Commit graph

1,461,726 commits

Author SHA1 Message Date
Riana Tauro
f4e9fc967a
drm/xe/xe_survivability: Redesign survivability mode
Redesign survivability mode to have only one value per file.

1) Retain the survivability_mode sysfs to indicate the type

	cat /sys/bus/pci/devices/0000\:03\:00.0/survivability_mode
	(Boot / Runtime)

2) Add survivability_info directory to expose boot breadcrumbs.
Entries in survivability mode sysfs are only visible when
boot breadcrumb registers are populated.

	/sys/bus/pci/devices/0000:03:00.0/survivability_info
	├── aux_info0
	├── aux_info1
	├── aux_info2
	├── aux_info3
	├── aux_info4
	├── capability_info
	├── postcode_trace
	└── postcode_trace_overflow

Capability Info:

	Provides data about boot status and has bits that
	indicate the support for the other breadcrumbs

Postcode Trace / Postcode Trace Overflow :

	Each postcode is represented as an 8-bit value and represents
	a boot failure event. When a new failure event is logged by Pcode
	the existing postcodes are shifted left. These entries provide a
	history of 8 postcodes.

Auxiliary Info:

	Some failures have additional debug information.

Signed-off-by: Riana Tauro <riana.tauro@intel.com>
Reviewed-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Link: https://patch.msgid.link/20251208084539.3652902-5-riana.tauro@intel.com
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2025-12-09 17:19:42 -05:00
Linus Torvalds
9d588a1140 platform-drivers-x86 for v6.19-1
Highlights:
 
 - acer-wmi: Add PH16-72, PHN16-72, and PT14-51 fan control support
 
 - acpi: platform_profile: Add max-power profile option (power draw limited
                           by the cooling hardware, may exceed battery power
 			  draw limit when on AC power)
 
 - amd/hsmp: Allow >1 data-fabric per socket
 
 - asus-armoury: Add WMI attributes driver to expose miscellaneous
                 WMI functions through fw_attributes (deprecates
                 the custom BIOS features interface through asus-wmi)
 
 - asus-wmi: Use brightness_set_blocking() for kbd led
 
 - ayaneo-ec: Add Ayaneo Embedded Controller driver
 
 - fs/nls:
 
   - Fix utf16 -> utf8 string conversion in output size restricted cases
 
   - Improve error code consistency for utf8 -> utf32 conversions
 
 - ideapad-laptop: Fast (Rapid Charge) charge type support
 
 - intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
 
 - intel/pmc:
 
   - Arrow Lake telemetry GUID improvements
 
   - Add support for Wildcat Lake PMC information
 
 - intel_pmc_ipc: Fix ACPI buffer memleak
 
 - intel/punit_ipc: Fix memory corruption
 
 - intel/vsec: Wildcat Lake PMT telemetry support
 
 - lenovo-wmi-gamezone: Map "Extreme" performance mode to max-power
 
 - lg-laptop: Add support for the HDAP opregion field
 
 - serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects
 
 - thinkpad-t14s-ec: Improve suspend/resume support (lid LEDs, keyboard
                     backlight)
 
 - uniwill: Add Uniwill laptop driver
 
 - wmi: Move under drivers/platform/wmi as non-x86 WMI support is around
        the corner and other WMI features will require adding more C
        files as well
 
 - tools/power/x86/intel-speed-select: v1.24
 
   - Check feature status to check if the feature enablement was successful
 
   - Reset SST-TF bucket structure to display valid bucket info
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 acer-wmi:
  -  Add fan control support
  -  Add support for PHN16-72
  -  Enable fan control for PH16-72 and PT14-51
  -  Fix setting of fan behavior
 
 acpi:
  -  platform_profile - Add max-power profile option
 
 Add Uniwill laptop driver:
  - Add Uniwill laptop driver
 
 alienware-wmi-wmax:
  -  Simplify FW profile to pprof matching
 
 amd: hfi:
  -  Remove redundant assignment to .owner
  -  Remove unused cpumask from cpuinfo struct
 
 amd/hsmp:
  -  Replace amd_num_nodes() with topology_max_packages()
 
 amd/pmf:
  -  Add BIOS_INPUTS_MAX macro to replace hardcoded array size
  -  Refactor repetitive BIOS output handling
  -  Rename IPU metrics fields to NPU for consistency
  -  Replace magic table id with METRICS_TABLE_ID
  -  Use devm_mutex_init() for mutex initialization
  -  Use explicit SET_CMD/GET_CMD flags in amd_pmf_send_cmd()
 
 arm64: thinkpad-t14s-ec:
  -  add suspend handler for keyboard backlight
  -  add system PM hooks
 
 asus-armoury:
  -  add apu-mem control support
  -  add panel_hd_mode attribute
  -  add ppt_* and nv_* tuning knobs
  -  add screen auto-brightness toggle
  -  add support for FA507UV
  -  add support for GA503QR
  -  Fix error code in mini_led_mode_current_value_store()
  -  fix mini-led mode show
  -  fix only DC tunables being available
  -  move existing tunings to asus-armoury module
 
 asus-wmi:
  -  deprecate bios features
  -  export symbols used for read/write WMI
  -  rename ASUS_WMI_DEVID_PPT_FPPT
  -  use brightness_set_blocking() for kbd led
 
 ayaneo-ec:
  -  Add Ayaneo Embedded Controller platform driver
  -  Add charge control support
  -  Add controller power and modules attributes
  -  Add hwmon support
  -  Add suspend hook
  -  Move Ayaneo devices from oxpec to ayaneo-ec
 
 Documentation: laptops:
  -  Add documentation for uniwill laptops
 
 fs/nls:
  -  Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
  -  Fix utf16 to utf8 conversion
 
 hp-wmi:
  -  Order DMI board name arrays
 
 ideapad-laptop: Add charge_types:
  - Fast (Rapid Charge)
 
 ideapad-laptop:
  -  Protect GBMD/SBMC calls with mutex
  -  Support multiple power_supply_ext definitions
  -  Use str_on_off() helper
 
 intel/hid:
  -  Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
 
 intel/pmc:
  -  Add DMU GUID to Arrow Lake U/H
  -  Add support for multiple DMU GUIDs
  -  Enable SSRAM support for Wildcat Lake
 
 intel_pmc_ipc:
  -  fix ACPI buffer memory leak
 
 intel/pmc:
  -  Relocate lpm_req_guid to pmc_reg_map
  -  Remove redundant has_die_c6 variable
  -  Rename PMC index variable to pmc_idx
  -  Update Arrow Lake telemetry GUID
 
 intel/vsec:
  -  Add support for Wildcat Lake
 
 lenovo-wmi-gamezone Use max-power rather than balanced-performance:
  - lenovo-wmi-gamezone Use max-power rather than balanced-performance
 
 lg-laptop:
  -  Add support for the HDAP opregion field
 
 serial-multi-instantiate:
  -  Add IRQ_RESOURCE_OPT for IRQ missing projects
 
 surface: acpi-notify:
  -  add WQ_PERCPU to alloc_workqueue users
 
 surface: aggregator:
  -  Omit a variable reassignment in ssam_serial_hub_probe()
 
 surface:
  -  replace use of system_wq with system_percpu_wq
 
 tools/power/x86/intel-speed-select:
  -  Check feature status
  -  Reset isst_turbo_freq_info for invalid buckets
  -  v1.24 release
 
 uniwill:
  -  Add TUXEDO devices
  -  Handle more WMI events required for TUXEDO devices
 
 wmi-gamezone:
  -  Add Legion Go 2 Quirks
 
 wmi:
  -  Move WMI core code into a separate directory
  -  Remove extern keyword from prototypes
  -  Use correct type when populating ACPI objects
 
 x86-android-tablets:
  -  Omit a variable reassignment in lenovo_yoga_tab2_830_1050_init_codec()
 
 x86:
  -  replace use of system_wq with system_percpu_wq
 
 Merges:
  -  Merge branch 'fixes' of into for-next
  -  Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into for-next
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCaTgl5wAKCRBZrE9hU+XO
 McWDAP4nmj5+EeHsg3Kl0kQ1lqF9llWI4EM2NeRd6MwrV5klxgD9FLW6djGkmP2j
 RjtZ4CULbtQ3QMl7kmXhfAjRwJfiSgk=
 =yFvQ
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen:

 - acer-wmi: Add PH16-72, PHN16-72, and PT14-51 fan control support

 - acpi: platform_profile: Add max-power profile option (power draw
   limited by the cooling hardware, may exceed battery power draw limit
   when on AC power)

 - amd/hsmp: Allow more than one data-fabric per socket

 - asus-armoury: Add WMI attributes driver to expose miscellaneous WMI
   functions through fw_attributes (deprecates the custom BIOS features
   interface through asus-wmi)

 - asus-wmi: Use brightness_set_blocking() for kbd led

 - ayaneo-ec: Add Ayaneo Embedded Controller driver

 - fs/nls:
     - Fix utf16 to utf8 string conversion when output size restricted
     - Improve error code consistency for utf8 to utf32 conversions

 - ideapad-laptop: Fast (Rapid Charge) charge type support

 - intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks

 - intel/pmc:
     - Arrow Lake telemetry GUID improvements
     - Add support for Wildcat Lake PMC information

 - intel_pmc_ipc: Fix ACPI buffer memleak

 - intel/punit_ipc: Fix memory corruption

 - intel/vsec: Wildcat Lake PMT telemetry support

 - lenovo-wmi-gamezone: Map "Extreme" performance mode to max-power

 - lg-laptop: Add support for the HDAP opregion field

 - serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing
   projects

 - thinkpad-t14s-ec: Improve suspend/resume support (lid LEDs, keyboard
   backlight)

 - uniwill: Add Uniwill laptop driver

 - wmi: Move under drivers/platform/wmi as non-x86 WMI support is around
   the corner and other WMI features will require adding more C files as
   well

 - tools/power/x86/intel-speed-select: v1.24
     - Check feature status to check if the feature enablement was
       successful
     - Reset SST-TF bucket structure to display valid bucket info

 - Miscellaneous cleanups / refactoring / improvements

* tag 'platform-drivers-x86-v6.19-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (73 commits)
  tools/power/x86/intel-speed-select: v1.24 release
  tools/power/x86/intel-speed-select: Reset isst_turbo_freq_info for invalid buckets
  tools/power/x86/intel-speed-select: Check feature status
  platform/x86: asus-wmi: use brightness_set_blocking() for kbd led
  fs/nls: Fix inconsistency between utf8_to_utf32() and utf32_to_utf8()
  platform/x86: asus-armoury: add support for GA503QR
  platform/x86: intel_pmc_ipc: fix ACPI buffer memory leak
  platform/x86: hp-wmi: Order DMI board name arrays
  platform/x86/intel/hid: Add Dell Pro Rugged 10/12 tablet to VGBS DMI quirks
  platform: surface: replace use of system_wq with system_percpu_wq
  platform: x86: replace use of system_wq with system_percpu_wq
  platform/surface: acpi-notify: add WQ_PERCPU to alloc_workqueue users
  platform/x86: wmi-gamezone: Add Legion Go 2 Quirks
  platform/x86: lenovo-wmi-gamezone Use max-power rather than balanced-performance
  acpi: platform_profile - Add max-power profile option
  platform/x86/amd/pmf: Use devm_mutex_init() for mutex initialization
  platform/x86/amd/pmf: Add BIOS_INPUTS_MAX macro to replace hardcoded array size
  platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects
  platform/x86/amd/pmf: Refactor repetitive BIOS output handling
  platform/x86/uniwill: Add TUXEDO devices
  ...
2025-12-10 06:38:17 +09:00
Linus Torvalds
9f20d9bad5 More power management updates for 6.19-rc1
Fix a runtime PM unit test added during the 6.18 development cycle and
 change the pm_runtime_barrier() return type to void (Brian Norris).
 -----BEGIN PGP SIGNATURE-----
 
 iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmk4BQ8SHHJqd0Byand5
 c29ja2kubmV0AAoJEO5fvZ0v1OO1sSwIAIBNY60EiGNHIVg4dyCbK/sVai66yJ1h
 Sj4cxfbQxCXBC6qWu8R2NBzDbXAgdsixLwaQcNn2ekhLwh1UzqFe2DWPSAsiIvoV
 FxE6fCJO5KzeTY2pIjiXfFdFsFsPwQkbqO2nwXBfoDz8HZolLnZGmRGWIqxAJ4LM
 kw9oefOhnD4VLd2Ce9pgbovZF/X+znKH5+9CgY+bD98NCcwlmOouz3vCXMYwJzn2
 F+/YJdNaLjtH4bGsojlknvOtnu3ZyM2bD4TzzJjOAe2gv+7yIA/Cv1rlnu0XffhB
 AQ8l3JBF4erIJ9lwmsRZpebchWYnq8VVbj1Fe+xh9CQdnIfnom2ZVik=
 =J7Q0
 -----END PGP SIGNATURE-----

Merge tag 'pm-6.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

Pull more power management updates from Rafael Wysocki:
 "Fix a runtime PM unit test added during the 6.18 development cycle and
  change the pm_runtime_barrier() return type to void (Brian Norris)"

* tag 'pm-6.19-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  coccinelle: Drop pm_runtime_barrier() error code checks
  PM: runtime: Make pm_runtime_barrier() return void
  PM: runtime: Stop checking pm_runtime_barrier() return code
2025-12-10 06:29:40 +09:00
Linus Torvalds
7a3984bbd6 just cleanups and fixes
-----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmk4DwkaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHD/dA//d44V2BXq3KQa1mAfHVzL
 uujZ3wAs5mTuz/NRYWpwy5nmcyvXvRww3FoABA9ILhk6mAc3IXs0La6Q9PKulRfk
 GX3w5PpHrxS+p3cuX+UY/xEDlhjNrE9F7UUzJjMgbGAKGJHmP54tNqp4tuJ0WtHC
 XPfhXjvNBzDVRykXWhp0M4YoGyYzo8Gb6JqFQuZzBOwTK/0H1JwV7ArGWXfpQFNQ
 NLzsX5tuM9K7JnTZ3q22aJMzBhAF/qdwe0G8TPEZauUEFeDmg8HFyS4HRIK3OWPG
 NIVTDTgbTFmqr4kBKP9ymSdJha2AGwhHlPlcHZdM6UIyJui3tOZUuWXyluaDHKal
 ZG7YVW9pUmjsSaBzFNd0l9QNzeWOSJN7NUeM7Xdcko0SzlMuQiCoS1QcPp8g6JU9
 5uPe6dT01PrgE9Io6atiqNgZK0+tdzqY7Ny6tB2ar8HBfSh5Y6JTmat9SeQI51LP
 kBOCIgUw5+tjekym4UCqlC2x7CFJhxtzLT6VssZtsqrENk2NFisQKBE+IDLjwp7o
 Olc43SVok/ZBxLQus5g4UL0DvenOG965jj9Qb4tvIF3w6wmLsLr07TVew1BcC6k8
 thEtIcmoP+WTw27ESuPj0UejAX0v4tf8IRnePyJnfAtlz834rm26C/p3eN5MCcY4
 9vge9trDsy1GOzMDQRPOKvg=
 =X6/w
 -----END PGP SIGNATURE-----

Merge tag 'mips_6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS updates from Thomas Bogendoerfer:
 "Just cleanups and fixes"

* tag 'mips_6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux:
  MIPS: Fix whitespace damage in r4k_wait from VS timer fix
  mips: kvm: simplify kvm_mips_deliver_interrupts()
  MIPS: alchemy: mtx1: switch to static device properties
  mips: Remove __GFP_HIGHMEM masking
  MIPS: ftrace: Fix memory corruption when kernel is located beyond 32 bits
  MIPS: dts: Always descend vendor subdirectories
  mips: configs: loongson1: Update defconfig
  MIPS: Fix HOTPLUG_PARALLEL dependency
2025-12-10 06:20:22 +09:00
Christoph Hellwig
12eef14bcb lockref: add a __cond_lock annotation for lockref_put_or_lock
Add a cond_lock annotation for lockref_put_or_lock to make sparse
happy with using it.  Note that for this the return value has to be
double-inverted as the return value convention of lockref_put_or_lock
is inverted compared to _trylock conventions expected by __cond_lock,
as lockref_put_or_lock returns true when it did not need to take the
lock.

Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2025-12-10 05:58:51 +09:00
Linus Torvalds
c752c21c90 Convert "__auto_type" to "auto", defining a macro for "auto"
unless C23+ is in use.
 
 ---
  arch/nios2/include/asm/uaccess.h                      |  8 ++++----
  arch/x86/include/asm/bug.h                            |  2 +-
  arch/x86/include/asm/string_64.h                      |  6 +++---
  arch/x86/include/asm/uaccess_64.h                     |  2 +-
  fs/proc/inode.c                                       | 19 +++++++++----------
  include/linux/cleanup.h                               |  6 +++---
  include/linux/compiler.h                              |  2 +-
  include/linux/compiler_types.h                        | 13 +++++++++++++
  include/linux/minmax.h                                |  6 +++---
  .../testing/selftests/bpf/prog_tests/socket_helpers.h |  9 +++++++--
  tools/virtio/linux/compiler.h                         |  2 +-
  11 files changed, 46 insertions(+), 29 deletions(-)
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEbQEHvGnuWidP2bYMLbPDMhtt34YFAmk4grQACgkQLbPDMhtt
 34Z9zQ//VKM0xKkCGVPfRBbL33O+DIcDfZjk6jokAl47aKAwJxrSTfT+Hdnmwsnv
 i7gKwaioYxDjnZlsfCzDbwbHexPTMGjsjgRNmFK3uS1mv1AhTspV2Jjn9qiYzd5o
 N+Cvzv7eIr88ti1dKe+7MZBa9j37nsGKZDzT0M/GubBlzIgMzeCZ6xAxOOV/TmD9
 sP17oU65MhczegpXH/fcxyK7atkvlWskPfc+50YB5T3C96hqzT0LDiU/vBSHIJ8z
 EyqSRYlt2To17BdcKQEKYcklduFZwJ/02UWDT4RYJRGBSkn6ohPJJwYsjI5Cvl5m
 9yPRLLqW/LsA5O5CZ/mq/tM0xiDdm5dCTEEbiwk90Lg1XTVxmpbTbMjjN1MCAy+a
 HYjsq9nWkYl9xXVBHk7CqgAjITAV7Z4ZZN//JLrJleQsD794EP3vYBzEaa370deP
 L22lONVSjpPm6m+Rr1fjObRDFQxs4piobUavxIj2JKaF48G8mSA0uAOG0nBRQkR1
 jOTsMhqH33z9XNxb52BlFdaVkQGkHNlLeONc/ivGiDMKox5oCb/gveKOQ+PXYnLN
 IRTllLqke0fuOQrgLa5lu135J6ZbPHDOgH+P19OwNrBQnOMQqzTr7DnENVoanIy7
 ocVc6vS3OX4qhZ+7uVpHugbnSCWOoCzBgV4xcZrIdh4qpTKzM+g=
 =Cu2O
 -----END PGP SIGNATURE-----

Merge tag 'auto-type-conversion-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-auto

Pull __auto_type to auto conversion from Peter Anvin:
 "Convert '__auto_type' to 'auto', defining a macro for 'auto' unless
  C23+ is in use"

* tag 'auto-type-conversion-for-v6.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/hpa/linux-auto:
  tools/virtio: replace "__auto_type" with "auto"
  selftests/bpf: replace "__auto_type" with "auto"
  arch/x86: replace "__auto_type" with "auto"
  arch/nios2: replace "__auto_type" and adjacent equivalent with "auto"
  fs/proc: replace "__auto_type" with "const auto"
  include/linux: change "__auto_type" to "auto"
  compiler_types.h: add "auto" as a macro for "__auto_type"
2025-12-10 05:41:10 +09:00
Lizhi Hou
00ffe45ece accel/amdxdna: Fix race condition when checking rpm_on
When autosuspend is triggered, driver rpm_on flag is set to indicate that
a suspend/resume is already in progress. However, when a userspace
application submits a command during this narrow window,
amdxdna_pm_resume_get() may incorrectly skip the resume operation because
the rpm_on flag is still set. This results in commands being submitted
while the device has not actually resumed, causing unexpected behavior.

The set_dpm() is called by suspend/resume, it relied on rpm_on flag to
avoid calling into rpm suspend/resume recursivly. So to fix this, remove
the use of the rpm_on flag entirely. Instead, introduce aie2_pm_set_dpm()
which explicitly resumes the device before invoking set_dpm(). With this
change, set_dpm() is called directly inside the suspend or resume execution
path. Otherwise, aie2_pm_set_dpm() is called.

Fixes: 063db45183 ("accel/amdxdna: Enhance runtime power management")
Reviewed-by: Mario Limonciello (AMD) <superm1@kernel.org>
Reviewed-by: Maciej Falkowski <maciej.falkowski@linux.intel.com>
Signed-off-by: Lizhi Hou <lizhi.hou@amd.com>
Link: https://patch.msgid.link/20251208165356.1549237-1-lizhi.hou@amd.com
2025-12-09 11:51:03 -08:00
Tomasz Lis
a00e305fba drm/xe/vf: Stop waiting for ring space on VF post migration recovery
If wait for ring space started just before migration, it can delay
the recovery process, by waiting without bailout path for up to 2
seconds.

Two second wait for recovery is not acceptable, and if the ring was
completely filled even without the migration temporarily stopping
execution, then such a wait will result in up to a thousand new jobs
(assuming constant flow) being added while the wait is happening.

While this will not cause data corruption, it will lead to warning
messages getting logged due to reset being scheduled on a GT under
recovery. Also several seconds of unresponsiveness, as the backlog
of jobs gets progressively executed.

Add a bailout condition, to make sure the recovery starts without
much delay. The recovery is expected to finish in about 100 ms when
under moderate stress, so the condition verification period needs to be
below that - settling at 64 ms.

The theoretical max time which the recovery can take depends on how
many requests can be emitted to engine rings and be pending execution.
While stress testing, it was possible to reach 10k pending requests
on rings when a platform with two GTs was used. This resulted in max
recovery time of 5 seconds. But in real life situations, it is very
unlikely that the amount of pending requests will ever exceed 100,
and for that the recovery time will be around 50 ms - well within our
claimed limit of 100ms.

Fixes: a4dae94aad ("drm/xe/vf: Wakeup in GuC backend on VF post migration recovery")
Signed-off-by: Tomasz Lis <tomasz.lis@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Signed-off-by: Michal Wajdeczko <michal.wajdeczko@intel.com>
Link: https://patch.msgid.link/20251204200820.2206168-1-tomasz.lis@intel.com
2025-12-09 20:50:12 +01:00
Arnd Bergmann
dafdba0964 mm/damon/tests/core-kunit: avoid damos_test_commit stack warning
The newly added damos_test_commit() constructs multiple large structures
on the stack, which exceeds the warning limit in some cases:

In file included from mm/damon/core.c:2941:
mm/damon/tests/core-kunit.h: In function 'damos_test_commit':
mm/damon/tests/core-kunit.h:965:1: error: the frame size of 1520 bytes is larger than 1280 bytes [-Werror=frame-larger-than=]

Split this function up into two separate ones that are called
sequentially, so they can occupy the same stack slots.

Link: https://lkml.kernel.org/r/20251204100403.1034980-1-arnd@kernel.org
Fixes: 299a88f6ec ("mm/damon/tests/core-kunit: add damos_commit() test")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Quanmin Yan <yanquanmin1@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:34 -08:00
Chen Ridong
49d921b471 mm: vmscan: correct nr_requested tracing in scan_folios
When enabling vmscan tracing, it is observed that nr_requested is always
4096, which is confusing.

        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...
        mm_vmscan_lru_isolate: classzone=3 order=0 nr_requested=4096 ...

This is because it prints MAX_LRU_BATCH, which is meaningless as it's a
constant.  To fix this, modify it to print capped valued.

Link: https://lkml.kernel.org/r/20251204122355.1822919-1-chenridong@huaweicloud.com
Fixes: 8c2214fc9a ("mm: multi-gen LRU: reuse some legacy trace events")
Signed-off-by: Chen Ridong <chenridong@huawei.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Lance Yang <lance.yang@linux.dev>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: Jaewon Kim <jaewon31.kim@samsung.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Lu Jialin <lujialin4@huawei.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Qi Zheng <zhengqi.arch@bytedance.com>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Wei Xu <weixugc@google.com>
Cc: Yuanchu Xie <yuanchu@google.com>
Cc: Yu Zhao <yuzhao@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:34 -08:00
Lukas Bulwahn
12c1fa8d46 MAINTAINERS: add idr core-api doc file to XARRAY
The files in Documentation/core-api/ are by virtue of their top-level
directory part of the Documentation section in MAINTAINERS.  Each file in
Documentation/core-api/ should however also have a further section in
MAINTAINERS it belongs to, which fits to the technical area of the
documented API in that file.

idr.rst provides some explanation to the ID allocation API defined in
lib/idr.c, which itself is part of the XARRAY section.

Add this core-api document to XARRAY.

Link: https://lkml.kernel.org/r/20251105105857.156950-1-lukas.bulwahn@redhat.com
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:34 -08:00
Shameer Kolothum
9ee5d1766c mm/hugetlb: fix incorrect error return from hugetlb_reserve_pages()
The function hugetlb_reserve_pages() returns the number of pages added
to the reservation map on success and a negative error code on failure
(e.g. -EINVAL, -ENOMEM). However, in some error paths, it may return -1
directly.

For example, a failure at:

    if (hugetlb_acct_memory(h, gbl_reserve) < 0)
        goto out_put_pages;

results in returning -1 (since add = -1), which may be misinterpreted
in userspace as -EPERM.

Fix this by explicitly capturing and propagating the return values from
helper functions, and using -EINVAL for all other failure cases.

Link: https://lkml.kernel.org/r/20251125171350.86441-1-skolothumtho@nvidia.com
Fixes: 986f5f2b4b ("mm/hugetlb: make hugetlb_reserve_pages() return nr of entries updated")
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: Matthew R. Ochs <mochs@nvidia.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Nicolin Chen <nicolinc@nvidia.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:33 -08:00
Lukas Bulwahn
40a4af52e0 mm: fix CONFIG_STACK_GROWSUP typo in mm.h
Commit 2b6a3f061f ("mm: declare VMA flags by bit") significantly
refactors the header file include/linux/mm.h.  In that step, it introduces
a typo in an ifdef, referring to a non-existing config option
STACK_GROWS_UP, whereas the actual config option is called STACK_GROWSUP.

Fix this typo in the mm header file.

Link: https://lkml.kernel.org/r/20251201122922.352480-1-lukas.bulwahn@redhat.com
Fixes: 2b6a3f061f ("mm: declare VMA flags by bit")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@redhat.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Alice Ryhl <aliceryhl@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:33 -08:00
Zi Yan
9dcdc0c207 mm/huge_memory: fix folio split stats counting
The "return <error code>" statements for error checks at the beginning of
__folio_split() skip necessary count_vm_event() and count_mthp_stat() at
the end of the function.  Fix these by replacing them with "ret = <error
code>; goto out;".

Link: https://lkml.kernel.org/r/20251126210618.1971206-5-ziy@nvidia.com
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:33 -08:00
Zi Yan
2f78910659 mm/huge_memory: make min_order_for_split() always return an order
min_order_for_split() returns -EBUSY when the folio is truncated and
cannot be split.  In commit 77008e1b2e ("mm/huge_memory: do not change
split_huge_page*() target order silently"), memory_failure() does not
handle it and pass -EBUSY to try_to_split_thp_page() directly. 
try_to_split_thp_page() returns -EINVAL since -EBUSY becomes 0xfffffff0 as
new_order is unsigned int in __folio_split() and this large new_order is
rejected as an invalid input.  The code does not cause a bug. 
soft_offline_in_use_page() also uses min_order_for_split() but it always
passes 0 as new_order for split.

Fix it by making min_order_for_split() always return an order.  When the
given folio is truncated, namely folio->mapping == NULL, return 0 and let
a subsequent split function handle the situation and return -EBUSY.

Add kernel-doc to min_order_for_split() to clarify its use.

Link: https://lkml.kernel.org/r/20251126210618.1971206-4-ziy@nvidia.com
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:33 -08:00
Zi Yan
5842bcbfc3 mm/huge_memory: replace can_split_folio() with direct refcount calculation
can_split_folio() is just a refcount comparison, making sure only the
split caller holds an extra pin.  Open code it with
folio_expected_ref_count() != folio_ref_count() - 1.  For the extra_pins
used by folio_ref_freeze(), add folio_cache_ref_count() to calculate it. 
Also replace folio_expected_ref_count() with folio_cache_ref_count() used
by folio_ref_unfreeze(), since they are returning the same values when a
folio is frozen and folio_cache_ref_count() does not have unnecessary
folio_mapcount() in its implementation.

Link: https://lkml.kernel.org/r/20251126210618.1971206-3-ziy@nvidia.com
Signed-off-by: Zi Yan <ziy@nvidia.com>
Suggested-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Balbir Singh <balbirs@nvidia.com>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:32 -08:00
Zi Yan
bdd0d69a32 mm/huge_memory: change folio_split_supported() to folio_check_splittable()
Patch series "Improve folio split related functions", v4.

This patchset improves several folio split related functions to avoid
future misuse.  The changes are:

1. Consolidated folio splittable checks by moving truncated folio check,
   huge zero folio check, and writeback folio check into
   folio_split_supported(). Changed the function return type. Renamed it
   to folio_check_splittable() for clarification.

2. Replaced can_split_folio() with open coded folio_expected_ref_count()
   and folio_ref_count() and introduced folio_cache_ref_count().

3. Changed min_order_for_split() to always return an order.

4. Fixed folio split stats counting.

Motivation
==========
This is based on Wei's observation[1] and solves several potential
issues:
1. Dereferencing NULL folio->mapping in try_folio_split_to_order() if it
   is called on truncated folios.
2. Not handling of negative return value of min_order_for_split() in
   mm/memory-failure.c

There is no bug in the current code.


This patch (of 4):

folio_split_supported() used in try_folio_split_to_order() requires
folio->mapping to be non NULL, but current try_folio_split_to_order() does
not check it.  There is no issue in the current code, since
try_folio_split_to_order() is only used in truncate_inode_partial_folio(),
where folio->mapping is not NULL.

To prevent future misuse, move folio->mapping NULL check (i.e., folio is
truncated) into folio_split_supported().  Since folio->mapping NULL check
returns -EBUSY and folio_split_supported() == false means -EINVAL, change
folio_split_supported() return type from bool to int and return error
numbers accordingly.  Rename folio_split_supported() to
folio_check_splittable() to match the return type change.

While at it, move is_huge_zero_folio() check and folio_test_writeback()
check into folio_check_splittable() and add kernel-doc.

Remove all warnings inside folio_check_splittable() and give warnings
in __folio_split() instead, so that bool warns parameter can be removed.

Link: https://lkml.kernel.org/r/20251126210618.1971206-1-ziy@nvidia.com
Link: https://lkml.kernel.org/r/20251126210618.1971206-2-ziy@nvidia.com
Signed-off-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Wei Yang <richard.weiyang@gmail.com>
Acked-by: Balbir Singh <balbirs@nvidia.com>
Acked-by: David Hildenbrand (Red Hat) <david@kernel.org>
Cc: Baolin Wang <baolin.wang@linux.alibaba.com>
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Miaohe Lin <linmiaohe@huawei.com>
Cc: Naoya Horiguchi <nao.horiguchi@gmail.com>
Cc: Nico Pache <npache@redhat.com>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:32 -08:00
Jinhui Guo
1cba2eba9b mm/sparse: fix sparse_vmemmap_init_nid_early definition without CONFIG_SPARSEMEM
When CONFIG_SPARSEMEM is disabled, the macro
sparse_vmemmap_init_nid_early(_nid, _use) passes two arguments, while the
actual function accepts only nid.  Drop the extra argument _use.

Link: https://lkml.kernel.org/r/20251127092512.278-1-guojinhui.liam@bytedance.com
Fixes: d65917c423 ("mm/sparse: allow for alternate vmemmap section init at boot")
Signed-off-by: Jinhui Guo <guojinhui.liam@bytedance.com>
Cc: Frank van der Linden <fvdl@google.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: "David Hildenbrand (Red Hat)" <david@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:32 -08:00
David Hildenbrand
0da2ba35c0 powerpc/pseries/cmm: adjust BALLOON_MIGRATE when migrating pages
Let's properly adjust BALLOON_MIGRATE like the other drivers.

Note that the INFLATE/DEFLATE events are triggered from the core when
enqueueing/dequeueing pages.

This was found by code inspection.

Link: https://lkml.kernel.org/r/20251021100606.148294-3-david@redhat.com
Fixes: fe030c9b85 ("powerpc/pseries/cmm: Implement balloon compaction")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:31 -08:00
David Hildenbrand
fc6bcf9ac4 powerpc/pseries/cmm: call balloon_devinfo_init() also without CONFIG_BALLOON_COMPACTION
Patch series "powerpc/pseries/cmm: two smaller fixes".

Two smaller fixes identified while doing a bigger rework.


This patch (of 2):

We always have to initialize the balloon_dev_info, even when compaction is
not configured in: otherwise the containing list and the lock are left
uninitialized.

Likely not many such configs exist in practice, but let's CC stable to
be sure.

This was found by code inspection.

Link: https://lkml.kernel.org/r/20251021100606.148294-1-david@redhat.com
Link: https://lkml.kernel.org/r/20251021100606.148294-2-david@redhat.com
Fixes: fe030c9b85 ("powerpc/pseries/cmm: Implement balloon compaction")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Cc: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Madhavan Srinivasan <maddy@linux.ibm.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-12-09 11:25:31 -08:00
Niranjana Vishwanathapura
81e77c0288 drm/xe/xe3p_xpc: Enable Indirect Ring State for xe3p_xpc
The xe3p_xpc platform supports Indirect Ring State and
it is required for the upcoming multi-queue feature.

Signed-off-by: Niranjana Vishwanathapura <niranjana.vishwanathapura@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Reviewed-by: Matt Roper <matthew.d.roper@intel.com>
Link: https://patch.msgid.link/20251204063451.1180387-2-niranjana.vishwanathapura@intel.com
2025-12-09 10:48:44 -08:00
Claudiu Beznea
94bf74830a PCI: rzg3s-host: Initialize MSI status bitmap before use
Initialize rzg3s_pcie_msi_irq() MSI status bitmap before use.

Fixes: 7ef502fb35 ("PCI: Add Renesas RZ/G3S host controller driver")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202512070218.XVMUQCl7-lkp@intel.com
Closes: https://lore.kernel.org/all/202512061812.Xbqmd2Gn-lkp@intel.com
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20251209125122.304129-1-claudiu.beznea.uj@bp.renesas.com
2025-12-09 12:42:48 -06:00
Ripan Deuri
5a58414fe1 wifi: ath12k: Skip DP peer creation for scan vdev
Consider a multi-link AP configuration:

    MLD vif (MAC addr: aa:bb)
        |-- 2.4 GHz link (BSSID: aa:bb)
        |-- 5 GHz link   (BSSID: cc:dd)

For AP vdevs, ath12k creates a DP peer using the arvif's BSSID and stores
it in dp_hw->dp_peers_list. During scan operations, the driver assigns an
arvif to the scan vdev and uses the vif's MAC address as its BSSID. In
the above scenario, the scan vdev MAC address (aa:bb) matches the BSSID
of the 2.4 GHz AP link, causing a duplicate entry in dp_hw->dp_peers_list
and leading to scan vdev creation failure.

Failure in vif bringup sequence:
1. Create AP vdev for 2.4 GHz link:
   - Assign arvif with BSSID = aa:bb and link_id = 0.
   - Create DP peer with address aa:bb and add to dp_hw->dp_peers_list.

2. Create scan vdev for 5 GHz link:
   - Assign arvif with BSSID = aa:bb (same as vif MAC address) and
     link_id = 15.
   - Attempt to create another DP peer with address aa:bb.
   - Operation fails because aa:bb already exists in dp_hw->dp_peers_list,
     resulting in duplicate entry conflict.

3. Delete scan vdev for 5 GHz link.
4. Create AP vdev for 5 GHz link.

Since DP peer is not needed for scan operations, identify scan vdev using
arvif->link_id >= IEEE80211_MLD_MAX_NUM_LINKS and skip DP peer creation
and deletion.

Tested-on: QCN9274 hw2.0 PCI WLAN.WBE.1.5-01651-QCAHKSWPL_SILICONZ-1

Signed-off-by: Ripan Deuri <quic_rdeuri@quicinc.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Link: https://patch.msgid.link/20251207072717.95542-1-quic_rdeuri@quicinc.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2025-12-09 10:18:44 -08:00
Mohamed Khalfella
59e25ef2b4 block: Use RCU in blk_mq_[un]quiesce_tagset() instead of set->tag_list_lock
blk_mq_{add,del}_queue_tag_set() functions add and remove queues from
tagset, the functions make sure that tagset and queues are marked as
shared when two or more queues are attached to the same tagset.
Initially a tagset starts as unshared and when the number of added
queues reaches two, blk_mq_add_queue_tag_set() marks it as shared along
with all the queues attached to it. When the number of attached queues
drops to 1 blk_mq_del_queue_tag_set() need to mark both the tagset and
the remaining queues as unshared.

Both functions need to freeze current queues in tagset before setting on
unsetting BLK_MQ_F_TAG_QUEUE_SHARED flag. While doing so, both functions
hold set->tag_list_lock mutex, which makes sense as we do not want
queues to be added or deleted in the process. This used to work fine
until commit 98d81f0df7 ("nvme: use blk_mq_[un]quiesce_tagset")
made the nvme driver quiesce tagset instead of quiscing individual
queues. blk_mq_quiesce_tagset() does the job and quiesce the queues in
set->tag_list while holding set->tag_list_lock also.

This results in deadlock between two threads with these stacktraces:

  __schedule+0x47c/0xbb0
  ? timerqueue_add+0x66/0xb0
  schedule+0x1c/0xa0
  schedule_preempt_disabled+0xa/0x10
  __mutex_lock.constprop.0+0x271/0x600
  blk_mq_quiesce_tagset+0x25/0xc0
  nvme_dev_disable+0x9c/0x250
  nvme_timeout+0x1fc/0x520
  blk_mq_handle_expired+0x5c/0x90
  bt_iter+0x7e/0x90
  blk_mq_queue_tag_busy_iter+0x27e/0x550
  ? __blk_mq_complete_request_remote+0x10/0x10
  ? __blk_mq_complete_request_remote+0x10/0x10
  ? __call_rcu_common.constprop.0+0x1c0/0x210
  blk_mq_timeout_work+0x12d/0x170
  process_one_work+0x12e/0x2d0
  worker_thread+0x288/0x3a0
  ? rescuer_thread+0x480/0x480
  kthread+0xb8/0xe0
  ? kthread_park+0x80/0x80
  ret_from_fork+0x2d/0x50
  ? kthread_park+0x80/0x80
  ret_from_fork_asm+0x11/0x20

  __schedule+0x47c/0xbb0
  ? xas_find+0x161/0x1a0
  schedule+0x1c/0xa0
  blk_mq_freeze_queue_wait+0x3d/0x70
  ? destroy_sched_domains_rcu+0x30/0x30
  blk_mq_update_tag_set_shared+0x44/0x80
  blk_mq_exit_queue+0x141/0x150
  del_gendisk+0x25a/0x2d0
  nvme_ns_remove+0xc9/0x170
  nvme_remove_namespaces+0xc7/0x100
  nvme_remove+0x62/0x150
  pci_device_remove+0x23/0x60
  device_release_driver_internal+0x159/0x200
  unbind_store+0x99/0xa0
  kernfs_fop_write_iter+0x112/0x1e0
  vfs_write+0x2b1/0x3d0
  ksys_write+0x4e/0xb0
  do_syscall_64+0x5b/0x160
  entry_SYSCALL_64_after_hwframe+0x4b/0x53

The top stacktrace is showing nvme_timeout() called to handle nvme
command timeout. timeout handler is trying to disable the controller and
as a first step, it needs to blk_mq_quiesce_tagset() to tell blk-mq not
to call queue callback handlers. The thread is stuck waiting for
set->tag_list_lock as it tries to walk the queues in set->tag_list.

The lock is held by the second thread in the bottom stack which is
waiting for one of queues to be frozen. The queue usage counter will
drop to zero after nvme_timeout() finishes, and this will not happen
because the thread will wait for this mutex forever.

Given that [un]quiescing queue is an operation that does not need to
sleep, update blk_mq_[un]quiesce_tagset() to use RCU instead of taking
set->tag_list_lock, update blk_mq_{add,del}_queue_tag_set() to use RCU
safe list operations. Also, delete INIT_LIST_HEAD(&q->tag_set_list)
in blk_mq_del_queue_tag_set() because we can not re-initialize it while
the list is being traversed under RCU. The deleted queue will not be
added/deleted to/from a tagset and it will be freed in blk_free_queue()
after the end of RCU grace period.

Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Fixes: 98d81f0df7 ("nvme: use blk_mq_[un]quiesce_tagset")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-09 10:24:55 -07:00
Caleb Sander Mateos
db339b4067 ublk: don't mutate struct bio_vec in iteration
__bio_for_each_segment() uses the returned struct bio_vec's bv_len field
to advance the struct bvec_iter at the end of each loop iteration. So
it's incorrect to modify it during the loop. Don't assign to bv_len (or
bv_offset, for that matter) in ublk_copy_user_pages().

Signed-off-by: Caleb Sander Mateos <csander@purestorage.com>
Fixes: e87d66ab27 ("ublk: use rq_for_each_segment() for user copy")
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-09 10:20:18 -07:00
Shida Zhang
cfdeb588ae block: prohibit calls to bio_chain_endio
Now that all potential callers of bio_chain_endio have been
eliminated, completely prohibit any future calls to this function.

Suggested-by: Ming Lei <ming.lei@redhat.com>
Suggested-by: Andreas Gruenbacher <agruenba@redhat.com>
Suggested-by: Christoph Hellwig <hch@infradead.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-09 10:20:03 -07:00
Shida Zhang
53280e3984 bcache: fix improper use of bi_end_io
Don't call bio->bi_end_io() directly. Use the bio_endio() helper
function instead, which handles completion more safely and uniformly.

Suggested-by: Christoph Hellwig <hch@infradead.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Shida Zhang <zhangshida@kylinos.cn>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
2025-12-09 10:20:03 -07:00
Ard Biesheuvel
1c7f9e528f drm/i915: Fix format string truncation warning
GCC notices that the 16-byte uabi_name field could theoretically be too
small for the formatted string if the instance number exceeds 100.

So grow the field to 20 bytes.

drivers/gpu/drm/i915/intel_memory_region.c: In function ‘intel_memory_region_create’:
drivers/gpu/drm/i915/intel_memory_region.c:273:61: error: ‘%u’ directive output may be truncated writing between 1 and 5 bytes into a region of size between 3 and 11 [-Werror=format-truncation=]
  273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
      |                                                             ^~
drivers/gpu/drm/i915/intel_memory_region.c:273:58: note: directive argument in the range [0, 65535]
  273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
      |                                                          ^~~~~~
drivers/gpu/drm/i915/intel_memory_region.c:273:9: note: ‘snprintf’ output between 7 and 19 bytes into a destination of size 16
  273 |         snprintf(mem->uabi_name, sizeof(mem->uabi_name), "%s%u",
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  274 |                  intel_memory_type_str(type), instance);
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fixes: 3b38d35157 ("drm/i915: Add stable memory region names")
Cc: <stable@vger.kernel.org> # v6.8+
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>
Link: https://lore.kernel.org/r/20251205113500.684286-2-ardb@kernel.org
(cherry picked from commit 18476087f1)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-09 15:53:12 +02:00
Dibin Moolakadan Subrahmanian
460b317203 drm/i915/fbdev: Hold runtime PM ref during fbdev BO creation
During fbdev probe, the xe driver allocates and pins a framebuffer
BO (via xe_bo_create_pin_map_novm() → xe_ggtt_insert_bo()).

Without a runtime PM reference, xe_pm_runtime_get_noresume() warns about
missing outer PM protection as below:

	xe 0000:03:00.0: [drm] Missing outer runtime PM protection

Acquire a runtime PM reference before framebuffer allocation to ensure
xe_ggtt_insert_bo()  executes  under active runtime PM context.

Changes in v2:
 - Update commit message to add Fixes tag (Jani Nikula)

Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/6350
Fixes: 44e694958b ("drm/xe/display: Implement display support")
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Signed-off-by: Dibin Moolakadan Subrahmanian <dibin.moolakadan.subrahmanian@intel.com>
Reviewed-by: Jouni Högander <jouni.hogander@intel.com>
Signed-off-by: Ankit Nautiyal <ankit.k.nautiyal@intel.com>
Link: https://patch.msgid.link/20251111135403.3415947-1-dibin.moolakadan.subrahmanian@intel.com
(cherry picked from commit 37fc7b7b3a)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-09 15:25:34 +02:00
Jani Nikula
668e88877a drm/i915/crtc: move crtc initialization loop to intel_crtc.c
intel_display_driver_probe_nogem() is too high of an abstraction level
to be looping and initializing individual CRTCs. Move this to
intel_crtc.c and repurpose intel_crtc_init() to initialize all
CRTCs. Make the original a static __intel_crtc_init() for initializing a
single CRTC.

Reviewed-by: Chaitanya Kumar Borah <chaitanya.kumar.borah@intel.com>
Link: https://patch.msgid.link/20251204143235.3138973-1-jani.nikula@intel.com
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
2025-12-09 14:43:25 +02:00
Faith Ekstrand
0823bd8942 drm/panfrost: Bump the driver version to 1.6
Bump the driver version to reflect the new cached-CPU mapping
capability.

v2:
- Quickly describe what the new version exposes in the commit message

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

v8:
- No changes

Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-14-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:37 +01:00
Faith Ekstrand
62eedf1ccb drm/panfrost: Add flag to map GEM object Write-Back Cacheable
Will be used by the UMD to optimize CPU accesses to buffers
that are frequently read by the CPU, or on which the access
pattern makes non-cacheable mappings inefficient.

Mapping buffers CPU-cached implies taking care of the CPU
cache maintenance in the UMD, unless the GPU is IO coherent.

v2:
- Add more to the commit message

v3:
- No changes

v4:
- Fix the map_wc test in panfrost_ioctl_query_bo_info()

v5:
- Drop Steve's R-b (enough has changed to justify a new review)

v6:
- Collect R-b

v7:
- No changes

v8:
- Fix double drm_gem_object_funcs::export assignment

Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-13-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:37 +01:00
Boris Brezillon
d17592e61f drm/panfrost: Add an ioctl to query BO flags
This is useful when importing BOs, so we can know about cacheability
and flush the caches when needed.

v2:
- New commit

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-12-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:37 +01:00
Faith Ekstrand
7be45f5489 drm/panfrost: Add a PANFROST_SYNC_BO ioctl
This will be used by the UMD to synchronize CPU-cached mappings when
the UMD can't do it directly (no usermode cache maintenance instruction
on Arm32).

v2:
- Add more to the commit message
- Change the flags to better match the drm_gem_shmem_sync semantics

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- Drop Steve's R-b (semantics changes requiring a new review)

v6:
- Bail out early in panfrost_ioctl_sync_bo() if op_count is zero

v7:
- Hand-roll our own bo_sync() helper

v8:
- Collect R-b

Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-11-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
2396d65d94 drm/panfrost: Expose the selected coherency protocol to the UMD
Will be needed if we want to skip CPU cache maintenance operations when
the GPU can snoop CPU caches.

v2:
- New commit

v3:
- Fix the coherency values (enum instead of bitmask)

v4:
- Fix init/test on coherency_features

v5:
- No changes

v6:
- Collect R-b

v7:
- No changes

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-10-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
3ae6637378 drm/panfrost: Provide a custom dma_buf implementation
Before we introduce cached CPU mappings, we want a dma_buf
implementation satisfying synchronization requests around CPU
accesses coming from a dma_buf exported by our driver. Let's
provide our own implementation relying on the default
gem_shmem_prime helpers designed for that purpose.

v5:
- New patch

v6:
- Collect R-b

v7:
- Hand-roll our own dma_buf boilerplate

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-9-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Faith Ekstrand
ae09426f47 drm/panthor: Bump the driver version to 1.7
Bump the driver version to reflect the new cached-CPU mapping
capability.

v2:
- Quickly describe what the new version exposes in the commit message

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

v8:
- Bump to 1.7 (1.6 was picked in the meantime)

Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-8-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Loïc Molinari
cd2c9c3015 drm/panthor: Add flag to map GEM object Write-Back Cacheable
Will be used by the UMD to optimize CPU accesses to buffers
that are frequently read by the CPU, or on which the access
pattern makes non-cacheable mappings inefficient.

Mapping buffers CPU-cached implies taking care of the CPU
cache maintenance in the UMD, unless the GPU is IO coherent.

v2:
- Add more to the commit message
- Tweak the doc
- Make sure we sync the section of the BO pointing to the CS
  syncobj before we read its seqno

v3:
- Fix formatting/spelling issues

v4:
- Add Steve's R-b

v5:
- Drop Steve's R-b (changes in the ioctl semantics requiring
  new review)

v6:
- Fix the uAPI doc
- Fix inverted logic in some comment

v7:
- No changes

v8:
- Collect R-b

Signed-off-by: Loïc Molinari <loic.molinari@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-7-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
c146c82f86 drm/panthor: Add an ioctl to query BO flags
This is useful when importing BOs, so we can know about cacheability
and flush the caches when needed.

We can also know when the buffer comes from a different subsystem and
take proper actions (avoid CPU mappings, or do kernel-based syncs
instead of userland cache flushes).

v2:
- New commit

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- No changes

v6:
- No changes

v7:
- No changes

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-6-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
e06177ec7a drm/panthor: Add a PANTHOR_BO_SYNC ioctl
This will be used by the UMD to synchronize CPU-cached mappings when
the UMD can't do it directly (no usermode cache maintenance instruction
on Arm32).

v2:
- Change the flags so they better match the drm_gem_shmem_sync()
  semantics

v3:
- Add Steve's R-b

v4:
- No changes

v5:
- Drop Steve's R-b (the semantics changes call for a new review)

v6:
- Drop ret initialization in panthor_ioctl_bo_sync()
- Bail out early in panthor_ioctl_bo_sync() if ops.count is zero
- Drop unused PANTHOR_BO_SYNC_OP_FLAGS definition

v7:
- Hand-roll the sync logic (was previously provided by gem_shmem)

v8:
- Collect R-b

Signed-off-by: Faith Ekstrand <faith.ekstrand@collabora.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-5-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
ea78ec9826 drm/panthor: Expose the selected coherency protocol to the UMD
If we want to be able to skip CPU cache maintenance operations on
CPU-cached mappings, the UMD needs to know the kind of coherency
in place. Add a field to drm_panthor_gpu_info to do that. We can re-use
a padding field for that since this object is write-only from the
KMD perspective, and the UMD should just ignore it.

v2:
- New commit

v3:
- Make coherency protocol a real enum, not a bitmask
- Add BUILD_BUG_ON()s to make sure the values in panthor_regs.h and
  those exposed through the uAPI match

v4:
- Add Steve's R-b

v5:
- No changes

v6:
- No changes

v7:
- Fix kernel doc

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Reviewed-by: Karunika Choo <karunika.choo@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-4-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
9beb8dca9e drm/panthor: Fix panthor_gpu_coherency_set()
GPU_COHERENCY_PROTOCOL takes one of GPU_COHERENCY_xx
not BIT(GPU_COHERENCY_xx).

v3:
- New commit

v4:
- Add Steve's R-b

v5:
- No changes

v6:
- No changes

v7:
- No changes

v8:
- No changes

Cc: Akash Goel <akash.goel@arm.com>
Fixes: dd7db8d911 ("drm/panthor: Explicitly set the coherency mode")
Reported-by: Steven Price <steven.price@arm.com>
Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-3-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Boris Brezillon
925ad0c26d drm/panthor: Provide a custom dma_buf implementation
Before we introduce cached CPU mappings, we want a dma_buf
implementation satisfying synchronization requests around CPU
accesses coming from a dma_buf exported by our driver. Let's
provide our own implementation relying on the default
gem_shmem_prime helpers designed for that purpose.

v5:
- New patch

v6:
- Collect R-b

v7:
- Hand-roll the dma_buf sync/import logic (was previously done by
  generic prime/shmem helpers)

v8:
- No changes

Reviewed-by: Steven Price <steven.price@arm.com>
Link: https://patch.msgid.link/20251208100841.730527-2-boris.brezillon@collabora.com
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
2025-12-09 13:09:36 +01:00
Thaumy Cheng
c418d8b4d7 perf/core: Fix missing read event generation on task exit
For events with inherit_stat enabled, a "read" event will be generated
to collect per task event counts on task exit.

The call chain is as follows:

do_exit
  -> perf_event_exit_task
    -> perf_event_exit_task_context
      -> perf_event_exit_event
        -> perf_remove_from_context
          -> perf_child_detach
            -> sync_child_event
              -> perf_event_read_event

However, the child event context detaches the task too early in
perf_event_exit_task_context, which causes sync_child_event to never
generate the read event in this case, since child_event->ctx->task is
always set to TASK_TOMBSTONE. Fix that by moving context lock section
backward to ensure ctx->task is not set to TASK_TOMBSTONE before
generating the read event.

Because perf_event_free_task calls perf_event_exit_task_context with
exit = false to tear down all child events from the context, and the
task never lived, accessing the task PID can lead to a use-after-free.

To fix that, let sync_child_event read task from argument and move the
call to the only place it should be triggered to avoid the effect of
setting ctx->task to TASK_TOMESTONE, and add a task parameter to
perf_event_exit_event to trigger the sync_child_event properly when
needed.

This bug can be reproduced by running "perf record -s" and attaching to
any program that generates perf events in its child tasks. If we check
the result with "perf report -T", the last line of the report will leave
an empty table like "# PID  TID", which is expected to contain the
per-task event counts by design.

Fixes: ef54c1a476 ("perf: Rework perf_event_exit_event()")
Signed-off-by: Thaumy Cheng <thaumy.love@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: linux-perf-users@vger.kernel.org
Link: https://patch.msgid.link/20251209041600.963586-1-thaumy.love@gmail.com
2025-12-09 12:22:25 +01:00
Sandipan Das
0143928651 perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error
If amd_uncore_event_init() fails, return an error irrespective of the
pmu_version. Setting hwc->config should be safe even if there is an
error so use this opportunity to simplify the code.

Closes: https://lore.kernel.org/all/aTaI0ci3vZ44lmBn@stanley.mountain/

Fixes: d6389d3ccc ("perf/x86/amd/uncore: Refactor uncore management")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/076935e23a70335d33bd6e23308b75ae0ad35ba2.1765268667.git.sandipan.das@amd.com
2025-12-09 12:21:47 +01:00
Richard Fitzgerald
a061deb0b4
ASoC: cs35l56: Fix incorrect select SND_SOC_CS35L56_CAL_SYSFS_COMMON
KConfig SND_SOC_CS35L56_CAL_SET_CTRL must select
SND_SOC_CS35L56_CAL_DEBUGFS_COMMON.

It incorrectly selected SND_SOC_CS35L56_CAL_SYSFS_COMMON.

Fixes: 32172cf3cb ("ASoC: cs35l56: Allow restoring factory calibration through ALSA control")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/T/#u
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://patch.msgid.link/20251209104657.485541-1-rf@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
2025-12-09 19:48:38 +09:00
Russell King (Oracle)
dea20281ac ARM: group is_permission_fault() with is_translation_fault()
Group is_permission_fault() with is_translation_fault(), which is
needed to use is_permission_fault() in __do_kernel_fault(). As
this is static inline, there is no need for this to be under
CONFIG_MMU.

Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2025-12-09 09:19:10 +00:00
Liyuan Pang
edb924a721 ARM: 9464/1: fix input-only operand modification in load_unaligned_zeropad()
In the inline assembly inside load_unaligned_zeropad(), the "addr" is
constrained as input-only operand. The compiler assumes that on exit
from the asm statement these operands contain the same values as they
had before executing the statement, but when kernel page fault happened, the assembly fixup code "bic %2 %2, #0x3" modify the value of "addr", which may lead to an unexpected behavior.

Use a temporary variable "tmp" to handle it, instead of modifying the
input-only operand, just like what arm64's load_unaligned_zeropad()
does.

Fixes: b9a50f7490 ("ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs")
Co-developed-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Liyuan Pang <pangliyuan1@huawei.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2025-12-09 09:18:53 +00:00
Jakub Kicinski
186468c67f Merge branch 'mptcp-misc-fixes-for-v6-19-rc1'
Matthieu Baerts says:

====================
mptcp: misc fixes for v6.19-rc1

Here are various unrelated fixes:

- Patches 1-2: ignore unknown in-kernel PM endpoint flags instead of
  pretending they are supported. A fix for v5.7.

- Patch 3: avoid potential unnecessary rtx timer expiration. A fix for
  v5.15.

- Patch 4: avoid a deadlock on fallback in case of SKB creation failure
  while re-injecting.
====================

Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-0-9e4781a6c1b8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-12-08 23:54:06 -08:00
Paolo Abeni
ffb8c27b05 mptcp: avoid deadlock on fallback while reinjecting
Jakub reported an MPTCP deadlock at fallback time:

 WARNING: possible recursive locking detected
 6.18.0-rc7-virtme #1 Not tainted
 --------------------------------------------
 mptcp_connect/20858 is trying to acquire lock:
 ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_try_fallback+0xd8/0x280

 but task is already holding lock:
 ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0

 other info that might help us debug this:
  Possible unsafe locking scenario:

        CPU0
        ----
   lock(&msk->fallback_lock);
   lock(&msk->fallback_lock);

  *** DEADLOCK ***

  May be due to missing lock nesting notation

 3 locks held by mptcp_connect/20858:
  #0: ff1100001da18290 (sk_lock-AF_INET){+.+.}-{0:0}, at: mptcp_sendmsg+0x114/0x1bc0
  #1: ff1100001db40fd0 (k-sk_lock-AF_INET#2){+.+.}-{0:0}, at: __mptcp_retrans+0x2cb/0xaa0
  #2: ff1100001da18b60 (&msk->fallback_lock){+.-.}-{3:3}, at: __mptcp_retrans+0x352/0xaa0

 stack backtrace:
 CPU: 0 UID: 0 PID: 20858 Comm: mptcp_connect Not tainted 6.18.0-rc7-virtme #1 PREEMPT(full)
 Hardware name: Bochs, BIOS Bochs 01/01/2011
 Call Trace:
  <TASK>
  dump_stack_lvl+0x6f/0xa0
  print_deadlock_bug.cold+0xc0/0xcd
  validate_chain+0x2ff/0x5f0
  __lock_acquire+0x34c/0x740
  lock_acquire.part.0+0xbc/0x260
  _raw_spin_lock_bh+0x38/0x50
  __mptcp_try_fallback+0xd8/0x280
  mptcp_sendmsg_frag+0x16c2/0x3050
  __mptcp_retrans+0x421/0xaa0
  mptcp_release_cb+0x5aa/0xa70
  release_sock+0xab/0x1d0
  mptcp_sendmsg+0xd5b/0x1bc0
  sock_write_iter+0x281/0x4d0
  new_sync_write+0x3c5/0x6f0
  vfs_write+0x65e/0xbb0
  ksys_write+0x17e/0x200
  do_syscall_64+0xbb/0xfd0
  entry_SYSCALL_64_after_hwframe+0x4b/0x53
 RIP: 0033:0x7fa5627cbc5e
 Code: 4d 89 d8 e8 14 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 <c9> c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa
 RSP: 002b:00007fff1fe14700 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
 RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00007fa5627cbc5e
 RDX: 0000000000001f9c RSI: 00007fff1fe16984 RDI: 0000000000000005
 RBP: 00007fff1fe14710 R08: 0000000000000000 R09: 0000000000000000
 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff1fe16920
 R13: 0000000000002000 R14: 0000000000001f9c R15: 0000000000001f9c

The packet scheduler could attempt a reinjection after receiving an
MP_FAIL and before the infinite map has been transmitted, causing a
deadlock since MPTCP needs to do the reinjection atomically from WRT
fallback.

Address the issue explicitly avoiding the reinjection in the critical
scenario. Note that this is the only fallback critical section that
could potentially send packets and hit the double-lock.

Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://netdev-ctrl.bots.linux.dev/logs/vmksft/mptcp-dbg/results/412720/1-mptcp-join-sh/stderr
Fixes: f8a1d9b18c ("mptcp: make fallback action and fallback decision atomic")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251205-net-mptcp-misc-fixes-6-19-rc1-v1-4-9e4781a6c1b8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2025-12-08 23:54:03 -08:00