* Re: [PATCH v2 12/30] KVM: arm64: Hoist MTE validation check out of MMU lock path
From: Anshuman Khandual @ 2026-04-01 2:18 UTC (permalink / raw)
To: Marc Zyngier
Cc: kvmarm, linux-arm-kernel, kvm, Joey Gouly, Suzuki K Poulose,
Oliver Upton, Zenghui Yu, Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <865x6b4zwh.wl-maz@kernel.org>
On 31/03/26 11:58 PM, Marc Zyngier wrote:
> On Tue, 31 Mar 2026 07:57:48 +0100,
> Anshuman Khandual <anshuman.khandual@arm.com> wrote:
>>
>> On 27/03/26 5:06 PM, Marc Zyngier wrote:
>>> From: Fuad Tabba <tabba@google.com>
>>>
>>> Simplify the non-cacheable attributes assignment by using a ternary
>>> operator. Additionally, hoist the MTE validation check (mte_allowed) out
>>> of kvm_s2_fault_map() and into kvm_s2_fault_compute_prot(). This allows
>>> us to fail faster and avoid acquiring the KVM MMU lock unnecessarily
>>> when the VMM introduces a disallowed VMA for an MTE-enabled guest.
>>>
>>> Signed-off-by: Fuad Tabba <tabba@google.com>
>>> Signed-off-by: Marc Zyngier <maz@kernel.org>
>>> ---
>>> arch/arm64/kvm/mmu.c | 28 ++++++++++++----------------
>>> 1 file changed, 12 insertions(+), 16 deletions(-)
>>>
>>> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
>>> index 0c71e3a9af8b0..ee2a548999b1b 100644
>>> --- a/arch/arm64/kvm/mmu.c
>>> +++ b/arch/arm64/kvm/mmu.c
>>> @@ -1870,18 +1870,21 @@ static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
>>> if (fault->exec_fault)
>>> fault->prot |= KVM_PGTABLE_PROT_X;
>>>
>>> - if (fault->s2_force_noncacheable) {
>>> - if (fault->vm_flags & VM_ALLOW_ANY_UNCACHED)
>>> - fault->prot |= KVM_PGTABLE_PROT_NORMAL_NC;
>>> - else
>>> - fault->prot |= KVM_PGTABLE_PROT_DEVICE;
>>> - } else if (cpus_have_final_cap(ARM64_HAS_CACHE_DIC)) {
>>> + if (fault->s2_force_noncacheable)
>>> + fault->prot |= (fault->vm_flags & VM_ALLOW_ANY_UNCACHED) ?
>>> + KVM_PGTABLE_PROT_NORMAL_NC : KVM_PGTABLE_PROT_DEVICE;
>>> + else if (cpus_have_final_cap(ARM64_HAS_CACHE_DIC))
>>> fault->prot |= KVM_PGTABLE_PROT_X;
>>> - }
>>
>> Is not the existing code block bit more cleaner though ?
>
> What is wrong with this? Are you stating a matter of personal taste ?
> > Ternary operators are great at making things more readable by reducing
> the amount of nesting, and I'm all in favour of anything that makes
> this $%^&*( code easier to parse.
>
> Or are you pointing out a technical issue?
There is no technical issue here. Just that the existing code block
appeared bit easier to read but as you mentioned earlier that is
probably subjective. Never mind and please feel free to ignore this
comment.
^ permalink raw reply
* Re: [RFC PATCH 1/7] media: v4l2-ctrls: Add V4L2_CID_MEMORY_USAGE control
From: Ming Qian(OSS) @ 2026-04-01 2:23 UTC (permalink / raw)
To: Nicolas Dufresne, Frank Li
Cc: linux-media, mchehab, hverkuil-cisco, sebastian.fricke, shawnguo,
s.hauer, kernel, festevam, linux-imx, xiahong.bao, eagle.zhou,
imx, linux-kernel, linux-arm-kernel
In-Reply-To: <079b1630abe5dd22e032797fc12925c9c79ea305.camel@ndufresne.ca>
Hi Nicolas,
On 3/31/2026 10:54 PM, Nicolas Dufresne wrote:
> Le mardi 31 mars 2026 à 10:33 -0400, Frank Li a écrit :
>> On Tue, Mar 31, 2026 at 03:23:11PM +0800, ming.qian@oss.nxp.com wrote:
>>> From: Ming Qian <ming.qian@oss.nxp.com>
>>>
>>> Add a new read-only control V4L2_CID_MEMORY_USAGE that allows
>>> applications to query the total amount of memory currently used
>>> by a device instance.
>>>
>>> This control reports the memory consumption in bytes, including
>>> internal buffers, intermediate processing data, and other
>>> driver-managed allocations. Applications can use this information
>>> for debugging, resource monitoring, or making informed decisions
>>> about buffer allocation strategies.
>>>
>>> Signed-off-by: Ming Qian <ming.qian@oss.nxp.com>
>>> ---
>>
>> Not sure why not export these information by debugfs, or any benefit vs
>> debugfs?
>
> There is also a on-going proposal that uses fdinfo.
>
> Nicolas
>
Thanks for the reminder about the ongoing fdinfo proposal.
Just to confirm, you are referring to Detlev’s ongoing fdinfo proposal,
specifically this series:
https://lore.kernel.org/lkml/20260212162328.192217-1-detlev.casanova@collabora.com/
I will align my work with it and switch to using fdinfo.
Once the show_fdinfo support from that series is merged, I will prepare
the next revision of my patch accordingly.
Regards,
Ming
>>
>> Generanlly document should be first patch, then driver change.
>>
>> Frank
>>
>>> drivers/media/v4l2-core/v4l2-ctrls-defs.c | 8 ++++++++
>>> include/uapi/linux/v4l2-controls.h | 4 +++-
>>> 2 files changed, 11 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/media/v4l2-core/v4l2-ctrls-defs.c b/drivers/media/v4l2-core/v4l2-ctrls-defs.c
>>> index 551426c4cd01..053db78ff661 100644
>>> --- a/drivers/media/v4l2-core/v4l2-ctrls-defs.c
>>> +++ b/drivers/media/v4l2-core/v4l2-ctrls-defs.c
>>> @@ -831,6 +831,7 @@ const char *v4l2_ctrl_get_name(u32 id)
>>> case V4L2_CID_ALPHA_COMPONENT: return "Alpha Component";
>>> case V4L2_CID_COLORFX_CBCR: return "Color Effects, CbCr";
>>> case V4L2_CID_COLORFX_RGB: return "Color Effects, RGB";
>>> + case V4L2_CID_MEMORY_USAGE: return "Memory Usage";
>>>
>>> /*
>>> * Codec controls
>>> @@ -1476,6 +1477,13 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type,
>>> *min = 0;
>>> *max = 0xffff;
>>> break;
>>> + case V4L2_CID_MEMORY_USAGE:
>>> + *type = V4L2_CTRL_TYPE_INTEGER64;
>>> + *flags |= V4L2_CTRL_FLAG_READ_ONLY;
>>> + *min = 0;
>>> + *max = S64_MAX;
>>> + *step = 1;
>>> + break;
>>> case V4L2_CID_FLASH_FAULT:
>>> case V4L2_CID_JPEG_ACTIVE_MARKER:
>>> case V4L2_CID_3A_LOCK:
>>> diff --git a/include/uapi/linux/v4l2-controls.h b/include/uapi/linux/v4l2-controls.h
>>> index 68dd0c4e47b2..02c6f960d38e 100644
>>> --- a/include/uapi/linux/v4l2-controls.h
>>> +++ b/include/uapi/linux/v4l2-controls.h
>>> @@ -110,8 +110,10 @@ enum v4l2_colorfx {
>>> #define V4L2_CID_COLORFX_CBCR (V4L2_CID_BASE+42)
>>> #define V4L2_CID_COLORFX_RGB (V4L2_CID_BASE+43)
>>>
>>> +#define V4L2_CID_MEMORY_USAGE (V4L2_CID_BASE+44)
>>> +
>>> /* last CID + 1 */
>>> -#define V4L2_CID_LASTP1 (V4L2_CID_BASE+44)
>>> +#define V4L2_CID_LASTP1 (V4L2_CID_BASE+45)
>>>
>>> /* USER-class private control IDs */
>>>
>>> --
>>> 2.53.0
>>>
^ permalink raw reply
* Re: [PATCH v2 12/30] KVM: arm64: Hoist MTE validation check out of MMU lock path
From: Anshuman Khandual @ 2026-04-01 2:23 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-13-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> From: Fuad Tabba <tabba@google.com>
>
> Simplify the non-cacheable attributes assignment by using a ternary
> operator. Additionally, hoist the MTE validation check (mte_allowed) out
> of kvm_s2_fault_map() and into kvm_s2_fault_compute_prot(). This allows
> us to fail faster and avoid acquiring the KVM MMU lock unnecessarily
> when the VMM introduces a disallowed VMA for an MTE-enabled guest.
>
> Signed-off-by: Fuad Tabba <tabba@google.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> ---
> arch/arm64/kvm/mmu.c | 28 ++++++++++++----------------
> 1 file changed, 12 insertions(+), 16 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 0c71e3a9af8b0..ee2a548999b1b 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1870,18 +1870,21 @@ static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
> if (fault->exec_fault)
> fault->prot |= KVM_PGTABLE_PROT_X;
>
> - if (fault->s2_force_noncacheable) {
> - if (fault->vm_flags & VM_ALLOW_ANY_UNCACHED)
> - fault->prot |= KVM_PGTABLE_PROT_NORMAL_NC;
> - else
> - fault->prot |= KVM_PGTABLE_PROT_DEVICE;
> - } else if (cpus_have_final_cap(ARM64_HAS_CACHE_DIC)) {
> + if (fault->s2_force_noncacheable)
> + fault->prot |= (fault->vm_flags & VM_ALLOW_ANY_UNCACHED) ?
> + KVM_PGTABLE_PROT_NORMAL_NC : KVM_PGTABLE_PROT_DEVICE;
> + else if (cpus_have_final_cap(ARM64_HAS_CACHE_DIC))
> fault->prot |= KVM_PGTABLE_PROT_X;
> - }
>
> if (fault->nested)
> adjust_nested_exec_perms(kvm, fault->nested, &fault->prot);
>
> + if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm)) {
> + /* Check the VMM hasn't introduced a new disallowed VMA */
> + if (!fault->mte_allowed)
> + return -EFAULT;
> + }
> +
> return 0;
> }
>
> @@ -1918,15 +1921,8 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> }
> }
>
> - if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm)) {
> - /* Check the VMM hasn't introduced a new disallowed VMA */
> - if (fault->mte_allowed) {
> - sanitise_mte_tags(kvm, fault->pfn, fault->vma_pagesize);
> - } else {
> - ret = -EFAULT;
> - goto out_unlock;
> - }
> - }
> + if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm))
> + sanitise_mte_tags(kvm, fault->pfn, fault->vma_pagesize);
>
> /*
> * Under the premise of getting a FSC_PERM fault, we just need to relax
^ permalink raw reply
* [PATCH v2] ACPI: AGDI: fix missing newline in error message
From: Haoyu Lu @ 2026-04-01 2:29 UTC (permalink / raw)
To: Rafael J . Wysocki, Lorenzo Pieralisi, Hanjun Guo, Sudeep Holla,
Catalin Marinas, Will Deacon
Cc: Len Brown, Ilkka Koskinen, Russell King, linux-acpi,
linux-arm-kernel, linux-kernel, Haoyu Lu
Add the missing trailing newline to the dev_err() message
printed when SDEI event registration fails.
This keeps the error output as a properly terminated log line.
Changes in v2:
- Change subject prefix from "acpi: arm64: agdi:" to "ACPI: AGDI:"
Fixes: a2a591fb76e6f5461dfd04715b69c317e50c43a5 ("ACPI: AGDI: Add driver for Arm Generic Diagnostic Dump and Reset device")
Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com>
Signed-off-by: Haoyu Lu <hechushiguitu666@gmail.com>
---
drivers/acpi/arm64/agdi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/arm64/agdi.c b/drivers/acpi/arm64/agdi.c
index feb4b2cb4618..0c2d9d6c160b 100644
--- a/drivers/acpi/arm64/agdi.c
+++ b/drivers/acpi/arm64/agdi.c
@@ -36,7 +36,7 @@ static int agdi_sdei_probe(struct platform_device *pdev,
err = sdei_event_register(adata->sdei_event, agdi_sdei_handler, pdev);
if (err) {
- dev_err(&pdev->dev, "Failed to register for SDEI event %d",
+ dev_err(&pdev->dev, "Failed to register for SDEI event %d\n",
adata->sdei_event);
return err;
}
--
2.17.1
^ permalink raw reply related
* Re: [PATCH net-next] net: airoha: Fix typo in airoha_set_gdm2_loopback routine name
From: patchwork-bot+netdevbpf @ 2026-04-01 2:40 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, linux-arm-kernel,
linux-mediatek, netdev
In-Reply-To: <20260330-airoha_set_gdm2_loopback-fix-typo-v1-1-a1320ff6b6cc@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 30 Mar 2026 00:03:49 +0200 you wrote:
> Rename airhoha_set_gdm2_loopback() in airoha_set_gdm2_loopback()
>
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
> ---
> drivers/net/ethernet/airoha/airoha_eth.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> [...]
Here is the summary with links:
- [net-next] net: airoha: Fix typo in airoha_set_gdm2_loopback routine name
https://git.kernel.org/netdev/net-next/c/a94ddc191f19
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 15/30] KVM: arm64: Make fault_ipa immutable
From: Anshuman Khandual @ 2026-04-01 2:44 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-16-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> Updating fault_ipa is conceptually annoying, as it changes something
> that is a property of the fault itself.
>
> Stop doing so and instead use fault->gfn as the sole piece of state
> that can be used to represent the faulting IPA.
>
> At the same time, introduce get_canonical_gfn() for the couple of case
> we're we are concerned with the memslot-related IPA and not the faulting
> one.
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> ---
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> arch/arm64/kvm/mmu.c | 38 ++++++++++++++++++++++++++------------
> 1 file changed, 26 insertions(+), 12 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 67e5e867e01dc..496bf5903ed3d 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1400,10 +1400,10 @@ static bool fault_supports_stage2_huge_mapping(struct kvm_memory_slot *memslot,
> */
> static long
> transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot,
> - unsigned long hva, kvm_pfn_t *pfnp,
> - phys_addr_t *ipap)
> + unsigned long hva, kvm_pfn_t *pfnp, gfn_t *gfnp)
> {
> kvm_pfn_t pfn = *pfnp;
> + gfn_t gfn = *gfnp;
>
> /*
> * Make sure the adjustment is done only for THP pages. Also make
> @@ -1419,7 +1419,8 @@ transparent_hugepage_adjust(struct kvm *kvm, struct kvm_memory_slot *memslot,
> if (sz < PMD_SIZE)
> return PAGE_SIZE;
>
> - *ipap &= PMD_MASK;
> + gfn &= ~(PTRS_PER_PMD - 1);
> + *gfnp = gfn;
> pfn &= ~(PTRS_PER_PMD - 1);
> *pfnp = pfn;
>
> @@ -1735,7 +1736,6 @@ static int kvm_s2_fault_get_vma_info(struct kvm_s2_fault *fault)
> {
> struct vm_area_struct *vma;
> struct kvm *kvm = fault->vcpu->kvm;
> - phys_addr_t ipa;
>
> mmap_read_lock(current->mm);
> vma = vma_lookup(current->mm, fault->hva);
> @@ -1753,9 +1753,7 @@ static int kvm_s2_fault_get_vma_info(struct kvm_s2_fault *fault)
> * mapping size to ensure we find the right PFN and lay down the
> * mapping in the right place.
> */
> - fault->fault_ipa = ALIGN_DOWN(fault->fault_ipa, fault->vma_pagesize);
> - ipa = fault->nested ? kvm_s2_trans_output(fault->nested) : fault->fault_ipa;
> - fault->gfn = ALIGN_DOWN(ipa, fault->vma_pagesize) >> PAGE_SHIFT;
> + fault->gfn = ALIGN_DOWN(fault->fault_ipa, fault->vma_pagesize) >> PAGE_SHIFT;
>
> fault->mte_allowed = kvm_vma_mte_allowed(vma);
>
> @@ -1777,6 +1775,17 @@ static int kvm_s2_fault_get_vma_info(struct kvm_s2_fault *fault)
> return 0;
> }
>
> +static gfn_t get_canonical_gfn(struct kvm_s2_fault *fault)
> +{
> + phys_addr_t ipa;
> +
> + if (!fault->nested)
> + return fault->gfn;
> +
> + ipa = kvm_s2_trans_output(fault->nested);
> + return ALIGN_DOWN(ipa, fault->vma_pagesize) >> PAGE_SHIFT;
> +}
> +
> static int kvm_s2_fault_pin_pfn(struct kvm_s2_fault *fault)
> {
> int ret;
> @@ -1785,7 +1794,7 @@ static int kvm_s2_fault_pin_pfn(struct kvm_s2_fault *fault)
> if (ret)
> return ret;
>
> - fault->pfn = __kvm_faultin_pfn(fault->memslot, fault->gfn,
> + fault->pfn = __kvm_faultin_pfn(fault->memslot, get_canonical_gfn(fault),
> fault->write_fault ? FOLL_WRITE : 0,
> &fault->writable, &fault->page);
> if (unlikely(is_error_noslot_pfn(fault->pfn))) {
> @@ -1885,6 +1894,11 @@ static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
> return 0;
> }
>
> +static phys_addr_t get_ipa(const struct kvm_s2_fault *fault)
> +{
> + return gfn_to_gpa(fault->gfn);
> +}
> +
> static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> {
> struct kvm *kvm = fault->vcpu->kvm;
> @@ -1909,7 +1923,7 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> } else {
> fault->vma_pagesize = transparent_hugepage_adjust(kvm, fault->memslot,
> fault->hva, &fault->pfn,
> - &fault->fault_ipa);
> + &fault->gfn);
>
> if (fault->vma_pagesize < 0) {
> ret = fault->vma_pagesize;
> @@ -1932,10 +1946,10 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> * PTE, which will be preserved.
> */
> fault->prot &= ~KVM_NV_GUEST_MAP_SZ;
> - ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, fault->fault_ipa,
> + ret = KVM_PGT_FN(kvm_pgtable_stage2_relax_perms)(pgt, get_ipa(fault),
> fault->prot, flags);
> } else {
> - ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, fault->fault_ipa, fault->vma_pagesize,
> + ret = KVM_PGT_FN(kvm_pgtable_stage2_map)(pgt, get_ipa(fault), fault->vma_pagesize,
> __pfn_to_phys(fault->pfn), fault->prot,
> memcache, flags);
> }
> @@ -1946,7 +1960,7 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
>
> /* Mark the page dirty only if the fault is handled successfully */
> if (fault->writable && !ret)
> - mark_page_dirty_in_slot(kvm, fault->memslot, fault->gfn);
> + mark_page_dirty_in_slot(kvm, fault->memslot, get_canonical_gfn(fault));
>
> if (ret != -EAGAIN)
> return ret;
^ permalink raw reply
* Re: [PATCH v2 16/30] KVM: arm64: Move fault context to const structure
From: Anshuman Khandual @ 2026-04-01 2:53 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-17-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> In order to make it clearer what gets updated or not during fault
> handling, move a set of information that losely represents the
> fault context.
>
> This gets populated early, from handle_mem_abort(), and gets passed
> along as a const pointer. user_mem_abort()'s signature is majorly
> improved in doing so, and kvm_s2_fault loses a bunch of fields.
>
> gmem_abort() will get a similar treatment down the line.
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> ---
> arch/arm64/kvm/mmu.c | 133 ++++++++++++++++++++++---------------------
> 1 file changed, 69 insertions(+), 64 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 496bf5903ed3d..09e32f08028e4 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1565,6 +1565,14 @@ static void adjust_nested_exec_perms(struct kvm *kvm,
> *prot &= ~KVM_PGTABLE_PROT_PX;
> }
>
> +struct kvm_s2_fault_desc {
> + struct kvm_vcpu *vcpu;
> + phys_addr_t fault_ipa;
> + struct kvm_s2_trans *nested;
> + struct kvm_memory_slot *memslot;
> + unsigned long hva;
> +};
> +
> static int gmem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> struct kvm_s2_trans *nested,
> struct kvm_memory_slot *memslot, bool is_perm)
> @@ -1640,23 +1648,20 @@ static int gmem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> return ret != -EAGAIN ? ret : 0;
> }
>
> -static short kvm_s2_resolve_vma_size(struct vm_area_struct *vma,
> - unsigned long hva,
> - struct kvm_memory_slot *memslot,
> - struct kvm_s2_trans *nested,
> - bool *force_pte)
> +static short kvm_s2_resolve_vma_size(const struct kvm_s2_fault_desc *s2fd,
> + struct vm_area_struct *vma, bool *force_pte)
> {
> short vma_shift;
>
> if (*force_pte)
> vma_shift = PAGE_SHIFT;
> else
> - vma_shift = get_vma_page_shift(vma, hva);
> + vma_shift = get_vma_page_shift(vma, s2fd->hva);
>
> switch (vma_shift) {
> #ifndef __PAGETABLE_PMD_FOLDED
> case PUD_SHIFT:
> - if (fault_supports_stage2_huge_mapping(memslot, hva, PUD_SIZE))
> + if (fault_supports_stage2_huge_mapping(s2fd->memslot, s2fd->hva, PUD_SIZE))
> break;
> fallthrough;
> #endif
> @@ -1664,7 +1669,7 @@ static short kvm_s2_resolve_vma_size(struct vm_area_struct *vma,
> vma_shift = PMD_SHIFT;
> fallthrough;
> case PMD_SHIFT:
> - if (fault_supports_stage2_huge_mapping(memslot, hva, PMD_SIZE))
> + if (fault_supports_stage2_huge_mapping(s2fd->memslot, s2fd->hva, PMD_SIZE))
> break;
> fallthrough;
> case CONT_PTE_SHIFT:
> @@ -1677,7 +1682,7 @@ static short kvm_s2_resolve_vma_size(struct vm_area_struct *vma,
> WARN_ONCE(1, "Unknown vma_shift %d", vma_shift);
> }
>
> - if (nested) {
> + if (s2fd->nested) {
> unsigned long max_map_size;
>
> max_map_size = *force_pte ? PAGE_SIZE : PUD_SIZE;
> @@ -1687,7 +1692,7 @@ static short kvm_s2_resolve_vma_size(struct vm_area_struct *vma,
> * can only create a block mapping if the guest stage 2 page
> * table uses at least as big a mapping.
> */
> - max_map_size = min(kvm_s2_trans_size(nested), max_map_size);
> + max_map_size = min(kvm_s2_trans_size(s2fd->nested), max_map_size);
>
> /*
> * Be careful that if the mapping size falls between
> @@ -1706,11 +1711,6 @@ static short kvm_s2_resolve_vma_size(struct vm_area_struct *vma,
> }
>
> struct kvm_s2_fault {
> - struct kvm_vcpu *vcpu;
> - phys_addr_t fault_ipa;
> - struct kvm_s2_trans *nested;
> - struct kvm_memory_slot *memslot;
> - unsigned long hva;
> bool fault_is_perm;
>
> bool write_fault;
> @@ -1732,28 +1732,28 @@ struct kvm_s2_fault {
> vm_flags_t vm_flags;
> };
>
> -static int kvm_s2_fault_get_vma_info(struct kvm_s2_fault *fault)
> +static int kvm_s2_fault_get_vma_info(const struct kvm_s2_fault_desc *s2fd,
> + struct kvm_s2_fault *fault)
> {
> struct vm_area_struct *vma;
> - struct kvm *kvm = fault->vcpu->kvm;
> + struct kvm *kvm = s2fd->vcpu->kvm;
>
> mmap_read_lock(current->mm);
> - vma = vma_lookup(current->mm, fault->hva);
> + vma = vma_lookup(current->mm, s2fd->hva);
> if (unlikely(!vma)) {
> - kvm_err("Failed to find VMA for fault->hva 0x%lx\n", fault->hva);
> + kvm_err("Failed to find VMA for hva 0x%lx\n", s2fd->hva);
> mmap_read_unlock(current->mm);
> return -EFAULT;
> }
>
> - fault->vma_pagesize = 1UL << kvm_s2_resolve_vma_size(vma, fault->hva, fault->memslot,
> - fault->nested, &fault->force_pte);
> + fault->vma_pagesize = BIT(kvm_s2_resolve_vma_size(s2fd, vma, &fault->force_pte));
>
> /*
> * Both the canonical IPA and fault IPA must be aligned to the
> * mapping size to ensure we find the right PFN and lay down the
> * mapping in the right place.
> */
> - fault->gfn = ALIGN_DOWN(fault->fault_ipa, fault->vma_pagesize) >> PAGE_SHIFT;
> + fault->gfn = ALIGN_DOWN(s2fd->fault_ipa, fault->vma_pagesize) >> PAGE_SHIFT;
>
> fault->mte_allowed = kvm_vma_mte_allowed(vma);
>
> @@ -1775,31 +1775,33 @@ static int kvm_s2_fault_get_vma_info(struct kvm_s2_fault *fault)
> return 0;
> }
>
> -static gfn_t get_canonical_gfn(struct kvm_s2_fault *fault)
> +static gfn_t get_canonical_gfn(const struct kvm_s2_fault_desc *s2fd,
> + const struct kvm_s2_fault *fault)
> {
> phys_addr_t ipa;
>
> - if (!fault->nested)
> + if (!s2fd->nested)
> return fault->gfn;
>
> - ipa = kvm_s2_trans_output(fault->nested);
> + ipa = kvm_s2_trans_output(s2fd->nested);
> return ALIGN_DOWN(ipa, fault->vma_pagesize) >> PAGE_SHIFT;
> }
>
> -static int kvm_s2_fault_pin_pfn(struct kvm_s2_fault *fault)
> +static int kvm_s2_fault_pin_pfn(const struct kvm_s2_fault_desc *s2fd,
> + struct kvm_s2_fault *fault)
> {
> int ret;
>
> - ret = kvm_s2_fault_get_vma_info(fault);
> + ret = kvm_s2_fault_get_vma_info(s2fd, fault);
> if (ret)
> return ret;
>
> - fault->pfn = __kvm_faultin_pfn(fault->memslot, get_canonical_gfn(fault),
> + fault->pfn = __kvm_faultin_pfn(s2fd->memslot, get_canonical_gfn(s2fd, fault),
> fault->write_fault ? FOLL_WRITE : 0,
> &fault->writable, &fault->page);
> if (unlikely(is_error_noslot_pfn(fault->pfn))) {
> if (fault->pfn == KVM_PFN_ERR_HWPOISON) {
> - kvm_send_hwpoison_signal(fault->hva, __ffs(fault->vma_pagesize));
> + kvm_send_hwpoison_signal(s2fd->hva, __ffs(fault->vma_pagesize));
> return 0;
> }
> return -EFAULT;
> @@ -1808,9 +1810,10 @@ static int kvm_s2_fault_pin_pfn(struct kvm_s2_fault *fault)
> return 1;
> }
>
> -static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
> +static int kvm_s2_fault_compute_prot(const struct kvm_s2_fault_desc *s2fd,
> + struct kvm_s2_fault *fault)
> {
> - struct kvm *kvm = fault->vcpu->kvm;
> + struct kvm *kvm = s2fd->vcpu->kvm;
>
> /*
> * Check if this is non-struct page memory PFN, and cannot support
> @@ -1862,13 +1865,13 @@ static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
> * and trigger the exception here. Since the memslot is valid, inject
> * the fault back to the guest.
> */
> - if (esr_fsc_is_excl_atomic_fault(kvm_vcpu_get_esr(fault->vcpu))) {
> - kvm_inject_dabt_excl_atomic(fault->vcpu, kvm_vcpu_get_hfar(fault->vcpu));
> + if (esr_fsc_is_excl_atomic_fault(kvm_vcpu_get_esr(s2fd->vcpu))) {
> + kvm_inject_dabt_excl_atomic(s2fd->vcpu, kvm_vcpu_get_hfar(s2fd->vcpu));
> return 1;
> }
>
> - if (fault->nested)
> - adjust_nested_fault_perms(fault->nested, &fault->prot, &fault->writable);
> + if (s2fd->nested)
> + adjust_nested_fault_perms(s2fd->nested, &fault->prot, &fault->writable);
>
> if (fault->writable)
> fault->prot |= KVM_PGTABLE_PROT_W;
> @@ -1882,8 +1885,8 @@ static int kvm_s2_fault_compute_prot(struct kvm_s2_fault *fault)
> else if (cpus_have_final_cap(ARM64_HAS_CACHE_DIC))
> fault->prot |= KVM_PGTABLE_PROT_X;
>
> - if (fault->nested)
> - adjust_nested_exec_perms(kvm, fault->nested, &fault->prot);
> + if (s2fd->nested)
> + adjust_nested_exec_perms(kvm, s2fd->nested, &fault->prot);
>
> if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm)) {
> /* Check the VMM hasn't introduced a new disallowed VMA */
> @@ -1899,15 +1902,16 @@ static phys_addr_t get_ipa(const struct kvm_s2_fault *fault)
> return gfn_to_gpa(fault->gfn);
> }
>
> -static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> +static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> + struct kvm_s2_fault *fault, void *memcache)
> {
> - struct kvm *kvm = fault->vcpu->kvm;
> + struct kvm *kvm = s2fd->vcpu->kvm;
> struct kvm_pgtable *pgt;
> int ret;
> enum kvm_pgtable_walk_flags flags = KVM_PGTABLE_WALK_SHARED;
>
> kvm_fault_lock(kvm);
> - pgt = fault->vcpu->arch.hw_mmu->pgt;
> + pgt = s2fd->vcpu->arch.hw_mmu->pgt;
> ret = -EAGAIN;
> if (mmu_invalidate_retry(kvm, fault->mmu_seq))
> goto out_unlock;
> @@ -1921,8 +1925,8 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
> if (fault->fault_is_perm && fault->fault_granule > PAGE_SIZE) {
> fault->vma_pagesize = fault->fault_granule;
> } else {
> - fault->vma_pagesize = transparent_hugepage_adjust(kvm, fault->memslot,
> - fault->hva, &fault->pfn,
> + fault->vma_pagesize = transparent_hugepage_adjust(kvm, s2fd->memslot,
> + s2fd->hva, &fault->pfn,
> &fault->gfn);
>
> if (fault->vma_pagesize < 0) {
> @@ -1960,34 +1964,27 @@ static int kvm_s2_fault_map(struct kvm_s2_fault *fault, void *memcache)
>
> /* Mark the page dirty only if the fault is handled successfully */
> if (fault->writable && !ret)
> - mark_page_dirty_in_slot(kvm, fault->memslot, get_canonical_gfn(fault));
> + mark_page_dirty_in_slot(kvm, s2fd->memslot, get_canonical_gfn(s2fd, fault));
>
> if (ret != -EAGAIN)
> return ret;
> return 0;
> }
>
> -static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> - struct kvm_s2_trans *nested,
> - struct kvm_memory_slot *memslot, unsigned long hva,
> - bool fault_is_perm)
> +static int user_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> {
> - bool write_fault = kvm_is_write_fault(vcpu);
> - bool logging_active = memslot_is_logging(memslot);
> + bool perm_fault = kvm_vcpu_trap_is_permission_fault(s2fd->vcpu);
> + bool write_fault = kvm_is_write_fault(s2fd->vcpu);
> + bool logging_active = memslot_is_logging(s2fd->memslot);
> struct kvm_s2_fault fault = {
> - .vcpu = vcpu,
> - .fault_ipa = fault_ipa,
> - .nested = nested,
> - .memslot = memslot,
> - .hva = hva,
> - .fault_is_perm = fault_is_perm,
> + .fault_is_perm = perm_fault,
> .logging_active = logging_active,
> .force_pte = logging_active,
> .prot = KVM_PGTABLE_PROT_R,
> - .fault_granule = fault_is_perm ? kvm_vcpu_trap_get_perm_fault_granule(vcpu) : 0,
> + .fault_granule = perm_fault ? kvm_vcpu_trap_get_perm_fault_granule(s2fd->vcpu) : 0,
> .write_fault = write_fault,
> - .exec_fault = kvm_vcpu_trap_is_exec_fault(vcpu),
> - .topup_memcache = !fault_is_perm || (logging_active && write_fault),
> + .exec_fault = kvm_vcpu_trap_is_exec_fault(s2fd->vcpu),
> + .topup_memcache = !perm_fault || (logging_active && write_fault),
> };
> void *memcache;
> int ret;
> @@ -2000,7 +1997,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> * only exception to this is when dirty logging is enabled at runtime
> * and a write fault needs to collapse a block entry into a table.
> */
> - ret = prepare_mmu_memcache(vcpu, fault.topup_memcache, &memcache);
> + ret = prepare_mmu_memcache(s2fd->vcpu, fault.topup_memcache, &memcache);
> if (ret)
> return ret;
>
> @@ -2008,17 +2005,17 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa,
> * Let's check if we will get back a huge page backed by hugetlbfs, or
> * get block mapping for device MMIO region.
> */
> - ret = kvm_s2_fault_pin_pfn(&fault);
> + ret = kvm_s2_fault_pin_pfn(s2fd, &fault);
> if (ret != 1)
> return ret;
>
> - ret = kvm_s2_fault_compute_prot(&fault);
> + ret = kvm_s2_fault_compute_prot(s2fd, &fault);
> if (ret) {
> kvm_release_page_unused(fault.page);
> return ret;
> }
>
> - return kvm_s2_fault_map(&fault, memcache);
> + return kvm_s2_fault_map(s2fd, &fault, memcache);
> }
>
> /* Resolve the access fault by making the page young again. */
> @@ -2284,12 +2281,20 @@ int kvm_handle_guest_abort(struct kvm_vcpu *vcpu)
> VM_WARN_ON_ONCE(kvm_vcpu_trap_is_permission_fault(vcpu) &&
> !write_fault && !kvm_vcpu_trap_is_exec_fault(vcpu));
>
> + const struct kvm_s2_fault_desc s2fd = {
> + .vcpu = vcpu,
> + .fault_ipa = fault_ipa,
> + .nested = nested,
> + .memslot = memslot,
> + .hva = hva,
> + };
> +
> if (kvm_slot_has_gmem(memslot))
> ret = gmem_abort(vcpu, fault_ipa, nested, memslot,
> esr_fsc_is_permission_fault(esr));
> else
> - ret = user_mem_abort(vcpu, fault_ipa, nested, memslot, hva,
> - esr_fsc_is_permission_fault(esr));
> + ret = user_mem_abort(&s2fd);
> +
> if (ret == 0)
> ret = 1;
> out:
^ permalink raw reply
* Re: [PATCH 1/2] pmdomain/rockchip: skip QoS operations for idle-only domains
From: Shawn Lin @ 2026-04-01 2:54 UTC (permalink / raw)
To: Daniel Bozeman
Cc: shawn.lin, linux-pm, linux-arm-kernel, linux-rockchip,
linux-kernel, ulf.hansson, heiko
In-Reply-To: <CAG+Ngm+xJCCQMPddZx8AbPEeH3rUrn3GKF575zXpGPJrnELvMw@mail.gmail.com>
在 2026/04/01 星期三 10:34, Daniel Bozeman 写道:
> The NanoPi Zero2 (RK3528) kernel panics during boot when a
> GPIO-controlled USB VBUS regulator is defined on GPIO4 (which
> is in PD_RKVENC). The goal of this series is to make USB host
> power work on boards that use GPIO4 for regulator control.
>
> The root cause is a probe ordering issue. On RK3528, the power
> domain controller's first probe attempt fails because PD_GPU's
> clock lookup returns -EPROBE_DEFER (CRU hasn't probed yet).
> The driver then tears down all domains, including PD_RKVENC
> which would have registered successfully (it has no clock
> requirements). During this window, the USB regulator driver
> probes and requests GPIO4, which is in the now-unregistered
> PD_RKVENC. This triggers a synchronous external abort.
>
> With patch 2 alone (skipping deferred domains), the idle-only
> domains register successfully. But the genpd framework then
> attempts to power them off via genpd_power_off_work_fn. This
> calls rockchip_pd_power(), which does QoS save and idle
> requests on domains with pwr_mask == 0 that cannot actually
> be powered off.
>
> To your question about why QoS registers become inaccessible
> on idle-only domains: I have not root-caused that specifically.
> What I can confirm is the crash trace below, which occurs when
> patch 2 is applied without patch 1. The abort happens during
This sounds like a parent-child dependency which hasn't been sorted
out. My another question will be: with patch 1 applied, how to save-
restore qos registers during normal S2R usage?
> rockchip_pmu_set_idle_request on an idle-only domain:
>
> Internal error: synchronous external abort: 0000000096000010
> CPU: 2 PID: 60 Comm: kworker/2:3
> Workqueue: pm genpd_power_off_work_fn
> pc : regmap_mmio_read32le+0x8/0x20
> lr : regmap_mmio_read+0x44/0x70
> Call trace:
> regmap_mmio_read32le+0x8/0x20
> _regmap_bus_reg_read+0x6c/0xac
> _regmap_read+0x60/0xd8
> regmap_read+0x4c/0x7c
> rockchip_pmu_set_idle_request.isra.0+0x94/0x1b4
> rockchip_pd_power+0x37c/0x608
> rockchip_pd_power_off+0x14/0x38
> genpd_power_off.isra.0+0x1f0/0x2f0
> genpd_power_off_work_fn+0x34/0x54
>
> The two patches work together: patch 1 prevents QoS access
> on idle-only domains, and patch 2 prevents the full probe
> teardown when a single domain defers.
>
> Tested on NanoPi Zero2 (fixes panic) and Radxa E20C (no
> regression).
>
> On Tue, Mar 31, 2026 at 6:17 PM Shawn Lin <shawn.lin@rock-chips.com
> <mailto:shawn.lin@rock-chips.com>> wrote:
>
> Hi Daniel,
>
> 在 2026/04/01 星期三 2:02, Daniel Bozeman 写道:
> > Idle-only power domains (pwr_mask == 0) cannot actually be powered
> > on or off. rockchip_do_pmu_set_power_domain() already returns early
> > for these domains, but rockchip_pd_power() still attempts QoS save
> > and idle requests before reaching that check.
> >
> > On RK3528, the idle-only domains (PD_RKVENC, PD_VO, PD_VPU) have
> > QoS registers that may be inaccessible when the generic power domain
> > framework attempts to power them off, leading to synchronous external
> > aborts.
> >
>
> Is it the real abort happened on your RK3528 board? I am trying to
> understand the problem first. Even with idle-only powerdomain, the code
> also save the QoS registers before set idle to the powerdomain, so
> how the QoS registers become inaccessible?
>
> > Return early from rockchip_pd_power() when pwr_mask is zero, matching
> > the existing guard in rockchip_do_pmu_set_power_domain().
> >
> > Fixes: 1fe767a56c32 ("soc: rockchip: power-domain: allow domains
> only handling idle requests")
> > Signed-off-by: Daniel Bozeman <daniel@orb.net
> <mailto:daniel@orb.net>>
> > ---
> > drivers/pmdomain/rockchip/pm-domains.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> > diff --git a/drivers/pmdomain/rockchip/pm-domains.c
> b/drivers/pmdomain/rockchip/pm-domains.c
> > index 490bbb1d1d..2eecae092a 100644
> > --- a/drivers/pmdomain/rockchip/pm-domains.c
> > +++ b/drivers/pmdomain/rockchip/pm-domains.c
> > @@ -640,6 +640,9 @@ static int rockchip_pd_power(struct
> rockchip_pm_domain *pd, bool power_on)
> > if (rockchip_pmu_domain_is_on(pd) == power_on)
> > return 0;
> >
> > + if (pd->info->pwr_mask == 0)
> > + return 0;
> > +
> > ret = clk_bulk_enable(pd->num_clks, pd->clks);
> > if (ret < 0) {
> > dev_err(pmu->dev, "failed to enable clocks\n");
> >
> > base-commit: bc330699801d3b4f99110365512caed5adcfaca3
>
^ permalink raw reply
* Re: [RESEND PATCH net v3 2/2] net: stmmac: Prevent indefinite RX stall on buffer exhaustion
From: Jakub Kicinski @ 2026-04-01 2:59 UTC (permalink / raw)
To: Sam Edwards
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Maxime Coquelin, Alexandre Torgue, Russell King (Oracle),
Maxime Chevallier, Ovidiu Panait, Vladimir Oltean, Baruch Siach,
Serge Semin, Giuseppe Cavallaro, netdev, linux-stm32,
linux-arm-kernel, linux-kernel, stable
In-Reply-To: <20260328192503.520689-3-CFSworks@gmail.com>
On Sat, 28 Mar 2026 12:25:03 -0700 Sam Edwards wrote:
> @@ -5870,6 +5871,10 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
> priv->xstats.rx_dropped += rx_dropped;
> priv->xstats.rx_errors += rx_errors;
>
> + /* If stmmac_rx_refill() failed, keep trying until it doesn't. */
> + if (unlikely(stmmac_rx_dirty(priv, queue) > 0))
> + return budget;
If the system is OOMing having ksoftirq busy looping indefinitely is
not going to be very helpful. 1) only react if the fill level is below
some critical threshold, 2) try to add some delay (timer)? before the
retry
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH] KVM: arm64: pkvm: Rollback refcount on hyp share/unshare error
From: Vincent Donnefort @ 2026-04-01 3:01 UTC (permalink / raw)
To: Quentin Perret
Cc: maz, oliver.upton, joey.gouly, suzuki.poulose, yuzenghui,
catalin.marinas, will, linux-arm-kernel, kvmarm, kernel-team
In-Reply-To: <acpCq1qZCMFqocs3@google.com>
On Mon, Mar 30, 2026 at 09:41:01AM +0000, Quentin Perret wrote:
> Hey Vincent,
>
> On Tuesday 24 Mar 2026 at 17:27:57 (+0000), Vincent Donnefort wrote:
> > If one of the HVC __pkvm_host_share_hyp or __pkvm_host_unshare_hyp fails,
> > rollback the refcount to ensure the hyp_shared_pfns tracking reflects
> > the actual sharing status.
>
> If any of these hypercalls fail I think we're still in trouble as
> kvm_{un}share_hyp() work on multi-page ranges and we could leak pages in
> a borked state if we fail halfway through. And failing any of these
> hypercalls is also sign of a bigger problem somewhere else so I wasn't
> too worried.
Yes, my bad, I haven't made that clear in the commit message: a failed HVC
right now is very much unlikely. I meant more to future proof and this isn't
fixing an existing corner case.
>
> But if we're going to fix this properly, I'd suggest also improving the
> error handling in kvm_share_hyp(). 'Fixing' kvm_unshare_hyp() is a bit
> harder because we must tell the caller to leak the data structure that
> was shared I presume, so maybe we just keep the WARN and cross our
> fingers :)
ack
>
> Cheers,
> Quentin
>
> > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> >
> > diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> > index 17d64a1e11e5..0fb41d2c8b44 100644
> > --- a/arch/arm64/kvm/mmu.c
> > +++ b/arch/arm64/kvm/mmu.c
> > @@ -493,11 +493,17 @@ static int share_pfn_hyp(u64 pfn)
> > goto unlock;
> > }
> >
> > + ret = kvm_call_hyp_nvhe(__pkvm_host_share_hyp, pfn);
> > + if (ret) {
> > + kfree(this);
> > + goto unlock;
> > + }
> > +
> > this->pfn = pfn;
> > this->count = 1;
> > rb_link_node(&this->node, parent, node);
> > rb_insert_color(&this->node, &hyp_shared_pfns);
> > - ret = kvm_call_hyp_nvhe(__pkvm_host_share_hyp, pfn);
> > +
> > unlock:
> > mutex_unlock(&hyp_shared_pfns_lock);
> >
> > @@ -521,9 +527,15 @@ static int unshare_pfn_hyp(u64 pfn)
> > if (this->count)
> > goto unlock;
> >
> > + ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_hyp, pfn);
> > + if (ret) {
> > + this->count++;
> > + goto unlock;
> > + }
> > +
> > rb_erase(&this->node, &hyp_shared_pfns);
> > kfree(this);
> > - ret = kvm_call_hyp_nvhe(__pkvm_host_unshare_hyp, pfn);
> > +
> > unlock:
> > mutex_unlock(&hyp_shared_pfns_lock);
> >
> >
> > base-commit: c369299895a591d96745d6492d4888259b004a9e
> > --
> > 2.53.0.1018.g2bb0e51243-goog
> >
^ permalink raw reply
* Re: [PATCH v2 17/30] KVM: arm64: Replace fault_is_perm with a helper
From: Anshuman Khandual @ 2026-04-01 3:18 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-18-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> Carrying a boolean to indicate that a given fault is a permission fault
> is slightly odd, as this is a property of the fault itself, and we'd
> better avoid duplicating state.
>
> For this purpose, introduce a kvm_s2_fault_is_perm() predicate that
> can take a fault descriptor as a parameter. fault_is_perm is therefore
> dropped from kvm_s2_fault.
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Reviewed-by: Joey Gouly <joey.gouly@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> ---
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> arch/arm64/kvm/mmu.c | 17 ++++++++++-------
> 1 file changed, 10 insertions(+), 7 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 09e32f08028e4..1e0d93d6d265a 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1711,8 +1711,6 @@ static short kvm_s2_resolve_vma_size(const struct kvm_s2_fault_desc *s2fd,
> }
>
> struct kvm_s2_fault {
> - bool fault_is_perm;
> -
> bool write_fault;
> bool exec_fault;
> bool writable;
> @@ -1732,6 +1730,11 @@ struct kvm_s2_fault {
> vm_flags_t vm_flags;
> };
>
> +static bool kvm_s2_fault_is_perm(const struct kvm_s2_fault_desc *s2fd)
> +{
> + return kvm_vcpu_trap_is_permission_fault(s2fd->vcpu);
> +}
> +
> static int kvm_s2_fault_get_vma_info(const struct kvm_s2_fault_desc *s2fd,
> struct kvm_s2_fault *fault)
> {
> @@ -1888,7 +1891,7 @@ static int kvm_s2_fault_compute_prot(const struct kvm_s2_fault_desc *s2fd,
> if (s2fd->nested)
> adjust_nested_exec_perms(kvm, s2fd->nested, &fault->prot);
>
> - if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm)) {
> + if (!kvm_s2_fault_is_perm(s2fd) && !fault->s2_force_noncacheable && kvm_has_mte(kvm)) {
> /* Check the VMM hasn't introduced a new disallowed VMA */
> if (!fault->mte_allowed)
> return -EFAULT;
> @@ -1905,6 +1908,7 @@ static phys_addr_t get_ipa(const struct kvm_s2_fault *fault)
> static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> struct kvm_s2_fault *fault, void *memcache)
> {
> + bool fault_is_perm = kvm_s2_fault_is_perm(s2fd);
> struct kvm *kvm = s2fd->vcpu->kvm;
> struct kvm_pgtable *pgt;
> int ret;
> @@ -1922,7 +1926,7 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> */
> if (fault->vma_pagesize == PAGE_SIZE &&
> !(fault->force_pte || fault->s2_force_noncacheable)) {
> - if (fault->fault_is_perm && fault->fault_granule > PAGE_SIZE) {
> + if (fault_is_perm && fault->fault_granule > PAGE_SIZE) {
> fault->vma_pagesize = fault->fault_granule;
> } else {
> fault->vma_pagesize = transparent_hugepage_adjust(kvm, s2fd->memslot,
> @@ -1936,7 +1940,7 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> }
> }
>
> - if (!fault->fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm))
> + if (!fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm))
> sanitise_mte_tags(kvm, fault->pfn, fault->vma_pagesize);
>
> /*
> @@ -1944,7 +1948,7 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> * permissions only if fault->vma_pagesize equals fault->fault_granule. Otherwise,
> * kvm_pgtable_stage2_map() should be called to change block size.
> */
> - if (fault->fault_is_perm && fault->vma_pagesize == fault->fault_granule) {
> + if (fault_is_perm && fault->vma_pagesize == fault->fault_granule) {
> /*
> * Drop the SW bits in favour of those stored in the
> * PTE, which will be preserved.
> @@ -1977,7 +1981,6 @@ static int user_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> bool write_fault = kvm_is_write_fault(s2fd->vcpu);
> bool logging_active = memslot_is_logging(s2fd->memslot);
> struct kvm_s2_fault fault = {
> - .fault_is_perm = perm_fault,
> .logging_active = logging_active,
> .force_pte = logging_active,
> .prot = KVM_PGTABLE_PROT_R,
^ permalink raw reply
* Re: [PATCH v4] net: stmmac: skip VLAN restore when VLAN hash ops are missing
From: patchwork-bot+netdevbpf @ 2026-04-01 3:20 UTC (permalink / raw)
To: Michal Piekos
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, mcoquelin.stm32,
alexandre.torgue, ovidiu.panait.rb, netdev, linux-stm32,
linux-arm-kernel, linux-kernel
In-Reply-To: <20260328-vlan-restore-error-v4-1-f88624c530dc@mmpsystems.pl>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Sat, 28 Mar 2026 09:55:51 +0100 you wrote:
> stmmac_vlan_restore() unconditionally calls stmmac_vlan_update() when
> NETIF_F_VLAN_FEATURES is set. On platforms where priv->hw->vlan (or
> ->update_vlan_hash) is not provided, stmmac_update_vlan_hash() returns
> -EINVAL via stmmac_do_void_callback(), resulting in a spurious
> "Failed to restore VLANs" error even when no VLAN filtering is in use.
>
> Remove not needed comment.
> Remove not used return value from stmmac_vlan_restore().
>
> [...]
Here is the summary with links:
- [v4] net: stmmac: skip VLAN restore when VLAN hash ops are missing
https://git.kernel.org/netdev/net/c/48b3cd69265f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 18/30] KVM: arm64: Constrain fault_granule to kvm_s2_fault_map()
From: Anshuman Khandual @ 2026-04-01 3:26 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-19-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> The notion of fault_granule is specific to kvm_s2_fault_map(), and
> is unused anywhere else.
>
> Move this variable locally, removing it from kvm_s2_fault.
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> ---
> arch/arm64/kvm/mmu.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 1e0d93d6d265a..981c04a74ab7a 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1724,7 +1724,6 @@ struct kvm_s2_fault {
> bool logging_active;
> bool force_pte;
> long vma_pagesize;
> - long fault_granule;
> enum kvm_pgtable_prot prot;
> struct page *page;
> vm_flags_t vm_flags;
> @@ -1908,9 +1907,9 @@ static phys_addr_t get_ipa(const struct kvm_s2_fault *fault)
> static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> struct kvm_s2_fault *fault, void *memcache)
> {
> - bool fault_is_perm = kvm_s2_fault_is_perm(s2fd);
> struct kvm *kvm = s2fd->vcpu->kvm;
> struct kvm_pgtable *pgt;
> + long perm_fault_granule;
> int ret;
> enum kvm_pgtable_walk_flags flags = KVM_PGTABLE_WALK_SHARED;
>
> @@ -1920,14 +1919,17 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> if (mmu_invalidate_retry(kvm, fault->mmu_seq))
> goto out_unlock;
>
> + perm_fault_granule = (kvm_s2_fault_is_perm(s2fd) ?
> + kvm_vcpu_trap_get_perm_fault_granule(s2fd->vcpu) : 0);
> +
> /*
> * If we are not forced to use page mapping, check if we are
> * backed by a THP and thus use block mapping if possible.
> */
> if (fault->vma_pagesize == PAGE_SIZE &&
> !(fault->force_pte || fault->s2_force_noncacheable)) {
> - if (fault_is_perm && fault->fault_granule > PAGE_SIZE) {
> - fault->vma_pagesize = fault->fault_granule;
> + if (perm_fault_granule > PAGE_SIZE) {
> + fault->vma_pagesize = perm_fault_granule;
> } else {
> fault->vma_pagesize = transparent_hugepage_adjust(kvm, s2fd->memslot,
> s2fd->hva, &fault->pfn,
> @@ -1940,15 +1942,15 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> }
> }
>
> - if (!fault_is_perm && !fault->s2_force_noncacheable && kvm_has_mte(kvm))
> + if (!perm_fault_granule && !fault->s2_force_noncacheable && kvm_has_mte(kvm))
> sanitise_mte_tags(kvm, fault->pfn, fault->vma_pagesize);
>
> /*
> * Under the premise of getting a FSC_PERM fault, we just need to relax
> - * permissions only if fault->vma_pagesize equals fault->fault_granule. Otherwise,
> + * permissions only if vma_pagesize equals perm_fault_granule. Otherwise,
> * kvm_pgtable_stage2_map() should be called to change block size.
> */
> - if (fault_is_perm && fault->vma_pagesize == fault->fault_granule) {
> + if (fault->vma_pagesize == perm_fault_granule) {
> /*
> * Drop the SW bits in favour of those stored in the
> * PTE, which will be preserved.
> @@ -1984,7 +1986,6 @@ static int user_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> .logging_active = logging_active,
> .force_pte = logging_active,
> .prot = KVM_PGTABLE_PROT_R,
> - .fault_granule = perm_fault ? kvm_vcpu_trap_get_perm_fault_granule(s2fd->vcpu) : 0,
> .write_fault = write_fault,
> .exec_fault = kvm_vcpu_trap_is_exec_fault(s2fd->vcpu),
> .topup_memcache = !perm_fault || (logging_active && write_fault),
^ permalink raw reply
* Re: [PATCH v2 19/30] KVM: arm64: Kill write_fault from kvm_s2_fault
From: Anshuman Khandual @ 2026-04-01 3:31 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-20-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> We already have kvm_is_write_fault() as a predicate indicating
> a S2 fault on a write, and we're better off just using that instead
> of duplicating the state.
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
> ---
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> arch/arm64/kvm/mmu.c | 11 +++--------
> 1 file changed, 3 insertions(+), 8 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 981c04a74ab7a..7dab0c3faa5bf 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1711,7 +1711,6 @@ static short kvm_s2_resolve_vma_size(const struct kvm_s2_fault_desc *s2fd,
> }
>
> struct kvm_s2_fault {
> - bool write_fault;
> bool exec_fault;
> bool writable;
> bool topup_memcache;
> @@ -1799,7 +1798,7 @@ static int kvm_s2_fault_pin_pfn(const struct kvm_s2_fault_desc *s2fd,
> return ret;
>
> fault->pfn = __kvm_faultin_pfn(s2fd->memslot, get_canonical_gfn(s2fd, fault),
> - fault->write_fault ? FOLL_WRITE : 0,
> + kvm_is_write_fault(s2fd->vcpu) ? FOLL_WRITE : 0,
> &fault->writable, &fault->page);
> if (unlikely(is_error_noslot_pfn(fault->pfn))) {
> if (fault->pfn == KVM_PFN_ERR_HWPOISON) {
> @@ -1850,7 +1849,7 @@ static int kvm_s2_fault_compute_prot(const struct kvm_s2_fault_desc *s2fd,
> */
> fault->s2_force_noncacheable = true;
> }
> - } else if (fault->logging_active && !fault->write_fault) {
> + } else if (fault->logging_active && !kvm_is_write_fault(s2fd->vcpu)) {
> /*
> * Only actually map the page as writable if this was a write
> * fault.
> @@ -1980,21 +1979,17 @@ static int kvm_s2_fault_map(const struct kvm_s2_fault_desc *s2fd,
> static int user_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> {
> bool perm_fault = kvm_vcpu_trap_is_permission_fault(s2fd->vcpu);
> - bool write_fault = kvm_is_write_fault(s2fd->vcpu);
> bool logging_active = memslot_is_logging(s2fd->memslot);
> struct kvm_s2_fault fault = {
> .logging_active = logging_active,
> .force_pte = logging_active,
> .prot = KVM_PGTABLE_PROT_R,
> - .write_fault = write_fault,
> .exec_fault = kvm_vcpu_trap_is_exec_fault(s2fd->vcpu),
> - .topup_memcache = !perm_fault || (logging_active && write_fault),
> + .topup_memcache = !perm_fault || (logging_active && kvm_is_write_fault(s2fd->vcpu)),
> };
> void *memcache;
> int ret;
>
> - VM_WARN_ON_ONCE(fault.write_fault && fault.exec_fault);
> -
> /*
> * Permission faults just need to update the existing leaf entry,
> * and so normally don't require allocations from the memcache. The
^ permalink raw reply
* Re: [PATCH v2 20/30] KVM: arm64: Kill exec_fault from kvm_s2_fault
From: Anshuman Khandual @ 2026-04-01 3:35 UTC (permalink / raw)
To: Marc Zyngier, kvmarm, linux-arm-kernel, kvm
Cc: Joey Gouly, Suzuki K Poulose, Oliver Upton, Zenghui Yu,
Fuad Tabba, Will Deacon, Quentin Perret
In-Reply-To: <20260327113618.4051534-21-maz@kernel.org>
On 27/03/26 5:06 PM, Marc Zyngier wrote:
> Similarly to write_fault, exec_fault can be advantageously replaced
> by the kvm_vcpu_trap_is_exec_fault() predicate where needed.
>
> Another one bites the dust...
>
> Tested-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Fuad Tabba <tabba@google.com>
> Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
> Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
> ---
> arch/arm64/kvm/mmu.c | 6 ++----
> 1 file changed, 2 insertions(+), 4 deletions(-)
>
> diff --git a/arch/arm64/kvm/mmu.c b/arch/arm64/kvm/mmu.c
> index 7dab0c3faa5bf..e8bda71e862b2 100644
> --- a/arch/arm64/kvm/mmu.c
> +++ b/arch/arm64/kvm/mmu.c
> @@ -1711,7 +1711,6 @@ static short kvm_s2_resolve_vma_size(const struct kvm_s2_fault_desc *s2fd,
> }
>
> struct kvm_s2_fault {
> - bool exec_fault;
> bool writable;
> bool topup_memcache;
> bool mte_allowed;
> @@ -1857,7 +1856,7 @@ static int kvm_s2_fault_compute_prot(const struct kvm_s2_fault_desc *s2fd,
> fault->writable = false;
> }
>
> - if (fault->exec_fault && fault->s2_force_noncacheable)
> + if (kvm_vcpu_trap_is_exec_fault(s2fd->vcpu) && fault->s2_force_noncacheable)
> return -ENOEXEC;
>
> /*
> @@ -1877,7 +1876,7 @@ static int kvm_s2_fault_compute_prot(const struct kvm_s2_fault_desc *s2fd,
> if (fault->writable)
> fault->prot |= KVM_PGTABLE_PROT_W;
>
> - if (fault->exec_fault)
> + if (kvm_vcpu_trap_is_exec_fault(s2fd->vcpu))
> fault->prot |= KVM_PGTABLE_PROT_X;
>
> if (fault->s2_force_noncacheable)
> @@ -1984,7 +1983,6 @@ static int user_mem_abort(const struct kvm_s2_fault_desc *s2fd)
> .logging_active = logging_active,
> .force_pte = logging_active,
> .prot = KVM_PGTABLE_PROT_R,
> - .exec_fault = kvm_vcpu_trap_is_exec_fault(s2fd->vcpu),
> .topup_memcache = !perm_fault || (logging_active && kvm_is_write_fault(s2fd->vcpu)),
> };
> void *memcache;
^ permalink raw reply
* [PATCH net v4 0/2] stmmac crash/stall fixes when under memory pressure
From: Sam Edwards @ 2026-04-01 4:19 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Maxime Coquelin, Alexandre Torgue, Russell King (Oracle),
Maxime Chevallier, Ovidiu Panait, Vladimir Oltean, Baruch Siach,
Serge Semin, Giuseppe Cavallaro, netdev, linux-stm32,
linux-arm-kernel, linux-kernel, Sam Edwards
Hi netdev,
This is v4 of my series containing a pair of bugfixes for the stmmac driver's
receive pipeline. These issues occur when stmmac_rx_refill() does not (fully)
succeed, which happens more frequently when free memory is low.
The first patch closes Bugzilla bug #221010 [1], where stmmac_rx() can circle
around to a still-dirty descriptor (with a NULL buffer pointer), mistake it for
a filled descriptor (due to OWN=0), and attempt to dereference the buffer.
In testing that patch, I discovered a second issue: starvation of available RX
buffers causes the NIC to stop sending interrupts; if the driver stops polling,
it will wait indefinitely for an interrupt that will never come. (Note: the
first patch makes this issue more prominent -- mostly because it lets the
system survive long enough to exhibit it -- but doesn't *cause* it.) The second
patch addresses that problem as well.
Both patches are minimal, appropriate for stable, and designated to `net`. My
focus is on small, obviously-correct, easy-to-explain changes: I'll follow up
with another patch/series (something like [2]) for `net-next` that fixes the
ring in a more robust way.
The tx and zc paths seem to have similar low-memory bugs, to be addressed in
separate series.
Regards,
Sam
---
[1] https://bugzilla.kernel.org/show_bug.cgi?id=221010
[2] https://lore.kernel.org/netdev/20260316021009.262358-4-CFSworks@gmail.com/
v4:
- Changed patch 2 to tolerate dirty stragglers up to a critical threshold (the
same threshold tolerated by the zero-copy path), to avoid nuisance looping
during OOM conditions (thanks Jakub)
v3: https://lore.kernel.org/netdev/20260328192503.520689-1-CFSworks@gmail.com/T/
- Rebased on latest net/main
- Changed patch 2 to require that stmmac_rx_refill() *fully* succeeds before
exiting polling, to reduce the chance of rx drops.
- DID NOT use the CIRC_SPACE() macro as suggested by Russell: I fear that the
perspective shift (first think of the dirty descriptors as the "work" that
refill "consumes" -- therefore the "space" is how much stmmac_rx() may loop)
is too counterintuitive for a stable fix, but I'll do it in v4 if reviewers
insist.
- Updated the recipients for the series, which was invalidated in v2 due to the
`Fixes:`
v2: https://lore.kernel.org/netdev/20260319184031.8596-1-CFSworks@gmail.com/T/
- Completely rewrote the commit message of patch 1, now assuming the reader is
generally familiar with DMA but wholly unfamiliar with the stmmac device
(thanks Jakub!)
- Added missing `Fixes:` to patch 2
- Moved patch 2's `int budget = limit;` decl per the reverse-xmas-tree rule
- Dropped patch 3: this was a code improvement not appropriate for stable
- Generated the series with --subject-prefix='PATCH net'
v1: https://lore.kernel.org/netdev/20260316021009.262358-1-CFSworks@gmail.com/
Sam Edwards (2):
net: stmmac: Prevent NULL deref when RX memory exhausted
net: stmmac: Prevent indefinite RX stall on buffer exhaustion
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--
2.52.0
^ permalink raw reply
* [PATCH net v4 1/2] net: stmmac: Prevent NULL deref when RX memory exhausted
From: Sam Edwards @ 2026-04-01 4:19 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Maxime Coquelin, Alexandre Torgue, Russell King (Oracle),
Maxime Chevallier, Ovidiu Panait, Vladimir Oltean, Baruch Siach,
Serge Semin, Giuseppe Cavallaro, netdev, linux-stm32,
linux-arm-kernel, linux-kernel, Sam Edwards, stable
In-Reply-To: <20260401041929.12392-1-CFSworks@gmail.com>
The CPU receives frames from the MAC through conventional DMA: the CPU
allocates buffers for the MAC, then the MAC fills them and returns
ownership to the CPU. For each hardware RX queue, the CPU and MAC
coordinate through a shared ring array of DMA descriptors: one
descriptor per DMA buffer. Each descriptor includes the buffer's
physical address and a status flag ("OWN") indicating which side owns
the buffer: OWN=0 for CPU, OWN=1 for MAC. The CPU is only allowed to set
the flag and the MAC is only allowed to clear it, and both must move
through the ring in sequence: thus the ring is used for both
"submissions" and "completions."
In the stmmac driver, stmmac_rx() bookmarks its position in the ring
with the `cur_rx` index. The main receive loop in that function checks
for rx_descs[cur_rx].own=0, gives the corresponding buffer to the
network stack (NULLing the pointer), and increments `cur_rx` modulo the
ring size. After the loop exits, stmmac_rx_refill(), which bookmarks its
position with `dirty_rx`, allocates fresh buffers and rearms the
descriptors (setting OWN=1). If it fails any allocation, it simply stops
early (leaving OWN=0) and will retry where it left off when next called.
This means descriptors have a three-stage lifecycle (terms my own):
- `empty` (OWN=1, buffer valid)
- `full` (OWN=0, buffer valid and populated)
- `dirty` (OWN=0, buffer NULL)
But because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In
the past (see 'Fixes:'), there was a bug where the loop could cycle
`cur_rx` all the way back to the first descriptor it dirtied, resulting
in a NULL dereference when mistaken for `full`. The aforementioned
commit resolved that *specific* failure by capping the loop's iteration
limit at `dma_rx_size - 1`, but this is only a partial fix: if the
previous stmmac_rx_refill() didn't complete, then there are leftover
`dirty` descriptors that the loop might encounter without needing to
cycle fully around. The current code therefore panics (see 'Closes:')
when stmmac_rx_refill() is memory-starved long enough for `cur_rx` to
catch up to `dirty_rx`.
Fix this by further tightening the clamp from `dma_rx_size - 1` to
`dma_rx_size - stmmac_rx_dirty() - 1`, subtracting any remnant dirty
entries and limiting the loop so that `cur_rx` cannot catch back up to
`dirty_rx`. This carries no risk of arithmetic underflow: since the
maximum possible return value of stmmac_rx_dirty() is `dma_rx_size - 1`,
the worst the clamp can do is prevent the loop from running at all.
Fixes: b6cb4541853c7 ("net: stmmac: avoid rx queue overrun")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221010
Cc: stable@vger.kernel.org
Signed-off-by: Sam Edwards <CFSworks@gmail.com>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 13d3cac056be..fc11f75f7dc0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5609,7 +5609,8 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
dma_dir = page_pool_get_dma_dir(rx_q->page_pool);
bufsz = DIV_ROUND_UP(priv->dma_conf.dma_buf_sz, PAGE_SIZE) * PAGE_SIZE;
- limit = min(priv->dma_conf.dma_rx_size - 1, (unsigned int)limit);
+ limit = min(priv->dma_conf.dma_rx_size - stmmac_rx_dirty(priv, queue) - 1,
+ (unsigned int)limit);
if (netif_msg_rx_status(priv)) {
void *rx_head;
--
2.52.0
^ permalink raw reply related
* [PATCH net v4 2/2] net: stmmac: Prevent indefinite RX stall on buffer exhaustion
From: Sam Edwards @ 2026-04-01 4:19 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Maxime Coquelin, Alexandre Torgue, Russell King (Oracle),
Maxime Chevallier, Ovidiu Panait, Vladimir Oltean, Baruch Siach,
Serge Semin, Giuseppe Cavallaro, netdev, linux-stm32,
linux-arm-kernel, linux-kernel, Sam Edwards, stable
In-Reply-To: <20260401041929.12392-1-CFSworks@gmail.com>
The stmmac driver handles interrupts in the usual NAPI way: an interrupt
arrives, the NAPI instance is scheduled and interrupts are masked, and
the actual work occurs in the NAPI polling function. Once no further
work remains, interrupts are unmasked and the NAPI instance is put to
sleep to await a future interrupt. In the receive case, the MAC only
sends the interrupt when a DMA operation completes; thus the driver must
make sure a usable RX DMA descriptor exists before expecting a future
interrupt.
The main receive loop in stmmac_rx() exits under one of 3 conditions:
1) It encounters a DMA descriptor with OWN=1, indicating that no further
pending data exists. The MAC will use this descriptor for the next
RX DMA operation, so the driver can expect a future interrupt.
2) It exhausts the NAPI budget. In this case, the driver doesn't know
whether the MAC has any usable DMA descriptors. But when the driver
consumes its full budget, that signals NAPI to keep polling, so the
question is moot.
3) It runs out of (non-dirty) descriptors in the RX ring. In this case,
the MAC will only have a usable descriptor if stmmac_rx_refill()
succeeds (at least partially).
Currently, stmmac_rx() lacks any check against scenario #3 and
stmmac_rx_refill() failing: it will stop NAPI polling and unmask
interrupts to await an interrupt that will never arrive, stalling the
receive pipeline indefinitely.
Also: even if not all descriptors are dirty, letting them accumulate
risks dropping frames in the next incoming traffic burst, if large
enough to exhaust the remaining valid ones.
Fix both of these problems by checking stmmac_rx_dirty() before return:
Use the same threshold as the zero-copy path (STMMAC_RX_FILL_BATCH) for
an unacceptably high number of neglected dirties, and tell NAPI to keep
polling (i.e. return budget) when that threshold is met.
Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.")
Cc: stable@vger.kernel.org
Signed-off-by: Sam Edwards <CFSworks@gmail.com>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index fc11f75f7dc0..6822ca27cb0f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5604,6 +5604,7 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
unsigned int desc_size;
struct sk_buff *skb = NULL;
struct stmmac_xdp_buff ctx;
+ int budget = limit;
int xdp_status = 0;
int bufsz;
@@ -5870,6 +5871,14 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
priv->xstats.rx_dropped += rx_dropped;
priv->xstats.rx_errors += rx_errors;
+ /* stmmac_rx_refill() may fail, leaving some dirty entries behind.
+ * A few is OK, but if it gets out of hand, we risk dropping frames
+ * in the next traffic burst; in the worst case (100% dirty) we won't
+ * even receive any future "DMA completed" interrupts.
+ */
+ if (unlikely(stmmac_rx_dirty(priv, queue) >= STMMAC_RX_FILL_BATCH))
+ return budget;
+
return count;
}
--
2.52.0
^ permalink raw reply related
* [PATCH v2 1/7] dt-bindings: soc: move,rename google,gs101-pmu-intr-gen and add exynos850
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
The PMU interrupt generation block introduced for the Google GS101 is
actually a standard Samsung Exynos IP block found in older SoCs, such
as the Exynos850, and is not exclusive to Google SoCs. To accurately
reflect its origin, move the schema file to under soc/samsung/
directory and rename it.
Concurrently, add the new "samsung,exynos850-pmu-intr-gen" compatible
string to the bindings. Support for this block is required to enable
power management features like CPU hotplug and idle states on Exynos850
platforms.
Also, move this file under Exynos850 SoC in MAINTAINERS entry.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
.../samsung,exynos850-pmu-intr-gen.yaml} | 8 +++++---
MAINTAINERS | 2 +-
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/Documentation/devicetree/bindings/soc/google/google,gs101-pmu-intr-gen.yaml b/Documentation/devicetree/bindings/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml
similarity index 70%
rename from Documentation/devicetree/bindings/soc/google/google,gs101-pmu-intr-gen.yaml
rename to Documentation/devicetree/bindings/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml
index 2be022ca6a7d..df23467d0e0e 100644
--- a/Documentation/devicetree/bindings/soc/google/google,gs101-pmu-intr-gen.yaml
+++ b/Documentation/devicetree/bindings/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml
@@ -1,10 +1,10 @@
# SPDX-License-Identifier: (GPL-2.0 OR BSD-2-Clause)
%YAML 1.2
---
-$id: http://devicetree.org/schemas/soc/google/google,gs101-pmu-intr-gen.yaml#
+$id: http://devicetree.org/schemas/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Google Power Management Unit (PMU) Interrupt Generation
+title: Samsung Power Management Unit (PMU) Interrupt Generation
description: |
PMU interrupt generator for handshaking between PMU through interrupts.
@@ -15,7 +15,9 @@ maintainers:
properties:
compatible:
items:
- - const: google,gs101-pmu-intr-gen
+ - enum:
+ - google,gs101-pmu-intr-gen
+ - samsung,exynos850-pmu-intr-gen
- const: syscon
reg:
diff --git a/MAINTAINERS b/MAINTAINERS
index ff935e197c21..e14e6f874e05 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -10947,7 +10947,6 @@ P: Documentation/process/maintainer-soc-clean-dts.rst
C: irc://irc.oftc.net/pixel6-kernel-dev
F: Documentation/devicetree/bindings/clock/google,gs101-clock.yaml
F: Documentation/devicetree/bindings/phy/google,lga-usb-phy.yaml
-F: Documentation/devicetree/bindings/soc/google/google,gs101-pmu-intr-gen.yaml
F: Documentation/devicetree/bindings/usb/google,lga-dwc3.yaml
F: arch/arm64/boot/dts/exynos/google/
F: drivers/clk/samsung/clk-gs101.c
@@ -23606,6 +23605,7 @@ L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
L: linux-samsung-soc@vger.kernel.org
S: Maintained
F: Documentation/devicetree/bindings/clock/samsung,exynos850-clock.yaml
+F: Documentation/devicetree/bindings/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml
F: arch/arm64/boot/dts/exynos/exynos850*
F: drivers/clk/samsung/clk-exynos850.c
F: include/dt-bindings/clock/exynos850.h
--
2.51.0
^ permalink raw reply related
* [PATCH v2 0/7] Exynos-pmu: Generalise cpu{hotplug,idle},PMU intr gen and add Exynos850 CPU hotplug
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
(b4 forces me to send this as v2, however previous version was RFC and b4
uses RFC as v1; but I don't want to break b4 tracking and b4 comparison)
Series generalises the GS101-specific cpuhotplug, cpuidle and PMU interrupt
generation block support, which is currently implemented specifically for
the google GS101 SoC, to make it reusable by other Samsung Exynos SoCs.
The PMU interrupt generation IP block introduced for google GS101 is a
standard Samsung Exynos block found in other SoCs, including Exynos850,
and it is not strictly exclusive to google Exynos-based platforms.
Access to this block is required to implement and enable cpuhotplug
on Exynos850-based boards.
As a next steps it will be possible to enable idle states on top of it.
First patches work on DT bindings to reflect that Exynos850 SoC predates
gs101 one, introduce new samsung,pmu-intr-gen-syscon phandle.
Then series generalises ("Exynosizes") cpuhotplug/cpuidle routines by
deferring platform-specific PMU and PMU-intr-gen updates to platform-
specific callbacks and then finally introduces new file exynos850-pmu.c
where such callbacks are implemented for Exynos850. Last commit adds
pmu_intr_gen DT node to exynos850.dtsi.
This series was tested on Exynos850 WinLink E850-96 board:
-- by spinning "chcpu -d 1-7; chcpu -e 1-7" in a loop for a few hours;
-- by running script [1] that randomly offlines or onlines random cpus
for a few hours.
I do not have access to a development google Pixel 6 or other gs101-based
devices to verify. I tried to implement it in way to not break anything
for gs101, but testing from others is highly appreciated.
Otherwise, if it can be tested on a "normal" pixel6 phone without breaking
userdata/android there, then please point me to instructions.
Will check sashiko after submitting this to see if anything can be improved.
Thanks,
Alexey
[1]: https://github.com/laklimov/xlam/blob/main/e850_cpuhotplug_random.sh
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
Changes in v2:
- moved gs101 cpu {offline,online} callbacks to gs101-pmu.c, updated MAINTAINERS;
- added new file exynos850-pmu.c with cpu {offline,online} callbacks and
exynos850 pmu data;
- new patch that adds exynos850-pmu.c to MAINTAINERS;
- moved pmu_intr_gen to right after pmu_system_controller@11860000;
- merged two patches that update google,gs101-pmu-intr-gen.yaml together,
now rename and adding exynos850 entry goes in a single patch;
- commits 5 and 6 from RFC series are merged together and reworked,
cpu_pmu_{offline,online} callbacks are moved into pmu_data struct, and
callbacks now need pmu_context as an argument, exynos_pmu_context and
CPU_INFORM defines are moved to exynos-pmu.h, gs101 callbacks
renamed. It is really better to check commit description.
- Link to RFC (v1 from b4 point of view):
https://lore.kernel.org/r/20260226-exynos850-cpuhotplug-v1-0-71d7c4063382@linaro.org
---
Alexey Klimov (7):
dt-bindings: soc: move,rename google,gs101-pmu-intr-gen and add exynos850
dt-bindings: soc: samsung: exynos-pmu: add samsung,pmu-intr-gen phandle
dt-bindings: soc: samsung: exynos-pmu: deprecate google,pmu-intr-gen-syscon
soc: samsung: exynos-pmu: generalise gs101-specific cpu{idle,hotplug} for Exynos SoCs
soc: samsung: exynos-pmu: add Exynos850 CPU hotplug support
MAINTAINERS: add exynos850-pmu.c to Exynos850 entry
arm64: dts: exynos850: add PMU interrupt generation node
.../bindings/soc/samsung/exynos-pmu.yaml | 24 ++++
.../samsung,exynos850-pmu-intr-gen.yaml} | 8 +-
MAINTAINERS | 4 +-
arch/arm64/boot/dts/exynos/exynos850.dtsi | 6 +
drivers/soc/samsung/Makefile | 2 +-
drivers/soc/samsung/exynos-pmu.c | 127 +++++----------------
drivers/soc/samsung/exynos-pmu.h | 32 ++++++
drivers/soc/samsung/exynos850-pmu.c | 78 +++++++++++++
drivers/soc/samsung/gs101-pmu.c | 57 +++++++++
include/linux/soc/samsung/exynos-regs-pmu.h | 15 ++-
10 files changed, 245 insertions(+), 108 deletions(-)
---
base-commit: 3b058d1aeeeff27a7289529c4944291613b364e9
change-id: 20260226-exynos850-cpuhotplug-69f1976eefa8
Best regards,
--
Alexey Klimov <alexey.klimov@linaro.org>
^ permalink raw reply
* [PATCH v2 2/7] dt-bindings: soc: samsung: exynos-pmu: add samsung,pmu-intr-gen phandle
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
Some Exynos-based SoCs, for instance Exynos850, require access
to the pmu interrupt generation register region which is exposed
as a syscon. Update the exynos-pmu bindings documentation to
reflect this.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
.../devicetree/bindings/soc/samsung/exynos-pmu.yaml | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml b/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
index 76ce7e98c10f..92acdfd5d44e 100644
--- a/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
+++ b/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
@@ -110,6 +110,11 @@ properties:
description:
Node for reboot method
+ samsung,pmu-intr-gen-syscon:
+ $ref: /schemas/types.yaml#/definitions/phandle
+ description:
+ Phandle to PMU interrupt generation interface.
+
google,pmu-intr-gen-syscon:
$ref: /schemas/types.yaml#/definitions/phandle
description:
@@ -189,6 +194,19 @@ allOf:
properties:
google,pmu-intr-gen-syscon: false
+ - if:
+ properties:
+ compatible:
+ contains:
+ enum:
+ - samsung,exynos850-pmu
+ then:
+ required:
+ - samsung,pmu-intr-gen-syscon
+ else:
+ properties:
+ samsung,pmu-intr-gen-syscon: false
+
examples:
- |
#include <dt-bindings/clock/exynos5250.h>
--
2.51.0
^ permalink raw reply related
* [PATCH v2 6/7] MAINTAINERS: add exynos850-pmu.c to Exynos850 entry
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
Update Exynos850 entry to include new file
drivers/soc/samsung/exynos850-pmu.c. Add myself as M
there.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
MAINTAINERS | 2 ++
1 file changed, 2 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index e14e6f874e05..4b28e92b4d9b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -23601,6 +23601,7 @@ F: include/dt-bindings/clock/samsung,exynos2200-cmu.h
SAMSUNG EXYNOS850 SoC SUPPORT
M: Sam Protsenko <semen.protsenko@linaro.org>
+M: Alexey Klimov <alexey.klimov@linaro.org>
L: linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
L: linux-samsung-soc@vger.kernel.org
S: Maintained
@@ -23608,6 +23609,7 @@ F: Documentation/devicetree/bindings/clock/samsung,exynos850-clock.yaml
F: Documentation/devicetree/bindings/soc/samsung/samsung,exynos850-pmu-intr-gen.yaml
F: arch/arm64/boot/dts/exynos/exynos850*
F: drivers/clk/samsung/clk-exynos850.c
+F: drivers/soc/samsung/exynos850-pmu.c
F: include/dt-bindings/clock/exynos850.h
SAMSUNG EXYNOS ACPM MAILBOX PROTOCOL
--
2.51.0
^ permalink raw reply related
* [PATCH v2 3/7] dt-bindings: soc: samsung: exynos-pmu: deprecate google,pmu-intr-gen-syscon
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
The generic property samsung,pmu-intr-gen-syscon should be used
by default for Samsung Exynos PMU hardware blocks. Update binding
document to add deprecated flag for google,pmu-intr-gen-syscon
property.
While at this, also add dependency to not allow usage of both
above mentioned properties in the same time.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml b/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
index 92acdfd5d44e..1ff1a8729989 100644
--- a/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
+++ b/Documentation/devicetree/bindings/soc/samsung/exynos-pmu.yaml
@@ -119,6 +119,7 @@ properties:
$ref: /schemas/types.yaml#/definitions/phandle
description:
Phandle to PMU interrupt generation interface.
+ deprecated: true
required:
- compatible
@@ -207,6 +208,11 @@ allOf:
properties:
samsung,pmu-intr-gen-syscon: false
+dependencies:
+ google,pmu-intr-gen-syscon:
+ not:
+ required: ['samsung,pmu-intr-gen-syscon']
+
examples:
- |
#include <dt-bindings/clock/exynos5250.h>
--
2.51.0
^ permalink raw reply related
* [PATCH v2 4/7] soc: samsung: exynos-pmu: generalise gs101-specific cpu{idle,hotplug} for Exynos SoCs
From: Alexey Klimov @ 2026-04-01 4:51 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
The cpuhotplug and cpuidle support for GS101-based SoCs which
utilizes GS101 PMU interrupts generation block can be generalised
to be (re)used for other Exynos-based SoCs. Also, the GS101 PMU
interrupts generation block is not exclusive to Google GS101 SoCs
and should be made more Exynos-generic.
Specifically, apply the following changes:
- rename gs101-specific calls, structs, names to be exynos-prefixed;
- move exynos_pmu_context and CPU_INFORM_* defines into exynos-pmu.h;
- introduce cpu_pmu_{offline,online} callbacks in driver-specific
exynos_pmu_data which can be used to hold PMU and PMU intr gen
update routines for different platforms and update cpuidle and cpuhotplug
support to use them;
- query the "samsung,pmu-intr-gen-syscon" phandle to reflect updates in
the DT bindings;
- add checks for the presense of cpu_pmu_{offline,online} callbacks;
- move and rename gs101-specific cpu{offline,online} PMU updates
routines into gs101-pmu.c file, also removing underscore prefix;
- update gs101_pmu_data to use newly introduced callbacks;
- rename PMU interrupts generation GS101_INTR_* regs to EXYNOS_INTR_*.
This allows other platforms to add cpuhotplug and cpuidle support in
a similar manner, using their own platform-specific PMU and
PMU intr gen update routines.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
drivers/soc/samsung/exynos-pmu.c | 126 +++++++---------------------
drivers/soc/samsung/exynos-pmu.h | 31 +++++++
drivers/soc/samsung/gs101-pmu.c | 57 +++++++++++++
include/linux/soc/samsung/exynos-regs-pmu.h | 10 +--
4 files changed, 121 insertions(+), 103 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index d58376c38179..4e5fcc01e5e0 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -24,22 +24,6 @@
#include "exynos-pmu.h"
-struct exynos_pmu_context {
- struct device *dev;
- const struct exynos_pmu_data *pmu_data;
- struct regmap *pmureg;
- struct regmap *pmuintrgen;
- /*
- * Serialization lock for CPU hot plug and cpuidle ACPM hint
- * programming. Also protects in_cpuhp, sys_insuspend & sys_inreboot
- * flags.
- */
- raw_spinlock_t cpupm_lock;
- unsigned long *in_cpuhp;
- bool sys_insuspend;
- bool sys_inreboot;
-};
-
void __iomem *pmu_base_addr;
static struct exynos_pmu_context *pmu_context;
/* forward declaration */
@@ -219,44 +203,8 @@ struct regmap *exynos_get_pmu_regmap_by_phandle(struct device_node *np,
}
EXPORT_SYMBOL_GPL(exynos_get_pmu_regmap_by_phandle);
-/*
- * CPU_INFORM register "hint" values are required to be programmed in addition to
- * the standard PSCI calls to have functional CPU hotplug and CPU idle states.
- * This is required to workaround limitations in the el3mon/ACPM firmware.
- */
-#define CPU_INFORM_CLEAR 0
-#define CPU_INFORM_C2 1
-
-/*
- * __gs101_cpu_pmu_ prefix functions are common code shared by CPU PM notifiers
- * (CPUIdle) and CPU hotplug callbacks. Functions should be called with IRQs
- * disabled and cpupm_lock held.
- */
-static int __gs101_cpu_pmu_online(unsigned int cpu)
- __must_hold(&pmu_context->cpupm_lock)
-{
- unsigned int cpuhint = smp_processor_id();
- u32 reg, mask;
-
- /* clear cpu inform hint */
- regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
- CPU_INFORM_CLEAR);
-
- mask = BIT(cpu);
-
- regmap_update_bits(pmu_context->pmuintrgen, GS101_GRP2_INTR_BID_ENABLE,
- mask, (0 << cpu));
-
- regmap_read(pmu_context->pmuintrgen, GS101_GRP2_INTR_BID_UPEND, ®);
-
- regmap_write(pmu_context->pmuintrgen, GS101_GRP2_INTR_BID_CLEAR,
- reg & mask);
-
- return 0;
-}
-
/* Called from CPU PM notifier (CPUIdle code path) with IRQs disabled */
-static int gs101_cpu_pmu_online(void)
+static int exynos_cpu_pmu_online(void)
{
int cpu;
@@ -268,20 +216,20 @@ static int gs101_cpu_pmu_online(void)
}
cpu = smp_processor_id();
- __gs101_cpu_pmu_online(cpu);
+ pmu_context->pmu_data->cpu_pmu_online(pmu_context, cpu);
raw_spin_unlock(&pmu_context->cpupm_lock);
return NOTIFY_OK;
}
/* Called from CPU hot plug callback with IRQs enabled */
-static int gs101_cpuhp_pmu_online(unsigned int cpu)
+static int exynos_cpuhp_pmu_online(unsigned int cpu)
{
unsigned long flags;
raw_spin_lock_irqsave(&pmu_context->cpupm_lock, flags);
- __gs101_cpu_pmu_online(cpu);
+ pmu_context->pmu_data->cpu_pmu_online(pmu_context, cpu);
/*
* Mark this CPU as having finished the hotplug.
* This means this CPU can now enter C2 idle state.
@@ -292,35 +240,8 @@ static int gs101_cpuhp_pmu_online(unsigned int cpu)
return 0;
}
-/* Common function shared by both CPU hot plug and CPUIdle */
-static int __gs101_cpu_pmu_offline(unsigned int cpu)
- __must_hold(&pmu_context->cpupm_lock)
-{
- unsigned int cpuhint = smp_processor_id();
- u32 reg, mask;
-
- /* set cpu inform hint */
- regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
- CPU_INFORM_C2);
-
- mask = BIT(cpu);
- regmap_update_bits(pmu_context->pmuintrgen, GS101_GRP2_INTR_BID_ENABLE,
- mask, BIT(cpu));
-
- regmap_read(pmu_context->pmuintrgen, GS101_GRP1_INTR_BID_UPEND, ®);
- regmap_write(pmu_context->pmuintrgen, GS101_GRP1_INTR_BID_CLEAR,
- reg & mask);
-
- mask = (BIT(cpu + 8));
- regmap_read(pmu_context->pmuintrgen, GS101_GRP1_INTR_BID_UPEND, ®);
- regmap_write(pmu_context->pmuintrgen, GS101_GRP1_INTR_BID_CLEAR,
- reg & mask);
-
- return 0;
-}
-
/* Called from CPU PM notifier (CPUIdle code path) with IRQs disabled */
-static int gs101_cpu_pmu_offline(void)
+static int exynos_cpu_pmu_offline(void)
{
int cpu;
@@ -338,14 +259,14 @@ static int gs101_cpu_pmu_offline(void)
return NOTIFY_OK;
}
- __gs101_cpu_pmu_offline(cpu);
+ pmu_context->pmu_data->cpu_pmu_offline(pmu_context, cpu);
raw_spin_unlock(&pmu_context->cpupm_lock);
return NOTIFY_OK;
}
/* Called from CPU hot plug callback with IRQs enabled */
-static int gs101_cpuhp_pmu_offline(unsigned int cpu)
+static int exynos_cpuhp_pmu_offline(unsigned int cpu)
{
unsigned long flags;
@@ -355,29 +276,29 @@ static int gs101_cpuhp_pmu_offline(unsigned int cpu)
* ACPM the CPU entering hotplug should not enter C2 idle state.
*/
set_bit(cpu, pmu_context->in_cpuhp);
- __gs101_cpu_pmu_offline(cpu);
+ pmu_context->pmu_data->cpu_pmu_offline(pmu_context, cpu);
raw_spin_unlock_irqrestore(&pmu_context->cpupm_lock, flags);
return 0;
}
-static int gs101_cpu_pm_notify_callback(struct notifier_block *self,
+static int exynos_cpu_pm_notify_callback(struct notifier_block *self,
unsigned long action, void *v)
{
switch (action) {
case CPU_PM_ENTER:
- return gs101_cpu_pmu_offline();
+ return exynos_cpu_pmu_offline();
case CPU_PM_EXIT:
- return gs101_cpu_pmu_online();
+ return exynos_cpu_pmu_online();
}
return NOTIFY_OK;
}
-static struct notifier_block gs101_cpu_pm_notifier = {
- .notifier_call = gs101_cpu_pm_notify_callback,
+static struct notifier_block exynos_cpu_pm_notifier = {
+ .notifier_call = exynos_cpu_pm_notify_callback,
/*
* We want to be called first, as the ACPM hint and handshake is what
* puts the CPU into C2.
@@ -414,8 +335,12 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
void __iomem *virt_addr;
int ret, cpu;
- intr_gen_node = of_parse_phandle(dev->of_node,
- "google,pmu-intr-gen-syscon", 0);
+ intr_gen_node = of_parse_phandle(dev->of_node, "samsung,pmu-intr-gen-syscon", 0);
+
+ /* Fall back to the google pmu intr gen property for older DTBs */
+ if (!intr_gen_node)
+ intr_gen_node = of_parse_phandle(dev->of_node, "google,pmu-intr-gen-syscon", 0);
+
if (!intr_gen_node) {
/*
* To maintain support for older DTs that didn't specify syscon
@@ -425,6 +350,11 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
return 0;
}
+ if (!pmu_context->pmu_data->cpu_pmu_offline || !pmu_context->pmu_data->cpu_pmu_online) {
+ dev_err(dev, "PMU write/read sequence is not present for cpuhotplug and cpuidle\n");
+ return -ENODEV;
+ }
+
/*
* To avoid lockdep issues (CPU PM notifiers use raw spinlocks) create
* a mmio regmap for pmu-intr-gen that uses raw spinlocks instead of
@@ -458,17 +388,17 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
/* set PMU to power on */
for_each_online_cpu(cpu)
- gs101_cpuhp_pmu_online(cpu);
+ exynos_cpuhp_pmu_online(cpu);
/* register CPU hotplug callbacks */
cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
- gs101_cpuhp_pmu_online, NULL);
+ exynos_cpuhp_pmu_online, NULL);
cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
- NULL, gs101_cpuhp_pmu_offline);
+ NULL, exynos_cpuhp_pmu_offline);
/* register CPU PM notifiers for cpuidle */
- cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
+ cpu_pm_register_notifier(&exynos_cpu_pm_notifier);
register_reboot_notifier(&exynos_cpupm_reboot_nb);
return 0;
}
diff --git a/drivers/soc/samsung/exynos-pmu.h b/drivers/soc/samsung/exynos-pmu.h
index fbe381e2a2e1..186299a049a8 100644
--- a/drivers/soc/samsung/exynos-pmu.h
+++ b/drivers/soc/samsung/exynos-pmu.h
@@ -13,6 +13,14 @@
#define PMU_TABLE_END (-1U)
+/*
+ * CPU_INFORM register "hint" values are required to be programmed in addition to
+ * the standard PSCI calls to have functional CPU hotplug and CPU idle states.
+ * This is required to workaround limitations in the el3mon/ACPM firmware.
+ */
+#define CPU_INFORM_CLEAR 0
+#define CPU_INFORM_C2 1
+
struct regmap_access_table;
struct exynos_pmu_conf {
@@ -20,6 +28,22 @@ struct exynos_pmu_conf {
u8 val[NUM_SYS_POWERDOWN];
};
+struct exynos_pmu_context {
+ struct device *dev;
+ const struct exynos_pmu_data *pmu_data;
+ struct regmap *pmureg;
+ struct regmap *pmuintrgen;
+ /*
+ * Serialization lock for CPU hot plug and cpuidle ACPM hint
+ * programming. Also protects in_cpuhp, sys_insuspend & sys_inreboot
+ * flags.
+ */
+ raw_spinlock_t cpupm_lock;
+ unsigned long *in_cpuhp;
+ bool sys_insuspend;
+ bool sys_inreboot;
+};
+
/**
* struct exynos_pmu_data - of_device_id (match) data
*
@@ -44,6 +68,10 @@ struct exynos_pmu_conf {
* used (i.e. when @pmu_secure is @true).
* @wr_table: A table of writable register ranges in case a custom regmap is
* used (i.e. when @pmu_secure is @true).
+ * @cpu_pmu_offline: Optional callback to be called before entering CPU offline
+ * or idle state. Only valid when pmu_cpuhp set to true.
+ * @cpu_pmu_online: Optional callback to be called after CPU onlined or after
+ * exiting idle state. Only valid when pmu_cpuhp set to true.
*/
struct exynos_pmu_data {
const struct exynos_pmu_conf *pmu_config;
@@ -57,6 +85,9 @@ struct exynos_pmu_data {
const struct regmap_access_table *rd_table;
const struct regmap_access_table *wr_table;
+
+ int (*cpu_pmu_offline)(struct exynos_pmu_context *pmu_context, unsigned int cpu);
+ int (*cpu_pmu_online)(struct exynos_pmu_context *pmu_context, unsigned int cpu);
};
extern void __iomem *pmu_base_addr;
diff --git a/drivers/soc/samsung/gs101-pmu.c b/drivers/soc/samsung/gs101-pmu.c
index 17dadc1b9c6e..5f2a59924144 100644
--- a/drivers/soc/samsung/gs101-pmu.c
+++ b/drivers/soc/samsung/gs101-pmu.c
@@ -322,11 +322,68 @@ static const struct regmap_access_table gs101_pmu_wr_table = {
.n_no_ranges = ARRAY_SIZE(gs101_pmu_ro_registers),
};
+/*
+ * gs101_cpu_pmu_ prefix functions are common code shared by CPU PM notifiers
+ * (CPUIdle) and CPU hotplug callbacks. Functions should be called with IRQs
+ * disabled and cpupm_lock held.
+ */
+static int gs101_cpu_pmu_online(struct exynos_pmu_context *pmu_context, unsigned int cpu)
+ __must_hold(&pmu_context->cpupm_lock)
+{
+ unsigned int cpuhint = smp_processor_id();
+ u32 reg, mask;
+
+ /* clear cpu inform hint */
+ regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
+ CPU_INFORM_CLEAR);
+
+ mask = BIT(cpu);
+
+ regmap_update_bits(pmu_context->pmuintrgen, EXYNOS_GRP2_INTR_BID_ENABLE,
+ mask, (0 << cpu));
+
+ regmap_read(pmu_context->pmuintrgen, EXYNOS_GRP2_INTR_BID_UPEND, ®);
+
+ regmap_write(pmu_context->pmuintrgen, EXYNOS_GRP2_INTR_BID_CLEAR,
+ reg & mask);
+
+ return 0;
+}
+
+/* Common function shared by both CPU hot plug and CPUIdle */
+static int gs101_cpu_pmu_offline(struct exynos_pmu_context *pmu_context, unsigned int cpu)
+ __must_hold(&pmu_context->cpupm_lock)
+{
+ unsigned int cpuhint = smp_processor_id();
+ u32 reg, mask;
+
+ /* set cpu inform hint */
+ regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
+ CPU_INFORM_C2);
+
+ mask = BIT(cpu);
+ regmap_update_bits(pmu_context->pmuintrgen, EXYNOS_GRP2_INTR_BID_ENABLE,
+ mask, BIT(cpu));
+
+ regmap_read(pmu_context->pmuintrgen, EXYNOS_GRP1_INTR_BID_UPEND, ®);
+ regmap_write(pmu_context->pmuintrgen, EXYNOS_GRP1_INTR_BID_CLEAR,
+ reg & mask);
+
+ mask = (BIT(cpu + 8));
+ regmap_read(pmu_context->pmuintrgen, EXYNOS_GRP1_INTR_BID_UPEND, ®);
+ regmap_write(pmu_context->pmuintrgen, EXYNOS_GRP1_INTR_BID_CLEAR,
+ reg & mask);
+
+ return 0;
+}
+
const struct exynos_pmu_data gs101_pmu_data = {
.pmu_secure = true,
.pmu_cpuhp = true,
.rd_table = &gs101_pmu_rd_table,
.wr_table = &gs101_pmu_wr_table,
+ .cpu_pmu_offline = gs101_cpu_pmu_offline,
+ .cpu_pmu_online = gs101_cpu_pmu_online,
};
/*
diff --git a/include/linux/soc/samsung/exynos-regs-pmu.h b/include/linux/soc/samsung/exynos-regs-pmu.h
index db8a7ca81080..9c4d3da41dbf 100644
--- a/include/linux/soc/samsung/exynos-regs-pmu.h
+++ b/include/linux/soc/samsung/exynos-regs-pmu.h
@@ -1009,11 +1009,11 @@
#define GS101_PHY_CTRL_UFS 0x3ec8
/* PMU INTR GEN */
-#define GS101_GRP1_INTR_BID_UPEND (0x0108)
-#define GS101_GRP1_INTR_BID_CLEAR (0x010c)
-#define GS101_GRP2_INTR_BID_ENABLE (0x0200)
-#define GS101_GRP2_INTR_BID_UPEND (0x0208)
-#define GS101_GRP2_INTR_BID_CLEAR (0x020c)
+#define EXYNOS_GRP1_INTR_BID_UPEND (0x0108)
+#define EXYNOS_GRP1_INTR_BID_CLEAR (0x010c)
+#define EXYNOS_GRP2_INTR_BID_ENABLE (0x0200)
+#define EXYNOS_GRP2_INTR_BID_UPEND (0x0208)
+#define EXYNOS_GRP2_INTR_BID_CLEAR (0x020c)
/* exynosautov920 */
#define EXYNOSAUTOV920_PHY_CTRL_USB20 (0x0710)
--
2.51.0
^ permalink raw reply related
* [PATCH v2 7/7] arm64: dts: exynos850: add PMU interrupt generation node
From: Alexey Klimov @ 2026-04-01 4:52 UTC (permalink / raw)
To: Sam Protsenko, linux-samsung-soc, Krzysztof Kozlowski,
Peter Griffin, André Draszik, Conor Dooley, Alim Akhtar
Cc: Tudor Ambarus, Rob Herring, Krzysztof Kozlowski, linux-arm-kernel,
devicetree, linux-kernel, Alexey Klimov
In-Reply-To: <20260401-exynos850-cpuhotplug-v2-0-c5a760a3e259@linaro.org>
Add pmu_intr_gen node for Exynos850. This hw block is required
for different power management routines like CPU hotplug and
different sleep and idle states.
Also reference this node from main PMU node.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
arch/arm64/boot/dts/exynos/exynos850.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/boot/dts/exynos/exynos850.dtsi b/arch/arm64/boot/dts/exynos/exynos850.dtsi
index cb55015c8dce..f5cbd4d86226 100644
--- a/arch/arm64/boot/dts/exynos/exynos850.dtsi
+++ b/arch/arm64/boot/dts/exynos/exynos850.dtsi
@@ -214,6 +214,7 @@ gic: interrupt-controller@12a01000 {
pmu_system_controller: system-controller@11860000 {
compatible = "samsung,exynos850-pmu", "syscon";
reg = <0x11860000 0x10000>;
+ samsung,pmu-intr-gen-syscon = <&pmu_intr_gen>;
reboot: syscon-reboot {
compatible = "syscon-reboot";
@@ -224,6 +225,11 @@ reboot: syscon-reboot {
};
};
+ pmu_intr_gen: syscon@11870000 {
+ compatible = "samsung,exynos850-pmu-intr-gen", "syscon";
+ reg = <0x11870000 0x10000>;
+ };
+
watchdog_cl0: watchdog@10050000 {
compatible = "samsung,exynos850-wdt";
reg = <0x10050000 0x100>;
--
2.51.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox