Commit Graph

1987 Commits

Author SHA1 Message Date
Linus Torvalds
2b19759b46 - Fix possible hang in machine_kexec_mask_interrupts(),
which incorrectly assumes that irq_set_irqchip_state()
    will always be able to complete in a kexec crash path,
    triggered on RK3399 embedded boards (Igor Velkov)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrd3X4RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gDkQ//Z+vr/rkvqst2EpYPjnygPBvjB/TsVO6d
 FoMUEm+3X8ss9EueryDaHfK52yj7JoPZeot/0Ff38FX9Tu+1kXsmbj07tRMMbk0n
 lcX6z0bfIuFcPiFfZZzraZR7oX0J1tOLkl2BsZzjpw02FPJcOqpPPYhJNMIaRKD6
 nR54X1sgOw5LP9UBX4OCCGF0+rxLxOeFsMt6mytv3Q7HZjWvVRKK2UK8g3GHn579
 AYPli910m+BgHQUbpEy1PHzsxGmoBiO/0jk2h5q15snlXZMnKaLr30GWnU3qzJIf
 T/Z33ouzP+plcPWA8K9GI7XE2Q+TpbtRbUejSqQor57HbAANEm517vnB3tS1Gjca
 tZPo2fvAWpU6BlEDWS+R/03Djt/M5hSB8CGd8ArhPZTCSSgdcGNkoz7rThn6aj9D
 awZBIfi/byLW8i8/m/x0a7IBMCKWCInSmgh87sfUSQTx3V46wS+4V3bMFitYUThv
 prCeIA987cqYWrnbtFGzqTSISKaHaW52iZndU6/Q+vW5a5zfv6vFty3u1qWnCs5o
 XvbRa4fRCLexY5S4+1jVjfhwXxcPpPDiR2WApVQWIls22ieidpMdWEPpTvWwCF7L
 hXQv5Pa+KKgBpeEsZC2wPNJ8Ht2thgF5SWFyLFKTwg/fvEKniSJGks4vICeMLUJ2
 6vbldnXh3Uo=
 =vGaL
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull kexec / irq fix from Ingo Molnar:

 - Fix possible hang in machine_kexec_mask_interrupts(),
   which incorrectly assumes that irq_set_irqchip_state()
   will always be able to complete in a kexec crash path,
   triggered on RK3399 embedded boards (Igor Velkov)

* tag 'irq-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path
2026-10-25 17:51:25 -10:00
Igor Velkov
717862eac6 genirq/kexec: Do not take the bus lock of an interrupt chip on the crash path
machine_kexec_mask_interrupts() calls irq_set_irqchip_state() for every
started interrupt. That function takes the bus lock of the chip and
desc->lock, and syncs the chip when it drops them. On the crash path
interrupts are off and the other CPUs are stopped, so a chip whose bus
transfer is completed by an interrupt never returns from the sync.

On RK3399 boards with an RK808 PMIC the RTC alarm interrupt belongs to
the regmap-irq chip of the RK808, which sits on I2C. rk808_irq_chip sets
init_ack_masked, so regmap_irq_sync_unlock() writes the ack register on
every unlock, and the I2C controller needs its own interrupt to finish
the transfer. A panic with a crash kernel loaded prints

  SMP: stopping secondary CPUs

and then nothing until the watchdog resets the board.

machine_kexec_mask_interrupts() takes neither lock for the other
operations on the descriptor. Move the search for the chip that
implements irq_set_irqchip_state() into __irq_set_irqchip_state(), which
takes no locks, and call it from machine_kexec_mask_interrupts().

Fixes: 78fd584cde ("arm64: kdump: implement machine_crash_shutdown()")
Suggested-by: Thomas Gleixner <tglx@kernel.org>
Signed-off-by: Igor Velkov <iav@iav.lv>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261015-kexec-irq-bus-lock-v2-1-2af15f0757b6@iav.lv
2026-10-23 23:16:39 +02:00
Linus Torvalds
2e973d4882 Updates for interrupt chip drivers:
- Remove the futile attempts to cleanup resources when the probing of the
     main interrupt chip fails for SiFIVE/PLIC devices. If that probe fails
     the system will stall immediately afterwards in the boot process
     without reaching a state where the error could be diagnosed. The lack
     of resource cleanup led to a frenzy of AI detected/assisted "fixes"
     which just make the code pretend to be correct for no value.
 
     Remove the existing half baked cleanup and immediately panic the
     machine when the probe fails. That's far more useful than letting it
     proceed and stall out a millisecond later with no information about the
     root cause.
 
   - A series of fixes for the ARM GIC-V3 driver addressing a potential
     double free, a bitmask overrun on 32-bit ARM and a OF node leak.
 
   - Automatically set the IRQ_DOMAIN_FLAG_DESTROY_GC when a interrupt
     domain is created that also allocates the generic interrupt chip during
     domain creation. That removes the requirement for manually setting the
     flag in the domain creation info structure when it contains a valid
     entry for allocating the generic interrupt chip. Remove the therefore
     redundant setters of IRQ_DOMAIN_FLAG_DESTROY_GC in the existing
     drivers.
 
   - Add support for Annapurna Labs FIC version 2 and 3 and implement
     affinity control for the demultiplexed interrupts by utilizing the
     recently merged interrupt redirection infrastructure.
 
   - Convert the ACPI device ID structures to named initializers
 
   - Consolidate the IPI related constants for RISC-V interrupt controllers
 
   - Add support for Qualcomm Purwa SoC interrupt chip and consolidate the
     workaround for the previous version in Hamoa SoCs.
 
   - The usual small fixes and improvements all over the place
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmrX0aEQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoatNEACU5naAkM1k+hTaPXSRcd/JpizpVrM5jpM5
 tOGe5ml6h9Mda+9uFSwR5rOF5kHXofZh70E97zR7C4jD7JNcuXPqgFg202mKfcjg
 ZWcuYKOR5DaAmiNgpXYPyK9UpXQ9YOPwE7MMpv7sv5yfYDVWFzVEOSb5F294D+gK
 vuQLY9jeysDWNRSuXD9Zo8pBoXJZBCMvTWrJJO4fdh8ZxIWJJv35nRoAgYs8ZlWq
 hF1om+Ei8KbftW9ox/ZJ+nomM6UG+H6iw8+7jZ/mQ9kadRExCNNoFF2NDfH/XFX2
 +o+2HVmXW5KTCSmy28aPLBTZojeAoEGvqI5IXu8bKYR6IfYrzdZIe+9UuabPg0lO
 NWOFj1wGbUD84hoo0gI9f1MsTORdNBqccG132MvDKzOyMYQ8cbOEsk44QTjLC+kT
 A46iM1eFC43g2YWpl9qZRKmq+PomCwMwBmjCKNPzG1a24iUzeDdGSs+Es2tNzlQt
 MVPXGHzgBfXb1thEP/28nBpEnAJ6XyXaXvIvp0GcSVdbTmT3MrkEOb0YmI1QUyot
 FRM9WVpy9X0XNo4yqxKAFGVlmGeR9XKMYgU3bgaZ7CgZMe507MAjTGU44mk+LjKa
 Ndyl7ztYrrcf3GMoe1IIbfKI6bcUZ588d6VPLjH8BKCd2ZqRDfnIPNX+oIpoomd3
 FxacuEXq4Q==
 =ma3a
 -----END PGP SIGNATURE-----

Merge tag 'irq-drivers-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq chip driver updates from Thomas Gleixner:
 "Updates for interrupt chip drivers:

   - Remove the futile attempts to cleanup resources when the probing of
     the main interrupt chip fails for SiFIVE/PLIC devices. If that
     probe fails the system will stall immediately afterwards in the
     boot process without reaching a state where the error could be
     diagnosed. The lack of resource cleanup led to a frenzy of AI
     detected/assisted "fixes" which just make the code pretend to be
     correct for no value.

     Remove the existing half baked cleanup and immediately panic the
     machine when the probe fails. That's far more useful than letting
     it proceed and stall out a millisecond later with no information
     about the root cause.

   - A series of fixes for the ARM GIC-V3 driver addressing a potential
     double free, a bitmask overrun on 32-bit ARM and a OF node leak.

   - Automatically set the IRQ_DOMAIN_FLAG_DESTROY_GC when a interrupt
     domain is created that also allocates the generic interrupt chip
     during domain creation. That removes the requirement for manually
     setting the flag in the domain creation info structure when it
     contains a valid entry for allocating the generic interrupt chip.
     Remove the therefore redundant setters of
     IRQ_DOMAIN_FLAG_DESTROY_GC in the existing drivers.

   - Add support for Annapurna Labs FIC version 2 and 3 and implement
     affinity control for the demultiplexed interrupts by utilizing the
     recently merged interrupt redirection infrastructure.

   - Convert the ACPI device ID structures to named initializers

   - Consolidate the IPI related constants for RISC-V interrupt
     controllers

   - Add support for Qualcomm Purwa SoC interrupt chip and consolidate
     the workaround for the previous version in Hamoa SoCs.

   - The usual small fixes and improvements all over the place"

* tag 'irq-drivers-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (61 commits)
  irqchip/al-fic: Support per-child affinity via interrupt redirection
  irqchip/al-fic: Add support for FIC v3
  irqchip/al-fic: Support error and fatal outputs and FIC v2
  dt-bindings: interrupt-controller: amazon,al-fic: Add mask selection
  irqchip/al-fic: Switch to shared parent interrupt
  irqchip/al-fic: Keep the device_node instead of a cached name string
  irqchip/al-fic: Use %pOF and raise init log level
  irqchip/al-fic: Use %pe to print init error
  irqchip/al-fic: Fix coding style issues
  irqchip: Use named initializers for acpi_device_id
  irqchip/gic-v5: Fix standalone IRSes OF probe
  dt-bindings: interrupt-controller: gicv5: Relax IRS properties constraints
  irqchip/renesas-rzv2h: Preserve TIEN state in rzv2h_tint_set_type()
  irqchip/loongson-eiointc: Use pa_to_nid() rather than hard-code
  irqchip/riscv-imsic: Expose the fwnode via the global config
  irqchip/meson-gpio: Allow the GPIO interrupts to wake the system
  irqchip/gic-v3: Ensure change to DS is visible
  irqchip/mips-gic: Transfer interrupt mask state across clusters
  irqchip/mips-gic: Fix recursive acquisition of gic_lock in gic_set_affinity()
  irqchip/mips-gic: Fix unbalanced cm_core_lock in for_each_online_cpu_gic()
  ...
2026-10-21 11:16:50 -10:00
Linus Torvalds
1fbe92c39e Updates for the generic interrupt subsystem:
- Skip programming of MSI/MSI-X related data while a PCI channel is
     offline (Link is down) in the error recovery code path. Accessing an
     offline channel results in a BUS error which affects the underlying
     Root Port.
 
     Check for pci_channel_offline() and if true avoid the writes and just
     cache the modifications which are subsequently applied when the Link
     has recovered.
 
   - Prevent a stack UAF when a faulting interrupt thread exits. On X86 the
     crash causes the stack to be discarded, which contains the callback
     head for the exit task_work to run the destructor. If the stack is
     clobbered before the destructor runs, then the indirect call of the
     task work function ends up in a random place. Move the callback head
     into the interrupt action to prevent that.
 
   - Prevent an UAF in the interrupt thread exit code which can happen when a
     faulting interrupt thread exits and races with a concurrent free_irq()
     by synchronizing free_irq() against thread exit.
 
   - Ensure that interrupt context accounting is accurate on interrupt
     return when checking for soft interrupt invocation.
 
     The code removed the hard interrupt context prematurely so that the
     subsequent code appeared to be in task context according to the preempt
     counter. That confuses ftrace, perf and K*SAN which get their recording
     context wrong. On Preempt-RT this can result in misbehaviour when BPF
     programs are attached to the affected region.
 
     Cure it by preserving the hard interrupt count up to the point where
     soft interrupts are actually invoked and switch directly to soft
     interrupt processing right there. That avoids the intermediate "in task
     context" state.
 
   - The usual small fixes and improvements
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmrXzOMQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoXEhD/9uddBaW4DRK1DvzJDP7AscC6LlMwd+R3b7
 AU/DF6xnlTOoSyqHJXesycUUvpV7qKm/aIu8tQNWqc+eun3TMgCrw4UUcJf8lcjD
 zy8JkykAGWKfcHW9rMjg2XERJHCrMkPtGrUhBhnuKDf91ihxnEzLNNH/H+qj1Y8u
 eFUcc/0kgBC1t5TO+Ughm3sHkz51Sjl0uSUUyHTOlG1NSwBAKhLUtku4duiEE4XB
 /0W1+C5cifrebnT6phKEH7GK6Hh3hSGfO5glCNJHmqng7/bKplJRo1kF9diJOxU9
 dtzrycTgI+W2x4lE7qt4Me+SoYdrp2LbYfaTKqzZPKJtJV7iwCd/eO96n3aeNGfu
 re6ec/WUtuyQpLhmcqNLqUDhruUOn5BOhBcF4CtdG9FM8a62A1wf4vyzXGX9OJkb
 bDkLrzu7p7RURhXv1p3RbJqh61cIdyaI38sjc7ct/YXgNwJngEy1LWF/Gy3teiXJ
 tWXv4+KD8dqFfL/p2bP+SZZnzFIr3KVdYIFvitwe+nc/2P+9nizsR1RnJGo7jsAI
 0VrgmqiBjvtifdLoezwp6NaZyz669iCqqpzL0na4UgPkCLQ/OkkNPBVJeR1eUv5x
 zdz5aNup8EZxK1kWEJMe3TXxUs/crIvOae1b65Bqvx0id8GGgtpYyP4gkwoJT1zM
 eCtMtU5dLw==
 =9wgq
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq updates from Thomas Gleixner:
 "Updates for the generic interrupt subsystem:

   - Skip programming of MSI/MSI-X related data while a PCI channel is
     offline (Link is down) in the error recovery code path. Accessing
     an offline channel results in a BUS error which affects the
     underlying Root Port.

     Check for pci_channel_offline() and if true avoid the writes and
     just cache the modifications which are subsequently applied when
     the Link has recovered.

   - Prevent a stack UAF when a faulting interrupt thread exits. On X86
     the crash causes the stack to be discarded, which contains the
     callback head for the exit task_work to run the destructor. If the
     stack is clobbered before the destructor runs, then the indirect
     call of the task work function ends up in a random place. Move the
     callback head into the interrupt action to prevent that.

   - Prevent an UAF in the interrupt thread exit code which can happen
     when a faulting interrupt thread exits and races with a concurrent
     free_irq() by synchronizing free_irq() against thread exit.

   - Ensure that interrupt context accounting is accurate on interrupt
     return when checking for soft interrupt invocation.

     The code removed the hard interrupt context prematurely so that the
     subsequent code appeared to be in task context according to the
     preempt counter. That confuses ftrace, perf and K*SAN which get
     their recording context wrong. On Preempt-RT this can result in
     misbehaviour when BPF programs are attached to the affected region.

     Cure it by preserving the hard interrupt count up to the point
     where soft interrupts are actually invoked and switch directly to
     soft interrupt processing right there. That avoids the intermediate
     "in task context" state.

   - The usual small fixes and improvements"

* tag 'irq-core-2026-10-20' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq/proc: Fix missing CPU header in /proc/interrupts
  PCI/MSI: Skip MSI/MSI-X programming while the channel is offline
  genirq: Fix typos in comments
  genirq: Move interrupt thread exit_work object to irqaction
  genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
  softirq: Preserve interrupt context on return from interrupt
  softirq: Remove redundant h->action from preempt_count mismatch error
  genirq: Discard cpumask of irqaffinity= boot parameter if parsing fails
2026-10-21 11:05:37 -10:00
Linus Torvalds
776bb6df3f Locking updates:
- In the refcount checking code, BUG() on UAF related errors if
    CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
 
  - Add {over,under}flow detection for local_interrupt_{enable,disable}()
    (Boqun Feng)
 
  - Add kunit test case for max local_interrupt_disable() nesting level
    (Boqun Feng)
 
  - Clarify comment (Boqun Feng)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUlMkRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jSug//cjg5WItJ31KfJuzjlRhLJmMdjaPflV+7
 y99hHMLZFu8+L20U8lqBLCCdjmgS3RnPUHsncSwxZHOIrp3zAduc85oa4FMultwq
 XT39jTLEiIfa/2S5/k48PCFZbB6kgFGZGLiAd/h8HuUi4w8t0deGNggdtQCANOdF
 OnpZedXttevu+tbqZFVn2CBZ9Y83S8au1GNuQTu/CAILAPFOalJWP/L+yxns6uZo
 W/5oJvW+RmjswKBFKEgPJSOg56VPURZBPqPZntB9TVyiUSAx7wQeXhMdVFL6e6hx
 MEE5uxbKAqau0LmbTJy7GHpZym4p2hNHIyACxiQX7eXd4l20C/INHVgwYvSRgF9F
 V2VgBMPxH6wXxxNeFujBnNfeUaZfb/9c/E0AQfIQNhexqXahA8bBfmwDy3T+2smq
 usRFLW676zAam2WybsJmANSHZ+KhKaVolOBJTLEUnGA2CG5ONt/xa3HqHNTKCI22
 CY6D6iSgKBzhmso2A7EGdajx3kBkNycfdrVlqXz6YIw7MiNZlONPWf7698bzszPL
 HcE9KWr+0Pt23R5t6g1BBg7T0mnARX8/k3UR5fUC+1zovoKQAm4k8VacDMhF1GSP
 xt7EKiQgNjSRPKdlF+vAlk97qEWqIqkHjvyw5dX+Gz3d4uJ+UHwJDqMM50dEm8g6
 JgqckejzN1A=
 =nN01
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:

 - In the refcount checking code, BUG() on UAF related errors if
   CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)

 - Add {over,under}flow detection for local_interrupt_{enable,disable}()
   (Boqun Feng)

 - Add kunit test case for max local_interrupt_disable() nesting level
   (Boqun Feng)

 - Clarify comment (Boqun Feng)

* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irq: Add max local_interrupt_disable() nesting level kunit test case
  irq: Explain better on NMI_MASK overflow condition
  irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
  refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
2026-10-20 12:43:05 -10:00
Haris Okanovic
e74798f2f8 genirq/proc: Fix missing CPU header in /proc/interrupts
irq_seq_show() must be idempotent since it may be called multiple times
to render the same record, e.g. when seq_file's buffer is exceeded. It
emits the CPU header behind the one-shot print_header flag, which the
first pass clears, so the header is lost with the discarded buffer.

This can be seen on large systems, such as 8g.48xl (192 CPUs) and
8i.96xl (384 CPUs) AWS instance types:

  $ head -1 /proc/interrupts
     9:          0          0 ...  0  GICv3  25 Level  vgic

Replace print_header with the position of the first record and include
the header whenever that record is emitted.

Fixes: 171cc0d9ee ("genirq/proc: Speed up /proc/interrupts iteration")
Signed-off-by: Haris Okanovic <harisokn@amazon.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260911-dev-harisokn-proc-interrupts-fix-b4-v1-1-f9ff208efcfa@amazon.com
2026-10-16 00:18:41 +02:00
Hemanth Selam
d2fa415329 genirq: Fix typos in comments
Correct the spelling of "descriptor" and "preceded" in the kernel-doc for
msi_insert_desc() and msi_next_desc().

Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20261009064807.70345-1-hemanth.selam@gmail.com
2026-10-16 00:18:40 +02:00
Richard Patel
89a9e003a2 genirq: Move interrupt thread exit_work object to irqaction
irq_thread() registers irq_thread_dtor() as exit task_work using a
stack-allocated callback_head.  On normal interrupt thread exit, this work
gets cancelled and never runs.

On x86, an abnormal interrupt thread exit (e.g. handler oops) discards the
stack, including the callback_head, while that callback_head is still
pending. By the time exit_task_work() runs, the stack memory formerly
backing callback_head is already clobbered.

  irq_thread()                      <-- on_exit_work allocated
    ** IRQ handler faults **
    oops_end()
      rewind_stack_and_make_dead()  <-- on_exit_work freed
  make_task_dead()
    do_exit(SIGSEGV)
      ...
      exit_shm()                    <-- on_exit_work clobbered
      ...
      exit_task_work()              <-- stack use-after-free
        exit_shm()+0x30             <-- wild jump to return addr

Thus, a benign threaded IRQ oops (e.g. a NULL pointer deref) is
turned into a wild jump. This is caught by kernel IBT:

  ** first fault **
  Oops: general protection fault, kernel NULL pointer dereference 0x3c0: 0000 [#1] SMP NOPTI
  ...
  ** second fault **
  Missing ENDBR: exit_shm+0x30/0x1c0
  kernel BUG at arch/x86/kernel/cet.c:133!
  ...
   ? task_work_run+0x5c/0x90
   ? do_exit+0x209/0x460
   ? rewind_stack_and_make_dead+0x16/0x20
  ...
  note: irq/165-AudioDS[1427] exited with irqs disabled
  Fixing recursive fault but reboot is needed!

Fix this by storing the callback_head in struct irqaction.  The irqaction
is only freed once irq_thread_dtor() finishes.

Fixes: 2deb4be280 ("x86/dumpstack: When OOPSing, rewind the stack before do_exit()")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-3-ripatel@wii.dev
2026-10-16 00:18:40 +02:00
Richard Patel
d04adff686 genirq: Defer kfree(irqaction) until irq_thread_dtor() finishes
When an interrupt thread exits abnormally via do_exit() (e.g. the interrupt
handler oopses) without returning from irq_thread(), a concurrent call to
free_irq() could free the irqaction before the irq_thread_dtor() exit task
work runs.

  irq thread (oopsed)                 free_irq()
  -------------------                 ----------
  do_exit()
    exit_mm()
      complete_vfork_done()  -------> kthread_stop() returns
    exit_files() ...                  kfree(action)
    exit_task_work()
      irq_thread_dtor()
        action->...                   <- use-after-free

Track the pending exit work with the IRQTF_EXIT_WORK thread flag, and have
__free_irq() wait for the bit to clear before kfree().

irq_thread_dtor() only runs on irq_thread abnormal exit. If that dtor also
faults, free_irq() will hang indefinitely, but double IRQ thread faults
require a reboot anyways.

[ tglx: Add missing include ]

Fixes: ed3e694d78 ("move exit_task_work() past exit_files() et.al.")
Signed-off-by: Richard Patel <ripatel@wii.dev>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20261009145842.1616117-2-ripatel@wii.dev
2026-10-16 00:18:40 +02:00
Thomas Gleixner
e03fa8f4e0 Linux 7.3-rc5
-----BEGIN PGP SIGNATURE-----
 
 iQFSBAABCgA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAmq5gqUeHHRvcnZhbGRz
 QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiG1m0IAKReEZDW1PRuno8+
 eLDLgJ2pYk8CMAnl7UO6OAG9dQWT5vLIJrRerLeoG2ZDP9kr5cJPGytXryxUtH1D
 8UfuSRZ+/b/JD0yhHlod0MSvZeVWbRtcL7r03kcea0p4ziNeR+V20oUQqM33ZuCL
 7o12W0EYtsQwfSmtMsO+5ayIoOu05FSBb/l2mnWi3TFUUYcLbna4SwBcQuVf/jXQ
 mCeNqTtFMHsdAFp27AFfu4wV87+y158QFyXxpCeoUk8cGcFDY8zu5R8CqijtHSar
 x9hpPGSMDVm+BSxfrIsDXWVU/1WskRAPyNw+l14vFR1NwY6uLUBruajPyLEnh3B4
 SzHSAxg=
 =5Bii
 -----END PGP SIGNATURE-----

Merge tag 'v7.3-rc5' into irq/core

Get the upstream modifications in softirq.c to avoid conflicts with pending
patches,
2026-10-15 10:10:08 +02:00
Boqun Feng
67e0eadd86 irq: Add max local_interrupt_disable() nesting level kunit test case
To confirm the max nesting level of local_interrupt_disable() works, a
kunit test is added to the whole test suite.

Note that when DEBUG_PREEMPT=y, it'll generate a warning which is
expected.

Suggested-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Link: https://patch.msgid.link/20261001082519.16195-6-boqun@kernel.org
2026-10-02 11:47:14 +02:00
Kuan-Wei Chiu
26f6b6357b irq: Make refcount_interrupt kunit test selectable
Currently, refcount_interrupt_test is built unconditionally when
CONFIG_KUNIT is enabled, causing it to run unexpectedly during boot.

Fix this by introducing CONFIG_REFCOUNT_INTERRUPT_KUNIT_TEST so the
test can be configured independently, following standard kunit
practices.

Fixes: 07a88e2bcd ("irq: Add KUnit test for refcounted interrupt enable/disable")
Signed-off-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Reviewed-by: Boqun Feng <boqun@kernel.org>
Link: https://patch.msgid.link/20261001082519.16195-2-boqun@kernel.org
2026-10-02 11:40:12 +02:00
Qingshuang Fu
0aa45dce2a irqdomain: Set IRQ_DOMAIN_FLAG_DESTROY_GC in __irq_domain_instantiate()
When a driver uses irq_domain_instantiate() with dgc_info to create
generic irq chips, IRQ_DOMAIN_FLAG_DESTROY_GC is required so that
irq_domain_remove() can clean up those generic chips.

All existing in-tree callers manually set this flag today, but this
pattern is error-prone. A future new caller forgetting to set the flag
would leave generic chips allocated by irq_domain_alloc_generic_chips()
leaked on domain removal.

Set IRQ_DOMAIN_FLAG_DESTROY_GC right after
irq_domain_alloc_generic_chips() succeeds inside
__irq_domain_instantiate().  This makes automatic cleanup the default
for all users that provide dgc_info via irq_domain_instantiate().

This is the correct location for the flag because:

  - irq_domain_instantiate() is a high-level wrapper which internally
    allocates the generic chips, so it should also take responsibility
    for arranging their cleanup.

  - Setting the flag in irq_domain_alloc_generic_chips() would affect
    legacy callers like __irq_alloc_domain_generic_chips(), some of
    which have custom cleanup paths that manually free the generic
    chips (e.g. gpio-tb10x does kfree(domain->gc) before
    irq_domain_remove()), leading to use-after-free.

Signed-off-by: Qingshuang Fu <fuqingshuang@kylinos.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Herve Codina <herve.codina@bootlin.com>
Link: https://patch.msgid.link/20260907024046.28845-2-fuqingshuang@kylinos.cn
2026-09-07 21:49:58 +02:00
Kees Cook
3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04 21:37:00 -07:00
Lukas Beckmann
94235414a0 genirq: Discard cpumask of irqaffinity= boot parameter if parsing fails
irq_affinity_setup() ignores the return value of cpulist_parse(). This
can result in using a "half parsed" cpulist. E.g. on a system with 8
cores, the parameter "irqaffinity=0,1,6-10,4" would result in using only
CPU 0 and 1, since the parsing fails at 6-10. Other boot parameters
which take a cpulist (e.g. isolcpus=, workqueue.unbound_cpus=) already
handle this by falling back to a default.

Check the return value of cpulist_parse() and let
init_irq_default_affinity() set the default in early_irq_init()
later, if parsing fails.

Signed-off-by: Lukas Beckmann <lbckmnn@mailbox.org>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260822160502.4665-1-lbckmnn@mailbox.org
2026-09-04 08:44:17 +02:00
Linus Torvalds
91ec203513 Networking changes for 7.3.
Core & protocols
 ----------------
 
  - A few steps lowering rtnl_lock dependence:
    - per-netns netdev unregistration for select SW drivers
      (e.g. veth, ipvlan, tunnels)
    - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
    - prepare software drivers and TC qdiscs for rtnl_lock-less GET
 
  - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve).
 
  - Support buffers larger than PAGE_SIZE in devmem zero-copy API.
 
  - Improve MPTCP handling of extreme memory pressure handling,
    when out-of-order queue had to be pruned.
 
  - Report the per-group user count via RTM_GETMULTICAST.
 
  - Expose the route deletion reason in RTM_DELROUTE.
 
  - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more useful
    handling of LSM denials when receiving SCM_RIGHTS messages: instead
    of truncating the message at the first blocked fd, keep every fd slot
    and store the LSM errno in the blocked slot.
 
  - IPv6 Segment Routing - support looking up the post-encap SID
    (address) in a different/specified routing table.
 
  - Support PRP RedBox (interlink) creation.
 
  - Support per-nexthop UDP dst port in VXLAN.
 
  - Continue converting getsockopt callbacks in a number of protocols
    to iov_iter.
 
 Ethernet
 --------
 
  - Marge initial CXL support for AMD/Solarflare NICs (shared branch
    with the CXL tree).
 
  - New drivers:
    - ADIN1140 10BASE-T1S MACPHY
    - Initial skeleton of Intel iXD and ZTE Dinghai drivers.
 
  - High-speed NICs:
    - AMD/Pensando:
      - support firmware flashing
    - Cisco (enic):
      - SR-IOV V2 admin channel and MBOX protocol
    - Huawei (hns3):
      - support for ethtool pfc_prevention_tout
    - nVidia/Mellanox:
      - support sharing bandwidth control across interfaces of
        the same device
    - Marvell (octeontx2-pf):
      - link RQ page pools to netdev for Netlink stats
    - Google vNIC:
      - XDP metadata support for DQ RDA
    - Microsoft vNIC:
      - support forcing full-page RX buffers
 
  - Other NICs:
    - Synopsys IP:
      - eic7700: support for eth1
    - Microchip (lan743x):
      - support for RMII interface
    - Wangxun:
      - support for ethtool -G and -C for VFs
      - add Tx timeout and PCIe error handling
    - Intel (igb/igc):
      - RSS key get/set support
      - support for forcing link speed without auto-negotiation
 
  - Switches:
    - NXP (dpaa2):
      - support bonding/LAG offload
    - Mediatek:
      - mt7530: EN7528 support
      - initial support for MT7628
    - Micrel (ksz8/9):
      - refactoring work to move towards library model
      - PTP support for KSZ8463
    - nVidia/Mellanox:
      - support rtnl-lock-less ethtool callbacks
    - Realtek:
      - rtl8366rb: use generic RTL83xx code
      - support SGMII and HSGMII for RTL8367S
 
  - PHYs:
    - Airoha:
      - EcoNet EN7528 PHY support
    - DAPU Telecom
      - DAPU Telecom DAP8211R(I) Gigabit PHY support
    - Realtek:
      - support RTL8261C_CG
      - support RTL8261D
 
 Wireless
 --------
 
  - nl80211: per-link statistics support for multi-link operation
 
  - mac80211: AQL/airtime-fairness support for multicast
 
  - Merge Peripheral Authentication Service (PAS) / TEE support
    for ath12k (shared branch with the firmware/qcom tree).
 
  - New drivers:
    - mm81x for Morse Micro Long-Range S1G devices
    - nxpwifi for NXP devices (mostly forked off from mwifiex)
 
  - Driver changes:
    - Broadcom (brcmfmac):
      - DPP support, some Cypress part update
    - MediaTek (mt76):
      - mt7928 support
      - mt7925 NAN support
      - mt7996 AP powersave improvements
    - Qualcomm (ath12k):
      - much kernel infrastructure integration work
      - AHB platform MultiPD support
    - Realtek (rt89):
      - LED support
      - RTL8922DE support
      - dual-BT coex for RTL8922D
    - Intel:
      - new FW version support
 
 Bluetooth
 ---------
 
  - HCI: add support for Shorter Connection Interval (SCI) feature.
 
  - af_bluetooth: add minimal context analysis annotations.
 
  - Driver changes:
    - Intel:
      - add Bluetooth SAR revision 2 support
      - add vendor_reset PCI sysfs for PLDR
    - Mediatek:
      - add USB IDs for MT7902 and MT7922 devices
    - Realtek:
      - add USB IDs for 8761CU and 8852BE devices
    - NXP:
      - add M.2 Bluetooth device support using pwrseq
 
 Misc
 ----
 
  - DPLL support for manual/numerical oscillator control (NCO)
    (implement in zl3073x).
 
  - MCTP support for MCTP over USB v1.1 (DMTF DSP0283).
 
  - Power-over-Ethernet: support Realtek PSE controllers.
 
  - Remove the IBM EHEA driver.
 
  - Remove tulip/xircom_cb driver.
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmqEwJ4ACgkQMUZtbf5S
 Irsegw//fmHJae525nxg3DHoXhrUz8EDDOVoLH6oyWyLQnh5bmbReAY/+oWA4m54
 3KKKO0b2rtgRvmY/7rnjAt3bjecYgCSjvZT7I+NosB0QbbBYc14PtHfYig9HffYm
 uCXfNJOk+aJ2QK4ncEvU2SjgE89Ya7cC+yARFBAwYx4zi/Qx24RB+ziOyvkQ8ksX
 atvMOZrnhwqvYUFOwnOLNHTpvdxB/ZsNwWY6iXcx6EYp9xrtPusbh3FlushWkwxH
 8cI/dNla44TcIKXAzRn0znRdgiEVmCMyHvOv7LKaOfy8P3I+knmuIf/mScYQqOEF
 T143HdXhVSBZFRtLtFKXIja/KsvCjX9lCeMn/2ak0brQDUREcacXxYbuZKDsNAAK
 zXt/+5qAcm/mO8W1gKR9Ulfli5bhFN4HKXgXMLjo5ucPtzfPxFN7HGxTiC3Cxv1v
 lSXexKaj74pNBVFmADrb5jWbq7oG+GzIdjzx3ycvm2q39Fr4nJ2SzrSPPNwc/ItQ
 IHv3tGLQKXlr8dl0+p2mDkRInmHXrawVNsB1UgN8E/jtcwT2QMwyWOV6s5G3uEDl
 a+0U/XsrPvDYBTUCRs/KaOJQGB90QkzLe9DATt159mf+rPzAX2/oCDo8xIEe+kWV
 aivP+YutFfMH/CSC9PMuvdLE2KmoPY4mibAeE4/4AYLKtJnc/yU=
 =zDto
 -----END PGP SIGNATURE-----

Merge tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next

Pull networking updates from Jakub Kicinski:
 "One of the 'small improvements all over the place' releases for us.

  It's hard to draw any direct comparisons because summer vacations
  disrupted our patch processing (and presumably - generation) quite a
  bit.

  Quick and dirty count suggests we (Paolo and I) merged a very similar
  number of net (632) and net-next (648) patches. This is not telling
  the full story either because 1/3 to 1/2 of the net-next patches also
  *seem* like AI-driven low priority fixes, cleanups and clarifications.

  We are completely overwhelmed, of course. The glimmer of hope is that
  we secured sufficient LLM budget and access (thank you Meta!) to run
  reviews with multiple frontier models on each patch. This eliminates
  some hallucinations. That said, in terms of review, the LLMs can only
  do so much.

  The sad truth is that our APIs (especially for rare events like PCIe
  errors, timeouts etc) have always been racy, and now LLMs don't let us
  ignore that. I expect our direction for the next release will be to
  tweak the reviews a little bit more, but start shifting focus to
  letting the LLMs take care of the busy work - managing patchwork,
  automating common process complaints, editing commit messages, and
  maybe applying patches which already got "reviewed-by" tags from
  people we trust...

  Core & protocols:

   - A few steps lowering rtnl_lock dependence:
      - per-netns netdev unregistration for select SW drivers (e.g.
        veth, ipvlan, tunnels)
      - rtnl_lock-less FIB rule changes (RTM_NEWRULE and RTM_DELRULE)
      - prepare software drivers and TC qdiscs for rtnl_lock-less GET

   - Support BIG TCP (>64kB TSO) in UDP tunnels (vxlan, geneve)

   - Support buffers larger than PAGE_SIZE in devmem zero-copy API

   - Improve MPTCP handling of extreme memory pressure handling, when
     out-of-order queue had to be pruned

   - Report the per-group user count via RTM_GETMULTICAST

   - Expose the route deletion reason in RTM_DELROUTE

   - Add a SO_RIGHTS_NOTRUNC option to UNIX sockets to enable more
     useful handling of LSM denials when receiving SCM_RIGHTS messages:
     instead of truncating the message at the first blocked fd, keep
     every fd slot and store the LSM errno in the blocked slot

   - IPv6 Segment Routing - support looking up the post-encap SID
     (address) in a different/specified routing table

   - Support PRP RedBox (interlink) creation

   - Support per-nexthop UDP dst port in VXLAN

   - Continue converting getsockopt callbacks in a number of protocols
     to iov_iter

  Ethernet:

   - Merge initial CXL support for AMD/Solarflare NICs (shared branch
     with the CXL tree)

   - New drivers:
      - ADIN1140 10BASE-T1S MACPHY
      - Initial skeleton of Intel iXD and ZTE Dinghai drivers

   - High-speed NICs:
      - AMD/Pensando:
         - support firmware flashing
      - Cisco (enic):
         - SR-IOV V2 admin channel and MBOX protocol
      - Huawei (hns3):
         - support for ethtool pfc_prevention_tout
      - nVidia/Mellanox:
         - support sharing bandwidth control across interfaces
           of the same device
      - Marvell (octeontx2-pf):
         - link RQ page pools to netdev for Netlink stats
      - Google vNIC:
         - XDP metadata support for DQ RDA
      - Microsoft vNIC:
         - support forcing full-page RX buffers

   - Other NICs:
      - Synopsys IP:
         - eic7700: support for eth1
      - Microchip (lan743x):
         - support for RMII interface
      - Wangxun:
         - support for ethtool -G and -C for VFs
         - add Tx timeout and PCIe error handling
      - Intel (igb/igc):
         - RSS key get/set support
         - support for forcing link speed without auto-negotiation

   - Switches:
      - NXP (dpaa2):
         - support bonding/LAG offload
      - Mediatek:
         - mt7530: EN7528 support
         - initial support for MT7628
      - Micrel (ksz8/9):
         - refactoring work to move towards library model
         - PTP support for KSZ8463
      - nVidia/Mellanox:
         - support rtnl-lock-less ethtool callbacks
      - Realtek:
         - rtl8366rb: use generic RTL83xx code
         - support SGMII and HSGMII for RTL8367S

   - PHYs:
      - Airoha:
         - EcoNet EN7528 PHY support
      - DAPU Telecom
         - DAPU Telecom DAP8211R(I) Gigabit PHY support
      - Realtek:
         - support RTL8261C_CG
         - support RTL8261D

  Wireless:

   - nl80211: per-link statistics support for multi-link operation

   - mac80211: AQL/airtime-fairness support for multicast

   - Merge Peripheral Authentication Service (PAS) / TEE support for
     ath12k (shared branch with the firmware/qcom tree)

   - New drivers:
      - mm81x for Morse Micro Long-Range S1G devices
      - nxpwifi for NXP devices (mostly forked off from mwifiex)

   - Driver changes:
      - Broadcom (brcmfmac):
         - DPP support, some Cypress part update
      - MediaTek (mt76):
         - mt7928 support
         - mt7925 NAN support
         - mt7996 AP powersave improvements
      - Qualcomm (ath12k):
         - much kernel infrastructure integration work
         - AHB platform MultiPD support
      - Realtek (rt89):
         - LED support
         - RTL8922DE support
         - dual-BT coex for RTL8922D
      - Intel:
         - new FW version support

  Bluetooth:

   - HCI: add support for Shorter Connection Interval (SCI) feature

   - af_bluetooth: add minimal context analysis annotations

   - Driver changes:
      - Intel:
         - add Bluetooth SAR revision 2 support
         - add vendor_reset PCI sysfs for PLDR
      - Mediatek:
         - add USB IDs for MT7902 and MT7922 devices
      - Realtek:
         - add USB IDs for 8761CU and 8852BE devices
      - NXP:
         - add M.2 Bluetooth device support using pwrseq

  Misc:

   - DPLL support for manual/numerical oscillator control (NCO)
     (implement in zl3073x)

   - MCTP support for MCTP over USB v1.1 (DMTF DSP0283)

   - Power-over-Ethernet: support Realtek PSE controllers

   - Remove the IBM EHEA driver

   - Remove tulip/xircom_cb driver"

* tag 'net-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next: (1433 commits)
  net/mlx5e: do not HW-GRO coalesce small frames
  net: openvswitch: fix nf_connlabels leak in ovs_ct_init
  net: add missing ref_tracker_dir_exit() to alloc_netdev_mqs()
  net: openvswitch: fix flow mask use-after-free on flow deletion
  sctp: stop processing a packet once its association is deleted
  dpll: zl3073x: add PTP clock support
  dpll: zl3073x: add channel ToD, phase step and TIE operations
  dpll: zl3073x: scale poll interval proportionally to timeout
  ptp: vmclock: prevent read-only mappings from becoming writable
  ipv4: reject undersized MTUs in ip_do_fragment()
  bonding: initialize err for empty target lists
  net: dsa: initial support for MT7628 embedded switch
  net: dsa: initial MT7628 tagging driver
  net: phy: mediatek: add phy driver for MT7628 built-in Fast Ethernet PHYs
  dt-bindings: net: dsa: add MT7628 ESW
  net: pse-pd: realtek-pse-mcu: add UART transport
  net: pse-pd: realtek-pse-mcu: add I2C transport
  net: pse-pd: add Realtek PSE MCU core
  dt-bindings: net: pse-pd: add bindings for Realtek PSE MCU
  vsock: use sock_error() to consume sk_err after a failed connect
  ...
2026-08-20 08:16:04 -07:00
Linus Torvalds
762fffa407 Generic interrupt subsystem updates:
- Remove pointless NULL checks of the kstats_irqs field. That's a
    historical left over and not longer required.
 
  - Add Radu Rendec as reviewer. Radu thankfully stepped up to help
    reviewing the interrupt core and the related drivers code.
 
  - The usual small improvements and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCtM8QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoV4SD/465axAMEli+6LbBcxWVmX1SCUasn+VM/2g
 VUUPONEDuf/Ucig+OC1QlvfZ/5d9pLiIwh3TakWPbkFtZpyfi60KiEQw5OW67TYB
 5TYgJI8BquIAQGzjUCKIzZmEvQhbuJzRjz07CIZnCtQBK3b/ftSDCwm6ynhhYRQC
 5yX/ay84pHPCyWVupkXV8jwjFm6v28U17j8TVd2VwEIOrEBa8dbOxOqUlRzrjbwE
 2dmo7r3BPSpyI/VpYiOW3wEXYq03+sR3MTNXQ9VWqLVcaUJUdDnbTnXqMbaXpGcO
 oV4vnuPv2Ah2TkB8xF9KTcyCKJbS2BKb5BtUXEJBQ/kPnB1wD712N2oZNuaN3omF
 SM4QoWojDpNPrPYWG99T4sNbemxfiyhIJzPSE/SgE6g0cWxh3d3wh5VfOnkp4ige
 gZKHVz7EcpjcyVz4xgYhaZk+7FmzAb6FMi4UhLZ9KHbAhdH87LSDDxvcUua2X3Js
 v1RdV3pkH1M3tBcLfO0D1neGL4VCL9zs8Ldf0jJBvcOy8kmjcs4uCll54hEbCQwI
 N7Qt7JF/r1LwxJRMC4OzsXp2upCbT5gaCOeG2HJuQUSy//0RL72NzjQe4cJSw5ya
 5Xnv5d/6L+hnwkOo7LPp9JYORXZ673D/vQgBg9Nf64Iz0i9SWnNB/fsmiSoTjw/c
 ZmqKGgEyHA==
 =6wX8
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull generic interrupt subsystem updates from Thomas Gleixner:

 - Remove pointless NULL checks of the kstats_irqs field. That's a
   historical left over and not longer required.

 - Add Radu Rendec as reviewer. Radu thankfully stepped up to help
   reviewing the interrupt core and the related drivers code.

 - The usual small improvements and fixes

* tag 'irq-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  MAINTAINERS: Add Radu Rendec as reviewer for the interrupt subsystem
  genirq/msi: Move misplaced EXPORT_SYMBOL_GPL for msi_domain_free_irqs_all()
  parisc: Remove unnecessary NULL check of the kstat_irqs field
  genirq: Remove unnecessary NULL check of the kstat_irqs field
  irqdomain: Remove unnedded NULL check in __irq_domain_[de]activate_irq()
  genirq/manage: Use irqd_get_parent_data() helper in __irq_get_irqchip_state()
  irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path
2026-08-18 15:19:50 -07:00
Lyude Paul
07a88e2bcd irq: Add KUnit test for refcounted interrupt enable/disable
While making changes to the refcounted interrupt patch series, at some
point on my local branch I broke something and ended up writing some kunit
tests for testing refcounted interrupts as a result. So, let's include
these tests now that we have refcounted interrupts.

Signed-off-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Boqun Feng <boqun@kernel.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/20260804161447.84806-7-boqun@kernel.org
2026-08-10 10:50:18 +02:00
Li RongQing
68d47be8ea genirq/msi: Move misplaced EXPORT_SYMBOL_GPL for msi_domain_free_irqs_all()
EXPORT_SYMBOL_GPL(msi_domain_free_irqs_all) was mistakenly placed after
msi_domain_free_irqs_range() instead of after its intended function
msi_domain_free_irqs_all().

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260717143157.1718-1-lirongqing@baidu.com
2026-07-20 11:23:00 +02:00
Radu Rendec
57d1220979 genirq: Remove unnecessary NULL check of the kstat_irqs field
The kstat_irqs field of struct irq_desc is used to store a per-cpu count
of interrupt events. It is initialized in init_desc(), along with all
the other fields in struct irq_desc that need explicit initialization,
and therefore it's always available (non-NULL) for any valid interrupt
descriptor (with a caveat - see below).

When CONFIG_SPARSE_IRQ is enabled, all interrupt descriptors are always
allocated dynamically via alloc_desc(), which calls init_desc(), so in
that case kstat_irqs is guaranteed to be non-NULL before a valid struct
irq_desc pointer is even returned.

By contrast, when CONFIG_SPARSE_IRQ is disabled, interrupt descriptors
are allocated statically in the irq_desc[] array, and kstat_irqs is
initialized implicitly to NULL. The per-cpu pointer is initialized only
later, for all descriptors, via start_kernel() -> early_irq_init() ->
init_desc().

The kstat_irqs field is used mostly for printing interrupt statistics
(i.e. reading /proc/interrupts), and that cannot happen until much
later, when user-space is fully initialized. So, there is no concern
with that use case.

The list below includes all functions where the NULL check is removed,
along with a list of all possible call chains and/or a brief explanation
of why it's safe to remove the NULL check in that case.

  * irq_desc_kstat_cpu() [include/linux/irqdesc.h]
    - All direct call sites use it for printing IRQ statistics.

    - Indirect call site: per_cpu_count_show() - also used for printing
      interruptstatistics.

  * kstat_irqs_cpu() [kernel/irq/irqdesc.c]
    - Called by sun3_int7() and sun3_int5() [arch/m68k/sun3/sun3ints.c]
      These are interrupt handlers and cannot be called until their
      corresponding interrupts are initialized in sun3_init_IRQ(). The
      call chain leading to that is:
        start_kernel() -> init_IRQ() [arch/m68k/kernel/ints.c] ->
        mach_init_IRQ = sun3_init_IRQ()
      The init_IRQ() call happens right *after* the early_irq_init() call,
      which means the descriptors are already fully initialized by the
      time the interrupt handlers are even registered.

    - Called by show_interrupts() [arch/s390/kernel/irq.c] - used for
      printing interrupt statistics.

  * kstat_irqs() [kernel/irq/irqdesc.c]
      The only possible call chain is via fs/proc/stat.c:
      stat_open() -> show_stat() -> show_all_irqs() -> kstat_irqs_usr() ->
      kstat_irqs()
      It is used for printing interrupt statistics.

  * kstat_snapshot_irqs()
      The only possible call chain is via kernel/watchdog.c:
        watchdog_timer_fn() -> is_softlockup() -> start_counting_irqs() ->
        kstat_snapshot_irqs()
      The watchdog timer cannot fire early, before early_irq_init().

  * kstat_get_irq_since_snapshot()
      The only possible call chain is via kernel/watchdog.c:
        watchdog_timer_fn() -> report_cpu_status() -> print_irq_counts() ->
        kstat_get_irq_since_snapshot()
      The watchdog timer cannot fire early, before early_irq_init().

Signed-off-by: Radu Rendec <radu@rendec.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260705210951.2717741-2-radu@rendec.net
2026-07-07 21:36:18 +02:00
Hangtian Zhu
25e638447e genirq: export irq_can_set_affinity() for module drivers
Export irq_can_set_affinity() for loadable drivers that need a runtime
check for IRQ affinity capability.

In hierarchical IRQ setups where the effective irqchip path lacks
.irq_set_affinity(), drivers may need to switch to a fallback policy.
Without this export, module drivers cannot use the core helper and have
to open-code equivalent checks.

Signed-off-by: Hangtian Zhu <hangtian.zhu@oss.qualcomm.com>
Acked-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260519011627.713068-2-hangtian.zhu@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
2026-06-30 14:20:20 -07:00
Kemeng Shi
491ee67755 irqdomain: Remove unnedded NULL check in __irq_domain_[de]activate_irq()
The callers already have a valid irq_data pointer, so the NULL checks in
__irq_domain_[de]activate_irq() is redundant.

Remove it.

[ tglx: Massage changelog, fix subject prefix ]

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623075134.4432-4-shikemeng@huaweicloud.com
2026-06-29 15:42:26 +02:00
Kemeng Shi
c5a0cfa07c genirq/manage: Use irqd_get_parent_data() helper in __irq_get_irqchip_state()
Replace the open coded version of it.

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623075134.4432-3-shikemeng@huaweicloud.com
2026-06-29 15:42:26 +02:00
Kemeng Shi
13856e2221 irqdomain: Plug leak in irq_domain_alloc_irqs_locked() error path
When irq_domain_trim_hierarchy() fails in irq_domain_alloc_irqs_locked(),
the error handling path fails to undo the hierarchy allocations.

Add the missing cleanup.

[ tglx: Massage change log ]

Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260623075134.4432-2-shikemeng@huaweicloud.com
2026-06-29 15:42:26 +02:00
Ethan Nelson-Moore
865730eec5 genirq/msi: Correct CONFIG_PCI_MSI_ARCH_FALLBACKS macro name in comment
A comment in kernel/irq/msi.c incorrectly refers to
CONFIG_PCI_MSI_ARCH_FALLBACK instead of CONFIG_PCI_MSI_ARCH_FALLBACKS.
Correct it.

Discovered while searching for CONFIG_* symbols referenced in code but
not defined in any Kconfig file.

Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260613213544.90613-1-enelsonmoore@gmail.com
2026-06-22 22:32:01 +02:00
Linus Torvalds
764e77d868 Locking updates for v7.2:
Futex updates:
 
  - Optimize futex hash bucket access patterns (Peter Zijlstra)
 
  - Large series to address the robust futex unlock race for real,
    by Thomas Gleixner:
 
     "The robust futex unlock mechanism is racy in respect
      to the clearing of the robust_list_head::list_op_pending
      pointer because unlock and clearing the pointer are not
      atomic. The race window is between the unlock and clearing the
      pending op pointer. If the task is forced to exit in this
      window, exit will access a potentially invalid pending op
      pointer when cleaning up the robust list. That happens if
      another task manages to unmap the object containing the lock
      before the cleanup, which results in an UAF. In the worst case
      this UAF can lead to memory corruption when unrelated content
      has been mapped to the same address by the time the access
      happens.
 
      User space can't solve this problem without help from the kernel.
      This series provides the kernel side infrastructure to help it
      along:
 
       1) Combined unlock, pointer clearing, wake-up for the
          contended case
 
       2) VDSO based unlock and pointer clearing helpers with a
          fix-up function in the kernel when user space was interrupted
          within the critical section.
 
     ... with help by André Almeida:
 
      - Add a note about robust list race condition (André Almeida)
      - Add self-tests for robust release operations (André Almeida)
 
 Context analysis updates:
 
  - Implement context analysis for 'struct rt_mutex'.
    (Bart Van Assche)
  - Bump required Clang version to 23 (Marco Elver)
 
 Guard infrastructure updates:
 
  - Series to remove NULL check from unconditional guards
    (Dmitry Ilvokhin)
 
 Lockdep updates:
 
  - Restore self-test migrate_disable() and sched_rt_mutex
    state on PREEMPT_RT (Karl Mehltretter)
 
 Membarriers updates:
 
  - Use per-CPU mutexes for targeted commands (Aniket Gattani)
  - Modernize membarrier_global_expedited with cleanup guards
    (Aniket Gattani)
  - Add rseq stress test for CFS throttle interactions (Aniket Gattani)
 
 percpu-rwsems updates:
 
  - Extract __percpu_up_read() to optimize inlining overhead
    (Dmitry Ilvokhin)
 
 Seqlocks updates:
 
  - Allow UBSAN_ALIGNMENT to fail optimizing (Heiko Carstens)
 
 Lock tracing:
 
  - Add contended_release tracepoint to sleepable locks
    such as mutexes, percpu-rwsems, rtmutexes, rwsems
    and semaphores. (Dmitry Ilvokhin)
 
 MAINTAINERS updates:
 
  - MAINTAINERS: Add RUST [SYNC] entry (Boqun Feng)
 
 Misc updates and fixes by Randy Dunlap, YE WEI-HONG,
 Fabricio Parra, Dmitry Ilvokhin and Peter Zijlstra.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmoujYURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jQFw//SNo1zxqGJuVudIWTpk5hUbWO6La9dc2C
 2RW4lMNM551AaGFK6V01u1hD7dBZkWBqER+f3+CMtkqi734pAevTfkYJOitnGOOX
 YZicGqTufV+Q+hcEiHAY3ADF6384SiyvAGNHL5wk3eLqC+Raug0f0cNt4opzFvr7
 I6vRcW02JQMRKBe50+Aoa5zg7ymmbqaH0KkiPvfY5UFl38MKABhkY1izA9o+/Q/S
 1/joNo5iQ3Ciqf6tn76vTg4Xiz7napikHB5LfWxorgmQo7FEdUY54GGMaa8aBOPi
 EfgIV9p+qOJhmWn4H1HgVSYlnUn3tJICYnVVCruXWXD+pzITS+F5qSQ3p25F3VIt
 c3jh3NaVW71pR/Sbj4zGvf8QguJL340RGJs/e5qcj91pjOSCH5B75ruNgFgYK9Lv
 iRi6dnHBBHxaN57YHTOrhphvjyfc0L7i6cGyJgHJWwyi0y3XBYlNuP/VLPuwquKl
 anK86hlkl9W4kO0OOukD1xhfuRv7066EdJc3iWWlp9yz+yI5xDGuV4FhvEHRoy38
 R9VY2bwzgZrW/NkodHIb95+W30qEmeq2z1W4wiBu+mf1JnyW2g/n8jKkc6AINMpI
 VGcom3MdinxjUtmybZT9Fx0SzBYCc+aRPkh7lPV7eXdZAWufxUO/6eVKiHBQ2HUO
 RFDkOZU0r+c=
 =gpHw
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:
 "Futex updates:

   - Optimize futex hash bucket access patterns (Peter Zijlstra)

   - Large series to address the robust futex unlock race for real, by
     Thomas Gleixner:

      "The robust futex unlock mechanism is racy in respect to the
       clearing of the robust_list_head::list_op_pending pointer because
       unlock and clearing the pointer are not atomic.

       The race window is between the unlock and clearing the pending op
       pointer. If the task is forced to exit in this window, exit will
       access a potentially invalid pending op pointer when cleaning up
       the robust list.

       That happens if another task manages to unmap the object
       containing the lock before the cleanup, which results in an UAF.

       In the worst case this UAF can lead to memory corruption when
       unrelated content has been mapped to the same address by the time
       the access happens.

       User space can't solve this problem without help from the kernel.
       This series provides the kernel side infrastructure to help it
       along:

        1) Combined unlock, pointer clearing, wake-up for the
           contended case

        2) VDSO based unlock and pointer clearing helpers with a
           fix-up function in the kernel when user space was interrupted
           within the critical section.

      ... with help by André Almeida:

        - Add a note about robust list race condition (André Almeida)
        - Add self-tests for robust release operations (André Almeida)

  Context analysis updates:

   - Implement context analysis for 'struct rt_mutex'. (Bart Van Assche)
   - Bump required Clang version to 23 (Marco Elver)

  Guard infrastructure updates:

   - Series to remove NULL check from unconditional guards (Dmitry
     Ilvokhin)

  Lockdep updates:

   - Restore self-test migrate_disable() and sched_rt_mutex state on
     PREEMPT_RT (Karl Mehltretter)

  Membarriers updates:

   - Use per-CPU mutexes for targeted commands (Aniket Gattani)
   - Modernize membarrier_global_expedited with cleanup guards (Aniket
     Gattani)
   - Add rseq stress test for CFS throttle interactions (Aniket Gattani)

  percpu-rwsems updates:

   - Extract __percpu_up_read() to optimize inlining overhead (Dmitry
     Ilvokhin)

  Seqlocks updates:

   - Allow UBSAN_ALIGNMENT to fail optimizing (Heiko Carstens)

  Lock tracing:

   - Add contended_release tracepoint to sleepable locks such as
     mutexes, percpu-rwsems, rtmutexes, rwsems and semaphores (Dmitry
     Ilvokhin)

  MAINTAINERS updates:

   - MAINTAINERS: Add RUST [SYNC] entry (Boqun Feng)

  Misc updates and fixes by Randy Dunlap, YE WEI-HONG, Fabricio Parra,
  Dmitry Ilvokhin and Peter Zijlstra"

* tag 'locking-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (36 commits)
  locking: Add contended_release tracepoint to sleepable locks
  locking/percpu-rwsem: Extract __percpu_up_read()
  tracing/lock: Remove unnecessary linux/sched.h include
  futex: Optimize futex hash bucket access patterns
  rust: sync: completion: Mark inline complete_all and wait_for_completion
  MAINTAINERS: Add RUST [SYNC] entry
  cleanup: Specify nonnull argument index
  selftests: futex: Add tests for robust release operations
  Documentation: futex: Add a note about robust list race condition
  x86/vdso: Implement __vdso_futex_robust_try_unlock()
  x86/vdso: Prepare for robust futex unlock support
  futex: Provide infrastructure to plug the non contended robust futex unlock race
  futex: Add robust futex unlock IP range
  futex: Add support for unlocking robust futexes
  futex: Cleanup UAPI defines
  x86: Select ARCH_MEMORY_ORDER_TSO
  uaccess: Provide unsafe_atomic_store_release_user()
  futex: Provide UABI defines for robust list entry modifiers
  futex: Move futex related mm_struct data into a struct
  futex: Make futex_mm_init() void
  ...
2026-06-15 14:21:14 +05:30
Linus Torvalds
13e1a6d6a1 Interrupt core code changes:
- Rework of /proc/interrupt handling:
 
       /proc/interrupts was subject to micro optimizations for a long time,
       but most of the low hanging fruit was left on the table. This rework
       addresses the major time consuming issues:
 
         - Printing a long series of zeros one by one via a format string
           instead of counting subsequent zeros and emitting a string
           constant.
 
         - Simplify and cache the conditions whether interrupts should be printed
 
 	- Use a proper iteration over the interrupt descriptor xarray
           instead of walking and testing one by one.
 
         - Provide helper functions for the architecture code to emit the
           architecture specific counters
 
 	- Convert the counter structure in x86 to an array, which
           simplifies the output and add mechanisms to suppress unused
           architecture interrupts, which just occupy space for
           nothing. Adopt the new core mechanisms.
 
       This adjusts the gdb scripts related to interrupt counter statitics
       to work with the new mechanisms.
 
     - Prevent a string overflow in the /proc/irq/$N/ directory name
       creation code.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmoths8QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoSoMEACRODwHjNfULjgD2heHbiPKsmPMRZvwO1Ud
 xu5XAoNT1gwxnLo4D+KrGCZeyxka+byRpby6eNg7HdRJuu3DUf8umwt/Q472I9a9
 ck8OGFp8ntbxnueISKfzxY/O2eXHYxSKmmfZMv3wdOKbvn5OUlFT6eHPjb8PzVUM
 7DiXsBL8s3MNHwdJ3grG5lBh60pt5fujzURwYAqvh/i8jlDHxsFRTMGuhR710knr
 YZrgZ4/7ffnEbDsn98xezPewRomIbhhEijgfjkkbnYYUub6Y2RHJqOzZhlp6zNgi
 vTsU/suW3ryVuzG34rL2uHvsxOcJY1HNA+ING7fkRmPuKxRGKOMBQfPmLQcWqP69
 GxwGIlBvNbAEYievgTCS7GNHTy3t0JbxTGhHcBvX3oMtnnOSTttqH9XzvrTwGxjj
 fMUykfvB+40Fp47D+t0JDhgyNNEkixSBjW8/gogZFQ0OdMFX6BQZNT/DLhMMC0LR
 JbqMpfsffp5+gYam/wixv3sPlxajMpQ2w8ocgyUHVAeFMo1LOY1spUuO3+Tq7nSj
 xt95xVg6HQDr+L+8QmZmnRq27uG276CxPpLotbPMsrn0Ax5PL+fymfmVsFmJFjAR
 ZHKK3tSD6M94GtklfKlB/yBJGNRafH4MVZbMa0iUxGI6UyAFr/Yror3mfDK9NsIA
 WTwwaqI8qw==
 =z6vj
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull interrupt core updates from Thomas Gleixner:

  - Rework of /proc/interrupt handling:

    /proc/interrupts was subject to micro optimizations for a long time,
    but most of the low hanging fruit was left on the table. This rework
    addresses the major time consuming issues:

      - Printing a long series of zeros one by one via a format string
        instead of counting subsequent zeros and emitting a string
        constant.

      - Simplify and cache the conditions whether interrupts should be
        printed

      - Use a proper iteration over the interrupt descriptor xarray
        instead of walking and testing one by one.

      - Provide helper functions for the architecture code to emit the
        architecture specific counters

      - Convert the counter structure in x86 to an array, which
        simplifies the output and add mechanisms to suppress unused
        architecture interrupts, which just occupy space for nothing.
        Adopt the new core mechanisms.

    This adjusts the gdb scripts related to interrupt counter statistics
    to work with the new mechanisms.

  - Prevent a string overflow in the /proc/irq/$N/ directory name
    creation code.

* tag 'irq-core-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/irq: Add missing 's' back to thermal event printout
  genirq/proc: Speed up /proc/interrupts iteration
  genirq/proc: Runtime size the chip name
  genirq: Expose irq_find_desc_at_or_after() in core code
  genirq: Add rcuref count to struct irq_desc
  genirq/proc: Increase default interrupt number precision to four
  genirq: Calculate precision only when required
  genirq: Cache the condition for /proc/interrupts exposure
  genirq/manage: Make NMI cleanup RT safe
  genirq: Expose nr_irqs in core code
  scripts/gdb: Update x86 interrupts to the array based storage
  x86/irq: Move IOAPIC misrouted and PIC/APIC error counts into irq_stats
  x86/irq: Suppress unlikely interrupt stats by default
  x86/irq: Make irqstats array based
  genirq/proc: Utilize irq_desc::tot_count to avoid evaluation
  genirq/proc: Avoid formatting zero counts in /proc/interrupts
  x86/irq: Optimize interrupts decimals printing
  genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
2026-06-15 13:19:41 +05:30
Dmitry Ilvokhin
08d4a7837f genirq: Move NULL check into irqdesc_lock guard unlock expression
irqdesc_lock uses __DEFINE_UNLOCK_GUARD() directly with a custom
constructor that can set .lock to NULL.

In preparation for removing the NULL check from __DEFINE_UNLOCK_GUARD(),
move the NULL check into the irqdesc_lock unlock expression, making the
NULL handling explicit at the call site.

No functional change.

Signed-off-by: Dmitry Ilvokhin <d@ilvokhin.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/ab457810653e4356e29b2d74ba616478bd9328ad.1780064327.git.d@ilvokhin.com
2026-06-03 11:38:47 +02:00
Thomas Gleixner
171cc0d9ee genirq/proc: Speed up /proc/interrupts iteration
Reading /proc/interrupts iterates over the interrupt number space one by
one and looks up the descriptors one by one. That's just a waste of time.

When CONFIG_GENERIC_IRQ_SHOW is enabled this can utilize the maple tree and
cache the descriptor pointer efficiently for the sequence file operations.

Implement a CONFIG_GENERIC_IRQ_SHOW specific version in the core code and
leave the fs/proc/ variant for the legacy architectures which ignore generic
code.

This reduces the time wasted for looking up the next record significantly.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/20260517194932.165280601@kernel.org
2026-05-26 16:21:15 +02:00
Thomas Gleixner
61b51a167c genirq/proc: Runtime size the chip name
The chip name column in the /proc/interrupt output is 8 characters and
right aligned, which causes visual clutter due to the fixed length and the
alignment. Many interrupt chips, e.g. PCI/MSI[X] have way longer names.

Update the length when a chip is assigned to an interrupt and utilize this
information for the output. Align it left so all chip names start at the
begin of the column.

Update the GDB script as well and disentangle the header maze so it
actually works with all .config combinations.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/20260517194932.085786035@kernel.org
2026-05-26 16:21:15 +02:00
Thomas Gleixner
7603e0575d genirq: Expose irq_find_desc_at_or_after() in core code
... in preparation for a smarter iterator for /proc/interrupts.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/20260517194932.005787611@kernel.org
2026-05-26 16:21:15 +02:00
Thomas Gleixner
1d9c4745bf genirq: Add rcuref count to struct irq_desc
Prepare for a smarter iterator for /proc/interrupts so that the next
interrupt descriptor can be cached after lookup.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Link: https://patch.msgid.link/20260517194931.917415190@kernel.org
2026-05-26 16:21:14 +02:00
Thomas Gleixner
34594da765 genirq/proc: Increase default interrupt number precision to four
Quite some architectures have four character wide acronyms for architecture
specific interrupts like IPI, NMI, etc.

The default precision of printing the Linux device interrupt numbers is
three, which causes quite some code to play games with adding or omitting
space after the acronym and the colon in order to keep the per CPU numbers
properly aligned.

Increase the default number precision to four in the core code and get rid
of the space games all over the place. At the same time align all
architecture specific descriptor texts left so that they show up in the
same column as the interrupt chip names, which makes the output more
uniform accross architectures. Fix up the GDB script to this new scheme as
well.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260517194931.839482411@kernel.org
2026-05-26 16:21:14 +02:00
Thomas Gleixner
2d62735f1d genirq: Calculate precision only when required
Calculating the precision of the interrupt number column on every initial
show_interrupt() invocation is a pointless exercise as the underlying
maximum number of interrupts rarely changes.

Calculate it only when that number is modified and let show_interrupts()
use the cached value.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260517194931.760664517@kernel.org
2026-05-26 16:21:14 +02:00
Thomas Gleixner
4892e5e71e genirq: Cache the condition for /proc/interrupts exposure
show_interrupts() evaluates a boatload of conditions to establish whether
it should expose an interrupt in /proc/interrupts or not.

That can be simplified by caching the condition in an internal status flag,
which is updated when one of the relevant inputs changes.

The irq_desc::kstat_irq check is dropped because visible interrupt
descriptors always have a valid pointer.

As a result the number of instructions and branches for reading
/proc/interrupts is reduced significantly.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260517194931.680943749@kernel.org
2026-05-26 16:21:13 +02:00
Thomas Gleixner
3ba92f6a28 genirq/manage: Make NMI cleanup RT safe
Eventually blocking functions cannot be invoked with interrupts disabled
and a raw spin lock held. Restructure the code so this happens outside of
the descriptor lock held region.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Link: https://patch.msgid.link/20260517194931.601972758@kernel.org
2026-05-26 16:21:13 +02:00
Thomas Gleixner
b99dc723b1 genirq: Expose nr_irqs in core code
... to avoid function calls in the core code to retrieve the maximum number
of interrupts.

Rename it to 'total_nr_irqs' as 'nr_irqs' is too generic and fix up the
'nr_irqs' reference in the related GDB script as well.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Link: https://patch.msgid.link/20260517194931.522168332@kernel.org
2026-05-26 16:21:13 +02:00
Thomas Gleixner
0179464391 genirq/proc: Utilize irq_desc::tot_count to avoid evaluation
Interrupts which are not marked per CPU increment not only the per CPU
statistics, but also the accumulation counter irq_desc::tot_count.

Change the counter to type unsigned long so it does not produce sporadic
zeros due to wrap arounds on 64-bit machines and do a quick check for non
per CPU interrupts. If the counter is zero, then simply emit a full set of
zero strings. That spares the evaluation of the per CPU counters completely
for interrupts with zero events.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Link: https://patch.msgid.link/20260517194931.115522199@kernel.org
2026-05-26 16:21:11 +02:00
Thomas Gleixner
95c33a64f2 genirq/proc: Avoid formatting zero counts in /proc/interrupts
A large portion of interrupt count entries are zero. There is no point in
formatting the zero value as it is way cheeper to just emit a constant
string.

Collect the number of consecutive zero counts and emit them in one go
before a non-zero count and at the end of the line.

Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Tested-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Dmitry Ilvokhin <d@ilvokhin.com>
Reviewed-by: Radu Rendec <radu@rendec.net>
Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com>
Link: https://patch.msgid.link/20260517194931.034728540@kernel.org
2026-05-26 16:21:11 +02:00
Pengpeng Hou
c2c7983c93 genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
/proc/irq/<n>/ directory names are built in `char name[10]` buffers
with `sprintf(name, "%u", irq)`.

Ten-digit IRQ numbers already need 11 bytes including the trailing NUL, and
current sparse-IRQ configurations allow interrupt numbers in that range.

Size the temporary name buffer for the current decimal form and switch
to bounded formatting when creating or removing the proc entry.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260404101001.1-genirq-proc-pengpeng@iscas.ac.cn
2026-05-11 16:32:30 +02:00
Mark Rutland
512718bbc5 genirq/chip: Don't call add_interrupt_randomness() for NMIs
Recently handle_percpu_devid_irq() was changed to call
add_interrupt_randomness(). This introduced a potential deadlock when
handle_percpu_devid_irq() is used to handle an NMI, which can be
detected with lockdep, e.g.

    ================================
    WARNING: inconsistent lock state
    7.1.0-rc2-pnmi #465 Not tainted
    --------------------------------
    inconsistent {INITIAL USE} -> {IN-NMI} usage.
    perf/695 [HC1[1]:SC0[0]:HE0:SE1] takes:
    ffff00837dfd3a18 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x6c/0xac
    {INITIAL USE} state was registered at:
      _raw_spin_lock_irqsave+0x68/0xb0
      lock_timer_base+0x6c/0xac
      __mod_timer+0x100/0x32c
      add_timer_global+0x2c/0x40
      __queue_delayed_work+0xf0/0x140
      queue_delayed_work_on+0x134/0x138
      mem_cgroup_css_online+0x30c/0x310
      online_css+0x34/0x10c
      cgroup_init_subsys+0x158/0x1c8
      cgroup_init+0x440/0x524
      start_kernel+0x888/0x998

    other info that might help us debug this:
    Possible unsafe locking scenario:
           CPU0
           ----
      lock(&base->lock);
      <Interrupt>
        lock(&base->lock);
        *** DEADLOCK ***

    Call trace:
     _raw_spin_lock_irqsave+0x68/0xb0
     lock_timer_base+0x6c/0xac
     add_timer_on+0x78/0x16c
     add_interrupt_randomness+0x124/0x134
     handle_percpu_devid_irq+0xd4/0x16c
     handle_irq_desc+0x40/0x58
     generic_handle_domain_nmi+0x28/0x50
     __gic_handle_nmi.isra.0+0x4c/0xa0
     gic_handle_irq+0x38/0x2bc
     call_on_irq_stack+0x30/0x48
     do_interrupt_handler+0x80/0x98
     el1_interrupt+0x90/0xac
     el1h_64_irq_handler+0x18/0x24
     el1h_64_irq+0x80/0x84
     [...]

During review, Thomas pointed out it wouldn't be safe for
handle_percpu_devid_irq() to call add_interrupt_randomness() if it was
used to handle NMIs:

  https://lore.kernel.org/lkml/87bjgik042.ffs@tglx/

... but evidently people missed that handle_percpu_devid_irq() *is* used
for NMIs.

While it might seem that NMIs should be handled with a separate
handle_percpu_devid_nmi() function, for various structural reasons this was
impractical, and handle_percpu_devid_irq() has been expected to be used for
NMIs since commits:

  21bbbc50f3 ("irqchip/gic-v3: Switch high priority PPIs over to handle_percpu_devid_irq()")
  5ff78c8de9 ("genirq: Kill handle_percpu_devid_fasteoi_nmi()")

Taking the above into account, avoid the deadlock by not calling
add_interrupt_randomness() when handle_percpu_devid_irq() is called in an
NMI context. This is consistent with other NNI handling flows, which do not
call add_interrupt_randomness().

At the same time, update the kernel-doc comment to make it clear that
handle_percpu_devid_irq() can be called in NMI context. The rest of
handle_percpu_devid_irq() is currently NMI safe and doesn't need to change.

Fixes: fd7400cfcb ("genirq/chip: Invoke add_interrupt_randomness() in handle_percpu_devid_irq()")
Reported-by: Ada Couprie Diaz <ada.coupriediaz@arm.com>
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260507110518.3128248-1-mark.rutland@arm.com
2026-05-11 14:56:04 +02:00
Michael Kelley
fd7400cfcb genirq/chip: Invoke add_interrupt_randomness() in handle_percpu_devid_irq()
handle_percpu_devid_irq() is a version of handle_percpu_irq() but with the
addition of a pointer to a per-CPU devid.

However, handle_percpu_irq() invokes add_interrupt_randomness(), while
handle_percpu_devid_irq() currently does not.

Add the missing add_interrupt_randomness(), as it is needed when per-CPU
interrupts with devid's are used in VMs for interrupts from the hypervisor.

Signed-off-by: Michael Kelley <mhklinux@outlook.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260402202400.1707-2-mhklkml@zohomail.com
2026-04-02 23:03:29 +02:00
Sebastian Andrzej Siewior
34d85ad426 genirq/affinity: Remove cpus_read_lock() while reading cpu_possible_mask
cpu_possible_mask is set early during boot based on information from the
firmware. After that it remains read only and is never changed.  Therefore
there is no need to acquire the CPU-hotplug lock while reading it.

Remove cpus_read_*() while accessing cpu_possible_mask.

Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260401121334.xeMOSC1v@linutronix.de
2026-04-01 16:09:05 +02:00
Nam Cao
56c167a0c0 genirq/matrix, LoongArch: Delete IRQ_MATRIX_BITS leftovers
Delete IRQ_MATRIX_BITS leftovers after commit 5b98d210ac ("genirq/matrix:
Dynamic bitmap allocation") has made IRQ_MATRIX_BITS obsolete.

Signed-off-by: Nam Cao <namcao@linutronix.de>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Link: https://patch.msgid.link/20260316072850.467995-1-namcao@linutronix.de
2026-03-17 10:57:03 +01:00
Linus Torvalds
323bbfcf1e Convert 'alloc_flex' family to use the new default GFP_KERNEL argument
This is the exact same thing as the 'alloc_obj()' version, only much
smaller because there are a lot fewer users of the *alloc_flex()
interface.

As with alloc_obj() version, this was done entirely with mindless brute
force, using the same script, except using 'flex' in the pattern rather
than 'objs*'.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Linus Torvalds
bf4afc53b7 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Kees Cook
69050f8d6d treewide: Replace kmalloc with kmalloc_obj for non-scalar types
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-21 01:02:28 -08:00
Linus Torvalds
1c2b4a4c2b pci-v7.0-changes
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmmKJO4UHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vzotA/+OGSOPOs9hWd+OwNF5Dm2WA81yG/3
 K3Jx5uMuPoSjduMbPhVcib02Mr6YDJTa6WlYNVa76ADs2G6HxcVMFHutlYudSVcl
 umSF48FnyeH1LTba88dRoVj4DB47Cue+BfhYY2L0ZtxmjQq/NRuDFAaGBh54uNeF
 Gcdgr52QlM01n1X6yKvl7vE9gPdcPH80L256ssHAm6oSOHI1SPc6gqEKUUD02f8G
 FtzfTUAq/cWYjlY3VoS5GKtdHxFYuXqC5WfbURhJ11o/nVJY9k1Zx8n4eI1tmAtN
 7q692xjWSQJZlzepOBBEyjFUpIiy80tZ43z2ptRRBeI/n/qMmGPAov/g4MzegBWG
 IAEHTAp/xx1Wra1ynr7RNvYVcPpXm2TEim8gIGah9DkHbNgbu7ing+OO7DnQuyfD
 2h4hGD2622o6uikqkwzVd4mYuIcFu7SA6yROZhFn83BRnz0QOQienDrDlvOB8XCV
 EodLAOMc2KClvOmmriFMy11PH7MFFoXexV6KS83VfDJHi4+XzBsy0w6TXTohcA9s
 JTPIkSWqf/u6SrdLjXlFGyyJ2/KCgRiXFIBhhtYBMhDuuO7nG+mcSVzMa1PT0s6C
 PF+QoT7sJof/5VMJ4o3BgPrPkD3CQICrlt8XIt5I8ngsy6RZRQ5rt+pUix7Shcn8
 DgcunuINYfQtkfw=
 =LIjp
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.0-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull PCI updates from Bjorn Helgaas:
 "Enumeration:

   - Don't try to enable Extended Tags on VFs since that bit is Reserved
     and causes misleading log messages (Håkon Bugge)

   - Initialize Endpoint Read Completion Boundary to match Root Port,
     regardless of ACPI _HPX (Håkon Bugge)

   - Apply _HPX PCIe Setting Record only to AER configuration, and only
     when OS owns PCIe hotplug but not AER, to avoid clobbering Extended
     Tag and Relaxed Ordering settings (Håkon Bugge)

  Resource management:

   - Move CardBus code to setup-cardbus.c and only build it when
     CONFIG_CARDBUS is set (Ilpo Järvinen)

   - Fix bridge window alignment with optional resources, where
     additional alignment requirement was previously lost (Ilpo
     Järvinen)

   - Stop over-estimating bridge window size since they are now assigned
     without any gaps between them (Ilpo Järvinen)

   - Increase resource MAX_IORES_LEVEL to avoid /proc/iomem flattening
     for nested bridges and endpoints (Ilpo Järvinen)

   - Add pbus_mem_size_optional() to handle sizes of optional resources
     (SR-IOV VF BARs, expansion ROMs, bridge windows) (Ilpo Järvinen)

   - Don't claim disabled bridge windows to avoid spurious claim
     failures (Ilpo Järvinen)

  Driver binding:

   - Fix device reference leak in pcie_port_remove_service() (Uwe
     Kleine-König)

   - Move pcie_port_bus_match() and pcie_port_bus_type to PCIe-specific
     portdrv.c (Uwe Kleine-König)

   - Convert portdrv to use pcie_port_bus_type.probe() and .remove()
     callbacks so .probe() and .remove() can eventually be removed from
     struct device_driver (Uwe Kleine-König)

  Error handling:

   - Clear stale errors on reporting agents upon probe so they don't
     look like recent errors (Lukas Wunner)

   - Add generic RAS tracepoint for hotplug events (Shuai Xue)

   - Add RAS tracepoint for link speed changes (Shuai Xue)

  Power management:

   - Avoid redundant delay on transition from D3hot to D3cold if the
     device was already in D3hot (Brian Norris)

   - Prevent runtime suspend until devices are fully initialized to
     avoid saving incompletely configured device state (Brian Norris)

  Power control:

   - Add power_on/off callbacks with generic signature to pwrseq,
     tc9563, and slot drivers so they can be used by pwrctrl core
     (Manivannan Sadhasivam)

   - Add PCIe M.2 connector support to the slot pwrctrl driver
     (Manivannan Sadhasivam)

   - Switch to pwrctrl interfaces to create, destroy, and power on/off
     devices, calling them from host controller drivers instead of the
     PCI core (Manivannan Sadhasivam)

   - Drop qcom .assert_perst() callbacks since this is now done by the
     controller driver instead of the pwrctrl driver (Manivannan
     Sadhasivam)

  Virtualization:

   - Remove an incorrect unlock in pci_slot_trylock() error handling
     (Jinhui Guo)

   - Lock the bridge device for slot reset (Keith Busch)

   - Enable ACS after IOMMU configuration on OF platforms so ACS is
     enabled an all devices; previously the first device enumerated
     (typically a Root Port) didn't have ACS enabled (Manivannan
     Sadhasivam)

   - Disable ACS Source Validation for IDT 0x80b5 and 0x8090 switches to
     work around hardware erratum; previously ACS SV was only
     temporarily disabled, which worked for enumeration but not after
     reset (Manivannan Sadhasivam)

  Peer-to-peer DMA:

   - Release per-CPU pgmap ref when vm_insert_page() fails to avoid hang
     when removing the PCI device (Hou Tao)

   - Remove incorrect p2pmem_alloc_mmap() warning about page refcount
     (Hou Tao)

  Endpoint framework:

   - Add configfs sub-groups synchronously to avoid NULL pointer
     dereference when racing with removal (Liu Song)

   - Fix swapped parameters in pci_{primary/secondary}_epc_epf_unlink()
     functions (Manikanta Maddireddy)

  ASPEED PCIe controller driver:

   - Add ASPEED Root Complex DT binding and driver (Jacky Chou)

  Freescale i.MX6 PCIe controller driver:

   - Add DT binding and driver support for an optional external refclock
     in addition to the refclock from the internal PLL (Richard Zhu)

   - Fix CLKREQ# control so host asserts it during enumeration and
     Endpoints can use it afterwards to exit the L1.2 link state
     (Richard Zhu)

  NVIDIA Tegra PCIe controller driver:

   - Export irq_domain_free_irqs() to allow PCI/MSI drivers that tear
     down MSI domains to be built as modules (Aaron Kling)

   - Allow pci-tegra to be built as a module (Aaron Kling)

  NVIDIA Tegra194 PCIe controller driver:

   - Relax Kconfig so tegra194 can be built for platforms beyond
     Tegra194 (Vidya Sagar)

  Qualcomm PCIe controller driver:

   - Merge SC8180x DT binding into SM8150 (Krzysztof Kozlowski)

   - Move SDX55, SDM845, QCS404, IPQ5018, IPQ6018, IPQ8074 Gen3,
     IPQ8074, IPQ4019, IPQ9574, APQ8064, MSM8996, APQ8084 to dedicated
     schema (Krzysztof Kozlowski)

   - Add DT binding and driver support for SA8255p Endpoint being
     configured by firmware (Mrinmay Sarkar)

   - Parse PERST# from all PCIe bridge nodes for future platforms that
     will have PERST# in Switch Downstream Ports as well as in Root
     Ports (Manivannan Sadhasivam)

  Renesas RZ/G3S PCIe controller driver:

   - Use pci_generic_config_write() since the writability provided by
     the custom wrapper is unnecessary (Claudiu Beznea)

  SOPHGO PCIe controller driver:

   - Disable ASPM L0s and L1 on Sophgo 2044 PCIe Root Ports (Inochi
     Amaoto)

  Synopsys DesignWare PCIe controller driver:

   - Extend PCI_FIND_NEXT_CAP() and PCI_FIND_NEXT_EXT_CAP() to return a
     pointer to the preceding Capability, to allow removal of
     Capabilities that are advertised but not fully implemented (Qiang
     Yu)

   - Remove MSI and MSI-X Capabilities in platforms that can't support
     them, so the PCI core automatically falls back to INTx (Qiang Yu)

   - Add ASPM L1.1 and L1.2 Substates context to debugfs ltssm_status
     for drivers that support this (Shawn Lin)

   - Skip PME_Turn_Off broadcast and L2/L3 transition during suspend if
     link is not up to avoid an unnecessary timeout (Manivannan
     Sadhasivam)

   - Revert dw-rockchip, qcom, and DWC core changes that used link-up
     IRQs to trigger enumeration instead of waiting for link to be up
     because the PCI core doesn't allocate bus number space for
     hierarchies that might be attached (Niklas Cassel)

   - Make endpoint iATU entry for MSI permanent instead of programming
     it dynamically, which is slow and racy with respect to other
     concurrent traffic, e.g., eDMA (Koichiro Den)

   - Use iMSI-RX MSI target address when possible to fix endpoints using
     32-bit MSI (Shawn Lin)

   - Allow DWC host controller driver probe to continue if device is not
     found or found but inactive; only fail when there's an error with
     the link (Manivannan Sadhasivam)

   - For controllers like NXP i.MX6QP and i.MX7D, where LTSSM registers
     are not accessible after PME_Turn_Off, simply wait 10ms instead of
     polling for L2/L3 Ready (Richard Zhu)

   - Use multiple iATU entries to map large bridge windows and DMA
     ranges when necessary instead of failing (Samuel Holland)

   - Add EPC dynamic_inbound_mapping feature bit for Endpoint
     Controllers that can update BAR inbound address translation without
     requiring EPF driver to clear/reset the BAR first, and advertise it
     for DWC-based Endpoints (Koichiro Den)

   - Add EPC subrange_mapping feature bit for Endpoint Controllers that
     can map multiple independent inbound regions in a single BAR,
     implement subrange mapping, advertise it for DWC-based Endpoints,
     and add Endpoint selftests for it (Koichiro Den)

   - Make resizable BARs work for Endpoint multi-PF configurations;
     previously it only worked for PF 0 (Aksh Garg)

   - Fix Endpoint non-PF 0 support for BAR configuration, ATU mappings,
     and Address Match Mode (Aksh Garg)

   - Set up iATU when ECAM is enabled; previously IO and MEM outbound
     windows weren't programmed, and ECAM-related iATU entries weren't
     restored after suspend/resume, so config accesses failed (Krishna
     Chaitanya Chundru)

  Miscellaneous:

   - Use system_percpu_wq and WQ_PERCPU to explicitly request per-CPU
     work so WQ_UNBOUND can eventually be removed (Marco Crivellari)"

* tag 'pci-v7.0-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (176 commits)
  PCI/bwctrl: Disable BW controller on Intel P45 using a quirk
  PCI: Disable ACS SV for IDT 0x8090 switch
  PCI: Disable ACS SV for IDT 0x80b5 switch
  PCI: Cache ACS Capabilities register
  PCI: Enable ACS after configuring IOMMU for OF platforms
  PCI: Add ACS quirk for Pericom PI7C9X2G404 switches [12d8:b404]
  PCI: Add ACS quirk for Qualcomm Hamoa & Glymur
  PCI: Use device_lock_assert() to verify device lock is held
  PCI: Use lockdep_assert_held(pci_bus_sem) to verify lock is held
  PCI: Fix pci_slot_lock () device locking
  PCI: Fix pci_slot_trylock() error handling
  PCI: Mark Nvidia GB10 to avoid bus reset
  PCI: Mark ASM1164 SATA controller to avoid bus reset
  PCI: host-generic: Avoid reporting incorrect 'missing reg property' error
  PCI/PME: Replace RMW of Root Status register with direct write
  PCI/AER: Clear stale errors on reporting agents upon probe
  PCI: Don't claim disabled bridge windows
  PCI: rzg3s-host: Fix device node reference leak in rzg3s_pcie_host_parse_port()
  PCI: dwc: Fix missing iATU setup when ECAM is enabled
  PCI: dwc: Clean up iATU index usage in dw_pcie_iatu_setup()
  ...
2026-02-11 17:20:38 -08:00
Linus Torvalds
3381d7b2b3 Updates for the [PCI] MSI subsystem:
- Add interrupt redirection infrastructure
 
     Some PCI controllers use a single demultiplexing interrupt for the MSI
     interrupts of subordinate devices.
 
     This prevents setting the interrupt affinity of device interrupts, which
     causes device interrupts to be delivered to a single CPU. That obviously is
     counterproductive for multi-queue devices and interrupt balancing.
 
     To work around this limitation the new infrastructure installs a dummy
     irq_set_affinity() callback which captures the affinity mask and picks a
     redirection target CPU out of the mask.
 
     When the PCI controller demultiplexes the interrupts it invokes a new
     handling function in the core, which either runs the interrupt handler in
     the context of the target CPU or delegates it to irq_work on the target CPU.
 
   - Utilize the interrupt redirection mechanism in the PCI DWC host controller
     driver.
 
     This allows affinity control for the subordinate device MSI interrupts
     instead of being randomly executed on the CPU which runs the demultiplex
     handler.
 
   - Replace the binary 64-bit MSI flag with a DMA mask
 
     Some PCI devices have PCI_MSI_FLAGS_64BIT in the MSI capability, but
     implement less than 64 address bits. This breaks on platforms where such a
     device is assigned an MSI address higher than what's supported.
 
     With the binary 64-bit flag there is no other choice than disabling 64-bit
     MSI support which leaves the device disfunctional.
 
     By using a DMA mask the address limit of a device can be described
     correctly which provides support for the above scenario.
 
   - Make use of the DMA mask based address limit in the hda/intel and radeon
     drivers to enable them on affected platforms.
 
   - The usual small cleanups and improvements
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmmJyPsQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYocekEADAsS5FlUkFuBy6kODhl5J7b9/oqlL3IEnR
 3CdOrFO716dce+Gej+Wp3T93dJ3XsfD7nCZuy99+LwUkTubmaBJXfjY9S+Ket0ID
 Wc3ltiD6f3GEFB14rXN+fFG/u+OOLkaXdpbQpiTnqL4JAti9qF80D4uon28+FC/o
 wc1MhqVBPbOHU9iM196ngkZuXCNVPLcnZN6PNBgIn0sxx06LcK+daY0bNGxfn5Ua
 LY9SD8hN7tYlkDi42nB/ZXMrexqT9cxSqHObmPX+G/QLfXCRBtD+gyVbs+KVzpRL
 hmFERTlUh9tUdcQFrjgiZP/r4N5ilzsu6w5ZpSOEsGuahFUPZWJWFFC1D8rmq/Ay
 X9HKge1jqXJtbCf0pJM/kdbJKSH5S6aLP3iF37y+PqITIEIX8jIT3oVcvL9hI0BW
 HFxpuJfhAVg63kMegZCO/iROTusLHUZr8iwYOM7pEiCE6fP46jPijsPffVIWvrlJ
 2LVOv/A5wy9q8FW8sF9/M6CW7cdeYQF06Ce3qAyMxjZjEyR3KFBJCVWjhqyMxZJP
 3zFl1XXKXgRO+CDrYKVTPIaXR5D76k/l6MnECQpq81CQyQKm2h6A9PyY+n70FfbZ
 BimakUlBGCd92ZbSxzC9pAOiHo0ZoKtc5BhnsRhKVyBCmEKDazEplDuf49/OSZUE
 p2kaf/PuOw==
 =SCSQ
 -----END PGP SIGNATURE-----

Merge tag 'irq-msi-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull MSI updates from Thomas Gleixner:
 "Updates for the [PCI] MSI subsystem:

   - Add interrupt redirection infrastructure

     Some PCI controllers use a single demultiplexing interrupt for the
     MSI interrupts of subordinate devices.

     This prevents setting the interrupt affinity of device interrupts,
     which causes device interrupts to be delivered to a single CPU.
     That obviously is counterproductive for multi-queue devices and
     interrupt balancing.

     To work around this limitation the new infrastructure installs a
     dummy irq_set_affinity() callback which captures the affinity mask
     and picks a redirection target CPU out of the mask.

     When the PCI controller demultiplexes the interrupts it invokes a
     new handling function in the core, which either runs the interrupt
     handler in the context of the target CPU or delegates it to
     irq_work on the target CPU.

   - Utilize the interrupt redirection mechanism in the PCI DWC host
     controller driver.

     This allows affinity control for the subordinate device MSI
     interrupts instead of being randomly executed on the CPU which runs
     the demultiplex handler.

   - Replace the binary 64-bit MSI flag with a DMA mask

     Some PCI devices have PCI_MSI_FLAGS_64BIT in the MSI capability,
     but implement less than 64 address bits. This breaks on platforms
     where such a device is assigned an MSI address higher than what's
     supported.

     With the binary 64-bit flag there is no other choice than disabling
     64-bit MSI support which leaves the device disfunctional.

     By using a DMA mask the address limit of a device can be described
     correctly which provides support for the above scenario.

   - Make use of the DMA mask based address limit in the hda/intel and
     radeon drivers to enable them on affected platforms

   - The usual small cleanups and improvements"

* tag 'irq-msi-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  ALSA: hda/intel: Make MSI address limit based on the device DMA limit
  drm/radeon: Make MSI address limit based on the device DMA limit
  PCI/MSI: Check the device specific address mask in msi_verify_entries()
  PCI/MSI: Convert the boolean no_64bit_msi flag to a DMA address mask
  genirq/redirect: Prevent writing MSI message on affinity change
  PCI/MSI: Unmap MSI-X region on error
  genirq: Update effective affinity for redirected interrupts
  PCI: dwc: Enable MSI affinity support
  PCI: dwc: Code cleanup
  genirq: Add interrupt redirection infrastructure
  genirq/msi: Correct kernel-doc in <linux/msi.h>
2026-02-10 16:30:29 -08:00
Linus Torvalds
66bbe4a8ed Updates for the interrupt core subsystem:
- Remove the interrupt timing infrastructure
 
    This was added seven years ago to be used for power management purposes, but
    that integration never happened.
 
  - Clean up the remaining setup_percpu_irq() users
 
    The memory allocator is available when interrupts can be requested so there
    is not need for static irq_action. Move the remaining users to
    request_percpu_irq() and delete the historical cruft.
 
  - Warn when interrupt flag inconsistencies are detected in request*_irq().
 
    Inconsistent flags can lead to hard to diagnose malfunction. The fallout of
    this new warning has been addressed in next and the fixes are coming in via
    the maintainer trees and the tip irq/cleanup pull requests.
 
  - Invoke affinity notifier when CPU hotplug breaks affinity
 
    Otherwise the code using the notifier misses the affinity change and
    operates on stale information.
 
  - The usual cleanups and improvements
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmmJwSAQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoV1rD/9lxepiLVhIvaaauyr69HkHnLDJyyyIuNQk
 OZ5Rx8JEnmtJIN49DJ/Ps/VjDZA6GYV2RvtKfqCNtpA3AdpHcLCDw2/mZKetHH3v
 0RlTNeu0TKt76Mo+d7vadJZqdcKbBPYEBucaQed4XLGFq9Vb7nuVMFLzkDZe+C5U
 zG8zhtIaPQyY+MUxFGpWJdeKcddnIC/lKRFBmhglmuflQ8ZdrydRlJZzFBxfcnPy
 dcZVnOVZYD4aaW+uryd9eVWg0de5q97C03OobVdhwt077zcmTZpGanRCBM/+7Kop
 UDB/p04Z5FFFKFbd+j0f76gl1l6yQ06K/2Pby8qrLnodsqOEgjEgLs0qbHhkNsVw
 g5W6ry9boLWAA1XhGFOnqZ4Dc/Qb1G7DpnRUzpmAlyL04MTManjocIHNPrGhjlNG
 +jT3iPuraiRUoNZ9K2PBYX9SikGVnKJXFmOwlffkPpOtaJk/oYVUAdMq2W71C4Du
 TZeAbd2RyrSPMYaSh7pnBhM7KBmsYIg+hHU1+RaAi/rFSOT0Se5sUWwmUUUzSfOn
 KvCAzMGX6gIg8rkSmTp7OvLQhXEfJ2kEVrVZACS6MBxS7+PNVBkxYuOqxdhdoVj0
 sZrfB8Qnm4mAcbq7YJtrD6az3+LH5CkrdNyWIAL62leMmqWDoTOgLRMFh2/yEMTl
 BeAOgPO2pw==
 =3hJ2
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq core updates from Thomas Gleixner:
 "Updates for the interrupt core subsystem:

   - Remove the interrupt timing infrastructure

     This was added seven years ago to be used for power management
     purposes, but that integration never happened.

   - Clean up the remaining setup_percpu_irq() users

     The memory allocator is available when interrupts can be requested
     so there is not need for static irq_action. Move the remaining
     users to request_percpu_irq() and delete the historical cruft.

   - Warn when interrupt flag inconsistencies are detected in
     request*_irq().

     Inconsistent flags can lead to hard to diagnose malfunction. The
     fallout of this new warning has been addressed in next and the
     fixes are coming in via the maintainer trees and the tip
     irq/cleanup pull requests.

   - Invoke affinity notifier when CPU hotplug breaks affinity

     Otherwise the code using the notifier misses the affinity change
     and operates on stale information.

   - The usual cleanups and improvements"

* tag 'irq-core-2026-02-09' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  genirq/proc: Replace snprintf with strscpy in register_handler_proc
  genirq/cpuhotplug: Notify about affinity changes breaking the affinity mask
  genirq: Move clear of kstat_irqs to free_desc()
  genirq: Warn about using IRQF_ONESHOT without a threaded handler
  irqdomain: Fix up const problem in irq_domain_set_name()
  genirq: Remove setup_percpu_irq()
  clocksource/drivers/mips-gic-timer: Move GIC timer to request_percpu_irq()
  MIPS: Move IP27 timer to request_percpu_irq()
  MIPS: Move IP30 timer to request_percpu_irq()
  genirq: Remove __request_percpu_irq() helper
  genirq: Remove IRQ timing tracking infrastructure
2026-02-10 13:39:37 -08:00