* [GIT PULL 0/4] soc updates for 7.2
From: Arnd Bergmann @ 2026-06-16 7:50 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
Marek Vasut, linux-kernel
Once more, the changes are dominated by devicetree updates for
64-bit NXP/Freescale and Qualcomm platforms. There are slightly
under 1000 patches this time, almost as much as for 7.1. The
overall diff size is much smaller this time as we have a lot
of simpler patches, only five new SoCs that are all variations
of previously supported ones, and again few large code changes.
The most contributions this time are from:
52 Marek Vasut
35 Krzysztof Kozlowski
30 Chen-Yu Tsai
27 Biju Das
19 Sudeep Holla
18 Linus Walleij
16 Sherry Sun
16 Cristian Marussi
15 Svyatoslav Ryhel
15 Stefano Radaelli
15 Hugo Villeneuve
15 Cristian Ciocaltea
14 Harshal Dev
14 Abel Vesa
13 Conor Dooley
12 Thierry Reding
12 Konrad Dybcio
12 Josua Mayer
12 Frank Li
11 Tudor Ambarus
11 Ronald Claveau
11 Nishanth Menon
11 Alexander Koskovich
diffstat=0.1
0.4% Documentation/arch/arm/zte/
0.3% Documentation/devicetree/bindings/arm/
0.1% Documentation/devicetree/bindings/clock/
0.1% Documentation/devicetree/bindings/iommu/
0.7% Documentation/devicetree/bindings/memory-controllers/
0.7% Documentation/devicetree/bindings/soc/renesas/
0.1% Documentation/devicetree/bindings/soc/
0.1% Documentation/devicetree/bindings/watchdog/
0.2% Documentation/devicetree/bindings/
3.5% arch/arm/boot/dts/aspeed/
0.6% arch/arm/boot/dts/gemini/
0.1% arch/arm/boot/dts/mediatek/
3.4% arch/arm/boot/dts/nvidia/
2.5% arch/arm/boot/dts/nxp/imx/
0.3% arch/arm/boot/dts/renesas/
0.6% arch/arm/boot/dts/st/
0.2% arch/arm/boot/dts/zte/
0.1% arch/arm/boot/dts/
1.1% arch/arm/
0.1% arch/arm64/boot/dts/allwinner/
1.2% arch/arm64/boot/dts/amlogic/
3.0% arch/arm64/boot/dts/apple/
3.3% arch/arm64/boot/dts/aspeed/
0.1% arch/arm64/boot/dts/cix/
21.1% arch/arm64/boot/dts/freescale/
0.1% arch/arm64/boot/dts/intel/
0.9% arch/arm64/boot/dts/mediatek/
0.1% arch/arm64/boot/dts/nuvoton/
0.1% arch/arm64/boot/dts/nvidia/
17.1% arch/arm64/boot/dts/qcom/
5.7% arch/arm64/boot/dts/renesas/
3.1% arch/arm64/boot/dts/rockchip/
4.0% arch/arm64/boot/dts/ti/
0.2% arch/arm64/boot/dts/
0.3% arch/arm64/configs/
0.3% arch/riscv/boot/dts/microchip/
0.5% arch/riscv/boot/dts/sophgo/
3.0% arch/riscv/boot/dts/spacemit/
0.1% arch/riscv/boot/dts/starfive/
0.1% arch/riscv/boot/dts/tenstorrent/
0.1% arch/riscv/boot/dts/thead/
0.4% drivers/bus/fsl-mc/
0.2% drivers/clk/
0.4% drivers/firmware/arm_ffa/
0.1% drivers/firmware/arm_scmi/transports/
0.1% drivers/firmware/arm_scmi/vendors/imx/
1.3% drivers/firmware/arm_scmi/
0.1% drivers/firmware/imx/
1.0% drivers/firmware/samsung/
0.5% drivers/firmware/
0.1% drivers/gpu/drm/
0.3% drivers/irqchip/
5.1% drivers/memory/tegra/
0.1% drivers/soc/bcm/brcmstb/
1.6% drivers/soc/qcom/
0.8% drivers/soc/renesas/
0.2% drivers/soc/sunxi/
0.9% drivers/soc/tegra/
0.5% drivers/soc/ti/
0.1% drivers/soc/
0.1% drivers/tee/amdtee/
0.7% drivers/tee/optee/
0.1% drivers/tee/
0.3% drivers/
0.4% include/dt-bindings/clock/
1.0% include/dt-bindings/memory/
0.5% include/dt-bindings/reset/
0.1% include/dt-bindings/
0.2% include/linux/soc/qcom/
0.3% include/linux/
0.1% include/soc/
843 files changed, 56647 insertions(+), 6762 deletions(-)
git shortlog --first-parent
Arnd Bergmann (19):
Merge tag 'pxa1908-dt-for-7.2' of https://codeberg.org/pxa1908-mainline/linux into soc/dt
Merge tag 'renesas-dts-for-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
Merge tag 'zx29-dts-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/dt
Merge tag 'tegra-for-7.2-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'arm-soc/for-7.2/devicetree' of https://github.com/Broadcom/stblinux into soc/dt
Merge tag 'ti-k3-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt
Merge tag 'apple-soc-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt
Merge tag 'imx-dt-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'hisi-arm64-dt-for-7.2' of https://github.com/hisilicon/linux-hisi into soc/dt
Merge tag 'v7.2-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'riscv-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt
Merge tag 'omap-for-v7.2/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt
Merge tag 'at91-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt
Merge tag 'microchip-dt64-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt
Merge tag 'imx-dt64-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'imx-dt64-7.2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'imx-binding-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'sunxi-dt-for-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt
Merge tag 'bst-arm64-emmc-driver-dts-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/dt
Krzysztof Kozlowski (10):
Merge tag 'mtk-dts32-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt
Merge tag 'mtk-dts64-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt
Merge tag 'renesas-dts-for-v7.2-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
Merge tag 'tenstorrent-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/tenstorrent/linux into soc/dt
Merge tag 'thead-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt
Merge tag 'spacemit-dt-for-7.2-1' of https://github.com/spacemit-com/linux into soc/dt
Merge tag 'amlogic-arm64-dt-for-v7.2-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt
Merge tag 'nuvoton-7.2-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
Merge tag 'riscv-sophgo-dt-for-v7.2' of https://github.com/sophgo/linux into soc/dt
Merge tag 'aspeed-7.2-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
Linus Walleij (10):
Merge tag 'cix-dt-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt
Merge tag 'qcom-arm64-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
Merge tag 'v7.2-rockchip-dts32' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'v7.2-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'gemini-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/dt
Merge tag 'tegra-for-7.2-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'tegra-for-7.2-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'samsung-dt64-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt
Merge tag 'stm32-dt-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt
Merge tag 'socfpga_dts_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt
Mohamed Ayman (1):
ARM: dts: ixp4xx: use phandle-based GPIOs in mi424wr
Ryan Chen (4):
dt-bindings: arm: aspeed: Add AST2700 board compatible
arm64: Kconfig: Add ASPEED SoC family Kconfig support
arm64: dts: aspeed: Add initial AST27xx SoC device tree
arm64: dts: aspeed: Fix duplicate pinctrl labels and address scheme
Yu-Chun Lin (1):
arm64: dts: realtek: Add pinctrl support for RTD1625
Arnd Bergmann (19):
Merge tag 'soc_fsl-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Merge tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Merge tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'optee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'tegra-for-7.2-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-pmc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Merge tag 'memory-controller-drv-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Merge tag 'arm-soc/for-7.2/drivers' of https://github.com/Broadcom/stblinux into soc/drivers
Merge tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers
Merge tag 'cache-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Merge tag 'riscv-soc-drivers-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
Merge tag 'memory-controller-drv-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Krzysztof Kozlowski (4):
Merge tag 'mtk-soc-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Merge tag 'sunxi-drivers-for-7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers
Merge tag 'aspeed-7.2-drivers-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers
Linus Walleij (1):
Merge tag 'zynqmp-soc-for-7.2' of https://github.com/Xilinx/linux-xlnx into soc/drivers
Arnd Bergmann (5):
Merge tag 'v7.2-qcom-pinctrl-defconfigs' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into soc/defconfig
Merge tag 'cix-defconfig-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/defconfig
Merge tag 'at91-defconfig-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig
Merge tag 'imx-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/defconfig
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig
Krzysztof Kozlowski (11):
arm64: defconfig: Move entries to match savedefconfig
arm64: defconfig: Drop unused legacy netfilter options
arm64: defconfig: Drop default or selected drivers
arm64: defconfig: Drop unused Ethernet vendors
arm64: defconfig: Switch Ethernet drivers to modules
ARM: multi_v7_defconfig: Move entries to match savedefconfig
ARM: configs: Drop redundant I2C_DESIGNWARE_PLATFORM
ARM: configs: Drop redundant SND_ATMEL_SOC
ARM: multi_v7_defconfig: Cleanup redundant options
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
ARM: configs: Drop duplicated CONFIG_EXT4_FS
Manivannan Sadhasivam (1):
arm64: defconfig: Enable PCI M.2 power sequencing driver
Maxime Ripard (1):
ARM: multi_v7_defconfig: Enable dma-buf heaps
Ryan Chen (1):
arm64: configs: Update defconfig for AST2700 platform support
Arnd Bergmann (7):
ARM: select legacy gpiolib interfaces where used
Merge tag 'soc-pxa-gpio-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into soc/arm
Merge tag 'zx29-plat-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'ep93xx-20260529' of https://git.kernel.org/pub/scm/linux/kernel/git/asv/linux into soc/arm
Merge tag 'imx-soc-updates-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/arm
Merge tag 'omap-for-v7.2/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm
Merge tag 'mvebu-arm-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/arm
Bartosz Golaszewski (1):
arm64: Kconfig: drop unneeded dependency on OF_GPIO for ARCH_MVEBU
Ethan Nelson-Moore (1):
ARM: remove the last few uses of do_bad_IRQ()
Linus Walleij (2):
Merge tag 'zx29-docfix-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'samsung-soc-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm
Prasad Bolisetty (1):
MAINTAINERS: Add Axiado reviewer and Maintainers
^ permalink raw reply
* [PATCH v2] media: meson: vdec: fix use-after-free of decode work in stop/close path
From: Doruk Tan Ozturk @ 2026-06-16 7:49 UTC (permalink / raw)
To: neil.armstrong, mchehab, gregkh, khilman
Cc: jbrunet, martin.blumenstingl, hverkuil, linux-media,
linux-amlogic, linux-staging, linux-arm-kernel, linux-kernel,
Doruk Tan Ozturk, stable
The ESPARSER worker (esparser_queue_all_src(), scheduled via
sess->esparser_queue_work) dereferences sess->m2m_ctx and accesses the
ESPARSER/DOS registers. On the stop_streaming()/release() paths the
buffers and, on close, the m2m context are torn down while this worker
may still be pending or running, leading to a use-after-free of the
freed session state.
vdec_poweroff() previously only called vdec_ops->stop() and disabled the
clocks; it never synchronized against the worker. Two problems follow:
- The decode (VDEC) interrupt is threaded
(devm_request_threaded_irq(.., vdec_isr, vdec_threaded_isr, ..)) and
its threaded handler re-arms the worker through amvdec_dst_buf_done()
-> schedule_work(&sess->esparser_queue_work). A handler that is still
in flight can therefore queue the worker again after teardown has
begun.
- The worker touches ESPARSER/DOS registers, so it must not run after
the clocks have been disabled.
Quiesce everything in vdec_poweroff(), in order, before disabling the
clocks: vdec_ops->stop() masks the VDEC interrupt in hardware so no new
IRQ can be raised; synchronize_irq() on the VDEC line then drains any
threaded handler still in flight (the only context that re-arms the
worker); cancel_work_sync() finally cancels/waits for the worker. After
this nothing can re-arm the work, and the worker can no longer run with
clocks disabled or against a freed m2m context.
Only the VDEC interrupt is synchronized: the ESPARSER interrupt handler
(esparser_isr()) only acknowledges the start-code-found status and wakes
the internal wait queue used by esparser_write_data(); it never touches
the session or schedules the worker, so it cannot re-arm it.
stop_streaming()/release() run under the video device lock, not under
sess->lock (the mutex the worker takes), so cancel_work_sync() here
cannot deadlock against the worker.
The VDEC IRQ number is now stored in struct amvdec_core so it is
available to synchronize_irq() at teardown.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
v2: also synchronize_irq() before cancelling the work, so a delayed
threaded IRQ cannot re-arm it after cancel_work_sync() (raised by
automated review). Only the VDEC IRQ is synchronized, as the
ESPARSER IRQ handler does not touch the session or schedule the work.
v1: https://lore.kernel.org/linux-media/20260615140529.52653-1-doruk@0sec.ai/
drivers/staging/media/meson/vdec/vdec.c | 21 +++++++++++++++++++++
drivers/staging/media/meson/vdec/vdec.h | 3 +++
2 files changed, 24 insertions(+)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4b77ec1af5a7..5304987546fa 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -123,6 +123,25 @@ static void vdec_poweroff(struct amvdec_session *sess)
codec_ops->drain(sess);
vdec_ops->stop(sess);
+
+ /*
+ * vdec_ops->stop() masks the VDEC interrupt at the hardware level, so
+ * no new IRQ can be raised past this point. The threaded ISR re-arms
+ * the ESPARSER worker via amvdec_dst_buf_done() (schedule_work()), so
+ * drain any in-flight handler before cancelling the worker, otherwise
+ * a late threaded IRQ could schedule it again after the cancel.
+ *
+ * The worker dereferences sess->m2m_ctx and touches the ESPARSER/DOS
+ * registers, so it must be cancelled while m2m_ctx is still valid and
+ * the clocks are still enabled, i.e. before the clk_disable below.
+ *
+ * This runs from the stop_streaming()/release() paths, which are
+ * serialized by the video device lock, not by sess->lock (the lock the
+ * worker takes), so cancel_work_sync() cannot deadlock here.
+ */
+ synchronize_irq(sess->core->vdec_irq);
+ cancel_work_sync(&sess->esparser_queue_work);
+
clk_disable_unprepare(sess->core->dos_clk);
clk_disable_unprepare(sess->core->dos_parser_clk);
}
@@ -1053,6 +1072,8 @@ static int vdec_probe(struct platform_device *pdev)
if (ret)
return ret;
+ core->vdec_irq = irq;
+
ret = esparser_init(pdev, core);
if (ret)
return ret;
diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/media/meson/vdec/vdec.h
index 7a5d8e871d70..9a50116a2665 100644
--- a/drivers/staging/media/meson/vdec/vdec.h
+++ b/drivers/staging/media/meson/vdec/vdec.h
@@ -66,6 +66,8 @@ struct amvdec_session;
* @v4l2_dev: v4l2 device
* @cur_sess: current decoding session
* @lock: video device lock
+ * @vdec_irq: IRQ line of the VDEC, used to synchronize the threaded ISR
+ * against teardown
*/
struct amvdec_core {
void __iomem *dos_base;
@@ -91,6 +93,7 @@ struct amvdec_core {
struct amvdec_session *cur_sess;
struct mutex lock;
+ int vdec_irq;
};
/**
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v6] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
From: Karthikeyan KS @ 2026-06-16 7:30 UTC (permalink / raw)
To: andrew
Cc: joel, andrew, Kees Cook, linux-arm-kernel, linux-aspeed,
linux-kernel, linux-hardening
In-Reply-To: <033f2657ae6a94ad13d22f717a2900afb75d892d.camel@codeconstruct.com.au>
Hi Andrew,
Happy to. Short version: ast2600-evb can't hit the SMP timing window,
so I reproduce each missing piece deliberately. The driver code under
test is unmodified -- only the stimulus and the post-race state are
injected. Stock qemu-system-arm (Debian 8.2.2), no QEMU changes.
Three obstacles, and what I did about each:
1. No BIOS to emit POST codes -- an injection module stages bytes into
the snoop registers via the LPC syscon regmap (SNPWDR + the HICR6
data-ready bit).
2. QEMU doesn't raise the snoop IRQ for those writes -- after staging,
the module dispatches it in software with
generic_handle_irq_safe(sdev->irq), which runs the driver's real
aspeed_lpc_snoop_irq() -> put_fifo_with_discard() path.
3. The SMP race won't trigger under TCG -- so I reconstruct its outcome
instead: force the channel-0 kfifo to in=4097, out=1, i.e.
(in - out) = 4096 > the 2048-byte ring, the exact state a reader
observes inside the window.
One caveat so it isn't misread: step 3 writes in/out directly, so it
bypasses the new lock. The patched run therefore shows the read path no
longer turns a corrupt (in - out) into a usercopy overflow; the lock's
job of preventing that state is the SPSC argument from the commit, which
TCG can't exercise.
== Tree / config ==
base: v7.1-rc7
clang: 22.1.7 (LLVM=-22; needed for the context-analysis check)
ARM multi_v7_defconfig + CONFIG_CC_IS_CLANG, WARN_CONTEXT_ANALYSIS,
SMP, ASPEED_LPC_SNOOP, HARDENED_USERCOPY, PROVE_LOCKING,
DEBUG_ATOMIC_SLEEP.
make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- LLVM=-22 O=build \
-j$(nproc) zImage
== Run ==
The injection module (full source below the sign-off) creates two
write-only sysfs knobs under /sys/kernel/snoop_test/. The init loads it,
then:
echo 4096 > /sys/kernel/snoop_test/generate # fill via the real
# IRQ path
echo 1 > /sys/kernel/snoop_test/adjust_ptrs # force in=4097/out=1
read(fd, buf, 4096) from /dev/aspeed-lpc-snoop0 # the overflowing read
Build it against the same tree (-DSNOOP_PATCHED for v6, which mirrors the
spinlock the fix adds ahead of @fifo; omit it for the unpatched build).
qemu-system-arm -M ast2600-evb -smp 2 \
-kernel build/arch/arm/boot/zImage \
-dtb build/arch/arm/boot/dts/aspeed/aspeed-ast2600-evb.dtb \
-initrd repro.cpio.gz \
-append "console=ttyS4,115200 panic=-1" -nographic -no-reboot
== Result ==
Unpatched, read(4096) with in=4097/out=1:
usercopy: Kernel memory exposure attempt detected from SLUB object
'kmalloc-2k' (offset 0, size 2049)!
kfifo_copy_to_user / __kfifo_to_user / snoop_file_read / vfs_read
Kernel panic - not syncing: Fatal exception
Patched: read() returns 2048, no panic; no lockdep or atomic-sleep
splats.
The init is just: mount proc/sysfs/devtmpfs, finit_module() the .ko,
write the two knobs above, then read(4096) from the char device. Full
injection module follows.
Thanks,
Karthikeyan
------ snoop_test_inject.c (build as an out-of-tree module) ------
// SPDX-License-Identifier: GPL-2.0
/*
* Reproduce the aspeed-lpc-snoop kfifo SPSC-violation post-race state
* deterministically under QEMU. Two write-only sysfs knobs under
* /sys/kernel/snoop_test/:
*
* generate <count> Push <count> POST-code bytes through the *real*
* driver IRQ path: write SNPWDR + HICR6 via the LPC
* syscon regmap, then dispatch the snoop IRQ so
* aspeed_lpc_snoop_irq() -> put_fifo_with_discard()
* runs.
*
* adjust_ptrs <1> Force the channel-0 kfifo into the state a reader
* observes inside the race window: in = 4097,
* out = 1, so (in - out) = 4096 > the 2048-byte ring.
*
* The driver's private channel is reached through a mirror struct whose
* layout must match drivers/soc/aspeed/aspeed-lpc-snoop.c. The v6 fix
* inserts a spinlock_t ahead of @fifo -- build with -DSNOOP_PATCHED to
* mirror that, otherwise the &fifo offset is wrong.
*/
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/kfifo.h>
#include <linux/miscdevice.h>
#include <linux/regmap.h>
#include <linux/interrupt.h>
#include <linux/irq.h>
#include <linux/irqdesc.h>
#include <linux/device.h>
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/wait.h>
#include <linux/spinlock.h>
#include <linux/bitops.h>
#define HICR6 0x84
#define HICR6_STR_SNP0W BIT(0)
#define SNPWDR 0x94
#define SNOOP_DEV "/dev/aspeed-lpc-snoop0"
#define RACE_OUT 1u
#define RACE_IN 4097u
struct snoop_chan_mirror {
const void *cfg;
bool enabled;
#ifdef SNOOP_PATCHED
spinlock_t lock; /* added by the fix */
#endif
struct kfifo fifo;
wait_queue_head_t wq;
struct miscdevice miscdev;
};
struct snoop_dev_mirror {
struct regmap *regmap;
int irq;
/* struct clk *clk; struct aspeed_lpc_snoop_channel chan[2]; follow */
};
static struct file *snoop_open(struct snoop_chan_mirror **chan_out)
{
struct file *filp;
struct miscdevice *md;
filp = filp_open(SNOOP_DEV, O_RDONLY | O_NONBLOCK, 0);
if (IS_ERR(filp))
return filp;
md = filp->private_data;
if (!md) {
filp_close(filp, NULL);
return ERR_PTR(-ENODEV);
}
*chan_out = container_of(md, struct snoop_chan_mirror, miscdev);
return filp;
}
static ssize_t generate_store(struct kobject *kobj, struct kobj_attribute *attr,
const char *buf, size_t len)
{
struct snoop_chan_mirror *chan;
struct snoop_dev_mirror *sdev;
struct file *filp;
unsigned int count, i;
int rc;
rc = kstrtouint(buf, 0, &count);
if (rc)
return rc;
filp = snoop_open(&chan);
if (IS_ERR(filp))
return PTR_ERR(filp);
sdev = dev_get_drvdata(chan->miscdev.parent);
if (!sdev || !sdev->regmap || sdev->irq <= 0) {
filp_close(filp, NULL);
return -ENODEV;
}
for (i = 0; i < count; i++) {
/* Stage the snoop'ed byte and the data-ready status bit. */
regmap_write(sdev->regmap, SNPWDR, (u32)(i & 0xff));
regmap_write(sdev->regmap, HICR6, HICR6_STR_SNP0W);
/*
* Dispatch IRQ -> aspeed_lpc_snoop_irq() ->
* put_fifo_with_discard(). generic_handle_irq_safe() copes
* with the GIC requiring the handler to run with IRQs off.
*/
generic_handle_irq_safe(sdev->irq);
}
filp_close(filp, NULL);
return len;
}
static ssize_t adjust_ptrs_store(struct kobject *kobj, struct kobj_attribute *attr,
const char *buf, size_t len)
{
struct snoop_chan_mirror *chan;
struct file *filp;
struct __kfifo *kf;
unsigned int val;
int rc;
rc = kstrtouint(buf, 0, &val);
if (rc)
return rc;
if (val != 1)
return -EINVAL;
filp = snoop_open(&chan);
if (IS_ERR(filp))
return PTR_ERR(filp);
kf = &chan->fifo.kfifo;
/* Reproduce the race outcome: fresh 'in', stale 'out'. */
WRITE_ONCE(kf->out, RACE_OUT);
WRITE_ONCE(kf->in, RACE_IN);
pr_info("snoop_test: in=%u out=%u (in-out=%u, size=%u)\n",
kf->in, kf->out, kf->in - kf->out, kf->mask + 1);
filp_close(filp, NULL);
return len;
}
static struct kobj_attribute generate_attr =
__ATTR(generate, 0220, NULL, generate_store);
static struct kobj_attribute adjust_ptrs_attr =
__ATTR(adjust_ptrs, 0220, NULL, adjust_ptrs_store);
static struct attribute *snoop_attrs[] = {
&generate_attr.attr,
&adjust_ptrs_attr.attr,
NULL,
};
static const struct attribute_group snoop_group = { .attrs = snoop_attrs };
static struct kobject *snoop_kobj;
static int __init snoop_test_init(void)
{
int rc;
snoop_kobj = kobject_create_and_add("snoop_test", kernel_kobj);
if (!snoop_kobj)
return -ENOMEM;
rc = sysfs_create_group(snoop_kobj, &snoop_group);
if (rc) {
kobject_put(snoop_kobj);
return rc;
}
return 0;
}
static void __exit snoop_test_exit(void)
{
sysfs_remove_group(snoop_kobj, &snoop_group);
kobject_put(snoop_kobj);
}
module_init(snoop_test_init);
module_exit(snoop_test_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("aspeed-lpc-snoop kfifo race post-state reproducer");
^ permalink raw reply
* [PATCH v4] arm64: dts: imx94: Add Root Port node and PERST property
From: hongxing.zhu @ 2026-06-16 7:23 UTC (permalink / raw)
To: sherry.sun, robh, krzk+dt, conor+dt, frank.li, s.hauer, festevam
Cc: kernel, devicetree, imx, linux-arm-kernel, linux-kernel,
Richard Zhu
From: Richard Zhu <hongxing.zhu@nxp.com>
Since describing the PCIe PERST# property under Host Bridge node is now
deprecated, it is recommended to add it to the Root Port node, so
creating the Root Port node and add the reset-gpios property in Root
Port.
Move the regulator to Root Port nodes as well, because that the PCI
pwrctrl framework had been integrated into pci-imx6 driver.
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
---
arch/arm64/boot/dts/freescale/imx94.dtsi | 11 +++++++++++
arch/arm64/boot/dts/freescale/imx943-evk.dts | 14 ++++++++++----
arch/arm64/boot/dts/freescale/imx943.dtsi | 11 +++++++++++
3 files changed, 32 insertions(+), 4 deletions(-)
---
Changes in v4:
Add the description of regualtor changes into commit message too.
Changes in v3:
- Move the regulator to Root Port node as well, since [2] had been
settled.
- Collect Reviewed-by tag issued by Sherry.
Changes in v2:
- Delete reset-gpio properties in PCIe bridge node.
- Correct the "reset-gpio" property to "reset-gpios".
Since the patch-set [1] issued by Sherry had been landed. Add according
changes on i.MX943 board too.
[1] https://lkml.org/lkml/2026/6/1/1461
[2] https://lore.kernel.org/imx/20260520084904.2424253-1-sherry.sun@oss.nxp.com/
diff --git a/arch/arm64/boot/dts/freescale/imx94.dtsi b/arch/arm64/boot/dts/freescale/imx94.dtsi
index 1f9035e6cf159..dfbb73603cb24 100644
--- a/arch/arm64/boot/dts/freescale/imx94.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx94.dtsi
@@ -1411,6 +1411,17 @@ pcie0: pcie@4c300000 {
power-domains = <&scmi_devpd IMX94_PD_HSIO_TOP>;
fsl,max-link-speed = <3>;
status = "disabled";
+
+ pcie0_port0: pcie@0 {
+ compatible = "pciclass,0604";
+ device_type = "pci";
+ reg = <0x0 0x0 0x0 0x0 0x0>;
+ bus-range = <0x01 0xff>;
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+ ranges;
+ };
};
pcie0_ep: pcie-ep@4c300000 {
diff --git a/arch/arm64/boot/dts/freescale/imx943-evk.dts b/arch/arm64/boot/dts/freescale/imx943-evk.dts
index 7cfd424689507..674410e541cba 100644
--- a/arch/arm64/boot/dts/freescale/imx943-evk.dts
+++ b/arch/arm64/boot/dts/freescale/imx943-evk.dts
@@ -1034,12 +1034,15 @@ &pcie0 {
<&pcie_ref_clk>;
clock-names = "pcie", "pcie_bus", "pcie_phy", "pcie_aux",
"ref", "extref";
- reset-gpio = <&pcal6416_i2c3_u46 3 GPIO_ACTIVE_LOW>;
- vpcie3v3aux-supply = <®_m2_wlan>;
supports-clkreq;
status = "okay";
};
+&pcie0_port0 {
+ reset-gpios = <&pcal6416_i2c3_u46 3 GPIO_ACTIVE_LOW>;
+ vpcie3v3aux-supply = <®_m2_wlan>;
+};
+
&pcie0_ep {
pinctrl-0 = <&pinctrl_pcie0>;
pinctrl-names = "default";
@@ -1058,12 +1061,15 @@ &pcie1 {
<&pcie_ref_clk>;
clock-names = "pcie", "pcie_bus", "pcie_phy", "pcie_aux",
"ref", "extref";
- reset-gpio = <&pcal6416_i2c3_u46 1 GPIO_ACTIVE_LOW>;
- vpcie3v3aux-supply = <®_slot_pwr>;
supports-clkreq;
status = "okay";
};
+&pcie1_port0 {
+ reset-gpios = <&pcal6416_i2c3_u46 1 GPIO_ACTIVE_LOW>;
+ vpcie3v3aux-supply = <®_slot_pwr>;
+};
+
&pcie1_ep {
pinctrl-0 = <&pinctrl_pcie1>;
pinctrl-names = "default";
diff --git a/arch/arm64/boot/dts/freescale/imx943.dtsi b/arch/arm64/boot/dts/freescale/imx943.dtsi
index cf5b3dbb47ff7..01152fd0efa5e 100644
--- a/arch/arm64/boot/dts/freescale/imx943.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx943.dtsi
@@ -255,6 +255,17 @@ pcie1: pcie@4c380000 {
power-domains = <&scmi_devpd IMX94_PD_HSIO_TOP>;
fsl,max-link-speed = <3>;
status = "disabled";
+
+ pcie1_port0: pcie@0 {
+ compatible = "pciclass,0604";
+ device_type = "pci";
+ reg = <0x0 0x0 0x0 0x0 0x0>;
+ bus-range = <0x01 0xff>;
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+ ranges;
+ };
};
pcie1_ep: pcie-ep@4c380000 {
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 3/4] mfd: mt6397-core: add mt6323 AUXADC support
From: Andy Shevchenko @ 2026-06-16 7:18 UTC (permalink / raw)
To: Roman Vivchar
Cc: Lee Jones, Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Matthias Brugger, AngeloGioacchino Del Regno, linux-iio,
devicetree, linux-kernel, linux-arm-kernel, linux-mediatek,
Ben Grisdale
In-Reply-To: <ycj3k-vV_tQv6u9OfCTP9G9kkeeE-_dbzg_oeHPXn2pb1oZe_Sa1BH6GUGuSd_gD6uPSJiTX7tz6MTlFcqGdWX-f3GMfyW2sLgAOCw6YeNE=@protonmail.com>
On Mon, Jun 15, 2026 at 11:10:20PM +0000, Roman Vivchar wrote:
> On Thursday, June 11th, 2026 at 7:37 PM, Lee Jones <lee@kernel.org> wrote:
> > On Tue, 02 Jun 2026, Roman Vivchar via B4 Relay wrote:
...
> > > + .of_compatible = "mediatek,mt6323-auxadc",
> >
> > [Severity: High]
> > Does adding this compatible string expose an unhandled edge case in the
> > auxadc driver?
> >
> > If this device is instantiated directly from a Device Tree without an MFD
> > parent (e.g., at the DT root), dev->parent could be the platform bus
> > (which has a NULL parent) or NULL itself.
> >
> > Looking at mt6323_auxadc_probe() in drivers/iio/adc/mt6323-auxadc.c:
> >
> > regmap = dev_get_regmap(dev->parent->parent, NULL);
> >
> > Could blindly dereferencing dev->parent->parent here, or passing a NULL
> > device to dev_get_regmap() (which calls devres_find()), result in a
> > kernel oops if probed as a root node?
>
> This is intended behavior, ADC always should be probed as a child of
> the mt6323 MFD because it doesn't have own MMIO space. Otherwise the
> devicetree is malformed. Recent mt6359 ADC driver has same thing with
> dev->parent->parent regmap.
I think Sashiko is overprotective here, but if changing, the whole lot of MFD
drivers should be changed (like Rafael recently has done for driver_override
issue in ACPI related drivers).
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 2/4] iio: adc: mt6323-auxadc: add mt6323 PMIC AUXADC driver
From: Andy Shevchenko @ 2026-06-16 7:15 UTC (permalink / raw)
To: Roman Vivchar
Cc: Jonathan Cameron, Roman Vivchar via B4 Relay, David Lechner,
Nuno Sá, Andy Shevchenko, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Matthias Brugger, AngeloGioacchino Del Regno,
Lee Jones, linux-iio, devicetree, linux-kernel, linux-arm-kernel,
linux-mediatek, Ben Grisdale
In-Reply-To: <E5H72l1Cg-JQGpaYAFl5TIyITmghqMsTaHQTR8VkuFtlzmfCGTpVlceNp8c2BDW7UoheO0Fx6NLJHmu56WHRNWdPNLsaoIKMCftj_bnyvEI=@protonmail.com>
On Mon, Jun 15, 2026 at 10:52:57PM +0000, Roman Vivchar wrote:
> On Sunday, June 14th, 2026 at 8:22 PM, Jonathan Cameron <jic23@kernel.org> wrote:
> > On Tue, 09 Jun 2026 16:31:59 +0300
> > Roman Vivchar via B4 Relay <devnull+rva333.protonmail.com@kernel.org> wrote:
...
> > > +/*
> > > + * The MediaTek MT6323 (as well as a lot of other PMICs) has the following hierarchy:
> > > + * PMIC AUXADC <- PMIC MFD <- SoC PWRAP (wrapper for PWRAP FSM)
> > > + *
> > > + * Therefore, PWRAP regmap should be obtained using dev->parent->parent.
> > > + */
> > > +struct mt6323_auxadc {
> > > + struct regmap *regmap;
> > > + struct mutex lock;
> > Locks should always have a comment on what data they are protecting.
> > I think this one is about protecting the state of a device during a channel read
> > by serializing those reads.
>
> Nuno said kerneldoc looks unnecessary on v1 [1]. How the comment should
> look?
The comment near to the member:
/* Why this lock? */
struct mutex lock;
...
> After these changes, should I keep or drop Andy's Reviewed-by?
Keep it, the above mentioned changes does not affect on that.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [PATCH v3 3/3] dt-bindings: perf: marvell: add CN20K TAD PMU support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
Marvell CN20K SoCs integrate a Performance Monitoring Unit (PMU)
associated with the LLC Tag-and-Data (TAD) blocks. The PMU provides
hardware counters to monitor cache traffic and performance events
via a dedicated MMIO region.
The CN20K LLC-TAD PMU is largely similar to CN10K, but differs in the
layout of PFC/PRF register offsets relative to each TAD base. These
offsets are derived from the compatible string in the driver and are
not described through Devicetree properties.
Because of this, using "marvell,cn10k-tad-pmu" as a fallback for CN20K
would result in incorrect register programming. Therefore, add a
separate compatible string:
"marvell,cn20k-tad-pmu"
Update the binding to document CN20K alongside CN10K.
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
.../bindings/perf/marvell-cn10k-tad.yaml | 25 +++++++++++++------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml b/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
index 362142252667..d11121a1e2c9 100644
--- a/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
+++ b/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
@@ -4,23 +4,32 @@
$id: http://devicetree.org/schemas/perf/marvell-cn10k-tad.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Marvell CN10K LLC-TAD performance monitor
+title: Marvell CN10K / CN20K LLC-TAD performance monitor
maintainers:
- Bhaskara Budiredla <bbudiredla@marvell.com>
+ - Geetha sowjanya <gakula@marvell.com>
description: |
- The Tag-and-Data units (TADs) maintain coherence and contain CN10K
- shared on-chip last level cache (LLC). The tad pmu measures the
- performance of last-level cache. Each tad pmu supports up to eight
- counters.
+ The Tag-and-Data units (TADs) maintain coherence and contain the
+ shared on-chip last level cache (LLC) on Marvell CN10K and CN20K SoCs.
+ The TAD PMU measures last-level cache performance. Each TAD PMU
+ supports up to eight counters.
- The DT setup comprises of number of tad blocks, the sizes of pmu
- regions, tad blocks and overall base address of the HW.
+ The DT setup describes the number of TAD blocks, the sizes of PMU
+ regions and TAD pages, and the overall MMIO base of the hardware.
+
+ marvell,cn20k-tad-pmu is not a compatible fallback for
+ marvell,cn10k-tad-pmu (and vice versa): the driver selects different
+ PFC/PRF MMIO offsets from the compatible string, and those offsets are
+ not described by separate DT properties today.
properties:
compatible:
- const: marvell,cn10k-tad-pmu
+ items:
+ - enum:
+ - marvell,cn10k-tad-pmu
+ - marvell,cn20k-tad-pmu
reg:
maxItems: 1
--
2.25.1
^ permalink raw reply related
* [PATCH v3 2/3] perf: marvell: Add CN20K LLC-TAD PMU support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
Add support for the LLC Tag-and-Data (TAD) PMU present in
Marvell CN20K SoCs.
The CN20K TAD PMU is based on the CN10K design but differs in the
layout of PFC/PRF register offsets relative to each TAD base, and
introduces additional events. These offsets are selected by the driver
based on the compatible string and are not described via DT properties.
Because of this, "marvell,cn10k-tad-pmu" cannot be used as a fallback
for CN20K, as it would result in incorrect register programming.
Add support for "marvell,cn20k-tad-pmu" by:
- Introducing a TAD_PMU_V3 profile with CN20K-specific register bases
- Extending the event map for new CN20K events
- Matching the PMU via OF and ACPI (MRVL000F)
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
---
Changelog (since v2)
--------------------
- Validate the eventId using an appropriate mask to ensure
it is restricted to 8 bits.
Changelog (since v1)
--------------------
- Hide V3-only events on CN10K via sysfs is_visible and reject them in
event_init.
- Use CN20K-specific MPAM PRF bits (MATCH_MPAMNS, partid << 10) for V3;
software partid is limited to nine bits so this does not collide with
the fixed bit at 25.
- Reset hwc->prev_count when starting counters so reads match cleared HW.
drivers/perf/marvell_cn10k_tad_pmu.c | 54 ++++++++++++++++++++++++++--
1 file changed, 52 insertions(+), 2 deletions(-)
diff --git a/drivers/perf/marvell_cn10k_tad_pmu.c b/drivers/perf/marvell_cn10k_tad_pmu.c
index 69a6648fa664..cd81bf8ff569 100644
--- a/drivers/perf/marvell_cn10k_tad_pmu.c
+++ b/drivers/perf/marvell_cn10k_tad_pmu.c
@@ -17,11 +17,14 @@
#define TAD_PRF_OFFSET 0x900
#define TAD_PFC_OFFSET 0x800
+#define TAD_PRF_NS_OFFSET 0x30900
+#define TAD_PFC_NS_OFFSET 0x30800
#define TAD_PFC(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF_CNTSEL_MASK 0xFF
#define TAD_PRF_MATCH_PARTID BIT(8)
#define TAD_PRF_PARTID_NS BIT(10)
+#define TAD_PRF_MATCH_MPAMNS BIT(25)
/*
* config1: bits 0..8 MPAM partition id (including 0); bit 9 requests
* filtering for MPAM-capable events. All-zero config1 means no filter.
@@ -39,6 +42,7 @@ struct tad_region {
enum mrvl_tad_pmu_version {
TAD_PMU_V1 = 1,
TAD_PMU_V2,
+ TAD_PMU_V3,
};
struct tad_pmu_data {
@@ -86,8 +90,15 @@ static void tad_pmu_start_counter(struct tad_pmu *pmu,
if (use_mpam && event_idx > 0x19 && event_idx < 0x21) {
partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_PARTID_NS |
((u64)partid << 11);
+
+ if (pdata->id == TAD_PMU_V3)
+ partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_MATCH_MPAMNS |
+ ((u64)partid << 10);
}
+ /* CN10K support events 0:24*/
+ if (pdata->id == TAD_PMU_V1 && event_idx >= 0x25)
+ return;
for (i = 0; i < pmu->region_cnt; i++) {
reg_val = event_idx & 0xFF;
@@ -160,6 +171,7 @@ static void tad_pmu_event_counter_start(struct perf_event *event, int flags)
struct hw_perf_event *hwc = &event->hw;
hwc->state = 0;
+ local64_set(&hwc->prev_count, 0);
tad_pmu->ops->start_counter(tad_pmu, event);
}
@@ -220,6 +232,8 @@ static int tad_pmu_event_init(struct perf_event *event)
if (cfg1)
return -EINVAL;
} else {
+ if (pdata->id == TAD_PMU_V1 && event_idx >= 0x25)
+ return -EINVAL;
if ((cfg1 & GENMASK(8, 0)) && !(cfg1 & TAD_PARTID_FILTER_EN))
return -EINVAL;
if (cfg1 & TAD_PARTID_FILTER_EN) {
@@ -246,6 +260,22 @@ static ssize_t tad_pmu_event_show(struct device *dev,
return sysfs_emit(page, "event=0x%02llx\n", pmu_attr->id);
}
+static umode_t tad_pmu_event_attr_is_visible(struct kobject *kobj,
+ struct attribute *attr, int unused)
+{
+ struct pmu *pmu = dev_get_drvdata(kobj_to_dev(kobj));
+ struct tad_pmu *t = to_tad_pmu(pmu);
+ struct device_attribute *da = container_of(attr, struct device_attribute,
+ attr);
+ struct perf_pmu_events_attr *e = container_of(da, struct perf_pmu_events_attr,
+ attr);
+ u64 id = e->id;
+
+ if (t->pdata->id != TAD_PMU_V3 && id >= 0x25)
+ return 0;
+ return attr->mode;
+}
+
#define TAD_PMU_EVENT_ATTR(name, config) \
PMU_EVENT_ATTR_ID(name, tad_pmu_event_show, config)
@@ -287,12 +317,25 @@ static struct attribute *tad_pmu_event_attrs[] = {
TAD_PMU_EVENT_ATTR(tad_dat_rd_byp, 0x22),
TAD_PMU_EVENT_ATTR(tad_ifb_occ, 0x23),
TAD_PMU_EVENT_ATTR(tad_req_occ, 0x24),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dtg_evict, 0x25),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_ltg_evict, 0x26),
+ TAD_PMU_EVENT_ATTR(tad_rsp_msh_out_mpam, 0x28),
+ TAD_PMU_EVENT_ATTR(tad_replays, 0x29),
+ TAD_PMU_EVENT_ATTR(tad_req_byp0, 0x2a),
+ TAD_PMU_EVENT_ATTR(tad_req_byp1, 0x2b),
+ TAD_PMU_EVENT_ATTR(tad_txreq_byp, 0x2c),
+ TAD_PMU_EVENT_ATTR(tad_time_in_dslp, 0x2d),
+ TAD_PMU_EVENT_ATTR(tad_time_elapsed, 0x2e),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dss_rd_128mrg, 0x2f),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dss_wr_128mrg, 0x30),
+ TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xff),
NULL
};
static const struct attribute_group tad_pmu_events_attr_group = {
.name = "events",
.attrs = tad_pmu_event_attrs,
+ .is_visible = tad_pmu_event_attr_is_visible,
};
static struct attribute *ody_tad_pmu_event_attrs[] = {
@@ -478,7 +521,7 @@ static int tad_pmu_probe(struct platform_device *pdev)
.read = tad_pmu_event_counter_read,
};
- if (version == TAD_PMU_V1) {
+ if (version == TAD_PMU_V1 || version == TAD_PMU_V3) {
tad_pmu->pmu.attr_groups = tad_pmu_attr_groups;
tad_pmu->ops = &tad_pmu_ops;
} else {
@@ -521,6 +564,11 @@ static const struct tad_pmu_data tad_pmu_data = {
.tad_pfc_offset = TAD_PFC_OFFSET,
};
+static const struct tad_pmu_data tad_pmu_cn20k_data = {
+ .id = TAD_PMU_V3,
+ .tad_prf_offset = TAD_PRF_NS_OFFSET,
+ .tad_pfc_offset = TAD_PFC_NS_OFFSET,
+};
#endif
#ifdef CONFIG_ACPI
@@ -534,6 +582,7 @@ static const struct tad_pmu_data tad_pmu_v2_data = {
#ifdef CONFIG_OF
static const struct of_device_id tad_pmu_of_match[] = {
{ .compatible = "marvell,cn10k-tad-pmu", .data = &tad_pmu_data },
+ { .compatible = "marvell,cn20k-tad-pmu", .data = &tad_pmu_cn20k_data },
{},
};
#endif
@@ -542,6 +591,7 @@ static const struct of_device_id tad_pmu_of_match[] = {
static const struct acpi_device_id tad_pmu_acpi_match[] = {
{"MRVL000B", (kernel_ulong_t)&tad_pmu_data},
{"MRVL000D", (kernel_ulong_t)&tad_pmu_v2_data},
+ {"MRVL000F", (kernel_ulong_t)&tad_pmu_cn20k_data},
{},
};
MODULE_DEVICE_TABLE(acpi, tad_pmu_acpi_match);
@@ -603,6 +653,6 @@ static void __exit tad_pmu_exit(void)
module_init(tad_pmu_init);
module_exit(tad_pmu_exit);
-MODULE_DESCRIPTION("Marvell CN10K LLC-TAD perf driver");
+MODULE_DESCRIPTION("Marvell CN10K/CN20K LLC-TAD perf driver");
MODULE_AUTHOR("Bhaskara Budiredla <bbudiredla@marvell.com>");
MODULE_LICENSE("GPL v2");
--
2.25.1
^ permalink raw reply related
* Patch "arm64/mm: Enable batched TLB flush in unmap_hotplug_range()" has been added to the 5.10-stable tree
From: gregkh @ 2026-06-16 7:10 UTC (permalink / raw)
To: anshuman.khandual, catalin.marinas, david, gregkh,
linux-arm-kernel, ryan.roberts, sashal, will
Cc: stable-commits
In-Reply-To: <20260428200548.3191346-1-sashal@kernel.org>
This is a note to let you know that I've just added the patch titled
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable+bounces-241768-greg=kroah.com@vger.kernel.org Wed Apr 29 01:35:55 2026
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 28 Apr 2026 16:05:48 -0400
Subject: arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
To: stable@vger.kernel.org
Cc: Anshuman Khandual <anshuman.khandual@arm.com>, Will Deacon <will@kernel.org>, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, "David Hildenbrand (Arm)" <david@kernel.org>, Ryan Roberts <ryan.roberts@arm.com>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260428200548.3191346-1-sashal@kernel.org>
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ]
During a memory hot remove operation, both linear and vmemmap mappings for
the memory range being removed, get unmapped via unmap_hotplug_range() but
mapped pages get freed only for vmemmap mapping. This is just a sequential
operation where each table entry gets cleared, followed by a leaf specific
TLB flush, and then followed by memory free operation when applicable.
This approach was simple and uniform both for vmemmap and linear mappings.
But linear mapping might contain CONT marked block memory where it becomes
necessary to first clear out all entire in the range before a TLB flush.
This is as per the architecture requirement. Hence batch all TLB flushes
during the table tear down walk and finally do it in unmap_hotplug_range().
Prior to this fix, it was hypothetically possible for a speculative access
to a higher address in the contiguous block to fill the TLB with shattered
entries for the entire contiguous range after a lower address had already
been cleared and invalidated. Due to the table entries being shattered, the
subsequent TLB invalidation for the higher address would not then clear the
TLB entries for the lower address, meaning stale TLB entries could persist.
Besides it also helps in improving the performance via TLBI range operation
along with reduced synchronization instructions. The time spent executing
unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal
in KVM guest.
This scheme is not applicable during vmemmap mapping tear down where memory
needs to be freed and hence a TLB flush is required after clearing out page
table entry.
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/
Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove")
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ renamed `__pte_clear()` to `pte_clear()` and inlined `pmd_cont(pmd)` as `pmd_val(pmd) & PMD_SECT_CONT` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -862,10 +862,14 @@ static void unmap_hotplug_pte_range(pmd_
WARN_ON(!pte_present(pte));
pte_clear(&init_mm, addr, ptep);
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pte_cont(pte));
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pte_page(pte),
PAGE_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
} while (addr += PAGE_SIZE, addr < end);
}
@@ -886,15 +890,14 @@ static void unmap_hotplug_pmd_range(pud_
WARN_ON(!pmd_present(pmd));
if (pmd_sect(pmd)) {
pmd_clear(pmdp);
-
- /*
- * One TLBI should be sufficient here as the PMD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pmd_val(pmd) & PMD_SECT_CONT);
+ flush_tlb_kernel_range(addr, addr + PMD_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pmd_table(pmd));
@@ -919,15 +922,12 @@ static void unmap_hotplug_pud_range(p4d_
WARN_ON(!pud_present(pud));
if (pud_sect(pud)) {
pud_clear(pudp);
-
- /*
- * One TLBI should be sufficient here as the PUD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ flush_tlb_kernel_range(addr, addr + PUD_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pud_table(pud));
@@ -957,6 +957,7 @@ static void unmap_hotplug_p4d_range(pgd_
static void unmap_hotplug_range(unsigned long addr, unsigned long end,
bool free_mapped, struct vmem_altmap *altmap)
{
+ unsigned long start = addr;
unsigned long next;
pgd_t *pgdp, pgd;
@@ -978,6 +979,9 @@ static void unmap_hotplug_range(unsigned
WARN_ON(!pgd_present(pgd));
unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap);
} while (addr = next, addr < end);
+
+ if (!free_mapped)
+ flush_tlb_kernel_range(start, end);
}
static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
Patches currently in stable-queue which might be from sashal@kernel.org are
queue-5.10/team-move-team-device-type-change-at-the-end-of-team.patch
queue-5.10/netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch
queue-5.10/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-5.10/spi-sun4i-fix-controller-deregistration.patch
queue-5.10/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-5.10/ice-fix-vf-queue-configuration-with-low-mtu-values.patch
queue-5.10/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-5.10/ktest-fixing-indentation-to-match-expected-pattern.patch
queue-5.10/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-5.10/spi-meson-spicc-fix-double-put-in-remove-path.patch
queue-5.10/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-5.10/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-5.10/mptcp-do-not-drop-partial-packets.patch
queue-5.10/bluetooth-hci_core-fix-use-after-free-in-vhci_flush.patch
queue-5.10/serial-qcom-geni-fix-uart_rx_par_en-bit-position.patch
queue-5.10/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-5.10/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-5.10/octeontx2-pf-avoid-double-free-of-pool-stack-on-aq-init-failure.patch
queue-5.10/net-hsr-defer-node-table-free-until-after-rcu-readers.patch
queue-5.10/f2fs-fix-incorrect-file-address-mapping-when-inline-inode-is-unwritten.patch
queue-5.10/phy-tegra-xusb-fix-per-pad-high-speed-termination-calibration.patch
queue-5.10/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-5.10/net-qrtr-ns-free-the-node-during-ctrl_cmd_bye.patch
queue-5.10/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-5.10/rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch-26331
queue-5.10/spi-ti-qspi-fix-controller-deregistration.patch
queue-5.10/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-5.10/smb-client-use-fullsessionkey-for-aes-256-encryption-key-derivation.patch
queue-5.10/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-5.10/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-5.10/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-5.10/ext4-validate-p_idx-bounds-in-ext4_ext_correct_index.patch
queue-5.10/spi-topcliff-pch-fix-controller-deregistration.patch
queue-5.10/spi-uniphier-fix-controller-deregistration.patch
queue-5.10/mtd-spi-nor-sst-fix-write-enable-before-aai-sequence.patch
queue-5.10/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-5.10/spi-syncuacer-fix-controller-deregistration.patch
queue-5.10/alsa-aoa-i2sbus-clear-stale-prepared-state.patch
queue-5.10/sched-use-u64-for-bandwidth-ratio-calculations.patch
queue-5.10/spi-tegra20-sflash-fix-controller-deregistration.patch
queue-5.10/usb-typec-ucsi-check-if-power-role-change-actually-happened-before-handling.patch
queue-5.10/rdma-umem-fix-kernel-doc-warnings.patch
queue-5.10/revert-rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch
queue-5.10/octeontx2-af-add-validation-for-lmac-type.patch
queue-5.10/can-ucan-fix-devres-lifetime.patch
queue-5.10/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-5.10/spi-qup-switch-to-use-modern-name.patch
queue-5.10/media-rc-igorplugusb-heed-coherency-rules.patch
queue-5.10/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-5.10/net-qrtr-ns-change-servers-radix-tree-to-xarray.patch
queue-5.10/qed-fix-double-free-in-qed_cxt_tables_alloc.patch
queue-5.10/usb-typec-ucsi-don-t-update-power_supply-on-power-role-change-if-not-connected.patch
queue-5.10/media-rc-ttusbir-respect-dma-coherency-rules.patch
queue-5.10/wifi-mac80211-check-tdls-flag-in-ieee80211_tdls_oper.patch
queue-5.10/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-5.10/tty-serial-qcom-geni-serial-remove-unused-symbols.patch
queue-5.10/tty-serial-qcom-geni-serial-align-define-values.patch
queue-5.10/bluetooth-fix-uaf-in-l2cap_sock_cleanup_listen-vs-l2cap_conn_del.patch
queue-5.10/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-5.10/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-5.10/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-5.10/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-5.10/can-ucan-fix-typos-in-comments.patch
queue-5.10/batman-adv-tp_meter-fix-race-condition-in-send-error.patch
queue-5.10/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-5.10/net-qrtr-ns-limit-the-total-number-of-nodes.patch
queue-5.10/spi-zynq-qspi-fix-controller-deregistration.patch
queue-5.10/serial-altera_jtaguart-handle-uart_add_one_port-failures.patch
queue-5.10/thunderbolt-property-cap-recursion-depth-in-__tb_property_parse_dir.patch
queue-5.10/serial-dz-fix-bootconsole-handover-lockup.patch
queue-5.10/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-5.10/octeontx2-af-cgx-add-bounds-check-to-cgx_speed_mbps-index.patch
queue-5.10/btrfs-fix-missing-last_unlink_trans-update-when-removing-a-directory.patch
queue-5.10/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-5.10/udf-fix-partition-descriptor-append-bookkeeping.patch
queue-5.10/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-5.10/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-5.10/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-5.10/rdma-umem-fix-truncation-for-block-sizes-4g.patch
queue-5.10/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-5.10/alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch
queue-5.10/hid-core-fix-size_t-specifier-in-hid_report_raw_even.patch
queue-5.10/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-5.10/bluetooth-init-sk_peer_-on-bt_sock_alloc.patch
queue-5.10/serial-altera_jtaguart-use-platform_get_irq_optional-to-get-the-interrupt.patch
queue-5.10/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-5.10/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-5.10/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-5.10/nfc-llcp-protect-nfc_llcp_sock_unlink-calls.patch
queue-5.10/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-5.10/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
queue-5.10/arm64-tlb-flush-walk-cache-when-unsharing-pmd-tables.patch
queue-5.10/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch
queue-5.10/spi-st-ssc4-fix-controller-deregistration.patch
queue-5.10/net-packet-fix-toctou-race-on-mmap-d-vnet_hdr-in-tpacket_snd.patch
queue-5.10/netfilter-nf_queue-hold-bridge-skb-dev-while-queued.patch
queue-5.10/drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-bounds-check.patch
queue-5.10/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-5.10/btrfs-fix-btrfs_ioctl_space_info-slot_count-toctou-which-can-lead-to-info-leak.patch
queue-5.10/io_uring-prevent-opcode-speculation.patch
queue-5.10/wifi-brcmfmac-fix-potential-use-after-free-issue-when-stopping-watchdog-task.patch
queue-5.10/hid-pass-the-buffer-size-to-hid_report_raw_event.patch
queue-5.10/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
queue-5.10/printk-add-print_hex_dump_devel.patch
queue-5.10/dm-thin-fix-metadata-refcount-underflow.patch
queue-5.10/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-5.10/tracing-probes-limit-size-of-event-probe-to-3k.patch
queue-5.10/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-5.10/mm-hugetlb_cma-round-up-per_node-before-logging-it.patch
queue-5.10/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-5.10/wifi-mwifiex-fix-use-after-free-in-mwifiex_adapter_cleanup.patch
queue-5.10/tracepoint-balance-regfunc-on-func_add-failure-in-tracepoint_add_func.patch
queue-5.10/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-5.10/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-5.10/compiler-clang.h-add-__diag-infrastructure-for-clang.patch
queue-5.10/spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch
queue-5.10/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-5.10/smb-client-fix-oob-read-in-smb2_ioctl_query_info-query_info-path.patch
queue-5.10/alsa-core-fix-potential-data-race-at-fasync-handling.patch
queue-5.10/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-5.10/batman-adv-tp_meter-avoid-role-confusion-in-tp_list.patch
queue-5.10/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-5.10/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-5.10/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-5.10/selftests-mptcp-drop-nanoseconds-width-specifier.patch
queue-5.10/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-5.10/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-5.10/hfsplus-fix-uninit-value-by-validating-catalog-record-size.patch
queue-5.10/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-5.10/alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
queue-5.10/rdma-move-dma-block-iterator-logic-into-dedicated-files.patch
queue-5.10/dm-btree-improve-btree-residency.patch
queue-5.10/page_pool-fix-use-after-free-in-page_pool_recycle_in.patch
queue-5.10/fbcon-avoid-oob-font-access-if-console-rotation-fails.patch
queue-5.10/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-5.10/qed-use-the-bitmap-api-to-simplify-some-functions.patch
queue-5.10/hid-core-add-printk_ratelimited-variants-to-hid_warn.patch
queue-5.10/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-5.10/usb-dwc3-move-guid-programming-after-phy-initialization.patch
queue-5.10/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-5.10/net-remove-redundant-if-statements.patch
queue-5.10/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-5.10/hv_netvsc-use-kmap_local_page-in-netvsc_copy_to_send_buf.patch
queue-5.10/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-5.10/net-qrtr-ns-limit-the-maximum-number-of-lookups.patch
queue-5.10/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-5.10/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-5.10/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-5.10/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-5.10/arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
queue-5.10/alsa-aoa-use-guard-for-mutex-locks.patch
queue-5.10/bluetooth-hci_event-fix-potential-uaf-in-ssp-passkey-handlers.patch
queue-5.10/bluetooth-consolidate-code-around-sk_alloc-into-a-helper-function.patch
queue-5.10/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-5.10/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-5.10/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-5.10/net-iucv-fix-locking-in-.getsockopt.patch
queue-5.10/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-5.10/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-5.10/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-5.10/bluetooth-hci_qca-convert-timeout-from-jiffies-to-ms.patch
queue-5.10/spi-lantiq-ssc-fix-controller-deregistration.patch
queue-5.10/erofs-fix-the-out-of-bounds-nameoff-handling-for-trailing-dirents.patch
queue-5.10/smb-client-require-a-full-nfs-mode-sid-before-reading-mode-bits.patch
queue-5.10/phy-renesas-rcar-gen3-usb2-fix-the-use-of-msleep-dur.patch
queue-5.10/bonding-limit-bond_mode_8023ad-to-ethernet-devices.patch
queue-5.10/scsi-target-iscsi-bound-iscsi_encode_text_output-appends-to-rsp_buf.patch
queue-5.10/spi-sun6i-fix-controller-deregistration.patch
queue-5.10/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-5.10/phy-tegra-xusb-disable-trk-clk-when-not-in-use.patch
queue-5.10/ceph-only-d_add-negative-dentries-when-they-are-unhashed.patch
queue-5.10/octeontx2-af-replace-deprecated-strncpy-with-strscpy.patch
queue-5.10/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-5.10/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-5.10/ktest-fix-the-month-in-the-name-of-the-failure-directory.patch
queue-5.10/pmdomain-core-fix-detach-procedure-for-virtual-devices-in-genpd.patch
queue-5.10/scsi-target-iscsi-fix-crc-overread-and-double-free-in-iscsit_handle_text_cmd.patch
queue-5.10/mm-huge_memory-update-file-pmd-counter-before-folio_put.patch
queue-5.10/net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch
queue-5.10/f2fs-fix-uaf-caused-by-decrementing-sbi-nr_pages-in-f2fs_write_end_io.patch
queue-5.10/thermal-core-fix-thermal-zone-governor-cleanup-issues.patch
queue-5.10/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-5.10/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-5.10/usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch
queue-5.10/spi-tegra114-fix-controller-deregistration.patch
queue-5.10/bluetooth-serialize-accept_q-access.patch
queue-5.10/crypto-caam-guard-hmac-key-hex-dumps-in-hash_digest_key.patch
queue-5.10/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-5.10/acpi-scan-use-acpi_dev_put-in-object-add-error-paths.patch
queue-5.10/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-5.10/selftests-forwarding-lib-add-helpers-for-checksum-ha.patch
queue-5.10/alsa-usb-audio-fix-null-pointer-dereference-on-point.patch
queue-5.10/hfsplus-fix-held-lock-freed-on-hfsplus_fill_super.patch
queue-5.10/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-5.10/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-5.10/use-less-confusing-names-for-iov_iter-direction-initializers.patch
queue-5.10/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-5.10/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-5.10/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-5.10/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-5.10/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
queue-5.10/nfsd-don-t-ignore-the-return-code-of-svc_proc_regist.patch
^ permalink raw reply
* [PATCH v3 1/3] perf: marvell: Add MPAM partid filtering to CN10K TAD PMU
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
From: Tanmay Jagdale <tanmay@marvell.com>
The TAD PMU exposes counters that can be filtered by MPAM partition id
for a subset of allocation and hit events.
Add a 9-bit partid format attribute (config1) and route counter programming
through variant-specific ops so CN10K keeps MPAM-capable programming while
Odyssey keeps the reduced event set without advertising partid in sysfs.
Probe no longer mutates the platform_device MMIO resource (walk a local
map_start), rejects tad-cnt / page sizes of zero, validates the memory
window against tad-cnt, and registers the perf PMU before hotplug with
correct unwind.
Example:
perf stat -e tad/tad_alloc_any,partid=0x12,partid_en=1/ -- <program>
Signed-off-by: Tanmay Jagdale <tanmay@marvell.com>
---
Changelog (since v2)
--------------------
- Validate the eventId using an appropriate mask to ensure
it is restricted to 8 bits
Changelog (since v1)
--------------------
- Fix config1 filter enable to use bit 9 consistently with the PMU format
string (partid_en) and reject reserved bits with GENMASK(9, 0).
- Register perf_pmu_register before cpuhp_state_add_instance_nocalls and
unregister on hotplug failure.
drivers/perf/marvell_cn10k_tad_pmu.c | 216 ++++++++++++++++++++-------
1 file changed, 164 insertions(+), 52 deletions(-)
diff --git a/drivers/perf/marvell_cn10k_tad_pmu.c b/drivers/perf/marvell_cn10k_tad_pmu.c
index 51ccb0befa05..69a6648fa664 100644
--- a/drivers/perf/marvell_cn10k_tad_pmu.c
+++ b/drivers/perf/marvell_cn10k_tad_pmu.c
@@ -7,6 +7,7 @@
#define pr_fmt(fmt) "tad_pmu: " fmt
#include <linux/io.h>
+#include <linux/bits.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/cpuhotplug.h>
@@ -14,12 +15,20 @@
#include <linux/platform_device.h>
#include <linux/acpi.h>
-#define TAD_PFC_OFFSET 0x800
-#define TAD_PFC(counter) (TAD_PFC_OFFSET | (counter << 3))
#define TAD_PRF_OFFSET 0x900
-#define TAD_PRF(counter) (TAD_PRF_OFFSET | (counter << 3))
+#define TAD_PFC_OFFSET 0x800
+#define TAD_PFC(base, counter) ((base) | ((u64)(counter) << 3))
+#define TAD_PRF(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF_CNTSEL_MASK 0xFF
+#define TAD_PRF_MATCH_PARTID BIT(8)
+#define TAD_PRF_PARTID_NS BIT(10)
+/*
+ * config1: bits 0..8 MPAM partition id (including 0); bit 9 requests
+ * filtering for MPAM-capable events. All-zero config1 means no filter.
+ */
+#define TAD_PARTID_FILTER_EN BIT(9)
#define TAD_MAX_COUNTERS 8
+#define TAD_EVENT_SEL_MASK GENMASK(7, 0)
#define to_tad_pmu(p) (container_of(p, struct tad_pmu, pmu))
@@ -27,30 +36,92 @@ struct tad_region {
void __iomem *base;
};
+enum mrvl_tad_pmu_version {
+ TAD_PMU_V1 = 1,
+ TAD_PMU_V2,
+};
+
+struct tad_pmu_data {
+ int id;
+ u64 tad_prf_offset;
+ u64 tad_pfc_offset;
+};
+
struct tad_pmu {
struct pmu pmu;
struct tad_region *regions;
u32 region_cnt;
unsigned int cpu;
+ const struct tad_pmu_ops *ops;
+ const struct tad_pmu_data *pdata;
struct hlist_node node;
struct perf_event *events[TAD_MAX_COUNTERS];
DECLARE_BITMAP(counters_map, TAD_MAX_COUNTERS);
};
-enum mrvl_tad_pmu_version {
- TAD_PMU_V1 = 1,
- TAD_PMU_V2,
-};
-
-struct tad_pmu_data {
- int id;
+struct tad_pmu_ops {
+ void (*start_counter)(struct tad_pmu *pmu, struct perf_event *event);
};
static int tad_pmu_cpuhp_state;
+static void tad_pmu_start_counter(struct tad_pmu *pmu,
+ struct perf_event *event)
+{
+ const struct tad_pmu_data *pdata = pmu->pdata;
+ struct hw_perf_event *hwc = &event->hw;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u32 counter_idx = hwc->idx;
+ u64 partid_filter = 0;
+ u64 reg_val;
+ u64 cfg1 = event->attr.config1;
+ bool use_mpam = cfg1 & TAD_PARTID_FILTER_EN;
+ u32 partid = (u32)(cfg1 & GENMASK(8, 0));
+ int i;
+
+ for (i = 0; i < pmu->region_cnt; i++)
+ writeq_relaxed(0, pmu->regions[i].base +
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
+
+ if (use_mpam && event_idx > 0x19 && event_idx < 0x21) {
+ partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_PARTID_NS |
+ ((u64)partid << 11);
+ }
+
+
+ for (i = 0; i < pmu->region_cnt; i++) {
+ reg_val = event_idx & 0xFF;
+ reg_val |= partid_filter;
+ writeq_relaxed(reg_val, pmu->regions[i].base +
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
+ }
+}
+
+static void tad_pmu_v2_start_counter(struct tad_pmu *pmu,
+ struct perf_event *event)
+{
+ const struct tad_pmu_data *pdata = pmu->pdata;
+ struct hw_perf_event *hwc = &event->hw;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u32 counter_idx = hwc->idx;
+ u64 reg_val;
+ int i;
+
+ for (i = 0; i < pmu->region_cnt; i++)
+ writeq_relaxed(0, pmu->regions[i].base +
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
+
+ for (i = 0; i < pmu->region_cnt; i++) {
+ reg_val = event_idx & 0xFF;
+ writeq_relaxed(reg_val, pmu->regions[i].base +
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
+ }
+}
+
static void tad_pmu_event_counter_read(struct perf_event *event)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
struct hw_perf_event *hwc = &event->hw;
u32 counter_idx = hwc->idx;
u64 prev, new;
@@ -60,7 +131,7 @@ static void tad_pmu_event_counter_read(struct perf_event *event)
prev = local64_read(&hwc->prev_count);
for (i = 0, new = 0; i < tad_pmu->region_cnt; i++)
new += readq(tad_pmu->regions[i].base +
- TAD_PFC(counter_idx));
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
} while (local64_cmpxchg(&hwc->prev_count, prev, new) != prev);
local64_add(new - prev, &event->count);
@@ -69,16 +140,14 @@ static void tad_pmu_event_counter_read(struct perf_event *event)
static void tad_pmu_event_counter_stop(struct perf_event *event, int flags)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
struct hw_perf_event *hwc = &event->hw;
u32 counter_idx = hwc->idx;
int i;
- /* TAD()_PFC() stop counting on the write
- * which sets TAD()_PRF()[CNTSEL] == 0
- */
for (i = 0; i < tad_pmu->region_cnt; i++) {
writeq_relaxed(0, tad_pmu->regions[i].base +
- TAD_PRF(counter_idx));
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
}
tad_pmu_event_counter_read(event);
@@ -89,26 +158,10 @@ static void tad_pmu_event_counter_start(struct perf_event *event, int flags)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
struct hw_perf_event *hwc = &event->hw;
- u32 event_idx = event->attr.config;
- u32 counter_idx = hwc->idx;
- u64 reg_val;
- int i;
hwc->state = 0;
- /* Typically TAD_PFC() are zeroed to start counting */
- for (i = 0; i < tad_pmu->region_cnt; i++)
- writeq_relaxed(0, tad_pmu->regions[i].base +
- TAD_PFC(counter_idx));
-
- /* TAD()_PFC() start counting on the write
- * which sets TAD()_PRF()[CNTSEL] != 0
- */
- for (i = 0; i < tad_pmu->region_cnt; i++) {
- reg_val = event_idx & 0xFF;
- writeq_relaxed(reg_val, tad_pmu->regions[i].base +
- TAD_PRF(counter_idx));
- }
+ tad_pmu->ops->start_counter(tad_pmu, event);
}
static void tad_pmu_event_counter_del(struct perf_event *event, int flags)
@@ -128,7 +181,6 @@ static int tad_pmu_event_counter_add(struct perf_event *event, int flags)
struct hw_perf_event *hwc = &event->hw;
int idx;
- /* Get a free counter for this event */
idx = find_first_zero_bit(tad_pmu->counters_map, TAD_MAX_COUNTERS);
if (idx == TAD_MAX_COUNTERS)
return -EAGAIN;
@@ -148,6 +200,9 @@ static int tad_pmu_event_counter_add(struct perf_event *event, int flags)
static int tad_pmu_event_init(struct perf_event *event)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u64 cfg1 = event->attr.config1;
if (event->attr.type != event->pmu->type)
return -ENOENT;
@@ -158,6 +213,23 @@ static int tad_pmu_event_init(struct perf_event *event)
if (event->state != PERF_EVENT_STATE_OFF)
return -EINVAL;
+ if (event->attr.config & ~TAD_EVENT_SEL_MASK)
+ return -EINVAL;
+
+ if (pdata->id == TAD_PMU_V2) {
+ if (cfg1)
+ return -EINVAL;
+ } else {
+ if ((cfg1 & GENMASK(8, 0)) && !(cfg1 & TAD_PARTID_FILTER_EN))
+ return -EINVAL;
+ if (cfg1 & TAD_PARTID_FILTER_EN) {
+ if (event_idx <= 0x19 || event_idx >= 0x21)
+ return -EINVAL;
+ }
+ if (cfg1 & ~GENMASK(9, 0))
+ return -EINVAL;
+ }
+
event->cpu = tad_pmu->cpu;
event->hw.idx = -1;
event->hw.config_base = event->attr.config;
@@ -232,7 +304,7 @@ static struct attribute *ody_tad_pmu_event_attrs[] = {
TAD_PMU_EVENT_ATTR(tad_hit_ltg, 0x1e),
TAD_PMU_EVENT_ATTR(tad_hit_any, 0x1f),
TAD_PMU_EVENT_ATTR(tad_tag_rd, 0x20),
- TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xFF),
+ TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xff),
NULL
};
@@ -242,9 +314,13 @@ static const struct attribute_group ody_tad_pmu_events_attr_group = {
};
PMU_FORMAT_ATTR(event, "config:0-7");
+PMU_FORMAT_ATTR(partid, "config1:0-8");
+PMU_FORMAT_ATTR(partid_en, "config1:9-9");
static struct attribute *tad_pmu_format_attrs[] = {
&format_attr_event.attr,
+ &format_attr_partid.attr,
+ &format_attr_partid_en.attr,
NULL
};
@@ -253,6 +329,16 @@ static struct attribute_group tad_pmu_format_attr_group = {
.attrs = tad_pmu_format_attrs,
};
+static struct attribute *ody_tad_pmu_format_attrs[] = {
+ &format_attr_event.attr,
+ NULL
+};
+
+static struct attribute_group ody_tad_pmu_format_attr_group = {
+ .name = "format",
+ .attrs = ody_tad_pmu_format_attrs,
+};
+
static ssize_t tad_pmu_cpumask_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -281,16 +367,25 @@ static const struct attribute_group *tad_pmu_attr_groups[] = {
static const struct attribute_group *ody_tad_pmu_attr_groups[] = {
&ody_tad_pmu_events_attr_group,
- &tad_pmu_format_attr_group,
+ &ody_tad_pmu_format_attr_group,
&tad_pmu_cpumask_attr_group,
NULL
};
+static const struct tad_pmu_ops tad_pmu_ops = {
+ .start_counter = tad_pmu_start_counter,
+};
+
+static const struct tad_pmu_ops tad_pmu_v2_ops = {
+ .start_counter = tad_pmu_v2_start_counter,
+};
+
static int tad_pmu_probe(struct platform_device *pdev)
{
const struct tad_pmu_data *dev_data;
struct device *dev = &pdev->dev;
struct tad_region *regions;
+ resource_size_t map_start;
struct tad_pmu *tad_pmu;
struct resource *res;
u32 tad_pmu_page_size;
@@ -298,7 +393,6 @@ static int tad_pmu_probe(struct platform_device *pdev)
u32 tad_cnt;
int version;
int i, ret;
- char *name;
tad_pmu = devm_kzalloc(&pdev->dev, sizeof(*tad_pmu), GFP_KERNEL);
if (!tad_pmu)
@@ -312,6 +406,7 @@ static int tad_pmu_probe(struct platform_device *pdev)
return -ENODEV;
}
version = dev_data->id;
+ tad_pmu->pdata = dev_data;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
@@ -338,22 +433,31 @@ static int tad_pmu_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "Can't find tad-cnt property\n");
return ret;
}
+ if (!tad_cnt || !tad_page_size || !tad_pmu_page_size) {
+ dev_err(&pdev->dev, "Invalid tad-cnt or page size\n");
+ return -EINVAL;
+ }
regions = devm_kcalloc(&pdev->dev, tad_cnt,
sizeof(*regions), GFP_KERNEL);
if (!regions)
return -ENOMEM;
- /* ioremap the distributed TAD pmu regions */
- for (i = 0; i < tad_cnt && res->start < res->end; i++) {
- regions[i].base = devm_ioremap(&pdev->dev,
- res->start,
+ map_start = res->start;
+ for (i = 0; i < tad_cnt; i++) {
+ if (map_start > res->end ||
+ tad_pmu_page_size > (resource_size_t)(res->end - map_start + 1)) {
+ dev_err(&pdev->dev, "TAD PMU mem window too small for tad-cnt=%u\n",
+ tad_cnt);
+ return -EINVAL;
+ }
+ regions[i].base = devm_ioremap(&pdev->dev, map_start,
tad_pmu_page_size);
if (!regions[i].base) {
dev_err(&pdev->dev, "TAD%d ioremap fail\n", i);
return -ENOMEM;
}
- res->start += tad_page_size;
+ map_start += tad_page_size;
}
tad_pmu->regions = regions;
@@ -374,28 +478,31 @@ static int tad_pmu_probe(struct platform_device *pdev)
.read = tad_pmu_event_counter_read,
};
- if (version == TAD_PMU_V1)
+ if (version == TAD_PMU_V1) {
tad_pmu->pmu.attr_groups = tad_pmu_attr_groups;
- else
+ tad_pmu->ops = &tad_pmu_ops;
+ } else {
tad_pmu->pmu.attr_groups = ody_tad_pmu_attr_groups;
+ tad_pmu->ops = &tad_pmu_v2_ops;
+ }
tad_pmu->cpu = raw_smp_processor_id();
- /* Register pmu instance for cpu hotplug */
+ ret = perf_pmu_register(&tad_pmu->pmu, "tad", -1);
+ if (ret) {
+ dev_err(&pdev->dev, "Error %d registering perf PMU\n", ret);
+ return ret;
+ }
+
ret = cpuhp_state_add_instance_nocalls(tad_pmu_cpuhp_state,
&tad_pmu->node);
if (ret) {
dev_err(&pdev->dev, "Error %d registering hotplug\n", ret);
+ perf_pmu_unregister(&tad_pmu->pmu);
return ret;
}
- name = "tad";
- ret = perf_pmu_register(&tad_pmu->pmu, name, -1);
- if (ret)
- cpuhp_state_remove_instance_nocalls(tad_pmu_cpuhp_state,
- &tad_pmu->node);
-
- return ret;
+ return 0;
}
static void tad_pmu_remove(struct platform_device *pdev)
@@ -410,12 +517,17 @@ static void tad_pmu_remove(struct platform_device *pdev)
#if defined(CONFIG_OF) || defined(CONFIG_ACPI)
static const struct tad_pmu_data tad_pmu_data = {
.id = TAD_PMU_V1,
+ .tad_prf_offset = TAD_PRF_OFFSET,
+ .tad_pfc_offset = TAD_PFC_OFFSET,
};
+
#endif
#ifdef CONFIG_ACPI
static const struct tad_pmu_data tad_pmu_v2_data = {
.id = TAD_PMU_V2,
+ .tad_prf_offset = TAD_PRF_OFFSET,
+ .tad_pfc_offset = TAD_PFC_OFFSET,
};
#endif
@@ -491,6 +603,6 @@ static void __exit tad_pmu_exit(void)
module_init(tad_pmu_init);
module_exit(tad_pmu_exit);
-MODULE_DESCRIPTION("Marvell CN10K LLC-TAD Perf driver");
+MODULE_DESCRIPTION("Marvell CN10K LLC-TAD perf driver");
MODULE_AUTHOR("Bhaskara Budiredla <bbudiredla@marvell.com>");
MODULE_LICENSE("GPL v2");
--
2.25.1
^ permalink raw reply related
* [PATCH v3 0/3] perf: marvell: LLC-TAD PMU MPAM filtering support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
This series extends the Marvell LLC-TAD performance driver used on CN10K
and CN20K systems.
Patch 1 adds optional MPAM partition-id filtering for the subset of TAD
events that support it, exposes partid / partid_en in the PMU format string,
and keeps the reduced Odyssey event surface without advertising partid where
it does not apply. It also fixes probe resource handling (no in-place
mutation of platform_get_resource() bounds, validate MMIO window vs
tad-cnt), orders perf registration vs hotplug with unwind, and aligns the
filter-enable bit in config1 with the sysfs format (bit 9).
Patch 2 introduces CN20K LLC-TAD support: non-standard PFC/PRF offsets,
additional programmable events with visibility checks so CN10K does not
advertise V3-only events, CN20K-specific MPAM encoding for the V3 profile,
local64_set(prev_count) on counter start, and device discovery via OF and
ACPI.
Patch 3 extends the DeviceTree binding for marvell,cn20k-tad-pmu.
Changes since v2
----------------
- Validate the eventId using an appropriate mask to ensure it is restricted to 8 bits.
Changes since v1
----------------
- config1: use bit 9 for MPAM filter enable consistently with partid_en in
the PMU format; allow only bits 0..9 in event_init on CN10K/CN20K paths.
- Reject reserved bits in attr.config and use the same 8-bit event index in
start_counter as in event_init so MPAM validation cannot be bypassed.
- Hide V3-only sysfs events on V1.
- Reset prev_count when starting counters after clearing hardware.
- DT binding: explain non-fallback compatibles for CN10K vs CN20K.
Tanmay Jagdale (1):
perf: marvell: Add MPAM partid filtering to CN10K TAD PMU
Geetha sowjanya (2):
perf: marvell: Add CN20K LLC-TAD PMU support
dt-bindings: perf: marvell: Extend CN10K TAD PMU binding for CN20K
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
--
2.25.1
^ permalink raw reply
* Re: [PATCH] PCI: dwc: meson: Fix reset GPIO initial state
From: Neil Armstrong @ 2026-06-16 7:10 UTC (permalink / raw)
To: linux-kernel-dev, Yue Wang, Lorenzo Pieralisi,
Krzysztof Wilczyński, Manivannan Sadhasivam, Rob Herring,
Bjorn Helgaas, Kevin Hilman, Jerome Brunet, Martin Blumenstingl,
Remi Pommarel
Cc: linux-pci, linux-amlogic, linux-arm-kernel, linux-kernel
In-Reply-To: <20260616-fix-meson-pcie-reset-gpio-v1-1-fca404b4c8be@aliel.fr>
On 6/16/26 09:07, Ronald Claveau via B4 Relay wrote:
> From: Ronald Claveau <linux-kernel-dev@aliel.fr>
>
> Commit 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio
> descriptor") inverted the reset assertion logic to use proper gpio
> descriptor semantics, and moved the polarity configuration to the
> device tree as GPIO_ACTIVE_LOW. However, the initial GPIO state
> "GPIOD_OUT_LOW" was not updated accordingly.
>
> Change GPIOD_OUT_LOW to GPIOD_OUT_HIGH to get the right behaviour.
>
> With GPIOD_OUT_LOW:
>
> ahci 0000:01:00.0: enabling device (0000 -> 0002)
> ahci 0000:01:00.0: SSS flag set, parallel bus scan disabled
> ahci 0000:01:00.0: Controller reset failed (0xffffffff)
> ahci 0000:01:00.0: probe with driver ahci failed with error -5
>
> With this fix:
>
> ahci 0000:01:00.0: enabling device (0000 -> 0002)
> ahci 0000:01:00.0: AHCI vers 0001.0300, 32 command slots, 6 Gbps,
> SATA mode
> ahci 0000:01:00.0: 1/1 ports implemented (port mask 0x1)
> ahci 0000:01:00.0: flags: 64bit ncq led clo only pio ccc
>
> Fixes: 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
> Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
> ---
> drivers/pci/controller/dwc/pci-meson.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
> index 0694084f612b7..15ed59b8764fb 100644
> --- a/drivers/pci/controller/dwc/pci-meson.c
> +++ b/drivers/pci/controller/dwc/pci-meson.c
> @@ -400,7 +400,7 @@ static int meson_pcie_probe(struct platform_device *pdev)
> return PTR_ERR(mp->phy);
> }
>
> - mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
> + mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
> if (IS_ERR(mp->reset_gpio)) {
> dev_err(dev, "get reset gpio failed\n");
> return PTR_ERR(mp->reset_gpio);
>
> ---
> base-commit: abe651837cb394f76d738a7a747322fca3bf17ba
> change-id: 20260616-fix-meson-pcie-reset-gpio-2b9e188668c5
>
> Best regards,
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Thanks,
Neil
^ permalink raw reply
* [PATCH] PCI: dwc: meson: Fix reset GPIO initial state
From: Ronald Claveau via B4 Relay @ 2026-06-16 7:07 UTC (permalink / raw)
To: Yue Wang, Lorenzo Pieralisi, Krzysztof Wilczyński,
Manivannan Sadhasivam, Rob Herring, Bjorn Helgaas, Neil Armstrong,
Kevin Hilman, Jerome Brunet, Martin Blumenstingl, Remi Pommarel
Cc: linux-pci, linux-amlogic, linux-arm-kernel, linux-kernel,
Ronald Claveau
From: Ronald Claveau <linux-kernel-dev@aliel.fr>
Commit 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio
descriptor") inverted the reset assertion logic to use proper gpio
descriptor semantics, and moved the polarity configuration to the
device tree as GPIO_ACTIVE_LOW. However, the initial GPIO state
"GPIOD_OUT_LOW" was not updated accordingly.
Change GPIOD_OUT_LOW to GPIOD_OUT_HIGH to get the right behaviour.
With GPIOD_OUT_LOW:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: SSS flag set, parallel bus scan disabled
ahci 0000:01:00.0: Controller reset failed (0xffffffff)
ahci 0000:01:00.0: probe with driver ahci failed with error -5
With this fix:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: AHCI vers 0001.0300, 32 command slots, 6 Gbps,
SATA mode
ahci 0000:01:00.0: 1/1 ports implemented (port mask 0x1)
ahci 0000:01:00.0: flags: 64bit ncq led clo only pio ccc
Fixes: 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
---
drivers/pci/controller/dwc/pci-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
index 0694084f612b7..15ed59b8764fb 100644
--- a/drivers/pci/controller/dwc/pci-meson.c
+++ b/drivers/pci/controller/dwc/pci-meson.c
@@ -400,7 +400,7 @@ static int meson_pcie_probe(struct platform_device *pdev)
return PTR_ERR(mp->phy);
}
- mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+ mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(mp->reset_gpio)) {
dev_err(dev, "get reset gpio failed\n");
return PTR_ERR(mp->reset_gpio);
---
base-commit: abe651837cb394f76d738a7a747322fca3bf17ba
change-id: 20260616-fix-meson-pcie-reset-gpio-2b9e188668c5
Best regards,
--
Ronald Claveau <linux-kernel-dev@aliel.fr>
^ permalink raw reply related
* Re: [PATCH v5 3/4] PCI: endpoint: Add support for DOE initialization and setup in EPC core
From: Manivannan Sadhasivam @ 2026-06-16 6:22 UTC (permalink / raw)
To: Aksh Garg
Cc: Bjorn Helgaas, linux-pci, linux-doc, kwilczynski, bhelgaas,
corbet, kishon, skhan, lukas, cassel, alistair, linux-arm-kernel,
linux-kernel, s-vadapalli, danishanwar, srk
In-Reply-To: <0216a528-3737-4714-b9d1-5d28008e0ec8@ti.com>
On Fri, Jun 12, 2026 at 01:54:13PM +0530, Aksh Garg wrote:
>
>
> On 12/06/26 00:42, Bjorn Helgaas wrote:
> > On Wed, Jun 10, 2026 at 03:32:55PM +0530, Aksh Garg wrote:
> > > Add pci_epc_init_capabilities() in EPC core driver to initialize and
> > > setup the capabilities supported by the EPC driver. This calls
> > > pci_epc_doe_setup() to setup the DOE framework for an endpoint controller,
> > > which discovers the DOE capabilities (extended capability ID 0x2E), and
> > > registers each discovered DOE mailbox for all the functions in the
> > > endpoint controller.
> > >
> > > Add pci_epc_deinit_capabilities() in EPC core driver for cleanup of the
> > > resources used by the capabilities of the EPC driver. This calls
> > > pci_ep_doe_destroy() to destroy all DOE mailboxes and free associated
> > > resources.
> > >
> > > Co-developed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
> > > Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
> > > Signed-off-by: Aksh Garg <a-garg7@ti.com>
> > > ---
> > > +/**
> > > + * pci_epc_doe_setup() - Discover and setup DOE mailboxes for all functions
> > > + * @epc: the EPC device on which DOE mailboxes has to be setup
> > > + *
> > > + * Discover DOE (Data Object Exchange) capabilities for all physical functions
> > > + * in the endpoint controller and register DOE mailboxes.
> > > + *
> > > + * Returns: 0 on success, -errno on failure
> > > + */
> > > +static int pci_epc_doe_setup(struct pci_epc *epc)
> > > +{
> > > + u8 func_no, vfunc_no = 0;
> > > + u16 cap_offset;
> > > + int ret;
> > > +
> > > + if (!epc->ops || !epc->ops->find_ext_capability)
> > > + return -EINVAL;
> >
>
> Hi Bjorn,
>
> Thank you for your feedback comments. I will work on them and post v6
> series incorporating the changes.
>
> > I don't see anything that sets pci_epc_ops.find_ext_capability in this
> > series, so this looks currently unused and untestable, so likely not
> > mergeable as-is. What's the plan for users of this?
> >
>
> Currently there is no EPC driver upstream which supports DOE yet. However, I
> am working on a platform which supports DOE (support for
> which would be added soon). Mani pointed out that if EPC driver support
> for the same is guaranteed to be added soon, the APIs can be merged
> first.
>
> For the demonstration purpose, he asked to show how an EPC driver is
> expected to use the API as a snippet in the cover letter itself.
>
I retract my previous comment here. Let's not introduce dead code in the kernel.
We can review the series now, but cannot merge it until the EPC driver gets
submitted.
- Mani
--
மணிவண்ணன் சதாசிவம்
^ permalink raw reply
* Re: [PATCH v2] arm64: tlbflush: Don't broadcast if mm was only active on local cpu
From: Mark Rutland @ 2026-06-16 6:13 UTC (permalink / raw)
To: Will Deacon
Cc: Linu Cherian, Catalin Marinas, Ryan Roberts, Kevin Brodsky,
Anshuman Khandual, Yang Shi, Huang Ying, linux-arm-kernel,
linux-kernel
In-Reply-To: <ajAPxKUTp66IRMMF@willie-the-truck>
On Mon, Jun 15, 2026 at 03:44:20PM +0100, Will Deacon wrote:
> On Mon, Jun 15, 2026 at 01:39:43PM +0100, Mark Rutland wrote:
> > On Sun, Jun 14, 2026 at 12:04:44PM +0100, Will Deacon wrote:
> > > On Sat, May 23, 2026 at 07:17:10PM +0530, Linu Cherian wrote:
> >
> > > > static inline void flush_tlb_mm(struct mm_struct *mm)
> > > > {
> > > > unsigned long asid;
> > > > + bool local;
> > > >
> > > > - dsb(ishst);
> > > > + local = flush_tlb_user_pre(mm, TLBF_NONE);
> > > > asid = __TLBI_VADDR(0, ASID(mm));
> > > > - __tlbi(aside1is, asid);
> > > > - __tlbi_user(aside1is, asid);
> > > > - __tlbi_sync_s1ish(mm);
> > > > + if (local) {
> > > > + __tlbi(aside1, asid);
> > > > + __tlbi_user(aside1, asid);
> > > > + dsb(nsh);
> > > > + } else {
> > > > + __tlbi(aside1is, asid);
> > > > + __tlbi_user(aside1is, asid);
> > > > + __tlbi_sync_s1ish(mm);
> > > > + }
> > > > + flush_tlb_user_post(local);
> > >
> > > I think you've changed this since Ryan's original patch, but why are you
> > > only calling __tlbi_sync_s1ish() for the !local case? Doesn't that break
> > > the erratum workaround when running as a VM if the vCPU is migrated?
> >
> > The errata mitigated by __tlbi_sync_s1ish() only affect broadcast
> > maintenance (the 'ish' in the name was intended to convey that). No
> > workaround is necessary for local TLB maintenance; aside from anything
> > else, when some PE executes the DSB to complete the maintenance, that
> > DSB alone is sufficient to complete memory accesses made by that PE.
> >
> > If it would make things clearer, we could add a __tlbi_sync_s1nsh()
> > helper for the local case, which would boil down to a DSB NSH.
>
> No, I don't think that's what I'm concerned about.
I *think* you're missing the shape of the errata; more on that below.
> > Regardless of the erratum, to correctly handle a vCPU being migrated
> > from pCPU-x to pCPU-y, we rely on:
> >
> > * The host to set HCR_EL2.FB to ensure that TLB maintenance is
> > broadcast to the ISH domain.
> >
> > * The host to set HCR_EL2.BSU to ensure the DSB is upgrade to ISH such
> > that any guest-issued DSB NSH will it can complete any TLB maintenance
> > that was upgraded to ISH.
> >
> > * The host to issue a DSB ISH on pCPU-x before the vCPU can run on
> > pCPU-y, to complete any outstanding maintenance that was issued on
> > pCPU-x. IIUC a DSB ISH on pCPU-y is not architecturally sufficient; it
> > must be executed on the same CPU which issued the TLB maintenance.
> >
> > ... but as above, all of that should be independent of any of the errata
> > that require the workaround.
>
> Yes, I understand all of the above but the case I'm struggling with is
> where a vCPU runs on a system that needs the TLB invalidation to be
> performed twice. For non-broadcast invalidation (from the guest
> perspective), this patch will mean that it only performs the
> invalidation once. So if the vCPU migrates to another physical CPU, can
> that effectively undo the HCR_EL2.FB upgrade unless KVM issues TLB
> invalidation as well as a DSB on migration?
>
> Maybe I'm missing something, as it looks like upstream already elides
> the call to __tlbi_sync_s1ish() for the NOBROADCAST case.
The key thing is that these errata only affect the completion of memory
accesses, and only those accesses made by other (physical) PEs.
A single TLBI will correctly remove the actual TLB entries, and
HCR_EL2.{FB,BSU} will still ensure that TLB entries are removed from the
TLBs of other PEs.
The errata only prevent completion of memory accesses made on other
(physical) PEs, and:
* For accesses made by the vCPU which is issuing the TLBI(s):
- Regardless of the errata, the hypervisor has to ensure that when a
vCPU is migrated from pCPU-x to pCPU-y, any prior CMOs or TLBIs are
completed, which requires the host to execute a DSB ISH on pCPU-x
before the vCPU can be run on pCPU-y.
Maybe we have a latent bug here?
- Within the context of the vCPU thread, a DSB {NSH,ISH,OSH} will
complete all prior accesses made by the vCPU *regardless* of any TLB
invalidation.
* For accesses made by *other* vCPUs, either:
- Software in the VM intended to complete concurrency accesses made by
other vCPUs. In which case, regardless of the errata, using a local
TLBI alone is a software bug since that's not guaranteed to affect
other PEs.
- Software did not intend to complete accesses made by other vCPUs.
In which case, it's fine that they may have uncompleted accesses.
... but maybe I'm still missing your concern?
Mark.
^ permalink raw reply
* Re: [PATCH] mmc: sdhci-of-aspeed: depopulate slots before disabling clock
From: Adrian Hunter @ 2026-06-16 6:13 UTC (permalink / raw)
To: Pengpeng Hou, Andrew Jeffery, Ulf Hansson, Joel Stanley,
linux-mmc, linux-aspeed, openbmc, linux-arm-kernel, linux-kernel,
Ryan Chen
In-Reply-To: <20260616004953.3469-1-pengpeng@iscas.ac.cn>
On 16/06/2026 03:49, Pengpeng Hou wrote:
> aspeed_sdc_probe() creates child slot devices one by one after enabling
> the controller clock. If a later slot creation fails, the already-created
> slot devices remain registered while the parent probe returns an error.
>
> Depopulate any created slot devices on probe failure and during remove,
> before disabling the shared controller clock used by the slots.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/mmc/host/sdhci-of-aspeed.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/host/sdhci-of-aspeed.c b/drivers/mmc/host/sdhci-of-aspeed.c
> index f5d973783cbe..3e941b176687 100644
> --- a/drivers/mmc/host/sdhci-of-aspeed.c
> +++ b/drivers/mmc/host/sdhci-of-aspeed.c
> @@ -560,12 +560,14 @@ static int aspeed_sdc_probe(struct platform_device *pdev)
> cpdev = of_platform_device_create(child, NULL, &pdev->dev);
> if (!cpdev) {
> ret = -ENODEV;
> - goto err_clk;
> + goto err_depopulate;
> }
> }
>
> return 0;
>
> +err_depopulate:
> + of_platform_depopulate(&pdev->dev);
of_platform_depopulate() does not appear to work with
of_platform_device_create() due to the OF_POPULATED_BUS flag
> err_clk:
> clk_disable_unprepare(sdc->clk);
> return ret;
> @@ -575,6 +577,7 @@ static void aspeed_sdc_remove(struct platform_device *pdev)
> {
> struct aspeed_sdc *sdc = dev_get_drvdata(&pdev->dev);
>
> + of_platform_depopulate(&pdev->dev);
> clk_disable_unprepare(sdc->clk);
> }
>
There is another existing issue that Sashiko noticed:
struct platform_driver aspeed_sdc_driver has:
.pm = &sdhci_pltfm_pmops,
where it won't work correctly. It looks like it
should have instead been in:
struct platform_driver aspeed_sdhci_driver
Refer:
https://sashiko.dev/#/patchset/20260616004953.3469-1-pengpeng%40iscas.ac.cn
^ permalink raw reply
* Re: [PATCH v3 2/2] clk: amlogic: Add A9 peripherals clock controller driver
From: Jian Hu @ 2026-06-16 6:12 UTC (permalink / raw)
To: Jerome Brunet
Cc: Jian Hu via B4 Relay, Neil Armstrong, Michael Turquette,
Stephen Boyd, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Xianwei Zhao, Kevin Hilman, Martin Blumenstingl, linux-amlogic,
linux-clk, devicetree, linux-kernel, linux-arm-kernel
In-Reply-To: <1j7bo0dm0z.fsf@starbuckisacylon.baylibre.com>
On 6/15/2026 8:29 PM, Jerome Brunet wrote:
> [ EXTERNAL EMAIL ]
>
> On lun. 15 juin 2026 at 19:25, Jian Hu <jian.hu@amlogic.com> wrote:
>
>> On 6/10/2026 8:49 PM, Jerome Brunet wrote:
>>> [ EXTERNAL EMAIL ]
>>>
>>> On mer. 10 juin 2026 at 16:14, Jian Hu via B4 Relay <devnull+jian.hu.amlogic.com@kernel.org> wrote:
>>>
>>>> From: Jian Hu <jian.hu@amlogic.com>
>>>>
>>>> Add the peripherals clock controller driver for the Amlogic A9 SoC family.
>>>>
>>>> Signed-off-by: Jian Hu <jian.hu@amlogic.com>
>>>> ---
>>>> drivers/clk/meson/Kconfig | 15 +
>>>> drivers/clk/meson/Makefile | 1 +
>>>> drivers/clk/meson/a9-peripherals.c | 1925 ++++++++++++++++++++++++++++++++++++
>>>> 3 files changed, 1941 insertions(+)
>>>>
>> [ ... ]
>>
>>>> +
>>>> +/* Channel 6 is unconnected. */
>>>> +static u32 a9_glb_parents_val_table[] = { 0, 1, 2, 3, 4, 5, 7 };
>>>> +static struct clk_regmap a9_dspa;
>>> What is this ?
>>
>> The peripheral clock definitions are ordered by register offset.
>>
>> dspa is one of the parents of the glb clock, while the dsp clock registers
>> are located after the GLB clock registers.
>>
>> Since glb references a9_dspa before its full definition appears, the
>> declaration
>>
>> static struct clk_regmap a9_dspa;
>>
>> is added as a forward declaration to satisfy the compiler.
>>
>>
>> Would it make sense to relax the register-offset ordering in this case?
>>
> I don't think we ever enforced such ordering (or any other ordering) in
> the clock driver, so yes please.
>
Understood. I'll reorder the clock definitions accordingly and remove
the forward declaration
in the next version.
>> By defining the DSP clock before the GLB clock, we could remove the forward
>> declaration of a9_dspa.
> Unless it is absolutely necessary, please avoid forward declaration.
>
> Declare what is needed first, keep related things together and use your.
> best judgement ... IOW, make it easy for me to review ;)
Ok.
>>>> +
>>>> +static const struct clk_parent_data a9_glb_parents[] = {
>>>> +};
> [...]
>
>>>> +
>>>> +static struct clk_regmap a9_vclk_div2_en = {
>>>> + .data = &(struct clk_regmap_gate_data){
>>>> + .offset = VID_CLK_CTRL,
>>>> + .bit_idx = 1,
>>>> + },
>>>> + .hw.init = CLK_HW_INIT_HW("vclk_div2_en", &a9_vclk.hw,
>>>> + &clk_regmap_gate_ops, CLK_SET_RATE_PARENT),
>>>> +};
>>> Looks to me all this div_en / div repeating pattern would be easier to review
>>> with tiny macro .
>>
>> Good point.
>>
>> I tried to reduce the repeated div_en/div pattern using a helper macro.
>>
>> It keeps the relationship between gate and fixed-factor clock more compact
>> and easier to review.
>>
>> After using the helper macro, the div_en/div code can be simplified to the
>> following:
>>
>> #define A9_VCLK(_name, _reg, _bit, _div, _parent) \
>> struct clk_regmap a9_##_name##_en = { \
> ^- not strictly necessary, a touch too agressive
>
>
>> .data = &(struct clk_regmap_gate_data){ \
>> .offset = _reg, \
>> .bit_idx = _bit, \
>> }, \
>> .hw.init = &(struct clk_init_data) { \
>> .name = #_name "_en", \
>> .ops = &clk_regmap_gate_ops, \
>> .parent_hws = (const struct clk_hw *[]) { _parent }, \
>> .num_parents = 1, \
>> .flags = CLK_SET_RATE_PARENT, \
>> }, \
>> }; \
>> \
>> struct clk_fixed_factor a9_##_name = { \
>> .mult = 1, \
>> .div = _div, \
>> .hw.init = &(struct clk_init_data){ \
>> .name = #_name, \
>> .ops = &clk_fixed_factor_ops, \
>> .parent_hws = (const struct clk_hw *[]) { \
>> &a9_##_name##_en.hw \
>> }, \
>> .num_parents = 1, \
>> .flags = CLK_SET_RATE_PARENT, \
>> }, \
>> }; \
>>
>> static A9_VCLK(vclk_div2, VID_CLK_CTRL, 1, 2, &a9_vclk.hw);
>> static A9_VCLK(vclk_div4, VID_CLK_CTRL, 2, 4, &a9_vclk.hw);
>> static A9_VCLK(vclk_div6, VID_CLK_CTRL, 3, 6, &a9_vclk.hw);
>> static A9_VCLK(vclk_div6, VID_CLK_CTRL, 4, 12, &a9_vclk.hw);
>> static A9_VCLK(vclk2_div2, VIID_CLK_CTRL, 1, 2, &a9_vclk2.hw);
>> static A9_VCLK(vclk2_div4, VIID_CLK_CTRL, 2, 4, &a9_vclk2.hw);
>> static A9_VCLK(vclk2_div6, VIID_CLK_CTRL, 3, 6, &a9_vclk2.hw);
>> static A9_VCLK(vclk2_div6, VIID_CLK_CTRL, 4, 12, &a9_vclk2.hw);
>>
>>
>> If you think splitting it further into separate helper macros would improve
>> readability.
> One clock per macro please. Hidding 2 declaration is recipe for
> disaster. For ex, here the first one is static, the 2nd is not
I'll split it into separate helper macros so that each macro expands to
a single clock definition.
They are defined as follows: (Excluding struct clk_regmap)
#define A9_VCLK_GATE(_name, _reg, _bit, _parent) \
.data = &(struct clk_regmap_gate_data){ \
.offset = _reg, \
.bit_idx = _bit, \
}, \
.hw.init = &(struct clk_init_data) { \
.name = #_name "_en", \
.ops = &clk_regmap_gate_ops, \
.parent_hws = (const struct clk_hw *[]) { _parent }, \
.num_parents = 1, \
.flags = CLK_SET_RATE_PARENT, \
},
#define A9_VCLK_DIV(_name, _reg, _div) \
....
static struct clk_regmap a9_vclk_div2_en = {
A9_VCLK_GATE(vclk_div2, VID_CLK_CTRL, 1, &a9_vclk.hw),
};
static struct clk_regmap a9_vclk_div2 = {
A9_VCLK_DIV(vclk_div2, VID_CLK_CTRL, 2),
};
My understanding is that you would prefer helper macros to cover only
the repeated initializer fields,
while keeping the actual clock declarations explicit.
If that's not what you had in mind, please let me know.
>> I can do that as well.
>>
--
Jian
^ permalink raw reply
* Re: [PATCH] soc: amlogic: meson-clk-measure: remove debugfs tree
From: Neil Armstrong @ 2026-06-16 6:07 UTC (permalink / raw)
To: Pengpeng Hou, Kevin Hilman, Jerome Brunet, Martin Blumenstingl,
linux-arm-kernel, linux-amlogic, linux-kernel
In-Reply-To: <20260615091531.21964-1-pengpeng@iscas.ac.cn>
On 6/15/26 11:15, Pengpeng Hou wrote:
> meson_msr_probe() creates a debugfs tree with entries that reference
> devm-managed measurement table entries and the driver's private regmap
> state. The driver has no remove callback, so unbinding the device can
> leave those debugfs entries behind after the private data is released.
>
> Store the debugfs root and remove the subtree from a new remove callback.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/soc/amlogic/meson-clk-measure.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> diff --git a/drivers/soc/amlogic/meson-clk-measure.c b/drivers/soc/amlogic/meson-clk-measure.c
> index d862e30a244e..7ca43bcb622a 100644
> --- a/drivers/soc/amlogic/meson-clk-measure.c
> +++ b/drivers/soc/amlogic/meson-clk-measure.c
> @@ -7,6 +7,7 @@
> #include <linux/of_address.h>
> #include <linux/platform_device.h>
> #include <linux/bitfield.h>
> +#include <linux/err.h>
> #include <linux/seq_file.h>
> #include <linux/debugfs.h>
> #include <linux/regmap.h>
> @@ -50,6 +51,7 @@ struct meson_msr_data {
> struct meson_msr {
> struct regmap *regmap;
> struct meson_msr_data data;
> + struct dentry *debugfs_root;
> };
>
> #define CLK_MSR_ID(__id, __name) \
> @@ -952,6 +954,7 @@ static int meson_msr_probe(struct platform_device *pdev)
> sizeof(struct msr_reg_offset));
>
> root = debugfs_create_dir("meson-clk-msr", NULL);
> + priv->debugfs_root = root;
> clks = debugfs_create_dir("clks", root);
>
> debugfs_create_file("measure_summary", 0444, root,
> @@ -967,9 +970,19 @@ static int meson_msr_probe(struct platform_device *pdev)
> &priv->data.msr_table[i], &clk_msr_fops);
> }
>
> + platform_set_drvdata(pdev, priv);
> +
> return 0;
> }
>
> +static void meson_msr_remove(struct platform_device *pdev)
> +{
> + struct meson_msr *priv = platform_get_drvdata(pdev);
> +
> + if (!IS_ERR_OR_NULL(priv->debugfs_root))
> + debugfs_remove_recursive(priv->debugfs_root);
> +}
> +
> static const struct msr_reg_offset msr_reg_offset = {
> .duty_val = 0x0,
> .freq_ctrl = 0x4,
> @@ -1065,6 +1078,7 @@ MODULE_DEVICE_TABLE(of, meson_msr_match_table);
>
> static struct platform_driver meson_msr_driver = {
> .probe = meson_msr_probe,
> + .remove = meson_msr_remove,
> .driver = {
> .name = "meson_msr",
> .of_match_table = meson_msr_match_table,
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Thanks,
Neil
^ permalink raw reply
* Re: [PATCH] PCI: meson: Fix PERST# timing by asserting reset before LTSSM enable
From: neil.armstrong @ 2026-06-16 6:06 UTC (permalink / raw)
To: Ronald Claveau, Gowtham Kudupudi
Cc: robh, bhelgaas, khilman, jbrunet, martin.blumenstingl, linux-pci,
linux-amlogic, linux-arm-kernel, linux-kernel, yue.wang,
lpieralisi, kwilczynski, mani
In-Reply-To: <84cc8b0c-da06-4d01-a076-9743c29c91f6@aliel.fr>
On 6/15/26 12:34, Ronald Claveau wrote:
> On 6/14/26 3:56 AM, Gowtham Kudupudi wrote:
>> On warm reboot, the PCIe controller's LTSSM starts link training
>> immediately if PERST# is already deasserted from the previous boot.
>> The driver then pulses PERST# for only 500us, which is too short to
>> properly reset the endpoint device that has already started training.
>>
>> Fix by moving the PERST# assert/deassert pulse BEFORE enabling LTSSM,
>> so the endpoint gets a clean reset cycle before link training begins.
>>
>> This was found on Amlogic G12B (A311D) with NVMe on an M.2 slot.
>> Cold boot worked because POR held PERST# low; warm reboot did not.
>> The fix was confirmed on a Banana Pi CM4 with Waveshare IO base board.
>>
>> Signed-off-by: Gowtham Kudupudi <gowtham@ferryfair.com>
>> ---
>> drivers/pci/controller/dwc/pci-meson.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
>> index 5f8e2f4b3c12..3a7e9f1d5b8c 100644
>> --- a/drivers/pci/controller/dwc/pci-meson.c
>> +++ b/drivers/pci/controller/dwc/pci-meson.c
>> @@ -310,8 +310,8 @@ static int meson_pcie_start_link(struct dw_pcie *pci)
>> {
>> struct meson_pcie *mp = to_meson_pcie(pci);
>>
>> + meson_pcie_assert_reset(mp);
>> meson_pcie_ltssm_enable(mp);
>> - meson_pcie_assert_reset(mp);
I think this change is valid, other controllers resets PERST
in the host init callback, so either this or move to the
init callback.
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
>>
>> return 0;
>> }
>
> Hi Gowtham,
>
> I have a patch [1] that I haven't submitted yet.
> This might be related to your issue, what do you think ?
Ronald, This fix is valid, it's definitely better to probe the
driver with PERST asserted, please send it.
Neil
>
> [1] https://github.com/rclaveau-tech/linux-khadas/commit/bee0a02d9756
>
^ permalink raw reply
* [PATCH v2] dmaengine: sun6i-dma: Fix memory leak in sun6i_dma_terminate_all
From: Hongling Zeng @ 2026-06-16 6:04 UTC (permalink / raw)
To: vkoul, Frank.Li, wens, jernej.skrabec, samuel, mripard, arnd
Cc: dmaengine, linux-arm-kernel, linux-sunxi, linux-kernel,
zhongling0719, Hongling Zeng
When terminating a non-cyclic DMA transfer, the active descriptor
is not properly reclaimed. The descriptor is removed from the
desc_issued list in sun6i_dma_start_desc(), but in
sun6i_dma_terminate_all(), only cyclic transfer descriptors are
added to the desc_completed list before cleanup.
For non-cyclic transfers, pchan->desc is set to NULL without first
adding the descriptor back to a list that vchan_get_all_descriptors()
can collect. This causes the descriptor and its associated LLI chain
to be permanently leaked.
Fix by ensuring both cyclic and non-cyclic active descriptors are
added to the desc_completed list before setting pchan->desc to NULL.
Fixes: 555859308723 ("dmaengine: sun6i: Add driver for the Allwinner A31 DMA controller")
Signed-off-by: Hongling Zeng <zenghongling@kylinos.cn>
---
Change in v2;
-Add pchan->desc != pchan->done check to prevent race condition
where completed descriptors could be double-added to desc_completed
list, causing list corruption
---
drivers/dma/sun6i-dma.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/dma/sun6i-dma.c b/drivers/dma/sun6i-dma.c
index 7a79f346250a..12d038ef5f2e 100644
--- a/drivers/dma/sun6i-dma.c
+++ b/drivers/dma/sun6i-dma.c
@@ -946,16 +946,14 @@ static int sun6i_dma_terminate_all(struct dma_chan *chan)
spin_lock_irqsave(&vchan->vc.lock, flags);
- if (vchan->cyclic) {
- vchan->cyclic = false;
- if (pchan && pchan->desc) {
- struct virt_dma_desc *vd = &pchan->desc->vd;
- struct virt_dma_chan *vc = &vchan->vc;
+ if (pchan && pchan->desc && pchan->desc != pchan->done) {
+ struct virt_dma_desc *vd = &pchan->desc->vd;
+ struct virt_dma_chan *vc = &vchan->vc;
- list_add_tail(&vd->node, &vc->desc_completed);
- }
+ list_add_tail(&vd->node, &vc->desc_completed);
}
+ vchan->cyclic = false;
vchan_get_all_descriptors(&vchan->vc, &head);
if (pchan) {
--
2.25.1
^ permalink raw reply related
* Re: [PATCH v6 3/3] PCI: rockchip: drive at 2.5 GT/s, error other speeds
From: Manivannan Sadhasivam @ 2026-06-16 5:39 UTC (permalink / raw)
To: Geraldo Nascimento
Cc: Shawn Lin, Dragan Simic, linux-rockchip, Lorenzo Pieralisi,
Krzysztof Wilczyński, Rob Herring, Bjorn Helgaas, linux-pci,
linux-arm-kernel, linux-kernel
In-Reply-To: <ajBS3tGp0wqLyVq7@geday>
On Mon, Jun 15, 2026 at 04:30:38PM -0300, Geraldo Nascimento wrote:
> Hi,
>
> On Thu, Jun 11, 2026 at 05:04:22PM -0300, Geraldo Nascimento wrote:
> > Configure the core to be driven at 2.5 GT/s Link Speed and ignore
> > any other speed with a warning. Also drop the 5.0 GT/s Link Speed
> > defines from Rockchip PCIe header.
> >
> > The reason is that Shawn Lin from Rockchip has reiterated that there
> > may be danger of "catastrophic failure" in using their PCIe with
> > 5.0 GT/s speeds.
> >
> > While Rockchip has done so informally without issuing a proper errata,
> > and the particulars are thus unknown, this may cause data loss or
> > worse.
> >
> > This change is corroborated by RK3399 official datasheet [1], which
> > states maximum link speed for this platform is 2.5 GT/s.
> >
> > [1] https://opensource.rock-chips.com/images/d/d7/Rockchip_RK3399_Datasheet_V2.1-20200323.pdf
> >
> > Fixes: 956cd99b35a8 ("PCI: rockchip: Separate common code from RC driver")
> > Link: https://lore.kernel.org/all/ffd05070-9879-4468-94e3-b88968b4c21b@rock-chips.com/
> > Cc: stable@vger.kernel.org
> > Reported-by: Dragan Simic <dsimic@manjaro.org>
> > Reported-by: Shawn Lin <shawn.lin@rock-chips.com>
> > Signed-off-by: Geraldo Nascimento <geraldogabriel@gmail.com>
> > ---
> > drivers/pci/controller/pcie-rockchip.c | 16 +++++++++-------
> > drivers/pci/controller/pcie-rockchip.h | 3 ---
> > 2 files changed, 9 insertions(+), 10 deletions(-)
> >
> > diff --git a/drivers/pci/controller/pcie-rockchip.c b/drivers/pci/controller/pcie-rockchip.c
> > index 0f88da3788054..5a2876d7c8547 100644
> > --- a/drivers/pci/controller/pcie-rockchip.c
> > +++ b/drivers/pci/controller/pcie-rockchip.c
> > @@ -66,8 +66,10 @@ int rockchip_pcie_parse_dt(struct rockchip_pcie *rockchip)
> > }
> >
> > rockchip->link_gen = of_pci_get_max_link_speed(node);
> > - if (rockchip->link_gen < 0 || rockchip->link_gen > 2)
> > - rockchip->link_gen = 2;
> > + if (rockchip->link_gen < 0 || rockchip->link_gen >= 2) {
> > + rockchip->link_gen = 1;
> > + dev_warn(dev, "invalid max-link-speed, limited to 2.5 GT/s\n");
> > + }
> >
> > for (i = 0; i < ROCKCHIP_NUM_PM_RSTS; i++)
> > rockchip->pm_rsts[i].id = rockchip_pci_pm_rsts[i];
> > @@ -147,12 +149,12 @@ int rockchip_pcie_init_port(struct rockchip_pcie *rockchip)
> > goto err_exit_phy;
> > }
> >
> > + /* 5.0 GT/s may cause catastrophic failure for this core */
> > if (rockchip->link_gen == 2)
> > - rockchip_pcie_write(rockchip, PCIE_CLIENT_GEN_SEL_2,
>
> Sashiko caught unreachable dead code rightfully here. It looks like I
> had got it right in v4 and then the fix regressed.
>
> Will address this for v7 after I get more comments.
>
I don't have any comments other than this.
- Mani
--
மணிவண்ணன் சதாசிவம்
^ permalink raw reply
* Patch "arm64/mm: Enable batched TLB flush in unmap_hotplug_range()" has been added to the 5.15-stable tree
From: gregkh @ 2026-06-16 5:32 UTC (permalink / raw)
To: anshuman.khandual, catalin.marinas, david, gregkh,
linux-arm-kernel, ryan.roberts, sashal, will
Cc: stable-commits
In-Reply-To: <20260428185311.3151505-1-sashal@kernel.org>
This is a note to let you know that I've just added the patch titled
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
to the 5.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
and it can be found in the queue-5.15 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable+bounces-241760-greg=kroah.com@vger.kernel.org Wed Apr 29 00:24:42 2026
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 28 Apr 2026 14:53:11 -0400
Subject: arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
To: stable@vger.kernel.org
Cc: Anshuman Khandual <anshuman.khandual@arm.com>, Will Deacon <will@kernel.org>, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, "David Hildenbrand (Arm)" <david@kernel.org>, Ryan Roberts <ryan.roberts@arm.com>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260428185311.3151505-1-sashal@kernel.org>
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ]
During a memory hot remove operation, both linear and vmemmap mappings for
the memory range being removed, get unmapped via unmap_hotplug_range() but
mapped pages get freed only for vmemmap mapping. This is just a sequential
operation where each table entry gets cleared, followed by a leaf specific
TLB flush, and then followed by memory free operation when applicable.
This approach was simple and uniform both for vmemmap and linear mappings.
But linear mapping might contain CONT marked block memory where it becomes
necessary to first clear out all entire in the range before a TLB flush.
This is as per the architecture requirement. Hence batch all TLB flushes
during the table tear down walk and finally do it in unmap_hotplug_range().
Prior to this fix, it was hypothetically possible for a speculative access
to a higher address in the contiguous block to fill the TLB with shattered
entries for the entire contiguous range after a lower address had already
been cleared and invalidated. Due to the table entries being shattered, the
subsequent TLB invalidation for the higher address would not then clear the
TLB entries for the lower address, meaning stale TLB entries could persist.
Besides it also helps in improving the performance via TLBI range operation
along with reduced synchronization instructions. The time spent executing
unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal
in KVM guest.
This scheme is not applicable during vmemmap mapping tear down where memory
needs to be freed and hence a TLB flush is required after clearing out page
table entry.
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/
Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove")
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ replaced `__pte_clear()` with `pte_clear()` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -886,10 +886,14 @@ static void unmap_hotplug_pte_range(pmd_
WARN_ON(!pte_present(pte));
pte_clear(&init_mm, addr, ptep);
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pte_cont(pte));
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pte_page(pte),
PAGE_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
} while (addr += PAGE_SIZE, addr < end);
}
@@ -910,15 +914,14 @@ static void unmap_hotplug_pmd_range(pud_
WARN_ON(!pmd_present(pmd));
if (pmd_sect(pmd)) {
pmd_clear(pmdp);
-
- /*
- * One TLBI should be sufficient here as the PMD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pmd_cont(pmd));
+ flush_tlb_kernel_range(addr, addr + PMD_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pmd_table(pmd));
@@ -943,15 +946,12 @@ static void unmap_hotplug_pud_range(p4d_
WARN_ON(!pud_present(pud));
if (pud_sect(pud)) {
pud_clear(pudp);
-
- /*
- * One TLBI should be sufficient here as the PUD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ flush_tlb_kernel_range(addr, addr + PUD_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pud_table(pud));
@@ -981,6 +981,7 @@ static void unmap_hotplug_p4d_range(pgd_
static void unmap_hotplug_range(unsigned long addr, unsigned long end,
bool free_mapped, struct vmem_altmap *altmap)
{
+ unsigned long start = addr;
unsigned long next;
pgd_t *pgdp, pgd;
@@ -1002,6 +1003,9 @@ static void unmap_hotplug_range(unsigned
WARN_ON(!pgd_present(pgd));
unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap);
} while (addr = next, addr < end);
+
+ if (!free_mapped)
+ flush_tlb_kernel_range(start, end);
}
static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
Patches currently in stable-queue which might be from sashal@kernel.org are
queue-5.15/bonding-refuse-to-enslave-can-devices.patch
queue-5.15/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-5.15/asoc-codecs-simple-mux-fix-enum-control-bounds-check.patch
queue-5.15/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-5.15/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-5.15/ethtool-eeprom-add-more-safeties-to-eeprom-netlink-f.patch
queue-5.15/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-5.15/randomize_kstack-maintain-kstack_offset-per-task.patch
queue-5.15/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-5.15/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-5.15/drm-vc4-fix-krealloc-memory-leak.patch
queue-5.15/f2fs-fix-to-do-sanity-check-on-dcc-discard_cmd_cnt-conditionally.patch
queue-5.15/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-5.15/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-5.15/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-5.15/bluetooth-bnep-reject-short-frames-before-parsing.patch
queue-5.15/nvme-respect-nvme_quirk_disable_write_zeroes-when-wzsl-is-set.patch
queue-5.15/rtw88-8821ce-disable-pcie-aspm-l1-for-8821ce-using-chip-id.patch
queue-5.15/net-qrtr-ns-free-the-node-during-ctrl_cmd_bye.patch
queue-5.15/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-5.15/crypto-nx-avoid-wflex-array-member-not-at-end-warning.patch
queue-5.15/drm-i915-psr-read-intel-dpcd-workaround-register.patch
queue-5.15/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-5.15/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-5.15/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-5.15/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-5.15/ext4-validate-p_idx-bounds-in-ext4_ext_correct_index.patch
queue-5.15/wifi-rtw88-check-for-pci-upstream-bridge-existence.patch
queue-5.15/bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
queue-5.15/mtd-spi-nor-sst-fix-write-enable-before-aai-sequence.patch
queue-5.15/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-5.15/alsa-aoa-i2sbus-clear-stale-prepared-state.patch
queue-5.15/sched-use-u64-for-bandwidth-ratio-calculations.patch
queue-5.15/revert-rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch
queue-5.15/can-ucan-fix-devres-lifetime.patch
queue-5.15/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-5.15/media-rc-igorplugusb-heed-coherency-rules.patch
queue-5.15/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-5.15/net-qrtr-ns-change-servers-radix-tree-to-xarray.patch
queue-5.15/net-mctp-ensure-our-nlmsg-responses-are-initialised.patch
queue-5.15/media-rc-ttusbir-respect-dma-coherency-rules.patch
queue-5.15/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-5.15/nvme-fix-interpretation-of-dmrsl.patch
queue-5.15/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-5.15/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-5.15/crypto-nx-fix-bounce-buffer-leaks-in-nx842_crypto_-alloc-free-_ctx.patch
queue-5.15/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-5.15/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-5.15/can-ucan-fix-typos-in-comments.patch
queue-5.15/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-5.15/drm-remove-plane-hsub-vsub-alignment-requirement-for.patch
queue-5.15/net-qrtr-ns-limit-the-total-number-of-nodes.patch
queue-5.15/scsi-sd-fix-missing-put_disk-when-device_add-disk_dev-fails.patch
queue-5.15/serial-dz-fix-bootconsole-handover-lockup.patch
queue-5.15/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-5.15/drm-i915-psr-add-defininitions-for-intel_wa_register.patch
queue-5.15/net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
queue-5.15/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-5.15/udf-fix-partition-descriptor-append-bookkeeping.patch
queue-5.15/scsi-sd-add-error-handling-support-for-add_disk.patch
queue-5.15/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-5.15/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-5.15/net-mvpp2-add-metadata-support-for-xdp-mode.patch
queue-5.15/net-mctp-fix-don-t-require-received-header-reserved-bits-to-be-zero.patch
queue-5.15/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-5.15/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-5.15/alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch
queue-5.15/hid-core-fix-size_t-specifier-in-hid_report_raw_even.patch
queue-5.15/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-5.15/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-5.15/wifi-brcmfmac-fix-use-after-free-when-rescheduling-b.patch
queue-5.15/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-5.15/mtd-docg3-fix-use-after-free-in-docg3_release.patch
queue-5.15/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-5.15/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-5.15/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
queue-5.15/fbdev-defio-disconnect-deferred-i-o-from-the-lifetime-of-struct-fb_info.patch
queue-5.15/net-packet-fix-toctou-race-on-mmap-d-vnet_hdr-in-tpacket_snd.patch
queue-5.15/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-5.15/gpio-rockchip-convert-bank-clk-to-devm_clk_get_enabl.patch
queue-5.15/hid-pass-the-buffer-size-to-hid_report_raw_event.patch
queue-5.15/smb-server-fix-active_num_conn-leak-on-transport-allocation-failure.patch
queue-5.15/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
queue-5.15/printk-add-print_hex_dump_devel.patch
queue-5.15/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-5.15/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-5.15/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-5.15/wifi-mwifiex-fix-use-after-free-in-mwifiex_adapter_cleanup.patch
queue-5.15/tracepoint-balance-regfunc-on-func_add-failure-in-tracepoint_add_func.patch
queue-5.15/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-5.15/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-5.15/compiler-clang.h-add-__diag-infrastructure-for-clang.patch
queue-5.15/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-5.15/smb-client-fix-oob-read-in-smb2_ioctl_query_info-query_info-path.patch
queue-5.15/batman-adv-tp_meter-directly-shut-down-timer-on-clea.patch
queue-5.15/netfilter-nf_log-validate-mac-header-was-set-before-.patch
queue-5.15/alsa-core-fix-potential-data-race-at-fasync-handling.patch
queue-5.15/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-5.15/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-5.15/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-5.15/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-5.15/phy-mscc-use-phy_id_match_vendor-to-minimize-phy-id-.patch
queue-5.15/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-5.15/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-5.15/hfsplus-fix-uninit-value-by-validating-catalog-record-size.patch
queue-5.15/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-5.15/net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
queue-5.15/mtd-docg3-convert-to-platform-remove-callback-returning-void.patch
queue-5.15/scsi-core-pm-rely-on-the-device-driver-core-for-async-power-management.patch
queue-5.15/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-5.15/net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
queue-5.15/bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
queue-5.15/hid-core-add-printk_ratelimited-variants-to-hid_warn.patch
queue-5.15/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-5.15/mm-damon-ops-common-call-folio_test_lru-after-folio_.patch
queue-5.15/mmc-sdhci-of-dwcmshc-disable-clock-before-dll-configuration.patch
queue-5.15/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-5.15/drm-dp-add-edp-1.5-bit-definition.patch
queue-5.15/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch
queue-5.15/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-5.15/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-5.15/net-qrtr-ns-limit-the-maximum-number-of-lookups.patch
queue-5.15/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-5.15/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-5.15/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-5.15/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-5.15/arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
queue-5.15/alsa-aoa-use-guard-for-mutex-locks.patch
queue-5.15/bluetooth-hci_event-fix-potential-uaf-in-ssp-passkey-handlers.patch
queue-5.15/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-5.15/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-5.15/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-5.15/net-cpsw_new-fix-potential-unregister-of-netdev-that.patch
queue-5.15/smb-server-fix-max_connections-off-by-one-in-tcp-accept-path.patch
queue-5.15/drm-i915-psr-apply-intel-dpcd-workaround-when-sdp-on.patch
queue-5.15/net-iucv-fix-locking-in-.getsockopt.patch
queue-5.15/rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch-82
queue-5.15/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-5.15/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-5.15/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-5.15/erofs-fix-the-out-of-bounds-nameoff-handling-for-trailing-dirents.patch
queue-5.15/smb-client-require-a-full-nfs-mode-sid-before-reading-mode-bits.patch
queue-5.15/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-5.15/ceph-only-d_add-negative-dentries-when-they-are-unhashed.patch
queue-5.15/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-5.15/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-5.15/bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
queue-5.15/net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch
queue-5.15/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
queue-5.15/f2fs-fix-uaf-caused-by-decrementing-sbi-nr_pages-in-f2fs_write_end_io.patch
queue-5.15/thermal-core-fix-thermal-zone-governor-cleanup-issues.patch
queue-5.15/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-5.15/crypto-nx-migrate-to-scomp-api.patch
queue-5.15/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-5.15/sd-rename-the-scsi_disk.dev-field.patch
queue-5.15/crypto-caam-guard-hmac-key-hex-dumps-in-hash_digest_key.patch
queue-5.15/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-5.15/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-5.15/selftests-forwarding-lib-add-helpers-for-checksum-ha.patch
queue-5.15/hfsplus-fix-held-lock-freed-on-hfsplus_fill_super.patch
queue-5.15/ksmbd-require-minimum-ace-size-in-smb_check_perm_dacl.patch
queue-5.15/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-5.15/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-5.15/phy-mscc-use-phy_id_match_exact-for-vsc8584-vsc8582-.patch
queue-5.15/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-5.15/erofs-fix-unsigned-underflow-in-z_erofs_lz4_handle_overlap.patch
queue-5.15/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-5.15/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-5.15/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-5.15/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
queue-5.15/rxrpc-fix-conn-level-packet-handling-to-unshare-response-packets.patch
queue-5.15/nfsd-don-t-ignore-the-return-code-of-svc_proc_regist.patch
^ permalink raw reply
* Patch "arm64/mm: Enable batched TLB flush in unmap_hotplug_range()" has been added to the 6.1-stable tree
From: gregkh @ 2026-06-16 5:16 UTC (permalink / raw)
To: anshuman.khandual, catalin.marinas, david, gregkh,
linux-arm-kernel, ryan.roberts, sashal, will
Cc: stable-commits
In-Reply-To: <20260428181949.3127002-1-sashal@kernel.org>
This is a note to let you know that I've just added the patch titled
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable+bounces-241756-greg=kroah.com@vger.kernel.org Tue Apr 28 23:49:57 2026
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 28 Apr 2026 14:19:49 -0400
Subject: arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
To: stable@vger.kernel.org
Cc: Anshuman Khandual <anshuman.khandual@arm.com>, Will Deacon <will@kernel.org>, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, "David Hildenbrand (Arm)" <david@kernel.org>, Ryan Roberts <ryan.roberts@arm.com>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260428181949.3127002-1-sashal@kernel.org>
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ]
During a memory hot remove operation, both linear and vmemmap mappings for
the memory range being removed, get unmapped via unmap_hotplug_range() but
mapped pages get freed only for vmemmap mapping. This is just a sequential
operation where each table entry gets cleared, followed by a leaf specific
TLB flush, and then followed by memory free operation when applicable.
This approach was simple and uniform both for vmemmap and linear mappings.
But linear mapping might contain CONT marked block memory where it becomes
necessary to first clear out all entire in the range before a TLB flush.
This is as per the architecture requirement. Hence batch all TLB flushes
during the table tear down walk and finally do it in unmap_hotplug_range().
Prior to this fix, it was hypothetically possible for a speculative access
to a higher address in the contiguous block to fill the TLB with shattered
entries for the entire contiguous range after a lower address had already
been cleared and invalidated. Due to the table entries being shattered, the
subsequent TLB invalidation for the higher address would not then clear the
TLB entries for the lower address, meaning stale TLB entries could persist.
Besides it also helps in improving the performance via TLBI range operation
along with reduced synchronization instructions. The time spent executing
unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal
in KVM guest.
This scheme is not applicable during vmemmap mapping tear down where memory
needs to be freed and hence a TLB flush is required after clearing out page
table entry.
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/
Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove")
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ replaced `__pte_clear()` with `pte_clear()` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -925,10 +925,14 @@ static void unmap_hotplug_pte_range(pmd_
WARN_ON(!pte_present(pte));
pte_clear(&init_mm, addr, ptep);
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pte_cont(pte));
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pte_page(pte),
PAGE_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
} while (addr += PAGE_SIZE, addr < end);
}
@@ -949,15 +953,14 @@ static void unmap_hotplug_pmd_range(pud_
WARN_ON(!pmd_present(pmd));
if (pmd_sect(pmd)) {
pmd_clear(pmdp);
-
- /*
- * One TLBI should be sufficient here as the PMD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pmd_cont(pmd));
+ flush_tlb_kernel_range(addr, addr + PMD_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pmd_table(pmd));
@@ -982,15 +985,12 @@ static void unmap_hotplug_pud_range(p4d_
WARN_ON(!pud_present(pud));
if (pud_sect(pud)) {
pud_clear(pudp);
-
- /*
- * One TLBI should be sufficient here as the PUD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ flush_tlb_kernel_range(addr, addr + PUD_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pud_table(pud));
@@ -1020,6 +1020,7 @@ static void unmap_hotplug_p4d_range(pgd_
static void unmap_hotplug_range(unsigned long addr, unsigned long end,
bool free_mapped, struct vmem_altmap *altmap)
{
+ unsigned long start = addr;
unsigned long next;
pgd_t *pgdp, pgd;
@@ -1041,6 +1042,9 @@ static void unmap_hotplug_range(unsigned
WARN_ON(!pgd_present(pgd));
unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap);
} while (addr = next, addr < end);
+
+ if (!free_mapped)
+ flush_tlb_kernel_range(start, end);
}
static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
Patches currently in stable-queue which might be from sashal@kernel.org are
queue-6.1/f2fs-use-kfree-instead-of-kvfree-to-free-some-memory.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-gpio-pmbus-accesses-wi.patch
queue-6.1/bonding-refuse-to-enslave-can-devices.patch
queue-6.1/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-6.1/asoc-codecs-simple-mux-fix-enum-control-bounds-check.patch
queue-6.1/selftests-bpf-add-read_build_id-function.patch
queue-6.1/smb-client-validate-the-whole-dacl-before-rewriting-it-in-cifsacl.patch
queue-6.1/rdma-rxe-complete-the-rxe_cleanup_task-backport.patch
queue-6.1/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-6.1/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-6.1/ethtool-eeprom-add-more-safeties-to-eeprom-netlink-f.patch
queue-6.1/vxlan-vnifilter-fix-spurious-notification-on-vni-upd.patch
queue-6.1/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-6.1/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-6.1/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-6.1/drm-vc4-fix-krealloc-memory-leak.patch
queue-6.1/f2fs-fix-to-do-sanity-check-on-dcc-discard_cmd_cnt-conditionally.patch
queue-6.1/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-6.1/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-6.1/revert-selftests-bpf-workaround-strict-bpf_lsm-retur.patch
queue-6.1/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-6.1/bluetooth-bnep-reject-short-frames-before-parsing.patch
queue-6.1/net-packet-convert-po-has_vnet_hdr-to-an-atomic-flag.patch
queue-6.1/net-qrtr-ns-free-the-node-during-ctrl_cmd_bye.patch
queue-6.1/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-6.1/ipmi-fix-rcu_read_unlock-to-srcu_read_unlock-in-hand.patch
queue-6.1/drm-i915-psr-read-intel-dpcd-workaround-register.patch
queue-6.1/net-fec-fix-pinctrl-default-state-restore-order-on-r.patch
queue-6.1/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-6.1/net-gro-don-t-merge-zcopy-skbs.patch
queue-6.1/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-6.1/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-6.1/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-6.1/bluetooth-bnep-fix-incorrect-length-parsing-in-bnep_.patch
queue-6.1/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-6.1/loongarch-add-spectre-boundry-for-syscall-dispatch-table.patch
queue-6.1/alsa-aoa-i2sbus-clear-stale-prepared-state.patch
queue-6.1/sched-use-u64-for-bandwidth-ratio-calculations.patch
queue-6.1/revert-rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch
queue-6.1/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-6.1/media-rc-igorplugusb-heed-coherency-rules.patch
queue-6.1/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-6.1/net-qrtr-ns-change-servers-radix-tree-to-xarray.patch
queue-6.1/net-mctp-ensure-our-nlmsg-responses-are-initialised.patch
queue-6.1/media-rc-ttusbir-respect-dma-coherency-rules.patch
queue-6.1/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-6.1/ptp-vclock-switch-from-rcu-to-srcu.patch
queue-6.1/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-6.1/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-6.1/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-6.1/tools-bootconfig-cleanup-bootconfig-footer-size-calc.patch
queue-6.1/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-6.1/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-6.1/net-hsr-fix-potential-oob-access-in-supervision-fram.patch
queue-6.1/drm-remove-plane-hsub-vsub-alignment-requirement-for.patch
queue-6.1/net-qrtr-ns-limit-the-total-number-of-nodes.patch
queue-6.1/selftests-bpf-convert-test_global_funcs-test-to-test.patch
queue-6.1/serial-dz-fix-bootconsole-handover-lockup.patch
queue-6.1/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-6.1/net-packet-convert-po-tp_loss-to-an-atomic-flag.patch
queue-6.1/mm-hugetlb-avoid-false-positive-lockdep-assertion.patch
queue-6.1/drm-i915-psr-add-defininitions-for-intel_wa_register.patch
queue-6.1/revert-selftests-bpf-add-a-cgroup-prog-bpf_get_ns_cu.patch
queue-6.1/net-mvpp2-limit-xdp-frame-size-to-the-rx-buffer.patch
queue-6.1/bpf-fix-a-few-selftest-failures-due-to-llvm18-change.patch
queue-6.1/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-6.1/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-6.1/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-6.1/r8152-block-future-register-access-if-register-acces.patch
queue-6.1/net-mvpp2-add-metadata-support-for-xdp-mode.patch
queue-6.1/net-packet-convert-po-tp_tx_has_off-to-an-atomic-fla.patch
queue-6.1/net-mctp-fix-don-t-require-received-header-reserved-bits-to-be-zero.patch
queue-6.1/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-6.1/netfilter-nf_conntrack-destroy-stale-expectfn-expect.patch
queue-6.1/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-6.1/selftests-bpf-s-iptables-iptables-legacy-in-the-bpf_.patch
queue-6.1/revert-selftests-bpf-add-tests-for-_opts-variants-of.patch
queue-6.1/hid-core-fix-size_t-specifier-in-hid_report_raw_even.patch
queue-6.1/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-6.1/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-6.1/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-6.1/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-6.1/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-sequencer_state-debugf.patch
queue-6.1/fbdev-defio-disconnect-deferred-i-o-from-the-lifetime-of-struct-fb_info.patch
queue-6.1/bluetooth-mgmt-fix-backward-compatibility-with-users.patch
queue-6.1/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-6.1/gpio-rockchip-convert-bank-clk-to-devm_clk_get_enabl.patch
queue-6.1/selftests-bpf-enhance-align-selftest-s-expected-log-.patch
queue-6.1/netfilter-ctnetlink-ensure-safe-access-to-master-con.patch
queue-6.1/rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch-25226
queue-6.1/hid-pass-the-buffer-size-to-hid_report_raw_event.patch
queue-6.1/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
queue-6.1/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-6.1/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-6.1/tools-bootconfig-fix-buf-leaks-in-apply_xbc.patch
queue-6.1/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-6.1/wifi-mwifiex-fix-use-after-free-in-mwifiex_adapter_cleanup.patch
queue-6.1/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-6.1/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-6.1/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-6.1/tcp-restrict-so_attach_filter-to-priv-users.patch
queue-6.1/batman-adv-tp_meter-directly-shut-down-timer-on-clea.patch
queue-6.1/netfilter-nf_log-validate-mac-header-was-set-before-.patch
queue-6.1/mm-page_alloc-clear-page-private-in-free_pages_prepa.patch
queue-6.1/octeontx2-af-npc-fix-cpt-channel-mask-in-npc_install.patch
queue-6.1/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-6.1/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-6.1/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-6.1/bpf-bonding-reject-vlan-srcmac-xmit_hash_policy-chan.patch
queue-6.1/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-6.1/iomap-don-t-revert-iov_iter-on-partially-completed-b.patch
queue-6.1/phy-mscc-use-phy_id_match_vendor-to-minimize-phy-id-.patch
queue-6.1/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-6.1/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-6.1/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-6.1/lib-test_hmm-evict-device-pages-on-file-close-to-avoid-use-after-free.patch
queue-6.1/alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
queue-6.1/net-mvpp2-refill-rx-buffers-before-xdp-or-skb-use.patch
queue-6.1/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-6.1/selftests-bpf-fix-arg_ptr_to_long-half-uninitialized.patch
queue-6.1/net-mvpp2-build-skb-from-xdp-adjusted-data-on-xdp_pa.patch
queue-6.1/selftests-bpf-add-generic-bpf-program-tester-loader.patch
queue-6.1/bluetooth-fix-memory-leak-in-error-path-of-hci_alloc.patch
queue-6.1/hid-core-add-printk_ratelimited-variants-to-hid_warn.patch
queue-6.1/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-6.1/mm-damon-ops-common-call-folio_test_lru-after-folio_.patch
queue-6.1/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-6.1/asoc-wm_adsp-fix-null-dereference-when-removing-firm.patch
queue-6.1/net-skbuff-fix-missing-zerocopy-reference-in-pskb_ca.patch
queue-6.1/drm-dp-add-edp-1.5-bit-definition.patch
queue-6.1/dmaengine-idxd-fix-not-releasing-workqueue-on-.relea.patch
queue-6.1/ipv6-fix-possible-infinite-loop-in-rt6_fill_node.patch
queue-6.1/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-6.1/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-6.1/vxlan-vnifilter-send-notification-on-vni-add.patch
queue-6.1/usb-gadget-f_ncm-fix-net_device-lifecycle-with-devic.patch
queue-6.1/selftests-bpf-update-bpf_clone_redirect-expected-ret.patch
queue-6.1/net-skbuff-fix-pskb_carve-leaking-zcopy-pages.patch
queue-6.1/net-qrtr-ns-limit-the-maximum-number-of-lookups.patch
queue-6.1/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-6.1/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-6.1/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-6.1/spi-imx-fix-use-after-free-on-unbind.patch
queue-6.1/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-6.1/arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
queue-6.1/netfilter-nf_tables-restore-set-elements-when-delete.patch
queue-6.1/alsa-aoa-use-guard-for-mutex-locks.patch
queue-6.1/mm-huge_memory-update-file-pmd-counter-before-folio_.patch
queue-6.1/spi-fix-resource-leaks-on-device-setup-failure.patch
queue-6.1/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-6.1/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-6.1/net-mana-add-null-guards-in-teardown-path-to-prevent.patch
queue-6.1/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-6.1/net-packet-fix-toctou-race-on-mmap-d-vnet_hdr-in-tpa.patch
queue-6.1/net-cpsw_new-fix-potential-unregister-of-netdev-that.patch
queue-6.1/drm-i915-psr-apply-intel-dpcd-workaround-when-sdp-on.patch
queue-6.1/net-iucv-fix-locking-in-.getsockopt.patch
queue-6.1/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-6.1/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-6.1/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-6.1/batman-adv-tt-reject-oversized-local-tvlv-buffers.patch
queue-6.1/net-annotate-sk-sk_write_space-for-udp-sockmap.patch
queue-6.1/r8152-handle-the-return-value-of-usb_reset_device.patch
queue-6.1/hwmon-pmbus-adm1266-serialize-nvmem-blackbox-read-wi.patch
queue-6.1/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-6.1/r8152-reduce-the-control-transfer-of-rtl8152_get_ver.patch
queue-6.1/net-packet-convert-po-running-to-an-atomic-flag.patch
queue-6.1/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-6.1/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-6.1/bluetooth-rfcomm-validate-skb-length-in-mcc-handlers.patch
queue-6.1/net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch
queue-6.1/fs-ntfs3-return-error-for-inconsistent-extended-attr.patch
queue-6.1/f2fs-fix-uaf-caused-by-decrementing-sbi-nr_pages-in-f2fs_write_end_io.patch
queue-6.1/thermal-core-fix-thermal-zone-governor-cleanup-issues.patch
queue-6.1/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-6.1/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-6.1/spi-imx-convert-to-platform-remove-callback-returning-void.patch
queue-6.1/net-mlx4-avoid-gcc-10-__bad_copy_from-false-positive.patch
queue-6.1/ipv6-fix-possible-infinite-loop-in-fib6_select_path.patch
queue-6.1/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-6.1/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-6.1/selftests-forwarding-lib-add-helpers-for-checksum-ha.patch
queue-6.1/ksmbd-require-minimum-ace-size-in-smb_check_perm_dacl.patch
queue-6.1/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-6.1/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-6.1/phy-mscc-use-phy_id_match_exact-for-vsc8584-vsc8582-.patch
queue-6.1/usb-gadget-u_ether-fix-null-pointer-deref-in-eth_get.patch
queue-6.1/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-6.1/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-6.1/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-6.1/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-6.1/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
^ permalink raw reply
* Re: [PATCH v2] arm64: tlbflush: Don't broadcast if mm was only active on local cpu
From: Linu Cherian @ 2026-06-16 5:05 UTC (permalink / raw)
To: Ryan Roberts
Cc: Will Deacon, Catalin Marinas, Kevin Brodsky, Anshuman Khandual,
Yang Shi, Mark Rutland, Huang Ying, linux-arm-kernel,
linux-kernel, shameerali.kolothum.thodi
In-Reply-To: <4aa78619-5a79-4fd0-aaac-a990b8c3fd05@arm.com>
Hi,
On Mon, Jun 15, 2026 at 04:41:04PM +0100, Ryan Roberts wrote:
> On 15/06/2026 15:43, Will Deacon wrote:
> > On Mon, Jun 15, 2026 at 12:21:19PM +0100, Ryan Roberts wrote:
> >> On 14/06/2026 12:04, Will Deacon wrote:
> >>> On Sat, May 23, 2026 at 07:17:10PM +0530, Linu Cherian wrote:
> >>>> From: Ryan Roberts <ryan.roberts@arm.com>
> >>>>
> >>>> Testing with 7.1-rc4 :
> >>>> +-----------------------+---------------------------------------------------+-------------+
> >>>> | Benchmark | Result Class | Improvement|
> >>>> +=======================+===================================================+=============+
> >>>> | perf/syscall | fork (ops/sec) | (I) 3.25% |
> >>>> +-----------------------+---------------------------------------------------+-------------+
> >>>> | pts/memtier-benchmark | Protocol: Redis Clients: 100 Ratio: 1:5 (Ops/sec) | (I) 2.70% |
> >>>> | | Protocol: Redis Clients: 100 Ratio: 5:1 (Ops/sec) | (I) 2.13% |
> >>>> +-----------------------+---------------------------------------------------+-------------+
> >>>
> >>> I think we need a much more comprehensive set of benchmarks before we can
> >>> begin to consider a change like this.
> >>
> >> I believe that Linu ran a wider set of benchmarks and didn't find any
> >> regressions. These are just the ones that show improvement (Linu, please correct
> >> me and/or provide details).
> >
> > I think it's important to show the ones that suffer as well... and also
> > look at different configurations (e.g. preemptible settings) and different
> > environments (e.g. native vs in a VM).
> >
> >> Additionally Huang Ying did some testing against the RFC and reported 4.5%
> >> improvement with Redis:
> >>
> >> https://lore.kernel.org/linux-arm-kernel/87segumv6w.fsf@DESKTOP-5N7EMDA
> >
> > To be clear: I'm not disputing that some benchmarks appear to show a small
> > boost from this series. I'm just worried that's not the whole story.
> >
> >>>> arch/arm64/include/asm/mmu.h | 12 +++
> >>>> arch/arm64/include/asm/mmu_context.h | 2 +
> >>>> arch/arm64/include/asm/tlbflush.h | 127 +++++++++++++++++++++------
> >>>> arch/arm64/mm/context.c | 30 ++++++-
> >>>> 4 files changed, 141 insertions(+), 30 deletions(-)
> >>>
> >>> Doesn't this break BTM/SVM with the SMMU? I think that's a non-starter
> >>> even if you can provide some more compelling numbers.
> >>
> >> AIUI, we don't support BTM upstream - the SMMU uses private ASIDs and implements
> >> MMU notifiers to forward the TLBIs via its command queue interface.
> >>
> >> I was also under the impression that supporting BTM upsteam was not desired;
> >> Please correct me if that's not accurate or if you're aware of plans to add
> >> support. I've been (coincidentlly) looking at some other stuff that could
> >> benefit from BTM but had concluded it wouldn't be an acceptable approach upstream.
> >>
> >> If we did ever want to add SMMU BTM support though, I think it would be simple
> >> enough to add an interface to allow the SMMU to disable the optimization (i.e.
> >> force active_cpu to ACTIVE_CPU_MULTIPLE)?
> >
> > We used to have some initial BTM support in the SMMUv3 driver but the
> > main problem was finding an upstream driver/soc that can use it properly
> > and so it was ultimately removed in d38c28dbefee ("iommu/arm-smmu-v3: Put
> > the SVA mmu notifier in the smmu_domain") because it was getting in the
> > way of wider driver rework and we couldn't test it.
> >
> > However, there *is* work to re-enable it on top of that rework (and other
> > changes):
> >
> > https://lore.kernel.org/linux-iommu/20250319173202.78988-6-shameerali.kolothum.thodi@huawei.com/
> >
> > although I don't know if Shameer intends to repost that...
>
> Thanks for the pointers; That's very interesting feedback. I'll take a closer
> look :)
>
> >
> >>>> +static inline bool flush_tlb_user_pre(struct mm_struct *mm, tlbf_t flags)
> >>>> +{
> >>>> + unsigned int self, active;
> >>>> + bool local;
> >>>> +
> >>>> + migrate_disable();
> >>>> +
> >>>> + if (flags & TLBF_NOBROADCAST) {
> >>>> + dsb(nshst);
> >>>> + return true;
> >>>> + }
> >>>
> >>> Why does the NOBROADCAST case need migration disabled? It didn't before...
> >>
> >> The existing semantic for TLBF_BOBROADCAST is that it emits a local TLBI on
> >> whatever CPU we happen to be executing on. It's used for lazily fixing up
> >> spurious faults (i.e. hitting RO TLB entries when the PTE has been relaxed to
> >> RW). So it's still functionally correct if the thread migrates CPU between
> >> taking the fault and issuing the local TLBI - in the worst case it just leads to
> >> another spurious fault.
> >>
> >> For this new case, we need to ensure we don't get migrated between reading
> >> active_cpu and issuing the local TLBI, otherwise we would only issue a local
> >> TLBI when a broadcast was required.
> >
> > Sounds like those two users probably need separating out, then?
>
> Ahh, I see; I'll admit I hadn't actually reviewed the new integration part. I
> agree - NOBROADCAST is different to to this. This is an optimization for the
> "not NOBROADCAST" case. We need to avoid disabling migration in the NOBROADCAST
> case.
>
Ack.
^ permalink raw reply
* Re: [PATCH v2] arm64: tlbflush: Don't broadcast if mm was only active on local cpu
From: Linu Cherian @ 2026-06-16 5:00 UTC (permalink / raw)
To: Will Deacon
Cc: Ryan Roberts, Catalin Marinas, Kevin Brodsky, Anshuman Khandual,
Yang Shi, Mark Rutland, Huang Ying, linux-arm-kernel,
linux-kernel, shameerali.kolothum.thodi
In-Reply-To: <ajAPnahwTe1OHQDp@willie-the-truck>
Hi,
On Mon, Jun 15, 2026 at 03:43:41PM +0100, Will Deacon wrote:
> On Mon, Jun 15, 2026 at 12:21:19PM +0100, Ryan Roberts wrote:
> > On 14/06/2026 12:04, Will Deacon wrote:
> > > On Sat, May 23, 2026 at 07:17:10PM +0530, Linu Cherian wrote:
> > >> From: Ryan Roberts <ryan.roberts@arm.com>
> > >>
> > >> Testing with 7.1-rc4 :
> > >> +-----------------------+---------------------------------------------------+-------------+
> > >> | Benchmark | Result Class | Improvement|
> > >> +=======================+===================================================+=============+
> > >> | perf/syscall | fork (ops/sec) | (I) 3.25% |
> > >> +-----------------------+---------------------------------------------------+-------------+
> > >> | pts/memtier-benchmark | Protocol: Redis Clients: 100 Ratio: 1:5 (Ops/sec) | (I) 2.70% |
> > >> | | Protocol: Redis Clients: 100 Ratio: 5:1 (Ops/sec) | (I) 2.13% |
> > >> +-----------------------+---------------------------------------------------+-------------+
> > >
> > > I think we need a much more comprehensive set of benchmarks before we can
> > > begin to consider a change like this.
> >
> > I believe that Linu ran a wider set of benchmarks and didn't find any
> > regressions. These are just the ones that show improvement (Linu, please correct
> > me and/or provide details).
>
> I think it's important to show the ones that suffer as well... and also
> look at different configurations (e.g. preemptible settings) and different
> environments (e.g. native vs in a VM).
All our tests were ran on the host.
Yeah, agree that other suggested configurations/environments need to be anlayzed as well.
--
Thanks,
Linu Cherian.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox