* Re: [PATCH net v4] mptcp: fix soft lockup in mptcp_recvmsg()
From: Matthieu Baerts @ 2026-03-30 13:54 UTC (permalink / raw)
To: Li Xiasong
Cc: netdev, mptcp, linux-kernel, yuehaibing, zhangchangzhong,
weiyongjun1, Mat Martineau, Geliang Tang, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman
In-Reply-To: <20260330120335.659027-1-lixiasong1@huawei.com>
Hi Li,
On 30/03/2026 14:03, Li Xiasong wrote:
> syzbot reported a soft lockup in mptcp_recvmsg() [0].
>
> When receiving data with MSG_PEEK | MSG_WAITALL flags, the skb is not
> removed from the sk_receive_queue. This causes sk_wait_data() to always
> find available data and never perform actual waiting, leading to a soft
> lockup.
>
> Fix this by adding a 'last' parameter to track the last peeked skb.
> This allows sk_wait_data() to make informed waiting decisions and prevent
> infinite loops when MSG_PEEK is used.
Thank you for this new version:
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
@netdev maintainers: this patch can be applied in 'net' directly, thank you!
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* Re: [PATCH net-next v2 0/2] Add support for PIC64-HPSC/HX MDIO controller
From: Charles Perry @ 2026-03-30 13:59 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Charles Perry, netdev, Andrew Lunn, David S. Miller, Eric Dumazet,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Heiner Kallweit, Russell King, devicetree, linux-kernel
In-Reply-To: <20260327165158.505855eb@kernel.org>
On Fri, Mar 27, 2026 at 04:51:58PM -0700, Jakub Kicinski wrote:
> On Fri, 27 Mar 2026 05:34:32 -0700 Charles Perry wrote:
> > On Thu, Mar 26, 2026 at 08:33:09PM -0700, Jakub Kicinski wrote:
> > > On Mon, 23 Mar 2026 15:02:52 -0700 Charles Perry wrote:
> > > > .../net/microchip,pic64hpsc-mdio.yaml | 68 +++++++
> > > > drivers/net/mdio/Kconfig | 7 +
> > > > drivers/net/mdio/Makefile | 1 +
> > > > drivers/net/mdio/mdio-pic64hpsc.c | 192 ++++++++++++++++++
> > >
> > > Speaking under correction from PHY maintainers but I think we need
> > > a MAINTAINERS entry that will cover Microchip MDIO, or at least the
> > > files you're adding. Important read:
> > > https://docs.kernel.org/next/maintainer/feature-and-driver-maintainers.html
> >
> > Sure, I think this should go under "RISC-V MICROCHIP SUPPORT" or maybe a
> > new "MICROCHIP PIC64-HPSC/HX DRIVER" entry if the former was meant only for
> > Polarfire SoC.
> >
> > I'll add something in v3.
>
> Thanks! FWIW I'd prefer the latter - smaller entries make the
> responsibility clear. Under a big arch entry the maintainers are
> usually seeing too many random patches to act. You can add
> _both_ dedicated a entry and add the files to RISC-V MICROCHIP,
> if you prefer, too.
Ok, thank you for the suggestion.
I'll go with "MICROCHIP PIC64-HPSC/HX DRIVERS" for all the small SoC
drivers (MDIO, GPIO, timers, etc.) and a separate entry for the big things
like RDMA or FRER hw accelerator, if we ever get there.
I won't add anything to RISC-V MICROCHIP SUPPORT even if PIC64-HPSC is
indeed a RISC-V chip since this entry is all Polarfire.
Thanks,
Charles
^ permalink raw reply
* Re: [PATCH] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test
From: Jakub Kicinski @ 2026-03-30 14:07 UTC (permalink / raw)
To: Yi Chen
Cc: Pablo Neira Ayuso, Florian Westphal, Phil Sutter, Long Xin,
David S . Miller, Eric Dumazet, Paolo Abeni, Simon Horman,
Shuah Khan, coreteam, netfilter-devel, linux-kselftest,
linux-kernel, netdev
In-Reply-To: <20260330113509.23990-1-yiche@redhat.com>
On Mon, 30 Mar 2026 19:35:09 +0800 Yi Chen wrote:
> The existing test covered a scenario where a delayed INIT_ACK chunk
> updates the vtag in conntrack after the association has already been
> established.
>
> A similar issue can occur with a delayed SCTP INIT chunk.
>
> Add a new simultaneous-open test case where the client's INIT is
> delayed, allowing conntrack to establish the association based on
> the server-initiated handshake.
>
> When the stale INIT arrives later, it may overwirte the vtag in
> conntrack, causing subsequent SCTP DATA chunks to be considered
> as invalid and then dropped by nft rules matching on ct state invalid.
>
> This test verifies such stale INIT chunks do not corrupt conntrack
> state.
Now it fails in NIPA:
TAP version 13
1..1
# timeout set to 1800
# selftests: net/netfilter: conntrack_sctp_collision.sh
# Test for SCTP INIT_ACK Collision in nf_conntrack:
# Client: rcvd! 6
# Server: sent! 6
# PASS: The delayed INIT_ACK chunk did not disrupt sctp ct tracking.
# Test for SCTP INIT Collision in nf_conntrack:
# Failed to recv msg -1
# Failed to recv msg -1
# FAIL: The delayed INIT chunk did not disrupt sctp ct tracking.
not ok 1 selftests: net/netfilter: conntrack_sctp_collision.sh # exit=1
^ permalink raw reply
* [PATCH] [v3] dpaa2: avoid linking objects into multiple modules
From: Arnd Bergmann @ 2026-03-30 14:07 UTC (permalink / raw)
To: Ioana Ciornei, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Russell King
Cc: Arnd Bergmann, netdev, linux-kernel
From: Arnd Bergmann <arnd@arndb.de>
Each object file contains information about which module it gets linked
into, so linking the same file into multiple modules now causes a warning:
scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpaa2-mac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch
scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpmac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch
Change the way that dpaa2 is built by moving the two common files into a
separate module with exported symbols instead.
To avoid a link failure when the switch driver is built-in, but the dpio driver
is a loadable module, add the same dependency in there that exists for
the ethernet driver.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
---
v2: add missing module description
v3: rename "common" to "mac"
drop Kconfig change
rebase to linux-next
---
drivers/net/ethernet/freescale/dpaa2/Makefile | 9 +++++----
drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c | 16 ++++++++++++++++
2 files changed, 21 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/freescale/dpaa2/Makefile b/drivers/net/ethernet/freescale/dpaa2/Makefile
index 1b05ba8d1cbf..5f74be76434f 100644
--- a/drivers/net/ethernet/freescale/dpaa2/Makefile
+++ b/drivers/net/ethernet/freescale/dpaa2/Makefile
@@ -3,15 +3,16 @@
# Makefile for the Freescale DPAA2 Ethernet controller
#
-obj-$(CONFIG_FSL_DPAA2_ETH) += fsl-dpaa2-eth.o
+obj-$(CONFIG_FSL_DPAA2_ETH) += fsl-dpaa2-eth.o fsl-dpaa2-mac.o
obj-$(CONFIG_FSL_DPAA2_PTP_CLOCK) += fsl-dpaa2-ptp.o
-obj-$(CONFIG_FSL_DPAA2_SWITCH) += fsl-dpaa2-switch.o
+obj-$(CONFIG_FSL_DPAA2_SWITCH) += fsl-dpaa2-switch.o fsl-dpaa2-mac.o
-fsl-dpaa2-eth-objs := dpaa2-eth.o dpaa2-ethtool.o dpni.o dpaa2-mac.o dpmac.o dpaa2-eth-devlink.o dpaa2-xsk.o
+fsl-dpaa2-eth-objs := dpaa2-eth.o dpaa2-ethtool.o dpni.o dpaa2-eth-devlink.o dpaa2-xsk.o
fsl-dpaa2-eth-${CONFIG_FSL_DPAA2_ETH_DCB} += dpaa2-eth-dcb.o
fsl-dpaa2-eth-${CONFIG_DEBUG_FS} += dpaa2-eth-debugfs.o
fsl-dpaa2-ptp-objs := dpaa2-ptp.o dprtc.o
-fsl-dpaa2-switch-objs := dpaa2-switch.o dpaa2-switch-ethtool.o dpsw.o dpaa2-switch-flower.o dpaa2-mac.o dpmac.o
+fsl-dpaa2-switch-objs := dpaa2-switch.o dpaa2-switch-ethtool.o dpsw.o dpaa2-switch-flower.o
+fsl-dpaa2-mac-objs += dpaa2-mac.o dpmac.o
# Needed by the tracing framework
CFLAGS_dpaa2-eth.o := -I$(src)
diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
index ad812ebf3139..1f80a527264a 100644
--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
+++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-mac.c
@@ -544,6 +544,7 @@ void dpaa2_mac_start(struct dpaa2_mac *mac)
phylink_start(mac->phylink);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_start);
void dpaa2_mac_stop(struct dpaa2_mac *mac)
{
@@ -554,6 +555,7 @@ void dpaa2_mac_stop(struct dpaa2_mac *mac)
if (mac->serdes_phy)
phy_power_off(mac->serdes_phy);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_stop);
int dpaa2_mac_connect(struct dpaa2_mac *mac)
{
@@ -646,6 +648,7 @@ int dpaa2_mac_connect(struct dpaa2_mac *mac)
return err;
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_connect);
void dpaa2_mac_disconnect(struct dpaa2_mac *mac)
{
@@ -658,6 +661,7 @@ void dpaa2_mac_disconnect(struct dpaa2_mac *mac)
of_phy_put(mac->serdes_phy);
mac->serdes_phy = NULL;
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_disconnect);
int dpaa2_mac_open(struct dpaa2_mac *mac)
{
@@ -729,6 +733,7 @@ int dpaa2_mac_open(struct dpaa2_mac *mac)
dpmac_close(mac->mc_io, 0, dpmac_dev->mc_handle);
return err;
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_open);
void dpaa2_mac_close(struct dpaa2_mac *mac)
{
@@ -753,6 +758,7 @@ void dpaa2_mac_close(struct dpaa2_mac *mac)
if (mac->fw_node)
fwnode_handle_put(mac->fw_node);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_close);
static void dpaa2_mac_transfer_stats(const struct dpmac_counter *counters,
size_t num_counters, void *s,
@@ -824,6 +830,7 @@ void dpaa2_mac_get_rmon_stats(struct dpaa2_mac *mac,
*ranges = dpaa2_mac_rmon_ranges;
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_rmon_stats);
void dpaa2_mac_get_pause_stats(struct dpaa2_mac *mac,
struct ethtool_pause_stats *s)
@@ -835,6 +842,7 @@ void dpaa2_mac_get_pause_stats(struct dpaa2_mac *mac,
DPAA2_MAC_NUM_PAUSE_STATS,
dpaa2_mac_pause_stats, s);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_pause_stats);
void dpaa2_mac_get_ctrl_stats(struct dpaa2_mac *mac,
struct ethtool_eth_ctrl_stats *s)
@@ -846,6 +854,7 @@ void dpaa2_mac_get_ctrl_stats(struct dpaa2_mac *mac,
DPAA2_MAC_NUM_ETH_CTRL_STATS,
dpaa2_mac_eth_ctrl_stats, s);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_ctrl_stats);
void dpaa2_mac_get_eth_mac_stats(struct dpaa2_mac *mac,
struct ethtool_eth_mac_stats *s)
@@ -857,11 +866,13 @@ void dpaa2_mac_get_eth_mac_stats(struct dpaa2_mac *mac,
DPAA2_MAC_NUM_ETH_MAC_STATS,
dpaa2_mac_eth_mac_stats, s);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_eth_mac_stats);
int dpaa2_mac_get_sset_count(void)
{
return DPAA2_MAC_NUM_ETHTOOL_STATS;
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_sset_count);
void dpaa2_mac_get_strings(u8 **data)
{
@@ -870,6 +881,7 @@ void dpaa2_mac_get_strings(u8 **data)
for (i = 0; i < DPAA2_MAC_NUM_ETHTOOL_STATS; i++)
ethtool_puts(data, dpaa2_mac_ethtool_stats[i].name);
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_strings);
void dpaa2_mac_get_ethtool_stats(struct dpaa2_mac *mac, u64 *data)
{
@@ -921,3 +933,7 @@ void dpaa2_mac_get_ethtool_stats(struct dpaa2_mac *mac, u64 *data)
*(data + i) = value;
}
}
+EXPORT_SYMBOL_GPL(dpaa2_mac_get_ethtool_stats);
+
+MODULE_LICENSE("GPL");
+MODULE_DESCRIPTION("DPAA2 Ethernet MAC library");
--
2.39.5
^ permalink raw reply related
* Re: [PATCH] [v2] dpaa: avoid linking objects into multiple modules
From: Arnd Bergmann @ 2026-03-30 14:08 UTC (permalink / raw)
To: Vladimir Oltean, Arnd Bergmann, Ioana Ciornei
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Russell King, Russell King, Josua Mayer,
Wolfram Sang, Sean Anderson, Netdev, linux-kernel
In-Reply-To: <20230725205933.yqvdy3h7hewbjosy@skbuf>
On Tue, Jul 25, 2023, at 22:59, Vladimir Oltean wrote:
> On Tue, Jul 25, 2023 at 10:39:40PM +0200, Arnd Bergmann wrote:
>> From: Arnd Bergmann <arnd@arndb.de>
>>
>> Each object file contains information about which module it gets linked
>> into, so linking the same file into multiple modules now causes a warning:
A recent change broke my earlier patch, and I noticed I had this
version sitting in my randconfig tree for multiple years now, so
I refreshed it now, sorry for dropping the ball earlier.
>> scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpaa2-mac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch
>> scripts/Makefile.build:254: drivers/net/ethernet/freescale/dpaa2/Makefile: dpmac.o is added to multiple modules: fsl-dpaa2-eth fsl-dpaa2-switch
>>
>> Chang the way that dpaa2 is built by moving the two common files into a
>> separate module with exported symbols instead.
>>
>> To avoid a link failure when the switch driver is built-in, but the dpio driver
>> is a loadable module, add the same dependency in there that exists for
>> the ethernet driver.
>
> Unrelated change should be separate.
This was fixed independently and is gone from v3
> There was a previous attempt at this before, by Alexander Lobakin:
> https://patchwork.kernel.org/project/netdevbpf/patch/20221119225650.1044591-16-alobakin@pm.me/
>
> but it seems he wasn't persistent enough with it.
>
> Something which I liked better in his proposal was the naming of the
> config option (FSL_DPAA2_MAC) and of the new module (fsl-dpaa2-mac).
I renamed the module, but did not introduce a Kconfig symbol.
The same thing can be done either using Kconfig or Makefile
logic, and I just kept my previous approach here.
>> -obj-$(CONFIG_FSL_DPAA2_ETH) += fsl-dpaa2-eth.o
>> +obj-$(CONFIG_FSL_DPAA2_ETH) += fsl-dpaa2-eth.o fsl-dpaa2-common.o
>> obj-$(CONFIG_FSL_DPAA2_PTP_CLOCK) += fsl-dpaa2-ptp.o
>> -obj-$(CONFIG_FSL_DPAA2_SWITCH) += fsl-dpaa2-switch.o
>> +obj-$(CONFIG_FSL_DPAA2_SWITCH) += fsl-dpaa2-switch.o fsl-dpaa2-common.o
>
> I am not completely sure how this works. Can fsl-dpaa2-common appear
> both in obj-y (added by $(CONFIG_FSL_DPAA2_ETH)) and in obj-m (added by
> $(CONFIG_FSL_DPAA2_SWITCH))? Olek proposed the introduction of a new,
> hidden and selectable tristate FSL_DPAA2_MAC. At least I understand how
> that works.
Yes, this is a Kbuild feature: if a module is both obj-y and obj-m, it
is built into the kernel and the second one is dropped. The effect is
exactly equivalent to having a silent Kconfig symbol FSL_DPAA2_MAC
that is selected by both others.
>> +
>> +MODULE_LICENSE("GPL");
>> +MODULE_DESCRIPTION("DPAA2 Ethernet core library");
>
> s/core/MAC/ everywhere
Done.
Arnd
^ permalink raw reply
* Re: [PATCH net 0/5] net/sched: netem: bug fixes found during AI-assisted review
From: Jakub Kicinski @ 2026-03-30 14:10 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev
In-Reply-To: <20260328182336.392817-1-stephen@networkplumber.org>
On Sat, 28 Mar 2026 11:21:44 -0700 Stephen Hemminger wrote:
> These bugs were identified while using AI-assisted code review of
> sch_netem.c to analyze the packet duplication re-entrancy problem
> (CVE-2025-37890, CVE-2025-38001), which are addressed in a separate
> series.
TDC still failing after dropping the net-next series so I swapped
it for this one.
^ permalink raw reply
* Re: [PATCH net-next v2 3/3] net: mdio: treat PSE EPROBE_DEFER as non-fatal during PHY registration
From: Andrew Lunn @ 2026-03-30 14:11 UTC (permalink / raw)
To: Carlo Szelinsky
Cc: Kory Maincent, Oleksij Rempel, Andrew Lunn, Heiner Kallweit,
Russell King, Jakub Kicinski, David S . Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, netdev, linux-kernel
In-Reply-To: <20260330132952.2950531-4-github@szelinsky.de>
> Treat -EPROBE_DEFER as non-fatal, allowing the PHY to register
> successfully with psec=NULL. The PSE control can be resolved lazily
> when first needed.
Is there a reason not to do lazily resolution all the time?
Andrew
^ permalink raw reply
* Re: [PATCH] selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test
From: Long Xin @ 2026-03-30 14:16 UTC (permalink / raw)
To: Yi Chen
Cc: Pablo Neira Ayuso, Florian Westphal, Phil Sutter,
David S . Miller, Jakub Kicinski, Eric Dumazet, Paolo Abeni,
Simon Horman, Shuah Khan, coreteam, netfilter-devel,
linux-kselftest, linux-kernel, netdev
In-Reply-To: <20260330113509.23990-1-yiche@redhat.com>
On Mon, Mar 30, 2026 at 7:35 AM Yi Chen <yiche@redhat.com> wrote:
>
> The existing test covered a scenario where a delayed INIT_ACK chunk
> updates the vtag in conntrack after the association has already been
> established.
>
> A similar issue can occur with a delayed SCTP INIT chunk.
>
> Add a new simultaneous-open test case where the client's INIT is
> delayed, allowing conntrack to establish the association based on
> the server-initiated handshake.
>
> When the stale INIT arrives later, it may overwirte the vtag in
> conntrack, causing subsequent SCTP DATA chunks to be considered
> as invalid and then dropped by nft rules matching on ct state invalid.
>
> This test verifies such stale INIT chunks do not corrupt conntrack
> state.
>
> Signed-off-by: Yi Chen <yiche@redhat.com>
Thanks for the patch, plase see comment below.
> ---
> .../net/netfilter/conntrack_sctp_collision.sh | 84 ++++++++++++++-----
> 1 file changed, 65 insertions(+), 19 deletions(-)
>
> diff --git a/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh b/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh
> index d860f7d9744b..7f8f1b6b746a 100755
> --- a/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh
> +++ b/tools/testing/selftests/net/netfilter/conntrack_sctp_collision.sh
> @@ -23,8 +23,19 @@ SERVER_PORT=1234
> CLIENT_GW="198.51.200.2"
> SERVER_GW="198.51.100.2"
>
> +assert_pass()
> +{
> + local ret=$?
> + if [ $ret != 0 ]; then
> + echo "FAIL: ${@}"
> + exit $ksft_fail
You should not print FAIL and exit $ksft_fail if ret is $ksft_skip
(The test case was skipped).
> + else
> + echo "PASS: ${@}"
> + fi
> +}
> +
> # setup the topo
> -setup() {
> +topo_setup() {
> setup_ns CLIENT_NS SERVER_NS ROUTER_NS
> ip -n "$SERVER_NS" link add link0 type veth peer name link1 netns "$ROUTER_NS"
> ip -n "$CLIENT_NS" link add link3 type veth peer name link2 netns "$ROUTER_NS"
> @@ -42,21 +53,51 @@ setup() {
> ip -n "$CLIENT_NS" link set link3 up
> ip -n "$CLIENT_NS" addr add $CLIENT_IP/24 dev link3
> ip -n "$CLIENT_NS" route add $SERVER_IP dev link3 via $CLIENT_GW
> +}
>
> - # simulate the delay on OVS upcall by setting up a delay for INIT_ACK with
> - # tc on $SERVER_NS side
> - tc -n "$SERVER_NS" qdisc add dev link0 root handle 1: htb r2q 64
> - tc -n "$SERVER_NS" class add dev link0 parent 1: classid 1:1 htb rate 100mbit
> - tc -n "$SERVER_NS" filter add dev link0 parent 1: protocol ip u32 match ip protocol 132 \
> - 0xff match u8 2 0xff at 32 flowid 1:1
> - if ! tc -n "$SERVER_NS" qdisc add dev link0 parent 1:1 handle 10: netem delay 1200ms; then
> - echo "SKIP: Cannot add netem qdisc"
> - exit $ksft_skip
> - fi
> +conf_delay()
> +{
> + # simulate the delay on OVS upcall by setting up a delay for INIT_ACK/INIT with
> + case $1 in
> + "INIT") chunk_type=1
> + # tc on $CLIENT_NS side
> + tc -n "$CLIENT_NS" qdisc add dev link3 root handle 1: htb r2q 64
> + tc -n "$CLIENT_NS" class add dev link3 parent 1: classid 1:1 htb rate 100mbit
> + tc -n "$CLIENT_NS" filter add dev link3 parent 1: protocol ip \
> + u32 match ip protocol 132 0xff match u8 $chunk_type 0xff at 32 flowid 1:1
> + if ! tc -n "$CLIENT_NS" qdisc add dev link3 parent 1:1 handle 10: \
> + netem delay 1200ms; then
> + echo "SKIP: Cannot add netem qdisc"
> + exit $ksft_skip
> + fi
> + ;;
> + "INIT_ACK") chunk_type=2
> + # tc on $SERVER_NS side
> + tc -n "$SERVER_NS" qdisc add dev link0 root handle 1: htb r2q 64
> + tc -n "$SERVER_NS" class add dev link0 parent 1: classid 1:1 htb rate 100mbit
> + tc -n "$SERVER_NS" filter add dev link0 parent 1: protocol ip \
> + u32 match ip protocol 132 0xff match u8 $chunk_type 0xff at 32 flowid 1:1
> + if ! tc -n "$SERVER_NS" qdisc add dev link0 parent 1:1 handle 10: \
> + netem delay 1200ms; then
> + echo "SKIP: Cannot add netem qdisc"
> + exit $ksft_skip
> + fi
> + ;;
> + esac
The code of case "INIT" and "INIT_ACK" are pretty simliar, please try
to move the tc command out of the case statement with $ns and $link.
>
> # simulate the ctstate check on OVS nf_conntrack
> - ip net exec "$ROUTER_NS" iptables -A FORWARD -m state --state INVALID,UNTRACKED -j DROP
> - ip net exec "$ROUTER_NS" iptables -A INPUT -p sctp -j DROP
> + ip net exec "$ROUTER_NS" nft -f - <<-EOF
> + table ip t {
> + chain forward {
> + type filter hook forward priority filter; policy accept;
> + meta l4proto { icmp, icmpv6 } accept
> + ct state new counter accept
> + ct state established,related counter accept
> + ct state invalid log flags all counter drop
> + counter
> + }
> + }
> + EOF
I think you need to check if 'nft' is available
Either in here by:
if [ $? -ne 0 ]; then
echo -n "SKIP: Could not load ruleset: "
nft --version
exit $ksft_skip
fi
Or at the beginning by:
checktool "nft --version" "run test without nft tool"
>
> # use a smaller number for assoc's max_retrans to reproduce the issue
> modprobe -q sctp
> @@ -64,8 +105,6 @@ setup() {
> }
>
> cleanup() {
> - ip net exec "$CLIENT_NS" pkill sctp_collision >/dev/null 2>&1
> - ip net exec "$SERVER_NS" pkill sctp_collision >/dev/null 2>&1
> cleanup_all_ns
> }
>
> @@ -81,7 +120,14 @@ do_test() {
>
> # run the test case
> trap cleanup EXIT
> -setup && \
> -echo "Test for SCTP Collision in nf_conntrack:" && \
> -do_test && echo "PASS!"
> -exit $?
> +
> +echo "Test for SCTP INIT_ACK Collision in nf_conntrack:"
> +topo_setup && conf_delay INIT_ACK
How will the error returned from conf_delay() be handled?
> +do_test
> +assert_pass "The delayed INIT_ACK chunk did not disrupt sctp ct tracking."
> +
> +echo "Test for SCTP INIT Collision in nf_conntrack:"
> +
> +topo_setup && conf_delay INIT
> +do_test
> +assert_pass "The delayed INIT chunk did not disrupt sctp ct tracking."
> --
> 2.53.0
>
The current kernel will fail with this test case, please hold the patch
until the fix is submitted. It is still in testing, as you already know.
thanks.
^ permalink raw reply
* Re: [PATCH RFC net-next] usb: gadget: u_ether: fix eth_get_drvinfo() oops
From: Greg Kroah-Hartman @ 2026-03-30 14:21 UTC (permalink / raw)
To: Russell King (Oracle)
Cc: Guilherme G. Piccoli, Kees Cook, linux-usb, netdev, Tony Luck
In-Reply-To: <E1w6oNQ-0000000ER1E-43NU@rmk-PC.armlinux.org.uk>
On Sun, Mar 29, 2026 at 12:32:20PM +0100, Russell King (Oracle) wrote:
> The following oops was observed on the nVidia Jetson Xavier NX1
> platform with 7.0.0-rc5, which is caused by dev->gadget becoming NULL
> while the u_ether device is still visible to userspace. Adding some
> debug reveals that we see this sequence:
>
> net usb1: gadget detached
> tegra-xudc 3550000.usb: ep 0 disabled
> net usb1: no gadget for drvinfo
> usb1 (unregistering): left allmulticast mode
> usb1 (unregistering): left promiscuous mode
> l4tbr0: port 2(usb1) entered disabled state
>
> Put a sticky plaster over this (it's racy!) I suspect
> gether_detach_gadget() needs to at least take the RTNL as well to
> prevent ethtool ops running concurrently with the gadget being
> detached.
>
> Unable to handle kernel NULL pointer dereference at virtual address 000000000000
> 00d0
> Mem abort info:
> ESR = 0x0000000096000004
> EC = 0x25: DABT (current EL), IL = 32 bits
> SET = 0, FnV = 0
> EA = 0, S1PTW = 0
> FSC = 0x04: level 0 translation fault
> Data abort info:
> ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
> CM = 0, WnR = 0, TnD = 0, TagAccess = 0
> GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
> user pgtable: 4k pages, 48-bit VAs, pgdp=00000001086b1000
> [00000000000000d0] pgd=0000000000000000, p4d=0000000000000000
> Internal error: Oops: 0000000096000004 [#1] SMP
> Modules linked in: snd_soc_tegra210_mvc snd_soc_tegra186_asrc snd_soc_tegra210_m
> ixer snd_soc_tegra210_admaif snd_soc_tegra_pcm snd_soc_tegra210_ope snd_soc_tegr
> a186_dspk snd_soc_tegra210_i2s snd_soc_simple_card_utils snd_soc_tegra210_dmic s
> nd_soc_tegra210_amx snd_soc_tegra210_adx snd_soc_tegra210_sfc rtw88_8822ce rtw88
> _8822c rtw88_pci rtw88_core mac80211 libarc4 sha256 cfg80211 snd_soc_tegra210_ah
> ub snd_soc_core snd_pcm_dmaengine snd_pcm snd_timer tegra210_adma zram tegra_drm
> zsmalloc usb_f_ncm syscopyarea usb_f_mass_storage drm_client_lib sysfillrect sy
> simgblt ramoops fb_sys_fops reed_solomon nls_iso8859_1 drm_display_helper nls_cp437 vfat drm_kms_helper fb fat cec drm_dp_aux_bus tegra_aconnect usb_f_acm u_serial usb_f_rndis u_ether max77620_wdt realtek tegra_xudc phy_package snd phy_tegra194_p2u dwmac_dwc_qos_eth soundcore stmmac_platform pwm_tegra rtc_efi tegra186_gpc_dma virt_dma tegra_bpmp_thermal host1x pcie_tegra194 libcomposite udc_core drm drm_panel_orientation_quirks backlight efivarfs ip_tables
> x_tables
> CPU: 1 UID: 0 PID: 4181 Comm: systemd-udevd Not tainted 7.0.0-rc5-net-next+ #640 PREEMPT
> Hardware name: NVIDIA NVIDIA Jetson Xavier NX Developer Kit/Jetson, BIOS 6.0-37391689 08/28/2024
> pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : eth_get_drvinfo+0x4c/0x80 [u_ether]
> lr : eth_get_drvinfo+0x40/0x80 [u_ether]
> sp : ffff80008484bb60
> x29: ffff80008484bb60 x28: ffff000083de18c0 x27: 0000000000000000
> x26: 0000000000000000 x25: ffff0000947da0a8 x24: 0000000000004000
> x23: ffff0000a38a5600 x22: 0000000000000000 x21: ffff80007a3a5558
> x20: ffff0000947da000 x19: ffff0000a38a5608 x18: 0000000000000000
> x17: 0000000000000000 x16: 0000000000000000 x15: 0000ffffe09af760
> x14: 0000000000000000 x13: 0000000000000020 x12: 0101010101010101
> x11: 7f7f7f7f7f7f7f7f x10: 00007ffff0071c50 x9 : 0000000000000020
> x8 : 0101010101010101 x7 : ffff0000a38a5634 x6 : fefefefefefefeff
> x5 : ffff0000a38a562c x4 : 0000000000383030 x3 : 0000000000383030
> x2 : 0000000000000020 x1 : 0000000000000000 x0 : ffff0000a38a564c
> Call trace:
> eth_get_drvinfo+0x4c/0x80 [u_ether] (P)
> ethtool_get_drvinfo+0x54/0x1e0
> __dev_ethtool+0x698/0x2000
> dev_ethtool+0x90/0x1a0
> dev_ioctl+0x37c/0x594
> sock_ioctl+0x390/0x5bc
> __arm64_sys_ioctl+0x408/0xeb4
> invoke_syscall.constprop.0+0x50/0xe0
> do_el0_svc+0x40/0xc0
> el0_svc+0x48/0x2a0
> el0t_64_sync_handler+0xa0/0xe4
> el0t_64_sync+0x19c/0x1a0
> Code: 95a68811 f9468a81 d2800402 91011260 (f9406821)
> ---[ end trace 0000000000000000 ]---
>
> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
> ---
>
> 1. get_maintainers.pl is picking up on the PSTORE folk because of the
> mention of "ramoops" in the commit message... even though this has
> nothing to do with them.
>
> 2. I think there's more bugs here as mentioned in the commit message,
> since setting dev->gadget to NULL without taking any locking while
> the u_ether device is still published to userspace looks mightily
> dangerous. Seems to be another kernel driver that fails to obey the
> basics discussed in OLS some twenty years ago concerning the order
> of setup/publish/unpublish/teardown... and we still don't seem to
> be able to get it right. :(
>
> 3. Patch generated against the net-next tree, because that's what I'm
> working with being focussed on stmmac at the moment - but I would like
> my test platform not to oops and reboot itself when I instead want it
> to power off.
>
> drivers/usb/gadget/function/u_ether.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
> index 1a9e7c495e2e..d1ae91889537 100644
> --- a/drivers/usb/gadget/function/u_ether.c
> +++ b/drivers/usb/gadget/function/u_ether.c
> @@ -113,6 +113,10 @@ static void eth_get_drvinfo(struct net_device *net, struct ethtool_drvinfo *p)
>
> strscpy(p->driver, "g_ether", sizeof(p->driver));
> strscpy(p->version, UETH__VERSION, sizeof(p->version));
> +
> + if (!dev->gadget)
> + return;
> +
> strscpy(p->fw_version, dev->gadget->name, sizeof(p->fw_version));
> strscpy(p->bus_info, dev_name(&dev->gadget->dev), sizeof(p->bus_info));
> }
Looks semi-sane, I'll pick this up through the USB tree now.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH v2 10/13] nfsd: add netlink upcall for the svc_export cache
From: Chuck Lever @ 2026-03-30 14:22 UTC (permalink / raw)
To: Jeff Layton, Chuck Lever, NeilBrown, Olga Kornievskaia, Dai Ngo,
Tom Talpey, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Donald Hunter
Cc: Trond Myklebust, Anna Schumaker, linux-nfs, linux-kernel, netdev
In-Reply-To: <20260325-exportd-netlink-v2-10-067df016ea95@kernel.org>
On Wed, Mar 25, 2026, at 10:40 AM, Jeff Layton wrote:
> Add netlink-based cache upcall support for the svc_export (nfsd.export)
> cache to Documentation/netlink/specs/nfsd.yaml and regenerate the
> resulting files.
> diff --git a/Documentation/netlink/specs/nfsd.yaml
> b/Documentation/netlink/specs/nfsd.yaml
> index
> 8ab43c8253b2e83bcc178c3f4fe8c41c2997d153..709751502f8b56bd4b68462fa15337df5e3e035e
> 100644
> --- a/Documentation/netlink/specs/nfsd.yaml
> +++ b/Documentation/netlink/specs/nfsd.yaml
> @@ -6,7 +6,51 @@ uapi-header: linux/nfsd_netlink.h
>
> doc: NFSD configuration over generic netlink.
>
> +definitions:
> + -
> + type: flags
> + name: cache-type
> + entries: [svc_export]
> + -
> + type: flags
> + name: export-flags
> + doc: These flags are ordered to match the NFSEXP_* flags in
> include/linux/nfsd/export.h
> + entries:
> + - readonly
> + - insecure-port
> + - rootsquash
> + - allsquash
> + - async
> + - gathered-writes
> + - noreaddirplus
> + - security-label
> + - sign-fh
> + - nohide
> + - nosubtreecheck
> + - noauthnlm
> + - msnfs
> + - fsid
> + - crossmount
> + - noacl
> + - v4root
> + - pnfs
> + -
> + type: flags
> + name: xprtsec-mode
> + doc: These flags are ordered to match the NFSEXP_XPRTSEC_* flags
> in include/linux/nfsd/export.h
> + entries:
> + - none
> + - tls
> + - mtls
> +
> attribute-sets:
> + -
> + name: cache-notify
> + attributes:
> + -
> + name: cache-type
> + type: u32
> + enum: cache-type
> -
> name: rpc-status
> attributes:
> @@ -132,6 +176,103 @@ attribute-sets:
> -
> name: npools
> type: u32
> + -
> + name: fslocation
> + attributes:
> + -
> + name: host
> + type: string
> + -
> + name: path
> + type: string
> + -
> + name: fslocations
> + attributes:
> + -
> + name: location
> + type: nest
> + nested-attributes: fslocation
> + multi-attr: true
> + -
> + name: auth-flavor
> + attributes:
> + -
> + name: pseudoflavor
> + type: u32
> + -
> + name: flags
> + type: u32
> + enum: export-flags
> + enum-as-flags: true
> + -
> + name: svc-export-req
> + attributes:
> + -
> + name: seqno
> + type: u64
> + -
> + name: client
> + type: string
> + -
> + name: path
> + type: string
Is the svc-export-req attribute set used for anything?
> + -
> + name: svc-export
> + attributes:
> + -
> + name: seqno
> + type: u64
> + -
> + name: client
> + type: string
> + -
> + name: path
> + type: string
> + -
> + name: negative
> + type: flag
> + -
> + name: expiry
> + type: u64
> + -
> + name: anon-uid
> + type: u32
> + -
> + name: anon-gid
> + type: u32
> + -
> + name: fslocations
> + type: nest
> + nested-attributes: fslocations
> + -
> + name: uuid
> + type: binary
> + -
> + name: secinfo
> + type: nest
> + nested-attributes: auth-flavor
> + multi-attr: true
> + -
> + name: xprtsec
> + type: u32
> + enum: xprtsec-mode
> + multi-attr: true
> + -
> + name: flags
> + type: u32
> + enum: export-flags
> + enum-as-flags: true
> + -
> + name: fsid
> + type: s32
> + -
> + name: svc-export-reqs
> + attributes:
> + -
> + name: requests
> + type: nest
> + nested-attributes: svc-export
> + multi-attr: true
>
> operations:
> list:
> @@ -233,3 +374,36 @@ operations:
> attributes:
> - mode
> - npools
> + -
> + name: cache-notify
> + doc: Notification that there are cache requests that need
> servicing
> + attribute-set: cache-notify
> + mcgrp: exportd
> + event:
> + attributes:
> + - cache-type
> + -
> + name: svc-export-get-reqs
> + doc: Dump all pending svc_export requests
> + attribute-set: svc-export-reqs
> + flags: [admin-perm]
> + dump:
> + request:
> + attributes:
> + - requests
> + -
> + name: svc-export-set-reqs
> + doc: Respond to one or more svc_export requests
> + attribute-set: svc-export-reqs
> + flags: [admin-perm]
> + do:
> + request:
> + attributes:
> + - requests
> +
> +mcast-groups:
> + list:
> + -
> + name: none
> + -
> + name: exportd
--
Chuck Lever
^ permalink raw reply
* Re: [PATCH v3] net: caif: fix stack out-of-bounds write in cfctrl_link_setup()
From: kernel test robot @ 2026-03-30 14:24 UTC (permalink / raw)
To: Kangzheng Gu, davem, edumazet, kuba, pabeni, horms, kees,
thorsten.blum, arnd, sjur.brandeland
Cc: llvm, oe-kbuild-all, netdev, linux-kernel, stable
In-Reply-To: <20260329190350.19065-1-xiaoguai0992@gmail.com>
Hi Kangzheng,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main soc/for-next linus/master v7.0-rc6 next-20260327]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Kangzheng-Gu/net-caif-fix-stack-out-of-bounds-write-in-cfctrl_link_setup/20260330-163130
base: net-next/main
patch link: https://lore.kernel.org/r/20260329190350.19065-1-xiaoguai0992%40gmail.com
patch subject: [PATCH v3] net: caif: fix stack out-of-bounds write in cfctrl_link_setup()
config: hexagon-randconfig-001-20260330 (https://download.01.org/0day-ci/archive/20260330/202603302217.BEd0DrgM-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project 2cd67b8b69f78e3f95918204320c3075a74ba16c)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260330/202603302217.BEd0DrgM-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202603302217.BEd0DrgM-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> net/caif/cfctrl.c:423:6: warning: format specifies type 'unsigned long' but the argument has type '__size_t' (aka 'unsigned int') [-Wformat]
422 | pr_warn("Request reject, volume name length exceeds %lu\n",
| ~~~
| %zu
423 | sizeof(linkparam.u.rfm.volume));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include/linux/printk.h:564:37: note: expanded from macro 'pr_warn'
564 | printk(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:511:60: note: expanded from macro 'printk'
511 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ~~~ ^~~~~~~~~~~
include/linux/printk.h:483:19: note: expanded from macro 'printk_index_wrap'
483 | _p_func(_fmt, ##__VA_ARGS__); \
| ~~~~ ^~~~~~~~~~~
1 warning generated.
vim +423 net/caif/cfctrl.c
351
352 static int cfctrl_link_setup(struct cfctrl *cfctrl, struct cfpkt *pkt, u8 cmdrsp)
353 {
354 u8 len;
355 u8 linkid = 0;
356 enum cfctrl_srv serv;
357 enum cfctrl_srv servtype;
358 u8 endpoint;
359 u8 physlinkid;
360 u8 prio;
361 u8 tmp;
362 u8 *cp;
363 int i;
364 struct cfctrl_link_param linkparam;
365 struct cfctrl_request_info rsp, *req;
366
367 memset(&linkparam, 0, sizeof(linkparam));
368
369 tmp = cfpkt_extr_head_u8(pkt);
370
371 serv = tmp & CFCTRL_SRV_MASK;
372 linkparam.linktype = serv;
373
374 servtype = tmp >> 4;
375 linkparam.chtype = servtype;
376
377 tmp = cfpkt_extr_head_u8(pkt);
378 physlinkid = tmp & 0x07;
379 prio = tmp >> 3;
380
381 linkparam.priority = prio;
382 linkparam.phyid = physlinkid;
383 endpoint = cfpkt_extr_head_u8(pkt);
384 linkparam.endpoint = endpoint & 0x03;
385
386 switch (serv) {
387 case CFCTRL_SRV_VEI:
388 case CFCTRL_SRV_DBG:
389 if (CFCTRL_ERR_BIT & cmdrsp)
390 break;
391 /* Link ID */
392 linkid = cfpkt_extr_head_u8(pkt);
393 break;
394 case CFCTRL_SRV_VIDEO:
395 tmp = cfpkt_extr_head_u8(pkt);
396 linkparam.u.video.connid = tmp;
397 if (CFCTRL_ERR_BIT & cmdrsp)
398 break;
399 /* Link ID */
400 linkid = cfpkt_extr_head_u8(pkt);
401 break;
402
403 case CFCTRL_SRV_DATAGRAM:
404 linkparam.u.datagram.connid = cfpkt_extr_head_u32(pkt);
405 if (CFCTRL_ERR_BIT & cmdrsp)
406 break;
407 /* Link ID */
408 linkid = cfpkt_extr_head_u8(pkt);
409 break;
410 case CFCTRL_SRV_RFM:
411 /* Construct a frame, convert
412 * DatagramConnectionID
413 * to network format long and copy it out...
414 */
415 linkparam.u.rfm.connid = cfpkt_extr_head_u32(pkt);
416 cp = (u8 *) linkparam.u.rfm.volume;
417 for (tmp = cfpkt_extr_head_u8(pkt);
418 cfpkt_more(pkt) && tmp != '\0';
419 tmp = cfpkt_extr_head_u8(pkt)) {
420 if (cp >= (u8 *)linkparam.u.rfm.volume +
421 sizeof(linkparam.u.rfm.volume) - 1) {
422 pr_warn("Request reject, volume name length exceeds %lu\n",
> 423 sizeof(linkparam.u.rfm.volume));
424 cmdrsp |= CFCTRL_ERR_BIT;
425 break;
426 }
427 *cp++ = tmp;
428 }
429 *cp = '\0';
430
431 if (CFCTRL_ERR_BIT & cmdrsp)
432 break;
433 /* Link ID */
434 linkid = cfpkt_extr_head_u8(pkt);
435
436 break;
437 case CFCTRL_SRV_UTIL:
438 /* Construct a frame, convert
439 * DatagramConnectionID
440 * to network format long and copy it out...
441 */
442 /* Fifosize KB */
443 linkparam.u.utility.fifosize_kb = cfpkt_extr_head_u16(pkt);
444 /* Fifosize bufs */
445 linkparam.u.utility.fifosize_bufs = cfpkt_extr_head_u16(pkt);
446 /* name */
447 cp = (u8 *) linkparam.u.utility.name;
448 caif_assert(sizeof(linkparam.u.utility.name)
449 >= UTILITY_NAME_LENGTH);
450 for (i = 0; i < UTILITY_NAME_LENGTH && cfpkt_more(pkt); i++) {
451 tmp = cfpkt_extr_head_u8(pkt);
452 *cp++ = tmp;
453 }
454 /* Length */
455 len = cfpkt_extr_head_u8(pkt);
456 linkparam.u.utility.paramlen = len;
457 /* Param Data */
458 cp = linkparam.u.utility.params;
459 while (cfpkt_more(pkt) && len--) {
460 tmp = cfpkt_extr_head_u8(pkt);
461 *cp++ = tmp;
462 }
463 if (CFCTRL_ERR_BIT & cmdrsp)
464 break;
465 /* Link ID */
466 linkid = cfpkt_extr_head_u8(pkt);
467 /* Length */
468 len = cfpkt_extr_head_u8(pkt);
469 /* Param Data */
470 cfpkt_extr_head(pkt, NULL, len);
471 break;
472 default:
473 pr_warn("Request setup, invalid type (%d)\n", serv);
474 return -1;
475 }
476
477 rsp.cmd = CFCTRL_CMD_LINK_SETUP;
478 rsp.param = linkparam;
479 spin_lock_bh(&cfctrl->info_list_lock);
480 req = cfctrl_remove_req(cfctrl, &rsp);
481
482 if (CFCTRL_ERR_BIT == (CFCTRL_ERR_BIT & cmdrsp) ||
483 cfpkt_erroneous(pkt)) {
484 pr_err("Invalid O/E bit or parse error "
485 "on CAIF control channel\n");
486 cfctrl->res.reject_rsp(cfctrl->serv.layer.up, 0,
487 req ? req->client_layer : NULL);
488 } else {
489 cfctrl->res.linksetup_rsp(cfctrl->serv.layer.up, linkid,
490 serv, physlinkid,
491 req ? req->client_layer : NULL);
492 }
493
494 kfree(req);
495
496 spin_unlock_bh(&cfctrl->info_list_lock);
497
498 return 0;
499 }
500
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH v24 10/11] cxl: Avoid dax creation for accelerators
From: Alejandro Lucero Palau @ 2026-03-30 14:26 UTC (permalink / raw)
To: Alison Schofield, alejandro.lucero-palau
Cc: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet, Jonathan Cameron, Davidlohr Bueso,
Ben Cheatham
In-Reply-To: <acNPnzDryNIQlTFS@aschofie-mobl2.lan>
On 3/25/26 02:59, Alison Schofield wrote:
> On Mon, Mar 23, 2026 at 11:31:16AM +0000, alejandro.lucero-palau@amd.com wrote:
>> From: Alejandro Lucero <alucerop@amd.com>
>>
>> By definition a type2 cxl device will use the host managed memory for
>> specific functionality, therefore it should not be available to other
>> uses.
> Hi Alejandro,
>
> I'm wondering if we're skipping too much, or perhaps just needs
> a clarifying comment?
>
> Commit message says 'Avoid dax creation...', that's specific.
>
> Commit log says 'should not be available to other uses', that's less specific
Hi Allison,
Would you prefer something like "should not be available to other uses
like DAX".?
> follow me ...
>
>> Signed-off-by: Alejandro Lucero <alucerop@amd.com>
>> Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
>> Reviewed-by: Davidlohr Bueso <daves@stgolabs.net>
>> Reviewed-by: Dave Jiang <dave.jiang@intel.com>
>> Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
>> ---
>> drivers/cxl/core/region.c | 7 +++++++
>> 1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
>> index 8bb53a095290..2f9bdb4f1f4f 100644
>> --- a/drivers/cxl/core/region.c
>> +++ b/drivers/cxl/core/region.c
>> @@ -4263,6 +4263,13 @@ static int cxl_region_probe(struct device *dev)
>> if (rc)
>> return rc;
>>
>> + /*
>> + * HDM-D[B] (device-memory) regions have accelerator specific usage.
>> + * Skip device-dax registration.
>> + */
>> + if (cxlr->type == CXL_DECODER_DEVMEM)
>> + return 0;
>> +
> And above says 'Skip device-dax' specific again, and is indeed skipped.
>
> This escape is not surgically placed at the point where dax is added.
> We are skipping a few other things before dax registration actually
> happens. Why skip memory notifiers, shutdown_notifiers, poison setup?
posion setup crashes with a type2 and I'm not sure if the memory
notifiers make sense for Type2.
If it is really needed, I would prefer to support it as a follow up.
Thank you
>
>> /*
>> * From this point on any path that changes the region's state away from
>> * CXL_CONFIG_COMMIT is also responsible for releasing the driver.
>> --
>> 2.34.1
>>
>>
^ permalink raw reply
* [PATCH 1/1] lib/zlib: use atomic GCOV counters to prevent crash in inflate_fast
From: Konstantin Khorenko @ 2026-03-30 14:32 UTC (permalink / raw)
To: Peter Oberparleiter, Mikhail Zaslonko
Cc: Steffen Klassert, Herbert Xu, Masahiro Yamada, Josh Poimboeuf,
Vasileios Almpanis, Pavel Tikhomirov, linux-kernel, netdev,
Konstantin Khorenko
In-Reply-To: <20260330143256.306326-1-khorenko@virtuozzo.com>
GCC's GCOV instrumentation can merge global branch counters with loop
induction variables as an optimization. In inflate_fast(), the inner
copy loops can be transformed so that GCOV counter values participate
in computing loop addresses and bounds. Since GCOV counters are global
(not per-CPU), concurrent execution on different CPUs causes the counter
to change mid-computation, producing inconsistent address calculations
and out-of-bounds memory writes.
The crash manifests during IPComp (IP Payload Compression) processing
when inflate_fast() runs concurrently on multiple CPUs:
BUG: unable to handle page fault for address: ffffd0a3c0902ffa
RIP: inflate_fast+1431
Call Trace:
zlib_inflate
__deflate_decompress
crypto_comp_decompress
ipcomp_decompress [xfrm_ipcomp]
ipcomp_input [xfrm_ipcomp]
xfrm_input
In one observed case, the compiler merged a global GCOV counter with the
loop induction variable that also indexed stores. Another CPU modified
the counter between the setup and iteration phases, causing a write
3.4 MB past the end of a 65 KB buffer.
The kernel already uses -fno-tree-loop-im for GCOV builds (commit
2b40e1ea76d4) to prevent a different optimization issue. That flag
prevents GCC from hoisting loop-invariant memory operations but does
NOT prevent the IVopts pass from merging counters with induction
variables.
Add -fprofile-update=atomic to zlib Makefiles. This tells GCC that
GCOV counters may be concurrently accessed, causing counter updates to
use atomic instructions (lock addq) instead of plain load/store.
This prevents the compiler from merging counters with loop induction
variables. The flag is scoped to zlib only to minimize performance
overhead from atomic operations in the rest of the kernel.
Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
Reviewed-by: Vasileios Almpanis <vasileios.almpanis@virtuozzo.com>
Reviewed-by: Pavel Tikhomirov <ptikhomirov@virtuozzo.com>
---
lib/zlib_deflate/Makefile | 6 ++++++
lib/zlib_dfltcc/Makefile | 6 ++++++
lib/zlib_inflate/Makefile | 7 +++++++
3 files changed, 19 insertions(+)
diff --git a/lib/zlib_deflate/Makefile b/lib/zlib_deflate/Makefile
index 2622e03c0b942..dc0b3e5660e9e 100644
--- a/lib/zlib_deflate/Makefile
+++ b/lib/zlib_deflate/Makefile
@@ -7,6 +7,12 @@
# decompression code.
#
+# Force atomic GCOV counter updates to prevent GCC from merging global
+# counters with loop induction variables (see lib/zlib_inflate/Makefile).
+ifdef CONFIG_GCOV_KERNEL
+ccflags-y += -fprofile-update=atomic
+endif
+
obj-$(CONFIG_ZLIB_DEFLATE) += zlib_deflate.o
zlib_deflate-objs := deflate.o deftree.o deflate_syms.o
diff --git a/lib/zlib_dfltcc/Makefile b/lib/zlib_dfltcc/Makefile
index 66e1c96387c40..fb08749d2ee7b 100644
--- a/lib/zlib_dfltcc/Makefile
+++ b/lib/zlib_dfltcc/Makefile
@@ -6,6 +6,12 @@
# This is the code for s390 zlib hardware support.
#
+# Force atomic GCOV counter updates to prevent GCC from merging global
+# counters with loop induction variables (see lib/zlib_inflate/Makefile).
+ifdef CONFIG_GCOV_KERNEL
+ccflags-y += -fprofile-update=atomic
+endif
+
obj-$(CONFIG_ZLIB_DFLTCC) += zlib_dfltcc.o
zlib_dfltcc-objs := dfltcc.o dfltcc_deflate.o dfltcc_inflate.o
diff --git a/lib/zlib_inflate/Makefile b/lib/zlib_inflate/Makefile
index 27327d3e9f541..8707c649adda5 100644
--- a/lib/zlib_inflate/Makefile
+++ b/lib/zlib_inflate/Makefile
@@ -14,6 +14,13 @@
# uncompression can be done without blocking on allocation).
#
+# Force atomic GCOV counter updates to prevent GCC from merging global
+# counters with loop induction variables — concurrent inflate_fast()
+# execution on multiple CPUs causes out-of-bounds writes otherwise.
+ifdef CONFIG_GCOV_KERNEL
+ccflags-y += -fprofile-update=atomic
+endif
+
obj-$(CONFIG_ZLIB_INFLATE) += zlib_inflate.o
zlib_inflate-objs := inffast.o inflate.o infutil.o \
--
2.43.0
^ permalink raw reply related
* [PATCH 0/1] lib/zlib: fix GCOV-induced crashes from concurrent inflate_fast()
From: Konstantin Khorenko @ 2026-03-30 14:32 UTC (permalink / raw)
To: Peter Oberparleiter, Mikhail Zaslonko
Cc: Steffen Klassert, Herbert Xu, Masahiro Yamada, Josh Poimboeuf,
Vasileios Almpanis, Pavel Tikhomirov, linux-kernel, netdev,
Konstantin Khorenko
## Summary
GCC can merge global GCOV branch counters with loop induction variables,
causing out-of-bounds memory writes when the same function executes
concurrently on multiple CPUs. We observed kernel crashes in zlib's
inflate_fast() during IPComp (IP Payload Compression) decompression when
the kernel is built with CONFIG_GCOV_KERNEL=y.
This patch adds -fprofile-update=atomic to the zlib Makefiles to prevent
the problematic optimization.
## Problem Discovery
The issue was discovered while running the LTP networking stress test on
a 6.12-based kernel with GCOV enabled:
Test: LTP net_stress.ipsec_udp -> udp4_ipsec06
Command: udp_ipsec.sh -p comp -m transport -s 100:1000:65000:R65000
Kernel: 6.12.0-55.52.1.el10 based (x86_64) with CONFIG_GCOV_KERNEL=y
The crash occurred in inflate_fast() during concurrent IPComp packet
decompression:
BUG: unable to handle page fault for address: ffffd0a3c0902ffa
RIP: inflate_fast+1431
Call Trace:
zlib_inflate
__deflate_decompress
crypto_comp_decompress
ipcomp_decompress [xfrm_ipcomp]
ipcomp_input [xfrm_ipcomp]
xfrm_input
Analysis showed a write 3.4 MB past the end of a 65 KB decompression
buffer, hitting unmapped vmalloc guard pages.
## Verification on Upstream Kernel
We verified the bug is present in upstream Linux v7.0-rc5 (commit
46b513250491) with both:
- GCC 14.2.1 20250110 (Red Hat 14.2.1-7)
- GCC 16.0.1 20260327 (experimental, built from source)
We compiled lib/zlib_inflate/inffast.c with the kernel's standard GCOV
flags (including the existing -fno-tree-loop-im workaround from commit
2b40e1ea76d4) and inspected the assembly output. Both compilers exhibit
the problematic optimization.
## Root Cause: GCOV Counter IV-Merging
When CONFIG_GCOV_KERNEL=y, GCC instruments every basic block with counter
updates. In zlib's inner copy loops, GCC can optimize by merging these
global GCOV counters with the loop induction variables that compute store
addresses.
For example, in the pattern-fill loop in inflate_fast() (conceptually
`do { *sout++ = pat16; } while (--loops);`), GCC may generate code that:
1. Loads the current GCOV counter value from global memory
2. Uses that value to compute the base address, start index, and end bound
3. On each iteration, uses the counter as both:
- The value to write back to the global counter
- The index for the data store
This optimization is valid for single-threaded code but breaks when the
same function executes concurrently on multiple CPUs, because the GCOV
counter is a single global variable shared by all CPUs.
### Assembly Examples
**GCC 14.2.1 (Red Hat)** — pattern-fill loop without -fprofile-update=atomic:
movq __gcov0.inflate_fast+248(%rip), %r9
leaq 1(%r9), %rax # rax = counter + 1
leaq (%r9,%rdi), %rsi # rsi = counter + loops (end)
negq %r9
leaq (%r15,%r9,2), %r9 # r9 = base - counter*2
.L42:
movq %rax, __gcov0.inflate_fast+248(%rip)
movw %cx, (%r9,%rax,2) # WRITE using merged counter
addq $1, %rax
cmpq %rax, %rsi
jne .L42
Here, %rax serves dual purpose: GCOV counter and memory index. If another
CPU updates __gcov0.inflate_fast+248 between the initial load and the loop
iteration, the write address becomes invalid.
**GCC 16.0.1 (experimental)** — same pattern, different register allocation:
movq __gcov0.inflate_fast+248(%rip), %r14
leaq 1(%r14), %rdx
leaq (%r14,%r8), %rdi # end bound from counter
negq %r14
leaq (%rbx,%r14,2), %rbx # base address from counter
.L42:
movq %rdx, __gcov0.inflate_fast+248(%rip)
movw %si, (%rbx,%rdx,2) # WRITE using merged counter
addq $1, %rdx
cmpq %rdx, %rdi
jne .L42
Both compilers merge the counter with the loop IV; both are vulnerable.
**With -fprofile-update=atomic** (GCC 14.2.1):
movq %rdi, %r9 # pure pointer
.L42:
lock addq $1, __gcov0.inflate_fast+248(%rip)
addq $2, %r9
movw %ax, -2(%r9) # WRITE using pure pointer
subq $1, %rdx
jne .L42
The GCOV counter update is isolated as a standalone atomic instruction.
The write address is computed purely from local registers, making
concurrent execution safe.
## Why Existing Workarounds Don't Help
The kernel already passes -fno-tree-loop-im when building with GCOV
(commit 2b40e1ea76d4, "gcov: disable tree-loop-im to reduce stack usage").
That flag prevents GCC from hoisting loop-invariant memory operations out
of loops, which was causing excessive stack usage.
However, -fno-tree-loop-im does NOT prevent the IVopts (induction variable
optimization) pass from merging GCOV counters with loop induction
variables. These are separate optimization passes, and the IV-merging
happens even with -fno-tree-loop-im present.
## The Fix: -fprofile-update=atomic
Adding -fprofile-update=atomic tells GCC that profile counters may be
accessed concurrently. This causes GCC to:
1. Use atomic instructions (lock addq) for counter updates
2. Treat counter variables as opaque — they cannot be merged with loop IVs
This completely eliminates the problematic optimization while preserving
GCOV functionality.
The flag is added only to lib/zlib_inflate/, lib/zlib_deflate/, and
lib/zlib_dfltcc/ Makefiles to minimize performance overhead. Zlib is
particularly vulnerable because:
- inflate_fast() has tight inner loops that GCC heavily optimizes
- IPComp and other subsystems call zlib from multiple CPUs concurrently
- The per-CPU isolation (scratch buffers, crypto transforms) protects
data structures but cannot protect global GCOV counters
Applying -fprofile-update=atomic globally would make all GCOV counter
updates use atomic instructions, adding overhead throughout the kernel.
By scoping it to zlib, we fix the known crash site with minimal impact.
## GCC Bug Report Status
A bug report for the upstream GCC project is being filed.
i'm not sure if GCC team will accept this as a bug as the compiler
optimization looks technically valid under the C standard (data races on
non-atomic variables are undefined behavior), but it creates a practical
problem for kernel code that routinely executes the same function on
multiple CPUs.
And anyway we need to fix/workaround the issue until/if the compiler is fixed.
## Testing
Verified the fix by:
1. Compiling lib/zlib_inflate/inffast.c with and without
-fprofile-update=atomic using the kernel's exact build flags
2. Inspecting assembly output to confirm the atomic flag prevents
counter-IV merging
3. Testing on upstream v7.0-rc5 with GCC 14.2.1 and GCC 16.0.1
---
Konstantin Khorenko (1):
lib/zlib: use atomic GCOV counters to prevent crash in inflate_fast
lib/zlib_deflate/Makefile | 6 ++++++
lib/zlib_dfltcc/Makefile | 6 ++++++
lib/zlib_inflate/Makefile | 7 +++++++
3 files changed, 19 insertions(+)
--
2.43.0
^ permalink raw reply
* [PATCH v2 0/2] Bypass usercopy hardening for kernel-only iterators
From: Chuck Lever @ 2026-03-30 14:36 UTC (permalink / raw)
To: Al Viro, Kees Cook, Gustavo A. R. Silva
Cc: linux-hardening, linux-block, linux-fsdevel, netdev, Chuck Lever
Profiling NFSD under an iozone workload showed that hardened
usercopy checks consume roughly 1.3% of CPU in the TCP receive
path. The runtime check in check_object_size() validates that
copy buffers reside in expected slab regions, which is
meaningful when data crosses the user/kernel boundary but adds
no value when both source and destination are kernel addresses.
The fix splits check_copy_size() into two variants: the
existing full check, and a new __compiletime_check_copy_size()
that retains the compile-time object size assertion and the
runtime overflow check but omits check_object_size(). A
user_backed_iter() test at each call site selects between
them, so user-backed iterators continue to receive the full
validation.
Patch 1 applies this to copy_to_iter(). Patch 2 applies the
same change to copy_from_iter(). copy_from_iter_nocache() is
left unchanged because all current callers pass user-space
addresses; the bypass there is deferred until that changes.
---
Changes since v1:
- Updated commit message for clarity and completeness
- Rename the check_copy_size() function (Kees)
- Added __compiletime_check_copy_size() stub to
tools/virtio/linux/ucopysize.h
- Add second patch to convert copy_from_iter()
---
Chuck Lever (2):
iov: Bypass usercopy hardening for copy_to_iter()
iov: Bypass usercopy hardening for copy_from_iter()
include/linux/ucopysize.h | 16 +++++++++++++++-
include/linux/uio.h | 18 ++++++++++++++----
tools/virtio/linux/ucopysize.h | 6 ++++++
3 files changed, 35 insertions(+), 5 deletions(-)
---
base-commit: 7aaa8047eafd0bd628065b15757d9b48c5f9c07d
change-id: 20260326-bypass-user-copy-3e73161cc90b
Best regards,
--
Chuck Lever
^ permalink raw reply
* [PATCH v2 1/2] iov: Bypass usercopy hardening for copy_to_iter()
From: Chuck Lever @ 2026-03-30 14:36 UTC (permalink / raw)
To: Al Viro, Kees Cook, Gustavo A. R. Silva
Cc: linux-hardening, linux-block, linux-fsdevel, netdev, Chuck Lever
In-Reply-To: <20260330-bypass-user-copy-v2-0-f236179e7fd6@oracle.com>
From: Chuck Lever <chuck.lever@oracle.com>
Profiling NFSD under an iozone workload showed that hardened
usercopy checks consume roughly 1.3% of CPU in the TCP receive
path. The runtime check in check_object_size() validates that
copy buffers reside in expected kernel memory regions (slab,
stack, and non-text), which is meaningful when data crosses
the user/kernel boundary but adds no value when both source
and destination are kernel addresses.
Split check_copy_size() so that copy_to_iter() can bypass
the runtime check_object_size() call for non-user-backed
iterators (ITER_KVEC, ITER_BVEC, ITER_FOLIOQ, ITER_XARRAY,
and ITER_DISCARD). Existing callers of check_copy_size() are
unaffected; user-backed iterators still receive the full
usercopy validation.
This benefits all kernel consumers of copy_to_iter(),
including the TCP receive path used by the NFS client and
server, NVMe-TCP, and any other subsystem that uses
non-user-backed receive buffers.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
include/linux/ucopysize.h | 16 +++++++++++++++-
include/linux/uio.h | 9 +++++++--
tools/virtio/linux/ucopysize.h | 6 ++++++
3 files changed, 28 insertions(+), 3 deletions(-)
diff --git a/include/linux/ucopysize.h b/include/linux/ucopysize.h
index 41c2d9720466..d187108f845a 100644
--- a/include/linux/ucopysize.h
+++ b/include/linux/ucopysize.h
@@ -41,8 +41,14 @@ static inline void copy_overflow(int size, unsigned long count)
__copy_overflow(size, count);
}
+/*
+ * Copy size validation without usercopy hardening. Checks
+ * compile-time object size and runtime overflow, but skips
+ * check_object_size(). Use check_copy_size() when @addr
+ * may point to userspace-accessible memory.
+ */
static __always_inline __must_check bool
-check_copy_size(const void *addr, size_t bytes, bool is_source)
+__compiletime_check_copy_size(const void *addr, size_t bytes, bool is_source)
{
int sz = __builtin_object_size(addr, 0);
if (unlikely(sz >= 0 && sz < bytes)) {
@@ -56,6 +62,14 @@ check_copy_size(const void *addr, size_t bytes, bool is_source)
}
if (WARN_ON_ONCE(bytes > INT_MAX))
return false;
+ return true;
+}
+
+static __always_inline __must_check bool
+check_copy_size(const void *addr, size_t bytes, bool is_source)
+{
+ if (!__compiletime_check_copy_size(addr, bytes, is_source))
+ return false;
check_object_size(addr, bytes, is_source);
return true;
}
diff --git a/include/linux/uio.h b/include/linux/uio.h
index a9bc5b3067e3..45b323e4be97 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -216,8 +216,13 @@ size_t copy_page_to_iter_nofault(struct page *page, unsigned offset,
static __always_inline __must_check
size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
{
- if (check_copy_size(addr, bytes, true))
- return _copy_to_iter(addr, bytes, i);
+ if (user_backed_iter(i)) {
+ if (check_copy_size(addr, bytes, true))
+ return _copy_to_iter(addr, bytes, i);
+ } else {
+ if (__compiletime_check_copy_size(addr, bytes, true))
+ return _copy_to_iter(addr, bytes, i);
+ }
return 0;
}
diff --git a/tools/virtio/linux/ucopysize.h b/tools/virtio/linux/ucopysize.h
index 8beb7755d060..a330e14c81c5 100644
--- a/tools/virtio/linux/ucopysize.h
+++ b/tools/virtio/linux/ucopysize.h
@@ -12,6 +12,12 @@ static inline void copy_overflow(int size, unsigned long count)
{
}
+static __always_inline __must_check bool
+__compiletime_check_copy_size(const void *addr, size_t bytes, bool is_source)
+{
+ return true;
+}
+
static __always_inline __must_check bool
check_copy_size(const void *addr, size_t bytes, bool is_source)
{
--
2.53.0
^ permalink raw reply related
* [PATCH v2 2/2] iov: Bypass usercopy hardening for copy_from_iter()
From: Chuck Lever @ 2026-03-30 14:36 UTC (permalink / raw)
To: Al Viro, Kees Cook, Gustavo A. R. Silva
Cc: linux-hardening, linux-block, linux-fsdevel, netdev, Chuck Lever
In-Reply-To: <20260330-bypass-user-copy-v2-0-f236179e7fd6@oracle.com>
From: Chuck Lever <chuck.lever@oracle.com>
The previous patch bypassed runtime usercopy validation in
copy_to_iter() for kernel-only iterators. The same overhead
exists in the copy_from_iter() path: check_object_size()
validates the destination buffer's slab residency on every
call, even when the iterator source is entirely kernel-backed
and the user-copy protection is redundant.
Apply the same bypass so that copy_from_iter() calls
__compiletime_check_copy_size() instead of the full
check_copy_size() when the iterator is not user-backed.
All current callers of copy_from_iter_nocache() pass user-space
addresses, so the same change is deferred for that wrapper.
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
---
include/linux/uio.h | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/include/linux/uio.h b/include/linux/uio.h
index 45b323e4be97..5a6ad2dd5627 100644
--- a/include/linux/uio.h
+++ b/include/linux/uio.h
@@ -229,8 +229,13 @@ size_t copy_to_iter(const void *addr, size_t bytes, struct iov_iter *i)
static __always_inline __must_check
size_t copy_from_iter(void *addr, size_t bytes, struct iov_iter *i)
{
- if (check_copy_size(addr, bytes, false))
- return _copy_from_iter(addr, bytes, i);
+ if (user_backed_iter(i)) {
+ if (check_copy_size(addr, bytes, false))
+ return _copy_from_iter(addr, bytes, i);
+ } else {
+ if (__compiletime_check_copy_size(addr, bytes, false))
+ return _copy_from_iter(addr, bytes, i);
+ }
return 0;
}
--
2.53.0
^ permalink raw reply related
* [PATCH v25 01/11] sfc: add cxl support
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Jonathan Cameron, Edward Cree, Alison Schofield
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
Add CXL initialization based on new CXL API for accel drivers and make
it dependent on kernel CXL configuration.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
---
drivers/net/ethernet/sfc/Kconfig | 9 +++++
drivers/net/ethernet/sfc/Makefile | 1 +
drivers/net/ethernet/sfc/efx.c | 15 ++++++-
drivers/net/ethernet/sfc/efx_cxl.c | 56 +++++++++++++++++++++++++++
drivers/net/ethernet/sfc/efx_cxl.h | 40 +++++++++++++++++++
drivers/net/ethernet/sfc/net_driver.h | 10 +++++
6 files changed, 130 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/ethernet/sfc/efx_cxl.c
create mode 100644 drivers/net/ethernet/sfc/efx_cxl.h
diff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig
index c4c43434f314..979f2801e2a8 100644
--- a/drivers/net/ethernet/sfc/Kconfig
+++ b/drivers/net/ethernet/sfc/Kconfig
@@ -66,6 +66,15 @@ config SFC_MCDI_LOGGING
Driver-Interface) commands and responses, allowing debugging of
driver/firmware interaction. The tracing is actually enabled by
a sysfs file 'mcdi_logging' under the PCI device.
+config SFC_CXL
+ bool "Solarflare SFC9100-family CXL support"
+ depends on SFC && CXL_BUS >= SFC
+ default SFC
+ help
+ This enables SFC CXL support if the kernel is configuring CXL for
+ using CTPIO with CXL.mem. The SFC device with CXL support and
+ with a CXL-aware firmware can be used for minimizing latencies
+ when sending through CTPIO.
source "drivers/net/ethernet/sfc/falcon/Kconfig"
source "drivers/net/ethernet/sfc/siena/Kconfig"
diff --git a/drivers/net/ethernet/sfc/Makefile b/drivers/net/ethernet/sfc/Makefile
index d99039ec468d..bb0f1891cde6 100644
--- a/drivers/net/ethernet/sfc/Makefile
+++ b/drivers/net/ethernet/sfc/Makefile
@@ -13,6 +13,7 @@ sfc-$(CONFIG_SFC_SRIOV) += sriov.o ef10_sriov.o ef100_sriov.o ef100_rep.o \
mae.o tc.o tc_bindings.o tc_counters.o \
tc_encap_actions.o tc_conntrack.o
+sfc-$(CONFIG_SFC_CXL) += efx_cxl.o
obj-$(CONFIG_SFC) += sfc.o
obj-$(CONFIG_SFC_FALCON) += falcon/
diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c
index 8f136a11d396..c1e6e31f07cf 100644
--- a/drivers/net/ethernet/sfc/efx.c
+++ b/drivers/net/ethernet/sfc/efx.c
@@ -34,6 +34,7 @@
#include "selftest.h"
#include "sriov.h"
#include "efx_devlink.h"
+#include "efx_cxl.h"
#include "mcdi_port_common.h"
#include "mcdi_pcol.h"
@@ -981,12 +982,15 @@ static void efx_pci_remove(struct pci_dev *pci_dev)
efx_pci_remove_main(efx);
efx_fini_io(efx);
+
+ probe_data = container_of(efx, struct efx_probe_data, efx);
+ efx_cxl_exit(probe_data);
+
pci_dbg(efx->pci_dev, "shutdown successful\n");
efx_fini_devlink_and_unlock(efx);
efx_fini_struct(efx);
free_netdev(efx->net_dev);
- probe_data = container_of(efx, struct efx_probe_data, efx);
kfree(probe_data);
};
@@ -1190,6 +1194,15 @@ static int efx_pci_probe(struct pci_dev *pci_dev,
if (rc)
goto fail2;
+ /* A successful cxl initialization implies a CXL region created to be
+ * used for PIO buffers. If there is no CXL support, or initialization
+ * fails, efx_cxl_pio_initialised will be false and legacy PIO buffers
+ * defined at specific PCI BAR regions will be used.
+ */
+ rc = efx_cxl_init(probe_data);
+ if (rc)
+ pci_err(pci_dev, "CXL initialization failed with error %d\n", rc);
+
rc = efx_pci_probe_post_io(efx);
if (rc) {
/* On failure, retry once immediately.
diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
new file mode 100644
index 000000000000..f66db976fde9
--- /dev/null
+++ b/drivers/net/ethernet/sfc/efx_cxl.c
@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/****************************************************************************
+ *
+ * Driver for AMD network controllers and boards
+ * Copyright (C) 2025, Advanced Micro Devices, Inc.
+ */
+
+#include <linux/pci.h>
+
+#include "net_driver.h"
+#include "efx_cxl.h"
+
+#define EFX_CTPIO_BUFFER_SIZE SZ_256M
+
+int efx_cxl_init(struct efx_probe_data *probe_data)
+{
+ struct efx_nic *efx = &probe_data->efx;
+ struct pci_dev *pci_dev = efx->pci_dev;
+ struct efx_cxl *cxl;
+ u16 dvsec;
+
+ probe_data->cxl_pio_initialised = false;
+
+ /* Is the device configured with and using CXL? */
+ if (!pcie_is_cxl(pci_dev))
+ return 0;
+
+ dvsec = pci_find_dvsec_capability(pci_dev, PCI_VENDOR_ID_CXL,
+ PCI_DVSEC_CXL_DEVICE);
+ if (!dvsec) {
+ pci_info(pci_dev, "CXL_DVSEC_PCIE_DEVICE capability not found\n");
+ return 0;
+ }
+
+ pci_dbg(pci_dev, "CXL_DVSEC_PCIE_DEVICE capability found\n");
+
+ /* Create a cxl_dev_state embedded in the cxl struct using cxl core api
+ * specifying no mbox available.
+ */
+ cxl = devm_cxl_dev_state_create(&pci_dev->dev, CXL_DEVTYPE_DEVMEM,
+ pci_dev->dev.id, dvsec, struct efx_cxl,
+ cxlds, false);
+
+ if (!cxl)
+ return -ENOMEM;
+
+ probe_data->cxl = cxl;
+
+ return 0;
+}
+
+void efx_cxl_exit(struct efx_probe_data *probe_data)
+{
+}
+
+MODULE_IMPORT_NS("CXL");
diff --git a/drivers/net/ethernet/sfc/efx_cxl.h b/drivers/net/ethernet/sfc/efx_cxl.h
new file mode 100644
index 000000000000..961639cef692
--- /dev/null
+++ b/drivers/net/ethernet/sfc/efx_cxl.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/****************************************************************************
+ * Driver for AMD network controllers and boards
+ * Copyright (C) 2025, Advanced Micro Devices, Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published
+ * by the Free Software Foundation, incorporated herein by reference.
+ */
+
+#ifndef EFX_CXL_H
+#define EFX_CXL_H
+
+#ifdef CONFIG_SFC_CXL
+
+#include <cxl/cxl.h>
+
+struct cxl_root_decoder;
+struct cxl_port;
+struct cxl_endpoint_decoder;
+struct cxl_region;
+struct efx_probe_data;
+
+struct efx_cxl {
+ struct cxl_dev_state cxlds;
+ struct cxl_memdev *cxlmd;
+ struct cxl_root_decoder *cxlrd;
+ struct cxl_port *endpoint;
+ struct cxl_endpoint_decoder *cxled;
+ struct cxl_region *efx_region;
+ void __iomem *ctpio_cxl;
+};
+
+int efx_cxl_init(struct efx_probe_data *probe_data);
+void efx_cxl_exit(struct efx_probe_data *probe_data);
+#else
+static inline int efx_cxl_init(struct efx_probe_data *probe_data) { return 0; }
+static inline void efx_cxl_exit(struct efx_probe_data *probe_data) {}
+#endif
+#endif
diff --git a/drivers/net/ethernet/sfc/net_driver.h b/drivers/net/ethernet/sfc/net_driver.h
index b98c259f672d..3964b2c56609 100644
--- a/drivers/net/ethernet/sfc/net_driver.h
+++ b/drivers/net/ethernet/sfc/net_driver.h
@@ -1197,14 +1197,24 @@ struct efx_nic {
atomic_t n_rx_noskb_drops;
};
+#ifdef CONFIG_SFC_CXL
+struct efx_cxl;
+#endif
+
/**
* struct efx_probe_data - State after hardware probe
* @pci_dev: The PCI device
* @efx: Efx NIC details
+ * @cxl: details of related cxl objects
+ * @cxl_pio_initialised: cxl initialization outcome.
*/
struct efx_probe_data {
struct pci_dev *pci_dev;
struct efx_nic efx;
+#ifdef CONFIG_SFC_CXL
+ struct efx_cxl *cxl;
+ bool cxl_pio_initialised;
+#endif
};
static inline struct efx_nic *efx_netdev_priv(struct net_device *dev)
--
2.34.1
^ permalink raw reply related
* [PATCH v25 00/11] Type2 device basic support
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero
From: Alejandro Lucero <alucerop@amd.com>
This patchset should be aplied on the for-7.1/cxl-type2-support branch.
For the sake of having the impending Type2 support for known drivers
needing it (sfc and Jump Trading) this version does only support the
case of HDM Type2 device committed by the BIOS, keeping the
decoders untouched when driver is unload, which requires a patch from v6
Smita's series:
https://lore.kernel.org/linux-cxl/20260210064501.157591-1-Smita.KoralahalliChannabasappa@amd.com/T/#mdad81d3817def8baace77ead9e2e305e775cf51d ?
or a BIOS locking those decoders.
changes in v25:
- minor fix in patch1 and patch2 (Jonathan)
- patch6: get region instead of decoder and region
make check based on decoder state (Benjamin)
- patch8: decouple unregister_region and cxl_unregister_region
and use devm action release instead. (Gregory)
- patch9: add comment when calling cxl_unregister_region (Jonathan)
- patch 10: fix commit (Allison)
Alejandro Lucero (11):
sfc: add cxl support
cxl/sfc: Map cxl regs
cxl/sfc: Initialize dpa without a mailbox
cxl: Prepare memdev creation for type2
sfc: create type2 cxl memdev
cxl/hdm: Add support for getting region from committed decoder
cxl: Add function for obtaining region range
cxl: Export function for unwinding cxl by accelerators
sfc: obtain decoder and region if committed by firmware
cxl: Avoid dax creation for accelerators
sfc: support pio mapping based on cxl
drivers/cxl/core/core.h | 2 +
drivers/cxl/core/hdm.c | 48 ++++++++++
drivers/cxl/core/mbox.c | 51 +----------
drivers/cxl/core/memdev.c | 81 ++++++++++++++++-
drivers/cxl/core/pci.c | 1 +
drivers/cxl/core/port.c | 1 +
drivers/cxl/core/region.c | 38 ++++++++
drivers/cxl/core/regs.c | 1 +
drivers/cxl/cxlmem.h | 6 --
drivers/cxl/cxlpci.h | 12 ---
drivers/cxl/mem.c | 45 +++++++---
drivers/cxl/pci.c | 1 +
drivers/net/ethernet/sfc/Kconfig | 9 ++
drivers/net/ethernet/sfc/Makefile | 1 +
drivers/net/ethernet/sfc/ef10.c | 53 +++++++++--
drivers/net/ethernet/sfc/efx.c | 15 +++-
drivers/net/ethernet/sfc/efx_cxl.c | 124 ++++++++++++++++++++++++++
drivers/net/ethernet/sfc/efx_cxl.h | 40 +++++++++
drivers/net/ethernet/sfc/net_driver.h | 12 +++
drivers/net/ethernet/sfc/nic.h | 3 +
include/cxl/cxl.h | 13 +++
include/cxl/pci.h | 21 +++++
22 files changed, 489 insertions(+), 89 deletions(-)
create mode 100644 drivers/net/ethernet/sfc/efx_cxl.c
create mode 100644 drivers/net/ethernet/sfc/efx_cxl.h
create mode 100644 include/cxl/pci.h
base-commit: 64584273dfb8a1e5fc7d78094ba22a93c204b44e
--
2.34.1
^ permalink raw reply
* [PATCH v25 02/11] cxl/sfc: Map cxl regs
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Jonathan Cameron, Ben Cheatham
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
Export cxl core functions for a Type2 driver being able to discover and
map the device registers.
Use it in sfc driver cxl initialization.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
---
drivers/cxl/core/pci.c | 1 +
drivers/cxl/core/port.c | 1 +
drivers/cxl/core/regs.c | 1 +
drivers/cxl/cxlpci.h | 12 ------------
drivers/cxl/pci.c | 1 +
drivers/net/ethernet/sfc/efx_cxl.c | 26 ++++++++++++++++++++++++++
include/cxl/pci.h | 21 +++++++++++++++++++++
7 files changed, 51 insertions(+), 12 deletions(-)
create mode 100644 include/cxl/pci.h
diff --git a/drivers/cxl/core/pci.c b/drivers/cxl/core/pci.c
index d1f487b3d809..2bcd683aa286 100644
--- a/drivers/cxl/core/pci.c
+++ b/drivers/cxl/core/pci.c
@@ -6,6 +6,7 @@
#include <linux/delay.h>
#include <linux/pci.h>
#include <linux/pci-doe.h>
+#include <cxl/pci.h>
#include <linux/aer.h>
#include <cxlpci.h>
#include <cxlmem.h>
diff --git a/drivers/cxl/core/port.c b/drivers/cxl/core/port.c
index 0c5957d1d329..a53b87de70e5 100644
--- a/drivers/cxl/core/port.c
+++ b/drivers/cxl/core/port.c
@@ -11,6 +11,7 @@
#include <linux/idr.h>
#include <linux/node.h>
#include <cxl/einj.h>
+#include <cxl/pci.h>
#include <cxlmem.h>
#include <cxlpci.h>
#include <cxl.h>
diff --git a/drivers/cxl/core/regs.c b/drivers/cxl/core/regs.c
index 93710cf4f0a6..20c2d9fbcfe7 100644
--- a/drivers/cxl/core/regs.c
+++ b/drivers/cxl/core/regs.c
@@ -4,6 +4,7 @@
#include <linux/device.h>
#include <linux/slab.h>
#include <linux/pci.h>
+#include <cxl/pci.h>
#include <cxlmem.h>
#include <cxlpci.h>
#include <pmu.h>
diff --git a/drivers/cxl/cxlpci.h b/drivers/cxl/cxlpci.h
index b826eb53cf7b..110ec9c44f09 100644
--- a/drivers/cxl/cxlpci.h
+++ b/drivers/cxl/cxlpci.h
@@ -13,16 +13,6 @@
*/
#define CXL_PCI_DEFAULT_MAX_VECTORS 16
-/* Register Block Identifier (RBI) */
-enum cxl_regloc_type {
- CXL_REGLOC_RBI_EMPTY = 0,
- CXL_REGLOC_RBI_COMPONENT,
- CXL_REGLOC_RBI_VIRT,
- CXL_REGLOC_RBI_MEMDEV,
- CXL_REGLOC_RBI_PMU,
- CXL_REGLOC_RBI_TYPES
-};
-
/*
* Table Access DOE, CDAT Read Entry Response
*
@@ -112,6 +102,4 @@ static inline void devm_cxl_port_ras_setup(struct cxl_port *port)
}
#endif
-int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,
- struct cxl_register_map *map);
#endif /* __CXL_PCI_H__ */
diff --git a/drivers/cxl/pci.c b/drivers/cxl/pci.c
index adc7c4bcb03a..5cad118e7101 100644
--- a/drivers/cxl/pci.c
+++ b/drivers/cxl/pci.c
@@ -11,6 +11,7 @@
#include <linux/pci.h>
#include <linux/aer.h>
#include <linux/io.h>
+#include <cxl/pci.h>
#include <cxl/mailbox.h>
#include "cxlmem.h"
#include "cxlpci.h"
diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
index f66db976fde9..6937616ec362 100644
--- a/drivers/net/ethernet/sfc/efx_cxl.c
+++ b/drivers/net/ethernet/sfc/efx_cxl.c
@@ -7,6 +7,8 @@
#include <linux/pci.h>
+#include <cxl/cxl.h>
+#include <cxl/pci.h>
#include "net_driver.h"
#include "efx_cxl.h"
@@ -18,6 +20,7 @@ int efx_cxl_init(struct efx_probe_data *probe_data)
struct pci_dev *pci_dev = efx->pci_dev;
struct efx_cxl *cxl;
u16 dvsec;
+ int rc;
probe_data->cxl_pio_initialised = false;
@@ -44,6 +47,29 @@ int efx_cxl_init(struct efx_probe_data *probe_data)
if (!cxl)
return -ENOMEM;
+ rc = cxl_pci_setup_regs(pci_dev, CXL_REGLOC_RBI_COMPONENT,
+ &cxl->cxlds.reg_map);
+ if (rc) {
+ pci_err(pci_dev, "No component registers\n");
+ return rc;
+ }
+
+ if (!cxl->cxlds.reg_map.component_map.hdm_decoder.valid) {
+ pci_err(pci_dev, "Expected HDM component register not found\n");
+ return -ENODEV;
+ }
+
+ if (!cxl->cxlds.reg_map.component_map.ras.valid) {
+ pci_err(pci_dev, "Expected RAS component register not found\n");
+ return -ENODEV;
+ }
+
+ /* Set media ready explicitly as there are neither mailbox for checking
+ * this state nor the CXL register involved, both not mandatory for
+ * type2.
+ */
+ cxl->cxlds.media_ready = true;
+
probe_data->cxl = cxl;
return 0;
diff --git a/include/cxl/pci.h b/include/cxl/pci.h
new file mode 100644
index 000000000000..a172439f08c6
--- /dev/null
+++ b/include/cxl/pci.h
@@ -0,0 +1,21 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/* Copyright(c) 2020 Intel Corporation. All rights reserved. */
+
+#ifndef __CXL_CXL_PCI_H__
+#define __CXL_CXL_PCI_H__
+
+/* Register Block Identifier (RBI) */
+enum cxl_regloc_type {
+ CXL_REGLOC_RBI_EMPTY = 0,
+ CXL_REGLOC_RBI_COMPONENT,
+ CXL_REGLOC_RBI_VIRT,
+ CXL_REGLOC_RBI_MEMDEV,
+ CXL_REGLOC_RBI_PMU,
+ CXL_REGLOC_RBI_TYPES
+};
+
+struct cxl_register_map;
+
+int cxl_pci_setup_regs(struct pci_dev *pdev, enum cxl_regloc_type type,
+ struct cxl_register_map *map);
+#endif
--
2.34.1
^ permalink raw reply related
* [PATCH v25 05/11] sfc: create type2 cxl memdev
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Martin Habets, Fan Ni, Edward Cree,
Jonathan Cameron
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
Use cxl API for creating a cxl memory device using the type2
cxl_dev_state struct.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Martin Habets <habetsm.xilinx@gmail.com>
Reviewed-by: Fan Ni <fan.ni@samsung.com>
Acked-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
---
drivers/net/ethernet/sfc/efx_cxl.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
index 6619084a77d8..63e6f277ae9f 100644
--- a/drivers/net/ethernet/sfc/efx_cxl.c
+++ b/drivers/net/ethernet/sfc/efx_cxl.c
@@ -75,6 +75,12 @@ int efx_cxl_init(struct efx_probe_data *probe_data)
return -ENODEV;
}
+ cxl->cxlmd = devm_cxl_add_memdev(&cxl->cxlds, NULL);
+ if (IS_ERR(cxl->cxlmd)) {
+ pci_err(pci_dev, "CXL accel memdev creation failed");
+ return PTR_ERR(cxl->cxlmd);
+ }
+
probe_data->cxl = cxl;
return 0;
--
2.34.1
^ permalink raw reply related
* [PATCH v25 06/11] cxl/hdm: Add support for getting region from committed decoder
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
A Type2 device configured by the BIOS can have its HDM committed and
a cxl region linked by auto discovery when the device memdev is created.
Add a function for a Type2 driver to obtain such a region.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
---
drivers/cxl/core/hdm.c | 48 ++++++++++++++++++++++++++++++++++++++++++
include/cxl/cxl.h | 2 ++
2 files changed, 50 insertions(+)
diff --git a/drivers/cxl/core/hdm.c b/drivers/cxl/core/hdm.c
index c222e98ae736..ce5feb4b26ae 100644
--- a/drivers/cxl/core/hdm.c
+++ b/drivers/cxl/core/hdm.c
@@ -686,6 +686,54 @@ int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size)
return devm_add_action_or_reset(&port->dev, cxl_dpa_release, cxled);
}
+static int find_committed_endpoint_decoder(struct device *dev, const void *data)
+{
+ struct cxl_endpoint_decoder *cxled;
+ struct cxl_decoder *cxld;
+
+ if (!is_endpoint_decoder(dev))
+ return 0;
+
+ cxled = to_cxl_endpoint_decoder(dev);
+ cxld = &cxled->cxld;
+
+ return (cxld->flags & CXL_DECODER_F_ENABLE);
+}
+
+/**
+ * cxl_get_region_from_committed_decoder - obtain a pointer to a region
+ * @cxlmd: CXL memdev from an endpoint device
+ *
+ * An accelerator decoder can be set up by the firmware/BIOS and the auto
+ * discovery region creation triggered by the memdev object initialization.
+ * Using this function the related driver can obtain such a region.
+ *
+ * Only one committed HDM is expected, returning the first one found.
+ *
+ * Return pointer to a region or NULL
+ */
+struct cxl_region *cxl_get_region_from_committed_decoder(struct cxl_memdev *cxlmd)
+{
+ struct cxl_port *endpoint = cxlmd->endpoint;
+ struct cxl_endpoint_decoder *cxled;
+
+ if (!endpoint)
+ return NULL;
+
+ guard(rwsem_read)(&cxl_rwsem.dpa);
+ struct device *cxled_dev __free(put_device) =
+ device_find_child(&endpoint->dev, NULL,
+ find_committed_endpoint_decoder);
+
+ if (!cxled_dev)
+ return NULL;
+
+ cxled = to_cxl_endpoint_decoder(cxled_dev);
+
+ return cxled->cxld.region;
+}
+EXPORT_SYMBOL_NS_GPL(cxl_get_region_from_committed_decoder, "CXL");
+
static void cxld_set_interleave(struct cxl_decoder *cxld, u32 *ctrl)
{
u16 eig;
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 10a9b8fa2f6b..05c6ff2404b0 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -231,4 +231,6 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev,
int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);
struct cxl_memdev *devm_cxl_add_memdev(struct cxl_dev_state *cxlds,
const struct cxl_memdev_attach *attach);
+struct cxl_region;
+struct cxl_region *cxl_get_region_from_committed_decoder(struct cxl_memdev *cxlmd);
#endif /* __CXL_CXL_H__ */
--
2.34.1
^ permalink raw reply related
* [PATCH v25 04/11] cxl: Prepare memdev creation for type2
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Ben Cheatham, Jonathan Cameron,
Alison Schofield
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
Current cxl core is relying on a CXL_DEVTYPE_CLASSMEM type device when
creating a memdev leading to problems when obtaining cxl_memdev_state
references from a CXL_DEVTYPE_DEVMEM type.
Modify check for obtaining cxl_memdev_state adding CXL_DEVTYPE_DEVMEM
support.
Make devm_cxl_add_memdev accessible from an accel driver.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
---
drivers/cxl/core/memdev.c | 15 +++++++++++--
drivers/cxl/cxlmem.h | 6 ------
drivers/cxl/mem.c | 45 +++++++++++++++++++++++++++++----------
include/cxl/cxl.h | 6 ++++++
4 files changed, 53 insertions(+), 19 deletions(-)
diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 166ec6b7d041..759b43364ed7 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -7,6 +7,7 @@
#include <linux/slab.h>
#include <linux/idr.h>
#include <linux/pci.h>
+#include <cxl/cxl.h>
#include <cxlmem.h>
#include "trace.h"
#include "core.h"
@@ -576,9 +577,16 @@ static const struct device_type cxl_memdev_type = {
.groups = cxl_memdev_attribute_groups,
};
+static const struct device_type cxl_accel_memdev_type = {
+ .name = "cxl_accel_memdev",
+ .release = cxl_memdev_release,
+ .devnode = cxl_memdev_devnode,
+};
+
bool is_cxl_memdev(const struct device *dev)
{
- return dev->type == &cxl_memdev_type;
+ return (dev->type == &cxl_memdev_type ||
+ dev->type == &cxl_accel_memdev_type);
}
EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, "CXL");
@@ -773,7 +781,10 @@ static struct cxl_memdev *cxl_memdev_alloc(struct cxl_dev_state *cxlds,
dev->parent = cxlds->dev;
dev->bus = &cxl_bus_type;
dev->devt = MKDEV(cxl_mem_major, cxlmd->id);
- dev->type = &cxl_memdev_type;
+ if (cxlds->type == CXL_DEVTYPE_DEVMEM)
+ dev->type = &cxl_accel_memdev_type;
+ else
+ dev->type = &cxl_memdev_type;
device_set_pm_not_required(dev);
INIT_WORK(&cxlmd->detach_work, detach_memdev);
diff --git a/drivers/cxl/cxlmem.h b/drivers/cxl/cxlmem.h
index 281546de426e..c98db6f18aa2 100644
--- a/drivers/cxl/cxlmem.h
+++ b/drivers/cxl/cxlmem.h
@@ -34,10 +34,6 @@
(FIELD_GET(CXLMDEV_RESET_NEEDED_MASK, status) != \
CXLMDEV_RESET_NEEDED_NOT)
-struct cxl_memdev_attach {
- int (*probe)(struct cxl_memdev *cxlmd);
-};
-
/**
* struct cxl_memdev - CXL bus object representing a Type-3 Memory Device
* @dev: driver core device object
@@ -103,8 +99,6 @@ static inline bool is_cxl_endpoint(struct cxl_port *port)
struct cxl_memdev *__devm_cxl_add_memdev(struct cxl_dev_state *cxlds,
const struct cxl_memdev_attach *attach);
-struct cxl_memdev *devm_cxl_add_memdev(struct cxl_dev_state *cxlds,
- const struct cxl_memdev_attach *attach);
int devm_cxl_sanitize_setup_notifier(struct device *host,
struct cxl_memdev *cxlmd);
struct cxl_memdev_state;
diff --git a/drivers/cxl/mem.c b/drivers/cxl/mem.c
index fcffe24dcb42..ff858318091f 100644
--- a/drivers/cxl/mem.c
+++ b/drivers/cxl/mem.c
@@ -65,6 +65,26 @@ static int cxl_debugfs_poison_clear(void *data, u64 dpa)
DEFINE_DEBUGFS_ATTRIBUTE(cxl_poison_clear_fops, NULL,
cxl_debugfs_poison_clear, "%llx\n");
+static void cxl_memdev_poison_enable(struct cxl_memdev_state *mds,
+ struct cxl_memdev *cxlmd,
+ struct dentry *dentry)
+{
+ /*
+ * Avoid poison debugfs for DEVMEM aka accelerators as they rely on
+ * cxl_memdev_state.
+ */
+ if (!mds)
+ return;
+
+ if (test_bit(CXL_POISON_ENABLED_INJECT, mds->poison.enabled_cmds))
+ debugfs_create_file("inject_poison", 0200, dentry, cxlmd,
+ &cxl_poison_inject_fops);
+
+ if (test_bit(CXL_POISON_ENABLED_CLEAR, mds->poison.enabled_cmds))
+ debugfs_create_file("clear_poison", 0200, dentry, cxlmd,
+ &cxl_poison_clear_fops);
+}
+
static int cxl_mem_probe(struct device *dev)
{
struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
@@ -92,12 +112,7 @@ static int cxl_mem_probe(struct device *dev)
dentry = cxl_debugfs_create_dir(dev_name(dev));
debugfs_create_devm_seqfile(dev, "dpamem", dentry, cxl_mem_dpa_show);
- if (test_bit(CXL_POISON_ENABLED_INJECT, mds->poison.enabled_cmds))
- debugfs_create_file("inject_poison", 0200, dentry, cxlmd,
- &cxl_poison_inject_fops);
- if (test_bit(CXL_POISON_ENABLED_CLEAR, mds->poison.enabled_cmds))
- debugfs_create_file("clear_poison", 0200, dentry, cxlmd,
- &cxl_poison_clear_fops);
+ cxl_memdev_poison_enable(mds, cxlmd, dentry);
rc = devm_add_action_or_reset(dev, remove_debugfs, dentry);
if (rc)
@@ -206,16 +221,24 @@ static ssize_t trigger_poison_list_store(struct device *dev,
}
static DEVICE_ATTR_WO(trigger_poison_list);
-static umode_t cxl_mem_visible(struct kobject *kobj, struct attribute *a, int n)
+static bool cxl_poison_attr_visible(struct kobject *kobj, struct attribute *a)
{
struct device *dev = kobj_to_dev(kobj);
struct cxl_memdev *cxlmd = to_cxl_memdev(dev);
struct cxl_memdev_state *mds = to_cxl_memdev_state(cxlmd->cxlds);
- if (a == &dev_attr_trigger_poison_list.attr)
- if (!test_bit(CXL_POISON_ENABLED_LIST,
- mds->poison.enabled_cmds))
- return 0;
+ if (!mds ||
+ !test_bit(CXL_POISON_ENABLED_LIST, mds->poison.enabled_cmds))
+ return false;
+
+ return true;
+}
+
+static umode_t cxl_mem_visible(struct kobject *kobj, struct attribute *a, int n)
+{
+ if (a == &dev_attr_trigger_poison_list.attr &&
+ !cxl_poison_attr_visible(kobj, a))
+ return 0;
return a->mode;
}
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index 1346771edc4e..10a9b8fa2f6b 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -149,6 +149,10 @@ struct cxl_dpa_partition {
#define CXL_NR_PARTITIONS_MAX 2
+struct cxl_memdev_attach {
+ int (*probe)(struct cxl_memdev *cxlmd);
+};
+
/**
* struct cxl_dev_state - The driver device state
*
@@ -225,4 +229,6 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev,
})
int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);
+struct cxl_memdev *devm_cxl_add_memdev(struct cxl_dev_state *cxlds,
+ const struct cxl_memdev_attach *attach);
#endif /* __CXL_CXL_H__ */
--
2.34.1
^ permalink raw reply related
* [PATCH v25 03/11] cxl/sfc: Initialize dpa without a mailbox
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Ben Cheatham, Jonathan Cameron
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
Type3 relies on mailbox CXL_MBOX_OP_IDENTIFY command for initializing
memdev state params which end up being used for DPA initialization.
Allow a Type2 driver to initialize DPA simply by giving the size of its
volatile hardware partition.
Move related functions to memdev.
Add sfc driver as the client.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
---
drivers/cxl/core/core.h | 2 +
drivers/cxl/core/mbox.c | 51 +----------------------
drivers/cxl/core/memdev.c | 66 ++++++++++++++++++++++++++++++
drivers/net/ethernet/sfc/efx_cxl.c | 5 +++
include/cxl/cxl.h | 2 +
5 files changed, 76 insertions(+), 50 deletions(-)
diff --git a/drivers/cxl/core/core.h b/drivers/cxl/core/core.h
index 5539e941782f..77c684744771 100644
--- a/drivers/cxl/core/core.h
+++ b/drivers/cxl/core/core.h
@@ -97,6 +97,8 @@ void __iomem *devm_cxl_iomap_block(struct device *dev, resource_size_t addr,
struct dentry *cxl_debugfs_create_dir(const char *dir);
int cxl_dpa_set_part(struct cxl_endpoint_decoder *cxled,
enum cxl_partition_mode mode);
+struct cxl_memdev_state;
+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds);
int cxl_dpa_alloc(struct cxl_endpoint_decoder *cxled, u64 size);
int cxl_dpa_free(struct cxl_endpoint_decoder *cxled);
resource_size_t cxl_dpa_size(struct cxl_endpoint_decoder *cxled);
diff --git a/drivers/cxl/core/mbox.c b/drivers/cxl/core/mbox.c
index 451ff2287b44..cf37676068c2 100644
--- a/drivers/cxl/core/mbox.c
+++ b/drivers/cxl/core/mbox.c
@@ -1151,7 +1151,7 @@ EXPORT_SYMBOL_NS_GPL(cxl_mem_get_event_records, "CXL");
*
* See CXL @8.2.9.5.2.1 Get Partition Info
*/
-static int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)
+int cxl_mem_get_partition_info(struct cxl_memdev_state *mds)
{
struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
struct cxl_mbox_get_partition_info pi;
@@ -1307,55 +1307,6 @@ int cxl_mem_sanitize(struct cxl_memdev *cxlmd, u16 cmd)
return -EBUSY;
}
-static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)
-{
- int i = info->nr_partitions;
-
- if (size == 0)
- return;
-
- info->part[i].range = (struct range) {
- .start = start,
- .end = start + size - 1,
- };
- info->part[i].mode = mode;
- info->nr_partitions++;
-}
-
-int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
-{
- struct cxl_dev_state *cxlds = &mds->cxlds;
- struct device *dev = cxlds->dev;
- int rc;
-
- if (!cxlds->media_ready) {
- info->size = 0;
- return 0;
- }
-
- info->size = mds->total_bytes;
-
- if (mds->partition_align_bytes == 0) {
- add_part(info, 0, mds->volatile_only_bytes, CXL_PARTMODE_RAM);
- add_part(info, mds->volatile_only_bytes,
- mds->persistent_only_bytes, CXL_PARTMODE_PMEM);
- return 0;
- }
-
- rc = cxl_mem_get_partition_info(mds);
- if (rc) {
- dev_err(dev, "Failed to query partition information\n");
- return rc;
- }
-
- add_part(info, 0, mds->active_volatile_bytes, CXL_PARTMODE_RAM);
- add_part(info, mds->active_volatile_bytes, mds->active_persistent_bytes,
- CXL_PARTMODE_PMEM);
-
- return 0;
-}
-EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
-
int cxl_get_dirty_count(struct cxl_memdev_state *mds, u32 *count)
{
struct cxl_mailbox *cxl_mbox = &mds->cxlds.cxl_mbox;
diff --git a/drivers/cxl/core/memdev.c b/drivers/cxl/core/memdev.c
index 99e422594885..166ec6b7d041 100644
--- a/drivers/cxl/core/memdev.c
+++ b/drivers/cxl/core/memdev.c
@@ -582,6 +582,72 @@ bool is_cxl_memdev(const struct device *dev)
}
EXPORT_SYMBOL_NS_GPL(is_cxl_memdev, "CXL");
+static void add_part(struct cxl_dpa_info *info, u64 start, u64 size, enum cxl_partition_mode mode)
+{
+ int i = info->nr_partitions;
+
+ if (size == 0)
+ return;
+
+ info->part[i].range = (struct range) {
+ .start = start,
+ .end = start + size - 1,
+ };
+ info->part[i].mode = mode;
+ info->nr_partitions++;
+}
+
+int cxl_mem_dpa_fetch(struct cxl_memdev_state *mds, struct cxl_dpa_info *info)
+{
+ struct cxl_dev_state *cxlds = &mds->cxlds;
+ struct device *dev = cxlds->dev;
+ int rc;
+
+ if (!cxlds->media_ready) {
+ info->size = 0;
+ return 0;
+ }
+
+ info->size = mds->total_bytes;
+
+ if (mds->partition_align_bytes == 0) {
+ add_part(info, 0, mds->volatile_only_bytes, CXL_PARTMODE_RAM);
+ add_part(info, mds->volatile_only_bytes,
+ mds->persistent_only_bytes, CXL_PARTMODE_PMEM);
+ return 0;
+ }
+
+ rc = cxl_mem_get_partition_info(mds);
+ if (rc) {
+ dev_err(dev, "Failed to query partition information\n");
+ return rc;
+ }
+
+ add_part(info, 0, mds->active_volatile_bytes, CXL_PARTMODE_RAM);
+ add_part(info, mds->active_volatile_bytes, mds->active_persistent_bytes,
+ CXL_PARTMODE_PMEM);
+
+ return 0;
+}
+EXPORT_SYMBOL_NS_GPL(cxl_mem_dpa_fetch, "CXL");
+
+/**
+ * cxl_set_capacity: initialize dpa by a driver without a mailbox.
+ *
+ * @cxlds: pointer to cxl_dev_state
+ * @capacity: device volatile memory size
+ */
+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity)
+{
+ struct cxl_dpa_info range_info = {
+ .size = capacity,
+ };
+
+ add_part(&range_info, 0, capacity, CXL_PARTMODE_RAM);
+ return cxl_dpa_setup(cxlds, &range_info);
+}
+EXPORT_SYMBOL_NS_GPL(cxl_set_capacity, "CXL");
+
/**
* set_exclusive_cxl_commands() - atomically disable user cxl commands
* @mds: The device state to operate on
diff --git a/drivers/net/ethernet/sfc/efx_cxl.c b/drivers/net/ethernet/sfc/efx_cxl.c
index 6937616ec362..6619084a77d8 100644
--- a/drivers/net/ethernet/sfc/efx_cxl.c
+++ b/drivers/net/ethernet/sfc/efx_cxl.c
@@ -70,6 +70,11 @@ int efx_cxl_init(struct efx_probe_data *probe_data)
*/
cxl->cxlds.media_ready = true;
+ if (cxl_set_capacity(&cxl->cxlds, EFX_CTPIO_BUFFER_SIZE)) {
+ pci_err(pci_dev, "dpa capacity setup failed\n");
+ return -ENODEV;
+ }
+
probe_data->cxl = cxl;
return 0;
diff --git a/include/cxl/cxl.h b/include/cxl/cxl.h
index fa7269154620..1346771edc4e 100644
--- a/include/cxl/cxl.h
+++ b/include/cxl/cxl.h
@@ -223,4 +223,6 @@ struct cxl_dev_state *_devm_cxl_dev_state_create(struct device *dev,
(drv_struct *)_devm_cxl_dev_state_create(parent, type, serial, dvsec, \
sizeof(drv_struct), mbox); \
})
+
+int cxl_set_capacity(struct cxl_dev_state *cxlds, u64 capacity);
#endif /* __CXL_CXL_H__ */
--
2.34.1
^ permalink raw reply related
* [PATCH v25 10/11] cxl: Avoid dax creation for accelerators
From: alejandro.lucero-palau @ 2026-03-30 14:38 UTC (permalink / raw)
To: linux-cxl, netdev, dave.jiang, dan.j.williams, edward.cree, davem,
kuba, pabeni, edumazet
Cc: Alejandro Lucero, Jonathan Cameron, Davidlohr Bueso, Ben Cheatham
In-Reply-To: <20260330143827.1278677-1-alejandro.lucero-palau@amd.com>
From: Alejandro Lucero <alucerop@amd.com>
By definition a type2 cxl device will use the host managed memory for
specific functionality, therefore it should not be available to other
uses like DAX.
Signed-off-by: Alejandro Lucero <alucerop@amd.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Davidlohr Bueso <daves@stgolabs.net>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Reviewed-by: Ben Cheatham <benjamin.cheatham@amd.com>
---
drivers/cxl/core/region.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/cxl/core/region.c b/drivers/cxl/core/region.c
index b3a6d08be461..6a89a1817199 100644
--- a/drivers/cxl/core/region.c
+++ b/drivers/cxl/core/region.c
@@ -4264,6 +4264,13 @@ static int cxl_region_probe(struct device *dev)
if (rc)
return rc;
+ /*
+ * HDM-D[B] (device-memory) regions have accelerator specific usage.
+ * Skip device-dax registration.
+ */
+ if (cxlr->type == CXL_DECODER_DEVMEM)
+ return 0;
+
/*
* From this point on any path that changes the region's state away from
* CXL_CONFIG_COMMIT is also responsible for releasing the driver.
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox