* [PATCH v2 0/3] Add support for NetCube Systems OpenNMC (dobermann)
From: Lukas Schmid @ 2026-06-05 19:13 UTC (permalink / raw)
To: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Chen-Yu Tsai,
Jernej Skrabec, Samuel Holland, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Maxime Ripard
Cc: Lukas Schmid, devicetree, linux-arm-kernel, linux-sunxi,
linux-kernel, linux-riscv
This series adds support for the NetCube Systems OpenNMC
Changes in v2:
- fixed ordering of compatible enum
- fixed gpio line names
Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>
---
Lukas Schmid (3):
dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann)
riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube
Systems OpenNMC
ARM: dts: sunxi: add support for NetCube Systems OpenNMC (dobermann)
.../devicetree/bindings/arm/sunxi.yaml | 1 +
.../sun8i-t113s-netcube-dobermann.dts | 149 ++++++++++++++++++
.../boot/dts/allwinner/sunxi-d1s-t113.dtsi | 6 +
3 files changed, 156 insertions(+)
create mode 100644 arch/arm/boot/dts/allwinner/sun8i-t113s-netcube-dobermann.dts
--
2.47.3
^ permalink raw reply
* [PATCH v2 2/3] riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC
From: Lukas Schmid @ 2026-06-05 19:13 UTC (permalink / raw)
To: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Chen-Yu Tsai,
Jernej Skrabec, Samuel Holland, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Maxime Ripard
Cc: Lukas Schmid, devicetree, linux-arm-kernel, linux-sunxi,
linux-kernel, linux-riscv
In-Reply-To: <20260605191322.1920944-1-lukas.schmid@netcube.li>
Added the "uart4_pb_pins" pinctrl used by the OpenNMC
Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>
---
arch/riscv/boot/dts/allwinner/sunxi-d1s-t113.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/riscv/boot/dts/allwinner/sunxi-d1s-t113.dtsi b/arch/riscv/boot/dts/allwinner/sunxi-d1s-t113.dtsi
index 82cc85acccb1..00fddedfa36f 100644
--- a/arch/riscv/boot/dts/allwinner/sunxi-d1s-t113.dtsi
+++ b/arch/riscv/boot/dts/allwinner/sunxi-d1s-t113.dtsi
@@ -191,6 +191,12 @@ uart3_pb_pins: uart3-pb-pins {
pins = "PB6", "PB7";
function = "uart3";
};
+
+ /omit-if-no-ref/
+ uart4_pb_pins: uart4-pb-pins {
+ pins = "PB2", "PB3";
+ function = "uart4";
+ };
};
ccu: clock-controller@2001000 {
--
2.47.3
^ permalink raw reply related
* [PATCH v2 3/3] ARM: dts: sunxi: add support for NetCube Systems OpenNMC (dobermann)
From: Lukas Schmid @ 2026-06-05 19:13 UTC (permalink / raw)
To: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Chen-Yu Tsai,
Jernej Skrabec, Samuel Holland, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Maxime Ripard
Cc: Lukas Schmid, devicetree, linux-arm-kernel, linux-sunxi,
linux-kernel, linux-riscv
In-Reply-To: <20260605191322.1920944-1-lukas.schmid@netcube.li>
NetCube Systems OpenNMC is an open replacement for APC SmartSlot Management
Cards. It is based on the Nagami System-on-Module. It breaks out the
following interfaces:
- 10/100 Mbps Ethernet
- USB Type-C OTG using a TUSB320 (usb0)
- USB Type-C Console Port using a CH340 (uart3)
- USB Type-A Host with internal CH334 USB-Hub (usb1)
- MicroSD Slot with Card-Detect (mmc0)
- WiFi/Bluetooth using the modules built-in ESP32
- SmartSlot serial interface (uart4)
- DS3232 RTC with CR1220 Battery Backup
- Extension connector providing SPI,I2C,USB,CAN,UART for future use.
Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>
---
.../sun8i-t113s-netcube-dobermann.dts | 149 ++++++++++++++++++
1 file changed, 149 insertions(+)
create mode 100644 arch/arm/boot/dts/allwinner/sun8i-t113s-netcube-dobermann.dts
diff --git a/arch/arm/boot/dts/allwinner/sun8i-t113s-netcube-dobermann.dts b/arch/arm/boot/dts/allwinner/sun8i-t113s-netcube-dobermann.dts
new file mode 100644
index 000000000000..d7765caffe2a
--- /dev/null
+++ b/arch/arm/boot/dts/allwinner/sun8i-t113s-netcube-dobermann.dts
@@ -0,0 +1,149 @@
+// SPDX-License-Identifier: (GPL-2.0+ OR MIT)
+/*
+ * Copyright (C) 2026 Lukas Schmid <lukas.schmid@netcube.li>
+ */
+
+/dts-v1/;
+#include "sun8i-t113s-netcube-nagami.dtsi"
+
+#include <dt-bindings/leds/common.h>
+
+/ {
+ model = "NetCube Systems OpenNMC (dobermann)";
+ compatible = "netcube,dobermann", "netcube,nagami",
+ "allwinner,sun8i-t113s";
+
+ aliases {
+ serial2 = &uart4; // UART on SmartSlot
+ rtc0 = &ds3232;
+ rtc1 = &rtc; // not battery backed
+ };
+
+ leds {
+ compatible = "gpio-leds";
+
+ led_heartbeat_green: led-heartbeat-green {
+ gpios = <&pio 6 14 GPIO_ACTIVE_HIGH>; /* PG14 */
+ linux,default-trigger = "heartbeat";
+ color = <LED_COLOR_ID_GREEN>;
+ function = LED_FUNCTION_HEARTBEAT;
+ };
+ };
+};
+
+&ehci0 {
+ status = "okay";
+};
+
+&ehci1 {
+ status = "okay";
+};
+
+&i2c2 {
+ status = "okay";
+
+ tusb320: typec@60 {
+ compatible = "ti,tusb320";
+ reg = <0x60>;
+ interrupts-extended = <&pio 3 22 IRQ_TYPE_LEVEL_LOW>; /* PD22 */
+ };
+
+ ds3232: rtc@68 {
+ compatible = "dallas,ds3232";
+ reg = <0x68>;
+ };
+};
+
+/* microSD Card Slot on the board */
+&mmc0 {
+ vmmc-supply = <®_vcc3v3>;
+ disable-wp;
+ bus-width = <4>;
+ cd-gpios = <&pio 6 15 GPIO_ACTIVE_LOW>; /* PG15 */
+ status = "okay";
+};
+
+&ohci0 {
+ status = "okay";
+};
+
+&ohci1 {
+ status = "okay";
+};
+
+&pio {
+ gpio-line-names = "", "", "", "", // PA
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "SMART_TX", "SMART_RX", // PB
+ "EXT_IO3", "EXT_IO2", "CONSOLE_TX", "CONSOLE_RX",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "eMMC_CLK", "eMMC_CMD", // PC
+ "eMMC_D2", "eMMC_D1", "eMMC_D0", "eMMC_D3",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "", // PD
+ "", "", "", "",
+ "", "USB_SEC_EN", "EXT_SPI_nCS", "EXT_SPI_SCK",
+ "EXT_SPI_MOSI", "EXT_SPI_MISO", "EXT_IO5", "EXT_IO4",
+ "SMART_SEL", "", "", "",
+ "I2C2_SCL", "I2C2_SDA", "TUSB320_nINT", "",
+ "", "", "", "",
+ "", "", "", "",
+ "ETH_CRSDV", "ETH_RXD0", "ETH_RXD1", "ETH_TXCK", // PE
+ "ETH_TXD0", "ETH_TXD1", "ETH_TXEN", "",
+ "ETH_MDC", "ETH_MDIO", "I2C3_nINT", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "uSD_D1", "uSD_D0", "uSD_CLK", "uSD_CMD", // PF
+ "uSD_D3", "uSD_D2", "TUSB320_ID", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "ESP_CLK", "ESP_CMD", "ESP_D0", "ESP_D1", // PG
+ "ESP_D2", "ESP_D3", "ESP_TXD", "ESP_RXD",
+ "ESP_nBOOT", "ESP_nRST", "I2C3_SCL", "I2C3_SDA",
+ "EXT_IO1", "EXT_IO0", "LED_HEARTBEAT", "SD_DETECT",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "",
+ "", "", "", "";
+};
+
+/* SmartSlot serial */
+&uart4 {
+ pinctrl-0 = <&uart4_pb_pins>;
+ pinctrl-names = "default";
+ status = "okay";
+};
+
+&usb_otg {
+ extcon = <&tusb320 0>;
+ dr_mode = "otg";
+ status = "okay";
+};
+
+&usbphy {
+ usb0_id_det-gpios = <&pio 5 6 GPIO_ACTIVE_HIGH>; /* PF6 */
+ status = "okay";
+};
--
2.47.3
^ permalink raw reply related
* [PATCH v2 1/3] dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann)
From: Lukas Schmid @ 2026-06-05 19:13 UTC (permalink / raw)
To: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Chen-Yu Tsai,
Jernej Skrabec, Samuel Holland, Paul Walmsley, Palmer Dabbelt,
Albert Ou, Alexandre Ghiti, Maxime Ripard
Cc: Lukas Schmid, devicetree, linux-arm-kernel, linux-sunxi,
linux-kernel, linux-riscv
In-Reply-To: <20260605191322.1920944-1-lukas.schmid@netcube.li>
The OpenNMC is an open replacement for APC SmartSlot management cards
based on the Nagami System-on-Module.
Signed-off-by: Lukas Schmid <lukas.schmid@netcube.li>
---
Documentation/devicetree/bindings/arm/sunxi.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/arm/sunxi.yaml b/Documentation/devicetree/bindings/arm/sunxi.yaml
index e6443c266fa1..077b65507645 100644
--- a/Documentation/devicetree/bindings/arm/sunxi.yaml
+++ b/Documentation/devicetree/bindings/arm/sunxi.yaml
@@ -598,6 +598,7 @@ properties:
- description: NetCube Systems Nagami SoM based boards
items:
- enum:
+ - netcube,dobermann
- netcube,nagami-basic-carrier
- netcube,nagami-keypad-carrier
- const: netcube,nagami
--
2.47.3
^ permalink raw reply related
* Re: [PATCH v4 18/24] iommu/arm-smmu-v3: Introduce master->ats_broken flag
From: Jason Gunthorpe @ 2026-06-05 19:42 UTC (permalink / raw)
To: Nicolin Chen
Cc: Will Deacon, Robin Murphy, Joerg Roedel, Bjorn Helgaas,
Rafael J . Wysocki, Len Brown, Pranjal Shrivastava, Mostafa Saleh,
Lu Baolu, Kevin Tian, linux-arm-kernel, iommu, linux-kernel,
linux-acpi, linux-pci, vsethi, Shuai Xue
In-Reply-To: <ah5txKCvspL8zMeG@Asurada-Nvidia>
On Mon, Jun 01, 2026 at 10:44:36PM -0700, Nicolin Chen wrote:
> On Mon, Jun 01, 2026 at 09:15:47PM -0300, Jason Gunthorpe wrote:
> > On Mon, Jun 01, 2026 at 01:41:26PM -0700, Nicolin Chen wrote:
> > > On Mon, Jun 01, 2026 at 09:32:31AM -0300, Jason Gunthorpe wrote:
> > > > On Fri, May 29, 2026 at 06:27:40PM -0700, Nicolin Chen wrote:
> > > > > On Tue, May 19, 2026 at 09:06:58AM -0300, Jason Gunthorpe wrote:
> > > > > > On Mon, May 18, 2026 at 08:39:01PM -0700, Nicolin Chen wrote:
> > > > > So I've tried INV_TYPE_ATS_BROKEN: during per-domain invalidation,
> > > > > each batch is built from domain->invs so it can carry the "invs";
> > > > > if the batch times out, we can immediately mutate its ATS entries.
> > > > >
> > > > > But I realized a limitation. E.g., if a device attaches to two SVA
> > > > > domains on two SSIDs. An invalidation timing out on one of the SVA
> > > > > domains could mark INV_TYPE_ATS_BROKEN in its own invs, but not in
> > > > > the other SVA domain's invs?
> > > >
> > > > You'd have to mark all the S1's sharing the STE.
> > >
> > > That would be a bit convoluted as we would have to go through all
> > > other domains' invs arrays.
> >
> > Ok, that is certainly an annoying problem.
> >
> > I don't have a better idea than storing the master unfortunately
> >
> > But I think the locking for that is going to be tricky, I'm not sure it does
> > actually fully work..
>
> Yes, there can be a race that sets STE.EATS back while per-master
> flag is set, which would skip the ATC_INV in commit(), so no more
> ATC_INV timeout that resets STE.EATS=0. To close it, we can force
> STE.EATS=0 at the end of commit() when state->ats_enabled and the
> per-master flag are both set, which is only possible in a race.
I don't see any of these options as appealing. We have to maintain a
few key invariants, and I think it cannot be done without a way to
find all the domains that are using the STE.
One way or another you have to be using the invs list rw locks to
synchronize the EATS state changes.
It is okayish to be sloppy when turning EATS off, but when turning it
back on we do need to cycle through every invs list and toggle its
lock to ensure that the invalidations are synchronized before
EATS=enable happens.
Given you must have a way to go from STE -> master -> all invs lists
I'm not sure either option really makes such a large difference.
If so then adjusting the invs to disable the ATS is pretty simple, run
over the xarray and set them all off. Yes you could find the master
through a SID lookup with some locking adjustment.
>
> (1) Per-invs marker: INV_TYPE_ATS_BROKEN + master_domains
> disable_ats() in the timeout path walks master->master_domains
> and flips matching ATS invs entries to the BROKEN type.
>
> + invs walker is free (one case label in the existing type switch).
> + No lock or pointer deref in the invs walker.
> + No master pointer stored in invs; no lifetime concern.
>
> - disable_ats() walks every (master, domain) and marks each invs
> set; the list needs locking usable from atomic.
This doesn't seem so bad
> (2) Per-master flag + streams_lock
> invs walker resolves SID -> master via streams_lock and reads
> master->ats_broken.
>
> + Single source of truth on the master.
> + disable_ats() is one WRITE_ONCE.
> + atc_inv_master early-skips via one READ_ONCE.
> + attach gates ats_enabled on the flag; a concurrent quarantine
> race can be closed by a short post-attach re-check in commit()
> + No master pointer in invs; no lifetime concern.
>
> - invs walker pays streams_lock + rb_find(SID) per ATS entry on
> every invalidation. Measurable on ATS-heavy workloads.
Doesn't consider how to enable
> (3) Per-master flag + inv->master pointer (v4)
> invs entry carries a master pointer; the invs walker reads
> cur->master->ats_broken directly.
>
> + invs walker is one READ_ONCE through a cached pointer.
> + disable_ats is one WRITE_ONCE.
> + atc_inv_master early-skip via one READ_ONCE.
> + attach gate + post-attach re-check, same as (2).
>
> - invs holds a master ptr, so release_device must synchronize_rcu()
> before freeing the master to drain walkers under rcu_read_lock().
> We dropped this from v4 for that reason.
synchronize_rcu is not right because you have to have gone through the
rwlock so there can be no readers.
Jason
^ permalink raw reply
* Re: [PATCH 3/4] arm64: wire SDEI NMI into the hardlockup watchdog
From: Doug Anderson @ 2026-06-05 20:03 UTC (permalink / raw)
To: Kiryl Shutsemau
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel, Kiryl Shutsemau (Meta)
In-Reply-To: <6172eafcb9de6e626c0f1c36426d67e1e562ed32.1780496779.git.kas@kernel.org>
Hi,
On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
>
> From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
>
> Select HAVE_HARDLOCKUP_DETECTOR_ARCH so the framework takes its backend
> from this driver. A per-CPU hrtimer checks its buddy's heartbeat and
> signals event 0 at a stalled CPU, which runs watchdog_hardlockup_check()
> NMI-like.
>
> The source is chosen at boot: SDEI if firmware provides it, otherwise a
> perf-NMI counter (pseudo-NMI) fallback -- one image covers both.
>
> Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> ---
> arch/arm64/Kconfig | 1 +
> drivers/firmware/Kconfig | 3 +
> drivers/firmware/sdei_nmi.c | 247 +++++++++++++++++++++++++++++++++++-
> 3 files changed, 248 insertions(+), 3 deletions(-)
I'm a little confused about this patch. We already have a buddy
hardlockup detector using the hrtimer, and it's even been improved
recently to trigger in a smaller time bound. It looks as if you're
duplicating bits of the perf and buddy detector here?
I don't think you need this patch at all. The existing buddy detector
+ patches #1 and #2 in your series should be sufficient.
Did I misunderstand?
-Doug
^ permalink raw reply
* [PATCH 1/3] soc: samsung: exynos-pmu: use target cpu ID in hotplug callbacks
From: Alexey Klimov @ 2026-06-05 20:18 UTC (permalink / raw)
To: Krzysztof Kozlowski, Alim Akhtar, Peter Griffin
Cc: Sam Protsenko, linux-samsung-soc, linux-arm-kernel, linux-kernel,
stable, Sashiko
In-Reply-To: <20260605-exynos-pmu-cpuhp-idle-fixes-v1-0-0cd05c81a82d@linaro.org>
The CPU hotplug state callbacks __gs101_cpu_pmu_online() and
__gs101_cpu_pmu_offline() currently partially use smp_processor_id() to
determine the target register offset for the CPU inform hints. This may
be fine for cpuidle flow but broken for cpu hotplug where the target
cpu is passed as an argument and could be different from cpu where
that is executing (e.g. CPU 0 offlining CPU 1), meaning that
smp_processor_id() returns the id of local CPU but hotplug flow
deals with another CPU core undergoing the transition.
This causes the pmu driver to write power down and power on configuration
hints to the wrong hardware registers, messing up the power state of active
cores and failing to configure the target core. Fix this by removing the
cpuhint variable entirely and utilizing the target 'cpu' argument passed
to the callbacks by the hotplug core infrastructure.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 598995027b91 ("soc: samsung: exynos-pmu: enable CPU hotplug support for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
drivers/soc/samsung/exynos-pmu.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index d58376c38179..6e635872247a 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -235,11 +235,10 @@ EXPORT_SYMBOL_GPL(exynos_get_pmu_regmap_by_phandle);
static int __gs101_cpu_pmu_online(unsigned int cpu)
__must_hold(&pmu_context->cpupm_lock)
{
- unsigned int cpuhint = smp_processor_id();
u32 reg, mask;
/* clear cpu inform hint */
- regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
+ regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpu),
CPU_INFORM_CLEAR);
mask = BIT(cpu);
@@ -296,12 +295,10 @@ static int gs101_cpuhp_pmu_online(unsigned int cpu)
static int __gs101_cpu_pmu_offline(unsigned int cpu)
__must_hold(&pmu_context->cpupm_lock)
{
- unsigned int cpuhint = smp_processor_id();
u32 reg, mask;
/* set cpu inform hint */
- regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpuhint),
- CPU_INFORM_C2);
+ regmap_write(pmu_context->pmureg, GS101_CPU_INFORM(cpu), CPU_INFORM_C2);
mask = BIT(cpu);
regmap_update_bits(pmu_context->pmuintrgen, GS101_GRP2_INTR_BID_ENABLE,
--
2.51.0
^ permalink raw reply related
* [PATCH 0/3] Exynos PMU fixes for cpu hotplug and cpuidle routines
From: Alexey Klimov @ 2026-06-05 20:18 UTC (permalink / raw)
To: Krzysztof Kozlowski, Alim Akhtar, Peter Griffin
Cc: Sam Protsenko, linux-samsung-soc, linux-arm-kernel, linux-kernel,
stable, Sashiko
This was reported by Sashiko here:
https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
and was mainly introduced by enabling cpu hotplug
support and cpuidle for gs101-based SoCs.
One patch removes strange usage of smp_processor_id() and
other patches deal with a few missing error paths issues
here and there in setup_cpuhp_and_cpuidle() and around.
Tested on gs101-raven device, I don't see any regressions
but testing from others will be appreciated.
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
Alexey Klimov (3):
soc: samsung: exynos-pmu: use target cpu ID in hotplug callbacks
soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup
drivers/soc/samsung/exynos-pmu.c | 75 ++++++++++++++++++++++++++++++++--------
1 file changed, 60 insertions(+), 15 deletions(-)
---
base-commit: e98d21c170b01ddef366f023bbfcf6b31509fa83
change-id: 20260605-exynos-pmu-cpuhp-idle-fixes-32f5ed7c969f
Best regards,
--
Alexey Klimov <alexey.klimov@linaro.org>
^ permalink raw reply
* [PATCH 3/3] soc: samsung: exynos-pmu: fix error paths in cpuhotplug/idle states setup
From: Alexey Klimov @ 2026-06-05 20:18 UTC (permalink / raw)
To: Krzysztof Kozlowski, Alim Akhtar, Peter Griffin
Cc: Sam Protsenko, linux-samsung-soc, linux-arm-kernel, linux-kernel,
stable, Sashiko
In-Reply-To: <20260605-exynos-pmu-cpuhp-idle-fixes-v1-0-0cd05c81a82d@linaro.org>
The setup_cpuhp_and_cpuidle() initialisation sequence currently ignores
the return values of cpuhp_setup_state(), cpu_pm_register_notifier(), and
register_reboot_notifier(). If any of these registrations fail during
probe() routine, the driver returns 0, leaving the driver partially
configured.
Furthermore, if anything after setup_cpuhp_and_cpuidle() fails in probe()
routine, for instance devm_mfd_add_devices(), the probe() lacks an error
path and leaves notifiers and cpu hotplug states registered.
Introduce variables for the cpu hotplug state IDs in exynos_pmu_context
struct, that should be initialised to CPUHP_INVALID by default. Check all
return codes in setup_cpuhp_and_cpuidle(), and add an error path to remove
registered states on failure. Finally, add destroy_cpuhp_and_cpuidle()
helper to safely tear down notifiers and cpu hotplug states.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
drivers/soc/samsung/exynos-pmu.c | 57 ++++++++++++++++++++++++++++++++++------
1 file changed, 49 insertions(+), 8 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 9636287f6794..846313a28e9a 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -38,6 +38,8 @@ struct exynos_pmu_context {
unsigned long *in_cpuhp;
bool sys_insuspend;
bool sys_inreboot;
+ int cpuhp_prepare_state;
+ int cpuhp_online_state;
};
void __iomem *pmu_base_addr;
@@ -404,6 +406,17 @@ static struct notifier_block exynos_cpupm_reboot_nb = {
.notifier_call = exynos_cpupm_reboot_notifier,
};
+static void destroy_cpuhp_and_cpuidle(void)
+{
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+ unregister_reboot_notifier(&exynos_cpupm_reboot_nb);
+
+ if (pmu_context->cpuhp_prepare_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ if (pmu_context->cpuhp_online_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
+}
+
static int setup_cpuhp_and_cpuidle(struct device *dev)
{
struct device_node *intr_gen_node;
@@ -465,16 +478,42 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
gs101_cpuhp_pmu_online(cpu);
/* register CPU hotplug callbacks */
- cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
- gs101_cpuhp_pmu_online, NULL);
+ pmu_context->cpuhp_prepare_state = CPUHP_INVALID;
+ pmu_context->cpuhp_online_state = CPUHP_INVALID;
- cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
- NULL, gs101_cpuhp_pmu_offline);
+ ret = cpuhp_setup_state(CPUHP_BP_PREPARE_DYN, "soc/exynos-pmu:prepare",
+ gs101_cpuhp_pmu_online, NULL);
+ if (ret < 0)
+ return ret;
+
+ pmu_context->cpuhp_prepare_state = ret;
+
+ ret = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "soc/exynos-pmu:online",
+ NULL, gs101_cpuhp_pmu_offline);
+ if (ret < 0)
+ goto clean_cpuhp_states;
+
+ pmu_context->cpuhp_online_state = ret;
/* register CPU PM notifiers for cpuidle */
- cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
- register_reboot_notifier(&exynos_cpupm_reboot_nb);
- return 0;
+ ret = cpu_pm_register_notifier(&gs101_cpu_pm_notifier);
+ if (ret)
+ goto clean_cpuhp_states;
+
+ ret = register_reboot_notifier(&exynos_cpupm_reboot_nb);
+ if (!ret)
+ /* Success */
+ return ret;
+
+ cpu_pm_unregister_notifier(&gs101_cpu_pm_notifier);
+
+clean_cpuhp_states:
+ if (pmu_context->cpuhp_prepare_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_prepare_state);
+ if (pmu_context->cpuhp_online_state != CPUHP_INVALID)
+ cpuhp_remove_state(pmu_context->cpuhp_online_state);
+
+ return ret;
}
static int exynos_pmu_probe(struct platform_device *pdev)
@@ -548,8 +587,10 @@ static int exynos_pmu_probe(struct platform_device *pdev)
ret = devm_mfd_add_devices(dev, PLATFORM_DEVID_NONE, exynos_pmu_devs,
ARRAY_SIZE(exynos_pmu_devs), NULL, 0, NULL);
- if (ret)
+ if (ret) {
+ destroy_cpuhp_and_cpuidle();
return ret;
+ }
if (devm_of_platform_populate(dev))
dev_err(dev, "Error populating children, reboot and poweroff might not work properly\n");
--
2.51.0
^ permalink raw reply related
* [PATCH 2/3] soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node
From: Alexey Klimov @ 2026-06-05 20:18 UTC (permalink / raw)
To: Krzysztof Kozlowski, Alim Akhtar, Peter Griffin
Cc: Sam Protsenko, linux-samsung-soc, linux-arm-kernel, linux-kernel,
stable, Sashiko
In-Reply-To: <20260605-exynos-pmu-cpuhp-idle-fixes-v1-0-0cd05c81a82d@linaro.org>
The setup_cpuhp_and_cpuidle() parses the device tree node for the
interrupt generation block via of_parse_phandle() and decrements its
reference count using of_node_put() immediately after fetching the resource
address. However, later the intr_gen_node pointer is passed into
of_syscon_register_regmap().
Fix this by moving the of_node_put() invocation to after the
of_syscon_register_regmap() call, and adding it to correct error paths.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260513-exynos850-cpuhotplug-v4-0-54fec5f65362@linaro.org?part=3
Fixes: 78b72897a5c8 ("soc: samsung: exynos-pmu: Enable CPU Idle for gs101")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
---
drivers/soc/samsung/exynos-pmu.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/samsung/exynos-pmu.c b/drivers/soc/samsung/exynos-pmu.c
index 6e635872247a..9636287f6794 100644
--- a/drivers/soc/samsung/exynos-pmu.c
+++ b/drivers/soc/samsung/exynos-pmu.c
@@ -428,23 +428,30 @@ static int setup_cpuhp_and_cpuidle(struct device *dev)
* syscon provided regmap.
*/
ret = of_address_to_resource(intr_gen_node, 0, &intrgen_res);
- of_node_put(intr_gen_node);
+ if (ret) {
+ of_node_put(intr_gen_node);
+ return ret;
+ }
virt_addr = devm_ioremap(dev, intrgen_res.start,
resource_size(&intrgen_res));
- if (!virt_addr)
+ if (!virt_addr) {
+ of_node_put(intr_gen_node);
return -ENOMEM;
+ }
pmu_context->pmuintrgen = devm_regmap_init_mmio(dev, virt_addr,
®map_pmu_intr);
if (IS_ERR(pmu_context->pmuintrgen)) {
dev_err(dev, "failed to initialize pmu-intr-gen regmap\n");
+ of_node_put(intr_gen_node);
return PTR_ERR(pmu_context->pmuintrgen);
}
/* register custom mmio regmap with syscon */
ret = of_syscon_register_regmap(intr_gen_node,
pmu_context->pmuintrgen);
+ of_node_put(intr_gen_node);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related
* Re: [PATCH 4/4] arm64: route crash_smp_send_stop() last resort through SDEI
From: Doug Anderson @ 2026-06-05 20:42 UTC (permalink / raw)
To: Kiryl Shutsemau
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel, Kiryl Shutsemau (Meta)
In-Reply-To: <54cb99db3c981dc39eb3031aff5caeaadb09e8b9.1780496779.git.kas@kernel.org>
Hi,
On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
>
> @@ -1288,8 +1288,32 @@ void crash_smp_send_stop(void)
> return;
> crash_stop = 1;
>
> + /*
> + * Stop the normal way first: IPI_CPU_STOP escalating to a pseudo-NMI
> + * IPI. Every CPU that responds saves its state via crash_save_cpu()
> + * and parks in cpu_park_loop() with its online bit cleared -- the
> + * standard kdump stop, identical to a kernel without SDEI. Crucially
> + * those CPUs stay in a clean, potentially-reusable state.
> + */
> smp_send_stop();
>
> + /*
> + * Whatever is still online didn't respond -- typically a CPU wedged
> + * with interrupts masked. The plain IPI can't reach it, and a fleet
> + * that declines the pseudo-NMI hot-path cost has no NMI IPI to
> + * escalate to. Hit only the survivors with the SDEI cross-CPU NMI
> + * (no-op if SDEI isn't active, or if everything already stopped):
> + * firmware delivers out of EL3 regardless of PSTATE.DAIF, and the
> + * handler captures crash_save_cpu() state from the wedged context
> + * before parking the CPU.
> + *
> + * SDEI is deliberately last: an SDEI-stopped CPU never completes its
> + * event (it parks inside the handler, so EL3 retains its dispatch
> + * slot until reset), which is strictly less recoverable than a normal
> + * stop. We pay that only for CPUs that left no other way to reach them.
> + */
> + sdei_nmi_crash_smp_send_stop();
It feels weird to me that you're adding SDEI for "crash stop" but not
for regular "stop". It feels like you should modify smp_send_stop() to
fall back to SDEI if sending the NMI failed, instead of adding this
separate path.
> static int sdei_nmi_handler(u32 event, struct pt_regs *regs, void *arg)
> {
> + int cpu = smp_processor_id();
> +
> + if (READ_ONCE(*this_cpu_ptr(&sdei_nmi_crash_stop_requested))) {
> + WRITE_ONCE(*this_cpu_ptr(&sdei_nmi_crash_stop_requested), 0);
> +
> + /*
> + * Capture the wedged context for kdump while pt_regs still
> + * points at the interrupted PC. This is the main motivation
> + * for using SDEI here: the plain IPI stop path can't reach an
> + * interrupt-masked CPU (and the fleet declines pseudo-NMI to
> + * keep the IRQ-mask hot path cheap), so crash_save_cpu() for
> + * that CPU would otherwise record nothing useful.
> + */
> + crash_save_cpu(regs, cpu);
> + set_cpu_online(cpu, false);
> +
> + /* publish the crash state/offline before the requester sees the ack */
> + smp_wmb();
> + WRITE_ONCE(*this_cpu_ptr(&sdei_nmi_crash_stop_acked), 1);
> +
> + /*
> + * Park forever from within the SDEI handler. We deliberately
> + * do NOT issue SDEI_EVENT_COMPLETE: the framework's return
> + * path restores firmware's saved interrupted context, which
> + * would land the CPU back wherever it was running (often
> + * do_idle, which then notices cpu_is_offline=true and BUGs
> + * at cpuhp_report_idle_dead). Returning the modified pt_regs
> + * doesn't help -- arch/arm64/kernel/sdei.c::do_sdei_event
> + * only honours a PC override via its IRQ-state heuristic
> + * and otherwise hands EL3 its own saved-context slot back.
> + *
> + * Trade-off: EL3 firmware retains ~one saved-context slot
> + * per parked CPU until the next hardware reset (~hundreds of
> + * bytes per CPU). The CPU itself is parked in cpu_park_loop
> + * exactly as if IPI_CPU_STOP had stopped it; recoverability
> + * is unchanged versus the existing path (neither is
> + * recoverable without hardware reset, since PSCI sees the
> + * CPU as ALREADY_ON in both cases).
> + */
> + cpu_park_loop();
> + /* unreachable */
Any chance we could avoid duplicating stuff from ipi_cpu_crash_stop()?
> +bool sdei_nmi_crash_smp_send_stop(void)
> +{
> + unsigned int this_cpu, cpu, remaining;
> + unsigned long timeout;
> + cpumask_t mask;
The above will probably get you a yell. Putting "cpumask_t" on the
stack is a no-no since it can be quite large under certain CONFIG
options. This is why it's nearly always defined as "static".
-Doug
^ permalink raw reply
* Re: [PATCH 1/4] firmware: arm_sdei: add SDEI_EVENT_SIGNAL support
From: Doug Anderson @ 2026-06-05 20:46 UTC (permalink / raw)
To: Kiryl Shutsemau
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel, Kiryl Shutsemau (Meta)
In-Reply-To: <ba8074cdb9ca5a471162cbc15f775c1567a3992a.1780496779.git.kas@kernel.org>
Hi,
On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
>
> From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
>
> Add sdei_event_signal(), a thin wrapper over the SDEI_EVENT_SIGNAL call
> (DEN0054) that makes the software-signalled event (event 0) pending on a
> target PE -- delivered NMI-like even when that PE has interrupts masked.
> It takes no locks, so it is safe to call from NMI / crash context.
>
> Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> ---
> drivers/firmware/arm_sdei.c | 12 ++++++++++++
> include/linux/arm_sdei.h | 6 ++++++
> include/uapi/linux/arm_sdei.h | 1 +
> 3 files changed, 19 insertions(+)
I'd never looked at SDEI before this (so my review is probably not
terribly strong), but this looks reasonable to me.
Reviewed-by: Douglas Anderson <dianders@chromium.org>
^ permalink raw reply
* Re: [PATCH 2/4] drivers/firmware: add SDEI cross-CPU NMI service for arm64
From: Doug Anderson @ 2026-06-05 20:54 UTC (permalink / raw)
To: Kiryl Shutsemau
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel, Kiryl Shutsemau (Meta)
In-Reply-To: <145b9e98b12a7d314fc4a203075f65c3a0c3a913.1780496779.git.kas@kernel.org>
Hi,
On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
>
> @@ -928,11 +929,19 @@ static void arm64_backtrace_ipi(cpumask_t *mask)
> void arch_trigger_cpumask_backtrace(const cpumask_t *mask, int exclude_cpu)
> {
> /*
> + * Prefer the SDEI cross-CPU NMI provider when active: firmware
> + * dispatches the event out of EL3 and reaches CPUs that have
> + * interrupts locally masked, without the per-IRQ-mask cost that
> + * pseudo-NMI pays for the same reach. The plain IPI path below
> + * can't reach such a CPU unless pseudo-NMI is enabled.
> + *
> * NOTE: though nmi_trigger_cpumask_backtrace() has "nmi_" in the name,
> * nothing about it truly needs to be implemented using an NMI, it's
> * just that it's _allowed_ to work with NMIs. If ipi_should_be_nmi()
> * returned false our backtrace attempt will just use a regular IPI.
> */
> + if (sdei_nmi_trigger_cpumask_backtrace(mask, exclude_cpu))
> + return;
> nmi_trigger_cpumask_backtrace(mask, exclude_cpu, arm64_backtrace_ipi);
nit: instead of one comment block, I would have broken it up in two. Like:
/*
* Prefer the SDEI ...
*/
if (sdei_nmi_trigger_cpumask_backtrace(mask, exclude_cpu))
return;
/*
* NOTE: though ...
*/
nmi_trigger_cpumask_backtrace(...);
> }
>
> diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
> index bbd2155d8483..6501087ff90d 100644
> --- a/drivers/firmware/Kconfig
> +++ b/drivers/firmware/Kconfig
> @@ -36,6 +36,25 @@ config ARM_SDE_INTERFACE
> standard for registering callbacks from the platform firmware
> into the OS. This is typically used to implement RAS notifications.
>
> +config ARM_SDEI_NMI
> + bool "SDEI-based cross-CPU NMI service (arm64)"
> + depends on ARM64 && ARM_SDE_INTERFACE
> + help
> + Provides SDEI-based cross-CPU NMI delivery for hooks that need
> + to reach interrupt-masked CPUs on silicon that lacks FEAT_NMI:
> +
> + - arch_trigger_cpumask_backtrace() (sysrq-l, RCU stalls,
> + hardlockup_all_cpu_backtrace, soft-lockup secondary dumps,
> + hung-task auxiliary dumps)
> +
> + The driver registers a handler for the SDEI software-signalled
> + event (event 0) and reaches a target CPU by signalling it with
> + SDEI_EVENT_SIGNAL. Firmware delivers the event out of EL3
> + regardless of the target's PSTATE.DAIF -- forced delivery into a
> + CPU wedged with interrupts locally masked.
> +
> + If unsure, say N.
Is there some downside to this? It seems like anyone who has the SDE
interface would want this. Not sure why you'd suggest people say "N".
Other than the nit, this looks reasoanble to me, though I'm a complete
noob when it comes to SDEI...
Reviewed-by: Douglas Anderson <dianders@chromium.org>
^ permalink raw reply
* Re: [PATCH bpf-next v2 8/8] selftests/bpf: add tests to validate KASAN on JIT programs
From: Alexis Lothoré @ 2026-06-05 20:55 UTC (permalink / raw)
To: Yonghong Song, Alexis Lothoré, Alexei Starovoitov,
Daniel Borkmann, Andrii Nakryiko, Martin KaFai Lau,
Eduard Zingerman, Kumar Kartikeya Dwivedi, Song Liu, Jiri Olsa,
John Fastabend, Thomas Gleixner, Ingo Molnar, Borislav Petkov,
Dave Hansen, x86, H. Peter Anvin, Shuah Khan, Maxime Coquelin,
Alexandre Torgue, Ihor Solodrai
Cc: ebpf, Bastien Curutchet, Thomas Petazzoni, bpf, linux-kernel,
linux-kselftest, linux-stm32, linux-arm-kernel
In-Reply-To: <f73d0971-0544-4a92-bde7-b2fbfcdaf28b@linux.dev>
On Fri Jun 5, 2026 at 7:20 PM CEST, Yonghong Song wrote:
[...]
>> Are you seeing any kasan report when you manually check your kernel
>> logs, or not at all ? If not at all, are you using the "CI" defconfig ?
>
> I do see one report:
>
> [ 79.503059] ==================================================================
> [ 79.503715] BUG: KASAN: slab-use-after-free in bpf_prog_bb753b2ee1f69aa0_st_not_on_stack+0x115/0x160
> [ 79.503715] Write of size 1 at addr ff11000117210a20 by task test_progs/2153
>
> [ 79.503715] CPU: 6 UID: 0 PID: 2153 Comm: test_progs Tainted: G OE 7.1.0-rc5-gd552a156c2fa #1926 PREEMPT(full)
> [ 79.503715] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
> [ 79.503715] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
> [ 79.503715] Call Trace:
> [ 79.503715] <TASK>
> [ 79.503715] dump_stack_lvl+0x6d/0xa0
> [ 79.503715] print_address_description+0x77/0x200
> [ 79.503715] print_report+0x58/0x70
> [ 79.503715] ? bpf_prog_bb753b2ee1f69aa0_st_not_on_stack+0x115/0x160
> [ 79.503715] kasan_report+0xa2/0xe0
> [ 79.503715] ? bpf_prog_bb753b2ee1f69aa0_st_not_on_stack+0x115/0x160
> [ 79.503715] ? bpf_test_run+0x208/0x770
> [ 79.503715] bpf_prog_bb753b2ee1f69aa0_st_not_on_stack+0x115/0x160
> [ 79.503715] bpf_test_run+0x472/0x770
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? __lock_acquire+0xe4a/0x2a10
> [ 79.503715] ? __pfx___css_rstat_updated+0x10/0x10
> [ 79.503715] ? __lock_acquire+0xe4a/0x2a10
> [ 79.503715] ? __pfx_bpf_test_run+0x10/0x10
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? lock_acquire+0xfd/0x2b0
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? rcu_is_watching+0x1f/0xa0
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? __kasan_krealloc+0xe9/0x110
> [ 79.503715] ? eth_type_trans+0x4b9/0x5f0
> [ 79.503715] bpf_prog_test_run_skb+0xddf/0x22f0
> [ 79.503715] ? __fget_files+0x29/0x350
> [ 79.503715] ? srso_alias_return_thunk+0x5/0xfbef5
> [ 79.503715] ? __fget_files+0x29/0x350
> [ 79.503715] bpf_prog_test_run+0x1cc/0x2d0
> [ 79.503715] __sys_bpf+0x740/0xa30
> [ 79.503715] ? __pfx___sys_bpf+0x10/0x10
> [ 79.503715] ? _prb_read_valid+0x334/0x770
> [ 79.503715] ? handle_mm_fault+0x91b/0xc00
> [ 79.503715] __x64_sys_bpf+0xba/0xd0
> [ 79.503715] do_syscall_64+0xee/0x400
> [ 79.503715] ? entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 79.503715] entry_SYSCALL_64_after_hwframe+0x76/0x7e
> [ 79.503715] RIP: 0033:0x7f92d8cfe1ad
> [ 79.503715] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 8
> [ 79.503715] RSP: 002b:00007ffe4237fee8 EFLAGS: 00000206 ORIG_RAX: 0000000000000141
> [ 79.503715] RAX: ffffffffffffffda RBX: 00007ffe423807b8 RCX: 00007f92d8cfe1ad
> [ 79.503715] RDX: 0000000000000050 RSI: 00007ffe4237ff70 RDI: 000000000000000a
> [ 79.503715] RBP: 00007ffe4237ff10 R08: 0000000000000000 R09: 0000000000000050
> [ 79.503715] R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000000
> [ 79.503715] R13: 00007ffe423807d8 R14: 00007f92d8eb9000 R15: 00005585778dd150
> [ 79.503715] </TASK>
>
> [ 79.503715] Allocated by task 2153:
> [ 79.503715] kasan_save_track+0x2f/0x70
> [ 79.503715] __kasan_kmalloc+0x72/0x90
> [ 79.503715] __kmalloc_node_noprof+0x34c/0x730
> [ 79.503715] bpf_map_area_alloc+0x4a/0x110
> [ 79.503715] array_map_alloc+0x19e/0x580
> [ 79.503715] map_create+0x8b2/0x1500
> [ 79.503715] __sys_bpf+0x7ea/0xa30
> [ 79.503715] __x64_sys_bpf+0xba/0xd0
> [ 79.503715] do_syscall_64+0xee/0x400
> [ 79.503715] entry_SYSCALL_64_after_hwframe+0x76/0x7e
>
> [ 79.503715] The buggy address belongs to the object at ff11000117210800
> which belongs to the cache kmalloc-cg-1k of size 1024
> [ 79.503715] The buggy address is located 0 bytes to the right of
> freed 544-byte region [ff11000117210800, ff11000117210a20)
>
> [ 79.503715] The buggy address belongs to the physical page:
> [ 79.503715] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x117210
> [ 79.503715] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 79.503715] memcg:ff11000117210411
> [ 79.503715] flags: 0x200000000000040(head|node=0|zone=2)
> [ 79.503715] page_type: f5(slab)
> [ 79.503715] raw: 0200000000000040 ff11000100072000 dead000000000100 dead000000000122
> [ 79.503715] raw: 0000000000000000 0000080000100010 00000000f5000000 ff11000117210411
> [ 79.503715] head: 0200000000000040 ff11000100072000 dead000000000100 dead000000000122
> [ 79.503715] head: 0000000000000000 0000080000100010 00000000f5000000 ff11000117210411
> [ 79.503715] head: 0200000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
> [ 79.503715] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
> [ 79.503715] page dumped because: kasan: bad access detected
>
> [ 79.503715] Memory state around the buggy address:
> [ 79.503715] ff11000117210900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 79.503715] ff11000117210980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
> [ 79.503715] >ff11000117210a00: 00 00 00 00 fb fb fc fc fc fc fc fc fc fc fc fc
> [ 79.503715] ^
> [ 79.503715] ff11000117210a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 79.503715] ff11000117210b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> [ 79.503715] ==================================================================
>
>
> But when I am running another same test './test_progs -t kasan', there is no kasan reports.
Ok, I guess you are missing kasan_multi_shot on your kernel command
line: without this option, only the first report is generated, then
KASAN does not emit additional report until you restart your kernel.
Could you please try adding it and running the tests again ?
Thanks,
Alexis
>>
>> cat tools/testing/selftests/bpf/{config,config.vm,config.x86_64} > .config && make olddefconfig
>>
>> If not, would you mind sharing your defconfig ?
>
> Attached.
>
>>
>> Thanks,
>>
>> Alexis
--
Alexis Lothoré, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
^ permalink raw reply
* Re: [PATCH 3/4] arm64: wire SDEI NMI into the hardlockup watchdog
From: Kiryl Shutsemau @ 2026-06-05 21:11 UTC (permalink / raw)
To: Doug Anderson
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel
In-Reply-To: <CAD=FV=U4eJ__dQc1e8CGgj5sMDNrD1MgEEy9Cgj9M5n-WmYAXA@mail.gmail.com>
On Fri, Jun 05, 2026 at 01:03:05PM -0700, Doug Anderson wrote:
> Hi,
>
> On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
> >
> > From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
> >
> > Select HAVE_HARDLOCKUP_DETECTOR_ARCH so the framework takes its backend
> > from this driver. A per-CPU hrtimer checks its buddy's heartbeat and
> > signals event 0 at a stalled CPU, which runs watchdog_hardlockup_check()
> > NMI-like.
> >
> > The source is chosen at boot: SDEI if firmware provides it, otherwise a
> > perf-NMI counter (pseudo-NMI) fallback -- one image covers both.
> >
> > Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
> > ---
> > arch/arm64/Kconfig | 1 +
> > drivers/firmware/Kconfig | 3 +
> > drivers/firmware/sdei_nmi.c | 247 +++++++++++++++++++++++++++++++++++-
> > 3 files changed, 248 insertions(+), 3 deletions(-)
>
> I'm a little confused about this patch. We already have a buddy
> hardlockup detector using the hrtimer, and it's even been improved
> recently to trigger in a smaller time bound. It looks as if you're
> duplicating bits of the perf and buddy detector here?
>
> I don't think you need this patch at all. The existing buddy detector
> + patches #1 and #2 in your series should be sufficient.
You're mostly right.
Buddy + #2 covers the console case (the remote branch triggers the
culprit's backtrace, which #2 makes deliverable), and #4 gets the wedged
CPU's registers into the vmcore.
The one thing this patch adds that a config can't is boot-time source
selection: PERF-compiled kernels have no detector on a pseudo_nmi=0
boot, and PREFER_BUDDY costs the pseudo-NMI machines perf
self-detection. But that's arguably out of scope for the patchset.
I'll drop this patch in v2 and run PREFER_BUDDY here. If a runtime
perf->buddy fallback ever materializes, the gap closes entirely.
--
Kiryl Shutsemau / Kirill A. Shutemov
^ permalink raw reply
* Re: [PATCH 2/4] drivers/firmware: add SDEI cross-CPU NMI service for arm64
From: Kiryl Shutsemau @ 2026-06-05 21:29 UTC (permalink / raw)
To: Doug Anderson
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel
In-Reply-To: <CAD=FV=XMqFVnri1aVGbFJhN6Ts3SeJUzEZrfN0Pqp9WeOzE=OA@mail.gmail.com>
On Fri, Jun 05, 2026 at 01:54:00PM -0700, Doug Anderson wrote:
> Hi,
>
> On Wed, Jun 3, 2026 at 7:36 AM Kiryl Shutsemau <kirill@shutemov.name> wrote:
> >
> > @@ -928,11 +929,19 @@ static void arm64_backtrace_ipi(cpumask_t *mask)
> > void arch_trigger_cpumask_backtrace(const cpumask_t *mask, int exclude_cpu)
> > {
> > /*
> > + * Prefer the SDEI cross-CPU NMI provider when active: firmware
> > + * dispatches the event out of EL3 and reaches CPUs that have
> > + * interrupts locally masked, without the per-IRQ-mask cost that
> > + * pseudo-NMI pays for the same reach. The plain IPI path below
> > + * can't reach such a CPU unless pseudo-NMI is enabled.
> > + *
> > * NOTE: though nmi_trigger_cpumask_backtrace() has "nmi_" in the name,
> > * nothing about it truly needs to be implemented using an NMI, it's
> > * just that it's _allowed_ to work with NMIs. If ipi_should_be_nmi()
> > * returned false our backtrace attempt will just use a regular IPI.
> > */
> > + if (sdei_nmi_trigger_cpumask_backtrace(mask, exclude_cpu))
> > + return;
> > nmi_trigger_cpumask_backtrace(mask, exclude_cpu, arm64_backtrace_ipi);
>
> nit: instead of one comment block, I would have broken it up in two. Like:
>
> /*
> * Prefer the SDEI ...
> */
> if (sdei_nmi_trigger_cpumask_backtrace(mask, exclude_cpu))
> return;
>
> /*
> * NOTE: though ...
> */
> nmi_trigger_cpumask_backtrace(...);
Makes sense.
> > }
> >
> > diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
> > index bbd2155d8483..6501087ff90d 100644
> > --- a/drivers/firmware/Kconfig
> > +++ b/drivers/firmware/Kconfig
> > @@ -36,6 +36,25 @@ config ARM_SDE_INTERFACE
> > standard for registering callbacks from the platform firmware
> > into the OS. This is typically used to implement RAS notifications.
> >
> > +config ARM_SDEI_NMI
> > + bool "SDEI-based cross-CPU NMI service (arm64)"
> > + depends on ARM64 && ARM_SDE_INTERFACE
> > + help
> > + Provides SDEI-based cross-CPU NMI delivery for hooks that need
> > + to reach interrupt-masked CPUs on silicon that lacks FEAT_NMI:
> > +
> > + - arch_trigger_cpumask_backtrace() (sysrq-l, RCU stalls,
> > + hardlockup_all_cpu_backtrace, soft-lockup secondary dumps,
> > + hung-task auxiliary dumps)
> > +
> > + The driver registers a handler for the SDEI software-signalled
> > + event (event 0) and reaches a target CPU by signalling it with
> > + SDEI_EVENT_SIGNAL. Firmware delivers the event out of EL3
> > + regardless of the target's PSTATE.DAIF -- forced delivery into a
> > + CPU wedged with interrupts locally masked.
> > +
> > + If unsure, say N.
>
> Is there some downside to this? It seems like anyone who has the SDE
> interface would want this. Not sure why you'd suggest people say "N".
No real downside -- without the software-signalled event the driver
stays inert, and there is no cost until an event actually fires.
The "say N" is caution, not a technical limit: so far this has run on
QEMU (TF-A) and one hardware platform, and the interesting paths depend
on each vendor's SDEI implementation at EL3. I'm not sure vendors would
care to run SDEI_EVENT_SIGNAL validation. Maybe we want to see more
data points first?
But maybe I am too cautious. Happy to flip the recommendation (or add
default y) in v2 if that the consensus.
> Other than the nit, this looks reasoanble to me, though I'm a complete
> noob when it comes to SDEI...
>
> Reviewed-by: Douglas Anderson <dianders@chromium.org>
Thanks!
--
Kiryl Shutsemau / Kirill A. Shutemov
^ permalink raw reply
* Re: [PATCH 4/4] arm64: route crash_smp_send_stop() last resort through SDEI
From: Kiryl Shutsemau @ 2026-06-05 21:46 UTC (permalink / raw)
To: Doug Anderson
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Petr Mladek, Thomas Gleixner, Andrew Morton,
Baoquan He, Puranjay Mohan, Usama Arif, Breno Leitao,
Julien Thierry, Lecopzer Chen, Sumit Garg, kernel-team, kexec,
linux-arm-kernel, linux-kernel
In-Reply-To: <CAD=FV=X5++c-6Wd6babajiPbn07cfPcG0uW3ZeepznXgSVO2+w@mail.gmail.com>
On Fri, Jun 05, 2026 at 01:42:57PM -0700, Doug Anderson wrote:
> > + sdei_nmi_crash_smp_send_stop();
>
> It feels weird to me that you're adding SDEI for "crash stop" but not
> for regular "stop". It feels like you should modify smp_send_stop() to
> fall back to SDEI if sending the NMI failed, instead of adding this
> separate path.
Fair. A wedged CPU ignores the reboot-path stop just the same, and the
escalation logic already lives in smp.c, so I'll restructure in v2.
One thing to sort out there: this patch parks the stopped CPU inside
its SDEI handler without completing the event, which is fine for the
crash case (nothing expects the CPU back before reset), but a generic
stop path probably wants SDEI_EVENT_COMPLETE_AND_RESUME into a parking
stub instead, so that e.g. a regular kexec can bring all CPUs back up
in the new kernel. I'll look into that as part of the rework.
> > + cpu_park_loop();
> > + /* unreachable */
>
> Any chance we could avoid duplicating stuff from ipi_cpu_crash_stop()?
Yes -- falls out of the above. I will look into this.
Maybe pull the save/offline/park body into a shared helper that both the
IPI handler and the SDEI handler call.
> > +bool sdei_nmi_crash_smp_send_stop(void)
> > +{
> > + unsigned int this_cpu, cpu, remaining;
> > + unsigned long timeout;
> > + cpumask_t mask;
>
> The above will probably get you a yell. Putting "cpumask_t" on the
> stack is a no-no since it can be quite large under certain CONFIG
> options. This is why it's nearly always defined as "static".
Doh! Will make it static in v2 -- safe here since the path is serialized
by the crash_stop guard.
--
Kiryl Shutsemau / Kirill A. Shutemov
^ permalink raw reply
* Re: [PATCH v4 18/24] iommu/arm-smmu-v3: Introduce master->ats_broken flag
From: Nicolin Chen @ 2026-06-05 21:56 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Will Deacon, Robin Murphy, Joerg Roedel, Bjorn Helgaas,
Rafael J . Wysocki, Len Brown, Pranjal Shrivastava, Mostafa Saleh,
Lu Baolu, Kevin Tian, linux-arm-kernel, iommu, linux-kernel,
linux-acpi, linux-pci, vsethi, Shuai Xue
In-Reply-To: <20260605194259.GE1962447@nvidia.com>
Thanks for the reply.
This is indeed a very complex and sophisticated topic..
On Fri, Jun 05, 2026 at 04:42:59PM -0300, Jason Gunthorpe wrote:
> I don't see any of these options as appealing. We have to maintain a
> few key invariants, and I think it cannot be done without a way to
> find all the domains that are using the STE.
>
> One way or another you have to be using the invs list rw locks to
> synchronize the EATS state changes.
>
> It is okayish to be sloppy when turning EATS off, but when turning it
> back on we do need to cycle through every invs list and toggle its
> lock to ensure that the invalidations are synchronized before
> EATS=enable happens.
I think the core guarantees that "cycle through every invs list"
happens: a PCI reset calls reset_prepare() blocking all the RID
and PASID domains and removing ATS entries from every invs list,
and then calls reset_done() that re-attach RID/PASID domains so
freshly new ATS entries will be installed before EATS=enable.
So, I think the enable path is not an issue, though the disable
path or the invalidation path would need "a way to find all the
domains that are using the STE".
> Given you must have a way to go from STE -> master -> all invs lists
> I'm not sure either option really makes such a large difference.
>
> If so then adjusting the invs to disable the ATS is pretty simple, run
> over the xarray and set them all off. Yes you could find the master
> through a SID lookup with some locking adjustment.
> >
> > (1) Per-invs marker: INV_TYPE_ATS_BROKEN + master_domains
> > disable_ats() in the timeout path walks master->master_domains
> > and flips matching ATS invs entries to the BROKEN type.
> >
> > + invs walker is free (one case label in the existing type switch).
> > + No lock or pointer deref in the invs walker.
> > + No master pointer stored in invs; no lifetime concern.
> >
> > - disable_ats() walks every (master, domain) and marks each invs
> > set; the list needs locking usable from atomic.
>
> This doesn't seem so bad
Yea, the only thing is that the disable path has to deal with a
complexity from going through a per-device domain list. Maybe it
can reuse iommu_group->pasid_array by taking xa_lock?
> > (2) Per-master flag + streams_lock
> > invs walker resolves SID -> master via streams_lock and reads
> > master->ats_broken.
> >
> > + Single source of truth on the master.
> > + disable_ats() is one WRITE_ONCE.
> > + atc_inv_master early-skips via one READ_ONCE.
> > + attach gates ats_enabled on the flag; a concurrent quarantine
> > race can be closed by a short post-attach re-check in commit()
> > + No master pointer in invs; no lifetime concern.
> >
> > - invs walker pays streams_lock + rb_find(SID) per ATS entry on
> > every invalidation. Measurable on ATS-heavy workloads.
>
> Doesn't consider how to enable
The enable side is core-driven: when reset_done() re-attaches
the device from blocked_domain back to its RID/PASID domains,
the new attach_dev callback (old_domain == blocked_domain) can
clear the per-master flag. If the device is still broken, then
arm_smmu_atc_inv_master() at the end of attach_commit() times
out and re-triggers quarantine.
The flaw lives in the invalidation path as it must translate
every SID to master using streams_lock + rb_find(SID) per ATS
entry, which make it very less attractive.
> > (3) Per-master flag + inv->master pointer (v4)
> > invs entry carries a master pointer; the invs walker reads
> > cur->master->ats_broken directly.
> >
> > + invs walker is one READ_ONCE through a cached pointer.
> > + disable_ats is one WRITE_ONCE.
> > + atc_inv_master early-skip via one READ_ONCE.
> > + attach gate + post-attach re-check, same as (2).
> >
> > - invs holds a master ptr, so release_device must synchronize_rcu()
> > before freeing the master to drain walkers under rcu_read_lock().
> > We dropped this from v4 for that reason.
>
> synchronize_rcu is not right because you have to have gone through the
> rwlock so there can be no readers.
Ah, I think you are right! When release_device() is invoked, the
device must be already in the release (blocked) domain. So there
should be no domain->invs in the system holding its ATS entries.
And the enable part would work as (2).
In this case, (3) seems the best? It's fast on every aspect.
And I think it would fit we plan to generalize the invs design:
struct inv {
struct arm_smmu_device *smmu; // => struct iommu_device *iommu;
struct arm_smmu_master *master; // => void *priv;
// (dev->iommu->priv)
Thanks
Nicolin
^ permalink raw reply
* [PATCH 00/17] media: rockchip: rga: Add multi-core support
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel,
Simon Xue, Joerg Roedel
Add multi-core support to the RGA (Raster Graphic Accelerator) driver
for Rockchip SoCs. This works by scheduling the given work to multiple
identical RGA cores. Previously other identical cores were discarded
while probing with -ENODEV to avoid exposing multiple video devices for
identical cores and breaking the ABI when adding an in-kernel scheduling.
This series targets the RK3588 SoC, which has one RGA2-Enhance core
and two RGA3 cores (see [1] for an overview of the different RGA cores).
The slimmed down RK3576 SoC also features two RGA2-Pro
(also described as RGA2.5) cores, but is currently not supported by
the driver. Tests are done on a Radxa Rock 5T SBC.
The scheduling is done only on a context level, which causes no
increased performance for a single stream (which uses only one mem2mem
context). Therefore at least N parallel stream are necessary to utilize
N cores. This avoids the more complex buffer handling required to avoid
mixing the frame ordering when one core is slightly faster than the
other (e.g. due to memory transfer timings or different clocks).
While the work is based on Detlev Casanova's multi-core series for the
rkvdec driver [2], it differs in two major aspects:
(1) It doesn't directly call v4l2_m2m_job_finish to mark the current job
as finished in the device_run callback. Detlev used this to trick the
m2m framework to directly schedule the next job. This looked like a
dirty hack and had me running into some of it's pitfalls (e.g. the
difference between the v4l2_m2m_buf_done and the newly introduced
v4l2_m2m_buf_done_manual function).
Instead I've dropped the current curr_ctx member of the v4l2_m2m_dev
struct and added a max_parallel_jobs member to specify the maximum
number of parallel jobs. This allows the driver to set it's maximum
number of parallel jobs with the newly introduced
v4l2_m2m_set_max_parallel_jobs function. The RGA driver uses it to set
it's number of parallel jobs to it's number of available cores. The m2m
framework then schedules the first N jobs on it's job queue to the
device_run callback instead of only one.
(2) Instead of attaching an identical RGA core on probe to the first
probed RGA core instance, use component helpers to add all cores as
components to a virtual platform device. This has the advantage of only
creating the video device after all cores have been probed successfully
and tearing it down if one core is being removed (e.g. by the sysfs),
which otherwise could lead to nasty memory bugs. The implementation is
based on the driver of the etnaviv gpu. As the virtual platform device
doesn't has an iommu, we still allocate all relevant drives on the first
core, which shares it's iommu domain with all other cores.
v4l2-compliance results:
v4l2-compliance 1.32.0, 64 bits, 64-bit time_t
...
Card type : rga2
...
Total for rockchip-rga device /dev/video0: 48, Succeeded: 48, Failed: 0, Warnings: 0
v4l2-compliance 1.32.0, 64 bits, 64-bit time_t
...
Card type : rga3
...
Total for rockchip-rga device /dev/video1: 48, Succeeded: 48, Failed: 0, Warnings: 0
The DTS and iommu changes at the end are picked out of other next trees
to provide an easy way to actually test the changes with an RGA3 on a
rk3588 SoC. They'll be dropped when they get into media/next.
Patch 1-3 address review comments from my last RGA3 patch series
Patch 4 additional driver cleanup
Patch 5 implements support for parallel jobs in the m2m framework
Patch 6-8 add multi core preparations to the driver
Patch 9-13 rework the driver to use component helpers
Patch 14 puts all cores into the same iommu domain
Patch 15 enables the multi-core support
patch 16-17 just pick patches required for testing
[1] https://codeberg.org/airockchip/librga/src/branch/main/docs/Rockchip_Developer_Guide_RGA_EN.md#design-index
[2] https://lore.kernel.org/linux-media/20260409-rkvdec-multicore-v1-0-62b316abf0f7@collabora.com/
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
Simon Xue (1):
iommu/rockchip: disable fetch dte time limit
Sven Püschel (16):
media: rockchip: rga: zero cmdbuf in shared code
media: rockchip: rga: add comment about pixel alignment for YUV formats
media: rockchip: rga: move early return into if condition in vidioc_enum_fmt
media: rockchip: rga: removed unused regmap member
media: v4l2-mem2mem: support running multiple jobs in parallel
media: rockchip: rga: move power handling to device_run
media: rockchip: rga: adjust get_version to return the version
media: rockchip: rga: add rga_core structure
media: rockchip: rga: use components to manage multiple cores
media: rockchip: rga: move rockchip_rga allocation to master probe
media: rockchip: rga: move video device to the master
media: rockchip: rga: move core initialization from bind to probe
media: rockchip: rga: bind all cores to the master
media: rockchip: rga: put all cores into first core iommu domain
media: rockchip: rga: schedule jobs to multiple cores
arm64: dts: rockchip: add rga3 dt nodes to rk3588
arch/arm64/boot/dts/rockchip/rk3588-base.dtsi | 44 +++
drivers/iommu/rockchip-iommu.c | 8 +
drivers/media/platform/rockchip/rga/rga-buf.c | 16 +-
drivers/media/platform/rockchip/rga/rga-hw.c | 40 +-
drivers/media/platform/rockchip/rga/rga.c | 501 +++++++++++++++++++-------
drivers/media/platform/rockchip/rga/rga.h | 45 ++-
drivers/media/platform/rockchip/rga/rga3-hw.c | 32 +-
drivers/media/v4l2-core/v4l2-mem2mem.c | 89 +++--
include/media/v4l2-mem2mem.h | 3 +
9 files changed, 541 insertions(+), 237 deletions(-)
---
base-commit: 6a75e3d4f6428b90f398354212e3a2e0172851d6
change-id: 20260602-spu-rga3multicore-ae8c8caf01e9
Best regards,
--
Sven Püschel <s.pueschel@pengutronix.de>
^ permalink raw reply
* [PATCH 02/17] media: rockchip: rga: add comment about pixel alignment for YUV formats
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Add a comment to clarify the use of fixed step_height values for all YUV
formats. While the commit introducing the change already explains the
reasoning, add an explicit comment to improve the visibility of the
reasoning.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index bd0afd33affe4..efe5541078214 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -414,6 +414,16 @@ static int vidioc_try_fmt(struct file *file, void *priv, struct v4l2_format *f)
.step_height = 1,
};
+ /*
+ * Technically 4:2:2 YUV formats don't need a step_height of 2.
+ * But for the RGA3 this is explicitly documented in section 5.6.3
+ * of the RK3588 TRM Part 2.
+ * And the RGA2 vendor driver also checks that the height (and width)
+ * is aligned to 2 when a YUV format is used.
+ *
+ * Therefore be safe and always align width and height to 2
+ * when a YUV format is used.
+ */
if (v4l2_is_format_yuv(v4l2_format_info(pix_fmt->pixelformat))) {
frmsize.step_width = 2;
frmsize.step_height = 2;
--
2.54.0
^ permalink raw reply related
* [PATCH 03/17] media: rockchip: rga: move early return into if condition in vidioc_enum_fmt
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Instead of a doing an early return when we don't have a capture device,
merge the condition with the following if condition. This improves
readability, as the condition now explicitly contains a check for a
capture device instead of returning when we don't have a capture device.
Also use the V4L2_TYPE_IS_CAPTURE helper and improve the comment.
The early return if was copied from the vivid drivers
vivid_enum_fmt_vid function.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index efe5541078214..8c03422d669cf 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -372,12 +372,14 @@ static int vidioc_enum_fmt(struct file *file, void *priv, struct v4l2_fmtdesc *f
if (ret != 0)
return ret;
- if (f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE &&
- f->type != V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE)
- return 0;
-
- /* allow changing the quantization and xfer func for YUV formats */
- if (v4l2_is_format_yuv(v4l2_format_info(f->pixelformat)))
+ /*
+ * Allow changing the quantization and ycbcr_enc func for YUV formats
+ * on the capture side for RGB -> YUV conversions.
+ *
+ * These flags are only relevant for capture devices.
+ */
+ if (V4L2_TYPE_IS_CAPTURE(f->type) &&
+ v4l2_is_format_yuv(v4l2_format_info(f->pixelformat)))
f->flags |= V4L2_FMT_FLAG_CSC_QUANTIZATION |
V4L2_FMT_FLAG_CSC_YCBCR_ENC;
--
2.54.0
^ permalink raw reply related
* [PATCH 13/17] media: rockchip: rga: bind all cores to the master
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Bind all core components to the master component. Previously only the
first core has been added to the master device to avoid creating
multiple video devices. As the video device creation has been moved to
the master component, it allows us to bind all cores without creating
additional video devices.
We expect that all cores to report the same version number, as we only
add cores with the same compatible value. This is important, as we
setup the command buffer before actually scheduling the work to a
specific core. Therefore adjusting command buffers depending on the
version register only works when all cores have the same value.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 22 +++++++++++-----------
drivers/media/platform/rockchip/rga/rga.h | 1 +
2 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index 0413b8518dfc8..6add6c510c127 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -742,6 +742,7 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
{
struct rockchip_rga *rga = data;
struct rga_core *core = dev_get_drvdata(dev);
+ struct rockchip_rga_version version;
int ret = 0;
core->rga = rga;
@@ -750,14 +751,21 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
if (ret < 0)
return ret;
- rga->version = rga->hw->get_version(core);
+ version = rga->hw->get_version(core);
v4l2_info(&rga->v4l2_dev, "HW Version: 0x%02x.%02x\n",
- rga->version.major, rga->version.minor);
+ version.major, version.minor);
+
+ if (rga->num_cores) {
+ /* we are not the first core, expect that we have the same version */
+ if (rga->version.major != version.major || rga->version.minor != version.minor)
+ v4l2_warn(&rga->v4l2_dev, "Detected multi-core setup with different core versions!\n");
+ } else
+ rga->version = version;
pm_runtime_put(core->dev);
- rga->cores[0] = core;
+ rga->cores[rga->num_cores++] = core;
return 0;
}
@@ -983,14 +991,6 @@ static int rga_probe(struct platform_device *pdev)
component_match_add_release(dev, &match, component_release_of,
component_compare_of, core_node);
num_cores++;
-
- /*
- * As multi core is not implemented yet,
- * break out of the loop to only have one core per rockchip_rga struct.
- * Also put the node, which otherwise would've been done by the loop iteration.
- */
- of_node_put(core_node);
- break;
}
if (!match)
diff --git a/drivers/media/platform/rockchip/rga/rga.h b/drivers/media/platform/rockchip/rga/rga.h
index fcf1ef7d2029f..6237436b984eb 100644
--- a/drivers/media/platform/rockchip/rga/rga.h
+++ b/drivers/media/platform/rockchip/rga/rga.h
@@ -88,6 +88,7 @@ struct rockchip_rga {
const struct rga_hw *hw;
+ u8 num_cores;
struct rga_core *cores[];
};
--
2.54.0
^ permalink raw reply related
* [PATCH 12/17] media: rockchip: rga: move core initialization from bind to probe
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Move the core initialization from the core binding function to the core
probing function. This better matches the actual sequence, where the
core probe initializes most things and the bind function just binds the
core to the actual rga struct from the master device.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 83 ++++++++++++++++---------------
1 file changed, 42 insertions(+), 41 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index 952377ae467f5..0413b8518dfc8 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -740,21 +740,49 @@ static int rga_parse_dt(struct rga_core *core)
static int rga_core_bind(struct device *dev, struct device *master, void *data)
{
- struct platform_device *pdev = to_platform_device(dev);
struct rockchip_rga *rga = data;
+ struct rga_core *core = dev_get_drvdata(dev);
+ int ret = 0;
+
+ core->rga = rga;
+
+ ret = pm_runtime_resume_and_get(core->dev);
+ if (ret < 0)
+ return ret;
+
+ rga->version = rga->hw->get_version(core);
+
+ v4l2_info(&rga->v4l2_dev, "HW Version: 0x%02x.%02x\n",
+ rga->version.major, rga->version.minor);
+
+ pm_runtime_put(core->dev);
+
+ rga->cores[0] = core;
+
+ return 0;
+}
+
+static const struct component_ops rga_core_ops = {
+ .bind = rga_core_bind,
+};
+
+static int rga_core_probe(struct platform_device *pdev)
+{
struct rga_core *core;
+ const struct rga_hw *hw;
int ret = 0;
int irq;
if (!pdev->dev.of_node)
return -ENODEV;
+ hw = of_device_get_match_data(&pdev->dev);
+ if (!hw)
+ return dev_err_probe(&pdev->dev, -ENODEV, "failed to get match data\n");
+
core = devm_kzalloc(&pdev->dev, sizeof(*core), GFP_KERNEL);
- core->rga = rga;
core->dev = &pdev->dev;
- rga->cores[0] = core;
-
ret = rga_parse_dt(core);
if (ret)
return dev_err_probe(&pdev->dev, ret, "Unable to parse OF data\n");
@@ -775,7 +803,7 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
}
ret = devm_request_irq(core->dev, irq, rga_isr,
- rga_has_internal_iommu(rga) ? 0 : IRQF_SHARED,
+ hw->has_internal_iommu ? 0 : IRQF_SHARED,
dev_name(core->dev), core);
if (ret < 0) {
dev_err(core->dev, "failed to request irq\n");
@@ -790,42 +818,6 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
platform_set_drvdata(pdev, core);
- ret = pm_runtime_resume_and_get(core->dev);
- if (ret < 0)
- goto err_put_clk;
-
- rga->version = rga->hw->get_version(core);
-
- v4l2_info(&rga->v4l2_dev, "HW Version: 0x%02x.%02x\n",
- rga->version.major, rga->version.minor);
-
- pm_runtime_put(core->dev);
-
- return 0;
-
-err_put_clk:
- pm_runtime_disable(core->dev);
-
- return ret;
-}
-
-static void rga_core_unbind(struct device *dev, struct device *master,
- void *data)
-{
- struct rga_core *core = dev_get_drvdata(dev);
-
- pm_runtime_disable(core->dev);
-}
-
-static const struct component_ops rga_core_ops = {
- .bind = rga_core_bind,
- .unbind = rga_core_unbind,
-};
-
-static int rga_core_probe(struct platform_device *pdev)
-{
- int ret = 0;
-
ret = component_add(&pdev->dev, &rga_core_ops);
if (ret < 0) {
dev_err(&pdev->dev, "failed to register component: %d", ret);
@@ -833,11 +825,20 @@ static int rga_core_probe(struct platform_device *pdev)
}
return 0;
+
+err_put_clk:
+ pm_runtime_disable(core->dev);
+
+ return ret;
}
static void rga_core_remove(struct platform_device *pdev)
{
+ struct rga_core *core = platform_get_drvdata(pdev);
+
component_del(&pdev->dev, &rga_core_ops);
+
+ pm_runtime_disable(core->dev);
}
static int __maybe_unused rga_runtime_suspend(struct device *dev)
--
2.54.0
^ permalink raw reply related
* [PATCH 14/17] media: rockchip: rga: put all cores into first core iommu domain
From: Sven Püschel @ 2026-06-05 22:07 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Put all cores into the iommu domain of the first core to allow them to
be used by any core. All buffers accessed by the hardware are allocated
on the first core, as the scheduling to a specific core is done after
the allocation. Therefore put all cores into the same domain to have the
same iommu mapping on all cores.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index 6add6c510c127..9cebb461b3fd2 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -10,6 +10,7 @@
#include <linux/delay.h>
#include <linux/fs.h>
#include <linux/interrupt.h>
+#include <linux/iommu.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/of_platform.h>
@@ -757,6 +758,19 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
version.major, version.minor);
if (rga->num_cores) {
+ /* Attach to the first cores iommu */
+ struct iommu_domain *domain = iommu_get_domain_for_dev(rga->cores[0]->dev);
+
+ if (IS_ERR(domain)) {
+ dev_err(core->dev, "Couldn't get domain of the first core\n");
+ return PTR_ERR(domain);
+ }
+ ret = iommu_attach_device(domain, core->dev);
+ if (ret) {
+ dev_err(core->dev, "Couldn't attach to the domain of the first core\n");
+ return ret;
+ }
+
/* we are not the first core, expect that we have the same version */
if (rga->version.major != version.major || rga->version.minor != version.minor)
v4l2_warn(&rga->v4l2_dev, "Detected multi-core setup with different core versions!\n");
--
2.54.0
^ permalink raw reply related
* [PATCH 11/17] media: rockchip: rga: move video device to the master
From: Sven Püschel @ 2026-06-05 22:06 UTC (permalink / raw)
To: Jacob Chen, Ezequiel Garcia, Mauro Carvalho Chehab,
Heiko Stuebner, Philipp Zabel
Cc: linux-media, linux-rockchip, linux-arm-kernel, linux-kernel,
kernel, Detlev Casanova, Michael Tretter, Sven Püschel
In-Reply-To: <20260606-spu-rga3multicore-v1-0-3ec2b15675f7@pengutronix.de>
Move the video device allocation and registration to the master
component bind function in preparation for binding multiple cores
to the master. Moving it to the master bind function allows to
only register the v4l2 device when all cores have been successfully
bound to the master device. This also causes the video device to be
bound against the master platform device instead of a specific core.
Signed-off-by: Sven Püschel <s.pueschel@pengutronix.de>
---
drivers/media/platform/rockchip/rga/rga.c | 96 ++++++++++++++++---------------
1 file changed, 50 insertions(+), 46 deletions(-)
diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
index 11912bf5b6906..952377ae467f5 100644
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -743,7 +743,6 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
struct platform_device *pdev = to_platform_device(dev);
struct rockchip_rga *rga = data;
struct rga_core *core;
- struct video_device *vfd;
int ret = 0;
int irq;
@@ -789,33 +788,11 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
goto err_put_clk;
}
- ret = v4l2_device_register(&pdev->dev, &rga->v4l2_dev);
- if (ret)
- goto err_put_clk;
- vfd = video_device_alloc();
- if (!vfd) {
- v4l2_err(&rga->v4l2_dev, "Failed to allocate video device\n");
- ret = -ENOMEM;
- goto unreg_v4l2_dev;
- }
- *vfd = rga_videodev;
- vfd->lock = &rga->mutex;
- vfd->v4l2_dev = &rga->v4l2_dev;
-
- video_set_drvdata(vfd, rga);
- rga->vfd = vfd;
-
platform_set_drvdata(pdev, core);
- rga->m2m_dev = v4l2_m2m_init(&rga_m2m_ops);
- if (IS_ERR(rga->m2m_dev)) {
- v4l2_err(&rga->v4l2_dev, "Failed to init mem2mem device\n");
- ret = PTR_ERR(rga->m2m_dev);
- goto rel_vdev;
- }
ret = pm_runtime_resume_and_get(core->dev);
if (ret < 0)
- goto rel_m2m;
+ goto err_put_clk;
rga->version = rga->hw->get_version(core);
@@ -824,23 +801,8 @@ static int rga_core_bind(struct device *dev, struct device *master, void *data)
pm_runtime_put(core->dev);
- ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
- if (ret) {
- v4l2_err(&rga->v4l2_dev, "Failed to register video device\n");
- goto rel_m2m;
- }
-
- v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n",
- vfd->name, video_device_node_name(vfd));
-
return 0;
-rel_m2m:
- v4l2_m2m_release(rga->m2m_dev);
-rel_vdev:
- video_device_release(vfd);
-unreg_v4l2_dev:
- v4l2_device_unregister(&rga->v4l2_dev);
err_put_clk:
pm_runtime_disable(core->dev);
@@ -851,13 +813,6 @@ static void rga_core_unbind(struct device *dev, struct device *master,
void *data)
{
struct rga_core *core = dev_get_drvdata(dev);
- struct rockchip_rga *rga = core->rga;
-
- v4l2_info(&rga->v4l2_dev, "Removing\n");
-
- v4l2_m2m_release(rga->m2m_dev);
- video_unregister_device(rga->vfd);
- v4l2_device_unregister(&rga->v4l2_dev);
pm_runtime_disable(core->dev);
}
@@ -937,6 +892,7 @@ static struct platform_driver rga_core_pdrv = {
static int rga_bind(struct device *dev)
{
struct rockchip_rga *rga = dev_get_drvdata(dev);
+ struct video_device *vfd;
int ret;
ret = component_bind_all(dev, rga);
@@ -945,11 +901,59 @@ static int rga_bind(struct device *dev)
return ret;
}
+ ret = v4l2_device_register(dev, &rga->v4l2_dev);
+ if (ret)
+ return ret;
+ vfd = video_device_alloc();
+ if (!vfd) {
+ v4l2_err(&rga->v4l2_dev, "Failed to allocate video device\n");
+ ret = -ENOMEM;
+ goto unreg_v4l2_dev;
+ }
+ *vfd = rga_videodev;
+ vfd->lock = &rga->mutex;
+ vfd->v4l2_dev = &rga->v4l2_dev;
+
+ video_set_drvdata(vfd, rga);
+ rga->vfd = vfd;
+
+ rga->m2m_dev = v4l2_m2m_init(&rga_m2m_ops);
+ if (IS_ERR(rga->m2m_dev)) {
+ v4l2_err(&rga->v4l2_dev, "Failed to init mem2mem device\n");
+ ret = PTR_ERR(rga->m2m_dev);
+ goto rel_vdev;
+ }
+
+ ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
+ if (ret) {
+ v4l2_err(&rga->v4l2_dev, "Failed to register video device\n");
+ goto rel_m2m;
+ }
+
+ v4l2_info(&rga->v4l2_dev, "Registered %s as /dev/%s\n",
+ vfd->name, video_device_node_name(vfd));
+
return 0;
+
+rel_m2m:
+ v4l2_m2m_release(rga->m2m_dev);
+rel_vdev:
+ video_device_release(vfd);
+unreg_v4l2_dev:
+ v4l2_device_unregister(&rga->v4l2_dev);
+ return ret;
}
static void rga_unbind(struct device *dev)
{
+ struct rockchip_rga *rga = dev_get_drvdata(dev);
+
+ v4l2_info(&rga->v4l2_dev, "Removing\n");
+
+ v4l2_m2m_release(rga->m2m_dev);
+ video_unregister_device(rga->vfd);
+ v4l2_device_unregister(&rga->v4l2_dev);
+
component_unbind_all(dev, NULL);
}
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox