Skip to content

Conversation

@PlaidCat
Copy link
Collaborator

  • Download all unprocessed src.rpm
  • for each src,pm
    • Find all commits in changelog up to last known tag ... in this case 6.12.0-55
    • Re-play commits in reverse order (oldest in change log to newest) with git cherry-pick
    • After replay replace ENTIRE code in branch with rpmbuild -bp from corresponding src.rpm.
    • Tag Rebuild branch
  • Use New Local Build with prodman and test (note test results will be different than usual)

Checking Rebuild Commits for potentially missing commits:

kernel-6.12.0-55.43.1.el10_0

[jmaple@devbox kernel-src-tree]$ cat ciq/ciq_backports/kernel-6.12.0-55.43.1.el10_0/rebuild.details.txt
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v4.18~1..kernel-mainline: 567757
Number of commits in rpm: 211
Number of commits matched with upstream: 206 (97.63%)
Number of commits in upstream but not in rpm: 567552
Number of commits NOT found in upstream: 5 (2.37%)

Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.43.1.el10_0 for kernel-6.12.0-55.43.1.el10_0
Clean Cherry Picks: 188 (91.26%)
Empty Cherry Picks: 17 (8.25%)
_______________________________

__EMPTY COMMITS__________________________
914639464b760a4ec659a46cc2de9a2fdc4eff5a ice: Add in/out PTP pin delays
f003075227864344c14f53302c28acd0174d9225 ice: Implement PTP support for E830 devices
905d1a220e8db4aaf0ccc5cb9f733ac2e5989386 ice: Add E830 checksum offload support
1ad466706671436994ec7e71305f44692fed989a x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES
549435aab49ae83d60a08795de6cf0e866f3b2ec x86/bugs: Move the X86_FEATURE_USE_IBPB check into callers
a48dc42614cad39fac1ef55d690847fd07f0e3c6 x86/mm: Remove X86_FEATURE_USE_IBPB checks in cond_mitigation()
80dacb080461edfc1d854721ee6933a4cfa3b602 x86/bugs: Use a static branch to guard IBPB on vCPU switch
8c4f28cd81fe86033918eec69d5280b532c05842 KVM: nVMX: Always use IBPB to properly virtualize IBRS
8f64eee70cdd3bb8c3ec7d30f0d1f52922aaef7c x86/bugs: Remove X86_FEATURE_USE_IBPB
13235d6d50bba99931c4392c0f813cfae0de3eac x86/bugs: Rename entry_ibpb() to write_ibpb()
b1b19cfcf4656c75088dc06b7499f493e0dec3e5 x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier()
8754e67ad4ac692c67ff1f99c0d07156f04ae40c x86/its: Add support for ITS-safe indirect thunk
a75bf27fe41abe658c53276a0c486c4bf9adecfc x86/its: Add support for ITS-safe return thunk
f4818881c47fd91fcb6d62373c57c7844e3de1c0 x86/its: Enable Indirect Target Selection mitigation
2665281a07e19550944e8354a2024635a7b2714a x86/its: Add "vmexit" option to skip mitigation on some CPUs
facd226f7e0c8ca936ac114aba43cb3e8b94e41e x86/its: Add support for RSB stuffing mitigation
8122b047dd18ef6e7e1c564e28f3c7067c5a2d71 tools arch x86: Sync the msr-index.h copy with the kernel sources

__CHANGES NOT IN UPSTREAM________________
Porting to Rocky Linux 10, debranding and Rocky Linux branding'
Add partial riscv64 support for build root'
Provide basic VisionFive 2 support'
redhat/configs: Enable CONFIG_MITIGATION_ITS for x86
redhat: configs: enable CONFIG_PACKING

BUILD

[jmaple@devbox code]$ egrep -B 5 -A 5 "\[TIMER\]|^Starting Build" $(ls -t kbuild* | head -n1)
/mnt/code/kernel-src-tree-build
Running make mrproper...
  CLEAN   scripts/basic
  CLEAN   scripts/kconfig
  CLEAN   include/config include/generated
[TIMER]{MRPROPER}: 7s
x86_64 architecture detected, copying config
'configs/kernel-x86_64-rhel.config' -> '.config'
Setting Local Version for build
CONFIG_LOCALVERSION="-rocky10_0_rebuild-11e6cfbb09b9"
Making olddefconfig
--
  HOSTCC  scripts/kconfig/util.o
  HOSTLD  scripts/kconfig/conf
#
# configuration written to .config
#
Starting Build
  GEN     arch/x86/include/generated/asm/orc_hash.h
  WRAP    arch/x86/include/generated/uapi/asm/bpf_perf_event.h
  WRAP    arch/x86/include/generated/uapi/asm/errno.h
  WRAP    arch/x86/include/generated/uapi/asm/fcntl.h
  WRAP    arch/x86/include/generated/uapi/asm/ioctl.h
--
  LD [M]  net/qrtr/qrtr.ko
  BTF [M] net/hsr/hsr.ko
  BTF [M] net/qrtr/qrtr.ko
  LD [M]  net/qrtr/qrtr-mhi.ko
  BTF [M] net/qrtr/qrtr-mhi.ko
[TIMER]{BUILD}: 1918s
Making Modules
  SYMLINK /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/build
  INSTALL /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/modules.order
  INSTALL /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/modules.builtin
  INSTALL /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/modules.builtin.modinfo
--
  STRIP   /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/kernel/net/qrtr/qrtr-mhi.ko
  SIGN    /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/kernel/net/qrtr/qrtr-mhi.ko
  SIGN    /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/kernel/net/qrtr/qrtr.ko
  SIGN    /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+/kernel/net/hsr/hsr.ko
  DEPMOD  /lib/modules/6.12.0-rocky10_0_rebuild-11e6cfbb09b9+
[TIMER]{MODULES}: 14s
Making Install
  INSTALL /boot
[TIMER]{INSTALL}: 16s
Checking kABI
kABI check passed
Setting Default Kernel to /boot/vmlinuz-6.12.0-rocky10_0_rebuild-11e6cfbb09b9+ and Index to 2
Hopefully Grub2.0 took everything ... rebooting after time metrices
[TIMER]{MRPROPER}: 7s
[TIMER]{BUILD}: 1918s
[TIMER]{MODULES}: 14s
[TIMER]{INSTALL}: 16s
[TIMER]{TOTAL} 1959s
Rebooting in 10 seconds

KSelfTests

[jmaple@devbox code]$ ~/workspace/auto_kernel_history_rebuild/Rocky10/rocky10/code/get_kselftest_diff.sh
kselftest.6.12.0-jmaple_rlc-10_6.12.0-55.41.1.el10_0-4bca6d668638+.log
506
kselftest.6.12.0-rocky10_0_rebuild-51495e441e52+.log
507
kselftest.6.12.0-jmaple_rlc-10_6.12.0-55.42.1.el10_0-fc6673a8811f+.log
506
kselftest.6.12.0-rocky10_0_rebuild-11e6cfbb09b9+.log
508
Before: kselftest.6.12.0-jmaple_rlc-10_6.12.0-55.42.1.el10_0-fc6673a8811f+.log
After: kselftest.6.12.0-rocky10_0_rebuild-11e6cfbb09b9+.log
Diff:
+ok 1 selftests: filesystems: devpts_pts # SKIP
+ok 1 selftests: x86/bugs: its_sysfs.py

…ffer

jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 8b3e266

While reworking the implementation, it became apparent that this check
does not exist.

There is no functional issue yet, because at call sites, "startbit" and
"endbit" are always hardcoded to correct values, and never come from the
user.

Even with the upcoming support of arbitrary buffer lengths, the
"startbit >= 8 * pbuflen" check will remain correct. This is because
we intend to always interpret the packed buffer in a way that avoids
discontinuities in the available bit indices.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Tested-by: Jacob Keller <jacob.e.keller@intel.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-1-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 8b3e266)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…fer lengths

jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit a636ba5

Jacob Keller has a use case for packing() in the intel/ice networking
driver, but it cannot be used as-is.

Simply put, the API quirks for LSW32_IS_FIRST and LITTLE_ENDIAN are
naively implemented with the undocumented assumption that the buffer
length must be a multiple of 4. All calculations of group offsets and
offsets of bytes within groups assume that this is the case. But in the
ice case, this does not hold true. For example, packing into a buffer
of 22 bytes would yield wrong results, but pretending it was a 24 byte
buffer would work.

Rather than requiring such hacks, and leaving a big question mark when
it comes to discontinuities in the accessible bit fields of such buffer,
we should extend the packing API to support this use case.

It turns out that we can keep the design in terms of groups of 4 bytes,
but also make it work if the total length is not a multiple of 4.
Just like before, imagine the buffer as a big number, and its most
significant bytes (the ones that would make up to a multiple of 4) are
missing. Thus, with a big endian (no quirks) interpretation of the
buffer, those most significant bytes would be absent from the beginning
of the buffer, and with a LSW32_IS_FIRST interpretation, they would be
absent from the end of the buffer. The LITTLE_ENDIAN quirk, in the
packing() API world, only affects byte ordering within groups of 4.
Thus, it does not change which bytes are missing. Only the significance
of the remaining bytes within the (smaller) group.

No change intended for buffer sizes which are multiples of 4. Tested
with the sja1105 driver and with downstream unit tests.

Link: https://lore.kernel.org/netdev/a0338310-e66c-497c-bc1f-a597e50aa3ff@intel.com/
	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Tested-by: Jacob Keller <jacob.e.keller@intel.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-2-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit a636ba5)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 816ad8f

It is not necessary to have the kernel-doc duplicated both in the
header and in the implementation. It is better to have it near the
implementation of the function, since in C, a function can have N
declarations, but only one definition.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-3-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 816ad8f)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 7263f64

Geert Uytterhoeven described packing() as "really bad API" because of
not being able to enforce const correctness. The same function is used
both when "pbuf" is input and "uval" is output, as in the other way
around.

Create 2 wrapper functions where const correctness can be ensured.
Do ugly type casts inside, to be able to reuse packing() as currently
implemented - which will _not_ modify the input argument.

Also, take the opportunity to change the type of startbit and endbit to
size_t - an unsigned type - in these new function prototypes. When int,
an extra check for negative values is necessary. Hopefully, when
packing() goes away completely, that check can be dropped.

My concern is that code which does rely on the conditional directionality
of packing() is harder to refactor without blowing up in size. So it may
take a while to completely eliminate packing(). But let's make alternatives
available for those who do not need that.

Link: https://lore.kernel.org/netdev/20210223112003.2223332-1-geert+renesas@glider.be/
	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-4-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 7263f64)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 28aec9c

packing() is now used in some hot paths, and it would be good to get rid
of some ifs and buts that depend on "op", to speed things up a little bit.

With the main implementations now taking size_t endbit, we no longer
have to check for negative values. Update the local integer variables to
also be size_t to match.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-5-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 28aec9c)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit e9502ea

Add 24 simple KUnit tests for the lib/packing.c pack() and unpack() APIs.

The first 16 tests exercise all combinations of quirks with a simple magic
number value on a 16-byte buffer. The remaining 8 tests cover
non-multiple-of-4 buffer sizes.

These tests were originally written by Vladimir as simple selftest
functions. I adapted them to KUnit, refactoring them into a table driven
approach. This will aid in adding additional tests in the future.

Co-developed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Tested-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-6-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit e9502ea)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit fcd6dd9

While reviewing the initial KUnit tests for lib/packing, Przemek pointed
out that the test values have duplicate bytes in the input sequence.

In addition, I noticed that the unit tests pack and unpack on a byte
boundary, instead of crossing bytes. Thus, we lack good coverage of the
corner cases of the API.

Add additional unit tests to cover packing and unpacking byte buffers which
do not have duplicate bytes in the unpacked value, and which pack and
unpack to an unaligned offset.

A careful reviewer may note the lack tests for QUIRK_MSB_ON_THE_RIGHT. This
is because I found issues with that quirk during test implementation. This
quirk will be fixed and the tests will be included in a future change.

	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-7-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit fcd6dd9)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit e7fdf5d

The QUIRK_MSB_ON_THE_RIGHT quirk is intended to modify pack() and unpack()
so that the most significant bit of each byte in the packed layout is on
the right.

The way the quirk is currently implemented is broken whenever the packing
code packs or unpacks any value that is not exactly a full byte.

The broken behavior can occur when packing any values smaller than one
byte, when packing any value that is not exactly a whole number of bytes,
or when the packing is not aligned to a byte boundary.

This quirk is documented in the following way:

  1. Normally (no quirks), we would do it like this:

  ::

    63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32
    7                       6                       5                        4
    31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10  9  8  7  6  5  4  3  2  1  0
    3                       2                       1                        0

  <snip>

  2. If QUIRK_MSB_ON_THE_RIGHT is set, we do it like this:

  ::

    56 57 58 59 60 61 62 63 48 49 50 51 52 53 54 55 40 41 42 43 44 45 46 47 32 33 34 35 36 37 38 39
    7                       6                        5                       4
    24 25 26 27 28 29 30 31 16 17 18 19 20 21 22 23  8  9 10 11 12 13 14 15  0  1  2  3  4  5  6  7
    3                       2                        1                       0

  That is, QUIRK_MSB_ON_THE_RIGHT does not affect byte positioning, but
  inverts bit offsets inside a byte.

Essentially, the mapping for physical bit offsets should be reserved for a
given byte within the payload. This reversal should be fixed to the bytes
in the packing layout.

The logic to implement this quirk is handled within the
adjust_for_msb_right_quirk() function. This function does not work properly
when dealing with the bytes that contain only a partial amount of data.

In particular, consider trying to pack or unpack the range 53-44. We should
always be mapping the bits from the logical ordering to their physical
ordering in the same way, regardless of what sequence of bits we are
unpacking.

This, we should grab the following logical bits:

  Logical: 55 54 53 52 51 50 49 48 47 45 44 43 42 41 40 39
                  ^  ^  ^  ^  ^  ^  ^  ^  ^

And pack them into the physical bits:

   Physical: 48 49 50 51 52 53 54 55 40 41 42 43 44 45 46 47
    Logical: 48 49 50 51 52 53                   44 45 46 47
              ^  ^  ^  ^  ^  ^                    ^  ^  ^  ^

The current logic in adjust_for_msb_right_quirk is broken. I believe it is
intending to map according to the following:

  Physical: 48 49 50 51 52 53 54 55 40 41 42 43 44 45 46 47
   Logical:       48 49 50 51 52 53 44 45 46 47
                   ^  ^  ^  ^  ^  ^  ^  ^  ^  ^

That is, it tries to keep the bits at the start and end of a packing
together. This is wrong, as it makes the packing change what bit is being
mapped to what based on which bits you're currently packing or unpacking.

Worse, the actual calculations within adjust_for_msb_right_quirk don't make
sense.

Consider the case when packing the last byte of an unaligned packing. It
might have a start bit of 7 and an end bit of 5. This would have a width of
3 bits. The new_start_bit will be calculated as the width - the box_end_bit
- 1. This will underflow and produce a negative value, which will
ultimate result in generating a new box_mask of all 0s.

For any other values, the result of the calculations of the
new_box_end_bit, new_box_start_bit, and the new box_mask will result in the
exact same values for the box_end_bit, box_start_bit, and box_mask. This
makes the calculations completely irrelevant.

If box_end_bit is 0, and box_start_bit is 7, then the entire function of
adjust_for_msb_right_quirk will boil down to just:

    *to_write = bitrev8(*to_write)

The other adjustments are attempting (incorrectly) to keep the bits in the
same place but just reversed. This is not the right behavior even if
implemented correctly, as it leaves the mapping dependent on the bit values
being packed or unpacked.

Remove adjust_for_msb_right_quirk() and just use bitrev8 to reverse the
byte order when interacting with the packed data.

In particular, for packing, we need to reverse both the box_mask and the
physical value being packed. This is done after shifting the value by
box_end_bit so that the reversed mapping is always aligned to the physical
buffer byte boundary. The box_mask is reversed as we're about to use it to
clear any stale bits in the physical buffer at this block.

For unpacking, we need to reverse the contents of the physical buffer
*before* masking with the box_mask. This is critical, as the box_mask is a
logical mask of the bit layout before handling the QUIRK_MSB_ON_THE_RIGHT.

Add several new tests which cover this behavior. These tests will fail
without the fix and pass afterwards. Note that no current drivers make use
of QUIRK_MSB_ON_THE_RIGHT. I suspect this is why there have been no reports
of this inconsistency before.

	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-8-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit e7fdf5d)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit fb02c7c

This helps clarify what the 8 is for.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-9-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit fb02c7c)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 46e784e

This is an u8, so using GENMASK_ULL() for unsigned long long is
unnecessary.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20241002-packing-kunit-tests-and-split-pack-unpack-v2-10-8373e551eae3@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 46e784e)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…hecking

jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit c411709

A future variant of the API, which works on arrays of packed_field
structures, will make most of these checks redundant. The idea will be
that we want to perform sanity checks at compile time, not once
for every function call.

Introduce new variants of pack() and unpack(), which elide the sanity
checks, assuming that the input was pre-sanitized.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241210-packing-pack-fields-and-ice-implementation-v10-1-ee56a47479ac@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit c411709)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 48c2752

Most of the sanity checks in pack() and unpack() can be covered at
compile time. There is only one exception, and that is truncation of the
uval during a pack() operation.

We'd like the error-less __pack() to catch that condition as well. But
at the same time, it is currently the responsibility of consumer drivers
(currently just sja1105) to print anything at all when this error
occurs, and then discard the return code.

We can just print a loud warning in the library code and continue with
the truncated __pack() operation. In practice, having the warning is
very important, see commit 24deec6 ("net: dsa: sja1105: disallow
C45 transactions on the BASE-TX MDIO bus") where the bug was caught
exactly by noticing this print.

Add the first print to the packing library, and at the same time remove
the print for the same condition from the sja1105 driver, to avoid
double printing.

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241210-packing-pack-fields-and-ice-implementation-v10-2-ee56a47479ac@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 48c2752)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 41d7ea3

This is new API which caters to the following requirements:

- Pack or unpack a large number of fields to/from a buffer with a small
  code footprint. The current alternative is to open-code a large number
  of calls to pack() and unpack(), or to use packing() to reduce that
  number to half. But packing() is not const-correct.

- Use unpacked numbers stored in variables smaller than u64. This
  reduces the rodata footprint of the stored field arrays.

- Perform error checking at compile time, rather than runtime, and return
  void from the API functions. Because the C preprocessor can't generate
  variable length code (loops), this is a bit tricky to do with macros.

  To handle this, implement macros which sanity check the packed field
  definitions based on their size. Finally, a single macro with a chain of
  __builtin_choose_expr() is used to select the appropriate macros. We
  enforce the use of ascending or descending order to avoid O(N^2) scaling
  when checking for overlap. Note that the macros are written with care to
  ensure that the compilers can correctly evaluate the resulting code at
  compile time. In particular, care was taken with avoiding too many nested
  statement expressions. Nested statement expressions trip up some
  compilers, especially when passing down variables created in previous
  statement expressions.

  There are two key design choices intended to keep the overall macro code
  size small. First, the definition of each CHECK_PACKED_FIELDS_N macro is
  implemented recursively, by calling the N-1 macro. This avoids needing
  the code to repeat multiple times.

  Second, the CHECK_PACKED_FIELD macro enforces that the fields in the
  array are sorted in order. This allows checking for overlap only with
  neighboring fields, rather than the general overlap case where each field
  would need to be checked against other fields.

  The overlap checks use the first two fields to determine the order of the
  remaining fields, thus allowing either ascending or descending order.
  This enables drivers the flexibility to keep the fields ordered in which
  ever order most naturally fits their hardware design and its associated
  documentation.

  The CHECK_PACKED_FIELDS macro is directly called from within pack_fields
  and unpack_fields, ensuring that all drivers using the API receive the
  benefits of the compile-time checks. Users do not need to directly call
  any of the macros directly.

  The CHECK_PACKED_FIELDS and its helper macros CHECK_PACKED_FIELDS_(0..50)
  are generated using a simple C program in scripts/gen_packed_field_checks.c
  This program can be compiled on demand and executed to generate the
  macro code in include/linux/packing.h. This will aid in the event that a
  driver needs more than 50 fields. The generator can be updated with a new
  size, and used to update the packing.h header file. In practice, the ice
  driver will need to support 27 fields, and the sja1105 driver will need
  to support 0 fields. This on-demand generation avoids the need to modify
  Kbuild. We do not anticipate the maximum number of fields to grow very
  often.

- Reduced rodata footprint for the storage of the packed field arrays.
  To that end, we have struct packed_field_u8 and packed_field_u16, which
  define the fields with the associated type. More can be added as
  needed (unlikely for now). On these types, the same generic pack_fields()
  and unpack_fields() API can be used, thanks to the new C11 _Generic()
  selection feature, which can call pack_fields_u8() or pack_fields_16(),
  depending on the type of the "fields" array - a simplistic form of
  polymorphism. It is evaluated at compile time which function will actually
  be called.

Over time, packing() is expected to be completely replaced either with
pack() or with pack_fields().

	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Co-developed-by: Jacob Keller <jacob.e.keller@intel.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241210-packing-pack-fields-and-ice-implementation-v10-3-ee56a47479ac@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 41d7ea3)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit a9ad2a8

Extend the documentation for the packing library, covering the intended use
for the recently added APIs. This includes the pack() and unpack() macros,
as well as the pack_fields() and unpack_fields() macros.

Add a note that the packing() API is now deprecated in favor of pack() and
unpack().

For the pack_fields() and unpack_fields() APIs, explain the rationale for
when a driver may want to select this API. Provide an example which shows
how to define the fields and call the pack_fields() and unpack_fields()
macros.

Co-developed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Reviewed-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241210-packing-pack-fields-and-ice-implementation-v10-4-ee56a47479ac@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit a9ad2a8)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Vladimir Oltean <vladimir.oltean@nxp.com>
commit 1405981

kunit_kzalloc() may fail. Other call sites verify that this is the case,
either using a direct comparison with the NULL pointer, or the
KUNIT_ASSERT_NOT_NULL() or KUNIT_ASSERT_NOT_ERR_OR_NULL().

Pick KUNIT_ASSERT_NOT_NULL() as the error handling method that made most
sense to me. It's an unlikely thing to happen, but at least we call
__kunit_abort() instead of dereferencing this NULL pointer.

Fixes: e9502ea ("lib: packing: add KUnit tests adapted from selftests")
	Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Link: https://patch.msgid.link/20241004110012.1323427-1-vladimir.oltean@nxp.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 1405981)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Przemek Kitszel <przemyslaw.kitszel@intel.com>
commit 3469472

Add devlink_fmsg_put() that dispatches based on the type
of the value to put, example: bool -> devlink_fmsg_bool_pair_put().

	Reviewed-by: Wojciech Drewek <wojciech.drewek@intel.com>
	Reviewed-by: Simon Horman <horms@kernel.org>
	Signed-off-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 3469472)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Mateusz Polchlopek <mateusz.polchlopek@intel.com>
commit 3dbfde7

Add devlink_fmsg_dump_skb() function that adds some diagnostic
information about skb (like length, pkt type, MAC, etc) to devlink
fmsg mechanism using bunch of devlink_fmsg_put() function calls.

	Signed-off-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 3dbfde7)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Alexander Lobakin <aleksander.lobakin@intel.com>
commit c6594d6

There are cases when we need to explicitly unroll loops. For example,
cache operations, filling DMA descriptors on very high speeds etc.
Add compiler-specific attribute macros to give the compiler a hint
that we'd like to unroll a loop.
Example usage:

 #define UNROLL_BATCH 8

	unrolled_count(UNROLL_BATCH)
	for (u32 i = 0; i < UNROLL_BATCH; i++)
		op(priv, i);

Note that sometimes the compilers won't unroll loops if they think this
would have worse optimization and perf than without unrolling, and that
unroll attributes are available only starting GCC 8. For older compiler
versions, no hints/attributes will be applied.
For better unrolling/parallelization, don't have any variables that
interfere between iterations except for the iterator itself.

Co-developed-by: Jose E. Marchesi <jose.marchesi@oracle.com> # pragmas
	Signed-off-by: Jose E. Marchesi <jose.marchesi@oracle.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Signed-off-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Link: https://patch.msgid.link/20250206182630.3914318-2-aleksander.lobakin@intel.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit c6594d6)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Karol Kolacinski <karol.kolacinski@intel.com>
commit d79c304

Current implementation checks revision of all PHYs on all PFs, which is
incorrect and may result in initialization failure. Check only the
revision of the current PHY.

Fixes: 7cab44f ("ice: Introduce ETH56G PHY model for E825C products")
	Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
	Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
	Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit d79c304)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Karol Kolacinski <karol.kolacinski@intel.com>
commit dc26548

Quad registers are read/written incorrectly. E825 devices always use
quad 0 address and differentiate between the PHYs by changing SBQ
destination device (phy_0 or phy_0_peer).

Add helpers for reading/writing PTP registers shared per quad and use
correct quad address and SBQ destination device based on port.

Fixes: 7cab44f ("ice: Introduce ETH56G PHY model for E825C products")
	Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
	Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
	Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit dc26548)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Karol Kolacinski <karol.kolacinski@intel.com>
commit 2e60560

Fix ETH56G FC-FEC incorrect Rx offset value by changing it from -255.96
to -469.26 ns.

Those values are derived from HW spec and reflect internal delays.
Hex value is a fixed point representation in Q23.9 format.

Fixes: 7cab44f ("ice: Introduce ETH56G PHY model for E825C products")
	Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com>
	Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 2e60560)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Karol Kolacinski <karol.kolacinski@intel.com>
commit 258f5f9

Driver always naively assumes, that for PTP purposes, PHY lane to
configure is corresponding to PF ID.

This is not true for some port configurations, e.g.:
- 2x50G per quad, where lanes used are 0 and 2 on each quad, but PF IDs
  are 0 and 1
- 100G per quad on 2 quads, where lanes used are 0 and 4, but PF IDs are
  0 and 1

Use correct PHY lane assignment by getting and parsing port options.
This is read from the NVM by the FW and provided to the driver with
the indication of active port split.

Remove ice_is_muxed_topo(), which is no longer needed.

Fixes: 4409ea1 ("ice: Adjust PTP init for 2x50G E825C devices")
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Arkadiusz Kubalewski <Arkadiusz.kubalewski@intel.com>
	Signed-off-by: Karol Kolacinski <karol.kolacinski@intel.com>
	Signed-off-by: Grzegorz Nitka <grzegorz.nitka@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 258f5f9)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Wojciech Drewek <wojciech.drewek@intel.com>
commit b699c81

Enable ethtool reset support. Ethtool reset flags are mapped to the
E810 reset type:
PF reset:
  $ ethtool --reset <ethX> irq dma filter offload
CORE reset:
  $ ethtool --reset <ethX> irq-shared dma-shared filter-shared \
    offload-shared ram-shared
GLOBAL reset:
  $ ethtool --reset <ethX> irq-shared dma-shared filter-shared \
    offload-shared mac-shared phy-shared ram-shared

Calling the same set of flags as in PF reset case on port representor
triggers VF reset.

	Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
	Reviewed-by: Marcin Szycik <marcin.szycik@linux.intel.com>
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Acked-by: Jakub Kicinski <kuba@kernel.org>
	Signed-off-by: Wojciech Drewek <wojciech.drewek@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit b699c81)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit a884c30

The ice_vc_cfg_qs_msg() function is used to configure VF queues in response
to a VIRTCHNL_OP_CONFIG_VSI_QUEUES command.

The virtchnl command contains an array of queue pair data for configuring
Tx and Rx queues. This data includes a queue ID. When configuring the
queues, the driver generally uses this queue ID to determine which Tx and
Rx ring to program. However, a handful of places use the index into the
queue pair data from the VF. While most VF implementations appear to send
this data in order, it is not mandated by the virtchnl and it is not
verified that the queue pair data comes in order.

Fix the driver to consistently use the q_idx field instead of the 'i'
iterator value when accessing the rings. For the Rx case, introduce a local
ring variable to keep lines short.

Fixes: 7ad1544 ("ice: Refactor VIRTCHNL_OP_CONFIG_VSI_QUEUES handling")
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit a884c30)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit 7e61c89

The max_frame and rx_buf_len fields of the VSI set the maximum frame size
for packets on the wire, and configure the size of the Rx buffer. In the
hardware, these are per-queue configuration. Most VSI types use a simple
method to determine the size of the buffers for all queues.

However, VFs may potentially configure different values for each queue.
While the Linux iAVF driver does not do this, it is allowed by the virtchnl
interface.

The current virtchnl code simply sets the per-VSI fields inbetween calls to
ice_vsi_cfg_single_rxq(). This technically works, as these fields are only
ever used when programming the Rx ring, and otherwise not checked again.
However, it is confusing to maintain.

The Rx ring also already has an rx_buf_len field in order to access the
buffer length in the hotpath. It also has extra unused bytes in the ring
structure which we can make use of to store the maximum frame size.

Drop the VSI max_frame and rx_buf_len fields. Add max_frame to the Rx ring,
and slightly re-order rx_buf_len to better fit into the gaps in the
structure layout.

Change the ice_vsi_cfg_frame_size function so that it writes to the ring
fields. Call this function once per ring in ice_vsi_cfg_rxqs(). This is
done over calling it inside the ice_vsi_cfg_rxq(), because
ice_vsi_cfg_rxq() is called in the virtchnl flow where the max_frame and
rx_buf_len have already been configured.

Change the accesses for rx_buf_len and max_frame to all point to the ring
structure. This has the added benefit that ice_vsi_cfg_rxq() no longer has
the surprise side effect of updating ring->rx_buf_len based on the VSI
field.

Update the virtchnl ice_vc_cfg_qs_msg() function to set the ring values
directly, and drop references to the removed VSI fields.

This now makes the VF logic clear, as the ring fields are obviously
per-queue. This reduces the required cognitive load when reasoning about
this logic.

Note that removing the VSI fields does leave a 4 byte gap, but the ice_vsi
structure has many gaps, and its layout is not as critical in the hot path.
The structure may benefit from a more thorough repacking, but no attempt
was made in this change.

	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 7e61c89)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Hongbo Li <lihongbo22@huawei.com>
commit 8d873cc

We have for some time the assign_bit() API to replace open coded

    if (foo)
            set_bit(n, bar);
    else
            clear_bit(n, bar);

Use this API to clean the code. No functional change intended.

	Signed-off-by: Hongbo Li <lihongbo22@huawei.com>
	Reviewed-by: Gerhard Engleder <gerhard@engleder-embedded.com>
	Tested-by: George Kuruvinakunnel <george.kuruvinakunnel@intel.com>
	Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 8d873cc)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Markus Elfring <elfring@users.sourceforge.net>
commit 5f4493f

Add jump targets so that a bit of exception handling can be better reused
at the end of two function implementations.

This issue was detected by using the Coccinelle software.

	Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
	Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 5f4493f)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Yue Haibing <yuehaibing@huawei.com>
commit ac532f4

Since commit fff292b ("ice: add VF representors one by one")
ice_eswitch_configure() is not used anymore.
Commit 1b8f15b ("ice: refactor filter functions") removed
ice_vsi_cfg_mac_fltr() but leave declaration.
Commit a24b4c6 ("ice: xsk: Do not convert to buff to frame for
XDP_TX") leave ice_xmit_xdp_buff() declaration.

Commit 7cab44f ("ice: Introduce ETH56G PHY model for E825C
products") declared ice_phy_cfg_{rx,tx}_offset_eth56g(),
commit a1ffafb ("ice: Support configuring the device to Double
VLAN Mode") declared ice_pkg_buf_get_free_space(), and
commit 8a3a565 ("ice: add admin commands to access cgu
configuration") declared ice_is_pca9575_present(), but all these never
be implemented.

	Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
	Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit ac532f4)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Wenjun Wu <wenjun1.wu@intel.com>
commit 608a5c0

This patch adds new virtchnl opcodes and structures for rate limit
and quanta size configuration, which include:
1. VIRTCHNL_OP_CONFIG_QUEUE_BW, to configure max bandwidth for each
VF per queue.
2. VIRTCHNL_OP_CONFIG_QUANTA, to configure quanta size per queue.
3. VIRTCHNL_OP_GET_QOS_CAPS, VF queries current QoS configuration, such
as enabled TCs, arbiter type, up2tc and bandwidth of VSI node. The
configuration is previously set by DCB and PF, and now is the potential
QoS capability of VF. VF can take it as reference to configure queue TC
mapping.

	Reviewed-by: Jiri Pirko <jiri@nvidia.com>
	Signed-off-by: Wenjun Wu <wenjun1.wu@intel.com>
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Link: https://patch.msgid.link/839002f7bd6f63b985a060a51b079f6e6dbbe237.1728460186.git.pabeni@redhat.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 608a5c0)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Paolo Abeni <pabeni@redhat.com>
commit d811ac1

The kernel test robot reported a build failure on m68k in the intel
driver due to the recent shapers-related changes.

The mentioned arch has funny alignment properties, let's be explicit
about the binary layout expectation introducing a padding field.

Fixes: 608a5c0 ("virtchnl: support queue rate limit and quanta size configuration")
	Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202410131710.71Wt6LKO-lkp@intel.com/
	Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
	Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
	Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/e45d1c9f17356d431b03b419f60b8b763d2ff768.1729000481.git.pabeni@redhat.com
	Signed-off-by: Paolo Abeni <pabeni@redhat.com>
(cherry picked from commit d811ac1)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
cve CVE-2024-28956
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
commit 7a9b709

Below are the tests added for Indirect Target Selection (ITS):

- its_sysfs.py - Check if sysfs reflects the correct mitigation status for
  the mitigation selected via the kernel cmdline.

- its_permutations.py - tests mitigation selection with cmdline
  permutations with other bugs like spectre_v2 and retbleed.

- its_indirect_alignment.py - verifies that for addresses in
  .retpoline_sites section that belong to lower half of cacheline are
  patched to ITS-safe thunk. Typical output looks like below:

  Site 49: function symbol: __x64_sys_restart_syscall+0x1f <0xffffffffbb1509af>
  #     vmlinux: 0xffffffff813509af:    jmp     0xffffffff81f5a8e0
  #     kcore:   0xffffffffbb1509af:    jmpq    *%rax
  #     ITS thunk NOT expected for site 49
  #     PASSED: Found *%rax
  #
  Site 50: function symbol: __resched_curr+0xb0 <0xffffffffbb181910>
  #     vmlinux: 0xffffffff81381910:    jmp     0xffffffff81f5a8e0
  #     kcore:   0xffffffffbb181910:    jmp     0xffffffffc02000fc
  #     ITS thunk expected for site 50
  #     PASSED: Found 0xffffffffc02000fc -> jmpq *%rax <scattered-thunk?>

- its_ret_alignment.py - verifies that for addresses in .return_sites
  section that belong to lower half of cacheline are patched to
  its_return_thunk. Typical output looks like below:

  Site 97: function symbol: collect_event+0x48 <0xffffffffbb007f18>
  #     vmlinux: 0xffffffff81207f18:    jmp     0xffffffff81f5b500
  #     kcore:   0xffffffffbb007f18:    jmp     0xffffffffbbd5b560
  #     PASSED: Found jmp 0xffffffffbbd5b560 <its_return_thunk>
  #
  Site 98: function symbol: collect_event+0xa4 <0xffffffffbb007f74>
  #     vmlinux: 0xffffffff81207f74:    jmp     0xffffffff81f5b500
  #     kcore:   0xffffffffbb007f74:    retq
  #     PASSED: Found retq

Some of these tests have dependency on tools like virtme-ng[1] and drgn[2].
When the dependencies are not met, the test will be skipped.

[1] https://github.com/arighi/virtme-ng
[2] https://github.com/osandov/drgn

Co-developed-by: Tao Zhang <tao1.zhang@linux.intel.com>
	Signed-off-by: Tao Zhang <tao1.zhang@linux.intel.com>
	Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
	Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
(cherry picked from commit 7a9b709)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit 63de8ab

To generate code in the eBPF epilogue that uses the DSB instruction,
insn.c needs a heler to encode the type and domain.

Re-use the crm encoding logic from the DMB instruction.

	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit 63de8ab)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit e7956c9

is_spectre_bhb_fw_affected() allows the caller to determine if the CPU
is known to need a firmware mitigation. CPUs are either on the list
of CPUs we know about, or firmware has been queried and reported that
the platform is affected - and mitigated by firmware.

This helper is not useful to determine if the platform is mitigated
by firmware. A CPU could be on the know list, but the firmware may
not be implemented. Its affected but not mitigated.

spectre_bhb_enable_mitigation() handles this distinction by checking
the firmware state before enabling the mitigation.

Add a helper to expose this state. This will be used by the BPF JIT
to determine if calling firmware for a mitigation is necessary and
supported.

	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit e7956c9)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit a1152be

Add a helper to expose the k value of the branchy loop. This is needed
by the BPF JIT to generate the mitigation sequence in BPF programs.

	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit a1152be)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
cve CVE-2025-37948
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit 0dfefc2

A malicious BPF program may manipulate the branch history to influence
what the hardware speculates will happen next.

On exit from a BPF program, emit the BHB mititgation sequence.

This is only applied for 'classic' cBPF programs that are loaded by
seccomp.

	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
	Acked-by: Daniel Borkmann <daniel@iogearbox.net>
(cherry picked from commit 0dfefc2)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
cve CVE-2025-37963
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit f300769

Support for eBPF programs loaded by unprivileged users is typically
disabled. This means only cBPF programs need to be mitigated for BHB.

In addition, only mitigate cBPF programs that were loaded by an
unprivileged user. Privileged users can also load the same program
via eBPF, making the mitigation pointless.

	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
	Acked-by: Daniel Borkmann <daniel@iogearbox.net>
(cherry picked from commit f300769)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author James Morse <james.morse@arm.com>
commit efe676a

Update the list of 'k' values for the branch mitigation from arm's
website.

Add the values for Cortex-X1C. The MIDR_EL1 value can be found here:
https://developer.arm.com/documentation/101968/0002/Register-descriptions/AArch>

Link: https://developer.arm.com/documentation/110280/2-0/?lang=en
	Signed-off-by: James Morse <james.morse@arm.com>
	Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
(cherry picked from commit efe676a)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Juergen Gross <jgross@suse.com>
commit 1dbf30f

Collapsing pages to a leaf PMD or PUD should be done only if
X86_FEATURE_PSE is available, which is not the case when running e.g.
as a Xen PV guest.

Fixes: 41d8848 ("x86/mm/pat: restore large ROX pages after fragmentation")
	Signed-off-by: Juergen Gross <jgross@suse.com>
	Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
	Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
	Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250528123557.12847-3-jgross@suse.com
(cherry picked from commit 1dbf30f)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
…is set

jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Mike Rapoport (Microsoft) <rppt@kernel.org>
commit 47410d8

Currently ROX cache in execmem is enabled regardless of
STRICT_MODULE_RWX setting. This breaks an assumption that module memory
is writable when STRICT_MODULE_RWX is disabled, for instance for kernel
debuggin.

Only enable ROX cache in execmem when STRICT_MODULE_RWX is set to
restore the original behaviour of module text permissions.

Fixes: 64f6a4e ("x86: re-enable EXECMEM_ROX support")
	Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
	Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
	Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20250603111446.2609381-3-rppt@kernel.org
(cherry picked from commit 47410d8)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Mike Rapoport (Microsoft) <rppt@kernel.org>
commit 7cd9a11

The commit d6d1e3e ("mm/execmem: Unify early execmem_cache
behaviour") changed early behaviour of execemem ROX cache to allow its
usage in early x86 code that allocates text pages when
CONFIG_MITGATION_ITS is enabled.

The permission management of the pages allocated from execmem for ITS
mitigation is now completely contained in arch/x86/kernel/alternatives.c
and therefore there is no need to special case early allocations in
execmem.

This reverts commit d6d1e3e.

	Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
	Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
	Cc: stable@vger.kernel.org
Link: https://lkml.kernel.org/r/20250603111446.2609381-6-rppt@kernel.org
(cherry picked from commit 7cd9a11)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Arnaldo Carvalho de Melo <acme@redhat.com>
commit 8122b04
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-6.12.0-55.43.1.el10_0/8122b047.failed

To pick up the changes from these csets:

  3f3c8be Merge tag 'for-linus-5.5a-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip
  4e3f77d ("xen/mcelog: add PPIN to record when available")
  db4d30f ("x86/bugs: Add ITLB_MULTIHIT bug infrastructure")
  1b42f01 ("x86/speculation/taa: Add mitigation for TSX Async Abort")
  c2955f2 ("x86/msr: Add the IA32_TSX_CTRL MSR")

These are the changes in tooling that this udpate ensues:

  $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > /tmp/before
  $
  $ cp arch/x86/include/asm/msr-index.h tools/arch/x86/include/asm/msr-index.h
  $
  $ tools/perf/trace/beauty/tracepoints/x86_msr.sh > /tmp/after
  $ diff -u /tmp/before /tmp/after
  --- /tmp/before	2019-12-02 11:54:44.371035723 -0300
  +++ /tmp/after	2019-12-02 11:55:31.847859784 -0300
  @@ -48,6 +48,7 @@
   	[0x00000119] = "IA32_BBL_CR_CTL",
   	[0x0000011e] = "IA32_BBL_CR_CTL3",
   	[0x00000120] = "IDT_MCR_CTRL",
  +	[0x00000122] = "IA32_TSX_CTRL",
   	[0x00000140] = "MISC_FEATURES_ENABLES",
   	[0x00000174] = "IA32_SYSENTER_CS",
   	[0x00000175] = "IA32_SYSENTER_ESP",
  @@ -283,4 +284,6 @@
   	[0xc0010240 - x86_AMD_V_KVM_MSRs_offset] = "F15H_NB_PERF_CTL",
   	[0xc0010241 - x86_AMD_V_KVM_MSRs_offset] = "F15H_NB_PERF_CTR",
   	[0xc0010280 - x86_AMD_V_KVM_MSRs_offset] = "F15H_PTSC",
  +	[0xc00102f0 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN_CTL",
  +	[0xc00102f1 - x86_AMD_V_KVM_MSRs_offset] = "AMD_PPIN",
   };
  $

  CC       /tmp/build/perf/trace/beauty/tracepoints/x86_msr.o
  LD       /tmp/build/perf/trace/beauty/tracepoints/perf-in.o
  LD       /tmp/build/perf/trace/beauty/perf-in.o
  LD       /tmp/build/perf/perf-in.o

Now it is possible to use these strings when setting up filters for the msr:*
tracepoints, like:

  # perf trace -e msr:* --filter=msr==IA32_TSX_CTRL
  ^C[root@quaco ~]#

If we use an invalid operator we can check what is the filter that is put in
place:

  # perf trace -e msr:* --filter=msr=IA32_TSX_CTRL
  Failed to set filter "(msr=0x122) && (common_pid != 25976 && common_pid != 25860)" on event msr:read_msr with 22 (Invalid argument)

One can as well use -v to see the tracepoints and its filters:

  # perf trace -v -e msr:* --filter=msr==IA32_TSX_CTRL
  Using CPUID GenuineIntel-6-8E-A
  New filter for msr:read_msr: (msr==0x122) && (common_pid != 26110 && common_pid != 25860)
  New filter for msr:write_msr: (msr==0x122) && (common_pid != 26110 && common_pid != 25860)
  New filter for msr:rdpmc: (msr==0x122) && (common_pid != 26110 && common_pid != 25860)
  mmap size 528384B
  ^C#

Better than keep looking up those numbers, works with callchains as
well, e.g. for something more common:

  # perf trace -e msr:*/max-stack=16/ --filter="msr==IA32_SPEC_CTRL" --max-events=2
       0.000 SCTP timer/6158 msr:write_msr(msr: IA32_SPEC_CTRL, val: 6)
                                         do_trace_write_msr ([kernel.kallsyms])
                                         do_trace_write_msr ([kernel.kallsyms])
                                         __switch_to_xtra ([kernel.kallsyms])
                                         __switch_to ([kernel.kallsyms])
                                         __sched_text_start ([kernel.kallsyms])
                                         schedule ([kernel.kallsyms])
                                         schedule_hrtimeout_range_clock ([kernel.kallsyms])
                                         poll_schedule_timeout.constprop.0 ([kernel.kallsyms])
                                         do_select ([kernel.kallsyms])
                                         core_sys_select ([kernel.kallsyms])
                                         kern_select ([kernel.kallsyms])
                                         __x64_sys_select ([kernel.kallsyms])
                                         do_syscall_64 ([kernel.kallsyms])
                                         entry_SYSCALL_64 ([kernel.kallsyms])
                                         __select (/usr/lib64/libc-2.29.so)
                                         [0] ([unknown])
       0.024 :0/0 msr:write_msr(msr: IA32_SPEC_CTRL)
                                         do_trace_write_msr ([kernel.kallsyms])
                                         do_trace_write_msr ([kernel.kallsyms])
                                         __switch_to_xtra ([kernel.kallsyms])
                                         __switch_to ([kernel.kallsyms])
                                         __sched_text_start ([kernel.kallsyms])
                                         schedule_idle ([kernel.kallsyms])
                                         do_idle ([kernel.kallsyms])
                                         cpu_startup_entry ([kernel.kallsyms])
                                         start_secondary ([kernel.kallsyms])
                                         [0x2000d4] ([kernel.kallsyms])
  #

	Cc: Adrian Hunter <adrian.hunter@intel.com>
	Cc: Jan Beulich <jbeulich@suse.com>
	Cc: Jiri Olsa <jolsa@kernel.org>
	Cc: Juergen Gross <jgross@suse.com>
	Cc: Namhyung Kim <namhyung@kernel.org>
	Cc: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
	Cc: Thomas Gleixner <tglx@linutronix.de>
	Cc: Vineela Tummalapalli <vineela.tummalapalli@intel.com>
Link: https://lkml.kernel.org/n/tip-n1xd78fpd5lxn4q1brqi2jl6@git.kernel.org
	Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
(cherry picked from commit 8122b04)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>

# Conflicts:
#	tools/arch/x86/include/asm/msr-index.h
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Gaurav Batra <gbatra@linux.ibm.com>
commit 6aa989a

iommu_mem_notifier() is invoked when RAM is dynamically added/removed. This
notifier call is responsible to add/remove TCEs from the Dynamic DMA Window
(DDW) when TCEs are pre-mapped. TCEs are pre-mapped only for RAM and not
for persistent memory (pmemory). For DMA buffers in pmemory, TCEs are
dynamically mapped when the device driver instructs to do so.

The issue is 'daxctl' command is capable of adding pmemory as "System RAM"
after LPAR boot. The command to do so is -

daxctl reconfigure-device --mode=system-ram dax0.0 --force

This will dynamically add pmemory range to LPAR RAM eventually invoking
iommu_mem_notifier(). The address range of pmemory is way beyond the Max
RAM that the LPAR can have. Which means, this range is beyond the DDW
created for the device, at device initialization time.

As a result when TCEs are pre-mapped for the pmemory range, by
iommu_mem_notifier(), PHYP HCALL returns H_PARAMETER. This failed the
command, daxctl, to add pmemory as RAM.

The solution is to not pre-map TCEs for pmemory.

	Signed-off-by: Gaurav Batra <gbatra@linux.ibm.com>
	Tested-by: Donet Tom <donettom@linux.ibm.com>
	Reviewed-by: Donet Tom <donettom@linux.ibm.com>
	Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/20250130183854.92258-1-gbatra@linux.ibm.com

(cherry picked from commit 6aa989a)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Anumula Murali Mohan Reddy <anumula@chelsio.com>
commit 4c12245

During ARP failure, tid is not inserted but _c4iw_free_ep()
attempts to remove tid which results in error.
This patch fixes the issue by avoiding removal of uninserted tid.

Fixes: 59437d7 ("cxgb4/chtls: fix ULD connection failures due to wrong TID base")
	Signed-off-by: Anumula Murali Mohan Reddy <anumula@chelsio.com>
	Signed-off-by: Potnuri Bharat Teja <bharat@chelsio.com>
Link: https://patch.msgid.link/20250103092327.1011925-1-anumula@chelsio.com
	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
(cherry picked from commit 4c12245)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Kees Cook <kees@kernel.org>
commit 39ec9ea

The sorting of VMAs by size in commit 7d442a3 ("binfmt_elf: Dump
smaller VMAs first in ELF cores") breaks elfutils[1]. Instead, sort
based on the setting of the new sysctl, core_sort_vma, which defaults
to 0, no sorting.

	Reported-by: Michael Stapelberg <michael@stapelberg.ch>
Closes: https://lore.kernel.org/all/20250218085407.61126-1-michael@stapelberg.de/ [1]
Fixes: 7d442a3 ("binfmt_elf: Dump smaller VMAs first in ELF cores")
	Signed-off-by: Kees Cook <kees@kernel.org>
(cherry picked from commit 39ec9ea)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit 8e404ad

Writing to clear the PTM status 'valid' bit while the PTM cycle is
triggered results in unreliable PTM operation. To fix this, clear the
PTM 'trigger' and status after each PTM transaction.

The issue can be reproduced with the following:

$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m

Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to
quickly reproduce the issue.

PHC2SYS exits with:

"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
  fails

This patch also fixes a hang in igc_probe() when loading the igc
driver in the kdump kernel on systems supporting PTM.

The igc driver running in the base kernel enables PTM trigger in
igc_probe().  Therefore the driver is always in PTM trigger mode,
except in brief periods when manually triggering a PTM cycle.

When a crash occurs, the NIC is reset while PTM trigger is enabled.
Due to a hardware problem, the NIC is subsequently in a bad busmaster
state and doesn't handle register reads/writes.  When running
igc_probe() in the kdump kernel, the first register access to a NIC
register hangs driver probing and ultimately breaks kdump.

With this patch, igc has PTM trigger disabled most of the time,
and the trigger is only enabled for very brief (10 - 100 us) periods
when manually triggering a PTM cycle.  Chances that a crash occurs
during a PTM trigger are not 0, but extremely reduced.

Fixes: a90ec84 ("igc: Add support for PTP getcrosststamp()")
	Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Corinna Vinschen <vinschen@redhat.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 8e404ad)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit 714cd03

The i225/i226 hardware retries if it receives an inappropriate response
from the upstream device. If the device retries too quickly, the root
port does not respond.

The wait between attempts was reduced from 10us to 1us in commit
6b8aa75 ("igc: Decrease PTM short interval from 10 us to 1 us"), which
said:

  With the 10us interval, we were seeing PTM transactions take around
  12us. Hardware team suggested this interval could be lowered to 1us
  which was confirmed with PCIe sniffer. With the 1us interval, PTM
  dialogs took around 2us.

While a 1us short cycle time was thought to be theoretically sufficient, it
turns out in practice it is not quite long enough. It is unclear if the
problem is in the root port or an issue in i225/i226.

Increase the wait from 1us to 4us. Increasing to 2us appeared to work in
practice on the setups we have available. A value of 4us was chosen due to
the limited hardware available for testing, with a goal of ensuring we wait
long enough without overly penalizing the response time when unnecessary.

The issue can be reproduced with the following:

$ sudo phc2sys -R 1000 -O 0 -i tsn0 -m

Note: 1000 Hz (-R 1000) is unrealistically large, but provides a way to
quickly reproduce the issue.

PHC2SYS exits with:

"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
  fails

Fixes: 6b8aa75 ("igc: Decrease PTM short interval from 10 us to 1 us")
	Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 714cd03)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit cd7f732

Move ktime_get_snapshot() into the loop. If a retry does occur, a more
recent snapshot will result in a more accurate cross-timestamp.

Fixes: a90ec84 ("igc: Add support for PTP getcrosststamp()")
	Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Tested-by: Avigail Dahan <avigailx.dahan@intel.com>
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit cd7f732)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit 26a3910

All functions in igc_ptp.c called from igc_main.c should check the
IGC_PTP_ENABLED flag. Adding check for this flag to stop and reset
functions.

Fixes: 5f29580 ("igc: Add basic skeleton for PTP")
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 26a3910)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit 1f02575

Make sure that the PTP module is cleaned up if the igc_probe() fails by
calling igc_ptp_stop() on exit.

Fixes: d89f884 ("igc: Add skeletal frame for Intel(R) 2.5G Ethernet Controller support")
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 1f02575)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Christopher S M Hall <christopher.s.hall@intel.com>
commit 1a931c4

Add a mutex around the PTM transaction to prevent multiple transactors

Multiple processes try to initiate a PTM transaction, one or all may
fail. This can be reproduced by running two instances of the
following:

$ sudo phc2sys -O 0 -i tsn0 -m

PHC2SYS exits with:

"ioctl PTP_OFFSET_PRECISE: Connection timed out" when the PTM transaction
 fails

Note: Normally two instance of PHC2SYS will not run, but one process
 should not break another.

Fixes: a90ec84 ("igc: Add support for PTP getcrosststamp()")
	Signed-off-by: Christopher S M Hall <christopher.s.hall@intel.com>
	Reviewed-by: Corinna Vinschen <vinschen@redhat.com>
	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Acked-by: Vinicius Costa Gomes <vinicius.gomes@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit 1a931c4)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Jacob Keller <jacob.e.keller@intel.com>
commit c7d6cb9

Commit 1a931c4 ("igc: add lock preventing multiple simultaneous PTM
transactions") added a new mutex to protect concurrent PTM transactions.
This lock is acquired in igc_ptp_reset() in order to ensure the PTM
registers are properly disabled after a device reset.

The flow where the lock is acquired already holds a spinlock, so acquiring
a mutex leads to a sleep-while-locking bug, reported both by smatch,
and the kernel test robot.

The critical section in igc_ptp_reset() does correctly use the
readx_poll_timeout_atomic variants, but the standard PTM flow uses regular
sleeping variants. This makes converting the mutex to a spinlock a bit
tricky.

Instead, re-order the locking in igc_ptp_reset. Acquire the mutex first,
and then the tmreg_lock spinlock. This is safe because there is no other
ordering dependency on these locks, as this is the only place where both
locks were acquired simultaneously. Indeed, any other flow acquiring locks
in that order would be wrong regardless.

	Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Fixes: 1a931c4 ("igc: add lock preventing multiple simultaneous PTM transactions")
Link: https://lore.kernel.org/intel-wired-lan/Z_-P-Hc1yxcw0lTB@stanley.mountain/
Link: https://lore.kernel.org/intel-wired-lan/202504211511.f7738f5d-lkp@intel.com/T/#u
	Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
	Reviewed-by: Vitaly Lifshits <vitaly.lifshits@intel.com>
	Tested-by: Mor Bar-Gabay <morx.bar.gabay@intel.com>
	Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
(cherry picked from commit c7d6cb9)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
jira LE-4694
cve CVE-2025-39864
Rebuild_History Non-Buildable kernel-6.12.0-55.43.1.el10_0
commit-author Dmitry Antipov <dmantipov@yandex.ru>
commit 26e8444

Following bss_free() quirk introduced in commit 776b358
("cfg80211: track hidden SSID networks properly"), adjust
cfg80211_update_known_bss() to free the last beacon frame
elements only if they're not shared via the corresponding
'hidden_beacon_bss' pointer.

	Reported-by: syzbot+30754ca335e6fb7e3092@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=30754ca335e6fb7e3092
Fixes: 3ab8227 ("cfg80211: refactor cfg80211_bss_update")
	Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20250813135236.799384-1-dmantipov@yandex.ru
	Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 26e8444)
	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
Rebuild_History BUILDABLE
Rebuilding Kernel from rpm changelog with Fuzz Limit: 87.50%
Number of commits in upstream range v4.18~1..kernel-mainline: 567757
Number of commits in rpm: 211
Number of commits matched with upstream: 206 (97.63%)
Number of commits in upstream but not in rpm: 567552
Number of commits NOT found in upstream: 5 (2.37%)

Rebuilding Kernel on Branch rocky10_0_rebuild_kernel-6.12.0-55.43.1.el10_0 for kernel-6.12.0-55.43.1.el10_0
Clean Cherry Picks: 188 (91.26%)
Empty Cherry Picks: 17 (8.25%)
_______________________________

Full Details Located here:
ciq/ciq_backports/kernel-6.12.0-55.43.1.el10_0/rebuild.details.txt

Includes:
* git commit header above
* Empty Commits with upstream SHA
* RPM ChangeLog Entries that could not be matched

Individual Empty Commit failures contained in the same containing directory.
The git message for empty commits will have the path for the failed commit.
File names are the first 8 characters of the upstream SHA
@PlaidCat PlaidCat requested a review from a team November 12, 2025 16:33
@PlaidCat PlaidCat self-assigned this Nov 12, 2025
Copy link

@jdieter jdieter left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🚢

@bmastbergen bmastbergen self-requested a review November 12, 2025 17:27
Copy link
Collaborator

@bmastbergen bmastbergen left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🥌

@PlaidCat PlaidCat merged commit 11e6cfb into rocky10_0 Nov 14, 2025
4 checks passed
@PlaidCat PlaidCat deleted the rocky10_0_rebuild branch November 14, 2025 18:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants