| Age | Commit message (Collapse) | Author |
|---|
|
memory.numa_stat exposes per-node hugetlb counters from per-node lruvec
stats. These stats are accounted against folio_nid(): incremented on the
folio's node when handed to a user, decremented when the folio is returned
to the pool.
During hugetlb folio migration, mem_cgroup_migrate() moves the charge to
the new folio and drops the memcg data of the old one, so the free of the
old folio right after the migration skips the memcg per-node lruvec
decrement. The hugetlb count stays attributed to the old node for the
rest of the life of the charge, while the target folio gets no increment
on the new node; its later free decrements a counter that was never
incremented.
Migrate the per-node lruvec accounting alongside migration. Global memcg
totals remain balanced because they track resource consumption, not node
placement.
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-2-e8a36245bfab@kylinos.cn
Fixes: 05d4532b60e3 ("memcg/hugetlb: add hugeTLB counters to memcg")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Acked-by: Muchun Song <muchun.song@linux.dev>
Cc: David Hildenbrand <david@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>
|
|
Patch series "mm: fix hugetlb NR_HUGETLB accounting on folio migration", v2.
The hugeTLB counters added by 05d4532b60e3 ("memcg/hugetlb: add hugeTLB
counters to memcg") are maintained in two per-node places:
- the per-node vmstat counter NR_HUGETLB, exposed as nr_hugetlb in
/proc/vmstat;
- the per-node memcg lruvec stat, exposed via memory.numa_stat.
Both are accounted against the folio's node, and both drift when a hugetlb
folio is migrated, though in different ways.
A migration target folio is allocated by alloc_hugetlb_folio_nodemask()
and inherits the old folio's state without ever being accounted, while the
old folio is freed right after and its free is accounted. That alone
loses vmstat accounting: the target node has no matching increment for the
decrement on the old node, so /proc/vmstat's nr_hugetlb shrinks by
nr_pages per migration. Patch 1 accounts the folio where it is obtained,
so the increment pairs with the free in free_huge_folio() on the
successful as well as the failed migration path. The memfd page cache
preallocation helper has the same asymmetry and is fixed in the same
patch.
The per-node lruvec stat breaks differently. mem_cgroup_migrate() moves
the charge to the new folio and drops the old folio's memcg data, so the
old folio's free right after migration skips the memcg per-node decrement;
the count stays attributed to the old node for the rest of the charge's
life, and the target folio never gets an increment on its new node. Patch
2 moves that per-node accounting along with the charge, in
move_hugetlb_state().
This patch (of 2):
The NR_HUGETLB vmstat counter is maintained per folio's node: incremented
when a huge page is handed to a user via hugetlb_alloc_folio() and
decremented when it is returned to the pool via free_huge_folio().
A folio obtained by alloc_hugetlb_folio_nodemask() never goes through
hugetlb_alloc_folio(), so it is never accounted, while its free always is.
For a migration target this means the target node gets no matching
increment for the decrement on the old node, so the global nr_hugetlb in
/proc/vmstat drops by nr_pages for each migration. The same asymmetry
affects the failed migration path, which frees the target again right
away, and the temporary folio hugetlb_mfill_atomic_pte() takes from the
same helper.
alloc_hugetlb_folio_reserve(), used to preallocate the memfd page cache
folios, has the same asymmetry: the folio is handed to a user without
being accounted, while its free is accounted through free_huge_folio().
Account the folio where it is obtained, in alloc_hugetlb_folio_nodemask()
and alloc_hugetlb_folio_reserve(), so that the increment pairs with the
decrement in free_huge_folio(): a successful migration hands the folio to
a user, a failed one frees it again.
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-0-e8a36245bfab@kylinos.cn
Link: https://lore.kernel.org/20260923-for-hugetlb_state3-v2-1-e8a36245bfab@kylinos.cn
Fixes: 05d4532b60e3 ("memcg/hugetlb: add hugeTLB counters to memcg")
Signed-off-by: Hongfu Li <lihongfu@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Reviewed-by: Joshua Hahn <joshua.hahnjy@gmail.com>
Acked-by: Muchun Song <muchun.song@linux.dev>
Acked-by: Oscar Salvador <osalvador@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Nhat Pham <nphamcs@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Roman Gushchin <roman.gushchin@linux.dev>
Cc: Chris Down <chris@chrisdown.name>
Cc: <stable@vger.kernel.org>
|
|
|
|
Ayush reported an issue that shmem/tmpfs folios are still mapped when
truncating them on production:
"
BUG: Bad page cache in process ... pfn:...
page dumped because: still mapped when deleted
"
I reproduced the issue with Ayush's reproducer [1] with the latest mm-unstable
branch, and I got the following crash info. From the dump message, we can
see that truncate_inode_folio() is really trying to remove mapped folios,
which is incorrect.
"
[ 189.171977] page: refcount:3 mapcount:1 mapping:00000000fe168ee1
index:0x3880 pfn:0x191647
[ 189.171995] memcg:ffff0000cc073d40
[ 189.171997] aops:shmem_aops ino:3c01 dentry name(?):"memfd:runsc-memory"
[ 189.172006] flags: 0x17fffef0002022d(locked|referenced|uptodate|lru|
workingset|swapbacked|node=0|zone=2|lastcpupid=0x3ffff)
.......
[ 189.172017] page dumped because: VM_BUG_ON_FOLIO(folio_mapped(folio))
[ 189.172026] ------------[ cut here ]------------
[ 189.172027] kernel BUG at mm/filemap.c:155!
[ 189.172057] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
.......
[ 189.177721] CPU: 3 UID: 0 PID: 5521 Comm: repro Kdump: loaded Tainted:
7.3.0-rc4+ #277 PREEMPT(lazy)
.......
[ 189.183986] Call trace:
[ 189.184124] filemap_unaccount_folio+0xf0/0x1e8 (P)
[ 189.184391] __filemap_remove_folio+0x34/0x160
[ 189.184633] filemap_remove_folio+0x4c/0xb0
[ 189.184859] truncate_inode_folio+0x34/0x58
[ 189.185087] shmem_undo_range+0x220/0x658
[ 189.185308] shmem_fallocate+0x2f0/0x470
[ 189.185527] vfs_fallocate+0x128/0x328
......
[ 189.187078] el0t_64_sync+0x184/0x188
"
After analysis, I believe the race exists between truncation and
MADV_DONTNEED, and shmem's ->map_pages() merely makes the issue easier to
reproduce. Since MADV_DONTNEED synchronously releases the pagetable page
before calling tlb_flush_rmaps(), this could cause another thread's
truncation to skip zap_pte_range() (due to pmd is none) but still observe
the folio's mapcount as non-zero. A possible race scenario is as follows:
CPU 0 CPU 1
shmem_fallocate madvise_dontneed_single_vma
unmap_mapping_range .......
......
(filemap_map_pages() remap folios)
zap_pte_range
truncate_inode_folio zap_empty_pte_table(pmd clear)
unmap_mapping_folio
......
zap_pmd_range (saw pmd none, skip)
filemap_remove_folio
BUG_ON(folio_mapped)
tlb_flush_rmaps(remove rmaps)
To fix this issue, we should move the pmd clear operation (via
zap_empty_pte_table()) to after tlb_flush_rmaps() and add
smp_wmb()/smp_rmb() memory barriers, so that when we find a pmd_none()
while unmapping a folio without holding the PTL, the folio's mappings are
guaranteed to have been removed via tlb_flush_rmaps().
Link: https://lore.kernel.org/542c97482eae84f86704bcee56482633d1b32321.1791616645.git.baolin.wang@linux.alibaba.com
Link: https://lore.kernel.org/all/20260925065013.3682431-1-ayushr@modal.com/ [1]
Fixes: 6375e95f381e ("mm: pgtable: reclaim empty PTE page in madvise(MADV_DONTNEED)")
Signed-off-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Ayush Ranjan <ayushr@modal.com>
Closes: https://lore.kernel.org/all/20260924061708.1645968-1-ayushr@modal.com/
Reviewed-by: Pedro Falcato <pfalcato@suse.de>
Cc: David Hildenbrand <david@kernel.org>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Qi Zheng <qi.zheng@linux.dev>
Cc: Jan Kara <jack@suse.cz>
|
|
After a recent change in clang to warn on signed char conversions within
array initializers [1], there are several instances of this warning from
base64_rev_maps in lib/base64.c, which can break the build with W=e or
CONFIG_WERROR=y:
lib/base64.c:58:18: error: implicit conversion from 'int' to 's8' (aka 'signed char') changes value from 131 to -125 [-Werror,-Wconstant-conversion]
58 | [BASE64_IMAP] = BASE64_REV_INIT('+', ',')
| ^~~~~~~~~~~~~~~~~~~~~~~~~
lib/base64.c:52:2: note: expanded from macro 'BASE64_REV_INIT'
48 | #define BASE64_REV_INIT(ch_62, ch_63) { \
| ~
49 | [0 ... 0x1f] = -1, \
50 | INIT_32(0x20, ch_62, ch_63), \
51 | INIT_32(0x40, ch_62, ch_63), \
52 | INIT_32(0x60, ch_62, ch_63), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
...
lib/base64.c:34:42: note: expanded from macro 'INIT_1'
34 | : (v) >= '0' && (v) <= '9' ? (v) - '0' + 52 \
| ~~~~~~~~~~^~~~
lib/base64.c:58:18: error: implicit conversion from 'int' to 's8' (aka 'signed char') changes value from 130 to -126 [-Werror,-Wconstant-conversion]
58 | [BASE64_IMAP] = BASE64_REV_INIT('+', ',')
| ^~~~~~~~~~~~~~~~~~~~~~~~~
lib/base64.c:52:2: note: expanded from macro 'BASE64_REV_INIT'
48 | #define BASE64_REV_INIT(ch_62, ch_63) { \
| ~
49 | [0 ... 0x1f] = -1, \
50 | INIT_32(0x20, ch_62, ch_63), \
51 | INIT_32(0x40, ch_62, ch_63), \
52 | INIT_32(0x60, ch_62, ch_63), \
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~
...
lib/base64.c:34:42: note: expanded from macro 'INIT_1'
34 | : (v) >= '0' && (v) <= '9' ? (v) - '0' + 52 \
| ~~~~~~~~~~^~~~
...
These are false positives, as the branch where the wraparound could happen
is unreachable with the values that clang reports. This is not considered
a bug by some clang folks [2][3], so silence the warnings using the __diag
macros the kernel has to workaround compiler warnings when necessary.
Link: https://lore.kernel.org/20261008-base64-silence-clang-24-constant-conversion-v1-1-0858b60b23c8@kernel.org
Link: https://github.com/llvm/llvm-project/commit/a5ef934a8d295dc03be3960f2b3744ec2e53238e [1]
Link: https://github.com/llvm/llvm-project/issues/223923#issuecomment-6056856245 [2]
Link: https://github.com/llvm/llvm-project/pull/226775#pullrequestreview-5454407389 [3]
Fixes: c4eb7ad32eab ("lib/base64: optimize base64_decode() with reverse lookup tables")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2181
Acked-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Bill Wendling <morbo@google.com>
Cc: Justin Stitt <justinstitt@google.com>
Cc: Guan-Chun Wu <409411716@gms.tku.edu.tw>
Cc: <stable@vger.kernel.org>
|
|
collapse_file() can fail its reference-count or dirty-folio check after
unmapping with TTU_BATCH_FLUSH. Both paths put back the isolated folio,
then unlock it and drop the lookup reference before reaching the common
try_to_unmap_flush().
The page-cache reference does not keep the folio stable once the lock is
released. Another collapse can replace and free it. With its PTEs
already gone, that collapse cannot flush the first task's per-task TLB
batch, and retract_page_tables() skips short or unaligned VMAs. A CPU can
therefore retain a user translation to the freed folio. This has been
reproduced with unprivileged MADV_COLLAPSE on a memfd.
Flush at out_unlock while the lookup reference and folio lock are still
held. The common flush continues to cover the accumulated pagelist on
both success and rollback, preserving batching on successful collapses.
Link: https://lore.kernel.org/20261007041001.43181-1-kylebot@openai.com
Fixes: 6d9df8a5889c ("mm/thp: collapse_file() do try_to_unmap(TTU_BATCH_FLUSH)")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Acked-by: Hugh Dickins <hughd@google.com>
Assisted-by: LLM
Cc: Barry Song <baohua@kernel.org>
Cc: Dev Jain <dev.jain@arm.com>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: Lance Yang <lance.yang@linux.dev>
Cc: "Liam R. Howlett" <liam@infradead.org>
Cc: Nico Pache <nico.pache@linux.dev>
Cc: Ryan Roberts <ryan.roberts@arm.com>
Cc: Usama Arif <usama.arif@linux.dev>
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: <stable@vger.kernel.org>
|
|
Patch series "userfaultfd: clear the inherited uffd bit in
move_swap_pte()", v4.
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never registered
for either, and nothing clears it afterwards. Patch 1 clears the bit,
then re-arms it if the destination is RWP-registered, which is what the
present-page and zeropage move paths already do. Patch 2 adds the tests
that catch it.
This patch (of 2):
UFFDIO_MOVE on a swapped-out page installs the source PTE at the
destination unchanged, so a uffd bit set on a write-protected or
RWP-protected source lands in a destination VMA that was never
registered for either. Nothing clears it there, and userspace sees:
- /proc/<pid>/pagemap reports the page as uffd-tracked (bit 57), both
while it is swapped out and after it is faulted back in.
- MADV_COLLAPSE fails with EINVAL on a range containing it, because the
collapse scan bails on a swap entry with the uffd bit set.
- With CONFIG_PAGE_TABLE_CHECK, faulting the page in warns.
do_swap_page() carries the bit into the present PTE and, since the
destination isn't WP-registered, also makes it writable:
WARNING: mm/page_table_check.c:202 at __page_table_check_ptes_set+0x185/0x1e0
Call Trace:
set_ptes+0x67/0xc0
do_swap_page+0x990/0xfe0
__handle_mm_fault+0x7d0/0xeb0
handle_mm_fault+0x9c/0x250
do_user_addr_fault+0x207/0x650
exc_page_fault+0x65/0x150
asm_exc_page_fault+0x26/0x30
Reaching it takes UFFDIO_MOVE out of a WP- or RWP-protected area into
one that isn't, on a page that is swapped out at the time. It hasn't
been seen in practice.
A resident page doesn't carry the bit, because move_present_ptes() builds
the destination PTE from dst_vma->vm_page_prot. Clear it on the moved
swap entry as well, then re-arm it if the destination is RWP-registered.
The WP case has been there since v6.8, where UFFDIO_MOVE was added.
Link: https://lore.kernel.org/20261003103030.63380-1-donggeunyoo.kernel@gmail.com
Link: https://lore.kernel.org/20261003103030.63380-2-donggeunyoo.kernel@gmail.com
Fixes: adef440691ba ("userfaultfd: UFFDIO_MOVE uABI")
Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: David Hildenbrand (Arm) <david@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Assisted-by: LLM
Cc: Peter Xu <peterx@redhat.com>
Cc: Suren Baghdasaryan <surenb@google.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Lorenzo Stoakes <ljs@kernel.org>
Cc: Liam R. Howlett <liam@infradead.org>
Cc: Vlastimil Babka <vbabka@kernel.org>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Kiryl Shutsemau <kas@kernel.org>
Cc: <stable@vger.kernel.org>
|
|
assoc_array_delete() can collapse a subtree into a node that contains only
leaves while retaining the shortcut that led to it. If that node later
fills, all_leaves_cluster_together replaces it with another shortcut. The
first shortcut then points directly to the second one.
assoc_array_apply_edit() publishes this topology and propagates branch
counts from the new child node. It skips the inner shortcut, encounters
the outer shortcut where it requires a node and triggers the BUG_ON().
Linux v7.2 and v6.12.105 are affected. The same root remains at the
base-commit below and in every supported stable branch checked down to
5.10. It requires CONFIG_KEYS, but no capability, user namespace or race.
A UID/GID 1000 process produced:
CONTROL_BEGIN mode=exact uid=1000 gid=1000
CONTROL_CapEff: 0000000000000000
kernel BUG at lib/assoc_array.c:1388!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
CPU: 0 UID: 1000 PID: 154 Comm: exploit
RIP: assoc_array_apply_edit+0x4aa/0x690
Call Trace:
__key_link
__key_instantiate_and_link
__key_create_or_update
__do_sys_add_key
Kernel panic - not syncing: Fatal exception
When deletion produces a leaf-only node, bypass its preceding shortcut as
garbage collection already does. Retire the shortcut and old node
together after an RCU grace period; reused leaves keep their references
and the deleted leaf is still freed separately.
The exact trigger reached the BUG in 3/3 unmodified v7.2 KASAN boots and
completed cleanly in 3/3 fixed boots. Fixed v6.12.105 also passed 3/3. A
source reproducer is available privately on request.
Link: https://lore.kernel.org/20260925080548.2505640-1-4ncienth@gmail.com
Fixes: 3cb989501c26 ("Add a generic associative array implementation.")
Signed-off-by: Daehyeon Ko <4ncienth@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Assisted-by: LLM
Cc: David Howells <dhowells@redhat.com>
Cc: <stable@vger.kernel.org>
|
|
A bug in the XArray iterator xas_find() causes the iterator's index
(xas->xa_index) to jump backwards when iterating over a multi-index entry
(like a THP) that resides in a non-leaf node and is concurrently split.
When iterating over a multi-index entry in a non-leaf node, xas_load()
sets xas->xa_offset to the base offset of the entry, but leaves
xas->xa_index at the requested index. When the caller subsequently wants
to advance to the next entry, xas_find() is called. xas_find() attempts
to synchronize xas->xa_offset with xas->xa_index before advancing.
However, the fixup logic was incorrectly restricted to leaf nodes
(!xas->xa_node->shift). Because the THP resides in a non-leaf node, the
fixup is skipped.
As a result, xas_find() simply increments xas->xa_offset and recalculates
xas->xa_index based on this new offset. This causes xas->xa_index to jump
backwards. If the THP was concurrently split, the entry at the new offset
is a node pointer, so xas_find() descends into it and returns the folio at
the backwards index. The caller (filemap_map_pages()) then calculates the
PTE pointer based on this backwards index, resulting in an invalid memory
access such as an out-of-bounds read or use-after-free on a page-table
page freed via tlb_remove_table_rcu().
A userspace access that faults in a file-backed mapping can trigger this
path. When the index moves backwards, filemap_map_pages() can calculate a
PTE outside the page locked for fault-around and dereference a freed
page-table page, resulting in a KASAN-detected use-after-free read.
To fix this, check if xas->xa_offset matches get_offset(xas->xa_index,
xas->xa_node). If it does not and the node is a non-leaf node, set
xas->xa_offset to get_offset(xas->xa_index, xas->xa_node) before
advancing. Also add test cases in test_xarray to verify xas_find()
behavior when iterating over and splitting multi-index entries.
Link: https://lore.kernel.org/20260904121301.200049-1-krystianmkaniewski@gmail.com
Fixes: b803b42823d0 ("xarray: Add XArray iterators")
Reported-by: syzbot+b72767277f29b6407083@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b72767277f29b6407083
Closes: https://syzkaller.appspot.com/ai_job?id=a01c56bd-74d0-411c-afb4-ee6f0cb6cb61
Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Assisted-by: Gemini:gemini-3.7-flash syzbot
Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
Cc: Mike Rapoport <rppt@kernel.org>
Cc: <stable@vger.kernel.org>
|
|
free_vmap_area_noflush() queues drain_vmap_work after the number of lazily
freed pages exceeds lazy_max_pages(). Until the worker purges those
pages, concurrent frees keep calling schedule_work(). Even if the work is
already pending, queue_work_on() performs a locked test_and_set_bit() on
the pending bit in the work item.
On the tested x86-64 build, drain_vmap_work and vmap_nodes occupy the same
64-byte cache line. The work item starts at offset 0 and the vmap_nodes
pointer at offset 32. The latter is read by vmap allocation and free
paths, so updates to the work item invalidate a cache line read by all
CPUs.
Put drain_vmap_work in the cacheline-aligned data section. Tests were run
on Linux 7.2.
On a two-socket Intel Xeon Silver 4208 system using 16 workers, the
runtimes of vmalloc.fix_align, vmalloc.fix_size, and
vmalloc.no_block_alloc decreased by 12.61%, 5.78%, and 6.87%,
respectively. HITM samples for the affected cache line and total HITM
samples decreased by 96.55% and 13.36%, respectively.
Link: https://lore.kernel.org/20260825104659.100134-1-jonaszhou-oc@zhaoxin.com
Signed-off-by: JonasZhou <jonaszhou-oc@zhaoxin.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Cc: <jianhuizzzzz@gmail.com>
|
|
drain_vmap_area_work() function can take >10ms to complete when there are
many accumulated vmap areas in a system with high CPU count, causing
workqueue watchdog warnings when run via schedule_work():
workqueue: drain_vmap_area_work hogged CPU for >10000us
Move the top-level drain work to a dedicated WQ_UNBOUND workqueue so the
scheduler can run this background work on any available CPU, improving
responsiveness. Use the WQ_MEM_RECLAIM to ensure forward progress under
memory pressure.
Move purge helpers to separate WQ_UNBOUND | WQ_MEM_RECLAIM workqueue.
This allows drain_vmap_work to wait for helpers completion without
creating dependency on the same rescuer thread and avoid a potential
parent/child deadlock.
Simplify purge helper scheduling by removing cpumask-based iteration to
iterating directly over vmap nodes checking work_queued state.
Link: https://lore.kernel.org/20260905152717.11711-1-urezki@gmail.com
Fixes: 72210662c5a2 ("mm: vmalloc: offload free_vmap_area_lock lock")
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reported-by: Li RongQing <lirongqing@baidu.com>
Closes: https://lore.kernel.org/all/20260319074307.2325-1-lirongqing@baidu.com/
Reviewed-by: Baoquan He <bhe@redhat.com>
Reviewed-by: Ye Liu <liuye@kylinos.cn>
Cc: Dev Jain <dev.jain@arm.com>
Cc: <stable@vger.kernel.org>
|
|
Failed hugetlbfs page allocations can permanently consume the mount's
size= quota without allocating a huge page. Repeated failures can make
the filesystem appear full and cause later huge-page faults or allocations
to fail with SIGBUS/allocation failure despite available huge pages and
unused real filesystem capacity.
alloc_hugetlb_folio() calls hugepage_subpool_get_pages() when map_chg is
set. For a subpool with max_hpages != -1, that bumps used_hpages
regardless of whether it returns gbl_chg = 0 (rsv slot consumed) or
gbl_chg > 0 (used_hpages slot only). If the allocation later fails before
a folio is returned, the unwind must undo the used_hpages bump. The old
cleanup only ran for !gbl_chg, leaking used_hpages on the gbl_chg > 0
path.
For gbl_chg > 0 on max-only subpools (max_hpages != -1, min_hpages == -1),
hugepage_subpool_get_pages() took only a speculative used_hpages slot.
Drop that slot directly under spool->lock. In that configuration
hugepage_subpool_put_pages() cannot restore rsv_hpages, so the direct
decrement is the exact inverse and is race-free against concurrent puts.
This matches the used_hpages-only part of hugetlb_reserve_pages()'s
out_put_pages cleanup, but restricts it to the max-only case where no
rsv_hpages restoration is possible.
Mounts with min_hpages != -1 are left unchanged for now. v2's approach
(hugepage_subpool_put_pages() + h->resv_huge_pages++ to back a restored
rsv_hpages slot) double-counts global backing under concurrent
free_huge_folio() and creates phantom reservations under concurrent
hugetlb_unreserve_pages(). Safe cleanup of that quadrant needs a
coordinated fix across multiple call sites.
Reproduced on size=20M hugetlbfs with the faulting task in a hugetlb
cgroup whose limit is exceeded. Vanilla leaks 6/8 hugepages of subpool
quota; this patch leaks 0/8. Verified under QEMU.
Link: https://lore.kernel.org/20260428113037.88766-2-enderaoelyther@gmail.com
Fixes: a833a693a490 ("mm: hugetlb: fix incorrect fallback for subpool")
Signed-off-by: Zhao Li <enderaoelyther@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Tested-by: Ackerley Tng <ackerleytng@google.com>
Tested-by: Karl Mehltretter <kmehltretter@gmail.com>
Link: https://lore.kernel.org/20260923065714.20781-1-kmehltretter@gmail.com
Cc: David Hildenbrand <david@kernel.org>
Cc: Ma Wupeng <mawupeng1@huawei.com>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: <stable@vger.kernel.org> # v6.15+
|
|
virtgpu_freeze() waits for the control and cursor queues to drain and
then deletes the virtqueues, but nothing tells the device to stop first.
del_vqs() frees the vring backing, but does not provide a generic device
quiesce operation. In particular, modern virtio-pci keeps enabled queues
active until the device is reset, so the device is left DRIVER_OK with
its queues pointing at memory that has been freed and may be reused while
the guest is suspended. virtio_device_restore() only resets the device
later, on resume.
Reset the device before deleting the virtqueues, the way
virtio_gpu_deinit() already does on removal.
Fixes: cad6a879a7fb ("drm/virtio: Freeze and restore hooks to support suspend and resume")
Cc: stable@vger.kernel.org
Signed-off-by: Yuho Choi <oss.patchbox@gmail.com>
Signed-off-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Link: https://patch.msgid.link/20260926202040.1313385-1-oss.patchbox@gmail.com
|
|
The receive completion handlers smbdirect_connection_recv_io_done(),
smbdirect_accept_negotiate_recv_done() and
smbdirect_connect_negotiate_recv_done() verify that the completion is a
regular receive with WARN_ON_ONCE(wc->opcode != IB_WC_RECV).
But wc->opcode is controlled by the remote peer: a posted receive work
request is consumed not only by an incoming SEND, but also by an RDMA
Write with Immediate, which completes as IB_WC_RECV_RDMA_WITH_IMM. An
unauthenticated peer can transmit such a message, even before the
negotiate completes, so it reaches the accept/connect negotiate
handlers as well. With panic_on_warn set this is a remote denial of
service, and otherwise it still taints the kernel and spams the log for
something a peer can trigger at will.
The opcode check itself was inherited from the original client and
server recv_done() handlers (fs/smb/client/smbdirect.c and
fs/smb/server/transport_rdma.c), where an unexpected opcode was simply
logged and the connection was torn down. Only the WARN_ON_ONCE() was
added on top during the socketization rework. Drop the WARN_ON_ONCE()
and keep the existing graceful error path, which logs the unexpected
opcode (unless the status is IB_WC_WR_FLUSH_ERR) and tears the
connection down.
Fixes: ea4151222a93 ("smb: smbdirect: introduce smbdirect_connection_recv_io_done()")
Fixes: eb3ed1e9048c ("smb: smbdirect: introduce smbdirect_accept_connect_request()")
Fixes: d1f187656797 ("smb: smbdirect: introduce smbdirect_connect[_sync]()")
Reported-by: Sashiko <sashiko-bot+sashiko@kernel.org>
Closes: https://sashiko.dev/#/bug/linux-5341a0c0-7b00-4eef-915c-91e099649d3e
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
smbdirect_socket_accept()
A socket on the ready list is in SMBDIRECT_SOCKET_NEGOTIATE_RUNNING,
but it may fail before smbdirect_socket_accept() picks it up, e.g.
RDMA_CM_EVENT_DISCONNECTED already moved it to
SMBDIRECT_SOCKET_DISCONNECTED.
smbdirect_socket_accept() unconditionally overwrote the status with
SMBDIRECT_SOCKET_CONNECTED and handed out the already disconnected
socket. smbdirect_socket_cleanup_work() then called rdma_disconnect()
on it again, and before the recent commit
smbdirect_socket_destroy_sync() waited forever for an
RDMA_CM_EVENT_DISCONNECTED that already happened.
Now we check first_error and change the status to
SMBDIRECT_SOCKET_CONNECTED only via cmpxchg() from
SMBDIRECT_SOCKET_NEGOTIATE_RUNNING, while we still hold listen.lock.
If the socket already failed, we move it to the orphaned list and
queue purge_orphaned_work, like smbdirect_listen_orphan_socket() does,
and try the next one. If we only found failed sockets, we wait for
the next one.
Fixes: dc691b91ad16 ("smb: smbdirect: introduce smbdirect_socket_{listen,accept}()")
Reported-by: Sashiko <sashiko-bot+sashiko@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1791224972.git.metze%40samba.org
Closes: https://sashiko.dev/#/bug/linux-f9dbca09-30a7-4145-9bdb-4676759982c8
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
A child of a listener only left the listen.pending or listen.ready
list via smbdirect_socket_accept() or when the listener was
destroyed. So every connection that failed before it was accepted
(negotiate timeout, peer disconnect, invalid negotiate request, ...)
stayed on the list and counted against the backlog until the listener
was destroyed. After about backlog (10 for ksmbd) such connections
smbdirect_listen_connect_request() rejected every new connection with
-EBUSY, so an unauthenticated peer was able to permanently stop
ksmbd from accepting SMB-Direct connections.
Now a failed child moves itself to a new listen.orphaned list at the
end of smbdirect_socket_cleanup_work(), after the disconnect was
started, and queues listen.purge_orphaned_work, which releases it
with smbdirect_socket_release(), without holding the listener's
rdma_lock_handler() lock, in the same way smbdirect_socket_destroy()
does for the remaining children. Orphaned sockets still count against
the backlog until they are released.
sc->accept.listener is now only changed under listener->listen.lock
and whoever clears it is responsible for releasing the socket:
smbdirect_socket_accept(), purge_orphaned_work or the destroy of the
listener.
In order to make that work:
- a struct smbdirect_socket that is a listener is now freed via
kfree_rcu(), so that a child can dereference sc->accept.listener
under rcu_read_lock(), even if the listener is released concurrently.
- smbdirect_listen_connect_request() adds nsc to the listen.pending
list and sets nsc->accept.listener before it calls
smbdirect_accept_connect_request(), and always returns 0 so the
rdma_cm core keeps the connection id and nsc owns it. On a non-zero
return it schedules nsc's teardown with
smbdirect_socket_schedule_cleanup(), which orphans it off the
listener so that purge_orphaned_work releases it; nsc destroys its
own connection id with rdma_destroy_id() in that teardown. The
teardown has to be deferred because the rdma_cm core holds nsc's
id_priv->handler_mutex across the handler, so nsc->rdma.cm_id must
not be destroyed synchronously from here. That same handler_mutex
(and the listener's) also guarantees nsc can't go away under us,
so setting the listener before the call is safe and lets a failure
orphan nsc.
- smbdirect_accept_negotiate_recv_work() no longer moves a socket to
the ready list if it already failed or no longer belongs to the
listener. Every accepting socket has a listener, so if
sc->accept.listener is already cleared, it no longer sends a
negotiate response, as the socket is about to be released.
- smbdirect_socket_destroy() of the listener disables
purge_orphaned_work and also releases the orphaned sockets.
Fixes: dc691b91ad16 ("smb: smbdirect: introduce smbdirect_socket_{listen,accept}()")
Reported-by: Lee Seong Hyeon <ihopenre@gmail.com>
Closes: https://lore.kernel.org/linux-cifs/CANTrAmxL5sWU8Sn29JAGZvSq5PBB2OA+VKA0MHsZJMesagtfzA@mail.gmail.com/
Reported-by: Sashiko <sashiko-bot+sashiko@kernel.org>
Closes: https://sashiko.dev/#/patchset/cover.1791224972.git.metze%40samba.org
Closes: https://sashiko.dev/#/patchset/cover.1791229120.git.metze%40samba.org
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
smbdirect_socket_destroy_sync()
smbdirect_socket_destroy_sync() waited for RDMA_CM_EVENT_DISCONNECTED
after smbdirect_socket_cleanup_work() called rdma_disconnect(). That
can take very long, e.g. if the peer just disappeared, until the
rdma cm gives up, or forever if the event already happened, but the
status was overwritten afterwards.
This is not needed: smbdirect_socket_destroy() drains the qp under
rdma_lock_handler(), destroys it and calls rdma_destroy_id(), which
only waits for a currently running event handler and makes sure no
further events are delivered. The rest of the disconnect protocol
(DREQ/DREP and timewait for IB, abrupt close for iWarp) is handled
by the rdma core asynchronously. drivers/nvme/host/rdma.c also just
calls rdma_disconnect() and ib_drain_qp() before rdma_destroy_id().
So smbdirect_socket_destroy() now also accepts
SMBDIRECT_SOCKET_DISCONNECTING and changes the status to
SMBDIRECT_SOCKET_DISCONNECTED itself under rdma_lock_handler().
We could still get RDMA_CM_EVENT_DISCONNECTED in the small
windows between rdma_unlock_handler() and rdma_destroy_id(),
but in that case smbdirect_connection_rdma_event_handler()
is basically a no-op.
Fixes: 422a2436697d ("smb: smbdirect: introduce smbdirect_socket_destroy[_sync]()")
Cc: Namjae Jeon <linkinjeon@kernel.org>
Cc: Paulo Alcantara <pc@manguebit.org>
Cc: Tom Talpey <tom@talpey.com>
Cc: linux-cifs@vger.kernel.org
Cc: samba-technical@lists.samba.org
Cc: linux-rdma@vger.kernel.org
Assisted-by: Claude:claude-opus-5-5
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
A write-only client can open an existing named stream with FILE_OPEN_IF
without permission to read the underlying file. The case-insensitive
lookup finds the xattr name, but querying its value length then fails
with -EACCES. smb2_set_stream_name_xattr() treats every negative result
as a missing stream and replaces the existing xattr with an empty value.
A failed xattr list is not proof that the stream is absent either:
for example, -ENOMEM can lead to the same empty replacement. Preserve
listing errors and create a stream only for -ENOENT or -ENODATA. The
latter can occur if the xattr is removed between listing its name and
querying its value. Return other lookup errors without changing the
stream.
A write-only FILE_OPEN now reports access denied instead of name not
found. FILE_OVERWRITE_IF and FILE_SUPERSEDE on an unreadable stream
also fail instead of appearing to replace it. Stream writes and EOF
changes already need to read the old value, so such handles cannot
update the stream after opening either.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
SMB stream names are case-insensitive, but ksmbd stores each named
stream in an xattr whose name is case-sensitive. Opening an existing
stream finds its xattr with a case-insensitive match, yet the handle
keeps the name as the client spelled it, and every later operation that
needs an exact name uses that spelling:
- a WRITE or an end-of-file change creates a second xattr, so a stream
created as "Foo" and written through "foo" ends up stored twice, and
which value a later lookup returns depends on xattr list order;
- delete-on-close and delete-pending removal can fail with -ENODATA,
or remove only a case-variant copy and leave the original;
- the share mode check compares stream names with strcmp(), so two
opens of the same stream that differ only in case do not conflict.
Have ksmbd_vfs_casexattr_len() copy the matching xattr's name into the
handle when the stream is opened, so later operations use the name
already on disk. The match must have the same length as the name it
replaces; the stream lookup passes a length that includes the
terminating NUL, which already guarantees that, and the check makes the
copy safe for any caller. A stream that does not exist yet keeps the
client's spelling, as before.
smb2_rename() compares and looks up fp->stream.name case-insensitively,
so it behaves the same with either spelling.
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
A READ on a non-empty named stream at or beyond its end fails with
STATUS_INVALID_PARAMETER. ksmbd_vfs_stream_read() returns -EINVAL when
the offset is not below the stream length, and smb2_read() maps -EINVAL
to that status.
smb2_read() already turns a zero-byte read into STATUS_END_OF_FILE, the
status a regular file returns at its end, and an empty stream already
takes that path. Return 0 instead of -EINVAL so that non-empty streams
do the same. Clients that read a stream until end of file otherwise get
an error once they have read all of its data.
The buffered copychunk path converts a zero-byte source read to -EIO,
as it does for a regular file that shrinks during copying.
Fixes: 2ae1a6cc4302 ("cifsd: fix potential read overflow in ksmbd_vfs_stream_read()")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
AppInstanceId lookup currently selects the first open with the matching
identifier. CREATE for an unrelated share or path can therefore
force-close another session's open before authorization of the new
target. Matching only the base path also conflates alternate data streams
with the unnamed stream.
MS-SMB2 requires the old open to match the share and path, belong to a
different ClientGuid, and be closed only when the requester has
GENERIC_READ access. Search all opens with the ID and match share,
resolved path, stream, and the current connection's client GUID. Retain a
share configuration reference in ksmbd_file and reuse its name instead of
allocating a name for every open. This keeps matching safe during tree
connection teardown and preserves name-based matching across configuration
updates.
Refresh the share reference on durable reconnect and restore the old
reference if reopening fails. Serialize connection and share comparisons
with durable disconnect/reconnect, and recheck the target before closing
it. Keep the original ClientGuid for durable replay and lease checks.
Check AppInstanceVersion before querying access, even when GENERIC_READ
is absent, and before disconnected delete-on-close cleanup. Rejected
CREATE must leave other durable opens untouched. Calculate maximal access
on the matched open's referenced path so a rename cannot substitute another
file's authorization. Require read access with the effective VFS
credentials as well as the NT DACL before takeover. Access denial only
skips takeover and leaves CREATE to its normal access checks. Restore
filesystem credentials before returning a takeover error.
Handle takeover before checking FILE_CREATE collisions, and re-resolve
the path after closing the old open. This lets delete-on-close remove the
old file before a new one is created. Include SYNCHRONIZE in the baseline
maximal-access mask so read-only files report GENERIC_READ correctly.
Fixes: 16c30649709d ("ksmbd: handle durable v2 app instance id")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Sung Byeongchan <tjdqudcks0424@naver.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
An SMB WRITE to an existing named stream can silently discard data after
its written range. ksmbd stores streams as xattr values, but the write
path passes offset + count as the length of the replacement xattr even
when the old stream is longer. Writing 26 bytes at offset 0 to a 60-byte
stream reports 26 bytes written while discarding the remaining 34 bytes.
Keep the existing xattr length when an in-place write ends before EOF.
Reject writes that cross XATTR_SIZE_MAX rather than storing only the
portion that fits while reporting the full requested count.
Commit 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
intentionally skipped ordinary inode truncation for stream handles: an
EOF SetInfo on an ADS had truncated the base file. That fixed the base
file corruption but left stream EOF changes reporting success without
resizing the stream. Handle these requests by resizing only the stream
xattr; the base file size remains untouched. Zero-fill stream extensions.
This is needed alongside the write fix: a short write's accidental
truncation previously masked an ignored explicit EOF change. The stream
resize helper returns xattr errors directly rather than using the
base-file truncate path's EBADF conversion.
Fixes: f44158485826 ("cifsd: add file operations")
Fixes: 4ea0bb8aaedf ("ksmbd: handle set/get info file for streamed file")
Cc: stable@vger.kernel.org
Signed-off-by: DaeMyung Kang <charsyam@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
ksmbd_build_ntlmssp_challenge_blob() only advertises extended session
security when conn->use_spnego is true. As a result, raw NTLMSSP
negotiation drops NTLMSSP_NEGOTIATE_EXTENDED_SEC from the challenge even
when the client requested it.
A Windows capture shows an initial SPNEGO authentication succeeding,
followed by a raw NTLMSSP negotiation on the same TCP connection. The raw
challenge omits extended session security, and the client does not send
an AUTHENTICATE message. The unfinished session then occupies the pending
session slot, causing subsequent SESSION_SETUP requests to fail with
STATUS_INSUFFICIENT_RESOURCES.
Set NTLMSSP_NEGOTIATE_EXTENDED_SEC whenever the client requests it,
independently of the SPNEGO wrapper, as required by [MS-NLMP].
Fixes: e2f34481b24d ("cifsd: add server-side procedures for SMB3")
Cc: stable@vger.kernel.org
Reported-by: Tea La Forgia <tealaforgia+alias@gmail.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
|
|
'arm64-fixes-for-7.3', 'arm64-for-7.4', 'clk-fixes-for-7.3', 'clk-for-7.4', 'drivers-fixes-for-7.3' and 'drivers-for-7.4' into for-next
|
|
Newer SoC like hawi with RSC version v4.5 support 4 byte message read
request instead of default 8 byte on older SoCs. The write request
continues to be 8 bytes.
The CMD_MSGID_LEN field is [3:0] bits. Describe the length bits as a
GENMASK() and use FIELD_PREP() when programming 4-byte or 8-byte message
length.
Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> #Hawi
Signed-off-by: Maulik Shah <maulik.shah@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>
Link: https://patch.msgid.link/20261007-rsc_read-v3-1-7501c014fb37@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
|
|
ACPI allow to use relative path in resources, pass the device handle
to acpi_get_gpiod() to allow resolving such path.
Signed-off-by: Alban Bedel <alban.bedel@lht.dlh.de>
Acked-by: Mika Westerberg <westeri@kernel.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
|
|
- Skip Target Speed quirk on clamped ports with no link (Maciej W. Rozycki)
- Disable MSI for ULi M1575 EHCI controller (Imre Kaloz)
* pci/misc:
PCI: Disable MSI for ULi M1575 EHCI controller
PCI: Skip Target Speed quirk on clamped ports with no link
|
|
- Add DT and driver support for optional PERST# for use in warm reset
scenarios (Sai Krishna Musham)
* pci/controller/xilinx-cpm:
PCI: xilinx-cpm: Add support for PCIe RP PERST# signal
dt-bindings: PCI: xilinx-versal-cpm: Add PERST# and reset support
|
|
- Use devm for clocks so they're automatically disabled, unprepared, and
released if errors happen during probe (Yuho Choi)
* pci/controller/xgene:
PCI: xgene: Use managed clock for PCIe controller
|
|
- Flush DMA writes before handling MSI on Meteor Lake: MSI may arrive
before write has completed, resulting in an nvme 30 second stall before a
QID timeout and possibly other similar problems (Rickey Bartlett)
- Flush DMA writes before handling MSI on Arrow Lake (Vladimir Nedoshivin)
* pci/controller/vmd:
PCI: vmd: Flush DMA writes before handling MSI on Arrow Lake
PCI: vmd: Flush DMA writes before handling MSI on Meteor Lake
|
|
- Fix the Link Capabilities offset so we read the correct register (Bjorn
Helgaas)
* pci/controller/tegra264:
PCI: tegra264: Fix Link Capabilities register offset
|
|
- Convert Tegra20 to json-schema (Thierry Reding)
* pci/controller/tegra:
dt-bindings: PCI: tegra: Convert to json-schema
|
|
- Disable refclk on probe failure (Lad Prabhakar)
- Propagate platform_get_irq_byname() errors so probe deferral works
correctly (Lad Prabhakar)
- Tear down INTx handlers if subsequent initialization fails (Lad
Prabhakar)
- Add RZ/G3L (R9A08G046) DT and driver support (Biju Das)
* pci/controller/rzg3s-host:
PCI: rzg3s-host: Add support for RZ/G3L SoC
dt-bindings: PCI: renesas,r9a08g045s33-pcie: Document RZ/G3L SoC
PCI: rzg3s: Fix IRQ domain initialization error handling
PCI: rzg3s: Propagate platform_get_irq_byname() errors
PCI: rzg3s: Disable refclk on probe failure
|
|
- Fix a 64-bit type truncation in mtk_pcie_set_trans_table() to avoid
issues with windows above or larger than 4GB (Sreeraj S Kurup)
* pci/controller/mediatek-gen3:
PCI: mediatek-gen3: Fix 64-bit type truncation in mtk_pcie_set_trans_table()
|
|
- Find INTx DT property by 'interrupt-controller' name instead of assuming
it's the first child node (Zhengping Zhang)
* pci/controller/mediatek:
PCI: mediatek: Find INTx controller by property
|
|
- Limit Max_Read_Request_Size to 256 to avoid hardware erratum (Marek
Vasut)
- Add a .post_deinit() callback to handle dw_pcie_ep_init() failures (Marek
Vasut)
- Rework .additional_common_init() into .init() to simplify flow (Marek
Vasut)
- Add .deinit() and .speed_control() callbacks, both to prepare for R-Car
Gen5 SoC support (Marek Vasut)
- Support PERST# via reset subsystem as well as the existing GPIO support
to prepare for R-Car Gen5 SoCs (Marek Vasut)
- Add DT and driver support for the R-Car Gen 5 X5H (R8A78000) PCIe Gen 4
core (Marek Vasut)
- Drop documentation about obtaining R-Car platform firmware, which is
obsolete now that it's available in the linux-firmware.git repository
(Marek Vasut)
- Add Application/Local register reset DT description and driver support
for both host and endpoint mode (Marek Vasut)
* pci/controller/dwc-rcar-gen4:
PCI: rcar-gen4: Add Application/Local register reset control
dt-bindings: PCI: rcar-gen4-pci-ep: Document Application/Local register reset
dt-bindings: PCI: rcar-gen4-pci-host: Document Application/Local register reset
PCI: rcar-gen4: Drop documentation about obtaining platform firmware
PCI: rcar-gen4: Add support for R-Car X5H PCIe4
PCI: rcar-gen4: Handle PERST# via reset subsystem
PCI: rcar-gen4: Add .speed_control() callback
PCI: rcar-gen4: Add .deinit() callback
PCI: rcar-gen4: Rework .additional_common_init() into .init()
dt-bindings: PCI: rcar-gen4-pci-host: Add R-Car X5H PCIe4 compatible
PCI: rcar-gen4: Use .post_deinit() to handle dw_pcie_ep_init() failures
PCI: dwc: Add dw_pcie_ep_ops->post_deinit() callback
PCI: rcar-gen4: Limit Max_Read_Request_Size to 256 Bytes
# Conflicts:
# drivers/pci/controller/dwc/pcie-rcar-gen4.c
|
|
- Only collect reset GPIOs from PCI bridge DT nodes to avoid stealing
resets used by downstream devices like USB controllers (Christopher
Obbard)
- Block accesses to downstream devices on link down to reduce a storm of
Completion Timeout AER interrupts (Qiang Yu)
- Skip system suspend/resume for firmware-managed PCIe, where firmware
manages clocks, regulators, resets, etc (Mrinmay Sarkar)
- Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0()
(Manivannan Sadhasivam)
* pci/controller/dwc-qcom:
PCI: qcom: Honor IOMMU provider's #iommu-cells in qcom_pcie_config_sid_1_9_0()
PCI: qcom: Skip system suspend/resume for firmware-managed PCIe
PCI: qcom: Block accesses to downstream devices on link down
PCI: qcom: Only check bridge nodes for PERST# GPIOs
|
|
- Remove device links to PHY, which are redundant because the PHY core
itself adds them (Vladimir Oltean)
* pci/controller/dwc-keystone:
PCI: keystone: Remove device links to PHY
|
|
- Fix pwrctrl device leak when .probe() PM runtime setup fail (Zhijian Han)
- Fix resource leaks in .probe() error paths (Zhijian Han)
- Improve i.MX95 Gen3 link stability by changing MPLLB_BANDWIDTH from
default 120 to 140 (Richard Zhu)
* pci/controller/dwc-imx6:
PCI: imx6: Update MPLLB bandwidth to improve i.MX95 Gen3 PCIe stability
PCI: imx6: Fix resource leaks in probe error paths
PCI: imx6: Fix pwrctrl device leak on PM runtime setup failure
|
|
- Remove device links to PHY, which are redundant because the PHY core
itself adds them (Vladimir Oltean)
- Fix optional clock leak when .probe() fails by using
devm_clk_get_optional_enabled() (Felix Gu)
* pci/controller/dwc-dra7xx:
PCI: dra7xx: Fix clock enable leak on probe failure
PCI: dra7xx: Remove device links to PHY
|
|
- Align register macros with Synopsys documentation (Hans Zhang)
- Remove unused PCIE_ATU_UNR_* register definitions; the driver now uses
ATU_* macros instead (Hans Zhang)
* pci/controller/dwc:
PCI: dwc: Remove unused PCIE_ATU_UNR_* register definitions
PCI: dwc: Align register macros with Synopsys documentation
|
|
- Limit host and endpoint controllers to 2.5 GT/s since 5.0 GT/s is unsafe
(Geraldo Nascimento)
* pci/controller/rockchip:
PCI: rockchip: Drive at 2.5 GT/s, error other speeds
PCI: rockchip-host: Do not attempt 5.0 GT/s retraining
PCI: rockchip-ep: Do not attempt 5.0 GT/s retraining
|
|
- Use for_each_available_child_of_node_scoped() to simplify probe loop over
children (Krzysztof Kozlowski)
- Refcount child OF nodes during .probe() to make a concurrent OF overlay
removal safe (Krzysztof Kozlowski)
* pci/controller/mvebu:
PCI: mvebu: Keep child node refcnt for probe duration
PCI: mvebu: Simplify with scoped for each OF child loop
|
|
- Fix enum type mismatch warning in LTSSM debugfs (Hans Zhang)
- Remove device links to PHY, which are redundant because the PHY core
itself adds them (Vladimir Oltean)
- Return error (not success) from cdns_plat_pcie_probe() if
pm_runtime_get_sync() or cdns_pcie_ep_setup() failed (Vladimir Oltean)
* pci/controller/cadence:
PCI: cadence: Preserve all error codes in cdns_plat_pcie_probe()
PCI: cadence: Remove device links to PHY
PCI: cadence: Fix enum type mismatch warning in LTSSM debugfs
|
|
- Fix clk and PHY leaks in aspeed_pcie_port_init() error paths (Liu
Zhenlong)
* pci/controller/aspeed:
PCI: aspeed: Fix clk and PHY leak in aspeed_pcie_port_init() error paths
|
|
- Disable PHY on probe failures (Myeonghun Pak)
* pci/controller/aardvark:
PCI: aardvark: Disable PHY on probe failures
|
|
- Add missing headers transitively included by <linux/phy/phy.h> so these
can be removed from linux/phy/phy.h itself (Vladimir Oltean)
* pci/controller/misc:
PCI: Add missing headers transitively included by <linux/phy/phy.h>
|
|
- Pass the correct physical and virtual endpoint function numbers when
setting translation of inbound memory windows (Koichiro Den)
- Make embedded doorbell IRQ non-shared, since currently only the first EPF
can allocate doorbells (Koichiro Den)
- MSI doorbells currently target the first EPF attached to an EPC; let
other EPFs try the embedded doorbell instead of failing when they can't
use the MSI doorbell (Koichiro Den)
- Serialize scan of vNTB virtual PCI bus with other PCI topology changes
(Koichiro Den)
- Manage vNTB lifetimes to avoid leaking virtual devices and buses and
allow removal (Koichiro Den)
* pci/endpoint:
PCI: endpoint: pci-epf-vntb: Manage virtual NTB and PCI bus lifetime
PCI: endpoint: pci-epf-vntb: Serialize virtual PCI bus scan
PCI: endpoint: pci-ep-msi: Let non-first EPFs use embedded doorbells
PCI: endpoint: pci-ep-msi: Make embedded doorbell IRQ exclusive
PCI: endpoint: pci-epf-vntb: Pass PF/VF number when BAR programming
|
|
- Add ACS quirk for Pericom PI7C9X2G304 switches (Hans de Goede)
- Read SR-IOV VF Revision ID and Subsystem ID from VF instead of assuming
they're the same as VF 0; they may differ (Logan Odell)
* pci/virtualization:
PCI/IOV: Read VF config values that need not match PF
PCI: Add ACS quirk for Pericom PI7C9X2G304 switches [12d8:b304]
|
|
- Validate the Steering Tag buffer returned from the Query Cache Locality
TPH Features _DSM (Wei Huang)
* pci/tph:
PCI/TPH: Validate the firmware Steering Tag response
|
