--- /dev/null
+From dff6f36878799a5ffabd15336ce993dc737374dc Mon Sep 17 00:00:00 2001
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Date: Sun, 27 Jul 2025 14:05:13 -0700
+Subject: platform/x86/intel-uncore-freq: Check write blocked for ELC
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+
+commit dff6f36878799a5ffabd15336ce993dc737374dc upstream.
+
+Add the missing write_blocked check for updating sysfs related to uncore
+efficiency latency control (ELC). If write operation is blocked return
+error.
+
+Fixes: bb516dc79c4a ("platform/x86/intel-uncore-freq: Add support for efficiency latency control")
+Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
+Cc: stable@vger.kernel.org
+Link: https://lore.kernel.org/r/20250727210513.2898630-1-srinivas.pandruvada@linux.intel.com
+Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
++++ b/drivers/platform/x86/intel/uncore-frequency/uncore-frequency-tpmi.c
+@@ -189,9 +189,14 @@ static int uncore_read_control_freq(stru
+ static int write_eff_lat_ctrl(struct uncore_data *data, unsigned int val, enum uncore_index index)
+ {
+ struct tpmi_uncore_cluster_info *cluster_info;
++ struct tpmi_uncore_struct *uncore_root;
+ u64 control;
+
+ cluster_info = container_of(data, struct tpmi_uncore_cluster_info, uncore_data);
++ uncore_root = cluster_info->uncore_root;
++
++ if (uncore_root->write_blocked)
++ return -EPERM;
+
+ if (cluster_info->root_domain)
+ return -ENODATA;
--- /dev/null
+From 3c3e9a9f2972b364e8c2cfbfdeb23c6d6be4f87f Mon Sep 17 00:00:00 2001
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+Date: Fri, 25 Jul 2025 18:31:04 -0700
+Subject: RDMA/rxe: Flush delayed SKBs while releasing RXE resources
+
+From: Zhu Yanjun <yanjun.zhu@linux.dev>
+
+commit 3c3e9a9f2972b364e8c2cfbfdeb23c6d6be4f87f upstream.
+
+When skb packets are sent out, these skb packets still depends on
+the rxe resources, for example, QP, sk, when these packets are
+destroyed.
+
+If these rxe resources are released when the skb packets are destroyed,
+the call traces will appear.
+
+To avoid skb packets hang too long time in some network devices,
+a timestamp is added when these skb packets are created. If these
+skb packets hang too long time in network devices, these network
+devices can free these skb packets to release rxe resources.
+
+Reported-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
+Closes: https://syzkaller.appspot.com/bug?extid=8425ccfb599521edb153
+Tested-by: syzbot+8425ccfb599521edb153@syzkaller.appspotmail.com
+Fixes: 1a633bdc8fd9 ("RDMA/rxe: Let destroy qp succeed with stuck packet")
+Signed-off-by: Zhu Yanjun <yanjun.zhu@linux.dev>
+Link: https://patch.msgid.link/20250726013104.463570-1-yanjun.zhu@linux.dev
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/infiniband/sw/rxe/rxe_net.c | 29 ++++++++---------------------
+ drivers/infiniband/sw/rxe/rxe_qp.c | 2 +-
+ 2 files changed, 9 insertions(+), 22 deletions(-)
+
+diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
+index 132a87e52d5c..ac0183a2ff7a 100644
+--- a/drivers/infiniband/sw/rxe/rxe_net.c
++++ b/drivers/infiniband/sw/rxe/rxe_net.c
+@@ -345,33 +345,15 @@ int rxe_prepare(struct rxe_av *av, struct rxe_pkt_info *pkt,
+
+ static void rxe_skb_tx_dtor(struct sk_buff *skb)
+ {
+- struct net_device *ndev = skb->dev;
+- struct rxe_dev *rxe;
+- unsigned int qp_index;
+- struct rxe_qp *qp;
++ struct rxe_qp *qp = skb->sk->sk_user_data;
+ int skb_out;
+
+- rxe = rxe_get_dev_from_net(ndev);
+- if (!rxe && is_vlan_dev(ndev))
+- rxe = rxe_get_dev_from_net(vlan_dev_real_dev(ndev));
+- if (WARN_ON(!rxe))
+- return;
+-
+- qp_index = (int)(uintptr_t)skb->sk->sk_user_data;
+- if (!qp_index)
+- return;
+-
+- qp = rxe_pool_get_index(&rxe->qp_pool, qp_index);
+- if (!qp)
+- goto put_dev;
+-
+ skb_out = atomic_dec_return(&qp->skb_out);
+- if (qp->need_req_skb && skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW)
++ if (unlikely(qp->need_req_skb &&
++ skb_out < RXE_INFLIGHT_SKBS_PER_QP_LOW))
+ rxe_sched_task(&qp->send_task);
+
+ rxe_put(qp);
+-put_dev:
+- ib_device_put(&rxe->ib_dev);
+ sock_put(skb->sk);
+ }
+
+@@ -383,6 +365,7 @@ static int rxe_send(struct sk_buff *skb, struct rxe_pkt_info *pkt)
+ sock_hold(sk);
+ skb->sk = sk;
+ skb->destructor = rxe_skb_tx_dtor;
++ rxe_get(pkt->qp);
+ atomic_inc(&pkt->qp->skb_out);
+
+ if (skb->protocol == htons(ETH_P_IP))
+@@ -405,6 +388,7 @@ static int rxe_loopback(struct sk_buff *skb, struct rxe_pkt_info *pkt)
+ sock_hold(sk);
+ skb->sk = sk;
+ skb->destructor = rxe_skb_tx_dtor;
++ rxe_get(pkt->qp);
+ atomic_inc(&pkt->qp->skb_out);
+
+ if (skb->protocol == htons(ETH_P_IP))
+@@ -497,6 +481,9 @@ struct sk_buff *rxe_init_packet(struct rxe_dev *rxe, struct rxe_av *av,
+ goto out;
+ }
+
++ /* Add time stamp to skb. */
++ skb->tstamp = ktime_get();
++
+ skb_reserve(skb, hdr_len + LL_RESERVED_SPACE(ndev));
+
+ /* FIXME: hold reference to this netdev until life of this skb. */
+diff --git a/drivers/infiniband/sw/rxe/rxe_qp.c b/drivers/infiniband/sw/rxe/rxe_qp.c
+index f2af3e0aef35..95f1c1c2949d 100644
+--- a/drivers/infiniband/sw/rxe/rxe_qp.c
++++ b/drivers/infiniband/sw/rxe/rxe_qp.c
+@@ -244,7 +244,7 @@ static int rxe_qp_init_req(struct rxe_dev *rxe, struct rxe_qp *qp,
+ err = sock_create_kern(&init_net, AF_INET, SOCK_DGRAM, 0, &qp->sk);
+ if (err < 0)
+ return err;
+- qp->sk->sk->sk_user_data = (void *)(uintptr_t)qp->elem.index;
++ qp->sk->sk->sk_user_data = qp;
+
+ /* pick a source UDP port number for this QP based on
+ * the source QPN. this spreads traffic for different QPs
+--
+2.50.1
+
--- /dev/null
+From 430fa71027b6ac9bb0ce5532b8d0676777d4219a Mon Sep 17 00:00:00 2001
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+Date: Mon, 18 Aug 2025 12:21:52 +0200
+Subject: s390/sclp: Fix SCCB present check
+
+From: Peter Oberparleiter <oberpar@linux.ibm.com>
+
+commit 430fa71027b6ac9bb0ce5532b8d0676777d4219a upstream.
+
+Tracing code called by the SCLP interrupt handler contains early exits
+if the SCCB address associated with an interrupt is NULL. This check is
+performed after physical to virtual address translation.
+
+If the kernel identity mapping does not start at address zero, the
+resulting virtual address is never zero, so that the NULL checks won't
+work. Subsequently this may result in incorrect accesses to the first
+page of the identity mapping.
+
+Fix this by introducing a function that handles the NULL case before
+address translation.
+
+Fixes: ada1da31ce34 ("s390/sclp: sort out physical vs virtual pointers usage")
+Cc: stable@vger.kernel.org
+Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
+Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/s390/char/sclp.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/drivers/s390/char/sclp.c
++++ b/drivers/s390/char/sclp.c
+@@ -76,6 +76,13 @@ unsigned long sclp_console_full;
+ /* The currently active SCLP command word. */
+ static sclp_cmdw_t active_cmd;
+
++static inline struct sccb_header *sclpint_to_sccb(u32 sccb_int)
++{
++ if (sccb_int)
++ return __va(sccb_int);
++ return NULL;
++}
++
+ static inline void sclp_trace(int prio, char *id, u32 a, u64 b, bool err)
+ {
+ struct sclp_trace_entry e;
+@@ -619,7 +626,7 @@ __sclp_find_req(u32 sccb)
+
+ static bool ok_response(u32 sccb_int, sclp_cmdw_t cmd)
+ {
+- struct sccb_header *sccb = (struct sccb_header *)__va(sccb_int);
++ struct sccb_header *sccb = sclpint_to_sccb(sccb_int);
+ struct evbuf_header *evbuf;
+ u16 response;
+
+@@ -658,7 +665,7 @@ static void sclp_interrupt_handler(struc
+
+ /* INT: Interrupt received (a=intparm, b=cmd) */
+ sclp_trace_sccb(0, "INT", param32, active_cmd, active_cmd,
+- (struct sccb_header *)__va(finished_sccb),
++ sclpint_to_sccb(finished_sccb),
+ !ok_response(finished_sccb, active_cmd));
+
+ if (finished_sccb) {
mm-debug_vm_pgtable-clear-page-table-entries-at-destroy_args.patch
mm-memory-failure-fix-infinite-uce-for-vm_pfnmap-pfn.patch
alsa-hda-realtek-add-support-for-hp-elitebook-x360-830-g6-and-elitebook-830-g6.patch
+rdma-rxe-flush-delayed-skbs-while-releasing-rxe-resources.patch
+s390-sclp-fix-sccb-present-check.patch
+platform-x86-intel-uncore-freq-check-write-blocked-for-elc.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
