* [PATCH v4 07/15] arm64: mm: Permit contiguous descriptors to be rewritten
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
Currently, pgattr_change_is_safe() is overly pedantic when it comes to
descriptors with the contiguous hint attribute set, as it rejects
assignments even if the old and the new value are the same.
So relax the check to allow that.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/mm/mmu.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 9610dd2d7bd9..bfb2f1cae724 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -134,10 +134,6 @@ bool pgattr_change_is_safe(pteval_t old, pteval_t new)
if (pte_pfn(__pte(old)) != pte_pfn(__pte(new)))
return false;
- /* live contiguous mappings may not be manipulated at all */
- if ((old | new) & PTE_CONT)
- return false;
-
/* Transitioning from Non-Global to Global is unsafe */
if (old & ~new & PTE_NG)
return false;
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 11/15] arm64: mm: Don't abuse memblock NOMAP to check for overlaps
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
Now that the DRAM mapping routines respect existing table mappings and
contiguous block and page mappings, it is no longer needed to fiddle
with the memblock tables to set and clear the NOMAP attribute in order
to omit text and rodata when creating the linear map.
Instead, map the kernel text and rodata alias first with the desired
attributes, so that they will not be remapped later with different
attributes when mapping the memblocks.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/mm/mmu.c | 24 +++++++-------------
1 file changed, 8 insertions(+), 16 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 5e2348b15783..1a4b4337d29a 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1148,12 +1148,15 @@ static void __init map_mem(void)
flags |= NO_BLOCK_MAPPINGS | NO_CONT_MAPPINGS;
/*
- * Take care not to create a writable alias for the
- * read-only text and rodata sections of the kernel image.
- * So temporarily mark them as NOMAP to skip mappings in
- * the following for-loop
+ * Map the linear alias of the [_text, __init_begin) interval
+ * as non-executable now, and remove the write permission in
+ * mark_linear_text_alias_ro() above (which will be called after
+ * alternative patching has completed). This makes the contents
+ * of the region accessible to subsystems such as hibernate,
+ * but protects it from inadvertent modification or execution.
*/
- memblock_mark_nomap(kernel_start, kernel_end - kernel_start);
+ __map_memblock(kernel_start, kernel_end, pgprot_tagged(PAGE_KERNEL),
+ flags);
/* map all the memory banks */
for_each_mem_range(i, &start, &end) {
@@ -1165,17 +1168,6 @@ static void __init map_mem(void)
__map_memblock(start, end, pgprot_tagged(PAGE_KERNEL),
flags);
}
-
- /*
- * Map the linear alias of the [_text, __init_begin) interval
- * as non-executable now, and remove the write permission in
- * mark_linear_text_alias_ro() below (which will be called after
- * alternative patching has completed). This makes the contents
- * of the region accessible to subsystems such as hibernate,
- * but protects it from inadvertent modification or execution.
- */
- __map_memblock(kernel_start, kernel_end, PAGE_KERNEL, 0);
- memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
}
void mark_rodata_ro(void)
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 09/15] arm64: mm: Permit contiguous attribute for preliminary mappings
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
There are a few cases where we omit the contiguous hint for mappings
that start out as read-write and are remapped read-only later, on the
basis that manipulating live descriptors with the PTE_CONT attribute set
is unsafe. When support for the contiguous hint was added to the code,
the ARM ARM was ambiguous about this, and so we erred on the side of
caution.
In the meantime, this has been clarified [0], and regions that will be
remapped in their entirety can use the contiguous hint both in the
initial mapping as well as the one that replaces it. Note that this
requires that the logic that may be called to remap overlapping regions
respects existing valid descriptors that have the contiguous bit
cleared.
So omit the NO_CONT_MAPPINGS flag in places where it is unneeded.
Thanks to Ryan for the reference.
[0] RJQQTC
For a TLB lookup in a contiguous region mapped by translation table entries that
have consistent values for the Contiguous bit, but have the OA, attributes, or
permissions misprogrammed, that TLB lookup is permitted to produce an OA, access
permissions, and memory attributes that are consistent with any one of the
programmed translation table values.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/mm/mmu.c | 10 +++-------
1 file changed, 3 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 4eab40f4aa6f..5e2348b15783 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1000,8 +1000,7 @@ void __init create_mapping_noalloc(phys_addr_t phys, unsigned long virt,
&phys, virt);
return;
}
- early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
- NO_CONT_MAPPINGS);
+ early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL, 0);
}
void __init create_pgd_mapping(struct mm_struct *mm, phys_addr_t phys,
@@ -1028,8 +1027,7 @@ static void update_mapping_prot(phys_addr_t phys, unsigned long virt,
return;
}
- early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL,
- NO_CONT_MAPPINGS);
+ early_create_pgd_mapping(init_mm.pgd, phys, virt, size, prot, NULL, 0);
/* flush the TLBs after updating live kernel mappings */
flush_tlb_kernel_range(virt, virt + size);
@@ -1175,10 +1173,8 @@ static void __init map_mem(void)
* alternative patching has completed). This makes the contents
* of the region accessible to subsystems such as hibernate,
* but protects it from inadvertent modification or execution.
- * Note that contiguous mappings cannot be remapped in this way,
- * so we should avoid them here.
*/
- __map_memblock(kernel_start, kernel_end, PAGE_KERNEL, NO_CONT_MAPPINGS);
+ __map_memblock(kernel_start, kernel_end, PAGE_KERNEL, 0);
memblock_clear_nomap(kernel_start, kernel_end - kernel_start);
}
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 10/15] arm64: Move fixmap page tables to end of kernel image
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
Move the fixmap page tables out of the BSS section, and place them at
the end of the image, right before the init_pg_dir section where some of
the other statically allocated page tables live.
These page tables are currently the only data objects in vmlinux that
are meant to be accessed via the kernel image's linear alias, and so
placing them together allows the remainder of the data/bss section to be
remapped read-only or unmapped entirely.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/kernel/vmlinux.lds.S | 5 +++++
arch/arm64/mm/fixmap.c | 7 ++++---
2 files changed, 9 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index e1ac876200a3..2dca18574619 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -353,6 +353,11 @@ SECTIONS
__pi___bss_start = __bss_start;
. = ALIGN(PAGE_SIZE);
+ .fixmap_pgdir : {
+ __fixmap_pgdir_start = .;
+ *(.fixmap_bss)
+ }
+
__pi_init_pg_dir = .;
. += INIT_DIR_SIZE;
__pi_init_pg_end = .;
diff --git a/arch/arm64/mm/fixmap.c b/arch/arm64/mm/fixmap.c
index c5c5425791da..b649ea1a46e4 100644
--- a/arch/arm64/mm/fixmap.c
+++ b/arch/arm64/mm/fixmap.c
@@ -31,9 +31,10 @@ static_assert(NR_BM_PMD_TABLES == 1);
#define BM_PTE_TABLE_IDX(addr) __BM_TABLE_IDX(addr, PMD_SHIFT)
-static pte_t bm_pte[NR_BM_PTE_TABLES][PTRS_PER_PTE] __page_aligned_bss;
-static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __maybe_unused;
-static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused;
+#define __fixmap_bss __section(".fixmap_bss") __aligned(PAGE_SIZE)
+static pte_t bm_pte[NR_BM_PTE_TABLES][PTRS_PER_PTE] __fixmap_bss;
+static pmd_t bm_pmd[PTRS_PER_PMD] __fixmap_bss __maybe_unused;
+static pud_t bm_pud[PTRS_PER_PUD] __fixmap_bss __maybe_unused;
static inline pte_t *fixmap_pte(unsigned long addr)
{
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 12/15] arm64: mm: Map the kernel data/bss read-only in the linear map
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
On systems where the bootloader adheres to the original arm64 boot
protocol, the placement of the kernel in the physical address space is
highly predictable, and this makes the placement of its linear alias in
the kernel virtual address space equally predictable, given the lack of
randomization of the linear map.
The linear aliases of the kernel text and rodata regions are already
mapped read-only, but the kernel data and bss are mapped read-write in
this region. This is not needed, so map them read-only as well.
Note that the statically allocated kernel page tables do need to be
modifiable via the linear map, so leave these mapped read-write.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/include/asm/sections.h | 1 +
arch/arm64/mm/mmu.c | 16 ++++++++++++++--
2 files changed, 15 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/sections.h b/arch/arm64/include/asm/sections.h
index 51b0d594239e..32ec21af0823 100644
--- a/arch/arm64/include/asm/sections.h
+++ b/arch/arm64/include/asm/sections.h
@@ -23,6 +23,7 @@ extern char __irqentry_text_start[], __irqentry_text_end[];
extern char __mmuoff_data_start[], __mmuoff_data_end[];
extern char __entry_tramp_text_start[], __entry_tramp_text_end[];
extern char __relocate_new_kernel_start[], __relocate_new_kernel_end[];
+extern char __fixmap_pgdir_start[];
static inline size_t entry_tramp_text_size(void)
{
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 1a4b4337d29a..9361b7efb848 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1122,7 +1122,9 @@ static void __init map_mem(void)
{
static const u64 direct_map_end = _PAGE_END(VA_BITS_MIN);
phys_addr_t kernel_start = __pa_symbol(_text);
- phys_addr_t kernel_end = __pa_symbol(__init_begin);
+ phys_addr_t init_begin = __pa_symbol(__init_begin);
+ phys_addr_t init_end = __pa_symbol(__init_end);
+ phys_addr_t kernel_end = __pa_symbol(__fixmap_pgdir_start);
phys_addr_t start, end;
int flags = NO_EXEC_MAPPINGS;
u64 i;
@@ -1155,7 +1157,11 @@ static void __init map_mem(void)
* of the region accessible to subsystems such as hibernate,
* but protects it from inadvertent modification or execution.
*/
- __map_memblock(kernel_start, kernel_end, pgprot_tagged(PAGE_KERNEL),
+ __map_memblock(kernel_start, init_begin, pgprot_tagged(PAGE_KERNEL),
+ flags);
+
+ /* Map the kernel data/bss so it can be remapped later */
+ __map_memblock(init_end, kernel_end, pgprot_tagged(PAGE_KERNEL),
flags);
/* map all the memory banks */
@@ -1168,6 +1174,12 @@ static void __init map_mem(void)
__map_memblock(start, end, pgprot_tagged(PAGE_KERNEL),
flags);
}
+
+ /* Map the kernel data/bss read-only in the linear map */
+ __map_memblock(init_end, kernel_end, pgprot_tagged(PAGE_KERNEL_RO),
+ flags);
+ flush_tlb_kernel_range((unsigned long)lm_alias(__init_end),
+ (unsigned long)lm_alias(__fixmap_pgdir_start));
}
void mark_rodata_ro(void)
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 13/15] arm64: mm: Unmap kernel data/bss entirely from the linear map
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
The linear aliases of the kernel text and rodata are mapped read-only in
the linear map as well. Given that the contents of these regions are
mostly identical to the version in the loadable image, mapping them
read-only and leaving their contents visible is a reasonable hardening
measure.
Data and bss, however, are now also mapped read-only but the contents of
these regions are more likely to contain data that we'd rather not leak.
So let's unmap these entirely in the linear map when the kernel is
running normally.
When going into hibernation or waking up from it, these regions need to
be mapped, so map the region initially, and toggle the valid bit so
map/unmap the region as needed.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/mm/mmu.c | 44 ++++++++++++++++----
1 file changed, 37 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 9361b7efb848..a464f3d2d2df 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -24,6 +24,7 @@
#include <linux/mm.h>
#include <linux/vmalloc.h>
#include <linux/set_memory.h>
+#include <linux/suspend.h>
#include <linux/kfence.h>
#include <linux/pkeys.h>
#include <linux/mm_inline.h>
@@ -1040,6 +1041,31 @@ static void __init __map_memblock(phys_addr_t start, phys_addr_t end,
end - start, prot, early_pgtable_alloc, flags);
}
+static void remap_linear_data_alias(bool unmap)
+{
+ set_memory_valid((unsigned long)lm_alias(__init_end),
+ (unsigned long)(__fixmap_pgdir_start - __init_end) / PAGE_SIZE,
+ !unmap);
+}
+
+static int arm64_hibernate_pm_notify(struct notifier_block *nb,
+ unsigned long mode, void *unused)
+{
+ switch (mode) {
+ default:
+ break;
+ case PM_POST_HIBERNATION:
+ case PM_POST_RESTORE:
+ remap_linear_data_alias(true);
+ break;
+ case PM_HIBERNATION_PREPARE:
+ case PM_RESTORE_PREPARE:
+ remap_linear_data_alias(false);
+ break;
+ }
+ return 0;
+}
+
void __init mark_linear_text_alias_ro(void)
{
/*
@@ -1048,6 +1074,16 @@ void __init mark_linear_text_alias_ro(void)
update_mapping_prot(__pa_symbol(_text), (unsigned long)lm_alias(_text),
(unsigned long)__init_begin - (unsigned long)_text,
pgprot_tagged(PAGE_KERNEL_RO));
+
+ remap_linear_data_alias(true);
+
+ if (IS_ENABLED(CONFIG_HIBERNATION)) {
+ static struct notifier_block nb = {
+ .notifier_call = arm64_hibernate_pm_notify
+ };
+
+ register_pm_notifier(&nb);
+ }
}
#ifdef CONFIG_KFENCE
@@ -1162,7 +1198,7 @@ static void __init map_mem(void)
/* Map the kernel data/bss so it can be remapped later */
__map_memblock(init_end, kernel_end, pgprot_tagged(PAGE_KERNEL),
- flags);
+ flags | NO_BLOCK_MAPPINGS);
/* map all the memory banks */
for_each_mem_range(i, &start, &end) {
@@ -1174,12 +1210,6 @@ static void __init map_mem(void)
__map_memblock(start, end, pgprot_tagged(PAGE_KERNEL),
flags);
}
-
- /* Map the kernel data/bss read-only in the linear map */
- __map_memblock(init_end, kernel_end, pgprot_tagged(PAGE_KERNEL_RO),
- flags);
- flush_tlb_kernel_range((unsigned long)lm_alias(__init_end),
- (unsigned long)lm_alias(__fixmap_pgdir_start));
}
void mark_rodata_ro(void)
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 14/15] arm64: mm: Generalize manipulation code of read-only descriptors
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
Before moving the fixmap PUD/PMD tables into .rodata, update the
existing descriptor manipulation code so it will fallback to the fixmap
for any descriptor located in the .pgdir_rodata section.
This is slightly more costly, as it evaluates whether or not a
descriptor is in the kernel's rodata region at levels PMD and higher for
any configuration, rather than only when the level in question is the
root level.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 27 ++++++++++----------
arch/arm64/kernel/vmlinux.lds.S | 8 ++++--
arch/arm64/mm/mmu.c | 24 ++++++++---------
3 files changed, 31 insertions(+), 28 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index a1c5894332d9..94235dd428be 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -816,23 +816,22 @@ extern pgd_t swapper_pg_dir[];
extern pgd_t idmap_pg_dir[];
extern pgd_t tramp_pg_dir[];
extern pgd_t reserved_pg_dir[];
+extern pgd_t __pgdir_rodata_start[], __pgdir_rodata_end[];
-extern void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd);
+extern void set_rodata_pte(pte_t *ptep, pte_t pte);
-static inline bool in_swapper_pgdir(void *addr)
+static inline bool in_pgdir_rodata(void *addr)
{
- return ((unsigned long)addr & PAGE_MASK) ==
- ((unsigned long)swapper_pg_dir & PAGE_MASK);
+ return addr >= (void *)__pgdir_rodata_start &&
+ addr < (void *)__pgdir_rodata_end;
}
static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
{
-#ifdef __PAGETABLE_PMD_FOLDED
- if (in_swapper_pgdir(pmdp)) {
- set_swapper_pgd((pgd_t *)pmdp, __pgd(pmd_val(pmd)));
+ if (in_pgdir_rodata(pmdp)) {
+ set_rodata_pte((pte_t *)pmdp, __pte(pmd_val(pmd)));
return;
}
-#endif /* __PAGETABLE_PMD_FOLDED */
WRITE_ONCE(*pmdp, pmd);
@@ -893,8 +892,8 @@ static inline bool pgtable_l4_enabled(void);
static inline void set_pud(pud_t *pudp, pud_t pud)
{
- if (!pgtable_l4_enabled() && in_swapper_pgdir(pudp)) {
- set_swapper_pgd((pgd_t *)pudp, __pgd(pud_val(pud)));
+ if (in_pgdir_rodata(pudp)) {
+ set_rodata_pte((pte_t *)pudp, __pte(pud_val(pud)));
return;
}
@@ -974,8 +973,8 @@ static inline bool mm_pud_folded(const struct mm_struct *mm)
static inline void set_p4d(p4d_t *p4dp, p4d_t p4d)
{
- if (in_swapper_pgdir(p4dp)) {
- set_swapper_pgd((pgd_t *)p4dp, __pgd(p4d_val(p4d)));
+ if (in_pgdir_rodata(p4dp)) {
+ set_rodata_pte((pte_t *)p4dp, __pte(p4d_val(p4d)));
return;
}
@@ -1102,8 +1101,8 @@ static inline bool mm_p4d_folded(const struct mm_struct *mm)
static inline void set_pgd(pgd_t *pgdp, pgd_t pgd)
{
- if (in_swapper_pgdir(pgdp)) {
- set_swapper_pgd(pgdp, __pgd(pgd_val(pgd)));
+ if (in_pgdir_rodata(pgdp)) {
+ set_rodata_pte((pte_t *)pgdp, __pte(pgd_val(pgd)));
return;
}
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index 2dca18574619..e5e1d0fd7f27 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -243,8 +243,12 @@ SECTIONS
reserved_pg_dir = .;
. += PAGE_SIZE;
- swapper_pg_dir = .;
- . += PAGE_SIZE;
+ .pgdir_rodata : {
+ __pgdir_rodata_start = .;
+ swapper_pg_dir = .;
+ . += PAGE_SIZE;
+ __pgdir_rodata_end = .;
+ }
. = ALIGN(SEGMENT_ALIGN);
__init_begin = .;
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index a464f3d2d2df..84d81bae07a7 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -65,34 +65,34 @@ static bool rodata_is_rw __ro_after_init = true;
*/
long __section(".mmuoff.data.write") __early_cpu_boot_status;
-static DEFINE_SPINLOCK(swapper_pgdir_lock);
+static DEFINE_SPINLOCK(rodata_pgdir_lock);
static DEFINE_MUTEX(fixmap_lock);
-void noinstr set_swapper_pgd(pgd_t *pgdp, pgd_t pgd)
+void noinstr set_rodata_pte(pte_t *ptep, pte_t pte)
{
- pgd_t *fixmap_pgdp;
+ pte_t *fixmap_ptep;
/*
- * Don't bother with the fixmap if swapper_pg_dir is still mapped
- * writable in the kernel mapping.
+ * Don't bother with the fixmap if rodata is still mapped
+ * writable in the kernel and linear mappings.
*/
if (rodata_is_rw) {
- WRITE_ONCE(*pgdp, pgd);
+ WRITE_ONCE(*ptep, pte);
dsb(ishst);
isb();
return;
}
- spin_lock(&swapper_pgdir_lock);
- fixmap_pgdp = pgd_set_fixmap(__pa_symbol(pgdp));
- WRITE_ONCE(*fixmap_pgdp, pgd);
+ spin_lock(&rodata_pgdir_lock);
+ fixmap_ptep = pte_set_fixmap(__pa_nodebug(ptep));
+ WRITE_ONCE(*fixmap_ptep, pte);
/*
* We need dsb(ishst) here to ensure the page-table-walker sees
* our new entry before set_p?d() returns. The fixmap's
* flush_tlb_kernel_range() via clear_fixmap() does this for us.
*/
- pgd_clear_fixmap();
- spin_unlock(&swapper_pgdir_lock);
+ pte_clear_fixmap();
+ spin_unlock(&rodata_pgdir_lock);
}
pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
@@ -1071,6 +1071,7 @@ void __init mark_linear_text_alias_ro(void)
/*
* Remove the write permissions from the linear alias of .text/.rodata
*/
+ WRITE_ONCE(rodata_is_rw, false);
update_mapping_prot(__pa_symbol(_text), (unsigned long)lm_alias(_text),
(unsigned long)__init_begin - (unsigned long)_text,
pgprot_tagged(PAGE_KERNEL_RO));
@@ -1221,7 +1222,6 @@ void mark_rodata_ro(void)
* to cover NOTES and EXCEPTION_TABLE.
*/
section_size = (unsigned long)__init_begin - (unsigned long)__start_rodata;
- WRITE_ONCE(rodata_is_rw, false);
update_mapping_prot(__pa_symbol(__start_rodata), (unsigned long)__start_rodata,
section_size, PAGE_KERNEL_RO);
/* mark the range between _text and _stext as read only. */
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* [PATCH v4 15/15] arm64: mm: Remap linear aliases of the fixmap page tables read-only
From: Ard Biesheuvel @ 2026-04-27 15:34 UTC (permalink / raw)
To: linux-arm-kernel
Cc: linux-kernel, will, catalin.marinas, mark.rutland, Ard Biesheuvel,
Ryan Roberts, Anshuman Khandual, Liz Prucka, Seth Jenkins,
Kees Cook, Mike Rapoport, David Hildenbrand, Andrew Morton,
linux-mm, linux-hardening
In-Reply-To: <20260427153416.2103979-17-ardb+git@google.com>
From: Ard Biesheuvel <ardb@kernel.org>
The fixmap page tables are statically allocated, and are currently
mapped read-write both in the kernel mapping as well as its linear
alias. Due to lack of randomization of the linear map, these tables will
appear at a priori known offsets in the virtual address space when
booting without physical randomization, which means that a single kernel
write primitive is sufficient for an attacker to map memory of their own
choosing with any permissions at a known virtual address in the kernel's
address space.
To harden against this, move the fixmap PUD and PMD tables to
.pgdir_rodata, so that both their kernel mappings as well as their
linear aliases are mapped read-only during ordinary execution.
The PTE table needs to remain read-write accessible via the kernel
mapping, but its linear alias can be remapped read-only as well.
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
---
arch/arm64/include/asm/pgtable.h | 6 ++++--
arch/arm64/kernel/vmlinux.lds.S | 1 +
arch/arm64/mm/fixmap.c | 5 +++--
arch/arm64/mm/mmu.c | 5 +++++
4 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 94235dd428be..21afe923cd71 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -822,8 +822,10 @@ extern void set_rodata_pte(pte_t *ptep, pte_t pte);
static inline bool in_pgdir_rodata(void *addr)
{
- return addr >= (void *)__pgdir_rodata_start &&
- addr < (void *)__pgdir_rodata_end;
+ phys_addr_t pa = __pa_nodebug(addr);
+
+ return pa >= __pa_symbol_nodebug(__pgdir_rodata_start) &&
+ pa < __pa_symbol_nodebug(__pgdir_rodata_end);
}
static inline void set_pmd(pmd_t *pmdp, pmd_t pmd)
diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index e5e1d0fd7f27..9b346dd24d1c 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S
@@ -247,6 +247,7 @@ SECTIONS
__pgdir_rodata_start = .;
swapper_pg_dir = .;
. += PAGE_SIZE;
+ *(.fixmap_rodata)
__pgdir_rodata_end = .;
}
diff --git a/arch/arm64/mm/fixmap.c b/arch/arm64/mm/fixmap.c
index b649ea1a46e4..ad6d46e5c23e 100644
--- a/arch/arm64/mm/fixmap.c
+++ b/arch/arm64/mm/fixmap.c
@@ -32,9 +32,10 @@ static_assert(NR_BM_PMD_TABLES == 1);
#define BM_PTE_TABLE_IDX(addr) __BM_TABLE_IDX(addr, PMD_SHIFT)
#define __fixmap_bss __section(".fixmap_bss") __aligned(PAGE_SIZE)
+#define __fixmap_rodata __section(".fixmap_rodata") __aligned(PAGE_SIZE)
static pte_t bm_pte[NR_BM_PTE_TABLES][PTRS_PER_PTE] __fixmap_bss;
-static pmd_t bm_pmd[PTRS_PER_PMD] __fixmap_bss __maybe_unused;
-static pud_t bm_pud[PTRS_PER_PUD] __fixmap_bss __maybe_unused;
+static pmd_t bm_pmd[PTRS_PER_PMD] __fixmap_rodata __maybe_unused;
+static pud_t bm_pud[PTRS_PER_PUD] __fixmap_rodata __maybe_unused;
static inline pte_t *fixmap_pte(unsigned long addr)
{
diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
index 84d81bae07a7..e76fe5b0c5fe 100644
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -1076,6 +1076,11 @@ void __init mark_linear_text_alias_ro(void)
(unsigned long)__init_begin - (unsigned long)_text,
pgprot_tagged(PAGE_KERNEL_RO));
+ /* Map the fixmap PTE table at __fixmap_pgdir_start R/O in linear map too */
+ update_mapping_prot(__pa_symbol(__fixmap_pgdir_start),
+ (unsigned long)lm_alias(__fixmap_pgdir_start),
+ PAGE_SIZE, pgprot_tagged(PAGE_KERNEL_RO));
+
remap_linear_data_alias(true);
if (IS_ENABLED(CONFIG_HIBERNATION)) {
--
2.54.0.rc2.544.gc7ae2d5bb8-goog
^ permalink raw reply related
* Re: [PATCH] usb: udc: pxa: remove unused platform_data
From: Andy Shevchenko @ 2026-04-27 15:42 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Greg Kroah-Hartman, Arnd Bergmann, Daniel Mack, Haojian Zhuang,
Robert Jarzmik, Linus Walleij, Bartosz Golaszewski,
linux-arm-kernel, linux-kernel, linux-usb, linux-gpio
In-Reply-To: <20260427143300.2887692-1-arnd@kernel.org>
On Mon, Apr 27, 2026 at 04:32:10PM +0200, Arnd Bergmann wrote:
> None of the remaining boards put useful data into the platform_data
> structures, so effectively this only works with DT based probing.
>
> Remove all code that references this data, to stop using the legacy
> gpiolib interfaces. The pxa27x version already supports gpio
> descriptors, while the pxa25x version now does it the same way.
...
> + dev->pullup_gpio = devm_gpiod_get_index_optional(&pdev->dev, "pullup", 0,
> + GPIOD_OUT_HIGH);
While I gave a tag some time ago, I still wonder why we use _index variant here.
With
struct device *dev = &pdev->dev;
it becomes just a single line (yes, 82 characters long).
dev->pullup_gpio = devm_gpiod_get_optional(dev, "pullup", GPIOD_OUT_HIGH);
> + if (IS_ERR(dev->pullup_gpio)) {
> + dev_dbg(&pdev->dev,
> + "can't get pullup gpio err: %ld\n",
> + PTR_ERR(dev->pullup_gpio));
This occupies more LOC than needed (also gpio --> GPIO).
dev_dbg(dev, "can't get pullup GPIO err: %ld\n",
PTR_ERR(dev->pullup_gpio));
I even wouldn't mind this to be long single line
dev_dbg(dev, "can't get pullup GPIO: %ld\n", PTR_ERR(dev->pullup_gpio));
(I dropped ' err' part in this variant, though).
> + retval = PTR_ERR(dev->pullup_gpio);
> + goto err;
> }
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH] usb: udc: pxa: remove unused platform_data
From: Andy Shevchenko @ 2026-04-27 15:43 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Greg Kroah-Hartman, Arnd Bergmann, Daniel Mack, Haojian Zhuang,
Robert Jarzmik, Linus Walleij, Bartosz Golaszewski,
linux-arm-kernel, linux-kernel, linux-usb, linux-gpio
In-Reply-To: <ae-D4Qki41GpOHyx@ashevche-desk.local>
On Mon, Apr 27, 2026 at 06:42:31PM +0300, Andy Shevchenko wrote:
> On Mon, Apr 27, 2026 at 04:32:10PM +0200, Arnd Bergmann wrote:
...
> I even wouldn't mind this to be long single line
>
> dev_dbg(dev, "can't get pullup GPIO: %ld\n", PTR_ERR(dev->pullup_gpio));
>
> (I dropped ' err' part in this variant, though).
Or even
dev_dbg(dev, "can't get pullup GPIO: %pe\n", dev->pullup_gpio);
which fits 80.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH 3/3] ASoC: pxa: integrate sound/arm/pxa2xx into sound/soc/pxa2xx
From: Andy Shevchenko @ 2026-04-27 15:52 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Daniel Mack, Haojian Zhuang, Robert Jarzmik, Jaroslav Kysela,
Takashi Iwai, Liam Girdwood, Mark Brown, Arnd Bergmann, Peng Fan,
Bartosz Golaszewski, Randy Dunlap, Kuninori Morimoto, Kees Cook,
linux-kernel, linux-arm-kernel, linux-sound
In-Reply-To: <20260427144658.3609647-3-arnd@kernel.org>
On Mon, Apr 27, 2026 at 04:46:31PM +0200, Arnd Bergmann wrote:
> The pxa2xx sound library modules are only used by the ASoC driver since
> commit b094de7810f3 ("ASoC: codec: Remove pxa2xx-ac97.c"), so move the
> code into the one module that uses as a simpliciation.
Is this part of the series that touches UDC? Btw, the UDC one despite on being
mentioned as v2 in the changelog still have no versioning in the Subject.
...
What a lovely change! I would like to give a tag, but see a comment below.
...
> +#ifndef __PXA2XX_LIB_H
> +#define __PXA2XX_LIB_H
> +
> +#include <uapi/sound/asound.h>
> +#include <linux/platform_device.h>
> +
> +/* PCM */
> +struct snd_pcm_substream;
> +struct snd_pcm_hw_params;
> +struct snd_soc_pcm_runtime;
> +struct snd_pcm;
> +struct snd_soc_component;
> +
> +extern int pxa2xx_soc_pcm_new(struct snd_soc_component *component,
> + struct snd_soc_pcm_runtime *rtd);
Can we kill 'extern' while at it?
> +extern int pxa2xx_soc_pcm_open(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream);
> +extern int pxa2xx_soc_pcm_close(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream);
> +extern int pxa2xx_soc_pcm_hw_params(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream,
> + struct snd_pcm_hw_params *params);
> +extern int pxa2xx_soc_pcm_prepare(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream);
> +extern int pxa2xx_soc_pcm_trigger(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream, int cmd);
> +extern snd_pcm_uframes_t
> +pxa2xx_soc_pcm_pointer(struct snd_soc_component *component,
> + struct snd_pcm_substream *substream);
> +
> +/* AC97 */
> +
> +extern int pxa2xx_ac97_read(int slot, unsigned short reg);
> +extern int pxa2xx_ac97_write(int slot, unsigned short reg, unsigned short val);
> +
> +extern bool pxa2xx_ac97_try_warm_reset(void);
> +extern bool pxa2xx_ac97_try_cold_reset(void);
> +extern void pxa2xx_ac97_finish_reset(void);
> +
> +extern int pxa2xx_ac97_hw_suspend(void);
> +extern int pxa2xx_ac97_hw_resume(void);
> +
> +extern int pxa2xx_ac97_hw_probe(struct platform_device *dev);
> +extern void pxa2xx_ac97_hw_remove(struct platform_device *dev);
> +
> +#endif
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH 1/1] scsi: ufs: remove ucd_rsp_dma_addr and ucd_prdt_dma_addr from ufshcd_lrb
From: Bart Van Assche @ 2026-04-27 15:55 UTC (permalink / raw)
To: ed.tsai, Alim Akhtar, Avri Altman, James E.J. Bottomley,
Martin K. Petersen, Matthias Brugger, AngeloGioacchino Del Regno
Cc: linux-kernel, linux-arm-kernel, linux-mediatek, wsd_upstream,
peter.wang, alice.chao, naomi.chu, chun-hung.wu, stable,
linux-scsi
In-Reply-To: <20260427035856.1610363-1-ed.tsai@mediatek.com>
On 4/26/26 8:58 PM, ed.tsai@mediatek.com wrote:
> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
> index 4805e40ed4d7..02fa61322e77 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -621,7 +621,8 @@ static void ufshcd_print_tr(struct ufs_hba *hba, struct scsi_cmnd *cmd,
> ufshcd_hex_dump("UPIU REQ: ", lrbp->ucd_req_ptr,
> sizeof(struct utp_upiu_req));
> dev_err(hba->dev, "UPIU[%d] - Response UPIU phys@0x%llx\n", tag,
> - (u64)lrbp->ucd_rsp_dma_addr);
> + (u64)(lrbp->ucd_req_dma_addr +
> + offsetof(struct utp_transfer_cmd_desc, response_upiu)));
> ufshcd_hex_dump("UPIU RSP: ", lrbp->ucd_rsp_ptr,
> sizeof(struct utp_upiu_rsp));
>
> @@ -633,7 +634,8 @@ static void ufshcd_print_tr(struct ufs_hba *hba, struct scsi_cmnd *cmd,
> dev_err(hba->dev,
> "UPIU[%d] - PRDT - %d entries phys@0x%llx\n",
> tag, prdt_length,
> - (u64)lrbp->ucd_prdt_dma_addr);
> + (u64)(lrbp->ucd_req_dma_addr +
> + offsetof(struct utp_transfer_cmd_desc, prd_table)));
I don't think that it is useful to log DMA addresses and I prefer that
this information would not be logged at all. Logging this information
might even involve a security risk. Here is some information about this
topic that comes from an LLM:
------------------------------------------------------------------------
Why is logging pointer addresses from kernel code considered a security
risk?
Exposing kernel pointer addresses—a practice often referred to as
pointer leaking—is considered a major security risk because it bypasses
a fundamental defense mechanism called KASLR (Kernel Address Space
Layout Randomization).
[ ... ]
2. Facilitating Exploit Chains
A pointer leak is rarely an exploit on its own, but it is almost always
the first step in a sophisticated attack.
* Return-Oriented Programming (ROP): To hijack execution flow, an
attacker needs "gadgets" (small snippets of existing code). Without
knowing the exact addresses of these gadgets, their exploit will simply
crash the system (a Denial of Service).
* Targeted Corruption: If an attacker wants to overwrite a specific
security structure (like a process's UID to gain root access), they need
the pointer to that specific object in kernel memory.
[ ... ]
------------------------------------------------------------------------
Thanks,
Bart.
^ permalink raw reply
* Re: [PATCH 2/3] ASoC: pxa2xx: push gpio usage into arch code
From: Andy Shevchenko @ 2026-04-27 15:58 UTC (permalink / raw)
To: Arnd Bergmann
Cc: Daniel Mack, Haojian Zhuang, Robert Jarzmik, Jaroslav Kysela,
Takashi Iwai, Arnd Bergmann, Thierry Reding, Mark Brown,
linux-arm-kernel, linux-kernel, linux-sound
In-Reply-To: <20260427144658.3609647-2-arnd@kernel.org>
On Mon, Apr 27, 2026 at 04:46:30PM +0200, Arnd Bergmann wrote:
> There are no remaining static platform_device users of pxa2xx ac97,
> so the rest of that code path can go away as well.
>
> Since nothing in the driver uses the gpio number now, constrain the use
> of the legacy gpio interface to the architecture specific code.
...
> + if (cpu_is_pxa27x()) {
> /* Assert reset using GPIOD_OUT_HIGH, because reset is GPIO_ACTIVE_LOW */
> rst_gpio = devm_gpiod_get(&dev->dev, "reset", GPIOD_OUT_HIGH);
> + if (IS_ERR(rst_gpio))
> + rst_gpio = NULL;
Have you seen my
https://lore.kernel.org/r/20260415150412.365989-1-andriy.shevchenko@linux.intel.com
?
Perhaps you can incorporate it into this mini-series, as it looks like that one
hasn't been applied yet.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH 3/3] ASoC: pxa: integrate sound/arm/pxa2xx into sound/soc/pxa2xx
From: Arnd Bergmann @ 2026-04-27 15:58 UTC (permalink / raw)
To: Andy Shevchenko, Arnd Bergmann
Cc: Daniel Mack, Haojian Zhuang, Robert Jarzmik, Jaroslav Kysela,
Takashi Iwai, Liam Girdwood, Mark Brown, Peng Fan,
Bartosz Golaszewski, Randy Dunlap, Kuninori Morimoto, Kees Cook,
linux-kernel, linux-arm-kernel, linux-sound
In-Reply-To: <ae-GOQjD4Kq0ve8D@ashevche-desk.local>
On Mon, Apr 27, 2026, at 17:52, Andy Shevchenko wrote:
> On Mon, Apr 27, 2026 at 04:46:31PM +0200, Arnd Bergmann wrote:
>
>> The pxa2xx sound library modules are only used by the ASoC driver since
>> commit b094de7810f3 ("ASoC: codec: Remove pxa2xx-ac97.c"), so move the
>> code into the one module that uses as a simpliciation.
>
> Is this part of the series that touches UDC? Btw, the UDC one despite on being
> mentioned as v2 in the changelog still have no versioning in the Subject.
Both patches came out of my work to hide the last users of GPIO numbers
behind CONFIG_GPIO_LEGACY that I first posted last year. A lot of my
patches got merged (or replaced with other work) in the meantime,
so there are only a few drivers and platforms left that won't use
GPIO descriptors any time soon.
> What a lovely change! I would like to give a tag, but see a comment below.
>> +
>> +extern int pxa2xx_soc_pcm_new(struct snd_soc_component *component,
>> + struct snd_soc_pcm_runtime *rtd);
>
> Can we kill 'extern' while at it?
I can change that, though I usually try to minimize changes to
code that I just move around.
Arnd
^ permalink raw reply
* [PATCH v2 0/1] dts: ti: k3-j7: Reserve memory for LPM metadata
From: Richard Genoud (TI) @ 2026-04-27 16:03 UTC (permalink / raw)
To: Nishanth Menon, Vignesh Raghavendra
Cc: Tero Kristo, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Udit Kumar, Abhash Kumar, Beleswar Padhi, Thomas Richard,
Gregory CLEMENT, Thomas Petazzoni, linux-arm-kernel, devicetree,
linux-kernel
At boot, U-Boot will copy ATF/OPTEE certificates and DM into a LPM memory
region.
Passing it to TIFS with TISCI_MSG_LPM_SAVE_ADDR
https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr
Before suspend, TIFS will save and encrypt TFA context and its own minimal
context.
At resume, U-Boot will tell TIFS to restore and decrypt data from this
memory region.
So, U-Boot needs to parse the device tree, looking for
"/reserved_memory/lpm-memory"
Moreover, from reserved-memory.yaml:
Following the generic-names recommended practice, node names should
reflect the purpose of the node (ie. "framebuffer" or "dma-pool").
So @lpm-memory seems to reflect the purpose.
Changes since v1:
- add specific lpm region for j742s2 and j784s4 instead of the common
one since the addresses are not the same.
- add j721s2 lpm_memory_region
- change j722s addresse to prevent holes
- link to v1: https://lore.kernel.org/lkml/20260312113446.1857592-1-p-mantena@ti.com/
Prasanth Babu Mantena (1):
arm64: dts: ti: k3-j7: Reserve memory for LPM meta data
arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi | 6 ++++++
arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi | 6 ++++++
arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 6 ++++++
arch/arm64/boot/dts/ti/k3-j742s2-evm.dts | 9 +++++++++
arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 9 ++++++---
5 files changed, 33 insertions(+), 3 deletions(-)
base-commit: 254f49634ee16a731174d2ae34bc50bd5f45e731
^ permalink raw reply
* [PATCH v2 1/1] arm64: dts: ti: k3-j7: Reserve memory for LPM meta data
From: Richard Genoud (TI) @ 2026-04-27 16:03 UTC (permalink / raw)
To: Nishanth Menon, Vignesh Raghavendra
Cc: Tero Kristo, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Udit Kumar, Abhash Kumar, Beleswar Padhi, Thomas Richard,
Gregory CLEMENT, Thomas Petazzoni, linux-arm-kernel, devicetree,
linux-kernel
In-Reply-To: <20260427160326.370415-1-richard.genoud@bootlin.com>
From: Prasanth Babu Mantena <p-mantena@ti.com>
For TI SOCs J7200, J784S4, J722S, J721s2 which support low power modes,
a chunk of memory is reserved for LPM meta data, which is needed for
saving ATF context and the certificate information of ATF and OPTEE and
DM image. This LPM metadata area is firewalled to be accessed only by
TIFS.
U-Boot/TIFS will use this area to save and restore:
- ATF context
- ATF certificate information
- OPTEE certificate information
- DM image
https://software-dl.ti.com/tisci/esd/latest/2_tisci_msgs/pm/lpm.html#lpm-msg-lpm-save-addr
U-Boot has to parse and retrieve this area from the device tree, thus
@lpm-memory node are used instead of the generic @memory.
Signed-off-by: Prasanth Babu Mantena <p-mantena@ti.com>
Signed-off-by: Richard Genoud (TI) <richard.genoud@bootlin.com>
---
arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi | 6 ++++++
arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi | 6 ++++++
arch/arm64/boot/dts/ti/k3-j722s-evm.dts | 6 ++++++
arch/arm64/boot/dts/ti/k3-j742s2-evm.dts | 9 +++++++++
arch/arm64/boot/dts/ti/k3-j784s4-evm.dts | 9 ++++++---
5 files changed, 33 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
index 5a8c2e707fde..756928a2d411 100644
--- a/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j7200-som-p0.dtsi
@@ -40,6 +40,12 @@ mcu_r5fss0_core0_memory_region: memory@a0100000 {
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
+
+ lpm_memory_region: lpm-memory@a4800000 {
+ reg = <0x00 0xa4800000 0x00 0x00300000>;
+ no-map;
+ bootph-all;
+ };
};
mux0: mux-controller-0 {
diff --git a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
index 12a38dd1514b..ceab8f057640 100644
--- a/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-j721s2-som-p0.dtsi
@@ -42,6 +42,12 @@ mcu_r5fss0_core0_memory_region: memory@a0100000 {
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
+
+ lpm_memory_region: lpm-memory@a9c00000 {
+ reg = <0x00 0xa9c00000 0x00 0x00300000>;
+ no-map;
+ bootph-all;
+ };
};
mux0: mux-controller-0 {
diff --git a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
index e66330c71593..eebc5cc7d4cd 100644
--- a/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j722s-evm.dts
@@ -63,6 +63,12 @@ wkup_r5fss0_core0_memory_region: memory@a0100000 {
reg = <0x00 0xa0100000 0x00 0xf00000>;
no-map;
};
+
+ lpm_memory_region: lpm-memory@a6c00000 {
+ reg = <0x00 0xa6c00000 0x00 0x00300000>;
+ no-map;
+ bootph-all;
+ };
};
vmain_pd: regulator-0 {
diff --git a/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts b/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
index fcb7f05d7faf..d0752c8a6b37 100644
--- a/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j742s2-evm.dts
@@ -23,4 +23,13 @@ memory@80000000 {
device_type = "memory";
bootph-all;
};
+
+};
+
+&reserved_memory {
+ lpm_memory_region: lpm-memory@ab000000 {
+ reg = <0x00 0xab000000 0x00 0x00300000>;
+ no-map;
+ bootph-all;
+ };
};
diff --git a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
index 6c7458c76f53..114594f37f0b 100644
--- a/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
+++ b/arch/arm64/boot/dts/ti/k3-j784s4-evm.dts
@@ -23,10 +23,13 @@ memory@80000000 {
device_type = "memory";
bootph-all;
};
+};
- reserved_memory: reserved-memory {
- #address-cells = <2>;
- #size-cells = <2>;
+&reserved_memory {
+ lpm_memory_region: lpm-memory@ac000000 {
+ reg = <0x00 0xac000000 0x00 0x00300000>;
+ no-map;
+ bootph-all;
};
};
^ permalink raw reply related
* Re: [PATCH v1 1/3] dt-bindings: PCI: imx6q-pcie: Add intr, aer and pme interrupts
From: Conor Dooley @ 2026-04-27 16:04 UTC (permalink / raw)
To: Hongxing Zhu
Cc: robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org,
bhelgaas@google.com, Frank Li, l.stach@pengutronix.de,
lpieralisi@kernel.org, kwilczynski@kernel.org, mani@kernel.org,
s.hauer@pengutronix.de, kernel@pengutronix.de, festevam@gmail.com,
linux-pci@vger.kernel.org, linux-arm-kernel@lists.infradead.org,
devicetree@vger.kernel.org, imx@lists.linux.dev,
linux-kernel@vger.kernel.org
In-Reply-To: <AM0PR04MB522051DF5CA446158839C2BD8C362@AM0PR04MB5220.eurprd04.prod.outlook.com>
[-- Attachment #1: Type: text/plain, Size: 1609 bytes --]
On Mon, Apr 27, 2026 at 03:17:12AM +0000, Hongxing Zhu wrote:
> > -----Original Message-----
> > From: Conor Dooley <conor@kernel.org>
> > Sent: Saturday, April 25, 2026 1:06 AM
> > To: Hongxing Zhu <hongxing.zhu@nxp.com>
> > Cc: robh@kernel.org; krzk+dt@kernel.org; conor+dt@kernel.org;
> > bhelgaas@google.com; Frank Li <frank.li@nxp.com>; l.stach@pengutronix.de;
> > lpieralisi@kernel.org; kwilczynski@kernel.org; mani@kernel.org;
> > s.hauer@pengutronix.de; kernel@pengutronix.de; festevam@gmail.com; linux-
> > pci@vger.kernel.org; linux-arm-kernel@lists.infradead.org;
> > devicetree@vger.kernel.org; imx@lists.linux.dev; linux-kernel@vger.kernel.org
> > Subject: Re: [PATCH v1 1/3] dt-bindings: PCI: imx6q-pcie: Add intr, aer and pme
> > interrupts
> >
> > On Fri, Apr 24, 2026 at 10:57:33AM +0800, Richard Zhu wrote:
> > > Add optional 'intr', 'aer', and 'pme' interrupt entries to the i.MX6Q
> > > PCIe binding to support PCIe event-based interrupts for general
> > > controller events, Advanced Error Reporting, and Power Management
> > > Events respectively.
> > >
> > > Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
> > > ---
> >
> > This binding supports lots of devices. Do they all have these additional interrupts?
> Currently, only i.MX95 PCIe has these dedicated SPI interrupts. The earlier
> SoCs in this binding (i.MX6Q/6SX/7D/8MQ/8MM/8MP, etc.) do not expose these as
> separate interrupt lines.
>
> I can constrain these three interrupt entries to be valid only for the i.MX95
> variant using conditional schemas. Would that be acceptable?
Please
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* [PATCH 00/43] KVM: arm64: Add GICv5 IRS support
From: Sascha Bischoff @ 2026-04-27 16:06 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
Hi all,
This series builds on the initial vGICv5 support [1] and adds support
for the GICv5 IRS, as described by the GICv5 (EAC0) specification [2].
With this, a GICv5 guest is no longer restricted to PPIs, and can
make use of SPIs and LPIs as well.
With SPIs and LPIs available, this series makes it possible to boot a
full Linux guest on the Arm FVP model [3], using the setup described
in Lorenzo's GICv5 Linux software enablement guide [4]. In addition,
GICv5 IPIs are typically implemented as LPIs, so LPI support is what
makes guests with more than one vCPU possible.
The corresponding kvmtool changes are available separately [5]. With
these changes, `--irqchip=gicv5` works now. The `--irqchip=gicv5-its`
configuration does not work with this series, as ITS/MSI support is not
included here.
The IRS is created as part of the vgic-v5 device, and is not a
separate KVM device. This is because implementing the CPU interface
alone would limit a guest to a single vCPU and PPIs only. Hence, the
IRS is bundled into the VGIC, much like the distributor for GICv3.
The series adds the host-side plumbing needed for KVM to interact with
the physical IRS, including VM and VPE table management, VPE residency,
and VPE doorbells. It also adds an emulated IRS MMIO interface for the
guest, together with the UAPI needed for userspace to configure the IRS
address and to save/restore the IRS and IST state.
The main pieces are:
* Host IRS capability discovery and configuration frame plumbing.
* Allocation and management of the GICv5 VM table, VPE table, VMTEs,
VPEs, and guest IST backing storage.
* VPE residency and doorbell handling, allowing the IRS to select SPIs
and LPIs for resident VPEs and wake non-resident VPEs when required.
* Emulation of the GICv5 IRS MMIO CONFIG_FRAME for guests.
Virtualisation, MPAM, MEC, SWERR are not supported and are RAZ/WI.
* SPI injection support using GIC VDPEND, together with tracking of
in-flight SPIs so that deactivation notifiers can still be handled.
* Save/restore support for GICv5 EL1 system registers, IRS MMIO state,
and guest ISTs.
* Documentation for the new VGICv5 IRS userspace interfaces and the
required save/restore ordering.
Please pay close attention to the save/restore interface and ordering,
in particular to make sure that no guest state has been omitted.
LPIs are explicitly driven by the guest through the IRS/IST state. This
series does not add direct LPI injection support, and does not add MSI
support. It also does not add GICv5 ITS emulation.
These changes are based on v7.1-rc1. They presume the existence of the
still-under-review changes in [6]. I've pushed the full set of changes
to a branch at [7].
Thanks for taking the time to look at these changes. Apologies for the
size of the series, but this is a rather hard set to disentangle and
review separately!
Thanks,
Sascha
[1] https://lore.kernel.org/all/20260319154937.3619520-1-sascha.bischoff@arm.com/
[2] https://developer.arm.com/documentation/aes0070/latest
[3] https://developer.arm.com/documentation/108086/latest
[4] https://linaro.atlassian.net/wiki/x/CQAF-wY
[5] https://lore.kernel.org/all/20260116182606.61856-1-sascha.bischoff@arm.com/
[6] https://lore.kernel.org/all/20260415115559.2227718-1-maz@kernel.org/
[7] https://gitlab.arm.com/linux-arm/linux-sb/-/tree/gicv5_kvm_irs_support
Sascha Bischoff (43):
arm64/sysreg: Add GICv5 GIC VDPEND and VDRCFG encodings
arm64/sysreg: Update ICC_CR0_EL1 with LINK and LINK_IDLE fields
KVM: arm64: gic-v5: Add resident/non-resident hyp calls
irqchip/gic-v5: Provide IRS config frame attrs to KVM
KVM: arm64: gic-v5: Extract host IRS caps from IRS config frame
KVM: arm64: gic-v5: Add VPE doorbell domain
KVM: arm64: gic-v5: Create & manage VM and VPE tables
KVM: arm64: gic-v5: Introduce guest IST alloc and management
KVM: arm64: gic-v5: Implement VMT/vIST IRS MMIO Ops
KVM: arm64: gic-v5: Implement VPE IRS MMIO Ops
KVM: arm64: gic-v5: Make VPEs valid in vgic_v5_reset()
KVM: arm64: gic-v5: Clear db_fired flag before making VPE non-resident
KVM: arm64: gic-v5: Make VPEs (non-)resident in vgic_load/put
KVM: arm64: gic-v5: Request VPE doorbells when going non-resident
KVM: arm64: gic-v5: Handle doorbells in kvm_vgic_vcpu_pending_irq()
KVM: arm64: gic-v5: Initialise and teardown VMTEs & doorbells
KVM: arm64: gic-v5: Enable VPE DBs on VPE reset and disable on
teardown
KVM: arm64: gic-v5: Define remaining IRS MMIO registers
KVM: arm64: gic-v5: Introduce struct vgic_v5_irs and IRS base address
KVM: arm64: gic-v5: Add IRS IODEV to iodev_types and generic MMIO
handlers
KVM: arm64: gic-v5: Add KVM_VGIC_V5_ADDR_TYPE_IRS to UAPI
KVM: arm64: gic-v5: Add GICv5 IRS IODEV and MMIO emulation
KVM: arm64: gic-v5: Set IRICHPPIDIS based on IRS enable state
KVM: arm64: gic-v5: Call IRS init/teardown from vgic_v5 init/teardown
KVM: arm64: gic-v5: Register the IRS IODEV
Documentation: KVM: Extend VGICv5 docs for KVM_VGIC_V5_ADDR_TYPE_IRS
KVM: arm64: selftests: Update vGICv5 selftest to set IRS address
KVM: arm64: gic-v5: Introduce SPI AP list
KVM: arm64: gic-v5: Add GIC VDPEND and GIC VDRCFG hyp calls
KVM: arm64: gic-v5: Track SPI state for in-flight SPIs
KVM: arm64: gic: Introduce set_pending_state() to irq_op
KVM: arm64: gic-v5: Support SPI injection
KVM: arm64: gic-v5: Add GICv5 SPI injection to irqfd
KVM: arm64: gic-v5: Mask per-vcpu PPI state in
vgic_v5_finalize_ppi_state()
KVM: arm64: gic-v5: Add GICv5 EL1 sysreg userspace set/get interface
KVM: arm64: gic-v5: Implement save/restore mechanisms for ISTs
KVM: arm64: gic-v5: Handle userspace accesses to IRS MMIO region
KVM: arm64: gic-v5: Add VGIC_GRP_IRS_REGS/VGIC_GRP_IST to UAPI
KVM: arm64: gic-v5: Plumb in has/set/get_attr for sysregs & IRS MMIO
regs
Documentation: KVM: Document KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS for
VGICv5
Documentation: KVM: Add KVM_DEV_ARM_VGIC_GRP_IRS_REGS to VGICv5 docs
Documentation: KVM: Add docs for KVM_DEV_ARM_VGIC_GRP_IST
Documentation: KVM: Add the VGICv5 IRS save/restore sequences
.../virt/kvm/devices/arm-vgic-v5.rst | 224 ++-
arch/arm64/include/asm/kvm_asm.h | 4 +
arch/arm64/include/asm/kvm_hyp.h | 4 +
arch/arm64/include/asm/sysreg.h | 18 +-
arch/arm64/include/uapi/asm/kvm.h | 7 +
arch/arm64/kvm/Makefile | 3 +-
arch/arm64/kvm/arm.c | 2 +-
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 33 +
arch/arm64/kvm/hyp/vgic-v5-sr.c | 54 +
arch/arm64/kvm/sys_regs.c | 6 +-
arch/arm64/kvm/vgic-sys-reg-v5.c | 510 +++++
arch/arm64/kvm/vgic/vgic-init.c | 57 +-
arch/arm64/kvm/vgic/vgic-irqfd.c | 13 +-
arch/arm64/kvm/vgic/vgic-irs-v5.c | 1075 ++++++++++
arch/arm64/kvm/vgic/vgic-kvm-device.c | 235 ++-
arch/arm64/kvm/vgic/vgic-mmio.c | 6 +
arch/arm64/kvm/vgic/vgic-mmio.h | 2 +
arch/arm64/kvm/vgic/vgic-v5-tables.c | 1766 +++++++++++++++++
arch/arm64/kvm/vgic/vgic-v5-tables.h | 212 ++
arch/arm64/kvm/vgic/vgic-v5.c | 1250 +++++++++++-
arch/arm64/kvm/vgic/vgic.c | 25 +-
arch/arm64/kvm/vgic/vgic.h | 20 +-
arch/arm64/tools/sysreg | 4 +-
drivers/irqchip/irq-gic-v5-irs.c | 26 +
drivers/irqchip/irq-gic-v5.c | 3 +
include/kvm/arm_vgic.h | 126 +-
include/linux/irqchip/arm-gic-v5.h | 199 +-
include/linux/irqchip/arm-vgic-info.h | 5 +
tools/arch/arm64/include/uapi/asm/kvm.h | 2 +
tools/testing/selftests/kvm/arm64/vgic_v5.c | 6 +
.../selftests/kvm/include/arm64/gic_v5.h | 3 +
31 files changed, 5791 insertions(+), 109 deletions(-)
create mode 100644 arch/arm64/kvm/vgic-sys-reg-v5.c
create mode 100644 arch/arm64/kvm/vgic/vgic-irs-v5.c
create mode 100644 arch/arm64/kvm/vgic/vgic-v5-tables.c
create mode 100644 arch/arm64/kvm/vgic/vgic-v5-tables.h
--
2.34.1
^ permalink raw reply
* [PATCH 01/43] arm64/sysreg: Add GICv5 GIC VDPEND and VDRCFG encodings
From: Sascha Bischoff @ 2026-04-27 16:06 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
Add the system register encodings for the GIC VDPEND and GIC VDRCFG
system instructions. These operate on the virtual interrupt domain,
and are used to make interrupts pending for a VM and to read back the
configuration of a VM's interrupts.
This is part of enabling GICv5 KVM support, and is required for
injection of SPIs and LPIs, and querying the state of in-flight SPIs
to detect their deactivation.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/include/asm/sysreg.h | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 736561480f365..e00b32f0a8d9f 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -1040,7 +1040,7 @@
#define GCS_CAP(x) ((((unsigned long)x) & GCS_CAP_ADDR_MASK) | \
GCS_CAP_VALID_TOKEN)
/*
- * Definitions for GICv5 instructions
+ * Definitions for GICv5 instructions for the Current Domain
*/
#define GICV5_OP_GIC_CDAFF sys_insn(1, 0, 12, 1, 3)
#define GICV5_OP_GIC_CDDI sys_insn(1, 0, 12, 2, 0)
@@ -1105,6 +1105,22 @@
#define GICV5_GICR_CDNMIA_TYPE_MASK GENMASK_ULL(31, 29)
#define GICV5_GICR_CDNMIA_ID_MASK GENMASK_ULL(23, 0)
+/*
+ * Definitions for GICv5 instructions for the Virtual Domain
+ */
+#define GICV5_OP_GIC_VDPEND sys_insn(1, 4, 12, 1, 4)
+#define GICV5_OP_GIC_VDRCFG sys_insn(1, 4, 12, 1, 5)
+
+/* Shift and mask definitions for GIC VDPEND */
+#define GICV5_GIC_VDPEND_PENDING_MASK BIT_ULL(63)
+#define GICV5_GIC_VDPEND_VM_MASK GENMASK_ULL(47, 32)
+#define GICV5_GIC_VDPEND_TYPE_MASK GENMASK_ULL(31, 29)
+#define GICV5_GIC_VDPEND_ID_MASK GENMASK_ULL(23, 0)
+
+/* Shift and mask definitions for GIC VDRCFG */
+#define GICV5_GIC_VDRCFG_TYPE_MASK GENMASK_ULL(31, 29)
+#define GICV5_GIC_VDRCFG_ID_MASK GENMASK_ULL(23, 0)
+
#define gicr_insn(insn) read_sysreg_s(GICV5_OP_GICR_##insn)
#define gic_insn(v, insn) write_sysreg_s(v, GICV5_OP_GIC_##insn)
--
2.34.1
^ permalink raw reply related
* [PATCH 02/43] arm64/sysreg: Update ICC_CR0_EL1 with LINK and LINK_IDLE fields
From: Sascha Bischoff @ 2026-04-27 16:06 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
These fields have been added to the architecture since this register
was added to the generator, and were hence missing.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/tools/sysreg | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index 6c3ff14e561e6..57ab09404267c 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -3736,7 +3736,9 @@ Sysreg ICC_CR0_EL1 3 1 12 0 1
Res0 63:39
Field 38 PID
Field 37:32 IPPT
-Res0 31:1
+Res0 31:3
+Field 2 LINK_IDLE
+Field 1 LINK
Field 0 EN
EndSysreg
--
2.34.1
^ permalink raw reply related
* [PATCH 03/43] KVM: arm64: gic-v5: Add resident/non-resident hyp calls
From: Sascha Bischoff @ 2026-04-27 16:07 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
So far the KVM GICv5 support has been limited to PPIs. These only go
as far out as the CPU interface, and have no interaction with the
host's IRS. Therefore, PPIs can be directly used for guests without
host IRS involvement. However, in order to support both SPIs and LPIs
IRS involvement is required.
GICv5 introduces the concept of VPE residency - a VPE can be either
resident or non-resident. When the VPE is resident, the IRS is allowed
to select interrupts that target that VPE (or the VM) as the HPPI
(Highest Priority Pending Interrupt). As the IRS handles both SPIs and
LPIs, these will only be picked as the IRS's HPPI when a VPE is
resident.
A GICv5 VPE is made resident by writing to the ICH_CONTEXTR_EL2 with a
valid VM and VPE ID, and marking it valid in the process. This informs
the IRS that a specific VPE is running, and that it can begin HPPI
selection for that VPE. Making a VPE non-resident (by making the
ICH_CONTEXTR_EL2 invalid) informs the IRS that the VPE is no longer
running, and it stops HPPI selection for it.
This change introduces two new hyp calls - one to make a VPE resident
and its counterpart to make a VPE non-resident. As part of making a
VPE resident, the ICH_CONTEXTR_EL2.F bit is checked in order to catch
faults, at which point the kernel will WARN. If everything is
configured correctly, this should not happen.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/include/asm/kvm_asm.h | 2 ++
arch/arm64/include/asm/kvm_hyp.h | 2 ++
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 15 +++++++++++++++
arch/arm64/kvm/hyp/vgic-v5-sr.c | 25 +++++++++++++++++++++++++
include/kvm/arm_vgic.h | 3 +++
5 files changed, 47 insertions(+)
diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h
index fa033be6141ad..8c69f1f4de534 100644
--- a/arch/arm64/include/asm/kvm_asm.h
+++ b/arch/arm64/include/asm/kvm_asm.h
@@ -79,6 +79,8 @@ enum __kvm_host_smccc_func {
__KVM_HOST_SMCCC_FUNC___kvm_timer_set_cntvoff,
__KVM_HOST_SMCCC_FUNC___vgic_v3_save_aprs,
__KVM_HOST_SMCCC_FUNC___vgic_v3_restore_vmcr_aprs,
+ __KVM_HOST_SMCCC_FUNC___vgic_v5_make_resident,
+ __KVM_HOST_SMCCC_FUNC___vgic_v5_make_non_resident,
__KVM_HOST_SMCCC_FUNC___vgic_v5_save_apr,
__KVM_HOST_SMCCC_FUNC___vgic_v5_restore_vmcr_apr,
diff --git a/arch/arm64/include/asm/kvm_hyp.h b/arch/arm64/include/asm/kvm_hyp.h
index 8d06b62e7188c..5f9184276b04e 100644
--- a/arch/arm64/include/asm/kvm_hyp.h
+++ b/arch/arm64/include/asm/kvm_hyp.h
@@ -88,6 +88,8 @@ void __vgic_v3_restore_vmcr_aprs(struct vgic_v3_cpu_if *cpu_if);
int __vgic_v3_perform_cpuif_access(struct kvm_vcpu *vcpu);
/* GICv5 */
+void __vgic_v5_make_resident(struct vgic_v5_cpu_if *cpu_if);
+void __vgic_v5_make_non_resident(struct vgic_v5_cpu_if *cpu_if);
void __vgic_v5_save_apr(struct vgic_v5_cpu_if *cpu_if);
void __vgic_v5_restore_vmcr_apr(struct vgic_v5_cpu_if *cpu_if);
/* No hypercalls for the following */
diff --git a/arch/arm64/kvm/hyp/nvhe/hyp-main.c b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
index 9e44c05cf780e..804a9ffdc8594 100644
--- a/arch/arm64/kvm/hyp/nvhe/hyp-main.c
+++ b/arch/arm64/kvm/hyp/nvhe/hyp-main.c
@@ -672,6 +672,19 @@ static void handle___tracing_write_event(struct kvm_cpu_context *host_ctxt)
trace_selftest(id);
}
+static void handle___vgic_v5_make_resident(struct kvm_cpu_context *host_ctxt)
+{
+ DECLARE_REG(struct vgic_v5_cpu_if *, cpu_if, host_ctxt, 1);
+
+ __vgic_v5_make_resident(kern_hyp_va(cpu_if));
+}
+static void handle___vgic_v5_make_non_resident(struct kvm_cpu_context *host_ctxt)
+{
+ DECLARE_REG(struct vgic_v5_cpu_if *, cpu_if, host_ctxt, 1);
+
+ __vgic_v5_make_non_resident(kern_hyp_va(cpu_if));
+}
+
static void handle___vgic_v5_save_apr(struct kvm_cpu_context *host_ctxt)
{
DECLARE_REG(struct vgic_v5_cpu_if *, cpu_if, host_ctxt, 1);
@@ -711,6 +724,8 @@ static const hcall_t host_hcall[] = {
HANDLE_FUNC(__kvm_timer_set_cntvoff),
HANDLE_FUNC(__vgic_v3_save_aprs),
HANDLE_FUNC(__vgic_v3_restore_vmcr_aprs),
+ HANDLE_FUNC(__vgic_v5_make_resident),
+ HANDLE_FUNC(__vgic_v5_make_non_resident),
HANDLE_FUNC(__vgic_v5_save_apr),
HANDLE_FUNC(__vgic_v5_restore_vmcr_apr),
diff --git a/arch/arm64/kvm/hyp/vgic-v5-sr.c b/arch/arm64/kvm/hyp/vgic-v5-sr.c
index 6d69dfe89a96c..04c5846b9abac 100644
--- a/arch/arm64/kvm/hyp/vgic-v5-sr.c
+++ b/arch/arm64/kvm/hyp/vgic-v5-sr.c
@@ -7,6 +7,31 @@
#include <asm/kvm_hyp.h>
+void __vgic_v5_make_resident(struct vgic_v5_cpu_if *cpu_if)
+{
+ write_sysreg_s(cpu_if->vgic_contextr, SYS_ICH_CONTEXTR_EL2);
+ isb();
+
+ /* Catch any faults */
+ cpu_if->vgic_contextr = read_sysreg_s(SYS_ICH_CONTEXTR_EL2);
+ if (WARN_ON(FIELD_GET(ICH_CONTEXTR_EL2_F, cpu_if->vgic_contextr)))
+ return;
+
+ cpu_if->gicv5_vpe.resident = true;
+}
+
+void __vgic_v5_make_non_resident(struct vgic_v5_cpu_if *cpu_if)
+{
+ /*
+ * Make as non-resident before actually making non-resident. Avoids race
+ * with doorbell arriving.
+ */
+ cpu_if->gicv5_vpe.resident = false;
+
+ write_sysreg_s(cpu_if->vgic_contextr, SYS_ICH_CONTEXTR_EL2);
+ isb();
+}
+
void __vgic_v5_save_apr(struct vgic_v5_cpu_if *cpu_if)
{
cpu_if->vgic_apr = read_sysreg_s(SYS_ICH_APR_EL2);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index fe49fb56dc3c9..d14cf4771d606 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -495,6 +495,9 @@ struct vgic_v5_cpu_if {
*/
u64 vgic_icsr;
+ /* The contextr used to make VPEs resident and non-resident */
+ u64 vgic_contextr;
+
struct gicv5_vpe gicv5_vpe;
};
--
2.34.1
^ permalink raw reply related
* [PATCH 04/43] irqchip/gic-v5: Provide IRS config frame attrs to KVM
From: Sascha Bischoff @ 2026-04-27 16:07 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
KVM needs to interact with the host IRS in order to, for example, make
VMs or VPEs valid. There are two potential approaches here. Either the
host irqchip driver can provide an interface, or KVM can interact
directly with the host IRS. The latter of these two is chosen as the
set of MMIO registers that KVM needs to interact with is orthogonal to
the set used by the host irqchip driver (with the exception of some of
the read-only IRS_IDRx registers).
Pass KVM a pointer to an IRS config frame - the config frame belonging
to ANY IRS is fine as long as one IRS's config frame is used
consistently - in struct gic_kvm_info. Additionally, include a flag
telling KVM whether the IRS is coherent or non-coherent in order to
make sure that KVM can do the correct cache state management, if
required.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
drivers/irqchip/irq-gic-v5-irs.c | 26 ++++++++++++++++++++++++++
drivers/irqchip/irq-gic-v5.c | 3 +++
include/linux/irqchip/arm-gic-v5.h | 2 ++
include/linux/irqchip/arm-vgic-info.h | 5 +++++
4 files changed, 36 insertions(+)
diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index f3fce0b1e25d9..5dfa043cf9e34 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -50,6 +50,32 @@ static void irs_writeq_relaxed(struct gicv5_irs_chip_data *irs_data,
writeq_relaxed(val, irs_data->irs_base + reg_offset);
}
+void __iomem *gicv5_irs_get_config_frame_base(void)
+{
+ struct gicv5_irs_chip_data *irs_data = per_cpu(per_cpu_irs_data,
+ smp_processor_id());
+
+ if (!irs_data)
+ return NULL;
+
+ return irs_data->irs_base;
+}
+
+bool gicv5_irs_is_non_coherent(void)
+{
+ struct gicv5_irs_chip_data *irs_data = per_cpu(per_cpu_irs_data,
+ smp_processor_id());
+
+ if (!irs_data) {
+ pr_err("Failed to look up IRS for CPU %d\n",
+ smp_processor_id());
+ return false;
+ }
+
+ return !!(irs_data->flags & IRS_FLAGS_NON_COHERENT);
+}
+
+
/*
* The polling wait (in gicv5_wait_for_op_s_atomic()) on a GIC register
* provides the memory barriers (through MMIO accessors)
diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
index 58e457d4c1476..3329019722360 100644
--- a/drivers/irqchip/irq-gic-v5.c
+++ b/drivers/irqchip/irq-gic-v5.c
@@ -1134,6 +1134,9 @@ static void __init gic_of_setup_kvm_info(struct device_node *node)
gic_v5_kvm_info.type = GIC_V5;
+ gic_v5_kvm_info.gicv5_irs.base = gicv5_irs_get_config_frame_base();
+ gic_v5_kvm_info.gicv5_irs.non_coherent = gicv5_irs_is_non_coherent();
+
/* GIC Virtual CPU interface maintenance interrupt */
gic_v5_kvm_info.no_maint_irq_mask = false;
gic_v5_kvm_info.maint_irq = irq_of_parse_and_map(node, 0);
diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
index 40d2fce682940..dfa4d29dc0012 100644
--- a/include/linux/irqchip/arm-gic-v5.h
+++ b/include/linux/irqchip/arm-gic-v5.h
@@ -377,6 +377,8 @@ void __init gicv5_free_lpi_domain(void);
int gicv5_irs_of_probe(struct device_node *parent);
int gicv5_irs_acpi_probe(void);
+void __iomem *gicv5_irs_get_config_frame_base(void);
+bool gicv5_irs_is_non_coherent(void);
void gicv5_irs_remove(void);
int gicv5_irs_enable(void);
void gicv5_irs_its_probe(void);
diff --git a/include/linux/irqchip/arm-vgic-info.h b/include/linux/irqchip/arm-vgic-info.h
index 67d9d960273b9..f05370e2debf4 100644
--- a/include/linux/irqchip/arm-vgic-info.h
+++ b/include/linux/irqchip/arm-vgic-info.h
@@ -38,6 +38,11 @@ struct gic_kvm_info {
bool has_v4_1;
/* Deactivation impared, subpar stuff */
bool no_hw_deactivation;
+ /* GICv5 IRS base */
+ struct {
+ void __iomem *base;
+ bool non_coherent;
+ } gicv5_irs;
};
#ifdef CONFIG_KVM
--
2.34.1
^ permalink raw reply related
* [PATCH 05/43] KVM: arm64: gic-v5: Extract host IRS caps from IRS config frame
From: Sascha Bischoff @ 2026-04-27 16:07 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
The host irqchip driver provides KVM with a pointer to an IRS's config
frame, which allows KVM to directly interact with the host's IRS. The
MMIO registers in the config frame are used to configure VMs (in
addition to them being used by the host). The IRS's config frame also
includes a set of ID registers which describe the capabilities that
the IRS has.
Stash the pointer to the config frame, and extract the VM capabilities
(from IRS_IDR3 & IRS_IDR4), as well as the IST
capabilities/requirements (IRS_IDR2) from the IRS.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/kvm/Makefile | 2 +-
arch/arm64/kvm/vgic/vgic-v5-tables.c | 8 +++++
arch/arm64/kvm/vgic/vgic-v5-tables.h | 41 ++++++++++++++++++++++
arch/arm64/kvm/vgic/vgic-v5.c | 52 ++++++++++++++++++++++++++++
include/linux/irqchip/arm-gic-v5.h | 10 ++++++
5 files changed, 112 insertions(+), 1 deletion(-)
create mode 100644 arch/arm64/kvm/vgic/vgic-v5-tables.c
create mode 100644 arch/arm64/kvm/vgic/vgic-v5-tables.h
diff --git a/arch/arm64/kvm/Makefile b/arch/arm64/kvm/Makefile
index 59612d2f277c1..431de9b145ca1 100644
--- a/arch/arm64/kvm/Makefile
+++ b/arch/arm64/kvm/Makefile
@@ -24,7 +24,7 @@ kvm-y += arm.o mmu.o mmio.o psci.o hypercalls.o pvtime.o \
vgic/vgic-mmio.o vgic/vgic-mmio-v2.o \
vgic/vgic-mmio-v3.o vgic/vgic-kvm-device.o \
vgic/vgic-its.o vgic/vgic-debug.o vgic/vgic-v3-nested.o \
- vgic/vgic-v5.o
+ vgic/vgic-v5.o vgic/vgic-v5-tables.o
kvm-$(CONFIG_HW_PERF_EVENTS) += pmu-emul.o pmu.o
kvm-$(CONFIG_ARM64_PTR_AUTH) += pauth.o
diff --git a/arch/arm64/kvm/vgic/vgic-v5-tables.c b/arch/arm64/kvm/vgic/vgic-v5-tables.c
new file mode 100644
index 0000000000000..30e2b108b1aa3
--- /dev/null
+++ b/arch/arm64/kvm/vgic/vgic-v5-tables.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2025, 2026 Arm Ltd.
+ */
+
+#include "vgic-v5-tables.h"
+
+struct vgic_v5_host_ist_caps gicv5_host_ist_caps;
diff --git a/arch/arm64/kvm/vgic/vgic-v5-tables.h b/arch/arm64/kvm/vgic/vgic-v5-tables.h
new file mode 100644
index 0000000000000..cf00a248eabd5
--- /dev/null
+++ b/arch/arm64/kvm/vgic/vgic-v5-tables.h
@@ -0,0 +1,41 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (C) 2025, 2026 Arm Ltd.
+ */
+
+#ifndef __KVM_ARM_VGICV5_TABLES_H__
+#define __KVM_ARM_VGICV5_TABLES_H__
+
+#include <linux/irqchip/arm-gic-v5.h>
+
+struct vgic_v5_host_ist_caps {
+ /* IST Capabilities */
+
+ /* Apply to LPIs and SPIs */
+ u8 ist_id_bits;
+ bool ist_levels;
+ u8 ist_l2sz;
+ bool istmd;
+ u8 istmd_sz;
+
+ /* LPI only */
+ u8 min_lpi_id_bits;
+
+ /* VM Table, VPE Table */
+ bool two_level_vmt_support;
+ u32 max_vms;
+ u32 max_vpes;
+ u16 vmd_size;
+ u16 vped_size;
+
+ /* Is the IRS coherent with us, or not? */
+ bool irs_non_coherent;
+};
+
+extern struct vgic_v5_host_ist_caps gicv5_host_ist_caps;
+static inline struct vgic_v5_host_ist_caps *vgic_v5_host_caps(void)
+{
+ return &gicv5_host_ist_caps;
+}
+
+#endif
diff --git a/arch/arm64/kvm/vgic/vgic-v5.c b/arch/arm64/kvm/vgic/vgic-v5.c
index d4789ff3e7402..fd3d6299a2baa 100644
--- a/arch/arm64/kvm/vgic/vgic-v5.c
+++ b/arch/arm64/kvm/vgic/vgic-v5.c
@@ -9,6 +9,7 @@
#include <linux/irqchip/arm-vgic-info.h>
#include "vgic.h"
+#include "vgic-v5-tables.h"
#define ppi_caps kvm_vgic_global_state.vgic_v5_ppi_caps
@@ -34,6 +35,54 @@ static void vgic_v5_get_implemented_ppis(void)
__assign_bit(GICV5_ARCH_PPI_PMUIRQ, ppi_caps.impl_ppi_mask, system_supports_pmuv3());
}
+static void __iomem *irs_base;
+
+static u32 irs_readl_relaxed(const u32 reg_offset)
+{
+ return readl_relaxed(irs_base + reg_offset);
+}
+
+static int gicv5_irs_extract_vm_caps(const struct gic_kvm_info *info)
+{
+ u64 idr;
+
+ irs_base = info->gicv5_irs.base;
+ if (!irs_base) {
+ kvm_info("No GICv5 MMIO IRS address; no GICv5 support\n");
+ return -ENODEV;
+ }
+
+ vgic_v5_host_caps()->irs_non_coherent = info->gicv5_irs.non_coherent;
+
+ idr = irs_readl_relaxed(GICV5_IRS_IDR2);
+
+ /* We skip the LPI field as it only applies to physical LPIs */
+ vgic_v5_host_caps()->ist_id_bits = FIELD_GET(GICV5_IRS_IDR2_ID_BITS, idr);
+ vgic_v5_host_caps()->min_lpi_id_bits = FIELD_GET(GICV5_IRS_IDR2_MIN_LPI_ID_BITS, idr);
+ vgic_v5_host_caps()->ist_levels = !!FIELD_GET(GICV5_IRS_IDR2_IST_LEVELS, idr);
+ vgic_v5_host_caps()->ist_l2sz = FIELD_GET(GICV5_IRS_IDR2_IST_L2SZ, idr);
+ vgic_v5_host_caps()->istmd = !!FIELD_GET(GICV5_IRS_IDR2_ISTMD, idr);
+ vgic_v5_host_caps()->istmd_sz = FIELD_GET(GICV5_IRS_IDR2_ISTMD_SZ, idr);
+
+ idr = irs_readl_relaxed(GICV5_IRS_IDR3);
+
+ vgic_v5_host_caps()->max_vms = BIT(FIELD_GET(GICV5_IRS_IDR3_VM_ID_BITS, idr));
+ vgic_v5_host_caps()->two_level_vmt_support = !!FIELD_GET(GICV5_IRS_IDR3_VMT_LEVELS, idr);
+
+ if (FIELD_GET(GICV5_IRS_IDR3_VMD, idr))
+ vgic_v5_host_caps()->vmd_size = BIT(FIELD_GET(GICV5_IRS_IDR3_VMD_SZ, idr));
+ else
+ vgic_v5_host_caps()->vmd_size = 0;
+
+ idr = irs_readl_relaxed(GICV5_IRS_IDR4);
+
+ vgic_v5_host_caps()->vped_size = BIT(FIELD_GET(GICV5_IRS_IDR4_VPED_SZ, idr));
+ /* Field stores VPE_ID_BITS - 1 */
+ vgic_v5_host_caps()->max_vpes = BIT(FIELD_GET(GICV5_IRS_IDR4_VPE_ID_BITS, idr) + 1);
+
+ return 0;
+}
+
/*
* Probe for a vGICv5 compatible interrupt controller, returning 0 on success.
*/
@@ -61,6 +110,9 @@ int vgic_v5_probe(const struct gic_kvm_info *info)
goto skip_v5;
}
+ if (gicv5_irs_extract_vm_caps(info))
+ goto skip_v5;
+
kvm_vgic_global_state.max_gic_vcpus = VGIC_V5_MAX_CPUS;
vgic_v5_get_implemented_ppis();
diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
index dfa4d29dc0012..76dcf414ffb20 100644
--- a/include/linux/irqchip/arm-gic-v5.h
+++ b/include/linux/irqchip/arm-gic-v5.h
@@ -68,6 +68,8 @@
#define GICV5_IRS_IDR0 0x0000
#define GICV5_IRS_IDR1 0x0004
#define GICV5_IRS_IDR2 0x0008
+#define GICV5_IRS_IDR3 0x000c
+#define GICV5_IRS_IDR4 0x0010
#define GICV5_IRS_IDR5 0x0014
#define GICV5_IRS_IDR6 0x0018
#define GICV5_IRS_IDR7 0x001c
@@ -105,6 +107,14 @@
#define GICV5_IRS_IDR2_LPI BIT(5)
#define GICV5_IRS_IDR2_ID_BITS GENMASK(4, 0)
+#define GICV5_IRS_IDR3_VMT_LEVELS BIT(10)
+#define GICV5_IRS_IDR3_VM_ID_BITS GENMASK(9, 5)
+#define GICV5_IRS_IDR3_VMD_SZ GENMASK(4, 1)
+#define GICV5_IRS_IDR3_VMD BIT(0)
+
+#define GICV5_IRS_IDR4_VPE_ID_BITS GENMASK(9, 6)
+#define GICV5_IRS_IDR4_VPED_SZ GENMASK(5, 0)
+
#define GICV5_IRS_IDR5_SPI_RANGE GENMASK(24, 0)
#define GICV5_IRS_IDR6_SPI_IRS_RANGE GENMASK(24, 0)
#define GICV5_IRS_IDR7_SPI_BASE GENMASK(23, 0)
--
2.34.1
^ permalink raw reply related
* [PATCH 06/43] KVM: arm64: gic-v5: Add VPE doorbell domain
From: Sascha Bischoff @ 2026-04-27 16:08 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
GICv5 supports two types of doorbell - VPE doorbells and VM
doorbells. In KVM we only support Targeted interrupts, and do not
support 1ofN target selection. This means that we only implement VPE
doorbells. These doorbells are implemented as host LPIs which are
generated when a non-resident VPE has a pending interrupt of
sufficient priority and the doorbell has been requested as part of
making the VPE non-resident.
VPE doorbells allow KVM to wake VPEs (so, vcpus) as soon as the
hardware determines that sufficient conditions for the interrupt to be
signalled have been met. This simplifies the wake-up path for vcpus
with GICv5 for LPIs and SPIs. NOTE: PPI pending state must still be
checked explicitly as the IRS never sees them.
This change introduces support for the vgic_v5 doorbell domain. One
doorbell domain is created per GICv5 VM, and all VPEs have their own
doorbell within this domain. When the doorbell fires, this is tracked
(in gicv5_vpe.db_fired) and the corresponding vcpu is kicked.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/kvm/vgic/vgic-init.c | 5 +-
arch/arm64/kvm/vgic/vgic-v5.c | 143 +++++++++++++++++++++++++++++
arch/arm64/kvm/vgic/vgic.h | 1 +
include/kvm/arm_vgic.h | 6 ++
include/linux/irqchip/arm-gic-v5.h | 2 +
5 files changed, 156 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index 907057881b26a..984908a271c8d 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -500,8 +500,11 @@ static void kvm_vgic_dist_destroy(struct kvm *kvm)
dist->vgic_cpu_base = VGIC_ADDR_UNDEF;
}
- if (vgic_supports_direct_irqs(kvm))
+ if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3 &&
+ vgic_supports_direct_irqs(kvm))
vgic_v4_teardown(kvm);
+ else if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V5)
+ vgic_v5_teardown(kvm);
xa_destroy(&dist->lpi_xa);
}
diff --git a/arch/arm64/kvm/vgic/vgic-v5.c b/arch/arm64/kvm/vgic/vgic-v5.c
index fd3d6299a2baa..4e0d52b309628 100644
--- a/arch/arm64/kvm/vgic/vgic-v5.c
+++ b/arch/arm64/kvm/vgic/vgic-v5.c
@@ -7,6 +7,7 @@
#include <linux/bitops.h>
#include <linux/irqchip/arm-vgic-info.h>
+#include <linux/irqdomain.h>
#include "vgic.h"
#include "vgic-v5-tables.h"
@@ -162,6 +163,138 @@ int vgic_v5_probe(const struct gic_kvm_info *info)
return 0;
}
+/*
+ * This set of irq_chip functions is specific for doorbells.
+ */
+static struct irq_chip vgic_v5_db_irq_chip = {
+ .name = "GICv5-DB",
+ .irq_mask = irq_chip_mask_parent,
+ .irq_unmask = irq_chip_unmask_parent,
+ .irq_eoi = irq_chip_eoi_parent,
+ .irq_set_affinity = irq_chip_set_affinity_parent,
+ .irq_get_irqchip_state = irq_chip_get_parent_state,
+ .irq_set_irqchip_state = irq_chip_set_parent_state,
+ .flags = IRQCHIP_SET_TYPE_MASKED | IRQCHIP_SKIP_SET_WAKE |
+ IRQCHIP_MASK_ON_SUSPEND,
+};
+
+static int vgic_v5_irq_db_domain_map(struct irq_domain *d, unsigned int virq,
+ u16 vpe_id)
+{
+ int ret;
+ u32 lpi;
+ irq_hw_number_t hwirq;
+ struct irq_chip *chip = &vgic_v5_db_irq_chip;
+ struct irq_data *irqd = irq_desc_get_irq_data(irq_to_desc(virq));
+
+ /*
+ * For the DB domain, we don't use the same hwirq as for LPIs.
+ */
+ hwirq = vpe_id;
+
+ ret = gicv5_alloc_lpi();
+ if (ret < 0)
+ return ret;
+ lpi = ret;
+
+ ret = irq_domain_alloc_irqs_parent(d, virq, 1, &lpi);
+ if (ret) {
+ gicv5_free_lpi(lpi);
+ return ret;
+ }
+
+ irq_domain_set_hwirq_and_chip(d, virq, hwirq, chip, d->host_data);
+ irqd_set_single_target(irqd);
+
+ return 0;
+}
+
+
+static void vgic_v5_irq_db_domain_free(struct irq_domain *domain,
+ unsigned int virq, unsigned int nr_irqs)
+{
+ int i;
+
+ for (i = 0; i < nr_irqs; i++) {
+ struct irq_data *d = irq_domain_get_irq_data(domain, virq + i);
+
+ gicv5_free_lpi(d->parent_data->hwirq);
+ irq_set_handler(virq + i, NULL);
+ irq_domain_reset_irq_data(d);
+ }
+
+ irq_domain_free_irqs_parent(domain, virq, nr_irqs);
+}
+
+static int vgic_v5_irq_db_domain_alloc(struct irq_domain *domain,
+ unsigned int virq, unsigned int nr_irqs,
+ void *arg)
+{
+ struct vgic_v5_vm *vm = arg;
+ int ret;
+
+ if (vm == NULL) {
+ pr_err("invalid parameter for doorbell irq allocation");
+ return -EINVAL;
+ }
+
+ if (vm->nr_vpes != nr_irqs)
+ return -EINVAL;
+
+ for (int i = 0; i < nr_irqs; i++) {
+ ret = vgic_v5_irq_db_domain_map(domain, virq + i, i);
+ if (ret) {
+ /* Free what we've allocated so far before returning */
+ while (--i >= 0)
+ vgic_v5_irq_db_domain_free(domain, virq + i, 1);
+ return ret;
+ }
+ }
+
+ return 0;
+}
+
+static const struct irq_domain_ops vgic_v5_irq_db_domain_ops = {
+ .alloc = vgic_v5_irq_db_domain_alloc,
+ .free = vgic_v5_irq_db_domain_free,
+};
+
+static int vgic_v5_create_per_vm_domain(struct vgic_v5_vm *vm)
+{
+ if (!gicv5_global_data.lpi_domain) {
+ pr_err("LPI domain uninitialized, can't set up KVM Doorbells");
+ return -ENODEV;
+ }
+
+ vm->fwnode = irq_domain_alloc_named_id_fwnode("GICv5-vpe-db",
+ task_pid_nr(current));
+
+ /*
+ * KVM per-VM VPE DB domain; child of LPI domain; only ever handles
+ * doorbells. We know how many doorbells we have, and therefore we
+ * create a linear domain.
+ */
+ vm->domain = irq_domain_create_hierarchy(gicv5_global_data.lpi_domain,
+ 0, vm->nr_vpes, vm->fwnode,
+ &vgic_v5_irq_db_domain_ops, vm);
+
+ if (WARN_ON(!vm->domain))
+ return -ENOMEM;
+
+ return 0;
+}
+
+static void vgic_v5_teardown_per_vm_domain(struct vgic_v5_vm *vm)
+{
+ if (!vm->domain)
+ return;
+
+ irq_domain_remove(vm->domain);
+ irq_domain_free_fwnode(vm->fwnode);
+ vm->domain = NULL;
+ vm->fwnode = NULL;
+}
+
void vgic_v5_reset(struct kvm_vcpu *vcpu)
{
/*
@@ -181,10 +314,15 @@ int vgic_v5_init(struct kvm *kvm)
{
struct kvm_vcpu *vcpu;
unsigned long idx;
+ int ret;
if (vgic_initialized(kvm))
return 0;
+ ret = vgic_v5_create_per_vm_domain(&kvm->arch.vgic.gicv5_vm);
+ if (ret)
+ return ret;
+
kvm_for_each_vcpu(idx, vcpu, kvm) {
if (vcpu_has_nv(vcpu)) {
kvm_err("Nested GICv5 VMs are currently unsupported\n");
@@ -203,6 +341,11 @@ int vgic_v5_init(struct kvm *kvm)
return 0;
}
+void vgic_v5_teardown(struct kvm *kvm)
+{
+ vgic_v5_teardown_per_vm_domain(&kvm->arch.vgic.gicv5_vm);
+}
+
int vgic_v5_map_resources(struct kvm *kvm)
{
if (!vgic_initialized(kvm))
diff --git a/arch/arm64/kvm/vgic/vgic.h b/arch/arm64/kvm/vgic/vgic.h
index f45f7e3ec4d6e..f2f5fdc3211d7 100644
--- a/arch/arm64/kvm/vgic/vgic.h
+++ b/arch/arm64/kvm/vgic/vgic.h
@@ -366,6 +366,7 @@ void vgic_debug_destroy(struct kvm *kvm);
int vgic_v5_probe(const struct gic_kvm_info *info);
void vgic_v5_reset(struct kvm_vcpu *vcpu);
int vgic_v5_init(struct kvm *kvm);
+void vgic_v5_teardown(struct kvm *kvm);
int vgic_v5_map_resources(struct kvm *kvm);
void vgic_v5_set_ppi_ops(struct kvm_vcpu *vcpu, u32 vintid);
bool vgic_v5_has_pending_ppi(struct kvm_vcpu *vcpu);
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index d14cf4771d606..05dbd01f6fd21 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -366,6 +366,12 @@ struct vgic_v5_vm {
* convenient way to do that).
*/
DECLARE_BITMAP(vgic_ppi_hmr, VGIC_V5_NR_PRIVATE_IRQS);
+
+ struct fwnode_handle *fwnode;
+ struct irq_domain *domain;
+ int vpe_db_base;
+ int nr_vpes;
+ u16 vm_id;
};
struct vgic_dist {
diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
index 76dcf414ffb20..087d94f739672 100644
--- a/include/linux/irqchip/arm-gic-v5.h
+++ b/include/linux/irqchip/arm-gic-v5.h
@@ -401,6 +401,8 @@ void gicv5_irs_syncr(void);
/* Embedded in kvm.arch */
struct gicv5_vpe {
+ int db;
+ bool db_fired;
bool resident;
};
--
2.34.1
^ permalink raw reply related
* [PATCH 07/43] KVM: arm64: gic-v5: Create & manage VM and VPE tables
From: Sascha Bischoff @ 2026-04-27 16:08 UTC (permalink / raw)
To: linux-arm-kernel@lists.infradead.org, kvmarm@lists.linux.dev,
kvm@vger.kernel.org
Cc: nd, maz@kernel.org, oliver.upton@linux.dev, Joey Gouly,
Suzuki Poulose, yuzenghui@huawei.com, peter.maydell@linaro.org,
lpieralisi@kernel.org, Timothy Hayes
In-Reply-To: <20260427160547.3129448-1-sascha.bischoff@arm.com>
GICv5 uses a set of in-memory tables to track and manage VM
state. These must be allocated by the hypervisor, and provided to the
IRS to use.
The VMT (Virtual Machine Table) is a linear or two level table
comprising VMT Entries (VMTE). Each VMTE describes the state for a
single VM. This state includes things such as the SPI and LPI IST
configuration (coming in a future commit), an implementation-defined
VM Descriptor, and a VPE Table (VPET).
The VPET contains one entry per VPE belonging to a VM, and is used to
mark a VPE as valid, as well as providing the address of an
implementation-defined VPE Descriptor, which is used by the hardware
to track and manage VPE state.
This commit adds support for allocating the VMT, and managing the
VMTEs. The VMTEs can be initialised or released for re-use. Allocation
and tracking of unused VMTEs is handled with an IDA.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
arch/arm64/kvm/vgic/vgic-v5-tables.c | 628 +++++++++++++++++++++++++++
arch/arm64/kvm/vgic/vgic-v5-tables.h | 108 +++++
include/kvm/arm_vgic.h | 2 +
include/linux/irqchip/arm-gic-v5.h | 13 +
4 files changed, 751 insertions(+)
diff --git a/arch/arm64/kvm/vgic/vgic-v5-tables.c b/arch/arm64/kvm/vgic/vgic-v5-tables.c
index 30e2b108b1aa3..502d05d46cccf 100644
--- a/arch/arm64/kvm/vgic/vgic-v5-tables.c
+++ b/arch/arm64/kvm/vgic/vgic-v5-tables.c
@@ -3,6 +3,634 @@
* Copyright (C) 2025, 2026 Arm Ltd.
*/
+#include <kvm/arm_vgic.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sizes.h>
+#include <linux/slab.h>
+#include <linux/xarray.h>
+#include <asm/kvm_mmu.h>
+
+#include "vgic.h"
#include "vgic-v5-tables.h"
struct vgic_v5_host_ist_caps gicv5_host_ist_caps;
+
+static struct vgic_v5_vmt *vmt_info;
+DEFINE_XARRAY(vm_info);
+
+static bool vgic_v5_vmt_allocated(void)
+{
+ return vmt_info != NULL;
+}
+
+static int vgic_v5_check_vm_id(u16 vm_id)
+{
+ if (vm_id >= vmt_info->num_entries)
+ return -EINVAL;
+
+ return 0;
+}
+
+/*
+ * Our IRS might be coherent or non-coherent. If coherent, we can just emit a
+ * DSB to ensure that we're in sync. However, when non-coherent, we need to
+ * manage our cached data explicitly.
+ *
+ * This helper is used to handle both coherent and non-coherent IRSes, and
+ * handles all combinations of cleaning and invalidating to the PoC.
+ */
+static void vgic_v5_clean_inval(void *va, size_t size, bool clean, bool inval)
+{
+ unsigned long base = (unsigned long)va;
+
+ /* Catch any accidental NOPs */
+ BUILD_BUG_ON(!(clean || inval));
+
+ /* Coherent; emit DSB. */
+ if (!gicv5_host_ist_caps.irs_non_coherent) {
+ dsb(ishst);
+ return;
+ }
+
+ if (clean && inval)
+ dcache_clean_inval_poc(base, base + size);
+ else if (clean)
+ dcache_clean_poc(base, base + size);
+ else if (inval)
+ dcache_inval_poc(base, base + size);
+}
+
+/*
+ * Create a linear VM table, rounding up the number of entries to at least one
+ * whole page to give us nicer alignment.
+ *
+ * Note: We don't update the number of entries tracked in our tracking structure
+ * as this might be higher than the number of bits supported by the HW.
+ */
+static int vgic_v5_alloc_vmt_linear(unsigned int num_entries)
+{
+ unsigned int l2_entries_per_page;
+ size_t alloc_size;
+
+ /* Potentially throw away a bit of memory for the sake of alignment! */
+ l2_entries_per_page = PAGE_SIZE / GICV5_VMTEL2E_SIZE;
+ if (num_entries < l2_entries_per_page)
+ num_entries = l2_entries_per_page;
+
+ alloc_size = num_entries * sizeof(struct vmtl2_entry);
+
+ vmt_info->linear.vmt_base = kzalloc(alloc_size, GFP_KERNEL);
+ if (vmt_info->linear.vmt_base == NULL)
+ return -ENOMEM;
+
+ vgic_v5_clean_inval(vmt_info->linear.vmt_base, alloc_size, true, true);
+
+ return 0;
+}
+
+/*
+ * Allocate the first level of a two-level VM table. The second-level VM tables
+ * are allocated on demand (by vgic_v5_alloc_l2_vmt()).
+ *
+ * Note: If there are too few entries, these are rounded up to the size of an L2
+ * table (4k) to ensure sane alignment. As with the linear table, the tracked
+ * number of entries is not increased to avoid the case of going above what the
+ * hardware supports.
+ */
+static int vgic_v5_alloc_vmt_two_level(unsigned int num_entries)
+{
+ size_t alloc_size;
+
+ /* Potentially throw away a bit of memory for the sake of alignment! */
+ if (num_entries < GICV5_VMT_L2_TABLE_ENTRIES)
+ num_entries = GICV5_VMT_L2_TABLE_ENTRIES;
+
+ /*
+ * Let's make sure that we always allocate a whole power of 2
+ * of entries. Note that we need to subtract 1 from the fls()
+ * result in order to give the correct number of bits as we
+ * are operating on a whole power of 2.
+ */
+ num_entries = roundup_pow_of_two(num_entries);
+
+ vmt_info->l2.num_l1_ents = (num_entries / GICV5_VMT_L2_TABLE_ENTRIES);
+ alloc_size = vmt_info->l2.num_l1_ents * sizeof(vmtl1_entry);
+
+ vmt_info->l2.vmt_base = kzalloc(alloc_size, GFP_KERNEL);
+ if (vmt_info->l2.vmt_base == NULL)
+ return -ENOMEM;
+
+ vgic_v5_clean_inval(vmt_info->l2.vmt_base, alloc_size, true, true);
+
+ vmt_info->l2.l2ptrs = kzalloc_objs(*vmt_info->l2.l2ptrs,
+ vmt_info->l2.num_l1_ents,
+ GFP_KERNEL);
+ if (vmt_info->l2.l2ptrs == NULL) {
+ kfree(vmt_info->l2.vmt_base);
+ return -ENOMEM;
+ }
+
+ return 0;
+}
+
+
+/*
+ * Allocate a second level VMT, if required. This can be called eagerly, and
+ * will only perform the allocation if required.
+ */
+static int vgic_v5_alloc_l2_vmt(struct kvm *kvm)
+{
+ unsigned int l1_index;
+ struct vmtl2_entry *l2_table;
+ vmtl1_entry tmp;
+ u16 vm_id = vgic_v5_vm_id(kvm);
+ struct kvm_vcpu *vcpu0 = kvm_get_vcpu(kvm, 0);
+ struct gicv5_cmd_info cmd_info;
+ int ret;
+
+ if (!vgic_v5_vmt_allocated())
+ return -ENXIO;
+
+ /* Nothing to do if we have linear tables! */
+ if (!vmt_info->two_level)
+ return 0;
+
+ ret = vgic_v5_check_vm_id(vm_id);
+ if (ret)
+ return ret;
+
+ /*
+ * We have 4k-sized L2 tables - this is mandated by the spec for
+ * two-level VMTs. This means that we have 128 entries per L1 VMTE.
+ */
+ l1_index = vm_id / GICV5_VMT_L2_TABLE_ENTRIES;
+
+ if (l1_index > vmt_info->l2.num_l1_ents)
+ return -E2BIG;
+
+ /* Already valid? Great! */
+ if (vmt_info->l2.l2ptrs[l1_index] != NULL)
+ return 0;
+
+ l2_table = kzalloc(GICV5_VMT_L2_TABLE_SIZE, GFP_KERNEL);
+ if (l2_table == NULL)
+ return -ENOMEM;
+
+ if (virt_to_phys(l2_table) & ~GICV5_VMTEL1E_L2_ADDR) {
+ kfree(l2_table);
+ return -EINVAL;
+ }
+
+ vmt_info->l2.l2ptrs[l1_index] = l2_table;
+
+ /* Alignment issue! */
+ if (virt_to_phys(l2_table) & ~GICV5_VMTEL1E_L2_ADDR) {
+ kfree(l2_table);
+ return -EFAULT;
+ }
+
+ tmp = virt_to_phys(l2_table) & GICV5_VMTEL1E_L2_ADDR;
+ WRITE_ONCE(vmt_info->l2.vmt_base[l1_index], cpu_to_le64(tmp));
+
+ vgic_v5_clean_inval(l2_table, GICV5_VMT_L2_TABLE_SIZE, true, true);
+ /* Skip inval for now - wait until table is made valid by HW */
+ vgic_v5_clean_inval(vmt_info->l2.vmt_base + l1_index,
+ sizeof(vmtl1_entry), true, false);
+
+ /* VMAP in the L2 VMT via the IRS */
+ cmd_info.cmd_type = VMT_L2_MAP;
+ ret = irq_set_vcpu_affinity(vgic_v5_vpe_db(vcpu0), &cmd_info);
+
+ /* We've failed to make the L2 VMT valid - things are very broken! */
+ if (ret) {
+ /* Remove the pointer from L1 table */
+ WRITE_ONCE(vmt_info->l2.vmt_base[l1_index], 0);
+
+ kfree(l2_table);
+ vmt_info->l2.l2ptrs[l1_index] = NULL;
+
+ return ret;
+ }
+
+ /* Table updated; inval our copy */
+ vgic_v5_clean_inval(vmt_info->l2.vmt_base + l1_index,
+ sizeof(vmtl1_entry), false, true);
+
+ return ret;
+}
+
+/*
+ * Allocate the top-level VMT. This can either be linear or two-level.
+ */
+int vgic_v5_vmt_allocate(bool two_level, unsigned int num_entries,
+ size_t vmd_size, size_t vped_size,
+ unsigned int max_vpes)
+{
+ int ret = 0;
+
+ if (vgic_v5_vmt_allocated())
+ return -EBUSY;
+
+ /* VMD is optional; using 0 to signal that it not needed. */
+ if (vmd_size != 0 &&
+ (vmd_size < VMD_MIN_SIZE || vmd_size > VMD_MAX_SIZE))
+ return -EINVAL;
+
+ if (vped_size < VPED_MIN_SIZE || vped_size > VPED_MAX_SIZE)
+ return -EINVAL;
+
+ /* Allocate the tracking structure */
+ vmt_info = kzalloc_obj(*vmt_info, GFP_KERNEL);
+ if (vmt_info == NULL)
+ return -ENOMEM;
+
+ ida_init(&vmt_info->vm_id_ida);
+ vmt_info->max_vpes = max_vpes;
+ vmt_info->vmd_size = vmd_size;
+ vmt_info->vped_size = vped_size;
+ vmt_info->two_level = two_level;
+ vmt_info->num_entries = num_entries;
+
+ if (!two_level)
+ ret = vgic_v5_alloc_vmt_linear(num_entries);
+ else
+ ret = vgic_v5_alloc_vmt_two_level(num_entries);
+
+ /* If anything failed, free our tracking structure before returning */
+ if (ret) {
+ kfree(vmt_info);
+ vmt_info = NULL;
+ }
+
+ return ret;
+}
+
+/*
+ * Free the VMT and associated tracking structures. This isn't strictly expected
+ * to be called in general operation, but instead exists for completeness.
+ */
+int vgic_v5_vmt_free(void)
+{
+ if (!vgic_v5_vmt_allocated())
+ return -EINVAL;
+
+ if (!vmt_info->two_level) {
+ kfree(vmt_info->linear.vmt_base);
+ } else {
+ /* Free the L2 tables; kfree(NULL) is safe */
+ for (int i = 0; i < vmt_info->l2.num_l1_ents; ++i)
+ kfree(vmt_info->l2.l2ptrs[i]);
+ kfree(vmt_info->l2.l2ptrs);
+
+ /* And now free the L1 table */
+ kfree(vmt_info->l2.vmt_base);
+ }
+
+ ida_destroy(&vmt_info->vm_id_ida);
+ kfree(vmt_info);
+ vmt_info = NULL;
+
+ return 0;
+}
+
+/*
+ * Look up a VMT Entry by VM ID.
+ */
+static int vgic_v5_get_l2_vmte(u16 vm_id, struct vmtl2_entry **vmte)
+{
+ unsigned int l1_index, l2_index;
+ struct vmtl2_entry *l2_table;
+ int ret;
+
+ ret = vgic_v5_check_vm_id(vm_id);
+ if (ret)
+ return ret;
+
+ if (!vmt_info->two_level) {
+ /* All entries always valid for Linear table */
+ *vmte = &vmt_info->linear.vmt_base[vm_id];
+ } else {
+ l1_index = vm_id / GICV5_VMT_L2_TABLE_ENTRIES;
+ l2_index = vm_id % GICV5_VMT_L2_TABLE_ENTRIES;
+
+ if (l1_index > vmt_info->l2.num_l1_ents)
+ return -E2BIG;
+
+ if (vmt_info->l2.l2ptrs[l1_index] == NULL)
+ return -EINVAL;
+
+ l2_table = vmt_info->l2.l2ptrs[l1_index];
+ *vmte = &l2_table[l2_index];
+ }
+
+ return 0;
+}
+
+/*
+ * Zero a VMT Entry, and flush & invalidate to the PoC, if required.
+ */
+static int vgic_v5_reset_vmte(struct kvm *kvm)
+{
+ u16 vm_id = vgic_v5_vm_id(kvm);
+ struct vmtl2_entry *vmte;
+ int ret;
+
+ ret = vgic_v5_get_l2_vmte(vm_id, &vmte);
+ if (ret)
+ return ret;
+
+ WRITE_ONCE(vmte->val[0], 0ULL);
+ WRITE_ONCE(vmte->val[1], 0ULL);
+ WRITE_ONCE(vmte->val[2], 0ULL);
+ WRITE_ONCE(vmte->val[3], 0ULL);
+
+ vgic_v5_clean_inval(vmte, sizeof(*vmte), true, true);
+
+ return 0;
+}
+
+/*
+ * Use the IDA to allocate a new VM ID, and track it in the gicv5_vm data
+ * structure. If we're out of VM IDs, the IDA catches that, and we return the
+ * error (-ENOSPC).
+ */
+int vgic_v5_allocate_vm_id(struct kvm *kvm)
+{
+ int id;
+
+ id = ida_alloc_max(&vmt_info->vm_id_ida, vmt_info->num_entries - 1u,
+ GFP_KERNEL);
+ if (id < 0)
+ return id;
+
+ kvm->arch.vgic.gicv5_vm.vm_id = id;
+ kvm->arch.vgic.gicv5_vm.vm_id_valid = true;
+
+ return 0;
+}
+
+/*
+ * Release the VM ID to allow it to be reallocated in the future.
+ */
+void vgic_v5_release_vm_id(struct kvm *kvm)
+{
+ ida_free(&vmt_info->vm_id_ida, kvm->arch.vgic.gicv5_vm.vm_id);
+ kvm->arch.vgic.gicv5_vm.vm_id_valid = false;
+}
+
+/*
+ * Initialise an entry in the VMT based on the index of the VM.
+ *
+ * Note: We don't mark the VMTE as valid as this needs to be done by
+ * the hardware.
+ */
+int vgic_v5_vmte_init(struct kvm *kvm)
+{
+ int nr_cpus = atomic_read(&kvm->online_vcpus);
+ struct vgic_v5_vm_info *vmi = NULL;
+ u16 vm_id = vgic_v5_vm_id(kvm);
+ void *vmd = NULL, *vpet = NULL;
+ struct vmtl2_entry *vmte;
+ void **vped_ptrs = NULL;
+ size_t vpet_alloc_size;
+ int ret;
+ u64 tmp;
+
+ if (nr_cpus > vmt_info->max_vpes)
+ return -E2BIG;
+
+ /*
+ * If we're using two-level VMTs, L2 is allocated on demand. For linear
+ * VMTs, this is a NOP.
+ */
+ if (vgic_v5_alloc_l2_vmt(kvm))
+ return -EIO;
+
+ ret = vgic_v5_get_l2_vmte(vm_id, &vmte);
+ if (ret)
+ return ret;
+
+ /* If the entry is already valid, something went wrong */
+ if (FIELD_GET(GICV5_VMTEL2E_VALID, le64_to_cpu(READ_ONCE(vmte->val[0])))) {
+ vgic_v5_clean_inval(vmte, sizeof(*vmte), true, true);
+ return -EINVAL;
+ }
+
+ ret = vgic_v5_reset_vmte(kvm);
+ if (ret)
+ return ret;
+
+ vmi = kzalloc_objs(*vmi, GFP_KERNEL);
+ if (vmi == NULL) {
+ ret = -ENOMEM;
+ goto out_fail;
+ }
+
+ ret = xa_insert(&vm_info, vm_id, vmi, GFP_KERNEL);
+ if (ret)
+ goto out_fail;
+
+ /* Allocate and assign the VM Descriptor, if required. */
+ if (vmt_info->vmd_size != 0) {
+ vmd = kzalloc(vmt_info->vmd_size, GFP_KERNEL);
+ if (!vmd) {
+ ret = -ENOMEM;
+ goto out_fail;
+ }
+
+ /* Stash the VA so we can free it later */
+ vmi->vmd_base = vmd;
+
+ tmp = FIELD_PREP(GICV5_VMTEL2E_VMD_ADDR,
+ virt_to_phys(vmd) >>
+ GICV5_VMTEL2E_VMD_ADDR_SHIFT);
+ WRITE_ONCE(vmte->val[0], cpu_to_le64(tmp));
+ }
+
+ /*
+ * Allocate and assign the VPE Table. We can only describe the number of
+ * VPE ID Bits in the VMTE, and therefore we round up the number of CPUs
+ * to a whole power of two.
+ */
+ nr_cpus = roundup_pow_of_two(nr_cpus);
+ vmi->vpe_id_bits = fls(nr_cpus) - 1;
+
+ vpet_alloc_size = sizeof(vpe_entry) * nr_cpus;
+ vpet = kzalloc(vpet_alloc_size, GFP_KERNEL);
+ if (!vpet) {
+ ret = -ENOMEM;
+ goto out_fail;
+ }
+
+ /* Stash the VA so we can free it later */
+ vmi->vpet_base = vpet;
+
+ tmp = FIELD_PREP(GICV5_VMTEL2E_VPET_ADDR,
+ virt_to_phys(vpet) >> GICV5_VMTEL2E_VPET_ADDR_SHIFT);
+ tmp |= FIELD_PREP(GICV5_VMTEL2E_VPE_ID_BITS, vmi->vpe_id_bits);
+ WRITE_ONCE(vmte->val[1], cpu_to_le64(tmp));
+
+ vped_ptrs = kzalloc_objs(*vped_ptrs, nr_cpus, GFP_KERNEL);
+ if (vped_ptrs == NULL) {
+ ret = -ENOMEM;
+ goto out_fail;
+ }
+ vmi->vped_ptrs = vped_ptrs;
+
+ if (vmd)
+ vgic_v5_clean_inval(vmd, vmt_info->vmd_size, true, true);
+ vgic_v5_clean_inval(vpet, vpet_alloc_size, true, true);
+ vgic_v5_clean_inval(vmte, sizeof(*vmte), true, true);
+
+ kvm->arch.vgic.gicv5_vm.vmte_allocated = true;
+
+ return 0;
+
+out_fail:
+ /* kfree(NULL) is safe so we can just kfree() at leisure */
+ kfree(vmd);
+ kfree(vpet);
+ kfree(vped_ptrs);
+ if (vmi)
+ xa_erase(&vm_info, vm_id);
+ kfree(vmi);
+
+ vgic_v5_reset_vmte(kvm);
+
+ return ret;
+}
+
+/*
+ * Release the VMT Entry, freeing up any allocated data structures before
+ * zeroing the VMTE.
+ *
+ * The VMTE must be marked as invalid before it is released.
+ */
+int vgic_v5_vmte_release(struct kvm *kvm)
+{
+ u16 vm_id = vgic_v5_vm_id(kvm);
+ struct vgic_v5_vm_info *vmi;
+ struct vmtl2_entry *vmte;
+ int ret;
+
+ ret = vgic_v5_get_l2_vmte(vm_id, &vmte);
+ if (ret)
+ return ret;
+
+ /* Reject if the VMTE has not been marked as invalid! */
+ if (FIELD_GET(GICV5_VMTEL2E_VALID, le64_to_cpu(READ_ONCE(vmte->val[0])))) {
+ vgic_v5_clean_inval(vmte, sizeof(*vmte), true, true);
+ return -EINVAL;
+ }
+
+ vmi = xa_load(&vm_info, vm_id);
+ if (WARN_ON_ONCE(!vmi))
+ goto no_vmi;
+
+ kfree(vmi->vmd_base);
+ kfree(vmi->vpet_base);
+
+ xa_erase(&vm_info, vm_id);
+ kfree(vmi);
+
+no_vmi:
+ /*
+ * If we didn't get far enough into allocating a VMTE to create the VM
+ * info structure, then we just zero the VMTE and move on. There's
+ * nothing else we can realistically do here.
+ */
+ ret = vgic_v5_reset_vmte(kvm);
+ if (ret)
+ return ret;
+
+ return 0;
+}
+
+/*
+ * Allocate a VPE descriptor and provide it to the hardware via the VPE Table.
+ */
+int vgic_v5_vmte_alloc_vpe(struct kvm_vcpu *vcpu)
+{
+ u16 vm_id = vgic_v5_vm_id(vcpu->kvm);
+ u16 vpe_id = vgic_v5_vpe_id(vcpu);
+ struct vgic_v5_vm_info *vmi;
+ vpe_entry tmp, *vpet_base;
+ void *vped;
+
+ /* Make sure we're not over what the hardware supports */
+ if (vpe_id >= vmt_info->max_vpes)
+ return -E2BIG;
+
+ vmi = xa_load(&vm_info, vm_id);
+ if (WARN_ON_ONCE(!vmi))
+ return -EINVAL;
+
+ if (vpe_id >= 1 << vmi->vpe_id_bits)
+ return -E2BIG;
+
+ vpet_base = vmi->vpet_base;
+
+ /* If the VPETE for this CPU is already valid we've gone wrong */
+ if (FIELD_GET(GICV5_VPE_VALID, le64_to_cpu(READ_ONCE(vpet_base[vpe_id])))) {
+ vgic_v5_clean_inval(&vpet_base[vpe_id], sizeof(*vpet_base), true, true);
+ return -EBUSY;
+ }
+
+ /* Alloc VPE Descriptor. Only used by IRS. */
+ vped = kzalloc(vmt_info->vped_size, GFP_KERNEL);
+ if (vped == NULL)
+ return -ENOMEM;
+
+ vmi->vped_ptrs[vpe_id] = vped;
+
+ tmp = FIELD_PREP(GICV5_VPED_ADDR, virt_to_phys(vped) >> GICV5_VPED_ADDR_SHIFT);
+ WRITE_ONCE(vpet_base[vpe_id], cpu_to_le64(tmp));
+
+ vgic_v5_clean_inval(vped, vmt_info->vped_size, true, true);
+ vgic_v5_clean_inval(vpet_base + vpe_id, sizeof(vpe_entry), true, true);
+
+ return 0;
+}
+
+/*
+ * Free the memory allocated for the VPE descriptor.
+ */
+int vgic_v5_vmte_free_vpe(struct kvm_vcpu *vcpu)
+{
+ u16 vm_id = vgic_v5_vm_id(vcpu->kvm);
+ u16 vpe_id = vgic_v5_vpe_id(vcpu);
+ struct vgic_v5_vm_info *vmi;
+ struct vmtl2_entry *vmte;
+ vpe_entry *vpet_base;
+ void *vped;
+ int ret;
+
+ ret = vgic_v5_get_l2_vmte(vm_id, &vmte);
+ if (ret)
+ return ret;
+
+ if (FIELD_GET(GICV5_VMTEL2E_VALID, le64_to_cpu(READ_ONCE(vmte->val[0])))) {
+ vgic_v5_clean_inval(vmte, sizeof(*vmte), true, true);
+ return -EBUSY;
+ }
+
+ vmi = xa_load(&vm_info, vm_id);
+ if (!vmi)
+ return -EINVAL;
+
+ if (vpe_id >= 1 << vmi->vpe_id_bits)
+ return -E2BIG;
+
+ vpet_base = vmi->vpet_base;
+ WRITE_ONCE(vpet_base[vpe_id], 0ULL);
+
+ vgic_v5_clean_inval(vpet_base + vpe_id, sizeof(vpe_entry), true, true);
+
+ /* Free VPE Descriptor. Only used by IRS. */
+ vped = vmi->vped_ptrs[vpe_id];
+ vmi->vped_ptrs[vpe_id] = NULL;
+ kfree(vped);
+
+ return 0;
+}
diff --git a/arch/arm64/kvm/vgic/vgic-v5-tables.h b/arch/arm64/kvm/vgic/vgic-v5-tables.h
index cf00a248eabd5..5501a44308362 100644
--- a/arch/arm64/kvm/vgic/vgic-v5-tables.h
+++ b/arch/arm64/kvm/vgic/vgic-v5-tables.h
@@ -8,6 +8,86 @@
#include <linux/irqchip/arm-gic-v5.h>
+#define VM_ID_BITS_MIN 8
+#define VM_ID_BITS_MAX 16
+#define VMD_MIN_SIZE 8
+#define VMD_MAX_SIZE 4096
+#define VPED_MIN_SIZE 8
+#define VPED_MAX_SIZE 4096
+#define VPE_ID_BITS_MIN 8
+#define VPE_ID_BITS_MAX 16
+
+/* Level 1 Virtual Machine Table Entry */
+typedef __le64 vmtl1_entry;
+#define GICV5_VMTEL1E_VALID BIT_ULL(0)
+/* Note that there is no shift for the address by design */
+#define GICV5_VMTEL1E_L2_ADDR GENMASK(51, 12)
+
+#define GICV5_VMTEL2E_SIZE 32ULL
+/* An L2 table (two-level VMT) is ALWAYS 4kB! */
+#define GICV5_VMT_L2_TABLE_SIZE 4096ULL
+#define GICV5_VMT_L2_TABLE_ENTRIES (GICV5_VMT_L2_TABLE_SIZE / GICV5_VMTEL2E_SIZE)
+
+/* Level 2 Virtual Machine Table Entry */
+struct vmtl2_entry {
+ __le64 val[4];
+};
+
+/*
+ * As the L2 VMTE is a large data structure, we are splitting it into 4 parts.
+ * We only mask and shift WITHIN each part for simplicity.
+ */
+/* First 64-bit chunk */
+#define GICV5_VMTEL2E_VALID BIT_ULL(0)
+#define GICV5_VMTEL2E_VMD_ADDR_SHIFT 3ULL
+#define GICV5_VMTEL2E_VMD_ADDR GENMASK_ULL(55, 3)
+/* Second 64-bit chunk */
+#define GICV5_VMTEL2E_VPET_ADDR_SHIFT 3ULL
+#define GICV5_VMTEL2E_VPET_ADDR GENMASK_ULL(55, 3)
+#define GICV5_VMTEL2E_VPE_ID_BITS GENMASK_ULL(63, 59)
+/* Third & fourth 64-bit chunks (the encodings are the same for each) */
+#define GICV5_VMTEL2E_IST_VALID BIT_ULL(0)
+#define GICV5_VMTEL2E_IST_L2SZ GENMASK_ULL(2, 1)
+#define GICV5_VMTEL2E_IST_ADDR_SHIFT 6ULL
+#define GICV5_VMTEL2E_IST_ADDR GENMASK_ULL(55, 6)
+#define GICV5_VMTEL2E_IST_ISTSZ GENMASK_ULL(57, 56)
+#define GICV5_VMTEL2E_IST_STRUCTURE BIT_ULL(58)
+#define GICV5_VMTEL2E_IST_ID_BITS GENMASK_ULL(63, 59)
+
+/* Virtual PE Table Entry */
+typedef __le64 vpe_entry;
+#define GICV5_VPE_VALID BIT_ULL(0)
+/* Note that there is no shift for the address by design. */
+#define GICV5_VPED_ADDR_SHIFT 3ULL
+#define GICV5_VPED_ADDR GENMASK_ULL(55, 3)
+
+struct vgic_v5_vm_info {
+ void __iomem *vmd_base;
+ vpe_entry __iomem *vpet_base;
+ void __iomem **vped_ptrs;
+ u8 vpe_id_bits;
+};
+
+struct vgic_v5_vmt {
+ union {
+ struct {
+ struct vmtl2_entry *vmt_base;
+ unsigned int num_ents;
+ } linear;
+ struct {
+ vmtl1_entry *vmt_base;
+ struct vmtl2_entry **l2ptrs;
+ unsigned int num_l1_ents;
+ } l2;
+ };
+ bool two_level;
+ unsigned int num_entries;
+ unsigned int max_vpes;
+ size_t vmd_size;
+ size_t vped_size;
+ struct ida vm_id_ida;
+};
+
struct vgic_v5_host_ist_caps {
/* IST Capabilities */
@@ -38,4 +118,32 @@ static inline struct vgic_v5_host_ist_caps *vgic_v5_host_caps(void)
return &gicv5_host_ist_caps;
}
+static inline u16 vgic_v5_vm_id(struct kvm *kvm)
+{
+ return kvm->arch.vgic.gicv5_vm.vm_id;
+}
+
+static inline u16 vgic_v5_vpe_id(struct kvm_vcpu *vcpu)
+{
+ return vcpu->vcpu_id;
+}
+
+static inline int vgic_v5_vpe_db(struct kvm_vcpu *vcpu)
+{
+ return vcpu->arch.vgic_cpu.vgic_v5.gicv5_vpe.db;
+}
+
+int vgic_v5_vmt_allocate(bool two_level, unsigned int num_entries,
+ size_t vmd_size, size_t vped_size,
+ unsigned int vpe_id_bits);
+int vgic_v5_vmt_free(void);
+
+int vgic_v5_allocate_vm_id(struct kvm *kvm);
+void vgic_v5_release_vm_id(struct kvm *kvm);
+
+int vgic_v5_vmte_init(struct kvm *kvm);
+int vgic_v5_vmte_release(struct kvm *kvm);
+int vgic_v5_vmte_alloc_vpe(struct kvm_vcpu *vcpu);
+int vgic_v5_vmte_free_vpe(struct kvm_vcpu *vcpu);
+
#endif
diff --git a/include/kvm/arm_vgic.h b/include/kvm/arm_vgic.h
index 05dbd01f6fd21..0bcbc751593cc 100644
--- a/include/kvm/arm_vgic.h
+++ b/include/kvm/arm_vgic.h
@@ -372,6 +372,8 @@ struct vgic_v5_vm {
int vpe_db_base;
int nr_vpes;
u16 vm_id;
+ bool vm_id_valid;
+ bool vmte_allocated;
};
struct vgic_dist {
diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
index 087d94f739672..89579ee04f5d1 100644
--- a/include/linux/irqchip/arm-gic-v5.h
+++ b/include/linux/irqchip/arm-gic-v5.h
@@ -182,6 +182,7 @@
#define GICV5_IRS_MAP_L2_ISTR_ID GENMASK(23, 0)
#define GICV5_ISTL1E_VALID BIT_ULL(0)
+#define GICV5_IRS_ISTL1E_SIZE 8UL
#define GICV5_ISTL1E_L2_ADDR_MASK GENMASK_ULL(55, 12)
@@ -444,4 +445,16 @@ void gicv5_free_lpi(u32 lpi);
void __init gicv5_its_of_probe(struct device_node *parent);
void __init gicv5_its_acpi_probe(void);
+
+enum gicv5_vcpu_info_cmd_type {
+ VMT_L2_MAP, /* Map in a L2 VMT - *may* happen on VM init */
+ VMTE_MAKE_VALID, /* Make the VMTE valid */
+ VMTE_MAKE_INVALID, /* Make the VMTE (et al.) invalid */
+};
+
+struct gicv5_cmd_info {
+ enum gicv5_vcpu_info_cmd_type cmd_type;
+ u64 data;
+};
+
#endif
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox