* Re: [PATCH RFC v7 0/9] firmware: arm_scmi: vendors: Qualcomm Generic Vendor Extensions
From: Sudeep Holla @ 2026-06-16 8:27 UTC (permalink / raw)
To: Pragnesh Papaniya
Cc: Cristian Marussi, Rob Herring, Krzysztof Kozlowski, Sudeep Holla,
Conor Dooley, Sibi Sankar, MyungJoo Ham, Kyungmin Park,
Chanwoo Choi, Dmitry Osipenko, Thierry Reding, Jonathan Hunter,
Bjorn Andersson, Konrad Dybcio, Rajendra Nayak, Pankaj Patil,
linux-arm-msm, linux-kernel, arm-scmi, linux-arm-kernel,
devicetree, linux-pm, linux-tegra, Amir Vajid,
Ramakrishna Gottimukkula
In-Reply-To: <20260610-rfc_v7_scmi_memlat-v7-0-f3f68c608f25@oss.qualcomm.com>
On Wed, Jun 10, 2026 at 02:21:27PM +0530, Pragnesh Papaniya wrote:
> The QCOM SCMI vendor protocol provides a generic way of exposing a number of
> Qualcomm SoC specific features (like memory bus scaling) through a mixture of
> pre-determined algorithm strings and param_id pairs hosted on the SCMI
> controller. On Qualcomm Glymur and Hamoa SoCs, the memlat governor and the
> mechanism to control the various caches and RAM is hosted on the CPU Control
> Processor (CPUCP) and the method to tweak and start the governor is exposed
> through the QCOM SCMI Generic Extension Protocol.
>
> This series introduces the devfreq SCMI client driver that uses the MEMLAT
> algorithm string hosted on the QCOM SCMI Generic Extension Protocol to detect
> memory latency workloads and control frequency/level of the various memory
> buses (DDR/LLCC/DDR_QOS). DDR/LLCC/DDR_QOS are modelled as devfreq devices
> using the remote devfreq governor. This provides basic insight into device
> operation via trans_stat and lets userspace further tweak the parameters of
> the remote governor.
>
> trans_stat data for DDR/LLCC/DDR_QOS is now available with this series:
>
> From : To
> 315000000 479000000 545000000 725000000 840000000 959000000 1090000000 1211000000 time(ms)
> 315000000: 0 3 6 6 6 7 0 30 143956
> 479000000: 2 0 7 1 1 1 0 3 356
> 545000000: 7 6 0 5 5 0 0 10 1200
> 725000000: 3 0 5 0 6 1 0 6 2172
> 840000000: 8 2 3 2 0 4 0 12 1188
> 959000000: 3 0 1 2 2 0 0 13 272
> 1090000000: 0 0 0 0 0 0 0 0 0
> 1211000000: 35 4 11 5 11 8 0 0 21684
> Total transition : 253
>
> QCOM SCMI Generic Vendor protocol background:
> A lot of the vendor protocol numbers used internally were for
> debug/internal development purposes that were either highly SoC-specific
> or had to be disabled because some features were fused out during
> production. This led to a large number of vendor protocol numbers being
> quickly consumed and never released. Using a single generic vendor
> protocol with functionality abstracted behind algorithm strings gives us
> the flexibility of letting such functionality exist during initial
> development/debugging while still being able to expose mature features
> (like MEMLAT) once they have stabilised. The param_ids are expected to
> act as ABI for algorithm strings like MEMLAT.
>
Not sure if it was discussed in the previous versions or not, it would be
good if you can capture why some of bus scaling doesn't work with the existing
SCMI performance protocol and the monitors don't fit the MPAM mode.
Please capture them in 1/9 as a motivation for this vendor protocol. It will
then help to understand it better as I am still struggling to. Sorry for that.
--
Regards,
Sudeep
^ permalink raw reply
* [GIT PULL 3/4] soc: defconfig updates for 7.2
From: Arnd Bergmann @ 2026-06-16 8:18 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
linux-kernel
In-Reply-To: <40c8ebc3-d681-4dcf-b3f2-ce0d780c539e@app.fastmail.com>
The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:
Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git tags/soc-defconfig-7.2
for you to fetch changes up to cccde8de2c72068051ff8351ae6f1e2a12718aa0:
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig (2026-06-12 09:03:41 +0200)
----------------------------------------------------------------
soc: defconfig updates for 7.2
The main change this time is a cleanup series from Krzysztof Kozlowski
that updates the defconfig files to be more in sync with changes to
the Kconfig files that moved options around or removed the completely.
In addition, a number of drivers get enabled, in order to support
more hardware out of the box, as usual.
----------------------------------------------------------------
I originally sent this as 0/4, which was obviously a mistake.
Albert Yang (1):
arm64: defconfig: enable BST SDHCI controller
Arnd Bergmann (5):
Merge tag 'v7.2-qcom-pinctrl-defconfigs' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into soc/defconfig
Merge tag 'cix-defconfig-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/defconfig
Merge tag 'at91-defconfig-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig
Merge tag 'imx-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/defconfig
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig
Krzysztof Kozlowski (12):
pinctrl: qcom: Make important drivers default (2)
arm64: defconfig: Move entries to match savedefconfig
arm64: defconfig: Drop unused legacy netfilter options
arm64: defconfig: Drop default or selected drivers
arm64: defconfig: Drop unused Ethernet vendors
arm64: defconfig: Switch Ethernet drivers to modules
ARM: multi_v7_defconfig: Move entries to match savedefconfig
ARM: configs: Drop redundant I2C_DESIGNWARE_PLATFORM
ARM: configs: Drop redundant SND_ATMEL_SOC
ARM: multi_v7_defconfig: Cleanup redundant options
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
ARM: configs: Drop duplicated CONFIG_EXT4_FS
Manikandan Muralidharan (1):
ARM: configs: at91: sama7: add sama7d65 i3c-hci
Manivannan Sadhasivam (1):
arm64: defconfig: Enable PCI M.2 power sequencing driver
Maxime Ripard (1):
ARM: multi_v7_defconfig: Enable dma-buf heaps
Peter Chen (1):
arm64: defconfig: Enable CIX Sky1 pinctrl, PCIe host, and Cadence GPIO
Ryan Chen (1):
arm64: configs: Update defconfig for AST2700 platform support
Stefan Wahren (1):
arm64: defconfig: Enable DP83822 PHY driver
arch/arm/configs/at91_dt_defconfig | 1 -
arch/arm/configs/axm55xx_defconfig | 1 -
arch/arm/configs/dove_defconfig | 1 -
arch/arm/configs/ep93xx_defconfig | 1 -
arch/arm/configs/hisi_defconfig | 1 -
arch/arm/configs/mmp2_defconfig | 1 -
arch/arm/configs/multi_v5_defconfig | 1 -
arch/arm/configs/multi_v7_defconfig | 106 ++++-----
arch/arm/configs/mv78xx0_defconfig | 1 -
arch/arm/configs/pxa_defconfig | 2 -
arch/arm/configs/qcom_defconfig | 15 --
arch/arm/configs/sama5_defconfig | 1 -
arch/arm/configs/sama7_defconfig | 3 +-
arch/arm/configs/socfpga_defconfig | 1 -
arch/arm/configs/spear13xx_defconfig | 1 -
arch/arm/configs/spear3xx_defconfig | 1 -
arch/arm/configs/spear6xx_defconfig | 1 -
arch/arm64/configs/defconfig | 423 +++++++++++++++++------------------
18 files changed, 250 insertions(+), 312 deletions(-)
^ permalink raw reply
* Re: [PATCH v2] spi: uniphier: Fix completion initialization order before devm_request_irq()
From: Masami Hiramatsu @ 2026-06-16 8:16 UTC (permalink / raw)
To: Kunihiko Hayashi
Cc: Mark Brown, linux-spi, linux-arm-kernel, linux-kernel,
Sangyun Kim, Kyungwook Boo, stable, Masami Hiramatsu
In-Reply-To: <20260616011223.201357-1-hayashi.kunihiko@socionext.com>
On Tue, 16 Jun 2026 10:12:23 +0900
Kunihiko Hayashi <hayashi.kunihiko@socionext.com> wrote:
> The driver calls devm_request_irq() before initializing the completion
> used by the interrupt handler. Because the interrupt may occur immediately
> after devm_request_irq(), the handler may execute before init_completion().
>
> This may result in calling complete() on an uninitialized completion,
> causing undefined behavior. This has been observed with KASAN.
>
> Fix this by initializing the completion before registering the IRQ.
>
> Reported-by: Sangyun Kim <sangyun.kim@snu.ac.kr>
> Reported-by: Kyungwook Boo <bookyungwook@gmail.com>
> Fixes: 5ba155a4d4cc ("spi: add SPI controller driver for UniPhier SoC")
> Cc: stable@vger.kernel.org
> Cc: Masami Hiramatsu <mhiramat@kernel.org>
> Signed-off-by: Kunihiko Hayashi <hayashi.kunihiko@socionext.com>
Looks good to me.
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
> ---
> Changes in v2:
> - Rebase onto latest, no functional changes
BTW, please clarify the actual branch name instead of "latest".
Thanks,
>
> drivers/spi/spi-uniphier.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/spi/spi-uniphier.c b/drivers/spi/spi-uniphier.c
> index cc20fd11f03f..86fce9a571da 100644
> --- a/drivers/spi/spi-uniphier.c
> +++ b/drivers/spi/spi-uniphier.c
> @@ -656,6 +656,8 @@ static int uniphier_spi_probe(struct platform_device *pdev)
> priv->host = host;
> priv->is_save_param = false;
>
> + init_completion(&priv->xfer_done);
> +
> priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
> if (IS_ERR(priv->base))
> return PTR_ERR(priv->base);
> @@ -679,8 +681,6 @@ static int uniphier_spi_probe(struct platform_device *pdev)
> return ret;
> }
>
> - init_completion(&priv->xfer_done);
> -
> clk_rate = clk_get_rate(priv->clk);
>
> host->max_speed_hz = DIV_ROUND_UP(clk_rate, SSI_MIN_CLK_DIVIDER);
> --
> 2.34.1
>
--
Masami Hiramatsu (Google) <mhiramat@kernel.org>
^ permalink raw reply
* [soc:for-next] BUILD SUCCESS 972ea78305bddb6a1db0586357914f125e913ffe
From: kernel test robot @ 2026-06-16 8:02 UTC (permalink / raw)
To: Arnd Bergmann; +Cc: linux-arm-kernel, arm
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git for-next
branch HEAD: 972ea78305bddb6a1db0586357914f125e913ffe soc: document merges
elapsed time: 835m
configs tested: 258
configs skipped: 3
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-16.1.0
alpha allyesconfig gcc-16.1.0
alpha defconfig gcc-16.1.0
arc allmodconfig clang-23
arc allmodconfig gcc-16.1.0
arc allnoconfig gcc-16.1.0
arc allyesconfig clang-23
arc allyesconfig gcc-16.1.0
arc defconfig gcc-16.1.0
arc randconfig-001-20260616 gcc-9.5.0
arc randconfig-002-20260616 gcc-9.5.0
arm allnoconfig clang-23
arm allnoconfig gcc-16.1.0
arm allyesconfig clang-23
arm allyesconfig gcc-16.1.0
arm defconfig gcc-16.1.0
arm randconfig-001-20260616 gcc-9.5.0
arm randconfig-002-20260616 gcc-9.5.0
arm randconfig-003-20260616 gcc-9.5.0
arm randconfig-004-20260616 gcc-9.5.0
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-16.1.0
arm64 defconfig gcc-16.1.0
arm64 randconfig-001-20260616 gcc-13.4.0
arm64 randconfig-001-20260616 gcc-8.5.0
arm64 randconfig-002-20260616 gcc-13.4.0
arm64 randconfig-002-20260616 gcc-15.2.0
arm64 randconfig-003-20260616 gcc-13.4.0
arm64 randconfig-004-20260616 gcc-11.5.0
arm64 randconfig-004-20260616 gcc-13.4.0
csky allmodconfig gcc-16.1.0
csky allnoconfig gcc-16.1.0
csky defconfig gcc-16.1.0
csky randconfig-001-20260616 gcc-13.4.0
csky randconfig-001-20260616 gcc-15.2.0
csky randconfig-002-20260616 gcc-13.4.0
hexagon allmodconfig gcc-16.1.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-16.1.0
hexagon defconfig gcc-16.1.0
hexagon randconfig-001 gcc-11.5.0
hexagon randconfig-001-20260616 clang-23
hexagon randconfig-001-20260616 gcc-11.5.0
hexagon randconfig-002 gcc-11.5.0
hexagon randconfig-002-20260616 clang-23
hexagon randconfig-002-20260616 gcc-11.5.0
i386 allmodconfig clang-22
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allnoconfig gcc-16.1.0
i386 allyesconfig clang-22
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001-20260616 clang-22
i386 buildonly-randconfig-002-20260616 clang-22
i386 buildonly-randconfig-003-20260616 clang-22
i386 buildonly-randconfig-004-20260616 clang-22
i386 buildonly-randconfig-005-20260616 clang-22
i386 buildonly-randconfig-006-20260616 clang-22
i386 defconfig gcc-16.1.0
i386 randconfig-001-20260616 gcc-14
i386 randconfig-002-20260616 gcc-14
i386 randconfig-003-20260616 gcc-14
i386 randconfig-004-20260616 gcc-14
i386 randconfig-005-20260616 gcc-14
i386 randconfig-006-20260616 gcc-14
i386 randconfig-007-20260616 gcc-14
i386 randconfig-011 clang-22
i386 randconfig-011-20260616 clang-22
i386 randconfig-011-20260616 gcc-14
i386 randconfig-012 clang-22
i386 randconfig-012-20260616 clang-22
i386 randconfig-012-20260616 gcc-14
i386 randconfig-013 gcc-14
i386 randconfig-013-20260616 clang-22
i386 randconfig-013-20260616 gcc-14
i386 randconfig-014 clang-22
i386 randconfig-014-20260616 clang-22
i386 randconfig-014-20260616 gcc-14
i386 randconfig-015 gcc-14
i386 randconfig-015-20260616 clang-22
i386 randconfig-015-20260616 gcc-14
i386 randconfig-016 gcc-14
i386 randconfig-016-20260616 clang-22
i386 randconfig-017 gcc-14
i386 randconfig-017-20260616 clang-22
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-20
loongarch allnoconfig gcc-16.1.0
loongarch defconfig clang-23
loongarch loongson64_defconfig clang-23
loongarch randconfig-001 gcc-11.5.0
loongarch randconfig-001-20260616 clang-23
loongarch randconfig-001-20260616 gcc-11.5.0
loongarch randconfig-002 gcc-11.5.0
loongarch randconfig-002-20260616 clang-23
loongarch randconfig-002-20260616 gcc-11.5.0
m68k allmodconfig gcc-16.1.0
m68k allnoconfig gcc-16.1.0
m68k allyesconfig clang-23
m68k allyesconfig gcc-16.1.0
m68k defconfig clang-23
microblaze allnoconfig gcc-16.1.0
microblaze allyesconfig gcc-16.1.0
microblaze defconfig clang-23
mips allmodconfig gcc-16.1.0
mips allnoconfig gcc-16.1.0
mips allyesconfig gcc-16.1.0
nios2 allmodconfig clang-20
nios2 allmodconfig gcc-11.5.0
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-23
nios2 randconfig-001 gcc-11.5.0
nios2 randconfig-001-20260616 clang-23
nios2 randconfig-001-20260616 gcc-11.5.0
nios2 randconfig-002 gcc-11.5.0
nios2 randconfig-002-20260616 clang-23
nios2 randconfig-002-20260616 gcc-11.5.0
openrisc allmodconfig clang-20
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-16.1.0
openrisc defconfig gcc-16.1.0
parisc allmodconfig gcc-16.1.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-16.1.0
parisc allyesconfig clang-17
parisc allyesconfig gcc-16.1.0
parisc defconfig gcc-16.1.0
parisc randconfig-001 gcc-8.5.0
parisc randconfig-001-20260616 gcc-8.5.0
parisc randconfig-002 gcc-8.5.0
parisc randconfig-002-20260616 gcc-8.5.0
parisc64 defconfig clang-23
powerpc allmodconfig gcc-16.1.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-16.1.0
powerpc ep88xc_defconfig gcc-16.1.0
powerpc pmac32_defconfig clang-23
powerpc randconfig-001 gcc-8.5.0
powerpc randconfig-001-20260616 gcc-8.5.0
powerpc randconfig-002 gcc-8.5.0
powerpc randconfig-002-20260616 gcc-8.5.0
powerpc64 randconfig-001 gcc-8.5.0
powerpc64 randconfig-001-20260616 gcc-8.5.0
powerpc64 randconfig-002 gcc-8.5.0
powerpc64 randconfig-002-20260616 gcc-8.5.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-16.1.0
riscv allyesconfig clang-23
riscv defconfig gcc-16.1.0
riscv randconfig-001 gcc-16.1.0
riscv randconfig-001-20260616 gcc-16.1.0
riscv randconfig-001-20260616 gcc-9.5.0
riscv randconfig-002 gcc-16.1.0
riscv randconfig-002-20260616 clang-23
riscv randconfig-002-20260616 gcc-16.1.0
s390 allmodconfig clang-17
s390 allmodconfig clang-23
s390 allnoconfig clang-23
s390 allyesconfig gcc-16.1.0
s390 defconfig gcc-16.1.0
s390 randconfig-001 gcc-16.1.0
s390 randconfig-001-20260616 clang-23
s390 randconfig-001-20260616 gcc-16.1.0
s390 randconfig-002 gcc-16.1.0
s390 randconfig-002-20260616 clang-18
s390 randconfig-002-20260616 gcc-16.1.0
sh allmodconfig gcc-16.1.0
sh allnoconfig clang-23
sh allnoconfig gcc-16.1.0
sh allyesconfig clang-17
sh allyesconfig gcc-16.1.0
sh defconfig gcc-14
sh randconfig-001 gcc-16.1.0
sh randconfig-001-20260616 gcc-16.1.0
sh randconfig-002 gcc-16.1.0
sh randconfig-002-20260616 gcc-13.4.0
sh randconfig-002-20260616 gcc-16.1.0
sh se7721_defconfig gcc-16.1.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-16.1.0
sparc defconfig gcc-16.1.0
sparc randconfig-001-20260616 gcc-8.5.0
sparc randconfig-002-20260616 gcc-8.5.0
sparc64 allmodconfig clang-20
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260616 gcc-8.5.0
sparc64 randconfig-002-20260616 gcc-8.5.0
um allmodconfig clang-17
um allmodconfig clang-23
um allnoconfig clang-16
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-16.1.0
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260616 gcc-8.5.0
um randconfig-002-20260616 gcc-8.5.0
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-22
x86_64 allnoconfig clang-22
x86_64 allnoconfig clang-23
x86_64 allyesconfig clang-22
x86_64 buildonly-randconfig-001-20260616 gcc-14
x86_64 buildonly-randconfig-002-20260616 gcc-14
x86_64 buildonly-randconfig-003-20260616 gcc-14
x86_64 buildonly-randconfig-004-20260616 gcc-14
x86_64 buildonly-randconfig-005-20260616 gcc-14
x86_64 buildonly-randconfig-006-20260616 gcc-14
x86_64 defconfig gcc-14
x86_64 kexec clang-22
x86_64 randconfig-001 gcc-14
x86_64 randconfig-001-20260616 clang-22
x86_64 randconfig-002 gcc-14
x86_64 randconfig-002-20260616 clang-22
x86_64 randconfig-003 clang-22
x86_64 randconfig-003-20260616 clang-22
x86_64 randconfig-004 clang-22
x86_64 randconfig-004-20260616 clang-22
x86_64 randconfig-004-20260616 gcc-14
x86_64 randconfig-005 gcc-14
x86_64 randconfig-005-20260616 clang-22
x86_64 randconfig-006 clang-22
x86_64 randconfig-006-20260616 clang-22
x86_64 randconfig-011-20260616 clang-22
x86_64 randconfig-012-20260616 clang-22
x86_64 randconfig-013-20260616 clang-22
x86_64 randconfig-014-20260616 clang-22
x86_64 randconfig-015-20260616 clang-22
x86_64 randconfig-016-20260616 clang-22
x86_64 randconfig-071 gcc-13
x86_64 randconfig-071-20260616 gcc-14
x86_64 randconfig-072 gcc-13
x86_64 randconfig-072-20260616 clang-22
x86_64 randconfig-072-20260616 gcc-14
x86_64 randconfig-073 gcc-13
x86_64 randconfig-073-20260616 gcc-14
x86_64 randconfig-074 gcc-13
x86_64 randconfig-074-20260616 gcc-14
x86_64 randconfig-075 gcc-13
x86_64 randconfig-075-20260616 gcc-12
x86_64 randconfig-075-20260616 gcc-14
x86_64 randconfig-076 gcc-13
x86_64 randconfig-076-20260616 gcc-14
x86_64 rhel-9.4 clang-22
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-22
x86_64 rhel-9.4-kselftests clang-22
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-22
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-16.1.0
xtensa allyesconfig clang-20
xtensa randconfig-001-20260616 gcc-8.5.0
xtensa randconfig-002-20260616 gcc-8.5.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH] media: mediatek: vcodec: fix use-after-free in decoder release path
From: Doruk Tan Ozturk @ 2026-06-16 7:56 UTC (permalink / raw)
To: tiffany.lin, andrew-ct.chen, yunfei.dong, mchehab, matthias.bgg,
angelogioacchino.delregno
Cc: hverkuil+cisco, linux-media, linux-mediatek, linux-arm-kernel,
linux-kernel, Doruk Tan Ozturk, stable
fops_vcodec_release() frees the decoder context with kfree(ctx) but
never cancels the per-context decode_work worker first. Although
v4l2_m2m_ctx_release() waits for any in-flight m2m job to finish, the
workqueue handler (mtk_vdec_worker) may still be running and accessing
the context after v4l2_m2m_job_finish() returns. Once kfree(ctx) runs,
that worker dereferences freed memory, resulting in a use-after-free.
Cancel the pending decode work with cancel_work_sync(&ctx->decode_work)
after the controls and m2m context are torn down and before kfree(ctx),
mirroring the fix already applied to the encoder release path in
commit 76e35091ffc7 ("media: mediatek: vcodec: fix use-after-free in
encoder release path").
decode_work is always initialised before release can run:
fops_vcodec_open() calls mtk_vcodec_dec_set_default_params() (its only
caller) unconditionally after a successful v4l2_m2m_ctx_init(), and that
function runs INIT_WORK(&ctx->decode_work, ...). A context can only reach
fops_vcodec_release() via an open() that returned 0, i.e. one that passed
that INIT_WORK. cancel_work_sync() on a properly initialised work_struct
is therefore always safe, even if the work was never queued. This is
unlike the 2023 msg_queue->core_work regression, where the work item
could be uninitialised at cancel time.
Fixes: 590577a4e525 ("[media] vcodec: mediatek: Add Mediatek V4L2 Video Decoder Driver")
Cc: stable@vger.kernel.org
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
v2: reword the commit message to stay within 75 columns (no functional
change; checkpatch).
v1: https://lore.kernel.org/linux-media/20260615140526.52617-1-doruk@0sec.ai/
.../mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
index e936ed8dffbaf..30906b24c608a 100644
--- a/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
+++ b/drivers/media/platform/mediatek/vcodec/decoder/mtk_vcodec_dec_drv.c
@@ -313,6 +313,15 @@ static int fops_vcodec_release(struct file *file)
v4l2_fh_exit(&ctx->fh);
v4l2_ctrl_handler_free(&ctx->ctrl_hdl);
+ /*
+ * Cancel any pending decode work before freeing the context.
+ * Although v4l2_m2m_ctx_release() waits for m2m job completion,
+ * the workqueue handler (mtk_vdec_worker) may still be accessing
+ * the context after v4l2_m2m_job_finish() returns. Without this,
+ * a use-after-free occurs when the worker accesses ctx after kfree.
+ */
+ cancel_work_sync(&ctx->decode_work);
+
mtk_vcodec_dbgfs_remove(dev, ctx->id);
spin_lock_irqsave(&dev->dev_ctx_lock, flags);
list_del_init(&ctx->list);
--
2.43.0
^ permalink raw reply related
* [GIT PULL 4/4] soc: arm code changes for 7.2
From: Arnd Bergmann @ 2026-06-16 7:55 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
linux-kernel
In-Reply-To: <40c8ebc3-d681-4dcf-b3f2-ce0d780c539e@app.fastmail.com>
The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:
Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git tags/soc-arm-7.2
for you to fetch changes up to cb2c3b5e113f26f74ef05926c6ace0f83cc3d0b3:
MAINTAINERS: Add Axiado reviewer and Maintainers (2026-06-11 22:28:47 +0200)
----------------------------------------------------------------
soc: arm code changes for 7.2
The largest addition here is the revived support for the ZTE ZX
SoC platform, though this mostly documentation.
The other changes are code cleanups that deal with continued
conversion of the GPIO library away from GPIO numbers to
descriptors and a few minor bugfixes.
----------------------------------------------------------------
Arnd Bergmann (8):
ARM: s3c: use gpio lookup table for LEDs
ARM: select legacy gpiolib interfaces where used
Merge tag 'soc-pxa-gpio-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into soc/arm
Merge tag 'zx29-plat-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'ep93xx-20260529' of https://git.kernel.org/pub/scm/linux/kernel/git/asv/linux into soc/arm
Merge tag 'imx-soc-updates-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/arm
Merge tag 'omap-for-v7.2/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm
Merge tag 'mvebu-arm-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/arm
Bartosz Golaszewski (5):
ARM: pxa: statify platform device definitions in spitz board file
ARM: pxa: spitz: attach software nodes to their target GPIO controllers
ARM: pxa: pxa25x: attach software node to its target GPIO controller
ARM: pxa: pxa27x: attach software node to its target GPIO controller
arm64: Kconfig: drop unneeded dependency on OF_GPIO for ARCH_MVEBU
Ethan Nelson-Moore (4):
arm: boot: ep93xx: don't rely on machine_is_*() for removed board files
arm: mvebu_v5_defconfig: remove stale MACH_LINKSTATION_LSCHL reference
ARM: orion5x: update board check in mss2_pci_init() to use the DT
ARM: remove the last few uses of do_bad_IRQ()
Krzysztof Kozlowski (1):
firmware: imx: sm-misc: Make scmi_imx_misc_ctrl_nb variable static
Linus Walleij (2):
Merge tag 'zx29-docfix-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'samsung-soc-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm
Martin Kaiser (2):
ARM: mvebu: drop unnecessary NULL check
ARM: mvebu: simplify of_node_put calls
Prasad Bolisetty (1):
MAINTAINERS: Add Axiado reviewer and Maintainers
Randy Dunlap (1):
ARM: zte: clean up zx297520v3 doc. warnings
Rosen Penev (1):
ARM: omap2: simplify allocation for omap_device
Stefan Dösinger (1):
ARM: zte: Add zx297520v3 platform support
Yuho Choi (2):
ARM: imx3: Fix CCM node reference leak
ARM: imx31: Fix IIM mapping leak in revision check
Documentation/arch/arm/index.rst | 2 +
Documentation/arch/arm/zte/index.rst | 10 ++
Documentation/arch/arm/zte/zx297520v3.rst | 166 ++++++++++++++++++++++++++++++
MAINTAINERS | 13 ++-
arch/arm/Kconfig | 2 +
arch/arm/Makefile | 1 +
arch/arm/boot/compressed/misc-ep93xx.h | 20 +++-
arch/arm/common/sa1111.c | 2 +-
arch/arm/configs/mvebu_v5_defconfig | 1 -
arch/arm/include/asm/mach/irq.h | 10 --
arch/arm/mach-footbridge/isa-irq.c | 2 +-
arch/arm/mach-imx/cpu-imx31.c | 9 +-
arch/arm/mach-imx/mm-imx3.c | 2 +
arch/arm/mach-mv78xx0/Kconfig | 1 +
arch/arm/mach-mvebu/coherency.c | 9 +-
arch/arm/mach-omap2/omap_device.c | 29 ++----
arch/arm/mach-omap2/omap_device.h | 4 +-
arch/arm/mach-orion5x/Kconfig | 1 +
arch/arm/mach-orion5x/board-mss2.c | 4 +-
arch/arm/mach-pxa/Kconfig | 1 +
arch/arm/mach-pxa/pxa25x.c | 3 +
arch/arm/mach-pxa/pxa27x.c | 3 +
arch/arm/mach-pxa/spitz.c | 11 +-
arch/arm/mach-s3c/Kconfig.s3c64xx | 1 +
arch/arm/mach-s3c/mach-crag6410.c | 24 +++--
arch/arm/mach-sa1100/Kconfig | 1 +
arch/arm/mach-zte/Kconfig | 29 ++++++
arch/arm/mach-zte/Makefile | 2 +
arch/arm/mach-zte/zx297520v3.c | 16 +++
arch/arm64/Kconfig.platforms | 1 -
drivers/firmware/imx/sm-misc.c | 2 +-
drivers/irqchip/irq-versatile-fpga.c | 2 +-
32 files changed, 320 insertions(+), 64 deletions(-)
create mode 100644 Documentation/arch/arm/zte/index.rst
create mode 100644 Documentation/arch/arm/zte/zx297520v3.rst
create mode 100644 arch/arm/mach-zte/Kconfig
create mode 100644 arch/arm/mach-zte/Makefile
create mode 100644 arch/arm/mach-zte/zx297520v3.c
^ permalink raw reply
* [GIT PULL 0/4] soc: defconfig updates for 7.2
From: Arnd Bergmann @ 2026-06-16 7:53 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
linux-kernel
In-Reply-To: <40c8ebc3-d681-4dcf-b3f2-ce0d780c539e@app.fastmail.com>
The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:
Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git tags/soc-defconfig-7.2
for you to fetch changes up to cccde8de2c72068051ff8351ae6f1e2a12718aa0:
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig (2026-06-12 09:03:41 +0200)
----------------------------------------------------------------
soc: defconfig updates for 7.2
The main change this time is a cleanup series from Krzysztof Kozlowski
that updates the defconfig files to be more in sync with changes to
the Kconfig files that moved options around or removed the completely.
In addition, a number of drivers get enabled, in order to support
more hardware out of the box, as usual.
----------------------------------------------------------------
Albert Yang (1):
arm64: defconfig: enable BST SDHCI controller
Arnd Bergmann (5):
Merge tag 'v7.2-qcom-pinctrl-defconfigs' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into soc/defconfig
Merge tag 'cix-defconfig-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/defconfig
Merge tag 'at91-defconfig-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig
Merge tag 'imx-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/defconfig
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig
Krzysztof Kozlowski (12):
pinctrl: qcom: Make important drivers default (2)
arm64: defconfig: Move entries to match savedefconfig
arm64: defconfig: Drop unused legacy netfilter options
arm64: defconfig: Drop default or selected drivers
arm64: defconfig: Drop unused Ethernet vendors
arm64: defconfig: Switch Ethernet drivers to modules
ARM: multi_v7_defconfig: Move entries to match savedefconfig
ARM: configs: Drop redundant I2C_DESIGNWARE_PLATFORM
ARM: configs: Drop redundant SND_ATMEL_SOC
ARM: multi_v7_defconfig: Cleanup redundant options
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
ARM: configs: Drop duplicated CONFIG_EXT4_FS
Manikandan Muralidharan (1):
ARM: configs: at91: sama7: add sama7d65 i3c-hci
Manivannan Sadhasivam (1):
arm64: defconfig: Enable PCI M.2 power sequencing driver
Maxime Ripard (1):
ARM: multi_v7_defconfig: Enable dma-buf heaps
Peter Chen (1):
arm64: defconfig: Enable CIX Sky1 pinctrl, PCIe host, and Cadence GPIO
Ryan Chen (1):
arm64: configs: Update defconfig for AST2700 platform support
Stefan Wahren (1):
arm64: defconfig: Enable DP83822 PHY driver
arch/arm/configs/at91_dt_defconfig | 1 -
arch/arm/configs/axm55xx_defconfig | 1 -
arch/arm/configs/dove_defconfig | 1 -
arch/arm/configs/ep93xx_defconfig | 1 -
arch/arm/configs/hisi_defconfig | 1 -
arch/arm/configs/mmp2_defconfig | 1 -
arch/arm/configs/multi_v5_defconfig | 1 -
arch/arm/configs/multi_v7_defconfig | 106 ++++-----
arch/arm/configs/mv78xx0_defconfig | 1 -
arch/arm/configs/pxa_defconfig | 2 -
arch/arm/configs/qcom_defconfig | 15 --
arch/arm/configs/sama5_defconfig | 1 -
arch/arm/configs/sama7_defconfig | 3 +-
arch/arm/configs/socfpga_defconfig | 1 -
arch/arm/configs/spear13xx_defconfig | 1 -
arch/arm/configs/spear3xx_defconfig | 1 -
arch/arm/configs/spear6xx_defconfig | 1 -
arch/arm64/configs/defconfig | 423 +++++++++++++++++------------------
18 files changed, 250 insertions(+), 312 deletions(-)
^ permalink raw reply
* [GIT PULL 2/4] soc: drivers for 7.2
From: Arnd Bergmann @ 2026-06-16 7:53 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
Marek Vasut, linux-kernel
In-Reply-To: <40c8ebc3-d681-4dcf-b3f2-ce0d780c539e@app.fastmail.com>
The following changes since commit 7fd2df204f342fc17d1a0bfcd474b24232fb0f32:
Linux 7.1-rc2 (2026-05-03 14:21:25 -0700)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git tags/soc-drivers-7.2
for you to fetch changes up to c7437fab2f2249c1f12d805770c5ba15cbd0e46a:
Merge tag 'memory-controller-drv-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers (2026-06-15 13:46:03 +0200)
----------------------------------------------------------------
soc: drivers for 7.2
There are a few added drivers, but mostly the normal maintenance to drivers
for firmware, memory controller and other soc specific hadware:
- The NXP QuickEngine gets modern MSI support, which allows some cleanups to
the GICv3 irqchip chip driver
- A new SoC specific driver for the Renesas R-Car MFIS unit is added,
encapsulating support for the on-chip mailbox and hwspinlock
implementations that are not easily separated into individual
drivers
- The Qualcomm SoC drivers add support for additional SoC implementations,
and flexiblity around power managedment for the serial-engine driver
as well as probing the LLCC driver using custom hardware descriptions
inside of the device itself.
- Added support for the Samsung thermal management unit
- A cleanup to the Tegra 'PMC' driver interfaces to remove legacy
APIs and allow multiple PMC instances everywhere.
- Updates to the TI SCI and KNAS drivers to improve suspend/resume
support.
- Minor driver changes for mediatek, xilinx, allwinner, aspeed, tegra,
broadcom, amd, microchip and starfive specific drivers
- Memory controller updates for Tegra and Renesas for additional SoC
types and other improvements.
- Firmware driver updates for Arm FF-A, SMCCC and SCMI interfaces,
to update driver probing, object lifetimes and address minor bugs.
----------------------------------------------------------------
Abel Vesa (4):
dt-bindings: soc: qcom: qcom,pmic-glink: Document Eliza compatible
dt-bindings: soc: qcom,aoss-qmp: Document the Eliza Always-On Subsystem side channel
dt-bindings: cache: qcom,llcc: Document Eliza LLCC block
soc: qcom: llcc-qcom: Add support for Eliza
Alexander Dahl (1):
memory: atmel-ebi: Allow deferred probing
Alexander Koskovich (3):
soc: qcom: socinfo: Add PMIV0102 & PMIV0104 PMICs
dt-bindings: arm: qcom,ids: Add SoC ID for SM7750
soc: qcom: socinfo: Add SoC ID for SM7750
Andre Przywara (1):
firmware: smccc: Fix Arm SMCCC SOC_ID name call
Arnd Bergmann (20):
Merge tag 'soc_fsl-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
firmware: samsung: acpm: remove compile-testing stubs
Merge tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Merge tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'optee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'tegra-for-7.2-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-pmc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Merge tag 'memory-controller-drv-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Merge tag 'arm-soc/for-7.2/drivers' of https://github.com/Broadcom/stblinux into soc/drivers
Merge tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers
Merge tag 'cache-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Merge tag 'riscv-soc-drivers-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
Merge tag 'memory-controller-drv-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Ashish Mhetre (5):
memory: tegra: Make ->resume() callback return void
memory: tegra: Wire up system sleep PM ops
memory: tegra: Restore MC interrupt masks on resume
dt-bindings: memory: tegra: Add nvidia,tegra238-mc compatible
memory: tegra: Add Tegra238 MC support
Bjorn Andersson (2):
Merge branch '20260507-ubwc-rework-v4-4-c19593d20c1d@oss.qualcomm.com' into drivers-for-7.2
Merge branch '20260227061544.1785978-1-praveen.talari@oss.qualcomm.com' into drivers-for-7.2
Chen-Yu Tsai (7):
dt-bindings: sram: Document Allwinner H616 VE SRAM
dt-bindings: sram: sunxi-sram: Add H616 SRAM regions
soc: sunxi: sram: Const-ify sunxi_sram_func data and references
soc: sunxi: sram: Allow SRAM to be claimed multiple times
soc: sunxi: sram: Support claiming multiple regions per device
soc: sunxi: sram: Add H616 SRAM regions
firmware: raspberrypi: Change dependency to ARCH_BCM2835 and COMPILE_TEST
Christophe Leroy (CS GROUP) (1):
soc: fsl: qe_ports_ic: switch to irq_domain_create_linear()
Claudiu Beznea (5):
soc: renesas: r9a08g045-sysc: Move common code to a helper
soc: renesas: r9a08g046-sysc: Move common code to a helper
soc: renesas: r9a09g047-sys: Move common code to a helper
soc: renesas: r9a09g056-sys: Move common code to a helper
soc: renesas: r9a09g057-sys: Move common code to a helper
Conor Dooley (1):
dt-bindings: soc: microchip: document irqmux on pic64gx
Cristian Marussi (16):
clk: scmi: Fix clock rate rounding
firmware: arm_scmi: Add clock determine_rate operation
clk: scmi: Use new determine_rate clock operation
firmware: arm_scmi: Simplify clock rates exposed interface
clk: scmi: Use new simplified per-clock rate properties
firmware: arm_scmi: Drop unused clock rate interfaces
firmware: arm_scmi: Make clock rates allocation dynamic
firmware: arm_scmi: Harden clock parents discovery
firmware: arm_scmi: Refactor iterators internal allocation
firmware: arm_scmi: Add bound iterators support
firmware: arm_scmi: Use bound iterators to minimize discovered rates
firmware: arm_scmi: Introduce all_rates_get clock operation
firmware: arm_scmi: Add transport instance handles
firmware: arm_scmi: Add a generic transport supplier
firmware: arm_scmi: virtio: Rework transport probe sequence
firmware: arm_scmi: optee: Rework transport probe sequence
Dan Carpenter (1):
soc: qcom: llcc-qcom: Fix NULL vs IS_ERR() bug in qcom_llcc_get_fw_config()
Deepti Jaggi (3):
dt-bindings: qcom: geni-se-qup: Add compatible for SA8797P SoC
dt-bindings: arm: qcom,ids: Add SoC ID for Nord SA8797P
soc: qcom: socinfo: Add SoC ID for Nord SA8797P
Diogo Ivo (1):
soc/tegra: pmc: Restrict power-off handler to Nexus 7
Dmitry Baryshkov (3):
soc: qcom: ubwc: define UBWC 3.1
soc: qcom: ubwc: define helper for MDSS and Adreno drivers
soc: qcom: ubwc: add helper controlling AMSBC enablement
Dominique Belhachemi (1):
cache: sifive_ccache: Add StarFive JH7110 SoC support
Ethan Tidmore (1):
memory: tegra: Fix possible null pointer dereference
Felix Gu (1):
soc: fsl: qe_ports_ic: Add missing cleanup on device removal
Fenglin Wu (1):
dt-bindings: soc: qcom: qcom,pmic-glink: Add Hawi compatible string
Francisco Munoz Ruiz (3):
dt-bindings: cache: qcom,llcc: Document Hawi SoC
soc: qcom: llcc-qcom: get SCT descriptors from fw-populated memory
soc: qcom: llcc-qcom: Capitalize LLCC/EDAC in comments and diagnostics
Geert Uytterhoeven (9):
Merge tag 'renesas-r8a78000-dt-binding-defs-tag1' into renesas-drivers-for-v7.2
firmware: arm_scmi: quirk: Improve quirk range parsing
firmware: arm_scmi: quirk: Simplify quirk table iteration
firmware: arm_scmi: Convert to list_for_each_entry()
soc: renesas: Convert to of_machine_get_match()
firmware: arm_scmi: Fix bound iterators returning too many items
firmware: arm_scmi: Use proper iter_response_bound_cleanup() name
firmware: arm_scmi: Fix OOB in scmi_clock_describe_rates_get_lazy()
firmware: arm_scmi: Fix OOB in scmi_power_name_get()
Harrison Vanderbyl (1):
firmware: qcom: scm: Allow QSEECOM on Surface Pro 12in
Hirokazu Honda (1):
tee: optee: Allow MT_NORMAL_TAGGED shared memory
Ioana Ciornei (1):
bus: fsl-mc: wait for the MC firmware to complete its boot
Jamie Nguyen (1):
firmware: arm_ffa: Honor partition info descriptor size
Jason-JH Lin (2):
soc: mediatek: Use pkt_write function pointer for subsys ID compatibility
soc: mediatek: mtk-cmdq: Add cmdq_pkt_jump_rel_temp() for removing shift_pa
Jon Hunter (3):
soc/tegra: pmc: Populate powergate debugfs only when needed
firmware: tegra: bpmp: Propagate debugfs errors
firmware: tegra: bpmp: Add support for multi-socket platforms
Judith Mendez (2):
dt-bindings: hwinfo: ti,k3-socinfo: Add nvmem-cells support
soc: ti: k3-socinfo: Add support for AM62P variants via NVMEM
Julian Braha (1):
soc: aspeed: cleanup dead default for ASPEED_SOCINFO
Justin Chen (1):
soc: brcmstb: consolidate initcall functions
Kartik Rajput (2):
soc/tegra: fuse: Register nvmem lookups at probe
soc/tegra: Use ARM SMCCC to get chip ID, revision, and platform info
Kathiravan Thirumoorthy (2):
dt-bindings: arm: qcom,ids: add SOC IDs for IPQ9650 family
soc: qcom: socinfo: add SoC ID for IPQ9650 family
Komal Bajaj (3):
dt-bindings: cache: qcom,llcc: Document Shikra LLCC
dt-bindings: arm: qcom,ids: Add SoC ID for Shikra IoT variants
soc: qcom: socinfo: Add SoC ID for Shikra IoT variants
Konrad Dybcio (1):
soc: qcom: socinfo: Add PMICs that ship with Glymur
Krzysztof Kozlowski (9):
Merge branch 'for-v7.2/tegra114-mc-bindings' into mem-ctrl-next
memory: tegra114-emc: Do not print error on icc_node_create() failure
memory: tegra114-emc: Simplify tegra114_emc_interconnect_init() error message
soc: aspeed: Move MODULE_DEVICE_TABLE next to the table itself
memory: omap-gpmc: Silence W=1 kerneldoc warnings
Merge tag 'mtk-soc-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Merge tag 'sunxi-drivers-for-7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers
Merge tag 'aspeed-7.2-drivers-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers
Lad Prabhakar (2):
dt-bindings: memory: renesas,rzg3e-xspi: Add RZ/T2H and RZ/N2H support
memory: renesas-rpc-if: Fix duplicate device name on multi-instance platforms
Linus Walleij (1):
Merge tag 'zynqmp-soc-for-7.2' of https://github.com/Xilinx/linux-xlnx into soc/drivers
Luca Leonardo Scorcia (1):
soc: mediatek: mtk-mmsys: Restore MT8167 routing masks lost during merge
Marc Zyngier (6):
fsl-mc: Remove MSI domain propagation to sub-devices
fsl-mc: Add minimal infrastructure to use platform MSI
irqchip/gic-v3-its: Add fsl_mc device plumbing to the msi-parent handling
fsl-mc: Switch over to per-device platform MSI
fsl-mc: Remove legacy MSI implementation
platform-msi: Remove stale comment
Marek Vasut (2):
firmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_info
soc: renesas: Identify R-Car R8A779MD M3Le SoC
Md Shofiqul Islam (1):
soc: ti: knav_qmss_queue: Implement resource cleanup in remove()
Mikko Perttunen (1):
memory: tegra: Deduplicate rate request management code
Mukesh Ojha (3):
dt-bindings: firmware: qcom,scm: Document SCM on Hawi SoC
dt-bindings: soc: qcom,aoss-qmp: Document the Hawi AOSS side channel
soc: qcom: pd-mapper: Add support for Hawi SoC
Nishanth Menon (11):
soc: ti: knav_qmss: Remove remaining redundant ENOMEM printks
soc: ti: knav_qmss: Rename global kdev to knav_qdev to fix -Wshadow
soc: ti: knav_qmss: Inline lockdep condition in for_each_handle_rcu
soc: ti: knav_qmss: Fix kernel-doc Return: tags
soc: ti: knav_qmss: Use %pe to print PTR_ERR()
soc: ti: knav_qmss: Fix __iomem annotations and __be32 type
soc: ti: knav_qmss_acc: Fix kernel-doc Return: tag
soc: ti: knav_dma: Remove unused DMA_PRIO_MASK macro
soc: ti: knav_dma: Remove dead check on unsigned args.args[0]
soc: ti: knav_dma: Use IOMEM_ERR_PTR() in pktdma_get_regs()
soc: ti: k3-ringacc: Use str_enabled_disabled() helper
Peng Fan (2):
firmware: arm_scmi: imx: Support getting reset reason of MISC protocol
firmware: imx: sm-misc: Print boot/shutdown reasons
Prasanna Kumar T S M (2):
soc: xilinx: Fix race condition in event registration
soc: xilinx: Shutdown and free rx mailbox channel
Prathamesh Shete (1):
soc/tegra: pmc: Add Tegra238 support
Praveen Talari (7):
soc: qcom: geni-se: Refactor geni_icc_get() and make qup-memory ICC path optional
soc: qcom: geni-se: Add geni_icc_set_bw_ab() function
soc: qcom: geni-se: Introduce helper API for resource initialization
soc: qcom: geni-se: Handle core clk in geni_se_clks_off() and geni_se_clks_on()
soc: qcom: geni-se: Add resources activation/deactivation helpers
soc: qcom: geni-se: Introduce helper API for attaching power domains
soc: qcom: geni-se: Introduce helper APIs for performance control
Raj Aryan (1):
soc: qcom: spmi-pmic: add SUBTYPEs for Glymur/Kaanapali/SM8750 PMICs
Randy Dunlap (2):
virt: fsl_hypervisor: fix header kernel-doc warnings
soc: ti: knav_dma: fix all kernel-doc warnings in knav_dma.h
Rijo Thomas (1):
tee: amdtee: store buffer ID in tee_shm->sec_world_id
Rodrigo Zaiden (1):
tee: optee: fix kernel-doc warnings
Ronak Jain (2):
Documentation: ABI: add sysfs interface for ZynqMP CSU registers
firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface
Rosen Penev (1):
soc: qcom: wcnss: fix leak of fw
Samuel Holland (1):
bus: sunxi-rsb: Always check register address validity
Sasha Levin (1):
firmware: tegra: Make TEGRA_IVC a hidden Kconfig symbol
Shawn Guo (2):
dt-bindings: firmware: qcom,scm: Document SCM for Nord SoC
soc: qcom: socinfo: Add PMIC PMAU0102
Sheetal (1):
bus: tegra-aconnect: Use dev_err_probe for probe error paths
Siddharth Vadapalli (1):
soc: ti: k3-ringacc: Fix access mode for k3_ringacc_ring_pop_tail_io/proxy
Stepan Ionichev (1):
clk: scpi: Unregister child clock providers on remove
Sudeep Holla (19):
firmware: arm_ffa: Check for NULL FF-A ID table while driver registration
firmware: arm_ffa: Skip free_pages on RX buffer alloc failure
firmware: arm_ffa: Avoid collapsing NPI work from different CPUs
firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueue
firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0
firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copies
firmware: arm_ffa: Keep framework RX release under lock
firmware: arm_ffa: Validate framework notification message layout
firmware: arm_ffa: Align RxTx buffer size before mapping
firmware: arm_ffa: Snapshot notifier callbacks under lock
firmware: arm_ffa: Fix sched-recv callback partition lookup
firmware: arm_ffa: Register core as a platform driver
firmware: arm_ffa: Set the core device as FF-A device parent
firmware: arm_ffa: Defer probe until pKVM is initialized
firmware: arm_scmi: Read sensor config as 32-bit value
firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size
firmware: arm_scmi: Validate SENSOR_UPDATE payload size
firmware: arm_scmi: Validate Powercap domains before state access
firmware: arm_ffa: Treat missing FF-A feature on a platform as a probe miss
Sumit Gupta (6):
memory: tegra264: Skip clients without bpmp_id or type
dt-bindings: memory: tegra264: Add full set of MC client IDs
memory: tegra264: Add full set of MC clients
memory: tegra186-emc: stop borrowing MC aggregate hook for EMC
memory: tegra264: drop redundant tegra264_mc_icc_aggregate()
memory: tegra234: drop dead NULL check in tegra234_mc_icc_aggregate()
Svyatoslav Ryhel (4):
dt-bindings: memory: Document Tegra114 Memory Controller
dt-bindings: memory: Document Tegra114 External Memory Controller
memory: tegra: Implement EMEM regs and ICC ops for Tegra114
memory: tegra: Add Tegra114 EMC driver
Thierry Reding (11):
MAINTAINERS: Move Peter De Schrijver to CREDITS
Documentation: ABI: Take over as contact for sysfs-driver-tegra-fuse
ata: ahci_tegra: Explicitly specify PMC instance to use
drm/nouveau: tegra: Explicitly specify PMC instance to use
drm/tegra: Explicitly specify PMC instance to use
media: vde: Explicitly specify PMC instance to use
PCI: tegra: Explicitly specify PMC instance to use
usb: xhci: tegra: Explicitly specify PMC instance to use
soc/tegra: pmc: Create PMC context dynamically
soc/tegra: pmc: Remove unused legacy functions
soc/tegra: pmc: Move legacy code behind CONFIG_ARM guard
Thomas Richard (TI) (4):
firmware: ti_sci: Add BOARDCFG_MANAGED mode support
firmware: ti_sci: Add support for restoring IRQs during resume
clk: keystone: sci-clk: Add restore_context() operation
firmware: ti_sci: Add support for restoring clock context during resume
Tony Truong (1):
soc: qcom: smem: Switch partitions to xarray
Tudor Ambarus (11):
firmware: samsung: acpm: Fix cross-thread RX length corruption
firmware: samsung: acpm: Fix mailbox channel leak on probe error
firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling
firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator
firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion
firmware: samsung: acpm: Consolidate transfer initialization helper
firmware: samsung: acpm: Annotate rx_data->cmd with __counted_by_ptr
firmware: samsung: acpm: Drop redundant _ops suffix in acpm_ops members
firmware: samsung: acpm: Make acpm_ops const and access via pointer
firmware: samsung: acpm: Add TMU protocol support
firmware: samsung: acpm: Add devm_acpm_get_by_phandle helper
Wang Jun (1):
soc: fsl: qe: panic on ioremap() failure in qe_reset()
Wolfram Sang (5):
dt-bindings: soc: renesas: Document MFIS IP core
soc: renesas: Add Renesas R-Car MFIS driver
soc: renesas: Add R-Car X5H PRR support
dt-bindings: soc: renesas: mfis: Add R-Car V4H/V4M support
soc: renesas: rcar-mfis: Add R-Car V4H/V4M support
Yeoreum Yun (1):
Revert "firmware: arm_ffa: Change initcall level of ffa_init() to rootfs_initcall"
CREDITS | 10 +
Documentation/ABI/testing/sysfs-driver-tegra-fuse | 2 +-
.../devicetree/bindings/cache/qcom,llcc.yaml | 43 +
.../devicetree/bindings/firmware/qcom,scm.yaml | 3 +
.../devicetree/bindings/hwinfo/ti,k3-socinfo.yaml | 11 +
.../memory-controllers/nvidia,tegra124-emc.yaml | 174 +--
.../memory-controllers/nvidia,tegra124-mc.yaml | 31 +-
.../memory-controllers/nvidia,tegra186-mc.yaml | 31 +
.../memory-controllers/renesas,rzg3e-xspi.yaml | 60 +-
.../soc/microchip/microchip,mpfs-irqmux.yaml | 6 +-
.../bindings/soc/qcom/qcom,aoss-qmp.yaml | 2 +
.../bindings/soc/qcom/qcom,pmic-glink.yaml | 6 +
.../soc/qcom/qcom,sa8255p-geni-se-qup.yaml | 31 +-
.../soc/renesas/renesas,r8a78000-mfis.yaml | 221 ++++
.../sram/allwinner,sun4i-a10-system-control.yaml | 5 +-
Documentation/devicetree/bindings/sram/sram.yaml | 1 +
MAINTAINERS | 1 -
drivers/ata/ahci_tegra.c | 17 +-
drivers/base/platform-msi.c | 4 -
drivers/bus/fsl-mc/dprc-driver.c | 14 +-
drivers/bus/fsl-mc/fsl-mc-bus.c | 50 +-
drivers/bus/fsl-mc/fsl-mc-msi.c | 166 +--
drivers/bus/fsl-mc/fsl-mc-private.h | 2 +-
drivers/bus/sunxi-rsb.c | 3 +
drivers/bus/tegra-aconnect.c | 14 +-
drivers/cache/sifive_ccache.c | 2 +
drivers/clk/clk-scmi.c | 48 +-
drivers/clk/clk-scpi.c | 2 +-
drivers/clk/keystone/sci-clk.c | 45 +-
drivers/clk/samsung/Kconfig | 2 +-
drivers/clk/samsung/clk-acpm.c | 8 +-
drivers/firmware/Kconfig | 5 +-
drivers/firmware/arm_ffa/bus.c | 7 +-
drivers/firmware/arm_ffa/common.h | 4 +-
drivers/firmware/arm_ffa/driver.c | 228 +++-
drivers/firmware/arm_ffa/smccc.c | 2 +-
drivers/firmware/arm_scmi/base.c | 25 +-
drivers/firmware/arm_scmi/clock.c | 301 ++++-
drivers/firmware/arm_scmi/common.h | 165 ++-
drivers/firmware/arm_scmi/driver.c | 98 +-
drivers/firmware/arm_scmi/power.c | 6 +-
drivers/firmware/arm_scmi/powercap.c | 18 +-
drivers/firmware/arm_scmi/protocols.h | 13 +-
drivers/firmware/arm_scmi/quirks.c | 17 +-
drivers/firmware/arm_scmi/sensors.c | 12 +-
drivers/firmware/arm_scmi/transports/optee.c | 46 +-
drivers/firmware/arm_scmi/transports/virtio.c | 52 +-
.../firmware/arm_scmi/vendors/imx/imx-sm-misc.c | 86 ++
drivers/firmware/imx/sm-misc.c | 73 ++
drivers/firmware/qcom/qcom_scm.c | 1 +
drivers/firmware/samsung/Makefile | 1 +
drivers/firmware/samsung/exynos-acpm-dvfs.c | 17 +-
drivers/firmware/samsung/exynos-acpm-pmic.c | 20 +-
drivers/firmware/samsung/exynos-acpm-tmu.c | 239 ++++
drivers/firmware/samsung/exynos-acpm-tmu.h | 28 +
drivers/firmware/samsung/exynos-acpm.c | 254 ++--
drivers/firmware/samsung/exynos-acpm.h | 2 +
drivers/firmware/smccc/soc_id.c | 2 +-
drivers/firmware/tegra/Kconfig | 2 +-
drivers/firmware/tegra/bpmp-debugfs.c | 55 +-
drivers/firmware/ti_sci.c | 201 ++-
drivers/firmware/ti_sci.h | 9 +
drivers/gpu/drm/nouveau/include/nvkm/core/tegra.h | 2 +
drivers/gpu/drm/nouveau/nvkm/engine/device/tegra.c | 9 +-
drivers/gpu/drm/tegra/dc.c | 14 +-
drivers/gpu/drm/tegra/dc.h | 1 +
drivers/gpu/drm/tegra/gr3d.c | 9 +-
drivers/gpu/drm/tegra/sor.c | 16 +-
drivers/irqchip/Kconfig | 6 -
drivers/irqchip/Makefile | 1 -
drivers/irqchip/irq-gic-its-msi-parent.c | 7 +-
drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c | 168 ---
drivers/media/platform/nvidia/tegra-vde/vde.c | 15 +-
drivers/media/platform/nvidia/tegra-vde/vde.h | 1 +
drivers/memory/atmel-ebi.c | 3 +-
drivers/memory/omap-gpmc.c | 6 +-
drivers/memory/renesas-rpc-if.c | 2 +-
drivers/memory/tegra/Kconfig | 19 +
drivers/memory/tegra/Makefile | 3 +
drivers/memory/tegra/mc.c | 40 +-
drivers/memory/tegra/mc.h | 9 +
drivers/memory/tegra/tegra-emc-common.c | 143 +++
drivers/memory/tegra/tegra-emc-common.h | 46 +
drivers/memory/tegra/tegra114-emc.c | 1351 ++++++++++++++++++++
drivers/memory/tegra/tegra114.c | 193 +++
drivers/memory/tegra/tegra124-emc.c | 107 +-
drivers/memory/tegra/tegra186-emc.c | 4 +-
drivers/memory/tegra/tegra186.c | 4 +-
drivers/memory/tegra/tegra20-emc.c | 110 +-
drivers/memory/tegra/tegra234.c | 8 +-
drivers/memory/tegra/tegra238.c | 391 ++++++
drivers/memory/tegra/tegra264.c | 585 ++++++++-
drivers/memory/tegra/tegra30-emc.c | 107 +-
drivers/mfd/sec-acpm.c | 6 +-
drivers/pci/controller/pci-tegra.c | 19 +-
drivers/soc/aspeed/Kconfig | 1 -
drivers/soc/aspeed/aspeed-lpc-ctrl.c | 2 +-
drivers/soc/aspeed/aspeed-lpc-snoop.c | 2 +-
drivers/soc/aspeed/aspeed-p2a-ctrl.c | 2 +-
drivers/soc/bcm/brcmstb/common.c | 88 +-
drivers/soc/fsl/qe/qe.c | 3 +
drivers/soc/fsl/qe/qe_ports_ic.c | 23 +-
drivers/soc/mediatek/mt8167-mmsys.h | 11 +-
drivers/soc/mediatek/mtk-mmsys.c | 8 +-
drivers/soc/mediatek/mtk-mutex.c | 5 +-
drivers/soc/qcom/llcc-qcom.c | 481 ++++++-
drivers/soc/qcom/qcom-geni-se.c | 270 +++-
drivers/soc/qcom/qcom_pd_mapper.c | 8 +
drivers/soc/qcom/smem.c | 56 +-
drivers/soc/qcom/socinfo.c | 23 +
drivers/soc/qcom/wcnss_ctrl.c | 11 +-
drivers/soc/renesas/Kconfig | 9 +
drivers/soc/renesas/Makefile | 1 +
drivers/soc/renesas/r9a08g045-sysc.c | 33 +-
drivers/soc/renesas/r9a08g046-sysc.c | 31 +-
drivers/soc/renesas/r9a09g047-sys.c | 34 +-
drivers/soc/renesas/r9a09g056-sys.c | 33 +-
drivers/soc/renesas/r9a09g057-sys.c | 44 +-
drivers/soc/renesas/rcar-mfis.c | 384 ++++++
drivers/soc/renesas/renesas-soc.c | 11 +-
drivers/soc/sunxi/sunxi_sram.c | 196 +--
drivers/soc/tegra/fuse/fuse-tegra.c | 14 +-
drivers/soc/tegra/fuse/tegra-apbmisc.c | 40 +-
drivers/soc/tegra/pmc.c | 648 ++++++----
drivers/soc/ti/k3-ringacc.c | 7 +-
drivers/soc/ti/k3-socinfo.c | 41 +-
drivers/soc/ti/knav_dma.c | 8 +-
drivers/soc/ti/knav_qmss.h | 2 +-
drivers/soc/ti/knav_qmss_acc.c | 2 +-
drivers/soc/ti/knav_qmss_queue.c | 155 ++-
drivers/soc/xilinx/zynqmp_power.c | 47 +-
drivers/tee/amdtee/amdtee_private.h | 16 -
drivers/tee/amdtee/call.c | 2 +-
drivers/tee/amdtee/core.c | 52 +-
drivers/tee/optee/call.c | 3 +-
drivers/tee/optee/optee_msg.h | 50 +-
drivers/tee/optee/optee_private.h | 120 +-
drivers/usb/host/xhci-tegra.c | 38 +-
include/dt-bindings/arm/qcom,ids.h | 11 +
include/dt-bindings/memory/nvidia,tegra238-mc.h | 74 ++
include/dt-bindings/memory/nvidia,tegra264.h | 287 +++++
include/dt-bindings/memory/tegra114-mc.h | 67 +
include/dt-bindings/soc/renesas,r8a78000-mfis.h | 28 +
include/linux/arm-smccc.h | 5 +
include/linux/arm_ffa.h | 4 +-
.../linux/firmware/samsung/exynos-acpm-protocol.h | 36 +-
include/linux/fsl/mc.h | 6 +-
include/linux/irqdomain_defs.h | 1 -
include/linux/scmi_imx_protocol.h | 14 +
include/linux/scmi_protocol.h | 36 +-
include/linux/soc/mediatek/mtk-cmdq.h | 24 +
include/linux/soc/qcom/geni-se.h | 19 +
include/linux/soc/qcom/llcc-qcom.h | 44 +-
include/linux/soc/qcom/ubwc.h | 22 +
include/linux/soc/ti/knav_dma.h | 11 +-
include/soc/qcom/qcom-spmi-pmic.h | 15 +-
include/soc/tegra/mc.h | 2 +-
include/soc/tegra/pmc.h | 81 +-
include/uapi/linux/fsl_hypervisor.h | 4 +-
159 files changed, 7850 insertions(+), 2365 deletions(-)
create mode 100644 Documentation/devicetree/bindings/soc/renesas/renesas,r8a78000-mfis.yaml
create mode 100644 drivers/firmware/samsung/exynos-acpm-tmu.c
create mode 100644 drivers/firmware/samsung/exynos-acpm-tmu.h
delete mode 100644 drivers/irqchip/irq-gic-v3-its-fsl-mc-msi.c
create mode 100644 drivers/memory/tegra/tegra-emc-common.c
create mode 100644 drivers/memory/tegra/tegra-emc-common.h
create mode 100644 drivers/memory/tegra/tegra114-emc.c
create mode 100644 drivers/memory/tegra/tegra238.c
create mode 100644 drivers/soc/renesas/rcar-mfis.c
create mode 100644 include/dt-bindings/memory/nvidia,tegra238-mc.h
create mode 100644 include/dt-bindings/soc/renesas,r8a78000-mfis.h
^ permalink raw reply
* Re: [PATCH v3 2/2] clk: amlogic: Add A9 peripherals clock controller driver
From: Jerome Brunet @ 2026-06-16 7:51 UTC (permalink / raw)
To: Jian Hu
Cc: Jian Hu via B4 Relay, Neil Armstrong, Michael Turquette,
Stephen Boyd, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Xianwei Zhao, Kevin Hilman, Martin Blumenstingl, linux-amlogic,
linux-clk, devicetree, linux-kernel, linux-arm-kernel
In-Reply-To: <5601fe65-777b-4db0-a6e5-8d2cdcde7e53@amlogic.com>
On mar. 16 juin 2026 at 14:12, Jian Hu <jian.hu@amlogic.com> wrote:
>>>
>>> If you think splitting it further into separate helper macros would improve
>>> readability.
>> One clock per macro please. Hidding 2 declaration is recipe for
>> disaster. For ex, here the first one is static, the 2nd is not
>
>
> I'll split it into separate helper macros so that each macro expands to a
> single clock definition.
>
> They are defined as follows: (Excluding struct clk_regmap)
>
> #define A9_VCLK_GATE(_name, _reg, _bit, _parent) \
> .data = &(struct clk_regmap_gate_data){ \
> .offset = _reg, \
> .bit_idx = _bit, \
> }, \
> .hw.init = &(struct clk_init_data) { \
> .name = #_name "_en", \
> .ops = &clk_regmap_gate_ops, \
> .parent_hws = (const struct clk_hw *[]) { _parent }, \
> .num_parents = 1, \
> .flags = CLK_SET_RATE_PARENT, \
> },
>
> #define A9_VCLK_DIV(_name, _reg, _div) \
>
> ....
>
> static struct clk_regmap a9_vclk_div2_en = {
> A9_VCLK_GATE(vclk_div2, VID_CLK_CTRL, 1, &a9_vclk.hw),
> };
>
>
> static struct clk_regmap a9_vclk_div2 = {
> A9_VCLK_DIV(vclk_div2, VID_CLK_CTRL, 2),
> };
>
> My understanding is that you would prefer helper macros to cover only the
> repeated initializer fields,
> while keeping the actual clock declarations explicit.
I do not have a definitive preference over this but I do want things to be
consistent, at least within the driver, globaly whenever possible.
Look at the other macros you have already defined in your driver and do
the same thing, including the way you declare the variable. Apart from
this, it seems fine.
>
> If that's not what you had in mind, please let me know.
>>> I can do that as well.
>>>
--
Jerome
^ permalink raw reply
* [GIT PULL 0/4] soc updates for 7.2
From: Arnd Bergmann @ 2026-06-16 7:50 UTC (permalink / raw)
To: Linus Torvalds
Cc: soc, linux-arm-kernel, Krzysztof Kozlowski, Linus Walleij,
Marek Vasut, linux-kernel
Once more, the changes are dominated by devicetree updates for
64-bit NXP/Freescale and Qualcomm platforms. There are slightly
under 1000 patches this time, almost as much as for 7.1. The
overall diff size is much smaller this time as we have a lot
of simpler patches, only five new SoCs that are all variations
of previously supported ones, and again few large code changes.
The most contributions this time are from:
52 Marek Vasut
35 Krzysztof Kozlowski
30 Chen-Yu Tsai
27 Biju Das
19 Sudeep Holla
18 Linus Walleij
16 Sherry Sun
16 Cristian Marussi
15 Svyatoslav Ryhel
15 Stefano Radaelli
15 Hugo Villeneuve
15 Cristian Ciocaltea
14 Harshal Dev
14 Abel Vesa
13 Conor Dooley
12 Thierry Reding
12 Konrad Dybcio
12 Josua Mayer
12 Frank Li
11 Tudor Ambarus
11 Ronald Claveau
11 Nishanth Menon
11 Alexander Koskovich
diffstat=0.1
0.4% Documentation/arch/arm/zte/
0.3% Documentation/devicetree/bindings/arm/
0.1% Documentation/devicetree/bindings/clock/
0.1% Documentation/devicetree/bindings/iommu/
0.7% Documentation/devicetree/bindings/memory-controllers/
0.7% Documentation/devicetree/bindings/soc/renesas/
0.1% Documentation/devicetree/bindings/soc/
0.1% Documentation/devicetree/bindings/watchdog/
0.2% Documentation/devicetree/bindings/
3.5% arch/arm/boot/dts/aspeed/
0.6% arch/arm/boot/dts/gemini/
0.1% arch/arm/boot/dts/mediatek/
3.4% arch/arm/boot/dts/nvidia/
2.5% arch/arm/boot/dts/nxp/imx/
0.3% arch/arm/boot/dts/renesas/
0.6% arch/arm/boot/dts/st/
0.2% arch/arm/boot/dts/zte/
0.1% arch/arm/boot/dts/
1.1% arch/arm/
0.1% arch/arm64/boot/dts/allwinner/
1.2% arch/arm64/boot/dts/amlogic/
3.0% arch/arm64/boot/dts/apple/
3.3% arch/arm64/boot/dts/aspeed/
0.1% arch/arm64/boot/dts/cix/
21.1% arch/arm64/boot/dts/freescale/
0.1% arch/arm64/boot/dts/intel/
0.9% arch/arm64/boot/dts/mediatek/
0.1% arch/arm64/boot/dts/nuvoton/
0.1% arch/arm64/boot/dts/nvidia/
17.1% arch/arm64/boot/dts/qcom/
5.7% arch/arm64/boot/dts/renesas/
3.1% arch/arm64/boot/dts/rockchip/
4.0% arch/arm64/boot/dts/ti/
0.2% arch/arm64/boot/dts/
0.3% arch/arm64/configs/
0.3% arch/riscv/boot/dts/microchip/
0.5% arch/riscv/boot/dts/sophgo/
3.0% arch/riscv/boot/dts/spacemit/
0.1% arch/riscv/boot/dts/starfive/
0.1% arch/riscv/boot/dts/tenstorrent/
0.1% arch/riscv/boot/dts/thead/
0.4% drivers/bus/fsl-mc/
0.2% drivers/clk/
0.4% drivers/firmware/arm_ffa/
0.1% drivers/firmware/arm_scmi/transports/
0.1% drivers/firmware/arm_scmi/vendors/imx/
1.3% drivers/firmware/arm_scmi/
0.1% drivers/firmware/imx/
1.0% drivers/firmware/samsung/
0.5% drivers/firmware/
0.1% drivers/gpu/drm/
0.3% drivers/irqchip/
5.1% drivers/memory/tegra/
0.1% drivers/soc/bcm/brcmstb/
1.6% drivers/soc/qcom/
0.8% drivers/soc/renesas/
0.2% drivers/soc/sunxi/
0.9% drivers/soc/tegra/
0.5% drivers/soc/ti/
0.1% drivers/soc/
0.1% drivers/tee/amdtee/
0.7% drivers/tee/optee/
0.1% drivers/tee/
0.3% drivers/
0.4% include/dt-bindings/clock/
1.0% include/dt-bindings/memory/
0.5% include/dt-bindings/reset/
0.1% include/dt-bindings/
0.2% include/linux/soc/qcom/
0.3% include/linux/
0.1% include/soc/
843 files changed, 56647 insertions(+), 6762 deletions(-)
git shortlog --first-parent
Arnd Bergmann (19):
Merge tag 'pxa1908-dt-for-7.2' of https://codeberg.org/pxa1908-mainline/linux into soc/dt
Merge tag 'renesas-dts-for-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
Merge tag 'zx29-dts-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/dt
Merge tag 'tegra-for-7.2-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'arm-soc/for-7.2/devicetree' of https://github.com/Broadcom/stblinux into soc/dt
Merge tag 'ti-k3-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt
Merge tag 'apple-soc-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/dt
Merge tag 'imx-dt-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'hisi-arm64-dt-for-7.2' of https://github.com/hisilicon/linux-hisi into soc/dt
Merge tag 'v7.2-rockchip-dts64-2' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'riscv-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/dt
Merge tag 'omap-for-v7.2/dt-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/dt
Merge tag 'at91-dt-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt
Merge tag 'microchip-dt64-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/dt
Merge tag 'imx-dt64-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'imx-dt64-7.2-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'imx-binding-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/dt
Merge tag 'sunxi-dt-for-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt
Merge tag 'bst-arm64-emmc-driver-dts-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/dt
Krzysztof Kozlowski (10):
Merge tag 'mtk-dts32-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt
Merge tag 'mtk-dts64-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/dt
Merge tag 'renesas-dts-for-v7.2-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/dt
Merge tag 'tenstorrent-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/tenstorrent/linux into soc/dt
Merge tag 'thead-dt-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/fustini/linux into soc/dt
Merge tag 'spacemit-dt-for-7.2-1' of https://github.com/spacemit-com/linux into soc/dt
Merge tag 'amlogic-arm64-dt-for-v7.2-v2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/amlogic/linux into soc/dt
Merge tag 'nuvoton-7.2-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
Merge tag 'riscv-sophgo-dt-for-v7.2' of https://github.com/sophgo/linux into soc/dt
Merge tag 'aspeed-7.2-devicetree-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/dt
Linus Walleij (10):
Merge tag 'cix-dt-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/dt
Merge tag 'qcom-arm64-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/dt
Merge tag 'v7.2-rockchip-dts32' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'v7.2-rockchip-dts64-1' of https://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into soc/dt
Merge tag 'gemini-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/dt
Merge tag 'tegra-for-7.2-dt-bindings' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'tegra-for-7.2-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
Merge tag 'samsung-dt64-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt
Merge tag 'stm32-dt-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt
Merge tag 'socfpga_dts_updates_for_v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux into soc/dt
Mohamed Ayman (1):
ARM: dts: ixp4xx: use phandle-based GPIOs in mi424wr
Ryan Chen (4):
dt-bindings: arm: aspeed: Add AST2700 board compatible
arm64: Kconfig: Add ASPEED SoC family Kconfig support
arm64: dts: aspeed: Add initial AST27xx SoC device tree
arm64: dts: aspeed: Fix duplicate pinctrl labels and address scheme
Yu-Chun Lin (1):
arm64: dts: realtek: Add pinctrl support for RTD1625
Arnd Bergmann (19):
Merge tag 'soc_fsl-7.1-2' of https://git.kernel.org/pub/scm/linux/kernel/git/chleroy/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Merge tag 'qcom-drivers-for-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Merge tag 'scmi-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'ffa-updates-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Merge tag 'amdtee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'optee-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
Merge tag 'tegra-for-7.2-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-pmc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'tegra-for-7.2-firmware' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
Merge tag 'samsung-drivers-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Merge tag 'memory-controller-drv-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Merge tag 'arm-soc/for-7.2/drivers' of https://github.com/Broadcom/stblinux into soc/drivers
Merge tag 'ti-driver-soc-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/drivers
Merge tag 'cache-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Merge tag 'riscv-soc-drivers-for-v7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into soc/drivers
Revert "Documentation: ABI: add sysfs interface for ZynqMP CSU registers"
Revert "firmware: zynqmp: Add dynamic CSU register discovery and sysfs interface"
Merge tag 'memory-controller-drv-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Krzysztof Kozlowski (4):
Merge tag 'mtk-soc-for-v7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers
Merge tag 'renesas-drivers-for-v7.2-tag2' of https://git.kernel.org/pub/scm/linux/kernel/git/geert/renesas-devel into soc/drivers
Merge tag 'sunxi-drivers-for-7.2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/drivers
Merge tag 'aspeed-7.2-drivers-0' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers
Linus Walleij (1):
Merge tag 'zynqmp-soc-for-7.2' of https://github.com/Xilinx/linux-xlnx into soc/drivers
Arnd Bergmann (5):
Merge tag 'v7.2-qcom-pinctrl-defconfigs' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl into soc/defconfig
Merge tag 'cix-defconfig-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/peter.chen/cix into soc/defconfig
Merge tag 'at91-defconfig-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into soc/defconfig
Merge tag 'imx-defconfig-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/defconfig
Merge tag 'bst-arm64-emmc-driver-defconfig-for-v7.2' of https://github.com/BlackSesame-SoC/linux into soc/defconfig
Krzysztof Kozlowski (11):
arm64: defconfig: Move entries to match savedefconfig
arm64: defconfig: Drop unused legacy netfilter options
arm64: defconfig: Drop default or selected drivers
arm64: defconfig: Drop unused Ethernet vendors
arm64: defconfig: Switch Ethernet drivers to modules
ARM: multi_v7_defconfig: Move entries to match savedefconfig
ARM: configs: Drop redundant I2C_DESIGNWARE_PLATFORM
ARM: configs: Drop redundant SND_ATMEL_SOC
ARM: multi_v7_defconfig: Cleanup redundant options
ARM: multi_v7_defconfig: Correct QCOM_RPMH and QCOM_RPMHPD
ARM: configs: Drop duplicated CONFIG_EXT4_FS
Manivannan Sadhasivam (1):
arm64: defconfig: Enable PCI M.2 power sequencing driver
Maxime Ripard (1):
ARM: multi_v7_defconfig: Enable dma-buf heaps
Ryan Chen (1):
arm64: configs: Update defconfig for AST2700 platform support
Arnd Bergmann (7):
ARM: select legacy gpiolib interfaces where used
Merge tag 'soc-pxa-gpio-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux into soc/arm
Merge tag 'zx29-plat-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'ep93xx-20260529' of https://git.kernel.org/pub/scm/linux/kernel/git/asv/linux into soc/arm
Merge tag 'imx-soc-updates-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into soc/arm
Merge tag 'omap-for-v7.2/soc-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into soc/arm
Merge tag 'mvebu-arm-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/gclement/mvebu into soc/arm
Bartosz Golaszewski (1):
arm64: Kconfig: drop unneeded dependency on OF_GPIO for ARCH_MVEBU
Ethan Nelson-Moore (1):
ARM: remove the last few uses of do_bad_IRQ()
Linus Walleij (2):
Merge tag 'zx29-docfix-for-7.2' of https://gitlab.com/stefandoesinger/zx297520-kernel into soc/arm
Merge tag 'samsung-soc-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/arm
Prasad Bolisetty (1):
MAINTAINERS: Add Axiado reviewer and Maintainers
^ permalink raw reply
* [PATCH v2] media: meson: vdec: fix use-after-free of decode work in stop/close path
From: Doruk Tan Ozturk @ 2026-06-16 7:49 UTC (permalink / raw)
To: neil.armstrong, mchehab, gregkh, khilman
Cc: jbrunet, martin.blumenstingl, hverkuil, linux-media,
linux-amlogic, linux-staging, linux-arm-kernel, linux-kernel,
Doruk Tan Ozturk, stable
The ESPARSER worker (esparser_queue_all_src(), scheduled via
sess->esparser_queue_work) dereferences sess->m2m_ctx and accesses the
ESPARSER/DOS registers. On the stop_streaming()/release() paths the
buffers and, on close, the m2m context are torn down while this worker
may still be pending or running, leading to a use-after-free of the
freed session state.
vdec_poweroff() previously only called vdec_ops->stop() and disabled the
clocks; it never synchronized against the worker. Two problems follow:
- The decode (VDEC) interrupt is threaded
(devm_request_threaded_irq(.., vdec_isr, vdec_threaded_isr, ..)) and
its threaded handler re-arms the worker through amvdec_dst_buf_done()
-> schedule_work(&sess->esparser_queue_work). A handler that is still
in flight can therefore queue the worker again after teardown has
begun.
- The worker touches ESPARSER/DOS registers, so it must not run after
the clocks have been disabled.
Quiesce everything in vdec_poweroff(), in order, before disabling the
clocks: vdec_ops->stop() masks the VDEC interrupt in hardware so no new
IRQ can be raised; synchronize_irq() on the VDEC line then drains any
threaded handler still in flight (the only context that re-arms the
worker); cancel_work_sync() finally cancels/waits for the worker. After
this nothing can re-arm the work, and the worker can no longer run with
clocks disabled or against a freed m2m context.
Only the VDEC interrupt is synchronized: the ESPARSER interrupt handler
(esparser_isr()) only acknowledges the start-code-found status and wakes
the internal wait queue used by esparser_write_data(); it never touches
the session or schedules the worker, so it cannot re-arm it.
stop_streaming()/release() run under the video device lock, not under
sess->lock (the mutex the worker takes), so cancel_work_sync() here
cannot deadlock against the worker.
The VDEC IRQ number is now stored in struct amvdec_core so it is
available to synchronize_irq() at teardown.
Fixes: 3e7f51bd9607 ("media: meson: add v4l2 m2m video decoder driver")
Cc: stable@vger.kernel.org
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
v2: also synchronize_irq() before cancelling the work, so a delayed
threaded IRQ cannot re-arm it after cancel_work_sync() (raised by
automated review). Only the VDEC IRQ is synchronized, as the
ESPARSER IRQ handler does not touch the session or schedule the work.
v1: https://lore.kernel.org/linux-media/20260615140529.52653-1-doruk@0sec.ai/
drivers/staging/media/meson/vdec/vdec.c | 21 +++++++++++++++++++++
drivers/staging/media/meson/vdec/vdec.h | 3 +++
2 files changed, 24 insertions(+)
diff --git a/drivers/staging/media/meson/vdec/vdec.c b/drivers/staging/media/meson/vdec/vdec.c
index 4b77ec1af5a7..5304987546fa 100644
--- a/drivers/staging/media/meson/vdec/vdec.c
+++ b/drivers/staging/media/meson/vdec/vdec.c
@@ -123,6 +123,25 @@ static void vdec_poweroff(struct amvdec_session *sess)
codec_ops->drain(sess);
vdec_ops->stop(sess);
+
+ /*
+ * vdec_ops->stop() masks the VDEC interrupt at the hardware level, so
+ * no new IRQ can be raised past this point. The threaded ISR re-arms
+ * the ESPARSER worker via amvdec_dst_buf_done() (schedule_work()), so
+ * drain any in-flight handler before cancelling the worker, otherwise
+ * a late threaded IRQ could schedule it again after the cancel.
+ *
+ * The worker dereferences sess->m2m_ctx and touches the ESPARSER/DOS
+ * registers, so it must be cancelled while m2m_ctx is still valid and
+ * the clocks are still enabled, i.e. before the clk_disable below.
+ *
+ * This runs from the stop_streaming()/release() paths, which are
+ * serialized by the video device lock, not by sess->lock (the lock the
+ * worker takes), so cancel_work_sync() cannot deadlock here.
+ */
+ synchronize_irq(sess->core->vdec_irq);
+ cancel_work_sync(&sess->esparser_queue_work);
+
clk_disable_unprepare(sess->core->dos_clk);
clk_disable_unprepare(sess->core->dos_parser_clk);
}
@@ -1053,6 +1072,8 @@ static int vdec_probe(struct platform_device *pdev)
if (ret)
return ret;
+ core->vdec_irq = irq;
+
ret = esparser_init(pdev, core);
if (ret)
return ret;
diff --git a/drivers/staging/media/meson/vdec/vdec.h b/drivers/staging/media/meson/vdec/vdec.h
index 7a5d8e871d70..9a50116a2665 100644
--- a/drivers/staging/media/meson/vdec/vdec.h
+++ b/drivers/staging/media/meson/vdec/vdec.h
@@ -66,6 +66,8 @@ struct amvdec_session;
* @v4l2_dev: v4l2 device
* @cur_sess: current decoding session
* @lock: video device lock
+ * @vdec_irq: IRQ line of the VDEC, used to synchronize the threaded ISR
+ * against teardown
*/
struct amvdec_core {
void __iomem *dos_base;
@@ -91,6 +93,7 @@ struct amvdec_core {
struct amvdec_session *cur_sess;
struct mutex lock;
+ int vdec_irq;
};
/**
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v6] soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read
From: Karthikeyan KS @ 2026-06-16 7:30 UTC (permalink / raw)
To: andrew
Cc: joel, andrew, Kees Cook, linux-arm-kernel, linux-aspeed,
linux-kernel, linux-hardening
In-Reply-To: <033f2657ae6a94ad13d22f717a2900afb75d892d.camel@codeconstruct.com.au>
Hi Andrew,
Happy to. Short version: ast2600-evb can't hit the SMP timing window,
so I reproduce each missing piece deliberately. The driver code under
test is unmodified -- only the stimulus and the post-race state are
injected. Stock qemu-system-arm (Debian 8.2.2), no QEMU changes.
Three obstacles, and what I did about each:
1. No BIOS to emit POST codes -- an injection module stages bytes into
the snoop registers via the LPC syscon regmap (SNPWDR + the HICR6
data-ready bit).
2. QEMU doesn't raise the snoop IRQ for those writes -- after staging,
the module dispatches it in software with
generic_handle_irq_safe(sdev->irq), which runs the driver's real
aspeed_lpc_snoop_irq() -> put_fifo_with_discard() path.
3. The SMP race won't trigger under TCG -- so I reconstruct its outcome
instead: force the channel-0 kfifo to in=4097, out=1, i.e.
(in - out) = 4096 > the 2048-byte ring, the exact state a reader
observes inside the window.
One caveat so it isn't misread: step 3 writes in/out directly, so it
bypasses the new lock. The patched run therefore shows the read path no
longer turns a corrupt (in - out) into a usercopy overflow; the lock's
job of preventing that state is the SPSC argument from the commit, which
TCG can't exercise.
== Tree / config ==
base: v7.1-rc7
clang: 22.1.7 (LLVM=-22; needed for the context-analysis check)
ARM multi_v7_defconfig + CONFIG_CC_IS_CLANG, WARN_CONTEXT_ANALYSIS,
SMP, ASPEED_LPC_SNOOP, HARDENED_USERCOPY, PROVE_LOCKING,
DEBUG_ATOMIC_SLEEP.
make ARCH=arm CROSS_COMPILE=arm-linux-gnueabi- LLVM=-22 O=build \
-j$(nproc) zImage
== Run ==
The injection module (full source below the sign-off) creates two
write-only sysfs knobs under /sys/kernel/snoop_test/. The init loads it,
then:
echo 4096 > /sys/kernel/snoop_test/generate # fill via the real
# IRQ path
echo 1 > /sys/kernel/snoop_test/adjust_ptrs # force in=4097/out=1
read(fd, buf, 4096) from /dev/aspeed-lpc-snoop0 # the overflowing read
Build it against the same tree (-DSNOOP_PATCHED for v6, which mirrors the
spinlock the fix adds ahead of @fifo; omit it for the unpatched build).
qemu-system-arm -M ast2600-evb -smp 2 \
-kernel build/arch/arm/boot/zImage \
-dtb build/arch/arm/boot/dts/aspeed/aspeed-ast2600-evb.dtb \
-initrd repro.cpio.gz \
-append "console=ttyS4,115200 panic=-1" -nographic -no-reboot
== Result ==
Unpatched, read(4096) with in=4097/out=1:
usercopy: Kernel memory exposure attempt detected from SLUB object
'kmalloc-2k' (offset 0, size 2049)!
kfifo_copy_to_user / __kfifo_to_user / snoop_file_read / vfs_read
Kernel panic - not syncing: Fatal exception
Patched: read() returns 2048, no panic; no lockdep or atomic-sleep
splats.
The init is just: mount proc/sysfs/devtmpfs, finit_module() the .ko,
write the two knobs above, then read(4096) from the char device. Full
injection module follows.
Thanks,
Karthikeyan
------ snoop_test_inject.c (build as an out-of-tree module) ------
// SPDX-License-Identifier: GPL-2.0
/*
* Reproduce the aspeed-lpc-snoop kfifo SPSC-violation post-race state
* deterministically under QEMU. Two write-only sysfs knobs under
* /sys/kernel/snoop_test/:
*
* generate <count> Push <count> POST-code bytes through the *real*
* driver IRQ path: write SNPWDR + HICR6 via the LPC
* syscon regmap, then dispatch the snoop IRQ so
* aspeed_lpc_snoop_irq() -> put_fifo_with_discard()
* runs.
*
* adjust_ptrs <1> Force the channel-0 kfifo into the state a reader
* observes inside the race window: in = 4097,
* out = 1, so (in - out) = 4096 > the 2048-byte ring.
*
* The driver's private channel is reached through a mirror struct whose
* layout must match drivers/soc/aspeed/aspeed-lpc-snoop.c. The v6 fix
* inserts a spinlock_t ahead of @fifo -- build with -DSNOOP_PATCHED to
* mirror that, otherwise the &fifo offset is wrong.
*/
#include <linux/module.h>
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/version.h>
#include <linux/fs.h>
#include <linux/file.h>
#include <linux/kfifo.h>
#include <linux/miscdevice.h>
#include <linux/regmap.h>
#include <linux/interrupt.h>
#include <linux/irq.h>
#include <linux/irqdesc.h>
#include <linux/device.h>
#include <linux/kobject.h>
#include <linux/sysfs.h>
#include <linux/wait.h>
#include <linux/spinlock.h>
#include <linux/bitops.h>
#define HICR6 0x84
#define HICR6_STR_SNP0W BIT(0)
#define SNPWDR 0x94
#define SNOOP_DEV "/dev/aspeed-lpc-snoop0"
#define RACE_OUT 1u
#define RACE_IN 4097u
struct snoop_chan_mirror {
const void *cfg;
bool enabled;
#ifdef SNOOP_PATCHED
spinlock_t lock; /* added by the fix */
#endif
struct kfifo fifo;
wait_queue_head_t wq;
struct miscdevice miscdev;
};
struct snoop_dev_mirror {
struct regmap *regmap;
int irq;
/* struct clk *clk; struct aspeed_lpc_snoop_channel chan[2]; follow */
};
static struct file *snoop_open(struct snoop_chan_mirror **chan_out)
{
struct file *filp;
struct miscdevice *md;
filp = filp_open(SNOOP_DEV, O_RDONLY | O_NONBLOCK, 0);
if (IS_ERR(filp))
return filp;
md = filp->private_data;
if (!md) {
filp_close(filp, NULL);
return ERR_PTR(-ENODEV);
}
*chan_out = container_of(md, struct snoop_chan_mirror, miscdev);
return filp;
}
static ssize_t generate_store(struct kobject *kobj, struct kobj_attribute *attr,
const char *buf, size_t len)
{
struct snoop_chan_mirror *chan;
struct snoop_dev_mirror *sdev;
struct file *filp;
unsigned int count, i;
int rc;
rc = kstrtouint(buf, 0, &count);
if (rc)
return rc;
filp = snoop_open(&chan);
if (IS_ERR(filp))
return PTR_ERR(filp);
sdev = dev_get_drvdata(chan->miscdev.parent);
if (!sdev || !sdev->regmap || sdev->irq <= 0) {
filp_close(filp, NULL);
return -ENODEV;
}
for (i = 0; i < count; i++) {
/* Stage the snoop'ed byte and the data-ready status bit. */
regmap_write(sdev->regmap, SNPWDR, (u32)(i & 0xff));
regmap_write(sdev->regmap, HICR6, HICR6_STR_SNP0W);
/*
* Dispatch IRQ -> aspeed_lpc_snoop_irq() ->
* put_fifo_with_discard(). generic_handle_irq_safe() copes
* with the GIC requiring the handler to run with IRQs off.
*/
generic_handle_irq_safe(sdev->irq);
}
filp_close(filp, NULL);
return len;
}
static ssize_t adjust_ptrs_store(struct kobject *kobj, struct kobj_attribute *attr,
const char *buf, size_t len)
{
struct snoop_chan_mirror *chan;
struct file *filp;
struct __kfifo *kf;
unsigned int val;
int rc;
rc = kstrtouint(buf, 0, &val);
if (rc)
return rc;
if (val != 1)
return -EINVAL;
filp = snoop_open(&chan);
if (IS_ERR(filp))
return PTR_ERR(filp);
kf = &chan->fifo.kfifo;
/* Reproduce the race outcome: fresh 'in', stale 'out'. */
WRITE_ONCE(kf->out, RACE_OUT);
WRITE_ONCE(kf->in, RACE_IN);
pr_info("snoop_test: in=%u out=%u (in-out=%u, size=%u)\n",
kf->in, kf->out, kf->in - kf->out, kf->mask + 1);
filp_close(filp, NULL);
return len;
}
static struct kobj_attribute generate_attr =
__ATTR(generate, 0220, NULL, generate_store);
static struct kobj_attribute adjust_ptrs_attr =
__ATTR(adjust_ptrs, 0220, NULL, adjust_ptrs_store);
static struct attribute *snoop_attrs[] = {
&generate_attr.attr,
&adjust_ptrs_attr.attr,
NULL,
};
static const struct attribute_group snoop_group = { .attrs = snoop_attrs };
static struct kobject *snoop_kobj;
static int __init snoop_test_init(void)
{
int rc;
snoop_kobj = kobject_create_and_add("snoop_test", kernel_kobj);
if (!snoop_kobj)
return -ENOMEM;
rc = sysfs_create_group(snoop_kobj, &snoop_group);
if (rc) {
kobject_put(snoop_kobj);
return rc;
}
return 0;
}
static void __exit snoop_test_exit(void)
{
sysfs_remove_group(snoop_kobj, &snoop_group);
kobject_put(snoop_kobj);
}
module_init(snoop_test_init);
module_exit(snoop_test_exit);
MODULE_LICENSE("GPL");
MODULE_DESCRIPTION("aspeed-lpc-snoop kfifo race post-state reproducer");
^ permalink raw reply
* [PATCH v4] arm64: dts: imx94: Add Root Port node and PERST property
From: hongxing.zhu @ 2026-06-16 7:23 UTC (permalink / raw)
To: sherry.sun, robh, krzk+dt, conor+dt, frank.li, s.hauer, festevam
Cc: kernel, devicetree, imx, linux-arm-kernel, linux-kernel,
Richard Zhu
From: Richard Zhu <hongxing.zhu@nxp.com>
Since describing the PCIe PERST# property under Host Bridge node is now
deprecated, it is recommended to add it to the Root Port node, so
creating the Root Port node and add the reset-gpios property in Root
Port.
Move the regulator to Root Port nodes as well, because that the PCI
pwrctrl framework had been integrated into pci-imx6 driver.
Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
Reviewed-by: Sherry Sun <sherry.sun@nxp.com>
---
arch/arm64/boot/dts/freescale/imx94.dtsi | 11 +++++++++++
arch/arm64/boot/dts/freescale/imx943-evk.dts | 14 ++++++++++----
arch/arm64/boot/dts/freescale/imx943.dtsi | 11 +++++++++++
3 files changed, 32 insertions(+), 4 deletions(-)
---
Changes in v4:
Add the description of regualtor changes into commit message too.
Changes in v3:
- Move the regulator to Root Port node as well, since [2] had been
settled.
- Collect Reviewed-by tag issued by Sherry.
Changes in v2:
- Delete reset-gpio properties in PCIe bridge node.
- Correct the "reset-gpio" property to "reset-gpios".
Since the patch-set [1] issued by Sherry had been landed. Add according
changes on i.MX943 board too.
[1] https://lkml.org/lkml/2026/6/1/1461
[2] https://lore.kernel.org/imx/20260520084904.2424253-1-sherry.sun@oss.nxp.com/
diff --git a/arch/arm64/boot/dts/freescale/imx94.dtsi b/arch/arm64/boot/dts/freescale/imx94.dtsi
index 1f9035e6cf159..dfbb73603cb24 100644
--- a/arch/arm64/boot/dts/freescale/imx94.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx94.dtsi
@@ -1411,6 +1411,17 @@ pcie0: pcie@4c300000 {
power-domains = <&scmi_devpd IMX94_PD_HSIO_TOP>;
fsl,max-link-speed = <3>;
status = "disabled";
+
+ pcie0_port0: pcie@0 {
+ compatible = "pciclass,0604";
+ device_type = "pci";
+ reg = <0x0 0x0 0x0 0x0 0x0>;
+ bus-range = <0x01 0xff>;
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+ ranges;
+ };
};
pcie0_ep: pcie-ep@4c300000 {
diff --git a/arch/arm64/boot/dts/freescale/imx943-evk.dts b/arch/arm64/boot/dts/freescale/imx943-evk.dts
index 7cfd424689507..674410e541cba 100644
--- a/arch/arm64/boot/dts/freescale/imx943-evk.dts
+++ b/arch/arm64/boot/dts/freescale/imx943-evk.dts
@@ -1034,12 +1034,15 @@ &pcie0 {
<&pcie_ref_clk>;
clock-names = "pcie", "pcie_bus", "pcie_phy", "pcie_aux",
"ref", "extref";
- reset-gpio = <&pcal6416_i2c3_u46 3 GPIO_ACTIVE_LOW>;
- vpcie3v3aux-supply = <®_m2_wlan>;
supports-clkreq;
status = "okay";
};
+&pcie0_port0 {
+ reset-gpios = <&pcal6416_i2c3_u46 3 GPIO_ACTIVE_LOW>;
+ vpcie3v3aux-supply = <®_m2_wlan>;
+};
+
&pcie0_ep {
pinctrl-0 = <&pinctrl_pcie0>;
pinctrl-names = "default";
@@ -1058,12 +1061,15 @@ &pcie1 {
<&pcie_ref_clk>;
clock-names = "pcie", "pcie_bus", "pcie_phy", "pcie_aux",
"ref", "extref";
- reset-gpio = <&pcal6416_i2c3_u46 1 GPIO_ACTIVE_LOW>;
- vpcie3v3aux-supply = <®_slot_pwr>;
supports-clkreq;
status = "okay";
};
+&pcie1_port0 {
+ reset-gpios = <&pcal6416_i2c3_u46 1 GPIO_ACTIVE_LOW>;
+ vpcie3v3aux-supply = <®_slot_pwr>;
+};
+
&pcie1_ep {
pinctrl-0 = <&pinctrl_pcie1>;
pinctrl-names = "default";
diff --git a/arch/arm64/boot/dts/freescale/imx943.dtsi b/arch/arm64/boot/dts/freescale/imx943.dtsi
index cf5b3dbb47ff7..01152fd0efa5e 100644
--- a/arch/arm64/boot/dts/freescale/imx943.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx943.dtsi
@@ -255,6 +255,17 @@ pcie1: pcie@4c380000 {
power-domains = <&scmi_devpd IMX94_PD_HSIO_TOP>;
fsl,max-link-speed = <3>;
status = "disabled";
+
+ pcie1_port0: pcie@0 {
+ compatible = "pciclass,0604";
+ device_type = "pci";
+ reg = <0x0 0x0 0x0 0x0 0x0>;
+ bus-range = <0x01 0xff>;
+
+ #address-cells = <3>;
+ #size-cells = <2>;
+ ranges;
+ };
};
pcie1_ep: pcie-ep@4c380000 {
--
2.34.1
^ permalink raw reply related
* Re: [PATCH 3/4] mfd: mt6397-core: add mt6323 AUXADC support
From: Andy Shevchenko @ 2026-06-16 7:18 UTC (permalink / raw)
To: Roman Vivchar
Cc: Lee Jones, Jonathan Cameron, David Lechner, Nuno Sá,
Andy Shevchenko, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Matthias Brugger, AngeloGioacchino Del Regno, linux-iio,
devicetree, linux-kernel, linux-arm-kernel, linux-mediatek,
Ben Grisdale
In-Reply-To: <ycj3k-vV_tQv6u9OfCTP9G9kkeeE-_dbzg_oeHPXn2pb1oZe_Sa1BH6GUGuSd_gD6uPSJiTX7tz6MTlFcqGdWX-f3GMfyW2sLgAOCw6YeNE=@protonmail.com>
On Mon, Jun 15, 2026 at 11:10:20PM +0000, Roman Vivchar wrote:
> On Thursday, June 11th, 2026 at 7:37 PM, Lee Jones <lee@kernel.org> wrote:
> > On Tue, 02 Jun 2026, Roman Vivchar via B4 Relay wrote:
...
> > > + .of_compatible = "mediatek,mt6323-auxadc",
> >
> > [Severity: High]
> > Does adding this compatible string expose an unhandled edge case in the
> > auxadc driver?
> >
> > If this device is instantiated directly from a Device Tree without an MFD
> > parent (e.g., at the DT root), dev->parent could be the platform bus
> > (which has a NULL parent) or NULL itself.
> >
> > Looking at mt6323_auxadc_probe() in drivers/iio/adc/mt6323-auxadc.c:
> >
> > regmap = dev_get_regmap(dev->parent->parent, NULL);
> >
> > Could blindly dereferencing dev->parent->parent here, or passing a NULL
> > device to dev_get_regmap() (which calls devres_find()), result in a
> > kernel oops if probed as a root node?
>
> This is intended behavior, ADC always should be probed as a child of
> the mt6323 MFD because it doesn't have own MMIO space. Otherwise the
> devicetree is malformed. Recent mt6359 ADC driver has same thing with
> dev->parent->parent regmap.
I think Sashiko is overprotective here, but if changing, the whole lot of MFD
drivers should be changed (like Rafael recently has done for driver_override
issue in ACPI related drivers).
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH v2 2/4] iio: adc: mt6323-auxadc: add mt6323 PMIC AUXADC driver
From: Andy Shevchenko @ 2026-06-16 7:15 UTC (permalink / raw)
To: Roman Vivchar
Cc: Jonathan Cameron, Roman Vivchar via B4 Relay, David Lechner,
Nuno Sá, Andy Shevchenko, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Matthias Brugger, AngeloGioacchino Del Regno,
Lee Jones, linux-iio, devicetree, linux-kernel, linux-arm-kernel,
linux-mediatek, Ben Grisdale
In-Reply-To: <E5H72l1Cg-JQGpaYAFl5TIyITmghqMsTaHQTR8VkuFtlzmfCGTpVlceNp8c2BDW7UoheO0Fx6NLJHmu56WHRNWdPNLsaoIKMCftj_bnyvEI=@protonmail.com>
On Mon, Jun 15, 2026 at 10:52:57PM +0000, Roman Vivchar wrote:
> On Sunday, June 14th, 2026 at 8:22 PM, Jonathan Cameron <jic23@kernel.org> wrote:
> > On Tue, 09 Jun 2026 16:31:59 +0300
> > Roman Vivchar via B4 Relay <devnull+rva333.protonmail.com@kernel.org> wrote:
...
> > > +/*
> > > + * The MediaTek MT6323 (as well as a lot of other PMICs) has the following hierarchy:
> > > + * PMIC AUXADC <- PMIC MFD <- SoC PWRAP (wrapper for PWRAP FSM)
> > > + *
> > > + * Therefore, PWRAP regmap should be obtained using dev->parent->parent.
> > > + */
> > > +struct mt6323_auxadc {
> > > + struct regmap *regmap;
> > > + struct mutex lock;
> > Locks should always have a comment on what data they are protecting.
> > I think this one is about protecting the state of a device during a channel read
> > by serializing those reads.
>
> Nuno said kerneldoc looks unnecessary on v1 [1]. How the comment should
> look?
The comment near to the member:
/* Why this lock? */
struct mutex lock;
...
> After these changes, should I keep or drop Andy's Reviewed-by?
Keep it, the above mentioned changes does not affect on that.
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* [PATCH v3 3/3] dt-bindings: perf: marvell: add CN20K TAD PMU support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
Marvell CN20K SoCs integrate a Performance Monitoring Unit (PMU)
associated with the LLC Tag-and-Data (TAD) blocks. The PMU provides
hardware counters to monitor cache traffic and performance events
via a dedicated MMIO region.
The CN20K LLC-TAD PMU is largely similar to CN10K, but differs in the
layout of PFC/PRF register offsets relative to each TAD base. These
offsets are derived from the compatible string in the driver and are
not described through Devicetree properties.
Because of this, using "marvell,cn10k-tad-pmu" as a fallback for CN20K
would result in incorrect register programming. Therefore, add a
separate compatible string:
"marvell,cn20k-tad-pmu"
Update the binding to document CN20K alongside CN10K.
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
.../bindings/perf/marvell-cn10k-tad.yaml | 25 +++++++++++++------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml b/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
index 362142252667..d11121a1e2c9 100644
--- a/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
+++ b/Documentation/devicetree/bindings/perf/marvell-cn10k-tad.yaml
@@ -4,23 +4,32 @@
$id: http://devicetree.org/schemas/perf/marvell-cn10k-tad.yaml#
$schema: http://devicetree.org/meta-schemas/core.yaml#
-title: Marvell CN10K LLC-TAD performance monitor
+title: Marvell CN10K / CN20K LLC-TAD performance monitor
maintainers:
- Bhaskara Budiredla <bbudiredla@marvell.com>
+ - Geetha sowjanya <gakula@marvell.com>
description: |
- The Tag-and-Data units (TADs) maintain coherence and contain CN10K
- shared on-chip last level cache (LLC). The tad pmu measures the
- performance of last-level cache. Each tad pmu supports up to eight
- counters.
+ The Tag-and-Data units (TADs) maintain coherence and contain the
+ shared on-chip last level cache (LLC) on Marvell CN10K and CN20K SoCs.
+ The TAD PMU measures last-level cache performance. Each TAD PMU
+ supports up to eight counters.
- The DT setup comprises of number of tad blocks, the sizes of pmu
- regions, tad blocks and overall base address of the HW.
+ The DT setup describes the number of TAD blocks, the sizes of PMU
+ regions and TAD pages, and the overall MMIO base of the hardware.
+
+ marvell,cn20k-tad-pmu is not a compatible fallback for
+ marvell,cn10k-tad-pmu (and vice versa): the driver selects different
+ PFC/PRF MMIO offsets from the compatible string, and those offsets are
+ not described by separate DT properties today.
properties:
compatible:
- const: marvell,cn10k-tad-pmu
+ items:
+ - enum:
+ - marvell,cn10k-tad-pmu
+ - marvell,cn20k-tad-pmu
reg:
maxItems: 1
--
2.25.1
^ permalink raw reply related
* [PATCH v3 2/3] perf: marvell: Add CN20K LLC-TAD PMU support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
Add support for the LLC Tag-and-Data (TAD) PMU present in
Marvell CN20K SoCs.
The CN20K TAD PMU is based on the CN10K design but differs in the
layout of PFC/PRF register offsets relative to each TAD base, and
introduces additional events. These offsets are selected by the driver
based on the compatible string and are not described via DT properties.
Because of this, "marvell,cn10k-tad-pmu" cannot be used as a fallback
for CN20K, as it would result in incorrect register programming.
Add support for "marvell,cn20k-tad-pmu" by:
- Introducing a TAD_PMU_V3 profile with CN20K-specific register bases
- Extending the event map for new CN20K events
- Matching the PMU via OF and ACPI (MRVL000F)
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
---
Changelog (since v2)
--------------------
- Validate the eventId using an appropriate mask to ensure
it is restricted to 8 bits.
Changelog (since v1)
--------------------
- Hide V3-only events on CN10K via sysfs is_visible and reject them in
event_init.
- Use CN20K-specific MPAM PRF bits (MATCH_MPAMNS, partid << 10) for V3;
software partid is limited to nine bits so this does not collide with
the fixed bit at 25.
- Reset hwc->prev_count when starting counters so reads match cleared HW.
drivers/perf/marvell_cn10k_tad_pmu.c | 54 ++++++++++++++++++++++++++--
1 file changed, 52 insertions(+), 2 deletions(-)
diff --git a/drivers/perf/marvell_cn10k_tad_pmu.c b/drivers/perf/marvell_cn10k_tad_pmu.c
index 69a6648fa664..cd81bf8ff569 100644
--- a/drivers/perf/marvell_cn10k_tad_pmu.c
+++ b/drivers/perf/marvell_cn10k_tad_pmu.c
@@ -17,11 +17,14 @@
#define TAD_PRF_OFFSET 0x900
#define TAD_PFC_OFFSET 0x800
+#define TAD_PRF_NS_OFFSET 0x30900
+#define TAD_PFC_NS_OFFSET 0x30800
#define TAD_PFC(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF_CNTSEL_MASK 0xFF
#define TAD_PRF_MATCH_PARTID BIT(8)
#define TAD_PRF_PARTID_NS BIT(10)
+#define TAD_PRF_MATCH_MPAMNS BIT(25)
/*
* config1: bits 0..8 MPAM partition id (including 0); bit 9 requests
* filtering for MPAM-capable events. All-zero config1 means no filter.
@@ -39,6 +42,7 @@ struct tad_region {
enum mrvl_tad_pmu_version {
TAD_PMU_V1 = 1,
TAD_PMU_V2,
+ TAD_PMU_V3,
};
struct tad_pmu_data {
@@ -86,8 +90,15 @@ static void tad_pmu_start_counter(struct tad_pmu *pmu,
if (use_mpam && event_idx > 0x19 && event_idx < 0x21) {
partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_PARTID_NS |
((u64)partid << 11);
+
+ if (pdata->id == TAD_PMU_V3)
+ partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_MATCH_MPAMNS |
+ ((u64)partid << 10);
}
+ /* CN10K support events 0:24*/
+ if (pdata->id == TAD_PMU_V1 && event_idx >= 0x25)
+ return;
for (i = 0; i < pmu->region_cnt; i++) {
reg_val = event_idx & 0xFF;
@@ -160,6 +171,7 @@ static void tad_pmu_event_counter_start(struct perf_event *event, int flags)
struct hw_perf_event *hwc = &event->hw;
hwc->state = 0;
+ local64_set(&hwc->prev_count, 0);
tad_pmu->ops->start_counter(tad_pmu, event);
}
@@ -220,6 +232,8 @@ static int tad_pmu_event_init(struct perf_event *event)
if (cfg1)
return -EINVAL;
} else {
+ if (pdata->id == TAD_PMU_V1 && event_idx >= 0x25)
+ return -EINVAL;
if ((cfg1 & GENMASK(8, 0)) && !(cfg1 & TAD_PARTID_FILTER_EN))
return -EINVAL;
if (cfg1 & TAD_PARTID_FILTER_EN) {
@@ -246,6 +260,22 @@ static ssize_t tad_pmu_event_show(struct device *dev,
return sysfs_emit(page, "event=0x%02llx\n", pmu_attr->id);
}
+static umode_t tad_pmu_event_attr_is_visible(struct kobject *kobj,
+ struct attribute *attr, int unused)
+{
+ struct pmu *pmu = dev_get_drvdata(kobj_to_dev(kobj));
+ struct tad_pmu *t = to_tad_pmu(pmu);
+ struct device_attribute *da = container_of(attr, struct device_attribute,
+ attr);
+ struct perf_pmu_events_attr *e = container_of(da, struct perf_pmu_events_attr,
+ attr);
+ u64 id = e->id;
+
+ if (t->pdata->id != TAD_PMU_V3 && id >= 0x25)
+ return 0;
+ return attr->mode;
+}
+
#define TAD_PMU_EVENT_ATTR(name, config) \
PMU_EVENT_ATTR_ID(name, tad_pmu_event_show, config)
@@ -287,12 +317,25 @@ static struct attribute *tad_pmu_event_attrs[] = {
TAD_PMU_EVENT_ATTR(tad_dat_rd_byp, 0x22),
TAD_PMU_EVENT_ATTR(tad_ifb_occ, 0x23),
TAD_PMU_EVENT_ATTR(tad_req_occ, 0x24),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dtg_evict, 0x25),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_ltg_evict, 0x26),
+ TAD_PMU_EVENT_ATTR(tad_rsp_msh_out_mpam, 0x28),
+ TAD_PMU_EVENT_ATTR(tad_replays, 0x29),
+ TAD_PMU_EVENT_ATTR(tad_req_byp0, 0x2a),
+ TAD_PMU_EVENT_ATTR(tad_req_byp1, 0x2b),
+ TAD_PMU_EVENT_ATTR(tad_txreq_byp, 0x2c),
+ TAD_PMU_EVENT_ATTR(tad_time_in_dslp, 0x2d),
+ TAD_PMU_EVENT_ATTR(tad_time_elapsed, 0x2e),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dss_rd_128mrg, 0x2f),
+ TAD_PMU_EVENT_ATTR(tad_req_msh_out_dss_wr_128mrg, 0x30),
+ TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xff),
NULL
};
static const struct attribute_group tad_pmu_events_attr_group = {
.name = "events",
.attrs = tad_pmu_event_attrs,
+ .is_visible = tad_pmu_event_attr_is_visible,
};
static struct attribute *ody_tad_pmu_event_attrs[] = {
@@ -478,7 +521,7 @@ static int tad_pmu_probe(struct platform_device *pdev)
.read = tad_pmu_event_counter_read,
};
- if (version == TAD_PMU_V1) {
+ if (version == TAD_PMU_V1 || version == TAD_PMU_V3) {
tad_pmu->pmu.attr_groups = tad_pmu_attr_groups;
tad_pmu->ops = &tad_pmu_ops;
} else {
@@ -521,6 +564,11 @@ static const struct tad_pmu_data tad_pmu_data = {
.tad_pfc_offset = TAD_PFC_OFFSET,
};
+static const struct tad_pmu_data tad_pmu_cn20k_data = {
+ .id = TAD_PMU_V3,
+ .tad_prf_offset = TAD_PRF_NS_OFFSET,
+ .tad_pfc_offset = TAD_PFC_NS_OFFSET,
+};
#endif
#ifdef CONFIG_ACPI
@@ -534,6 +582,7 @@ static const struct tad_pmu_data tad_pmu_v2_data = {
#ifdef CONFIG_OF
static const struct of_device_id tad_pmu_of_match[] = {
{ .compatible = "marvell,cn10k-tad-pmu", .data = &tad_pmu_data },
+ { .compatible = "marvell,cn20k-tad-pmu", .data = &tad_pmu_cn20k_data },
{},
};
#endif
@@ -542,6 +591,7 @@ static const struct of_device_id tad_pmu_of_match[] = {
static const struct acpi_device_id tad_pmu_acpi_match[] = {
{"MRVL000B", (kernel_ulong_t)&tad_pmu_data},
{"MRVL000D", (kernel_ulong_t)&tad_pmu_v2_data},
+ {"MRVL000F", (kernel_ulong_t)&tad_pmu_cn20k_data},
{},
};
MODULE_DEVICE_TABLE(acpi, tad_pmu_acpi_match);
@@ -603,6 +653,6 @@ static void __exit tad_pmu_exit(void)
module_init(tad_pmu_init);
module_exit(tad_pmu_exit);
-MODULE_DESCRIPTION("Marvell CN10K LLC-TAD perf driver");
+MODULE_DESCRIPTION("Marvell CN10K/CN20K LLC-TAD perf driver");
MODULE_AUTHOR("Bhaskara Budiredla <bbudiredla@marvell.com>");
MODULE_LICENSE("GPL v2");
--
2.25.1
^ permalink raw reply related
* Patch "arm64/mm: Enable batched TLB flush in unmap_hotplug_range()" has been added to the 5.10-stable tree
From: gregkh @ 2026-06-16 7:10 UTC (permalink / raw)
To: anshuman.khandual, catalin.marinas, david, gregkh,
linux-arm-kernel, ryan.roberts, sashal, will
Cc: stable-commits
In-Reply-To: <20260428200548.3191346-1-sashal@kernel.org>
This is a note to let you know that I've just added the patch titled
arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
to the 5.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
and it can be found in the queue-5.10 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@vger.kernel.org> know about it.
From stable+bounces-241768-greg=kroah.com@vger.kernel.org Wed Apr 29 01:35:55 2026
From: Sasha Levin <sashal@kernel.org>
Date: Tue, 28 Apr 2026 16:05:48 -0400
Subject: arm64/mm: Enable batched TLB flush in unmap_hotplug_range()
To: stable@vger.kernel.org
Cc: Anshuman Khandual <anshuman.khandual@arm.com>, Will Deacon <will@kernel.org>, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, "David Hildenbrand (Arm)" <david@kernel.org>, Ryan Roberts <ryan.roberts@arm.com>, Catalin Marinas <catalin.marinas@arm.com>, Sasha Levin <sashal@kernel.org>
Message-ID: <20260428200548.3191346-1-sashal@kernel.org>
From: Anshuman Khandual <anshuman.khandual@arm.com>
[ Upstream commit 48478b9f791376b4b89018d7afdfd06865498f65 ]
During a memory hot remove operation, both linear and vmemmap mappings for
the memory range being removed, get unmapped via unmap_hotplug_range() but
mapped pages get freed only for vmemmap mapping. This is just a sequential
operation where each table entry gets cleared, followed by a leaf specific
TLB flush, and then followed by memory free operation when applicable.
This approach was simple and uniform both for vmemmap and linear mappings.
But linear mapping might contain CONT marked block memory where it becomes
necessary to first clear out all entire in the range before a TLB flush.
This is as per the architecture requirement. Hence batch all TLB flushes
during the table tear down walk and finally do it in unmap_hotplug_range().
Prior to this fix, it was hypothetically possible for a speculative access
to a higher address in the contiguous block to fill the TLB with shattered
entries for the entire contiguous range after a lower address had already
been cleared and invalidated. Due to the table entries being shattered, the
subsequent TLB invalidation for the higher address would not then clear the
TLB entries for the lower address, meaning stale TLB entries could persist.
Besides it also helps in improving the performance via TLBI range operation
along with reduced synchronization instructions. The time spent executing
unmap_hotplug_range() improved 97% measured over a 2GB memory hot removal
in KVM guest.
This scheme is not applicable during vmemmap mapping tear down where memory
needs to be freed and hence a TLB flush is required after clearing out page
table entry.
Cc: Will Deacon <will@kernel.org>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Closes: https://lore.kernel.org/all/aWZYXhrT6D2M-7-N@willie-the-truck/
Fixes: bbd6ec605c0f ("arm64/mm: Enable memory hot remove")
Cc: stable@vger.kernel.org
Reviewed-by: David Hildenbrand (Arm) <david@kernel.org>
Reviewed-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Ryan Roberts <ryan.roberts@arm.com>
Signed-off-by: Anshuman Khandual <anshuman.khandual@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ renamed `__pte_clear()` to `pte_clear()` and inlined `pmd_cont(pmd)` as `pmd_val(pmd) & PMD_SECT_CONT` ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/mm/mmu.c | 36 ++++++++++++++++++++----------------
1 file changed, 20 insertions(+), 16 deletions(-)
--- a/arch/arm64/mm/mmu.c
+++ b/arch/arm64/mm/mmu.c
@@ -862,10 +862,14 @@ static void unmap_hotplug_pte_range(pmd_
WARN_ON(!pte_present(pte));
pte_clear(&init_mm, addr, ptep);
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pte_cont(pte));
+ flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
free_hotplug_page_range(pte_page(pte),
PAGE_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
} while (addr += PAGE_SIZE, addr < end);
}
@@ -886,15 +890,14 @@ static void unmap_hotplug_pmd_range(pud_
WARN_ON(!pmd_present(pmd));
if (pmd_sect(pmd)) {
pmd_clear(pmdp);
-
- /*
- * One TLBI should be sufficient here as the PMD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ /* CONT blocks are not supported in the vmemmap */
+ WARN_ON(pmd_val(pmd) & PMD_SECT_CONT);
+ flush_tlb_kernel_range(addr, addr + PMD_SIZE);
free_hotplug_page_range(pmd_page(pmd),
PMD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pmd_table(pmd));
@@ -919,15 +922,12 @@ static void unmap_hotplug_pud_range(p4d_
WARN_ON(!pud_present(pud));
if (pud_sect(pud)) {
pud_clear(pudp);
-
- /*
- * One TLBI should be sufficient here as the PUD_SIZE
- * range is mapped with a single block entry.
- */
- flush_tlb_kernel_range(addr, addr + PAGE_SIZE);
- if (free_mapped)
+ if (free_mapped) {
+ flush_tlb_kernel_range(addr, addr + PUD_SIZE);
free_hotplug_page_range(pud_page(pud),
PUD_SIZE, altmap);
+ }
+ /* unmap_hotplug_range() flushes TLB for !free_mapped */
continue;
}
WARN_ON(!pud_table(pud));
@@ -957,6 +957,7 @@ static void unmap_hotplug_p4d_range(pgd_
static void unmap_hotplug_range(unsigned long addr, unsigned long end,
bool free_mapped, struct vmem_altmap *altmap)
{
+ unsigned long start = addr;
unsigned long next;
pgd_t *pgdp, pgd;
@@ -978,6 +979,9 @@ static void unmap_hotplug_range(unsigned
WARN_ON(!pgd_present(pgd));
unmap_hotplug_p4d_range(pgdp, addr, next, free_mapped, altmap);
} while (addr = next, addr < end);
+
+ if (!free_mapped)
+ flush_tlb_kernel_range(start, end);
}
static void free_empty_pte_table(pmd_t *pmdp, unsigned long addr,
Patches currently in stable-queue which might be from sashal@kernel.org are
queue-5.10/team-move-team-device-type-change-at-the-end-of-team.patch
queue-5.10/netfilter-nft_fib-fix-stale-stack-leak-via-the-oifname-register.patch
queue-5.10/asoc-intel-bytcht_es8316-fix-mclk-leak-on-init-error.patch
queue-5.10/spi-sun4i-fix-controller-deregistration.patch
queue-5.10/bluetooth-l2cap-fix-possible-crash-on-l2cap_ecred_co.patch
queue-5.10/ice-fix-vf-queue-configuration-with-low-mtu-values.patch
queue-5.10/ipv6-sit-reload-inner-ipv6-header-after-gso-offloads.patch
queue-5.10/ktest-fixing-indentation-to-match-expected-pattern.patch
queue-5.10/6lowpan-fix-off-by-one-in-multicast-context-address-.patch
queue-5.10/spi-meson-spicc-fix-double-put-in-remove-path.patch
queue-5.10/sctp-fix-race-between-sctp_wait_for_connect-and-peel.patch
queue-5.10/pcnet32-stop-holding-device-spin-lock-during-napi_co.patch
queue-5.10/mptcp-do-not-drop-partial-packets.patch
queue-5.10/bluetooth-hci_core-fix-use-after-free-in-vhci_flush.patch
queue-5.10/serial-qcom-geni-fix-uart_rx_par_en-bit-position.patch
queue-5.10/arm64-tlb-optimize-arm64_workaround_repeat_tlbi.patch
queue-5.10/nfc-llcp-fix-use-after-free-race-in-nfc_llcp_recv_cc.patch
queue-5.10/octeontx2-pf-avoid-double-free-of-pool-stack-on-aq-init-failure.patch
queue-5.10/net-hsr-defer-node-table-free-until-after-rcu-readers.patch
queue-5.10/f2fs-fix-incorrect-file-address-mapping-when-inline-inode-is-unwritten.patch
queue-5.10/phy-tegra-xusb-fix-per-pad-high-speed-termination-calibration.patch
queue-5.10/net-netlink-fix-sending-unassigned-nsid-after-assign.patch
queue-5.10/net-qrtr-ns-free-the-node-during-ctrl_cmd_bye.patch
queue-5.10/dm-cache-policy-smq-check-allocation-under-invalidat.patch
queue-5.10/rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch-26331
queue-5.10/spi-ti-qspi-fix-controller-deregistration.patch
queue-5.10/ipv6-rpl-fix-hdrlen-overflow-in-ipv6_rpl_srh_decompr.patch
queue-5.10/smb-client-use-fullsessionkey-for-aes-256-encryption-key-derivation.patch
queue-5.10/ieee802154-6lowpan-only-accept-ipv6-packets-in-lowpa.patch
queue-5.10/tun-free-page-on-short-frame-rejection-in-tun_xdp_on.patch
queue-5.10/usb-serial-mct_u232-fix-memory-corruption-with-small.patch
queue-5.10/ext4-validate-p_idx-bounds-in-ext4_ext_correct_index.patch
queue-5.10/spi-topcliff-pch-fix-controller-deregistration.patch
queue-5.10/spi-uniphier-fix-controller-deregistration.patch
queue-5.10/mtd-spi-nor-sst-fix-write-enable-before-aai-sequence.patch
queue-5.10/signal-clear-jobctl_pending_mask-for-caller-in-zap_o.patch
queue-5.10/spi-syncuacer-fix-controller-deregistration.patch
queue-5.10/alsa-aoa-i2sbus-clear-stale-prepared-state.patch
queue-5.10/sched-use-u64-for-bandwidth-ratio-calculations.patch
queue-5.10/spi-tegra20-sflash-fix-controller-deregistration.patch
queue-5.10/usb-typec-ucsi-check-if-power-role-change-actually-happened-before-handling.patch
queue-5.10/rdma-umem-fix-kernel-doc-warnings.patch
queue-5.10/revert-rdma-rxe-fix-double-free-in-rxe_srq_from_init.patch
queue-5.10/octeontx2-af-add-validation-for-lmac-type.patch
queue-5.10/can-ucan-fix-devres-lifetime.patch
queue-5.10/net-qrtr-fix-refcount-saturation-and-potential-uaf-i.patch
queue-5.10/spi-qup-switch-to-use-modern-name.patch
queue-5.10/media-rc-igorplugusb-heed-coherency-rules.patch
queue-5.10/bpf-free-reuseport-cbpf-prog-after-rcu-grace-period.patch
queue-5.10/net-qrtr-ns-change-servers-radix-tree-to-xarray.patch
queue-5.10/qed-fix-double-free-in-qed_cxt_tables_alloc.patch
queue-5.10/usb-typec-ucsi-don-t-update-power_supply-on-power-role-change-if-not-connected.patch
queue-5.10/media-rc-ttusbir-respect-dma-coherency-rules.patch
queue-5.10/wifi-mac80211-check-tdls-flag-in-ieee80211_tdls_oper.patch
queue-5.10/batman-adv-tt-fix-toctou-race-for-reported-vlans.patch
queue-5.10/tty-serial-qcom-geni-serial-remove-unused-symbols.patch
queue-5.10/tty-serial-qcom-geni-serial-align-define-values.patch
queue-5.10/bluetooth-fix-uaf-in-l2cap_sock_cleanup_listen-vs-l2cap_conn_del.patch
queue-5.10/time-fix-off-by-one-in-settimeofday-usec-validation.patch
queue-5.10/usb-serial-cypress_m8-fix-memory-corruption-with-sma.patch
queue-5.10/xfrm-policy-fix-use-after-free-on-inexact-bin-in-xfr.patch
queue-5.10/netlabel-validate-unlabeled-address-and-mask-attribu.patch
queue-5.10/can-ucan-fix-typos-in-comments.patch
queue-5.10/batman-adv-tp_meter-fix-race-condition-in-send-error.patch
queue-5.10/batman-adv-tt-avoid-empty-vlan-responses.patch
queue-5.10/net-qrtr-ns-limit-the-total-number-of-nodes.patch
queue-5.10/spi-zynq-qspi-fix-controller-deregistration.patch
queue-5.10/serial-altera_jtaguart-handle-uart_add_one_port-failures.patch
queue-5.10/thunderbolt-property-cap-recursion-depth-in-__tb_property_parse_dir.patch
queue-5.10/serial-dz-fix-bootconsole-handover-lockup.patch
queue-5.10/net-sched-revert-net-sched-restrict-conditions-for-a.patch
queue-5.10/octeontx2-af-cgx-add-bounds-check-to-cgx_speed_mbps-index.patch
queue-5.10/btrfs-fix-missing-last_unlink_trans-update-when-removing-a-directory.patch
queue-5.10/vxlan-do-not-reuse-cached-ip_hdr-value-after-skb_tun.patch
queue-5.10/udf-fix-partition-descriptor-append-bookkeeping.patch
queue-5.10/net-guard-timestamp-cmsgs-to-real-error-queue-skbs.patch
queue-5.10/batman-adv-tvlv-reject-oversized-tvlv-packets.patch
queue-5.10/xfrm-check-for-underflow-in-xfrm_state_mtu.patch
queue-5.10/rdma-umem-fix-truncation-for-block-sizes-4g.patch
queue-5.10/net-garp-fix-unsigned-integer-underflow-in-garp_pdu_.patch
queue-5.10/alsa-aloop-fix-peer-runtime-uaf-during-format-change-stop.patch
queue-5.10/hid-core-fix-size_t-specifier-in-hid_report_raw_even.patch
queue-5.10/rds-mark-snapshot-pages-dirty-in-rds_info_getsockopt.patch
queue-5.10/bluetooth-init-sk_peer_-on-bt_sock_alloc.patch
queue-5.10/serial-altera_jtaguart-use-platform_get_irq_optional-to-get-the-interrupt.patch
queue-5.10/net-sched-act_api-use-rcu-with-deferred-freeing-for-.patch
queue-5.10/bluetooth-6lowpan-check-skb_clone-return-value-in-se.patch
queue-5.10/batman-adv-v-stop-ogmv2-on-disabled-interface.patch
queue-5.10/nfc-llcp-protect-nfc_llcp_sock_unlink-calls.patch
queue-5.10/net-openvswitch-fix-possible-kfree_skb-of-err_ptr.patch
queue-5.10/smb-client-fix-smbdirect_recv_io-leak-in-smbd_negoti.patch
queue-5.10/arm64-tlb-flush-walk-cache-when-unsharing-pmd-tables.patch
queue-5.10/mptcp-pm-add_addr-rtx-fix-potential-data-race.patch
queue-5.10/spi-st-ssc4-fix-controller-deregistration.patch
queue-5.10/net-packet-fix-toctou-race-on-mmap-d-vnet_hdr-in-tpacket_snd.patch
queue-5.10/netfilter-nf_queue-hold-bridge-skb-dev-while-queued.patch
queue-5.10/drm-nouveau-fix-u32-overflow-in-pushbuf-reloc-bounds-check.patch
queue-5.10/ip6_vti-fix-incorrect-tunnel-matching-in-vti6_tnl_lo.patch
queue-5.10/btrfs-fix-btrfs_ioctl_space_info-slot_count-toctou-which-can-lead-to-info-leak.patch
queue-5.10/io_uring-prevent-opcode-speculation.patch
queue-5.10/wifi-brcmfmac-fix-potential-use-after-free-issue-when-stopping-watchdog-task.patch
queue-5.10/hid-pass-the-buffer-size-to-hid_report_raw_event.patch
queue-5.10/alsa-aoa-skip-devices-with-no-codecs-in-i2sbus_resume.patch
queue-5.10/printk-add-print_hex_dump_devel.patch
queue-5.10/dm-thin-fix-metadata-refcount-underflow.patch
queue-5.10/batman-adv-bla-avoid-null-ptr-deref-for-claim-via-dr.patch
queue-5.10/tracing-probes-limit-size-of-event-probe-to-3k.patch
queue-5.10/usb-serial-digi_acceleport-fix-memory-corruption-wit.patch
queue-5.10/mm-hugetlb_cma-round-up-per_node-before-logging-it.patch
queue-5.10/bluetooth-rfcomm-hold-listener-socket-in-rfcomm_conn.patch
queue-5.10/wifi-mwifiex-fix-use-after-free-in-mwifiex_adapter_cleanup.patch
queue-5.10/tracepoint-balance-regfunc-on-func_add-failure-in-tracepoint_add_func.patch
queue-5.10/batman-adv-iv-recover-ogm-scheduling-after-forward-p.patch
queue-5.10/net-sched-cls_fw-fix-null-dereference-of-old-filters.patch
queue-5.10/compiler-clang.h-add-__diag-infrastructure-for-clang.patch
queue-5.10/spi-qup-fix-error-pointer-deref-after-dma-setup-failure.patch
queue-5.10/net-netlink-don-t-set-nsid-on-local-notifications.patch
queue-5.10/smb-client-fix-oob-read-in-smb2_ioctl_query_info-query_info-path.patch
queue-5.10/alsa-core-fix-potential-data-race-at-fasync-handling.patch
queue-5.10/net-smc-do-not-re-initialize-smc-hashtables.patch
queue-5.10/batman-adv-tp_meter-avoid-role-confusion-in-tp_list.patch
queue-5.10/ipvs-clear-the-svc-scheduler-ptr-early-on-edit.patch
queue-5.10/bluetooth-l2cap-clear-chan-ident-on-ecred-reconfigur.patch
queue-5.10/tunnels-do-not-assume-transport-header-in-iptunnel_p.patch
queue-5.10/selftests-mptcp-drop-nanoseconds-width-specifier.patch
queue-5.10/net-802-mrp-fix-vector-attribute-parsing-in-mrp_pdu_.patch
queue-5.10/batman-adv-bla-avoid-double-decrement-of-bla.num_req.patch
queue-5.10/hfsplus-fix-uninit-value-by-validating-catalog-record-size.patch
queue-5.10/batman-adv-tvlv-abort-ogm-send-on-tvlv-append-failur.patch
queue-5.10/alsa-pcm-fix-wait-queue-list-corruption-in-snd_pcm_d.patch
queue-5.10/rdma-move-dma-block-iterator-logic-into-dedicated-files.patch
queue-5.10/dm-btree-improve-btree-residency.patch
queue-5.10/page_pool-fix-use-after-free-in-page_pool_recycle_in.patch
queue-5.10/fbcon-avoid-oob-font-access-if-console-rotation-fails.patch
queue-5.10/tun-free-page-on-build_skb-failure-in-tun_xdp_one.patch
queue-5.10/qed-use-the-bitmap-api-to-simplify-some-functions.patch
queue-5.10/hid-core-add-printk_ratelimited-variants-to-hid_warn.patch
queue-5.10/bluetooth-mgmt-validate-advertising-tlv-before-type-.patch
queue-5.10/usb-dwc3-move-guid-programming-after-phy-initialization.patch
queue-5.10/netfilter-synproxy-add-mutex-to-guard-hook-reference.patch
queue-5.10/net-remove-redundant-if-statements.patch
queue-5.10/tee-optee-prevent-use-after-free-when-the-client-exi.patch
queue-5.10/hv_netvsc-use-kmap_local_page-in-netvsc_copy_to_send_buf.patch
queue-5.10/disable-wattribute-alias-for-clang-23-and-newer.patch
queue-5.10/net-qrtr-ns-limit-the-maximum-number-of-lookups.patch
queue-5.10/net-sched-sch_sfb-replace-direct-dequeue-call-with-p.patch
queue-5.10/netfilter-x_tables-avoid-leaking-percpu-counter-poin.patch
queue-5.10/tunnels-load-network-headers-after-skb_cow-in-iptunn.patch
queue-5.10/netfilter-synproxy-refresh-tcphdr-after-skb_ensure_w.patch
queue-5.10/arm64-mm-enable-batched-tlb-flush-in-unmap_hotplug_range.patch
queue-5.10/alsa-aoa-use-guard-for-mutex-locks.patch
queue-5.10/bluetooth-hci_event-fix-potential-uaf-in-ssp-passkey-handlers.patch
queue-5.10/bluetooth-consolidate-code-around-sk_alloc-into-a-helper-function.patch
queue-5.10/kvm-arm64-remove-vpipt-i-cache-handling.patch
queue-5.10/xhci-tegra-fix-ghost-usb-device-on-dual-role-port-un.patch
queue-5.10/netfilter-nft_exthdr-fix-register-tracking-for-f_pre.patch
queue-5.10/net-iucv-fix-locking-in-.getsockopt.patch
queue-5.10/sctp-purge-outqueue-on-stale-cookie-echo-handling.patch
queue-5.10/ipv4-restrict-ipopt_ssrr-and-ipopt_lsrr-options.patch
queue-5.10/netfilter-xt_cpu-prefer-raw_smp_processor_id.patch
queue-5.10/bluetooth-hci_qca-convert-timeout-from-jiffies-to-ms.patch
queue-5.10/spi-lantiq-ssc-fix-controller-deregistration.patch
queue-5.10/erofs-fix-the-out-of-bounds-nameoff-handling-for-trailing-dirents.patch
queue-5.10/smb-client-require-a-full-nfs-mode-sid-before-reading-mode-bits.patch
queue-5.10/phy-renesas-rcar-gen3-usb2-fix-the-use-of-msleep-dur.patch
queue-5.10/bonding-limit-bond_mode_8023ad-to-ethernet-devices.patch
queue-5.10/scsi-target-iscsi-bound-iscsi_encode_text_output-appends-to-rsp_buf.patch
queue-5.10/spi-sun6i-fix-controller-deregistration.patch
queue-5.10/netfilter-ebtables-fix-oob-read-in-compat_mtw_from_u.patch
queue-5.10/phy-tegra-xusb-disable-trk-clk-when-not-in-use.patch
queue-5.10/ceph-only-d_add-negative-dentries-when-they-are-unhashed.patch
queue-5.10/octeontx2-af-replace-deprecated-strncpy-with-strscpy.patch
queue-5.10/tap-free-page-on-error-paths-in-tap_get_user_xdp.patch
queue-5.10/nfc-nxp-nci-i2c-use-rising-edge-irq-on-acpi-systems.patch
queue-5.10/ktest-fix-the-month-in-the-name-of-the-failure-directory.patch
queue-5.10/pmdomain-core-fix-detach-procedure-for-virtual-devices-in-genpd.patch
queue-5.10/scsi-target-iscsi-fix-crc-overread-and-double-free-in-iscsit_handle_text_cmd.patch
queue-5.10/mm-huge_memory-update-file-pmd-counter-before-folio_put.patch
queue-5.10/net-bridge-use-a-stable-fdb-dst-snapshot-in-rcu-readers.patch
queue-5.10/f2fs-fix-uaf-caused-by-decrementing-sbi-nr_pages-in-f2fs_write_end_io.patch
queue-5.10/thermal-core-fix-thermal-zone-governor-cleanup-issues.patch
queue-5.10/net-lan743x-permit-vlan-tagged-packets-up-to-configu.patch
queue-5.10/drm-imx-fix-three-kernel-doc-warnings-in-dcss-scaler.patch
queue-5.10/usbnet-fix-using-smp_processor_id-in-preemptible-cod.patch
queue-5.10/spi-tegra114-fix-controller-deregistration.patch
queue-5.10/bluetooth-serialize-accept_q-access.patch
queue-5.10/crypto-caam-guard-hmac-key-hex-dumps-in-hash_digest_key.patch
queue-5.10/netfilter-bridge-make-ebt_snat-arp-rewrite-writable.patch
queue-5.10/acpi-scan-use-acpi_dev_put-in-object-add-error-paths.patch
queue-5.10/nfc-llcp-fix-use-after-free-in-llcp_sock_release.patch
queue-5.10/selftests-forwarding-lib-add-helpers-for-checksum-ha.patch
queue-5.10/alsa-usb-audio-fix-null-pointer-dereference-on-point.patch
queue-5.10/hfsplus-fix-held-lock-freed-on-hfsplus_fill_super.patch
queue-5.10/netfilter-conntrack_irc-fix-possible-out-of-bounds-r.patch
queue-5.10/netfilter-xt_nfqueue-prefer-raw_smp_processor_id.patch
queue-5.10/use-less-confusing-names-for-iov_iter-direction-initializers.patch
queue-5.10/net-rds-fix-null-deref-in-rds_ib_send_cqe_handler-on.patch
queue-5.10/sctp-fix-uninit-value-in-__sctp_rcv_asconf_lookup.patch
queue-5.10/ipv4-free-net-ipv4.sysctl_local_reserved_ports-after.patch
queue-5.10/net-mvpp2-sync-rx-data-at-the-hardware-packet-offset.patch
queue-5.10/arm64-tlb-allow-xzr-argument-to-tlbi-ops.patch
queue-5.10/nfsd-don-t-ignore-the-return-code-of-svc_proc_regist.patch
^ permalink raw reply
* [PATCH v3 1/3] perf: marvell: Add MPAM partid filtering to CN10K TAD PMU
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
In-Reply-To: <20260616071149.12523-1-gakula@marvell.com>
From: Tanmay Jagdale <tanmay@marvell.com>
The TAD PMU exposes counters that can be filtered by MPAM partition id
for a subset of allocation and hit events.
Add a 9-bit partid format attribute (config1) and route counter programming
through variant-specific ops so CN10K keeps MPAM-capable programming while
Odyssey keeps the reduced event set without advertising partid in sysfs.
Probe no longer mutates the platform_device MMIO resource (walk a local
map_start), rejects tad-cnt / page sizes of zero, validates the memory
window against tad-cnt, and registers the perf PMU before hotplug with
correct unwind.
Example:
perf stat -e tad/tad_alloc_any,partid=0x12,partid_en=1/ -- <program>
Signed-off-by: Tanmay Jagdale <tanmay@marvell.com>
---
Changelog (since v2)
--------------------
- Validate the eventId using an appropriate mask to ensure
it is restricted to 8 bits
Changelog (since v1)
--------------------
- Fix config1 filter enable to use bit 9 consistently with the PMU format
string (partid_en) and reject reserved bits with GENMASK(9, 0).
- Register perf_pmu_register before cpuhp_state_add_instance_nocalls and
unregister on hotplug failure.
drivers/perf/marvell_cn10k_tad_pmu.c | 216 ++++++++++++++++++++-------
1 file changed, 164 insertions(+), 52 deletions(-)
diff --git a/drivers/perf/marvell_cn10k_tad_pmu.c b/drivers/perf/marvell_cn10k_tad_pmu.c
index 51ccb0befa05..69a6648fa664 100644
--- a/drivers/perf/marvell_cn10k_tad_pmu.c
+++ b/drivers/perf/marvell_cn10k_tad_pmu.c
@@ -7,6 +7,7 @@
#define pr_fmt(fmt) "tad_pmu: " fmt
#include <linux/io.h>
+#include <linux/bits.h>
#include <linux/module.h>
#include <linux/of.h>
#include <linux/cpuhotplug.h>
@@ -14,12 +15,20 @@
#include <linux/platform_device.h>
#include <linux/acpi.h>
-#define TAD_PFC_OFFSET 0x800
-#define TAD_PFC(counter) (TAD_PFC_OFFSET | (counter << 3))
#define TAD_PRF_OFFSET 0x900
-#define TAD_PRF(counter) (TAD_PRF_OFFSET | (counter << 3))
+#define TAD_PFC_OFFSET 0x800
+#define TAD_PFC(base, counter) ((base) | ((u64)(counter) << 3))
+#define TAD_PRF(base, counter) ((base) | ((u64)(counter) << 3))
#define TAD_PRF_CNTSEL_MASK 0xFF
+#define TAD_PRF_MATCH_PARTID BIT(8)
+#define TAD_PRF_PARTID_NS BIT(10)
+/*
+ * config1: bits 0..8 MPAM partition id (including 0); bit 9 requests
+ * filtering for MPAM-capable events. All-zero config1 means no filter.
+ */
+#define TAD_PARTID_FILTER_EN BIT(9)
#define TAD_MAX_COUNTERS 8
+#define TAD_EVENT_SEL_MASK GENMASK(7, 0)
#define to_tad_pmu(p) (container_of(p, struct tad_pmu, pmu))
@@ -27,30 +36,92 @@ struct tad_region {
void __iomem *base;
};
+enum mrvl_tad_pmu_version {
+ TAD_PMU_V1 = 1,
+ TAD_PMU_V2,
+};
+
+struct tad_pmu_data {
+ int id;
+ u64 tad_prf_offset;
+ u64 tad_pfc_offset;
+};
+
struct tad_pmu {
struct pmu pmu;
struct tad_region *regions;
u32 region_cnt;
unsigned int cpu;
+ const struct tad_pmu_ops *ops;
+ const struct tad_pmu_data *pdata;
struct hlist_node node;
struct perf_event *events[TAD_MAX_COUNTERS];
DECLARE_BITMAP(counters_map, TAD_MAX_COUNTERS);
};
-enum mrvl_tad_pmu_version {
- TAD_PMU_V1 = 1,
- TAD_PMU_V2,
-};
-
-struct tad_pmu_data {
- int id;
+struct tad_pmu_ops {
+ void (*start_counter)(struct tad_pmu *pmu, struct perf_event *event);
};
static int tad_pmu_cpuhp_state;
+static void tad_pmu_start_counter(struct tad_pmu *pmu,
+ struct perf_event *event)
+{
+ const struct tad_pmu_data *pdata = pmu->pdata;
+ struct hw_perf_event *hwc = &event->hw;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u32 counter_idx = hwc->idx;
+ u64 partid_filter = 0;
+ u64 reg_val;
+ u64 cfg1 = event->attr.config1;
+ bool use_mpam = cfg1 & TAD_PARTID_FILTER_EN;
+ u32 partid = (u32)(cfg1 & GENMASK(8, 0));
+ int i;
+
+ for (i = 0; i < pmu->region_cnt; i++)
+ writeq_relaxed(0, pmu->regions[i].base +
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
+
+ if (use_mpam && event_idx > 0x19 && event_idx < 0x21) {
+ partid_filter = TAD_PRF_MATCH_PARTID | TAD_PRF_PARTID_NS |
+ ((u64)partid << 11);
+ }
+
+
+ for (i = 0; i < pmu->region_cnt; i++) {
+ reg_val = event_idx & 0xFF;
+ reg_val |= partid_filter;
+ writeq_relaxed(reg_val, pmu->regions[i].base +
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
+ }
+}
+
+static void tad_pmu_v2_start_counter(struct tad_pmu *pmu,
+ struct perf_event *event)
+{
+ const struct tad_pmu_data *pdata = pmu->pdata;
+ struct hw_perf_event *hwc = &event->hw;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u32 counter_idx = hwc->idx;
+ u64 reg_val;
+ int i;
+
+ for (i = 0; i < pmu->region_cnt; i++)
+ writeq_relaxed(0, pmu->regions[i].base +
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
+
+ for (i = 0; i < pmu->region_cnt; i++) {
+ reg_val = event_idx & 0xFF;
+ writeq_relaxed(reg_val, pmu->regions[i].base +
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
+ }
+}
+
static void tad_pmu_event_counter_read(struct perf_event *event)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
struct hw_perf_event *hwc = &event->hw;
u32 counter_idx = hwc->idx;
u64 prev, new;
@@ -60,7 +131,7 @@ static void tad_pmu_event_counter_read(struct perf_event *event)
prev = local64_read(&hwc->prev_count);
for (i = 0, new = 0; i < tad_pmu->region_cnt; i++)
new += readq(tad_pmu->regions[i].base +
- TAD_PFC(counter_idx));
+ TAD_PFC(pdata->tad_pfc_offset, counter_idx));
} while (local64_cmpxchg(&hwc->prev_count, prev, new) != prev);
local64_add(new - prev, &event->count);
@@ -69,16 +140,14 @@ static void tad_pmu_event_counter_read(struct perf_event *event)
static void tad_pmu_event_counter_stop(struct perf_event *event, int flags)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
struct hw_perf_event *hwc = &event->hw;
u32 counter_idx = hwc->idx;
int i;
- /* TAD()_PFC() stop counting on the write
- * which sets TAD()_PRF()[CNTSEL] == 0
- */
for (i = 0; i < tad_pmu->region_cnt; i++) {
writeq_relaxed(0, tad_pmu->regions[i].base +
- TAD_PRF(counter_idx));
+ TAD_PRF(pdata->tad_prf_offset, counter_idx));
}
tad_pmu_event_counter_read(event);
@@ -89,26 +158,10 @@ static void tad_pmu_event_counter_start(struct perf_event *event, int flags)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
struct hw_perf_event *hwc = &event->hw;
- u32 event_idx = event->attr.config;
- u32 counter_idx = hwc->idx;
- u64 reg_val;
- int i;
hwc->state = 0;
- /* Typically TAD_PFC() are zeroed to start counting */
- for (i = 0; i < tad_pmu->region_cnt; i++)
- writeq_relaxed(0, tad_pmu->regions[i].base +
- TAD_PFC(counter_idx));
-
- /* TAD()_PFC() start counting on the write
- * which sets TAD()_PRF()[CNTSEL] != 0
- */
- for (i = 0; i < tad_pmu->region_cnt; i++) {
- reg_val = event_idx & 0xFF;
- writeq_relaxed(reg_val, tad_pmu->regions[i].base +
- TAD_PRF(counter_idx));
- }
+ tad_pmu->ops->start_counter(tad_pmu, event);
}
static void tad_pmu_event_counter_del(struct perf_event *event, int flags)
@@ -128,7 +181,6 @@ static int tad_pmu_event_counter_add(struct perf_event *event, int flags)
struct hw_perf_event *hwc = &event->hw;
int idx;
- /* Get a free counter for this event */
idx = find_first_zero_bit(tad_pmu->counters_map, TAD_MAX_COUNTERS);
if (idx == TAD_MAX_COUNTERS)
return -EAGAIN;
@@ -148,6 +200,9 @@ static int tad_pmu_event_counter_add(struct perf_event *event, int flags)
static int tad_pmu_event_init(struct perf_event *event)
{
struct tad_pmu *tad_pmu = to_tad_pmu(event->pmu);
+ const struct tad_pmu_data *pdata = tad_pmu->pdata;
+ u32 event_idx = (u32)(event->attr.config & TAD_EVENT_SEL_MASK);
+ u64 cfg1 = event->attr.config1;
if (event->attr.type != event->pmu->type)
return -ENOENT;
@@ -158,6 +213,23 @@ static int tad_pmu_event_init(struct perf_event *event)
if (event->state != PERF_EVENT_STATE_OFF)
return -EINVAL;
+ if (event->attr.config & ~TAD_EVENT_SEL_MASK)
+ return -EINVAL;
+
+ if (pdata->id == TAD_PMU_V2) {
+ if (cfg1)
+ return -EINVAL;
+ } else {
+ if ((cfg1 & GENMASK(8, 0)) && !(cfg1 & TAD_PARTID_FILTER_EN))
+ return -EINVAL;
+ if (cfg1 & TAD_PARTID_FILTER_EN) {
+ if (event_idx <= 0x19 || event_idx >= 0x21)
+ return -EINVAL;
+ }
+ if (cfg1 & ~GENMASK(9, 0))
+ return -EINVAL;
+ }
+
event->cpu = tad_pmu->cpu;
event->hw.idx = -1;
event->hw.config_base = event->attr.config;
@@ -232,7 +304,7 @@ static struct attribute *ody_tad_pmu_event_attrs[] = {
TAD_PMU_EVENT_ATTR(tad_hit_ltg, 0x1e),
TAD_PMU_EVENT_ATTR(tad_hit_any, 0x1f),
TAD_PMU_EVENT_ATTR(tad_tag_rd, 0x20),
- TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xFF),
+ TAD_PMU_EVENT_ATTR(tad_tot_cycle, 0xff),
NULL
};
@@ -242,9 +314,13 @@ static const struct attribute_group ody_tad_pmu_events_attr_group = {
};
PMU_FORMAT_ATTR(event, "config:0-7");
+PMU_FORMAT_ATTR(partid, "config1:0-8");
+PMU_FORMAT_ATTR(partid_en, "config1:9-9");
static struct attribute *tad_pmu_format_attrs[] = {
&format_attr_event.attr,
+ &format_attr_partid.attr,
+ &format_attr_partid_en.attr,
NULL
};
@@ -253,6 +329,16 @@ static struct attribute_group tad_pmu_format_attr_group = {
.attrs = tad_pmu_format_attrs,
};
+static struct attribute *ody_tad_pmu_format_attrs[] = {
+ &format_attr_event.attr,
+ NULL
+};
+
+static struct attribute_group ody_tad_pmu_format_attr_group = {
+ .name = "format",
+ .attrs = ody_tad_pmu_format_attrs,
+};
+
static ssize_t tad_pmu_cpumask_show(struct device *dev,
struct device_attribute *attr, char *buf)
{
@@ -281,16 +367,25 @@ static const struct attribute_group *tad_pmu_attr_groups[] = {
static const struct attribute_group *ody_tad_pmu_attr_groups[] = {
&ody_tad_pmu_events_attr_group,
- &tad_pmu_format_attr_group,
+ &ody_tad_pmu_format_attr_group,
&tad_pmu_cpumask_attr_group,
NULL
};
+static const struct tad_pmu_ops tad_pmu_ops = {
+ .start_counter = tad_pmu_start_counter,
+};
+
+static const struct tad_pmu_ops tad_pmu_v2_ops = {
+ .start_counter = tad_pmu_v2_start_counter,
+};
+
static int tad_pmu_probe(struct platform_device *pdev)
{
const struct tad_pmu_data *dev_data;
struct device *dev = &pdev->dev;
struct tad_region *regions;
+ resource_size_t map_start;
struct tad_pmu *tad_pmu;
struct resource *res;
u32 tad_pmu_page_size;
@@ -298,7 +393,6 @@ static int tad_pmu_probe(struct platform_device *pdev)
u32 tad_cnt;
int version;
int i, ret;
- char *name;
tad_pmu = devm_kzalloc(&pdev->dev, sizeof(*tad_pmu), GFP_KERNEL);
if (!tad_pmu)
@@ -312,6 +406,7 @@ static int tad_pmu_probe(struct platform_device *pdev)
return -ENODEV;
}
version = dev_data->id;
+ tad_pmu->pdata = dev_data;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
@@ -338,22 +433,31 @@ static int tad_pmu_probe(struct platform_device *pdev)
dev_err(&pdev->dev, "Can't find tad-cnt property\n");
return ret;
}
+ if (!tad_cnt || !tad_page_size || !tad_pmu_page_size) {
+ dev_err(&pdev->dev, "Invalid tad-cnt or page size\n");
+ return -EINVAL;
+ }
regions = devm_kcalloc(&pdev->dev, tad_cnt,
sizeof(*regions), GFP_KERNEL);
if (!regions)
return -ENOMEM;
- /* ioremap the distributed TAD pmu regions */
- for (i = 0; i < tad_cnt && res->start < res->end; i++) {
- regions[i].base = devm_ioremap(&pdev->dev,
- res->start,
+ map_start = res->start;
+ for (i = 0; i < tad_cnt; i++) {
+ if (map_start > res->end ||
+ tad_pmu_page_size > (resource_size_t)(res->end - map_start + 1)) {
+ dev_err(&pdev->dev, "TAD PMU mem window too small for tad-cnt=%u\n",
+ tad_cnt);
+ return -EINVAL;
+ }
+ regions[i].base = devm_ioremap(&pdev->dev, map_start,
tad_pmu_page_size);
if (!regions[i].base) {
dev_err(&pdev->dev, "TAD%d ioremap fail\n", i);
return -ENOMEM;
}
- res->start += tad_page_size;
+ map_start += tad_page_size;
}
tad_pmu->regions = regions;
@@ -374,28 +478,31 @@ static int tad_pmu_probe(struct platform_device *pdev)
.read = tad_pmu_event_counter_read,
};
- if (version == TAD_PMU_V1)
+ if (version == TAD_PMU_V1) {
tad_pmu->pmu.attr_groups = tad_pmu_attr_groups;
- else
+ tad_pmu->ops = &tad_pmu_ops;
+ } else {
tad_pmu->pmu.attr_groups = ody_tad_pmu_attr_groups;
+ tad_pmu->ops = &tad_pmu_v2_ops;
+ }
tad_pmu->cpu = raw_smp_processor_id();
- /* Register pmu instance for cpu hotplug */
+ ret = perf_pmu_register(&tad_pmu->pmu, "tad", -1);
+ if (ret) {
+ dev_err(&pdev->dev, "Error %d registering perf PMU\n", ret);
+ return ret;
+ }
+
ret = cpuhp_state_add_instance_nocalls(tad_pmu_cpuhp_state,
&tad_pmu->node);
if (ret) {
dev_err(&pdev->dev, "Error %d registering hotplug\n", ret);
+ perf_pmu_unregister(&tad_pmu->pmu);
return ret;
}
- name = "tad";
- ret = perf_pmu_register(&tad_pmu->pmu, name, -1);
- if (ret)
- cpuhp_state_remove_instance_nocalls(tad_pmu_cpuhp_state,
- &tad_pmu->node);
-
- return ret;
+ return 0;
}
static void tad_pmu_remove(struct platform_device *pdev)
@@ -410,12 +517,17 @@ static void tad_pmu_remove(struct platform_device *pdev)
#if defined(CONFIG_OF) || defined(CONFIG_ACPI)
static const struct tad_pmu_data tad_pmu_data = {
.id = TAD_PMU_V1,
+ .tad_prf_offset = TAD_PRF_OFFSET,
+ .tad_pfc_offset = TAD_PFC_OFFSET,
};
+
#endif
#ifdef CONFIG_ACPI
static const struct tad_pmu_data tad_pmu_v2_data = {
.id = TAD_PMU_V2,
+ .tad_prf_offset = TAD_PRF_OFFSET,
+ .tad_pfc_offset = TAD_PFC_OFFSET,
};
#endif
@@ -491,6 +603,6 @@ static void __exit tad_pmu_exit(void)
module_init(tad_pmu_init);
module_exit(tad_pmu_exit);
-MODULE_DESCRIPTION("Marvell CN10K LLC-TAD Perf driver");
+MODULE_DESCRIPTION("Marvell CN10K LLC-TAD perf driver");
MODULE_AUTHOR("Bhaskara Budiredla <bbudiredla@marvell.com>");
MODULE_LICENSE("GPL v2");
--
2.25.1
^ permalink raw reply related
* [PATCH v3 0/3] perf: marvell: LLC-TAD PMU MPAM filtering support
From: Geetha sowjanya @ 2026-06-16 7:11 UTC (permalink / raw)
To: linux-perf-users, linux-kernel, linux-arm-kernel, devicetree
Cc: mark.rutland, will, krzk+dt, gakula
This series extends the Marvell LLC-TAD performance driver used on CN10K
and CN20K systems.
Patch 1 adds optional MPAM partition-id filtering for the subset of TAD
events that support it, exposes partid / partid_en in the PMU format string,
and keeps the reduced Odyssey event surface without advertising partid where
it does not apply. It also fixes probe resource handling (no in-place
mutation of platform_get_resource() bounds, validate MMIO window vs
tad-cnt), orders perf registration vs hotplug with unwind, and aligns the
filter-enable bit in config1 with the sysfs format (bit 9).
Patch 2 introduces CN20K LLC-TAD support: non-standard PFC/PRF offsets,
additional programmable events with visibility checks so CN10K does not
advertise V3-only events, CN20K-specific MPAM encoding for the V3 profile,
local64_set(prev_count) on counter start, and device discovery via OF and
ACPI.
Patch 3 extends the DeviceTree binding for marvell,cn20k-tad-pmu.
Changes since v2
----------------
- Validate the eventId using an appropriate mask to ensure it is restricted to 8 bits.
Changes since v1
----------------
- config1: use bit 9 for MPAM filter enable consistently with partid_en in
the PMU format; allow only bits 0..9 in event_init on CN10K/CN20K paths.
- Reject reserved bits in attr.config and use the same 8-bit event index in
start_counter as in event_init so MPAM validation cannot be bypassed.
- Hide V3-only sysfs events on V1.
- Reset prev_count when starting counters after clearing hardware.
- DT binding: explain non-fallback compatibles for CN10K vs CN20K.
Tanmay Jagdale (1):
perf: marvell: Add MPAM partid filtering to CN10K TAD PMU
Geetha sowjanya (2):
perf: marvell: Add CN20K LLC-TAD PMU support
dt-bindings: perf: marvell: Extend CN10K TAD PMU binding for CN20K
Signed-off-by: Geetha sowjanya <gakula@marvell.com>
--
2.25.1
^ permalink raw reply
* Re: [PATCH] PCI: dwc: meson: Fix reset GPIO initial state
From: Neil Armstrong @ 2026-06-16 7:10 UTC (permalink / raw)
To: linux-kernel-dev, Yue Wang, Lorenzo Pieralisi,
Krzysztof Wilczyński, Manivannan Sadhasivam, Rob Herring,
Bjorn Helgaas, Kevin Hilman, Jerome Brunet, Martin Blumenstingl,
Remi Pommarel
Cc: linux-pci, linux-amlogic, linux-arm-kernel, linux-kernel
In-Reply-To: <20260616-fix-meson-pcie-reset-gpio-v1-1-fca404b4c8be@aliel.fr>
On 6/16/26 09:07, Ronald Claveau via B4 Relay wrote:
> From: Ronald Claveau <linux-kernel-dev@aliel.fr>
>
> Commit 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio
> descriptor") inverted the reset assertion logic to use proper gpio
> descriptor semantics, and moved the polarity configuration to the
> device tree as GPIO_ACTIVE_LOW. However, the initial GPIO state
> "GPIOD_OUT_LOW" was not updated accordingly.
>
> Change GPIOD_OUT_LOW to GPIOD_OUT_HIGH to get the right behaviour.
>
> With GPIOD_OUT_LOW:
>
> ahci 0000:01:00.0: enabling device (0000 -> 0002)
> ahci 0000:01:00.0: SSS flag set, parallel bus scan disabled
> ahci 0000:01:00.0: Controller reset failed (0xffffffff)
> ahci 0000:01:00.0: probe with driver ahci failed with error -5
>
> With this fix:
>
> ahci 0000:01:00.0: enabling device (0000 -> 0002)
> ahci 0000:01:00.0: AHCI vers 0001.0300, 32 command slots, 6 Gbps,
> SATA mode
> ahci 0000:01:00.0: 1/1 ports implemented (port mask 0x1)
> ahci 0000:01:00.0: flags: 64bit ncq led clo only pio ccc
>
> Fixes: 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
> Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
> ---
> drivers/pci/controller/dwc/pci-meson.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
> index 0694084f612b7..15ed59b8764fb 100644
> --- a/drivers/pci/controller/dwc/pci-meson.c
> +++ b/drivers/pci/controller/dwc/pci-meson.c
> @@ -400,7 +400,7 @@ static int meson_pcie_probe(struct platform_device *pdev)
> return PTR_ERR(mp->phy);
> }
>
> - mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
> + mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
> if (IS_ERR(mp->reset_gpio)) {
> dev_err(dev, "get reset gpio failed\n");
> return PTR_ERR(mp->reset_gpio);
>
> ---
> base-commit: abe651837cb394f76d738a7a747322fca3bf17ba
> change-id: 20260616-fix-meson-pcie-reset-gpio-2b9e188668c5
>
> Best regards,
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Thanks,
Neil
^ permalink raw reply
* [PATCH] PCI: dwc: meson: Fix reset GPIO initial state
From: Ronald Claveau via B4 Relay @ 2026-06-16 7:07 UTC (permalink / raw)
To: Yue Wang, Lorenzo Pieralisi, Krzysztof Wilczyński,
Manivannan Sadhasivam, Rob Herring, Bjorn Helgaas, Neil Armstrong,
Kevin Hilman, Jerome Brunet, Martin Blumenstingl, Remi Pommarel
Cc: linux-pci, linux-amlogic, linux-arm-kernel, linux-kernel,
Ronald Claveau
From: Ronald Claveau <linux-kernel-dev@aliel.fr>
Commit 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio
descriptor") inverted the reset assertion logic to use proper gpio
descriptor semantics, and moved the polarity configuration to the
device tree as GPIO_ACTIVE_LOW. However, the initial GPIO state
"GPIOD_OUT_LOW" was not updated accordingly.
Change GPIOD_OUT_LOW to GPIOD_OUT_HIGH to get the right behaviour.
With GPIOD_OUT_LOW:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: SSS flag set, parallel bus scan disabled
ahci 0000:01:00.0: Controller reset failed (0xffffffff)
ahci 0000:01:00.0: probe with driver ahci failed with error -5
With this fix:
ahci 0000:01:00.0: enabling device (0000 -> 0002)
ahci 0000:01:00.0: AHCI vers 0001.0300, 32 command slots, 6 Gbps,
SATA mode
ahci 0000:01:00.0: 1/1 ports implemented (port mask 0x1)
ahci 0000:01:00.0: flags: 64bit ncq led clo only pio ccc
Fixes: 4d3186a525b3 ("PCI: amlogic: Fix reset assertion via gpio descriptor")
Signed-off-by: Ronald Claveau <linux-kernel-dev@aliel.fr>
---
drivers/pci/controller/dwc/pci-meson.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/controller/dwc/pci-meson.c b/drivers/pci/controller/dwc/pci-meson.c
index 0694084f612b7..15ed59b8764fb 100644
--- a/drivers/pci/controller/dwc/pci-meson.c
+++ b/drivers/pci/controller/dwc/pci-meson.c
@@ -400,7 +400,7 @@ static int meson_pcie_probe(struct platform_device *pdev)
return PTR_ERR(mp->phy);
}
- mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+ mp->reset_gpio = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(mp->reset_gpio)) {
dev_err(dev, "get reset gpio failed\n");
return PTR_ERR(mp->reset_gpio);
---
base-commit: abe651837cb394f76d738a7a747322fca3bf17ba
change-id: 20260616-fix-meson-pcie-reset-gpio-2b9e188668c5
Best regards,
--
Ronald Claveau <linux-kernel-dev@aliel.fr>
^ permalink raw reply related
* Re: [PATCH v5 3/4] PCI: endpoint: Add support for DOE initialization and setup in EPC core
From: Manivannan Sadhasivam @ 2026-06-16 6:22 UTC (permalink / raw)
To: Aksh Garg
Cc: Bjorn Helgaas, linux-pci, linux-doc, kwilczynski, bhelgaas,
corbet, kishon, skhan, lukas, cassel, alistair, linux-arm-kernel,
linux-kernel, s-vadapalli, danishanwar, srk
In-Reply-To: <0216a528-3737-4714-b9d1-5d28008e0ec8@ti.com>
On Fri, Jun 12, 2026 at 01:54:13PM +0530, Aksh Garg wrote:
>
>
> On 12/06/26 00:42, Bjorn Helgaas wrote:
> > On Wed, Jun 10, 2026 at 03:32:55PM +0530, Aksh Garg wrote:
> > > Add pci_epc_init_capabilities() in EPC core driver to initialize and
> > > setup the capabilities supported by the EPC driver. This calls
> > > pci_epc_doe_setup() to setup the DOE framework for an endpoint controller,
> > > which discovers the DOE capabilities (extended capability ID 0x2E), and
> > > registers each discovered DOE mailbox for all the functions in the
> > > endpoint controller.
> > >
> > > Add pci_epc_deinit_capabilities() in EPC core driver for cleanup of the
> > > resources used by the capabilities of the EPC driver. This calls
> > > pci_ep_doe_destroy() to destroy all DOE mailboxes and free associated
> > > resources.
> > >
> > > Co-developed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
> > > Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
> > > Signed-off-by: Aksh Garg <a-garg7@ti.com>
> > > ---
> > > +/**
> > > + * pci_epc_doe_setup() - Discover and setup DOE mailboxes for all functions
> > > + * @epc: the EPC device on which DOE mailboxes has to be setup
> > > + *
> > > + * Discover DOE (Data Object Exchange) capabilities for all physical functions
> > > + * in the endpoint controller and register DOE mailboxes.
> > > + *
> > > + * Returns: 0 on success, -errno on failure
> > > + */
> > > +static int pci_epc_doe_setup(struct pci_epc *epc)
> > > +{
> > > + u8 func_no, vfunc_no = 0;
> > > + u16 cap_offset;
> > > + int ret;
> > > +
> > > + if (!epc->ops || !epc->ops->find_ext_capability)
> > > + return -EINVAL;
> >
>
> Hi Bjorn,
>
> Thank you for your feedback comments. I will work on them and post v6
> series incorporating the changes.
>
> > I don't see anything that sets pci_epc_ops.find_ext_capability in this
> > series, so this looks currently unused and untestable, so likely not
> > mergeable as-is. What's the plan for users of this?
> >
>
> Currently there is no EPC driver upstream which supports DOE yet. However, I
> am working on a platform which supports DOE (support for
> which would be added soon). Mani pointed out that if EPC driver support
> for the same is guaranteed to be added soon, the APIs can be merged
> first.
>
> For the demonstration purpose, he asked to show how an EPC driver is
> expected to use the API as a snippet in the cover letter itself.
>
I retract my previous comment here. Let's not introduce dead code in the kernel.
We can review the series now, but cannot merge it until the EPC driver gets
submitted.
- Mani
--
மணிவண்ணன் சதாசிவம்
^ permalink raw reply
* Re: [PATCH v2] arm64: tlbflush: Don't broadcast if mm was only active on local cpu
From: Mark Rutland @ 2026-06-16 6:13 UTC (permalink / raw)
To: Will Deacon
Cc: Linu Cherian, Catalin Marinas, Ryan Roberts, Kevin Brodsky,
Anshuman Khandual, Yang Shi, Huang Ying, linux-arm-kernel,
linux-kernel
In-Reply-To: <ajAPxKUTp66IRMMF@willie-the-truck>
On Mon, Jun 15, 2026 at 03:44:20PM +0100, Will Deacon wrote:
> On Mon, Jun 15, 2026 at 01:39:43PM +0100, Mark Rutland wrote:
> > On Sun, Jun 14, 2026 at 12:04:44PM +0100, Will Deacon wrote:
> > > On Sat, May 23, 2026 at 07:17:10PM +0530, Linu Cherian wrote:
> >
> > > > static inline void flush_tlb_mm(struct mm_struct *mm)
> > > > {
> > > > unsigned long asid;
> > > > + bool local;
> > > >
> > > > - dsb(ishst);
> > > > + local = flush_tlb_user_pre(mm, TLBF_NONE);
> > > > asid = __TLBI_VADDR(0, ASID(mm));
> > > > - __tlbi(aside1is, asid);
> > > > - __tlbi_user(aside1is, asid);
> > > > - __tlbi_sync_s1ish(mm);
> > > > + if (local) {
> > > > + __tlbi(aside1, asid);
> > > > + __tlbi_user(aside1, asid);
> > > > + dsb(nsh);
> > > > + } else {
> > > > + __tlbi(aside1is, asid);
> > > > + __tlbi_user(aside1is, asid);
> > > > + __tlbi_sync_s1ish(mm);
> > > > + }
> > > > + flush_tlb_user_post(local);
> > >
> > > I think you've changed this since Ryan's original patch, but why are you
> > > only calling __tlbi_sync_s1ish() for the !local case? Doesn't that break
> > > the erratum workaround when running as a VM if the vCPU is migrated?
> >
> > The errata mitigated by __tlbi_sync_s1ish() only affect broadcast
> > maintenance (the 'ish' in the name was intended to convey that). No
> > workaround is necessary for local TLB maintenance; aside from anything
> > else, when some PE executes the DSB to complete the maintenance, that
> > DSB alone is sufficient to complete memory accesses made by that PE.
> >
> > If it would make things clearer, we could add a __tlbi_sync_s1nsh()
> > helper for the local case, which would boil down to a DSB NSH.
>
> No, I don't think that's what I'm concerned about.
I *think* you're missing the shape of the errata; more on that below.
> > Regardless of the erratum, to correctly handle a vCPU being migrated
> > from pCPU-x to pCPU-y, we rely on:
> >
> > * The host to set HCR_EL2.FB to ensure that TLB maintenance is
> > broadcast to the ISH domain.
> >
> > * The host to set HCR_EL2.BSU to ensure the DSB is upgrade to ISH such
> > that any guest-issued DSB NSH will it can complete any TLB maintenance
> > that was upgraded to ISH.
> >
> > * The host to issue a DSB ISH on pCPU-x before the vCPU can run on
> > pCPU-y, to complete any outstanding maintenance that was issued on
> > pCPU-x. IIUC a DSB ISH on pCPU-y is not architecturally sufficient; it
> > must be executed on the same CPU which issued the TLB maintenance.
> >
> > ... but as above, all of that should be independent of any of the errata
> > that require the workaround.
>
> Yes, I understand all of the above but the case I'm struggling with is
> where a vCPU runs on a system that needs the TLB invalidation to be
> performed twice. For non-broadcast invalidation (from the guest
> perspective), this patch will mean that it only performs the
> invalidation once. So if the vCPU migrates to another physical CPU, can
> that effectively undo the HCR_EL2.FB upgrade unless KVM issues TLB
> invalidation as well as a DSB on migration?
>
> Maybe I'm missing something, as it looks like upstream already elides
> the call to __tlbi_sync_s1ish() for the NOBROADCAST case.
The key thing is that these errata only affect the completion of memory
accesses, and only those accesses made by other (physical) PEs.
A single TLBI will correctly remove the actual TLB entries, and
HCR_EL2.{FB,BSU} will still ensure that TLB entries are removed from the
TLBs of other PEs.
The errata only prevent completion of memory accesses made on other
(physical) PEs, and:
* For accesses made by the vCPU which is issuing the TLBI(s):
- Regardless of the errata, the hypervisor has to ensure that when a
vCPU is migrated from pCPU-x to pCPU-y, any prior CMOs or TLBIs are
completed, which requires the host to execute a DSB ISH on pCPU-x
before the vCPU can be run on pCPU-y.
Maybe we have a latent bug here?
- Within the context of the vCPU thread, a DSB {NSH,ISH,OSH} will
complete all prior accesses made by the vCPU *regardless* of any TLB
invalidation.
* For accesses made by *other* vCPUs, either:
- Software in the VM intended to complete concurrency accesses made by
other vCPUs. In which case, regardless of the errata, using a local
TLBI alone is a software bug since that's not guaranteed to affect
other PEs.
- Software did not intend to complete accesses made by other vCPUs.
In which case, it's fine that they may have uncompleted accesses.
... but maybe I'm still missing your concern?
Mark.
^ permalink raw reply
* Re: [PATCH] mmc: sdhci-of-aspeed: depopulate slots before disabling clock
From: Adrian Hunter @ 2026-06-16 6:13 UTC (permalink / raw)
To: Pengpeng Hou, Andrew Jeffery, Ulf Hansson, Joel Stanley,
linux-mmc, linux-aspeed, openbmc, linux-arm-kernel, linux-kernel,
Ryan Chen
In-Reply-To: <20260616004953.3469-1-pengpeng@iscas.ac.cn>
On 16/06/2026 03:49, Pengpeng Hou wrote:
> aspeed_sdc_probe() creates child slot devices one by one after enabling
> the controller clock. If a later slot creation fails, the already-created
> slot devices remain registered while the parent probe returns an error.
>
> Depopulate any created slot devices on probe failure and during remove,
> before disabling the shared controller clock used by the slots.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/mmc/host/sdhci-of-aspeed.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mmc/host/sdhci-of-aspeed.c b/drivers/mmc/host/sdhci-of-aspeed.c
> index f5d973783cbe..3e941b176687 100644
> --- a/drivers/mmc/host/sdhci-of-aspeed.c
> +++ b/drivers/mmc/host/sdhci-of-aspeed.c
> @@ -560,12 +560,14 @@ static int aspeed_sdc_probe(struct platform_device *pdev)
> cpdev = of_platform_device_create(child, NULL, &pdev->dev);
> if (!cpdev) {
> ret = -ENODEV;
> - goto err_clk;
> + goto err_depopulate;
> }
> }
>
> return 0;
>
> +err_depopulate:
> + of_platform_depopulate(&pdev->dev);
of_platform_depopulate() does not appear to work with
of_platform_device_create() due to the OF_POPULATED_BUS flag
> err_clk:
> clk_disable_unprepare(sdc->clk);
> return ret;
> @@ -575,6 +577,7 @@ static void aspeed_sdc_remove(struct platform_device *pdev)
> {
> struct aspeed_sdc *sdc = dev_get_drvdata(&pdev->dev);
>
> + of_platform_depopulate(&pdev->dev);
> clk_disable_unprepare(sdc->clk);
> }
>
There is another existing issue that Sashiko noticed:
struct platform_driver aspeed_sdc_driver has:
.pm = &sdhci_pltfm_pmops,
where it won't work correctly. It looks like it
should have instead been in:
struct platform_driver aspeed_sdhci_driver
Refer:
https://sashiko.dev/#/patchset/20260616004953.3469-1-pengpeng%40iscas.ac.cn
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox