ctrliq · PlaidCat · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026 · Mar 3, 2026
diff --git a/COPYING-5.14.0-611.35.1.el9_7 → COPYING-5.14.0-611.36.1.el9_7 b/COPYING-5.14.0-611.35.1.el9_7 → COPYING-5.14.0-611.36.1.el9_7
diff --git a/Documentation/netlink/specs/dpll.yaml b/Documentation/netlink/specs/dpll.yaml
@@ -446,6 +446,16 @@ attribute-sets:
         doc: |
           Granularity of phase adjustment, in picoseconds. The value of
           phase adjustment must be a multiple of this granularity.
+      -
+        name: fractional-frequency-offset-ppt
+        type: sint
+        doc: |
+          The FFO (Fractional Frequency Offset) of the pin with respect to
+          the nominal frequency.
+          Value = (frequency_measured - frequency_nominal) / frequency_nominal
+          Value is in PPT (parts per trillion, 10^-12).
+          Note: This attribute provides higher resolution than the standard
+          fractional-frequency-offset (which is in PPM).
 
   -
     name: pin-parent-device
@@ -550,6 +560,7 @@ operations:
         request:
           attributes:
             - id
+            - mode
             - phase-offset-monitor
             - phase-offset-avg-factor
     -
@@ -627,6 +638,7 @@ operations:
             - phase-adjust-max
             - phase-adjust
             - fractional-frequency-offset
+            - fractional-frequency-offset-ppt
             - esync-frequency
             - esync-frequency-supported
             - esync-pulse

diff --git a/Documentation/netlink/specs/fou.yaml b/Documentation/netlink/specs/fou.yaml
@@ -15,7 +15,7 @@ kernel-policy: global
 definitions:
   -
     type: enum
-    name: encap_type
+    name: encap-type
     name-prefix: fou-encap-
     enum-name:
     entries: [ unspec, direct, gue ]
@@ -39,30 +39,32 @@ attribute-sets:
       -
         name: ipproto
         type: u8
+        checks:
+          min: 1
       -
         name: type
         type: u8
       -
-        name: remcsum_nopartial
+        name: remcsum-nopartial
         type: flag
       -
-        name: local_v4
+        name: local-v4
         type: u32
       -
-        name: local_v6
+        name: local-v6
         type: binary
         checks:
           min-len: 16
       -
-        name: peer_v4
+        name: peer-v4
         type: u32
       -
-        name: peer_v6
+        name: peer-v6
         type: binary
         checks:
           min-len: 16
       -
-        name: peer_port
+        name: peer-port
         type: u16
         byte-order: big-endian
       -
@@ -90,12 +92,12 @@ operations:
             - port
             - ipproto
             - type
-            - remcsum_nopartial
-            - local_v4
-            - peer_v4
-            - local_v6
-            - peer_v6
-            - peer_port
+            - remcsum-nopartial
+            - local-v4
+            - peer-v4
+            - local-v6
+            - peer-v6
+            - peer-port
             - ifindex
 
     -
@@ -112,11 +114,11 @@ operations:
             - af
             - ifindex
             - port
-            - peer_port
-            - local_v4
-            - peer_v4
-            - local_v6
-            - peer_v6
+            - peer-port
+            - local-v4
+            - peer-v4
+            - local-v6
+            - peer-v6
 
     -
       name: get

diff --git a/Makefile.rhelver b/Makefile.rhelver
@@ -12,7 +12,7 @@ RHEL_MINOR = 7
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 611.35.1
+RHEL_RELEASE = 611.36.1
 
 #
 # ZSTREAM

diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
@@ -1103,17 +1103,15 @@ static inline pte_t pte_mkhuge(pte_t pte)
 #define IPTE_NODAT	0x400
 #define IPTE_GUEST_ASCE	0x800
 
-static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep,
-				       unsigned long opt, unsigned long asce,
-				       int local)
+static __always_inline void __ptep_rdp(unsigned long addr, pte_t *ptep, int local)
 {
 	unsigned long pto;
 
 	pto = __pa(ptep) & ~(PTRS_PER_PTE * sizeof(pte_t) - 1);
-	asm volatile(".insn rrf,0xb98b0000,%[r1],%[r2],%[asce],%[m4]"
+	asm volatile(".insn	rrf,0xb98b0000,%[r1],%[r2],%%r0,%[m4]"
 		     : "+m" (*ptep)
-		     : [r1] "a" (pto), [r2] "a" ((addr & PAGE_MASK) | opt),
-		       [asce] "a" (asce), [m4] "i" (local));
+		     : [r1] "a" (pto), [r2] "a" (addr & PAGE_MASK),
+		       [m4] "i" (local));
 }
 
 static __always_inline void __ptep_ipte(unsigned long address, pte_t *ptep,
@@ -1297,7 +1295,7 @@ static inline void flush_tlb_fix_spurious_fault(struct vm_area_struct *vma,
 	 * A local RDP can be used to do the flush.
 	 */
 	if (MACHINE_HAS_RDP && !(pte_val(*ptep) & _PAGE_PROTECT))
-		__ptep_rdp(address, ptep, 0, 0, 1);
+		__ptep_rdp(address, ptep, 1);
 }
 #define flush_tlb_fix_spurious_fault flush_tlb_fix_spurious_fault
 

diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
@@ -303,9 +303,9 @@ void ptep_reset_dat_prot(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
 	preempt_disable();
 	atomic_inc(&mm->context.flush_count);
 	if (cpumask_equal(mm_cpumask(mm), cpumask_of(smp_processor_id())))
-		__ptep_rdp(addr, ptep, 0, 0, 1);
+		__ptep_rdp(addr, ptep, 1);
 	else
-		__ptep_rdp(addr, ptep, 0, 0, 0);
+		__ptep_rdp(addr, ptep, 0);
 	/*
 	 * PTE is not invalidated by RDP, only _PAGE_PROTECT is cleared. That
 	 * means it is still valid and active, and must not be changed according

diff --git a/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/31475b88.failed b/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/31475b88.failed
@@ -0,0 +1,68 @@
+s390/mm: Fix __ptep_rdp() inline assembly
+
+jira KERNEL-703
+Rebuild_History Non-Buildable kernel-5.14.0-611.36.1.el9_7
+commit-author Heiko Carstens <hca@linux.ibm.com>
+commit 31475b88110c4725b4f9a79c3a0d9bbf97e69e1c
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/31475b88.failed
+
+When a zero ASCE is passed to the __ptep_rdp() inline assembly, the
+generated instruction should have the R3 field of the instruction set to
+zero. However the inline assembly is written incorrectly: for such cases a
+zero is loaded into a register allocated by the compiler and this register
+is then used by the instruction.
+
+This means that selected TLB entries may not be flushed since the specified
+ASCE does not match the one which was used when the selected TLB entries
+were created.
+
+Fix this by removing the asce and opt parameters of __ptep_rdp(), since
+all callers always pass zero, and use a hard-coded register zero for
+the R3 field.
+
+Fixes: 0807b856521f ("s390/mm: add support for RDP (Reset DAT-Protection)")
+	Cc: stable@vger.kernel.org
+	Reviewed-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
+	Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
+(cherry picked from commit 31475b88110c4725b4f9a79c3a0d9bbf97e69e1c)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	arch/s390/include/asm/pgtable.h
+diff --cc arch/s390/include/asm/pgtable.h
+index 0a696d0fbf73,6663f1619abb..000000000000
+--- a/arch/s390/include/asm/pgtable.h
++++ b/arch/s390/include/asm/pgtable.h
+@@@ -1296,8 -1345,8 +1294,13 @@@ static inline void flush_tlb_fix_spurio
+  	 * PTE does not have _PAGE_PROTECT set, to avoid unnecessary overhead.
+  	 * A local RDP can be used to do the flush.
+  	 */
+++<<<<<<< HEAD
+ +	if (MACHINE_HAS_RDP && !(pte_val(*ptep) & _PAGE_PROTECT))
+ +		__ptep_rdp(address, ptep, 0, 0, 1);
+++=======
++ 	if (cpu_has_rdp() && !(pte_val(*ptep) & _PAGE_PROTECT))
++ 		__ptep_rdp(address, ptep, 1);
+++>>>>>>> 31475b88110c (s390/mm: Fix __ptep_rdp() inline assembly)
+  }
+  #define flush_tlb_fix_spurious_fault flush_tlb_fix_spurious_fault
+
+* Unmerged path arch/s390/include/asm/pgtable.h
+diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
+index c670195c0107..61c6ae698199 100644
+--- a/arch/s390/mm/pgtable.c
++++ b/arch/s390/mm/pgtable.c
+@@ -303,9 +303,9 @@ void ptep_reset_dat_prot(struct mm_struct *mm, unsigned long addr, pte_t *ptep,
+ 	preempt_disable();
+ 	atomic_inc(&mm->context.flush_count);
+ 	if (cpumask_equal(mm_cpumask(mm), cpumask_of(smp_processor_id())))
+-		__ptep_rdp(addr, ptep, 0, 0, 1);
++		__ptep_rdp(addr, ptep, 1);
+ 	else
+-		__ptep_rdp(addr, ptep, 0, 0, 0);
++		__ptep_rdp(addr, ptep, 0);
+ 	/*
+ 	 * PTE is not invalidated by RDP, only _PAGE_PROTECT is cleared. That
+ 	 * means it is still valid and active, and must not be changed according
diff --git a/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/41387874.failed b/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/41387874.failed
@@ -0,0 +1,99 @@
+tick/sched: Limit non-timekeeper CPUs calling jiffies update
+
+jira KERNEL-703
+Rebuild_History Non-Buildable kernel-5.14.0-611.36.1.el9_7
+commit-author Steve Wahl <steve.wahl@hpe.com>
+commit 4138787408aa47e9e107f28876cb59b42d78bb99
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/41387874.failed
+
+On large NUMA systems, while running a test program that saturates the
+inter-processor and inter-NUMA links, acquiring the jiffies_lock can be
+very expensive.
+
+If the cpu designated to do jiffies updates (tick_do_timer_cpu) gets
+delayed and other cpus decide to do the jiffies update themselves, a large
+number of them decide to do so at the same time.
+
+The inexpensive check against tick_next_period is far quicker than actually
+acquiring the lock, so most of these get in line to obtain the lock.  If
+obtaining the lock is slow enough, this spirals into the vast majority of
+CPUs continuously being stuck waiting for this lock, just to obtain it and
+find out that time has already been updated by another cpu. For example, on
+one random entry to kdb by manually-injected NMI, 2912 of 3840 CPUs were
+observed to be stuck there.
+
+To avoid this, allow only one non-timekeeper CPU to call
+tick_do_update_jiffies64() at any given time, resetting ts->stalled jiffies
+only if the jiffies update function is actually called.
+
+With this change, manually interrupting the test at most two CPUs are
+observed to invoke tick_do_update_jiffies64() - the timekeeper and one
+other.
+
+	Signed-off-by: Steve Wahl <steve.wahl@hpe.com>
+	Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+	Acked-by: Shrikanth Hegde <sshegde@linux.ibm.com>
+Link: https://patch.msgid.link/20251027183456.343407-1-steve.wahl@hpe.com
+(cherry picked from commit 4138787408aa47e9e107f28876cb59b42d78bb99)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	kernel/time/tick-sched.c
+diff --cc kernel/time/tick-sched.c
+index 5205373652e9,3ff3eb1f90d0..000000000000
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@@ -181,6 -181,47 +181,50 @@@ static ktime_t tick_init_jiffy_update(v
+  	return period;
+  }
+
+++<<<<<<< HEAD
+++=======
++ static inline int tick_sched_flag_test(struct tick_sched *ts,
++ 				       unsigned long flag)
++ {
++ 	return !!(ts->flags & flag);
++ }
++ 
++ static inline void tick_sched_flag_set(struct tick_sched *ts,
++ 				       unsigned long flag)
++ {
++ 	lockdep_assert_irqs_disabled();
++ 	ts->flags |= flag;
++ }
++ 
++ static inline void tick_sched_flag_clear(struct tick_sched *ts,
++ 					 unsigned long flag)
++ {
++ 	lockdep_assert_irqs_disabled();
++ 	ts->flags &= ~flag;
++ }
++ 
++ /*
++  * Allow only one non-timekeeper CPU at a time update jiffies from
++  * the timer tick.
++  *
++  * Returns true if update was run.
++  */
++ static bool tick_limited_update_jiffies64(struct tick_sched *ts, ktime_t now)
++ {
++ 	static atomic_t in_progress;
++ 	int inp;
++ 
++ 	inp = atomic_read(&in_progress);
++ 	if (inp || !atomic_try_cmpxchg(&in_progress, &inp, 1))
++ 		return false;
++ 
++ 	if (ts->last_tick_jiffies == jiffies)
++ 		tick_do_update_jiffies64(now);
++ 	atomic_set(&in_progress, 0);
++ 	return true;
++ }
++ 
+++>>>>>>> 4138787408aa (tick/sched: Limit non-timekeeper CPUs calling jiffies update)
+  #define MAX_STALLED_JIFFIES 5
+
+  static void tick_sched_do_timer(struct tick_sched *ts, ktime_t now)
+* Unmerged path kernel/time/tick-sched.c
diff --git a/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/4c800227.failed b/ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/4c800227.failed
@@ -0,0 +1,42 @@
+fou: fix initialization of grc
+
+jira KERNEL-703
+Rebuild_History Non-Buildable kernel-5.14.0-611.36.1.el9_7
+commit-author Muhammad Usama Anjum <usama.anjum@collabora.com>
+commit 4c8002277167125078e6b9b90137bdf443ebaa08
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-5.14.0-611.36.1.el9_7/4c800227.failed
+
+The grc must be initialize first. There can be a condition where if
+fou is NULL, goto out will be executed and grc would be used
+uninitialized.
+
+Fixes: 7e4196935069 ("fou: Fix null-ptr-deref in GRO.")
+	Signed-off-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
+	Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
+Link: https://patch.msgid.link/20240906102839.202798-1-usama.anjum@collabora.com
+	Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+(cherry picked from commit 4c8002277167125078e6b9b90137bdf443ebaa08)
+	Signed-off-by: Jonathan Maple <jmaple@ciq.com>
+
+# Conflicts:
+#	net/ipv4/fou_core.c
+diff --cc net/ipv4/fou_core.c
+index b7b887f83b65,3e30745e2c09..000000000000
+--- a/net/ipv4/fou_core.c
++++ b/net/ipv4/fou_core.c
+@@@ -328,6 -338,9 +328,12 @@@ static struct sk_buff *gue_gro_receive(
+
+  	skb_gro_remcsum_init(&grc);
+
+++<<<<<<< HEAD
+++=======
++ 	if (!fou)
++ 		goto out;
++ 
+++>>>>>>> 4c8002277167 (fou: fix initialization of grc)
+  	off = skb_gro_offset(skb);
+  	len = off + sizeof(*guehdr);
+
+* Unmerged path net/ipv4/fou_core.c