* Re: [PATCH v4 3/5] arm_mpam: resctrl: Add resctrl_arch_config_cntr() for ABMC use
From: Fenghua Yu @ 2026-07-03 5:23 UTC (permalink / raw)
To: Ben Horgan
Cc: amitsinght, baisheng.gao, baolin.wang, carl, dave.martin, david,
dfustini, gshan, james.morse, jic23, kobak, lcherian,
linux-arm-kernel, linux-kernel, peternewman, punit.agrawal,
quic_jiles, reinette.chatre, rohit.mathew, scott, sdonthineni,
tan.shaopeng, xhao, zengheng4, x86, Jonathan Cameron
In-Reply-To: <20260520212458.1797221-4-ben.horgan@arm.com>
Hi, Ben,
On 5/20/26 14:24, Ben Horgan wrote:
> From: James Morse <james.morse@arm.com>
>
> ABMC, mbm_event mode, has a helper resctrl_arch_config_cntr() for changing
> the mapping between 'cntr_id' and a CLOSID/RMID pair.
>
> Add the helper.
>
> For MPAM this is done by updating the mon->mbwu_idx_to_mon[] array, and as
> usual CDP means it needs doing in three different ways.
>
> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
> Signed-off-by: James Morse <james.morse@arm.com>
> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
Please check following nits.
> ---
> Changes since new rfc:
> Mention mbm_event mode in commit message
>
> Changes since v3:
> Warning bound (Sashiko)
> ---
> drivers/resctrl/mpam_resctrl.c | 44 +++++++++++++++++++++++++++++-----
> 1 file changed, 38 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/resctrl/mpam_resctrl.c b/drivers/resctrl/mpam_resctrl.c
> index a13eb232a19d..1f9a8ae157ca 100644
> --- a/drivers/resctrl/mpam_resctrl.c
> +++ b/drivers/resctrl/mpam_resctrl.c
> @@ -127,12 +127,6 @@ void resctrl_arch_reset_cntr(struct rdt_resource *r, struct rdt_l3_mon_domain *d
> {
> }
>
> -void resctrl_arch_config_cntr(struct rdt_resource *r, struct rdt_l3_mon_domain *d,
> - enum resctrl_event_id evtid, u32 rmid, u32 closid,
> - u32 cntr_id, bool assign)
> -{
> -}
> -
> int resctrl_arch_cntr_read(struct rdt_resource *r, struct rdt_l3_mon_domain *d,
> u32 unused, u32 rmid, int cntr_id,
> enum resctrl_event_id eventid, u64 *val)
> @@ -1076,6 +1070,44 @@ static void mpam_resctrl_pick_counters(void)
> }
> }
>
> +static void __config_cntr(struct mpam_resctrl_mon *mon, u32 cntr_id,
> + enum resctrl_conf_type cdp_type, u32 closid, u32 rmid,
> + bool assign)
> +{
> + u32 mbwu_idx, mon_idx = resctrl_get_config_index(cntr_id, cdp_type);
Nit:
Reuse resctrl_get_config_index() to get cntr_id->mon_idx which
resctrl_get_config_index() handles closid:
/* For use by arch code to remap resctrl's smaller CDP CLOSID range */
static inline u32 resctrl_get_config_index(u32 closid,
enum resctrl_conf_type type)
Logically it's correct. It's just a little confusing when reading it.
Maybe adding a comment to make reading easier?
+ /* Same CDP index remap as closid; maps cntr_id to
assigned_counters[]. */
But it's up to you.
> +
> + WARN_ON_ONCE(mon_idx >= l3_num_allocated_mbwu);> +
> + closid = resctrl_get_config_index(closid, cdp_type);
> + mbwu_idx = resctrl_arch_rmid_idx_encode(closid, rmid);
> +
> + if (assign)
> + mon->mbwu_idx_to_mon[mbwu_idx] = mon->assigned_counters[mon_idx];
> + else
> + mon->mbwu_idx_to_mon[mbwu_idx] = -1;
> +}
> +
> +void resctrl_arch_config_cntr(struct rdt_resource *r, struct rdt_l3_mon_domain *d,
> + enum resctrl_event_id evtid, u32 rmid, u32 closid,
> + u32 cntr_id, bool assign)
> +{
> + struct mpam_resctrl_mon *mon = &mpam_resctrl_counters[evtid];
Add a sanity checking on evtid == QOS_L3_MBM_TOTAL_EVENT_ID here? To
make sure this helper is not for llc occupancy event. And the sanity
checking matches other functions in mpam_resctrl.c.
> +
> + if (!mon->mbwu_idx_to_mon || !mon->assigned_counters) {
> + pr_debug("monitor arrays not allocated\n");
> + return;
> + }
> +
> + if (cdp_enabled) {
> + __config_cntr(mon, cntr_id, CDP_CODE, closid, rmid, assign);
> + __config_cntr(mon, cntr_id, CDP_DATA, closid, rmid, assign);
> + } else {
> + __config_cntr(mon, cntr_id, CDP_NONE, closid, rmid, assign);
> + }
> +
> + resctrl_arch_reset_rmid(r, d, closid, rmid, evtid);
> +}
> +
> static int mpam_resctrl_control_init(struct mpam_resctrl_res *res)
> {
> struct mpam_class *class = res->class;
Thanks.
-Fenghua
^ permalink raw reply
* Re: [PATCH 2/3] arm64: dts: socfpga: agilex5: Add SoCDK TSN Config2 board
From: Nazle Asmade, Muhammad Nazim Amirul @ 2026-07-03 5:28 UTC (permalink / raw)
To: Krzysztof Kozlowski
Cc: dinguyen@kernel.org, maxime.chevallier@bootlin.com,
rmk+kernel@armlinux.org.uk, krzk+dt@kernel.org,
conor+dt@kernel.org, robh@kernel.org, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
andrew+netdev@lunn.ch, devicetree@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <20260702-heretic-fractal-jackdaw-70681b@quoll>
On 2/7/2026 3:17 pm, Krzysztof Kozlowski wrote:
> On Tue, Jun 30, 2026 at 06:31:07AM -0700, muhammad.nazim.amirul.nazle.asmade@altera.com wrote:
>> From: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>>
>> Add device tree for the Intel SoCFPGA Agilex5 SoCDK TSN Config2 board
>> variant. This configuration enables gmac1 as a TSN port alongside
>> the standard gmac2 Ethernet port.
>>
>> The TSN port (gmac1) uses GMII internally in the MAC but connects to an
>> RGMII PHY. The mac-mode property is set to "gmii" to reflect the
>> MAC-side interface, while phy-mode is set to "rgmii" for the PHY-side
>> interface.
>>
>> Signed-off-by: Nazim Amirul <muhammad.nazim.amirul.nazle.asmade@altera.com>
>> ---
>> arch/arm64/boot/dts/intel/Makefile | 3 +-
>> .../intel/socfpga_agilex5_socdk_tsn_cfg2.dts | 133 ++++++++++++++++++
>> 2 files changed, 135 insertions(+), 1 deletion(-)
>> create mode 100644 arch/arm64/boot/dts/intel/socfpga_agilex5_socdk_tsn_cfg2.dts
>>
>> diff --git a/arch/arm64/boot/dts/intel/Makefile b/arch/arm64/boot/dts/intel/Makefile
>> index 270c70fdf084..fc7ba2c6384b 100644
>> --- a/arch/arm64/boot/dts/intel/Makefile
>> +++ b/arch/arm64/boot/dts/intel/Makefile
>> @@ -4,10 +4,11 @@ dtb-$(CONFIG_ARCH_INTEL_SOCFPGA) += socfpga_agilex_n6000.dtb \
>> socfpga_agilex_socdk_emmc.dtb \
>> socfpga_agilex_socdk_nand.dtb \
>> socfpga_agilex3_socdk.dtb \
>> - socfpga_agilex5_socdk.dtb \
>> + socfpga_agilex5_socdk.dtb \
>
> Why are you making this change?
Hi Krzysztof,
Thank you for catching this. I did not intend to make this change — the
indentation on the socfpga_agilex5_socdk.dtb line was accidentally
modified during patch preparation. It should retain its original
indentation. I will fix this in v2.
>
>> socfpga_agilex5_socdk_013b.dtb \
>> socfpga_agilex5_socdk_modular.dtb \
>> socfpga_agilex5_socdk_nand.dtb \
>> + socfpga_agilex5_socdk_tsn_cfg2.dtb \
>> socfpga_agilex72_socdk.dtb \
>> socfpga_agilex7m_socdk.dtb \
>> socfpga_n5x_socdk.dtb
>
> Best regards,
> Krzysztof
>
BR,
Nazim
^ permalink raw reply
* Re: [PATCH v2 2/6] mm/rmap: use huge_ptep_get() in try_to_unmap_one()
From: Dev Jain @ 2026-07-03 5:30 UTC (permalink / raw)
To: David Hildenbrand (Arm), muchun.song, osalvador, akpm, ljs, liam
Cc: riel, vbabka, harry, jannh, lance.yang, kas, linux-mm,
linux-kernel, rcampbell, apopple, ziy, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, j-nomura,
nao.horiguchi, ak, mel, pfalcato, jpoimboe, dave.hansen, tglx,
catalin.marinas, will, linux-arm-kernel, ryan.roberts,
anshuman.khandual, stable
In-Reply-To: <00d6e0fb-dcba-45d5-98c0-f5ed81604ca0@kernel.org>
On 02/07/26 9:02 pm, David Hildenbrand (Arm) wrote:
> On 7/2/26 07:13, Dev Jain wrote:
>> try_to_unmap_one() handles hugetlb folios when memory failure needs
>> to replace a poisoned hugetlb mapping with a hwpoison entry. In that
>> case page_vma_mapped_walk() returns the pte pointer to the hugetlb folio
>> in pvmw.pte, but the code reads it with ptep_get().
>>
>> On arches which provide their own huge_ptep_get() to dereference a huge
>> pte pointer, accessing via ptep_get() would cause pte_pfn(), pte_present()
>> etc to misbehave.
>>
>> It is not clear whether this has a trivially visible effect to userspace.
>>
>> Just use huge_ptep_get() for dereferencing a huge pte pointer.
>>
>> Fixes: c7ab0d2fdc84 ("mm: convert try_to_unmap_one() to use page_vma_mapped_walk()")
>> Cc: stable@vger.kernel.org
>> Reported-by: David Hildenbrand <david@kernel.org>
>> Signed-off-by: Dev Jain <dev.jain@arm.com>
>> ---
>> include/linux/hugetlb.h | 3 +++
>> mm/rmap.c | 16 ++++++++++------
>> 2 files changed, 13 insertions(+), 6 deletions(-)
>>
>> diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
>> index 2abaf99321e90..fdb7bdf7645c5 100644
>> --- a/include/linux/hugetlb.h
>> +++ b/include/linux/hugetlb.h
>> @@ -1261,6 +1261,9 @@ static inline void hugetlb_count_sub(long l, struct mm_struct *mm)
>> {
>> }
>>
>> +pte_t huge_ptep_get(struct mm_struct *mm, unsigned long addr,
>> + pte_t *ptep);
>
> Two tabs, or just in a single line.
>
> If others prefer a stub, I don't care. This here is shortest to let the linker
> bail out.
>
>> +
>> static inline pte_t huge_ptep_clear_flush(struct vm_area_struct *vma,
>> unsigned long addr, pte_t *ptep)
>> {
>> diff --git a/mm/rmap.c b/mm/rmap.c
>> index 1c77d5dc06e9f..aa8a254efaecc 100644
>> --- a/mm/rmap.c
>> +++ b/mm/rmap.c
>> @@ -2095,11 +2095,16 @@ static bool try_to_unmap_one(struct folio *folio, struct vm_area_struct *vma,
>> /* Unexpected PMD-mapped THP? */
>> VM_BUG_ON_FOLIO(!pvmw.pte, folio);
>>
>> - /*
>> - * Handle PFN swap PTEs, such as device-exclusive ones, that
>> - * actually map pages.
>> - */
>
> That comment now actually belongs above the pte_present() check below.
Oops I mindlessly just copied the comment.
I will then rather put it in the else block which gets the pfn from the softleaf,
that is the most appropriate.
>
>
^ permalink raw reply
* Re: [PATCH v2 6/6] mm/mprotect: use huge_ptep_get() for hugetlb
From: Dev Jain @ 2026-07-03 5:30 UTC (permalink / raw)
To: David Hildenbrand (Arm), muchun.song, osalvador, akpm, ljs, liam
Cc: riel, vbabka, harry, jannh, lance.yang, kas, linux-mm,
linux-kernel, rcampbell, apopple, ziy, matthew.brost,
joshua.hahnjy, rakie.kim, byungchul, gourry, ying.huang, j-nomura,
nao.horiguchi, ak, mel, pfalcato, jpoimboe, dave.hansen, tglx,
catalin.marinas, will, linux-arm-kernel, ryan.roberts,
anshuman.khandual
In-Reply-To: <f1bef34f-987a-4a47-99fb-acdeda1c072d@kernel.org>
On 02/07/26 9:17 pm, David Hildenbrand (Arm) wrote:
> On 7/2/26 07:13, Dev Jain wrote:
>> prot_none_hugetlb_entry() is the hugetlb callback for the early
>> mprotect(PROT_NONE) PFN permission walk on x86.
>>
>> The callback passes the decoded PFN to pfn_modify_allowed(). For a
>> hugetlb callback, the pte pointer refers to a hugetlb entry. On
>> architectures where hugetlb entries need huge_ptep_get(), reading that
>> entry with ptep_get() can make the permission check use the wrong PFN.
>>
>> Use huge_ptep_get() before decoding the hugetlb PFN.
>>
>> Currently there is no path which can trigger a bug: huge_ptep_get() is a
>> simple ptep_get() for x86, and the prot_none walk occurs only for x86.
>>
>> So no need to backport - use the correct helper anyways.
>>
>> Fixes: 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged high MMIO PROT_NONE mappings")
>> Signed-off-by: Dev Jain <dev.jain@arm.com>
>> ---
>> mm/mprotect.c | 8 +++++++-
>> 1 file changed, 7 insertions(+), 1 deletion(-)
>>
>> diff --git a/mm/mprotect.c b/mm/mprotect.c
>> index 9cbf932b028cf..23779632d18bf 100644
>> --- a/mm/mprotect.c
>> +++ b/mm/mprotect.c
>> @@ -699,14 +699,20 @@ static int prot_none_pte_entry(pte_t *pte, unsigned long addr,
>> 0 : -EACCES;
>> }
>>
>> +#ifdef CONFIG_HUGETLB_PAGE
>> static int prot_none_hugetlb_entry(pte_t *pte, unsigned long hmask,
>> unsigned long addr, unsigned long next,
>> struct mm_walk *walk)
>> {
>> - return pfn_modify_allowed(pte_pfn(ptep_get(pte)),
>> + pte_t entry = huge_ptep_get(walk->mm, addr, pte);
>
> Nit: can be const :)
>
>> +
>> + return pfn_modify_allowed(pte_pfn(entry),
>> *(pgprot_t *)(walk->private)) ?
>> 0 : -EACCES;
>
> Indentation is odd.
>
> Can we just make this readable?
>
> if (pfn_modify_allowed ...)
> return 0
> return -EACCESS;
>
Sure I'll do this.
>
^ permalink raw reply
* [PATCH v1 01/11] iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initialized
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_vintf_init_lvcmdq() stores the freshly allocated vcmdq pointer to
the vintf->lvcmdqs[] array, before tegra241_vcmdq_alloc_smmu_cmdq() builds
the vcmdq->cmdq. The error ISR dereferences that cmdq, so a latched LVCMDQ
error (e.g. one inherited across a kexec) firing in this window would make
tegra241_vintf0_handle_error() pass the still-zeroed arm_smmu_cmdq down to
__arm_smmu_cmdq_skip_err(), dereferencing NULL queue register pointers.
Drop the store from tegra241_vintf_init_lvcmdq() and publish the vcmdq at
the end of the allocation instead, with an smp_store_release() that pairs
with an smp_load_acquire() in the ISR, which can see a fully built LVCMDQ
or NULL.
The user-owned LVCMDQ allocation moves accordingly, publishing the vcmdq
once tegra241_vcmdq_hw_init_user() succeeds, using a plain store since a
user VINTF's lvcmdqs[] has no lockless reader -- the error ISR only walks
the VINTF0 array.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-fable-5
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 25 +++++++++++++------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 67be62a6e7640..f843d607c8134 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -318,12 +318,19 @@ static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf)
while (map) {
unsigned long lidx = __ffs64(map);
- struct tegra241_vcmdq *vcmdq = vintf->lvcmdqs[lidx];
- u32 gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR));
+ struct tegra241_vcmdq *vcmdq;
+ u32 gerror;
+ map &= ~BIT_ULL(lidx);
+
+ /* Pairs with smp_store_release() publishing it */
+ vcmdq = smp_load_acquire(&vintf->lvcmdqs[lidx]);
+ if (!vcmdq)
+ continue;
+
+ gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR));
__arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq);
writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN));
- map &= ~BIT_ULL(lidx);
}
}
}
@@ -666,7 +673,6 @@ static int tegra241_vintf_init_lvcmdq(struct tegra241_vintf *vintf, u16 lidx,
vcmdq->page0 = cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE0(idx, lidx);
vcmdq->page1 = cmdqv->base + TEGRA241_VINTFi_LVCMDQ_PAGE1(idx, lidx);
- vintf->lvcmdqs[lidx] = vcmdq;
return 0;
}
@@ -705,14 +711,15 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vintf, u16 lidx)
/* Build an arm_smmu_cmdq for each LVCMDQ */
ret = tegra241_vcmdq_alloc_smmu_cmdq(vcmdq);
if (ret)
- goto deinit_lvcmdq;
+ goto free_vcmdq;
+
+ /* Pairs with the smp_load_acquire() in the error ISR */
+ smp_store_release(&vintf->lvcmdqs[lidx], vcmdq);
dev_dbg(cmdqv->dev,
"%sallocated\n", lvcmdq_error_header(vcmdq, header, 64));
return vcmdq;
-deinit_lvcmdq:
- tegra241_vintf_deinit_lvcmdq(vintf, lidx);
free_vcmdq:
kfree(vcmdq);
return ERR_PTR(ret);
@@ -1130,13 +1137,15 @@ static int tegra241_vintf_alloc_lvcmdq_user(struct iommufd_hw_queue *hw_queue,
if (ret)
goto unmap_lvcmdq;
+ /* No lockless reader of a user VINTF's lvcmdqs[]; mutex-serialized */
+ vintf->lvcmdqs[lidx] = vcmdq;
+
hw_queue->destroy = &tegra241_vintf_destroy_lvcmdq_user;
mutex_unlock(&vintf->lvcmdq_mutex);
return 0;
unmap_lvcmdq:
tegra241_vcmdq_unmap_lvcmdq(vcmdq);
- tegra241_vintf_deinit_lvcmdq(vintf, lidx);
undepend_vcmdq:
if (vcmdq->prev)
iommufd_hw_queue_undepend(vcmdq, vcmdq->prev, core);
--
2.43.0
^ permalink raw reply related
* [PATCH v1 02/11] iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
A user VINTF is torn down by tegra241_cmdqv_deinit_vintf(), which runs from
the destroy callback and from the init-failure unwind in the alloc handler.
It clears the cmdqv->vintfs[] slot and lets the iommufd core free it, but
nothing serializes that against the error interrupt: tegra241_cmdqv_isr()
reads cmdqv->vintfs[idx] and dereferences the vintf. A concurrent error can
make the ISR read a slot mid-clear (a NULL deref) or use a vintf which is
about to be freed (a use-after-free).
deinit_vintf() also returns idx to the IDA before clearing the slot, so a
concurrent create that reuses idx can publish its new vintf into the slot,
only for this teardown to erase it again with the stale NULL store.
On the other end, tegra241_cmdqv_init_vintf() publishes a new vintf with a
plain store to the cmdqv->vintfs[] slot, and the ISR dereferences fields of
a published vintf such as vintf->base. A plain store gives no ordering on a
weakly-ordered CPU, and a stale VINTF_ERR_MAP bit on a reused idx can make
the ISR pick a vintf the moment it is published, before its fields are set
or tegra241_vintf_hw_init() runs.
The cmdqv->vintfs[0] slot stays NULL until tegra241_cmdqv_init_structures()
first creates VINTF0, so the slot 0 read needs the same NULL check.
Publish every slot with an smp_store_release(), and read each slot in the
ISR with an smp_load_acquire() under a NULL check, so the ISR always sees
a fully built vintf or NULL. Also make deinit_vintf() clear the slot, and
synchronize_irq() prior to returning idx to the IDA, so no vintf is freed
under a running handler and no reused idx is clobbered.
Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 37 +++++++++++++++++--
1 file changed, 33 insertions(+), 4 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index f843d607c8134..5fbc1c85874a5 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -335,6 +335,13 @@ static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf)
}
}
+/*
+ * The CMDQV error interrupt is edge-triggered, so a pending VINTF error fires
+ * this ISR once and does not re-assert. An unacked guest therefore cannot
+ * storm the host. The HW latches and forwards each new error event on its
+ * own, so an already-set ERR_MAP bit does not suppress the interrupt for a
+ * new error.
+ */
static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid)
{
struct tegra241_cmdqv *cmdqv = (struct tegra241_cmdqv *)devid;
@@ -357,16 +364,27 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid)
/* Handle VINTF0 and its LVCMDQs */
if (vintf_map & BIT_ULL(0)) {
- tegra241_vintf0_handle_error(cmdqv->vintfs[0]);
+ struct tegra241_vintf *vintf0;
+
vintf_map &= ~BIT_ULL(0);
+
+ /* NULL until tegra241_cmdqv_init_structures() publishes it */
+ vintf0 = smp_load_acquire(&cmdqv->vintfs[0]);
+ if (vintf0)
+ tegra241_vintf0_handle_error(vintf0);
}
/* Handle other user VINTFs and their LVCMDQs */
while (vintf_map) {
unsigned long idx = __ffs64(vintf_map);
+ struct tegra241_vintf *vintf;
- tegra241_vintf_user_handle_error(cmdqv->vintfs[idx]);
vintf_map &= ~BIT_ULL(idx);
+
+ /* The slot may be published or torn down (NULL'd) concurrently */
+ vintf = smp_load_acquire(&cmdqv->vintfs[idx]);
+ if (vintf)
+ tegra241_vintf_user_handle_error(vintf);
}
return IRQ_HANDLED;
@@ -730,8 +748,18 @@ tegra241_vintf_alloc_lvcmdq(struct tegra241_vintf *vintf, u16 lidx)
static void tegra241_cmdqv_deinit_vintf(struct tegra241_cmdqv *cmdqv, u16 idx)
{
kfree(cmdqv->vintfs[idx]->lvcmdqs);
+ /*
+ * Clear the slot and drain any in-flight ISR before returning idx to
+ * the IDA, so a concurrent create that reuses idx cannot have its
+ * freshly published VINTF erased here. A plain WRITE_ONCE() suffices
+ * since clearing the slot publishes no data. This also covers the
+ * init-failure unwind, which reaches deinit_vintf() without the
+ * destroy callback.
+ */
+ WRITE_ONCE(cmdqv->vintfs[idx], NULL);
+ if (cmdqv->irq > 0)
+ synchronize_irq(cmdqv->irq);
ida_free(&cmdqv->vintf_ids, idx);
- cmdqv->vintfs[idx] = NULL;
}
static int tegra241_cmdqv_init_vintf(struct tegra241_cmdqv *cmdqv, u16 max_idx,
@@ -757,7 +785,8 @@ static int tegra241_cmdqv_init_vintf(struct tegra241_cmdqv *cmdqv, u16 max_idx,
return -ENOMEM;
}
- cmdqv->vintfs[idx] = vintf;
+ /* Pairs with the smp_load_acquire() in tegra241_cmdqv_isr() */
+ smp_store_release(&cmdqv->vintfs[idx], vintf);
return ret;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v1 06/11] iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_cmdqv_remove() tears each VINTF down first, then calls free_irq().
Tearing a VINTF down frees vintf0 and clears cmdqv->vintfs[0]. An error in
that window makes tegra241_cmdqv_isr() read the stale slot and hand it to
tegra241_vintf0_handle_error(), which dereferences a NULL or freed pointer.
Free the IRQ before tearing the VINTFs down. free_irq() waits for in-flight
handlers to finish and blocks new ones, so no ISR can observe a VINTF as it
is torn down.
Note: a user-owned VINTF (viommu) could outlive this teardown, which unmaps
cmdqv->base and frees cmdqv->vintfs, so a later viommu close then touches
freed memory. This is neither introduced nor fixed here: a physical IOMMU
is not a pluggable device, so iommufd by design holds no reference on the
one behind a viommu, and this teardown is not expected while that viommu is
still alive.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 262798cd6b8a8..fbf7ecf043a8c 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -829,6 +829,14 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu)
container_of(smmu, struct tegra241_cmdqv, smmu);
u16 idx;
+ /*
+ * Free the IRQ before tearing down the VINTFs. free_irq() waits for any
+ * in-flight tegra241_cmdqv_isr() to finish and blocks new ones, so the
+ * ISR cannot dereference a VINTF that is freed by the loop below.
+ */
+ if (cmdqv->irq > 0)
+ free_irq(cmdqv->irq, cmdqv);
+
/* Remove VINTF resources */
for (idx = 0; idx < cmdqv->num_vintfs; idx++) {
if (cmdqv->vintfs[idx]) {
@@ -841,8 +849,6 @@ static void tegra241_cmdqv_remove(struct arm_smmu_device *smmu)
/* Remove cmdqv resources */
ida_destroy(&cmdqv->vintf_ids);
- if (cmdqv->irq > 0)
- free_irq(cmdqv->irq, cmdqv);
iounmap(cmdqv->base);
kfree(cmdqv->vintfs);
put_device(cmdqv->dev); /* smmu->impl_dev */
--
2.43.0
^ permalink raw reply related
* [PATCH v1 07/11] iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_vintf_init_vsid() programs the guest-provided vSID into SID_MATCH,
whose VIRT_SID field spans bits [20:1] with bit 0 as the match-enable flag.
The HW therefore matches only a 20-bit Stream ID.
The bound check rejects only virt_sid > UINT_MAX, which admits a value far
wider than the field. The write "virt_sid << 1 | 0x1" then drops every bit
above 20: a virt_sid of 0x80000000 lands as SID_MATCH = 0x1, a valid match
on vSID 0, so the entry aliases the wrong Stream ID. Because vdev->virt_id
is guest-controlled, a VMM can trigger it.
Validate virt_sid against the field width with FIELD_MAX(), and program the
register with FIELD_PREP() so the value and the field stay consistent.
Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index fbf7ecf043a8c..812cc500b4a1e 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -56,6 +56,8 @@
#define VINTF_ENABLED BIT(0)
#define TEGRA241_VINTF_SID_MATCH(s) (0x0040 + 0x4*(s))
+#define VINTF_SID_MATCH_VIRT_SID GENMASK(20, 1)
+#define VINTF_SID_MATCH_ENABLE BIT(0)
#define TEGRA241_VINTF_SID_REPLACE(s) (0x0080 + 0x4*(s))
#define TEGRA241_VINTF_LVCMDQ_ERR_MAP_64(m) \
@@ -1244,7 +1246,7 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev)
u64 virt_sid = vdev->virt_id;
int sidx;
- if (virt_sid > UINT_MAX)
+ if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID))
return -EINVAL;
WARN_ON_ONCE(master->num_streams != 1);
@@ -1256,7 +1258,9 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev)
return sidx;
writel(stream->id, REG_VINTF(vintf, SID_REPLACE(sidx)));
- writel(virt_sid << 1 | 0x1, REG_VINTF(vintf, SID_MATCH(sidx)));
+ writel(FIELD_PREP(VINTF_SID_MATCH_VIRT_SID, virt_sid) |
+ VINTF_SID_MATCH_ENABLE,
+ REG_VINTF(vintf, SID_MATCH(sidx)));
dev_dbg(vintf->cmdqv->dev,
"VINTF%u: allocated SID_REPLACE%d for pSID=%x, vSID=%x\n",
vintf->idx, sidx, stream->id, (u32)virt_sid);
--
2.43.0
^ permalink raw reply related
* [PATCH v1 05/11] iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger
tegra241_cmdqv, which frees the original @smmu once it relocates. A failure
after that returned NULL, and the caller then dereferenced the freed @smmu
on its fallback path.
Return an int and take @smmu by reference instead, then update *smmu to the
reallocated pointer after devm_krealloc() succeeds, so the caller and its
fallback path both use the live @smmu rather than the freed original.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 54 +++++++++++--------
1 file changed, 32 insertions(+), 22 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 7e366030d9d70..262798cd6b8a8 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -934,16 +934,22 @@ static int tegra241_cmdqv_init_structures(struct arm_smmu_device *smmu)
static struct dentry *cmdqv_debugfs_dir;
#endif
-static struct arm_smmu_device *
-__tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
- int irq)
+/*
+ * Probe the CMDQV and reallocate @smmu into the larger cmdqv->smmu.
+ *
+ * devm_krealloc() may relocate and free the original @smmu, so update *smmu to
+ * the new pointer once it succeeds. The error paths after it do the same, so a
+ * caller falling back keeps a live @smmu instead of the freed original.
+ */
+static int __tegra241_cmdqv_probe(struct arm_smmu_device **smmu,
+ struct resource *res, int irq)
{
static const struct arm_smmu_impl_ops init_ops = {
.init_structures = tegra241_cmdqv_init_structures,
.device_remove = tegra241_cmdqv_remove,
};
- struct tegra241_cmdqv *cmdqv = NULL;
- struct arm_smmu_device *new_smmu;
+ struct device *dev = (*smmu)->dev;
+ struct tegra241_cmdqv *cmdqv;
void __iomem *base;
u32 regval;
int ret;
@@ -952,25 +958,28 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
base = ioremap(res->start, resource_size(res));
if (!base) {
- dev_err(smmu->dev, "failed to ioremap\n");
- return NULL;
+ dev_err(dev, "failed to ioremap\n");
+ return -ENOMEM;
}
regval = readl(base + TEGRA241_CMDQV_CONFIG);
if (disable_cmdqv) {
- dev_info(smmu->dev, "Detected disable_cmdqv=true\n");
+ dev_info(dev, "Detected disable_cmdqv=true\n");
writel(regval & ~CMDQV_EN, base + TEGRA241_CMDQV_CONFIG);
+ ret = -ENODEV;
goto iounmap;
}
- cmdqv = devm_krealloc(smmu->dev, smmu, sizeof(*cmdqv), GFP_KERNEL);
- if (!cmdqv)
+ cmdqv = devm_krealloc(dev, *smmu, sizeof(*cmdqv), GFP_KERNEL);
+ if (!cmdqv) {
+ ret = -ENOMEM;
goto iounmap;
- new_smmu = &cmdqv->smmu;
+ }
+ *smmu = &cmdqv->smmu;
cmdqv->irq = irq;
cmdqv->base = base;
- cmdqv->dev = smmu->impl_dev;
+ cmdqv->dev = (*smmu)->impl_dev;
cmdqv->base_phys = res->start;
regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM));
@@ -982,8 +991,10 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->vintfs =
kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs);
- if (!cmdqv->vintfs)
+ if (!cmdqv->vintfs) {
+ ret = -ENOMEM;
goto iounmap;
+ }
ida_init(&cmdqv->vintf_ids);
@@ -1012,24 +1023,23 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
#endif
/* Provide init-level ops only, until tegra241_cmdqv_init_structures */
- new_smmu->impl_ops = &init_ops;
+ cmdqv->smmu.impl_ops = &init_ops;
- return new_smmu;
+ return 0;
free_vintfs:
ida_destroy(&cmdqv->vintf_ids);
kfree(cmdqv->vintfs);
iounmap:
iounmap(base);
- return NULL;
+ return ret;
}
struct arm_smmu_device *tegra241_cmdqv_probe(struct arm_smmu_device *smmu)
{
struct platform_device *pdev = to_platform_device(smmu->impl_dev);
- struct arm_smmu_device *new_smmu;
struct resource *res;
- int irq;
+ int irq, ret;
res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
if (!res) {
@@ -1042,15 +1052,15 @@ struct arm_smmu_device *tegra241_cmdqv_probe(struct arm_smmu_device *smmu)
dev_warn(&pdev->dev,
"no interrupt. errors will not be reported\n");
- new_smmu = __tegra241_cmdqv_probe(smmu, res, irq);
- if (new_smmu)
- return new_smmu;
+ ret = __tegra241_cmdqv_probe(&smmu, res, irq);
+ if (!ret)
+ return smmu;
out_fallback:
dev_info(smmu->impl_dev, "Falling back to standard SMMU CMDQ\n");
smmu->options &= ~ARM_SMMU_OPT_TEGRA241_CMDQV;
put_device(smmu->impl_dev);
- return ERR_PTR(-ENODEV);
+ return smmu;
}
/* User space VINTF and VCMDQ Functions */
--
2.43.0
^ permalink raw reply related
* [PATCH v1 00/11] iommu/tegra241-cmdqv: Fix error-interrupt races and VINTF lifecycle bugs
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
These fix a cluster of bugs reported by Sashiko during patch reviews. The
patches are ordered roughly most-critical-first, so some later ones fix
smaller pre-existing issues in the same functions that earlier patches
touch.
Issues fixed:
- the error ISR racing VINTF (de)init and reading a NULL, freed, or not
yet fully initialized slot
- the probe fallback dereferencing an smmu freed by devm_krealloc()
- a guest vSID programmed without validating its width or the device's
Stream ID count
- VINTF0 leaked on an init-failure path
- error-map index/bounds handling and a VCMDQ base above the 48-bit limit
- the error ISR flooding the kernel log under repeated guest errors
False positives raised by Sashiko:
- a viommu outliving an SMMU unbind and touching freed memory on close: a
physical IOMMU is not a pluggable device, so iommufd holds no reference
on the one behind a viommu, and this teardown cannot arise.
- the ISR running after cmdqv is freed on probe failure: free_irq() runs
first from tegra241_cmdqv_remove(), the devm device_remove action,
which devres invokes before the cmdqv allocation is released.
- a guest never acking its VCMDQ error wedging the shared interrupt: the
interrupt is edge-signaled per event, and the host ISR only snapshots
the error map into the guest's bounded vEVENTQ, never depending on a
guest-side GERRORN ack.
- the ISR accessing a de-assigned LVCMDQ page after a VINTF hw_init()
failure: the page remains a mapped MMIO region backed by empty
registers, so reads are benign and writes are dropped.
In parallel to Shameer's Tegra241 CMDQV CMD_SYNC use-after-free fix:
https://lore.kernel.org/all/20260629094106.251694-1-skolothumtho@nvidia.com/
This is on github:
https://github.com/nicolinc/iommufd/commits/fix_cmdqv_sashiko-v1
Nicolin Chen (11):
iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully
initialized
iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init
iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR
iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up
vintfs
iommu/tegra241-cmdqv: Don't fall back to a freed smmu after
devm_krealloc()
iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs
iommu/tegra241-cmdqv: Reject a vSID wider than the SID_MATCH field
iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
iommu/tegra241-cmdqv: Warn on a VCMDQ base above the 48-bit hardware
limit
iommu/tegra241-cmdqv: Rate-limit the error ISR's log message
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 224 ++++++++++++------
1 file changed, 156 insertions(+), 68 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH v1 11/11] iommu/tegra241-cmdqv: Rate-limit the error ISR's log message
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_cmdqv_isr() logs the error-map registers on every error interrupt.
A malfunctioning device, or a guest deliberately faulting its own VCMDQs,
can raise these interrupts rapidly, and the unconditional dev_warn() then
floods the kernel log.
Rate-limit the message with dev_warn_ratelimited(), and pass the error-map
registers straight to it so their four MMIO reads run only when the limiter
prints, instead of building the string on every interrupt.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 41046605de9ca..21a12a20e7436 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -353,21 +353,19 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid)
{
struct tegra241_cmdqv *cmdqv = (struct tegra241_cmdqv *)devid;
void __iomem *reg_vintf_map = REG_CMDQV(cmdqv, VINTF_ERR_MAP);
- char err_str[256];
u64 vintf_map;
/* Use readl_relaxed() as register addresses are not 64-bit aligned */
vintf_map = (u64)readl_relaxed(reg_vintf_map + 0x4) << 32 |
(u64)readl_relaxed(reg_vintf_map);
- snprintf(err_str, sizeof(err_str),
- "vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x", vintf_map,
- readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))),
- readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))),
- readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))),
- readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0))));
-
- dev_warn(cmdqv->dev, "unexpected error reported. %s\n", err_str);
+ dev_warn_ratelimited(
+ cmdqv->dev,
+ "unexpected error reported. vintf_map: %016llx, vcmdq_map %08x:%08x:%08x:%08x\n",
+ vintf_map, readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(3))),
+ readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(2))),
+ readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(1))),
+ readl_relaxed(REG_CMDQV(cmdqv, CMDQ_ERR_MAP(0))));
/* Handle VINTF0 and its LVCMDQs */
if (vintf_map & BIT_ULL(0)) {
--
2.43.0
^ permalink raw reply related
* [PATCH v1 03/11] iommu/tegra241-cmdqv: Harden error-map index handling in the error ISR
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_vintf0_handle_error() reads both 64-bit LVCMDQ error-map registers
but used the register-local __ffs64() bit directly as the vintf->lvcmdqs[]
index. For the second register that selects the wrong queue instead of 64 *
i + bit, clearing the wrong queue's error status.
The index is unbounded too: a bit at or beyond num_lvcmdqs_per_vintf would
walk the read off vintf->lvcmdqs[].
tegra241_cmdqv_isr() has the same flaw one level up: a VINTF_ERR_MAP bit
at or beyond num_vintfs would walk the read off cmdqv->vintfs[].
Use 64 * i + bit for the index and clear the snapshot with the local bit.
In both handlers, WARN_ON_ONCE() and skip an out-of-bounds index. Only a
malfunctioning device sets such a bit, so the _ONCE form keeps a wedged map
from flooding the log.
Note that 64 * i + bit is not reachable with the current configuration as a
VINTF is pre-assigned with 2 lvcmdqs, this is not treated as bug fix but an
defensive hardening.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 5fbc1c85874a5..b89f021ba0b86 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -311,25 +311,30 @@ static void tegra241_vintf_user_handle_error(struct tegra241_vintf *vintf)
static void tegra241_vintf0_handle_error(struct tegra241_vintf *vintf)
{
+ struct tegra241_cmdqv *cmdqv = vintf->cmdqv;
int i;
for (i = 0; i < LVCMDQ_ERR_MAP_NUM_64; i++) {
u64 map = readq_relaxed(REG_VINTF(vintf, LVCMDQ_ERR_MAP_64(i)));
while (map) {
- unsigned long lidx = __ffs64(map);
+ unsigned long map_bit = __ffs64(map);
+ unsigned long lidx = 64 * i + map_bit;
struct tegra241_vcmdq *vcmdq;
u32 gerror;
- map &= ~BIT_ULL(lidx);
+ map &= ~BIT_ULL(map_bit);
+ /* A bit beyond the count means a HW error; skip it */
+ if (WARN_ON_ONCE(lidx >= cmdqv->num_lvcmdqs_per_vintf))
+ continue;
/* Pairs with smp_store_release() publishing it */
vcmdq = smp_load_acquire(&vintf->lvcmdqs[lidx]);
if (!vcmdq)
continue;
gerror = readl_relaxed(REG_VCMDQ_PAGE0(vcmdq, GERROR));
- __arm_smmu_cmdq_skip_err(&vintf->cmdqv->smmu, &vcmdq->cmdq);
+ __arm_smmu_cmdq_skip_err(&cmdqv->smmu, &vcmdq->cmdq);
writel(gerror, REG_VCMDQ_PAGE0(vcmdq, GERRORN));
}
}
@@ -381,6 +386,9 @@ static irqreturn_t tegra241_cmdqv_isr(int irq, void *devid)
vintf_map &= ~BIT_ULL(idx);
+ /* A bit beyond the count means a HW error; skip it */
+ if (WARN_ON_ONCE(idx >= cmdqv->num_vintfs))
+ continue;
/* The slot may be published or torn down (NULL'd) concurrently */
vintf = smp_load_acquire(&cmdqv->vintfs[idx]);
if (vintf)
--
2.43.0
^ permalink raw reply related
* [PATCH v1 08/11] iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_vintf_init_vsid() maps a guest vSID to a single physical Stream ID
taken from master->streams[0], and only warns when the device does not have
exactly one stream. A device with several streams gets only its first one
mapped, so a guest vSID invalidation cannot reach the others' ATC and IOTLB
entries; a device with none makes master->streams a ZERO_SIZE_PTR, read out
of bounds.
Reject the mapping with -EINVAL when master->num_streams is not one, rather
than warning and pressing on.
Fixes: 4dc0d12474f9 ("iommu/tegra241-cmdqv: Add user-space use support")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 812cc500b4a1e..aa0568e328356 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -1249,7 +1249,8 @@ static int tegra241_vintf_init_vsid(struct iommufd_vdevice *vdev)
if (virt_sid > FIELD_MAX(VINTF_SID_MATCH_VIRT_SID))
return -EINVAL;
- WARN_ON_ONCE(master->num_streams != 1);
+ if (master->num_streams != 1)
+ return -EINVAL;
/* Find an empty pair of SID_REPLACE and SID_MATCH */
sidx = ida_alloc_max(&vintf->sids, vintf->cmdqv->num_sids_per_vintf - 1,
--
2.43.0
^ permalink raw reply related
* [PATCH v1 04/11] iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintfs
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
__tegra241_cmdqv_probe() requests the error IRQ before it has allocated the
cmdqv->vintfs array and set cmdqv->num_vintfs. A CMDQV left enabled with a
latched error across a kexec fires the IRQ as soon as it is requested, and
tegra241_cmdqv_isr() then walks the uninitialized cmdqv->vintfs array.
Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so that
a latched interrupt firing early runs the ISR against a valid array of NULL
slots that it safely skips.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
.../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 34 +++++++++++--------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index b89f021ba0b86..7e366030d9d70 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -973,17 +973,6 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->dev = smmu->impl_dev;
cmdqv->base_phys = res->start;
- if (cmdqv->irq > 0) {
- ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr,
- IRQF_ONESHOT, "tegra241-cmdqv",
- cmdqv);
- if (ret) {
- dev_err(cmdqv->dev, "failed to request irq (%d): %d\n",
- cmdqv->irq, ret);
- goto iounmap;
- }
- }
-
regval = readl_relaxed(REG_CMDQV(cmdqv, PARAM));
cmdqv->num_vintfs = 1 << FIELD_GET(CMDQV_NUM_VINTF_LOG2, regval);
cmdqv->num_vcmdqs = 1 << FIELD_GET(CMDQV_NUM_VCMDQ_LOG2, regval);
@@ -994,10 +983,25 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
cmdqv->vintfs =
kzalloc_objs(*cmdqv->vintfs, cmdqv->num_vintfs);
if (!cmdqv->vintfs)
- goto free_irq;
+ goto iounmap;
ida_init(&cmdqv->vintf_ids);
+ /*
+ * Request the IRQ only after cmdqv->vintfs is allocated and zeroed, so
+ * the ISR would not walk an uninitialized array.
+ */
+ if (cmdqv->irq > 0) {
+ ret = request_threaded_irq(irq, NULL, tegra241_cmdqv_isr,
+ IRQF_ONESHOT, "tegra241-cmdqv",
+ cmdqv);
+ if (ret) {
+ dev_err(cmdqv->dev, "failed to request irq (%d): %d\n",
+ cmdqv->irq, ret);
+ goto free_vintfs;
+ }
+ }
+
#ifdef CONFIG_IOMMU_DEBUGFS
if (!cmdqv_debugfs_dir) {
cmdqv_debugfs_dir =
@@ -1012,9 +1016,9 @@ __tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
return new_smmu;
-free_irq:
- if (cmdqv->irq > 0)
- free_irq(cmdqv->irq, cmdqv);
+free_vintfs:
+ ida_destroy(&cmdqv->vintf_ids);
+ kfree(cmdqv->vintfs);
iounmap:
iounmap(base);
return NULL;
--
2.43.0
^ permalink raw reply related
* [PATCH v1 09/11] iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_cmdqv_init_structures() allocates VINTF0 with kzalloc_obj(), inits
it, and preallocates its logical VCMDQs. Two of its error paths leak.
When tegra241_cmdqv_init_vintf() fails it returns before VINTF0 reaches the
cmdqv->vintfs[] array, so the devres unwind on probe failure cannot reach
it; free it directly there.
A later VCMDQ preallocation failure instead leaves VINTF0 published, and so
this time the unwind does reach tegra241_cmdqv_remove_vintf(), which then
frees it from vintf->hyp_own. But tegra241_vintf_hw_init() sets that flag
only afterward, from a HW read-back, so the still-uninited VINTF0 reads as
guest-owned and leaks, with mutex_destroy() and ida_destroy() run on fields
it never set up.
Decide ownership from vintf->idx instead, the index assigned when its id is
allocated: idx 0 is the kernel-owned VINTF0, while idx >= 1 marks a guest
VINTF. So the in-kernel free decision in tegra241_cmdqv_remove_vintf() and
tegra241_vintf_free_lvcmdq() now keys on idx too, and hyp_own stays a pure
HW-readback state.
Fixes: 918eb5c856f6 ("iommu/arm-smmu-v3: Add in-kernel support for NVIDIA Tegra241 (Grace) CMDQV")
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index aa0568e328356..2d832d633d030 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -716,7 +716,7 @@ static void tegra241_vintf_free_lvcmdq(struct tegra241_vintf *vintf, u16 lidx)
dev_dbg(vintf->cmdqv->dev,
"%sdeallocated\n", lvcmdq_error_header(vcmdq, header, 64));
/* Guest-owned VCMDQ is free-ed with hw_queue by iommufd core */
- if (vcmdq->vintf->hyp_own)
+ if (!vcmdq->vintf->idx)
kfree(vcmdq);
}
@@ -816,7 +816,7 @@ static void tegra241_cmdqv_remove_vintf(struct tegra241_cmdqv *cmdqv, u16 idx)
dev_dbg(cmdqv->dev, "VINTF%u: deallocated\n", vintf->idx);
tegra241_cmdqv_deinit_vintf(cmdqv, idx);
- if (!vintf->hyp_own) {
+ if (vintf->idx) {
mutex_destroy(&vintf->lvcmdq_mutex);
ida_destroy(&vintf->sids);
/* Guest-owned VINTF is free-ed with viommu by iommufd core */
@@ -921,6 +921,12 @@ static int tegra241_cmdqv_init_structures(struct arm_smmu_device *smmu)
ret = tegra241_cmdqv_init_vintf(cmdqv, 0, vintf);
if (ret) {
dev_err(cmdqv->dev, "failed to init vintf0: %d\n", ret);
+ /*
+ * tegra241_cmdqv_init_vintf() failed to publish the vintf0 to
+ * cmdqv->vintfs[], so the probe unwind path that goes through
+ * cmdqv->vintfs[] would miss it. Free it here.
+ */
+ kfree(vintf);
return ret;
}
--
2.43.0
^ permalink raw reply related
* [PATCH v1 10/11] iommu/tegra241-cmdqv: Warn on a VCMDQ base above the 48-bit hardware limit
From: Nicolin Chen @ 2026-07-03 5:31 UTC (permalink / raw)
To: Will Deacon
Cc: Robin Murphy, Joerg Roedel (AMD), Jason Gunthorpe, linux-tegra,
linux-arm-kernel, iommu, linux-kernel
In-Reply-To: <cover.1783054570.git.nicolinc@nvidia.com>
tegra241_vcmdq_alloc_smmu_cmdq() allocates the VCMDQ buffer via the common
arm_smmu_init_one_queue(), which uses smmu->dev and its coherent DMA mask
of DMA_BIT_MASK(smmu->oas). The architectural Q_BASE_ADDR_MASK is 52 bits,
but the Tegra241 VCMDQ_BASE holds only 48 (VCMDQ_ADDR), so the masked write
"q_base = base_dma & VCMDQ_ADDR" silently drops bits 48 and up.
A real Tegra241 never reports a 52-bit OAS alongside the 48-bit VCMDQ, so
this cannot happen on correct hardware, but a buggy or hostile hypervisor
could still advertise such an OAS to a guest. The user-VCMDQ path already
rejects a base_addr_pa with bits set outside VCMDQ_ADDR; add the same guard
to the kernel-allocated path, failing the queue init rather than silently
truncating the base. Use dev_warn_once() rather than WARN_ON(): the OAS is
hypervisor-controlled, and a WARN_ON() would let it panic a guest that is
booted with panic_on_warn.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 2d832d633d030..41046605de9ca 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -674,6 +674,19 @@ static int tegra241_vcmdq_alloc_smmu_cmdq(struct tegra241_vcmdq *vcmdq)
if (ret)
return ret;
+ /*
+ * The q->base_dma is bounded by DMA_BIT_MASK of SMMU's IDR5.OAS. On a
+ * real hardware, VCMDQ_ADDR mask and IDR5.OAS are always aligned. But
+ * a buggy VM might set a mismatched IDR5.OAS for SMMU. Spit a warning
+ * instead of a silent truncation.
+ */
+ if (q->base_dma & ~VCMDQ_ADDR) {
+ dev_warn_once(
+ vcmdq->cmdqv->dev,
+ "VCMDQ base %pad exceeds the 48-bit VCMDQ_ADDR limit\n",
+ &q->base_dma);
+ return -EINVAL;
+ }
/* ...override q_base to write VCMDQ_BASE registers */
q->q_base = q->base_dma & VCMDQ_ADDR;
q->q_base |= FIELD_PREP(VCMDQ_LOG2SIZE, q->llq.max_n_shift);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v4 4/5] arm_mpam: resctrl: Add resctrl_arch_cntr_read() & resctrl_arch_reset_cntr()
From: Fenghua Yu @ 2026-07-03 5:35 UTC (permalink / raw)
To: Ben Horgan
Cc: amitsinght, baisheng.gao, baolin.wang, carl, dave.martin, david,
dfustini, gshan, james.morse, jic23, kobak, lcherian,
linux-arm-kernel, linux-kernel, peternewman, punit.agrawal,
quic_jiles, reinette.chatre, rohit.mathew, scott, sdonthineni,
tan.shaopeng, xhao, zengheng4, x86, Jonathan Cameron
In-Reply-To: <20260520212458.1797221-5-ben.horgan@arm.com>
On 5/20/26 14:24, Ben Horgan wrote:
> From: James Morse <james.morse@arm.com>
>
> When used in 'mbm_event' mode, ABMC emulation, resctrl uses arch hooks to
> read and reset the memory bandwidth utilization (MBWU) counters.
>
> Add these.
>
> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
> Signed-off-by: James Morse <james.morse@arm.com>
> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
Thanks.
-Fenghua
^ permalink raw reply
* Re: [PATCH 03/42] drm/mediatek: Export OVL Blend function
From: CK Hu (胡俊光) @ 2026-07-03 5:38 UTC (permalink / raw)
To: AngeloGioacchino Del Regno, chunkuang.hu@kernel.org
Cc: robh@kernel.org, tzimmermann@suse.de, simona@ffwll.ch,
mripard@kernel.org, kernel@collabora.com,
linux-mediatek@lists.infradead.org,
maarten.lankhorst@linux.intel.com,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
conor+dt@kernel.org, devicetree@vger.kernel.org,
krzk+dt@kernel.org, Paul-pl Chen (陳柏霖),
p.zabel@pengutronix.de, Nancy Lin (林欣螢),
airlied@gmail.com, Justin Yeh (葉英茂),
matthias.bgg@gmail.com, linux-arm-kernel@lists.infradead.org,
Jason-JH Lin (林睿祥)
In-Reply-To: <20260701122057.19648-4-angelogioacchino.delregno@collabora.com>
On Wed, 2026-07-01 at 14:20 +0200, AngeloGioacchino Del Regno wrote:
> From: Paul-pl Chen <paul-pl.chen@mediatek.com>
>
> For the new BLENDER component, the OVL ignore pixel alpha logic
> should be exported as a function and reused it.
>
> Signed-off-by: Nancy Lin <nancy.lin@mediatek.com>
> Signed-off-by: Paul-pl Chen <paul-pl.chen@mediatek.com>
> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> ---
> drivers/gpu/drm/mediatek/mtk_disp_ovl.c | 68 +++++++++++++++++--------
> drivers/gpu/drm/mediatek/mtk_disp_ovl.h | 8 +++
> 2 files changed, 56 insertions(+), 20 deletions(-)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
> index 9ded20202191..fa4607304acb 100644
> --- a/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
> +++ b/drivers/gpu/drm/mediatek/mtk_disp_ovl.c
> @@ -215,6 +215,23 @@ void mtk_ovl_disable_vblank(struct device *dev)
> writel_relaxed(0x0, ovl->regs + DISP_REG_OVL_INTEN);
> }
>
> +bool mtk_ovl_is_ignore_pixel_alpha(struct mtk_plane_state *state, unsigned int blend_mode)
> +{
> + if (!state->base.fb)
> + return false;
> +
> + /*
> + * Although the alpha channel can be ignored, CONST_BLD must be enabled
> + * for XRGB format, otherwise OVL will still read the value from memory.
> + * For RGB888 related formats, whether CONST_BLD is enabled or not won't
> + * affect the result. Therefore we use !has_alpha as the condition.
> + */
> + if (blend_mode == DRM_MODE_BLEND_PIXEL_NONE || !state->base.fb->format->has_alpha)
> + return true;
> +
> + return false;
> +}
> +
> u32 mtk_ovl_get_blend_modes(struct device *dev)
> {
> struct mtk_disp_ovl *ovl = dev_get_drvdata(dev);
> @@ -401,6 +418,29 @@ void mtk_ovl_layer_off(struct device *dev, unsigned int idx,
> DISP_REG_OVL_RDMA_CTRL(idx));
> }
>
> +unsigned int mtk_ovl_get_blend_mode(struct mtk_plane_state *state, unsigned int blend_modes)
> +{
> + unsigned int blend_mode = DRM_MODE_BLEND_COVERAGE;
> +
> + /*
> + * For the platforms where OVL_CON_CLRFMT_MAN is defined in the hardware data sheet
> + * and supports premultiplied color formats, such as OVL_CON_CLRFMT_PARGB888
> + * and supports premultiplied color formats, such as OVL_CON_CLRFMT_PARGB8888.
> + *
> + * Check blend_modes in the driver data to see if premultiplied mode is supported.
> + * If not, use coverage mode instead to set it to the supported color formats.
> + *
> + * Current DRM assumption is that alpha is default premultiplied, so the bitmask of
> + * blend_modes must include BIT(DRM_MODE_BLEND_PREMULTI). Otherwise, mtk_plane_init()
> + * will get an error return from drm_plane_create_blend_mode_property() and
> + * state->base.pixel_blend_mode should not be used.
> + */
> + if (blend_modes & BIT(DRM_MODE_BLEND_PREMULTI))
> + blend_mode = state->base.pixel_blend_mode;
> +
> + return blend_mode;
> +}
> +
> unsigned int mtk_ovl_fmt_convert(unsigned int fmt, unsigned int blend_mode,
> bool fmt_rgb565_is_0, bool color_convert,
> u8 clrfmt_shift, u32 clrfmt_man, u32 byte_swap, u32 rgb_swap)
> @@ -529,7 +569,7 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
> unsigned int rotation = pending->rotation;
> unsigned int offset = (pending->y << 16) | pending->x;
> unsigned int src_size = (pending->height << 16) | pending->width;
> - unsigned int blend_mode = state->base.pixel_blend_mode;
> + unsigned int blend_mode = mtk_ovl_get_blend_mode(state, ovl->data->blend_modes);
In [02/42], you add these statement.
+ if (ovl->data->blend_modes & BIT(DRM_MODE_BLEND_PREMULTI))
+ con = mtk_ovl_fmt_convert(fmt, blend_mode,
+ ovl->data->fmt_rgb565_is_0, true, OVL_CON_CLRFMT_SHIFT,
+ OVL_CON_CLRFMT_MAN, OVL_CON_BYTE_SWAP, OVL_CON_RGB_SWAP);
+ else
+ con = mtk_ovl_fmt_convert(fmt, DRM_MODE_BLEND_COVERAGE,
+ ovl->data->fmt_rgb565_is_0, true, OVL_CON_CLRFMT_SHIFT,
+ OVL_CON_CLRFMT_MAN, OVL_CON_BYTE_SWAP, OVL_CON_RGB_SWAP);
And here you change definition of blend_mode, so these statement could be simplified as
+ con = mtk_ovl_fmt_convert(fmt, blend_mode,
+ ovl->data->fmt_rgb565_is_0, true, OVL_CON_CLRFMT_SHIFT,
+ OVL_CON_CLRFMT_MAN, OVL_CON_BYTE_SWAP, OVL_CON_RGB_SWAP);
> unsigned int ignore_pixel_alpha = 0;
> unsigned int con;
>
> @@ -554,17 +594,8 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
> * For blend_modes supported SoCs, always enable alpha blending.
> * For blend_modes unsupported SoCs, enable alpha blending when has_alpha is set.
> */
> - if (blend_mode || state->base.fb->format->has_alpha)
> + if (state->base.pixel_blend_mode || state->base.fb->format->has_alpha)
> con |= OVL_CON_AEN;
> -
> - /*
> - * Although the alpha channel can be ignored, CONST_BLD must be enabled
> - * for XRGB format, otherwise OVL will still read the value from memory.
> - * For RGB888 related formats, whether CONST_BLD is enabled or not won't
> - * affect the result. Therefore we use !has_alpha as the condition.
> - */
> - if (blend_mode == DRM_MODE_BLEND_PIXEL_NONE || !state->base.fb->format->has_alpha)
> - ignore_pixel_alpha = OVL_CONST_BLEND;
> }
>
> /*
> @@ -590,6 +621,9 @@ void mtk_ovl_layer_config(struct device *dev, unsigned int idx,
>
> mtk_ddp_write_relaxed(cmdq_pkt, con, &ovl->cmdq_reg, ovl->regs,
> DISP_REG_OVL_CON(idx));
> +
> + if (mtk_ovl_is_ignore_pixel_alpha(state, blend_mode))
if (mtk_ovl_is_ignore_pixel_alpha(state, state->base.pixel_blend_mode))
Regards,
CK
> + ignore_pixel_alpha = OVL_CONST_BLEND;
> mtk_ddp_write_relaxed(cmdq_pkt, pitch_lsb | ignore_pixel_alpha,
> &ovl->cmdq_reg, ovl->regs, DISP_REG_OVL_PITCH(idx));
> mtk_ddp_write_relaxed(cmdq_pkt, src_size, &ovl->cmdq_reg, ovl->regs,
>
^ permalink raw reply
* Re: [PATCH v4 0/5] arm_mpam: resctrl: Counter Assignment (ABMC)
From: Fenghua Yu @ 2026-07-03 5:38 UTC (permalink / raw)
To: Ben Horgan
Cc: amitsinght, baisheng.gao, baolin.wang, carl, dave.martin, david,
dfustini, gshan, james.morse, jic23, kobak, lcherian,
linux-arm-kernel, linux-kernel, peternewman, punit.agrawal,
quic_jiles, reinette.chatre, rohit.mathew, scott, sdonthineni,
tan.shaopeng, xhao, zengheng4, x86
In-Reply-To: <20260520212458.1797221-1-ben.horgan@arm.com>
On 5/20/26 14:24, Ben Horgan wrote:
> Version 4 of this series addresses a few review comments and some concerns
> of the sashiko bot.
>
> From the cover letter of v3:
>
> Removing the rfc tag as the resctrl precursors [1] have been queued in tip
> x86/cache. Due to that dependency, it would be good for this to also go through
> x86/cache.
>
> This series adds support for memory bandwidth monitoring.
>
> Please review and test.
[SNIP]
Tested-by: Fenghua Yu <fenghuay@nvidia.com>
Thanks.
-Fenghua
^ permalink raw reply
* RE: [PATCH v4 3/7] mtd: spi-nor: sfdp: expose the SFDP as a read-only NVMEM device
From: Takahiro.Kuwano @ 2026-07-03 5:35 UTC (permalink / raw)
To: manikandan.m, pratyush, mwalle, miquel.raynal, richard, vigneshr,
robh, krzk+dt, conor+dt, srini, nicolas.ferre, alexandre.belloni,
claudiu.beznea, linux, richardcochran, linusw, arnd, michael,
linux-mtd, devicetree, linux-kernel, linux-arm-kernel, netdev
In-Reply-To: <20260630092406.150587-4-manikandan.m@microchip.com>
Hi,
> Register the cached SFDP as a read-only NVMEM device rooted at the
> flash's "sfdp" child node, exposing it in on-flash byte order. This lets
> NVMEM cells reference any SFDP data: a fixed-layout for parameters at a
> known offset, or an nvmem-layout parser for vendor data whose location
> must be discovered at runtime. The device is only registered when an
> "sfdp" node is present in the device tree.
>
> Signed-off-by: Manikandan Muralidharan <manikandan.m@microchip.com>
SFDP is exposed in sysfs (e.g., /sys/bus/spi/devices/spi0.0/spi-nor/sfdp).
Why don't you just use this existing entry?
Thanks,
Takahiro
^ permalink raw reply
* Re: [PATCH 2/3] can: rockchip: add RK3588 CAN-FD support
From: Cunhao Lu @ 2026-07-03 5:41 UTC (permalink / raw)
To: Marc Kleine-Budde, heiko
Cc: linux-can, mailhol, kernel, robh, krzk+dt, conor+dt, devicetree,
linux-arm-kernel, linux-rockchip, linux-kernel
In-Reply-To: <20260702-accelerated-shoebill-of-elevation-76f536-mkl@pengutronix.de>
Hi Marc,
> Then CAN-FD is broken. :/
>
> Maybe in a later patch we can hack something, to allow working
> configurations.
I did some more tests and found that the immediate bus-off with BRS is
related to the transmit delay compensation setting.
After setting RKCANFD_REG_TRANSMIT_DELAY_COMPENSATION to 0, i.e.
disabling TDC, CAN-FD with BRS works on RK3588 in my setup. I tested the
same command with 500 kbit/s arbitration bitrate and 1, 3 and 5 Mbit/s
data bitrate.
The 5 Mbit/s data phase test setup was:
CAN clock: 300 MHz
can0 <-> can1 directly connected
no other devices on the bus
bus termination: 60 Ohm
ip link set can0 type can bitrate 500000 sample-point 0.8 dbitrate 5000000 dsample-point 0.8 fd on berr-reporting on
ip link set can1 type can bitrate 500000 sample-point 0.8 dbitrate 5000000 dsample-point 0.8 fd on berr-reporting on
cangen can0 -I 2 -Li -Di -p 10 -f -g 1 -c32 -b
cansequence -rv can1 -f
The test ran for 15 minutes. The receiver reported continuous sequence
wrap-around messages, e.g.:
sequence wrap around (0)
sequence wrap around (1)
...
sequence wrap around (37218)
sequence wrap around (37219)
The interface statistics after the test were:
can0:
re-started bus-errors arbit-lost error-warn error-pass bus-off
0 0 0 0 0 0
RX: bytes packets errors dropped missed mcast
150667356 9528377 0 0 0 0
TX: bytes packets errors dropped carrier collsns
150667356 9528377 0 0 0 0
can1:
re-started bus-errors arbit-lost error-warn error-pass bus-off
0 0 0 0 0 0
RX: bytes packets errors dropped missed mcast
150667356 9528377 0 0 0 0
TX: bytes packets errors dropped carrier collsns
0 0 0 0 0 0
There were no bus errors and no bus-off events in this test.
> Can you update the description of the quirk for the rk3588 and add how
> to reproduce it?
With TDC disabled I cannot reproduce the BRS bus-off problem anymore.
This also looks different from RKCANFD_QUIRK_CANFD_BROKEN, so I do not
think RK3588 should use that quirk.
> Please keep it disabled for now.
Given the new test result, I plan to send v4 with the RK3588 TDC register
set to 0 and CAN-FD enabled for RK3588.
Regards,
Cunhao
^ permalink raw reply
* Re: [PATCH v5 0/4] arm64: cross-CPU NMI via SDEI
From: YinFengwei @ 2026-07-03 6:01 UTC (permalink / raw)
To: Kiryl Shutsemau
Cc: Catalin Marinas, Will Deacon, James Morse, Mark Rutland,
Marc Zyngier, Doug Anderson, Petr Mladek, Thomas Gleixner,
Andrew Morton, Baoquan He, Puranjay Mohan, Usama Arif,
Breno Leitao, Julien Thierry, Lecopzer Chen, Sumit Garg,
kernel-team, kexec, linux-arm-kernel, linux-kernel,
Kiryl Shutsemau (Meta)
In-Reply-To: <cover.1782744912.git.kas@kernel.org>
Hi Kirill,
On Mon, Jun 29, 2026 at 04:07:14PM +0100, Kiryl Shutsemau wrote:
> From: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
>
> A class of debug/observability features needs to interrupt a CPU that has
> its interrupts locally masked: the all-CPU backtrace behind sysrq-l /
> RCU-stall / hung-task / hard-lockup dumps, and crash_smp_send_stop()
> capturing a stuck CPU's state into the vmcore. On arm64 these need a
> mechanism that reaches a CPU spinning with DAIF masked, which a normal IPI
> cannot.
>
V> arm64 has two such mechanisms today:
>
> - GICv3 pseudo-NMI (interrupt priority masking). The cost lands on the
> interrupt mask/unmask hot path: local_irq_enable() becomes an
> ICC_PMR_EL1 write, and exception entry/exit save and restore the PMR,
> paid on every CPU whether or not an NMI is ever delivered.
>
> Measured on Grace (Neoverse V2; ICC_CTLR_EL1.PMHE=0, so the PMR-sync
> DSB is already patched to a NOP), pseudo_nmi=0 vs pseudo_nmi=1:
>
> gettid() loop: 178 -> 253 ns/call (+42%, ~74 ns)
> will-it-scale sched_yield: 0.705x throughput, flat from 1 to 72 cores
> will-it-scale page_fault1: within ~5%
>
> The ~74 ns is a fixed per-syscall entry/exit tax -- it reproduces at
> +73.5 ns on Neoverse N2 -- so the hit tracks syscall/exception density
> and is unacceptable on syscall-bound fleet workloads, which therefore
> run with pseudo-NMI disabled.
>
This patchset works perfectly on our Neoverse N2 ARM64 platform. So
Tested-by: Yin Fengwei <fengwei_yin@linux.alibaba.com>
Regards
Yin, Fengwei
^ permalink raw reply
* Re: [PATCH 04/42] drm/mediatek: Move mtk_ddp_comp_type enumeration to mtk-mmsys.h
From: CK Hu (胡俊光) @ 2026-07-03 6:03 UTC (permalink / raw)
To: AngeloGioacchino Del Regno, chunkuang.hu@kernel.org
Cc: robh@kernel.org, tzimmermann@suse.de, simona@ffwll.ch,
mripard@kernel.org, kernel@collabora.com,
linux-mediatek@lists.infradead.org,
maarten.lankhorst@linux.intel.com,
dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org,
conor+dt@kernel.org, devicetree@vger.kernel.org,
krzk+dt@kernel.org, p.zabel@pengutronix.de, airlied@gmail.com,
Justin Yeh (葉英茂), matthias.bgg@gmail.com,
linux-arm-kernel@lists.infradead.org,
Jason-JH Lin (林睿祥)
In-Reply-To: <20260701122057.19648-5-angelogioacchino.delregno@collabora.com>
On Wed, 2026-07-01 at 14:20 +0200, AngeloGioacchino Del Regno wrote:
> In preparation for a major refactoring of MMSYS, MUTEX and of
> mediatek-drm, move the mtk_ddp_comp_type enumeration to the
> mtk-mmsys.h header, as this will be shared between multiple
> MediaTek multimedia related drivers.
>
> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> ---
> drivers/gpu/drm/mediatek/mtk_ddp_comp.h | 25 ------------------
> include/linux/soc/mediatek/mtk-mmsys.h | 34 +++++++++++++++++++++++++
> 2 files changed, 34 insertions(+), 25 deletions(-)
>
> diff --git a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h
> index 99bf1e1015da..bbc66072fe6b 100644
> --- a/drivers/gpu/drm/mediatek/mtk_ddp_comp.h
> +++ b/drivers/gpu/drm/mediatek/mtk_ddp_comp.h
> @@ -22,31 +22,6 @@ struct mtk_plane_state;
> struct drm_crtc_state;
> struct drm_dsc_config;
>
> -enum mtk_ddp_comp_type {
> - MTK_DISP_AAL,
> - MTK_DISP_BLS,
> - MTK_DISP_CCORR,
> - MTK_DISP_COLOR,
> - MTK_DISP_DITHER,
> - MTK_DISP_DSC,
> - MTK_DISP_GAMMA,
> - MTK_DISP_MERGE,
> - MTK_DISP_MUTEX,
> - MTK_DISP_OD,
> - MTK_DISP_OVL,
> - MTK_DISP_OVL_2L,
> - MTK_DISP_OVL_ADAPTOR,
> - MTK_DISP_POSTMASK,
> - MTK_DISP_PWM,
> - MTK_DISP_RDMA,
> - MTK_DISP_UFOE,
> - MTK_DISP_WDMA,
> - MTK_DPI,
> - MTK_DP_INTF,
> - MTK_DSI,
> - MTK_DDP_COMP_TYPE_MAX,
> -};
> -
> struct mtk_ddp_comp;
> struct cmdq_pkt;
> struct mtk_ddp_comp_funcs {
> diff --git a/include/linux/soc/mediatek/mtk-mmsys.h b/include/linux/soc/mediatek/mtk-mmsys.h
> index 4885b065b849..3ddfdeac658d 100644
> --- a/include/linux/soc/mediatek/mtk-mmsys.h
> +++ b/include/linux/soc/mediatek/mtk-mmsys.h
> @@ -84,6 +84,40 @@ enum mtk_ddp_comp_id {
> DDP_COMPONENT_ID_MAX,
> };
>
> +enum mtk_ddp_comp_type {
> + /* DISP Components */
> + MTK_DISP_AAL,
> + MTK_DISP_BLS,
> + MTK_DISP_CCORR,
> + MTK_DISP_COLOR,
> + MTK_DISP_DITHER,
> + MTK_DISP_DSC,
> + MTK_DISP_ETHDR_MIXER,
Let this patch just 'move'.
Separate new add to another patch.
> + MTK_DISP_GAMMA,
> + MTK_DISP_MERGE,
> + MTK_DISP_MUTEX,
> + MTK_DISP_OD,
> + MTK_DISP_OVL,
> + MTK_DISP_OVL_2L,
> + MTK_DISP_OVL_ADAPTOR,
> + MTK_DISP_PADDING,
Ditto.
> + MTK_DISP_POSTMASK,
> + MTK_DISP_PWM,
> + MTK_DISP_RDMA,
> + MTK_DISP_UFOE,
> + MTK_DISP_WDMA,
> +
> + /* MDP Components */
> + MTK_DISP_MDP_RDMA,
Ditto.
Regards,
CK
> +
> + /* Keep Display outputs at the end for readability */
> + MTK_DPI,
> + MTK_DP_INTF,
> + MTK_DSI,
> +
> + MTK_DDP_COMP_TYPE_MAX
> +};
> +
> void mtk_mmsys_ddp_connect(struct device *dev,
> enum mtk_ddp_comp_id cur,
> enum mtk_ddp_comp_id next);
^ permalink raw reply
* Re: [PATCH v6 01/12] dt-bindings: soc: zte: Add zx297520v3 top clock and reset bindings
From: Krzysztof Kozlowski @ 2026-07-03 6:03 UTC (permalink / raw)
To: Stefan Dösinger
Cc: Michael Turquette, Stephen Boyd, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Philipp Zabel, Brian Masney, linux-clk, devicetree,
linux-kernel, linux-arm-kernel
In-Reply-To: <20260702-zx29clk-v6-1-377b704f80c4@gmail.com>
On Thu, Jul 02, 2026 at 11:27:56PM +0300, Stefan Dösinger wrote:
> +maintainers:
> + - Stefan Dösinger <stefandoesinger@gmail.com>
> +
> +description: |
> + The zx297520v3's top clock and reset controller generates clocks for core
> + devices on the board like the main bus, USB and timers. In addition to clocks
> + it has reset controls for peripherals, a global board reset, watchdog reset
> + controls and a USB status register.
> +
> + The controller has two clock inputs: a 26 MHz and a 32 KHz external
> + oscillator. They need to be provided as input clocks. The controller provides
> + clocks to the downstream Matrix clock controller.
> +
> + All available clocks are defined as preprocessor macros in the
> + 'dt-bindings/clock/zte,zx297520v3-clk.h' header. The resets are defined in the
> + 'dt-bindings/reset/zte,zx297520v3-reset.h' header.
Use full paths (include/...), so these could be validated by tooling.
> +
> +properties:
> + compatible:
> + items:
> + - const: zte,zx297520v3-topcrm
> + - const: syscon
> +
> + reg:
> + maxItems: 1
> +
> + clocks:
> + items:
> + - description: 26 MHz external oscillator
> + - description: 32 KHz external oscillator
> +
> + clock-names:
> + items:
> + - const: osc26m
> + - const: osc32k
> +
> + "#clock-cells":
> + const: 1
> +
> + "#reset-cells":
> + const: 1
> +
> + syscon-reboot:
> + type: object
> + $ref: /schemas/power/reset/syscon-reboot.yaml#
Missing: unevaluatedProperties: false
> + description:
> + Reboot method for the SoC.
> +
> +required:
> + - compatible
> + - reg
> + - clocks
> + - clock-names
> + - '#clock-cells'
Use consistent quotes, either ' or "
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v4 2/5] arm_mpam: resctrl: Pre-allocate assignable monitors
From: Fenghua Yu @ 2026-07-03 5:30 UTC (permalink / raw)
To: Ben Horgan
Cc: amitsinght, baisheng.gao, baolin.wang, carl, dave.martin, david,
dfustini, gshan, james.morse, jic23, kobak, lcherian,
linux-arm-kernel, linux-kernel, peternewman, punit.agrawal,
quic_jiles, reinette.chatre, rohit.mathew, scott, sdonthineni,
tan.shaopeng, xhao, zengheng4, x86
In-Reply-To: <20260520212458.1797221-3-ben.horgan@arm.com>
Hi, Ben,
On 5/20/26 14:24, Ben Horgan wrote:
> MPAM is able to emulate ABMC, i.e. mbm_event mode, by making memory
> bandwidth monitors assignable. Rather than supporting the 'default'
> mbm_assign_mode always use 'mbm_event' mode even if there are sufficient
> memory bandwidth monitors. The per monitor event configuration is only
> provided by resctrl when in 'mbm_event' mode and so only allowing
> 'mbm_event' mode will make it easier to support per-monitor event
> configuration for MPAM. For the moment, the only event supported is
> mbm_total_event with no bandwidth type configuration. The 'mbm_assign_mode'
> file will still show 'default' when there is no support for memory
> bandwidth monitoring.
>
> The monitors need to be allocated from the driver, and mapped to whichever
> control/monitor group resctrl wants to use them with.
>
> Add a second array to hold the monitor values indexed by resctrl's cntr_id.
>
> When CDP is in use, two monitors are needed so the available number of
> counters halves. Platforms with one monitor will have zero monitors when
> CDP is in use.
>
> Co-developed-by: James Morse <james.morse@arm.com>
> Signed-off-by: James Morse <james.morse@arm.com>
> Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Fenghua Yu <fenghuay@nvidia.com>
Please check the following nit.
> ---
> Changes since rfc v1:
> abmc enabled even if enough counters
> Helpers from dropped free running commits
> carry on with zero counters if using cdp
> set config bits
> use kmalloc_objs
> drop tags for rework
> Configure mbm_cntr_configurable, mbm_cntr_assign_fixed
>
> Changes since rfc v2:
> Don't set mon->assigned_counters to an error pointer
> Fix mpam_resctrl_teardown_mon()
> Remove free running check
> Separate cleanup allocations, e.g. __free(), from the rest
> Restrict scope on err in mpam_resctrl_monitor_init()
>
> Changes since v3:
> Correct NULL check in mpam_resctrl_teardown_mon() (Shaopeng)
> variable allocation ordering in mpam_resctrl_pick_domain_id() (Shaopeng)
> Move mon.* assignments from mpam_resctrl_monitor_sync_abmc_vals()
> to mpam_resctrl_monitor_init_abmc() counters (Sashiko)
> use kvmalloc_obj() for allocations that may be big on some
> platforms (Sashiko)
> ---
> drivers/resctrl/mpam_internal.h | 6 +-
> drivers/resctrl/mpam_resctrl.c | 139 +++++++++++++++++++++++++++++++-
> 2 files changed, 141 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/resctrl/mpam_internal.h b/drivers/resctrl/mpam_internal.h
> index 1914aefdcba9..7a166b395b5a 100644
> --- a/drivers/resctrl/mpam_internal.h
> +++ b/drivers/resctrl/mpam_internal.h
> @@ -411,7 +411,11 @@ struct mpam_resctrl_res {
> struct mpam_resctrl_mon {
> struct mpam_class *class;
>
> - /* per-class data that resctrl needs will live here */
> + /* Array of allocated MBWU monitors, indexed by (closid, rmid). */
> + int *mbwu_idx_to_mon;
> +
> + /* Array of assigned MBWU monitors, indexed by idx argument. */
Nit:
"idx argument" is unclear and confusing. The idx is actually cntr_id
coming from resctrl.
Is it better s/index by idx argument/indexed by resctrl's cntr_id/?
You mentioned "indexed by resctrl's cntr_id" in the commit message
already. I think it's clearer than simple "idx argument".
> + int *assigned_counters;
> };
>
[SNIP]
Thanks.
-Fenghua
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox