From nobody Mon May 25 09:57:53 2026 Received: from mail-pj1-f41.google.com (mail-pj1-f41.google.com [209.85.216.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 57D623C5540 for ; Mon, 18 May 2026 07:50:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779090648; cv=none; b=XrtFpDs+PEkalXCggQiNYU1ljAbcbx4N0ZgjC1jArx/6/3Z6z7h8J68fPG2utaeyhqyZp/EIsC8QZ9T1g4nj9/5bAcJuZ/CiLdSridD+FVFe6kPc3kIS6juxjEGuWLyBW80dNQUOaWZFFZ8m8eAYDQHC/Vj0G815/ag/Ih3hHmY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779090648; c=relaxed/simple; bh=7jIebGwmF0iENb0ALG6d7MlUOZ/qqAzxPqxbRGSUgXU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=CmnaEgKcqKG6U7p/+VLR0AAIQDk9KF9ShA+djC9C1mrO62nqhO8/mzxQ36fUMLJOvZuBdc9Ek9hOuff5n5N+r1SH8aVTMCJCjyrmfX2iYsk/w34XsUnLx7AZG8kePL61sAAzlE6UGhTQT65GOD1J9LbJjQcegpdox/meRJicKoc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dpVSU/on; arc=none smtp.client-ip=209.85.216.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dpVSU/on" Received: by mail-pj1-f41.google.com with SMTP id 98e67ed59e1d1-36974221f93so756451a91.2 for ; Mon, 18 May 2026 00:50:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779090644; x=1779695444; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=tzisouNi0YPd87k664ptzNj9xQbIRLyhwzkMQ6zJ85Y=; b=dpVSU/on/vo+fSBcS+hP4T+BfGkqlrTwK8GNJqxNaQKd4q7Iig76Nj8weE63adxCTV uksMVYsAMWqH9cpqqgbKisgbMUfeOaRNRs7kmWfBYwJZrJc1c/IXeeOwm05aIPMu0dMT iodfZ83m4NBhX+a8NnimM72kPGWOJy33KxlHxKDYEXkDTX0wK996etAlaeH+BDd4+bXU 5w2HSYGlqe81sgdtQXctLkVx73MMI6tfQO8DqhE1F1GmKvq0fm3LTKzcEssYbC+1Dtnk 6TD0U2zbVMKCRe4P/5PtHiYh36+T2p2Tn7Itoo+yHLPMP3SGsuHaPZn0RWzLUzxKOm6L sKuw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779090644; x=1779695444; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=tzisouNi0YPd87k664ptzNj9xQbIRLyhwzkMQ6zJ85Y=; b=ghFwcrMLC24NFSOP7+Tzm4CFOh1cH3tV6baxhZBF0lxZaKPNPDN69aBfO8JRXV/1i/ g1B2SOZt3C8Bu3KyU29c2z/MavoATgWfHfR2rIL9z9von3Svrlrgibb4F2sNVtaDpMsf cLYT6fnPH/+OEx78K+tUxZTTu2b2TYQ4roEl3gbZ807PBIPIfh9W95rk3oRMBaCn78TJ zAw29TyJ+/io+7vRu4ov8UGqDaEy+VbtMBIo/D7EFh64J5VT/1cqNvw7J0lLM6sHPJwu o5MHPHD3UKfn9GCLQob1X3jN1uFOMW8BqTD4kUj3oP4LiOye1hzrs2nm5/XBy8g6pTlG ztXQ== X-Forwarded-Encrypted: i=1; AFNElJ+Lt/C2A42iSzJZETQQFhBjJcCTzQm71SYpLB9B5pEkL4URXvTgmhRKXhGUyvFrn+R27EYDP5NAuNpMSQU=@vger.kernel.org X-Gm-Message-State: AOJu0Yyu5faGmkc+Z3zdUjutWVU2nC5+LXjpBYJKRd4cPCFedDd8qkin yxZly9yIWkpEzG//8eGgOT2ceS2SJy8GmyD+t14riWuQrWXwxSFW7tAM X-Gm-Gg: Acq92OH0ooANR4yRZawvVfsQZC9GGQIS2BougOclN/P5MUUiisAVSwiROt8FLHXuZ+0 ZkBJhSYm40StF8XG97HVD2egxhmqtf/4VeOAiZCX+4IEe9T+6McFGJDyQ2iT3Kr003W9eXy3ZUh J+T16mRc8ABK4BBOVyciJ5DTIc9jHbszFrVhWXqibCCfUh8PQVwCuuHlKuwCANO6WxfvUyiNmom RJVoL6AqbsPKkmeo+ceP6yQIK8yAIjmXPR4uStuDX62ujI0rlJRhZK9d6h9Q8zb8s2O5bJ3mhmR mSDiDWCFI5ZAsgD9LqVBwyxWbhRWCxtMLdoPd8/3ljF7sm9GaN21Aa91yJnOWacXgZaZkB5ruHr 0bus7NnOWn0BtNOiQFLTNmJ6w2WsJ2mH6L7puvcDbW+hyykOpTZSGoe+Atf4HyTQlCGaSRK+A5b B92uqlntWKehFJO/6PCFRAVwLB5Smp2deQXn9YbZCXnHiIzTe4Yg== X-Received: by 2002:a17:90b:57e4:b0:367:b819:2214 with SMTP id 98e67ed59e1d1-36951b82d4dmr14219312a91.13.1779090643586; Mon, 18 May 2026 00:50:43 -0700 (PDT) Received: from u.. (61-222-64-201.hinet-ip.hinet.net. [61.222.64.201]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36970422515sm3361487a91.4.2026.05.18.00.50.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 18 May 2026 00:50:43 -0700 (PDT) From: Tim JH Chen X-Google-Original-From: Tim JH Chen To: netdev@vger.kernel.org Cc: Tim JH Chen , Chandrashekar Devegowda , Liu Haijun , Ricardo Martinez , Loic Poulain , Sergey Ryazanov , Johannes Berg , Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-kernel@vger.kernel.org (open list) Subject: [PATCH] net: wwan: t7xx: fix race between TX thread and system PM suspend Date: Mon, 18 May 2026 15:50:33 +0800 Message-ID: <20260518075033.58996-1-tim.jh.chen@wnc.com.tw> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable When system suspend is triggered while the DPMAIF TX kthread (t7xx_dpmaif_tx_hw_push_thread) is running, a deadlock can occur leading to a CPU soft lockup. The root cause is two-fold: 1. t7xx_dpmaif_suspend() calls t7xx_dpmaif_tx_stop() which only stops the TX work-queue items (by clearing txq->que_started and waiting on txq->tx_processing). It does NOT signal the kthread and does NOT update dpmaif_ctrl->state, which stays DPMAIF_STATE_PWRON. 2. The kthread's state guard (line: "if ... state !=3D DPMAIF_STATE_PWRON") is only checked at the top of each loop iteration. If the thread already passed this guard, it proceeds unconditionally to call pm_runtime_resume_and_get() =E2=80=94 which tries to acquire the PM spin= lock also held (or contended) by the system PM suspend path. The result is a spinlock deadlock observed as: watchdog: BUG: soft lockup - CPU#N stuck for 26s! [dpmaif_tx_hw_pu] RIP: _raw_spin_unlock_irqrestore Call Trace: __pm_runtime_resume+0x5b/0x80 t7xx_dpmaif_tx_hw_push_thread+0xc4 [mtk_t7xx] The condition requires ASPM L1 enabled on the endpoint (which extends the time pm_runtime_resume_and_get() holds the PM lock during L1.2 link retraining) and hundreds of repeated suspend/resume cycles to trigger reliably. Fix by three coordinated changes: - In t7xx_dpmaif_suspend(): immediately set state to DPMAIF_STATE_PWROFF after stopping the TX queue, then call wake_up() so any sleeping thread re-evaluates the wait_event condition and stops. - In t7xx_dpmaif_resume(): restore state to DPMAIF_STATE_PWRON before re-enabling the TX queues, symmetric with the suspend change. Without this the kthread would never wake up after resume. - In t7xx_dpmaif_tx_hw_push_thread(): add a second state check immediately before pm_runtime_resume_and_get() to close the TOCTOU window between the wait_event guard and the pm call. Tested: no soft lockup observed over 500+ suspend/resume cycles with SIM registered and ASPM L1 enabled (previously triggered in < 300). Signed-off-by: Tim JH Chen --- drivers/net/wwan/t7xx/t7xx_hif_dpmaif.c | 3 +++ drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c | 3 +++ 2 files changed, 6 insertions(+) diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif.c b/drivers/net/wwan/t7x= x/t7xx_hif_dpmaif.c index 7ff33c1d6..315a77e24 100644 --- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif.c +++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif.c @@ -412,6 +412,8 @@ static int t7xx_dpmaif_suspend(struct t7xx_pci_dev *t7x= x_dev, void *param) struct dpmaif_ctrl *dpmaif_ctrl =3D param; =20 t7xx_dpmaif_tx_stop(dpmaif_ctrl); + dpmaif_ctrl->state =3D DPMAIF_STATE_PWROFF; + wake_up(&dpmaif_ctrl->tx_wq); t7xx_dpmaif_hw_stop_all_txq(&dpmaif_ctrl->hw_info); t7xx_dpmaif_hw_stop_all_rxq(&dpmaif_ctrl->hw_info); t7xx_dpmaif_disable_irq(dpmaif_ctrl); @@ -451,6 +453,7 @@ static int t7xx_dpmaif_resume(struct t7xx_pci_dev *t7xx= _dev, void *param) if (!dpmaif_ctrl) return 0; =20 + dpmaif_ctrl->state =3D DPMAIF_STATE_PWRON; t7xx_dpmaif_start_txrx_qs(dpmaif_ctrl); t7xx_dpmaif_enable_irq(dpmaif_ctrl); t7xx_dpmaif_unmask_dlq_intr(dpmaif_ctrl); diff --git a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c b/drivers/net/wwan/= t7xx/t7xx_hif_dpmaif_tx.c index 236d632cf..d5a5befec 100644 --- a/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c +++ b/drivers/net/wwan/t7xx/t7xx_hif_dpmaif_tx.c @@ -460,6 +460,9 @@ static int t7xx_dpmaif_tx_hw_push_thread(void *arg) break; } =20 + if (dpmaif_ctrl->state !=3D DPMAIF_STATE_PWRON) + continue; + ret =3D pm_runtime_resume_and_get(dpmaif_ctrl->dev); if (ret < 0 && ret !=3D -EACCES) return ret; --=20 2.25.1