mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
1,481,701 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Daniel Baluta
|
f24cfafd1e |
soc: qcom: ubwc: Fix link error when QCOM_SMEM=n
ubwc_config.c calls qcom_smem_is_available() and qcom_smem_dram_get_hbb()
unconditionally, so QCOM_UBWC_CONFIG=y with QCOM_SMEM=n fails to link:
arm-linux-gnueabihf-ld: ubwc_config.c:(.text+0x2c): undefined
reference to 'qcom_smem_is_available'
Add the missing 'depends on QCOM_SMEM'.
Fixes:
|
||
|
Daniel Baluta
|
8afb928301 |
media: iris: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM
QCOM_UBWC_CONFIG is about to depend on QCOM_SMEM. Guard the
VIDEO_QCOM_IRIS select with 'if ARCH_QCOM && QCOM_SMEM', and add
'depends on QCOM_SMEM || QCOM_SMEM=n' so a built-in driver is never
selected against a missing or modular SMEM.
Fixes:
|
||
|
Daniel Baluta
|
a1ee4bb25b |
drm/msm: Guard the QCOM_UBWC_CONFIG select with QCOM_SMEM
QCOM_UBWC_CONFIG is about to depend on QCOM_SMEM. Guard the DRM_MSM
select with 'if ARCH_QCOM && QCOM_SMEM', and add
'depends on QCOM_SMEM || QCOM_SMEM=n' so a built-in driver is never
selected against a missing or modular SMEM.
Fixes:
|
||
Baokun Li
|
ed97699493 |
fuse: reject a duplicate fd= mount option
fuse_opt_fd() stored the fuse device in ctx->fud and bumped its refcount
unconditionally:
ctx->fud = fuse_dev_grab(file);
If fd= is given twice (two fsconfig FSCONFIG_SET_FD calls), the second
call overwrites ctx->fud and grabs the new device, while the reference
taken on the first device is never released - a permanent refcount leak
that pins the first fuse_dev until reboot.
Reject a second fd= outright. ctx is zeroed on allocation, so a non-NULL
ctx->fud reliably means the option was already processed.
Fixes:
|
||
Thomas Gleixner
|
c793bbfc4a |
timer: Keep debugobjects state consistent in migrate_timer_list()
When timers are migrated away from an offline CPU the debugobjects state
gets corrupted. The timer is accounted as inactive on deletion, but the
enqueue on the alive CPU lacks the activation call.
That used to work, but got broken when the trace point and the debug
objects call got separated. That change missed to fixup
migrate_timer_list().
Add the missing debug_timer_activate() invocation to fix it.
Fixes:
|
||
Qing Ming
|
29e63b8d9f |
mpls: reload header after pskb_may_pull()
mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop
when an MPLS route has multiple nexthops. While walking the MPLS label
stack, the hash routine caches hdr for the current label. After finding
the bottom-of-stack label, it calls pskb_may_pull() before reading the
inner IP header.
If an skb is constructed with the inner IP header in nonlinear data and
insufficient tailroom in the linear head, pskb_may_pull() calls
pskb_expand_head() to replace the skb head and free the old one. This
leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr
again when it performs a second pull for the larger header.
The issue was found through static analysis. A reproducer sending a legal
Geneve packet through a bareudp/MPLS multipath setup triggered the same
KASAN report in 2 of 2 unpatched runs:
BUG: KASAN: slab-use-after-free in mpls_select_multipath
Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23
Call Trace:
mpls_select_multipath
mpls_forward
__netif_receive_skb_list_core
netif_receive_skb_list_internal
napi_complete_done
gro_cell_poll
__napi_poll
net_rx_action
Freed by task 23:
kfree
pskb_expand_head
__pskb_pull_tail
mpls_select_multipath
Reload hdr from the current skb head after each successful pull before
deriving the inner IPv4 or IPv6 header pointer.
Fixes:
|
||
Weiming Shi
|
c22f91d82c |
fs/ntfs3: validate ef->size covers the record's name and value
When an EA record has a non-zero ef->size, ntfs_read_ea() only checks
that the record fits in the remaining buffer (ea_size > bytes), not that
ef->size is large enough to hold the record's own name_len + 1 + elength.
A crafted image can pass validation with, e.g., ef->size = 24 but
elength = 0xffff. ntfs_get_ea() then trusts elength and copies it out of
the undersized record, reading past the kmalloc(info->size) allocation
and leaking heap memory to userspace via getxattr():
BUG: KASAN: slab-out-of-bounds in ntfs_get_ea (fs/ntfs3/xattr.c:302)
Read of size 65535 at addr ffff888100794550 by task exploit
__asan_memcpy (mm/kasan/shadow.c:105)
ntfs_get_ea (fs/ntfs3/xattr.c:302)
ntfs_getxattr (fs/ntfs3/xattr.c:848)
__vfs_getxattr (fs/xattr.c:441)
vfs_getxattr (fs/xattr.c:474)
do_getxattr (fs/xattr.c:800)
path_getxattrat (fs/xattr.c:868)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
The buggy address is located 80 bytes inside of
allocated 84-byte region in cache kmalloc-96
Compute the size the record needs and require ef->size to cover it.
Fixes:
|
||
Konstantin Komarov
|
de603b9d37 |
fs/ntfs3: fix out-of-bounds read in read_log_rec_buf()
read_log_rec_buf() copies a log record into a caller buffer starting at
u32 off = lsn_to_page_off(log, lsn) + log->record_header_len;
log->record_header_len (and log->data_off, used for the following pages)
comes verbatim from the on-disk restart area and is only checked for
8-byte alignment in is_rst_area_valid(), so off can exceed
log->page_size. "tail = log->page_size - off" then underflows and
memcpy() reads past the page_size-sized buffer returned by
read_log_page(), spilling adjacent slab memory into the replay buffer.
This is reachable by mounting a crafted NTFS image:
BUG: KASAN: slab-out-of-bounds in read_log_rec_buf+0x216/0x580
Read of size 64 at addr ffff88800a877ff8 by task exploit/127
read_log_rec_buf fs/ntfs3/fslog.c:2299
log_replay fs/ntfs3/fslog.c:4216
ntfs_loadlog_and_replay fs/ntfs3/fsntfs.c:324
ntfs_fill_super fs/ntfs3/super.c:1392
get_tree_bdev_flags fs/super.c:1694
__x64_sys_mount fs/namespace.c:4360
The buggy address is located 4088 bytes to the right of
the 4096-byte region [ffff88800a876000, ffff88800a877000)
Reject an in-page offset outside the current page before the copy.
Fixes:
|
||
|
Baokun Li
|
4deb3edead |
cuse: wait for pending RCU callbacks on module exit
Since commit |
||
|
Baokun Li
|
a927f1867e |
fuse: fix invalidate lock leak on open O_TRUNC DAX failure
fuse_open() takes filemap_invalidate_lock() for a DAX truncate
(dax_truncate = true) and releases it before the out_inode_unlock
label. But when fuse_dax_break_layouts() fails, the goto
out_inode_unlock skips the unlock and leaks the rwsem, so any later
fault or truncate on the file stalls on the stale lock.
fuse_dax_break_layouts() can fail with -ERESTARTSYS when a signal
interrupts the wait for busy DAX pages to drain:
open("file", O_RDWR | O_TRUNC)
└─ fuse_open()
├─ filemap_invalidate_lock() # dax_truncate
└─ fuse_dax_break_layouts()
└─ dax_break_layout()
└─ wait_page_idle() # TASK_INTERRUPTIBLE
└─ fuse_wait_dax_page() # unlock, schedule, re-lock
└─ signal → -ERESTARTSYS
goto out_inode_unlock # <- lock leaked
Fix this by moving filemap_invalidate_unlock() below the label so
that all error paths release the lock, and rename the label to
out_unlock as it now covers more than just the inode lock.
Fixes:
|
||
|
Baokun Li
|
9afeca0d56 |
fuse: fix invalidate lock leak on setattr writeback failure
fuse_do_setattr() takes filemap_invalidate_lock() for a DAX truncate
(fault_blocked = true) and releases it at the out:/error: labels. But
when a writeback flush is also needed, a write_inode_now() failure
returns directly and leaks the lock, so any later fault or truncate on
the file stalls on the stale rwsem.
For example, truncate(2) on a setuid file reaches fuse_do_setattr()
with both ATTR_SIZE and ATTR_MODE set:
truncate(2)
└─ do_truncate()
├─ dentry_needs_remove_privs() # S_ISUID
└─ notify_change() # KILL_SUID -> ATTR_MODE
└─ fuse_setattr() # no killpriv:
│ # ia_valid |= ATTR_MODE
└─ fuse_do_setattr()
├─ filemap_invalidate_lock() # IS_DAX && is_truncate
└─ write_inode_now() # is_wb && ATTR_MODE
└─ if (err) # e.g. daemon -> -EIO
return err # <- lock leaked
Fix this by adding an unlock label that releases the lock before
returning the error, and use it for the fuse_dax_break_layouts()
failure path as well.
Fixes:
|
||
Takashi Iwai
|
b2b82ce147 |
ASoC: Updates for v7.3
A very busy release, a combination of a lot of new device work and more
people than usual doing various subsystem wide improvements in the code.
The main subsystem level change is the work Morimoto-san has been doing
to get automatic DAI format selection more widely deployed, and even
that is largely changes in the drivers to enable use of the feature
rather than framework work.
- Conversions of a lot of drivers to use the automatic DAI format
selection code from Morimoto-san.
- Many fixes and code improvements from bui duc phuc and Morimoto-san.
- Fixes for ordering problems in register default tables from Peter
Ujfalusi.
- Changes to use auto-cleanup for firmware to improve robustness from
Takashi Iwai.
- Support for firmware on more Awinc devices.
- Many changes in the Qualcomm driver stack, mostly around new platform
support.
- Support for AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300,
Meson GX formatter and interface, Qualcomm LPI MI2S, SM8475 and
WSA855 and Realtek RT1321 VA1/2 and RT766/7.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmqDIPkACgkQJNaLcl1U
h9BOVgf/SMQ3h9+jUQhtPSODZrUn3ke8e70gAchWM0vZeqjV78eLVXNvOYDoKHnS
nM3LAc4uMclXBXT8nV9JPBdCg3Pw1S26Dvuuqttcta7bwcZ/2cDzB3N3IA7dD8Rj
vICECoTNep/hhdchsiO7swU3If6HnRgjX2B6C9XwkoZSrCQZ5KidjtZUGXYgIvQK
pB5qTvtGVvTGINmb6QsqXRBfXsgvOPcNHECSkOHkhLPCQb+YbGzOMDrSMcELl9db
xGL3I+n/n6mjANxxjZfzNLWqV1xdHlJeODXC8Z1bQofOFGzSBR+1FGEzbvC/cDh4
VsrG4+gBd3mvE1xxodTaYKQH4RxaKw==
=RMbR
-----END PGP SIGNATURE-----
Merge tag 'asoc-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus
ASoC: Updates for v7.3
A very busy release, a combination of a lot of new device work and more
people than usual doing various subsystem wide improvements in the code.
The main subsystem level change is the work Morimoto-san has been doing
to get automatic DAI format selection more widely deployed, and even
that is largely changes in the drivers to enable use of the feature
rather than framework work.
- Conversions of a lot of drivers to use the automatic DAI format
selection code from Morimoto-san.
- Many fixes and code improvements from bui duc phuc and Morimoto-san.
- Fixes for ordering problems in register default tables from Peter
Ujfalusi.
- Changes to use auto-cleanup for firmware to improve robustness from
Takashi Iwai.
- Support for firmware on more Awinc devices.
- Many changes in the Qualcomm driver stack, mostly around new platform
support.
- Support for AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300,
Meson GX formatter and interface, Qualcomm LPI MI2S, SM8475 and
WSA855 and Realtek RT1321 VA1/2 and RT766/7.
|
||
Zihan Xi
|
4e9442ce55 |
xfrm: bound nat keepalive state collection
The v1 nat keepalive fix allocates a GFP_ATOMIC object for every state
while collecting references for phase two. This makes the worker's
temporary memory use depend on the number of states and lets -ENOMEM abort
the scan.
Replace the allocated list with a fixed-size batch. When the batch is full,
return a private walk status so xfrm_state_walk() leaves a cursor; drain
the references after the walk releases xfrm_state_lock and resume from
the cursor. This bounds temporary memory use and avoids the allocation
failure path.
The v1 fix also moved nat_keepalive_send() out of the walk callback. Keep
the phase-two drain BH-disabled, as required by local_lock_nested_bh()
used by the keepalive sockets.
Fixes:
|
||
Linus Torvalds
|
0f23d56f17 |
linux_kselftest-next-7.3-rc1
Fixes zram test failure in kernel_gte() when using dash and a spelling error in ftrace poll test comment. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmqDcTUACgkQCwJExA0N Qxxq6Q/7BCbPLp7csLCB5d37VO7OZ0bxgCu3W7hjQC6Edy0PAW29YuYdFKFqQ4b6 Sw+z4m02uYrHwTNvaKSA6S9QiHHzjUp5ldX5HQ4LUKVADUuNVF6N6U/LxUofmHtp dpE8z4D0ueMj7XkoDwjUgq03brS2YSnL7fsjLcX7bSwGh4BmantGp4Yig1ffL1SG 0EziRDQLAY9Iepr2UZ8kFkW4mTSLSXMNApTzL8FGcv6nUzvm9VM+SJdK1g9f1qph hccbz3s/QWXy1uG2H5Gp4BRrPkvgnabhe7WRnf3PUAD1QPdPfch6UrcpB0hVF4tx x2/grMmuf+rDlDVZwDNv9UbelIvT2Ll9Zt9fRzA6mqGWyjHgIzIxwpCb+dmQfw2q u/Rkzk9Oc1H7+ZalySv44jXTdJj5G+cGaQzT6GbQ+kTnJqT2PtNVQlZdKnPgjBFq 8HsxT8KX1NvW9zDqUFG1lBsbssigL7pKDTM9dIqxR+g3Qs6bgCOo/vaNPemhA1ih ldhNrDrgL9sl2xio23URQS30swe6qtbte2Dd30OA+dLD3PM4tmfeznLp2fdElehD KzXi/PlicRFKQmOa/QPxaLphGaKX99dyWmgzCzFqnCA+i8xotxIFVTFQCyfrMx6O +Qmd9qnJyHyiTEeszvyESH998fByTh4EN9g/XZmb5lMgyxu6gh4= =2Uye -----END PGP SIGNATURE----- Merge tag 'linux_kselftest-next-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest update from Shuah Khan: "Fix zram test failure in kernel_gte() when using dash and a spelling error in ftrace poll test comment" * tag 'linux_kselftest-next-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: selftests/zram: fix kernel_gte() for POSIX sh selftests/ftrace: fix spelling error in poll test comment |
||
|
Linus Torvalds
|
fd89b0be55 |
linux_kselftest-kunit-7.3-rc1
Fixes and new kunit and tool, enables new configs, and updates
documentation:
-- kunit: configs: enable GPIO kunit test cases in all_tests.config
-- kunit: string-stream: Replace strlcat() with strscpy() and seq_buf
-- kunit: configs: enable GPIO kunit test cases in all_tests.config
-- Documentation: kunit: Test Kconfig entries shouldn't select other
configs
-- Documentation: kunit: Fix outdated FAQ entries
Adds ability to skip entire test suites and an example test suite that
can be skipped at runtime.
-- kunit,rust: Add ability to skip entire test suites
-- kunit: Add example of test suite that can be skipped at runtime
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmqDa/4ACgkQCwJExA0N
Qxyo9BAAqaZhmbNMJoKQ7bU6sM7qHOVC7ZxWNE028Pij/Imi53270LF0W2muOgsV
Ex8I5uTr/pMlClAJSSpz/Cu8YN+coXhKVlJvOmvUAd5buveVFuQpwL9kmZmhqD/c
8S4N1fYYOIxXP+bxbYTdmBXCH+AwdfAAsRucZ+nLOK8g2ZDEfkQPScASHjNgQ9ED
ZG6iRNynVRAigypzdBCU1KMs0+PbU0BK6f78l9HoUEBprjyUOaO4bJU9CxWamL7x
ebJGU7xYmcr6t34VFQp8aHxMVIe1b6oiXXTvfGmVx8WtUAe1h8cm7ACU2apPSLlV
PAjlj0bAtkBBBae3gI6oatWn0dOMeR76CdaKpLhhXXjDXod7Q41gu/WaxSIS1Jjb
CotFVWalqpfTpLGiUvSRH9FXDaaUgskODHwAQO3EW9QpexxaWPciLUtWCRbvfFU9
EEN/zxkSKME9DW6Z8pjwtnJgZ3/GEl+fTxQsRZ5NMkYY9RBo8OeZMlUSx6aACEl0
etqWTQI3kIdojGifTCndKFhExe9hl/H48PORvQZUijOfcjWVEk45+i1W9YyB+DPg
5V1b4lyq01IdAlxigK5BVklL5jzXFouR+eouhsfSd1c8rIQosJgzt1iB/9nWjB1n
Dd84PcsqAKvt2kojFHQXaJhwryP0OxV6VgDFdqDfZ/dZuuobEZ0=
=09RL
-----END PGP SIGNATURE-----
Merge tag 'linux_kselftest-kunit-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
Pull kunit updates from Shuah Khan:
"Fixes and new kunit and tools, enable new configs:
- configs: enable GPIO kunit test cases in all_tests.config
- string-stream: Replace strlcat() with strscpy() and seq_buf
- configs: enable GPIO kunit test cases in all_tests.config
Documentation:
- Test config entries shouldn't select other configs
- Fix outdated FAQ entries
Add the ability to skip entire test suites and an example test suite
that can be skipped at runtime:
- Add ability to skip entire test suites
- Add example of test suite that can be skipped at runtime"
* tag 'linux_kselftest-kunit-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
kunit: tool: fix _list_tests filtering wrong variable when list has TAP prefix
kunit: configs: enable GPIO kunit test cases in all_tests.config
kunit: string-stream: Replace strlcat() with strscpy() and seq_buf
Documentation: kunit: Fix outdated FAQ entries
Documentation: kunit: Test Kconfig entries shouldn't select other configs
kunit: Add example of test suite that can be skipped at runtime
kunit,rust: Add ability to skip entire test suites
|
||
|
Linus Torvalds
|
fc8c78bce3 |
Crypto library tests for 7.3
- Add comprehensive KUnit test suites for the new AES-GCM and AES-CCM library APIs. - Add FIPS self-tests for all the AES encryption modes. This is needed for parity with the traditional crypto API. - Fix a couple more issues in the IRQ test helper. -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaoEsfhQcZWJpZ2dlcnNA a2VybmVsLm9yZwAKCRDzXCl4vpKOK9LWAQD9ELPYkGqv76fC5x5/Tcm9amo3ZDEX ymx+Q15jmZkgKAD/TWpZJ2eQ9BELHY21VBHwRP8O+agWQUUwxFayZpHE6gw= =ez1k -----END PGP SIGNATURE----- Merge tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux Pull crypto library test updates from Eric Biggers: - Add comprehensive KUnit test suites for the new AES-GCM and AES-CCM library APIs - Add FIPS self-tests for all the AES encryption modes. This is needed for parity with the traditional crypto API - Fix a couple more issues in the IRQ test helper * tag 'libcrypto-tests-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux: lib/crypto: aes-cmac: Use __cleanup() instead of memzero_explicit() kunit: irq: Unregister on-stack timer and work from debugobjects kunit: irq: Continue increasing hrtimer interval for longer lib/crypto: tests: Add KUnit test suite for AES-GCM lib/crypto: tests: Add KUnit test suite for AES-CCM lib/crypto: tests: Add aead-test-template.h lib/crypto: tests: Use per-test-case buffers in hash tests lib/crypto: tests: Create test-utils.h lib/crypto: aes: Add FIPS self-tests for GCM and CCM lib/crypto: aes: Add FIPS self-tests for unauthenticated modes lib/crypto: fips: Split fips.h into fips-aes.h and fips-sha.h |
||
|
Linus Torvalds
|
d47db9bf50 |
Crypto library updates for 7.3
Add library APIs for most AES encryption modes that are used in the
kernel (ECB, CBC, CBC-CTS, CTR, XCTR, XTS, GCM, CCM).
These AES modes have many in-kernel users that are currently using the
crypto_skcipher or crypto_aead APIs. These existing APIs are difficult
to use and inefficient. Until now, the lack of proper library support
for these has been the main gap in the crypto library.
This set of changes is the next stage of addressing it:
- Implement the new APIs on top of the existing support for
single-block AES in the library.
- Fully document the new APIs.
- Migrate the only user of the old AES-GCM library API to the new,
more flexible API; then remove the old API and its implementation.
- Wire up the new APIs to the traditional crypto API by adding
crypto_skcipher and crypto_aead algorithms.
This makes the new APIs be covered by the traditional crypto API's
self-tests. It also makes them be already used for real on systems
that don't have architecture-optimized code for these modes.
But most importantly, this is a prerequisite for migrating the
architecture-optimized code for these AES modes (i.e.
arch/*/crypto/aes*) into the library, which as usual will
eliminate a lot of redundant "glue" code.
Note that unlike some of the other algorithms that have been migrated
to the library, e.g. SHA-512, for these AES modes there was too much
to get done in one cycle. Nor did it make sense to handle these modes
one at a time, because they tend to be coupled together or depend on
each other, especially in the architecture-optimized AES code.
Thus, most of the benefits (reductions in lines of code, performance
improvements, etc.) will follow in later cycles when
architecture-optimized code is migrated into the library and users of
crypto_skcipher and crypto_aead are updated to use the new APIs.
The design of the new APIs was informed by writing proof-of-concept
patches for many kernel subsystems currently accessing these same
algorithms via crypto_skcipher or crypto_aead (patches 18-33 of
https://lore.kernel.org/r/20260707053503.209874-1-ebiggers@kernel.org/).
While those patches will be resent for real later, the total diffstat
for them was negative 1905 lines. So clearly the new APIs are quite a
bit easier to use and align better with what users actually need.
Besides the new AES encryption APIs, there are also a few changes for
improved AES-CMAC key and context zeroization.
-----BEGIN PGP SIGNATURE-----
iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaoEqhRQcZWJpZ2dlcnNA
a2VybmVsLm9yZwAKCRDzXCl4vpKOKy8YAP4o44z09KdugtigFIFX7qQnLk0uPAw+
sTPqmu+FA4jOGAD/Vy23hzAVpWmSBFhyo7HMK9W0ABK7cqj6x23I/N6JRgM=
=SLPT
-----END PGP SIGNATURE-----
Merge tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux
Pull crypto library updates from Eric Biggers:
"Add library APIs for most AES encryption modes that are used in the
kernel (ECB, CBC, CBC-CTS, CTR, XCTR, XTS, GCM, CCM).
These AES modes have many in-kernel users that are currently using the
crypto_skcipher or crypto_aead APIs. These existing APIs are difficult
to use and inefficient. Until now, the lack of proper library support
for these has been the main gap in the crypto library.
This set of changes is the next stage of addressing it:
- Implement the new APIs on top of the existing support for
single-block AES in the library.
- Fully document the new APIs.
- Migrate the only user of the old AES-GCM library API to the new,
more flexible API; then remove the old API and its implementation.
- Wire up the new APIs to the traditional crypto API by adding
crypto_skcipher and crypto_aead algorithms.
This makes the new APIs be covered by the traditional crypto API's
self-tests. It also makes them be already used for real on systems
that don't have architecture-optimized code for these modes.
But most importantly, this is a prerequisite for migrating the
architecture-optimized code for these AES modes (i.e.
arch/*/crypto/aes*) into the library, which as usual will eliminate
a lot of redundant "glue" code.
Note that unlike some of the other algorithms that have been migrated
to the library, e.g. SHA-512, for these AES modes there was too much
to get done in one cycle. Nor did it make sense to handle these modes
one at a time, because they tend to be coupled together or depend on
each other, especially in the architecture-optimized AES code.
Thus, most of the benefits (reductions in lines of code, performance
improvements, etc.) will follow in later cycles when
architecture-optimized code is migrated into the library and users of
crypto_skcipher and crypto_aead are updated to use the new APIs.
The design of the new APIs was informed by writing proof-of-concept
patches for many kernel subsystems currently accessing these same
algorithms via crypto_skcipher or crypto_aead (patches 18-33 of
https://lore.kernel.org/r/20260707053503.209874-1-ebiggers@kernel.org/).
While those patches will be resent for real later, the total diffstat
for them was negative 1905 lines. So clearly the new APIs are quite a
bit easier to use and align better with what users actually need.
Besides the new AES encryption APIs, there are also a few changes for
improved AES-CMAC key and context zeroization"
* tag 'libcrypto-updates-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux:
mac80211: fils_aead: Use __cleanup() instead of memzero_explicit()
Bluetooth: SMP: clear the aes_cmac_key when done
smb: clear the aes_cmac_key and aes_cmac_ctx when done
lib/crypto: aes-cmac: Add zeroization functions
lib/crypto: aesgcm: Remove old AES-GCM library
x86/sev: Remove obsolete virtual address check
x86/sev: Use new AES-GCM library
crypto: aes - Add CCM support using library
crypto: aes - Add GCM support using library
crypto: aes - Add XTS support using library
crypto: aes - Add CTR and XCTR support using library
crypto: aes - Add CBC and CBC-CTS support using library
crypto: aes - Add ECB support using library
lib/crypto: aes: Add CCM support
lib/crypto: aes: Add GCM support
lib/crypto: aes: Add XTS support
lib/crypto: aes: Add CTR and XCTR support
lib/crypto: aes: Add CBC and CBC-CTS support
lib/crypto: aes: Add ECB support
crypto: xts - Split out __xts_verify_key() helper
|
||
|
Linus Torvalds
|
1d7443e4dc |
fscrypt updates for 7.3
The main change this cycle is a significant simplification that's been
overdue for a while now: standardizing on a single file contents
encryption implementation in ext4 and f2fs, instead of having two.
Specifically, the original filesystem-layer file contents encryption
implementation is removed, and the blk-crypto implementation is now
used unconditionally. blk-crypto delegates either to inline crypto
hardware or to the CPU via blk-crypto-fallback. The latter is
functionally equivalent to the original filesystem-layer code.
The blk-crypto implementation already existed, but previously it was
used only when the filesystem was mounted with "-o inlinecrypt". Now,
"-o inlinecrypt" just selects whether inline crypto hardware is used.
To allow maintaining that user control over hardware use, the
blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW.
Overall, this removes quite a bit of redundant code from ext4, f2fs,
and fs/crypto/. It should make things easier for ongoing filesystem
efforts such as iomap support, large folios, and btrfs encryption.
(btrfs had already been planning to use blk-crypto exclusively.)
There are two small behavior changes of note:
- Direct I/O now works on encrypted files even without
"-o inlinecrypt", rather than falling back to buffered I/O. This is
effectively a bugfix, though I'll continue to keep an eye out for
any user that may have been depending on the buffered I/O fallback.
- IV_INO_LBLK_32 policies are no longer supported in certain cases
that didn't make sense and have no known uses.
This has been in linux-next since July 22 with no reported issues.
All encryption xfstests pass on ext4 and f2fs. As usual I've also been
using it on a system with an fscrypt-encrypted home directory. Of
course, the blk-crypto code paths also aren't new and were already
being used on many systems via the inlinecrypt mount option.
In addition to the main change described above, there are a few other
cleanups such as using lock guards for mutexes, improving
documentation, and removing a workaround for outdated gcc versions.
-----BEGIN PGP SIGNATURE-----
iIoEABYIADIWIQSacvsUNc7UX4ntmEPzXCl4vpKOKwUCaoDumhQcZWJpZ2dlcnNA
a2VybmVsLm9yZwAKCRDzXCl4vpKOKwk1AP9gAHdxAK2tr+Wpklkos/qTMR3a7h2I
xLmgwhLHmHoHTgD/cD+0eMoK4RIVVGS/73Bf7oF2qY5jOyfi1aGh4ERQ0AA=
=0+o6
-----END PGP SIGNATURE-----
Merge tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux
Pull fscrypt updates from Eric Biggers:
"The main change this cycle is a significant simplification that's been
overdue for a while now: standardizing on a single file contents
encryption implementation in ext4 and f2fs, instead of having two.
Specifically, the original filesystem-layer file contents encryption
implementation is removed, and the blk-crypto implementation is now
used unconditionally. blk-crypto delegates either to inline crypto
hardware or to the CPU via blk-crypto-fallback. The latter is
functionally equivalent to the original filesystem-layer code.
The blk-crypto implementation already existed, but previously it was
used only when the filesystem was mounted with "-o inlinecrypt". Now,
"-o inlinecrypt" just selects whether inline crypto hardware is used.
To allow maintaining that user control over hardware use, the
blk-crypto API is extended with a new flag BLK_CRYPTO_CFG_ALLOW_HW.
Overall, this removes quite a bit of redundant code from ext4, f2fs,
and fs/crypto/. It should make things easier for ongoing filesystem
efforts such as iomap support, large folios, and btrfs encryption
(btrfs had already been planning to use blk-crypto exclusively.)
There are two small behavior changes of note:
- Direct I/O now works on encrypted files even without "-o inlinecrypt",
rather than falling back to buffered I/O. This is effectively a
bugfix, though I'll continue to keep an eye out for any user that
may have been depending on the buffered I/O fallback.
- IV_INO_LBLK_32 policies are no longer supported in certain cases
that didn't make sense and have no known uses.
This has been in linux-next since July 22 with no reported issues. All
encryption xfstests pass on ext4 and f2fs. As usual I've also been
using it on a system with an fscrypt-encrypted home directory. Of
course, the blk-crypto code paths also aren't new and were already
being used on many systems via the inlinecrypt mount option.
In addition to the main change described above, there are a few other
cleanups such as using lock guards for mutexes, improving
documentation, and removing a workaround for outdated gcc versions"
* tag 'fscrypt-for-linus' of git://git.kernel.org/pub/scm/fs/fscrypt/linux: (29 commits)
blk-crypto: Update docs for blk-crypto-fallback motivation
blk-crypto: Remove unused function blk_crypto_config_supported()
fscrypt: Update docs for data path
fscrypt: Remove unused function fscrypt_finalize_bounce_page()
f2fs: Update outdated comment in f2fs_write_begin()
fs: Update outdated comment for SB_INLINECRYPT
fscrypt: Update encryption policy version docs
fscrypt: Replace some variable-size memsets with fixed-size
fscrypt: Add safety checks to non-block-based en/decryption
fscrypt: Merge bio.c and inline_crypt.c into block.c
fscrypt: Remove unused functions and workqueue
fscrypt: Remove fs-layer zeroout code
fscrypt: Remove fscrypt_dio_supported()
fscrypt: Replace calls to fscrypt_inode_uses_inline_crypto()
fs/buffer: Remove fs-layer decryption code
f2fs: Remove fs-layer file contents en/decryption code
ext4: Further de-generalize the bio postprocessing code
ext4: Make ext4_bio_write_folio() return void
ext4: Remove fs-layer file contents en/decryption code
Documentation: fscrypt: Update docs for inlinecrypt
...
|
||
Jakub Kicinski
|
47226bbdef |
Merge branch 'net-mlx5-hws-misc-enhancements'
Tariq Toukan says: ==================== net/mlx5: HWS misc enhancements This series by Yevgeny brings several misc improvements to the mlx5 HWS driver. v2: https://lore.kernel.org/20260810092630.3137666-1-tariqt@nvidia.com v1: https://lore.kernel.org/20260723095349.1890983-1-tariqt@nvidia.com ==================== Link: https://patch.msgid.link/20260816142045.3289452-1-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Yevgeny Kliteynik
|
bc502b3f69 |
net/mlx5: HWS, Remove redundant FW command when reading caps
Remove redundant FW query that isn't really in use. Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260816142045.3289452-6-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yevgeny Kliteynik
|
7e34d2ada9 |
net/mlx5: HWS, Remove redundant MLX5_SET in RTC creation
Remove duplicated setting of field in mlx5hws_cmd_rtc_create(). Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260816142045.3289452-5-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yevgeny Kliteynik
|
5d3ff6671b |
net/mlx5: HWS, Set the num of queues only when alloc succeeded
When initializing send queues, set the number of queues only when allocations are over. Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260816142045.3289452-4-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yevgeny Kliteynik
|
d4c34eebf1 |
net/mlx5: HWS, Log syndrome on STC modify failure
When mlx5_cmd_exec fails for STC modify, include the command syndrome from the output buffer in the error message to aid debugging. Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260816142045.3289452-3-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Yevgeny Kliteynik
|
dcb09aae19 |
net/mlx5: HWS, Print more details for bad completion
When polling for completion returned completion with error, parse some more details: WQE count and syndrome number. Also, extract all the long value-to-string if conditions to a short value-to-string functions: do it for rule resize state, rule status, and syndrome. v2: removed duplicated QPN print Signed-off-by: Yevgeny Kliteynik <kliteyn@nvidia.com> Reviewed-by: Erez Shitrit <erezsh@nvidia.com> Signed-off-by: Tariq Toukan <tariqt@nvidia.com> Link: https://patch.msgid.link/20260816142045.3289452-2-tariqt@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jakub Kicinski
|
e818e7464d |
Merge branch 'gve-adminq-mode-related-refactors'
Harshitha Ramamurthy says: ==================== gve: AdminQ mode related refactors [part] ==================== Link: https://patch.msgid.link/20260814021406.3044324-1-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Harshitha Ramamurthy
|
69886e8085 |
gve: add a few helper functions to set device properties
For the mailbox ABI, device properties will come from a different source compared to the AdminQ mode. To accommodate the new source when the mailbox ABI is added, add a few helper functions to set a few device properties. Those functions are: - gve_set_queue_properties() to set no. of pages for QPL mode and number of queues in general - gve_set_mtu() - gve_set_mac() This is just code movement, no functional change. Reviewed-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Link: https://patch.msgid.link/20260814021406.3044324-4-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Harshitha Ramamurthy
|
94afe5cebc |
gve: refactor initialization with helper functions
In the interest of commonizing code, refactor gve_probe() and gve_init_priv() with a few helper functions that can be expanded and utilized in upcoming patches that add the mailbox ABI to the driver. The helper functions are: - gve_set_num_ntfy_blks() - gve_set_num_queues() Reorder code to combine lines that accomplish a similar objective like setting defaults. Move setting HW-GRO and UDP GSO support out of an Adminq method into gve_init_priv(). These changes are just code movement, no functional change. Reviewed-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Link: https://patch.msgid.link/20260814021406.3044324-3-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Harshitha Ramamurthy
|
063aeece60 |
gve: don't pass in unused parameter to gve_adminq_free
Clean up gve_adminq_free to not take in an unused parameter. Reviewed-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jordan Rhee <jordanrhee@google.com> Signed-off-by: Harshitha Ramamurthy <hramamurthy@google.com> Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com> Link: https://patch.msgid.link/20260814021406.3044324-2-hramamurthy@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Linus Torvalds
|
63c070cba0 |
nilfs2 updates for v7.3
- nilfs2: standardize the inode number type to u64
- nilfs2: enhance btree node keys check
- nilfs2: suppress false positive WARN_ONs for sufile after an FS error
- nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
- nilfs2: prevent out-of-bounds read in super root block parsing
- nilfs2: fix infinite loop in nilfs_clean_segments()
- nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
- Documentation: fix grammar in description of nilfs2 recovery code
- nilfs2: handle corrupted checkpoint count gracefully during deletion
- nilfs2: reject invalid block index in GC ioctl
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCaoNiIQAKCRAhI4xTh21N
nW+YAQCIBwhBkHCHiBPeupSxYar35F/+f5xj4JCh0j6PrbwbYAEAyGJRw9QJNczy
rIVKmh2yuqyukCnPGFRFVBJQAFXHHQQ=
=M3Sh
-----END PGP SIGNATURE-----
Merge tag 'nilfs2-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2
Pull nilfs2 updates from Viacheslav Dubeyko:
"This contains fixes of syzbot reported issue and various fixes in
NILFS2 functionality:
- Reject super-root inode sizes whose computed on-disk footprint
exceeds the filesystem block size (David Lee)
- Replace WARN_ON() in nilfs_cpfile_delete_checkpoints() with
returning -EIO and reporting a filesystem error via nilfs_error()
in the case of corrupted checkpoint count on the storage medium
(Igor Putko)
- Fixed a potential infinite loop in nilfs_clean_segments() reported
by syzbot (Joshua Crofts)
In nilfs_clean_segments(), if err is non-zero, logic logs the error
and sleeps but doesn't abort when it encounters a terminal error
like -EROFS. This causes the thread to loop forever.
Fix this by breaking out of the loop if nilfs_segctor_construct()
returns -EROFS.
- Fix small grammar mistake in the description for nilfs2 recovery
code (Manoj K M)
- Multiple fixes by Ryusuke Konishi:
- fix the list corruption issue recently detected by syzbot, that
can occur when out-of-range values are intentionally passed to
certain GC ioctl parameters
- fix a flaw in the original B-tree implementation related to
truncation and resolves the reported out-of-bounds memory
access issue
- fix an issue reported by syzbot where a kernel BUG could be
triggered depending on timing after filesystem corruption is
detected
- fix an issue where a WARN_ON check is triggered by sufile
functions within the log writer after the filesystem degrades
to read-only mode
- Check for sorted keys when reading btree node blocks into the cache
(Wang Jianjian)
This prevents unexpected errors during the block number assignment
phase in log writing caused by key order inconsistencies, as well
as the kernel warnings reported by syzbot"
* tag 'nilfs2-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
nilfs2: standardize the inode number type to u64
nilfs2: enhance btree node keys check
nilfs2: suppress false positive WARN_ONs for sufile after an FS error
nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch
nilfs2: prevent out-of-bounds read in super root block parsing
nilfs2: fix infinite loop in nilfs_clean_segments()
nilfs2: fix slab-out-of-bounds in nilfs_direct_propagate after truncation
Documentation: fix grammar in description of nilfs2 recovery code
nilfs2: handle corrupted checkpoint count gracefully during deletion
nilfs2: reject invalid block index in GC ioctl
|
||
Nikolay Aleksandrov
|
21040c7f93 |
net: bridge: vlan: fix inverted default vlan notification
A notification should be emitted only when the vlan delete was successful
and not otherwise. The proper check is if br/nbp_vlan_delete returned 0.
Fixes:
|
||
Ahmad Fatoum
|
fb58b6a696 |
net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO
rtl83xx_reset_assert() and rtl83xx_reset_deassert() are only called from
the probe path, which may sleep and is not timing-critical. When the
reset GPIO is provided by a sleeping controller such as an I2C I/O
expander, gpiod_set_value() warns:
WARNING: drivers/gpio/gpiolib.c:4030 at gpiod_set_value+0x44/0x80, CPU#1: kworker/u16:4/61
Hardware name: B&O MAP CA33 Rev f (UNKNOWN) (DT)
Workqueue: events_unbound deferred_probe_work_func
pc : gpiod_set_value+0x44/0x80
lr : rtl83xx_probe+0x1d8/0x3a0
Call trace:
gpiod_set_value+0x44/0x80 (P)
rtl83xx_probe+0x1d8/0x3a0
realtek_mdio_probe+0x24/0xa0
mdio_probe+0x38/0x78
really_probe+0xc4/0x3e0
__driver_probe_device+0x15c/0x1b8
driver_probe_device+0xb4/0x120
__device_attach_driver+0xb8/0x1a0
bus_for_each_drv+0x88/0xf0
__device_attach+0xa0/0x1d8
device_initial_probe+0x54/0x68
bus_probe_device+0x38/0xa0
deferred_probe_work_func+0xb8/0x120
process_one_work+0x184/0x4e8
worker_thread+0x188/0x308
kthread+0x130/0x150
ret_from_fork+0x10/0x20
Switch both helpers to gpiod_set_value_cansleep() so such a reset GPIO can
be used without triggering the warning.
The reset GPIO has been driven with the non-sleeping gpiod_set_value()
since the driver was added in v4.19. The call has since been refactored
across several files - from realtek-smi.c / realtek-mdio.c into the common
rtl83xx.c module and then into the rtl83xx_reset_assert() and
rtl83xx_reset_deassert() helpers (both in v6.9). This patch therefore
applies as-is only to kernels that carry those helpers (v6.9+); older
stable kernels need the same gpiod_set_value_cansleep() conversion at the
corresponding open-coded call sites.
Fixes:
|
||
|
Jakub Kicinski
|
f461b94f1a |
Merge branch 'net-af_unix-useful-handling-of-lsm-denials-on-scm_rights'
Jori Koolstra says: ==================== net: af_unix: useful handling of LSM denials on SCM_RIGHTS Right now if some LSM denies an AF_UNIX socket peer to receive a SCM_RIGHTS fd, the SCM_RIGHTS fd array will be cut short at that point, and MSG_CTRUNC is set on return of recvmsg(2). This is highly problematic behaviour, because it leaves the receiver wondering what happened. As per man page MSG_CTRUNC is supposed to indicate that the control buffer was sized too short, but suddenly a permission error might result in the exact same flag being set. Moreover, the receiver has no chance to determine how many fds got originally sent and how many were suppressed.[1] Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot. This option is inherited by the accept()-ed socket when set on the listen() socket. [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights ==================== Link: https://patch.msgid.link/20260813162818.149248-1-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Jori Koolstra
|
5d513ce19d |
selftest: Add tests for useful handling of LSM denials on SCM_RIGHTS
Tests SCM_RIGHTS fd passing on a socket with the new socket option SO_RIGHTS_NOTRUNC turned on. To hook into the security_file_receive() call, BPF is used. The BPF program shares a hashmap with userspace that lists the inos to be blocked (of the receiver tgid). Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260814172806.158954-1-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jori Koolstra
|
fd8756fa14 |
net: af_unix: useful handling of LSM denials on SCM_RIGHTS
Right now if some LSM such as Smack denies an AF_UNIX socket peer to receive an SCM_RIGHTS fd, the SCM_RIGHTS fd array will be cut short at that point, and MSG_CTRUNC is set on return of recvmsg(). This is highly problematic behaviour, because it leaves the receiver wondering what happened. As per man page MSG_CTRUNC is supposed to indicate that the control buffer was sized too short, but suddenly a permission error might result in the exact same flag being set. Moreover, the receiver has no chance to determine how many fds got originally sent and how many were suppressed.[1] Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful handling of LSM denials when receiving SCM_RIGHTS messages: instead of truncating the message at the first blocked fd, keep every fd slot and store the LSM errno in the blocked slot. The socket option is inherited by the child accept() socket if set on the listen() socket. [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260813162818.149248-4-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jori Koolstra
|
48b84acc5e |
net: scm: move scm_detach_fds() from common path to scm_recv_unix()
scm->fp can only be set when using UNIX sockets, therefore we should move it out of the common path __scm_recv_common() into scm_recv_unix(). Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Link: https://patch.msgid.link/20260813162818.149248-3-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jori Koolstra
|
de1c489b57 |
net: af_unix: enable custom setsockopt for all socket types
unix_setsockopt() and the SOCK_CUSTOM_SOCKOPT flag were only wired up for SOCK_STREAM (introduced along with the stream-only SO_INQ). Consequently custom AF_UNIX options are unreachable on SOCK_DGRAM and SOCK_SEQPACKET: those setsockopt() calls bypass unix_setsockopt() and fall through to the generic sock_setsockopt(), failing with -ENOPROTOOPT. Set SOCK_CUSTOM_SOCKOPT for every AF_UNIX socket type in unix_create(), and also for accepted sockets in unix_accept() (reachable for stream and seqpacket). This is a prerequisite for making SO_RIGHTS_NOTRUNC settable on all AF_UNIX socket types. Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Link: https://patch.msgid.link/20260813162818.149248-2-jkoolstra@xs4all.nl Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Linus Torvalds
|
0de672c7e1 |
hfs/hfsplus updates for v7.3
- hfsplus: validate extent record length before writing it back
- hfsplus: validate B-tree record offset table
- hfs: rework MDB locking scheme
- fs: hfsplus: remove redundant NULL check before kfree()
- hfs: port HFS+ b-tree bitmap corruption check
- hfs: don't re-dirty MDB buffers after a write failure
- hfsplus: fix error code when writing beyond volume capacity
- hfs: fix error code when writing beyond volume capacity
- hfsplus: validate thread record before delete key rebuild
- hfs: validate catalog CNIDs before instantiating inodes
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCan+JtwAKCRAhI4xTh21N
ndwRAQCo1yRn8Dt1H1ecRH1aXFEceQ1IiDRyklA/0sdXE1iRcAD9Gh5mUvXKvkww
TYTKWgFlqBZTODeAhD5kV/Vqai0AAAQ=
=9ixe
-----END PGP SIGNATURE-----
Merge tag 'hfs-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
Pull HFS updates from Viacheslav Dubeyko:
"This contains several fixes in HFS/HFS+ of syzbot reported issues and
HFS/HFS+ fixes of xfstests failures.
- b-tree bitmap corruption check (Aditya Prakash Srivastava)
During b-tree open (hfs_btree_open()), the code verifies that the
allocation map bit for the tree header (node 0) is set. If not, it
indicates a corrupted map record/bitmap and mounts the volume as
read-only (SB_RDONLY) to prevent further damage.
- Validate catalog CNIDs before instantiating inodes (David
Maximiliano Hermitte)
The hfs_cat_find_brec() first resolves a catalog thread record by
CNID and then looks up the corresponding catalog record by
parent/name. On a corrupted filesystem image, the second lookup may
find a record whose CNID does not match the CNID that was
requested. Finally, corrupted catalog records are rejected.
- Validate B-tree record offset table (Jiaming Zhang)
A crafted HFS+ image can contain a corrupted B-tree node. The node
descriptor may contain a record count that does not fit in the
node, and record offsets may be unordered, unaligned, outside the
node, or point into the offset table itself. Validate num_recs
against the node size before walking the record offset table.
Reject record ranges that are unordered, unaligned, outside the
node, or overlapping the offset table. Reject invalid record
indexes before reading their offset entries, and avoid decrementing
an already-zero leaf_count.
- Refactoring of hfsplus_delete_cat() logic (Kyle Zeng).
The hfsplus_delete_cat() is called with str == NULL when the last
open reference to an unlinked HFS+ hardlink backing inode is
closed. In that case, the function finds the catalog thread by CNID
and rebuilds the catalog key from thread.nodeName. A corrupted
image can therefore provide an oversized thread name length and
make hfs_bnode_read() write past the catalog search-key allocation.
Read the CNID record through hfsplus_brec_read_cat(), which bounds
the record read to sizeof(hfsplus_cat_entry) and verifies that a
thread record's size exactly matches nodeName.length.
- Cleanup in KUnit test (Mohammad Shahid)
The kfree() safely handles NULL pointers, so the explicit NULL
check in free_mock_str_env() before calling kfree() is unnecessary.
The rest contain fixes of generic/564 xfstests' test-case failure
for the case of HFS+ file system, syzbot reported issue in
hfs_mdb_commit() and hfs_mdb_close() methods of HFS file system,
and reworking the MDB locking scheme in HFS file system"
* tag 'hfs-v7.3-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
hfsplus: validate extent record length before writing it back
hfsplus: validate B-tree record offset table
hfs: rework MDB locking scheme
fs: hfsplus: remove redundant NULL check before kfree()
hfs: port HFS+ b-tree bitmap corruption check
hfs: don't re-dirty MDB buffers after a write failure
hfsplus: fix error code when writing beyond volume capacity
hfs: fix error code when writing beyond volume capacity
hfsplus: validate thread record before delete key rebuild
hfs: validate catalog CNIDs before instantiating inodes
|
||
Maximilian Immanuel Brandtner
|
9466ef3ec9 |
tls: fix RX desync on overlapping skbs
The TCP receive queue can hold adjacent skbs whose sequence ranges
overlap. The tls fast-path reads the record header with skb_copy_bits()
by byte offset, which assumes skbs do not overlap, so a header split
across the overlap is misread and the connection aborts
(-EMSGSIZE/-EINVAL). tls_strp_check_queue_ok() detects such overlaps but
only ran after the header was parsed, never covering the header itself.
Observed with parallel kTLS connections on:
- ConnectX-7 + IPsec crypto offload + GRO
- VirtIO (8 queues) + GRO
Fixes:
|
||
|
Jakub Kicinski
|
768af21721 |
Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue
Tony Nguyen says: ==================== Introduce iXD driver Larysa Zaremba says: This patch series adds the iXD driver, which supports the Intel(R) Control Plane PCI Function on Intel E2100 and later IPUs and FNICs. It facilitates a centralized control over multiple IDPF PFs/VFs/SFs exposed by the same card. The reason for the separation is to be able to offload the control plane to the host different from where the data plane is running. This is the first phase in the release of this driver where we implement the initialization of the core PCI driver. Subsequent phases will implement advanced features like usage of idpf ethernet aux device, link management, NVM update via devlink, switchdev port representors, data and exception path, flow rule programming, etc. The first phase entails the following aspects: 1. Additional libie functionalities: Patches 1-5 introduce additional common library API for drivers to communicate with the control plane through mailbox communication. A control queue is a hardware interface which is used by the driver to interact with other subsystems (like firmware). The library APIs allow the driver to setup and configure the control queues to send and receive virtchnl messages. The library has an internal bookkeeping (XN API) mechanism to keep track of the send messages. It supports both synchronous as well as asynchronous way of handling the messages. The library also handles the timeout internally for synchronous messages using events. This reduces the driver's overhead in handling the timeout error cases. The current patch series supports only APIs that are needed for device initialization. These include APIs in the libie_pci module: * Allocating/freeing the DMA memory and mapping the MMIO regions for BAR0, read/write APIs for drivers to access the MMIO memory and libie_cp module: * Control queue initialization and configuration * Transport initialization for bookkeeping * Blocking and asynchronous mailbox transactions Once the mailbox is initialized, the drivers can send and receive virtchnl messages to/from the control plane. The modules above are not supposed to be linked with the main libie library, but do share the folder with it. 2. idpf: Patches 6-11 refactor the idpf driver to use the libie APIs for control queue configuration, virtchnl transaction, device initialization and reset and adjust related code accordingly. 3. ixd: Patches 12-15 add the ixd driver and implement multiple pieces of the initialization flow as follows: * Add the ability to load * A reset is issued to ensure a clean device state, followed by initialization of the mailbox * Device capabilities: As part of initialization, the driver has to determine what the device is capable of (ex. max queues, vports, etc). This information is obtained from the firmware and stored by the driver. * Enable initial support for the devlink interface * '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/next-queue: ixd: add devlink support ixd: add the core initialization ixd: add reset checks and initialize the mailbox ixd: add basic driver framework for Intel(R) Control Plane Function idpf: print a debug message and bail in case of non-event ctlq message idpf: make mbx_task queueing and cancelling more consistent idpf: refactor idpf to use libie control queues idpf: refactor idpf to use libie_pci APIs idpf: remove unused code for getting RSS info from device idpf: remove 'vport_params_reqd' field libie: add bookkeeping support for control queue messages libie: add control queue support libeth: allow to create fill queues without NAPI libie: add PCI device initialization helpers to libie virtchnl: move virtchnl and virtchnl2 headers to 'include/linux/net/intel' ==================== Link: https://patch.msgid.link/20260812212532.905873-1-anthony.l.nguyen@intel.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Jakub Kicinski
|
2d380a4fed |
Merge branch 'enic-sr-iov-v2-admin-channel-and-mbox-protocol'
Satish Kharat says: ==================== enic: SR-IOV V2 admin channel and MBOX protocol This series adds the admin channel infrastructure and mailbox (MBOX) protocol needed for V2 SR-IOV support in the enic driver. The V2 SR-IOV design uses a direct PF-VF communication channel built on dedicated WQ/RQ/CQ hardware resources and an MSI-X interrupt. This series touches enic_remove(), which is also modified by a fix already applied to net: enic: fix tx_hang_reset use-after-free on device removal https://git.kernel.org/netdev/net/c/ec680ea4ba1b That fix was previously carried at the head of this series (patch 1 in v10-v12); it has been split out and applied to net separately. This net-next series no longer includes it and applies cleanly on current net-next, which already contains that fix (via the net -> net-next merge); the overlapping enic_remove() teardown-ordering change is incorporated in this series. Firmware capability and admin channel infrastructure (patches 1-4): - Probe-time firmware feature check for V2 SR-IOV support - Admin channel open/close, RQ buffer management, CQ service with MSI-X interrupt and workqueue-based polling MBOX protocol and VF enable (patches 5-10): - MBOX message types, core send/receive, PF and VF handlers - V2 SR-IOV enable wiring with admin channel setup - V2 VF probe with admin channel and PF registration Patch 11 completes reset recovery for V2 VFs: the reset paths added earlier in the series re-establish the admin channel only for the PF, which left a VF unregistered and unable to exchange MBOX traffic after a reset taken on the VF. Known follow-ups (not blocking this series; the V2 PF data path is not yet activated and V2 VFs are brought up only in a later series that wires .sriov_configure): - Full request/reply correlation by msg_num requires the MBOX peer to echo the request number; this series retains the existing single-outstanding-request model with reply-type gating. - PF-side registration synchronization, initial link-state retry, and admin control-message throttling will be completed alongside the .sriov_configure enablement. ==================== Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-0-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
Satish Kharat
|
885f462fe9 |
enic: re-establish V2 VF admin channel and PF registration after reset
The reset paths (enic_reset/enic_tx_hang_reset) tore down and re-opened the V2 admin/MBOX channel only for the PF: the close/reopen was gated on enic_sriov_enabled() && vf_type == ENIC_VF_TYPE_V2, which is never true on a VF (vf_type is set only on the PF; VFs are identified by enic_is_sriov_vf_v2()). A VF-initiated reset therefore left the VF admin QP wiped by the reset but never re-opened, and the VF never re-registered with the PF, so VF<->PF MBOX traffic (currently link state) stopped working until the VF was re-probed. Factor the decision into enic_has_admin_chan() (true for a V2 PF while SR-IOV is enabled and for every V2 VF) and the reopen sequence into enic_admin_chan_reopen(). For a VF the helper additionally re-runs the probe-time handshake (enic_mbox_vf_capability_check() + enic_mbox_vf_register()) so the PF learns about the VF again; for a PF it re-pushes the current link state as before. Before reopening, invalidate the VF's local registration flag. The reset only wipes the VF's admin QP, not the PF's software vf_state (that changes only via the register/unregister MBOX handlers), so the PF may still hold a stale "registered" until the VF re-registers. Locally, a failed reopen or re-handshake must not leave a stale registered state that a later teardown would try to unregister over a dead channel. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-11-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
b2dfdc966b |
enic: add V2 VF probe with admin channel and PF registration
When a V2 SR-IOV VF probes, initialize the MBOX protocol, open the admin channel, perform the capability check with the PF, and register with the PF. This establishes the PF-VF communication path that the PF uses to send link state notifications. The admin channel and MBOX registration happen after enic_dev_init() (which discovers admin channel resources) and before register_netdev() so the VF is fully initialized before the interface is visible to userspace. A V2 VF whose firmware did not provision admin WQ/RQ/CQ resources fails probe with -ENODEV from enic_admin_channel_open(); the admin channel is a hard requirement for V2 VFs. enic_mbox_init() installs the receive handler and resets the message sequence number before enic_admin_channel_open() unmasks the admin interrupt, so a completion can never arrive before the handler is in place. On remove, the VF unregisters from the PF and closes its admin channel before tearing down data path resources. V2 VFs are not provisioned with an RES_TYPE_SRIOV_INTR resource by firmware, so bypass that check in the admin channel capability detection for V2 VFs. The PF still requires this resource. The admin MSI-X vector reserved by enic_set_intr_mode() is used for the admin channel interrupt. enic_adjust_resources() ensures the reserved slot is within intr_avail bounds even at maximum queue configurations. The admin INTR uses a RES_TYPE_INTR_CTRL slot shared with the data path. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-10-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
4ff204cef0 |
enic: wire V2 SR-IOV enable with admin channel and MBOX
Extend enic_sriov_configure() to handle V2 SR-IOV VFs. When the PF detects V2 VF device IDs, the enable path allocates per-VF MBOX state, initializes the MBOX protocol, opens the admin channel, and then calls pci_enable_sriov(). The admin channel must be ready before VFs are created so that VF drivers can immediately begin the MBOX capability and registration handshake during their probe. The enic_sriov_configure() dispatcher and its V2 helpers (enic_sriov_v2_enable, enic_sriov_v2_disable) are defined here but intentionally not yet wired into struct pci_driver via .sriov_configure -- hence the __maybe_unused annotations. This series introduces only the admin channel and MBOX infrastructure; sysfs-driven V2 enable/disable will be activated in a follow-up patch by adding ".sriov_configure = enic_sriov_configure," to enic_driver. Because .sriov_configure is not registered yet, enic_sriov_configure() cannot run concurrently with the rtnl-protected reset paths (enic_reset(), enic_tx_hang_reset()) in this series, so there is no reachable locking race between SR-IOV enable/disable and reset. The follow-up patch that wires the callback will add the necessary serialization against those paths. Note that simply taking rtnl_lock() around the enable path is not viable, because pci_enable_sriov() triggers VF probe and register_netdev(), which themselves acquire rtnl; the wiring patch therefore uses finer-grained serialization. The disable path first clears ENIC_SRIOV_ENABLED and flushes the link-notify work, so no further VF link-state broadcast can run, then calls pci_disable_sriov() (VF drivers unregister via MBOX), closes the admin channel, and frees per-VF state. Clearing the flag and flushing the work before vf_state is freed closes a use-after-free window against the link-notify path. Notify registered VFs of PF link transitions: enic_link_check() schedules link_notify_work on each carrier up/down edge, and the work handler sends PF_LINK_STATE_NOTIF to the VFs from process context. The broadcast cannot run directly in enic_link_check() because the MBOX send path may sleep and link check runs in the notify timer/ISR context. On a V2 VF the admin-channel (PF) link-state notification is the sole authority for carrier state, so enic_link_check() returns early for such VFs. As a side effect the VF retains the firmware-provided static Rx interrupt coalescing (config.intr_timer_usec) rather than PF-driven speed-adaptive coalescing; this is intentional, as adaptive Rx coalescing is a PF-only responsibility for V2 VFs. Re-establish the admin/MBOX channel across a PF reset. enic_reset() and enic_tx_hang_reset() fully close the admin channel before the soft/hang reset (which wipes all hardware queues, including the admin WQ/RQ), then reopen it and re-run enic_mbox_init() after the data path is back up, and re-push the current link state to registered VFs. Reject VF port profile requests when V2 SR-IOV is active (enic_is_valid_pp_vf), since enic->pp is not reallocated for V2 VFs and the V2 protocol uses MBOX instead of port profiles. Update enic_remove() to run enic_dev_deinit() and vnic_dev_close() after SR-IOV teardown, so the PF device remains functional while VFs are being cleaned up. This ordering applies to both V1 and V2 SR-IOV paths. Restrict the probe-time SR-IOV auto-enable to the legacy VF types (V1 and usNIC). A V2-capable adapter whose firmware lacks V2 support is downgraded to ENIC_VF_TYPE_NONE, and V2 VFs require the admin channel which is only brought up via sysfs enic_sriov_configure(); neither must be auto-enabled through the legacy pci_enable_sriov() path at probe. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-9-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
72b65c9405 |
enic: add MBOX VF handlers for capability, register and link state
Implement VF-side mailbox message processing for SR-IOV V2
admin channel communication.
VF receive handlers:
- VF_CAPABILITY_REPLY: store PF protocol version, signal
completion
- VF_REGISTER_REPLY: mark VF as registered, signal completion
- VF_UNREGISTER_REPLY: mark VF as unregistered, signal
completion
- PF_LINK_STATE_NOTIF: update carrier state via
netif_carrier_on/off, send ACK back to PF
VF initiation functions for the probe-time handshake:
- enic_mbox_vf_capability_check: send capability request,
wait for PF reply via completion
- enic_mbox_vf_register: send register request, wait for
PF confirmation via completion
- enic_mbox_vf_unregister: send unregister request, wait
for PF confirmation
The wait helper (enic_mbox_wait_reply) uses
wait_for_completion_timeout, signaled when the admin ISR and
CQ-poll/dispatch workqueue pipeline delivers the reply message.
mbox_expected_reply is written by the request thread and read by the
admin CQ poll/dispatch context that runs the receive handlers; annotate
those accesses with READ_ONCE()/WRITE_ONCE() under the
single-outstanding-reply invariant.
Signed-off-by: Satish Kharat <satishkh@cisco.com>
Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-8-b3809e448aba@cisco.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|
Satish Kharat
|
06bdfb1621 |
enic: add MBOX PF handlers for VF register and capability
Implement PF-side mailbox message processing for SR-IOV V2
admin channel communication.
When the PF receives messages from VFs, the dispatch routes
them to type-specific handlers:
- VF_CAPABILITY_REQUEST: reply with protocol version 1
- VF_REGISTER_REQUEST: send the register reply, mark the
VF registered on success, then send PF_LINK_STATE_NOTIF
reflecting the PF's current carrier state
- VF_UNREGISTER_REQUEST: mark VF unregistered, send reply
- PF_LINK_STATE_ACK: log errors from VF acknowledgment
Per-VF state (struct enic_vf_state) is tracked via enic->vf_state
which will be allocated when SRIOV V2 is enabled.
Remove the CONFIG_PCI_IOV guard from num_vfs in struct enic. The
PF handlers reference enic->num_vfs for VF ID bounds checking in
enic_mbox.c, which is compiled unconditionally. The field must be
visible regardless of CONFIG_PCI_IOV to avoid build failures.
Add enic_mbox_send_link_state() helper for PF-initiated link
state notifications.
Signed-off-by: Satish Kharat <satishkh@cisco.com>
Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-7-b3809e448aba@cisco.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
||
|
Satish Kharat
|
1f0c856b59 |
enic: add MBOX core send and receive for admin channel
Implement the mailbox protocol engine used for PF-VF communication over the admin channel. The send path (enic_mbox_send_msg) builds a message with a common header, DMA-maps it, posts a single WQ descriptor with the destination vnic ID encoded in the VLAN tag field, and polls the WQ CQ for completion. The total message length is computed as a size_t, and the payload is bounded before the send lock is taken: a payload larger than the admin buffer minus the header is rejected with -EINVAL. This keeps the length sum from wrapping and stops the on-the-wire u16 length from overflowing or the DMA buffer from being overrun. MBOX sends are gated by enic->mbox_send_disabled: enic_mbox_send_msg() returns early while it is set. It is set at the very start of both enic_admin_channel_open() and enic_admin_channel_close(), and is cleared in enic_admin_channel_open() only once the admin WQ/RQ/CQ and interrupt are fully allocated, programmed and enabled. Keeping it set for the whole open sequence means an early failure that returns before the channel is ready (as well as a not-yet-ready or torn-down channel) leaves sends disabled, so a concurrent sender can never race an MBOX send against a half-open or freed admin_wq. The receive path (enic_mbox_recv_handler) is installed as the admin RQ callback and validates incoming message headers. PF/VF-specific dispatch will be added in subsequent commits. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-6-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
1584793311 |
enic: define MBOX message types and header structures
Define the mailbox protocol structures for PF-VF communication: message header, generic reply, and per-message-type payloads for capability negotiation, VF registration/unregistration, and link state notification/acknowledgment. Include linux/types.h and linux/bits.h for __le16/__le32/__le64 and BIT() used in the header. Message types use an even=request / odd=reply convention. The header carries source and destination VNIC IDs, a per-channel message sequence number, and the total message length. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-5-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
cb1dba54c7 |
enic: add admin CQ service with MSI-X interrupt and workqueue polling
Add completion queue (CQ) service for the admin channel work queue (WQ) and receive queue (RQ), driven by a dedicated MSI-X interrupt and a workqueue-based CQ poller. The admin WQ CQ service advances the completion ring and returns the number of descriptors consumed. The admin RQ CQ service does the same for receive completions and copies each received message out of its pre-posted DMA buffer into a dynamically allocated queue entry. The pending queue is bounded to ENIC_ADMIN_MSG_MAX (256) entries so a buggy or hostile VF cannot drive the host out of memory; messages are enqueued for deferred dispatch by a separate work_struct so the CQ poller stays short. When the MSI-X interrupt fires, the ISR schedules the CQ poll work. The work handler drains all pending completions, kicks message dispatch if work was done, and returns credits to unmask the interrupt. The admin vector is kept masked from the time the IRQ is requested until the rings are initialised and filled during channel open, so an early or spurious interrupt cannot run the poll handler against uninitialised rings. The poll handler snapshots the pending credit count before draining the CQ so it acknowledges exactly what the hardware reported for this interrupt; any credits that accrue during draining are serviced by the next interrupt. The credit write also sets the mask bit to re-arm the vector, and that unmask is applied independently of the credit count, so the vector is re-armed even when zero credits are returned -- which matters here because the admin channel is not re-polled like the NAPI data path. If an admin RQ buffer refill fails under transient memory pressure, reschedule the CQ poll work itself after a short delay to retry the refill and re-arm the RQ, so the admin channel cannot stall when the ring would otherwise be left empty with no completion to drive the next refill. The poll work is a delayed_work for this reason; routing the retry through it keeps the admin RQ ring owned by a single context so refills never run concurrently. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-4-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
a0da4ea750 |
enic: add admin RQ buffer management
The admin receive queue needs pre-posted DMA buffers for incoming mailbox messages from VFs. Each buffer is a kzalloc'd region mapped for DMA (2048 bytes, sufficient for any MBOX message). Zeroing on allocation ensures that if a completion reports more bytes than hardware actually DMA-wrote, the parser reads zero padding rather than uninitialised heap contents. Add enic_admin_rq_fill(gfp) to post buffers at open time, and enic_admin_rq_drain() to unmap and free them at close time. Wire both into the admin channel open/close paths. The gfp_t parameter lets the caller pass the allocation context; both current callers -- channel open and the CQ-poll work handler that refills after draining (added in the next patch) -- run in process context and use GFP_KERNEL. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-3-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
||
|
Satish Kharat
|
3258931d40 |
enic: add admin channel open and close for SR-IOV
The V2 SR-IOV design uses a dedicated admin channel (WQ/RQ/CQ resources plus an MSI-X interrupt) for PF-VF mailbox communication rather than firmware-proxied devcmds. Introduce enic_admin_channel_open() and enic_admin_channel_close(). Open allocates and initialises the admin WQ, RQ, and two CQs (one per direction), then issues CMD_QP_TYPE_SET to tell firmware the queues are admin-type. Close reverses the sequence. enic_admin_wq_buf_clean() unmaps and frees any WQ buffers still held at close time, fixing a DMA mapping leak when a send times out. Add CMD_QP_TYPE_SET (97), QP_TYPE_ADMIN/DATA, and QP_ENABLE/QP_DISABLE defines to vnic_devcmd.h. Add VNIC_CQ_* named constants to vnic_cq.h so CQ initialisation parameters are self-documenting from their first introduction. Signed-off-by: Satish Kharat <satishkh@cisco.com> Link: https://patch.msgid.link/20260812-enic-sriov-v2-admin-channel-v2-v13-2-b3809e448aba@cisco.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> |