* [PATCH v13 10/32] KVM: arm64: Rename SVE finalization constants to be more general
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
Due to the overlap between SVE and SME vector length configuration
created by streaming mode SVE we will finalize both at once. Rename the
existing finalization to use _VEC (vector) for the naming to avoid
confusion.
Since this includes the userspace API we create an alias
KVM_ARM_VCPU_VEC for the existing KVM_ARM_VCPU_SVE capability, existing
code which does not enable SME will be unaffected and any SME only code
will not need to use SVE constants.
No functional change.
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Jean-Philippe Brucker <jpb@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/kvm_host.h | 8 +++++---
arch/arm64/include/uapi/asm/kvm.h | 6 ++++++
arch/arm64/kvm/guest.c | 12 ++++++------
arch/arm64/kvm/hyp/nvhe/pkvm.c | 2 +-
arch/arm64/kvm/reset.c | 20 ++++++++++----------
5 files changed, 28 insertions(+), 20 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index bae2c4f92ef5..8b746b1a1e53 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -1037,8 +1037,8 @@ struct kvm_vcpu_arch {
/* KVM_ARM_VCPU_INIT completed */
#define VCPU_INITIALIZED __vcpu_single_flag(cflags, BIT(0))
-/* SVE config completed */
-#define VCPU_SVE_FINALIZED __vcpu_single_flag(cflags, BIT(1))
+/* Vector config completed */
+#define VCPU_VEC_FINALIZED __vcpu_single_flag(cflags, BIT(1))
/* pKVM VCPU setup completed */
#define VCPU_PKVM_FINALIZED __vcpu_single_flag(cflags, BIT(2))
@@ -1133,6 +1133,8 @@ struct kvm_vcpu_arch {
#define vcpu_has_sve(vcpu) kvm_has_sve((vcpu)->kvm)
#endif
+#define vcpu_has_vec(vcpu) vcpu_has_sve(vcpu)
+
#ifdef CONFIG_ARM64_PTR_AUTH
#define vcpu_has_ptrauth(vcpu) \
((cpus_have_final_cap(ARM64_HAS_ADDRESS_AUTH) || \
@@ -1505,7 +1507,7 @@ struct kvm *kvm_arch_alloc_vm(void);
int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature);
bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu);
-#define kvm_arm_vcpu_sve_finalized(vcpu) vcpu_get_flag(vcpu, VCPU_SVE_FINALIZED)
+#define kvm_arm_vcpu_vec_finalized(vcpu) vcpu_get_flag(vcpu, VCPU_VEC_FINALIZED)
#define kvm_has_mte(kvm) \
(system_supports_mte() && \
diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h
index 1c13bfa2d38a..83af99ca4e1b 100644
--- a/arch/arm64/include/uapi/asm/kvm.h
+++ b/arch/arm64/include/uapi/asm/kvm.h
@@ -107,6 +107,12 @@ struct kvm_regs {
#define KVM_ARM_VCPU_HAS_EL2 7 /* Support nested virtualization */
#define KVM_ARM_VCPU_HAS_EL2_E2H0 8 /* Limit NV support to E2H RES0 */
+/*
+ * An alias for _SVE since we finalize VL configuration for both SVE and SME
+ * simultaneously.
+ */
+#define KVM_ARM_VCPU_VEC KVM_ARM_VCPU_SVE
+
struct kvm_vcpu_init {
__u32 target;
__u32 features[7];
diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index b01d6622b872..0b789f73bf7c 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c
@@ -342,7 +342,7 @@ static int set_sve_vls(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
if (!vcpu_has_sve(vcpu))
return -ENOENT;
- if (kvm_arm_vcpu_sve_finalized(vcpu))
+ if (kvm_arm_vcpu_vec_finalized(vcpu))
return -EPERM; /* too late! */
if (WARN_ON(vcpu->arch.sve_state))
@@ -374,7 +374,7 @@ static int set_sve_vls(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
if (max_vq < SVE_VQ_MIN)
return -EINVAL;
- /* vcpu->arch.sve_state will be alloc'd by kvm_vcpu_finalize_sve() */
+ /* vcpu->arch.sve_state will be alloc'd by kvm_vcpu_finalize_vec() */
vcpu->arch.sve_max_vl = sve_vl_from_vq(max_vq);
return 0;
@@ -497,7 +497,7 @@ static int get_sve_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
if (ret)
return ret;
- if (!kvm_arm_vcpu_sve_finalized(vcpu))
+ if (!kvm_arm_vcpu_vec_finalized(vcpu))
return -EPERM;
if (copy_to_user(uptr, (void *)vcpu->arch.sve_state + region.koffset,
@@ -523,7 +523,7 @@ static int set_sve_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg)
if (ret)
return ret;
- if (!kvm_arm_vcpu_sve_finalized(vcpu))
+ if (!kvm_arm_vcpu_vec_finalized(vcpu))
return -EPERM;
if (copy_from_user((void *)vcpu->arch.sve_state + region.koffset, uptr,
@@ -599,7 +599,7 @@ static unsigned long num_sve_regs(const struct kvm_vcpu *vcpu)
return 0;
/* Policed by KVM_GET_REG_LIST: */
- WARN_ON(!kvm_arm_vcpu_sve_finalized(vcpu));
+ WARN_ON(!kvm_arm_vcpu_vec_finalized(vcpu));
return slices * (SVE_NUM_PREGS + SVE_NUM_ZREGS + 1 /* FFR */)
+ 1; /* KVM_REG_ARM64_SVE_VLS */
@@ -617,7 +617,7 @@ static int copy_sve_reg_indices(const struct kvm_vcpu *vcpu,
return 0;
/* Policed by KVM_GET_REG_LIST: */
- WARN_ON(!kvm_arm_vcpu_sve_finalized(vcpu));
+ WARN_ON(!kvm_arm_vcpu_vec_finalized(vcpu));
/*
* Enumerate this first, so that userspace can save/restore in
diff --git a/arch/arm64/kvm/hyp/nvhe/pkvm.c b/arch/arm64/kvm/hyp/nvhe/pkvm.c
index 3b2c4fbc34d8..9d7f632f01f8 100644
--- a/arch/arm64/kvm/hyp/nvhe/pkvm.c
+++ b/arch/arm64/kvm/hyp/nvhe/pkvm.c
@@ -454,7 +454,7 @@ static int pkvm_vcpu_init_sve(struct pkvm_hyp_vcpu *hyp_vcpu, struct kvm_vcpu *h
int ret = 0;
if (!vcpu_has_feature(vcpu, KVM_ARM_VCPU_SVE)) {
- vcpu_clear_flag(vcpu, VCPU_SVE_FINALIZED);
+ vcpu_clear_flag(vcpu, VCPU_VEC_FINALIZED);
return 0;
}
diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c
index b963fd975aac..0fae62a9eaef 100644
--- a/arch/arm64/kvm/reset.c
+++ b/arch/arm64/kvm/reset.c
@@ -92,7 +92,7 @@ static void kvm_vcpu_enable_sve(struct kvm_vcpu *vcpu)
* Finalize vcpu's maximum SVE vector length, allocating
* vcpu->arch.sve_state as necessary.
*/
-static int kvm_vcpu_finalize_sve(struct kvm_vcpu *vcpu)
+static int kvm_vcpu_finalize_vec(struct kvm_vcpu *vcpu)
{
void *buf;
unsigned int vl;
@@ -122,21 +122,21 @@ static int kvm_vcpu_finalize_sve(struct kvm_vcpu *vcpu)
}
vcpu->arch.sve_state = buf;
- vcpu_set_flag(vcpu, VCPU_SVE_FINALIZED);
+ vcpu_set_flag(vcpu, VCPU_VEC_FINALIZED);
return 0;
}
int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature)
{
switch (feature) {
- case KVM_ARM_VCPU_SVE:
- if (!vcpu_has_sve(vcpu))
+ case KVM_ARM_VCPU_VEC:
+ if (!vcpu_has_vec(vcpu))
return -EINVAL;
- if (kvm_arm_vcpu_sve_finalized(vcpu))
+ if (kvm_arm_vcpu_vec_finalized(vcpu))
return -EPERM;
- return kvm_vcpu_finalize_sve(vcpu);
+ return kvm_vcpu_finalize_vec(vcpu);
}
return -EINVAL;
@@ -144,7 +144,7 @@ int kvm_arm_vcpu_finalize(struct kvm_vcpu *vcpu, int feature)
bool kvm_arm_vcpu_is_finalized(struct kvm_vcpu *vcpu)
{
- if (vcpu_has_sve(vcpu) && !kvm_arm_vcpu_sve_finalized(vcpu))
+ if (vcpu_has_vec(vcpu) && !kvm_arm_vcpu_vec_finalized(vcpu))
return false;
return true;
@@ -163,7 +163,7 @@ void kvm_arm_vcpu_destroy(struct kvm_vcpu *vcpu)
kfree(vcpu->arch.ccsidr);
}
-static void kvm_vcpu_reset_sve(struct kvm_vcpu *vcpu)
+static void kvm_vcpu_reset_vec(struct kvm_vcpu *vcpu)
{
if (vcpu_has_sve(vcpu))
memset(vcpu->arch.sve_state, 0, vcpu_sve_state_size(vcpu));
@@ -203,11 +203,11 @@ void kvm_reset_vcpu(struct kvm_vcpu *vcpu)
if (loaded)
kvm_arch_vcpu_put(vcpu);
- if (!kvm_arm_vcpu_sve_finalized(vcpu)) {
+ if (!kvm_arm_vcpu_vec_finalized(vcpu)) {
if (vcpu_has_feature(vcpu, KVM_ARM_VCPU_SVE))
kvm_vcpu_enable_sve(vcpu);
} else {
- kvm_vcpu_reset_sve(vcpu);
+ kvm_vcpu_reset_vec(vcpu);
}
if (vcpu_el1_is_32bit(vcpu))
--
2.47.3
^ permalink raw reply related
* [PATCH v13 12/32] KVM: arm64: Define internal features for SME
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
In order to simplify interdependencies in the rest of the series define
the feature detection for SME and its subfeatures. Due to the need for
vector length configuration we define a flag for SME like for SVE. We
also have two subfeatures which add architectural state, FA64 and SME2,
which are configured via the normal ID register scheme.
Also provide helpers which check if the vCPU is in streaming mode or has
ZA enabled.
Reviewed-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/kvm_host.h | 35 ++++++++++++++++++++++++++++++++++-
arch/arm64/kvm/sys_regs.c | 2 +-
2 files changed, 35 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h
index 8b746b1a1e53..8e185e43fbff 100644
--- a/arch/arm64/include/asm/kvm_host.h
+++ b/arch/arm64/include/asm/kvm_host.h
@@ -367,6 +367,8 @@ struct kvm_arch {
#define KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS 10
/* Unhandled SEAs are taken to userspace */
#define KVM_ARCH_FLAG_EXIT_SEA 11
+ /* SME exposed to guest */
+#define KVM_ARCH_FLAG_GUEST_HAS_SME 12
unsigned long flags;
/* VM-wide vCPU feature set */
@@ -1133,7 +1135,16 @@ struct kvm_vcpu_arch {
#define vcpu_has_sve(vcpu) kvm_has_sve((vcpu)->kvm)
#endif
-#define vcpu_has_vec(vcpu) vcpu_has_sve(vcpu)
+#define kvm_has_sme(kvm) (system_supports_sme() && \
+ test_bit(KVM_ARCH_FLAG_GUEST_HAS_SME, &(kvm)->arch.flags))
+
+#ifdef __KVM_NVHE_HYPERVISOR__
+#define vcpu_has_sme(vcpu) kvm_has_sme(kern_hyp_va((vcpu)->kvm))
+#else
+#define vcpu_has_sme(vcpu) kvm_has_sme((vcpu)->kvm)
+#endif
+
+#define vcpu_has_vec(vcpu) (vcpu_has_sve(vcpu) || vcpu_has_sme(vcpu))
#ifdef CONFIG_ARM64_PTR_AUTH
#define vcpu_has_ptrauth(vcpu) \
@@ -1650,6 +1661,28 @@ void kvm_set_vm_id_reg(struct kvm *kvm, u32 reg, u64 val);
#define kvm_has_sctlr2(k) \
(kvm_has_feat((k), ID_AA64MMFR3_EL1, SCTLRX, IMP))
+#define kvm_has_fa64(k) \
+ (system_supports_fa64() && \
+ kvm_has_feat((k), ID_AA64SMFR0_EL1, FA64, IMP))
+
+#define kvm_has_sme2(k) \
+ (system_supports_sme2() && \
+ kvm_has_feat((k), ID_AA64PFR1_EL1, SME, SME2))
+
+#ifdef __KVM_NVHE_HYPERVISOR__
+#define vcpu_has_sme2(vcpu) kvm_has_sme2(kern_hyp_va((vcpu)->kvm))
+#define vcpu_has_fa64(vcpu) kvm_has_fa64(kern_hyp_va((vcpu)->kvm))
+#else
+#define vcpu_has_sme2(vcpu) kvm_has_sme2((vcpu)->kvm)
+#define vcpu_has_fa64(vcpu) kvm_has_fa64((vcpu)->kvm)
+#endif
+
+#define vcpu_in_streaming_mode(vcpu) \
+ (__vcpu_sys_reg(vcpu, SVCR) & SVCR_SM_MASK)
+
+#define vcpu_za_enabled(vcpu) \
+ (__vcpu_sys_reg(vcpu, SVCR) & SVCR_ZA_MASK)
+
static inline bool kvm_arch_has_irq_bypass(void)
{
return true;
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index b352cd323e30..ba8a3ed8f5ff 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -2028,7 +2028,7 @@ static unsigned int sve_visibility(const struct kvm_vcpu *vcpu,
static unsigned int sme_visibility(const struct kvm_vcpu *vcpu,
const struct sys_reg_desc *rd)
{
- if (kvm_has_feat(vcpu->kvm, ID_AA64PFR1_EL1, SME, IMP))
+ if (vcpu_has_sme(vcpu))
return 0;
return REG_HIDDEN;
--
2.47.3
^ permalink raw reply related
* [PATCH v13 09/32] KVM: arm64: Pull ctxt_has_ helpers to start of sysreg-sr.h
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
Rather than add earlier prototypes of specific ctxt_has_ helpers let's just
pull all their definitions to the top of sysreg-sr.h so they're all
available to all the individual save/restore functions.
Reviewed-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Jean-Philippe Brucker <jpb@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 84 +++++++++++++++---------------
1 file changed, 41 insertions(+), 43 deletions(-)
diff --git a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
index a17cbe7582de..5624fd705ae3 100644
--- a/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
+++ b/arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h
@@ -16,8 +16,6 @@
#include <asm/kvm_hyp.h>
#include <asm/kvm_mmu.h>
-static inline bool ctxt_has_s1poe(struct kvm_cpu_context *ctxt);
-
static inline struct kvm_vcpu *ctxt_to_vcpu(struct kvm_cpu_context *ctxt)
{
struct kvm_vcpu *vcpu = ctxt->__hyp_running_vcpu;
@@ -28,47 +26,6 @@ static inline struct kvm_vcpu *ctxt_to_vcpu(struct kvm_cpu_context *ctxt)
return vcpu;
}
-static inline bool ctxt_is_guest(struct kvm_cpu_context *ctxt)
-{
- return host_data_ptr(host_ctxt) != ctxt;
-}
-
-static inline u64 *ctxt_mdscr_el1(struct kvm_cpu_context *ctxt)
-{
- struct kvm_vcpu *vcpu = ctxt_to_vcpu(ctxt);
-
- if (ctxt_is_guest(ctxt) && kvm_host_owns_debug_regs(vcpu))
- return &vcpu->arch.external_mdscr_el1;
-
- return &ctxt_sys_reg(ctxt, MDSCR_EL1);
-}
-
-static inline u64 ctxt_midr_el1(struct kvm_cpu_context *ctxt)
-{
- struct kvm *kvm = kern_hyp_va(ctxt_to_vcpu(ctxt)->kvm);
-
- if (!(ctxt_is_guest(ctxt) &&
- test_bit(KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS, &kvm->arch.flags)))
- return read_cpuid_id();
-
- return kvm_read_vm_id_reg(kvm, SYS_MIDR_EL1);
-}
-
-static inline void __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
-{
- *ctxt_mdscr_el1(ctxt) = read_sysreg(mdscr_el1);
-
- // POR_EL0 can affect uaccess, so must be saved/restored early.
- if (ctxt_has_s1poe(ctxt))
- ctxt_sys_reg(ctxt, POR_EL0) = read_sysreg_s(SYS_POR_EL0);
-}
-
-static inline void __sysreg_save_user_state(struct kvm_cpu_context *ctxt)
-{
- ctxt_sys_reg(ctxt, TPIDR_EL0) = read_sysreg(tpidr_el0);
- ctxt_sys_reg(ctxt, TPIDRRO_EL0) = read_sysreg(tpidrro_el0);
-}
-
static inline bool ctxt_has_mte(struct kvm_cpu_context *ctxt)
{
struct kvm_vcpu *vcpu = ctxt_to_vcpu(ctxt);
@@ -131,6 +88,47 @@ static inline bool ctxt_has_sctlr2(struct kvm_cpu_context *ctxt)
return kvm_has_sctlr2(kern_hyp_va(vcpu->kvm));
}
+static inline bool ctxt_is_guest(struct kvm_cpu_context *ctxt)
+{
+ return host_data_ptr(host_ctxt) != ctxt;
+}
+
+static inline u64 *ctxt_mdscr_el1(struct kvm_cpu_context *ctxt)
+{
+ struct kvm_vcpu *vcpu = ctxt_to_vcpu(ctxt);
+
+ if (ctxt_is_guest(ctxt) && kvm_host_owns_debug_regs(vcpu))
+ return &vcpu->arch.external_mdscr_el1;
+
+ return &ctxt_sys_reg(ctxt, MDSCR_EL1);
+}
+
+static inline u64 ctxt_midr_el1(struct kvm_cpu_context *ctxt)
+{
+ struct kvm *kvm = kern_hyp_va(ctxt_to_vcpu(ctxt)->kvm);
+
+ if (!(ctxt_is_guest(ctxt) &&
+ test_bit(KVM_ARCH_FLAG_WRITABLE_IMP_ID_REGS, &kvm->arch.flags)))
+ return read_cpuid_id();
+
+ return kvm_read_vm_id_reg(kvm, SYS_MIDR_EL1);
+}
+
+static inline void __sysreg_save_common_state(struct kvm_cpu_context *ctxt)
+{
+ *ctxt_mdscr_el1(ctxt) = read_sysreg(mdscr_el1);
+
+ // POR_EL0 can affect uaccess, so must be saved/restored early.
+ if (ctxt_has_s1poe(ctxt))
+ ctxt_sys_reg(ctxt, POR_EL0) = read_sysreg_s(SYS_POR_EL0);
+}
+
+static inline void __sysreg_save_user_state(struct kvm_cpu_context *ctxt)
+{
+ ctxt_sys_reg(ctxt, TPIDR_EL0) = read_sysreg(tpidr_el0);
+ ctxt_sys_reg(ctxt, TPIDRRO_EL0) = read_sysreg(tpidrro_el0);
+}
+
static inline void __sysreg_save_el1_state(struct kvm_cpu_context *ctxt)
{
ctxt_sys_reg(ctxt, SCTLR_EL1) = read_sysreg_el1(SYS_SCTLR);
--
2.47.3
^ permalink raw reply related
* [PATCH v13 08/32] KVM: arm64: Handle FEAT_IDST for guest accesses to hidden registers
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
In preparation for adding support for SMIDR_EL1 which is only available in
systems with SME factor out the FEAT_IDST injection from emulate-nested.c
into a helper and use it when handling hidden ID registers, ensuring that
we provide FEAT_IDST behaviour for them.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/kvm_emulate.h | 1 +
arch/arm64/kvm/emulate-nested.c | 6 +-----
arch/arm64/kvm/inject_fault.c | 15 +++++++++++++++
arch/arm64/kvm/sys_regs.c | 6 +++++-
4 files changed, 22 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index 5bf3d7e1d92c..994afbf479fc 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -45,6 +45,7 @@ bool kvm_condition_valid32(const struct kvm_vcpu *vcpu);
void kvm_skip_instr32(struct kvm_vcpu *vcpu);
void kvm_inject_undefined(struct kvm_vcpu *vcpu);
+void kvm_inject_undefined_idreg(struct kvm_vcpu *vcpu);
void kvm_inject_sync(struct kvm_vcpu *vcpu, u64 esr);
int kvm_inject_serror_esr(struct kvm_vcpu *vcpu, u64 esr);
int kvm_inject_sea(struct kvm_vcpu *vcpu, bool iabt, u64 addr);
diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
index e688bc5139c1..f49b7b311d09 100644
--- a/arch/arm64/kvm/emulate-nested.c
+++ b/arch/arm64/kvm/emulate-nested.c
@@ -2669,11 +2669,7 @@ bool triage_sysreg_trap(struct kvm_vcpu *vcpu, int *sr_index)
* helper for the purpose of dealing with FEAT_IDST.
*/
if (in_feat_id_space(¶ms)) {
- if (kvm_has_feat(vcpu->kvm, ID_AA64MMFR2_EL1, IDS, IMP))
- kvm_inject_sync(vcpu, kvm_vcpu_get_esr(vcpu));
- else
- kvm_inject_undefined(vcpu);
-
+ kvm_inject_undefined_idreg(vcpu);
return true;
}
diff --git a/arch/arm64/kvm/inject_fault.c b/arch/arm64/kvm/inject_fault.c
index 89982bd3345f..e2f519ca3045 100644
--- a/arch/arm64/kvm/inject_fault.c
+++ b/arch/arm64/kvm/inject_fault.c
@@ -331,6 +331,21 @@ void kvm_inject_undefined(struct kvm_vcpu *vcpu)
inject_undef64(vcpu);
}
+/**
+ * kvm_inject_undefined_idreg - emulate UnimplementedIDRegister() pseudocode
+ * @vcpu: The vCPU in which to inject the exception
+ *
+ * It is assumed that this code is called from the VCPU thread and that the
+ * VCPU therefore is not currently executing guest code.
+ */
+void kvm_inject_undefined_idreg(struct kvm_vcpu *vcpu)
+{
+ if (kvm_has_feat(vcpu->kvm, ID_AA64MMFR2_EL1, IDS, IMP))
+ kvm_inject_sync(vcpu, kvm_vcpu_get_esr(vcpu));
+ else
+ kvm_inject_undefined(vcpu);
+}
+
static bool serror_is_masked(struct kvm_vcpu *vcpu)
{
return (*vcpu_cpsr(vcpu) & PSR_A_BIT) && !effective_sctlr2_nmea(vcpu);
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 5d5c579d4579..b352cd323e30 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -4759,7 +4759,11 @@ static void perform_access(struct kvm_vcpu *vcpu,
/* Check for regs disabled by runtime config */
if (sysreg_hidden(vcpu, r)) {
- kvm_inject_undefined(vcpu);
+ if (in_feat_id_space(params)) {
+ kvm_inject_undefined_idreg(vcpu);
+ } else {
+ kvm_inject_undefined(vcpu);
+ }
return;
}
--
2.47.3
^ permalink raw reply related
* [PATCH v13 07/32] KVM: arm64: Remove bitrotted comment on handle_sve()
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
The comment for handle_sve() says that we only call it if the guest does
not support SVE but it is now also used for nested guests which have
enabled traps at EL2. Just remove the comment.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/kvm/handle_exit.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c
index 54aedf93c78b..f674cd25d894 100644
--- a/arch/arm64/kvm/handle_exit.c
+++ b/arch/arm64/kvm/handle_exit.c
@@ -224,10 +224,6 @@ static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu)
return 1;
}
-/*
- * Guest access to SVE registers should be routed to this handler only
- * when the system doesn't support SVE.
- */
static int handle_sve(struct kvm_vcpu *vcpu)
{
if (guest_hyp_sve_traps_enabled(vcpu))
--
2.47.3
^ permalink raw reply related
* [PATCH v13 06/32] arm64/fpsimd: Determine maximum virtualisable SME vector length
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
As with SVE we can only virtualise SME vector lengths that are supported by
all CPUs in the system, implement similar checks to those for SVE. Since
unlike SVE there are no specific vector lengths that are architecturally
required the handling is subtly different, we report a system where this
happens with a maximum vector length of 0.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/kernel/fpsimd.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 314f5d61be11..7f2c44bd9fd5 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1281,6 +1281,7 @@ void __init sme_setup(void)
* minimum available VL will be used.
*/
set_sme_default_vl(find_supported_vector_length(ARM64_VEC_SME, 32));
+ info->max_virtualisable_vl = vec_virtualisable_vl(info);
pr_info("SME: minimum available vector length %u bytes per vector\n",
info->min_vl);
@@ -1288,6 +1289,10 @@ void __init sme_setup(void)
info->max_vl);
pr_info("SME: default vector length %u bytes per vector\n",
get_sme_default_vl());
+
+ /* KVM decides whether to support mismatched systems. Just warn here: */
+ if (info->max_virtualisable_vl < info->max_vl)
+ pr_warn("SME: unvirtualisable vector lengths present\n");
}
#endif /* CONFIG_ARM64_SME */
--
2.47.3
^ permalink raw reply related
* [PATCH v13 05/32] arm64/sve: Factor virtualizable VL discovery out of SVE specific code
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
In preparation for reuising it for SME pull the code for discovering the
maximum virtualizable vector length out of sve_setup() into a separate
function, updating to return 0 without a WARN_ON() for the case where no
virtualisable VL exists. For SVE this case is architecturally invalid
but for SME it is valid if ill advised.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/kernel/fpsimd.c | 41 ++++++++++++++++++++++++-----------------
1 file changed, 24 insertions(+), 17 deletions(-)
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index b5535f8c9bd9..314f5d61be11 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1118,6 +1118,29 @@ int vec_verify_vq_map(enum vec_type type)
return 0;
}
+static int __init vec_virtualisable_vl(struct vl_info *info)
+{
+ DECLARE_BITMAP(partial_only_map, SVE_VQ_MAX);
+ unsigned long b_min_partial, b_max_virt;
+
+ bitmap_andnot(partial_only_map, info->vq_partial_map, info->vq_map,
+ SVE_VQ_MAX);
+ b_min_partial = find_last_bit(partial_only_map, SVE_VQ_MAX);
+
+ /* All implemented VLs are virtualisable */
+ if (b_min_partial >= SVE_VQ_MAX)
+ return info->max_vl;
+
+ b_max_virt = find_next_bit(info->vq_map, SVE_VQ_MAX, b_min_partial);
+
+ /* No implemented VLs are virtualisable */
+ if (b_max_virt >= SVE_VQ_MAX)
+ return 0;
+
+ /* At least one virtualisable VL exists */
+ return sve_vl_from_vq(__bit_to_vq(b_max_virt));
+}
+
void cpu_enable_sve(const struct arm64_cpu_capabilities *__always_unused p)
{
write_sysreg(read_sysreg(CPACR_EL1) | CPACR_EL1_ZEN_EL1EN, CPACR_EL1);
@@ -1129,8 +1152,6 @@ void cpu_enable_sve(const struct arm64_cpu_capabilities *__always_unused p)
void __init sve_setup(void)
{
struct vl_info *info = &vl_info[ARM64_VEC_SVE];
- DECLARE_BITMAP(tmp_map, SVE_VQ_MAX);
- unsigned long b;
int max_bit;
if (!system_supports_sve())
@@ -1153,21 +1174,7 @@ void __init sve_setup(void)
*/
set_sve_default_vl(find_supported_vector_length(ARM64_VEC_SVE, 64));
- bitmap_andnot(tmp_map, info->vq_partial_map, info->vq_map,
- SVE_VQ_MAX);
-
- b = find_last_bit(tmp_map, SVE_VQ_MAX);
- if (b >= SVE_VQ_MAX)
- /* No non-virtualisable VLs found */
- info->max_virtualisable_vl = SVE_VQ_MAX;
- else if (WARN_ON(b == SVE_VQ_MAX - 1))
- /* No virtualisable VLs? This is architecturally forbidden. */
- info->max_virtualisable_vl = SVE_VQ_MIN;
- else /* b + 1 < SVE_VQ_MAX */
- info->max_virtualisable_vl = sve_vl_from_vq(__bit_to_vq(b + 1));
-
- if (info->max_virtualisable_vl > info->max_vl)
- info->max_virtualisable_vl = info->max_vl;
+ info->max_virtualisable_vl = vec_virtualisable_vl(info);
pr_info("%s: maximum available vector length %u bytes per vector\n",
info->name, info->max_vl);
--
2.47.3
^ permalink raw reply related
* [PATCH v13 04/32] arm64/fpsimd: Decide to save ZT0 and streaming mode FFR at bind time
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
Some parts of the SME state are optional, enabled by additional features
on top of the base FEAT_SME and controlled with enable bits in SMCR_ELx. We
unconditionally enable these for the host but for KVM we will allow the
feature set exposed to guests to be restricted by the VMM. These are the
FFR register (FEAT_SME_FA64) and ZT0 (FEAT_SME2).
We defer saving of guest floating point state for non-protected guests to
the host kernel. We also want to avoid having to reconfigure the guest
floating point state if nothing used the floating point state while running
the host. If the guest was running with the optional features disabled then
traps will be enabled for them so the host kernel will need to skip
accessing that state when saving state for the guest.
Support this by moving the decision about saving this state to the point
where we bind floating point state to the CPU, instead of only storing
the SME VL to use we store the SMCR value. This includes all the enable
controls for the subfeatures along the vector length.
In order to keep the code paths for the vector extensions consistent
also adjust the SVE path to store a ZCR value instead of the VL, since
no fields other than LEN are currently defined for ZCR this is much less
of a meaningful change.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/fpsimd.h | 4 ++--
arch/arm64/kernel/fpsimd.c | 16 ++++++++--------
arch/arm64/kvm/fpsimd.c | 3 ++-
3 files changed, 12 insertions(+), 11 deletions(-)
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index 59f3c4a9e390..395606e01e18 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -166,8 +166,8 @@ struct cpu_fp_state {
struct arm64_sme_state *sme_state;
u64 *svcr;
u64 *fpmr;
- unsigned int sve_vl;
- unsigned int sme_vl;
+ u64 smcr;
+ u64 zcr;
enum fp_type *fp_type;
enum fp_type to_save;
};
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index b868db2982ee..b5535f8c9bd9 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -474,7 +474,7 @@ static void fpsimd_save_user_state(void)
/* set by fpsimd_bind_task_to_cpu() or fpsimd_bind_state_to_cpu() */
bool save_sve_regs = false;
bool save_ffr;
- unsigned int vl;
+ unsigned int vq;
WARN_ON(!system_supports_fpsimd());
WARN_ON(preemptible());
@@ -498,7 +498,7 @@ static void fpsimd_save_user_state(void)
last->to_save == FP_STATE_SVE) {
save_sve_regs = true;
save_ffr = true;
- vl = last->sve_vl;
+ vq = SYS_FIELD_GET(ZCR_ELx, LEN, last->zcr) + 1;
}
if (system_supports_sme()) {
@@ -508,19 +508,19 @@ static void fpsimd_save_user_state(void)
if (*svcr & SVCR_ZA_MASK)
sme_save_state(last->sme_state,
- system_supports_sme2());
+ last->smcr & SMCR_ELx_EZT0);
/* If we are in streaming mode override regular SVE. */
if (*svcr & SVCR_SM_MASK) {
save_sve_regs = true;
- save_ffr = system_supports_fa64();
- vl = last->sme_vl;
+ save_ffr = last->smcr & SMCR_ELx_FA64;
+ vq = SYS_FIELD_GET(SMCR_ELx, LEN, last->smcr) + 1;
}
}
if (IS_ENABLED(CONFIG_ARM64_SVE) && save_sve_regs) {
/* Get the configured VL from RDVL, will account for SM */
- if (WARN_ON(sve_get_vl() != vl)) {
+ if (WARN_ON(sve_get_vl() != sve_vl_from_vq(vq))) {
/*
* Can't save the user regs, so current would
* re-enter user with corrupt state.
@@ -1712,8 +1712,8 @@ static void fpsimd_bind_task_to_cpu(void)
last->st = ¤t->thread.uw.fpsimd_state;
last->sve_state = current->thread.sve_state;
last->sme_state = current->thread.sme_state;
- last->sve_vl = task_get_sve_vl(current);
- last->sme_vl = task_get_sme_vl(current);
+ last->zcr = task_zcr(current);
+ last->smcr = task_smcr(current);
last->svcr = ¤t->thread.svcr;
last->fpmr = ¤t->thread.uw.fpmr;
last->fp_type = ¤t->thread.fp_type;
diff --git a/arch/arm64/kvm/fpsimd.c b/arch/arm64/kvm/fpsimd.c
index 3f6b1e29cd6b..567dd43970c5 100644
--- a/arch/arm64/kvm/fpsimd.c
+++ b/arch/arm64/kvm/fpsimd.c
@@ -89,7 +89,8 @@ void kvm_arch_vcpu_ctxsync_fp(struct kvm_vcpu *vcpu)
*/
fp_state.st = &vcpu->arch.ctxt.fp_regs;
fp_state.sve_state = vcpu->arch.sve_state;
- fp_state.sve_vl = vcpu->arch.sve_max_vl;
+ fp_state.zcr = vcpu_sve_max_vq(vcpu) - 1;
+ fp_state.smcr = 0;
fp_state.sme_state = NULL;
fp_state.svcr = __ctxt_sys_reg(&vcpu->arch.ctxt, SVCR);
fp_state.fpmr = __ctxt_sys_reg(&vcpu->arch.ctxt, FPMR);
--
2.47.3
^ permalink raw reply related
* [PATCH v13 03/32] arm64/fpsimd: Configure all ZCR/SMCR bits when loading task state
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
Currently, when loading a task's SVE and/or SME state, we configure
ZCR_ELx.LEN and/or SMCR_ELx.LEN with read-modify-write sequences,
preserving all other bits of the registers (e.g. SMCR_ELx.{FA64,ZT0}).
This relies on all the other bits already holding the expected value
for the task.
It would be simpler and more robust to configure all the bits without
a read-modify-write sequence:
- Doing so will remove the need to configure these registers during
feature detection and when returning from idle, simplifying the code
and removing some redundant writes to the registers.
- Doing so will permit KVM to clobber other bits of the registers when
no task state is bound. Along with other changes (e.g. when saving
state), this will make it possible for KVM to expose a different
configuration to guests (e.g. disabling ZT0 for vCPUs, even if ZT0
is exposed to userspace).
While SMCR_ELx.LEN and ZCR_ELx.LEN are self synchronizing SMCR_ELx.FA64
and SMCR_ELx.EZT0 are not so we add an isb() if those have changed.
This could be further optimised by considering if the SME configuration
of the loaded state means we will rely on the newly configured values
but for clarity this is not done here, it can be improved in future.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/fpsimd.h | 2 -
arch/arm64/kernel/cpufeature.c | 2 -
arch/arm64/kernel/fpsimd.c | 84 +++++++++++++++++++----------------------
3 files changed, 38 insertions(+), 50 deletions(-)
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index e13a85320ab6..59f3c4a9e390 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -360,8 +360,6 @@ struct arm64_cpu_capabilities;
extern void cpu_enable_fpsimd(const struct arm64_cpu_capabilities *__unused);
extern void cpu_enable_sve(const struct arm64_cpu_capabilities *__unused);
extern void cpu_enable_sme(const struct arm64_cpu_capabilities *__unused);
-extern void cpu_enable_sme2(const struct arm64_cpu_capabilities *__unused);
-extern void cpu_enable_fa64(const struct arm64_cpu_capabilities *__unused);
extern void cpu_enable_fpmr(const struct arm64_cpu_capabilities *__unused);
extern void fpsimd_suspend_exit(void);
diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c
index 9a22df0c5120..0609dce1989e 100644
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -2992,7 +2992,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
.type = ARM64_CPUCAP_SYSTEM_FEATURE,
.capability = ARM64_SME_FA64,
.matches = has_cpuid_feature,
- .cpu_enable = cpu_enable_fa64,
ARM64_CPUID_FIELDS(ID_AA64SMFR0_EL1, FA64, IMP)
},
{
@@ -3000,7 +2999,6 @@ static const struct arm64_cpu_capabilities arm64_features[] = {
.type = ARM64_CPUCAP_SYSTEM_FEATURE,
.capability = ARM64_SME2,
.matches = has_cpuid_feature,
- .cpu_enable = cpu_enable_sme2,
ARM64_CPUID_FIELDS(ID_AA64PFR1_EL1, SME, SME2)
},
#endif /* CONFIG_ARM64_SME */
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index 78c9d8dab545..b868db2982ee 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -277,6 +277,27 @@ void task_set_vl_onexec(struct task_struct *task, enum vec_type type,
task->thread.vl_onexec[type] = vl;
}
+static unsigned long task_zcr(const struct task_struct *task)
+{
+ unsigned long vq = sve_vq_from_vl(task_get_sve_vl(task));
+ unsigned long zcr = vq - 1;
+
+ return zcr;
+}
+
+static unsigned long task_smcr(const struct task_struct *task)
+{
+ unsigned long vq = sve_vq_from_vl(task_get_sme_vl(task));
+ unsigned long smcr = vq - 1;
+
+ if (system_supports_fa64())
+ smcr |= SMCR_ELx_FA64;
+ if (system_supports_sme2())
+ smcr |= SMCR_ELx_EZT0;
+
+ return smcr;
+}
+
/*
* TIF_SME controls whether a task can use SME without trapping while
* in userspace, when TIF_SME is set then we must have storage
@@ -377,10 +398,8 @@ static void task_fpsimd_load(void)
if (!thread_sm_enabled(¤t->thread))
WARN_ON_ONCE(!test_and_set_thread_flag(TIF_SVE));
- if (test_thread_flag(TIF_SVE)) {
- unsigned long vq = sve_vq_from_vl(task_get_sve_vl(current));
- sysreg_clear_set_s(SYS_ZCR_EL1, ZCR_ELx_LEN, vq - 1);
- }
+ if (system_supports_sve())
+ sysreg_cond_update_s(SYS_ZCR_EL1, task_zcr(current));
restore_sve_regs = true;
restore_ffr = true;
@@ -402,12 +421,17 @@ static void task_fpsimd_load(void)
/* Restore SME, override SVE register configuration if needed */
if (system_supports_sme()) {
- unsigned long sme_vl = task_get_sme_vl(current);
-
- /* Ensure VL is set up for restoring data */
if (test_thread_flag(TIF_SME)) {
- unsigned long vq = sve_vq_from_vl(sme_vl);
- sysreg_clear_set_s(SYS_SMCR_EL1, SMCR_ELx_LEN, vq - 1);
+ u64 old_smcr = read_sysreg_s(SYS_SMCR_EL1);
+ u64 new_smcr = task_smcr(current);
+
+ sysreg_cond_update_s(SYS_SMCR_EL1, new_smcr);
+
+ /* FA64 and EZT0 are not self synchronising */
+ old_smcr &= SMCR_ELx_FA64 | SMCR_ELx_EZT0;
+ new_smcr &= SMCR_ELx_FA64 | SMCR_ELx_EZT0;
+ if (old_smcr != new_smcr)
+ isb();
}
write_sysreg_s(current->thread.svcr, SYS_SVCR);
@@ -1217,26 +1241,6 @@ void cpu_enable_sme(const struct arm64_cpu_capabilities *__always_unused p)
isb();
}
-void cpu_enable_sme2(const struct arm64_cpu_capabilities *__always_unused p)
-{
- /* This must be enabled after SME */
- BUILD_BUG_ON(ARM64_SME2 <= ARM64_SME);
-
- /* Allow use of ZT0 */
- write_sysreg_s(read_sysreg_s(SYS_SMCR_EL1) | SMCR_ELx_EZT0_MASK,
- SYS_SMCR_EL1);
-}
-
-void cpu_enable_fa64(const struct arm64_cpu_capabilities *__always_unused p)
-{
- /* This must be enabled after SME */
- BUILD_BUG_ON(ARM64_SME_FA64 <= ARM64_SME);
-
- /* Allow use of FA64 */
- write_sysreg_s(read_sysreg_s(SYS_SMCR_EL1) | SMCR_ELx_FA64_MASK,
- SYS_SMCR_EL1);
-}
-
void __init sme_setup(void)
{
struct vl_info *info = &vl_info[ARM64_VEC_SME];
@@ -1283,20 +1287,10 @@ void __init sme_setup(void)
void fpsimd_suspend_exit(void)
{
- u64 smcr = 0;
-
- if (system_supports_sve())
- write_sysreg_s(0, SYS_ZCR_EL1);
-
- if (system_supports_sme()) {
- if (system_supports_fa64())
- smcr |= SMCR_ELx_FA64;
- if (system_supports_sme2())
- smcr |= SMCR_ELx_EZT0;
+ if (!system_supports_sme())
+ return;
- write_sysreg_s(smcr, SYS_SMCR_EL1);
- write_sysreg_s(0, SYS_SMPRI_EL1);
- }
+ write_sysreg_s(0, SYS_SMPRI_EL1);
}
/*
@@ -1338,8 +1332,7 @@ void do_sve_acc(unsigned long esr, struct pt_regs *regs)
* any effective streaming mode SVE state.
*/
if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {
- unsigned long vq = sve_vq_from_vl(task_get_sve_vl(current));
- sysreg_clear_set_s(SYS_ZCR_EL1, ZCR_ELx_LEN, vq - 1);
+ sysreg_cond_update_s(SYS_ZCR_EL1, task_zcr(current));
sve_flush_live();
fpsimd_bind_task_to_cpu();
} else {
@@ -1474,8 +1467,7 @@ void do_sme_acc(unsigned long esr, struct pt_regs *regs)
WARN_ON(1);
if (!test_thread_flag(TIF_FOREIGN_FPSTATE)) {
- unsigned long vq = sve_vq_from_vl(task_get_sme_vl(current));
- sysreg_clear_set_s(SYS_SMCR_EL1, SMCR_ELx_LEN, vq - 1);
+ sysreg_cond_update_s(SYS_SMCR_EL1, task_smcr(current));
fpsimd_bind_task_to_cpu();
} else {
--
2.47.3
^ permalink raw reply related
* [PATCH v13 02/32] arm64/fpsimd: Ensure all of ZCR_EL1 is initialised from idle
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
At present when exiting from idle we do not fully reinitialise ZCR_EL1,
we update ZCR_EL1.LEN with a read/modify/write cycle when loading task
state but never set any of the other bits to an explicit value. Since
currently they are all architecturally RES0 or RAZ/WI this is not a
practical issue but it may become one if further fields are defined in
the register so we should explicitly configure the whole register.
Rename the existing sme_suspend_exit() (which handles this for SME) to
fpsimd_suspend_exit() and add set ZCR_EL1 to 0 there, if needed LEN will
be updated when loading task state.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/fpsimd.h | 4 ++--
arch/arm64/kernel/fpsimd.c | 24 +++++++++++++-----------
arch/arm64/kernel/suspend.c | 2 +-
3 files changed, 16 insertions(+), 14 deletions(-)
diff --git a/arch/arm64/include/asm/fpsimd.h b/arch/arm64/include/asm/fpsimd.h
index a67d5774e672..e13a85320ab6 100644
--- a/arch/arm64/include/asm/fpsimd.h
+++ b/arch/arm64/include/asm/fpsimd.h
@@ -364,6 +364,8 @@ extern void cpu_enable_sme2(const struct arm64_cpu_capabilities *__unused);
extern void cpu_enable_fa64(const struct arm64_cpu_capabilities *__unused);
extern void cpu_enable_fpmr(const struct arm64_cpu_capabilities *__unused);
+extern void fpsimd_suspend_exit(void);
+
/*
* Helpers to translate bit indices in sve_vq_map to VQ values (and
* vice versa). This allows find_next_bit() to be used to find the
@@ -623,7 +625,6 @@ static inline unsigned int sme_get_vl(void)
extern void sme_alloc(struct task_struct *task, bool flush);
extern int sme_set_current_vl(unsigned long arg);
extern int sme_get_current_vl(void);
-extern void sme_suspend_exit(void);
static inline size_t __sme_state_size(unsigned int sme_vl)
{
@@ -779,7 +780,6 @@ static inline int sme_max_vl(void) { return 0; }
static inline int sme_max_virtualisable_vl(void) { return 0; }
static inline int sme_set_current_vl(unsigned long arg) { return -EINVAL; }
static inline int sme_get_current_vl(void) { return -EINVAL; }
-static inline void sme_suspend_exit(void) { }
static inline size_t __sme_state_size(unsigned int sme_vl)
{
diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c
index e7f1682a3059..78c9d8dab545 100644
--- a/arch/arm64/kernel/fpsimd.c
+++ b/arch/arm64/kernel/fpsimd.c
@@ -1279,24 +1279,26 @@ void __init sme_setup(void)
get_sme_default_vl());
}
-void sme_suspend_exit(void)
+#endif /* CONFIG_ARM64_SME */
+
+void fpsimd_suspend_exit(void)
{
u64 smcr = 0;
- if (!system_supports_sme())
- return;
+ if (system_supports_sve())
+ write_sysreg_s(0, SYS_ZCR_EL1);
- if (system_supports_fa64())
- smcr |= SMCR_ELx_FA64;
- if (system_supports_sme2())
- smcr |= SMCR_ELx_EZT0;
+ if (system_supports_sme()) {
+ if (system_supports_fa64())
+ smcr |= SMCR_ELx_FA64;
+ if (system_supports_sme2())
+ smcr |= SMCR_ELx_EZT0;
- write_sysreg_s(smcr, SYS_SMCR_EL1);
- write_sysreg_s(0, SYS_SMPRI_EL1);
+ write_sysreg_s(smcr, SYS_SMCR_EL1);
+ write_sysreg_s(0, SYS_SMPRI_EL1);
+ }
}
-#endif /* CONFIG_ARM64_SME */
-
/*
* Trapped SVE access
*
diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c
index eaaff94329cd..e02728d14e0d 100644
--- a/arch/arm64/kernel/suspend.c
+++ b/arch/arm64/kernel/suspend.c
@@ -81,7 +81,7 @@ void notrace __cpu_suspend_exit(void)
*/
spectre_v4_enable_mitigation(NULL);
- sme_suspend_exit();
+ fpsimd_suspend_exit();
/* Restore additional feature-specific configuration */
ptrauth_suspend_exit();
--
2.47.3
^ permalink raw reply related
* [PATCH v13 01/32] arm64/sysreg: Define full value read/modify/write helpers
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
In-Reply-To: <20260720-kvm-arm64-sme-v13-0-d9abd3ffa245@kernel.org>
We have read/modify write helpers for updating bitfields in sysregs if they
have changed but we do not have them for updating the whole register.
Define sysreg_cond_update() for that.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
arch/arm64/include/asm/sysreg.h | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm64/include/asm/sysreg.h b/arch/arm64/include/asm/sysreg.h
index 7aa08d59d494..4b96449e0ffa 100644
--- a/arch/arm64/include/asm/sysreg.h
+++ b/arch/arm64/include/asm/sysreg.h
@@ -1235,6 +1235,12 @@
write_sysreg_s(__scs_new, sysreg); \
} while (0)
+#define sysreg_cond_update(sysreg, val) \
+ sysreg_clear_set(sysreg, ~0UL, val)
+
+#define sysreg_cond_update_s(sysreg, val) \
+ sysreg_clear_set_s(sysreg, ~0UL, val)
+
#define write_sysreg_hcr(__val) do { \
if (IS_ENABLED(CONFIG_AMPERE_ERRATUM_AC04_CPU_23) && \
(!system_capabilities_finalized() || \
--
2.47.3
^ permalink raw reply related
* [PATCH v13 00/32] KVM: arm64: Implement support for SME
From: Mark Brown @ 2026-07-19 23:07 UTC (permalink / raw)
To: Marc Zyngier, Joey Gouly, Catalin Marinas, Suzuki K Poulose,
Will Deacon, Paolo Bonzini, Jonathan Corbet, Shuah Khan,
Oliver Upton
Cc: Dave Martin, Fuad Tabba, Mark Rutland, Ben Horgan,
Jean-Philippe Brucker, linux-arm-kernel, kvmarm, linux-kernel,
kvm, linux-doc, linux-kselftest, Peter Maydell, Eric Auger,
Mark Brown
[ Note: I've spoken with both Mark Rutland and James Morse both of whom
might potentially have some overlapping changes, they've both agreed
that they'll deal with any rebasing if it's a question of this getting
in or something else. ]
I've removed the RFC tag from this version of the series, but the items
that I'm looking for feedback on remains the same:
- The userspace ABI, in particular:
- The vector length used for the SVE registers, access to the SVE
registers and access to ZA and (if available) ZT0 depending on
the current state of PSTATE.{SM,ZA}.
- The use of a single finalisation for both SVE and SME.
- There was some review from the qemu people who seemed OK with the
structure, and there's some initial patches from them at:
https://patchew.org/QEMU/20260216034432.23912-1-richard.henderson@linaro.org/
This series implements support for SME use in non-protected KVM guests.
Much of this is very similar to SVE, the main additional challenge that
SME presents is that it introduces a new vector length similar to the
SVE vector length and two new controls which change the registers seen
by guests:
- PSTATE.ZA enables the ZA matrix register and, if SME2 is supported,
the ZT0 LUT register.
- PSTATE.SM enables streaming mode, a new floating point mode which
uses the SVE register set with the separately configured SME vector
length. In streaming mode implementation of the FFR register is
optional.
It is also permitted to build systems which support SME without SVE, in
this case when not in streaming mode no SVE registers or instructions
are available. Further, there is no requirement that there be any
overlap in the set of vector lengths supported by SVE and SME in a
system, this is expected to be a common situation in practical systems.
Since there is a new vector length to configure we introduce a new
feature parallel to the existing SVE one with a new pseudo register for
the streaming mode vector length. Due to the overlap with SVE caused by
streaming mode rather than finalising SME as a separate feature we use
the existing SVE finalisation to also finalise SME, a new define
KVM_ARM_VCPU_VEC is provided to help make user code clearer. Finalising
SVE and SME separately would introduce complication with register access
since finalising SVE makes the SVE registers writeable by userspace and
doing multiple finalisations results in an error being reported.
Dealing with a state where the SVE registers are writeable due to one of
SVE or SME being finalised but may have their VL changed by the other
being finalised seems like needless complexity with minimal practical
utility, it seems clearer to just express directly that only one
finalisation can be done in the ABI.
Access to the floating point registers follows the architecture:
- When both SVE and SME are present:
- If PSTATE.SM == 0 the vector length used for the Z and P registers
is the SVE vector length.
- If PSTATE.SM == 1 the vector length used for the Z and P registers
is the SME vector length.
- If only SME is present:
- If PSTATE.SM == 0 the Z and P registers are inaccessible and the
floating point state accessed via the encodings for the V registers.
- If PSTATE.SM == 1 the vector length used for the Z and P registers
- The SME specific ZA and ZT0 registers are only accessible if SVCR.ZA is 1.
The VMM must understand this, in particular when loading state SVCR
should be configured before other state. It should be noted that while
the architecture refers to PSTATE.SM and PSTATE.ZA these PSTATE bits are
not preserved in SPSR_ELx, they are only accessible via SVCR.
There are a large number of subfeatures for SME, most of which only
offer additional instructions but some of which (SME2 and FA64) add
architectural state. These are configured via the ID registers as per
usual.
Protected KVM is supported, with the implementation maintaining the
existing restriction that the hypervisor will refuse to run if streaming
mode or ZA is enabled. This both simplfies the code and avoids the need
to allocate storage for host ZA and ZT0 state, there seems to be little
practical use case for supporting this and the memory usage would be
non-trivial. SME is not made available to protected guests, only normal
guests.
The new KVM_ARM_VCPU_VEC feature and ZA and ZT0 registers have not been
added to the get-reg-list selftest, the idea of supporting additional
features there without restructuring the program to generate all
possible feature combinations has been rejected. I will post a separate
series which does that restructuring.
There is some room for optimisation here, for example we could do more
work to suppress isb()s on SMCR changes (we don't really try in the
hypervisor), but this is already a very large series.
Signed-off-by: Mark Brown <broonie@kernel.org>
---
Changes in v13:
- Rebase onto v7.2-rc3.
- Remove existing special casing of ZCR_EL2 as an access trap and the
corresponding newly added SMCR_EL2 handling.
- Fix handling of nested EZT0/FA64, factoring out shared initialisation
for both SMCR_EL2 and nested EL2 traps.
- Document why we isb() after updating SMCR, and suppress redundant
isb()s for the host kernel.
- Add missing isb()s in the hypervisor.
- Use generic RES0 handling for SMPRIMAP_EL2.
- Fix comment on SMPRI_EL1.
- Emulate SCMR_EL2.EZT0 traps for nested guests.
- Remove a bitrotted comment on the SVE exit handler.
- Don't restore SMCR_EL1 after running non-SME guests with pKVM.
- Add an explicit reset of ZCR_EL1.
- Add a missing __init annotation to vec_virtualisable_vl().
- Add SMIDR_EL1 to the ABI documentation for KVM_CAP_ARM_WRITABLE_IMP_ID_REGS.
- Block attempts to set ID_AA64PFR1_EL1.SME to 0 when SME is enabled.
- Process vCPU resets before enumerating registers.
- Changelog updates.
- Link to v12: https://patch.msgid.link/20260709-kvm-arm64-sme-v12-0-d0301d79ef58@kernel.org
Changes in v12:
- Resend with commit rather than tag object specified as the base.
- Link to v11: https://patch.msgid.link/20260709-kvm-arm64-sme-v11-0-32799f66db9d@kernel.org
Changes in v11:
- Rebase onto v7.2-rc2.
- Rework VL enumeration.
- Refactor ZCR and SMCR value generation for the host into helper
functions.
- Add handling of FEAT_IDST for hidden system registers.
- Ensure we manage traps correctly for emulated EL2.
- Always allocate space for ZT0 if the hardware supports it.
- Tighten the register enumeration ABI to reflect current VM state.
- Sanitise SMIDR_EL1.
- Fix generation of invalid values in set_id_regs.
- Various smaller fixups, including from Jean-Phillipe's review.
- Link to v10: https://patch.msgid.link/20260306-kvm-arm64-sme-v10-0-43f7683a0fb7@kernel.org
Changes in v10:
- Define and use a SME_VQ_INVALID for the case where there is no
virtuablisable SME VL.
- Fix handling of SMCR_EL2 accesses.
- Correct VNCR constant for SMPRI_EL2.
- Correct trapping for SMPRI_EL1.
- Reject userspace access to FFR when in streaming mode without FA64.
- Constrain the VL set by sme_cond_update_smcr() to fit within LEN.
- Reject userspace access to ZA and ZT0 when SVCR.SM is 0.
- Use -EACCESS for inaccessible SME registers.
- Remove some unused functions.
- Further bugfixes from review.
- Commit log typo fixes.
- Link to v9: https://patch.msgid.link/20251223-kvm-arm64-sme-v9-0-8be3867cb883@kernel.org
Changes in v9:
- Rebase onto v6.19-rc1.
- ABI document clarifications.
- Add changes dropping asserts on single bit wide bitfields in set_id_regs.
- Link to v8: https://lore.kernel.org/r/20250902-kvm-arm64-sme-v8-0-2cb2199c656c@kernel.org
Changes in v8:
- Small fixes in ABI documentation.
- Link to v7: https://lore.kernel.org/r/20250822-kvm-arm64-sme-v7-0-7a65d82b8b10@kernel.org
Changes in v7:
- Rebase onto v6.17-rc1.
- Handle SMIDR_EL1 as a VM wide ID register and use this in feat_sme_smps().
- Expose affinity fields in SMIDR_EL1.
- Remove SMPRI_EL1 from vcpu_sysreg, the value is always 0 currently.
- Prevent userspace writes to SMPRIMAP_EL2.
- Link to v6: https://lore.kernel.org/r/20250625-kvm-arm64-sme-v6-0-114cff4ffe04@kernel.org
Changes in v6:
- Rebase onto v6.16-rc3.
- Link to v5: https://lore.kernel.org/r/20250417-kvm-arm64-sme-v5-0-f469a2d5f574@kernel.org
Changes in v5:
- Rebase onto v6.15-rc2.
- Add pKVM guest support.
- Always restore SVCR.
- Link to v4: https://lore.kernel.org/r/20250214-kvm-arm64-sme-v4-0-d64a681adcc2@kernel.org
Changes in v4:
- Rebase onto v6.14-rc2 and Mark Rutland's fixes.
- Expose SME to nested guests.
- Additional cleanups and test fixes following on from the rebase.
- Flush register state on VMM PSTATE.{SM,ZA}.
- Link to v3: https://lore.kernel.org/r/20241220-kvm-arm64-sme-v3-0-05b018c1ffeb@kernel.org
Changes in v3:
- Rebase onto v6.12-rc2.
- Link to v2: https://lore.kernel.org/r/20231222-kvm-arm64-sme-v2-0-da226cb180bb@kernel.org
Changes in v2:
- Rebase onto v6.7-rc3.
- Configure subfeatures based on host system only.
- Complete nVHE support.
- There was some snafu with sending v1 out, it didn't make it to the
lists but in case it hit people's inboxes I'm sending as v2.
---
Mark Brown (32):
arm64/sysreg: Define full value read/modify/write helpers
arm64/fpsimd: Ensure all of ZCR_EL1 is initialised from idle
arm64/fpsimd: Configure all ZCR/SMCR bits when loading task state
arm64/fpsimd: Decide to save ZT0 and streaming mode FFR at bind time
arm64/sve: Factor virtualizable VL discovery out of SVE specific code
arm64/fpsimd: Determine maximum virtualisable SME vector length
KVM: arm64: Remove bitrotted comment on handle_sve()
KVM: arm64: Handle FEAT_IDST for guest accesses to hidden registers
KVM: arm64: Pull ctxt_has_ helpers to start of sysreg-sr.h
KVM: arm64: Rename SVE finalization constants to be more general
KVM: arm64: Remove special case for FP state loading from ZCR_EL2 traps
KVM: arm64: Define internal features for SME
KVM: arm64: Rename sve_state_reg_region
KVM: arm64: Store vector lengths in an array
KVM: arm64: Factor SVE code out of fpsimd_lazy_switch_to_host()
KVM: arm64: Document the KVM ABI for SME
KVM: arm64: Implement SME vector length configuration
KVM: arm64: Support SME control registers
KVM: arm64: Support TPIDR2_EL0
KVM: arm64: Support SME identification registers for guests
KVM: arm64: Support SME priority registers
KVM: arm64: Support userspace access to streaming mode Z and P registers
KVM: arm64: Flush register state on writes to SVCR.SM and SVCR.ZA
KVM: arm64: Expose SME specific state to userspace
KVM: arm64: Context switch SME state for guests
KVM: arm64: Handle SME exceptions
KVM: arm64: Expose SME to nested guests
KVM: arm64: Provide interface for configuring and enabling SME for guests
KVM: arm64: selftests: Remove spurious check for single bit safe values
KVM: arm64: selftests: Skip impossible invalid value tests
KVM: arm64: selftests: Add SME system registers to get-reg-list
KVM: arm64: selftests: Add SME to set_id_regs test
Documentation/virt/kvm/api.rst | 127 +++++---
arch/arm64/include/asm/fpsimd.h | 11 +-
arch/arm64/include/asm/kvm_emulate.h | 16 +
arch/arm64/include/asm/kvm_host.h | 117 ++++++-
arch/arm64/include/asm/kvm_hyp.h | 2 +-
arch/arm64/include/asm/kvm_nested.h | 2 +
arch/arm64/include/asm/kvm_pkvm.h | 2 +-
arch/arm64/include/asm/sysreg.h | 8 +
arch/arm64/include/asm/vncr_mapping.h | 2 +
arch/arm64/include/uapi/asm/kvm.h | 34 +++
arch/arm64/kernel/cpufeature.c | 2 -
arch/arm64/kernel/fpsimd.c | 144 ++++-----
arch/arm64/kernel/suspend.c | 2 +-
arch/arm64/kvm/arm.c | 19 ++
arch/arm64/kvm/config.c | 13 +-
arch/arm64/kvm/emulate-nested.c | 6 +-
arch/arm64/kvm/fpsimd.c | 27 +-
arch/arm64/kvm/guest.c | 369 ++++++++++++++++++++---
arch/arm64/kvm/handle_exit.c | 23 +-
arch/arm64/kvm/hyp/include/hyp/switch.h | 262 +++++++++++++---
arch/arm64/kvm/hyp/include/hyp/sysreg-sr.h | 96 +++---
arch/arm64/kvm/hyp/nvhe/hyp-main.c | 133 ++++++--
arch/arm64/kvm/hyp/nvhe/pkvm.c | 90 ++++--
arch/arm64/kvm/hyp/nvhe/switch.c | 2 +
arch/arm64/kvm/hyp/nvhe/sys_regs.c | 6 +
arch/arm64/kvm/hyp/vhe/switch.c | 28 +-
arch/arm64/kvm/hyp/vhe/sysreg-sr.c | 7 +
arch/arm64/kvm/inject_fault.c | 15 +
arch/arm64/kvm/nested.c | 15 +-
arch/arm64/kvm/reset.c | 159 +++++++---
arch/arm64/kvm/sys_regs.c | 155 +++++++++-
include/uapi/linux/kvm.h | 1 +
tools/testing/selftests/kvm/arm64/get-reg-list.c | 15 +-
tools/testing/selftests/kvm/arm64/set_id_regs.c | 96 +++++-
34 files changed, 1602 insertions(+), 404 deletions(-)
---
base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
change-id: 20230301-kvm-arm64-sme-06a1246d3636
Best regards,
--
Mark Brown <broonie@kernel.org>
^ permalink raw reply
* [PATCH v3] coresight: coresight.h: add '*' to kernel-doc lines
From: Randy Dunlap @ 2026-07-19 22:24 UTC (permalink / raw)
To: linux-kernel
Cc: Randy Dunlap, James Clark, Tao Zhang, Suzuki K Poulose, coresight,
Danilo Krummrich, Mike Leach, Leo Yan, linux-arm-kernel
kernel-doc reports 2 (kernel-doc) lines in coresight.h that don't have
a beginning '*' in them, so fix these lines.
Also convert struct coresight_trace_id_map to kernel-doc format to
remove another warning.
Warning: include/linux/coresight.h:173 bad line:
connected to @src_port. NULL until the device is created
Warning: include/linux/coresight.h:177 bad line:
needs to be filtered.
Warning: include/linux/coresight.h:236 This comment starts with '/**',
but isn't a kernel-doc comment.
Fixes: ec9903d6cc34 ("coresight: Add support for trace filtering by source")
Fixes: d49c9cf15f89 ("coresight: Rename connection members to make the direction explicit")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
v2: rebase & resend
v3: rebase & resend
Cc: James Clark <james.clark@arm.com>
Cc: Tao Zhang <quic_taozha@quicinc.com>
Cc: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: coresight@lists.linaro.org
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: Mike Leach <mike.leach@arm.com>
Cc: Leo Yan <leo.yan@arm.com>
Cc: linux-arm-kernel@lists.infradead.org
---
include/linux/coresight.h | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- linux-next-20260717.orig/include/linux/coresight.h
+++ linux-next-20260717/include/linux/coresight.h
@@ -177,11 +177,11 @@ struct coresight_desc {
* @dest_port: destination's input port number @src_port is connected to.
* @dest_fwnode: destination component's fwnode handle.
* @dest_dev: a @coresight_device representation of the component
- connected to @src_port. NULL until the device is created
+ * connected to @src_port. NULL until the device is created
* @link: Representation of the connection as a sysfs link.
* @filter_src_fwnode: filter source component's fwnode handle.
* @filter_src_dev: a @coresight_device representation of the component that
- needs to be filtered.
+ * needs to be filtered.
*
* The full connection structure looks like this, where in_conns store
* references to same connection as the source device's out_conns.
@@ -234,7 +234,7 @@ struct coresight_sysfs_link {
#define CORESIGHT_TRACE_IDS_MAX 128
/**
- * Trace ID map.
+ * struct coresight_trace_id_map - Trace ID map.
*
* @used_ids: Bitmap to register available (bit = 0) and in use (bit = 1) IDs.
* Initialised so that the reserved IDs are permanently marked as
^ permalink raw reply
* [PATCH] clk: mmp: allow COMPILE_TEST builds
From: Rosen Penev @ 2026-07-19 21:43 UTC (permalink / raw)
To: linux-clk
Cc: Michael Turquette, Stephen Boyd, Brian Masney,
Duje Mihanović, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, open list,
moderated list:ARM/Marvell PXA1908 SOC support,
open list:CLANG/LLVM BUILD SUPPORT:Keyword:b(?i:clang|llvm)b
The MMP clock directory is only entered for ARCH_MMP, even though the
PXA1908 and MMP2 audio clock symbols can already be selected for
COMPILE_TEST.
Add a hidden MMP clock family gate, select it from the compile-testable MMP
clock symbols, and use that symbol for the parent Makefile descent. Keep
ARCH_MMP as the default provider for existing platform builds.
Tested with:
make LLVM=1 ARCH=loongarch drivers/clk/mmp/
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/clk/Kconfig | 2 ++
drivers/clk/Makefile | 2 +-
drivers/clk/mmp/Kconfig | 5 +++++
3 files changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 16191b297150..cb69872401fd 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -457,12 +457,14 @@ config COMMON_CLK_STM32H7
config COMMON_CLK_MMP2
def_bool COMMON_CLK && (MACH_MMP2_DT || MACH_MMP3_DT)
+ select COMMON_CLK_MMP
help
Support for Marvell MMP2 and MMP3 SoC clocks
config COMMON_CLK_MMP2_AUDIO
tristate "Clock driver for MMP2 Audio subsystem"
depends on COMMON_CLK_MMP2 || COMPILE_TEST
+ select COMMON_CLK_MMP
help
This driver supports clocks for Audio subsystem on MMP2 SoC.
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 4b2c089f46a1..8383f9f1da51 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -130,7 +130,7 @@ obj-y += mediatek/
obj-$(CONFIG_ARCH_MESON) += meson/
obj-y += microchip/
ifeq ($(CONFIG_COMMON_CLK), y)
-obj-$(CONFIG_ARCH_MMP) += mmp/
+obj-$(CONFIG_COMMON_CLK_MMP) += mmp/
endif
obj-y += mstar/
obj-y += mvebu/
diff --git a/drivers/clk/mmp/Kconfig b/drivers/clk/mmp/Kconfig
index b0d2fea3cda5..35a069034b28 100644
--- a/drivers/clk/mmp/Kconfig
+++ b/drivers/clk/mmp/Kconfig
@@ -1,10 +1,15 @@
# SPDX-License-Identifier: GPL-2.0-only
+config COMMON_CLK_MMP
+ bool
+ default ARCH_MMP
+
config COMMON_CLK_PXA1908
bool "Clock driver for Marvell PXA1908"
depends on ARCH_MMP || COMPILE_TEST
depends on OF
default y if ARCH_MMP && ARM64
+ select COMMON_CLK_MMP
select AUXILIARY_BUS
help
This driver supports the Marvell PXA1908 SoC clocks.
--
2.55.0
^ permalink raw reply related
* [PATCH v2 4/4] serial: imx: serialize imx_uart_ports[] lifetime
From: Karl Mehltretter @ 2026-07-19 22:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby
Cc: Karl Mehltretter, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, linux-serial, linux-kernel, imx, linux-arm-kernel,
Sashiko, stable
In-Reply-To: <20260719221014.44354-1-kmehltretter@gmail.com>
imx_uart_probe() publishes the port in imx_uart_ports[] before
uart_add_one_port(), because console setup during that call uses the
table. The entry is not cleared if adding the port fails or after
imx_uart_remove() removes it.
The port is devm-allocated, so a failed probe or unbind leaves the table
pointing at freed memory. A later registration of the shared console can
then dereference the stale entry. Reproduced on QEMU's mcimx6ul-evk by
unbinding a sibling UART, unbinding the console UART and rebinding the
sibling:
BUG: KASAN: slab-use-after-free in imx_uart_console_setup+0xd0/0x3d8
The entry must remain valid until uart_remove_one_port() unregisters the
console. Clearing it afterward without serialization still races a
sibling probe: the sibling can register the shared console using the
dying entry before it is cleared. The next console write then
dereferences NULL.
Use a driver-wide mutex to serialize table publication, port addition
and rollback with port removal and table clearing. Console callbacks
remain lockless because uart_add_one_port() may invoke setup while
probe holds the mutex.
The probe-failure path also relies on "serial: core: do fallible
allocations before the console can be registered", which moves the
uport->name and uport->tty_groups allocations before console
registration. Both changes should be backported together.
Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables")
Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://lore.kernel.org/all/20260719162850.043B41F000E9@smtp.kernel.org
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
drivers/tty/serial/imx.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 251a50c8aa38..def874f9cd00 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -22,6 +22,7 @@
#include <linux/clk.h>
#include <linux/delay.h>
#include <linux/ktime.h>
+#include <linux/mutex.h>
#include <linux/pinctrl/consumer.h>
#include <linux/rational.h>
#include <linux/slab.h>
@@ -2080,6 +2081,15 @@ static const struct uart_ops imx_uart_pops = {
static struct imx_port *imx_uart_ports[UART_NR];
+/*
+ * Store the port in imx_uart_ports[] before uart_add_one_port() and clear
+ * it only after uart_remove_one_port() returns. Console callbacks in both
+ * calls use the table, so this mutex serializes these sequences between
+ * sibling ports. Callbacks must not take it because uart_add_one_port()
+ * may invoke setup while it is held.
+ */
+static DEFINE_MUTEX(imx_uart_ports_lock);
+
#if IS_ENABLED(CONFIG_SERIAL_IMX_CONSOLE)
static void imx_uart_console_putchar(struct uart_port *port, unsigned char ch)
{
@@ -2632,11 +2642,14 @@ static int imx_uart_probe(struct platform_device *pdev)
}
}
- imx_uart_ports[sport->port.line] = sport;
-
platform_set_drvdata(pdev, sport);
+ mutex_lock(&imx_uart_ports_lock);
+ imx_uart_ports[sport->port.line] = sport;
ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port);
+ if (ret)
+ imx_uart_ports[sport->port.line] = NULL;
+ mutex_unlock(&imx_uart_ports_lock);
err_clk:
clk_disable_unprepare(sport->clk_ipg);
@@ -2647,8 +2660,12 @@ static int imx_uart_probe(struct platform_device *pdev)
static void imx_uart_remove(struct platform_device *pdev)
{
struct imx_port *sport = platform_get_drvdata(pdev);
+ unsigned int line = sport->port.line;
+ mutex_lock(&imx_uart_ports_lock);
uart_remove_one_port(&imx_uart_uart_driver, &sport->port);
+ imx_uart_ports[line] = NULL;
+ mutex_unlock(&imx_uart_ports_lock);
}
static void imx_uart_restore_context(struct imx_port *sport)
--
2.53.0
^ permalink raw reply related
* [PATCH v2 1/4] serial: core: do fallible allocations before the console can be registered
From: Karl Mehltretter @ 2026-07-19 22:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby
Cc: Karl Mehltretter, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, linux-serial, linux-kernel, imx, linux-arm-kernel,
stable
In-Reply-To: <20260719221014.44354-1-kmehltretter@gmail.com>
serial_core_add_one_port() allocates uport->tty_groups after
uart_configure_port() has already registered the port's console. If
that allocation fails, the function returns -ENOMEM with the console
still registered, and the driver's probe error path then tears down
the port state the console callbacks depend on.
Reproduced with fault injection on qemu's raspi1ap board. Failing the
tty_groups allocation during a PL011 sysfs bind makes
uart_add_one_port() return -ENOMEM. pl011_register_port() then clears
amba_ports[0], but ttyAMA0 remains registered as a console. The nbcon
printer thread dereferences the NULL entry and oopses:
Unhandled fault: page domain fault (0x01b) at 0x00000178
CPU: 0 UID: 0 PID: 43 Comm: pr/ttyAMA0 Not tainted 7.2.0-rc3+ #1
PC is at pl011_console_write_thread+0x2c/0x168
This is not PL011-specific: the failing allocation is in serial core,
after uart_configure_port() has registered the console, so any console
UART driver is exposed. On i.MX the retained console references a
devm-allocated port that the failed probe frees, causing a
use-after-free. Reproduced on qemu's mcimx6ul-evk using the same
fail-nth harness under KASAN:
BUG: KASAN: slab-use-after-free in imx_uart_console_write_thread+0x50/0x278
Read of size 4 at addr c5246048 by task pr/ttymxc0/63
imx_uart_console_write_thread from nbcon_emit_next_record+0x360/0x50c
nbcon_emit_next_record from nbcon_emit_one+0x140/0x184
Allocated by task 1:
devm_kmalloc from imx_uart_probe+0x90/0xa5c
Freed by task 1:
devres_release_all from device_unbind_cleanup+0x38/0xdc
device_unbind_cleanup from really_probe+0x2b4/0x388
The pre-existing kasprintf() failure path has a related problem: it
returns with state->uart_port already pointing at a port whose probe
is about to unwind and free it.
Reorder the function so the uport->name and uport->tty_groups
allocations both happen before the port is linked into the driver
state table and before uart_configure_port() registers the console:
1. Allocate uport->name.
2. Allocate the tty_groups array with room for three entries
unconditionally (serial core group, optional driver group, NULL
terminator). The optional group cannot be examined at this point:
config_port() may only supply uport->attr_group during
uart_configure_port(), e.g. 8250 sets it after autodetection.
3. Only then link the port into the driver state table and run
uart_configure_port().
4. Fill in the optional attr_group slot afterwards.
A fail-nth sweep over the whole bind path on both boards left the
console unregistered after every failed bind and did not reproduce the
i.MX use-after-free.
Fixes: 266dcff03eed ("Serial: allow port drivers to have a default attribute group")
Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-fable-5
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
drivers/tty/serial/serial_core.c | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index a530ad372b43..887b1dd80ad2 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3056,7 +3056,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
struct uart_state *state;
struct tty_port *port;
struct device *tty_dev;
- int num_groups;
if (uport->line >= drv->nr)
return -EINVAL;
@@ -3068,6 +3067,23 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
if (state->uart_port)
return -EINVAL;
+ uport->name = kasprintf(GFP_KERNEL, "%s%u", drv->dev_name,
+ drv->tty_driver->name_base + uport->line);
+ if (!uport->name)
+ return -ENOMEM;
+
+ /*
+ * uart_configure_port() may set uport->attr_group and register the
+ * console. Allocate room for both groups and a NULL terminator first.
+ */
+ uport->tty_groups = kzalloc_objs(*uport->tty_groups, 3);
+ if (!uport->tty_groups) {
+ kfree(uport->name);
+ uport->name = NULL;
+ return -ENOMEM;
+ }
+ uport->tty_groups[0] = &tty_dev_attr_group;
+
/* Link the port to the driver state table and vice versa */
atomic_set(&state->refcount, 1);
init_waitqueue_head(&state->remove_wait);
@@ -3084,10 +3100,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
state->pm_state = UART_PM_STATE_UNDEFINED;
uart_port_set_cons(uport, drv->cons);
uport->minor = drv->tty_driver->minor_start + uport->line;
- uport->name = kasprintf(GFP_KERNEL, "%s%u", drv->dev_name,
- drv->tty_driver->name_base + uport->line);
- if (!uport->name)
- return -ENOMEM;
if (uport->cons && uport->dev)
of_console_check(uport->dev->of_node, uport->cons->name, uport->line);
@@ -3102,15 +3114,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u
port->console = uart_console(uport);
- num_groups = 2;
- if (uport->attr_group)
- num_groups++;
-
- uport->tty_groups = kzalloc_objs(*uport->tty_groups, num_groups);
- if (!uport->tty_groups)
- return -ENOMEM;
-
- uport->tty_groups[0] = &tty_dev_attr_group;
if (uport->attr_group)
uport->tty_groups[1] = uport->attr_group;
--
2.53.0
^ permalink raw reply related
* [PATCH v2 0/4] serial: fix console lifetime bugs on failed bind and removal
From: Karl Mehltretter @ 2026-07-19 22:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby
Cc: Karl Mehltretter, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, linux-serial, linux-kernel, imx, linux-arm-kernel
This series fixes three serial/tty bind-error bugs and an i.MX console
port-table lifetime bug. The fixes were found with failslab fail-nth sweeps
and sysfs bind/unbind sequences under KASAN on QEMU's raspi1ap and
mcimx6ul-evk machines.
Patches 1-3 fix shared serial/tty core code. Patch 1 moves fallible serial
core allocations before console registration; patch 2 clears serial-core
pointers after uart_driver registration fails; and patch 3 makes a non-NULL
tty cdev slot mean that the cdev is live.
Patch 4 clears i.MX's devm-allocated port-table entry on probe failure and
removal. It keeps the entry valid through console unregistration and
serializes the table updates against sibling probes.
Backporting note: the probe-failure half of patch 4 relies on patch 1, which
ensures that uart_add_one_port() cannot fail after registering the console.
For complete coverage, patches 1 and 4 should be backported together.
Validation for patch 4 includes reproducing the sibling-probe race under
KASAN with and without the fix, a sequential unbind/rebind regression, and
the same test with CONFIG_PROVE_LOCKING=y. The fixed kernel keeps the
console unregistered and survives an explicit printk in each applicable run.
Changes in v2:
- Patch 4: serialize port registration and removal with imx_uart_ports[]
updates to close the reported sibling-probe race.
- Patches 1-3 are unchanged.
v1: https://lore.kernel.org/r/20260719160812.35407-1-kmehltretter@gmail.com
Karl Mehltretter (4):
serial: core: do fallible allocations before the console can be
registered
serial: core: clear freed pointers on uart_register_driver() failure
tty: don't oops in tty_unregister_device() when no cdev is registered
serial: imx: serialize imx_uart_ports[] lifetime
drivers/tty/serial/imx.c | 21 ++++++++++++++++++--
drivers/tty/serial/serial_core.c | 33 ++++++++++++++++++--------------
drivers/tty/tty_io.c | 6 ++++--
3 files changed, 42 insertions(+), 18 deletions(-)
--
2.53.0
^ permalink raw reply
* [PATCHv2 2/2] clk: stm32: allow STM32MP COMPILE_TEST builds
From: Rosen Penev @ 2026-07-19 21:50 UTC (permalink / raw)
To: linux-clk
Cc: Michael Turquette, Stephen Boyd, Brian Masney, Maxime Coquelin,
Alexandre Torgue, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, Gabriel Fernandez, Nicolas Le Bayon,
Alok Tiwari, open list, moderated list:ARM/STM32 ARCHITECTURE,
moderated list:ARM/STM32 ARCHITECTURE,
open list:CLANG/LLVM BUILD SUPPORT:Keyword:b(?i:clang|llvm)b
In-Reply-To: <20260719215040.767232-1-rosenp@gmail.com>
COMMON_CLK_STM32MP already allows COMPILE_TEST, but the parent clock
Makefile only descends into drivers/clk/stm32 for ARCH_STM32. Use the
STM32MP clock symbol for that directory gate instead.
Tested with:
make LLVM=1 ARCH=loongarch drivers/clk/stm32/
Assisted-by: Codex:GPT-5.5
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/clk/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile
index 8383f9f1da51..bbcedf5d60ea 100644
--- a/drivers/clk/Makefile
+++ b/drivers/clk/Makefile
@@ -151,7 +151,7 @@ obj-y += spacemit/
obj-$(CONFIG_PLAT_SPEAR) += spear/
obj-y += sprd/
obj-$(CONFIG_ARCH_STI) += st/
-obj-$(CONFIG_ARCH_STM32) += stm32/
+obj-$(CONFIG_COMMON_CLK_STM32MP) += stm32/
obj-y += starfive/
obj-$(CONFIG_ARCH_SUNXI) += sunxi/
obj-y += sunxi-ng/
--
2.55.0
^ permalink raw reply related
* [PATCHv2 1/2] clk: stm32: add missing bitfield.h header
From: Rosen Penev @ 2026-07-19 21:50 UTC (permalink / raw)
To: linux-clk
Cc: Michael Turquette, Stephen Boyd, Brian Masney, Maxime Coquelin,
Alexandre Torgue, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, Gabriel Fernandez, Nicolas Le Bayon,
Alok Tiwari, open list, moderated list:ARM/STM32 ARCHITECTURE,
moderated list:ARM/STM32 ARCHITECTURE,
open list:CLANG/LLVM BUILD SUPPORT:Keyword:b(?i:clang|llvm)b
In-Reply-To: <20260719215040.767232-1-rosenp@gmail.com>
It seems some ARM header includes this and the build passes there, but
nowhere else. Note that the driver has COMPILE_TEST in depends.
Fixes: 37ae8501cdb0 ("clk: stm32: introduce clocks for STM32MP21 platfor")
Signed-off-by: Rosen Penev <rosenp@gmail.com>
---
drivers/clk/stm32/clk-stm32mp21.c | 1 +
drivers/clk/stm32/clk-stm32mp25.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/clk/stm32/clk-stm32mp21.c b/drivers/clk/stm32/clk-stm32mp21.c
index c8a37b716bd5..bdb17419908c 100644
--- a/drivers/clk/stm32/clk-stm32mp21.c
+++ b/drivers/clk/stm32/clk-stm32mp21.c
@@ -4,6 +4,7 @@
* Author: Gabriel Fernandez <gabriel.fernandez@foss.st.com> for STMicroelectronics.
*/
+#include <linux/bitfield.h>
#include <linux/bus/stm32_firewall_device.h>
#include <linux/clk-provider.h>
#include <linux/io.h>
diff --git a/drivers/clk/stm32/clk-stm32mp25.c b/drivers/clk/stm32/clk-stm32mp25.c
index 52f0e8a12926..eb0bc918ecee 100644
--- a/drivers/clk/stm32/clk-stm32mp25.c
+++ b/drivers/clk/stm32/clk-stm32mp25.c
@@ -4,6 +4,7 @@
* Author: Gabriel Fernandez <gabriel.fernandez@foss.st.com> for STMicroelectronics.
*/
+#include <linux/bitfield.h>
#include <linux/bus/stm32_firewall_device.h>
#include <linux/clk-provider.h>
#include <linux/io.h>
--
2.55.0
^ permalink raw reply related
* [PATCHv2 0/2] clk: stm32: fix COMPILE_TEST builds
From: Rosen Penev @ 2026-07-19 21:50 UTC (permalink / raw)
To: linux-clk
Cc: Michael Turquette, Stephen Boyd, Brian Masney, Maxime Coquelin,
Alexandre Torgue, Nathan Chancellor, Nick Desaulniers,
Bill Wendling, Justin Stitt, Gabriel Fernandez, Nicolas Le Bayon,
Alok Tiwari, open list, moderated list:ARM/STM32 ARCHITECTURE,
moderated list:ARM/STM32 ARCHITECTURE,
open list:CLANG/LLVM BUILD SUPPORT:Keyword:b(?i:clang|llvm)b
The STM32MP clock drivers have COMPILE_TEST in their Kconfig depends, but
they fail to build (and are not even compiled) when ARCH_STM32 is disabled.
The first patch adds a missing bitfield.h include so the drivers build
standalone, and the second wires up the Makefile gate to the STM32MP clock
symbol so the directory is actually traversed under COMPILE_TEST.
v2: split up in two patches.
Rosen Penev (2):
clk: stm32: add missing bitfield.h header
clk: stm32: allow STM32MP COMPILE_TEST builds
drivers/clk/Makefile | 2 +-
drivers/clk/stm32/clk-stm32mp21.c | 1 +
drivers/clk/stm32/clk-stm32mp25.c | 1 +
3 files changed, 3 insertions(+), 1 deletion(-)
--
2.55.0
^ permalink raw reply
* [PATCH v1 1/4] clk: sunxi-ng: add cycle-masking divider (maskdiv) clock type
From: Juan Manuel López Carrillo @ 2026-07-19 21:13 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland
Cc: Brian Masney, Andre Przywara, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-clk, linux-sunxi, linux-arm-kernel,
devicetree, linux-kernel, Juan Manuel López Carrillo
In-Reply-To: <20260719211319.982285-1-juanmanuellopezcarrillo@gmail.com>
Some mod clocks do not divide their parent with a linear M+1 divider:
the M factor masks (swallows) M pulses out of every 2^width parent
cycles, so the average output rate is
rate = parent * (2^width - M) / 2^width
and the surviving pulses keep the parent period. The A523/T527 GPU
clock (GPU_CLK_REG, 0x670) is such a divider: "FACTOR_M: mask M cycles
at 16 cycles", GPU_CLK = Clock Source * ((16-M)/16) (T527 user manual
v0.92, section 2.7.6.58).
Modelling these registers with the linear ccu_div type programs a
faster clock than requested for every M > 0 (e.g. M=1 on a 800 MHz
parent yields 750 MHz, not 400 MHz).
Add a small ccu type implementing the masking semantics. Because the
masked output is not an even pulse train, determine_rate prefers, among
the parents that reach the requested rate, the one needing the least
masking. set_rate_and_parent follows the same ordering rule as
clk_composite_set_rate_and_parent() so no intermediate configuration
overshoots both the old and the new rate.
Signed-off-by: Juan Manuel López Carrillo <juanmanuellopezcarrillo@gmail.com>
---
drivers/clk/sunxi-ng/Makefile | 1 +
drivers/clk/sunxi-ng/ccu_maskdiv.c | 199 +++++++++++++++++++++++++++++
drivers/clk/sunxi-ng/ccu_maskdiv.h | 71 ++++++++++
3 files changed, 271 insertions(+)
create mode 100644 drivers/clk/sunxi-ng/ccu_maskdiv.c
create mode 100644 drivers/clk/sunxi-ng/ccu_maskdiv.h
diff --git a/drivers/clk/sunxi-ng/Makefile b/drivers/clk/sunxi-ng/Makefile
index a1c4087d7..26313083c 100644
--- a/drivers/clk/sunxi-ng/Makefile
+++ b/drivers/clk/sunxi-ng/Makefile
@@ -10,6 +10,7 @@ sunxi-ccu-y += ccu_reset.o
# Base clock types
sunxi-ccu-y += ccu_div.o
sunxi-ccu-y += ccu_frac.o
+sunxi-ccu-y += ccu_maskdiv.o
sunxi-ccu-y += ccu_gate.o
sunxi-ccu-y += ccu_mux.o
sunxi-ccu-y += ccu_mult.o
diff --git a/drivers/clk/sunxi-ng/ccu_maskdiv.c b/drivers/clk/sunxi-ng/ccu_maskdiv.c
new file mode 100644
index 000000000..2d3cccf08
--- /dev/null
+++ b/drivers/clk/sunxi-ng/ccu_maskdiv.c
@@ -0,0 +1,199 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+/*
+ * Copyright (c) 2026 Juan Manuel López Carrillo
+ *
+ * Cycle-masking divider: the M factor masks M pulses out of every
+ * 2^width parent cycles instead of dividing the parent rate, so
+ *
+ * rate = parent * (2^width - M) / 2^width
+ *
+ * The masked output is not an even pulse train: the surviving pulses
+ * keep the parent period. Rate selection therefore prefers, among the
+ * parents that reach the requested rate, the one needing the least
+ * masking.
+ */
+
+#include <linux/clk-provider.h>
+#include <linux/io.h>
+#include <linux/math64.h>
+
+#include "ccu_gate.h"
+#include "ccu_maskdiv.h"
+
+static unsigned long ccu_maskdiv_calc_rate(unsigned long parent_rate,
+ unsigned int m, unsigned int width)
+{
+ unsigned int n = 1 << width;
+
+ return div_u64((u64)parent_rate * (n - m), n);
+}
+
+/*
+ * Smallest M (least masking) whose output does not exceed the requested
+ * rate; masking everything (M == 2^width) is never returned.
+ */
+static unsigned int ccu_maskdiv_find_m(unsigned long parent_rate,
+ unsigned long rate, unsigned int width)
+{
+ unsigned int n = 1 << width;
+ u64 kept;
+
+ if (!parent_rate || rate >= parent_rate)
+ return 0;
+
+ kept = div64_ul((u64)rate * n, parent_rate);
+ if (!kept)
+ kept = 1;
+
+ return n - (unsigned int)kept;
+}
+
+static void ccu_maskdiv_disable(struct clk_hw *hw)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+
+ return ccu_gate_helper_disable(&cmd->common, cmd->enable);
+}
+
+static int ccu_maskdiv_enable(struct clk_hw *hw)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+
+ return ccu_gate_helper_enable(&cmd->common, cmd->enable);
+}
+
+static int ccu_maskdiv_is_enabled(struct clk_hw *hw)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+
+ return ccu_gate_helper_is_enabled(&cmd->common, cmd->enable);
+}
+
+static unsigned long ccu_maskdiv_recalc_rate(struct clk_hw *hw,
+ unsigned long parent_rate)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+ unsigned int m;
+ u32 reg;
+
+ reg = readl(cmd->common.base + cmd->common.reg);
+ m = (reg >> cmd->shift) & ((1 << cmd->width) - 1);
+
+ return ccu_maskdiv_calc_rate(parent_rate, m, cmd->width);
+}
+
+static int ccu_maskdiv_determine_rate(struct clk_hw *hw,
+ struct clk_rate_request *req)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+ unsigned long best_rate = 0, best_parent_rate = 0;
+ struct clk_hw *best_parent = NULL;
+ unsigned int best_m = UINT_MAX;
+ unsigned int i;
+
+ for (i = 0; i < clk_hw_get_num_parents(hw); i++) {
+ struct clk_hw *parent = clk_hw_get_parent_by_index(hw, i);
+ unsigned long parent_rate, new_rate;
+ unsigned int m;
+
+ if (!parent)
+ continue;
+
+ parent_rate = clk_hw_get_rate(parent);
+ m = ccu_maskdiv_find_m(parent_rate, req->rate, cmd->width);
+ new_rate = ccu_maskdiv_calc_rate(parent_rate, m, cmd->width);
+
+ if (new_rate > req->rate)
+ continue;
+
+ /* Closest rate first; on ties, the least masking */
+ if (new_rate > best_rate ||
+ (new_rate == best_rate && m < best_m)) {
+ best_rate = new_rate;
+ best_parent_rate = parent_rate;
+ best_parent = parent;
+ best_m = m;
+ }
+ }
+
+ if (!best_parent)
+ return -EINVAL;
+
+ req->best_parent_hw = best_parent;
+ req->best_parent_rate = best_parent_rate;
+ req->rate = best_rate;
+
+ return 0;
+}
+
+static int ccu_maskdiv_set_rate(struct clk_hw *hw, unsigned long rate,
+ unsigned long parent_rate)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+ unsigned int m;
+ unsigned long flags;
+ u32 reg;
+
+ m = ccu_maskdiv_find_m(parent_rate, rate, cmd->width);
+
+ spin_lock_irqsave(cmd->common.lock, flags);
+
+ reg = readl(cmd->common.base + cmd->common.reg);
+ reg &= ~GENMASK(cmd->shift + cmd->width - 1, cmd->shift);
+ writel(reg | (m << cmd->shift), cmd->common.base + cmd->common.reg);
+
+ spin_unlock_irqrestore(cmd->common.lock, flags);
+
+ return 0;
+}
+
+static u8 ccu_maskdiv_get_parent(struct clk_hw *hw)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+
+ return ccu_mux_helper_get_parent(&cmd->common, &cmd->mux);
+}
+
+static int ccu_maskdiv_set_parent(struct clk_hw *hw, u8 index)
+{
+ struct ccu_maskdiv *cmd = hw_to_ccu_maskdiv(hw);
+
+ return ccu_mux_helper_set_parent(&cmd->common, &cmd->mux, index);
+}
+
+static int ccu_maskdiv_set_rate_and_parent(struct clk_hw *hw,
+ unsigned long rate,
+ unsigned long parent_rate, u8 index)
+{
+ /*
+ * Same ordering rule as clk_composite_set_rate_and_parent(): if
+ * switching the mux with the current M would overshoot the
+ * requested rate, program the divider first, so the
+ * intermediate rate never exceeds both the old and the new
+ * rate.
+ */
+ if (ccu_maskdiv_recalc_rate(hw, parent_rate) > rate) {
+ ccu_maskdiv_set_rate(hw, rate, parent_rate);
+ ccu_maskdiv_set_parent(hw, index);
+ } else {
+ ccu_maskdiv_set_parent(hw, index);
+ ccu_maskdiv_set_rate(hw, rate, parent_rate);
+ }
+
+ return 0;
+}
+
+const struct clk_ops ccu_maskdiv_ops = {
+ .disable = ccu_maskdiv_disable,
+ .enable = ccu_maskdiv_enable,
+ .is_enabled = ccu_maskdiv_is_enabled,
+
+ .get_parent = ccu_maskdiv_get_parent,
+ .set_parent = ccu_maskdiv_set_parent,
+
+ .determine_rate = ccu_maskdiv_determine_rate,
+ .recalc_rate = ccu_maskdiv_recalc_rate,
+ .set_rate = ccu_maskdiv_set_rate,
+ .set_rate_and_parent = ccu_maskdiv_set_rate_and_parent,
+};
+EXPORT_SYMBOL_NS_GPL(ccu_maskdiv_ops, "SUNXI_CCU");
diff --git a/drivers/clk/sunxi-ng/ccu_maskdiv.h b/drivers/clk/sunxi-ng/ccu_maskdiv.h
new file mode 100644
index 000000000..3cbfce064
--- /dev/null
+++ b/drivers/clk/sunxi-ng/ccu_maskdiv.h
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2026 Juan Manuel López Carrillo
+ */
+
+#ifndef _CCU_MASKDIV_H_
+#define _CCU_MASKDIV_H_
+
+#include <linux/clk-provider.h>
+
+#include "ccu_common.h"
+#include "ccu_mux.h"
+
+/*
+ * struct ccu_maskdiv - cycle-masking ("fractional") divider
+ *
+ * This divider does not divide the parent clock: it masks (swallows) M
+ * pulses out of every 2^width parent cycles, so the average output rate
+ * is
+ *
+ * rate = parent * (2^width - M) / 2^width
+ *
+ * with the remaining pulses keeping the parent period. The A523/T527
+ * GPU clock (GPU_CLK_REG, 0x670) is such a divider: "FACTOR_M: mask M
+ * cycles at 16 cycles", GPU_CLK = Clock Source * ((16-M)/16) (T527 user
+ * manual v0.92, section 2.7.6.58).
+ *
+ * @shift: shift of the M field in the register
+ * @width: width of the M field; the mask window is 2^width cycles
+ */
+struct ccu_maskdiv {
+ u32 enable;
+
+ u8 shift;
+ u8 width;
+
+ struct ccu_mux_internal mux;
+ struct ccu_common common;
+};
+
+#define SUNXI_CCU_MASKDIV_HW_WITH_MUX_TABLE_GATE(_struct, _name, \
+ _parents, _table, \
+ _reg, \
+ _mshift, _mwidth, \
+ _muxshift, _muxwidth, \
+ _gate, _flags) \
+ struct ccu_maskdiv _struct = { \
+ .enable = _gate, \
+ .shift = _mshift, \
+ .width = _mwidth, \
+ .mux = _SUNXI_CCU_MUX_TABLE(_muxshift, _muxwidth, \
+ _table), \
+ .common = { \
+ .reg = _reg, \
+ .hw.init = CLK_HW_INIT_PARENTS_HW(_name, \
+ _parents, \
+ &ccu_maskdiv_ops, \
+ _flags), \
+ }, \
+ }
+
+static inline struct ccu_maskdiv *hw_to_ccu_maskdiv(struct clk_hw *hw)
+{
+ struct ccu_common *common = hw_to_ccu_common(hw);
+
+ return container_of(common, struct ccu_maskdiv, common);
+}
+
+extern const struct clk_ops ccu_maskdiv_ops;
+
+#endif /* _CCU_MASKDIV_H_ */
--
2.47.3
^ permalink raw reply related
* [PATCH v1 4/4] arm64: dts: allwinner: t527-orangepi-4a: add GPU OPP table
From: Juan Manuel López Carrillo @ 2026-07-19 21:13 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland
Cc: Brian Masney, Andre Przywara, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-clk, linux-sunxi, linux-arm-kernel,
devicetree, linux-kernel, Juan Manuel López Carrillo
In-Reply-To: <20260719211319.982285-1-juanmanuellopezcarrillo@gmail.com>
Add the Mali-G57 operating points from the vendor BSP universal table
(150/200/300/400/600 MHz) so panfrost devfreq can scale the GPU
instead of running at the boot clock.
All operating points use 920 mV: the BSP table specifies 900 mV for
every universal OPP, but on this board the GPU rail (AXP717 DCDC2,
vdd-gpu-sys) is a fixed 920 mV supply, so the OPP voltage states the
actual rail value and voltage transitions are no-ops. The higher
speed-bin points of the BSP (648-792 MHz) are not included: they are
gated by a SID efuse bin and need pll-gpu as a live parent.
Depends on the sun55i-a523 GPU clock divider fix (the OPP rates are
only produced correctly with the cycle-masking divider model);
validated on hardware with the Mali cycle counter: 149/199/300/399/597
MHz measured under load, thermal-emulation throttling included.
Signed-off-by: Juan Manuel López Carrillo <juanmanuellopezcarrillo@gmail.com>
---
.../dts/allwinner/sun55i-t527-orangepi-4a.dts | 30 +++++++++++++++++++
1 file changed, 30 insertions(+)
diff --git a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
index 055be86e5..0fd73a1bb 100644
--- a/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
+++ b/arch/arm64/boot/dts/allwinner/sun55i-t527-orangepi-4a.dts
@@ -30,6 +30,35 @@ ext_osc32k: ext-osc32k-clk {
clock-output-names = "ext_osc32k";
};
+ gpu_opp_table: opp-table-gpu {
+ compatible = "operating-points-v2";
+
+ opp-150000000 {
+ opp-hz = /bits/ 64 <150000000>;
+ opp-microvolt = <920000>;
+ };
+
+ opp-200000000 {
+ opp-hz = /bits/ 64 <200000000>;
+ opp-microvolt = <920000>;
+ };
+
+ opp-300000000 {
+ opp-hz = /bits/ 64 <300000000>;
+ opp-microvolt = <920000>;
+ };
+
+ opp-400000000 {
+ opp-hz = /bits/ 64 <400000000>;
+ opp-microvolt = <920000>;
+ };
+
+ opp-600000000 {
+ opp-hz = /bits/ 64 <600000000>;
+ opp-microvolt = <920000>;
+ };
+ };
+
leds {
compatible = "gpio-leds";
@@ -116,6 +145,7 @@ &gmac1 {
&gpu {
mali-supply = <®_dcdc2>;
+ operating-points-v2 = <&gpu_opp_table>;
status = "okay";
};
--
2.47.3
^ permalink raw reply related
* [PATCH v1 3/4] clk: sunxi-ng: sun55i-a523: reparent GPU while pll-gpu changes rate
From: Juan Manuel López Carrillo @ 2026-07-19 21:13 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland
Cc: Brian Masney, Andre Przywara, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-clk, linux-sunxi, linux-arm-kernel,
devicetree, linux-kernel, Juan Manuel López Carrillo
In-Reply-To: <20260719211319.982285-1-juanmanuellopezcarrillo@gmail.com>
Register the existing sunxi-ng mux notifier on pll-gpu so the GPU mod
clock is parked on the fixed pll-periph0-600M output while the PLL is
being reprogrammed, and switched back once it has locked, following the
cpux precedent of other sunxi SoCs. The mux switch is glitch-free per
the T527 manual (GPU_CLK_REG, "The clock selection supports glitch-free
switch").
Nothing retunes pll-gpu at runtime today (the mux does not propagate
rate requests and all standard OPPs resolve to pll-periph0 outputs),
but the higher speed-bin operating points (648-792 MHz) will need
pll-gpu as a live parent, and any direct clk_set_rate() on the PLL is
now safe.
Signed-off-by: Juan Manuel López Carrillo <juanmanuellopezcarrillo@gmail.com>
---
drivers/clk/sunxi-ng/ccu-sun55i-a523.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/clk/sunxi-ng/ccu-sun55i-a523.c b/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
index 979e53e63..4341eb66c 100644
--- a/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
+++ b/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
@@ -1667,6 +1667,17 @@ static const u32 pll_regs[] = {
SUN55I_A523_PLL_NPU_REG,
};
+/*
+ * Park the GPU on the fixed pll-periph0-600M output while pll-gpu
+ * changes rate; the mux switch is glitch-free (T527 manual, GPU_CLK_REG).
+ */
+static struct ccu_mux_nb sun55i_a523_gpu_nb = {
+ .common = &gpu_clk.common,
+ .cm = &gpu_clk.mux,
+ .delay_us = 1,
+ .bypass_index = 1, /* pll-periph0-600M */
+};
+
static int sun55i_a523_ccu_probe(struct platform_device *pdev)
{
void __iomem *reg;
@@ -1698,6 +1709,10 @@ static int sun55i_a523_ccu_probe(struct platform_device *pdev)
if (ret)
return ret;
+ /* Reparent the GPU during pll-gpu rate changes */
+ ccu_mux_notifier_register(pll_gpu_clk.common.hw.clk,
+ &sun55i_a523_gpu_nb);
+
return 0;
}
--
2.47.3
^ permalink raw reply related
* [PATCH v1 2/4] clk: sunxi-ng: sun55i-a523: GPU clock divider is fractional, not linear
From: Juan Manuel López Carrillo @ 2026-07-19 21:13 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland
Cc: Brian Masney, Andre Przywara, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-clk, linux-sunxi, linux-arm-kernel,
devicetree, linux-kernel, Juan Manuel López Carrillo
In-Reply-To: <20260719211319.982285-1-juanmanuellopezcarrillo@gmail.com>
The GPU mod clock (0x670) was modelled as a linear M+1 divider, but the
M factor of this register is a cycle-masking divider: GPU_CLK = Clock
Source * ((16-M)/16) (T527 user manual v0.92, section 2.7.6.58).
With the linear model every OPP that needed M > 0 silently ran the GPU
faster than requested. Measured on an Orange Pi 4A (T527) with the
Mali cycle counter against the programmed register:
OPP request programmed real rate
150 MHz 600M, M=3 487.5 MHz
200 MHz 800M, M=3 650 MHz
300 MHz 600M, M=1 562.5 MHz
400 MHz 800M, M=1 750 MHz
600 MHz 600M, M=0 600 MHz
i.e. the "400 MHz" OPP ran the GPU at 750 MHz, 25% above the vendor
ceiling of 600 MHz, at the low-OPP voltage. Thermal throttling to
"400 MHz" actually overclocked the GPU.
Switch the clock to the maskdiv type. With least-masking preference
the vendor OPP set now resolves to 600/400/300/200 MHz taken undivided
from their periph outputs and 150 MHz = pll-periph0-200M * 12/16, all
verified exact on hardware with the same cycle-counter method.
Drop pll-periph0-800M from the selectable parents (the mux table skips
hardware index 1): the vendor BSP removed it from its parent list with
the comment "If GPU use pll-peri0-800m, gpu will occur job fault", and
with the masking semantics every vendor OPP matches exactly from the
800M parent first, so it would otherwise always be chosen.
Also drop CLK_SET_RATE_PARENT: every OPP is reachable from the fixed
pll-periph0 outputs, and pll-gpu must never be reprogrammed through this
mux. Once the GPU moves off pll-gpu the PLL is no longer prepared, so
it loses the rate protection of CLK_SET_RATE_GATE; a propagated rate
request would then reprogram the PLL while its gate is off (the lock
bit never asserts, 70 ms poll timeout per transition) and switch the
running GPU onto it before it locks.
Fixes: 6702d17f54a8 ("clk: sunxi-ng: a523: add video mod clocks")
Signed-off-by: Juan Manuel López Carrillo <juanmanuellopezcarrillo@gmail.com>
---
drivers/clk/sunxi-ng/ccu-sun55i-a523.c | 32 +++++++++++++++++++++-----
1 file changed, 26 insertions(+), 6 deletions(-)
diff --git a/drivers/clk/sunxi-ng/ccu-sun55i-a523.c b/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
index 20dad06b3..979e53e63 100644
--- a/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
+++ b/drivers/clk/sunxi-ng/ccu-sun55i-a523.c
@@ -21,6 +21,7 @@
#include "ccu_div.h"
#include "ccu_gate.h"
+#include "ccu_maskdiv.h"
#include "ccu_mp.h"
#include "ccu_mult.h"
#include "ccu_nk.h"
@@ -442,18 +443,37 @@ static SUNXI_CCU_GATE_HWS(bus_g2d_clk, "bus-g2d", ahb_hws, 0x63c, BIT(0), 0);
static const struct clk_hw *gpu_parents[] = {
&pll_gpu_clk.common.hw,
- &pll_periph0_800M_clk.common.hw,
&pll_periph0_600M_clk.hw,
&pll_periph0_400M_clk.hw,
&pll_periph0_300M_clk.hw,
&pll_periph0_200M_clk.hw,
};
-static SUNXI_CCU_M_HW_WITH_MUX_GATE(gpu_clk, "gpu", gpu_parents, 0x670,
- 0, 4, /* M */
- 24, 3, /* mux */
- BIT(31), /* gate */
- CLK_SET_RATE_PARENT);
+/*
+ * Mux index 1 (pll-periph0-800M) is skipped: the vendor BSP removed it
+ * from the parent list ("If GPU use pll-peri0-800m, gpu will occur job
+ * fault"), and with the masking divider every OPP would match exactly
+ * from it first.
+ */
+static const u8 gpu_mux_table[] = { 0, 2, 3, 4, 5 };
+
+/*
+ * The M factor is a cycle-masking (fractional) divider, not a linear
+ * one: rate = source * (16 - M) / 16 (T527 manual, GPU_CLK_REG).
+ *
+ * No CLK_SET_RATE_PARENT: every GPU OPP is reachable from the fixed
+ * pll-periph0 outputs, and pll-gpu must never be reprogrammed through this mux.
+ * Once the GPU moves off pll-gpu the PLL is no longer prepared, so it loses
+ * the rate protection of CLK_SET_RATE_GATE; a propagated rate request would
+ * then reprogram the PLL while its gate is off (the lock bit never asserts,
+ * 70 ms timeout) and switch the running GPU onto it before it locks.
+ */
+static SUNXI_CCU_MASKDIV_HW_WITH_MUX_TABLE_GATE(gpu_clk, "gpu", gpu_parents,
+ gpu_mux_table, 0x670,
+ 0, 4, /* M */
+ 24, 3, /* mux */
+ BIT(31), /* gate */
+ 0);
static SUNXI_CCU_GATE_HWS(bus_gpu_clk, "bus-gpu", ahb_hws, 0x67c, BIT(0), 0);
--
2.47.3
^ permalink raw reply related
* [PATCH v1 0/4] clk: sunxi-ng: fix the A523/T527 GPU clock model, enable GPU DVFS
From: Juan Manuel López Carrillo @ 2026-07-19 21:13 UTC (permalink / raw)
To: Michael Turquette, Stephen Boyd, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland
Cc: Brian Masney, Andre Przywara, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, linux-clk, linux-sunxi, linux-arm-kernel,
devicetree, linux-kernel, Juan Manuel López Carrillo
This series follows up on the discussion in [1], where Chen-Yu pointed
out that the A523/T527 GPU mod clock is not a standard divider but a
fractional one: GPU_CLK = Clock Source * ((16-M)/16), with M 0-15.
I checked this against the T527 user manual (v0.92, section 2.7.6.58,
"FACTOR_M: mask M cycles at 16 cycles") and verified it on hardware:
with the current linear model, forcing each OPP on an Orange Pi 4A and
measuring the real GPU frequency with the Mali cycle counter gives
OPP request programmed measured
150 MHz 600M, M=3 ~487 MHz
200 MHz 800M, M=3 648 MHz
300 MHz 600M, M=1 560 MHz
400 MHz 800M, M=1 749 MHz
600 MHz 600M, M=0 599 MHz
so every OPP below 600 MHz silently overclocks, up to 25% above the
vendor ceiling, and thermal throttling to "400 MHz" actually raises
the GPU frequency.
Patch 1 adds a small ccu type implementing the cycle-masking
semantics. Patch 2 switches the A523 GPU clock to it, drops
pll-periph0-800M from the selectable parents (the vendor BSP removed
it citing GPU job faults) and drops CLK_SET_RATE_PARENT (pll-gpu loses
its CLK_SET_RATE_GATE protection once the GPU runs from a periph
output). Patch 3 registers the existing sunxi-ng mux notifier so the
GPU is parked on pll-periph0-600M while pll-gpu changes rate, as
Chen-Yu suggested in the same thread. Patch 4 adds the BSP operating
points to the Orange Pi 4A DT, which enables panfrost devfreq.
With the series applied the same cycle-counter measurement reads
149/199/300/399/597 MHz for the five OPPs, all from the intended
parents, and devfreq scaling plus thermal throttling (emulated
temperature) behave correctly under load.
The higher speed-bin operating points of the BSP (648-792 MHz, gated
by a SID efuse bin, running from pll-gpu) are left for a follow-up.
[1] https://lore.kernel.org/linux-sunxi/20260719153122.892013-1-juanmanuellopezcarrillo@gmail.com/
Juan Manuel López Carrillo (4):
clk: sunxi-ng: add cycle-masking divider (maskdiv) clock type
clk: sunxi-ng: sun55i-a523: GPU clock divider is fractional, not
linear
clk: sunxi-ng: sun55i-a523: reparent GPU while pll-gpu changes rate
arm64: dts: allwinner: t527-orangepi-4a: add GPU OPP table
.../dts/allwinner/sun55i-t527-orangepi-4a.dts | 30 +++
drivers/clk/sunxi-ng/Makefile | 1 +
drivers/clk/sunxi-ng/ccu-sun55i-a523.c | 47 ++++-
drivers/clk/sunxi-ng/ccu_maskdiv.c | 199 ++++++++++++++++++
drivers/clk/sunxi-ng/ccu_maskdiv.h | 71 +++++++
5 files changed, 342 insertions(+), 6 deletions(-)
create mode 100644 drivers/clk/sunxi-ng/ccu_maskdiv.c
create mode 100644 drivers/clk/sunxi-ng/ccu_maskdiv.h
--
2.47.3
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox