950057cfed2cc3c87343b5db -Author: Yevgeny Kliteynik -Date: Sun Aug 17 23:23:21 2025 +0300 - - net/mlx5: HWS, don't rehash on every kind of insertion failure - - If rule creation failed due to a full queue, due to timeout - in polling for completion, or due to matcher being in resize, - don't try to initiate rehash sequence - rehash would have - failed anyway. - - Fixes: 2111bb970c78 ("net/mlx5: HWS, added backward-compatible API handling") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Vlad Dogaru - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index 2a59be11fe55..adeccc588e5d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -1063,6 +1063,21 @@ int mlx5hws_bwc_rule_create_simple(struct mlx5hws_bwc_rule *bwc_rule, - return 0; /* rule inserted successfully */ - } - -+ /* Rule insertion could fail due to queue being full, timeout, or -+ * matcher in resize. In such cases, no point in trying to rehash. -+ */ -+ if (ret == -EBUSY || ret == -ETIMEDOUT || ret == -EAGAIN) { -+ mutex_unlock(queue_lock); -+ mlx5hws_err(ctx, -+ "BWC rule insertion failed - %s (%d)\n", -+ ret == -EBUSY ? "queue is full" : -+ ret == -ETIMEDOUT ? "timeout" : -+ ret == -EAGAIN ? "matcher in resize" : "N/A", -+ ret); -+ hws_bwc_rule_cnt_dec(bwc_rule); -+ return ret; -+ } -+ - /* At this point the rule wasn't added. - * It could be because there was collision, or some other problem. - * Try rehash by size and insert rule again - last chance. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1471-net-mlx5-hws-fix-table-creation-uid.patch b/SOURCES/1471-net-mlx5-hws-fix-table-creation-uid.patch deleted file mode 100644 index 96386ac9a..000000000 --- a/SOURCES/1471-net-mlx5-hws-fix-table-creation-uid.patch +++ /dev/null @@ -1,179 +0,0 @@ -From 5ba0229ef0a40fce8e7bc1ccb7cda677afe9277d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix table creation UID - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8a51507320ebddaab32610199774f69cd7d53e78 -Author: Alex Vesker -Date: Sun Aug 17 23:23:22 2025 +0300 - - net/mlx5: HWS, Fix table creation UID - - During table creation, caller passes a UID using ft_attr. The UID - value was ignored, which leads to problems when the caller sets the - UID to a non-zero value, such as SHARED_RESOURCE_UID (0xffff) - the - internal FT objects will be created with UID=0. - - Fixes: 0869701cba3d ("net/mlx5: HWS, added FW commands handling") - Signed-off-by: Alex Vesker - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -index 9c83753e4592..0bdcab2e5cf3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -@@ -55,6 +55,7 @@ int mlx5hws_cmd_flow_table_create(struct mlx5_core_dev *mdev, - - MLX5_SET(create_flow_table_in, in, opcode, MLX5_CMD_OP_CREATE_FLOW_TABLE); - MLX5_SET(create_flow_table_in, in, table_type, ft_attr->type); -+ MLX5_SET(create_flow_table_in, in, uid, ft_attr->uid); - - ft_ctx = MLX5_ADDR_OF(create_flow_table_in, in, flow_table_context); - MLX5_SET(flow_table_context, ft_ctx, level, ft_attr->level); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -index fa6bff210266..122ccc671628 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.h -@@ -36,6 +36,7 @@ struct mlx5hws_cmd_set_fte_attr { - struct mlx5hws_cmd_ft_create_attr { - u8 type; - u8 level; -+ u16 uid; - bool rtc_valid; - bool decap_en; - bool reformat_en; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index 57592b92e24b..131e74b2b774 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -267,6 +267,7 @@ static int mlx5_cmd_hws_create_flow_table(struct mlx5_flow_root_namespace *ns, - - tbl_attr.type = MLX5HWS_TABLE_TYPE_FDB; - tbl_attr.level = ft_attr->level; -+ tbl_attr.uid = ft_attr->uid; - tbl = mlx5hws_table_create(ctx, &tbl_attr); - if (!tbl) { - mlx5_core_err(ns->dev, "Failed creating hws flow_table\n"); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -index f3ea09caba2b..32f87fdf3213 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c -@@ -85,6 +85,7 @@ static int hws_matcher_create_end_ft_isolated(struct mlx5hws_matcher *matcher) - - ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, - tbl, -+ 0, - &matcher->end_ft_id); - if (ret) { - mlx5hws_err(tbl->ctx, "Isolated matcher: failed to create end flow table\n"); -@@ -112,7 +113,9 @@ static int hws_matcher_create_end_ft(struct mlx5hws_matcher *matcher) - if (mlx5hws_matcher_is_isolated(matcher)) - ret = hws_matcher_create_end_ft_isolated(matcher); - else -- ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, tbl, -+ ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, -+ tbl, -+ 0, - &matcher->end_ft_id); - - if (ret) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 59c14745ed0c..2498ceff2060 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -75,6 +75,7 @@ struct mlx5hws_context_attr { - struct mlx5hws_table_attr { - enum mlx5hws_table_type type; - u32 level; -+ u16 uid; - }; - - enum mlx5hws_matcher_flow_src { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -index 568f691733f3..6113383ae47b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.c -@@ -9,6 +9,7 @@ u32 mlx5hws_table_get_id(struct mlx5hws_table *tbl) - } - - static void hws_table_init_next_ft_attr(struct mlx5hws_table *tbl, -+ u16 uid, - struct mlx5hws_cmd_ft_create_attr *ft_attr) - { - ft_attr->type = tbl->fw_ft_type; -@@ -16,7 +17,9 @@ static void hws_table_init_next_ft_attr(struct mlx5hws_table *tbl, - ft_attr->level = tbl->ctx->caps->fdb_ft.max_level - 1; - else - ft_attr->level = tbl->ctx->caps->nic_ft.max_level - 1; -+ - ft_attr->rtc_valid = true; -+ ft_attr->uid = uid; - } - - static void hws_table_set_cap_attr(struct mlx5hws_table *tbl, -@@ -119,12 +122,12 @@ static int hws_table_connect_to_default_miss_tbl(struct mlx5hws_table *tbl, u32 - - int mlx5hws_table_create_default_ft(struct mlx5_core_dev *mdev, - struct mlx5hws_table *tbl, -- u32 *ft_id) -+ u16 uid, u32 *ft_id) - { - struct mlx5hws_cmd_ft_create_attr ft_attr = {0}; - int ret; - -- hws_table_init_next_ft_attr(tbl, &ft_attr); -+ hws_table_init_next_ft_attr(tbl, uid, &ft_attr); - hws_table_set_cap_attr(tbl, &ft_attr); - - ret = mlx5hws_cmd_flow_table_create(mdev, &ft_attr, ft_id); -@@ -189,7 +192,10 @@ static int hws_table_init(struct mlx5hws_table *tbl) - } - - mutex_lock(&ctx->ctrl_lock); -- ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, tbl, &tbl->ft_id); -+ ret = mlx5hws_table_create_default_ft(tbl->ctx->mdev, -+ tbl, -+ tbl->uid, -+ &tbl->ft_id); - if (ret) { - mlx5hws_err(tbl->ctx, "Failed to create flow table object\n"); - mutex_unlock(&ctx->ctrl_lock); -@@ -239,6 +245,7 @@ struct mlx5hws_table *mlx5hws_table_create(struct mlx5hws_context *ctx, - tbl->ctx = ctx; - tbl->type = attr->type; - tbl->level = attr->level; -+ tbl->uid = attr->uid; - - ret = hws_table_init(tbl); - if (ret) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -index 0400cce0c317..1246f9bd8422 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/table.h -@@ -18,6 +18,7 @@ struct mlx5hws_table { - enum mlx5hws_table_type type; - u32 fw_ft_type; - u32 level; -+ u16 uid; - struct list_head matchers_list; - struct list_head tbl_list_node; - struct mlx5hws_default_miss default_miss; -@@ -47,7 +48,7 @@ u32 mlx5hws_table_get_res_fw_ft_type(enum mlx5hws_table_type tbl_type, - - int mlx5hws_table_create_default_ft(struct mlx5_core_dev *mdev, - struct mlx5hws_table *tbl, -- u32 *ft_id); -+ u16 uid, u32 *ft_id); - - void mlx5hws_table_destroy_default_ft(struct mlx5hws_table *tbl, - u32 ft_id); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1472-net-mlx5-ct-use-the-correct-counter-offset.patch b/SOURCES/1472-net-mlx5-ct-use-the-correct-counter-offset.patch deleted file mode 100644 index 59cbf73ee..000000000 --- a/SOURCES/1472-net-mlx5-ct-use-the-correct-counter-offset.patch +++ /dev/null @@ -1,48 +0,0 @@ -From e9c25119d53e4ed49454a852dbf0d4a0b1998973 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: CT: Use the correct counter offset - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d2d6f950cb43be6845a41cac5956cb2a10e657e5 -Author: Vlad Dogaru -Date: Sun Aug 17 23:23:23 2025 +0300 - - net/mlx5: CT: Use the correct counter offset - - Specifying the counter action is not enough, as it is used by multiple - counters that were allocated in a bulk. By omitting the offset, rules - will be associated with a different counter from the same bulk. - Subsequently, the CT subsystem checks the correct counter, assumes that - no traffic has triggered the rule, and ages out the rule. The end result - is intermittent offloading of long lived connections, as rules are aged - out then promptly re-added. - - Fix this by specifying the correct offset along with the counter rule. - - Fixes: 34eea5b12a10 ("net/mlx5e: CT: Add initial support for Hardware Steering") - Signed-off-by: Vlad Dogaru - Reviewed-by: Yevgeny Kliteynik - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250817202323.308604-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -index a4263137fef5..01d522b02947 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -@@ -173,6 +173,8 @@ static void mlx5_ct_fs_hmfs_fill_rule_actions(struct mlx5_ct_fs_hmfs *fs_hmfs, - - memset(rule_actions, 0, NUM_CT_HMFS_RULES * sizeof(*rule_actions)); - rule_actions[0].action = mlx5_fc_get_hws_action(fs_hmfs->ctx, attr->counter); -+ rule_actions[0].counter.offset = -+ attr->counter->id - attr->counter->bulk->base_id; - /* Modify header is special, it may require extra arguments outside the action itself. */ - if (mh_action->mh_data) { - rule_actions[1].modify_header.offset = mh_action->mh_data->offset; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1473-net-mlx5-base-ecvf-devlink-port-attrs-from-0.patch b/SOURCES/1473-net-mlx5-base-ecvf-devlink-port-attrs-from-0.patch deleted file mode 100644 index 0c78fdd9d..000000000 --- a/SOURCES/1473-net-mlx5-base-ecvf-devlink-port-attrs-from-0.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 4664ef9e5ba7021bb556c8e0f1f690d7538c2b11 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: Base ECVF devlink port attrs from 0 - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bc17455bc843b2f4b206e0bb8139013eb3d3c08b -Author: Daniel Jurgens -Date: Wed Aug 20 16:32:02 2025 +0300 - - net/mlx5: Base ECVF devlink port attrs from 0 - - Adjust the vport number by the base ECVF vport number so the port - attributes start at 0. Previously the port attributes would start 1 - after the maximum number of host VFs. - - Fixes: dc13180824b7 ("net/mlx5: Enable devlink port for embedded cpu VF vports") - Signed-off-by: Daniel Jurgens - Reviewed-by: Parav Pandit - Reviewed-by: Saeed Mahameed - Signed-off-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -index b7102e14d23d..c33accadae0f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -@@ -47,10 +47,12 @@ static void mlx5_esw_offloads_pf_vf_devlink_port_attrs_set(struct mlx5_eswitch * - devlink_port_attrs_pci_vf_set(dl_port, controller_num, pfnum, - vport_num - 1, external); - } else if (mlx5_core_is_ec_vf_vport(esw->dev, vport_num)) { -+ u16 base_vport = mlx5_core_ec_vf_vport_base(dev); -+ - memcpy(dl_port->attrs.switch_id.id, ppid.id, ppid.id_len); - dl_port->attrs.switch_id.id_len = ppid.id_len; - devlink_port_attrs_pci_vf_set(dl_port, 0, pfnum, -- vport_num - 1, false); -+ vport_num - base_vport, false); - } - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1474-net-mlx5-remove-default-qos-group-and-attach-vports-directly.patch b/SOURCES/1474-net-mlx5-remove-default-qos-group-and-attach-vports-directly.patch deleted file mode 100644 index 661644ba3..000000000 --- a/SOURCES/1474-net-mlx5-remove-default-qos-group-and-attach-vports-directly.patch +++ /dev/null @@ -1,299 +0,0 @@ -From 1aea4efe28aadf5ebb2abbcaa1286585a6c71a01 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:00 -0400 -Subject: [PATCH] net/mlx5: Remove default QoS group and attach vports directly - to root TSAR - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 330f0f6713a39581936decac72331e6ab7f13529 -Author: Carolina Jubran -Date: Wed Aug 20 16:32:03 2025 +0300 - - net/mlx5: Remove default QoS group and attach vports directly to root TSAR - - Currently, the driver creates a default group (`node0`) and attaches - all vports to it unless the user explicitly sets a parent group. As a - result, when a user configures tx_share on a group and tx_share on - a VF, the expectation is for the group and the VF to share bandwidth - relatively. However, since the VF is not connected to the same parent - (but to the default node), the proportional share logic is not applied - correctly. - - To fix this, remove the default group (`node0`) and instead connect - vports directly to the root TSAR when no parent is specified. This - ensures that vports and groups share the same root scheduler and their - tx_share values are compared directly under the same hierarchy. - - Fixes: 0fe132eac38c ("net/mlx5: E-switch, Allow to add vports to rate groups") - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-3-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 91d863c8c152..cd58d3934596 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -462,6 +462,7 @@ static int - esw_qos_vport_create_sched_element(struct mlx5_esw_sched_node *vport_node, - struct netlink_ext_ack *extack) - { -+ struct mlx5_esw_sched_node *parent = vport_node->parent; - u32 sched_ctx[MLX5_ST_SZ_DW(scheduling_context)] = {}; - struct mlx5_core_dev *dev = vport_node->esw->dev; - void *attr; -@@ -477,7 +478,7 @@ esw_qos_vport_create_sched_element(struct mlx5_esw_sched_node *vport_node, - attr = MLX5_ADDR_OF(scheduling_context, sched_ctx, element_attributes); - MLX5_SET(vport_element, attr, vport_number, vport_node->vport->vport); - MLX5_SET(scheduling_context, sched_ctx, parent_element_id, -- vport_node->parent->ix); -+ parent ? parent->ix : vport_node->esw->qos.root_tsar_ix); - MLX5_SET(scheduling_context, sched_ctx, max_average_bw, - vport_node->max_rate); - -@@ -786,48 +787,15 @@ static int esw_qos_create(struct mlx5_eswitch *esw, struct netlink_ext_ack *exta - return err; - } - -- if (MLX5_CAP_QOS(dev, log_esw_max_sched_depth)) { -- esw->qos.node0 = __esw_qos_create_vports_sched_node(esw, NULL, extack); -- } else { -- /* The eswitch doesn't support scheduling nodes. -- * Create a software-only node0 using the root TSAR to attach vport QoS to. -- */ -- if (!__esw_qos_alloc_node(esw, -- esw->qos.root_tsar_ix, -- SCHED_NODE_TYPE_VPORTS_TSAR, -- NULL)) -- esw->qos.node0 = ERR_PTR(-ENOMEM); -- else -- list_add_tail(&esw->qos.node0->entry, -- &esw->qos.domain->nodes); -- } -- if (IS_ERR(esw->qos.node0)) { -- err = PTR_ERR(esw->qos.node0); -- esw_warn(dev, "E-Switch create rate node 0 failed (%d)\n", err); -- goto err_node0; -- } - refcount_set(&esw->qos.refcnt, 1); - - return 0; -- --err_node0: -- if (mlx5_destroy_scheduling_element_cmd(esw->dev, SCHEDULING_HIERARCHY_E_SWITCH, -- esw->qos.root_tsar_ix)) -- esw_warn(esw->dev, "E-Switch destroy root TSAR failed.\n"); -- -- return err; - } - - static void esw_qos_destroy(struct mlx5_eswitch *esw) - { - int err; - -- if (esw->qos.node0->ix != esw->qos.root_tsar_ix) -- __esw_qos_destroy_node(esw->qos.node0, NULL); -- else -- __esw_qos_free_node(esw->qos.node0); -- esw->qos.node0 = NULL; -- - err = mlx5_destroy_scheduling_element_cmd(esw->dev, - SCHEDULING_HIERARCHY_E_SWITCH, - esw->qos.root_tsar_ix); -@@ -990,13 +958,16 @@ esw_qos_vport_tc_enable(struct mlx5_vport *vport, enum sched_node_type type, - struct netlink_ext_ack *extack) - { - struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -- int err, new_level, max_level; -+ struct mlx5_esw_sched_node *parent = vport_node->parent; -+ int err; - - if (type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) { -+ int new_level, max_level; -+ - /* Increase the parent's level by 2 to account for both the - * TC arbiter and the vports TC scheduling element. - */ -- new_level = vport_node->parent->level + 2; -+ new_level = (parent ? parent->level : 2) + 2; - max_level = 1 << MLX5_CAP_QOS(vport_node->esw->dev, - log_esw_max_sched_depth); - if (new_level > max_level) { -@@ -1033,9 +1004,7 @@ esw_qos_vport_tc_enable(struct mlx5_vport *vport, enum sched_node_type type, - err_sched_nodes: - if (type == SCHED_NODE_TYPE_RATE_LIMITER) { - esw_qos_node_destroy_sched_element(vport_node, NULL); -- list_add_tail(&vport_node->entry, -- &vport_node->parent->children); -- vport_node->level = vport_node->parent->level + 1; -+ esw_qos_node_attach_to_parent(vport_node); - } else { - esw_qos_tc_arbiter_scheduling_teardown(vport_node, NULL); - } -@@ -1083,7 +1052,6 @@ static int esw_qos_set_vport_tcs_min_rate(struct mlx5_vport *vport, - static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_ack *extack) - { - struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -- struct mlx5_esw_sched_node *parent = vport_node->parent; - enum sched_node_type curr_type = vport_node->type; - - if (curr_type == SCHED_NODE_TYPE_VPORT) -@@ -1093,7 +1061,7 @@ static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_a - - vport_node->bw_share = 0; - list_del_init(&vport_node->entry); -- esw_qos_normalize_min_rate(parent->esw, parent, extack); -+ esw_qos_normalize_min_rate(vport_node->esw, vport_node->parent, extack); - - trace_mlx5_esw_vport_qos_destroy(vport_node->esw->dev, vport); - } -@@ -1103,25 +1071,23 @@ static int esw_qos_vport_enable(struct mlx5_vport *vport, - struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) - { -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; - int err; - - esw_assert_qos_lock_held(vport->dev->priv.eswitch); - -- esw_qos_node_set_parent(vport->qos.sched_node, parent); -- if (type == SCHED_NODE_TYPE_VPORT) { -- err = esw_qos_vport_create_sched_element(vport->qos.sched_node, -- extack); -- } else { -+ esw_qos_node_set_parent(vport_node, parent); -+ if (type == SCHED_NODE_TYPE_VPORT) -+ err = esw_qos_vport_create_sched_element(vport_node, extack); -+ else - err = esw_qos_vport_tc_enable(vport, type, extack); -- } - if (err) - return err; - -- vport->qos.sched_node->type = type; -- esw_qos_normalize_min_rate(parent->esw, parent, extack); -- trace_mlx5_esw_vport_qos_create(vport->dev, vport, -- vport->qos.sched_node->max_rate, -- vport->qos.sched_node->bw_share); -+ vport_node->type = type; -+ esw_qos_normalize_min_rate(vport_node->esw, parent, extack); -+ trace_mlx5_esw_vport_qos_create(vport->dev, vport, vport_node->max_rate, -+ vport_node->bw_share); - - return 0; - } -@@ -1132,6 +1098,7 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - { - struct mlx5_eswitch *esw = vport->dev->priv.eswitch; - struct mlx5_esw_sched_node *sched_node; -+ struct mlx5_eswitch *parent_esw; - int err; - - esw_assert_qos_lock_held(esw); -@@ -1139,10 +1106,12 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - if (err) - return err; - -- parent = parent ?: esw->qos.node0; -- sched_node = __esw_qos_alloc_node(parent->esw, 0, type, parent); -+ parent_esw = parent ? parent->esw : esw; -+ sched_node = __esw_qos_alloc_node(parent_esw, 0, type, parent); - if (!sched_node) - return -ENOMEM; -+ if (!parent) -+ list_add_tail(&sched_node->entry, &esw->qos.domain->nodes); - - sched_node->max_rate = max_rate; - sched_node->min_rate = min_rate; -@@ -1168,7 +1137,7 @@ void mlx5_esw_qos_vport_disable(struct mlx5_vport *vport) - goto unlock; - - parent = vport->qos.sched_node->parent; -- WARN(parent != esw->qos.node0, "Disabling QoS on port before detaching it from node"); -+ WARN(parent, "Disabling QoS on port before detaching it from node"); - - esw_qos_vport_disable(vport, NULL); - mlx5_esw_qos_vport_qos_free(vport); -@@ -1268,7 +1237,6 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - int err; - - esw_assert_qos_lock_held(vport->dev->priv.eswitch); -- parent = parent ?: curr_parent; - if (curr_type == type && curr_parent == parent) - return 0; - -@@ -1306,16 +1274,16 @@ static int esw_qos_vport_update_parent(struct mlx5_vport *vport, struct mlx5_esw - - esw_assert_qos_lock_held(esw); - curr_parent = vport->qos.sched_node->parent; -- parent = parent ?: esw->qos.node0; - if (curr_parent == parent) - return 0; - - /* Set vport QoS type based on parent node type if different from - * default QoS; otherwise, use the vport's current QoS type. - */ -- if (parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ if (parent && parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) - type = SCHED_NODE_TYPE_RATE_LIMITER; -- else if (curr_parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) -+ else if (curr_parent && -+ curr_parent->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) - type = SCHED_NODE_TYPE_VPORT; - else - type = vport->qos.sched_node->type; -@@ -1654,9 +1622,10 @@ static bool esw_qos_validate_unsupported_tc_bw(struct mlx5_eswitch *esw, - static bool esw_qos_vport_validate_unsupported_tc_bw(struct mlx5_vport *vport, - u32 *tc_bw) - { -- struct mlx5_eswitch *esw = vport->qos.sched_node ? -- vport->qos.sched_node->parent->esw : -- vport->dev->priv.eswitch; -+ struct mlx5_esw_sched_node *node = vport->qos.sched_node; -+ struct mlx5_eswitch *esw = vport->dev->priv.eswitch; -+ -+ esw = (node && node->parent) ? node->parent->esw : esw; - - return esw_qos_validate_unsupported_tc_bw(esw, tc_bw); - } -@@ -1763,7 +1732,7 @@ int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, - if (disable) { - if (vport_node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) - err = esw_qos_vport_update(vport, SCHED_NODE_TYPE_VPORT, -- NULL, extack); -+ vport_node->parent, extack); - goto unlock; - } - -@@ -1775,7 +1744,7 @@ int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, - } else { - err = esw_qos_vport_update(vport, - SCHED_NODE_TYPE_TC_ARBITER_TSAR, -- NULL, extack); -+ vport_node->parent, extack); - } - if (!err) - esw_qos_set_tc_arbiter_bw_shares(vport_node, tc_bw, extack); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index b0b8ef3ec3c4..45506ad56847 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -373,11 +373,6 @@ struct mlx5_eswitch { - refcount_t refcnt; - u32 root_tsar_ix; - struct mlx5_qos_domain *domain; -- /* Contains all vports with QoS enabled but no explicit node. -- * Cannot be NULL if QoS is enabled, but may be a fake node -- * referencing the root TSAR if the esw doesn't support nodes. -- */ -- struct mlx5_esw_sched_node *node0; - } qos; - - struct mlx5_esw_bridge_offloads *br_offloads; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1475-net-mlx5e-preserve-tc-bw-during-parent-changes.patch b/SOURCES/1475-net-mlx5e-preserve-tc-bw-during-parent-changes.patch deleted file mode 100644 index 116514886..000000000 --- a/SOURCES/1475-net-mlx5e-preserve-tc-bw-during-parent-changes.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 563c9ce2e47d6913030f6d78e8cde9303038c48e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5e: Preserve tc-bw during parent changes - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e8f973576ca5387ffd2917b8ae661d3f9acde526 -Author: Carolina Jubran -Date: Wed Aug 20 16:32:04 2025 +0300 - - net/mlx5e: Preserve tc-bw during parent changes - - When changing parent of a node/leaf with tc-bw configured, the code - saves and restores tc-bw values. However, it was reading the converted - hardware bw_share values (where 0 becomes 1) instead of the original - user values, causing incorrect tc-bw calculations after parent change. - - Store original tc-bw values in the node structure and use them directly - for save/restore operations. - - Fixes: cf7e73770d1b ("net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw") - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index cd58d3934596..4ed5968f1638 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -102,6 +102,8 @@ struct mlx5_esw_sched_node { - u8 level; - /* Valid only when this node represents a traffic class. */ - u8 tc; -+ /* Valid only for a TC arbiter node or vport TC arbiter. */ -+ u32 tc_bw[DEVLINK_RATE_TCS_MAX]; - }; - - static void esw_qos_node_attach_to_parent(struct mlx5_esw_sched_node *node) -@@ -609,10 +611,7 @@ static void - esw_qos_tc_arbiter_get_bw_shares(struct mlx5_esw_sched_node *tc_arbiter_node, - u32 *tc_bw) - { -- struct mlx5_esw_sched_node *vports_tc_node; -- -- list_for_each_entry(vports_tc_node, &tc_arbiter_node->children, entry) -- tc_bw[vports_tc_node->tc] = vports_tc_node->bw_share; -+ memcpy(tc_bw, tc_arbiter_node->tc_bw, sizeof(tc_arbiter_node->tc_bw)); - } - - static void -@@ -629,6 +628,7 @@ esw_qos_set_tc_arbiter_bw_shares(struct mlx5_esw_sched_node *tc_arbiter_node, - u8 tc = vports_tc_node->tc; - u32 bw_share; - -+ tc_arbiter_node->tc_bw[tc] = tc_bw[tc]; - bw_share = tc_bw[tc] * fw_max_bw_share; - bw_share = esw_qos_calc_bw_share(bw_share, divider, - fw_max_bw_share); -@@ -1060,6 +1060,7 @@ static void esw_qos_vport_disable(struct mlx5_vport *vport, struct netlink_ext_a - esw_qos_vport_tc_disable(vport, extack); - - vport_node->bw_share = 0; -+ memset(vport_node->tc_bw, 0, sizeof(vport_node->tc_bw)); - list_del_init(&vport_node->entry); - esw_qos_normalize_min_rate(vport_node->esw, vport_node->parent, extack); - -@@ -1231,8 +1232,9 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - struct mlx5_esw_sched_node *parent, - struct netlink_ext_ack *extack) - { -- struct mlx5_esw_sched_node *curr_parent = vport->qos.sched_node->parent; -- enum sched_node_type curr_type = vport->qos.sched_node->type; -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ struct mlx5_esw_sched_node *curr_parent = vport_node->parent; -+ enum sched_node_type curr_type = vport_node->type; - u32 curr_tc_bw[DEVLINK_RATE_TCS_MAX] = {0}; - int err; - -@@ -1244,10 +1246,8 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - if (err) - return err; - -- if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && curr_type == type) { -- esw_qos_tc_arbiter_get_bw_shares(vport->qos.sched_node, -- curr_tc_bw); -- } -+ if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && curr_type == type) -+ esw_qos_tc_arbiter_get_bw_shares(vport_node, curr_tc_bw); - - esw_qos_vport_disable(vport, extack); - -@@ -1258,8 +1258,8 @@ static int esw_qos_vport_update(struct mlx5_vport *vport, - } - - if (curr_type == SCHED_NODE_TYPE_TC_ARBITER_TSAR && curr_type == type) { -- esw_qos_set_tc_arbiter_bw_shares(vport->qos.sched_node, -- curr_tc_bw, extack); -+ esw_qos_set_tc_arbiter_bw_shares(vport_node, curr_tc_bw, -+ extack); - } - - return err; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1476-net-mlx5-destroy-vport-qos-element-when-no-configuration-rem.patch b/SOURCES/1476-net-mlx5-destroy-vport-qos-element-when-no-configuration-rem.patch deleted file mode 100644 index b7502c4f1..000000000 --- a/SOURCES/1476-net-mlx5-destroy-vport-qos-element-when-no-configuration-rem.patch +++ /dev/null @@ -1,151 +0,0 @@ -From b80130b7b7999d4307a31abd933abe52a149bb54 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: Destroy vport QoS element when no configuration - remains - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b697ef4d1d136948d282384e6cc3d1af469ea123 -Author: Carolina Jubran -Date: Wed Aug 20 16:32:05 2025 +0300 - - net/mlx5: Destroy vport QoS element when no configuration remains - - If a VF has been configured and the user later clears all QoS settings, - the vport element remains in the firmware QoS tree. This leads to - inconsistent behavior compared to VFs that were never configured, since - the FW assumes that unconfigured VFs are outside the QoS hierarchy. - As a result, the bandwidth share across VFs may differ, even though - none of them appear to have any configuration. - - Align the driver behavior with the FW expectation by destroying the - vport QoS element when all configurations are removed. - - Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate") - Fixes: cf7e73770d1b ("net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw") - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Mark Bloch - Reviewed-by: Przemek Kitszel - Link: https://patch.msgid.link/20250820133209.389065-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 4ed5968f1638..452a948a3e6d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1127,6 +1127,19 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - return err; - } - -+static void mlx5_esw_qos_vport_disable_locked(struct mlx5_vport *vport) -+{ -+ struct mlx5_eswitch *esw = vport->dev->priv.eswitch; -+ -+ esw_assert_qos_lock_held(esw); -+ if (!vport->qos.sched_node) -+ return; -+ -+ esw_qos_vport_disable(vport, NULL); -+ mlx5_esw_qos_vport_qos_free(vport); -+ esw_qos_put(esw); -+} -+ - void mlx5_esw_qos_vport_disable(struct mlx5_vport *vport) - { - struct mlx5_eswitch *esw = vport->dev->priv.eswitch; -@@ -1140,9 +1153,7 @@ void mlx5_esw_qos_vport_disable(struct mlx5_vport *vport) - parent = vport->qos.sched_node->parent; - WARN(parent, "Disabling QoS on port before detaching it from node"); - -- esw_qos_vport_disable(vport, NULL); -- mlx5_esw_qos_vport_qos_free(vport); -- esw_qos_put(esw); -+ mlx5_esw_qos_vport_disable_locked(vport); - unlock: - esw_qos_unlock(esw); - } -@@ -1642,6 +1653,21 @@ static bool esw_qos_tc_bw_disabled(u32 *tc_bw) - return true; - } - -+static void esw_vport_qos_prune_empty(struct mlx5_vport *vport) -+{ -+ struct mlx5_esw_sched_node *vport_node = vport->qos.sched_node; -+ -+ esw_assert_qos_lock_held(vport->dev->priv.eswitch); -+ if (!vport_node) -+ return; -+ -+ if (vport_node->parent || vport_node->max_rate || -+ vport_node->min_rate || !esw_qos_tc_bw_disabled(vport_node->tc_bw)) -+ return; -+ -+ mlx5_esw_qos_vport_disable_locked(vport); -+} -+ - int mlx5_esw_qos_init(struct mlx5_eswitch *esw) - { - if (esw->qos.domain) -@@ -1675,6 +1701,10 @@ int mlx5_esw_devlink_rate_leaf_tx_share_set(struct devlink_rate *rate_leaf, void - - esw_qos_lock(esw); - err = mlx5_esw_qos_set_vport_min_rate(vport, tx_share, extack); -+ if (err) -+ goto out; -+ esw_vport_qos_prune_empty(vport); -+out: - esw_qos_unlock(esw); - return err; - } -@@ -1696,6 +1726,10 @@ int mlx5_esw_devlink_rate_leaf_tx_max_set(struct devlink_rate *rate_leaf, void * - - esw_qos_lock(esw); - err = mlx5_esw_qos_set_vport_max_rate(vport, tx_max, extack); -+ if (err) -+ goto out; -+ esw_vport_qos_prune_empty(vport); -+out: - esw_qos_unlock(esw); - return err; - } -@@ -1733,6 +1767,7 @@ int mlx5_esw_devlink_rate_leaf_tc_bw_set(struct devlink_rate *rate_leaf, - if (vport_node->type == SCHED_NODE_TYPE_TC_ARBITER_TSAR) - err = esw_qos_vport_update(vport, SCHED_NODE_TYPE_VPORT, - vport_node->parent, extack); -+ esw_vport_qos_prune_empty(vport); - goto unlock; - } - -@@ -1893,14 +1928,20 @@ int mlx5_esw_devlink_rate_leaf_parent_set(struct devlink_rate *devlink_rate, - void *priv, void *parent_priv, - struct netlink_ext_ack *extack) - { -- struct mlx5_esw_sched_node *node; -+ struct mlx5_esw_sched_node *node = parent ? parent_priv : NULL; - struct mlx5_vport *vport = priv; -+ int err; - -- if (!parent) -- return mlx5_esw_qos_vport_update_parent(vport, NULL, extack); -+ err = mlx5_esw_qos_vport_update_parent(vport, node, extack); -+ if (!err) { -+ struct mlx5_eswitch *esw = vport->dev->priv.eswitch; -+ -+ esw_qos_lock(esw); -+ esw_vport_qos_prune_empty(vport); -+ esw_qos_unlock(esw); -+ } - -- node = parent_priv; -- return mlx5_esw_qos_vport_update_parent(vport, node, extack); -+ return err; - } - - static bool esw_qos_is_node_empty(struct mlx5_esw_sched_node *node) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1477-net-mlx5-fix-qos-reference-leak-in-vport-enable-error-path.patch b/SOURCES/1477-net-mlx5-fix-qos-reference-leak-in-vport-enable-error-path.patch deleted file mode 100644 index f5efa6291..000000000 --- a/SOURCES/1477-net-mlx5-fix-qos-reference-leak-in-vport-enable-error-path.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 5b2ddfb962de15082b8a2f6959cb9b18e384f355 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: Fix QoS reference leak in vport enable error path - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3c114fb2afe493066df5b9e560ef37216b153c90 -Author: Carolina Jubran -Date: Wed Aug 20 16:32:06 2025 +0300 - - net/mlx5: Fix QoS reference leak in vport enable error path - - Add missing esw_qos_put() call when __esw_qos_alloc_node() fails in - mlx5_esw_qos_vport_enable(). - - Fixes: be034baba83e ("net/mlx5: Make vport QoS enablement more flexible for future extensions") - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 452a948a3e6d..41aec07bb6c2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1109,8 +1109,10 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - - parent_esw = parent ? parent->esw : esw; - sched_node = __esw_qos_alloc_node(parent_esw, 0, type, parent); -- if (!sched_node) -+ if (!sched_node) { -+ esw_qos_put(esw); - return -ENOMEM; -+ } - if (!parent) - list_add_tail(&sched_node->entry, &esw->qos.domain->nodes); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1478-net-mlx5-restore-missing-scheduling-node-cleanup-on-vport-en.patch b/SOURCES/1478-net-mlx5-restore-missing-scheduling-node-cleanup-on-vport-en.patch deleted file mode 100644 index 74eab8a73..000000000 --- a/SOURCES/1478-net-mlx5-restore-missing-scheduling-node-cleanup-on-vport-en.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 511f926b17986007f23bb5a1351e214af05d8b4c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: Restore missing scheduling node cleanup on vport - enable failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 51b17c98e3dbb2093a81b0490050a0eaa919ebee -Author: Carolina Jubran -Date: Wed Aug 20 16:32:07 2025 +0300 - - net/mlx5: Restore missing scheduling node cleanup on vport enable failure - - Restore the __esw_qos_free_node() call removed by the offending commit. - - Fixes: 97733d1e00a0 ("net/mlx5: Add traffic class scheduling support for vport QoS") - Signed-off-by: Carolina Jubran - Reviewed-by: Tariq Toukan - Reviewed-by: Cosmin Ratiu - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 41aec07bb6c2..8b4977650183 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1122,6 +1122,7 @@ static int mlx5_esw_qos_vport_enable(struct mlx5_vport *vport, enum sched_node_t - vport->qos.sched_node = sched_node; - err = esw_qos_vport_enable(vport, type, parent, extack); - if (err) { -+ __esw_qos_free_node(sched_node); - esw_qos_put(esw); - vport->qos.sched_node = NULL; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1479-net-mlx5e-query-fw-for-buffer-ownership.patch b/SOURCES/1479-net-mlx5e-query-fw-for-buffer-ownership.patch deleted file mode 100644 index e218f4022..000000000 --- a/SOURCES/1479-net-mlx5e-query-fw-for-buffer-ownership.patch +++ /dev/null @@ -1,142 +0,0 @@ -From 9f88327ce89be95757619078e64831f60cb79111 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5e: Query FW for buffer ownership - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 451d2849ea66659040b59ae3cb7e50cc97404733 -Author: Alexei Lazar -Date: Wed Aug 20 16:32:08 2025 +0300 - - net/mlx5e: Query FW for buffer ownership - - The SW currently saves local buffer ownership when setting - the buffer. - This means that the SW assumes it has ownership of the buffer - after the command is set. - - If setting the buffer fails and we remain in FW ownership, - the local buffer ownership state incorrectly remains as SW-owned. - This leads to incorrect behavior in subsequent PFC commands, - causing failures. - - Instead of saving local buffer ownership in SW, - query the FW for buffer ownership when setting the buffer. - This ensures that the buffer ownership state is accurately - reflected, avoiding the issues caused by incorrect ownership - states. - - Fixes: ecdf2dadee8e ("net/mlx5e: Receive buffer support for DCBX") - Signed-off-by: Alexei Lazar - Reviewed-by: Shahar Shitrit - Reviewed-by: Dragos Tatulea - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250820133209.389065-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h b/drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h -index b59aee75de94..2c98a5299df3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/dcbnl.h -@@ -26,7 +26,6 @@ struct mlx5e_dcbx { - u8 cap; - - /* Buffer configuration */ -- bool manual_buffer; - u32 cable_len; - u32 xoff; - u16 port_buff_cell_sz; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 8705cffc747f..b08328fe1aa3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -362,6 +362,7 @@ static int mlx5e_dcbnl_ieee_getpfc(struct net_device *dev, - static int mlx5e_dcbnl_ieee_setpfc(struct net_device *dev, - struct ieee_pfc *pfc) - { -+ u8 buffer_ownership = MLX5_BUF_OWNERSHIP_UNKNOWN; - struct mlx5e_priv *priv = netdev_priv(dev); - struct mlx5_core_dev *mdev = priv->mdev; - u32 old_cable_len = priv->dcbx.cable_len; -@@ -389,7 +390,14 @@ static int mlx5e_dcbnl_ieee_setpfc(struct net_device *dev, - - if (MLX5_BUFFER_SUPPORTED(mdev)) { - pfc_new.pfc_en = (changed & MLX5E_PORT_BUFFER_PFC) ? pfc->pfc_en : curr_pfc_en; -- if (priv->dcbx.manual_buffer) -+ ret = mlx5_query_port_buffer_ownership(mdev, -+ &buffer_ownership); -+ if (ret) -+ netdev_err(dev, -+ "%s, Failed to get buffer ownership: %d\n", -+ __func__, ret); -+ -+ if (buffer_ownership == MLX5_BUF_OWNERSHIP_SW_OWNED) - ret = mlx5e_port_manual_buffer_config(priv, changed, - dev->mtu, &pfc_new, - NULL, NULL); -@@ -982,7 +990,6 @@ static int mlx5e_dcbnl_setbuffer(struct net_device *dev, - if (!changed) - return 0; - -- priv->dcbx.manual_buffer = true; - err = mlx5e_port_manual_buffer_config(priv, changed, dev->mtu, NULL, - buffer_size, prio2buffer); - return err; -@@ -1250,7 +1257,6 @@ void mlx5e_dcbnl_initialize(struct mlx5e_priv *priv) - priv->dcbx.cap |= DCB_CAP_DCBX_HOST; - - priv->dcbx.port_buff_cell_sz = mlx5e_query_port_buffers_cell_size(priv); -- priv->dcbx.manual_buffer = false; - priv->dcbx.cable_len = MLX5E_DEFAULT_CABLE_LEN; - - mlx5e_ets_init(priv); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index b6d53db27cd5..9d3504f5abfa 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -367,6 +367,8 @@ int mlx5_query_port_dcbx_param(struct mlx5_core_dev *mdev, u32 *out); - int mlx5_set_port_dcbx_param(struct mlx5_core_dev *mdev, u32 *in); - int mlx5_set_trust_state(struct mlx5_core_dev *mdev, u8 trust_state); - int mlx5_query_trust_state(struct mlx5_core_dev *mdev, u8 *trust_state); -+int mlx5_query_port_buffer_ownership(struct mlx5_core_dev *mdev, -+ u8 *buffer_ownership); - int mlx5_set_dscp2prio(struct mlx5_core_dev *mdev, u8 dscp, u8 prio); - int mlx5_query_dscp2prio(struct mlx5_core_dev *mdev, u8 *dscp2prio); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c -index 7b99e08a7964..aa9f2b0a77d3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c -@@ -968,6 +968,26 @@ int mlx5_query_trust_state(struct mlx5_core_dev *mdev, u8 *trust_state) - return err; - } - -+int mlx5_query_port_buffer_ownership(struct mlx5_core_dev *mdev, -+ u8 *buffer_ownership) -+{ -+ u32 out[MLX5_ST_SZ_DW(pfcc_reg)] = {}; -+ int err; -+ -+ if (!MLX5_CAP_PCAM_FEATURE(mdev, buffer_ownership)) { -+ *buffer_ownership = MLX5_BUF_OWNERSHIP_UNKNOWN; -+ return 0; -+ } -+ -+ err = mlx5_query_pfcc_reg(mdev, out, sizeof(out)); -+ if (err) -+ return err; -+ -+ *buffer_ownership = MLX5_GET(pfcc_reg, out, buf_ownership); -+ -+ return 0; -+} -+ - int mlx5_set_dscp2prio(struct mlx5_core_dev *mdev, u8 dscp, u8 prio) - { - int sz = MLX5_ST_SZ_BYTES(qpdpm_reg); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1480-net-mlx5e-preserve-shared-buffer-capacity-during-headroom-up.patch b/SOURCES/1480-net-mlx5e-preserve-shared-buffer-capacity-during-headroom-up.patch deleted file mode 100644 index 882cd2ec7..000000000 --- a/SOURCES/1480-net-mlx5e-preserve-shared-buffer-capacity-during-headroom-up.patch +++ /dev/null @@ -1,110 +0,0 @@ -From e3dabd2aa80641b16aa1f10f3a08a3312ed081e8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5e: Preserve shared buffer capacity during headroom - updates - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8b0587a885fdb34fd6090a3f8625cb7ac1444826 -Author: Armen Ratner -Date: Wed Aug 20 16:32:09 2025 +0300 - - net/mlx5e: Preserve shared buffer capacity during headroom updates - - When port buffer headroom changes, port_update_shared_buffer() - recalculates the shared buffer size and splits it in a 3:1 ratio - (lossy:lossless) - Currently, the calculation is: - lossless = shared / 4; - lossy = (shared / 4) * 3; - - Meaning, the calculation dropped the remainder of shared % 4 due to - integer division, unintentionally reducing the total shared buffer - by up to three cells on each update. Over time, this could shrink - the buffer below usable size. - - Fix it by changing the calculation to: - lossless = shared / 4; - lossy = shared - lossless; - - This retains all buffer cells while still approximating the - intended 3:1 split, preventing capacity loss over time. - - While at it, perform headroom calculations in units of cells rather than - in bytes for more accurate calculations avoiding extra divisions. - - Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes") - Signed-off-by: Armen Ratner - Signed-off-by: Maher Sanalla - Reviewed-by: Tariq Toukan - Signed-off-by: Alexei Lazar - Signed-off-by: Mark Bloch - Reviewed-by: Przemek Kitszel - Link: https://patch.msgid.link/20250820133209.389065-9-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 5ae787656a7c..3efa8bf1d14e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -272,8 +272,8 @@ static int port_update_shared_buffer(struct mlx5_core_dev *mdev, - /* Total shared buffer size is split in a ratio of 3:1 between - * lossy and lossless pools respectively. - */ -- lossy_epool_size = (shared_buffer_size / 4) * 3; - lossless_ipool_size = shared_buffer_size / 4; -+ lossy_epool_size = shared_buffer_size - lossless_ipool_size; - - mlx5e_port_set_sbpr(mdev, 0, MLX5_EGRESS_DIR, MLX5_LOSSY_POOL, 0, - lossy_epool_size); -@@ -288,14 +288,12 @@ static int port_set_buffer(struct mlx5e_priv *priv, - u16 port_buff_cell_sz = priv->dcbx.port_buff_cell_sz; - struct mlx5_core_dev *mdev = priv->mdev; - int sz = MLX5_ST_SZ_BYTES(pbmc_reg); -- u32 new_headroom_size = 0; -- u32 current_headroom_size; -+ u32 current_headroom_cells = 0; -+ u32 new_headroom_cells = 0; - void *in; - int err; - int i; - -- current_headroom_size = port_buffer->headroom_size; -- - in = kzalloc(sz, GFP_KERNEL); - if (!in) - return -ENOMEM; -@@ -306,12 +304,14 @@ static int port_set_buffer(struct mlx5e_priv *priv, - - for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) { - void *buffer = MLX5_ADDR_OF(pbmc_reg, in, buffer[i]); -+ current_headroom_cells += MLX5_GET(bufferx_reg, buffer, size); -+ - u64 size = port_buffer->buffer[i].size; - u64 xoff = port_buffer->buffer[i].xoff; - u64 xon = port_buffer->buffer[i].xon; - -- new_headroom_size += size; - do_div(size, port_buff_cell_sz); -+ new_headroom_cells += size; - do_div(xoff, port_buff_cell_sz); - do_div(xon, port_buff_cell_sz); - MLX5_SET(bufferx_reg, buffer, size, size); -@@ -320,10 +320,8 @@ static int port_set_buffer(struct mlx5e_priv *priv, - MLX5_SET(bufferx_reg, buffer, xon_threshold, xon); - } - -- new_headroom_size /= port_buff_cell_sz; -- current_headroom_size /= port_buff_cell_sz; -- err = port_update_shared_buffer(priv->mdev, current_headroom_size, -- new_headroom_size); -+ err = port_update_shared_buffer(priv->mdev, current_headroom_cells, -+ new_headroom_cells); - if (err) - goto out; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1481-net-mlx5-hws-fix-memory-leak-in-hws-pool-buddy-init-error-pa.patch b/SOURCES/1481-net-mlx5-hws-fix-memory-leak-in-hws-pool-buddy-init-error-pa.patch deleted file mode 100644 index 14b424afc..000000000 --- a/SOURCES/1481-net-mlx5-hws-fix-memory-leak-in-hws-pool-buddy-init-error-pa.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 223d0918d6f47f7a9bca9ccd248bfc9f9e3dfcc6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error - path - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2c0a959bebdc1ada13cf9a8242f177c5400299e6 -Author: Lama Kayal -Date: Mon Aug 25 17:34:24 2025 +0300 - - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path - - In the error path of hws_pool_buddy_init(), the buddy allocator cleanup - doesn't free the allocator structure itself, causing a memory leak. - - Add the missing kfree() to properly release all allocated memory. - - Fixes: c61afff94373 ("net/mlx5: HWS, added memory management handling") - Signed-off-by: Lama Kayal - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -index 7e37d6e9eb83..7b5071c3df36 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pool.c -@@ -124,6 +124,7 @@ static int hws_pool_buddy_init(struct mlx5hws_pool *pool) - mlx5hws_err(pool->ctx, "Failed to create resource type: %d size %zu\n", - pool->type, pool->alloc_log_sz); - mlx5hws_buddy_cleanup(buddy); -+ kfree(buddy); - return -ENOMEM; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1482-net-mlx5-hws-fix-memory-leak-in-hws-action-get-shared-stc-ni.patch b/SOURCES/1482-net-mlx5-hws-fix-memory-leak-in-hws-action-get-shared-stc-ni.patch deleted file mode 100644 index eed884841..000000000 --- a/SOURCES/1482-net-mlx5-hws-fix-memory-leak-in-hws-action-get-shared-stc-ni.patch +++ /dev/null @@ -1,45 +0,0 @@ -From c1f59cf7c514ce94f11a1211050c606e42d03dca Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix memory leak in - hws_action_get_shared_stc_nic error flow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a630f83592cdad1253523a1b760cfe78fef6cd9c -Author: Lama Kayal -Date: Mon Aug 25 17:34:25 2025 +0300 - - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow - - When an invalid stc_type is provided, the function allocates memory for - shared_stc but jumps to unlock_and_out without freeing it, causing a - memory leak. - - Fix by jumping to free_shared_stc label instead to ensure proper cleanup. - - Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") - Signed-off-by: Lama Kayal - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-3-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 396804369b00..6b36a4a7d895 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -117,7 +117,7 @@ static int hws_action_get_shared_stc_nic(struct mlx5hws_context *ctx, - mlx5hws_err(ctx, "No such stc_type: %d\n", stc_type); - pr_warn("HWS: Invalid stc_type: %d\n", stc_type); - ret = -EINVAL; -- goto unlock_and_out; -+ goto free_shared_stc; - } - - ret = mlx5hws_action_alloc_single_stc(ctx, &stc_attr, tbl_type, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1483-net-mlx5-hws-fix-uninitialized-variables-in-mlx5hws-pat-calc.patch b/SOURCES/1483-net-mlx5-hws-fix-uninitialized-variables-in-mlx5hws-pat-calc.patch deleted file mode 100644 index 65275df14..000000000 --- a/SOURCES/1483-net-mlx5-hws-fix-uninitialized-variables-in-mlx5hws-pat-calc.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 74dac1eedfab4ceb5c4e79d3fd50685dd9d1f812 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix uninitialized variables in - mlx5hws_pat_calc_nop error flow - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 24b6e53140475b56cadcccd4e82a93aa5bacf1eb -Author: Lama Kayal -Date: Mon Aug 25 17:34:26 2025 +0300 - - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow - - In mlx5hws_pat_calc_nop(), src_field and dst_field are passed to - hws_action_modify_get_target_fields() which should set their values. - However, if an invalid action type is encountered, these variables - remain uninitialized and are later used to update prev_src_field - and prev_dst_field. - - Initialize both variables to INVALID_FIELD to ensure they have - defined values in all code paths. - - Fixes: 01e035fd0380 ("net/mlx5: HWS, handle modify header actions dependency") - Signed-off-by: Lama Kayal - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -index 51e4c551e0ef..622fd579f140 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -@@ -527,7 +527,6 @@ int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, - u32 *nop_locations, __be64 *new_pat) - { - u16 prev_src_field = INVALID_FIELD, prev_dst_field = INVALID_FIELD; -- u16 src_field, dst_field; - u8 action_type; - bool dependent; - size_t i, j; -@@ -539,6 +538,9 @@ int mlx5hws_pat_calc_nop(__be64 *pattern, size_t num_actions, - return 0; - - for (i = 0, j = 0; i < num_actions; i++, j++) { -+ u16 src_field = INVALID_FIELD; -+ u16 dst_field = INVALID_FIELD; -+ - if (j >= max_actions) - return -EINVAL; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1484-net-mlx5-hws-fix-pattern-destruction-in-mlx5hws-pat-get-patt.patch b/SOURCES/1484-net-mlx5-hws-fix-pattern-destruction-in-mlx5hws-pat-get-patt.patch deleted file mode 100644 index 0ccdb92cd..000000000 --- a/SOURCES/1484-net-mlx5-hws-fix-pattern-destruction-in-mlx5hws-pat-get-patt.patch +++ /dev/null @@ -1,52 +0,0 @@ -From d1f05a9096aedbf63150bffeb5a0d1b64c6fef49 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: HWS, Fix pattern destruction in - mlx5hws_pat_get_pattern error path - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 00a50e4e8974cbf5d6a1dc91cfa5cce4aa7af05a -Author: Lama Kayal -Date: Mon Aug 25 17:34:27 2025 +0300 - - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path - - In mlx5hws_pat_get_pattern(), when mlx5hws_pat_add_pattern_to_cache() - fails, the function attempts to clean up the pattern created by - mlx5hws_cmd_header_modify_pattern_create(). However, it incorrectly - uses *pattern_id which hasn't been set yet, instead of the local - ptrn_id variable that contains the actual pattern ID. - - This results in attempting to destroy a pattern using uninitialized - data from the output parameter, rather than the valid pattern ID - returned by the firmware. - - Use ptrn_id instead of *pattern_id in the cleanup path to properly - destroy the created pattern. - - Fixes: aefc15a0fa1c ("net/mlx5: HWS, added modify header pattern and args handling") - Signed-off-by: Lama Kayal - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -index 622fd579f140..d56271a9e4f0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/pat_arg.c -@@ -279,7 +279,7 @@ int mlx5hws_pat_get_pattern(struct mlx5hws_context *ctx, - return ret; - - clean_pattern: -- mlx5hws_cmd_header_modify_pattern_destroy(ctx->mdev, *pattern_id); -+ mlx5hws_cmd_header_modify_pattern_destroy(ctx->mdev, ptrn_id); - out_unlock: - mutex_unlock(&ctx->pattern_cache->lock); - return ret; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1485-net-mlx5-reload-auxiliary-drivers-on-fw-activate.patch b/SOURCES/1485-net-mlx5-reload-auxiliary-drivers-on-fw-activate.patch deleted file mode 100644 index 84a92fdae..000000000 --- a/SOURCES/1485-net-mlx5-reload-auxiliary-drivers-on-fw-activate.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 16da4a8dd6e2c76f90cc71ed53bbe7c5864360be Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:01 -0400 -Subject: [PATCH] net/mlx5: Reload auxiliary drivers on fw_activate - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 34cc6a54914f478c93e176450fae6313404f9f74 -Author: Moshe Shemesh -Date: Mon Aug 25 17:34:28 2025 +0300 - - net/mlx5: Reload auxiliary drivers on fw_activate - - The devlink reload fw_activate command performs firmware activation - followed by driver reload, while devlink reload driver_reinit triggers - only driver reload. However, the driver reload logic differs between the - two modes, as on driver_reinit mode mlx5 also reloads auxiliary drivers, - while in fw_activate mode the auxiliary drivers are suspended where - applicable. - - Additionally, following the cited commit, if the device has multiple PFs, - the behavior during fw_activate may vary between PFs: one PF may suspend - auxiliary drivers, while another reloads them. - - Align devlink dev reload fw_activate behavior with devlink dev reload - driver_reinit, to reload all auxiliary drivers. - - Fixes: 72ed5d5624af ("net/mlx5: Suspend auxiliary devices only in case of PCI device suspend") - Signed-off-by: Moshe Shemesh - Reviewed-by: Tariq Toukan - Reviewed-by: Akiva Goldberger - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 204055be51c0..b97dfb6f005f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -160,7 +160,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netli - if (err) - return err; - -- mlx5_unload_one_devl_locked(dev, true); -+ mlx5_unload_one_devl_locked(dev, false); - err = mlx5_health_wait_pci_up(dev); - if (err) - NL_SET_ERR_MSG_MOD(extack, "FW activate aborted, PCI reads fail after reset"); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1486-net-mlx5-fix-lockdep-assertion-on-sync-reset-unload-event.patch b/SOURCES/1486-net-mlx5-fix-lockdep-assertion-on-sync-reset-unload-event.patch deleted file mode 100644 index 2f02b6250..000000000 --- a/SOURCES/1486-net-mlx5-fix-lockdep-assertion-on-sync-reset-unload-event.patch +++ /dev/null @@ -1,259 +0,0 @@ -From 8d67e5b6048a7a5d0a98c8990787da19ebb1b140 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5: Fix lockdep assertion on sync reset unload event - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 902a8bc23a24882200f57cadc270e15a2cfaf2bb -Author: Moshe Shemesh -Date: Mon Aug 25 17:34:29 2025 +0300 - - net/mlx5: Fix lockdep assertion on sync reset unload event - - Fix lockdep assertion triggered during sync reset unload event. When the - sync reset flow is initiated using the devlink reload fw_activate - option, the PF already holds the devlink lock while handling unload - event. In this case, delegate sync reset unload event handling back to - the devlink callback process to avoid double-locking and resolve the - lockdep warning. - - Kernel log: - WARNING: CPU: 9 PID: 1578 at devl_assert_locked+0x31/0x40 - [...] - Call Trace: - - mlx5_unload_one_devl_locked+0x2c/0xc0 [mlx5_core] - mlx5_sync_reset_unload_event+0xaf/0x2f0 [mlx5_core] - process_one_work+0x222/0x640 - worker_thread+0x199/0x350 - kthread+0x10b/0x230 - ? __pfx_worker_thread+0x10/0x10 - ? __pfx_kthread+0x10/0x10 - ret_from_fork+0x8e/0x100 - ? __pfx_kthread+0x10/0x10 - ret_from_fork_asm+0x1a/0x30 - - - Fixes: 7a9770f1bfea ("net/mlx5: Handle sync reset unload event") - Signed-off-by: Moshe Shemesh - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-7-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index b97dfb6f005f..8c53fe5aa306 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -160,7 +160,7 @@ static int mlx5_devlink_reload_fw_activate(struct devlink *devlink, struct netli - if (err) - return err; - -- mlx5_unload_one_devl_locked(dev, false); -+ mlx5_sync_reset_unload_flow(dev, true); - err = mlx5_health_wait_pci_up(dev); - if (err) - NL_SET_ERR_MSG_MOD(extack, "FW activate aborted, PCI reads fail after reset"); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 69933addd921..38b9b184ae01 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -12,7 +12,8 @@ enum { - MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, - MLX5_FW_RESET_FLAGS_PENDING_COMP, - MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, -- MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED -+ MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, -+ MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, - }; - - struct mlx5_fw_reset { -@@ -219,7 +220,7 @@ int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev) - return mlx5_reg_mfrl_set(dev, MLX5_MFRL_REG_RESET_LEVEL0, 0, 0, false); - } - --static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev, bool unloaded) -+static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) - { - struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; - struct devlink *devlink = priv_to_devlink(dev); -@@ -228,8 +229,7 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev, bool unload - if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) { - complete(&fw_reset->done); - } else { -- if (!unloaded) -- mlx5_unload_one(dev, false); -+ mlx5_sync_reset_unload_flow(dev, false); - if (mlx5_health_wait_pci_up(dev)) - mlx5_core_err(dev, "reset reload flow aborted, PCI reads still not working\n"); - else -@@ -272,7 +272,7 @@ static void mlx5_sync_reset_reload_work(struct work_struct *work) - - mlx5_sync_reset_clear_reset_requested(dev, false); - mlx5_enter_error_state(dev, true); -- mlx5_fw_reset_complete_reload(dev, false); -+ mlx5_fw_reset_complete_reload(dev); - } - - #define MLX5_RESET_POLL_INTERVAL (HZ / 10) -@@ -586,6 +586,65 @@ static int mlx5_sync_pci_reset(struct mlx5_core_dev *dev, u8 reset_method) - return err; - } - -+void mlx5_sync_reset_unload_flow(struct mlx5_core_dev *dev, bool locked) -+{ -+ struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; -+ unsigned long timeout; -+ int poll_freq = 20; -+ bool reset_action; -+ u8 rst_state; -+ int err; -+ -+ if (locked) -+ mlx5_unload_one_devl_locked(dev, false); -+ else -+ mlx5_unload_one(dev, false); -+ -+ if (!test_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags)) -+ return; -+ -+ mlx5_set_fw_rst_ack(dev); -+ mlx5_core_warn(dev, "Sync Reset Unload done, device reset expected\n"); -+ -+ reset_action = false; -+ timeout = jiffies + msecs_to_jiffies(mlx5_tout_ms(dev, RESET_UNLOAD)); -+ do { -+ rst_state = mlx5_get_fw_rst_state(dev); -+ if (rst_state == MLX5_FW_RST_STATE_TOGGLE_REQ || -+ rst_state == MLX5_FW_RST_STATE_IDLE) { -+ reset_action = true; -+ break; -+ } -+ if (rst_state == MLX5_FW_RST_STATE_DROP_MODE) { -+ mlx5_core_info(dev, "Sync Reset Drop mode ack\n"); -+ mlx5_set_fw_rst_ack(dev); -+ poll_freq = 1000; -+ } -+ msleep(poll_freq); -+ } while (!time_after(jiffies, timeout)); -+ -+ if (!reset_action) { -+ mlx5_core_err(dev, "Got timeout waiting for sync reset action, state = %u\n", -+ rst_state); -+ fw_reset->ret = -ETIMEDOUT; -+ goto done; -+ } -+ -+ mlx5_core_warn(dev, "Sync Reset, got reset action. rst_state = %u\n", -+ rst_state); -+ if (rst_state == MLX5_FW_RST_STATE_TOGGLE_REQ) { -+ err = mlx5_sync_pci_reset(dev, fw_reset->reset_method); -+ if (err) { -+ mlx5_core_warn(dev, "mlx5_sync_pci_reset failed, err %d\n", -+ err); -+ fw_reset->ret = err; -+ } -+ } -+ -+done: -+ clear_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags); -+} -+ - static void mlx5_sync_reset_now_event(struct work_struct *work) - { - struct mlx5_fw_reset *fw_reset = container_of(work, struct mlx5_fw_reset, -@@ -613,17 +672,13 @@ static void mlx5_sync_reset_now_event(struct work_struct *work) - mlx5_enter_error_state(dev, true); - done: - fw_reset->ret = err; -- mlx5_fw_reset_complete_reload(dev, false); -+ mlx5_fw_reset_complete_reload(dev); - } - - static void mlx5_sync_reset_unload_event(struct work_struct *work) - { - struct mlx5_fw_reset *fw_reset; - struct mlx5_core_dev *dev; -- unsigned long timeout; -- int poll_freq = 20; -- bool reset_action; -- u8 rst_state; - int err; - - fw_reset = container_of(work, struct mlx5_fw_reset, reset_unload_work); -@@ -632,6 +687,7 @@ static void mlx5_sync_reset_unload_event(struct work_struct *work) - if (mlx5_sync_reset_clear_reset_requested(dev, false)) - return; - -+ set_bit(MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, &fw_reset->reset_flags); - mlx5_core_warn(dev, "Sync Reset Unload. Function is forced down.\n"); - - err = mlx5_cmd_fast_teardown_hca(dev); -@@ -640,49 +696,7 @@ static void mlx5_sync_reset_unload_event(struct work_struct *work) - else - mlx5_enter_error_state(dev, true); - -- if (test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) -- mlx5_unload_one_devl_locked(dev, false); -- else -- mlx5_unload_one(dev, false); -- -- mlx5_set_fw_rst_ack(dev); -- mlx5_core_warn(dev, "Sync Reset Unload done, device reset expected\n"); -- -- reset_action = false; -- timeout = jiffies + msecs_to_jiffies(mlx5_tout_ms(dev, RESET_UNLOAD)); -- do { -- rst_state = mlx5_get_fw_rst_state(dev); -- if (rst_state == MLX5_FW_RST_STATE_TOGGLE_REQ || -- rst_state == MLX5_FW_RST_STATE_IDLE) { -- reset_action = true; -- break; -- } -- if (rst_state == MLX5_FW_RST_STATE_DROP_MODE) { -- mlx5_core_info(dev, "Sync Reset Drop mode ack\n"); -- mlx5_set_fw_rst_ack(dev); -- poll_freq = 1000; -- } -- msleep(poll_freq); -- } while (!time_after(jiffies, timeout)); -- -- if (!reset_action) { -- mlx5_core_err(dev, "Got timeout waiting for sync reset action, state = %u\n", -- rst_state); -- fw_reset->ret = -ETIMEDOUT; -- goto done; -- } -- -- mlx5_core_warn(dev, "Sync Reset, got reset action. rst_state = %u\n", rst_state); -- if (rst_state == MLX5_FW_RST_STATE_TOGGLE_REQ) { -- err = mlx5_sync_pci_reset(dev, fw_reset->reset_method); -- if (err) { -- mlx5_core_warn(dev, "mlx5_sync_pci_reset failed, err %d\n", err); -- fw_reset->ret = err; -- } -- } -- --done: -- mlx5_fw_reset_complete_reload(dev, true); -+ mlx5_fw_reset_complete_reload(dev); - } - - static void mlx5_sync_reset_abort_event(struct work_struct *work) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -index ea527d06a85f..d5b28525c960 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -@@ -12,6 +12,7 @@ int mlx5_fw_reset_set_reset_sync(struct mlx5_core_dev *dev, u8 reset_type_sel, - int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev); - - int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev); -+void mlx5_sync_reset_unload_flow(struct mlx5_core_dev *dev, bool locked); - int mlx5_fw_reset_verify_fw_complete(struct mlx5_core_dev *dev, - struct netlink_ext_ack *extack); - void mlx5_fw_reset_events_start(struct mlx5_core_dev *dev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1487-net-mlx5-nack-sync-reset-when-sfs-are-present.patch b/SOURCES/1487-net-mlx5-nack-sync-reset-when-sfs-are-present.patch deleted file mode 100644 index 586b2864c..000000000 --- a/SOURCES/1487-net-mlx5-nack-sync-reset-when-sfs-are-present.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 7c29b174a5e289e35ebc9cf72567d198522b3183 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5: Nack sync reset when SFs are present - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 26e42ec7712d392d561964514b1f253b1a96f42d -Author: Moshe Shemesh -Date: Mon Aug 25 17:34:30 2025 +0300 - - net/mlx5: Nack sync reset when SFs are present - - If PF (Physical Function) has SFs (Sub-Functions), since the SFs are not - taking part in the synchronization flow, sync reset can lead to fatal - error on the SFs, as the function will be closed unexpectedly from the - SF point of view. - - Add a check to prevent sync reset when there are SFs on a PF device - which is not ECPF, as ECPF is teardowned gracefully before reset. - - Fixes: 92501fa6e421 ("net/mlx5: Ack on sync_reset_request only if PF can do reset_now") - Signed-off-by: Moshe Shemesh - Reviewed-by: Parav Pandit - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-8-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 38b9b184ae01..22995131824a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -6,6 +6,7 @@ - #include "fw_reset.h" - #include "diag/fw_tracer.h" - #include "lib/tout.h" -+#include "sf/sf.h" - - enum { - MLX5_FW_RESET_FLAGS_RESET_REQUESTED, -@@ -428,6 +429,11 @@ static bool mlx5_is_reset_now_capable(struct mlx5_core_dev *dev, - return false; - } - -+ if (!mlx5_core_is_ecpf(dev) && !mlx5_sf_table_empty(dev)) { -+ mlx5_core_warn(dev, "SFs should be removed before reset\n"); -+ return false; -+ } -+ - #if IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE) - if (reset_method != MLX5_MFRL_REG_PCI_RESET_METHOD_HOT_RESET) { - err = mlx5_check_hotplug_interrupt(dev, bridge); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -index 0864ba625c07..3304f25cc805 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -@@ -518,3 +518,13 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - WARN_ON(!xa_empty(&table->function_ids)); - kfree(table); - } -+ -+bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev) -+{ -+ struct mlx5_sf_table *table = dev->priv.sf_table; -+ -+ if (!table) -+ return true; -+ -+ return xa_empty(&table->function_ids); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -index 860f9ddb7107..89559a37997a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -@@ -17,6 +17,7 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev); - - int mlx5_sf_table_init(struct mlx5_core_dev *dev); - void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev); -+bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev); - - int mlx5_devlink_sf_port_new(struct devlink *devlink, - const struct devlink_port_new_attrs *add_attr, -@@ -61,6 +62,11 @@ static inline void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - { - } - -+static inline bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev) -+{ -+ return true; -+} -+ - #endif - - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1488-net-mlx5-prevent-flow-steering-mode-changes-in-switchdev-mod.patch b/SOURCES/1488-net-mlx5-prevent-flow-steering-mode-changes-in-switchdev-mod.patch deleted file mode 100644 index f77e7cb1d..000000000 --- a/SOURCES/1488-net-mlx5-prevent-flow-steering-mode-changes-in-switchdev-mod.patch +++ /dev/null @@ -1,62 +0,0 @@ -From ffafacde352f98dec23fba49d1430594a39ee7f8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5: Prevent flow steering mode changes in switchdev - mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cf9a8627b9a369ba01d37be6f71b297beb688faa -Author: Moshe Shemesh -Date: Mon Aug 25 17:34:31 2025 +0300 - - net/mlx5: Prevent flow steering mode changes in switchdev mode - - Changing flow steering modes is not allowed when eswitch is in switchdev - mode. This fix ensures that any steering mode change, including to - firmware steering, is correctly blocked while eswitch mode is switchdev. - - Fixes: e890acd5ff18 ("net/mlx5: Add devlink flow_steering_mode parameter") - Signed-off-by: Moshe Shemesh - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-9-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 0de287392c32..fafccfe9fb64 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3734,6 +3734,13 @@ static int mlx5_fs_mode_validate(struct devlink *devlink, u32 id, - char *value = val.vstr; - u8 eswitch_mode; - -+ eswitch_mode = mlx5_eswitch_mode(dev); -+ if (eswitch_mode == MLX5_ESWITCH_OFFLOADS) { -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "Changing fs mode is not supported when eswitch offloads enabled."); -+ return -EOPNOTSUPP; -+ } -+ - if (!strcmp(value, "dmfs")) - return 0; - -@@ -3759,14 +3766,6 @@ static int mlx5_fs_mode_validate(struct devlink *devlink, u32 id, - return -EINVAL; - } - -- eswitch_mode = mlx5_eswitch_mode(dev); -- if (eswitch_mode == MLX5_ESWITCH_OFFLOADS) { -- NL_SET_ERR_MSG_FMT_MOD(extack, -- "Moving to %s is not supported when eswitch offloads enabled.", -- value); -- return -EOPNOTSUPP; -- } -- - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1489-net-mlx5e-set-local-xoff-after-fw-update.patch b/SOURCES/1489-net-mlx5e-set-local-xoff-after-fw-update.patch deleted file mode 100644 index e5a486c43..000000000 --- a/SOURCES/1489-net-mlx5e-set-local-xoff-after-fw-update.patch +++ /dev/null @@ -1,52 +0,0 @@ -From ecbfbdf8a69145aac9f6ce649ff1f0df6e1492c6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5e: Set local Xoff after FW update - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit aca0c31af61e0d5cf1675a0cbd29460b95ae693c -Author: Alexei Lazar -Date: Mon Aug 25 17:34:34 2025 +0300 - - net/mlx5e: Set local Xoff after FW update - - The local Xoff value is being set before the firmware (FW) update. - In case of a failure where the FW is not updated with the new value, - there is no fallback to the previous value. - Update the local Xoff value after the FW has been successfully set. - - Fixes: 0696d60853d5 ("net/mlx5e: Receive buffer configuration") - Signed-off-by: Alexei Lazar - Reviewed-by: Tariq Toukan - Reviewed-by: Dragos Tatulea - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250825143435.598584-12-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -index 3efa8bf1d14e..4720523813b9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c -@@ -575,7 +575,6 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - if (err) - return err; - } -- priv->dcbx.xoff = xoff; - - /* Apply the settings */ - if (update_buffer) { -@@ -584,6 +583,8 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv, - return err; - } - -+ priv->dcbx.xoff = xoff; -+ - if (update_prio2buffer) - err = mlx5e_port_set_priority2buffer(priv->mdev, prio2buffer); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1490-net-mlx5e-harden-uplink-netdev-access-against-device-unbind.patch b/SOURCES/1490-net-mlx5e-harden-uplink-netdev-access-against-device-unbind.patch deleted file mode 100644 index 365d19abc..000000000 --- a/SOURCES/1490-net-mlx5e-harden-uplink-netdev-access-against-device-unbind.patch +++ /dev/null @@ -1,154 +0,0 @@ -From 0c57717c5a423776e7d1d71db56227cca621d0d1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5e: Harden uplink netdev access against device unbind - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6b4be64fd9fec16418f365c2d8e47a7566e9eba5 -Author: Jianbo Liu -Date: Mon Sep 15 15:24:32 2025 +0300 - - net/mlx5e: Harden uplink netdev access against device unbind - - The function mlx5_uplink_netdev_get() gets the uplink netdevice - pointer from mdev->mlx5e_res.uplink_netdev. However, the netdevice can - be removed and its pointer cleared when unbound from the mlx5_core.eth - driver. This results in a NULL pointer, causing a kernel panic. - - BUG: unable to handle page fault for address: 0000000000001300 - at RIP: 0010:mlx5e_vport_rep_load+0x22a/0x270 [mlx5_core] - Call Trace: - - mlx5_esw_offloads_rep_load+0x68/0xe0 [mlx5_core] - esw_offloads_enable+0x593/0x910 [mlx5_core] - mlx5_eswitch_enable_locked+0x341/0x420 [mlx5_core] - mlx5_devlink_eswitch_mode_set+0x17e/0x3a0 [mlx5_core] - devlink_nl_eswitch_set_doit+0x60/0xd0 - genl_family_rcv_msg_doit+0xe0/0x130 - genl_rcv_msg+0x183/0x290 - netlink_rcv_skb+0x4b/0xf0 - genl_rcv+0x24/0x40 - netlink_unicast+0x255/0x380 - netlink_sendmsg+0x1f3/0x420 - __sock_sendmsg+0x38/0x60 - __sys_sendto+0x119/0x180 - do_syscall_64+0x53/0x1d0 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - - Ensure the pointer is valid before use by checking it for NULL. If it - is valid, immediately call netdev_hold() to take a reference, and - preventing the netdevice from being freed while it is in use. - - Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") - Signed-off-by: Jianbo Liu - Reviewed-by: Cosmin Ratiu - Reviewed-by: Jiri Pirko - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757939074-617281-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 2640cace0f76..5766be2c0153 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -1499,12 +1499,21 @@ static const struct mlx5e_profile mlx5e_uplink_rep_profile = { - static int - mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - { -- struct mlx5e_priv *priv = netdev_priv(mlx5_uplink_netdev_get(dev)); - struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); -+ struct net_device *netdev; -+ struct mlx5e_priv *priv; -+ int err; -+ -+ netdev = mlx5_uplink_netdev_get(dev); -+ if (!netdev) -+ return 0; - -+ priv = netdev_priv(netdev); - rpriv->netdev = priv->netdev; -- return mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, -- rpriv); -+ err = mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, -+ rpriv); -+ mlx5_uplink_netdev_put(dev, netdev); -+ return err; - } - - static void -@@ -1631,8 +1640,16 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) - { - struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); - struct net_device *netdev = rpriv->netdev; -- struct mlx5e_priv *priv = netdev_priv(netdev); -- void *ppriv = priv->ppriv; -+ struct mlx5e_priv *priv; -+ void *ppriv; -+ -+ if (!netdev) { -+ ppriv = rpriv; -+ goto free_ppriv; -+ } -+ -+ priv = netdev_priv(netdev); -+ ppriv = priv->ppriv; - - if (rep->vport == MLX5_VPORT_UPLINK) { - mlx5e_vport_uplink_rep_unload(rpriv); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 8b4977650183..5f2d6c35f1ad 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1515,6 +1515,7 @@ static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) - speed = lksettings.base.speed; - - out: -+ mlx5_uplink_netdev_put(mdev, slave); - return speed; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -index b111ccd03b02..74ea5da58b7e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mlx5.h -@@ -47,7 +47,20 @@ int mlx5_crdump_collect(struct mlx5_core_dev *dev, u32 *cr_data); - - static inline struct net_device *mlx5_uplink_netdev_get(struct mlx5_core_dev *mdev) - { -- return mdev->mlx5e_res.uplink_netdev; -+ struct mlx5e_resources *mlx5e_res = &mdev->mlx5e_res; -+ struct net_device *netdev; -+ -+ mutex_lock(&mlx5e_res->uplink_netdev_lock); -+ netdev = mlx5e_res->uplink_netdev; -+ netdev_hold(netdev, &mlx5e_res->tracker, GFP_KERNEL); -+ mutex_unlock(&mlx5e_res->uplink_netdev_lock); -+ return netdev; -+} -+ -+static inline void mlx5_uplink_netdev_put(struct mlx5_core_dev *mdev, -+ struct net_device *netdev) -+{ -+ netdev_put(netdev, &mdev->mlx5e_res.tracker); - } - - struct mlx5_sd; -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 8c5fbfb85749..10fe492e1fed 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -663,6 +663,7 @@ struct mlx5e_resources { - bool tisn_valid; - } hw_objs; - struct net_device *uplink_netdev; -+ netdevice_tracker tracker; - struct mutex uplink_netdev_lock; - struct mlx5_crypto_dek_priv *dek_priv; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1491-net-mlx5e-add-a-miss-level-for-ipsec-crypto-offload.patch b/SOURCES/1491-net-mlx5e-add-a-miss-level-for-ipsec-crypto-offload.patch deleted file mode 100644 index 590c50689..000000000 --- a/SOURCES/1491-net-mlx5e-add-a-miss-level-for-ipsec-crypto-offload.patch +++ /dev/null @@ -1,103 +0,0 @@ -From b7ac00cd85d83a5a3b439546e01e6a1f7fd35a2b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5e: Add a miss level for ipsec crypto offload - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7601a0a46216f4ba05adff2de75923b4e8e585c2 -Author: Lama Kayal -Date: Mon Sep 15 15:24:34 2025 +0300 - - net/mlx5e: Add a miss level for ipsec crypto offload - - The cited commit adds a miss table for switchdev mode. But it - uses the same level as policy table. Will hit the following error - when running command: - - # ip xfrm state add src 192.168.1.22 dst 192.168.1.21 proto \ - esp spi 1001 reqid 10001 aead 'rfc4106(gcm(aes))' \ - 0x3a189a7f9374955d3817886c8587f1da3df387ff 128 \ - mode tunnel offload dev enp8s0f0 dir in - Error: mlx5_core: Device failed to offload this state. - - The dmesg error is: - - mlx5_core 0000:03:00.0: ipsec_miss_create:578:(pid 311797): fail to create IPsec miss_rule err=-22 - - Fix it by adding a new miss level to avoid the error. - - Fixes: 7d9e292ecd67 ("net/mlx5e: Move IPSec policy check after decryption") - Signed-off-by: Jianbo Liu - Signed-off-by: Chris Mi - Signed-off-by: Lama Kayal - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757939074-617281-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -index 9560fcba643f..ac65e3191480 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -@@ -92,6 +92,7 @@ enum { - MLX5E_ACCEL_FS_ESP_FT_LEVEL = MLX5E_INNER_TTC_FT_LEVEL + 1, - MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL, - MLX5E_ACCEL_FS_POL_FT_LEVEL, -+ MLX5E_ACCEL_FS_POL_MISS_FT_LEVEL, - MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL, - #endif - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -index ffcd0cdeb775..23703f28386a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -@@ -185,6 +185,7 @@ struct mlx5e_ipsec_rx_create_attr { - u32 family; - int prio; - int pol_level; -+ int pol_miss_level; - int sa_level; - int status_level; - enum mlx5_flow_namespace_type chains_ns; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 98b6a3a623f9..65dc3529283b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -747,6 +747,7 @@ static void ipsec_rx_create_attr_set(struct mlx5e_ipsec *ipsec, - attr->family = family; - attr->prio = MLX5E_NIC_PRIO; - attr->pol_level = MLX5E_ACCEL_FS_POL_FT_LEVEL; -+ attr->pol_miss_level = MLX5E_ACCEL_FS_POL_MISS_FT_LEVEL; - attr->sa_level = MLX5E_ACCEL_FS_ESP_FT_LEVEL; - attr->status_level = MLX5E_ACCEL_FS_ESP_FT_ERR_LEVEL; - attr->chains_ns = MLX5_FLOW_NAMESPACE_KERNEL; -@@ -833,7 +834,7 @@ static int ipsec_rx_chains_create_miss(struct mlx5e_ipsec *ipsec, - - ft_attr.max_fte = 1; - ft_attr.autogroup.max_num_groups = 1; -- ft_attr.level = attr->pol_level; -+ ft_attr.level = attr->pol_miss_level; - ft_attr.prio = attr->prio; - - ft = mlx5_create_auto_grouped_flow_table(attr->ns, &ft_attr); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index fafccfe9fb64..80245c38dbad 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -114,9 +114,9 @@ - #define ETHTOOL_NUM_PRIOS 11 - #define ETHTOOL_MIN_LEVEL (KERNEL_MIN_LEVEL + ETHTOOL_NUM_PRIOS) - /* Vlan, mac, ttc, inner ttc, {UDP/ANY/aRFS/accel/{esp, esp_err}}, IPsec policy, -- * {IPsec RoCE MPV,Alias table},IPsec RoCE policy -+ * IPsec policy miss, {IPsec RoCE MPV,Alias table},IPsec RoCE policy - */ --#define KERNEL_NIC_PRIO_NUM_LEVELS 10 -+#define KERNEL_NIC_PRIO_NUM_LEVELS 11 - #define KERNEL_NIC_NUM_PRIOS 1 - /* One more level for tc, and one more for promisc */ - #define KERNEL_MIN_LEVEL (KERNEL_NIC_PRIO_NUM_LEVELS + 2) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1492-net-mlx5-hws-ignore-flow-level-for-multi-dest-table.patch b/SOURCES/1492-net-mlx5-hws-ignore-flow-level-for-multi-dest-table.patch deleted file mode 100644 index 705061a59..000000000 --- a/SOURCES/1492-net-mlx5-hws-ignore-flow-level-for-multi-dest-table.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 51c27a17e77ddff742da7ca6798930dae1987ff4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5: HWS, ignore flow level for multi-dest table - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit efb877cf27e300e47e1c051f4e8fd80fc42325d5 -Author: Yevgeny Kliteynik -Date: Mon Sep 22 10:11:33 2025 +0300 - - net/mlx5: HWS, ignore flow level for multi-dest table - - When HWS creates multi-dest FW table and adds rules to - forward to other tables, ignore the flow level enforcement - in FW, because HWS is responsible for table levels. - - This fixes the following error: - - mlx5_core 0000:08:00.0: mlx5_cmd_out_err:818:(pid 192306): - SET_FLOW_TABLE_ENTRY(0x936) op_mod(0x0) failed, - status bad parameter(0x3), syndrome (0x6ae84c), err(-22) - - Fixes: 504e536d9010 ("net/mlx5: HWS, added actions handling") - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Moshe Shemesh - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758525094-816583-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -index 6b36a4a7d895..fe56b59e24c5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/action.c -@@ -1360,7 +1360,7 @@ mlx5hws_action_create_modify_header(struct mlx5hws_context *ctx, - struct mlx5hws_action * - mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest, - struct mlx5hws_action_dest_attr *dests, -- bool ignore_flow_level, u32 flags) -+ u32 flags) - { - struct mlx5hws_cmd_set_fte_dest *dest_list = NULL; - struct mlx5hws_cmd_ft_create_attr ft_attr = {0}; -@@ -1397,7 +1397,7 @@ mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest, - MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest_list[i].destination_id = dests[i].dest->dest_obj.obj_id; - fte_attr.action_flags |= MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; -- fte_attr.ignore_flow_level = ignore_flow_level; -+ fte_attr.ignore_flow_level = 1; - if (dests[i].is_wire_ft) - last_dest_idx = i; - break; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -index 131e74b2b774..6a4c4cccd643 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/fs_hws.c -@@ -572,12 +572,12 @@ static void mlx5_fs_put_dest_action_sampler(struct mlx5_fs_hws_context *fs_ctx, - static struct mlx5hws_action * - mlx5_fs_create_action_dest_array(struct mlx5hws_context *ctx, - struct mlx5hws_action_dest_attr *dests, -- u32 num_of_dests, bool ignore_flow_level) -+ u32 num_of_dests) - { - u32 flags = MLX5HWS_ACTION_FLAG_HWS_FDB | MLX5HWS_ACTION_FLAG_SHARED; - - return mlx5hws_action_create_dest_array(ctx, num_of_dests, dests, -- ignore_flow_level, flags); -+ flags); - } - - static struct mlx5hws_action * -@@ -1014,19 +1014,14 @@ static int mlx5_fs_fte_get_hws_actions(struct mlx5_flow_root_namespace *ns, - } - (*ractions)[num_actions++].action = dest_actions->dest; - } else if (num_dest_actions > 1) { -- bool ignore_flow_level; -- - if (num_actions == MLX5_FLOW_CONTEXT_ACTION_MAX || - num_fs_actions == MLX5_FLOW_CONTEXT_ACTION_MAX) { - err = -EOPNOTSUPP; - goto free_actions; - } -- ignore_flow_level = -- !!(fte_action->flags & FLOW_ACT_IGNORE_FLOW_LEVEL); - tmp_action = - mlx5_fs_create_action_dest_array(ctx, dest_actions, -- num_dest_actions, -- ignore_flow_level); -+ num_dest_actions); - if (!tmp_action) { - err = -EOPNOTSUPP; - goto free_actions; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -index 2498ceff2060..1ad7a50d938b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/mlx5hws.h -@@ -735,7 +735,6 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags); - * @num_dest: The number of dests attributes. - * @dests: The destination array. Each contains a destination action and can - * have additional actions. -- * @ignore_flow_level: Whether to turn on 'ignore_flow_level' for this dest. - * @flags: Action creation flags (enum mlx5hws_action_flags). - * - * Return: pointer to mlx5hws_action on success NULL otherwise. -@@ -743,7 +742,7 @@ mlx5hws_action_create_push_vlan(struct mlx5hws_context *ctx, u32 flags); - struct mlx5hws_action * - mlx5hws_action_create_dest_array(struct mlx5hws_context *ctx, size_t num_dest, - struct mlx5hws_action_dest_attr *dests, -- bool ignore_flow_level, u32 flags); -+ u32 flags); - - /** - * mlx5hws_action_create_insert_header - Create insert header action. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1493-net-mlx5e-fix-missing-fec-rs-stats-for-rs-544-514-interleave.patch b/SOURCES/1493-net-mlx5e-fix-missing-fec-rs-stats-for-rs-544-514-interleave.patch deleted file mode 100644 index ed71aa7e6..000000000 --- a/SOURCES/1493-net-mlx5e-fix-missing-fec-rs-stats-for-rs-544-514-interleave.patch +++ /dev/null @@ -1,43 +0,0 @@ -From a462cd4d181450388f7a92e030eb445a9e26d143 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:27:02 -0400 -Subject: [PATCH] net/mlx5e: Fix missing FEC RS stats for - RS_544_514_INTERLEAVED_QUAD - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6d0477d0d067a53c1d48d0aff1fd52e151721871 -Author: Carolina Jubran -Date: Mon Sep 22 10:11:34 2025 +0300 - - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD - - Include MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD in the FEC RS stats - handling. This addresses a gap introduced when adding support for - 200G/lane link modes. - - Fixes: 4e343c11efbb ("net/mlx5e: Support FEC settings for 200G per lane link modes") - Signed-off-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Reviewed-by: Yael Chemla - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758525094-816583-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -index 87536f158d07..c6185ddba04b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_stats.c -@@ -1466,6 +1466,7 @@ static void fec_set_block_stats(struct mlx5e_priv *priv, - case MLX5E_FEC_RS_528_514: - case MLX5E_FEC_RS_544_514: - case MLX5E_FEC_LLRS_272_257_1: -+ case MLX5E_FEC_RS_544_514_INTERLEAVED_QUAD: - fec_set_rs_stats(fec_stats, out); - return; - case MLX5E_FEC_FIRECODE: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1494-rdma-mlx5-support-driver-apis-pre-destroy-cq-and-post-destro.patch b/SOURCES/1494-rdma-mlx5-support-driver-apis-pre-destroy-cq-and-post-destro.patch deleted file mode 100644 index d5634e7db..000000000 --- a/SOURCES/1494-rdma-mlx5-support-driver-apis-pre-destroy-cq-and-post-destro.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 7bb84b07914794814787055dc7b0ac6ae57a3e6c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:08 -0400 -Subject: [PATCH] RDMA/mlx5: Support driver APIs pre_destroy_cq and - post_destroy_cq - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b5eeb8365d196c95dbb0fd0a5b5a69a44832f16f -Author: Mark Zhang -Date: Mon Jun 16 13:42:38 2025 +0300 - - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq - - - pre_destroy_cq: Destroy FW CQ object so that no new CQ event would - be generated; - - post_destroy_cq: Release all resources. - - This patch, along with last one, fixes the crash below. - - Unable to handle kernel paging request at virtual address ffff8000114b1180 - Mem abort info: - ESR = 0x96000047 - EC = 0x25: DABT (current EL), IL = 32 bits - SET = 0, FnV = 0 - EA = 0, S1PTW = 0 - Data abort info: - ISV = 0, ISS = 0x00000047 - CM = 0, WnR = 1 - swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000000f4582000 - [ffff8000114b1180] pgd=00000447fffff003, p4d=00000447fffff003, pud=00000447ffffe003, pmd=00000447ffffb003, pte=0000000000000000 - Internal error: Oops: 96000047 [#1] SMP - Modules linked in: udp_diag uio_pci_generic uio tcp_diag inet_diag binfmt_misc sn_core_odd(OE) rpcrdma(OE) xprtrdma(OE) ib_isert(OE) ib_iser(OE) ib_srpt(OE) ib_srp(OE) ib_ipoib(OE) kpatch_9658536(OK) kpatch_9322385(OK) kpatch_8843421(OK) kpatch_8636216(OK) vfat fat aes_ce_blk crypto_simd cryptd aes_ce_cipher crct10dif_ce ghash_ce sm4_ce sha2_ce sha256_arm64 sha1_ce sbsa_gwdt sg acpi_ipmi ipmi_si ipmi_msghandler m1_uncore_ddrss_pmu m1_uncore_cmn_pmu team_yosemite9rc6(OE) vnic(OE) ip_tables mlx5_ib(OE) sd_mod ast mlx5_core(OE) i2c_algo_bit drm_vram_helper psample drm_kms_helper mlxdevm(OE) auxiliary(OE) mlxfw(OE) syscopyarea sysfillrect tls sysimgblt fb_sys_fops drm_ttm_helper nvme ttm nvme_core drm t10_pi i2c_designware_platform i2c_designware_core i2c_core ahci libahci libata rdma_ucm(OE) ib_uverbs(OE) rdma_cm(OE) iw_cm(OE) ib_cm(OE) ib_umad(OE) ib_core(OE) ib_ucm(OE) mlx_compat(OE) [last unloaded: ipmi_devintf] - CPU: 83 PID: 59375 Comm: kworker/u253:1 Kdump: loaded Tainted: G OE K 5.10.84-004.ali5000.alios7.aarch64 #1 - Hardware name: Inspur AliServer-Xuanwu2.0AM-02-2UM1P-5B/AS1221MG1, BIOS 1.2.M1.AL.P.158.00 08/31/2023 - Workqueue: ib-comp-unb-wq ib_cq_poll_work [ib_core] - pstate: 82c00089 (Nzcv daIf +PAN +UAO +TCO BTYPE=--) - pc : native_queued_spin_lock_slowpath+0x1c4/0x31c - lr : mlx5_ib_poll_cq+0x18c/0x2f8 [mlx5_ib] - sp : ffff80002be1bc80 - x29: ffff80002be1bc80 x28: ffff000810e69000 - x27: ffff000810e69000 x26: ffff000810e69200 - x25: 0000000000000000 x24: ffff8000117db000 - x23: ffff04000156b780 x22: 0000000000000000 - x21: ffff04000ce6c160 x20: ffff0008196a4000 - x19: 0000000000000010 x18: 0000000000000020 - x17: 0000000000000000 x16: 0000000000000000 - x15: ffff040055a364e8 x14: ffffffffffffffff - x13: ffff80002318bda8 x12: ffff0400358836e8 - x11: 0000000000000040 x10: 0000000000000eb0 - x9 : 0000000000000000 x8 : 0000000000000000 - x7 : ffff04477fa20140 x6 : ffff8000114b1140 - x5 : ffff04477fa20140 x4 : ffff8000114b1180 - x3 : ffff000810e69200 x2 : ffff8000114b1180 - x1 : 0000000001500000 x0 : ffff04477fa20148 - Call trace: - native_queued_spin_lock_slowpath+0x1c4/0x31c - __ib_process_cq+0x74/0x1b8 [ib_core] - ib_cq_poll_work+0x34/0xa0 [ib_core] - process_one_work+0x1d8/0x4b0 - worker_thread+0x180/0x440 - kthread+0x114/0x120 - Code: 910020e0 8b0400c4 f862d929 aa0403e2 (f8296847) - ---[ end trace 387be2290557729c ]--- - Kernel panic - not syncing: Oops: Fatal exception - SMP: stopping secondary CPUs - Kernel Offset: disabled - CPU features: 0x9850817,7a60aa38 - Memory Limit: none - Starting crashdump kernel... - Bye! - - Signed-off-by: Mark Zhang - Link: https://patch.msgid.link/aaf0072f350d1c7e8731f43b79e11a560bafb9e0.1750070205.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index 3657ab8f848c..78cd3151f2ed 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -1052,20 +1052,31 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - return err; - } - --int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) -+int mlx5_ib_pre_destroy_cq(struct ib_cq *cq) - { - struct mlx5_ib_dev *dev = to_mdev(cq->device); - struct mlx5_ib_cq *mcq = to_mcq(cq); -+ -+ return mlx5_core_destroy_cq(dev->mdev, &mcq->mcq); -+} -+ -+void mlx5_ib_post_destroy_cq(struct ib_cq *cq) -+{ -+ destroy_cq_kernel(to_mdev(cq->device), to_mcq(cq)); -+} -+ -+int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata) -+{ - int ret; - -- ret = mlx5_core_destroy_cq(dev->mdev, &mcq->mcq); -+ ret = mlx5_ib_pre_destroy_cq(cq); - if (ret) - return ret; - - if (udata) -- destroy_cq_user(mcq, udata); -+ destroy_cq_user(to_mcq(cq), udata); - else -- destroy_cq_kernel(dev, mcq); -+ mlx5_ib_post_destroy_cq(cq); - return 0; - } - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index c03743daeaa8..bdd82b371ba0 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -4190,7 +4190,9 @@ static const struct ib_device_ops mlx5_ib_dev_ops = { - .modify_port = mlx5_ib_modify_port, - .modify_qp = mlx5_ib_modify_qp, - .modify_srq = mlx5_ib_modify_srq, -+ .pre_destroy_cq = mlx5_ib_pre_destroy_cq, - .poll_cq = mlx5_ib_poll_cq, -+ .post_destroy_cq = mlx5_ib_post_destroy_cq, - .post_recv = mlx5_ib_post_recv_nodrain, - .post_send = mlx5_ib_post_send_nodrain, - .post_srq_recv = mlx5_ib_post_srq_recv, -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 54ca6e010bd4..66cec408df2c 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1368,6 +1368,8 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - struct uverbs_attr_bundle *attrs); - int mlx5_ib_destroy_cq(struct ib_cq *cq, struct ib_udata *udata); - int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc); -+int mlx5_ib_pre_destroy_cq(struct ib_cq *cq); -+void mlx5_ib_post_destroy_cq(struct ib_cq *cq); - int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags); - int mlx5_ib_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period); - int mlx5_ib_resize_cq(struct ib_cq *ibcq, int entries, struct ib_udata *udata); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1495-rdma-mlx5-add-multiple-priorities-support-to-rdma-transport-.patch b/SOURCES/1495-rdma-mlx5-add-multiple-priorities-support-to-rdma-transport-.patch deleted file mode 100644 index 5be779070..000000000 --- a/SOURCES/1495-rdma-mlx5-add-multiple-priorities-support-to-rdma-transport-.patch +++ /dev/null @@ -1,148 +0,0 @@ -From 2a9f1cd9f95b3225269fbcc0b684b17d422103c1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:08 -0400 -Subject: [PATCH] RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT - userspace tables - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 40852c890119ebf39a741f50db13ae941f230d05 -Author: Patrisious Haddad -Date: Tue Jun 17 11:19:16 2025 +0300 - - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables - - Support the creation of RDMA TRANSPORT tables over multiple priorities - via matcher creation. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Mark Bloch - Link: https://patch.msgid.link/bb38e50ae4504e979c6568d41939402a4cf15635.1750148083.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index 680627f1de33..ebcc05f766e1 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -1966,7 +1966,8 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - break; - case MLX5_FLOW_NAMESPACE_RDMA_TRANSPORT_RX: - case MLX5_FLOW_NAMESPACE_RDMA_TRANSPORT_TX: -- if (ib_port == 0 || user_priority > MLX5_RDMA_TRANSPORT_BYPASS_PRIO) -+ if (ib_port == 0 || -+ user_priority >= MLX5_RDMA_TRANSPORT_BYPASS_PRIO) - return ERR_PTR(-EINVAL); - ret = mlx5_ib_fill_transport_ns_info(dev, ns_type, &flags, - &vport_idx, &vport, -@@ -2016,10 +2017,10 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - prio = &dev->flow_db->rdma_tx[priority]; - break; - case MLX5_FLOW_NAMESPACE_RDMA_TRANSPORT_RX: -- prio = &dev->flow_db->rdma_transport_rx[ib_port - 1]; -+ prio = &dev->flow_db->rdma_transport_rx[priority][ib_port - 1]; - break; - case MLX5_FLOW_NAMESPACE_RDMA_TRANSPORT_TX: -- prio = &dev->flow_db->rdma_transport_tx[ib_port - 1]; -+ prio = &dev->flow_db->rdma_transport_tx[priority][ib_port - 1]; - break; - default: return ERR_PTR(-EINVAL); - } -@@ -3466,31 +3467,40 @@ static const struct ib_device_ops flow_ops = { - - int mlx5_ib_fs_init(struct mlx5_ib_dev *dev) - { -+ int i, j; -+ - dev->flow_db = kzalloc(sizeof(*dev->flow_db), GFP_KERNEL); - - if (!dev->flow_db) - return -ENOMEM; - -- dev->flow_db->rdma_transport_rx = kcalloc(dev->num_ports, -- sizeof(struct mlx5_ib_flow_prio), -- GFP_KERNEL); -- if (!dev->flow_db->rdma_transport_rx) -- goto free_flow_db; -+ for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) { -+ dev->flow_db->rdma_transport_rx[i] = -+ kcalloc(dev->num_ports, -+ sizeof(struct mlx5_ib_flow_prio), GFP_KERNEL); -+ if (!dev->flow_db->rdma_transport_rx[i]) -+ goto free_rdma_transport_rx; -+ } - -- dev->flow_db->rdma_transport_tx = kcalloc(dev->num_ports, -- sizeof(struct mlx5_ib_flow_prio), -- GFP_KERNEL); -- if (!dev->flow_db->rdma_transport_tx) -- goto free_rdma_transport_rx; -+ for (j = 0; j < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; j++) { -+ dev->flow_db->rdma_transport_tx[j] = -+ kcalloc(dev->num_ports, -+ sizeof(struct mlx5_ib_flow_prio), GFP_KERNEL); -+ if (!dev->flow_db->rdma_transport_tx[j]) -+ goto free_rdma_transport_tx; -+ } - - mutex_init(&dev->flow_db->lock); - - ib_set_device_ops(&dev->ib_dev, &flow_ops); - return 0; - -+free_rdma_transport_tx: -+ while (j--) -+ kfree(dev->flow_db->rdma_transport_tx[j]); - free_rdma_transport_rx: -- kfree(dev->flow_db->rdma_transport_rx); --free_flow_db: -+ while (i--) -+ kfree(dev->flow_db->rdma_transport_rx[i]); - kfree(dev->flow_db); - return -ENOMEM; - } -diff --git a/drivers/infiniband/hw/mlx5/fs.h b/drivers/infiniband/hw/mlx5/fs.h -index 2ebe86e5be10..7abba0e2837c 100644 ---- a/drivers/infiniband/hw/mlx5/fs.h -+++ b/drivers/infiniband/hw/mlx5/fs.h -@@ -13,6 +13,8 @@ void mlx5_ib_fs_cleanup_anchor(struct mlx5_ib_dev *dev); - - static inline void mlx5_ib_fs_cleanup(struct mlx5_ib_dev *dev) - { -+ int i; -+ - /* When a steering anchor is created, a special flow table is also - * created for the user to reference. Since the user can reference it, - * the kernel cannot trust that when the user destroys the steering -@@ -25,8 +27,10 @@ static inline void mlx5_ib_fs_cleanup(struct mlx5_ib_dev *dev) - * is a safe assumption that all references are gone. - */ - mlx5_ib_fs_cleanup_anchor(dev); -- kfree(dev->flow_db->rdma_transport_tx); -- kfree(dev->flow_db->rdma_transport_rx); -+ for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) -+ kfree(dev->flow_db->rdma_transport_tx[i]); -+ for (i = 0; i < MLX5_RDMA_TRANSPORT_BYPASS_PRIO; i++) -+ kfree(dev->flow_db->rdma_transport_rx[i]); - kfree(dev->flow_db); - } - #endif /* _MLX5_IB_FS_H */ -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 66cec408df2c..37f902860210 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -316,8 +316,8 @@ struct mlx5_ib_flow_db { - struct mlx5_ib_flow_prio rdma_tx[MLX5_IB_NUM_FLOW_FT]; - struct mlx5_ib_flow_prio opfcs[MLX5_IB_OPCOUNTER_MAX]; - struct mlx5_flow_table *lag_demux_ft; -- struct mlx5_ib_flow_prio *rdma_transport_rx; -- struct mlx5_ib_flow_prio *rdma_transport_tx; -+ struct mlx5_ib_flow_prio *rdma_transport_rx[MLX5_RDMA_TRANSPORT_BYPASS_PRIO]; -+ struct mlx5_ib_flow_prio *rdma_transport_tx[MLX5_RDMA_TRANSPORT_BYPASS_PRIO]; - /* Protect flow steering bypass flow tables - * when add/del flow rules. - * only single add/removal of flow steering rule could be done --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1496-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-flow-creat.patch b/SOURCES/1496-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-flow-creat.patch deleted file mode 100644 index c6b77205d..000000000 --- a/SOURCES/1496-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-flow-creat.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 677a231096d3c49d2b9a19995ba2cec1db49ba01 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:08 -0400 -Subject: [PATCH] RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow - create - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 95a89ec304c38f7447cdbf271f2d1cbad4c3bf81 -Author: Parav Pandit -Date: Thu Jun 26 21:58:05 2025 +0300 - - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create - - Currently, the capability check is done in the default - init_user_ns user namespace. When a process runs in a - non default user namespace, such check fails. Due to this - when a process is running using Podman, it fails to create - the flow. - - Since the RDMA device is a resource within a network namespace, - use the network namespace associated with the RDMA device to - determine its owning user namespace. - - Fixes: 322694412400 ("IB/mlx5: Introduce driver create and destroy flow methods") - Signed-off-by: Parav Pandit - Link: https://patch.msgid.link/a4dcd5e3ac6904ef50b19e56942ca6ab0728794c.1750963874.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index ebcc05f766e1..58e058c067d3 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -2459,7 +2459,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_CREATE_FLOW)( - struct mlx5_ib_dev *dev; - u32 flags; - -- if (!capable(CAP_NET_RAW)) -+ if (!rdma_uattrs_has_raw_cap(attrs)) - return -EPERM; - - fs_matcher = uverbs_attr_get_obj(attrs, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1497-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-anchor-cre.patch b/SOURCES/1497-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-anchor-cre.patch deleted file mode 100644 index e222c2f43..000000000 --- a/SOURCES/1497-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-anchor-cre.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 45706e874cdf6c8294b8830c9069356170a15b38 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:08 -0400 -Subject: [PATCH] RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor - create - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 14957e8125e767bfd40a3ac61b1d6b8e62ee0a98 -Author: Parav Pandit -Date: Thu Jun 26 21:58:06 2025 +0300 - - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create - - Currently, the capability check is done in the default - init_user_ns user namespace. When a process runs in a - non default user namespace, such check fails. Due to this - when a process is running using Podman, it fails to create - the anchor. - - Since the RDMA device is a resource within a network namespace, - use the network namespace associated with the RDMA device to - determine its owning user namespace. - - Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace") - Signed-off-by: Parav Pandit - Link: https://patch.msgid.link/c2376ca75e7658e2cbd1f619cf28fbe98c906419.1750963874.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index 58e058c067d3..bab2f58240c9 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -2990,7 +2990,7 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)( - u32 ft_id; - int err; - -- if (!capable(CAP_NET_RAW)) -+ if (!rdma_dev_has_raw_cap(&dev->ib_dev)) - return -EPERM; - - err = uverbs_get_const(&ib_uapi_ft_type, attrs, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1498-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-devx-creat.patch b/SOURCES/1498-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-devx-creat.patch deleted file mode 100644 index 3247b4877..000000000 --- a/SOURCES/1498-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-devx-creat.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 2fd1c308495b0ae84f02a16b4d4b58df99920114 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:08 -0400 -Subject: [PATCH] RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx - create - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bd82467f17e0940c6f6a5396278cda586c9cb6fd -Author: Parav Pandit -Date: Thu Jun 26 21:58:10 2025 +0300 - - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create - - Currently, the capability check is done in the default - init_user_ns user namespace. When a process runs in a - non default user namespace, such check fails. Due to this - when a process is running using Podman, it fails to create - the devx object. - - Since the RDMA device is a resource within a network namespace, - use the network namespace associated with the RDMA device to - determine its owning user namespace. - - Fixes: a8b92ca1b0e5 ("IB/mlx5: Introduce DEVX") - Signed-off-by: Parav Pandit - Link: https://patch.msgid.link/36ee87e92defd81410c6a2b33f9d6c0d6dcfd64c.1750963874.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index fae11535b1a0..f96c46b93bec 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -159,7 +159,7 @@ int mlx5_ib_devx_create(struct mlx5_ib_dev *dev, bool is_user, u64 req_ucaps) - uctx = MLX5_ADDR_OF(create_uctx_in, in, uctx); - if (is_user && - (MLX5_CAP_GEN(dev->mdev, uctx_cap) & MLX5_UCTX_CAP_RAW_TX) && -- capable(CAP_NET_RAW)) -+ rdma_dev_has_raw_cap(&dev->ib_dev)) - cap |= MLX5_UCTX_CAP_RAW_TX; - if (is_user && - (MLX5_CAP_GEN(dev->mdev, uctx_cap) & --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1499-rdma-mlx5-align-mkc-page-size-capability-check-to-prm.patch b/SOURCES/1499-rdma-mlx5-align-mkc-page-size-capability-check-to-prm.patch deleted file mode 100644 index f3ed387f3..000000000 --- a/SOURCES/1499-rdma-mlx5-align-mkc-page-size-capability-check-to-prm.patch +++ /dev/null @@ -1,142 +0,0 @@ -From 0eddc9480134b5ba251ae340546845445fbfe6e5 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Align mkc page size capability check to PRM -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fcfb03597b7d7737aac6bdfda1f7b5d152cfed73 -Author: Michael Guralnik -Date: Wed Jul 9 09:42:10 2025 +0300 - - RDMA/mlx5: Align mkc page size capability check to PRM - - Align the capabilities checked when using the log_page_size 6th bit in the - mkey context to the PRM definition. The upper and lower bounds are set by - max/min caps, and modification of the 6th bit by UMR is allowed only when - a specific UMR cap is set. - Current implementation falsely assumes all page sizes up-to 2^63 are - supported when the UMR cap is set. In case the upper bound cap is lower - than 63, this might result a FW syndrome on mkey creation, e.g: - mlx5_core 0000:c1:00.0: mlx5_cmd_out_err:832:(pid 0): CREATE_MKEY(0×200) op_mod(0×0) failed, status bad parameter(0×3), syndrome (0×38a711), err(-22) - - Previous cap enforcement is still correct for all current HW, FW and - driver combinations. However, this patch aligns the code to be PRM - compliant in the general case. - - Signed-off-by: Michael Guralnik - Link: https://patch.msgid.link/eab4eeb4785105a4bb5eb362dc0b3662cd840412.1751979184.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 37f902860210..6095d8c58ff6 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1748,18 +1748,59 @@ static inline u32 smi_to_native_portnum(struct mlx5_ib_dev *dev, u32 port) - return (port - 1) / dev->num_ports + 1; - } - -+static inline unsigned int get_max_log_entity_size_cap(struct mlx5_ib_dev *dev, -+ int access_mode) -+{ -+ int max_log_size = 0; -+ -+ if (access_mode == MLX5_MKC_ACCESS_MODE_MTT) -+ max_log_size = -+ MLX5_CAP_GEN_2(dev->mdev, max_mkey_log_entity_size_mtt); -+ else if (access_mode == MLX5_MKC_ACCESS_MODE_KSM) -+ max_log_size = MLX5_CAP_GEN_2( -+ dev->mdev, max_mkey_log_entity_size_fixed_buffer); -+ -+ if (!max_log_size || -+ (max_log_size > 31 && -+ !MLX5_CAP_GEN_2(dev->mdev, umr_log_entity_size_5))) -+ max_log_size = 31; -+ -+ return max_log_size; -+} -+ -+static inline unsigned int get_min_log_entity_size_cap(struct mlx5_ib_dev *dev, -+ int access_mode) -+{ -+ int min_log_size = 0; -+ -+ if (access_mode == MLX5_MKC_ACCESS_MODE_KSM && -+ MLX5_CAP_GEN_2(dev->mdev, -+ min_mkey_log_entity_size_fixed_buffer_valid)) -+ min_log_size = MLX5_CAP_GEN_2( -+ dev->mdev, min_mkey_log_entity_size_fixed_buffer); -+ else -+ min_log_size = -+ MLX5_CAP_GEN_2(dev->mdev, log_min_mkey_entity_size); -+ -+ min_log_size = max(min_log_size, MLX5_ADAPTER_PAGE_SHIFT); -+ return min_log_size; -+} -+ - /* - * For mkc users, instead of a page_offset the command has a start_iova which - * specifies both the page_offset and the on-the-wire IOVA - */ - static __always_inline unsigned long - mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem, -- u64 iova) -+ u64 iova, int access_mode) - { -- int page_size_bits = -- MLX5_CAP_GEN_2(dev->mdev, umr_log_entity_size_5) ? 6 : 5; -- unsigned long bitmap = -- __mlx5_log_page_size_to_bitmap(page_size_bits, 0); -+ unsigned int max_log_entity_size_cap, min_log_entity_size_cap; -+ unsigned long bitmap; -+ -+ max_log_entity_size_cap = get_max_log_entity_size_cap(dev, access_mode); -+ min_log_entity_size_cap = get_min_log_entity_size_cap(dev, access_mode); -+ -+ bitmap = GENMASK_ULL(max_log_entity_size_cap, min_log_entity_size_cap); - - return ib_umem_find_best_pgsz(umem, bitmap, iova); - } -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index 5a7b234bdfd9..0a31f8c248e4 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -1130,7 +1130,8 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd, - if (umem->is_dmabuf) - page_size = mlx5_umem_dmabuf_default_pgsz(umem, iova); - else -- page_size = mlx5_umem_mkc_find_best_pgsz(dev, umem, iova); -+ page_size = mlx5_umem_mkc_find_best_pgsz(dev, umem, iova, -+ access_mode); - if (WARN_ON(!page_size)) - return ERR_PTR(-EINVAL); - -@@ -1435,8 +1436,8 @@ static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem, - mr = alloc_cacheable_mr(pd, umem, iova, access_flags, - MLX5_MKC_ACCESS_MODE_MTT); - } else { -- unsigned long page_size = -- mlx5_umem_mkc_find_best_pgsz(dev, umem, iova); -+ unsigned long page_size = mlx5_umem_mkc_find_best_pgsz( -+ dev, umem, iova, MLX5_MKC_ACCESS_MODE_MTT); - - mutex_lock(&dev->slow_path_mutex); - mr = reg_create(pd, umem, iova, access_flags, page_size, -@@ -1756,7 +1757,8 @@ static bool can_use_umr_rereg_pas(struct mlx5_ib_mr *mr, - if (!mlx5r_umr_can_load_pas(dev, new_umem->length)) - return false; - -- *page_size = mlx5_umem_mkc_find_best_pgsz(dev, new_umem, iova); -+ *page_size = mlx5_umem_mkc_find_best_pgsz( -+ dev, new_umem, iova, mr->mmkey.cache_ent->rb_key.access_mode); - if (WARN_ON(!*page_size)) - return false; - return (mr->mmkey.cache_ent->rb_key.ndescs) >= --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1500-rdma-mlx5-optimize-dmabuf-mkey-page-size.patch b/SOURCES/1500-rdma-mlx5-optimize-dmabuf-mkey-page-size.patch deleted file mode 100644 index 6b84ad0a0..000000000 --- a/SOURCES/1500-rdma-mlx5-optimize-dmabuf-mkey-page-size.patch +++ /dev/null @@ -1,571 +0,0 @@ -From 7b4607e2c48935209521c40fd141d9f44f49c7a1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Optimize DMABUF mkey page size - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e73242aa14d2ec7f4a1a13688366bb36dc0fe5b7 -Author: Edward Srouji -Date: Wed Jul 9 09:42:11 2025 +0300 - - RDMA/mlx5: Optimize DMABUF mkey page size - - The current implementation of DMABUF memory registration uses a fixed - page size for the memory key (mkey), which can lead to suboptimal - performance when the underlying memory layout may offer better page - size. - - The optimization improves performance by reducing the number of page - table entries required for the mkey, leading to less MTT/KSM descriptors - that the HCA must go through to find translations, fewer cache-lines, - and shorter UMR work requests on mkey updates such as when - re-registering or reusing a cacheable mkey. - - To ensure safe page size updates, the implementation uses a 5-step - process: - 1. Make the first X entries non-present, while X is calculated to be - minimal according to a large page shift that can be used to cover the - MR length. - 2. Update the page size to the large supported page size - 3. Load the remaining N-X entries according to the (optimized) - page shift - 4. Update the page size according to the (optimized) page shift - 5. Load the first X entries with the correct translations - - This ensures that at no point is the MR accessible with a partially - updated translation table, maintaining correctness and preventing - access to stale or inconsistent mappings, such as having an mkey - advertising the new page size while some of the underlying page table - entries still contain the old page size translations. - - Signed-off-by: Edward Srouji - Reviewed-by: Michael Guralnik - Link: https://patch.msgid.link/bc05a6b2142c02f96a90635f9a4458ee4bbbf39f.1751979184.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 6095d8c58ff6..326fb13484de 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -100,19 +100,6 @@ unsigned long __mlx5_umem_find_best_quantized_pgoff( - __mlx5_bit_sz(typ, page_offset_fld), 0, scale, \ - page_offset_quantized) - --static inline unsigned long --mlx5_umem_dmabuf_find_best_pgsz(struct ib_umem_dmabuf *umem_dmabuf) --{ -- /* -- * mkeys used for dmabuf are fixed at PAGE_SIZE because we must be able -- * to hold any sgl after a move operation. Ideally the mkc page size -- * could be changed at runtime to be optimal, but right now the driver -- * cannot do that. -- */ -- return ib_umem_find_best_pgsz(&umem_dmabuf->umem, PAGE_SIZE, -- umem_dmabuf->umem.iova); --} -- - enum { - MLX5_IB_MMAP_OFFSET_START = 9, - MLX5_IB_MMAP_OFFSET_END = 255, -@@ -348,6 +335,7 @@ struct mlx5_ib_flow_db { - #define MLX5_IB_UPD_XLT_ACCESS BIT(5) - #define MLX5_IB_UPD_XLT_INDIRECT BIT(6) - #define MLX5_IB_UPD_XLT_DOWNGRADE BIT(7) -+#define MLX5_IB_UPD_XLT_KEEP_PGSZ BIT(8) - - /* Private QP creation flags to be passed in ib_qp_init_attr.create_flags. - * -@@ -735,6 +723,8 @@ struct mlx5_ib_mr { - struct mlx5_ib_mr *dd_crossed_mr; - struct list_head dd_node; - u8 revoked :1; -+ /* Indicates previous dmabuf page fault occurred */ -+ u8 dmabuf_faulted:1; - struct mlx5_ib_mkey null_mmkey; - }; - }; -@@ -1805,4 +1795,14 @@ mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem, - return ib_umem_find_best_pgsz(umem, bitmap, iova); - } - -+static inline unsigned long -+mlx5_umem_dmabuf_find_best_pgsz(struct ib_umem_dmabuf *umem_dmabuf, -+ int access_mode) -+{ -+ return mlx5_umem_mkc_find_best_pgsz(to_mdev(umem_dmabuf->umem.ibdev), -+ &umem_dmabuf->umem, -+ umem_dmabuf->umem.iova, -+ access_mode); -+} -+ - #endif /* MLX5_IB_H */ -diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c -index f6abd64f07f7..1c63cc0b9409 100644 ---- a/drivers/infiniband/hw/mlx5/odp.c -+++ b/drivers/infiniband/hw/mlx5/odp.c -@@ -836,9 +836,13 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt, - u32 *bytes_mapped, u32 flags) - { - struct ib_umem_dmabuf *umem_dmabuf = to_ib_umem_dmabuf(mr->umem); -+ int access_mode = mr->data_direct ? MLX5_MKC_ACCESS_MODE_KSM : -+ MLX5_MKC_ACCESS_MODE_MTT; -+ unsigned int old_page_shift = mr->page_shift; -+ unsigned int page_shift; -+ unsigned long page_size; - u32 xlt_flags = 0; - int err; -- unsigned long page_size; - - if (flags & MLX5_PF_FLAGS_ENABLE) - xlt_flags |= MLX5_IB_UPD_XLT_ENABLE; -@@ -850,20 +854,33 @@ static int pagefault_dmabuf_mr(struct mlx5_ib_mr *mr, size_t bcnt, - return err; - } - -- page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf); -+ page_size = mlx5_umem_dmabuf_find_best_pgsz(umem_dmabuf, access_mode); - if (!page_size) { - ib_umem_dmabuf_unmap_pages(umem_dmabuf); - err = -EINVAL; - } else { -- if (mr->data_direct) -- err = mlx5r_umr_update_data_direct_ksm_pas(mr, xlt_flags); -- else -- err = mlx5r_umr_update_mr_pas(mr, xlt_flags); -+ page_shift = order_base_2(page_size); -+ if (page_shift != mr->page_shift && mr->dmabuf_faulted) { -+ err = mlx5r_umr_dmabuf_update_pgsz(mr, xlt_flags, -+ page_shift); -+ } else { -+ mr->page_shift = page_shift; -+ if (mr->data_direct) -+ err = mlx5r_umr_update_data_direct_ksm_pas( -+ mr, xlt_flags); -+ else -+ err = mlx5r_umr_update_mr_pas(mr, -+ xlt_flags); -+ } - } - dma_resv_unlock(umem_dmabuf->attach->dmabuf->resv); - -- if (err) -+ if (err) { -+ mr->page_shift = old_page_shift; - return err; -+ } -+ -+ mr->dmabuf_faulted = 1; - - if (bytes_mapped) - *bytes_mapped += bcnt; -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index 25601dea9e30..b097d8839cad 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -659,6 +659,8 @@ static void mlx5r_umr_final_update_xlt(struct mlx5_ib_dev *dev, - wqe->ctrl_seg.mkey_mask |= get_umr_update_translation_mask(dev); - if (!mr->ibmr.length) - MLX5_SET(mkc, &wqe->mkey_seg, length64, 1); -+ if (flags & MLX5_IB_UPD_XLT_KEEP_PGSZ) -+ wqe->ctrl_seg.mkey_mask &= ~MLX5_MKEY_MASK_PAGE_SIZE; - } - - wqe->ctrl_seg.xlt_octowords = -@@ -666,46 +668,78 @@ static void mlx5r_umr_final_update_xlt(struct mlx5_ib_dev *dev, - wqe->data_seg.byte_count = cpu_to_be32(sg->length); - } - -+static void -+_mlx5r_umr_init_wqe(struct mlx5_ib_mr *mr, struct mlx5r_umr_wqe *wqe, -+ struct ib_sge *sg, unsigned int flags, -+ unsigned int page_shift, bool dd) -+{ -+ struct mlx5_ib_dev *dev = mr_to_mdev(mr); -+ -+ mlx5r_umr_set_update_xlt_ctrl_seg(&wqe->ctrl_seg, flags, sg); -+ mlx5r_umr_set_update_xlt_mkey_seg(dev, &wqe->mkey_seg, mr, page_shift); -+ if (dd) /* Use the data direct internal kernel PD */ -+ MLX5_SET(mkc, &wqe->mkey_seg, pd, dev->ddr.pdn); -+ mlx5r_umr_set_update_xlt_data_seg(&wqe->data_seg, sg); -+} -+ - static int --_mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd) -+_mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd, -+ size_t start_block, size_t nblocks) - { - size_t ent_size = dd ? sizeof(struct mlx5_ksm) : sizeof(struct mlx5_mtt); - struct mlx5_ib_dev *dev = mr_to_mdev(mr); - struct device *ddev = &dev->mdev->pdev->dev; - struct mlx5r_umr_wqe wqe = {}; -+ size_t processed_blocks = 0; - struct ib_block_iter biter; -+ size_t cur_block_idx = 0; - struct mlx5_ksm *cur_ksm; - struct mlx5_mtt *cur_mtt; - size_t orig_sg_length; -+ size_t total_blocks; - size_t final_size; - void *curr_entry; - struct ib_sge sg; - void *entry; -- u64 offset = 0; -+ u64 offset; - int err = 0; - -- entry = mlx5r_umr_create_xlt(dev, &sg, -- ib_umem_num_dma_blocks(mr->umem, 1 << mr->page_shift), -- ent_size, flags); -+ total_blocks = ib_umem_num_dma_blocks(mr->umem, 1UL << mr->page_shift); -+ if (start_block > total_blocks) -+ return -EINVAL; -+ -+ /* nblocks 0 means update all blocks starting from start_block */ -+ if (nblocks) -+ total_blocks = nblocks; -+ -+ entry = mlx5r_umr_create_xlt(dev, &sg, total_blocks, ent_size, flags); - if (!entry) - return -ENOMEM; - - orig_sg_length = sg.length; -- mlx5r_umr_set_update_xlt_ctrl_seg(&wqe.ctrl_seg, flags, &sg); -- mlx5r_umr_set_update_xlt_mkey_seg(dev, &wqe.mkey_seg, mr, -- mr->page_shift); -- if (dd) { -- /* Use the data direct internal kernel PD */ -- MLX5_SET(mkc, &wqe.mkey_seg, pd, dev->ddr.pdn); -+ -+ _mlx5r_umr_init_wqe(mr, &wqe, &sg, flags, mr->page_shift, dd); -+ -+ /* Set initial translation offset to start_block */ -+ offset = (u64)start_block * ent_size; -+ mlx5r_umr_update_offset(&wqe.ctrl_seg, offset); -+ -+ if (dd) - cur_ksm = entry; -- } else { -+ else - cur_mtt = entry; -- } -- -- mlx5r_umr_set_update_xlt_data_seg(&wqe.data_seg, &sg); - - curr_entry = entry; -+ - rdma_umem_for_each_dma_block(mr->umem, &biter, BIT(mr->page_shift)) { -+ if (cur_block_idx < start_block) { -+ cur_block_idx++; -+ continue; -+ } -+ -+ if (nblocks && processed_blocks >= nblocks) -+ break; -+ - if (curr_entry == entry + sg.length) { - dma_sync_single_for_device(ddev, sg.addr, sg.length, - DMA_TO_DEVICE); -@@ -727,6 +761,11 @@ _mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd) - if (dd) { - cur_ksm->va = cpu_to_be64(rdma_block_iter_dma_address(&biter)); - cur_ksm->key = cpu_to_be32(dev->ddr.mkey); -+ if (mr->umem->is_dmabuf && -+ (flags & MLX5_IB_UPD_XLT_ZAP)) { -+ cur_ksm->va = 0; -+ cur_ksm->key = 0; -+ } - cur_ksm++; - curr_entry = cur_ksm; - } else { -@@ -738,6 +777,8 @@ _mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd) - cur_mtt++; - curr_entry = cur_mtt; - } -+ -+ processed_blocks++; - } - - final_size = curr_entry - entry; -@@ -754,13 +795,32 @@ _mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd) - return err; - } - --int mlx5r_umr_update_data_direct_ksm_pas(struct mlx5_ib_mr *mr, unsigned int flags) -+int mlx5r_umr_update_data_direct_ksm_pas_range(struct mlx5_ib_mr *mr, -+ unsigned int flags, -+ size_t start_block, -+ size_t nblocks) - { - /* No invalidation flow is expected */ -- if (WARN_ON(!mr->umem->is_dmabuf) || (flags & MLX5_IB_UPD_XLT_ZAP)) -+ if (WARN_ON(!mr->umem->is_dmabuf) || ((flags & MLX5_IB_UPD_XLT_ZAP) && -+ !(flags & MLX5_IB_UPD_XLT_KEEP_PGSZ))) - return -EINVAL; - -- return _mlx5r_umr_update_mr_pas(mr, flags, true); -+ return _mlx5r_umr_update_mr_pas(mr, flags, true, start_block, nblocks); -+} -+ -+int mlx5r_umr_update_data_direct_ksm_pas(struct mlx5_ib_mr *mr, -+ unsigned int flags) -+{ -+ return mlx5r_umr_update_data_direct_ksm_pas_range(mr, flags, 0, 0); -+} -+ -+int mlx5r_umr_update_mr_pas_range(struct mlx5_ib_mr *mr, unsigned int flags, -+ size_t start_block, size_t nblocks) -+{ -+ if (WARN_ON(mr->umem->is_odp)) -+ return -EINVAL; -+ -+ return _mlx5r_umr_update_mr_pas(mr, flags, false, start_block, nblocks); - } - - /* -@@ -770,10 +830,7 @@ int mlx5r_umr_update_data_direct_ksm_pas(struct mlx5_ib_mr *mr, unsigned int fla - */ - int mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags) - { -- if (WARN_ON(mr->umem->is_odp)) -- return -EINVAL; -- -- return _mlx5r_umr_update_mr_pas(mr, flags, false); -+ return mlx5r_umr_update_mr_pas_range(mr, flags, 0, 0); - } - - static bool umr_can_use_indirect_mkey(struct mlx5_ib_dev *dev) -@@ -866,3 +923,202 @@ int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages, - mlx5r_umr_unmap_free_xlt(dev, xlt, &sg); - return err; - } -+ -+/* -+ * Update only the page-size (log_page_size) field of an existing memory key -+ * using UMR. This is useful when the MR's physical layout stays the same -+ * but the optimal page shift has changed (e.g. dmabuf after pages are -+ * pinned and the HW can switch from 4K to huge-page alignment). -+ */ -+int mlx5r_umr_update_mr_page_shift(struct mlx5_ib_mr *mr, -+ unsigned int page_shift, -+ bool dd) -+{ -+ struct mlx5_ib_dev *dev = mr_to_mdev(mr); -+ struct mlx5r_umr_wqe wqe = {}; -+ int err; -+ -+ /* Build UMR wqe: we touch only PAGE_SIZE, so use the dedicated mask */ -+ wqe.ctrl_seg.mkey_mask = get_umr_update_translation_mask(dev); -+ -+ /* MR must be free while page size is modified */ -+ wqe.ctrl_seg.flags = MLX5_UMR_CHECK_FREE | MLX5_UMR_INLINE; -+ -+ /* Fill mkey segment with the new page size, keep the rest unchanged */ -+ MLX5_SET(mkc, &wqe.mkey_seg, log_page_size, page_shift); -+ -+ if (dd) -+ MLX5_SET(mkc, &wqe.mkey_seg, pd, dev->ddr.pdn); -+ else -+ MLX5_SET(mkc, &wqe.mkey_seg, pd, to_mpd(mr->ibmr.pd)->pdn); -+ -+ MLX5_SET64(mkc, &wqe.mkey_seg, start_addr, mr->ibmr.iova); -+ MLX5_SET64(mkc, &wqe.mkey_seg, len, mr->ibmr.length); -+ MLX5_SET(mkc, &wqe.mkey_seg, qpn, 0xffffff); -+ MLX5_SET(mkc, &wqe.mkey_seg, mkey_7_0, -+ mlx5_mkey_variant(mr->mmkey.key)); -+ -+ err = mlx5r_umr_post_send_wait(dev, mr->mmkey.key, &wqe, false); -+ if (!err) -+ mr->page_shift = page_shift; -+ -+ return err; -+} -+ -+static inline int -+_mlx5r_dmabuf_umr_update_pas(struct mlx5_ib_mr *mr, unsigned int flags, -+ size_t start_block, size_t nblocks, bool dd) -+{ -+ if (dd) -+ return mlx5r_umr_update_data_direct_ksm_pas_range(mr, flags, -+ start_block, -+ nblocks); -+ else -+ return mlx5r_umr_update_mr_pas_range(mr, flags, start_block, -+ nblocks); -+} -+ -+/** -+ * This function makes an mkey non-present by zapping the translation entries of -+ * the mkey by zapping (zeroing out) the first N entries, where N is determined -+ * by the largest page size supported by the device and the MR length. -+ * It then updates the mkey's page size to the largest possible value, ensuring -+ * the MR is completely non-present and safe for further updates. -+ * It is useful to update the page size of a dmabuf MR on a page fault. -+ * -+ * Return: On success, returns the number of entries that were zapped. -+ * On error, returns a negative error code. -+ */ -+static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, -+ unsigned int flags, -+ unsigned int page_shift, -+ bool dd) -+{ -+ unsigned int old_page_shift = mr->page_shift; -+ struct mlx5_ib_dev *dev = mr_to_mdev(mr); -+ unsigned int max_page_shift; -+ size_t page_shift_nblocks; -+ unsigned int max_log_size; -+ int access_mode; -+ size_t nblocks; -+ int err; -+ -+ access_mode = dd ? MLX5_MKC_ACCESS_MODE_KSM : MLX5_MKC_ACCESS_MODE_MTT; -+ flags |= MLX5_IB_UPD_XLT_KEEP_PGSZ | MLX5_IB_UPD_XLT_ZAP | -+ MLX5_IB_UPD_XLT_ATOMIC; -+ max_log_size = get_max_log_entity_size_cap(dev, access_mode); -+ max_page_shift = order_base_2(mr->ibmr.length); -+ max_page_shift = min(max(max_page_shift, page_shift), max_log_size); -+ /* Count blocks in units of max_page_shift, we will zap exactly this -+ * many to make the whole MR non-present. -+ * Block size must be aligned to MLX5_UMR_FLEX_ALIGNMENT since it may -+ * be used as offset into the XLT later on. -+ */ -+ nblocks = ib_umem_num_dma_blocks(mr->umem, 1UL << max_page_shift); -+ if (dd) -+ nblocks = ALIGN(nblocks, MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT); -+ else -+ nblocks = ALIGN(nblocks, MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT); -+ page_shift_nblocks = ib_umem_num_dma_blocks(mr->umem, -+ 1UL << page_shift); -+ /* If the number of blocks at max possible page shift is greater than -+ * the number of blocks at the new page size, we should just go over the -+ * whole mkey entries. -+ */ -+ if (nblocks >= page_shift_nblocks) -+ nblocks = 0; -+ -+ /* Make the first nblocks entries non-present without changing -+ * page size yet. -+ */ -+ if (nblocks) -+ mr->page_shift = max_page_shift; -+ err = _mlx5r_dmabuf_umr_update_pas(mr, flags, 0, nblocks, dd); -+ if (err) { -+ mr->page_shift = old_page_shift; -+ return err; -+ } -+ -+ /* Change page size to the max page size now that the MR is completely -+ * non-present. -+ */ -+ if (nblocks) { -+ err = mlx5r_umr_update_mr_page_shift(mr, max_page_shift, dd); -+ if (err) { -+ mr->page_shift = old_page_shift; -+ return err; -+ } -+ } -+ -+ return err ? err : nblocks; -+} -+ -+/** -+ * mlx5r_umr_dmabuf_update_pgsz - Safely update DMABUF MR page size and its -+ * entries accordingly -+ * @mr: The memory region to update -+ * @xlt_flags: Translation table update flags -+ * @page_shift: The new (optimized) page shift to use -+ * -+ * This function updates the page size and mkey translation entries for a DMABUF -+ * MR in a safe, multi-step process to avoid exposing partially updated mappings -+ * The update is performed in 5 steps: -+ * 1. Make the first X entries non-present, while X is calculated to be -+ * minimal according to a large page shift that can be used to cover the -+ * MR length. -+ * 2. Update the page size to the large supported page size -+ * 3. Load the remaining N-X entries according to the (optimized) page_shift -+ * 4. Update the page size according to the (optimized) page_shift -+ * 5. Load the first X entries with the correct translations -+ * -+ * This ensures that at no point is the MR accessible with a partially updated -+ * translation table, maintaining correctness and preventing access to stale or -+ * inconsistent mappings. -+ * -+ * Returns 0 on success or a negative error code on failure. -+ */ -+int mlx5r_umr_dmabuf_update_pgsz(struct mlx5_ib_mr *mr, u32 xlt_flags, -+ unsigned int page_shift) -+{ -+ unsigned int old_page_shift = mr->page_shift; -+ size_t zapped_blocks; -+ size_t total_blocks; -+ int err; -+ -+ zapped_blocks = _mlx5r_umr_zap_mkey(mr, xlt_flags, page_shift, -+ mr->data_direct); -+ if (zapped_blocks < 0) -+ return zapped_blocks; -+ -+ /* _mlx5r_umr_zap_mkey already enables the mkey */ -+ xlt_flags &= ~MLX5_IB_UPD_XLT_ENABLE; -+ mr->page_shift = page_shift; -+ total_blocks = ib_umem_num_dma_blocks(mr->umem, 1UL << mr->page_shift); -+ if (zapped_blocks && zapped_blocks < total_blocks) { -+ /* Update PAS according to the new page size but don't update -+ * the page size in the mkey yet. -+ */ -+ err = _mlx5r_dmabuf_umr_update_pas( -+ mr, -+ xlt_flags | MLX5_IB_UPD_XLT_KEEP_PGSZ, -+ zapped_blocks, -+ total_blocks - zapped_blocks, -+ mr->data_direct); -+ if (err) -+ goto err; -+ } -+ -+ err = mlx5r_umr_update_mr_page_shift(mr, mr->page_shift, -+ mr->data_direct); -+ if (err) -+ goto err; -+ err = _mlx5r_dmabuf_umr_update_pas(mr, xlt_flags, 0, zapped_blocks, -+ mr->data_direct); -+ if (err) -+ goto err; -+ -+ return 0; -+err: -+ mr->page_shift = old_page_shift; -+ return err; -+} -diff --git a/drivers/infiniband/hw/mlx5/umr.h b/drivers/infiniband/hw/mlx5/umr.h -index 4a02c9b5aad8..e9361f0140e7 100644 ---- a/drivers/infiniband/hw/mlx5/umr.h -+++ b/drivers/infiniband/hw/mlx5/umr.h -@@ -94,9 +94,20 @@ struct mlx5r_umr_wqe { - int mlx5r_umr_revoke_mr(struct mlx5_ib_mr *mr); - int mlx5r_umr_rereg_pd_access(struct mlx5_ib_mr *mr, struct ib_pd *pd, - int access_flags); --int mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags); -+int mlx5r_umr_update_data_direct_ksm_pas_range(struct mlx5_ib_mr *mr, -+ unsigned int flags, -+ size_t start_block, -+ size_t nblocks); - int mlx5r_umr_update_data_direct_ksm_pas(struct mlx5_ib_mr *mr, unsigned int flags); -+int mlx5r_umr_update_mr_pas_range(struct mlx5_ib_mr *mr, unsigned int flags, -+ size_t start_block, size_t nblocks); -+int mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags); - int mlx5r_umr_update_xlt(struct mlx5_ib_mr *mr, u64 idx, int npages, - int page_shift, int flags); -+int mlx5r_umr_update_mr_page_shift(struct mlx5_ib_mr *mr, -+ unsigned int page_shift, -+ bool dd); -+int mlx5r_umr_dmabuf_update_pgsz(struct mlx5_ib_mr *mr, u32 xlt_flags, -+ unsigned int page_shift); - - #endif /* _MLX5_IB_UMR_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1501-rdma-mlx5-remove-redundant-check-on-err-on-return-expression.patch b/SOURCES/1501-rdma-mlx5-remove-redundant-check-on-err-on-return-expression.patch deleted file mode 100644 index 7a807cde2..000000000 --- a/SOURCES/1501-rdma-mlx5-remove-redundant-check-on-err-on-return-expression.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 46a6cf3e0875d7e11fe831ffceb067c6f3707c78 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: remove redundant check on err on return expression - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit aee80e6ffc5878a90ca5c16760b2c4f3f3d7343f -Author: Colin Ian King -Date: Thu Jul 17 12:21:08 2025 +0100 - - RDMA/mlx5: remove redundant check on err on return expression - - Currently all paths that set err and then check it for an error - perform immediate returns, hence err always zero at the end of - the function _mlx5r_umr_zap_mkey. The return expression - err ? err : nblocks has a redundant check on the err since err - is always zero, so just return nblocks instead. - - Signed-off-by: Colin Ian King - Link: https://patch.msgid.link/20250717112108.4036171-1-colin.i.king@gmail.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index b097d8839cad..fa5c4ea685b9 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -1050,7 +1050,7 @@ static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - } - } - -- return err ? err : nblocks; -+ return nblocks; - } - - /** --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1502-rdma-mlx5-fix-returned-type-from-mlx5r-umr-zap-mkey.patch b/SOURCES/1502-rdma-mlx5-fix-returned-type-from-mlx5r-umr-zap-mkey.patch deleted file mode 100644 index f5791c5e1..000000000 --- a/SOURCES/1502-rdma-mlx5-fix-returned-type-from-mlx5r-umr-zap-mkey.patch +++ /dev/null @@ -1,119 +0,0 @@ -From e83f0e3b0976e6266badf6107c3ea4f65e21687c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d59ebb4549ff9bdba7abf6a5246a749e7f4a36ed -Author: Leon Romanovsky -Date: Sun Jul 20 12:25:34 2025 +0300 - - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() - - As Colin reported: - "The variable zapped_blocks is a size_t type and is being assigned a int - return value from the call to _mlx5r_umr_zap_mkey. Since zapped_blocks is an - unsigned type, the error check for zapped_blocks < 0 will never be true." - - So separate return error and nblocks assignment. - - Fixes: e73242aa14d2 ("RDMA/mlx5: Optimize DMABUF mkey page size") - Reported-by: Colin King (gmail) - Closes: https://lore.kernel.org/all/79166fb1-3b73-4d37-af02-a17b22eb8e64@gmail.com - Link: https://patch.msgid.link/71d8ea208ac7eaa4438af683b9afaed78625e419.1753003467.git.leon@kernel.org - Reviewed-by: Zhu Yanjun - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index fa5c4ea685b9..054f6dae2415 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -992,6 +992,7 @@ _mlx5r_dmabuf_umr_update_pas(struct mlx5_ib_mr *mr, unsigned int flags, - static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - unsigned int flags, - unsigned int page_shift, -+ size_t *nblocks, - bool dd) - { - unsigned int old_page_shift = mr->page_shift; -@@ -1000,7 +1001,6 @@ static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - size_t page_shift_nblocks; - unsigned int max_log_size; - int access_mode; -- size_t nblocks; - int err; - - access_mode = dd ? MLX5_MKC_ACCESS_MODE_KSM : MLX5_MKC_ACCESS_MODE_MTT; -@@ -1014,26 +1014,26 @@ static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - * Block size must be aligned to MLX5_UMR_FLEX_ALIGNMENT since it may - * be used as offset into the XLT later on. - */ -- nblocks = ib_umem_num_dma_blocks(mr->umem, 1UL << max_page_shift); -+ *nblocks = ib_umem_num_dma_blocks(mr->umem, 1UL << max_page_shift); - if (dd) -- nblocks = ALIGN(nblocks, MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT); -+ *nblocks = ALIGN(*nblocks, MLX5_UMR_KSM_NUM_ENTRIES_ALIGNMENT); - else -- nblocks = ALIGN(nblocks, MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT); -+ *nblocks = ALIGN(*nblocks, MLX5_UMR_MTT_NUM_ENTRIES_ALIGNMENT); - page_shift_nblocks = ib_umem_num_dma_blocks(mr->umem, - 1UL << page_shift); - /* If the number of blocks at max possible page shift is greater than - * the number of blocks at the new page size, we should just go over the - * whole mkey entries. - */ -- if (nblocks >= page_shift_nblocks) -- nblocks = 0; -+ if (*nblocks >= page_shift_nblocks) -+ *nblocks = 0; - - /* Make the first nblocks entries non-present without changing - * page size yet. - */ -- if (nblocks) -+ if (*nblocks) - mr->page_shift = max_page_shift; -- err = _mlx5r_dmabuf_umr_update_pas(mr, flags, 0, nblocks, dd); -+ err = _mlx5r_dmabuf_umr_update_pas(mr, flags, 0, *nblocks, dd); - if (err) { - mr->page_shift = old_page_shift; - return err; -@@ -1042,7 +1042,7 @@ static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - /* Change page size to the max page size now that the MR is completely - * non-present. - */ -- if (nblocks) { -+ if (*nblocks) { - err = mlx5r_umr_update_mr_page_shift(mr, max_page_shift, dd); - if (err) { - mr->page_shift = old_page_shift; -@@ -1050,7 +1050,7 @@ static int _mlx5r_umr_zap_mkey(struct mlx5_ib_mr *mr, - } - } - -- return nblocks; -+ return 0; - } - - /** -@@ -1085,10 +1085,10 @@ int mlx5r_umr_dmabuf_update_pgsz(struct mlx5_ib_mr *mr, u32 xlt_flags, - size_t total_blocks; - int err; - -- zapped_blocks = _mlx5r_umr_zap_mkey(mr, xlt_flags, page_shift, -- mr->data_direct); -- if (zapped_blocks < 0) -- return zapped_blocks; -+ err = _mlx5r_umr_zap_mkey(mr, xlt_flags, page_shift, &zapped_blocks, -+ mr->data_direct); -+ if (err) -+ return err; - - /* _mlx5r_umr_zap_mkey already enables the mkey */ - xlt_flags &= ~MLX5_IB_UPD_XLT_ENABLE; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1503-rdma-mlx5-fix-incorrect-mkey-masking.patch b/SOURCES/1503-rdma-mlx5-fix-incorrect-mkey-masking.patch deleted file mode 100644 index 75d4f7aca..000000000 --- a/SOURCES/1503-rdma-mlx5-fix-incorrect-mkey-masking.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 303a5934f15321dfa8360cd86a148655b9737ff7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Fix incorrect MKEY masking - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b83440736864ad96f863666fea49bd14ab17547d -Author: Leon Romanovsky -Date: Sun Jul 20 12:25:35 2025 +0300 - - RDMA/mlx5: Fix incorrect MKEY masking - - mkey_mask is __be64 type, while MLX5_MKEY_MASK_PAGE_SIZE is declared as - unsigned long long. This causes to the static checkers errors: - - drivers/infiniband/hw/mlx5/umr.c:663:49: warning: invalid assignment: &= - drivers/infiniband/hw/mlx5/umr.c:663:49: left side has type restricted __be64 - drivers/infiniband/hw/mlx5/umr.c:663:49: right side has type int - - Fixes: e73242aa14d2 ("RDMA/mlx5: Optimize DMABUF mkey page size") - Link: https://patch.msgid.link/e354d70b98dfa5ecf4c236a36cd36b64add9d9de.1753003467.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index 054f6dae2415..7ef35cddce81 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -660,7 +660,8 @@ static void mlx5r_umr_final_update_xlt(struct mlx5_ib_dev *dev, - if (!mr->ibmr.length) - MLX5_SET(mkc, &wqe->mkey_seg, length64, 1); - if (flags & MLX5_IB_UPD_XLT_KEEP_PGSZ) -- wqe->ctrl_seg.mkey_mask &= ~MLX5_MKEY_MASK_PAGE_SIZE; -+ wqe->ctrl_seg.mkey_mask &= -+ cpu_to_be64(~MLX5_MKEY_MASK_PAGE_SIZE); - } - - wqe->ctrl_seg.xlt_octowords = --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1504-rdma-mlx5-add-dmah-object-support.patch b/SOURCES/1504-rdma-mlx5-add-dmah-object-support.patch deleted file mode 100644 index dab2e1f59..000000000 --- a/SOURCES/1504-rdma-mlx5-add-dmah-object-support.patch +++ /dev/null @@ -1,171 +0,0 @@ -From af56cc5d21a505cbc7dd28b09e0de1b09cb1fc3e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Add DMAH object support - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3c819070754c3e81ad7be07e77fad83a658022f7 -Author: Yishai Hadas -Date: Thu Jul 17 15:17:30 2025 +0300 - - RDMA/mlx5: Add DMAH object support - - This patch introduces support for allocating and deallocating the DMAH - object. - - Further details: - ---------------- - The DMAH API is exposed to upper layers only if the underlying device - supports TPH. - - It uses the mlx5_core steering tag (ST) APIs to get a steering tag index - based on the provided input. - - The obtained index is stored in the device-specific mlx5_dmah structure - for future use. - - Upcoming patches in the series will integrate the allocated DMAH into - the memory region (MR) registration process. - - Signed-off-by: Yishai Hadas - Reviewed-by: Edward Srouji - Link: https://patch.msgid.link/778550776799d82edb4d05da249a1cff00160b50.1752752567.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/Makefile b/drivers/infiniband/hw/mlx5/Makefile -index 11878ddf7cc7..dd7bb377f491 100644 ---- a/drivers/infiniband/hw/mlx5/Makefile -+++ b/drivers/infiniband/hw/mlx5/Makefile -@@ -8,6 +8,7 @@ mlx5_ib-y := ah.o \ - cq.o \ - data_direct.o \ - dm.o \ -+ dmah.o \ - doorbell.o \ - fs.o \ - gsi.o \ -diff --git a/drivers/infiniband/hw/mlx5/dmah.c b/drivers/infiniband/hw/mlx5/dmah.c -new file mode 100644 -index 000000000000..362a88992ffa ---- /dev/null -+++ b/drivers/infiniband/hw/mlx5/dmah.c -@@ -0,0 +1,54 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+/* -+ * Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved -+ */ -+ -+#include -+#include -+#include "dmah.h" -+ -+#define UVERBS_MODULE_NAME mlx5_ib -+#include -+ -+static int mlx5_ib_alloc_dmah(struct ib_dmah *ibdmah, -+ struct uverbs_attr_bundle *attrs) -+{ -+ struct mlx5_core_dev *mdev = to_mdev(ibdmah->device)->mdev; -+ struct mlx5_ib_dmah *dmah = to_mdmah(ibdmah); -+ u16 st_bits = BIT(IB_DMAH_CPU_ID_EXISTS) | -+ BIT(IB_DMAH_MEM_TYPE_EXISTS); -+ int err; -+ -+ /* PH is a must for TPH following PCIe spec 6.2-1.0 */ -+ if (!(ibdmah->valid_fields & BIT(IB_DMAH_PH_EXISTS))) -+ return -EINVAL; -+ -+ /* ST is optional; however, partial data for it is not allowed */ -+ if (ibdmah->valid_fields & st_bits) { -+ if ((ibdmah->valid_fields & st_bits) != st_bits) -+ return -EINVAL; -+ err = mlx5_st_alloc_index(mdev, ibdmah->mem_type, -+ ibdmah->cpu_id, &dmah->st_index); -+ if (err) -+ return err; -+ } -+ -+ return 0; -+} -+ -+static int mlx5_ib_dealloc_dmah(struct ib_dmah *ibdmah, -+ struct uverbs_attr_bundle *attrs) -+{ -+ struct mlx5_ib_dmah *dmah = to_mdmah(ibdmah); -+ struct mlx5_core_dev *mdev = to_mdev(ibdmah->device)->mdev; -+ -+ if (ibdmah->valid_fields & BIT(IB_DMAH_CPU_ID_EXISTS)) -+ return mlx5_st_dealloc_index(mdev, dmah->st_index); -+ -+ return 0; -+} -+ -+const struct ib_device_ops mlx5_ib_dev_dmah_ops = { -+ .alloc_dmah = mlx5_ib_alloc_dmah, -+ .dealloc_dmah = mlx5_ib_dealloc_dmah, -+}; -diff --git a/drivers/infiniband/hw/mlx5/dmah.h b/drivers/infiniband/hw/mlx5/dmah.h -new file mode 100644 -index 000000000000..68de72b4744a ---- /dev/null -+++ b/drivers/infiniband/hw/mlx5/dmah.h -@@ -0,0 +1,23 @@ -+/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ -+/* -+ * Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved -+ */ -+ -+#ifndef _MLX5_IB_DMAH_H -+#define _MLX5_IB_DMAH_H -+ -+#include "mlx5_ib.h" -+ -+extern const struct ib_device_ops mlx5_ib_dev_dmah_ops; -+ -+struct mlx5_ib_dmah { -+ struct ib_dmah ibdmah; -+ u16 st_index; -+}; -+ -+static inline struct mlx5_ib_dmah *to_mdmah(struct ib_dmah *ibdmah) -+{ -+ return container_of(ibdmah, struct mlx5_ib_dmah, ibdmah); -+} -+ -+#endif /* _MLX5_IB_DMAH_H */ -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index bdd82b371ba0..08e4e6d85f7b 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -50,6 +50,7 @@ - #include - #include "macsec.h" - #include "data_direct.h" -+#include "dmah.h" - - #define UVERBS_MODULE_NAME mlx5_ib - #include -@@ -4214,6 +4215,7 @@ static const struct ib_device_ops mlx5_ib_dev_ops = { - INIT_RDMA_OBJ_SIZE(ib_ah, mlx5_ib_ah, ibah), - INIT_RDMA_OBJ_SIZE(ib_counters, mlx5_ib_mcounters, ibcntrs), - INIT_RDMA_OBJ_SIZE(ib_cq, mlx5_ib_cq, ibcq), -+ INIT_RDMA_OBJ_SIZE(ib_dmah, mlx5_ib_dmah, ibdmah), - INIT_RDMA_OBJ_SIZE(ib_pd, mlx5_ib_pd, ibpd), - INIT_RDMA_OBJ_SIZE(ib_qp, mlx5_ib_qp, ibqp), - INIT_RDMA_OBJ_SIZE(ib_srq, mlx5_ib_srq, ibsrq), -@@ -4341,6 +4343,9 @@ static int mlx5_ib_stage_caps_init(struct mlx5_ib_dev *dev) - MLX5_GENERAL_OBJ_TYPES_CAP_SW_ICM) - ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_dm_ops); - -+ if (mdev->st) -+ ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_dmah_ops); -+ - ib_set_device_ops(&dev->ib_dev, &mlx5_ib_dev_ops); - - if (IS_ENABLED(CONFIG_INFINIBAND_USER_ACCESS)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1505-rdma-mlx5-add-dmah-support-for-reg-user-mr-reg-user-dmabuf-m.patch b/SOURCES/1505-rdma-mlx5-add-dmah-support-for-reg-user-mr-reg-user-dmabuf-m.patch deleted file mode 100644 index 30f8479c4..000000000 --- a/SOURCES/1505-rdma-mlx5-add-dmah-support-for-reg-user-mr-reg-user-dmabuf-m.patch +++ /dev/null @@ -1,394 +0,0 @@ -From 44f646c103b3c937ffa87d5233c889c6cf0092dd Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Add DMAH support for - reg_user_mr/reg_user_dmabuf_mr - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e1bed9a94da86a7c01b985c2e9a030207269cbc7 -Author: Yishai Hadas -Date: Thu Jul 17 15:17:32 2025 +0300 - - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr - - As part of this enhancement, allow the creation of an MKEY associated - with a DMA handle. - - Additional notes: - - MKEYs with TPH (i.e. TLP Processing Hints) attributes are currently not - UMR-capable unless explicitly enabled by firmware or hardware. - Therefore, to maintain such MKEYs in the MR cache, the TPH fields have - been added to the rb_key structure, with a dedicated hash bucket. - - The ability to bypass the kernel verbs flow and create an MKEY with TPH - attributes using DEVX has been restricted. TPH must follow the standard - InfiniBand flow, where a DMAH is created with the appropriate security - checks and management mechanisms in place. - - DMA handles are currently not supported in conjunction with On-Demand - Paging (ODP). - - Re-registration of memory regions originally created with TPH attributes - is currently not supported. - - Signed-off-by: Yishai Hadas - Reviewed-by: Edward Srouji - Link: https://patch.msgid.link/1c485651cf8417694ddebb80446c5093d5a791a9.1752752567.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index f96c46b93bec..8694df5bf5ae 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -1393,6 +1393,10 @@ static int devx_handle_mkey_create(struct mlx5_ib_dev *dev, - } - - MLX5_SET(create_mkey_in, in, mkey_umem_valid, 1); -+ /* TPH is not allowed to bypass the regular kernel's verbs flow */ -+ MLX5_SET(mkc, mkc, pcie_tph_en, 0); -+ MLX5_SET(mkc, mkc, pcie_tph_steering_tag_index, -+ MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX); - return 0; - } - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 326fb13484de..e64997ba2f59 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -634,8 +634,13 @@ enum mlx5_mkey_type { - MLX5_MKEY_IMPLICIT_CHILD, - }; - -+/* Used for non-existent ph value */ -+#define MLX5_IB_NO_PH 0xff -+ - struct mlx5r_cache_rb_key { - u8 ats:1; -+ u8 ph; -+ u16 st_index; - unsigned int access_mode; - unsigned int access_flags; - unsigned int ndescs; -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index 0a31f8c248e4..1317f2cb38a4 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -44,6 +44,7 @@ - #include "mlx5_ib.h" - #include "umr.h" - #include "data_direct.h" -+#include "dmah.h" - - enum { - MAX_PENDING_REG_MR = 8, -@@ -57,7 +58,7 @@ create_mkey_callback(int status, struct mlx5_async_work *context); - static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem, - u64 iova, int access_flags, - unsigned long page_size, bool populate, -- int access_mode); -+ int access_mode, u16 st_index, u8 ph); - static int __mlx5_ib_dereg_mr(struct ib_mr *ibmr); - - static void set_mkc_access_pd_addr_fields(void *mkc, int acc, u64 start_addr, -@@ -256,6 +257,14 @@ static void set_cache_mkc(struct mlx5_cache_ent *ent, void *mkc) - get_mkc_octo_size(ent->rb_key.access_mode, - ent->rb_key.ndescs)); - MLX5_SET(mkc, mkc, log_page_size, PAGE_SHIFT); -+ -+ if (ent->rb_key.ph != MLX5_IB_NO_PH) { -+ MLX5_SET(mkc, mkc, pcie_tph_en, 1); -+ MLX5_SET(mkc, mkc, pcie_tph_ph, ent->rb_key.ph); -+ if (ent->rb_key.st_index != MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX) -+ MLX5_SET(mkc, mkc, pcie_tph_steering_tag_index, -+ ent->rb_key.st_index); -+ } - } - - /* Asynchronously schedule new MRs to be populated in the cache. */ -@@ -641,6 +650,14 @@ static int cache_ent_key_cmp(struct mlx5r_cache_rb_key key1, - if (res) - return res; - -+ res = key1.st_index - key2.st_index; -+ if (res) -+ return res; -+ -+ res = key1.ph - key2.ph; -+ if (res) -+ return res; -+ - /* - * keep ndescs the last in the compare table since the find function - * searches for an exact match on all properties and only closest -@@ -712,6 +729,8 @@ mkey_cache_ent_from_rb_key(struct mlx5_ib_dev *dev, - smallest->rb_key.access_mode == rb_key.access_mode && - smallest->rb_key.access_flags == rb_key.access_flags && - smallest->rb_key.ats == rb_key.ats && -+ smallest->rb_key.st_index == rb_key.st_index && -+ smallest->rb_key.ph == rb_key.ph && - smallest->rb_key.ndescs <= ndescs_limit) ? - smallest : - NULL; -@@ -786,7 +805,8 @@ struct mlx5_ib_mr *mlx5_mr_cache_alloc(struct mlx5_ib_dev *dev, - struct mlx5r_cache_rb_key rb_key = { - .ndescs = ndescs, - .access_mode = access_mode, -- .access_flags = get_unchangeable_access_flags(dev, access_flags) -+ .access_flags = get_unchangeable_access_flags(dev, access_flags), -+ .ph = MLX5_IB_NO_PH, - }; - struct mlx5_cache_ent *ent = mkey_cache_ent_from_rb_key(dev, rb_key); - -@@ -943,6 +963,7 @@ int mlx5_mkey_cache_init(struct mlx5_ib_dev *dev) - struct rb_root *root = &dev->cache.rb_root; - struct mlx5r_cache_rb_key rb_key = { - .access_mode = MLX5_MKC_ACCESS_MODE_MTT, -+ .ph = MLX5_IB_NO_PH, - }; - struct mlx5_cache_ent *ent; - struct rb_node *node; -@@ -1119,7 +1140,8 @@ static unsigned int mlx5_umem_dmabuf_default_pgsz(struct ib_umem *umem, - - static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd, - struct ib_umem *umem, u64 iova, -- int access_flags, int access_mode) -+ int access_flags, int access_mode, -+ u16 st_index, u8 ph) - { - struct mlx5_ib_dev *dev = to_mdev(pd->device); - struct mlx5r_cache_rb_key rb_key = {}; -@@ -1139,6 +1161,8 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd, - rb_key.ndescs = ib_umem_num_dma_blocks(umem, page_size); - rb_key.ats = mlx5_umem_needs_ats(dev, umem, access_flags); - rb_key.access_flags = get_unchangeable_access_flags(dev, access_flags); -+ rb_key.st_index = st_index; -+ rb_key.ph = ph; - ent = mkey_cache_ent_from_rb_key(dev, rb_key); - /* - * If the MR can't come from the cache then synchronously create an uncached -@@ -1146,7 +1170,8 @@ static struct mlx5_ib_mr *alloc_cacheable_mr(struct ib_pd *pd, - */ - if (!ent) { - mutex_lock(&dev->slow_path_mutex); -- mr = reg_create(pd, umem, iova, access_flags, page_size, false, access_mode); -+ mr = reg_create(pd, umem, iova, access_flags, page_size, false, access_mode, -+ st_index, ph); - mutex_unlock(&dev->slow_path_mutex); - if (IS_ERR(mr)) - return mr; -@@ -1231,7 +1256,7 @@ reg_create_crossing_vhca_mr(struct ib_pd *pd, u64 iova, u64 length, int access_f - static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem, - u64 iova, int access_flags, - unsigned long page_size, bool populate, -- int access_mode) -+ int access_mode, u16 st_index, u8 ph) - { - struct mlx5_ib_dev *dev = to_mdev(pd->device); - struct mlx5_ib_mr *mr; -@@ -1241,7 +1266,8 @@ static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem, - u32 *in; - int err; - bool pg_cap = !!(MLX5_CAP_GEN(dev->mdev, pg)) && -- (access_mode == MLX5_MKC_ACCESS_MODE_MTT); -+ (access_mode == MLX5_MKC_ACCESS_MODE_MTT) && -+ (ph == MLX5_IB_NO_PH); - bool ksm_mode = (access_mode == MLX5_MKC_ACCESS_MODE_KSM); - - if (!page_size) -@@ -1305,6 +1331,13 @@ static struct mlx5_ib_mr *reg_create(struct ib_pd *pd, struct ib_umem *umem, - get_octo_len(iova, umem->length, mr->page_shift)); - } - -+ if (ph != MLX5_IB_NO_PH) { -+ MLX5_SET(mkc, mkc, pcie_tph_en, 1); -+ MLX5_SET(mkc, mkc, pcie_tph_ph, ph); -+ if (st_index != MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX) -+ MLX5_SET(mkc, mkc, pcie_tph_steering_tag_index, st_index); -+ } -+ - err = mlx5_ib_create_mkey(dev, &mr->mmkey, in, inlen); - if (err) { - mlx5_ib_warn(dev, "create mkey failed\n"); -@@ -1424,24 +1457,37 @@ struct ib_mr *mlx5_ib_reg_dm_mr(struct ib_pd *pd, struct ib_dm *dm, - } - - static struct ib_mr *create_real_mr(struct ib_pd *pd, struct ib_umem *umem, -- u64 iova, int access_flags) -+ u64 iova, int access_flags, -+ struct ib_dmah *dmah) - { - struct mlx5_ib_dev *dev = to_mdev(pd->device); - struct mlx5_ib_mr *mr = NULL; - bool xlt_with_umr; -+ u16 st_index = MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX; -+ u8 ph = MLX5_IB_NO_PH; - int err; - -+ if (dmah) { -+ struct mlx5_ib_dmah *mdmah = to_mdmah(dmah); -+ -+ ph = dmah->ph; -+ if (dmah->valid_fields & BIT(IB_DMAH_CPU_ID_EXISTS)) -+ st_index = mdmah->st_index; -+ } -+ - xlt_with_umr = mlx5r_umr_can_load_pas(dev, umem->length); - if (xlt_with_umr) { - mr = alloc_cacheable_mr(pd, umem, iova, access_flags, -- MLX5_MKC_ACCESS_MODE_MTT); -+ MLX5_MKC_ACCESS_MODE_MTT, -+ st_index, ph); - } else { - unsigned long page_size = mlx5_umem_mkc_find_best_pgsz( - dev, umem, iova, MLX5_MKC_ACCESS_MODE_MTT); - - mutex_lock(&dev->slow_path_mutex); - mr = reg_create(pd, umem, iova, access_flags, page_size, -- true, MLX5_MKC_ACCESS_MODE_MTT); -+ true, MLX5_MKC_ACCESS_MODE_MTT, -+ st_index, ph); - mutex_unlock(&dev->slow_path_mutex); - } - if (IS_ERR(mr)) { -@@ -1505,7 +1551,9 @@ static struct ib_mr *create_user_odp_mr(struct ib_pd *pd, u64 start, u64 length, - return ERR_CAST(odp); - - mr = alloc_cacheable_mr(pd, &odp->umem, iova, access_flags, -- MLX5_MKC_ACCESS_MODE_MTT); -+ MLX5_MKC_ACCESS_MODE_MTT, -+ MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX, -+ MLX5_IB_NO_PH); - if (IS_ERR(mr)) { - ib_umem_release(&odp->umem); - return ERR_CAST(mr); -@@ -1536,7 +1584,8 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, - struct ib_umem *umem; - int err; - -- if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM) || dmah) -+ if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM) || -+ ((access_flags & IB_ACCESS_ON_DEMAND) && dmah)) - return ERR_PTR(-EOPNOTSUPP); - - mlx5_ib_dbg(dev, "start 0x%llx, iova 0x%llx, length 0x%llx, access_flags 0x%x\n", -@@ -1552,7 +1601,7 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, - umem = ib_umem_get(&dev->ib_dev, start, length, access_flags); - if (IS_ERR(umem)) - return ERR_CAST(umem); -- return create_real_mr(pd, umem, iova, access_flags); -+ return create_real_mr(pd, umem, iova, access_flags, dmah); - } - - static void mlx5_ib_dmabuf_invalidate_cb(struct dma_buf_attachment *attach) -@@ -1577,12 +1626,15 @@ static struct dma_buf_attach_ops mlx5_ib_dmabuf_attach_ops = { - static struct ib_mr * - reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device, - u64 offset, u64 length, u64 virt_addr, -- int fd, int access_flags, int access_mode) -+ int fd, int access_flags, int access_mode, -+ struct ib_dmah *dmah) - { - bool pinned_mode = (access_mode == MLX5_MKC_ACCESS_MODE_KSM); - struct mlx5_ib_dev *dev = to_mdev(pd->device); - struct mlx5_ib_mr *mr = NULL; - struct ib_umem_dmabuf *umem_dmabuf; -+ u16 st_index = MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX; -+ u8 ph = MLX5_IB_NO_PH; - int err; - - err = mlx5r_umr_resource_init(dev); -@@ -1605,8 +1657,17 @@ reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device, - return ERR_CAST(umem_dmabuf); - } - -+ if (dmah) { -+ struct mlx5_ib_dmah *mdmah = to_mdmah(dmah); -+ -+ ph = dmah->ph; -+ if (dmah->valid_fields & BIT(IB_DMAH_CPU_ID_EXISTS)) -+ st_index = mdmah->st_index; -+ } -+ - mr = alloc_cacheable_mr(pd, &umem_dmabuf->umem, virt_addr, -- access_flags, access_mode); -+ access_flags, access_mode, -+ st_index, ph); - if (IS_ERR(mr)) { - ib_umem_release(&umem_dmabuf->umem); - return ERR_CAST(mr); -@@ -1663,7 +1724,8 @@ reg_user_mr_dmabuf_by_data_direct(struct ib_pd *pd, u64 offset, - access_flags &= ~IB_ACCESS_RELAXED_ORDERING; - crossed_mr = reg_user_mr_dmabuf(pd, &data_direct_dev->pdev->dev, - offset, length, virt_addr, fd, -- access_flags, MLX5_MKC_ACCESS_MODE_KSM); -+ access_flags, MLX5_MKC_ACCESS_MODE_KSM, -+ NULL); - if (IS_ERR(crossed_mr)) { - ret = PTR_ERR(crossed_mr); - goto end; -@@ -1698,7 +1760,7 @@ struct ib_mr *mlx5_ib_reg_user_mr_dmabuf(struct ib_pd *pd, u64 offset, - int err; - - if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM) || -- !IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING) || dmah) -+ !IS_ENABLED(CONFIG_INFINIBAND_ON_DEMAND_PAGING)) - return ERR_PTR(-EOPNOTSUPP); - - if (uverbs_attr_is_valid(attrs, MLX5_IB_ATTR_REG_DMABUF_MR_ACCESS_FLAGS)) { -@@ -1723,7 +1785,8 @@ struct ib_mr *mlx5_ib_reg_user_mr_dmabuf(struct ib_pd *pd, u64 offset, - - return reg_user_mr_dmabuf(pd, pd->device->dma_device, - offset, length, virt_addr, -- fd, access_flags, MLX5_MKC_ACCESS_MODE_MTT); -+ fd, access_flags, MLX5_MKC_ACCESS_MODE_MTT, -+ dmah); - } - - /* -@@ -1821,7 +1884,8 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, - struct mlx5_ib_mr *mr = to_mmr(ib_mr); - int err; - -- if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM) || mr->data_direct) -+ if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM) || mr->data_direct || -+ mr->mmkey.rb_key.ph != MLX5_IB_NO_PH) - return ERR_PTR(-EOPNOTSUPP); - - mlx5_ib_dbg( -@@ -1865,7 +1929,7 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, - atomic_sub(ib_umem_num_pages(umem), &dev->mdev->priv.reg_pages); - - return create_real_mr(new_pd, umem, mr->ibmr.iova, -- new_access_flags); -+ new_access_flags, NULL); - } - - /* -@@ -1896,7 +1960,7 @@ struct ib_mr *mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, - } - return NULL; - } -- return create_real_mr(new_pd, new_umem, iova, new_access_flags); -+ return create_real_mr(new_pd, new_umem, iova, new_access_flags, NULL); - } - - /* -diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c -index 1c63cc0b9409..0e8ae85af5a6 100644 ---- a/drivers/infiniband/hw/mlx5/odp.c -+++ b/drivers/infiniband/hw/mlx5/odp.c -@@ -1883,6 +1883,7 @@ int mlx5_odp_init_mkey_cache(struct mlx5_ib_dev *dev) - struct mlx5r_cache_rb_key rb_key = { - .access_mode = MLX5_MKC_ACCESS_MODE_KSM, - .ndescs = mlx5_imr_ksm_entries, -+ .ph = MLX5_IB_NO_PH, - }; - struct mlx5_cache_ent *ent; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1506-rdma-mlx5-refactor-optional-counters-steering-code.patch b/SOURCES/1506-rdma-mlx5-refactor-optional-counters-steering-code.patch deleted file mode 100644 index e8cc4a08c..000000000 --- a/SOURCES/1506-rdma-mlx5-refactor-optional-counters-steering-code.patch +++ /dev/null @@ -1,358 +0,0 @@ -From ff4e6069b1f973258676f846a6bb2bea72eecebf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] RDMA/mlx5: Refactor optional counters steering code - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 10d4de4189533840f296ce7e48eac05b985d96bc -Author: Patrisious Haddad -Date: Sun Jul 20 12:37:24 2025 +0300 - - RDMA/mlx5: Refactor optional counters steering code - - Currently there isn't a clear layer separation between the counters and - the steering code, whereas the steering code is doing redundant access - to the counter struct. - - Separate the fs.c and counters.c, where fs code won't access or be - aware of counter structs but only the objects it needs. - - As a result, move mlx5_rdma_counter struct from the header file to be - an internal struct for the counters file only. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Edward Srouji - Link: https://patch.msgid.link/9854d1fdb140e4a6552b7a2fd1a028cfe488a935.1753004208.git.leon@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/counters.c b/drivers/infiniband/hw/mlx5/counters.c -index a506fafd2b15..e042e0719ead 100644 ---- a/drivers/infiniband/hw/mlx5/counters.c -+++ b/drivers/infiniband/hw/mlx5/counters.c -@@ -16,6 +16,18 @@ struct mlx5_ib_counter { - u32 type; - }; - -+struct mlx5_rdma_counter { -+ struct rdma_counter rdma_counter; -+ -+ struct mlx5_fc *fc[MLX5_IB_OPCOUNTER_MAX]; -+ struct xarray qpn_opfc_xa; -+}; -+ -+static struct mlx5_rdma_counter *to_mcounter(struct rdma_counter *counter) -+{ -+ return container_of(counter, struct mlx5_rdma_counter, rdma_counter); -+} -+ - #define INIT_Q_COUNTER(_name) \ - { .name = #_name, .offset = MLX5_BYTE_OFF(query_q_counter_out, _name)} - -@@ -602,7 +614,7 @@ static int mlx5_ib_counter_dealloc(struct rdma_counter *counter) - return 0; - - WARN_ON(!xa_empty(&mcounter->qpn_opfc_xa)); -- mlx5r_fs_destroy_fcs(dev, counter); -+ mlx5r_fs_destroy_fcs(dev, mcounter->fc); - MLX5_SET(dealloc_q_counter_in, in, opcode, - MLX5_CMD_OP_DEALLOC_Q_COUNTER); - MLX5_SET(dealloc_q_counter_in, in, counter_set_id, counter->id); -@@ -612,6 +624,7 @@ static int mlx5_ib_counter_dealloc(struct rdma_counter *counter) - static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - struct ib_qp *qp, u32 port) - { -+ struct mlx5_rdma_counter *mcounter = to_mcounter(counter); - struct mlx5_ib_dev *dev = to_mdev(qp->device); - bool new = false; - int err; -@@ -635,7 +648,11 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - if (err) - goto fail_set_counter; - -- err = mlx5r_fs_bind_op_fc(qp, counter, port); -+ if (!counter->mode.bind_opcnt) -+ return 0; -+ -+ err = mlx5r_fs_bind_op_fc(qp, mcounter->fc, &mcounter->qpn_opfc_xa, -+ port); - if (err) - goto fail_bind_op_fc; - -@@ -655,9 +672,12 @@ static int mlx5_ib_counter_bind_qp(struct rdma_counter *counter, - static int mlx5_ib_counter_unbind_qp(struct ib_qp *qp, u32 port) - { - struct rdma_counter *counter = qp->counter; -+ struct mlx5_rdma_counter *mcounter; - int err; - -- mlx5r_fs_unbind_op_fc(qp, counter); -+ mcounter = to_mcounter(counter); -+ -+ mlx5r_fs_unbind_op_fc(qp, &mcounter->qpn_opfc_xa); - - err = mlx5_ib_qp_set_counter(qp, NULL); - if (err) -@@ -666,7 +686,9 @@ static int mlx5_ib_counter_unbind_qp(struct ib_qp *qp, u32 port) - return 0; - - fail_set_counter: -- mlx5r_fs_bind_op_fc(qp, counter, port); -+ if (counter->mode.bind_opcnt) -+ mlx5r_fs_bind_op_fc(qp, mcounter->fc, -+ &mcounter->qpn_opfc_xa, port); - return err; - } - -diff --git a/drivers/infiniband/hw/mlx5/counters.h b/drivers/infiniband/hw/mlx5/counters.h -index bd03cee42014..a04e7dd59455 100644 ---- a/drivers/infiniband/hw/mlx5/counters.h -+++ b/drivers/infiniband/hw/mlx5/counters.h -@@ -8,19 +8,6 @@ - - #include "mlx5_ib.h" - --struct mlx5_rdma_counter { -- struct rdma_counter rdma_counter; -- -- struct mlx5_fc *fc[MLX5_IB_OPCOUNTER_MAX]; -- struct xarray qpn_opfc_xa; --}; -- --static inline struct mlx5_rdma_counter * --to_mcounter(struct rdma_counter *counter) --{ -- return container_of(counter, struct mlx5_rdma_counter, rdma_counter); --} -- - int mlx5_ib_counters_init(struct mlx5_ib_dev *dev); - void mlx5_ib_counters_cleanup(struct mlx5_ib_dev *dev); - void mlx5_ib_counters_clear_description(struct ib_counters *counters); -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index bab2f58240c9..b0f7663c24c1 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -1012,14 +1012,14 @@ static int get_per_qp_prio(struct mlx5_ib_dev *dev, - return 0; - } - --static struct mlx5_per_qp_opfc * --get_per_qp_opfc(struct mlx5_rdma_counter *mcounter, u32 qp_num, bool *new) -+static struct mlx5_per_qp_opfc *get_per_qp_opfc(struct xarray *qpn_opfc_xa, -+ u32 qp_num, bool *new) - { - struct mlx5_per_qp_opfc *per_qp_opfc; - - *new = false; - -- per_qp_opfc = xa_load(&mcounter->qpn_opfc_xa, qp_num); -+ per_qp_opfc = xa_load(qpn_opfc_xa, qp_num); - if (per_qp_opfc) - return per_qp_opfc; - per_qp_opfc = kzalloc(sizeof(*per_qp_opfc), GFP_KERNEL); -@@ -1032,7 +1032,8 @@ get_per_qp_opfc(struct mlx5_rdma_counter *mcounter, u32 qp_num, bool *new) - } - - static int add_op_fc_rules(struct mlx5_ib_dev *dev, -- struct mlx5_rdma_counter *mcounter, -+ struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX], -+ struct xarray *qpn_opfc_xa, - struct mlx5_per_qp_opfc *per_qp_opfc, - struct mlx5_ib_flow_prio *prio, - enum mlx5_ib_optional_counter_type type, -@@ -1055,7 +1056,7 @@ static int add_op_fc_rules(struct mlx5_ib_dev *dev, - return 0; - } - -- opfc->fc = mcounter->fc[type]; -+ opfc->fc = fc_arr[type]; - - spec = kcalloc(MAX_OPFC_RULES, sizeof(*spec), GFP_KERNEL); - if (!spec) { -@@ -1148,8 +1149,7 @@ static int add_op_fc_rules(struct mlx5_ib_dev *dev, - } - prio->refcount += spec_num; - -- err = xa_err(xa_store(&mcounter->qpn_opfc_xa, qp_num, per_qp_opfc, -- GFP_KERNEL)); -+ err = xa_err(xa_store(qpn_opfc_xa, qp_num, per_qp_opfc, GFP_KERNEL)); - if (err) - goto del_rules; - -@@ -1168,8 +1168,9 @@ static int add_op_fc_rules(struct mlx5_ib_dev *dev, - return err; - } - --static bool is_fc_shared_and_in_use(struct mlx5_rdma_counter *mcounter, -- u32 type, struct mlx5_fc **fc) -+static bool -+is_fc_shared_and_in_use(struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX], u32 type, -+ struct mlx5_fc **fc) - { - u32 shared_fc_type; - -@@ -1190,7 +1191,7 @@ static bool is_fc_shared_and_in_use(struct mlx5_rdma_counter *mcounter, - return false; - } - -- *fc = mcounter->fc[shared_fc_type]; -+ *fc = fc_arr[shared_fc_type]; - if (!(*fc)) - return false; - -@@ -1198,24 +1199,23 @@ static bool is_fc_shared_and_in_use(struct mlx5_rdma_counter *mcounter, - } - - void mlx5r_fs_destroy_fcs(struct mlx5_ib_dev *dev, -- struct rdma_counter *counter) -+ struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX]) - { -- struct mlx5_rdma_counter *mcounter = to_mcounter(counter); - struct mlx5_fc *in_use_fc; - int i; - - for (i = MLX5_IB_OPCOUNTER_CC_RX_CE_PKTS_PER_QP; - i <= MLX5_IB_OPCOUNTER_RDMA_RX_BYTES_PER_QP; i++) { -- if (!mcounter->fc[i]) -+ if (!fc_arr[i]) - continue; - -- if (is_fc_shared_and_in_use(mcounter, i, &in_use_fc)) { -- mcounter->fc[i] = NULL; -+ if (is_fc_shared_and_in_use(fc_arr, i, &in_use_fc)) { -+ fc_arr[i] = NULL; - continue; - } - -- mlx5_fc_destroy(dev->mdev, mcounter->fc[i]); -- mcounter->fc[i] = NULL; -+ mlx5_fc_destroy(dev->mdev, fc_arr[i]); -+ fc_arr[i] = NULL; - } - } - -@@ -1359,16 +1359,15 @@ void mlx5_ib_fs_remove_op_fc(struct mlx5_ib_dev *dev, - put_per_qp_prio(dev, type); - } - --void mlx5r_fs_unbind_op_fc(struct ib_qp *qp, struct rdma_counter *counter) -+void mlx5r_fs_unbind_op_fc(struct ib_qp *qp, struct xarray *qpn_opfc_xa) - { -- struct mlx5_rdma_counter *mcounter = to_mcounter(counter); -- struct mlx5_ib_dev *dev = to_mdev(counter->device); -+ struct mlx5_ib_dev *dev = to_mdev(qp->device); - struct mlx5_per_qp_opfc *per_qp_opfc; - struct mlx5_ib_op_fc *in_use_opfc; - struct mlx5_ib_flow_prio *prio; - int i, j; - -- per_qp_opfc = xa_load(&mcounter->qpn_opfc_xa, qp->qp_num); -+ per_qp_opfc = xa_load(qpn_opfc_xa, qp->qp_num); - if (!per_qp_opfc) - return; - -@@ -1394,13 +1393,13 @@ void mlx5r_fs_unbind_op_fc(struct ib_qp *qp, struct rdma_counter *counter) - } - - kfree(per_qp_opfc); -- xa_erase(&mcounter->qpn_opfc_xa, qp->qp_num); -+ xa_erase(qpn_opfc_xa, qp->qp_num); - } - --int mlx5r_fs_bind_op_fc(struct ib_qp *qp, struct rdma_counter *counter, -- u32 port) -+int mlx5r_fs_bind_op_fc(struct ib_qp *qp, -+ struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX], -+ struct xarray *qpn_opfc_xa, u32 port) - { -- struct mlx5_rdma_counter *mcounter = to_mcounter(counter); - struct mlx5_ib_dev *dev = to_mdev(qp->device); - struct mlx5_per_qp_opfc *per_qp_opfc; - struct mlx5_ib_flow_prio *prio; -@@ -1410,9 +1409,6 @@ int mlx5r_fs_bind_op_fc(struct ib_qp *qp, struct rdma_counter *counter, - int i, err, per_qp_type; - bool new; - -- if (!counter->mode.bind_opcnt) -- return 0; -- - cnts = &dev->port[port - 1].cnts; - - for (i = 0; i <= MLX5_IB_OPCOUNTER_RDMA_RX_BYTES; i++) { -@@ -1424,23 +1420,22 @@ int mlx5r_fs_bind_op_fc(struct ib_qp *qp, struct rdma_counter *counter, - prio = get_opfc_prio(dev, per_qp_type); - WARN_ON(!prio->flow_table); - -- if (is_fc_shared_and_in_use(mcounter, per_qp_type, &in_use_fc)) -- mcounter->fc[per_qp_type] = in_use_fc; -+ if (is_fc_shared_and_in_use(fc_arr, per_qp_type, &in_use_fc)) -+ fc_arr[per_qp_type] = in_use_fc; - -- if (!mcounter->fc[per_qp_type]) { -- mcounter->fc[per_qp_type] = mlx5_fc_create(dev->mdev, -- false); -- if (IS_ERR(mcounter->fc[per_qp_type])) -- return PTR_ERR(mcounter->fc[per_qp_type]); -+ if (!fc_arr[per_qp_type]) { -+ fc_arr[per_qp_type] = mlx5_fc_create(dev->mdev, false); -+ if (IS_ERR(fc_arr[per_qp_type])) -+ return PTR_ERR(fc_arr[per_qp_type]); - } - -- per_qp_opfc = get_per_qp_opfc(mcounter, qp->qp_num, &new); -+ per_qp_opfc = get_per_qp_opfc(qpn_opfc_xa, qp->qp_num, &new); - if (!per_qp_opfc) { - err = -ENOMEM; - goto free_fc; - } -- err = add_op_fc_rules(dev, mcounter, per_qp_opfc, prio, -- per_qp_type, qp->qp_num, port); -+ err = add_op_fc_rules(dev, fc_arr, qpn_opfc_xa, per_qp_opfc, -+ prio, per_qp_type, qp->qp_num, port); - if (err) - goto del_rules; - } -@@ -1448,12 +1443,12 @@ int mlx5r_fs_bind_op_fc(struct ib_qp *qp, struct rdma_counter *counter, - return 0; - - del_rules: -- mlx5r_fs_unbind_op_fc(qp, counter); -+ mlx5r_fs_unbind_op_fc(qp, qpn_opfc_xa); - if (new) - kfree(per_qp_opfc); - free_fc: -- if (xa_empty(&mcounter->qpn_opfc_xa)) -- mlx5r_fs_destroy_fcs(dev, counter); -+ if (xa_empty(qpn_opfc_xa)) -+ mlx5r_fs_destroy_fcs(dev, fc_arr); - return err; - } - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index e64997ba2f59..1b646761d5d5 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -890,13 +890,14 @@ void mlx5_ib_fs_remove_op_fc(struct mlx5_ib_dev *dev, - struct mlx5_ib_op_fc *opfc, - enum mlx5_ib_optional_counter_type type); - --int mlx5r_fs_bind_op_fc(struct ib_qp *qp, struct rdma_counter *counter, -- u32 port); -+int mlx5r_fs_bind_op_fc(struct ib_qp *qp, -+ struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX], -+ struct xarray *qpn_opfc_xa, u32 port); - --void mlx5r_fs_unbind_op_fc(struct ib_qp *qp, struct rdma_counter *counter); -+void mlx5r_fs_unbind_op_fc(struct ib_qp *qp, struct xarray *qpn_opfc_xa); - - void mlx5r_fs_destroy_fcs(struct mlx5_ib_dev *dev, -- struct rdma_counter *counter); -+ struct mlx5_fc *fc_arr[MLX5_IB_OPCOUNTER_MAX]); - - struct mlx5_ib_multiport_info; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1507-ib-mlx5-fix-obj-type-mismatch-for-srq-event-subscriptions.patch b/SOURCES/1507-ib-mlx5-fix-obj-type-mismatch-for-srq-event-subscriptions.patch deleted file mode 100644 index a199fb627..000000000 --- a/SOURCES/1507-ib-mlx5-fix-obj-type-mismatch-for-srq-event-subscriptions.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 421118c839b06cb8a5813d102897509002765133 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Fri, 17 Apr 2026 11:35:09 -0400 -Subject: [PATCH] IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 85fe9f565d2d5af95ac2bbaa5082b8ce62b039f5 -Author: Or Har-Toov -Date: Wed Aug 13 15:43:20 2025 +0300 - - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions - - Fix a bug where the driver's event subscription logic for SRQ-related - events incorrectly sets obj_type for RMP objects. - - When subscribing to SRQ events, get_legacy_obj_type() did not handle - the MLX5_CMD_OP_CREATE_RMP case, which caused obj_type to be 0 - (default). - This led to a mismatch between the obj_type used during subscription - (0) and the value used during notification (1, taken from the event's - type field). As a result, event mapping for SRQ objects could fail and - event notification would not be delivered correctly. - - This fix adds handling for MLX5_CMD_OP_CREATE_RMP in get_legacy_obj_type, - returning MLX5_EVENT_QUEUE_TYPE_RQ so obj_type is consistent between - subscription and notification. - - Fixes: 759738537142 ("IB/mlx5: Enable subscription for device events over DEVX") - Link: https://patch.msgid.link/r/8f1048e3fdd1fde6b90607ce0ed251afaf8a148c.1755088962.git.leon@kernel.org - Signed-off-by: Or Har-Toov - Reviewed-by: Edward Srouji - Signed-off-by: Leon Romanovsky - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 8694df5bf5ae..4e2edf3378d7 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -233,6 +233,7 @@ static u16 get_legacy_obj_type(u16 opcode) - { - switch (opcode) { - case MLX5_CMD_OP_CREATE_RQ: -+ case MLX5_CMD_OP_CREATE_RMP: - return MLX5_EVENT_QUEUE_TYPE_RQ; - case MLX5_CMD_OP_CREATE_QP: - return MLX5_EVENT_QUEUE_TYPE_QP; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1508-net-mlx5-don-t-use-pk-through-tracepoints.patch b/SOURCES/1508-net-mlx5-don-t-use-pk-through-tracepoints.patch deleted file mode 100644 index 61497740a..000000000 --- a/SOURCES/1508-net-mlx5-don-t-use-pk-through-tracepoints.patch +++ /dev/null @@ -1,56 +0,0 @@ -From f0f4ea25153362ece899e7a2d8d40ccc171e1e9e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] net/mlx5: Don't use %pK through tracepoints -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e2068f74b97653356ad7d6ce456db1f5b7fb575e -Author: Thomas Weißschuh -Date: Mon Aug 11 11:43:19 2025 +0200 - - net/mlx5: Don't use %pK through tracepoints - - In the past %pK was preferable to %p as it would not leak raw pointer - values into the kernel log. - Since commit ad67b74d2469 ("printk: hash addresses printed with %p") - the regular %p has been improved to avoid this issue. - Furthermore, restricted pointers ("%pK") were never meant to be used - through tracepoints. They can still unintentionally leak raw pointers or - acquire sleeping locks in atomic contexts. - - Switch to the regular pointer formatting which is safer and - easier to reason about. - There are still a few users of %pK left, but these use it through seq_file, - for which its usage is safe. - - Signed-off-by: Thomas Weißschuh - Reviewed-by: Aleksandr Loktionov - Reviewed-by: Tariq Toukan - Reviewed-by: Simon Horman - Reviewed-by: Paul Menzel - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/20250811-restricted-pointers-net-v5-2-2e2fdc7d3f2c@linutronix.de - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/diag/dev_tracepoint.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/diag/dev_tracepoint.h -index 7f7c9af5deed..ce834680f504 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/diag/dev_tracepoint.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/diag/dev_tracepoint.h -@@ -28,7 +28,7 @@ DECLARE_EVENT_CLASS(mlx5_sf_dev_template, - __entry->hw_fn_id = sfdev->fn_id; - __entry->sfnum = sfdev->sfnum; - ), -- TP_printk("(%s) sfdev=%pK aux_id=%d hw_id=0x%x sfnum=%u\n", -+ TP_printk("(%s) sfdev=%p aux_id=%d hw_id=0x%x sfnum=%u\n", - __get_str(devname), __entry->sfdev, - __entry->aux_id, __entry->hw_fn_id, - __entry->sfnum) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1509-net-mlx5-mlx5-ifc-add-hardware-definitions-needed-for-adjace.patch b/SOURCES/1509-net-mlx5-mlx5-ifc-add-hardware-definitions-needed-for-adjace.patch deleted file mode 100644 index 5928c96e6..000000000 --- a/SOURCES/1509-net-mlx5-mlx5-ifc-add-hardware-definitions-needed-for-adjace.patch +++ /dev/null @@ -1,215 +0,0 @@ -From 857a7a08e1d720b6a9dd18630a3bae53e013a460 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] net/mlx5: mlx5_ifc, Add hardware definitions needed for - adjacent vports - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2335b3f56690f76ac34b972fcaef368bab1f76f2 -Author: Saeed Mahameed -Date: Mon Jun 16 23:41:53 2025 -0700 - - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports - - Next patches will implement the discovery and creation of adjacent - functions vports, this patch introduces the hardware structures - definitions needed for the driver implementation. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Mark Bloch - Reviewed-by: Parav Pandit - Reviewed-by: Jack Morgenstein - Signed-off-by: Alexei Lazar - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index fd3bedd8dbcb..4362dcb3b8fa 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -189,6 +189,9 @@ enum { - MLX5_CMD_OP_QUERY_XRQ_ERROR_PARAMS = 0x727, - MLX5_CMD_OP_RELEASE_XRQ_ERROR = 0x729, - MLX5_CMD_OP_MODIFY_XRQ = 0x72a, -+ MLX5_CMD_OPCODE_QUERY_DELEGATED_VHCA = 0x732, -+ MLX5_CMD_OPCODE_CREATE_ESW_VPORT = 0x733, -+ MLX5_CMD_OPCODE_DESTROY_ESW_VPORT = 0x734, - MLX5_CMD_OP_QUERY_ESW_FUNCTIONS = 0x740, - MLX5_CMD_OP_QUERY_VPORT_STATE = 0x750, - MLX5_CMD_OP_MODIFY_VPORT_STATE = 0x751, -@@ -2206,7 +2209,19 @@ struct mlx5_ifc_cmd_hca_cap_2_bits { - - u8 reserved_at_440[0x8]; - u8 max_num_eqs_24b[0x18]; -- u8 reserved_at_460[0x3a0]; -+ -+ u8 reserved_at_460[0x160]; -+ -+ u8 query_adjacent_functions_id[0x1]; -+ u8 ingress_egress_esw_vport_connect[0x1]; -+ u8 function_id_type_vhca_id[0x1]; -+ u8 reserved_at_5c3[0xd]; -+ u8 delegate_vhca_management_profiles[0x10]; -+ -+ u8 delegated_vhca_max[0x10]; -+ u8 delegate_vhca_max[0x10]; -+ -+ u8 reserved_at_600[0x200]; - }; - - enum mlx5_ifc_flow_destination_type { -@@ -5158,7 +5173,9 @@ struct mlx5_ifc_set_hca_cap_in_bits { - - u8 other_function[0x1]; - u8 ec_vf_function[0x1]; -- u8 reserved_at_42[0xe]; -+ u8 reserved_at_42[0x1]; -+ u8 function_id_type[0x1]; -+ u8 reserved_at_44[0xc]; - u8 function_id[0x10]; - - u8 reserved_at_60[0x20]; -@@ -6356,7 +6373,9 @@ struct mlx5_ifc_query_hca_cap_in_bits { - - u8 other_function[0x1]; - u8 ec_vf_function[0x1]; -- u8 reserved_at_42[0xe]; -+ u8 reserved_at_42[0x1]; -+ u8 function_id_type[0x1]; -+ u8 reserved_at_44[0xc]; - u8 function_id[0x10]; - - u8 reserved_at_60[0x20]; -@@ -6982,6 +7001,28 @@ struct mlx5_ifc_query_esw_vport_context_in_bits { - u8 reserved_at_60[0x20]; - }; - -+struct mlx5_ifc_destroy_esw_vport_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x20]; -+}; -+ -+struct mlx5_ifc_destroy_esw_vport_in_bits { -+ u8 opcode[0x10]; -+ u8 uid[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x10]; -+ u8 vport_num[0x10]; -+ -+ u8 reserved_at_60[0x20]; -+}; -+ - struct mlx5_ifc_modify_esw_vport_context_out_bits { - u8 status[0x8]; - u8 reserved_at_8[0x18]; -@@ -7483,6 +7524,85 @@ struct mlx5_ifc_query_adapter_in_bits { - u8 reserved_at_40[0x40]; - }; - -+struct mlx5_ifc_function_vhca_rid_info_reg_bits { -+ u8 host_number[0x8]; -+ u8 host_pci_device_function[0x8]; -+ u8 host_pci_bus[0x8]; -+ u8 reserved_at_18[0x3]; -+ u8 pci_bus_assigned[0x1]; -+ u8 function_type[0x4]; -+ -+ u8 parent_pci_device_function[0x8]; -+ u8 parent_pci_bus[0x8]; -+ u8 vhca_id[0x10]; -+ -+ u8 reserved_at_40[0x10]; -+ u8 function_id[0x10]; -+ -+ u8 reserved_at_60[0x20]; -+}; -+ -+struct mlx5_ifc_delegated_function_vhca_rid_info_bits { -+ struct mlx5_ifc_function_vhca_rid_info_reg_bits function_vhca_rid_info; -+ -+ u8 reserved_at_80[0x18]; -+ u8 manage_profile[0x8]; -+ -+ u8 reserved_at_a0[0x60]; -+}; -+ -+struct mlx5_ifc_query_delegated_vhca_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x20]; -+ -+ u8 reserved_at_60[0x10]; -+ u8 functions_count[0x10]; -+ -+ u8 reserved_at_80[0x80]; -+ -+ struct mlx5_ifc_delegated_function_vhca_rid_info_bits -+ delegated_function_vhca_rid_info[]; -+}; -+ -+struct mlx5_ifc_query_delegated_vhca_in_bits { -+ u8 opcode[0x10]; -+ u8 uid[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x40]; -+}; -+ -+struct mlx5_ifc_create_esw_vport_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x20]; -+ -+ u8 reserved_at_60[0x10]; -+ u8 vport_num[0x10]; -+}; -+ -+struct mlx5_ifc_create_esw_vport_in_bits { -+ u8 opcode[0x10]; -+ u8 reserved_at_10[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x10]; -+ u8 managed_vhca_id[0x10]; -+ -+ u8 reserved_at_60[0x20]; -+}; -+ - struct mlx5_ifc_qp_2rst_out_bits { - u8 status[0x8]; - u8 reserved_at_8[0x18]; -@@ -7610,7 +7730,12 @@ struct mlx5_ifc_modify_vport_state_in_bits { - u8 reserved_at_41[0xf]; - u8 vport_number[0x10]; - -- u8 reserved_at_60[0x18]; -+ u8 reserved_at_60[0x10]; -+ u8 ingress_connect[0x1]; -+ u8 egress_connect[0x1]; -+ u8 ingress_connect_valid[0x1]; -+ u8 egress_connect_valid[0x1]; -+ u8 reserved_at_74[0x4]; - u8 admin_state[0x4]; - u8 reserved_at_7c[0x4]; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1510-net-mlx5-e-switch-cache-vport-vhca-id-on-first-cap-query.patch b/SOURCES/1510-net-mlx5-e-switch-cache-vport-vhca-id-on-first-cap-query.patch deleted file mode 100644 index 1e208ec17..000000000 --- a/SOURCES/1510-net-mlx5-e-switch-cache-vport-vhca-id-on-first-cap-query.patch +++ /dev/null @@ -1,167 +0,0 @@ -From 9d3ab89a09acc99709471de7e52a0cd864903abc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Cache vport vhca id on first cap query - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 864c05b9bc4077c99730512babc991a9d92730e0 -Author: Saeed Mahameed -Date: Sat Jun 14 02:29:41 2025 -0700 - - net/mlx5: E-Switch, Cache vport vhca id on first cap query - - We need vhca_id to set up the vhca_id to vport mapping for every vport, - for that we query the firmware in mlx5_esw_vport_vhca_id_set, and it is - redundant since in esw_vport_setup, we already query hca caps which has - the vhca_id, cache it there and save 2 extra fw queries per vport. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Mark Bloch - Reviewed-by: Parav Pandit - Signed-off-by: Alexei Lazar - Reviewed-by: Feng Liu - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 4917d185d0c3..eeffe9c4aa56 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -820,6 +820,7 @@ static int mlx5_esw_vport_caps_get(struct mlx5_eswitch *esw, struct mlx5_vport * - - hca_caps = MLX5_ADDR_OF(query_hca_cap_out, query_ctx, capability); - vport->info.roce_enabled = MLX5_GET(cmd_hca_cap, hca_caps, roce); -+ vport->vhca_id = MLX5_GET(cmd_hca_cap, hca_caps, vhca_id); - - if (!MLX5_CAP_GEN_MAX(esw->dev, hca_cap_2)) - goto out_free; -@@ -929,7 +930,7 @@ int mlx5_esw_vport_enable(struct mlx5_eswitch *esw, struct mlx5_vport *vport, - - if (!mlx5_esw_is_manager_vport(esw, vport_num) && - MLX5_CAP_GEN(esw->dev, vhca_resource_manager)) { -- ret = mlx5_esw_vport_vhca_id_set(esw, vport_num); -+ ret = mlx5_esw_vport_vhca_id_map(esw, vport); - if (ret) - goto err_vhca_mapping; - } -@@ -973,7 +974,7 @@ void mlx5_esw_vport_disable(struct mlx5_eswitch *esw, struct mlx5_vport *vport) - - if (!mlx5_esw_is_manager_vport(esw, vport_num) && - MLX5_CAP_GEN(esw->dev, vhca_resource_manager)) -- mlx5_esw_vport_vhca_id_clear(esw, vport_num); -+ mlx5_esw_vport_vhca_id_unmap(esw, vport); - - if (vport->vport != MLX5_VPORT_PF && - (vport->info.ipsec_crypto_enabled || vport->info.ipsec_packet_enabled)) -@@ -1710,6 +1711,7 @@ static int mlx5_esw_vport_alloc(struct mlx5_eswitch *esw, - vport->vport = vport_num; - vport->index = index; - vport->info.link_state = MLX5_VPORT_ADMIN_STATE_AUTO; -+ vport->vhca_id = MLX5_VHCA_ID_INVALID; - INIT_WORK(&vport->vport_change_handler, esw_vport_change_handler); - err = xa_insert(&esw->vports, vport_num, vport, GFP_KERNEL); - if (err) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 45506ad56847..32aab5e1e673 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -197,6 +197,11 @@ static inline struct mlx5_vport *mlx5_devlink_port_vport_get(struct devlink_port - return mlx5_devlink_port_get(dl_port)->vport; - } - -+#define MLX5_VHCA_ID_INVALID (-1) -+ -+#define MLX5_VPORT_INVAL_VHCA_ID(vport) \ -+ ((vport)->vhca_id == MLX5_VHCA_ID_INVALID) -+ - struct mlx5_vport { - struct mlx5_core_dev *dev; - struct hlist_head uc_list[MLX5_L2_ADDR_HASH_SIZE]; -@@ -209,6 +214,7 @@ struct mlx5_vport { - struct vport_egress egress; - u32 default_metadata; - u32 metadata; -+ int vhca_id; - - struct mlx5_vport_info info; - -@@ -817,8 +823,10 @@ struct devlink_port *mlx5_esw_offloads_devlink_port(struct mlx5_eswitch *esw, u1 - - int mlx5_esw_sf_max_hpf_functions(struct mlx5_core_dev *dev, u16 *max_sfs, u16 *sf_base_id); - --int mlx5_esw_vport_vhca_id_set(struct mlx5_eswitch *esw, u16 vport_num); --void mlx5_esw_vport_vhca_id_clear(struct mlx5_eswitch *esw, u16 vport_num); -+int mlx5_esw_vport_vhca_id_map(struct mlx5_eswitch *esw, -+ struct mlx5_vport *vport); -+void mlx5_esw_vport_vhca_id_unmap(struct mlx5_eswitch *esw, -+ struct mlx5_vport *vport); - int mlx5_eswitch_vhca_id_to_vport(struct mlx5_eswitch *esw, u16 vhca_id, u16 *vport_num); - - /** -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index bee906661282..19decaa8a96e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -4161,23 +4161,28 @@ u32 mlx5_eswitch_get_vport_metadata_for_match(struct mlx5_eswitch *esw, - } - EXPORT_SYMBOL(mlx5_eswitch_get_vport_metadata_for_match); - --int mlx5_esw_vport_vhca_id_set(struct mlx5_eswitch *esw, u16 vport_num) -+int mlx5_esw_vport_vhca_id_map(struct mlx5_eswitch *esw, -+ struct mlx5_vport *vport) - { - u16 *old_entry, *vhca_map_entry, vhca_id; -- int err; - -- err = mlx5_vport_get_vhca_id(esw->dev, vport_num, &vhca_id); -- if (err) { -- esw_warn(esw->dev, "Getting vhca_id for vport failed (vport=%u,err=%d)\n", -- vport_num, err); -- return err; -+ if (WARN_ONCE(MLX5_VPORT_INVAL_VHCA_ID(vport), -+ "vport %d vhca_id is not set", vport->vport)) { -+ int err; -+ -+ err = mlx5_vport_get_vhca_id(vport->dev, vport->vport, -+ &vhca_id); -+ if (err) -+ return err; -+ vport->vhca_id = vhca_id; - } - -+ vhca_id = vport->vhca_id; - vhca_map_entry = kmalloc(sizeof(*vhca_map_entry), GFP_KERNEL); - if (!vhca_map_entry) - return -ENOMEM; - -- *vhca_map_entry = vport_num; -+ *vhca_map_entry = vport->vport; - old_entry = xa_store(&esw->offloads.vhca_map, vhca_id, vhca_map_entry, GFP_KERNEL); - if (xa_is_err(old_entry)) { - kfree(vhca_map_entry); -@@ -4187,17 +4192,12 @@ int mlx5_esw_vport_vhca_id_set(struct mlx5_eswitch *esw, u16 vport_num) - return 0; - } - --void mlx5_esw_vport_vhca_id_clear(struct mlx5_eswitch *esw, u16 vport_num) -+void mlx5_esw_vport_vhca_id_unmap(struct mlx5_eswitch *esw, -+ struct mlx5_vport *vport) - { -- u16 *vhca_map_entry, vhca_id; -- int err; -- -- err = mlx5_vport_get_vhca_id(esw->dev, vport_num, &vhca_id); -- if (err) -- esw_warn(esw->dev, "Getting vhca_id for vport failed (vport=%hu,err=%d)\n", -- vport_num, err); -+ u16 *vhca_map_entry; - -- vhca_map_entry = xa_erase(&esw->offloads.vhca_map, vhca_id); -+ vhca_map_entry = xa_erase(&esw->offloads.vhca_map, vport->vhca_id); - kfree(vhca_map_entry); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1511-net-mlx5-e-switch-set-query-hca-cap-via-vhca-id.patch b/SOURCES/1511-net-mlx5-e-switch-set-query-hca-cap-via-vhca-id.patch deleted file mode 100644 index 897f6507d..000000000 --- a/SOURCES/1511-net-mlx5-e-switch-set-query-hca-cap-via-vhca-id.patch +++ /dev/null @@ -1,180 +0,0 @@ -From 3e3dbc4c44a45831254561a2f5423e61497e4d76 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Set/Query hca cap via vhca id - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1baf30426553efb3ac518b0e9d5c1c3f8ed7762a -Author: Saeed Mahameed -Date: Mon Jun 16 15:07:59 2025 -0700 - - net/mlx5: E-Switch, Set/Query hca cap via vhca id - - Dynamically created vports require vhca id as input to set/query other - vport hca cap, when FW is capable and the vhca id of a vport is valid - use it instead of the local function id. - - Signed-off-by: Saeed Mahameed - Signed-off-by: Adithya Jayachandran - Reviewed-by: Parav Pandit - Reviewed-by: Feng Liu - Reviewed-by: William Tu - Reviewed-by: Mark Bloch - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index eeffe9c4aa56..21c42138d93c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -840,6 +840,18 @@ static int mlx5_esw_vport_caps_get(struct mlx5_eswitch *esw, struct mlx5_vport * - return err; - } - -+bool mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id) -+{ -+ struct mlx5_vport *vport; -+ -+ vport = mlx5_eswitch_get_vport(esw, vportn); -+ if (IS_ERR(vport) || MLX5_VPORT_INVAL_VHCA_ID(vport)) -+ return false; -+ -+ *vhca_id = vport->vhca_id; -+ return true; -+} -+ - static int esw_vport_setup(struct mlx5_eswitch *esw, struct mlx5_vport *vport) - { - bool vst_mode_steering = esw_vst_mode_is_steering(esw); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 32aab5e1e673..8e99d5e20c46 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -828,6 +828,7 @@ int mlx5_esw_vport_vhca_id_map(struct mlx5_eswitch *esw, - void mlx5_esw_vport_vhca_id_unmap(struct mlx5_eswitch *esw, - struct mlx5_vport *vport); - int mlx5_eswitch_vhca_id_to_vport(struct mlx5_eswitch *esw, u16 vhca_id, u16 *vport_num); -+bool mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id); - - /** - * struct mlx5_esw_event_info - Indicates eswitch mode changed/changing. -@@ -968,6 +969,13 @@ static inline bool mlx5_eswitch_block_ipsec(struct mlx5_core_dev *dev) - } - - static inline void mlx5_eswitch_unblock_ipsec(struct mlx5_core_dev *dev) {} -+ -+static inline bool -+mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id) -+{ -+ return -EOPNOTSUPP; -+} -+ - #endif /* CONFIG_MLX5_ESWITCH */ - - #endif /* __MLX5_ESWITCH_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index da5c24fc7b30..231bedc6a252 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -36,6 +36,7 @@ - #include - #include - #include "mlx5_core.h" -+#include "eswitch.h" - #include "sf/sf.h" - - /* Mutex to hold while enabling or disabling RoCE */ -@@ -1189,18 +1190,44 @@ u64 mlx5_query_nic_system_image_guid(struct mlx5_core_dev *mdev) - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_system_image_guid); - -+static bool mlx5_vport_use_vhca_id_as_func_id(struct mlx5_core_dev *dev, -+ u16 vport_num, u16 *vhca_id) -+{ -+ if (!MLX5_CAP_GEN_2(dev, function_id_type_vhca_id)) -+ return false; -+ -+ return mlx5_esw_vport_vhca_id(dev->priv.eswitch, vport_num, vhca_id); -+} -+ - int mlx5_vport_get_other_func_cap(struct mlx5_core_dev *dev, u16 vport, void *out, - u16 opmod) - { -- bool ec_vf_func = mlx5_core_is_ec_vf_vport(dev, vport); - u8 in[MLX5_ST_SZ_BYTES(query_hca_cap_in)] = {}; -+ u16 vhca_id = 0, function_id = 0; -+ bool ec_vf_func = false; -+ -+ /* if this vport is referring to a vport on the ec PF (embedded cpu ) -+ * let the FW know which domain we are querying since vport numbers or -+ * function_ids are not unique across the different PF domains, -+ * unless we use vhca_id as the function_id below. -+ */ -+ ec_vf_func = mlx5_core_is_ec_vf_vport(dev, vport); -+ function_id = mlx5_vport_to_func_id(dev, vport, ec_vf_func); -+ -+ if (mlx5_vport_use_vhca_id_as_func_id(dev, vport, &vhca_id)) { -+ MLX5_SET(query_hca_cap_in, in, function_id_type, 1); -+ function_id = vhca_id; -+ ec_vf_func = false; -+ mlx5_core_dbg(dev, "%s using vhca_id as function_id for vport %d vhca_id 0x%x\n", -+ __func__, vport, vhca_id); -+ } - - opmod = (opmod << 1) | (HCA_CAP_OPMOD_GET_MAX & 0x01); - MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); - MLX5_SET(query_hca_cap_in, in, op_mod, opmod); -- MLX5_SET(query_hca_cap_in, in, function_id, mlx5_vport_to_func_id(dev, vport, ec_vf_func)); - MLX5_SET(query_hca_cap_in, in, other_function, true); - MLX5_SET(query_hca_cap_in, in, ec_vf_function, ec_vf_func); -+ MLX5_SET(query_hca_cap_in, in, function_id, function_id); - return mlx5_cmd_exec_inout(dev, query_hca_cap, in, out); - } - EXPORT_SYMBOL_GPL(mlx5_vport_get_other_func_cap); -@@ -1233,8 +1260,9 @@ int mlx5_vport_get_vhca_id(struct mlx5_core_dev *dev, u16 vport, u16 *vhca_id) - int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, - u16 vport, u16 opmod) - { -- bool ec_vf_func = mlx5_core_is_ec_vf_vport(dev, vport); - int set_sz = MLX5_ST_SZ_BYTES(set_hca_cap_in); -+ u16 vhca_id = 0, function_id = 0; -+ bool ec_vf_func = false; - void *set_hca_cap; - void *set_ctx; - int ret; -@@ -1243,14 +1271,29 @@ int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap - if (!set_ctx) - return -ENOMEM; - -+ /* if this vport is referring to a vport on the ec PF (embedded cpu ) -+ * let the FW know which domain we are querying since vport numbers or -+ * function_ids are not unique across the different PF domains, -+ * unless we use vhca_id as the function_id below. -+ */ -+ ec_vf_func = mlx5_core_is_ec_vf_vport(dev, vport); -+ function_id = mlx5_vport_to_func_id(dev, vport, ec_vf_func); -+ -+ if (mlx5_vport_use_vhca_id_as_func_id(dev, vport, &vhca_id)) { -+ MLX5_SET(set_hca_cap_in, set_ctx, function_id_type, 1); -+ function_id = vhca_id; -+ ec_vf_func = false; -+ mlx5_core_dbg(dev, "%s using vhca_id as function_id for vport %d vhca_id 0x%x\n", -+ __func__, vport, vhca_id); -+ } -+ - MLX5_SET(set_hca_cap_in, set_ctx, opcode, MLX5_CMD_OP_SET_HCA_CAP); - MLX5_SET(set_hca_cap_in, set_ctx, op_mod, opmod << 1); - set_hca_cap = MLX5_ADDR_OF(set_hca_cap_in, set_ctx, capability); - memcpy(set_hca_cap, hca_cap, MLX5_ST_SZ_BYTES(cmd_hca_cap)); -- MLX5_SET(set_hca_cap_in, set_ctx, function_id, -- mlx5_vport_to_func_id(dev, vport, ec_vf_func)); - MLX5_SET(set_hca_cap_in, set_ctx, other_function, true); - MLX5_SET(set_hca_cap_in, set_ctx, ec_vf_function, ec_vf_func); -+ MLX5_SET(set_hca_cap_in, set_ctx, function_id, function_id); - ret = mlx5_cmd_exec_in(dev, set_hca_cap, set_ctx); - - kfree(set_ctx); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1512-rdma-net-mlx5-export-mlx5-vport-get-vhca-id.patch b/SOURCES/1512-rdma-net-mlx5-export-mlx5-vport-get-vhca-id.patch deleted file mode 100644 index 9b52bc1b9..000000000 --- a/SOURCES/1512-rdma-net-mlx5-export-mlx5-vport-get-vhca-id.patch +++ /dev/null @@ -1,213 +0,0 @@ -From 113633f8dbc3d4d8c2bc4327fa79c49e99a9170a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] {rdma,net}/mlx5: export mlx5_vport_get_vhca_id - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 40653f280b2640e5caa94eeedee43e0f1df97704 -Author: Saeed Mahameed -Date: Mon Jun 16 17:28:20 2025 -0700 - - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id - - vhca id is already cached in the vport structure no need to query on - every mlx5 layer, use the mlx5_vport_get_vhca_id, where possible. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Mark Bloch - Reviewed-by: Parav Pandit - Signed-off-by: Alexei Lazar - Reviewed-by: Feng Liu - Reviewed-by: Tariq Toukan - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/std_types.c b/drivers/infiniband/hw/mlx5/std_types.c -index bdb568411091..2fcf553044e1 100644 ---- a/drivers/infiniband/hw/mlx5/std_types.c -+++ b/drivers/infiniband/hw/mlx5/std_types.c -@@ -83,33 +83,14 @@ static int fill_vport_icm_addr(struct mlx5_core_dev *mdev, u16 vport, - static int fill_vport_vhca_id(struct mlx5_core_dev *mdev, u16 vport, - struct mlx5_ib_uapi_query_port *info) - { -- size_t out_sz = MLX5_ST_SZ_BYTES(query_hca_cap_out); -- u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; -- void *out; -- int err; -- -- out = kzalloc(out_sz, GFP_KERNEL); -- if (!out) -- return -ENOMEM; -+ int err = mlx5_vport_get_vhca_id(mdev, vport, &info->vport_vhca_id); - -- MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); -- MLX5_SET(query_hca_cap_in, in, other_function, true); -- MLX5_SET(query_hca_cap_in, in, function_id, vport); -- MLX5_SET(query_hca_cap_in, in, op_mod, -- MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE | -- HCA_CAP_OPMOD_GET_CUR); -- -- err = mlx5_cmd_exec(mdev, in, sizeof(in), out, out_sz); - if (err) -- goto out; -- -- info->vport_vhca_id = MLX5_GET(query_hca_cap_out, out, -- capability.cmd_hca_cap.vhca_id); -+ return err; - - info->flags |= MLX5_IB_UAPI_QUERY_PORT_VPORT_VHCA_ID; --out: -- kfree(out); -- return err; -+ -+ return 0; - } - - static int fill_multiport_info(struct mlx5_ib_dev *dev, u32 port_num, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -index 878f9b46bf18..73f5b62b8c7f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -@@ -1,6 +1,8 @@ - // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB - /* Copyright (c) 2023, NVIDIA CORPORATION & AFFILIATES. */ - -+#include -+ - #include "reporter_vnic.h" - #include "en_stats.h" - #include "devlink.h" -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index 9d3504f5abfa..082259b56816 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -449,8 +449,6 @@ int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap - #define mlx5_vport_get_other_func_general_cap(dev, vport, out) \ - mlx5_vport_get_other_func_cap(dev, vport, out, MLX5_CAP_GENERAL) - --int mlx5_vport_get_vhca_id(struct mlx5_core_dev *dev, u16 vport, u16 *vhca_id); -- - static inline u32 mlx5_sriov_get_vf_total_msix(struct pci_dev *pdev) - { - struct mlx5_core_dev *dev = pci_get_drvdata(pdev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -index 0bdcab2e5cf3..acb0317f930b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -@@ -1200,22 +1200,28 @@ int mlx5hws_cmd_query_caps(struct mlx5_core_dev *mdev, - int mlx5hws_cmd_query_gvmi(struct mlx5_core_dev *mdev, bool other_function, - u16 vport_number, u16 *gvmi) - { -- bool ec_vf_func = other_function ? mlx5_core_is_ec_vf_vport(mdev, vport_number) : false; - u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; - int out_size; - void *out; - int err; - -+ if (other_function) { -+ err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); -+ if (!err) -+ return 0; -+ -+ mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -+ vport_number); -+ return err; -+ } -+ -+ /* get vhca_id for `this` function */ - out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); - out = kzalloc(out_size, GFP_KERNEL); - if (!out) - return -ENOMEM; - - MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); -- MLX5_SET(query_hca_cap_in, in, other_function, other_function); -- MLX5_SET(query_hca_cap_in, in, function_id, -- mlx5_vport_to_func_id(mdev, vport_number, ec_vf_func)); -- MLX5_SET(query_hca_cap_in, in, ec_vf_function, ec_vf_func); - MLX5_SET(query_hca_cap_in, in, op_mod, - MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE << 1 | HCA_CAP_OPMOD_GET_CUR); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -index baefb9a3fa05..bf99b933fd14 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -@@ -2,6 +2,7 @@ - /* Copyright (c) 2019 Mellanox Technologies. */ - - #include "dr_types.h" -+#include "eswitch.h" - - int mlx5dr_cmd_query_esw_vport_context(struct mlx5_core_dev *mdev, - bool other_vport, -@@ -34,21 +35,28 @@ int mlx5dr_cmd_query_esw_vport_context(struct mlx5_core_dev *mdev, - int mlx5dr_cmd_query_gvmi(struct mlx5_core_dev *mdev, bool other_vport, - u16 vport_number, u16 *gvmi) - { -- bool ec_vf_func = other_vport ? mlx5_core_is_ec_vf_vport(mdev, vport_number) : false; - u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; - int out_size; - void *out; - int err; - -+ if (other_vport) { -+ err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); -+ if (!err) -+ return 0; -+ -+ mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -+ vport_number); -+ return err; -+ } -+ -+ /* get vhca_id for `this` function */ - out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); - out = kzalloc(out_size, GFP_KERNEL); - if (!out) - return -ENOMEM; - - MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); -- MLX5_SET(query_hca_cap_in, in, other_function, other_vport); -- MLX5_SET(query_hca_cap_in, in, function_id, mlx5_vport_to_func_id(mdev, vport_number, ec_vf_func)); -- MLX5_SET(query_hca_cap_in, in, ec_vf_function, ec_vf_func); - MLX5_SET(query_hca_cap_in, in, op_mod, - MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE << 1 | - HCA_CAP_OPMOD_GET_CUR); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index 231bedc6a252..2ed2e530b07d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -1239,7 +1239,9 @@ int mlx5_vport_get_vhca_id(struct mlx5_core_dev *dev, u16 vport, u16 *vhca_id) - void *hca_caps; - int err; - -- *vhca_id = 0; -+ /* try get vhca_id via eswitch */ -+ if (mlx5_esw_vport_vhca_id(dev->priv.eswitch, vport, vhca_id)) -+ return 0; - - query_ctx = kzalloc(query_out_sz, GFP_KERNEL); - if (!query_ctx) -@@ -1256,6 +1258,7 @@ int mlx5_vport_get_vhca_id(struct mlx5_core_dev *dev, u16 vport, u16 *vhca_id) - kfree(query_ctx); - return err; - } -+EXPORT_SYMBOL_GPL(mlx5_vport_get_vhca_id); - - int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, - u16 vport, u16 opmod) -diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h -index c36cc6d82926..c87b9507cfa1 100644 ---- a/include/linux/mlx5/vport.h -+++ b/include/linux/mlx5/vport.h -@@ -135,4 +135,6 @@ int mlx5_nic_vport_unaffiliate_multiport(struct mlx5_core_dev *port_mdev); - u64 mlx5_query_nic_system_image_guid(struct mlx5_core_dev *mdev); - int mlx5_vport_get_other_func_cap(struct mlx5_core_dev *dev, u16 vport, void *out, - u16 opmod); -+int mlx5_vport_get_vhca_id(struct mlx5_core_dev *dev, u16 vport, u16 *vhca_id); -+ - #endif /* __MLX5_VPORT_H__ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1513-net-mlx5-query-to-see-if-host-pf-is-disabled.patch b/SOURCES/1513-net-mlx5-query-to-see-if-host-pf-is-disabled.patch deleted file mode 100644 index 6268668d2..000000000 --- a/SOURCES/1513-net-mlx5-query-to-see-if-host-pf-is-disabled.patch +++ /dev/null @@ -1,80 +0,0 @@ -From bb5b306016d1fbae12cb837c79c4311c5a6449f2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sat, 18 Apr 2026 17:12:40 -0400 -Subject: [PATCH] net/mlx5: Query to see if host PF is disabled - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9e84de72aef9bcf0e751a0bff3ac91b0cf52366f -Author: Daniel Jurgens -Date: Wed Aug 13 22:19:55 2025 +0300 - - net/mlx5: Query to see if host PF is disabled - - The host PF can be disabled, query firmware to check if the host PF of - this function exists. - - Signed-off-by: Daniel Jurgens - Reviewed-by: William Tu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1755112796-467444-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 21c42138d93c..e8e053aa4111 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1051,6 +1051,25 @@ const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev) - return ERR_PTR(err); - } - -+static int mlx5_esw_host_functions_enabled_query(struct mlx5_eswitch *esw) -+{ -+ const u32 *query_host_out; -+ -+ if (!mlx5_core_is_ecpf_esw_manager(esw->dev)) -+ return 0; -+ -+ query_host_out = mlx5_esw_query_functions(esw->dev); -+ if (IS_ERR(query_host_out)) -+ return PTR_ERR(query_host_out); -+ -+ esw->esw_funcs.host_funcs_disabled = -+ MLX5_GET(query_esw_functions_out, query_host_out, -+ host_params_context.host_pf_not_exist); -+ -+ kvfree(query_host_out); -+ return 0; -+} -+ - static void mlx5_eswitch_event_handler_register(struct mlx5_eswitch *esw) - { - if (esw->mode == MLX5_ESWITCH_OFFLOADS && mlx5_eswitch_is_funcs_handler(esw->dev)) { -@@ -1888,6 +1907,10 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) - goto abort; - } - -+ err = mlx5_esw_host_functions_enabled_query(esw); -+ if (err) -+ goto abort; -+ - err = mlx5_esw_vports_init(esw); - if (err) - goto abort; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 8e99d5e20c46..eacce5bece10 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -329,6 +329,7 @@ struct mlx5_host_work { - - struct mlx5_esw_functions { - struct mlx5_nb nb; -+ bool host_funcs_disabled; - u16 num_vfs; - u16 num_ec_vfs; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1514-net-mlx5-support-disabling-host-pfs.patch b/SOURCES/1514-net-mlx5-support-disabling-host-pfs.patch deleted file mode 100644 index 6a3113c58..000000000 --- a/SOURCES/1514-net-mlx5-support-disabling-host-pfs.patch +++ /dev/null @@ -1,257 +0,0 @@ -From c6a2b2fe5d05fec43296bf69739c4cdee2efb6b5 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:19:36 -0400 -Subject: [PATCH] net/mlx5: Support disabling host PFs - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to an upstream conflicts that fixed in the following: -38dad812bb50 ("Merge tag 'mlx5-next-vhca-id' of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux") - -commit 520369ef43a8504f9d54ee219bb6c692d2e40028 -Author: Daniel Jurgens -Date: Wed Aug 13 22:19:56 2025 +0300 - - net/mlx5: Support disabling host PFs - - Some devices support disabling the physical function on the host. When - this is configured the vports for the host functions do not exist. - - This patch checks if host functions are enabled before trying to access - their vports. - - Signed-off-by: Daniel Jurgens - Reviewed-by: William Tu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1755112796-467444-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index e8e053aa4111..9fe5a45124fd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1310,17 +1310,19 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, - esw->mode == MLX5_ESWITCH_LEGACY; - - /* Enable PF vport */ -- if (pf_needed) { -+ if (pf_needed && mlx5_esw_host_functions_enabled(esw->dev)) { - ret = mlx5_eswitch_load_pf_vf_vport(esw, MLX5_VPORT_PF, - enabled_events); - if (ret) - return ret; - } - -- /* Enable external host PF HCA */ -- ret = host_pf_enable_hca(esw->dev); -- if (ret) -- goto pf_hca_err; -+ if (mlx5_esw_host_functions_enabled(esw->dev)) { -+ /* Enable external host PF HCA */ -+ ret = host_pf_enable_hca(esw->dev); -+ if (ret) -+ goto pf_hca_err; -+ } - - /* Enable ECPF vport */ - if (mlx5_ecpf_vport_exists(esw->dev)) { -@@ -1352,9 +1354,10 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, - if (mlx5_ecpf_vport_exists(esw->dev)) - mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_ECPF); - ecpf_err: -- host_pf_disable_hca(esw->dev); -+ if (mlx5_esw_host_functions_enabled(esw->dev)) -+ host_pf_disable_hca(esw->dev); - pf_hca_err: -- if (pf_needed) -+ if (pf_needed && mlx5_esw_host_functions_enabled(esw->dev)) - mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_PF); - return ret; - } -@@ -1374,10 +1377,12 @@ void mlx5_eswitch_disable_pf_vf_vports(struct mlx5_eswitch *esw) - mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_ECPF); - } - -- host_pf_disable_hca(esw->dev); -+ if (mlx5_esw_host_functions_enabled(esw->dev)) -+ host_pf_disable_hca(esw->dev); - -- if (mlx5_core_is_ecpf_esw_manager(esw->dev) || -- esw->mode == MLX5_ESWITCH_LEGACY) -+ if ((mlx5_core_is_ecpf_esw_manager(esw->dev) || -+ esw->mode == MLX5_ESWITCH_LEGACY) && -+ mlx5_esw_host_functions_enabled(esw->dev)) - mlx5_eswitch_unload_pf_vf_vport(esw, MLX5_VPORT_PF); - } - -@@ -1706,7 +1711,8 @@ int mlx5_esw_sf_max_hpf_functions(struct mlx5_core_dev *dev, u16 *max_sfs, u16 * - void *hca_caps; - int err; - -- if (!mlx5_core_is_ecpf(dev)) { -+ if (!mlx5_core_is_ecpf(dev) || -+ !mlx5_esw_host_functions_enabled(dev)) { - *max_sfs = 0; - return 0; - } -@@ -1783,21 +1789,23 @@ static int mlx5_esw_vports_init(struct mlx5_eswitch *esw) - - xa_init(&esw->vports); - -- err = mlx5_esw_vport_alloc(esw, idx, MLX5_VPORT_PF); -- if (err) -- goto err; -- if (esw->first_host_vport == MLX5_VPORT_PF) -- xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_HOST_FN); -- idx++; -- -- for (i = 0; i < mlx5_core_max_vfs(dev); i++) { -- err = mlx5_esw_vport_alloc(esw, idx, idx); -+ if (mlx5_esw_host_functions_enabled(dev)) { -+ err = mlx5_esw_vport_alloc(esw, idx, MLX5_VPORT_PF); - if (err) - goto err; -- xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_VF); -- xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_HOST_FN); -+ if (esw->first_host_vport == MLX5_VPORT_PF) -+ xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_HOST_FN); - idx++; -+ for (i = 0; i < mlx5_core_max_vfs(dev); i++) { -+ err = mlx5_esw_vport_alloc(esw, idx, idx); -+ if (err) -+ goto err; -+ xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_VF); -+ xa_set_mark(&esw->vports, idx, MLX5_ESW_VPT_HOST_FN); -+ idx++; -+ } - } -+ - base_sf_num = mlx5_sf_start_function_id(dev); - for (i = 0; i < mlx5_sf_max_functions(dev); i++) { - err = mlx5_esw_vport_alloc(esw, idx, base_sf_num + i); -@@ -1897,6 +1905,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) - goto free_esw; - - esw->dev = dev; -+ dev->priv.eswitch = esw; - esw->manager_vport = mlx5_eswitch_manager_vport(dev); - esw->first_host_vport = mlx5_eswitch_first_host_vport_num(dev); - -@@ -1915,7 +1924,6 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) - if (err) - goto abort; - -- dev->priv.eswitch = esw; - err = esw_offloads_init(esw); - if (err) - goto reps_err; -@@ -2447,3 +2455,11 @@ void mlx5_eswitch_unblock_ipsec(struct mlx5_core_dev *dev) - dev->num_ipsec_offloads--; - mutex_unlock(&esw->state_lock); - } -+ -+bool mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev) -+{ -+ if (!dev->priv.eswitch) -+ return true; -+ -+ return !dev->priv.eswitch->esw_funcs.host_funcs_disabled; -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index eacce5bece10..cfd6b1b8c6f4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -903,6 +903,7 @@ int mlx5_esw_ipsec_vf_packet_offload_set(struct mlx5_eswitch *esw, struct mlx5_v - bool enable); - int mlx5_esw_ipsec_vf_packet_offload_supported(struct mlx5_core_dev *dev, - u16 vport_num); -+bool mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev); - #else /* CONFIG_MLX5_ESWITCH */ - /* eswitch API stubs */ - static inline int mlx5_eswitch_init(struct mlx5_core_dev *dev) { return 0; } -@@ -971,6 +972,12 @@ static inline bool mlx5_eswitch_block_ipsec(struct mlx5_core_dev *dev) - - static inline void mlx5_eswitch_unblock_ipsec(struct mlx5_core_dev *dev) {} - -+static inline bool -+mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev) -+{ -+ return true; -+} -+ - static inline bool - mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id) - { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 19decaa8a96e..cdba7bc448ee 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1213,7 +1213,8 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - misc = MLX5_ADDR_OF(fte_match_param, spec->match_value, - misc_parameters); - -- if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev) && -+ mlx5_esw_host_functions_enabled(peer_dev)) { - peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); - esw_set_peer_miss_rule_source_port(esw, peer_esw, spec, - MLX5_VPORT_PF); -@@ -1239,19 +1240,21 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - flows[peer_vport->index] = flow; - } - -- mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -- mlx5_core_max_vfs(peer_dev)) { -- esw_set_peer_miss_rule_source_port(esw, -- peer_esw, -- spec, peer_vport->vport); -+ if (mlx5_esw_host_functions_enabled(esw->dev)) { -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, -+ spec, -+ peer_vport->vport); - -- flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), -- spec, &flow_act, &dest, 1); -- if (IS_ERR(flow)) { -- err = PTR_ERR(flow); -- goto add_vf_flow_err; -+ flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), -+ spec, &flow_act, &dest, 1); -+ if (IS_ERR(flow)) { -+ err = PTR_ERR(flow); -+ goto add_vf_flow_err; -+ } -+ flows[peer_vport->index] = flow; - } -- flows[peer_vport->index] = flow; - } - - if (mlx5_core_ec_sriov_enabled(peer_dev)) { -@@ -1301,7 +1304,9 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - mlx5_del_flow_rules(flows[peer_vport->index]); - } - add_ecpf_flow_err: -- if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev) && -+ mlx5_esw_host_functions_enabled(peer_dev)) { - peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); - mlx5_del_flow_rules(flows[peer_vport->index]); - } -@@ -4059,7 +4064,8 @@ mlx5_eswitch_vport_has_rep(const struct mlx5_eswitch *esw, u16 vport_num) - { - /* Currently, only ECPF based device has representor for host PF. */ - if (vport_num == MLX5_VPORT_PF && -- !mlx5_core_is_ecpf_esw_manager(esw->dev)) -+ (!mlx5_core_is_ecpf_esw_manager(esw->dev) || -+ !mlx5_esw_host_functions_enabled(esw->dev))) - return false; - - if (vport_num == MLX5_VPORT_ECPF && --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1515-net-mlx5e-set-default-burst-period-for-tx-and-rx-reporters.patch b/SOURCES/1515-net-mlx5e-set-default-burst-period-for-tx-and-rx-reporters.patch deleted file mode 100644 index 136c0ba8d..000000000 --- a/SOURCES/1515-net-mlx5e-set-default-burst-period-for-tx-and-rx-reporters.patch +++ /dev/null @@ -1,89 +0,0 @@ -From ae5fd3463475a68bcecf16609574d3df05474f3b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5e: Set default burst period for TX and RX reporters - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2d5ccb93bbb4f161ccb677ce0b2ebcfe4a089d62 -Author: Shahar Shitrit -Date: Sun Aug 24 11:43:54 2025 +0300 - - net/mlx5e: Set default burst period for TX and RX reporters - - System errors can sometimes cause multiple errors to be reported - to the TX reporter at the same time. For instance, lost interrupts - may cause several SQs to time out simultaneously. When dev_watchdog - notifies the driver for that, it iterates over all SQs to trigger - recovery for the timed-out ones, via TX health reporter. - However, grace period allows only one recovery at a time, so only - the first SQ recovers while others remain blocked. Since no further - recoveries are allowed during the grace period, subsequent errors - cause the reporter to enter an ERROR state, requiring manual - intervention. - - To address this, set the TX reporter's default burst period - to 0.5 second. This allows the reporter to detect and handle all - timed-out SQs within this window before initiating the grace period. - - To account for the possibility of a similar issue in the RX reporter, - its default burst period is also configured. - - Additionally, while here, align the TX definition prefix with the RX, - as these are used only in EN driver. - - Signed-off-by: Shahar Shitrit - Reviewed-by: Dragos Tatulea - Reviewed-by: Carolina Jubran - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20250824084354.533182-6-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -index 1b9ea72abc5a..eb1cace5910c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -@@ -652,6 +652,7 @@ void mlx5e_reporter_icosq_resume_recovery(struct mlx5e_channel *c) - } - - #define MLX5E_REPORTER_RX_GRACEFUL_PERIOD 500 -+#define MLX5E_REPORTER_RX_BURST_PERIOD 500 - - static const struct devlink_health_reporter_ops mlx5_rx_reporter_ops = { - .name = "rx", -@@ -659,6 +660,7 @@ static const struct devlink_health_reporter_ops mlx5_rx_reporter_ops = { - .diagnose = mlx5e_rx_reporter_diagnose, - .dump = mlx5e_rx_reporter_dump, - .default_graceful_period = MLX5E_REPORTER_RX_GRACEFUL_PERIOD, -+ .default_burst_period = MLX5E_REPORTER_RX_BURST_PERIOD, - }; - - void mlx5e_reporter_rx_create(struct mlx5e_priv *priv) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -index 069ab8aaac5c..8907c5378f54 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -@@ -543,14 +543,16 @@ void mlx5e_reporter_tx_ptpsq_unhealthy(struct mlx5e_ptpsq *ptpsq) - mlx5e_health_report(priv, priv->tx_reporter, err_str, &err_ctx); - } - --#define MLX5_REPORTER_TX_GRACEFUL_PERIOD 500 -+#define MLX5E_REPORTER_TX_GRACEFUL_PERIOD 500 -+#define MLX5E_REPORTER_TX_BURST_PERIOD 500 - - static const struct devlink_health_reporter_ops mlx5_tx_reporter_ops = { - .name = "tx", - .recover = mlx5e_tx_reporter_recover, - .diagnose = mlx5e_tx_reporter_diagnose, - .dump = mlx5e_tx_reporter_dump, -- .default_graceful_period = MLX5_REPORTER_TX_GRACEFUL_PERIOD, -+ .default_graceful_period = MLX5E_REPORTER_TX_GRACEFUL_PERIOD, -+ .default_burst_period = MLX5E_REPORTER_TX_BURST_PERIOD, - }; - - void mlx5e_reporter_tx_create(struct mlx5e_priv *priv) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1516-eth-mlx5-remove-kconfig-co-dependency-with-vxlan.patch b/SOURCES/1516-eth-mlx5-remove-kconfig-co-dependency-with-vxlan.patch deleted file mode 100644 index c46fe66fb..000000000 --- a/SOURCES/1516-eth-mlx5-remove-kconfig-co-dependency-with-vxlan.patch +++ /dev/null @@ -1,57 +0,0 @@ -From c2622b6a6d390d99cd9e0fee8ad6a711265c46d6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] eth: mlx5: remove Kconfig co-dependency with VXLAN - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 15d157c3ad018a7b9d99d0cf35d6b163e570728e -Author: Jakub Kicinski -Date: Wed Aug 27 16:43:19 2025 -0700 - - eth: mlx5: remove Kconfig co-dependency with VXLAN - - mlx5 has a Kconfig co-dependency on VXLAN, even tho it doesn't - call any VXLAN function (unlike mlxsw). Perhaps this dates back - to very old days when tunnel ports were fetched directly from - VXLAN. - - Remove the dependency to allow MLX5=y + VXLAN=m kernel configs. - But still avoid compiling in the lib/vxlan code if VXLAN=n. - - Reviewed-by: Saeed Mahameed - Link: https://patch.msgid.link/20250827234319.3504852-1-kuba@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig -index 6ec7d6e0181d..8ef2ac2060ba 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig -@@ -8,7 +8,6 @@ config MLX5_CORE - depends on PCI - select AUXILIARY_BUS - select NET_DEVLINK -- depends on VXLAN || !VXLAN - depends on MLXFW || !MLXFW - depends on PTP_1588_CLOCK_OPTIONAL - depends on PCI_HYPERV_INTERFACE || !PCI_HYPERV_INTERFACE -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index a253c73db9e5..206223ce63a8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -85,7 +85,9 @@ mlx5_core-$(CONFIG_MLX5_BRIDGE) += esw/bridge.o esw/bridge_mcast.o esw/bridge - - mlx5_core-$(CONFIG_HWMON) += hwmon.o - mlx5_core-$(CONFIG_MLX5_MPFS) += lib/mpfs.o --mlx5_core-$(CONFIG_VXLAN) += lib/vxlan.o -+ifneq ($(CONFIG_VXLAN),) -+ mlx5_core-y += lib/vxlan.o -+endif - mlx5_core-$(CONFIG_PTP_1588_CLOCK) += lib/clock.o - mlx5_core-$(CONFIG_PCI_HYPERV_INTERFACE) += lib/hv.o lib/hv_vhca.o - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1517-net-mlx5-fs-convert-vport-acls-root-namespaces-to-xarray.patch b/SOURCES/1517-net-mlx5-fs-convert-vport-acls-root-namespaces-to-xarray.patch deleted file mode 100644 index 2dc5dcadb..000000000 --- a/SOURCES/1517-net-mlx5-fs-convert-vport-acls-root-namespaces-to-xarray.patch +++ /dev/null @@ -1,327 +0,0 @@ -From 97520697555ea273161d35f4f201b27d6dbc02d9 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5: FS, Convert vport acls root namespaces to xarray - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2e894b99c0172759f89af506cdd898ced0b14e13 -Author: Saeed Mahameed -Date: Fri Aug 29 15:37:16 2025 -0700 - - net/mlx5: FS, Convert vport acls root namespaces to xarray - - Before this patch it was a linear array and could only support a certain - number of vports, in the next patches, vport numbers are not bound to a - well known limit, thus convert acl root name space storage to xarray. - - In addition create fs_core public API to add/remove vport acl namespaces - as it is the eswitch responsibility to create the vports and their - root name spaces for acls, in the next patch we will move - mlx5_fs_ingress_acls_{init,cleanup} to eswitch and will use - the individual mlx5_fs_vport_{egress,ingresS}_acl_ns_{add,remove} - APIs for dynamically create vports. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-2-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 80245c38dbad..6028c163d9a2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -2793,30 +2793,32 @@ struct mlx5_flow_namespace *mlx5_get_flow_namespace(struct mlx5_core_dev *dev, - } - EXPORT_SYMBOL(mlx5_get_flow_namespace); - -+struct mlx5_vport_acl_root_ns { -+ u16 vport_idx; -+ struct mlx5_flow_root_namespace *root_ns; -+}; -+ - struct mlx5_flow_namespace * - mlx5_get_flow_vport_namespace(struct mlx5_core_dev *dev, - enum mlx5_flow_namespace_type type, int vport_idx) - { - struct mlx5_flow_steering *steering = dev->priv.steering; -+ struct mlx5_vport_acl_root_ns *vport_ns; - - if (!steering) - return NULL; - - switch (type) { - case MLX5_FLOW_NAMESPACE_ESW_EGRESS: -- if (vport_idx >= steering->esw_egress_acl_vports) -- return NULL; -- if (steering->esw_egress_root_ns && -- steering->esw_egress_root_ns[vport_idx]) -- return &steering->esw_egress_root_ns[vport_idx]->ns; -+ vport_ns = xa_load(&steering->esw_egress_root_ns, vport_idx); -+ if (vport_ns) -+ return &vport_ns->root_ns->ns; - else - return NULL; - case MLX5_FLOW_NAMESPACE_ESW_INGRESS: -- if (vport_idx >= steering->esw_ingress_acl_vports) -- return NULL; -- if (steering->esw_ingress_root_ns && -- steering->esw_ingress_root_ns[vport_idx]) -- return &steering->esw_ingress_root_ns[vport_idx]->ns; -+ vport_ns = xa_load(&steering->esw_ingress_root_ns, vport_idx); -+ if (vport_ns) -+ return &vport_ns->root_ns->ns; - else - return NULL; - case MLX5_FLOW_NAMESPACE_RDMA_TRANSPORT_RX: -@@ -3575,30 +3577,102 @@ static int init_fdb_root_ns(struct mlx5_flow_steering *steering) - return err; - } - --static int init_egress_acl_root_ns(struct mlx5_flow_steering *steering, int vport) -+static void -+mlx5_fs_remove_vport_acl_root_ns(struct xarray *esw_acl_root_ns, u16 vport_idx) -+{ -+ struct mlx5_vport_acl_root_ns *vport_ns; -+ -+ vport_ns = xa_erase(esw_acl_root_ns, vport_idx); -+ if (vport_ns) { -+ cleanup_root_ns(vport_ns->root_ns); -+ kfree(vport_ns); -+ } -+} -+ -+static int -+mlx5_fs_add_vport_acl_root_ns(struct mlx5_flow_steering *steering, -+ struct xarray *esw_acl_root_ns, -+ enum fs_flow_table_type table_type, -+ u16 vport_idx) - { -+ struct mlx5_vport_acl_root_ns *vport_ns; - struct fs_prio *prio; -+ int err; -+ -+ /* sanity check, intended xarrays are used */ -+ if (WARN_ON(esw_acl_root_ns != &steering->esw_egress_root_ns && -+ esw_acl_root_ns != &steering->esw_ingress_root_ns)) -+ return -EINVAL; - -- steering->esw_egress_root_ns[vport] = create_root_ns(steering, FS_FT_ESW_EGRESS_ACL); -- if (!steering->esw_egress_root_ns[vport]) -+ if (table_type != FS_FT_ESW_EGRESS_ACL && -+ table_type != FS_FT_ESW_INGRESS_ACL) { -+ mlx5_core_err(steering->dev, -+ "Invalid table type %d for egress/ingress ACLs\n", -+ table_type); -+ return -EINVAL; -+ } -+ -+ if (xa_load(esw_acl_root_ns, vport_idx)) -+ return -EEXIST; -+ -+ vport_ns = kzalloc(sizeof(*vport_ns), GFP_KERNEL); -+ if (!vport_ns) - return -ENOMEM; - -+ vport_ns->root_ns = create_root_ns(steering, table_type); -+ if (!vport_ns->root_ns) { -+ err = -ENOMEM; -+ goto kfree_vport_ns; -+ } -+ - /* create 1 prio*/ -- prio = fs_create_prio(&steering->esw_egress_root_ns[vport]->ns, 0, 1); -- return PTR_ERR_OR_ZERO(prio); -+ prio = fs_create_prio(&vport_ns->root_ns->ns, 0, 1); -+ if (IS_ERR(prio)) { -+ err = PTR_ERR(prio); -+ goto cleanup_root_ns; -+ } -+ -+ vport_ns->vport_idx = vport_idx; -+ err = xa_insert(esw_acl_root_ns, vport_idx, vport_ns, GFP_KERNEL); -+ if (err) -+ goto cleanup_root_ns; -+ return 0; -+ -+cleanup_root_ns: -+ cleanup_root_ns(vport_ns->root_ns); -+kfree_vport_ns: -+ kfree(vport_ns); -+ return err; - } - --static int init_ingress_acl_root_ns(struct mlx5_flow_steering *steering, int vport) -+int mlx5_fs_vport_egress_acl_ns_add(struct mlx5_flow_steering *steering, -+ u16 vport_idx) - { -- struct fs_prio *prio; -+ return mlx5_fs_add_vport_acl_root_ns(steering, -+ &steering->esw_egress_root_ns, -+ FS_FT_ESW_EGRESS_ACL, vport_idx); -+} - -- steering->esw_ingress_root_ns[vport] = create_root_ns(steering, FS_FT_ESW_INGRESS_ACL); -- if (!steering->esw_ingress_root_ns[vport]) -- return -ENOMEM; -+int mlx5_fs_vport_ingress_acl_ns_add(struct mlx5_flow_steering *steering, -+ u16 vport_idx) -+{ -+ return mlx5_fs_add_vport_acl_root_ns(steering, -+ &steering->esw_ingress_root_ns, -+ FS_FT_ESW_INGRESS_ACL, vport_idx); -+} - -- /* create 1 prio*/ -- prio = fs_create_prio(&steering->esw_ingress_root_ns[vport]->ns, 0, 1); -- return PTR_ERR_OR_ZERO(prio); -+void mlx5_fs_vport_egress_acl_ns_remove(struct mlx5_flow_steering *steering, -+ int vport_idx) -+{ -+ mlx5_fs_remove_vport_acl_root_ns(&steering->esw_egress_root_ns, -+ vport_idx); -+} -+ -+void mlx5_fs_vport_ingress_acl_ns_remove(struct mlx5_flow_steering *steering, -+ int vport_idx) -+{ -+ mlx5_fs_remove_vport_acl_root_ns(&steering->esw_ingress_root_ns, -+ vport_idx); - } - - int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports) -@@ -3607,15 +3681,10 @@ int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports) - int err; - int i; - -- steering->esw_egress_root_ns = -- kcalloc(total_vports, -- sizeof(*steering->esw_egress_root_ns), -- GFP_KERNEL); -- if (!steering->esw_egress_root_ns) -- return -ENOMEM; -+ xa_init(&steering->esw_egress_root_ns); - - for (i = 0; i < total_vports; i++) { -- err = init_egress_acl_root_ns(steering, i); -+ err = mlx5_fs_vport_egress_acl_ns_add(steering, i); - if (err) - goto cleanup_root_ns; - } -@@ -3623,10 +3692,9 @@ int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports) - return 0; - - cleanup_root_ns: -- for (i--; i >= 0; i--) -- cleanup_root_ns(steering->esw_egress_root_ns[i]); -- kfree(steering->esw_egress_root_ns); -- steering->esw_egress_root_ns = NULL; -+ while (i--) -+ mlx5_fs_vport_egress_acl_ns_remove(steering, i); -+ xa_destroy(&steering->esw_egress_root_ns); - return err; - } - -@@ -3635,14 +3703,10 @@ void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev) - struct mlx5_flow_steering *steering = dev->priv.steering; - int i; - -- if (!steering->esw_egress_root_ns) -- return; -- - for (i = 0; i < steering->esw_egress_acl_vports; i++) -- cleanup_root_ns(steering->esw_egress_root_ns[i]); -+ mlx5_fs_vport_egress_acl_ns_remove(steering, i); - -- kfree(steering->esw_egress_root_ns); -- steering->esw_egress_root_ns = NULL; -+ xa_destroy(&steering->esw_egress_root_ns); - } - - int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports) -@@ -3651,15 +3715,10 @@ int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports) - int err; - int i; - -- steering->esw_ingress_root_ns = -- kcalloc(total_vports, -- sizeof(*steering->esw_ingress_root_ns), -- GFP_KERNEL); -- if (!steering->esw_ingress_root_ns) -- return -ENOMEM; -+ xa_init(&steering->esw_ingress_root_ns); - - for (i = 0; i < total_vports; i++) { -- err = init_ingress_acl_root_ns(steering, i); -+ err = mlx5_fs_vport_ingress_acl_ns_add(steering, i); - if (err) - goto cleanup_root_ns; - } -@@ -3667,10 +3726,10 @@ int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports) - return 0; - - cleanup_root_ns: -- for (i--; i >= 0; i--) -- cleanup_root_ns(steering->esw_ingress_root_ns[i]); -- kfree(steering->esw_ingress_root_ns); -- steering->esw_ingress_root_ns = NULL; -+ while (i--) -+ mlx5_fs_vport_ingress_acl_ns_remove(steering, i); -+ -+ xa_destroy(&steering->esw_ingress_root_ns); - return err; - } - -@@ -3679,14 +3738,10 @@ void mlx5_fs_ingress_acls_cleanup(struct mlx5_core_dev *dev) - struct mlx5_flow_steering *steering = dev->priv.steering; - int i; - -- if (!steering->esw_ingress_root_ns) -- return; -- - for (i = 0; i < steering->esw_ingress_acl_vports; i++) -- cleanup_root_ns(steering->esw_ingress_root_ns[i]); -+ mlx5_fs_vport_ingress_acl_ns_remove(steering, i); - -- kfree(steering->esw_ingress_root_ns); -- steering->esw_ingress_root_ns = NULL; -+ xa_destroy(&steering->esw_ingress_root_ns); - } - - u32 mlx5_fs_get_capabilities(struct mlx5_core_dev *dev, enum mlx5_flow_namespace_type type) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index e6a95b310b55..4dbf2485fb9e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -151,8 +151,8 @@ struct mlx5_flow_steering { - struct mlx5_flow_root_namespace *root_ns; - struct mlx5_flow_root_namespace *fdb_root_ns; - struct mlx5_flow_namespace **fdb_sub_ns; -- struct mlx5_flow_root_namespace **esw_egress_root_ns; -- struct mlx5_flow_root_namespace **esw_ingress_root_ns; -+ struct xarray esw_egress_root_ns; -+ struct xarray esw_ingress_root_ns; - struct mlx5_flow_root_namespace *sniffer_tx_root_ns; - struct mlx5_flow_root_namespace *sniffer_rx_root_ns; - struct mlx5_flow_root_namespace *rdma_rx_root_ns; -@@ -384,6 +384,15 @@ void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev); - int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports); - void mlx5_fs_ingress_acls_cleanup(struct mlx5_core_dev *dev); - -+int mlx5_fs_vport_egress_acl_ns_add(struct mlx5_flow_steering *steering, -+ u16 vport_idx); -+int mlx5_fs_vport_ingress_acl_ns_add(struct mlx5_flow_steering *steering, -+ u16 vport_idx); -+void mlx5_fs_vport_egress_acl_ns_remove(struct mlx5_flow_steering *steering, -+ int vport_idx); -+void mlx5_fs_vport_ingress_acl_ns_remove(struct mlx5_flow_steering *steering, -+ int vport_idx); -+ - u32 mlx5_fs_get_capabilities(struct mlx5_core_dev *dev, enum mlx5_flow_namespace_type type); - - struct mlx5_flow_root_namespace *find_root(struct fs_node *node); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1518-net-mlx5-e-switch-move-vport-acls-root-namespaces-creation-t.patch b/SOURCES/1518-net-mlx5-e-switch-move-vport-acls-root-namespaces-creation-t.patch deleted file mode 100644 index 464cb2626..000000000 --- a/SOURCES/1518-net-mlx5-e-switch-move-vport-acls-root-namespaces-creation-t.patch +++ /dev/null @@ -1,271 +0,0 @@ -From 57ec704d66d385d9c9b5c3aa7728dc04b0287551 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Move vport acls root namespaces creation - to eswitch - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit faa6ac53cdaa26f80e4b44e6255a52bd67b83acb -Author: Saeed Mahameed -Date: Fri Aug 29 15:37:17 2025 -0700 - - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch - - Move the loop that creates the vports ACLs root name spaces to eswitch, - since it is the eswitch responsibility to decide when and how many - vports ACLs root namespaces to create, in the next patches we will use - the fs_core vport ACL root namespace APIs to create/remove root ns - ACLs dynamically for dynamically created vports. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-3-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 9fe5a45124fd..900650a1a66e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1439,19 +1439,76 @@ static void mlx5_esw_mode_change_notify(struct mlx5_eswitch *esw, u16 mode) - blocking_notifier_call_chain(&esw->n_head, 0, &info); - } - -+static int mlx5_esw_egress_acls_init(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_flow_steering *steering = dev->priv.steering; -+ int total_vports = mlx5_eswitch_get_total_vports(dev); -+ int err; -+ int i; -+ -+ for (i = 0; i < total_vports; i++) { -+ err = mlx5_fs_vport_egress_acl_ns_add(steering, i); -+ if (err) -+ goto acl_ns_remove; -+ } -+ return 0; -+ -+acl_ns_remove: -+ while (i--) -+ mlx5_fs_vport_egress_acl_ns_remove(steering, i); -+ return err; -+} -+ -+static void mlx5_esw_egress_acls_cleanup(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_flow_steering *steering = dev->priv.steering; -+ int total_vports = mlx5_eswitch_get_total_vports(dev); -+ int i; -+ -+ for (i = total_vports - 1; i >= 0; i--) -+ mlx5_fs_vport_egress_acl_ns_remove(steering, i); -+} -+ -+static int mlx5_esw_ingress_acls_init(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_flow_steering *steering = dev->priv.steering; -+ int total_vports = mlx5_eswitch_get_total_vports(dev); -+ int err; -+ int i; -+ -+ for (i = 0; i < total_vports; i++) { -+ err = mlx5_fs_vport_ingress_acl_ns_add(steering, i); -+ if (err) -+ goto acl_ns_remove; -+ } -+ return 0; -+ -+acl_ns_remove: -+ while (i--) -+ mlx5_fs_vport_ingress_acl_ns_remove(steering, i); -+ return err; -+} -+ -+static void mlx5_esw_ingress_acls_cleanup(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_flow_steering *steering = dev->priv.steering; -+ int total_vports = mlx5_eswitch_get_total_vports(dev); -+ int i; -+ -+ for (i = total_vports - 1; i >= 0; i--) -+ mlx5_fs_vport_ingress_acl_ns_remove(steering, i); -+} -+ - static int mlx5_esw_acls_ns_init(struct mlx5_eswitch *esw) - { - struct mlx5_core_dev *dev = esw->dev; -- int total_vports; - int err; - - if (esw->flags & MLX5_ESWITCH_VPORT_ACL_NS_CREATED) - return 0; - -- total_vports = mlx5_eswitch_get_total_vports(dev); -- - if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) { -- err = mlx5_fs_egress_acls_init(dev, total_vports); -+ err = mlx5_esw_egress_acls_init(dev); - if (err) - return err; - } else { -@@ -1459,7 +1516,7 @@ static int mlx5_esw_acls_ns_init(struct mlx5_eswitch *esw) - } - - if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) { -- err = mlx5_fs_ingress_acls_init(dev, total_vports); -+ err = mlx5_esw_ingress_acls_init(dev); - if (err) - goto err; - } else { -@@ -1470,7 +1527,7 @@ static int mlx5_esw_acls_ns_init(struct mlx5_eswitch *esw) - - err: - if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) -- mlx5_fs_egress_acls_cleanup(dev); -+ mlx5_esw_egress_acls_cleanup(dev); - return err; - } - -@@ -1480,9 +1537,9 @@ static void mlx5_esw_acls_ns_cleanup(struct mlx5_eswitch *esw) - - esw->flags &= ~MLX5_ESWITCH_VPORT_ACL_NS_CREATED; - if (MLX5_CAP_ESW_INGRESS_ACL(dev, ft_support)) -- mlx5_fs_ingress_acls_cleanup(dev); -+ mlx5_esw_ingress_acls_cleanup(dev); - if (MLX5_CAP_ESW_EGRESS_ACL(dev, ft_support)) -- mlx5_fs_egress_acls_cleanup(dev); -+ mlx5_esw_egress_acls_cleanup(dev); - } - - /** -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 6028c163d9a2..2db3ffb0a2b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3675,75 +3675,6 @@ void mlx5_fs_vport_ingress_acl_ns_remove(struct mlx5_flow_steering *steering, - vport_idx); - } - --int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports) --{ -- struct mlx5_flow_steering *steering = dev->priv.steering; -- int err; -- int i; -- -- xa_init(&steering->esw_egress_root_ns); -- -- for (i = 0; i < total_vports; i++) { -- err = mlx5_fs_vport_egress_acl_ns_add(steering, i); -- if (err) -- goto cleanup_root_ns; -- } -- steering->esw_egress_acl_vports = total_vports; -- return 0; -- --cleanup_root_ns: -- while (i--) -- mlx5_fs_vport_egress_acl_ns_remove(steering, i); -- xa_destroy(&steering->esw_egress_root_ns); -- return err; --} -- --void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev) --{ -- struct mlx5_flow_steering *steering = dev->priv.steering; -- int i; -- -- for (i = 0; i < steering->esw_egress_acl_vports; i++) -- mlx5_fs_vport_egress_acl_ns_remove(steering, i); -- -- xa_destroy(&steering->esw_egress_root_ns); --} -- --int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports) --{ -- struct mlx5_flow_steering *steering = dev->priv.steering; -- int err; -- int i; -- -- xa_init(&steering->esw_ingress_root_ns); -- -- for (i = 0; i < total_vports; i++) { -- err = mlx5_fs_vport_ingress_acl_ns_add(steering, i); -- if (err) -- goto cleanup_root_ns; -- } -- steering->esw_ingress_acl_vports = total_vports; -- return 0; -- --cleanup_root_ns: -- while (i--) -- mlx5_fs_vport_ingress_acl_ns_remove(steering, i); -- -- xa_destroy(&steering->esw_ingress_root_ns); -- return err; --} -- --void mlx5_fs_ingress_acls_cleanup(struct mlx5_core_dev *dev) --{ -- struct mlx5_flow_steering *steering = dev->priv.steering; -- int i; -- -- for (i = 0; i < steering->esw_ingress_acl_vports; i++) -- mlx5_fs_vport_ingress_acl_ns_remove(steering, i); -- -- xa_destroy(&steering->esw_ingress_root_ns); --} -- - u32 mlx5_fs_get_capabilities(struct mlx5_core_dev *dev, enum mlx5_flow_namespace_type type) - { - struct mlx5_flow_root_namespace *root; -@@ -3873,6 +3804,11 @@ void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev) - { - struct mlx5_flow_steering *steering = dev->priv.steering; - -+ WARN_ON(!xa_empty(&steering->esw_egress_root_ns)); -+ WARN_ON(!xa_empty(&steering->esw_ingress_root_ns)); -+ xa_destroy(&steering->esw_egress_root_ns); -+ xa_destroy(&steering->esw_ingress_root_ns); -+ - cleanup_root_ns(steering->root_ns); - cleanup_fdb_root_ns(steering); - cleanup_root_ns(steering->port_sel_root_ns); -@@ -3963,6 +3899,8 @@ int mlx5_fs_core_init(struct mlx5_core_dev *dev) - goto err; - } - -+ xa_init(&steering->esw_egress_root_ns); -+ xa_init(&steering->esw_ingress_root_ns); - return 0; - - err: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index 4dbf2485fb9e..8458ce203dac 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -159,8 +159,6 @@ struct mlx5_flow_steering { - struct mlx5_flow_root_namespace *rdma_tx_root_ns; - struct mlx5_flow_root_namespace *egress_root_ns; - struct mlx5_flow_root_namespace *port_sel_root_ns; -- int esw_egress_acl_vports; -- int esw_ingress_acl_vports; - struct mlx5_flow_root_namespace **rdma_transport_rx_root_ns; - struct mlx5_flow_root_namespace **rdma_transport_tx_root_ns; - int rdma_transport_rx_vports; -@@ -379,11 +377,6 @@ void mlx5_fs_core_free(struct mlx5_core_dev *dev); - int mlx5_fs_core_init(struct mlx5_core_dev *dev); - void mlx5_fs_core_cleanup(struct mlx5_core_dev *dev); - --int mlx5_fs_egress_acls_init(struct mlx5_core_dev *dev, int total_vports); --void mlx5_fs_egress_acls_cleanup(struct mlx5_core_dev *dev); --int mlx5_fs_ingress_acls_init(struct mlx5_core_dev *dev, int total_vports); --void mlx5_fs_ingress_acls_cleanup(struct mlx5_core_dev *dev); -- - int mlx5_fs_vport_egress_acl_ns_add(struct mlx5_flow_steering *steering, - u16 vport_idx); - int mlx5_fs_vport_ingress_acl_ns_add(struct mlx5_flow_steering *steering, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1519-net-mlx5-e-switch-add-support-for-adjacent-functions-vports-.patch b/SOURCES/1519-net-mlx5-e-switch-add-support-for-adjacent-functions-vports-.patch deleted file mode 100644 index 00cb75153..000000000 --- a/SOURCES/1519-net-mlx5-e-switch-add-support-for-adjacent-functions-vports-.patch +++ /dev/null @@ -1,420 +0,0 @@ -From 641a800bf548400ee76d7e052972fb3873894321 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Add support for adjacent functions vports - discovery - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 17426c5d4b1db69c0aa34d0bf6a1552cc2c68d95 -Author: Adithya Jayachandran -Date: Fri Aug 29 15:37:18 2025 -0700 - - net/mlx5: E-Switch, Add support for adjacent functions vports discovery - - Adding driver support to query adjacent functions vports, AKA - delegated vports. - - Adjacent functions can delegate their sriov vfs to other sibling PF in - the system, to be managed by the eswitch capable sibling PF. - E.g, ECPF to Host PF, multi host PF between each other, etc. - - Only supported in switchdev mode. - - Signed-off-by: Adithya Jayachandran - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-4-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index 206223ce63a8..a65ab661375a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -69,7 +69,7 @@ mlx5_core-$(CONFIG_MLX5_TC_SAMPLE) += en/tc/sample.o - # Core extra - # - mlx5_core-$(CONFIG_MLX5_ESWITCH) += eswitch.o eswitch_offloads.o eswitch_offloads_termtbl.o \ -- ecpf.o rdma.o esw/legacy.o \ -+ ecpf.o rdma.o esw/legacy.o esw/adj_vport.o \ - esw/devlink_port.o esw/vporttbl.o esw/qos.o esw/ipsec.o - - mlx5_core-$(CONFIG_MLX5_ESWITCH) += esw/acl/helper.o \ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -new file mode 100644 -index 000000000000..37a06c0949d5 ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -@@ -0,0 +1,185 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+// Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved. -+ -+#include "eswitch.h" -+ -+enum { -+ MLX5_ADJ_VPORT_DISCONNECT = 0x0, -+ MLX5_ADJ_VPORT_CONNECT = 0x1, -+}; -+ -+static int mlx5_esw_adj_vport_modify(struct mlx5_core_dev *dev, -+ u16 vport, bool connect) -+{ -+ u32 in[MLX5_ST_SZ_DW(modify_vport_state_in)] = {}; -+ -+ MLX5_SET(modify_vport_state_in, in, opcode, -+ MLX5_CMD_OP_MODIFY_VPORT_STATE); -+ MLX5_SET(modify_vport_state_in, in, op_mod, -+ MLX5_VPORT_STATE_OP_MOD_ESW_VPORT); -+ MLX5_SET(modify_vport_state_in, in, other_vport, 1); -+ MLX5_SET(modify_vport_state_in, in, vport_number, vport); -+ MLX5_SET(modify_vport_state_in, in, ingress_connect_valid, 1); -+ MLX5_SET(modify_vport_state_in, in, egress_connect_valid, 1); -+ MLX5_SET(modify_vport_state_in, in, ingress_connect, connect); -+ MLX5_SET(modify_vport_state_in, in, egress_connect, connect); -+ -+ return mlx5_cmd_exec_in(dev, modify_vport_state, in); -+} -+ -+static void mlx5_esw_destroy_esw_vport(struct mlx5_core_dev *dev, u16 vport) -+{ -+ u32 in[MLX5_ST_SZ_DW(destroy_esw_vport_in)] = {}; -+ -+ MLX5_SET(destroy_esw_vport_in, in, opcode, -+ MLX5_CMD_OPCODE_DESTROY_ESW_VPORT); -+ MLX5_SET(destroy_esw_vport_in, in, vport_num, vport); -+ -+ mlx5_cmd_exec_in(dev, destroy_esw_vport, in); -+} -+ -+static int mlx5_esw_create_esw_vport(struct mlx5_core_dev *dev, u16 vhca_id, -+ u16 *vport_num) -+{ -+ u32 out[MLX5_ST_SZ_DW(create_esw_vport_out)] = {}; -+ u32 in[MLX5_ST_SZ_DW(create_esw_vport_in)] = {}; -+ int err; -+ -+ MLX5_SET(create_esw_vport_in, in, opcode, -+ MLX5_CMD_OPCODE_CREATE_ESW_VPORT); -+ MLX5_SET(create_esw_vport_in, in, managed_vhca_id, vhca_id); -+ -+ err = mlx5_cmd_exec(dev, in, sizeof(in), out, sizeof(out)); -+ if (!err) -+ *vport_num = MLX5_GET(create_esw_vport_out, out, vport_num); -+ -+ return err; -+} -+ -+static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id) -+{ -+ struct mlx5_vport *vport; -+ u16 vport_num; -+ int err; -+ -+ err = mlx5_esw_create_esw_vport(esw->dev, vhca_id, &vport_num); -+ if (err) { -+ esw_warn(esw->dev, -+ "Failed to create adjacent vport for vhca_id %d, err %d\n", -+ vhca_id, err); -+ return err; -+ } -+ -+ esw_debug(esw->dev, "Created adjacent vport[%d] %d for vhca_id 0x%x\n", -+ esw->last_vport_idx, vport_num, vhca_id); -+ -+ err = mlx5_esw_vport_alloc(esw, esw->last_vport_idx++, vport_num); -+ if (err) -+ goto destroy_esw_vport; -+ -+ xa_set_mark(&esw->vports, vport_num, MLX5_ESW_VPT_VF); -+ vport = mlx5_eswitch_get_vport(esw, vport_num); -+ vport->adjacent = true; -+ vport->vhca_id = vhca_id; -+ -+ mlx5_esw_adj_vport_modify(esw->dev, vport_num, MLX5_ADJ_VPORT_CONNECT); -+ return 0; -+ -+destroy_esw_vport: -+ mlx5_esw_destroy_esw_vport(esw->dev, vport_num); -+ return err; -+} -+ -+static void mlx5_esw_adj_vport_destroy(struct mlx5_eswitch *esw, -+ struct mlx5_vport *vport) -+{ -+ u16 vport_num = vport->vport; -+ -+ esw_debug(esw->dev, "Destroying adjacent vport %d for vhca_id 0x%x\n", -+ vport_num, vport->vhca_id); -+ mlx5_esw_adj_vport_modify(esw->dev, vport_num, -+ MLX5_ADJ_VPORT_DISCONNECT); -+ mlx5_esw_vport_free(esw, vport); -+ /* Reset the vport index back so new adj vports can use this index. -+ * When vport count can incrementally change, this needs to be modified. -+ */ -+ esw->last_vport_idx--; -+ mlx5_esw_destroy_esw_vport(esw->dev, vport_num); -+} -+ -+void mlx5_esw_adjacent_vhcas_cleanup(struct mlx5_eswitch *esw) -+{ -+ struct mlx5_vport *vport; -+ unsigned long i; -+ -+ if (!MLX5_CAP_GEN_2(esw->dev, delegated_vhca_max)) -+ return; -+ -+ mlx5_esw_for_each_vf_vport(esw, i, vport, U16_MAX) { -+ if (!vport->adjacent) -+ continue; -+ mlx5_esw_adj_vport_destroy(esw, vport); -+ } -+} -+ -+void mlx5_esw_adjacent_vhcas_setup(struct mlx5_eswitch *esw) -+{ -+ u32 delegated_vhca_max = MLX5_CAP_GEN_2(esw->dev, delegated_vhca_max); -+ u32 in[MLX5_ST_SZ_DW(query_delegated_vhca_in)] = {}; -+ int outlen, err, i = 0; -+ u8 *out; -+ u32 count; -+ -+ if (!delegated_vhca_max) -+ return; -+ -+ outlen = MLX5_ST_SZ_BYTES(query_delegated_vhca_out) + -+ delegated_vhca_max * -+ MLX5_ST_SZ_BYTES(delegated_function_vhca_rid_info); -+ -+ esw_debug(esw->dev, "delegated_vhca_max=%d\n", delegated_vhca_max); -+ -+ out = kvzalloc(outlen, GFP_KERNEL); -+ if (!out) -+ return; -+ -+ MLX5_SET(query_delegated_vhca_in, in, opcode, -+ MLX5_CMD_OPCODE_QUERY_DELEGATED_VHCA); -+ -+ err = mlx5_cmd_exec(esw->dev, in, sizeof(in), out, outlen); -+ if (err) { -+ kvfree(out); -+ esw_warn(esw->dev, "Failed to query delegated vhca, err %d\n", -+ err); -+ return; -+ } -+ -+ count = MLX5_GET(query_delegated_vhca_out, out, functions_count); -+ esw_debug(esw->dev, "Delegated vhca functions count %d\n", count); -+ -+ for (i = 0; i < count; i++) { -+ void *rid_info, *rid_info_reg; -+ u16 vhca_id; -+ -+ rid_info = MLX5_ADDR_OF(query_delegated_vhca_out, out, -+ delegated_function_vhca_rid_info[i]); -+ -+ rid_info_reg = MLX5_ADDR_OF(delegated_function_vhca_rid_info, -+ rid_info, function_vhca_rid_info); -+ -+ vhca_id = MLX5_GET(function_vhca_rid_info_reg, rid_info_reg, -+ vhca_id); -+ esw_debug(esw->dev, "Delegating vhca_id 0x%x rid info:\n", -+ vhca_id); -+ -+ err = mlx5_esw_adj_vport_create(esw, vhca_id); -+ if (err) { -+ esw_warn(esw->dev, -+ "Failed to init adjacent vhca 0x%x, err %d\n", -+ vhca_id, err); -+ break; -+ } -+ } -+ -+ kvfree(out); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 900650a1a66e..10eca910a2db 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1217,7 +1217,8 @@ void mlx5_eswitch_unload_vf_vports(struct mlx5_eswitch *esw, u16 num_vfs) - unsigned long i; - - mlx5_esw_for_each_vf_vport(esw, i, vport, num_vfs) { -- if (!vport->enabled) -+ /* Adjacent VFs are unloaded separately */ -+ if (!vport->enabled || vport->adjacent) - continue; - mlx5_eswitch_unload_pf_vf_vport(esw, vport->vport); - } -@@ -1236,6 +1237,42 @@ static void mlx5_eswitch_unload_ec_vf_vports(struct mlx5_eswitch *esw, - } - } - -+static void mlx5_eswitch_unload_adj_vf_vports(struct mlx5_eswitch *esw) -+{ -+ struct mlx5_vport *vport; -+ unsigned long i; -+ -+ mlx5_esw_for_each_vf_vport(esw, i, vport, U16_MAX) { -+ if (!vport->enabled || !vport->adjacent) -+ continue; -+ mlx5_eswitch_unload_pf_vf_vport(esw, vport->vport); -+ } -+} -+ -+static int -+mlx5_eswitch_load_adj_vf_vports(struct mlx5_eswitch *esw, -+ enum mlx5_eswitch_vport_event enabled_events) -+{ -+ struct mlx5_vport *vport; -+ unsigned long i; -+ int err; -+ -+ mlx5_esw_for_each_vf_vport(esw, i, vport, U16_MAX) { -+ if (!vport->adjacent) -+ continue; -+ err = mlx5_eswitch_load_pf_vf_vport(esw, vport->vport, -+ enabled_events); -+ if (err) -+ goto unload_adj_vf_vport; -+ } -+ -+ return 0; -+ -+unload_adj_vf_vport: -+ mlx5_eswitch_unload_adj_vf_vports(esw); -+ return err; -+} -+ - int mlx5_eswitch_load_vf_vports(struct mlx5_eswitch *esw, u16 num_vfs, - enum mlx5_eswitch_vport_event enabled_events) - { -@@ -1345,8 +1382,16 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, - enabled_events); - if (ret) - goto vf_err; -+ -+ /* Enable adjacent VF vports */ -+ ret = mlx5_eswitch_load_adj_vf_vports(esw, enabled_events); -+ if (ret) -+ goto unload_vf_vports; -+ - return 0; - -+unload_vf_vports: -+ mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs); - vf_err: - if (mlx5_core_ec_sriov_enabled(esw->dev)) - mlx5_eswitch_unload_ec_vf_vports(esw, esw->esw_funcs.num_ec_vfs); -@@ -1367,6 +1412,8 @@ mlx5_eswitch_enable_pf_vf_vports(struct mlx5_eswitch *esw, - */ - void mlx5_eswitch_disable_pf_vf_vports(struct mlx5_eswitch *esw) - { -+ mlx5_eswitch_unload_adj_vf_vports(esw); -+ - mlx5_eswitch_unload_vf_vports(esw, esw->esw_funcs.num_vfs); - - if (mlx5_core_ec_sriov_enabled(esw->dev)) -@@ -1791,8 +1838,7 @@ int mlx5_esw_sf_max_hpf_functions(struct mlx5_core_dev *dev, u16 *max_sfs, u16 * - return err; - } - --static int mlx5_esw_vport_alloc(struct mlx5_eswitch *esw, -- int index, u16 vport_num) -+int mlx5_esw_vport_alloc(struct mlx5_eswitch *esw, int index, u16 vport_num) - { - struct mlx5_vport *vport; - int err; -@@ -1819,8 +1865,9 @@ static int mlx5_esw_vport_alloc(struct mlx5_eswitch *esw, - return err; - } - --static void mlx5_esw_vport_free(struct mlx5_eswitch *esw, struct mlx5_vport *vport) -+void mlx5_esw_vport_free(struct mlx5_eswitch *esw, struct mlx5_vport *vport) - { -+ esw->total_vports--; - xa_erase(&esw->vports, vport->vport); - kfree(vport); - } -@@ -1904,6 +1951,9 @@ static int mlx5_esw_vports_init(struct mlx5_eswitch *esw) - err = mlx5_esw_vport_alloc(esw, idx, MLX5_VPORT_UPLINK); - if (err) - goto err; -+ -+ /* Adjacent vports or other dynamically create vports will use this */ -+ esw->last_vport_idx = ++idx; - return 0; - - err: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index cfd6b1b8c6f4..2c0e5ca73f3d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -216,6 +216,7 @@ struct mlx5_vport { - u32 metadata; - int vhca_id; - -+ bool adjacent; /* delegated vhca from adjacent function */ - struct mlx5_vport_info info; - - /* Protected with the E-Switch qos domain lock. The Vport QoS can -@@ -384,6 +385,7 @@ struct mlx5_eswitch { - - struct mlx5_esw_bridge_offloads *br_offloads; - struct mlx5_esw_offload offloads; -+ u32 last_vport_idx; - int mode; - u16 manager_vport; - u16 first_host_vport; -@@ -417,6 +419,8 @@ int mlx5_esw_qos_modify_vport_rate(struct mlx5_eswitch *esw, u16 vport_num, u32 - /* E-Switch API */ - int mlx5_eswitch_init(struct mlx5_core_dev *dev); - void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw); -+int mlx5_esw_vport_alloc(struct mlx5_eswitch *esw, int index, u16 vport_num); -+void mlx5_esw_vport_free(struct mlx5_eswitch *esw, struct mlx5_vport *vport); - - #define MLX5_ESWITCH_IGNORE_NUM_VFS (-1) - int mlx5_eswitch_enable_locked(struct mlx5_eswitch *esw, int num_vfs); -@@ -622,6 +626,9 @@ bool mlx5_esw_multipath_prereq(struct mlx5_core_dev *dev0, - - const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev); - -+void mlx5_esw_adjacent_vhcas_setup(struct mlx5_eswitch *esw); -+void mlx5_esw_adjacent_vhcas_cleanup(struct mlx5_eswitch *esw); -+ - #define MLX5_DEBUG_ESWITCH_MASK BIT(3) - - #define esw_info(__dev, format, ...) \ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index cdba7bc448ee..fb03981d5036 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3538,6 +3538,8 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - int err; - - mutex_init(&esw->offloads.termtbl_mutex); -+ mlx5_esw_adjacent_vhcas_setup(esw); -+ - err = mlx5_rdma_enable_roce(esw->dev); - if (err) - goto err_roce; -@@ -3602,6 +3604,7 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - err_metadata: - mlx5_rdma_disable_roce(esw->dev); - err_roce: -+ mlx5_esw_adjacent_vhcas_cleanup(esw); - mutex_destroy(&esw->offloads.termtbl_mutex); - return err; - } -@@ -3635,6 +3638,7 @@ void esw_offloads_disable(struct mlx5_eswitch *esw) - mapping_destroy(esw->offloads.reg_c0_obj_pool); - esw_offloads_metadata_uninit(esw); - mlx5_rdma_disable_roce(esw->dev); -+ mlx5_esw_adjacent_vhcas_cleanup(esw); - mutex_destroy(&esw->offloads.termtbl_mutex); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1520-net-mlx5-e-switch-create-acls-root-namespace-for-adjacent-vp.patch b/SOURCES/1520-net-mlx5-e-switch-create-acls-root-namespace-for-adjacent-vp.patch deleted file mode 100644 index bd9096930..000000000 --- a/SOURCES/1520-net-mlx5-e-switch-create-acls-root-namespace-for-adjacent-vp.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 3c7bde53049a9fd2ec77d02d1c80aa511db89454 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Create acls root namespace for adjacent - vports - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9984ec9f1f502dc5e19daf4210b221f554ca35db -Author: Saeed Mahameed -Date: Fri Aug 29 15:37:19 2025 -0700 - - net/mlx5: E-Switch, Create acls root namespace for adjacent vports - - Use the new vport acl root namespace add/remove API to create the - missing acl root name spaces per each new adjacent function vport. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-5-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -index 37a06c0949d5..1d104b3fe9e0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB - // Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. All rights reserved. - -+#include "fs_core.h" - #include "eswitch.h" - - enum { -@@ -82,6 +83,9 @@ static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id) - vport->adjacent = true; - vport->vhca_id = vhca_id; - -+ mlx5_fs_vport_egress_acl_ns_add(esw->dev->priv.steering, vport->index); -+ mlx5_fs_vport_ingress_acl_ns_add(esw->dev->priv.steering, vport->index); -+ - mlx5_esw_adj_vport_modify(esw->dev, vport_num, MLX5_ADJ_VPORT_CONNECT); - return 0; - -@@ -99,6 +103,10 @@ static void mlx5_esw_adj_vport_destroy(struct mlx5_eswitch *esw, - vport_num, vport->vhca_id); - mlx5_esw_adj_vport_modify(esw->dev, vport_num, - MLX5_ADJ_VPORT_DISCONNECT); -+ mlx5_fs_vport_egress_acl_ns_remove(esw->dev->priv.steering, -+ vport->index); -+ mlx5_fs_vport_ingress_acl_ns_remove(esw->dev->priv.steering, -+ vport->index); - mlx5_esw_vport_free(esw, vport); - /* Reset the vport index back so new adj vports can use this index. - * When vport count can incrementally change, this needs to be modified. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1521-net-mlx5-e-switch-register-representors-for-adjacent-vports.patch b/SOURCES/1521-net-mlx5-e-switch-register-representors-for-adjacent-vports.patch deleted file mode 100644 index adfb22d47..000000000 --- a/SOURCES/1521-net-mlx5-e-switch-register-representors-for-adjacent-vports.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 769550b37c1dfb703c621e938b789e4437093ffc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:56 -0400 -Subject: [PATCH] net/mlx5: E-Switch, Register representors for adjacent vports - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a0a7002b943997f5a4a9103ab92db388965f7aff -Author: Saeed Mahameed -Date: Fri Aug 29 15:37:20 2025 -0700 - - net/mlx5: E-Switch, Register representors for adjacent vports - - Register representors for adjacent vports dynamically when they are - discovered. Dynamically added representors state will now be set to - 'REGISTERED' when the representor type was already registered, - otherwise they won't be loaded. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-6-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -index 1d104b3fe9e0..3380f85678bc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -@@ -85,10 +85,19 @@ static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id) - - mlx5_fs_vport_egress_acl_ns_add(esw->dev->priv.steering, vport->index); - mlx5_fs_vport_ingress_acl_ns_add(esw->dev->priv.steering, vport->index); -+ err = mlx5_esw_offloads_rep_add(esw, vport); -+ if (err) -+ goto acl_ns_remove; - - mlx5_esw_adj_vport_modify(esw->dev, vport_num, MLX5_ADJ_VPORT_CONNECT); - return 0; - -+acl_ns_remove: -+ mlx5_fs_vport_ingress_acl_ns_remove(esw->dev->priv.steering, -+ vport->index); -+ mlx5_fs_vport_egress_acl_ns_remove(esw->dev->priv.steering, -+ vport->index); -+ mlx5_esw_vport_free(esw, vport); - destroy_esw_vport: - mlx5_esw_destroy_esw_vport(esw->dev, vport_num); - return err; -@@ -103,6 +112,7 @@ static void mlx5_esw_adj_vport_destroy(struct mlx5_eswitch *esw, - vport_num, vport->vhca_id); - mlx5_esw_adj_vport_modify(esw->dev, vport_num, - MLX5_ADJ_VPORT_DISCONNECT); -+ mlx5_esw_offloads_rep_remove(esw, vport); - mlx5_fs_vport_egress_acl_ns_remove(esw->dev->priv.steering, - vport->index); - mlx5_fs_vport_ingress_acl_ns_remove(esw->dev->priv.steering, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 2c0e5ca73f3d..6d36d8bbb979 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -838,6 +838,11 @@ void mlx5_esw_vport_vhca_id_unmap(struct mlx5_eswitch *esw, - int mlx5_eswitch_vhca_id_to_vport(struct mlx5_eswitch *esw, u16 vhca_id, u16 *vport_num); - bool mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id); - -+void mlx5_esw_offloads_rep_remove(struct mlx5_eswitch *esw, -+ const struct mlx5_vport *vport); -+int mlx5_esw_offloads_rep_add(struct mlx5_eswitch *esw, -+ const struct mlx5_vport *vport); -+ - /** - * struct mlx5_esw_event_info - Indicates eswitch mode changed/changing. - * -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index fb03981d5036..d57f86d297ab 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -2378,7 +2378,20 @@ static int esw_offloads_start(struct mlx5_eswitch *esw, - return 0; - } - --static int mlx5_esw_offloads_rep_init(struct mlx5_eswitch *esw, const struct mlx5_vport *vport) -+void mlx5_esw_offloads_rep_remove(struct mlx5_eswitch *esw, -+ const struct mlx5_vport *vport) -+{ -+ struct mlx5_eswitch_rep *rep = xa_load(&esw->offloads.vport_reps, -+ vport->vport); -+ -+ if (!rep) -+ return; -+ xa_erase(&esw->offloads.vport_reps, vport->vport); -+ kfree(rep); -+} -+ -+int mlx5_esw_offloads_rep_add(struct mlx5_eswitch *esw, -+ const struct mlx5_vport *vport) - { - struct mlx5_eswitch_rep *rep; - int rep_type; -@@ -2390,9 +2403,19 @@ static int mlx5_esw_offloads_rep_init(struct mlx5_eswitch *esw, const struct mlx - - rep->vport = vport->vport; - rep->vport_index = vport->index; -- for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++) -- atomic_set(&rep->rep_data[rep_type].state, REP_UNREGISTERED); -- -+ for (rep_type = 0; rep_type < NUM_REP_TYPES; rep_type++) { -+ if (!esw->offloads.rep_ops[rep_type]) { -+ atomic_set(&rep->rep_data[rep_type].state, -+ REP_UNREGISTERED); -+ continue; -+ } -+ /* Dynamic/delegated vports add their representors after -+ * mlx5_eswitch_register_vport_reps, so mark them as registered -+ * for them to be loaded later with the others. -+ */ -+ rep->esw = esw; -+ atomic_set(&rep->rep_data[rep_type].state, REP_REGISTERED); -+ } - err = xa_insert(&esw->offloads.vport_reps, rep->vport, rep, GFP_KERNEL); - if (err) - goto insert_err; -@@ -2430,7 +2453,7 @@ static int esw_offloads_init_reps(struct mlx5_eswitch *esw) - xa_init(&esw->offloads.vport_reps); - - mlx5_esw_for_each_vport(esw, i, vport) { -- err = mlx5_esw_offloads_rep_init(esw, vport); -+ err = mlx5_esw_offloads_rep_add(esw, vport); - if (err) - goto err; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1522-net-mlx5-e-switch-set-representor-attributes-for-adjacent-vf.patch b/SOURCES/1522-net-mlx5-e-switch-set-representor-attributes-for-adjacent-vf.patch deleted file mode 100644 index 31ec2bd03..000000000 --- a/SOURCES/1522-net-mlx5-e-switch-set-representor-attributes-for-adjacent-vf.patch +++ /dev/null @@ -1,138 +0,0 @@ -From cb384ea85892df1bafcb9e6d92919a27840649c6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: E-switch, Set representor attributes for adjacent - VFs - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5d8ae2c2cfe88a2c7458e18f30df4c655dfa983e -Author: Adithya Jayachandran -Date: Fri Aug 29 15:37:21 2025 -0700 - - net/mlx5: E-switch, Set representor attributes for adjacent VFs - - Adjacent vfs get their devlink port information from firmware, - use the information (pfnum, function id) from FW when populating the - devlink port attributes. - - Before: - $ devlink port show - pci/0000:00:03.0/180225: type eth netdev eth0 flavour pcivf controller 0 pfnum 0 vfnum 49152 external false splittable false - function: - hw_addr 00:00:00:00:00:00 - - After: - $ devlink port show - pci/0000:00:03.0/180225: type eth netdev enp0s3npf0vf2 flavour pcivf controller 0 pfnum 0 vfnum 2 external false splittable false - function: - hw_addr 00:00:00:00:00:00 - - Signed-off-by: Adithya Jayachandran - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-7-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -index 3380f85678bc..0091ba697bae 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -@@ -57,7 +57,8 @@ static int mlx5_esw_create_esw_vport(struct mlx5_core_dev *dev, u16 vhca_id, - return err; - } - --static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id) -+static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id, -+ const void *rid_info_reg) - { - struct mlx5_vport *vport; - u16 vport_num; -@@ -83,6 +84,12 @@ static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id) - vport->adjacent = true; - vport->vhca_id = vhca_id; - -+ vport->adj_info.parent_pci_devfn = -+ MLX5_GET(function_vhca_rid_info_reg, rid_info_reg, -+ parent_pci_device_function); -+ vport->adj_info.function_id = -+ MLX5_GET(function_vhca_rid_info_reg, rid_info_reg, function_id); -+ - mlx5_fs_vport_egress_acl_ns_add(esw->dev->priv.steering, vport->index); - mlx5_fs_vport_ingress_acl_ns_add(esw->dev->priv.steering, vport->index); - err = mlx5_esw_offloads_rep_add(esw, vport); -@@ -176,7 +183,7 @@ void mlx5_esw_adjacent_vhcas_setup(struct mlx5_eswitch *esw) - esw_debug(esw->dev, "Delegated vhca functions count %d\n", count); - - for (i = 0; i < count; i++) { -- void *rid_info, *rid_info_reg; -+ const void *rid_info, *rid_info_reg; - u16 vhca_id; - - rid_info = MLX5_ADDR_OF(query_delegated_vhca_out, out, -@@ -187,10 +194,9 @@ void mlx5_esw_adjacent_vhcas_setup(struct mlx5_eswitch *esw) - - vhca_id = MLX5_GET(function_vhca_rid_info_reg, rid_info_reg, - vhca_id); -- esw_debug(esw->dev, "Delegating vhca_id 0x%x rid info:\n", -- vhca_id); -+ esw_debug(esw->dev, "Delegating vhca_id 0x%x\n", vhca_id); - -- err = mlx5_esw_adj_vport_create(esw, vhca_id); -+ err = mlx5_esw_adj_vport_create(esw, vhca_id, rid_info_reg); - if (err) { - esw_warn(esw->dev, - "Failed to init adjacent vhca 0x%x, err %d\n", -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -index c33accadae0f..cf88a106d80d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -@@ -27,6 +27,7 @@ static void mlx5_esw_offloads_pf_vf_devlink_port_attrs_set(struct mlx5_eswitch * - { - struct mlx5_core_dev *dev = esw->dev; - struct netdev_phys_item_id ppid = {}; -+ struct mlx5_vport *vport; - u32 controller_num = 0; - bool external; - u16 pfnum; -@@ -42,10 +43,18 @@ static void mlx5_esw_offloads_pf_vf_devlink_port_attrs_set(struct mlx5_eswitch * - dl_port->attrs.switch_id.id_len = ppid.id_len; - devlink_port_attrs_pci_pf_set(dl_port, controller_num, pfnum, external); - } else if (mlx5_eswitch_is_vf_vport(esw, vport_num)) { -+ u16 func_id = vport_num - 1; -+ -+ vport = mlx5_eswitch_get_vport(esw, vport_num); - memcpy(dl_port->attrs.switch_id.id, ppid.id, ppid.id_len); - dl_port->attrs.switch_id.id_len = ppid.id_len; -+ if (vport->adjacent) { -+ func_id = vport->adj_info.function_id; -+ pfnum = vport->adj_info.parent_pci_devfn; -+ } -+ - devlink_port_attrs_pci_vf_set(dl_port, controller_num, pfnum, -- vport_num - 1, external); -+ func_id, external); - } else if (mlx5_core_is_ec_vf_vport(esw->dev, vport_num)) { - u16 base_vport = mlx5_core_ec_vf_vport_base(dev); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 6d36d8bbb979..4fe285ce32aa 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -217,6 +217,11 @@ struct mlx5_vport { - int vhca_id; - - bool adjacent; /* delegated vhca from adjacent function */ -+ struct { -+ u16 parent_pci_devfn; /* Adjacent parent PCI device function */ -+ u16 function_id; /* Function ID of the delegated VPort */ -+ } adj_info; -+ - struct mlx5_vport_info info; - - /* Protected with the E-Switch qos domain lock. The Vport QoS can --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1523-net-mlx5-dr-hws-use-the-cached-vhca-id-for-this-device.patch b/SOURCES/1523-net-mlx5-dr-hws-use-the-cached-vhca-id-for-this-device.patch deleted file mode 100644 index 07497d3c9..000000000 --- a/SOURCES/1523-net-mlx5-dr-hws-use-the-cached-vhca-id-for-this-device.patch +++ /dev/null @@ -1,133 +0,0 @@ -From 445001490208492dac2b44949d28ad9854942329 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: {DR,HWS}, Use the cached vhca_id for this device - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 0c2a02f3c066d4b50ebb66178843df83f33e4f1b -Author: Saeed Mahameed -Date: Fri Aug 29 15:37:22 2025 -0700 - - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device - - The mlx5 driver caches many capabilities to be used by mlx5 layers. - - In SW and HW steering we can use the cached vhca_id instead of invoking - FW commands. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250829223722.900629-8-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -index acb0317f930b..f22eaf506d28 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/cmd.c -@@ -1200,40 +1200,20 @@ int mlx5hws_cmd_query_caps(struct mlx5_core_dev *mdev, - int mlx5hws_cmd_query_gvmi(struct mlx5_core_dev *mdev, bool other_function, - u16 vport_number, u16 *gvmi) - { -- u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; -- int out_size; -- void *out; - int err; - -- if (other_function) { -- err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); -- if (!err) -- return 0; -- -- mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -- vport_number); -- return err; -+ if (!other_function) { -+ /* self vhca_id */ -+ *gvmi = MLX5_CAP_GEN(mdev, vhca_id); -+ return 0; - } - -- /* get vhca_id for `this` function */ -- out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); -- out = kzalloc(out_size, GFP_KERNEL); -- if (!out) -- return -ENOMEM; -- -- MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); -- MLX5_SET(query_hca_cap_in, in, op_mod, -- MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE << 1 | HCA_CAP_OPMOD_GET_CUR); -- -- err = mlx5_cmd_exec_inout(mdev, query_hca_cap, in, out); -+ err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); - if (err) { -- kfree(out); -+ mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -+ vport_number); - return err; - } - -- *gvmi = MLX5_GET(query_hca_cap_out, out, capability.cmd_hca_cap.vhca_id); -- -- kfree(out); -- - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -index bf99b933fd14..1ebb2b15c080 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_cmd.c -@@ -35,41 +35,21 @@ int mlx5dr_cmd_query_esw_vport_context(struct mlx5_core_dev *mdev, - int mlx5dr_cmd_query_gvmi(struct mlx5_core_dev *mdev, bool other_vport, - u16 vport_number, u16 *gvmi) - { -- u32 in[MLX5_ST_SZ_DW(query_hca_cap_in)] = {}; -- int out_size; -- void *out; - int err; - -- if (other_vport) { -- err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); -- if (!err) -- return 0; -- -- mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -- vport_number); -- return err; -+ if (!other_vport) { -+ /* self vhca_id */ -+ *gvmi = MLX5_CAP_GEN(mdev, vhca_id); -+ return 0; - } - -- /* get vhca_id for `this` function */ -- out_size = MLX5_ST_SZ_BYTES(query_hca_cap_out); -- out = kzalloc(out_size, GFP_KERNEL); -- if (!out) -- return -ENOMEM; -- -- MLX5_SET(query_hca_cap_in, in, opcode, MLX5_CMD_OP_QUERY_HCA_CAP); -- MLX5_SET(query_hca_cap_in, in, op_mod, -- MLX5_SET_HCA_CAP_OP_MOD_GENERAL_DEVICE << 1 | -- HCA_CAP_OPMOD_GET_CUR); -- -- err = mlx5_cmd_exec_inout(mdev, query_hca_cap, in, out); -+ err = mlx5_vport_get_vhca_id(mdev, vport_number, gvmi); - if (err) { -- kfree(out); -+ mlx5_core_err(mdev, "Failed to get vport vhca id for vport %d\n", -+ vport_number); - return err; - } - -- *gvmi = MLX5_GET(query_hca_cap_out, out, capability.cmd_hca_cap.vhca_id); -- -- kfree(out); - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1524-net-mlx5-add-psp-capabilities-structures-and-bits.patch b/SOURCES/1524-net-mlx5-add-psp-capabilities-structures-and-bits.patch deleted file mode 100644 index d7d3628e6..000000000 --- a/SOURCES/1524-net-mlx5-add-psp-capabilities-structures-and-bits.patch +++ /dev/null @@ -1,266 +0,0 @@ -From 4fade4931589e2d29e81f53e02b684a77ad6ac5f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Add PSP capabilities structures and bits - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 04a3134f88a4bd03001a3093144819523cfca99e -Author: Saeed Mahameed -Date: Tue Sep 2 22:45:24 2025 -0700 - - net/mlx5: Add PSP capabilities structures and bits - - Add mlx5_ifc PSP related capabilities structures and HW definitions - needed for PSP support in mlx5. - - Link: https://lore.kernel.org/netdev/20250828162953.2707727-1-daniel.zahka@gmail.com/ - Signed-off-by: Saeed Mahameed - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c -index 57476487e31f..eeb4437975f2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c -@@ -294,6 +294,12 @@ int mlx5_query_hca_caps(struct mlx5_core_dev *dev) - return err; - } - -+ if (MLX5_CAP_GEN(dev, psp)) { -+ err = mlx5_core_get_caps(dev, MLX5_CAP_PSP); -+ if (err) -+ return err; -+ } -+ - return 0; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index f6b04b2ae623..6175aa0bbbb7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1798,6 +1798,7 @@ static const int types[] = { - MLX5_CAP_VDPA_EMULATION, - MLX5_CAP_IPSEC, - MLX5_CAP_PORT_SELECTION, -+ MLX5_CAP_PSP, - MLX5_CAP_MACSEC, - MLX5_CAP_ADV_VIRTUALIZATION, - MLX5_CAP_CRYPTO, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index c6436c3a7a83..c4bb6967f74d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -1280,7 +1280,7 @@ hws_definer_conv_misc2(struct mlx5hws_definer_conv_data *cd, - struct mlx5hws_definer_fc *fc = cd->fc; - struct mlx5hws_definer_fc *curr_fc; - -- if (HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.reserved_at_1a0, 0x8) || -+ if (HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.psp_syndrome, 0x8) || - HWS_IS_FLD_SET_SZ(match_param, - misc_parameters_2.ipsec_next_header, 0x8) || - HWS_IS_FLD_SET_SZ(match_param, misc_parameters_2.reserved_at_1c0, 0x40) || -diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h -index 3b506482b4fa..04ceff52e19b 100644 ---- a/include/linux/mlx5/device.h -+++ b/include/linux/mlx5/device.h -@@ -1238,6 +1238,7 @@ enum mlx5_cap_type { - MLX5_CAP_IPSEC, - MLX5_CAP_CRYPTO = 0x1a, - MLX5_CAP_SHAMPO = 0x1d, -+ MLX5_CAP_PSP = 0x1e, - MLX5_CAP_MACSEC = 0x1f, - MLX5_CAP_GENERAL_2 = 0x20, - MLX5_CAP_PORT_SELECTION = 0x25, -@@ -1477,6 +1478,9 @@ enum mlx5_qcam_feature_groups { - #define MLX5_CAP_SHAMPO(mdev, cap) \ - MLX5_GET(shampo_cap, mdev->caps.hca[MLX5_CAP_SHAMPO]->cur, cap) - -+#define MLX5_CAP_PSP(mdev, cap)\ -+ MLX5_GET(psp_cap, (mdev)->caps.hca[MLX5_CAP_PSP]->cur, cap) -+ - enum { - MLX5_CMD_STAT_OK = 0x0, - MLX5_CMD_STAT_INT_ERR = 0x1, -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 4362dcb3b8fa..5934c24d8dcb 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -314,6 +314,8 @@ enum { - MLX5_CMD_OP_CREATE_UMEM = 0xa08, - MLX5_CMD_OP_DESTROY_UMEM = 0xa0a, - MLX5_CMD_OP_SYNC_STEERING = 0xb00, -+ MLX5_CMD_OP_PSP_GEN_SPI = 0xb10, -+ MLX5_CMD_OP_PSP_ROTATE_KEY = 0xb11, - MLX5_CMD_OP_QUERY_VHCA_STATE = 0xb0d, - MLX5_CMD_OP_MODIFY_VHCA_STATE = 0xb0e, - MLX5_CMD_OP_SYNC_CRYPTO = 0xb12, -@@ -489,12 +491,14 @@ struct mlx5_ifc_flow_table_prop_layout_bits { - u8 execute_aso[0x1]; - u8 reserved_at_47[0x19]; - -- u8 reserved_at_60[0x2]; -+ u8 reformat_l2_to_l3_psp_tunnel[0x1]; -+ u8 reformat_l3_psp_tunnel_to_l2[0x1]; - u8 reformat_insert[0x1]; - u8 reformat_remove[0x1]; - u8 macsec_encrypt[0x1]; - u8 macsec_decrypt[0x1]; -- u8 reserved_at_66[0x2]; -+ u8 psp_encrypt[0x1]; -+ u8 psp_decrypt[0x1]; - u8 reformat_add_macsec[0x1]; - u8 reformat_remove_macsec[0x1]; - u8 reparse[0x1]; -@@ -703,7 +707,7 @@ struct mlx5_ifc_fte_match_set_misc2_bits { - - u8 metadata_reg_a[0x20]; - -- u8 reserved_at_1a0[0x8]; -+ u8 psp_syndrome[0x8]; - u8 macsec_syndrome[0x8]; - u8 ipsec_syndrome[0x8]; - u8 ipsec_next_header[0x8]; -@@ -1510,6 +1514,21 @@ struct mlx5_ifc_macsec_cap_bits { - u8 reserved_at_40[0x7c0]; - }; - -+struct mlx5_ifc_psp_cap_bits { -+ u8 reserved_at_0[0x1]; -+ u8 psp_crypto_offload[0x1]; -+ u8 reserved_at_2[0x1]; -+ u8 psp_crypto_esp_aes_gcm_256_encrypt[0x1]; -+ u8 psp_crypto_esp_aes_gcm_128_encrypt[0x1]; -+ u8 psp_crypto_esp_aes_gcm_256_decrypt[0x1]; -+ u8 psp_crypto_esp_aes_gcm_128_decrypt[0x1]; -+ u8 reserved_at_7[0x4]; -+ u8 log_max_num_of_psp_spi[0x5]; -+ u8 reserved_at_10[0x10]; -+ -+ u8 reserved_at_20[0x7e0]; -+}; -+ - enum { - MLX5_WQ_TYPE_LINKED_LIST = 0x0, - MLX5_WQ_TYPE_CYCLIC = 0x1, -@@ -1875,7 +1894,9 @@ struct mlx5_ifc_cmd_hca_cap_bits { - - u8 reserved_at_2a0[0x7]; - u8 mkey_pcie_tph[0x1]; -- u8 reserved_at_2a8[0x3]; -+ u8 reserved_at_2a8[0x2]; -+ -+ u8 psp[0x1]; - u8 shampo[0x1]; - u8 reserved_at_2ac[0x4]; - u8 max_wqe_sz_rq[0x10]; -@@ -3802,6 +3823,7 @@ union mlx5_ifc_hca_cap_union_bits { - struct mlx5_ifc_macsec_cap_bits macsec_cap; - struct mlx5_ifc_crypto_cap_bits crypto_cap; - struct mlx5_ifc_ipsec_cap_bits ipsec_cap; -+ struct mlx5_ifc_psp_cap_bits psp_cap; - u8 reserved_at_0[0x8000]; - }; - -@@ -3831,6 +3853,7 @@ enum { - enum { - MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_IPSEC = 0x0, - MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_MACSEC = 0x1, -+ MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_PSP = 0x2, - }; - - struct mlx5_ifc_vlan_bits { -@@ -7158,6 +7181,8 @@ enum mlx5_reformat_ctx_type { - MLX5_REFORMAT_TYPE_DEL_ESP_TRANSPORT_OVER_UDP = 0xa, - MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_IPV6 = 0xb, - MLX5_REFORMAT_TYPE_ADD_ESP_TRANSPORT_OVER_UDPV6 = 0xc, -+ MLX5_REFORMAT_TYPE_ADD_PSP_TUNNEL = 0xd, -+ MLX5_REFORMAT_TYPE_DEL_PSP_TUNNEL = 0xe, - MLX5_REFORMAT_TYPE_INSERT_HDR = 0xf, - MLX5_REFORMAT_TYPE_REMOVE_HDR = 0x10, - MLX5_REFORMAT_TYPE_ADD_MACSEC = 0x11, -@@ -7284,6 +7309,7 @@ enum { - MLX5_ACTION_IN_FIELD_IPSEC_SYNDROME = 0x5D, - MLX5_ACTION_IN_FIELD_OUT_EMD_47_32 = 0x6F, - MLX5_ACTION_IN_FIELD_OUT_EMD_31_0 = 0x70, -+ MLX5_ACTION_IN_FIELD_PSP_SYNDROME = 0x71, - }; - - struct mlx5_ifc_alloc_modify_header_context_out_bits { -@@ -13078,6 +13104,7 @@ enum { - MLX5_GENERAL_OBJECT_TYPE_ENCRYPTION_KEY_PURPOSE_TLS = 0x1, - MLX5_GENERAL_OBJECT_TYPE_ENCRYPTION_KEY_PURPOSE_IPSEC = 0x2, - MLX5_GENERAL_OBJECT_TYPE_ENCRYPTION_KEY_PURPOSE_MACSEC = 0x4, -+ MLX5_GENERAL_OBJECT_TYPE_ENCRYPTION_KEY_PURPOSE_PSP = 0x6, - }; - - struct mlx5_ifc_tls_static_params_bits { -@@ -13495,4 +13522,64 @@ enum mlx5e_pcie_cong_event_mod_field { - MLX5_PCIE_CONG_EVENT_MOD_THRESH = BIT(2), - }; - -+struct mlx5_ifc_psp_rotate_key_in_bits { -+ u8 opcode[0x10]; -+ u8 uid[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x40]; -+}; -+ -+struct mlx5_ifc_psp_rotate_key_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x40]; -+}; -+ -+enum mlx5_psp_gen_spi_in_key_size { -+ MLX5_PSP_GEN_SPI_IN_KEY_SIZE_128 = 0x0, -+ MLX5_PSP_GEN_SPI_IN_KEY_SIZE_256 = 0x1, -+}; -+ -+struct mlx5_ifc_key_spi_bits { -+ u8 spi[0x20]; -+ -+ u8 reserved_at_20[0x60]; -+ -+ u8 key[8][0x20]; -+}; -+ -+struct mlx5_ifc_psp_gen_spi_in_bits { -+ u8 opcode[0x10]; -+ u8 uid[0x10]; -+ -+ u8 reserved_at_20[0x10]; -+ u8 op_mod[0x10]; -+ -+ u8 reserved_at_40[0x20]; -+ -+ u8 key_size[0x2]; -+ u8 reserved_at_62[0xe]; -+ u8 num_of_spi[0x10]; -+}; -+ -+struct mlx5_ifc_psp_gen_spi_out_bits { -+ u8 status[0x8]; -+ u8 reserved_at_8[0x18]; -+ -+ u8 syndrome[0x20]; -+ -+ u8 reserved_at_40[0x10]; -+ u8 num_of_spi[0x10]; -+ -+ u8 reserved_at_60[0x20]; -+ -+ struct mlx5_ifc_key_spi_bits key_spi[]; -+}; -+ - #endif /* MLX5_IFC_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1525-net-mlx5-extract-mtctr-register-read-logic-into-helper-funct.patch b/SOURCES/1525-net-mlx5-extract-mtctr-register-read-logic-into-helper-funct.patch deleted file mode 100644 index 1842d738e..000000000 --- a/SOURCES/1525-net-mlx5-extract-mtctr-register-read-logic-into-helper-funct.patch +++ /dev/null @@ -1,96 +0,0 @@ -From e06059ef23979150acdcb02c9d2f8d8d864317fa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Extract MTCTR register read logic into helper - function - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 96c345c3c54c31abf8ba04c241b8fe26fa0ab022 -Author: Carolina Jubran -Date: Tue Aug 12 17:17:07 2025 +0300 - - net/mlx5: Extract MTCTR register read logic into helper function - - Refactor the MTCTR register reading logic into a dedicated helper to - lay the groundwork for the next patch. - - Signed-off-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1755008228-88881-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 214d732d18e9..9b49bdc339ad 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -247,27 +247,24 @@ static bool mlx5_is_ptm_source_time_available(struct mlx5_core_dev *dev) - return !!MLX5_GET(mtptm_reg, out, psta); - } - --static int mlx5_mtctr_syncdevicetime(ktime_t *device_time, -- struct system_counterval_t *sys_counterval, -- void *ctx) -+static int mlx5_mtctr_read(struct mlx5_core_dev *mdev, -+ bool real_time_mode, -+ struct system_counterval_t *sys_counterval, -+ u64 *device) - { - u32 out[MLX5_ST_SZ_DW(mtctr_reg)] = {0}; - u32 in[MLX5_ST_SZ_DW(mtctr_reg)] = {0}; -- struct mlx5_core_dev *mdev = ctx; -- bool real_time_mode; -- u64 host, device; -+ u64 host; - int err; - -- real_time_mode = mlx5_real_time_mode(mdev); -- - MLX5_SET(mtctr_reg, in, first_clock_timestamp_request, - MLX5_MTCTR_REQUEST_PTM_ROOT_CLOCK); - MLX5_SET(mtctr_reg, in, second_clock_timestamp_request, - real_time_mode ? MLX5_MTCTR_REQUEST_REAL_TIME_CLOCK : -- MLX5_MTCTR_REQUEST_FREE_RUNNING_COUNTER); -+ MLX5_MTCTR_REQUEST_FREE_RUNNING_COUNTER); - -- err = mlx5_core_access_reg(mdev, in, sizeof(in), out, sizeof(out), MLX5_REG_MTCTR, -- 0, 0); -+ err = mlx5_core_access_reg(mdev, in, sizeof(in), out, sizeof(out), -+ MLX5_REG_MTCTR, 0, 0); - if (err) - return err; - -@@ -281,8 +278,26 @@ static int mlx5_mtctr_syncdevicetime(ktime_t *device_time, - .cs_id = CSID_X86_ART, - .use_nsecs = true, - }; -+ *device = MLX5_GET64(mtctr_reg, out, second_clock_timestamp); -+ -+ return 0; -+} -+ -+static int mlx5_mtctr_syncdevicetime(ktime_t *device_time, -+ struct system_counterval_t *sys_counterval, -+ void *ctx) -+{ -+ struct mlx5_core_dev *mdev = ctx; -+ bool real_time_mode; -+ u64 device; -+ int err; -+ -+ real_time_mode = mlx5_real_time_mode(mdev); -+ -+ err = mlx5_mtctr_read(mdev, real_time_mode, sys_counterval, &device); -+ if (err) -+ return err; - -- device = MLX5_GET64(mtctr_reg, out, second_clock_timestamp); - if (real_time_mode) - *device_time = ns_to_ktime(REAL_TIME_TO_NS(device >> 32, device & U32_MAX)); - else --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1526-net-mlx5-support-getcyclesx-and-getcrosscycles.patch b/SOURCES/1526-net-mlx5-support-getcyclesx-and-getcrosscycles.patch deleted file mode 100644 index a7f2fb69f..000000000 --- a/SOURCES/1526-net-mlx5-support-getcyclesx-and-getcrosscycles.patch +++ /dev/null @@ -1,148 +0,0 @@ -From f3f5c68e707d79c44f1ad12f7449fa6a93c3eb6e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Support getcyclesx and getcrosscycles -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a3fb485505caeadb559029900f5f37a332ae54e0 -Author: Carolina Jubran -Date: Tue Aug 12 17:17:08 2025 +0300 - - net/mlx5: Support getcyclesx and getcrosscycles - - Implement the getcyclesx64 and getcrosscycles callbacks in ptp_info to - expose the device’s raw free-running counter. - - Signed-off-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1755008228-88881-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 9b49bdc339ad..7ad3baca99de 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -306,6 +306,23 @@ static int mlx5_mtctr_syncdevicetime(ktime_t *device_time, - return 0; - } - -+static int -+mlx5_mtctr_syncdevicecyclestime(ktime_t *device_time, -+ struct system_counterval_t *sys_counterval, -+ void *ctx) -+{ -+ struct mlx5_core_dev *mdev = ctx; -+ u64 device; -+ int err; -+ -+ err = mlx5_mtctr_read(mdev, false, sys_counterval, &device); -+ if (err) -+ return err; -+ *device_time = ns_to_ktime(device); -+ -+ return 0; -+} -+ - static int mlx5_ptp_getcrosststamp(struct ptp_clock_info *ptp, - struct system_device_crosststamp *cts) - { -@@ -330,6 +347,32 @@ static int mlx5_ptp_getcrosststamp(struct ptp_clock_info *ptp, - mlx5_clock_unlock(clock); - return err; - } -+ -+static int mlx5_ptp_getcrosscycles(struct ptp_clock_info *ptp, -+ struct system_device_crosststamp *cts) -+{ -+ struct mlx5_clock *clock = -+ container_of(ptp, struct mlx5_clock, ptp_info); -+ struct system_time_snapshot history_begin = {0}; -+ struct mlx5_core_dev *mdev; -+ int err; -+ -+ mlx5_clock_lock(clock); -+ mdev = mlx5_clock_mdev_get(clock); -+ -+ if (!mlx5_is_ptm_source_time_available(mdev)) { -+ err = -EBUSY; -+ goto unlock; -+ } -+ -+ ktime_get_snapshot(&history_begin); -+ -+ err = get_device_system_crosststamp(mlx5_mtctr_syncdevicecyclestime, -+ mdev, &history_begin, cts); -+unlock: -+ mlx5_clock_unlock(clock); -+ return err; -+} - #endif /* CONFIG_X86 */ - - static u64 mlx5_read_time(struct mlx5_core_dev *dev, -@@ -528,6 +571,24 @@ static int mlx5_ptp_gettimex(struct ptp_clock_info *ptp, struct timespec64 *ts, - return 0; - } - -+static int mlx5_ptp_getcyclesx(struct ptp_clock_info *ptp, -+ struct timespec64 *ts, -+ struct ptp_system_timestamp *sts) -+{ -+ struct mlx5_clock *clock = container_of(ptp, struct mlx5_clock, -+ ptp_info); -+ struct mlx5_core_dev *mdev; -+ u64 cycles; -+ -+ mlx5_clock_lock(clock); -+ mdev = mlx5_clock_mdev_get(clock); -+ -+ cycles = mlx5_read_time(mdev, sts, false); -+ *ts = ns_to_timespec64(cycles); -+ mlx5_clock_unlock(clock); -+ return 0; -+} -+ - static int mlx5_ptp_adjtime_real_time(struct mlx5_core_dev *mdev, s64 delta) - { - u32 in[MLX5_ST_SZ_DW(mtutc_reg)] = {}; -@@ -1244,6 +1305,7 @@ static void mlx5_init_timer_max_freq_adjustment(struct mlx5_core_dev *mdev) - static void mlx5_init_timer_clock(struct mlx5_core_dev *mdev) - { - struct mlx5_clock *clock = mdev->clock; -+ bool expose_cycles; - - /* Configure the PHC */ - clock->ptp_info = mlx5_ptp_clock_info; -@@ -1251,12 +1313,22 @@ static void mlx5_init_timer_clock(struct mlx5_core_dev *mdev) - if (MLX5_CAP_MCAM_REG(mdev, mtutc)) - mlx5_init_timer_max_freq_adjustment(mdev); - -+ expose_cycles = !MLX5_CAP_GEN(mdev, disciplined_fr_counter) || -+ !mlx5_real_time_mode(mdev); -+ - #ifdef CONFIG_X86 - if (MLX5_CAP_MCAM_REG3(mdev, mtptm) && -- MLX5_CAP_MCAM_REG3(mdev, mtctr) && boot_cpu_has(X86_FEATURE_ART)) -+ MLX5_CAP_MCAM_REG3(mdev, mtctr) && boot_cpu_has(X86_FEATURE_ART)) { - clock->ptp_info.getcrosststamp = mlx5_ptp_getcrosststamp; -+ if (expose_cycles) -+ clock->ptp_info.getcrosscycles = -+ mlx5_ptp_getcrosscycles; -+ } - #endif /* CONFIG_X86 */ - -+ if (expose_cycles) -+ clock->ptp_info.getcyclesx64 = mlx5_ptp_getcyclesx; -+ - mlx5_timecounter_init(mdev); - mlx5_init_clock_info(mdev); - mlx5_init_overflow_period(mdev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1527-net-mlx5-add-rs-fec-histogram-infrastructure.patch b/SOURCES/1527-net-mlx5-add-rs-fec-histogram-infrastructure.patch deleted file mode 100644 index fd9c20042..000000000 --- a/SOURCES/1527-net-mlx5-add-rs-fec-histogram-infrastructure.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 90c470d8b4225f84cf2065766d96aa95d8ff3af6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Add RS FEC histogram infrastructure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ff97bc38be343e4530e2f140b40cbdce2e09152f -Author: Carolina Jubran -Date: Wed Sep 3 10:30:00 2025 +0300 - - net/mlx5: Add RS FEC histogram infrastructure - - Define the Ports Phy Histogram Configuration Register (PPHCR) to expose - RS-FEC histogram bin ranges, and expose a new counter group in the Ports - Performance Counters Register (PPCNT) to report the corresponding - histogram values. - - Co-developed-by: Yael Chemla - Signed-off-by: Yael Chemla - Signed-off-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1756884600-520195-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/device.h b/include/linux/mlx5/device.h -index 04ceff52e19b..6644864b1972 100644 ---- a/include/linux/mlx5/device.h -+++ b/include/linux/mlx5/device.h -@@ -1515,6 +1515,7 @@ enum { - MLX5_PHYSICAL_LAYER_RECOVERY_GROUP = 0x1a, - MLX5_INFINIBAND_PORT_COUNTERS_GROUP = 0x20, - MLX5_INFINIBAND_EXTENDED_PORT_COUNTERS_GROUP = 0x21, -+ MLX5_RS_FEC_HISTOGRAM_GROUP = 0x23, - }; - - enum { -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 10fe492e1fed..89d020a4f572 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -130,6 +130,7 @@ enum { - MLX5_REG_PDDR = 0x5031, - MLX5_REG_PMLP = 0x5002, - MLX5_REG_PPLM = 0x5023, -+ MLX5_REG_PPHCR = 0x503E, - MLX5_REG_PCAM = 0x507f, - MLX5_REG_NODE_DESC = 0x6001, - MLX5_REG_HOST_ENDIANNESS = 0x7004, -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 5934c24d8dcb..961e9c76c6c5 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -4900,6 +4900,11 @@ union mlx5_ifc_field_select_802_1_r_roce_auto_bits { - u8 reserved_at_0[0x20]; - }; - -+struct mlx5_ifc_rs_histogram_cntrs_bits { -+ u8 hist[16][0x40]; -+ u8 reserved_at_400[0x2c0]; -+}; -+ - union mlx5_ifc_eth_cntrs_grp_data_layout_auto_bits { - struct mlx5_ifc_eth_802_3_cntrs_grp_data_layout_bits eth_802_3_cntrs_grp_data_layout; - struct mlx5_ifc_eth_2863_cntrs_grp_data_layout_bits eth_2863_cntrs_grp_data_layout; -@@ -4914,6 +4919,7 @@ union mlx5_ifc_eth_cntrs_grp_data_layout_auto_bits { - struct mlx5_ifc_phys_layer_cntrs_bits phys_layer_cntrs; - struct mlx5_ifc_phys_layer_statistical_cntrs_bits phys_layer_statistical_cntrs; - struct mlx5_ifc_phys_layer_recovery_cntrs_bits phys_layer_recovery_cntrs; -+ struct mlx5_ifc_rs_histogram_cntrs_bits rs_histogram_cntrs; - u8 reserved_at_0[0x7c0]; - }; - -@@ -11737,6 +11743,28 @@ struct mlx5_ifc_mtctr_reg_bits { - u8 second_clock_timestamp[0x40]; - }; - -+struct mlx5_ifc_bin_range_layout_bits { -+ u8 reserved_at_0[0xa]; -+ u8 high_val[0x6]; -+ u8 reserved_at_10[0xa]; -+ u8 low_val[0x6]; -+}; -+ -+struct mlx5_ifc_pphcr_reg_bits { -+ u8 active_hist_type[0x4]; -+ u8 reserved_at_4[0x4]; -+ u8 local_port[0x8]; -+ u8 reserved_at_10[0x10]; -+ -+ u8 reserved_at_20[0x8]; -+ u8 num_of_bins[0x8]; -+ u8 reserved_at_30[0x10]; -+ -+ u8 reserved_at_40[0x40]; -+ -+ struct mlx5_ifc_bin_range_layout_bits bin_range[16]; -+}; -+ - union mlx5_ifc_ports_control_registers_document_bits { - struct mlx5_ifc_bufferx_reg_bits bufferx_reg; - struct mlx5_ifc_eth_2819_cntrs_grp_data_layout_bits eth_2819_cntrs_grp_data_layout; -@@ -11803,6 +11831,7 @@ union mlx5_ifc_ports_control_registers_document_bits { - struct mlx5_ifc_mtmp_reg_bits mtmp_reg; - struct mlx5_ifc_mtptm_reg_bits mtptm_reg; - struct mlx5_ifc_mtctr_reg_bits mtctr_reg; -+ struct mlx5_ifc_pphcr_reg_bits pphcr_reg; - u8 reserved_at_0[0x60e0]; - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1528-net-mlx5-implement-cqe-compress-type-via-devlink-params.patch b/SOURCES/1528-net-mlx5-implement-cqe-compress-type-via-devlink-params.patch deleted file mode 100644 index 559cf099e..000000000 --- a/SOURCES/1528-net-mlx5-implement-cqe-compress-type-via-devlink-params.patch +++ /dev/null @@ -1,399 +0,0 @@ -From 40ba4249f330045380f077e35929e6bb548f4c1e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Implement cqe_compress_type via devlink params - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bf2da4799fdb6eb58d9c9541b7dc1096c260499d -Author: Saeed Mahameed -Date: Sat Sep 6 18:29:44 2025 -0700 - - net/mlx5: Implement cqe_compress_type via devlink params - - Selects which algorithm should be used by the NIC in order to decide rate of - CQE compression dependeng on PCIe bus conditions. - - Supported values: - - 1) balanced, merges fewer CQEs, resulting in a moderate compression ratio - but maintaining a balance between bandwidth savings and performance - 2) aggressive, merges more CQEs into a single entry, achieving a higher - compression rate and maximizing performance, particularly under high - traffic loads. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Jiri Pirko - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250907012953.301746-3-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index 7febe0aecd53..2edc842b620d 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -117,6 +117,16 @@ parameters. - - driverinit - - Control the size (in packets) of the hairpin queues. - -+ * - ``cqe_compress_type`` -+ - string -+ - permanent -+ - Configure which mechanism/algorithm should be used by the NIC that will -+ affect the rate (aggressiveness) of compressed CQEs depending on PCIe bus -+ conditions and other internal NIC factors. This mode affects all queues -+ that enable compression. -+ * ``balanced`` : Merges fewer CQEs, resulting in a moderate compression ratio but maintaining a balance between bandwidth savings and performance -+ * ``aggressive`` : Merges more CQEs into a single entry, achieving a higher compression rate and maximizing performance, particularly under high traffic loads -+ - The ``mlx5`` driver supports reloading via ``DEVLINK_CMD_RELOAD`` - - Info versions -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Makefile b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -index a65ab661375a..d77696f46eb5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/Makefile -+++ b/drivers/net/ethernet/mellanox/mlx5/core/Makefile -@@ -17,7 +17,7 @@ mlx5_core-y := main.o cmd.o debugfs.o fw.o eq.o uar.o pagealloc.o \ - fs_counters.o fs_ft_pool.o rl.o lag/debugfs.o lag/lag.o dev.o events.o wq.o lib/gid.o \ - lib/devcom.o lib/pci_vsc.o lib/dm.o lib/fs_ttc.o diag/fs_tracepoint.o \ - diag/fw_tracer.o diag/crdump.o devlink.o diag/rsc_dump.o diag/reporter_vnic.o \ -- fw_reset.o qos.o lib/tout.o lib/aso.o wc.o fs_pool.o -+ fw_reset.o qos.o lib/tout.o lib/aso.o wc.o fs_pool.o lib/nv_param.o - - # - # Netdev basic -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 8c53fe5aa306..0c0f7231cb2a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -10,6 +10,7 @@ - #include "esw/qos.h" - #include "sf/dev/dev.h" - #include "sf/sf.h" -+#include "lib/nv_param.h" - - static int mlx5_devlink_flash_update(struct devlink *devlink, - struct devlink_flash_update_params *params, -@@ -895,8 +896,14 @@ int mlx5_devlink_params_register(struct devlink *devlink) - if (err) - goto max_uc_list_err; - -+ err = mlx5_nv_param_register_dl_params(devlink); -+ if (err) -+ goto nv_param_err; -+ - return 0; - -+nv_param_err: -+ mlx5_devlink_max_uc_list_params_unregister(devlink); - max_uc_list_err: - mlx5_devlink_auxdev_params_unregister(devlink); - auxdev_reg_err: -@@ -907,6 +914,7 @@ int mlx5_devlink_params_register(struct devlink *devlink) - - void mlx5_devlink_params_unregister(struct devlink *devlink) - { -+ mlx5_nv_param_unregister_dl_params(devlink); - mlx5_devlink_max_uc_list_params_unregister(devlink); - mlx5_devlink_auxdev_params_unregister(devlink); - devl_params_unregister(devlink, mlx5_devlink_params, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.h b/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -index 961f75da6227..74bcdfa70361 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -@@ -22,6 +22,7 @@ enum mlx5_devlink_param_id { - MLX5_DEVLINK_PARAM_ID_ESW_MULTIPORT, - MLX5_DEVLINK_PARAM_ID_HAIRPIN_NUM_QUEUES, - MLX5_DEVLINK_PARAM_ID_HAIRPIN_QUEUE_SIZE, -+ MLX5_DEVLINK_PARAM_ID_CQE_COMPRESSION_TYPE - }; - - struct mlx5_trap_ctx { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -new file mode 100644 -index 000000000000..20a39483be04 ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -@@ -0,0 +1,245 @@ -+// SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB -+/* Copyright (c) 2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ -+ -+#include "nv_param.h" -+#include "mlx5_core.h" -+ -+enum { -+ MLX5_CLASS_0_CTRL_ID_NV_SW_OFFLOAD_CONFIG = 0x10a, -+}; -+ -+struct mlx5_ifc_configuration_item_type_class_global_bits { -+ u8 type_class[0x8]; -+ u8 parameter_index[0x18]; -+}; -+ -+union mlx5_ifc_config_item_type_auto_bits { -+ struct mlx5_ifc_configuration_item_type_class_global_bits -+ configuration_item_type_class_global; -+ u8 reserved_at_0[0x20]; -+}; -+ -+struct mlx5_ifc_config_item_bits { -+ u8 valid[0x2]; -+ u8 priority[0x2]; -+ u8 header_type[0x2]; -+ u8 ovr_en[0x1]; -+ u8 rd_en[0x1]; -+ u8 access_mode[0x2]; -+ u8 reserved_at_a[0x1]; -+ u8 writer_id[0x5]; -+ u8 version[0x4]; -+ u8 reserved_at_14[0x2]; -+ u8 host_id_valid[0x1]; -+ u8 length[0x9]; -+ -+ union mlx5_ifc_config_item_type_auto_bits type; -+ -+ u8 reserved_at_40[0x10]; -+ u8 crc16[0x10]; -+}; -+ -+struct mlx5_ifc_mnvda_reg_bits { -+ struct mlx5_ifc_config_item_bits configuration_item_header; -+ -+ u8 configuration_item_data[64][0x20]; -+}; -+ -+struct mlx5_ifc_nv_sw_offload_conf_bits { -+ u8 ip_over_vxlan_port[0x10]; -+ u8 tunnel_ecn_copy_offload_disable[0x1]; -+ u8 pci_atomic_mode[0x3]; -+ u8 sr_enable[0x1]; -+ u8 ptp_cyc2realtime[0x1]; -+ u8 vector_calc_disable[0x1]; -+ u8 uctx_en[0x1]; -+ u8 prio_tag_required_en[0x1]; -+ u8 esw_fdb_ipv4_ttl_modify_enable[0x1]; -+ u8 mkey_by_name[0x1]; -+ u8 ip_over_vxlan_en[0x1]; -+ u8 one_qp_per_recovery[0x1]; -+ u8 cqe_compression[0x3]; -+ u8 tunnel_udp_entropy_proto_disable[0x1]; -+ u8 reserved_at_21[0x1]; -+ u8 ar_enable[0x1]; -+ u8 log_max_outstanding_wqe[0x5]; -+ u8 vf_migration[0x2]; -+ u8 log_tx_psn_win[0x6]; -+ u8 lro_log_timeout3[0x4]; -+ u8 lro_log_timeout2[0x4]; -+ u8 lro_log_timeout1[0x4]; -+ u8 lro_log_timeout0[0x4]; -+}; -+ -+#define MNVDA_HDR_SZ \ -+ (MLX5_ST_SZ_BYTES(mnvda_reg) - \ -+ MLX5_BYTE_OFF(mnvda_reg, configuration_item_data)) -+ -+#define MLX5_SET_CFG_ITEM_TYPE(_cls_name, _mnvda_ptr, _field, _val) \ -+ MLX5_SET(mnvda_reg, _mnvda_ptr, \ -+ configuration_item_header.type.configuration_item_type_class_##_cls_name._field, \ -+ _val) -+ -+#define MLX5_SET_CFG_HDR_LEN(_mnvda_ptr, _cls_name) \ -+ MLX5_SET(mnvda_reg, _mnvda_ptr, configuration_item_header.length, \ -+ MLX5_ST_SZ_BYTES(_cls_name)) -+ -+#define MLX5_GET_CFG_HDR_LEN(_mnvda_ptr) \ -+ MLX5_GET(mnvda_reg, _mnvda_ptr, configuration_item_header.length) -+ -+static int mlx5_nv_param_read(struct mlx5_core_dev *dev, void *mnvda, -+ size_t len) -+{ -+ u32 param_idx, type_class; -+ u32 header_len; -+ void *cls_ptr; -+ int err; -+ -+ if (WARN_ON(len > MLX5_ST_SZ_BYTES(mnvda_reg)) || len < MNVDA_HDR_SZ) -+ return -EINVAL; /* A caller bug */ -+ -+ err = mlx5_core_access_reg(dev, mnvda, len, mnvda, len, MLX5_REG_MNVDA, -+ 0, 0); -+ if (!err) -+ return 0; -+ -+ cls_ptr = MLX5_ADDR_OF(mnvda_reg, mnvda, -+ configuration_item_header.type.configuration_item_type_class_global); -+ -+ type_class = MLX5_GET(configuration_item_type_class_global, cls_ptr, -+ type_class); -+ param_idx = MLX5_GET(configuration_item_type_class_global, cls_ptr, -+ parameter_index); -+ header_len = MLX5_GET_CFG_HDR_LEN(mnvda); -+ -+ mlx5_core_warn(dev, "Failed to read mnvda reg: type_class 0x%x, param_idx 0x%x, header_len %u, err %d\n", -+ type_class, param_idx, header_len, err); -+ -+ return -EOPNOTSUPP; -+} -+ -+static int mlx5_nv_param_write(struct mlx5_core_dev *dev, void *mnvda, -+ size_t len) -+{ -+ if (WARN_ON(len > MLX5_ST_SZ_BYTES(mnvda_reg)) || len < MNVDA_HDR_SZ) -+ return -EINVAL; -+ -+ if (WARN_ON(MLX5_GET_CFG_HDR_LEN(mnvda) == 0)) -+ return -EINVAL; -+ -+ return mlx5_core_access_reg(dev, mnvda, len, mnvda, len, MLX5_REG_MNVDA, -+ 0, 1); -+} -+ -+static int -+mlx5_nv_param_read_sw_offload_conf(struct mlx5_core_dev *dev, void *mnvda, -+ size_t len) -+{ -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, type_class, 0); -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, parameter_index, -+ MLX5_CLASS_0_CTRL_ID_NV_SW_OFFLOAD_CONFIG); -+ MLX5_SET_CFG_HDR_LEN(mnvda, nv_sw_offload_conf); -+ -+ return mlx5_nv_param_read(dev, mnvda, len); -+} -+ -+static const char *const -+ cqe_compress_str[] = { "balanced", "aggressive" }; -+ -+static int -+mlx5_nv_param_devlink_cqe_compress_get(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)] = {}; -+ u8 value = U8_MAX; -+ void *data; -+ int err; -+ -+ err = mlx5_nv_param_read_sw_offload_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ value = MLX5_GET(nv_sw_offload_conf, data, cqe_compression); -+ -+ if (value >= ARRAY_SIZE(cqe_compress_str)) -+ return -EOPNOTSUPP; -+ -+ strscpy(ctx->val.vstr, cqe_compress_str[value], sizeof(ctx->val.vstr)); -+ return 0; -+} -+ -+static int -+mlx5_nv_param_devlink_cqe_compress_validate(struct devlink *devlink, u32 id, -+ union devlink_param_value val, -+ struct netlink_ext_ack *extack) -+{ -+ int i; -+ -+ for (i = 0; i < ARRAY_SIZE(cqe_compress_str); i++) { -+ if (!strcmp(val.vstr, cqe_compress_str[i])) -+ return 0; -+ } -+ -+ NL_SET_ERR_MSG_MOD(extack, -+ "Invalid value, supported values are balanced/aggressive"); -+ return -EOPNOTSUPP; -+} -+ -+static int -+mlx5_nv_param_devlink_cqe_compress_set(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)] = {}; -+ int err = 0; -+ void *data; -+ u8 value; -+ -+ if (!strcmp(ctx->val.vstr, "aggressive")) -+ value = 1; -+ else /* balanced: can't be anything else already validated above */ -+ value = 0; -+ -+ err = mlx5_nv_param_read_sw_offload_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Failed to read sw_offload_conf mnvda reg"); -+ return err; -+ } -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ MLX5_SET(nv_sw_offload_conf, data, cqe_compression, value); -+ -+ return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+} -+ -+static const struct devlink_param mlx5_nv_param_devlink_params[] = { -+ DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_CQE_COMPRESSION_TYPE, -+ "cqe_compress_type", DEVLINK_PARAM_TYPE_STRING, -+ BIT(DEVLINK_PARAM_CMODE_PERMANENT), -+ mlx5_nv_param_devlink_cqe_compress_get, -+ mlx5_nv_param_devlink_cqe_compress_set, -+ mlx5_nv_param_devlink_cqe_compress_validate), -+}; -+ -+int mlx5_nv_param_register_dl_params(struct devlink *devlink) -+{ -+ if (!mlx5_core_is_pf(devlink_priv(devlink))) -+ return 0; -+ -+ return devl_params_register(devlink, mlx5_nv_param_devlink_params, -+ ARRAY_SIZE(mlx5_nv_param_devlink_params)); -+} -+ -+void mlx5_nv_param_unregister_dl_params(struct devlink *devlink) -+{ -+ if (!mlx5_core_is_pf(devlink_priv(devlink))) -+ return; -+ -+ devl_params_unregister(devlink, mlx5_nv_param_devlink_params, -+ ARRAY_SIZE(mlx5_nv_param_devlink_params)); -+} -+ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.h -new file mode 100644 -index 000000000000..9f4922ff7745 ---- /dev/null -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.h -@@ -0,0 +1,14 @@ -+/* SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB */ -+/* Copyright (c) 2024, NVIDIA CORPORATION & AFFILIATES. All rights reserved. */ -+ -+#ifndef __MLX5_NV_PARAM_H -+#define __MLX5_NV_PARAM_H -+ -+#include -+#include "devlink.h" -+ -+int mlx5_nv_param_register_dl_params(struct devlink *devlink); -+void mlx5_nv_param_unregister_dl_params(struct devlink *devlink); -+ -+#endif -+ -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 89d020a4f572..c5106eb8b413 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -137,6 +137,7 @@ enum { - MLX5_REG_MTCAP = 0x9009, - MLX5_REG_MTMP = 0x900A, - MLX5_REG_MCIA = 0x9014, -+ MLX5_REG_MNVDA = 0x9024, - MLX5_REG_MFRL = 0x9028, - MLX5_REG_MLCR = 0x902b, - MLX5_REG_MRTC = 0x902d, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1529-net-mlx5-implement-devlink-enable-sriov-parameter.patch b/SOURCES/1529-net-mlx5-implement-devlink-enable-sriov-parameter.patch deleted file mode 100644 index 6a032aa7c..000000000 --- a/SOURCES/1529-net-mlx5-implement-devlink-enable-sriov-parameter.patch +++ /dev/null @@ -1,308 +0,0 @@ -From 9392c0b3d4463777bea3276ddbd9ef0dded68854 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Implement devlink enable_sriov parameter - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 95a0af146dff5437acb4ea27eacc05aa22c7bb54 -Author: Vlad Dumitrescu -Date: Sat Sep 6 18:29:45 2025 -0700 - - net/mlx5: Implement devlink enable_sriov parameter - - Example usage: - devlink dev param set pci/0000:01:00.0 name enable_sriov value {true, false} cmode permanent - devlink dev reload pci/0000:01:00.0 action fw_activate - echo 1 >/sys/bus/pci/devices/0000:01:00.0/remove - echo 1 >/sys/bus/pci/rescan - grep ^ /sys/bus/pci/devices/0000:01:00.0/sriov_* - - Signed-off-by: Vlad Dumitrescu - Tested-by: Kamal Heib - Reviewed-by: Jiri Pirko - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250907012953.301746-4-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index 2edc842b620d..c3610f7c1d4b 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -15,23 +15,31 @@ Parameters - * - Name - - Mode - - Validation -+ - Notes - * - ``enable_roce`` - - driverinit -- - Type: Boolean -- -- If the device supports RoCE disablement, RoCE enablement state controls -+ - Boolean -+ - If the device supports RoCE disablement, RoCE enablement state controls - device support for RoCE capability. Otherwise, the control occurs in the - driver stack. When RoCE is disabled at the driver level, only raw - ethernet QPs are supported. - * - ``io_eq_size`` - - driverinit - - The range is between 64 and 4096. -+ - - * - ``event_eq_size`` - - driverinit - - The range is between 64 and 4096. -+ - - * - ``max_macs`` - - driverinit - - The range is between 1 and 2^31. Only power of 2 values are supported. -+ - -+ * - ``enable_sriov`` -+ - permanent -+ - Boolean -+ - Applies to each physical function (PF) independently, if the device -+ supports it. Otherwise, it applies symmetrically to all PFs. - - The ``mlx5`` driver also implements the following driver-specific - parameters. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -index 20a39483be04..ed2129843ec7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -@@ -5,7 +5,11 @@ - #include "mlx5_core.h" - - enum { -+ MLX5_CLASS_0_CTRL_ID_NV_GLOBAL_PCI_CONF = 0x80, -+ MLX5_CLASS_0_CTRL_ID_NV_GLOBAL_PCI_CAP = 0x81, - MLX5_CLASS_0_CTRL_ID_NV_SW_OFFLOAD_CONFIG = 0x10a, -+ -+ MLX5_CLASS_3_CTRL_ID_NV_PF_PCI_CONF = 0x80, - }; - - struct mlx5_ifc_configuration_item_type_class_global_bits { -@@ -13,9 +17,18 @@ struct mlx5_ifc_configuration_item_type_class_global_bits { - u8 parameter_index[0x18]; - }; - -+struct mlx5_ifc_configuration_item_type_class_per_host_pf_bits { -+ u8 type_class[0x8]; -+ u8 pf_index[0x6]; -+ u8 pci_bus_index[0x8]; -+ u8 parameter_index[0xa]; -+}; -+ - union mlx5_ifc_config_item_type_auto_bits { - struct mlx5_ifc_configuration_item_type_class_global_bits - configuration_item_type_class_global; -+ struct mlx5_ifc_configuration_item_type_class_per_host_pf_bits -+ configuration_item_type_class_per_host_pf; - u8 reserved_at_0[0x20]; - }; - -@@ -45,6 +58,45 @@ struct mlx5_ifc_mnvda_reg_bits { - u8 configuration_item_data[64][0x20]; - }; - -+struct mlx5_ifc_nv_global_pci_conf_bits { -+ u8 sriov_valid[0x1]; -+ u8 reserved_at_1[0x10]; -+ u8 per_pf_total_vf[0x1]; -+ u8 reserved_at_12[0xe]; -+ -+ u8 sriov_en[0x1]; -+ u8 reserved_at_21[0xf]; -+ u8 total_vfs[0x10]; -+ -+ u8 reserved_at_40[0x20]; -+}; -+ -+struct mlx5_ifc_nv_global_pci_cap_bits { -+ u8 max_vfs_per_pf_valid[0x1]; -+ u8 reserved_at_1[0x13]; -+ u8 per_pf_total_vf_supported[0x1]; -+ u8 reserved_at_15[0xb]; -+ -+ u8 sriov_support[0x1]; -+ u8 reserved_at_21[0xf]; -+ u8 max_vfs_per_pf[0x10]; -+ -+ u8 reserved_at_40[0x60]; -+}; -+ -+struct mlx5_ifc_nv_pf_pci_conf_bits { -+ u8 reserved_at_0[0x9]; -+ u8 pf_total_vf_en[0x1]; -+ u8 reserved_at_a[0x16]; -+ -+ u8 reserved_at_20[0x20]; -+ -+ u8 reserved_at_40[0x10]; -+ u8 total_vf[0x10]; -+ -+ u8 reserved_at_60[0x20]; -+}; -+ - struct mlx5_ifc_nv_sw_offload_conf_bits { - u8 ip_over_vxlan_port[0x10]; - u8 tunnel_ecn_copy_offload_disable[0x1]; -@@ -216,7 +268,154 @@ mlx5_nv_param_devlink_cqe_compress_set(struct devlink *devlink, u32 id, - return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); - } - -+static int mlx5_nv_param_read_global_pci_conf(struct mlx5_core_dev *dev, -+ void *mnvda, size_t len) -+{ -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, type_class, 0); -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, parameter_index, -+ MLX5_CLASS_0_CTRL_ID_NV_GLOBAL_PCI_CONF); -+ MLX5_SET_CFG_HDR_LEN(mnvda, nv_global_pci_conf); -+ -+ return mlx5_nv_param_read(dev, mnvda, len); -+} -+ -+static int mlx5_nv_param_read_global_pci_cap(struct mlx5_core_dev *dev, -+ void *mnvda, size_t len) -+{ -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, type_class, 0); -+ MLX5_SET_CFG_ITEM_TYPE(global, mnvda, parameter_index, -+ MLX5_CLASS_0_CTRL_ID_NV_GLOBAL_PCI_CAP); -+ MLX5_SET_CFG_HDR_LEN(mnvda, nv_global_pci_cap); -+ -+ return mlx5_nv_param_read(dev, mnvda, len); -+} -+ -+static int mlx5_nv_param_read_per_host_pf_conf(struct mlx5_core_dev *dev, -+ void *mnvda, size_t len) -+{ -+ MLX5_SET_CFG_ITEM_TYPE(per_host_pf, mnvda, type_class, 3); -+ MLX5_SET_CFG_ITEM_TYPE(per_host_pf, mnvda, parameter_index, -+ MLX5_CLASS_3_CTRL_ID_NV_PF_PCI_CONF); -+ MLX5_SET_CFG_HDR_LEN(mnvda, nv_pf_pci_conf); -+ -+ return mlx5_nv_param_read(dev, mnvda, len); -+} -+ -+static int mlx5_devlink_enable_sriov_get(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)] = {}; -+ bool sriov_en = false; -+ void *data; -+ int err; -+ -+ err = mlx5_nv_param_read_global_pci_cap(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ if (!MLX5_GET(nv_global_pci_cap, data, sriov_support)) { -+ ctx->val.vbool = false; -+ return 0; -+ } -+ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_global_pci_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ sriov_en = MLX5_GET(nv_global_pci_conf, data, sriov_en); -+ if (!MLX5_GET(nv_global_pci_conf, data, per_pf_total_vf)) { -+ ctx->val.vbool = sriov_en; -+ return 0; -+ } -+ -+ /* SRIOV is per PF */ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_per_host_pf_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ ctx->val.vbool = sriov_en && -+ MLX5_GET(nv_pf_pci_conf, data, pf_total_vf_en); -+ return 0; -+} -+ -+static int mlx5_devlink_enable_sriov_set(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)] = {}; -+ bool per_pf_support; -+ void *cap, *data; -+ int err; -+ -+ err = mlx5_nv_param_read_global_pci_cap(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Failed to read global PCI capability"); -+ return err; -+ } -+ -+ cap = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ per_pf_support = MLX5_GET(nv_global_pci_cap, cap, -+ per_pf_total_vf_supported); -+ -+ if (!MLX5_GET(nv_global_pci_cap, cap, sriov_support)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "SRIOV is not supported on this device"); -+ return -EOPNOTSUPP; -+ } -+ -+ if (!per_pf_support) { -+ /* We don't allow global SRIOV setting on per PF devlink */ -+ NL_SET_ERR_MSG_MOD(extack, -+ "SRIOV is not per PF on this device"); -+ return -EOPNOTSUPP; -+ } -+ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_global_pci_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Unable to read global PCI configuration"); -+ return err; -+ } -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ -+ /* setup per PF sriov mode */ -+ MLX5_SET(nv_global_pci_conf, data, sriov_valid, 1); -+ MLX5_SET(nv_global_pci_conf, data, sriov_en, 1); -+ MLX5_SET(nv_global_pci_conf, data, per_pf_total_vf, 1); -+ -+ err = mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Unable to write global PCI configuration"); -+ return err; -+ } -+ -+ /* enable/disable sriov on this PF */ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_per_host_pf_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Unable to read per host PF configuration"); -+ return err; -+ } -+ MLX5_SET(nv_pf_pci_conf, data, pf_total_vf_en, ctx->val.vbool); -+ return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+} -+ - static const struct devlink_param mlx5_nv_param_devlink_params[] = { -+ DEVLINK_PARAM_GENERIC(ENABLE_SRIOV, BIT(DEVLINK_PARAM_CMODE_PERMANENT), -+ mlx5_devlink_enable_sriov_get, -+ mlx5_devlink_enable_sriov_set, NULL), - DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_CQE_COMPRESSION_TYPE, - "cqe_compress_type", DEVLINK_PARAM_TYPE_STRING, - BIT(DEVLINK_PARAM_CMODE_PERMANENT), --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1530-net-mlx5-implement-devlink-total-vfs-parameter.patch b/SOURCES/1530-net-mlx5-implement-devlink-total-vfs-parameter.patch deleted file mode 100644 index c0616076a..000000000 --- a/SOURCES/1530-net-mlx5-implement-devlink-total-vfs-parameter.patch +++ /dev/null @@ -1,218 +0,0 @@ -From dd2496e03913db85e628821c349281e8cad5ef4f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5: Implement devlink total_vfs parameter - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a4c49611cf4f7018ee80f02bded12fd4002ef95c -Author: Vlad Dumitrescu -Date: Sat Sep 6 18:29:46 2025 -0700 - - net/mlx5: Implement devlink total_vfs parameter - - Some devices support both symmetric (same value for all PFs) and - asymmetric, while others only support symmetric configuration. This - implementation prefers asymmetric, since it is closer to the devlink - model (per function settings), but falls back to symmetric when needed. - - Example usage: - devlink dev param set pci/0000:01:00.0 name total_vfs value cmode permanent - devlink dev reload pci/0000:01:00.0 action fw_activate - echo 1 >/sys/bus/pci/devices/0000:01:00.0/remove - echo 1 >/sys/bus/pci/rescan - cat /sys/bus/pci/devices/0000:01:00.0/sriov_totalvfs - - Signed-off-by: Vlad Dumitrescu - Reviewed-by: Jiri Pirko - Tested-by: Kamal Heib - Signed-off-by: Saeed Mahameed - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/20250907012953.301746-5-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index c3610f7c1d4b..07b1424cbfbb 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -40,6 +40,28 @@ Parameters - - Boolean - - Applies to each physical function (PF) independently, if the device - supports it. Otherwise, it applies symmetrically to all PFs. -+ * - ``total_vfs`` -+ - permanent -+ - The range is between 1 and a device-specific max. -+ - Applies to each physical function (PF) independently, if the device -+ supports it. Otherwise, it applies symmetrically to all PFs. -+ -+Note: permanent parameters such as ``enable_sriov`` and ``total_vfs`` require FW reset to take effect -+ -+.. code-block:: bash -+ -+ # setup parameters -+ devlink dev param set pci/0000:01:00.0 name enable_sriov value true cmode permanent -+ devlink dev param set pci/0000:01:00.0 name total_vfs value 8 cmode permanent -+ -+ # Fw reset -+ devlink dev reload pci/0000:01:00.0 action fw_activate -+ -+ # for PCI related config such as sriov PCI reset/rescan is required: -+ echo 1 >/sys/bus/pci/devices/0000:01:00.0/remove -+ echo 1 >/sys/bus/pci/rescan -+ grep ^ /sys/bus/pci/devices/0000:01:00.0/sriov_* -+ - - The ``mlx5`` driver also implements the following driver-specific - parameters. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -index ed2129843ec7..383d8cfe4c0a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -@@ -412,10 +412,142 @@ static int mlx5_devlink_enable_sriov_set(struct devlink *devlink, u32 id, - return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); - } - -+static int mlx5_devlink_total_vfs_get(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)] = {}; -+ void *data; -+ int err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ -+ err = mlx5_nv_param_read_global_pci_cap(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ if (!MLX5_GET(nv_global_pci_cap, data, sriov_support)) { -+ ctx->val.vu32 = 0; -+ return 0; -+ } -+ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_global_pci_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ if (!MLX5_GET(nv_global_pci_conf, data, per_pf_total_vf)) { -+ ctx->val.vu32 = MLX5_GET(nv_global_pci_conf, data, total_vfs); -+ return 0; -+ } -+ -+ /* SRIOV is per PF */ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_per_host_pf_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ ctx->val.vu32 = MLX5_GET(nv_pf_pci_conf, data, total_vf); -+ -+ return 0; -+} -+ -+static int mlx5_devlink_total_vfs_set(struct devlink *devlink, u32 id, -+ struct devlink_param_gset_ctx *ctx, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)]; -+ bool per_pf_support; -+ void *data; -+ int err; -+ -+ err = mlx5_nv_param_read_global_pci_cap(dev, mnvda, sizeof(mnvda)); -+ if (err) { -+ NL_SET_ERR_MSG_MOD(extack, "Failed to read global pci cap"); -+ return err; -+ } -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ if (!MLX5_GET(nv_global_pci_cap, data, sriov_support)) { -+ NL_SET_ERR_MSG_MOD(extack, "Not configurable on this device"); -+ return -EOPNOTSUPP; -+ } -+ -+ per_pf_support = MLX5_GET(nv_global_pci_cap, data, -+ per_pf_total_vf_supported); -+ if (!per_pf_support) { -+ /* We don't allow global SRIOV setting on per PF devlink */ -+ NL_SET_ERR_MSG_MOD(extack, -+ "SRIOV is not per PF on this device"); -+ return -EOPNOTSUPP; -+ } -+ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_global_pci_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ MLX5_SET(nv_global_pci_conf, data, sriov_valid, 1); -+ MLX5_SET(nv_global_pci_conf, data, per_pf_total_vf, per_pf_support); -+ -+ if (!per_pf_support) { -+ MLX5_SET(nv_global_pci_conf, data, total_vfs, ctx->val.vu32); -+ return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+ } -+ -+ /* SRIOV is per PF */ -+ err = mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ memset(mnvda, 0, sizeof(mnvda)); -+ err = mlx5_nv_param_read_per_host_pf_conf(dev, mnvda, sizeof(mnvda)); -+ if (err) -+ return err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, mnvda, configuration_item_data); -+ MLX5_SET(nv_pf_pci_conf, data, total_vf, ctx->val.vu32); -+ return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -+} -+ -+static int mlx5_devlink_total_vfs_validate(struct devlink *devlink, u32 id, -+ union devlink_param_value val, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ u32 cap[MLX5_ST_SZ_DW(mnvda_reg)]; -+ void *data; -+ u16 max; -+ int err; -+ -+ data = MLX5_ADDR_OF(mnvda_reg, cap, configuration_item_data); -+ -+ err = mlx5_nv_param_read_global_pci_cap(dev, cap, sizeof(cap)); -+ if (err) -+ return err; -+ -+ if (!MLX5_GET(nv_global_pci_cap, data, max_vfs_per_pf_valid)) -+ return 0; /* optimistic, but set might fail later */ -+ -+ max = MLX5_GET(nv_global_pci_cap, data, max_vfs_per_pf); -+ if (val.vu16 > max) { -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "Max allowed by device is %u", max); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static const struct devlink_param mlx5_nv_param_devlink_params[] = { - DEVLINK_PARAM_GENERIC(ENABLE_SRIOV, BIT(DEVLINK_PARAM_CMODE_PERMANENT), - mlx5_devlink_enable_sriov_get, - mlx5_devlink_enable_sriov_set, NULL), -+ DEVLINK_PARAM_GENERIC(TOTAL_VFS, BIT(DEVLINK_PARAM_CMODE_PERMANENT), -+ mlx5_devlink_total_vfs_get, -+ mlx5_devlink_total_vfs_set, -+ mlx5_devlink_total_vfs_validate), - DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_CQE_COMPRESSION_TYPE, - "cqe_compress_type", DEVLINK_PARAM_TYPE_STRING, - BIT(DEVLINK_PARAM_CMODE_PERMANENT), --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1531-net-mlx5e-make-pcie-congestion-event-thresholds-configurable.patch b/SOURCES/1531-net-mlx5e-make-pcie-congestion-event-thresholds-configurable.patch deleted file mode 100644 index dc80a495d..000000000 --- a/SOURCES/1531-net-mlx5e-make-pcie-congestion-event-thresholds-configurable.patch +++ /dev/null @@ -1,359 +0,0 @@ -From 21028531e0ca0857334d5e11cea7c7b27adcd477 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:57 -0400 -Subject: [PATCH] net/mlx5e: Make PCIe congestion event thresholds configurable - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f4053490a6f651476124903dbe0777e3c24ac8cb -Author: Dragos Tatulea -Date: Sun Sep 7 12:39:35 2025 +0300 - - net/mlx5e: Make PCIe congestion event thresholds configurable - - Add devlink driverinit parameters for configuring the thresholds for - PCIe congestion events. These parameters are registered only when the - firmware supports this feature. - - Update the mlx5 devlink docs as well on these new params. - - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1757237976-531416-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index 07b1424cbfbb..60cc9fedf1ef 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -146,6 +146,58 @@ parameters. - - u32 - - driverinit - - Control the size (in packets) of the hairpin queues. -+ * - ``pcie_cong_inbound_high`` -+ - u16 -+ - driverinit -+ - High threshold configuration for PCIe congestion events. The firmware -+ will send an event once device side inbound PCIe traffic went -+ above the configured high threshold for a long enough period (at least -+ 200ms). -+ -+ See pci_bw_inbound_high ethtool stat. -+ -+ Units are 0.01 %. Accepted values are in range [0, 10000]. -+ pcie_cong_inbound_low < pcie_cong_inbound_high. -+ Default value: 9000 (Corresponds to 90%). -+ * - ``pcie_cong_inbound_low`` -+ - u16 -+ - driverinit -+ - Low threshold configuration for PCIe congestion events. The firmware -+ will send an event once device side inbound PCIe traffic went -+ below the configured low threshold, only after having been previously in -+ a congested state. -+ -+ See pci_bw_inbound_low ethtool stat. -+ -+ Units are 0.01 %. Accepted values are in range [0, 10000]. -+ pcie_cong_inbound_low < pcie_cong_inbound_high. -+ Default value: 7500. -+ * - ``pcie_cong_outbound_high`` -+ - u16 -+ - driverinit -+ - High threshold configuration for PCIe congestion events. The firmware -+ will send an event once device side outbound PCIe traffic went -+ above the configured high threshold for a long enough period (at least -+ 200ms). -+ -+ See pci_bw_outbound_high ethtool stat. -+ -+ Units are 0.01 %. Accepted values are in range [0, 10000]. -+ pcie_cong_outbound_low < pcie_cong_outbound_high. -+ Default value: 9000 (Corresponds to 90%). -+ * - ``pcie_cong_outbound_low`` -+ - u16 -+ - driverinit -+ - Low threshold configuration for PCIe congestion events. The firmware -+ will send an event once device side outbound PCIe traffic went -+ below the configured low threshold, only after having been previously in -+ a congested state. -+ -+ See pci_bw_outbound_low ethtool stat. -+ -+ Units are 0.01 %. Accepted values are in range [0, 10000]. -+ pcie_cong_outbound_low < pcie_cong_outbound_high. -+ Default value: 7500. - - * - ``cqe_compress_type`` - - string -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 0c0f7231cb2a..e900451643a3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -651,6 +651,105 @@ static void mlx5_devlink_eth_params_unregister(struct devlink *devlink) - ARRAY_SIZE(mlx5_devlink_eth_params)); - } - -+#define MLX5_PCIE_CONG_THRESH_MAX 10000 -+#define MLX5_PCIE_CONG_THRESH_DEF_LOW 7500 -+#define MLX5_PCIE_CONG_THRESH_DEF_HIGH 9000 -+ -+static int -+mlx5_devlink_pcie_cong_thresh_validate(struct devlink *devl, u32 id, -+ union devlink_param_value val, -+ struct netlink_ext_ack *extack) -+{ -+ if (val.vu16 > MLX5_PCIE_CONG_THRESH_MAX) { -+ NL_SET_ERR_MSG_FMT_MOD(extack, "Value %u > max supported (%u)", -+ val.vu16, MLX5_PCIE_CONG_THRESH_MAX); -+ -+ return -EINVAL; -+ } -+ -+ switch (id) { -+ case MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_LOW: -+ case MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_HIGH: -+ case MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_LOW: -+ case MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_HIGH: -+ break; -+ default: -+ return -EOPNOTSUPP; -+ } -+ -+ return 0; -+} -+ -+static void mlx5_devlink_pcie_cong_init_values(struct devlink *devlink) -+{ -+ union devlink_param_value value; -+ u32 id; -+ -+ value.vu16 = MLX5_PCIE_CONG_THRESH_DEF_LOW; -+ id = MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_LOW; -+ devl_param_driverinit_value_set(devlink, id, value); -+ -+ value.vu16 = MLX5_PCIE_CONG_THRESH_DEF_HIGH; -+ id = MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_HIGH; -+ devl_param_driverinit_value_set(devlink, id, value); -+ -+ value.vu16 = MLX5_PCIE_CONG_THRESH_DEF_LOW; -+ id = MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_LOW; -+ devl_param_driverinit_value_set(devlink, id, value); -+ -+ value.vu16 = MLX5_PCIE_CONG_THRESH_DEF_HIGH; -+ id = MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_HIGH; -+ devl_param_driverinit_value_set(devlink, id, value); -+} -+ -+static const struct devlink_param mlx5_devlink_pcie_cong_params[] = { -+ DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_LOW, -+ "pcie_cong_inbound_low", DEVLINK_PARAM_TYPE_U16, -+ BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, -+ mlx5_devlink_pcie_cong_thresh_validate), -+ DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_HIGH, -+ "pcie_cong_inbound_high", DEVLINK_PARAM_TYPE_U16, -+ BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, -+ mlx5_devlink_pcie_cong_thresh_validate), -+ DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_LOW, -+ "pcie_cong_outbound_low", DEVLINK_PARAM_TYPE_U16, -+ BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, -+ mlx5_devlink_pcie_cong_thresh_validate), -+ DEVLINK_PARAM_DRIVER(MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_HIGH, -+ "pcie_cong_outbound_high", DEVLINK_PARAM_TYPE_U16, -+ BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, -+ mlx5_devlink_pcie_cong_thresh_validate), -+}; -+ -+static int mlx5_devlink_pcie_cong_params_register(struct devlink *devlink) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ int err; -+ -+ if (!mlx5_pcie_cong_event_supported(dev)) -+ return 0; -+ -+ err = devl_params_register(devlink, mlx5_devlink_pcie_cong_params, -+ ARRAY_SIZE(mlx5_devlink_pcie_cong_params)); -+ if (err) -+ return err; -+ -+ mlx5_devlink_pcie_cong_init_values(devlink); -+ -+ return 0; -+} -+ -+static void mlx5_devlink_pcie_cong_params_unregister(struct devlink *devlink) -+{ -+ struct mlx5_core_dev *dev = devlink_priv(devlink); -+ -+ if (!mlx5_pcie_cong_event_supported(dev)) -+ return; -+ -+ devl_params_unregister(devlink, mlx5_devlink_pcie_cong_params, -+ ARRAY_SIZE(mlx5_devlink_pcie_cong_params)); -+} -+ - static int mlx5_devlink_enable_rdma_validate(struct devlink *devlink, u32 id, - union devlink_param_value val, - struct netlink_ext_ack *extack) -@@ -896,6 +995,10 @@ int mlx5_devlink_params_register(struct devlink *devlink) - if (err) - goto max_uc_list_err; - -+ err = mlx5_devlink_pcie_cong_params_register(devlink); -+ if (err) -+ goto pcie_cong_err; -+ - err = mlx5_nv_param_register_dl_params(devlink); - if (err) - goto nv_param_err; -@@ -903,6 +1006,8 @@ int mlx5_devlink_params_register(struct devlink *devlink) - return 0; - - nv_param_err: -+ mlx5_devlink_pcie_cong_params_unregister(devlink); -+pcie_cong_err: - mlx5_devlink_max_uc_list_params_unregister(devlink); - max_uc_list_err: - mlx5_devlink_auxdev_params_unregister(devlink); -@@ -915,6 +1020,7 @@ int mlx5_devlink_params_register(struct devlink *devlink) - void mlx5_devlink_params_unregister(struct devlink *devlink) - { - mlx5_nv_param_unregister_dl_params(devlink); -+ mlx5_devlink_pcie_cong_params_unregister(devlink); - mlx5_devlink_max_uc_list_params_unregister(devlink); - mlx5_devlink_auxdev_params_unregister(devlink); - devl_params_unregister(devlink, mlx5_devlink_params, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.h b/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -index 74bcdfa70361..c9555119a661 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.h -@@ -22,6 +22,10 @@ enum mlx5_devlink_param_id { - MLX5_DEVLINK_PARAM_ID_ESW_MULTIPORT, - MLX5_DEVLINK_PARAM_ID_HAIRPIN_NUM_QUEUES, - MLX5_DEVLINK_PARAM_ID_HAIRPIN_QUEUE_SIZE, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_LOW, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_HIGH, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_LOW, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_HIGH, - MLX5_DEVLINK_PARAM_ID_CQE_COMPRESSION_TYPE - }; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -index 0ed017569a19..0cf142f71c09 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -@@ -1,6 +1,7 @@ - // SPDX-License-Identifier: GPL-2.0 OR Linux-OpenIB - // Copyright (c) 2025, NVIDIA CORPORATION & AFFILIATES. - -+#include "../devlink.h" - #include "en.h" - #include "pcie_cong_event.h" - -@@ -41,13 +42,6 @@ struct mlx5e_pcie_cong_event { - struct mlx5e_pcie_cong_stats stats; - }; - --/* In units of 0.01 % */ --static const struct mlx5e_pcie_cong_thresh default_thresh_config = { -- .inbound_high = 9000, -- .inbound_low = 7500, -- .outbound_high = 9000, -- .outbound_low = 7500, --}; - - static const struct counter_desc mlx5e_pcie_cong_stats_desc[] = { - { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -@@ -249,8 +243,60 @@ static int mlx5e_pcie_cong_event_handler(struct notifier_block *nb, - return NOTIFY_OK; - } - -+static int -+mlx5e_pcie_cong_get_thresh_config(struct mlx5_core_dev *dev, -+ struct mlx5e_pcie_cong_thresh *config) -+{ -+ u32 ids[4] = { -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_LOW, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_IN_HIGH, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_LOW, -+ MLX5_DEVLINK_PARAM_ID_PCIE_CONG_OUT_HIGH, -+ }; -+ struct devlink *devlink = priv_to_devlink(dev); -+ union devlink_param_value val[4]; -+ -+ for (int i = 0; i < 4; i++) { -+ u32 id = ids[i]; -+ int err; -+ -+ err = devl_param_driverinit_value_get(devlink, id, &val[i]); -+ if (err) -+ return err; -+ } -+ -+ config->inbound_low = val[0].vu16; -+ config->inbound_high = val[1].vu16; -+ config->outbound_low = val[2].vu16; -+ config->outbound_high = val[3].vu16; -+ -+ return 0; -+} -+ -+static int -+mlx5e_thresh_config_validate(struct mlx5_core_dev *mdev, -+ const struct mlx5e_pcie_cong_thresh *config) -+{ -+ int err = 0; -+ -+ if (config->inbound_low >= config->inbound_high) { -+ err = -EINVAL; -+ mlx5_core_err(mdev, "PCIe inbound congestion threshold configuration invalid: low (%u) >= high (%u).\n", -+ config->inbound_low, config->inbound_high); -+ } -+ -+ if (config->outbound_low >= config->outbound_high) { -+ err = -EINVAL; -+ mlx5_core_err(mdev, "PCIe outbound congestion threshold configuration invalid: low (%u) >= high (%u).\n", -+ config->outbound_low, config->outbound_high); -+ } -+ -+ return err; -+} -+ - int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - { -+ struct mlx5e_pcie_cong_thresh thresh_config = {}; - struct mlx5e_pcie_cong_event *cong_event; - struct mlx5_core_dev *mdev = priv->mdev; - int err; -@@ -258,6 +304,16 @@ int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - if (!mlx5_pcie_cong_event_supported(mdev)) - return 0; - -+ err = mlx5e_pcie_cong_get_thresh_config(mdev, &thresh_config); -+ if (WARN_ON(err)) -+ return err; -+ -+ err = mlx5e_thresh_config_validate(mdev, &thresh_config); -+ if (err) { -+ mlx5_core_err(mdev, "PCIe congestion event feature disabled\n"); -+ return err; -+ } -+ - cong_event = kvzalloc_node(sizeof(*cong_event), GFP_KERNEL, - mdev->priv.numa_node); - if (!cong_event) -@@ -269,7 +325,7 @@ int mlx5e_pcie_cong_event_init(struct mlx5e_priv *priv) - - cong_event->priv = priv; - -- err = mlx5_cmd_pcie_cong_event_set(mdev, &default_thresh_config, -+ err = mlx5_cmd_pcie_cong_event_set(mdev, &thresh_config, - &cong_event->obj_id); - if (err) { - mlx5_core_warn(mdev, "Error creating a PCIe congestion event object\n"); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1532-net-mlx5e-add-stale-counter-for-pcie-congestion-events.patch b/SOURCES/1532-net-mlx5e-add-stale-counter-for-pcie-congestion-events.patch deleted file mode 100644 index 7f68c244e..000000000 --- a/SOURCES/1532-net-mlx5e-add-stale-counter-for-pcie-congestion-events.patch +++ /dev/null @@ -1,89 +0,0 @@ -From 3b6651757c73fb5891d4e1eb65f6e8ea0cb6188c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5e: Add stale counter for PCIe congestion events - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cdc492746e3f6d73a9e6a6a9962c9f1f7b7961b5 -Author: Dragos Tatulea -Date: Sun Sep 7 12:39:36 2025 +0300 - - net/mlx5e: Add stale counter for PCIe congestion events - - This ethtool counter is meant to help with observing how many times the - congestion event was triggered but on query there was no state change. - - This would help to indicate when a work item was scheduled to run too - late and in the meantime the congestion state changed back to previous - state. - - While at it, do a driveby typo fix in documentation for - pci_bw_inbound_high. - - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1757237976-531416-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst b/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -index 754c81436408..cc498895f92e 100644 ---- a/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -+++ b/Documentation/networking/device_drivers/ethernet/mellanox/mlx5/counters.rst -@@ -1348,7 +1348,7 @@ Device Counters - is in a congested state. - If pci_bw_inbound_high == pci_bw_inbound_low then the device is not congested. - If pci_bw_inbound_high > pci_bw_inbound_low then the device is congested. -- - Tnformative -+ - Informative - - * - `pci_bw_inbound_low` - - The number of times the device crossed the low inbound PCIe bandwidth -@@ -1373,3 +1373,8 @@ Device Counters - If pci_bw_outbound_high == pci_bw_outbound_low then the device is not congested. - If pci_bw_outbound_high > pci_bw_outbound_low then the device is congested. - - Informative -+ -+ * - `pci_bw_stale_event` -+ - The number of times the device fired a PCIe congestion event but on query -+ there was no change in state. -+ - Informative -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -index 0cf142f71c09..2eb666a46f39 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/pcie_cong_event.c -@@ -24,6 +24,7 @@ struct mlx5e_pcie_cong_stats { - u32 pci_bw_inbound_low; - u32 pci_bw_outbound_high; - u32 pci_bw_outbound_low; -+ u32 pci_bw_stale_event; - }; - - struct mlx5e_pcie_cong_event { -@@ -52,6 +53,8 @@ static const struct counter_desc mlx5e_pcie_cong_stats_desc[] = { - pci_bw_outbound_high) }, - { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, - pci_bw_outbound_low) }, -+ { MLX5E_DECLARE_STAT(struct mlx5e_pcie_cong_stats, -+ pci_bw_stale_event) }, - }; - - #define NUM_PCIE_CONG_COUNTERS ARRAY_SIZE(mlx5e_pcie_cong_stats_desc) -@@ -212,8 +215,10 @@ static void mlx5e_pcie_cong_event_work(struct work_struct *work) - } - - changes = cong_event->state ^ new_cong_state; -- if (!changes) -+ if (!changes) { -+ cong_event->stats.pci_bw_stale_event++; - return; -+ } - - cong_event->state = new_cong_state; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1533-net-mlx5-fix-typo-in-pci-irq-c-comment.patch b/SOURCES/1533-net-mlx5-fix-typo-in-pci-irq-c-comment.patch deleted file mode 100644 index 31d44ecc4..000000000 --- a/SOURCES/1533-net-mlx5-fix-typo-in-pci-irq-c-comment.patch +++ /dev/null @@ -1,42 +0,0 @@ -From db599277be7ea60432782677ca6ef98c7d73b692 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: fix typo in pci_irq.c comment -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c5e389cc6b36701098d31fa3438c553c7fe7c1bb -Author: Alok Tiwari -Date: Fri Sep 12 06:50:44 2025 -0700 - - net/mlx5: fix typo in pci_irq.c comment - - Fix a typo in a comment in pci_irq.c: - "ssigned" → "assigned" - - Signed-off-by: Alok Tiwari - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20250912135050.3921116-1-alok.a.tiwari@oracle.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index 692ef9c2f729..e18a850c615c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -54,7 +54,7 @@ static int mlx5_core_func_to_vport(const struct mlx5_core_dev *dev, - - /** - * mlx5_get_default_msix_vec_count - Get the default number of MSI-X vectors -- * to be ssigned to each VF. -+ * to be assigned to each VF. - * @dev: PF to work on - * @num_vfs: Number of enabled VFs - */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1534-net-mlx5-refactor-devcom-to-use-match-attributes.patch b/SOURCES/1534-net-mlx5-refactor-devcom-to-use-match-attributes.patch deleted file mode 100644 index 88500c31e..000000000 --- a/SOURCES/1534-net-mlx5-refactor-devcom-to-use-match-attributes.patch +++ /dev/null @@ -1,330 +0,0 @@ -From d09bbd0ecb3ccf4257ae9b07e3eb0819e1867c71 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Refactor devcom to use match attributes - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f05a82fbcc645dceeed242d80bccb9dad2ca3383 -Author: Shay Drory -Date: Mon Sep 15 15:41:07 2025 +0300 - - net/mlx5: Refactor devcom to use match attributes - - Refactor the devcom interface to use a match attribute structure instead - of passing raw keys. This change lays the groundwork for extending - devcom matching logic with additional fields like net namespace, - improving its flexibility and robustness. - - No functional changes. - - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757940070-618661-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 4cc80cda8a09..b09291decca5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -232,9 +232,13 @@ static int mlx5e_devcom_event_mpv(int event, void *my_data, void *event_data) - - static int mlx5e_devcom_init_mpv(struct mlx5e_priv *priv, u64 *data) - { -+ struct mlx5_devcom_match_attr attr = { -+ .key.val = *data, -+ }; -+ - priv->devcom = mlx5_devcom_register_component(priv->mdev->priv.devc, - MLX5_DEVCOM_MPV, -- *data, -+ &attr, - mlx5e_devcom_event_mpv, - priv); - if (IS_ERR(priv->devcom)) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index fef418e1ed1a..ffa5749df587 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -5387,12 +5387,13 @@ void mlx5e_tc_ht_cleanup(struct rhashtable *tc_ht) - int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - { - const size_t sz_enc_opts = sizeof(struct tunnel_match_enc_opts); -+ struct mlx5_devcom_match_attr attr = {}; - struct netdev_phys_item_id ppid; - struct mlx5e_rep_priv *rpriv; - struct mapping_ctx *mapping; - struct mlx5_eswitch *esw; - struct mlx5e_priv *priv; -- u64 mapping_id, key; -+ u64 mapping_id; - int err = 0; - - rpriv = container_of(uplink_priv, struct mlx5e_rep_priv, uplink_priv); -@@ -5448,8 +5449,8 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - - err = dev_get_port_parent_id(priv->netdev, &ppid, false); - if (!err) { -- memcpy(&key, &ppid.id, sizeof(key)); -- mlx5_esw_offloads_devcom_init(esw, key); -+ memcpy(&attr.key.val, &ppid.id, sizeof(attr.key.val)); -+ mlx5_esw_offloads_devcom_init(esw, &attr); - } - - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 4fe285ce32aa..df3756d7e52e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -433,7 +433,8 @@ int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int num_vfs); - void mlx5_eswitch_disable_sriov(struct mlx5_eswitch *esw, bool clear_vf); - void mlx5_eswitch_disable_locked(struct mlx5_eswitch *esw); - void mlx5_eswitch_disable(struct mlx5_eswitch *esw); --void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, u64 key); -+void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, -+ const struct mlx5_devcom_match_attr *attr); - void mlx5_esw_offloads_devcom_cleanup(struct mlx5_eswitch *esw); - bool mlx5_esw_offloads_devcom_is_ready(struct mlx5_eswitch *esw); - int mlx5_eswitch_set_vport_mac(struct mlx5_eswitch *esw, -@@ -928,7 +929,9 @@ static inline void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw) {} - static inline int mlx5_eswitch_enable(struct mlx5_eswitch *esw, int num_vfs) { return 0; } - static inline void mlx5_eswitch_disable_sriov(struct mlx5_eswitch *esw, bool clear_vf) {} - static inline void mlx5_eswitch_disable(struct mlx5_eswitch *esw) {} --static inline void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, u64 key) {} -+static inline void -+mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, -+ const struct mlx5_devcom_match_attr *attr) {} - static inline void mlx5_esw_offloads_devcom_cleanup(struct mlx5_eswitch *esw) {} - static inline bool mlx5_esw_offloads_devcom_is_ready(struct mlx5_eswitch *esw) { return false; } - static inline bool mlx5_eswitch_is_funcs_handler(struct mlx5_core_dev *dev) { return false; } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index d57f86d297ab..bc9838dc5bf8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3104,7 +3104,8 @@ static int mlx5_esw_offloads_devcom_event(int event, - return err; - } - --void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, u64 key) -+void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, -+ const struct mlx5_devcom_match_attr *attr) - { - int i; - -@@ -3123,7 +3124,7 @@ void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, u64 key) - esw->num_peers = 0; - esw->devcom = mlx5_devcom_register_component(esw->dev->priv.devc, - MLX5_DEVCOM_ESW_OFFLOADS, -- key, -+ attr, - mlx5_esw_offloads_devcom_event, - esw); - if (IS_ERR(esw->devcom)) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 7ad3baca99de..8f2ad45bec9f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -1435,14 +1435,20 @@ static int mlx5_clock_alloc(struct mlx5_core_dev *mdev, bool shared) - static void mlx5_shared_clock_register(struct mlx5_core_dev *mdev, u64 key) - { - struct mlx5_core_dev *peer_dev, *next = NULL; -+ struct mlx5_devcom_match_attr attr = { -+ .key.val = key, -+ }; -+ struct mlx5_devcom_comp_dev *compd; - struct mlx5_devcom_comp_dev *pos; - -- mdev->clock_state->compdev = mlx5_devcom_register_component(mdev->priv.devc, -- MLX5_DEVCOM_SHARED_CLOCK, -- key, NULL, mdev); -- if (IS_ERR(mdev->clock_state->compdev)) -+ compd = mlx5_devcom_register_component(mdev->priv.devc, -+ MLX5_DEVCOM_SHARED_CLOCK, -+ &attr, NULL, mdev); -+ if (IS_ERR(compd)) - return; - -+ mdev->clock_state->compdev = compd; -+ - mlx5_devcom_comp_lock(mdev->clock_state->compdev); - mlx5_devcom_for_each_peer_entry(mdev->clock_state->compdev, peer_dev, pos) { - if (peer_dev->clock) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -index 7b0766c89f4c..1ab9de316deb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -@@ -22,11 +22,15 @@ struct mlx5_devcom_dev { - struct kref ref; - }; - -+struct mlx5_devcom_key { -+ union mlx5_devcom_match_key key; -+}; -+ - struct mlx5_devcom_comp { - struct list_head comp_list; - enum mlx5_devcom_component id; -- u64 key; - struct list_head comp_dev_list_head; -+ struct mlx5_devcom_key key; - mlx5_devcom_event_handler_t handler; - struct kref ref; - bool ready; -@@ -108,7 +112,8 @@ void mlx5_devcom_unregister_device(struct mlx5_devcom_dev *devc) - } - - static struct mlx5_devcom_comp * --mlx5_devcom_comp_alloc(u64 id, u64 key, mlx5_devcom_event_handler_t handler) -+mlx5_devcom_comp_alloc(u64 id, const struct mlx5_devcom_match_attr *attr, -+ mlx5_devcom_event_handler_t handler) - { - struct mlx5_devcom_comp *comp; - -@@ -117,7 +122,7 @@ mlx5_devcom_comp_alloc(u64 id, u64 key, mlx5_devcom_event_handler_t handler) - return ERR_PTR(-ENOMEM); - - comp->id = id; -- comp->key = key; -+ comp->key.key = attr->key; - comp->handler = handler; - init_rwsem(&comp->sem); - lockdep_register_key(&comp->lock_key); -@@ -180,21 +185,27 @@ devcom_free_comp_dev(struct mlx5_devcom_comp_dev *devcom) - static bool - devcom_component_equal(struct mlx5_devcom_comp *devcom, - enum mlx5_devcom_component id, -- u64 key) -+ const struct mlx5_devcom_match_attr *attr) - { -- return devcom->id == id && devcom->key == key; -+ if (devcom->id != id) -+ return false; -+ -+ if (memcmp(&devcom->key.key, &attr->key, sizeof(devcom->key.key))) -+ return false; -+ -+ return true; - } - - static struct mlx5_devcom_comp * - devcom_component_get(struct mlx5_devcom_dev *devc, - enum mlx5_devcom_component id, -- u64 key, -+ const struct mlx5_devcom_match_attr *attr, - mlx5_devcom_event_handler_t handler) - { - struct mlx5_devcom_comp *comp; - - devcom_for_each_component(comp) { -- if (devcom_component_equal(comp, id, key)) { -+ if (devcom_component_equal(comp, id, attr)) { - if (handler == comp->handler) { - kref_get(&comp->ref); - return comp; -@@ -212,7 +223,7 @@ devcom_component_get(struct mlx5_devcom_dev *devc, - struct mlx5_devcom_comp_dev * - mlx5_devcom_register_component(struct mlx5_devcom_dev *devc, - enum mlx5_devcom_component id, -- u64 key, -+ const struct mlx5_devcom_match_attr *attr, - mlx5_devcom_event_handler_t handler, - void *data) - { -@@ -223,14 +234,14 @@ mlx5_devcom_register_component(struct mlx5_devcom_dev *devc, - return ERR_PTR(-EINVAL); - - mutex_lock(&comp_list_lock); -- comp = devcom_component_get(devc, id, key, handler); -+ comp = devcom_component_get(devc, id, attr, handler); - if (IS_ERR(comp)) { - devcom = ERR_PTR(-EINVAL); - goto out_unlock; - } - - if (!comp) { -- comp = mlx5_devcom_comp_alloc(id, key, handler); -+ comp = mlx5_devcom_comp_alloc(id, attr, handler); - if (IS_ERR(comp)) { - devcom = ERR_CAST(comp); - goto out_unlock; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -index c79699b94a02..f350d2395707 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -@@ -6,6 +6,14 @@ - - #include - -+union mlx5_devcom_match_key { -+ u64 val; -+}; -+ -+struct mlx5_devcom_match_attr { -+ union mlx5_devcom_match_key key; -+}; -+ - enum mlx5_devcom_component { - MLX5_DEVCOM_ESW_OFFLOADS, - MLX5_DEVCOM_MPV, -@@ -25,7 +33,7 @@ void mlx5_devcom_unregister_device(struct mlx5_devcom_dev *devc); - struct mlx5_devcom_comp_dev * - mlx5_devcom_register_component(struct mlx5_devcom_dev *devc, - enum mlx5_devcom_component id, -- u64 key, -+ const struct mlx5_devcom_match_attr *attr, - mlx5_devcom_event_handler_t handler, - void *data); - void mlx5_devcom_unregister_component(struct mlx5_devcom_comp_dev *devcom); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -index eeb0b7ea05f1..d4015328ba65 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -@@ -210,13 +210,15 @@ static void sd_cleanup(struct mlx5_core_dev *dev) - static int sd_register(struct mlx5_core_dev *dev) - { - struct mlx5_devcom_comp_dev *devcom, *pos; -+ struct mlx5_devcom_match_attr attr = {}; - struct mlx5_core_dev *peer, *primary; - struct mlx5_sd *sd, *primary_sd; - int err, i; - - sd = mlx5_get_sd(dev); -+ attr.key.val = sd->group_id; - devcom = mlx5_devcom_register_component(dev->priv.devc, MLX5_DEVCOM_SD_GROUP, -- sd->group_id, NULL, dev); -+ &attr, NULL, dev); - if (IS_ERR(devcom)) - return PTR_ERR(devcom); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 6175aa0bbbb7..d741ec582c2c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -975,6 +975,10 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev) - - static void mlx5_register_hca_devcom_comp(struct mlx5_core_dev *dev) - { -+ struct mlx5_devcom_match_attr attr = { -+ .key.val = mlx5_query_nic_system_image_guid(dev), -+ }; -+ - /* This component is use to sync adding core_dev to lag_dev and to sync - * changes of mlx5_adev_devices between LAG layer and other layers. - */ -@@ -983,8 +987,7 @@ static void mlx5_register_hca_devcom_comp(struct mlx5_core_dev *dev) - - dev->priv.hca_devcom_comp = - mlx5_devcom_register_component(dev->priv.devc, MLX5_DEVCOM_HCA_PORTS, -- mlx5_query_nic_system_image_guid(dev), -- NULL, dev); -+ &attr, NULL, dev); - if (IS_ERR(dev->priv.hca_devcom_comp)) - mlx5_core_err(dev, "Failed to register devcom HCA component\n"); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1535-net-mlx5-lag-move-devcom-registration-to-lag-layer.patch b/SOURCES/1535-net-mlx5-lag-move-devcom-registration-to-lag-layer.patch deleted file mode 100644 index ee0323272..000000000 --- a/SOURCES/1535-net-mlx5-lag-move-devcom-registration-to-lag-layer.patch +++ /dev/null @@ -1,145 +0,0 @@ -From 105bbeb8900edbce45170c99c9b9456925b2ea85 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Lag, move devcom registration to LAG layer - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5a977b5833b7a261bfa6094595ffa73c1071588c -Author: Shay Drory -Date: Mon Sep 15 15:41:08 2025 +0300 - - net/mlx5: Lag, move devcom registration to LAG layer - - Move the devcom registration for the HCA_PORTS component from the core - initialization path into the LAG logic. This better reflects the logical - ownership of this component and ensures proper alignment with the LAG - lifecycle. - - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757940070-618661-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index d058cbb4a00c..ccb22ed13f84 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -1404,6 +1404,34 @@ static int __mlx5_lag_dev_add_mdev(struct mlx5_core_dev *dev) - return 0; - } - -+static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev) -+{ -+ mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp); -+} -+ -+static int mlx5_lag_register_hca_devcom_comp(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_devcom_match_attr attr = { -+ .key.val = mlx5_query_nic_system_image_guid(dev), -+ }; -+ -+ /* This component is use to sync adding core_dev to lag_dev and to sync -+ * changes of mlx5_adev_devices between LAG layer and other layers. -+ */ -+ dev->priv.hca_devcom_comp = -+ mlx5_devcom_register_component(dev->priv.devc, -+ MLX5_DEVCOM_HCA_PORTS, -+ &attr, NULL, dev); -+ if (IS_ERR(dev->priv.hca_devcom_comp)) { -+ mlx5_core_err(dev, -+ "Failed to register devcom HCA component, err: %ld\n", -+ PTR_ERR(dev->priv.hca_devcom_comp)); -+ return PTR_ERR(dev->priv.hca_devcom_comp); -+ } -+ -+ return 0; -+} -+ - void mlx5_lag_remove_mdev(struct mlx5_core_dev *dev) - { - struct mlx5_lag *ldev; -@@ -1425,6 +1453,7 @@ void mlx5_lag_remove_mdev(struct mlx5_core_dev *dev) - } - mlx5_ldev_remove_mdev(ldev, dev); - mutex_unlock(&ldev->lock); -+ mlx5_lag_unregister_hca_devcom_comp(dev); - mlx5_ldev_put(ldev); - } - -@@ -1435,7 +1464,7 @@ void mlx5_lag_add_mdev(struct mlx5_core_dev *dev) - if (!mlx5_lag_is_supported(dev)) - return; - -- if (IS_ERR_OR_NULL(dev->priv.hca_devcom_comp)) -+ if (mlx5_lag_register_hca_devcom_comp(dev)) - return; - - recheck: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index d741ec582c2c..00fe79878c4f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -973,30 +973,6 @@ static void mlx5_pci_close(struct mlx5_core_dev *dev) - mlx5_pci_disable_device(dev); - } - --static void mlx5_register_hca_devcom_comp(struct mlx5_core_dev *dev) --{ -- struct mlx5_devcom_match_attr attr = { -- .key.val = mlx5_query_nic_system_image_guid(dev), -- }; -- -- /* This component is use to sync adding core_dev to lag_dev and to sync -- * changes of mlx5_adev_devices between LAG layer and other layers. -- */ -- if (!mlx5_lag_is_supported(dev)) -- return; -- -- dev->priv.hca_devcom_comp = -- mlx5_devcom_register_component(dev->priv.devc, MLX5_DEVCOM_HCA_PORTS, -- &attr, NULL, dev); -- if (IS_ERR(dev->priv.hca_devcom_comp)) -- mlx5_core_err(dev, "Failed to register devcom HCA component\n"); --} -- --static void mlx5_unregister_hca_devcom_comp(struct mlx5_core_dev *dev) --{ -- mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp); --} -- - static int mlx5_init_once(struct mlx5_core_dev *dev) - { - int err; -@@ -1005,7 +981,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - if (IS_ERR(dev->priv.devc)) - mlx5_core_warn(dev, "failed to register devcom device %ld\n", - PTR_ERR(dev->priv.devc)); -- mlx5_register_hca_devcom_comp(dev); - - err = mlx5_query_board_id(dev); - if (err) { -@@ -1143,7 +1118,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - err_irq_cleanup: - mlx5_irq_table_cleanup(dev); - err_devcom: -- mlx5_unregister_hca_devcom_comp(dev); - mlx5_devcom_unregister_device(dev->priv.devc); - - return err; -@@ -1174,7 +1148,6 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev) - mlx5_events_cleanup(dev); - mlx5_eq_table_cleanup(dev); - mlx5_irq_table_cleanup(dev); -- mlx5_unregister_hca_devcom_comp(dev); - mlx5_devcom_unregister_device(dev->priv.devc); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1536-net-mlx5-add-net-namespace-support-to-devcom.patch b/SOURCES/1536-net-mlx5-add-net-namespace-support-to-devcom.patch deleted file mode 100644 index 50b517e53..000000000 --- a/SOURCES/1536-net-mlx5-add-net-namespace-support-to-devcom.patch +++ /dev/null @@ -1,149 +0,0 @@ -From 18400abe1a3e9946faafbe52a16ac08dfbd4a63c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Add net namespace support to devcom - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 95f73447c269e196dc149bece65b2d83cdb42b08 -Author: Shay Drory -Date: Mon Sep 15 15:41:09 2025 +0300 - - net/mlx5: Add net namespace support to devcom - - Extend the devcom framework to support namespace-aware components. - - The existing devcom matching logic was based solely on numeric keys, - limiting its use to the global (init_net) scope or requiring clients to - ignore namespaces altogether, both of which are incorrect in - multi-namespace environments. - - This patch introduces namespace support by allowing devcom clients to - provide a namespace match attribute. The devcom pairing mechanism is - updated to compare the namespace, enabling proper isolation and - interaction of components across different net namespaces. - - With this change, components that require namespace aware pairing, such - as SD groups or LAG, can now work correctly in multi-namespace - scenarios. In particular, this opens the way to support hardware LAG - within a net namespace. - - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Reviewed-by: Parav Pandit - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757940070-618661-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index ffa5749df587..1ddefeeeca01 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -66,6 +66,7 @@ - #include "lib/devcom.h" - #include "lib/geneve.h" - #include "lib/fs_chains.h" -+#include "lib/mlx5.h" - #include "diag/en_tc_tracepoint.h" - #include - #include "lag/lag.h" -@@ -5450,6 +5451,8 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - err = dev_get_port_parent_id(priv->netdev, &ppid, false); - if (!err) { - memcpy(&attr.key.val, &ppid.id, sizeof(attr.key.val)); -+ attr.flags = MLX5_DEVCOM_MATCH_FLAGS_NS; -+ attr.net = mlx5_core_net(esw->dev); - mlx5_esw_offloads_devcom_init(esw, &attr); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -index 1ab9de316deb..faa2833602c8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -@@ -4,6 +4,7 @@ - #include - #include - #include "lib/devcom.h" -+#include "lib/mlx5.h" - #include "mlx5_core.h" - - static LIST_HEAD(devcom_dev_list); -@@ -23,7 +24,9 @@ struct mlx5_devcom_dev { - }; - - struct mlx5_devcom_key { -+ u32 flags; - union mlx5_devcom_match_key key; -+ possible_net_t net; - }; - - struct mlx5_devcom_comp { -@@ -123,6 +126,9 @@ mlx5_devcom_comp_alloc(u64 id, const struct mlx5_devcom_match_attr *attr, - - comp->id = id; - comp->key.key = attr->key; -+ comp->key.flags = attr->flags; -+ if (attr->flags & MLX5_DEVCOM_MATCH_FLAGS_NS) -+ write_pnet(&comp->key.net, attr->net); - comp->handler = handler; - init_rwsem(&comp->sem); - lockdep_register_key(&comp->lock_key); -@@ -190,9 +196,16 @@ devcom_component_equal(struct mlx5_devcom_comp *devcom, - if (devcom->id != id) - return false; - -+ if (devcom->key.flags != attr->flags) -+ return false; -+ - if (memcmp(&devcom->key.key, &attr->key, sizeof(devcom->key.key))) - return false; - -+ if (devcom->key.flags & MLX5_DEVCOM_MATCH_FLAGS_NS && -+ !net_eq(read_pnet(&devcom->key.net), attr->net)) -+ return false; -+ - return true; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -index f350d2395707..609c85f47917 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -@@ -6,12 +6,18 @@ - - #include - -+enum mlx5_devom_match_flags { -+ MLX5_DEVCOM_MATCH_FLAGS_NS = BIT(0), -+}; -+ - union mlx5_devcom_match_key { - u64 val; - }; - - struct mlx5_devcom_match_attr { -+ u32 flags; - union mlx5_devcom_match_key key; -+ struct net *net; - }; - - enum mlx5_devcom_component { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -index d4015328ba65..f5c2701f6e87 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -@@ -217,6 +217,8 @@ static int sd_register(struct mlx5_core_dev *dev) - - sd = mlx5_get_sd(dev); - attr.key.val = sd->group_id; -+ attr.flags = MLX5_DEVCOM_MATCH_FLAGS_NS; -+ attr.net = mlx5_core_net(dev); - devcom = mlx5_devcom_register_component(dev->priv.devc, MLX5_DEVCOM_SD_GROUP, - &attr, NULL, dev); - if (IS_ERR(devcom)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1537-net-mlx5-lag-add-net-namespace-support.patch b/SOURCES/1537-net-mlx5-lag-add-net-namespace-support.patch deleted file mode 100644 index 4eb22caf8..000000000 --- a/SOURCES/1537-net-mlx5-lag-add-net-namespace-support.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 897f77f80756b9168173416e0e6b1dbc0308a4f2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Lag, add net namespace support -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d654d3fc2066c40586fa3b0538c0bf093e20b817 -Author: Shay Drory -Date: Mon Sep 15 15:41:10 2025 +0300 - - net/mlx5: Lag, add net namespace support - - Update the LAG implementation to support net namespace isolation. - Recent devcom changes added namespace-aware client matching. Align LAG - with this model so that hardware LAG forms only between mlx5 interfaces - that share the same network namespace. This avoids cross-namespace - interference and matches user expectations when devices are placed in - different netns. - - Make LAG netns-aware by storing the device’s namespace in mlx5_lag and - registering the devcom client with that namespace. As a result, only - peers in the same netns are eligible to form a LAG. - Adjust reload handling so LAG teardown/re-evaluation happens in the - correct namespace context. Remove the blanket restriction that prevented - devlink reload when LAG was active. Remove the reload restriction here - allowing devlink reload in LAG mode is part of delivering complete netns - aware LAG support: - - With per-netns devcom registration, reload no longer risks - cross-namespace coupling. The devcom client is torn down and - re-registered in the device’s current netns, and LAG is re-evaluated - within that scope. The change is trivial and self-contained, and keeping - it in this patch avoids splitting a feature that is functionally one - unit. - - Only devices in same netns can form hardware LAG. - devlink reload no longer fails just because LAG is active. - LAG is torn down/re-created as needed within the correct namespace. - No change for setups that don’t use namespaces. - - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Reviewed-by: Parav Pandit - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757940070-618661-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index e900451643a3..18ef8404e5e6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -204,11 +204,6 @@ static int mlx5_devlink_reload_down(struct devlink *devlink, bool netns_change, - return 0; - } - -- if (mlx5_lag_is_active(dev)) { -- NL_SET_ERR_MSG_MOD(extack, "reload is unsupported in Lag mode"); -- return -EOPNOTSUPP; -- } -- - if (mlx5_core_is_mp_slave(dev)) { - NL_SET_ERR_MSG_MOD(extack, "reload is unsupported for multi port slave"); - return -EOPNOTSUPP; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index ccb22ed13f84..59c00c911275 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include "lib/mlx5.h" - #include "lib/devcom.h" - #include "mlx5_core.h" - #include "eswitch.h" -@@ -231,9 +232,13 @@ static void mlx5_do_bond_work(struct work_struct *work); - static void mlx5_ldev_free(struct kref *ref) - { - struct mlx5_lag *ldev = container_of(ref, struct mlx5_lag, ref); -+ struct net *net; -+ -+ if (ldev->nb.notifier_call) { -+ net = read_pnet(&ldev->net); -+ unregister_netdevice_notifier_net(net, &ldev->nb); -+ } - -- if (ldev->nb.notifier_call) -- unregister_netdevice_notifier_net(&init_net, &ldev->nb); - mlx5_lag_mp_cleanup(ldev); - cancel_delayed_work_sync(&ldev->bond_work); - destroy_workqueue(ldev->wq); -@@ -271,7 +276,8 @@ static struct mlx5_lag *mlx5_lag_dev_alloc(struct mlx5_core_dev *dev) - INIT_DELAYED_WORK(&ldev->bond_work, mlx5_do_bond_work); - - ldev->nb.notifier_call = mlx5_lag_netdev_event; -- if (register_netdevice_notifier_net(&init_net, &ldev->nb)) { -+ write_pnet(&ldev->net, mlx5_core_net(dev)); -+ if (register_netdevice_notifier_net(read_pnet(&ldev->net), &ldev->nb)) { - ldev->nb.notifier_call = NULL; - mlx5_core_err(dev, "Failed to register LAG netdev notifier\n"); - } -@@ -1413,6 +1419,8 @@ static int mlx5_lag_register_hca_devcom_comp(struct mlx5_core_dev *dev) - { - struct mlx5_devcom_match_attr attr = { - .key.val = mlx5_query_nic_system_image_guid(dev), -+ .flags = MLX5_DEVCOM_MATCH_FLAGS_NS, -+ .net = mlx5_core_net(dev), - }; - - /* This component is use to sync adding core_dev to lag_dev and to sync -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -index c2f256bb2bc2..4918eee2b3da 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.h -@@ -67,6 +67,7 @@ struct mlx5_lag { - struct workqueue_struct *wq; - struct delayed_work bond_work; - struct notifier_block nb; -+ possible_net_t net; - struct lag_mp lag_mp; - struct mlx5_lag_port_sel port_sel; - /* Protect lag fields/state changes */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1538-net-mlx5-remove-vlan-insertion-fields-from-wqe-ether-segment.patch b/SOURCES/1538-net-mlx5-remove-vlan-insertion-fields-from-wqe-ether-segment.patch deleted file mode 100644 index 28aaade42..000000000 --- a/SOURCES/1538-net-mlx5-remove-vlan-insertion-fields-from-wqe-ether-segment.patch +++ /dev/null @@ -1,56 +0,0 @@ -From e83fb12bba4582bf6f10d745f8abe0a64d49bab6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Remove VLAN insertion fields from WQE Ether segment - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit de2be98541dbe0de58d2dccf7fa19dfc9d9a8260 -Author: Carolina Jubran -Date: Thu Sep 11 10:10:17 2025 +0300 - - net/mlx5: Remove VLAN insertion fields from WQE Ether segment - - Now that the driver no longer uses VLAN TX insertion via the WQE - Ethernet segment, the related fields and flags can be removed. - - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757574619-604874-2-git-send-email-tariqt@nvidia.com - Reviewed-by: Simon Horman - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h -index fc7eeff99a8a..5546c7bd2c83 100644 ---- a/include/linux/mlx5/qp.h -+++ b/include/linux/mlx5/qp.h -@@ -237,13 +237,11 @@ enum { - }; - - enum { -- MLX5_ETH_WQE_SVLAN = 1 << 0, - MLX5_ETH_WQE_TRAILER_HDR_OUTER_IP_ASSOC = 1 << 26, - MLX5_ETH_WQE_TRAILER_HDR_OUTER_L4_ASSOC = 1 << 27, - MLX5_ETH_WQE_TRAILER_HDR_INNER_IP_ASSOC = 3 << 26, - MLX5_ETH_WQE_TRAILER_HDR_INNER_L4_ASSOC = 1 << 28, - MLX5_ETH_WQE_INSERT_TRAILER = 1 << 30, -- MLX5_ETH_WQE_INSERT_VLAN = 1 << 15, - }; - - enum { -@@ -275,10 +273,6 @@ struct mlx5_wqe_eth_seg { - DECLARE_FLEX_ARRAY(u8, data); - }; - } inline_hdr; -- struct { -- __be16 type; -- __be16 vlan_tci; -- } insert; - __be32 trailer; - }; - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1539-net-mlx5-refactor-macsec-wqe-metadata-shifts.patch b/SOURCES/1539-net-mlx5-refactor-macsec-wqe-metadata-shifts.patch deleted file mode 100644 index f1f46b9e5..000000000 --- a/SOURCES/1539-net-mlx5-refactor-macsec-wqe-metadata-shifts.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 7fa18c8f4a6bc955619d779d0d26bee794b04c3b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:58 -0400 -Subject: [PATCH] net/mlx5: Refactor MACsec WQE metadata shifts -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cce65f32443b61db2370a67d2e92d16b773fe8a4 -Author: Carolina Jubran -Date: Thu Sep 11 10:10:18 2025 +0300 - - net/mlx5: Refactor MACsec WQE metadata shifts - - Introduce MLX5_ETH_WQE_FT_META_SHIFT as a shared base offset for - features that use the lower 8 bits of the WQE flow_table_metadata - field, currently used for timestamping, IPsec, and MACsec. - - Define MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK so that fs_id occupies - bits 2–5, making it clear that fs_id occupies bits in the metadata. - - Set MLX5_ETH_WQE_FT_META_MACSEC_MASK as the OR of the MACsec flag and - MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK, corresponding to the original - 0x3E mask. - - Update the fs_id macro to right-shift the MACsec flag by - MLX5_ETH_WQE_FT_META_SHIFT and update the RoCE modify-header action to - use it. - - Introduce the helper macro MLX5_MACSEC_TX_METADATA(fs_id) to compose - the full shifted MACsec metadata value. - - These changes make it explicit exactly which metadata bits carry MACsec - information, simplifying future feature exclusions when multiple - features share the WQE flowtable metadata. - - In addition, drop the incorrect “RX flow steering” comment, since this - applies to TX flow steering. - - Signed-off-by: Carolina Jubran - Reviewed-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757574619-604874-3-git-send-email-tariqt@nvidia.com - Reviewed-by: Simon Horman - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -index 6ab02f3fc291..528b04d4de41 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/macsec.c -@@ -1676,7 +1676,7 @@ void mlx5e_macsec_tx_build_eseg(struct mlx5e_macsec *macsec, - if (!fs_id) - return; - -- eseg->flow_table_metadata = cpu_to_be32(MLX5_ETH_WQE_FT_META_MACSEC | fs_id << 2); -+ eseg->flow_table_metadata = cpu_to_be32(MLX5_MACSEC_TX_METADATA(fs_id)); - } - - void mlx5e_macsec_offload_handle_rx_skb(struct net_device *netdev, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -index 762d55ba9e51..9ec450603176 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -@@ -45,11 +45,7 @@ - #define MLX5_SECTAG_HEADER_SIZE_WITHOUT_SCI 0x8 - #define MLX5_SECTAG_HEADER_SIZE_WITH_SCI (MLX5_SECTAG_HEADER_SIZE_WITHOUT_SCI + MACSEC_SCI_LEN) - --/* MACsec RX flow steering */ --#define MLX5_ETH_WQE_FT_META_MACSEC_MASK 0x3E -- - /* MACsec fs_id handling for steering */ --#define macsec_fs_set_tx_fs_id(fs_id) (MLX5_ETH_WQE_FT_META_MACSEC | (fs_id) << 2) - #define macsec_fs_set_rx_fs_id(fs_id) ((fs_id) | BIT(30)) - - struct mlx5_sectag_header { -@@ -597,7 +593,7 @@ static int macsec_fs_tx_setup_fte(struct mlx5_macsec_fs *macsec_fs, - MLX5_SET(fte_match_param, spec->match_criteria, misc_parameters_2.metadata_reg_a, - MLX5_ETH_WQE_FT_META_MACSEC_MASK); - MLX5_SET(fte_match_param, spec->match_value, misc_parameters_2.metadata_reg_a, -- macsec_fs_set_tx_fs_id(id)); -+ MLX5_MACSEC_TX_METADATA(id)); - - *fs_id = id; - flow_act->crypto.type = MLX5_FLOW_CONTEXT_ENCRYPT_DECRYPT_TYPE_MACSEC; -@@ -2219,8 +2215,10 @@ static int mlx5_macsec_fs_add_roce_rule_tx(struct mlx5_macsec_fs *macsec_fs, u32 - - MLX5_SET(set_action_in, action, action_type, MLX5_ACTION_TYPE_SET); - MLX5_SET(set_action_in, action, field, MLX5_ACTION_IN_FIELD_METADATA_REG_A); -- MLX5_SET(set_action_in, action, data, macsec_fs_set_tx_fs_id(fs_id)); -- MLX5_SET(set_action_in, action, offset, 0); -+ MLX5_SET(set_action_in, action, data, -+ mlx5_macsec_fs_set_tx_fs_id(fs_id)); -+ MLX5_SET(set_action_in, action, offset, -+ MLX5_ETH_WQE_FT_META_MACSEC_SHIFT); - MLX5_SET(set_action_in, action, length, 32); - - modify_hdr = mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_RDMA_TX_MACSEC, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h -index 34b80c3ef6a5..15acaff43641 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.h -@@ -12,6 +12,21 @@ - #define MLX5_MACSEC_METADATA_MARKER(metadata) ((((metadata) >> 30) & 0x3) == 0x1) - #define MLX5_MACSEC_RX_METADAT_HANDLE(metadata) ((metadata) & MLX5_MACSEC_RX_FS_ID_MASK) - -+/* MACsec TX flow steering */ -+#define MLX5_ETH_WQE_FT_META_MACSEC_MASK \ -+ (MLX5_ETH_WQE_FT_META_MACSEC | MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK) -+#define MLX5_ETH_WQE_FT_META_MACSEC_SHIFT MLX5_ETH_WQE_FT_META_SHIFT -+ -+/* MACsec fs_id handling for steering */ -+#define mlx5_macsec_fs_set_tx_fs_id(fs_id) \ -+ (((MLX5_ETH_WQE_FT_META_MACSEC) >> MLX5_ETH_WQE_FT_META_MACSEC_SHIFT) \ -+ | ((fs_id) << 2)) -+ -+#define MLX5_MACSEC_TX_METADATA(fs_id) \ -+ (mlx5_macsec_fs_set_tx_fs_id(fs_id) << \ -+ MLX5_ETH_WQE_FT_META_MACSEC_SHIFT) -+ -+/* MACsec fs_id uses 4 bits, supports up to 16 interfaces */ - #define MLX5_MACSEC_NUM_OF_SUPPORTED_INTERFACES 16 - - struct mlx5_macsec_fs; -diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h -index 5546c7bd2c83..b21be7630575 100644 ---- a/include/linux/mlx5/qp.h -+++ b/include/linux/mlx5/qp.h -@@ -251,9 +251,14 @@ enum { - MLX5_ETH_WQE_SWP_OUTER_L4_UDP = 1 << 5, - }; - -+/* Base shift for metadata bits used by timestamping, IPsec, and MACsec */ -+#define MLX5_ETH_WQE_FT_META_SHIFT 0 -+ - enum { -- MLX5_ETH_WQE_FT_META_IPSEC = BIT(0), -- MLX5_ETH_WQE_FT_META_MACSEC = BIT(1), -+ MLX5_ETH_WQE_FT_META_IPSEC = BIT(0) << MLX5_ETH_WQE_FT_META_SHIFT, -+ MLX5_ETH_WQE_FT_META_MACSEC = BIT(1) << MLX5_ETH_WQE_FT_META_SHIFT, -+ MLX5_ETH_WQE_FT_META_MACSEC_FS_ID_MASK = -+ GENMASK(5, 2) << MLX5_ETH_WQE_FT_META_SHIFT, - }; - - struct mlx5_wqe_eth_seg { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1540-net-mlx5e-prevent-wqe-metadata-conflicts-between-timestampin.patch b/SOURCES/1540-net-mlx5e-prevent-wqe-metadata-conflicts-between-timestampin.patch deleted file mode 100644 index d3d939d36..000000000 --- a/SOURCES/1540-net-mlx5e-prevent-wqe-metadata-conflicts-between-timestampin.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 3cc63348aa2158c664d92a20ee1ca8a6ed9fada3 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:59 -0400 -Subject: [PATCH] net/mlx5e: Prevent WQE metadata conflicts between - timestamping and offloads - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2ac207381c37eebc49559634ce5642119784bc7c -Author: Carolina Jubran -Date: Thu Sep 11 10:10:19 2025 +0300 - - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads - - Update the WQE metadata assignment to avoid overriding existing - metadata when setting the sysport timestamp ID. Since timestamp IDs are - limited to 256 values, they use only the lower 8 bits of the metadata - field. - - To avoid conflicts, move IPsec and MACsec metadata ID to bits 8 and 9, - and shift the MACsec fs_id accordingly. This ensures safe coexistence - of timestamping and offload features that use the same metadata field. - - Signed-off-by: Carolina Jubran - Reviewed-by: Jianbo Liu - Reviewed-by: Patrisious Haddad - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1757574619-604874-4-git-send-email-tariqt@nvidia.com - Reviewed-by: Simon Horman - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -index e6a301ba3254..7ffc1cc7aa7d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -@@ -653,7 +653,7 @@ static void mlx5e_cqe_ts_id_eseg(struct mlx5e_ptpsq *ptpsq, struct sk_buff *skb, - struct mlx5_wqe_eth_seg *eseg) - { - if (unlikely(skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP)) -- eseg->flow_table_metadata = -+ eseg->flow_table_metadata |= - cpu_to_be32(mlx5e_ptp_metadata_fifo_peek(&ptpsq->metadata_freelist)); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -index 9ec450603176..e6be2f01daf4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/macsec_fs.c -@@ -2219,7 +2219,7 @@ static int mlx5_macsec_fs_add_roce_rule_tx(struct mlx5_macsec_fs *macsec_fs, u32 - mlx5_macsec_fs_set_tx_fs_id(fs_id)); - MLX5_SET(set_action_in, action, offset, - MLX5_ETH_WQE_FT_META_MACSEC_SHIFT); -- MLX5_SET(set_action_in, action, length, 32); -+ MLX5_SET(set_action_in, action, length, 8); - - modify_hdr = mlx5_modify_header_alloc(mdev, MLX5_FLOW_NAMESPACE_RDMA_TX_MACSEC, - 1, action); -diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h -index b21be7630575..d67aedc6ea68 100644 ---- a/include/linux/mlx5/qp.h -+++ b/include/linux/mlx5/qp.h -@@ -251,8 +251,9 @@ enum { - MLX5_ETH_WQE_SWP_OUTER_L4_UDP = 1 << 5, - }; - --/* Base shift for metadata bits used by timestamping, IPsec, and MACsec */ --#define MLX5_ETH_WQE_FT_META_SHIFT 0 -+/* Metadata bits 0-7 are used by timestamping */ -+/* Base shift for metadata bits used by IPsec and MACsec */ -+#define MLX5_ETH_WQE_FT_META_SHIFT 8 - - enum { - MLX5_ETH_WQE_FT_META_IPSEC = BIT(0) << MLX5_ETH_WQE_FT_META_SHIFT, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1541-net-mlx5-fix-typo-of-mlx5-eq-doorbel-offset.patch b/SOURCES/1541-net-mlx5-fix-typo-of-mlx5-eq-doorbel-offset.patch deleted file mode 100644 index 750841555..000000000 --- a/SOURCES/1541-net-mlx5-fix-typo-of-mlx5-eq-doorbel-offset.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 509e1b64bb19abbd0d572d08c99d67f04a341c06 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:59 -0400 -Subject: [PATCH] net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 917449e7c3cdc7a0dfe429de997e39098d9cdd20 -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:35 2025 +0300 - - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET - - Also convert it to a simple define. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -index 1ab77159409d..f3c714ebd9cb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -@@ -32,9 +32,7 @@ enum { - MLX5_EQ_STATE_ALWAYS_ARMED = 0xb, - }; - --enum { -- MLX5_EQ_DOORBEL_OFFSET = 0x40, --}; -+#define MLX5_EQ_DOORBELL_OFFSET 0x40 - - /* budget must be smaller than MLX5_NUM_SPARE_EQE to guarantee that we update - * the ci before we polled all the entries in the EQ. MLX5_NUM_SPARE_EQE is -@@ -322,7 +320,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, - eq->eqn = MLX5_GET(create_eq_out, out, eq_number); - eq->irqn = pci_irq_vector(dev->pdev, vecidx); - eq->dev = dev; -- eq->doorbell = priv->uar->map + MLX5_EQ_DOORBEL_OFFSET; -+ eq->doorbell = priv->uar->map + MLX5_EQ_DOORBELL_OFFSET; - - err = mlx5_debug_eq_add(dev, eq); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1542-net-mlx5-remove-unused-offset-field-from-mlx5-sq-bfreg.patch b/SOURCES/1542-net-mlx5-remove-unused-offset-field-from-mlx5-sq-bfreg.patch deleted file mode 100644 index 201944208..000000000 --- a/SOURCES/1542-net-mlx5-remove-unused-offset-field-from-mlx5-sq-bfreg.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 7fe95ab6c8a811f699662290775101f52aec8242 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:59 -0400 -Subject: [PATCH] net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 05dfe654b5932322e297aba11dd6f3f26eea6ecb -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:36 2025 +0300 - - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg - - The 'offset' field was introduced in the original commit [1] and never - used until commit [2], which added an unnecessary use. - - Remove the field and refactor the write-combining test to use a local - variable instead. - - [1] commit a6d51b68611e ("net/mlx5: Introduce blue flame register - allocator") - [2] commit d98995b4bf98 ("net/mlx5: Reimplement write combining test") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wc.c b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -index 2f0316616fa4..276594586404 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/wc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -@@ -255,7 +255,8 @@ static void mlx5_wc_destroy_sq(struct mlx5_wc_sq *sq) - mlx5_wq_destroy(&sq->wq_ctrl); - } - --static void mlx5_wc_post_nop(struct mlx5_wc_sq *sq, bool signaled) -+static void mlx5_wc_post_nop(struct mlx5_wc_sq *sq, unsigned int *offset, -+ bool signaled) - { - int buf_size = (1 << MLX5_CAP_GEN(sq->cq.mdev, log_bf_reg_size)) / 2; - struct mlx5_wqe_ctrl_seg *ctrl; -@@ -288,10 +289,10 @@ static void mlx5_wc_post_nop(struct mlx5_wc_sq *sq, bool signaled) - */ - wmb(); - -- __iowrite64_copy(sq->bfreg.map + sq->bfreg.offset, mmio_wqe, -+ __iowrite64_copy(sq->bfreg.map + *offset, mmio_wqe, - sizeof(mmio_wqe) / 8); - -- sq->bfreg.offset ^= buf_size; -+ *offset ^= buf_size; - } - - static int mlx5_wc_poll_cq(struct mlx5_wc_sq *sq) -@@ -332,6 +333,7 @@ static int mlx5_wc_poll_cq(struct mlx5_wc_sq *sq) - - static void mlx5_core_test_wc(struct mlx5_core_dev *mdev) - { -+ unsigned int offset = 0; - unsigned long expires; - struct mlx5_wc_sq *sq; - int i, err; -@@ -358,9 +360,9 @@ static void mlx5_core_test_wc(struct mlx5_core_dev *mdev) - goto err_create_sq; - - for (i = 0; i < TEST_WC_NUM_WQES - 1; i++) -- mlx5_wc_post_nop(sq, false); -+ mlx5_wc_post_nop(sq, &offset, false); - -- mlx5_wc_post_nop(sq, true); -+ mlx5_wc_post_nop(sq, &offset, true); - - expires = jiffies + TEST_WC_POLLING_MAX_TIME_JIFFIES; - do { -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index c5106eb8b413..c94d8828aa67 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -434,7 +434,6 @@ struct mlx5_sq_bfreg { - struct mlx5_uars_page *up; - bool wc; - u32 index; -- unsigned int offset; - }; - - struct mlx5_core_health { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1543-net-mlx5e-remove-unused-xsk-param-of-mlx5e-build-xdpsq-param.patch b/SOURCES/1543-net-mlx5e-remove-unused-xsk-param-of-mlx5e-build-xdpsq-param.patch deleted file mode 100644 index b149ac622..000000000 --- a/SOURCES/1543-net-mlx5e-remove-unused-xsk-param-of-mlx5e-build-xdpsq-param.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 66b4853aad07eca8de84bdaa5e730cad6ec93dd7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:59 -0400 -Subject: [PATCH] net/mlx5e: Remove unused 'xsk' param of - mlx5e_build_xdpsq_param - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 913d28f8a71cd8e38d6d788c70643f5a71507400 -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:37 2025 +0300 - - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param - - This was added in commit [1], but its only use removed in commit [2]. - The parameter is unused, so remove it from the function parameter list. - - [1] commit 9ded70fa1d81 ("net/mlx5e: Don't prefill WQEs in XDP SQ in the - multi buffer mode") - [2] commit 1a9304859b3a ("net/mlx5: XDP, Enable TX side XDP multi-buffer - support") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 3cca06a74cf9..31e7f59bc19b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -1229,7 +1229,6 @@ static void mlx5e_build_async_icosq_param(struct mlx5_core_dev *mdev, - - void mlx5e_build_xdpsq_param(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, -- struct mlx5e_xsk_param *xsk, - struct mlx5e_sq_param *param) - { - void *sqc = param->sqc; -@@ -1256,7 +1255,7 @@ int mlx5e_build_channel_param(struct mlx5_core_dev *mdev, - async_icosq_log_wq_sz = mlx5e_build_async_icosq_log_wq_sz(mdev); - - mlx5e_build_sq_param(mdev, params, &cparam->txq_sq); -- mlx5e_build_xdpsq_param(mdev, params, NULL, &cparam->xdp_sq); -+ mlx5e_build_xdpsq_param(mdev, params, &cparam->xdp_sq); - mlx5e_build_icosq_param(mdev, icosq_log_wq_sz, &cparam->icosq); - mlx5e_build_async_icosq_param(mdev, async_icosq_log_wq_sz, &cparam->async_icosq); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -index 488ccdbc1e2c..e3edf79dde5f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -@@ -132,7 +132,6 @@ void mlx5e_build_tx_cq_param(struct mlx5_core_dev *mdev, - struct mlx5e_cq_param *param); - void mlx5e_build_xdpsq_param(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, -- struct mlx5e_xsk_param *xsk, - struct mlx5e_sq_param *param); - int mlx5e_build_channel_param(struct mlx5_core_dev *mdev, - struct mlx5e_params *params, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -index d743e823362a..dbd88eb5c082 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -@@ -54,7 +54,7 @@ static void mlx5e_build_xsk_cparam(struct mlx5_core_dev *mdev, - struct mlx5e_channel_param *cparam) - { - mlx5e_build_rq_param(mdev, params, xsk, &cparam->rq); -- mlx5e_build_xdpsq_param(mdev, params, xsk, &cparam->xdp_sq); -+ mlx5e_build_xdpsq_param(mdev, params, &cparam->xdp_sq); - } - - static int mlx5e_init_xsk_rq(struct mlx5e_channel *c, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1544-net-mlx5-store-the-global-doorbell-in-mlx5-priv.patch b/SOURCES/1544-net-mlx5-store-the-global-doorbell-in-mlx5-priv.patch deleted file mode 100644 index cf5518c2e..000000000 --- a/SOURCES/1544-net-mlx5-store-the-global-doorbell-in-mlx5-priv.patch +++ /dev/null @@ -1,371 +0,0 @@ -From efdec7d57b38f8166d2270d527a7eb2189382893 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:20:59 -0400 -Subject: [PATCH] net/mlx5: Store the global doorbell in mlx5_priv - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit aa4595d0ada65d5d44fa924a42a87c175d9d88e3 -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:38 2025 +0300 - - net/mlx5: Store the global doorbell in mlx5_priv - - The global doorbell is used for more than just Ethernet resources, so - move it out of mlx5e_hw_objs into a common place (mlx5_priv), to avoid - non-Ethernet modules (e.g. HWS, ASO) depending on Ethernet structs. - - Use this opportunity to consolidate it with the 'uar' pointer already - there, which was used as an RX doorbell. Underneath the 'uar' pointer is - identical to 'bfreg->up', so store a single resource and use that - instead. - - For CQ doorbells, care is taken to always use bfreg->up->index instead - of bfreg->index, which may refer to a subsequent UAR page from the same - ALLOC_UAR batch on some NICs. - - This paves the way for cleanly supporting multiple doorbells in the - Ethernet driver. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index 78cd3151f2ed..f23eb22e98ff 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -645,7 +645,7 @@ int mlx5_ib_arm_cq(struct ib_cq *ibcq, enum ib_cq_notify_flags flags) - { - struct mlx5_core_dev *mdev = to_mdev(ibcq->device)->mdev; - struct mlx5_ib_cq *cq = to_mcq(ibcq); -- void __iomem *uar_page = mdev->priv.uar->map; -+ void __iomem *uar_page = mdev->priv.bfreg.up->map; - unsigned long irq_flags; - int ret = 0; - -@@ -920,7 +920,7 @@ static int create_cq_kernel(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, - cq->buf.frag_buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - -- *index = dev->mdev->priv.uar->index; -+ *index = dev->mdev->priv.bfreg.up->index; - - return 0; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cq.c b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -index 1fd403713baf..35039a95dcfd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -@@ -145,7 +145,7 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, - mlx5_core_dbg(dev, "failed adding CP 0x%x to debug file system\n", - cq->cqn); - -- cq->uar = dev->priv.uar; -+ cq->uar = dev->priv.bfreg.up; - cq->irqn = eq->core.irqn; - - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 31e7f59bc19b..b6b4ae7c59fa 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -810,7 +810,7 @@ static void mlx5e_build_common_cq_param(struct mlx5_core_dev *mdev, - { - void *cqc = param->cqc; - -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - if (MLX5_CAP_GEN(mdev, cqe_128_always) && cache_line_size() >= 128) - MLX5_SET(cqc, cqc, cqe_sz, CQE_STRIDE_128_PAD); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 71fb20f63bc3..3729a41dc558 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -333,7 +333,7 @@ static int mlx5e_ptp_alloc_txqsq(struct mlx5e_ptp *c, int txq_ix, - sq->mdev = mdev; - sq->ch_ix = MLX5E_PTP_CHANNEL_IX; - sq->txq_ix = txq_ix; -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - sq->stats = &c->priv->ptp_stats.sq[tc]; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index 6ed3a32b7e22..e9e36358c39d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -163,17 +163,11 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - goto err_dealloc_transport_domain; - } - -- err = mlx5_alloc_bfreg(mdev, &res->bfreg, false, false); -- if (err) { -- mlx5_core_err(mdev, "alloc bfreg failed, %d\n", err); -- goto err_destroy_mkey; -- } -- - if (create_tises) { - err = mlx5e_create_tises(mdev, res->tisn); - if (err) { - mlx5_core_err(mdev, "alloc tises failed, %d\n", err); -- goto err_destroy_bfreg; -+ goto err_destroy_mkey; - } - res->tisn_valid = true; - } -@@ -190,8 +184,6 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - - return 0; - --err_destroy_bfreg: -- mlx5_free_bfreg(mdev, &res->bfreg); - err_destroy_mkey: - mlx5_core_destroy_mkey(mdev, res->mkey); - err_dealloc_transport_domain: -@@ -209,7 +201,6 @@ void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev) - mdev->mlx5e_res.dek_priv = NULL; - if (res->tisn_valid) - mlx5e_destroy_tises(mdev, res->tisn); -- mlx5_free_bfreg(mdev, &res->bfreg); - mlx5_core_destroy_mkey(mdev, res->mkey); - mlx5_core_dealloc_transport_domain(mdev, res->td.tdn); - mlx5_core_dealloc_pd(mdev, res->pdn); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index b09291decca5..0395316f7031 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -1533,7 +1533,7 @@ static int mlx5e_alloc_xdpsq(struct mlx5e_channel *c, - sq->pdev = c->pdev; - sq->mkey_be = c->mkey_be; - sq->channel = c; -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu) - ETH_FCS_LEN; - sq->xsk_pool = xsk_pool; -@@ -1618,7 +1618,7 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c, - int err; - - sq->channel = c; -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - sq->reserved_room = param->stop_room; - - param->wq.db_numa_node = cpu_to_node(c->cpu); -@@ -1703,7 +1703,7 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c, - sq->priv = c->priv; - sq->ch_ix = c->ix; - sq->txq_ix = txq_ix; -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - sq->max_sq_mpw_wqebbs = mlx5e_get_max_sq_aligned_wqebbs(mdev); -@@ -1779,7 +1779,7 @@ static int mlx5e_create_sq(struct mlx5_core_dev *mdev, - MLX5_SET(sqc, sqc, flush_in_error_en, 1); - - MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC); -- MLX5_SET(wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); -+ MLX5_SET(wq, wq, uar_page, mdev->priv.bfreg.index); - MLX5_SET(wq, wq, log_wq_pg_sz, csp->wq_ctrl->buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(wq, wq, dbr_addr, csp->wq_ctrl->db.dma); -@@ -2261,7 +2261,7 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param) - MLX5_SET(cqc, cqc, cq_period_mode, mlx5e_cq_period_mode(param->cq_period_mode)); - - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -index f3c714ebd9cb..25499da177bc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c -@@ -307,7 +307,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, - - eqc = MLX5_ADDR_OF(create_eq_in, in, eq_context_entry); - MLX5_SET(eqc, eqc, log_eq_size, eq->fbc.log_sz); -- MLX5_SET(eqc, eqc, uar_page, priv->uar->index); -+ MLX5_SET(eqc, eqc, uar_page, priv->bfreg.up->index); - MLX5_SET(eqc, eqc, intr, vecidx); - MLX5_SET(eqc, eqc, log_page_size, - eq->frag_buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT); -@@ -320,7 +320,7 @@ create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, - eq->eqn = MLX5_GET(create_eq_out, out, eq_number); - eq->irqn = pci_irq_vector(dev->pdev, vecidx); - eq->dev = dev; -- eq->doorbell = priv->uar->map + MLX5_EQ_DOORBELL_OFFSET; -+ eq->doorbell = priv->bfreg.up->map + MLX5_EQ_DOORBELL_OFFSET; - - err = mlx5_debug_eq_add(dev, eq); - if (err) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -index 58bd749b5e4d..129725159a93 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/aso.c -@@ -100,7 +100,7 @@ static int create_aso_cq(struct mlx5_aso_cq *cq, void *cqc_data) - - MLX5_SET(cqc, cqc, cq_period_mode, MLX5_CQ_PERIOD_MODE_START_FROM_EQE); - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma); -@@ -129,7 +129,7 @@ static int mlx5_aso_create_cq(struct mlx5_core_dev *mdev, int numa_node, - return -ENOMEM; - - MLX5_SET(cqc, cqc_data, log_cq_size, 1); -- MLX5_SET(cqc, cqc_data, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc_data, uar_page, mdev->priv.bfreg.up->index); - if (MLX5_CAP_GEN(mdev, cqe_128_always) && cache_line_size() >= 128) - MLX5_SET(cqc, cqc_data, cqe_sz, CQE_STRIDE_128_PAD); - -@@ -163,7 +163,7 @@ static int mlx5_aso_alloc_sq(struct mlx5_core_dev *mdev, int numa_node, - struct mlx5_wq_param param; - int err; - -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - - param.db_numa_node = numa_node; - param.buf_numa_node = numa_node; -@@ -203,7 +203,7 @@ static int create_aso_sq(struct mlx5_core_dev *mdev, int pdn, - MLX5_SET(sqc, sqc, ts_format, ts_format); - - MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC); -- MLX5_SET(wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); -+ MLX5_SET(wq, wq, uar_page, mdev->priv.bfreg.index); - MLX5_SET(wq, wq, log_wq_pg_sz, sq->wq_ctrl.buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(wq, wq, dbr_addr, sq->wq_ctrl.db.dma); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 00fe79878c4f..c48f3d9765f7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1316,10 +1316,9 @@ static int mlx5_load(struct mlx5_core_dev *dev) - { - int err; - -- dev->priv.uar = mlx5_get_uars_page(dev); -- if (IS_ERR(dev->priv.uar)) { -- mlx5_core_err(dev, "Failed allocating uar, aborting\n"); -- err = PTR_ERR(dev->priv.uar); -+ err = mlx5_alloc_bfreg(dev, &dev->priv.bfreg, false, false); -+ if (err) { -+ mlx5_core_err(dev, "Failed allocating bfreg, %d\n", err); - return err; - } - -@@ -1430,7 +1429,7 @@ static int mlx5_load(struct mlx5_core_dev *dev) - err_irq_table: - mlx5_pagealloc_stop(dev); - mlx5_events_stop(dev); -- mlx5_put_uars_page(dev, dev->priv.uar); -+ mlx5_free_bfreg(dev, &dev->priv.bfreg); - return err; - } - -@@ -1455,7 +1454,7 @@ static void mlx5_unload(struct mlx5_core_dev *dev) - mlx5_irq_table_destroy(dev); - mlx5_pagealloc_stop(dev); - mlx5_events_stop(dev); -- mlx5_put_uars_page(dev, dev->priv.uar); -+ mlx5_free_bfreg(dev, &dev->priv.bfreg); - } - - int mlx5_init_one_devl_locked(struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -index b0595c9b09e4..24ef7d66fa8a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -@@ -690,7 +690,7 @@ static int hws_send_ring_alloc_sq(struct mlx5_core_dev *mdev, - size_t buf_sz; - int err; - -- sq->uar_map = mdev->mlx5e_res.hw_objs.bfreg.map; -+ sq->uar_map = mdev->priv.bfreg.map; - sq->mdev = mdev; - - param.db_numa_node = numa_node; -@@ -764,7 +764,7 @@ static int hws_send_ring_create_sq(struct mlx5_core_dev *mdev, u32 pdn, - MLX5_SET(sqc, sqc, ts_format, ts_format); - - MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC); -- MLX5_SET(wq, wq, uar_page, mdev->mlx5e_res.hw_objs.bfreg.index); -+ MLX5_SET(wq, wq, uar_page, mdev->priv.bfreg.index); - MLX5_SET(wq, wq, log_wq_pg_sz, sq->wq_ctrl.buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(wq, wq, dbr_addr, sq->wq_ctrl.db.dma); - -@@ -940,7 +940,7 @@ static int hws_send_ring_create_cq(struct mlx5_core_dev *mdev, - (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas)); - - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma); - -@@ -963,7 +963,7 @@ static int hws_send_ring_open_cq(struct mlx5_core_dev *mdev, - if (!cqc_data) - return -ENOMEM; - -- MLX5_SET(cqc, cqc_data, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc_data, uar_page, mdev->priv.bfreg.up->index); - MLX5_SET(cqc, cqc_data, log_cq_size, ilog2(queue->num_entries)); - - err = hws_send_ring_alloc_cq(mdev, numa_node, queue, cqc_data, cq); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wc.c b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -index 276594586404..999d6216648a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/wc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -@@ -94,7 +94,7 @@ static int create_wc_cq(struct mlx5_wc_cq *cq, void *cqc_data) - - MLX5_SET(cqc, cqc, cq_period_mode, MLX5_CQ_PERIOD_MODE_START_FROM_EQE); - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma); -@@ -116,7 +116,7 @@ static int mlx5_wc_create_cq(struct mlx5_core_dev *mdev, struct mlx5_wc_cq *cq) - return -ENOMEM; - - MLX5_SET(cqc, cqc, log_cq_size, TEST_WC_LOG_CQ_SZ); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.uar->index); -+ MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); - if (MLX5_CAP_GEN(mdev, cqe_128_always) && cache_line_size() >= 128) - MLX5_SET(cqc, cqc, cqe_sz, CQE_STRIDE_128_PAD); - -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index c94d8828aa67..5f2cdfa2588d 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -612,7 +612,7 @@ struct mlx5_priv { - struct mlx5_ft_pool *ft_pool; - - struct mlx5_bfreg_data bfregs; -- struct mlx5_uars_page *uar; -+ struct mlx5_sq_bfreg bfreg; - #ifdef CONFIG_MLX5_SF - struct mlx5_vhca_state_notifier *vhca_state_notifier; - struct mlx5_sf_dev_table *sf_dev_table; -@@ -658,7 +658,6 @@ struct mlx5e_resources { - u32 pdn; - struct mlx5_td td; - u32 mkey; -- struct mlx5_sq_bfreg bfreg; - #define MLX5_MAX_NUM_TC 8 - u32 tisn[MLX5_MAX_PORTS][MLX5_MAX_NUM_TC]; - bool tisn_valid; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1545-net-mlx5e-prepare-for-using-multiple-tx-doorbells.patch b/SOURCES/1545-net-mlx5e-prepare-for-using-multiple-tx-doorbells.patch deleted file mode 100644 index d82cd425a..000000000 --- a/SOURCES/1545-net-mlx5e-prepare-for-using-multiple-tx-doorbells.patch +++ /dev/null @@ -1,194 +0,0 @@ -From 8296ee6bac850052245bd6cdbe58555e8c05e891 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:23:40 -0400 -Subject: [PATCH] net/mlx5e: Prepare for using multiple TX doorbells - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to the missing of the following commit: -8f7b00307bf1 ("net/mlx5e: Convert mlx5 netdevs to instance locking") - -commit 673d7ab7563e1268ac4ca62914b2b99d16219500 -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:39 2025 +0300 - - net/mlx5e: Prepare for using multiple TX doorbells - - The driver allocates a single doorbell per device and uses - it for all Send Queues (SQs). This can become a bottleneck due to the - high number of concurrent MMIO accesses when ringing the same doorbell - from many channels. - - This patch makes the doorbells used by channel queues configurable. - - mlx5e_channel_pick_doorbell() is added to select the doorbell to be used - for a given channel, picking the default for now. - - When opening a channel, the selected doorbell is saved to the channel - struct and used whenever channel-related queues are created. - - Finally, 'uar_page' is added to 'struct mlx5e_create_sq_param' to - control which doorbell to use when allocating an SQ, since that can - happen outside channel context (e.g. for PTP). - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 5e150e083829..fdd15d674b69 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -788,6 +788,7 @@ struct mlx5e_channel { - int vec_ix; - int sd_ix; - int cpu; -+ struct mlx5_sq_bfreg *bfreg; - /* Sync between icosq recovery and XSK enable/disable. */ - struct mutex icosq_recovery_lock; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -index e3edf79dde5f..00617c65fe3c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.h -@@ -51,6 +51,7 @@ struct mlx5e_create_sq_param { - u32 tisn; - u8 tis_lst_sz; - u8 min_inline_mode; -+ u32 uar_page; - }; - - /* Striding RQ dynamic parameters */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 3729a41dc558..1cc962232ea8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -333,7 +333,7 @@ static int mlx5e_ptp_alloc_txqsq(struct mlx5e_ptp *c, int txq_ix, - sq->mdev = mdev; - sq->ch_ix = MLX5E_PTP_CHANNEL_IX; - sq->txq_ix = txq_ix; -- sq->uar_map = mdev->priv.bfreg.map; -+ sq->uar_map = c->bfreg->map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - sq->stats = &c->priv->ptp_stats.sq[tc]; -@@ -471,6 +471,7 @@ static int mlx5e_ptp_open_txqsq(struct mlx5e_ptp *c, u32 tisn, - csp.wq_ctrl = &txqsq->wq_ctrl; - csp.min_inline_mode = txqsq->min_inline_mode; - csp.ts_cqe_to_dest_cqn = ptpsq->ts_cq.mcq.cqn; -+ csp.uar_page = c->bfreg->index; - - err = mlx5e_create_sq_rdy(c->mdev, sqp, &csp, 0, &txqsq->sqn); - if (err) -@@ -885,6 +886,7 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params, - c->num_tc = mlx5e_get_dcb_num_tc(params); - c->stats = &priv->ptp_stats.ch; - c->lag_port = lag_port; -+ c->bfreg = &mdev->priv.bfreg; - - err = mlx5e_ptp_set_state(c, params); - if (err) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -index 883c044852f1..1b3c9648220b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -@@ -66,6 +66,7 @@ struct mlx5e_ptp { - struct mlx5_core_dev *mdev; - struct hwtstamp_config *tstamp; - DECLARE_BITMAP(state, MLX5E_PTP_STATE_NUM_STATES); -+ struct mlx5_sq_bfreg *bfreg; - }; - - static inline bool mlx5e_use_ptpsq(struct sk_buff *skb) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 0395316f7031..3c617c2bd471 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -1533,7 +1533,7 @@ static int mlx5e_alloc_xdpsq(struct mlx5e_channel *c, - sq->pdev = c->pdev; - sq->mkey_be = c->mkey_be; - sq->channel = c; -- sq->uar_map = mdev->priv.bfreg.map; -+ sq->uar_map = c->bfreg->map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu) - ETH_FCS_LEN; - sq->xsk_pool = xsk_pool; -@@ -1618,7 +1618,7 @@ static int mlx5e_alloc_icosq(struct mlx5e_channel *c, - int err; - - sq->channel = c; -- sq->uar_map = mdev->priv.bfreg.map; -+ sq->uar_map = c->bfreg->map; - sq->reserved_room = param->stop_room; - - param->wq.db_numa_node = cpu_to_node(c->cpu); -@@ -1703,7 +1703,7 @@ static int mlx5e_alloc_txqsq(struct mlx5e_channel *c, - sq->priv = c->priv; - sq->ch_ix = c->ix; - sq->txq_ix = txq_ix; -- sq->uar_map = mdev->priv.bfreg.map; -+ sq->uar_map = c->bfreg->map; - sq->min_inline_mode = params->tx_min_inline_mode; - sq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - sq->max_sq_mpw_wqebbs = mlx5e_get_max_sq_aligned_wqebbs(mdev); -@@ -1779,7 +1779,7 @@ static int mlx5e_create_sq(struct mlx5_core_dev *mdev, - MLX5_SET(sqc, sqc, flush_in_error_en, 1); - - MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_CYCLIC); -- MLX5_SET(wq, wq, uar_page, mdev->priv.bfreg.index); -+ MLX5_SET(wq, wq, uar_page, csp->uar_page); - MLX5_SET(wq, wq, log_wq_pg_sz, csp->wq_ctrl->buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(wq, wq, dbr_addr, csp->wq_ctrl->db.dma); -@@ -1883,6 +1883,7 @@ int mlx5e_open_txqsq(struct mlx5e_channel *c, u32 tisn, int txq_ix, - csp.cqn = sq->cq.mcq.cqn; - csp.wq_ctrl = &sq->wq_ctrl; - csp.min_inline_mode = sq->min_inline_mode; -+ csp.uar_page = c->bfreg->index; - err = mlx5e_create_sq_rdy(c->mdev, param, &csp, qos_queue_group_id, &sq->sqn); - if (err) - goto err_free_txqsq; -@@ -2040,6 +2041,7 @@ static int mlx5e_open_icosq(struct mlx5e_channel *c, struct mlx5e_params *params - csp.cqn = sq->cq.mcq.cqn; - csp.wq_ctrl = &sq->wq_ctrl; - csp.min_inline_mode = params->tx_min_inline_mode; -+ csp.uar_page = c->bfreg->index; - err = mlx5e_create_sq_rdy(c->mdev, param, &csp, 0, &sq->sqn); - if (err) - goto err_free_icosq; -@@ -2100,6 +2102,7 @@ int mlx5e_open_xdpsq(struct mlx5e_channel *c, struct mlx5e_params *params, - csp.cqn = sq->cq.mcq.cqn; - csp.wq_ctrl = &sq->wq_ctrl; - csp.min_inline_mode = sq->min_inline_mode; -+ csp.uar_page = c->bfreg->index; - set_bit(MLX5E_SQ_STATE_ENABLED, &sq->state); - - err = mlx5e_create_sq_rdy(c->mdev, param, &csp, 0, &sq->sqn); -@@ -2728,6 +2731,11 @@ void mlx5e_trigger_napi_sched(struct napi_struct *napi) - local_bh_enable(); - } - -+static void mlx5e_channel_pick_doorbell(struct mlx5e_channel *c) -+{ -+ c->bfreg = &c->mdev->priv.bfreg; -+} -+ - static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, - struct mlx5e_params *params, - struct xsk_buff_pool *xsk_pool, -@@ -2782,6 +2790,8 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, - c->aff_mask = irq_get_effective_affinity_mask(irq); - c->lag_port = mlx5e_enumerate_lag_port(mdev, ix); - -+ mlx5e_channel_pick_doorbell(c); -+ - netif_napi_add_config(netdev, &c->napi, mlx5e_napi_poll, ix); - netif_napi_set_irq(&c->napi, irq); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1546-net-mlx5e-prepare-for-using-different-cq-doorbells.patch b/SOURCES/1546-net-mlx5e-prepare-for-using-different-cq-doorbells.patch deleted file mode 100644 index 343f88702..000000000 --- a/SOURCES/1546-net-mlx5e-prepare-for-using-different-cq-doorbells.patch +++ /dev/null @@ -1,168 +0,0 @@ -From b414407f3762b30a2690b20186179814bef40a8b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:28 -0400 -Subject: [PATCH] net/mlx5e: Prepare for using different CQ doorbells - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a315b723e87ba4e4573e1e5c759d512f38bdc0b3 -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:40 2025 +0300 - - net/mlx5e: Prepare for using different CQ doorbells - - Completion queues (CQs) in mlx5 use the same global doorbell, which may - become contended when accessed concurrently from many cores. - - This patch prepares the CQ management code for supporting different - doorbells per CQ. This will be used in downstream patches to allow - separate doorbells to be used by channels CQs. - - The main change is moving the 'uar' pointer from struct mlx5_core_cq to - struct mlx5e_cq, as the uar page to be used is better off stored - directly there. Other users of mlx5_core_cq also store the UAR to be - used separately and therefore the pointer being removed is dead weight - for them. As evidence, in this patch there are two users which set the - mcq.uar pointer but didn't use it, Software Steering and old Innova CQ - creation code. Instead, they rang the doorbell directly from another - pointer. - - The 'uar' pointer added to struct mlx5e_cq remains in a hot cacheline - (as before), because it may get accessed for each packet. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cq.c b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -index 35039a95dcfd..e9f319a9bdd6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -@@ -145,7 +145,6 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, - mlx5_core_dbg(dev, "failed adding CP 0x%x to debug file system\n", - cq->cqn); - -- cq->uar = dev->priv.bfreg.up; - cq->irqn = eq->core.irqn; - - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index fdd15d674b69..28c8bfb47a2a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -344,6 +344,7 @@ struct mlx5e_cq { - /* data path - accessed per napi poll */ - u16 event_ctr; - struct napi_struct *napi; -+ struct mlx5_uars_page *uar; - struct mlx5_core_cq mcq; - struct mlx5e_ch_stats *ch_stats; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -index e837c21d3d21..8189d5e1ef49 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -@@ -309,10 +309,7 @@ mlx5e_notify_hw(struct mlx5_wq_cyc *wq, u16 pc, void __iomem *uar_map, - - static inline void mlx5e_cq_arm(struct mlx5e_cq *cq) - { -- struct mlx5_core_cq *mcq; -- -- mcq = &cq->mcq; -- mlx5_cq_arm(mcq, MLX5_CQ_DB_REQ_NOT, mcq->uar->map, cq->wq.cc); -+ mlx5_cq_arm(&cq->mcq, MLX5_CQ_DB_REQ_NOT, cq->uar->map, cq->wq.cc); - } - - static inline struct mlx5e_sq_dma * -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 3c617c2bd471..ca4f1c69df54 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2173,6 +2173,7 @@ static void mlx5e_close_xdpredirect_sq(struct mlx5e_xdpsq *xdpsq) - static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, - struct net_device *netdev, - struct workqueue_struct *workqueue, -+ struct mlx5_uars_page *uar, - struct mlx5e_cq_param *param, - struct mlx5e_cq *cq) - { -@@ -2204,6 +2205,7 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, - cq->mdev = mdev; - cq->netdev = netdev; - cq->workqueue = workqueue; -+ cq->uar = uar; - - return 0; - } -@@ -2219,7 +2221,8 @@ static int mlx5e_alloc_cq(struct mlx5_core_dev *mdev, - param->wq.db_numa_node = ccp->node; - param->eq_ix = ccp->ix; - -- err = mlx5e_alloc_cq_common(mdev, ccp->netdev, ccp->wq, param, cq); -+ err = mlx5e_alloc_cq_common(mdev, ccp->netdev, ccp->wq, -+ mdev->priv.bfreg.up, param, cq); - - cq->napi = ccp->napi; - cq->ch_stats = ccp->ch_stats; -@@ -2264,7 +2267,7 @@ static int mlx5e_create_cq(struct mlx5e_cq *cq, struct mlx5e_cq_param *param) - MLX5_SET(cqc, cqc, cq_period_mode, mlx5e_cq_period_mode(param->cq_period_mode)); - - MLX5_SET(cqc, cqc, c_eqn_or_apu_element, eqn); -- MLX5_SET(cqc, cqc, uar_page, mdev->priv.bfreg.up->index); -+ MLX5_SET(cqc, cqc, uar_page, cq->uar->index); - MLX5_SET(cqc, cqc, log_page_size, cq->wq_ctrl.buf.page_shift - - MLX5_ADAPTER_PAGE_SHIFT); - MLX5_SET64(cqc, cqc, dbr_addr, cq->wq_ctrl.db.dma); -@@ -3563,7 +3566,8 @@ static int mlx5e_alloc_drop_cq(struct mlx5e_priv *priv, - param->wq.buf_numa_node = dev_to_node(mlx5_core_dma_dev(mdev)); - param->wq.db_numa_node = dev_to_node(mlx5_core_dma_dev(mdev)); - -- return mlx5e_alloc_cq_common(priv->mdev, priv->netdev, priv->wq, param, cq); -+ return mlx5e_alloc_cq_common(priv->mdev, priv->netdev, priv->wq, -+ mdev->priv.bfreg.up, param, cq); - } - - int mlx5e_open_drop_rq(struct mlx5e_priv *priv, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -index c4de6bf8d1b6..cb1319974f83 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -@@ -475,7 +475,6 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) - *conn->cq.mcq.arm_db = 0; - conn->cq.mcq.vector = 0; - conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete; -- conn->cq.mcq.uar = fdev->conn_res.uar; - tasklet_setup(&conn->cq.tasklet, mlx5_fpga_conn_cq_tasklet); - - mlx5_fpga_dbg(fdev, "Created CQ #0x%x\n", conn->cq.mcq.cqn); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -index 4fd4e8483382..077a77fde670 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -@@ -1131,7 +1131,6 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - *cq->mcq.arm_db = cpu_to_be32(2 << 28); - - cq->mcq.vector = 0; -- cq->mcq.uar = uar; - cq->mdev = mdev; - - return cq; -diff --git a/include/linux/mlx5/cq.h b/include/linux/mlx5/cq.h -index 991526039ccb..7ef2c7c7d803 100644 ---- a/include/linux/mlx5/cq.h -+++ b/include/linux/mlx5/cq.h -@@ -41,7 +41,6 @@ struct mlx5_core_cq { - int cqe_sz; - __be32 *set_ci_db; - __be32 *arm_db; -- struct mlx5_uars_page *uar; - refcount_t refcount; - struct completion free; - unsigned vector; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1547-net-mlx5e-use-multiple-tx-doorbells.patch b/SOURCES/1547-net-mlx5e-use-multiple-tx-doorbells.patch deleted file mode 100644 index eaef79383..000000000 --- a/SOURCES/1547-net-mlx5e-use-multiple-tx-doorbells.patch +++ /dev/null @@ -1,142 +0,0 @@ -From d549d7b310aa69dabf312c34ac10967ba9df1c21 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:28 -0400 -Subject: [PATCH] net/mlx5e: Use multiple TX doorbells - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 71fb4832d50b01f0af2d257360c239879ce93a8e -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:41 2025 +0300 - - net/mlx5e: Use multiple TX doorbells - - First, allocate more doorbells in mlx5e_create_mdev_resources: - - one doorbell remains 'global' and will be used by all non-channel - associated SQs (e.g. ASO, HWS, PTP, ...). - - allocate additional 'num_doorbells' doorbells. This defaults to - minimum between 8 and max number of channels. - - mlx5e_channel_pick_doorbell() now spreads out channel SQs across - available doorbells. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index e9e36358c39d..d13cebbc763a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -143,6 +143,7 @@ static int mlx5e_create_tises(struct mlx5_core_dev *mdev, u32 tisn[MLX5_MAX_PORT - int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - { - struct mlx5e_hw_objs *res = &mdev->mlx5e_res.hw_objs; -+ unsigned int num_doorbells, i; - int err; - - err = mlx5_core_alloc_pd(mdev, &res->pdn); -@@ -163,11 +164,30 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - goto err_dealloc_transport_domain; - } - -+ num_doorbells = min(MLX5_DEFAULT_NUM_DOORBELLS, -+ mlx5e_get_max_num_channels(mdev)); -+ res->bfregs = kcalloc(num_doorbells, sizeof(*res->bfregs), GFP_KERNEL); -+ if (!res->bfregs) { -+ err = -ENOMEM; -+ goto err_destroy_mkey; -+ } -+ -+ for (i = 0; i < num_doorbells; i++) { -+ err = mlx5_alloc_bfreg(mdev, res->bfregs + i, false, false); -+ if (err) { -+ mlx5_core_warn(mdev, -+ "could only allocate %d/%d doorbells, err %d.\n", -+ i, num_doorbells, err); -+ break; -+ } -+ } -+ res->num_bfregs = i; -+ - if (create_tises) { - err = mlx5e_create_tises(mdev, res->tisn); - if (err) { - mlx5_core_err(mdev, "alloc tises failed, %d\n", err); -- goto err_destroy_mkey; -+ goto err_destroy_bfregs; - } - res->tisn_valid = true; - } -@@ -184,6 +204,10 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - - return 0; - -+err_destroy_bfregs: -+ for (i = 0; i < res->num_bfregs; i++) -+ mlx5_free_bfreg(mdev, res->bfregs + i); -+ kfree(res->bfregs); - err_destroy_mkey: - mlx5_core_destroy_mkey(mdev, res->mkey); - err_dealloc_transport_domain: -@@ -201,6 +225,9 @@ void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev) - mdev->mlx5e_res.dek_priv = NULL; - if (res->tisn_valid) - mlx5e_destroy_tises(mdev, res->tisn); -+ for (unsigned int i = 0; i < res->num_bfregs; i++) -+ mlx5_free_bfreg(mdev, res->bfregs + i); -+ kfree(res->bfregs); - mlx5_core_destroy_mkey(mdev, res->mkey); - mlx5_core_dealloc_transport_domain(mdev, res->td.tdn); - mlx5_core_dealloc_pd(mdev, res->pdn); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index ca4f1c69df54..9727a40e1961 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2736,7 +2736,16 @@ void mlx5e_trigger_napi_sched(struct napi_struct *napi) - - static void mlx5e_channel_pick_doorbell(struct mlx5e_channel *c) - { -- c->bfreg = &c->mdev->priv.bfreg; -+ struct mlx5e_hw_objs *hw_objs = &c->mdev->mlx5e_res.hw_objs; -+ -+ /* No dedicated Ethernet doorbells, use the global one. */ -+ if (hw_objs->num_bfregs == 0) { -+ c->bfreg = &c->mdev->priv.bfreg; -+ return; -+ } -+ -+ /* Round-robin between doorbells. */ -+ c->bfreg = hw_objs->bfregs + c->vec_ix % hw_objs->num_bfregs; - } - - static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 5f2cdfa2588d..5405ca1038f9 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -658,6 +658,8 @@ struct mlx5e_resources { - u32 pdn; - struct mlx5_td td; - u32 mkey; -+ struct mlx5_sq_bfreg *bfregs; -+ unsigned int num_bfregs; - #define MLX5_MAX_NUM_TC 8 - u32 tisn[MLX5_MAX_PORTS][MLX5_MAX_NUM_TC]; - bool tisn_valid; -@@ -802,6 +804,8 @@ struct mlx5_db { - int index; - }; - -+#define MLX5_DEFAULT_NUM_DOORBELLS 8 -+ - enum { - MLX5_COMP_EQ_SIZE = 1024, - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1548-net-mlx5e-use-multiple-cq-doorbells.patch b/SOURCES/1548-net-mlx5e-use-multiple-cq-doorbells.patch deleted file mode 100644 index 0a79d9997..000000000 --- a/SOURCES/1548-net-mlx5e-use-multiple-cq-doorbells.patch +++ /dev/null @@ -1,106 +0,0 @@ -From dd12546e17527a5b54fd9c3072bfca12613e0cbb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:28 -0400 -Subject: [PATCH] net/mlx5e: Use multiple CQ doorbells - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 325db9c6f69b1408ccd2c6e237fc07697a9f210f -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:42 2025 +0300 - - net/mlx5e: Use multiple CQ doorbells - - Channel doorbells are now also used by all channel CQs. - - A new 'uar' parameter is added to 'struct mlx5e_create_cq_param', - which is then used in mlx5e_alloc_cq. - - A single UAR page has two TX doorbells and a single CQ doorbell, so - every consecutive pair of 'struct mlx5_sq_bfreg' (TX doorbells) - uses the same underlying 'struct mlx5_uars_page' (CQ doorbell). - So by using c->bfreg->up, CQs from every consecutive channel pair will - share the same CQ doorbell. - - Non-channel associated CQs keep using the global CQ doorbell. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 28c8bfb47a2a..9098e526fbb6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1062,6 +1062,7 @@ struct mlx5e_create_cq_param { - struct mlx5e_ch_stats *ch_stats; - int node; - int ix; -+ struct mlx5_uars_page *uar; - }; - - struct mlx5e_cq_param; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index b6b4ae7c59fa..596440c8c364 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -611,6 +611,7 @@ void mlx5e_build_create_cq_param(struct mlx5e_create_cq_param *ccp, struct mlx5e - .ch_stats = c->stats, - .node = cpu_to_node(c->cpu), - .ix = c->vec_ix, -+ .uar = c->bfreg->up, - }; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 1cc962232ea8..d1e0f974b8a3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -563,6 +563,7 @@ static int mlx5e_ptp_open_tx_cqs(struct mlx5e_ptp *c, - ccp.ch_stats = c->stats; - ccp.napi = &c->napi; - ccp.ix = MLX5E_PTP_CHANNEL_IX; -+ ccp.uar = c->bfreg->up; - - cq_param = &cparams->txq_sq_param.cqp; - -@@ -612,6 +613,7 @@ static int mlx5e_ptp_open_rx_cq(struct mlx5e_ptp *c, - ccp.ch_stats = c->stats; - ccp.napi = &c->napi; - ccp.ix = MLX5E_PTP_CHANNEL_IX; -+ ccp.uar = c->bfreg->up; - - cq_param = &cparams->rq_param.cqp; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -index 140606fcd23b..5099a1c47f4f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -@@ -76,6 +76,7 @@ static int mlx5e_open_trap_rq(struct mlx5e_priv *priv, struct mlx5e_trap *t) - ccp.ch_stats = t->stats; - ccp.napi = &t->napi; - ccp.ix = 0; -+ ccp.uar = mdev->priv.bfreg.up; - err = mlx5e_open_cq(priv->mdev, trap_moder, &rq_param->cqp, &ccp, &rq->cq); - if (err) - return err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 9727a40e1961..26d35a2653dc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2222,7 +2222,7 @@ static int mlx5e_alloc_cq(struct mlx5_core_dev *mdev, - param->eq_ix = ccp->ix; - - err = mlx5e_alloc_cq_common(mdev, ccp->netdev, ccp->wq, -- mdev->priv.bfreg.up, param, cq); -+ ccp->uar, param, cq); - - cq->napi = ccp->napi; - cq->ch_stats = ccp->ch_stats; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1549-net-mlx5e-use-the-num-doorbells-devlink-param.patch b/SOURCES/1549-net-mlx5e-use-the-num-doorbells-devlink-param.patch deleted file mode 100644 index f5caf4c48..000000000 --- a/SOURCES/1549-net-mlx5e-use-the-num-doorbells-devlink-param.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 2568919a7375e71e88c7ea83576fbea2a5a76f5b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:28 -0400 -Subject: [PATCH] net/mlx5e: Use the 'num_doorbells' devlink param - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 11bbcfb7668c6f4d97260f7caaefea22678bc31e -Author: Cosmin Ratiu -Date: Tue Sep 16 17:11:44 2025 +0300 - - net/mlx5e: Use the 'num_doorbells' devlink param - - Use the new devlink param to control how many doorbells mlx5e devices - allocate and use. The maximum number of doorbells configurable is capped - to the maximum number of channels. This only applies to the Ethernet - part, the RDMA devices using mlx5 manage their own doorbells. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index 60cc9fedf1ef..41c9b716699e 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -62,6 +62,15 @@ Note: permanent parameters such as ``enable_sriov`` and ``total_vfs`` require FW - echo 1 >/sys/bus/pci/rescan - grep ^ /sys/bus/pci/devices/0000:01:00.0/sriov_* - -+ * - ``num_doorbells`` -+ - driverinit -+ - This controls the number of channel doorbells used by the netdev. In all -+ cases, an additional doorbell is allocated and used for non-channel -+ communication (e.g. for PTP, HWS, etc.). Supported values are: -+ -+ - 0: No channel-specific doorbells, use the global one for everything. -+ - [1, max_num_channels]: Spread netdev channels equally across these -+ doorbells. - - The ``mlx5`` driver also implements the following driver-specific - parameters. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index 18ef8404e5e6..e8ce011f2464 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -530,6 +530,25 @@ mlx5_devlink_hairpin_queue_size_validate(struct devlink *devlink, u32 id, - return 0; - } - -+static int mlx5_devlink_num_doorbells_validate(struct devlink *devlink, u32 id, -+ union devlink_param_value val, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5_core_dev *mdev = devlink_priv(devlink); -+ u32 val32 = val.vu32; -+ u32 max_num_channels; -+ -+ max_num_channels = mlx5e_get_max_num_channels(mdev); -+ if (val32 > max_num_channels) { -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "Requested num_doorbells (%u) exceeds maximum number of channels (%u)", -+ val32, max_num_channels); -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ - static void mlx5_devlink_hairpin_params_init_values(struct devlink *devlink) - { - struct mlx5_core_dev *dev = devlink_priv(devlink); -@@ -609,6 +628,9 @@ static const struct devlink_param mlx5_devlink_eth_params[] = { - "hairpin_queue_size", DEVLINK_PARAM_TYPE_U32, - BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, - mlx5_devlink_hairpin_queue_size_validate), -+ DEVLINK_PARAM_GENERIC(NUM_DOORBELLS, -+ BIT(DEVLINK_PARAM_CMODE_DRIVERINIT), NULL, NULL, -+ mlx5_devlink_num_doorbells_validate), - }; - - static int mlx5_devlink_eth_params_register(struct devlink *devlink) -@@ -632,6 +654,10 @@ static int mlx5_devlink_eth_params_register(struct devlink *devlink) - - mlx5_devlink_hairpin_params_init_values(devlink); - -+ value.vu32 = MLX5_DEFAULT_NUM_DOORBELLS; -+ devl_param_driverinit_value_set(devlink, -+ DEVLINK_PARAM_GENERIC_ID_NUM_DOORBELLS, -+ value); - return 0; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index d13cebbc763a..96b744ceaf13 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -30,6 +30,7 @@ - * SOFTWARE. - */ - -+#include "devlink.h" - #include "en.h" - #include "lib/crypto.h" - -@@ -140,6 +141,18 @@ static int mlx5e_create_tises(struct mlx5_core_dev *mdev, u32 tisn[MLX5_MAX_PORT - return err; - } - -+static unsigned int -+mlx5e_get_devlink_param_num_doorbells(struct mlx5_core_dev *dev) -+{ -+ const u32 param_id = DEVLINK_PARAM_GENERIC_ID_NUM_DOORBELLS; -+ struct devlink *devlink = priv_to_devlink(dev); -+ union devlink_param_value val; -+ int err; -+ -+ err = devl_param_driverinit_value_get(devlink, param_id, &val); -+ return err ? MLX5_DEFAULT_NUM_DOORBELLS : val.vu32; -+} -+ - int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - { - struct mlx5e_hw_objs *res = &mdev->mlx5e_res.hw_objs; -@@ -164,7 +177,7 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - goto err_dealloc_transport_domain; - } - -- num_doorbells = min(MLX5_DEFAULT_NUM_DOORBELLS, -+ num_doorbells = min(mlx5e_get_devlink_param_num_doorbells(mdev), - mlx5e_get_max_num_channels(mdev)); - res->bfregs = kcalloc(num_doorbells, sizeof(*res->bfregs), GFP_KERNEL); - if (!res->bfregs) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1550-net-mlx5e-use-unsigned-for-mlx5e-get-max-num-channels.patch b/SOURCES/1550-net-mlx5e-use-unsigned-for-mlx5e-get-max-num-channels.patch deleted file mode 100644 index c890fad2a..000000000 --- a/SOURCES/1550-net-mlx5e-use-unsigned-for-mlx5e-get-max-num-channels.patch +++ /dev/null @@ -1,50 +0,0 @@ -From d9239efd2beaaadb2ff5f66de134e261d9967d9f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 09:46:23 -0400 -Subject: [PATCH] net/mlx5e: Use unsigned for mlx5e_get_max_num_channels -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 57a94d4b22b0c6cc5d601e6b6238d78fb923d991 -Author: Cosmin Ratiu -Date: Wed Feb 18 09:29:04 2026 +0200 - - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels - - The max number of channels is always an unsigned int, use the correct - type to fix compilation errors done with strict type checking, e.g.: - - error: call to ‘__compiletime_assert_1110’ declared with attribute - error: min(mlx5e_get_devlink_param_num_doorbells(mdev), - mlx5e_get_max_num_channels(mdev)) signedness error - - Fixes: 74a8dadac17e ("net/mlx5e: Preparations for supporting larger number of channels") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Jacob Keller - Link: https://patch.msgid.link/20260218072904.1764634-7-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 9098e526fbb6..964df2d545b0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -178,7 +178,8 @@ static inline u16 mlx5_min_rx_wqes(int wq_type, u32 wq_size) - } - - /* Use this function to get max num channels (rxqs/txqs) only to create netdev */ --static inline int mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev) -+static inline unsigned int -+mlx5e_get_max_num_channels(struct mlx5_core_dev *mdev) - { - return is_kdump_kernel() ? - MLX5E_MIN_NUM_CHANNELS : --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1551-net-mlx5-add-uar-access-and-odp-page-fault-counters.patch b/SOURCES/1551-net-mlx5-add-uar-access-and-odp-page-fault-counters.patch deleted file mode 100644 index 52b8f9c91..000000000 --- a/SOURCES/1551-net-mlx5-add-uar-access-and-odp-page-fault-counters.patch +++ /dev/null @@ -1,58 +0,0 @@ -From e4d710c6703746ce3e88be7f9b008c5017da77a9 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:28 -0400 -Subject: [PATCH] net/mlx5: Add uar access and odp page fault counters - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a3d076b0567e729d5f21a95525c4d096b1f59e79 -Author: Akiva Goldberger -Date: Wed Sep 17 16:27:58 2025 +0300 - - net/mlx5: Add uar access and odp page fault counters - - Add bar_uar_access, odp_local_triggered_page_fault, and - odp_remote_triggered_page_fault counters to the query_vnic_env command. - Additionally, add corresponding capabilities bits to the HCA CAP. - - Signed-off-by: Akiva Goldberger - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758115678-643464-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 961e9c76c6c5..0ef2af28d424 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -1957,7 +1957,9 @@ struct mlx5_ifc_cmd_hca_cap_bits { - u8 log_max_rqt[0x5]; - u8 reserved_at_390[0x3]; - u8 log_max_rqt_size[0x5]; -- u8 reserved_at_398[0x3]; -+ u8 reserved_at_398[0x1]; -+ u8 vnic_env_cnt_bar_uar_access[0x1]; -+ u8 vnic_env_cnt_odp_page_fault[0x1]; - u8 log_max_tis_per_sq[0x5]; - - u8 ext_stride_num_range[0x1]; -@@ -4018,7 +4020,13 @@ struct mlx5_ifc_vnic_diagnostic_statistics_bits { - - u8 handled_pkt_steering_fail[0x40]; - -- u8 reserved_at_360[0xc80]; -+ u8 bar_uar_access[0x20]; -+ -+ u8 odp_local_triggered_page_fault[0x20]; -+ -+ u8 odp_remote_triggered_page_fault[0x20]; -+ -+ u8 reserved_at_3c0[0xc20]; - }; - - struct mlx5_ifc_traffic_counter_bits { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1552-net-mlx5-change-ttc-rules-to-match-on-undecrypted-esp-packet.patch b/SOURCES/1552-net-mlx5-change-ttc-rules-to-match-on-undecrypted-esp-packet.patch deleted file mode 100644 index ee16ce977..000000000 --- a/SOURCES/1552-net-mlx5-change-ttc-rules-to-match-on-undecrypted-esp-packet.patch +++ /dev/null @@ -1,345 +0,0 @@ -From 97fb90a6ac2428b12dbb43857e127ffdf661358c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:29 -0400 -Subject: [PATCH] net/mlx5: Change TTC rules to match on undecrypted ESP - packets - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9f24f0c4d4ddbd207e655697e78ef67a0374a481 -Author: Jianbo Liu -Date: Thu Sep 18 10:19:20 2025 +0300 - - net/mlx5: Change TTC rules to match on undecrypted ESP packets - - The TTC (Traffic Type Classifier) table classifies the traffic and - steers packet to TIRs, where RSS works based on the hash calculated - from the selected packet fields. For AH/ESP packets, SPI and IP - addresses are the fields used to calculate the hash value for RSS. So, - it's hard to distribute packets to different receiving queues as there - is usually only one SPI in that direction. - - IPSec hardware offloads, crypto offload and full (packet) offload were - introduced later. For crypto offload, hardware does encryption, - decryption and authentication, kernel does the others. Kernel always - sends/receives formatted ESP packets with plaintext data instead of - the ciphertext data, all other fields are unmodified. For full - offload, hardware will take care of almost everything, kernel just - sends/receives packets without any IPSec headers. - - Currently, all packets with ESP protocols are forwarded to IPSec - offload tables if IPSec rules are configured. In a downstream patch, - the decrypted packets will be recirculated to TTC table, in order to - use RSS, which does the hash on L4 fields after IPSec headers are - stripped by full offload. So those packets handled by crypto offload - must filtered out, as they still have the ESP headers, but apparently - no need to be decrypted again. To do that, ipsec_next_header is added - for the packet matching, as it is valid only after passing through - IPSec decryption. - - Signed-off-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758179963-649455-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -index ac65e3191480..3fc093ec1f50 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -@@ -132,7 +132,8 @@ struct mlx5e_ptp_fs; - - void mlx5e_set_ttc_params(struct mlx5e_flow_steering *fs, - struct mlx5e_rx_res *rx_res, -- struct ttc_params *ttc_params, bool tunnel); -+ struct ttc_params *ttc_params, bool tunnel, -+ bool ipsec_rss); - - void mlx5e_destroy_ttc_table(struct mlx5e_flow_steering *fs); - int mlx5e_create_ttc_table(struct mlx5e_flow_steering *fs, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -index 537e732085b2..701147d5e2e1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -@@ -912,7 +912,8 @@ static void mlx5e_set_inner_ttc_params(struct mlx5e_flow_steering *fs, - - void mlx5e_set_ttc_params(struct mlx5e_flow_steering *fs, - struct mlx5e_rx_res *rx_res, -- struct ttc_params *ttc_params, bool tunnel) -+ struct ttc_params *ttc_params, bool tunnel, -+ bool ipsec_rss) - - { - struct mlx5_flow_table_attr *ft_attr = &ttc_params->ft_attr; -@@ -923,6 +924,9 @@ void mlx5e_set_ttc_params(struct mlx5e_flow_steering *fs, - ft_attr->level = MLX5E_TTC_FT_LEVEL; - ft_attr->prio = MLX5E_NIC_PRIO; - -+ ttc_params->ipsec_rss = ipsec_rss && -+ MLX5_CAP_NIC_RX_FT_FIELD_SUPPORT_2(fs->mdev, ipsec_next_header); -+ - for (tt = 0; tt < MLX5_NUM_TT; tt++) { - ttc_params->dests[tt].type = MLX5_FLOW_DESTINATION_TYPE_TIR; - ttc_params->dests[tt].tir_num = -@@ -1289,7 +1293,7 @@ int mlx5e_create_ttc_table(struct mlx5e_flow_steering *fs, - { - struct ttc_params ttc_params = {}; - -- mlx5e_set_ttc_params(fs, rx_res, &ttc_params, true); -+ mlx5e_set_ttc_params(fs, rx_res, &ttc_params, true, true); - fs->ttc = mlx5_create_ttc_table(fs->mdev, &ttc_params); - return PTR_ERR_OR_ZERO(fs->ttc); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 5766be2c0153..2ce31ebd70d3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -971,7 +971,7 @@ static int mlx5e_create_rep_ttc_table(struct mlx5e_priv *priv) - MLX5_FLOW_NAMESPACE_KERNEL), false); - - /* The inner_ttc in the ttc params is intentionally not set */ -- mlx5e_set_ttc_params(priv->fs, priv->rx_res, &ttc_params, false); -+ mlx5e_set_ttc_params(priv->fs, priv->rx_res, &ttc_params, false, false); - - if (rep->vport != MLX5_VPORT_UPLINK) - /* To give uplik rep TTC a lower level for chaining from root ft */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -index ca9ecec358b2..850fff4548c8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -@@ -9,7 +9,7 @@ - #include "mlx5_core.h" - #include "lib/fs_ttc.h" - --#define MLX5_TTC_MAX_NUM_GROUPS 4 -+#define MLX5_TTC_MAX_NUM_GROUPS 5 - #define MLX5_TTC_GROUP_TCPUDP_SIZE (MLX5_TT_IPV6_UDP + 1) - - struct mlx5_fs_ttc_groups { -@@ -31,6 +31,7 @@ static int mlx5_fs_ttc_table_size(const struct mlx5_fs_ttc_groups *groups) - /* L3/L4 traffic type classifier */ - struct mlx5_ttc_table { - int num_groups; -+ const struct mlx5_fs_ttc_groups *groups; - struct mlx5_flow_table *t; - struct mlx5_flow_group **g; - struct mlx5_ttc_rule rules[MLX5_NUM_TT]; -@@ -163,6 +164,8 @@ static struct mlx5_etype_proto ttc_tunnel_rules[] = { - enum TTC_GROUP_TYPE { - TTC_GROUPS_DEFAULT = 0, - TTC_GROUPS_USE_L4_TYPE = 1, -+ TTC_GROUPS_DEFAULT_ESP = 2, -+ TTC_GROUPS_USE_L4_TYPE_ESP = 3, - }; - - static const struct mlx5_fs_ttc_groups ttc_groups[] = { -@@ -184,6 +187,27 @@ static const struct mlx5_fs_ttc_groups ttc_groups[] = { - BIT(0), - }, - }, -+ [TTC_GROUPS_DEFAULT_ESP] = { -+ .num_groups = 4, -+ .group_size = { -+ MLX5_TTC_GROUP_TCPUDP_SIZE + BIT(1) + -+ MLX5_NUM_TUNNEL_TT, -+ BIT(1), /* ESP */ -+ BIT(1), -+ BIT(0), -+ }, -+ }, -+ [TTC_GROUPS_USE_L4_TYPE_ESP] = { -+ .use_l4_type = true, -+ .num_groups = 5, -+ .group_size = { -+ MLX5_TTC_GROUP_TCPUDP_SIZE, -+ BIT(1) + MLX5_NUM_TUNNEL_TT, -+ BIT(1), /* ESP */ -+ BIT(1), -+ BIT(0), -+ }, -+ }, - }; - - static const struct mlx5_fs_ttc_groups inner_ttc_groups[] = { -@@ -207,6 +231,23 @@ static const struct mlx5_fs_ttc_groups inner_ttc_groups[] = { - }, - }; - -+static const struct mlx5_fs_ttc_groups * -+mlx5_ttc_get_fs_groups(bool use_l4_type, bool ipsec_rss) -+{ -+ if (!ipsec_rss) -+ return use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] : -+ &ttc_groups[TTC_GROUPS_DEFAULT]; -+ -+ return use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE_ESP] : -+ &ttc_groups[TTC_GROUPS_DEFAULT_ESP]; -+} -+ -+bool mlx5_ttc_has_esp_flow_group(struct mlx5_ttc_table *ttc) -+{ -+ return ttc->groups == &ttc_groups[TTC_GROUPS_DEFAULT_ESP] || -+ ttc->groups == &ttc_groups[TTC_GROUPS_USE_L4_TYPE_ESP]; -+} -+ - u8 mlx5_get_proto_by_tunnel_type(enum mlx5_tunnel_types tt) - { - return ttc_tunnel_rules[tt].proto; -@@ -279,7 +320,7 @@ static void mlx5_fs_ttc_set_match_proto(void *headers_c, void *headers_v, - static struct mlx5_flow_handle * - mlx5_generate_ttc_rule(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, - struct mlx5_flow_destination *dest, u16 etype, u8 proto, -- bool use_l4_type) -+ bool use_l4_type, bool ipsec_rss) - { - int match_ipv_outer = - MLX5_CAP_FLOWTABLE_NIC_RX(dev, -@@ -316,6 +357,14 @@ mlx5_generate_ttc_rule(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, - MLX5_SET(fte_match_param, spec->match_value, outer_headers.ethertype, etype); - } - -+ if (ipsec_rss && proto == IPPROTO_ESP) { -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ misc_parameters_2.ipsec_next_header); -+ MLX5_SET(fte_match_param, spec->match_value, -+ misc_parameters_2.ipsec_next_header, 0); -+ spec->match_criteria_enable |= MLX5_MATCH_MISC_PARAMETERS_2; -+ } -+ - rule = mlx5_add_flow_rules(ft, spec, &flow_act, dest, 1); - if (IS_ERR(rule)) { - err = PTR_ERR(rule); -@@ -347,7 +396,8 @@ static int mlx5_generate_ttc_table_rules(struct mlx5_core_dev *dev, - rule->rule = mlx5_generate_ttc_rule(dev, ft, ¶ms->dests[tt], - ttc_rules[tt].etype, - ttc_rules[tt].proto, -- use_l4_type); -+ use_l4_type, -+ params->ipsec_rss); - if (IS_ERR(rule->rule)) { - err = PTR_ERR(rule->rule); - rule->rule = NULL; -@@ -370,7 +420,7 @@ static int mlx5_generate_ttc_table_rules(struct mlx5_core_dev *dev, - ¶ms->tunnel_dests[tt], - ttc_tunnel_rules[tt].etype, - ttc_tunnel_rules[tt].proto, -- use_l4_type); -+ use_l4_type, false); - if (IS_ERR(trules[tt])) { - err = PTR_ERR(trules[tt]); - trules[tt] = NULL; -@@ -385,10 +435,38 @@ static int mlx5_generate_ttc_table_rules(struct mlx5_core_dev *dev, - return err; - } - -+static int mlx5_create_ttc_table_ipsec_groups(struct mlx5_ttc_table *ttc, -+ u32 *in, int *next_ix) -+{ -+ u8 *mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); -+ const struct mlx5_fs_ttc_groups *groups = ttc->groups; -+ int ix = *next_ix; -+ -+ /* undecrypted ESP group */ -+ MLX5_SET_CFG(in, match_criteria_enable, -+ MLX5_MATCH_OUTER_HEADERS | MLX5_MATCH_MISC_PARAMETERS_2); -+ MLX5_SET_TO_ONES(fte_match_param, mc, -+ misc_parameters_2.ipsec_next_header); -+ MLX5_SET_CFG(in, start_flow_index, ix); -+ ix += groups->group_size[ttc->num_groups]; -+ MLX5_SET_CFG(in, end_flow_index, ix - 1); -+ ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in); -+ if (IS_ERR(ttc->g[ttc->num_groups])) -+ goto err; -+ ttc->num_groups++; -+ -+ *next_ix = ix; -+ -+ return 0; -+ -+err: -+ return PTR_ERR(ttc->g[ttc->num_groups]); -+} -+ - static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc, -- bool use_ipv, -- const struct mlx5_fs_ttc_groups *groups) -+ bool use_ipv) - { -+ const struct mlx5_fs_ttc_groups *groups = ttc->groups; - int inlen = MLX5_ST_SZ_BYTES(create_flow_group_in); - int ix = 0; - u32 *in; -@@ -436,8 +514,18 @@ static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc, - goto err; - ttc->num_groups++; - -+ if (mlx5_ttc_has_esp_flow_group(ttc)) { -+ err = mlx5_create_ttc_table_ipsec_groups(ttc, in, &ix); -+ if (err) -+ goto err; -+ -+ MLX5_SET(fte_match_param, mc, -+ misc_parameters_2.ipsec_next_header, 0); -+ } -+ - /* L3 Group */ - MLX5_SET(fte_match_param, mc, outer_headers.ip_protocol, 0); -+ MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); - MLX5_SET_CFG(in, start_flow_index, ix); - ix += groups->group_size[ttc->num_groups]; - MLX5_SET_CFG(in, end_flow_index, ix - 1); -@@ -709,7 +797,6 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, - bool match_ipv_outer = - MLX5_CAP_FLOWTABLE_NIC_RX(dev, - ft_field_support.outer_ip_version); -- const struct mlx5_fs_ttc_groups *groups; - struct mlx5_flow_namespace *ns; - struct mlx5_ttc_table *ttc; - bool use_l4_type; -@@ -738,11 +825,10 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, - return ERR_PTR(-EOPNOTSUPP); - } - -- groups = use_l4_type ? &ttc_groups[TTC_GROUPS_USE_L4_TYPE] : -- &ttc_groups[TTC_GROUPS_DEFAULT]; -+ ttc->groups = mlx5_ttc_get_fs_groups(use_l4_type, params->ipsec_rss); - - WARN_ON_ONCE(params->ft_attr.max_fte); -- params->ft_attr.max_fte = mlx5_fs_ttc_table_size(groups); -+ params->ft_attr.max_fte = mlx5_fs_ttc_table_size(ttc->groups); - ttc->t = mlx5_create_flow_table(ns, ¶ms->ft_attr); - if (IS_ERR(ttc->t)) { - err = PTR_ERR(ttc->t); -@@ -750,7 +836,7 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, - return ERR_PTR(err); - } - -- err = mlx5_create_ttc_table_groups(ttc, match_ipv_outer, groups); -+ err = mlx5_create_ttc_table_groups(ttc, match_ipv_outer); - if (err) - goto destroy_ft; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -index ab9434fe3ae6..aead62441550 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -@@ -47,6 +47,7 @@ struct ttc_params { - bool inner_ttc; - DECLARE_BITMAP(ignore_tunnel_dests, MLX5_NUM_TUNNEL_TT); - struct mlx5_flow_destination tunnel_dests[MLX5_NUM_TUNNEL_TT]; -+ bool ipsec_rss; - }; - - const char *mlx5_ttc_get_name(enum mlx5_traffic_types tt); -@@ -70,4 +71,6 @@ int mlx5_ttc_fwd_default_dest(struct mlx5_ttc_table *ttc, - bool mlx5_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev); - u8 mlx5_get_proto_by_tunnel_type(enum mlx5_tunnel_types tt); - -+bool mlx5_ttc_has_esp_flow_group(struct mlx5_ttc_table *ttc); -+ - #endif /* __MLX5_FS_TTC_H__ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1553-net-mlx5e-recirculate-decrypted-packets-into-ttc-table.patch b/SOURCES/1553-net-mlx5e-recirculate-decrypted-packets-into-ttc-table.patch deleted file mode 100644 index f1bf6ca98..000000000 --- a/SOURCES/1553-net-mlx5e-recirculate-decrypted-packets-into-ttc-table.patch +++ /dev/null @@ -1,121 +0,0 @@ -From 07129dc1f84040e1a13f973ccd55d90763e0715e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:29 -0400 -Subject: [PATCH] net/mlx5e: Recirculate decrypted packets into TTC table - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c69ac57199eac5259a715314a5edeb4c30925934 -Author: Jianbo Liu -Date: Thu Sep 18 10:19:21 2025 +0300 - - net/mlx5e: Recirculate decrypted packets into TTC table - - In the commit 5e466345291a ("net/mlx5e: IPsec: Add IPsec steering in - local NIC RX"), the decrypted packets are handled in RX error flow - table. There is only one rule in the table, which forwards packets to - the default ESP TIR. - - This patch updates the design to allow RSS after decryption. For ESP - traffic, SPI and IP addresses are the fields selected for RSS hash, - and it's common that only one SPI is configured in RX direction, so - RSS can't work properly as all the packets are hashed to one key in - this case. To take advantage of RSS and improve performance, the - decrypted packets need to be forwarded back to TTC table, where RSS - can work based on the decrypted packet types. - - Signed-off-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758179963-649455-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 65dc3529283b..417c8b654880 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -585,6 +585,20 @@ static int ipsec_miss_create(struct mlx5_core_dev *mdev, - return err; - } - -+static struct mlx5_flow_destination -+ipsec_rx_decrypted_pkt_def_dest(struct mlx5_ttc_table *ttc, u32 family) -+{ -+ struct mlx5_flow_destination dest; -+ -+ if (!mlx5_ttc_has_esp_flow_group(ttc)) -+ return mlx5_ttc_get_default_dest(ttc, family2tt(family)); -+ -+ dest.ft = mlx5_get_ttc_flow_table(ttc); -+ dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; -+ -+ return dest; -+} -+ - static void ipsec_rx_update_default_dest(struct mlx5e_ipsec_rx *rx, - struct mlx5_flow_destination *old_dest, - struct mlx5_flow_destination *new_dest) -@@ -598,10 +612,10 @@ static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) - { - struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, family, XFRM_DEV_OFFLOAD_PACKET); - struct mlx5_flow_namespace *ns = mlx5e_fs_get_ns(ipsec->fs, false); -+ struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false); - struct mlx5_flow_destination old_dest, new_dest; - -- old_dest = mlx5_ttc_get_default_dest(mlx5e_fs_get_ttc(ipsec->fs, false), -- family2tt(family)); -+ old_dest = ipsec_rx_decrypted_pkt_def_dest(ttc, family); - - mlx5_ipsec_fs_roce_rx_create(ipsec->mdev, ipsec->roce, ns, &old_dest, family, - MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL, MLX5E_NIC_PRIO); -@@ -614,12 +628,12 @@ static void handle_ipsec_rx_bringup(struct mlx5e_ipsec *ipsec, u32 family) - static void handle_ipsec_rx_cleanup(struct mlx5e_ipsec *ipsec, u32 family) - { - struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, family, XFRM_DEV_OFFLOAD_PACKET); -+ struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false); - struct mlx5_flow_destination old_dest, new_dest; - - old_dest.ft = mlx5_ipsec_fs_roce_ft_get(ipsec->roce, family); - old_dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; -- new_dest = mlx5_ttc_get_default_dest(mlx5e_fs_get_ttc(ipsec->fs, false), -- family2tt(family)); -+ new_dest = ipsec_rx_decrypted_pkt_def_dest(ttc, family); - ipsec_rx_update_default_dest(rx, &old_dest, &new_dest); - - mlx5_ipsec_fs_roce_rx_destroy(ipsec->roce, family, ipsec->mdev); -@@ -764,7 +778,7 @@ static int ipsec_rx_status_pass_dest_get(struct mlx5e_ipsec *ipsec, - if (rx == ipsec->rx_esw) - return mlx5_esw_ipsec_rx_status_pass_dest_get(ipsec, dest); - -- *dest = mlx5_ttc_get_default_dest(attr->ttc, family2tt(attr->family)); -+ *dest = ipsec_rx_decrypted_pkt_def_dest(attr->ttc, attr->family); - err = mlx5_ipsec_fs_roce_rx_create(ipsec->mdev, ipsec->roce, attr->ns, dest, - attr->family, MLX5E_ACCEL_FS_ESP_FT_ROCE_LEVEL, - attr->prio); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c -index b7d4b1a2baf2..d524f0220513 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/ipsec_fs_roce.c -@@ -164,6 +164,8 @@ ipsec_fs_roce_rx_rule_setup(struct mlx5_core_dev *mdev, - roce->rule = rule; - - memset(spec, 0, sizeof(*spec)); -+ if (default_dst->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE) -+ flow_act.flags |= FLOW_ACT_IGNORE_FLOW_LEVEL; - rule = mlx5_add_flow_rules(roce->ft, spec, &flow_act, default_dst, 1); - if (IS_ERR(rule)) { - err = PTR_ERR(rule); -@@ -178,6 +180,8 @@ ipsec_fs_roce_rx_rule_setup(struct mlx5_core_dev *mdev, - goto out; - - flow_act.action = MLX5_FLOW_CONTEXT_ACTION_FWD_DEST; -+ if (default_dst->type == MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE) -+ flow_act.flags &= ~FLOW_ACT_IGNORE_FLOW_LEVEL; - dst.type = MLX5_FLOW_DESTINATION_TYPE_TABLE_TYPE; - dst.ft = roce->ft_rdma; - rule = mlx5_add_flow_rules(roce->nic_master_ft, NULL, &flow_act, &dst, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1554-net-mlx5e-add-flow-groups-for-the-packets-decrypted-by-crypt.patch b/SOURCES/1554-net-mlx5e-add-flow-groups-for-the-packets-decrypted-by-crypt.patch deleted file mode 100644 index a244f9f9d..000000000 --- a/SOURCES/1554-net-mlx5e-add-flow-groups-for-the-packets-decrypted-by-crypt.patch +++ /dev/null @@ -1,275 +0,0 @@ -From 7f11b0bbd0d16e938d09619d971b88504bdd4dd1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:29 -0400 -Subject: [PATCH] net/mlx5e: Add flow groups for the packets decrypted by - crypto offload - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d8693cac22c7fa7ef13c836327f1720d3fe414f6 -Author: Jianbo Liu -Date: Thu Sep 18 10:19:22 2025 +0300 - - net/mlx5e: Add flow groups for the packets decrypted by crypto offload - - When using IPsec crypto offload, the hardware decrypts the packet - payload but preserves the ESP header. This prevents the standard RSS - mechanism from accessing the inner L4 (TCP/UDP) headers. As a result, - the RSS hash is calculated only on the outer L3 IP headers, causing - all traffic for a given IPsec tunnel to be directed to a single queue, - leading to poor traffic distribution. - - Newer firmware introduces the ability to match on l4_type_ext, which - exposes the L4 protocol type following an ESP header. This allows the - driver to create steering rules that can identify the inner protocols - of decrypted packets. - - This commit leverages this new capability to improve traffic - distribution. It adds two new flow groups to steer decrypted packets - to dedicated TIRs that was configured to perform RSS on the inner L4 - headers. - - These groups are inserted after the standard L4 group and before the - group that handles undecrypted ESP packets added in this series. The - first new group matches decrypted packets based on the outer IP - version (or ethertype) and l4_type_ext. The second new group matches - decrypted tunneled packets based on the inner IP version and - l4_type_ext. Eight new traffic types are also defined to support this - functionality. - - Signed-off-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758179963-649455-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -index 3fc093ec1f50..eb142f358470 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs.h -@@ -57,7 +57,7 @@ struct mlx5e_l2_table { - bool promisc_enabled; - }; - --#define MLX5E_NUM_INDIR_TIRS (MLX5_NUM_TT - 1) -+#define MLX5E_NUM_INDIR_TIRS (MLX5_NUM_INDIR_TIRS) - - #define MLX5_HASH_IP (MLX5_HASH_FIELD_SEL_SRC_IP |\ - MLX5_HASH_FIELD_SEL_DST_IP) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -index 701147d5e2e1..b18ef92837c1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c -@@ -901,6 +901,9 @@ static void mlx5e_set_inner_ttc_params(struct mlx5e_flow_steering *fs, - ft_attr->prio = MLX5E_NIC_PRIO; - - for (tt = 0; tt < MLX5_NUM_TT; tt++) { -+ if (mlx5_ttc_is_decrypted_esp_tt(tt)) -+ continue; -+ - ttc_params->dests[tt].type = MLX5_FLOW_DESTINATION_TYPE_TIR; - ttc_params->dests[tt].tir_num = - tt == MLX5_TT_ANY ? -@@ -910,6 +913,13 @@ static void mlx5e_set_inner_ttc_params(struct mlx5e_flow_steering *fs, - } - } - -+static bool mlx5e_ipsec_rss_supported(struct mlx5_core_dev *mdev) -+{ -+ return MLX5_CAP_NIC_RX_FT_FIELD_SUPPORT_2(mdev, ipsec_next_header) && -+ MLX5_CAP_NIC_RX_FT_FIELD_SUPPORT_2(mdev, outer_l4_type_ext) && -+ MLX5_CAP_NIC_RX_FT_FIELD_SUPPORT_2(mdev, inner_l4_type_ext); -+} -+ - void mlx5e_set_ttc_params(struct mlx5e_flow_steering *fs, - struct mlx5e_rx_res *rx_res, - struct ttc_params *ttc_params, bool tunnel, -@@ -925,9 +935,12 @@ void mlx5e_set_ttc_params(struct mlx5e_flow_steering *fs, - ft_attr->prio = MLX5E_NIC_PRIO; - - ttc_params->ipsec_rss = ipsec_rss && -- MLX5_CAP_NIC_RX_FT_FIELD_SUPPORT_2(fs->mdev, ipsec_next_header); -+ mlx5e_ipsec_rss_supported(fs->mdev); - - for (tt = 0; tt < MLX5_NUM_TT; tt++) { -+ if (mlx5_ttc_is_decrypted_esp_tt(tt)) -+ continue; -+ - ttc_params->dests[tt].type = MLX5_FLOW_DESTINATION_TYPE_TIR; - ttc_params->dests[tt].tir_num = - tt == MLX5_TT_ANY ? -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 1ddefeeeca01..e1599817c3b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -838,6 +838,9 @@ static void mlx5e_hairpin_set_ttc_params(struct mlx5e_hairpin *hp, - - ttc_params->ns_type = MLX5_FLOW_NAMESPACE_KERNEL; - for (tt = 0; tt < MLX5_NUM_TT; tt++) { -+ if (mlx5_ttc_is_decrypted_esp_tt(tt)) -+ continue; -+ - ttc_params->dests[tt].type = MLX5_FLOW_DESTINATION_TYPE_TIR; - ttc_params->dests[tt].tir_num = - tt == MLX5_TT_ANY ? -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -index 850fff4548c8..3cd5de6f714f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -@@ -9,7 +9,7 @@ - #include "mlx5_core.h" - #include "lib/fs_ttc.h" - --#define MLX5_TTC_MAX_NUM_GROUPS 5 -+#define MLX5_TTC_MAX_NUM_GROUPS 7 - #define MLX5_TTC_GROUP_TCPUDP_SIZE (MLX5_TT_IPV6_UDP + 1) - - struct mlx5_fs_ttc_groups { -@@ -188,10 +188,12 @@ static const struct mlx5_fs_ttc_groups ttc_groups[] = { - }, - }, - [TTC_GROUPS_DEFAULT_ESP] = { -- .num_groups = 4, -+ .num_groups = 6, - .group_size = { - MLX5_TTC_GROUP_TCPUDP_SIZE + BIT(1) + - MLX5_NUM_TUNNEL_TT, -+ BIT(2), /* decrypted outer L4 */ -+ BIT(2), /* decrypted inner L4 */ - BIT(1), /* ESP */ - BIT(1), - BIT(0), -@@ -199,10 +201,12 @@ static const struct mlx5_fs_ttc_groups ttc_groups[] = { - }, - [TTC_GROUPS_USE_L4_TYPE_ESP] = { - .use_l4_type = true, -- .num_groups = 5, -+ .num_groups = 7, - .group_size = { - MLX5_TTC_GROUP_TCPUDP_SIZE, - BIT(1) + MLX5_NUM_TUNNEL_TT, -+ BIT(2), /* decrypted outer L4 */ -+ BIT(2), /* decrypted inner L4 */ - BIT(1), /* ESP */ - BIT(1), - BIT(0), -@@ -391,6 +395,9 @@ static int mlx5_generate_ttc_table_rules(struct mlx5_core_dev *dev, - for (tt = 0; tt < MLX5_NUM_TT; tt++) { - struct mlx5_ttc_rule *rule = &rules[tt]; - -+ if (mlx5_ttc_is_decrypted_esp_tt(tt)) -+ continue; -+ - if (test_bit(tt, params->ignore_dests)) - continue; - rule->rule = mlx5_generate_ttc_rule(dev, ft, ¶ms->dests[tt], -@@ -436,15 +443,55 @@ static int mlx5_generate_ttc_table_rules(struct mlx5_core_dev *dev, - } - - static int mlx5_create_ttc_table_ipsec_groups(struct mlx5_ttc_table *ttc, -+ bool use_ipv, - u32 *in, int *next_ix) - { - u8 *mc = MLX5_ADDR_OF(create_flow_group_in, in, match_criteria); - const struct mlx5_fs_ttc_groups *groups = ttc->groups; - int ix = *next_ix; - -+ MLX5_SET(fte_match_param, mc, outer_headers.ip_protocol, 0); -+ -+ /* decrypted ESP outer group */ -+ MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_OUTER_HEADERS); -+ MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.l4_type_ext); -+ MLX5_SET_CFG(in, start_flow_index, ix); -+ ix += groups->group_size[ttc->num_groups]; -+ MLX5_SET_CFG(in, end_flow_index, ix - 1); -+ ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in); -+ if (IS_ERR(ttc->g[ttc->num_groups])) -+ goto err; -+ ttc->num_groups++; -+ -+ MLX5_SET(fte_match_param, mc, outer_headers.l4_type_ext, 0); -+ -+ /* decrypted ESP inner group */ -+ MLX5_SET_CFG(in, match_criteria_enable, MLX5_MATCH_INNER_HEADERS); -+ if (use_ipv) -+ MLX5_SET(fte_match_param, mc, outer_headers.ip_version, 0); -+ else -+ MLX5_SET(fte_match_param, mc, outer_headers.ethertype, 0); -+ MLX5_SET_TO_ONES(fte_match_param, mc, inner_headers.ip_version); -+ MLX5_SET_TO_ONES(fte_match_param, mc, inner_headers.l4_type_ext); -+ MLX5_SET_CFG(in, start_flow_index, ix); -+ ix += groups->group_size[ttc->num_groups]; -+ MLX5_SET_CFG(in, end_flow_index, ix - 1); -+ ttc->g[ttc->num_groups] = mlx5_create_flow_group(ttc->t, in); -+ if (IS_ERR(ttc->g[ttc->num_groups])) -+ goto err; -+ ttc->num_groups++; -+ -+ MLX5_SET(fte_match_param, mc, inner_headers.ip_version, 0); -+ MLX5_SET(fte_match_param, mc, inner_headers.l4_type_ext, 0); -+ - /* undecrypted ESP group */ - MLX5_SET_CFG(in, match_criteria_enable, - MLX5_MATCH_OUTER_HEADERS | MLX5_MATCH_MISC_PARAMETERS_2); -+ if (use_ipv) -+ MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_version); -+ else -+ MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ethertype); -+ MLX5_SET_TO_ONES(fte_match_param, mc, outer_headers.ip_protocol); - MLX5_SET_TO_ONES(fte_match_param, mc, - misc_parameters_2.ipsec_next_header); - MLX5_SET_CFG(in, start_flow_index, ix); -@@ -515,7 +562,7 @@ static int mlx5_create_ttc_table_groups(struct mlx5_ttc_table *ttc, - ttc->num_groups++; - - if (mlx5_ttc_has_esp_flow_group(ttc)) { -- err = mlx5_create_ttc_table_ipsec_groups(ttc, in, &ix); -+ err = mlx5_create_ttc_table_ipsec_groups(ttc, use_ipv, in, &ix); - if (err) - goto err; - -@@ -615,6 +662,9 @@ static int mlx5_generate_inner_ttc_table_rules(struct mlx5_core_dev *dev, - for (tt = 0; tt < MLX5_NUM_TT; tt++) { - struct mlx5_ttc_rule *rule = &rules[tt]; - -+ if (mlx5_ttc_is_decrypted_esp_tt(tt)) -+ continue; -+ - if (test_bit(tt, params->ignore_dests)) - continue; - rule->rule = mlx5_generate_inner_ttc_rule(dev, ft, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -index aead62441550..cae6a8ba0491 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -@@ -18,6 +18,14 @@ enum mlx5_traffic_types { - MLX5_TT_IPV4, - MLX5_TT_IPV6, - MLX5_TT_ANY, -+ MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP, -+ MLX5_TT_DECRYPTED_ESP_OUTER_IPV6_TCP, -+ MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_UDP, -+ MLX5_TT_DECRYPTED_ESP_OUTER_IPV6_UDP, -+ MLX5_TT_DECRYPTED_ESP_INNER_IPV4_TCP, -+ MLX5_TT_DECRYPTED_ESP_INNER_IPV6_TCP, -+ MLX5_TT_DECRYPTED_ESP_INNER_IPV4_UDP, -+ MLX5_TT_DECRYPTED_ESP_INNER_IPV6_UDP, - MLX5_NUM_TT, - MLX5_NUM_INDIR_TIRS = MLX5_TT_ANY, - }; -@@ -72,5 +80,10 @@ bool mlx5_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev); - u8 mlx5_get_proto_by_tunnel_type(enum mlx5_tunnel_types tt); - - bool mlx5_ttc_has_esp_flow_group(struct mlx5_ttc_table *ttc); -+static inline bool mlx5_ttc_is_decrypted_esp_tt(enum mlx5_traffic_types tt) -+{ -+ return tt >= MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP && -+ tt <= MLX5_TT_DECRYPTED_ESP_INNER_IPV6_UDP; -+} - - #endif /* __MLX5_FS_TTC_H__ */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1555-net-mlx5e-add-flow-rules-for-the-decrypted-esp-packets.patch b/SOURCES/1555-net-mlx5e-add-flow-rules-for-the-decrypted-esp-packets.patch deleted file mode 100644 index 63242f3cb..000000000 --- a/SOURCES/1555-net-mlx5e-add-flow-rules-for-the-decrypted-esp-packets.patch +++ /dev/null @@ -1,402 +0,0 @@ -From 8d599bd39e82ff0badd6f3b005532853e11fbc27 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:29 -0400 -Subject: [PATCH] net/mlx5e: Add flow rules for the decrypted ESP packets - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 72ed3ebf95a73b3c822ab7efb6a46114672179c5 -Author: Jianbo Liu -Date: Thu Sep 18 10:19:23 2025 +0300 - - net/mlx5e: Add flow rules for the decrypted ESP packets - - The previous commit introduced two new flow groups to enable L4 RSS - for decrypted IPsec traffic. This commit implements the logic to - populate these groups with the necessary steering rules. - - The rules are created dynamically whenever the first IPSec offload - rule is configured via the xfrm subsystem and the decryption tables - for RX are created. Each rule matches a specific decrypted traffic - type based on its ip version (or ethertype) and outer/inner - l4_type_ext, directing it to the appropriate L4 RSS-enabled TIR. - - The lifecycle of these steering rules is tied directly to the RX - tables. They are deleted when the RX tables are destroyed. - - Signed-off-by: Jianbo Liu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758179963-649455-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 417c8b654880..ef2878f0c20e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -61,6 +61,7 @@ struct mlx5e_ipsec_rx { - struct mlx5_flow_table *pol_miss_ft; - struct mlx5_flow_handle *pol_miss_rule; - u8 allow_tunnel_mode : 1; -+ u8 ttc_rules_added : 1; - }; - - /* IPsec RX flow steering */ -@@ -683,10 +684,13 @@ static void ipsec_mpv_work_handler(struct work_struct *_work) - complete(&work->master_priv->ipsec->comp); - } - --static void ipsec_rx_ft_disconnect(struct mlx5e_ipsec *ipsec, u32 family) -+static void ipsec_rx_ft_disconnect(struct mlx5e_ipsec *ipsec, -+ struct mlx5e_ipsec_rx *rx, u32 family) - { - struct mlx5_ttc_table *ttc = mlx5e_fs_get_ttc(ipsec->fs, false); - -+ if (rx->ttc_rules_added) -+ mlx5_ttc_destroy_ipsec_rules(ttc); - mlx5_ttc_fwd_default_dest(ttc, family2tt(family)); - } - -@@ -721,7 +725,7 @@ static void rx_destroy(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, - { - /* disconnect */ - if (rx != ipsec->rx_esw) -- ipsec_rx_ft_disconnect(ipsec, family); -+ ipsec_rx_ft_disconnect(ipsec, rx, family); - - mlx5_del_flow_rules(rx->sa.rule); - mlx5_destroy_flow_group(rx->sa.group); -@@ -821,10 +825,16 @@ static void ipsec_rx_ft_connect(struct mlx5e_ipsec *ipsec, - struct mlx5e_ipsec_rx_create_attr *attr) - { - struct mlx5_flow_destination dest = {}; -+ struct mlx5_ttc_table *ttc, *inner_ttc; - - dest.type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE; - dest.ft = rx->ft.sa; -- mlx5_ttc_fwd_dest(attr->ttc, family2tt(attr->family), &dest); -+ if (mlx5_ttc_fwd_dest(attr->ttc, family2tt(attr->family), &dest)) -+ return; -+ -+ ttc = mlx5e_fs_get_ttc(ipsec->fs, false); -+ inner_ttc = mlx5e_fs_get_ttc(ipsec->fs, true); -+ rx->ttc_rules_added = !mlx5_ttc_create_ipsec_rules(ttc, inner_ttc); - } - - static int ipsec_rx_chains_create_miss(struct mlx5e_ipsec *ipsec, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -index 3cd5de6f714f..7adad784ad46 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.c -@@ -32,10 +32,13 @@ static int mlx5_fs_ttc_table_size(const struct mlx5_fs_ttc_groups *groups) - struct mlx5_ttc_table { - int num_groups; - const struct mlx5_fs_ttc_groups *groups; -+ struct mlx5_core_dev *mdev; - struct mlx5_flow_table *t; - struct mlx5_flow_group **g; - struct mlx5_ttc_rule rules[MLX5_NUM_TT]; - struct mlx5_flow_handle *tunnel_rules[MLX5_NUM_TUNNEL_TT]; -+ u32 refcnt; -+ struct mutex mutex; /* Protect adding rules for ipsec crypto offload */ - }; - - struct mlx5_flow_table *mlx5_get_ttc_flow_table(struct mlx5_ttc_table *ttc) -@@ -302,6 +305,31 @@ static u8 mlx5_etype_to_ipv(u16 ethertype) - return 0; - } - -+static void mlx5_fs_ttc_set_match_ipv_outer(struct mlx5_core_dev *mdev, -+ struct mlx5_flow_spec *spec, -+ u16 etype) -+{ -+ int match_ipv_outer = -+ MLX5_CAP_FLOWTABLE_NIC_RX(mdev, -+ ft_field_support.outer_ip_version); -+ u8 ipv; -+ -+ ipv = mlx5_etype_to_ipv(etype); -+ if (match_ipv_outer && ipv) { -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ outer_headers.ip_version); -+ MLX5_SET(fte_match_param, spec->match_value, -+ outer_headers.ip_version, ipv); -+ } else { -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ outer_headers.ethertype); -+ MLX5_SET(fte_match_param, spec->match_value, -+ outer_headers.ethertype, etype); -+ } -+ -+ spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS; -+} -+ - static void mlx5_fs_ttc_set_match_proto(void *headers_c, void *headers_v, - u8 proto, bool use_l4_type) - { -@@ -326,14 +354,10 @@ mlx5_generate_ttc_rule(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, - struct mlx5_flow_destination *dest, u16 etype, u8 proto, - bool use_l4_type, bool ipsec_rss) - { -- int match_ipv_outer = -- MLX5_CAP_FLOWTABLE_NIC_RX(dev, -- ft_field_support.outer_ip_version); - MLX5_DECLARE_FLOW_ACT(flow_act); - struct mlx5_flow_handle *rule; - struct mlx5_flow_spec *spec; - int err = 0; -- u8 ipv; - - spec = kvzalloc(sizeof(*spec), GFP_KERNEL); - if (!spec) -@@ -350,16 +374,8 @@ mlx5_generate_ttc_rule(struct mlx5_core_dev *dev, struct mlx5_flow_table *ft, - proto, use_l4_type); - } - -- ipv = mlx5_etype_to_ipv(etype); -- if (match_ipv_outer && ipv) { -- spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS; -- MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.ip_version); -- MLX5_SET(fte_match_param, spec->match_value, outer_headers.ip_version, ipv); -- } else if (etype) { -- spec->match_criteria_enable = MLX5_MATCH_OUTER_HEADERS; -- MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.ethertype); -- MLX5_SET(fte_match_param, spec->match_value, outer_headers.ethertype, etype); -- } -+ if (etype) -+ mlx5_fs_ttc_set_match_ipv_outer(dev, spec, etype); - - if (ipsec_rss && proto == IPPROTO_ESP) { - MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -@@ -838,6 +854,7 @@ void mlx5_destroy_ttc_table(struct mlx5_ttc_table *ttc) - - kfree(ttc->g); - mlx5_destroy_flow_table(ttc->t); -+ mutex_destroy(&ttc->mutex); - kvfree(ttc); - } - -@@ -894,6 +911,9 @@ struct mlx5_ttc_table *mlx5_create_ttc_table(struct mlx5_core_dev *dev, - if (err) - goto destroy_ft; - -+ ttc->mdev = dev; -+ mutex_init(&ttc->mutex); -+ - return ttc; - - destroy_ft: -@@ -927,3 +947,194 @@ int mlx5_ttc_fwd_default_dest(struct mlx5_ttc_table *ttc, - - return mlx5_ttc_fwd_dest(ttc, type, &dest); - } -+ -+static void _mlx5_ttc_destroy_ipsec_rules(struct mlx5_ttc_table *ttc) -+{ -+ enum mlx5_traffic_types i; -+ -+ for (i = MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP; -+ i <= MLX5_TT_DECRYPTED_ESP_INNER_IPV6_UDP; i++) { -+ if (!ttc->rules[i].rule) -+ continue; -+ -+ mlx5_del_flow_rules(ttc->rules[i].rule); -+ ttc->rules[i].rule = NULL; -+ } -+} -+ -+void mlx5_ttc_destroy_ipsec_rules(struct mlx5_ttc_table *ttc) -+{ -+ if (!mlx5_ttc_has_esp_flow_group(ttc)) -+ return; -+ -+ mutex_lock(&ttc->mutex); -+ if (--ttc->refcnt) -+ goto unlock; -+ -+ _mlx5_ttc_destroy_ipsec_rules(ttc); -+unlock: -+ mutex_unlock(&ttc->mutex); -+} -+ -+static int mlx5_ttc_get_tt_attrs(enum mlx5_traffic_types type, -+ u16 *etype, int *l4_type_ext, -+ enum mlx5_traffic_types *tir_tt) -+{ -+ switch (type) { -+ case MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP: -+ case MLX5_TT_DECRYPTED_ESP_INNER_IPV4_TCP: -+ *etype = ETH_P_IP; -+ *l4_type_ext = MLX5_PACKET_L4_TYPE_EXT_TCP; -+ *tir_tt = MLX5_TT_IPV4_TCP; -+ break; -+ case MLX5_TT_DECRYPTED_ESP_OUTER_IPV6_TCP: -+ case MLX5_TT_DECRYPTED_ESP_INNER_IPV6_TCP: -+ *etype = ETH_P_IPV6; -+ *l4_type_ext = MLX5_PACKET_L4_TYPE_EXT_TCP; -+ *tir_tt = MLX5_TT_IPV6_TCP; -+ break; -+ case MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_UDP: -+ case MLX5_TT_DECRYPTED_ESP_INNER_IPV4_UDP: -+ *etype = ETH_P_IP; -+ *l4_type_ext = MLX5_PACKET_L4_TYPE_EXT_UDP; -+ *tir_tt = MLX5_TT_IPV4_UDP; -+ break; -+ case MLX5_TT_DECRYPTED_ESP_OUTER_IPV6_UDP: -+ case MLX5_TT_DECRYPTED_ESP_INNER_IPV6_UDP: -+ *etype = ETH_P_IPV6; -+ *l4_type_ext = MLX5_PACKET_L4_TYPE_EXT_UDP; -+ *tir_tt = MLX5_TT_IPV6_UDP; -+ break; -+ default: -+ return -EINVAL; -+ } -+ -+ return 0; -+} -+ -+static struct mlx5_flow_handle * -+mlx5_ttc_create_ipsec_outer_rule(struct mlx5_ttc_table *ttc, -+ enum mlx5_traffic_types type) -+{ -+ struct mlx5_flow_destination dest; -+ MLX5_DECLARE_FLOW_ACT(flow_act); -+ enum mlx5_traffic_types tir_tt; -+ struct mlx5_flow_handle *rule; -+ struct mlx5_flow_spec *spec; -+ int l4_type_ext; -+ u16 etype; -+ int err; -+ -+ err = mlx5_ttc_get_tt_attrs(type, &etype, &l4_type_ext, &tir_tt); -+ if (err) -+ return ERR_PTR(err); -+ -+ spec = kvzalloc(sizeof(*spec), GFP_KERNEL); -+ if (!spec) -+ return ERR_PTR(-ENOMEM); -+ -+ mlx5_fs_ttc_set_match_ipv_outer(ttc->mdev, spec, etype); -+ -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ outer_headers.l4_type_ext); -+ MLX5_SET(fte_match_param, spec->match_value, -+ outer_headers.l4_type_ext, l4_type_ext); -+ -+ dest = mlx5_ttc_get_default_dest(ttc, tir_tt); -+ -+ rule = mlx5_add_flow_rules(ttc->t, spec, &flow_act, &dest, 1); -+ if (IS_ERR(rule)) { -+ err = PTR_ERR(rule); -+ mlx5_core_err(ttc->mdev, "%s: add rule failed\n", __func__); -+ } -+ -+ kvfree(spec); -+ return err ? ERR_PTR(err) : rule; -+} -+ -+static struct mlx5_flow_handle * -+mlx5_ttc_create_ipsec_inner_rule(struct mlx5_ttc_table *ttc, -+ struct mlx5_ttc_table *inner_ttc, -+ enum mlx5_traffic_types type) -+{ -+ struct mlx5_flow_destination dest; -+ MLX5_DECLARE_FLOW_ACT(flow_act); -+ enum mlx5_traffic_types tir_tt; -+ struct mlx5_flow_handle *rule; -+ struct mlx5_flow_spec *spec; -+ int l4_type_ext; -+ u16 etype; -+ int err; -+ -+ err = mlx5_ttc_get_tt_attrs(type, &etype, &l4_type_ext, &tir_tt); -+ if (err) -+ return ERR_PTR(err); -+ -+ spec = kvzalloc(sizeof(*spec), GFP_KERNEL); -+ if (!spec) -+ return ERR_PTR(-ENOMEM); -+ -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ inner_headers.ip_version); -+ MLX5_SET(fte_match_param, spec->match_value, -+ inner_headers.ip_version, mlx5_etype_to_ipv(etype)); -+ MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, -+ inner_headers.l4_type_ext); -+ MLX5_SET(fte_match_param, spec->match_value, -+ inner_headers.l4_type_ext, l4_type_ext); -+ -+ dest = mlx5_ttc_get_default_dest(inner_ttc, tir_tt); -+ -+ spec->match_criteria_enable = MLX5_MATCH_INNER_HEADERS; -+ -+ rule = mlx5_add_flow_rules(ttc->t, spec, &flow_act, &dest, 1); -+ if (IS_ERR(rule)) { -+ err = PTR_ERR(rule); -+ mlx5_core_err(ttc->mdev, "%s: add rule failed\n", __func__); -+ } -+ -+ kvfree(spec); -+ return err ? ERR_PTR(err) : rule; -+} -+ -+int mlx5_ttc_create_ipsec_rules(struct mlx5_ttc_table *ttc, -+ struct mlx5_ttc_table *inner_ttc) -+{ -+ struct mlx5_flow_handle *rule; -+ enum mlx5_traffic_types i; -+ -+ if (!mlx5_ttc_has_esp_flow_group(ttc)) -+ return 0; -+ -+ mutex_lock(&ttc->mutex); -+ if (ttc->refcnt) -+ goto skip; -+ -+ for (i = MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP; -+ i <= MLX5_TT_DECRYPTED_ESP_OUTER_IPV6_UDP; i++) { -+ rule = mlx5_ttc_create_ipsec_outer_rule(ttc, i); -+ if (IS_ERR(rule)) -+ goto err_out; -+ -+ ttc->rules[i].rule = rule; -+ } -+ -+ for (i = MLX5_TT_DECRYPTED_ESP_INNER_IPV4_TCP; -+ i <= MLX5_TT_DECRYPTED_ESP_INNER_IPV6_UDP; i++) { -+ rule = mlx5_ttc_create_ipsec_inner_rule(ttc, inner_ttc, i); -+ if (IS_ERR(rule)) -+ goto err_out; -+ -+ ttc->rules[i].rule = rule; -+ } -+ -+skip: -+ ttc->refcnt++; -+ mutex_unlock(&ttc->mutex); -+ return 0; -+ -+err_out: -+ _mlx5_ttc_destroy_ipsec_rules(ttc); -+ mutex_unlock(&ttc->mutex); -+ return PTR_ERR(rule); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -index cae6a8ba0491..95f6e56724a2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/fs_ttc.h -@@ -80,6 +80,9 @@ bool mlx5_tunnel_inner_ft_supported(struct mlx5_core_dev *mdev); - u8 mlx5_get_proto_by_tunnel_type(enum mlx5_tunnel_types tt); - - bool mlx5_ttc_has_esp_flow_group(struct mlx5_ttc_table *ttc); -+int mlx5_ttc_create_ipsec_rules(struct mlx5_ttc_table *ttc, -+ struct mlx5_ttc_table *inner_ttc); -+void mlx5_ttc_destroy_ipsec_rules(struct mlx5_ttc_table *ttc); - static inline bool mlx5_ttc_is_decrypted_esp_tt(enum mlx5_traffic_types tt) - { - return tt >= MLX5_TT_DECRYPTED_ESP_OUTER_IPV4_TCP && --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1556-net-mlx5-remove-dead-code-from-total-vfs-setter.patch b/SOURCES/1556-net-mlx5-remove-dead-code-from-total-vfs-setter.patch deleted file mode 100644 index fff9d8feb..000000000 --- a/SOURCES/1556-net-mlx5-remove-dead-code-from-total-vfs-setter.patch +++ /dev/null @@ -1,70 +0,0 @@ -From 2817cd94836b1f849a6902fcab3c06edada5ad66 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:29 -0400 -Subject: [PATCH] net/mlx5: Remove dead code from total_vfs setter - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6a46e4faa8fd848acec81bd6149a44c3b9b17de6 -Author: Vlad Dumitrescu -Date: Thu Sep 18 15:05:07 2025 -0700 - - net/mlx5: Remove dead code from total_vfs setter - - The mlx5_devlink_total_vfs_set function branches based on per_pf_support - twice. Remove the second branch as the first one exits the function when - per_pf_support is false. - - Accidentally added as part of commit a4c49611cf4f ("net/mlx5: Implement - devlink total_vfs parameter"). - - Reported-by: Dan Carpenter - Closes: https://lore.kernel.org/linux-rdma/aMQWenzpdjhAX4fm@stanley.mountain/ - Signed-off-by: Vlad Dumitrescu - Link: https://patch.msgid.link/a6142a60-1948-439a-b0ae-ff1df26a37f8@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -index 383d8cfe4c0a..459a0b4d08e6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/nv_param.c -@@ -458,7 +458,6 @@ static int mlx5_devlink_total_vfs_set(struct devlink *devlink, u32 id, - { - struct mlx5_core_dev *dev = devlink_priv(devlink); - u32 mnvda[MLX5_ST_SZ_DW(mnvda_reg)]; -- bool per_pf_support; - void *data; - int err; - -@@ -474,9 +473,7 @@ static int mlx5_devlink_total_vfs_set(struct devlink *devlink, u32 id, - return -EOPNOTSUPP; - } - -- per_pf_support = MLX5_GET(nv_global_pci_cap, data, -- per_pf_total_vf_supported); -- if (!per_pf_support) { -+ if (!MLX5_GET(nv_global_pci_cap, data, per_pf_total_vf_supported)) { - /* We don't allow global SRIOV setting on per PF devlink */ - NL_SET_ERR_MSG_MOD(extack, - "SRIOV is not per PF on this device"); -@@ -489,14 +486,8 @@ static int mlx5_devlink_total_vfs_set(struct devlink *devlink, u32 id, - return err; - - MLX5_SET(nv_global_pci_conf, data, sriov_valid, 1); -- MLX5_SET(nv_global_pci_conf, data, per_pf_total_vf, per_pf_support); -- -- if (!per_pf_support) { -- MLX5_SET(nv_global_pci_conf, data, total_vfs, ctx->val.vu32); -- return mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); -- } -+ MLX5_SET(nv_global_pci_conf, data, per_pf_total_vf, 1); - -- /* SRIOV is per PF */ - err = mlx5_nv_param_write(dev, mnvda, sizeof(mnvda)); - if (err) - return err; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1557-net-mlx5-use-pe-format-specifier-for-error-pointers.patch b/SOURCES/1557-net-mlx5-use-pe-format-specifier-for-error-pointers.patch deleted file mode 100644 index 3dddec0ad..000000000 --- a/SOURCES/1557-net-mlx5-use-pe-format-specifier-for-error-pointers.patch +++ /dev/null @@ -1,553 +0,0 @@ -From a21dd06612a0f800db77e4067232edc09af2ae4e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: Use %pe format specifier for error pointers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b89cd87b77d48ff14aea743cdba4193e76feb588 -Author: Gal Pressman -Date: Thu Sep 18 13:43:47 2025 +0300 - - net/mlx5: Use %pe format specifier for error pointers - - Using the coccinelle test introduced in previous commit - (scripts/coccinelle/misc/ptr_err_to_pe.cocci), convert error logging - throughout the mlx5 driver to use the %pe format specifier instead of - PTR_ERR() with integer format specifiers. - - Signed-off-by: Gal Pressman - Reviewed-by: Alexei Lazar - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1758192227-701925-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -index 73f5b62b8c7f..a17f82321c25 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -@@ -138,8 +138,8 @@ void mlx5_reporter_vnic_create(struct mlx5_core_dev *dev) - dev); - if (IS_ERR(health->vnic_reporter)) - mlx5_core_warn(dev, -- "Failed to create vnic reporter, err = %ld\n", -- PTR_ERR(health->vnic_reporter)); -+ "Failed to create vnic reporter, err = %pe\n", -+ health->vnic_reporter); - } - - void mlx5_reporter_vnic_destroy(struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c -index b4f3bd7d346e..195863b2c013 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/hv_vhca_stats.c -@@ -138,8 +138,8 @@ void mlx5e_hv_vhca_stats_create(struct mlx5e_priv *priv) - if (IS_ERR_OR_NULL(agent)) { - if (IS_ERR(agent)) - netdev_warn(priv->netdev, -- "Failed to create hv vhca stats agent, err = %ld\n", -- PTR_ERR(agent)); -+ "Failed to create hv vhca stats agent, err = %pe\n", -+ agent); - - kvfree(priv->stats_agent.buf); - return; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -index 0f5d7ea8956f..9d1c677814e0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -@@ -488,8 +488,8 @@ static int mlx5_esw_bridge_switchdev_event(struct notifier_block *nb, - fdb_info, - br_offloads); - if (IS_ERR(work)) { -- WARN_ONCE(1, "Failed to init switchdev work, err=%ld", -- PTR_ERR(work)); -+ WARN_ONCE(1, "Failed to init switchdev work, err=%pe", -+ work); - return notifier_from_errno(PTR_ERR(work)); - } - -@@ -527,7 +527,8 @@ void mlx5e_rep_bridge_init(struct mlx5e_priv *priv) - br_offloads = mlx5_esw_bridge_init(esw); - rtnl_unlock(); - if (IS_ERR(br_offloads)) { -- esw_warn(mdev, "Failed to init esw bridge (err=%ld)\n", PTR_ERR(br_offloads)); -+ esw_warn(mdev, "Failed to init esw bridge (err=%pe)\n", -+ br_offloads); - return; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -index eb1cace5910c..b1415992ffa2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -@@ -672,8 +672,8 @@ void mlx5e_reporter_rx_create(struct mlx5e_priv *priv) - &mlx5_rx_reporter_ops, - priv); - if (IS_ERR(reporter)) { -- netdev_warn(priv->netdev, "Failed to create rx reporter, err = %ld\n", -- PTR_ERR(reporter)); -+ netdev_warn(priv->netdev, "Failed to create rx reporter, err = %pe\n", -+ reporter); - return; - } - priv->rx_reporter = reporter; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -index 8907c5378f54..f10b9c5bf55b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_tx.c -@@ -565,8 +565,8 @@ void mlx5e_reporter_tx_create(struct mlx5e_priv *priv) - priv); - if (IS_ERR(reporter)) { - netdev_warn(priv->netdev, -- "Failed to create tx reporter, err = %ld\n", -- PTR_ERR(reporter)); -+ "Failed to create tx reporter, err = %pe\n", -+ reporter); - return; - } - priv->tx_reporter = reporter; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -index 01d522b02947..d3db6146fcad 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_hmfs.c -@@ -136,8 +136,8 @@ mlx5_ct_fs_hmfs_matcher_get(struct mlx5_ct_fs *fs, struct mlx5_flow_spec *spec, - hws_bwc_matcher = mlx5_ct_fs_hmfs_matcher_create(fs, tbl, spec, ipv4, tcp, gre); - if (IS_ERR(hws_bwc_matcher)) { - netdev_warn(fs->netdev, -- "ct_fs_hmfs: failed to create bwc matcher (nat %d, ipv4 %d, tcp %d, gre %d), err: %ld\n", -- nat, ipv4, tcp, gre, PTR_ERR(hws_bwc_matcher)); -+ "ct_fs_hmfs: failed to create bwc matcher (nat %d, ipv4 %d, tcp %d, gre %d), err: %pe\n", -+ nat, ipv4, tcp, gre, hws_bwc_matcher); - - hmfs_matcher = ERR_CAST(hws_bwc_matcher); - goto out_unlock; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_smfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_smfs.c -index 0c97c5899904..4d6924b644c9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_smfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/ct_fs_smfs.c -@@ -148,8 +148,8 @@ mlx5_ct_fs_smfs_matcher_get(struct mlx5_ct_fs *fs, bool nat, bool ipv4, bool tcp - dr_matcher = mlx5_ct_fs_smfs_matcher_create(fs, tbl, ipv4, tcp, gre, prio); - if (IS_ERR(dr_matcher)) { - netdev_warn(fs->netdev, -- "ct_fs_smfs: failed to create matcher (nat %d, ipv4 %d, tcp %d, gre %d), err: %ld\n", -- nat, ipv4, tcp, gre, PTR_ERR(dr_matcher)); -+ "ct_fs_smfs: failed to create matcher (nat %d, ipv4 %d, tcp %d, gre %d), err: %pe\n", -+ nat, ipv4, tcp, gre, dr_matcher); - - smfs_matcher = ERR_CAST(dr_matcher); - goto out_unlock; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -index 8afcec0c5d3c..896f718483c3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -@@ -93,8 +93,8 @@ mlx5e_int_port_create_rx_rule(struct mlx5_eswitch *esw, - flow_rule = mlx5_add_flow_rules(esw->offloads.ft_offloads, spec, - &flow_act, dest, 1); - if (IS_ERR(flow_rule)) -- mlx5_core_warn(esw->dev, "ft offloads: Failed to add internal vport rx rule err %ld\n", -- PTR_ERR(flow_rule)); -+ mlx5_core_warn(esw->dev, "ft offloads: Failed to add internal vport rx rule err %pe\n", -+ flow_rule); - - kvfree(spec); - -@@ -322,8 +322,8 @@ mlx5e_tc_int_port_init(struct mlx5e_priv *priv) - sizeof(u32) * 2, - (1 << ESW_VPORT_BITS) - 1, true); - if (IS_ERR(int_port_priv->metadata_mapping)) { -- mlx5_core_warn(priv->mdev, "Can't allocate metadata mapping of int port offload, err=%ld\n", -- PTR_ERR(int_port_priv->metadata_mapping)); -+ mlx5_core_warn(priv->mdev, "Can't allocate metadata mapping of int port offload, err=%pe\n", -+ int_port_priv->metadata_mapping); - goto err_mapping; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c -index a0fc76a1bc08..0735d10f2bac 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c -@@ -172,8 +172,8 @@ void mlx5e_tc_encap_flows_add(struct mlx5e_priv *priv, - &reformat_params, - MLX5_FLOW_NAMESPACE_FDB); - if (IS_ERR(e->pkt_reformat)) { -- mlx5_core_warn(priv->mdev, "Failed to offload cached encapsulation header, %lu\n", -- PTR_ERR(e->pkt_reformat)); -+ mlx5_core_warn(priv->mdev, "Failed to offload cached encapsulation header, %pe\n", -+ e->pkt_reformat); - return; - } - e->flags |= MLX5_ENCAP_ENTRY_VALID; -@@ -1845,8 +1845,8 @@ static int mlx5e_tc_tun_fib_event(struct notifier_block *nb, unsigned long event - queue_work(priv->wq, &fib_work->work); - } else if (IS_ERR(fib_work)) { - NL_SET_ERR_MSG_MOD(info->extack, "Failed to init fib work"); -- mlx5_core_warn(priv->mdev, "Failed to init fib work, %ld\n", -- PTR_ERR(fib_work)); -+ mlx5_core_warn(priv->mdev, "Failed to init fib work, %pe\n", -+ fib_work); - } - - break; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c -index 4f83e3172767..1febdc5b81f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c -@@ -138,7 +138,7 @@ struct mlx5_flow_handle *mlx5e_accel_fs_add_sk(struct mlx5e_flow_steering *fs, - flow = mlx5_add_flow_rules(ft->t, spec, &flow_act, &dest, 1); - - if (IS_ERR(flow)) -- fs_err(fs, "mlx5_add_flow_rules() failed, flow is %ld\n", PTR_ERR(flow)); -+ fs_err(fs, "mlx5_add_flow_rules() failed, flow is %pe\n", flow); - - out: - kvfree(spec); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index ef2878f0c20e..6ccfc2af07b7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -1729,8 +1729,8 @@ static int setup_modify_header(struct mlx5e_ipsec *ipsec, int type, u32 val, u8 - - modify_hdr = mlx5_modify_header_alloc(mdev, ns_type, num_of_actions, action); - if (IS_ERR(modify_hdr)) { -- mlx5_core_err(mdev, "Failed to allocate modify_header %ld\n", -- PTR_ERR(modify_hdr)); -+ mlx5_core_err(mdev, "Failed to allocate modify_header %pe\n", -+ modify_hdr); - return PTR_ERR(modify_hdr); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index 96b744ceaf13..30424ccad584 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -210,8 +210,8 @@ int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises) - - mdev->mlx5e_res.dek_priv = mlx5_crypto_dek_init(mdev); - if (IS_ERR(mdev->mlx5e_res.dek_priv)) { -- mlx5_core_err(mdev, "crypto dek init failed, %ld\n", -- PTR_ERR(mdev->mlx5e_res.dek_priv)); -+ mlx5_core_err(mdev, "crypto dek init failed, %pe\n", -+ mdev->mlx5e_res.dek_priv); - mdev->mlx5e_res.dek_priv = NULL; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 2ce31ebd70d3..d19d743a88ae 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -1443,8 +1443,8 @@ static void mlx5e_rep_vnic_reporter_create(struct mlx5e_priv *priv, - rpriv); - if (IS_ERR(reporter)) { - mlx5_core_err(priv->mdev, -- "Failed to create representor vnic reporter, err = %ld\n", -- PTR_ERR(reporter)); -+ "Failed to create representor vnic reporter, err = %pe\n", -+ reporter); - return; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c -index 7dd1dc3f77c7..c9a1654d83a2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/egress_lgcy.c -@@ -87,8 +87,8 @@ int esw_acl_egress_lgcy_setup(struct mlx5_eswitch *esw, - drop_counter = mlx5_fc_create(esw->dev, false); - if (IS_ERR(drop_counter)) { - esw_warn(esw->dev, -- "vport[%d] configure egress drop rule counter err(%ld)\n", -- vport->vport, PTR_ERR(drop_counter)); -+ "vport[%d] configure egress drop rule counter err(%pe)\n", -+ vport->vport, drop_counter); - drop_counter = NULL; - } - vport->egress.legacy.drop_counter = drop_counter; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c -index 76e35c827da0..60e10047770f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/bridge.c -@@ -81,7 +81,8 @@ mlx5_esw_bridge_table_create(int max_fte, u32 level, struct mlx5_eswitch *esw) - ft_attr.prio = FDB_BR_OFFLOAD; - fdb = mlx5_create_flow_table(ns, &ft_attr); - if (IS_ERR(fdb)) -- esw_warn(dev, "Failed to create bridge FDB Table (err=%ld)\n", PTR_ERR(fdb)); -+ esw_warn(dev, "Failed to create bridge FDB Table (err=%pe)\n", -+ fdb); - - return fdb; - } -@@ -121,8 +122,8 @@ mlx5_esw_bridge_ingress_vlan_proto_fg_create(unsigned int from, unsigned int to, - kvfree(in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create VLAN(proto=%x) flow group for bridge ingress table (err=%ld)\n", -- vlan_proto, PTR_ERR(fg)); -+ "Failed to create VLAN(proto=%x) flow group for bridge ingress table (err=%pe)\n", -+ vlan_proto, fg); - - return fg; - } -@@ -180,8 +181,8 @@ mlx5_esw_bridge_ingress_vlan_proto_filter_fg_create(unsigned int from, unsigned - fg = mlx5_create_flow_group(ingress_ft, in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create bridge ingress table VLAN filter flow group (err=%ld)\n", -- PTR_ERR(fg)); -+ "Failed to create bridge ingress table VLAN filter flow group (err=%pe)\n", -+ fg); - kvfree(in); - return fg; - } -@@ -237,8 +238,8 @@ mlx5_esw_bridge_ingress_mac_fg_create(struct mlx5_eswitch *esw, struct mlx5_flow - fg = mlx5_create_flow_group(ingress_ft, in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create MAC flow group for bridge ingress table (err=%ld)\n", -- PTR_ERR(fg)); -+ "Failed to create MAC flow group for bridge ingress table (err=%pe)\n", -+ fg); - - kvfree(in); - return fg; -@@ -274,8 +275,8 @@ mlx5_esw_bridge_egress_vlan_proto_fg_create(unsigned int from, unsigned int to, - fg = mlx5_create_flow_group(egress_ft, in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create VLAN flow group for bridge egress table (err=%ld)\n", -- PTR_ERR(fg)); -+ "Failed to create VLAN flow group for bridge egress table (err=%pe)\n", -+ fg); - kvfree(in); - return fg; - } -@@ -324,8 +325,8 @@ mlx5_esw_bridge_egress_mac_fg_create(struct mlx5_eswitch *esw, struct mlx5_flow_ - fg = mlx5_create_flow_group(egress_ft, in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create bridge egress table MAC flow group (err=%ld)\n", -- PTR_ERR(fg)); -+ "Failed to create bridge egress table MAC flow group (err=%pe)\n", -+ fg); - kvfree(in); - return fg; - } -@@ -354,8 +355,8 @@ mlx5_esw_bridge_egress_miss_fg_create(struct mlx5_eswitch *esw, struct mlx5_flow - fg = mlx5_create_flow_group(egress_ft, in); - if (IS_ERR(fg)) - esw_warn(esw->dev, -- "Failed to create bridge egress table miss flow group (err=%ld)\n", -- PTR_ERR(fg)); -+ "Failed to create bridge egress table miss flow group (err=%pe)\n", -+ fg); - kvfree(in); - return fg; - } -@@ -501,8 +502,8 @@ mlx5_esw_bridge_egress_table_init(struct mlx5_esw_bridge_offloads *br_offloads, - if (mlx5_esw_bridge_pkt_reformat_vlan_pop_supported(esw)) { - miss_fg = mlx5_esw_bridge_egress_miss_fg_create(esw, egress_ft); - if (IS_ERR(miss_fg)) { -- esw_warn(esw->dev, "Failed to create miss flow group (err=%ld)\n", -- PTR_ERR(miss_fg)); -+ esw_warn(esw->dev, "Failed to create miss flow group (err=%pe)\n", -+ miss_fg); - miss_fg = NULL; - goto skip_miss_flow; - } -@@ -510,8 +511,8 @@ mlx5_esw_bridge_egress_table_init(struct mlx5_esw_bridge_offloads *br_offloads, - miss_pkt_reformat = mlx5_esw_bridge_pkt_reformat_vlan_pop_create(esw); - if (IS_ERR(miss_pkt_reformat)) { - esw_warn(esw->dev, -- "Failed to alloc packet reformat REMOVE_HEADER (err=%ld)\n", -- PTR_ERR(miss_pkt_reformat)); -+ "Failed to alloc packet reformat REMOVE_HEADER (err=%pe)\n", -+ miss_pkt_reformat); - miss_pkt_reformat = NULL; - mlx5_destroy_flow_group(miss_fg); - miss_fg = NULL; -@@ -522,8 +523,8 @@ mlx5_esw_bridge_egress_table_init(struct mlx5_esw_bridge_offloads *br_offloads, - br_offloads->skip_ft, - miss_pkt_reformat); - if (IS_ERR(miss_handle)) { -- esw_warn(esw->dev, "Failed to create miss flow (err=%ld)\n", -- PTR_ERR(miss_handle)); -+ esw_warn(esw->dev, "Failed to create miss flow (err=%pe)\n", -+ miss_handle); - miss_handle = NULL; - mlx5_packet_reformat_dealloc(esw->dev, miss_pkt_reformat); - miss_pkt_reformat = NULL; -@@ -1048,8 +1049,8 @@ mlx5_esw_bridge_vlan_push_create(u16 vlan_proto, struct mlx5_esw_bridge_vlan *vl - &reformat_params, - MLX5_FLOW_NAMESPACE_FDB); - if (IS_ERR(pkt_reformat)) { -- esw_warn(esw->dev, "Failed to alloc packet reformat INSERT_HEADER (err=%ld)\n", -- PTR_ERR(pkt_reformat)); -+ esw_warn(esw->dev, "Failed to alloc packet reformat INSERT_HEADER (err=%pe)\n", -+ pkt_reformat); - return PTR_ERR(pkt_reformat); - } - -@@ -1076,8 +1077,8 @@ mlx5_esw_bridge_vlan_pop_create(struct mlx5_esw_bridge_vlan *vlan, struct mlx5_e - - pkt_reformat = mlx5_esw_bridge_pkt_reformat_vlan_pop_create(esw); - if (IS_ERR(pkt_reformat)) { -- esw_warn(esw->dev, "Failed to alloc packet reformat REMOVE_HEADER (err=%ld)\n", -- PTR_ERR(pkt_reformat)); -+ esw_warn(esw->dev, "Failed to alloc packet reformat REMOVE_HEADER (err=%pe)\n", -+ pkt_reformat); - return PTR_ERR(pkt_reformat); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c -index 749c3957a128..407062096a82 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/vporttbl.c -@@ -45,8 +45,8 @@ esw_vport_tbl_create(struct mlx5_eswitch *esw, struct mlx5_flow_namespace *ns, - ft_attr.flags = vport_ns->flags; - fdb = mlx5_create_auto_grouped_flow_table(ns, &ft_attr); - if (IS_ERR(fdb)) { -- esw_warn(esw->dev, "Failed to create per vport FDB Table err %ld\n", -- PTR_ERR(fdb)); -+ esw_warn(esw->dev, "Failed to create per vport FDB Table err %pe\n", -+ fdb); - } - - return fdb; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 10eca910a2db..e2ffb87b94cb 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -257,8 +257,8 @@ __esw_fdb_set_vport_rule(struct mlx5_eswitch *esw, u16 vport, bool rx_rule, - &flow_act, &dest, 1); - if (IS_ERR(flow_rule)) { - esw_warn(esw->dev, -- "FDB: Failed to add flow rule: dmac_v(%pM) dmac_c(%pM) -> vport(%d), err(%ld)\n", -- dmac_v, dmac_c, vport, PTR_ERR(flow_rule)); -+ "FDB: Failed to add flow rule: dmac_v(%pM) dmac_c(%pM) -> vport(%d), err(%pe)\n", -+ dmac_v, dmac_c, vport, flow_rule); - flow_rule = NULL; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index bc9838dc5bf8..b8ec55929ab1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1016,8 +1016,8 @@ mlx5_eswitch_add_send_to_vport_rule(struct mlx5_eswitch *on_esw, - flow_rule = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(on_esw), - spec, &flow_act, &dest, 1); - if (IS_ERR(flow_rule)) -- esw_warn(on_esw->dev, "FDB: Failed to add send to vport rule err %ld\n", -- PTR_ERR(flow_rule)); -+ esw_warn(on_esw->dev, "FDB: Failed to add send to vport rule err %pe\n", -+ flow_rule); - out: - kvfree(spec); - return flow_rule; -@@ -1065,8 +1065,8 @@ mlx5_eswitch_add_send_to_vport_meta_rule(struct mlx5_eswitch *esw, u16 vport_num - flow_rule = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), - spec, &flow_act, &dest, 1); - if (IS_ERR(flow_rule)) -- esw_warn(esw->dev, "FDB: Failed to add send to vport meta rule vport %d, err %ld\n", -- vport_num, PTR_ERR(flow_rule)); -+ esw_warn(esw->dev, "FDB: Failed to add send to vport meta rule vport %d, err %pe\n", -+ vport_num, flow_rule); - - kvfree(spec); - return flow_rule; -@@ -2159,7 +2159,9 @@ mlx5_eswitch_create_vport_rx_rule(struct mlx5_eswitch *esw, u16 vport, - flow_rule = mlx5_add_flow_rules(esw->offloads.ft_offloads, spec, - &flow_act, dest, 1); - if (IS_ERR(flow_rule)) { -- esw_warn(esw->dev, "fs offloads: Failed to add vport rx rule err %ld\n", PTR_ERR(flow_rule)); -+ esw_warn(esw->dev, -+ "fs offloads: Failed to add vport rx rule err %pe\n", -+ flow_rule); - goto out; - } - -@@ -2178,8 +2180,8 @@ static int esw_create_vport_rx_drop_rule(struct mlx5_eswitch *esw) - &flow_act, NULL, 0); - if (IS_ERR(flow_rule)) { - esw_warn(esw->dev, -- "fs offloads: Failed to add vport rx drop rule err %ld\n", -- PTR_ERR(flow_rule)); -+ "fs offloads: Failed to add vport rx drop rule err %pe\n", -+ flow_rule); - return PTR_ERR(flow_rule); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/health.c b/drivers/net/ethernet/mellanox/mlx5/core/health.c -index b63c5a221eb9..aeeb136f5ebc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/health.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/health.c -@@ -718,15 +718,15 @@ void mlx5_fw_reporters_create(struct mlx5_core_dev *dev) - - health->fw_reporter = devl_health_reporter_create(devlink, fw_ops, dev); - if (IS_ERR(health->fw_reporter)) -- mlx5_core_warn(dev, "Failed to create fw reporter, err = %ld\n", -- PTR_ERR(health->fw_reporter)); -+ mlx5_core_warn(dev, "Failed to create fw reporter, err = %pe\n", -+ health->fw_reporter); - - health->fw_fatal_reporter = devl_health_reporter_create(devlink, - fw_fatal_ops, - dev); - if (IS_ERR(health->fw_fatal_reporter)) -- mlx5_core_warn(dev, "Failed to create fw fatal reporter, err = %ld\n", -- PTR_ERR(health->fw_fatal_reporter)); -+ mlx5_core_warn(dev, "Failed to create fw fatal reporter, err = %pe\n", -+ health->fw_fatal_reporter); - } - - static void mlx5_fw_reporters_destroy(struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c b/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -index 82d3c2568244..14d339eceb92 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/irq_affinity.c -@@ -150,8 +150,8 @@ mlx5_irq_affinity_request(struct mlx5_core_dev *dev, struct mlx5_irq_pool *pool, - if (IS_ERR(new_irq)) { - if (!least_loaded_irq) { - /* We failed to create an IRQ and we didn't find an IRQ */ -- mlx5_core_err(pool->dev, "Didn't find a matching IRQ. err = %ld\n", -- PTR_ERR(new_irq)); -+ mlx5_core_err(pool->dev, "Didn't find a matching IRQ. err = %pe\n", -+ new_irq); - mutex_unlock(&pool->lock); - return new_irq; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 8f2ad45bec9f..d0ba83d77cd1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -1365,9 +1365,9 @@ static void mlx5_init_clock_dev(struct mlx5_core_dev *mdev) - clock->ptp = ptp_clock_register(&clock->ptp_info, - clock->shared ? NULL : &mdev->pdev->dev); - if (IS_ERR(clock->ptp)) { -- mlx5_core_warn(mdev, "%sptp_clock_register failed %ld\n", -+ mlx5_core_warn(mdev, "%sptp_clock_register failed %pe\n", - clock->shared ? "shared clock " : "", -- PTR_ERR(clock->ptp)); -+ clock->ptp); - clock->ptp = NULL; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index c48f3d9765f7..77f587f97a2d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -979,8 +979,8 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - - dev->priv.devc = mlx5_devcom_register_device(dev); - if (IS_ERR(dev->priv.devc)) -- mlx5_core_warn(dev, "failed to register devcom device %ld\n", -- PTR_ERR(dev->priv.devc)); -+ mlx5_core_warn(dev, "failed to register devcom device %pe\n", -+ dev->priv.devc); - - err = mlx5_query_board_id(dev); - if (err) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1558-net-mlx5-expose-uar-access-and-odp-page-fault-counters.patch b/SOURCES/1558-net-mlx5-expose-uar-access-and-odp-page-fault-counters.patch deleted file mode 100644 index 69c562bba..000000000 --- a/SOURCES/1558-net-mlx5-expose-uar-access-and-odp-page-fault-counters.patch +++ /dev/null @@ -1,84 +0,0 @@ -From fecdf816a498c9d63e80e7253fdc1f84cfd02001 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: Expose uar access and odp page fault counters - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e835faaed2f80ee8652f59a54703edceab04f0d9 -Author: Akiva Goldberger -Date: Thu Sep 25 13:45:30 2025 +0300 - - net/mlx5: Expose uar access and odp page fault counters - - Add three counters to vnic health reporter: - bar_uar_access, odp_local_triggered_page_fault, and - odp_remote_triggered_page_fault. - - - bar_uar_access - number of WRITE or READ access operations to the UAR on the PCIe - BAR. - - odp_local_triggered_page_fault - number of locally-triggered page-faults due to ODP. - - odp_remote_triggered_page_fault - number of remotly-triggered page-faults due to ODP. - - Example access: - $ devlink health diagnose pci/0000:08:00.0 reporter vnic - vNIC env counters: - total_error_queues: 0 send_queue_priority_update_flow: 0 - comp_eq_overrun: 0 async_eq_overrun: 0 cq_overrun: 0 - invalid_command: 0 quota_exceeded_command: 0 - nic_receive_steering_discard: 0 icm_consumption: 1032 - bar_uar_access: 1279 odp_local_triggered_page_fault: 20 - odp_remote_triggered_page_fault: 34 - - Signed-off-by: Akiva Goldberger - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1758797130-829564-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/Documentation/networking/devlink/mlx5.rst b/Documentation/networking/devlink/mlx5.rst -index 41c9b716699e..0e5f9c76e514 100644 ---- a/Documentation/networking/devlink/mlx5.rst -+++ b/Documentation/networking/devlink/mlx5.rst -@@ -385,6 +385,12 @@ Description of the vnic counters: - amount of Interconnect Host Memory (ICM) consumed by the vnic in - granularity of 4KB. ICM is host memory allocated by SW upon HCA request - and is used for storing data structures that control HCA operation. -+- bar_uar_access -+ number of WRITE or READ access operations to the UAR on the PCIe BAR. -+- odp_local_triggered_page_fault -+ number of locally-triggered page-faults due to ODP. -+- odp_remote_triggered_page_fault -+ number of remotly-triggered page-faults due to ODP. - - User commands examples: - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -index a17f82321c25..7cae0c6e5e8a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/reporter_vnic.c -@@ -107,6 +107,15 @@ void mlx5_reporter_vnic_diagnose_counters(struct mlx5_core_dev *dev, - } - if (MLX5_CAP_GEN(dev, nic_cap_reg)) - mlx5_reporter_vnic_diagnose_counter_icm(dev, fmsg, vport_num, other_vport); -+ if (MLX5_CAP_GEN(dev, vnic_env_cnt_bar_uar_access)) -+ devlink_fmsg_u32_pair_put(fmsg, "bar_uar_access", -+ VNIC_ENV_GET(&vnic, bar_uar_access)); -+ if (MLX5_CAP_GEN(dev, vnic_env_cnt_odp_page_fault)) { -+ devlink_fmsg_u32_pair_put(fmsg, "odp_local_triggered_page_fault", -+ VNIC_ENV_GET(&vnic, odp_local_triggered_page_fault)); -+ devlink_fmsg_u32_pair_put(fmsg, "odp_remote_triggered_page_fault", -+ VNIC_ENV_GET(&vnic, odp_remote_triggered_page_fault)); -+ } - - devlink_fmsg_obj_nest_end(fmsg); - devlink_fmsg_pair_nest_end(fmsg); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1559-net-mlx5-add-ifc-bit-for-tir-sq-order-capability.patch b/SOURCES/1559-net-mlx5-add-ifc-bit-for-tir-sq-order-capability.patch deleted file mode 100644 index 8ecb7beed..000000000 --- a/SOURCES/1559-net-mlx5-add-ifc-bit-for-tir-sq-order-capability.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 0601b67c4234f8bb9e709a59115a2865e5c14437 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: Add IFC bit for TIR/SQ order capability - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1ddf1636e0e058adf2231486da0419243eb49539 -Author: Tariq Toukan -Date: Mon Sep 22 09:06:30 2025 +0300 - - net/mlx5: Add IFC bit for TIR/SQ order capability - - Before this cap, firmware requested a certain creation order between TIR - objects and SQs of the same transport domain to properly support the - self loopback prevention feature. If order is not preserved, explicit - modify_tir operations are necessary after the opening of the SQs. - - When set, this cap bit indicates that this firmware requirement / - limitation no longer holds. - - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758521191-814350-2-git-send-email-tariqt@nvidia.com - Reviewed-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 0ef2af28d424..3d0322b1bd5a 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -1894,7 +1894,8 @@ struct mlx5_ifc_cmd_hca_cap_bits { - - u8 reserved_at_2a0[0x7]; - u8 mkey_pcie_tph[0x1]; -- u8 reserved_at_2a8[0x2]; -+ u8 reserved_at_2a8[0x1]; -+ u8 tis_tir_td_order[0x1]; - - u8 psp[0x1]; - u8 shampo[0x1]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1560-net-mlx5-ifc-add-balance-id-and-lag-per-mp-group-bits.patch b/SOURCES/1560-net-mlx5-ifc-add-balance-id-and-lag-per-mp-group-bits.patch deleted file mode 100644 index 9ee995f7e..000000000 --- a/SOURCES/1560-net-mlx5-ifc-add-balance-id-and-lag-per-mp-group-bits.patch +++ /dev/null @@ -1,58 +0,0 @@ -From fde9ec2ca86396c0145e4498a5337df946ade79a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: IFC add balance ID and LAG per MP group bits - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 137d1a6355131457723b51a34192320d93d15654 -Author: Mark Bloch -Date: Mon Sep 22 09:06:31 2025 +0300 - - net/mlx5: IFC add balance ID and LAG per MP group bits - - Add interface definitions for load balance ID and LAG per multiplane group - functionality. This patch introduces the hardware capability bits needed - to support balance ID in multiplane LAG configurations. - - The new fields include: - - load_balance_id: 4-bit field for balance identifier. - - lag_per_mp_group: capability bit for LAG per multiplane group support. - - These interface additions are prerequisites for implementing balance ID - support in the MLX5 driver. - - Signed-off-by: Mark Bloch - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1758521191-814350-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 3d0322b1bd5a..5e2bc469ca64 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -2234,12 +2234,16 @@ struct mlx5_ifc_cmd_hca_cap_2_bits { - u8 reserved_at_440[0x8]; - u8 max_num_eqs_24b[0x18]; - -- u8 reserved_at_460[0x160]; -+ u8 reserved_at_460[0x144]; -+ u8 load_balance_id[0x4]; -+ u8 reserved_at_5a8[0x18]; - - u8 query_adjacent_functions_id[0x1]; - u8 ingress_egress_esw_vport_connect[0x1]; - u8 function_id_type_vhca_id[0x1]; -- u8 reserved_at_5c3[0xd]; -+ u8 reserved_at_5c3[0x1]; -+ u8 lag_per_mp_group[0x1]; -+ u8 reserved_at_5c5[0xb]; - u8 delegate_vhca_management_profiles[0x10]; - - u8 delegated_vhca_max[0x10]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1561-net-mlx5-stop-polling-for-command-response-if-interface-goes.patch b/SOURCES/1561-net-mlx5-stop-polling-for-command-response-if-interface-goes.patch deleted file mode 100644 index 513849859..000000000 --- a/SOURCES/1561-net-mlx5-stop-polling-for-command-response-if-interface-goes.patch +++ /dev/null @@ -1,56 +0,0 @@ -From 0064b668708144129c1860bcc8a92fb74d68f8e1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: Stop polling for command response if interface goes - down - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b1f0349bd6d320c382df2e7f6fc2ac95c85f2b18 -Author: Moshe Shemesh -Date: Mon Sep 29 00:02:07 2025 +0300 - - net/mlx5: Stop polling for command response if interface goes down - - Stop polling on firmware response to command in polling mode if the - command interface got down. This situation can occur, for example, if a - firmware fatal error is detected during polling. - - This change halts the polling process when the command interface goes - down, preventing unnecessary waits. - - Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") - Signed-off-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index e395ef5f356e..722282cebce9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -294,6 +294,10 @@ static void poll_timeout(struct mlx5_cmd_work_ent *ent) - return; - } - cond_resched(); -+ if (mlx5_cmd_is_down(dev)) { -+ ent->ret = -ENXIO; -+ return; -+ } - } while (time_before(jiffies, poll_end)); - - ent->ret = -ETIMEDOUT; -@@ -1070,7 +1074,7 @@ static void cmd_work_handler(struct work_struct *work) - poll_timeout(ent); - /* make sure we read the descriptor after ownership is SW */ - rmb(); -- mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, (ent->ret == -ETIMEDOUT)); -+ mlx5_cmd_comp_handler(dev, 1ULL << ent->idx, !!ent->ret); - } - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1562-net-mlx5-pagealloc-fix-reclaim-race-during-command-interface.patch b/SOURCES/1562-net-mlx5-pagealloc-fix-reclaim-race-during-command-interface.patch deleted file mode 100644 index a7e868c7e..000000000 --- a/SOURCES/1562-net-mlx5-pagealloc-fix-reclaim-race-during-command-interface.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 0c5ea60367085f9ccb735f4c05ee9e35faebf640 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: pagealloc: Fix reclaim race during command - interface teardown - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 79a0e32b32ac4e4f9e4bb22be97f371c8c116c88 -Author: Shay Drory -Date: Mon Sep 29 00:02:08 2025 +0300 - - net/mlx5: pagealloc: Fix reclaim race during command interface teardown - - The reclaim_pages_cmd() function sends a command to the firmware to - reclaim pages if the command interface is active. - - A race condition can occur if the command interface goes down (e.g., due - to a PCI error) while the mlx5_cmd_do() call is in flight. In this - case, mlx5_cmd_do() will return an error. The original code would - propagate this error immediately, bypassing the software-based page - reclamation logic that is supposed to run when the command interface is - down. - - Fix this by checking whether mlx5_cmd_do() returns -ENXIO, which mark - that command interface is down. If this is the case, fall through to - the software reclamation path. If the command failed for any another - reason, or finished successfully, return as before. - - Fixes: b898ce7bccf1 ("net/mlx5: cmdif, Avoid skipping reclaim pages if FW is not accessible") - Signed-off-by: Shay Drory - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -index 9bc9bd83c232..cd68c4b2c0bf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c -@@ -489,9 +489,12 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, - u32 func_id; - u32 npages; - u32 i = 0; -+ int err; - -- if (!mlx5_cmd_is_down(dev)) -- return mlx5_cmd_do(dev, in, in_size, out, out_size); -+ err = mlx5_cmd_do(dev, in, in_size, out, out_size); -+ /* If FW is gone (-ENXIO), proceed to forceful reclaim */ -+ if (err != -ENXIO) -+ return err; - - /* No hard feelings, we want our pages back! */ - npages = MLX5_GET(manage_pages_in, in, input_num_entries); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1563-net-mlx5-fw-reset-add-reset-timeout-work.patch b/SOURCES/1563-net-mlx5-fw-reset-add-reset-timeout-work.patch deleted file mode 100644 index d292f8731..000000000 --- a/SOURCES/1563-net-mlx5-fw-reset-add-reset-timeout-work.patch +++ /dev/null @@ -1,99 +0,0 @@ -From 4f09ee86bf6f20ac7470200bfb81f70ef9f10779 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:30 -0400 -Subject: [PATCH] net/mlx5: fw reset, add reset timeout work - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5cfbe7ebfa42fd3c517a701dab5bd73524da9088 -Author: Moshe Shemesh -Date: Mon Sep 29 00:02:09 2025 +0300 - - net/mlx5: fw reset, add reset timeout work - - Add sync reset timeout to stop poll_sync_reset in case there was no - reset done or abort event within timeout. Otherwise poll sync reset will - just continue and in case of fw fatal error no health reporting will be - done. - - Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") - Signed-off-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 22995131824a..89e399606877 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -27,6 +27,7 @@ struct mlx5_fw_reset { - struct work_struct reset_reload_work; - struct work_struct reset_now_work; - struct work_struct reset_abort_work; -+ struct delayed_work reset_timeout_work; - unsigned long reset_flags; - u8 reset_method; - struct timer_list timer; -@@ -259,6 +260,8 @@ static int mlx5_sync_reset_clear_reset_requested(struct mlx5_core_dev *dev, bool - return -EALREADY; - } - -+ if (current_work() != &fw_reset->reset_timeout_work.work) -+ cancel_delayed_work(&fw_reset->reset_timeout_work); - mlx5_stop_sync_reset_poll(dev); - if (poll_health) - mlx5_start_health_poll(dev); -@@ -330,6 +333,11 @@ static int mlx5_sync_reset_set_reset_requested(struct mlx5_core_dev *dev) - } - mlx5_stop_health_poll(dev, true); - mlx5_start_sync_reset_poll(dev); -+ -+ if (!test_bit(MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, -+ &fw_reset->reset_flags)) -+ schedule_delayed_work(&fw_reset->reset_timeout_work, -+ msecs_to_jiffies(mlx5_tout_ms(dev, PCI_SYNC_UPDATE))); - return 0; - } - -@@ -739,6 +747,19 @@ static void mlx5_sync_reset_events_handle(struct mlx5_fw_reset *fw_reset, struct - } - } - -+static void mlx5_sync_reset_timeout_work(struct work_struct *work) -+{ -+ struct delayed_work *dwork = container_of(work, struct delayed_work, -+ work); -+ struct mlx5_fw_reset *fw_reset = -+ container_of(dwork, struct mlx5_fw_reset, reset_timeout_work); -+ struct mlx5_core_dev *dev = fw_reset->dev; -+ -+ if (mlx5_sync_reset_clear_reset_requested(dev, true)) -+ return; -+ mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); -+} -+ - static int fw_reset_event_notifier(struct notifier_block *nb, unsigned long action, void *data) - { - struct mlx5_fw_reset *fw_reset = mlx5_nb_cof(nb, struct mlx5_fw_reset, nb); -@@ -822,6 +843,7 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) - cancel_work_sync(&fw_reset->reset_reload_work); - cancel_work_sync(&fw_reset->reset_now_work); - cancel_work_sync(&fw_reset->reset_abort_work); -+ cancel_delayed_work(&fw_reset->reset_timeout_work); - } - - static const struct devlink_param mlx5_fw_reset_devlink_params[] = { -@@ -865,6 +887,8 @@ int mlx5_fw_reset_init(struct mlx5_core_dev *dev) - INIT_WORK(&fw_reset->reset_reload_work, mlx5_sync_reset_reload_work); - INIT_WORK(&fw_reset->reset_now_work, mlx5_sync_reset_now_event); - INIT_WORK(&fw_reset->reset_abort_work, mlx5_sync_reset_abort_event); -+ INIT_DELAYED_WORK(&fw_reset->reset_timeout_work, -+ mlx5_sync_reset_timeout_work); - - init_completion(&fw_reset->done); - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1564-net-mlx5-improve-write-combining-test-reliability-for-arm64-.patch b/SOURCES/1564-net-mlx5-improve-write-combining-test-reliability-for-arm64-.patch deleted file mode 100644 index 9a3c52cc5..000000000 --- a/SOURCES/1564-net-mlx5-improve-write-combining-test-reliability-for-arm64-.patch +++ /dev/null @@ -1,164 +0,0 @@ -From f373b5ca04e4165f2d83fcb1b275b2b8d567ed67 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5: Improve write-combining test reliability for ARM64 - Grace CPUs - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fd8c8216648cd8c047bd3bcad65424ed44b5b450 -Author: Patrisious Haddad -Date: Mon Sep 29 00:08:08 2025 +0300 - - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs - - Write combining is an optimization feature in CPUs that is frequently - used by modern devices to generate 32 or 64 byte TLPs at the PCIe level. - These large TLPs allow certain optimizations in the driver to HW - communication that improve performance. As WC is unpredictable and - optional the HW designs all tolerate cases where combining doesn't - happen and simply experience a performance degradation. - - Unfortunately many virtualization environments on all architectures have - done things that completely disable WC inside the VM with no generic way - to detect this. For example WC was fully blocked in ARM64 KVM until - commit 8c47ce3e1d2c ("KVM: arm64: Set io memory s2 pte as normalnc for - vfio pci device"). - - Trying to use WC when it is known not to work has a measurable - performance cost (~5%). Long ago mlx5 developed an boot time algorithm - to test if WC is available or not by using unique mlx5 HW features to - measure how many large TLPs the device is receiving. The SW generates a - large number of combining opportunities and if any succeed then WC is - declared working. - - In mlx5 the WC optimization feature is never used by the kernel except - for the boot time test. The WC is only used by userspace in rdma-core. - - Sadly modern ARM CPUs, especially NVIDIA Grace, have a combining - implementation that is very unreliable compared to pretty much - everything prior. This is being fixed architecturally in new CPUs with a - new ST64B instruction, but current shipping devices suffer this problem. - - Unreliable means the SW can present thousands of combining opportunities - and the HW will not combine for any of them, which creates a performance - degradation, and critically fails the mlx5 boot test. However, the CPU - is very sensitive to the instruction sequence used, with the better - options being sufficiently good that the performance loss from the - unreliable CPU is not measurable. - - Broadly there are several options, from worst to best: - 1) A C loop doing a u64 memcpy. - This was used prior to commit ef302283ddfc - ("IB/mlx5: Use __iowrite64_copy() for write combining stores") - and failed almost all the time on Grace CPUs. - - 2) ARM64 assembly with consecutive 8 byte stores. This was implemented - as an arch-generic __iowriteXX_copy() family of functions suitable - for performance use in drivers for WC. commit ead79118dae6 - ("arm64/io: Provide a WC friendly __iowriteXX_copy()") provided the - ARM implementation. - - 3) ARM64 assembly with consecutive 16 byte stores. This was rejected - from kernel use over fears of virtualization failures. Common ARM - VMMs will crash if STP is used against emulated memory. - - 4) A single NEON store instruction. Userspace has used this option for a - very long time, it performs well. - - 5) For future silicon the new ST64B instruction is guaranteed to - generate a 64 byte TLP 100% of the time - - The past upgrade from #1 to #2 was thought to be sufficient to solve - this problem. However, more testing on more systems shows that #3 is - still problematic at a low frequency and the kernel test fails. - - Thus, make the mlx5 use the same instructions as userspace during the - boot time WC self test. This way the WC test matches the userspace and - will properly detect the ability of HW to support the WC workload that - userspace will generate. While #4 still has imperfect combining - performance, it is substantially better than #2, and does actually give - a performance win to applications. Self-test failures with #2 are like - 3/10 boots, on some systems, #4 has never seen a boot failure. - - There is no real general use case for a NEON based WC flow in the - kernel. This is not suitable for any performance path work as getting - into/out of a NEON context is fairly expensive compared to the gain of - WC. Future CPUs are going to fix this issue by using an new ARM - instruction and __iowriteXX_copy() will be updated to use that - automatically, probably using the ALTERNATES mechanism. - - Since this problem is constrained to mlx5's unique situation of needing - a non-performance code path to duplicate what mlx5 userspace is doing as - a matter of self-testing, implement it as a one line inline assembly in - the driver directly. - - Lastly, this was concluded from the discussion with ARM maintainers - which confirms that this is the best approach for the solution: - https://lore.kernel.org/r/aHqN_hpJl84T1Usi@arm.com - - Signed-off-by: Patrisious Haddad - Reviewed-by: Michael Guralnik - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759093688-841357-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wc.c b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -index 999d6216648a..c281153bd411 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/wc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -@@ -7,6 +7,10 @@ - #include "mlx5_core.h" - #include "wq.h" - -+#if IS_ENABLED(CONFIG_KERNEL_MODE_NEON) && IS_ENABLED(CONFIG_ARM64) -+#include -+#endif -+ - #define TEST_WC_NUM_WQES 255 - #define TEST_WC_LOG_CQ_SZ (order_base_2(TEST_WC_NUM_WQES)) - #define TEST_WC_SQ_LOG_WQ_SZ TEST_WC_LOG_CQ_SZ -@@ -255,6 +259,27 @@ static void mlx5_wc_destroy_sq(struct mlx5_wc_sq *sq) - mlx5_wq_destroy(&sq->wq_ctrl); - } - -+static void mlx5_iowrite64_copy(struct mlx5_wc_sq *sq, __be32 mmio_wqe[16], -+ size_t mmio_wqe_size, unsigned int offset) -+{ -+#if IS_ENABLED(CONFIG_KERNEL_MODE_NEON) && IS_ENABLED(CONFIG_ARM64) -+ if (cpu_has_neon()) { -+ kernel_neon_begin(); -+ asm volatile -+ (".arch_extension simd;\n\t" -+ "ld1 {v0.16b, v1.16b, v2.16b, v3.16b}, [%0]\n\t" -+ "st1 {v0.16b, v1.16b, v2.16b, v3.16b}, [%1]" -+ : -+ : "r"(mmio_wqe), "r"(sq->bfreg.map + offset) -+ : "memory", "v0", "v1", "v2", "v3"); -+ kernel_neon_end(); -+ return; -+ } -+#endif -+ __iowrite64_copy(sq->bfreg.map + offset, mmio_wqe, -+ mmio_wqe_size / 8); -+} -+ - static void mlx5_wc_post_nop(struct mlx5_wc_sq *sq, unsigned int *offset, - bool signaled) - { -@@ -289,8 +314,7 @@ static void mlx5_wc_post_nop(struct mlx5_wc_sq *sq, unsigned int *offset, - */ - wmb(); - -- __iowrite64_copy(sq->bfreg.map + *offset, mmio_wqe, -- sizeof(mmio_wqe) / 8); -+ mlx5_iowrite64_copy(sq, mmio_wqe, sizeof(mmio_wqe), *offset); - - *offset ^= buf_size; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1565-net-mlx5-hws-generalize-complex-matchers.patch b/SOURCES/1565-net-mlx5-hws-generalize-complex-matchers.patch deleted file mode 100644 index 2c6d9e62e..000000000 --- a/SOURCES/1565-net-mlx5-hws-generalize-complex-matchers.patch +++ /dev/null @@ -1,2553 +0,0 @@ -From 64ec2870c12373c3f1c66188d1ae32408554f918 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5: HWS, Generalize complex matchers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 906154caa7d3d750d47cd18f9349b75b77e12854 -Author: Vlad Dogaru -Date: Mon Sep 29 00:25:17 2025 +0300 - - net/mlx5: HWS, Generalize complex matchers - - The existing solution of complex matchers splits the match parameters - across two, and exactly two, matchers. For some rather extreme cases - (e.g. IPv6-in-IPv6 tunnels), even two matchers are not enough. - - Generalize complex matchers to up to 4 submatchers, and allow easy - extension to more if needed. This resulted in rewriting a large part - of the high-level complex matchers logic, but the original concepts - were rock solid and still hold. - - Key characteristics of the new implementation: - - * Rework complex matchers to include multiple submatchers. All - submatchers but the first are isolated, in keeping with the existing - paradigm of handing off to specialized matchers that are not otherwise - reachable by regular rules. - - * Similarly, rework complex rules to allow splitting them into more than - two simple rules. Rules continue to be refcounted to allow for - multiple complex rules matching on identical parts of the match - params. - - * Rely on the match tag, as opposed to the entire match_param, to hash - subrules. This results in lower memory usage. - - * Prefer to split the original user-supplied match parameters rather - than the internal field descriptors. This avoids the awkward - transition back and forth between the two formats. - - * Allow splitting multi-dword fields across matchers. The only - restrictions that the new implementation impose are: a) any fragment - of an IP address must be accompanied by a match on the IP version; and - b) a single lower dword of an IPv6 address cannot be present in a - submatcher as it would be interpreted as an IPv4 address. - - * Employ a greedy algorithm to split the match params, as opposed to - complete search. The results are not optimal, but the algorithm is now - linear compared to exponential. Consequently, we see complex matcher - creation time drops two orders of magnitude in our tests. - - Signed-off-by: Vlad Dogaru - Signed-off-by: Yevgeny Kliteynik - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -index adeccc588e5d..6ef0c4be27e1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.c -@@ -51,9 +51,6 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - u8 size_log_rx, u8 size_log_tx, - struct mlx5hws_matcher_attr *attr) - { -- struct mlx5hws_bwc_matcher *first_matcher = -- bwc_matcher->complex_first_bwc_matcher; -- - memset(attr, 0, sizeof(*attr)); - - attr->priority = priority; -@@ -66,9 +63,6 @@ static void hws_bwc_matcher_init_attr(struct mlx5hws_bwc_matcher *bwc_matcher, - attr->size[MLX5HWS_MATCHER_SIZE_TYPE_TX].rule.num_log = size_log_tx; - attr->resizable = true; - attr->max_num_of_at_attach = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; -- -- attr->isolated_matcher_end_ft_id = -- first_matcher ? first_matcher->matcher->end_ft_id : 0; - } - - static int -@@ -171,10 +165,16 @@ hws_bwc_matcher_move_all_simple(struct mlx5hws_bwc_matcher *bwc_matcher) - - static int hws_bwc_matcher_move_all(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- if (!bwc_matcher->complex) -+ switch (bwc_matcher->matcher_type) { -+ case MLX5HWS_BWC_MATCHER_SIMPLE: - return hws_bwc_matcher_move_all_simple(bwc_matcher); -- -- return mlx5hws_bwc_matcher_move_all_complex(bwc_matcher); -+ case MLX5HWS_BWC_MATCHER_COMPLEX_FIRST: -+ return mlx5hws_bwc_matcher_complex_move_first(bwc_matcher); -+ case MLX5HWS_BWC_MATCHER_COMPLEX_SUBMATCHER: -+ return mlx5hws_bwc_matcher_complex_move(bwc_matcher); -+ default: -+ return -EINVAL; -+ } - } - - static int hws_bwc_matcher_move(struct mlx5hws_bwc_matcher *bwc_matcher) -@@ -249,6 +249,7 @@ int mlx5hws_bwc_matcher_create_simple(struct mlx5hws_bwc_matcher *bwc_matcher, - bwc_matcher->tx_size.size_log, - &attr); - -+ bwc_matcher->matcher_type = MLX5HWS_BWC_MATCHER_SIMPLE; - bwc_matcher->priority = priority; - - bwc_matcher->size_of_at_array = MLX5HWS_BWC_MATCHER_ATTACH_AT_NUM; -@@ -393,7 +394,7 @@ int mlx5hws_bwc_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) - "BWC matcher destroy: matcher still has %u RX and %u TX rules\n", - rx_rules, tx_rules); - -- if (bwc_matcher->complex) -+ if (bwc_matcher->matcher_type == MLX5HWS_BWC_MATCHER_COMPLEX_FIRST) - mlx5hws_bwc_matcher_destroy_complex(bwc_matcher); - else - mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -@@ -651,7 +652,8 @@ int mlx5hws_bwc_rule_destroy_simple(struct mlx5hws_bwc_rule *bwc_rule) - - int mlx5hws_bwc_rule_destroy(struct mlx5hws_bwc_rule *bwc_rule) - { -- bool is_complex = !!bwc_rule->bwc_matcher->complex; -+ bool is_complex = bwc_rule->bwc_matcher->matcher_type == -+ MLX5HWS_BWC_MATCHER_COMPLEX_FIRST; - int ret = 0; - - if (is_complex) -@@ -1147,7 +1149,7 @@ mlx5hws_bwc_rule_create(struct mlx5hws_bwc_matcher *bwc_matcher, - - bwc_queue_idx = hws_bwc_gen_queue_idx(ctx); - -- if (bwc_matcher->complex) -+ if (bwc_matcher->matcher_type == MLX5HWS_BWC_MATCHER_COMPLEX_FIRST) - ret = mlx5hws_bwc_rule_create_complex(bwc_rule, - params, - flow_source, -@@ -1216,10 +1218,9 @@ int mlx5hws_bwc_rule_action_update(struct mlx5hws_bwc_rule *bwc_rule, - return -EINVAL; - } - -- /* For complex rule, the update should happen on the second matcher */ -- if (bwc_rule->isolated_bwc_rule) -- return hws_bwc_rule_action_update(bwc_rule->isolated_bwc_rule, -- rule_actions); -- else -- return hws_bwc_rule_action_update(bwc_rule, rule_actions); -+ /* For complex rules, the update should happen on the last subrule. */ -+ while (bwc_rule->next_subrule) -+ bwc_rule = bwc_rule->next_subrule; -+ -+ return hws_bwc_rule_action_update(bwc_rule, rule_actions); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -index af391d70c14f..b905511f5c53 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc.h -@@ -18,6 +18,21 @@ - - #define MLX5HWS_BWC_POLLING_TIMEOUT 60 - -+enum mlx5hws_bwc_matcher_type { -+ /* Standalone bwc matcher. */ -+ MLX5HWS_BWC_MATCHER_SIMPLE, -+ /* The first matcher of a complex matcher. When rules are inserted into -+ * a matcher of this type, they are split into subrules and inserted -+ * into their corresponding submatchers. -+ */ -+ MLX5HWS_BWC_MATCHER_COMPLEX_FIRST, -+ /* A submatcher that is part of a complex matcher. For most purposes -+ * these are treated as simple matchers, except when it comes to moving -+ * rules during resize. -+ */ -+ MLX5HWS_BWC_MATCHER_COMPLEX_SUBMATCHER, -+}; -+ - struct mlx5hws_bwc_matcher_complex_data; - - struct mlx5hws_bwc_matcher_size { -@@ -31,9 +46,9 @@ struct mlx5hws_bwc_matcher { - struct mlx5hws_match_template *mt; - struct mlx5hws_action_template **at; - struct mlx5hws_bwc_matcher_complex_data *complex; -- struct mlx5hws_bwc_matcher *complex_first_bwc_matcher; - u8 num_of_at; - u8 size_of_at_array; -+ enum mlx5hws_bwc_matcher_type matcher_type; - u32 priority; - struct mlx5hws_bwc_matcher_size rx_size; - struct mlx5hws_bwc_matcher_size tx_size; -@@ -43,8 +58,8 @@ struct mlx5hws_bwc_matcher { - struct mlx5hws_bwc_rule { - struct mlx5hws_bwc_matcher *bwc_matcher; - struct mlx5hws_rule *rule; -- struct mlx5hws_bwc_rule *isolated_bwc_rule; -- struct mlx5hws_bwc_complex_rule_hash_node *complex_hash_node; -+ struct mlx5hws_bwc_rule *next_subrule; -+ struct mlx5hws_bwc_complex_subrule_data *subrule_data; - u32 flow_source; - u16 bwc_queue_idx; - bool skip_rx; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -index 14e79579c719..660630f18ce9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.c -@@ -3,25 +3,27 @@ - - #include "internal.h" - --#define HWS_CLEAR_MATCH_PARAM(mask, field) \ -- MLX5_SET(fte_match_param, (mask)->match_buf, field, 0) -- --#define HWS_SZ_MATCH_PARAM (MLX5_ST_SZ_DW_MATCH_PARAM * 4) -- --static const struct rhashtable_params hws_refcount_hash = { -- .key_len = sizeof_field(struct mlx5hws_bwc_complex_rule_hash_node, -- match_buf), -- .key_offset = offsetof(struct mlx5hws_bwc_complex_rule_hash_node, -- match_buf), -- .head_offset = offsetof(struct mlx5hws_bwc_complex_rule_hash_node, -- hash_node), -- .automatic_shrinking = true, -- .min_size = 1, -+/* We chain submatchers by applying three rules on a subrule: modify header (to -+ * set register C6), jump to table (to the next submatcher) and the mandatory -+ * last rule. -+ */ -+#define HWS_NUM_CHAIN_ACTIONS 3 -+ -+static const struct rhashtable_params hws_rules_hash_params = { -+ .key_len = sizeof_field(struct mlx5hws_bwc_complex_subrule_data, -+ match_tag), -+ .key_offset = -+ offsetof(struct mlx5hws_bwc_complex_subrule_data, match_tag), -+ .head_offset = -+ offsetof(struct mlx5hws_bwc_complex_subrule_data, hash_node), -+ .automatic_shrinking = true, .min_size = 1, - }; - --bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, -- u8 match_criteria_enable, -- struct mlx5hws_match_parameters *mask) -+static bool -+hws_match_params_exceeds_definer(struct mlx5hws_context *ctx, -+ u8 match_criteria_enable, -+ struct mlx5hws_match_parameters *mask, -+ bool allow_jumbo) - { - struct mlx5hws_definer match_layout = {0}; - struct mlx5hws_match_template *mt; -@@ -36,11 +38,11 @@ bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, - mask->match_sz, - match_criteria_enable); - if (!mt) { -- mlx5hws_err(ctx, "BWC: failed creating match template\n"); -+ mlx5hws_err(ctx, "Complex matcher: failed creating match template\n"); - return false; - } - -- ret = mlx5hws_definer_calc_layout(ctx, mt, &match_layout); -+ ret = mlx5hws_definer_calc_layout(ctx, mt, &match_layout, allow_jumbo); - if (ret) { - /* The only case that we're interested in is E2BIG, - * which means that the match parameters need to be -@@ -64,825 +66,481 @@ bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, - return is_complex; - } - --static void --hws_bwc_matcher_complex_params_clear_fld(struct mlx5hws_context *ctx, -- enum mlx5hws_definer_fname fname, -+bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, -+ u8 match_criteria_enable, - struct mlx5hws_match_parameters *mask) - { -- struct mlx5hws_cmd_query_caps *caps = ctx->caps; -- -- switch (fname) { -- case MLX5HWS_DEFINER_FNAME_ETH_TYPE_O: -- case MLX5HWS_DEFINER_FNAME_ETH_TYPE_I: -- case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_O: -- case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_I: -- case MLX5HWS_DEFINER_FNAME_IP_VERSION_O: -- case MLX5HWS_DEFINER_FNAME_IP_VERSION_I: -- /* Because of the strict requirements for IP address matching -- * that require ethtype/ip_version matching as well, don't clear -- * these fields - have them in both parts of the complex matcher -- */ -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.smac_47_16); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.smac_47_16); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.smac_15_0); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.smac_15_0); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.dmac_47_16); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.dmac_47_16); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.dmac_15_0); -- break; -- case MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.dmac_15_0); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_TYPE_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.cvlan_tag); -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.svlan_tag); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_TYPE_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.cvlan_tag); -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.svlan_tag); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_FIRST_PRIO_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_prio); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_FIRST_PRIO_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_prio); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_CFI_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_cfi); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_CFI_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_cfi); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_ID_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.first_vid); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_ID_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.first_vid); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_TYPE_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.outer_second_cvlan_tag); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.outer_second_svlan_tag); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_TYPE_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.inner_second_cvlan_tag); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.inner_second_svlan_tag); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_PRIO_O: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_prio); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_PRIO_I: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_prio); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_CFI_O: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_cfi); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_CFI_I: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_cfi); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_ID_O: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.outer_second_vid); -- break; -- case MLX5HWS_DEFINER_FNAME_VLAN_SECOND_ID_I: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.inner_second_vid); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_IHL_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ipv4_ihl); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_IHL_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ipv4_ihl); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_DSCP_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_dscp); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_DSCP_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_dscp); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_ECN_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_ecn); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_ECN_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_ecn); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_TTL_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ttl_hoplimit); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_TTL_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ttl_hoplimit); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_DST_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_SRC_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_DST_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV4_SRC_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_FRAG_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.frag); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_FRAG_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.frag); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_FLOW_LABEL_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.outer_ipv6_flow_label); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_FLOW_LABEL_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.inner_ipv6_flow_label); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_95_64); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_63_32); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O: -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_95_64); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_63_32); -- HWS_CLEAR_MATCH_PARAM(mask, -- outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_95_64); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_63_32); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I: -- case MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I: -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_95_64); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_63_32); -- HWS_CLEAR_MATCH_PARAM(mask, -- inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_PROTOCOL_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.ip_protocol); -- break; -- case MLX5HWS_DEFINER_FNAME_IP_PROTOCOL_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.ip_protocol); -- break; -- case MLX5HWS_DEFINER_FNAME_L4_SPORT_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_sport); -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.udp_sport); -- break; -- case MLX5HWS_DEFINER_FNAME_L4_SPORT_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.tcp_dport); -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.udp_dport); -- break; -- case MLX5HWS_DEFINER_FNAME_L4_DPORT_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_dport); -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.udp_dport); -- break; -- case MLX5HWS_DEFINER_FNAME_L4_DPORT_I: -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.tcp_dport); -- HWS_CLEAR_MATCH_PARAM(mask, inner_headers.udp_dport); -- break; -- case MLX5HWS_DEFINER_FNAME_TCP_FLAGS_O: -- HWS_CLEAR_MATCH_PARAM(mask, outer_headers.tcp_flags); -- break; -- case MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM: -- case MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.outer_tcp_seq_num); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.outer_tcp_ack_num); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.inner_tcp_seq_num); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.inner_tcp_ack_num); -- break; -- case MLX5HWS_DEFINER_FNAME_GTP_TEID: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_teid); -- break; -- case MLX5HWS_DEFINER_FNAME_GTP_MSG_TYPE: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_msg_type); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_msg_flags); -- break; -- case MLX5HWS_DEFINER_FNAME_GTPU_FIRST_EXT_DW0: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.gtpu_first_ext_dw_0); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_dw_0); -- break; -- case MLX5HWS_DEFINER_FNAME_GTPU_DW2: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.gtpu_dw_2); -- break; -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_2.outer_first_mpls_over_gre); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_2.outer_first_mpls_over_udp); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.geneve_tlv_option_0_data); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_id_0); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_value_0); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_value_1); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_id_2); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_value_2); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_id_3); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_4.prog_sample_field_value_3); -- break; -- case MLX5HWS_DEFINER_FNAME_VXLAN_VNI: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.vxlan_vni); -- break; -- case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_FLAGS: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.outer_vxlan_gpe_flags); -- break; -- case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_RSVD0: -- break; -- case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_PROTO: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.outer_vxlan_gpe_next_protocol); -- break; -- case MLX5HWS_DEFINER_FNAME_VXLAN_GPE_VNI: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.outer_vxlan_gpe_vni); -- break; -- case MLX5HWS_DEFINER_FNAME_GENEVE_OPT_LEN: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_opt_len); -- break; -- case MLX5HWS_DEFINER_FNAME_GENEVE_OAM: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_oam); -- break; -- case MLX5HWS_DEFINER_FNAME_GENEVE_PROTO: -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.geneve_protocol_type); -- break; -- case MLX5HWS_DEFINER_FNAME_GENEVE_VNI: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.geneve_vni); -- break; -- case MLX5HWS_DEFINER_FNAME_SOURCE_QP: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.source_sqn); -- break; -- case MLX5HWS_DEFINER_FNAME_SOURCE_GVMI: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.source_port); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.source_eswitch_owner_vhca_id); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_0: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_0); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_1: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_1); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_2: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_2); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_3: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_3); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_4: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_4); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_5: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_5); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_7: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_c_7); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_A: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.metadata_reg_a); -- break; -- case MLX5HWS_DEFINER_FNAME_GRE_C: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_c_present); -- break; -- case MLX5HWS_DEFINER_FNAME_GRE_K: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_k_present); -- break; -- case MLX5HWS_DEFINER_FNAME_GRE_S: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_s_present); -- break; -- case MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_protocol); -- break; -- case MLX5HWS_DEFINER_FNAME_GRE_OPT_KEY: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters.gre_key.key); -- break; -- case MLX5HWS_DEFINER_FNAME_ICMP_DW1: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_header_data); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_type); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmp_code); -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters_3.icmpv6_header_data); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmpv6_type); -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_3.icmpv6_code); -- break; -- case MLX5HWS_DEFINER_FNAME_MPLS0_O: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.outer_first_mpls); -- break; -- case MLX5HWS_DEFINER_FNAME_MPLS0_I: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_2.inner_first_mpls); -- break; -- case MLX5HWS_DEFINER_FNAME_TNL_HDR_0: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_0); -- break; -- case MLX5HWS_DEFINER_FNAME_TNL_HDR_1: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_1); -- break; -- case MLX5HWS_DEFINER_FNAME_TNL_HDR_2: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_2); -- break; -- case MLX5HWS_DEFINER_FNAME_TNL_HDR_3: -- HWS_CLEAR_MATCH_PARAM(mask, misc_parameters_5.tunnel_header_3); -- break; -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER0_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER1_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER2_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER3_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER4_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER5_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER6_OK: -- case MLX5HWS_DEFINER_FNAME_FLEX_PARSER7_OK: -- /* assuming this is flex parser for geneve option */ -- if ((fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER0_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 0) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER1_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 1) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER2_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 2) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER3_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 3) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER4_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 4) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER5_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 5) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER6_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 6) || -- (fname == MLX5HWS_DEFINER_FNAME_FLEX_PARSER7_OK && -- ctx->caps->flex_parser_id_geneve_tlv_option_0 != 7)) { -- mlx5hws_err(ctx, -- "Complex params: unsupported field %s (%d), flex parser ID for geneve is %d\n", -- mlx5hws_definer_fname_to_str(fname), fname, -- caps->flex_parser_id_geneve_tlv_option_0); -- break; -- } -- HWS_CLEAR_MATCH_PARAM(mask, -- misc_parameters.geneve_tlv_option_0_exist); -- break; -- case MLX5HWS_DEFINER_FNAME_REG_6: -- default: -- mlx5hws_err(ctx, "Complex params: unsupported field %s (%d)\n", -- mlx5hws_definer_fname_to_str(fname), fname); -- break; -- } -+ return hws_match_params_exceeds_definer(ctx, match_criteria_enable, -+ mask, true); - } - --static bool --hws_bwc_matcher_complex_params_comb_is_valid(struct mlx5hws_definer_fc *fc, -- int fc_sz, -- u32 combination_num) -+static int -+hws_get_last_set_dword_idx(const struct mlx5hws_match_parameters *mask) - { -- bool m1[MLX5HWS_DEFINER_FNAME_MAX] = {0}; -- bool m2[MLX5HWS_DEFINER_FNAME_MAX] = {0}; -- bool is_first_matcher; - int i; - -- for (i = 0; i < fc_sz; i++) { -- is_first_matcher = !(combination_num & BIT(i)); -- if (is_first_matcher) -- m1[fc[i].fname] = true; -- else -- m2[fc[i].fname] = true; -- } -- -- /* Not all the fields can be split into separate matchers. -- * Some should be together on the same matcher. -- * For example, IPv6 parts - the whole IPv6 address should be on the -- * same matcher in order for us to deduce if it's IPv6 or IPv4 address. -- */ -- if (m1[MLX5HWS_DEFINER_FNAME_IP_FRAG_O] && -- (m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O])) -- return false; -- -- if (m2[MLX5HWS_DEFINER_FNAME_IP_FRAG_O] && -- (m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_O] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_O] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_O] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_O])) -- return false; -+ for (i = mask->match_sz / 4 - 1; i >= 0; i--) -+ if (mask->match_buf[i]) -+ return i; - -- if (m1[MLX5HWS_DEFINER_FNAME_IP_FRAG_I] && -- (m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I] || -- m2[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I])) -- return false; -+ return -1; -+} - -- if (m2[MLX5HWS_DEFINER_FNAME_IP_FRAG_I] && -- (m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_47_16_I] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_SMAC_15_0_I] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_47_16_I] || -- m1[MLX5HWS_DEFINER_FNAME_ETH_DMAC_15_0_I])) -- return false; -+static bool hws_match_mask_is_empty(const struct mlx5hws_match_parameters *mask) -+{ -+ return hws_get_last_set_dword_idx(mask) == -1; -+} - -- /* Don't split outer IPv6 dest address. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O]) && -- (m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_O])) -- return false; -+static bool hws_dword_is_inner_ipaddr_off(int dword_off) -+{ -+ /* IPv4 and IPv6 addresses share the same entry via a union, and the -+ * source and dest addresses are contiguous in the fte_match_param. So -+ * we need to check 8 words. -+ */ -+ static const int inner_ip_dword_off = -+ __mlx5_dw_off(fte_match_param, inner_headers.src_ipv4_src_ipv6); - -- /* Don't split outer IPv6 source address. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O]) && -- (m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_O] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_O])) -- return false; -+ return dword_off >= inner_ip_dword_off && -+ dword_off < inner_ip_dword_off + 8; -+} - -- /* Don't split inner IPv6 dest address. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I]) && -- (m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_127_96_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_95_64_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_63_32_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_DST_31_0_I])) -- return false; -+static bool hws_dword_is_outer_ipaddr_off(int dword_off) -+{ -+ static const int outer_ip_dword_off = -+ __mlx5_dw_off(fte_match_param, outer_headers.src_ipv4_src_ipv6); - -- /* Don't split inner IPv6 source address. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I] || -- m1[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I]) && -- (m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_127_96_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_95_64_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_63_32_I] || -- m2[MLX5HWS_DEFINER_FNAME_IPV6_SRC_31_0_I])) -- return false; -+ return dword_off >= outer_ip_dword_off && -+ dword_off < outer_ip_dword_off + 8; -+} - -- /* Don't split GRE parameters. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_GRE_C] || -- m1[MLX5HWS_DEFINER_FNAME_GRE_K] || -- m1[MLX5HWS_DEFINER_FNAME_GRE_S] || -- m1[MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL]) && -- (m2[MLX5HWS_DEFINER_FNAME_GRE_C] || -- m2[MLX5HWS_DEFINER_FNAME_GRE_K] || -- m2[MLX5HWS_DEFINER_FNAME_GRE_S] || -- m2[MLX5HWS_DEFINER_FNAME_GRE_PROTOCOL])) -- return false; -+static void hws_add_dword_to_mask(struct mlx5hws_match_parameters *mask, -+ const struct mlx5hws_match_parameters *orig, -+ int dword_idx, bool *added_inner_ipv, -+ bool *added_outer_ipv) -+{ -+ mask->match_buf[dword_idx] |= orig->match_buf[dword_idx]; - -- /* Don't split TCP ack/seq numbers. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM] || -- m1[MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM]) && -- (m2[MLX5HWS_DEFINER_FNAME_TCP_ACK_NUM] || -- m2[MLX5HWS_DEFINER_FNAME_TCP_SEQ_NUM])) -- return false; -+ *added_inner_ipv = false; -+ *added_outer_ipv = false; - -- /* Don't split flex parser. */ -- if ((m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6] || -- m1[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7]) && -- (m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_0] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_1] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_2] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_3] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_4] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_5] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_6] || -- m2[MLX5HWS_DEFINER_FNAME_FLEX_PARSER_7])) -- return false; -+ /* Any IP address fragment must be accompanied by a match on IP version. -+ * Use the `added_ipv` variables to keep track if we added IP versions -+ * specifically for this dword, so that we can roll them back if the -+ * match params become too large to fit into a definer. -+ */ -+ if (hws_dword_is_inner_ipaddr_off(dword_idx) && -+ !MLX5_GET(fte_match_param, mask->match_buf, -+ inner_headers.ip_version)) { -+ MLX5_SET(fte_match_param, mask->match_buf, -+ inner_headers.ip_version, 0xf); -+ *added_inner_ipv = true; -+ } -+ if (hws_dword_is_outer_ipaddr_off(dword_idx) && -+ !MLX5_GET(fte_match_param, mask->match_buf, -+ outer_headers.ip_version)) { -+ MLX5_SET(fte_match_param, mask->match_buf, -+ outer_headers.ip_version, 0xf); -+ *added_outer_ipv = true; -+ } -+} - -- return true; -+static void hws_remove_dword_from_mask(struct mlx5hws_match_parameters *mask, -+ int dword_idx, bool added_inner_ipv, -+ bool added_outer_ipv) -+{ -+ mask->match_buf[dword_idx] = 0; -+ if (added_inner_ipv) -+ MLX5_SET(fte_match_param, mask->match_buf, -+ inner_headers.ip_version, 0); -+ if (added_outer_ipv) -+ MLX5_SET(fte_match_param, mask->match_buf, -+ outer_headers.ip_version, 0); - } - --static void --hws_bwc_matcher_complex_params_comb_create(struct mlx5hws_context *ctx, -- struct mlx5hws_match_parameters *m, -- struct mlx5hws_match_parameters *m1, -- struct mlx5hws_match_parameters *m2, -- struct mlx5hws_definer_fc *fc, -- int fc_sz, -- u32 combination_num) -+/* Avoid leaving a single lower dword in `mask` if there are others present in -+ * `orig`. Splitting IPv6 addresses like this causes them to be interpreted as -+ * IPv4. -+ */ -+static void hws_avoid_ipv6_split_of(struct mlx5hws_match_parameters *orig, -+ struct mlx5hws_match_parameters *mask, -+ int off) - { -- bool is_first_matcher; -- int i; -+ /* Masks are allocated to a full fte_match_param, but it can't hurt to -+ * double check. -+ */ -+ if (orig->match_sz <= off + 3 || mask->match_sz <= off + 3) -+ return; - -- memcpy(m1->match_buf, m->match_buf, m->match_sz); -- memcpy(m2->match_buf, m->match_buf, m->match_sz); -+ /* Lower dword is not set, nothing to do. */ -+ if (!mask->match_buf[off + 3]) -+ return; - -- for (i = 0; i < fc_sz; i++) { -- is_first_matcher = !(combination_num & BIT(i)); -- hws_bwc_matcher_complex_params_clear_fld(ctx, -- fc[i].fname, -- is_first_matcher ? -- m2 : m1); -- } -+ /* Higher dwords also present in `mask`, no ambiguity. */ -+ if (mask->match_buf[off] || mask->match_buf[off + 1] || -+ mask->match_buf[off + 2]) -+ return; -+ -+ /* There are no higher dwords in `orig`, i.e. we match on IPv4. */ -+ if (!orig->match_buf[off] && !orig->match_buf[off + 1] && -+ !orig->match_buf[off + 2]) -+ return; - -- MLX5_SET(fte_match_param, m2->match_buf, -- misc_parameters_2.metadata_reg_c_6, -1); -+ /* Put the lower dword back in `orig`. It is always safe to do this, the -+ * dword will just be picked up in the next submask. -+ */ -+ orig->match_buf[off + 3] = mask->match_buf[off + 3]; -+ mask->match_buf[off + 3] = 0; - } - --static void --hws_bwc_matcher_complex_params_destroy(struct mlx5hws_match_parameters *mask_1, -- struct mlx5hws_match_parameters *mask_2) -+static void hws_avoid_ipv6_split(struct mlx5hws_match_parameters *orig, -+ struct mlx5hws_match_parameters *mask) - { -- kfree(mask_1->match_buf); -- kfree(mask_2->match_buf); -+ hws_avoid_ipv6_split_of(orig, mask, -+ __mlx5_dw_off(fte_match_param, -+ outer_headers.src_ipv4_src_ipv6)); -+ hws_avoid_ipv6_split_of(orig, mask, -+ __mlx5_dw_off(fte_match_param, -+ outer_headers.dst_ipv4_dst_ipv6)); -+ hws_avoid_ipv6_split_of(orig, mask, -+ __mlx5_dw_off(fte_match_param, -+ inner_headers.src_ipv4_src_ipv6)); -+ hws_avoid_ipv6_split_of(orig, mask, -+ __mlx5_dw_off(fte_match_param, -+ inner_headers.dst_ipv4_dst_ipv6)); - } - --static int --hws_bwc_matcher_complex_params_create(struct mlx5hws_context *ctx, -- u8 match_criteria, -- struct mlx5hws_match_parameters *mask, -- struct mlx5hws_match_parameters *mask_1, -- struct mlx5hws_match_parameters *mask_2) -+/* Build a subset of the `orig` match parameters into `mask`. This subset is -+ * guaranteed to fit in a single definer an as such is a candidate for being a -+ * part of a complex matcher. Upon successful execution, the match params that -+ * go into `mask` are cleared from `orig`. -+ */ -+static int hws_get_simple_params(struct mlx5hws_context *ctx, u8 match_criteria, -+ struct mlx5hws_match_parameters *orig, -+ struct mlx5hws_match_parameters *mask) - { -- struct mlx5hws_definer_fc *fc; -- u32 num_of_combinations; -- int fc_sz = 0; -- int res = 0; -- u32 i; -- -- if (MLX5_GET(fte_match_param, mask->match_buf, -- misc_parameters_2.metadata_reg_c_6)) { -- mlx5hws_err(ctx, "Complex matcher: REG_C_6 matching is reserved\n"); -- res = -EINVAL; -- goto out; -- } -+ bool added_inner_ipv, added_outer_ipv; -+ int dword_idx; -+ u32 *backup; -+ int ret; - -- mask_1->match_buf = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), -- GFP_KERNEL); -- mask_2->match_buf = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), -- GFP_KERNEL); -- if (!mask_1->match_buf || !mask_2->match_buf) { -- mlx5hws_err(ctx, "Complex matcher: failed to allocate match_param\n"); -- res = -ENOMEM; -- goto free_params; -- } -+ dword_idx = hws_get_last_set_dword_idx(orig); -+ /* Nothing to do, we consumed all of the match params before. */ -+ if (dword_idx == -1) -+ return 0; - -- mask_1->match_sz = mask->match_sz; -- mask_2->match_sz = mask->match_sz; -+ backup = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), GFP_KERNEL); -+ if (!backup) -+ return -ENOMEM; - -- fc = mlx5hws_definer_conv_match_params_to_compressed_fc(ctx, -- match_criteria, -- mask->match_buf, -- &fc_sz); -- if (!fc) { -- res = -ENOMEM; -- goto free_params; -- } -+ while (1) { -+ dword_idx = hws_get_last_set_dword_idx(orig); -+ /* Nothing to do, we consumed all of the original match params -+ * into this subset, which still fits into a single matcher. -+ */ -+ if (dword_idx == -1) { -+ ret = 0; -+ goto free_backup; -+ } - -- if (fc_sz >= sizeof(num_of_combinations) * BITS_PER_BYTE) { -- mlx5hws_err(ctx, -- "Complex matcher: too many match parameters (%d)\n", -- fc_sz); -- res = -EINVAL; -- goto free_fc; -+ memcpy(backup, mask->match_buf, mask->match_sz); -+ -+ /* Try to add this dword to the current subset. */ -+ hws_add_dword_to_mask(mask, orig, dword_idx, &added_inner_ipv, -+ &added_outer_ipv); -+ -+ if (hws_match_params_exceeds_definer(ctx, match_criteria, mask, -+ false)) { -+ /* We just added a match param that makes the definer -+ * too large. Revert and return what we had before. -+ * Note that we can't just zero out the affected fields, -+ * because it's possible that the dword we're looking at -+ * wasn't zero before (e.g. it included auto-added -+ * matches in IP version. This is why we employ the -+ * rather cumbersome memcpy for backing up. -+ */ -+ memcpy(mask->match_buf, backup, mask->match_sz); -+ /* Possible future improvement: We can't add any more -+ * dwords, but it may be possible to squeeze in -+ * individual bytes, as definers have special slots for -+ * those. -+ * -+ * For now, keep the code simple. This results in an -+ * extra submatcher in some cases, but it's good enough. -+ */ -+ ret = 0; -+ break; -+ } -+ -+ /* The current subset of match params still fits in a single -+ * definer. Remove the dword from the original mask. -+ * -+ * Also remove any explicit match on IP version if we just -+ * included one here. We will still automatically add it to -+ * accompany any IP address fragment, but do not need to -+ * consider it by itself. -+ */ -+ hws_remove_dword_from_mask(orig, dword_idx, added_inner_ipv, -+ added_outer_ipv); - } - -- /* We have list of all the match fields from the match parameter. -- * Now try all the possibilities of splitting them into two match -- * buffers and look for the supported combination. -+ /* Make sure we have not picked up a single lower dword of an IPv6 -+ * address, as the firmware will erroneously treat it as an IPv4 -+ * address. - */ -- num_of_combinations = 1 << fc_sz; -+ hws_avoid_ipv6_split(orig, mask); - -- /* Start from combination at index 1 - we know that 0 is unsupported */ -- for (i = 1; i < num_of_combinations; i++) { -- if (!hws_bwc_matcher_complex_params_comb_is_valid(fc, fc_sz, i)) -- continue; -+free_backup: -+ kfree(backup); - -- hws_bwc_matcher_complex_params_comb_create(ctx, -- mask, mask_1, mask_2, -- fc, fc_sz, i); -- /* We now have two separate sets of match params. -- * Check if each of them can be used in its own matcher. -+ return ret; -+} -+ -+static int -+hws_bwc_matcher_split_mask(struct mlx5hws_context *ctx, u8 match_criteria, -+ const struct mlx5hws_match_parameters *mask, -+ struct mlx5hws_match_parameters *submasks, -+ int *num_submasks) -+{ -+ struct mlx5hws_match_parameters mask_copy; -+ int ret, i = 0; -+ -+ mask_copy.match_sz = MLX5_ST_SZ_BYTES(fte_match_param); -+ mask_copy.match_buf = kzalloc(mask_copy.match_sz, GFP_KERNEL); -+ if (!mask_copy.match_buf) -+ return -ENOMEM; -+ -+ memcpy(mask_copy.match_buf, mask->match_buf, mask->match_sz); -+ -+ while (!hws_match_mask_is_empty(&mask_copy)) { -+ if (i >= MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS) { -+ mlx5hws_err(ctx, -+ "Complex matcher: mask too large for %d matchers\n", -+ MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS); -+ ret = -E2BIG; -+ goto free_copy; -+ } -+ /* All but the first matcher need to match on register C6 to -+ * connect pieces of the complex rule together. - */ -- if (!mlx5hws_bwc_match_params_is_complex(ctx, -- match_criteria, -- mask_1) && -- !mlx5hws_bwc_match_params_is_complex(ctx, -- match_criteria, -- mask_2)) -- break; -+ if (i > 0) { -+ MLX5_SET(fte_match_param, submasks[i].match_buf, -+ misc_parameters_2.metadata_reg_c_6, -1); -+ match_criteria |= MLX5HWS_DEFINER_MATCH_CRITERIA_MISC2; -+ } -+ ret = hws_get_simple_params(ctx, match_criteria, &mask_copy, -+ &submasks[i]); -+ if (ret < 0) -+ goto free_copy; -+ i++; - } - -- if (i == num_of_combinations) { -- /* We've scanned all the combinations, but to no avail */ -- mlx5hws_err(ctx, "Complex matcher: couldn't find match params combination\n"); -- res = -EINVAL; -- goto free_fc; -- } -+ *num_submasks = i; -+ ret = 0; - -- kfree(fc); -- return 0; -+free_copy: -+ kfree(mask_copy.match_buf); - --free_fc: -- kfree(fc); --free_params: -- hws_bwc_matcher_complex_params_destroy(mask_1, mask_2); --out: -- return res; -+ return ret; - } - --static int --hws_bwc_isolated_table_create(struct mlx5hws_bwc_matcher *bwc_matcher, -- struct mlx5hws_table *table) -+static struct mlx5hws_table * -+hws_isolated_table_create(const struct mlx5hws_bwc_matcher *cmatcher) - { -+ struct mlx5hws_bwc_complex_submatcher *first_subm; - struct mlx5hws_cmd_ft_modify_attr ft_attr = {0}; -- struct mlx5hws_context *ctx = table->ctx; - struct mlx5hws_table_attr tbl_attr = {0}; -- struct mlx5hws_table *isolated_tbl; -- int ret = 0; -+ struct mlx5hws_table *orig_tbl; -+ struct mlx5hws_context *ctx; -+ struct mlx5hws_table *tbl; -+ int ret; - -- tbl_attr.type = table->type; -- tbl_attr.level = table->level; -+ first_subm = &cmatcher->complex->submatchers[0]; -+ orig_tbl = first_subm->tbl; -+ ctx = orig_tbl->ctx; - -- bwc_matcher->complex->isolated_tbl = -- mlx5hws_table_create(ctx, &tbl_attr); -- isolated_tbl = bwc_matcher->complex->isolated_tbl; -- if (!isolated_tbl) -- return -EINVAL; -+ tbl_attr.type = orig_tbl->type; -+ tbl_attr.level = orig_tbl->level; -+ tbl = mlx5hws_table_create(ctx, &tbl_attr); -+ if (!tbl) -+ return ERR_PTR(-EINVAL); - -- /* Set the default miss of the isolated table to -- * point to the end anchor of the original matcher. -+ /* Set the default miss of the isolated table to point -+ * to the end anchor of the original matcher. - */ -- mlx5hws_cmd_set_attr_connect_miss_tbl(ctx, -- isolated_tbl->fw_ft_type, -- isolated_tbl->type, -- &ft_attr); -- ft_attr.table_miss_id = bwc_matcher->matcher->end_ft_id; -- -- ret = mlx5hws_cmd_flow_table_modify(ctx->mdev, -- &ft_attr, -- isolated_tbl->ft_id); -+ mlx5hws_cmd_set_attr_connect_miss_tbl(ctx, tbl->fw_ft_type, -+ tbl->type, &ft_attr); -+ ft_attr.table_miss_id = first_subm->bwc_matcher->matcher->end_ft_id; -+ -+ ret = mlx5hws_cmd_flow_table_modify(ctx->mdev, &ft_attr, tbl->ft_id); - if (ret) { -- mlx5hws_err(ctx, "Failed setting isolated tbl default miss\n"); -+ mlx5hws_err(ctx, "Complex matcher: failed to set isolated tbl default miss\n"); - goto destroy_tbl; - } - -- return 0; -+ return tbl; - - destroy_tbl: -- mlx5hws_table_destroy(isolated_tbl); -- return ret; -+ mlx5hws_table_destroy(tbl); -+ -+ return ERR_PTR(ret); - } - --static void hws_bwc_isolated_table_destroy(struct mlx5hws_table *isolated_tbl) -+static int hws_submatcher_init_first(struct mlx5hws_bwc_matcher *cmatcher, -+ struct mlx5hws_table *table, u32 priority, -+ u8 match_criteria, -+ struct mlx5hws_match_parameters *mask) - { -- /* This table is isolated - no table is pointing to it, no need to -- * disconnect it from anywhere, it won't affect any other table's miss. -+ enum mlx5hws_action_type action_types[HWS_NUM_CHAIN_ACTIONS]; -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ int ret; -+ -+ subm = &cmatcher->complex->submatchers[0]; -+ -+ /* The first submatcher lives in the original table and does not have an -+ * associated jump to table action. It also points to the outer complex -+ * matcher. - */ -- mlx5hws_table_destroy(isolated_tbl); -+ subm->tbl = table; -+ subm->action_tbl = NULL; -+ subm->bwc_matcher = cmatcher; -+ -+ action_types[0] = MLX5HWS_ACTION_TYP_MODIFY_HDR; -+ action_types[1] = MLX5HWS_ACTION_TYP_TBL; -+ action_types[2] = MLX5HWS_ACTION_TYP_LAST; -+ -+ ret = mlx5hws_bwc_matcher_create_simple(subm->bwc_matcher, subm->tbl, -+ priority, match_criteria, mask, -+ action_types); -+ if (ret) -+ return ret; -+ -+ subm->bwc_matcher->matcher_type = MLX5HWS_BWC_MATCHER_COMPLEX_FIRST; -+ -+ ret = rhashtable_init(&subm->rules_hash, &hws_rules_hash_params); -+ if (ret) -+ goto destroy_matcher; -+ mutex_init(&subm->hash_lock); -+ ida_init(&subm->chain_ida); -+ -+ return 0; -+ -+destroy_matcher: -+ mlx5hws_bwc_matcher_destroy_simple(subm->bwc_matcher); -+ -+ return ret; - } - --static int --hws_bwc_isolated_matcher_create(struct mlx5hws_bwc_matcher *bwc_matcher, -- struct mlx5hws_table *table, -- u8 match_criteria_enable, -- struct mlx5hws_match_parameters *mask) -+static int hws_submatcher_init(struct mlx5hws_bwc_matcher *cmatcher, int idx, -+ struct mlx5hws_table *table, u32 priority, -+ u8 match_criteria, -+ struct mlx5hws_match_parameters *mask) - { -- struct mlx5hws_table *isolated_tbl = bwc_matcher->complex->isolated_tbl; -- struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -- struct mlx5hws_context *ctx = table->ctx; -+ enum mlx5hws_action_type action_types[HWS_NUM_CHAIN_ACTIONS]; -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ bool is_last; - int ret; - -- isolated_bwc_matcher = kzalloc(sizeof(*bwc_matcher), GFP_KERNEL); -- if (!isolated_bwc_matcher) -- return -ENOMEM; -+ if (!idx) -+ return hws_submatcher_init_first(cmatcher, table, priority, -+ match_criteria, mask); -+ -+ subm = &cmatcher->complex->submatchers[idx]; -+ is_last = idx == cmatcher->complex->num_submatchers - 1; -+ -+ subm->tbl = hws_isolated_table_create(cmatcher); -+ if (IS_ERR(subm->tbl)) -+ return PTR_ERR(subm->tbl); -+ -+ subm->action_tbl = -+ mlx5hws_action_create_dest_table(subm->tbl->ctx, subm->tbl, -+ MLX5HWS_ACTION_FLAG_HWS_FDB); -+ if (!subm->action_tbl) { -+ ret = -EINVAL; -+ goto destroy_tbl; -+ } -+ -+ subm->bwc_matcher = kzalloc(sizeof(*subm->bwc_matcher), GFP_KERNEL); -+ if (!subm->bwc_matcher) { -+ ret = -ENOMEM; -+ goto destroy_action; -+ } - -- bwc_matcher->complex->isolated_bwc_matcher = isolated_bwc_matcher; -+ /* Every matcher other than the first also matches of register C6 to -+ * bind subrules together in the complex rule using the chain ids. -+ */ -+ match_criteria |= MLX5HWS_DEFINER_MATCH_CRITERIA_MISC2; - -- /* Isolated BWC matcher needs access to the first BWC matcher */ -- isolated_bwc_matcher->complex_first_bwc_matcher = bwc_matcher; -+ action_types[0] = MLX5HWS_ACTION_TYP_MODIFY_HDR; -+ action_types[1] = MLX5HWS_ACTION_TYP_TBL; -+ action_types[2] = MLX5HWS_ACTION_TYP_LAST; - -- /* Isolated matcher needs to match on REG_C_6, -- * so make sure its criteria bit is on. -+ /* Every matcher other than the last sets register C6 and jumps to the -+ * next submatcher's table. The final submatcher will use the -+ * user-supplied actions and will attach an action template at rule -+ * insertion time. - */ -- match_criteria_enable |= MLX5HWS_DEFINER_MATCH_CRITERIA_MISC2; -- -- ret = mlx5hws_bwc_matcher_create_simple(isolated_bwc_matcher, -- isolated_tbl, -- 0, -- match_criteria_enable, -- mask, -- NULL); -- if (ret) { -- mlx5hws_err(ctx, "Complex matcher: failed creating isolated BWC matcher\n"); -+ ret = mlx5hws_bwc_matcher_create_simple(subm->bwc_matcher, subm->tbl, -+ priority, match_criteria, mask, -+ is_last ? NULL : action_types); -+ if (ret) - goto free_matcher; -- } -+ -+ subm->bwc_matcher->matcher_type = -+ MLX5HWS_BWC_MATCHER_COMPLEX_SUBMATCHER; -+ -+ ret = rhashtable_init(&subm->rules_hash, &hws_rules_hash_params); -+ if (ret) -+ goto destroy_matcher; -+ mutex_init(&subm->hash_lock); -+ ida_init(&subm->chain_ida); - - return 0; - -+destroy_matcher: -+ mlx5hws_bwc_matcher_destroy_simple(subm->bwc_matcher); - free_matcher: -- kfree(bwc_matcher->complex->isolated_bwc_matcher); -+ kfree(subm->bwc_matcher); -+destroy_action: -+ mlx5hws_action_destroy(subm->action_tbl); -+destroy_tbl: -+ mlx5hws_table_destroy(subm->tbl); -+ - return ret; - } - --static void --hws_bwc_isolated_matcher_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) -+static void hws_submatcher_destroy(struct mlx5hws_bwc_matcher *cmatcher, -+ int idx) - { -- mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -- kfree(bwc_matcher); -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ -+ subm = &cmatcher->complex->submatchers[idx]; -+ -+ ida_destroy(&subm->chain_ida); -+ mutex_destroy(&subm->hash_lock); -+ rhashtable_destroy(&subm->rules_hash); -+ -+ if (subm->bwc_matcher) { -+ mlx5hws_bwc_matcher_destroy_simple(subm->bwc_matcher); -+ if (idx) -+ kfree(subm->bwc_matcher); -+ } -+ -+ /* We own all of the isolated tables, but not the original one. */ -+ if (idx) { -+ mlx5hws_action_destroy(subm->action_tbl); -+ mlx5hws_table_destroy(subm->tbl); -+ } - } - - static int --hws_bwc_isolated_actions_create(struct mlx5hws_bwc_matcher *bwc_matcher, -- struct mlx5hws_table *table) -+hws_complex_data_actions_init(struct mlx5hws_bwc_matcher_complex_data *cdata) - { -- struct mlx5hws_table *isolated_tbl = bwc_matcher->complex->isolated_tbl; -+ struct mlx5hws_context *ctx = cdata->submatchers[0].tbl->ctx; - u8 modify_hdr_action[MLX5_ST_SZ_BYTES(set_action_in)] = {0}; -- struct mlx5hws_context *ctx = table->ctx; - struct mlx5hws_action_mh_pattern ptrn; - int ret = 0; - -- /* Create action to jump to isolated table */ -- -- bwc_matcher->complex->action_go_to_tbl = -- mlx5hws_action_create_dest_table(ctx, -- isolated_tbl, -- MLX5HWS_ACTION_FLAG_HWS_FDB); -- if (!bwc_matcher->complex->action_go_to_tbl) { -- mlx5hws_err(ctx, "Complex matcher: failed to create go-to-tbl action\n"); -- return -EINVAL; -- } -- - /* Create modify header action to set REG_C_6 */ -- - MLX5_SET(set_action_in, modify_hdr_action, - action_type, MLX5_MODIFICATION_TYPE_SET); - MLX5_SET(set_action_in, modify_hdr_action, -@@ -895,19 +553,18 @@ hws_bwc_isolated_actions_create(struct mlx5hws_bwc_matcher *bwc_matcher, - ptrn.data = (void *)modify_hdr_action; - ptrn.sz = MLX5HWS_ACTION_DOUBLE_SIZE; - -- bwc_matcher->complex->action_metadata = -+ cdata->action_metadata = - mlx5hws_action_create_modify_header(ctx, 1, &ptrn, 0, - MLX5HWS_ACTION_FLAG_HWS_FDB); -- if (!bwc_matcher->complex->action_metadata) { -- ret = -EINVAL; -- goto destroy_action_go_to_tbl; -+ if (!cdata->action_metadata) { -+ mlx5hws_err(ctx, "Complex matcher: failed to create set reg C6 action\n"); -+ return -EINVAL; - } - - /* Create last action */ -- -- bwc_matcher->complex->action_last = -+ cdata->action_last = - mlx5hws_action_create_last(ctx, MLX5HWS_ACTION_FLAG_HWS_FDB); -- if (!bwc_matcher->complex->action_last) { -+ if (!cdata->action_last) { - mlx5hws_err(ctx, "Complex matcher: failed to create last action\n"); - ret = -EINVAL; - goto destroy_action_metadata; -@@ -916,196 +573,130 @@ hws_bwc_isolated_actions_create(struct mlx5hws_bwc_matcher *bwc_matcher, - return 0; - - destroy_action_metadata: -- mlx5hws_action_destroy(bwc_matcher->complex->action_metadata); --destroy_action_go_to_tbl: -- mlx5hws_action_destroy(bwc_matcher->complex->action_go_to_tbl); -+ mlx5hws_action_destroy(cdata->action_metadata); -+ - return ret; - } - - static void --hws_bwc_isolated_actions_destroy(struct mlx5hws_bwc_matcher *bwc_matcher) -+hws_complex_data_actions_destroy(struct mlx5hws_bwc_matcher_complex_data *cdata) - { -- mlx5hws_action_destroy(bwc_matcher->complex->action_last); -- mlx5hws_action_destroy(bwc_matcher->complex->action_metadata); -- mlx5hws_action_destroy(bwc_matcher->complex->action_go_to_tbl); -+ mlx5hws_action_destroy(cdata->action_last); -+ mlx5hws_action_destroy(cdata->action_metadata); - } - - int mlx5hws_bwc_matcher_create_complex(struct mlx5hws_bwc_matcher *bwc_matcher, - struct mlx5hws_table *table, -- u32 priority, -- u8 match_criteria_enable, -+ u32 priority, u8 match_criteria_enable, - struct mlx5hws_match_parameters *mask) - { -- enum mlx5hws_action_type complex_init_action_types[3]; -- struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -- struct mlx5hws_match_parameters mask_1 = {0}; -- struct mlx5hws_match_parameters mask_2 = {0}; -+ struct mlx5hws_match_parameters -+ submasks[MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS] = {0}; -+ struct mlx5hws_bwc_matcher_complex_data *cdata; - struct mlx5hws_context *ctx = table->ctx; -- int ret; -- -- ret = hws_bwc_matcher_complex_params_create(table->ctx, -- match_criteria_enable, -- mask, &mask_1, &mask_2); -- if (ret) -- goto err; -- -- bwc_matcher->complex = -- kzalloc(sizeof(*bwc_matcher->complex), GFP_KERNEL); -- if (!bwc_matcher->complex) { -- ret = -ENOMEM; -- goto free_masks; -- } -+ int num_submatchers; -+ int i, ret; - -- ret = rhashtable_init(&bwc_matcher->complex->refcount_hash, -- &hws_refcount_hash); -- if (ret) { -- mlx5hws_err(ctx, "Complex matcher: failed to initialize rhashtable\n"); -- goto free_complex; -+ for (i = 0; i < ARRAY_SIZE(submasks); i++) { -+ submasks[i].match_sz = MLX5_ST_SZ_BYTES(fte_match_param); -+ submasks[i].match_buf = kzalloc(submasks[i].match_sz, -+ GFP_KERNEL); -+ if (!submasks[i].match_buf) { -+ ret = -ENOMEM; -+ goto free_submasks; -+ } - } - -- mutex_init(&bwc_matcher->complex->hash_lock); -- ida_init(&bwc_matcher->complex->metadata_ida); -- -- /* Create initial action template for the first matcher. -- * Usually the initial AT is just dummy, but in case of complex -- * matcher we know exactly which actions should it have. -- */ -- -- complex_init_action_types[0] = MLX5HWS_ACTION_TYP_MODIFY_HDR; -- complex_init_action_types[1] = MLX5HWS_ACTION_TYP_TBL; -- complex_init_action_types[2] = MLX5HWS_ACTION_TYP_LAST; -- -- /* Create the first matcher */ -- -- ret = mlx5hws_bwc_matcher_create_simple(bwc_matcher, -- table, -- priority, -- match_criteria_enable, -- &mask_1, -- complex_init_action_types); -+ ret = hws_bwc_matcher_split_mask(ctx, match_criteria_enable, mask, -+ submasks, &num_submatchers); - if (ret) -- goto destroy_ida; -- -- /* Create isolated table to hold the second isolated matcher */ -+ goto free_submasks; - -- ret = hws_bwc_isolated_table_create(bwc_matcher, table); -- if (ret) { -- mlx5hws_err(ctx, "Complex matcher: failed creating isolated table\n"); -- goto destroy_first_matcher; -+ cdata = kzalloc(sizeof(*cdata), GFP_KERNEL); -+ if (!cdata) { -+ ret = -ENOMEM; -+ goto free_submasks; - } - -- /* Now create the second BWC matcher - the isolated one */ -+ bwc_matcher->complex = cdata; -+ cdata->num_submatchers = num_submatchers; - -- ret = hws_bwc_isolated_matcher_create(bwc_matcher, table, -- match_criteria_enable, &mask_2); -- if (ret) { -- mlx5hws_err(ctx, "Complex matcher: failed creating isolated matcher\n"); -- goto destroy_isolated_tbl; -+ for (i = 0; i < num_submatchers; i++) { -+ ret = hws_submatcher_init(bwc_matcher, i, table, priority, -+ match_criteria_enable, &submasks[i]); -+ if (ret) -+ goto destroy_submatchers; - } - -- /* Create action for isolated matcher's rules */ -- -- ret = hws_bwc_isolated_actions_create(bwc_matcher, table); -- if (ret) { -- mlx5hws_err(ctx, "Complex matcher: failed creating isolated actions\n"); -- goto destroy_isolated_matcher; -- } -+ ret = hws_complex_data_actions_init(cdata); -+ if (ret) -+ goto destroy_submatchers; - -- hws_bwc_matcher_complex_params_destroy(&mask_1, &mask_2); -- return 0; -+ ret = 0; -+ goto free_submasks; - --destroy_isolated_matcher: -- isolated_bwc_matcher = bwc_matcher->complex->isolated_bwc_matcher; -- hws_bwc_isolated_matcher_destroy(isolated_bwc_matcher); --destroy_isolated_tbl: -- hws_bwc_isolated_table_destroy(bwc_matcher->complex->isolated_tbl); --destroy_first_matcher: -- mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); --destroy_ida: -- ida_destroy(&bwc_matcher->complex->metadata_ida); -- mutex_destroy(&bwc_matcher->complex->hash_lock); -- rhashtable_destroy(&bwc_matcher->complex->refcount_hash); --free_complex: -- kfree(bwc_matcher->complex); -+destroy_submatchers: -+ while (i--) -+ hws_submatcher_destroy(bwc_matcher, i); -+ kfree(cdata); - bwc_matcher->complex = NULL; --free_masks: -- hws_bwc_matcher_complex_params_destroy(&mask_1, &mask_2); --err: -+ -+free_submasks: -+ for (i = 0; i < ARRAY_SIZE(submasks); i++) -+ kfree(submasks[i].match_buf); -+ - return ret; - } - - void - mlx5hws_bwc_matcher_destroy_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - { -- struct mlx5hws_bwc_matcher *isolated_bwc_matcher = -- bwc_matcher->complex->isolated_bwc_matcher; -- -- hws_bwc_isolated_actions_destroy(bwc_matcher); -- hws_bwc_isolated_matcher_destroy(isolated_bwc_matcher); -- hws_bwc_isolated_table_destroy(bwc_matcher->complex->isolated_tbl); -- mlx5hws_bwc_matcher_destroy_simple(bwc_matcher); -- ida_destroy(&bwc_matcher->complex->metadata_ida); -- mutex_destroy(&bwc_matcher->complex->hash_lock); -- rhashtable_destroy(&bwc_matcher->complex->refcount_hash); -+ int i; -+ -+ hws_complex_data_actions_destroy(bwc_matcher->complex); -+ for (i = 0; i < bwc_matcher->complex->num_submatchers; i++) -+ hws_submatcher_destroy(bwc_matcher, i); - kfree(bwc_matcher->complex); - bwc_matcher->complex = NULL; - } - --static void --hws_bwc_matcher_complex_hash_lock(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- mutex_lock(&bwc_matcher->complex->hash_lock); --} -- --static void --hws_bwc_matcher_complex_hash_unlock(struct mlx5hws_bwc_matcher *bwc_matcher) --{ -- mutex_unlock(&bwc_matcher->complex->hash_lock); --} -- - static int --hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, -- struct mlx5hws_match_parameters *params) -+hws_complex_get_subrule_data(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_bwc_complex_submatcher *subm, -+ u32 *match_params) -+__must_hold(&subm->hash_lock) - { -- struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -- struct mlx5hws_bwc_complex_rule_hash_node *node, *old_node; -- struct rhashtable *refcount_hash; -- int ret, i; -- -- bwc_rule->complex_hash_node = NULL; -+ struct mlx5hws_bwc_matcher *bwc_matcher = subm->bwc_matcher; -+ struct mlx5hws_bwc_complex_subrule_data *sr_data, *old_data; -+ struct mlx5hws_match_template *mt; -+ int ret; - -- node = kzalloc(sizeof(*node), GFP_KERNEL); -- if (unlikely(!node)) -+ sr_data = kzalloc(sizeof(*sr_data), GFP_KERNEL); -+ if (!sr_data) - return -ENOMEM; - -- ret = ida_alloc(&bwc_matcher->complex->metadata_ida, GFP_KERNEL); -+ ret = ida_alloc(&subm->chain_ida, GFP_KERNEL); - if (ret < 0) -- goto err_free_node; -- node->tag = ret; -+ goto free_sr_data; -+ sr_data->chain_id = ret; - -- refcount_set(&node->refcount, 1); -+ refcount_set(&sr_data->refcount, 1); - -- /* Clear match buffer - turn off all the unrelated fields -- * in accordance with the match params mask for the first -- * matcher out of the two parts of the complex matcher. -- * The resulting mask is the key for the hash. -- */ -- for (i = 0; i < MLX5_ST_SZ_DW_MATCH_PARAM; i++) -- node->match_buf[i] = params->match_buf[i] & -- bwc_matcher->mt->match_param[i]; -- -- refcount_hash = &bwc_matcher->complex->refcount_hash; -- old_node = rhashtable_lookup_get_insert_fast(refcount_hash, -- &node->hash_node, -- hws_refcount_hash); -- if (IS_ERR(old_node)) { -- ret = PTR_ERR(old_node); -- goto err_free_ida; -+ mt = bwc_matcher->matcher->mt; -+ mlx5hws_definer_create_tag(match_params, mt->fc, mt->fc_sz, -+ (u8 *)&sr_data->match_tag); -+ -+ old_data = rhashtable_lookup_get_insert_fast(&subm->rules_hash, -+ &sr_data->hash_node, -+ hws_rules_hash_params); -+ if (IS_ERR(old_data)) { -+ ret = PTR_ERR(old_data); -+ goto free_ida; - } - -- if (old_node) { -+ if (old_data) { - /* Rule with the same tag already exists - update refcount */ -- refcount_inc(&old_node->refcount); -+ refcount_inc(&old_data->refcount); - /* Let the new rule use the same tag as the existing rule. - * Note that we don't have any indication for the rule creation - * process that a rule with similar matching params already -@@ -1114,247 +705,281 @@ hws_bwc_rule_complex_hash_node_get(struct mlx5hws_bwc_rule *bwc_rule, - * There's some performance advantage in skipping such cases, - * so this is left for future optimizations. - */ -- ida_free(&bwc_matcher->complex->metadata_ida, node->tag); -- kfree(node); -- node = old_node; -+ bwc_rule->subrule_data = old_data; -+ ret = 0; -+ goto free_ida; - } - -- bwc_rule->complex_hash_node = node; -+ bwc_rule->subrule_data = sr_data; - return 0; - --err_free_ida: -- ida_free(&bwc_matcher->complex->metadata_ida, node->tag); --err_free_node: -- kfree(node); -+free_ida: -+ ida_free(&subm->chain_ida, sr_data->chain_id); -+free_sr_data: -+ kfree(sr_data); -+ - return ret; - } - - static void --hws_bwc_rule_complex_hash_node_put(struct mlx5hws_bwc_rule *bwc_rule, -- bool *is_last_rule) -+hws_complex_put_subrule_data(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_bwc_complex_submatcher *subm, -+ bool *is_last_rule) -+__must_hold(&subm->hash_lock) - { -- struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -- struct mlx5hws_bwc_complex_rule_hash_node *node; -+ struct mlx5hws_bwc_complex_subrule_data *sr_data; - - if (is_last_rule) - *is_last_rule = false; - -- node = bwc_rule->complex_hash_node; -- if (refcount_dec_and_test(&node->refcount)) { -- rhashtable_remove_fast(&bwc_matcher->complex->refcount_hash, -- &node->hash_node, -- hws_refcount_hash); -- ida_free(&bwc_matcher->complex->metadata_ida, node->tag); -- kfree(node); -+ sr_data = bwc_rule->subrule_data; -+ if (refcount_dec_and_test(&sr_data->refcount)) { -+ rhashtable_remove_fast(&subm->rules_hash, -+ &sr_data->hash_node, -+ hws_rules_hash_params); -+ ida_free(&subm->chain_ida, sr_data->chain_id); -+ kfree(sr_data); - if (is_last_rule) - *is_last_rule = true; - } - -- bwc_rule->complex_hash_node = NULL; -+ bwc_rule->subrule_data = NULL; - } - --int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, -- struct mlx5hws_match_parameters *params, -- u32 flow_source, -- struct mlx5hws_rule_action rule_actions[], -- u16 bwc_queue_idx) -+static int hws_complex_subrule_create(struct mlx5hws_bwc_matcher *cmatcher, -+ struct mlx5hws_bwc_rule *subrule, -+ u32 *match_params, u32 flow_source, -+ int bwc_queue_idx, int subm_idx, -+ struct mlx5hws_rule_action *actions, -+ u32 *chain_id) - { -- struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -- struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_rule_action chain_actions[HWS_NUM_CHAIN_ACTIONS] = {0}; - u8 modify_hdr_action[MLX5_ST_SZ_BYTES(set_action_in)] = {0}; -- struct mlx5hws_rule_action rule_actions_1[3] = {0}; -- struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -- u32 *match_buf_2; -- u32 metadata_val; -- int ret = 0; -+ struct mlx5hws_bwc_matcher_complex_data *cdata; -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ int ret; - -- isolated_bwc_matcher = bwc_matcher->complex->isolated_bwc_matcher; -- bwc_rule->isolated_bwc_rule = -- mlx5hws_bwc_rule_alloc(isolated_bwc_matcher); -- if (unlikely(!bwc_rule->isolated_bwc_rule)) -- return -ENOMEM; -+ cdata = cmatcher->complex; -+ subm = &cdata->submatchers[subm_idx]; - -- hws_bwc_matcher_complex_hash_lock(bwc_matcher); -+ mutex_lock(&subm->hash_lock); - -- /* Get a new hash node for this complex rule. -- * If this is a unique set of match params for the first matcher, -- * we will get a new hash node with newly allocated IDA. -- * Otherwise we will get an existing node with IDA and updated refcount. -- */ -- ret = hws_bwc_rule_complex_hash_node_get(bwc_rule, params); -- if (unlikely(ret)) { -- mlx5hws_err(ctx, "Complex rule: failed getting RHT node for this rule\n"); -- goto free_isolated_rule; -+ ret = hws_complex_get_subrule_data(subrule, subm, match_params); -+ if (ret) -+ goto unlock; -+ -+ *chain_id = subrule->subrule_data->chain_id; -+ -+ if (!actions) { -+ MLX5_SET(set_action_in, modify_hdr_action, data, *chain_id); -+ chain_actions[0].action = cdata->action_metadata; -+ chain_actions[0].modify_header.data = modify_hdr_action; -+ chain_actions[1].action = -+ cdata->submatchers[subm_idx + 1].action_tbl; -+ chain_actions[2].action = cdata->action_last; -+ actions = chain_actions; - } - -- /* No need to clear match buffer's fields in accordance to what -- * will actually be matched on first and second matchers. -- * Both matchers were created with the appropriate masks -- * and each of them holds the appropriate field copy array, -- * so rule creation will use only the fields that will be copied -- * in accordance with setters in field copy array. -- * We do, however, need to temporary allocate match buffer -- * for the second (isolated) rule in order to not modify -- * user's match params buffer. -- */ -- -- match_buf_2 = kmemdup(params->match_buf, -- MLX5_ST_SZ_BYTES(fte_match_param), -- GFP_KERNEL); -- if (unlikely(!match_buf_2)) { -- mlx5hws_err(ctx, "Complex rule: failed allocating match_buf\n"); -- ret = -ENOMEM; -- goto hash_node_put; -- } -+ ret = mlx5hws_bwc_rule_create_simple(subrule, match_params, actions, -+ flow_source, bwc_queue_idx); -+ if (ret) -+ goto put_subrule_data; - -- /* On 2nd matcher, use unique 32-bit ID as a matching tag */ -- metadata_val = bwc_rule->complex_hash_node->tag; -- MLX5_SET(fte_match_param, match_buf_2, -- misc_parameters_2.metadata_reg_c_6, metadata_val); -- -- /* Isolated rule's rule_actions contain all the original actions */ -- ret = mlx5hws_bwc_rule_create_simple(bwc_rule->isolated_bwc_rule, -- match_buf_2, -- rule_actions, -- flow_source, -- bwc_queue_idx); -- kfree(match_buf_2); -- if (unlikely(ret)) { -- mlx5hws_err(ctx, -- "Complex rule: failed creating isolated BWC rule (%d)\n", -- ret); -- goto hash_node_put; -- } -+ ret = 0; -+ goto unlock; - -- /* First rule's rule_actions contain setting metadata and -- * jump to isolated table that contains the second matcher. -- * Set metadata value to a unique value for this rule. -- */ -+put_subrule_data: -+ hws_complex_put_subrule_data(subrule, subm, NULL); -+unlock: -+ mutex_unlock(&subm->hash_lock); - -- MLX5_SET(set_action_in, modify_hdr_action, -- action_type, MLX5_MODIFICATION_TYPE_SET); -- MLX5_SET(set_action_in, modify_hdr_action, -- field, MLX5_MODI_META_REG_C_6); -- MLX5_SET(set_action_in, modify_hdr_action, -- length, 0); /* zero means length of 32 */ -- MLX5_SET(set_action_in, modify_hdr_action, -- offset, 0); -- MLX5_SET(set_action_in, modify_hdr_action, -- data, metadata_val); -+ return ret; -+} - -- rule_actions_1[0].action = bwc_matcher->complex->action_metadata; -- rule_actions_1[0].modify_header.offset = 0; -- rule_actions_1[0].modify_header.data = modify_hdr_action; -+static int hws_complex_subrule_destroy(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_bwc_matcher *cmatcher, -+ int subm_idx) -+{ -+ struct mlx5hws_bwc_matcher_complex_data *cdata; -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ struct mlx5hws_context *ctx; -+ bool is_last_rule; -+ int ret = 0; - -- rule_actions_1[1].action = bwc_matcher->complex->action_go_to_tbl; -- rule_actions_1[2].action = bwc_matcher->complex->action_last; -+ cdata = cmatcher->complex; -+ subm = &cdata->submatchers[subm_idx]; -+ ctx = subm->tbl->ctx; - -- ret = mlx5hws_bwc_rule_create_simple(bwc_rule, -- params->match_buf, -- rule_actions_1, -- flow_source, -- bwc_queue_idx); -+ mutex_lock(&subm->hash_lock); - -- if (unlikely(ret)) { -+ hws_complex_put_subrule_data(bwc_rule, subm, &is_last_rule); -+ bwc_rule->rule->skip_delete = !is_last_rule; -+ ret = mlx5hws_bwc_rule_destroy_simple(bwc_rule); -+ if (unlikely(ret)) - mlx5hws_err(ctx, -- "Complex rule: failed creating first BWC rule (%d)\n", -- ret); -- goto destroy_isolated_rule; -- } -+ "Complex rule: failed to delete subrule %d (%d)\n", -+ subm_idx, ret); - -- hws_bwc_matcher_complex_hash_unlock(bwc_matcher); -+ if (subm_idx) -+ mlx5hws_bwc_rule_free(bwc_rule); - -- return 0; -+ mutex_unlock(&subm->hash_lock); - --destroy_isolated_rule: -- mlx5hws_bwc_rule_destroy_simple(bwc_rule->isolated_bwc_rule); --hash_node_put: -- hws_bwc_rule_complex_hash_node_put(bwc_rule, NULL); --free_isolated_rule: -- hws_bwc_matcher_complex_hash_unlock(bwc_matcher); -- mlx5hws_bwc_rule_free(bwc_rule->isolated_bwc_rule); - return ret; - } - --int mlx5hws_bwc_rule_destroy_complex(struct mlx5hws_bwc_rule *bwc_rule) -+int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, -+ struct mlx5hws_match_parameters *params, -+ u32 flow_source, -+ struct mlx5hws_rule_action rule_actions[], -+ u16 bwc_queue_idx) - { -- struct mlx5hws_context *ctx = bwc_rule->bwc_matcher->matcher->tbl->ctx; -- struct mlx5hws_bwc_rule *isolated_bwc_rule; -- int ret_isolated, ret; -- bool is_last_rule; -+ struct mlx5hws_bwc_rule -+ *subrules[MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS] = {0}; -+ struct mlx5hws_bwc_matcher *cmatcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_bwc_matcher_complex_data *cdata; -+ struct mlx5hws_rule_action *subrule_actions; -+ struct mlx5hws_bwc_complex_submatcher *subm; -+ struct mlx5hws_bwc_rule *subrule; -+ u32 *match_params; -+ u32 chain_id; -+ int i, ret; - -- hws_bwc_matcher_complex_hash_lock(bwc_rule->bwc_matcher); -+ cdata = cmatcher->complex; -+ if (!cdata) -+ return -EINVAL; - -- hws_bwc_rule_complex_hash_node_put(bwc_rule, &is_last_rule); -- bwc_rule->rule->skip_delete = !is_last_rule; -+ /* Duplicate user data because we will modify it to set register C6 -+ * values. For the same reason, make sure that we allocate a full -+ * match_param even if the user gave us fewer bytes. We need to ensure -+ * there is space for the match on C6. -+ */ -+ match_params = kzalloc(MLX5_ST_SZ_BYTES(fte_match_param), GFP_KERNEL); -+ if (!match_params) -+ return -ENOMEM; - -- ret = mlx5hws_bwc_rule_destroy_simple(bwc_rule); -- if (unlikely(ret)) -- mlx5hws_err(ctx, "BWC complex rule: failed destroying first rule\n"); -+ memcpy(match_params, params->match_buf, params->match_sz); -+ -+ ret = hws_complex_subrule_create(cmatcher, bwc_rule, match_params, -+ flow_source, bwc_queue_idx, 0, -+ NULL, &chain_id); -+ if (ret) -+ goto free_match_params; -+ subrules[0] = bwc_rule; -+ -+ for (i = 1; i < cdata->num_submatchers; i++) { -+ subm = &cdata->submatchers[i]; -+ subrule = mlx5hws_bwc_rule_alloc(subm->bwc_matcher); -+ if (!subrule) { -+ ret = -ENOMEM; -+ goto destroy_subrules; -+ } -+ -+ /* Match on the previous subrule's chain_id. This is how -+ * subrules are connected in steering. -+ */ -+ MLX5_SET(fte_match_param, match_params, -+ misc_parameters_2.metadata_reg_c_6, chain_id); -+ -+ /* The last subrule uses the complex rule's user-specified -+ * actions. Everything else uses the chaining rules based on the -+ * next table and chain_id. -+ */ -+ subrule_actions = -+ i == cdata->num_submatchers - 1 ? rule_actions : NULL; -+ -+ ret = hws_complex_subrule_create(cmatcher, subrule, -+ match_params, flow_source, -+ bwc_queue_idx, i, -+ subrule_actions, &chain_id); -+ if (ret) { -+ mlx5hws_bwc_rule_free(subrule); -+ goto destroy_subrules; -+ } -+ -+ subrules[i] = subrule; -+ } -+ -+ for (i = 0; i < cdata->num_submatchers - 1; i++) -+ subrules[i]->next_subrule = subrules[i + 1]; - -- isolated_bwc_rule = bwc_rule->isolated_bwc_rule; -- ret_isolated = mlx5hws_bwc_rule_destroy_simple(isolated_bwc_rule); -- if (unlikely(ret_isolated)) -- mlx5hws_err(ctx, "BWC complex rule: failed destroying second (isolated) rule\n"); -+ kfree(match_params); - -- hws_bwc_matcher_complex_hash_unlock(bwc_rule->bwc_matcher); -+ return 0; - -- mlx5hws_bwc_rule_free(isolated_bwc_rule); -+destroy_subrules: -+ while (i--) -+ hws_complex_subrule_destroy(subrules[i], cmatcher, i); -+free_match_params: -+ kfree(match_params); - -- return ret || ret_isolated; -+ return ret; - } - --static void --hws_bwc_matcher_clear_hash_rtcs(struct mlx5hws_bwc_matcher *bwc_matcher) -+int mlx5hws_bwc_rule_destroy_complex(struct mlx5hws_bwc_rule *bwc_rule) - { -- struct mlx5hws_bwc_complex_rule_hash_node *node; -- struct rhashtable_iter iter; -+ struct mlx5hws_bwc_matcher *bwc_matcher = bwc_rule->bwc_matcher; -+ struct mlx5hws_bwc_rule -+ *subrules[MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS] = {0}; -+ struct mlx5hws_bwc_matcher_complex_data *cdata; -+ int i, err, ret_val; -+ -+ cdata = bwc_matcher->complex; -+ -+ /* Construct a list of all the subrules we need to destroy. */ -+ subrules[0] = bwc_rule; -+ for (i = 1; i < cdata->num_submatchers; i++) -+ subrules[i] = subrules[i - 1]->next_subrule; -+ -+ ret_val = 0; -+ for (i = 0; i < cdata->num_submatchers; i++) { -+ err = hws_complex_subrule_destroy(subrules[i], bwc_matcher, i); -+ /* If something goes wrong, plow along to destroy all of the -+ * subrules but return an error upstack. -+ */ -+ if (unlikely(err)) -+ ret_val = err; -+ } - -- rhashtable_walk_enter(&bwc_matcher->complex->refcount_hash, &iter); -- rhashtable_walk_start(&iter); -+ return ret_val; -+} - -- while ((node = rhashtable_walk_next(&iter)) != NULL) { -- if (IS_ERR(node)) -+static void -+hws_bwc_matcher_init_move(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ u16 bwc_queues = mlx5hws_bwc_queues(ctx); -+ struct mlx5hws_bwc_rule *bwc_rule; -+ struct list_head *rules_list; -+ int i; -+ -+ for (i = 0; i < bwc_queues; i++) { -+ rules_list = &bwc_matcher->rules[i]; -+ if (list_empty(rules_list)) - continue; -- node->rtc_valid = false; -- } - -- rhashtable_walk_stop(&iter); -- rhashtable_walk_exit(&iter); -+ list_for_each_entry(bwc_rule, rules_list, list_node) { -+ if (!bwc_rule->subrule_data) -+ continue; -+ bwc_rule->subrule_data->was_moved = false; -+ } -+ } - } - --int --mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) -+int mlx5hws_bwc_matcher_complex_move(struct mlx5hws_bwc_matcher *bwc_matcher) - { - struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; - struct mlx5hws_matcher *matcher = bwc_matcher->matcher; - u16 bwc_queues = mlx5hws_bwc_queues(ctx); - struct mlx5hws_bwc_rule *tmp_bwc_rule; - struct mlx5hws_rule_attr rule_attr; -- struct mlx5hws_table *isolated_tbl; - int move_error = 0, poll_error = 0; - struct mlx5hws_rule *tmp_rule; - struct list_head *rules_list; - u32 expected_completions = 1; -- u32 end_ft_id; -- int i, ret; -+ int i, ret = 0; - -- /* We are rehashing the matcher that is the first part of the complex -- * matcher. Need to update the isolated matcher to point to the end_ft -- * of this new matcher. This needs to be done before moving any rules -- * to prevent possible steering loops. -- */ -- isolated_tbl = bwc_matcher->complex->isolated_tbl; -- end_ft_id = bwc_matcher->matcher->resize_dst->end_ft_id; -- ret = mlx5hws_matcher_update_end_ft_isolated(isolated_tbl, end_ft_id); -- if (ret) { -- mlx5hws_err(ctx, -- "Failed updating end_ft of isolated matcher (%d)\n", -- ret); -- return ret; -- } -- -- hws_bwc_matcher_clear_hash_rtcs(bwc_matcher); -+ hws_bwc_matcher_init_move(bwc_matcher); - - mlx5hws_bwc_rule_fill_attr(bwc_matcher, 0, 0, &rule_attr); - -@@ -1369,15 +994,15 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - /* Check if a rule with similar tag has already - * been moved. - */ -- if (tmp_bwc_rule->complex_hash_node->rtc_valid) { -- /* This rule is a duplicate of rule with similar -- * tag that has already been moved earlier. -- * Just update this rule's RTCs. -+ if (tmp_bwc_rule->subrule_data->was_moved) { -+ /* This rule is a duplicate of rule with -+ * identical tag that has already been moved -+ * earlier. Just update this rule's RTCs. - */ - tmp_bwc_rule->rule->rtc_0 = -- tmp_bwc_rule->complex_hash_node->rtc_0; -+ tmp_bwc_rule->subrule_data->rtc_0; - tmp_bwc_rule->rule->rtc_1 = -- tmp_bwc_rule->complex_hash_node->rtc_1; -+ tmp_bwc_rule->subrule_data->rtc_1; - tmp_bwc_rule->rule->matcher = - tmp_bwc_rule->rule->matcher->resize_dst; - continue; -@@ -1425,12 +1050,12 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - /* Done moving the rule to the new matcher, - * now update RTCs for all the duplicated rules. - */ -- tmp_bwc_rule->complex_hash_node->rtc_0 = -+ tmp_bwc_rule->subrule_data->rtc_0 = - tmp_bwc_rule->rule->rtc_0; -- tmp_bwc_rule->complex_hash_node->rtc_1 = -+ tmp_bwc_rule->subrule_data->rtc_1 = - tmp_bwc_rule->rule->rtc_1; - -- tmp_bwc_rule->complex_hash_node->rtc_valid = true; -+ tmp_bwc_rule->subrule_data->was_moved = true; - } - } - -@@ -1442,3 +1067,35 @@ mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher) - - return ret; - } -+ -+int -+mlx5hws_bwc_matcher_complex_move_first(struct mlx5hws_bwc_matcher *bwc_matcher) -+{ -+ struct mlx5hws_context *ctx = bwc_matcher->matcher->tbl->ctx; -+ struct mlx5hws_bwc_matcher_complex_data *cdata; -+ struct mlx5hws_table *isolated_tbl; -+ u32 end_ft_id; -+ int i, ret; -+ -+ cdata = bwc_matcher->complex; -+ -+ /* We are rehashing the first submatcher. We need to update the -+ * subsequent submatchers to point to the end_ft of this new matcher. -+ * This needs to be done before moving any rules to prevent possible -+ * steering loops. -+ */ -+ end_ft_id = bwc_matcher->matcher->resize_dst->end_ft_id; -+ for (i = 1; i < cdata->num_submatchers; i++) { -+ isolated_tbl = cdata->submatchers[i].tbl; -+ ret = mlx5hws_matcher_update_end_ft_isolated(isolated_tbl, -+ end_ft_id); -+ if (ret) { -+ mlx5hws_err(ctx, -+ "Complex matcher: failed updating end_ft of isolated matcher (%d)\n", -+ ret); -+ return ret; -+ } -+ } -+ -+ return mlx5hws_bwc_matcher_complex_move(bwc_matcher); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -index a6887c7e39d5..d07de631ce9f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/bwc_complex.h -@@ -4,25 +4,60 @@ - #ifndef HWS_BWC_COMPLEX_H_ - #define HWS_BWC_COMPLEX_H_ - --struct mlx5hws_bwc_complex_rule_hash_node { -- u32 match_buf[MLX5_ST_SZ_DW_MATCH_PARAM]; -- u32 tag; -+#define MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS 4 -+ -+/* A matcher can't contain two rules with the same match tag, but it is possible -+ * that two different complex rules' subrules have the same match tag. In that -+ * case, those subrules correspond to a single rule, and we need to refcount. -+ */ -+struct mlx5hws_bwc_complex_subrule_data { -+ struct mlx5hws_rule_match_tag match_tag; - refcount_t refcount; -- bool rtc_valid; -+ /* The chain_id is what glues individual subrules into larger complex -+ * rules. It is the value that this subrule writes to register C6, and -+ * that the next subrule matches against. -+ */ -+ u32 chain_id; - u32 rtc_0; - u32 rtc_1; -+ /* During rehash we iterate through all the subrules to move them. But -+ * two or more subrules can share the same physical rule in the -+ * submatcher, so we use `was_moved` to keep track if a given rule was -+ * already moved. -+ */ -+ bool was_moved; - struct rhash_head hash_node; - }; - -+struct mlx5hws_bwc_complex_submatcher { -+ /* Isolated table that the matcher lives in. Not set for the first -+ * matcher, which lives in the original table. -+ */ -+ struct mlx5hws_table *tbl; -+ /* Match a rule with this action to go to `tbl`. This is set in all -+ * submatchers but the first. -+ */ -+ struct mlx5hws_action *action_tbl; -+ /* This submatcher's simple matcher. The first submatcher points to the -+ * outer (complex) matcher. -+ */ -+ struct mlx5hws_bwc_matcher *bwc_matcher; -+ struct rhashtable rules_hash; -+ struct ida chain_ida; -+ struct mutex hash_lock; /* Protect the hash and ida. */ -+}; -+ - struct mlx5hws_bwc_matcher_complex_data { -- struct mlx5hws_table *isolated_tbl; -- struct mlx5hws_bwc_matcher *isolated_bwc_matcher; -+ struct mlx5hws_bwc_complex_submatcher -+ submatchers[MLX5HWS_BWC_COMPLEX_MAX_SUBMATCHERS]; -+ int num_submatchers; -+ /* Actions used by all but the last submatcher to point to the next -+ * submatcher in the chain. The last submatcher uses the action template -+ * from the complex matcher, to perform the actions that the user -+ * originally requested. -+ */ - struct mlx5hws_action *action_metadata; -- struct mlx5hws_action *action_go_to_tbl; - struct mlx5hws_action *action_last; -- struct rhashtable refcount_hash; -- struct mutex hash_lock; /* Protect the refcount rhashtable */ -- struct ida metadata_ida; - }; - - bool mlx5hws_bwc_match_params_is_complex(struct mlx5hws_context *ctx, -@@ -37,7 +72,10 @@ int mlx5hws_bwc_matcher_create_complex(struct mlx5hws_bwc_matcher *bwc_matcher, - - void mlx5hws_bwc_matcher_destroy_complex(struct mlx5hws_bwc_matcher *bwc_matcher); - --int mlx5hws_bwc_matcher_move_all_complex(struct mlx5hws_bwc_matcher *bwc_matcher); -+int mlx5hws_bwc_matcher_complex_move(struct mlx5hws_bwc_matcher *bwc_matcher); -+ -+int -+mlx5hws_bwc_matcher_complex_move_first(struct mlx5hws_bwc_matcher *bwc_matcher); - - int mlx5hws_bwc_rule_create_complex(struct mlx5hws_bwc_rule *bwc_rule, - struct mlx5hws_match_parameters *params, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -index c4bb6967f74d..82fd122d4284 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c -@@ -1831,80 +1831,6 @@ hws_definer_conv_match_params_to_hl(struct mlx5hws_context *ctx, - return ret; - } - --struct mlx5hws_definer_fc * --mlx5hws_definer_conv_match_params_to_compressed_fc(struct mlx5hws_context *ctx, -- u8 match_criteria_enable, -- u32 *match_param, -- int *fc_sz) --{ -- struct mlx5hws_definer_fc *compressed_fc = NULL; -- struct mlx5hws_definer_conv_data cd = {0}; -- struct mlx5hws_definer_fc *fc; -- int ret; -- -- fc = hws_definer_alloc_fc(ctx, MLX5HWS_DEFINER_FNAME_MAX); -- if (!fc) -- return NULL; -- -- cd.fc = fc; -- cd.ctx = ctx; -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_OUTER) { -- ret = hws_definer_conv_outer(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_INNER) { -- ret = hws_definer_conv_inner(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_MISC) { -- ret = hws_definer_conv_misc(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_MISC2) { -- ret = hws_definer_conv_misc2(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_MISC3) { -- ret = hws_definer_conv_misc3(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_MISC4) { -- ret = hws_definer_conv_misc4(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- if (match_criteria_enable & MLX5HWS_DEFINER_MATCH_CRITERIA_MISC5) { -- ret = hws_definer_conv_misc5(&cd, match_param); -- if (ret) -- goto err_free_fc; -- } -- -- /* Allocate fc array on mt */ -- compressed_fc = hws_definer_alloc_compressed_fc(fc); -- if (!compressed_fc) { -- mlx5hws_err(ctx, -- "Convert to compressed fc: failed to set field copy to match template\n"); -- goto err_free_fc; -- } -- *fc_sz = hws_definer_get_fc_size(fc); -- --err_free_fc: -- kfree(fc); -- return compressed_fc; --} -- - static int - hws_definer_find_byte_in_tag(struct mlx5hws_definer *definer, - u32 hl_byte_off, -@@ -2067,7 +1993,7 @@ hws_definer_copy_sel_ctrl(struct mlx5hws_definer_sel_ctrl *ctrl, - static int - hws_definer_find_best_match_fit(struct mlx5hws_context *ctx, - struct mlx5hws_definer *definer, -- u8 *hl) -+ u8 *hl, bool allow_jumbo) - { - struct mlx5hws_definer_sel_ctrl ctrl = {0}; - bool found; -@@ -2084,6 +2010,9 @@ hws_definer_find_best_match_fit(struct mlx5hws_context *ctx, - return 0; - } - -+ if (!allow_jumbo) -+ return -E2BIG; -+ - /* Try to create a full/limited jumbo definer */ - ctrl.allowed_full_dw = ctx->caps->full_dw_jumbo_support ? DW_SELECTORS : - DW_SELECTORS_MATCH; -@@ -2160,7 +2089,8 @@ int mlx5hws_definer_compare(struct mlx5hws_definer *definer_a, - int - mlx5hws_definer_calc_layout(struct mlx5hws_context *ctx, - struct mlx5hws_match_template *mt, -- struct mlx5hws_definer *match_definer) -+ struct mlx5hws_definer *match_definer, -+ bool allow_jumbo) - { - u8 *match_hl; - int ret; -@@ -2182,7 +2112,8 @@ mlx5hws_definer_calc_layout(struct mlx5hws_context *ctx, - } - - /* Find the match definer layout for header layout match union */ -- ret = hws_definer_find_best_match_fit(ctx, match_definer, match_hl); -+ ret = hws_definer_find_best_match_fit(ctx, match_definer, match_hl, -+ allow_jumbo); - if (ret) { - if (ret == -E2BIG) - mlx5hws_dbg(ctx, -@@ -2370,7 +2301,7 @@ int mlx5hws_definer_mt_init(struct mlx5hws_context *ctx, - struct mlx5hws_definer match_layout = {0}; - int ret; - -- ret = mlx5hws_definer_calc_layout(ctx, mt, &match_layout); -+ ret = mlx5hws_definer_calc_layout(ctx, mt, &match_layout, true); - if (ret) { - mlx5hws_err(ctx, "Failed to calculate matcher definer layout\n"); - return ret; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -index 62da55389331..141f3eb2e307 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.h -@@ -823,13 +823,8 @@ void mlx5hws_definer_free(struct mlx5hws_context *ctx, - - int mlx5hws_definer_calc_layout(struct mlx5hws_context *ctx, - struct mlx5hws_match_template *mt, -- struct mlx5hws_definer *match_definer); -- --struct mlx5hws_definer_fc * --mlx5hws_definer_conv_match_params_to_compressed_fc(struct mlx5hws_context *ctx, -- u8 match_criteria_enable, -- u32 *match_param, -- int *fc_sz); -+ struct mlx5hws_definer *match_definer, -+ bool allow_jumbo); - - const char *mlx5hws_definer_fname_to_str(enum mlx5hws_definer_fname fname); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1566-net-mlx5e-prevent-entering-switchdev-mode-with-inconsistent-.patch b/SOURCES/1566-net-mlx5e-prevent-entering-switchdev-mode-with-inconsistent-.patch deleted file mode 100644 index 17a13e4e4..000000000 --- a/SOURCES/1566-net-mlx5e-prevent-entering-switchdev-mode-with-inconsistent-.patch +++ /dev/null @@ -1,105 +0,0 @@ -From e372fb3a61e3df224c1a4e95424e8124dbd9dbef Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Prevent entering switchdev mode with inconsistent - netns - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 06fdc45f16c392dc3394c67e7c17ae63935715d3 -Author: Jianbo Liu -Date: Mon Sep 29 00:25:18 2025 +0300 - - net/mlx5e: Prevent entering switchdev mode with inconsistent netns - - When a PF enters switchdev mode, its netdevice becomes the uplink - representor but remains in its current network namespace. All other - representors (VFs, SFs) are created in the netns of the devlink - instance. - - If the PF's netns has been moved and differs from the devlink's netns, - enabling switchdev mode would create a state where the OVS control - plane (ovs-vsctl) cannot manage the switch because the PF uplink - representor and the other representors are split across different - namespaces. - - To prevent this inconsistent configuration, block the request to enter - switchdev mode if the PF netdevice's netns does not match the netns of - its devlink instance. - - As part of this change, the PF's netns is first marked as immutable. - This prevents race conditions where the netns could be changed after - the check is performed but before the mode transition is complete, and - it aligns the PF's behavior with that of the final uplink representor. - - Signed-off-by: Jianbo Liu - Reviewed-by: Cosmin Ratiu - Reviewed-by: Jiri Pirko - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index b8ec55929ab1..52c3de24bea3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3774,6 +3774,29 @@ void mlx5_eswitch_unblock_mode(struct mlx5_core_dev *dev) - up_write(&esw->mode_lock); - } - -+/* Returns false only when uplink netdev exists and its netns is different from -+ * devlink's netns. True for all others so entering switchdev mode is allowed. -+ */ -+static bool mlx5_devlink_netdev_netns_immutable_set(struct devlink *devlink, -+ bool immutable) -+{ -+ struct mlx5_core_dev *mdev = devlink_priv(devlink); -+ struct net_device *netdev; -+ bool ret; -+ -+ netdev = mlx5_uplink_netdev_get(mdev); -+ if (!netdev) -+ return true; -+ -+ rtnl_lock(); -+ netdev->netns_immutable = immutable; -+ ret = net_eq(dev_net(netdev), devlink_net(devlink)); -+ rtnl_unlock(); -+ -+ mlx5_uplink_netdev_put(mdev, netdev); -+ return ret; -+} -+ - int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - struct netlink_ext_ack *extack) - { -@@ -3816,6 +3839,14 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - esw->eswitch_operation_in_progress = true; - up_write(&esw->mode_lock); - -+ if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && -+ !mlx5_devlink_netdev_netns_immutable_set(devlink, true)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's."); -+ err = -EINVAL; -+ goto skip; -+ } -+ - if (mode == DEVLINK_ESWITCH_MODE_LEGACY) - esw->dev->priv.flags |= MLX5_PRIV_FLAGS_SWITCH_LEGACY; - mlx5_eswitch_disable_locked(esw); -@@ -3834,6 +3865,8 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - } - - skip: -+ if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && err) -+ mlx5_devlink_netdev_netns_immutable_set(devlink, false); - down_write(&esw->mode_lock); - esw->eswitch_operation_in_progress = false; - unlock: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1567-net-mlx5-improve-qos-error-messages-with-actual-depth-values.patch b/SOURCES/1567-net-mlx5-improve-qos-error-messages-with-actual-depth-values.patch deleted file mode 100644 index 80e4b700f..000000000 --- a/SOURCES/1567-net-mlx5-improve-qos-error-messages-with-actual-depth-values.patch +++ /dev/null @@ -1,68 +0,0 @@ -From 12a0a2705638c0500f2b3b6f06925dd54e277143 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5: Improve QoS error messages with actual depth values - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 33dbaa54ef431b416c1ddb2c25b9b201634edcfa -Author: Carolina Jubran -Date: Mon Sep 29 00:25:19 2025 +0300 - - net/mlx5: Improve QoS error messages with actual depth values - - Enhance error messages in MLX5 QoS scheduling depth validation by - including the actual values that caused the validation to fail. - - Suggested-by: Paolo Abeni - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 5f2d6c35f1ad..56e6f54b1e2e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -971,8 +971,9 @@ esw_qos_vport_tc_enable(struct mlx5_vport *vport, enum sched_node_type type, - max_level = 1 << MLX5_CAP_QOS(vport_node->esw->dev, - log_esw_max_sched_depth); - if (new_level > max_level) { -- NL_SET_ERR_MSG_MOD(extack, -- "TC arbitration on leafs is not supported beyond max scheduling depth"); -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "TC arbitration on leafs is not supported beyond max depth %d", -+ max_level); - return -EOPNOTSUPP; - } - } -@@ -1444,8 +1445,9 @@ static int esw_qos_node_enable_tc_arbitration(struct mlx5_esw_sched_node *node, - new_level = node->level + 1; - max_level = 1 << MLX5_CAP_QOS(node->esw->dev, log_esw_max_sched_depth); - if (new_level > max_level) { -- NL_SET_ERR_MSG_MOD(extack, -- "TC arbitration on nodes is not supported beyond max scheduling depth"); -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "TC arbitration on nodes is not supported beyond max depth %d", -+ max_level); - return -EOPNOTSUPP; - } - -@@ -1997,8 +1999,9 @@ mlx5_esw_qos_node_validate_set_parent(struct mlx5_esw_sched_node *node, - - max_level = 1 << MLX5_CAP_QOS(node->esw->dev, log_esw_max_sched_depth); - if (new_level > max_level) { -- NL_SET_ERR_MSG_MOD(extack, -- "Node hierarchy depth exceeds the maximum supported level"); -+ NL_SET_ERR_MSG_FMT_MOD(extack, -+ "Node hierarchy depth %d exceeds the maximum supported level %d", -+ new_level, max_level); - return -EOPNOTSUPP; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1568-net-mlx5e-remove-unused-mdev-param-from-rss-indir-init.patch b/SOURCES/1568-net-mlx5e-remove-unused-mdev-param-from-rss-indir-init.patch deleted file mode 100644 index e613d4428..000000000 --- a/SOURCES/1568-net-mlx5e-remove-unused-mdev-param-from-rss-indir-init.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 59a3d8fddda6c882efa6b79e0292733f9cf1f627 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Remove unused mdev param from RSS indir init - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a3f69641cbbc36015eb50ad6170caeb26f9022de -Author: Carolina Jubran -Date: Mon Sep 29 00:25:20 2025 +0300 - - net/mlx5e: Remove unused mdev param from RSS indir init - - The mdev parameter is not used in mlx5e_rss_params_indir_init, so drop - it from the function and update all callers accordingly. - - No functional changes. - - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -index c68ba0e58fa6..6422eeabc334 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -@@ -91,7 +91,7 @@ void mlx5e_rss_params_indir_modify_actual_size(struct mlx5e_rss *rss, u32 num_ch - rss->indir.actual_table_size = mlx5e_rqt_size(rss->mdev, num_channels); - } - --int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, struct mlx5_core_dev *mdev, -+int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, - u32 actual_table_size, u32 max_table_size) - { - indir->table = kvmalloc_array(max_table_size, sizeof(*indir->table), GFP_KERNEL); -@@ -139,7 +139,8 @@ static struct mlx5e_rss *mlx5e_rss_init_copy(const struct mlx5e_rss *from) - if (!rss) - return ERR_PTR(-ENOMEM); - -- err = mlx5e_rss_params_indir_init(&rss->indir, from->mdev, from->indir.actual_table_size, -+ err = mlx5e_rss_params_indir_init(&rss->indir, -+ from->indir.actual_table_size, - from->indir.max_table_size); - if (err) - goto err_free_rss; -@@ -363,6 +364,7 @@ struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_suppo - enum mlx5e_rss_init_type type, unsigned int nch, - unsigned int max_nch) - { -+ u32 rqt_max_size, rqt_size; - struct mlx5e_rss *rss; - int err; - -@@ -370,9 +372,9 @@ struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_suppo - if (!rss) - return ERR_PTR(-ENOMEM); - -- err = mlx5e_rss_params_indir_init(&rss->indir, mdev, -- mlx5e_rqt_size(mdev, nch), -- mlx5e_rqt_size(mdev, max_nch)); -+ rqt_size = mlx5e_rqt_size(mdev, nch); -+ rqt_max_size = mlx5e_rqt_size(mdev, max_nch); -+ err = mlx5e_rss_params_indir_init(&rss->indir, rqt_size, rqt_max_size); - if (err) - goto err_free_rss; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -index c6c1b2847cf5..616097c8770e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -@@ -18,7 +18,7 @@ mlx5e_rss_get_default_tt_config(enum mlx5_traffic_types tt); - - struct mlx5e_rss; - --int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, struct mlx5_core_dev *mdev, -+int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, - u32 actual_table_size, u32 max_table_size); - void mlx5e_rss_params_indir_cleanup(struct mlx5e_rss_params_indir *indir); - void mlx5e_rss_params_indir_modify_actual_size(struct mlx5e_rss *rss, u32 num_channels); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index e1599817c3b2..7a34a502f97f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -758,11 +758,11 @@ static int mlx5e_hairpin_create_indirect_rqt(struct mlx5e_hairpin *hp) - struct mlx5e_priv *priv = hp->func_priv; - struct mlx5_core_dev *mdev = priv->mdev; - struct mlx5e_rss_params_indir indir; -+ u32 rqt_size; - int err; - -- err = mlx5e_rss_params_indir_init(&indir, mdev, -- mlx5e_rqt_size(mdev, hp->num_channels), -- mlx5e_rqt_size(mdev, hp->num_channels)); -+ rqt_size = mlx5e_rqt_size(mdev, hp->num_channels); -+ err = mlx5e_rss_params_indir_init(&indir, rqt_size, rqt_size); - if (err) - return err; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1569-net-mlx5e-introduce-mlx5e-rss-init-params.patch b/SOURCES/1569-net-mlx5e-introduce-mlx5e-rss-init-params.patch deleted file mode 100644 index fb79d67da..000000000 --- a/SOURCES/1569-net-mlx5e-introduce-mlx5e-rss-init-params.patch +++ /dev/null @@ -1,288 +0,0 @@ -From 382207217359bed3c6dd288669d8eabc4726fa49 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Introduce mlx5e_rss_init_params - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fc92cddd7a833d51ef857eca672214cab755ceaa -Author: Carolina Jubran -Date: Mon Sep 29 00:25:21 2025 +0300 - - net/mlx5e: Introduce mlx5e_rss_init_params - - Introduce a dedicated structure to group RSS initialization parameters - that are only used during RSS creation, and drop the "init" prefix - from pkt_merge_param. - - No functional changes. - - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -index 6422eeabc334..c3eeeec62129 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -@@ -193,10 +193,10 @@ mlx5e_rss_get_tt_config(struct mlx5e_rss *rss, enum mlx5_traffic_types tt) - return rss_tt; - } - --static int mlx5e_rss_create_tir(struct mlx5e_rss *rss, -- enum mlx5_traffic_types tt, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- bool inner) -+static int -+mlx5e_rss_create_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, -+ bool inner) - { - struct mlx5e_rss_params_traffic_type rss_tt; - struct mlx5e_tir_builder *builder; -@@ -229,7 +229,7 @@ static int mlx5e_rss_create_tir(struct mlx5e_rss *rss, - rqtn = mlx5e_rqt_get_rqtn(&rss->rqt); - mlx5e_tir_builder_build_rqt(builder, rss->mdev->mlx5e_res.hw_objs.td.tdn, - rqtn, rss->inner_ft_support); -- mlx5e_tir_builder_build_packet_merge(builder, init_pkt_merge_param); -+ mlx5e_tir_builder_build_packet_merge(builder, pkt_merge_param); - rss_tt = mlx5e_rss_get_tt_config(rss, tt); - mlx5e_tir_builder_build_rss(builder, &rss->hash, &rss_tt, inner); - -@@ -265,15 +265,16 @@ static void mlx5e_rss_destroy_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types - *tir_p = NULL; - } - --static int mlx5e_rss_create_tirs(struct mlx5e_rss *rss, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- bool inner) -+static int -+mlx5e_rss_create_tirs(struct mlx5e_rss *rss, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, -+ bool inner) - { - enum mlx5_traffic_types tt, max_tt; - int err; - - for (tt = 0; tt < MLX5E_NUM_INDIR_TIRS; tt++) { -- err = mlx5e_rss_create_tir(rss, tt, init_pkt_merge_param, inner); -+ err = mlx5e_rss_create_tir(rss, tt, pkt_merge_param, inner); - if (err) - goto err_destroy_tirs; - } -@@ -359,10 +360,9 @@ static int mlx5e_rss_init_no_tirs(struct mlx5e_rss *rss) - rss->drop_rqn, rss->indir.max_table_size); - } - --struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- enum mlx5e_rss_init_type type, unsigned int nch, -- unsigned int max_nch) -+struct mlx5e_rss * -+mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -+ const struct mlx5e_rss_init_params *init_params) - { - u32 rqt_max_size, rqt_size; - struct mlx5e_rss *rss; -@@ -372,8 +372,8 @@ struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_suppo - if (!rss) - return ERR_PTR(-ENOMEM); - -- rqt_size = mlx5e_rqt_size(mdev, nch); -- rqt_max_size = mlx5e_rqt_size(mdev, max_nch); -+ rqt_size = mlx5e_rqt_size(mdev, init_params->nch); -+ rqt_max_size = mlx5e_rqt_size(mdev, init_params->max_nch); - err = mlx5e_rss_params_indir_init(&rss->indir, rqt_size, rqt_max_size); - if (err) - goto err_free_rss; -@@ -386,15 +386,18 @@ struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_suppo - if (err) - goto err_free_indir; - -- if (type == MLX5E_RSS_INIT_NO_TIRS) -+ if (init_params->type == MLX5E_RSS_INIT_NO_TIRS) - goto out; - -- err = mlx5e_rss_create_tirs(rss, init_pkt_merge_param, false); -+ err = mlx5e_rss_create_tirs(rss, init_params->pkt_merge_param, -+ false); - if (err) - goto err_destroy_rqt; - - if (inner_ft_support) { -- err = mlx5e_rss_create_tirs(rss, init_pkt_merge_param, true); -+ err = mlx5e_rss_create_tirs(rss, -+ init_params->pkt_merge_param, -+ true); - if (err) - goto err_destroy_tirs; - } -@@ -470,10 +473,10 @@ bool mlx5e_rss_valid_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, bool - /* Fill the "tirn" output parameter. - * Create the requested TIR if it's its first usage. - */ --int mlx5e_rss_obtain_tirn(struct mlx5e_rss *rss, -- enum mlx5_traffic_types tt, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- bool inner, u32 *tirn) -+int -+mlx5e_rss_obtain_tirn(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, -+ bool inner, u32 *tirn) - { - struct mlx5e_tir *tir; - -@@ -481,7 +484,7 @@ int mlx5e_rss_obtain_tirn(struct mlx5e_rss *rss, - if (!tir) { /* TIR doesn't exist, create one */ - int err; - -- err = mlx5e_rss_create_tir(rss, tt, init_pkt_merge_param, inner); -+ err = mlx5e_rss_create_tir(rss, tt, pkt_merge_param, inner); - if (err) - return err; - tir = rss_get_tir(rss, tt, inner); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -index 616097c8770e..80225709675b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -@@ -13,6 +13,13 @@ enum mlx5e_rss_init_type { - MLX5E_RSS_INIT_TIRS - }; - -+struct mlx5e_rss_init_params { -+ enum mlx5e_rss_init_type type; -+ const struct mlx5e_packet_merge_param *pkt_merge_param; -+ unsigned int nch; -+ unsigned int max_nch; -+}; -+ - struct mlx5e_rss_params_traffic_type - mlx5e_rss_get_default_tt_config(enum mlx5_traffic_types tt); - -@@ -22,10 +29,9 @@ int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, - u32 actual_table_size, u32 max_table_size); - void mlx5e_rss_params_indir_cleanup(struct mlx5e_rss_params_indir *indir); - void mlx5e_rss_params_indir_modify_actual_size(struct mlx5e_rss *rss, u32 num_channels); --struct mlx5e_rss *mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- enum mlx5e_rss_init_type type, unsigned int nch, -- unsigned int max_nch); -+struct mlx5e_rss * -+mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -+ const struct mlx5e_rss_init_params *init_params); - int mlx5e_rss_cleanup(struct mlx5e_rss *rss); - - void mlx5e_rss_refcnt_inc(struct mlx5e_rss *rss); -@@ -37,10 +43,10 @@ u32 mlx5e_rss_get_tirn(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - bool inner); - bool mlx5e_rss_valid_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, bool inner); - u32 mlx5e_rss_get_rqtn(struct mlx5e_rss *rss); --int mlx5e_rss_obtain_tirn(struct mlx5e_rss *rss, -- enum mlx5_traffic_types tt, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -- bool inner, u32 *tirn); -+int -+mlx5e_rss_obtain_tirn(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, -+ bool inner, u32 *tirn); - - void mlx5e_rss_enable(struct mlx5e_rss *rss, u32 *rqns, u32 *vhca_ids, unsigned int num_rqns); - void mlx5e_rss_disable(struct mlx5e_rss *rss); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -index a2acbfee2b77..74dda61e92bc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -@@ -54,17 +54,25 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - unsigned int init_nch) - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; -+ struct mlx5e_rss_init_params init_params; - struct mlx5e_rss *rss; - - if (WARN_ON(res->rss[0])) - return -EINVAL; - -+ init_params = (struct mlx5e_rss_init_params) { -+ .type = MLX5E_RSS_INIT_TIRS, -+ .pkt_merge_param = &res->pkt_merge_param, -+ .nch = init_nch, -+ .max_nch = res->max_nch, -+ }; -+ - rss = mlx5e_rss_init(res->mdev, inner_ft_support, res->drop_rqn, -- &res->pkt_merge_param, MLX5E_RSS_INIT_TIRS, init_nch, res->max_nch); -+ &init_params); - if (IS_ERR(rss)) - return PTR_ERR(rss); - -- mlx5e_rss_set_indir_uniform(rss, init_nch); -+ mlx5e_rss_set_indir_uniform(rss, init_params.nch); - - res->rss[0] = rss; - -@@ -74,18 +82,25 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int init_nch) - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; -+ struct mlx5e_rss_init_params init_params; - struct mlx5e_rss *rss; - - if (WARN_ON_ONCE(res->rss[rss_idx])) - return -ENOSPC; - -+ init_params = (struct mlx5e_rss_init_params) { -+ .type = MLX5E_RSS_INIT_NO_TIRS, -+ .pkt_merge_param = &res->pkt_merge_param, -+ .nch = init_nch, -+ .max_nch = res->max_nch, -+ }; -+ - rss = mlx5e_rss_init(res->mdev, inner_ft_support, res->drop_rqn, -- &res->pkt_merge_param, MLX5E_RSS_INIT_NO_TIRS, init_nch, -- res->max_nch); -+ &init_params); - if (IS_ERR(rss)) - return PTR_ERR(rss); - -- mlx5e_rss_set_indir_uniform(rss, init_nch); -+ mlx5e_rss_set_indir_uniform(rss, init_params.nch); - if (res->rss_active) { - u32 *vhca_ids = get_vhca_ids(res, 0); - -@@ -438,7 +453,7 @@ static void mlx5e_rx_res_ptp_destroy(struct mlx5e_rx_res *res) - struct mlx5e_rx_res * - mlx5e_rx_res_create(struct mlx5_core_dev *mdev, enum mlx5e_rx_res_features features, - unsigned int max_nch, u32 drop_rqn, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, - unsigned int init_nch) - { - bool multi_vhca = features & MLX5E_RX_RES_FEATURE_MULTI_VHCA; -@@ -454,7 +469,7 @@ mlx5e_rx_res_create(struct mlx5_core_dev *mdev, enum mlx5e_rx_res_features featu - res->max_nch = max_nch; - res->drop_rqn = drop_rqn; - -- res->pkt_merge_param = *init_pkt_merge_param; -+ res->pkt_merge_param = *pkt_merge_param; - init_rwsem(&res->pkt_merge_param_sem); - - err = mlx5e_rx_res_rss_init_def(res, init_nch); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -index 1d049e2aa264..65a857c215e1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -@@ -27,7 +27,7 @@ enum mlx5e_rx_res_features { - struct mlx5e_rx_res * - mlx5e_rx_res_create(struct mlx5_core_dev *mdev, enum mlx5e_rx_res_features features, - unsigned int max_nch, u32 drop_rqn, -- const struct mlx5e_packet_merge_param *init_pkt_merge_param, -+ const struct mlx5e_packet_merge_param *pkt_merge_param, - unsigned int init_nch); - void mlx5e_rx_res_destroy(struct mlx5e_rx_res *res); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1570-net-mlx5e-introduce-mlx5e-rss-params-for-rss-configuration.patch b/SOURCES/1570-net-mlx5e-introduce-mlx5e-rss-params-for-rss-configuration.patch deleted file mode 100644 index 0243d1aa6..000000000 --- a/SOURCES/1570-net-mlx5e-introduce-mlx5e-rss-params-for-rss-configuration.patch +++ /dev/null @@ -1,247 +0,0 @@ -From fe06434012210b2e9fc9dc042408201768b9419c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Introduce mlx5e_rss_params for RSS configuration - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c40a94ccfdc76fa26c620d1748ebda35c2153dd9 -Author: Carolina Jubran -Date: Mon Sep 29 00:25:22 2025 +0300 - - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration - - Group RSS-related parameters into a dedicated mlx5e_rss_params - struct. Pass this struct instead of individual arguments when - initializing RSS. - - No functional changes. - - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -index c3eeeec62129..c96cbc4b0dbf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -@@ -75,15 +75,14 @@ struct mlx5e_rss { - struct mlx5e_tir *inner_tir[MLX5E_NUM_INDIR_TIRS]; - struct mlx5e_rqt rqt; - struct mlx5_core_dev *mdev; /* primary */ -- u32 drop_rqn; -- bool inner_ft_support; -+ struct mlx5e_rss_params params; - bool enabled; - refcount_t refcnt; - }; - - bool mlx5e_rss_get_inner_ft_support(struct mlx5e_rss *rss) - { -- return rss->inner_ft_support; -+ return rss->params.inner_ft_support; - } - - void mlx5e_rss_params_indir_modify_actual_size(struct mlx5e_rss *rss, u32 num_channels) -@@ -198,6 +197,7 @@ mlx5e_rss_create_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - const struct mlx5e_packet_merge_param *pkt_merge_param, - bool inner) - { -+ bool rss_inner = rss->params.inner_ft_support; - struct mlx5e_rss_params_traffic_type rss_tt; - struct mlx5e_tir_builder *builder; - struct mlx5e_tir **tir_p; -@@ -205,7 +205,7 @@ mlx5e_rss_create_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - u32 rqtn; - int err; - -- if (inner && !rss->inner_ft_support) { -+ if (inner && !rss_inner) { - mlx5e_rss_warn(rss->mdev, - "Cannot create inner indirect TIR[%d], RSS inner FT is not supported.\n", - tt); -@@ -228,7 +228,7 @@ mlx5e_rss_create_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - - rqtn = mlx5e_rqt_get_rqtn(&rss->rqt); - mlx5e_tir_builder_build_rqt(builder, rss->mdev->mlx5e_res.hw_objs.td.tdn, -- rqtn, rss->inner_ft_support); -+ rqtn, rss_inner); - mlx5e_tir_builder_build_packet_merge(builder, pkt_merge_param); - rss_tt = mlx5e_rss_get_tt_config(rss, tt); - mlx5e_tir_builder_build_rss(builder, &rss->hash, &rss_tt, inner); -@@ -337,7 +337,7 @@ static int mlx5e_rss_update_tirs(struct mlx5e_rss *rss) - tt, err); - } - -- if (!rss->inner_ft_support) -+ if (!rss->params.inner_ft_support) - continue; - - err = mlx5e_rss_update_tir(rss, tt, true); -@@ -357,11 +357,13 @@ static int mlx5e_rss_init_no_tirs(struct mlx5e_rss *rss) - refcount_set(&rss->refcnt, 1); - - return mlx5e_rqt_init_direct(&rss->rqt, rss->mdev, true, -- rss->drop_rqn, rss->indir.max_table_size); -+ rss->params.drop_rqn, -+ rss->indir.max_table_size); - } - - struct mlx5e_rss * --mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -+mlx5e_rss_init(struct mlx5_core_dev *mdev, -+ const struct mlx5e_rss_params *params, - const struct mlx5e_rss_init_params *init_params) - { - u32 rqt_max_size, rqt_size; -@@ -379,8 +381,7 @@ mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, - goto err_free_rss; - - rss->mdev = mdev; -- rss->inner_ft_support = inner_ft_support; -- rss->drop_rqn = drop_rqn; -+ rss->params = *params; - - err = mlx5e_rss_init_no_tirs(rss); - if (err) -@@ -394,7 +395,7 @@ mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, - if (err) - goto err_destroy_rqt; - -- if (inner_ft_support) { -+ if (params->inner_ft_support) { - err = mlx5e_rss_create_tirs(rss, - init_params->pkt_merge_param, - true); -@@ -423,7 +424,7 @@ int mlx5e_rss_cleanup(struct mlx5e_rss *rss) - - mlx5e_rss_destroy_tirs(rss, false); - -- if (rss->inner_ft_support) -+ if (rss->params.inner_ft_support) - mlx5e_rss_destroy_tirs(rss, true); - - mlx5e_rqt_destroy(&rss->rqt); -@@ -453,7 +454,7 @@ u32 mlx5e_rss_get_tirn(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - { - struct mlx5e_tir *tir; - -- WARN_ON(inner && !rss->inner_ft_support); -+ WARN_ON(inner && !rss->params.inner_ft_support); - tir = rss_get_tir(rss, tt, inner); - WARN_ON(!tir); - -@@ -517,10 +518,11 @@ void mlx5e_rss_disable(struct mlx5e_rss *rss) - int err; - - rss->enabled = false; -- err = mlx5e_rqt_redirect_direct(&rss->rqt, rss->drop_rqn, NULL); -+ err = mlx5e_rqt_redirect_direct(&rss->rqt, rss->params.drop_rqn, NULL); - if (err) - mlx5e_rss_warn(rss->mdev, "Failed to redirect RQT %#x to drop RQ %#x: err = %d\n", -- mlx5e_rqt_get_rqtn(&rss->rqt), rss->drop_rqn, err); -+ mlx5e_rqt_get_rqtn(&rss->rqt), -+ rss->params.drop_rqn, err); - } - - int mlx5e_rss_packet_merge_set_param(struct mlx5e_rss *rss, -@@ -553,7 +555,7 @@ int mlx5e_rss_packet_merge_set_param(struct mlx5e_rss *rss, - } - - inner_tir: -- if (!rss->inner_ft_support) -+ if (!rss->params.inner_ft_support) - continue; - - tir = rss_get_tir(rss, tt, true); -@@ -686,7 +688,7 @@ int mlx5e_rss_set_hash_fields(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - return err; - } - -- if (!(rss->inner_ft_support)) -+ if (!(rss->params.inner_ft_support)) - return 0; - - err = mlx5e_rss_update_tir(rss, tt, true); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -index 80225709675b..5fb03cd0a411 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -@@ -20,6 +20,11 @@ struct mlx5e_rss_init_params { - unsigned int max_nch; - }; - -+struct mlx5e_rss_params { -+ bool inner_ft_support; -+ u32 drop_rqn; -+}; -+ - struct mlx5e_rss_params_traffic_type - mlx5e_rss_get_default_tt_config(enum mlx5_traffic_types tt); - -@@ -30,7 +35,8 @@ int mlx5e_rss_params_indir_init(struct mlx5e_rss_params_indir *indir, - void mlx5e_rss_params_indir_cleanup(struct mlx5e_rss_params_indir *indir); - void mlx5e_rss_params_indir_modify_actual_size(struct mlx5e_rss *rss, u32 num_channels); - struct mlx5e_rss * --mlx5e_rss_init(struct mlx5_core_dev *mdev, bool inner_ft_support, u32 drop_rqn, -+mlx5e_rss_init(struct mlx5_core_dev *mdev, -+ const struct mlx5e_rss_params *params, - const struct mlx5e_rss_init_params *init_params); - int mlx5e_rss_cleanup(struct mlx5e_rss *rss); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -index 74dda61e92bc..ac26a32845d0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -@@ -55,6 +55,7 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; - struct mlx5e_rss_init_params init_params; -+ struct mlx5e_rss_params rss_params; - struct mlx5e_rss *rss; - - if (WARN_ON(res->rss[0])) -@@ -67,8 +68,12 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - .max_nch = res->max_nch, - }; - -- rss = mlx5e_rss_init(res->mdev, inner_ft_support, res->drop_rqn, -- &init_params); -+ rss_params = (struct mlx5e_rss_params) { -+ .inner_ft_support = inner_ft_support, -+ .drop_rqn = res->drop_rqn, -+ }; -+ -+ rss = mlx5e_rss_init(res->mdev, &rss_params, &init_params); - if (IS_ERR(rss)) - return PTR_ERR(rss); - -@@ -83,6 +88,7 @@ int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int in - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; - struct mlx5e_rss_init_params init_params; -+ struct mlx5e_rss_params rss_params; - struct mlx5e_rss *rss; - - if (WARN_ON_ONCE(res->rss[rss_idx])) -@@ -95,8 +101,12 @@ int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int in - .max_nch = res->max_nch, - }; - -- rss = mlx5e_rss_init(res->mdev, inner_ft_support, res->drop_rqn, -- &init_params); -+ rss_params = (struct mlx5e_rss_params) { -+ .inner_ft_support = inner_ft_support, -+ .drop_rqn = res->drop_rqn, -+ }; -+ -+ rss = mlx5e_rss_init(res->mdev, &rss_params, &init_params); - if (IS_ERR(rss)) - return PTR_ERR(rss); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1571-net-mlx5e-use-extack-in-set-rxfh-callback.patch b/SOURCES/1571-net-mlx5e-use-extack-in-set-rxfh-callback.patch deleted file mode 100644 index 21c34d6cd..000000000 --- a/SOURCES/1571-net-mlx5e-use-extack-in-set-rxfh-callback.patch +++ /dev/null @@ -1,85 +0,0 @@ -From 96f1787f529352d9da96d303daa083686caa2c71 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Use extack in set rxfh callback - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a833538d1d8db96b78bac04eec9be51b297f1d23 -Author: Gal Pressman -Date: Mon Sep 29 00:25:23 2025 +0300 - - net/mlx5e: Use extack in set rxfh callback - - The ->set/create/modify_rxfh() callbacks now pass a valid extack instead - of NULL through netlink [1]. In case of an error, reflect it through - extack instead of a dmesg print. - - [1] - commit c0ae03588bbb ("ethtool: rss: initial RSS_SET (indirection table handling)") - - Signed-off-by: Gal Pressman - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759094723-843774-8-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 81e819f8722c..64f315089b04 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -1494,7 +1494,8 @@ static int mlx5e_get_rxfh(struct net_device *netdev, struct ethtool_rxfh_param * - } - - static int mlx5e_rxfh_hfunc_check(struct mlx5e_priv *priv, -- const struct ethtool_rxfh_param *rxfh) -+ const struct ethtool_rxfh_param *rxfh, -+ struct netlink_ext_ack *extack) - { - unsigned int count; - -@@ -1504,8 +1505,10 @@ static int mlx5e_rxfh_hfunc_check(struct mlx5e_priv *priv, - unsigned int xor8_max_channels = mlx5e_rqt_max_num_channels_allowed_for_xor8(); - - if (count > xor8_max_channels) { -- netdev_err(priv->netdev, "%s: Cannot set RSS hash function to XOR, current number of channels (%d) exceeds the maximum allowed for XOR8 RSS hfunc (%d)\n", -- __func__, count, xor8_max_channels); -+ NL_SET_ERR_MSG_FMT_MOD( -+ extack, -+ "Number of channels (%u) exceeds the max for XOR8 RSS (%u)", -+ count, xor8_max_channels); - return -EINVAL; - } - } -@@ -1524,7 +1527,7 @@ static int mlx5e_set_rxfh(struct net_device *dev, - - mutex_lock(&priv->state_lock); - -- err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh, extack); - if (err) - goto unlock; - -@@ -1550,7 +1553,7 @@ static int mlx5e_create_rxfh_context(struct net_device *dev, - - mutex_lock(&priv->state_lock); - -- err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh, extack); - if (err) - goto unlock; - -@@ -1590,7 +1593,7 @@ static int mlx5e_modify_rxfh_context(struct net_device *dev, - - mutex_lock(&priv->state_lock); - -- err = mlx5e_rxfh_hfunc_check(priv, rxfh); -+ err = mlx5e_rxfh_hfunc_check(priv, rxfh, extack); - if (err) - goto unlock; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1572-net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-and-nic-i.patch b/SOURCES/1572-net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-and-nic-i.patch deleted file mode 100644 index ebfe8eed8..000000000 --- a/SOURCES/1572-net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-and-nic-i.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 80f8dd4a894d8b6f78de86efd7bb9db3fce351c7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5: Prevent tunnel mode conflicts between FDB and NIC - IPsec tables -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7593439c13933164f701eed9c83d89358f203469 -Author: Carolina Jubran -Date: Sun Oct 5 11:29:57 2025 +0300 - - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables - - When creating IPsec flow tables with tunnel mode enabled, the driver - uses mlx5_eswitch_block_encap() to prevent tunnel encapsulation - conflicts across different domains (NIC_RX/NIC_TX and FDB), since the - firmware doesn’t allow both at the same time. - - Currently, the driver attempts to reserve tunnel mode unconditionally - for both NIC and FDB IPsec tables. This can lead to conflicting tunnel - mode setups, for example, if a flow table was created in the FDB - domain with tunnel offload enabled, and we later try to create another - one in the NIC, or vice versa. - - To resolve this, adjust the blocking logic so that tunnel mode is only - reserved by NIC flows. This ensures that tunnel offload is exclusively - used in either the NIC or the FDB, and avoids unintended offload - conflicts. - - Fixes: 1762f132d542 ("net/mlx5e: Support IPsec packet offload for RX in switchdev mode") - Fixes: c6c2bf5db4ea ("net/mlx5e: Support IPsec packet offload for TX in switchdev mode") - Signed-off-by: Carolina Jubran - Reviewed-by: Jianbo Liu - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759652999-858513-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 6ccfc2af07b7..0bc080274584 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -1069,7 +1069,9 @@ static int rx_create(struct mlx5_core_dev *mdev, struct mlx5e_ipsec *ipsec, - - /* Create FT */ - if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) -- rx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); -+ rx->allow_tunnel_mode = -+ mlx5_eswitch_block_encap(mdev, rx == ipsec->rx_esw); -+ - if (rx->allow_tunnel_mode) - flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; - ft = ipsec_ft_create(attr.ns, attr.sa_level, attr.prio, 1, 2, flags); -@@ -1310,7 +1312,9 @@ static int tx_create(struct mlx5e_ipsec *ipsec, struct mlx5e_ipsec_tx *tx, - goto err_status_rule; - - if (mlx5_ipsec_device_caps(mdev) & MLX5_IPSEC_CAP_TUNNEL) -- tx->allow_tunnel_mode = mlx5_eswitch_block_encap(mdev); -+ tx->allow_tunnel_mode = -+ mlx5_eswitch_block_encap(mdev, tx == ipsec->tx_esw); -+ - if (tx->allow_tunnel_mode) - flags = MLX5_FLOW_TABLE_TUNNEL_EN_REFORMAT; - ft = ipsec_ft_create(tx->ns, attr.sa_level, attr.prio, 1, 4, flags); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index df3756d7e52e..16eb99aba2a7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -879,7 +879,7 @@ void mlx5_eswitch_offloads_single_fdb_del_one(struct mlx5_eswitch *master_esw, - struct mlx5_eswitch *slave_esw); - int mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw); - --bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev); -+bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb); - void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev); - - int mlx5_eswitch_block_mode(struct mlx5_core_dev *dev); -@@ -974,7 +974,8 @@ mlx5_eswitch_reload_ib_reps(struct mlx5_eswitch *esw) - return 0; - } - --static inline bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev) -+static inline bool -+mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb) - { - return true; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 52c3de24bea3..4cf995be127d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -4006,23 +4006,25 @@ int mlx5_devlink_eswitch_inline_mode_get(struct devlink *devlink, u8 *mode) - return esw_inline_mode_to_devlink(esw->offloads.inline_mode, mode); - } - --bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev) -+bool mlx5_eswitch_block_encap(struct mlx5_core_dev *dev, bool from_fdb) - { - struct mlx5_eswitch *esw = dev->priv.eswitch; -+ enum devlink_eswitch_encap_mode encap; -+ bool allow_tunnel = false; - - if (!mlx5_esw_allowed(esw)) - return true; - - down_write(&esw->mode_lock); -- if (esw->mode != MLX5_ESWITCH_LEGACY && -- esw->offloads.encap != DEVLINK_ESWITCH_ENCAP_MODE_NONE) { -- up_write(&esw->mode_lock); -- return false; -+ encap = esw->offloads.encap; -+ if (esw->mode == MLX5_ESWITCH_LEGACY || -+ (encap == DEVLINK_ESWITCH_ENCAP_MODE_NONE && !from_fdb)) { -+ allow_tunnel = true; -+ esw->offloads.num_block_encap++; - } -- -- esw->offloads.num_block_encap++; - up_write(&esw->mode_lock); -- return true; -+ -+ return allow_tunnel; - } - - void mlx5_eswitch_unblock_encap(struct mlx5_core_dev *dev) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1573-net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-not-allow.patch b/SOURCES/1573-net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-not-allow.patch deleted file mode 100644 index fc0cf5b05..000000000 --- a/SOURCES/1573-net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-not-allow.patch +++ /dev/null @@ -1,188 +0,0 @@ -From 9822a1419dfc189e8c1029d8c8df460c5300de89 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:31 -0400 -Subject: [PATCH] net/mlx5e: Prevent tunnel reformat when tunnel mode not - allowed - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 22239eb258bc1e6ccdb2d3502fce1cc2b2a88386 -Author: Carolina Jubran -Date: Sun Oct 5 11:29:58 2025 +0300 - - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed - - When configuring IPsec packet offload in tunnel mode, the driver tries - to create tunnel reformat objects unconditionally. This is incorrect, - because tunnel mode is only permitted under specific encapsulation - settings, and that decision is already made when the flow table is - created. - - The offending commit attempted to block this case in the state add - path, but the check there happens too late and does not prevent the - reformat from being configured. - - Fix by taking short reservations for both the eswitch mode and the - encap at the start of state setup. This preserves the block ordering - (mode --> encap) used later: the mode is blocked during RX/TX get, and - the encap is blocked during flow-table creation. This lets us fail - early if either reservation cannot be obtained, it means a mode - transition is underway or a conflicting configuration already owns - encap. If both succeed, the flow-table path later takes the ownership - and the reservations are released on exit. - - Fixes: 146c196b60e4 ("net/mlx5e: Create IPsec table with tunnel support only when encap is disabled") - Signed-off-by: Carolina Jubran - Reviewed-by: Jianbo Liu - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1759652999-858513-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 00e77c71e201..0a4fb8c92268 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -772,6 +772,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - struct netlink_ext_ack *extack) - { - struct mlx5e_ipsec_sa_entry *sa_entry = NULL; -+ bool allow_tunnel_mode = false; - struct mlx5e_ipsec *ipsec; - struct mlx5e_priv *priv; - gfp_t gfp; -@@ -803,6 +804,20 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - goto err_xfrm; - } - -+ if (mlx5_eswitch_block_mode(priv->mdev)) -+ goto unblock_ipsec; -+ -+ if (x->props.mode == XFRM_MODE_TUNNEL && -+ x->xso.type == XFRM_DEV_OFFLOAD_PACKET) { -+ allow_tunnel_mode = mlx5e_ipsec_fs_tunnel_allowed(sa_entry); -+ if (!allow_tunnel_mode) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Packet offload tunnel mode is disabled due to encap settings"); -+ err = -EINVAL; -+ goto unblock_mode; -+ } -+ } -+ - /* check esn */ - if (x->props.flags & XFRM_STATE_ESN) - mlx5e_ipsec_update_esn_state(sa_entry); -@@ -817,7 +832,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - - err = mlx5_ipsec_create_work(sa_entry); - if (err) -- goto unblock_ipsec; -+ goto unblock_encap; - - err = mlx5e_ipsec_create_dwork(sa_entry); - if (err) -@@ -832,14 +847,6 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - if (err) - goto err_hw_ctx; - -- if (x->props.mode == XFRM_MODE_TUNNEL && -- x->xso.type == XFRM_DEV_OFFLOAD_PACKET && -- !mlx5e_ipsec_fs_tunnel_enabled(sa_entry)) { -- NL_SET_ERR_MSG_MOD(extack, "Packet offload tunnel mode is disabled due to encap settings"); -- err = -EINVAL; -- goto err_add_rule; -- } -- - /* We use *_bh() variant because xfrm_timer_handler(), which runs - * in softirq context, can reach our state delete logic and we need - * xa_erase_bh() there. -@@ -855,8 +862,7 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - queue_delayed_work(ipsec->wq, &sa_entry->dwork->dwork, - MLX5_IPSEC_RESCHED); - -- if (x->xso.type == XFRM_DEV_OFFLOAD_PACKET && -- x->props.mode == XFRM_MODE_TUNNEL) { -+ if (allow_tunnel_mode) { - xa_lock_bh(&ipsec->sadb); - __xa_set_mark(&ipsec->sadb, sa_entry->ipsec_obj_id, - MLX5E_IPSEC_TUNNEL_SA); -@@ -865,6 +871,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - - out: - x->xso.offload_handle = (unsigned long)sa_entry; -+ if (allow_tunnel_mode) -+ mlx5_eswitch_unblock_encap(priv->mdev); -+ -+ mlx5_eswitch_unblock_mode(priv->mdev); -+ - return 0; - - err_add_rule: -@@ -877,6 +888,11 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - if (sa_entry->work) - kfree(sa_entry->work->data); - kfree(sa_entry->work); -+unblock_encap: -+ if (allow_tunnel_mode) -+ mlx5_eswitch_unblock_encap(priv->mdev); -+unblock_mode: -+ mlx5_eswitch_unblock_mode(priv->mdev); - unblock_ipsec: - mlx5_eswitch_unblock_ipsec(priv->mdev); - err_xfrm: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -index 23703f28386a..5d7c15abfcaf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -@@ -319,7 +319,7 @@ void mlx5e_accel_ipsec_fs_del_rule(struct mlx5e_ipsec_sa_entry *sa_entry); - int mlx5e_accel_ipsec_fs_add_pol(struct mlx5e_ipsec_pol_entry *pol_entry); - void mlx5e_accel_ipsec_fs_del_pol(struct mlx5e_ipsec_pol_entry *pol_entry); - void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry); --bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry); -+bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry); - - int mlx5_ipsec_create_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); - void mlx5_ipsec_free_sa_ctx(struct mlx5e_ipsec_sa_entry *sa_entry); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index 0bc080274584..bf1d2769d4f1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -2850,18 +2850,24 @@ void mlx5e_accel_ipsec_fs_modify(struct mlx5e_ipsec_sa_entry *sa_entry) - memcpy(sa_entry, &sa_entry_shadow, sizeof(*sa_entry)); - } - --bool mlx5e_ipsec_fs_tunnel_enabled(struct mlx5e_ipsec_sa_entry *sa_entry) -+bool mlx5e_ipsec_fs_tunnel_allowed(struct mlx5e_ipsec_sa_entry *sa_entry) - { -- struct mlx5_accel_esp_xfrm_attrs *attrs = &sa_entry->attrs; -- struct mlx5e_ipsec_rx *rx; -- struct mlx5e_ipsec_tx *tx; -+ struct mlx5e_ipsec *ipsec = sa_entry->ipsec; -+ struct xfrm_state *x = sa_entry->x; -+ bool from_fdb; - -- rx = ipsec_rx(sa_entry->ipsec, attrs->addrs.family, attrs->type); -- tx = ipsec_tx(sa_entry->ipsec, attrs->type); -- if (sa_entry->attrs.dir == XFRM_DEV_OFFLOAD_OUT) -- return tx->allow_tunnel_mode; -+ if (x->xso.dir == XFRM_DEV_OFFLOAD_OUT) { -+ struct mlx5e_ipsec_tx *tx = ipsec_tx(ipsec, x->xso.type); -+ -+ from_fdb = (tx == ipsec->tx_esw); -+ } else { -+ struct mlx5e_ipsec_rx *rx = ipsec_rx(ipsec, x->props.family, -+ x->xso.type); -+ -+ from_fdb = (rx == ipsec->rx_esw); -+ } - -- return rx->allow_tunnel_mode; -+ return mlx5_eswitch_block_encap(ipsec->mdev, from_fdb); - } - - void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1574-net-mlx5-fix-pre-2-40-binutils-assembler-error.patch b/SOURCES/1574-net-mlx5-fix-pre-2-40-binutils-assembler-error.patch deleted file mode 100644 index b2bfef9fc..000000000 --- a/SOURCES/1574-net-mlx5-fix-pre-2-40-binutils-assembler-error.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 832ffc37e1d39ab4bb0b9980dd9319d3951aeb3b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5: fix pre-2.40 binutils assembler error - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e475fa420e6c53a5023e89dbf0d51bd027b5a776 -Author: Arnd Bergmann -Date: Mon Oct 6 13:56:34 2025 +0200 - - net/mlx5: fix pre-2.40 binutils assembler error - - Old binutils versions require a slightly stricter syntax for the .arch_extension - directive and fail with the extra semicolon: - - /tmp/cclfMnj9.s:656: Error: unknown architectural extension `simd;' - - Drop the semicolon to make it work with all supported toolchain version. - - Link: https://lore.kernel.org/all/20251001163655.GA370262@ax162/ - Reported-by: Paolo Abeni - Reported-by: Naresh Kamboju - Suggested-by: Nathan Chancellor - Fixes: fd8c8216648c ("net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs") - Signed-off-by: Arnd Bergmann - Reviewed-by: Nathan Chancellor - Reviewed-by: Patrisious Haddad - Link: https://patch.msgid.link/20251006115640.497169-1-arnd@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/wc.c b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -index c281153bd411..05e5fd777d4f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/wc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/wc.c -@@ -266,7 +266,7 @@ static void mlx5_iowrite64_copy(struct mlx5_wc_sq *sq, __be32 mmio_wqe[16], - if (cpu_has_neon()) { - kernel_neon_begin(); - asm volatile -- (".arch_extension simd;\n\t" -+ (".arch_extension simd\n\t" - "ld1 {v0.16b, v1.16b, v2.16b, v3.16b}, [%0]\n\t" - "st1 {v0.16b, v1.16b, v2.16b, v3.16b}, [%1]" - : --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1575-net-mlx5e-return-1-instead-of-0-in-invalid-case-in-mlx5e-mpw.patch b/SOURCES/1575-net-mlx5e-return-1-instead-of-0-in-invalid-case-in-mlx5e-mpw.patch deleted file mode 100644 index b2f11ea56..000000000 --- a/SOURCES/1575-net-mlx5e-return-1-instead-of-0-in-invalid-case-in-mlx5e-mpw.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 7291fd4461e2a5d18ff4d95f7f7da90258d715ac Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5e: Return 1 instead of 0 in invalid case in - mlx5e_mpwrq_umr_entry_size() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit aaf043a5688114703ae2c1482b92e7e0754d684e -Author: Nathan Chancellor -Date: Tue Oct 14 13:46:49 2025 -0700 - - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() - - When building with Clang 20 or newer, there are some objtool warnings - from unexpected fallthroughs to other functions: - - vmlinux.o: warning: objtool: mlx5e_mpwrq_mtts_per_wqe() falls through to next function mlx5e_mpwrq_max_num_entries() - vmlinux.o: warning: objtool: mlx5e_mpwrq_max_log_rq_size() falls through to next function mlx5e_get_linear_rq_headroom() - - LLVM 20 contains an (admittedly problematic [1]) optimization [2] to - convert divide by zero into the equivalent of __builtin_unreachable(), - which invokes undefined behavior and destroys code generation when it is - encountered in a control flow graph. - - mlx5e_mpwrq_umr_entry_size() returns 0 in the default case of an - unrecognized mlx5e_mpwrq_umr_mode value. mlx5e_mpwrq_mtts_per_wqe(), - which is inlined into mlx5e_mpwrq_max_log_rq_size(), uses the result of - mlx5e_mpwrq_umr_entry_size() in a divide operation without checking for - zero, so LLVM is able to infer there will be a divide by zero in this - case and invokes undefined behavior. While there is some proposed work - to isolate this undefined behavior and avoid the destructive code - generation that results in these objtool warnings, code should still be - defensive against divide by zero. - - As the WARN_ONCE() implies that an invalid value should be handled - gracefully, return 1 instead of 0 in the default case so that the - results of this division operation is always valid. - - Fixes: 168723c1f8d6 ("net/mlx5e: xsk: Use umr_mode to calculate striding RQ parameters") - Link: https://lore.kernel.org/CAGG=3QUk8-Ak7YKnRziO4=0z=1C_7+4jF+6ZeDQ9yF+kuTOHOQ@mail.gmail.com/ [1] - Link: https://github.com/llvm/llvm-project/commit/37932643abab699e8bb1def08b7eb4eae7ff1448 [2] - Closes: https://github.com/ClangBuiltLinux/linux/issues/2131 - Closes: https://github.com/ClangBuiltLinux/linux/issues/2132 - Signed-off-by: Nathan Chancellor - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20251014-mlx5e-avoid-zero-div-from-mlx5e_mpwrq_umr_entry_size-v1-1-dc186b8819ef@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -index 596440c8c364..c948a80a0e9a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/params.c -@@ -99,7 +99,7 @@ u8 mlx5e_mpwrq_umr_entry_size(enum mlx5e_mpwrq_umr_mode mode) - return sizeof(struct mlx5_ksm) * 4; - } - WARN_ONCE(1, "MPWRQ UMR mode %d is not known\n", mode); -- return 0; -+ return 1; - } - - u8 mlx5e_mpwrq_log_wqe_sz(struct mlx5_core_dev *mdev, u8 page_shift, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1576-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch b/SOURCES/1576-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch deleted file mode 100644 index b64beae25..000000000 --- a/SOURCES/1576-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e0455875e08fcaf37107e9ad673671f24ad54203 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5e: RX, Fix generating skb from non-linear xdp_buff - for legacy RQ - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit afd5ba577c10639f62e8120df67dc70ea4b61176 -Author: Amery Hung -Date: Thu Oct 16 22:55:39 2025 +0300 - - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ - - XDP programs can release xdp_buff fragments when calling - bpf_xdp_adjust_tail(). The driver currently assumes the number of - fragments to be unchanged and may generate skb with wrong truesize or - containing invalid frags. Fix the bug by generating skb according to - xdp_buff after the XDP program runs. - - Fixes: ea5d49bdae8b ("net/mlx5e: Add XDP multi buffer support to the non-linear legacy RQ") - Reviewed-by: Dragos Tatulea - Signed-off-by: Amery Hung - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1760644540-899148-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 3301d5495134..753c20d9dc22 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1772,14 +1772,27 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - } - - prog = rcu_dereference(rq->xdp_prog); -- if (prog && mlx5e_xdp_handle(rq, prog, mxbuf)) { -- if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) { -- struct mlx5e_wqe_frag_info *pwi; -+ if (prog) { -+ u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ -+ if (mlx5e_xdp_handle(rq, prog, mxbuf)) { -+ if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, -+ rq->flags)) { -+ struct mlx5e_wqe_frag_info *pwi; -+ -+ wi -= old_nr_frags - sinfo->nr_frags; -+ -+ for (pwi = head_wi; pwi < wi; pwi++) -+ pwi->frag_page->frags++; -+ } -+ return NULL; /* page/packet was consumed by XDP */ -+ } - -- for (pwi = head_wi; pwi < wi; pwi++) -- pwi->frag_page->frags++; -+ nr_frags_free = old_nr_frags - sinfo->nr_frags; -+ if (unlikely(nr_frags_free)) { -+ wi -= nr_frags_free; -+ truesize -= nr_frags_free * frag_info->frag_stride; - } -- return NULL; /* page/packet was consumed by XDP */ - } - - skb = mlx5e_build_linear_skb( --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1577-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch b/SOURCES/1577-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch deleted file mode 100644 index 433ac0b33..000000000 --- a/SOURCES/1577-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 7062cbfda71609deef84add064a6f2f936a52326 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5e: RX, Fix generating skb from non-linear xdp_buff - for striding RQ - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 87bcef158ac1faca1bd7e0104588e8e2956d10be -Author: Amery Hung -Date: Thu Oct 16 22:55:40 2025 +0300 - - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ - - XDP programs can change the layout of an xdp_buff through - bpf_xdp_adjust_tail() and bpf_xdp_adjust_head(). Therefore, the driver - cannot assume the size of the linear data area nor fragments. Fix the - bug in mlx5 by generating skb according to xdp_buff after XDP programs - run. - - Currently, when handling multi-buf XDP, the mlx5 driver assumes the - layout of an xdp_buff to be unchanged. That is, the linear data area - continues to be empty and fragments remain the same. This may cause - the driver to generate erroneous skb or triggering a kernel - warning. When an XDP program added linear data through - bpf_xdp_adjust_head(), the linear data will be ignored as - mlx5e_build_linear_skb() builds an skb without linear data and then - pull data from fragments to fill the linear data area. When an XDP - program has shrunk the non-linear data through bpf_xdp_adjust_tail(), - the delta passed to __pskb_pull_tail() may exceed the actual nonlinear - data size and trigger the BUG_ON in it. - - To fix the issue, first record the original number of fragments. If the - number of fragments changes after the XDP program runs, rewind the end - fragment pointer by the difference and recalculate the truesize. Then, - build the skb with the linear data area matching the xdp_buff. Finally, - only pull data in if there is non-linear data and fill the linear part - up to 256 bytes. - - Fixes: f52ac7028bec ("net/mlx5e: RX, Add XDP multi-buffer support in Striding RQ") - Signed-off-by: Amery Hung - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1760644540-899148-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 753c20d9dc22..21be5dcf47d5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -2016,6 +2016,7 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - u32 byte_cnt = cqe_bcnt; - struct skb_shared_info *sinfo; - unsigned int truesize = 0; -+ u32 pg_consumed_bytes; - struct bpf_prog *prog; - struct sk_buff *skb; - u32 linear_frame_sz; -@@ -2068,7 +2069,8 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - - while (byte_cnt) { - /* Non-linear mode, hence non-XSK, which always uses PAGE_SIZE. */ -- u32 pg_consumed_bytes = min_t(u32, PAGE_SIZE - frag_offset, byte_cnt); -+ pg_consumed_bytes = -+ min_t(u32, PAGE_SIZE - frag_offset, byte_cnt); - - if (test_bit(MLX5E_RQ_STATE_SHAMPO, &rq->state)) - truesize += pg_consumed_bytes; -@@ -2084,10 +2086,15 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - } - - if (prog) { -+ u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ u32 len; -+ - if (mlx5e_xdp_handle(rq, prog, mxbuf)) { - if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) { - struct mlx5e_frag_page *pfp; - -+ frag_page -= old_nr_frags - sinfo->nr_frags; -+ - for (pfp = head_page; pfp < frag_page; pfp++) - pfp->frags++; - -@@ -2098,9 +2105,19 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - return NULL; /* page/packet was consumed by XDP */ - } - -+ nr_frags_free = old_nr_frags - sinfo->nr_frags; -+ if (unlikely(nr_frags_free)) { -+ frag_page -= nr_frags_free; -+ truesize -= (nr_frags_free - 1) * PAGE_SIZE + -+ ALIGN(pg_consumed_bytes, -+ BIT(rq->mpwqe.log_stride_sz)); -+ } -+ -+ len = mxbuf->xdp.data_end - mxbuf->xdp.data; -+ - skb = mlx5e_build_linear_skb( - rq, mxbuf->xdp.data_hard_start, linear_frame_sz, -- mxbuf->xdp.data - mxbuf->xdp.data_hard_start, 0, -+ mxbuf->xdp.data - mxbuf->xdp.data_hard_start, len, - mxbuf->xdp.data - mxbuf->xdp.data_meta); - if (unlikely(!skb)) { - mlx5e_page_release_fragmented(rq->page_pool, -@@ -2125,8 +2142,11 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - do - pagep->frags++; - while (++pagep < frag_page); -+ -+ headlen = min_t(u16, MLX5E_RX_MAX_HEAD - len, -+ skb->data_len); -+ __pskb_pull_tail(skb, headlen); - } -- __pskb_pull_tail(skb, headlen); - } else { - dma_addr_t addr; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1578-net-mlx5-add-pphcr-to-pcam-supported-registers-mask.patch b/SOURCES/1578-net-mlx5-add-pphcr-to-pcam-supported-registers-mask.patch deleted file mode 100644 index 758c1a0ba..000000000 --- a/SOURCES/1578-net-mlx5-add-pphcr-to-pcam-supported-registers-mask.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 1ab436443ca3370eb1dbe023658aaa6afc08020a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5: Add PPHCR to PCAM supported registers mask - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bb65e0c141f879cdf54db11ae446ee3605fb54d5 -Author: Alexei Lazar -Date: Wed Oct 22 15:29:39 2025 +0300 - - net/mlx5: Add PPHCR to PCAM supported registers mask - - Add the PPHCR bit to the port_access_reg_cap_mask field of PCAM - register to indicate that the device supports the PPHCR register - and the RS-FEC histogram feature. - - Signed-off-by: Alexei Lazar - Reviewed-by: Yael Chemla - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761136182-918470-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 5e2bc469ca64..2207404a125c 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -10832,7 +10832,9 @@ struct mlx5_ifc_pcam_regs_5000_to_507f_bits { - u8 port_access_reg_cap_mask_127_to_96[0x20]; - u8 port_access_reg_cap_mask_95_to_64[0x20]; - -- u8 port_access_reg_cap_mask_63_to_36[0x1c]; -+ u8 port_access_reg_cap_mask_63[0x1]; -+ u8 pphcr[0x1]; -+ u8 port_access_reg_cap_mask_61_to_36[0x1a]; - u8 pplm[0x1]; - u8 port_access_reg_cap_mask_34_to_32[0x3]; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1579-net-mlx5-refactor-devcom-to-return-null-on-failure.patch b/SOURCES/1579-net-mlx5-refactor-devcom-to-return-null-on-failure.patch deleted file mode 100644 index 1b1bd841a..000000000 --- a/SOURCES/1579-net-mlx5-refactor-devcom-to-return-null-on-failure.patch +++ /dev/null @@ -1,302 +0,0 @@ -From 0c2f2f4265dbabbfa5f3e8cf8225fcd6eef57bc8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:32 -0400 -Subject: [PATCH] net/mlx5: Refactor devcom to return NULL on failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 8f82f89550daafc8ca3ba74c389ae1b4afdd75c8 -Author: Patrisious Haddad -Date: Wed Oct 22 15:29:41 2025 +0300 - - net/mlx5: Refactor devcom to return NULL on failure - - Devcom device and component registration isn't always critical to the - functionality of the caller, hence the registration can fail and we can - continue working with an ERR_PTR value saved inside a variable. - - In order to avoid that make sure all devcom failures return NULL. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761136182-918470-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 26d35a2653dc..7ab4fb83dff2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -241,8 +241,8 @@ static int mlx5e_devcom_init_mpv(struct mlx5e_priv *priv, u64 *data) - &attr, - mlx5e_devcom_event_mpv, - priv); -- if (IS_ERR(priv->devcom)) -- return PTR_ERR(priv->devcom); -+ if (!priv->devcom) -+ return -EINVAL; - - if (mlx5_core_is_mp_master(priv->mdev)) { - mlx5_devcom_send_event(priv->devcom, MPV_DEVCOM_MASTER_UP, -@@ -255,7 +255,7 @@ static int mlx5e_devcom_init_mpv(struct mlx5e_priv *priv, u64 *data) - - static void mlx5e_devcom_cleanup_mpv(struct mlx5e_priv *priv) - { -- if (IS_ERR_OR_NULL(priv->devcom)) -+ if (!priv->devcom) - return; - - if (mlx5_core_is_mp_master(priv->mdev)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 4cf995be127d..34749814f19b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3129,7 +3129,7 @@ void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, - attr, - mlx5_esw_offloads_devcom_event, - esw); -- if (IS_ERR(esw->devcom)) -+ if (!esw->devcom) - return; - - mlx5_devcom_send_event(esw->devcom, -@@ -3140,7 +3140,7 @@ void mlx5_esw_offloads_devcom_init(struct mlx5_eswitch *esw, - - void mlx5_esw_offloads_devcom_cleanup(struct mlx5_eswitch *esw) - { -- if (IS_ERR_OR_NULL(esw->devcom)) -+ if (!esw->devcom) - return; - - mlx5_devcom_send_event(esw->devcom, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index 59c00c911275..3db0387bf6dc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -1430,11 +1430,10 @@ static int mlx5_lag_register_hca_devcom_comp(struct mlx5_core_dev *dev) - mlx5_devcom_register_component(dev->priv.devc, - MLX5_DEVCOM_HCA_PORTS, - &attr, NULL, dev); -- if (IS_ERR(dev->priv.hca_devcom_comp)) { -+ if (!dev->priv.hca_devcom_comp) { - mlx5_core_err(dev, -- "Failed to register devcom HCA component, err: %ld\n", -- PTR_ERR(dev->priv.hca_devcom_comp)); -- return PTR_ERR(dev->priv.hca_devcom_comp); -+ "Failed to register devcom HCA component."); -+ return -EINVAL; - } - - return 0; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index d0ba83d77cd1..29e7fa09c32c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -1444,7 +1444,7 @@ static void mlx5_shared_clock_register(struct mlx5_core_dev *mdev, u64 key) - compd = mlx5_devcom_register_component(mdev->priv.devc, - MLX5_DEVCOM_SHARED_CLOCK, - &attr, NULL, mdev); -- if (IS_ERR(compd)) -+ if (!compd) - return; - - mdev->clock_state->compdev = compd; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -index faa2833602c8..e749618229bc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.c -@@ -76,20 +76,18 @@ mlx5_devcom_dev_alloc(struct mlx5_core_dev *dev) - struct mlx5_devcom_dev * - mlx5_devcom_register_device(struct mlx5_core_dev *dev) - { -- struct mlx5_devcom_dev *devc; -+ struct mlx5_devcom_dev *devc = NULL; - - mutex_lock(&dev_list_lock); - - if (devcom_dev_exists(dev)) { -- devc = ERR_PTR(-EEXIST); -+ mlx5_core_err(dev, "devcom device already exists"); - goto out; - } - - devc = mlx5_devcom_dev_alloc(dev); -- if (!devc) { -- devc = ERR_PTR(-ENOMEM); -+ if (!devc) - goto out; -- } - - list_add_tail(&devc->list, &devcom_dev_list); - out: -@@ -110,8 +108,10 @@ mlx5_devcom_dev_release(struct kref *ref) - - void mlx5_devcom_unregister_device(struct mlx5_devcom_dev *devc) - { -- if (!IS_ERR_OR_NULL(devc)) -- kref_put(&devc->ref, mlx5_devcom_dev_release); -+ if (!devc) -+ return; -+ -+ kref_put(&devc->ref, mlx5_devcom_dev_release); - } - - static struct mlx5_devcom_comp * -@@ -122,7 +122,7 @@ mlx5_devcom_comp_alloc(u64 id, const struct mlx5_devcom_match_attr *attr, - - comp = kzalloc(sizeof(*comp), GFP_KERNEL); - if (!comp) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - comp->id = id; - comp->key.key = attr->key; -@@ -160,7 +160,7 @@ devcom_alloc_comp_dev(struct mlx5_devcom_dev *devc, - - devcom = kzalloc(sizeof(*devcom), GFP_KERNEL); - if (!devcom) -- return ERR_PTR(-ENOMEM); -+ return NULL; - - kref_get(&devc->ref); - devcom->devc = devc; -@@ -240,31 +240,28 @@ mlx5_devcom_register_component(struct mlx5_devcom_dev *devc, - mlx5_devcom_event_handler_t handler, - void *data) - { -- struct mlx5_devcom_comp_dev *devcom; -+ struct mlx5_devcom_comp_dev *devcom = NULL; - struct mlx5_devcom_comp *comp; - -- if (IS_ERR_OR_NULL(devc)) -- return ERR_PTR(-EINVAL); -+ if (!devc) -+ return NULL; - - mutex_lock(&comp_list_lock); - comp = devcom_component_get(devc, id, attr, handler); -- if (IS_ERR(comp)) { -- devcom = ERR_PTR(-EINVAL); -+ if (IS_ERR(comp)) - goto out_unlock; -- } - - if (!comp) { - comp = mlx5_devcom_comp_alloc(id, attr, handler); -- if (IS_ERR(comp)) { -- devcom = ERR_CAST(comp); -+ if (!comp) - goto out_unlock; -- } -+ - list_add_tail(&comp->comp_list, &devcom_comp_list); - } - mutex_unlock(&comp_list_lock); - - devcom = devcom_alloc_comp_dev(devc, comp, data); -- if (IS_ERR(devcom)) -+ if (!devcom) - kref_put(&comp->ref, mlx5_devcom_comp_release); - - return devcom; -@@ -276,8 +273,10 @@ mlx5_devcom_register_component(struct mlx5_devcom_dev *devc, - - void mlx5_devcom_unregister_component(struct mlx5_devcom_comp_dev *devcom) - { -- if (!IS_ERR_OR_NULL(devcom)) -- devcom_free_comp_dev(devcom); -+ if (!devcom) -+ return; -+ -+ devcom_free_comp_dev(devcom); - } - - int mlx5_devcom_comp_get_size(struct mlx5_devcom_comp_dev *devcom) -@@ -296,7 +295,7 @@ int mlx5_devcom_send_event(struct mlx5_devcom_comp_dev *devcom, - int err = 0; - void *data; - -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return -ENODEV; - - comp = devcom->comp; -@@ -338,7 +337,7 @@ void mlx5_devcom_comp_set_ready(struct mlx5_devcom_comp_dev *devcom, bool ready) - - bool mlx5_devcom_comp_is_ready(struct mlx5_devcom_comp_dev *devcom) - { -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return false; - - return READ_ONCE(devcom->comp->ready); -@@ -348,7 +347,7 @@ bool mlx5_devcom_for_each_peer_begin(struct mlx5_devcom_comp_dev *devcom) - { - struct mlx5_devcom_comp *comp; - -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return false; - - comp = devcom->comp; -@@ -421,21 +420,21 @@ void *mlx5_devcom_get_next_peer_data_rcu(struct mlx5_devcom_comp_dev *devcom, - - void mlx5_devcom_comp_lock(struct mlx5_devcom_comp_dev *devcom) - { -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return; - down_write(&devcom->comp->sem); - } - - void mlx5_devcom_comp_unlock(struct mlx5_devcom_comp_dev *devcom) - { -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return; - up_write(&devcom->comp->sem); - } - - int mlx5_devcom_comp_trylock(struct mlx5_devcom_comp_dev *devcom) - { -- if (IS_ERR_OR_NULL(devcom)) -+ if (!devcom) - return 0; - return down_write_trylock(&devcom->comp->sem); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -index f5c2701f6e87..8e17daae48af 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c -@@ -221,8 +221,8 @@ static int sd_register(struct mlx5_core_dev *dev) - attr.net = mlx5_core_net(dev); - devcom = mlx5_devcom_register_component(dev->priv.devc, MLX5_DEVCOM_SD_GROUP, - &attr, NULL, dev); -- if (IS_ERR(devcom)) -- return PTR_ERR(devcom); -+ if (!devcom) -+ return -EINVAL; - - sd->devcom = devcom; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 77f587f97a2d..81930a461e62 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -978,9 +978,8 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - int err; - - dev->priv.devc = mlx5_devcom_register_device(dev); -- if (IS_ERR(dev->priv.devc)) -- mlx5_core_warn(dev, "failed to register devcom device %pe\n", -- dev->priv.devc); -+ if (!dev->priv.devc) -+ mlx5_core_warn(dev, "failed to register devcom device\n"); - - err = mlx5_query_board_id(dev); - if (err) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1580-net-mlx5-fix-ipsec-cleanup-over-mpv-device.patch b/SOURCES/1580-net-mlx5-fix-ipsec-cleanup-over-mpv-device.patch deleted file mode 100644 index 8e937283c..000000000 --- a/SOURCES/1580-net-mlx5-fix-ipsec-cleanup-over-mpv-device.patch +++ /dev/null @@ -1,201 +0,0 @@ -From 62aa720413bd9440055eeee9a13abe6090797204 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:33 -0400 -Subject: [PATCH] net/mlx5: Fix IPsec cleanup over MPV device - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 664f76be38a18c61151d0ef248c7e2f3afb4f3c7 -Author: Patrisious Haddad -Date: Wed Oct 22 15:29:42 2025 +0300 - - net/mlx5: Fix IPsec cleanup over MPV device - - When we do mlx5e_detach_netdev() we eventually disable blocking events - notifier, among those events are IPsec MPV events from IB to core. - - So before disabling those blocking events, make sure to also unregister - the devcom device and mark all this device operations as complete, - in order to prevent the other device from using invalid netdev - during future devcom events which could cause the trace below. - - BUG: kernel NULL pointer dereference, address: 0000000000000010 - PGD 146427067 P4D 146427067 PUD 146488067 PMD 0 - Oops: Oops: 0000 [#1] SMP - CPU: 1 UID: 0 PID: 7735 Comm: devlink Tainted: GW 6.12.0-rc6_for_upstream_min_debug_2024_11_08_00_46 #1 - Tainted: [W]=WARN - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 - RIP: 0010:mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] - Code: 00 01 48 83 05 23 32 1e 00 01 41 b8 ed ff ff ff e9 60 ff ff ff 48 83 05 00 32 1e 00 01 eb e3 66 0f 1f 44 00 00 0f 1f 44 00 00 <48> 8b 47 10 48 83 05 5f 32 1e 00 01 48 8b 50 40 48 85 d2 74 05 40 - RSP: 0018:ffff88811a5c35f8 EFLAGS: 00010206 - RAX: ffff888106e8ab80 RBX: ffff888107d7e200 RCX: ffff88810d6f0a00 - RDX: ffff88810d6f0a00 RSI: 0000000000000001 RDI: 0000000000000000 - RBP: ffff88811a17e620 R08: 0000000000000040 R09: 0000000000000000 - R10: ffff88811a5c3618 R11: 0000000de85d51bd R12: ffff88811a17e600 - R13: ffff88810d6f0a00 R14: 0000000000000000 R15: ffff8881034bda80 - FS: 00007f27bdf89180(0000) GS:ffff88852c880000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000010 CR3: 000000010f159005 CR4: 0000000000372eb0 - DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 - DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 - Call Trace: - - ? __die+0x20/0x60 - ? page_fault_oops+0x150/0x3e0 - ? exc_page_fault+0x74/0x130 - ? asm_exc_page_fault+0x22/0x30 - ? mlx5_devcom_comp_set_ready+0x5/0x40 [mlx5_core] - mlx5e_devcom_event_mpv+0x42/0x60 [mlx5_core] - mlx5_devcom_send_event+0x8c/0x170 [mlx5_core] - blocking_event+0x17b/0x230 [mlx5_core] - notifier_call_chain+0x35/0xa0 - blocking_notifier_call_chain+0x3d/0x60 - mlx5_blocking_notifier_call_chain+0x22/0x30 [mlx5_core] - mlx5_core_mp_event_replay+0x12/0x20 [mlx5_core] - mlx5_ib_bind_slave_port+0x228/0x2c0 [mlx5_ib] - mlx5_ib_stage_init_init+0x664/0x9d0 [mlx5_ib] - ? idr_alloc_cyclic+0x50/0xb0 - ? __kmalloc_cache_noprof+0x167/0x340 - ? __kmalloc_noprof+0x1a7/0x430 - __mlx5_ib_add+0x34/0xd0 [mlx5_ib] - mlx5r_probe+0xe9/0x310 [mlx5_ib] - ? kernfs_add_one+0x107/0x150 - ? __mlx5_ib_add+0xd0/0xd0 [mlx5_ib] - auxiliary_bus_probe+0x3e/0x90 - really_probe+0xc5/0x3a0 - ? driver_probe_device+0x90/0x90 - __driver_probe_device+0x80/0x160 - driver_probe_device+0x1e/0x90 - __device_attach_driver+0x7d/0x100 - bus_for_each_drv+0x80/0xd0 - __device_attach+0xbc/0x1f0 - bus_probe_device+0x86/0xa0 - device_add+0x62d/0x830 - __auxiliary_device_add+0x3b/0xa0 - ? auxiliary_device_init+0x41/0x90 - add_adev+0xd1/0x150 [mlx5_core] - mlx5_rescan_drivers_locked+0x21c/0x300 [mlx5_core] - esw_mode_change+0x6c/0xc0 [mlx5_core] - mlx5_devlink_eswitch_mode_set+0x21e/0x640 [mlx5_core] - devlink_nl_eswitch_set_doit+0x60/0xe0 - genl_family_rcv_msg_doit+0xd0/0x120 - genl_rcv_msg+0x180/0x2b0 - ? devlink_get_from_attrs_lock+0x170/0x170 - ? devlink_nl_eswitch_get_doit+0x290/0x290 - ? devlink_nl_pre_doit_port_optional+0x50/0x50 - ? genl_family_rcv_msg_dumpit+0xf0/0xf0 - netlink_rcv_skb+0x54/0x100 - genl_rcv+0x24/0x40 - netlink_unicast+0x1fc/0x2d0 - netlink_sendmsg+0x1e4/0x410 - __sock_sendmsg+0x38/0x60 - ? sockfd_lookup_light+0x12/0x60 - __sys_sendto+0x105/0x160 - ? __sys_recvmsg+0x4e/0x90 - __x64_sys_sendto+0x20/0x30 - do_syscall_64+0x4c/0x100 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - RIP: 0033:0x7f27bc91b13a - Code: bb 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 8b 05 fa 96 2c 00 45 89 c9 4c 63 d1 48 63 ff 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 76 f3 c3 0f 1f 40 00 41 55 41 54 4d 89 c5 55 - RSP: 002b:00007fff369557e8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c - RAX: ffffffffffffffda RBX: 0000000009c54b10 RCX: 00007f27bc91b13a - RDX: 0000000000000038 RSI: 0000000009c54b10 RDI: 0000000000000006 - RBP: 0000000009c54920 R08: 00007f27bd0030e0 R09: 000000000000000c - R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 - R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 - - Modules linked in: mlx5_vdpa vringh vhost_iotlb vdpa xt_MASQUERADE nf_conntrack_netlink nfnetlink iptable_nat xt_addrtype xt_conntrack nf_nat br_netfilter rpcsec_gss_krb5 auth_rpcgss oid_registry overlay rpcrdma rdma_ucm ib_iser libiscsi ib_umad scsi_transport_iscsi ib_ipoib rdma_cm iw_cm ib_cm mlx5_fwctl mlx5_ib ib_uverbs ib_core mlx5_core - CR2: 0000000000000010 - - Fixes: 82f9378c443c ("net/mlx5: Handle IPsec steering upon master unbind/bind") - Signed-off-by: Patrisious Haddad - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761136182-918470-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -index 5d7c15abfcaf..f8eaaf37963b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.h -@@ -342,6 +342,7 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, - void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, - struct mlx5e_priv *master_priv); - void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event); -+void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv); - - static inline struct mlx5_core_dev * - mlx5e_ipsec_sa2dev(struct mlx5e_ipsec_sa_entry *sa_entry) -@@ -387,6 +388,10 @@ static inline void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *sl - static inline void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event) - { - } -+ -+static inline void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv) -+{ -+} - #endif - - #endif /* __MLX5E_IPSEC_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index bf1d2769d4f1..feef86fff4bf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -2893,9 +2893,30 @@ void mlx5e_ipsec_handle_mpv_event(int event, struct mlx5e_priv *slave_priv, - - void mlx5e_ipsec_send_event(struct mlx5e_priv *priv, int event) - { -- if (!priv->ipsec) -- return; /* IPsec not supported */ -+ if (!priv->ipsec || mlx5_devcom_comp_get_size(priv->devcom) < 2) -+ return; /* IPsec not supported or no peers */ - - mlx5_devcom_send_event(priv->devcom, event, event, priv); - wait_for_completion(&priv->ipsec->comp); - } -+ -+void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv) -+{ -+ struct mlx5_devcom_comp_dev *tmp = NULL; -+ struct mlx5e_priv *peer_priv; -+ -+ if (!priv->devcom) -+ return; -+ -+ if (!mlx5_devcom_for_each_peer_begin(priv->devcom)) -+ goto out; -+ -+ peer_priv = mlx5_devcom_get_next_peer_data(priv->devcom, &tmp); -+ if (peer_priv) -+ complete_all(&peer_priv->ipsec->comp); -+ -+ mlx5_devcom_for_each_peer_end(priv->devcom); -+out: -+ mlx5_devcom_unregister_component(priv->devcom); -+ priv->devcom = NULL; -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 7ab4fb83dff2..31a6bfe1ce11 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -265,6 +265,7 @@ static void mlx5e_devcom_cleanup_mpv(struct mlx5e_priv *priv) - } - - mlx5_devcom_unregister_component(priv->devcom); -+ priv->devcom = NULL; - } - - static int blocking_event(struct notifier_block *nb, unsigned long event, void *data) -@@ -6069,6 +6070,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv) - if (mlx5e_monitor_counter_supported(priv)) - mlx5e_monitor_counter_cleanup(priv); - -+ mlx5e_ipsec_disable_events(priv); - mlx5e_disable_blocking_events(priv); - if (priv->en_trap) { - mlx5e_deactivate_trap(priv); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1581-net-mlx5-don-t-zero-user-count-when-destroying-fdb-tables.patch b/SOURCES/1581-net-mlx5-don-t-zero-user-count-when-destroying-fdb-tables.patch deleted file mode 100644 index 4dae81030..000000000 --- a/SOURCES/1581-net-mlx5-don-t-zero-user-count-when-destroying-fdb-tables.patch +++ /dev/null @@ -1,82 +0,0 @@ -From abfe0d534a4b347055a3e0b2169f2f58b304857d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:24:33 -0400 -Subject: [PATCH] net/mlx5: Don't zero user_count when destroying FDB tables - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 53110232c95ff56067fd96c75a1a1c53d10dcd98 -Author: Cosmin Ratiu -Date: Sun Oct 26 22:20:19 2025 +0200 - - net/mlx5: Don't zero user_count when destroying FDB tables - - esw->user_count tracks how many TC rules are added on an esw via - mlx5e_configure_flower -> mlx5_esw_get -> atomic64_inc(&esw->user_count) - - esw.user_count was unconditionally set to 0 in - esw_destroy_legacy_fdb_table and esw_destroy_offloads_fdb_tables. - - These two together can lead to the following sequence of events: - 1. echo 1 > /sys/class/net/eth2/device/sriov_numvfs - - mlx5_core_sriov_configure -...-> esw_create_legacy_table -> - atomic64_set(&esw->user_count, 0) - 2. tc qdisc add dev eth2 ingress && \ - tc filter replace dev eth2 pref 1 protocol ip chain 0 ingress \ - handle 1 flower action ct nat zone 64000 pipe - - mlx5e_configure_flower -> mlx5_esw_get -> - atomic64_inc(&esw->user_count) - 3. echo 0 > /sys/class/net/eth2/device/sriov_numvfs - - mlx5_core_sriov_configure -..-> esw_destroy_legacy_fdb_table - -> atomic64_set(&esw->user_count, 0) - 4. devlink dev eswitch set pci/0000:08:00.0 mode switchdev - - mlx5_devlink_eswitch_mode_set -> mlx5_esw_try_lock -> - atomic64_read(&esw->user_count) == 0 - - then proceed to a WARN_ON in: - esw_offloads_start -> mlx5_eswitch_enable_locke -> esw_offloads_enable - -> mlx5_esw_offloads_rep_load -> mlx5e_vport_rep_load -> - mlx5e_netdev_change_profile -> mlx5e_detach_netdev -> - mlx5e_cleanup_nic_rx -> mlx5e_tc_nic_cleanup -> - mlx5e_mod_hdr_tbl_destroy - - Fix this by not clearing out the user_count when destroying FDB tables, - so that the check in mlx5_esw_try_lock can prevent the mode change when - there are TC rules configured, as originally intended. - - Fixes: 2318b8bb94a3 ("net/mlx5: E-switch, Destroy legacy fdb table when needed") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761510019-938772-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -index 76382626ad41..929adeb50a98 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/legacy.c -@@ -66,7 +66,6 @@ static void esw_destroy_legacy_fdb_table(struct mlx5_eswitch *esw) - esw->fdb_table.legacy.addr_grp = NULL; - esw->fdb_table.legacy.allmulti_grp = NULL; - esw->fdb_table.legacy.promisc_grp = NULL; -- atomic64_set(&esw->user_count, 0); - } - - static int esw_create_legacy_fdb_table(struct mlx5_eswitch *esw) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 34749814f19b..44a142a041b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1978,7 +1978,6 @@ static void esw_destroy_offloads_fdb_tables(struct mlx5_eswitch *esw) - /* Holds true only as long as DMFS is the default */ - mlx5_flow_namespace_set_mode(esw->fdb_table.offloads.ns, - MLX5_FLOW_STEERING_MODE_DMFS); -- atomic64_set(&esw->user_count, 0); - } - - static int esw_get_nr_ft_offloads_steering_src_ports(struct mlx5_eswitch *esw) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1582-net-mlx5e-fix-return-value-in-case-of-module-eeprom-read-err.patch b/SOURCES/1582-net-mlx5e-fix-return-value-in-case-of-module-eeprom-read-err.patch deleted file mode 100644 index 4bf5d762e..000000000 --- a/SOURCES/1582-net-mlx5e-fix-return-value-in-case-of-module-eeprom-read-err.patch +++ /dev/null @@ -1,77 +0,0 @@ -From a073cd50ef8f5289370d350c9cd61907e6d330c5 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:28:57 -0400 -Subject: [PATCH] net/mlx5e: Fix return value in case of module EEPROM read - error - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d1c94bc5b90c21b65469d30d4a6bc8ed715c1bfe -Author: Gal Pressman -Date: Tue Nov 4 16:15:36 2025 +0200 - - net/mlx5e: Fix return value in case of module EEPROM read error - - mlx5e_get_module_eeprom_by_page() has weird error handling. - - First, it is treating -EINVAL as a special case, but it is unclear why. - - Second, it tries to fail "gracefully" by returning the number of bytes - read even in case of an error. This results in wrongly returning - success (0 return value) if the error occurs before any bytes were - read. - - Simplify the error handling by returning an error when such occurs. This - also aligns with the error handling we have in mlx5e_get_module_eeprom() - for the old API. - - This fixes the following case where the query fails, but userspace - ethtool wrongly treats it as success and dumps an output: - - # ethtool -m eth2 - netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 - netlink warning: mlx5_core: Query module eeprom by page failed, read 0 bytes, err -5 - Offset Values - ------ ------ - 0x0000: 00 00 00 00 05 00 04 00 00 00 00 00 05 00 05 00 - 0x0010: 00 00 00 00 05 00 06 00 50 00 00 00 67 65 20 66 - 0x0020: 61 69 6c 65 64 2c 20 72 65 61 64 20 30 20 62 79 - 0x0030: 74 65 73 2c 20 65 72 72 20 2d 35 00 14 00 03 00 - 0x0040: 08 00 01 00 03 00 00 00 08 00 02 00 1a 00 00 00 - 0x0050: 14 00 04 00 08 00 01 00 04 00 00 00 08 00 02 00 - 0x0060: 0e 00 00 00 14 00 05 00 08 00 01 00 05 00 00 00 - 0x0070: 08 00 02 00 1a 00 00 00 14 00 06 00 08 00 01 00 - - Fixes: e109d2b204da ("net/mlx5: Implement get_module_eeprom_by_page()") - Signed-off-by: Gal Pressman - Reviewed-by: Alex Lazar - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1762265736-1028868-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 64f315089b04..e7c9f22ac1fc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -2124,14 +2124,12 @@ static int mlx5e_get_module_eeprom_by_page(struct net_device *netdev, - if (!size_read) - return i; - -- if (size_read == -EINVAL) -- return -EINVAL; - if (size_read < 0) { - NL_SET_ERR_MSG_FMT_MOD( - extack, - "Query module eeprom by page failed, read %u bytes, err %d", - i, size_read); -- return i; -+ return size_read; - } - - i += size_read; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1583-net-mlx5e-fix-missing-error-assignment-in-mlx5e-xfrm-add-sta.patch b/SOURCES/1583-net-mlx5e-fix-missing-error-assignment-in-mlx5e-xfrm-add-sta.patch deleted file mode 100644 index 37a17fecb..000000000 --- a/SOURCES/1583-net-mlx5e-fix-missing-error-assignment-in-mlx5e-xfrm-add-sta.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 925dc73091f0cfe33befd0576b2855ddefa9d335 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] net/mlx5e: Fix missing error assignment in - mlx5e_xfrm_add_state() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 0bcd5b3b50cc1fcbf775479322cc37c15d35a489 -Author: Carolina Jubran -Date: Sun Nov 9 11:37:49 2025 +0200 - - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() - - Assign the return value of mlx5_eswitch_block_mode() to 'err' before - checking it to avoid returning an uninitialized error code. - - Fixes: 22239eb258bc ("net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed") - Reported-by: kernel test robot - Reported-by: Dan Carpenter - Closes: https://lore.kernel.org/r/202510271649.uwsIxD6O-lkp@intel.com/ - Closes: http://lore.kernel.org/linux-rdma/aPIEK4rLB586FdDt@stanley.mountain/ - Signed-off-by: Carolina Jubran - Reviewed-by: Jianbo Liu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762681073-1084058-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 0a4fb8c92268..35d9530037a6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -804,7 +804,8 @@ static int mlx5e_xfrm_add_state(struct net_device *dev, - goto err_xfrm; - } - -- if (mlx5_eswitch_block_mode(priv->mdev)) -+ err = mlx5_eswitch_block_mode(priv->mdev); -+ if (err) - goto unblock_ipsec; - - if (x->props.mode == XFRM_MODE_TUNNEL && --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1584-net-mlx5e-trim-the-length-of-the-num-doorbell-error.patch b/SOURCES/1584-net-mlx5e-trim-the-length-of-the-num-doorbell-error.patch deleted file mode 100644 index 3f43e4681..000000000 --- a/SOURCES/1584-net-mlx5e-trim-the-length-of-the-num-doorbell-error.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 8ced9f3ff009ffbdb00178a66be008cdddf28a96 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] net/mlx5e: Trim the length of the num_doorbell error - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2dc768c05217e667f987907a3404926e7ba89ff3 -Author: Cosmin Ratiu -Date: Sun Nov 9 11:37:50 2025 +0200 - - net/mlx5e: Trim the length of the num_doorbell error - - When trying to set num_doorbells to a value greater than the max number - of channels, the error message was going over the netlink limit of 80 - chars, truncating the most important part of the message, the number of - channels. - - Fix that by trimming the length a bit. - - Fixes: 11bbcfb7668c ("net/mlx5e: Use the 'num_doorbells' devlink param") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762681073-1084058-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index e8ce011f2464..c204c707b850 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -541,7 +541,7 @@ static int mlx5_devlink_num_doorbells_validate(struct devlink *devlink, u32 id, - max_num_channels = mlx5e_get_max_num_channels(mdev); - if (val32 > max_num_channels) { - NL_SET_ERR_MSG_FMT_MOD(extack, -- "Requested num_doorbells (%u) exceeds maximum number of channels (%u)", -+ "Requested num_doorbells (%u) exceeds max number of channels (%u)", - val32, max_num_channels); - return -EINVAL; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1585-net-mlx5e-fix-maxrate-wraparound-in-threshold-between-units.patch b/SOURCES/1585-net-mlx5e-fix-maxrate-wraparound-in-threshold-between-units.patch deleted file mode 100644 index 4a4184880..000000000 --- a/SOURCES/1585-net-mlx5e-fix-maxrate-wraparound-in-threshold-between-units.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 717d4f3fa629f184f2a41c67ab587bb4a2f241e0 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] net/mlx5e: Fix maxrate wraparound in threshold between units - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a7bf4d5063c7837096aab2853224eb23628514d9 -Author: Gal Pressman -Date: Sun Nov 9 11:37:51 2025 +0200 - - net/mlx5e: Fix maxrate wraparound in threshold between units - - The previous calculation used roundup() which caused an overflow for - rates between 25.5Gbps and 26Gbps. - For example, a rate of 25.6Gbps would result in using 100Mbps units with - value of 256, which would overflow the 8 bits field. - - Simplify the upper_limit_mbps calculation by removing the - unnecessary roundup, and adjust the comparison to use <= to correctly - handle the boundary condition. - - Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index b08328fe1aa3..99ee288ed43a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -595,18 +595,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - u8 max_bw_value[IEEE_8021QAZ_MAX_TCS]; - u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS]; -- __u64 upper_limit_mbps = roundup(255 * MLX5E_100MB, MLX5E_1GB); -+ __u64 upper_limit_mbps; - int i; - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -+ upper_limit_mbps = 255 * MLX5E_100MB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - if (!maxrate->tc_maxrate[i]) { - max_bw_unit[i] = MLX5_BW_NO_LIMIT; - continue; - } -- if (maxrate->tc_maxrate[i] < upper_limit_mbps) { -+ if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1586-net-mlx5e-fix-wraparound-in-rate-limiting-for-values-above-2.patch b/SOURCES/1586-net-mlx5e-fix-wraparound-in-rate-limiting-for-values-above-2.patch deleted file mode 100644 index 49fbba447..000000000 --- a/SOURCES/1586-net-mlx5e-fix-wraparound-in-rate-limiting-for-values-above-2.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 30e8fa6185cde17f7dff2fbfa16760aa3ea8df3a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] net/mlx5e: Fix wraparound in rate limiting for values above - 255 Gbps - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e -Author: Gal Pressman -Date: Sun Nov 9 11:37:52 2025 +0200 - - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps - - Add validation to reject rates exceeding 255 Gbps that would overflow - the 8 bits max bandwidth field. - - Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate") - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 99ee288ed43a..154f8d9eec02 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -596,11 +596,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - u8 max_bw_value[IEEE_8021QAZ_MAX_TCS]; - u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS]; - __u64 upper_limit_mbps; -+ __u64 upper_limit_gbps; - int i; - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); - upper_limit_mbps = 255 * MLX5E_100MB; -+ upper_limit_gbps = 255 * MLX5E_1GB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - if (!maxrate->tc_maxrate[i]) { -@@ -612,10 +614,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; - max_bw_unit[i] = MLX5_100_MBPS_UNIT; -- } else { -+ } else if (max_bw_value[i] <= upper_limit_gbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_1GB); - max_bw_unit[i] = MLX5_GBPS_UNIT; -+ } else { -+ netdev_err(netdev, -+ "tc_%d maxrate %llu Kbps exceeds limit %llu\n", -+ i, maxrate->tc_maxrate[i], -+ upper_limit_gbps); -+ return -EINVAL; - } - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1587-net-mlx5e-fix-potentially-misleading-debug-message.patch b/SOURCES/1587-net-mlx5e-fix-potentially-misleading-debug-message.patch deleted file mode 100644 index 33eb5415d..000000000 --- a/SOURCES/1587-net-mlx5e-fix-potentially-misleading-debug-message.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 59df4ad4169a55ed4d0febf33d6fc026517e9c7e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] net/mlx5e: Fix potentially misleading debug message - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9fcc2b6c10523f7e75db6387946c86fcf19dc97e -Author: Gal Pressman -Date: Sun Nov 9 11:37:53 2025 +0200 - - net/mlx5e: Fix potentially misleading debug message - - Change the debug message to print the correct units instead of always - assuming Gbps, as the value can be in either 100 Mbps or 1 Gbps units. - - Fixes: 5da8bc3effb6 ("net/mlx5e: DCBNL, Add debug messages log") - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762681073-1084058-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 154f8d9eec02..2ca32fb1961e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -598,6 +598,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - __u64 upper_limit_mbps; - __u64 upper_limit_gbps; - int i; -+ struct { -+ int scale; -+ const char *units_str; -+ } units[] = { -+ [MLX5_100_MBPS_UNIT] = { -+ .scale = 100, -+ .units_str = "Mbps", -+ }, -+ [MLX5_GBPS_UNIT] = { -+ .scale = 1, -+ .units_str = "Gbps", -+ }, -+ }; - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -@@ -628,8 +641,9 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - } - - for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { -- netdev_dbg(netdev, "%s: tc_%d <=> max_bw %d Gbps\n", -- __func__, i, max_bw_value[i]); -+ netdev_dbg(netdev, "%s: tc_%d <=> max_bw %u %s\n", __func__, i, -+ max_bw_value[i] * units[max_bw_unit[i]].scale, -+ units[max_bw_unit[i]].units_str); - } - - return mlx5_modify_port_ets_rate_limit(mdev, max_bw_value, max_bw_unit); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1588-mlx5-fix-default-values-in-create-cq.patch b/SOURCES/1588-mlx5-fix-default-values-in-create-cq.patch deleted file mode 100644 index 138fa7f86..000000000 --- a/SOURCES/1588-mlx5-fix-default-values-in-create-cq.patch +++ /dev/null @@ -1,298 +0,0 @@ -From 7b0831b2d1ad91773665acd7e75272bd0e67e27c Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:41 -0400 -Subject: [PATCH] mlx5: Fix default values in create CQ - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e5eba42f01340f73888dfe560be2806057c25913 -Author: Akiva Goldberger -Date: Sun Nov 9 11:49:03 2025 +0200 - - mlx5: Fix default values in create CQ - - Currently, CQs without a completion function are assigned the - mlx5_add_cq_to_tasklet function by default. This is problematic since - only user CQs created through the mlx5_ib driver are intended to use - this function. - - Additionally, all CQs that will use doorbells instead of polling for - completions must call mlx5_cq_arm. However, the default CQ creation flow - leaves a valid value in the CQ's arm_db field, allowing FW to send - interrupts to polling-only CQs in certain corner cases. - - These two factors would allow a polling-only kernel CQ to be triggered - by an EQ interrupt and call a completion function intended only for user - CQs, causing a null pointer exception. - - Some areas in the driver have prevented this issue with one-off fixes - but did not address the root cause. - - This patch fixes the described issue by adding defaults to the create CQ - flow. It adds a default dummy completion function to protect against - null pointer exceptions, and it sets an invalid command sequence number - by default in kernel CQs to prevent the FW from sending an interrupt to - the CQ until it is armed. User CQs are responsible for their own - initialization values. - - Callers of mlx5_core_create_cq are responsible for changing the - completion function and arming the CQ per their needs. - - Fixes: cdd04f4d4d71 ("net/mlx5: Add support to create SQ and CQ for ASO") - Signed-off-by: Akiva Goldberger - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Acked-by: Leon Romanovsky - Link: https://patch.msgid.link/1762681743-1084694-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c -index f23eb22e98ff..aa11a4b5a264 100644 ---- a/drivers/infiniband/hw/mlx5/cq.c -+++ b/drivers/infiniband/hw/mlx5/cq.c -@@ -1017,15 +1017,18 @@ int mlx5_ib_create_cq(struct ib_cq *ibcq, const struct ib_cq_init_attr *attr, - if (cq->create_flags & IB_UVERBS_CQ_FLAGS_IGNORE_OVERRUN) - MLX5_SET(cqc, cqc, oi, 1); - -+ if (udata) { -+ cq->mcq.comp = mlx5_add_cq_to_tasklet; -+ cq->mcq.tasklet_ctx.comp = mlx5_ib_cq_comp; -+ } else { -+ cq->mcq.comp = mlx5_ib_cq_comp; -+ } -+ - err = mlx5_core_create_cq(dev->mdev, &cq->mcq, cqb, inlen, out, sizeof(out)); - if (err) - goto err_cqb; - - mlx5_ib_dbg(dev, "cqn 0x%x\n", cq->mcq.cqn); -- if (udata) -- cq->mcq.tasklet_ctx.comp = mlx5_ib_cq_comp; -- else -- cq->mcq.comp = mlx5_ib_cq_comp; - cq->mcq.event = mlx5_ib_cq_event; - - INIT_LIST_HEAD(&cq->wc_list); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cq.c b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -index e9f319a9bdd6..60f7ab1d72e7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cq.c -@@ -66,8 +66,8 @@ void mlx5_cq_tasklet_cb(struct tasklet_struct *t) - tasklet_schedule(&ctx->task); - } - --static void mlx5_add_cq_to_tasklet(struct mlx5_core_cq *cq, -- struct mlx5_eqe *eqe) -+void mlx5_add_cq_to_tasklet(struct mlx5_core_cq *cq, -+ struct mlx5_eqe *eqe) - { - unsigned long flags; - struct mlx5_eq_tasklet *tasklet_ctx = cq->tasklet_ctx.priv; -@@ -95,7 +95,15 @@ static void mlx5_add_cq_to_tasklet(struct mlx5_core_cq *cq, - if (schedule_tasklet) - tasklet_schedule(&tasklet_ctx->task); - } -+EXPORT_SYMBOL(mlx5_add_cq_to_tasklet); - -+static void mlx5_core_cq_dummy_cb(struct mlx5_core_cq *cq, struct mlx5_eqe *eqe) -+{ -+ mlx5_core_err(cq->eq->core.dev, -+ "CQ default completion callback, CQ #%u\n", cq->cqn); -+} -+ -+#define MLX5_CQ_INIT_CMD_SN cpu_to_be32(2 << 28) - /* Callers must verify outbox status in case of err */ - int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, - u32 *in, int inlen, u32 *out, int outlen) -@@ -121,10 +129,19 @@ int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, - cq->arm_sn = 0; - cq->eq = eq; - cq->uid = MLX5_GET(create_cq_in, in, uid); -+ -+ /* Kernel CQs must set the arm_db address prior to calling -+ * this function, allowing for the proper value to be -+ * initialized. User CQs are responsible for their own -+ * initialization since they do not use the arm_db field. -+ */ -+ if (cq->arm_db) -+ *cq->arm_db = MLX5_CQ_INIT_CMD_SN; -+ - refcount_set(&cq->refcount, 1); - init_completion(&cq->free); - if (!cq->comp) -- cq->comp = mlx5_add_cq_to_tasklet; -+ cq->comp = mlx5_core_cq_dummy_cb; - /* assuming CQ will be deleted before the EQ */ - cq->tasklet_ctx.priv = &eq->tasklet_ctx; - INIT_LIST_HEAD(&cq->tasklet_ctx.list); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 31a6bfe1ce11..ef655b8abc96 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2191,7 +2191,6 @@ static int mlx5e_alloc_cq_common(struct mlx5_core_dev *mdev, - mcq->set_ci_db = cq->wq_ctrl.db.db; - mcq->arm_db = cq->wq_ctrl.db.db + 1; - *mcq->set_ci_db = 0; -- *mcq->arm_db = 0; - mcq->vector = param->eq_ix; - mcq->comp = mlx5e_completion_event; - mcq->event = mlx5e_cq_error_event; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -index cb1319974f83..ccef64fb40b6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/conn.c -@@ -421,6 +421,13 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) - __be64 *pas; - u32 i; - -+ conn->cq.mcq.cqe_sz = 64; -+ conn->cq.mcq.set_ci_db = conn->cq.wq_ctrl.db.db; -+ conn->cq.mcq.arm_db = conn->cq.wq_ctrl.db.db + 1; -+ *conn->cq.mcq.set_ci_db = 0; -+ conn->cq.mcq.vector = 0; -+ conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete; -+ - cq_size = roundup_pow_of_two(cq_size); - MLX5_SET(cqc, temp_cqc, log_cq_size, ilog2(cq_size)); - -@@ -468,15 +475,7 @@ static int mlx5_fpga_conn_create_cq(struct mlx5_fpga_conn *conn, int cq_size) - if (err) - goto err_cqwq; - -- conn->cq.mcq.cqe_sz = 64; -- conn->cq.mcq.set_ci_db = conn->cq.wq_ctrl.db.db; -- conn->cq.mcq.arm_db = conn->cq.wq_ctrl.db.db + 1; -- *conn->cq.mcq.set_ci_db = 0; -- *conn->cq.mcq.arm_db = 0; -- conn->cq.mcq.vector = 0; -- conn->cq.mcq.comp = mlx5_fpga_conn_cq_complete; - tasklet_setup(&conn->cq.tasklet, mlx5_fpga_conn_cq_tasklet); -- - mlx5_fpga_dbg(fdev, "Created CQ #0x%x\n", conn->cq.mcq.cqn); - - goto out; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -index 24ef7d66fa8a..7510c46e58a5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/send.c -@@ -873,12 +873,6 @@ static int hws_send_ring_open_sq(struct mlx5hws_context *ctx, - return err; - } - --static void hws_cq_complete(struct mlx5_core_cq *mcq, -- struct mlx5_eqe *eqe) --{ -- pr_err("CQ completion CQ: #%u\n", mcq->cqn); --} -- - static int hws_send_ring_alloc_cq(struct mlx5_core_dev *mdev, - int numa_node, - struct mlx5hws_send_engine *queue, -@@ -901,7 +895,6 @@ static int hws_send_ring_alloc_cq(struct mlx5_core_dev *mdev, - mcq->cqe_sz = 64; - mcq->set_ci_db = cq->wq_ctrl.db.db; - mcq->arm_db = cq->wq_ctrl.db.db + 1; -- mcq->comp = hws_cq_complete; - - for (i = 0; i < mlx5_cqwq_get_size(&cq->wq); i++) { - cqe = mlx5_cqwq_get_wqe(&cq->wq, i); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -index 077a77fde670..d034372fa047 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_send.c -@@ -1049,12 +1049,6 @@ static int dr_prepare_qp_to_rts(struct mlx5dr_domain *dmn) - return 0; - } - --static void dr_cq_complete(struct mlx5_core_cq *mcq, -- struct mlx5_eqe *eqe) --{ -- pr_err("CQ completion CQ: #%u\n", mcq->cqn); --} -- - static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - struct mlx5_uars_page *uar, - size_t ncqe) -@@ -1089,6 +1083,13 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - cqe->op_own = MLX5_CQE_INVALID << 4 | MLX5_CQE_OWNER_MASK; - } - -+ cq->mcq.cqe_sz = 64; -+ cq->mcq.set_ci_db = cq->wq_ctrl.db.db; -+ cq->mcq.arm_db = cq->wq_ctrl.db.db + 1; -+ *cq->mcq.set_ci_db = 0; -+ cq->mcq.vector = 0; -+ cq->mdev = mdev; -+ - inlen = MLX5_ST_SZ_BYTES(create_cq_in) + - sizeof(u64) * cq->wq_ctrl.buf.npages; - in = kvzalloc(inlen, GFP_KERNEL); -@@ -1112,27 +1113,12 @@ static struct mlx5dr_cq *dr_create_cq(struct mlx5_core_dev *mdev, - pas = (__be64 *)MLX5_ADDR_OF(create_cq_in, in, pas); - mlx5_fill_page_frag_array(&cq->wq_ctrl.buf, pas); - -- cq->mcq.comp = dr_cq_complete; -- - err = mlx5_core_create_cq(mdev, &cq->mcq, in, inlen, out, sizeof(out)); - kvfree(in); - - if (err) - goto err_cqwq; - -- cq->mcq.cqe_sz = 64; -- cq->mcq.set_ci_db = cq->wq_ctrl.db.db; -- cq->mcq.arm_db = cq->wq_ctrl.db.db + 1; -- *cq->mcq.set_ci_db = 0; -- -- /* set no-zero value, in order to avoid the HW to run db-recovery on -- * CQ that used in polling mode. -- */ -- *cq->mcq.arm_db = cpu_to_be32(2 << 28); -- -- cq->mcq.vector = 0; -- cq->mdev = mdev; -- - return cq; - - err_cqwq: -diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5_vnet.c -index 7ea46522f230..3c05407449c5 100644 ---- a/drivers/vdpa/mlx5/net/mlx5_vnet.c -+++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c -@@ -552,6 +552,8 @@ static int cq_create(struct mlx5_vdpa_net *ndev, u16 idx, u32 num_ent) - vcq->mcq.set_ci_db = vcq->db.db; - vcq->mcq.arm_db = vcq->db.db + 1; - vcq->mcq.cqe_sz = 64; -+ vcq->mcq.comp = mlx5_vdpa_cq_comp; -+ vcq->cqe = num_ent; - - err = cq_frag_buf_alloc(ndev, &vcq->buf, num_ent); - if (err) -@@ -591,10 +593,6 @@ static int cq_create(struct mlx5_vdpa_net *ndev, u16 idx, u32 num_ent) - if (err) - goto err_vec; - -- vcq->mcq.comp = mlx5_vdpa_cq_comp; -- vcq->cqe = num_ent; -- vcq->mcq.set_ci_db = vcq->db.db; -- vcq->mcq.arm_db = vcq->db.db + 1; - mlx5_cq_arm(&mvq->cq.mcq, MLX5_CQ_DB_REQ_NOT, uar_page, mvq->cq.mcq.cons_index); - kfree(in); - return 0; -diff --git a/include/linux/mlx5/cq.h b/include/linux/mlx5/cq.h -index 7ef2c7c7d803..9d47cdc727ad 100644 ---- a/include/linux/mlx5/cq.h -+++ b/include/linux/mlx5/cq.h -@@ -183,6 +183,7 @@ static inline void mlx5_cq_put(struct mlx5_core_cq *cq) - complete(&cq->free); - } - -+void mlx5_add_cq_to_tasklet(struct mlx5_core_cq *cq, struct mlx5_eqe *eqe); - int mlx5_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, - u32 *in, int inlen, u32 *out, int outlen); - int mlx5_core_create_cq(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1589-net-mlx5-clean-up-only-new-irq-glue-on-request-irq-failure.patch b/SOURCES/1589-net-mlx5-clean-up-only-new-irq-glue-on-request-irq-failure.patch deleted file mode 100644 index aa0030ee6..000000000 --- a/SOURCES/1589-net-mlx5-clean-up-only-new-irq-glue-on-request-irq-failure.patch +++ /dev/null @@ -1,163 +0,0 @@ -From b851610ef6ad88f1cdcb487ae25be1fe0781f904 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:42 -0400 -Subject: [PATCH] net/mlx5: Clean up only new IRQ glue on request_irq() failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d47515af6cccd7484d8b0870376858c9848a18ec -Author: Pradyumn Rahar -Date: Mon Nov 17 14:16:08 2025 +0200 - - net/mlx5: Clean up only new IRQ glue on request_irq() failure - - The mlx5_irq_alloc() function can inadvertently free the entire rmap - and end up in a crash[1] when the other threads tries to access this, - when request_irq() fails due to exhausted IRQ vectors. This commit - modifies the cleanup to remove only the specific IRQ mapping that was - just added. - - This prevents removal of other valid mappings and ensures precise - cleanup of the failed IRQ allocation's associated glue object. - - Note: This error is observed when both fwctl and rds configs are enabled. - - [1] - mlx5_core 0000:05:00.0: Successfully registered panic handler for port 1 - mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to - request irq. err = -28 - infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while - trying to test write-combining support - mlx5_core 0000:05:00.0: Successfully unregistered panic handler for port 1 - mlx5_core 0000:06:00.0: Successfully registered panic handler for port 1 - mlx5_core 0000:06:00.0: mlx5_irq_alloc:293:(pid 66740): Failed to - request irq. err = -28 - infiniband mlx5_0: mlx5_ib_test_wc:290:(pid 66740): Error -28 while - trying to test write-combining support - mlx5_core 0000:06:00.0: Successfully unregistered panic handler for port 1 - mlx5_core 0000:03:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to - request irq. err = -28 - mlx5_core 0000:05:00.0: mlx5_irq_alloc:293:(pid 28895): Failed to - request irq. err = -28 - general protection fault, probably for non-canonical address - 0xe277a58fde16f291: 0000 [#1] SMP NOPTI - - RIP: 0010:free_irq_cpu_rmap+0x23/0x7d - Call Trace: - - ? show_trace_log_lvl+0x1d6/0x2f9 - ? show_trace_log_lvl+0x1d6/0x2f9 - ? mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] - ? __die_body.cold+0x8/0xa - ? die_addr+0x39/0x53 - ? exc_general_protection+0x1c4/0x3e9 - ? dev_vprintk_emit+0x5f/0x90 - ? asm_exc_general_protection+0x22/0x27 - ? free_irq_cpu_rmap+0x23/0x7d - mlx5_irq_alloc.cold+0x5d/0xf3 [mlx5_core] - irq_pool_request_vector+0x7d/0x90 [mlx5_core] - mlx5_irq_request+0x2e/0xe0 [mlx5_core] - mlx5_irq_request_vector+0xad/0xf7 [mlx5_core] - comp_irq_request_pci+0x64/0xf0 [mlx5_core] - create_comp_eq+0x71/0x385 [mlx5_core] - ? mlx5e_open_xdpsq+0x11c/0x230 [mlx5_core] - mlx5_comp_eqn_get+0x72/0x90 [mlx5_core] - ? xas_load+0x8/0x91 - mlx5_comp_irqn_get+0x40/0x90 [mlx5_core] - mlx5e_open_channel+0x7d/0x3c7 [mlx5_core] - mlx5e_open_channels+0xad/0x250 [mlx5_core] - mlx5e_open_locked+0x3e/0x110 [mlx5_core] - mlx5e_open+0x23/0x70 [mlx5_core] - __dev_open+0xf1/0x1a5 - __dev_change_flags+0x1e1/0x249 - dev_change_flags+0x21/0x5c - do_setlink+0x28b/0xcc4 - ? __nla_parse+0x22/0x3d - ? inet6_validate_link_af+0x6b/0x108 - ? cpumask_next+0x1f/0x35 - ? __snmp6_fill_stats64.constprop.0+0x66/0x107 - ? __nla_validate_parse+0x48/0x1e6 - __rtnl_newlink+0x5ff/0xa57 - ? kmem_cache_alloc_trace+0x164/0x2ce - rtnl_newlink+0x44/0x6e - rtnetlink_rcv_msg+0x2bb/0x362 - ? __netlink_sendskb+0x4c/0x6c - ? netlink_unicast+0x28f/0x2ce - ? rtnl_calcit.isra.0+0x150/0x146 - netlink_rcv_skb+0x5f/0x112 - netlink_unicast+0x213/0x2ce - netlink_sendmsg+0x24f/0x4d9 - __sock_sendmsg+0x65/0x6a - ____sys_sendmsg+0x28f/0x2c9 - ? import_iovec+0x17/0x2b - ___sys_sendmsg+0x97/0xe0 - __sys_sendmsg+0x81/0xd8 - do_syscall_64+0x35/0x87 - entry_SYSCALL_64_after_hwframe+0x6e/0x0 - RIP: 0033:0x7fc328603727 - Code: c3 66 90 41 54 41 89 d4 55 48 89 f5 53 89 fb 48 83 ec 10 e8 0b ed - ff ff 44 89 e2 48 89 ee 89 df 41 89 c0 b8 2e 00 00 00 0f 05 <48> 3d 00 - f0 ff ff 77 35 44 89 c7 48 89 44 24 08 e8 44 ed ff ff 48 - RSP: 002b:00007ffe8eb3f1a0 EFLAGS: 00000293 ORIG_RAX: 000000000000002e - RAX: ffffffffffffffda RBX: 000000000000000d RCX: 00007fc328603727 - RDX: 0000000000000000 RSI: 00007ffe8eb3f1f0 RDI: 000000000000000d - RBP: 00007ffe8eb3f1f0 R08: 0000000000000000 R09: 0000000000000000 - R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 - R13: 0000000000000000 R14: 00007ffe8eb3f3c8 R15: 00007ffe8eb3f3bc - - ---[ end trace f43ce73c3c2b13a2 ]--- - RIP: 0010:free_irq_cpu_rmap+0x23/0x7d - Code: 0f 1f 80 00 00 00 00 48 85 ff 74 6b 55 48 89 fd 53 66 83 7f 06 00 - 74 24 31 db 48 8b 55 08 0f b7 c3 48 8b 04 c2 48 85 c0 74 09 <8b> 38 31 - f6 e8 c4 0a b8 ff 83 c3 01 66 3b 5d 06 72 de b8 ff ff ff - RSP: 0018:ff384881640eaca0 EFLAGS: 00010282 - RAX: e277a58fde16f291 RBX: 0000000000000000 RCX: 0000000000000000 - RDX: ff2335e2e20b3600 RSI: 0000000000000000 RDI: ff2335e2e20b3400 - RBP: ff2335e2e20b3400 R08: 0000000000000000 R09: 0000000000000000 - R10: 0000000000000000 R11: 00000000ffffffe4 R12: ff384881640ead88 - R13: ff2335c3760751e0 R14: ff2335e2e1672200 R15: ff2335c3760751f8 - FS: 00007fc32ac22480(0000) GS:ff2335e2d6e00000(0000) - knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 00007f651ab54000 CR3: 00000029f1206003 CR4: 0000000000771ef0 - DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 - DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 - PKRU: 55555554 - Kernel panic - not syncing: Fatal exception - Kernel Offset: 0x1dc00000 from 0xffffffff81000000 (relocation range: - 0xffffffff80000000-0xffffffffbfffffff) - kvm-guest: disable async PF for cpu 0 - - Fixes: 3354822cde5a ("net/mlx5: Use dynamic msix vectors allocation") - Signed-off-by: Mohith Kumar Thummaluru - Tested-by: Mohith Kumar Thummaluru - Reviewed-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Pradyumn Rahar - Reviewed-by: Jacob Keller - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763381768-1234998-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -index e18a850c615c..aa3b5878e3da 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/pci_irq.c -@@ -324,10 +324,8 @@ struct mlx5_irq *mlx5_irq_alloc(struct mlx5_irq_pool *pool, int i, - free_irq(irq->map.virq, &irq->nh); - err_req_irq: - #ifdef CONFIG_RFS_ACCEL -- if (i && rmap && *rmap) { -- free_irq_cpu_rmap(*rmap); -- *rmap = NULL; -- } -+ if (i && rmap && *rmap) -+ irq_cpu_rmap_remove(*rmap, irq->map.virq); - err_irq_rmap: - #endif - if (i && pci_msix_can_alloc_dyn(dev->pdev)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1590-net-mlx5e-fix-validation-logic-in-rate-limiting.patch b/SOURCES/1590-net-mlx5e-fix-validation-logic-in-rate-limiting.patch deleted file mode 100644 index eb60ddc1b..000000000 --- a/SOURCES/1590-net-mlx5e-fix-validation-logic-in-rate-limiting.patch +++ /dev/null @@ -1,65 +0,0 @@ -From 8fc5ca59970d1e8eb7a933ce6cb9a0afbecea0dc Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Sun, 19 Apr 2026 18:32:42 -0400 -Subject: [PATCH] net/mlx5e: Fix validation logic in rate limiting - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 -Author: Danielle Costantino -Date: Mon Nov 24 10:00:43 2025 -0800 - - net/mlx5e: Fix validation logic in rate limiting - - The rate limiting validation condition currently checks the output - variable max_bw_value[i] instead of the input value - maxrate->tc_maxrate[i]. This causes the validation to compare an - uninitialized or stale value rather than the actual requested rate. - - The condition should check the input rate to properly validate against - the upper limit: - - } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { - - This aligns with the pattern used in the first branch, which correctly - checks maxrate->tc_maxrate[i] against upper_limit_mbps. - - The current implementation can lead to unreliable validation behavior: - - - For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0 - from initialization, the GBPS path may be taken regardless of whether - the actual rate is within bounds - - - When processing multiple TCs (i > 0), max_bw_value[i] contains the - value computed for the previous TC, affecting the validation logic - - - The overflow check for rates exceeding 255 Gbps may not trigger - consistently depending on previous array values - - This patch ensures the validation correctly examines the requested rate - value for proper bounds checking. - - Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps") - Signed-off-by: Danielle Costantino - Reviewed-by: Gal Pressman - Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 2ca32fb1961e..84e700777941 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -627,7 +627,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; - max_bw_unit[i] = MLX5_100_MBPS_UNIT; -- } else if (max_bw_value[i] <= upper_limit_gbps) { -+ } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_1GB); - max_bw_unit[i] = MLX5_GBPS_UNIT; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1591-rdma-mlx5-enable-data-direct-with-relaxed-ordering.patch b/SOURCES/1591-rdma-mlx5-enable-data-direct-with-relaxed-ordering.patch deleted file mode 100644 index af60de7c6..000000000 --- a/SOURCES/1591-rdma-mlx5-enable-data-direct-with-relaxed-ordering.patch +++ /dev/null @@ -1,141 +0,0 @@ -From 29e117eff6eab97cde39f2c88548de7ab7371d22 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:51:52 -0400 -Subject: [PATCH] RDMA/mlx5: Enable Data-Direct with Relaxed Ordering - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d9e6e85b7beb2aeb8defac2f705b23532ddb25d4 -Author: Yishai Hadas -Date: Wed Aug 13 15:36:01 2025 +0300 - - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering - - Relaxed Ordering can improve performance in certain scenarios. - - Enable it in the Data-Direct use case as well. - - Link: https://patch.msgid.link/r/1221dcdda8061ba5f6bc3519044083c7438b257e.1755088503.git.leon@kernel.org - Signed-off-by: Yishai Hadas - Reviewed-by: Gal Shalom - Signed-off-by: Leon Romanovsky - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 08e4e6d85f7b..63f3ba258b18 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -3118,6 +3118,7 @@ mlx5_ib_create_data_direct_resources(struct mlx5_ib_dev *dev) - { - int inlen = MLX5_ST_SZ_BYTES(create_mkey_in); - struct mlx5_core_dev *mdev = dev->mdev; -+ bool ro_supp = false; - void *mkc; - u32 mkey; - u32 pdn; -@@ -3146,14 +3147,37 @@ mlx5_ib_create_data_direct_resources(struct mlx5_ib_dev *dev) - MLX5_SET(mkc, mkc, length64, 1); - MLX5_SET(mkc, mkc, qpn, 0xffffff); - err = mlx5_core_create_mkey(mdev, &mkey, in, inlen); -- kvfree(in); - if (err) -- goto err; -+ goto err_mkey; - - dev->ddr.mkey = mkey; - dev->ddr.pdn = pdn; -+ -+ /* create another mkey with RO support */ -+ if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_write)) { -+ MLX5_SET(mkc, mkc, relaxed_ordering_write, 1); -+ ro_supp = true; -+ } -+ -+ if (MLX5_CAP_GEN(dev->mdev, relaxed_ordering_read)) { -+ MLX5_SET(mkc, mkc, relaxed_ordering_read, 1); -+ ro_supp = true; -+ } -+ -+ if (ro_supp) { -+ err = mlx5_core_create_mkey(mdev, &mkey, in, inlen); -+ /* RO is defined as best effort */ -+ if (!err) { -+ dev->ddr.mkey_ro = mkey; -+ dev->ddr.mkey_ro_valid = true; -+ } -+ } -+ -+ kvfree(in); - return 0; - -+err_mkey: -+ kvfree(in); - err: - mlx5_core_dealloc_pd(mdev, pdn); - return err; -@@ -3162,6 +3186,10 @@ mlx5_ib_create_data_direct_resources(struct mlx5_ib_dev *dev) - static void - mlx5_ib_free_data_direct_resources(struct mlx5_ib_dev *dev) - { -+ -+ if (dev->ddr.mkey_ro_valid) -+ mlx5_core_destroy_mkey(dev->mdev, dev->ddr.mkey_ro); -+ - mlx5_core_destroy_mkey(dev->mdev, dev->ddr.mkey); - mlx5_core_dealloc_pd(dev->mdev, dev->ddr.pdn); - } -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 1b646761d5d5..6ffa394c2e6d 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -850,6 +850,8 @@ struct mlx5_ib_port_resources { - struct mlx5_data_direct_resources { - u32 pdn; - u32 mkey; -+ u32 mkey_ro; -+ u8 mkey_ro_valid :1; - }; - - struct mlx5_ib_resources { -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index 1317f2cb38a4..d3c82ffa300e 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -1717,11 +1717,11 @@ reg_user_mr_dmabuf_by_data_direct(struct ib_pd *pd, u64 offset, - goto end; - } - -- /* The device's 'data direct mkey' was created without RO flags to -- * simplify things and allow for a single mkey per device. -- * Since RO is not a must, mask it out accordingly. -+ /* If no device's 'data direct mkey' with RO flags exists -+ * mask it out accordingly. - */ -- access_flags &= ~IB_ACCESS_RELAXED_ORDERING; -+ if (!dev->ddr.mkey_ro_valid) -+ access_flags &= ~IB_ACCESS_RELAXED_ORDERING; - crossed_mr = reg_user_mr_dmabuf(pd, &data_direct_dev->pdev->dev, - offset, length, virt_addr, fd, - access_flags, MLX5_MKC_ACCESS_MODE_KSM, -diff --git a/drivers/infiniband/hw/mlx5/umr.c b/drivers/infiniband/hw/mlx5/umr.c -index 7ef35cddce81..4e562e0dd9e1 100644 ---- a/drivers/infiniband/hw/mlx5/umr.c -+++ b/drivers/infiniband/hw/mlx5/umr.c -@@ -761,7 +761,11 @@ _mlx5r_umr_update_mr_pas(struct mlx5_ib_mr *mr, unsigned int flags, bool dd, - - if (dd) { - cur_ksm->va = cpu_to_be64(rdma_block_iter_dma_address(&biter)); -- cur_ksm->key = cpu_to_be32(dev->ddr.mkey); -+ if (mr->access_flags & IB_ACCESS_RELAXED_ORDERING && -+ dev->ddr.mkey_ro_valid) -+ cur_ksm->key = cpu_to_be32(dev->ddr.mkey_ro); -+ else -+ cur_ksm->key = cpu_to_be32(dev->ddr.mkey); - if (mr->umem->is_dmabuf && - (flags & MLX5_IB_UPD_XLT_ZAP)) { - cur_ksm->va = 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1592-rdma-mlx5-better-estimate-max-qp-wr-to-reflect-wqe-count.patch b/SOURCES/1592-rdma-mlx5-better-estimate-max-qp-wr-to-reflect-wqe-count.patch deleted file mode 100644 index adc4c98fe..000000000 --- a/SOURCES/1592-rdma-mlx5-better-estimate-max-qp-wr-to-reflect-wqe-count.patch +++ /dev/null @@ -1,117 +0,0 @@ -From 27bb9e5c42866bd69208589cc7b070c2abfd980f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:51:52 -0400 -Subject: [PATCH] RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1a7c18c485bf17ef408d5ebb7f83e1f8ef329585 -Author: Or Har-Toov -Date: Wed Aug 13 15:39:56 2025 +0300 - - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count - - The mlx5 driver currently derives max_qp_wr directly from the - log_max_qp_sz HCA capability: - - props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); - - However, this value represents the number of WQEs in units of Basic - Blocks (see MLX5_SEND_WQE_BB), not actual number of WQEs. Since the size - of a WQE can vary depending on transport type and features (e.g., atomic - operations, UMR, LSO), the actual number of WQEs can be significantly - smaller than the WQEBB count suggests. - - This patch introduces a conservative estimation of the worst-case WQE size - — considering largest segments possible with 1 SGE and no inline data or - special features. It uses this to derive a more accurate max_qp_wr value. - - Fixes: 938fe83c8dcb ("net/mlx5_core: New device capabilities handling") - Link: https://patch.msgid.link/r/7d992c9831c997ed5c33d30973406dc2dcaf5e89.1755088725.git.leon@kernel.org - Reported-by: Chuck Lever - Closes: https://lore.kernel.org/all/20250506142202.GJ2260621@ziepe.ca/ - Signed-off-by: Or Har-Toov - Signed-off-by: Leon Romanovsky - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 63f3ba258b18..671f03876f18 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -13,6 +13,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -883,6 +884,51 @@ static void fill_esw_mgr_reg_c0(struct mlx5_core_dev *mdev, - resp->reg_c0.mask = mlx5_eswitch_get_vport_metadata_mask(); - } - -+/* -+ * Calculate maximum SQ overhead across all QP types. -+ * Other QP types (REG_UMR, UC, RC, UD/SMI/GSI, XRC_TGT) -+ * have smaller overhead than the types calculated below, -+ * so they are implicitly included. -+ */ -+static u32 mlx5_ib_calc_max_sq_overhead(void) -+{ -+ u32 max_overhead_xrc, overhead_ud_lso, a, b; -+ -+ /* XRC_INI */ -+ max_overhead_xrc = sizeof(struct mlx5_wqe_xrc_seg); -+ max_overhead_xrc += sizeof(struct mlx5_wqe_ctrl_seg); -+ a = sizeof(struct mlx5_wqe_atomic_seg) + -+ sizeof(struct mlx5_wqe_raddr_seg); -+ b = sizeof(struct mlx5_wqe_umr_ctrl_seg) + -+ sizeof(struct mlx5_mkey_seg) + -+ MLX5_IB_SQ_UMR_INLINE_THRESHOLD / MLX5_IB_UMR_OCTOWORD; -+ max_overhead_xrc += max(a, b); -+ -+ /* UD with LSO */ -+ overhead_ud_lso = sizeof(struct mlx5_wqe_ctrl_seg); -+ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_pad); -+ overhead_ud_lso += sizeof(struct mlx5_wqe_eth_seg); -+ overhead_ud_lso += sizeof(struct mlx5_wqe_datagram_seg); -+ -+ return max(max_overhead_xrc, overhead_ud_lso); -+} -+ -+static u32 mlx5_ib_calc_max_qp_wr(struct mlx5_ib_dev *dev) -+{ -+ struct mlx5_core_dev *mdev = dev->mdev; -+ u32 max_wqe_bb_units = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); -+ u32 max_wqe_size; -+ /* max QP overhead + 1 SGE, no inline, no special features */ -+ max_wqe_size = mlx5_ib_calc_max_sq_overhead() + -+ sizeof(struct mlx5_wqe_data_seg); -+ -+ max_wqe_size = roundup_pow_of_two(max_wqe_size); -+ -+ max_wqe_size = ALIGN(max_wqe_size, MLX5_SEND_WQE_BB); -+ -+ return (max_wqe_bb_units * MLX5_SEND_WQE_BB) / max_wqe_size; -+} -+ - static int mlx5_ib_query_device(struct ib_device *ibdev, - struct ib_device_attr *props, - struct ib_udata *uhw) -@@ -1041,7 +1087,7 @@ static int mlx5_ib_query_device(struct ib_device *ibdev, - props->max_mr_size = ~0ull; - props->page_size_cap = ~(min_page_size - 1); - props->max_qp = 1 << MLX5_CAP_GEN(mdev, log_max_qp); -- props->max_qp_wr = 1 << MLX5_CAP_GEN(mdev, log_max_qp_sz); -+ props->max_qp_wr = mlx5_ib_calc_max_qp_wr(dev); - max_rq_sg = MLX5_CAP_GEN(mdev, max_wqe_sz_rq) / - sizeof(struct mlx5_wqe_data_seg); - max_sq_desc = min_t(int, MLX5_CAP_GEN(mdev, max_wqe_sz_sq), 512); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1593-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch b/SOURCES/1593-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch deleted file mode 100644 index 885b3db45..000000000 --- a/SOURCES/1593-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch +++ /dev/null @@ -1,118 +0,0 @@ -From 1a67b8f97f52293f23a8836ed94bb75832c95245 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:51:52 -0400 -Subject: [PATCH] RDMA/mlx5: Fix vport loopback forcing for MPV device - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 08aae7860450c89eebbc6fd4d38416e53c7a33d2 -Author: Patrisious Haddad -Date: Wed Aug 13 15:41:19 2025 +0300 - - RDMA/mlx5: Fix vport loopback forcing for MPV device - - Previously loopback for MPV was supposed to be permanently enabled, - however other driver flows were able to over-ride that configuration and - disable it. - - Add force_lb parameter that indicates that loopback should always be - enabled which prevents all other driver flows from disabling it. - - Fixes: a9a9e68954f2 ("RDMA/mlx5: Fix vport loopback for MPV device") - Link: https://patch.msgid.link/r/cfc6b1f0f99f8100b087483cc14da6025317f901.1755088808.git.leon@kernel.org - Signed-off-by: Patrisious Haddad - Reviewed-by: Mark Bloch - Signed-off-by: Leon Romanovsky - Signed-off-by: Jason Gunthorpe - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 671f03876f18..e9bcd93517a9 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -1839,7 +1839,8 @@ static void deallocate_uars(struct mlx5_ib_dev *dev, - } - - static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, -- struct mlx5_core_dev *slave) -+ struct mlx5_core_dev *slave, -+ struct mlx5_ib_lb_state *lb_state) - { - int err; - -@@ -1851,6 +1852,7 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, - if (err) - goto out; - -+ lb_state->force_enable = true; - return 0; - - out: -@@ -1859,16 +1861,22 @@ static int mlx5_ib_enable_lb_mp(struct mlx5_core_dev *master, - } - - static void mlx5_ib_disable_lb_mp(struct mlx5_core_dev *master, -- struct mlx5_core_dev *slave) -+ struct mlx5_core_dev *slave, -+ struct mlx5_ib_lb_state *lb_state) - { - mlx5_nic_vport_update_local_lb(slave, false); - mlx5_nic_vport_update_local_lb(master, false); -+ -+ lb_state->force_enable = false; - } - - int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { - int err = 0; - -+ if (dev->lb.force_enable) -+ return 0; -+ - mutex_lock(&dev->lb.mutex); - if (td) - dev->lb.user_td++; -@@ -1890,6 +1898,9 @@ int mlx5_ib_enable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - - void mlx5_ib_disable_lb(struct mlx5_ib_dev *dev, bool td, bool qp) - { -+ if (dev->lb.force_enable) -+ return; -+ - mutex_lock(&dev->lb.mutex); - if (td) - dev->lb.user_td--; -@@ -3597,7 +3608,7 @@ static void mlx5_ib_unbind_slave_port(struct mlx5_ib_dev *ibdev, - - lockdep_assert_held(&mlx5_ib_multiport_mutex); - -- mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev); -+ mlx5_ib_disable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); - - mlx5_core_mp_event_replay(ibdev->mdev, - MLX5_DRIVER_EVENT_AFFILIATION_REMOVED, -@@ -3694,7 +3705,7 @@ static bool mlx5_ib_bind_slave_port(struct mlx5_ib_dev *ibdev, - MLX5_DRIVER_EVENT_AFFILIATION_DONE, - &key); - -- err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev); -+ err = mlx5_ib_enable_lb_mp(ibdev->mdev, mpi->mdev, &ibdev->lb); - if (err) - goto unbind; - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 6ffa394c2e6d..4c15e8d4488f 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1107,6 +1107,7 @@ struct mlx5_ib_lb_state { - u32 user_td; - int qps; - bool enabled; -+ bool force_enable; - }; - - struct mlx5_ib_pf_eq { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1594-rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-mode.patch b/SOURCES/1594-rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-mode.patch deleted file mode 100644 index 9f8b136ed..000000000 --- a/SOURCES/1594-rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-mode.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 383138b02e58ab08c149df8a1d6447113b9a015b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:51:53 -0400 -Subject: [PATCH] RDMA/mlx5: Fix page size bitmap calculation for KSM mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 372fdb5c75b61f038f4abf596abdcf01acbdb7af -Author: Edward Srouji -Date: Sun Aug 24 17:48:39 2025 +0300 - - RDMA/mlx5: Fix page size bitmap calculation for KSM mode - - When using KSM (Key Scatter-gather Memory) access mode, the HW requires - the IOVA to be aligned to the selected page size. - Without this alignment, the HW may not function correctly. - - Currently, mlx5_umem_mkc_find_best_pgsz() does not filter out page sizes - that would result in misaligned IOVAs for KSM mode. This can lead to - selecting page sizes that are incompatible with the given IOVA. - - Fix this by filtering the page size bitmap when in KSM mode, keeping - only page sizes to which the IOVA is aligned to. - - Fixes: fcfb03597b7d ("RDMA/mlx5: Align mkc page size capability check to PRM") - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20250824144839.154717-1-edwards@nvidia.com - Reviewed-by: Michael Guralnik - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/mlx5_ib.h b/drivers/infiniband/hw/mlx5/mlx5_ib.h -index 4c15e8d4488f..b20d3e5efd9e 100644 ---- a/drivers/infiniband/hw/mlx5/mlx5_ib.h -+++ b/drivers/infiniband/hw/mlx5/mlx5_ib.h -@@ -1801,6 +1801,10 @@ mlx5_umem_mkc_find_best_pgsz(struct mlx5_ib_dev *dev, struct ib_umem *umem, - - bitmap = GENMASK_ULL(max_log_entity_size_cap, min_log_entity_size_cap); - -+ /* In KSM mode HW requires IOVA and mkey's page size to be aligned */ -+ if (access_mode == MLX5_MKC_ACCESS_MODE_KSM && iova) -+ bitmap &= GENMASK_ULL(__ffs64(iova), 0); -+ - return ib_umem_find_best_pgsz(umem, bitmap, iova); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1595-rdma-use-pe-format-specifier-for-error-pointers.patch b/SOURCES/1595-rdma-use-pe-format-specifier-for-error-pointers.patch deleted file mode 100644 index ef978005d..000000000 --- a/SOURCES/1595-rdma-use-pe-format-specifier-for-error-pointers.patch +++ /dev/null @@ -1,140 +0,0 @@ -From 959cd78d8f953ff0e1cf6ee8f5b1746cfb9dd8a7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:52:28 -0400 -Subject: [PATCH] RDMA: Use %pe format specifier for error pointers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Include only the mlx5 hunks. - -commit 4b6b6233f50f72353b54295ba594990b19f33223 -Author: Leon Romanovsky -Date: Thu Sep 18 20:53:41 2025 +0300 - - RDMA: Use %pe format specifier for error pointers - - Convert error logging throughout the RDMA subsystem to use - the %pe format specifier instead of PTR_ERR() with integer - format specifiers. - - Link: https://patch.msgid.link/e81ec02df1e474be20417fb62e779776e3f47a50.1758217936.git.leon@kernel.org - Reviewed-by: Zhu Yanjun - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/data_direct.c b/drivers/infiniband/hw/mlx5/data_direct.c -index b9ba84afaae2..b81ac5709b56 100644 ---- a/drivers/infiniband/hw/mlx5/data_direct.c -+++ b/drivers/infiniband/hw/mlx5/data_direct.c -@@ -35,7 +35,7 @@ static int mlx5_data_direct_vpd_get_vuid(struct mlx5_data_direct_dev *dev) - - vpd_data = pci_vpd_alloc(pdev, &vpd_size); - if (IS_ERR(vpd_data)) { -- pci_err(pdev, "Unable to read VPD, err=%ld\n", PTR_ERR(vpd_data)); -+ pci_err(pdev, "Unable to read VPD, err=%pe\n", vpd_data); - return PTR_ERR(vpd_data); - } - -diff --git a/drivers/infiniband/hw/mlx5/gsi.c b/drivers/infiniband/hw/mlx5/gsi.c -index b804f2dd5628..d5487834ed25 100644 ---- a/drivers/infiniband/hw/mlx5/gsi.c -+++ b/drivers/infiniband/hw/mlx5/gsi.c -@@ -131,8 +131,9 @@ int mlx5_ib_create_gsi(struct ib_pd *pd, struct mlx5_ib_qp *mqp, - gsi->cq = ib_alloc_cq(pd->device, gsi, attr->cap.max_send_wr, 0, - IB_POLL_SOFTIRQ); - if (IS_ERR(gsi->cq)) { -- mlx5_ib_warn(dev, "unable to create send CQ for GSI QP. error %ld\n", -- PTR_ERR(gsi->cq)); -+ mlx5_ib_warn(dev, -+ "unable to create send CQ for GSI QP. error %pe\n", -+ gsi->cq); - ret = PTR_ERR(gsi->cq); - goto err_free_wrs; - } -@@ -147,8 +148,9 @@ int mlx5_ib_create_gsi(struct ib_pd *pd, struct mlx5_ib_qp *mqp, - - gsi->rx_qp = ib_create_qp(pd, &hw_init_attr); - if (IS_ERR(gsi->rx_qp)) { -- mlx5_ib_warn(dev, "unable to create hardware GSI QP. error %ld\n", -- PTR_ERR(gsi->rx_qp)); -+ mlx5_ib_warn(dev, -+ "unable to create hardware GSI QP. error %pe\n", -+ gsi->rx_qp); - ret = PTR_ERR(gsi->rx_qp); - goto err_destroy_cq; - } -@@ -294,8 +296,9 @@ static void setup_qp(struct mlx5_ib_gsi_qp *gsi, u16 qp_index) - - qp = create_gsi_ud_qp(gsi); - if (IS_ERR(qp)) { -- mlx5_ib_warn(dev, "unable to create hardware UD QP for GSI: %ld\n", -- PTR_ERR(qp)); -+ mlx5_ib_warn(dev, -+ "unable to create hardware UD QP for GSI: %pe\n", -+ qp); - return; - } - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index e9bcd93517a9..8f2c6e84127f 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -3051,14 +3051,16 @@ int mlx5_ib_dev_res_cq_init(struct mlx5_ib_dev *dev) - pd = ib_alloc_pd(ibdev, 0); - if (IS_ERR(pd)) { - ret = PTR_ERR(pd); -- mlx5_ib_err(dev, "Couldn't allocate PD for res init, err=%d\n", ret); -+ mlx5_ib_err(dev, "Couldn't allocate PD for res init, err=%pe\n", -+ pd); - goto unlock; - } - - cq = ib_create_cq(ibdev, NULL, NULL, NULL, &cq_attr); - if (IS_ERR(cq)) { - ret = PTR_ERR(cq); -- mlx5_ib_err(dev, "Couldn't create CQ for res init, err=%d\n", ret); -+ mlx5_ib_err(dev, "Couldn't create CQ for res init, err=%pe\n", -+ cq); - ib_dealloc_pd(pd); - goto unlock; - } -@@ -3102,7 +3104,9 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) - s0 = ib_create_srq(devr->p0, &attr); - if (IS_ERR(s0)) { - ret = PTR_ERR(s0); -- mlx5_ib_err(dev, "Couldn't create SRQ 0 for res init, err=%d\n", ret); -+ mlx5_ib_err(dev, -+ "Couldn't create SRQ 0 for res init, err=%pe\n", -+ s0); - goto unlock; - } - -@@ -3114,7 +3118,9 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) - s1 = ib_create_srq(devr->p0, &attr); - if (IS_ERR(s1)) { - ret = PTR_ERR(s1); -- mlx5_ib_err(dev, "Couldn't create SRQ 1 for res init, err=%d\n", ret); -+ mlx5_ib_err(dev, -+ "Couldn't create SRQ 1 for res init, err=%pe\n", -+ s1); - ib_destroy_srq(s0); - } - -diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c -index d3c82ffa300e..325fa04cbe8a 100644 ---- a/drivers/infiniband/hw/mlx5/mr.c -+++ b/drivers/infiniband/hw/mlx5/mr.c -@@ -1652,8 +1652,7 @@ reg_user_mr_dmabuf(struct ib_pd *pd, struct device *dma_device, - fd, access_flags); - - if (IS_ERR(umem_dmabuf)) { -- mlx5_ib_dbg(dev, "umem_dmabuf get failed (%ld)\n", -- PTR_ERR(umem_dmabuf)); -+ mlx5_ib_dbg(dev, "umem_dmabuf get failed (%pe)\n", umem_dmabuf); - return ERR_CAST(umem_dmabuf); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1596-rdma-net-mlx5-query-vports-mac-address-from-device.patch b/SOURCES/1596-rdma-net-mlx5-query-vports-mac-address-from-device.patch deleted file mode 100644 index 1ffa89202..000000000 --- a/SOURCES/1596-rdma-net-mlx5-query-vports-mac-address-from-device.patch +++ /dev/null @@ -1,223 +0,0 @@ -From 1411ab84153ec7c4943797b252cea03fbcbcd772 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:33 -0400 -Subject: [PATCH] {rdma,net}/mlx5: Query vports mac address from device - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit eea31f21dce10814e34dc7ef7ed5136269c7bb59 -Author: Adithya Jayachandran -Date: Wed Oct 15 18:40:55 2025 -0700 - - {rdma,net}/mlx5: Query vports mac address from device - - Before this patch during either switchdev or legacy mode enablement we - cleared the mac address of vports between changes. This change allows us - to preserve the vports mac address between eswitch mode changes. - - Vports hold information for VFs/SFs such as the permanent mac address. - VF/SF mac can be set either by iproute vf interface or devlink function - interface. For no obvious reason we reset it to 0 on switchdev/legacy - mode changes, this patch is fixing that, to align with other vport - information that are never reset, e.g GUID,mtu,promisc mode, etc .. - - Signed-off-by: Adithya Jayachandran - Signed-off-by: Saeed Mahameed - Reviewed-by: Mark Bloch - Acked-by: Leon Romanovsky # RDMA - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 8f2c6e84127f..dc2c5cc47860 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -842,7 +842,7 @@ static int mlx5_query_node_guid(struct mlx5_ib_dev *dev, - break; - - case MLX5_VPORT_ACCESS_METHOD_NIC: -- err = mlx5_query_nic_vport_node_guid(dev->mdev, &tmp); -+ err = mlx5_query_nic_vport_node_guid(dev->mdev, 0, false, &tmp); - break; - - default: -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index e2ffb87b94cb..25af8bd7f077 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -875,13 +875,10 @@ static int esw_vport_setup(struct mlx5_eswitch *esw, struct mlx5_vport *vport) - vport_num, 1, - vport->info.link_state); - -- /* Host PF has its own mac/guid. */ -- if (vport_num) { -- mlx5_modify_nic_vport_mac_address(esw->dev, vport_num, -- vport->info.mac); -- mlx5_modify_nic_vport_node_guid(esw->dev, vport_num, -- vport->info.node_guid); -- } -+ mlx5_query_nic_vport_mac_address(esw->dev, vport_num, true, -+ vport->info.mac); -+ mlx5_query_nic_vport_node_guid(esw->dev, vport_num, true, -+ &vport->info.node_guid); - - flags = (vport->info.vlan || vport->info.qos) ? - SET_VLAN_STRIP | SET_VLAN_INSERT : 0; -@@ -947,12 +944,6 @@ int mlx5_esw_vport_enable(struct mlx5_eswitch *esw, struct mlx5_vport *vport, - goto err_vhca_mapping; - } - -- /* External controller host PF has factory programmed MAC. -- * Read it from the device. -- */ -- if (mlx5_core_is_ecpf(esw->dev) && vport_num == MLX5_VPORT_PF) -- mlx5_query_nic_vport_mac_address(esw->dev, vport_num, true, vport->info.mac); -- - esw_vport_change_handle_locked(vport); - - esw->enabled_vports++; -@@ -2235,6 +2226,9 @@ int mlx5_eswitch_get_vport_config(struct mlx5_eswitch *esw, - ivi->vf = vport - 1; - - mutex_lock(&esw->state_lock); -+ -+ mlx5_query_nic_vport_mac_address(esw->dev, vport, true, -+ evport->info.mac); - ether_addr_copy(ivi->mac, evport->info.mac); - ivi->linkstate = evport->info.link_state; - ivi->vlan = evport->info.vlan; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 44a142a041b2..05270d5bc6df 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -4302,6 +4302,9 @@ int mlx5_devlink_port_fn_hw_addr_get(struct devlink_port *port, - struct mlx5_vport *vport = mlx5_devlink_port_vport_get(port); - - mutex_lock(&esw->state_lock); -+ -+ mlx5_query_nic_vport_mac_address(esw->dev, vport->vport, true, -+ vport->info.mac); - ether_addr_copy(hw_addr, vport->info.mac); - *hw_addr_len = ETH_ALEN; - mutex_unlock(&esw->state_lock); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index 2ed2e530b07d..d1483f66cd0c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -78,15 +78,14 @@ int mlx5_modify_vport_admin_state(struct mlx5_core_dev *mdev, u8 opmod, - } - - static int mlx5_query_nic_vport_context(struct mlx5_core_dev *mdev, u16 vport, -- u32 *out) -+ bool other_vport, u32 *out) - { - u32 in[MLX5_ST_SZ_DW(query_nic_vport_context_in)] = {}; - - MLX5_SET(query_nic_vport_context_in, in, opcode, - MLX5_CMD_OP_QUERY_NIC_VPORT_CONTEXT); - MLX5_SET(query_nic_vport_context_in, in, vport_number, vport); -- if (vport) -- MLX5_SET(query_nic_vport_context_in, in, other_vport, 1); -+ MLX5_SET(query_nic_vport_context_in, in, other_vport, other_vport); - - return mlx5_cmd_exec_inout(mdev, query_nic_vport_context, in, out); - } -@@ -97,7 +96,7 @@ int mlx5_query_nic_vport_min_inline(struct mlx5_core_dev *mdev, - u32 out[MLX5_ST_SZ_DW(query_nic_vport_context_out)] = {}; - int err; - -- err = mlx5_query_nic_vport_context(mdev, vport, out); -+ err = mlx5_query_nic_vport_context(mdev, vport, vport > 0, out); - if (!err) - *min_inline = MLX5_GET(query_nic_vport_context_out, out, - nic_vport_context.min_wqe_inline_mode); -@@ -219,7 +218,7 @@ int mlx5_query_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 *mtu) - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, false, out); - if (!err) - *mtu = MLX5_GET(query_nic_vport_context_out, out, - nic_vport_context.mtu); -@@ -429,7 +428,7 @@ int mlx5_query_nic_vport_system_image_guid(struct mlx5_core_dev *mdev, - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, false, out); - if (err) - goto out; - -@@ -451,7 +450,7 @@ int mlx5_query_nic_vport_sd_group(struct mlx5_core_dev *mdev, u8 *sd_group) - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, false, out); - if (err) - goto out; - -@@ -462,7 +461,8 @@ int mlx5_query_nic_vport_sd_group(struct mlx5_core_dev *mdev, u8 *sd_group) - return err; - } - --int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid) -+int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, -+ u16 vport, bool other_vport, u64 *node_guid) - { - u32 *out; - int outlen = MLX5_ST_SZ_BYTES(query_nic_vport_context_out); -@@ -472,7 +472,7 @@ int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid) - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, vport, other_vport, out); - if (err) - goto out; - -@@ -529,7 +529,7 @@ int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev, - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, false, out); - if (err) - goto out; - -@@ -804,7 +804,7 @@ int mlx5_query_nic_vport_promisc(struct mlx5_core_dev *mdev, - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, vport, out); -+ err = mlx5_query_nic_vport_context(mdev, vport, vport > 0, out); - if (err) - goto out; - -@@ -908,7 +908,7 @@ int mlx5_nic_vport_query_local_lb(struct mlx5_core_dev *mdev, bool *status) - if (!out) - return -ENOMEM; - -- err = mlx5_query_nic_vport_context(mdev, 0, out); -+ err = mlx5_query_nic_vport_context(mdev, 0, false, out); - if (err) - goto out; - -diff --git a/include/linux/mlx5/vport.h b/include/linux/mlx5/vport.h -index c87b9507cfa1..f876bfc0669c 100644 ---- a/include/linux/mlx5/vport.h -+++ b/include/linux/mlx5/vport.h -@@ -73,7 +73,8 @@ int mlx5_modify_nic_vport_mtu(struct mlx5_core_dev *mdev, u16 mtu); - int mlx5_query_nic_vport_system_image_guid(struct mlx5_core_dev *mdev, - u64 *system_image_guid); - int mlx5_query_nic_vport_sd_group(struct mlx5_core_dev *mdev, u8 *sd_group); --int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, u64 *node_guid); -+int mlx5_query_nic_vport_node_guid(struct mlx5_core_dev *mdev, -+ u16 vport, bool other_vport, u64 *node_guid); - int mlx5_modify_nic_vport_node_guid(struct mlx5_core_dev *mdev, - u16 vport, u64 node_guid); - int mlx5_query_nic_vport_qkey_viol_cntr(struct mlx5_core_dev *mdev, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1597-net-mlx5-use-common-mlx5-same-hw-devs-function.patch b/SOURCES/1597-net-mlx5-use-common-mlx5-same-hw-devs-function.patch deleted file mode 100644 index 20e5e4ac3..000000000 --- a/SOURCES/1597-net-mlx5-use-common-mlx5-same-hw-devs-function.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 0d9a9d2de5e05ddcfd2a420e7529e5eb93c4a905 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:33 -0400 -Subject: [PATCH] net/mlx5: Use common mlx5_same_hw_devs function - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 211de28b1caf51581ba5e0978e83213db4f488c6 -Author: Mark Bloch -Date: Thu Oct 23 12:16:56 2025 +0300 - - net/mlx5: Use common mlx5_same_hw_devs function - - Refactor duplicate hardware device comparison code to use the common - mlx5_same_hw_devs() function instead of reimplementing system GUID - comparison logic in multiple places. - - This cleanup eliminates code duplication in: - - Bridge representor device comparison. - - TC hardware device comparison. - - Using the centralized function improves maintainability and ensures - consistent behavior across the driver. - - Signed-off-by: Mark Bloch - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761211020-925651-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -index 9d1c677814e0..87a2ad69526d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rep/bridge.c -@@ -30,15 +30,11 @@ static bool mlx5_esw_bridge_dev_same_hw(struct net_device *dev, struct mlx5_eswi - { - struct mlx5e_priv *priv = netdev_priv(dev); - struct mlx5_core_dev *mdev, *esw_mdev; -- u64 system_guid, esw_system_guid; - - mdev = priv->mdev; - esw_mdev = esw->dev; - -- system_guid = mlx5_query_nic_system_image_guid(mdev); -- esw_system_guid = mlx5_query_nic_system_image_guid(esw_mdev); -- -- return system_guid == esw_system_guid; -+ return mlx5_same_hw_devs(mdev, esw_mdev); - } - - static struct net_device * -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 7a34a502f97f..45d004c7b0dd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -3614,15 +3614,11 @@ static bool same_port_devs(struct mlx5e_priv *priv, struct mlx5e_priv *peer_priv - bool mlx5e_same_hw_devs(struct mlx5e_priv *priv, struct mlx5e_priv *peer_priv) - { - struct mlx5_core_dev *fmdev, *pmdev; -- u64 fsystem_guid, psystem_guid; - - fmdev = priv->mdev; - pmdev = peer_priv->mdev; - -- fsystem_guid = mlx5_query_nic_system_image_guid(fmdev); -- psystem_guid = mlx5_query_nic_system_image_guid(pmdev); -- -- return (fsystem_guid == psystem_guid); -+ return mlx5_same_hw_devs(fmdev, pmdev); - } - - static int --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1598-net-mlx5-add-software-system-image-guid-infrastructure.patch b/SOURCES/1598-net-mlx5-add-software-system-image-guid-infrastructure.patch deleted file mode 100644 index cf0986ae2..000000000 --- a/SOURCES/1598-net-mlx5-add-software-system-image-guid-infrastructure.patch +++ /dev/null @@ -1,424 +0,0 @@ -From 8445ffd300ce776e75275484b16cace67ff4a5ac Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:33 -0400 -Subject: [PATCH] net/mlx5: Add software system image GUID infrastructure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7718f2a8b87af7363d60819ac0ac0da8b2f8ff00 -Author: Mark Bloch -Date: Thu Oct 23 12:16:57 2025 +0300 - - net/mlx5: Add software system image GUID infrastructure - - Replace direct hardware system image GUID usage with a new software - system image GUID function that supports variable-length identifiers. - - Key changes: - - Add mlx5_query_nic_sw_system_image_guid() function with length parameter. - - Update all callsites to use the new function and buffer/length approach. - - Modify mapping contexts to use byte arrays instead of u64 keys. - - Update devcom matching to support variable-length keys. - - Change mlx5_same_hw_devs() to use buffer comparison instead of u64. - - This refactoring prepares the infrastructure for balance ID support, - which requires extending the system image GUID with additional data. - The change maintains backward compatibility while enabling future - enhancements. - - Signed-off-by: Mark Bloch - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761211020-925651-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c -index 891bbbbfbbf1..64c04f52990f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c -@@ -564,10 +564,14 @@ int mlx5_rescan_drivers_locked(struct mlx5_core_dev *dev) - - bool mlx5_same_hw_devs(struct mlx5_core_dev *dev, struct mlx5_core_dev *peer_dev) - { -- u64 fsystem_guid, psystem_guid; -+ u8 fsystem_guid[MLX5_SW_IMAGE_GUID_MAX_BYTES]; -+ u8 psystem_guid[MLX5_SW_IMAGE_GUID_MAX_BYTES]; -+ u8 flen; -+ u8 plen; - -- fsystem_guid = mlx5_query_nic_system_image_guid(dev); -- psystem_guid = mlx5_query_nic_system_image_guid(peer_dev); -+ mlx5_query_nic_sw_system_image_guid(dev, fsystem_guid, &flen); -+ mlx5_query_nic_sw_system_image_guid(peer_dev, psystem_guid, &plen); - -- return (fsystem_guid && psystem_guid && fsystem_guid == psystem_guid); -+ return plen && flen && flen == plen && -+ !memcmp(fsystem_guid, psystem_guid, flen); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/en/devlink.c -index 0b1ac6e5c890..8818f65d1fbc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/devlink.c -@@ -40,11 +40,8 @@ void mlx5e_destroy_devlink(struct mlx5e_dev *mlx5e_dev) - static void - mlx5e_devlink_get_port_parent_id(struct mlx5_core_dev *dev, struct netdev_phys_item_id *ppid) - { -- u64 parent_id; -- -- parent_id = mlx5_query_nic_system_image_guid(dev); -- ppid->id_len = sizeof(parent_id); -- memcpy(ppid->id, &parent_id, sizeof(parent_id)); -+ BUILD_BUG_ON(MLX5_SW_IMAGE_GUID_MAX_BYTES > MAX_PHYS_ITEM_ID_LEN); -+ mlx5_query_nic_sw_system_image_guid(dev, ppid->id, &ppid->id_len); - } - - int mlx5e_devlink_port_register(struct mlx5e_dev *mlx5e_dev, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.c b/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.c -index 4e72ca8070e2..1de18c7e96ec 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - - #include "mapping.h" - -@@ -24,7 +25,8 @@ struct mapping_ctx { - struct delayed_work dwork; - struct list_head pending_list; - spinlock_t pending_list_lock; /* Guards pending list */ -- u64 id; -+ u8 id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; -+ u8 id_len; - u8 type; - struct list_head list; - refcount_t refcount; -@@ -220,13 +222,15 @@ mapping_create(size_t data_size, u32 max_id, bool delayed_removal) - } - - struct mapping_ctx * --mapping_create_for_id(u64 id, u8 type, size_t data_size, u32 max_id, bool delayed_removal) -+mapping_create_for_id(u8 *id, u8 id_len, u8 type, size_t data_size, u32 max_id, -+ bool delayed_removal) - { - struct mapping_ctx *ctx; - - mutex_lock(&shared_ctx_lock); - list_for_each_entry(ctx, &shared_ctx_list, list) { -- if (ctx->id == id && ctx->type == type) { -+ if (ctx->type == type && ctx->id_len == id_len && -+ !memcmp(id, ctx->id, id_len)) { - if (refcount_inc_not_zero(&ctx->refcount)) - goto unlock; - break; -@@ -237,7 +241,8 @@ mapping_create_for_id(u64 id, u8 type, size_t data_size, u32 max_id, bool delaye - if (IS_ERR(ctx)) - goto unlock; - -- ctx->id = id; -+ memcpy(ctx->id, id, id_len); -+ ctx->id_len = id_len; - ctx->type = type; - list_add(&ctx->list, &shared_ctx_list); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.h b/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.h -index 4e2119f0f4c1..e86a103d58b9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/mapping.h -@@ -27,6 +27,7 @@ void mapping_destroy(struct mapping_ctx *ctx); - /* adds mapping with an id or get an existing mapping with the same id - */ - struct mapping_ctx * --mapping_create_for_id(u64 id, u8 type, size_t data_size, u32 max_id, bool delayed_removal); -+mapping_create_for_id(u8 *id, u8 id_len, u8 type, size_t data_size, u32 max_id, -+ bool delayed_removal); - - #endif /* __MLX5_MAPPING_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -index 896f718483c3..991f47050643 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/int_port.c -@@ -307,7 +307,8 @@ mlx5e_tc_int_port_init(struct mlx5e_priv *priv) - { - struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; - struct mlx5e_tc_int_port_priv *int_port_priv; -- u64 mapping_id; -+ u8 mapping_id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; -+ u8 id_len; - - if (!mlx5e_tc_int_port_supported(esw)) - return NULL; -@@ -316,9 +317,10 @@ mlx5e_tc_int_port_init(struct mlx5e_priv *priv) - if (!int_port_priv) - return NULL; - -- mapping_id = mlx5_query_nic_system_image_guid(priv->mdev); -+ mlx5_query_nic_sw_system_image_guid(priv->mdev, mapping_id, &id_len); - -- int_port_priv->metadata_mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_INT_PORT, -+ int_port_priv->metadata_mapping = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_INT_PORT, - sizeof(u32) * 2, - (1 << ESW_VPORT_BITS) - 1, true); - if (IS_ERR(int_port_priv->metadata_mapping)) { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -index 870d12364f99..fc0e57403d25 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_ct.c -@@ -2287,9 +2287,10 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains, - enum mlx5_flow_namespace_type ns_type, - struct mlx5e_post_act *post_act) - { -+ u8 mapping_id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; - struct mlx5_tc_ct_priv *ct_priv; - struct mlx5_core_dev *dev; -- u64 mapping_id; -+ u8 id_len; - int err; - - dev = priv->mdev; -@@ -2301,16 +2302,18 @@ mlx5_tc_ct_init(struct mlx5e_priv *priv, struct mlx5_fs_chains *chains, - if (!ct_priv) - goto err_alloc; - -- mapping_id = mlx5_query_nic_system_image_guid(dev); -+ mlx5_query_nic_sw_system_image_guid(dev, mapping_id, &id_len); - -- ct_priv->zone_mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_ZONE, -+ ct_priv->zone_mapping = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_ZONE, - sizeof(u16), 0, true); - if (IS_ERR(ct_priv->zone_mapping)) { - err = PTR_ERR(ct_priv->zone_mapping); - goto err_mapping_zone; - } - -- ct_priv->labels_mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_LABELS, -+ ct_priv->labels_mapping = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_LABELS, - sizeof(u32) * 4, 0, true); - if (IS_ERR(ct_priv->labels_mapping)) { - err = PTR_ERR(ct_priv->labels_mapping); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 45d004c7b0dd..17ae07b47f7f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -5233,10 +5233,11 @@ static void mlx5e_tc_nic_destroy_miss_table(struct mlx5e_priv *priv) - int mlx5e_tc_nic_init(struct mlx5e_priv *priv) - { - struct mlx5e_tc_table *tc = mlx5e_fs_get_tc(priv->fs); -+ u8 mapping_id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; - struct mlx5_core_dev *dev = priv->mdev; - struct mapping_ctx *chains_mapping; - struct mlx5_chains_attr attr = {}; -- u64 mapping_id; -+ u8 id_len; - int err; - - mlx5e_mod_hdr_tbl_init(&tc->mod_hdr); -@@ -5252,11 +5253,13 @@ int mlx5e_tc_nic_init(struct mlx5e_priv *priv) - lockdep_set_class(&tc->ht.mutex, &tc_ht_lock_key); - lockdep_init_map(&tc->ht.run_work.lockdep_map, "tc_ht_wq_key", &tc_ht_wq_key, 0); - -- mapping_id = mlx5_query_nic_system_image_guid(dev); -+ mlx5_query_nic_sw_system_image_guid(dev, mapping_id, &id_len); - -- chains_mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_CHAIN, -+ chains_mapping = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_CHAIN, - sizeof(struct mlx5_mapped_obj), -- MLX5E_TC_TABLE_CHAIN_TAG_MASK, true); -+ MLX5E_TC_TABLE_CHAIN_TAG_MASK, -+ true); - - if (IS_ERR(chains_mapping)) { - err = PTR_ERR(chains_mapping); -@@ -5387,14 +5390,15 @@ void mlx5e_tc_ht_cleanup(struct rhashtable *tc_ht) - int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - { - const size_t sz_enc_opts = sizeof(struct tunnel_match_enc_opts); -+ u8 mapping_id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; - struct mlx5_devcom_match_attr attr = {}; - struct netdev_phys_item_id ppid; - struct mlx5e_rep_priv *rpriv; - struct mapping_ctx *mapping; - struct mlx5_eswitch *esw; - struct mlx5e_priv *priv; -- u64 mapping_id; - int err = 0; -+ u8 id_len; - - rpriv = container_of(uplink_priv, struct mlx5e_rep_priv, uplink_priv); - priv = netdev_priv(rpriv->netdev); -@@ -5412,9 +5416,9 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - - uplink_priv->tc_psample = mlx5e_tc_sample_init(esw, uplink_priv->post_act); - -- mapping_id = mlx5_query_nic_system_image_guid(esw->dev); -+ mlx5_query_nic_sw_system_image_guid(esw->dev, mapping_id, &id_len); - -- mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_TUNNEL, -+ mapping = mapping_create_for_id(mapping_id, id_len, MAPPING_TYPE_TUNNEL, - sizeof(struct tunnel_match_key), - TUNNEL_INFO_BITS_MASK, true); - -@@ -5427,8 +5431,10 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - /* Two last values are reserved for stack devices slow path table mark - * and bridge ingress push mark. - */ -- mapping = mapping_create_for_id(mapping_id, MAPPING_TYPE_TUNNEL_ENC_OPTS, -- sz_enc_opts, ENC_OPTS_BITS_MASK - 2, true); -+ mapping = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_TUNNEL_ENC_OPTS, -+ sz_enc_opts, ENC_OPTS_BITS_MASK - 2, -+ true); - if (IS_ERR(mapping)) { - err = PTR_ERR(mapping); - goto err_enc_opts_mapping; -@@ -5449,7 +5455,7 @@ int mlx5e_tc_esw_init(struct mlx5_rep_uplink_priv *uplink_priv) - - err = dev_get_port_parent_id(priv->netdev, &ppid, false); - if (!err) { -- memcpy(&attr.key.val, &ppid.id, sizeof(attr.key.val)); -+ memcpy(&attr.key.buf, &ppid.id, ppid.id_len); - attr.flags = MLX5_DEVCOM_MATCH_FLAGS_NS; - attr.net = mlx5_core_net(esw->dev); - mlx5_esw_offloads_devcom_init(esw, &attr); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -index cf88a106d80d..89a58dee50b3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/devlink_port.c -@@ -7,11 +7,7 @@ - static void - mlx5_esw_get_port_parent_id(struct mlx5_core_dev *dev, struct netdev_phys_item_id *ppid) - { -- u64 parent_id; -- -- parent_id = mlx5_query_nic_system_image_guid(dev); -- ppid->id_len = sizeof(parent_id); -- memcpy(ppid->id, &parent_id, sizeof(parent_id)); -+ mlx5_query_nic_sw_system_image_guid(dev, ppid->id, &ppid->id_len); - } - - static bool mlx5_esw_devlink_port_supported(struct mlx5_eswitch *esw, u16 vport_num) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 05270d5bc6df..8eb08d2276be 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3556,10 +3556,11 @@ bool mlx5_esw_offloads_controller_valid(const struct mlx5_eswitch *esw, u32 cont - - int esw_offloads_enable(struct mlx5_eswitch *esw) - { -+ u8 mapping_id[MLX5_SW_IMAGE_GUID_MAX_BYTES]; - struct mapping_ctx *reg_c0_obj_pool; - struct mlx5_vport *vport; - unsigned long i; -- u64 mapping_id; -+ u8 id_len; - int err; - - mutex_init(&esw->offloads.termtbl_mutex); -@@ -3581,9 +3582,10 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - if (err) - goto err_vport_metadata; - -- mapping_id = mlx5_query_nic_system_image_guid(esw->dev); -+ mlx5_query_nic_sw_system_image_guid(esw->dev, mapping_id, &id_len); - -- reg_c0_obj_pool = mapping_create_for_id(mapping_id, MAPPING_TYPE_CHAIN, -+ reg_c0_obj_pool = mapping_create_for_id(mapping_id, id_len, -+ MAPPING_TYPE_CHAIN, - sizeof(struct mlx5_mapped_obj), - ESW_REG_C0_USER_DATA_METADATA_MASK, - true); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index 3db0387bf6dc..1ac933cd8f02 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -1418,10 +1418,12 @@ static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev) - static int mlx5_lag_register_hca_devcom_comp(struct mlx5_core_dev *dev) - { - struct mlx5_devcom_match_attr attr = { -- .key.val = mlx5_query_nic_system_image_guid(dev), - .flags = MLX5_DEVCOM_MATCH_FLAGS_NS, - .net = mlx5_core_net(dev), - }; -+ u8 len __always_unused; -+ -+ mlx5_query_nic_sw_system_image_guid(dev, attr.key.buf, &len); - - /* This component is use to sync adding core_dev to lag_dev and to sync - * changes of mlx5_adev_devices between LAG layer and other layers. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -index 609c85f47917..91e5ae529d5c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/devcom.h -@@ -10,8 +10,10 @@ enum mlx5_devom_match_flags { - MLX5_DEVCOM_MATCH_FLAGS_NS = BIT(0), - }; - -+#define MLX5_DEVCOM_MATCH_KEY_MAX 32 - union mlx5_devcom_match_key { - u64 val; -+ u8 buf[MLX5_DEVCOM_MATCH_KEY_MAX]; - }; - - struct mlx5_devcom_match_attr { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index 082259b56816..acef7d0ffa09 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -444,6 +444,8 @@ int mlx5_init_one_light(struct mlx5_core_dev *dev); - void mlx5_uninit_one_light(struct mlx5_core_dev *dev); - void mlx5_unload_one_light(struct mlx5_core_dev *dev); - -+void mlx5_query_nic_sw_system_image_guid(struct mlx5_core_dev *mdev, u8 *buf, -+ u8 *len); - int mlx5_vport_set_other_func_cap(struct mlx5_core_dev *dev, const void *hca_cap, u16 vport, - u16 opmod); - #define mlx5_vport_get_other_func_general_cap(dev, vport, out) \ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index d1483f66cd0c..8f23d2e9d284 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -1190,6 +1190,21 @@ u64 mlx5_query_nic_system_image_guid(struct mlx5_core_dev *mdev) - } - EXPORT_SYMBOL_GPL(mlx5_query_nic_system_image_guid); - -+void mlx5_query_nic_sw_system_image_guid(struct mlx5_core_dev *mdev, u8 *buf, -+ u8 *len) -+{ -+ u64 fw_system_image_guid; -+ -+ *len = 0; -+ -+ fw_system_image_guid = mlx5_query_nic_system_image_guid(mdev); -+ if (!fw_system_image_guid) -+ return; -+ -+ memcpy(buf, &fw_system_image_guid, sizeof(fw_system_image_guid)); -+ *len += sizeof(fw_system_image_guid); -+} -+ - static bool mlx5_vport_use_vhca_id_as_func_id(struct mlx5_core_dev *dev, - u16 vport_num, u16 *vhca_id) - { -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 5405ca1038f9..dcf262aa9ea6 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -1379,4 +1379,7 @@ static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) - { - return devlink_net(priv_to_devlink(dev)); - } -+ -+#define MLX5_SW_IMAGE_GUID_MAX_BYTES 8 -+ - #endif /* MLX5_DRIVER_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1599-net-mlx5-refactor-ptp-clock-devcom-pairing.patch b/SOURCES/1599-net-mlx5-refactor-ptp-clock-devcom-pairing.patch deleted file mode 100644 index e75dda44b..000000000 --- a/SOURCES/1599-net-mlx5-refactor-ptp-clock-devcom-pairing.patch +++ /dev/null @@ -1,84 +0,0 @@ -From deaf4963449dd436d854c56969edc939d10a0311 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5: Refactor PTP clock devcom pairing - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cd36818c34ac5ff7f6a50ce88822c7bbb5ac9e0d -Author: Mark Bloch -Date: Thu Oct 23 12:16:58 2025 +0300 - - net/mlx5: Refactor PTP clock devcom pairing - - Refactor PTP clock device component pairing to use the clock identity - buffer instead of casting it to a u64 key. This change leverages the new - software system image GUID infrastructure. - - Changes include: - - Pass identity buffer to mlx5_shared_clock_register(). - - Use memcpy for identity buffer in devcom matching attributes. - - Remove intermediate u64 key conversion. - - Add BUILD_BUG_ON to ensure identity size fits in match key. - - Signed-off-by: Mark Bloch - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761211020-925651-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -index 29e7fa09c32c..0ba0ef8bae42 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c -@@ -1432,15 +1432,17 @@ static int mlx5_clock_alloc(struct mlx5_core_dev *mdev, bool shared) - return 0; - } - --static void mlx5_shared_clock_register(struct mlx5_core_dev *mdev, u64 key) -+static void mlx5_shared_clock_register(struct mlx5_core_dev *mdev, -+ u8 identity[MLX5_RT_CLOCK_IDENTITY_SIZE]) - { - struct mlx5_core_dev *peer_dev, *next = NULL; -- struct mlx5_devcom_match_attr attr = { -- .key.val = key, -- }; -+ struct mlx5_devcom_match_attr attr = {}; - struct mlx5_devcom_comp_dev *compd; - struct mlx5_devcom_comp_dev *pos; - -+ BUILD_BUG_ON(MLX5_RT_CLOCK_IDENTITY_SIZE > MLX5_DEVCOM_MATCH_KEY_MAX); -+ memcpy(attr.key.buf, identity, MLX5_RT_CLOCK_IDENTITY_SIZE); -+ - compd = mlx5_devcom_register_component(mdev->priv.devc, - MLX5_DEVCOM_SHARED_CLOCK, - &attr, NULL, mdev); -@@ -1594,7 +1596,6 @@ int mlx5_init_clock(struct mlx5_core_dev *mdev) - { - u8 identity[MLX5_RT_CLOCK_IDENTITY_SIZE]; - struct mlx5_clock_dev_state *clock_state; -- u64 key; - int err; - - if (!MLX5_CAP_GEN(mdev, device_frequency_khz)) { -@@ -1610,12 +1611,10 @@ int mlx5_init_clock(struct mlx5_core_dev *mdev) - mdev->clock_state = clock_state; - - if (MLX5_CAP_MCAM_REG3(mdev, mrtcq) && mlx5_real_time_mode(mdev)) { -- if (mlx5_clock_identity_get(mdev, identity)) { -+ if (mlx5_clock_identity_get(mdev, identity)) - mlx5_core_warn(mdev, "failed to get rt clock identity, create ptp dev per function\n"); -- } else { -- memcpy(&key, &identity, sizeof(key)); -- mlx5_shared_clock_register(mdev, key); -- } -+ else -+ mlx5_shared_clock_register(mdev, identity); - } - - if (!mdev->clock) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1600-net-mlx5-refactor-hca-cap-2-setting.patch b/SOURCES/1600-net-mlx5-refactor-hca-cap-2-setting.patch deleted file mode 100644 index 0e4074296..000000000 --- a/SOURCES/1600-net-mlx5-refactor-hca-cap-2-setting.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 91356ee2e31410460f681a78ec9a2dd33fa38c32 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5: Refactor HCA cap 2 setting - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 075e85a1261e4653c2068e68a8c91da6c7bc4e60 -Author: Mark Bloch -Date: Thu Oct 23 12:16:59 2025 +0300 - - net/mlx5: Refactor HCA cap 2 setting - - Refactor HCA capability 2 setting logic to be more structured and - conditional. Move the sw_vhca_id_valid setting inside proper conditional - checks and prepare the function for additional capability settings. - - The refactoring: - - Always copy current capabilities to set_hca_cap buffer. - - Apply sw_vhca_id_valid setting only when conditions are met. - - Improve code readability and maintainability. - - This cleanup prepares the handle_hca_cap_2() function for the upcoming - balance ID capability setting. - - Signed-off-by: Mark Bloch - Reviewed-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761211020-925651-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 81930a461e62..4f2969a56ff2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -553,6 +553,7 @@ EXPORT_SYMBOL(mlx5_is_roce_on); - - static int handle_hca_cap_2(struct mlx5_core_dev *dev, void *set_ctx) - { -+ bool do_set = false; - void *set_hca_cap; - int err; - -@@ -563,17 +564,22 @@ static int handle_hca_cap_2(struct mlx5_core_dev *dev, void *set_ctx) - if (err) - return err; - -- if (!MLX5_CAP_GEN_2_MAX(dev, sw_vhca_id_valid) || -- !(dev->priv.sw_vhca_id > 0)) -- return 0; -- - set_hca_cap = MLX5_ADDR_OF(set_hca_cap_in, set_ctx, - capability); - memcpy(set_hca_cap, dev->caps.hca[MLX5_CAP_GENERAL_2]->cur, - MLX5_ST_SZ_BYTES(cmd_hca_cap_2)); -- MLX5_SET(cmd_hca_cap_2, set_hca_cap, sw_vhca_id_valid, 1); - -- return set_caps(dev, set_ctx, MLX5_CAP_GENERAL_2); -+ if (MLX5_CAP_GEN_2_MAX(dev, sw_vhca_id_valid) && -+ dev->priv.sw_vhca_id > 0) { -+ MLX5_SET(cmd_hca_cap_2, set_hca_cap, sw_vhca_id_valid, 1); -+ do_set = true; -+ } -+ -+ /* some FW versions that support querying MLX5_CAP_GENERAL_2 -+ * capabilities but don't support setting them. -+ * Skip unnecessary update to hca_cap_2 when no changes were introduced -+ */ -+ return do_set ? set_caps(dev, set_ctx, MLX5_CAP_GENERAL_2) : 0; - } - - static int handle_hca_cap(struct mlx5_core_dev *dev, void *set_ctx) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1601-net-mlx5-add-balance-id-support-for-lag-multiplane-groups.patch b/SOURCES/1601-net-mlx5-add-balance-id-support-for-lag-multiplane-groups.patch deleted file mode 100644 index 80310021e..000000000 --- a/SOURCES/1601-net-mlx5-add-balance-id-support-for-lag-multiplane-groups.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 826353d76400033b9de3a11f625bd5d28db13e04 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5: Add balance ID support for LAG multiplane groups - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 20d78ead947783b039b02ca4b8c551b4d1894759 -Author: Mark Bloch -Date: Thu Oct 23 12:17:00 2025 +0300 - - net/mlx5: Add balance ID support for LAG multiplane groups - - Implement balance ID support for multiplane LAG configurations. This - feature enables per-multiplane group load balancing by extending the - software system image GUID with a balance ID component. - - Key implementations: - - Enable lag_per_mp_group capability when supported by hardware. - - Append load_balance_id to software system image GUID when conditions - are met. - - Increase MLX5_SW_IMAGE_GUID_MAX_BYTES from 8 to 9 to accommodate the - extra byte. - - The balance ID is appended to the system image GUID only when both - load_balance_id and lag_per_mp_group capabilities are available, ensuring - backward compatibility while enabling enhanced LAG functionality. - - This enhancement allows for more granular load balancing control in complex - multi-plane LAG deployments, improving network performance and flexibility. - - Signed-off-by: Mark Bloch - Reviewed-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761211020-925651-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 4f2969a56ff2..b0d8d9888629 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -575,6 +575,11 @@ static int handle_hca_cap_2(struct mlx5_core_dev *dev, void *set_ctx) - do_set = true; - } - -+ if (MLX5_CAP_GEN_2_MAX(dev, lag_per_mp_group)) { -+ MLX5_SET(cmd_hca_cap_2, set_hca_cap, lag_per_mp_group, 1); -+ do_set = true; -+ } -+ - /* some FW versions that support querying MLX5_CAP_GENERAL_2 - * capabilities but don't support setting them. - * Skip unnecessary update to hca_cap_2 when no changes were introduced -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -index 8f23d2e9d284..306affbcfd3b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c -@@ -1203,6 +1203,10 @@ void mlx5_query_nic_sw_system_image_guid(struct mlx5_core_dev *mdev, u8 *buf, - - memcpy(buf, &fw_system_image_guid, sizeof(fw_system_image_guid)); - *len += sizeof(fw_system_image_guid); -+ -+ if (MLX5_CAP_GEN_2(mdev, load_balance_id) && -+ MLX5_CAP_GEN_2(mdev, lag_per_mp_group)) -+ buf[(*len)++] = MLX5_CAP_GEN_2(mdev, load_balance_id); - } - - static bool mlx5_vport_use_vhca_id_as_func_id(struct mlx5_core_dev *dev, -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index dcf262aa9ea6..046396269ccf 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -1380,6 +1380,6 @@ static inline struct net *mlx5_core_net(struct mlx5_core_dev *dev) - return devlink_net(priv_to_devlink(dev)); - } - --#define MLX5_SW_IMAGE_GUID_MAX_BYTES 8 -+#define MLX5_SW_IMAGE_GUID_MAX_BYTES 9 - - #endif /* MLX5_DRIVER_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1602-net-mlx5e-remove-redundant-tstamp-pointer-from-channel-struc.patch b/SOURCES/1602-net-mlx5e-remove-redundant-tstamp-pointer-from-channel-struc.patch deleted file mode 100644 index 8020111f8..000000000 --- a/SOURCES/1602-net-mlx5e-remove-redundant-tstamp-pointer-from-channel-struc.patch +++ /dev/null @@ -1,139 +0,0 @@ -From 7af23ae57d22fb171661939465f9532c0b0efdaf Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Remove redundant tstamp pointer from channel - structures - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7ea4376b3972d89385599307d1ad4f20eb763a05 -Author: Carolina Jubran -Date: Thu Oct 30 12:25:05 2025 +0200 - - net/mlx5e: Remove redundant tstamp pointer from channel structures - - Remove the tstamp pointer field from mlx5e_channel, mlx5e_ptp, and - mlx5e_trap structures, since it was only used to reference the tstamp - field in the priv structure. Instead, directly use the tstamp field - from priv when initializing RQ structures. - - Also remove the unused hwtstamp_config field from mlx5_clock structure - as part of the cleanup. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761819910-1011051-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 964df2d545b0..32598ea81e40 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -784,7 +784,6 @@ struct mlx5e_channel { - /* control */ - struct mlx5e_priv *priv; - struct mlx5_core_dev *mdev; -- struct hwtstamp_config *tstamp; - DECLARE_BITMAP(state, MLX5E_CHANNEL_NUM_STATES); - int ix; - int vec_ix; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index d1e0f974b8a3..7685494cc57b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -881,7 +881,6 @@ int mlx5e_ptp_open(struct mlx5e_priv *priv, struct mlx5e_params *params, - - c->priv = priv; - c->mdev = priv->mdev; -- c->tstamp = &priv->tstamp; - c->pdev = mlx5_core_dma_dev(priv->mdev); - c->netdev = priv->netdev; - c->mkey_be = cpu_to_be32(priv->mdev->mlx5e_res.hw_objs.mkey); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -index 1b3c9648220b..1c0e0a86a9ac 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -@@ -64,7 +64,6 @@ struct mlx5e_ptp { - /* control */ - struct mlx5e_priv *priv; - struct mlx5_core_dev *mdev; -- struct hwtstamp_config *tstamp; - DECLARE_BITMAP(state, MLX5E_PTP_STATE_NUM_STATES); - struct mlx5_sq_bfreg *bfreg; - }; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -index 5099a1c47f4f..6d0a0d6e8d5f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -@@ -144,7 +144,6 @@ static struct mlx5e_trap *mlx5e_open_trap(struct mlx5e_priv *priv) - - t->priv = priv; - t->mdev = priv->mdev; -- t->tstamp = &priv->tstamp; - t->pdev = mlx5_core_dma_dev(priv->mdev); - t->netdev = priv->netdev; - t->mkey_be = cpu_to_be32(priv->mdev->mlx5e_res.hw_objs.mkey); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.h b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.h -index aa3f17658c6d..394e917ea2b0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.h -@@ -22,7 +22,6 @@ struct mlx5e_trap { - /* control */ - struct mlx5e_priv *priv; - struct mlx5_core_dev *mdev; -- struct hwtstamp_config *tstamp; - DECLARE_BITMAP(state, MLX5E_CHANNEL_NUM_STATES); - - struct mlx5e_params params; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -index dbd88eb5c082..dc5a4afa4974 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -@@ -71,7 +71,7 @@ static int mlx5e_init_xsk_rq(struct mlx5e_channel *c, - rq->pdev = c->pdev; - rq->netdev = c->netdev; - rq->priv = c->priv; -- rq->tstamp = c->tstamp; -+ rq->tstamp = &c->priv->tstamp; - rq->clock = mdev->clock; - rq->icosq = &c->icosq; - rq->ix = c->ix; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index ef655b8abc96..4b2407b38e7b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -734,7 +734,7 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param - rq->pdev = c->pdev; - rq->netdev = c->netdev; - rq->priv = c->priv; -- rq->tstamp = c->tstamp; -+ rq->tstamp = &c->priv->tstamp; - rq->clock = mdev->clock; - rq->icosq = &c->icosq; - rq->ix = c->ix; -@@ -2788,7 +2788,6 @@ static int mlx5e_open_channel(struct mlx5e_priv *priv, int ix, - - c->priv = priv; - c->mdev = mdev; -- c->tstamp = &priv->tstamp; - c->ix = ix; - c->vec_ix = vec_ix; - c->sd_ix = mlx5_sd_ch_ix_get_dev_ix(mdev, ix); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.h -index c18a652c0faa..aff3aed62c74 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.h -@@ -54,7 +54,6 @@ struct mlx5_timer { - - struct mlx5_clock { - seqlock_t lock; -- struct hwtstamp_config hwtstamp_config; - struct ptp_clock *ptp; - struct ptp_clock_info ptp_info; - struct mlx5_pps pps_info; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1603-net-mlx5e-remove-unnecessary-tstamp-local-variable-in-mlx5i-.patch b/SOURCES/1603-net-mlx5e-remove-unnecessary-tstamp-local-variable-in-mlx5i-.patch deleted file mode 100644 index 50caee578..000000000 --- a/SOURCES/1603-net-mlx5e-remove-unnecessary-tstamp-local-variable-in-mlx5i-.patch +++ /dev/null @@ -1,58 +0,0 @@ -From bca2504af0dcf4f1fe144801c35aadc2d8a92410 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Remove unnecessary tstamp local variable in - mlx5i_complete_rx_cqe - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bf791659743b1a8e20f5810b1ac893b7b24f650e -Author: Carolina Jubran -Date: Thu Oct 30 12:25:06 2025 +0200 - - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe - - Remove the tstamp local variable in mlx5i_complete_rx_cqe() and directly - pass the tstamp field from priv to mlx5e_rx_hw_stamp(). The local variable - was only used once and provided no additional value. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761819910-1011051-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 21be5dcf47d5..ed1fb4096271 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -2605,7 +2605,6 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, - u32 cqe_bcnt, - struct sk_buff *skb) - { -- struct hwtstamp_config *tstamp; - struct mlx5e_rq_stats *stats; - struct net_device *netdev; - struct mlx5e_priv *priv; -@@ -2629,7 +2628,6 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, - } - - priv = mlx5i_epriv(netdev); -- tstamp = &priv->tstamp; - stats = &priv->channel_stats[rq->ix]->rq; - - flags_rqpn = be32_to_cpu(cqe->flags_rqpn); -@@ -2665,7 +2663,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, - stats->csum_none++; - } - -- if (unlikely(mlx5e_rx_hw_stamp(tstamp))) -+ if (unlikely(mlx5e_rx_hw_stamp(&priv->tstamp))) - skb_hwtstamps(skb)->hwtstamp = mlx5e_cqe_ts_to_ns(rq->ptp_cyc2time, - rq->clock, get_cqe_ts(cqe)); - skb_record_rx_queue(skb, rq->ix); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1604-net-mlx5e-rename-hwstamp-functions-to-hwtstamp.patch b/SOURCES/1604-net-mlx5e-rename-hwstamp-functions-to-hwtstamp.patch deleted file mode 100644 index 24eda6e68..000000000 --- a/SOURCES/1604-net-mlx5e-rename-hwstamp-functions-to-hwtstamp.patch +++ /dev/null @@ -1,93 +0,0 @@ -From 2698fb06119fde802d822433049c18d489b6d0be Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Rename hwstamp functions to hwtstamp - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fee182371a59414d43633a5ea6f1cda160418a16 -Author: Carolina Jubran -Date: Thu Oct 30 12:25:07 2025 +0200 - - net/mlx5e: Rename hwstamp functions to hwtstamp - - Rename mlx5e_hwstamp_set/get() functions to mlx5e_hwtstamp_set/get() - to better reflect that these functions handle hardware timestamping, - not just hardware stamping. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761819910-1011051-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 32598ea81e40..f042de60688d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1022,8 +1022,8 @@ void mlx5e_self_test(struct net_device *ndev, struct ethtool_test *etest, - u64 *buf); - void mlx5e_set_rx_mode_work(struct work_struct *work); - --int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr); --int mlx5e_hwstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr); -+int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr); -+int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr); - int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool val, bool rx_filter); - - int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 4b2407b38e7b..9a6d82b5ccc7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4725,7 +4725,7 @@ static int mlx5e_hwstamp_config_ptp_rx(struct mlx5e_priv *priv, bool ptp_rx) - &new_params.ptp_rx, true); - } - --int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) -+int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - { - struct hwtstamp_config config; - bool rx_cqe_compress_def; -@@ -4803,7 +4803,7 @@ int mlx5e_hwstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - return err; - } - --int mlx5e_hwstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr) -+int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr) - { - struct hwtstamp_config *cfg = &priv->tstamp; - -@@ -4819,9 +4819,9 @@ static int mlx5e_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - - switch (cmd) { - case SIOCSHWTSTAMP: -- return mlx5e_hwstamp_set(priv, ifr); -+ return mlx5e_hwtstamp_set(priv, ifr); - case SIOCGHWTSTAMP: -- return mlx5e_hwstamp_get(priv, ifr); -+ return mlx5e_hwtstamp_get(priv, ifr); - default: - return -EOPNOTSUPP; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -index 0979d672d47f..f3a249b59482 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -@@ -560,9 +560,9 @@ int mlx5i_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) - - switch (cmd) { - case SIOCSHWTSTAMP: -- return mlx5e_hwstamp_set(priv, ifr); -+ return mlx5e_hwtstamp_set(priv, ifr); - case SIOCGHWTSTAMP: -- return mlx5e_hwstamp_get(priv, ifr); -+ return mlx5e_hwtstamp_get(priv, ifr); - default: - return -EOPNOTSUPP; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1605-net-mlx5e-rename-timestamp-fields-to-hwtstamp-config.patch b/SOURCES/1605-net-mlx5e-rename-timestamp-fields-to-hwtstamp-config.patch deleted file mode 100644 index e87bf9951..000000000 --- a/SOURCES/1605-net-mlx5e-rename-timestamp-fields-to-hwtstamp-config.patch +++ /dev/null @@ -1,194 +0,0 @@ -From e9557d650bf01676fa2ad210556ab69f3d2f552f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Rename timestamp fields to hwtstamp_config - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 91baaf96f5d0b764aec462dd50a8433f5c8d621f -Author: Carolina Jubran -Date: Thu Oct 30 12:25:08 2025 +0200 - - net/mlx5e: Rename timestamp fields to hwtstamp_config - - Rename hardware timestamp-related fields from 'tstamp' to - 'hwtstamp_config' throughout the MLX5 driver. The new name is more - descriptive as it clearly indicates these fields contain hardware - timestamp configuration. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761819910-1011051-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index f042de60688d..a853ec4e529a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -696,7 +696,7 @@ struct mlx5e_rq { - struct mlx5e_rq_stats *stats; - struct mlx5e_cq cq; - struct mlx5e_cq_decomp cqd; -- struct hwtstamp_config *tstamp; -+ struct hwtstamp_config *hwtstamp_config; - struct mlx5_clock *clock; - struct mlx5e_icosq *icosq; - struct mlx5e_priv *priv; -@@ -917,7 +917,7 @@ struct mlx5e_priv { - u8 max_opened_tc; - bool tx_ptp_opened; - bool rx_ptp_opened; -- struct hwtstamp_config tstamp; -+ struct hwtstamp_config hwtstamp_config; - u16 q_counter[MLX5_SD_MAX_GROUP_SZ]; - u16 drop_rq_q_counter; - struct notifier_block events_nb; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 7685494cc57b..92b57e3aaa85 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -698,7 +698,7 @@ static int mlx5e_init_ptp_rq(struct mlx5e_ptp *c, struct mlx5e_params *params, - rq->netdev = priv->netdev; - rq->priv = priv; - rq->clock = mdev->clock; -- rq->tstamp = &priv->tstamp; -+ rq->hwtstamp_config = &priv->hwtstamp_config; - rq->mdev = mdev; - rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - rq->stats = &c->priv->ptp_stats.rq; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -index b1415992ffa2..0686fbdd5a05 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/reporter_rx.c -@@ -318,7 +318,8 @@ mlx5e_rx_reporter_diagnose_common_ptp_config(struct mlx5e_priv *priv, struct mlx - struct devlink_fmsg *fmsg) - { - mlx5e_health_fmsg_named_obj_nest_start(fmsg, "PTP"); -- devlink_fmsg_u32_pair_put(fmsg, "filter_type", priv->tstamp.rx_filter); -+ devlink_fmsg_u32_pair_put(fmsg, "filter_type", -+ priv->hwtstamp_config.rx_filter); - mlx5e_rx_reporter_diagnose_generic_rq(&ptp_ch->rq, fmsg); - mlx5e_health_fmsg_named_obj_nest_end(fmsg); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -index 6d0a0d6e8d5f..1b1c89014b70 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/trap.c -@@ -47,7 +47,7 @@ static void mlx5e_init_trap_rq(struct mlx5e_trap *t, struct mlx5e_params *params - rq->netdev = priv->netdev; - rq->priv = priv; - rq->clock = mdev->clock; -- rq->tstamp = &priv->tstamp; -+ rq->hwtstamp_config = &priv->hwtstamp_config; - rq->mdev = mdev; - rq->hw_mtu = MLX5E_SW2HW_MTU(params, params->sw_mtu); - rq->stats = &priv->trap_stats.rq; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -index 1f9d012231d8..027c55187378 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c -@@ -178,7 +178,7 @@ static int mlx5e_xdp_rx_timestamp(const struct xdp_md *ctx, u64 *timestamp) - { - const struct mlx5e_xdp_buff *_ctx = (void *)ctx; - -- if (unlikely(!mlx5e_rx_hw_stamp(_ctx->rq->tstamp))) -+ if (unlikely(!mlx5e_rx_hw_stamp(_ctx->rq->hwtstamp_config))) - return -ENODATA; - - *timestamp = mlx5e_cqe_ts_to_ns(_ctx->rq->ptp_cyc2time, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -index dc5a4afa4974..5981c71cae2d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xsk/setup.c -@@ -71,7 +71,7 @@ static int mlx5e_init_xsk_rq(struct mlx5e_channel *c, - rq->pdev = c->pdev; - rq->netdev = c->netdev; - rq->priv = c->priv; -- rq->tstamp = &c->priv->tstamp; -+ rq->hwtstamp_config = &c->priv->hwtstamp_config; - rq->clock = mdev->clock; - rq->icosq = &c->icosq; - rq->ix = c->ix; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index e7c9f22ac1fc..5a0f5589b894 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -2275,7 +2275,7 @@ static int set_pflag_rx_cqe_compress(struct net_device *netdev, - if (!MLX5_CAP_GEN(mdev, cqe_compression)) - return -EOPNOTSUPP; - -- rx_filter = priv->tstamp.rx_filter != HWTSTAMP_FILTER_NONE; -+ rx_filter = priv->hwtstamp_config.rx_filter != HWTSTAMP_FILTER_NONE; - err = mlx5e_modify_rx_cqe_compression_locked(priv, enable, rx_filter); - if (err) - return err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 9a6d82b5ccc7..2fb121be52d8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -734,7 +734,7 @@ static int mlx5e_init_rxq_rq(struct mlx5e_channel *c, struct mlx5e_params *param - rq->pdev = c->pdev; - rq->netdev = c->netdev; - rq->priv = c->priv; -- rq->tstamp = &c->priv->tstamp; -+ rq->hwtstamp_config = &c->priv->hwtstamp_config; - rq->clock = mdev->clock; - rq->icosq = &c->icosq; - rq->ix = c->ix; -@@ -3429,8 +3429,8 @@ int mlx5e_safe_reopen_channels(struct mlx5e_priv *priv) - - void mlx5e_timestamp_init(struct mlx5e_priv *priv) - { -- priv->tstamp.tx_type = HWTSTAMP_TX_OFF; -- priv->tstamp.rx_filter = HWTSTAMP_FILTER_NONE; -+ priv->hwtstamp_config.tx_type = HWTSTAMP_TX_OFF; -+ priv->hwtstamp_config.rx_filter = HWTSTAMP_FILTER_NONE; - } - - static void mlx5e_modify_admin_state(struct mlx5_core_dev *mdev, -@@ -4790,7 +4790,7 @@ int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - if (err) - goto err_unlock; - -- memcpy(&priv->tstamp, &config, sizeof(config)); -+ memcpy(&priv->hwtstamp_config, &config, sizeof(config)); - mutex_unlock(&priv->state_lock); - - /* might need to fix some features */ -@@ -4805,7 +4805,7 @@ int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - - int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr) - { -- struct hwtstamp_config *cfg = &priv->tstamp; -+ struct hwtstamp_config *cfg = &priv->hwtstamp_config; - - if (!MLX5_CAP_GEN(priv->mdev, device_frequency_khz)) - return -EOPNOTSUPP; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index ed1fb4096271..0afdc68896c3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1582,7 +1582,7 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - stats->lro_bytes += cqe_bcnt; - } - -- if (unlikely(mlx5e_rx_hw_stamp(rq->tstamp))) -+ if (unlikely(mlx5e_rx_hw_stamp(rq->hwtstamp_config))) - skb_hwtstamps(skb)->hwtstamp = mlx5e_cqe_ts_to_ns(rq->ptp_cyc2time, - rq->clock, get_cqe_ts(cqe)); - skb_record_rx_queue(skb, rq->ix); -@@ -2663,7 +2663,7 @@ static inline void mlx5i_complete_rx_cqe(struct mlx5e_rq *rq, - stats->csum_none++; - } - -- if (unlikely(mlx5e_rx_hw_stamp(&priv->tstamp))) -+ if (unlikely(mlx5e_rx_hw_stamp(&priv->hwtstamp_config))) - skb_hwtstamps(skb)->hwtstamp = mlx5e_cqe_ts_to_ns(rq->ptp_cyc2time, - rq->clock, get_cqe_ts(cqe)); - skb_record_rx_queue(skb, rq->ix); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1606-net-mlx5e-convert-to-new-hwtstamp-get-set-interface.patch b/SOURCES/1606-net-mlx5e-convert-to-new-hwtstamp-get-set-interface.patch deleted file mode 100644 index 25cb07f09..000000000 --- a/SOURCES/1606-net-mlx5e-convert-to-new-hwtstamp-get-set-interface.patch +++ /dev/null @@ -1,322 +0,0 @@ -From 3b75686a21a3077a62a49db325f7265cd9f56376 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Convert to new hwtstamp_get/set interface - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 1c7fe48a90158486a66665f1401d0b90bd390ef0 -Author: Carolina Jubran -Date: Thu Oct 30 12:25:10 2025 +0200 - - net/mlx5e: Convert to new hwtstamp_get/set interface - - Migrate from the legacy ioctl hardware timestamping interface to the - ndo_hwtstamp_get/set operations. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1761819910-1011051-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index a853ec4e529a..208870fe79c1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -696,7 +696,7 @@ struct mlx5e_rq { - struct mlx5e_rq_stats *stats; - struct mlx5e_cq cq; - struct mlx5e_cq_decomp cqd; -- struct hwtstamp_config *hwtstamp_config; -+ struct kernel_hwtstamp_config *hwtstamp_config; - struct mlx5_clock *clock; - struct mlx5e_icosq *icosq; - struct mlx5e_priv *priv; -@@ -917,7 +917,7 @@ struct mlx5e_priv { - u8 max_opened_tc; - bool tx_ptp_opened; - bool rx_ptp_opened; -- struct hwtstamp_config hwtstamp_config; -+ struct kernel_hwtstamp_config hwtstamp_config; - u16 q_counter[MLX5_SD_MAX_GROUP_SZ]; - u16 drop_rq_q_counter; - struct notifier_block events_nb; -@@ -1022,8 +1022,11 @@ void mlx5e_self_test(struct net_device *ndev, struct ethtool_test *etest, - u64 *buf); - void mlx5e_set_rx_mode_work(struct work_struct *work); - --int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr); --int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr); -+int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, -+ struct kernel_hwtstamp_config *config, -+ struct netlink_ext_ack *extack); -+int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, -+ struct kernel_hwtstamp_config *config); - int mlx5e_modify_rx_cqe_compression_locked(struct mlx5e_priv *priv, bool val, bool rx_filter); - - int mlx5e_vlan_rx_add_vid(struct net_device *dev, __always_unused __be16 proto, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -index 8189d5e1ef49..07945e182b4f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/txrx.h -@@ -92,7 +92,7 @@ int mlx5e_poll_rx_cq(struct mlx5e_cq *cq, int budget); - void mlx5e_free_rx_descs(struct mlx5e_rq *rq); - void mlx5e_free_rx_missing_descs(struct mlx5e_rq *rq); - --static inline bool mlx5e_rx_hw_stamp(struct hwtstamp_config *config) -+static inline bool mlx5e_rx_hw_stamp(struct kernel_hwtstamp_config *config) - { - return config->rx_filter == HWTSTAMP_FILTER_ALL; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 2fb121be52d8..2390975c1252 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4725,22 +4725,23 @@ static int mlx5e_hwstamp_config_ptp_rx(struct mlx5e_priv *priv, bool ptp_rx) - &new_params.ptp_rx, true); - } - --int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) -+int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, -+ struct kernel_hwtstamp_config *config, -+ struct netlink_ext_ack *extack) - { -- struct hwtstamp_config config; - bool rx_cqe_compress_def; - bool ptp_rx; - int err; - - if (!MLX5_CAP_GEN(priv->mdev, device_frequency_khz) || -- (mlx5_clock_get_ptp_index(priv->mdev) == -1)) -+ (mlx5_clock_get_ptp_index(priv->mdev) == -1)) { -+ NL_SET_ERR_MSG_MOD(extack, -+ "Timestamps are not supported on this device"); - return -EOPNOTSUPP; -- -- if (copy_from_user(&config, ifr->ifr_data, sizeof(config))) -- return -EFAULT; -+ } - - /* TX HW timestamp */ -- switch (config.tx_type) { -+ switch (config->tx_type) { - case HWTSTAMP_TX_OFF: - case HWTSTAMP_TX_ON: - break; -@@ -4752,7 +4753,7 @@ int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - rx_cqe_compress_def = priv->channels.params.rx_cqe_compress_def; - - /* RX HW timestamp */ -- switch (config.rx_filter) { -+ switch (config->rx_filter) { - case HWTSTAMP_FILTER_NONE: - ptp_rx = false; - break; -@@ -4771,7 +4772,7 @@ int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - case HWTSTAMP_FILTER_PTP_V2_SYNC: - case HWTSTAMP_FILTER_PTP_V2_DELAY_REQ: - case HWTSTAMP_FILTER_NTP_ALL: -- config.rx_filter = HWTSTAMP_FILTER_ALL; -+ config->rx_filter = HWTSTAMP_FILTER_ALL; - /* ptp_rx is set if both HW TS is set and CQE - * compression is set - */ -@@ -4784,47 +4785,50 @@ int mlx5e_hwtstamp_set(struct mlx5e_priv *priv, struct ifreq *ifr) - - if (!mlx5e_profile_feature_cap(priv->profile, PTP_RX)) - err = mlx5e_hwstamp_config_no_ptp_rx(priv, -- config.rx_filter != HWTSTAMP_FILTER_NONE); -+ config->rx_filter != HWTSTAMP_FILTER_NONE); - else - err = mlx5e_hwstamp_config_ptp_rx(priv, ptp_rx); - if (err) - goto err_unlock; - -- memcpy(&priv->hwtstamp_config, &config, sizeof(config)); -+ priv->hwtstamp_config = *config; - mutex_unlock(&priv->state_lock); - - /* might need to fix some features */ - netdev_update_features(priv->netdev); - -- return copy_to_user(ifr->ifr_data, &config, -- sizeof(config)) ? -EFAULT : 0; -+ return 0; - err_unlock: - mutex_unlock(&priv->state_lock); - return err; - } - --int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, struct ifreq *ifr) -+static int mlx5e_hwtstamp_set_ndo(struct net_device *netdev, -+ struct kernel_hwtstamp_config *config, -+ struct netlink_ext_ack *extack) - { -- struct hwtstamp_config *cfg = &priv->hwtstamp_config; -+ struct mlx5e_priv *priv = netdev_priv(netdev); -+ -+ return mlx5e_hwtstamp_set(priv, config, extack); -+} - -+int mlx5e_hwtstamp_get(struct mlx5e_priv *priv, -+ struct kernel_hwtstamp_config *config) -+{ - if (!MLX5_CAP_GEN(priv->mdev, device_frequency_khz)) - return -EOPNOTSUPP; - -- return copy_to_user(ifr->ifr_data, cfg, sizeof(*cfg)) ? -EFAULT : 0; -+ *config = priv->hwtstamp_config; -+ -+ return 0; - } - --static int mlx5e_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) -+static int mlx5e_hwtstamp_get_ndo(struct net_device *dev, -+ struct kernel_hwtstamp_config *config) - { - struct mlx5e_priv *priv = netdev_priv(dev); - -- switch (cmd) { -- case SIOCSHWTSTAMP: -- return mlx5e_hwtstamp_set(priv, ifr); -- case SIOCGHWTSTAMP: -- return mlx5e_hwtstamp_get(priv, ifr); -- default: -- return -EOPNOTSUPP; -- } -+ return mlx5e_hwtstamp_get(priv, config); - } - - #ifdef CONFIG_MLX5_ESWITCH -@@ -5268,13 +5272,14 @@ const struct net_device_ops mlx5e_netdev_ops = { - .ndo_set_features = mlx5e_set_features, - .ndo_fix_features = mlx5e_fix_features, - .ndo_change_mtu = mlx5e_change_nic_mtu, -- .ndo_eth_ioctl = mlx5e_ioctl, - .ndo_set_tx_maxrate = mlx5e_set_tx_maxrate, - .ndo_features_check = mlx5e_features_check, - .ndo_tx_timeout = mlx5e_tx_timeout, - .ndo_bpf = mlx5e_xdp, - .ndo_xdp_xmit = mlx5e_xdp_xmit, - .ndo_xsk_wakeup = mlx5e_xsk_wakeup, -+ .ndo_hwtstamp_get = mlx5e_hwtstamp_get_ndo, -+ .ndo_hwtstamp_set = mlx5e_hwtstamp_set_ndo, - #ifdef CONFIG_MLX5_EN_ARFS - .ndo_rx_flow_steer = mlx5e_rx_flow_steer, - #endif -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -index f3a249b59482..dd8daf5af7a6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -@@ -44,6 +44,23 @@ static int mlx5i_open(struct net_device *netdev); - static int mlx5i_close(struct net_device *netdev); - static int mlx5i_change_mtu(struct net_device *netdev, int new_mtu); - -+int mlx5i_hwtstamp_set(struct net_device *dev, -+ struct kernel_hwtstamp_config *config, -+ struct netlink_ext_ack *extack) -+{ -+ struct mlx5e_priv *epriv = mlx5i_epriv(dev); -+ -+ return mlx5e_hwtstamp_set(epriv, config, extack); -+} -+ -+int mlx5i_hwtstamp_get(struct net_device *dev, -+ struct kernel_hwtstamp_config *config) -+{ -+ struct mlx5e_priv *epriv = mlx5i_epriv(dev); -+ -+ return mlx5e_hwtstamp_get(epriv, config); -+} -+ - static const struct net_device_ops mlx5i_netdev_ops = { - .ndo_open = mlx5i_open, - .ndo_stop = mlx5i_close, -@@ -51,7 +68,8 @@ static const struct net_device_ops mlx5i_netdev_ops = { - .ndo_init = mlx5i_dev_init, - .ndo_uninit = mlx5i_dev_cleanup, - .ndo_change_mtu = mlx5i_change_mtu, -- .ndo_eth_ioctl = mlx5i_ioctl, -+ .ndo_hwtstamp_get = mlx5i_hwtstamp_get, -+ .ndo_hwtstamp_set = mlx5i_hwtstamp_set, - }; - - /* IPoIB mlx5 netdev profile */ -@@ -554,20 +572,6 @@ int mlx5i_dev_init(struct net_device *dev) - return 0; - } - --int mlx5i_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) --{ -- struct mlx5e_priv *priv = mlx5i_epriv(dev); -- -- switch (cmd) { -- case SIOCSHWTSTAMP: -- return mlx5e_hwtstamp_set(priv, ifr); -- case SIOCGHWTSTAMP: -- return mlx5e_hwtstamp_get(priv, ifr); -- default: -- return -EOPNOTSUPP; -- } --} -- - void mlx5i_dev_cleanup(struct net_device *dev) - { - struct mlx5e_priv *priv = mlx5i_epriv(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h -index 2ab6437a1c49..d67d5a72bb41 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.h -@@ -88,7 +88,11 @@ struct net_device *mlx5i_pkey_get_netdev(struct net_device *netdev, u32 qpn); - /* Shared ndo functions */ - int mlx5i_dev_init(struct net_device *dev); - void mlx5i_dev_cleanup(struct net_device *dev); --int mlx5i_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd); -+int mlx5i_hwtstamp_set(struct net_device *dev, -+ struct kernel_hwtstamp_config *config, -+ struct netlink_ext_ack *extack); -+int mlx5i_hwtstamp_get(struct net_device *dev, -+ struct kernel_hwtstamp_config *config); - - /* Parent profile functions */ - int mlx5i_init(struct mlx5_core_dev *mdev, struct net_device *netdev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c -index 028a76944d82..04444dad3a0d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib_vlan.c -@@ -140,7 +140,6 @@ static int mlx5i_pkey_close(struct net_device *netdev); - static int mlx5i_pkey_dev_init(struct net_device *dev); - static void mlx5i_pkey_dev_cleanup(struct net_device *netdev); - static int mlx5i_pkey_change_mtu(struct net_device *netdev, int new_mtu); --static int mlx5i_pkey_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd); - - static const struct net_device_ops mlx5i_pkey_netdev_ops = { - .ndo_open = mlx5i_pkey_open, -@@ -149,7 +148,8 @@ static const struct net_device_ops mlx5i_pkey_netdev_ops = { - .ndo_get_stats64 = mlx5i_get_stats, - .ndo_uninit = mlx5i_pkey_dev_cleanup, - .ndo_change_mtu = mlx5i_pkey_change_mtu, -- .ndo_eth_ioctl = mlx5i_pkey_ioctl, -+ .ndo_hwtstamp_get = mlx5i_hwtstamp_get, -+ .ndo_hwtstamp_set = mlx5i_hwtstamp_set, - }; - - /* Child NDOs */ -@@ -184,11 +184,6 @@ static int mlx5i_pkey_dev_init(struct net_device *dev) - return mlx5i_dev_init(dev); - } - --static int mlx5i_pkey_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) --{ -- return mlx5i_ioctl(dev, ifr, cmd); --} -- - static void mlx5i_pkey_dev_cleanup(struct net_device *netdev) - { - mlx5i_parent_put(netdev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1607-net-mlx5e-enhance-function-structures-for-self-loopback-prev.patch b/SOURCES/1607-net-mlx5e-enhance-function-structures-for-self-loopback-prev.patch deleted file mode 100644 index 2d9e52e8d..000000000 --- a/SOURCES/1607-net-mlx5e-enhance-function-structures-for-self-loopback-prev.patch +++ /dev/null @@ -1,136 +0,0 @@ -From 3c2408d24b13ce27a3265d9cf94bac7817af07f0 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Enhance function structures for self loopback - prevention application - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 091400a5d411ee7398095ba832361eb12b345f3d -Author: Tariq Toukan -Date: Thu Oct 30 15:32:33 2025 +0200 - - net/mlx5e: Enhance function structures for self loopback prevention application - - The re-application of self loopback prevention attributes in TIRs is - necessary in old firmwares (where tis_tir_td_order cap is cleared) after - recreation of SQs. - - However, this is not needed in new firmware with tis_tir_td_order=1. - - As a preparation patch, enhance the function structures to differentiate - between an explicit loopback prevention configuration apply, and the - re-apply operation required by old firmware. - - Loopback selftests should now call mlx5e_modify_tirs_lb() directly, as - their use case is not related to the firmware limitation. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 208870fe79c1..85f940869968 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1152,7 +1152,9 @@ extern const struct ethtool_ops mlx5e_ethtool_ops; - int mlx5e_create_mkey(struct mlx5_core_dev *mdev, u32 pdn, u32 *mkey); - int mlx5e_create_mdev_resources(struct mlx5_core_dev *mdev, bool create_tises); - void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev); --int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb, -+int mlx5e_modify_tirs_lb(struct mlx5_core_dev *mdev, bool enable_uc_lb, -+ bool enable_mc_lb); -+int mlx5e_refresh_tirs(struct mlx5_core_dev *mdev, bool enable_uc_lb, - bool enable_mc_lb); - void mlx5e_mkey_set_relaxed_ordering(struct mlx5_core_dev *mdev, void *mkc); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index 30424ccad584..376a018b2db1 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -247,10 +247,9 @@ void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev) - memset(res, 0, sizeof(*res)); - } - --int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb, -- bool enable_mc_lb) -+int mlx5e_modify_tirs_lb(struct mlx5_core_dev *mdev, bool enable_uc_lb, -+ bool enable_mc_lb) - { -- struct mlx5_core_dev *mdev = priv->mdev; - struct mlx5e_tir *tir; - u8 lb_flags = 0; - int err = 0; -@@ -285,7 +284,16 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb, - - kvfree(in); - if (err) -- netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err); -+ mlx5_core_err(mdev, -+ "modify tir(0x%x) enable_lb uc(%d) mc(%d) failed, %d\n", -+ tirn, -+ enable_uc_lb, enable_mc_lb, err); - - return err; - } -+ -+int mlx5e_refresh_tirs(struct mlx5_core_dev *mdev, bool enable_uc_lb, -+ bool enable_mc_lb) -+{ -+ return mlx5e_modify_tirs_lb(mdev, enable_uc_lb, enable_mc_lb); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 2390975c1252..b08aa2c7c837 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6089,7 +6089,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv) - - static int mlx5e_update_nic_rx(struct mlx5e_priv *priv) - { -- return mlx5e_refresh_tirs(priv, false, false); -+ return mlx5e_refresh_tirs(priv->mdev, false, false); - } - - static const struct mlx5e_profile mlx5e_nic_profile = { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -index 2f7a543feca6..fcad464bc4d5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c -@@ -214,7 +214,7 @@ static int mlx5e_test_loopback_setup(struct mlx5e_priv *priv, - return err; - } - -- err = mlx5e_refresh_tirs(priv, true, false); -+ err = mlx5e_modify_tirs_lb(priv->mdev, true, false); - if (err) - goto out; - -@@ -243,7 +243,7 @@ static void mlx5e_test_loopback_cleanup(struct mlx5e_priv *priv, - mlx5_nic_vport_update_local_lb(priv->mdev, false); - - dev_remove_pack(&lbtp->pt); -- mlx5e_refresh_tirs(priv, false, false); -+ mlx5e_modify_tirs_lb(priv->mdev, false, false); - } - - static int mlx5e_cond_loopback(struct mlx5e_priv *priv) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -index dd8daf5af7a6..a5ff11922d8d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -@@ -331,7 +331,7 @@ void mlx5i_destroy_underlay_qp(struct mlx5_core_dev *mdev, u32 qpn) - - int mlx5i_update_nic_rx(struct mlx5e_priv *priv) - { -- return mlx5e_refresh_tirs(priv, true, true); -+ return mlx5e_refresh_tirs(priv->mdev, true, true); - } - - int mlx5i_create_tis(struct mlx5_core_dev *mdev, u32 underlay_qpn, u32 *tisn) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1608-net-mlx5e-use-tir-api-in-mlx5e-modify-tirs-lb.patch b/SOURCES/1608-net-mlx5e-use-tir-api-in-mlx5e-modify-tirs-lb.patch deleted file mode 100644 index e00c6c310..000000000 --- a/SOURCES/1608-net-mlx5e-use-tir-api-in-mlx5e-modify-tirs-lb.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 4ad5e38a3dab61e3f8cfceed6c47b4cd4f8e976f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:34 -0400 -Subject: [PATCH] net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5c51a86122b20326229c6c9dff4a92c186cbb6bf -Author: Tariq Toukan -Date: Thu Oct 30 15:32:34 2025 +0200 - - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() - - Extend the TIR API and use it in mlx5e_modify_tirs_lb() instead of the - explicit modify_tir code. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Dragos Tatulea - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c -index 19499072f67f..0b55e77f19c8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.c -@@ -146,6 +146,31 @@ void mlx5e_tir_builder_build_direct(struct mlx5e_tir_builder *builder) - MLX5_SET(tirc, tirc, rx_hash_fn, MLX5_RX_HASH_FN_INVERTED_XOR8); - } - -+static void mlx5e_tir_context_self_lb_block(void *tirc, bool enable_uc_lb, -+ bool enable_mc_lb) -+{ -+ u8 lb_flags = 0; -+ -+ if (enable_uc_lb) -+ lb_flags = MLX5_TIRC_SELF_LB_BLOCK_BLOCK_UNICAST; -+ if (enable_mc_lb) -+ lb_flags |= MLX5_TIRC_SELF_LB_BLOCK_BLOCK_MULTICAST; -+ -+ MLX5_SET(tirc, tirc, self_lb_block, lb_flags); -+} -+ -+void mlx5e_tir_builder_build_self_lb_block(struct mlx5e_tir_builder *builder, -+ bool enable_uc_lb, -+ bool enable_mc_lb) -+{ -+ void *tirc = mlx5e_tir_builder_get_tirc(builder); -+ -+ if (builder->modify) -+ MLX5_SET(modify_tir_in, builder->in, bitmask.self_lb_en, 1); -+ -+ mlx5e_tir_context_self_lb_block(tirc, enable_uc_lb, enable_mc_lb); -+} -+ - void mlx5e_tir_builder_build_tls(struct mlx5e_tir_builder *builder) - { - void *tirc = mlx5e_tir_builder_get_tirc(builder); -@@ -153,9 +178,7 @@ void mlx5e_tir_builder_build_tls(struct mlx5e_tir_builder *builder) - WARN_ON(builder->modify); - - MLX5_SET(tirc, tirc, tls_en, 1); -- MLX5_SET(tirc, tirc, self_lb_block, -- MLX5_TIRC_SELF_LB_BLOCK_BLOCK_UNICAST | -- MLX5_TIRC_SELF_LB_BLOCK_BLOCK_MULTICAST); -+ mlx5e_tir_context_self_lb_block(tirc, true, true); - } - - int mlx5e_tir_init(struct mlx5e_tir *tir, struct mlx5e_tir_builder *builder, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.h -index e8df3aaf6562..958eeb959a19 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/tir.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tir.h -@@ -35,6 +35,9 @@ void mlx5e_tir_builder_build_rss(struct mlx5e_tir_builder *builder, - const struct mlx5e_rss_params_traffic_type *rss_tt, - bool inner); - void mlx5e_tir_builder_build_direct(struct mlx5e_tir_builder *builder); -+void mlx5e_tir_builder_build_self_lb_block(struct mlx5e_tir_builder *builder, -+ bool enable_uc_lb, -+ bool enable_mc_lb); - void mlx5e_tir_builder_build_tls(struct mlx5e_tir_builder *builder); - - struct mlx5_core_dev; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index 376a018b2db1..022a0cf7063c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -250,44 +250,31 @@ void mlx5e_destroy_mdev_resources(struct mlx5_core_dev *mdev) - int mlx5e_modify_tirs_lb(struct mlx5_core_dev *mdev, bool enable_uc_lb, - bool enable_mc_lb) - { -+ struct mlx5e_tir_builder *builder; - struct mlx5e_tir *tir; -- u8 lb_flags = 0; -- int err = 0; -- u32 tirn = 0; -- int inlen; -- void *in; -+ int err = 0; - -- inlen = MLX5_ST_SZ_BYTES(modify_tir_in); -- in = kvzalloc(inlen, GFP_KERNEL); -- if (!in) -+ builder = mlx5e_tir_builder_alloc(true); -+ if (!builder) - return -ENOMEM; - -- if (enable_uc_lb) -- lb_flags = MLX5_TIRC_SELF_LB_BLOCK_BLOCK_UNICAST; -- -- if (enable_mc_lb) -- lb_flags |= MLX5_TIRC_SELF_LB_BLOCK_BLOCK_MULTICAST; -- -- if (lb_flags) -- MLX5_SET(modify_tir_in, in, ctx.self_lb_block, lb_flags); -- -- MLX5_SET(modify_tir_in, in, bitmask.self_lb_en, 1); -+ mlx5e_tir_builder_build_self_lb_block(builder, enable_uc_lb, -+ enable_mc_lb); - - mutex_lock(&mdev->mlx5e_res.hw_objs.td.list_lock); - list_for_each_entry(tir, &mdev->mlx5e_res.hw_objs.td.tirs_list, list) { -- tirn = tir->tirn; -- err = mlx5_core_modify_tir(mdev, tirn, in); -- if (err) -+ err = mlx5e_tir_modify(tir, builder); -+ if (err) { -+ mlx5_core_err(mdev, -+ "modify tir(0x%x) enable_lb uc(%d) mc(%d) failed, %d\n", -+ mlx5e_tir_get_tirn(tir), -+ enable_uc_lb, enable_mc_lb, err); - break; -+ } - } - mutex_unlock(&mdev->mlx5e_res.hw_objs.td.list_lock); - -- kvfree(in); -- if (err) -- mlx5_core_err(mdev, -- "modify tir(0x%x) enable_lb uc(%d) mc(%d) failed, %d\n", -- tirn, -- enable_uc_lb, enable_mc_lb, err); -+ mlx5e_tir_builder_free(builder); - - return err; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1609-net-mlx5e-allow-setting-self-loopback-prevention-bits-on-tir.patch b/SOURCES/1609-net-mlx5e-allow-setting-self-loopback-prevention-bits-on-tir.patch deleted file mode 100644 index cddfcfd1d..000000000 --- a/SOURCES/1609-net-mlx5e-allow-setting-self-loopback-prevention-bits-on-tir.patch +++ /dev/null @@ -1,107 +0,0 @@ -From 7adf722efde27ea91e0879133117958641da4dbe Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:35 -0400 -Subject: [PATCH] net/mlx5e: Allow setting self loopback prevention bits on TIR - init - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 99b002018f6a3dc08c789e2962070d6de7cb3bac -Author: Tariq Toukan -Date: Thu Oct 30 15:32:35 2025 +0200 - - net/mlx5e: Allow setting self loopback prevention bits on TIR init - - Until now, IPoIB was creating TIRs without setting self loopback - prevention, then modifying them in activation stage. - - This is a preparation patch, that will be used by IPoIB to init TIRs - properly without the need for following calls of modify_tir. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -index c96cbc4b0dbf..88b0e1050d1a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.c -@@ -231,6 +231,8 @@ mlx5e_rss_create_tir(struct mlx5e_rss *rss, enum mlx5_traffic_types tt, - rqtn, rss_inner); - mlx5e_tir_builder_build_packet_merge(builder, pkt_merge_param); - rss_tt = mlx5e_rss_get_tt_config(rss, tt); -+ mlx5e_tir_builder_build_self_lb_block(builder, rss->params.self_lb_blk, -+ rss->params.self_lb_blk); - mlx5e_tir_builder_build_rss(builder, &rss->hash, &rss_tt, inner); - - err = mlx5e_tir_init(tir, builder, rss->mdev, true); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -index 5fb03cd0a411..17664757a561 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rss.h -@@ -23,6 +23,7 @@ struct mlx5e_rss_init_params { - struct mlx5e_rss_params { - bool inner_ft_support; - u32 drop_rqn; -+ bool self_lb_blk; - }; - - struct mlx5e_rss_params_traffic_type -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -index ac26a32845d0..55c117b7d8c4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.c -@@ -71,6 +71,8 @@ static int mlx5e_rx_res_rss_init_def(struct mlx5e_rx_res *res, - rss_params = (struct mlx5e_rss_params) { - .inner_ft_support = inner_ft_support, - .drop_rqn = res->drop_rqn, -+ .self_lb_blk = -+ res->features & MLX5E_RX_RES_FEATURE_SELF_LB_BLOCK, - }; - - rss = mlx5e_rss_init(res->mdev, &rss_params, &init_params); -@@ -104,6 +106,8 @@ int mlx5e_rx_res_rss_init(struct mlx5e_rx_res *res, u32 rss_idx, unsigned int in - rss_params = (struct mlx5e_rss_params) { - .inner_ft_support = inner_ft_support, - .drop_rqn = res->drop_rqn, -+ .self_lb_blk = -+ res->features & MLX5E_RX_RES_FEATURE_SELF_LB_BLOCK, - }; - - rss = mlx5e_rss_init(res->mdev, &rss_params, &init_params); -@@ -346,6 +350,7 @@ static struct mlx5e_rx_res *mlx5e_rx_res_alloc(struct mlx5_core_dev *mdev, unsig - static int mlx5e_rx_res_channels_init(struct mlx5e_rx_res *res) - { - bool inner_ft_support = res->features & MLX5E_RX_RES_FEATURE_INNER_FT; -+ bool self_lb_blk = res->features & MLX5E_RX_RES_FEATURE_SELF_LB_BLOCK; - struct mlx5e_tir_builder *builder; - int err = 0; - int ix; -@@ -376,6 +381,8 @@ static int mlx5e_rx_res_channels_init(struct mlx5e_rx_res *res) - mlx5e_rqt_get_rqtn(&res->channels[ix].direct_rqt), - inner_ft_support); - mlx5e_tir_builder_build_packet_merge(builder, &res->pkt_merge_param); -+ mlx5e_tir_builder_build_self_lb_block(builder, self_lb_blk, -+ self_lb_blk); - mlx5e_tir_builder_build_direct(builder); - - err = mlx5e_tir_init(&res->channels[ix].direct_tir, builder, res->mdev, true); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -index 65a857c215e1..675780120a20 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/rx_res.h -@@ -21,6 +21,7 @@ enum mlx5e_rx_res_features { - MLX5E_RX_RES_FEATURE_INNER_FT = BIT(0), - MLX5E_RX_RES_FEATURE_PTP = BIT(1), - MLX5E_RX_RES_FEATURE_MULTI_VHCA = BIT(2), -+ MLX5E_RX_RES_FEATURE_SELF_LB_BLOCK = BIT(3), - }; - - /* Setup */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1610-net-mlx5-ipoib-set-self-loopback-prevention-in-tir-init.patch b/SOURCES/1610-net-mlx5-ipoib-set-self-loopback-prevention-in-tir-init.patch deleted file mode 100644 index 58b371218..000000000 --- a/SOURCES/1610-net-mlx5-ipoib-set-self-loopback-prevention-in-tir-init.patch +++ /dev/null @@ -1,55 +0,0 @@ -From e1bddea2eaecdc2d6f4985f941f1af987197ba1d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:35 -0400 -Subject: [PATCH] net/mlx5: IPoIB, set self loopback prevention in TIR init - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a4c81e72f132b93a3b920196621a7b78c71fb7fc -Author: Tariq Toukan -Date: Thu Oct 30 15:32:36 2025 +0200 - - net/mlx5: IPoIB, set self loopback prevention in TIR init - - In IPoIB, the self loopback prevention configuration apply in activation - stage has two roles: fulfill a firmware requirement for old firmware - (tis_tir_td_order=0), and update the proper configuration as it was not - set in init. - - Here we set the proper configuration in init, to allow skipping the - modify_tirs commands on new firmware in a downstream patch. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -index a5ff11922d8d..22037785d112 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ipoib.c -@@ -424,6 +424,7 @@ static void mlx5i_destroy_flow_steering(struct mlx5e_priv *priv) - static int mlx5i_init_rx(struct mlx5e_priv *priv) - { - struct mlx5_core_dev *mdev = priv->mdev; -+ enum mlx5e_rx_res_features features; - int err; - - priv->fs = mlx5e_fs_init(priv->profile, mdev, -@@ -442,7 +443,9 @@ static int mlx5i_init_rx(struct mlx5e_priv *priv) - goto err_destroy_q_counters; - } - -- priv->rx_res = mlx5e_rx_res_create(priv->mdev, 0, priv->max_nch, priv->drop_rq.rqn, -+ features = MLX5E_RX_RES_FEATURE_SELF_LB_BLOCK; -+ priv->rx_res = mlx5e_rx_res_create(priv->mdev, features, priv->max_nch, -+ priv->drop_rq.rqn, - &priv->channels.params.packet_merge, - priv->channels.params.num_channels); - if (IS_ERR(priv->rx_res)) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1611-net-mlx5e-do-not-re-apply-tir-loopback-configuration-if-not-.patch b/SOURCES/1611-net-mlx5e-do-not-re-apply-tir-loopback-configuration-if-not-.patch deleted file mode 100644 index 78550e6e0..000000000 --- a/SOURCES/1611-net-mlx5e-do-not-re-apply-tir-loopback-configuration-if-not-.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 083b2b315daab48969e31a6226515df7ef33d1b2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:35 -0400 -Subject: [PATCH] net/mlx5e: Do not re-apply TIR loopback configuration if not - necessary - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 477c352adda4ba0bd80c945ab13165161802239e -Author: Tariq Toukan -Date: Thu Oct 30 15:32:37 2025 +0200 - - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary - - On old firmware, (tis_tir_td_order=0), TIR of a transport domain should - either be created after all SQs of the same domain, or TIR.self_lb_en - should be reapplied using MODIFY_TIR, for self loopback filtering to - function correctly. - - This is not necessary anymnore on new FW (tis_tir_td_order=1), thus - there's no need for calling modify_tir operations after creating a new - set of SQs to maintain the self loopback prevention functional. - - Skip these operations. - - This saves O(max_num_channels) MODIFY_TIR firmware commands in - operations like interface up or channels configuration change. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -index 022a0cf7063c..5a2ac7b6f260 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c -@@ -282,5 +282,8 @@ int mlx5e_modify_tirs_lb(struct mlx5_core_dev *mdev, bool enable_uc_lb, - int mlx5e_refresh_tirs(struct mlx5_core_dev *mdev, bool enable_uc_lb, - bool enable_mc_lb) - { -+ if (MLX5_CAP_GEN(mdev, tis_tir_td_order)) -+ return 0; /* refresh not needed */ -+ - return mlx5e_modify_tirs_lb(mdev, enable_uc_lb, enable_mc_lb); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1612-net-mlx5e-pass-old-channels-as-argument-to-mlx5e-switch-priv.patch b/SOURCES/1612-net-mlx5e-pass-old-channels-as-argument-to-mlx5e-switch-priv.patch deleted file mode 100644 index 64a7261ea..000000000 --- a/SOURCES/1612-net-mlx5e-pass-old-channels-as-argument-to-mlx5e-switch-priv.patch +++ /dev/null @@ -1,122 +0,0 @@ -From 7cb440aa7ae915a4b220ce7984cc03306e39c7c6 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:35 -0400 -Subject: [PATCH] net/mlx5e: Pass old channels as argument to - mlx5e_switch_priv_channels - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 911e3a37b024163d8329e3560d6fd5f0f0da2558 -Author: Tariq Toukan -Date: Thu Oct 30 15:32:38 2025 +0200 - - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels - - Let the caller function mlx5e_safe_switch_params() maintain a copy - of the old channels, and pass it to mlx5e_switch_priv_channels(). - - This is in preparation for the next patch. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index b08aa2c7c837..223cbc800144 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3341,12 +3341,12 @@ static int mlx5e_switch_priv_params(struct mlx5e_priv *priv, - } - - static int mlx5e_switch_priv_channels(struct mlx5e_priv *priv, -+ struct mlx5e_channels *old_chs, - struct mlx5e_channels *new_chs, - mlx5e_fp_preactivate preactivate, - void *context) - { - struct net_device *netdev = priv->netdev; -- struct mlx5e_channels old_chs; - int carrier_ok; - int err = 0; - -@@ -3355,7 +3355,6 @@ static int mlx5e_switch_priv_channels(struct mlx5e_priv *priv, - - mlx5e_deactivate_priv_channels(priv); - -- old_chs = priv->channels; - priv->channels = *new_chs; - - /* New channels are ready to roll, call the preactivate hook if needed -@@ -3364,12 +3363,12 @@ static int mlx5e_switch_priv_channels(struct mlx5e_priv *priv, - if (preactivate) { - err = preactivate(priv, context); - if (err) { -- priv->channels = old_chs; -+ priv->channels = *old_chs; - goto out; - } - } - -- mlx5e_close_channels(&old_chs); -+ mlx5e_close_channels(old_chs); - priv->profile->update_rx(priv); - - mlx5e_selq_apply(&priv->selq); -@@ -3388,16 +3387,20 @@ int mlx5e_safe_switch_params(struct mlx5e_priv *priv, - mlx5e_fp_preactivate preactivate, - void *context, bool reset) - { -- struct mlx5e_channels *new_chs; -+ struct mlx5e_channels *old_chs, *new_chs; - int err; - - reset &= test_bit(MLX5E_STATE_OPENED, &priv->state); - if (!reset) - return mlx5e_switch_priv_params(priv, params, preactivate, context); - -+ old_chs = kzalloc(sizeof(*old_chs), GFP_KERNEL); - new_chs = kzalloc(sizeof(*new_chs), GFP_KERNEL); -- if (!new_chs) -- return -ENOMEM; -+ if (!old_chs || !new_chs) { -+ err = -ENOMEM; -+ goto err_free_chs; -+ } -+ - new_chs->params = *params; - - mlx5e_selq_prepare_params(&priv->selq, &new_chs->params); -@@ -3406,11 +3409,15 @@ int mlx5e_safe_switch_params(struct mlx5e_priv *priv, - if (err) - goto err_cancel_selq; - -- err = mlx5e_switch_priv_channels(priv, new_chs, preactivate, context); -+ *old_chs = priv->channels; -+ -+ err = mlx5e_switch_priv_channels(priv, old_chs, new_chs, -+ preactivate, context); - if (err) - goto err_close; - - kfree(new_chs); -+ kfree(old_chs); - return 0; - - err_close: -@@ -3418,7 +3425,9 @@ int mlx5e_safe_switch_params(struct mlx5e_priv *priv, - - err_cancel_selq: - mlx5e_selq_cancel(&priv->selq); -+err_free_chs: - kfree(new_chs); -+ kfree(old_chs); - return err; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1613-net-mlx5e-defer-channels-closure-to-reduce-interface-down-ti.patch b/SOURCES/1613-net-mlx5e-defer-channels-closure-to-reduce-interface-down-ti.patch deleted file mode 100644 index 60ffd57b1..000000000 --- a/SOURCES/1613-net-mlx5e-defer-channels-closure-to-reduce-interface-down-ti.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 9628d012855f087f2800246493e00999c0dd58ea Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:56:35 -0400 -Subject: [PATCH] net/mlx5e: Defer channels closure to reduce interface down - time - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3b88a535a8e10d83335f04c60aafbdfd37146a01 -Author: Tariq Toukan -Date: Thu Oct 30 15:32:39 2025 +0200 - - net/mlx5e: Defer channels closure to reduce interface down time - - Cap bit tis_tir_td_order=1 indicates that an old firmware requirement / - limitation no longer exists. When unset, the latency of several firmware - commands significantly increases with the presence of high number of - co-existing channels (both old and new sets). Hence, we used to close - unneeded old channels before invoking those firmware commands. - - Today, on capable devices, this is no longer the case. Minimize the - interface down time by deferring the old channels closure, after the - activation of the new ones. - - Perf numbers: - Measured the number of dropped packets in a simple ping flood test, - during a configuration change operation, that switches the number of - channels from 247 to 248. - - Before: 71 packets lost - After: 15 packets lost, ~80% saving. - - Signed-off-by: Tariq Toukan - Reviewed-by: Carolina Jubran - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1761831159-1013140-8-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 223cbc800144..261b96e41d7e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3368,7 +3368,8 @@ static int mlx5e_switch_priv_channels(struct mlx5e_priv *priv, - } - } - -- mlx5e_close_channels(old_chs); -+ if (!MLX5_CAP_GEN(priv->mdev, tis_tir_td_order)) -+ mlx5e_close_channels(old_chs); - priv->profile->update_rx(priv); - - mlx5e_selq_apply(&priv->selq); -@@ -3416,6 +3417,9 @@ int mlx5e_safe_switch_params(struct mlx5e_priv *priv, - if (err) - goto err_close; - -+ if (MLX5_CAP_GEN(priv->mdev, tis_tir_td_order)) -+ mlx5e_close_channels(old_chs); -+ - kfree(new_chs); - kfree(old_chs); - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1614-pci-tph-expose-pcie-tph-get-st-table-loc.patch b/SOURCES/1614-pci-tph-expose-pcie-tph-get-st-table-loc.patch deleted file mode 100644 index 3807af8e7..000000000 --- a/SOURCES/1614-pci-tph-expose-pcie-tph-get-st-table-loc.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 9a458f4698a1ae08042ed9332d3246964288e31f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 20:36:54 -0400 -Subject: [PATCH] PCI/TPH: Expose pcie_tph_get_st_table_loc() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7b8a8ec20cfce2298f6737089f5d17407ea346b4 -Author: Yishai Hadas -Date: Mon Oct 27 11:34:01 2025 +0200 - - PCI/TPH: Expose pcie_tph_get_st_table_loc() - - Expose pcie_tph_get_st_table_loc() to be used by drivers as will be done - in the next patch from the series. - - Signed-off-by: Yishai Hadas - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251027-st-direct-mode-v1-1-e0ad953866b6@nvidia.com - Acked-by: Bjorn Helgaas - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/pci/tph.c b/drivers/pci/tph.c -index 6822c2e3f93f..47a160b399f9 100644 ---- a/drivers/pci/tph.c -+++ b/drivers/pci/tph.c -@@ -155,7 +155,16 @@ static u8 get_st_modes(struct pci_dev *pdev) - return reg; - } - --static u32 get_st_table_loc(struct pci_dev *pdev) -+/** -+ * pcie_tph_get_st_table_loc - Return the device's ST table location -+ * @pdev: PCI device to query -+ * -+ * Return: -+ * PCI_TPH_LOC_NONE - Not present -+ * PCI_TPH_LOC_CAP - Located in the TPH Requester Extended Capability -+ * PCI_TPH_LOC_MSIX - Located in the MSI-X Table -+ */ -+u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev) - { - u32 reg; - -@@ -163,6 +172,7 @@ static u32 get_st_table_loc(struct pci_dev *pdev) - - return FIELD_GET(PCI_TPH_CAP_LOC_MASK, reg); - } -+EXPORT_SYMBOL(pcie_tph_get_st_table_loc); - - /* - * Return the size of ST table. If ST table is not in TPH Requester Extended -@@ -174,7 +184,7 @@ u16 pcie_tph_get_st_table_size(struct pci_dev *pdev) - u32 loc; - - /* Check ST table location first */ -- loc = get_st_table_loc(pdev); -+ loc = pcie_tph_get_st_table_loc(pdev); - - /* Convert loc to match with PCI_TPH_LOC_* defined in pci_regs.h */ - loc = FIELD_PREP(PCI_TPH_CAP_LOC_MASK, loc); -@@ -341,7 +351,7 @@ int pcie_tph_set_st_entry(struct pci_dev *pdev, unsigned int index, u16 tag) - */ - set_ctrl_reg_req_en(pdev, PCI_TPH_REQ_DISABLE); - -- loc = get_st_table_loc(pdev); -+ loc = pcie_tph_get_st_table_loc(pdev); - /* Convert loc to match with PCI_TPH_LOC_* */ - loc = FIELD_PREP(PCI_TPH_CAP_LOC_MASK, loc); - -diff --git a/include/linux/pci-tph.h b/include/linux/pci-tph.h -index 9e4e331b1603..ba28140ce670 100644 ---- a/include/linux/pci-tph.h -+++ b/include/linux/pci-tph.h -@@ -29,6 +29,7 @@ int pcie_tph_get_cpu_st(struct pci_dev *dev, - void pcie_disable_tph(struct pci_dev *pdev); - int pcie_enable_tph(struct pci_dev *pdev, int mode); - u16 pcie_tph_get_st_table_size(struct pci_dev *pdev); -+u32 pcie_tph_get_st_table_loc(struct pci_dev *pdev); - #else - static inline int pcie_tph_set_st_entry(struct pci_dev *pdev, - unsigned int index, u16 tag) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1615-net-mlx5-add-direct-st-mode-support-for-rdma.patch b/SOURCES/1615-net-mlx5-add-direct-st-mode-support-for-rdma.patch deleted file mode 100644 index da2bb3f19..000000000 --- a/SOURCES/1615-net-mlx5-add-direct-st-mode-support-for-rdma.patch +++ /dev/null @@ -1,107 +0,0 @@ -From caf19e68e6d7d37e7aabf04ad3beea4462451166 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:28 -0400 -Subject: [PATCH] net/mlx5: Add direct ST mode support for RDMA - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2d838c11e10e9169cae4f7778345c11b5447ef05 -Author: Yishai Hadas -Date: Mon Oct 27 11:34:02 2025 +0200 - - net/mlx5: Add direct ST mode support for RDMA - - Add support for direct ST mode where ST Table Location equals - PCI_TPH_LOC_NONE. - - In that case, no steering table exists, the steering tag itself will be - used directly by the SW, FW, HW from the mkey. - - This enables RDMA users to use the current exposed APIs to work in - direct mode. - - Signed-off-by: Yishai Hadas - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251027-st-direct-mode-v1-2-e0ad953866b6@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c -index 47fe215f66bf..ef06fe6cbb51 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/st.c -@@ -19,13 +19,16 @@ struct mlx5_st { - struct mutex lock; - struct xa_limit index_limit; - struct xarray idx_xa; /* key == index, value == struct mlx5_st_idx_data */ -+ u8 direct_mode : 1; - }; - - struct mlx5_st *mlx5_st_create(struct mlx5_core_dev *dev) - { - struct pci_dev *pdev = dev->pdev; - struct mlx5_st *st; -+ u8 direct_mode = 0; - u16 num_entries; -+ u32 tbl_loc; - int ret; - - if (!MLX5_CAP_GEN(dev, mkey_pcie_tph)) -@@ -40,10 +43,16 @@ struct mlx5_st *mlx5_st_create(struct mlx5_core_dev *dev) - if (!pdev->tph_cap) - return NULL; - -- num_entries = pcie_tph_get_st_table_size(pdev); -- /* We need a reserved entry for non TPH cases */ -- if (num_entries < 2) -- return NULL; -+ tbl_loc = pcie_tph_get_st_table_loc(pdev); -+ if (tbl_loc == PCI_TPH_LOC_NONE) -+ direct_mode = 1; -+ -+ if (!direct_mode) { -+ num_entries = pcie_tph_get_st_table_size(pdev); -+ /* We need a reserved entry for non TPH cases */ -+ if (num_entries < 2) -+ return NULL; -+ } - - /* The OS doesn't support ST */ - ret = pcie_enable_tph(pdev, PCI_TPH_ST_DS_MODE); -@@ -56,6 +65,10 @@ struct mlx5_st *mlx5_st_create(struct mlx5_core_dev *dev) - - mutex_init(&st->lock); - xa_init_flags(&st->idx_xa, XA_FLAGS_ALLOC); -+ st->direct_mode = direct_mode; -+ if (st->direct_mode) -+ return st; -+ - /* entry 0 is reserved for non TPH cases */ - st->index_limit.min = MLX5_MKC_PCIE_TPH_NO_STEERING_TAG_INDEX + 1; - st->index_limit.max = num_entries - 1; -@@ -96,6 +109,11 @@ int mlx5_st_alloc_index(struct mlx5_core_dev *dev, enum tph_mem_type mem_type, - if (ret) - return ret; - -+ if (st->direct_mode) { -+ *st_index = tag; -+ return 0; -+ } -+ - mutex_lock(&st->lock); - - xa_for_each(&st->idx_xa, index, idx_data) { -@@ -145,6 +163,9 @@ int mlx5_st_dealloc_index(struct mlx5_core_dev *dev, u16 st_index) - if (!st) - return -EOPNOTSUPP; - -+ if (st->direct_mode) -+ return 0; -+ - mutex_lock(&st->lock); - idx_data = xa_load(&st->idx_xa, st_index); - if (WARN_ON_ONCE(!idx_data)) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1616-net-mlx5-add-other-eswitch-hw-capabilities.patch b/SOURCES/1616-net-mlx5-add-other-eswitch-hw-capabilities.patch deleted file mode 100644 index 0ee7bae3d..000000000 --- a/SOURCES/1616-net-mlx5-add-other-eswitch-hw-capabilities.patch +++ /dev/null @@ -1,173 +0,0 @@ -From 7fc60da49f5667617b1c008424e771a0ed46da17 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:28 -0400 -Subject: [PATCH] net/mlx5: Add OTHER_ESWITCH HW capabilities - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6948417b3f1fafbeab85c051f8dba5e305a8f9c4 -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:53 2025 +0200 - - net/mlx5: Add OTHER_ESWITCH HW capabilities - - Add OTHER_ESWITCH capabilities which includes other_eswitch and - eswitch_owner_vhca_id to all steering objects. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-1-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h -index 2207404a125c..53cba23d1fcb 100644 ---- a/include/linux/mlx5/mlx5_ifc.h -+++ b/include/linux/mlx5/mlx5_ifc.h -@@ -5250,13 +5250,15 @@ struct mlx5_ifc_set_fte_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; -@@ -8808,13 +8810,15 @@ struct mlx5_ifc_destroy_flow_table_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; -@@ -8839,13 +8843,15 @@ struct mlx5_ifc_destroy_flow_group_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; -@@ -8984,13 +8990,15 @@ struct mlx5_ifc_delete_fte_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; -@@ -9534,13 +9542,15 @@ struct mlx5_ifc_create_flow_table_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x20]; - -@@ -9579,7 +9589,8 @@ struct mlx5_ifc_create_flow_group_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x20]; -@@ -9587,7 +9598,7 @@ struct mlx5_ifc_create_flow_group_in_bits { - u8 table_type[0x8]; - u8 reserved_at_88[0x4]; - u8 group_type[0x4]; -- u8 reserved_at_90[0x10]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; -@@ -11877,10 +11888,12 @@ struct mlx5_ifc_set_flow_table_root_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - -- u8 reserved_at_60[0x20]; -+ u8 reserved_at_60[0x10]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 table_type[0x8]; - u8 reserved_at_88[0x7]; -@@ -11920,14 +11933,16 @@ struct mlx5_ifc_modify_flow_table_in_bits { - u8 op_mod[0x10]; - - u8 other_vport[0x1]; -- u8 reserved_at_41[0xf]; -+ u8 other_eswitch[0x1]; -+ u8 reserved_at_42[0xe]; - u8 vport_number[0x10]; - - u8 reserved_at_60[0x10]; - u8 modify_field_select[0x10]; - - u8 table_type[0x8]; -- u8 reserved_at_88[0x18]; -+ u8 reserved_at_88[0x8]; -+ u8 eswitch_owner_vhca_id[0x10]; - - u8 reserved_at_a0[0x8]; - u8 table_id[0x18]; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1617-net-mlx5-fs-add-other-eswitch-support-for-steering-tables.patch b/SOURCES/1617-net-mlx5-fs-add-other-eswitch-support-for-steering-tables.patch deleted file mode 100644 index 1ee35a745..000000000 --- a/SOURCES/1617-net-mlx5-fs-add-other-eswitch-support-for-steering-tables.patch +++ /dev/null @@ -1,203 +0,0 @@ -From ca872d4a1b466fec01b471e20d13d29a18f41e84 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:28 -0400 -Subject: [PATCH] net/mlx5: fs, Add other_eswitch support for steering tables - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3b848dec7e821bace785b9e405bf1884c077635a -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:54 2025 +0200 - - net/mlx5: fs, Add other_eswitch support for steering tables - - Add other_eswitch support which allows flow tables creation above vports - that reside on different esw managers. - - The new flag MLX5_FLOW_TABLE_OTHER_ESWITCH indicates if the - esw_owner_vhca_id attribute is supported. - - Note that this is only supported if the Advanced-RDMA cap- - rdma_transport_manager_other_eswitch is set. - And it is the caller responsibility to check that. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-2-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -index 1af76da8b132..ced747bef641 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -@@ -239,6 +239,10 @@ static int mlx5_cmd_update_root_ft(struct mlx5_flow_root_namespace *ns, - MLX5_SET(set_flow_table_root_in, in, vport_number, ft->vport); - MLX5_SET(set_flow_table_root_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(set_flow_table_root_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(set_flow_table_root_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - - err = mlx5_cmd_exec_in(dev, set_flow_table_root, in); - if (!err && -@@ -302,6 +306,10 @@ static int mlx5_cmd_create_flow_table(struct mlx5_flow_root_namespace *ns, - MLX5_SET(create_flow_table_in, in, vport_number, ft->vport); - MLX5_SET(create_flow_table_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(create_flow_table_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(create_flow_table_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - - MLX5_SET(create_flow_table_in, in, flow_table_context.decap_en, - en_decap); -@@ -360,6 +368,10 @@ static int mlx5_cmd_destroy_flow_table(struct mlx5_flow_root_namespace *ns, - MLX5_SET(destroy_flow_table_in, in, vport_number, ft->vport); - MLX5_SET(destroy_flow_table_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(destroy_flow_table_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(destroy_flow_table_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - - err = mlx5_cmd_exec_in(dev, destroy_flow_table, in); - if (!err) -@@ -394,6 +406,10 @@ static int mlx5_cmd_modify_flow_table(struct mlx5_flow_root_namespace *ns, - MLX5_SET(modify_flow_table_in, in, vport_number, ft->vport); - MLX5_SET(modify_flow_table_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(modify_flow_table_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(modify_flow_table_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - MLX5_SET(modify_flow_table_in, in, modify_field_select, - MLX5_MODIFY_FLOW_TABLE_MISS_TABLE_ID); - if (next_ft) { -@@ -429,6 +445,10 @@ static int mlx5_cmd_create_flow_group(struct mlx5_flow_root_namespace *ns, - MLX5_SET(create_flow_group_in, in, vport_number, ft->vport); - MLX5_SET(create_flow_group_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(create_flow_group_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(create_flow_group_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - err = mlx5_cmd_exec_inout(dev, create_flow_group, in, out); - if (!err) - fg->id = MLX5_GET(create_flow_group_out, out, -@@ -451,6 +471,10 @@ static int mlx5_cmd_destroy_flow_group(struct mlx5_flow_root_namespace *ns, - MLX5_SET(destroy_flow_group_in, in, vport_number, ft->vport); - MLX5_SET(destroy_flow_group_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(destroy_flow_group_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(destroy_flow_group_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - return mlx5_cmd_exec_in(dev, destroy_flow_group, in); - } - -@@ -559,6 +583,9 @@ static int mlx5_cmd_set_fte(struct mlx5_core_dev *dev, - MLX5_SET(set_fte_in, in, vport_number, ft->vport); - MLX5_SET(set_fte_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(set_fte_in, in, eswitch_owner_vhca_id, ft->esw_owner_vhca_id); -+ MLX5_SET(set_fte_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - - in_flow_context = MLX5_ADDR_OF(set_fte_in, in, flow_context); - MLX5_SET(flow_context, in_flow_context, group_id, group_id); -@@ -788,6 +815,10 @@ static int mlx5_cmd_delete_fte(struct mlx5_flow_root_namespace *ns, - MLX5_SET(delete_fte_in, in, vport_number, ft->vport); - MLX5_SET(delete_fte_in, in, other_vport, - !!(ft->flags & MLX5_FLOW_TABLE_OTHER_VPORT)); -+ MLX5_SET(delete_fte_in, in, eswitch_owner_vhca_id, -+ ft->esw_owner_vhca_id); -+ MLX5_SET(delete_fte_in, in, other_eswitch, -+ !!(ft->flags & MLX5_FLOW_TABLE_OTHER_ESWITCH)); - - return mlx5_cmd_exec_in(dev, delete_fte, in); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 2db3ffb0a2b2..87e381c82ed3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -939,10 +939,10 @@ static struct mlx5_flow_group *alloc_insert_flow_group(struct mlx5_flow_table *f - return fg; - } - --static struct mlx5_flow_table *alloc_flow_table(int level, u16 vport, -- enum fs_flow_table_type table_type, -- enum fs_flow_table_op_mod op_mod, -- u32 flags) -+static struct mlx5_flow_table * -+alloc_flow_table(struct mlx5_flow_table_attr *ft_attr, u16 vport, -+ enum fs_flow_table_type table_type, -+ enum fs_flow_table_op_mod op_mod) - { - struct mlx5_flow_table *ft; - int ret; -@@ -957,12 +957,13 @@ static struct mlx5_flow_table *alloc_flow_table(int level, u16 vport, - return ERR_PTR(ret); - } - -- ft->level = level; -+ ft->level = ft_attr->level; - ft->node.type = FS_TYPE_FLOW_TABLE; - ft->op_mod = op_mod; - ft->type = table_type; - ft->vport = vport; -- ft->flags = flags; -+ ft->esw_owner_vhca_id = ft_attr->esw_owner_vhca_id; -+ ft->flags = ft_attr->flags; - INIT_LIST_HEAD(&ft->fwd_rules); - mutex_init(&ft->lock); - -@@ -1370,10 +1371,7 @@ static struct mlx5_flow_table *__mlx5_create_flow_table(struct mlx5_flow_namespa - /* The level is related to the - * priority level range. - */ -- ft = alloc_flow_table(ft_attr->level, -- vport, -- root->table_type, -- op_mod, ft_attr->flags); -+ ft = alloc_flow_table(ft_attr, vport, root->table_type, op_mod); - if (IS_ERR(ft)) { - err = PTR_ERR(ft); - goto unlock_root; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index 8458ce203dac..0a9a5ef34c21 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -205,6 +205,7 @@ struct mlx5_flow_table { - }; - u32 id; - u16 vport; -+ u16 esw_owner_vhca_id; - unsigned int max_fte; - unsigned int level; - enum fs_flow_table_type type; -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index 6ac76a0c3827..6325a7fa0df2 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -71,6 +71,7 @@ enum { - MLX5_FLOW_TABLE_UNMANAGED = BIT(3), - MLX5_FLOW_TABLE_OTHER_VPORT = BIT(4), - MLX5_FLOW_TABLE_UPLINK_VPORT = BIT(5), -+ MLX5_FLOW_TABLE_OTHER_ESWITCH = BIT(6), - }; - - #define LEFTOVERS_RULE_NUM 2 -@@ -208,6 +209,7 @@ struct mlx5_flow_table_attr { - u32 flags; - u16 uid; - u16 vport; -+ u16 esw_owner_vhca_id; - struct mlx5_flow_table *next_ft; - - struct { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1618-net-mlx5-fs-set-non-default-device-per-namespace.patch b/SOURCES/1618-net-mlx5-fs-set-non-default-device-per-namespace.patch deleted file mode 100644 index b1db3c463..000000000 --- a/SOURCES/1618-net-mlx5-fs-set-non-default-device-per-namespace.patch +++ /dev/null @@ -1,168 +0,0 @@ -From 8307810e0c08308cacef1229ba11018e55ea7d09 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: fs, set non default device per namespace - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 583b4fe1c19d978bb787e0adf9ce469cb7f68455 -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:55 2025 +0200 - - net/mlx5: fs, set non default device per namespace - - Add mlx5_fs_set_root_dev() function which swaps the root namespace - core device with another one for a given table_type. - - It is intended for usage only by RDMA_TRANSPORT tables in case of LAG - configuration, to allow the creation of tables during LAG always - through the LAG master device, which is valid since during LAG the - master is allowed to manage the RDMA_TRANSPORT tables of its slaves. - - In addition move the table_type enum to global include to allow its use - in a downstream patch in the RDMA driver. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-3-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 87e381c82ed3..5b210c54a592 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3308,6 +3308,62 @@ init_rdma_transport_tx_root_ns_one(struct mlx5_flow_steering *steering, - return ret; - } - -+static bool mlx5_fs_ns_is_empty(struct mlx5_flow_namespace *ns) -+{ -+ struct fs_prio *iter_prio; -+ -+ fs_for_each_prio(iter_prio, ns) { -+ if (iter_prio->num_ft) -+ return false; -+ } -+ -+ return true; -+} -+ -+int mlx5_fs_set_root_dev(struct mlx5_core_dev *dev, -+ struct mlx5_core_dev *new_dev, -+ enum fs_flow_table_type table_type) -+{ -+ struct mlx5_flow_root_namespace **root; -+ int total_vports; -+ int i; -+ -+ switch (table_type) { -+ case FS_FT_RDMA_TRANSPORT_TX: -+ root = dev->priv.steering->rdma_transport_tx_root_ns; -+ total_vports = dev->priv.steering->rdma_transport_tx_vports; -+ break; -+ case FS_FT_RDMA_TRANSPORT_RX: -+ root = dev->priv.steering->rdma_transport_rx_root_ns; -+ total_vports = dev->priv.steering->rdma_transport_rx_vports; -+ break; -+ default: -+ WARN_ON_ONCE(true); -+ return -EINVAL; -+ } -+ -+ for (i = 0; i < total_vports; i++) { -+ mutex_lock(&root[i]->chain_lock); -+ if (!mlx5_fs_ns_is_empty(&root[i]->ns)) { -+ mutex_unlock(&root[i]->chain_lock); -+ goto err; -+ } -+ root[i]->dev = new_dev; -+ mutex_unlock(&root[i]->chain_lock); -+ } -+ return 0; -+err: -+ while (i--) { -+ mutex_lock(&root[i]->chain_lock); -+ root[i]->dev = dev; -+ mutex_unlock(&root[i]->chain_lock); -+ } -+ /* If you hit this error try destroying all flow tables and try again */ -+ mlx5_core_err(dev, "Failed to set root device for RDMA TRANSPORT\n"); -+ return -EINVAL; -+} -+EXPORT_SYMBOL(mlx5_fs_set_root_dev); -+ - static int init_rdma_transport_rx_root_ns(struct mlx5_flow_steering *steering) - { - struct mlx5_core_dev *dev = steering->dev; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -index 0a9a5ef34c21..1c6591425260 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.h -@@ -103,24 +103,6 @@ enum fs_node_type { - FS_TYPE_FLOW_DEST - }; - --enum fs_flow_table_type { -- FS_FT_NIC_RX = 0x0, -- FS_FT_NIC_TX = 0x1, -- FS_FT_ESW_EGRESS_ACL = 0x2, -- FS_FT_ESW_INGRESS_ACL = 0x3, -- FS_FT_FDB = 0X4, -- FS_FT_SNIFFER_RX = 0X5, -- FS_FT_SNIFFER_TX = 0X6, -- FS_FT_RDMA_RX = 0X7, -- FS_FT_RDMA_TX = 0X8, -- FS_FT_PORT_SEL = 0X9, -- FS_FT_FDB_RX = 0xa, -- FS_FT_FDB_TX = 0xb, -- FS_FT_RDMA_TRANSPORT_RX = 0xd, -- FS_FT_RDMA_TRANSPORT_TX = 0xe, -- FS_FT_MAX_TYPE = FS_FT_RDMA_TRANSPORT_TX, --}; -- - enum fs_flow_table_op_mod { - FS_FT_OP_MOD_NORMAL, - FS_FT_OP_MOD_LAG_DEMUX, -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index 6325a7fa0df2..fe721557bd1d 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -128,6 +128,24 @@ enum { - FDB_PER_VPORT, - }; - -+enum fs_flow_table_type { -+ FS_FT_NIC_RX = 0x0, -+ FS_FT_NIC_TX = 0x1, -+ FS_FT_ESW_EGRESS_ACL = 0x2, -+ FS_FT_ESW_INGRESS_ACL = 0x3, -+ FS_FT_FDB = 0X4, -+ FS_FT_SNIFFER_RX = 0X5, -+ FS_FT_SNIFFER_TX = 0X6, -+ FS_FT_RDMA_RX = 0X7, -+ FS_FT_RDMA_TX = 0X8, -+ FS_FT_PORT_SEL = 0X9, -+ FS_FT_FDB_RX = 0xa, -+ FS_FT_FDB_TX = 0xb, -+ FS_FT_RDMA_TRANSPORT_RX = 0xd, -+ FS_FT_RDMA_TRANSPORT_TX = 0xe, -+ FS_FT_MAX_TYPE = FS_FT_RDMA_TRANSPORT_TX, -+}; -+ - struct mlx5_pkt_reformat; - struct mlx5_modify_hdr; - struct mlx5_flow_definer; -@@ -355,4 +373,8 @@ u32 mlx5_flow_table_id(struct mlx5_flow_table *ft); - - struct mlx5_flow_root_namespace * - mlx5_get_root_namespace(struct mlx5_core_dev *dev, enum mlx5_flow_namespace_type ns_type); -+ -+int mlx5_fs_set_root_dev(struct mlx5_core_dev *dev, -+ struct mlx5_core_dev *new_dev, -+ enum fs_flow_table_type table_type); - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1619-net-mlx5-mpfs-add-support-for-dynamic-enable-disable.patch b/SOURCES/1619-net-mlx5-mpfs-add-support-for-dynamic-enable-disable.patch deleted file mode 100644 index c43d1871b..000000000 --- a/SOURCES/1619-net-mlx5-mpfs-add-support-for-dynamic-enable-disable.patch +++ /dev/null @@ -1,247 +0,0 @@ -From 013c1eb99ebac50e30b766e6e16c0a25cb50c4f1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: MPFS, add support for dynamic enable/disable - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9902b6381d76ccd2e08e2703390e8c8a3bcda482 -Author: Saeed Mahameed -Date: Fri Nov 7 23:04:03 2025 -0800 - - net/mlx5: MPFS, add support for dynamic enable/disable - - MPFS (Multi PF Switch) is enabled by default in Multi-Host environments, - the driver keeps a list of desired unicast mac addresses of all vports - (vfs/Sfs) and applied to HW via L2_table FW command. - - Add API to dynamically apply the list of MACs to HW when needed for next - patches, to utilize this new API in devlink eswitch active/in-active uAPI. - - Signed-off-by: Saeed Mahameed - Signed-off-by: Adithya Jayachandran - Reviewed-by: Jiri Pirko - Link: https://patch.msgid.link/20251108070404.1551708-3-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -index 4450091e181a..99fb7a53add0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -@@ -65,13 +65,14 @@ static int del_l2table_entry_cmd(struct mlx5_core_dev *dev, u32 index) - /* UC L2 table hash node */ - struct l2table_node { - struct l2addr_node node; -- u32 index; /* index in HW l2 table */ -+ int index; /* index in HW l2 table */ - int ref_count; - }; - - struct mlx5_mpfs { - struct hlist_head hash[MLX5_L2_ADDR_HASH_SIZE]; - struct mutex lock; /* Synchronize l2 table access */ -+ bool enabled; - u32 size; - unsigned long *bitmap; - }; -@@ -114,6 +115,8 @@ int mlx5_mpfs_init(struct mlx5_core_dev *dev) - return -ENOMEM; - } - -+ mpfs->enabled = true; -+ - dev->priv.mpfs = mpfs; - return 0; - } -@@ -135,7 +138,7 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac) - struct mlx5_mpfs *mpfs = dev->priv.mpfs; - struct l2table_node *l2addr; - int err = 0; -- u32 index; -+ int index; - - if (!mpfs) - return 0; -@@ -148,30 +151,34 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac) - goto out; - } - -- err = alloc_l2table_index(mpfs, &index); -- if (err) -- goto out; -- - l2addr = l2addr_hash_add(mpfs->hash, mac, struct l2table_node, GFP_KERNEL); - if (!l2addr) { - err = -ENOMEM; -- goto hash_add_err; -+ goto out; - } - -- err = set_l2table_entry_cmd(dev, index, mac); -- if (err) -- goto set_table_entry_err; -+ index = -1; -+ -+ if (mpfs->enabled) { -+ err = alloc_l2table_index(mpfs, &index); -+ if (err) -+ goto hash_del; -+ err = set_l2table_entry_cmd(dev, index, mac); -+ if (err) -+ goto free_l2table_index; -+ mlx5_core_dbg(dev, "MPFS entry %pM, set @index (%d)\n", -+ l2addr->node.addr, l2addr->index); -+ } - - l2addr->index = index; - l2addr->ref_count = 1; - - mlx5_core_dbg(dev, "MPFS mac added %pM, index (%d)\n", mac, index); - goto out; -- --set_table_entry_err: -- l2addr_hash_del(l2addr); --hash_add_err: -+free_l2table_index: - free_l2table_index(mpfs, index); -+hash_del: -+ l2addr_hash_del(l2addr); - out: - mutex_unlock(&mpfs->lock); - return err; -@@ -183,7 +190,7 @@ int mlx5_mpfs_del_mac(struct mlx5_core_dev *dev, u8 *mac) - struct mlx5_mpfs *mpfs = dev->priv.mpfs; - struct l2table_node *l2addr; - int err = 0; -- u32 index; -+ int index; - - if (!mpfs) - return 0; -@@ -200,12 +207,87 @@ int mlx5_mpfs_del_mac(struct mlx5_core_dev *dev, u8 *mac) - goto unlock; - - index = l2addr->index; -- del_l2table_entry_cmd(dev, index); -+ if (index >= 0) { -+ del_l2table_entry_cmd(dev, index); -+ free_l2table_index(mpfs, index); -+ mlx5_core_dbg(dev, "MPFS entry %pM, deleted @index (%d)\n", -+ mac, index); -+ } - l2addr_hash_del(l2addr); -- free_l2table_index(mpfs, index); - mlx5_core_dbg(dev, "MPFS mac deleted %pM, index (%d)\n", mac, index); - unlock: - mutex_unlock(&mpfs->lock); - return err; - } - EXPORT_SYMBOL(mlx5_mpfs_del_mac); -+ -+int mlx5_mpfs_enable(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_mpfs *mpfs = dev->priv.mpfs; -+ struct l2table_node *l2addr; -+ struct hlist_node *n; -+ int err = 0, i; -+ -+ if (!mpfs) -+ return -ENODEV; -+ -+ mutex_lock(&mpfs->lock); -+ if (mpfs->enabled) -+ goto out; -+ mpfs->enabled = true; -+ mlx5_core_dbg(dev, "MPFS enabling mpfs\n"); -+ -+ mlx5_mpfs_foreach(l2addr, n, mpfs, i) { -+ u32 index; -+ -+ err = alloc_l2table_index(mpfs, &index); -+ if (err) { -+ mlx5_core_err(dev, "Failed to allocated MPFS index for %pM, err(%d)\n", -+ l2addr->node.addr, err); -+ goto out; -+ } -+ -+ err = set_l2table_entry_cmd(dev, index, l2addr->node.addr); -+ if (err) { -+ mlx5_core_err(dev, "Failed to set MPFS l2table entry for %pM index=%d, err(%d)\n", -+ l2addr->node.addr, index, err); -+ free_l2table_index(mpfs, index); -+ goto out; -+ } -+ -+ l2addr->index = index; -+ mlx5_core_dbg(dev, "MPFS entry %pM, set @index (%d)\n", -+ l2addr->node.addr, l2addr->index); -+ } -+out: -+ mutex_unlock(&mpfs->lock); -+ return err; -+} -+ -+void mlx5_mpfs_disable(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_mpfs *mpfs = dev->priv.mpfs; -+ struct l2table_node *l2addr; -+ struct hlist_node *n; -+ int i; -+ -+ if (!mpfs) -+ return; -+ -+ mutex_lock(&mpfs->lock); -+ if (!mpfs->enabled) -+ goto unlock; -+ mlx5_mpfs_foreach(l2addr, n, mpfs, i) { -+ if (l2addr->index < 0) -+ continue; -+ del_l2table_entry_cmd(dev, l2addr->index); -+ free_l2table_index(mpfs, l2addr->index); -+ mlx5_core_dbg(dev, "MPFS entry %pM, deleted @index (%d)\n", -+ l2addr->node.addr, l2addr->index); -+ l2addr->index = -1; -+ } -+ mpfs->enabled = false; -+ mlx5_core_dbg(dev, "MPFS disabled\n"); -+unlock: -+ mutex_unlock(&mpfs->lock); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.h b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.h -index 4a293542a7aa..9c63838ce1f3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.h -@@ -45,6 +45,10 @@ struct l2addr_node { - u8 addr[ETH_ALEN]; - }; - -+#define mlx5_mpfs_foreach(hs, tmp, mpfs, i) \ -+ for (i = 0; i < MLX5_L2_ADDR_HASH_SIZE; i++) \ -+ hlist_for_each_entry_safe(hs, tmp, &(mpfs)->hash[i], node.hlist) -+ - #define for_each_l2hash_node(hn, tmp, hash, i) \ - for (i = 0; i < MLX5_L2_ADDR_HASH_SIZE; i++) \ - hlist_for_each_entry_safe(hn, tmp, &(hash)[i], hlist) -@@ -82,11 +86,16 @@ struct l2addr_node { - }) - - #ifdef CONFIG_MLX5_MPFS -+struct mlx5_core_dev; - int mlx5_mpfs_init(struct mlx5_core_dev *dev); - void mlx5_mpfs_cleanup(struct mlx5_core_dev *dev); -+int mlx5_mpfs_enable(struct mlx5_core_dev *dev); -+void mlx5_mpfs_disable(struct mlx5_core_dev *dev); - #else /* #ifndef CONFIG_MLX5_MPFS */ - static inline int mlx5_mpfs_init(struct mlx5_core_dev *dev) { return 0; } - static inline void mlx5_mpfs_cleanup(struct mlx5_core_dev *dev) {} -+static inline int mlx5_mpfs_enable(struct mlx5_core_dev *dev) { return 0; } -+static inline void mlx5_mpfs_disable(struct mlx5_core_dev *dev) {} - #endif - - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1620-net-mlx5-e-switch-support-eswitch-inactive-mode.patch b/SOURCES/1620-net-mlx5-e-switch-support-eswitch-inactive-mode.patch deleted file mode 100644 index cb9b63188..000000000 --- a/SOURCES/1620-net-mlx5-e-switch-support-eswitch-inactive-mode.patch +++ /dev/null @@ -1,471 +0,0 @@ -From c62f3f0c11a849afa227a35847a2d50d58a3475d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: E-Switch, support eswitch inactive mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9da611df15aa8d519f9947b88a5c733267cba888 -Author: Saeed Mahameed -Date: Fri Nov 7 23:04:04 2025 -0800 - - net/mlx5: E-Switch, support eswitch inactive mode - - Add support for eswitch switchdev inactive mode - - Inactive mode: Drop all traffic going to FDB, Remove - mpfs l2 rules and disconnect adjacent vports. - - Active mode: Traffic flows through FDB, mpfs table populated, and - adjacent vports are connected. - - Signed-off-by: Saeed Mahameed - Signed-off-by: Adithya Jayachandran - Reviewed-by: Jiri Pirko - Link: https://patch.msgid.link/20251108070404.1551708-4-saeed@kernel.org - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -index 0091ba697bae..250af09b5af2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/adj_vport.c -@@ -4,13 +4,8 @@ - #include "fs_core.h" - #include "eswitch.h" - --enum { -- MLX5_ADJ_VPORT_DISCONNECT = 0x0, -- MLX5_ADJ_VPORT_CONNECT = 0x1, --}; -- --static int mlx5_esw_adj_vport_modify(struct mlx5_core_dev *dev, -- u16 vport, bool connect) -+int mlx5_esw_adj_vport_modify(struct mlx5_core_dev *dev, u16 vport, -+ bool connect) - { - u32 in[MLX5_ST_SZ_DW(modify_vport_state_in)] = {}; - -@@ -24,7 +19,7 @@ static int mlx5_esw_adj_vport_modify(struct mlx5_core_dev *dev, - MLX5_SET(modify_vport_state_in, in, egress_connect_valid, 1); - MLX5_SET(modify_vport_state_in, in, ingress_connect, connect); - MLX5_SET(modify_vport_state_in, in, egress_connect, connect); -- -+ MLX5_SET(modify_vport_state_in, in, admin_state, connect); - return mlx5_cmd_exec_in(dev, modify_vport_state, in); - } - -@@ -96,7 +91,6 @@ static int mlx5_esw_adj_vport_create(struct mlx5_eswitch *esw, u16 vhca_id, - if (err) - goto acl_ns_remove; - -- mlx5_esw_adj_vport_modify(esw->dev, vport_num, MLX5_ADJ_VPORT_CONNECT); - return 0; - - acl_ns_remove: -@@ -117,8 +111,7 @@ static void mlx5_esw_adj_vport_destroy(struct mlx5_eswitch *esw, - - esw_debug(esw->dev, "Destroying adjacent vport %d for vhca_id 0x%x\n", - vport_num, vport->vhca_id); -- mlx5_esw_adj_vport_modify(esw->dev, vport_num, -- MLX5_ADJ_VPORT_DISCONNECT); -+ - mlx5_esw_offloads_rep_remove(esw, vport); - mlx5_fs_vport_egress_acl_ns_remove(esw->dev->priv.steering, - vport->index); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 16eb99aba2a7..beaec450a734 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -264,6 +264,9 @@ struct mlx5_eswitch_fdb { - - struct offloads_fdb { - struct mlx5_flow_namespace *ns; -+ struct mlx5_flow_table *drop_root; -+ struct mlx5_flow_handle *drop_root_rule; -+ struct mlx5_fc *drop_root_fc; - struct mlx5_flow_table *tc_miss_table; - struct mlx5_flow_table *slow_fdb; - struct mlx5_flow_group *send_to_vport_grp; -@@ -392,6 +395,7 @@ struct mlx5_eswitch { - struct mlx5_esw_offload offloads; - u32 last_vport_idx; - int mode; -+ bool offloads_inactive; - u16 manager_vport; - u16 first_host_vport; - u8 num_peers; -@@ -634,6 +638,8 @@ const u32 *mlx5_esw_query_functions(struct mlx5_core_dev *dev); - - void mlx5_esw_adjacent_vhcas_setup(struct mlx5_eswitch *esw); - void mlx5_esw_adjacent_vhcas_cleanup(struct mlx5_eswitch *esw); -+int mlx5_esw_adj_vport_modify(struct mlx5_core_dev *dev, u16 vport, -+ bool connect); - - #define MLX5_DEBUG_ESWITCH_MASK BIT(3) - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 8eb08d2276be..8ebca0d17f65 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1577,6 +1577,7 @@ esw_chains_create(struct mlx5_eswitch *esw, struct mlx5_flow_table *miss_fdb) - attr.max_grp_num = esw->params.large_group_num; - attr.default_ft = miss_fdb; - attr.mapping = esw->offloads.reg_c0_obj_pool; -+ attr.fs_base_prio = FDB_BYPASS_PATH; - - chains = mlx5_chains_create(dev, &attr); - if (IS_ERR(chains)) { -@@ -2355,6 +2356,131 @@ static void esw_mode_change(struct mlx5_eswitch *esw, u16 mode) - mlx5_devcom_comp_unlock(esw->dev->priv.hca_devcom_comp); - } - -+static void mlx5_esw_fdb_drop_destroy(struct mlx5_eswitch *esw) -+{ -+ if (!esw->fdb_table.offloads.drop_root) -+ return; -+ -+ esw_debug(esw->dev, "Destroying FDB drop root table %#x fc %#x\n", -+ esw->fdb_table.offloads.drop_root->id, -+ esw->fdb_table.offloads.drop_root_fc->id); -+ mlx5_del_flow_rules(esw->fdb_table.offloads.drop_root_rule); -+ /* Don't free flow counter here, can be reused on a later activation */ -+ mlx5_destroy_flow_table(esw->fdb_table.offloads.drop_root); -+ esw->fdb_table.offloads.drop_root_rule = NULL; -+ esw->fdb_table.offloads.drop_root = NULL; -+} -+ -+static int mlx5_esw_fdb_drop_create(struct mlx5_eswitch *esw) -+{ -+ struct mlx5_flow_destination drop_fc_dst = {}; -+ struct mlx5_flow_table_attr ft_attr = {}; -+ struct mlx5_flow_destination *dst = NULL; -+ struct mlx5_core_dev *dev = esw->dev; -+ struct mlx5_flow_namespace *root_ns; -+ struct mlx5_flow_act flow_act = {}; -+ struct mlx5_flow_handle *flow_rule; -+ struct mlx5_flow_table *table; -+ int err = 0, dst_num = 0; -+ -+ if (esw->fdb_table.offloads.drop_root) -+ return 0; -+ -+ root_ns = esw->fdb_table.offloads.ns; -+ -+ ft_attr.prio = FDB_DROP_ROOT; -+ ft_attr.max_fte = 1; -+ ft_attr.autogroup.max_num_groups = 1; -+ table = mlx5_create_auto_grouped_flow_table(root_ns, &ft_attr); -+ if (IS_ERR(table)) { -+ esw_warn(dev, "Failed to create fdb drop root table, err %pe\n", -+ table); -+ return PTR_ERR(table); -+ } -+ -+ /* Drop FC reusable, create once on first deactivation of FDB */ -+ if (!esw->fdb_table.offloads.drop_root_fc) { -+ struct mlx5_fc *counter = mlx5_fc_create(dev, 0); -+ -+ err = PTR_ERR_OR_ZERO(counter); -+ if (err) -+ esw_warn(esw->dev, "create fdb drop fc err %d\n", err); -+ else -+ esw->fdb_table.offloads.drop_root_fc = counter; -+ } -+ -+ flow_act.action = MLX5_FLOW_CONTEXT_ACTION_DROP; -+ -+ if (esw->fdb_table.offloads.drop_root_fc) { -+ flow_act.action |= MLX5_FLOW_CONTEXT_ACTION_COUNT; -+ drop_fc_dst.type = MLX5_FLOW_DESTINATION_TYPE_COUNTER; -+ drop_fc_dst.counter = esw->fdb_table.offloads.drop_root_fc; -+ dst = &drop_fc_dst; -+ dst_num++; -+ } -+ -+ flow_rule = mlx5_add_flow_rules(table, NULL, &flow_act, dst, dst_num); -+ err = PTR_ERR_OR_ZERO(flow_rule); -+ if (err) { -+ esw_warn(esw->dev, -+ "fs offloads: Failed to add vport rx drop rule err %d\n", -+ err); -+ goto err_flow_rule; -+ } -+ -+ esw->fdb_table.offloads.drop_root = table; -+ esw->fdb_table.offloads.drop_root_rule = flow_rule; -+ esw_debug(esw->dev, "Created FDB drop root table %#x fc %#x\n", -+ table->id, dst ? dst->counter->id : 0); -+ return 0; -+ -+err_flow_rule: -+ /* no need to free drop fc, esw_offloads_steering_cleanup will do it */ -+ mlx5_destroy_flow_table(table); -+ return err; -+} -+ -+static void mlx5_esw_fdb_active(struct mlx5_eswitch *esw) -+{ -+ struct mlx5_vport *vport; -+ unsigned long i; -+ -+ mlx5_esw_fdb_drop_destroy(esw); -+ mlx5_mpfs_enable(esw->dev); -+ -+ mlx5_esw_for_each_vf_vport(esw, i, vport, U16_MAX) { -+ if (!vport->adjacent) -+ continue; -+ esw_debug(esw->dev, "Connecting vport %d to eswitch\n", -+ vport->vport); -+ mlx5_esw_adj_vport_modify(esw->dev, vport->vport, true); -+ } -+ -+ esw->offloads_inactive = false; -+ esw_warn(esw->dev, "MPFS/FDB active\n"); -+} -+ -+static void mlx5_esw_fdb_inactive(struct mlx5_eswitch *esw) -+{ -+ struct mlx5_vport *vport; -+ unsigned long i; -+ -+ mlx5_mpfs_disable(esw->dev); -+ mlx5_esw_fdb_drop_create(esw); -+ -+ mlx5_esw_for_each_vf_vport(esw, i, vport, U16_MAX) { -+ if (!vport->adjacent) -+ continue; -+ esw_debug(esw->dev, "Disconnecting vport %u from eswitch\n", -+ vport->vport); -+ -+ mlx5_esw_adj_vport_modify(esw->dev, vport->vport, false); -+ } -+ -+ esw->offloads_inactive = true; -+ esw_warn(esw->dev, "MPFS/FDB inactive\n"); -+} -+ - static int esw_offloads_start(struct mlx5_eswitch *esw, - struct netlink_ext_ack *extack) - { -@@ -3438,6 +3564,10 @@ static int esw_offloads_steering_init(struct mlx5_eswitch *esw) - - static void esw_offloads_steering_cleanup(struct mlx5_eswitch *esw) - { -+ mlx5_esw_fdb_drop_destroy(esw); -+ if (esw->fdb_table.offloads.drop_root_fc) -+ mlx5_fc_destroy(esw->dev, esw->fdb_table.offloads.drop_root_fc); -+ esw->fdb_table.offloads.drop_root_fc = NULL; - esw_destroy_vport_rx_drop_rule(esw); - esw_destroy_vport_rx_drop_group(esw); - esw_destroy_vport_rx_group(esw); -@@ -3600,6 +3730,11 @@ int esw_offloads_enable(struct mlx5_eswitch *esw) - if (err) - goto err_steering_init; - -+ if (esw->offloads_inactive) -+ mlx5_esw_fdb_inactive(esw); -+ else -+ mlx5_esw_fdb_active(esw); -+ - /* Representor will control the vport link state */ - mlx5_esw_for_each_vf_vport(esw, i, vport, esw->esw_funcs.num_vfs) - vport->info.link_state = MLX5_VPORT_ADMIN_STATE_DOWN; -@@ -3666,6 +3801,9 @@ void esw_offloads_disable(struct mlx5_eswitch *esw) - esw_offloads_metadata_uninit(esw); - mlx5_rdma_disable_roce(esw->dev); - mlx5_esw_adjacent_vhcas_cleanup(esw); -+ /* must be done after vhcas cleanup to avoid adjacent vports connect */ -+ if (esw->offloads_inactive) -+ mlx5_esw_fdb_active(esw); /* legacy mode always active */ - mutex_destroy(&esw->offloads.termtbl_mutex); - } - -@@ -3676,6 +3814,7 @@ static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode) - *mlx5_mode = MLX5_ESWITCH_LEGACY; - break; - case DEVLINK_ESWITCH_MODE_SWITCHDEV: -+ case DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE: - *mlx5_mode = MLX5_ESWITCH_OFFLOADS; - break; - default: -@@ -3685,14 +3824,17 @@ static int esw_mode_from_devlink(u16 mode, u16 *mlx5_mode) - return 0; - } - --static int esw_mode_to_devlink(u16 mlx5_mode, u16 *mode) -+static int esw_mode_to_devlink(struct mlx5_eswitch *esw, u16 *mode) - { -- switch (mlx5_mode) { -+ switch (esw->mode) { - case MLX5_ESWITCH_LEGACY: - *mode = DEVLINK_ESWITCH_MODE_LEGACY; - break; - case MLX5_ESWITCH_OFFLOADS: -- *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV; -+ if (esw->offloads_inactive) -+ *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE; -+ else -+ *mode = DEVLINK_ESWITCH_MODE_SWITCHDEV; - break; - default: - return -EINVAL; -@@ -3798,6 +3940,45 @@ static bool mlx5_devlink_netdev_netns_immutable_set(struct devlink *devlink, - return ret; - } - -+/* Returns true when only changing between active and inactive switchdev mode */ -+static bool mlx5_devlink_switchdev_active_mode_change(struct mlx5_eswitch *esw, -+ u16 devlink_mode) -+{ -+ /* current mode is not switchdev */ -+ if (esw->mode != MLX5_ESWITCH_OFFLOADS) -+ return false; -+ -+ /* new mode is not switchdev */ -+ if (devlink_mode != DEVLINK_ESWITCH_MODE_SWITCHDEV && -+ devlink_mode != DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE) -+ return false; -+ -+ /* already inactive: no change in current state */ -+ if (devlink_mode == DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE && -+ esw->offloads_inactive) -+ return false; -+ -+ /* already active: no change in current state */ -+ if (devlink_mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && -+ !esw->offloads_inactive) -+ return false; -+ -+ down_write(&esw->mode_lock); -+ esw->offloads_inactive = !esw->offloads_inactive; -+ esw->eswitch_operation_in_progress = true; -+ up_write(&esw->mode_lock); -+ -+ if (esw->offloads_inactive) -+ mlx5_esw_fdb_inactive(esw); -+ else -+ mlx5_esw_fdb_active(esw); -+ -+ down_write(&esw->mode_lock); -+ esw->eswitch_operation_in_progress = false; -+ up_write(&esw->mode_lock); -+ return true; -+} -+ - int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - struct netlink_ext_ack *extack) - { -@@ -3812,12 +3993,16 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - if (esw_mode_from_devlink(mode, &mlx5_mode)) - return -EINVAL; - -- if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && mlx5_get_sd(esw->dev)) { -+ if (mlx5_mode == MLX5_ESWITCH_OFFLOADS && mlx5_get_sd(esw->dev)) { - NL_SET_ERR_MSG_MOD(extack, - "Can't change E-Switch mode to switchdev when multi-PF netdev (Socket Direct) is configured."); - return -EPERM; - } - -+ /* Avoid try_lock, active/inactive mode change is not restricted */ -+ if (mlx5_devlink_switchdev_active_mode_change(esw, mode)) -+ return 0; -+ - mlx5_lag_disable_change(esw->dev); - err = mlx5_esw_try_lock(esw); - if (err < 0) { -@@ -3840,7 +4025,7 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - esw->eswitch_operation_in_progress = true; - up_write(&esw->mode_lock); - -- if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && -+ if (mlx5_mode == MLX5_ESWITCH_OFFLOADS && - !mlx5_devlink_netdev_netns_immutable_set(devlink, true)) { - NL_SET_ERR_MSG_MOD(extack, - "Can't change E-Switch mode to switchdev when netdev net namespace has diverged from the devlink's."); -@@ -3848,25 +4033,27 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - goto skip; - } - -- if (mode == DEVLINK_ESWITCH_MODE_LEGACY) -+ if (mlx5_mode == MLX5_ESWITCH_LEGACY) - esw->dev->priv.flags |= MLX5_PRIV_FLAGS_SWITCH_LEGACY; - mlx5_eswitch_disable_locked(esw); -- if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV) { -+ if (mlx5_mode == MLX5_ESWITCH_OFFLOADS) { - if (mlx5_devlink_trap_get_num_active(esw->dev)) { - NL_SET_ERR_MSG_MOD(extack, - "Can't change mode while devlink traps are active"); - err = -EOPNOTSUPP; - goto skip; - } -+ esw->offloads_inactive = -+ (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV_INACTIVE); - err = esw_offloads_start(esw, extack); -- } else if (mode == DEVLINK_ESWITCH_MODE_LEGACY) { -+ } else if (mlx5_mode == MLX5_ESWITCH_LEGACY) { - err = esw_offloads_stop(esw, extack); - } else { - err = -EINVAL; - } - - skip: -- if (mode == DEVLINK_ESWITCH_MODE_SWITCHDEV && err) -+ if (mlx5_mode == MLX5_ESWITCH_OFFLOADS && err) - mlx5_devlink_netdev_netns_immutable_set(devlink, false); - down_write(&esw->mode_lock); - esw->eswitch_operation_in_progress = false; -@@ -3885,7 +4072,7 @@ int mlx5_devlink_eswitch_mode_get(struct devlink *devlink, u16 *mode) - if (IS_ERR(esw)) - return PTR_ERR(esw); - -- return esw_mode_to_devlink(esw->mode, mode); -+ return esw_mode_to_devlink(esw, mode); - } - - static int mlx5_esw_vports_inline_set(struct mlx5_eswitch *esw, u8 mlx5_mode, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -index 5b210c54a592..2b755a0035ce 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c -@@ -3574,6 +3574,11 @@ static int init_fdb_root_ns(struct mlx5_flow_steering *steering) - if (!steering->fdb_root_ns) - return -ENOMEM; - -+ maj_prio = fs_create_prio(&steering->fdb_root_ns->ns, FDB_DROP_ROOT, 1); -+ err = PTR_ERR_OR_ZERO(maj_prio); -+ if (err) -+ goto out_err; -+ - err = create_fdb_bypass(steering); - if (err) - goto out_err; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -index 99fb7a53add0..4a88a42ae4f7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c -@@ -167,7 +167,7 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac) - if (err) - goto free_l2table_index; - mlx5_core_dbg(dev, "MPFS entry %pM, set @index (%d)\n", -- l2addr->node.addr, l2addr->index); -+ l2addr->node.addr, index); - } - - l2addr->index = index; -diff --git a/include/linux/mlx5/fs.h b/include/linux/mlx5/fs.h -index fe721557bd1d..9cadb1d5e6df 100644 ---- a/include/linux/mlx5/fs.h -+++ b/include/linux/mlx5/fs.h -@@ -117,6 +117,7 @@ enum mlx5_flow_namespace_type { - }; - - enum { -+ FDB_DROP_ROOT, - FDB_BYPASS_PATH, - FDB_CRYPTO_INGRESS, - FDB_TC_OFFLOAD, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1621-net-mlx5-expose-definition-for-1600gbps-link-mode.patch b/SOURCES/1621-net-mlx5-expose-definition-for-1600gbps-link-mode.patch deleted file mode 100644 index 406d7a521..000000000 --- a/SOURCES/1621-net-mlx5-expose-definition-for-1600gbps-link-mode.patch +++ /dev/null @@ -1,39 +0,0 @@ -From e4e0b1c258bc9c16e4824753b52ae59780d8fc9f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: Expose definition for 1600Gbps link mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5422318e27d7a4662701f518e2e51b9f73a331b1 -Author: Tariq Toukan -Date: Tue Nov 11 14:24:48 2025 +0200 - - net/mlx5: Expose definition for 1600Gbps link mode - - This patch exposes new link mode for 1600Gbps, utilizing 8 lanes at - 200Gbps per lane. - - Co-developed-by: Yael Chemla - Reviewed-by: Shahar Shitrit - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1762863888-1092798-1-git-send-email-tariqt@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/include/linux/mlx5/port.h b/include/linux/mlx5/port.h -index 58770b86f793..1df9d9a57bbc 100644 ---- a/include/linux/mlx5/port.h -+++ b/include/linux/mlx5/port.h -@@ -112,6 +112,7 @@ enum mlx5e_ext_link_mode { - MLX5E_400GAUI_2_400GBASE_CR2_KR2 = 17, - MLX5E_800GAUI_8_800GBASE_CR8_KR8 = 19, - MLX5E_800GAUI_4_800GBASE_CR4_KR4 = 20, -+ MLX5E_1600TAUI_8_1600TBASE_CR8_KR8 = 23, - MLX5E_EXT_LINK_MODES_NUMBER, - }; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1622-mlx5-extract-grxrings-from-get-rxnfc.patch b/SOURCES/1622-mlx5-extract-grxrings-from-get-rxnfc.patch deleted file mode 100644 index 101f8d24e..000000000 --- a/SOURCES/1622-mlx5-extract-grxrings-from-get-rxnfc.patch +++ /dev/null @@ -1,119 +0,0 @@ -From 632bcac88d530e5d0155819e9828957287db541a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] mlx5: extract GRXRINGS from .get_rxnfc - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 945499665f63197801b64fabb0bccf9d15ed09bf -Author: Breno Leitao -Date: Thu Nov 13 08:46:04 2025 -0800 - - mlx5: extract GRXRINGS from .get_rxnfc - - Commit 84eaf4359c36 ("net: ethtool: add get_rx_ring_count callback to - optimize RX ring queries") added specific support for GRXRINGS callback, - simplifying .get_rxnfc. - - Remove the handling of GRXRINGS in .get_rxnfc() by moving it to the new - .get_rx_ring_count() for both the mlx5 ethernet and IPoIB drivers. - - The ETHTOOL_GRXRINGS handling was previously kept in .get_rxnfc() to - support "ethtool -x" when CONFIG_MLX5_EN_RXNFC=n. With the new - dedicated .get_rx_ring_count() callback, this is no longer necessary. - - This simplifies the RX ring count retrieval and aligns mlx5 with the new - ethtool API for querying RX ring parameters. - - Signed-off-by: Breno Leitao - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20251113-mlx_grxrings-v1-2-0017f2af7dd0@debian.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 5a0f5589b894..61760af93969 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -2496,21 +2496,18 @@ static int mlx5e_set_rxfh_fields(struct net_device *dev, - return mlx5e_ethtool_set_rxfh_fields(priv, cmd, extack); - } - -+static u32 mlx5e_get_rx_ring_count(struct net_device *dev) -+{ -+ struct mlx5e_priv *priv = netdev_priv(dev); -+ -+ return priv->channels.params.num_channels; -+} -+ - static int mlx5e_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info, - u32 *rule_locs) - { - struct mlx5e_priv *priv = netdev_priv(dev); - -- /* ETHTOOL_GRXRINGS is needed by ethtool -x which is not part -- * of rxnfc. We keep this logic out of mlx5e_ethtool_get_rxnfc, -- * to avoid breaking "ethtool -x" when mlx5e_ethtool_get_rxnfc -- * is compiled out via CONFIG_MLX5_EN_RXNFC=n. -- */ -- if (info->cmd == ETHTOOL_GRXRINGS) { -- info->data = priv->channels.params.num_channels; -- return 0; -- } -- - return mlx5e_ethtool_get_rxnfc(priv, info, rule_locs); - } - -@@ -2770,6 +2767,7 @@ const struct ethtool_ops mlx5e_ethtool_ops = { - .remove_rxfh_context = mlx5e_remove_rxfh_context, - .get_rxnfc = mlx5e_get_rxnfc, - .set_rxnfc = mlx5e_set_rxnfc, -+ .get_rx_ring_count = mlx5e_get_rx_ring_count, - .get_tunable = mlx5e_get_tunable, - .set_tunable = mlx5e_set_tunable, - .get_pause_stats = mlx5e_get_pause_stats, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c -index 4b3430ac3905..3b2f54ca30a8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/ipoib/ethtool.c -@@ -266,21 +266,18 @@ static int mlx5i_set_rxnfc(struct net_device *dev, struct ethtool_rxnfc *cmd) - return mlx5e_ethtool_set_rxnfc(priv, cmd); - } - -+static u32 mlx5i_get_rx_ring_count(struct net_device *dev) -+{ -+ struct mlx5e_priv *priv = mlx5i_epriv(dev); -+ -+ return priv->channels.params.num_channels; -+} -+ - static int mlx5i_get_rxnfc(struct net_device *dev, struct ethtool_rxnfc *info, - u32 *rule_locs) - { - struct mlx5e_priv *priv = mlx5i_epriv(dev); - -- /* ETHTOOL_GRXRINGS is needed by ethtool -x which is not part -- * of rxnfc. We keep this logic out of mlx5e_ethtool_get_rxnfc, -- * to avoid breaking "ethtool -x" when mlx5e_ethtool_get_rxnfc -- * is compiled out via CONFIG_MLX5_EN_RXNFC=n. -- */ -- if (info->cmd == ETHTOOL_GRXRINGS) { -- info->data = priv->channels.params.num_channels; -- return 0; -- } -- - return mlx5e_ethtool_get_rxnfc(priv, info, rule_locs); - } - -@@ -304,6 +301,7 @@ const struct ethtool_ops mlx5i_ethtool_ops = { - .set_rxfh_fields = mlx5i_set_rxfh_fields, - .get_rxnfc = mlx5i_get_rxnfc, - .set_rxnfc = mlx5i_set_rxnfc, -+ .get_rx_ring_count = mlx5i_get_rx_ring_count, - .get_link_ksettings = mlx5i_get_link_ksettings, - .get_link = ethtool_op_get_link, - }; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1623-net-mlx5-refactor-eeprom-query-error-handling-to-return-stat.patch b/SOURCES/1623-net-mlx5-refactor-eeprom-query-error-handling-to-return-stat.patch deleted file mode 100644 index b642a9927..000000000 --- a/SOURCES/1623-net-mlx5-refactor-eeprom-query-error-handling-to-return-stat.patch +++ /dev/null @@ -1,234 +0,0 @@ -From 4da9c7c34673ba1c1c8e3c8b6a85a632db909986 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: Refactor EEPROM query error handling to return - status separately - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2e4c44b12f4da60d3e8dcbc1ccf38bb28a878050 -Author: Gal Pressman -Date: Mon Nov 17 23:42:05 2025 +0200 - - net/mlx5: Refactor EEPROM query error handling to return status separately - - Matthew and Jakub reported [1] issues where inventory automation tools - are calling EEPROM query repeatedly on a port that doesn't have an SFP - connected, resulting in millions of error prints. - - Move MCIA register status extraction from the query functions to the - callers, allowing use of extack reporting instead of a dmesg print when - using the netlink API. - - [1] https://lore.kernel.org/netdev/20251028194011.39877-1-mattc@purestorage.com/ - - Cc: Matthew W Carlis - Signed-off-by: Gal Pressman - Reviewed-by: Jianbo Liu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763415729-1238421-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 61760af93969..6e12bd196ec9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -2026,7 +2026,7 @@ static int mlx5e_get_module_info(struct net_device *netdev, - int size_read = 0; - u8 data[4] = {0}; - -- size_read = mlx5_query_module_eeprom(dev, 0, 2, data); -+ size_read = mlx5_query_module_eeprom(dev, 0, 2, data, NULL); - if (size_read < 2) - return -EIO; - -@@ -2068,6 +2068,7 @@ static int mlx5e_get_module_eeprom(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - int offset = ee->offset; - int size_read; -+ u8 status = 0; - int i = 0; - - if (!ee->len) -@@ -2077,15 +2078,15 @@ static int mlx5e_get_module_eeprom(struct net_device *netdev, - - while (i < ee->len) { - size_read = mlx5_query_module_eeprom(mdev, offset, ee->len - i, -- data + i); -- -+ data + i, &status); - if (!size_read) - /* Done reading */ - return 0; - - if (size_read < 0) { -- netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n", -- __func__, size_read); -+ netdev_err(netdev, -+ "%s: mlx5_query_eeprom failed:0x%x, status %u\n", -+ __func__, size_read, status); - return size_read; - } - -@@ -2105,6 +2106,7 @@ static int mlx5e_get_module_eeprom_by_page(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - u8 *data = page_data->data; - int size_read; -+ u8 status = 0; - int i = 0; - - if (!page_data->length) -@@ -2118,7 +2120,8 @@ static int mlx5e_get_module_eeprom_by_page(struct net_device *netdev, - query.page = page_data->page; - while (i < page_data->length) { - query.size = page_data->length - i; -- size_read = mlx5_query_module_eeprom_by_page(mdev, &query, data + i); -+ size_read = mlx5_query_module_eeprom_by_page(mdev, &query, -+ data + i, &status); - - /* Done reading, return how many bytes was read */ - if (!size_read) -@@ -2127,8 +2130,8 @@ static int mlx5e_get_module_eeprom_by_page(struct net_device *netdev, - if (size_read < 0) { - NL_SET_ERR_MSG_FMT_MOD( - extack, -- "Query module eeprom by page failed, read %u bytes, err %d", -- i, size_read); -+ "Query module eeprom by page failed, read %u bytes, err %d, status %u", -+ i, size_read, status); - return size_read; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index acef7d0ffa09..cfebc110c02f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -357,11 +357,11 @@ int mlx5_set_port_fcs(struct mlx5_core_dev *mdev, u8 enable); - void mlx5_query_port_fcs(struct mlx5_core_dev *mdev, bool *supported, - bool *enabled); - int mlx5_query_module_eeprom(struct mlx5_core_dev *dev, -- u16 offset, u16 size, u8 *data); -+ u16 offset, u16 size, u8 *data, u8 *status); - int - mlx5_query_module_eeprom_by_page(struct mlx5_core_dev *dev, - struct mlx5_module_eeprom_query_params *params, -- u8 *data); -+ u8 *data, u8 *status); - - int mlx5_query_port_dcbx_param(struct mlx5_core_dev *mdev, u32 *out); - int mlx5_set_port_dcbx_param(struct mlx5_core_dev *mdev, u32 *in); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c -index aa9f2b0a77d3..e4b1dfafb41f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c -@@ -289,11 +289,11 @@ int mlx5_query_module_num(struct mlx5_core_dev *dev, int *module_num) - } - - static int mlx5_query_module_id(struct mlx5_core_dev *dev, int module_num, -- u8 *module_id) -+ u8 *module_id, u8 *status) - { - u32 in[MLX5_ST_SZ_DW(mcia_reg)] = {}; - u32 out[MLX5_ST_SZ_DW(mcia_reg)]; -- int err, status; -+ int err; - u8 *ptr; - - MLX5_SET(mcia_reg, in, i2c_device_address, MLX5_I2C_ADDR_LOW); -@@ -308,12 +308,12 @@ static int mlx5_query_module_id(struct mlx5_core_dev *dev, int module_num, - if (err) - return err; - -- status = MLX5_GET(mcia_reg, out, status); -- if (status) { -- mlx5_core_err(dev, "query_mcia_reg failed: status: 0x%x\n", -- status); -+ if (MLX5_GET(mcia_reg, out, status)) { -+ if (status) -+ *status = MLX5_GET(mcia_reg, out, status); - return -EIO; - } -+ - ptr = MLX5_ADDR_OF(mcia_reg, out, dword_0); - - *module_id = ptr[0]; -@@ -370,13 +370,14 @@ static int mlx5_mcia_max_bytes(struct mlx5_core_dev *dev) - } - - static int mlx5_query_mcia(struct mlx5_core_dev *dev, -- struct mlx5_module_eeprom_query_params *params, u8 *data) -+ struct mlx5_module_eeprom_query_params *params, -+ u8 *data, u8 *status) - { - u32 in[MLX5_ST_SZ_DW(mcia_reg)] = {}; - u32 out[MLX5_ST_SZ_DW(mcia_reg)]; -- int status, err; - void *ptr; - u16 size; -+ int err; - - size = min_t(int, params->size, mlx5_mcia_max_bytes(dev)); - -@@ -392,12 +393,9 @@ static int mlx5_query_mcia(struct mlx5_core_dev *dev, - if (err) - return err; - -- status = MLX5_GET(mcia_reg, out, status); -- if (status) { -- mlx5_core_err(dev, "query_mcia_reg failed: status: 0x%x\n", -- status); -+ *status = MLX5_GET(mcia_reg, out, status); -+ if (*status) - return -EIO; -- } - - ptr = MLX5_ADDR_OF(mcia_reg, out, dword_0); - memcpy(data, ptr, size); -@@ -406,7 +404,7 @@ static int mlx5_query_mcia(struct mlx5_core_dev *dev, - } - - int mlx5_query_module_eeprom(struct mlx5_core_dev *dev, -- u16 offset, u16 size, u8 *data) -+ u16 offset, u16 size, u8 *data, u8 *status) - { - struct mlx5_module_eeprom_query_params query = {0}; - u8 module_id; -@@ -416,7 +414,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev, - if (err) - return err; - -- err = mlx5_query_module_id(dev, query.module_number, &module_id); -+ err = mlx5_query_module_id(dev, query.module_number, &module_id, -+ status); - if (err) - return err; - -@@ -441,12 +440,12 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev, - query.size = size; - query.offset = offset; - -- return mlx5_query_mcia(dev, &query, data); -+ return mlx5_query_mcia(dev, &query, data, status); - } - - int mlx5_query_module_eeprom_by_page(struct mlx5_core_dev *dev, - struct mlx5_module_eeprom_query_params *params, -- u8 *data) -+ u8 *data, u8 *status) - { - int err; - -@@ -460,7 +459,7 @@ int mlx5_query_module_eeprom_by_page(struct mlx5_core_dev *dev, - return -EINVAL; - } - -- return mlx5_query_mcia(dev, params, data); -+ return mlx5_query_mcia(dev, params, data, status); - } - - static int mlx5_query_port_pvlc(struct mlx5_core_dev *dev, u32 *pvlc, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1624-net-mlx5e-recover-sq-on-excessive-ptp-tx-timestamp-delta.patch b/SOURCES/1624-net-mlx5e-recover-sq-on-excessive-ptp-tx-timestamp-delta.patch deleted file mode 100644 index 52c7d827e..000000000 --- a/SOURCES/1624-net-mlx5e-recover-sq-on-excessive-ptp-tx-timestamp-delta.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 37ec5748002c5268991e309587e2a16f8a434b25 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5e: Recover SQ on excessive PTP TX timestamp delta - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 391dad2e686f214932f769847cc8603a7df389eb -Author: Carolina Jubran -Date: Mon Nov 17 23:42:06 2025 +0200 - - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta - - Extend the TX timestamp handler to recover the SQ when the difference - between the port and CQE TX timestamps is abnormally large. - - The current logic aborts timestamp delivery if the delta exceeds - 1/128 seconds, which matches the maximum expected packet interval in - ptp4l. A larger delta makes the timestamps unreliable. - - This change adds recovery if the delta exceeds 0.5 seconds. Such a - large gap should not occur in normal operation and indicates that - firmware is stuck or metadata tracking is out of sync, leading to stale - or mismatched timestamps. Recovering the SQ ensures forward progress - and avoids silently dropping invalid timestamps. - - The timestamp handler now takes mlx5e_ptpsq directly to access both CQ - stats and the recovery state. - - Signed-off-by: Carolina Jubran - Reviewed-by: Shahar Shitrit - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763415729-1238421-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -index 92b57e3aaa85..bd58c1771ac0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.c -@@ -81,7 +81,7 @@ static struct mlx5e_skb_cb_hwtstamp *mlx5e_skb_cb_get_hwts(struct sk_buff *skb) - } - - static void mlx5e_skb_cb_hwtstamp_tx(struct sk_buff *skb, -- struct mlx5e_ptp_cq_stats *cq_stats) -+ struct mlx5e_ptpsq *ptpsq) - { - struct skb_shared_hwtstamps hwts = {}; - ktime_t diff; -@@ -91,8 +91,17 @@ static void mlx5e_skb_cb_hwtstamp_tx(struct sk_buff *skb, - - /* Maximal allowed diff is 1 / 128 second */ - if (diff > (NSEC_PER_SEC >> 7)) { -- cq_stats->abort++; -- cq_stats->abort_abs_diff_ns += diff; -+ struct mlx5e_txqsq *sq = &ptpsq->txqsq; -+ -+ ptpsq->cq_stats->abort++; -+ ptpsq->cq_stats->abort_abs_diff_ns += diff; -+ if (diff > (NSEC_PER_SEC >> 1) && -+ !test_and_set_bit(MLX5E_SQ_STATE_RECOVERING, &sq->state)) { -+ netdev_warn(sq->channel->netdev, -+ "PTP TX timestamp difference between CQE and port exceeds threshold: %lld ns, recovering SQ %u\n", -+ (s64)diff, sq->sqn); -+ queue_work(sq->priv->wq, &ptpsq->report_unhealthy_work); -+ } - return; - } - -@@ -102,7 +111,7 @@ static void mlx5e_skb_cb_hwtstamp_tx(struct sk_buff *skb, - - void mlx5e_skb_cb_hwtstamp_handler(struct sk_buff *skb, int hwtstamp_type, - ktime_t hwtstamp, -- struct mlx5e_ptp_cq_stats *cq_stats) -+ struct mlx5e_ptpsq *ptpsq) - { - switch (hwtstamp_type) { - case (MLX5E_SKB_CB_CQE_HWTSTAMP): -@@ -120,7 +129,7 @@ void mlx5e_skb_cb_hwtstamp_handler(struct sk_buff *skb, int hwtstamp_type, - !mlx5e_skb_cb_get_hwts(skb)->port_hwtstamp) - return; - -- mlx5e_skb_cb_hwtstamp_tx(skb, cq_stats); -+ mlx5e_skb_cb_hwtstamp_tx(skb, ptpsq); - memset(skb->cb, 0, sizeof(struct mlx5e_skb_cb_hwtstamp)); - } - -@@ -208,7 +217,7 @@ static void mlx5e_ptp_handle_ts_cqe(struct mlx5e_ptpsq *ptpsq, - - hwtstamp = mlx5e_cqe_ts_to_ns(sq->ptp_cyc2time, sq->clock, get_cqe_ts(cqe)); - mlx5e_skb_cb_hwtstamp_handler(skb, MLX5E_SKB_CB_PORT_HWTSTAMP, -- hwtstamp, ptpsq->cq_stats); -+ hwtstamp, ptpsq); - ptpsq->cq_stats->cqe++; - - mlx5e_ptpsq_mark_ts_cqes_undelivered(ptpsq, hwtstamp); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -index 1c0e0a86a9ac..2a457a2ed707 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/ptp.h -@@ -147,7 +147,7 @@ enum { - - void mlx5e_skb_cb_hwtstamp_handler(struct sk_buff *skb, int hwtstamp_type, - ktime_t hwtstamp, -- struct mlx5e_ptp_cq_stats *cq_stats); -+ struct mlx5e_ptpsq *ptpsq); - - void mlx5e_skb_cb_hwtstamp_init(struct sk_buff *skb); - #endif /* __MLX5_EN_PTP_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -index 7ffc1cc7aa7d..6245d2f82afe 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -@@ -749,7 +749,7 @@ static void mlx5e_consume_skb(struct mlx5e_txqsq *sq, struct sk_buff *skb, - hwts.hwtstamp = mlx5e_cqe_ts_to_ns(sq->ptp_cyc2time, sq->clock, ts); - if (sq->ptpsq) { - mlx5e_skb_cb_hwtstamp_handler(skb, MLX5E_SKB_CB_CQE_HWTSTAMP, -- hwts.hwtstamp, sq->ptpsq->cq_stats); -+ hwts.hwtstamp, sq->ptpsq); - } else { - skb_tstamp_tx(skb, &hwts); - sq->stats->timestamps++; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1625-net-mlx5-remove-redundant-bw-share-minimal-value-assignment.patch b/SOURCES/1625-net-mlx5-remove-redundant-bw-share-minimal-value-assignment.patch deleted file mode 100644 index 75d5c77bc..000000000 --- a/SOURCES/1625-net-mlx5-remove-redundant-bw-share-minimal-value-assignment.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 92bdadb99a3dd8e447494b29a2303172c244fa18 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:29 -0400 -Subject: [PATCH] net/mlx5: Remove redundant bw_share minimal value assignment - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ea3270351c792632db5722ea3ca83b468cebb531 -Author: Carolina Jubran -Date: Mon Nov 17 23:42:07 2025 +0200 - - net/mlx5: Remove redundant bw_share minimal value assignment - - Remove unnecessary logic that sets bw_share to minimal value, when - parent has bw_share configured but nodes don't have min_rate. - - This check is redundant because the parent bandwidth acts as the upper - bound regardless, and the firmware always enforces the topmost - bandwidth constraint. - - Signed-off-by: Carolina Jubran - Reviewed-by: Cosmin Ratiu - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763415729-1238421-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 56e6f54b1e2e..4278bcb04c72 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -341,13 +341,6 @@ static u32 esw_qos_calculate_min_rate_divider(struct mlx5_eswitch *esw, - if (max_guarantee) - return max_t(u32, max_guarantee / fw_max_bw_share, 1); - -- /* If nodes max min_rate divider is 0 but their parent has bw_share -- * configured, then set bw_share for nodes to minimal value. -- */ -- -- if (parent && parent->bw_share) -- return 1; -- - /* If the node nodes has min_rate configured, a divider of 0 sets all - * nodes' bw_share to 0, effectively disabling min guarantees. - */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1626-net-mlx5-abort-new-commands-if-all-command-slots-are-stalled.patch b/SOURCES/1626-net-mlx5-abort-new-commands-if-all-command-slots-are-stalled.patch deleted file mode 100644 index 0b689ab7e..000000000 --- a/SOURCES/1626-net-mlx5-abort-new-commands-if-all-command-slots-are-stalled.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 3014c5aefcf7f51a5cab8c54d694939d8a5580de Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Abort new commands if all command slots are stalled - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit fbb9933666e31f84c62e9620e9ec4d220ee31ab4 -Author: Saeed Mahameed -Date: Mon Nov 17 23:42:08 2025 +0200 - - net/mlx5: Abort new commands if all command slots are stalled - - In case of a FW issue, FW might be not responding to FW commands, - causing kernel lockout for a long period of time, e.g. rtnl_lock held - while ethtool is trying to collect stats waiting for FW to respond to - multiple commands, when all of them will timeout. - - While there's no immediate indication of the FW lockout, we can safely - assume that something is wrong when all command slots are busy and in - a timeout state and no FW completion was received on any of them. - - In such case, start immediately failing new commands. - - Signed-off-by: Saeed Mahameed - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763415729-1238421-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index 722282cebce9..5b08e5ffe0e2 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -181,6 +181,7 @@ static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent) - static void cmd_free_index(struct mlx5_cmd *cmd, int idx) - { - lockdep_assert_held(&cmd->alloc_lock); -+ cmd->ent_arr[idx] = NULL; - set_bit(idx, &cmd->vars.bitmask); - } - -@@ -1200,6 +1201,44 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent) - return err; - } - -+/* Check if all command slots are stalled (timed out and not recovered). -+ * returns true if all slots timed out on a recent command and have not been -+ * completed by FW yet. (stalled state) -+ * false otherwise (at least one slot is not stalled). -+ * -+ * In such odd situation "all_stalled", this serves as a protection mechanism -+ * to avoid blocking the kernel for long periods of time in case FW is not -+ * responding to commands. -+ */ -+static bool mlx5_cmd_all_stalled(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_cmd *cmd = &dev->cmd; -+ bool all_stalled = true; -+ unsigned long flags; -+ int i; -+ -+ spin_lock_irqsave(&cmd->alloc_lock, flags); -+ -+ /* at least one command slot is free */ -+ if (bitmap_weight(&cmd->vars.bitmask, cmd->vars.max_reg_cmds) > 0) { -+ all_stalled = false; -+ goto out; -+ } -+ -+ for_each_clear_bit(i, &cmd->vars.bitmask, cmd->vars.max_reg_cmds) { -+ struct mlx5_cmd_work_ent *ent = dev->cmd.ent_arr[i]; -+ -+ if (!test_bit(MLX5_CMD_ENT_STATE_TIMEDOUT, &ent->state)) { -+ all_stalled = false; -+ break; -+ } -+ } -+out: -+ spin_unlock_irqrestore(&cmd->alloc_lock, flags); -+ -+ return all_stalled; -+} -+ - /* Notes: - * 1. Callback functions may not sleep - * 2. page queue commands do not support asynchrous completion -@@ -1230,6 +1269,15 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in, - if (callback && page_queue) - return -EINVAL; - -+ if (!page_queue && mlx5_cmd_all_stalled(dev)) { -+ mlx5_core_err_rl(dev, -+ "All CMD slots are stalled, aborting command\n"); -+ /* there's no reason to wait and block the whole kernel if FW -+ * isn't currently responding to all slots, fail immediately -+ */ -+ return -EAGAIN; -+ } -+ - ent = cmd_alloc_ent(cmd, in, out, uout, uout_size, - callback, context, page_queue); - if (IS_ERR(ent)) -@@ -1700,6 +1748,13 @@ static void mlx5_cmd_comp_handler(struct mlx5_core_dev *dev, u64 vec, bool force - if (test_bit(i, &vector)) { - ent = cmd->ent_arr[i]; - -+ if (forced && ent->ret == -ETIMEDOUT) -+ set_bit(MLX5_CMD_ENT_STATE_TIMEDOUT, -+ &ent->state); -+ else if (!forced) /* real FW completion */ -+ clear_bit(MLX5_CMD_ENT_STATE_TIMEDOUT, -+ &ent->state); -+ - /* if we already completed the command, ignore it */ - if (!test_and_clear_bit(MLX5_CMD_ENT_STATE_PENDING_COMP, - &ent->state)) { -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 046396269ccf..7aec53371cf0 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -819,6 +819,7 @@ typedef void (*mlx5_cmd_cbk_t)(int status, void *context); - - enum { - MLX5_CMD_ENT_STATE_PENDING_COMP, -+ MLX5_CMD_ENT_STATE_TIMEDOUT, - }; - - struct mlx5_cmd_work_ent { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1627-net-mlx5-use-eopnotsupp-instead-of-enotsupp.patch b/SOURCES/1627-net-mlx5-use-eopnotsupp-instead-of-enotsupp.patch deleted file mode 100644 index ac5b25cb6..000000000 --- a/SOURCES/1627-net-mlx5-use-eopnotsupp-instead-of-enotsupp.patch +++ /dev/null @@ -1,113 +0,0 @@ -From c9316c275fc464f96c66f97cfcef95809cb67940 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 70ca239b612cd154c9828fe4d0093fb9bd02a6c7 -Author: Tariq Toukan -Date: Mon Nov 17 23:42:09 2025 +0200 - - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP - - Per Documentation/dev-tools/checkpatch.rst, ENOTSUPP is not a standard - error code and should be avoided. EOPNOTSUPP should be used instead. - - Signed-off-by: Tariq Toukan - Reviewed-by: Gal Pressman - Link: https://patch.msgid.link/1763415729-1238421-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -index 080e7eab52c7..7bcf822a89f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -@@ -54,7 +54,7 @@ static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer) - - if (!MLX5_GET(mtrc_cap, out, trace_to_memory)) { - mlx5_core_dbg(dev, "FWTracer: Device does not support logging traces to memory\n"); -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - } - - tracer->trc_ver = MLX5_GET(mtrc_cap, out, trc_ver); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c -index 79916f1abd14..63bdef5b4ba5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs_ethtool.c -@@ -704,7 +704,7 @@ static int validate_flow(struct mlx5e_priv *priv, - num_tuples += ret; - break; - default: -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - } - if ((fs->flow_type & FLOW_EXT)) { - ret = validate_vlan(fs); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c -index e5c1012921d2..1ec61164e6b5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fpga/core.c -@@ -211,7 +211,7 @@ int mlx5_fpga_device_start(struct mlx5_core_dev *mdev) - max_num_qps = MLX5_CAP_FPGA(mdev, shell_caps.max_num_qps); - if (!max_num_qps) { - mlx5_fpga_err(fdev, "FPGA reports 0 QPs in SHELL_CAPS\n"); -- err = -ENOTSUPP; -+ err = -EOPNOTSUPP; - goto out; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c -index d55e15c1f380..304912637c35 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/vxlan.c -@@ -149,7 +149,7 @@ struct mlx5_vxlan *mlx5_vxlan_create(struct mlx5_core_dev *mdev) - struct mlx5_vxlan *vxlan; - - if (!MLX5_CAP_ETH(mdev, tunnel_stateless_vxlan) || !mlx5_core_is_pf(mdev)) -- return ERR_PTR(-ENOTSUPP); -+ return ERR_PTR(-EOPNOTSUPP); - - vxlan = kzalloc(sizeof(*vxlan), GFP_KERNEL); - if (!vxlan) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_domain.c -index 65740bb68b09..e8c67ed9f748 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_domain.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/sws/dr_domain.c -@@ -410,7 +410,7 @@ static int dr_domain_caps_init(struct mlx5_core_dev *mdev, - switch (dmn->type) { - case MLX5DR_DOMAIN_TYPE_NIC_RX: - if (!DR_DOMAIN_SW_STEERING_SUPPORTED(dmn, rx)) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - dmn->info.supp_sw_steering = true; - dmn->info.rx.type = DR_DOMAIN_NIC_TYPE_RX; -@@ -419,7 +419,7 @@ static int dr_domain_caps_init(struct mlx5_core_dev *mdev, - break; - case MLX5DR_DOMAIN_TYPE_NIC_TX: - if (!DR_DOMAIN_SW_STEERING_SUPPORTED(dmn, tx)) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - dmn->info.supp_sw_steering = true; - dmn->info.tx.type = DR_DOMAIN_NIC_TYPE_TX; -@@ -428,10 +428,10 @@ static int dr_domain_caps_init(struct mlx5_core_dev *mdev, - break; - case MLX5DR_DOMAIN_TYPE_FDB: - if (!dmn->info.caps.eswitch_manager) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - if (!DR_DOMAIN_SW_STEERING_SUPPORTED(dmn, fdb)) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - - dmn->info.rx.type = DR_DOMAIN_NIC_TYPE_RX; - dmn->info.tx.type = DR_DOMAIN_NIC_TYPE_TX; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1628-net-mlx5-initialize-events-outside-devlink-lock.patch b/SOURCES/1628-net-mlx5-initialize-events-outside-devlink-lock.patch deleted file mode 100644 index 26d68cc69..000000000 --- a/SOURCES/1628-net-mlx5-initialize-events-outside-devlink-lock.patch +++ /dev/null @@ -1,116 +0,0 @@ -From 1c5f23db129a2e1115918a8cf4b6cf5062350f2e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Initialize events outside devlink lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b6b03097f9826db72aeb3f751774c5e9edd9a5b3 -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:35 2025 +0200 - - net/mlx5: Initialize events outside devlink lock - - Move event init/cleanup outside of mlx5_init_one() / mlx5_uninit_one() - and into the mlx5_mdev_init() / mlx5_mdev_uninit() functions. - - By doing this, we avoid the events being reinitialized on devlink reload - and, more importantly, the events->sw_nh notifier chain becomes - available earlier in the init procedure, which will be used in - subsequent patches. This makes sense because the events struct is pure - software, independent of any HW details. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index b0d8d9888629..f73e1b5e13e3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1010,16 +1010,10 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - goto err_irq_cleanup; - } - -- err = mlx5_events_init(dev); -- if (err) { -- mlx5_core_err(dev, "failed to initialize events\n"); -- goto err_eq_cleanup; -- } -- - err = mlx5_fw_reset_init(dev); - if (err) { - mlx5_core_err(dev, "failed to initialize fw reset events\n"); -- goto err_events_cleanup; -+ goto err_eq_cleanup; - } - - mlx5_cq_debugfs_init(dev); -@@ -1121,8 +1115,6 @@ static int mlx5_init_once(struct mlx5_core_dev *dev) - mlx5_cleanup_reserved_gids(dev); - mlx5_cq_debugfs_cleanup(dev); - mlx5_fw_reset_cleanup(dev); --err_events_cleanup: -- mlx5_events_cleanup(dev); - err_eq_cleanup: - mlx5_eq_table_cleanup(dev); - err_irq_cleanup: -@@ -1155,7 +1147,6 @@ static void mlx5_cleanup_once(struct mlx5_core_dev *dev) - mlx5_cleanup_reserved_gids(dev); - mlx5_cq_debugfs_cleanup(dev); - mlx5_fw_reset_cleanup(dev); -- mlx5_events_cleanup(dev); - mlx5_eq_table_cleanup(dev); - mlx5_irq_table_cleanup(dev); - mlx5_devcom_unregister_device(dev->priv.devc); -@@ -1833,6 +1824,24 @@ static int vhca_id_show(struct seq_file *file, void *priv) - - DEFINE_SHOW_ATTRIBUTE(vhca_id); - -+static int mlx5_notifiers_init(struct mlx5_core_dev *dev) -+{ -+ int err; -+ -+ err = mlx5_events_init(dev); -+ if (err) { -+ mlx5_core_err(dev, "failed to initialize events\n"); -+ return err; -+ } -+ -+ return 0; -+} -+ -+static void mlx5_notifiers_cleanup(struct mlx5_core_dev *dev) -+{ -+ mlx5_events_cleanup(dev); -+} -+ - int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) - { - struct mlx5_priv *priv = &dev->priv; -@@ -1888,6 +1897,10 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) - if (err) - goto err_hca_caps; - -+ err = mlx5_notifiers_init(dev); -+ if (err) -+ goto err_hca_caps; -+ - /* The conjunction of sw_vhca_id with sw_owner_id will be a global - * unique id per function which uses mlx5_core. - * Those values are supplied to FW as part of the init HCA command to -@@ -1930,6 +1943,7 @@ void mlx5_mdev_uninit(struct mlx5_core_dev *dev) - if (priv->sw_vhca_id > 0) - ida_free(&sw_vhca_ida, dev->priv.sw_vhca_id); - -+ mlx5_notifiers_cleanup(dev); - mlx5_hca_caps_free(dev); - mlx5_adev_cleanup(dev); - mlx5_pagealloc_cleanup(dev); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1629-net-mlx5-move-the-esw-mode-notifier-chain-outside-the-devlin.patch b/SOURCES/1629-net-mlx5-move-the-esw-mode-notifier-chain-outside-the-devlin.patch deleted file mode 100644 index 92d29c205..000000000 --- a/SOURCES/1629-net-mlx5-move-the-esw-mode-notifier-chain-outside-the-devlin.patch +++ /dev/null @@ -1,156 +0,0 @@ -From 6cd2c32c9bfb5ce6ce06065133fe15058050cef4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Move the esw mode notifier chain outside the - devlink lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3fee828789b1cf294a8fc83ad8a37f644c174fae -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:36 2025 +0200 - - net/mlx5: Move the esw mode notifier chain outside the devlink lock - - The esw mode change notifier chain is initialized/cleaned up in - mlx5_init_one() / mlx5_uninit_one() with the devlink lock held. - - Move the notifier head from the eswitch struct into mlx5_priv directly, - and initialize it outside the critical section. This will allow notifier - registration to happen earlier in the init procedure in subsequent - patches. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -index 25af8bd7f077..3adf2b1cd26a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c -@@ -1474,7 +1474,7 @@ static void mlx5_esw_mode_change_notify(struct mlx5_eswitch *esw, u16 mode) - - info.new_mode = mode; - -- blocking_notifier_call_chain(&esw->n_head, 0, &info); -+ blocking_notifier_call_chain(&esw->dev->priv.esw_n_head, 0, &info); - } - - static int mlx5_esw_egress_acls_init(struct mlx5_core_dev *dev) -@@ -2050,7 +2050,6 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) - esw->offloads.encap = DEVLINK_ESWITCH_ENCAP_MODE_BASIC; - else - esw->offloads.encap = DEVLINK_ESWITCH_ENCAP_MODE_NONE; -- BLOCKING_INIT_NOTIFIER_HEAD(&esw->n_head); - - esw_info(dev, - "Total vports %d, per vport: max uc(%d) max mc(%d)\n", -@@ -2379,14 +2378,16 @@ bool mlx5_esw_multipath_prereq(struct mlx5_core_dev *dev0, - dev1->priv.eswitch->mode == MLX5_ESWITCH_OFFLOADS); - } - --int mlx5_esw_event_notifier_register(struct mlx5_eswitch *esw, struct notifier_block *nb) -+int mlx5_esw_event_notifier_register(struct mlx5_core_dev *dev, -+ struct notifier_block *nb) - { -- return blocking_notifier_chain_register(&esw->n_head, nb); -+ return blocking_notifier_chain_register(&dev->priv.esw_n_head, nb); - } - --void mlx5_esw_event_notifier_unregister(struct mlx5_eswitch *esw, struct notifier_block *nb) -+void mlx5_esw_event_notifier_unregister(struct mlx5_core_dev *dev, -+ struct notifier_block *nb) - { -- blocking_notifier_chain_unregister(&esw->n_head, nb); -+ blocking_notifier_chain_unregister(&dev->priv.esw_n_head, nb); - } - - /** -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index beaec450a734..ad1073f7b79f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -403,7 +403,6 @@ struct mlx5_eswitch { - struct { - u32 large_group_num; - } params; -- struct blocking_notifier_head n_head; - struct xarray paired; - struct mlx5_devcom_comp_dev *devcom; - u16 enabled_ipsec_vf_count; -@@ -864,8 +863,10 @@ struct mlx5_esw_event_info { - u16 new_mode; - }; - --int mlx5_esw_event_notifier_register(struct mlx5_eswitch *esw, struct notifier_block *n); --void mlx5_esw_event_notifier_unregister(struct mlx5_eswitch *esw, struct notifier_block *n); -+int mlx5_esw_event_notifier_register(struct mlx5_core_dev *dev, -+ struct notifier_block *n); -+void mlx5_esw_event_notifier_unregister(struct mlx5_core_dev *dev, -+ struct notifier_block *n); - - bool mlx5_esw_hold(struct mlx5_core_dev *dev); - void mlx5_esw_release(struct mlx5_core_dev *dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index f73e1b5e13e3..eb1bb6ecbff3 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1834,6 +1834,8 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - return err; - } - -+ BLOCKING_INIT_NOTIFIER_HEAD(&dev->priv.esw_n_head); -+ - return 0; - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -index 3304f25cc805..2ece4983d33f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -@@ -481,7 +481,7 @@ int mlx5_sf_table_init(struct mlx5_core_dev *dev) - xa_init(&table->function_ids); - dev->priv.sf_table = table; - table->esw_nb.notifier_call = mlx5_sf_esw_event; -- err = mlx5_esw_event_notifier_register(dev->priv.eswitch, &table->esw_nb); -+ err = mlx5_esw_event_notifier_register(dev, &table->esw_nb); - if (err) - goto reg_err; - -@@ -496,7 +496,7 @@ int mlx5_sf_table_init(struct mlx5_core_dev *dev) - return 0; - - vhca_err: -- mlx5_esw_event_notifier_unregister(dev->priv.eswitch, &table->esw_nb); -+ mlx5_esw_event_notifier_unregister(dev, &table->esw_nb); - reg_err: - mutex_destroy(&table->sf_state_lock); - kfree(table); -@@ -513,7 +513,7 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - - mlx5_blocking_notifier_unregister(dev, &table->mdev_nb); - mlx5_vhca_event_notifier_unregister(table->dev, &table->vhca_nb); -- mlx5_esw_event_notifier_unregister(dev->priv.eswitch, &table->esw_nb); -+ mlx5_esw_event_notifier_unregister(dev, &table->esw_nb); - mutex_destroy(&table->sf_state_lock); - WARN_ON(!xa_empty(&table->function_ids)); - kfree(table); -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 7aec53371cf0..9a4a5112a59e 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -599,6 +599,7 @@ struct mlx5_priv { - - struct mlx5_flow_steering *steering; - struct mlx5_mpfs *mpfs; -+ struct blocking_notifier_head esw_n_head; - struct mlx5_eswitch *eswitch; - struct mlx5_core_sriov sriov; - struct mlx5_lag *lag; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1630-net-mlx5-move-the-vhca-event-notifier-outside-of-the-devlink.patch b/SOURCES/1630-net-mlx5-move-the-vhca-event-notifier-outside-of-the-devlink.patch deleted file mode 100644 index 261f61c09..000000000 --- a/SOURCES/1630-net-mlx5-move-the-vhca-event-notifier-outside-of-the-devlink.patch +++ /dev/null @@ -1,303 +0,0 @@ -From 8b70fca3cb47e9d8e587a3bcd5500848d3733c5d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Move the vhca event notifier outside of the devlink - lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d3a356db853bc2dfb51034eacafd41aca7dd4c37 -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:37 2025 +0200 - - net/mlx5: Move the vhca event notifier outside of the devlink lock - - The vhca event notifier consists of an atomic notifier for vhca state - changes (used for SF events), multiple workqueues and a blocking - notifier chain for delivering the vhca state change events for further - processing. - - This patch moves the vhca notifier head outside of mlx5_init_one() / - mlx5_uninit_one() and into the mlx5_mdev_init() / mlx5_mdev_uninit() - functions. - - This allows called notifiers to grab the PF devlink lock which was - previously impossible because it would create a circular lock - dependency. - - mlx5_vhca_event_stop() is now called earlier in the cleanup phase and - flushes the workqueues to ensure that after the call, there are no - pending events. This simplifies the cleanup flow for vhca event - consumers. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index eb1bb6ecbff3..6adaa1514dad 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1438,12 +1438,12 @@ static void mlx5_unload(struct mlx5_core_dev *dev) - { - mlx5_eswitch_disable(dev->priv.eswitch); - mlx5_devlink_traps_unregister(priv_to_devlink(dev)); -+ mlx5_vhca_event_stop(dev); - mlx5_sf_dev_table_destroy(dev); - mlx5_sriov_detach(dev); - mlx5_lag_remove_mdev(dev); - mlx5_ec_cleanup(dev); - mlx5_sf_hw_table_destroy(dev); -- mlx5_vhca_event_stop(dev); - mlx5_fs_core_cleanup(dev); - mlx5_fpga_device_stop(dev); - mlx5_rsc_dump_cleanup(dev); -@@ -1835,6 +1835,7 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - } - - BLOCKING_INIT_NOTIFIER_HEAD(&dev->priv.esw_n_head); -+ mlx5_vhca_state_notifier_init(dev); - - return 0; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -index 99219ea52c4b..a68a8ee24dce 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -@@ -381,7 +381,6 @@ void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev) - - mlx5_sf_dev_destroy_active_works(table); - mlx5_vhca_event_notifier_unregister(dev, &table->nb); -- mlx5_vhca_event_work_queues_flush(dev); - - /* Now that event handler is not running, it is safe to destroy - * the sf device without race. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -index 1f613320fe07..a14b1aa5fb5a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -@@ -389,6 +389,7 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev) - return; - - mlx5_vhca_event_notifier_unregister(dev, &table->vhca_nb); -+ - /* Dealloc SFs whose firmware event has been missed. */ - mlx5_sf_hw_table_dealloc_all(table); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.c -index cda01ba441ae..b04cf6cf8956 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.c -@@ -9,15 +9,9 @@ - #define CREATE_TRACE_POINTS - #include "diag/vhca_tracepoint.h" - --struct mlx5_vhca_state_notifier { -- struct mlx5_core_dev *dev; -- struct mlx5_nb nb; -- struct blocking_notifier_head n_head; --}; -- - struct mlx5_vhca_event_work { - struct work_struct work; -- struct mlx5_vhca_state_notifier *notifier; -+ struct mlx5_core_dev *dev; - struct mlx5_vhca_state_event event; - }; - -@@ -95,16 +89,14 @@ mlx5_vhca_event_notify(struct mlx5_core_dev *dev, struct mlx5_vhca_state_event * - mlx5_vhca_event_arm(dev, event->function_id); - trace_mlx5_sf_vhca_event(dev, event); - -- blocking_notifier_call_chain(&dev->priv.vhca_state_notifier->n_head, 0, event); -+ blocking_notifier_call_chain(&dev->priv.vhca_state_n_head, 0, event); - } - - static void mlx5_vhca_state_work_handler(struct work_struct *_work) - { - struct mlx5_vhca_event_work *work = container_of(_work, struct mlx5_vhca_event_work, work); -- struct mlx5_vhca_state_notifier *notifier = work->notifier; -- struct mlx5_core_dev *dev = notifier->dev; - -- mlx5_vhca_event_notify(dev, &work->event); -+ mlx5_vhca_event_notify(work->dev, &work->event); - kfree(work); - } - -@@ -116,8 +108,8 @@ void mlx5_vhca_events_work_enqueue(struct mlx5_core_dev *dev, int idx, struct wo - static int - mlx5_vhca_state_change_notifier(struct notifier_block *nb, unsigned long type, void *data) - { -- struct mlx5_vhca_state_notifier *notifier = -- mlx5_nb_cof(nb, struct mlx5_vhca_state_notifier, nb); -+ struct mlx5_core_dev *dev = mlx5_nb_cof(nb, struct mlx5_core_dev, -+ priv.vhca_state_nb); - struct mlx5_vhca_event_work *work; - struct mlx5_eqe *eqe = data; - int wq_idx; -@@ -126,10 +118,10 @@ mlx5_vhca_state_change_notifier(struct notifier_block *nb, unsigned long type, v - if (!work) - return NOTIFY_DONE; - INIT_WORK(&work->work, &mlx5_vhca_state_work_handler); -- work->notifier = notifier; -+ work->dev = dev; - work->event.function_id = be16_to_cpu(eqe->data.vhca_state.function_id); - wq_idx = work->event.function_id % MLX5_DEV_MAX_WQS; -- mlx5_vhca_events_work_enqueue(notifier->dev, wq_idx, &work->work); -+ mlx5_vhca_events_work_enqueue(dev, wq_idx, &work->work); - return NOTIFY_OK; - } - -@@ -145,9 +137,15 @@ void mlx5_vhca_state_cap_handle(struct mlx5_core_dev *dev, void *set_hca_cap) - MLX5_SET(cmd_hca_cap, set_hca_cap, event_on_vhca_state_teardown_request, 1); - } - -+void mlx5_vhca_state_notifier_init(struct mlx5_core_dev *dev) -+{ -+ BLOCKING_INIT_NOTIFIER_HEAD(&dev->priv.vhca_state_n_head); -+ MLX5_NB_INIT(&dev->priv.vhca_state_nb, mlx5_vhca_state_change_notifier, -+ VHCA_STATE_CHANGE); -+} -+ - int mlx5_vhca_event_init(struct mlx5_core_dev *dev) - { -- struct mlx5_vhca_state_notifier *notifier; - char wq_name[MLX5_CMD_WQ_MAX_NAME]; - struct mlx5_vhca_events *events; - int err, i; -@@ -160,7 +158,6 @@ int mlx5_vhca_event_init(struct mlx5_core_dev *dev) - return -ENOMEM; - - events->dev = dev; -- dev->priv.vhca_events = events; - for (i = 0; i < MLX5_DEV_MAX_WQS; i++) { - snprintf(wq_name, MLX5_CMD_WQ_MAX_NAME, "mlx5_vhca_event%d", i); - events->handler[i].wq = create_singlethread_workqueue(wq_name); -@@ -169,20 +166,10 @@ int mlx5_vhca_event_init(struct mlx5_core_dev *dev) - goto err_create_wq; - } - } -+ dev->priv.vhca_events = events; - -- notifier = kzalloc(sizeof(*notifier), GFP_KERNEL); -- if (!notifier) { -- err = -ENOMEM; -- goto err_notifier; -- } -- -- dev->priv.vhca_state_notifier = notifier; -- notifier->dev = dev; -- BLOCKING_INIT_NOTIFIER_HEAD(¬ifier->n_head); -- MLX5_NB_INIT(¬ifier->nb, mlx5_vhca_state_change_notifier, VHCA_STATE_CHANGE); - return 0; - --err_notifier: - err_create_wq: - for (--i; i >= 0; i--) - destroy_workqueue(events->handler[i].wq); -@@ -211,8 +198,6 @@ void mlx5_vhca_event_cleanup(struct mlx5_core_dev *dev) - if (!mlx5_vhca_event_supported(dev)) - return; - -- kfree(dev->priv.vhca_state_notifier); -- dev->priv.vhca_state_notifier = NULL; - vhca_events = dev->priv.vhca_events; - for (i = 0; i < MLX5_DEV_MAX_WQS; i++) - destroy_workqueue(vhca_events->handler[i].wq); -@@ -221,34 +206,30 @@ void mlx5_vhca_event_cleanup(struct mlx5_core_dev *dev) - - void mlx5_vhca_event_start(struct mlx5_core_dev *dev) - { -- struct mlx5_vhca_state_notifier *notifier; -- -- if (!dev->priv.vhca_state_notifier) -+ if (!mlx5_vhca_event_supported(dev)) - return; - -- notifier = dev->priv.vhca_state_notifier; -- mlx5_eq_notifier_register(dev, ¬ifier->nb); -+ mlx5_eq_notifier_register(dev, &dev->priv.vhca_state_nb); - } - - void mlx5_vhca_event_stop(struct mlx5_core_dev *dev) - { -- struct mlx5_vhca_state_notifier *notifier; -- -- if (!dev->priv.vhca_state_notifier) -+ if (!mlx5_vhca_event_supported(dev)) - return; - -- notifier = dev->priv.vhca_state_notifier; -- mlx5_eq_notifier_unregister(dev, ¬ifier->nb); -+ mlx5_eq_notifier_unregister(dev, &dev->priv.vhca_state_nb); -+ -+ /* Flush workqueues of all pending events. */ -+ mlx5_vhca_event_work_queues_flush(dev); - } - - int mlx5_vhca_event_notifier_register(struct mlx5_core_dev *dev, struct notifier_block *nb) - { -- if (!dev->priv.vhca_state_notifier) -- return -EOPNOTSUPP; -- return blocking_notifier_chain_register(&dev->priv.vhca_state_notifier->n_head, nb); -+ return blocking_notifier_chain_register(&dev->priv.vhca_state_n_head, -+ nb); - } - - void mlx5_vhca_event_notifier_unregister(struct mlx5_core_dev *dev, struct notifier_block *nb) - { -- blocking_notifier_chain_unregister(&dev->priv.vhca_state_notifier->n_head, nb); -+ blocking_notifier_chain_unregister(&dev->priv.vhca_state_n_head, nb); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.h -index 1725ba64f8af..52790423874c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/vhca_event.h -@@ -18,6 +18,7 @@ static inline bool mlx5_vhca_event_supported(const struct mlx5_core_dev *dev) - } - - void mlx5_vhca_state_cap_handle(struct mlx5_core_dev *dev, void *set_hca_cap); -+void mlx5_vhca_state_notifier_init(struct mlx5_core_dev *dev); - int mlx5_vhca_event_init(struct mlx5_core_dev *dev); - void mlx5_vhca_event_cleanup(struct mlx5_core_dev *dev); - void mlx5_vhca_event_start(struct mlx5_core_dev *dev); -@@ -37,6 +38,10 @@ static inline void mlx5_vhca_state_cap_handle(struct mlx5_core_dev *dev, void *s - { - } - -+static inline void mlx5_vhca_state_notifier_init(struct mlx5_core_dev *dev) -+{ -+} -+ - static inline int mlx5_vhca_event_init(struct mlx5_core_dev *dev) - { - return 0; -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 9a4a5112a59e..88afb2788dc9 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -488,7 +488,6 @@ struct mlx5_devcom_dev; - struct mlx5_fw_reset; - struct mlx5_eq_table; - struct mlx5_irq_table; --struct mlx5_vhca_state_notifier; - struct mlx5_sf_dev_table; - struct mlx5_sf_hw_table; - struct mlx5_sf_table; -@@ -615,7 +614,8 @@ struct mlx5_priv { - struct mlx5_bfreg_data bfregs; - struct mlx5_sq_bfreg bfreg; - #ifdef CONFIG_MLX5_SF -- struct mlx5_vhca_state_notifier *vhca_state_notifier; -+ struct mlx5_nb vhca_state_nb; -+ struct blocking_notifier_head vhca_state_n_head; - struct mlx5_sf_dev_table *sf_dev_table; - struct mlx5_core_dev *parent_mdev; - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1631-net-mlx5-move-the-sf-hw-table-notifier-outside-the-devlink-l.patch b/SOURCES/1631-net-mlx5-move-the-sf-hw-table-notifier-outside-the-devlink-l.patch deleted file mode 100644 index 5dbd74984..000000000 --- a/SOURCES/1631-net-mlx5-move-the-sf-hw-table-notifier-outside-the-devlink-l.patch +++ /dev/null @@ -1,295 +0,0 @@ -From 53ae24ef64e0191f8ec9348bd4dc4f98e939bfc4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Move the SF HW table notifier outside the devlink - lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e63c9c5f0a4802deea81a48c2c40d0af56153e8a -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:38 2025 +0200 - - net/mlx5: Move the SF HW table notifier outside the devlink lock - - Move the SF HW table notifier registration/unregistration outside of - mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / - mlx5_mdev_uninit() functions. - - This is only done for non-SFs, since SFs do not have a SF HW table - themselves. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 6adaa1514dad..91cb5b45300f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1377,12 +1377,6 @@ static int mlx5_load(struct mlx5_core_dev *dev) - - mlx5_vhca_event_start(dev); - -- err = mlx5_sf_hw_table_create(dev); -- if (err) { -- mlx5_core_err(dev, "sf table create failed %d\n", err); -- goto err_vhca; -- } -- - err = mlx5_ec_init(dev); - if (err) { - mlx5_core_err(dev, "Failed to init embedded CPU\n"); -@@ -1411,8 +1405,6 @@ static int mlx5_load(struct mlx5_core_dev *dev) - mlx5_lag_remove_mdev(dev); - mlx5_ec_cleanup(dev); - err_ec: -- mlx5_sf_hw_table_destroy(dev); --err_vhca: - mlx5_vhca_event_stop(dev); - err_set_hca: - mlx5_fs_core_cleanup(dev); -@@ -1837,11 +1829,20 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - BLOCKING_INIT_NOTIFIER_HEAD(&dev->priv.esw_n_head); - mlx5_vhca_state_notifier_init(dev); - -+ err = mlx5_sf_hw_notifier_init(dev); -+ if (err) -+ goto err_sf_hw_notifier; -+ - return 0; -+ -+err_sf_hw_notifier: -+ mlx5_events_cleanup(dev); -+ return err; - } - - static void mlx5_notifiers_cleanup(struct mlx5_core_dev *dev) - { -+ mlx5_sf_hw_notifier_cleanup(dev); - mlx5_events_cleanup(dev); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -index a14b1aa5fb5a..bd968f3b3855 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/hw_table.c -@@ -30,9 +30,7 @@ enum mlx5_sf_hwc_index { - }; - - struct mlx5_sf_hw_table { -- struct mlx5_core_dev *dev; - struct mutex table_lock; /* Serializes sf deletion and vhca state change handler. */ -- struct notifier_block vhca_nb; - struct mlx5_sf_hwc_table hwc[MLX5_SF_HWC_MAX]; - }; - -@@ -71,14 +69,16 @@ mlx5_sf_table_fn_to_hwc(struct mlx5_sf_hw_table *table, u16 fn_id) - return NULL; - } - --static int mlx5_sf_hw_table_id_alloc(struct mlx5_sf_hw_table *table, u32 controller, -+static int mlx5_sf_hw_table_id_alloc(struct mlx5_core_dev *dev, -+ struct mlx5_sf_hw_table *table, -+ u32 controller, - u32 usr_sfnum) - { - struct mlx5_sf_hwc_table *hwc; - int free_idx = -1; - int i; - -- hwc = mlx5_sf_controller_to_hwc(table->dev, controller); -+ hwc = mlx5_sf_controller_to_hwc(dev, controller); - if (!hwc->sfs) - return -ENOSPC; - -@@ -100,11 +100,13 @@ static int mlx5_sf_hw_table_id_alloc(struct mlx5_sf_hw_table *table, u32 control - return free_idx; - } - --static void mlx5_sf_hw_table_id_free(struct mlx5_sf_hw_table *table, u32 controller, int id) -+static void mlx5_sf_hw_table_id_free(struct mlx5_core_dev *dev, -+ struct mlx5_sf_hw_table *table, -+ u32 controller, int id) - { - struct mlx5_sf_hwc_table *hwc; - -- hwc = mlx5_sf_controller_to_hwc(table->dev, controller); -+ hwc = mlx5_sf_controller_to_hwc(dev, controller); - hwc->sfs[id].allocated = false; - hwc->sfs[id].pending_delete = false; - } -@@ -120,7 +122,7 @@ int mlx5_sf_hw_table_sf_alloc(struct mlx5_core_dev *dev, u32 controller, u32 usr - return -EOPNOTSUPP; - - mutex_lock(&table->table_lock); -- sw_id = mlx5_sf_hw_table_id_alloc(table, controller, usr_sfnum); -+ sw_id = mlx5_sf_hw_table_id_alloc(dev, table, controller, usr_sfnum); - if (sw_id < 0) { - err = sw_id; - goto exist_err; -@@ -151,7 +153,7 @@ int mlx5_sf_hw_table_sf_alloc(struct mlx5_core_dev *dev, u32 controller, u32 usr - vhca_err: - mlx5_cmd_dealloc_sf(dev, hw_fn_id); - err: -- mlx5_sf_hw_table_id_free(table, controller, sw_id); -+ mlx5_sf_hw_table_id_free(dev, table, controller, sw_id); - exist_err: - mutex_unlock(&table->table_lock); - return err; -@@ -165,7 +167,7 @@ void mlx5_sf_hw_table_sf_free(struct mlx5_core_dev *dev, u32 controller, u16 id) - mutex_lock(&table->table_lock); - hw_fn_id = mlx5_sf_sw_to_hw_id(dev, controller, id); - mlx5_cmd_dealloc_sf(dev, hw_fn_id); -- mlx5_sf_hw_table_id_free(table, controller, id); -+ mlx5_sf_hw_table_id_free(dev, table, controller, id); - mutex_unlock(&table->table_lock); - } - -@@ -216,10 +218,12 @@ static void mlx5_sf_hw_table_hwc_dealloc_all(struct mlx5_core_dev *dev, - } - } - --static void mlx5_sf_hw_table_dealloc_all(struct mlx5_sf_hw_table *table) -+static void mlx5_sf_hw_table_dealloc_all(struct mlx5_core_dev *dev, -+ struct mlx5_sf_hw_table *table) - { -- mlx5_sf_hw_table_hwc_dealloc_all(table->dev, &table->hwc[MLX5_SF_HWC_EXTERNAL]); -- mlx5_sf_hw_table_hwc_dealloc_all(table->dev, &table->hwc[MLX5_SF_HWC_LOCAL]); -+ mlx5_sf_hw_table_hwc_dealloc_all(dev, -+ &table->hwc[MLX5_SF_HWC_EXTERNAL]); -+ mlx5_sf_hw_table_hwc_dealloc_all(dev, &table->hwc[MLX5_SF_HWC_LOCAL]); - } - - static int mlx5_sf_hw_table_hwc_init(struct mlx5_sf_hwc_table *hwc, u16 max_fn, u16 base_id) -@@ -301,7 +305,6 @@ int mlx5_sf_hw_table_init(struct mlx5_core_dev *dev) - } - - mutex_init(&table->table_lock); -- table->dev = dev; - dev->priv.sf_hw_table = table; - - base_id = mlx5_sf_start_function_id(dev); -@@ -338,19 +341,22 @@ void mlx5_sf_hw_table_cleanup(struct mlx5_core_dev *dev) - mlx5_sf_hw_table_hwc_cleanup(&table->hwc[MLX5_SF_HWC_LOCAL]); - mutex_destroy(&table->table_lock); - kfree(table); -+ dev->priv.sf_hw_table = NULL; - res_unregister: - mlx5_sf_hw_table_res_unregister(dev); - } - - static int mlx5_sf_hw_vhca_event(struct notifier_block *nb, unsigned long opcode, void *data) - { -- struct mlx5_sf_hw_table *table = container_of(nb, struct mlx5_sf_hw_table, vhca_nb); -+ struct mlx5_core_dev *dev = container_of(nb, struct mlx5_core_dev, -+ priv.sf_hw_table_vhca_nb); -+ struct mlx5_sf_hw_table *table = dev->priv.sf_hw_table; - const struct mlx5_vhca_state_event *event = data; - struct mlx5_sf_hwc_table *hwc; - struct mlx5_sf_hw *sf_hw; - u16 sw_id; - -- if (event->new_vhca_state != MLX5_VHCA_STATE_ALLOCATED) -+ if (!table || event->new_vhca_state != MLX5_VHCA_STATE_ALLOCATED) - return 0; - - hwc = mlx5_sf_table_fn_to_hwc(table, event->function_id); -@@ -365,20 +371,28 @@ static int mlx5_sf_hw_vhca_event(struct notifier_block *nb, unsigned long opcode - * Hence recycle the sf hardware id for reuse. - */ - if (sf_hw->allocated && sf_hw->pending_delete) -- mlx5_sf_hw_table_hwc_sf_free(table->dev, hwc, sw_id); -+ mlx5_sf_hw_table_hwc_sf_free(dev, hwc, sw_id); - mutex_unlock(&table->table_lock); - return 0; - } - --int mlx5_sf_hw_table_create(struct mlx5_core_dev *dev) -+int mlx5_sf_hw_notifier_init(struct mlx5_core_dev *dev) - { -- struct mlx5_sf_hw_table *table = dev->priv.sf_hw_table; -- -- if (!table) -+ if (mlx5_core_is_sf(dev)) - return 0; - -- table->vhca_nb.notifier_call = mlx5_sf_hw_vhca_event; -- return mlx5_vhca_event_notifier_register(dev, &table->vhca_nb); -+ dev->priv.sf_hw_table_vhca_nb.notifier_call = mlx5_sf_hw_vhca_event; -+ return mlx5_vhca_event_notifier_register(dev, -+ &dev->priv.sf_hw_table_vhca_nb); -+} -+ -+void mlx5_sf_hw_notifier_cleanup(struct mlx5_core_dev *dev) -+{ -+ if (mlx5_core_is_sf(dev)) -+ return; -+ -+ mlx5_vhca_event_notifier_unregister(dev, -+ &dev->priv.sf_hw_table_vhca_nb); - } - - void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev) -@@ -388,10 +402,8 @@ void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev) - if (!table) - return; - -- mlx5_vhca_event_notifier_unregister(dev, &table->vhca_nb); -- - /* Dealloc SFs whose firmware event has been missed. */ -- mlx5_sf_hw_table_dealloc_all(table); -+ mlx5_sf_hw_table_dealloc_all(dev, table); - } - - bool mlx5_sf_hw_table_supported(const struct mlx5_core_dev *dev) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -index 89559a37997a..3922dacffae8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -@@ -12,7 +12,8 @@ - int mlx5_sf_hw_table_init(struct mlx5_core_dev *dev); - void mlx5_sf_hw_table_cleanup(struct mlx5_core_dev *dev); - --int mlx5_sf_hw_table_create(struct mlx5_core_dev *dev); -+int mlx5_sf_hw_notifier_init(struct mlx5_core_dev *dev); -+void mlx5_sf_hw_notifier_cleanup(struct mlx5_core_dev *dev); - void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev); - - int mlx5_sf_table_init(struct mlx5_core_dev *dev); -@@ -44,11 +45,15 @@ static inline void mlx5_sf_hw_table_cleanup(struct mlx5_core_dev *dev) - { - } - --static inline int mlx5_sf_hw_table_create(struct mlx5_core_dev *dev) -+static inline int mlx5_sf_hw_notifier_init(struct mlx5_core_dev *dev) - { - return 0; - } - -+static inline void mlx5_sf_hw_notifier_cleanup(struct mlx5_core_dev *dev) -+{ -+} -+ - static inline void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev) - { - } -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 88afb2788dc9..d6c5bcebdaca 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -620,6 +620,7 @@ struct mlx5_priv { - struct mlx5_core_dev *parent_mdev; - #endif - #ifdef CONFIG_MLX5_SF_MANAGER -+ struct notifier_block sf_hw_table_vhca_nb; - struct mlx5_sf_hw_table *sf_hw_table; - struct mlx5_sf_table *sf_table; - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1632-net-mlx5-move-the-sf-table-notifiers-outside-the-devlink-loc.patch b/SOURCES/1632-net-mlx5-move-the-sf-table-notifiers-outside-the-devlink-loc.patch deleted file mode 100644 index 041d51210..000000000 --- a/SOURCES/1632-net-mlx5-move-the-sf-table-notifiers-outside-the-devlink-loc.patch +++ /dev/null @@ -1,278 +0,0 @@ -From 0501aeebaf52fad09275228fd5f63cccc4a0b9ba Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Move the SF table notifiers outside the devlink - lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d4a0acbd94c2a93bf308a9fde9ab6719f5d98c7a -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:39 2025 +0200 - - net/mlx5: Move the SF table notifiers outside the devlink lock - - Move the SF table notifiers registration/unregistration outside of - mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / - mlx5_mdev_uninit() functions. - - This is only done for non-SFs, since SFs do not have a SF table - themselves and thus don't need notifiers. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 91cb5b45300f..240c30d380f5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1833,8 +1833,14 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - if (err) - goto err_sf_hw_notifier; - -+ err = mlx5_sf_notifiers_init(dev); -+ if (err) -+ goto err_sf_notifiers; -+ - return 0; - -+err_sf_notifiers: -+ mlx5_sf_hw_notifier_cleanup(dev); - err_sf_hw_notifier: - mlx5_events_cleanup(dev); - return err; -@@ -1842,6 +1848,7 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - - static void mlx5_notifiers_cleanup(struct mlx5_core_dev *dev) - { -+ mlx5_sf_notifiers_cleanup(dev); - mlx5_sf_hw_notifier_cleanup(dev); - mlx5_events_cleanup(dev); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -index 2ece4983d33f..b82323b8449e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/devlink.c -@@ -31,9 +31,6 @@ struct mlx5_sf_table { - struct mlx5_core_dev *dev; /* To refer from notifier context. */ - struct xarray function_ids; /* function id based lookup. */ - struct mutex sf_state_lock; /* Serializes sf state among user cmds & vhca event handler. */ -- struct notifier_block esw_nb; -- struct notifier_block vhca_nb; -- struct notifier_block mdev_nb; - }; - - static struct mlx5_sf * -@@ -391,11 +388,16 @@ static bool mlx5_sf_state_update_check(const struct mlx5_sf *sf, u8 new_state) - - static int mlx5_sf_vhca_event(struct notifier_block *nb, unsigned long opcode, void *data) - { -- struct mlx5_sf_table *table = container_of(nb, struct mlx5_sf_table, vhca_nb); -+ struct mlx5_core_dev *dev = container_of(nb, struct mlx5_core_dev, -+ priv.sf_table_vhca_nb); -+ struct mlx5_sf_table *table = dev->priv.sf_table; - const struct mlx5_vhca_state_event *event = data; - bool update = false; - struct mlx5_sf *sf; - -+ if (!table) -+ return 0; -+ - mutex_lock(&table->sf_state_lock); - sf = mlx5_sf_lookup_by_function_id(table, event->function_id); - if (!sf) -@@ -407,7 +409,7 @@ static int mlx5_sf_vhca_event(struct notifier_block *nb, unsigned long opcode, v - update = mlx5_sf_state_update_check(sf, event->new_vhca_state); - if (update) - sf->hw_state = event->new_vhca_state; -- trace_mlx5_sf_update_state(table->dev, sf->port_index, sf->controller, -+ trace_mlx5_sf_update_state(dev, sf->port_index, sf->controller, - sf->hw_fn_id, sf->hw_state); - unlock: - mutex_unlock(&table->sf_state_lock); -@@ -425,12 +427,16 @@ static void mlx5_sf_del_all(struct mlx5_sf_table *table) - - static int mlx5_sf_esw_event(struct notifier_block *nb, unsigned long event, void *data) - { -- struct mlx5_sf_table *table = container_of(nb, struct mlx5_sf_table, esw_nb); -+ struct mlx5_core_dev *dev = container_of(nb, struct mlx5_core_dev, -+ priv.sf_table_esw_nb); - const struct mlx5_esw_event_info *mode = data; - -+ if (!dev->priv.sf_table) -+ return 0; -+ - switch (mode->new_mode) { - case MLX5_ESWITCH_LEGACY: -- mlx5_sf_del_all(table); -+ mlx5_sf_del_all(dev->priv.sf_table); - break; - default: - break; -@@ -441,15 +447,16 @@ static int mlx5_sf_esw_event(struct notifier_block *nb, unsigned long event, voi - - static int mlx5_sf_mdev_event(struct notifier_block *nb, unsigned long event, void *data) - { -- struct mlx5_sf_table *table = container_of(nb, struct mlx5_sf_table, mdev_nb); -+ struct mlx5_core_dev *dev = container_of(nb, struct mlx5_core_dev, -+ priv.sf_table_mdev_nb); - struct mlx5_sf_peer_devlink_event_ctx *event_ctx = data; -+ struct mlx5_sf_table *table = dev->priv.sf_table; - int ret = NOTIFY_DONE; - struct mlx5_sf *sf; - -- if (event != MLX5_DRIVER_EVENT_SF_PEER_DEVLINK) -+ if (!table || event != MLX5_DRIVER_EVENT_SF_PEER_DEVLINK) - return NOTIFY_DONE; - -- - mutex_lock(&table->sf_state_lock); - sf = mlx5_sf_lookup_by_function_id(table, event_ctx->fn_id); - if (!sf) -@@ -464,10 +471,40 @@ static int mlx5_sf_mdev_event(struct notifier_block *nb, unsigned long event, vo - return ret; - } - -+int mlx5_sf_notifiers_init(struct mlx5_core_dev *dev) -+{ -+ int err; -+ -+ if (mlx5_core_is_sf(dev)) -+ return 0; -+ -+ dev->priv.sf_table_esw_nb.notifier_call = mlx5_sf_esw_event; -+ err = mlx5_esw_event_notifier_register(dev, &dev->priv.sf_table_esw_nb); -+ if (err) -+ return err; -+ -+ dev->priv.sf_table_vhca_nb.notifier_call = mlx5_sf_vhca_event; -+ err = mlx5_vhca_event_notifier_register(dev, -+ &dev->priv.sf_table_vhca_nb); -+ if (err) -+ goto vhca_err; -+ -+ dev->priv.sf_table_mdev_nb.notifier_call = mlx5_sf_mdev_event; -+ err = mlx5_blocking_notifier_register(dev, &dev->priv.sf_table_mdev_nb); -+ if (err) -+ goto mdev_err; -+ -+ return 0; -+mdev_err: -+ mlx5_vhca_event_notifier_unregister(dev, &dev->priv.sf_table_vhca_nb); -+vhca_err: -+ mlx5_esw_event_notifier_unregister(dev, &dev->priv.sf_table_esw_nb); -+ return err; -+} -+ - int mlx5_sf_table_init(struct mlx5_core_dev *dev) - { - struct mlx5_sf_table *table; -- int err; - - if (!mlx5_sf_table_supported(dev) || !mlx5_vhca_event_supported(dev)) - return 0; -@@ -480,28 +517,18 @@ int mlx5_sf_table_init(struct mlx5_core_dev *dev) - table->dev = dev; - xa_init(&table->function_ids); - dev->priv.sf_table = table; -- table->esw_nb.notifier_call = mlx5_sf_esw_event; -- err = mlx5_esw_event_notifier_register(dev, &table->esw_nb); -- if (err) -- goto reg_err; -- -- table->vhca_nb.notifier_call = mlx5_sf_vhca_event; -- err = mlx5_vhca_event_notifier_register(table->dev, &table->vhca_nb); -- if (err) -- goto vhca_err; -- -- table->mdev_nb.notifier_call = mlx5_sf_mdev_event; -- mlx5_blocking_notifier_register(dev, &table->mdev_nb); - - return 0; -+} - --vhca_err: -- mlx5_esw_event_notifier_unregister(dev, &table->esw_nb); --reg_err: -- mutex_destroy(&table->sf_state_lock); -- kfree(table); -- dev->priv.sf_table = NULL; -- return err; -+void mlx5_sf_notifiers_cleanup(struct mlx5_core_dev *dev) -+{ -+ if (mlx5_core_is_sf(dev)) -+ return; -+ -+ mlx5_blocking_notifier_unregister(dev, &dev->priv.sf_table_mdev_nb); -+ mlx5_vhca_event_notifier_unregister(dev, &dev->priv.sf_table_vhca_nb); -+ mlx5_esw_event_notifier_unregister(dev, &dev->priv.sf_table_esw_nb); - } - - void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) -@@ -511,9 +538,6 @@ void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - if (!table) - return; - -- mlx5_blocking_notifier_unregister(dev, &table->mdev_nb); -- mlx5_vhca_event_notifier_unregister(table->dev, &table->vhca_nb); -- mlx5_esw_event_notifier_unregister(dev, &table->esw_nb); - mutex_destroy(&table->sf_state_lock); - WARN_ON(!xa_empty(&table->function_ids)); - kfree(table); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -index 3922dacffae8..d8a934a0e968 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/sf.h -@@ -16,7 +16,9 @@ int mlx5_sf_hw_notifier_init(struct mlx5_core_dev *dev); - void mlx5_sf_hw_notifier_cleanup(struct mlx5_core_dev *dev); - void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev); - -+int mlx5_sf_notifiers_init(struct mlx5_core_dev *dev); - int mlx5_sf_table_init(struct mlx5_core_dev *dev); -+void mlx5_sf_notifiers_cleanup(struct mlx5_core_dev *dev); - void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev); - bool mlx5_sf_table_empty(const struct mlx5_core_dev *dev); - -@@ -58,11 +60,20 @@ static inline void mlx5_sf_hw_table_destroy(struct mlx5_core_dev *dev) - { - } - -+static inline int mlx5_sf_notifiers_init(struct mlx5_core_dev *dev) -+{ -+ return 0; -+} -+ - static inline int mlx5_sf_table_init(struct mlx5_core_dev *dev) - { - return 0; - } - -+static inline void mlx5_sf_notifiers_cleanup(struct mlx5_core_dev *dev) -+{ -+} -+ - static inline void mlx5_sf_table_cleanup(struct mlx5_core_dev *dev) - { - } -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index d6c5bcebdaca..6af62047a614 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -622,6 +622,9 @@ struct mlx5_priv { - #ifdef CONFIG_MLX5_SF_MANAGER - struct notifier_block sf_hw_table_vhca_nb; - struct mlx5_sf_hw_table *sf_hw_table; -+ struct notifier_block sf_table_esw_nb; -+ struct notifier_block sf_table_vhca_nb; -+ struct notifier_block sf_table_mdev_nb; - struct mlx5_sf_table *sf_table; - #endif - struct blocking_notifier_head lag_nh; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1633-net-mlx5-move-sf-dev-table-notifier-registration-outside-the.patch b/SOURCES/1633-net-mlx5-move-sf-dev-table-notifier-registration-outside-the.patch deleted file mode 100644 index 694771c39..000000000 --- a/SOURCES/1633-net-mlx5-move-sf-dev-table-notifier-registration-outside-the.patch +++ /dev/null @@ -1,241 +0,0 @@ -From 8eac199fc546e3d296c918e5395ce4e5b94c2254 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5: Move SF dev table notifier registration outside the - PF devlink lock - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 64ad6470c882fcaecfa4a1da96ea94de7ca0dc80 -Author: Cosmin Ratiu -Date: Sun Nov 16 22:45:40 2025 +0200 - - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock - - This completes the previous patches by moving notifier registration for - SF dev tables outside the devlink locked critical section in - mlx5_init_one() / mlx5_uninit_one() and into the mlx5_mdev_init() / - mlx5_mdev_uninit() functions. - - This is only done for non-SFs, since SFs do not have a SF HW table - themselves. - - After this patch, notifiers can grab the PF devlink lock (soon to be - necessary) without creating a locking cycle. - - Signed-off-by: Cosmin Ratiu - Reviewed-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1763325940-1231508-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 240c30d380f5..a0f937c29891 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1837,8 +1837,14 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - if (err) - goto err_sf_notifiers; - -+ err = mlx5_sf_dev_notifier_init(dev); -+ if (err) -+ goto err_sf_dev_notifier; -+ - return 0; - -+err_sf_dev_notifier: -+ mlx5_sf_notifiers_cleanup(dev); - err_sf_notifiers: - mlx5_sf_hw_notifier_cleanup(dev); - err_sf_hw_notifier: -@@ -1848,6 +1854,7 @@ static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - - static void mlx5_notifiers_cleanup(struct mlx5_core_dev *dev) - { -+ mlx5_sf_dev_notifier_cleanup(dev); - mlx5_sf_notifiers_cleanup(dev); - mlx5_sf_hw_notifier_cleanup(dev); - mlx5_events_cleanup(dev); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -index a68a8ee24dce..f310bde3d11f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.c -@@ -16,7 +16,6 @@ struct mlx5_sf_dev_table { - struct xarray devices; - phys_addr_t base_address; - u64 sf_bar_length; -- struct notifier_block nb; - struct workqueue_struct *active_wq; - struct work_struct work; - u8 stop_active_wq:1; -@@ -156,18 +155,23 @@ static void mlx5_sf_dev_del(struct mlx5_core_dev *dev, struct mlx5_sf_dev *sf_de - static int - mlx5_sf_dev_state_change_handler(struct notifier_block *nb, unsigned long event_code, void *data) - { -- struct mlx5_sf_dev_table *table = container_of(nb, struct mlx5_sf_dev_table, nb); -+ struct mlx5_core_dev *dev = container_of(nb, struct mlx5_core_dev, -+ priv.sf_dev_nb); -+ struct mlx5_sf_dev_table *table = dev->priv.sf_dev_table; - const struct mlx5_vhca_state_event *event = data; - struct mlx5_sf_dev *sf_dev; - u16 max_functions; - u16 sf_index; - u16 base_id; - -- max_functions = mlx5_sf_max_functions(table->dev); -+ if (!table) -+ return 0; -+ -+ max_functions = mlx5_sf_max_functions(dev); - if (!max_functions) - return 0; - -- base_id = mlx5_sf_start_function_id(table->dev); -+ base_id = mlx5_sf_start_function_id(dev); - if (event->function_id < base_id || event->function_id >= (base_id + max_functions)) - return 0; - -@@ -177,19 +181,19 @@ mlx5_sf_dev_state_change_handler(struct notifier_block *nb, unsigned long event_ - case MLX5_VHCA_STATE_INVALID: - case MLX5_VHCA_STATE_ALLOCATED: - if (sf_dev) -- mlx5_sf_dev_del(table->dev, sf_dev, sf_index); -+ mlx5_sf_dev_del(dev, sf_dev, sf_index); - break; - case MLX5_VHCA_STATE_TEARDOWN_REQUEST: - if (sf_dev) -- mlx5_sf_dev_del(table->dev, sf_dev, sf_index); -+ mlx5_sf_dev_del(dev, sf_dev, sf_index); - else -- mlx5_core_err(table->dev, -+ mlx5_core_err(dev, - "SF DEV: teardown state for invalid dev index=%d sfnum=0x%x\n", - sf_index, event->sw_function_id); - break; - case MLX5_VHCA_STATE_ACTIVE: - if (!sf_dev) -- mlx5_sf_dev_add(table->dev, sf_index, event->function_id, -+ mlx5_sf_dev_add(dev, sf_index, event->function_id, - event->sw_function_id); - break; - default: -@@ -315,6 +319,15 @@ static void mlx5_sf_dev_destroy_active_works(struct mlx5_sf_dev_table *table) - } - } - -+int mlx5_sf_dev_notifier_init(struct mlx5_core_dev *dev) -+{ -+ if (mlx5_core_is_sf(dev)) -+ return 0; -+ -+ dev->priv.sf_dev_nb.notifier_call = mlx5_sf_dev_state_change_handler; -+ return mlx5_vhca_event_notifier_register(dev, &dev->priv.sf_dev_nb); -+} -+ - void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) - { - struct mlx5_sf_dev_table *table; -@@ -329,17 +342,12 @@ void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) - goto table_err; - } - -- table->nb.notifier_call = mlx5_sf_dev_state_change_handler; - table->dev = dev; - table->sf_bar_length = 1 << (MLX5_CAP_GEN(dev, log_min_sf_size) + 12); - table->base_address = pci_resource_start(dev->pdev, 2); - xa_init(&table->devices); - dev->priv.sf_dev_table = table; - -- err = mlx5_vhca_event_notifier_register(dev, &table->nb); -- if (err) -- goto vhca_err; -- - err = mlx5_sf_dev_create_active_works(table); - if (err) - goto add_active_err; -@@ -351,10 +359,8 @@ void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) - - arm_err: - mlx5_sf_dev_destroy_active_works(table); --add_active_err: -- mlx5_vhca_event_notifier_unregister(dev, &table->nb); - mlx5_vhca_event_work_queues_flush(dev); --vhca_err: -+add_active_err: - kfree(table); - dev->priv.sf_dev_table = NULL; - table_err: -@@ -372,6 +378,14 @@ static void mlx5_sf_dev_destroy_all(struct mlx5_sf_dev_table *table) - } - } - -+void mlx5_sf_dev_notifier_cleanup(struct mlx5_core_dev *dev) -+{ -+ if (mlx5_core_is_sf(dev)) -+ return; -+ -+ mlx5_vhca_event_notifier_unregister(dev, &dev->priv.sf_dev_nb); -+} -+ - void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev) - { - struct mlx5_sf_dev_table *table = dev->priv.sf_dev_table; -@@ -380,7 +394,6 @@ void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev) - return; - - mlx5_sf_dev_destroy_active_works(table); -- mlx5_vhca_event_notifier_unregister(dev, &table->nb); - - /* Now that event handler is not running, it is safe to destroy - * the sf device without race. -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.h b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.h -index b99131e95e37..3ab0449c770c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/dev.h -@@ -25,7 +25,9 @@ struct mlx5_sf_peer_devlink_event_ctx { - int err; - }; - -+int mlx5_sf_dev_notifier_init(struct mlx5_core_dev *dev); - void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev); -+void mlx5_sf_dev_notifier_cleanup(struct mlx5_core_dev *dev); - void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev); - - int mlx5_sf_driver_register(void); -@@ -35,10 +37,19 @@ bool mlx5_sf_dev_allocated(const struct mlx5_core_dev *dev); - - #else - -+static inline int mlx5_sf_dev_notifier_init(struct mlx5_core_dev *dev) -+{ -+ return 0; -+} -+ - static inline void mlx5_sf_dev_table_create(struct mlx5_core_dev *dev) - { - } - -+static inline void mlx5_sf_dev_notifier_cleanup(struct mlx5_core_dev *dev) -+{ -+} -+ - static inline void mlx5_sf_dev_table_destroy(struct mlx5_core_dev *dev) - { - } -diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h -index 6af62047a614..1c54aa6f74fb 100644 ---- a/include/linux/mlx5/driver.h -+++ b/include/linux/mlx5/driver.h -@@ -616,6 +616,7 @@ struct mlx5_priv { - #ifdef CONFIG_MLX5_SF - struct mlx5_nb vhca_state_nb; - struct blocking_notifier_head vhca_state_n_head; -+ struct notifier_block sf_dev_nb; - struct mlx5_sf_dev_table *sf_dev_table; - struct mlx5_core_dev *parent_mdev; - #endif --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1634-net-mlx5e-use-u64-instead-of-u64-in-ieee-setmaxrate.patch b/SOURCES/1634-net-mlx5e-use-u64-instead-of-u64-in-ieee-setmaxrate.patch deleted file mode 100644 index d962229ff..000000000 --- a/SOURCES/1634-net-mlx5e-use-u64-instead-of-u64-in-ieee-setmaxrate.patch +++ /dev/null @@ -1,42 +0,0 @@ -From b3d0adbb647eb3a4fbbf0cb2bb76437601a97598 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:30 -0400 -Subject: [PATCH] net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e1de33c377b685298da406bb4838bd9814194f96 -Author: Gal Pressman -Date: Sun Nov 30 12:25:31 2025 +0200 - - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate - - Change upper_limit_mbps/gbps from __u64 to u64 to follow kernel coding - conventions. - - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1764498334-1327918-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 84e700777941..b06b65167787 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -595,8 +595,8 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - u8 max_bw_value[IEEE_8021QAZ_MAX_TCS]; - u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS]; -- __u64 upper_limit_mbps; -- __u64 upper_limit_gbps; -+ u64 upper_limit_mbps; -+ u64 upper_limit_gbps; - int i; - struct { - int scale; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1635-net-mlx5e-rename-upper-limit-mbps-to-upper-limit-100mbps.patch b/SOURCES/1635-net-mlx5e-rename-upper-limit-mbps-to-upper-limit-100mbps.patch deleted file mode 100644 index d6c174764..000000000 --- a/SOURCES/1635-net-mlx5e-rename-upper-limit-mbps-to-upper-limit-100mbps.patch +++ /dev/null @@ -1,58 +0,0 @@ -From c0b5bcdd57bf923bb87df30c72552385313befd4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:31 -0400 -Subject: [PATCH] net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e1098bb02f2d9a85a127aecad6378e4f159acce5 -Author: Gal Pressman -Date: Sun Nov 30 12:25:32 2025 +0200 - - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps - - Clarify that the limit represents the threshold for using 100 Mbps - units rather than a general Mbps limit. - - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1764498334-1327918-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index b06b65167787..892aae41fe2f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -595,7 +595,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - struct mlx5_core_dev *mdev = priv->mdev; - u8 max_bw_value[IEEE_8021QAZ_MAX_TCS]; - u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS]; -- u64 upper_limit_mbps; -+ u64 upper_limit_100mbps; - u64 upper_limit_gbps; - int i; - struct { -@@ -614,7 +614,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -- upper_limit_mbps = 255 * MLX5E_100MB; -+ upper_limit_100mbps = 255 * MLX5E_100MB; - upper_limit_gbps = 255 * MLX5E_1GB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { -@@ -622,7 +622,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - max_bw_unit[i] = MLX5_BW_NO_LIMIT; - continue; - } -- if (maxrate->tc_maxrate[i] <= upper_limit_mbps) { -+ if (maxrate->tc_maxrate[i] <= upper_limit_100mbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], - MLX5E_100MB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1636-net-mlx5e-use-u8-max-instead-of-hard-coded-magic-number.patch b/SOURCES/1636-net-mlx5e-use-u8-max-instead-of-hard-coded-magic-number.patch deleted file mode 100644 index 79a66fc12..000000000 --- a/SOURCES/1636-net-mlx5e-use-u8-max-instead-of-hard-coded-magic-number.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 3547ea962b6e8d4d768dc25d5e63ddadb6cb30b2 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:31 -0400 -Subject: [PATCH] net/mlx5e: Use U8_MAX instead of hard coded magic number - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 53f7a771285182be7bfba6d59ccdd0d47fc1a097 -Author: Gal Pressman -Date: Sun Nov 30 12:25:33 2025 +0200 - - net/mlx5e: Use U8_MAX instead of hard coded magic number - - Replace hard coded 255 magic number with U8_MAX (the register field is 8 - bits). - - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1764498334-1327918-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 892aae41fe2f..9229e94b9909 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -614,8 +614,8 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -- upper_limit_100mbps = 255 * MLX5E_100MB; -- upper_limit_gbps = 255 * MLX5E_1GB; -+ upper_limit_100mbps = U8_MAX * MLX5E_100MB; -+ upper_limit_gbps = U8_MAX * MLX5E_1GB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - if (!maxrate->tc_maxrate[i]) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1637-net-mlx5e-use-standard-unit-definitions-for-bandwidth-conver.patch b/SOURCES/1637-net-mlx5e-use-standard-unit-definitions-for-bandwidth-conver.patch deleted file mode 100644 index debb43026..000000000 --- a/SOURCES/1637-net-mlx5e-use-standard-unit-definitions-for-bandwidth-conver.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 796a108303c5f16c626de7c80ee67ca9442bd13e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:31 -0400 -Subject: [PATCH] net/mlx5e: Use standard unit definitions for bandwidth - conversion - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 87a5112bfc406a72c6bf1e8cdef9b0169dc1df6a -Author: Gal Pressman -Date: Sun Nov 30 12:25:34 2025 +0200 - - net/mlx5e: Use standard unit definitions for bandwidth conversion - - MLX5E_100MB and MLX5E_1GB defines are confusing, MLX5E_100MB is not - equal to 100 * MEGA, and MLX5E_1GB is not equal to one GIGA, as they - hide the Kbps rate conversion required for ieee_maxrate. - - Replace hardcoded bandwidth conversion values with standard unit - definitions from linux/units.h. Rename MLX5E_100MB/MLX5E_1GB to - MLX5E_100MB_TO_KB/MLX5E_1GB_TO_KB to clarify these are conversion - factors to Kbps, not absolute bandwidth values. - - Signed-off-by: Gal Pressman - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1764498334-1327918-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -index 9229e94b9909..585ac619e5e8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c -@@ -31,14 +31,15 @@ - */ - #include - #include -+#include - #include "en.h" - #include "en/port.h" - #include "en/port_buffer.h" - - #define MLX5E_MAX_BW_ALLOC 100 /* Max percentage of BW allocation */ - --#define MLX5E_100MB (100000) --#define MLX5E_1GB (1000000) -+#define MLX5E_100MB_TO_KB (100 * MEGA / KILO) -+#define MLX5E_1GB_TO_KB (GIGA / KILO) - - #define MLX5E_CEE_STATE_UP 1 - #define MLX5E_CEE_STATE_DOWN 0 -@@ -572,10 +573,10 @@ static int mlx5e_dcbnl_ieee_getmaxrate(struct net_device *netdev, - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - switch (max_bw_unit[i]) { - case MLX5_100_MBPS_UNIT: -- maxrate->tc_maxrate[i] = max_bw_value[i] * MLX5E_100MB; -+ maxrate->tc_maxrate[i] = max_bw_value[i] * MLX5E_100MB_TO_KB; - break; - case MLX5_GBPS_UNIT: -- maxrate->tc_maxrate[i] = max_bw_value[i] * MLX5E_1GB; -+ maxrate->tc_maxrate[i] = max_bw_value[i] * MLX5E_1GB_TO_KB; - break; - case MLX5_BW_NO_LIMIT: - break; -@@ -614,8 +615,8 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - - memset(max_bw_value, 0, sizeof(max_bw_value)); - memset(max_bw_unit, 0, sizeof(max_bw_unit)); -- upper_limit_100mbps = U8_MAX * MLX5E_100MB; -- upper_limit_gbps = U8_MAX * MLX5E_1GB; -+ upper_limit_100mbps = U8_MAX * MLX5E_100MB_TO_KB; -+ upper_limit_gbps = U8_MAX * MLX5E_1GB_TO_KB; - - for (i = 0; i <= mlx5_max_tc(mdev); i++) { - if (!maxrate->tc_maxrate[i]) { -@@ -624,12 +625,12 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev, - } - if (maxrate->tc_maxrate[i] <= upper_limit_100mbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], -- MLX5E_100MB); -+ MLX5E_100MB_TO_KB); - max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1; - max_bw_unit[i] = MLX5_100_MBPS_UNIT; - } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) { - max_bw_value[i] = div_u64(maxrate->tc_maxrate[i], -- MLX5E_1GB); -+ MLX5E_1GB_TO_KB); - max_bw_unit[i] = MLX5_GBPS_UNIT; - } else { - netdev_err(netdev, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1638-net-mlx5e-update-xdp-features-in-switch-channels.patch b/SOURCES/1638-net-mlx5e-update-xdp-features-in-switch-channels.patch deleted file mode 100644 index f89db9aec..000000000 --- a/SOURCES/1638-net-mlx5e-update-xdp-features-in-switch-channels.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 9e854a91756c19006bbdf08d8b42d112a2f5f1b1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 14:59:31 -0400 -Subject: [PATCH] net/mlx5e: Update XDP features in switch channels - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 96a8395061358adcd4b6a4f0f4c8989ec69e8659 -Author: Tariq Toukan -Date: Sun Nov 30 12:13:36 2025 +0200 - - net/mlx5e: Update XDP features in switch channels - - The XDP features state might depend of the state of other features, like - HW-LRO / HW-GRO. - - In general, move the re-evaluation announcement of the XDP features - (xdp_set_features_flag_locked) into the flow where configuration gets - changed. There's no point in updating them elsewhere. - - This is a more appropriate place, as this modifies the announced - features while channels are inactive, which avoids the small interval - between channel activation and the proper setting of the XDP features. - - Signed-off-by: Tariq Toukan - Reviewed-by: Dragos Tatulea - Reviewed-by: William Tu - Link: https://patch.msgid.link/1764497617-1326331-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 85f940869968..a1d33c78aedd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1242,7 +1242,7 @@ void mlx5e_netdev_attach_nic_profile(struct mlx5e_priv *priv); - void mlx5e_set_netdev_mtu_boundaries(struct mlx5e_priv *priv); - void mlx5e_build_nic_params(struct mlx5e_priv *priv, struct mlx5e_xsk *xsk, u16 mtu); - --void mlx5e_set_xdp_feature(struct net_device *netdev); -+void mlx5e_set_xdp_feature(struct mlx5e_priv *priv); - netdev_features_t mlx5e_features_check(struct sk_buff *skb, - struct net_device *netdev, - netdev_features_t features); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -index 6e12bd196ec9..12ecb949bcc5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c -@@ -2293,7 +2293,6 @@ static int set_pflag_rx_striding_rq(struct net_device *netdev, bool enable) - struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = priv->mdev; - struct mlx5e_params new_params; -- int err; - - if (enable) { - /* Checking the regular RQ here; mlx5e_validate_xsk_param called -@@ -2314,14 +2313,7 @@ static int set_pflag_rx_striding_rq(struct net_device *netdev, bool enable) - MLX5E_SET_PFLAG(&new_params, MLX5E_PFLAG_RX_STRIDING_RQ, enable); - mlx5e_set_rq_type(mdev, &new_params); - -- err = mlx5e_safe_switch_params(priv, &new_params, NULL, NULL, true); -- if (err) -- return err; -- -- /* update XDP supported features */ -- mlx5e_set_xdp_feature(netdev); -- -- return 0; -+ return mlx5e_safe_switch_params(priv, &new_params, NULL, NULL, true); - } - - static int set_pflag_rx_no_csum_complete(struct net_device *netdev, bool enable) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 261b96e41d7e..7c1f458a61f5 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -3337,6 +3337,7 @@ static int mlx5e_switch_priv_params(struct mlx5e_priv *priv, - } - } - -+ mlx5e_set_xdp_feature(priv); - return 0; - } - -@@ -3368,6 +3369,7 @@ static int mlx5e_switch_priv_channels(struct mlx5e_priv *priv, - } - } - -+ mlx5e_set_xdp_feature(priv); - if (!MLX5_CAP_GEN(priv->mdev, tis_tir_td_order)) - mlx5e_close_channels(old_chs); - priv->profile->update_rx(priv); -@@ -4376,10 +4378,10 @@ static int mlx5e_handle_feature(struct net_device *netdev, - return 0; - } - --void mlx5e_set_xdp_feature(struct net_device *netdev) -+void mlx5e_set_xdp_feature(struct mlx5e_priv *priv) - { -- struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5e_params *params = &priv->channels.params; -+ struct net_device *netdev = priv->netdev; - xdp_features_t val; - - if (!netdev->netdev_ops->ndo_bpf || -@@ -4428,9 +4430,6 @@ int mlx5e_set_features(struct net_device *netdev, netdev_features_t features) - return -EINVAL; - } - -- /* update XDP supported features */ -- mlx5e_set_xdp_feature(netdev); -- - return 0; - } - -@@ -5805,7 +5804,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) - netdev->priv_flags |= IFF_UNICAST_FLT; - - netif_set_tso_max_size(netdev, GSO_MAX_SIZE); -- mlx5e_set_xdp_feature(netdev); -+ mlx5e_set_xdp_feature(priv); - mlx5e_set_netdev_dev_addr(netdev); - mlx5e_macsec_build_netdev(priv); - mlx5e_ipsec_build_netdev(priv); -@@ -5898,7 +5897,7 @@ static int mlx5e_nic_init(struct mlx5_core_dev *mdev, - rtnl_lock(); - - /* update XDP supported features */ -- mlx5e_set_xdp_feature(netdev); -+ mlx5e_set_xdp_feature(priv); - - if (take_rtnl) - rtnl_unlock(); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index d19d743a88ae..8490e2039f7f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -866,7 +866,7 @@ static void mlx5e_build_rep_params(struct net_device *netdev) - if (take_rtnl) - rtnl_lock(); - /* update XDP supported features */ -- mlx5e_set_xdp_feature(netdev); -+ mlx5e_set_xdp_feature(priv); - if (take_rtnl) - rtnl_unlock(); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1639-net-mlx5e-support-xdp-target-xmit-with-dummy-program.patch b/SOURCES/1639-net-mlx5e-support-xdp-target-xmit-with-dummy-program.patch deleted file mode 100644 index 7ac8f0c9c..000000000 --- a/SOURCES/1639-net-mlx5e-support-xdp-target-xmit-with-dummy-program.patch +++ /dev/null @@ -1,88 +0,0 @@ -From debb682ed668b08f9b59751749f9d83c3a496622 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:05:59 -0400 -Subject: [PATCH] net/mlx5e: Support XDP target xmit with dummy program - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to the missing of the following commit: -8f7b00307bf1 ("net/mlx5e: Convert mlx5 netdevs to instance locking") - -commit d4aa0cc9bd31f3e0cd5f067d649bf39135e4b46b -Author: Tariq Toukan -Date: Sun Nov 30 12:13:37 2025 +0200 - - net/mlx5e: Support XDP target xmit with dummy program - - Save per-channel resources in default, in device and host memory. - - As no better API exist, make the XDP-redirect-target SQ available by - loading a dummy XDP program. - - This improves the latency of interface up/down operations when feature - is disabled. - - Perf numbers: - NIC: Connect-X7. - Setup: 248 channels, default mtu and rx/tx ring sizes. - - Interface up + down: - Before: 2.246 secs - After: 1.798 secs (-0.448 sec) - - Saves ~1.8 msec per channel. - - Signed-off-by: Tariq Toukan - Reviewed-by: Dragos Tatulea - Reviewed-by: William Tu - Link: https://patch.msgid.link/1764497617-1326331-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 7c1f458a61f5..e69a67aa54f4 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -2584,7 +2584,7 @@ static int mlx5e_open_queues(struct mlx5e_channel *c, - if (err) - goto err_close_icosq_cq; - -- if (netdev_ops->ndo_xdp_xmit) { -+ if (netdev_ops->ndo_xdp_xmit && c->xdp) { - c->xdpsq = mlx5e_open_xdpredirect_sq(c, params, cparam, &ccp); - if (IS_ERR(c->xdpsq)) { - err = PTR_ERR(c->xdpsq); -@@ -4382,19 +4382,18 @@ void mlx5e_set_xdp_feature(struct mlx5e_priv *priv) - { - struct mlx5e_params *params = &priv->channels.params; - struct net_device *netdev = priv->netdev; -- xdp_features_t val; -+ xdp_features_t val = 0; - -- if (!netdev->netdev_ops->ndo_bpf || -- params->packet_merge.type != MLX5E_PACKET_MERGE_NONE) { -- xdp_clear_features_flag(netdev); -- return; -- } -+ if (netdev->netdev_ops->ndo_bpf && -+ params->packet_merge.type == MLX5E_PACKET_MERGE_NONE) -+ val = NETDEV_XDP_ACT_BASIC | NETDEV_XDP_ACT_REDIRECT | -+ NETDEV_XDP_ACT_XSK_ZEROCOPY | -+ NETDEV_XDP_ACT_RX_SG; -+ -+ if (netdev->netdev_ops->ndo_xdp_xmit && params->xdp_prog) -+ val |= NETDEV_XDP_ACT_NDO_XMIT | -+ NETDEV_XDP_ACT_NDO_XMIT_SG; - -- val = NETDEV_XDP_ACT_BASIC | NETDEV_XDP_ACT_REDIRECT | -- NETDEV_XDP_ACT_XSK_ZEROCOPY | -- NETDEV_XDP_ACT_RX_SG | -- NETDEV_XDP_ACT_NDO_XMIT | -- NETDEV_XDP_ACT_NDO_XMIT_SG; - xdp_set_features_flag(netdev, val); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1640-net-mlx5-make-enable-mpesw-idempotent.patch b/SOURCES/1640-net-mlx5-make-enable-mpesw-idempotent.patch deleted file mode 100644 index 3222f10e8..000000000 --- a/SOURCES/1640-net-mlx5-make-enable-mpesw-idempotent.patch +++ /dev/null @@ -1,60 +0,0 @@ -From bf157e13863b52747166fe7dd75eb43def8ee477 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:57 -0400 -Subject: [PATCH] net/mlx5: make enable_mpesw idempotent - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit cd7671ef4cf2edf73cd2a3dca3a2f522a4525bf5 -Author: Moshe Shemesh -Date: Mon Dec 1 17:13:27 2025 +0200 - - net/mlx5: make enable_mpesw idempotent - - The enable_mpesw() function returns -EINVAL if ldev->mode is not - MLX5_LAG_MODE_NONE. This means attempting to enable MPESW mode when it's - already enabled will fail. In contrast, disable_mpesw() properly checks - if the mode is MLX5_LAG_MODE_MPESW before proceeding, making it - naturally idempotent and safe to call multiple times. - - Fix enable_mpesw() to return success if mpesw is already enabled. - - Fixes: a32327a3a02c ("net/mlx5: Lag, Control MultiPort E-Switch single FDB mode") - Signed-off-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1764602008-1334866-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -index aad52d3a90e6..2d86af8f0d9b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mpesw.c -@@ -67,12 +67,19 @@ static int mlx5_mpesw_metadata_set(struct mlx5_lag *ldev) - - static int enable_mpesw(struct mlx5_lag *ldev) - { -- int idx = mlx5_lag_get_dev_index_by_seq(ldev, MLX5_LAG_P1); - struct mlx5_core_dev *dev0; - int err; -+ int idx; - int i; - -- if (idx < 0 || ldev->mode != MLX5_LAG_MODE_NONE) -+ if (ldev->mode == MLX5_LAG_MODE_MPESW) -+ return 0; -+ -+ if (ldev->mode != MLX5_LAG_MODE_NONE) -+ return -EINVAL; -+ -+ idx = mlx5_lag_get_dev_index_by_seq(ldev, MLX5_LAG_P1); -+ if (idx < 0) - return -EINVAL; - - dev0 = ldev->pf[idx].dev; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1641-net-mlx5-fix-double-unregister-of-hca-ports-component.patch b/SOURCES/1641-net-mlx5-fix-double-unregister-of-hca-ports-component.patch deleted file mode 100644 index a508db2c5..000000000 --- a/SOURCES/1641-net-mlx5-fix-double-unregister-of-hca-ports-component.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 494a5454615c502d757998af84c0ddbbea83c72e Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:57 -0400 -Subject: [PATCH] net/mlx5: Fix double unregister of HCA_PORTS component - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6a107cfe9c99a079e578a4c5eb70038101a3599f -Author: Gerd Bayer -Date: Tue Dec 2 12:12:57 2025 +0100 - - net/mlx5: Fix double unregister of HCA_PORTS component - - Clear hca_devcom_comp in device's private data after unregistering it in - LAG teardown. Otherwise a slightly lagging second pass through - mlx5_unload_one() might try to unregister it again and trip over - use-after-free. - - On s390 almost all PCI level recovery events trigger two passes through - mxl5_unload_one() - one through the poll_health() method and one through - mlx5_pci_err_detected() as callback from generic PCI error recovery. - While testing PCI error recovery paths with more kernel debug features - enabled, this issue reproducibly led to kernel panics with the following - call chain: - - Unable to handle kernel pointer dereference in virtual kernel address space - Failing address: 6b6b6b6b6b6b6000 TEID: 6b6b6b6b6b6b6803 ESOP-2 FSI - Fault in home space mode while using kernel ASCE. - AS:00000000705c4007 R3:0000000000000024 - Oops: 0038 ilc:3 [#1]SMP - - CPU: 14 UID: 0 PID: 156 Comm: kmcheck Kdump: loaded Not tainted - 6.18.0-20251130.rc7.git0.16131a59cab1.300.fc43.s390x+debug #1 PREEMPT - - Krnl PSW : 0404e00180000000 0000020fc86aa1dc (__lock_acquire+0x5c/0x15f0) - R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 - Krnl GPRS: 0000000000000000 0000020f00000001 6b6b6b6b6b6b6c33 0000000000000000 - 0000000000000000 0000000000000000 0000000000000001 0000000000000000 - 0000000000000000 0000020fca28b820 0000000000000000 0000010a1ced8100 - 0000010a1ced8100 0000020fc9775068 0000018fce14f8b8 0000018fce14f7f8 - Krnl Code: 0000020fc86aa1cc: e3b003400004 lg %r11,832 - 0000020fc86aa1d2: a7840211 brc 8,0000020fc86aa5f4 - *0000020fc86aa1d6: c09000df0b25 larl %r9,0000020fca28b820 - >0000020fc86aa1dc: d50790002000 clc 0(8,%r9),0(%r2) - 0000020fc86aa1e2: a7840209 brc 8,0000020fc86aa5f4 - 0000020fc86aa1e6: c0e001100401 larl %r14,0000020fca8aa9e8 - 0000020fc86aa1ec: c01000e25a00 larl %r1,0000020fca2f55ec - 0000020fc86aa1f2: a7eb00e8 aghi %r14,232 - - Call Trace: - __lock_acquire+0x5c/0x15f0 - lock_acquire.part.0+0xf8/0x270 - lock_acquire+0xb0/0x1b0 - down_write+0x5a/0x250 - mlx5_detach_device+0x42/0x110 [mlx5_core] - mlx5_unload_one_devl_locked+0x50/0xc0 [mlx5_core] - mlx5_unload_one+0x42/0x60 [mlx5_core] - mlx5_pci_err_detected+0x94/0x150 [mlx5_core] - zpci_event_attempt_error_recovery+0xcc/0x388 - - Fixes: 5a977b5833b7 ("net/mlx5: Lag, move devcom registration to LAG layer") - Signed-off-by: Gerd Bayer - Reviewed-by: Moshe Shemesh - Acked-by: Tariq Toukan - Link: https://patch.msgid.link/20251202-fix_lag-v1-1-59e8177ffce0@linux.ibm.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -index 1ac933cd8f02..a459a30f36ca 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c -@@ -1413,6 +1413,7 @@ static int __mlx5_lag_dev_add_mdev(struct mlx5_core_dev *dev) - static void mlx5_lag_unregister_hca_devcom_comp(struct mlx5_core_dev *dev) - { - mlx5_devcom_unregister_component(dev->priv.hca_devcom_comp); -+ dev->priv.hca_devcom_comp = NULL; - } - - static int mlx5_lag_register_hca_devcom_comp(struct mlx5_core_dev *dev) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1642-net-mlx5-fw-reset-clear-reset-requested-on-drain-fw-reset.patch b/SOURCES/1642-net-mlx5-fw-reset-clear-reset-requested-on-drain-fw-reset.patch deleted file mode 100644 index 35e21fa4b..000000000 --- a/SOURCES/1642-net-mlx5-fw-reset-clear-reset-requested-on-drain-fw-reset.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 1eb2fb402f2e35219048887c0cecd272e3d3e0bb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:57 -0400 -Subject: [PATCH] net/mlx5: fw reset, clear reset requested on drain_fw_reset - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 89a898d63f6f588acf5c104c65c94a38b68c69a6 -Author: Moshe Shemesh -Date: Tue Dec 9 14:56:09 2025 +0200 - - net/mlx5: fw reset, clear reset requested on drain_fw_reset - - drain_fw_reset() waits for ongoing firmware reset events and blocks new - event handling, but does not clear the reset requested flag, and may - keep sync reset polling. - - To fix it, call mlx5_sync_reset_clear_reset_requested() to clear the - flag, stop sync reset polling, and resume health polling, ensuring - health issues are still detected after the firmware reset drain. - - Fixes: 16d42d313350 ("net/mlx5: Drain fw_reset when removing device") - Signed-off-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 89e399606877..33df0418e575 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -843,7 +843,8 @@ void mlx5_drain_fw_reset(struct mlx5_core_dev *dev) - cancel_work_sync(&fw_reset->reset_reload_work); - cancel_work_sync(&fw_reset->reset_now_work); - cancel_work_sync(&fw_reset->reset_abort_work); -- cancel_delayed_work(&fw_reset->reset_timeout_work); -+ if (test_bit(MLX5_FW_RESET_FLAGS_RESET_REQUESTED, &fw_reset->reset_flags)) -+ mlx5_sync_reset_clear_reset_requested(dev, true); - } - - static const struct devlink_param mlx5_fw_reset_devlink_params[] = { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1643-net-mlx5-drain-firmware-reset-in-shutdown-callback.patch b/SOURCES/1643-net-mlx5-drain-firmware-reset-in-shutdown-callback.patch deleted file mode 100644 index bc27c0b07..000000000 --- a/SOURCES/1643-net-mlx5-drain-firmware-reset-in-shutdown-callback.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 264b47175d28baa833a99a484e91d6ba85034fcb Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:57 -0400 -Subject: [PATCH] net/mlx5: Drain firmware reset in shutdown callback - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5846a365fc6476b02d6766963cf0985520f0385f -Author: Moshe Shemesh -Date: Tue Dec 9 14:56:10 2025 +0200 - - net/mlx5: Drain firmware reset in shutdown callback - - Invoke drain_fw_reset() in the shutdown callback to ensure all - firmware reset handling is completed before shutdown proceeds. - - Fixes: 16d42d313350 ("net/mlx5: Drain fw_reset when removing device") - Signed-off-by: Moshe Shemesh - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index a0f937c29891..bb794c276b7f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -2232,6 +2232,7 @@ static void shutdown(struct pci_dev *pdev) - - mlx5_core_info(dev, "Shutdown was called\n"); - set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state); -+ mlx5_drain_fw_reset(dev); - mlx5_drain_health_wq(dev); - err = mlx5_try_fast_unload(dev); - if (err) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1644-net-mlx5-fw-tracer-validate-format-string-parameters.patch b/SOURCES/1644-net-mlx5-fw-tracer-validate-format-string-parameters.patch deleted file mode 100644 index dcb0f8e41..000000000 --- a/SOURCES/1644-net-mlx5-fw-tracer-validate-format-string-parameters.patch +++ /dev/null @@ -1,196 +0,0 @@ -From f790fae387e151437057cc8a223b1fba282aecfa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5: fw_tracer, Validate format string parameters - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b35966042d20b14e2d83330049f77deec5229749 -Author: Shay Drory -Date: Tue Dec 9 14:56:11 2025 +0200 - - net/mlx5: fw_tracer, Validate format string parameters - - Add validation for format string parameters in the firmware tracer to - prevent potential security vulnerabilities and crashes from malformed - format strings received from firmware. - - The firmware tracer receives format strings from the device firmware and - uses them to format trace messages. Without proper validation, bad - firmware could provide format strings with invalid format specifiers - (e.g., %s, %p, %n) that could lead to crashes, or other undefined - behavior. - - Add mlx5_tracer_validate_params() to validate that all format specifiers - in trace strings are limited to safe integer/hex formats (%x, %d, %i, - %u, %llx, %lx, etc.). Reject strings containing other format types that - could be used to access arbitrary memory or cause crashes. - Invalid format strings are added to the trace output for visibility with - "BAD_FORMAT: " prefix. - - Fixes: 70dd6fdb8987 ("net/mlx5: FW tracer, parse traces and kernel tracing support") - Signed-off-by: Shay Drory - Reviewed-by: Moshe Shemesh - Reported-by: Breno Leitao - Closes: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/ - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -index 7bcf822a89f9..b415dfe5de45 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -@@ -33,6 +33,7 @@ - #include "lib/eq.h" - #include "fw_tracer.h" - #include "fw_tracer_tracepoint.h" -+#include - - static int mlx5_query_mtrc_caps(struct mlx5_fw_tracer *tracer) - { -@@ -358,6 +359,43 @@ static const char *VAL_PARM = "%llx"; - static const char *REPLACE_64_VAL_PARM = "%x%x"; - static const char *PARAM_CHAR = "%"; - -+static bool mlx5_is_valid_spec(const char *str) -+{ -+ /* Parse format specifiers to find the actual type. -+ * Structure: %[flags][width][.precision][length]type -+ * Skip flags, width, precision & length. -+ */ -+ while (isdigit(*str) || *str == '#' || *str == '.' || *str == 'l') -+ str++; -+ -+ /* Check if it's a valid integer/hex specifier: -+ * Valid formats: %x, %d, %i, %u, etc. -+ */ -+ if (*str != 'x' && *str != 'X' && *str != 'd' && *str != 'i' && -+ *str != 'u' && *str != 'c') -+ return false; -+ -+ return true; -+} -+ -+static bool mlx5_tracer_validate_params(const char *str) -+{ -+ const char *substr = str; -+ -+ if (!str) -+ return false; -+ -+ substr = strstr(substr, PARAM_CHAR); -+ while (substr) { -+ if (!mlx5_is_valid_spec(substr + 1)) -+ return false; -+ -+ substr = strstr(substr + 1, PARAM_CHAR); -+ } -+ -+ return true; -+} -+ - static int mlx5_tracer_message_hash(u32 message_id) - { - return jhash_1word(message_id, 0) & (MESSAGE_HASH_SIZE - 1); -@@ -419,6 +457,10 @@ static int mlx5_tracer_get_num_of_params(char *str) - char *substr, *pstr = str; - int num_of_params = 0; - -+ /* Validate that all parameters are valid before processing */ -+ if (!mlx5_tracer_validate_params(str)) -+ return -EINVAL; -+ - /* replace %llx with %x%x */ - substr = strstr(pstr, VAL_PARM); - while (substr) { -@@ -570,14 +612,17 @@ void mlx5_tracer_print_trace(struct tracer_string_format *str_frmt, - { - char tmp[512]; - -- snprintf(tmp, sizeof(tmp), str_frmt->string, -- str_frmt->params[0], -- str_frmt->params[1], -- str_frmt->params[2], -- str_frmt->params[3], -- str_frmt->params[4], -- str_frmt->params[5], -- str_frmt->params[6]); -+ if (str_frmt->invalid_string) -+ snprintf(tmp, sizeof(tmp), "BAD_FORMAT: %s", str_frmt->string); -+ else -+ snprintf(tmp, sizeof(tmp), str_frmt->string, -+ str_frmt->params[0], -+ str_frmt->params[1], -+ str_frmt->params[2], -+ str_frmt->params[3], -+ str_frmt->params[4], -+ str_frmt->params[5], -+ str_frmt->params[6]); - - trace_mlx5_fw(dev->tracer, trace_timestamp, str_frmt->lost, - str_frmt->event_id, tmp); -@@ -609,6 +654,13 @@ static int mlx5_tracer_handle_raw_string(struct mlx5_fw_tracer *tracer, - return 0; - } - -+static void mlx5_tracer_handle_bad_format_string(struct mlx5_fw_tracer *tracer, -+ struct tracer_string_format *cur_string) -+{ -+ cur_string->invalid_string = true; -+ list_add_tail(&cur_string->list, &tracer->ready_strings_list); -+} -+ - static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, - struct tracer_event *tracer_event) - { -@@ -619,12 +671,18 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, - if (!cur_string) - return mlx5_tracer_handle_raw_string(tracer, tracer_event); - -- cur_string->num_of_params = mlx5_tracer_get_num_of_params(cur_string->string); -- cur_string->last_param_num = 0; - cur_string->event_id = tracer_event->event_id; - cur_string->tmsn = tracer_event->string_event.tmsn; - cur_string->timestamp = tracer_event->string_event.timestamp; - cur_string->lost = tracer_event->lost_event; -+ cur_string->last_param_num = 0; -+ cur_string->num_of_params = mlx5_tracer_get_num_of_params(cur_string->string); -+ if (cur_string->num_of_params < 0) { -+ pr_debug("%s Invalid format string parameters\n", -+ __func__); -+ mlx5_tracer_handle_bad_format_string(tracer, cur_string); -+ return 0; -+ } - if (cur_string->num_of_params == 0) /* trace with no params */ - list_add_tail(&cur_string->list, &tracer->ready_strings_list); - } else { -@@ -634,6 +692,11 @@ static int mlx5_tracer_handle_string_trace(struct mlx5_fw_tracer *tracer, - __func__, tracer_event->string_event.tmsn); - return mlx5_tracer_handle_raw_string(tracer, tracer_event); - } -+ if (cur_string->num_of_params < 0) { -+ pr_debug("%s string parameter of invalid string, dumping\n", -+ __func__); -+ return 0; -+ } - cur_string->last_param_num += 1; - if (cur_string->last_param_num > TRACER_MAX_PARAMS) { - pr_debug("%s Number of params exceeds the max (%d)\n", -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h -index 5c548bb74f07..30d0bcba8847 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.h -@@ -125,6 +125,7 @@ struct tracer_string_format { - struct list_head list; - u32 timestamp; - bool lost; -+ bool invalid_string; - }; - - enum mlx5_fw_tracer_ownership_state { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1645-net-mlx5-fw-tracer-handle-escaped-percent-properly.patch b/SOURCES/1645-net-mlx5-fw-tracer-handle-escaped-percent-properly.patch deleted file mode 100644 index b44f97176..000000000 --- a/SOURCES/1645-net-mlx5-fw-tracer-handle-escaped-percent-properly.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 5439ccdfeefa1a7ccd88e3d1ed4a075004cdac03 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5: fw_tracer, Handle escaped percent properly - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c0289f67f7d6a0dfba0e92cfe661a5c70c8c6e92 -Author: Shay Drory -Date: Tue Dec 9 14:56:12 2025 +0200 - - net/mlx5: fw_tracer, Handle escaped percent properly - - The firmware tracer's format string validation and parameter counting - did not properly handle escaped percent signs (%%). This caused - fw_tracer to count more parameters when trace format strings contained - literal percent characters. - - To fix it, allow %% to pass string validation and skip %% sequences when - counting parameters since they represent literal percent signs rather - than format specifiers. - - Fixes: 70dd6fdb8987 ("net/mlx5: FW tracer, parse traces and kernel tracing support") - Signed-off-by: Shay Drory - Reported-by: Breno Leitao - Reviewed-by: Moshe Shemesh - Closes: https://lore.kernel.org/netdev/hanz6rzrb2bqbplryjrakvkbmv4y5jlmtthnvi3thg5slqvelp@t3s3erottr6s/ - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -index b415dfe5de45..6b4ec457ce22 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c -@@ -368,11 +368,11 @@ static bool mlx5_is_valid_spec(const char *str) - while (isdigit(*str) || *str == '#' || *str == '.' || *str == 'l') - str++; - -- /* Check if it's a valid integer/hex specifier: -+ /* Check if it's a valid integer/hex specifier or %%: - * Valid formats: %x, %d, %i, %u, etc. - */ - if (*str != 'x' && *str != 'X' && *str != 'd' && *str != 'i' && -- *str != 'u' && *str != 'c') -+ *str != 'u' && *str != 'c' && *str != '%') - return false; - - return true; -@@ -390,7 +390,11 @@ static bool mlx5_tracer_validate_params(const char *str) - if (!mlx5_is_valid_spec(substr + 1)) - return false; - -- substr = strstr(substr + 1, PARAM_CHAR); -+ if (*(substr + 1) == '%') -+ substr = strstr(substr + 2, PARAM_CHAR); -+ else -+ substr = strstr(substr + 1, PARAM_CHAR); -+ - } - - return true; -@@ -469,11 +473,15 @@ static int mlx5_tracer_get_num_of_params(char *str) - substr = strstr(pstr, VAL_PARM); - } - -- /* count all the % characters */ -+ /* count all the % characters, but skip %% (escaped percent) */ - substr = strstr(str, PARAM_CHAR); - while (substr) { -- num_of_params += 1; -- str = substr + 1; -+ if (*(substr + 1) != '%') { -+ num_of_params += 1; -+ str = substr + 1; -+ } else { -+ str = substr + 2; -+ } - substr = strstr(str, PARAM_CHAR); - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1646-net-mlx5-serialize-firmware-reset-with-devlink.patch b/SOURCES/1646-net-mlx5-serialize-firmware-reset-with-devlink.patch deleted file mode 100644 index 98c8966d3..000000000 --- a/SOURCES/1646-net-mlx5-serialize-firmware-reset-with-devlink.patch +++ /dev/null @@ -1,208 +0,0 @@ -From 377d452a9758e2011a101d4919bb498a14e4075b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5: Serialize firmware reset with devlink - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 367e501f8b095eca08d2eb0ba4ccea5b5e82c169 -Author: Shay Drory -Date: Tue Dec 9 14:56:13 2025 +0200 - - net/mlx5: Serialize firmware reset with devlink - - The firmware reset mechanism can be triggered by asynchronous events, - which may race with other devlink operations like devlink reload or - devlink dev eswitch set, potentially leading to inconsistent states. - - This patch addresses the race by using the devl_lock to serialize the - firmware reset against other devlink operations. When a reset is - requested, the driver attempts to acquire the lock. If successful, it - sets a flag to block devlink reload or eswitch changes, ACKs the reset - to firmware and then releases the lock. If the lock is already held by - another operation, the driver NACKs the firmware reset request, - indicating that the reset cannot proceed. - - Firmware reset does not keep the devl_lock and instead uses an internal - firmware reset bit. This is because firmware resets can be triggered by - asynchronous events, and processed in different threads. It is illegal - and unsafe to acquire a lock in one thread and attempt to release it in - another, as lock ownership is intrinsically thread-specific. - - This change ensures that firmware resets and other devlink operations - are mutually exclusive during the critical reset request phase, - preventing race conditions. - - Fixes: 38b9f903f22b ("net/mlx5: Handle sync reset request event") - Signed-off-by: Shay Drory - Reviewed-by: Mateusz Berezecki - Reviewed-by: Moshe Shemesh - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-6-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -index c204c707b850..9fb39f42a670 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/devlink.c -@@ -197,6 +197,11 @@ static int mlx5_devlink_reload_down(struct devlink *devlink, bool netns_change, - struct pci_dev *pdev = dev->pdev; - int ret = 0; - -+ if (mlx5_fw_reset_in_progress(dev)) { -+ NL_SET_ERR_MSG_MOD(extack, "Can't reload during firmware reset"); -+ return -EBUSY; -+ } -+ - if (mlx5_dev_is_lightweight(dev)) { - if (action != DEVLINK_RELOAD_ACTION_DRIVER_REINIT) - return -EOPNOTSUPP; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 8ebca0d17f65..575b12079933 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -52,6 +52,7 @@ - #include "devlink.h" - #include "lag/lag.h" - #include "en/tc/post_meter.h" -+#include "fw_reset.h" - - /* There are two match-all miss flows, one for unicast dst mac and - * one for multicast. -@@ -3990,6 +3991,11 @@ int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - if (IS_ERR(esw)) - return PTR_ERR(esw); - -+ if (mlx5_fw_reset_in_progress(esw->dev)) { -+ NL_SET_ERR_MSG_MOD(extack, "Can't change eswitch mode during firmware reset"); -+ return -EBUSY; -+ } -+ - if (esw_mode_from_devlink(mode, &mlx5_mode)) - return -EINVAL; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -index 33df0418e575..4544f1968f73 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c -@@ -15,6 +15,7 @@ enum { - MLX5_FW_RESET_FLAGS_DROP_NEW_REQUESTS, - MLX5_FW_RESET_FLAGS_RELOAD_REQUIRED, - MLX5_FW_RESET_FLAGS_UNLOAD_EVENT, -+ MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, - }; - - struct mlx5_fw_reset { -@@ -127,6 +128,16 @@ int mlx5_fw_reset_query(struct mlx5_core_dev *dev, u8 *reset_level, u8 *reset_ty - return mlx5_reg_mfrl_query(dev, reset_level, reset_type, NULL, NULL); - } - -+bool mlx5_fw_reset_in_progress(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_fw_reset *fw_reset = dev->priv.fw_reset; -+ -+ if (!fw_reset) -+ return false; -+ -+ return test_bit(MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, &fw_reset->reset_flags); -+} -+ - static int mlx5_fw_reset_get_reset_method(struct mlx5_core_dev *dev, - u8 *reset_method) - { -@@ -242,6 +253,8 @@ static void mlx5_fw_reset_complete_reload(struct mlx5_core_dev *dev) - BIT(DEVLINK_RELOAD_ACTION_FW_ACTIVATE)); - devl_unlock(devlink); - } -+ -+ clear_bit(MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, &fw_reset->reset_flags); - } - - static void mlx5_stop_sync_reset_poll(struct mlx5_core_dev *dev) -@@ -461,27 +474,48 @@ static void mlx5_sync_reset_request_event(struct work_struct *work) - struct mlx5_fw_reset *fw_reset = container_of(work, struct mlx5_fw_reset, - reset_request_work); - struct mlx5_core_dev *dev = fw_reset->dev; -+ bool nack_request = false; -+ struct devlink *devlink; - int err; - - err = mlx5_fw_reset_get_reset_method(dev, &fw_reset->reset_method); -- if (err) -+ if (err) { -+ nack_request = true; - mlx5_core_warn(dev, "Failed reading MFRL, err %d\n", err); -+ } else if (!mlx5_is_reset_now_capable(dev, fw_reset->reset_method) || -+ test_bit(MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, -+ &fw_reset->reset_flags)) { -+ nack_request = true; -+ } - -- if (err || test_bit(MLX5_FW_RESET_FLAGS_NACK_RESET_REQUEST, &fw_reset->reset_flags) || -- !mlx5_is_reset_now_capable(dev, fw_reset->reset_method)) { -+ devlink = priv_to_devlink(dev); -+ /* For external resets, try to acquire devl_lock. Skip if devlink reset is -+ * pending (lock already held) -+ */ -+ if (nack_request || -+ (!test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, -+ &fw_reset->reset_flags) && -+ !devl_trylock(devlink))) { - err = mlx5_fw_reset_set_reset_sync_nack(dev); - mlx5_core_warn(dev, "PCI Sync FW Update Reset Nack %s", - err ? "Failed" : "Sent"); - return; - } -+ - if (mlx5_sync_reset_set_reset_requested(dev)) -- return; -+ goto unlock; -+ -+ set_bit(MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, &fw_reset->reset_flags); - - err = mlx5_fw_reset_set_reset_sync_ack(dev); - if (err) - mlx5_core_warn(dev, "PCI Sync FW Update Reset Ack Failed. Error code: %d\n", err); - else - mlx5_core_warn(dev, "PCI Sync FW Update Reset Ack. Device reset is expected.\n"); -+ -+unlock: -+ if (!test_bit(MLX5_FW_RESET_FLAGS_PENDING_COMP, &fw_reset->reset_flags)) -+ devl_unlock(devlink); - } - - static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev, u16 dev_id) -@@ -721,6 +755,8 @@ static void mlx5_sync_reset_abort_event(struct work_struct *work) - - if (mlx5_sync_reset_clear_reset_requested(dev, true)) - return; -+ -+ clear_bit(MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, &fw_reset->reset_flags); - mlx5_core_warn(dev, "PCI Sync FW Update Reset Aborted.\n"); - } - -@@ -757,6 +793,7 @@ static void mlx5_sync_reset_timeout_work(struct work_struct *work) - - if (mlx5_sync_reset_clear_reset_requested(dev, true)) - return; -+ clear_bit(MLX5_FW_RESET_FLAGS_RESET_IN_PROGRESS, &fw_reset->reset_flags); - mlx5_core_warn(dev, "PCI Sync FW Update Reset Timeout.\n"); - } - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -index d5b28525c960..2d96b2adc1cd 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.h -@@ -10,6 +10,7 @@ int mlx5_fw_reset_query(struct mlx5_core_dev *dev, u8 *reset_level, u8 *reset_ty - int mlx5_fw_reset_set_reset_sync(struct mlx5_core_dev *dev, u8 reset_type_sel, - struct netlink_ext_ack *extack); - int mlx5_fw_reset_set_live_patch(struct mlx5_core_dev *dev); -+bool mlx5_fw_reset_in_progress(struct mlx5_core_dev *dev); - - int mlx5_fw_reset_wait_reset_done(struct mlx5_core_dev *dev); - void mlx5_sync_reset_unload_flow(struct mlx5_core_dev *dev, bool locked); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1647-net-mlx5e-use-ip6-dst-lookup-instead-of-ipv6-dst-lookup-flow.patch b/SOURCES/1647-net-mlx5e-use-ip6-dst-lookup-instead-of-ipv6-dst-lookup-flow.patch deleted file mode 100644 index fbd0aae55..000000000 --- a/SOURCES/1647-net-mlx5e-use-ip6-dst-lookup-instead-of-ipv6-dst-lookup-flow.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 1ae4c52b8db64bdfb7c3b877a224c57927935879 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow - for MAC init - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit e35d7da8dd9e55b37c3e8ab548f6793af0c2ab49 -Author: Jianbo Liu -Date: Tue Dec 9 14:56:14 2025 +0200 - - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init - - Replace ipv6_stub->ipv6_dst_lookup_flow() with ip6_dst_lookup() in - mlx5e_ipsec_init_macs() since IPsec transformations are not needed - during Security Association setup - only basic routing information is - required for nexthop MAC address resolution. - - This resolves an issue where XfrmOutNoStates error counter would be - incremented when xfrm policy is configured before xfrm state, as the - IPsec-aware routing function would attempt policy checks during SA - initialization. - - Fixes: 71670f766b8f ("net/mlx5e: Support routed networks during IPsec MACs initialization") - Signed-off-by: Jianbo Liu - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-7-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 35d9530037a6..6c79b9cea2ef 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -342,9 +342,8 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, - rt_dst_entry = &rt->dst; - break; - case AF_INET6: -- rt_dst_entry = ipv6_stub->ipv6_dst_lookup_flow( -- dev_net(netdev), NULL, &fl6, NULL); -- if (IS_ERR(rt_dst_entry)) -+ if (!IS_ENABLED(CONFIG_IPV6) || -+ ip6_dst_lookup(dev_net(netdev), NULL, &rt_dst_entry, &fl6)) - goto neigh; - break; - default: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1648-net-mlx5e-trigger-neighbor-resolution-for-unresolved-destina.patch b/SOURCES/1648-net-mlx5e-trigger-neighbor-resolution-for-unresolved-destina.patch deleted file mode 100644 index 48b79a037..000000000 --- a/SOURCES/1648-net-mlx5e-trigger-neighbor-resolution-for-unresolved-destina.patch +++ /dev/null @@ -1,63 +0,0 @@ -From 67b865f6f8239b5ab05970b5be18c101fe92f285 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5e: Trigger neighbor resolution for unresolved - destinations - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 9ab89bde13e5251e1d0507e1cc426edcdfe19142 -Author: Jianbo Liu -Date: Tue Dec 9 14:56:15 2025 +0200 - - net/mlx5e: Trigger neighbor resolution for unresolved destinations - - When initializing the MAC addresses for an outbound IPsec packet offload - rule in mlx5e_ipsec_init_macs, the call to dst_neigh_lookup is used to - find the next-hop neighbor (typically the gateway in tunnel mode). - This call might create a new neighbor entry if one doesn't already - exist. This newly created entry starts in the INCOMPLETE state, as the - kernel hasn't yet sent an ARP or NDISC probe to resolve the MAC - address. In this case, neigh_ha_snapshot will correctly return an - all-zero MAC address. - - IPsec packet offload requires the actual next-hop MAC address to - program the rule correctly. If the neighbor state is INCOMPLETE when - the rule is created, the hardware rule is programmed with an all-zero - destination MAC address. Packets sent using this rule will be - subsequently dropped by the receiving network infrastructure or host. - - This patch adds a check specifically for the outbound offload path. If - neigh_ha_snapshot returns an all-zero MAC address, it proactively - calls neigh_event_send(n, NULL). This ensures the kernel immediately - sends the initial ARP or NDISC probe if one isn't already pending, - accelerating the resolution process. This helps prevent the hardware - rule from being programmed with an invalid MAC address and avoids - packet drops due to unresolved neighbors. - - Fixes: 71670f766b8f ("net/mlx5e: Support routed networks during IPsec MACs initialization") - Signed-off-by: Jianbo Liu - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1765284977-1363052-8-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index 6c79b9cea2ef..a8fb4bec369c 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -358,6 +358,9 @@ static void mlx5e_ipsec_init_macs(struct mlx5e_ipsec_sa_entry *sa_entry, - - neigh_ha_snapshot(addr, n, netdev); - ether_addr_copy(dst, addr); -+ if (attrs->dir == XFRM_DEV_OFFLOAD_OUT && -+ is_zero_ether_addr(addr)) -+ neigh_event_send(n, NULL); - dst_release(rt_dst_entry); - neigh_release(n); - return; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1649-net-mlx5e-do-not-update-bql-of-old-txqs-during-channel-recon.patch b/SOURCES/1649-net-mlx5e-do-not-update-bql-of-old-txqs-during-channel-recon.patch deleted file mode 100644 index 8338a6f05..000000000 --- a/SOURCES/1649-net-mlx5e-do-not-update-bql-of-old-txqs-during-channel-recon.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 6c09bd8f4ec1299227af49385e6855bda80b85c1 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5e: Do not update BQL of old txqs during channel - reconfiguration - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit c8591decd9dbf395cb8ae398e70b0438fdd24aee -Author: Tariq Toukan -Date: Tue Dec 9 14:56:16 2025 +0200 - - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration - - During channel reconfiguration (e.g., ethtool private flags changes), - the driver can trigger a kernel BUG_ON in dql_completed() with the error - "kernel BUG at lib/dynamic_queue_limits.c:99". - - The issue occurs in the following sequence: - - During mlx5e_safe_switch_params(), old channels are deactivated via - mlx5e_deactivate_txqsq(). New channels are created and activated, taking - ownership of the netdev_queues and their BQL state. - - When old channels are closed via mlx5e_close_txqsq(), there may be - pending TX descriptors (sq->cc != sq->pc) that were in-flight during the - deactivation. - - mlx5e_free_txqsq_descs() frees these pending descriptors and attempts to - complete them via netdev_tx_completed_queue(). - - However, the BQL state (dql->num_queued and dql->num_completed) have - been reset in mlx5e_activate_txqsq and belong to the new queue owner, - leading to dql->num_queued - dql->num_completed < nbytes. - - This triggers BUG_ON(count > num_queued - num_completed) in - dql_completed(). - - Fixes: 3b88a535a8e1 ("net/mlx5e: Defer channels closure to reduce interface down time") - Signed-off-by: Tariq Toukan - Signed-off-by: William Tu - Reviewed-by: Dragos Tatulea - Link: https://patch.msgid.link/1765284977-1363052-9-git-send-email-tariqt@nvidia.com - Signed-off-by: Paolo Abeni - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -index 6245d2f82afe..5d12f19dfe8a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c -@@ -933,7 +933,11 @@ void mlx5e_free_txqsq_descs(struct mlx5e_txqsq *sq) - sq->dma_fifo_cc = dma_fifo_cc; - sq->cc = sqcc; - -- netdev_tx_completed_queue(sq->txq, npkts, nbytes); -+ /* Do not update BQL for TXQs that got replaced by new active ones, as -+ * netdev_tx_reset_queue() is called for them in mlx5e_activate_txqsq(). -+ */ -+ if (sq == sq->priv->txq2sq[sq->txq_ix]) -+ netdev_tx_completed_queue(sq->txq, npkts, nbytes); - } - - #ifdef CONFIG_MLX5_CORE_IPOIB --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1650-net-mlx5-lag-multipath-give-priority-for-routes-with-smaller.patch b/SOURCES/1650-net-mlx5-lag-multipath-give-priority-for-routes-with-smaller.patch deleted file mode 100644 index 79b28cd58..000000000 --- a/SOURCES/1650-net-mlx5-lag-multipath-give-priority-for-routes-with-smaller.patch +++ /dev/null @@ -1,59 +0,0 @@ -From ee464f702ba7e81cee0eecabd8e982448af4cdba Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 15:08:58 -0400 -Subject: [PATCH] net/mlx5: Lag, multipath, give priority for routes with - smaller network prefix - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 31057979cdadfee9f934746fd84046b43506ba61 -Author: Patrisious Haddad -Date: Thu Dec 25 15:27:13 2025 +0200 - - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix - - Today multipath offload is controlled by a single route and the route - controlling is selected if it meets one of the following criteria: - 1. No controlling route is set. - 2. New route destination is the same as old one. - 3. New route metric is lower than old route metric. - - This can cause unwanted behaviour in case a new route is added - with a smaller network prefix which should get the priority. - - Fix this by adding a new criteria to give priority to new route with - a smaller network prefix. - - Fixes: ad11c4f1d8fd ("net/mlx5e: Lag, Only handle events from highest priority multipath entry") - Signed-off-by: Patrisious Haddad - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20251225132717.358820-2-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c b/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c -index aee17fcf3b36..cdc99fe5c956 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/lag/mp.c -@@ -173,10 +173,15 @@ static void mlx5_lag_fib_route_event(struct mlx5_lag *ldev, unsigned long event, - } - - /* Handle multipath entry with lower priority value */ -- if (mp->fib.mfi && mp->fib.mfi != fi && -+ if (mp->fib.mfi && - (mp->fib.dst != fen_info->dst || mp->fib.dst_len != fen_info->dst_len) && -- fi->fib_priority >= mp->fib.priority) -+ mp->fib.dst_len <= fen_info->dst_len && -+ !(mp->fib.dst_len == fen_info->dst_len && -+ fi->fib_priority < mp->fib.priority)) { -+ mlx5_core_dbg(ldev->pf[idx].dev, -+ "Multipath entry with lower priority was rejected\n"); - return; -+ } - - nh_dev0 = mlx5_lag_get_next_fib_dev(ldev, fi, NULL); - nh_dev1 = mlx5_lag_get_next_fib_dev(ldev, fi, nh_dev0); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1651-net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eepro.patch b/SOURCES/1651-net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eepro.patch deleted file mode 100644 index a28be6b3f..000000000 --- a/SOURCES/1651-net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eepro.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 8667c2e8fe140d8da277af968148cadaf9eafc87 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:11 -0400 -Subject: [PATCH] net/mlx5e: Fix NULL pointer dereference in ioctl module - EEPROM query - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 7d36a4a8bf62dc508bc6bb4b59727aec25064ca5 -Author: Gal Pressman -Date: Thu Dec 25 15:27:15 2025 +0200 - - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query - - The mlx5_query_mcia() function unconditionally dereferences the status - pointer to store the MCIA register status value. - However, mlx5e_get_module_id() passes NULL since it doesn't need the - status value. - - Add a NULL check before dereferencing the status pointer to prevent a - NULL pointer dereference. - - Fixes: 2e4c44b12f4d ("net/mlx5: Refactor EEPROM query error handling to return status separately") - Signed-off-by: Gal Pressman - Reviewed-by: Tariq Toukan - Reviewed-by: Dragos Tatulea - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20251225132717.358820-4-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c -index e4b1dfafb41f..3e52579bc2af 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c -@@ -393,9 +393,11 @@ static int mlx5_query_mcia(struct mlx5_core_dev *dev, - if (err) - return err; - -- *status = MLX5_GET(mcia_reg, out, status); -- if (*status) -+ if (MLX5_GET(mcia_reg, out, status)) { -+ if (status) -+ *status = MLX5_GET(mcia_reg, out, status); - return -EIO; -+ } - - ptr = MLX5_ADDR_OF(mcia_reg, out, dword_0); - memcpy(data, ptr, size); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1652-net-mlx5e-don-t-print-error-message-due-to-invalid-module.patch b/SOURCES/1652-net-mlx5e-don-t-print-error-message-due-to-invalid-module.patch deleted file mode 100644 index e58a23ddd..000000000 --- a/SOURCES/1652-net-mlx5e-don-t-print-error-message-due-to-invalid-module.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 765f3c5f2352a80f786fe737bff899ec2c4c6389 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:11 -0400 -Subject: [PATCH] net/mlx5e: Don't print error message due to invalid module - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 144297e2a24e3e54aee1180ec21120ea38822b97 -Author: Gal Pressman -Date: Thu Dec 25 15:27:16 2025 +0200 - - net/mlx5e: Don't print error message due to invalid module - - Dumping module EEPROM on newer modules is supported through the netlink - interface only. - - Querying with old userspace ethtool (or other tools, such as 'lshw') - which still uses the ioctl interface results in an error message that - could flood dmesg (in addition to the expected error return value). - The original message was added under the assumption that the driver - should be able to handle all module types, but now that such flows are - easily triggered from userspace, it doesn't serve its purpose. - - Change the log level of the print in mlx5_query_module_eeprom() to - debug. - - Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM") - Signed-off-by: Gal Pressman - Reviewed-by: Tariq Toukan - Signed-off-by: Mark Bloch - Link: https://patch.msgid.link/20251225132717.358820-5-mbloch@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c -index 3e52579bc2af..959b568c4da9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/port.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c -@@ -431,7 +431,8 @@ int mlx5_query_module_eeprom(struct mlx5_core_dev *dev, - mlx5_qsfp_eeprom_params_set(&query.i2c_address, &query.page, &offset); - break; - default: -- mlx5_core_err(dev, "Module ID not recognized: 0x%x\n", module_id); -+ mlx5_core_dbg(dev, "Module ID not recognized: 0x%x\n", -+ module_id); - return -EINVAL; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1653-net-mlx5e-fix-crash-on-profile-change-rollback-failure.patch b/SOURCES/1653-net-mlx5e-fix-crash-on-profile-change-rollback-failure.patch deleted file mode 100644 index 0f1494e96..000000000 --- a/SOURCES/1653-net-mlx5e-fix-crash-on-profile-change-rollback-failure.patch +++ /dev/null @@ -1,232 +0,0 @@ -From 0e08840d988b62eac0ef37571ee3e7f2c41c94ea Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:38 -0400 -Subject: [PATCH] net/mlx5e: Fix crash on profile change rollback failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4dadc4077e3f77d6d31e199a925fc7a705e7adeb -Author: Saeed Mahameed -Date: Thu Jan 8 13:26:54 2026 -0800 - - net/mlx5e: Fix crash on profile change rollback failure - - mlx5e_netdev_change_profile can fail to attach a new profile and can - fail to rollback to old profile, in such case, we could end up with a - dangling netdev with a fully reset netdev_priv. A retry to change - profile, e.g. another attempt to call mlx5e_netdev_change_profile via - switchdev mode change, will crash trying to access the now NULL - priv->mdev. - - This fix allows mlx5e_netdev_change_profile() to handle previous - failures and an empty priv, by not assuming priv is valid. - - Pass netdev and mdev to all flows requiring - mlx5e_netdev_change_profile() and avoid passing priv. - In mlx5e_netdev_change_profile() check if current priv is valid, and if - not, just attach the new profile without trying to access the old one. - - This fixes the following oops, when enabling switchdev mode for the 2nd - time after first time failure: - - ## Enabling switchdev mode first time: - - mlx5_core 0012:03:00.1: E-Switch: Supported tc chains and prios offload - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 - ^^^^^^^^ - mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) - - ## retry: Enabling switchdev mode 2nd time: - - mlx5_core 0000:00:03.0: E-Switch: Supported tc chains and prios offload - BUG: kernel NULL pointer dereference, address: 0000000000000038 - #PF: supervisor read access in kernel mode - #PF: error_code(0x0000) - not-present page - PGD 0 P4D 0 - Oops: Oops: 0000 [#1] SMP NOPTI - CPU: 13 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc4+ #91 PREEMPT(voluntary) - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 - RIP: 0010:mlx5e_detach_netdev+0x3c/0x90 - Code: 50 00 00 f0 80 4f 78 02 48 8b bf e8 07 00 00 48 85 ff 74 16 48 8b 73 78 48 d1 ee 83 e6 01 83 f6 01 40 0f b6 f6 e8 c4 42 00 00 <48> 8b 45 38 48 85 c0 74 08 48 89 df e8 cc 47 40 1e 48 8b bb f0 07 - RSP: 0018:ffffc90000673890 EFLAGS: 00010246 - RAX: 0000000000000000 RBX: ffff8881036a89c0 RCX: 0000000000000000 - RDX: ffff888113f63800 RSI: ffffffff822fe720 RDI: 0000000000000000 - RBP: 0000000000000000 R08: 0000000000002dcd R09: 0000000000000000 - R10: ffffc900006738e8 R11: 00000000ffffffff R12: 0000000000000000 - R13: 0000000000000000 R14: ffff8881036a89c0 R15: 0000000000000000 - FS: 00007fdfb8384740(0000) GS:ffff88856a9d6000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000038 CR3: 0000000112ae0005 CR4: 0000000000370ef0 - Call Trace: - - mlx5e_netdev_change_profile+0x45/0xb0 - mlx5e_vport_rep_load+0x27b/0x2d0 - mlx5_esw_offloads_rep_load+0x72/0xf0 - esw_offloads_enable+0x5d0/0x970 - mlx5_eswitch_enable_locked+0x349/0x430 - ? is_mp_supported+0x57/0xb0 - mlx5_devlink_eswitch_mode_set+0x26b/0x430 - devlink_nl_eswitch_set_doit+0x6f/0xf0 - genl_family_rcv_msg_doit+0xe8/0x140 - genl_rcv_msg+0x18b/0x290 - ? __pfx_devlink_nl_pre_doit+0x10/0x10 - ? __pfx_devlink_nl_eswitch_set_doit+0x10/0x10 - ? __pfx_devlink_nl_post_doit+0x10/0x10 - ? __pfx_genl_rcv_msg+0x10/0x10 - netlink_rcv_skb+0x52/0x100 - genl_rcv+0x28/0x40 - netlink_unicast+0x282/0x3e0 - ? __alloc_skb+0xd6/0x190 - netlink_sendmsg+0x1f7/0x430 - __sys_sendto+0x213/0x220 - ? __sys_recvmsg+0x6a/0xd0 - __x64_sys_sendto+0x24/0x30 - do_syscall_64+0x50/0x1f0 - entry_SYSCALL_64_after_hwframe+0x76/0x7e - RIP: 0033:0x7fdfb8495047 - - Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") - Signed-off-by: Saeed Mahameed - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260108212657.25090-2-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index a1d33c78aedd..80c8a37c8e8e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1236,9 +1236,12 @@ mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *prof - int mlx5e_attach_netdev(struct mlx5e_priv *priv); - void mlx5e_detach_netdev(struct mlx5e_priv *priv); - void mlx5e_destroy_netdev(struct mlx5e_priv *priv); --int mlx5e_netdev_change_profile(struct mlx5e_priv *priv, -- const struct mlx5e_profile *new_profile, void *new_ppriv); --void mlx5e_netdev_attach_nic_profile(struct mlx5e_priv *priv); -+int mlx5e_netdev_change_profile(struct net_device *netdev, -+ struct mlx5_core_dev *mdev, -+ const struct mlx5e_profile *new_profile, -+ void *new_ppriv); -+void mlx5e_netdev_attach_nic_profile(struct net_device *netdev, -+ struct mlx5_core_dev *mdev); - void mlx5e_set_netdev_mtu_boundaries(struct mlx5e_priv *priv); - void mlx5e_build_nic_params(struct mlx5e_priv *priv, struct mlx5e_xsk *xsk, u16 mtu); - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index e69a67aa54f4..b2d90097186e 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6505,19 +6505,28 @@ mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mde - return err; - } - --int mlx5e_netdev_change_profile(struct mlx5e_priv *priv, -- const struct mlx5e_profile *new_profile, void *new_ppriv) -+int mlx5e_netdev_change_profile(struct net_device *netdev, -+ struct mlx5_core_dev *mdev, -+ const struct mlx5e_profile *new_profile, -+ void *new_ppriv) - { -- const struct mlx5e_profile *orig_profile = priv->profile; -- struct net_device *netdev = priv->netdev; -- struct mlx5_core_dev *mdev = priv->mdev; -- void *orig_ppriv = priv->ppriv; -+ struct mlx5e_priv *priv = netdev_priv(netdev); -+ const struct mlx5e_profile *orig_profile; - int err, rollback_err; -+ void *orig_ppriv; - -- /* cleanup old profile */ -- mlx5e_detach_netdev(priv); -- priv->profile->cleanup(priv); -- mlx5e_priv_cleanup(priv); -+ orig_profile = priv->profile; -+ orig_ppriv = priv->ppriv; -+ -+ /* NULL could happen if previous change_profile failed to rollback */ -+ if (priv->profile) { -+ WARN_ON_ONCE(priv->mdev != mdev); -+ /* cleanup old profile */ -+ mlx5e_detach_netdev(priv); -+ priv->profile->cleanup(priv); -+ mlx5e_priv_cleanup(priv); -+ } -+ /* priv members are not valid from this point ... */ - - if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { - mlx5e_netdev_init_profile(netdev, mdev, new_profile, new_ppriv); -@@ -6534,16 +6543,25 @@ int mlx5e_netdev_change_profile(struct mlx5e_priv *priv, - return 0; - - rollback: -+ if (!orig_profile) { -+ netdev_warn(netdev, "no original profile to rollback to\n"); -+ priv->profile = NULL; -+ return err; -+ } -+ - rollback_err = mlx5e_netdev_attach_profile(netdev, mdev, orig_profile, orig_ppriv); -- if (rollback_err) -- netdev_err(netdev, "%s: failed to rollback to orig profile, %d\n", -- __func__, rollback_err); -+ if (rollback_err) { -+ netdev_err(netdev, "failed to rollback to orig profile, %d\n", -+ rollback_err); -+ priv->profile = NULL; -+ } - return err; - } - --void mlx5e_netdev_attach_nic_profile(struct mlx5e_priv *priv) -+void mlx5e_netdev_attach_nic_profile(struct net_device *netdev, -+ struct mlx5_core_dev *mdev) - { -- mlx5e_netdev_change_profile(priv, &mlx5e_nic_profile, NULL); -+ mlx5e_netdev_change_profile(netdev, mdev, &mlx5e_nic_profile, NULL); - } - - void mlx5e_destroy_netdev(struct mlx5e_priv *priv) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 8490e2039f7f..2b1b6e094ba8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -1501,17 +1501,16 @@ mlx5e_vport_uplink_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep * - { - struct mlx5e_rep_priv *rpriv = mlx5e_rep_to_rep_priv(rep); - struct net_device *netdev; -- struct mlx5e_priv *priv; - int err; - - netdev = mlx5_uplink_netdev_get(dev); - if (!netdev) - return 0; - -- priv = netdev_priv(netdev); -- rpriv->netdev = priv->netdev; -- err = mlx5e_netdev_change_profile(priv, &mlx5e_uplink_rep_profile, -- rpriv); -+ /* must not use netdev_priv(netdev), it might not be initialized yet */ -+ rpriv->netdev = netdev; -+ err = mlx5e_netdev_change_profile(netdev, dev, -+ &mlx5e_uplink_rep_profile, rpriv); - mlx5_uplink_netdev_put(dev, netdev); - return err; - } -@@ -1539,7 +1538,7 @@ mlx5e_vport_uplink_rep_unload(struct mlx5e_rep_priv *rpriv) - if (!(priv->mdev->priv.flags & MLX5_PRIV_FLAGS_SWITCH_LEGACY)) - unregister_netdev(netdev); - -- mlx5e_netdev_attach_nic_profile(priv); -+ mlx5e_netdev_attach_nic_profile(netdev, priv->mdev); - } - - static int --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1654-net-mlx5e-don-t-store-mlx5e-priv-in-mlx5e-dev-devlink-priv.patch b/SOURCES/1654-net-mlx5e-don-t-store-mlx5e-priv-in-mlx5e-dev-devlink-priv.patch deleted file mode 100644 index 5f8b18f7c..000000000 --- a/SOURCES/1654-net-mlx5e-don-t-store-mlx5e-priv-in-mlx5e-dev-devlink-priv.patch +++ /dev/null @@ -1,152 +0,0 @@ -From 166d3efdac38dc1e7edca6f2762c68714219ccb7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:38 -0400 -Subject: [PATCH] net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 123eda2e5b1638e298e3a66bb1e64a8da92de5e1 -Author: Saeed Mahameed -Date: Thu Jan 8 13:26:55 2026 -0800 - - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv - - mlx5e_priv is an unstable structure that can be memset(0) if profile - attaching fails, mlx5e_priv in mlx5e_dev devlink private is used to - reference the netdev and mdev associated with that struct. Instead, - store netdev directly into mlx5e_dev and get mdev from the containing - mlx5_adev aux device structure. - - This fixes a kernel oops in mlx5e_remove when switchdev mode fails due - to change profile failure. - - $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev - Error: mlx5_core: Failed setting eswitch to offloads. - dmesg: - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 - - $ devlink dev reload pci/0000:00:03.0 ==> oops - - BUG: kernel NULL pointer dereference, address: 0000000000000520 - #PF: supervisor read access in kernel mode - #PF: error_code(0x0000) - not-present page - PGD 0 P4D 0 - Oops: Oops: 0000 [#1] SMP NOPTI - CPU: 3 UID: 0 PID: 521 Comm: devlink Not tainted 6.18.0-rc5+ #117 PREEMPT(voluntary) - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 - RIP: 0010:mlx5e_remove+0x68/0x130 - RSP: 0018:ffffc900034838f0 EFLAGS: 00010246 - RAX: ffff88810283c380 RBX: ffff888101874400 RCX: ffffffff826ffc45 - RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 - RBP: ffff888102d789c0 R08: ffff8881007137f0 R09: ffff888100264e10 - R10: ffffc90003483898 R11: ffffc900034838a0 R12: ffff888100d261a0 - R13: ffff888100d261a0 R14: ffff8881018749a0 R15: ffff888101874400 - FS: 00007f8565fea740(0000) GS:ffff88856a759000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000520 CR3: 000000010b11a004 CR4: 0000000000370ef0 - Call Trace: - - device_release_driver_internal+0x19c/0x200 - bus_remove_device+0xc6/0x130 - device_del+0x160/0x3d0 - ? devl_param_driverinit_value_get+0x2d/0x90 - mlx5_detach_device+0x89/0xe0 - mlx5_unload_one_devl_locked+0x3a/0x70 - mlx5_devlink_reload_down+0xc8/0x220 - devlink_reload+0x7d/0x260 - devlink_nl_reload_doit+0x45b/0x5a0 - genl_family_rcv_msg_doit+0xe8/0x140 - - Fixes: ee75f1fc44dd ("net/mlx5e: Create separate devlink instance for ethernet auxiliary device") - Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") - Signed-off-by: Saeed Mahameed - Link: https://patch.msgid.link/20260108212657.25090-3-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 80c8a37c8e8e..bae15968cb37 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -955,7 +955,7 @@ struct mlx5e_priv { - }; - - struct mlx5e_dev { -- struct mlx5e_priv *priv; -+ struct net_device *netdev; - struct devlink_port dl_port; - }; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index b2d90097186e..d91bf655d291 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6576,8 +6576,8 @@ static int _mlx5e_resume(struct auxiliary_device *adev) - { - struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev); - struct mlx5e_dev *mlx5e_dev = auxiliary_get_drvdata(adev); -- struct mlx5e_priv *priv = mlx5e_dev->priv; -- struct net_device *netdev = priv->netdev; -+ struct mlx5e_priv *priv = netdev_priv(mlx5e_dev->netdev); -+ struct net_device *netdev = mlx5e_dev->netdev; - struct mlx5_core_dev *mdev = edev->mdev; - struct mlx5_core_dev *pos, *to; - int err, i; -@@ -6623,10 +6623,11 @@ static int mlx5e_resume(struct auxiliary_device *adev) - - static int _mlx5e_suspend(struct auxiliary_device *adev, bool pre_netdev_reg) - { -+ struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev); - struct mlx5e_dev *mlx5e_dev = auxiliary_get_drvdata(adev); -- struct mlx5e_priv *priv = mlx5e_dev->priv; -- struct net_device *netdev = priv->netdev; -- struct mlx5_core_dev *mdev = priv->mdev; -+ struct mlx5e_priv *priv = netdev_priv(mlx5e_dev->netdev); -+ struct net_device *netdev = mlx5e_dev->netdev; -+ struct mlx5_core_dev *mdev = edev->mdev; - struct mlx5_core_dev *pos; - int i; - -@@ -6687,11 +6688,11 @@ static int _mlx5e_probe(struct auxiliary_device *adev) - goto err_devlink_port_unregister; - } - SET_NETDEV_DEVLINK_PORT(netdev, &mlx5e_dev->dl_port); -+ mlx5e_dev->netdev = netdev; - - mlx5e_build_nic_netdev(netdev); - - priv = netdev_priv(netdev); -- mlx5e_dev->priv = priv; - - priv->profile = profile; - priv->ppriv = NULL; -@@ -6754,7 +6755,8 @@ static void _mlx5e_remove(struct auxiliary_device *adev) - { - struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev); - struct mlx5e_dev *mlx5e_dev = auxiliary_get_drvdata(adev); -- struct mlx5e_priv *priv = mlx5e_dev->priv; -+ struct net_device *netdev = mlx5e_dev->netdev; -+ struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = edev->mdev; - - mlx5_core_uplink_netdev_set(mdev, NULL); -@@ -6763,8 +6765,8 @@ static void _mlx5e_remove(struct auxiliary_device *adev) - * if it's from legacy mode. If from switchdev mode, it - * is already unregistered before changing to NIC profile. - */ -- if (priv->netdev->reg_state == NETREG_REGISTERED) { -- unregister_netdev(priv->netdev); -+ if (netdev->reg_state == NETREG_REGISTERED) { -+ unregister_netdev(netdev); - _mlx5e_suspend(adev, false); - } else { - struct mlx5_core_dev *pos; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1655-net-mlx5e-pass-netdev-to-mlx5e-destroy-netdev-instead-of-pri.patch b/SOURCES/1655-net-mlx5e-pass-netdev-to-mlx5e-destroy-netdev-instead-of-pri.patch deleted file mode 100644 index 5f7b21fc2..000000000 --- a/SOURCES/1655-net-mlx5e-pass-netdev-to-mlx5e-destroy-netdev-instead-of-pri.patch +++ /dev/null @@ -1,163 +0,0 @@ -From 6bf769a0587bdc4c10766c7846eb147c44ebfef8 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:38 -0400 -Subject: [PATCH] net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of - priv - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 4ef8512e1427111f7ba92b4a847d181ff0aeec42 -Author: Saeed Mahameed -Date: Thu Jan 8 13:26:56 2026 -0800 - - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv - - mlx5e_priv is an unstable structure that can be memset(0) if profile - attaching fails. - - Pass netdev to mlx5e_destroy_netdev() to guarantee it will work on a - valid netdev. - - On mlx5e_remove: Check validity of priv->profile, before attempting - to cleanup any resources that might be not there. - - This fixes a kernel oops in mlx5e_remove when switchdev mode fails due - to change profile failure. - - $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev - Error: mlx5_core: Failed setting eswitch to offloads. - dmesg: - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: new profile init failed, -12 - workqueue: Failed to create a rescuer kthread for wq "mlx5e": -EINTR - mlx5_core 0012:03:00.1: mlx5e_netdev_init_profile:6214:(pid 37199): mlx5e_priv_init failed, err=-12 - mlx5_core 0012:03:00.1 gpu3rdma1: mlx5e_netdev_change_profile: failed to rollback to orig profile, -12 - - $ devlink dev reload pci/0000:00:03.0 ==> oops - - BUG: kernel NULL pointer dereference, address: 0000000000000370 - PGD 0 P4D 0 - Oops: Oops: 0000 [#1] SMP NOPTI - CPU: 15 UID: 0 PID: 520 Comm: devlink Not tainted 6.18.0-rc5+ #115 PREEMPT(voluntary) - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-2.fc40 04/01/2014 - RIP: 0010:mlx5e_dcbnl_dscp_app+0x23/0x100 - RSP: 0018:ffffc9000083f8b8 EFLAGS: 00010286 - RAX: ffff8881126fc380 RBX: ffff8881015ac400 RCX: ffffffff826ffc45 - RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8881035109c0 - RBP: ffff8881035109c0 R08: ffff888101e3e838 R09: ffff888100264e10 - R10: ffffc9000083f898 R11: ffffc9000083f8a0 R12: ffff888101b921a0 - R13: ffff888101b921a0 R14: ffff8881015ac9a0 R15: ffff8881015ac400 - FS: 00007f789a3c8740(0000) GS:ffff88856aa59000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000370 CR3: 000000010b6c0001 CR4: 0000000000370ef0 - Call Trace: - - mlx5e_remove+0x57/0x110 - device_release_driver_internal+0x19c/0x200 - bus_remove_device+0xc6/0x130 - device_del+0x160/0x3d0 - ? devl_param_driverinit_value_get+0x2d/0x90 - mlx5_detach_device+0x89/0xe0 - mlx5_unload_one_devl_locked+0x3a/0x70 - mlx5_devlink_reload_down+0xc8/0x220 - devlink_reload+0x7d/0x260 - devlink_nl_reload_doit+0x45b/0x5a0 - genl_family_rcv_msg_doit+0xe8/0x140 - - Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") - Signed-off-by: Saeed Mahameed - Reviewed-by: Shay Drori - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260108212657.25090-4-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index bae15968cb37..32224bd1a0e7 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -1235,7 +1235,7 @@ struct net_device * - mlx5e_create_netdev(struct mlx5_core_dev *mdev, const struct mlx5e_profile *profile); - int mlx5e_attach_netdev(struct mlx5e_priv *priv); - void mlx5e_detach_netdev(struct mlx5e_priv *priv); --void mlx5e_destroy_netdev(struct mlx5e_priv *priv); -+void mlx5e_destroy_netdev(struct net_device *netdev); - int mlx5e_netdev_change_profile(struct net_device *netdev, - struct mlx5_core_dev *mdev, - const struct mlx5e_profile *new_profile, -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index d91bf655d291..7e3618dfa888 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6564,11 +6564,12 @@ void mlx5e_netdev_attach_nic_profile(struct net_device *netdev, - mlx5e_netdev_change_profile(netdev, mdev, &mlx5e_nic_profile, NULL); - } - --void mlx5e_destroy_netdev(struct mlx5e_priv *priv) -+void mlx5e_destroy_netdev(struct net_device *netdev) - { -- struct net_device *netdev = priv->netdev; -+ struct mlx5e_priv *priv = netdev_priv(netdev); - -- mlx5e_priv_cleanup(priv); -+ if (priv->profile) -+ mlx5e_priv_cleanup(priv); - free_netdev(netdev); - } - -@@ -6725,7 +6726,7 @@ static int _mlx5e_probe(struct auxiliary_device *adev) - err_profile_cleanup: - profile->cleanup(priv); - err_destroy_netdev: -- mlx5e_destroy_netdev(priv); -+ mlx5e_destroy_netdev(netdev); - err_devlink_port_unregister: - mlx5e_devlink_port_unregister(mlx5e_dev); - err_devlink_unregister: -@@ -6760,7 +6761,9 @@ static void _mlx5e_remove(struct auxiliary_device *adev) - struct mlx5_core_dev *mdev = edev->mdev; - - mlx5_core_uplink_netdev_set(mdev, NULL); -- mlx5e_dcbnl_delete_app(priv); -+ -+ if (priv->profile) -+ mlx5e_dcbnl_delete_app(priv); - /* When unload driver, the netdev is in registered state - * if it's from legacy mode. If from switchdev mode, it - * is already unregistered before changing to NIC profile. -@@ -6781,7 +6784,7 @@ static void _mlx5e_remove(struct auxiliary_device *adev) - /* Avoid cleanup if profile rollback failed. */ - if (priv->profile) - priv->profile->cleanup(priv); -- mlx5e_destroy_netdev(priv); -+ mlx5e_destroy_netdev(netdev); - mlx5e_devlink_port_unregister(mlx5e_dev); - mlx5e_destroy_devlink(mlx5e_dev); - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -index 2b1b6e094ba8..493e0f01b5a8 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c -@@ -1604,7 +1604,7 @@ mlx5e_vport_vf_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - priv->profile->cleanup(priv); - - err_destroy_netdev: -- mlx5e_destroy_netdev(netdev_priv(netdev)); -+ mlx5e_destroy_netdev(netdev); - return err; - } - -@@ -1659,7 +1659,7 @@ mlx5e_vport_rep_unload(struct mlx5_eswitch_rep *rep) - mlx5e_rep_vnic_reporter_destroy(priv); - mlx5e_detach_netdev(priv); - priv->profile->cleanup(priv); -- mlx5e_destroy_netdev(priv); -+ mlx5e_destroy_netdev(netdev); - free_ppriv: - kvfree(ppriv); /* mlx5e_rep_priv */ - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1656-net-mlx5e-restore-destroying-state-bit-after-profile-cleanup.patch b/SOURCES/1656-net-mlx5e-restore-destroying-state-bit-after-profile-cleanup.patch deleted file mode 100644 index 0a4316644..000000000 --- a/SOURCES/1656-net-mlx5e-restore-destroying-state-bit-after-profile-cleanup.patch +++ /dev/null @@ -1,71 +0,0 @@ -From 93b9795b5f597068b48a83b917d80b3ed6386e81 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:38 -0400 -Subject: [PATCH] net/mlx5e: Restore destroying state bit after profile cleanup - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5629f8859dca7ef74d7314b60de6a957f23166c0 -Author: Saeed Mahameed -Date: Thu Jan 8 13:26:57 2026 -0800 - - net/mlx5e: Restore destroying state bit after profile cleanup - - Profile rollback can fail in mlx5e_netdev_change_profile() and we will - end up with invalid mlx5e_priv memset to 0, we must maintain the - 'destroying' bit in order to gracefully shutdown even if the - profile/priv are not valid. - - This patch maintains the previous state of the 'destroying' state of - mlx5e_priv after priv cleanup, to allow the remove flow to cleanup - common resources from mlx5_core to avoid FW fatal errors as seen below: - - $ devlink dev eswitch set pci/0000:00:03.0 mode switchdev - Error: mlx5_core: Failed setting eswitch to offloads. - dmesg: mlx5_core 0000:00:03.0 enp0s3np0: failed to rollback to orig profile, ... - - $ devlink dev reload pci/0000:00:03.0 - - mlx5_core 0000:00:03.0: E-Switch: Disable: mode(LEGACY), nvfs(0), necvfs(0), active vports(0) - mlx5_core 0000:00:03.0: poll_health:803:(pid 519): Fatal error 3 detected - mlx5_core 0000:00:03.0: firmware version: 28.41.1000 - mlx5_core 0000:00:03.0: 0.000 Gb/s available PCIe bandwidth (Unknown x255 link) - mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed - mlx5_core 0000:00:03.0: mlx5_function_enable:1200:(pid 519): enable hca failed - mlx5_core 0000:00:03.0: mlx5_health_try_recover:340:(pid 141): handling bad device here - mlx5_core 0000:00:03.0: mlx5_handle_bad_state:285:(pid 141): Expected to see disabled NIC but it is full driver - mlx5_core 0000:00:03.0: mlx5_error_sw_reset:236:(pid 141): start - mlx5_core 0000:00:03.0: NIC IFC still 0 after 4000ms. - - Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method") - Signed-off-by: Saeed Mahameed - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260108212657.25090-5-saeed@kernel.org - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 7e3618dfa888..be18d6cfd35b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6253,6 +6253,7 @@ int mlx5e_priv_init(struct mlx5e_priv *priv, - - void mlx5e_priv_cleanup(struct mlx5e_priv *priv) - { -+ bool destroying = test_bit(MLX5E_STATE_DESTROYING, &priv->state); - int i; - - /* bail if change profile failed and also rollback failed */ -@@ -6279,6 +6280,8 @@ void mlx5e_priv_cleanup(struct mlx5e_priv *priv) - } - - memset(priv, 0, sizeof(*priv)); -+ if (destroying) /* restore destroying bit, to allow unload */ -+ set_bit(MLX5E_STATE_DESTROYING, &priv->state); - } - - static unsigned int mlx5e_get_max_num_txqs(struct mlx5_core_dev *mdev, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1657-net-mlx5-fix-memory-leak-in-esw-acl-ingress-lgcy-setup.patch b/SOURCES/1657-net-mlx5-fix-memory-leak-in-esw-acl-ingress-lgcy-setup.patch deleted file mode 100644 index bb577af17..000000000 --- a/SOURCES/1657-net-mlx5-fix-memory-leak-in-esw-acl-ingress-lgcy-setup.patch +++ /dev/null @@ -1,48 +0,0 @@ -From d65e10ccab7a91e2068ad9c6f4736dfe6da13d2f Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:10:39 -0400 -Subject: [PATCH] net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 108948f723b13874b7ebf6b3f1cc598a7de38622 -Author: Zilin Guan -Date: Tue Jan 20 13:46:40 2026 +0000 - - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() - - In esw_acl_ingress_lgcy_setup(), if esw_acl_table_create() fails, - the function returns directly without releasing the previously - created counter, leading to a memory leak. - - Fix this by jumping to the out label instead of returning directly, - which aligns with the error handling logic of other paths in this - function. - - Compile tested only. Issue found using a prototype static analysis tool - and code review. - - Fixes: 07bab9502641 ("net/mlx5: E-Switch, Refactor eswitch ingress acl codes") - Signed-off-by: Zilin Guan - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260120134640.2717808-1-zilin@seu.edu.cn - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c -index 1c37098e09ea..49a637829c59 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/acl/ingress_lgcy.c -@@ -188,7 +188,7 @@ int esw_acl_ingress_lgcy_setup(struct mlx5_eswitch *esw, - if (IS_ERR(vport->ingress.acl)) { - err = PTR_ERR(vport->ingress.acl); - vport->ingress.acl = NULL; -- return err; -+ goto out; - } - - err = esw_acl_ingress_lgcy_groups_create(esw, vport); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1658-net-mlx5-fix-unbinding-uplink-netdev-in-switchdev-mode.patch b/SOURCES/1658-net-mlx5-fix-unbinding-uplink-netdev-in-switchdev-mode.patch deleted file mode 100644 index bdd2b2bd7..000000000 --- a/SOURCES/1658-net-mlx5-fix-unbinding-uplink-netdev-in-switchdev-mode.patch +++ /dev/null @@ -1,159 +0,0 @@ -From 05b3733cda98e6ed503d943ce964f775e8199fc4 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:29:26 -0400 -Subject: [PATCH] net/mlx5: Fix Unbinding uplink-netdev in switchdev mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2ae8c7edea87f54609bda30963a099cd3c64b0bb -Author: Shay Drory -Date: Mon Jan 26 09:14:53 2026 +0200 - - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode - - It is possible to unbind the uplink ETH driver while the E-Switch is - in switchdev mode. This leads to netdevice reference counting issues[1], - as the driver removal path was not designed to clean up from this state. - - During uplink ETH driver removal (_mlx5e_remove), the code now waits for - any concurrent E-Switch mode transition to finish. It then removes the - REPs auxiliary device, if exists. This ensures a graceful cleanup. - - [1] - unregister_netdevice: waiting for eth2 to become free. Usage count = 2 - ref_tracker: netdev@00000000c912e04b has 1/1 users at - ib_device_set_netdev+0x130/0x270 [ib_core] - mlx5_ib_vport_rep_load+0xf4/0x3e0 [mlx5_ib] - mlx5_esw_offloads_rep_load+0xc7/0xe0 [mlx5_core] - esw_offloads_enable+0x583/0x900 [mlx5_core] - mlx5_eswitch_enable_locked+0x1b2/0x290 [mlx5_core] - mlx5_devlink_eswitch_mode_set+0x107/0x3e0 [mlx5_core] - devlink_nl_eswitch_set_doit+0x60/0xd0 - genl_family_rcv_msg_doit+0xe0/0x130 - genl_rcv_msg+0x183/0x290 - netlink_rcv_skb+0x4b/0xf0 - genl_rcv+0x24/0x40 - netlink_unicast+0x255/0x380 - netlink_sendmsg+0x1f3/0x420 - __sock_sendmsg+0x38/0x60 - __sys_sendto+0x119/0x180 - __x64_sys_sendto+0x20/0x30 - - Fixes: 7a9fb35e8c3a ("net/mlx5e: Do not reload ethernet ports when changing eswitch mode") - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1769411695-18820-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/dev.c b/drivers/net/ethernet/mellanox/mlx5/core/dev.c -index 64c04f52990f..781e39b5aa1d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/dev.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/dev.c -@@ -575,3 +575,17 @@ bool mlx5_same_hw_devs(struct mlx5_core_dev *dev, struct mlx5_core_dev *peer_dev - return plen && flen && flen == plen && - !memcmp(fsystem_guid, psystem_guid, flen); - } -+ -+void mlx5_core_reps_aux_devs_remove(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_priv *priv = &dev->priv; -+ -+ if (priv->adev[MLX5_INTERFACE_PROTOCOL_ETH]) -+ device_lock_assert(&priv->adev[MLX5_INTERFACE_PROTOCOL_ETH]->adev.dev); -+ else -+ mlx5_core_err(dev, "ETH driver already removed\n"); -+ if (priv->adev[MLX5_INTERFACE_PROTOCOL_IB_REP]) -+ del_adev(&priv->adev[MLX5_INTERFACE_PROTOCOL_IB_REP]->adev); -+ if (priv->adev[MLX5_INTERFACE_PROTOCOL_ETH_REP]) -+ del_adev(&priv->adev[MLX5_INTERFACE_PROTOCOL_ETH_REP]->adev); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index be18d6cfd35b..4ccd20317759 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -6763,6 +6763,7 @@ static void _mlx5e_remove(struct auxiliary_device *adev) - struct mlx5e_priv *priv = netdev_priv(netdev); - struct mlx5_core_dev *mdev = edev->mdev; - -+ mlx5_eswitch_safe_aux_devs_remove(mdev); - mlx5_core_uplink_netdev_set(mdev, NULL); - - if (priv->profile) -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index ad1073f7b79f..829b9ecca7bc 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -929,6 +929,7 @@ int mlx5_esw_ipsec_vf_packet_offload_set(struct mlx5_eswitch *esw, struct mlx5_v - int mlx5_esw_ipsec_vf_packet_offload_supported(struct mlx5_core_dev *dev, - u16 vport_num); - bool mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev); -+void mlx5_eswitch_safe_aux_devs_remove(struct mlx5_core_dev *dev); - #else /* CONFIG_MLX5_ESWITCH */ - /* eswitch API stubs */ - static inline int mlx5_eswitch_init(struct mlx5_core_dev *dev) { return 0; } -@@ -1012,6 +1013,9 @@ mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id) - return -EOPNOTSUPP; - } - -+static inline void -+mlx5_eswitch_safe_aux_devs_remove(struct mlx5_core_dev *dev) {} -+ - #endif /* CONFIG_MLX5_ESWITCH */ - - #endif /* __MLX5_ESWITCH_H__ */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 575b12079933..30bf164a067f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -3980,6 +3980,32 @@ static bool mlx5_devlink_switchdev_active_mode_change(struct mlx5_eswitch *esw, - return true; - } - -+#define MLX5_ESW_HOLD_TIMEOUT_MS 7000 -+#define MLX5_ESW_HOLD_RETRY_DELAY_MS 500 -+ -+void mlx5_eswitch_safe_aux_devs_remove(struct mlx5_core_dev *dev) -+{ -+ unsigned long timeout; -+ bool hold_esw = true; -+ -+ /* Wait for any concurrent eswitch mode transition to complete. */ -+ if (!mlx5_esw_hold(dev)) { -+ timeout = jiffies + msecs_to_jiffies(MLX5_ESW_HOLD_TIMEOUT_MS); -+ while (!mlx5_esw_hold(dev)) { -+ if (!time_before(jiffies, timeout)) { -+ hold_esw = false; -+ break; -+ } -+ msleep(MLX5_ESW_HOLD_RETRY_DELAY_MS); -+ } -+ } -+ if (hold_esw) { -+ if (mlx5_eswitch_mode(dev) == MLX5_ESWITCH_OFFLOADS) -+ mlx5_core_reps_aux_devs_remove(dev); -+ mlx5_esw_release(dev); -+ } -+} -+ - int mlx5_devlink_eswitch_mode_set(struct devlink *devlink, u16 mode, - struct netlink_ext_ack *extack) - { -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index cfebc110c02f..99b0a25054ef 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -290,6 +290,7 @@ int mlx5_register_device(struct mlx5_core_dev *dev); - void mlx5_unregister_device(struct mlx5_core_dev *dev); - void mlx5_dev_set_lightweight(struct mlx5_core_dev *dev); - bool mlx5_dev_is_lightweight(struct mlx5_core_dev *dev); -+void mlx5_core_reps_aux_devs_remove(struct mlx5_core_dev *dev); - - void mlx5_fw_reporters_create(struct mlx5_core_dev *dev); - int mlx5_query_mtpps(struct mlx5_core_dev *dev, u32 *mtpps, u32 mtpps_size); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1659-net-mlx5e-tc-delete-flows-only-for-existing-peers.patch b/SOURCES/1659-net-mlx5e-tc-delete-flows-only-for-existing-peers.patch deleted file mode 100644 index 4757065a8..000000000 --- a/SOURCES/1659-net-mlx5e-tc-delete-flows-only-for-existing-peers.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 970afdeeddc84cae0ac878cb44d284e5d0fdb77a Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:29:26 -0400 -Subject: [PATCH] net/mlx5e: TC, delete flows only for existing peers - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f67666938ae626cbda63fbf5176b3583c07e7124 -Author: Mark Bloch -Date: Mon Jan 26 09:14:54 2026 +0200 - - net/mlx5e: TC, delete flows only for existing peers - - When deleting TC steering flows, iterate only over actual devcom - peers instead of assuming all possible ports exist. This avoids - touching non-existent peers and ensures cleanup is limited to - devices the driver is currently connected to. - - BUG: kernel NULL pointer dereference, address: 0000000000000008 - #PF: supervisor write access in kernel mode - #PF: error_code(0x0002) - not-present page - PGD 133c8a067 P4D 0 - Oops: Oops: 0002 [#1] SMP - CPU: 19 UID: 0 PID: 2169 Comm: tc Not tainted 6.18.0+ #156 NONE - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 - RIP: 0010:mlx5e_tc_del_fdb_peers_flow+0xbe/0x200 [mlx5_core] - Code: 00 00 a8 08 74 a8 49 8b 46 18 f6 c4 02 74 9f 4c 8d bf a0 12 00 00 4c 89 ff e8 0e e7 96 e1 49 8b 44 24 08 49 8b 0c 24 4c 89 ff <48> 89 41 08 48 89 08 49 89 2c 24 49 89 5c 24 08 e8 7d ce 96 e1 49 - RSP: 0018:ff11000143867528 EFLAGS: 00010246 - RAX: 0000000000000000 RBX: dead000000000122 RCX: 0000000000000000 - RDX: ff11000143691580 RSI: ff110001026e5000 RDI: ff11000106f3d2a0 - RBP: dead000000000100 R08: 00000000000003fd R09: 0000000000000002 - R10: ff11000101c75690 R11: ff1100085faea178 R12: ff11000115f0ae78 - R13: 0000000000000000 R14: ff11000115f0a800 R15: ff11000106f3d2a0 - FS: 00007f35236bf740(0000) GS:ff110008dc809000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000008 CR3: 0000000157a01001 CR4: 0000000000373eb0 - Call Trace: - - mlx5e_tc_del_flow+0x46/0x270 [mlx5_core] - mlx5e_flow_put+0x25/0x50 [mlx5_core] - mlx5e_delete_flower+0x2a6/0x3e0 [mlx5_core] - tc_setup_cb_reoffload+0x20/0x80 - fl_reoffload+0x26f/0x2f0 [cls_flower] - ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] - ? mlx5e_tc_reoffload_flows_work+0xc0/0xc0 [mlx5_core] - tcf_block_playback_offloads+0x9e/0x1c0 - tcf_block_unbind+0x7b/0xd0 - tcf_block_setup+0x186/0x1d0 - tcf_block_offload_cmd.isra.0+0xef/0x130 - tcf_block_offload_unbind+0x43/0x70 - __tcf_block_put+0x85/0x160 - ingress_destroy+0x32/0x110 [sch_ingress] - __qdisc_destroy+0x44/0x100 - qdisc_graft+0x22b/0x610 - tc_get_qdisc+0x183/0x4d0 - rtnetlink_rcv_msg+0x2d7/0x3d0 - ? rtnl_calcit.isra.0+0x100/0x100 - netlink_rcv_skb+0x53/0x100 - netlink_unicast+0x249/0x320 - ? __alloc_skb+0x102/0x1f0 - netlink_sendmsg+0x1e3/0x420 - __sock_sendmsg+0x38/0x60 - ____sys_sendmsg+0x1ef/0x230 - ? copy_msghdr_from_user+0x6c/0xa0 - ___sys_sendmsg+0x7f/0xc0 - ? ___sys_recvmsg+0x8a/0xc0 - ? __sys_sendto+0x119/0x180 - __sys_sendmsg+0x61/0xb0 - do_syscall_64+0x55/0x640 - entry_SYSCALL_64_after_hwframe+0x4b/0x53 - RIP: 0033:0x7f35238bb764 - Code: 15 b9 86 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb bf 0f 1f 44 00 00 f3 0f 1e fa 80 3d e5 08 0d 00 00 74 13 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 20 89 55 - RSP: 002b:00007ffed4c35638 EFLAGS: 00000202 ORIG_RAX: 000000000000002e - RAX: ffffffffffffffda RBX: 000055a2efcc75e0 RCX: 00007f35238bb764 - RDX: 0000000000000000 RSI: 00007ffed4c356a0 RDI: 0000000000000003 - RBP: 00007ffed4c35710 R08: 0000000000000010 R09: 00007f3523984b20 - R10: 0000000000000004 R11: 0000000000000202 R12: 00007ffed4c35790 - R13: 000000006947df8f R14: 000055a2efcc75e0 R15: 00007ffed4c35780 - - Fixes: 9be6c21fdcf8 ("net/mlx5e: Handle offloads flows per peer") - Signed-off-by: Mark Bloch - Reviewed-by: Shay Drori - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1769411695-18820-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -index 17ae07b47f7f..40ae3c61773f 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c -@@ -2147,11 +2147,14 @@ static void mlx5e_tc_del_fdb_peer_flow(struct mlx5e_tc_flow *flow, - - static void mlx5e_tc_del_fdb_peers_flow(struct mlx5e_tc_flow *flow) - { -+ struct mlx5_devcom_comp_dev *devcom; -+ struct mlx5_devcom_comp_dev *pos; -+ struct mlx5_eswitch *peer_esw; - int i; - -- for (i = 0; i < MLX5_MAX_PORTS; i++) { -- if (i == mlx5_get_dev_index(flow->priv->mdev)) -- continue; -+ devcom = flow->priv->mdev->priv.eswitch->devcom; -+ mlx5_devcom_for_each_peer_entry(devcom, peer_esw, pos) { -+ i = mlx5_get_dev_index(peer_esw->dev); - mlx5e_tc_del_fdb_peer_flow(flow, i); - } - } -@@ -5513,12 +5516,16 @@ int mlx5e_tc_num_filters(struct mlx5e_priv *priv, unsigned long flags) - - void mlx5e_tc_clean_fdb_peer_flows(struct mlx5_eswitch *esw) - { -+ struct mlx5_devcom_comp_dev *devcom; -+ struct mlx5_devcom_comp_dev *pos; - struct mlx5e_tc_flow *flow, *tmp; -+ struct mlx5_eswitch *peer_esw; - int i; - -- for (i = 0; i < MLX5_MAX_PORTS; i++) { -- if (i == mlx5_get_dev_index(esw->dev)) -- continue; -+ devcom = esw->devcom; -+ -+ mlx5_devcom_for_each_peer_entry(devcom, peer_esw, pos) { -+ i = mlx5_get_dev_index(peer_esw->dev); - list_for_each_entry_safe(flow, tmp, &esw->offloads.peer_flows[i], peer[i]) - mlx5e_tc_del_fdb_peers_flow(flow); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1660-net-mlx5e-account-for-netdev-stats-in-ndo-get-stats64.patch b/SOURCES/1660-net-mlx5e-account-for-netdev-stats-in-ndo-get-stats64.patch deleted file mode 100644 index e069e1f6e..000000000 --- a/SOURCES/1660-net-mlx5e-account-for-netdev-stats-in-ndo-get-stats64.patch +++ /dev/null @@ -1,77 +0,0 @@ -From 790788e38aff2b1e3115669c125f7266d88be7a7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:29:26 -0400 -Subject: [PATCH] net/mlx5e: Account for netdev stats in ndo_get_stats64 - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 476681f10cc1e0e56e26856684e75d4678b072b2 -Author: Gal Pressman -Date: Mon Jan 26 09:14:55 2026 +0200 - - net/mlx5e: Account for netdev stats in ndo_get_stats64 - - The driver's ndo_get_stats64 callback is only reporting mlx5 counters, - without accounting for the netdev stats, causing errors from the network - stack to be invisible in statistics. - - Add netdev_stats_to_stats64() call to first populate the counters, then - add mlx5 counters on top, ensuring both are accounted for (where - appropriate). - - Fixes: f62b8bb8f2d3 ("net/mlx5: Extend mlx5_core to support ConnectX-4 Ethernet functionality") - Signed-off-by: Gal Pressman - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1769411695-18820-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index 4ccd20317759..af067ff1ebcf 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -4019,6 +4019,8 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) - mlx5e_queue_update_stats(priv); - } - -+ netdev_stats_to_stats64(stats, &dev->stats); -+ - if (mlx5e_is_uplink_rep(priv)) { - struct mlx5e_vport_stats *vstats = &priv->stats.vport; - -@@ -4035,21 +4037,21 @@ mlx5e_get_stats(struct net_device *dev, struct rtnl_link_stats64 *stats) - mlx5e_fold_sw_stats64(priv, stats); - } - -- stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer; -- stats->rx_dropped = PPORT_2863_GET(pstats, if_in_discards); -+ stats->rx_missed_errors += priv->stats.qcnt.rx_out_of_buffer; -+ stats->rx_dropped += PPORT_2863_GET(pstats, if_in_discards); - -- stats->rx_length_errors = -+ stats->rx_length_errors += - PPORT_802_3_GET(pstats, a_in_range_length_errors) + - PPORT_802_3_GET(pstats, a_out_of_range_length_field) + - PPORT_802_3_GET(pstats, a_frame_too_long_errors) + - VNIC_ENV_GET(&priv->stats.vnic, eth_wqe_too_small); -- stats->rx_crc_errors = -+ stats->rx_crc_errors += - PPORT_802_3_GET(pstats, a_frame_check_sequence_errors); -- stats->rx_frame_errors = PPORT_802_3_GET(pstats, a_alignment_errors); -- stats->tx_aborted_errors = PPORT_2863_GET(pstats, if_out_discards); -- stats->rx_errors = stats->rx_length_errors + stats->rx_crc_errors + -- stats->rx_frame_errors; -- stats->tx_errors = stats->tx_aborted_errors + stats->tx_carrier_errors; -+ stats->rx_frame_errors += PPORT_802_3_GET(pstats, a_alignment_errors); -+ stats->tx_aborted_errors += PPORT_2863_GET(pstats, if_out_discards); -+ stats->rx_errors += stats->rx_length_errors + stats->rx_crc_errors + -+ stats->rx_frame_errors; -+ stats->tx_errors += stats->tx_aborted_errors + stats->tx_carrier_errors; - } - - static void mlx5e_nic_set_rx_mode(struct mlx5e_priv *priv) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1661-net-mlx5-fix-return-type-mismatch-in-mlx5-esw-vport-vhca-id.patch b/SOURCES/1661-net-mlx5-fix-return-type-mismatch-in-mlx5-esw-vport-vhca-id.patch deleted file mode 100644 index cedfa59de..000000000 --- a/SOURCES/1661-net-mlx5-fix-return-type-mismatch-in-mlx5-esw-vport-vhca-id.patch +++ /dev/null @@ -1,47 +0,0 @@ -From 3dd049ba859efec10f425696118e102fde8d4882 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:36:26 -0400 -Subject: [PATCH] net/mlx5: Fix return type mismatch in - mlx5_esw_vport_vhca_id() - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit ca12c4a155ebf84e9ef29b05ce979bc89364290f -Author: Zeng Chi -Date: Fri Jan 23 16:57:49 2026 +0800 - - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() - - The function mlx5_esw_vport_vhca_id() is declared to return bool, - but returns -EOPNOTSUPP (-45), which is an int error code. This - causes a signedness bug as reported by smatch. - - This patch fixes this smatch report: - drivers/net/ethernet/mellanox/mlx5/core/eswitch.h:981 mlx5_esw_vport_vhca_id() - warn: signedness bug returning '(-45)' - - Fixes: 1baf30426553 ("net/mlx5: E-Switch, Set/Query hca cap via vhca id") - Reviewed-by: Parav Pandit - Signed-off-by: Zeng Chi - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260123085749.1401969-1-zeng_chi911@163.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -index 829b9ecca7bc..714ad28e8445 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h -@@ -1010,7 +1010,7 @@ mlx5_esw_host_functions_enabled(const struct mlx5_core_dev *dev) - static inline bool - mlx5_esw_vport_vhca_id(struct mlx5_eswitch *esw, u16 vportn, u16 *vhca_id) - { -- return -EOPNOTSUPP; -+ return false; - } - - static inline void --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1662-net-mlx5-fs-fix-inverted-cap-check-in-tx-flow-table-root-dis.patch b/SOURCES/1662-net-mlx5-fs-fix-inverted-cap-check-in-tx-flow-table-root-dis.patch deleted file mode 100644 index e531421cd..000000000 --- a/SOURCES/1662-net-mlx5-fs-fix-inverted-cap-check-in-tx-flow-table-root-dis.patch +++ /dev/null @@ -1,47 +0,0 @@ -From bcedb8b2e9ce1a7b4d28614fa149cf305905c980 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:37:37 -0400 -Subject: [PATCH] net/mlx5: fs, Fix inverted cap check in tx flow table root - disconnect - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 2610a3d65691a1301ab10c92ff6ebab0bedf9199 -Author: Shay Drory -Date: Tue Jan 27 10:52:38 2026 +0200 - - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect - - The capability check for reset_root_to_default was inverted, causing - the function to return -EOPNOTSUPP when the capability IS supported, - rather than when it is NOT supported. - - Fix the capability check condition. - - Fixes: 3c9c34c32bc6 ("net/mlx5: fs, Command to control TX flow table root") - Signed-off-by: Shay Drory - Reviewed-by: Mark Bloch - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1769503961-124173-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -index ced747bef641..c348ee62cd3a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_cmd.c -@@ -1198,7 +1198,8 @@ int mlx5_fs_cmd_set_tx_flow_table_root(struct mlx5_core_dev *dev, u32 ft_id, boo - u32 out[MLX5_ST_SZ_DW(set_flow_table_root_out)] = {}; - u32 in[MLX5_ST_SZ_DW(set_flow_table_root_in)] = {}; - -- if (disconnect && MLX5_CAP_FLOWTABLE_NIC_TX(dev, reset_root_to_default)) -+ if (disconnect && -+ !MLX5_CAP_FLOWTABLE_NIC_TX(dev, reset_root_to_default)) - return -EOPNOTSUPP; - - MLX5_SET(set_flow_table_root_in, in, opcode, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1663-net-mlx5-fix-vhca-id-access-call-trace-use-before-alloc.patch b/SOURCES/1663-net-mlx5-fix-vhca-id-access-call-trace-use-before-alloc.patch deleted file mode 100644 index ff50060ec..000000000 --- a/SOURCES/1663-net-mlx5-fix-vhca-id-access-call-trace-use-before-alloc.patch +++ /dev/null @@ -1,157 +0,0 @@ -From 92e9db10ad78811b7ae2dc215e3dd24de2322b8b Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:37:37 -0400 -Subject: [PATCH] net/mlx5: Fix vhca_id access call trace use before alloc - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit a8f930b7be7be3f18f14446df461e17137400407 -Author: Parav Pandit -Date: Tue Jan 27 10:52:40 2026 +0200 - - net/mlx5: Fix vhca_id access call trace use before alloc - - HCA CAP structure is allocated in mlx5_hca_caps_alloc(). - mlx5_mdev_init() - mlx5_hca_caps_alloc() - - And HCA CAP is read from the device in mlx5_init_one(). - - The vhca_id's debugfs file is published even before above two - operations are done. - Due to this when user reads the vhca id before the initialization, - following call trace is observed. - - Fix this by deferring debugfs publication until the HCA CAP is - allocated and read from the device. - - BUG: kernel NULL pointer dereference, address: 0000000000000004 - PGD 0 P4D 0 - Oops: Oops: 0000 [#1] SMP PTI - CPU: 23 UID: 0 PID: 6605 Comm: cat Kdump: loaded Not tainted 6.18.0-rc7-sf+ #110 PREEMPT(full) - Hardware name: Supermicro SYS-6028U-TR4+/X10DRU-i+, BIOS 2.0b 08/09/2016 - RIP: 0010:vhca_id_show+0x17/0x30 [mlx5_core] - Code: cb 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 48 8b 47 70 48 c7 c6 45 f0 12 c1 48 8b 80 70 03 00 00 <8b> 50 04 0f ca 0f b7 d2 e8 8c 82 47 cb 31 c0 c3 cc cc cc cc 0f 1f - RSP: 0018:ffffd37f4f337d40 EFLAGS: 00010203 - RAX: 0000000000000000 RBX: ffff8f18445c9b40 RCX: 0000000000000001 - RDX: ffff8f1109825180 RSI: ffffffffc112f045 RDI: ffff8f18445c9b40 - RBP: 0000000000000000 R08: 0000645eac0d2928 R09: 0000000000000006 - R10: ffffd37f4f337d48 R11: 0000000000000000 R12: ffffd37f4f337dd8 - R13: ffffd37f4f337db0 R14: ffff8f18445c9b68 R15: 0000000000000001 - FS: 00007f3eea099580(0000) GS:ffff8f2090f1f000(0000) knlGS:0000000000000000 - CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - CR2: 0000000000000004 CR3: 00000008b64e4006 CR4: 00000000003726f0 - Call Trace: - - seq_read_iter+0x11f/0x4f0 - ? _raw_spin_unlock+0x15/0x30 - ? do_anonymous_page+0x104/0x810 - seq_read+0xf6/0x120 - ? srso_alias_untrain_ret+0x1/0x10 - full_proxy_read+0x5c/0x90 - vfs_read+0xad/0x320 - ? handle_mm_fault+0x1ab/0x290 - ksys_read+0x52/0xd0 - do_syscall_64+0x61/0x11e0 - entry_SYSCALL_64_after_hwframe+0x76/0x7e - - Fixes: dd3dd7263cde ("net/mlx5: Expose vhca_id to debugfs") - Signed-off-by: Parav Pandit - Reviewed-by: Shay Drori - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1769503961-124173-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -index 36806e813c33..1301c56e20d6 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c -@@ -613,3 +613,19 @@ void mlx5_debug_cq_remove(struct mlx5_core_dev *dev, struct mlx5_core_cq *cq) - cq->dbg = NULL; - } - } -+ -+static int vhca_id_show(struct seq_file *file, void *priv) -+{ -+ struct mlx5_core_dev *dev = file->private; -+ -+ seq_printf(file, "0x%x\n", MLX5_CAP_GEN(dev, vhca_id)); -+ return 0; -+} -+ -+DEFINE_SHOW_ATTRIBUTE(vhca_id); -+ -+void mlx5_vhca_debugfs_init(struct mlx5_core_dev *dev) -+{ -+ debugfs_create_file("vhca_id", 0400, dev->priv.dbg.dbg_root, dev, -+ &vhca_id_fops); -+} -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index bb794c276b7f..5f6a8eef1982 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1806,16 +1806,6 @@ static int mlx5_hca_caps_alloc(struct mlx5_core_dev *dev) - return -ENOMEM; - } - --static int vhca_id_show(struct seq_file *file, void *priv) --{ -- struct mlx5_core_dev *dev = file->private; -- -- seq_printf(file, "0x%x\n", MLX5_CAP_GEN(dev, vhca_id)); -- return 0; --} -- --DEFINE_SHOW_ATTRIBUTE(vhca_id); -- - static int mlx5_notifiers_init(struct mlx5_core_dev *dev) - { - int err; -@@ -1884,7 +1874,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) - priv->numa_node = dev_to_node(mlx5_core_dma_dev(dev)); - priv->dbg.dbg_root = debugfs_create_dir(dev_name(dev->device), - mlx5_debugfs_root); -- debugfs_create_file("vhca_id", 0400, priv->dbg.dbg_root, dev, &vhca_id_fops); -+ - INIT_LIST_HEAD(&priv->traps); - - err = mlx5_cmd_init(dev); -@@ -2022,6 +2012,8 @@ static int probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - goto err_init_one; - } - -+ mlx5_vhca_debugfs_init(dev); -+ - pci_save_state(pdev); - return 0; - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -index 99b0a25054ef..f2d74382fb85 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/mlx5_core.h -@@ -258,6 +258,7 @@ int mlx5_wait_for_pages(struct mlx5_core_dev *dev, int *pages); - void mlx5_cmd_flush(struct mlx5_core_dev *dev); - void mlx5_cq_debugfs_init(struct mlx5_core_dev *dev); - void mlx5_cq_debugfs_cleanup(struct mlx5_core_dev *dev); -+void mlx5_vhca_debugfs_init(struct mlx5_core_dev *dev); - - int mlx5_query_pcam_reg(struct mlx5_core_dev *dev, u32 *pcam, u8 feature_group, - u8 access_reg_group); -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c -index b706f1486504..c45540fe7d9d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c -@@ -76,6 +76,7 @@ static int mlx5_sf_dev_probe(struct auxiliary_device *adev, const struct auxilia - goto init_one_err; - } - -+ mlx5_vhca_debugfs_init(mdev); - return 0; - - init_one_err: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1664-net-mlx5e-skip-esn-replay-window-setup-for-ipsec-crypto-offl.patch b/SOURCES/1664-net-mlx5e-skip-esn-replay-window-setup-for-ipsec-crypto-offl.patch deleted file mode 100644 index ce7f88556..000000000 --- a/SOURCES/1664-net-mlx5e-skip-esn-replay-window-setup-for-ipsec-crypto-offl.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 62d638d5076e68952faa57a2858b1ef4ed296809 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 17:37:37 -0400 -Subject: [PATCH] net/mlx5e: Skip ESN replay window setup for IPsec crypto - offload - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 011be342dd24b5168a5dcf408b14c3babe503341 -Author: Jianbo Liu -Date: Tue Jan 27 10:52:41 2026 +0200 - - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload - - Commit a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay - window size") introduced logic to setup the ESN replay window size. - This logic is only valid for packet offload. - - However, the check to skip this block only covered outbound offloads. - It was not skipped for crypto offload, causing it to fall through to - the new switch statement and trigger its WARN_ON default case (for - instance, if a window larger than 256 bits was configured). - - Fix this by amending the condition to also skip the replay window - setup if the offload type is not XFRM_DEV_OFFLOAD_PACKET. - - Fixes: a5e400a985df ("net/mlx5e: Honor user choice of IPsec replay window size") - Signed-off-by: Jianbo Liu - Reviewed-by: Leon Romanovsky - Reviewed-by: Simon Horman - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/1769503961-124173-5-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -index a8fb4bec369c..9c7064187ed0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec.c -@@ -430,7 +430,8 @@ void mlx5e_ipsec_build_accel_xfrm_attrs(struct mlx5e_ipsec_sa_entry *sa_entry, - attrs->replay_esn.esn = sa_entry->esn_state.esn; - attrs->replay_esn.esn_msb = sa_entry->esn_state.esn_msb; - attrs->replay_esn.overlap = sa_entry->esn_state.overlap; -- if (attrs->dir == XFRM_DEV_OFFLOAD_OUT) -+ if (attrs->dir == XFRM_DEV_OFFLOAD_OUT || -+ x->xso.type != XFRM_DEV_OFFLOAD_PACKET) - goto skip_replay_window; - - switch (x->replay_esn->replay_window) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1665-rdma-mlx5-change-default-device-for-lag-slaves-in-rdma-trans.patch b/SOURCES/1665-rdma-mlx5-change-default-device-for-lag-slaves-in-rdma-trans.patch deleted file mode 100644 index 46e48de8f..000000000 --- a/SOURCES/1665-rdma-mlx5-change-default-device-for-lag-slaves-in-rdma-trans.patch +++ /dev/null @@ -1,138 +0,0 @@ -From 12d9e4ddee7403d143feac428ed32f172d516daa Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 22:57:23 -0400 -Subject: [PATCH] RDMA/mlx5: Change default device for LAG slaves in RDMA - TRANSPORT namespaces - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 3506242da07156e6804c061554bd01d77c1b463b -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:56 2025 +0200 - - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces - - In case of a LAG configuration change the root namespace core device for - all of the LAG slaves to be the core device of the master device for - RDMA_TRANSPORT namespaces, in order to ensure all tables are created - through the master device. - Once the LAG is disabled revert back to the native core device. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-4-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/ib_rep.c b/drivers/infiniband/hw/mlx5/ib_rep.c -index cc8859d3c2f5..bbecca405171 100644 ---- a/drivers/infiniband/hw/mlx5/ib_rep.c -+++ b/drivers/infiniband/hw/mlx5/ib_rep.c -@@ -44,6 +44,63 @@ static void mlx5_ib_num_ports_update(struct mlx5_core_dev *dev, u32 *num_ports) - } - } - -+static int mlx5_ib_set_owner_transport(struct mlx5_core_dev *cur_owner, -+ struct mlx5_core_dev *new_owner) -+{ -+ int ret; -+ -+ if (!MLX5_CAP_FLOWTABLE_RDMA_TRANSPORT_TX(cur_owner, ft_support) || -+ !MLX5_CAP_FLOWTABLE_RDMA_TRANSPORT_RX(cur_owner, ft_support)) -+ return 0; -+ -+ if (!MLX5_CAP_ADV_RDMA(new_owner, rdma_transport_manager) || -+ !MLX5_CAP_ADV_RDMA(new_owner, rdma_transport_manager_other_eswitch)) -+ return 0; -+ -+ ret = mlx5_fs_set_root_dev(cur_owner, new_owner, -+ FS_FT_RDMA_TRANSPORT_TX); -+ if (ret) -+ return ret; -+ -+ ret = mlx5_fs_set_root_dev(cur_owner, new_owner, -+ FS_FT_RDMA_TRANSPORT_RX); -+ if (ret) { -+ mlx5_fs_set_root_dev(cur_owner, cur_owner, -+ FS_FT_RDMA_TRANSPORT_TX); -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static void mlx5_ib_release_transport(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_core_dev *peer_dev; -+ int i, ret; -+ -+ mlx5_lag_for_each_peer_mdev(dev, peer_dev, i) { -+ ret = mlx5_ib_set_owner_transport(peer_dev, peer_dev); -+ WARN_ON_ONCE(ret); -+ } -+} -+ -+static int mlx5_ib_take_transport(struct mlx5_core_dev *dev) -+{ -+ struct mlx5_core_dev *peer_dev; -+ int ret; -+ int i; -+ -+ mlx5_lag_for_each_peer_mdev(dev, peer_dev, i) { -+ ret = mlx5_ib_set_owner_transport(peer_dev, dev); -+ if (ret) { -+ mlx5_ib_release_transport(dev); -+ return ret; -+ } -+ } -+ -+ return 0; -+} -+ - static int - mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - { -@@ -88,10 +145,18 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - else - return mlx5_ib_set_vport_rep(lag_master, rep, vport_index); - -+ if (mlx5_lag_is_shared_fdb(dev)) { -+ ret = mlx5_ib_take_transport(lag_master); -+ if (ret) -+ return ret; -+ } -+ - ibdev = ib_alloc_device_with_net(mlx5_ib_dev, ib_dev, - mlx5_core_net(lag_master)); -- if (!ibdev) -- return -ENOMEM; -+ if (!ibdev) { -+ ret = -ENOMEM; -+ goto release_transport; -+ } - - ibdev->port = kcalloc(num_ports, sizeof(*ibdev->port), - GFP_KERNEL); -@@ -127,6 +192,10 @@ mlx5_ib_vport_rep_load(struct mlx5_core_dev *dev, struct mlx5_eswitch_rep *rep) - kfree(ibdev->port); - fail_port: - ib_dealloc_device(&ibdev->ib_dev); -+release_transport: -+ if (mlx5_lag_is_shared_fdb(lag_master)) -+ mlx5_ib_release_transport(lag_master); -+ - return ret; - } - -@@ -182,6 +251,7 @@ mlx5_ib_vport_rep_unload(struct mlx5_eswitch_rep *rep) - esw = peer_mdev->priv.eswitch; - mlx5_eswitch_unregister_vport_reps(esw, REP_IB); - } -+ mlx5_ib_release_transport(mdev); - } - __mlx5_ib_remove(dev, dev->profile, MLX5_IB_STAGE_MAX); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1666-rdma-mlx5-add-other-eswitch-support-for-devx-destruction.patch b/SOURCES/1666-rdma-mlx5-add-other-eswitch-support-for-devx-destruction.patch deleted file mode 100644 index 531e54457..000000000 --- a/SOURCES/1666-rdma-mlx5-add-other-eswitch-support-for-devx-destruction.patch +++ /dev/null @@ -1,67 +0,0 @@ -From 5e8af3841a8d260e3b9643e58cbea841e35f6cc7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 22:57:23 -0400 -Subject: [PATCH] RDMA/mlx5: Add other_eswitch support for devx destruction - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 5939decc64f6b9099c2c356d75047c66a6639e00 -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:57 2025 +0200 - - RDMA/mlx5: Add other_eswitch support for devx destruction - - When building a devx object destruction command for steering objects add - consideration for other_eswitch argument to allow proper destruction for - objects that were created with it. - - Signed-off-by: Patrisious Haddad - Reviewed-by: Mark Bloch - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-5-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/devx.c b/drivers/infiniband/hw/mlx5/devx.c -index 4e2edf3378d7..e52a73bb94ee 100644 ---- a/drivers/infiniband/hw/mlx5/devx.c -+++ b/drivers/infiniband/hw/mlx5/devx.c -@@ -1225,6 +1225,11 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din, - MLX5_GET(create_flow_table_in, in, other_vport)); - MLX5_SET(destroy_flow_table_in, din, vport_number, - MLX5_GET(create_flow_table_in, in, vport_number)); -+ MLX5_SET(destroy_flow_table_in, din, other_eswitch, -+ MLX5_GET(create_flow_table_in, in, other_eswitch)); -+ MLX5_SET(destroy_flow_table_in, din, eswitch_owner_vhca_id, -+ MLX5_GET(create_flow_table_in, in, -+ eswitch_owner_vhca_id)); - MLX5_SET(destroy_flow_table_in, din, table_type, - MLX5_GET(create_flow_table_in, in, table_type)); - MLX5_SET(destroy_flow_table_in, din, table_id, *obj_id); -@@ -1237,6 +1242,11 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din, - MLX5_GET(create_flow_group_in, in, other_vport)); - MLX5_SET(destroy_flow_group_in, din, vport_number, - MLX5_GET(create_flow_group_in, in, vport_number)); -+ MLX5_SET(destroy_flow_group_in, din, other_eswitch, -+ MLX5_GET(create_flow_group_in, in, other_eswitch)); -+ MLX5_SET(destroy_flow_group_in, din, eswitch_owner_vhca_id, -+ MLX5_GET(create_flow_group_in, in, -+ eswitch_owner_vhca_id)); - MLX5_SET(destroy_flow_group_in, din, table_type, - MLX5_GET(create_flow_group_in, in, table_type)); - MLX5_SET(destroy_flow_group_in, din, table_id, -@@ -1251,6 +1261,10 @@ static void devx_obj_build_destroy_cmd(void *in, void *out, void *din, - MLX5_GET(set_fte_in, in, other_vport)); - MLX5_SET(delete_fte_in, din, vport_number, - MLX5_GET(set_fte_in, in, vport_number)); -+ MLX5_SET(delete_fte_in, din, other_eswitch, -+ MLX5_GET(set_fte_in, in, other_eswitch)); -+ MLX5_SET(delete_fte_in, din, eswitch_owner_vhca_id, -+ MLX5_GET(set_fte_in, in, eswitch_owner_vhca_id)); - MLX5_SET(delete_fte_in, din, table_type, - MLX5_GET(set_fte_in, in, table_type)); - MLX5_SET(delete_fte_in, din, table_id, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1667-rdma-mlx5-refactor-get-prio-function.patch b/SOURCES/1667-rdma-mlx5-refactor-get-prio-function.patch deleted file mode 100644 index f10395f0f..000000000 --- a/SOURCES/1667-rdma-mlx5-refactor-get-prio-function.patch +++ /dev/null @@ -1,151 +0,0 @@ -From 358f6d5032cf113b0dbe0ea3c4fd9f693e2c2870 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 22:57:23 -0400 -Subject: [PATCH] RDMA/mlx5: Refactor _get_prio() function - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit f277662b734e96bf38ce7d422b091f53df3ff8cb -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:58 2025 +0200 - - RDMA/mlx5: Refactor _get_prio() function - - Refactor the _get_prio() function to remove redundant arguments by - reusing the existing flow table attributes struct instead of passing - attributes separately. This improves code clarity and maintainability. - - In addition allows downstream patch to add new parameter without - needing to change __get_prio() arguments. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-6-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index b0f7663c24c1..c8a25370aa79 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -691,22 +691,13 @@ static bool __maybe_unused mlx5_ib_shared_ft_allowed(struct ib_device *device) - return MLX5_CAP_GEN(dev->mdev, shared_object_to_user_object_allowed); - } - --static struct mlx5_ib_flow_prio *_get_prio(struct mlx5_ib_dev *dev, -- struct mlx5_flow_namespace *ns, -+static struct mlx5_ib_flow_prio *_get_prio(struct mlx5_flow_namespace *ns, - struct mlx5_ib_flow_prio *prio, -- int priority, -- int num_entries, int num_groups, -- u32 flags, u16 vport) -+ struct mlx5_flow_table_attr *ft_attr) - { -- struct mlx5_flow_table_attr ft_attr = {}; - struct mlx5_flow_table *ft; - -- ft_attr.prio = priority; -- ft_attr.max_fte = num_entries; -- ft_attr.flags = flags; -- ft_attr.vport = vport; -- ft_attr.autogroup.max_num_groups = num_groups; -- ft = mlx5_create_auto_grouped_flow_table(ns, &ft_attr); -+ ft = mlx5_create_auto_grouped_flow_table(ns, ft_attr); - if (IS_ERR(ft)) - return ERR_CAST(ft); - -@@ -720,6 +711,7 @@ static struct mlx5_ib_flow_prio *get_flow_table(struct mlx5_ib_dev *dev, - enum flow_table_type ft_type) - { - bool dont_trap = flow_attr->flags & IB_FLOW_ATTR_FLAGS_DONT_TRAP; -+ struct mlx5_flow_table_attr ft_attr = {}; - struct mlx5_flow_namespace *ns = NULL; - enum mlx5_flow_namespace_type fn_type; - struct mlx5_ib_flow_prio *prio; -@@ -797,11 +789,14 @@ static struct mlx5_ib_flow_prio *get_flow_table(struct mlx5_ib_dev *dev, - max_table_size = min_t(int, num_entries, max_table_size); - - ft = prio->flow_table; -- if (!ft) -- return _get_prio(dev, ns, prio, priority, max_table_size, -- num_groups, flags, 0); -+ if (ft) -+ return prio; - -- return prio; -+ ft_attr.prio = priority; -+ ft_attr.max_fte = max_table_size; -+ ft_attr.flags = flags; -+ ft_attr.autogroup.max_num_groups = num_groups; -+ return _get_prio(ns, prio, &ft_attr); - } - - enum { -@@ -950,6 +945,7 @@ static int get_per_qp_prio(struct mlx5_ib_dev *dev, - enum mlx5_ib_optional_counter_type type) - { - enum mlx5_ib_optional_counter_type per_qp_type; -+ struct mlx5_flow_table_attr ft_attr = {}; - enum mlx5_flow_namespace_type fn_type; - struct mlx5_flow_namespace *ns; - struct mlx5_ib_flow_prio *prio; -@@ -1003,7 +999,10 @@ static int get_per_qp_prio(struct mlx5_ib_dev *dev, - if (prio->flow_table) - return 0; - -- prio = _get_prio(dev, ns, prio, priority, MLX5_FS_MAX_POOL_SIZE, 1, 0, 0); -+ ft_attr.prio = priority; -+ ft_attr.max_fte = MLX5_FS_MAX_POOL_SIZE; -+ ft_attr.autogroup.max_num_groups = 1; -+ prio = _get_prio(ns, prio, &ft_attr); - if (IS_ERR(prio)) - return PTR_ERR(prio); - -@@ -1223,6 +1222,7 @@ int mlx5_ib_fs_add_op_fc(struct mlx5_ib_dev *dev, u32 port_num, - struct mlx5_ib_op_fc *opfc, - enum mlx5_ib_optional_counter_type type) - { -+ struct mlx5_flow_table_attr ft_attr = {}; - enum mlx5_flow_namespace_type fn_type; - int priority, i, err, spec_num; - struct mlx5_flow_act flow_act = {}; -@@ -1304,8 +1304,10 @@ int mlx5_ib_fs_add_op_fc(struct mlx5_ib_dev *dev, u32 port_num, - if (err) - goto free; - -- prio = _get_prio(dev, ns, prio, priority, -- dev->num_ports * MAX_OPFC_RULES, 1, 0, 0); -+ ft_attr.prio = priority; -+ ft_attr.max_fte = dev->num_ports * MAX_OPFC_RULES; -+ ft_attr.autogroup.max_num_groups = 1; -+ prio = _get_prio(ns, prio, &ft_attr); - if (IS_ERR(prio)) { - err = PTR_ERR(prio); - goto put_prio; -@@ -1903,6 +1905,7 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - bool mcast, u32 ib_port) - { - struct mlx5_core_dev *ft_mdev = dev->mdev; -+ struct mlx5_flow_table_attr ft_attr = {}; - struct mlx5_flow_namespace *ns = NULL; - struct mlx5_ib_flow_prio *prio = NULL; - int max_table_size = 0; -@@ -2026,8 +2029,12 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - if (prio->flow_table) - return prio; - -- return _get_prio(dev, ns, prio, priority, max_table_size, -- MLX5_FS_MAX_TYPES, flags, vport); -+ ft_attr.prio = priority; -+ ft_attr.max_fte = max_table_size; -+ ft_attr.flags = flags; -+ ft_attr.vport = vport; -+ ft_attr.autogroup.max_num_groups = MLX5_FS_MAX_TYPES; -+ return _get_prio(ns, prio, &ft_attr); - } - - static struct mlx5_ib_flow_handler * --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1668-rdma-mlx5-add-other-eswitch-support-to-userspace-tables.patch b/SOURCES/1668-rdma-mlx5-add-other-eswitch-support-to-userspace-tables.patch deleted file mode 100644 index 459d3fc52..000000000 --- a/SOURCES/1668-rdma-mlx5-add-other-eswitch-support-to-userspace-tables.patch +++ /dev/null @@ -1,82 +0,0 @@ -From 1e56cbcbe140a743961ae9209de4e33c933d1de7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 22:57:24 -0400 -Subject: [PATCH] RDMA/mlx5: Add other eswitch support to userspace tables - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6e79e210058e8f95fb3824e33b781960851ae7d1 -Author: Patrisious Haddad -Date: Wed Oct 29 17:42:59 2025 +0200 - - RDMA/mlx5: Add other eswitch support to userspace tables - - Allows the creation of RDMA TRANSPORT tables over VFs/SFs that - belong to another eswitch manager. Which is only possible for PFs that - were connected via a create_lag PRM command. - - Signed-off-by: Patrisious Haddad - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251029-support-other-eswitch-v1-7-98bb707b5d57@nvidia.com - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c -index c8a25370aa79..d17823ce7f38 100644 ---- a/drivers/infiniband/hw/mlx5/fs.c -+++ b/drivers/infiniband/hw/mlx5/fs.c -@@ -1874,7 +1874,7 @@ static int mlx5_ib_fill_transport_ns_info(struct mlx5_ib_dev *dev, - u32 *flags, u16 *vport_idx, - u16 *vport, - struct mlx5_core_dev **ft_mdev, -- u32 ib_port) -+ u32 ib_port, u16 *esw_owner_vhca_id) - { - struct mlx5_core_dev *esw_mdev; - -@@ -1888,8 +1888,13 @@ static int mlx5_ib_fill_transport_ns_info(struct mlx5_ib_dev *dev, - return -EINVAL; - - esw_mdev = mlx5_eswitch_get_core_dev(dev->port[ib_port - 1].rep->esw); -- if (esw_mdev != dev->mdev) -- return -EOPNOTSUPP; -+ if (esw_mdev != dev->mdev) { -+ if (!MLX5_CAP_ADV_RDMA(dev->mdev, -+ rdma_transport_manager_other_eswitch)) -+ return -EOPNOTSUPP; -+ *flags |= MLX5_FLOW_TABLE_OTHER_ESWITCH; -+ *esw_owner_vhca_id = MLX5_CAP_GEN(esw_mdev, vhca_id); -+ } - - *flags |= MLX5_FLOW_TABLE_OTHER_VPORT; - *ft_mdev = esw_mdev; -@@ -1908,6 +1913,7 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - struct mlx5_flow_table_attr ft_attr = {}; - struct mlx5_flow_namespace *ns = NULL; - struct mlx5_ib_flow_prio *prio = NULL; -+ u16 esw_owner_vhca_id = 0; - int max_table_size = 0; - u16 vport_idx = 0; - bool esw_encap; -@@ -1969,7 +1975,8 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - return ERR_PTR(-EINVAL); - ret = mlx5_ib_fill_transport_ns_info(dev, ns_type, &flags, - &vport_idx, &vport, -- &ft_mdev, ib_port); -+ &ft_mdev, ib_port, -+ &esw_owner_vhca_id); - if (ret) - return ERR_PTR(ret); - -@@ -2033,6 +2040,7 @@ _get_flow_table(struct mlx5_ib_dev *dev, u16 user_priority, - ft_attr.max_fte = max_table_size; - ft_attr.flags = flags; - ft_attr.vport = vport; -+ ft_attr.esw_owner_vhca_id = esw_owner_vhca_id; - ft_attr.autogroup.max_num_groups = MLX5_FS_MAX_TYPES; - return _get_prio(ns, prio, &ft_attr); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1669-ib-mlx5-reduce-imr-ksm-size-when-5-level-paging-is-enabled.patch b/SOURCES/1669-ib-mlx5-reduce-imr-ksm-size-when-5-level-paging-is-enabled.patch deleted file mode 100644 index 276393df5..000000000 --- a/SOURCES/1669-ib-mlx5-reduce-imr-ksm-size-when-5-level-paging-is-enabled.patch +++ /dev/null @@ -1,277 +0,0 @@ -From 7ab8fa2cec647de00118c81fbd7186f05dcb2302 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Mon, 20 Apr 2026 22:57:24 -0400 -Subject: [PATCH] IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 6dbd547adad534c0daad13ca9e1f862278ca955b -Author: Yishai Hadas -Date: Thu Nov 20 16:49:28 2025 +0200 - - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled - - Enabling 5-level paging (LA57) increases TASK_SIZE on x86_64 from 2^47 - to 2^56. This affects implicit ODP, which uses TASK_SIZE to calculate - the number of IMR KSM entries. - - As a result, the number of entries and the memory usage for KSM mkeys - increase drastically: - - - With 2^47 TASK_SIZE: 0x20000 entries (~2MB) - - With 2^56 TASK_SIZE: 0x4000000 entries (~1GB) - - This issue could happen previously on systems with LA57 manually - enabled, but now commit 7212b58d6d71 ("x86/mm/64: Make 5-level paging - support unconditional") enables LA57 by default on all supported - systems. This makes the issue impact widespread. - - To mitigate this, increase the size each MTT entry maps from 1GB to 16GB - when 5-level paging is enabled. This reduces the number of KSM entries - and lowers the memory usage on LA57 systems from 1GB to 64MB per IMR. - - As now 'mlx5_imr_mtt_size' is larger than 32 bits, we move to use u64 - instead of int as part of populate_klm() to prevent overflow of the - 'step' variable. - - In addition, as populate_klm() actually handles KSM and not KLM, as it's - used only by implicit ODP, we renamed its signature and the internal - structures accordingly while dropping the byte_count handling which is - not relevant in KSM. The page size in KSM is fixed for all the entries - and come from the log_page_size of the mkey. - - Note: - On platforms where the calculated value for 'mlx5_imr_ksm_page_shift' is - higher than the max firmware cap to be changed over UMR, or that the - calculated value for 'log_va_pages' is higher than what we may expect, - the implicit ODP cap will be simply turned off. - - Co-developed-by: Or Har-Toov - Signed-off-by: Or Har-Toov - Signed-off-by: Yishai Hadas - Reviewed-by: Michael Guralnik - Signed-off-by: Edward Srouji - Link: https://patch.msgid.link/20251120-reduce-ksm-v1-1-6864bfc814dc@kernel.org - Signed-off-by: Leon Romanovsky - -Signed-off-by: Kamal Heib - -diff --git a/drivers/infiniband/hw/mlx5/odp.c b/drivers/infiniband/hw/mlx5/odp.c -index 6441abdf1f3b..e71ee3d52eb0 100644 ---- a/drivers/infiniband/hw/mlx5/odp.c -+++ b/drivers/infiniband/hw/mlx5/odp.c -@@ -97,33 +97,28 @@ struct mlx5_pagefault { - * a pagefault. */ - #define MMU_NOTIFIER_TIMEOUT 1000 - --#define MLX5_IMR_MTT_BITS (30 - PAGE_SHIFT) --#define MLX5_IMR_MTT_SHIFT (MLX5_IMR_MTT_BITS + PAGE_SHIFT) --#define MLX5_IMR_MTT_ENTRIES BIT_ULL(MLX5_IMR_MTT_BITS) --#define MLX5_IMR_MTT_SIZE BIT_ULL(MLX5_IMR_MTT_SHIFT) --#define MLX5_IMR_MTT_MASK (~(MLX5_IMR_MTT_SIZE - 1)) -- --#define MLX5_KSM_PAGE_SHIFT MLX5_IMR_MTT_SHIFT -- - static u64 mlx5_imr_ksm_entries; -+static u64 mlx5_imr_mtt_entries; -+static u64 mlx5_imr_mtt_size; -+static u8 mlx5_imr_mtt_shift; -+static u8 mlx5_imr_ksm_page_shift; - --static void populate_klm(struct mlx5_klm *pklm, size_t idx, size_t nentries, -+static void populate_ksm(struct mlx5_ksm *pksm, size_t idx, size_t nentries, - struct mlx5_ib_mr *imr, int flags) - { - struct mlx5_core_dev *dev = mr_to_mdev(imr)->mdev; -- struct mlx5_klm *end = pklm + nentries; -- int step = MLX5_CAP_ODP(dev, mem_page_fault) ? MLX5_IMR_MTT_SIZE : 0; -+ struct mlx5_ksm *end = pksm + nentries; -+ u64 step = MLX5_CAP_ODP(dev, mem_page_fault) ? mlx5_imr_mtt_size : 0; - __be32 key = MLX5_CAP_ODP(dev, mem_page_fault) ? - cpu_to_be32(imr->null_mmkey.key) : - mr_to_mdev(imr)->mkeys.null_mkey; - u64 va = -- MLX5_CAP_ODP(dev, mem_page_fault) ? idx * MLX5_IMR_MTT_SIZE : 0; -+ MLX5_CAP_ODP(dev, mem_page_fault) ? idx * mlx5_imr_mtt_size : 0; - - if (flags & MLX5_IB_UPD_XLT_ZAP) { -- for (; pklm != end; pklm++, idx++, va += step) { -- pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE); -- pklm->key = key; -- pklm->va = cpu_to_be64(va); -+ for (; pksm != end; pksm++, idx++, va += step) { -+ pksm->key = key; -+ pksm->va = cpu_to_be64(va); - } - return; - } -@@ -147,16 +142,15 @@ static void populate_klm(struct mlx5_klm *pklm, size_t idx, size_t nentries, - */ - lockdep_assert_held(&to_ib_umem_odp(imr->umem)->umem_mutex); - -- for (; pklm != end; pklm++, idx++, va += step) { -+ for (; pksm != end; pksm++, idx++, va += step) { - struct mlx5_ib_mr *mtt = xa_load(&imr->implicit_children, idx); - -- pklm->bcount = cpu_to_be32(MLX5_IMR_MTT_SIZE); - if (mtt) { -- pklm->key = cpu_to_be32(mtt->ibmr.lkey); -- pklm->va = cpu_to_be64(idx * MLX5_IMR_MTT_SIZE); -+ pksm->key = cpu_to_be32(mtt->ibmr.lkey); -+ pksm->va = cpu_to_be64(idx * mlx5_imr_mtt_size); - } else { -- pklm->key = key; -- pklm->va = cpu_to_be64(va); -+ pksm->key = key; -+ pksm->va = cpu_to_be64(va); - } - } - } -@@ -201,7 +195,7 @@ int mlx5_odp_populate_xlt(void *xlt, size_t idx, size_t nentries, - struct mlx5_ib_mr *mr, int flags) - { - if (flags & MLX5_IB_UPD_XLT_INDIRECT) { -- populate_klm(xlt, idx, nentries, mr, flags); -+ populate_ksm(xlt, idx, nentries, mr, flags); - return 0; - } else { - return populate_mtt(xlt, idx, nentries, mr, flags); -@@ -226,7 +220,7 @@ static void free_implicit_child_mr_work(struct work_struct *work) - - mutex_lock(&odp_imr->umem_mutex); - mlx5r_umr_update_xlt(mr->parent, -- ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT, 1, 0, -+ ib_umem_start(odp) >> mlx5_imr_mtt_shift, 1, 0, - MLX5_IB_UPD_XLT_INDIRECT | MLX5_IB_UPD_XLT_ATOMIC); - mutex_unlock(&odp_imr->umem_mutex); - mlx5_ib_dereg_mr(&mr->ibmr, NULL); -@@ -237,7 +231,7 @@ static void free_implicit_child_mr_work(struct work_struct *work) - static void destroy_unused_implicit_child_mr(struct mlx5_ib_mr *mr) - { - struct ib_umem_odp *odp = to_ib_umem_odp(mr->umem); -- unsigned long idx = ib_umem_start(odp) >> MLX5_IMR_MTT_SHIFT; -+ unsigned long idx = ib_umem_start(odp) >> mlx5_imr_mtt_shift; - struct mlx5_ib_mr *imr = mr->parent; - - /* -@@ -425,7 +419,10 @@ static void internal_fill_odp_caps(struct mlx5_ib_dev *dev) - if (MLX5_CAP_GEN(dev->mdev, fixed_buffer_size) && - MLX5_CAP_GEN(dev->mdev, null_mkey) && - MLX5_CAP_GEN(dev->mdev, umr_extended_translation_offset) && -- !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled)) -+ !MLX5_CAP_GEN(dev->mdev, umr_indirect_mkey_disabled) && -+ mlx5_imr_ksm_entries != 0 && -+ !(mlx5_imr_ksm_page_shift > -+ get_max_log_entity_size_cap(dev, MLX5_MKC_ACCESS_MODE_KSM))) - caps->general_caps |= IB_ODP_SUPPORT_IMPLICIT; - } - -@@ -476,14 +473,14 @@ static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr, - int err; - - odp = ib_umem_odp_alloc_child(to_ib_umem_odp(imr->umem), -- idx * MLX5_IMR_MTT_SIZE, -- MLX5_IMR_MTT_SIZE, &mlx5_mn_ops); -+ idx * mlx5_imr_mtt_size, -+ mlx5_imr_mtt_size, &mlx5_mn_ops); - if (IS_ERR(odp)) - return ERR_CAST(odp); - - mr = mlx5_mr_cache_alloc(dev, imr->access_flags, - MLX5_MKC_ACCESS_MODE_MTT, -- MLX5_IMR_MTT_ENTRIES); -+ mlx5_imr_mtt_entries); - if (IS_ERR(mr)) { - ib_umem_odp_release(odp); - return mr; -@@ -495,7 +492,7 @@ static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr, - mr->umem = &odp->umem; - mr->ibmr.lkey = mr->mmkey.key; - mr->ibmr.rkey = mr->mmkey.key; -- mr->ibmr.iova = idx * MLX5_IMR_MTT_SIZE; -+ mr->ibmr.iova = idx * mlx5_imr_mtt_size; - mr->parent = imr; - odp->private = mr; - -@@ -506,7 +503,7 @@ static struct mlx5_ib_mr *implicit_get_child_mr(struct mlx5_ib_mr *imr, - refcount_set(&mr->mmkey.usecount, 2); - - err = mlx5r_umr_update_xlt(mr, 0, -- MLX5_IMR_MTT_ENTRIES, -+ mlx5_imr_mtt_entries, - PAGE_SHIFT, - MLX5_IB_UPD_XLT_ZAP | - MLX5_IB_UPD_XLT_ENABLE); -@@ -611,7 +608,7 @@ struct mlx5_ib_mr *mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd *pd, - struct mlx5_ib_mr *imr; - int err; - -- if (!mlx5r_umr_can_load_pas(dev, MLX5_IMR_MTT_ENTRIES * PAGE_SIZE)) -+ if (!mlx5r_umr_can_load_pas(dev, mlx5_imr_mtt_entries * PAGE_SIZE)) - return ERR_PTR(-EOPNOTSUPP); - - umem_odp = ib_umem_odp_alloc_implicit(&dev->ib_dev, access_flags); -@@ -647,7 +644,7 @@ struct mlx5_ib_mr *mlx5_ib_alloc_implicit_mr(struct mlx5_ib_pd *pd, - - err = mlx5r_umr_update_xlt(imr, 0, - mlx5_imr_ksm_entries, -- MLX5_KSM_PAGE_SHIFT, -+ mlx5_imr_ksm_page_shift, - MLX5_IB_UPD_XLT_INDIRECT | - MLX5_IB_UPD_XLT_ZAP | - MLX5_IB_UPD_XLT_ENABLE); -@@ -750,20 +747,20 @@ static int pagefault_implicit_mr(struct mlx5_ib_mr *imr, - struct ib_umem_odp *odp_imr, u64 user_va, - size_t bcnt, u32 *bytes_mapped, u32 flags) - { -- unsigned long end_idx = (user_va + bcnt - 1) >> MLX5_IMR_MTT_SHIFT; -+ unsigned long end_idx = (user_va + bcnt - 1) >> mlx5_imr_mtt_shift; - unsigned long upd_start_idx = end_idx + 1; - unsigned long upd_len = 0; - unsigned long npages = 0; - int err; - int ret; - -- if (unlikely(user_va >= mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE || -- mlx5_imr_ksm_entries * MLX5_IMR_MTT_SIZE - user_va < bcnt)) -+ if (unlikely(user_va >= mlx5_imr_ksm_entries * mlx5_imr_mtt_size || -+ mlx5_imr_ksm_entries * mlx5_imr_mtt_size - user_va < bcnt)) - return -EFAULT; - - /* Fault each child mr that intersects with our interval. */ - while (bcnt) { -- unsigned long idx = user_va >> MLX5_IMR_MTT_SHIFT; -+ unsigned long idx = user_va >> mlx5_imr_mtt_shift; - struct ib_umem_odp *umem_odp; - struct mlx5_ib_mr *mtt; - u64 len; -@@ -1924,9 +1921,25 @@ void mlx5_ib_odp_cleanup_one(struct mlx5_ib_dev *dev) - - int mlx5_ib_odp_init(void) - { -+ u32 log_va_pages = ilog2(TASK_SIZE) - PAGE_SHIFT; -+ u8 mlx5_imr_mtt_bits; -+ -+ /* 48 is default ARM64 VA space and covers X86 4-level paging which is 47 */ -+ if (log_va_pages <= 48 - PAGE_SHIFT) -+ mlx5_imr_mtt_shift = 30; -+ /* 56 is x86-64, 5-level paging */ -+ else if (log_va_pages <= 56 - PAGE_SHIFT) -+ mlx5_imr_mtt_shift = 34; -+ else -+ return 0; -+ -+ mlx5_imr_mtt_size = BIT_ULL(mlx5_imr_mtt_shift); -+ mlx5_imr_mtt_bits = mlx5_imr_mtt_shift - PAGE_SHIFT; -+ mlx5_imr_mtt_entries = BIT_ULL(mlx5_imr_mtt_bits); - mlx5_imr_ksm_entries = BIT_ULL(get_order(TASK_SIZE) - -- MLX5_IMR_MTT_BITS); -+ mlx5_imr_mtt_bits); - -+ mlx5_imr_ksm_page_shift = mlx5_imr_mtt_shift; - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1670-net-mlx5e-shampo-fix-header-mapping-for-64k-pages.patch b/SOURCES/1670-net-mlx5e-shampo-fix-header-mapping-for-64k-pages.patch deleted file mode 100644 index df750c228..000000000 --- a/SOURCES/1670-net-mlx5e-shampo-fix-header-mapping-for-64k-pages.patch +++ /dev/null @@ -1,126 +0,0 @@ -From 27d7412e723700805252d3c166530d596311fefe Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 21 Apr 2026 14:55:14 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO, Fix header mapping for 64K pages - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to the missing of the following commit: -d1668f119943 ("net/mlx5e: Convert over to netmem") - -commit 665a7e13c220bbde55531a24bd5524320648df10 -Author: Dragos Tatulea -Date: Tue Nov 4 08:48:33 2025 +0200 - - net/mlx5e: SHAMPO, Fix header mapping for 64K pages - - HW-GRO is broken on mlx5 for 64K page sizes. The patch in the fixes tag - didn't take into account larger page sizes when doing an align down - of max_ksm_entries. For 64K page size, max_ksm_entries is 0 which will skip - mapping header pages via WQE UMR. This breaks header-data split - and will result in the following syndrome: - - mlx5_core 0000:00:08.0 eth2: Error cqe on cqn 0x4c9, ci 0x0, qn 0x1133, opcode 0xe, syndrome 0x4, vendor syndrome 0x32 - 00000000: 00 00 00 00 04 4a 00 00 00 00 00 00 20 00 93 32 - 00000010: 55 00 00 00 fb cc 00 00 00 00 00 00 07 18 00 00 - 00000020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4a - 00000030: 00 00 3b c7 93 01 32 04 00 00 00 00 00 00 bf e0 - mlx5_core 0000:00:08.0 eth2: ERR CQE on RQ: 0x1133 - - Furthermore, the function that fills in WQE UMRs for the headers - (mlx5e_build_shampo_hd_umr()) only supports mapping page sizes that - fit in a single UMR WQE. - - This patch goes back to the old non-aligned max_ksm_entries value and it - changes mlx5e_build_shampo_hd_umr() to support mapping a large page over - multiple UMR WQEs. - - This means that mlx5e_build_shampo_hd_umr() can now leave a page only - partially mapped. The caller, mlx5e_alloc_rx_hd_mpwqe(), ensures that - there are enough UMR WQEs to cover complete pages by working on - ksm_entries that are multiples of MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. - - Fixes: 8a0ee54027b1 ("net/mlx5e: SHAMPO, Simplify UMR allocation for headers") - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1762238915-1027590-2-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 0afdc68896c3..6b3393895792 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -670,7 +670,7 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - u16 pi, header_offset, err, wqe_bbs; - u32 lkey = rq->mdev->mlx5e_res.hw_objs.mkey; - struct mlx5e_umr_wqe *umr_wqe; -- int headroom, i = 0; -+ int headroom, i; - - headroom = rq->buff.headroom; - wqe_bbs = MLX5E_KSM_UMR_WQEBBS(ksm_entries); -@@ -678,25 +678,24 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - umr_wqe = mlx5_wq_cyc_get_wqe(&sq->wq, pi); - build_ksm_umr(sq, umr_wqe, shampo->mkey_be, index, ksm_entries); - -- WARN_ON_ONCE(ksm_entries & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)); -- while (i < ksm_entries) { -- struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); -+ for (i = 0; i < ksm_entries; i++, index++) { -+ struct mlx5e_frag_page *frag_page; - u64 addr; - -- err = mlx5e_page_alloc_fragmented(rq->hd_page_pool, frag_page); -- if (unlikely(err)) -- goto err_unmap; -+ frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); -+ header_offset = mlx5e_shampo_hd_offset(index); -+ if (!header_offset) { -+ err = mlx5e_page_alloc_fragmented(rq->hd_page_pool, -+ frag_page); -+ if (err) -+ goto err_unmap; -+ } - - addr = page_pool_get_dma_addr(frag_page->page); -- -- for (int j = 0; j < MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; j++) { -- header_offset = mlx5e_shampo_hd_offset(index++); -- -- umr_wqe->inline_ksms[i++] = (struct mlx5_ksm) { -- .key = cpu_to_be32(lkey), -- .va = cpu_to_be64(addr + header_offset + headroom), -- }; -- } -+ umr_wqe->inline_ksms[i] = (struct mlx5_ksm) { -+ .key = cpu_to_be32(lkey), -+ .va = cpu_to_be64(addr + header_offset + headroom), -+ }; - } - - sq->db.wqe_info[pi] = (struct mlx5e_icosq_wqe_info) { -@@ -712,7 +711,7 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - return 0; - - err_unmap: -- while (--i) { -+ while (--i >= 0) { - --index; - header_offset = mlx5e_shampo_hd_offset(index); - if (!header_offset) { -@@ -734,8 +733,7 @@ static int mlx5e_alloc_rx_hd_mpwqe(struct mlx5e_rq *rq) - struct mlx5e_icosq *sq = rq->icosq; - int i, err, max_ksm_entries, len; - -- max_ksm_entries = ALIGN_DOWN(MLX5E_MAX_KSM_PER_WQE(rq->mdev), -- MLX5E_SHAMPO_WQ_HEADER_PER_PAGE); -+ max_ksm_entries = MLX5E_MAX_KSM_PER_WQE(rq->mdev); - ksm_entries = bitmap_find_window(shampo->bitmap, - shampo->hd_per_wqe, - shampo->hd_per_wq, shampo->pi); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1671-net-mlx5e-shampo-fix-skb-size-check-for-64k-pages.patch b/SOURCES/1671-net-mlx5e-shampo-fix-skb-size-check-for-64k-pages.patch deleted file mode 100644 index 62874a1a4..000000000 --- a/SOURCES/1671-net-mlx5e-shampo-fix-skb-size-check-for-64k-pages.patch +++ /dev/null @@ -1,58 +0,0 @@ -From c7a4dd865f4a385b4b6d96b210bcb651876f7681 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 21 Apr 2026 14:56:09 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO, Fix skb size check for 64K pages - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit bacd8d80181ebe34b599a39aa26bf73a44c91e55 -Author: Dragos Tatulea -Date: Tue Nov 4 08:48:34 2025 +0200 - - net/mlx5e: SHAMPO, Fix skb size check for 64K pages - - mlx5e_hw_gro_skb_has_enough_space() uses a formula to check if there is - enough space in the skb frags to store more data. This formula is - incorrect for 64K page sizes and it triggers early GRO session - termination because the first fragment will blow up beyond - GRO_LEGACY_MAX_SIZE. - - This patch adds a special case for page sizes >= GRO_LEGACY_MAX_SIZE - (64K) which uses the skb->len instead. Within this context, - the check is safe from fragment overflow because the hardware - will continuously fill the data up to the reservation size of 64K - and the driver will coalesce all data from the same page to the same - fragment. This means that the data will span one fragment or at most - two for such a large page size. - - It is expected that the if statement will be optimized out as the - check is done with constants. - - Fixes: 92552d3abd32 ("net/mlx5e: HW_GRO cqe handler implementation") - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1762238915-1027590-3-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 6b3393895792..cbb6596a65c0 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -2322,7 +2322,10 @@ mlx5e_hw_gro_skb_has_enough_space(struct sk_buff *skb, u16 data_bcnt) - { - int nr_frags = skb_shinfo(skb)->nr_frags; - -- return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE; -+ if (PAGE_SIZE >= GRO_LEGACY_MAX_SIZE) -+ return skb->len + data_bcnt <= GRO_LEGACY_MAX_SIZE; -+ else -+ return PAGE_SIZE * nr_frags + data_bcnt <= GRO_LEGACY_MAX_SIZE; - } - - static void mlx5e_handle_rx_cqe_mpwrq_shampo(struct mlx5e_rq *rq, struct mlx5_cqe64 *cqe) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1672-net-mlx5e-shampo-fix-header-formulas-for-higher-mtus-and-64k.patch b/SOURCES/1672-net-mlx5e-shampo-fix-header-formulas-for-higher-mtus-and-64k.patch deleted file mode 100644 index fde4db191..000000000 --- a/SOURCES/1672-net-mlx5e-shampo-fix-header-formulas-for-higher-mtus-and-64k.patch +++ /dev/null @@ -1,212 +0,0 @@ -From 29457aaef82f67cb25ec966a91a6ccf70934a4b7 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Tue, 21 Apr 2026 15:08:34 -0400 -Subject: [PATCH] net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and - 64K pages - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Adjust this change due to the missing of the following commit: -d1668f119943 ("net/mlx5e: Convert over to netmem") - -commit d8a7ed9586c7579a99e9e2d90988c9eceeee61ff -Author: Dragos Tatulea -Date: Tue Nov 4 08:48:35 2025 +0200 - - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages - - The MLX5E_SHAMPO_WQ_HEADER_PER_PAGE and - MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE macros are used directly in - several places under the assumption that there will always be more - headers per WQE than headers per page. However, this assumption doesn't - hold for 64K page sizes and higher MTUs (> 4K). This can be first - observed during header page allocation: ksm_entries will become 0 during - alignment to MLX5E_SHAMPO_WQ_HEADER_PER_PAGE. - - This patch introduces 2 additional members to the mlx5e_shampo_hd struct - which are meant to be used instead of the macrose mentioned above. - When the number of headers per WQE goes below - MLX5E_SHAMPO_WQ_HEADER_PER_PAGE, clamp the number of headers per - page and expand the header size accordingly so that the headers - for one WQE cover a full page. - - All the formulas are adapted to use these two new members. - - Fixes: 945ca432bfd0 ("net/mlx5e: SHAMPO, Drop info array") - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Simon Horman - Link: https://patch.msgid.link/1762238915-1027590-4-git-send-email-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h -index 32224bd1a0e7..041c986f7065 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en.h -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h -@@ -634,7 +634,10 @@ struct mlx5e_dma_info { - struct mlx5e_shampo_hd { - struct mlx5e_frag_page *pages; - u32 hd_per_wq; -+ u32 hd_per_page; - u16 hd_per_wqe; -+ u8 log_hd_per_page; -+ u8 log_hd_entry_size; - unsigned long *bitmap; - u16 pi; - u16 ci; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -index af067ff1ebcf..47416e54379a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c -@@ -795,8 +795,9 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - int node) - { - void *wqc = MLX5_ADDR_OF(rqc, rqp->rqc, wq); -+ u8 log_hd_per_page, log_hd_entry_size; -+ u16 hd_per_wq, hd_per_wqe; - u32 hd_pool_size; -- u16 hd_per_wq; - int wq_size; - int err; - -@@ -819,11 +820,24 @@ static int mlx5_rq_shampo_alloc(struct mlx5_core_dev *mdev, - if (err) - goto err_umr_mkey; - -- rq->mpwqe.shampo->hd_per_wqe = -- mlx5e_shampo_hd_per_wqe(mdev, params, rqp); -+ hd_per_wqe = mlx5e_shampo_hd_per_wqe(mdev, params, rqp); - wq_size = BIT(MLX5_GET(wq, wqc, log_wq_sz)); -- hd_pool_size = (rq->mpwqe.shampo->hd_per_wqe * wq_size) / -- MLX5E_SHAMPO_WQ_HEADER_PER_PAGE; -+ -+ BUILD_BUG_ON(MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE > PAGE_SHIFT); -+ if (hd_per_wqe >= MLX5E_SHAMPO_WQ_HEADER_PER_PAGE) { -+ log_hd_per_page = MLX5E_SHAMPO_LOG_WQ_HEADER_PER_PAGE; -+ log_hd_entry_size = MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE; -+ } else { -+ log_hd_per_page = order_base_2(hd_per_wqe); -+ log_hd_entry_size = order_base_2(PAGE_SIZE / hd_per_wqe); -+ } -+ -+ rq->mpwqe.shampo->hd_per_wqe = hd_per_wqe; -+ rq->mpwqe.shampo->hd_per_page = BIT(log_hd_per_page); -+ rq->mpwqe.shampo->log_hd_per_page = log_hd_per_page; -+ rq->mpwqe.shampo->log_hd_entry_size = log_hd_entry_size; -+ -+ hd_pool_size = (hd_per_wqe * wq_size) >> log_hd_per_page; - - if (mlx5_rq_needs_separate_hd_pool(rq)) { - /* Separate page pool for shampo headers */ -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index cbb6596a65c0..8b51369500f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -647,17 +647,20 @@ static void build_ksm_umr(struct mlx5e_icosq *sq, struct mlx5e_umr_wqe *umr_wqe, - umr_wqe->hdr.uctrl.mkey_mask = cpu_to_be64(MLX5_MKEY_MASK_FREE); - } - --static struct mlx5e_frag_page *mlx5e_shampo_hd_to_frag_page(struct mlx5e_rq *rq, int header_index) -+static struct mlx5e_frag_page *mlx5e_shampo_hd_to_frag_page(struct mlx5e_rq *rq, -+ int header_index) - { -- BUILD_BUG_ON(MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE > PAGE_SHIFT); -+ struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; - -- return &rq->mpwqe.shampo->pages[header_index >> MLX5E_SHAMPO_LOG_WQ_HEADER_PER_PAGE]; -+ return &shampo->pages[header_index >> shampo->log_hd_per_page]; - } - --static u64 mlx5e_shampo_hd_offset(int header_index) -+static u64 mlx5e_shampo_hd_offset(struct mlx5e_rq *rq, int header_index) - { -- return (header_index & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)) << -- MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE; -+ struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; -+ u32 hd_per_page = shampo->hd_per_page; -+ -+ return (header_index & (hd_per_page - 1)) << shampo->log_hd_entry_size; - } - - static void mlx5e_free_rx_shampo_hd_entry(struct mlx5e_rq *rq, u16 header_index); -@@ -683,7 +686,7 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - u64 addr; - - frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); -- header_offset = mlx5e_shampo_hd_offset(index); -+ header_offset = mlx5e_shampo_hd_offset(rq, index); - if (!header_offset) { - err = mlx5e_page_alloc_fragmented(rq->hd_page_pool, - frag_page); -@@ -713,7 +716,7 @@ static int mlx5e_build_shampo_hd_umr(struct mlx5e_rq *rq, - err_unmap: - while (--i >= 0) { - --index; -- header_offset = mlx5e_shampo_hd_offset(index); -+ header_offset = mlx5e_shampo_hd_offset(rq, index); - if (!header_offset) { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, index); - -@@ -737,7 +740,7 @@ static int mlx5e_alloc_rx_hd_mpwqe(struct mlx5e_rq *rq) - ksm_entries = bitmap_find_window(shampo->bitmap, - shampo->hd_per_wqe, - shampo->hd_per_wq, shampo->pi); -- ksm_entries = ALIGN_DOWN(ksm_entries, MLX5E_SHAMPO_WQ_HEADER_PER_PAGE); -+ ksm_entries = ALIGN_DOWN(ksm_entries, shampo->hd_per_page); - if (!ksm_entries) - return 0; - -@@ -854,7 +857,7 @@ mlx5e_free_rx_shampo_hd_entry(struct mlx5e_rq *rq, u16 header_index) - { - struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; - -- if (((header_index + 1) & (MLX5E_SHAMPO_WQ_HEADER_PER_PAGE - 1)) == 0) { -+ if (((header_index + 1) & (shampo->hd_per_page - 1)) == 0) { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, header_index); - - mlx5e_page_release_fragmented(rq->hd_page_pool, frag_page); -@@ -1217,9 +1220,10 @@ static unsigned int mlx5e_lro_update_hdr(struct sk_buff *skb, - static void *mlx5e_shampo_get_packet_hd(struct mlx5e_rq *rq, u16 header_index) - { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, header_index); -- u16 head_offset = mlx5e_shampo_hd_offset(header_index) + rq->buff.headroom; -+ u16 head_offset = mlx5e_shampo_hd_offset(rq, header_index); -+ void *addr = page_address(frag_page->page); - -- return page_address(frag_page->page) + head_offset; -+ return addr + head_offset + rq->buff.headroom; - } - - static void mlx5e_shampo_update_ipv4_udp_hdr(struct mlx5e_rq *rq, struct iphdr *ipv4) -@@ -2236,20 +2240,22 @@ mlx5e_skb_from_cqe_shampo(struct mlx5e_rq *rq, struct mlx5e_mpw_info *wi, - struct mlx5_cqe64 *cqe, u16 header_index) - { - struct mlx5e_frag_page *frag_page = mlx5e_shampo_hd_to_frag_page(rq, header_index); -- dma_addr_t page_dma_addr = page_pool_get_dma_addr(frag_page->page); -- u16 head_offset = mlx5e_shampo_hd_offset(header_index); -- dma_addr_t dma_addr = page_dma_addr + head_offset; -+ u16 head_offset = mlx5e_shampo_hd_offset(rq, header_index); -+ struct mlx5e_shampo_hd *shampo = rq->mpwqe.shampo; - u16 head_size = cqe->shampo.header_size; - u16 rx_headroom = rq->buff.headroom; - struct sk_buff *skb = NULL; - void *hdr, *data; - u32 frag_size; - -+ dma_addr_t page_dma_addr = page_pool_get_dma_addr(frag_page->page); -+ dma_addr_t dma_addr = page_dma_addr + head_offset; - hdr = page_address(frag_page->page) + head_offset; -+ - data = hdr + rx_headroom; - frag_size = MLX5_SKB_FRAG_SZ(rx_headroom + head_size); - -- if (likely(frag_size <= BIT(MLX5E_SHAMPO_LOG_MAX_HEADER_ENTRY_SIZE))) { -+ if (likely(frag_size <= BIT(shampo->log_hd_entry_size))) { - /* build SKB around header */ - dma_sync_single_range_for_cpu(rq->pdev, dma_addr, 0, frag_size, rq->buff.map_dir); - net_prefetchw(hdr); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1673-net-mlx5-qos-restrict-rtnl-area-to-avoid-a-lock-cycle.patch b/SOURCES/1673-net-mlx5-qos-restrict-rtnl-area-to-avoid-a-lock-cycle.patch deleted file mode 100644 index bbb820ffb..000000000 --- a/SOURCES/1673-net-mlx5-qos-restrict-rtnl-area-to-avoid-a-lock-cycle.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 6713dff9bbe1695af06964814ed721f140ed1d89 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:44:51 -0400 -Subject: [PATCH] net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit b7e3a5d9c0d66b7fb44f63aef3bd734821afa0c8 -Author: Cosmin Ratiu -Date: Mon Mar 16 11:46:01 2026 +0200 - - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle - - A lock dependency cycle exists where: - 1. mlx5_ib_roce_init -> mlx5_core_uplink_netdev_event_replay -> - mlx5_blocking_notifier_call_chain (takes notifier_rwsem) -> - mlx5e_mdev_notifier_event -> mlx5_netdev_notifier_register -> - register_netdevice_notifier_dev_net (takes rtnl) - => notifier_rwsem -> rtnl - - 2. mlx5e_probe -> _mlx5e_probe -> - mlx5_core_uplink_netdev_set (takes uplink_netdev_lock) -> - mlx5_blocking_notifier_call_chain (takes notifier_rwsem) - => uplink_netdev_lock -> notifier_rwsem - - 3: devlink_nl_rate_set_doit -> devlink_nl_rate_set -> - mlx5_esw_devlink_rate_leaf_tx_max_set -> esw_qos_devlink_rate_to_mbps -> - mlx5_esw_qos_max_link_speed_get (takes rtnl) -> - mlx5_esw_qos_lag_link_speed_get_locked -> - mlx5_uplink_netdev_get (takes uplink_netdev_lock) - => rtnl -> uplink_netdev_lock - => BOOM! (lock cycle) - - Fix that by restricting the rtnl-protected section to just the necessary - part, the call to netdev_master_upper_dev_get and speed querying, so - that the last lock dependency is avoided and the cycle doesn't close. - This is safe because mlx5_uplink_netdev_get uses netdev_hold to keep the - uplink netdev alive while its master device is queried. - - Use this opportunity to rename the ambiguously-named "hold_rtnl_lock" - argument to "take_rtnl" and remove the "_locked" suffix from - mlx5_esw_qos_lag_link_speed_get_locked. - - Fixes: 6b4be64fd9fe ("net/mlx5e: Harden uplink netdev access against device unbind") - Signed-off-by: Cosmin Ratiu - Reviewed-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/20260316094603.6999-2-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -index 4278bcb04c72..2e11574b3a81 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/esw/qos.c -@@ -1490,24 +1490,24 @@ static int esw_qos_node_enable_tc_arbitration(struct mlx5_esw_sched_node *node, - return err; - } - --static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) -+static u32 mlx5_esw_qos_lag_link_speed_get(struct mlx5_core_dev *mdev, -+ bool take_rtnl) - { - struct ethtool_link_ksettings lksettings; - struct net_device *slave, *master; - u32 speed = SPEED_UNKNOWN; - -- /* Lock ensures a stable reference to master and slave netdevice -- * while port speed of master is queried. -- */ -- ASSERT_RTNL(); -- - slave = mlx5_uplink_netdev_get(mdev); - if (!slave) - goto out; - -+ if (take_rtnl) -+ rtnl_lock(); - master = netdev_master_upper_dev_get(slave); - if (master && !__ethtool_get_link_ksettings(master, &lksettings)) - speed = lksettings.base.speed; -+ if (take_rtnl) -+ rtnl_unlock(); - - out: - mlx5_uplink_netdev_put(mdev, slave); -@@ -1515,20 +1515,15 @@ static u32 mlx5_esw_qos_lag_link_speed_get_locked(struct mlx5_core_dev *mdev) - } - - static int mlx5_esw_qos_max_link_speed_get(struct mlx5_core_dev *mdev, u32 *link_speed_max, -- bool hold_rtnl_lock, struct netlink_ext_ack *extack) -+ bool take_rtnl, -+ struct netlink_ext_ack *extack) - { - int err; - - if (!mlx5_lag_is_active(mdev)) - goto skip_lag; - -- if (hold_rtnl_lock) -- rtnl_lock(); -- -- *link_speed_max = mlx5_esw_qos_lag_link_speed_get_locked(mdev); -- -- if (hold_rtnl_lock) -- rtnl_unlock(); -+ *link_speed_max = mlx5_esw_qos_lag_link_speed_get(mdev, take_rtnl); - - if (*link_speed_max != (u32)SPEED_UNKNOWN) - return 0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1674-net-mlx5-fix-peer-miss-rules-host-disabled-checks.patch b/SOURCES/1674-net-mlx5-fix-peer-miss-rules-host-disabled-checks.patch deleted file mode 100644 index 3e65011e2..000000000 --- a/SOURCES/1674-net-mlx5-fix-peer-miss-rules-host-disabled-checks.patch +++ /dev/null @@ -1,79 +0,0 @@ -From 5877220f3a935e925a70599a157196b5264e8c36 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:44:58 -0400 -Subject: [PATCH] net/mlx5: Fix peer miss rules host disabled checks - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 76324e4041c0efb4808702b05426d7a0a7d8df5b -Author: Carolina Jubran -Date: Thu Mar 5 16:26:31 2026 +0200 - - net/mlx5: Fix peer miss rules host disabled checks - - The check on mlx5_esw_host_functions_enabled(esw->dev) for adding VF - peer miss rules is incorrect. These rules match traffic from peer's VFs, - so the local device's host function status is irrelevant. Remove this - check to ensure peer VF traffic is properly handled regardless of local - host configuration. - - Also fix the PF peer miss rule deletion to be symmetric with the add - path, so only attempt to delete the rule if it was actually created. - - Fixes: 520369ef43a8 ("net/mlx5: Support disabling host PFs") - Signed-off-by: Carolina Jubran - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/20260305142634.1813208-3-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -index 30bf164a067f..3af2a51ace6a 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c -@@ -1241,21 +1241,17 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - flows[peer_vport->index] = flow; - } - -- if (mlx5_esw_host_functions_enabled(esw->dev)) { -- mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -- mlx5_core_max_vfs(peer_dev)) { -- esw_set_peer_miss_rule_source_port(esw, peer_esw, -- spec, -- peer_vport->vport); -- -- flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), -- spec, &flow_act, &dest, 1); -- if (IS_ERR(flow)) { -- err = PTR_ERR(flow); -- goto add_vf_flow_err; -- } -- flows[peer_vport->index] = flow; -+ mlx5_esw_for_each_vf_vport(peer_esw, i, peer_vport, -+ mlx5_core_max_vfs(peer_dev)) { -+ esw_set_peer_miss_rule_source_port(esw, peer_esw, spec, -+ peer_vport->vport); -+ flow = mlx5_add_flow_rules(mlx5_eswitch_get_slow_fdb(esw), -+ spec, &flow_act, &dest, 1); -+ if (IS_ERR(flow)) { -+ err = PTR_ERR(flow); -+ goto add_vf_flow_err; - } -+ flows[peer_vport->index] = flow; - } - - if (mlx5_core_ec_sriov_enabled(peer_dev)) { -@@ -1347,7 +1343,8 @@ static void esw_del_fdb_peer_miss_rules(struct mlx5_eswitch *esw, - mlx5_del_flow_rules(flows[peer_vport->index]); - } - -- if (mlx5_core_is_ecpf_esw_manager(peer_dev)) { -+ if (mlx5_core_is_ecpf_esw_manager(peer_dev) && -+ mlx5_esw_host_functions_enabled(peer_dev)) { - peer_vport = mlx5_eswitch_get_vport(peer_esw, MLX5_VPORT_PF); - mlx5_del_flow_rules(flows[peer_vport->index]); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1675-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-legacy-rq.patch b/SOURCES/1675-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-legacy-rq.patch deleted file mode 100644 index 4e9d045fb..000000000 --- a/SOURCES/1675-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-legacy-rq.patch +++ /dev/null @@ -1,132 +0,0 @@ -From 2dd1bc5b18f3cf2e65f322d22fa558e93418bed0 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:52:13 -0400 -Subject: [PATCH] net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to the missing of the following commit: -1827f773e416 ("net: xdp: pass full flags to xdp_update_skb_shared_info()") - -commit a6413e6f6c9d9bb9833324cb3753582f7bc0f2fa -Author: Dragos Tatulea -Date: Thu Mar 5 16:26:34 2026 +0200 - - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ - - XDP multi-buf programs can modify the layout of the XDP buffer when the - program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The - referenced commit in the fixes tag corrected the assumption in the mlx5 - driver that the XDP buffer layout doesn't change during a program - execution. However, this fix introduced another issue: the dropped - fragments still need to be counted on the driver side to avoid page - fragment reference counting issues. - - Such issue can be observed with the - test_xdp_native_adjst_tail_shrnk_data selftest when using a payload of - 3600 and shrinking by 256 bytes (an upcoming selftest patch): the last - fragment gets released by the XDP code but doesn't get tracked by the - driver. This results in a negative pp_ref_count during page release and - the following splat: - - WARNING: include/net/page_pool/helpers.h:297 at mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core], CPU#12: ip/3137 - Modules linked in: [...] - CPU: 12 UID: 0 PID: 3137 Comm: ip Not tainted 6.19.0-rc3+ #12 NONE - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 - RIP: 0010:mlx5e_page_release_fragmented.isra.0+0x4a/0x50 [mlx5_core] - [...] - Call Trace: - - mlx5e_dealloc_rx_wqe+0xcb/0x1a0 [mlx5_core] - mlx5e_free_rx_descs+0x7f/0x110 [mlx5_core] - mlx5e_close_rq+0x50/0x60 [mlx5_core] - mlx5e_close_queues+0x36/0x2c0 [mlx5_core] - mlx5e_close_channel+0x1c/0x50 [mlx5_core] - mlx5e_close_channels+0x45/0x80 [mlx5_core] - mlx5e_safe_switch_params+0x1a5/0x230 [mlx5_core] - mlx5e_change_mtu+0xf3/0x2f0 [mlx5_core] - netif_set_mtu_ext+0xf1/0x230 - do_setlink.isra.0+0x219/0x1180 - rtnl_newlink+0x79f/0xb60 - rtnetlink_rcv_msg+0x213/0x3a0 - netlink_rcv_skb+0x48/0xf0 - netlink_unicast+0x24a/0x350 - netlink_sendmsg+0x1ee/0x410 - __sock_sendmsg+0x38/0x60 - ____sys_sendmsg+0x232/0x280 - ___sys_sendmsg+0x78/0xb0 - __sys_sendmsg+0x5f/0xb0 - [...] - do_syscall_64+0x57/0xc50 - - This patch fixes the issue by doing page frag counting on all the - original XDP buffer fragments for all relevant XDP actions (XDP_TX , - XDP_REDIRECT and XDP_PASS). This is basically reverting to the original - counting before the commit in the fixes tag. - - As frag_page is still pointing to the original tail, the nr_frags - parameter to xdp_update_skb_frags_info() needs to be calculated - in a different way to reflect the new nr_frags. - - Fixes: afd5ba577c10 ("net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ") - Signed-off-by: Dragos Tatulea - Signed-off-by: Tariq Toukan - Reviewed-by: Amery Hung - Link: https://patch.msgid.link/20260305142634.1813208-6-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index 8b51369500f9..ae2bc2275c14 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -1733,6 +1733,7 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - struct skb_shared_info *sinfo; - u32 frag_consumed_bytes; - struct bpf_prog *prog; -+ u8 nr_frags_free = 0; - struct sk_buff *skb; - dma_addr_t addr; - u32 truesize; -@@ -1775,15 +1776,13 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - - prog = rcu_dereference(rq->xdp_prog); - if (prog) { -- u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ u8 old_nr_frags = sinfo->nr_frags; - - if (mlx5e_xdp_handle(rq, prog, mxbuf)) { - if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, - rq->flags)) { - struct mlx5e_wqe_frag_info *pwi; - -- wi -= old_nr_frags - sinfo->nr_frags; -- - for (pwi = head_wi; pwi < wi; pwi++) - pwi->frag_page->frags++; - } -@@ -1791,10 +1790,8 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - } - - nr_frags_free = old_nr_frags - sinfo->nr_frags; -- if (unlikely(nr_frags_free)) { -- wi -= nr_frags_free; -+ if (unlikely(nr_frags_free)) - truesize -= nr_frags_free * frag_info->frag_stride; -- } - } - - skb = mlx5e_build_linear_skb( -@@ -1810,7 +1807,7 @@ mlx5e_skb_from_cqe_nonlinear(struct mlx5e_rq *rq, struct mlx5e_wqe_frag_info *wi - - if (xdp_buff_has_frags(&mxbuf->xdp)) { - /* sinfo->nr_frags is reset by build_skb, calculate again. */ -- xdp_update_skb_shared_info(skb, wi - head_wi - 1, -+ xdp_update_skb_shared_info(skb, wi - head_wi - nr_frags_free - 1, - sinfo->xdp_frags_size, truesize, - xdp_buff_is_frag_pfmemalloc( - &mxbuf->xdp)); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1676-net-mlx5-fix-crash-when-moving-to-switchdev-mode.patch b/SOURCES/1676-net-mlx5-fix-crash-when-moving-to-switchdev-mode.patch deleted file mode 100644 index 7c547cbb8..000000000 --- a/SOURCES/1676-net-mlx5-fix-crash-when-moving-to-switchdev-mode.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 0dc330615eafebf537f5880633e3d2d40bd67b54 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:53:11 -0400 -Subject: [PATCH] net/mlx5: Fix crash when moving to switchdev mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit 24b2795f9683e092dc22a68f487e7aaaf2ddafea -Author: Patrisious Haddad -Date: Thu Mar 5 16:26:30 2026 +0200 - - net/mlx5: Fix crash when moving to switchdev mode - - When moving to switchdev mode when the device doesn't support IPsec, - we try to clean up the IPsec resources anyway which causes the crash - below, fix that by correctly checking for IPsec support before trying - to clean up its resources. - - [27642.515799] WARNING: arch/x86/mm/fault.c:1276 at - do_user_addr_fault+0x18a/0x680, CPU#4: devlink/6490 - [27642.517159] Modules linked in: xt_conntrack xt_MASQUERADE - ip6table_nat ip6table_filter ip6_tables iptable_nat nf_nat xt_addrtype - rpcsec_gss_krb5 auth_rpcgss oid_registry overlay mlx5_fwctl nfnetlink - zram zsmalloc mlx5_ib fuse rpcrdma rdma_ucm ib_uverbs ib_iser libiscsi - scsi_transport_iscsi ib_umad rdma_cm ib_ipoib iw_cm ib_cm mlx5_core - ib_core - [27642.521358] CPU: 4 UID: 0 PID: 6490 Comm: devlink Not tainted - 6.19.0-rc5_for_upstream_min_debug_2026_01_14_16_47 #1 NONE - [27642.522923] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS - rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014 - [27642.524528] RIP: 0010:do_user_addr_fault+0x18a/0x680 - [27642.525362] Code: ff 0f 84 75 03 00 00 48 89 ee 4c 89 e7 e8 5e b9 22 - 00 49 89 c0 48 85 c0 0f 84 a8 02 00 00 f7 c3 60 80 00 00 74 22 31 c9 eb - ae <0f> 0b 48 83 c4 10 48 89 ea 48 89 de 4c 89 f7 5b 5d 41 5c 41 5d - 41 - [27642.528166] RSP: 0018:ffff88810770f6b8 EFLAGS: 00010046 - [27642.529038] RAX: 0000000000000000 RBX: 0000000000000002 RCX: - ffff88810b980f00 - [27642.530158] RDX: 00000000000000a0 RSI: 0000000000000002 RDI: - ffff88810770f728 - [27642.531270] RBP: 00000000000000a0 R08: 0000000000000000 R09: - 0000000000000000 - [27642.532383] R10: 0000000000000000 R11: 0000000000000000 R12: - ffff888103f3c4c0 - [27642.533499] R13: 0000000000000000 R14: ffff88810770f728 R15: - 0000000000000000 - [27642.534614] FS: 00007f197c741740(0000) GS:ffff88856a94c000(0000) - knlGS:0000000000000000 - [27642.535915] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 - [27642.536858] CR2: 00000000000000a0 CR3: 000000011334c003 CR4: - 0000000000172eb0 - [27642.537982] Call Trace: - [27642.538466] - [27642.538907] exc_page_fault+0x76/0x140 - [27642.539583] asm_exc_page_fault+0x22/0x30 - [27642.540282] RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30 - [27642.541134] Code: 07 85 c0 75 11 ba ff 00 00 00 f0 0f b1 17 75 06 b8 - 01 00 00 00 c3 31 c0 c3 90 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 - 00 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 7e 02 00 00 48 89 d8 - 5b - [27642.543936] RSP: 0018:ffff88810770f7d8 EFLAGS: 00010046 - [27642.544803] RAX: 0000000000000000 RBX: 0000000000000202 RCX: - ffff888113ad96d8 - [27642.545916] RDX: 0000000000000001 RSI: ffff88810770f818 RDI: - 00000000000000a0 - [27642.547027] RBP: 0000000000000098 R08: 0000000000000400 R09: - ffff88810b980f00 - [27642.548140] R10: 0000000000000001 R11: ffff888101845a80 R12: - 00000000000000a8 - [27642.549263] R13: ffffffffa02a9060 R14: 00000000000000a0 R15: - ffff8881130d8a40 - [27642.550379] complete_all+0x20/0x90 - [27642.551010] mlx5e_ipsec_disable_events+0xb6/0xf0 [mlx5_core] - [27642.552022] mlx5e_nic_disable+0x12d/0x220 [mlx5_core] - [27642.552929] mlx5e_detach_netdev+0x66/0xf0 [mlx5_core] - [27642.553822] mlx5e_netdev_change_profile+0x5b/0x120 [mlx5_core] - [27642.554821] mlx5e_vport_rep_load+0x419/0x590 [mlx5_core] - [27642.555757] ? xa_load+0x53/0x90 - [27642.556361] __esw_offloads_load_rep+0x54/0x70 [mlx5_core] - [27642.557328] mlx5_esw_offloads_rep_load+0x45/0xd0 [mlx5_core] - [27642.558320] esw_offloads_enable+0xb4b/0xc90 [mlx5_core] - [27642.559247] mlx5_eswitch_enable_locked+0x34e/0x4f0 [mlx5_core] - [27642.560257] ? mlx5_rescan_drivers_locked+0x222/0x2d0 [mlx5_core] - [27642.561284] mlx5_devlink_eswitch_mode_set+0x5ac/0x9c0 [mlx5_core] - [27642.562334] ? devlink_rate_set_ops_supported+0x21/0x3a0 - [27642.563220] devlink_nl_eswitch_set_doit+0x67/0xe0 - [27642.564026] genl_family_rcv_msg_doit+0xe0/0x130 - [27642.564816] genl_rcv_msg+0x183/0x290 - [27642.565466] ? __devlink_nl_pre_doit.isra.0+0x160/0x160 - [27642.566329] ? devlink_nl_eswitch_get_doit+0x290/0x290 - [27642.567181] ? devlink_nl_pre_doit_parent_dev_optional+0x20/0x20 - [27642.568147] ? genl_family_rcv_msg_dumpit+0xf0/0xf0 - [27642.568966] netlink_rcv_skb+0x4b/0xf0 - [27642.569629] genl_rcv+0x24/0x40 - [27642.570215] netlink_unicast+0x255/0x380 - [27642.570901] ? __alloc_skb+0xfa/0x1e0 - [27642.571560] netlink_sendmsg+0x1f3/0x420 - [27642.572249] __sock_sendmsg+0x38/0x60 - [27642.572911] __sys_sendto+0x119/0x180 - [27642.573561] ? __sys_recvmsg+0x5c/0xb0 - [27642.574227] __x64_sys_sendto+0x20/0x30 - [27642.574904] do_syscall_64+0x55/0xc10 - [27642.575554] entry_SYSCALL_64_after_hwframe+0x4b/0x53 - [27642.576391] RIP: 0033:0x7f197c85e807 - [27642.577050] Code: c7 c0 ff ff ff ff eb be 66 2e 0f 1f 84 00 00 00 00 - 00 90 f3 0f 1e fa 80 3d 45 08 0d 00 00 41 89 ca 74 10 b8 2c 00 00 00 0f - 05 <48> 3d 00 f0 ff ff 77 69 c3 55 48 89 e5 53 48 83 ec 38 44 89 4d - d0 - [27642.579846] RSP: 002b:00007ffebd4e2248 EFLAGS: 00000202 ORIG_RAX: - 000000000000002c - [27642.581082] RAX: ffffffffffffffda RBX: 000055cfcd9cd2a0 RCX: - 00007f197c85e807 - [27642.582200] RDX: 0000000000000038 RSI: 000055cfcd9cd490 RDI: - 0000000000000003 - [27642.583320] RBP: 00007ffebd4e2290 R08: 00007f197c942200 R09: - 000000000000000c - [27642.584437] R10: 0000000000000000 R11: 0000000000000202 R12: - 0000000000000000 - [27642.585555] R13: 000055cfcd9cd490 R14: 00007ffebd4e45d1 R15: - 000055cfcd9cd2a0 - [27642.586671] - [27642.587121] ---[ end trace 0000000000000000 ]--- - [27642.587910] BUG: kernel NULL pointer dereference, address: - 00000000000000a0 - - Fixes: 664f76be38a1 ("net/mlx5: Fix IPsec cleanup over MPV device") - Signed-off-by: Patrisious Haddad - Reviewed-by: Leon Romanovsky - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/20260305142634.1813208-2-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -index feef86fff4bf..91cfabc45032 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c -@@ -2912,7 +2912,7 @@ void mlx5e_ipsec_disable_events(struct mlx5e_priv *priv) - goto out; - - peer_priv = mlx5_devcom_get_next_peer_data(priv->devcom, &tmp); -- if (peer_priv) -+ if (peer_priv && peer_priv->ipsec) - complete_all(&peer_priv->ipsec->comp); - - mlx5_devcom_for_each_peer_end(priv->devcom); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1677-net-mlx5-fix-hca-caps-leak-on-notifier-init-failure.patch b/SOURCES/1677-net-mlx5-fix-hca-caps-leak-on-notifier-init-failure.patch deleted file mode 100644 index 2aa74e3cd..000000000 --- a/SOURCES/1677-net-mlx5-fix-hca-caps-leak-on-notifier-init-failure.patch +++ /dev/null @@ -1,55 +0,0 @@ -From cfefb5ef35ad6dd869244d59c0cfaf7caa4f7a93 Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 09:53:23 -0400 -Subject: [PATCH] net/mlx5: Fix HCA caps leak on notifier init failure - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 - -commit d03fc81a57956248383efec99967d0ae627390a8 -Author: Prathamesh Deshpande -Date: Wed Apr 15 01:49:37 2026 +0100 - - net/mlx5: Fix HCA caps leak on notifier init failure - - mlx5_mdev_init() allocates HCA caps via mlx5_hca_caps_alloc() before - calling mlx5_notifiers_init(). If notifier initialization fails, the - error path jumps to err_hca_caps and skips mlx5_hca_caps_free(), leaking - allocated caps. - - Add a dedicated unwind label for notifier-init failure that frees HCA - caps before continuing the existing cleanup sequence. - - Fixes: b6b03097f982 ("net/mlx5: Initialize events outside devlink lock") - Signed-off-by: Prathamesh Deshpande - Reviewed-by: Cosmin Ratiu - Reviewed-by: Tariq Toukan - Link: https://patch.msgid.link/20260415005022.34764-1-prathameshdeshpande7@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 5f6a8eef1982..622bc2c5c6f9 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -1907,7 +1907,7 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) - - err = mlx5_notifiers_init(dev); - if (err) -- goto err_hca_caps; -+ goto err_notifiers_init; - - /* The conjunction of sw_vhca_id with sw_owner_id will be a global - * unique id per function which uses mlx5_core. -@@ -1923,6 +1923,8 @@ int mlx5_mdev_init(struct mlx5_core_dev *dev, int profile_idx) - - return 0; - -+err_notifiers_init: -+ mlx5_hca_caps_free(dev); - err_hca_caps: - mlx5_adev_cleanup(dev); - err_adev_init: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1678-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-striding-rq.patch b/SOURCES/1678-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-striding-rq.patch deleted file mode 100644 index cc3f4987f..000000000 --- a/SOURCES/1678-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-striding-rq.patch +++ /dev/null @@ -1,148 +0,0 @@ -From c493e44776b6a85009b43c2928b2b16658967f9d Mon Sep 17 00:00:00 2001 -From: Kamal Heib -Date: Wed, 22 Apr 2026 10:14:24 -0400 -Subject: [PATCH] net/mlx5e: RX, Fix XDP multi-buf frag counting for striding - RQ - -JIRA: https://redhat.atlassian.net/browse/RHEL-169055 -Conflicts: -Context diff due to the missing of the following commit: -1827f773e416 ("net: xdp: pass full flags to xdp_update_skb_shared_info()") - -commit db25c42c2e1f9c0d136420fff5e5700f7e771a6f -Author: Dragos Tatulea -Date: Thu Mar 5 16:26:33 2026 +0200 - - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ - - XDP multi-buf programs can modify the layout of the XDP buffer when the - program calls bpf_xdp_pull_data() or bpf_xdp_adjust_tail(). The - referenced commit in the fixes tag corrected the assumption in the mlx5 - driver that the XDP buffer layout doesn't change during a program - execution. However, this fix introduced another issue: the dropped - fragments still need to be counted on the driver side to avoid page - fragment reference counting issues. - - The issue was discovered by the drivers/net/xdp.py selftest, - more specifically the test_xdp_native_tx_mb: - - The mlx5 driver allocates a page_pool page and initializes it with - a frag counter of 64 (pp_ref_count=64) and the internal frag counter - to 0. - - The test sends one packet with no payload. - - On RX (mlx5e_skb_from_cqe_mpwrq_nonlinear()), mlx5 configures the XDP - buffer with the packet data starting in the first fragment which is the - page mentioned above. - - The XDP program runs and calls bpf_xdp_pull_data() which moves the - header into the linear part of the XDP buffer. As the packet doesn't - contain more data, the program drops the tail fragment since it no - longer contains any payload (pp_ref_count=63). - - mlx5 device skips counting this fragment. Internal frag counter - remains 0. - - mlx5 releases all 64 fragments of the page but page pp_ref_count is - 63 => negative reference counting error. - - Resulting splat during the test: - - WARNING: CPU: 0 PID: 188225 at ./include/net/page_pool/helpers.h:297 mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] - Modules linked in: [...] - CPU: 0 UID: 0 PID: 188225 Comm: ip Not tainted 6.18.0-rc7_for_upstream_min_debug_2025_12_08_11_44 #1 NONE - Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 - RIP: 0010:mlx5e_page_release_fragmented.isra.0+0xbd/0xe0 [mlx5_core] - [...] - Call Trace: - - mlx5e_free_rx_mpwqe+0x20a/0x250 [mlx5_core] - mlx5e_dealloc_rx_mpwqe+0x37/0xb0 [mlx5_core] - mlx5e_free_rx_descs+0x11a/0x170 [mlx5_core] - mlx5e_close_rq+0x78/0xa0 [mlx5_core] - mlx5e_close_queues+0x46/0x2a0 [mlx5_core] - mlx5e_close_channel+0x24/0x90 [mlx5_core] - mlx5e_close_channels+0x5d/0xf0 [mlx5_core] - mlx5e_safe_switch_params+0x2ec/0x380 [mlx5_core] - mlx5e_change_mtu+0x11d/0x490 [mlx5_core] - mlx5e_change_nic_mtu+0x19/0x30 [mlx5_core] - netif_set_mtu_ext+0xfc/0x240 - do_setlink.isra.0+0x226/0x1100 - rtnl_newlink+0x7a9/0xba0 - rtnetlink_rcv_msg+0x220/0x3c0 - netlink_rcv_skb+0x4b/0xf0 - netlink_unicast+0x255/0x380 - netlink_sendmsg+0x1f3/0x420 - __sock_sendmsg+0x38/0x60 - ____sys_sendmsg+0x1e8/0x240 - ___sys_sendmsg+0x7c/0xb0 - [...] - __sys_sendmsg+0x5f/0xb0 - do_syscall_64+0x55/0xc70 - - The problem applies for XDP_PASS as well which is handled in a different - code path in the driver. - - This patch fixes the issue by doing page frag counting on all the - original XDP buffer fragments for all relevant XDP actions (XDP_TX , - XDP_REDIRECT and XDP_PASS). This is basically reverting to the original - counting before the commit in the fixes tag. - - As frag_page is still pointing to the original tail, the nr_frags - parameter to xdp_update_skb_frags_info() needs to be calculated - in a different way to reflect the new nr_frags. - - Fixes: 87bcef158ac1 ("net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ") - Signed-off-by: Dragos Tatulea - Cc: Amery Hung - Reviewed-by: Nimrod Oren - Signed-off-by: Tariq Toukan - Link: https://patch.msgid.link/20260305142634.1813208-5-tariqt@nvidia.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Kamal Heib - -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index ae2bc2275c14..3c34d8f7367d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -2086,14 +2086,13 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - - if (prog) { - u8 nr_frags_free, old_nr_frags = sinfo->nr_frags; -+ u8 new_nr_frags; - u32 len; - - if (mlx5e_xdp_handle(rq, prog, mxbuf)) { - if (__test_and_clear_bit(MLX5E_RQ_FLAG_XDP_XMIT, rq->flags)) { - struct mlx5e_frag_page *pfp; - -- frag_page -= old_nr_frags - sinfo->nr_frags; -- - for (pfp = head_page; pfp < frag_page; pfp++) - pfp->frags++; - -@@ -2104,13 +2103,12 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - return NULL; /* page/packet was consumed by XDP */ - } - -- nr_frags_free = old_nr_frags - sinfo->nr_frags; -- if (unlikely(nr_frags_free)) { -- frag_page -= nr_frags_free; -+ new_nr_frags = sinfo->nr_frags; -+ nr_frags_free = old_nr_frags - new_nr_frags; -+ if (unlikely(nr_frags_free)) - truesize -= (nr_frags_free - 1) * PAGE_SIZE + - ALIGN(pg_consumed_bytes, - BIT(rq->mpwqe.log_stride_sz)); -- } - - len = mxbuf->xdp.data_end - mxbuf->xdp.data; - -@@ -2132,7 +2130,7 @@ mlx5e_skb_from_cqe_mpwrq_nonlinear(struct mlx5e_rq *rq, struct mlx5e_mpw_info *w - struct mlx5e_frag_page *pagep; - - /* sinfo->nr_frags is reset by build_skb, calculate again. */ -- xdp_update_skb_shared_info(skb, frag_page - head_page, -+ xdp_update_skb_shared_info(skb, new_nr_frags, - sinfo->xdp_frags_size, truesize, - xdp_buff_is_frag_pfmemalloc( - &mxbuf->xdp)); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1679-iavf-fix-vlan-filter-lost-on-add-delete-race.patch b/SOURCES/1679-iavf-fix-vlan-filter-lost-on-add-delete-race.patch deleted file mode 100644 index f3f0de334..000000000 --- a/SOURCES/1679-iavf-fix-vlan-filter-lost-on-add-delete-race.patch +++ /dev/null @@ -1,72 +0,0 @@ -From 78e72af8acdf612a08878849b70dfd42da25e53a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:45:34 +0000 -Subject: [PATCH] iavf: fix VLAN filter lost on add/delete race - -JIRA: https://redhat.atlassian.net/browse/RHEL-144630 - -commit fc9c69be594756b81b54c6bc40803fa6052f35ae -Author: Petr Oros -Date: Wed Feb 25 11:01:37 2026 +0100 - - iavf: fix VLAN filter lost on add/delete race - - When iavf_add_vlan() finds an existing filter in IAVF_VLAN_REMOVE - state, it transitions the filter to IAVF_VLAN_ACTIVE assuming the - pending delete can simply be cancelled. However, there is no guarantee - that iavf_del_vlans() has not already processed the delete AQ request - and removed the filter from the PF. In that case the filter remains in - the driver's list as IAVF_VLAN_ACTIVE but is no longer programmed on - the NIC. Since iavf_add_vlans() only picks up filters in - IAVF_VLAN_ADD state, the filter is never re-added, and spoof checking - drops all traffic for that VLAN. - - CPU0 CPU1 Workqueue - ---- ---- --------- - iavf_del_vlan(vlan 100) - f->state = REMOVE - schedule AQ_DEL_VLAN - iavf_add_vlan(vlan 100) - f->state = ACTIVE - iavf_del_vlans() - f is ACTIVE, skip - iavf_add_vlans() - f is ACTIVE, skip - - Filter is ACTIVE in driver but absent from NIC. - - Transition to IAVF_VLAN_ADD instead and schedule - IAVF_FLAG_AQ_ADD_VLAN_FILTER so iavf_add_vlans() re-programs the - filter. A duplicate add is idempotent on the PF. - - Fixes: 0c0da0e95105 ("iavf: refactor VLAN filter states") - Signed-off-by: Petr Oros - Tested-by: Rafal Romanowski - Signed-off-by: Tony Nguyen - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 7a5efc9ea63f..b5f3774a80a6 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -781,10 +781,13 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, - adapter->num_vlan_filters++; - iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER); - } else if (f->state == IAVF_VLAN_REMOVE) { -- /* IAVF_VLAN_REMOVE means that VLAN wasn't yet removed. -- * We can safely only change the state here. -+ /* Re-add the filter since we cannot tell whether the -+ * pending delete has already been processed by the PF. -+ * A duplicate add is harmless. - */ -- f->state = IAVF_VLAN_ACTIVE; -+ f->state = IAVF_VLAN_ADD; -+ iavf_schedule_aq_request(adapter, -+ IAVF_FLAG_AQ_ADD_VLAN_FILTER); - } - - clearout: --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1680-iavf-rename-iavf-vlan-is-new-to-iavf-vlan-adding.patch b/SOURCES/1680-iavf-rename-iavf-vlan-is-new-to-iavf-vlan-adding.patch deleted file mode 100644 index 4d3297ae3..000000000 --- a/SOURCES/1680-iavf-rename-iavf-vlan-is-new-to-iavf-vlan-adding.patch +++ /dev/null @@ -1,87 +0,0 @@ -From 0f54b3aee80737b4a44a4fb5c15ec3caafcc62e6 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:45:35 +0000 -Subject: [PATCH] iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - -JIRA: https://redhat.atlassian.net/browse/RHEL-144630 - -commit 70d62b669f1f9080a25278fc90b64309f4ae8959 -Author: Petr Oros -Date: Mon Apr 27 22:22:13 2026 -0700 - - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING - - Rename the IAVF_VLAN_IS_NEW state to IAVF_VLAN_ADDING to better - describe what the state represents: an ADD request has been sent to - the PF and is waiting for a response. - - This is a pure rename with no behavioral change, preparing for a - cleanup of the VLAN filter state machine. - - Signed-off-by: Petr Oros - Reviewed-by: Aleksandr Loktionov - Tested-by: Rafal Romanowski - Reviewed-by: Simon Horman - Reviewed-by: Przemek Kitszel - Signed-off-by: Jacob Keller - Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-1-cdcb48303fd8@intel.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h -index 0d7cd7d4335d..94e606e3fcd6 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf.h -+++ b/drivers/net/ethernet/intel/iavf/iavf.h -@@ -158,7 +158,7 @@ struct iavf_vlan { - enum iavf_vlan_state_t { - IAVF_VLAN_INVALID, - IAVF_VLAN_ADD, /* filter needs to be added */ -- IAVF_VLAN_IS_NEW, /* filter is new, wait for PF answer */ -+ IAVF_VLAN_ADDING, /* ADD sent to PF, waiting for response */ - IAVF_VLAN_ACTIVE, /* filter is accepted by PF */ - IAVF_VLAN_DISABLE, /* filter needs to be deleted by PF, then marked INACTIVE */ - IAVF_VLAN_INACTIVE, /* filter is inactive, we are in IFF_DOWN */ -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index 88156082a41d..5114934fe81f 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -746,7 +746,7 @@ static void iavf_vlan_add_reject(struct iavf_adapter *adapter) - - spin_lock_bh(&adapter->mac_vlan_list_lock); - list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -- if (f->state == IAVF_VLAN_IS_NEW) { -+ if (f->state == IAVF_VLAN_ADDING) { - list_del(&f->list); - kfree(f); - adapter->num_vlan_filters--; -@@ -812,7 +812,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) - if (f->state == IAVF_VLAN_ADD) { - vvfl->vlan_id[i] = f->vlan.vid; - i++; -- f->state = IAVF_VLAN_IS_NEW; -+ f->state = IAVF_VLAN_ADDING; - if (i == count) - break; - } -@@ -874,7 +874,7 @@ void iavf_add_vlans(struct iavf_adapter *adapter) - vlan->tpid = f->vlan.tpid; - - i++; -- f->state = IAVF_VLAN_IS_NEW; -+ f->state = IAVF_VLAN_ADDING; - } - } - -@@ -2911,7 +2911,7 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - - spin_lock_bh(&adapter->mac_vlan_list_lock); - list_for_each_entry(f, &adapter->vlan_filter_list, list) { -- if (f->state == IAVF_VLAN_IS_NEW) -+ if (f->state == IAVF_VLAN_ADDING) - f->state = IAVF_VLAN_ACTIVE; - } - spin_unlock_bh(&adapter->mac_vlan_list_lock); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1681-iavf-stop-removing-vlan-filters-from-pf-on-interface-down.patch b/SOURCES/1681-iavf-stop-removing-vlan-filters-from-pf-on-interface-down.patch deleted file mode 100644 index 05ee26fb6..000000000 --- a/SOURCES/1681-iavf-stop-removing-vlan-filters-from-pf-on-interface-down.patch +++ /dev/null @@ -1,233 +0,0 @@ -From be4a5925a33238e2197330d94f77af7b9a4094a8 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:45:36 +0000 -Subject: [PATCH] iavf: stop removing VLAN filters from PF on interface down - -JIRA: https://redhat.atlassian.net/browse/RHEL-144630 - -commit f2ce65b9b917474a1a6ce68d357e15fac2aca0f2 -Author: Petr Oros -Date: Mon Apr 27 22:22:14 2026 -0700 - - iavf: stop removing VLAN filters from PF on interface down - - When a VF goes down, the driver currently sends DEL_VLAN to the PF for - every VLAN filter (ACTIVE -> DISABLE -> send DEL -> INACTIVE), then - re-adds them all on UP (INACTIVE -> ADD -> send ADD -> ADDING -> - ACTIVE). This round-trip is unnecessary because: - - 1. The PF disables the VF's queues via VIRTCHNL_OP_DISABLE_QUEUES, - which already prevents all RX/TX traffic regardless of VLAN filter - state. - - 2. The VLAN filters remaining in PF HW while the VF is down is - harmless - packets matching those filters have nowhere to go with - queues disabled. - - 3. The DEL+ADD cycle during down/up creates race windows where the - VLAN filter list is incomplete. With spoofcheck enabled, the PF - enables TX VLAN filtering on the first non-zero VLAN add, blocking - traffic for any VLANs not yet re-added. - - Remove the entire DISABLE/INACTIVE state machinery: - - Remove IAVF_VLAN_DISABLE and IAVF_VLAN_INACTIVE enum values - - Remove iavf_restore_filters() and its call from iavf_open() - - Remove VLAN filter handling from iavf_clear_mac_vlan_filters(), - rename it to iavf_clear_mac_filters() - - Remove DEL_VLAN_FILTER scheduling from iavf_down() - - Remove all DISABLE/INACTIVE handling from iavf_del_vlans() - - VLAN filters now stay ACTIVE across down/up cycles. Only explicit - user removal (ndo_vlan_rx_kill_vid) or PF/VF reset triggers VLAN - filter deletion/re-addition. - - Fixes: ed1f5b58ea01 ("i40evf: remove VLAN filters on close") - Signed-off-by: Petr Oros - Reviewed-by: Aleksandr Loktionov - Tested-by: Rafal Romanowski - Reviewed-by: Simon Horman - Reviewed-by: Przemek Kitszel - Signed-off-by: Jacob Keller - Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-2-cdcb48303fd8@intel.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h -index 94e606e3fcd6..14c4084f3739 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf.h -+++ b/drivers/net/ethernet/intel/iavf/iavf.h -@@ -159,10 +159,8 @@ enum iavf_vlan_state_t { - IAVF_VLAN_INVALID, - IAVF_VLAN_ADD, /* filter needs to be added */ - IAVF_VLAN_ADDING, /* ADD sent to PF, waiting for response */ -- IAVF_VLAN_ACTIVE, /* filter is accepted by PF */ -- IAVF_VLAN_DISABLE, /* filter needs to be deleted by PF, then marked INACTIVE */ -- IAVF_VLAN_INACTIVE, /* filter is inactive, we are in IFF_DOWN */ -- IAVF_VLAN_REMOVE, /* filter needs to be removed from list */ -+ IAVF_VLAN_ACTIVE, /* PF confirmed, filter is in HW */ -+ IAVF_VLAN_REMOVE, /* filter queued for DEL from PF */ - }; - - struct iavf_vlan_filter { -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index b5f3774a80a6..796473fe57f4 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -825,27 +825,6 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) - spin_unlock_bh(&adapter->mac_vlan_list_lock); - } - --/** -- * iavf_restore_filters -- * @adapter: board private structure -- * -- * Restore existing non MAC filters when VF netdev comes back up -- **/ --static void iavf_restore_filters(struct iavf_adapter *adapter) --{ -- struct iavf_vlan_filter *f; -- -- /* re-add all VLAN filters */ -- spin_lock_bh(&adapter->mac_vlan_list_lock); -- -- list_for_each_entry(f, &adapter->vlan_filter_list, list) { -- if (f->state == IAVF_VLAN_INACTIVE) -- f->state = IAVF_VLAN_ADD; -- } -- -- spin_unlock_bh(&adapter->mac_vlan_list_lock); -- adapter->aq_required |= IAVF_FLAG_AQ_ADD_VLAN_FILTER; --} - - /** - * iavf_get_num_vlans_added - get number of VLANs added -@@ -1264,13 +1243,12 @@ static void iavf_up_complete(struct iavf_adapter *adapter) - } - - /** -- * iavf_clear_mac_vlan_filters - Remove mac and vlan filters not sent to PF -- * yet and mark other to be removed. -+ * iavf_clear_mac_filters - Remove MAC filters not sent to PF yet and mark -+ * others to be removed. - * @adapter: board private structure - **/ --static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) -+static void iavf_clear_mac_filters(struct iavf_adapter *adapter) - { -- struct iavf_vlan_filter *vlf, *vlftmp; - struct iavf_mac_filter *f, *ftmp; - - spin_lock_bh(&adapter->mac_vlan_list_lock); -@@ -1289,11 +1267,6 @@ static void iavf_clear_mac_vlan_filters(struct iavf_adapter *adapter) - } - } - -- /* disable all VLAN filters */ -- list_for_each_entry_safe(vlf, vlftmp, &adapter->vlan_filter_list, -- list) -- vlf->state = IAVF_VLAN_DISABLE; -- - spin_unlock_bh(&adapter->mac_vlan_list_lock); - } - -@@ -1389,7 +1362,7 @@ void iavf_down(struct iavf_adapter *adapter) - iavf_napi_disable_all(adapter); - iavf_irq_disable(adapter); - -- iavf_clear_mac_vlan_filters(adapter); -+ iavf_clear_mac_filters(adapter); - iavf_clear_cloud_filters(adapter); - iavf_clear_fdir_filters(adapter); - iavf_clear_adv_rss_conf(adapter); -@@ -1406,8 +1379,6 @@ void iavf_down(struct iavf_adapter *adapter) - */ - if (!list_empty(&adapter->mac_filter_list)) - adapter->aq_required |= IAVF_FLAG_AQ_DEL_MAC_FILTER; -- if (!list_empty(&adapter->vlan_filter_list)) -- adapter->aq_required |= IAVF_FLAG_AQ_DEL_VLAN_FILTER; - if (!list_empty(&adapter->cloud_filter_list)) - adapter->aq_required |= IAVF_FLAG_AQ_DEL_CLOUD_FILTER; - if (!list_empty(&adapter->fdir_list_head)) -@@ -4562,8 +4533,6 @@ static int iavf_open(struct net_device *netdev) - - spin_unlock_bh(&adapter->mac_vlan_list_lock); - -- /* Restore filters that were removed with IFF_DOWN */ -- iavf_restore_filters(adapter); - iavf_restore_fdir_filters(adapter); - - iavf_configure(adapter); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index 5114934fe81f..d62c0d639414 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -911,22 +911,12 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - spin_lock_bh(&adapter->mac_vlan_list_lock); - - list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -- /* since VLAN capabilities are not allowed, we dont want to send -- * a VLAN delete request because it will most likely fail and -- * create unnecessary errors/noise, so just free the VLAN -- * filters marked for removal to enable bailing out before -- * sending a virtchnl message -- */ - if (f->state == IAVF_VLAN_REMOVE && - !VLAN_FILTERING_ALLOWED(adapter)) { - list_del(&f->list); - kfree(f); - adapter->num_vlan_filters--; -- } else if (f->state == IAVF_VLAN_DISABLE && -- !VLAN_FILTERING_ALLOWED(adapter)) { -- f->state = IAVF_VLAN_INACTIVE; -- } else if (f->state == IAVF_VLAN_REMOVE || -- f->state == IAVF_VLAN_DISABLE) { -+ } else if (f->state == IAVF_VLAN_REMOVE) { - count++; - } - } -@@ -959,13 +949,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - vvfl->vsi_id = adapter->vsi_res->vsi_id; - vvfl->num_elements = count; - list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -- if (f->state == IAVF_VLAN_DISABLE) { -- vvfl->vlan_id[i] = f->vlan.vid; -- f->state = IAVF_VLAN_INACTIVE; -- i++; -- if (i == count) -- break; -- } else if (f->state == IAVF_VLAN_REMOVE) { -+ if (f->state == IAVF_VLAN_REMOVE) { - vvfl->vlan_id[i] = f->vlan.vid; - list_del(&f->list); - kfree(f); -@@ -1007,8 +991,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - vvfl_v2->vport_id = adapter->vsi_res->vsi_id; - vvfl_v2->num_elements = count; - list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -- if (f->state == IAVF_VLAN_DISABLE || -- f->state == IAVF_VLAN_REMOVE) { -+ if (f->state == IAVF_VLAN_REMOVE) { - struct virtchnl_vlan_supported_caps *filtering_support = - &adapter->vlan_v2_caps.filtering.filtering_support; - struct virtchnl_vlan *vlan; -@@ -1022,13 +1005,9 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - vlan->tci = f->vlan.vid; - vlan->tpid = f->vlan.tpid; - -- if (f->state == IAVF_VLAN_DISABLE) { -- f->state = IAVF_VLAN_INACTIVE; -- } else { -- list_del(&f->list); -- kfree(f); -- adapter->num_vlan_filters--; -- } -+ list_del(&f->list); -+ kfree(f); -+ adapter->num_vlan_filters--; - i++; - if (i == count) - break; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1682-iavf-wait-for-pf-confirmation-before-removing-vlan-filters.patch b/SOURCES/1682-iavf-wait-for-pf-confirmation-before-removing-vlan-filters.patch deleted file mode 100644 index d2cc90392..000000000 --- a/SOURCES/1682-iavf-wait-for-pf-confirmation-before-removing-vlan-filters.patch +++ /dev/null @@ -1,189 +0,0 @@ -From ef8fb4129e9999e7462c8b53a531ec72164b5ff4 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:45:37 +0000 -Subject: [PATCH] iavf: wait for PF confirmation before removing VLAN filters - -JIRA: https://redhat.atlassian.net/browse/RHEL-144630 - -commit bbcbe4ed70dea948849549af7edf44bd42bbd695 -Author: Petr Oros -Date: Mon Apr 27 22:22:15 2026 -0700 - - iavf: wait for PF confirmation before removing VLAN filters - - The VLAN filter DELETE path was asymmetric with the ADD path: ADD - waits for PF confirmation (ADD -> ADDING -> ACTIVE), but DELETE - immediately frees the filter struct after sending the DEL message - without waiting for the PF response. - - This is problematic because: - - If the PF rejects the DEL, the filter remains in HW but the driver - has already freed the tracking structure, losing sync. - - Race conditions between DEL pending and other operations - (add, reset) cannot be properly resolved if the filter struct - is already gone. - - Add IAVF_VLAN_REMOVING state to make the DELETE path symmetric: - - REMOVE -> REMOVING (send DEL) -> PF confirms -> kfree - -> PF rejects -> ACTIVE - - In iavf_del_vlans(), transition filters from REMOVE to REMOVING - instead of immediately freeing them. The new DEL completion handler - in iavf_virtchnl_completion() frees filters on success or reverts - them to ACTIVE on error. - - Update iavf_add_vlan() to handle the REMOVING state: if a DEL is - pending and the user re-adds the same VLAN, queue it for ADD so - it gets re-programmed after the PF processes the DEL. - - The !VLAN_FILTERING_ALLOWED early-exit path still frees filters - directly since no PF message is sent in that case. - - Also update iavf_del_vlan() to skip filters already in REMOVING - state: DEL has been sent to PF and the completion handler will - free the filter when PF confirms. Without this guard, the sequence - DEL(pending) -> user-del -> second DEL could cause the PF to return - an error for the second DEL (filter already gone), causing the - completion handler to incorrectly revert a deleted filter back to - ACTIVE. - - Fixes: 968996c070ef ("iavf: Fix VLAN_V2 addition/rejection") - Signed-off-by: Petr Oros - Reviewed-by: Aleksandr Loktionov - Tested-by: Rafal Romanowski - Reviewed-by: Przemek Kitszel - Signed-off-by: Jacob Keller - Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-3-cdcb48303fd8@intel.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h -index 14c4084f3739..a0bf39bdcbeb 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf.h -+++ b/drivers/net/ethernet/intel/iavf/iavf.h -@@ -161,6 +161,7 @@ enum iavf_vlan_state_t { - IAVF_VLAN_ADDING, /* ADD sent to PF, waiting for response */ - IAVF_VLAN_ACTIVE, /* PF confirmed, filter is in HW */ - IAVF_VLAN_REMOVE, /* filter queued for DEL from PF */ -+ IAVF_VLAN_REMOVING, /* DEL sent to PF, waiting for response */ - }; - - struct iavf_vlan_filter { -diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c -index 796473fe57f4..f50dcf75bd6c 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_main.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_main.c -@@ -781,10 +781,10 @@ iavf_vlan_filter *iavf_add_vlan(struct iavf_adapter *adapter, - adapter->num_vlan_filters++; - iavf_schedule_aq_request(adapter, IAVF_FLAG_AQ_ADD_VLAN_FILTER); - } else if (f->state == IAVF_VLAN_REMOVE) { -- /* Re-add the filter since we cannot tell whether the -- * pending delete has already been processed by the PF. -- * A duplicate add is harmless. -- */ -+ /* DEL not yet sent to PF, cancel it */ -+ f->state = IAVF_VLAN_ACTIVE; -+ } else if (f->state == IAVF_VLAN_REMOVING) { -+ /* DEL already sent to PF, re-add after completion */ - f->state = IAVF_VLAN_ADD; - iavf_schedule_aq_request(adapter, - IAVF_FLAG_AQ_ADD_VLAN_FILTER); -@@ -815,11 +815,14 @@ static void iavf_del_vlan(struct iavf_adapter *adapter, struct iavf_vlan vlan) - list_del(&f->list); - kfree(f); - adapter->num_vlan_filters--; -- } else { -+ } else if (f->state != IAVF_VLAN_REMOVING) { - f->state = IAVF_VLAN_REMOVE; - iavf_schedule_aq_request(adapter, - IAVF_FLAG_AQ_DEL_VLAN_FILTER); - } -+ /* If REMOVING, DEL is already sent to PF; completion -+ * handler will free the filter when PF confirms. -+ */ - } - - spin_unlock_bh(&adapter->mac_vlan_list_lock); -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index d62c0d639414..d0b7b8106793 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -948,12 +948,10 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - - vvfl->vsi_id = adapter->vsi_res->vsi_id; - vvfl->num_elements = count; -- list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -+ list_for_each_entry(f, &adapter->vlan_filter_list, list) { - if (f->state == IAVF_VLAN_REMOVE) { - vvfl->vlan_id[i] = f->vlan.vid; -- list_del(&f->list); -- kfree(f); -- adapter->num_vlan_filters--; -+ f->state = IAVF_VLAN_REMOVING; - i++; - if (i == count) - break; -@@ -990,7 +988,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - - vvfl_v2->vport_id = adapter->vsi_res->vsi_id; - vvfl_v2->num_elements = count; -- list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, list) { -+ list_for_each_entry(f, &adapter->vlan_filter_list, list) { - if (f->state == IAVF_VLAN_REMOVE) { - struct virtchnl_vlan_supported_caps *filtering_support = - &adapter->vlan_v2_caps.filtering.filtering_support; -@@ -1005,9 +1003,7 @@ void iavf_del_vlans(struct iavf_adapter *adapter) - vlan->tci = f->vlan.vid; - vlan->tpid = f->vlan.tpid; - -- list_del(&f->list); -- kfree(f); -- adapter->num_vlan_filters--; -+ f->state = IAVF_VLAN_REMOVING; - i++; - if (i == count) - break; -@@ -2370,10 +2366,6 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - ether_addr_copy(adapter->hw.mac.addr, netdev->dev_addr); - wake_up(&adapter->vc_waitqueue); - break; -- case VIRTCHNL_OP_DEL_VLAN: -- dev_err(&adapter->pdev->dev, "Failed to delete VLAN filter, error %s\n", -- iavf_stat_str(&adapter->hw, v_retval)); -- break; - case VIRTCHNL_OP_DEL_ETH_ADDR: - dev_err(&adapter->pdev->dev, "Failed to delete MAC filter, error %s\n", - iavf_stat_str(&adapter->hw, v_retval)); -@@ -2896,6 +2888,27 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - spin_unlock_bh(&adapter->mac_vlan_list_lock); - } - break; -+ case VIRTCHNL_OP_DEL_VLAN: -+ case VIRTCHNL_OP_DEL_VLAN_V2: { -+ struct iavf_vlan_filter *f, *ftmp; -+ -+ spin_lock_bh(&adapter->mac_vlan_list_lock); -+ list_for_each_entry_safe(f, ftmp, &adapter->vlan_filter_list, -+ list) { -+ if (f->state == IAVF_VLAN_REMOVING) { -+ if (v_retval) { -+ /* PF rejected DEL, keep filter */ -+ f->state = IAVF_VLAN_ACTIVE; -+ } else { -+ list_del(&f->list); -+ kfree(f); -+ adapter->num_vlan_filters--; -+ } -+ } -+ } -+ spin_unlock_bh(&adapter->mac_vlan_list_lock); -+ } -+ break; - case VIRTCHNL_OP_ENABLE_VLAN_STRIPPING: - /* PF enabled vlan strip on this VF. - * Update netdev->features if needed to be in sync with ethtool. --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1683-iavf-add-virtchnl-op-add-vlan-to-success-completion-handler.patch b/SOURCES/1683-iavf-add-virtchnl-op-add-vlan-to-success-completion-handler.patch deleted file mode 100644 index b9b253b80..000000000 --- a/SOURCES/1683-iavf-add-virtchnl-op-add-vlan-to-success-completion-handler.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 41f0c9ca3d4bd319e2dcea3b46422291bc178b6a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 4 May 2026 08:45:38 +0000 -Subject: [PATCH] iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - -JIRA: https://redhat.atlassian.net/browse/RHEL-144630 - -commit 34d33313b52eeac3a97ad2e3176d523ec70d9283 -Author: Petr Oros -Date: Mon Apr 27 22:22:16 2026 -0700 - - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler - - The V1 ADD_VLAN opcode had no success handler; filters sent via V1 - stayed in ADDING state permanently. Add a fallthrough case so V1 - filters also transition ADDING -> ACTIVE on PF confirmation. - - Critically, add an `if (v_retval) break` guard: the error switch in - iavf_virtchnl_completion() does NOT return after handling errors, - it falls through to the success switch. Without this guard, a - PF-rejected ADD would incorrectly mark ADDING filters as ACTIVE, - creating a driver/HW mismatch where the driver believes the filter - is installed but the PF never accepted it. - - For V2, this is harmless: iavf_vlan_add_reject() in the error - block already kfree'd all ADDING filters, so the success handler - finds nothing to transition. - - Fixes: 968996c070ef ("iavf: Fix VLAN_V2 addition/rejection") - Signed-off-by: Petr Oros - Reviewed-by: Aleksandr Loktionov - Tested-by: Rafal Romanowski - Reviewed-by: Przemek Kitszel - Signed-off-by: Jacob Keller - Link: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-4-cdcb48303fd8@intel.com - Signed-off-by: Paolo Abeni - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -index d0b7b8106793..147adb76f641 100644 ---- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c -@@ -2877,9 +2877,13 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, - spin_unlock_bh(&adapter->adv_rss_lock); - } - break; -+ case VIRTCHNL_OP_ADD_VLAN: - case VIRTCHNL_OP_ADD_VLAN_V2: { - struct iavf_vlan_filter *f; - -+ if (v_retval) -+ break; -+ - spin_lock_bh(&adapter->mac_vlan_list_lock); - list_for_each_entry(f, &adapter->vlan_filter_list, list) { - if (f->state == IAVF_VLAN_ADDING) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1684-netfilter-skip-recording-stale-or-retransmitted-init.patch b/SOURCES/1684-netfilter-skip-recording-stale-or-retransmitted-init.patch deleted file mode 100644 index 1f082debd..000000000 --- a/SOURCES/1684-netfilter-skip-recording-stale-or-retransmitted-init.patch +++ /dev/null @@ -1,66 +0,0 @@ -From d2438e908b9e5d25bcc9b798703ee520770d2172 Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Wed, 29 Apr 2026 09:33:15 -0400 -Subject: [PATCH] netfilter: skip recording stale or retransmitted INIT - -JIRA: https://issues.redhat.com/browse/RHEL-158357 -Tested: compile only - -commit 576a5d2bad4814c881a829576b1261b9b8159d2b -Author: Xin Long -Date: Sun Apr 26 10:46:40 2026 -0400 - - netfilter: skip recording stale or retransmitted INIT - - An INIT whose init_tag matches the peer's vtag does not provide new state - information. It indicates either: - - - a stale INIT (after INIT-ACK has already been seen on the same side), or - - a retransmitted INIT (after INIT has already been recorded on the same - side). - - In both cases, the INIT must not update ct->proto.sctp.init[] state, since - it does not advance the handshake tracking and may otherwise corrupt - INIT/INIT-ACK validation logic. - - Allow INIT processing only when the conntrack entry is newly created - (SCTP_CONNTRACK_NONE), or when the init_tag differs from the stored peer - vtag. - - Note it skips the check for the ct with old_state SCTP_CONNTRACK_NONE in - nf_conntrack_sctp_packet(), as it is just created in sctp_new() where it - set ct->proto.sctp.vtag[IP_CT_DIR_REPLY] = ih->init_tag. - - Fixes: 9fb9cbb1082d ("[NETFILTER]: Add nf_conntrack subsystem.") - Signed-off-by: Xin Long - Reviewed-by: Marcelo Ricardo Leitner - Acked-by: Florian Westphal - Link: https://patch.msgid.link/ee56c3e416452b2a40589a2a85245ac2ad5e9f4b.1777214801.git.lucien.xin@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Xin Long - -diff --git a/net/netfilter/nf_conntrack_proto_sctp.c b/net/netfilter/nf_conntrack_proto_sctp.c -index a9f11910a131..014d3468515e 100644 ---- a/net/netfilter/nf_conntrack_proto_sctp.c -+++ b/net/netfilter/nf_conntrack_proto_sctp.c -@@ -470,9 +470,13 @@ int nf_conntrack_sctp_packet(struct nf_conn *ct, - if (!ih) - goto out_unlock; - -- if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir]) -- ct->proto.sctp.init[!dir] = 0; -- ct->proto.sctp.init[dir] = 1; -+ /* Do not record INIT matching peer vtag (stale or retransmitted INIT). */ -+ if (old_state == SCTP_CONNTRACK_NONE || -+ ct->proto.sctp.vtag[!dir] != ih->init_tag) { -+ if (ct->proto.sctp.init[dir] && ct->proto.sctp.init[!dir]) -+ ct->proto.sctp.init[!dir] = 0; -+ ct->proto.sctp.init[dir] = 1; -+ } - - pr_debug("Setting vtag %x for dir %d\n", ih->init_tag, !dir); - ct->proto.sctp.vtag[!dir] = ih->init_tag; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1685-sctp-discard-stale-init-after-handshake-completion.patch b/SOURCES/1685-sctp-discard-stale-init-after-handshake-completion.patch deleted file mode 100644 index 2e36b3483..000000000 --- a/SOURCES/1685-sctp-discard-stale-init-after-handshake-completion.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 9df78bef9f55f4b9d1cde20340fae050a6d6b12b Mon Sep 17 00:00:00 2001 -From: Xin Long -Date: Wed, 29 Apr 2026 09:33:15 -0400 -Subject: [PATCH] sctp: discard stale INIT after handshake completion -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://issues.redhat.com/browse/RHEL-158357 -Tested: compile only - -commit 8a92cb475ca90d84db769e4d4383e631ace0d6e5 -Author: Xin Long -Date: Sun Apr 26 10:46:41 2026 -0400 - - sctp: discard stale INIT after handshake completion - - After an association reaches ESTABLISHED, the peer’s init_tag is already - known from the handshake. Any subsequent INIT with the same init_tag is - not a valid restart, but a delayed or duplicate INIT. - - Drop such INIT chunks in sctp_sf_do_unexpected_init() instead of - processing them as new association attempts. - - Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") - Signed-off-by: Xin Long - Acked-by: Marcelo Ricardo Leitner - Link: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: Xin Long - -diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c -index 4848d5d50a5f..488a74d14644 100644 ---- a/net/sctp/sm_statefuns.c -+++ b/net/sctp/sm_statefuns.c -@@ -1554,6 +1554,12 @@ static enum sctp_disposition sctp_sf_do_unexpected_init( - /* Tag the variable length parameters. */ - chunk->param_hdr.v = skb_pull(chunk->skb, sizeof(struct sctp_inithdr)); - -+ if (asoc->state >= SCTP_STATE_ESTABLISHED) { -+ /* Discard INIT matching peer vtag after handshake completion (stale INIT). */ -+ if (ntohl(chunk->subh.init_hdr->init_tag) == asoc->peer.i.init_tag) -+ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); -+ } -+ - /* Verify the INIT chunk before processing it. */ - err_chunk = NULL; - if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1686-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch b/SOURCES/1686-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch deleted file mode 100644 index 3e1b647df..000000000 --- a/SOURCES/1686-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch +++ /dev/null @@ -1,34 +0,0 @@ -From 1df5711121cdc11e76b889408fdbe459feba1d39 Mon Sep 17 00:00:00 2001 -From: Jason Gunthorpe -Date: Tue, 28 Apr 2026 13:17:43 -0300 -Subject: [PATCH] RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() - error path - -commit e38e86995df27f1f854063dab1f0c6a513db3faf upstream. - -Sashiko points out that pvrdma_uar_free() is already called within -pvrdma_dealloc_ucontext(), so calling it before triggers a double free. - -Cc: stable@vger.kernel.org -Fixes: 29c8d9eba550 ("IB: Add vmw_pvrdma driver") -Link: https://sashiko.dev/#/patchset/0-v1-e911b76a94d1%2B65d95-rdma_udata_rep_jgg%40nvidia.com?part=4 -Link: https://patch.msgid.link/r/10-v1-41f3135e5565+9d2-rdma_ai_fixes1_jgg@nvidia.com -Signed-off-by: Jason Gunthorpe -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -index 19176583dbde..0d6d8902a6d9 100644 ---- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -+++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c -@@ -350,7 +350,7 @@ int pvrdma_alloc_ucontext(struct ib_ucontext *uctx, struct ib_udata *udata) - uresp.qp_tab_size = vdev->dsr->caps.max_qp; - ret = ib_copy_to_udata(udata, &uresp, sizeof(uresp)); - if (ret) { -- pvrdma_uar_free(vdev, &context->uar); -+ /* pvrdma_dealloc_ucontext() also frees the UAR */ - pvrdma_dealloc_ucontext(&context->ibucontext); - return -EFAULT; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1687-sched-fair-skip-sched-balance-running-cmpxchg-when-balance-i.patch b/SOURCES/1687-sched-fair-skip-sched-balance-running-cmpxchg-when-balance-i.patch deleted file mode 100644 index 92fd04cef..000000000 --- a/SOURCES/1687-sched-fair-skip-sched-balance-running-cmpxchg-when-balance-i.patch +++ /dev/null @@ -1,187 +0,0 @@ -From 1ed0f38cc5a629d210c5bec0e275bd4df318d2f9 Mon Sep 17 00:00:00 2001 -From: "Herton R. Krzesinski" -Date: Mon, 9 Mar 2026 19:55:43 -0300 -Subject: [PATCH] sched/fair: Skip sched_balance_running cmpxchg when balance - is not due - -JIRA: https://issues.redhat.com/browse/RHEL-147187 - -commit 3324b2180c17b21c31c16966cc85ca41a7c93703 -Author: Tim Chen -Date: Mon Nov 10 10:47:35 2025 -0800 - - sched/fair: Skip sched_balance_running cmpxchg when balance is not due - - The NUMA sched domain sets the SD_SERIALIZE flag by default, allowing - only one NUMA load balancing operation to run system-wide at a time. - - Currently, each sched group leader directly under NUMA domain attempts - to acquire the global sched_balance_running flag via cmpxchg() before - checking whether load balancing is due or whether it is the designated - load balancer for that NUMA domain. On systems with a large number - of cores, this causes significant cache contention on the shared - sched_balance_running flag. - - This patch reduces unnecessary cmpxchg() operations by first checking - that the balancer is the designated leader for a NUMA domain from - should_we_balance(), and the balance interval has expired before - trying to acquire sched_balance_running to load balance a NUMA - domain. - - On a 2-socket Granite Rapids system with sub-NUMA clustering enabled, - running an OLTP workload, 7.8% of total CPU cycles were previously spent - in sched_balance_domain() contending on sched_balance_running before - this change. - - : 104 static __always_inline int arch_atomic_cmpxchg(atomic_t *v, int old, int new) - : 105 { - : 106 return arch_cmpxchg(&v->counter, old, new); - 0.00 : ffffffff81326e6c: xor %eax,%eax - 0.00 : ffffffff81326e6e: mov $0x1,%ecx - 0.00 : ffffffff81326e73: lock cmpxchg %ecx,0x2394195(%rip) # ffffffff836bb010 - : 110 sched_balance_domains(): - : 12234 if (atomic_cmpxchg_acquire(&sched_balance_running, 0, 1)) - 99.39 : ffffffff81326e7b: test %eax,%eax - 0.00 : ffffffff81326e7d: jne ffffffff81326e99 - : 12238 if (time_after_eq(jiffies, sd->last_balance + interval)) { - 0.00 : ffffffff81326e7f: mov 0x14e2b3a(%rip),%rax # ffffffff828099c0 - 0.00 : ffffffff81326e86: sub 0x48(%r14),%rax - 0.00 : ffffffff81326e8a: cmp %rdx,%rax - - After applying this fix, sched_balance_domain() is gone from the profile - and there is a 5% throughput improvement. - - [peterz: made it so that redo retains the 'lock' and split out the - CPU_NEWLY_IDLE change to a separate patch] - Signed-off-by: Tim Chen - Signed-off-by: Peter Zijlstra (Intel) - Reviewed-by: Chen Yu - Reviewed-by: Vincent Guittot - Reviewed-by: Shrikanth Hegde - Reviewed-by: K Prateek Nayak - Reviewed-by: Srikar Dronamraju - Tested-by: Mohini Narkhede - Tested-by: Shrikanth Hegde - Link: https://patch.msgid.link/6fed119b723c71552943bfe5798c93851b30a361.1762800251.git.tim.c.chen@linux.intel.com - -(cherry picked from commit 3324b2180c17b21c31c16966cc85ca41a7c93703) -Assisted-by: Patchpal -Signed-off-by: Herton R. Krzesinski - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 9c70c9e9356f..091cfc865815 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -11248,6 +11248,21 @@ static void update_lb_imbalance_stat(struct lb_env *env, struct sched_domain *sd - } - } - -+/* -+ * This flag serializes load-balancing passes over large domains -+ * (above the NODE topology level) - only one load-balancing instance -+ * may run at a time, to reduce overhead on very large systems with -+ * lots of CPUs and large NUMA distances. -+ * -+ * - Note that load-balancing passes triggered while another one -+ * is executing are skipped and not re-tried. -+ * -+ * - Also note that this does not serialize rebalance_domains() -+ * execution, as non-SD_SERIALIZE domains will still be -+ * load-balanced in parallel. -+ */ -+static atomic_t sched_balance_running = ATOMIC_INIT(0); -+ - /* - * Check this_cpu to ensure it is balanced within domain. Attempt to move - * tasks if there is an imbalance. -@@ -11273,6 +11288,7 @@ static int sched_balance_rq(int this_cpu, struct rq *this_rq, - .fbq_type = all, - .tasks = LIST_HEAD_INIT(env.tasks), - }; -+ bool need_unlock = false; - - cpumask_and(cpus, sched_domain_span(sd), cpu_active_mask); - -@@ -11284,6 +11300,14 @@ static int sched_balance_rq(int this_cpu, struct rq *this_rq, - goto out_balanced; - } - -+ if (!need_unlock && (sd->flags & SD_SERIALIZE) && idle != CPU_NEWLY_IDLE) { -+ int zero = 0; -+ if (!atomic_try_cmpxchg_acquire(&sched_balance_running, &zero, 1)) -+ goto out_balanced; -+ -+ need_unlock = true; -+ } -+ - group = sched_balance_find_src_group(&env); - if (!group) { - schedstat_inc(sd->lb_nobusyg[idle]); -@@ -11524,6 +11548,9 @@ static int sched_balance_rq(int this_cpu, struct rq *this_rq, - sd->balance_interval < sd->max_interval) - sd->balance_interval *= 2; - out: -+ if (need_unlock) -+ atomic_set_release(&sched_balance_running, 0); -+ - return ld_moved; - } - -@@ -11648,21 +11675,6 @@ static int active_load_balance_cpu_stop(void *data) - return 0; - } - --/* -- * This flag serializes load-balancing passes over large domains -- * (above the NODE topology level) - only one load-balancing instance -- * may run at a time, to reduce overhead on very large systems with -- * lots of CPUs and large NUMA distances. -- * -- * - Note that load-balancing passes triggered while another one -- * is executing are skipped and not re-tried. -- * -- * - Also note that this does not serialize rebalance_domains() -- * execution, as non-SD_SERIALIZE domains will still be -- * load-balanced in parallel. -- */ --static atomic_t sched_balance_running = ATOMIC_INIT(0); -- - /* - * Scale the max sched_balance_rq interval with the number of CPUs in the system. - * This trades load-balance latency on larger machines for less cross talk. -@@ -11718,7 +11730,7 @@ static void sched_balance_domains(struct rq *rq, enum cpu_idle_type idle) - /* Earliest time when we have to do rebalance again */ - unsigned long next_balance = jiffies + 60*HZ; - int update_next_balance = 0; -- int need_serialize, need_decay = 0; -+ int need_decay = 0; - u64 max_cost = 0; - - rcu_read_lock(); -@@ -11742,13 +11754,6 @@ static void sched_balance_domains(struct rq *rq, enum cpu_idle_type idle) - } - - interval = get_sd_balance_interval(sd, busy); -- -- need_serialize = sd->flags & SD_SERIALIZE; -- if (need_serialize) { -- if (atomic_cmpxchg_acquire(&sched_balance_running, 0, 1)) -- goto out; -- } -- - if (time_after_eq(jiffies, sd->last_balance + interval)) { - if (sched_balance_rq(cpu, rq, sd, idle, &continue_balancing)) { - /* -@@ -11762,9 +11767,6 @@ static void sched_balance_domains(struct rq *rq, enum cpu_idle_type idle) - sd->last_balance = jiffies; - interval = get_sd_balance_interval(sd, busy); - } -- if (need_serialize) -- atomic_set_release(&sched_balance_running, 0); --out: - if (time_after(next_balance, sd->last_balance + interval)) { - next_balance = sd->last_balance + interval; - update_next_balance = 1; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1688-sched-fair-have-sd-serialize-affect-newidle-balancing.patch b/SOURCES/1688-sched-fair-have-sd-serialize-affect-newidle-balancing.patch deleted file mode 100644 index 58d432efa..000000000 --- a/SOURCES/1688-sched-fair-have-sd-serialize-affect-newidle-balancing.patch +++ /dev/null @@ -1,50 +0,0 @@ -From 2c7cbbeb752578e4f484727baed6ddb1434b6eaa Mon Sep 17 00:00:00 2001 -From: "Herton R. Krzesinski" -Date: Tue, 10 Mar 2026 11:21:37 -0300 -Subject: [PATCH] sched/fair: Have SD_SERIALIZE affect newidle balancing - -JIRA: https://issues.redhat.com/browse/RHEL-147187 - -commit 522fb20fbdbe48ed98f587d628637ff38ececd2d -Author: Peter Zijlstra -Date: Mon Nov 17 17:13:09 2025 +0100 - - sched/fair: Have SD_SERIALIZE affect newidle balancing - - Also serialize the possiblty much more frequent newidle balancing for - the 'expensive' domains that have SD_BALANCE set. - - Initial benchmarking by K Prateek and Tim showed no negative effect. - - Split out from the larger patch moving sched_balance_running around - for ease of bisect and such. - - Suggested-by: Shrikanth Hegde - Seconded-by: K Prateek Nayak - Signed-off-by: Peter Zijlstra (Intel) - Link: https://lkml.kernel.org/r/df068896-82f9-458d-8fff-5a2f654e8ffd@amd.com - Link: https://patch.msgid.link/6fed119b723c71552943bfe5798c93851b30a361.1762800251.git.tim.c.chen@linux.intel.com - - # Conflicts: - # kernel/sched/fair.c - -(cherry picked from commit 522fb20fbdbe48ed98f587d628637ff38ececd2d) -Assisted-by: Patchpal -Signed-off-by: Herton R. Krzesinski - -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 091cfc865815..68e3e4283da9 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -11300,7 +11300,7 @@ static int sched_balance_rq(int this_cpu, struct rq *this_rq, - goto out_balanced; - } - -- if (!need_unlock && (sd->flags & SD_SERIALIZE) && idle != CPU_NEWLY_IDLE) { -+ if (!need_unlock && (sd->flags & SD_SERIALIZE)) { - int zero = 0; - if (!atomic_try_cmpxchg_acquire(&sched_balance_running, &zero, 1)) - goto out_balanced; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1689-powerpc-64-force-inlining-of-prevent-user-access-and-set-kua.patch b/SOURCES/1689-powerpc-64-force-inlining-of-prevent-user-access-and-set-kua.patch deleted file mode 100644 index b9ecfeec2..000000000 --- a/SOURCES/1689-powerpc-64-force-inlining-of-prevent-user-access-and-set-kua.patch +++ /dev/null @@ -1,97 +0,0 @@ -From 0f12186498e70a3446eb2850847142827bfc7f13 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 17:10:08 -0400 -Subject: [PATCH] powerpc/64: Force inlining of prevent_user_access() and - set_kuap() - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 - -commit 792993919349fefba20f58ae4843c80e8b01f518 -Author: Christophe Leroy -Date: Fri, 11 Feb 2022 15:16:51 +0100 - - powerpc/64: Force inlining of prevent_user_access() and set_kuap() - - A ppc64_defconfig build exhibits about 10 copied of - prevent_user_access(). It also have one copy of set_kuap(). - - c000000000017340 <.prevent_user_access.constprop.0>: - c00000000001a038: 4b ff d3 09 bl c000000000017340 <.prevent_user_access.constprop.0> - c00000000001aabc: 4b ff c8 85 bl c000000000017340 <.prevent_user_access.constprop.0> - c00000000001ab38: 4b ff c8 09 bl c000000000017340 <.prevent_user_access.constprop.0> - c00000000001ade0: 4b ff c5 61 bl c000000000017340 <.prevent_user_access.constprop.0> - c000000000039b90 <.prevent_user_access.constprop.0>: - c00000000003ac08: 4b ff ef 89 bl c000000000039b90 <.prevent_user_access.constprop.0> - c00000000003b9d0: 4b ff e1 c1 bl c000000000039b90 <.prevent_user_access.constprop.0> - c00000000003ba54: 4b ff e1 3d bl c000000000039b90 <.prevent_user_access.constprop.0> - c00000000003bbfc: 4b ff df 95 bl c000000000039b90 <.prevent_user_access.constprop.0> - c00000000015dde0 <.prevent_user_access.constprop.0>: - c0000000001612c0: 4b ff cb 21 bl c00000000015dde0 <.prevent_user_access.constprop.0> - c000000000161b54: 4b ff c2 8d bl c00000000015dde0 <.prevent_user_access.constprop.0> - c000000000188cf0 <.prevent_user_access.constprop.0>: - c00000000018d658: 4b ff b6 99 bl c000000000188cf0 <.prevent_user_access.constprop.0> - c00000000030fe20 <.prevent_user_access.constprop.0>: - c0000000003123d4: 4b ff da 4d bl c00000000030fe20 <.prevent_user_access.constprop.0> - c000000000313970: 4b ff c4 b1 bl c00000000030fe20 <.prevent_user_access.constprop.0> - c0000000005e6bd0 <.prevent_user_access.constprop.0>: - c0000000005e7d8c: 4b ff ee 45 bl c0000000005e6bd0 <.prevent_user_access.constprop.0> - c0000000007bcae0 <.prevent_user_access.constprop.0>: - c0000000007bda10: 4b ff f0 d1 bl c0000000007bcae0 <.prevent_user_access.constprop.0> - c0000000007bda54: 4b ff f0 8d bl c0000000007bcae0 <.prevent_user_access.constprop.0> - c0000000007bdd28: 4b ff ed b9 bl c0000000007bcae0 <.prevent_user_access.constprop.0> - c0000000007c0390: 4b ff c7 51 bl c0000000007bcae0 <.prevent_user_access.constprop.0> - c00000000094e4f0 <.prevent_user_access.constprop.0>: - c000000000950e40: 4b ff d6 b1 bl c00000000094e4f0 <.prevent_user_access.constprop.0> - c00000000097d2d0 <.prevent_user_access.constprop.0>: - c0000000009813fc: 4b ff be d5 bl c00000000097d2d0 <.prevent_user_access.constprop.0> - c000000000acd540 <.prevent_user_access.constprop.0>: - c000000000ad1d60: 4b ff b7 e1 bl c000000000acd540 <.prevent_user_access.constprop.0> - c000000000e5d680 <.prevent_user_access.constprop.0>: - c000000000e64b60: 4b ff 8b 21 bl c000000000e5d680 <.prevent_user_access.constprop.0> - c000000000e64b6c: 4b ff 8b 15 bl c000000000e5d680 <.prevent_user_access.constprop.0> - c000000000e64c38: 4b ff 8a 49 bl c000000000e5d680 <.prevent_user_access.constprop.0> - - When building signal_64.c with -Winline the following messages appear: - - ./arch/powerpc/include/asm/book3s/64/kup.h:331:20: error: inlining failed in call to 'set_kuap': call is unlikely and code size would grow [-Werror=inline] - ./arch/powerpc/include/asm/book3s/64/kup.h:401:20: error: inlining failed in call to 'prevent_user_access.constprop': call is unlikely and code size would grow [-Werror=inline] - - Those functions are used on hot pathes and have been - expected to be inlined at all time. - - Force them inline. - - This patch reduces the kernel text size by 700 bytes, confirming - that not inlining those functions is not worth it. - - Signed-off-by: Christophe Leroy - Signed-off-by: Michael Ellerman - Link: https://lore.kernel.org/r/eff9b2b211957fa2e8707e46f31674097fd563a3.1644588972.git.christophe.leroy@csgroup.eu - -Signed-off-by: Waiman Long - -diff --git a/arch/powerpc/include/asm/book3s/64/kup.h b/arch/powerpc/include/asm/book3s/64/kup.h -index 23545732ddeb..c82323b864e1 100644 ---- a/arch/powerpc/include/asm/book3s/64/kup.h -+++ b/arch/powerpc/include/asm/book3s/64/kup.h -@@ -328,7 +328,7 @@ static inline unsigned long get_kuap(void) - return mfspr(SPRN_AMR); - } - --static inline void set_kuap(unsigned long value) -+static __always_inline void set_kuap(unsigned long value) - { - if (!mmu_has_feature(MMU_FTR_BOOK3S_KUAP)) - return; -@@ -398,7 +398,7 @@ static __always_inline void allow_user_access(void __user *to, const void __user - - #endif /* !CONFIG_PPC_KUAP */ - --static inline void prevent_user_access(unsigned long dir) -+static __always_inline void prevent_user_access(unsigned long dir) - { - set_kuap(AMR_KUAP_BLOCKED); - if (static_branch_unlikely(&uaccess_flush_key)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1690-compiler-gcc-h-remove-ancient-workaround-for-gcc-pr-58670.patch b/SOURCES/1690-compiler-gcc-h-remove-ancient-workaround-for-gcc-pr-58670.patch deleted file mode 100644 index 74e48169f..000000000 --- a/SOURCES/1690-compiler-gcc-h-remove-ancient-workaround-for-gcc-pr-58670.patch +++ /dev/null @@ -1,81 +0,0 @@ -From add20169be1f92eec68ed7588e96da06720c3a60 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 17:57:10 -0400 -Subject: [PATCH] compiler-gcc.h: remove ancient workaround for gcc PR 58670 - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 -Conflicts: A context diff due to missing upstream commit 173a3efd3edb - ("bug.h: work around GCC PR82365 in BUG()"). - -commit 43c249ea0b1e10baac4a1264a25d69723ce5d2c2 -Author: Uros Bizjak -Date: Fri, 24 Jun 2022 16:14:12 +0200 - - compiler-gcc.h: remove ancient workaround for gcc PR 58670 - - The workaround for 'asm goto' miscompilation introduces a compiler barrier - quirk that inhibits many useful compiler optimizations. For example, - __try_cmpxchg_user compiles to: - - 11375: 41 8b 4d 00 mov 0x0(%r13),%ecx - 11379: 41 8b 02 mov (%r10),%eax - 1137c: f0 0f b1 0a lock cmpxchg %ecx,(%rdx) - 11380: 0f 94 c2 sete %dl - 11383: 84 d2 test %dl,%dl - 11385: 75 c4 jne 1134b <...> - 11387: 41 89 02 mov %eax,(%r10) - - where the barrier inhibits flags propagation from asm when compiled with - gcc-12. - - When the mentioned quirk is removed, the following code is generated: - - 11553: 41 8b 4d 00 mov 0x0(%r13),%ecx - 11557: 41 8b 02 mov (%r10),%eax - 1155a: f0 0f b1 0a lock cmpxchg %ecx,(%rdx) - 1155e: 74 c9 je 11529 <...> - 11560: 41 89 02 mov %eax,(%r10) - - The refered compiler bug: - - http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 - - was fixed for gcc-4.8.2. - - Current minimum required version of GCC is version 5.1 which has the above - 'asm goto' miscompilation fixed, so remove the workaround. - - Link: https://lkml.kernel.org/r/20220624141412.72274-1-ubizjak@gmail.com - Signed-off-by: Uros Bizjak - Cc: Ingo Molnar - Cc: "H. Peter Anvin" - Cc: Thomas Gleixner - Signed-off-by: Andrew Morton - -Signed-off-by: Waiman Long - -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 589c5f4a3bfd..6fc88f0a056c 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -59,17 +59,6 @@ - */ - #define barrier_before_unreachable() asm volatile("") - --/* -- * GCC 'asm goto' miscompiles certain code sequences: -- * -- * http://gcc.gnu.org/bugzilla/show_bug.cgi?id=58670 -- * -- * Work it around via a compiler barrier quirk suggested by Jakub Jelinek. -- * -- * (asm goto is automatically volatile - the naming reflects this.) -- */ --#define asm_volatile_goto(x...) do { asm goto(x); asm (""); } while (0) -- - #if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) - #define __HAVE_BUILTIN_BSWAP32__ - #define __HAVE_BUILTIN_BSWAP64__ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1691-work-around-gcc-bugs-with-asm-goto-with-outputs.patch b/SOURCES/1691-work-around-gcc-bugs-with-asm-goto-with-outputs.patch deleted file mode 100644 index 3e56b0ae3..000000000 --- a/SOURCES/1691-work-around-gcc-bugs-with-asm-goto-with-outputs.patch +++ /dev/null @@ -1,666 +0,0 @@ -From 157e5d51df4e87292d65d1efbcb1e48196a917a2 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 17:57:13 -0400 -Subject: [PATCH] work around gcc bugs with 'asm goto' with outputs - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 -Conflicts: - 1) Hunks with merge conflicts for files missing or in unsupported - arches are dropped. - 2) The arch/x86/include/asm/cpufeature.h hunk is dropped as the change - had already been applied as part of RHEL commit 824a2da84fc6 ("x86/asm: - Use %c/%n instead of %P operand modifier in asm templates"). - 3) Two hunks from arch/powerpc/include/asm/uaccess.h are dropped due - to missing upstream commit dc5dac748af9 ("powerpc/64: Add support - to build with prefixed instructions"). - 4) The arch/powerpc/kernel/irq_64.c hunk is applied to - arch/powerpc/kernel/irq.c. - 5) A context diff in the include/linux/compiler-gcc.h hunk due to - missing upstream commit 173a3efd3edb ("bug.h: work around GCC - PR82365 in BUG()"). - -commit 4356e9f841f7fbb945521cef3577ba394c65f3fc -Author: Linus Torvalds -Date: Fri, 9 Feb 2024 12:39:31 -0800 - - work around gcc bugs with 'asm goto' with outputs - - We've had issues with gcc and 'asm goto' before, and we created a - 'asm_volatile_goto()' macro for that in the past: see commits - 3f0116c3238a ("compiler/gcc4: Add quirk for 'asm goto' miscompilation - bug") and a9f180345f53 ("compiler/gcc4: Make quirk for - asm_volatile_goto() unconditional"). - - Then, much later, we ended up removing the workaround in commit - 43c249ea0b1e ("compiler-gcc.h: remove ancient workaround for gcc PR - 58670") because we no longer supported building the kernel with the - affected gcc versions, but we left the macro uses around. - - Now, Sean Christopherson reports a new version of a very similar - problem, which is fixed by re-applying that ancient workaround. But the - problem in question is limited to only the 'asm goto with outputs' - cases, so instead of re-introducing the old workaround as-is, let's - rename and limit the workaround to just that much less common case. - - It looks like there are at least two separate issues that all hit in - this area: - - (a) some versions of gcc don't mark the asm goto as 'volatile' when it - has outputs: - - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98619 - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110420 - - which is easy to work around by just adding the 'volatile' by hand. - - (b) Internal compiler errors: - - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110422 - - which are worked around by adding the extra empty 'asm' as a - barrier, as in the original workaround. - - but the problem Sean sees may be a third thing since it involves bad - code generation (not an ICE) even with the manually added 'volatile'. - - but the same old workaround works for this case, even if this feels a - bit like voodoo programming and may only be hiding the issue. - - Reported-and-tested-by: Sean Christopherson - Link: https://lore.kernel.org/all/20240208220604.140859-1-seanjc@google.com/ - Cc: Nick Desaulniers - Cc: Uros Bizjak - Cc: Jakub Jelinek - Cc: Andrew Pinski - Signed-off-by: Linus Torvalds - -Signed-off-by: Waiman Long - -diff --git a/arch/arc/include/asm/jump_label.h b/arch/arc/include/asm/jump_label.h -index 9d9618079739..a339223d9e05 100644 ---- a/arch/arc/include/asm/jump_label.h -+++ b/arch/arc/include/asm/jump_label.h -@@ -31,7 +31,7 @@ - static __always_inline bool arch_static_branch(struct static_key *key, - bool branch) - { -- asm_volatile_goto(".balign "__stringify(JUMP_LABEL_NOP_SIZE)" \n" -+ asm goto(".balign "__stringify(JUMP_LABEL_NOP_SIZE)" \n" - "1: \n" - "nop \n" - ".pushsection __jump_table, \"aw\" \n" -@@ -47,7 +47,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, - static __always_inline bool arch_static_branch_jump(struct static_key *key, - bool branch) - { -- asm_volatile_goto(".balign "__stringify(JUMP_LABEL_NOP_SIZE)" \n" -+ asm goto(".balign "__stringify(JUMP_LABEL_NOP_SIZE)" \n" - "1: \n" - "b %l[l_yes] \n" - ".pushsection __jump_table, \"aw\" \n" -diff --git a/arch/arm/include/asm/jump_label.h b/arch/arm/include/asm/jump_label.h -index e12d7d096fc0..e4eb54f6cd9f 100644 ---- a/arch/arm/include/asm/jump_label.h -+++ b/arch/arm/include/asm/jump_label.h -@@ -11,7 +11,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - WASM(nop) "\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".word 1b, %l[l_yes], %c0\n\t" -@@ -25,7 +25,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - WASM(b) " %l[l_yes]\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".word 1b, %l[l_yes], %c0\n\t" -diff --git a/arch/arm64/include/asm/alternative-macros.h b/arch/arm64/include/asm/alternative-macros.h -index 210bb43cff2c..d328f549b1a6 100644 ---- a/arch/arm64/include/asm/alternative-macros.h -+++ b/arch/arm64/include/asm/alternative-macros.h -@@ -229,7 +229,7 @@ alternative_has_cap_likely(const unsigned long cpucap) - if (!cpucap_is_possible(cpucap)) - return false; - -- asm_volatile_goto( -+ asm goto( - ALTERNATIVE_CB("b %l[l_no]", %[cpucap], alt_cb_patch_nops) - : - : [cpucap] "i" (cpucap) -@@ -247,7 +247,7 @@ alternative_has_cap_unlikely(const unsigned long cpucap) - if (!cpucap_is_possible(cpucap)) - return false; - -- asm_volatile_goto( -+ asm goto( - ALTERNATIVE("nop", "b %l[l_yes]", %[cpucap]) - : - : [cpucap] "i" (cpucap) -diff --git a/arch/arm64/include/asm/jump_label.h b/arch/arm64/include/asm/jump_label.h -index 48ddc0f45d22..6aafbb789991 100644 ---- a/arch/arm64/include/asm/jump_label.h -+++ b/arch/arm64/include/asm/jump_label.h -@@ -18,7 +18,7 @@ - static __always_inline bool arch_static_branch(struct static_key * const key, - const bool branch) - { -- asm_volatile_goto( -+ asm goto( - "1: nop \n\t" - " .pushsection __jump_table, \"aw\" \n\t" - " .align 3 \n\t" -@@ -35,7 +35,7 @@ static __always_inline bool arch_static_branch(struct static_key * const key, - static __always_inline bool arch_static_branch_jump(struct static_key * const key, - const bool branch) - { -- asm_volatile_goto( -+ asm goto( - "1: b %l[l_yes] \n\t" - " .pushsection __jump_table, \"aw\" \n\t" - " .align 3 \n\t" -diff --git a/arch/mips/include/asm/jump_label.h b/arch/mips/include/asm/jump_label.h -index c5c6864e64bc..405c85173f2c 100644 ---- a/arch/mips/include/asm/jump_label.h -+++ b/arch/mips/include/asm/jump_label.h -@@ -36,7 +36,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\t" B_INSN " 2f\n\t" -+ asm goto("1:\t" B_INSN " 2f\n\t" - "2:\t.insn\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - WORD_INSN " 1b, %l[l_yes], %0\n\t" -@@ -50,7 +50,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\t" J_INSN " %l[l_yes]\n\t" -+ asm goto("1:\t" J_INSN " %l[l_yes]\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - WORD_INSN " 1b, %l[l_yes], %0\n\t" - ".popsection\n\t" -diff --git a/arch/parisc/include/asm/jump_label.h b/arch/parisc/include/asm/jump_label.h -index 7efb1aa2f7f8..9e06acd0e58b 100644 ---- a/arch/parisc/include/asm/jump_label.h -+++ b/arch/parisc/include/asm/jump_label.h -@@ -11,7 +11,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "nop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".word 1b - ., %l[l_yes] - .\n\t" -@@ -26,7 +26,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "b,n %l[l_yes]\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".word 1b - ., %l[l_yes] - .\n\t" -diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h -index 93ce3ec25387..2f2a86ed2280 100644 ---- a/arch/powerpc/include/asm/jump_label.h -+++ b/arch/powerpc/include/asm/jump_label.h -@@ -17,7 +17,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "nop # arch_static_branch\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".long 1b - ., %l[l_yes] - .\n\t" -@@ -32,7 +32,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "b %l[l_yes] # arch_static_branch_jump\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".long 1b - ., %l[l_yes] - .\n\t" -diff --git a/arch/powerpc/include/asm/uaccess.h b/arch/powerpc/include/asm/uaccess.h -index fd515d2e7dbd..1f645841ff8e 100644 ---- a/arch/powerpc/include/asm/uaccess.h -+++ b/arch/powerpc/include/asm/uaccess.h -@@ -73,7 +73,7 @@ __pu_failed: \ - * are no aliasing issues. - */ - #define __put_user_asm_goto(x, addr, label, op) \ -- asm_volatile_goto( \ -+ asm goto( \ - "1: " op "%U1%X1 %0,%1 # put_user\n" \ - EX_TABLE(1b, %l2) \ - : \ -@@ -86,7 +86,7 @@ __pu_failed: \ - __put_user_asm_goto(x, ptr, label, "std") - #else /* __powerpc64__ */ - #define __put_user_asm2_goto(x, addr, label) \ -- asm_volatile_goto( \ -+ asm goto( \ - "1: stw%X1 %0, %1\n" \ - "2: stw%X1 %L0, %L1\n" \ - EX_TABLE(1b, %l2) \ -@@ -130,7 +130,7 @@ do { \ - #ifdef CONFIG_CC_HAS_ASM_GOTO_OUTPUT - - #define __get_user_asm_goto(x, addr, label, op) \ -- asm_volatile_goto( \ -+ asm_goto_output( \ - "1: "op"%U1%X1 %0, %1 # get_user\n" \ - EX_TABLE(1b, %l2) \ - : "=r" (x) \ -@@ -143,7 +143,7 @@ do { \ - __get_user_asm_goto(x, addr, label, "ld") - #else /* __powerpc64__ */ - #define __get_user_asm2_goto(x, addr, label) \ -- asm_volatile_goto( \ -+ asm_goto_output( \ - "1: lwz%X1 %0, %1\n" \ - "2: lwz%X1 %L0, %L1\n" \ - EX_TABLE(1b, %l2) \ -diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c -index 2a1d2f4adab1..218f95e56091 100644 ---- a/arch/powerpc/kernel/irq.c -+++ b/arch/powerpc/kernel/irq.c -@@ -242,7 +242,7 @@ notrace void arch_local_irq_restore(unsigned long mask) - * This allows interrupts to be unmasked without hard disabling, and - * also without new hard interrupts coming in ahead of pending ones. - */ -- asm_volatile_goto( -+ asm goto( - "1: \n" - " lbz 9,%0(13) \n" - " cmpwi 9,0 \n" -diff --git a/arch/s390/include/asm/jump_label.h b/arch/s390/include/asm/jump_label.h -index 895f774bbcc5..bf78cf381dfc 100644 ---- a/arch/s390/include/asm/jump_label.h -+++ b/arch/s390/include/asm/jump_label.h -@@ -25,7 +25,7 @@ - */ - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("0: brcl 0,%l[label]\n" -+ asm goto("0: brcl 0,%l[label]\n" - ".pushsection __jump_table,\"aw\"\n" - ".balign 8\n" - ".long 0b-.,%l[label]-.\n" -@@ -39,7 +39,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("0: brcl 15,%l[label]\n" -+ asm goto("0: brcl 15,%l[label]\n" - ".pushsection __jump_table,\"aw\"\n" - ".balign 8\n" - ".long 0b-.,%l[label]-.\n" -diff --git a/arch/sparc/include/asm/jump_label.h b/arch/sparc/include/asm/jump_label.h -index 94eb529dcb77..2718cbea826a 100644 ---- a/arch/sparc/include/asm/jump_label.h -+++ b/arch/sparc/include/asm/jump_label.h -@@ -10,7 +10,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "nop\n\t" - "nop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" -@@ -26,7 +26,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch_jump(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "b %l[l_yes]\n\t" - "nop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" -diff --git a/arch/um/include/asm/cpufeature.h b/arch/um/include/asm/cpufeature.h -index 4b6d1b526bc1..66fe06db872f 100644 ---- a/arch/um/include/asm/cpufeature.h -+++ b/arch/um/include/asm/cpufeature.h -@@ -75,7 +75,7 @@ extern void setup_clear_cpu_cap(unsigned int bit); - */ - static __always_inline bool _static_cpu_has(u16 bit) - { -- asm_volatile_goto("1: jmp 6f\n" -+ asm goto("1: jmp 6f\n" - "2:\n" - ".skip -(((5f-4f) - (2b-1b)) > 0) * " - "((5f-4f) - (2b-1b)),0x90\n" -diff --git a/arch/x86/include/asm/jump_label.h b/arch/x86/include/asm/jump_label.h -index 071572e23d3a..cbbef32517f0 100644 ---- a/arch/x86/include/asm/jump_label.h -+++ b/arch/x86/include/asm/jump_label.h -@@ -24,7 +24,7 @@ - - static __always_inline bool arch_static_branch(struct static_key *key, bool branch) - { -- asm_volatile_goto("1:" -+ asm goto("1:" - "jmp %l[l_yes] # objtool NOPs this \n\t" - JUMP_TABLE_ENTRY - : : "i" (key), "i" (2 | branch) : : l_yes); -@@ -38,7 +38,7 @@ static __always_inline bool arch_static_branch(struct static_key *key, bool bran - - static __always_inline bool arch_static_branch(struct static_key * const key, const bool branch) - { -- asm_volatile_goto("1:" -+ asm goto("1:" - ".byte " __stringify(BYTES_NOP5) "\n\t" - JUMP_TABLE_ENTRY - : : "i" (key), "i" (branch) : : l_yes); -@@ -52,7 +52,7 @@ static __always_inline bool arch_static_branch(struct static_key * const key, co - - static __always_inline bool arch_static_branch_jump(struct static_key * const key, const bool branch) - { -- asm_volatile_goto("1:" -+ asm goto("1:" - "jmp %l[l_yes]\n\t" - JUMP_TABLE_ENTRY - : : "i" (key), "i" (branch) : : l_yes); -diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h -index 7fa611216417..1919ccf493cd 100644 ---- a/arch/x86/include/asm/rmwcc.h -+++ b/arch/x86/include/asm/rmwcc.h -@@ -18,7 +18,7 @@ - #define __GEN_RMWcc(fullop, _var, cc, clobbers, ...) \ - ({ \ - bool c = false; \ -- asm_volatile_goto (fullop "; j" #cc " %l[cc_label]" \ -+ asm goto (fullop "; j" #cc " %l[cc_label]" \ - : : [var] "m" (_var), ## __VA_ARGS__ \ - : clobbers : cc_label); \ - if (0) { \ -diff --git a/arch/x86/include/asm/special_insns.h b/arch/x86/include/asm/special_insns.h -index 9d45aff76187..1c5513b04f03 100644 ---- a/arch/x86/include/asm/special_insns.h -+++ b/arch/x86/include/asm/special_insns.h -@@ -205,7 +205,7 @@ static inline void clwb(volatile void *__p) - #ifdef CONFIG_X86_USER_SHADOW_STACK - static inline int write_user_shstk_64(u64 __user *addr, u64 val) - { -- asm_volatile_goto("1: wrussq %[val], (%[addr])\n" -+ asm goto("1: wrussq %[val], (%[addr])\n" - _ASM_EXTABLE(1b, %l[fail]) - :: [addr] "r" (addr), [val] "r" (val) - :: fail); -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index 34f500f9b014..3a7755c1a441 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -133,7 +133,7 @@ extern int __get_user_bad(void); - - #ifdef CONFIG_X86_32 - #define __put_user_goto_u64(x, addr, label) \ -- asm_volatile_goto("\n" \ -+ asm goto("\n" \ - "1: movl %%eax,0(%1)\n" \ - "2: movl %%edx,4(%1)\n" \ - _ASM_EXTABLE_UA(1b, %l2) \ -@@ -295,7 +295,7 @@ do { \ - } while (0) - - #define __get_user_asm(x, addr, itype, ltype, label) \ -- asm_volatile_goto("\n" \ -+ asm_goto_output("\n" \ - "1: mov"itype" %[umem],%[output]\n" \ - _ASM_EXTABLE_UA(1b, %l2) \ - : [output] ltype(x) \ -@@ -375,7 +375,7 @@ do { \ - __typeof__(_ptr) _old = (__typeof__(_ptr))(_pold); \ - __typeof__(*(_ptr)) __old = *_old; \ - __typeof__(*(_ptr)) __new = (_new); \ -- asm_volatile_goto("\n" \ -+ asm_goto_output("\n" \ - "1: " LOCK_PREFIX "cmpxchg"itype" %[new], %[ptr]\n"\ - _ASM_EXTABLE_UA(1b, %l[label]) \ - : CC_OUT(z) (success), \ -@@ -394,7 +394,7 @@ do { \ - __typeof__(_ptr) _old = (__typeof__(_ptr))(_pold); \ - __typeof__(*(_ptr)) __old = *_old; \ - __typeof__(*(_ptr)) __new = (_new); \ -- asm_volatile_goto("\n" \ -+ asm_goto_output("\n" \ - "1: " LOCK_PREFIX "cmpxchg8b %[ptr]\n" \ - _ASM_EXTABLE_UA(1b, %l[label]) \ - : CC_OUT(z) (success), \ -@@ -477,7 +477,7 @@ struct __large_struct { unsigned long buf[100]; }; - * aliasing issues. - */ - #define __put_user_goto(x, addr, itype, ltype, label) \ -- asm_volatile_goto("\n" \ -+ asm goto("\n" \ - "1: mov"itype" %0,%1\n" \ - _ASM_EXTABLE_UA(1b, %l2) \ - : : ltype(x), "m" (__m(addr)) \ -diff --git a/arch/x86/kvm/svm/svm_ops.h b/arch/x86/kvm/svm/svm_ops.h -index 36c8af87a707..4e725854c63a 100644 ---- a/arch/x86/kvm/svm/svm_ops.h -+++ b/arch/x86/kvm/svm/svm_ops.h -@@ -8,7 +8,7 @@ - - #define svm_asm(insn, clobber...) \ - do { \ -- asm_volatile_goto("1: " __stringify(insn) "\n\t" \ -+ asm goto("1: " __stringify(insn) "\n\t" \ - _ASM_EXTABLE(1b, %l[fault]) \ - ::: clobber : fault); \ - return; \ -@@ -18,7 +18,7 @@ fault: \ - - #define svm_asm1(insn, op1, clobber...) \ - do { \ -- asm_volatile_goto("1: " __stringify(insn) " %0\n\t" \ -+ asm goto("1: " __stringify(insn) " %0\n\t" \ - _ASM_EXTABLE(1b, %l[fault]) \ - :: op1 : clobber : fault); \ - return; \ -@@ -28,7 +28,7 @@ fault: \ - - #define svm_asm2(insn, op1, op2, clobber...) \ - do { \ -- asm_volatile_goto("1: " __stringify(insn) " %1, %0\n\t" \ -+ asm goto("1: " __stringify(insn) " %1, %0\n\t" \ - _ASM_EXTABLE(1b, %l[fault]) \ - :: op1, op2 : clobber : fault); \ - return; \ -diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c -index 09fc5c6d13d7..bc94324bf778 100644 ---- a/arch/x86/kvm/vmx/vmx.c -+++ b/arch/x86/kvm/vmx/vmx.c -@@ -745,7 +745,7 @@ static int vmx_set_guest_uret_msr(struct vcpu_vmx *vmx, - */ - static int kvm_cpu_vmxoff(void) - { -- asm_volatile_goto("1: vmxoff\n\t" -+ asm goto("1: vmxoff\n\t" - _ASM_EXTABLE(1b, %l[fault]) - ::: "cc", "memory" : fault); - -@@ -2807,7 +2807,7 @@ static int kvm_cpu_vmxon(u64 vmxon_pointer) - - cr4_set_bits(X86_CR4_VMXE); - -- asm_volatile_goto("1: vmxon %[vmxon_pointer]\n\t" -+ asm goto("1: vmxon %[vmxon_pointer]\n\t" - _ASM_EXTABLE(1b, %l[fault]) - : : [vmxon_pointer] "m"(vmxon_pointer) - : : fault); -diff --git a/arch/x86/kvm/vmx/vmx_ops.h b/arch/x86/kvm/vmx/vmx_ops.h -index f41ce3c24123..8060e5fc6dbd 100644 ---- a/arch/x86/kvm/vmx/vmx_ops.h -+++ b/arch/x86/kvm/vmx/vmx_ops.h -@@ -94,7 +94,7 @@ static __always_inline unsigned long __vmcs_readl(unsigned long field) - - #ifdef CONFIG_CC_HAS_ASM_GOTO_OUTPUT - -- asm_volatile_goto("1: vmread %[field], %[output]\n\t" -+ asm_goto_output("1: vmread %[field], %[output]\n\t" - "jna %l[do_fail]\n\t" - - _ASM_EXTABLE(1b, %l[do_exception]) -@@ -188,7 +188,7 @@ static __always_inline unsigned long vmcs_readl(unsigned long field) - - #define vmx_asm1(insn, op1, error_args...) \ - do { \ -- asm_volatile_goto("1: " __stringify(insn) " %0\n\t" \ -+ asm goto("1: " __stringify(insn) " %0\n\t" \ - ".byte 0x2e\n\t" /* branch not taken hint */ \ - "jna %l[error]\n\t" \ - _ASM_EXTABLE(1b, %l[fault]) \ -@@ -205,7 +205,7 @@ fault: \ - - #define vmx_asm2(insn, op1, op2, error_args...) \ - do { \ -- asm_volatile_goto("1: " __stringify(insn) " %1, %0\n\t" \ -+ asm goto("1: " __stringify(insn) " %1, %0\n\t" \ - ".byte 0x2e\n\t" /* branch not taken hint */ \ - "jna %l[error]\n\t" \ - _ASM_EXTABLE(1b, %l[fault]) \ -diff --git a/arch/xtensa/include/asm/jump_label.h b/arch/xtensa/include/asm/jump_label.h -index c812bf85021c..46c8596259d2 100644 ---- a/arch/xtensa/include/asm/jump_label.h -+++ b/arch/xtensa/include/asm/jump_label.h -@@ -13,7 +13,7 @@ - static __always_inline bool arch_static_branch(struct static_key *key, - bool branch) - { -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - "_nop\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".word 1b, %l[l_yes], %c0\n\t" -@@ -38,7 +38,7 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key, - * make it reachable and wrap both into a no-transform block - * to avoid any assembler interference with this. - */ -- asm_volatile_goto("1:\n\t" -+ asm goto("1:\n\t" - ".begin no-transform\n\t" - "_j %l[l_yes]\n\t" - "2:\n\t" -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 6fc88f0a056c..25d2b060cf50 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -59,6 +59,25 @@ - */ - #define barrier_before_unreachable() asm volatile("") - -+/* -+ * GCC 'asm goto' with outputs miscompiles certain code sequences: -+ * -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110420 -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110422 -+ * -+ * Work it around via the same compiler barrier quirk that we used -+ * to use for the old 'asm goto' workaround. -+ * -+ * Also, always mark such 'asm goto' statements as volatile: all -+ * asm goto statements are supposed to be volatile as per the -+ * documentation, but some versions of gcc didn't actually do -+ * that for asms with outputs: -+ * -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98619 -+ */ -+#define asm_goto_output(x...) \ -+ do { asm volatile goto(x); asm (""); } while (0) -+ - #if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) - #define __HAVE_BUILTIN_BSWAP32__ - #define __HAVE_BUILTIN_BSWAP64__ -diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h -index 575898ac4daa..f84ef9014c98 100644 ---- a/include/linux/compiler_types.h -+++ b/include/linux/compiler_types.h -@@ -373,8 +373,8 @@ __no_sanitize_memory - #define __member_size(p) __builtin_object_size(p, 1) - #endif - --#ifndef asm_volatile_goto --#define asm_volatile_goto(x...) asm goto(x) -+#ifndef asm_goto_output -+#define asm_goto_output(x...) asm goto(x) - #endif - - #ifdef CONFIG_CC_HAS_ASM_INLINE -diff --git a/net/netfilter/nft_set_pipapo_avx2.c b/net/netfilter/nft_set_pipapo_avx2.c -index cf5683afaf83..56a4deb276fb 100644 ---- a/net/netfilter/nft_set_pipapo_avx2.c -+++ b/net/netfilter/nft_set_pipapo_avx2.c -@@ -57,7 +57,7 @@ - - /* Jump to label if @reg is zero */ - #define NFT_PIPAPO_AVX2_NOMATCH_GOTO(reg, label) \ -- asm_volatile_goto("vptest %%ymm" #reg ", %%ymm" #reg ";" \ -+ asm goto("vptest %%ymm" #reg ", %%ymm" #reg ";" \ - "je %l[" #label "]" : : : : label) - - /* Store 256 bits from YMM register into memory. Contrary to bucket load -diff --git a/samples/bpf/asm_goto_workaround.h b/samples/bpf/asm_goto_workaround.h -index 7048bb3594d6..634e81d83efd 100644 ---- a/samples/bpf/asm_goto_workaround.h -+++ b/samples/bpf/asm_goto_workaround.h -@@ -4,14 +4,14 @@ - #define __ASM_GOTO_WORKAROUND_H - - /* -- * This will bring in asm_volatile_goto and asm_inline macro definitions -+ * This will bring in asm_goto_output and asm_inline macro definitions - * if enabled by compiler and config options. - */ - #include - --#ifdef asm_volatile_goto --#undef asm_volatile_goto --#define asm_volatile_goto(x...) asm volatile("invalid use of asm_volatile_goto") -+#ifdef asm_goto_output -+#undef asm_goto_output -+#define asm_goto_output(x...) asm volatile("invalid use of asm_goto_output") - #endif - - /* -diff --git a/tools/arch/x86/include/asm/rmwcc.h b/tools/arch/x86/include/asm/rmwcc.h -index 11ff975242ca..e2ff22b379a4 100644 ---- a/tools/arch/x86/include/asm/rmwcc.h -+++ b/tools/arch/x86/include/asm/rmwcc.h -@@ -4,7 +4,7 @@ - - #define __GEN_RMWcc(fullop, var, cc, ...) \ - do { \ -- asm_volatile_goto (fullop "; j" cc " %l[cc_label]" \ -+ asm goto (fullop "; j" cc " %l[cc_label]" \ - : : "m" (var), ## __VA_ARGS__ \ - : "memory" : cc_label); \ - return 0; \ -diff --git a/tools/include/linux/compiler_types.h b/tools/include/linux/compiler_types.h -index 1bdd834bdd57..d09f9dc172a4 100644 ---- a/tools/include/linux/compiler_types.h -+++ b/tools/include/linux/compiler_types.h -@@ -36,8 +36,8 @@ - #include - #endif - --#ifndef asm_volatile_goto --#define asm_volatile_goto(x...) asm goto(x) -+#ifndef asm_goto_output -+#define asm_goto_output(x...) asm goto(x) - #endif - - #endif /* __LINUX_COMPILER_TYPES_H */ --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1692-init-kconfig-fix-cc-has-asm-goto-tied-output-test-with-dash.patch b/SOURCES/1692-init-kconfig-fix-cc-has-asm-goto-tied-output-test-with-dash.patch deleted file mode 100644 index f593068f2..000000000 --- a/SOURCES/1692-init-kconfig-fix-cc-has-asm-goto-tied-output-test-with-dash.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 2c488a61ac36c5fdeac896b4dacfc1169d3a02f6 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 20:06:07 -0400 -Subject: [PATCH] init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 - -commit 534bd70374d646f17e2cebe0e6e4cdd478ce4f0c -Author: Alexandre Belloni -Date: Tue, 15 Nov 2022 12:01:58 +0100 - - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash - - When using dash as /bin/sh, the CC_HAS_ASM_GOTO_TIED_OUTPUT test fails - with a syntax error which is not the one we are looking for: - - : In function ‘foo’: - :1:29: warning: missing terminating " character - :1:29: error: missing terminating " character - :2:5: error: expected ‘:’ before ‘+’ token - :2:7: warning: missing terminating " character - :2:7: error: missing terminating " character - :2:5: error: expected declaration or statement at end of input - - Removing '\n' solves this. - - Fixes: 1aa0e8b144b6 ("Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug") - Signed-off-by: Alexandre Belloni - Reviewed-by: Sean Christopherson - Signed-off-by: Masahiro Yamada - -Signed-off-by: Waiman Long - -diff --git a/init/Kconfig b/init/Kconfig -index c2b4633fb6ad..f7f1675bb4db 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -76,7 +76,7 @@ config CC_HAS_ASM_GOTO_OUTPUT - config CC_HAS_ASM_GOTO_TIED_OUTPUT - depends on CC_HAS_ASM_GOTO_OUTPUT - # Detect buggy gcc and clang, fixed in gcc-11 clang-14. -- def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .\n": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) -+ def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) - - config TOOLS_SUPPORT_RELR - def_bool $(success,env "CC=$(CC)" "LD=$(LD)" "NM=$(NM)" "OBJCOPY=$(OBJCOPY)" $(srctree)/scripts/tools-support-relr.sh) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1693-update-workarounds-for-gcc-asm-goto-issue.patch b/SOURCES/1693-update-workarounds-for-gcc-asm-goto-issue.patch deleted file mode 100644 index 9f9ddc025..000000000 --- a/SOURCES/1693-update-workarounds-for-gcc-asm-goto-issue.patch +++ /dev/null @@ -1,127 +0,0 @@ -From 0e2c7308f190cc8605b796f87e4cbdd3a2a57004 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 20:06:35 -0400 -Subject: [PATCH] update workarounds for gcc "asm goto" issue - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 - -commit 68fb3ca0e408e00db1c3f8fccdfa19e274c033be -Author: Linus Torvalds -Date: Thu, 15 Feb 2024 11:14:33 -0800 - - update workarounds for gcc "asm goto" issue - - In commit 4356e9f841f7 ("work around gcc bugs with 'asm goto' with - outputs") I did the gcc workaround unconditionally, because the cause of - the bad code generation wasn't entirely clear. - - In the meantime, Jakub Jelinek debugged the issue, and has come up with - a fix in gcc [2], which also got backported to the still maintained - branches of gcc-11, gcc-12 and gcc-13. - - Note that while the fix technically wasn't in the original gcc-14 - branch, Jakub says: - - "while it is true that no GCC 14 snapshots until today (or whenever the - fix will be committed) have the fix, for GCC trunk it is up to the - distros to use the latest snapshot if they use it at all and would - allow better testing of the kernel code without the workaround, so - that if there are other issues they won't be discovered years later. - Most userland code doesn't actually use asm goto with outputs..." - - so we will consider gcc-14 to be fixed - if somebody is using gcc - snapshots of the gcc-14 before the fix, they should upgrade. - - Note that while the bug goes back to gcc-11, in practice other gcc - changes seem to have effectively hidden it since gcc-12.1 as per a - bisect by Jakub. So even a gcc-14 snapshot without the fix likely - doesn't show actual problems. - - Also, make the default 'asm_goto_output()' macro mark the asm as - volatile by hand, because of an unrelated gcc issue [1] where it doesn't - match the documented behavior ("asm goto is always volatile"). - - Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103979 [1] - Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 [2] - Link: https://lore.kernel.org/all/20240208220604.140859-1-seanjc@google.com/ - Requested-by: Jakub Jelinek - Cc: Uros Bizjak - Cc: Nick Desaulniers - Cc: Sean Christopherson - Cc: Andrew Pinski - Signed-off-by: Linus Torvalds - -Signed-off-by: Waiman Long - -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 25d2b060cf50..77f1bedf0290 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -62,10 +62,9 @@ - /* - * GCC 'asm goto' with outputs miscompiles certain code sequences: - * -- * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110420 -- * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110422 -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 - * -- * Work it around via the same compiler barrier quirk that we used -+ * Work around it via the same compiler barrier quirk that we used - * to use for the old 'asm goto' workaround. - * - * Also, always mark such 'asm goto' statements as volatile: all -@@ -75,8 +74,10 @@ - * - * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98619 - */ -+#ifdef CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND - #define asm_goto_output(x...) \ - do { asm volatile goto(x); asm (""); } while (0) -+#endif - - #if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) - #define __HAVE_BUILTIN_BSWAP32__ -diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h -index f84ef9014c98..1f405d334c61 100644 ---- a/include/linux/compiler_types.h -+++ b/include/linux/compiler_types.h -@@ -373,8 +373,15 @@ __no_sanitize_memory - #define __member_size(p) __builtin_object_size(p, 1) - #endif - -+/* -+ * Some versions of gcc do not mark 'asm goto' volatile: -+ * -+ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103979 -+ * -+ * We do it here by hand, because it doesn't hurt. -+ */ - #ifndef asm_goto_output --#define asm_goto_output(x...) asm goto(x) -+#define asm_goto_output(x...) asm volatile goto(x) - #endif - - #ifdef CONFIG_CC_HAS_ASM_INLINE -diff --git a/init/Kconfig b/init/Kconfig -index f7f1675bb4db..bbfb726a6522 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -78,6 +78,15 @@ config CC_HAS_ASM_GOTO_TIED_OUTPUT - # Detect buggy gcc and clang, fixed in gcc-11 clang-14. - def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) - -+config GCC_ASM_GOTO_OUTPUT_WORKAROUND -+ bool -+ depends on CC_IS_GCC && CC_HAS_ASM_GOTO_OUTPUT -+ # Fixed in GCC 14, 13.3, 12.4 and 11.5 -+ # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 -+ default y if GCC_VERSION < 110500 -+ default y if GCC_VERSION >= 120000 && GCC_VERSION < 120400 -+ default y if GCC_VERSION >= 130000 && GCC_VERSION < 130300 -+ - config TOOLS_SUPPORT_RELR - def_bool $(success,env "CC=$(CC)" "LD=$(LD)" "NM=$(NM)" "OBJCOPY=$(OBJCOPY)" $(srctree)/scripts/tools-support-relr.sh) - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1694-init-kconfig-remove-config-gcc-asm-goto-output-workaround.patch b/SOURCES/1694-init-kconfig-remove-config-gcc-asm-goto-output-workaround.patch deleted file mode 100644 index 6df1a30e8..000000000 --- a/SOURCES/1694-init-kconfig-remove-config-gcc-asm-goto-output-workaround.patch +++ /dev/null @@ -1,257 +0,0 @@ -From 37170aeb1d2b90bd97b9a1a213e37a7da303ad18 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Fri, 8 May 2026 20:07:10 -0400 -Subject: [PATCH] init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND - -JIRA: https://redhat.atlassian.net/browse/RHEL-166727 -Conflicts: - A context diff in the include/linux/compiler-gcc.h hunk due to - missing upstream commit 173a3efd3edb ("bug.h: work around GCC PR82365 - in BUG()"). - -commit f2f6a8e8871725035959b90bac048cde555aa0e9 -Author: Mark Rutland -Date: Thu, 18 Jul 2024 13:06:47 +0100 - - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND - - Several versions of GCC mis-compile asm goto with outputs. We try to - workaround this, but our workaround is demonstrably incomplete and - liable to result in subtle bugs, especially on arm64 where get_user() - has recently been moved over to using asm goto with outputs. - - From discussion(s) with Linus at: - - https://lore.kernel.org/linux-arm-kernel/Zpfv2tnlQ-gOLGac@J2N7QTR9R3.cambridge.arm.com/ - https://lore.kernel.org/linux-arm-kernel/ZpfxLrJAOF2YNqCk@J2N7QTR9R3.cambridge.arm.com/ - - ... it sounds like the best thing to do for now is to remove the - workaround and make CC_HAS_ASM_GOTO_OUTPUT depend on working compiler - versions. - - The issue was originally reported to GCC by Sean Christopherson: - - https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 - - ... and Jakub Jelinek fixed this for GCC 14, with the fix backported to - 13.3.0, 12.4.0, and 11.5.0. - - In the kernel, we tried to workaround broken compilers in commits: - - 4356e9f841f7 ("work around gcc bugs with 'asm goto' with outputs") - 68fb3ca0e408 ("update workarounds for gcc "asm goto" issue") - - ... but the workaround of adding an empty asm("") after the asm volatile - goto(...) demonstrably does not always avoid the problem, as can be seen - in the following test case: - - | #define asm_goto_output(x...) \ - | do { asm volatile goto(x); asm (""); } while (0) - | - | #define __good_or_bad(__val, __key) \ - | do { \ - | __label__ __failed; \ - | unsigned long __tmp; \ - | asm_goto_output( \ - | " cbnz %[key], %l[__failed]\n" \ - | " mov %[val], #0x900d\n" \ - | : [val] "=r" (__tmp) \ - | : [key] "r" (__key) \ - | : \ - | : __failed); \ - | (__val) = __tmp; \ - | break; \ - | __failed: \ - | (__val) = 0xbad; \ - | } while (0) - | - | unsigned long get_val(unsigned long key); - | unsigned long get_val(unsigned long key) - | { - | unsigned long val = 0xbad; - | - | __good_or_bad(val, key); - | - | return val; - | } - - GCC 13.2.0 (at -O2) compiles this to: - - | cbnz x0, .Lfailed - | mov x0, #0x900d - | .Lfailed: - | ret - - GCC 14.1.0 (at -O2) compiles this to: - - | cbnz x0, .Lfailed - | mov x0, #0x900d - | ret - | .Lfailed: - | mov x0, #0xbad - | ret - - Note that GCC 13.2.0 erroneously omits the assignment to 'val' in the - error path (even though this does not depend on an output of the asm - goto). GCC 14.1.0 correctly retains the assignment. - - This problem can be seen within the kernel with the following test case: - - | #include - | #include - | - | noinline unsigned long test_unsafe_get_user(unsigned long __user *ptr); - | noinline unsigned long test_unsafe_get_user(unsigned long __user *ptr) - | { - | unsigned long val; - | - | unsafe_get_user(val, ptr, Efault); - | return val; - | - | Efault: - | val = 0x900d; - | return val; - | } - - GCC 13.2.0 (arm64 defconfig) compiles this to: - - | and x0, x0, #0xff7fffffffffffff - | ldtr x0, [x0] - | .Lextable_fixup: - | ret - - GCC 13.2.0 (x86_64 defconfig + MITIGATION_RETPOLINE=n) compiles this to: - - | endbr64 - | mov (%rdi),%rax - | .Lextable_fixup: - | ret - - ... omitting the assignment to 'val' in the error path, and leaving - garbage in the result register returned by the function (which happens - to contain the faulting address in the generated code). - - GCC 14.1.0 (arm64 defconfig) compiles this to: - - | and x0, x0, #0xff7fffffffffffff - | ldtr x0, [x0] - | ret - | .Lextable_fixup: - | mov x0, #0x900d // #36877 - | ret - - GCC 14.1.0 (x86_64 defconfig + MITIGATION_RETPOLINE=n) compiles this to: - - | endbr64 - | mov (%rdi),%rax - | ret - | .Lextable_fixup: - | mov $0x900d,%eax - | ret - - ... retaining the expected assignment to 'val' in the error path. - - We don't have a complete and reasonable workaround. While placing empty - asm("") blocks after each goto label *might* be sufficient, we don't - know for certain, this is tedious and error-prone, and there doesn't - seem to be a neat way to wrap this up (which is especially painful for - cases with multiple goto labels). - - Avoid this issue by disabling CONFIG_CC_HAS_ASM_GOTO_OUTPUT for - known-broken compiler versions and removing the workaround (along with - the CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND config option). - - For the moment I've left the default implementation of asm_goto_output() - unchanged. This should now be redundant since any compiler with the fix - for the clobbering issue whould also have a fix for the (earlier) - volatile issue, but it's far less churny to leave it around, which makes - it easier to backport this patch if necessary. - - Signed-off-by: Mark Rutland - Cc: Alex Coplan - Cc: Catalin Marinas - Cc: Jakub Jelinek - Cc: Peter Zijlstra - Cc: Sean Christopherson - Cc: Szabolcs Nagy - Cc: Will Deacon - Cc: linux-arm-kernel@lists.infradead.org - Cc: linux-kernel@vger.kernel.org - Signed-off-by: Linus Torvalds - -Signed-off-by: Waiman Long - -diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h -index 77f1bedf0290..6fc88f0a056c 100644 ---- a/include/linux/compiler-gcc.h -+++ b/include/linux/compiler-gcc.h -@@ -59,26 +59,6 @@ - */ - #define barrier_before_unreachable() asm volatile("") - --/* -- * GCC 'asm goto' with outputs miscompiles certain code sequences: -- * -- * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 -- * -- * Work around it via the same compiler barrier quirk that we used -- * to use for the old 'asm goto' workaround. -- * -- * Also, always mark such 'asm goto' statements as volatile: all -- * asm goto statements are supposed to be volatile as per the -- * documentation, but some versions of gcc didn't actually do -- * that for asms with outputs: -- * -- * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98619 -- */ --#ifdef CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND --#define asm_goto_output(x...) \ -- do { asm volatile goto(x); asm (""); } while (0) --#endif -- - #if defined(CONFIG_ARCH_USE_BUILTIN_BSWAP) - #define __HAVE_BUILTIN_BSWAP32__ - #define __HAVE_BUILTIN_BSWAP64__ -diff --git a/init/Kconfig b/init/Kconfig -index bbfb726a6522..df5a34169f22 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -70,23 +70,25 @@ config CC_CAN_LINK_STATIC - default $(success,$(srctree)/scripts/cc-can-link.sh $(CC) $(CLANG_FLAGS) $(USERCFLAGS) $(USERLDFLAGS) $(m64-flag) -static) if 64BIT - default $(success,$(srctree)/scripts/cc-can-link.sh $(CC) $(CLANG_FLAGS) $(USERCFLAGS) $(USERLDFLAGS) $(m32-flag) -static) - -+# Fixed in GCC 14, 13.3, 12.4 and 11.5 -+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 -+config GCC_ASM_GOTO_OUTPUT_BROKEN -+ bool -+ depends on CC_IS_GCC -+ default y if GCC_VERSION < 110500 -+ default y if GCC_VERSION >= 120000 && GCC_VERSION < 120400 -+ default y if GCC_VERSION >= 130000 && GCC_VERSION < 130300 -+ - config CC_HAS_ASM_GOTO_OUTPUT -- def_bool $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null) -+ def_bool y -+ depends on !GCC_ASM_GOTO_OUTPUT_BROKEN -+ depends on $(success,echo 'int foo(int x) { asm goto ("": "=r"(x) ::: bar); return x; bar: return 0; }' | $(CC) -x c - -c -o /dev/null) - - config CC_HAS_ASM_GOTO_TIED_OUTPUT - depends on CC_HAS_ASM_GOTO_OUTPUT - # Detect buggy gcc and clang, fixed in gcc-11 clang-14. - def_bool $(success,echo 'int foo(int *x) { asm goto (".long (%l[bar]) - .": "+m"(*x) ::: bar); return *x; bar: return 0; }' | $CC -x c - -c -o /dev/null) - --config GCC_ASM_GOTO_OUTPUT_WORKAROUND -- bool -- depends on CC_IS_GCC && CC_HAS_ASM_GOTO_OUTPUT -- # Fixed in GCC 14, 13.3, 12.4 and 11.5 -- # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113921 -- default y if GCC_VERSION < 110500 -- default y if GCC_VERSION >= 120000 && GCC_VERSION < 120400 -- default y if GCC_VERSION >= 130000 && GCC_VERSION < 130300 -- - config TOOLS_SUPPORT_RELR - def_bool $(success,env "CC=$(CC)" "LD=$(LD)" "NM=$(NM)" "OBJCOPY=$(OBJCOPY)" $(srctree)/scripts/tools-support-relr.sh) - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1695-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch b/SOURCES/1695-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch deleted file mode 100644 index 8241b237b..000000000 --- a/SOURCES/1695-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 7fe755dde8aa5a969850638df9f39e30c87631ac Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 15:40:52 +0000 -Subject: [PATCH] RDMA/mlx5: Fix error path fall-through in - mlx5_ib_dev_res_srq_init() - -JIRA: https://redhat.atlassian.net/browse/RHEL-179997 -CVE: CVE-2026-46176 -Backported from tree(s): linux - -commit c488df06bd552bb8b6e14fa0cfd5ad986c6e9525 -Author: Junrui Luo -Date: Fri Apr 24 13:51:02 2026 +0800 - - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() - - mlx5_ib_dev_res_srq_init() allocates two SRQs, s0 and s1. When - ib_create_srq() fails for s1, the error branch destroys s0 but falls - through and unconditionally assigns the freed s0 and the ERR_PTR s1 to - devr->s0 and devr->s1. - - This leads to several problems: the lock-free fast path checks - "if (devr->s1) return 0;" and treats the ERR_PTR as already initialised; - users in mlx5_ib_create_qp() dereference the freed SRQ or ERR_PTR via - to_msrq(devr->s0)->msrq.srqn; and mlx5_ib_dev_res_cleanup() dereferences - the ERR_PTR and double-frees s0 on teardown. - - Fix by adding the same `goto unlock` in the s1 failure path. - - Cc: stable@vger.kernel.org - Fixes: 5895e70f2e6e ("IB/mlx5: Allocate resources just before first QP/SRQ is created") - Link: https://patch.msgid.link/r/SYBPR01MB7881E1E0970268BD69C0BA75AF2B2@SYBPR01MB7881.ausprd01.prod.outlook.com - Reported-by: Yuhao Jiang - Signed-off-by: Junrui Luo - Signed-off-by: Jason Gunthorpe - -Signed-off-by: CKI Backport Bot - -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index dc2c5cc47860..36f06ea8a680 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -3122,6 +3122,7 @@ int mlx5_ib_dev_res_srq_init(struct mlx5_ib_dev *dev) - "Couldn't create SRQ 1 for res init, err=%pe\n", - s1); - ib_destroy_srq(s0); -+ goto unlock; - } - - devr->s0 = s0; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1696-net-atm-fix-crash-due-to-unvalidated-vcc-pointer-in-sigd-sen.patch b/SOURCES/1696-net-atm-fix-crash-due-to-unvalidated-vcc-pointer-in-sigd-sen.patch deleted file mode 100644 index ded595149..000000000 --- a/SOURCES/1696-net-atm-fix-crash-due-to-unvalidated-vcc-pointer-in-sigd-sen.patch +++ /dev/null @@ -1,150 +0,0 @@ -From 1c8bda3df028d5e54134077dcd09f46ca8cfceb5 Mon Sep 17 00:00:00 2001 -From: Jiayuan Chen -Date: Thu, 5 Feb 2026 17:54:51 +0800 -Subject: [PATCH] net: atm: fix crash due to unvalidated vcc pointer in - sigd_send() - -[ Upstream commit ae88a5d2f29b69819dc7b04086734439d074a643 ] - -Reproducer available at [1]. - -The ATM send path (sendmsg -> vcc_sendmsg -> sigd_send) reads the vcc -pointer from msg->vcc and uses it directly without any validation. This -pointer comes from userspace via sendmsg() and can be arbitrarily forged: - - int fd = socket(AF_ATMSVC, SOCK_DGRAM, 0); - ioctl(fd, ATMSIGD_CTRL); // become ATM signaling daemon - struct msghdr msg = { .msg_iov = &iov, ... }; - *(unsigned long *)(buf + 4) = 0xdeadbeef; // fake vcc pointer - sendmsg(fd, &msg, 0); // kernel dereferences 0xdeadbeef - -In normal operation, the kernel sends the vcc pointer to the signaling -daemon via sigd_enq() when processing operations like connect(), bind(), -or listen(). The daemon is expected to return the same pointer when -responding. However, a malicious daemon can send arbitrary pointer values. - -Fix this by introducing find_get_vcc() which validates the pointer by -searching through vcc_hash (similar to how sigd_close() iterates over -all VCCs), and acquires a reference via sock_hold() if found. - -Since struct atm_vcc embeds struct sock as its first member, they share -the same lifetime. Therefore using sock_hold/sock_put is sufficient to -keep the vcc alive while it is being used. - -Note that there may be a race with sigd_close() which could mark the vcc -with various flags (e.g., ATM_VF_RELEASED) after find_get_vcc() returns. -However, sock_hold() guarantees the memory remains valid, so this race -only affects the logical state, not memory safety. - -[1]: https://gist.github.com/mrpre/1ba5949c45529c511152e2f4c755b0f3 -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: syzbot+1f22cb1769f249df9fa0@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/all/69039850.a70a0220.5b2ed.005d.GAE@google.com/T/ -Signed-off-by: Jiayuan Chen -Link: https://patch.msgid.link/20260205095501.131890-1-jiayuan.chen@linux.dev -Signed-off-by: Paolo Abeni -Signed-off-by: Sasha Levin - -diff --git a/net/atm/signaling.c b/net/atm/signaling.c -index 5de06ab8ed75..5a5d8b1fa8be 100644 ---- a/net/atm/signaling.c -+++ b/net/atm/signaling.c -@@ -22,6 +22,36 @@ - - struct atm_vcc *sigd = NULL; - -+/* -+ * find_get_vcc - validate and get a reference to a vcc pointer -+ * @vcc: the vcc pointer to validate -+ * -+ * This function validates that @vcc points to a registered VCC in vcc_hash. -+ * If found, it increments the socket reference count and returns the vcc. -+ * The caller must call sock_put(sk_atm(vcc)) when done. -+ * -+ * Returns the vcc pointer if valid, NULL otherwise. -+ */ -+static struct atm_vcc *find_get_vcc(struct atm_vcc *vcc) -+{ -+ int i; -+ -+ read_lock(&vcc_sklist_lock); -+ for (i = 0; i < VCC_HTABLE_SIZE; i++) { -+ struct sock *s; -+ -+ sk_for_each(s, &vcc_hash[i]) { -+ if (atm_sk(s) == vcc) { -+ sock_hold(s); -+ read_unlock(&vcc_sklist_lock); -+ return vcc; -+ } -+ } -+ } -+ read_unlock(&vcc_sklist_lock); -+ return NULL; -+} -+ - static void sigd_put_skb(struct sk_buff *skb) - { - if (!sigd) { -@@ -69,7 +99,14 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb) - - msg = (struct atmsvc_msg *) skb->data; - WARN_ON(refcount_sub_and_test(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc)); -- vcc = *(struct atm_vcc **) &msg->vcc; -+ -+ vcc = find_get_vcc(*(struct atm_vcc **)&msg->vcc); -+ if (!vcc) { -+ pr_debug("invalid vcc pointer in msg\n"); -+ dev_kfree_skb(skb); -+ return -EINVAL; -+ } -+ - pr_debug("%d (0x%lx)\n", (int)msg->type, (unsigned long)vcc); - sk = sk_atm(vcc); - -@@ -100,7 +137,16 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb) - clear_bit(ATM_VF_WAITING, &vcc->flags); - break; - case as_indicate: -- vcc = *(struct atm_vcc **)&msg->listen_vcc; -+ /* Release the reference from msg->vcc, we'll use msg->listen_vcc instead */ -+ sock_put(sk); -+ -+ vcc = find_get_vcc(*(struct atm_vcc **)&msg->listen_vcc); -+ if (!vcc) { -+ pr_debug("invalid listen_vcc pointer in msg\n"); -+ dev_kfree_skb(skb); -+ return -EINVAL; -+ } -+ - sk = sk_atm(vcc); - pr_debug("as_indicate!!!\n"); - lock_sock(sk); -@@ -115,6 +161,8 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb) - sk->sk_state_change(sk); - as_indicate_complete: - release_sock(sk); -+ /* Paired with find_get_vcc(msg->listen_vcc) above */ -+ sock_put(sk); - return 0; - case as_close: - set_bit(ATM_VF_RELEASED, &vcc->flags); -@@ -131,11 +179,15 @@ static int sigd_send(struct atm_vcc *vcc, struct sk_buff *skb) - break; - default: - pr_alert("bad message type %d\n", (int)msg->type); -+ /* Paired with find_get_vcc(msg->vcc) above */ -+ sock_put(sk); - return -EINVAL; - } - sk->sk_state_change(sk); - out: - dev_kfree_skb(skb); -+ /* Paired with find_get_vcc(msg->vcc) above */ -+ sock_put(sk); - return 0; - } - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1697-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch b/SOURCES/1697-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch deleted file mode 100644 index 7701eb292..000000000 --- a/SOURCES/1697-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch +++ /dev/null @@ -1,168 +0,0 @@ -From b0a090e60d8e8e0fade225dfc62b43e2ac9912cc Mon Sep 17 00:00:00 2001 -From: Nilesh Javali -Date: Thu, 19 Mar 2026 14:52:28 +0530 -Subject: [PATCH] scsi: qla2xxx: Add support to report MPI FW state - -JIRA: https://redhat.atlassian.net/browse/RHEL-157284 - -Upstream Status: git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi.git - -Note: Resolve conflict due to divergence in code base from upstream - -commit 0e124af675ebabddacfeb0958abd443265dddf13 -Author: Nilesh Javali -Date: Thu Mar 5 15:03:37 2026 +0530 - - scsi: qla2xxx: Add support to report MPI FW state - - MPI firmware state was returned as 0. Get MPI FW state to proceed with - flash image validation. - - A new sysfs node 'mpi_fw_state' is added to report MPI firmware state: - - /sys/class/scsi_host/hostXX/mpi_fw_state - - Fixes: d74181ca110e ("scsi: qla2xxx: Add bsg interface to support firmware img validation") - Signed-off-by: Nilesh Javali - Link: https://patch.msgid.link/20260305093337.2007205-1-njavali@marvell.com - Signed-off-by: Martin K. Petersen - -Signed-off-by: Nilesh Javali - -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index aa1525008500..9a506d6be335 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -1645,7 +1645,7 @@ qla2x00_fw_state_show(struct device *dev, struct device_attribute *attr, - { - scsi_qla_host_t *vha = shost_priv(class_to_shost(dev)); - int rval = QLA_FUNCTION_FAILED; -- uint16_t state[6]; -+ uint16_t state[16]; - uint32_t pstate; - - if (IS_QLAFX00(vha->hw)) { -@@ -2409,6 +2409,63 @@ qla2x00_dport_diagnostics_show(struct device *dev, - vha->dport_data[0], vha->dport_data[1], - vha->dport_data[2], vha->dport_data[3]); - } -+ -+static ssize_t -+qla2x00_mpi_fw_state_show(struct device *dev, struct device_attribute *attr, -+ char *buf) -+{ -+ scsi_qla_host_t *vha = shost_priv(class_to_shost(dev)); -+ int rval = QLA_FUNCTION_FAILED; -+ u16 state[16]; -+ u16 mpi_state; -+ struct qla_hw_data *ha = vha->hw; -+ -+ if (!(IS_QLA27XX(ha) || IS_QLA28XX(ha))) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI state reporting is not supported for this HBA.\n"); -+ -+ memset(state, 0, sizeof(state)); -+ -+ mutex_lock(&vha->hw->optrom_mutex); -+ if (qla2x00_chip_is_down(vha)) { -+ mutex_unlock(&vha->hw->optrom_mutex); -+ ql_dbg(ql_dbg_user, vha, 0x70df, -+ "ISP reset is in progress, failing mpi_fw_state.\n"); -+ return -EBUSY; -+ } else if (vha->hw->flags.eeh_busy) { -+ mutex_unlock(&vha->hw->optrom_mutex); -+ ql_dbg(ql_dbg_user, vha, 0x70ea, -+ "HBA in PCI error state, failing mpi_fw_state.\n"); -+ return -EBUSY; -+ } -+ -+ rval = qla2x00_get_firmware_state(vha, state); -+ mutex_unlock(&vha->hw->optrom_mutex); -+ if (rval != QLA_SUCCESS) { -+ ql_dbg(ql_dbg_user, vha, 0x70eb, -+ "MB Command to retrieve MPI state failed (%d), failing mpi_fw_state.\n", -+ rval); -+ return -EIO; -+ } -+ -+ mpi_state = state[11]; -+ -+ if (!(mpi_state & BIT_15)) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware state reporting is not supported by this firmware. (0x%02x)\n", -+ mpi_state); -+ -+ if (!(mpi_state & BIT_8)) -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware is disabled. (0x%02x)\n", -+ mpi_state); -+ -+ return scnprintf(buf, PAGE_SIZE, -+ "MPI firmware is enabled, state is %s. (0x%02x)\n", -+ mpi_state & BIT_9 ? "active" : "inactive", -+ mpi_state); -+} -+ - static DEVICE_ATTR(dport_diagnostics, 0444, - qla2x00_dport_diagnostics_show, NULL); - -@@ -2476,6 +2533,8 @@ static DEVICE_ATTR(port_speed, 0644, qla2x00_port_speed_show, - qla2x00_port_speed_store); - static DEVICE_ATTR(port_no, 0444, qla2x00_port_no_show, NULL); - static DEVICE_ATTR(fw_attr, 0444, qla2x00_fw_attr_show, NULL); -+static DEVICE_ATTR(mpi_fw_state, 0444, qla2x00_mpi_fw_state_show, NULL); -+ - - - struct device_attribute *qla2x00_host_attrs[] = { -@@ -2525,6 +2584,7 @@ struct device_attribute *qla2x00_host_attrs[] = { - NULL, /* reserve for qlini_mode */ - NULL, /* reserve for ql2xiniexchg */ - NULL, /* reserve for ql2xexchoffld */ -+ &dev_attr_mpi_fw_state, - NULL, - }; - -diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c -index 081f5d5c63af..5fa28b10bbb7 100644 ---- a/drivers/scsi/qla2xxx/qla_init.c -+++ b/drivers/scsi/qla2xxx/qla_init.c -@@ -4916,7 +4916,7 @@ qla2x00_fw_ready(scsi_qla_host_t *vha) - unsigned long wtime, mtime, cs84xx_time; - uint16_t min_wait; /* Minimum wait time if loop is down */ - uint16_t wait_time; /* Wait time if loop is coming ready */ -- uint16_t state[6]; -+ uint16_t state[16]; - struct qla_hw_data *ha = vha->hw; - - if (IS_QLAFX00(vha->hw)) -diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c -index d0f09f0a2459..e3ee26058901 100644 ---- a/drivers/scsi/qla2xxx/qla_mbx.c -+++ b/drivers/scsi/qla2xxx/qla_mbx.c -@@ -2266,6 +2266,13 @@ qla2x00_get_firmware_state(scsi_qla_host_t *vha, uint16_t *states) - mcp->in_mb = MBX_6|MBX_5|MBX_4|MBX_3|MBX_2|MBX_1|MBX_0; - else - mcp->in_mb = MBX_1|MBX_0; -+ -+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) { -+ mcp->mb[12] = 0; -+ mcp->out_mb |= MBX_12; -+ mcp->in_mb |= MBX_12; -+ } -+ - mcp->tov = MBX_TOV_SECONDS; - mcp->flags = 0; - rval = qla2x00_mailbox_command(vha, mcp); -@@ -2278,6 +2285,8 @@ qla2x00_get_firmware_state(scsi_qla_host_t *vha, uint16_t *states) - states[3] = mcp->mb[4]; - states[4] = mcp->mb[5]; - states[5] = mcp->mb[6]; /* DPORT status */ -+ if (IS_QLA27XX(ha) || IS_QLA28XX(ha)) -+ states[11] = mcp->mb[12]; /* MPI state. */ - } - - if (rval != QLA_SUCCESS) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1698-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch b/SOURCES/1698-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch deleted file mode 100644 index e63d68f44..000000000 --- a/SOURCES/1698-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch +++ /dev/null @@ -1,131 +0,0 @@ -From 84ffde44e62f1991a6908f9bb5aba06aad2d7dda Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - use API helpers to setup fallback request - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into the upstream linux.git - -commit c1024581ff2c34db4fdfe857b29f606e5117eb12 -Author: Ovidiu Panait -Date: Mon Apr 7 15:36:04 2025 +0300 - - crypto: tegra - use API helpers to setup fallback request - - Rather than setting up the fallback request by hand, use - ahash_request_set_callback() and ahash_request_set_crypt() API helpers - to properly setup the new request. - - Signed-off-by: Ovidiu Panait - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 90bf34eb3578..e3fe5911a324 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -118,8 +118,9 @@ static int tegra_sha_fallback_init(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_init(&rctx->fallback_req); - } -@@ -131,10 +132,10 @@ static int tegra_sha_fallback_update(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, NULL, req->nbytes); - - return crypto_ahash_update(&rctx->fallback_req); - } -@@ -146,9 +147,10 @@ static int tegra_sha_fallback_final(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, NULL, req->result, 0); - - return crypto_ahash_final(&rctx->fallback_req); - } -@@ -160,12 +162,11 @@ static int tegra_sha_fallback_finup(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, req->result, -+ req->nbytes); - - return crypto_ahash_finup(&rctx->fallback_req); - } -@@ -177,12 +178,11 @@ static int tegra_sha_fallback_digest(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -- -- rctx->fallback_req.nbytes = req->nbytes; -- rctx->fallback_req.src = req->src; -- rctx->fallback_req.result = req->result; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); -+ ahash_request_set_crypt(&rctx->fallback_req, req->src, req->result, -+ req->nbytes); - - return crypto_ahash_digest(&rctx->fallback_req); - } -@@ -194,8 +194,9 @@ static int tegra_sha_fallback_import(struct ahash_request *req, const void *in) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_import(&rctx->fallback_req, in); - } -@@ -207,8 +208,9 @@ static int tegra_sha_fallback_export(struct ahash_request *req, void *out) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(tfm); - - ahash_request_set_tfm(&rctx->fallback_req, ctx->fallback_tfm); -- rctx->fallback_req.base.flags = req->base.flags & -- CRYPTO_TFM_REQ_MAY_SLEEP; -+ ahash_request_set_callback(&rctx->fallback_req, -+ req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP, -+ req->base.complete, req->base.data); - - return crypto_ahash_export(&rctx->fallback_req, out); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1699-crypto-tegra-remove-the-use-of-dev-err-probe.patch b/SOURCES/1699-crypto-tegra-remove-the-use-of-dev-err-probe.patch deleted file mode 100644 index 7127e9dcf..000000000 --- a/SOURCES/1699-crypto-tegra-remove-the-use-of-dev-err-probe.patch +++ /dev/null @@ -1,46 +0,0 @@ -From 4a06bd56527fed781c5cffff4d0f0203841fbc80 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Remove the use of dev_err_probe() - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into the upstream linux.git - -commit 8595bcb09b05a6c712c35f03ef701e7785895b51 -Author: Liao Yuanhong -Date: Wed Aug 20 20:37:52 2025 +0800 - - crypto: tegra - Remove the use of dev_err_probe() - - Logging messages that show some type of "out of memory" error are generally - unnecessary as there is a generic message and a stack dump done by the - memory subsystem. These messages generally increase kernel size without - much added value[1]. - - The dev_err_probe() doesn't do anything when error is '-ENOMEM'. Therefore, - remove the useless call to dev_err_probe(), and just return the value - instead. - - [1]: https://lore.kernel.org/lkml/1402419340.30479.18.camel@joe-AO725/ - - Signed-off-by: Liao Yuanhong - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c -index 63afb0556acf..81facb649ec6 100644 ---- a/drivers/crypto/tegra/tegra-se-main.c -+++ b/drivers/crypto/tegra/tegra-se-main.c -@@ -310,7 +310,7 @@ static int tegra_se_probe(struct platform_device *pdev) - - se->engine = crypto_engine_alloc_init(dev, 0); - if (!se->engine) -- return dev_err_probe(dev, -ENOMEM, "failed to init crypto engine\n"); -+ return -ENOMEM; - - ret = crypto_engine_start(se->engine); - if (ret) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1700-crypto-tegra-use-int-type-to-store-negative-error-codes.patch b/SOURCES/1700-crypto-tegra-use-int-type-to-store-negative-error-codes.patch deleted file mode 100644 index 739536b36..000000000 --- a/SOURCES/1700-crypto-tegra-use-int-type-to-store-negative-error-codes.patch +++ /dev/null @@ -1,43 +0,0 @@ -From e27f636604e6817fe00db4b37af61ac76a14c1ee Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Use int type to store negative error codes - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into the upstream linux.git - -commit a710a71cd8ad294937e03b352cd71deb7ad08700 -Author: Qianfeng Rong -Date: Wed Sep 3 21:25:37 2025 +0800 - - crypto: tegra - Use int type to store negative error codes - - Change the 'ret' variable in tegra_sha_do_update() from unsigned int to - int, as it needs to store either negative error codes or zero returned - by tegra_se_host1x_submit(). - - No effect on runtime. - - Signed-off-by: Qianfeng Rong - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index e3fe5911a324..79f1e5c9b729 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -401,8 +401,9 @@ static int tegra_sha_do_update(struct ahash_request *req) - struct tegra_sha_ctx *ctx = crypto_ahash_ctx(crypto_ahash_reqtfm(req)); - struct tegra_sha_reqctx *rctx = ahash_request_ctx(req); - struct tegra_se *se = ctx->se; -- unsigned int nblks, nresidue, size, ret; -+ unsigned int nblks, nresidue, size; - u32 *cpuvaddr = se->cmdbuf->addr; -+ int ret; - - nresidue = (req->nbytes + rctx->residue.size) % rctx->blk_size; - nblks = (req->nbytes + rctx->residue.size) / rctx->blk_size; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1701-crypto-tegra-add-missing-crypto-alg-async.patch b/SOURCES/1701-crypto-tegra-add-missing-crypto-alg-async.patch deleted file mode 100644 index 3d17a3557..000000000 --- a/SOURCES/1701-crypto-tegra-add-missing-crypto-alg-async.patch +++ /dev/null @@ -1,224 +0,0 @@ -From 67d735aa5c6e4d048175700e89cb267d82db8d37 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Add missing CRYPTO_ALG_ASYNC - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into the upstream linux.git -CVE: CVE-2026-31739 - -commit 4b56770d345524fc2acc143a2b85539cf7d74bc1 -Author: Eric Biggers -Date: Mon Mar 16 13:21:19 2026 -0700 - - crypto: tegra - Add missing CRYPTO_ALG_ASYNC - - The tegra crypto driver failed to set the CRYPTO_ALG_ASYNC on its - asynchronous algorithms, causing the crypto API to select them for users - that request only synchronous algorithms. This causes crashes (at - least). Fix this by adding the flag like what the other drivers do. - Also remove the unnecessary CRYPTO_ALG_TYPE_* flags, since those just - get ignored and overridden by the registration function anyway. - - Reported-by: Zorro Lang - Closes: https://lore.kernel.org/r/20260314080937.pghb4aa7d4je3mhh@dell-per750-06-vm-08.rhts.eng.pek2.redhat.com - Fixes: 0880bb3b00c8 ("crypto: tegra - Add Tegra Security Engine driver") - Cc: stable@vger.kernel.org - Cc: Akhil R - Signed-off-by: Eric Biggers - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 8b91f00b9c31..30c78afe3dea 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -532,7 +532,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "cbc(aes)", - .cra_driver_name = "cbc-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -553,7 +553,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "ecb(aes)", - .cra_driver_name = "ecb-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -575,7 +575,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "ctr(aes)", - .cra_driver_name = "ctr-aes-tegra", - .cra_priority = 500, -- .cra_flags = CRYPTO_ALG_TYPE_SKCIPHER | CRYPTO_ALG_ASYNC, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = 0xf, -@@ -597,6 +597,7 @@ static struct tegra_se_alg tegra_aes_algs[] = { - .cra_name = "xts(aes)", - .cra_driver_name = "xts-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_aes_ctx), - .cra_alignmask = (__alignof__(u64) - 1), -@@ -1931,6 +1932,7 @@ static struct tegra_se_alg tegra_aead_algs[] = { - .cra_name = "gcm(aes)", - .cra_driver_name = "gcm-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aead_ctx), - .cra_alignmask = 0xf, -@@ -1953,6 +1955,7 @@ static struct tegra_se_alg tegra_aead_algs[] = { - .cra_name = "ccm(aes)", - .cra_driver_name = "ccm-aes-tegra", - .cra_priority = 500, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct tegra_aead_ctx), - .cra_alignmask = 0xf, -@@ -1980,7 +1983,7 @@ static struct tegra_se_alg tegra_cmac_algs[] = { - .cra_name = "cmac(aes)", - .cra_driver_name = "tegra-se-cmac", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_cmac_ctx), - .cra_alignmask = 0, -diff --git a/drivers/crypto/tegra/tegra-se-hash.c b/drivers/crypto/tegra/tegra-se-hash.c -index 79f1e5c9b729..23d549801612 100644 ---- a/drivers/crypto/tegra/tegra-se-hash.c -+++ b/drivers/crypto/tegra/tegra-se-hash.c -@@ -764,7 +764,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha1", - .cra_driver_name = "tegra-se-sha1", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA1_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -789,7 +789,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha224", - .cra_driver_name = "tegra-se-sha224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -814,7 +814,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha256", - .cra_driver_name = "tegra-se-sha256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -839,7 +839,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha384", - .cra_driver_name = "tegra-se-sha384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -864,7 +864,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha512", - .cra_driver_name = "tegra-se-sha512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -889,7 +889,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-224", - .cra_driver_name = "tegra-se-sha3-224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -914,7 +914,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-256", - .cra_driver_name = "tegra-se-sha3-256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -939,7 +939,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-384", - .cra_driver_name = "tegra-se-sha3-384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -964,7 +964,7 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "sha3-512", - .cra_driver_name = "tegra-se-sha3-512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH, -+ .cra_flags = CRYPTO_ALG_ASYNC, - .cra_blocksize = SHA3_512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -991,7 +991,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha224)", - .cra_driver_name = "tegra-se-hmac-sha224", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA224_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1018,7 +1019,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha256)", - .cra_driver_name = "tegra-se-hmac-sha256", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA256_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1045,7 +1047,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha384)", - .cra_driver_name = "tegra-se-hmac-sha384", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA384_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, -@@ -1072,7 +1075,8 @@ static struct tegra_se_alg tegra_hash_algs[] = { - .cra_name = "hmac(sha512)", - .cra_driver_name = "tegra-se-hmac-sha512", - .cra_priority = 300, -- .cra_flags = CRYPTO_ALG_TYPE_AHASH | CRYPTO_ALG_NEED_FALLBACK, -+ .cra_flags = CRYPTO_ALG_ASYNC | -+ CRYPTO_ALG_NEED_FALLBACK, - .cra_blocksize = SHA512_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct tegra_sha_ctx), - .cra_alignmask = 0, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1702-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch b/SOURCES/1702-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch deleted file mode 100644 index db7a8c780..000000000 --- a/SOURCES/1702-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 6c2f9f0720ab7b65156de8b88918766401d70614 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Don't touch bo refcount in host1x bo - pin/unpin - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into the upstream linux.git - -commit f8c9c57d750346abd213ffed2ae3cacb0268e9f1 -Author: Mikko Perttunen -Date: Fri May 15 11:34:52 2026 +0900 - - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin - - Since commit "gpu: host1x: Allow entries in BO caches to be freed", - host1x_bo_pin() and host1x_bo_unpin() handle the bo's refcount - themselves. .pin/.unpin callbacks should not adjust it. - - Signed-off-by: Mikko Perttunen - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-main.c b/drivers/crypto/tegra/tegra-se-main.c -index 81facb649ec6..35ec98e9569e 100644 ---- a/drivers/crypto/tegra/tegra-se-main.c -+++ b/drivers/crypto/tegra/tegra-se-main.c -@@ -52,7 +52,7 @@ tegra_se_cmdbuf_pin(struct device *dev, struct host1x_bo *bo, enum dma_data_dire - return ERR_PTR(-ENOMEM); - - kref_init(&map->ref); -- map->bo = host1x_bo_get(bo); -+ map->bo = bo; - map->direction = direction; - map->dev = dev; - -@@ -93,7 +93,6 @@ static void tegra_se_cmdbuf_unpin(struct host1x_bo_mapping *map) - dma_unmap_sgtable(map->dev, map->sgt, map->direction, 0); - sg_free_table(map->sgt); - kfree(map->sgt); -- host1x_bo_put(map->bo); - - kfree(map); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1703-crypto-tegra-fix-dma-free-coherent-size-error.patch b/SOURCES/1703-crypto-tegra-fix-dma-free-coherent-size-error.patch deleted file mode 100644 index 28efb8c88..000000000 --- a/SOURCES/1703-crypto-tegra-fix-dma-free-coherent-size-error.patch +++ /dev/null @@ -1,127 +0,0 @@ -From cfbcdc45a8a605bc55aa4dffaca84e8936ef81c1 Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Fix dma_free_coherent size error - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into herbert/crypto-2.6.git - -commit 03215b8457784540acc741e6331e355b62c6c8ab -Author: Herbert Xu -Date: Tue May 19 12:22:18 2026 +0800 - - crypto: tegra - Fix dma_free_coherent size error - - When freeing a coherent DMA buffer, the size must match the value - that was used during the allocation. - - Unfortunately the size field in the tegra driver gets overwritten - by this point so it no longer matches and creates a warning. - - Fix this by saving a copy of the size on the stack. - - Note that the ccm function actually mixes up the inbuf and outbuf - sizes, but it doesn't matter because the two sizes are actually - equal. - - Fixes: 1cb328da4e8f ("crypto: tegra - Do not use fixed size buffers") - Reporeted-by: Patrick Talbert - Signed-off-by: Herbert Xu - Reviewed-by: Vladislav Dronov - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 30c78afe3dea..5086e7f140c3 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -1201,6 +1201,7 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm); - struct tegra_se *se = ctx->se; -+ unsigned int bufsize; - int ret; - - ret = tegra_ccm_crypt_init(req, se, rctx); -@@ -1210,14 +1211,15 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->key_id = ctx->key_id; - - /* Allocate buffers required */ -- rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size, -+ bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -+ rctx->inbuf.size = bufsize; -+ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); - if (!rctx->inbuf.buf) - goto out_finalize; - -- rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen + 100; -- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size, -+ rctx->outbuf.size = bufsize; -+ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); - if (!rctx->outbuf.buf) { - ret = -ENOMEM; -@@ -1254,11 +1256,11 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - } - - out: -- dma_free_coherent(ctx->se->dev, rctx->inbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->outbuf.buf, rctx->outbuf.addr); - - out_free_inbuf: -- dma_free_coherent(ctx->se->dev, rctx->outbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->inbuf.buf, rctx->inbuf.addr); - - if (tegra_key_is_reserved(rctx->key_id)) -@@ -1278,6 +1280,7 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - struct crypto_aead *tfm = crypto_aead_reqtfm(req); - struct tegra_aead_ctx *ctx = crypto_aead_ctx(tfm); - struct tegra_aead_reqctx *rctx = aead_request_ctx(req); -+ unsigned int bufsize; - int ret; - - rctx->src_sg = req->src; -@@ -1296,16 +1299,17 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->key_id = ctx->key_id; - - /* Allocate buffers required */ -- rctx->inbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; -- rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->inbuf.size, -+ bufsize = rctx->assoclen + rctx->authsize + rctx->cryptlen; -+ rctx->inbuf.size = bufsize; -+ rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); - if (!rctx->inbuf.buf) { - ret = -ENOMEM; - goto out_finalize; - } - -- rctx->outbuf.size = rctx->assoclen + rctx->authsize + rctx->cryptlen; -- rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, rctx->outbuf.size, -+ rctx->outbuf.size = bufsize; -+ rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); - if (!rctx->outbuf.buf) { - ret = -ENOMEM; -@@ -1342,11 +1346,11 @@ static int tegra_gcm_do_one_req(struct crypto_engine *engine, void *areq) - ret = tegra_gcm_do_verify(ctx->se, rctx); - - out: -- dma_free_coherent(ctx->se->dev, rctx->outbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->outbuf.buf, rctx->outbuf.addr); - - out_free_inbuf: -- dma_free_coherent(ctx->se->dev, rctx->inbuf.size, -+ dma_free_coherent(ctx->se->dev, bufsize, - rctx->inbuf.buf, rctx->inbuf.addr); - - if (tegra_key_is_reserved(rctx->key_id)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1704-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch b/SOURCES/1704-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch deleted file mode 100644 index 63e09a3c8..000000000 --- a/SOURCES/1704-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch +++ /dev/null @@ -1,52 +0,0 @@ -From 0b918fd4603c0d94c95399e052c4f8a78ecbe44f Mon Sep 17 00:00:00 2001 -From: Vladislav Dronov -Date: Sun, 7 Jun 2026 23:27:48 +0200 -Subject: [PATCH] crypto: tegra - Return ENOMEM when input buffer allocation - fails for ccm - -JIRA: https://redhat.atlassian.net/browse/RHEL-182565 -Upstream Status: merged into herbert/crypto-2.6.git - -commit 690a5f9e5c972a580565ce544ed1627ccf1e84de -Author: Herbert Xu -Date: Wed May 20 10:51:14 2026 +0800 - - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm - - Ensure the ENOMEM error value is set when the input buffer allocation - fails in tegra_ccm_do_one_req. - - Fixes: 1e245948ca0c ("crypto: tegra - finalize crypto req on error") - Reported-by: Vladislav Dronov - Signed-off-by: Herbert Xu - Reviewed-by: Vladislav Dronov - Signed-off-by: Herbert Xu - -Signed-off-by: Vladislav Dronov - -diff --git a/drivers/crypto/tegra/tegra-se-aes.c b/drivers/crypto/tegra/tegra-se-aes.c -index 5086e7f140c3..9094c03e991f 100644 ---- a/drivers/crypto/tegra/tegra-se-aes.c -+++ b/drivers/crypto/tegra/tegra-se-aes.c -@@ -1215,16 +1215,15 @@ static int tegra_ccm_do_one_req(struct crypto_engine *engine, void *areq) - rctx->inbuf.size = bufsize; - rctx->inbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->inbuf.addr, GFP_KERNEL); -+ ret = -ENOMEM; - if (!rctx->inbuf.buf) - goto out_finalize; - - rctx->outbuf.size = bufsize; - rctx->outbuf.buf = dma_alloc_coherent(ctx->se->dev, bufsize, - &rctx->outbuf.addr, GFP_KERNEL); -- if (!rctx->outbuf.buf) { -- ret = -ENOMEM; -+ if (!rctx->outbuf.buf) - goto out_free_inbuf; -- } - - if (!ctx->key_id) { - ret = tegra_key_submit_reserved_aes(ctx->se, ctx->key, --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1705-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch b/SOURCES/1705-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch deleted file mode 100644 index d4d633031..000000000 --- a/SOURCES/1705-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch +++ /dev/null @@ -1,293 +0,0 @@ -From 858d2a4f67ff69e645a43487ef7ea7f28f06deae Mon Sep 17 00:00:00 2001 -From: Eric Dumazet -Date: Tue, 17 Feb 2026 16:12:05 +0000 -Subject: [PATCH] tcp: fix potential race in tcp_v6_syn_recv_sock() - -Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() -is done too late. - -After tcp_v4_syn_recv_sock(), the child socket is already visible -from TCP ehash table and other cpus might use it. - -Since newinet->pinet6 is still pointing to the listener ipv6_pinfo -bad things can happen as syzbot found. - -Move the problematic code in tcp_v6_mapped_child_init() -and call this new helper from tcp_v4_syn_recv_sock() before -the ehash insertion. - -This allows the removal of one tcp_sync_mss(), since -tcp_v4_syn_recv_sock() will call it with the correct -context. - -Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") -Reported-by: syzbot+937b5bbb6a815b3e5d0b@syzkaller.appspotmail.com -Closes: https://lore.kernel.org/netdev/69949275.050a0220.2eeac1.0145.GAE@google.com/ -Signed-off-by: Eric Dumazet -Reviewed-by: Kuniyuki Iwashima -Link: https://patch.msgid.link/20260217161205.2079883-1-edumazet@google.com -Signed-off-by: Jakub Kicinski - -diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h -index 35bb5af..0cd481d 100644 ---- a/include/net/inet_connection_sock.h -+++ b/include/net/inet_connection_sock.h -@@ -41,7 +41,9 @@ struct inet_connection_sock_af_ops { - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req); -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)); - u16 net_header_len; - u16 net_frag_header_len; - u16 sockaddr_len; -diff --git a/include/net/tcp.h b/include/net/tcp.h -index d0f76cd..b1a3eb9 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -470,7 +470,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req); -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)); - int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb); - int tcp_v4_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len); - int tcp_connect(struct sock *sk); -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index 4164926..f243e6a 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -201,7 +201,7 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb, - bool own_req; - - child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, -- NULL, &own_req); -+ NULL, &own_req, NULL); - if (child) { - refcount_set(&req->rsk_refcnt, 1); - tcp_sk(child)->tsoffset = tsoff; -diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c -index 10aa010..912eaef 100644 ---- a/net/ipv4/tcp_fastopen.c -+++ b/net/ipv4/tcp_fastopen.c -@@ -262,7 +262,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, - bool own_req; - - child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, -- NULL, &own_req); -+ NULL, &own_req, NULL); - if (!child) - return NULL; - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index f029f01..e90bf04 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -1499,7 +1499,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct inet_request_sock *ireq; - bool found_dup_sk = false; -@@ -1555,6 +1557,10 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - } - sk_setup_caps(newsk, dst); - -+#if IS_ENABLED(CONFIG_IPV6) -+ if (opt_child_init) -+ opt_child_init(newsk, sk); -+#endif - tcp_ca_openreq_child(newsk, dst); - - tcp_sync_mss(newsk, dst_mtu(dst)); -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 6c6850f..c0f26b0 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -782,7 +782,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, - * socket is created, wait for troubles. - */ - child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, -- req, &own_req); -+ req, &own_req, NULL); - if (!child) - goto listen_overflow; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 979e3c8..a00876b 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1188,11 +1188,48 @@ static void tcp_v6_restore_cb(struct sk_buff *skb) - sizeof(struct inet6_skb_parm)); - } - -+/* Called from tcp_v4_syn_recv_sock() for v6_mapped children. */ -+static void tcp_v6_mapped_child_init(struct sock *newsk, const struct sock *sk) -+{ -+ struct inet_sock *newinet = inet_sk(newsk); -+ struct ipv6_pinfo *newnp; -+ -+ newinet->pinet6 = newnp = tcp_inet6_sk(newsk); -+ -+ memcpy(newnp, tcp_inet6_sk(sk), sizeof(struct ipv6_pinfo)); -+ -+ newnp->saddr = newsk->sk_v6_rcv_saddr; -+ -+ inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; -+ if (sk_is_mptcp(newsk)) -+ mptcpv6_handle_mapped(newsk, true); -+ newsk->sk_backlog_rcv = tcp_v4_do_rcv; -+#if defined(CONFIG_TCP_MD5SIG) -+ tcp_sk(newsk)->af_specific = &tcp_sock_ipv6_mapped_specific; -+#endif -+ -+ newnp->ipv6_mc_list = NULL; -+ newnp->ipv6_ac_list = NULL; -+ newnp->ipv6_fl_list = NULL; -+ newnp->pktoptions = NULL; -+ newnp->opt = NULL; -+ -+ /* tcp_v4_syn_recv_sock() has initialized newinet->mc_{index,ttl} */ -+ newnp->mcast_oif = newinet->mc_index; -+ newnp->mcast_hops = newinet->mc_ttl; -+ -+ newnp->rcv_flowinfo = 0; -+ if (tcp_inet6_sk(sk)->repflow) -+ newnp->flow_label = 0; -+} -+ - static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct inet_request_sock *ireq; - struct ipv6_pinfo *newnp; -@@ -1208,61 +1245,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - #endif - struct flowi6 fl6; - -- if (skb->protocol == htons(ETH_P_IP)) { -- /* -- * v6 mapped -- */ -- -- newsk = tcp_v4_syn_recv_sock(sk, skb, req, dst, -- req_unhash, own_req); -- -- if (!newsk) -- return NULL; -- -- inet_sk(newsk)->pinet6 = tcp_inet6_sk(newsk); -- -- newinet = inet_sk(newsk); -- newnp = tcp_inet6_sk(newsk); -- newtp = tcp_sk(newsk); -- -- memcpy(newnp, np, sizeof(struct ipv6_pinfo)); -- -- newnp->saddr = newsk->sk_v6_rcv_saddr; -- -- inet_csk(newsk)->icsk_af_ops = &ipv6_mapped; -- if (sk_is_mptcp(newsk)) -- mptcpv6_handle_mapped(newsk, true); -- newsk->sk_backlog_rcv = tcp_v4_do_rcv; --#ifdef CONFIG_TCP_MD5SIG -- newtp->af_specific = &tcp_sock_ipv6_mapped_specific; --#endif -- -- newnp->ipv6_mc_list = NULL; -- newnp->ipv6_ac_list = NULL; -- newnp->ipv6_fl_list = NULL; -- newnp->pktoptions = NULL; -- newnp->opt = NULL; -- newnp->mcast_oif = inet_iif(skb); -- newnp->mcast_hops = ip_hdr(skb)->ttl; -- newnp->rcv_flowinfo = 0; -- if (np->repflow) -- newnp->flow_label = 0; -- -- /* -- * No need to charge this sock to the relevant IPv6 refcnt debug socks count -- * here, tcp_create_openreq_child now does this for us, see the comment in -- * that function for the gory details. -acme -- */ -- -- /* It is tricky place. Until this moment IPv4 tcp -- worked with IPv6 icsk.icsk_af_ops. -- Sync it now. -- */ -- tcp_sync_mss(newsk, inet_csk(newsk)->icsk_pmtu_cookie); -- -- return newsk; -- } -- -+ if (skb->protocol == htons(ETH_P_IP)) -+ return tcp_v4_syn_recv_sock(sk, skb, req, dst, -+ req_unhash, own_req, -+ tcp_v6_mapped_child_init); - ireq = inet_rsk(req); - - if (sk_acceptq_is_full(sk)) -diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c -index b6cd4d5..3329917 100644 ---- a/net/mptcp/subflow.c -+++ b/net/mptcp/subflow.c -@@ -805,7 +805,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk); - struct mptcp_subflow_request_sock *subflow_req; -@@ -852,7 +854,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, - - create_child: - child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst, -- req_unhash, own_req); -+ req_unhash, own_req, opt_child_init); - - if (child && *own_req) { - struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child); -diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c -index 3de4169..2dfa3ec 100644 ---- a/net/smc/af_smc.c -+++ b/net/smc/af_smc.c -@@ -124,7 +124,9 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, - struct request_sock *req, - struct dst_entry *dst, - struct request_sock *req_unhash, -- bool *own_req) -+ bool *own_req, -+ void (*opt_child_init)(struct sock *newsk, -+ const struct sock *sk)) - { - struct smc_sock *smc; - struct sock *child; -@@ -142,7 +144,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, - - /* passthrough to original syn recv sock fct */ - child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, -- own_req); -+ own_req, opt_child_init); - /* child must not inherit smc or its ops */ - if (child) { - rcu_assign_sk_user_data(child, NULL); diff --git a/SOURCES/1706-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch b/SOURCES/1706-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch deleted file mode 100644 index 428499fea..000000000 --- a/SOURCES/1706-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch +++ /dev/null @@ -1,45 +0,0 @@ -From aeb0d0a32bda58a858acd0abc31a0b4a9243e271 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:06:53 +0200 -Subject: [PATCH] crypto: testmgr - allow - authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode - -JIRA: https://redhat.atlassian.net/browse/RHEL-182254 -Upstream Status: Posted https://lore.kernel.org/linux-crypto/20260603155008.736872-1-idryomov@gmail.com/ - -hmac(sha256), hmac(sha384) and cts(cbc(aes)) algorithms have been -marked as FIPS allowed for years. Mark the respective authenc() -constructions per RFC 8009 ("AES Encryption with HMAC-SHA2 for -Kerberos 5") as such as well. - -SP 800-57 Part 3 Rev. 1 from Jan 2015 [1] links the draft of what -became RFC 8009 in Oct 2016 as approved in section 6.3 Procurement -Guidance (item/recommendation 3). - -[1] https://csrc.nist.gov/pubs/sp/800/57/pt3/r1/final - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/testmgr.c b/crypto/testmgr.c -index de885bfe4c2b..7c80412e5ff7 100644 ---- a/crypto/testmgr.c -+++ b/crypto/testmgr.c -@@ -4374,6 +4374,7 @@ static const struct alg_test_desc alg_test_descs[] = { - }, { - .alg = "authenc(hmac(sha256),cts(cbc(aes)))", - .test = alg_test_aead, -+ .fips_allowed = 1, - .suite = { - .aead = __VECS(krb5_test_aes128_cts_hmac_sha256_128) - } -@@ -4400,6 +4401,7 @@ static const struct alg_test_desc alg_test_descs[] = { - }, { - .alg = "authenc(hmac(sha384),cts(cbc(aes)))", - .test = alg_test_aead, -+ .fips_allowed = 1, - .suite = { - .aead = __VECS(krb5_test_aes256_cts_hmac_sha384_192) - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1707-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch b/SOURCES/1707-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch deleted file mode 100644 index 8d21f1354..000000000 --- a/SOURCES/1707-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch +++ /dev/null @@ -1,60 +0,0 @@ -From 34066fd2a30ffc1a423caa991915b56cfd503d1c Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:21 +0200 -Subject: [PATCH] crypto: krb5enc - fix sleepable flag handling in encrypt - dispatch - -JIRA: https://redhat.atlassian.net/browse/RHEL-182254 - -commit 2ef3bac16fb5e9eee4fb1d722578a79b751ea58a -Author: Wesley Atwell -Date: Mon Mar 9 00:26:24 2026 -0600 - - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch - - krb5enc_encrypt_ahash_done() continues encryption from an ahash - completion callback by calling krb5enc_dispatch_encrypt(). - - That helper takes a flags argument for this continuation path, but it - ignored that argument and reused aead_request_flags(req) when setting - up the skcipher subrequest callback. This can incorrectly preserve - CRYPTO_TFM_REQ_MAY_SLEEP when the encrypt step is started from callback - context. - - Preserve the original request flags but clear - CRYPTO_TFM_REQ_MAY_SLEEP for the callback continuation path, and use - the caller-supplied flags when setting up the skcipher subrequest. - - Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") - Assisted-by: Codex:GPT-5 - Signed-off-by: Wesley Atwell - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5enc.c b/crypto/krb5enc.c -index 793eae81aeba..2741ba229995 100644 ---- a/crypto/krb5enc.c -+++ b/crypto/krb5enc.c -@@ -154,7 +154,7 @@ static int krb5enc_dispatch_encrypt(struct aead_request *req, - dst = scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); - - skcipher_request_set_tfm(skreq, enc); -- skcipher_request_set_callback(skreq, aead_request_flags(req), -+ skcipher_request_set_callback(skreq, flags, - krb5enc_encrypt_done, req); - skcipher_request_set_crypt(skreq, src, dst, req->cryptlen, req->iv); - -@@ -193,7 +193,8 @@ static void krb5enc_encrypt_ahash_done(struct crypto_async_request *areq, - - krb5enc_insert_checksum(req, ahreq->result); - -- err = krb5enc_dispatch_encrypt(req, 0); -+ err = krb5enc_dispatch_encrypt(req, -+ aead_request_flags(req) & ~CRYPTO_TFM_REQ_MAY_SLEEP); - if (err != -EINPROGRESS) - aead_request_complete(req, err); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1708-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch b/SOURCES/1708-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch deleted file mode 100644 index 53e2aab2d..000000000 --- a/SOURCES/1708-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch +++ /dev/null @@ -1,169 +0,0 @@ -From eebdcc2ddddf6708964baec467161fbffc0de910 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:35 +0200 -Subject: [PATCH] crypto: krb5enc - fix async decrypt skipping hash - verification - -JIRA: https://redhat.atlassian.net/browse/RHEL-182254 -Conflicts: -- crypto_completion_t data can't be accessed directly in RHEL - -commit 3bfbf5f0a99c991769ec562721285df7ab69240b -Author: Dudu Lu -Date: Mon Apr 20 12:40:27 2026 +0800 - - crypto: krb5enc - fix async decrypt skipping hash verification - - krb5enc_dispatch_decrypt() sets req->base.complete as the skcipher - callback, which is the caller's own completion handler. When the - skcipher completes asynchronously, this signals "done" to the caller - without executing krb5enc_dispatch_decrypt_hash(), completely bypassing - the integrity verification (hash check). - - Compare with the encrypt path which correctly uses - krb5enc_encrypt_done as an intermediate callback to chain into the - hash computation on async completion. - - Fix by adding krb5enc_decrypt_done as an intermediate callback that - chains into krb5enc_dispatch_decrypt_hash() upon async skcipher - completion, matching the encrypt path's callback pattern. - - Also fix EBUSY/EINPROGRESS handling throughout: remove - krb5enc_request_complete() which incorrectly swallowed EINPROGRESS - notifications that must be passed up to callers waiting on backlogged - requests, and add missing EBUSY checks in krb5enc_encrypt_ahash_done - for the dispatch_encrypt return value. - - Fixes: d1775a177f7f ("crypto: Add 'krb5enc' hash and cipher AEAD algorithm") - Signed-off-by: Dudu Lu - - Unset MAY_BACKLOG on the async completion path so the user won't - see back-to-back EINPROGRESS notifications. - - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5enc.c b/crypto/krb5enc.c -index 2741ba229995..1e7b4fc8ed8c 100644 ---- a/crypto/krb5enc.c -+++ b/crypto/krb5enc.c -@@ -39,12 +39,6 @@ struct krb5enc_request_ctx { - char tail[]; - }; - --static void krb5enc_request_complete(struct aead_request *req, int err) --{ -- if (err != -EINPROGRESS) -- aead_request_complete(req, err); --} -- - /** - * crypto_krb5enc_extractkeys - Extract Ke and Ki keys from the key blob. - * @keys: Where to put the key sizes and pointers -@@ -127,7 +121,7 @@ static void krb5enc_encrypt_done(struct crypto_async_request *areq, int err) - { - struct aead_request *req = areq->data; - -- krb5enc_request_complete(req, err); -+ aead_request_complete(req, err); - } - - /* -@@ -189,14 +183,16 @@ static void krb5enc_encrypt_ahash_done(struct crypto_async_request *areq, - struct ahash_request *ahreq = (void *)(areq_ctx->tail + ictx->reqoff); - - if (err) -- return krb5enc_request_complete(req, err); -+ goto out; - - krb5enc_insert_checksum(req, ahreq->result); - -- err = krb5enc_dispatch_encrypt(req, -- aead_request_flags(req) & ~CRYPTO_TFM_REQ_MAY_SLEEP); -- if (err != -EINPROGRESS) -- aead_request_complete(req, err); -+ err = krb5enc_dispatch_encrypt(req, 0); -+ if (err == -EINPROGRESS) -+ return; -+ -+out: -+ aead_request_complete(req, err); - } - - /* -@@ -267,17 +263,16 @@ static void krb5enc_decrypt_hash_done(struct crypto_async_request *areq, - { - struct aead_request *req = areq->data; - -- if (err) -- return krb5enc_request_complete(req, err); -- -- err = krb5enc_verify_hash(req); -- krb5enc_request_complete(req, err); -+ if (!err) -+ err = krb5enc_verify_hash(req); -+ aead_request_complete(req, err); - } - - /* - * Dispatch the hashing of the plaintext after we've done the decryption. - */ --static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) -+static int krb5enc_dispatch_decrypt_hash(struct aead_request *req, -+ unsigned int flags) - { - struct crypto_aead *krb5enc = crypto_aead_reqtfm(req); - struct aead_instance *inst = aead_alg_instance(krb5enc); -@@ -293,7 +288,7 @@ static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) - ahash_request_set_tfm(ahreq, auth); - ahash_request_set_crypt(ahreq, req->dst, hash, - req->assoclen + req->cryptlen - authsize); -- ahash_request_set_callback(ahreq, aead_request_flags(req), -+ ahash_request_set_callback(ahreq, flags, - krb5enc_decrypt_hash_done, req); - - err = crypto_ahash_digest(ahreq); -@@ -303,6 +298,21 @@ static int krb5enc_dispatch_decrypt_hash(struct aead_request *req) - return krb5enc_verify_hash(req); - } - -+static void krb5enc_decrypt_done(struct crypto_async_request *areq, int err) -+{ -+ struct aead_request *req = areq->data; -+ -+ if (err) -+ goto out; -+ -+ err = krb5enc_dispatch_decrypt_hash(req, 0); -+ if (err == -EINPROGRESS) -+ return; -+ -+out: -+ aead_request_complete(req, err); -+} -+ - /* - * Dispatch the decryption of the ciphertext. - */ -@@ -326,7 +336,7 @@ static int krb5enc_dispatch_decrypt(struct aead_request *req) - - skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, aead_request_flags(req), -- req->base.complete, req->base.data); -+ krb5enc_decrypt_done, req); - skcipher_request_set_crypt(skreq, src, dst, - req->cryptlen - authsize, req->iv); - -@@ -341,7 +351,7 @@ static int krb5enc_decrypt(struct aead_request *req) - if (err < 0) - return err; - -- return krb5enc_dispatch_decrypt_hash(req); -+ return krb5enc_dispatch_decrypt_hash(req, aead_request_flags(req)); - } - - static int krb5enc_init_tfm(struct crypto_aead *tfm) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1709-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch b/SOURCES/1709-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch deleted file mode 100644 index 9a304d4f1..000000000 --- a/SOURCES/1709-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch +++ /dev/null @@ -1,62 +0,0 @@ -From b404b859e714b89a20c22818d2a2606290c68266 Mon Sep 17 00:00:00 2001 -From: Ilya Dryomov -Date: Thu, 4 Jun 2026 13:24:44 +0200 -Subject: [PATCH] crypto: krb5 - filter out async aead implementations at alloc - -JIRA: https://redhat.atlassian.net/browse/RHEL-182254 -Upstream Status: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git - -commit 6c9dddeb582fde005360f4fe02c760d45ca05fb5 -Author: Michael Bommarito -Date: Sun May 10 19:24:55 2026 -0400 - - crypto: krb5 - filter out async aead implementations at alloc - - krb5_aead_encrypt(), krb5_aead_decrypt() in rfc3961_simplified.c and - rfc8009_encrypt(), rfc8009_decrypt() in rfc8009_aes2.c set a NULL - completion callback and treat any negative return from - crypto_aead_{encrypt,decrypt}() as terminal, falling through to - kfree_sensitive(buffer). When the encrypt_name resolves to an - async AEAD instance the request returns -EINPROGRESS, the buffer - is freed while the backend's worker still holds a pointer, and the - worker dereferences the freed slab on completion. - - KASAN report under UML+SLUB with a synthetic async aead backend - bound to krb5->encrypt_name: - - BUG: KASAN: slab-use-after-free in t5_stub_complete+0x7d/0xc7 - - The helpers were written synchronously, so filter the async - instances out at allocation time instead of plumbing - crypto_wait_req() through every call site. - - Reachable via net/rxrpc/rxgk.c, fs/afs/cm_security.c and - net/ceph/crypto.c on systems with an async AEAD provider bound to - the krb5 enctype name. - - Fixes: 00244da40f78 ("crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions") - Fixes: 6c3c0e86c2ac ("crypto/krb5: Implement the AES enctypes from rfc8009") - Cc: stable@vger.kernel.org - Suggested-by: Herbert Xu - Assisted-by: Claude:claude-opus-4-7 - Signed-off-by: Michael Bommarito - Signed-off-by: Herbert Xu - -Signed-off-by: Ilya Dryomov - -diff --git a/crypto/krb5/krb5_api.c b/crypto/krb5/krb5_api.c -index 23026d4206c8..2b20284fa0ab 100644 ---- a/crypto/krb5/krb5_api.c -+++ b/crypto/krb5/krb5_api.c -@@ -165,7 +165,7 @@ struct crypto_aead *krb5_prepare_encryption(const struct krb5_enctype *krb5, - struct crypto_aead *ci = NULL; - int ret = -ENOMEM; - -- ci = crypto_alloc_aead(krb5->encrypt_name, 0, 0); -+ ci = crypto_alloc_aead(krb5->encrypt_name, 0, CRYPTO_ALG_ASYNC); - if (IS_ERR(ci)) { - ret = PTR_ERR(ci); - if (ret == -ENOENT) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1713-nouveau-gsp-drop-warn-on-in-acpi-probes.patch b/SOURCES/1713-nouveau-gsp-drop-warn-on-in-acpi-probes.patch deleted file mode 100644 index 3a87b0159..000000000 --- a/SOURCES/1713-nouveau-gsp-drop-warn-on-in-acpi-probes.patch +++ /dev/null @@ -1,55 +0,0 @@ -From d1c991c860496d97044802ea54b30f20db468c1d Mon Sep 17 00:00:00 2001 -From: Dave Airlie -Date: Thu, 21 Nov 2024 11:46:01 +1000 -Subject: [PATCH] nouveau/gsp: drop WARN_ON in ACPI probes - -commit 9478c166c46934160135e197b049b5a05753f2ad upstream. - -These WARN_ONs seem to trigger a lot, and we don't seem to have a -plan to fix them, so just drop them, as they are most likely -harmless. - -Cc: stable@vger.kernel.org -Fixes: 176fdcbddfd2 ("drm/nouveau/gsp/r535: add support for booting GSP-RM") -Signed-off-by: Dave Airlie -Link: https://patch.msgid.link/20241121014601.229391-1-airlied@gmail.com -Signed-off-by: Danilo Krummrich -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -index 7fb13434c..a575a8dbf 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r535/gsp.c -@@ -737,8 +737,8 @@ r535_gsp_acpi_caps(acpi_handle handle, CAPS_METHOD_DATA *caps) - if (!obj) - goto done; - -- if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || -- WARN_ON(obj->buffer.length != 4)) -+ if (obj->type != ACPI_TYPE_BUFFER || -+ obj->buffer.length != 4) - goto done; - - caps->status = 0; -@@ -773,8 +773,8 @@ r535_gsp_acpi_jt(acpi_handle handle, JT_METHOD_DATA *jt) - if (!obj) - goto done; - -- if (WARN_ON(obj->type != ACPI_TYPE_BUFFER) || -- WARN_ON(obj->buffer.length != 4)) -+ if (obj->type != ACPI_TYPE_BUFFER || -+ obj->buffer.length != 4) - goto done; - - jt->status = 0; -@@ -861,8 +861,8 @@ r535_gsp_acpi_dod(acpi_handle handle, DOD_METHOD_DATA *dod) - - _DOD = output.pointer; - -- if (WARN_ON(_DOD->type != ACPI_TYPE_PACKAGE) || -- WARN_ON(_DOD->package.count > ARRAY_SIZE(dod->acpiIdList))) -+ if (_DOD->type != ACPI_TYPE_PACKAGE || -+ _DOD->package.count > ARRAY_SIZE(dod->acpiIdList)) - return; - - for (int i = 0; i < _DOD->package.count; i++) { diff --git a/SOURCES/1714-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sc.patch b/SOURCES/1714-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sc.patch deleted file mode 100644 index 9ebed0768..000000000 --- a/SOURCES/1714-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sc.patch +++ /dev/null @@ -1,83 +0,0 @@ -From 00c03cd13c65e9e641347130541d9a58b57e6152 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Thu, 28 May 2026 12:43:00 +0000 -Subject: [PATCH] sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in - SCTP_SENDALL - -JIRA: https://redhat.atlassian.net/browse/RHEL-179859 -CVE: CVE-2026-46227 -Backported from tree(s): linux - -commit abb5f36771cc4c05899b34000829a787572a8817 -Author: Ben Morris -Date: Thu May 7 17:14:55 2026 -0700 - - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL - - The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with - list_for_each_entry_safe(), which caches the next entry in @tmp before - the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may - drop the socket lock inside sctp_wait_for_sndbuf(). - - While the lock is dropped, another thread can SCTP_SOCKOPT_PEELOFF the - association cached in @tmp, migrating it to a new endpoint via - sctp_sock_migrate() (list_del_init() + list_add_tail() to - newep->asocs), and optionally close the new socket which frees the - association via kfree_rcu(). The cached @tmp can also be freed by a - network ABORT for that association, processed in softirq while the - lock is dropped. - - sctp_wait_for_sndbuf() revalidates @asoc (the current entry) on re-lock - via the "sk != asoc->base.sk" and "asoc->base.dead" checks, but nothing - revalidates @tmp. After a successful return, the iterator advances to - the stale @tmp, yielding either a use-after-free (if the peeled socket - was closed) or a list-walk onto the new endpoint's list head (type - confusion of &newep->asocs as a struct sctp_association *). - - Both are reachable from CapEff=0; the type-confusion path gives - controlled indirect call via the outqueue.sched->init_sid pointer. - - Fix by re-deriving @tmp from @asoc after sctp_sendmsg_to_asoc() - returns. @asoc is known to still be on ep->asocs at that point: the - only callers that list_del an association from ep->asocs are - sctp_association_free() (which sets asoc->base.dead) and - sctp_assoc_migrate() (which changes asoc->base.sk), and - sctp_wait_for_sndbuf() checks both under the lock before any - successful return; a tripped check propagates as err < 0 and the loop - bails before the re-derive. - - The SCTP_ABORT path in sctp_sendmsg_check_sflags() returns 0 and the - loop hits 'continue' before sctp_sendmsg_to_asoc() is ever called, so - the @tmp cached by list_for_each_entry_safe() still covers the - lock-held free that ba59fb027307 ("sctp: walk the list of asoc - safely") was added for. - - Fixes: 4910280503f3 ("sctp: add support for snd flag SCTP_SENDALL process in sendmsg") - Cc: stable@vger.kernel.org - Signed-off-by: Ben Morris - Acked-by: Xin Long - Link: https://patch.msgid.link/20260508001455.3137-1-joycathacker@gmail.com - Signed-off-by: Jakub Kicinski - -Signed-off-by: CKI Backport Bot - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index f99382c11..43ad2cb7a 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -1988,6 +1988,15 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) - goto out_unlock; - - iov_iter_revert(&msg->msg_iter, err); -+ -+ /* sctp_sendmsg_to_asoc() may have released the socket -+ * lock (sctp_wait_for_sndbuf), during which other -+ * associations on ep->asocs could have been peeled -+ * off or freed. @asoc itself is revalidated by the -+ * base.dead and base.sk checks in sctp_wait_for_sndbuf, -+ * so re-derive the cached cursor from it. -+ */ -+ tmp = list_next_entry(asoc, asocs); - } - - goto out_unlock; diff --git a/SOURCES/1715-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch b/SOURCES/1715-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch deleted file mode 100644 index bcd6b4f30..000000000 --- a/SOURCES/1715-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch +++ /dev/null @@ -1,54 +0,0 @@ -From adfc5ba4ef4dd2bca5969f40e8fc7b41fb3902ad Mon Sep 17 00:00:00 2001 -From: Ashutosh Desai -Date: Mon, 20 Apr 2026 01:36:37 +0000 -Subject: [PATCH] drm/gem: Fix inconsistent plane dimension calculation in - drm_gem_fb_init_with_funcs() - -commit 3d4c2268bd7243c3780fe32bf24ff876da272acf upstream. - -drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions -using plain integer division: - - unsigned int width = mode_cmd->width / (i ? info->hsub : 1); - unsigned int height = mode_cmd->height / (i ? info->vsub : 1); - -However, the ioctl-level framebuffer_check() in drm_framebuffer.c uses -drm_format_info_plane_width/height() which round up dimensions via -DIV_ROUND_UP(). This inconsistency corrupts the subsequent GEM object -size check for certain pixel format and dimension combinations. - -For example, with NV12 (vsub=2) and a 1-pixel-tall framebuffer the -GEM size validation path sees height=0 instead of height=1. The -expression (height - 1) then wraps to UINT_MAX as an unsigned int, -causing min_size to overflow and wrap back to a small value. A tiny -GEM object therefore passes the size guard, yet when the GPU accesses -the chroma plane it will read or write memory beyond the object's -bounds. - -Fix by replacing the open-coded divisions with drm_format_info_plane_width() -and drm_format_info_plane_height(), which use DIV_ROUND_UP() and match -the calculation already used in framebuffer_check(). - -Fixes: 4c3dbb2c312c ("drm: Add GEM backed framebuffer library") -Cc: stable@vger.kernel.org # v4.14+ -Reviewed-by: Thomas Zimmermann -Signed-off-by: Ashutosh Desai -Signed-off-by: Thomas Zimmermann -Link: https://patch.msgid.link/20260420013637.457751-1-ashutoshdesai993@gmail.com -Signed-off-by: Greg Kroah-Hartman - -diff --git a/drivers/gpu/drm/drm_gem_framebuffer_helper.c b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -index 167be6f3c..219fa736c 100644 ---- a/drivers/gpu/drm/drm_gem_framebuffer_helper.c -+++ b/drivers/gpu/drm/drm_gem_framebuffer_helper.c -@@ -171,8 +171,8 @@ int drm_gem_fb_init_with_funcs(struct drm_device *dev, - } - - for (i = 0; i < info->num_planes; i++) { -- unsigned int width = mode_cmd->width / (i ? info->hsub : 1); -- unsigned int height = mode_cmd->height / (i ? info->vsub : 1); -+ unsigned int width = drm_format_info_plane_width(info, mode_cmd->width, i); -+ unsigned int height = drm_format_info_plane_height(info, mode_cmd->height, i); - unsigned int min_size; - - objs[i] = drm_gem_object_lookup(file, mode_cmd->handles[i]); diff --git a/SOURCES/1716-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch b/SOURCES/1716-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch deleted file mode 100644 index a69c1742a..000000000 --- a/SOURCES/1716-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch +++ /dev/null @@ -1,60 +0,0 @@ -From d64340a9a54b2dfe5db7ba3d5649107eb9b4a5a5 Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 3 Jun 2026 18:59:39 +0000 -Subject: [PATCH] procfs: fix missing RCU protection when reading real_parent - in do_task_stat() - -JIRA: https://redhat.atlassian.net/browse/RHEL-181904 -CVE: CVE-2026-46259 -Backported from tree(s): linux - -commit 76149d53502cf17ef3ae454ff384551236fba867 -Author: Jinliang Zheng -Date: Wed Jan 28 16:30:07 2026 +0800 - - procfs: fix missing RCU protection when reading real_parent in do_task_stat() - - When reading /proc/[pid]/stat, do_task_stat() accesses task->real_parent - without proper RCU protection, which leads to: - - cpu 0 cpu 1 - ----- ----- - do_task_stat - var = task->real_parent - release_task - call_rcu(delayed_put_task_struct) - task_tgid_nr_ns(var) - rcu_read_lock <--- Too late to protect task->real_parent! - task_pid_ptr <--- UAF! - rcu_read_unlock - - This patch uses task_ppid_nr_ns() instead of task_tgid_nr_ns() to add - proper RCU protection for accessing task->real_parent. - - Link: https://lkml.kernel.org/r/20260128083007.3173016-1-alexjlzheng@tencent.com - Fixes: 06fffb1267c9 ("do_task_stat: don't take rcu_read_lock()") - Signed-off-by: Jinliang Zheng - Acked-by: Oleg Nesterov - Cc: David Hildenbrand - Cc: Ingo Molnar - Cc: Lorenzo Stoakes - Cc: Mateusz Guzik - Cc: ruippan - Cc: Usama Arif - Signed-off-by: Andrew Morton - -Signed-off-by: CKI Backport Bot - -diff --git a/fs/proc/array.c b/fs/proc/array.c -index 0e414fc4e..87798c51b 100644 ---- a/fs/proc/array.c -+++ b/fs/proc/array.c -@@ -539,7 +539,7 @@ static int do_task_stat(struct seq_file *m, struct pid_namespace *ns, - } - - sid = task_session_nr_ns(task, ns); -- ppid = task_tgid_nr_ns(task->real_parent, ns); -+ ppid = task_ppid_nr_ns(task, ns); - pgid = task_pgrp_nr_ns(task, ns); - - unlock_task_sighand(task, &flags); diff --git a/SOURCES/1717-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch b/SOURCES/1717-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch deleted file mode 100644 index b104af76a..000000000 --- a/SOURCES/1717-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch +++ /dev/null @@ -1,59 +0,0 @@ -From 73b5b9723557438d6c599146896627089504f03a Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Wed, 3 Jun 2026 21:42:17 +0000 -Subject: [PATCH] netfilter: nft_inner: Fix IPv6 inner_thoff desync -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -JIRA: https://redhat.atlassian.net/browse/RHEL-181932 -CVE: CVE-2026-46244 -Backported from tree(s): linux - -commit b6a91f68ebfed9c38e0e9150f58a9b85da07181c -Author: Yizhou Zhao -Date: Tue May 12 01:30:41 2026 +0800 - - netfilter: nft_inner: Fix IPv6 inner_thoff desync - - In nft_inner_parse_l2l3(), when processing inner IPv6 packets, - ipv6_find_hdr() correctly computes the transport header offset - traversing all extension headers, but the result is immediately - overwritten with nhoff + sizeof(_ip6h) (40 bytes), which only - accounts for the IPv6 base header. This creates a desync between - inner_thoff (wrong — points to extension header start) and l4proto - (correct — e.g., IPPROTO_TCP), enabling transport header forgery - and potential firewall bypass. This issue affects stable versions - from Linux 6.2. - - For comparison, the normal (non-inner) IPv6 path correctly - preserves ipv6_find_hdr()'s result. Removing the incorrect overwrite - ensures that ipv6_find_hdr()'s calculated transport header offset is - preserved, thereby fixing the desynchronization. - - Fixes: 3a07327d10a0 ("netfilter: nft_inner: support for inner tunnel header matching") - Cc: stable@vger.kernel.org - Reported-by: Yizhou Zhao - Reported-by: Yuxiang Yang - Reported-by: Xuewei Feng - Reported-by: Qi Li - Reported-by: Ke Xu - Assisted-by: GLM:5.1 Z.ai - Signed-off-by: Yizhou Zhao - Reviewed-by: Fernando Fernandez Mancera - Signed-off-by: Pablo Neira Ayuso - -Signed-off-by: CKI Backport Bot - -diff --git a/net/netfilter/nft_inner.c b/net/netfilter/nft_inner.c -index 817ab978d..5e6a1d370 100644 ---- a/net/netfilter/nft_inner.c -+++ b/net/netfilter/nft_inner.c -@@ -156,7 +156,6 @@ static int nft_inner_parse_l2l3(const struct nft_inner *priv, - return -1; - - if (fragoff == 0) { -- thoff = nhoff + sizeof(_ip6h); - ctx->flags |= NFT_PAYLOAD_CTX_INNER_TH; - ctx->inner_thoff = thoff; - ctx->l4proto = l4proto; diff --git a/SOURCES/1719-arm64-cputype-add-c1-pro-definitions.patch b/SOURCES/1719-arm64-cputype-add-c1-pro-definitions.patch deleted file mode 100644 index 52329cdae..000000000 --- a/SOURCES/1719-arm64-cputype-add-c1-pro-definitions.patch +++ /dev/null @@ -1,42 +0,0 @@ -From ee5ce483d42809b6c9e5bb25c33601e54229128f Mon Sep 17 00:00:00 2001 -From: Catalin Marinas -Date: Tue, 21 Apr 2026 11:00:16 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Pro definitions - -commit 2c99561016c591f4c3d5ad7d22a61b8726e79735 upstream. - -Add cputype definitions for C1-Pro. These will be used for errata -detection in subsequent patches. - -These values can be found in "Table A-303: MIDR_EL1 bit descriptions" in -issue 07 of the C1-Pro TRM: - - https://documentation-service.arm.com/static/6930126730f8f55a656570af - -Acked-by: Mark Rutland -Cc: Will Deacon -Cc: James Morse -Reviewed-by: Will Deacon -Signed-off-by: Catalin Marinas -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 751b78cd3..b0a90d6a4 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -98,6 +98,7 @@ - #define ARM_CPU_PART_CORTEX_A725 0xD87 - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E -+#define ARM_CPU_PART_C1_PRO 0xD8B - - #define APM_CPU_PART_XGENE 0x000 - #define APM_CPU_VAR_POTENZA 0x00 -@@ -185,6 +186,7 @@ - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) - #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) - #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) -+#define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) - #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) diff --git a/SOURCES/1720-arm64-cputype-add-c1-premium-definitions.patch b/SOURCES/1720-arm64-cputype-add-c1-premium-definitions.patch deleted file mode 100644 index ce7aace14..000000000 --- a/SOURCES/1720-arm64-cputype-add-c1-premium-definitions.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 521008bee0c5c6a1d7db31bc77f2b488b859958e Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:23:04 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Premium definitions - -commit d28413bfc5a255957241f1df5d7fd0c2cd74fe18 upstream. - -Add cputype definitions for C1-Premium. These will be used for errata -detection in subsequent patches. - -These values can be found in the C1-Premium TRM: - - https://developer.arm.com/documentation/109416/0100/ - -... in section A.5.1 ("MIDR_EL1, Main ID Register"). - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index b0a90d6a4..e075a0c96 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -99,6 +99,7 @@ - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E - #define ARM_CPU_PART_C1_PRO 0xD8B -+#define ARM_CPU_PART_C1_PREMIUM 0xD90 - - #define APM_CPU_PART_XGENE 0x000 - #define APM_CPU_VAR_POTENZA 0x00 -@@ -169,6 +170,7 @@ - #define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) - #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) - #define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) -+#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) - #define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520) - #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) diff --git a/SOURCES/1721-arm64-cputype-add-c1-ultra-definitions.patch b/SOURCES/1721-arm64-cputype-add-c1-ultra-definitions.patch deleted file mode 100644 index 85baa2304..000000000 --- a/SOURCES/1721-arm64-cputype-add-c1-ultra-definitions.patch +++ /dev/null @@ -1,44 +0,0 @@ -From 6bb606b134779251805f07433df85d8bd874dcfc Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:23:03 +0100 -Subject: [PATCH] arm64: cputype: Add C1-Ultra definitions - -commit 60349e64a6c65f9f0aa118af711b3c7e137f07ff upstream. - -Add cputype definitions for C1-Ultra. These will be used for errata -detection in subsequent patches. - -These values can be found in the C1-Ultra TRM: - - https://developer.arm.com/documentation/108014/0100/ - -... in section A.5.1 ("MIDR_EL1, Main ID Register"). - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index e075a0c96..0fe5fea9b 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -97,6 +97,7 @@ - #define ARM_CPU_PART_CORTEX_X925 0xD85 - #define ARM_CPU_PART_CORTEX_A725 0xD87 - #define ARM_CPU_PART_CORTEX_A720AE 0xD89 -+#define ARM_CPU_PART_C1_ULTRA 0xD8C - #define ARM_CPU_PART_NEOVERSE_N3 0xD8E - #define ARM_CPU_PART_C1_PRO 0xD8B - #define ARM_CPU_PART_C1_PREMIUM 0xD90 -@@ -166,6 +167,7 @@ - #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) - #define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) - #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) -+#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) - #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) - #define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) - #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) diff --git a/SOURCES/1722-arm64-cputype-add-neoverse-v3ae-definitions.patch b/SOURCES/1722-arm64-cputype-add-neoverse-v3ae-definitions.patch deleted file mode 100644 index fd14dfffc..000000000 --- a/SOURCES/1722-arm64-cputype-add-neoverse-v3ae-definitions.patch +++ /dev/null @@ -1,46 +0,0 @@ -From a6ef05314d5a8ab238088ae708843ec59b58b082 Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Fri, 19 Sep 2025 15:58:28 +0100 -Subject: [PATCH] arm64: cputype: Add Neoverse-V3AE definitions - -commit 3bbf004c4808e2c3241e5c1ad6cc102f38a03c39 upstream. - -Add cputype definitions for Neoverse-V3AE. These will be used for errata -detection in subsequent patches. - -These values can be found in the Neoverse-V3AE TRM: - - https://developer.arm.com/documentation/SDEN-2615521/9-0/ - -... in section A.6.1 ("MIDR_EL1, Main ID Register"). - -Signed-off-by: Mark Rutland -Cc: James Morse -Cc: Will Deacon -Cc: Catalin Marinas -Signed-off-by: Ryan Roberts -Signed-off-by: Will Deacon -[ Ryan: Trivial backport ] -Signed-off-by: Ryan Roberts -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 0fe5fea9b..986bd0fc0 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -93,6 +93,7 @@ - #define ARM_CPU_PART_NEOVERSE_V2 0xD4F - #define ARM_CPU_PART_CORTEX_A720 0xD81 - #define ARM_CPU_PART_CORTEX_X4 0xD82 -+#define ARM_CPU_PART_NEOVERSE_V3AE 0xD83 - #define ARM_CPU_PART_NEOVERSE_V3 0xD84 - #define ARM_CPU_PART_CORTEX_X925 0xD85 - #define ARM_CPU_PART_CORTEX_A725 0xD87 -@@ -185,6 +186,7 @@ - #define MIDR_NEOVERSE_V2 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V2) - #define MIDR_CORTEX_A720 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720) - #define MIDR_CORTEX_X4 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X4) -+#define MIDR_NEOVERSE_V3AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3AE) - #define MIDR_NEOVERSE_V3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V3) - #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) diff --git a/SOURCES/1723-arm64-errata-apply-workarounds-for-neoverse-v3ae.patch b/SOURCES/1723-arm64-errata-apply-workarounds-for-neoverse-v3ae.patch deleted file mode 100644 index acba4f75a..000000000 --- a/SOURCES/1723-arm64-errata-apply-workarounds-for-neoverse-v3ae.patch +++ /dev/null @@ -1,62 +0,0 @@ -From dc9f91f849860591bf4b02c75e6407780cf2df69 Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Fri, 19 Sep 2025 15:58:29 +0100 -Subject: [PATCH] arm64: errata: Apply workarounds for Neoverse-V3AE - -commit 0c33aa1804d101c11ba1992504f17a42233f0e11 upstream. - -Neoverse-V3AE is also affected by erratum #3312417, as described in its -Software Developer Errata Notice (SDEN) document: - - Neoverse V3AE (MP172) SDEN v9.0, erratum 3312417 - https://developer.arm.com/documentation/SDEN-2615521/9-0/ - -Enable the workaround for Neoverse-V3AE, and document this. - -Signed-off-by: Mark Rutland -Cc: James Morse -Cc: Will Deacon -Cc: Catalin Marinas -Signed-off-by: Ryan Roberts -Signed-off-by: Will Deacon -[ Ryan: Trivial backport ] -Signed-off-by: Ryan Roberts -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst -index 29c8e3936..95227fbba 100644 ---- a/Documentation/arm64/silicon-errata.rst -+++ b/Documentation/arm64/silicon-errata.rst -@@ -160,6 +160,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A720 | #3456091 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A725 | #3456106 | ARM64_ERRATUM_3194386 | -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 60c6bfae4..903aec08c 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1106,6 +1106,7 @@ config ARM64_ERRATUM_3194386 - * ARM Neoverse-V1 erratum 3324341 - * ARM Neoverse V2 erratum 3324336 - * ARM Neoverse-V3 erratum 3312417 -+ * ARM Neoverse-V3AE erratum 3312417 - - On affected cores "MSR SSBS, #0" instructions may not affect - subsequent speculative instructions, which may permit unexepected -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index e08910c40..f3c2d766c 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -456,6 +456,7 @@ static const struct midr_range erratum_spec_ssbs_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), - {} - }; - #endif diff --git a/SOURCES/1724-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch b/SOURCES/1724-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch deleted file mode 100644 index c7f1f592b..000000000 --- a/SOURCES/1724-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch +++ /dev/null @@ -1,171 +0,0 @@ -From 8364384ae82fbffdf8968abaac3455ed854da18d Mon Sep 17 00:00:00 2001 -From: Mark Rutland -Date: Tue, 16 Jun 2026 06:23:05 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on various Arm CPUs - -commit cfd391e74134db664feb499d43af286380b10ba8 upstream. - -A number of CPUs developed by Arm suffer from errata whereby a broadcast -TLBI;DSB sequence may complete before the global observation of writes -which are translated by an affected TLB entry. - -These errata ONLY affect the completion of memory accesses which have -been translated by an invalidated TLB entry, and these errata DO NOT -affect the actual invalidation of TLB entries. TLB entries are removed -correctly. - -This issue has been assigned CVE ID CVE-2025-10263. - -To mitigate this issue, Arm recommends that software follows any -affected TLBI;DSB sequence with an additional TLBI;DSB, which will -ensure that all memory write effects affected by the first TLBI have -been globally observed. The additional TLBI can use any operation that -is broadcast to affected CPUs, and the additional DSB can use any option -that is sufficient to complete the additional TLBI. - -The ARM64_WORKAROUND_REPEAT_TLBI workaround is sufficient to mitigate -the issue. Enable this workaround for affected CPUs, and update the -silicon errata documentation accordingly. - -Note that due to the manner in which Arm develops IP and tracks errata, -some CPUs share a common erratum number. - -Signed-off-by: Mark Rutland -Cc: Catalin Marinas -Cc: Will Deacon -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst -index 95227fbba..3960a75ab 100644 ---- a/Documentation/arm64/silicon-errata.rst -+++ b/Documentation/arm64/silicon-errata.rst -@@ -158,6 +158,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | -@@ -194,6 +196,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #3324349 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-N1 | #4193800 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #2139208 | ARM64_ERRATUM_2139208 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #2067961 | ARM64_ERRATUM_2067961 | -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 903aec08c..030ccd4b3 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1120,6 +1120,54 @@ config ARM64_ERRATUM_3194386 - - If unsure, say Y. - -+config ARM64_ERRATUM_4193714 -+ bool "C1-Pro: 4193714: SME DVMSync early acknowledgement" -+ depends on ARM64_SME -+ default y -+ help -+ Enable workaround for C1-Pro acknowledging the DVMSync before -+ the SME memory accesses are complete. This will cause TLB -+ maintenance for processes using SME to also issue an IPI to -+ the affected CPUs. -+ -+ If unsure, say Y. -+ -+config ARM64_ERRATUM_4118414 -+ bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" -+ default y -+ select ARM64_WORKAROUND_REPEAT_TLBI -+ help -+ This option adds a workaround for the following errata: -+ -+ * ARM C1-Premium erratum 4193780 -+ * ARM C1-Ultra erratum 4193780 -+ * ARM Cortex-A76 erratum 4193800 -+ * ARM Cortex-A76AE erratum 4193801 -+ * ARM Cortex-A77 erratum 4193798 -+ * ARM Cortex-A78 erratum 4193791 -+ * ARM Cortex-A78AE erratum 4193793 -+ * ARM Cortex-A78C erratum 4193794 -+ * ARM Cortex-A710 erratum 4193788 -+ * ARM Cortex-X1 erratum 4193791 -+ * ARM Cortex-X1C erratum 4193792 -+ * ARM Cortex-X2 erratum 4193788 -+ * ARM Cortex-X3 erratum 4193786 -+ * ARM Cortex-X4 erratum 4118414 -+ * ARM Cortex-X925 erratum 4193781 -+ * ARM Neoverse-N1 erratum 4193800 -+ * ARM Neoverse-N2 erratum 4193789 -+ * ARM Neoverse-V1 erratum 4193790 -+ * ARM Neoverse-V2 erratum 4193787 -+ * ARM Neoverse-V3 erratum 4193784 -+ * ARM Neoverse-V3AE erratum 4193784 -+ -+ On affected cores, some memory accesses might not be completed by -+ broadcast TLB invalidation. -+ -+ This issue is also known as CVE-2025-10263. -+ -+ If unsure, say Y. -+ - config CAVIUM_ERRATUM_22375 - bool "Cavium erratum 22375, 24313" - default y -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index f3c2d766c..7010c152d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -225,7 +225,35 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - ERRATA_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1), - }, - #endif -- {}, -+#ifdef CONFIG_ARM64_ERRATUM_4118414 -+ { -+ ERRATA_MIDR_RANGE_LIST(((const struct midr_range[]) { -+ MIDR_ALL_VERSIONS(MIDR_C1_PREMIUM), -+ MIDR_ALL_VERSIONS(MIDR_C1_ULTRA), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A76AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A77), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78AE), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A78C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_A710), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X1C), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X2), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X3), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X4), -+ MIDR_ALL_VERSIONS(MIDR_CORTEX_X925), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N1), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_N2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V1), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), -+ MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), -+ {} -+ })), -+ }, -+#endif -+ {} - }; - #endif - -@@ -561,7 +589,7 @@ const struct arm64_cpu_capabilities arm64_errata[] = { - #endif - #ifdef CONFIG_ARM64_WORKAROUND_REPEAT_TLBI - { -- .desc = "Qualcomm erratum 1009, or ARM erratum 1286807, 2441009", -+ .desc = "Broken broadcast TLBI completion", - .capability = ARM64_WORKAROUND_REPEAT_TLBI, - .type = ARM64_CPUCAP_LOCAL_CPU_ERRATUM, - .matches = cpucap_multi_entry_cap_matches, diff --git a/SOURCES/1725-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch b/SOURCES/1725-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch deleted file mode 100644 index be35e3c3b..000000000 --- a/SOURCES/1725-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch +++ /dev/null @@ -1,73 +0,0 @@ -From f040e78cde73c9363beec35514ea0242725402ef Mon Sep 17 00:00:00 2001 -From: Shanker Donthineni -Date: Tue, 16 Jun 2026 06:23:06 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU - -commit ec7216f92e4ebd485b1c6dc6aa3f6064b71a5768 upstream. - -NVIDIA Olympus cores are affected by the TLBI completion issue tracked as -CVE-2025-10263. The existing ARM64_ERRATUM_4118414 handling already uses -ARM64_WORKAROUND_REPEAT_TLBI to issue an additional broadcast TLBI;DSB -sequence and ensure affected memory write effects are globally observed. - -Add MIDR_NVIDIA_OLYMPUS to the repeat-TLBI match list so the same -mitigation is enabled on affected Olympus systems. Also document the -NVIDIA Olympus erratum in the arm64 silicon errata table and list it in -the Kconfig help text. - -Signed-off-by: Shanker Donthineni -Cc: Catalin Marinas -Cc: Will Deacon -Cc: Mark Rutland -Acked-by: Mark Rutland -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Shanker Donthineni -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst -index 3960a75ab..9307f17f0 100644 ---- a/Documentation/arm64/silicon-errata.rst -+++ b/Documentation/arm64/silicon-errata.rst -@@ -252,6 +252,8 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | Cavium | ThunderX2 Core | #219 | CAVIUM_TX2_ERRATUM_219 | - +----------------+-----------------+-----------------+-----------------------------+ -+| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ - | Marvell | ARM-MMU-500 | #582743 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 030ccd4b3..da3eb91c3 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1133,7 +1133,7 @@ config ARM64_ERRATUM_4193714 - If unsure, say Y. - - config ARM64_ERRATUM_4118414 -- bool "Cortex-*/Neoverse-*/C1-*: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" -+ bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" - default y - select ARM64_WORKAROUND_REPEAT_TLBI - help -@@ -1160,6 +1160,7 @@ config ARM64_ERRATUM_4118414 - * ARM Neoverse-V2 erratum 4193787 - * ARM Neoverse-V3 erratum 4193784 - * ARM Neoverse-V3AE erratum 4193784 -+ * NVIDIA Olympus erratum T410-OLY-1029 - - On affected cores, some memory accesses might not be completed by - broadcast TLB invalidation. -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 7010c152d..48f867d5d 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -249,6 +249,7 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V2), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), -+ MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), - {} - })), - }, diff --git a/SOURCES/1726-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch b/SOURCES/1726-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch deleted file mode 100644 index f0a2fc329..000000000 --- a/SOURCES/1726-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch +++ /dev/null @@ -1,55 +0,0 @@ -From 6a26fd2e6b6fccb15f1aeb2056a84f46cba08e52 Mon Sep 17 00:00:00 2001 -From: Will Deacon -Date: Tue, 16 Jun 2026 06:23:07 +0100 -Subject: [PATCH] arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt - 100 CPU - -commit 1940e70a8144bf75e6df26bf6f600862ea7f7ea1 upstream. - -Commit fb091ff39479 ("arm64: Subscribe Microsoft Azure Cobalt 100 to ARM -Neoverse N2 errata") states that Microsoft Azure Cobalt 100 CPU "is a -Microsoft implemented CPU based on r0p0 of the ARM Neoverse N2 CPU, and -therefore suffers from all the same errata.". - -So enable the workaround for the latest broadcast TLB invalidation bug -on these parts. - -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst -index 9307f17f0..35be36ad8 100644 ---- a/Documentation/arm64/silicon-errata.rst -+++ b/Documentation/arm64/silicon-errata.rst -@@ -316,3 +316,5 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | Microsoft | Azure Cobalt 100| #3324339 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| Microsoft | Azure Cobalt 100| #4193789 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index da3eb91c3..6f0d6c160 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1160,6 +1160,7 @@ config ARM64_ERRATUM_4118414 - * ARM Neoverse-V2 erratum 4193787 - * ARM Neoverse-V3 erratum 4193784 - * ARM Neoverse-V3AE erratum 4193784 -+ * Microsoft Azure Cobalt 100 4193789 - * NVIDIA Olympus erratum T410-OLY-1029 - - On affected cores, some memory accesses might not be completed by -diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c -index 48f867d5d..9b991fbba 100644 ---- a/arch/arm64/kernel/cpu_errata.c -+++ b/arch/arm64/kernel/cpu_errata.c -@@ -250,6 +250,7 @@ static const struct arm64_cpu_capabilities arm64_repeat_tlbi_list[] = { - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3), - MIDR_ALL_VERSIONS(MIDR_NEOVERSE_V3AE), - MIDR_ALL_VERSIONS(MIDR_NVIDIA_OLYMPUS), -+ MIDR_ALL_VERSIONS(MIDR_MICROSOFT_AZURE_COBALT_100), - {} - })), - }, diff --git a/SOURCES/1727-arm64-cputype-add-nvidia-olympus-definitions.patch b/SOURCES/1727-arm64-cputype-add-nvidia-olympus-definitions.patch deleted file mode 100644 index 8f3686eb5..000000000 --- a/SOURCES/1727-arm64-cputype-add-nvidia-olympus-definitions.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 401fbd171e5e9c3ff3023bf5756c51689281025f Mon Sep 17 00:00:00 2001 -From: Shanker Donthineni -Date: Tue, 16 Jun 2026 06:23:02 +0100 -Subject: [PATCH] arm64: cputype: Add NVIDIA Olympus definitions - -commit e185c8a0d84236d14af61faff8147c953a878a77 upstream. - -Add cpu part and model macro definitions for NVIDIA Olympus core. - -Signed-off-by: Shanker Donthineni -Signed-off-by: Will Deacon -[Mark: backport to v5.15.y] -Signed-off-by: Mark Rutland -Signed-off-by: Greg Kroah-Hartman - -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index 986bd0fc0..e779252ad 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -132,6 +132,7 @@ - - #define NVIDIA_CPU_PART_DENVER 0x003 - #define NVIDIA_CPU_PART_CARMEL 0x004 -+#define NVIDIA_CPU_PART_OLYMPUS 0x010 - - #define FUJITSU_CPU_PART_A64FX 0x001 - -@@ -215,6 +216,7 @@ - #define MIDR_QCOM_KRYO_4XX_SILVER MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO_4XX_SILVER) - #define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) - #define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) -+#define MIDR_NVIDIA_OLYMPUS MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_OLYMPUS) - #define MIDR_FUJITSU_A64FX MIDR_CPU_MODEL(ARM_CPU_IMP_FUJITSU, FUJITSU_CPU_PART_A64FX) - #define MIDR_HISI_TSV110 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_TSV110) - #define MIDR_HISI_HIP09 MIDR_CPU_MODEL(ARM_CPU_IMP_HISI, HISI_CPU_PART_HIP09) diff --git a/SOURCES/1728-clean-up-documentation-mess-left-by-previous-backport.patch b/SOURCES/1728-clean-up-documentation-mess-left-by-previous-backport.patch deleted file mode 100644 index 791f8862d..000000000 --- a/SOURCES/1728-clean-up-documentation-mess-left-by-previous-backport.patch +++ /dev/null @@ -1,204 +0,0 @@ -From: Mark Salter -Date: Mon, 6 Jul 2026 00:00:00 +0000 -Subject: [PATCH] Clean up documentation mess left by previous backport - -RHEL-only reconciliation of arch/arm64 (silicon-errata.rst, Kconfig, -cpu_errata.c, cputype.h) after the CVE-2025-10263 TLBI errata backport, -to match RHEL 5.14.0-687.22.1.el9_8. No public upstream commit. - -CVE: CVE-2025-10263 ---- -diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst -index 35be36ad8..d19ff3a69 100644 ---- a/Documentation/arm64/silicon-errata.rst -+++ b/Documentation/arm64/silicon-errata.rst -@@ -128,25 +128,27 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A76 | #3324349 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A76 | #4193800 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A76AE | #4193801 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1491015 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_1508412 | - +----------------+-----------------+-----------------+-----------------------------+ --<<<<<<< HEAD:Documentation/arm64/silicon-errata.rst --| ARM | Cortex-A510 | #2051678 | ARM64_ERRATUM_2051678 | -+| ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A510 | #2077057 | ARM64_ERRATUM_2077057 | -+| ARM | Cortex-A77 | #4193798 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A510 | #2441009 | ARM64_ERRATUM_2441009 | -+| ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A510 | #2658417 | ARM64_ERRATUM_2658417 | --======= --| ARM | Cortex-A77 | #3324348 | ARM64_ERRATUM_3194386 | -+| ARM | Cortex-A78 | #4193791 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A78 | #3324344 | ARM64_ERRATUM_3194386 | -+| ARM | Cortex-A78AE | #4193793 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A78C | #3324346,3324347| ARM64_ERRATUM_3194386 | -->>>>>>> adeec61a4723 (arm64: errata: Expand speculative SSBS workaround (again)):Documentation/arch/arm64/silicon-errata.rst -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-A78C | #4193794 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #2119858 | ARM64_ERRATUM_2119858 | - +----------------+-----------------+-----------------+-----------------------------+ -@@ -156,13 +158,11 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #3324338 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | --+----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A710 | #4193788 | ARM64_ERRATUM_4118414 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | -+| ARM | Cortex-A715 | #2645198 | ARM64_ERRATUM_2645198 | - +----------------+-----------------+-----------------+-----------------------------+ --| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | -+| ARM | Cortex-A715 | #3456084 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-A720 | #3456091 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -@@ -172,20 +172,32 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X1 | #3324344 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X1 | #4193791 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X1C | #3324346 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X1C | #4193792 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #2119858 | ARM64_ERRATUM_2119858 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #2224489 | ARM64_ERRATUM_2224489 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X2 | #3324338 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X2 | #4193788 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X3 | #3324335 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X3 | #4193786 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X4 | #3194386 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X4 | #4118414 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Cortex-X925 | #3324334 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Cortex-X925 | #4193781 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_1418040 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N1 | #1349291 | N/A | -@@ -206,16 +218,32 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N2 | #3324339 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-N2 | #4193789 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-N3 | #3456111 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V1 | #1619801 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V1 | #3324341 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V1 | #4193790 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V2 | #3324336 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V2 | #4193787 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | Neoverse-V3 | #3312417 | ARM64_ERRATUM_3194386 | - +----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3 | #4193784 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3AE | #3312417 | ARM64_ERRATUM_3194386 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | Neoverse-V3AE | #4193784 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | C1-Premium | #4193780 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ -+| ARM | C1-Ultra | #4193780 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | ARM | MMU-500 | #841119,826419 | ARM_SMMU_MMU_500_CPRE_ERRATA| - | | | #562869,1047329 | | - +----------------+-----------------+-----------------+-----------------------------+ -@@ -252,14 +280,14 @@ stable kernels. - +----------------+-----------------+-----------------+-----------------------------+ - | Cavium | ThunderX2 Core | #219 | CAVIUM_TX2_ERRATUM_219 | - +----------------+-----------------+-----------------+-----------------------------+ --| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | --+----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ - | Marvell | ARM-MMU-500 | #582743 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ - | NVIDIA | Carmel Core | N/A | NVIDIA_CARMEL_CNP_ERRATUM | - +----------------+-----------------+-----------------+-----------------------------+ -+| NVIDIA | Olympus core | T410-OLY-1029 | ARM64_ERRATUM_4118414 | -++----------------+-----------------+-----------------+-----------------------------+ - | NVIDIA | T241 GICv3/4.x | T241-FABRIC-4 | N/A | - +----------------+-----------------+-----------------+-----------------------------+ - +----------------+-----------------+-----------------+-----------------------------+ -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 6f0d6c160..1b77efe71 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -1120,18 +1120,6 @@ config ARM64_ERRATUM_3194386 - - If unsure, say Y. - --config ARM64_ERRATUM_4193714 -- bool "C1-Pro: 4193714: SME DVMSync early acknowledgement" -- depends on ARM64_SME -- default y -- help -- Enable workaround for C1-Pro acknowledging the DVMSync before -- the SME memory accesses are complete. This will cause TLB -- maintenance for processes using SME to also issue an IPI to -- the affected CPUs. -- -- If unsure, say Y. -- - config ARM64_ERRATUM_4118414 - bool "Various: Completion of affected memory accesses might not be guaranteed by completion of a TLBI" - default y -diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h -index e779252ad..34440a3cb 100644 ---- a/arch/arm64/include/asm/cputype.h -+++ b/arch/arm64/include/asm/cputype.h -@@ -169,12 +169,10 @@ - #define MIDR_CORTEX_A77 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A77) - #define MIDR_CORTEX_A76AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A76AE) - #define MIDR_NEOVERSE_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_V1) --#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) - #define MIDR_CORTEX_A78 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78) - #define MIDR_CORTEX_A78AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A78AE) - #define MIDR_CORTEX_X1 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1) - #define MIDR_CORTEX_A510 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A510) --#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_CORTEX_X1C MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X1C) - #define MIDR_CORTEX_A520 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A520) - #define MIDR_CORTEX_A710 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A710) -@@ -192,8 +190,10 @@ - #define MIDR_CORTEX_X925 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_X925) - #define MIDR_CORTEX_A725 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A725) - #define MIDR_CORTEX_A720AE MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A720AE) -+#define MIDR_C1_ULTRA MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_ULTRA) - #define MIDR_NEOVERSE_N3 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_NEOVERSE_N3) - #define MIDR_C1_PRO MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PRO) -+#define MIDR_C1_PREMIUM MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_C1_PREMIUM) - #define MIDR_THUNDERX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX) - #define MIDR_THUNDERX_81XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_81XX) - #define MIDR_THUNDERX_83XX MIDR_CPU_MODEL(ARM_CPU_IMP_CAVIUM, CAVIUM_CPU_PART_THUNDERX_83XX) --- -2.43.0 - diff --git a/SOURCES/1729-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepat.patch b/SOURCES/1729-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepat.patch deleted file mode 100644 index ced97fedd..000000000 --- a/SOURCES/1729-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepat.patch +++ /dev/null @@ -1,45 +0,0 @@ -From 23372f29f9fdbdf360b9b8812d8bce59d6caf6ac Mon Sep 17 00:00:00 2001 -From: CKI Backport Bot -Date: Mon, 29 Jun 2026 08:46:34 +0000 -Subject: [PATCH] fs/smb/client: fix out-of-bounds read in - cifs_sanitize_prepath - -JIRA: https://redhat.atlassian.net/browse/RHEL-189496 -CVE: CVE-2026-43112 -Backported from tree(s): linux - -fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath - -When cifs_sanitize_prepath is called with an empty string or a string -containing only delimiters (e.g., "/"), the current logic attempts to -check *(cursor2 - 1) before cursor2 has advanced. This results in an -out-of-bounds read. - -This patch adds an early exit check after stripping prepended -delimiters. If no path content remains, the function returns NULL. - -The bug was identified via manual audit and verified using a -standalone test case compiled with AddressSanitizer, which -triggered a SEGV on affected inputs. - -Signed-off-by: Fredric Cover -Reviewed-by: Henrique Carvalho <[2]henrique.carvalho@suse.com> -Signed-off-by: Steve French -(cherry picked from commit 78ec5bf2f589ec7fd8f169394bfeca541b077317) -Signed-off-by: CKI Backport Bot - -diff --git a/fs/smb/client/fs_context.c b/fs/smb/client/fs_context.c -index 296a231e8..fdfe1508b 100644 ---- a/fs/smb/client/fs_context.c -+++ b/fs/smb/client/fs_context.c -@@ -587,6 +587,10 @@ char *cifs_sanitize_prepath(char *prepath, gfp_t gfp) - while (IS_DELIM(*cursor1)) - cursor1++; - -+ /* exit in case of only delimiters */ -+ if (!*cursor1) -+ return NULL; -+ - /* copy the first letter */ - *cursor2 = *cursor1; - diff --git a/SOURCES/1730-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch b/SOURCES/1730-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch deleted file mode 100644 index 34c2b2b2a..000000000 --- a/SOURCES/1730-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch +++ /dev/null @@ -1,82 +0,0 @@ -From a9a7c3203fdc4d4a8d8a7a3b1ed05d2bb4c6e77e Mon Sep 17 00:00:00 2001 -From: Dipayaan Roy -Date: Tue, 24 Feb 2026 04:38:36 -0800 -Subject: [PATCH] net: mana: Fix double destroy_workqueue on service rescan PCI - path - -[ Upstream commit f975a0955276579e2176a134366ed586071c7c6a ] - -While testing corner cases in the driver, a use-after-free crash -was found on the service rescan PCI path. - -When mana_serv_reset() calls mana_gd_suspend(), mana_gd_cleanup() -destroys gc->service_wq. If the subsequent mana_gd_resume() fails -with -ETIMEDOUT or -EPROTO, the code falls through to -mana_serv_rescan() which triggers pci_stop_and_remove_bus_device(). -This invokes the PCI .remove callback (mana_gd_remove), which calls -mana_gd_cleanup() a second time, attempting to destroy the already- -freed workqueue. Fix this by NULL-checking gc->service_wq in -mana_gd_cleanup() and setting it to NULL after destruction. - -Call stack of issue for reference: -[Sat Feb 21 18:53:48 2026] Call Trace: -[Sat Feb 21 18:53:48 2026] -[Sat Feb 21 18:53:48 2026] mana_gd_cleanup+0x33/0x70 [mana] -[Sat Feb 21 18:53:48 2026] mana_gd_remove+0x3a/0xc0 [mana] -[Sat Feb 21 18:53:48 2026] pci_device_remove+0x41/0xb0 -[Sat Feb 21 18:53:48 2026] device_remove+0x46/0x70 -[Sat Feb 21 18:53:48 2026] device_release_driver_internal+0x1e3/0x250 -[Sat Feb 21 18:53:48 2026] device_release_driver+0x12/0x20 -[Sat Feb 21 18:53:48 2026] pci_stop_bus_device+0x6a/0x90 -[Sat Feb 21 18:53:48 2026] pci_stop_and_remove_bus_device+0x13/0x30 -[Sat Feb 21 18:53:48 2026] mana_do_service+0x180/0x290 [mana] -[Sat Feb 21 18:53:48 2026] mana_serv_func+0x24/0x50 [mana] -[Sat Feb 21 18:53:48 2026] process_one_work+0x190/0x3d0 -[Sat Feb 21 18:53:48 2026] worker_thread+0x16e/0x2e0 -[Sat Feb 21 18:53:48 2026] kthread+0xf7/0x130 -[Sat Feb 21 18:53:48 2026] ? __pfx_worker_thread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ret_from_fork+0x269/0x350 -[Sat Feb 21 18:53:48 2026] ? __pfx_kthread+0x10/0x10 -[Sat Feb 21 18:53:48 2026] ret_from_fork_asm+0x1a/0x30 -[Sat Feb 21 18:53:48 2026] - -Fixes: 505cc26bcae0 ("net: mana: Add support for auxiliary device servicing events") -Reviewed-by: Haiyang Zhang -Signed-off-by: Dipayaan Roy -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/aZ2bzL64NagfyHpg@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index 43c5b6efc..674df4782 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -1947,7 +1947,10 @@ static void mana_gd_cleanup(struct pci_dev *pdev) - - mana_gd_remove_irqs(pdev); - -- destroy_workqueue(gc->service_wq); -+ if (gc->service_wq) { -+ destroy_workqueue(gc->service_wq); -+ gc->service_wq = NULL; -+ } - dev_dbg(&pdev->dev, "mana gdma cleanup successful\n"); - } - -diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c -index a64ef3e22..a98227b5a 100644 ---- a/drivers/net/ethernet/microsoft/mana/mana_en.c -+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c -@@ -3525,7 +3525,9 @@ void mana_rdma_remove(struct gdma_dev *gd) - } - - WRITE_ONCE(gd->rdma_teardown, true); -- flush_workqueue(gc->service_wq); -+ -+ if (gc->service_wq) -+ flush_workqueue(gc->service_wq); - - if (gd->adev) - remove_adev(gd); diff --git a/SOURCES/1731-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch b/SOURCES/1731-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch deleted file mode 100644 index 2d7155640..000000000 --- a/SOURCES/1731-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch +++ /dev/null @@ -1,33 +0,0 @@ -From 6c92392602b451e3869f15ab685f8f650e942b13 Mon Sep 17 00:00:00 2001 -From: Shiraz Saleem -Date: Mon, 9 Mar 2026 10:24:43 -0700 -Subject: [PATCH] net/mana: Null service_wq on setup error to prevent double - destroy - -[ Upstream commit 87c2302813abc55c46485711a678e3c312b00666 ] - -In mana_gd_setup() error path, set gc->service_wq to NULL after -destroy_workqueue() to match the cleanup in mana_gd_cleanup(). -This prevents a use-after-free if the workqueue pointer is checked -after a failed setup. - -Fixes: f975a0955276 ("net: mana: Fix double destroy_workqueue on service rescan PCI path") -Signed-off-by: Shiraz Saleem -Signed-off-by: Konstantin Taranov -Reviewed-by: Simon Horman -Link: https://patch.msgid.link/20260309172443.688392-1-kotaranov@linux.microsoft.com -Signed-off-by: Jakub Kicinski -Signed-off-by: Sasha Levin - -diff --git a/drivers/net/ethernet/microsoft/mana/gdma_main.c b/drivers/net/ethernet/microsoft/mana/gdma_main.c -index 674df4782..2e72838af 100644 ---- a/drivers/net/ethernet/microsoft/mana/gdma_main.c -+++ b/drivers/net/ethernet/microsoft/mana/gdma_main.c -@@ -1935,6 +1935,7 @@ static int mana_gd_setup(struct pci_dev *pdev) - mana_gd_remove_irqs(pdev); - free_workqueue: - destroy_workqueue(gc->service_wq); -+ gc->service_wq = NULL; - dev_err(&pdev->dev, "%s failed (error %d)\n", __func__, err); - return err; - } diff --git a/SOURCES/1732-net-gro-don-t-merge-zcopy-skbs.patch b/SOURCES/1732-net-gro-don-t-merge-zcopy-skbs.patch deleted file mode 100644 index 04ce9fcf7..000000000 --- a/SOURCES/1732-net-gro-don-t-merge-zcopy-skbs.patch +++ /dev/null @@ -1,43 +0,0 @@ -From 3c6cc9f2ca65b6dd61b1af75452dc0e1cd0aad8d Mon Sep 17 00:00:00 2001 -From: Sabrina Dubroca -Date: Wed, 20 May 2026 22:44:42 +0200 -Subject: [PATCH] net: gro: don't merge zcopy skbs - -[ Upstream commit 4db79a322db8c97f7b73b8a347395ef4d685eb40 ] - -skb_gro_receive() can currently copy frags between the source and GRO -skb, without checking the zerocopy status, and in particular the -SKBFL_MANAGED_FRAG_REFS flag. - -When SKBFL_MANAGED_FRAG_REFS is set, the skb doesn't hold a reference -on the pages in shinfo->frags. Appending those frags to another skb's -frags without fixing up the page refcount can lead to UAF. - -When either the last skb in the GRO chain (the one we would append -frags to) or the source skb is zerocopy, don't merge the skbs. - -Fixes: 753f1ca4e1e5 ("net: introduce managed frags infrastructure") -Reported-by: Huzaifa Sidhpurwala -Signed-off-by: Sabrina Dubroca -Reviewed-by: Willem de Bruijn -Link: https://patch.msgid.link/c3b7f906bbfcbdfd7b4fa9d6c18a438870df85be.1779307748.git.sd@queasysnail.net -Signed-off-by: Jakub Kicinski -[Salvatore Bonaccorso: Adjust for context in 6.1.y series without -e8d4d34df715 ("net: Add netif_get_gro_max_size helper for GRO")] -Signed-off-by: Salvatore Bonaccorso -Signed-off-by: Sasha Levin - -diff --git a/net/core/gro.c b/net/core/gro.c -index a1b6faeb2..de524b613 100644 ---- a/net/core/gro.c -+++ b/net/core/gro.c -@@ -113,6 +113,9 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) - if (p->pp_recycle != skb->pp_recycle) - return -ETOOMANYREFS; - -+ if (skb_zcopy(p) || skb_zcopy(skb)) -+ return -ETOOMANYREFS; -+ - /* pairs with WRITE_ONCE() in netif_set_gro(_ipv4)_max_size() */ - gro_max_size = p->protocol == htons(ETH_P_IPV6) ? - READ_ONCE(p->dev->gro_max_size) : diff --git a/SOURCES/1733-xfrm-defensively-unhash-xfrm-state-lists-in-xfrm-state-delet.patch b/SOURCES/1733-xfrm-defensively-unhash-xfrm-state-lists-in-xfrm-state-delet.patch deleted file mode 100644 index c712bbb3c..000000000 --- a/SOURCES/1733-xfrm-defensively-unhash-xfrm-state-lists-in-xfrm-state-delet.patch +++ /dev/null @@ -1,114 +0,0 @@ -From 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8 Mon Sep 17 00:00:00 2001 -From: Michal Kosiorek -Date: Wed, 13 May 2026 13:44:48 -0400 -Subject: [PATCH] xfrm: defensively unhash xfrm_state lists in - __xfrm_state_delete - -[ Upstream commit 14acf9652e5690de3c7486c6db5fb8dafd0a32a3 ] - -KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s -hlist_del_rcu calls under syzkaller load on linux-6.12.y stable -(reproduced on 6.12.47, also reachable via the same code path on -torvalds/master and on the ipsec tree). Nine unique signatures cluster -in the xfrm_state lifecycle, the load-bearing one being: - - BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] - BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] - BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c - Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435 - - Workqueue: netns cleanup_net - Call Trace: - __hlist_del / hlist_del_rcu - __xfrm_state_delete - xfrm_state_delete - xfrm_state_flush - xfrm_state_fini - ops_exit_list - cleanup_net - -The other observed signatures hit the same slab object from -__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB -write variant of __xfrm_state_delete, all on the byseq/byspi -hash chains. - -__xfrm_state_delete() guards its byseq and byspi unhashes with -value-based predicates: - - if (x->km.seq) - hlist_del_rcu(&x->byseq); - if (x->id.spi) - hlist_del_rcu(&x->byspi); - -while everywhere else in the file (e.g. state_cache, state_cache_input) -the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets -x->id.spi = newspi inside xfrm_state_lock and then immediately inserts -into byspi, but a path that observes x->id.spi != 0 outside of -xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently -with whether x is actually on the list. The same holds for x->km.seq -versus byseq, and the bydst/bysrc unhashes have no predicate at all, -so a second __xfrm_state_delete() on the same object writes through -LIST_POISON pprev. - -The defensive change here: - - - Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, - bysrc, byseq and byspi so a second deletion is a no-op rather - than a write through LIST_POISON pprev. The byseq/byspi nodes - are already initialised in xfrm_state_alloc(). - - Test hlist_unhashed() rather than the value predicate for - byseq/byspi, so the unhash decision tracks list state rather than - mutable scalar fields. - -Empirical verification: applied this patch on top of v6.12.47, rebuilt, -and re-ran the same syzkaller harness for 1h16m on a previously-crashy -configuration that produced ~100 hits each of slab-use-after-free -Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in -__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at -~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo -confirms the xfrm_state slab is actively allocated and freed during -the run (~143 KiB resident), so the fuzzer is still exercising those -code paths -- they just no longer crash. - -Reproduction: - - - Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV - - syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db - - 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal - - 9 unique signatures collected in ~9h, all within xfrm_state - lifecycle - -Fixes: fe9f1d8779cb ("xfrm: add state hashtable keyed by seq") -Fixes: 7b4dc3600e48 ("[XFRM]: Do not add a state whose SPI is zero to the SPI hash.") -Reported-by: Michal Kosiorek -Tested-by: Michal Kosiorek -Cc: stable@vger.kernel.org -Signed-off-by: Michal Kosiorek -Signed-off-by: Steffen Klassert -[ dropped state_cache/state_cache_input unhash hunks and xfrm_nat_keepalive_state_updated() call ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c -index 3f5b630f7..93a8144d4 100644 ---- a/net/xfrm/xfrm_state.c -+++ b/net/xfrm/xfrm_state.c -@@ -751,12 +751,12 @@ int __xfrm_state_delete(struct xfrm_state *x) - x->km.state = XFRM_STATE_DEAD; - spin_lock(&net->xfrm.xfrm_state_lock); - list_del(&x->km.all); -- hlist_del_rcu(&x->bydst); -- hlist_del_rcu(&x->bysrc); -- if (x->km.seq) -- hlist_del_rcu(&x->byseq); -- if (x->id.spi) -- hlist_del_rcu(&x->byspi); -+ hlist_del_init_rcu(&x->bydst); -+ hlist_del_init_rcu(&x->bysrc); -+ if (!hlist_unhashed(&x->byseq)) -+ hlist_del_init_rcu(&x->byseq); -+ if (!hlist_unhashed(&x->byspi)) -+ hlist_del_init_rcu(&x->byspi); - net->xfrm.state_num--; - spin_unlock(&net->xfrm.xfrm_state_lock); - diff --git a/SOURCES/1734-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch b/SOURCES/1734-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch deleted file mode 100644 index e7b045333..000000000 --- a/SOURCES/1734-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch +++ /dev/null @@ -1,59 +0,0 @@ -From de1e5c0a53783dc22cba5cd5b520d81dd1ca0613 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Wed, 1 Jul 2026 15:14:30 -0300 -Subject: [PATCH] smb: client: fix off-by-8 bounds check in check_wsl_eas() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180044 - -commit 3d8b9d06bd3ac4c6846f5498800b0f5f8062e53b -Author: Greg Kroah-Hartman -Date: Mon Apr 6 15:49:37 2026 +0200 - - smb: client: fix off-by-8 bounds check in check_wsl_eas() - - The bounds check uses (u8 *)ea + nlen + 1 + vlen as the end of the EA - name and value, but ea_data sits at offset sizeof(struct - smb2_file_full_ea_info) = 8 from ea, not at offset 0. The strncmp() - later reads ea->ea_data[0..nlen-1] and the value bytes follow at - ea_data[nlen+1..nlen+vlen], so the actual end is ea->ea_data + nlen + 1 - + vlen. Isn't pointer math fun? - - The earlier check (u8 *)ea > end - sizeof(*ea) only guarantees the - 8-byte header is in bounds, but since the last EA is placed within 8 - bytes of the end of the response, the name and value bytes are read past - the end of iov. - - Fix this mess all up by using ea->ea_data as the base for the bounds - check. - - An "untrusted" server can use this to leak up to 8 bytes of kernel heap - into the EA name comparison and influence which WSL xattr the data is - interpreted as. - - Cc: Ronnie Sahlberg - Cc: Shyam Prasad N - Cc: Tom Talpey - Cc: Bharath SM - Cc: linux-cifs@vger.kernel.org - Cc: samba-technical@lists.samba.org - Cc: stable - Assisted-by: gregkh_clanker_t1000 - Reviewed-by: Paulo Alcantara (Red Hat) - Signed-off-by: Greg Kroah-Hartman - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 47bff865c..7f4e27613 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -124,7 +124,7 @@ static int check_wsl_eas(struct kvec *rsp_iov) - nlen = ea->ea_name_length; - vlen = le16_to_cpu(ea->ea_value_length); - if (nlen != SMB2_WSL_XATTR_NAME_LEN || -- (u8 *)ea + nlen + 1 + vlen > end) -+ (u8 *)ea->ea_data + nlen + 1 + vlen > end) - return -EINVAL; - - switch (vlen) { diff --git a/SOURCES/1735-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch b/SOURCES/1735-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch deleted file mode 100644 index 77a95c3b2..000000000 --- a/SOURCES/1735-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch +++ /dev/null @@ -1,70 +0,0 @@ -From a26414c13d61ee7ad429dc66d9c3eea15f3bb0e8 Mon Sep 17 00:00:00 2001 -From: Paulo Alcantara -Date: Wed, 1 Jul 2026 15:14:45 -0300 -Subject: [PATCH] smb/client: fix out-of-bounds read in smb2_compound_op() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180044 -CVE: CVE-2026-46155 - -commit 8d09328dfda089675e4c049f3f256064a1d1996b -Author: Zisen Ye -Date: Wed May 6 11:49:08 2026 +0800 - - smb/client: fix out-of-bounds read in smb2_compound_op() - - If a server sends a truncated response but a large OutputBufferLength, and - terminates the EA list early, check_wsl_eas() returns success without - validating that the entire OutputBufferLength fits within iov_len. - - Then smb2_compound_op() does: - memcpy(idata->wsl.eas, data[0], size[0]); - - Where size[0] is OutputBufferLength. If iov_len is smaller than size[0], - memcpy can read beyond the end of the rsp_iov allocation and leak adjacent - kernel heap memory. - - Link: https://lore.kernel.org/linux-cifs/d998240c-aca9-420d-9dbd-f5ba24af19e0@chenxiaosong.com/ - Fixes: ea41367b2a60 ("smb: client: introduce SMB2_OP_QUERY_WSL_EA") - Cc: stable@vger.kernel.org - Signed-off-by: Zisen Ye - Reviewed-by: ChenXiaoSong - Signed-off-by: Steve French - -Signed-off-by: Paulo Alcantara - -diff --git a/fs/smb/client/smb2inode.c b/fs/smb/client/smb2inode.c -index 7f4e27613..f3c1ed362 100644 ---- a/fs/smb/client/smb2inode.c -+++ b/fs/smb/client/smb2inode.c -@@ -107,7 +107,7 @@ static int check_wsl_eas(struct kvec *rsp_iov) - u32 outlen, next; - u16 vlen; - u8 nlen; -- u8 *end; -+ u8 *ea_end, *iov_end; - - outlen = le32_to_cpu(rsp->OutputBufferLength); - if (outlen < SMB2_WSL_MIN_QUERY_EA_RESP_SIZE || -@@ -116,15 +116,19 @@ static int check_wsl_eas(struct kvec *rsp_iov) - - ea = (void *)((u8 *)rsp_iov->iov_base + - le16_to_cpu(rsp->OutputBufferOffset)); -- end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len; -+ ea_end = (u8 *)ea + outlen; -+ iov_end = (u8 *)rsp_iov->iov_base + rsp_iov->iov_len; -+ if (ea_end > iov_end) -+ return -EINVAL; -+ - for (;;) { -- if ((u8 *)ea > end - sizeof(*ea)) -+ if ((u8 *)ea > ea_end - sizeof(*ea)) - return -EINVAL; - - nlen = ea->ea_name_length; - vlen = le16_to_cpu(ea->ea_value_length); - if (nlen != SMB2_WSL_XATTR_NAME_LEN || -- (u8 *)ea->ea_data + nlen + 1 + vlen > end) -+ (u8 *)ea->ea_data + nlen + 1 + vlen > ea_end) - return -EINVAL; - - switch (vlen) { diff --git a/SOURCES/1739-tg3-fix-race-for-querying-speed-duplex.patch b/SOURCES/1739-tg3-fix-race-for-querying-speed-duplex.patch deleted file mode 100644 index d2315a7ee..000000000 --- a/SOURCES/1739-tg3-fix-race-for-querying-speed-duplex.patch +++ /dev/null @@ -1,35 +0,0 @@ -From 38b778cd8963336ed70b618be269b65ffeb0ae42 Mon Sep 17 00:00:00 2001 -From: Thomas Bogendoerfer -Date: Wed, 25 Mar 2026 12:20:53 +0100 -Subject: [PATCH] tg3: Fix race for querying speed/duplex - -[ Upstream commit bb417456c7814d1493d98b7dd9c040bf3ce3b4ed ] - -When driver signals carrier up via netif_carrier_on() its internal -link_up state isn't updated immediately. This leads to inconsistent -speed/duplex in /proc/net/bonding/bondX where the speed and duplex -is shown as unknown while ethtool shows correct values. Fix this by -using netif_carrier_ok() for link checking in get_ksettings function. - -Fixes: 84421b99cedc ("tg3: Update link_up flag for phylib devices") -Signed-off-by: Thomas Bogendoerfer -Reviewed-by: Pavan Chebbi -Signed-off-by: David S. Miller -Signed-off-by: Sasha Levin - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index bd3b56c7aab8..e18e58f8258e 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -12223,7 +12223,7 @@ static int tg3_get_link_ksettings(struct net_device *dev, - ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.advertising, - advertising); - -- if (netif_running(dev) && tp->link_up) { -+ if (netif_running(dev) && netif_carrier_ok(dev)) { - cmd->base.speed = tp->link_config.active_speed; - cmd->base.duplex = tp->link_config.active_duplex; - ethtool_convert_legacy_u32_to_link_mode( --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1740-netfilter-bridge-make-ebt-snat-arp-rewrite-writable.patch b/SOURCES/1740-netfilter-bridge-make-ebt-snat-arp-rewrite-writable.patch deleted file mode 100644 index 82c85a6c7..000000000 --- a/SOURCES/1740-netfilter-bridge-make-ebt-snat-arp-rewrite-writable.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 76280b78cc9f23bdc6438e10ad6dff148ef8375b Mon Sep 17 00:00:00 2001 -From: Yiming Qian -Date: Sat, 23 May 2026 12:29:10 +0000 -Subject: [PATCH] netfilter: bridge: make ebt_snat ARP rewrite writable - -[ Upstream commit 67ba971ae02514d85818fe0c32549ab4bfa3bf49 ] - -The ebtables SNAT target keeps the Ethernet source address rewrite -behind skb_ensure_writable(skb, 0). This is intentional: at the bridge -ebtables hooks the Ethernet header is addressed through -skb_mac_header()/eth_hdr(), while skb->data points at the Ethernet -payload. Asking skb_ensure_writable() for ETH_HLEN bytes would check -the payload, not the Ethernet header, and would reintroduce the small -packet regression fixed by commit 63137bc5882a. - -However, the optional ARP sender hardware address rewrite is different. -It writes through skb_store_bits() at an offset relative to skb->data: - - skb_store_bits(skb, sizeof(struct arphdr), info->mac, ETH_ALEN) - -skb_header_pointer() only safely reads the ARP header; it does not make -the later sender hardware address range writable. If that range is -still held in a nonlinear skb fragment backed by a splice-imported file -page, skb_store_bits() maps the frag page and copies the new MAC address -directly into it. - -Ensure the ARP SHA range is writable before reading the ARP header and -before calling skb_store_bits(). - -Fixes: 63137bc5882a ("netfilter: ebtables: Fixes dropping of small packets in bridge nat") -Reported-by: Yiming Qian -Signed-off-by: Yiming Qian -Signed-off-by: Florian Westphal -Signed-off-by: Pablo Neira Ayuso -Signed-off-by: Sasha Levin - -diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c -index 7dfbcdfc30e5..c9e229af0366 100644 ---- a/net/bridge/netfilter/ebt_snat.c -+++ b/net/bridge/netfilter/ebt_snat.c -@@ -31,6 +31,9 @@ ebt_snat_tg(struct sk_buff *skb, const struct xt_action_param *par) - const struct arphdr *ap; - struct arphdr _ah; - -+ if (skb_ensure_writable(skb, sizeof(_ah) + ETH_ALEN)) -+ return EBT_DROP; -+ - ap = skb_header_pointer(skb, 0, sizeof(_ah), &_ah); - if (ap == NULL) - return EBT_DROP; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1741-epoll-annotate-racy-check.patch b/SOURCES/1741-epoll-annotate-racy-check.patch deleted file mode 100644 index b698c2631..000000000 --- a/SOURCES/1741-epoll-annotate-racy-check.patch +++ /dev/null @@ -1,66 +0,0 @@ -From bde1be0c6e5eeb145576344159be1f51cb8d5d8b Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:53:22 +0800 -Subject: [PATCH] epoll: annotate racy check - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 6474353a5e3d0b2cf610153cea0c61f576a36d0a -Author: Christian Brauner -Date: Wed Sep 25 11:05:16 2024 +0200 - - epoll: annotate racy check - - Epoll relies on a racy fastpath check during __fput() in - eventpoll_release() to avoid the hit of pointlessly acquiring a - semaphore. Annotate that race by using WRITE_ONCE() and READ_ONCE(). - - Link: https://lore.kernel.org/r/66edfb3c.050a0220.3195df.001a.GAE@google.com - Link: https://lore.kernel.org/r/20240925-fungieren-anbauen-79b334b00542@brauner - Reviewed-by: Jan Kara - Reported-by: syzbot+3b6b32dc50537a49bb4a@syzkaller.appspotmail.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index a7efeb499e4b..616f97e9b75b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -852,7 +852,8 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - to_free = NULL; - head = file->f_ep; - if (head->first == &epi->fllink && !epi->fllink.next) { -- file->f_ep = NULL; -+ /* See eventpoll_release() for details. */ -+ WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { - struct epitems_head *v; - v = container_of(head, struct epitems_head, epitems); -@@ -1630,7 +1631,8 @@ static int attach_epitem(struct file *file, struct epitem *epi) - spin_unlock(&file->f_lock); - goto allocate; - } -- file->f_ep = head; -+ /* See eventpoll_release() for details. */ -+ WRITE_ONCE(file->f_ep, head); - to_free = NULL; - } - hlist_add_head_rcu(&epi->fllink, file->f_ep); -diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h -index 3337745d81bd..0c0d00fcd131 100644 ---- a/include/linux/eventpoll.h -+++ b/include/linux/eventpoll.h -@@ -42,7 +42,7 @@ static inline void eventpoll_release(struct file *file) - * because the file in on the way to be removed and nobody ( but - * eventpoll ) has still a reference to this file. - */ -- if (likely(!file->f_ep)) -+ if (likely(!READ_ONCE(file->f_ep))) - return; - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1742-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch b/SOURCES/1742-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch deleted file mode 100644 index f2bdc8dc7..000000000 --- a/SOURCES/1742-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch +++ /dev/null @@ -1,53 +0,0 @@ -From 2b62eb17ec16b6a7d341497e48e331f84280cd58 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:54:24 +0800 -Subject: [PATCH] eventpoll: defer struct eventpoll free to RCU grace period - -JIRA: https://redhat.atlassian.net/browse/RHEL-173837 -Upstream status: Linus - -CVE: CVE-2026-43074 - -commit 07712db80857d5d09ae08f3df85a708ecfc3b61f -Author: Nicholas Carlini -Date: Tue Mar 31 15:25:32 2026 +0200 - - eventpoll: defer struct eventpoll free to RCU grace period - - In certain situations, ep_free() in eventpoll.c will kfree the epi->ep - eventpoll struct while it still being used by another concurrent thread. - Defer the kfree() to an RCU callback to prevent UAF. - - Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") - Signed-off-by: Nicholas Carlini - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 616f97e9b75b..0368ab69138a 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -225,6 +225,9 @@ struct eventpoll { - */ - refcount_t refcount; - -+ /* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */ -+ struct rcu_head rcu; -+ - #ifdef CONFIG_NET_RX_BUSY_POLL - /* used to track busy poll napi_id */ - unsigned int napi_id; -@@ -818,7 +821,8 @@ static void ep_free(struct eventpoll *ep) - mutex_destroy(&ep->mtx); - free_uid(ep->user); - wakeup_source_unregister(ep->ws); -- kfree(ep); -+ /* ep_get_upwards_depth_proc() may still hold epi->ep under RCU */ -+ kfree_rcu(ep, rcu); - } - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1743-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch b/SOURCES/1743-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch deleted file mode 100644 index 126527bc2..000000000 --- a/SOURCES/1743-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch +++ /dev/null @@ -1,39 +0,0 @@ -From 1fe6204c6ea38fc1d370d9bbb9fd6a800104e5c8 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:54:59 +0800 -Subject: [PATCH] eventpoll: use hlist_is_singular_node() in __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 3d9fd0abc94d8cd430cc7cd7d37ce5e5aae2cd2b -Author: Christian Brauner -Date: Thu Apr 23 11:56:04 2026 +0200 - - eventpoll: use hlist_is_singular_node() in __ep_remove() - - Replace the open-coded "epi is the only entry in file->f_ep" check - with hlist_is_singular_node(). Same semantics, and the helper avoids - the head-cacheline access in the common false case. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-1-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 0368ab69138a..2dd87800bfbf 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -855,7 +855,7 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - - to_free = NULL; - head = file->f_ep; -- if (head->first == &epi->fllink && !epi->fllink.next) { -+ if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1744-eventpoll-split-ep-remove.patch b/SOURCES/1744-eventpoll-split-ep-remove.patch deleted file mode 100644 index a872525c2..000000000 --- a/SOURCES/1744-eventpoll-split-ep-remove.patch +++ /dev/null @@ -1,84 +0,0 @@ -From 83db11e5ba3c57104945247e11c1891355a12fb6 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:55:51 +0800 -Subject: [PATCH] eventpoll: split __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 0f7bdfd413000985de09fc39eb9efa1e091a3ce0 -Author: Christian Brauner -Date: Thu Apr 23 11:56:05 2026 +0200 - - eventpoll: split __ep_remove() - - Split __ep_remove() to delineate file removal from epoll item removal. - - Suggested-by: Linus Torvalds - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-2-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 2dd87800bfbf..001c87b6ddab 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -825,6 +825,9 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -+ - /* - * Removes a "struct epitem" from the eventpoll RB tree and deallocates - * all the associated resources. Must be called with "mtx" held. -@@ -836,8 +839,6 @@ static void ep_free(struct eventpoll *ep) - static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - { - struct file *file = epi->ffd.file; -- struct epitems_head *to_free; -- struct hlist_head *head; - - lockdep_assert_irqs_enabled(); - -@@ -853,8 +854,21 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - return false; - } - -- to_free = NULL; -- head = file->f_ep; -+ __ep_remove_file(ep, epi, file); -+ return __ep_remove_epi(ep, epi); -+} -+ -+/* -+ * Called with &file->f_lock held, -+ * returns with it released -+ */ -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+{ -+ struct epitems_head *to_free = NULL; -+ struct hlist_head *head = file->f_ep; -+ -+ lockdep_assert_held(&ep->mtx); -+ - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); -@@ -868,6 +882,11 @@ static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) - hlist_del_rcu(&epi->fllink); - spin_unlock(&file->f_lock); - free_ephead(to_free); -+} -+ -+static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+{ -+ lockdep_assert_held(&ep->mtx); - - rb_erase_cached(&epi->rbn, &ep->rbr); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1745-eventpoll-kill-ep-remove.patch b/SOURCES/1745-eventpoll-kill-ep-remove.patch deleted file mode 100644 index 3d7e6632d..000000000 --- a/SOURCES/1745-eventpoll-kill-ep-remove.patch +++ /dev/null @@ -1,134 +0,0 @@ -From 9a9a41f8aa46741f965703f520542e9e8fdbe59f Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:56:21 +0800 -Subject: [PATCH] eventpoll: kill __ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit e9e5cd40d7c403e19f21d0f7b8b8ba3a76b58330 -Author: Christian Brauner -Date: Thu Apr 23 11:56:06 2026 +0200 - - eventpoll: kill __ep_remove() - - Remove the boolean conditional in __ep_remove() and restructure the code - so the check for racing with eventpoll_release_file() are only done in - the ep_remove_safe() path where they belong. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-3-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 001c87b6ddab..cb75868ba1de 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -825,49 +825,18 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file); --static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi); -- --/* -- * Removes a "struct epitem" from the eventpoll RB tree and deallocates -- * all the associated resources. Must be called with "mtx" held. -- * If the dying flag is set, do the removal only if force is true. -- * This prevents ep_clear_and_put() from dropping all the ep references -- * while running concurrently with eventpoll_release_file(). -- * Returns true if the eventpoll can be disposed. -- */ --static bool __ep_remove(struct eventpoll *ep, struct epitem *epi, bool force) --{ -- struct file *file = epi->ffd.file; -- -- lockdep_assert_irqs_enabled(); -- -- /* -- * Removes poll wait queue hooks. -- */ -- ep_unregister_pollwait(ep, epi); -- -- /* Remove the current item from the list of epoll hooks */ -- spin_lock(&file->f_lock); -- if (epi->dying && !force) { -- spin_unlock(&file->f_lock); -- return false; -- } -- -- __ep_remove_file(ep, epi, file); -- return __ep_remove_epi(ep, epi); --} -- - /* - * Called with &file->f_lock held, - * returns with it released - */ --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, struct file *file) -+static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, -+ struct file *file) - { - struct epitems_head *to_free = NULL; - struct hlist_head *head = file->f_ep; - - lockdep_assert_held(&ep->mtx); -+ lockdep_assert_held(&file->f_lock); - - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ -@@ -914,7 +883,25 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) - { -- if (__ep_remove(ep, epi, false)) -+ struct file *file = epi->ffd.file; -+ -+ lockdep_assert_irqs_enabled(); -+ lockdep_assert_held(&ep->mtx); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ /* sync with eventpoll_release_file() */ -+ if (unlikely(READ_ONCE(epi->dying))) -+ return; -+ -+ spin_lock(&file->f_lock); -+ if (epi->dying) { -+ spin_unlock(&file->f_lock); -+ return; -+ } -+ __ep_remove_file(ep, epi, file); -+ -+ if (__ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - -@@ -1146,7 +1133,7 @@ void eventpoll_release_file(struct file *file) - spin_lock(&file->f_lock); - if (file->f_ep && file->f_ep->first) { - epi = hlist_entry(file->f_ep->first, struct epitem, fllink); -- epi->dying = true; -+ WRITE_ONCE(epi->dying, true); - spin_unlock(&file->f_lock); - - /* -@@ -1155,7 +1142,13 @@ void eventpoll_release_file(struct file *file) - */ - ep = epi->ep; - mutex_lock(&ep->mtx); -- dispose = __ep_remove(ep, epi, true); -+ -+ ep_unregister_pollwait(ep, epi); -+ -+ spin_lock(&file->f_lock); -+ __ep_remove_file(ep, epi, file); -+ dispose = __ep_remove_epi(ep, epi); -+ - mutex_unlock(&ep->mtx); - - if (dispose && ep_refcount_dec_and_test(ep)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1746-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch b/SOURCES/1746-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch deleted file mode 100644 index 23c3da7fc..000000000 --- a/SOURCES/1746-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch +++ /dev/null @@ -1,98 +0,0 @@ -From 4e16f36e52dfe03056ec8c4daaef79b1715bb341 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:58:37 +0800 -Subject: [PATCH] eventpoll: rename ep_remove_safe() back to ep_remove() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 0bade234723e40e4937be912e105785d6a51464e -Author: Christian Brauner -Date: Thu Apr 23 11:56:07 2026 +0200 - - eventpoll: rename ep_remove_safe() back to ep_remove() - - The current name is just confusing and doesn't clarify anything. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-4-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index cb75868ba1de..efc9e3e1e3f5 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -881,7 +881,7 @@ static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - /* - * ep_remove variant for callers owing an additional reference to the ep - */ --static void ep_remove_safe(struct eventpoll *ep, struct epitem *epi) -+static void ep_remove(struct eventpoll *ep, struct epitem *epi) - { - struct file *file = epi->ffd.file; - -@@ -928,7 +928,7 @@ static void ep_clear_and_put(struct eventpoll *ep) - - /* - * Walks through the whole tree and try to free each "struct epitem". -- * Note that ep_remove_safe() will not remove the epitem in case of a -+ * Note that ep_remove() will not remove the epitem in case of a - * racing eventpoll_release_file(); the latter will do the removal. - * At this point we are sure no poll callbacks will be lingering around. - * Since we still own a reference to the eventpoll struct, the loop can't -@@ -937,7 +937,7 @@ static void ep_clear_and_put(struct eventpoll *ep) - for (rbp = rb_first_cached(&ep->rbr); rbp; rbp = next) { - next = rb_next(rbp); - epi = rb_entry(rbp, struct epitem, rbn); -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - cond_resched(); - } - -@@ -1714,21 +1714,21 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - mutex_unlock(&tep->mtx); - - /* -- * ep_remove_safe() calls in the later error paths can't lead to -+ * ep_remove() calls in the later error paths can't lead to - * ep_free() as the ep file itself still holds an ep reference. - */ - ep_get(ep); - - /* now check if we've created too many backpaths */ - if (unlikely(full_check && reverse_path_check())) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return -EINVAL; - } - - if (epi->event.events & EPOLLWAKEUP) { - error = ep_create_wakeup_source(epi); - if (error) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return error; - } - } -@@ -1752,7 +1752,7 @@ static int ep_insert(struct eventpoll *ep, const struct epoll_event *event, - * high memory pressure. - */ - if (unlikely(!epq.epi)) { -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - return -ENOMEM; - } - -@@ -2415,7 +2415,7 @@ int do_epoll_ctl(int epfd, int op, int fd, struct epoll_event *epds, - * The eventpoll itself is still alive: the refcount - * can't go to zero here. - */ -- ep_remove_safe(ep, epi); -+ ep_remove(ep, epi); - error = 0; - } else { - error = -ENOENT; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1747-eventpoll-move-epi-fget-up.patch b/SOURCES/1747-eventpoll-move-epi-fget-up.patch deleted file mode 100644 index 199fb0414..000000000 --- a/SOURCES/1747-eventpoll-move-epi-fget-up.patch +++ /dev/null @@ -1,95 +0,0 @@ -From 8c1707336e5674c16c2a24c9cdf2b5018b166a09 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:00:26 +0800 -Subject: [PATCH] eventpoll: move epi_fget() up - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 86e87059e6d1fd5115a31949726450ed03c1073b -Author: Christian Brauner -Date: Thu Apr 23 11:56:08 2026 +0200 - - eventpoll: move epi_fget() up - - We'll need it when removing files so move it up. No functional change. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-5-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index f7591c255..c9e9d3da9 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -715,6 +715,34 @@ static void ep_free(struct eventpoll *ep) - kfree_rcu(ep, rcu); - } - -+/* -+ * The ffd.file pointer may be in the process of being torn down due to -+ * being closed, but we may not have finished eventpoll_release() yet. -+ * -+ * Normally, even with the atomic_long_inc_not_zero, the file may have -+ * been free'd and then gotten re-allocated to something else (since -+ * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -+ * -+ * But for epoll, users hold the ep->mtx mutex, and as such any file in -+ * the process of being free'd will block in eventpoll_release_file() -+ * and thus the underlying file allocation will not be free'd, and the -+ * file re-use cannot happen. -+ * -+ * For the same reason we can avoid a rcu_read_lock() around the -+ * operation - 'ffd.file' cannot go away even if the refcount has -+ * reached zero (but we must still not call out to ->poll() functions -+ * etc). -+ */ -+static struct file *epi_fget(const struct epitem *epi) -+{ -+ struct file *file; -+ -+ file = epi->ffd.file; -+ if (!atomic_long_inc_not_zero(&file->f_count)) -+ file = NULL; -+ return file; -+} -+ - /* - * Called with &file->f_lock held, - * returns with it released -@@ -886,34 +914,6 @@ static __poll_t __ep_eventpoll_poll(struct file *file, poll_table *wait, int dep - return res; - } - --/* -- * The ffd.file pointer may be in the process of being torn down due to -- * being closed, but we may not have finished eventpoll_release() yet. -- * -- * Normally, even with the atomic_long_inc_not_zero, the file may have -- * been free'd and then gotten re-allocated to something else (since -- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -- * -- * But for epoll, users hold the ep->mtx mutex, and as such any file in -- * the process of being free'd will block in eventpoll_release_file() -- * and thus the underlying file allocation will not be free'd, and the -- * file re-use cannot happen. -- * -- * For the same reason we can avoid a rcu_read_lock() around the -- * operation - 'ffd.file' cannot go away even if the refcount has -- * reached zero (but we must still not call out to ->poll() functions -- * etc). -- */ --static struct file *epi_fget(const struct epitem *epi) --{ -- struct file *file; -- -- file = epi->ffd.file; -- if (!atomic_long_inc_not_zero(&file->f_count)) -- file = NULL; -- return file; --} -- - /* - * Differs from ep_eventpoll_poll() in that internal callers already have - * the ep->mtx so we need to start from depth=1, such that mutex_lock_nested() diff --git a/SOURCES/1748-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch b/SOURCES/1748-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch deleted file mode 100644 index 985802699..000000000 --- a/SOURCES/1748-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch +++ /dev/null @@ -1,78 +0,0 @@ -From 6175a9a692e559e7f0635d3a32d20fe94bae8280 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 15:57:24 +0800 -Subject: [PATCH] eventpoll: drop vestigial __ prefix from - ep_remove_{file,epi}() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -Conflict: I don't know how this commit is present when commit - d3608d9e2f5a ("eventpoll: fix ep_remove struct eventpoll / - struct file UAF") is applied since its time stamp is later than - the afore mentioned commit. I've applied it here purely to avoid - the subsequent conflict. - -commit 0feaf644f7180c4a91b6b405a881afbfd958f1cf -Author: Christian Brauner -Date: Fri Apr 24 00:23:18 2026 +0200 - - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() - - With __ep_remove() gone, the double-underscore on __ep_remove_file() - and __ep_remove_epi() no longer contrasts with a __-less parent and - just reads as noise. Rename both to ep_remove_file() and - ep_remove_epi(). No functional change. - - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index ded53c6fbd6f..1246c0517aa6 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -857,7 +857,7 @@ static struct file *epi_fget(const struct epitem *epi) - * Called with &file->f_lock held, - * returns with it released - */ --static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, -+static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - struct file *file) - { - struct epitems_head *to_free = NULL; -@@ -881,7 +881,7 @@ static void __ep_remove_file(struct eventpoll *ep, struct epitem *epi, - free_ephead(to_free); - } - --static bool __ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - { - lockdep_assert_held(&ep->mtx); - -@@ -927,9 +927,9 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - spin_unlock(&file->f_lock); - return; - } -- __ep_remove_file(ep, epi, file); -+ ep_remove_file(ep, epi, file); - -- if (__ep_remove_epi(ep, epi)) -+ if (ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - -@@ -1146,8 +1146,8 @@ void eventpoll_release_file(struct file *file) - ep_unregister_pollwait(ep, epi); - - spin_lock(&file->f_lock); -- __ep_remove_file(ep, epi, file); -- dispose = __ep_remove_epi(ep, epi); -+ ep_remove_file(ep, epi, file); -+ dispose = ep_remove_epi(ep, epi); - - mutex_unlock(&ep->mtx); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1749-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch b/SOURCES/1749-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch deleted file mode 100644 index 2f4872c14..000000000 --- a/SOURCES/1749-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch +++ /dev/null @@ -1,104 +0,0 @@ -From 5c53e2d149e55d3ee64fb03387d2f81d59477774 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:00:59 +0800 -Subject: [PATCH] eventpoll: fix ep_remove struct eventpoll / struct file UAF - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -CVE: CVE-2026-46242 - -commit a6dc643c69311677c574a0f17a3f4d66a5f3744b -Author: Christian Brauner -Date: Thu Apr 23 11:56:09 2026 +0200 - - eventpoll: fix ep_remove struct eventpoll / struct file UAF - - ep_remove() (via ep_remove_file()) cleared file->f_ep under - file->f_lock but then kept using @file inside the critical section - (is_file_epoll(), hlist_del_rcu() through the head, spin_unlock). - A concurrent __fput() taking the eventpoll_release() fastpath in - that window observed the transient NULL, skipped - eventpoll_release_file() and ran to f_op->release / file_free(). - - For the epoll-watches-epoll case, f_op->release is - ep_eventpoll_release() -> ep_clear_and_put() -> ep_free(), which - kfree()s the watched struct eventpoll. Its embedded ->refs - hlist_head is exactly where epi->fllink.pprev points, so the - subsequent hlist_del_rcu()'s "*pprev = next" scribbles into freed - kmalloc-192 memory. - - In addition, struct file is SLAB_TYPESAFE_BY_RCU, so the slot - backing @file could be recycled by alloc_empty_file() -- - reinitializing f_lock and f_ep -- while ep_remove() is still - nominally inside that lock. The upshot is an attacker-controllable - kmem_cache_free() against the wrong slab cache. - - Pin @file via epi_fget() at the top of ep_remove() and gate the - critical section on the pin succeeding. With the pin held @file - cannot reach refcount zero, which holds __fput() off and - transitively keeps the watched struct eventpoll alive across the - hlist_del_rcu() and the f_lock use, closing both UAFs. - - If the pin fails @file has already reached refcount zero and its - __fput() is in flight. Because we bailed before clearing f_ep, - that path takes the eventpoll_release() slow path into - eventpoll_release_file() and blocks on ep->mtx until the waiter - side's ep_clear_and_put() drops it. The bailed epi's share of - ep->refcount stays intact, so the trailing ep_refcount_dec_and_test() - in ep_clear_and_put() cannot free the eventpoll out from under - eventpoll_release_file(); the orphaned epi is then cleaned up - there. - - A successful pin also proves we are not racing - eventpoll_release_file() on this epi, so drop the now-redundant - re-check of epi->dying under f_lock. The cheap lockless - READ_ONCE(epi->dying) fast-path bailout stays. - - Fixes: 58c9b016e128 ("epoll: use refcount to reduce ep_mutex contention") - Reported-by: Jaeyoung Chung - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-6-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 1246c0517aa6..f46906640a9b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -911,22 +911,26 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - */ - static void ep_remove(struct eventpoll *ep, struct epitem *epi) - { -- struct file *file = epi->ffd.file; -+ struct file *file __free(fput) = NULL; - - lockdep_assert_irqs_enabled(); - lockdep_assert_held(&ep->mtx); - - ep_unregister_pollwait(ep, epi); - -- /* sync with eventpoll_release_file() */ -+ /* cheap sync with eventpoll_release_file() */ - if (unlikely(READ_ONCE(epi->dying))) - return; - -- spin_lock(&file->f_lock); -- if (epi->dying) { -- spin_unlock(&file->f_lock); -+ /* -+ * If we manage to grab a reference it means we're not in -+ * eventpoll_release_file() and aren't going to be. -+ */ -+ file = epi_fget(epi); -+ if (!file) - return; -- } -+ -+ spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - - if (ep_remove_epi(ep, epi)) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1750-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch b/SOURCES/1750-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch deleted file mode 100644 index 9c82bdf39..000000000 --- a/SOURCES/1750-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch +++ /dev/null @@ -1,70 +0,0 @@ -From e0bf480728b83ec6ceb66975bfbac514195873c8 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:01:51 +0800 -Subject: [PATCH] eventpoll: move f_lock acquisition into ep_remove_file() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit d30deeb8b0cf6259785c1fb79b87905d281b0a5a -Author: Christian Brauner -Date: Thu Apr 23 11:56:10 2026 +0200 - - eventpoll: move f_lock acquisition into ep_remove_file() - - Let the helper own its critical section end-to-end: take &file->f_lock - at the top, read file->f_ep inside the lock, release on exit. Callers - (ep_remove() and eventpoll_release_file()) no longer need to wrap the - call, and the function-comment lock-handoff contract is gone. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-7-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index f46906640a9b..9798ab5f7663 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -854,18 +854,18 @@ static struct file *epi_fget(const struct epitem *epi) - } - - /* -- * Called with &file->f_lock held, -- * returns with it released -+ * Takes &file->f_lock; returns with it released. - */ - static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - struct file *file) - { - struct epitems_head *to_free = NULL; -- struct hlist_head *head = file->f_ep; -+ struct hlist_head *head; - - lockdep_assert_held(&ep->mtx); -- lockdep_assert_held(&file->f_lock); - -+ spin_lock(&file->f_lock); -+ head = file->f_ep; - if (hlist_is_singular_node(&epi->fllink, head)) { - /* See eventpoll_release() for details. */ - WRITE_ONCE(file->f_ep, NULL); -@@ -930,7 +930,6 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - if (!file) - return; - -- spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - - if (ep_remove_epi(ep, epi)) -@@ -1149,7 +1148,6 @@ void eventpoll_release_file(struct file *file) - - ep_unregister_pollwait(ep, epi); - -- spin_lock(&file->f_lock); - ep_remove_file(ep, epi, file); - dispose = ep_remove_epi(ep, epi); - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1751-eventpoll-refresh-eventpoll-release-fast-path-comment.patch b/SOURCES/1751-eventpoll-refresh-eventpoll-release-fast-path-comment.patch deleted file mode 100644 index deabbe282..000000000 --- a/SOURCES/1751-eventpoll-refresh-eventpoll-release-fast-path-comment.patch +++ /dev/null @@ -1,66 +0,0 @@ -From eab8e8be1be2430b6712fc1a6c8925d240a40031 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:02:27 +0800 -Subject: [PATCH] eventpoll: refresh eventpoll_release() fast-path comment - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 33e92e9ecf48c08cb4807e9a36f9eb01619c1a1e -Author: Christian Brauner -Date: Thu Apr 23 11:56:11 2026 +0200 - - eventpoll: refresh eventpoll_release() fast-path comment - - The old comment justified the lockless READ_ONCE(file->f_ep) check - with "False positives simply cannot happen because the file is on - the way to be removed and nobody ( but eventpoll ) has still a - reference to this file." That reasoning was the root of the UAF - fixed in "eventpoll: fix ep_remove struct eventpoll / struct file - UAF": __ep_remove() could clear f_ep while another close raced - past the fast path and freed the watched eventpoll / recycled the - struct file slot. - - With ep_remove() now pinning @file via epi_fget() across the f_ep - clear and hlist_del_rcu(), the invariant is re-established for the - right reason: anyone who might clear f_ep holds @file alive for - the duration, so a NULL observation really does mean no - concurrent eventpoll path has work left on this file. Refresh the - comment accordingly so the next reader doesn't inherit the broken - model. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-8-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h -index 0c0d00fcd131..be762281355a 100644 ---- a/include/linux/eventpoll.h -+++ b/include/linux/eventpoll.h -@@ -35,12 +35,16 @@ static inline void eventpoll_release(struct file *file) - { - - /* -- * Fast check to avoid the get/release of the semaphore. Since -- * we're doing this outside the semaphore lock, it might return -- * false negatives, but we don't care. It'll help in 99.99% of cases -- * to avoid the semaphore lock. False positives simply cannot happen -- * because the file in on the way to be removed and nobody ( but -- * eventpoll ) has still a reference to this file. -+ * Fast check to skip the slow path in the common case where the -+ * file was never attached to an epoll. Safe without file->f_lock -+ * because every f_ep writer excludes a concurrent __fput() on -+ * @file: -+ * - ep_insert() requires the file alive (refcount > 0); -+ * - ep_remove() holds @file pinned via epi_fget() across the -+ * write; -+ * - eventpoll_release_file() runs from __fput() itself. -+ * We are in __fput() here, so none of those can race us: a NULL -+ * observation truly means no epoll path has work left on @file. - */ - if (likely(!READ_ONCE(file->f_ep))) - return; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1752-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch b/SOURCES/1752-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch deleted file mode 100644 index 43a7ae060..000000000 --- a/SOURCES/1752-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch +++ /dev/null @@ -1,92 +0,0 @@ -From 38a78d49b434ce9f29afdfaa870142ecb121800f Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:03:04 +0800 -Subject: [PATCH] eventpoll: drop dead bool return from ep_remove_epi() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 3a4551ea9c042502019b1d8a986e962cb9015366 -Author: Christian Brauner -Date: Thu Apr 23 11:56:12 2026 +0200 - - eventpoll: drop dead bool return from ep_remove_epi() - - ep_remove_epi() always returns true -- the "can be disposed" - answer was meaningful back when the dying-check lived inside the - pre-split __ep_remove(), but after that check moved to ep_remove() - the return value is just noise. Both callers gate on it - unconditionally: - - if (ep_remove_epi(ep, epi)) - WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - - dispose = ep_remove_epi(ep, epi); - ... - if (dispose && ep_refcount_dec_and_test(ep)) - ep_free(ep); - - Make ep_remove_epi() return void, drop the dispose local in - eventpoll_release_file(), and the useless conditionals at both - callers. No functional change. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-9-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index d8163df95..2933f5ea0 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -771,7 +771,7 @@ static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - free_ephead(to_free); - } - --static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) -+static void ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - { - lockdep_assert_held(&ep->mtx); - -@@ -793,7 +793,6 @@ static bool ep_remove_epi(struct eventpoll *ep, struct epitem *epi) - call_rcu(&epi->rcu, epi_rcu_free); - - percpu_counter_dec(&ep->user->epoll_watches); -- return true; - } - - /* -@@ -821,9 +820,8 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - return; - - ep_remove_file(ep, epi, file); -- -- if (ep_remove_epi(ep, epi)) -- WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); -+ ep_remove_epi(ep, epi); -+ WARN_ON_ONCE(ep_refcount_dec_and_test(ep)); - } - - static void ep_clear_and_put(struct eventpoll *ep) -@@ -992,7 +990,6 @@ void eventpoll_release_file(struct file *file) - { - struct eventpoll *ep; - struct epitem *epi; -- bool dispose; - - /* - * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from -@@ -1016,11 +1013,11 @@ void eventpoll_release_file(struct file *file) - ep_unregister_pollwait(ep, epi); - - ep_remove_file(ep, epi, file); -- dispose = ep_remove_epi(ep, epi); -+ ep_remove_epi(ep, epi); - - mutex_unlock(&ep->mtx); - -- if (dispose && ep_refcount_dec_and_test(ep)) -+ if (ep_refcount_dec_and_test(ep)) - ep_free(ep); - goto again; - } diff --git a/SOURCES/1753-eventpoll-drop-vestigial-epi-dying-flag.patch b/SOURCES/1753-eventpoll-drop-vestigial-epi-dying-flag.patch deleted file mode 100644 index 499dae72e..000000000 --- a/SOURCES/1753-eventpoll-drop-vestigial-epi-dying-flag.patch +++ /dev/null @@ -1,110 +0,0 @@ -From 3724dc6414c5da5c393e58e0e5863fdb95166922 Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Tue, 16 Jun 2026 16:03:26 +0800 -Subject: [PATCH] eventpoll: drop vestigial epi->dying flag - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit 07422c948f4bdf15567a129a0983f7c12e57ba8e -Author: Christian Brauner -Date: Thu Apr 23 11:56:13 2026 +0200 - - eventpoll: drop vestigial epi->dying flag - - With ep_remove() now pinning @file via epi_fget() across the - f_ep clear and hlist_del_rcu(), the dying flag no longer - orchestrates anything: it was set in eventpoll_release_file() - (which only runs from __fput(), i.e. after @file's refcount has - reached zero) and read in __ep_remove() / ep_remove() as a cheap - bail before attempting the same synchronization epi_fget() now - provides unconditionally. - - The implication is simple: epi->dying == true always coincides - with file_ref_get(&file->f_ref) == false, because __fput() is - reachable only once the refcount hits zero and the refcount is - monotone in that state. The READ_ONCE(epi->dying) in ep_remove() - therefore selects exactly the same callers that epi_fget() would - reject, just one atomic cheaper. That's not worth a struct - field, a second coordination mechanism, and the comments on - both. - - Refresh the eventpoll_release_file() comment to describe what - actually makes the path race-free now (the pin in ep_remove()). - No functional change: the correctness argument is unchanged, - only the mechanism is now a single one instead of two. - - Link: https://patch.msgid.link/20260423-work-epoll-uaf-v1-10-2470f9eec0f5@kernel.org - Signed-off-by: Christian Brauner (Amutable) - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 88b501a5e709..5228ff9c8742 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -148,13 +148,6 @@ struct epitem { - /* The file descriptor information this item refers to */ - struct epoll_filefd ffd; - -- /* -- * Protected by file->f_lock, true for to-be-released epitem already -- * removed from the "struct file" items list; together with -- * eventpoll->refcount orchestrates "struct eventpoll" disposal -- */ -- bool dying; -- - /* List containing poll wait queues */ - struct eppoll_entry *pwqlist; - -@@ -220,10 +213,7 @@ struct eventpoll { - struct hlist_head refs; - u8 loop_check_depth; - -- /* -- * usage count, used together with epitem->dying to -- * orchestrate the disposal of this struct -- */ -+ /* usage count, orchestrates "struct eventpoll" disposal */ - refcount_t refcount; - - /* used to defer freeing past ep_get_upwards_depth_proc() RCU walk */ -@@ -918,13 +908,10 @@ static void ep_remove(struct eventpoll *ep, struct epitem *epi) - - ep_unregister_pollwait(ep, epi); - -- /* cheap sync with eventpoll_release_file() */ -- if (unlikely(READ_ONCE(epi->dying))) -- return; -- - /* - * If we manage to grab a reference it means we're not in -- * eventpoll_release_file() and aren't going to be. -+ * eventpoll_release_file() and aren't going to be: once @file's -+ * refcount has reached zero, file_ref_get() cannot bring it back. - */ - file = epi_fget(epi); - if (!file) -@@ -1126,15 +1113,15 @@ void eventpoll_release_file(struct file *file) - struct epitem *epi; - - /* -- * Use the 'dying' flag to prevent a concurrent ep_clear_and_put() from -- * touching the epitems list before eventpoll_release_file() can access -- * the ep->mtx. -+ * A concurrent ep_remove() cannot outrace us: it pins @file via -+ * epi_fget(), which fails once __fput() has dropped the refcount -+ * to zero -- the path we're on. So any racing ep_remove() bails -+ * and leaves the epi for us to clean up here. - */ - again: - spin_lock(&file->f_lock); - if (file->f_ep && file->f_ep->first) { - epi = hlist_entry(file->f_ep->first, struct epitem, fllink); -- WRITE_ONCE(epi->dying, true); - spin_unlock(&file->f_lock); - - /* --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1754-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch b/SOURCES/1754-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch deleted file mode 100644 index 85940ba18..000000000 --- a/SOURCES/1754-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch +++ /dev/null @@ -1,57 +0,0 @@ -From 2eb0a1e08ebad5be00433093449abf025450ca6d Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Wed, 17 Jun 2026 12:08:43 +0800 -Subject: [PATCH] eventpoll: Fix integer overflow in ep_loop_check_proc() - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linus - -commit fdcfce93073d990ed4b71752e31ad1c1d6e9d58b -Author: Jann Horn -Date: Mon Feb 23 20:59:33 2026 +0100 - - eventpoll: Fix integer overflow in ep_loop_check_proc() - - If a recursive call to ep_loop_check_proc() hits the `result = INT_MAX`, - an integer overflow will occur in the calling ep_loop_check_proc() at - `result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1)`, - breaking the recursion depth check. - - Fix it by using a different placeholder value that can't lead to an - overflow. - - Reported-by: Guenter Roeck - Fixes: f2e467a48287 ("eventpoll: Fix semi-unbounded recursion") - Cc: stable@vger.kernel.org - Signed-off-by: Jann Horn - Link: https://patch.msgid.link/20260223-epoll-int-overflow-v1-1-452f35132224@google.com - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 5228ff9c8742..cb21dfe9ee0a 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -2130,7 +2130,8 @@ static int ep_poll(struct eventpoll *ep, struct epoll_event __user *events, - * @ep: the &struct eventpoll to be currently checked. - * @depth: Current depth of the path being checked. - * -- * Return: depth of the subtree, or INT_MAX if we found a loop or went too deep. -+ * Return: depth of the subtree, or a value bigger than EP_MAX_NESTS if we found -+ * a loop or went too deep. - */ - static int ep_loop_check_proc(struct eventpoll *ep, int depth) - { -@@ -2149,7 +2150,7 @@ static int ep_loop_check_proc(struct eventpoll *ep, int depth) - struct eventpoll *ep_tovisit; - ep_tovisit = epi->ffd.file->private_data; - if (ep_tovisit == inserting_into || depth > EP_MAX_NESTS) -- result = INT_MAX; -+ result = EP_MAX_NESTS+1; - else - result = max(result, ep_loop_check_proc(ep_tovisit, depth + 1) + 1); - if (result > EP_MAX_NESTS) --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1755-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch b/SOURCES/1755-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch deleted file mode 100644 index bc6f290ea..000000000 --- a/SOURCES/1755-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch +++ /dev/null @@ -1,101 +0,0 @@ -From 39c9ab147e5bc9cf20d146d78c59afc7a0ab488d Mon Sep 17 00:00:00 2001 -From: Ian Kent -Date: Thu, 18 Jun 2026 11:30:35 +0800 -Subject: [PATCH] eventpoll: refresh epi_fget() / ep_remove_file() comments - -JIRA: https://redhat.atlassian.net/browse/RHEL-180777 -Upstream status: Linux - -commit a573cb40f9819c3fe81a43eb10170f8fc8eddc5e -Author: Christian Brauner -Date: Fri Apr 24 15:46:35 2026 +0200 - - eventpoll: refresh epi_fget() / ep_remove_file() comments - - Two comments drifted from the code they sit on. - - epi_fget()'s block comment still referenced atomic_long_inc_not_zero, - which has been file_ref_get() for a while, and described only one of - the function's two roles: safe dereference of epi->ffd.file under - ep->mtx. Since commit a6dc643c6931 ("eventpoll: fix ep_remove struct - eventpoll / struct file UAF") the refcount bump also serves as a pin - that blocks __fput() from starting, which is what lets ep_remove() - touch file->f_lock and file->f_ep without racing - eventpoll_release_file(). Update the block to name both roles and the - commit that introduced the pin role. - - ep_remove_file()'s one-line "See eventpoll_release() for details" - pointed at an inline in include/linux/eventpoll.h but said nothing - about what those details were. Replace it with a short explanation: - we publish NULL so the eventpoll_release() fastpath can skip the slow - path, and this is safe because every f_ep writer either holds a pin - via epi_fget() or is __fput() itself. - - Comment-only; no functional change. - - Signed-off-by: Christian Brauner (Amutable) - Link: https://patch.msgid.link/20260424-work-epoll-rework-v1-4-249ed00a20f3@kernel.org - Signed-off-by: Christian Brauner - -Signed-off-by: Ian Kent - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index cb21dfe9ee0a..9bde520ac74b 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -817,22 +817,23 @@ static void ep_free(struct eventpoll *ep) - } - - /* -- * The ffd.file pointer may be in the process of being torn down due to -- * being closed, but we may not have finished eventpoll_release() yet. -+ * Pin @epi->ffd.file for operations that require both safe dereference -+ * and exclusion from __fput(). - * -- * Normally, even with the atomic_long_inc_not_zero, the file may have -- * been free'd and then gotten re-allocated to something else (since -- * files are not RCU-delayed, they are SLAB_TYPESAFE_BY_RCU). -+ * struct file uses SLAB_TYPESAFE_BY_RCU, so a freed slot can be -+ * reassigned at any time. The bare load of epi->ffd.file is safe here -+ * because the caller holds ep->mtx and eventpoll_release_file() blocks -+ * on that mutex while tearing down the epi, so the backing file -+ * allocation cannot be freed and reused under us. An rcu_read_lock() -+ * is therefore unnecessary for the load. - * -- * But for epoll, users hold the ep->mtx mutex, and as such any file in -- * the process of being free'd will block in eventpoll_release_file() -- * and thus the underlying file allocation will not be free'd, and the -- * file re-use cannot happen. -- * -- * For the same reason we can avoid a rcu_read_lock() around the -- * operation - 'ffd.file' cannot go away even if the refcount has -- * reached zero (but we must still not call out to ->poll() functions -- * etc). -+ * A successful file_ref_get() additionally blocks __fput() from -+ * starting on this file: once the refcount has reached zero it cannot -+ * come back. ep_remove() relies on that to touch file->f_lock and -+ * file->f_ep without racing eventpoll_release_file() (see commit -+ * a6dc643c6931). A NULL return means __fput() is already in flight; -+ * the caller must bail without touching the file, and -+ * eventpoll_release_file() will clean the epi up from its side. - */ - static struct file *epi_fget(const struct epitem *epi) - { -@@ -858,7 +859,13 @@ static void ep_remove_file(struct eventpoll *ep, struct epitem *epi, - spin_lock(&file->f_lock); - head = file->f_ep; - if (hlist_is_singular_node(&epi->fllink, head)) { -- /* See eventpoll_release() for details. */ -+ /* -+ * Last watcher: publish NULL so the eventpoll_release() -+ * fastpath in include/linux/eventpoll.h can skip the slow -+ * path on a future __fput(). Safe because every f_ep writer -+ * either holds a pin on @file via epi_fget() or is __fput() -+ * itself -- see the comment in eventpoll_release(). -+ */ - WRITE_ONCE(file->f_ep, NULL); - if (!is_file_epoll(file)) { - struct epitems_head *v; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1758-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch b/SOURCES/1758-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch deleted file mode 100644 index 03a5128a0..000000000 --- a/SOURCES/1758-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch +++ /dev/null @@ -1,227 +0,0 @@ -From c7f6e7cc14df72b997258216e99d897d2df0dbbd Mon Sep 17 00:00:00 2001 -From: Jamal Hadi Salim -Date: Fri, 28 Nov 2025 10:19:19 -0500 -Subject: [PATCH] net/sched: ets: Always remove class from active list before - deleting in ets_qdisc_change - -[ Upstream commit ce052b9402e461a9aded599f5b47e76bc727f7de ] - -zdi-disclosures@trendmicro.com says: - -The vulnerability is a race condition between `ets_qdisc_dequeue` and -`ets_qdisc_change`. It leads to UAF on `struct Qdisc` object. -Attacker requires the capability to create new user and network namespace -in order to trigger the bug. -See my additional commentary at the end of the analysis. - -Analysis: - -static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - struct netlink_ext_ack *extack) -{ -... - - // (1) this lock is preventing .change handler (`ets_qdisc_change`) - //to race with .dequeue handler (`ets_qdisc_dequeue`) - sch_tree_lock(sch); - - for (i = nbands; i < oldbands; i++) { - if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) - list_del_init(&q->classes[i].alist); - qdisc_purge_queue(q->classes[i].qdisc); - } - - WRITE_ONCE(q->nbands, nbands); - for (i = nstrict; i < q->nstrict; i++) { - if (q->classes[i].qdisc->q.qlen) { - // (2) the class is added to the q->active - list_add_tail(&q->classes[i].alist, &q->active); - q->classes[i].deficit = quanta[i]; - } - } - WRITE_ONCE(q->nstrict, nstrict); - memcpy(q->prio2band, priomap, sizeof(priomap)); - - for (i = 0; i < q->nbands; i++) - WRITE_ONCE(q->classes[i].quantum, quanta[i]); - - for (i = oldbands; i < q->nbands; i++) { - q->classes[i].qdisc = queues[i]; - if (q->classes[i].qdisc != &noop_qdisc) - qdisc_hash_add(q->classes[i].qdisc, true); - } - - // (3) the qdisc is unlocked, now dequeue can be called in parallel - // to the rest of .change handler - sch_tree_unlock(sch); - - ets_offload_change(sch); - for (i = q->nbands; i < oldbands; i++) { - // (4) we're reducing the refcount for our class's qdisc and - // freeing it - qdisc_put(q->classes[i].qdisc); - // (5) If we call .dequeue between (4) and (5), we will have - // a strong UAF and we can control RIP - q->classes[i].qdisc = NULL; - WRITE_ONCE(q->classes[i].quantum, 0); - q->classes[i].deficit = 0; - gnet_stats_basic_sync_init(&q->classes[i].bstats); - memset(&q->classes[i].qstats, 0, sizeof(q->classes[i].qstats)); - } - return 0; -} - -Comment: -This happens because some of the classes have their qdiscs assigned to -NULL, but remain in the active list. This commit fixes this issue by always -removing the class from the active list before deleting and freeing its -associated qdisc - -Reproducer Steps -(trimmed version of what was sent by zdi-disclosures@trendmicro.com) - -``` -DEV="${DEV:-lo}" -ROOT_HANDLE="${ROOT_HANDLE:-1:}" -BAND2_HANDLE="${BAND2_HANDLE:-20:}" # child under 1:2 -PING_BYTES="${PING_BYTES:-48}" -PING_COUNT="${PING_COUNT:-200000}" -PING_DST="${PING_DST:-127.0.0.1}" - -SLOW_TBF_RATE="${SLOW_TBF_RATE:-8bit}" -SLOW_TBF_BURST="${SLOW_TBF_BURST:-100b}" -SLOW_TBF_LAT="${SLOW_TBF_LAT:-1s}" - -cleanup() { - tc qdisc del dev "$DEV" root 2>/dev/null -} -trap cleanup EXIT - -ip link set "$DEV" up - -tc qdisc del dev "$DEV" root 2>/dev/null || true - -tc qdisc add dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 - -tc qdisc add dev "$DEV" parent 1:2 handle "$BAND2_HANDLE" \ - tbf rate "$SLOW_TBF_RATE" burst "$SLOW_TBF_BURST" latency "$SLOW_TBF_LAT" - -tc filter add dev "$DEV" parent 1: protocol all prio 1 u32 match u32 0 0 flowid 1:2 -tc -s qdisc ls dev $DEV - -ping -I "$DEV" -f -c "$PING_COUNT" -s "$PING_BYTES" -W 0.001 "$PING_DST" \ - >/dev/null 2>&1 & -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 0 -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 2 strict 2 -tc -s qdisc ls dev $DEV -tc qdisc del dev "$DEV" parent 1:2 || true -tc -s qdisc ls dev $DEV -tc qdisc change dev "$DEV" root handle "$ROOT_HANDLE" ets bands 1 strict 1 -``` - -KASAN report -``` -================================================================== -BUG: KASAN: slab-use-after-free in ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 -Read of size 8 at addr ffff8880502fc018 by task ping/12308 -> -CPU: 0 UID: 0 PID: 12308 Comm: ping Not tainted 6.18.0-rc4-dirty #1 PREEMPT(full) -Hardware name: QEMU Ubuntu 25.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 -Call Trace: - - __dump_stack kernel/lib/dump_stack.c:94 - dump_stack_lvl+0x100/0x190 kernel/lib/dump_stack.c:120 - print_address_description kernel/mm/kasan/report.c:378 - print_report+0x156/0x4c9 kernel/mm/kasan/report.c:482 - kasan_report+0xdf/0x110 kernel/mm/kasan/report.c:595 - ets_qdisc_dequeue+0x1071/0x11b0 kernel/net/sched/sch_ets.c:481 - dequeue_skb kernel/net/sched/sch_generic.c:294 - qdisc_restart kernel/net/sched/sch_generic.c:399 - __qdisc_run+0x1c9/0x1b00 kernel/net/sched/sch_generic.c:417 - __dev_xmit_skb kernel/net/core/dev.c:4221 - __dev_queue_xmit+0x2848/0x4410 kernel/net/core/dev.c:4729 - dev_queue_xmit kernel/./include/linux/netdevice.h:3365 -[...] - -Allocated by task 17115: - kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 - poison_kmalloc_redzone kernel/mm/kasan/common.c:400 - __kasan_kmalloc+0xaa/0xb0 kernel/mm/kasan/common.c:417 - kasan_kmalloc kernel/./include/linux/kasan.h:262 - __do_kmalloc_node kernel/mm/slub.c:5642 - __kmalloc_node_noprof+0x34e/0x990 kernel/mm/slub.c:5648 - kmalloc_node_noprof kernel/./include/linux/slab.h:987 - qdisc_alloc+0xb8/0xc30 kernel/net/sched/sch_generic.c:950 - qdisc_create_dflt+0x93/0x490 kernel/net/sched/sch_generic.c:1012 - ets_class_graft+0x4fd/0x800 kernel/net/sched/sch_ets.c:261 - qdisc_graft+0x3e4/0x1780 kernel/net/sched/sch_api.c:1196 -[...] - -Freed by task 9905: - kasan_save_stack+0x30/0x50 kernel/mm/kasan/common.c:56 - kasan_save_track+0x14/0x30 kernel/mm/kasan/common.c:77 - __kasan_save_free_info+0x3b/0x70 kernel/mm/kasan/generic.c:587 - kasan_save_free_info kernel/mm/kasan/kasan.h:406 - poison_slab_object kernel/mm/kasan/common.c:252 - __kasan_slab_free+0x5f/0x80 kernel/mm/kasan/common.c:284 - kasan_slab_free kernel/./include/linux/kasan.h:234 - slab_free_hook kernel/mm/slub.c:2539 - slab_free kernel/mm/slub.c:6630 - kfree+0x144/0x700 kernel/mm/slub.c:6837 - rcu_do_batch kernel/kernel/rcu/tree.c:2605 - rcu_core+0x7c0/0x1500 kernel/kernel/rcu/tree.c:2861 - handle_softirqs+0x1ea/0x8a0 kernel/kernel/softirq.c:622 - __do_softirq kernel/kernel/softirq.c:656 -[...] - -Commentary: - -1. Maher Azzouzi working with Trend Micro Zero Day Initiative was reported as -the person who found the issue. I requested to get a proper email to add to the -reported-by tag but got no response. For this reason i will credit the person -i exchanged emails with i.e zdi-disclosures@trendmicro.com - -2. Neither i nor Victor who did a much more thorough testing was able to -reproduce a UAF with the PoC or other approaches we tried. We were both able to -reproduce a null ptr deref. After exchange with zdi-disclosures@trendmicro.com -they sent a small change to be made to the code to add an extra delay which -was able to simulate the UAF. i.e, this: - qdisc_put(q->classes[i].qdisc); - mdelay(90); - q->classes[i].qdisc = NULL; - -I was informed by Thomas Gleixner(tglx@linutronix.de) that adding delays was -acceptable approach for demonstrating the bug, quote: -"Adding such delays is common exploit validation practice" -The equivalent delay could happen "by virt scheduling the vCPU out, SMIs, -NMIs, PREEMPT_RT enabled kernel" - -3. I asked the OP to test and report back but got no response and after a -few days gave up and proceeded to submit this fix. - -Fixes: de6d25924c2a ("net/sched: sch_ets: don't peek at classes beyond 'nbands'") -Reported-by: zdi-disclosures@trendmicro.com -Tested-by: Victor Nogueira -Signed-off-by: Jamal Hadi Salim -Reviewed-by: Davide Caratti -Link: https://patch.msgid.link/20251128151919.576920-1-jhs@mojatatu.com -Signed-off-by: Paolo Abeni -Signed-off-by: Sasha Levin - -diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c -index d95d12797525..bcd91ffe9bc6 100644 ---- a/net/sched/sch_ets.c -+++ b/net/sched/sch_ets.c -@@ -665,7 +665,7 @@ static int ets_qdisc_change(struct Qdisc *sch, struct nlattr *opt, - sch_tree_lock(sch); - - for (i = nbands; i < oldbands; i++) { -- if (i >= q->nstrict && q->classes[i].qdisc->q.qlen) -+ if (cl_is_active(&q->classes[i])) - list_del_init(&q->classes[i].alist); - qdisc_purge_queue(q->classes[i].qdisc); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1759-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch b/SOURCES/1759-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch deleted file mode 100644 index 7918184a2..000000000 --- a/SOURCES/1759-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch +++ /dev/null @@ -1,128 +0,0 @@ -From 0cb2af2ea66ad8ff195c156ea690f11216285bdf Mon Sep 17 00:00:00 2001 -From: Sean Christopherson -Date: Wed, 15 Apr 2026 00:52:34 +0000 -Subject: [PATCH] KVM: x86: Fix shadow paging use-after-free due to unexpected - GFN - -The shadow MMU computes GFNs for direct shadow pages using sp->gfn plus -the SPTE index. This assumption breaks for shadow paging if the guest -page tables are modified between VM entries (similar to commit -aad885e77496, "KVM: x86/mmu: Drop/zap existing present SPTE even -when creating an MMIO SPTE", 2026-03-27). The flow is as follows: - -- a PDE is installed for a 2MB mapping, and a page in that area is - accessed. KVM creates a kvm_mmu_page consisting of 512 4KB pages; - the kvm_mmu_page is marked by FNAME(fetch) as direct-mapped because - the guest's mapping is a huge page (and thus contiguous). - -- the PDE mapping is changed from outside the guest. - -- the guest accesses another page in the same 2MB area. KVM installs - a new leaf SPTE and rmap entry; the SPTE uses the "correct" GFN - (i.e. based on the new mapping, as changed in the previous step) but - that GFN is outside of the [sp->gfn, sp->gfn + 511] range; therefore - the rmap entry cannot be found and removed when the kvm_mmu_page - is zapped. - -- the memslot that covers the first 2MB mapping is deleted, and the - kvm_mmu_page for the now-invalid GPA is zapped. However, rmap_remove() - only looks at the [sp->gfn, sp->gfn + 511] range established in step 1, - and fails to find the rmap entry that was recorded by step 3. - -- any operation that causes an rmap walk for the same page accessed - by step 3 then walks a stale rmap and dereferences a freed kvm_mmu_page. - This includes dirty logging or MMU notifier invalidations (e.g., from - MADV_DONTNEED). - -The underlying issue is that KVM's walking of shadow PTEs assumes that -if a SPTE is present when KVM wants to install a non-leaf SPTE, then the -existing kvm_mmu_page must be for the correct gfn. Because the only way -for the gfn to be wrong is if KVM messed up and failed to zap a SPTE... -which shouldn't happen, but *actually* only happens in response to a -guest write. - -That bug dates back literally forever, as even the first version of KVM -assumes that the GFN matches and walks into the "wrong" shadow page. -However, that was only an imprecision until 2032a93d66fa ("KVM: MMU: -Don't allocate gfns page for direct mmu pages") came along. - -Fix it by checking for a target gfn mismatch and zapping the existing -SPTE. That way the old SP and rmap entries are gone, KVM installs -the rmap in the right location, and everyone is happy. - -Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") -Fixes: 6aa8b732ca01 ("kvm: userspace interface") -Reported-by: Alexander Bulekov -Reported-by: Fred Griffoul -Cc: stable@vger.kernel.org -Signed-off-by: Sean Christopherson -Link: https://patch.msgid.link/20260503201029.106481-1-pbonzini@redhat.com/ -Signed-off-by: Paolo Bonzini - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index 8895c98f0..6140702e1 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -183,6 +183,8 @@ struct kmem_cache *mmu_page_header_cache; - static struct percpu_counter kvm_total_used_mmu_pages; - - static void mmu_spte_set(u64 *sptep, u64 spte); -+static int mmu_page_zap_pte(struct kvm *kvm, struct kvm_mmu_page *sp, -+ u64 *spte, struct list_head *invalid_list); - - struct kvm_mmu_role_regs { - const unsigned long cr0; -@@ -1220,19 +1222,6 @@ static void drop_spte(struct kvm *kvm, u64 *sptep) - rmap_remove(kvm, sptep); - } - --static void drop_large_spte(struct kvm *kvm, u64 *sptep, bool flush) --{ -- struct kvm_mmu_page *sp; -- -- sp = sptep_to_sp(sptep); -- WARN_ON_ONCE(sp->role.level == PG_LEVEL_4K); -- -- drop_spte(kvm, sptep); -- -- if (flush) -- kvm_flush_remote_tlbs_sptep(kvm, sptep); --} -- - /* - * Write-protect on the specified @sptep, @pt_protect indicates whether - * spte write-protection is caused by protecting shadow page table. -@@ -2328,7 +2317,8 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, - { - union kvm_mmu_page_role role; - -- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep)) -+ if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) && -+ spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn) - return ERR_PTR(-EEXIST); - - role = kvm_mmu_child_role(sptep, direct, access); -@@ -2406,13 +2396,16 @@ static void __link_shadow_page(struct kvm *kvm, - - BUILD_BUG_ON(VMX_EPT_WRITABLE_MASK != PT_WRITABLE_MASK); - -- /* -- * If an SPTE is present already, it must be a leaf and therefore -- * a large one. Drop it, and flush the TLB if needed, before -- * installing sp. -- */ -- if (is_shadow_present_pte(*sptep)) -- drop_large_spte(kvm, sptep, flush); -+ if (is_shadow_present_pte(*sptep)) { -+ struct kvm_mmu_page *parent_sp; -+ LIST_HEAD(invalid_list); -+ -+ parent_sp = sptep_to_sp(sptep); -+ WARN_ON_ONCE(parent_sp->role.level == PG_LEVEL_4K); -+ -+ mmu_page_zap_pte(kvm, parent_sp, sptep, &invalid_list); -+ kvm_mmu_remote_flush_or_zap(kvm, &invalid_list, true); -+ } - - spte = make_nonleaf_spte(sp->spt, sp_ad_disabled(sp)); - diff --git a/SOURCES/1760-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch b/SOURCES/1760-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch deleted file mode 100644 index 8e57ae462..000000000 --- a/SOURCES/1760-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch +++ /dev/null @@ -1,61 +0,0 @@ -From 81ccda30b4e83d8f5cc4fd50503c44e3a33abfeb Mon Sep 17 00:00:00 2001 -From: Paolo Bonzini -Date: Fri, 12 Jun 2026 22:18:12 +0200 -Subject: [PATCH] KVM: x86: Fix shadow paging use-after-free due to unexpected - role - -Commit 0cb2af2ea66ad ("KVM: x86: Fix shadow paging use-after-free due -to unexpected GFN") fixed a shadow paging mismatch between stored and -computed GFNs; the bug could be triggered by changing a PDE mapping from -outside the guest, and then deleting a memslot. The rmap_remove() -call would miss entries created after the PDE change because the GFN -of the leaf SPTE does not match the GFN of the struct kvm_mmu_page. - -A similar hole however remains if the modified PDE points to a non-leaf -page. In this case the gfn can be made to match, but the role does not -match: the original large 2MB page creates a kvm_mmu_page with direct=1, -while the new 4KB needs a kvm_mmu_page with direct=0. However, -kvm_mmu_get_child_sp() does not compare the role, and therefore reuses -the page. - -The next step is installing a leaf (4KB) SPTE on the new path which -records an rmap entry under the gfn resolved by the walk. But when -that child is zapped its parent kvm_mmu_page has direct=1 and -kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as -sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[] -in older kernels). It therefore fails to remove the recorded entry. - -When the memslot is dropped the shadow page is freed but the rmap -entry survives, as in the scenario that was already fixed. Code that -later walks that gfn (dirty logging, MMU notifier invalidation, and -so on) dereferences an sptep that lies in the freed page, causing the -use-after-free. - -Fixes: 2032a93d66fa ("KVM: MMU: Don't allocate gfns page for direct mmu pages") -Reported-by: Hyunwoo Kim -Signed-off-by: Paolo Bonzini - -diff --git a/arch/x86/kvm/mmu/mmu.c b/arch/x86/kvm/mmu/mmu.c -index 6140702e1..8996c8965 100644 ---- a/arch/x86/kvm/mmu/mmu.c -+++ b/arch/x86/kvm/mmu/mmu.c -@@ -2315,13 +2315,15 @@ static struct kvm_mmu_page *kvm_mmu_get_child_sp(struct kvm_vcpu *vcpu, - u64 *sptep, gfn_t gfn, - bool direct, unsigned int access) - { -- union kvm_mmu_page_role role; -+ union kvm_mmu_page_role role = kvm_mmu_child_role(sptep, direct, access); - -- if (is_shadow_present_pte(*sptep) && !is_large_pte(*sptep) && -- spte_to_child_sp(*sptep) && spte_to_child_sp(*sptep)->gfn == gfn) -+ if (is_shadow_present_pte(*sptep) && -+ !is_large_pte(*sptep) && -+ spte_to_child_sp(*sptep) && -+ spte_to_child_sp(*sptep)->gfn == gfn && -+ spte_to_child_sp(*sptep)->role.word == role.word) - return ERR_PTR(-EEXIST); - -- role = kvm_mmu_child_role(sptep, direct, access); - return kvm_mmu_get_shadow_page(vcpu, gfn, role); - } - diff --git a/SOURCES/1761-crypto-ccp-copy-iv-using-skcipher-ivsize.patch b/SOURCES/1761-crypto-ccp-copy-iv-using-skcipher-ivsize.patch deleted file mode 100644 index 141f714b7..000000000 --- a/SOURCES/1761-crypto-ccp-copy-iv-using-skcipher-ivsize.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 798d409a8949f3f495f238549b86de2886b129bd Mon Sep 17 00:00:00 2001 -From: Paul Moses -Date: Wed, 1 Apr 2026 03:07:49 -0500 -Subject: [PATCH] crypto: ccp - copy IV using skcipher ivsize - -[ Upstream commit a7a1f3cdd64d8a165d9b8c9e9ad7fb46ac19dfc4 ] - -AF_ALG rfc3686-ctr-aes-ccp requests pass an 8-byte IV to the driver. - -ccp_aes_complete() restores AES_BLOCK_SIZE bytes into the caller's IV -buffer while RFC3686 skciphers expose an 8-byte IV, so the restore -overruns the provided buffer. - -Use crypto_skcipher_ivsize() to copy only the algorithm's IV length. - -Fixes: 2b789435d7f3 ("crypto: ccp - CCP AES crypto API support") -Signed-off-by: Paul Moses -Reviewed-by: Tom Lendacky -Signed-off-by: Herbert Xu -Signed-off-by: Sasha Levin - -diff --git a/drivers/crypto/ccp/ccp-crypto-aes.c b/drivers/crypto/ccp/ccp-crypto-aes.c -index e6dcd8cedd53..b03ed5e83c3e 100644 ---- a/drivers/crypto/ccp/ccp-crypto-aes.c -+++ b/drivers/crypto/ccp/ccp-crypto-aes.c -@@ -28,8 +28,11 @@ static int ccp_aes_complete(struct crypto_async_request *async_req, int ret) - if (ret) - return ret; - -- if (ctx->u.aes.mode != CCP_AES_MODE_ECB) -- memcpy(req->iv, rctx->iv, AES_BLOCK_SIZE); -+ if (ctx->u.aes.mode != CCP_AES_MODE_ECB) { -+ size_t ivsize = crypto_skcipher_ivsize(crypto_skcipher_reqtfm(req)); -+ -+ memcpy(req->iv, rctx->iv, ivsize); -+ } - - return 0; - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1762-net-fix-memory-leak-in-skb-segment-list-for-gro-packets.patch b/SOURCES/1762-net-fix-memory-leak-in-skb-segment-list-for-gro-packets.patch deleted file mode 100644 index 705bdc95d..000000000 --- a/SOURCES/1762-net-fix-memory-leak-in-skb-segment-list-for-gro-packets.patch +++ /dev/null @@ -1,100 +0,0 @@ -From 238e03d0466239410b72294b79494e43d4fabe77 Mon Sep 17 00:00:00 2001 -From: Mohammad Heib -Date: Sun, 4 Jan 2026 23:31:01 +0200 -Subject: [PATCH] net: fix memory leak in skb_segment_list for GRO packets - -When skb_segment_list() is called during packet forwarding, it handles -packets that were aggregated by the GRO engine. - -Historically, the segmentation logic in skb_segment_list assumes that -individual segments are split from a parent SKB and may need to carry -their own socket memory accounting. Accordingly, the code transfers -truesize from the parent to the newly created segments. - -Prior to commit ed4cccef64c1 ("gro: fix ownership transfer"), this -truesize subtraction in skb_segment_list() was valid because fragments -still carry a reference to the original socket. - -However, commit ed4cccef64c1 ("gro: fix ownership transfer") changed -this behavior by ensuring that fraglist entries are explicitly -orphaned (skb->sk = NULL) to prevent illegal orphaning later in the -stack. This change meant that the entire socket memory charge remained -with the head SKB, but the corresponding accounting logic in -skb_segment_list() was never updated. - -As a result, the current code unconditionally adds each fragment's -truesize to delta_truesize and subtracts it from the parent SKB. Since -the fragments are no longer charged to the socket, this subtraction -results in an effective under-count of memory when the head is freed. -This causes sk_wmem_alloc to remain non-zero, preventing socket -destruction and leading to a persistent memory leak. - -The leak can be observed via KMEMLEAK when tearing down the networking -environment: - -unreferenced object 0xffff8881e6eb9100 (size 2048): - comm "ping", pid 6720, jiffies 4295492526 - backtrace: - kmem_cache_alloc_noprof+0x5c6/0x800 - sk_prot_alloc+0x5b/0x220 - sk_alloc+0x35/0xa00 - inet6_create.part.0+0x303/0x10d0 - __sock_create+0x248/0x640 - __sys_socket+0x11b/0x1d0 - -Since skb_segment_list() is exclusively used for SKB_GSO_FRAGLIST -packets constructed by GRO, the truesize adjustment is removed. - -The call to skb_release_head_state() must be preserved. As documented in -commit cf673ed0e057 ("net: fix fraglist segmentation reference count -leak"), it is still required to correctly drop references to SKB -extensions that may be overwritten during __copy_skb_header(). - -Fixes: ed4cccef64c1 ("gro: fix ownership transfer") -Signed-off-by: Mohammad Heib -Reviewed-by: Willem de Bruijn -Link: https://patch.msgid.link/20260104213101.352887-1-mheib@redhat.com -Signed-off-by: Jakub Kicinski - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index a00808f7be6a..a56133902c0d 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -4636,12 +4636,14 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, - { - struct sk_buff *list_skb = skb_shinfo(skb)->frag_list; - unsigned int tnl_hlen = skb_tnl_header_len(skb); -- unsigned int delta_truesize = 0; - unsigned int delta_len = 0; - struct sk_buff *tail = NULL; - struct sk_buff *nskb, *tmp; - int len_diff, err; - -+ /* Only skb_gro_receive_list generated skbs arrive here */ -+ DEBUG_NET_WARN_ON_ONCE(!(skb_shinfo(skb)->gso_type & SKB_GSO_FRAGLIST)); -+ - skb_push(skb, -skb_network_offset(skb) + offset); - - /* Ensure the head is writeable before touching the shared info */ -@@ -4655,8 +4657,9 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, - nskb = list_skb; - list_skb = list_skb->next; - -+ DEBUG_NET_WARN_ON_ONCE(nskb->sk); -+ - err = 0; -- delta_truesize += nskb->truesize; - if (skb_shared(nskb)) { - tmp = skb_clone(nskb, GFP_ATOMIC); - if (tmp) { -@@ -4699,7 +4702,6 @@ struct sk_buff *skb_segment_list(struct sk_buff *skb, - goto err_linearize; - } - -- skb->truesize = skb->truesize - delta_truesize; - skb->data_len = skb->data_len - delta_len; - skb->len = skb->len - delta_len; - --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1763-kallsyms-clean-up-modname-and-modbuildid-initialization.patch b/SOURCES/1763-kallsyms-clean-up-modname-and-modbuildid-initialization.patch deleted file mode 100644 index f67ad55f9..000000000 --- a/SOURCES/1763-kallsyms-clean-up-modname-and-modbuildid-initialization.patch +++ /dev/null @@ -1,77 +0,0 @@ -From bba6d3303088d0f68a34859079a4656d6e86e164 Mon Sep 17 00:00:00 2001 -From: Anubhav Shelat -Date: Tue, 12 May 2026 12:55:02 -0400 -Subject: [PATCH] kallsyms: clean up modname and modbuildid initialization in - kallsyms_lookup_buildid() - -JIRA: https://issues.redhat.com/browse/RHEL-164306 - -upstream -======== -commit fda024fb64769e9d6b3916d013c78d6b189129f8 -Author: Petr Mladek -Date: Fri Nov 28 14:59:15 2025 +0100 - -description -=========== -The @modname and @modbuildid optional return parameters are set only when -the symbol is in a module. - -Always initialize them so that they do not need to be cleared when the -module is not in a module. It simplifies the logic and makes the code -even slightly more safe. - -Note that bpf_address_lookup() function will get updated in a separate -patch. - - Link: https://lkml.kernel.org/r/20251128135920.217303-3-pmladek@suse.com - Signed-off-by: Petr Mladek - Cc: Aaron Tomlin - Cc: Alexei Starovoitov - Cc: Daniel Borkman - Cc: Daniel Gomez - Cc: John Fastabend - Cc: Kees Cook - Cc: Luis Chamberalin - Cc: Marc Rutland - Cc: "Masami Hiramatsu (Google)" - Cc: Petr Pavlu - Cc: Sami Tolvanen - Cc: Steven Rostedt (Google) - Signed-off-by: Andrew Morton - -Signed-off-by: Anubhav Shelat - -diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c -index 8deb399d45c7..859435335c6f 100644 ---- a/kernel/kallsyms.c -+++ b/kernel/kallsyms.c -@@ -403,6 +403,14 @@ static const char *kallsyms_lookup_buildid(unsigned long addr, - - namebuf[KSYM_NAME_LEN - 1] = 0; - namebuf[0] = 0; -+ /* -+ * Initialize the module-related return values. They are not set -+ * when the symbol is in vmlinux or it is a bpf address. -+ */ -+ if (modname) -+ *modname = NULL; -+ if (modbuildid) -+ *modbuildid = NULL; - - if (is_ksym_addr(addr)) { - unsigned long pos; -@@ -411,10 +419,6 @@ static const char *kallsyms_lookup_buildid(unsigned long addr, - /* Grab name */ - kallsyms_expand_symbol(get_symbol_offset(pos), - namebuf, KSYM_NAME_LEN); -- if (modname) -- *modname = NULL; -- if (modbuildid) -- *modbuildid = NULL; - - ret = namebuf; - goto found; --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1764-kallsyms-bpf-rename-bpf-address-lookup.patch b/SOURCES/1764-kallsyms-bpf-rename-bpf-address-lookup.patch deleted file mode 100644 index 9e2345165..000000000 --- a/SOURCES/1764-kallsyms-bpf-rename-bpf-address-lookup.patch +++ /dev/null @@ -1,175 +0,0 @@ -From f4175fcdb3d3d06d76caf08a7e6cb8f56da32f94 Mon Sep 17 00:00:00 2001 -From: Anubhav Shelat -Date: Tue, 12 May 2026 17:50:20 -0400 -Subject: [PATCH] kallsyms/bpf: rename __bpf_address_lookup() to - bpf_address_lookup() - -JIRA: https://issues.redhat.com/browse/RHEL-164306 - -Conflict: Code difference due to missing -7e1f4eb9a60d40dd17a97d9b76818682a024a127 (kallsyms: rework symbol lookup -return codes). - -upstream -======== -commit cd6735896d0343942cf3dafb48ce32eb79341990 -Author: Petr Mladek -Date: Fri Nov 28 14:59:18 2025 +0100 - -description -=========== - -bpf_address_lookup() has been used only in kallsyms_lookup_buildid(). It -was supposed to set @modname and @modbuildid when the symbol was in a -module. - -But it always just cleared @modname because BPF symbols were never in a -module. And it did not clear @modbuildid because the pointer was not -passed. - -The wrapper is no longer needed. Both @modname and @modbuildid are now -always initialized to NULL in kallsyms_lookup_buildid(). - -Remove the wrapper and rename __bpf_address_lookup() to -bpf_address_lookup() because this variant is used everywhere. - - [akpm@linux-foundation.org: fix loongarch] - Link: https://lkml.kernel.org/r/20251128135920.217303-6-pmladek@suse.com - Fixes: 9294523e3768 ("module: add printk formats to add module build ID to stacktraces") - Signed-off-by: Petr Mladek - Acked-by: Alexei Starovoitov - Cc: Aaron Tomlin - Cc: Daniel Borkman - Cc: Daniel Gomez - Cc: John Fastabend - Cc: Kees Cook - Cc: Luis Chamberalin - Cc: Marc Rutland - Cc: "Masami Hiramatsu (Google)" - Cc: Petr Pavlu - Cc: Sami Tolvanen - Cc: Steven Rostedt (Google) - Signed-off-by: Andrew Morton - -Signed-off-by: Anubhav Shelat - -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index c2afc5533..0f32892f0 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -2567,7 +2567,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type poke_type, - u64 plt_target = 0ULL; - bool poking_bpf_entry; - -- if (!__bpf_address_lookup((unsigned long)ip, &size, &offset, namebuf)) -+ if (!bpf_address_lookup((unsigned long)ip, &size, &offset, namebuf)) - /* Only poking bpf text is supported. Since kernel function - * entry is set up by ftrace, we reply on ftrace to poke kernel - * functions. -diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c -index b381ab8d1..325d494e2 100644 ---- a/arch/powerpc/net/bpf_jit_comp.c -+++ b/arch/powerpc/net/bpf_jit_comp.c -@@ -1096,7 +1096,7 @@ int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type poke_type, - branch_flags = poke_type == BPF_MOD_CALL ? BRANCH_SET_LINK : 0; - - /* We currently only support poking bpf programs */ -- if (!__bpf_address_lookup(bpf_func, &size, &offset, name)) { -+ if (!bpf_address_lookup(bpf_func, &size, &offset, name)) { - pr_err("%s (0x%lx): kernel/modules are not supported\n", __func__, bpf_func); - return -EOPNOTSUPP; - } -diff --git a/include/linux/filter.h b/include/linux/filter.h -index c04fbf7f0..057626c3b 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -1249,24 +1249,13 @@ static inline bool bpf_jit_kallsyms_enabled(void) - return false; - } - --const char *__bpf_address_lookup(unsigned long addr, unsigned long *size, -- unsigned long *off, char *sym); -+const char *bpf_address_lookup(unsigned long addr, unsigned long *size, -+ unsigned long *off, char *sym); - bool is_bpf_text_address(unsigned long addr); - int bpf_get_kallsym(unsigned int symnum, unsigned long *value, char *type, - char *sym); - struct bpf_prog *bpf_prog_ksym_find(unsigned long addr); - --static inline const char * --bpf_address_lookup(unsigned long addr, unsigned long *size, -- unsigned long *off, char **modname, char *sym) --{ -- const char *ret = __bpf_address_lookup(addr, size, off, sym); -- -- if (ret && modname) -- *modname = NULL; -- return ret; --} -- - void bpf_prog_kallsyms_add(struct bpf_prog *fp); - void bpf_prog_kallsyms_del(struct bpf_prog *fp); - -@@ -1305,8 +1294,8 @@ static inline bool bpf_jit_kallsyms_enabled(void) - } - - static inline const char * --__bpf_address_lookup(unsigned long addr, unsigned long *size, -- unsigned long *off, char *sym) -+bpf_address_lookup(unsigned long addr, unsigned long *size, -+ unsigned long *off, char *sym) - { - return NULL; - } -@@ -1327,13 +1316,6 @@ static inline struct bpf_prog *bpf_prog_ksym_find(unsigned long addr) - return NULL; - } - --static inline const char * --bpf_address_lookup(unsigned long addr, unsigned long *size, -- unsigned long *off, char **modname, char *sym) --{ -- return NULL; --} -- - static inline void bpf_prog_kallsyms_add(struct bpf_prog *fp) - { - } -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 07dda7c6a..5c07d9a7d 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -742,8 +742,8 @@ static struct bpf_ksym *bpf_ksym_find(unsigned long addr) - return n ? container_of(n, struct bpf_ksym, tnode) : NULL; - } - --const char *__bpf_address_lookup(unsigned long addr, unsigned long *size, -- unsigned long *off, char *sym) -+const char *bpf_address_lookup(unsigned long addr, unsigned long *size, -+ unsigned long *off, char *sym) - { - struct bpf_ksym *ksym; - char *ret = NULL; -diff --git a/kernel/kallsyms.c b/kernel/kallsyms.c -index 859435335..8ff04b11e 100644 ---- a/kernel/kallsyms.c -+++ b/kernel/kallsyms.c -@@ -391,7 +391,7 @@ int kallsyms_lookup_size_offset(unsigned long addr, unsigned long *symbolsize, - return 1; - } - return !!module_address_lookup(addr, symbolsize, offset, NULL, NULL, namebuf) || -- !!__bpf_address_lookup(addr, symbolsize, offset, namebuf); -+ !!bpf_address_lookup(addr, symbolsize, offset, namebuf); - } - - static const char *kallsyms_lookup_buildid(unsigned long addr, -@@ -428,8 +428,7 @@ static const char *kallsyms_lookup_buildid(unsigned long addr, - ret = module_address_lookup(addr, symbolsize, offset, - modname, modbuildid, namebuf); - if (!ret) -- ret = bpf_address_lookup(addr, symbolsize, -- offset, modname, namebuf); -+ ret = bpf_address_lookup(addr, symbolsize, offset, namebuf); - - if (!ret) - ret = ftrace_mod_address_lookup(addr, symbolsize, diff --git a/SOURCES/1765-net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch b/SOURCES/1765-net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch deleted file mode 100644 index 4672e2341..000000000 --- a/SOURCES/1765-net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch +++ /dev/null @@ -1,171 +0,0 @@ -From a6ae4511c07b91f597e461406c6330f0d4ff810e Mon Sep 17 00:00:00 2001 -From: Zhengchuan Liang -Date: Mon, 4 May 2026 08:16:28 -0400 -Subject: [PATCH] net: bridge: use a stable FDB dst snapshot in RCU readers - -[ Upstream commit df4601653201de21b487c3e7fffd464790cab808 ] - -Local FDB entries can be rewritten in place by `fdb_delete_local()`, which -updates `f->dst` to another port or to `NULL` while keeping the entry -alive. Several bridge RCU readers inspect `f->dst`, including -`br_fdb_fillbuf()` through the `brforward_read()` sysfs path. - -These readers currently load `f->dst` multiple times and can therefore -observe inconsistent values across the check and later dereference. -In `br_fdb_fillbuf()`, this means a concurrent local-FDB update can change -`f->dst` after the NULL check and before the `port_no` dereference, -leading to a NULL-ptr-deref. - -Fix this by taking a single `READ_ONCE()` snapshot of `f->dst` in each -affected RCU reader and using that snapshot for the rest of the access -sequence. Also publish the in-place `f->dst` updates in `fdb_delete_local()` -with `WRITE_ONCE()` so the readers and writer use matching access patterns. - -Fixes: 960b589f86c7 ("bridge: Properly check if local fdb entry can be deleted in br_fdb_change_mac_address") -Cc: stable@kernel.org -Reported-by: Yifan Wu -Reported-by: Juefei Pu -Co-developed-by: Yuan Tan -Signed-off-by: Yuan Tan -Suggested-by: Xin Liu -Tested-by: Ren Wei -Signed-off-by: Zhengchuan Liang -Signed-off-by: Ren Wei -Reviewed-by: Ido Schimmel -Acked-by: Nikolay Aleksandrov -Link: https://patch.msgid.link/6570fabb85ecadb8baaf019efe856f407711c7b9.1776043229.git.zcliangcn@gmail.com -Signed-off-by: Paolo Abeni -[ kept combined-flag check `(dst->flags & (BR_PROXYARP_WIFI | BR_NEIGH_SUPPRESS))` and `cb->args[2]` indexing instead of `br_is_neigh_suppress_enabled()` helper and `ctx->fdb_idx` ] -Signed-off-by: Sasha Levin -Signed-off-by: Greg Kroah-Hartman - -diff --git a/net/bridge/br_arp_nd_proxy.c b/net/bridge/br_arp_nd_proxy.c -index 1e2b51769..1f37b8cff 100644 ---- a/net/bridge/br_arp_nd_proxy.c -+++ b/net/bridge/br_arp_nd_proxy.c -@@ -202,11 +202,12 @@ void br_do_proxy_suppress_arp(struct sk_buff *skb, struct net_bridge *br, - - f = br_fdb_find_rcu(br, n->ha, vid); - if (f) { -+ const struct net_bridge_port *dst = READ_ONCE(f->dst); - bool replied = false; - - if ((p && (p->flags & BR_PROXYARP)) || -- (f->dst && (f->dst->flags & BR_PROXYARP_WIFI)) || -- br_is_neigh_suppress_enabled(f->dst, vid)) { -+ (dst && (dst->flags & BR_PROXYARP_WIFI)) || -+ br_is_neigh_suppress_enabled(dst, vid)) { - if (!vid) - br_arp_send(br, p, skb->dev, sip, tip, - sha, n->ha, sha, 0, 0); -@@ -466,9 +467,10 @@ void br_do_suppress_nd(struct sk_buff *skb, struct net_bridge *br, - - f = br_fdb_find_rcu(br, n->ha, vid); - if (f) { -+ const struct net_bridge_port *dst = READ_ONCE(f->dst); - bool replied = false; - -- if (br_is_neigh_suppress_enabled(f->dst, vid)) { -+ if (br_is_neigh_suppress_enabled(dst, vid)) { - if (vid != 0) - br_nd_send(br, p, skb, n, - skb->vlan_proto, -diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c -index 83483ea12..53abd9d9a 100644 ---- a/net/bridge/br_fdb.c -+++ b/net/bridge/br_fdb.c -@@ -243,6 +243,7 @@ struct net_device *br_fdb_find_port(const struct net_device *br_dev, - const unsigned char *addr, - __u16 vid) - { -+ const struct net_bridge_port *dst; - struct net_bridge_fdb_entry *f; - struct net_device *dev = NULL; - struct net_bridge *br; -@@ -255,8 +256,11 @@ struct net_device *br_fdb_find_port(const struct net_device *br_dev, - br = netdev_priv(br_dev); - rcu_read_lock(); - f = br_fdb_find_rcu(br, addr, vid); -- if (f && f->dst) -- dev = f->dst->dev; -+ if (f) { -+ dst = READ_ONCE(f->dst); -+ if (dst) -+ dev = dst->dev; -+ } - rcu_read_unlock(); - - return dev; -@@ -353,7 +357,7 @@ static void fdb_delete_local(struct net_bridge *br, - vg = nbp_vlan_group(op); - if (op != p && ether_addr_equal(op->dev->dev_addr, addr) && - (!vid || br_vlan_find(vg, vid))) { -- f->dst = op; -+ WRITE_ONCE(f->dst, op); - clear_bit(BR_FDB_ADDED_BY_USER, &f->flags); - return; - } -@@ -364,7 +368,7 @@ static void fdb_delete_local(struct net_bridge *br, - /* Maybe bridge device has same hw addr? */ - if (p && ether_addr_equal(br->dev->dev_addr, addr) && - (!vid || (v && br_vlan_should_use(v)))) { -- f->dst = NULL; -+ WRITE_ONCE(f->dst, NULL); - clear_bit(BR_FDB_ADDED_BY_USER, &f->flags); - return; - } -@@ -827,6 +831,7 @@ int br_fdb_test_addr(struct net_device *dev, unsigned char *addr) - int br_fdb_fillbuf(struct net_bridge *br, void *buf, - unsigned long maxnum, unsigned long skip) - { -+ const struct net_bridge_port *dst; - struct net_bridge_fdb_entry *f; - struct __fdb_entry *fe = buf; - int num = 0; -@@ -842,7 +847,8 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, - continue; - - /* ignore pseudo entry for local MAC address */ -- if (!f->dst) -+ dst = READ_ONCE(f->dst); -+ if (!dst) - continue; - - if (skip) { -@@ -854,8 +860,8 @@ int br_fdb_fillbuf(struct net_bridge *br, void *buf, - memcpy(fe->mac_addr, f->key.addr.addr, ETH_ALEN); - - /* due to ABI compat need to split into hi/lo */ -- fe->port_no = f->dst->port_no; -- fe->port_hi = f->dst->port_no >> 8; -+ fe->port_no = dst->port_no; -+ fe->port_hi = dst->port_no >> 8; - - fe->is_local = test_bit(BR_FDB_LOCAL, &f->flags); - if (!test_bit(BR_FDB_STATIC, &f->flags)) -@@ -977,9 +983,11 @@ int br_fdb_dump(struct sk_buff *skb, - - rcu_read_lock(); - hlist_for_each_entry_rcu(f, &br->fdb_list, fdb_node) { -+ const struct net_bridge_port *dst = READ_ONCE(f->dst); -+ - if (*idx < cb->args[2]) - goto skip; -- if (filter_dev && (!f->dst || f->dst->dev != filter_dev)) { -+ if (filter_dev && (!dst || dst->dev != filter_dev)) { - if (filter_dev != dev) - goto skip; - /* !f->dst is a special case for bridge -@@ -987,10 +995,10 @@ int br_fdb_dump(struct sk_buff *skb, - * Therefore need a little more filtering - * we only want to dump the !f->dst case - */ -- if (f->dst) -+ if (dst) - goto skip; - } -- if (!filter_dev && f->dst) -+ if (!filter_dev && dst) - goto skip; - - err = fdb_fill_info(skb, br, f, diff --git a/SOURCES/1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch b/SOURCES/1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch deleted file mode 100644 index 5ca391956..000000000 --- a/SOURCES/1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch +++ /dev/null @@ -1,91 +0,0 @@ -From 4e5a31ae1fa995362e4a828f36369ea3e7b44cc1 Mon Sep 17 00:00:00 2001 -From: Waiman Long -Date: Tue, 28 Apr 2026 21:48:18 -0400 -Subject: [PATCH] rtmutex: Use waiter::task instead of current in - remove_waiter() - -JIRA: https://redhat.atlassian.net/browse/RHEL-171802 - -commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 -Author: Keenan Dong -Date: Wed, 8 Apr 2026 16:46:00 +0800 - - rtmutex: Use waiter::task instead of current in remove_waiter() - - remove_waiter() is used by the slowlock paths, but it is also used for - proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from - futex_requeue(). - - In the latter case waiter::task is not current, but remove_waiter() - operates on current for the dequeue operation. That results in several - problems: - - 1) the rbtree dequeue happens without waiter::task::pi_lock being held - - 2) the waiter task's pi_blocked_on state is not cleared, which leaves a - dangling pointer primed for UAF around. - - 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter - task - - Use waiter::task instead of current in all related operations in - remove_waiter() to cure those problems. - - [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the - changelog ] - - Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock") - Reported-by: Yuan Tan - Reported-by: Yifan Wu - Reported-by: Juefei Pu - Reported-by: Xin Liu - Signed-off-by: Keenan Dong - Signed-off-by: Thomas Gleixner - Cc: stable@vger.kernel.org - -Signed-off-by: Waiman Long - -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index 1eb4f949909c..e881d9548030 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock, - * - * Must be called with lock->wait_lock held and interrupts disabled. It must - * have just failed to try_to_take_rt_mutex(). -+ * -+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current ! - */ - static void __sched remove_waiter(struct rt_mutex_base *lock, - struct rt_mutex_waiter *waiter) - { - bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock)); - struct task_struct *owner = rt_mutex_owner(lock); -+ struct task_struct *waiter_task = waiter->task; - struct rt_mutex_base *next_lock; - - lockdep_assert_held(&lock->wait_lock); - -- raw_spin_lock(¤t->pi_lock); -- rt_mutex_dequeue(lock, waiter); -- current->pi_blocked_on = NULL; -- raw_spin_unlock(¤t->pi_lock); -+ scoped_guard(raw_spinlock, &waiter_task->pi_lock) { -+ rt_mutex_dequeue(lock, waiter); -+ waiter_task->pi_blocked_on = NULL; -+ } - - /* - * Only update priority if the waiter was the highest priority -@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, - raw_spin_unlock_irq(&lock->wait_lock); - - rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock, -- next_lock, NULL, current); -+ next_lock, NULL, waiter_task); - - raw_spin_lock_irq(&lock->wait_lock); - } --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch b/SOURCES/1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch deleted file mode 100644 index c8d3af944..000000000 --- a/SOURCES/1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch +++ /dev/null @@ -1,42 +0,0 @@ -From 74e144274af39935b0f410c0ee4d2b91c3730414 Mon Sep 17 00:00:00 2001 -From: Ji'an Zhou -Date: Tue, 2 Jun 2026 09:12:04 +0000 -Subject: [PATCH] futex/requeue: Prevent NULL pointer dereference in - remove_waiter() on self-deadlock - -When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the -target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting -waiter->task. - -The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences -the NULL waiter->task, causing a kernel crash. - -Add a self-deadlock check for non-top waiters before calling -rt_mutex_start_proxy_lock(), analogous to the top-waiter check in -futex_lock_pi_atomic(). - -Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Signed-off-by: Ji'an Zhou -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org - -diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c -index b597cb3d17fc..1d99a84dc9ad 100644 ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, - continue; - } - -+ /* Self-deadlock: non-top waiter already owns the PI futex. */ -+ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -+ ret = -EDEADLK; -+ break; -+ } -+ - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch b/SOURCES/1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch deleted file mode 100644 index 5f8a34337..000000000 --- a/SOURCES/1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch +++ /dev/null @@ -1,64 +0,0 @@ -From 40a25d59e85b3c8709ac2424d44f65610467871e Mon Sep 17 00:00:00 2001 -From: Davidlohr Bueso -Date: Thu, 7 May 2026 04:29:13 -0700 -Subject: [PATCH] locking/rtmutex: Skip remove_waiter() when waiter is not - enqueued - -syzbot triggered the following splat in remove_waiter() via -FUTEX_CMP_REQUEUE_PI: - - KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] - class_raw_spinlock_constructor - remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 - rt_mutex_start_proxy_lock+0x103/0x120 - futex_requeue+0x10e4/0x20d0 - __x64_sys_futex+0x34f/0x4d0 - -task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, -leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead -of current in remove_waiter()") made this fatal. - -Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() -upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock -return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() -(where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to -account for try_to_take_rt_mutex(). - -Fixes: 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") -Reported-by: syzbot+78147abe6c524f183ee9@syzkaller.appspotmail.com -Signed-off-by: Davidlohr Bueso -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ -Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net - -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index 4f386ea6c792..daeeeef973e2 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1558,6 +1558,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, - - lockdep_assert_held(&lock->wait_lock); - -+ if (!waiter_task) /* never enqueued */ -+ return; -+ - scoped_guard(raw_spinlock, &waiter_task->pi_lock) { - rt_mutex_dequeue(lock, waiter); - waiter_task->pi_blocked_on = NULL; -diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c -index 124219aea46e..514fce7a4e0a 100644 ---- a/kernel/locking/rtmutex_api.c -+++ b/kernel/locking/rtmutex_api.c -@@ -365,7 +365,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock, - - raw_spin_lock_irq(&lock->wait_lock); - ret = __rt_mutex_start_proxy_lock(lock, waiter, task, &wake_q); -- if (unlikely(ret)) -+ if (unlikely(ret < 0)) - remove_waiter(lock, waiter); - preempt_disable(); - raw_spin_unlock_irq(&lock->wait_lock); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1769-futex-requeue-revert-prevent-null-pointer-dereference.patch b/SOURCES/1769-futex-requeue-revert-prevent-null-pointer-dereference.patch deleted file mode 100644 index 1aeddd19c..000000000 --- a/SOURCES/1769-futex-requeue-revert-prevent-null-pointer-dereference.patch +++ /dev/null @@ -1,48 +0,0 @@ -From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001 -From: Sebastian Andrzej Siewior -Date: Wed, 1 Jul 2026 15:11:50 +0200 -Subject: [PATCH] futex/requeue: Revert "Prevent NULL pointer dereference in - remove_waiter() on self-deadlock"" - -The commit cited below should not have been merged. It attemted to fix an -existing problem ansd thereby introduced new problems by keeping the -pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. - -Based on the commit description the intention was to handle the case -when task_blocks_on_rt_mutex() returns -EDEADLK and the following -remove_waiter() dereferences the NULL pointer in waiter->task. - -That is already handled by Davidlohr in commit 40a25d59e85b3 -("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and -requires no further acting. - -Revert the commit breaking the "waiter == owner" case again. - -Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") -Reported-by: Michael Bommarito -Signed-off-by: Sebastian Andrzej Siewior -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org -Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de -Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com - -diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c -index 7384672916fb..79823ad13683 100644 ---- a/kernel/futex/requeue.c -+++ b/kernel/futex/requeue.c -@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, - continue; - } - -- /* Self-deadlock: non-top waiter already owns the PI futex. */ -- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { -- ret = -EDEADLK; -- break; -- } -- - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, - this->rt_waiter, - this->task); --- -2.50.1 (Apple Git-155) - diff --git a/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch b/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch deleted file mode 100644 index 031cfbd4a..000000000 --- a/SOURCES/1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch +++ /dev/null @@ -1,109 +0,0 @@ -From e34a2e95ac88e4f13049ddd64f47a361f615bdc3 Mon Sep 17 00:00:00 2001 -From: Carlos Maiolino -Date: Fri, 10 Jul 2026 09:07:22 +0200 -Subject: [PATCH] xfs: resample the data fork mapping after cycling ILOCK - -JIRA: https://redhat.atlassian.net/browse/RHEL-193940 -Upstream Status: git://git.kernel.org/pub/scm/fs/xfs/xfs-linux.git -commit 2f4acd0fcd862e22eab45690ec2c08c80b6ef2e7 -Author: Darrick J. Wong - - xfs: resample the data fork mapping after cycling ILOCK - - xfs_reflink_fill_{cow_hole,delalloc} are both presented with an inode, - a data fork mapping, and a cow fork mapping. Unfortunately, these two - helpers cycle the ILOCK to grab a transaction, which means that the - mappings are stale as soon as we reacquire the ILOCK. Currently we - refresh the cow fork mapping by re-calling xfs_find_trim_cow_extent, but - we don't refresh the data fork mapping beforehand, which means that the - xfs_bmap_trim_cow in that function queries the refcount btree about the - wrong physical blocks and returns an inaccurate value in *shared. - - If *shared is now false, the directio write proceeds with a stale data - fork mapping. Fix this by querying the data fork mapping if the - sequence counter changes across the ILOCK cycle. - - Cc: hch@lst.de - Cc: stable@vger.kernel.org # v4.11 - Fixes: 3c68d44a2b49a0 ("xfs: allocate direct I/O COW blocks in iomap_begin") - Signed-off-by: "Darrick J. Wong" - Reviewed-by: Christoph Hellwig - Reviewed-by: Carlos Maiolino - Signed-off-by: Carlos Maiolino - -Signed-off-by: Carlos Maiolino ---- - fs/xfs/xfs_reflink.c | 36 ++++++++++++++++++++++++++++++++++++ - 1 file changed, 36 insertions(+) - -diff --git a/fs/xfs/xfs_reflink.c b/fs/xfs/xfs_reflink.c -index b11769c009ef..0e4a66ff4e59 100644 ---- a/fs/xfs/xfs_reflink.c -+++ b/fs/xfs/xfs_reflink.c -@@ -389,6 +389,7 @@ xfs_reflink_fill_cow_hole( - struct xfs_mount *mp = ip->i_mount; - struct xfs_trans *tp; - xfs_filblks_t resaligned; -+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); - xfs_extlen_t resblks; - int nimaps; - int error; -@@ -408,6 +409,22 @@ xfs_reflink_fill_cow_hole( - - *lockmode = XFS_ILOCK_EXCL; - -+ /* -+ * The data fork mapping may have changed while we dropped the ILOCK -+ * (a racing O_DIRECT writer under IOLOCK_SHARED can complete a full -+ * CoW cycle including xfs_reflink_end_cow(), which remaps this offset -+ * and drops the refcount of the old shared block). Re-read it so the -+ * shared-status recheck below and the caller's in-place iomap both -+ * operate on the current mapping rather than a stale physical block. -+ */ -+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { -+ nimaps = 1; -+ error = xfs_bmapi_read(ip, imap->br_startoff, -+ imap->br_blockcount, imap, &nimaps, 0); -+ if (error) -+ goto out_trans_cancel; -+ } -+ - error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, &found); - if (error || !*shared) - goto out_trans_cancel; -@@ -454,6 +471,8 @@ xfs_reflink_fill_delalloc( - bool found; - - do { -+ unsigned int seq_before = READ_ONCE(ip->i_df.if_seq); -+ - xfs_iunlock(ip, *lockmode); - *lockmode = 0; - -@@ -464,6 +483,23 @@ xfs_reflink_fill_delalloc( - - *lockmode = XFS_ILOCK_EXCL; - -+ /* -+ * The data fork mapping may have changed while we dropped the -+ * ILOCK (a racing O_DIRECT writer under IOLOCK_SHARED can -+ * complete a full CoW cycle including xfs_reflink_end_cow(), -+ * which remaps this offset and drops the refcount of the old -+ * shared block). Re-read it so the shared-status recheck -+ * below and the caller's in-place iomap both operate on the -+ * current mapping rather than a stale physical block. -+ */ -+ if (seq_before != READ_ONCE(ip->i_df.if_seq)) { -+ nimaps = 1; -+ error = xfs_bmapi_read(ip, imap->br_startoff, -+ imap->br_blockcount, imap, &nimaps, 0); -+ if (error) -+ goto out_trans_cancel; -+ } -+ - error = xfs_find_trim_cow_extent(ip, imap, cmap, shared, - &found); - if (error || !*shared) --- -GitLab - diff --git a/SOURCES/Makefile.rhelver b/SOURCES/Makefile.rhelver index cf8e50290..e5f3ee5c5 100644 --- a/SOURCES/Makefile.rhelver +++ b/SOURCES/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 8 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 687.5.1 +RHEL_RELEASE = 687.26.1 # # ZSTREAM diff --git a/SOURCES/centossecureboot201.cer b/SOURCES/centossecureboot201.cer deleted file mode 100644 index ca3c13440..000000000 Binary files a/SOURCES/centossecureboot201.cer and /dev/null differ diff --git a/SOURCES/centossecurebootca2.cer b/SOURCES/centossecurebootca2.cer deleted file mode 100644 index 42bdfcfbc..000000000 Binary files a/SOURCES/centossecurebootca2.cer and /dev/null differ diff --git a/SOURCES/gating.yaml b/SOURCES/gating.yaml index 03a73c7a2..2418cefdf 100644 --- a/SOURCES/gating.yaml +++ b/SOURCES/gating.yaml @@ -5,11 +5,9 @@ decision_context: osci_compose_gate rules: - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-64k-aarch64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-debug-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-ppc64le.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-64k-aarch64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-aarch64.tier1.functional} - - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-debug-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-rt-x86_64.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-s390x.tier1.functional} - !PassingTestCaseRule {test_case_name: kernel-qe.kernel-ci.kernel-x86_64.tier1.functional} diff --git a/SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 b/SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 deleted file mode 100644 index 3581fd6e4..000000000 Binary files a/SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 and /dev/null differ diff --git a/SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 b/SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 deleted file mode 100644 index 04e3bcdb0..000000000 Binary files a/SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 and /dev/null differ diff --git a/SOURCES/kernel.changelog b/SOURCES/kernel.changelog index 745898509..31a54b0b2 100644 --- a/SOURCES/kernel.changelog +++ b/SOURCES/kernel.changelog @@ -1,3 +1,748 @@ +* Mon Jul 13 2026 CKI KWF Bot [5.14.0-687.26.1.el9_8] +- xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] +Resolves: RHEL-193937 + +* Thu Jul 09 2026 CKI KWF Bot [5.14.0-687.25.1.el9_8] +- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} +- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} +- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499} +- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499} +- net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086} +- kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236] +- kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236] +- net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} +- crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} +Resolves: RHEL-179330, RHEL-183236, RHEL-188459, RHEL-189959, RHEL-193151, RHEL-193245 + +* Tue Jul 07 2026 CKI KWF Bot [5.14.0-687.24.1.el9_8] +- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} +- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} +Resolves: RHEL-183004, RHEL-186702, RHEL-192400 + +* Mon Jul 06 2026 CKI KWF Bot [5.14.0-687.23.1.el9_8] +- eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] +- eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] +- eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773] +- eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773] +- eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773] +- eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773] +- eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242} +- eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773] +- eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773] +- eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773] +- eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773] +- eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773] +- eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773] +- eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074} +- epoll: annotate racy check (Ian Kent) [RHEL-180773] +- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] +- tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] +Resolves: RHEL-173830, RHEL-180773, RHEL-182344, RHEL-182768 + +* Mon Jul 06 2026 CKI KWF Bot [5.14.0-687.22.1.el9_8] +- smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} +- smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116} +- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323} +- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} +- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276} +Resolves: RHEL-177878, RHEL-180041, RHEL-180176, RHEL-180271 + +* Thu Jul 02 2026 CKI KWF Bot [5.14.0-687.21.1.el9_8] +- fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112} +- Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263} +- KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316} +- netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244} +- procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259} +- drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209} +- sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} +- nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] +Resolves: RHEL-160966, RHEL-179865, RHEL-179909, RHEL-181907, RHEL-181929, RHEL-183625, RHEL-183969, RHEL-189503 + +* Mon Jun 29 2026 CKI KWF Bot [5.14.0-687.20.1.el9_8] +- crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] +- crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] +- crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540] +- crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540] +- tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198} +- crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760] +- crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760] +- crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760] +- crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739} +- crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760] +- crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760] +- crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760] +- scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] +- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} +Resolves: RHEL-167051, RHEL-174243, RHEL-181886, RHEL-182540, RHEL-182760 + +* Thu Jun 25 2026 CKI KWF Bot [5.14.0-687.19.1.el9_8] +- RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} +- init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] +- update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183] +- init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183] +- work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183] +- compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183] +- powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183] +- sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776] +- sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776] +- RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189} +- sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273] +- netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273] +- iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993] +- iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993] +- iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993] +- iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993] +- iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993] +Resolves: RHEL-172993, RHEL-178273, RHEL-179955, RHEL-179994, RHEL-182776, RHEL-183183 + +* Tue Jun 23 2026 CKI KWF Bot [5.14.0-687.18.1.el9_8] +- net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057] +- net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057] +- net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057] +- IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057] +- net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057] +- net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057] +- net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057] +- net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057] +- net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057] +- net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057] +- net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057] +- net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057] +- net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057] +- net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057] +- net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057] +- net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057] +- net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057] +- net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057] +- net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057] +- net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057] +- net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057] +- net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057] +- net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057] +- net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057] +- net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057] +- net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057] +- net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057] +- mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057] +- net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057] +- net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057] +- net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057] +- net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057] +- net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057] +- PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057] +- net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057] +- net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057] +- net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057] +- net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057] +- net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057] +- net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057] +- net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057] +- net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057] +- net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] +- net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] +- {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] +- RDMA: Use %%pe format specifier for error pointers (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057] +- net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057] +- mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057] +- net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057] +- net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057] +- net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057] +- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057] +- net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057] +- net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057] +- net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057] +- net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057] +- net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057] +- net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057] +- net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057] +- net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057] +- net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057] +- net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057] +- net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057] +- net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057] +- net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057] +- net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] +- net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] +- net/mlx5: Use %%pe format specifier for error pointers (Kamal Heib) [RHEL-169057] +- net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] +- net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057] +- net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057] +- net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057] +- net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057] +- net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057] +- net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057] +- net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057] +- net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057] +- net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057] +- net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057] +- net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057] +- net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057] +- net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057] +- net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057] +- net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057] +- net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057] +- net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057] +- net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057] +- net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057] +- net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057] +- net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057] +- net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057] +- net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057] +- net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057] +- net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057] +- net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057] +- eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057] +- net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057] +- net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057] +- net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057] +- {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] +- net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] +- net/mlx5: Don't use %%pK through tracepoints (Kamal Heib) [RHEL-169057] +- IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057] +- net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057] +- net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057] +- net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057] +- net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057] +- net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057] +- net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057] +- net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057] +- net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057] +- net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057] +- net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057] +- net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057] +- net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057] +- net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057] +- net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057] +- net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057] +- net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057] +- net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057] +- net: Fix typos (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057] +- net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057] +- PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057] +- net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057] +- net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057] +- net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057] +- net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057] +- net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057] +- net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057] +- net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057] +- net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057] +- net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057] +- net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057] +- net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057] +- eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057] +- net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057] +- net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057] +- net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057] +- net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057] +- net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057] +- net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057] +- net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057] +- net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057] +- net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057] +- net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057] +- net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057] +- net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057] +- net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057] +- net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057] +- net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057] +- net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057] +- net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057] +- net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057] +- net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057] +- net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057] +- net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057] +- net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057] +- net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057] +- net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057] +- RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057] +- net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057] +- net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057] +- net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057] +- selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444] +- ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444] +- ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444] +- ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054} +- RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898} +- ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090} +- ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038} +- drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} +- netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} +Resolves: RHEL-169057, RHEL-172670, RHEL-176927, RHEL-178836, RHEL-179310, RHEL-179444, RHEL-179664 + +* Thu Jun 18 2026 CKI KWF Bot [5.14.0-687.17.1.el9_8] +- net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} +- gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) +- rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130] +- scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414} +- nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135} +- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117} +- exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173} +- ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279} +Resolves: RHEL-173941, RHEL-177392, RHEL-179754, RHEL-180016, RHEL-180102, RHEL-180158, RHEL-183130 + +* Tue Jun 16 2026 CKI KWF Bot [5.14.0-687.16.1.el9_8] +- s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317] +- ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308] +- s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048] +- gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984} +- gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984} +- bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260} +- wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125} +- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145} +- wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152} +- wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166} +- Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056} +- ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699] +- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669} +- dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823] +- dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823] +- dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820] +- dpll: add pin operational state (Ivan Vecera) [RHEL-175820] +- can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474} +- Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} +- xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} +Resolves: RHEL-166048, RHEL-171506, RHEL-172488, RHEL-172858, RHEL-175525, RHEL-175699, RHEL-175820, RHEL-175823, RHEL-178308, RHEL-179359, RHEL-179589, RHEL-180025, RHEL-180057, RHEL-180085, RHEL-180121, RHEL-180308, RHEL-183317 + +* Wed Jun 10 2026 CKI KWF Bot [5.14.0-687.15.1.el9_8] +- ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} +- net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} +Resolves: RHEL-170539, RHEL-172646 + +* Tue Jun 09 2026 Tanishi Srivastava [5.14.0-687.14.1.el9_8] +- RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181} +- redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501} +- RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852} +- netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116} +- ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526] +- ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336] +- ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336] +- ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336] +- dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} +- dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125} +- dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273] +- dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273] +- dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273] +- dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273] +- dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833] +- dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833] +- dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833] +- dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938] +- dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938] +- ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581} +- net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056} +- scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216} +- net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} +- x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] +Resolves: RHEL-158916, RHEL-165564, RHEL-167273, RHEL-167833, RHEL-168068, RHEL-172768, RHEL-172938, RHEL-172969, RHEL-173843, RHEL-173993, RHEL-174336, RHEL-177526, RHEL-178408, RHEL-179712, RHEL-179988, RHEL-181822 + +* Tue Jun 02 2026 CKI KWF Bot [5.14.0-687.13.1.el9_8] +- smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} +- s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] +- s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472] +- s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472] +- nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] +- nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745] +- Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786} +- crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167] +- crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167] +- smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613} +- mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778] +- mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778] +- mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778] +- mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778] +- mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778] +- mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778] +- mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] +- mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] +Resolves: RHEL-164778, RHEL-171471, RHEL-171745, RHEL-172167, RHEL-172510, RHEL-176472, RHEL-178944 + +* Mon May 25 2026 CKI KWF Bot [5.14.0-687.12.1.el9_8] +- dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] +- netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} +- wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110} +- Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023} +- Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020} +- crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914] +- proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653} +- proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653} +- proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653} +- pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470] +Resolves: RHEL-157470, RHEL-163343, RHEL-169626, RHEL-170914, RHEL-172572, RHEL-172599, RHEL-173848, RHEL-174216 + +* Tue May 19 2026 CKI KWF Bot [5.14.0-687.11.1.el9_8] +- mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303} +- ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441] +- smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821] +- smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821] +- smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821] +- smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821] +- smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709} +- Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408} +- xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} +- xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158} +- redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927] +- HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051} +- netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027} +- s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859] +- ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829] +- ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829] +- dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829] +- ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179] +- ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832] +- ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257] +- dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442] +- dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442] +- dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442] +- dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442] +- dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442] +- scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378] +- netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685} +- net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684} +- cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960] +- ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701] +- ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701] +- ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701] +- ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701] +- drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179] +- nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366} +- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} +- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089} +- netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455} +- crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724} +- ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183} +- i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312] +- ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182] +- ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185] +- Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] +- netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} +Resolves: RHEL-150179, RHEL-155312, RHEL-160461, RHEL-162179, RHEL-162182, RHEL-162185, RHEL-163464, RHEL-164442, RHEL-165063, RHEL-166859, RHEL-166927, RHEL-166950, RHEL-166987, RHEL-167100, RHEL-169734, RHEL-170701, RHEL-170960, RHEL-171138, RHEL-171155, RHEL-171378, RHEL-171829, RHEL-171832, RHEL-172257, RHEL-172620, RHEL-172740, RHEL-172821, RHEL-172927, RHEL-174058, RHEL-174750, RHEL-175441 + +* Mon May 18 2026 CKI KWF Bot [5.14.0-687.10.1.el9_8] +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} +- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} +- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} +- ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333} +- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163} +- RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128} +- usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607} +- can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532} +Resolves: RHEL-170759, RHEL-171430, RHEL-174020, RHEL-174091, RHEL-176064, RHEL-176454 + +* Mon May 11 2026 Patrick Talbert [5.14.0-687.9.1.el9_8] +- xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284} +Resolves: RHEL-174563 + +* Mon May 04 2026 Patrick Talbert [5.14.0-687.8.1.el9_8] +- crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204] +- crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204] +- crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204] +- crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204] +- crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431} +- crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060} +- crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204] +- crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677} +- crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431} +- crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204] +Resolves: RHEL-172204 + +* Fri Apr 24 2026 CKI KWF Bot [5.14.0-687.7.1.el9_8] +- KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401} +- powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125] +- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136} +- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990} +- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984} +- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116} +- scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742] +- Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742] +- Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742] +- drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822] +- drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822] +- x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853] +- net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270} +- net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204} +- net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404] +Resolves: RHEL-104822, RHEL-150404, RHEL-153722, RHEL-157235, RHEL-157853, RHEL-165125, RHEL-167742, RHEL-169063, RHEL-169067, RHEL-169071, RHEL-169078 + +* Thu Apr 16 2026 CKI KWF Bot [5.14.0-687.6.1.el9_8] +- nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402} +- scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741} +- smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988] +- ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378] +- RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966] +- RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966] +- net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207] +- ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095] +- net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766} +- net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} +- rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} +Resolves: RHEL-145522, RHEL-150444, RHEL-151378, RHEL-154095, RHEL-155207, RHEL-155966, RHEL-158988, RHEL-159223, RHEL-167017 + * Wed Apr 01 2026 CKI KWF Bot [5.14.0-687.5.1.el9_8] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] diff --git a/SOURCES/linux-4.18.0-553.139.1.el8_10.tar.xz b/SOURCES/linux-4.18.0-553.139.1.el8_10.tar.xz deleted file mode 100644 index a4e3f68e7..000000000 Binary files a/SOURCES/linux-4.18.0-553.139.1.el8_10.tar.xz and /dev/null differ diff --git a/SOURCES/redhatsecureboot302.cer b/SOURCES/redhatsecureboot302.cer deleted file mode 100644 index 137d3858f..000000000 Binary files a/SOURCES/redhatsecureboot302.cer and /dev/null differ diff --git a/SOURCES/redhatsecureboot303.cer b/SOURCES/redhatsecureboot303.cer deleted file mode 100644 index 25e3743e4..000000000 Binary files a/SOURCES/redhatsecureboot303.cer and /dev/null differ diff --git a/SOURCES/redhatsecureboot501.cer b/SOURCES/redhatsecureboot501.cer deleted file mode 100644 index dfa7afb46..000000000 Binary files a/SOURCES/redhatsecureboot501.cer and /dev/null differ diff --git a/SOURCES/redhatsecurebootca3.cer b/SOURCES/redhatsecurebootca3.cer deleted file mode 100644 index b2354007b..000000000 Binary files a/SOURCES/redhatsecurebootca3.cer and /dev/null differ diff --git a/SOURCES/redhatsecurebootca7.cer b/SOURCES/redhatsecurebootca7.cer deleted file mode 100644 index 0e6e79bdb..000000000 Binary files a/SOURCES/redhatsecurebootca7.cer and /dev/null differ diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index a99af7d97..15b076512 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -178,13 +178,13 @@ Summary: The Linux kernel %define patchversion 5.14 %define pkgrelease 687.26.1 %define kversion 5 -%define tarfile_release 5.14.0-687.5.1.el9_8 +%define tarfile_release 5.14.0-687.26.1.el9_8 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag %define specrelease 687.26.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-687.5.1.el9_8 +%define kabiversion 5.14.0-687.26.1.el9_8 # # End of genspec.sh variables @@ -975,670 +975,8 @@ Patch2007: 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch Patch2008: 0001-Make-KVM-PMU-symbols-global-for-ppc64le-module-build.patch Patch2009: 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patch -Patch1100: 1100-rtnetlink-allocate-vfinfo-size-for-vf-guids-when-supported.patch -Patch1101: 1101-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch -Patch1102: 1102-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch -Patch1103: 1103-ice-fix-page-leak-for-zero-size-rx-descriptors.patch -Patch1104: 1104-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch -Patch1105: 1105-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch -Patch1106: 1106-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch -Patch1107: 1107-rdma-bnxt-re-support-2g-message-size.patch -Patch1108: 1108-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch -Patch1109: 1109-rdma-bnxt-re-congestion-control-settings-using-debugfs-hook.patch -Patch1110: 1110-rdma-bnxt-re-fix-buffer-overflow-in-debugfs-code.patch -Patch1111: 1111-rdma-bnxt-re-fix-the-condition-check-while-programming-conge.patch -Patch1112: 1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch -Patch1113: 1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch -Patch1114: 1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch -Patch1115: 1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch -Patch1116: 1116-ionic-fix-persistent-mac-address-override-on-pf.patch -Patch1117: 1117-smb-client-fix-krb5-mount-with-username-option.patch -Patch1118: 1118-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch -Patch1119: 1119-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch -Patch1120: 1120-net-add-skb-header-pointer-careful-helper.patch -Patch1121: 1121-net-sched-cls-u32-use-skb-header-pointer-careful.patch -Patch1122: 1122-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch -Patch1123: 1123-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch -Patch1124: 1124-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch -Patch1125: 1125-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch -Patch1126: 1126-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch -Patch1127: 1127-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch -Patch1128: 1128-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch -Patch1129: 1129-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch -Patch1130: 1130-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch -Patch1131: 1131-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch -Patch1132: 1132-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch -Patch1133: 1133-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch -Patch1134: 1134-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch -Patch1135: 1135-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch -Patch1136: 1136-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch -Patch1137: 1137-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch -Patch1138: 1138-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch -Patch1139: 1139-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch -Patch1140: 1140-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch -Patch1141: 1141-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch -Patch1142: 1142-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch -Patch1143: 1143-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch -Patch1144: 1144-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch -Patch1145: 1145-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch -Patch1146: 1146-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch -Patch1147: 1147-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch -Patch1148: 1148-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch -Patch1149: 1149-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch -Patch1150: 1150-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch -Patch1151: 1151-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch -Patch1152: 1152-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch -Patch1153: 1153-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch -Patch1154: 1154-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch -Patch1155: 1155-revert-scsi-lpfc-use-min-to-improve-code.patch -Patch1156: 1156-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch -Patch1157: 1157-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch -Patch1158: 1158-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch -Patch1159: 1159-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch -Patch1160: 1160-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch -Patch1161: 1161-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch -Patch1162: 1162-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch -Patch1163: 1163-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch -Patch1164: 1164-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch -Patch1165: 1165-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch -Patch1166: 1166-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch -Patch1167: 1167-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch -Patch1168: 1168-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch -Patch1169: 1169-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch -Patch1170: 1170-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch -Patch1171: 1171-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-if-nodelist-freed.patch -Patch1172: 1172-libceph-make-decode-pool-more-resilient-against-corrupted-os.patch -Patch1173: 1173-libceph-prevent-potential-out-of-bounds-reads-in-handle-auth.patch -Patch1174: 1174-libceph-replace-overzealous-bug-on-in-osdmap-apply-increment.patch -Patch1175: 1175-libceph-reset-sparse-read-state-in-osd-fault.patch -Patch1176: 1176-powerpc-tools-drop-o-pipefail-in-gcc-check-scripts.patch -Patch1177: 1177-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch -Patch1178: 1178-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch -Patch1179: 1179-crypto-algif-aead-revert-to-operating-out-of-place.patch -Patch1180: 1180-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch -Patch1181: 1181-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch -Patch1182: 1182-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch -Patch1183: 1183-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch -Patch1184: 1184-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch -Patch1185: 1185-crypto-authencesn-reject-short-ahash-digests-during-instance.patch -Patch1186: 1186-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch -Patch1187: 1187-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch -Patch1188: 1188-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch -Patch1189: 1189-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch -Patch1190: 1190-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch -Patch1191: 1191-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch -Patch1192: 1192-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch -Patch1193: 1193-ptrace-slightly-saner-get-dumpable-logic.patch -Patch1194: 1194-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch -Patch1195: 1195-net-move-skb-gro-receive-list-from-udp-to-core.patch -Patch1196: 1196-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch -Patch1197: 1197-smb-client-reject-userspace-cifs.spnego-descriptions.patch -Patch1198: 1198-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch -Patch1199: 1199-revert-mm-pcp-increase-pcp-free-count-threshold-to-trigger-f.patch -Patch1200: 1200-ice-fix-missing-tx-timestamps-interrupts-on-e825-devices.patch -Patch1201: 1201-ice-fix-ptp-timestamping-broken-by-synce-code-on-e825c.patch -Patch1202: 1202-i2c-i801-revert-i2c-i801-replace-acpi-lock-with-i2c-bus-lock.patch -Patch1203: 1203-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch -Patch1204: 1204-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch -Patch1205: 1205-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch -Patch1206: 1206-iommu-sva-add-kernel-page-table-iotlb-flush-notification.patch -Patch1207: 1207-x86-mm-flush-iommu-before-freeing-kernel-page-table-pages.patch -Patch1208: 1208-nbd-defer-config-unlock-in-nbd-genl-connect.patch -Patch1209: 1209-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch -Patch1210: 1210-ice-fix-timestamp-interrupt-configuration-for-e825c.patch -Patch1211: 1211-ice-perform-phy-soft-reset-for-e825c-ports-at-initialization.patch -Patch1212: 1212-ice-fix-ready-bitmap-check-for-non-e822-devices.patch -Patch1213: 1213-ice-fix-ice-ptp-read-tx-hwtstamp-status-eth56g.patch -Patch1214: 1214-cifs-make-default-value-of-retrans-as-zero.patch -Patch1215: 1215-net-sched-act-csum-validate-nested-vlan-headers.patch -Patch1216: 1216-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch -Patch1217: 1217-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch -Patch1218: 1218-dpll-zl3073x-add-output-pin-frequency-helper.patch -Patch1219: 1219-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch -Patch1220: 1220-dpll-zl3073x-fix-ref-frequency-setting.patch -Patch1221: 1221-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch -Patch1222: 1222-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch -Patch1223: 1223-ice-fix-null-pointer-dereference-in-ice-reset-all-vfs.patch -Patch1224: 1224-ice-fix-missing-sma-pin-initialization-in-dpll-subsystem.patch -Patch1225: 1225-ice-fix-sma-and-u-fl-pin-state-changes-affecting-paired-pin.patch -Patch1226: 1226-dpll-export-dpll-pin-change-ntf-for-use-under-dpll-lock.patch -Patch1227: 1227-ice-fix-missing-dpll-notifications-for-sw-pins.patch -Patch1228: 1228-ice-add-dpll-peer-notification-for-paired-sma-and-u-fl-pins.patch -Patch1229: 1229-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch -Patch1230: 1230-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch -Patch1231: 1231-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch -Patch1232: 1232-redhat-configs-enable-config-sclp-ofb-for-s390x.patch -Patch1233: 1233-xfs-delete-attr-leaf-freemap-entries-when-empty.patch -Patch1234: 1234-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch -Patch1235: 1235-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch -Patch1236: 1236-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch -Patch1237: 1237-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch -Patch1238: 1238-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch -Patch1239: 1239-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch -Patch1240: 1240-smb-client-validate-dacloffset-before-building-dacl-pointers.patch -Patch1241: 1241-ice-fix-infinite-recursion-in-ice-cfg-tx-topo-via-ice-init-d.patch -Patch1242: 1242-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch -Patch1243: 1243-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch -Patch1244: 1244-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch -Patch1245: 1245-proc-fix-missing-pde-set-flags-for-net-proc-files.patch -Patch1246: 1246-proc-fix-type-confusion-in-pde-set-flags.patch -Patch1247: 1247-crypto-tegra-disable-softirqs-before-finalizing-request.patch -Patch1248: 1248-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch -Patch1249: 1249-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch -Patch1250: 1250-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch -Patch1251: 1251-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch -Patch1252: 1252-dm-thin-fix-metadata-refcount-underflow.patch Patch11111: ppc64le-kvm-support.patch -Patch1253: 1253-mm-document-gfp-nofail-must-be-blockable.patch -Patch1254: 1254-mm-warn-about-illegal-gfp-nofail-usage-in-a-more-appropriate.patch -Patch1255: 1255-mm-page-alloc-c-avoid-infinite-retries-caused-by-cpuset-race.patch -Patch1256: 1256-mm-page-alloc-thp-prevent-reclaim-for-gfp-thisnode-thp-alloc.patch -Patch1257: 1257-mm-page-alloc-ignore-the-exact-initial-compaction-result.patch -Patch1258: 1258-mm-page-alloc-refactor-the-initial-compaction-handling.patch -Patch1259: 1259-mm-page-alloc-simplify-alloc-pages-slowpath-flow.patch -Patch1260: 1260-mm-page-alloc-add-vm-thp-thisnode-reclaim-sysctl-to-allow-th.patch -Patch1261: 1261-smb-client-fix-oob-reads-parsing-symlink-error-response.patch -Patch1262: 1262-crypto-authenc-fix-sleep-in-atomic-context-in-decrypt-tail.patch -Patch1263: 1263-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch -Patch1264: 1264-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch -Patch1265: 1265-nvme-nvme-fc-move-tagset-removal-to-nvme-fc-delete-ctrl.patch -Patch1266: 1266-nvme-nvme-fc-ensure-ioerr-work-is-cancelled-in-nvme-fc-delet.patch -Patch1267: 1267-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch -Patch1268: 1268-s390-dasd-move-quiesce-state-with-pprc-swap.patch -Patch1269: 1269-s390-dasd-copy-detected-format-information-to-secondary-devi.patch -Patch1270: 1270-x86-kvm-avoid-freeing-stack-allocated-node-in-kvm-async-pf-q.patch -Patch1271: 1271-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch -Patch1272: 1272-scsi-target-iscsi-fix-use-after-free-in-iscsit-dec-conn-usag.patch -Patch1273: 1273-net-mana-fix-use-after-free-in-add-adev-error-path.patch -Patch1274: 1274-alsa-6fire-fix-use-after-free-on-disconnect.patch -Patch1275: 1275-dlm-validate-length-in-dlm-search-rsb-tree.patch -Patch1276: 1276-dlm-fix-buffer-overflow-from-negative-len-in-dlm-search-rsb-.patch -Patch1277: 1277-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch -Patch1278: 1278-rdma-rxe-fix-double-free-in-rxe-srq-from-init.patch -Patch1279: 1279-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch -Patch1280: 1280-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch -Patch1281: 1281-ipv6-rpl-headroom.patch -Patch1282: 1282-rdma-mlx4-srq.patch -Patch1283: 1283-dpll-series-RHEL.patch -Patch1284: 1284-ice-rss-queues-RHEL.patch -Patch1285: 1285-xen-privcmd-fix-double-free-via-vma-splitting.patch -Patch1286: 1286-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch -Patch1287: 1287-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch -Patch1288: 1288-dpll-add-pin-operational-state.patch -Patch1289: 1289-dpll-zl3073x-implement-pin-operational-state-reporting.patch -Patch1290: 1290-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch -Patch1291: 1291-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch -Patch1292: 1292-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch -Patch1293: 1293-ice-fix-null-pointer-dereference-in-ice-vsi-set-napi-queues.patch -Patch1294: 1294-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch -Patch1295: 1295-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch -Patch1296: 1296-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch -Patch1297: 1297-rdma-mana-validate-rx-hash-key-len.patch -Patch1298: 1298-wifi-mac80211-remove-station-if-connection-prep-fails.patch -Patch1299: 1299-bnxt-en-fix-rss-context-delete-logic.patch -Patch1300: 1300-gfs2-add-metapath-dibh-helper.patch -Patch1301: 1301-gfs2-fix-use-after-free-in-iomap-inline-data-write-path.patch -Patch1302: 1302-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch -Patch1303: 1303-ibmveth-disable-gso-for-packets-with-small-mss.patch -Patch1304: 1304-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch -Patch1305: 1305-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch -Patch1306: 1306-exit-prevent-preemption-of-oopsing-task-dead-task.patch -Patch1307: 1307-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch -Patch1308: 1308-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch -Patch1309: 1309-scsi-qla2xxx-completely-fix-fcport-double-free.patch -Patch1310: 1310-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch -Patch1311: 1311-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch -Patch1312: 1312-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch -Patch1313: 1313-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch -Patch1314: 1314-drm-amd-display-do-not-skip-unrelated-mode-changes-in-dsc-va.patch -Patch1315: 1315-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch -Patch1316: 1316-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch -Patch1317: 1317-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch -Patch1318: 1318-binder-use-cred-instead-of-task-for-selinux-checks.patch -Patch1319: 1319-locks-fix-toctou-race-when-granting-write-lease.patch -Patch1320: 1320-fs-use-a-helper-for-opening-kernel-internal-files.patch -Patch1321: 1321-fs-move-kmem-cache-zalloc-into-alloc-empty-file-helpers.patch -Patch1322: 1322-fs-use-backing-file-container-for-internal-files-with-fake-f.patch -Patch1323: 1323-ovl-enable-fsnotify-events-on-underlying-real-files.patch -Patch1324: 1324-fs-move-cleanup-from-init-file-into-its-callers.patch -Patch1325: 1325-lsm-constify-the-file-parameter-in-security-binder-transfer-.patch -Patch1326: 1326-cachefiles-use-kiocb-start-end-write-helpers.patch -Patch1327: 1327-fs-fix-kernel-doc-warnings.patch -Patch1328: 1328-fs-rename-mnt-want-drop-write-helpers.patch -Patch1329: 1329-fs-get-mnt-writers-count-for-an-open-backing-file-s-real-pat.patch -Patch1330: 1330-fs-create-helper-file-user-path-for-user-displayed-mapped-fi.patch -Patch1331: 1331-fs-store-real-path-instead-of-fake-path-in-backing-file-f-pa.patch -Patch1332: 1332-fs-prepare-for-stackable-filesystems-backing-file-helpers.patch -Patch1333: 1333-fs-factor-out-backing-file-read-write-iter-helpers.patch -Patch1334: 1334-fs-factor-out-backing-file-splice-read-write-helpers.patch -Patch1335: 1335-fs-factor-out-backing-file-mmap-helper.patch -Patch1336: 1336-lsm-add-helper-for-blob-allocations.patch -Patch1337: 1337-ovl-fix-nested-backing-file-paths.patch -Patch1338: 1338-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch -Patch1339: 1339-ovl-remove-unneeded-non-const-conversion.patch -Patch1340: 1340-ovl-remove-redundant-iocb-dio-caller-comp-clearing.patch -Patch1341: 1341-perf-core-fix-mmap-event-path-names-with-backing-files.patch -Patch1342: 1342-fs-prepare-for-adding-lsm-blob-to-backing-file.patch -Patch1343: 1343-lsm-add-backing-file-lsm-hooks.patch -Patch1344: 1344-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch -Patch1345: 1345-selinux-rhel-only-hotfix-for-execmem-regression.patch -Patch1346: 1346-net-mlx5-hws-fix-matcher-action-template-attach.patch -Patch1347: 1347-net-mlx5-hws-remove-unused-element-array.patch -Patch1348: 1348-net-mlx5-hws-make-pool-single-resource.patch -Patch1349: 1349-net-mlx5-hws-refactor-pool-implementation.patch -Patch1350: 1350-net-mlx5-hws-cleanup-after-pool-refactoring.patch -Patch1351: 1351-net-mlx5-hws-add-fullness-tracking-to-pool.patch -Patch1352: 1352-net-mlx5-hws-fix-pool-size-optimization.patch -Patch1353: 1353-net-mlx5-hws-implement-action-ste-pool.patch -Patch1354: 1354-net-mlx5-hws-use-the-new-action-ste-pool.patch -Patch1355: 1355-net-mlx5-hws-cleanup-matcher-action-ste-table.patch -Patch1356: 1356-net-mlx5-hws-free-unused-action-ste-tables.patch -Patch1357: 1357-net-mlx5-hws-export-action-ste-tables-to-debugfs.patch -Patch1358: 1358-net-mlx5e-ethtool-fix-formatting-of-ptp-rq0-csum-complete-ta.patch -Patch1359: 1359-net-mlx5-fix-spelling-mistakes-in-mlx5-core-dbg-message-and-.patch -Patch1360: 1360-net-mlx5-hws-fix-ip-version-decision.patch -Patch1361: 1361-net-mlx5-hws-harden-ip-version-definer-checks.patch -Patch1362: 1362-net-mlx5-hws-disallow-matcher-ip-version-mixing.patch -Patch1363: 1363-rdma-mlx5-fix-error-flow-upon-firmware-failure-for-rq-destru.patch -Patch1364: 1364-net-mlx5-support-software-tx-timestamp.patch -Patch1365: 1365-net-mlx5-hws-expose-function-mlx5hws-table-ft-set-next-ft-in.patch -Patch1366: 1366-net-mlx5-hws-add-definer-function-to-get-field-name-str.patch -Patch1367: 1367-net-mlx5-hws-expose-polling-function-in-header-file.patch -Patch1368: 1368-net-mlx5-hws-introduce-isolated-matchers.patch -Patch1369: 1369-net-mlx5-hws-support-complex-matchers.patch -Patch1370: 1370-net-mlx5-hws-force-rehash-when-rule-insertion-failed.patch -Patch1371: 1371-net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch -Patch1372: 1372-net-mlx5-hws-fix-redundant-extension-of-action-templates.patch -Patch1373: 1373-net-mlx5-hws-rework-rehash-loop.patch -Patch1374: 1374-net-mlx5-hws-dump-bad-completion-details.patch -Patch1375: 1375-net-mlx5-use-to-delayed-work.patch -Patch1376: 1376-net-mlx5-sws-fix-reformat-id-error-handling.patch -Patch1377: 1377-net-mlx5-hws-register-reformat-actions-with-fw.patch -Patch1378: 1378-net-mlx5-hws-fix-typo-nope-to-nop.patch -Patch1379: 1379-net-mlx5-hws-handle-modify-header-actions-dependency.patch -Patch1380: 1380-net-mlx5-core-add-error-handling-inmlx5-query-nic-vport-qkey.patch -Patch1381: 1381-net-mlx5e-allow-setting-mac-address-of-representors.patch -Patch1382: 1382-net-mlx5-add-error-handling-in-mlx5-query-nic-vport-node-gui.patch -Patch1383: 1383-net-mlx5-hws-fix-an-error-code-in-mlx5hws-bwc-rule-create-co.patch -Patch1384: 1384-net-mlx5-ensure-fw-pages-are-always-allocated-on-same-numa.patch -Patch1385: 1385-net-mlx5-fix-return-value-when-searching-for-existing-flow-g.patch -Patch1386: 1386-net-mlx5-hws-init-mutex-on-the-correct-path.patch -Patch1387: 1387-net-mlx5-hws-fix-missing-ip-version-handling-in-definer.patch -Patch1388: 1388-net-mlx5-hws-make-sure-the-uplink-is-the-last-destination.patch -Patch1389: 1389-net-mlx5e-fix-leak-of-geneve-tlv-option-object.patch -Patch1390: 1390-net-mlx5-hws-add-error-checking-to-hws-bwc-rule-complex-hash.patch -Patch1391: 1391-net-mlx5e-fix-race-between-dim-disable-and-net-dim.patch -Patch1392: 1392-net-mlx5e-add-new-prio-for-promiscuous-mode.patch -Patch1393: 1393-net-mlx5-correctly-set-gso-size-when-lro-is-used.patch -Patch1394: 1394-net-mlx5-fix-memory-leak-in-cmd-exec.patch -Patch1395: 1395-net-mlx5-e-switch-fix-peer-miss-rules-to-use-peer-eswitch.patch -Patch1396: 1396-rdma-mlx5-convert-timeouts-to-secs-to-jiffies.patch -Patch1397: 1397-rdma-mlx5-remove-the-redundant-mlx5-ib-stage-uar-stage.patch -Patch1398: 1398-rdma-mlx5-add-support-for-200gbps-per-lane-speeds.patch -Patch1399: 1399-rdma-mlx5-avoid-flexible-array-warning.patch -Patch1400: 1400-rdma-mlx5-initialize-obj-event-obj-sub-list-before-xa-insert.patch -Patch1401: 1401-rdma-mlx5-fix-hw-counters-query-for-non-representor-devices.patch -Patch1402: 1402-rdma-mlx5-fix-cc-counters-query-for-mpv.patch -Patch1403: 1403-rdma-mlx5-fix-vport-loopback-for-mpv-device.patch -Patch1404: 1404-net-mlx5-expose-serial-numbers-in-devlink-info.patch -Patch1405: 1405-net-mlx5e-shampo-reorganize-mlx5-rq-shampo-alloc.patch -Patch1406: 1406-net-mlx5e-shampo-remove-redundant-params.patch -Patch1407: 1407-net-mlx5e-shampo-improve-hw-gro-capability-checking.patch -Patch1408: 1408-net-mlx5e-shampo-separate-pool-for-headers.patch -Patch1409: 1409-net-mlx5e-implement-queue-mgmt-ops-and-single-channel-swap.patch -Patch1410: 1410-net-mlx5e-support-ethtool-tcp-data-split-settings.patch -Patch1411: 1411-net-mlx5-fs-add-multiple-prios-to-rdma-transport-steering-do.patch -Patch1412: 1412-net-mlx5-small-refactor-for-general-object-capabilities.patch -Patch1413: 1413-net-mlx5-add-ifc-bits-for-pcie-congestion-event-object.patch -Patch1414: 1414-rdma-mlx5-allocate-ib-device-with-net-namespace-supplied-fro.patch -Patch1415: 1415-net-mlx5e-fix-error-handling-in-rq-memory-model-registration.patch -Patch1416: 1416-net-mlx5-fs-fix-rdma-transport-init-cleanup-flow.patch -Patch1417: 1417-net-mlx5-check-device-memory-pointer-before-usage.patch -Patch1418: 1418-net-mlx5-add-no-op-implementation-for-setting-tc-bw-on-rate-.patch -Patch1419: 1419-net-mlx5-add-support-for-setting-tc-bw-on-nodes.patch -Patch1420: 1420-net-mlx5-add-traffic-class-scheduling-support-for-vport-qos.patch -Patch1421: 1421-net-mlx5-manage-tc-arbiter-nodes-and-implement-full-support-.patch -Patch1422: 1422-net-mlx5-hws-remove-unused-create-dest-array-parameter.patch -Patch1423: 1423-net-mlx5-hws-remove-incorrect-comment.patch -Patch1424: 1424-net-mlx5-hws-export-rule-skip-logic.patch -Patch1425: 1425-net-mlx5-hws-refactor-rule-skip-logic.patch -Patch1426: 1426-net-mlx5-hws-create-stes-directly-from-matcher.patch -Patch1427: 1427-net-mlx5-hws-decouple-matcher-rx-and-tx-sizes.patch -Patch1428: 1428-net-mlx5-hws-track-matcher-sizes-individually.patch -Patch1429: 1429-net-mlx5-hws-rearrange-to-prevent-forward-declaration.patch -Patch1430: 1430-net-mlx5-hws-shrink-empty-matchers.patch -Patch1431: 1431-net-mlx5-add-hws-as-secondary-steering-mode.patch -Patch1432: 1432-net-mlx5-fix-spelling-mistake-disabliing-disabling.patch -Patch1433: 1433-eth-mlx5-migrate-to-the-rxfh-context-ops.patch -Patch1434: 1434-net-mlx5e-remove-unused-vlan-insertion-logic-in-tx-path.patch -Patch1435: 1435-net-mlx5e-ct-extract-a-memcmp-from-a-spinlock-section.patch -Patch1436: 1436-net-mlx5e-replace-recursive-vlan-push-handling-with-an-itera.patch -Patch1437: 1437-net-mlx5-warn-when-write-combining-is-not-supported.patch -Patch1438: 1438-net-mlx5e-rx-remove-unnecessary-rqt-redirects.patch -Patch1439: 1439-net-mlx5-expose-hca-capability-bits-for-mkey-max-page-size.patch -Patch1440: 1440-rdma-mlx5-fix-umr-modifying-of-mkey-page-size.patch -Patch1441: 1441-net-mlx5-expose-disciplined-fr-counter-through-hca-capabilit.patch -Patch1442: 1442-net-mlx5-ifc-updates-for-disabled-host-pf.patch -Patch1443: 1443-net-mlx5e-create-destroy-pcie-congestion-event-object.patch -Patch1444: 1444-net-mlx5e-add-device-pcie-congestion-ethtool-stats.patch -Patch1445: 1445-net-mlx5-fix-an-is-err-vs-null-bug-in-esw-qos-move-node.patch -Patch1446: 1446-net-mlx5-hws-enable-ipsec-hardware-offload-in-legacy-mode.patch -Patch1447: 1447-net-mlx5e-fix-kdoc-warning-on-eswitch-h.patch -Patch1448: 1448-net-mlx5e-properly-access-rcu-protected-qdisc-sleeping-varia.patch -Patch1449: 1449-net-mlx5-add-ifc-bits-to-support-rss-for-ipsec-offload.patch -Patch1450: 1450-net-mlx5-add-ifc-bits-and-enums-for-buf-ownership.patch -Patch1451: 1451-net-mlx5-expose-cable-length-field-in-pfcc-register.patch -Patch1452: 1452-net-mlx5e-shampo-cleanup-reservation-size-formula.patch -Patch1453: 1453-net-mlx5e-shampo-remove-mlx5e-shampo-get-log-hd-entry-size.patch -Patch1454: 1454-net-mlx5e-remove-duplicate-mkey-from-shampo-header.patch -Patch1455: 1455-pci-tph-expose-pcie-tph-get-st-table-size.patch -Patch1456: 1456-net-mlx5-expose-ifc-bits-for-tph.patch -Patch1457: 1457-net-mlx5-add-support-for-device-steering-tag.patch -Patch1458: 1458-net-mlx5-fix-build-wframe-larger-than-warnings.patch -Patch1459: 1459-net-fix-typos.patch -Patch1460: 1460-net-mlx5e-clear-read-only-port-buffer-size-in-pbmc-before-up.patch -Patch1461: 1461-net-mlx5e-remove-skb-secpath-if-xfrm-state-is-not-found.patch -Patch1462: 1462-net-mlx5e-fix-potential-deadlock-by-deferring-rx-timeout-rec.patch -Patch1463: 1463-net-mlx5e-support-routed-networks-during-ipsec-macs-initiali.patch -Patch1464: 1464-net-mlx5e-expose-tis-via-devlink-tx-reporter-diagnose.patch -Patch1465: 1465-net-mlx5-correctly-set-gso-segs-when-lro-is-used.patch -Patch1466: 1466-net-mlx5-hws-fix-bad-parameter-in-cq-creation.patch -Patch1467: 1467-net-mlx5-hws-fix-simple-rules-rehash-error-flow.patch -Patch1468: 1468-net-mlx5-hws-fix-complex-rules-rehash-error-flow.patch -Patch1469: 1469-net-mlx5-hws-prevent-rehash-from-filling-up-the-queues.patch -Patch1470: 1470-net-mlx5-hws-don-t-rehash-on-every-kind-of-insertion-failure.patch -Patch1471: 1471-net-mlx5-hws-fix-table-creation-uid.patch -Patch1472: 1472-net-mlx5-ct-use-the-correct-counter-offset.patch -Patch1473: 1473-net-mlx5-base-ecvf-devlink-port-attrs-from-0.patch -Patch1474: 1474-net-mlx5-remove-default-qos-group-and-attach-vports-directly.patch -Patch1475: 1475-net-mlx5e-preserve-tc-bw-during-parent-changes.patch -Patch1476: 1476-net-mlx5-destroy-vport-qos-element-when-no-configuration-rem.patch -Patch1477: 1477-net-mlx5-fix-qos-reference-leak-in-vport-enable-error-path.patch -Patch1478: 1478-net-mlx5-restore-missing-scheduling-node-cleanup-on-vport-en.patch -Patch1479: 1479-net-mlx5e-query-fw-for-buffer-ownership.patch -Patch1480: 1480-net-mlx5e-preserve-shared-buffer-capacity-during-headroom-up.patch -Patch1481: 1481-net-mlx5-hws-fix-memory-leak-in-hws-pool-buddy-init-error-pa.patch -Patch1482: 1482-net-mlx5-hws-fix-memory-leak-in-hws-action-get-shared-stc-ni.patch -Patch1483: 1483-net-mlx5-hws-fix-uninitialized-variables-in-mlx5hws-pat-calc.patch -Patch1484: 1484-net-mlx5-hws-fix-pattern-destruction-in-mlx5hws-pat-get-patt.patch -Patch1485: 1485-net-mlx5-reload-auxiliary-drivers-on-fw-activate.patch -Patch1486: 1486-net-mlx5-fix-lockdep-assertion-on-sync-reset-unload-event.patch -Patch1487: 1487-net-mlx5-nack-sync-reset-when-sfs-are-present.patch -Patch1488: 1488-net-mlx5-prevent-flow-steering-mode-changes-in-switchdev-mod.patch -Patch1489: 1489-net-mlx5e-set-local-xoff-after-fw-update.patch -Patch1490: 1490-net-mlx5e-harden-uplink-netdev-access-against-device-unbind.patch -Patch1491: 1491-net-mlx5e-add-a-miss-level-for-ipsec-crypto-offload.patch -Patch1492: 1492-net-mlx5-hws-ignore-flow-level-for-multi-dest-table.patch -Patch1493: 1493-net-mlx5e-fix-missing-fec-rs-stats-for-rs-544-514-interleave.patch -Patch1494: 1494-rdma-mlx5-support-driver-apis-pre-destroy-cq-and-post-destro.patch -Patch1495: 1495-rdma-mlx5-add-multiple-priorities-support-to-rdma-transport-.patch -Patch1496: 1496-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-flow-creat.patch -Patch1497: 1497-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-anchor-cre.patch -Patch1498: 1498-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-devx-creat.patch -Patch1499: 1499-rdma-mlx5-align-mkc-page-size-capability-check-to-prm.patch -Patch1500: 1500-rdma-mlx5-optimize-dmabuf-mkey-page-size.patch -Patch1501: 1501-rdma-mlx5-remove-redundant-check-on-err-on-return-expression.patch -Patch1502: 1502-rdma-mlx5-fix-returned-type-from-mlx5r-umr-zap-mkey.patch -Patch1503: 1503-rdma-mlx5-fix-incorrect-mkey-masking.patch -Patch1504: 1504-rdma-mlx5-add-dmah-object-support.patch -Patch1505: 1505-rdma-mlx5-add-dmah-support-for-reg-user-mr-reg-user-dmabuf-m.patch -Patch1506: 1506-rdma-mlx5-refactor-optional-counters-steering-code.patch -Patch1507: 1507-ib-mlx5-fix-obj-type-mismatch-for-srq-event-subscriptions.patch -Patch1508: 1508-net-mlx5-don-t-use-pk-through-tracepoints.patch -Patch1509: 1509-net-mlx5-mlx5-ifc-add-hardware-definitions-needed-for-adjace.patch -Patch1510: 1510-net-mlx5-e-switch-cache-vport-vhca-id-on-first-cap-query.patch -Patch1511: 1511-net-mlx5-e-switch-set-query-hca-cap-via-vhca-id.patch -Patch1512: 1512-rdma-net-mlx5-export-mlx5-vport-get-vhca-id.patch -Patch1513: 1513-net-mlx5-query-to-see-if-host-pf-is-disabled.patch -Patch1514: 1514-net-mlx5-support-disabling-host-pfs.patch -Patch1515: 1515-net-mlx5e-set-default-burst-period-for-tx-and-rx-reporters.patch -Patch1516: 1516-eth-mlx5-remove-kconfig-co-dependency-with-vxlan.patch -Patch1517: 1517-net-mlx5-fs-convert-vport-acls-root-namespaces-to-xarray.patch -Patch1518: 1518-net-mlx5-e-switch-move-vport-acls-root-namespaces-creation-t.patch -Patch1519: 1519-net-mlx5-e-switch-add-support-for-adjacent-functions-vports-.patch -Patch1520: 1520-net-mlx5-e-switch-create-acls-root-namespace-for-adjacent-vp.patch -Patch1521: 1521-net-mlx5-e-switch-register-representors-for-adjacent-vports.patch -Patch1522: 1522-net-mlx5-e-switch-set-representor-attributes-for-adjacent-vf.patch -Patch1523: 1523-net-mlx5-dr-hws-use-the-cached-vhca-id-for-this-device.patch -Patch1524: 1524-net-mlx5-add-psp-capabilities-structures-and-bits.patch -Patch1525: 1525-net-mlx5-extract-mtctr-register-read-logic-into-helper-funct.patch -Patch1526: 1526-net-mlx5-support-getcyclesx-and-getcrosscycles.patch -Patch1527: 1527-net-mlx5-add-rs-fec-histogram-infrastructure.patch -Patch1528: 1528-net-mlx5-implement-cqe-compress-type-via-devlink-params.patch -Patch1529: 1529-net-mlx5-implement-devlink-enable-sriov-parameter.patch -Patch1530: 1530-net-mlx5-implement-devlink-total-vfs-parameter.patch -Patch1531: 1531-net-mlx5e-make-pcie-congestion-event-thresholds-configurable.patch -Patch1532: 1532-net-mlx5e-add-stale-counter-for-pcie-congestion-events.patch -Patch1533: 1533-net-mlx5-fix-typo-in-pci-irq-c-comment.patch -Patch1534: 1534-net-mlx5-refactor-devcom-to-use-match-attributes.patch -Patch1535: 1535-net-mlx5-lag-move-devcom-registration-to-lag-layer.patch -Patch1536: 1536-net-mlx5-add-net-namespace-support-to-devcom.patch -Patch1537: 1537-net-mlx5-lag-add-net-namespace-support.patch -Patch1538: 1538-net-mlx5-remove-vlan-insertion-fields-from-wqe-ether-segment.patch -Patch1539: 1539-net-mlx5-refactor-macsec-wqe-metadata-shifts.patch -Patch1540: 1540-net-mlx5e-prevent-wqe-metadata-conflicts-between-timestampin.patch -Patch1541: 1541-net-mlx5-fix-typo-of-mlx5-eq-doorbel-offset.patch -Patch1542: 1542-net-mlx5-remove-unused-offset-field-from-mlx5-sq-bfreg.patch -Patch1543: 1543-net-mlx5e-remove-unused-xsk-param-of-mlx5e-build-xdpsq-param.patch -Patch1544: 1544-net-mlx5-store-the-global-doorbell-in-mlx5-priv.patch -Patch1545: 1545-net-mlx5e-prepare-for-using-multiple-tx-doorbells.patch -Patch1546: 1546-net-mlx5e-prepare-for-using-different-cq-doorbells.patch -Patch1547: 1547-net-mlx5e-use-multiple-tx-doorbells.patch -Patch1548: 1548-net-mlx5e-use-multiple-cq-doorbells.patch -Patch1549: 1549-net-mlx5e-use-the-num-doorbells-devlink-param.patch -Patch1550: 1550-net-mlx5e-use-unsigned-for-mlx5e-get-max-num-channels.patch -Patch1551: 1551-net-mlx5-add-uar-access-and-odp-page-fault-counters.patch -Patch1552: 1552-net-mlx5-change-ttc-rules-to-match-on-undecrypted-esp-packet.patch -Patch1553: 1553-net-mlx5e-recirculate-decrypted-packets-into-ttc-table.patch -Patch1554: 1554-net-mlx5e-add-flow-groups-for-the-packets-decrypted-by-crypt.patch -Patch1555: 1555-net-mlx5e-add-flow-rules-for-the-decrypted-esp-packets.patch -Patch1556: 1556-net-mlx5-remove-dead-code-from-total-vfs-setter.patch -Patch1557: 1557-net-mlx5-use-pe-format-specifier-for-error-pointers.patch -Patch1558: 1558-net-mlx5-expose-uar-access-and-odp-page-fault-counters.patch -Patch1559: 1559-net-mlx5-add-ifc-bit-for-tir-sq-order-capability.patch -Patch1560: 1560-net-mlx5-ifc-add-balance-id-and-lag-per-mp-group-bits.patch -Patch1561: 1561-net-mlx5-stop-polling-for-command-response-if-interface-goes.patch -Patch1562: 1562-net-mlx5-pagealloc-fix-reclaim-race-during-command-interface.patch -Patch1563: 1563-net-mlx5-fw-reset-add-reset-timeout-work.patch -Patch1564: 1564-net-mlx5-improve-write-combining-test-reliability-for-arm64-.patch -Patch1565: 1565-net-mlx5-hws-generalize-complex-matchers.patch -Patch1566: 1566-net-mlx5e-prevent-entering-switchdev-mode-with-inconsistent-.patch -Patch1567: 1567-net-mlx5-improve-qos-error-messages-with-actual-depth-values.patch -Patch1568: 1568-net-mlx5e-remove-unused-mdev-param-from-rss-indir-init.patch -Patch1569: 1569-net-mlx5e-introduce-mlx5e-rss-init-params.patch -Patch1570: 1570-net-mlx5e-introduce-mlx5e-rss-params-for-rss-configuration.patch -Patch1571: 1571-net-mlx5e-use-extack-in-set-rxfh-callback.patch -Patch1572: 1572-net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-and-nic-i.patch -Patch1573: 1573-net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-not-allow.patch -Patch1574: 1574-net-mlx5-fix-pre-2-40-binutils-assembler-error.patch -Patch1575: 1575-net-mlx5e-return-1-instead-of-0-in-invalid-case-in-mlx5e-mpw.patch -Patch1576: 1576-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch -Patch1577: 1577-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch -Patch1578: 1578-net-mlx5-add-pphcr-to-pcam-supported-registers-mask.patch -Patch1579: 1579-net-mlx5-refactor-devcom-to-return-null-on-failure.patch -Patch1580: 1580-net-mlx5-fix-ipsec-cleanup-over-mpv-device.patch -Patch1581: 1581-net-mlx5-don-t-zero-user-count-when-destroying-fdb-tables.patch -Patch1582: 1582-net-mlx5e-fix-return-value-in-case-of-module-eeprom-read-err.patch -Patch1583: 1583-net-mlx5e-fix-missing-error-assignment-in-mlx5e-xfrm-add-sta.patch -Patch1584: 1584-net-mlx5e-trim-the-length-of-the-num-doorbell-error.patch -Patch1585: 1585-net-mlx5e-fix-maxrate-wraparound-in-threshold-between-units.patch -Patch1586: 1586-net-mlx5e-fix-wraparound-in-rate-limiting-for-values-above-2.patch -Patch1587: 1587-net-mlx5e-fix-potentially-misleading-debug-message.patch -Patch1588: 1588-mlx5-fix-default-values-in-create-cq.patch -Patch1589: 1589-net-mlx5-clean-up-only-new-irq-glue-on-request-irq-failure.patch -Patch1590: 1590-net-mlx5e-fix-validation-logic-in-rate-limiting.patch -Patch1591: 1591-rdma-mlx5-enable-data-direct-with-relaxed-ordering.patch -Patch1592: 1592-rdma-mlx5-better-estimate-max-qp-wr-to-reflect-wqe-count.patch -Patch1593: 1593-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch -Patch1594: 1594-rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-mode.patch -Patch1595: 1595-rdma-use-pe-format-specifier-for-error-pointers.patch -Patch1596: 1596-rdma-net-mlx5-query-vports-mac-address-from-device.patch -Patch1597: 1597-net-mlx5-use-common-mlx5-same-hw-devs-function.patch -Patch1598: 1598-net-mlx5-add-software-system-image-guid-infrastructure.patch -Patch1599: 1599-net-mlx5-refactor-ptp-clock-devcom-pairing.patch -Patch1600: 1600-net-mlx5-refactor-hca-cap-2-setting.patch -Patch1601: 1601-net-mlx5-add-balance-id-support-for-lag-multiplane-groups.patch -Patch1602: 1602-net-mlx5e-remove-redundant-tstamp-pointer-from-channel-struc.patch -Patch1603: 1603-net-mlx5e-remove-unnecessary-tstamp-local-variable-in-mlx5i-.patch -Patch1604: 1604-net-mlx5e-rename-hwstamp-functions-to-hwtstamp.patch -Patch1605: 1605-net-mlx5e-rename-timestamp-fields-to-hwtstamp-config.patch -Patch1606: 1606-net-mlx5e-convert-to-new-hwtstamp-get-set-interface.patch -Patch1607: 1607-net-mlx5e-enhance-function-structures-for-self-loopback-prev.patch -Patch1608: 1608-net-mlx5e-use-tir-api-in-mlx5e-modify-tirs-lb.patch -Patch1609: 1609-net-mlx5e-allow-setting-self-loopback-prevention-bits-on-tir.patch -Patch1610: 1610-net-mlx5-ipoib-set-self-loopback-prevention-in-tir-init.patch -Patch1611: 1611-net-mlx5e-do-not-re-apply-tir-loopback-configuration-if-not-.patch -Patch1612: 1612-net-mlx5e-pass-old-channels-as-argument-to-mlx5e-switch-priv.patch -Patch1613: 1613-net-mlx5e-defer-channels-closure-to-reduce-interface-down-ti.patch -Patch1614: 1614-pci-tph-expose-pcie-tph-get-st-table-loc.patch -Patch1615: 1615-net-mlx5-add-direct-st-mode-support-for-rdma.patch -Patch1616: 1616-net-mlx5-add-other-eswitch-hw-capabilities.patch -Patch1617: 1617-net-mlx5-fs-add-other-eswitch-support-for-steering-tables.patch -Patch1618: 1618-net-mlx5-fs-set-non-default-device-per-namespace.patch -Patch1619: 1619-net-mlx5-mpfs-add-support-for-dynamic-enable-disable.patch -Patch1620: 1620-net-mlx5-e-switch-support-eswitch-inactive-mode.patch -Patch1621: 1621-net-mlx5-expose-definition-for-1600gbps-link-mode.patch -Patch1622: 1622-mlx5-extract-grxrings-from-get-rxnfc.patch -Patch1623: 1623-net-mlx5-refactor-eeprom-query-error-handling-to-return-stat.patch -Patch1624: 1624-net-mlx5e-recover-sq-on-excessive-ptp-tx-timestamp-delta.patch -Patch1625: 1625-net-mlx5-remove-redundant-bw-share-minimal-value-assignment.patch -Patch1626: 1626-net-mlx5-abort-new-commands-if-all-command-slots-are-stalled.patch -Patch1627: 1627-net-mlx5-use-eopnotsupp-instead-of-enotsupp.patch -Patch1628: 1628-net-mlx5-initialize-events-outside-devlink-lock.patch -Patch1629: 1629-net-mlx5-move-the-esw-mode-notifier-chain-outside-the-devlin.patch -Patch1630: 1630-net-mlx5-move-the-vhca-event-notifier-outside-of-the-devlink.patch -Patch1631: 1631-net-mlx5-move-the-sf-hw-table-notifier-outside-the-devlink-l.patch -Patch1632: 1632-net-mlx5-move-the-sf-table-notifiers-outside-the-devlink-loc.patch -Patch1633: 1633-net-mlx5-move-sf-dev-table-notifier-registration-outside-the.patch -Patch1634: 1634-net-mlx5e-use-u64-instead-of-u64-in-ieee-setmaxrate.patch -Patch1635: 1635-net-mlx5e-rename-upper-limit-mbps-to-upper-limit-100mbps.patch -Patch1636: 1636-net-mlx5e-use-u8-max-instead-of-hard-coded-magic-number.patch -Patch1637: 1637-net-mlx5e-use-standard-unit-definitions-for-bandwidth-conver.patch -Patch1638: 1638-net-mlx5e-update-xdp-features-in-switch-channels.patch -Patch1639: 1639-net-mlx5e-support-xdp-target-xmit-with-dummy-program.patch -Patch1640: 1640-net-mlx5-make-enable-mpesw-idempotent.patch -Patch1641: 1641-net-mlx5-fix-double-unregister-of-hca-ports-component.patch -Patch1642: 1642-net-mlx5-fw-reset-clear-reset-requested-on-drain-fw-reset.patch -Patch1643: 1643-net-mlx5-drain-firmware-reset-in-shutdown-callback.patch -Patch1644: 1644-net-mlx5-fw-tracer-validate-format-string-parameters.patch -Patch1645: 1645-net-mlx5-fw-tracer-handle-escaped-percent-properly.patch -Patch1646: 1646-net-mlx5-serialize-firmware-reset-with-devlink.patch -Patch1647: 1647-net-mlx5e-use-ip6-dst-lookup-instead-of-ipv6-dst-lookup-flow.patch -Patch1648: 1648-net-mlx5e-trigger-neighbor-resolution-for-unresolved-destina.patch -Patch1649: 1649-net-mlx5e-do-not-update-bql-of-old-txqs-during-channel-recon.patch -Patch1650: 1650-net-mlx5-lag-multipath-give-priority-for-routes-with-smaller.patch -Patch1651: 1651-net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eepro.patch -Patch1652: 1652-net-mlx5e-don-t-print-error-message-due-to-invalid-module.patch -Patch1653: 1653-net-mlx5e-fix-crash-on-profile-change-rollback-failure.patch -Patch1654: 1654-net-mlx5e-don-t-store-mlx5e-priv-in-mlx5e-dev-devlink-priv.patch -Patch1655: 1655-net-mlx5e-pass-netdev-to-mlx5e-destroy-netdev-instead-of-pri.patch -Patch1656: 1656-net-mlx5e-restore-destroying-state-bit-after-profile-cleanup.patch -Patch1657: 1657-net-mlx5-fix-memory-leak-in-esw-acl-ingress-lgcy-setup.patch -Patch1658: 1658-net-mlx5-fix-unbinding-uplink-netdev-in-switchdev-mode.patch -Patch1659: 1659-net-mlx5e-tc-delete-flows-only-for-existing-peers.patch -Patch1660: 1660-net-mlx5e-account-for-netdev-stats-in-ndo-get-stats64.patch -Patch1661: 1661-net-mlx5-fix-return-type-mismatch-in-mlx5-esw-vport-vhca-id.patch -Patch1662: 1662-net-mlx5-fs-fix-inverted-cap-check-in-tx-flow-table-root-dis.patch -Patch1663: 1663-net-mlx5-fix-vhca-id-access-call-trace-use-before-alloc.patch -Patch1664: 1664-net-mlx5e-skip-esn-replay-window-setup-for-ipsec-crypto-offl.patch -Patch1665: 1665-rdma-mlx5-change-default-device-for-lag-slaves-in-rdma-trans.patch -Patch1666: 1666-rdma-mlx5-add-other-eswitch-support-for-devx-destruction.patch -Patch1667: 1667-rdma-mlx5-refactor-get-prio-function.patch -Patch1668: 1668-rdma-mlx5-add-other-eswitch-support-to-userspace-tables.patch -Patch1669: 1669-ib-mlx5-reduce-imr-ksm-size-when-5-level-paging-is-enabled.patch -Patch1670: 1670-net-mlx5e-shampo-fix-header-mapping-for-64k-pages.patch -Patch1671: 1671-net-mlx5e-shampo-fix-skb-size-check-for-64k-pages.patch -Patch1672: 1672-net-mlx5e-shampo-fix-header-formulas-for-higher-mtus-and-64k.patch -Patch1673: 1673-net-mlx5-qos-restrict-rtnl-area-to-avoid-a-lock-cycle.patch -Patch1674: 1674-net-mlx5-fix-peer-miss-rules-host-disabled-checks.patch -Patch1675: 1675-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-legacy-rq.patch -Patch1676: 1676-net-mlx5-fix-crash-when-moving-to-switchdev-mode.patch -Patch1677: 1677-net-mlx5-fix-hca-caps-leak-on-notifier-init-failure.patch -Patch1678: 1678-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-striding-rq.patch -Patch1679: 1679-iavf-fix-vlan-filter-lost-on-add-delete-race.patch -Patch1680: 1680-iavf-rename-iavf-vlan-is-new-to-iavf-vlan-adding.patch -Patch1681: 1681-iavf-stop-removing-vlan-filters-from-pf-on-interface-down.patch -Patch1682: 1682-iavf-wait-for-pf-confirmation-before-removing-vlan-filters.patch -Patch1683: 1683-iavf-add-virtchnl-op-add-vlan-to-success-completion-handler.patch -Patch1684: 1684-netfilter-skip-recording-stale-or-retransmitted-init.patch -Patch1685: 1685-sctp-discard-stale-init-after-handshake-completion.patch -Patch1686: 1686-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch -Patch1687: 1687-sched-fair-skip-sched-balance-running-cmpxchg-when-balance-i.patch -Patch1688: 1688-sched-fair-have-sd-serialize-affect-newidle-balancing.patch -Patch1689: 1689-powerpc-64-force-inlining-of-prevent-user-access-and-set-kua.patch -Patch1690: 1690-compiler-gcc-h-remove-ancient-workaround-for-gcc-pr-58670.patch -Patch1691: 1691-work-around-gcc-bugs-with-asm-goto-with-outputs.patch -Patch1692: 1692-init-kconfig-fix-cc-has-asm-goto-tied-output-test-with-dash.patch -Patch1693: 1693-update-workarounds-for-gcc-asm-goto-issue.patch -Patch1694: 1694-init-kconfig-remove-config-gcc-asm-goto-output-workaround.patch -Patch1695: 1695-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch -Patch1696: 1696-net-atm-fix-crash-due-to-unvalidated-vcc-pointer-in-sigd-sen.patch -Patch1697: 1697-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch -Patch1698: 1698-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch -Patch1699: 1699-crypto-tegra-remove-the-use-of-dev-err-probe.patch -Patch1700: 1700-crypto-tegra-use-int-type-to-store-negative-error-codes.patch -Patch1701: 1701-crypto-tegra-add-missing-crypto-alg-async.patch -Patch1702: 1702-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch -Patch1703: 1703-crypto-tegra-fix-dma-free-coherent-size-error.patch -Patch1704: 1704-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch -Patch1705: 1705-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch -Patch1706: 1706-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch -Patch1707: 1707-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch -Patch1708: 1708-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch -Patch1709: 1709-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch -Patch1713: 1713-nouveau-gsp-drop-warn-on-in-acpi-probes.patch -Patch1714: 1714-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sc.patch -Patch1715: 1715-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch -Patch1716: 1716-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch -Patch1717: 1717-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch -Patch1719: 1719-arm64-cputype-add-c1-pro-definitions.patch -Patch1720: 1720-arm64-cputype-add-c1-premium-definitions.patch -Patch1721: 1721-arm64-cputype-add-c1-ultra-definitions.patch -Patch1722: 1722-arm64-cputype-add-neoverse-v3ae-definitions.patch -Patch1723: 1723-arm64-errata-apply-workarounds-for-neoverse-v3ae.patch -Patch1724: 1724-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch -Patch1725: 1725-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch -Patch1726: 1726-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch -Patch1727: 1727-arm64-cputype-add-nvidia-olympus-definitions.patch -Patch1728: 1728-clean-up-documentation-mess-left-by-previous-backport.patch -Patch1729: 1729-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepat.patch -Patch1730: 1730-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch -Patch1731: 1731-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch -Patch1732: 1732-net-gro-don-t-merge-zcopy-skbs.patch -Patch1733: 1733-xfrm-defensively-unhash-xfrm-state-lists-in-xfrm-state-delet.patch -Patch1734: 1734-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch -Patch1735: 1735-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch -Patch1739: 1739-tg3-fix-race-for-querying-speed-duplex.patch -Patch1740: 1740-netfilter-bridge-make-ebt-snat-arp-rewrite-writable.patch -Patch1741: 1741-epoll-annotate-racy-check.patch -Patch1742: 1742-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch -Patch1743: 1743-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch -Patch1744: 1744-eventpoll-split-ep-remove.patch -Patch1745: 1745-eventpoll-kill-ep-remove.patch -Patch1746: 1746-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch -Patch1747: 1747-eventpoll-move-epi-fget-up.patch -Patch1748: 1748-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch -Patch1749: 1749-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch -Patch1750: 1750-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch -Patch1751: 1751-eventpoll-refresh-eventpoll-release-fast-path-comment.patch -Patch1752: 1752-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch -Patch1753: 1753-eventpoll-drop-vestigial-epi-dying-flag.patch -Patch1754: 1754-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch -Patch1755: 1755-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -Patch1758: 1758-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch -Patch1759: 1759-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch -Patch1760: 1760-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch -Patch1761: 1761-crypto-ccp-copy-iv-using-skcipher-ivsize.patch -Patch1762: 1762-net-fix-memory-leak-in-skb-segment-list-for-gro-packets.patch -Patch1763: 1763-kallsyms-clean-up-modname-and-modbuildid-initialization.patch -Patch1764: 1764-kallsyms-bpf-rename-bpf-address-lookup.patch -Patch1765: 1765-net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch -Patch1766: 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch -Patch1767: 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch -Patch1768: 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch -Patch1769: 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch -Patch1770: 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch # END OF PATCH DEFINITIONS %description @@ -2383,668 +1721,6 @@ ApplyPatch 0007-Bring-back-deprecated-pci-ids-to-be2iscsi-driver.patch ApplyPatch 0001-Make-KVM-PMU-symbols-global-for-ppc64le-module-build.patch ApplyPatch 0001-proc-fix-a-dentry-lock-race-between-release_task-and-lookup.patch -ApplyPatch 1100-rtnetlink-allocate-vfinfo-size-for-vf-guids-when-supported.patch -ApplyPatch 1101-net-sched-make-cake-enqueue-return-net-xmit-cn-when-past-buf.patch -ApplyPatch 1102-net-sched-sch-cake-fix-incorrect-qlen-reduction-in-cake-drop.patch -ApplyPatch 1103-ice-fix-page-leak-for-zero-size-rx-descriptors.patch -ApplyPatch 1104-net-hv-netvsc-reject-rss-hash-key-programming-without-rx-ind.patch -ApplyPatch 1105-rdma-bnxt-re-support-extended-stats-for-thor2-vf.patch -ApplyPatch 1106-rdma-bnxt-re-fix-size-of-uverbs-copy-to-in-bnxt-re-method-ge.patch -ApplyPatch 1107-rdma-bnxt-re-support-2g-message-size.patch -ApplyPatch 1108-rdma-bnxt-re-use-macro-instead-of-hard-coded-value.patch -ApplyPatch 1109-rdma-bnxt-re-congestion-control-settings-using-debugfs-hook.patch -ApplyPatch 1110-rdma-bnxt-re-fix-buffer-overflow-in-debugfs-code.patch -ApplyPatch 1111-rdma-bnxt-re-fix-the-condition-check-while-programming-conge.patch -ApplyPatch 1112-rdma-bnxt-re-fix-incorrect-display-of-inactivity-cp-in-debug.patch -ApplyPatch 1113-rdma-bnxt-re-fix-missing-error-handling-for-tx-queue.patch -ApplyPatch 1114-rdma-bnxt-re-fix-return-code-of-bnxt-re-configure-cc.patch -ApplyPatch 1115-rdma-bnxt-re-convert-timeouts-to-secs-to-jiffies.patch -ApplyPatch 1116-ionic-fix-persistent-mac-address-override-on-pf.patch -ApplyPatch 1117-smb-client-fix-krb5-mount-with-username-option.patch -ApplyPatch 1118-scsi-qla2xxx-fix-improper-freeing-of-purex-item.patch -ApplyPatch 1119-nfsd-fix-heap-overflow-in-nfsv4-0-lock-replay-cache.patch -ApplyPatch 1120-net-add-skb-header-pointer-careful-helper.patch -ApplyPatch 1121-net-sched-cls-u32-use-skb-header-pointer-careful.patch -ApplyPatch 1122-net-sched-only-allow-act-ct-to-bind-to-clsact-ingress-qdiscs.patch -ApplyPatch 1123-x86-boot-handle-relative-config-efi-sbat-file-file-paths.patch -ApplyPatch 1124-drm-i915-dsc-add-helper-to-enable-the-dsc-configuration-for-.patch -ApplyPatch 1125-drm-i915-dp-ensure-the-fec-state-stays-disabled-for-uhbr-lin.patch -ApplyPatch 1126-drm-i915-dp-export-helper-to-determine-if-fec-on-non-uhbr-li.patch -ApplyPatch 1127-drm-i915-dp-mst-reuse-the-dp-sst-helper-function-to-compute-.patch -ApplyPatch 1128-drm-i915-dp-mst-track-dsc-enabled-status-on-the-mst-link.patch -ApplyPatch 1129-drm-i915-dp-mst-recompute-all-mst-link-crtcs-if-dsc-gets-ena.patch -ApplyPatch 1130-drm-i915-dp-fix-panel-replay-when-dsc-is-enabled.patch -ApplyPatch 1131-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-12.patch -ApplyPatch 1132-revert-scsi-lpfc-add-capability-to-register-platform-name-id.patch -ApplyPatch 1133-revert-scsi-lpfc-allow-support-for-bb-credit-recovery-in-poi.patch -ApplyPatch 1134-revert-scsi-lpfc-modify-kref-handling-for-fabric-controller-.patch -ApplyPatch 1135-revert-scsi-lpfc-fix-leaked-ndlp-krefs-when-in-point-to-poin.patch -ApplyPatch 1136-revert-scsi-lpfc-ensure-unregistration-of-rpis-for-received-.patch -ApplyPatch 1137-revert-scsi-lpfc-remove-redundant-null-ptr-assignment-in-lpf.patch -ApplyPatch 1138-revert-scsi-lpfc-revise-discovery-related-function-headers-a.patch -ApplyPatch 1139-revert-scsi-lpfc-update-various-npiv-diagnostic-log-messagin.patch -ApplyPatch 1140-revert-scsi-lpfc-copyright-updates-for-14-4-0-11-patches.patch -ApplyPatch 1141-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-11.patch -ApplyPatch 1142-revert-scsi-lpfc-convert-debugfs-directory-counts-from-atomi.patch -ApplyPatch 1143-revert-scsi-lpfc-clean-up-extraneous-phba-dentries.patch -ApplyPatch 1144-revert-scsi-lpfc-use-switch-case-statements-in-dif-debugfs-h.patch -ApplyPatch 1145-revert-scsi-lpfc-fix-memory-leak-when-nvmeio-trc-debugfs-ent.patch -ApplyPatch 1146-revert-scsi-lpfc-define-size-of-debugfs-entry-for-xri-rebala.patch -ApplyPatch 1147-revert-scsi-lpfc-ensure-plogi-acc-is-sent-prior-to-prli-in-p.patch -ApplyPatch 1148-revert-scsi-lpfc-check-return-status-of-lpfc-reset-flush-io-.patch -ApplyPatch 1149-revert-scsi-lpfc-decrement-ndlp-kref-after-fdisc-retries-exh.patch -ApplyPatch 1150-revert-scsi-lpfc-remove-ndlp-kref-decrement-clause-for-f-por.patch -ApplyPatch 1151-revert-scsi-lpfc-clean-up-allocated-queues-when-queue-setup-.patch -ApplyPatch 1152-revert-scsi-lpfc-abort-outstanding-els-wqes-regardless-of-if.patch -ApplyPatch 1153-revert-scsi-lpfc-remove-unused-member-variables-in-struct-lp.patch -ApplyPatch 1154-revert-scsi-lpfc-use-int-type-to-store-negative-error-codes.patch -ApplyPatch 1155-revert-scsi-lpfc-use-min-to-improve-code.patch -ApplyPatch 1156-revert-scsi-lpfc-fix-wrong-function-reference-in-a-comment.patch -ApplyPatch 1157-revert-lpfc-don-t-use-file-f-path-dentry-for-comparisons.patch -ApplyPatch 1158-revert-scsi-lpfc-update-lpfc-version-to-14-4-0-10.patch -ApplyPatch 1159-revert-scsi-lpfc-copyright-updates-for-14-4-0-10-patches.patch -ApplyPatch 1160-revert-scsi-lpfc-modify-end-of-life-adapters-model-descripti.patch -ApplyPatch 1161-revert-scsi-lpfc-revise-cq-create-set-mailbox-bitfield-defin.patch -ApplyPatch 1162-revert-scsi-lpfc-move-clearing-of-hba-setup-flag-to-before-l.patch -ApplyPatch 1163-revert-scsi-lpfc-ensure-hba-setup-flag-is-used-only-for-sli4.patch -ApplyPatch 1164-revert-scsi-lpfc-relocate-clearing-initial-phba-flags-from-l.patch -ApplyPatch 1165-revert-scsi-lpfc-simplify-error-handling-for-failed-lpfc-get.patch -ApplyPatch 1166-revert-scsi-lpfc-early-return-out-of-fdmi-cmpl-for-locally-r.patch -ApplyPatch 1167-revert-scsi-lpfc-skip-rscn-processing-when-fc-unloading-flag.patch -ApplyPatch 1168-revert-scsi-lpfc-check-for-hdwq-null-ptr-when-cleaning-up-lp.patch -ApplyPatch 1169-revert-scsi-lpfc-update-debugfs-trace-ring-initialization-me.patch -ApplyPatch 1170-revert-scsi-lpfc-revise-logging-format-for-failed-ct-mib-req.patch -ApplyPatch 1171-scsi-lpfc-avoid-crashing-in-lpfc-nlp-get-if-nodelist-freed.patch -ApplyPatch 1172-libceph-make-decode-pool-more-resilient-against-corrupted-os.patch -ApplyPatch 1173-libceph-prevent-potential-out-of-bounds-reads-in-handle-auth.patch -ApplyPatch 1174-libceph-replace-overzealous-bug-on-in-osdmap-apply-increment.patch -ApplyPatch 1175-libceph-reset-sparse-read-state-in-osd-fault.patch -ApplyPatch 1176-powerpc-tools-drop-o-pipefail-in-gcc-check-scripts.patch -ApplyPatch 1177-kvm-x86-mmu-drop-zap-existing-present-spte-even-when-creatin.patch -ApplyPatch 1178-crypto-af-alg-fix-null-pointer-dereference-in-scatterwalk.patch -ApplyPatch 1179-crypto-algif-aead-revert-to-operating-out-of-place.patch -ApplyPatch 1180-crypto-af-alg-limit-rx-sg-extraction-by-receive-buffer-budge.patch -ApplyPatch 1181-crypto-af-alg-fix-page-reassignment-overflow-in-af-alg-pull-.patch -ApplyPatch 1182-crypto-authencesn-reject-too-short-aad-assoclen-8-to-match-e.patch -ApplyPatch 1183-crypto-authencesn-do-not-place-hiseq-at-end-of-dst-for-out-o.patch -ApplyPatch 1184-crypto-authencesn-fix-src-offset-when-decrypting-in-place.patch -ApplyPatch 1185-crypto-authencesn-reject-short-ahash-digests-during-instance.patch -ApplyPatch 1186-crypto-algif-aead-fix-minimum-rx-size-check-for-decryption.patch -ApplyPatch 1187-crypto-algif-aead-snapshot-iv-for-async-aead-requests.patch -ApplyPatch 1188-xfrm-esp-avoid-in-place-decrypt-on-shared-skb-frags.patch -ApplyPatch 1189-can-raw-fix-ro-uniq-use-after-free-in-raw-rcv.patch -ApplyPatch 1190-usbip-validate-number-of-packets-in-usbip-pack-ret-submit.patch -ApplyPatch 1191-rdma-umem-fix-double-dma-buf-unpin-in-failure-path.patch -ApplyPatch 1192-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch -ApplyPatch 1193-ptrace-slightly-saner-get-dumpable-logic.patch -ApplyPatch 1194-net-skbuff-preserve-shared-frag-marker-during-coalescing.patch -ApplyPatch 1195-net-move-skb-gro-receive-list-from-udp-to-core.patch -ApplyPatch 1196-net-skbuff-propagate-shared-frag-marker-through-frag-transfe.patch -ApplyPatch 1197-smb-client-reject-userspace-cifs.spnego-descriptions.patch -ApplyPatch 1198-netfilter-nf-tables-release-flowtable-after-rcu-grace-period.patch -ApplyPatch 1199-revert-mm-pcp-increase-pcp-free-count-threshold-to-trigger-f.patch -ApplyPatch 1200-ice-fix-missing-tx-timestamps-interrupts-on-e825-devices.patch -ApplyPatch 1201-ice-fix-ptp-timestamping-broken-by-synce-code-on-e825c.patch -ApplyPatch 1202-i2c-i801-revert-i2c-i801-replace-acpi-lock-with-i2c-bus-lock.patch -ApplyPatch 1203-ima-don-t-clear-ima-digsig-flag-when-setting-or-removing-non.patch -ApplyPatch 1204-crypto-asymmetric-keys-prevent-overflow-in-asymmetric-key-ge.patch -ApplyPatch 1205-netfilter-nf-conntrack-h323-check-for-zero-length-in-decodeq.patch -ApplyPatch 1206-iommu-sva-add-kernel-page-table-iotlb-flush-notification.patch -ApplyPatch 1207-x86-mm-flush-iommu-before-freeing-kernel-page-table-pages.patch -ApplyPatch 1208-nbd-defer-config-unlock-in-nbd-genl-connect.patch -ApplyPatch 1209-drm-mgag200-fix-mgag200-bmc-stop-scanout.patch -ApplyPatch 1210-ice-fix-timestamp-interrupt-configuration-for-e825c.patch -ApplyPatch 1211-ice-perform-phy-soft-reset-for-e825c-ports-at-initialization.patch -ApplyPatch 1212-ice-fix-ready-bitmap-check-for-non-e822-devices.patch -ApplyPatch 1213-ice-fix-ice-ptp-read-tx-hwtstamp-status-eth56g.patch -ApplyPatch 1214-cifs-make-default-value-of-retrans-as-zero.patch -ApplyPatch 1215-net-sched-act-csum-validate-nested-vlan-headers.patch -ApplyPatch 1216-netfilter-ip6t-eui64-reject-invalid-mac-header-for-all-packe.patch -ApplyPatch 1217-scsi-storvsc-handle-persistent-reserve-in-truncation-for-hyp.patch -ApplyPatch 1218-dpll-zl3073x-add-output-pin-frequency-helper.patch -ApplyPatch 1219-dpll-zl3073x-include-current-frequency-in-supported-frequenc.patch -ApplyPatch 1220-dpll-zl3073x-fix-ref-frequency-setting.patch -ApplyPatch 1221-dpll-zl3073x-fix-ref-phase-offset-comp-register-width-for-so.patch -ApplyPatch 1222-dpll-zl3073x-remove-redundant-cleanup-in-devm-dpll-init.patch -ApplyPatch 1223-ice-fix-null-pointer-dereference-in-ice-reset-all-vfs.patch -ApplyPatch 1224-ice-fix-missing-sma-pin-initialization-in-dpll-subsystem.patch -ApplyPatch 1225-ice-fix-sma-and-u-fl-pin-state-changes-affecting-paired-pin.patch -ApplyPatch 1226-dpll-export-dpll-pin-change-ntf-for-use-under-dpll-lock.patch -ApplyPatch 1227-ice-fix-missing-dpll-notifications-for-sw-pins.patch -ApplyPatch 1228-ice-add-dpll-peer-notification-for-paired-sma-and-u-fl-pins.patch -ApplyPatch 1229-s390-pci-avoid-deadlock-between-pci-error-recovery-and-mlx5-.patch -ApplyPatch 1230-netfilter-nf-conntrack-helper-pass-helper-to-expect-cleanup.patch -ApplyPatch 1231-hid-wacom-fix-out-of-bounds-read-in-wacom-intuos-bt-irq.patch -ApplyPatch 1232-redhat-configs-enable-config-sclp-ofb-for-s390x.patch -ApplyPatch 1233-xfs-delete-attr-leaf-freemap-entries-when-empty.patch -ApplyPatch 1234-xfs-fix-freemap-adjustments-when-adding-xattrs-to-leaf-block.patch -ApplyPatch 1235-bluetooth-sco-fix-use-after-free-in-sco-recv-frame-due-to-mi.patch -ApplyPatch 1236-smb-client-validate-the-whole-dacl-before-rewriting-it-in-ci.patch -ApplyPatch 1237-smb-client-require-a-full-nfs-mode-sid-before-reading-mode-b.patch -ApplyPatch 1238-smb-client-scope-end-of-dacl-to-cifs-debug2-use-in-parse-dac.patch -ApplyPatch 1239-smb-client-use-kzalloc-to-zero-initialize-security-descripto.patch -ApplyPatch 1240-smb-client-validate-dacloffset-before-building-dacl-pointers.patch -ApplyPatch 1241-ice-fix-infinite-recursion-in-ice-cfg-tx-topo-via-ice-init-d.patch -ApplyPatch 1242-mm-page-alloc-clear-page-private-in-free-pages-prepare.patch -ApplyPatch 1243-pnfs-fix-a-missing-wake-up-while-waiting-on-nfs-layout-drain.patch -ApplyPatch 1244-proc-use-the-same-treatment-to-check-proc-lseek-as-ones-for-.patch -ApplyPatch 1245-proc-fix-missing-pde-set-flags-for-net-proc-files.patch -ApplyPatch 1246-proc-fix-type-confusion-in-pde-set-flags.patch -ApplyPatch 1247-crypto-tegra-disable-softirqs-before-finalizing-request.patch -ApplyPatch 1248-bluetooth-mgmt-validate-ltk-enc-size-on-load.patch -ApplyPatch 1249-bluetooth-sco-fix-race-conditions-in-sco-sock-connect.patch -ApplyPatch 1250-wifi-brcmfmac-validate-bsscfg-indices-in-if-events.patch -ApplyPatch 1251-netfilter-xt-tcpmss-check-remaining-length-before-reading-op.patch -ApplyPatch 1252-dm-thin-fix-metadata-refcount-underflow.patch -ApplyPatch 1253-mm-document-gfp-nofail-must-be-blockable.patch -ApplyPatch 1254-mm-warn-about-illegal-gfp-nofail-usage-in-a-more-appropriate.patch -ApplyPatch 1255-mm-page-alloc-c-avoid-infinite-retries-caused-by-cpuset-race.patch -ApplyPatch 1256-mm-page-alloc-thp-prevent-reclaim-for-gfp-thisnode-thp-alloc.patch -ApplyPatch 1257-mm-page-alloc-ignore-the-exact-initial-compaction-result.patch -ApplyPatch 1258-mm-page-alloc-refactor-the-initial-compaction-handling.patch -ApplyPatch 1259-mm-page-alloc-simplify-alloc-pages-slowpath-flow.patch -ApplyPatch 1260-mm-page-alloc-add-vm-thp-thisnode-reclaim-sysctl-to-allow-th.patch -ApplyPatch 1261-smb-client-fix-oob-reads-parsing-symlink-error-response.patch -ApplyPatch 1262-crypto-authenc-fix-sleep-in-atomic-context-in-decrypt-tail.patch -ApplyPatch 1263-crypto-authenc-correctly-pass-einprogress-back-up-to-the-cal.patch -ApplyPatch 1264-buffer-overflow-in-drivers-xen-sys-hypervisor-c.patch -ApplyPatch 1265-nvme-nvme-fc-move-tagset-removal-to-nvme-fc-delete-ctrl.patch -ApplyPatch 1266-nvme-nvme-fc-ensure-ioerr-work-is-cancelled-in-nvme-fc-delet.patch -ApplyPatch 1267-s390-dasd-fix-gendisk-parent-after-copy-pair-swap.patch -ApplyPatch 1268-s390-dasd-move-quiesce-state-with-pprc-swap.patch -ApplyPatch 1269-s390-dasd-copy-detected-format-information-to-secondary-devi.patch -ApplyPatch 1270-x86-kvm-avoid-freeing-stack-allocated-node-in-kvm-async-pf-q.patch -ApplyPatch 1271-net-bonding-fix-use-after-free-in-bond-xmit-broadcast.patch -ApplyPatch 1272-scsi-target-iscsi-fix-use-after-free-in-iscsit-dec-conn-usag.patch -ApplyPatch 1273-net-mana-fix-use-after-free-in-add-adev-error-path.patch -ApplyPatch 1274-alsa-6fire-fix-use-after-free-on-disconnect.patch -ApplyPatch 1275-dlm-validate-length-in-dlm-search-rsb-tree.patch -ApplyPatch 1276-dlm-fix-buffer-overflow-from-negative-len-in-dlm-search-rsb-.patch -ApplyPatch 1277-netfilter-ctnetlink-ensure-safe-access-to-master-conntrack.patch -ApplyPatch 1278-rdma-rxe-fix-double-free-in-rxe-srq-from-init.patch -ApplyPatch 1279-net-openvswitch-avoid-releasing-netdev-before-teardown-compl.patch -ApplyPatch 1280-ip6-tunnel-clear-skb2-cb-in-ip4ip6-err.patch -ApplyPatch 1281-ipv6-rpl-headroom.patch -ApplyPatch 1282-rdma-mlx4-srq.patch -ApplyPatch 1283-dpll-series-RHEL.patch -ApplyPatch 1284-ice-rss-queues-RHEL.patch -ApplyPatch 1285-xen-privcmd-fix-double-free-via-vma-splitting.patch -ApplyPatch 1286-bluetooth-hci-sync-fix-stack-buffer-overflow-in-hci-le-big-c.patch -ApplyPatch 1287-can-isotp-fix-tx-buf-use-after-free-in-isotp-sendmsg.patch -ApplyPatch 1288-dpll-add-pin-operational-state.patch -ApplyPatch 1289-dpll-zl3073x-implement-pin-operational-state-reporting.patch -ApplyPatch 1290-dpll-add-fractional-frequency-offset-to-pin-parent-device.patch -ApplyPatch 1291-dpll-zl3073x-report-ffo-as-dpll-vs-input-reference-offset.patch -ApplyPatch 1292-mptcp-fix-slab-use-after-free-in-inet-lookup-established.patch -ApplyPatch 1293-ice-fix-null-pointer-dereference-in-ice-vsi-set-napi-queues.patch -ApplyPatch 1294-bluetooth-hci-event-fix-potential-uaf-in-ssp-passkey-handler.patch -ApplyPatch 1295-wifi-mac80211-use-safe-list-iteration-in-radar-detect-work.patch -ApplyPatch 1296-wifi-mac80211-drop-stray-static-from-fast-rx-rx-result.patch -ApplyPatch 1297-rdma-mana-validate-rx-hash-key-len.patch -ApplyPatch 1298-wifi-mac80211-remove-station-if-connection-prep-fails.patch -ApplyPatch 1299-bnxt-en-fix-rss-context-delete-logic.patch -ApplyPatch 1300-gfs2-add-metapath-dibh-helper.patch -ApplyPatch 1301-gfs2-fix-use-after-free-in-iomap-inline-data-write-path.patch -ApplyPatch 1302-s390-ap-expose-ap-bindings-complete-count-counter-via-sysfs.patch -ApplyPatch 1303-ibmveth-disable-gso-for-packets-with-small-mss.patch -ApplyPatch 1304-s390-mm-add-missing-secure-storage-access-fixups-for-donated.patch -ApplyPatch 1305-alsa-usb-audio-add-sanity-check-for-oob-writes-at-silencing.patch -ApplyPatch 1306-exit-prevent-preemption-of-oopsing-task-dead-task.patch -ApplyPatch 1307-rdma-mana-remove-user-triggerable-warn-on-in-mana-ib-create-.patch -ApplyPatch 1308-nvmet-tcp-fix-race-between-icreq-handling-and-queue-teardown.patch -ApplyPatch 1309-scsi-qla2xxx-completely-fix-fcport-double-free.patch -ApplyPatch 1310-rbd-eliminate-a-race-in-lock-dwork-draining-on-unmap.patch -ApplyPatch 1311-net-sched-fix-pedit-partial-cow-leading-to-page-cache-corrup.patch -ApplyPatch 1312-kvm-arm64-vgic-its-drop-translation-cache-ref-only-for-eras.patch -ApplyPatch 1313-netfilter-flowtable-strictly-check-for-maximum-number-of-act.patch -ApplyPatch 1314-drm-amd-display-do-not-skip-unrelated-mode-changes-in-dsc-va.patch -ApplyPatch 1315-ipv6-icmp-clear-skb2-cb-in-ip6-err-gen-icmpv6-unreach.patch -ApplyPatch 1316-alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch -ApplyPatch 1317-rdma-iwcm-fix-workqueue-list-corruption-by-removing-work-lis.patch -ApplyPatch 1318-binder-use-cred-instead-of-task-for-selinux-checks.patch -ApplyPatch 1319-locks-fix-toctou-race-when-granting-write-lease.patch -ApplyPatch 1320-fs-use-a-helper-for-opening-kernel-internal-files.patch -ApplyPatch 1321-fs-move-kmem-cache-zalloc-into-alloc-empty-file-helpers.patch -ApplyPatch 1322-fs-use-backing-file-container-for-internal-files-with-fake-f.patch -ApplyPatch 1323-ovl-enable-fsnotify-events-on-underlying-real-files.patch -ApplyPatch 1324-fs-move-cleanup-from-init-file-into-its-callers.patch -ApplyPatch 1325-lsm-constify-the-file-parameter-in-security-binder-transfer-.patch -ApplyPatch 1326-cachefiles-use-kiocb-start-end-write-helpers.patch -ApplyPatch 1327-fs-fix-kernel-doc-warnings.patch -ApplyPatch 1328-fs-rename-mnt-want-drop-write-helpers.patch -ApplyPatch 1329-fs-get-mnt-writers-count-for-an-open-backing-file-s-real-pat.patch -ApplyPatch 1330-fs-create-helper-file-user-path-for-user-displayed-mapped-fi.patch -ApplyPatch 1331-fs-store-real-path-instead-of-fake-path-in-backing-file-f-pa.patch -ApplyPatch 1332-fs-prepare-for-stackable-filesystems-backing-file-helpers.patch -ApplyPatch 1333-fs-factor-out-backing-file-read-write-iter-helpers.patch -ApplyPatch 1334-fs-factor-out-backing-file-splice-read-write-helpers.patch -ApplyPatch 1335-fs-factor-out-backing-file-mmap-helper.patch -ApplyPatch 1336-lsm-add-helper-for-blob-allocations.patch -ApplyPatch 1337-ovl-fix-nested-backing-file-paths.patch -ApplyPatch 1338-fs-constify-file-ptr-in-backing-file-accessor-helpers.patch -ApplyPatch 1339-ovl-remove-unneeded-non-const-conversion.patch -ApplyPatch 1340-ovl-remove-redundant-iocb-dio-caller-comp-clearing.patch -ApplyPatch 1341-perf-core-fix-mmap-event-path-names-with-backing-files.patch -ApplyPatch 1342-fs-prepare-for-adding-lsm-blob-to-backing-file.patch -ApplyPatch 1343-lsm-add-backing-file-lsm-hooks.patch -ApplyPatch 1344-selinux-fix-overlayfs-mmap-and-mprotect-access-checks.patch -ApplyPatch 1345-selinux-rhel-only-hotfix-for-execmem-regression.patch -ApplyPatch 1346-net-mlx5-hws-fix-matcher-action-template-attach.patch -ApplyPatch 1347-net-mlx5-hws-remove-unused-element-array.patch -ApplyPatch 1348-net-mlx5-hws-make-pool-single-resource.patch -ApplyPatch 1349-net-mlx5-hws-refactor-pool-implementation.patch -ApplyPatch 1350-net-mlx5-hws-cleanup-after-pool-refactoring.patch -ApplyPatch 1351-net-mlx5-hws-add-fullness-tracking-to-pool.patch -ApplyPatch 1352-net-mlx5-hws-fix-pool-size-optimization.patch -ApplyPatch 1353-net-mlx5-hws-implement-action-ste-pool.patch -ApplyPatch 1354-net-mlx5-hws-use-the-new-action-ste-pool.patch -ApplyPatch 1355-net-mlx5-hws-cleanup-matcher-action-ste-table.patch -ApplyPatch 1356-net-mlx5-hws-free-unused-action-ste-tables.patch -ApplyPatch 1357-net-mlx5-hws-export-action-ste-tables-to-debugfs.patch -ApplyPatch 1358-net-mlx5e-ethtool-fix-formatting-of-ptp-rq0-csum-complete-ta.patch -ApplyPatch 1359-net-mlx5-fix-spelling-mistakes-in-mlx5-core-dbg-message-and-.patch -ApplyPatch 1360-net-mlx5-hws-fix-ip-version-decision.patch -ApplyPatch 1361-net-mlx5-hws-harden-ip-version-definer-checks.patch -ApplyPatch 1362-net-mlx5-hws-disallow-matcher-ip-version-mixing.patch -ApplyPatch 1363-rdma-mlx5-fix-error-flow-upon-firmware-failure-for-rq-destru.patch -ApplyPatch 1364-net-mlx5-support-software-tx-timestamp.patch -ApplyPatch 1365-net-mlx5-hws-expose-function-mlx5hws-table-ft-set-next-ft-in.patch -ApplyPatch 1366-net-mlx5-hws-add-definer-function-to-get-field-name-str.patch -ApplyPatch 1367-net-mlx5-hws-expose-polling-function-in-header-file.patch -ApplyPatch 1368-net-mlx5-hws-introduce-isolated-matchers.patch -ApplyPatch 1369-net-mlx5-hws-support-complex-matchers.patch -ApplyPatch 1370-net-mlx5-hws-force-rehash-when-rule-insertion-failed.patch -ApplyPatch 1371-net-mlx5-hws-fix-counting-of-rules-in-the-matcher.patch -ApplyPatch 1372-net-mlx5-hws-fix-redundant-extension-of-action-templates.patch -ApplyPatch 1373-net-mlx5-hws-rework-rehash-loop.patch -ApplyPatch 1374-net-mlx5-hws-dump-bad-completion-details.patch -ApplyPatch 1375-net-mlx5-use-to-delayed-work.patch -ApplyPatch 1376-net-mlx5-sws-fix-reformat-id-error-handling.patch -ApplyPatch 1377-net-mlx5-hws-register-reformat-actions-with-fw.patch -ApplyPatch 1378-net-mlx5-hws-fix-typo-nope-to-nop.patch -ApplyPatch 1379-net-mlx5-hws-handle-modify-header-actions-dependency.patch -ApplyPatch 1380-net-mlx5-core-add-error-handling-inmlx5-query-nic-vport-qkey.patch -ApplyPatch 1381-net-mlx5e-allow-setting-mac-address-of-representors.patch -ApplyPatch 1382-net-mlx5-add-error-handling-in-mlx5-query-nic-vport-node-gui.patch -ApplyPatch 1383-net-mlx5-hws-fix-an-error-code-in-mlx5hws-bwc-rule-create-co.patch -ApplyPatch 1384-net-mlx5-ensure-fw-pages-are-always-allocated-on-same-numa.patch -ApplyPatch 1385-net-mlx5-fix-return-value-when-searching-for-existing-flow-g.patch -ApplyPatch 1386-net-mlx5-hws-init-mutex-on-the-correct-path.patch -ApplyPatch 1387-net-mlx5-hws-fix-missing-ip-version-handling-in-definer.patch -ApplyPatch 1388-net-mlx5-hws-make-sure-the-uplink-is-the-last-destination.patch -ApplyPatch 1389-net-mlx5e-fix-leak-of-geneve-tlv-option-object.patch -ApplyPatch 1390-net-mlx5-hws-add-error-checking-to-hws-bwc-rule-complex-hash.patch -ApplyPatch 1391-net-mlx5e-fix-race-between-dim-disable-and-net-dim.patch -ApplyPatch 1392-net-mlx5e-add-new-prio-for-promiscuous-mode.patch -ApplyPatch 1393-net-mlx5-correctly-set-gso-size-when-lro-is-used.patch -ApplyPatch 1394-net-mlx5-fix-memory-leak-in-cmd-exec.patch -ApplyPatch 1395-net-mlx5-e-switch-fix-peer-miss-rules-to-use-peer-eswitch.patch -ApplyPatch 1396-rdma-mlx5-convert-timeouts-to-secs-to-jiffies.patch -ApplyPatch 1397-rdma-mlx5-remove-the-redundant-mlx5-ib-stage-uar-stage.patch -ApplyPatch 1398-rdma-mlx5-add-support-for-200gbps-per-lane-speeds.patch -ApplyPatch 1399-rdma-mlx5-avoid-flexible-array-warning.patch -ApplyPatch 1400-rdma-mlx5-initialize-obj-event-obj-sub-list-before-xa-insert.patch -ApplyPatch 1401-rdma-mlx5-fix-hw-counters-query-for-non-representor-devices.patch -ApplyPatch 1402-rdma-mlx5-fix-cc-counters-query-for-mpv.patch -ApplyPatch 1403-rdma-mlx5-fix-vport-loopback-for-mpv-device.patch -ApplyPatch 1404-net-mlx5-expose-serial-numbers-in-devlink-info.patch -ApplyPatch 1405-net-mlx5e-shampo-reorganize-mlx5-rq-shampo-alloc.patch -ApplyPatch 1406-net-mlx5e-shampo-remove-redundant-params.patch -ApplyPatch 1407-net-mlx5e-shampo-improve-hw-gro-capability-checking.patch -ApplyPatch 1408-net-mlx5e-shampo-separate-pool-for-headers.patch -ApplyPatch 1409-net-mlx5e-implement-queue-mgmt-ops-and-single-channel-swap.patch -ApplyPatch 1410-net-mlx5e-support-ethtool-tcp-data-split-settings.patch -ApplyPatch 1411-net-mlx5-fs-add-multiple-prios-to-rdma-transport-steering-do.patch -ApplyPatch 1412-net-mlx5-small-refactor-for-general-object-capabilities.patch -ApplyPatch 1413-net-mlx5-add-ifc-bits-for-pcie-congestion-event-object.patch -ApplyPatch 1414-rdma-mlx5-allocate-ib-device-with-net-namespace-supplied-fro.patch -ApplyPatch 1415-net-mlx5e-fix-error-handling-in-rq-memory-model-registration.patch -ApplyPatch 1416-net-mlx5-fs-fix-rdma-transport-init-cleanup-flow.patch -ApplyPatch 1417-net-mlx5-check-device-memory-pointer-before-usage.patch -ApplyPatch 1418-net-mlx5-add-no-op-implementation-for-setting-tc-bw-on-rate-.patch -ApplyPatch 1419-net-mlx5-add-support-for-setting-tc-bw-on-nodes.patch -ApplyPatch 1420-net-mlx5-add-traffic-class-scheduling-support-for-vport-qos.patch -ApplyPatch 1421-net-mlx5-manage-tc-arbiter-nodes-and-implement-full-support-.patch -ApplyPatch 1422-net-mlx5-hws-remove-unused-create-dest-array-parameter.patch -ApplyPatch 1423-net-mlx5-hws-remove-incorrect-comment.patch -ApplyPatch 1424-net-mlx5-hws-export-rule-skip-logic.patch -ApplyPatch 1425-net-mlx5-hws-refactor-rule-skip-logic.patch -ApplyPatch 1426-net-mlx5-hws-create-stes-directly-from-matcher.patch -ApplyPatch 1427-net-mlx5-hws-decouple-matcher-rx-and-tx-sizes.patch -ApplyPatch 1428-net-mlx5-hws-track-matcher-sizes-individually.patch -ApplyPatch 1429-net-mlx5-hws-rearrange-to-prevent-forward-declaration.patch -ApplyPatch 1430-net-mlx5-hws-shrink-empty-matchers.patch -ApplyPatch 1431-net-mlx5-add-hws-as-secondary-steering-mode.patch -ApplyPatch 1432-net-mlx5-fix-spelling-mistake-disabliing-disabling.patch -ApplyPatch 1433-eth-mlx5-migrate-to-the-rxfh-context-ops.patch -ApplyPatch 1434-net-mlx5e-remove-unused-vlan-insertion-logic-in-tx-path.patch -ApplyPatch 1435-net-mlx5e-ct-extract-a-memcmp-from-a-spinlock-section.patch -ApplyPatch 1436-net-mlx5e-replace-recursive-vlan-push-handling-with-an-itera.patch -ApplyPatch 1437-net-mlx5-warn-when-write-combining-is-not-supported.patch -ApplyPatch 1438-net-mlx5e-rx-remove-unnecessary-rqt-redirects.patch -ApplyPatch 1439-net-mlx5-expose-hca-capability-bits-for-mkey-max-page-size.patch -ApplyPatch 1440-rdma-mlx5-fix-umr-modifying-of-mkey-page-size.patch -ApplyPatch 1441-net-mlx5-expose-disciplined-fr-counter-through-hca-capabilit.patch -ApplyPatch 1442-net-mlx5-ifc-updates-for-disabled-host-pf.patch -ApplyPatch 1443-net-mlx5e-create-destroy-pcie-congestion-event-object.patch -ApplyPatch 1444-net-mlx5e-add-device-pcie-congestion-ethtool-stats.patch -ApplyPatch 1445-net-mlx5-fix-an-is-err-vs-null-bug-in-esw-qos-move-node.patch -ApplyPatch 1446-net-mlx5-hws-enable-ipsec-hardware-offload-in-legacy-mode.patch -ApplyPatch 1447-net-mlx5e-fix-kdoc-warning-on-eswitch-h.patch -ApplyPatch 1448-net-mlx5e-properly-access-rcu-protected-qdisc-sleeping-varia.patch -ApplyPatch 1449-net-mlx5-add-ifc-bits-to-support-rss-for-ipsec-offload.patch -ApplyPatch 1450-net-mlx5-add-ifc-bits-and-enums-for-buf-ownership.patch -ApplyPatch 1451-net-mlx5-expose-cable-length-field-in-pfcc-register.patch -ApplyPatch 1452-net-mlx5e-shampo-cleanup-reservation-size-formula.patch -ApplyPatch 1453-net-mlx5e-shampo-remove-mlx5e-shampo-get-log-hd-entry-size.patch -ApplyPatch 1454-net-mlx5e-remove-duplicate-mkey-from-shampo-header.patch -ApplyPatch 1455-pci-tph-expose-pcie-tph-get-st-table-size.patch -ApplyPatch 1456-net-mlx5-expose-ifc-bits-for-tph.patch -ApplyPatch 1457-net-mlx5-add-support-for-device-steering-tag.patch -ApplyPatch 1458-net-mlx5-fix-build-wframe-larger-than-warnings.patch -ApplyPatch 1459-net-fix-typos.patch -ApplyPatch 1460-net-mlx5e-clear-read-only-port-buffer-size-in-pbmc-before-up.patch -ApplyPatch 1461-net-mlx5e-remove-skb-secpath-if-xfrm-state-is-not-found.patch -ApplyPatch 1462-net-mlx5e-fix-potential-deadlock-by-deferring-rx-timeout-rec.patch -ApplyPatch 1463-net-mlx5e-support-routed-networks-during-ipsec-macs-initiali.patch -ApplyPatch 1464-net-mlx5e-expose-tis-via-devlink-tx-reporter-diagnose.patch -ApplyPatch 1465-net-mlx5-correctly-set-gso-segs-when-lro-is-used.patch -ApplyPatch 1466-net-mlx5-hws-fix-bad-parameter-in-cq-creation.patch -ApplyPatch 1467-net-mlx5-hws-fix-simple-rules-rehash-error-flow.patch -ApplyPatch 1468-net-mlx5-hws-fix-complex-rules-rehash-error-flow.patch -ApplyPatch 1469-net-mlx5-hws-prevent-rehash-from-filling-up-the-queues.patch -ApplyPatch 1470-net-mlx5-hws-don-t-rehash-on-every-kind-of-insertion-failure.patch -ApplyPatch 1471-net-mlx5-hws-fix-table-creation-uid.patch -ApplyPatch 1472-net-mlx5-ct-use-the-correct-counter-offset.patch -ApplyPatch 1473-net-mlx5-base-ecvf-devlink-port-attrs-from-0.patch -ApplyPatch 1474-net-mlx5-remove-default-qos-group-and-attach-vports-directly.patch -ApplyPatch 1475-net-mlx5e-preserve-tc-bw-during-parent-changes.patch -ApplyPatch 1476-net-mlx5-destroy-vport-qos-element-when-no-configuration-rem.patch -ApplyPatch 1477-net-mlx5-fix-qos-reference-leak-in-vport-enable-error-path.patch -ApplyPatch 1478-net-mlx5-restore-missing-scheduling-node-cleanup-on-vport-en.patch -ApplyPatch 1479-net-mlx5e-query-fw-for-buffer-ownership.patch -ApplyPatch 1480-net-mlx5e-preserve-shared-buffer-capacity-during-headroom-up.patch -ApplyPatch 1481-net-mlx5-hws-fix-memory-leak-in-hws-pool-buddy-init-error-pa.patch -ApplyPatch 1482-net-mlx5-hws-fix-memory-leak-in-hws-action-get-shared-stc-ni.patch -ApplyPatch 1483-net-mlx5-hws-fix-uninitialized-variables-in-mlx5hws-pat-calc.patch -ApplyPatch 1484-net-mlx5-hws-fix-pattern-destruction-in-mlx5hws-pat-get-patt.patch -ApplyPatch 1485-net-mlx5-reload-auxiliary-drivers-on-fw-activate.patch -ApplyPatch 1486-net-mlx5-fix-lockdep-assertion-on-sync-reset-unload-event.patch -ApplyPatch 1487-net-mlx5-nack-sync-reset-when-sfs-are-present.patch -ApplyPatch 1488-net-mlx5-prevent-flow-steering-mode-changes-in-switchdev-mod.patch -ApplyPatch 1489-net-mlx5e-set-local-xoff-after-fw-update.patch -ApplyPatch 1490-net-mlx5e-harden-uplink-netdev-access-against-device-unbind.patch -ApplyPatch 1491-net-mlx5e-add-a-miss-level-for-ipsec-crypto-offload.patch -ApplyPatch 1492-net-mlx5-hws-ignore-flow-level-for-multi-dest-table.patch -ApplyPatch 1493-net-mlx5e-fix-missing-fec-rs-stats-for-rs-544-514-interleave.patch -ApplyPatch 1494-rdma-mlx5-support-driver-apis-pre-destroy-cq-and-post-destro.patch -ApplyPatch 1495-rdma-mlx5-add-multiple-priorities-support-to-rdma-transport-.patch -ApplyPatch 1496-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-flow-creat.patch -ApplyPatch 1497-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-anchor-cre.patch -ApplyPatch 1498-rdma-mlx5-check-cap-net-raw-in-user-namespace-for-devx-creat.patch -ApplyPatch 1499-rdma-mlx5-align-mkc-page-size-capability-check-to-prm.patch -ApplyPatch 1500-rdma-mlx5-optimize-dmabuf-mkey-page-size.patch -ApplyPatch 1501-rdma-mlx5-remove-redundant-check-on-err-on-return-expression.patch -ApplyPatch 1502-rdma-mlx5-fix-returned-type-from-mlx5r-umr-zap-mkey.patch -ApplyPatch 1503-rdma-mlx5-fix-incorrect-mkey-masking.patch -ApplyPatch 1504-rdma-mlx5-add-dmah-object-support.patch -ApplyPatch 1505-rdma-mlx5-add-dmah-support-for-reg-user-mr-reg-user-dmabuf-m.patch -ApplyPatch 1506-rdma-mlx5-refactor-optional-counters-steering-code.patch -ApplyPatch 1507-ib-mlx5-fix-obj-type-mismatch-for-srq-event-subscriptions.patch -ApplyPatch 1508-net-mlx5-don-t-use-pk-through-tracepoints.patch -ApplyPatch 1509-net-mlx5-mlx5-ifc-add-hardware-definitions-needed-for-adjace.patch -ApplyPatch 1510-net-mlx5-e-switch-cache-vport-vhca-id-on-first-cap-query.patch -ApplyPatch 1511-net-mlx5-e-switch-set-query-hca-cap-via-vhca-id.patch -ApplyPatch 1512-rdma-net-mlx5-export-mlx5-vport-get-vhca-id.patch -ApplyPatch 1513-net-mlx5-query-to-see-if-host-pf-is-disabled.patch -ApplyPatch 1514-net-mlx5-support-disabling-host-pfs.patch -ApplyPatch 1515-net-mlx5e-set-default-burst-period-for-tx-and-rx-reporters.patch -ApplyPatch 1516-eth-mlx5-remove-kconfig-co-dependency-with-vxlan.patch -ApplyPatch 1517-net-mlx5-fs-convert-vport-acls-root-namespaces-to-xarray.patch -ApplyPatch 1518-net-mlx5-e-switch-move-vport-acls-root-namespaces-creation-t.patch -ApplyPatch 1519-net-mlx5-e-switch-add-support-for-adjacent-functions-vports-.patch -ApplyPatch 1520-net-mlx5-e-switch-create-acls-root-namespace-for-adjacent-vp.patch -ApplyPatch 1521-net-mlx5-e-switch-register-representors-for-adjacent-vports.patch -ApplyPatch 1522-net-mlx5-e-switch-set-representor-attributes-for-adjacent-vf.patch -ApplyPatch 1523-net-mlx5-dr-hws-use-the-cached-vhca-id-for-this-device.patch -ApplyPatch 1524-net-mlx5-add-psp-capabilities-structures-and-bits.patch -ApplyPatch 1525-net-mlx5-extract-mtctr-register-read-logic-into-helper-funct.patch -ApplyPatch 1526-net-mlx5-support-getcyclesx-and-getcrosscycles.patch -ApplyPatch 1527-net-mlx5-add-rs-fec-histogram-infrastructure.patch -ApplyPatch 1528-net-mlx5-implement-cqe-compress-type-via-devlink-params.patch -ApplyPatch 1529-net-mlx5-implement-devlink-enable-sriov-parameter.patch -ApplyPatch 1530-net-mlx5-implement-devlink-total-vfs-parameter.patch -ApplyPatch 1531-net-mlx5e-make-pcie-congestion-event-thresholds-configurable.patch -ApplyPatch 1532-net-mlx5e-add-stale-counter-for-pcie-congestion-events.patch -ApplyPatch 1533-net-mlx5-fix-typo-in-pci-irq-c-comment.patch -ApplyPatch 1534-net-mlx5-refactor-devcom-to-use-match-attributes.patch -ApplyPatch 1535-net-mlx5-lag-move-devcom-registration-to-lag-layer.patch -ApplyPatch 1536-net-mlx5-add-net-namespace-support-to-devcom.patch -ApplyPatch 1537-net-mlx5-lag-add-net-namespace-support.patch -ApplyPatch 1538-net-mlx5-remove-vlan-insertion-fields-from-wqe-ether-segment.patch -ApplyPatch 1539-net-mlx5-refactor-macsec-wqe-metadata-shifts.patch -ApplyPatch 1540-net-mlx5e-prevent-wqe-metadata-conflicts-between-timestampin.patch -ApplyPatch 1541-net-mlx5-fix-typo-of-mlx5-eq-doorbel-offset.patch -ApplyPatch 1542-net-mlx5-remove-unused-offset-field-from-mlx5-sq-bfreg.patch -ApplyPatch 1543-net-mlx5e-remove-unused-xsk-param-of-mlx5e-build-xdpsq-param.patch -ApplyPatch 1544-net-mlx5-store-the-global-doorbell-in-mlx5-priv.patch -ApplyPatch 1545-net-mlx5e-prepare-for-using-multiple-tx-doorbells.patch -ApplyPatch 1546-net-mlx5e-prepare-for-using-different-cq-doorbells.patch -ApplyPatch 1547-net-mlx5e-use-multiple-tx-doorbells.patch -ApplyPatch 1548-net-mlx5e-use-multiple-cq-doorbells.patch -ApplyPatch 1549-net-mlx5e-use-the-num-doorbells-devlink-param.patch -ApplyPatch 1550-net-mlx5e-use-unsigned-for-mlx5e-get-max-num-channels.patch -ApplyPatch 1551-net-mlx5-add-uar-access-and-odp-page-fault-counters.patch -ApplyPatch 1552-net-mlx5-change-ttc-rules-to-match-on-undecrypted-esp-packet.patch -ApplyPatch 1553-net-mlx5e-recirculate-decrypted-packets-into-ttc-table.patch -ApplyPatch 1554-net-mlx5e-add-flow-groups-for-the-packets-decrypted-by-crypt.patch -ApplyPatch 1555-net-mlx5e-add-flow-rules-for-the-decrypted-esp-packets.patch -ApplyPatch 1556-net-mlx5-remove-dead-code-from-total-vfs-setter.patch -ApplyPatch 1557-net-mlx5-use-pe-format-specifier-for-error-pointers.patch -ApplyPatch 1558-net-mlx5-expose-uar-access-and-odp-page-fault-counters.patch -ApplyPatch 1559-net-mlx5-add-ifc-bit-for-tir-sq-order-capability.patch -ApplyPatch 1560-net-mlx5-ifc-add-balance-id-and-lag-per-mp-group-bits.patch -ApplyPatch 1561-net-mlx5-stop-polling-for-command-response-if-interface-goes.patch -ApplyPatch 1562-net-mlx5-pagealloc-fix-reclaim-race-during-command-interface.patch -ApplyPatch 1563-net-mlx5-fw-reset-add-reset-timeout-work.patch -ApplyPatch 1564-net-mlx5-improve-write-combining-test-reliability-for-arm64-.patch -ApplyPatch 1565-net-mlx5-hws-generalize-complex-matchers.patch -ApplyPatch 1566-net-mlx5e-prevent-entering-switchdev-mode-with-inconsistent-.patch -ApplyPatch 1567-net-mlx5-improve-qos-error-messages-with-actual-depth-values.patch -ApplyPatch 1568-net-mlx5e-remove-unused-mdev-param-from-rss-indir-init.patch -ApplyPatch 1569-net-mlx5e-introduce-mlx5e-rss-init-params.patch -ApplyPatch 1570-net-mlx5e-introduce-mlx5e-rss-params-for-rss-configuration.patch -ApplyPatch 1571-net-mlx5e-use-extack-in-set-rxfh-callback.patch -ApplyPatch 1572-net-mlx5-prevent-tunnel-mode-conflicts-between-fdb-and-nic-i.patch -ApplyPatch 1573-net-mlx5e-prevent-tunnel-reformat-when-tunnel-mode-not-allow.patch -ApplyPatch 1574-net-mlx5-fix-pre-2-40-binutils-assembler-error.patch -ApplyPatch 1575-net-mlx5e-return-1-instead-of-0-in-invalid-case-in-mlx5e-mpw.patch -ApplyPatch 1576-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch -ApplyPatch 1577-net-mlx5e-rx-fix-generating-skb-from-non-linear-xdp-buff-for.patch -ApplyPatch 1578-net-mlx5-add-pphcr-to-pcam-supported-registers-mask.patch -ApplyPatch 1579-net-mlx5-refactor-devcom-to-return-null-on-failure.patch -ApplyPatch 1580-net-mlx5-fix-ipsec-cleanup-over-mpv-device.patch -ApplyPatch 1581-net-mlx5-don-t-zero-user-count-when-destroying-fdb-tables.patch -ApplyPatch 1582-net-mlx5e-fix-return-value-in-case-of-module-eeprom-read-err.patch -ApplyPatch 1583-net-mlx5e-fix-missing-error-assignment-in-mlx5e-xfrm-add-sta.patch -ApplyPatch 1584-net-mlx5e-trim-the-length-of-the-num-doorbell-error.patch -ApplyPatch 1585-net-mlx5e-fix-maxrate-wraparound-in-threshold-between-units.patch -ApplyPatch 1586-net-mlx5e-fix-wraparound-in-rate-limiting-for-values-above-2.patch -ApplyPatch 1587-net-mlx5e-fix-potentially-misleading-debug-message.patch -ApplyPatch 1588-mlx5-fix-default-values-in-create-cq.patch -ApplyPatch 1589-net-mlx5-clean-up-only-new-irq-glue-on-request-irq-failure.patch -ApplyPatch 1590-net-mlx5e-fix-validation-logic-in-rate-limiting.patch -ApplyPatch 1591-rdma-mlx5-enable-data-direct-with-relaxed-ordering.patch -ApplyPatch 1592-rdma-mlx5-better-estimate-max-qp-wr-to-reflect-wqe-count.patch -ApplyPatch 1593-rdma-mlx5-fix-vport-loopback-forcing-for-mpv-device.patch -ApplyPatch 1594-rdma-mlx5-fix-page-size-bitmap-calculation-for-ksm-mode.patch -ApplyPatch 1595-rdma-use-pe-format-specifier-for-error-pointers.patch -ApplyPatch 1596-rdma-net-mlx5-query-vports-mac-address-from-device.patch -ApplyPatch 1597-net-mlx5-use-common-mlx5-same-hw-devs-function.patch -ApplyPatch 1598-net-mlx5-add-software-system-image-guid-infrastructure.patch -ApplyPatch 1599-net-mlx5-refactor-ptp-clock-devcom-pairing.patch -ApplyPatch 1600-net-mlx5-refactor-hca-cap-2-setting.patch -ApplyPatch 1601-net-mlx5-add-balance-id-support-for-lag-multiplane-groups.patch -ApplyPatch 1602-net-mlx5e-remove-redundant-tstamp-pointer-from-channel-struc.patch -ApplyPatch 1603-net-mlx5e-remove-unnecessary-tstamp-local-variable-in-mlx5i-.patch -ApplyPatch 1604-net-mlx5e-rename-hwstamp-functions-to-hwtstamp.patch -ApplyPatch 1605-net-mlx5e-rename-timestamp-fields-to-hwtstamp-config.patch -ApplyPatch 1606-net-mlx5e-convert-to-new-hwtstamp-get-set-interface.patch -ApplyPatch 1607-net-mlx5e-enhance-function-structures-for-self-loopback-prev.patch -ApplyPatch 1608-net-mlx5e-use-tir-api-in-mlx5e-modify-tirs-lb.patch -ApplyPatch 1609-net-mlx5e-allow-setting-self-loopback-prevention-bits-on-tir.patch -ApplyPatch 1610-net-mlx5-ipoib-set-self-loopback-prevention-in-tir-init.patch -ApplyPatch 1611-net-mlx5e-do-not-re-apply-tir-loopback-configuration-if-not-.patch -ApplyPatch 1612-net-mlx5e-pass-old-channels-as-argument-to-mlx5e-switch-priv.patch -ApplyPatch 1613-net-mlx5e-defer-channels-closure-to-reduce-interface-down-ti.patch -ApplyPatch 1614-pci-tph-expose-pcie-tph-get-st-table-loc.patch -ApplyPatch 1615-net-mlx5-add-direct-st-mode-support-for-rdma.patch -ApplyPatch 1616-net-mlx5-add-other-eswitch-hw-capabilities.patch -ApplyPatch 1617-net-mlx5-fs-add-other-eswitch-support-for-steering-tables.patch -ApplyPatch 1618-net-mlx5-fs-set-non-default-device-per-namespace.patch -ApplyPatch 1619-net-mlx5-mpfs-add-support-for-dynamic-enable-disable.patch -ApplyPatch 1620-net-mlx5-e-switch-support-eswitch-inactive-mode.patch -ApplyPatch 1621-net-mlx5-expose-definition-for-1600gbps-link-mode.patch -ApplyPatch 1622-mlx5-extract-grxrings-from-get-rxnfc.patch -ApplyPatch 1623-net-mlx5-refactor-eeprom-query-error-handling-to-return-stat.patch -ApplyPatch 1624-net-mlx5e-recover-sq-on-excessive-ptp-tx-timestamp-delta.patch -ApplyPatch 1625-net-mlx5-remove-redundant-bw-share-minimal-value-assignment.patch -ApplyPatch 1626-net-mlx5-abort-new-commands-if-all-command-slots-are-stalled.patch -ApplyPatch 1627-net-mlx5-use-eopnotsupp-instead-of-enotsupp.patch -ApplyPatch 1628-net-mlx5-initialize-events-outside-devlink-lock.patch -ApplyPatch 1629-net-mlx5-move-the-esw-mode-notifier-chain-outside-the-devlin.patch -ApplyPatch 1630-net-mlx5-move-the-vhca-event-notifier-outside-of-the-devlink.patch -ApplyPatch 1631-net-mlx5-move-the-sf-hw-table-notifier-outside-the-devlink-l.patch -ApplyPatch 1632-net-mlx5-move-the-sf-table-notifiers-outside-the-devlink-loc.patch -ApplyPatch 1633-net-mlx5-move-sf-dev-table-notifier-registration-outside-the.patch -ApplyPatch 1634-net-mlx5e-use-u64-instead-of-u64-in-ieee-setmaxrate.patch -ApplyPatch 1635-net-mlx5e-rename-upper-limit-mbps-to-upper-limit-100mbps.patch -ApplyPatch 1636-net-mlx5e-use-u8-max-instead-of-hard-coded-magic-number.patch -ApplyPatch 1637-net-mlx5e-use-standard-unit-definitions-for-bandwidth-conver.patch -ApplyPatch 1638-net-mlx5e-update-xdp-features-in-switch-channels.patch -ApplyPatch 1639-net-mlx5e-support-xdp-target-xmit-with-dummy-program.patch -ApplyPatch 1640-net-mlx5-make-enable-mpesw-idempotent.patch -ApplyPatch 1641-net-mlx5-fix-double-unregister-of-hca-ports-component.patch -ApplyPatch 1642-net-mlx5-fw-reset-clear-reset-requested-on-drain-fw-reset.patch -ApplyPatch 1643-net-mlx5-drain-firmware-reset-in-shutdown-callback.patch -ApplyPatch 1644-net-mlx5-fw-tracer-validate-format-string-parameters.patch -ApplyPatch 1645-net-mlx5-fw-tracer-handle-escaped-percent-properly.patch -ApplyPatch 1646-net-mlx5-serialize-firmware-reset-with-devlink.patch -ApplyPatch 1647-net-mlx5e-use-ip6-dst-lookup-instead-of-ipv6-dst-lookup-flow.patch -ApplyPatch 1648-net-mlx5e-trigger-neighbor-resolution-for-unresolved-destina.patch -ApplyPatch 1649-net-mlx5e-do-not-update-bql-of-old-txqs-during-channel-recon.patch -ApplyPatch 1650-net-mlx5-lag-multipath-give-priority-for-routes-with-smaller.patch -ApplyPatch 1651-net-mlx5e-fix-null-pointer-dereference-in-ioctl-module-eepro.patch -ApplyPatch 1652-net-mlx5e-don-t-print-error-message-due-to-invalid-module.patch -ApplyPatch 1653-net-mlx5e-fix-crash-on-profile-change-rollback-failure.patch -ApplyPatch 1654-net-mlx5e-don-t-store-mlx5e-priv-in-mlx5e-dev-devlink-priv.patch -ApplyPatch 1655-net-mlx5e-pass-netdev-to-mlx5e-destroy-netdev-instead-of-pri.patch -ApplyPatch 1656-net-mlx5e-restore-destroying-state-bit-after-profile-cleanup.patch -ApplyPatch 1657-net-mlx5-fix-memory-leak-in-esw-acl-ingress-lgcy-setup.patch -ApplyPatch 1658-net-mlx5-fix-unbinding-uplink-netdev-in-switchdev-mode.patch -ApplyPatch 1659-net-mlx5e-tc-delete-flows-only-for-existing-peers.patch -ApplyPatch 1660-net-mlx5e-account-for-netdev-stats-in-ndo-get-stats64.patch -ApplyPatch 1661-net-mlx5-fix-return-type-mismatch-in-mlx5-esw-vport-vhca-id.patch -ApplyPatch 1662-net-mlx5-fs-fix-inverted-cap-check-in-tx-flow-table-root-dis.patch -ApplyPatch 1663-net-mlx5-fix-vhca-id-access-call-trace-use-before-alloc.patch -ApplyPatch 1664-net-mlx5e-skip-esn-replay-window-setup-for-ipsec-crypto-offl.patch -ApplyPatch 1665-rdma-mlx5-change-default-device-for-lag-slaves-in-rdma-trans.patch -ApplyPatch 1666-rdma-mlx5-add-other-eswitch-support-for-devx-destruction.patch -ApplyPatch 1667-rdma-mlx5-refactor-get-prio-function.patch -ApplyPatch 1668-rdma-mlx5-add-other-eswitch-support-to-userspace-tables.patch -ApplyPatch 1669-ib-mlx5-reduce-imr-ksm-size-when-5-level-paging-is-enabled.patch -ApplyPatch 1670-net-mlx5e-shampo-fix-header-mapping-for-64k-pages.patch -ApplyPatch 1671-net-mlx5e-shampo-fix-skb-size-check-for-64k-pages.patch -ApplyPatch 1672-net-mlx5e-shampo-fix-header-formulas-for-higher-mtus-and-64k.patch -ApplyPatch 1673-net-mlx5-qos-restrict-rtnl-area-to-avoid-a-lock-cycle.patch -ApplyPatch 1674-net-mlx5-fix-peer-miss-rules-host-disabled-checks.patch -ApplyPatch 1675-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-legacy-rq.patch -ApplyPatch 1676-net-mlx5-fix-crash-when-moving-to-switchdev-mode.patch -ApplyPatch 1677-net-mlx5-fix-hca-caps-leak-on-notifier-init-failure.patch -ApplyPatch 1678-net-mlx5e-rx-fix-xdp-multi-buf-frag-counting-for-striding-rq.patch -ApplyPatch 1679-iavf-fix-vlan-filter-lost-on-add-delete-race.patch -ApplyPatch 1680-iavf-rename-iavf-vlan-is-new-to-iavf-vlan-adding.patch -ApplyPatch 1681-iavf-stop-removing-vlan-filters-from-pf-on-interface-down.patch -ApplyPatch 1682-iavf-wait-for-pf-confirmation-before-removing-vlan-filters.patch -ApplyPatch 1683-iavf-add-virtchnl-op-add-vlan-to-success-completion-handler.patch -ApplyPatch 1684-netfilter-skip-recording-stale-or-retransmitted-init.patch -ApplyPatch 1685-sctp-discard-stale-init-after-handshake-completion.patch -ApplyPatch 1686-rdma-vmw-pvrdma-fix-double-free-on-pvrdma-alloc-ucontext-err.patch -ApplyPatch 1687-sched-fair-skip-sched-balance-running-cmpxchg-when-balance-i.patch -ApplyPatch 1688-sched-fair-have-sd-serialize-affect-newidle-balancing.patch -ApplyPatch 1689-powerpc-64-force-inlining-of-prevent-user-access-and-set-kua.patch -ApplyPatch 1690-compiler-gcc-h-remove-ancient-workaround-for-gcc-pr-58670.patch -ApplyPatch 1691-work-around-gcc-bugs-with-asm-goto-with-outputs.patch -ApplyPatch 1692-init-kconfig-fix-cc-has-asm-goto-tied-output-test-with-dash.patch -ApplyPatch 1693-update-workarounds-for-gcc-asm-goto-issue.patch -ApplyPatch 1694-init-kconfig-remove-config-gcc-asm-goto-output-workaround.patch -ApplyPatch 1695-rdma-mlx5-fix-error-path-fall-through-in-mlx5-ib-dev-res-srq.patch -ApplyPatch 1696-net-atm-fix-crash-due-to-unvalidated-vcc-pointer-in-sigd-sen.patch -ApplyPatch 1697-scsi-qla2xxx-add-support-to-report-mpi-fw-state.patch -ApplyPatch 1698-crypto-tegra-use-api-helpers-to-setup-fallback-request.patch -ApplyPatch 1699-crypto-tegra-remove-the-use-of-dev-err-probe.patch -ApplyPatch 1700-crypto-tegra-use-int-type-to-store-negative-error-codes.patch -ApplyPatch 1701-crypto-tegra-add-missing-crypto-alg-async.patch -ApplyPatch 1702-crypto-tegra-don-t-touch-bo-refcount-in-host1x-bo-pin-unpin.patch -ApplyPatch 1703-crypto-tegra-fix-dma-free-coherent-size-error.patch -ApplyPatch 1704-crypto-tegra-return-enomem-when-input-buffer-allocation-fail.patch -ApplyPatch 1705-tcp-fix-potential-race-in-tcp-v6-syn-recv-sock.patch -ApplyPatch 1706-crypto-testmgr-allow-authenc-hmac-sha-256-384-cts-cbc-aes-in.patch -ApplyPatch 1707-crypto-krb5enc-fix-sleepable-flag-handling-in-encrypt-dispat.patch -ApplyPatch 1708-crypto-krb5enc-fix-async-decrypt-skipping-hash-verification.patch -ApplyPatch 1709-crypto-krb5-filter-out-async-aead-implementations-at-alloc.patch -ApplyPatch 1713-nouveau-gsp-drop-warn-on-in-acpi-probes.patch -ApplyPatch 1714-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sc.patch -ApplyPatch 1715-drm-gem-fix-inconsistent-plane-dimension-calculation-in-drm.patch -ApplyPatch 1716-procfs-fix-missing-rcu-protection-when-reading-real-parent-i.patch -ApplyPatch 1717-netfilter-nft-inner-fix-ipv6-inner-thoff-desync.patch -ApplyPatch 1719-arm64-cputype-add-c1-pro-definitions.patch -ApplyPatch 1720-arm64-cputype-add-c1-premium-definitions.patch -ApplyPatch 1721-arm64-cputype-add-c1-ultra-definitions.patch -ApplyPatch 1722-arm64-cputype-add-neoverse-v3ae-definitions.patch -ApplyPatch 1723-arm64-errata-apply-workarounds-for-neoverse-v3ae.patch -ApplyPatch 1724-arm64-errata-mitigate-tlbi-errata-on-various-arm-cpus.patch -ApplyPatch 1725-arm64-errata-mitigate-tlbi-errata-on-nvidia-olympus-cpu.patch -ApplyPatch 1726-arm64-errata-mitigate-tlbi-errata-on-microsoft-azure-cobalt.patch -ApplyPatch 1727-arm64-cputype-add-nvidia-olympus-definitions.patch -ApplyPatch 1728-clean-up-documentation-mess-left-by-previous-backport.patch -ApplyPatch 1729-fs-smb-client-fix-out-of-bounds-read-in-cifs-sanitize-prepat.patch -ApplyPatch 1730-net-mana-fix-double-destroy-workqueue-on-service-rescan-pci.patch -ApplyPatch 1731-net-mana-null-service-wq-on-setup-error-to-prevent-double-de.patch -ApplyPatch 1732-net-gro-don-t-merge-zcopy-skbs.patch -ApplyPatch 1733-xfrm-defensively-unhash-xfrm-state-lists-in-xfrm-state-delet.patch -ApplyPatch 1734-smb-client-fix-off-by-8-bounds-check-in-check-wsl-eas.patch -ApplyPatch 1735-smb-client-fix-out-of-bounds-read-in-smb2-compound-op.patch -ApplyPatch 1739-tg3-fix-race-for-querying-speed-duplex.patch -ApplyPatch 1740-netfilter-bridge-make-ebt-snat-arp-rewrite-writable.patch -ApplyPatch 1741-epoll-annotate-racy-check.patch -ApplyPatch 1742-eventpoll-defer-struct-eventpoll-free-to-rcu-grace-period.patch -ApplyPatch 1743-eventpoll-use-hlist-is-singular-node-in-ep-remove.patch -ApplyPatch 1744-eventpoll-split-ep-remove.patch -ApplyPatch 1745-eventpoll-kill-ep-remove.patch -ApplyPatch 1746-eventpoll-rename-ep-remove-safe-back-to-ep-remove.patch -ApplyPatch 1747-eventpoll-move-epi-fget-up.patch -ApplyPatch 1748-eventpoll-drop-vestigial-prefix-from-ep-remove-file-epi.patch -ApplyPatch 1749-eventpoll-fix-ep-remove-struct-eventpoll-struct-file-uaf.patch -ApplyPatch 1750-eventpoll-move-f-lock-acquisition-into-ep-remove-file.patch -ApplyPatch 1751-eventpoll-refresh-eventpoll-release-fast-path-comment.patch -ApplyPatch 1752-eventpoll-drop-dead-bool-return-from-ep-remove-epi.patch -ApplyPatch 1753-eventpoll-drop-vestigial-epi-dying-flag.patch -ApplyPatch 1754-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch -ApplyPatch 1755-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -ApplyPatch 1758-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch -ApplyPatch 1759-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch -ApplyPatch 1760-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch -ApplyPatch 1761-crypto-ccp-copy-iv-using-skcipher-ivsize.patch -ApplyPatch 1762-net-fix-memory-leak-in-skb-segment-list-for-gro-packets.patch -ApplyPatch 1763-kallsyms-clean-up-modname-and-modbuildid-initialization.patch -ApplyPatch 1764-kallsyms-bpf-rename-bpf-address-lookup.patch -ApplyPatch 1765-net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch -ApplyPatch 1766-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch -ApplyPatch 1767-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch -ApplyPatch 1768-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch -ApplyPatch 1769-futex-requeue-revert-prevent-null-pointer-dereference.patch -ApplyPatch 1770-xfs-resample-the-data-fork-mapping-after-cycling-ilock.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -5119,19 +3795,27 @@ fi # # %changelog -* Tue Jul 14 2026 Andrew Lukoshko - 5.14.0-687.26.1 -- Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770) -- RHEL changelog for 687.26.1 follows: +* Fri Jul 17 2026 Andrew Lukoshko - 5.14.0-687.26.1 +- proc: fix a dentry lock race between release_task and lookup +- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 +- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 +- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 +- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 +- qla4xxx: bring back deprecated PCI ids +- lpfc: bring back deprecated PCI ids +- be2iscsi: bring back deprecated PCI ids +- kernel/rh_messages.h: enable all disabled pci devices by moving to + unmaintained + +* Fri Jul 17 2026 Eduard Abdullin - 5.14.0-687.26.1 +- Use AlmaLinux OS secure boot cert +- Debrand for AlmaLinux OS +- Add KVM support for ppc64le +- KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds * Mon Jul 13 2026 CKI KWF Bot [5.14.0-687.26.1.el9_8] - xfs: resample the data fork mapping after cycling ILOCK (Carlos Maiolino) [RHEL-193937] -* Mon Jul 13 2026 Andrew Lukoshko - 5.14.0-687.25.1 -- Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769) -- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 - (1756, 1757) are superseded by RHEL's copies and dropped -- RHEL changelog for 687.25.1 follows: - * Thu Jul 09 2026 CKI KWF Bot [5.14.0-687.25.1.el9_8] - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166} - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166} @@ -5143,28 +3827,11 @@ fi - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979} - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016} -* Thu Jul 09 2026 Andrew Lukoshko - 5.14.0-687.24.1 -- Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760) -- The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are - superseded by RHEL's copies and dropped -- RHEL changelog for 687.24.1 follows: - * Tue Jul 07 2026 CKI KWF Bot [5.14.0-687.24.1.el9_8] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113} - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066} -* Wed Jul 08 2026 Andrew Lukoshko - 5.14.0-687.23.2 -- Bring back the rtmutex self-deadlock NULL pointer dereference fixes in - remove_waiter() ahead of RHEL, upstream 3bfdc63936dd + 40a25d59e85b (1756, 1757) - -* Wed Jul 08 2026 Andrew Lukoshko - 5.14.0-687.23.1 -- Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755) -- The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by - RHEL's eventpoll series carrying the same fix and is dropped -- Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738) -- RHEL changelog for 687.23.1 follows: - * Mon Jul 06 2026 CKI KWF Bot [5.14.0-687.23.1.el9_8] - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773] - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773] @@ -5184,21 +3851,6 @@ fi - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344] - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768] -* Tue Jul 08 2026 Andrew Lukoshko - 5.14.0-687.22.2 -- Fix rtmutex self-deadlock NULL pointer dereference in remove_waiter() ahead of - RHEL, upstream 3bfdc63936dd + 40a25d59e85b (1736, 1738); the futex_requeue guard - 74e144274af3 was dropped, reverted upstream by 39def6d250d3 (the NULL deref is - fully handled by 40a25d59e85b) - -* Mon Jul 07 2026 Andrew Lukoshko - 5.14.0-687.22.1 -- Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735) -- Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll - ep_remove use-after-free CVE-2026-46242 (1712) -- RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux - ahead-patch (1312) is retained and RHEL's duplicate copy omitted -- CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263) -- RHEL changelog for 687.21.1..687.22.1 follows: - * Mon Jul 06 2026 CKI KWF Bot [5.14.0-687.22.1.el9_8] - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155} - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041] @@ -5227,19 +3879,6 @@ fi - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227} - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966] -* Mon Jul 06 2026 Andrew Lukoshko - 5.14.0-687.20.3 -- Fix CVE-2026-46242: eventpoll ep_remove struct eventpoll / struct file - use-after-free, adapted from upstream a6dc643c6931 ahead of RHEL (1712) - -* Thu Jul 02 2026 Andrew Lukoshko - 5.14.0-687.20.2 -- Fix KVM x86 shadow paging use-after-free due to unexpected GFN ahead of RHEL (1710) -- Fix KVM x86 shadow paging use-after-free due to unexpected role ahead of RHEL (1711) - -* Tue Jun 30 2026 Andrew Lukoshko - 5.14.0-687.20.1 -- Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709) -- Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) -- RHEL changelog for 687.19.1..687.20.1 follows: - * Mon Jun 29 2026 CKI KWF Bot [5.14.0-687.20.1.el9_8] - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540] - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540] @@ -5256,11 +3895,6 @@ fi - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886] - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411} -* Mon Jun 29 2026 Andrew Lukoshko - 5.14.0-687.19.1 -- Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695) -- Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312) -- RHEL changelog for 687.18.1..687.19.1 follows: - * Thu Jun 25 2026 CKI KWF Bot [5.14.0-687.19.1.el9_8] - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176} - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183] @@ -5364,7 +3998,7 @@ fi - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057] - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057] - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057] -- RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] +- RDMA: Use %%pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057] @@ -5402,7 +4036,7 @@ fi - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057] - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057] - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057] -- net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057] +- net/mlx5: Use %%pe format specifier for error pointers (Kamal Heib) [RHEL-169057] - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057] - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057] @@ -5451,7 +4085,7 @@ fi - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057] - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057] - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057] -- net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057] +- net/mlx5: Don't use %%pK through tracepoints (Kamal Heib) [RHEL-169057] - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057] - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057] @@ -5648,13 +4282,6 @@ fi - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488} - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329} -* Tue Jun 23 2026 Andrew Lukoshko - 5.14.0-687.17.1 -- Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312) - -* Mon Jun 22 2026 Andrew Lukoshko - 5.14.0-687.17.1 -- Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311) -- RHEL changelog for 687.16.1..687.17.1 follows: - * Thu Jun 18 2026 CKI KWF Bot [5.14.0-687.17.1.el9_8] - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331} - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann) @@ -5687,12 +4314,6 @@ fi - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772} - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787} -* Wed Jun 11 2026 Andrew Lukoshko - 5.14.0-687.15.1 -- Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284) -- redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822) -- dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files) -- RHEL changelog for 687.14.1..687.15.1 follows: - * Wed Jun 10 2026 CKI KWF Bot [5.14.0-687.15.1.el9_8] - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037} - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508} @@ -5730,10 +4351,6 @@ fi - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419} - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916] -* Wed Jun 11 2026 Andrew Lukoshko - 5.14.0-687.13.1 -- Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269) -- RHEL changelog for 687.13.1 follows: - * Tue Jun 02 2026 CKI KWF Bot [5.14.0-687.13.1.el9_8] - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243} - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472] @@ -5754,11 +4371,6 @@ fi - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778] - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778] -* Sun Jun 07 2026 Andrew Lukoshko - 5.14.0-687.12.1 -- Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable - backports (SOURCES/1198-1252) -- RHEL changelog for 687.11.1..687.12.1 follows: - * Mon May 25 2026 CKI KWF Bot [5.14.0-687.12.1.el9_8] - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626] - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190} @@ -5818,15 +4430,6 @@ fi - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464] - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392} -* Sun Jun 07 2026 Andrew Lukoshko - 5.14.0-687.10.1 -- Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable - backports (SOURCES/1100-1196) -- Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL - backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto - authencesn/algif) -- Keep the smb cifs.spnego ahead-fix (retained as 1197) -- RHEL changelog for 687.6.1..687.10.1 follows: - * Mon May 18 2026 CKI KWF Bot [5.14.0-687.10.1.el9_8] - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300} @@ -5934,47 +4537,6 @@ fi - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766} - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075} -* Thu May 28 2026 Andrew Lukoshko - 5.14.0-687.5.4 -- net: skbuff: propagate shared-frag marker through frag-transfer helpers - (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300 - "Fragnesia") -- smb: client: reject userspace cifs.spnego descriptions (upstream commit - 3da1fdf4efbc) - -* Tue May 19 2026 Andrew Lukoshko - 5.14.0-687.5.3 -- xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284) -- rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500) -- net: skbuff: propagate shared-frag marker through frag-transfer helpers - (CVE-2026-46300 "Fragnesia") -- ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe - replacement for upstream 31e62c2ebbfd, Qualys Security Advisory) -- crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431) - -* Tue Apr 14 2026 Andrew Lukoshko - 5.14.0-687.5.1 -- proc: fix a dentry lock race between release_task and lookup -- hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 -- mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 -- megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024 -- qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024 -- qla4xxx: bring back deprecated PCI ids -- lpfc: bring back deprecated PCI ids -- be2iscsi: bring back deprecated PCI ids -- kernel/rh_messages.h: enable all disabled pci devices by moving to - unmaintained - -* Tue Apr 14 2026 Eduard Abdullin - 5.14.0-687.5.1 -- Use AlmaLinux OS secure boot cert -- Debrand for AlmaLinux OS -- Add KVM support for ppc64le -- KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds - -* Tue Apr 14 2026 Andrew Lukoshko [5.14.0-687.5.1.el9_8] -- kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] -- Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko) -- kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672] -- Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert) -- Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert) - * Wed Apr 01 2026 CKI KWF Bot [5.14.0-687.5.1.el9_8] - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672] - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]