From 00cdfd072c709c608606461d7d44d4613119bfa9 Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Wed, 8 Jul 2026 13:54:48 +0530 Subject: [PATCH 01/62] rust: Fix "multiple candidates for rmeta dependency core" error When building Rust code for powerpc64le with LLVM=1 and -j1, rustc encounters an error: "multiple candidates for `rmeta` dependency `core` found", with two candidates: 1. The host's standard library from the rustup toolchain 2. The kernel's custom libcore.rmeta in the rust/ directory This occurs because the build system uses `-L$(objtree)/rust` for host library builds (proc_macro2, quote, syn), which causes rustc to search the rust/ directory. During this search, rustc finds both the kernel's custom libcore.rmeta and gains access to the host's standard library, creating a conflict. The solution is to separate host libraries into a dedicated rust/host/ subdirectory and use `-L$(objtree)/rust/host` for host builds instead of `-L$(objtree)/rust`. This ensures that: 1. Host library builds (proc_macro2, quote, syn) only search rust/host/ and never encounter the kernel's libcore.rmeta 2. Proc macro builds use `-L$(objtree)/rust/host` to find their dependencies Special handling is added for rustdoc-pin_init, which is a host build (to access the alloc crate) but depends on proc macros from the main rust/ directory. It uses explicit `--extern` paths to reference the proc macros without adding `-L$(objtree)/rust`, which would reintroduce the conflict. The rust/host/ directory is added to clean-files to ensure it's removed during `make clean`. Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-2-mkchauras@gmail.com --- rust/Makefile | 42 +++++++++++++++++++++++------------------- 1 file changed, 23 insertions(+), 19 deletions(-) diff --git a/rust/Makefile b/rust/Makefile index 627ed79dc6f5..0f44d231338b 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -3,6 +3,9 @@ # Where to place rustdoc generated documentation rustdoc_output := $(objtree)/Documentation/output/rust/rustdoc +# Clean generated host directory +clean-files := host/ + obj-$(CONFIG_RUST) += core.o compiler_builtins.o ffi.o always-$(CONFIG_RUST) += exports_core_generated.h @@ -33,7 +36,7 @@ endif obj-$(CONFIG_RUST) += exports.o -always-$(CONFIG_RUST) += libproc_macro2.rlib libquote.rlib libsyn.rlib +always-$(CONFIG_RUST) += host/libproc_macro2.rlib host/libquote.rlib host/libsyn.rlib always-$(CONFIG_RUST_KERNEL_DOCTESTS) += doctests_kernel_generated.rs always-$(CONFIG_RUST_KERNEL_DOCTESTS) += doctests_kernel_generated_kunit.c @@ -171,7 +174,7 @@ quiet_cmd_rustdoc = RUSTDOC $(if $(rustdoc_host),H, ) $< $(rustc_target_envs) \ OBJTREE=$(abspath $(objtree)) \ $(RUSTDOC) $(filter-out $(skip_flags) --remap-path-scope=%,$(if $(rustdoc_host),$(rust_common_flags),$(rust_flags))) \ - $(rustc_target_flags) -L$(objtree)/$(obj) \ + $(rustc_target_flags) -L$(objtree)/$(obj)$(if $(rustdoc_host),/host) \ -Zunstable-options --generate-link-to-definition \ --output $(rustdoc_output) \ --crate-name $(subst rustdoc-,,$@) \ @@ -269,6 +272,7 @@ rustdoc-pin_init_internal: $(src)/pin-init/internal/src/lib.rs \ rustdoc-pin_init: private rustdoc_host = yes rustdoc-pin_init: private rustc_target_flags = $(pin_init-flags) \ + --extern pin_init_internal=$(objtree)/$(obj)/$(libpin_init_internal_name) \ --extern alloc --cfg feature=\"alloc\" rustdoc-pin_init: $(src)/pin-init/src/lib.rs rustdoc-pin_init_internal \ rustdoc-macros FORCE @@ -580,23 +584,23 @@ quiet_cmd_rustc_procmacrolibrary = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_Q $(if $(skip_clippy),$(RUSTC),$(RUSTC_OR_CLIPPY)) \ $(filter-out $(skip_flags),$(rust_common_flags) $(rustc_target_flags)) \ --emit=dep-info=$(depfile) --emit=link=$@ --crate-type rlib -O \ - --out-dir $(objtree)/$(obj) -L$(objtree)/$(obj) \ + --out-dir $(objtree)/$(obj)/host -L$(objtree)/$(obj)/host \ --crate-name $(patsubst lib%.rlib,%,$(notdir $@)) $< -$(obj)/libproc_macro2.rlib: private skip_clippy = 1 -$(obj)/libproc_macro2.rlib: private rustc_target_flags = $(proc_macro2-flags) -$(obj)/libproc_macro2.rlib: $(src)/proc-macro2/lib.rs FORCE +$(obj)/host/libproc_macro2.rlib: private skip_clippy = 1 +$(obj)/host/libproc_macro2.rlib: private rustc_target_flags = $(proc_macro2-flags) +$(obj)/host/libproc_macro2.rlib: $(src)/proc-macro2/lib.rs FORCE +$(call if_changed_dep,rustc_procmacrolibrary) -$(obj)/libquote.rlib: private skip_clippy = 1 -$(obj)/libquote.rlib: private skip_flags = $(quote-skip_flags) -$(obj)/libquote.rlib: private rustc_target_flags = $(quote-flags) -$(obj)/libquote.rlib: $(src)/quote/lib.rs $(obj)/libproc_macro2.rlib FORCE +$(obj)/host/libquote.rlib: private skip_clippy = 1 +$(obj)/host/libquote.rlib: private skip_flags = $(quote-skip_flags) +$(obj)/host/libquote.rlib: private rustc_target_flags = $(quote-flags) +$(obj)/host/libquote.rlib: $(src)/quote/lib.rs $(obj)/host/libproc_macro2.rlib FORCE +$(call if_changed_dep,rustc_procmacrolibrary) -$(obj)/libsyn.rlib: private skip_clippy = 1 -$(obj)/libsyn.rlib: private rustc_target_flags = $(syn-flags) -$(obj)/libsyn.rlib: $(src)/syn/lib.rs $(obj)/libquote.rlib FORCE +$(obj)/host/libsyn.rlib: private skip_clippy = 1 +$(obj)/host/libsyn.rlib: private rustc_target_flags = $(syn-flags) +$(obj)/host/libsyn.rlib: $(src)/syn/lib.rs $(obj)/host/libquote.rlib FORCE +$(call if_changed_dep,rustc_procmacrolibrary) quiet_cmd_rustc_procmacro = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_QUIET)) P $@ @@ -606,26 +610,26 @@ quiet_cmd_rustc_procmacro = $(if $(skip_clippy),RUSTC,$(RUSTC_OR_CLIPPY_QUIET)) -Clinker-flavor=gcc -Clinker=$(HOSTCC) \ -Clink-args='$(call escsq,$(KBUILD_PROCMACROLDFLAGS))' \ --emit=dep-info=$(depfile) --emit=link=$@ --extern proc_macro \ - --crate-type proc-macro -L$(objtree)/$(obj) \ + --crate-type proc-macro -L$(objtree)/$(obj)/host \ --crate-name $(patsubst lib%.$(procmacro-extension),%,$(notdir $@)) \ @$(objtree)/include/generated/rustc_cfg $< # Procedural macros can only be used with the `rustc` that compiled it. $(obj)/$(libzerocopy_derive_name): private skip_clippy = 1 $(obj)/$(libzerocopy_derive_name): private rustc_target_flags = $(zerocopy_derive-flags) -$(obj)/$(libzerocopy_derive_name): $(src)/zerocopy-derive/lib.rs $(obj)/libproc_macro2.rlib \ - $(obj)/libquote.rlib $(obj)/libsyn.rlib FORCE +$(obj)/$(libzerocopy_derive_name): $(src)/zerocopy-derive/lib.rs $(obj)/host/libproc_macro2.rlib \ + $(obj)/host/libquote.rlib $(obj)/host/libsyn.rlib FORCE +$(call if_changed_dep,rustc_procmacro) $(obj)/$(libmacros_name): private rustc_target_flags = \ --extern proc_macro2 --extern quote --extern syn -$(obj)/$(libmacros_name): $(src)/macros/lib.rs $(obj)/libproc_macro2.rlib \ - $(obj)/libquote.rlib $(obj)/libsyn.rlib FORCE +$(obj)/$(libmacros_name): $(src)/macros/lib.rs $(obj)/host/libproc_macro2.rlib \ + $(obj)/host/libquote.rlib $(obj)/host/libsyn.rlib FORCE +$(call if_changed_dep,rustc_procmacro) $(obj)/$(libpin_init_internal_name): private rustc_target_flags = $(pin_init_internal-flags) $(obj)/$(libpin_init_internal_name): $(src)/pin-init/internal/src/lib.rs \ - $(obj)/libproc_macro2.rlib $(obj)/libquote.rlib $(obj)/libsyn.rlib FORCE + $(obj)/host/libproc_macro2.rlib $(obj)/host/libquote.rlib $(obj)/host/libsyn.rlib FORCE +$(call if_changed_dep,rustc_procmacro) # `rustc` requires `-Zunstable-options` to use custom target specifications From be809b60cbb61aab96179f44ac3670242ae72996 Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Wed, 8 Jul 2026 13:54:49 +0530 Subject: [PATCH 02/62] dma-resv: Fix undefined symbol when CONFIG_DMA_SHARED_BUFFER is disabled MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When building with LLVM=1 for architectures like powerpc where CONFIG_DMA_SHARED_BUFFER is not enabled, the build fails with: ld.lld: error: undefined symbol: dma_resv_reset_max_fences >>> referenced by helpers.c >>> rust/helpers/helpers.o:(rust_helper_dma_resv_unlock) The issue occurs because: 1. CONFIG_DEBUG_MUTEXES=y is enabled 2. CONFIG_DMA_SHARED_BUFFER is not enabled 3. dma_resv_reset_max_fences() is declared in the header when CONFIG_DEBUG_MUTEXES is set 4. But the function is only compiled in drivers/dma-buf/dma-resv.c, which is only built when CONFIG_DMA_SHARED_BUFFER is enabled 5. Rust helpers call dma_resv_unlock() which calls dma_resv_reset_max_fences(), causing an undefined symbol Fix this by compiling `dma-resv.c` file only when CONFIG_DMA_SHARED_BUFFER is enabled. Fixes: 9b836641d3bf ("rust: helpers: Add bindings/wrappers for dma_resv_lock") Reviewed-by: Christian König Reviewed-by: Gary Guo Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-3-mkchauras@gmail.com --- rust/helpers/helpers.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c index 998e31052e66..4b90a1390ad5 100644 --- a/rust/helpers/helpers.c +++ b/rust/helpers/helpers.c @@ -58,7 +58,9 @@ #include "cred.c" #include "device.c" #include "dma.c" +#ifdef CONFIG_DMA_SHARED_BUFFER #include "dma-resv.c" +#endif #include "drm.c" #include "drm_gpuvm.c" #include "err.c" From 13244c0a40139fe66c4c5c5655f4d732a6002957 Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Wed, 8 Jul 2026 13:54:50 +0530 Subject: [PATCH 03/62] powerpc/jump_label: adjust inline asm to be consistent Added support for a new macro ARCH_STATIC_BRANCH_ASM in powerpc to avoid duplication of inline asm between C and Rust. This is inline with 'commit aecaf181651c ("jump_label: adjust inline asm to be consistent")' Co-developed-by: Madhavan Srinivasan Reviewed-by: Alice Ryhl Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Gary Guo Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-4-mkchauras@gmail.com --- arch/powerpc/include/asm/jump_label.h | 23 +++++++++++++---------- 1 file changed, 13 insertions(+), 10 deletions(-) diff --git a/arch/powerpc/include/asm/jump_label.h b/arch/powerpc/include/asm/jump_label.h index d4eaba459a0e..3016e9c8d6bc 100644 --- a/arch/powerpc/include/asm/jump_label.h +++ b/arch/powerpc/include/asm/jump_label.h @@ -15,14 +15,20 @@ #define JUMP_ENTRY_TYPE stringify_in_c(FTR_ENTRY_LONG) #define JUMP_LABEL_NOP_SIZE 4 +#define JUMP_TABLE_ENTRY(key, label) \ + ".pushsection __jump_table, \"aw\" \n\t" \ + ".long 1b - ., " label " - . \n\t" \ + JUMP_ENTRY_TYPE key " - . \n\t" \ + ".popsection \n\t" + +#define ARCH_STATIC_BRANCH_ASM(key, label) \ + "1: nop \n\t" \ + JUMP_TABLE_ENTRY(key, label) + static __always_inline bool arch_static_branch(struct static_key *key, bool branch) { - asm goto("1:\n\t" - "nop # arch_static_branch\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".long 1b - ., %l[l_yes] - .\n\t" - JUMP_ENTRY_TYPE "%c0 - .\n\t" - ".popsection \n\t" + asm goto( + ARCH_STATIC_BRANCH_ASM("%c0", "%l[l_yes]") : : "i" (&((char *)key)[branch]) : : l_yes); return false; @@ -34,10 +40,7 @@ static __always_inline bool arch_static_branch_jump(struct static_key *key, bool { asm goto("1:\n\t" "b %l[l_yes] # arch_static_branch_jump\n\t" - ".pushsection __jump_table, \"aw\"\n\t" - ".long 1b - ., %l[l_yes] - .\n\t" - JUMP_ENTRY_TYPE "%c0 - .\n\t" - ".popsection \n\t" + JUMP_TABLE_ENTRY("%c0", "%l[l_yes]") : : "i" (&((char *)key)[branch]) : : l_yes); return false; From e299147cdc8e19c6421a6b7863dc82a35b09d967 Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Wed, 8 Jul 2026 13:54:51 +0530 Subject: [PATCH 04/62] rust/powerpc: Set min rustc version for powerpc Minimum `rustc` version required for powerpc is 1.95 as some critical features required for compiling rust code for kernel are not there. For example Stable inline asm support which got merged in 1.95. Link: https://github.com/rust-lang/rust/pull/147996 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-5-mkchauras@gmail.com --- scripts/min-tool-version.sh | 2 ++ 1 file changed, 2 insertions(+) diff --git a/scripts/min-tool-version.sh b/scripts/min-tool-version.sh index 031f2192b390..99bfdcaa3396 100755 --- a/scripts/min-tool-version.sh +++ b/scripts/min-tool-version.sh @@ -33,6 +33,8 @@ llvm) rustc) if [ "$SRCARCH" = "s390" ]; then echo 1.96.0 + elif [ "$ARCH" = powerpc ]; then + echo 1.95.0 else echo 1.85.0 fi From c93c194e4ee71a734986fd99a8b1ec9fbb7a9b8b Mon Sep 17 00:00:00 2001 From: Link Mauve Date: Wed, 8 Jul 2026 13:54:52 +0530 Subject: [PATCH 05/62] rust: Make __udivdi3() and __umoddi3() panic MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The core crate currently depends on these two functions for i64/u64/ i128/u128/core::time::Duration formatting, but we shouldn’t use that in the kernel so let’s panic if they are ever called. This doesn’t yet fix drm_panic_qr.rs, which also uses __udivdi3 when CONFIG_CC_OPTIMIZE_FOR_SIZE=y, but at least makes the rest of the kernel build on PPC32. Signed-off-by: Link Mauve Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-6-mkchauras@gmail.com --- rust/Makefile | 4 ++++ rust/compiler_builtins.rs | 6 ++++++ 2 files changed, 10 insertions(+) diff --git a/rust/Makefile b/rust/Makefile index 0f44d231338b..ca831984ad45 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -687,6 +687,10 @@ ifneq ($(or $(CONFIG_ARM64),$(and $(CONFIG_RISCV),$(CONFIG_64BIT))),) __ashrti3 \ __ashlti3 __lshrti3 endif +ifdef CONFIG_PPC32 + redirect-intrinsics += \ + __udivdi3 __umoddi3 +endif ifdef CONFIG_MODVERSIONS cmd_gendwarfksyms = $(if $(skip_gendwarfksyms),, \ diff --git a/rust/compiler_builtins.rs b/rust/compiler_builtins.rs index dd16c1dc899c..fc6b54636dd5 100644 --- a/rust/compiler_builtins.rs +++ b/rust/compiler_builtins.rs @@ -97,5 +97,11 @@ pub extern "C" fn $ident() { __aeabi_uldivmod, }); +#[cfg(target_arch = "powerpc")] +define_panicking_intrinsics!("`u64` division/modulo should not be used", { + __udivdi3, + __umoddi3, +}); + // NOTE: if you are adding a new intrinsic here, you should also add it to // `redirect-intrinsics` in `rust/Makefile`. From 73b741adb264967093ef4eb59905618a7e0d0de0 Mon Sep 17 00:00:00 2001 From: Link Mauve Date: Wed, 8 Jul 2026 13:54:53 +0530 Subject: [PATCH 06/62] rust: Add PowerPC support MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For now only Big Endian 32-bit PowerPC is supported, as that is the only hardware I have. This has been tested on the Nintendo Wii so far, but I plan on also using it on the GameCube, Wii U and Apple G4. These changes aren’t the only ones required to get the kernel to compile and link on PowerPC, libcore will also have to be changed to not use integer division to format u64, u128 and core::time::Duration, otherwise __udivdi3() and __umoddi3() will have to be added. I have tested this change by replacing the three implementations with unimplemented!() and it linked just fine. Signed-off-by: Link Mauve Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Acked-by: Gary Guo Link: https://github.com/rust-lang/compiler-team/issues/986 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-7-mkchauras@gmail.com --- arch/powerpc/Kconfig | 1 + arch/powerpc/Makefile | 2 ++ rust/Makefile | 4 +++- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index f7ce5fff81f0..badd7c99b87f 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -285,6 +285,7 @@ config PPC select HAVE_REGS_AND_STACK_ACCESS_API select HAVE_RELIABLE_STACKTRACE select HAVE_RSEQ + select HAVE_RUST if PPC32 select HAVE_SAMPLE_FTRACE_DIRECT if HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_SETUP_PER_CPU_AREA if PPC64 diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile index a58b1029592c..589613eaa5dc 100644 --- a/arch/powerpc/Makefile +++ b/arch/powerpc/Makefile @@ -61,6 +61,8 @@ else KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o endif +KBUILD_RUSTFLAGS += --target=powerpc-unknown-linux-gnu + ifdef CONFIG_CPU_LITTLE_ENDIAN KBUILD_CPPFLAGS += -mlittle-endian KBUILD_LDFLAGS += -EL diff --git a/rust/Makefile b/rust/Makefile index ca831984ad45..dfc020d44b80 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -456,7 +456,8 @@ bindgen_skip_c_flags := -mno-fp-ret-in-387 -mpreferred-stack-boundary=% \ -fstrict-flex-arrays=% -fmin-function-alignment=% \ -fzero-init-padding-bits=% -mno-fdpic \ -fdiagnostics-show-context -fdiagnostics-show-context=% \ - --param=% --param asan-% -fno-isolate-erroneous-paths-dereference + --param=% --param asan-% -fno-isolate-erroneous-paths-dereference \ + -ffixed-r2 -mmultiple -mno-readonly-in-sdata # Derived from `scripts/Makefile.clang`. BINDGEN_TARGET_x86 := x86_64-linux-gnu @@ -466,6 +467,7 @@ BINDGEN_TARGET_loongarch := loongarch64-linux-gnusf BINDGEN_TARGET_s390 := s390x-linux-gnu # This is only for i386 UM builds, which need the 32-bit target not -m32 BINDGEN_TARGET_i386 := i386-linux-gnu +BINDGEN_TARGET_powerpc := powerpc-linux-gnu BINDGEN_TARGET_um := $(BINDGEN_TARGET_$(SUBARCH)) BINDGEN_TARGET := $(BINDGEN_TARGET_$(SRCARCH)) From bc87cbdb952e9223616b839d64bdb4723aa2ed1d Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Wed, 8 Jul 2026 13:54:54 +0530 Subject: [PATCH 07/62] powerpc: Enable Rust for ppc64le MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Enabling rust support for ppc64le. Tested on pseries Power11: ╰─❯ dmesg | grep rust [ 0.225728] Initialise system trusted keyrings [ 0.270961] rust_minimal: Rust minimal sample (init) [ 0.270968] rust_minimal: Am I built-in? true [ 0.270974] rust_minimal: test_parameter: 1 [ 0.270983] rust_misc_device: Initialising Rust Misc Device Sample [ 0.271012] rust_print: Rust printing macros sample (init) [ 0.271019] rust_print: Emergency message (level 0) without args [ 0.271023] rust_print: Alert message (level 1) without args [ 0.271026] rust_print: Critical message (level 2) without args [ 0.271030] rust_print: Error message (level 3) without args [ 0.271033] rust_print: Warning message (level 4) without args [ 0.271037] rust_print: Notice message (level 5) without args [ 0.271040] rust_print: Info message (level 6) without args [ 0.271043] rust_print: A line that is continued without args [ 0.271054] rust_print: Emergency message (level 0) with args [ 0.271064] rust_print: Alert message (level 1) with args [ 0.271072] rust_print: Critical message (level 2) with args [ 0.271077] rust_print: Error message (level 3) with args [ 0.271083] rust_print: Warning message (level 4) with args [ 0.271091] rust_print: Notice message (level 5) with args [ 0.271097] rust_print: Info message (level 6) with args [ 0.271102] rust_print: A line that is continued with args [ 0.271110] rust_print: 1 [ 0.271113] rust_print: "hello, world" [ 0.271121] rust_print: [samples/rust/rust_print_main.rs:35:5] c = "hello, world" [ 0.271129] rust_print: Arc says 42 [ 0.271130] rust_print: Arc says hello, world [ 0.271136] rust_print: "hello, world" [ 0.271198] usbcore: registered new interface driver rust_driver_usb [ 0.271207] rust_faux_driver: Initialising Rust Faux Device Sample [ 0.271227] faux_driver rust-faux-sample-device: Hello from faux device! [ 0.271297] rust_configfs: Rust configfs sample (init) Reviewed-by: Link Mauve Tested-by: Link Mauve Reviewed-by: Christophe Leroy (CS GROUP) Tested-by: Venkat Rao Bagalkote Link: https://github.com/Rust-for-Linux/linux/issues/105 Link: https://github.com/linuxppc/issues/issues/451 Acked-by: Gary Guo Link: https://github.com/rust-lang/compiler-team/issues/987 Link: https://github.com/rust-lang/compiler-team/issues/988 Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260708082454.1254320-8-mkchauras@gmail.com --- arch/powerpc/Kconfig | 1 + arch/powerpc/Makefile | 7 ++++++- rust/Makefile | 6 ++++++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index badd7c99b87f..650283107b92 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -286,6 +286,7 @@ config PPC select HAVE_RELIABLE_STACKTRACE select HAVE_RSEQ select HAVE_RUST if PPC32 + select HAVE_RUST if PPC64 && CPU_LITTLE_ENDIAN select HAVE_SAMPLE_FTRACE_DIRECT if HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_SAMPLE_FTRACE_DIRECT_MULTI if HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS select HAVE_SETUP_PER_CPU_AREA if PPC64 diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile index 589613eaa5dc..9385db478c59 100644 --- a/arch/powerpc/Makefile +++ b/arch/powerpc/Makefile @@ -61,7 +61,12 @@ else KBUILD_LDFLAGS_MODULE += $(objtree)/arch/powerpc/lib/crtsavres.o endif -KBUILD_RUSTFLAGS += --target=powerpc-unknown-linux-gnu +ifdef CONFIG_PPC64 +KBUILD_RUSTFLAGS += --target=powerpc64le-unknown-linux-gnu +KBUILD_RUSTFLAGS += -Ctarget-feature=-mma,-vsx,-hard-float,-altivec +else +KBUILD_RUSTFLAGS += --target=powerpc-unknown-linux-gnu +endif ifdef CONFIG_CPU_LITTLE_ENDIAN KBUILD_CPPFLAGS += -mlittle-endian diff --git a/rust/Makefile b/rust/Makefile index dfc020d44b80..6fb6ab09ef2b 100644 --- a/rust/Makefile +++ b/rust/Makefile @@ -467,7 +467,13 @@ BINDGEN_TARGET_loongarch := loongarch64-linux-gnusf BINDGEN_TARGET_s390 := s390x-linux-gnu # This is only for i386 UM builds, which need the 32-bit target not -m32 BINDGEN_TARGET_i386 := i386-linux-gnu + +ifdef CONFIG_PPC64 +BINDGEN_TARGET_powerpc := powerpc64le-linux-gnu +else BINDGEN_TARGET_powerpc := powerpc-linux-gnu +endif + BINDGEN_TARGET_um := $(BINDGEN_TARGET_$(SUBARCH)) BINDGEN_TARGET := $(BINDGEN_TARGET_$(SRCARCH)) From 12013e3d4695721ef83b2e32fdfd20e2eb9b0cc9 Mon Sep 17 00:00:00 2001 From: Vishal Chourasia Date: Thu, 9 Jul 2026 14:51:40 +0530 Subject: [PATCH 08/62] KVM: powerpc: Use generic xfer to guest work function Since commit 2cd571245b43 ("sched/fair: Add related data structure for task based throttle") in v6.18, CFS bandwidth throttling no longer dequeues a task directly; it queues task_work via TWA_RESUME and sets TIF_NOTIFY_RESUME, relying on that work running before the task returns to guest/user mode. The powerpc KVM run loops only checked for reschedule and signals, never TIF_NOTIFY_RESUME, so the deferred throttle never ran while a vCPU stayed in the run loop: a CPU-bound guest that rarely exits to userspace ran far past its cpu.max quota and then appeared frozen for minutes while the accrued throttle debt was repaid. Use the generic infrastructure to check for and handle pending work before transitioning into guest mode, replacing the open-coded need_resched() and cond_resched() checks in the Book3S HV run loops and in the common kvmppc_prepare_to_enter() used by the Book3S PR and BookE run loops. The redundant signal_pending() recheck (and its sigpend label) in kvmhv_run_single_vcpu() is also dropped, as xfer_to_guest_mode_work_pending() is a superset of it. This picks up handling for TIF_NOTIFY_RESUME, which was previously ignored, meaning task work will now be correctly handled on every guest re-entry. Selecting VIRT_XFER_TO_GUEST_WORK disables RCU's last-resort self-IPI fallback for vCPU tasks (see rcu_irq_work_resched()), which on nohz_full CPUs was what forced a reschedule for deferred rcuog wakeups queued right before guest entry. Take over that obligation the same way x86 and s390 do: call xfer_to_guest_mode_prepare() with IRQs disabled immediately before the final xfer_to_guest_mode_work_pending() check at each guest-entry gate (kvmhv_run_single_vcpu(), kvmppc_run_core() and kvmppc_prepare_to_enter()). In kvmppc_prepare_to_enter(), IRQs are now disabled with local_irq_disable() before hard_irq_disable(): on 32-bit, hard_irq_disable() is a raw MSR[EE] clear that bypasses the lockdep/irq-tracing state, and the strict xfer_to_guest_mode helpers assert that IRQs are seen as disabled. This also allows upgrading the racy __xfer_to_guest_mode_work_pending() check to the asserting variant, as this loop is the terminal gate for the PR and BookE paths. In kvmhv_run_single_vcpu(), the -EINTR exit and the pre-existing kvmhv_setup_mmu() failure exit now leave via the done label instead of returning directly, keeping the run_vcpu enter/exit tracepoints balanced and vcpu->arch.ret consistent with the returned value. In kvmppc_prepare_to_enter() the generic helper accounts the signal exit (vcpu->stat.signal_exits and KVM_EXIT_INTR) but does not set the exit type, so kvmppc_set_exit_type(SIGNAL_EXITS) is retained on the signal path to preserve the E500 CONFIG_KVM_EXIT_TIMING histogram; it is a no-op otherwise. Signed-off-by: Vishal Chourasia Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260709092140.1753715-4-vishalc@linux.ibm.com --- arch/powerpc/kvm/Kconfig | 1 + arch/powerpc/kvm/book3s_hv.c | 39 ++++++++++++++++++++++------------ arch/powerpc/kvm/booke.c | 1 + arch/powerpc/kvm/powerpc.c | 41 ++++++++++++++++++++++++++---------- 4 files changed, 57 insertions(+), 25 deletions(-) diff --git a/arch/powerpc/kvm/Kconfig b/arch/powerpc/kvm/Kconfig index 9a0d1c1aca6c..b6bc2fc86dca 100644 --- a/arch/powerpc/kvm/Kconfig +++ b/arch/powerpc/kvm/Kconfig @@ -22,6 +22,7 @@ config KVM select KVM_COMMON select KVM_VFIO select HAVE_KVM_IRQ_BYPASS + select VIRT_XFER_TO_GUEST_WORK config KVM_BOOK3S_HANDLER bool diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c index 61dbeea317f3..3cfe9a7be9c6 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c @@ -3853,7 +3853,8 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc) */ local_irq_disable(); hard_irq_disable(); - if (lazy_irq_pending() || need_resched() || + xfer_to_guest_mode_prepare(); + if (lazy_irq_pending() || xfer_to_guest_mode_work_pending() || recheck_signals_and_mmu(&core_info)) { local_irq_enable(); vc->vcore_state = VCORE_INACTIVE; @@ -4824,10 +4825,16 @@ static int kvmppc_run_vcpu(struct kvm_vcpu *vcpu) vc->runner = vcpu; if (n_ceded == vc->n_runnable) { kvmppc_vcore_blocked(vc); - } else if (need_resched()) { + } else if (__xfer_to_guest_mode_work_pending()) { kvmppc_vcore_preempt(vc); - /* Let something else run */ - cond_resched_lock(&vc->lock); + /* + * Let something else run. The raw helper is used as + * signal exits are accounted by this path already; + * it may schedule(), so drop the vcore lock. + */ + spin_unlock(&vc->lock); + xfer_to_guest_mode_handle_work(); + spin_lock(&vc->lock); if (vc->vcore_state == VCORE_PREEMPT) kvmppc_vcore_end_preempt(vc); } else { @@ -4895,12 +4902,16 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit, run->exit_reason = KVM_EXIT_FAIL_ENTRY; run->fail_entry.hardware_entry_failure_reason = 0; vcpu->arch.ret = r; - return r; + goto done; } } - if (need_resched()) - cond_resched(); + r = kvm_xfer_to_guest_mode_handle_work(vcpu); + if (r) { + /* -EINTR: signal pending, exit to userspace (KVM_EXIT_INTR) */ + vcpu->arch.ret = r; + goto done; + } kvmppc_update_vpas(vcpu); @@ -4914,9 +4925,13 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit, vcpu->arch.state = KVMPPC_VCPU_RUNNABLE; - if (signal_pending(current)) - goto sigpend; - if (need_resched() || !kvm->arch.mmu_ready) + xfer_to_guest_mode_prepare(); + + /* + * IRQs are disabled here, so on pending work bail to the outer loop, + * which handles it via kvm_xfer_to_guest_mode_handle_work() above. + */ + if (xfer_to_guest_mode_work_pending() || !kvm->arch.mmu_ready) goto out; vcpu->cpu = pcpu; @@ -5068,10 +5083,6 @@ int kvmhv_run_single_vcpu(struct kvm_vcpu *vcpu, u64 time_limit, return vcpu->arch.ret; - sigpend: - vcpu->stat.signal_exits++; - run->exit_reason = KVM_EXIT_INTR; - vcpu->arch.ret = -EINTR; out: vcpu->cpu = -1; vcpu->arch.thread_cpu = -1; diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c index f3ddb24ece74..5fba199dfdd6 100644 --- a/arch/powerpc/kvm/booke.c +++ b/arch/powerpc/kvm/booke.c @@ -722,6 +722,7 @@ int kvmppc_core_prepare_to_enter(struct kvm_vcpu *vcpu) if (vcpu->arch.shared->msr & MSR_WE) { local_irq_enable(); kvm_vcpu_halt(vcpu); + local_irq_disable(); hard_irq_disable(); kvmppc_set_exit_type(vcpu, EMULATED_MTMSRWE_EXITS); diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c index 00302399fc37..be5e48ae0c6c 100644 --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -81,21 +81,39 @@ int kvmppc_prepare_to_enter(struct kvm_vcpu *vcpu) int r; WARN_ON(irqs_disabled()); + /* + * local_irq_disable() first: on 32-bit, hard_irq_disable() alone is a + * raw MSR[EE] clear that bypasses the lockdep/irq-tracing state, and + * the xfer_to_guest_mode helpers assert IRQs are seen as disabled. + */ + local_irq_disable(); hard_irq_disable(); while (true) { - if (need_resched()) { - local_irq_enable(); - cond_resched(); - hard_irq_disable(); - continue; - } + xfer_to_guest_mode_prepare(); - if (signal_pending(current)) { - kvmppc_account_exit(vcpu, SIGNAL_EXITS); - vcpu->run->exit_reason = KVM_EXIT_INTR; - r = -EINTR; - break; + if (xfer_to_guest_mode_work_pending()) { + /* + * The helper must run with IRQs enabled and may + * schedule(). On a pending signal it returns -EINTR + * with run->exit_reason and vcpu->stat.signal_exits + * already set, so just return to userspace. + */ + local_irq_enable(); + r = kvm_xfer_to_guest_mode_handle_work(vcpu); + local_irq_disable(); + hard_irq_disable(); + if (r) { + /* + * The generic helper does not set the exit + * type; record it for the E500 + * CONFIG_KVM_EXIT_TIMING histogram (a no-op + * otherwise). + */ + kvmppc_set_exit_type(vcpu, SIGNAL_EXITS); + break; + } + continue; } vcpu->mode = IN_GUEST_MODE; @@ -116,6 +134,7 @@ int kvmppc_prepare_to_enter(struct kvm_vcpu *vcpu) local_irq_enable(); trace_kvm_check_requests(vcpu); r = kvmppc_core_check_requests(vcpu); + local_irq_disable(); hard_irq_disable(); if (r > 0) continue; From c2c8844316a12c2e1a3314e4f021815dd7fc7b47 Mon Sep 17 00:00:00 2001 From: Shrikanth Hegde Date: Thu, 9 Jul 2026 14:51:41 +0530 Subject: [PATCH 09/62] powerpc: enable to run posix cpu timers in task context Now that all kvm entry to guest paths handle the task work using the generic framework, enable HAVE_POSIX_CPU_TIMERS_TASK_WORK which allows running posix cpu timers in task context instead of running them in hardirq. This would is a necessary step towards enabling PREEMPT_RT on powerNV systems. Signed-off-by: Shrikanth Hegde Signed-off-by: Vishal Chourasia Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260709092140.1753715-5-vishalc@linux.ibm.com --- arch/powerpc/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig index 650283107b92..da35126d93ac 100644 --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig @@ -281,6 +281,7 @@ config PPC select HAVE_PERF_REGS select HAVE_PERF_USER_STACK_DUMP select HAVE_PREEMPT_DYNAMIC_KEY + select HAVE_POSIX_CPU_TIMERS_TASK_WORK select HAVE_RETHOOK if KPROBES select HAVE_REGS_AND_STACK_ACCESS_API select HAVE_RELIABLE_STACKTRACE From dd6c80abf46a966f839fead7659bda05f80e462b Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Wed, 27 May 2026 02:01:06 +0200 Subject: [PATCH 10/62] powerpc/kexec_file: use snprintf to simplify setup_kdump_cmdline Replace the manual string length accounting, memcpy(), and NUL termination with a single snprintf() call to prepend the elfcorehdr= address and to detect string truncation at the same time. Use kmalloc() to avoid unnecessarily zeroing the memory. While at it, also use "prepending" instead of "appending" in the error message. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260527000105.1081651-3-thorsten.blum@linux.dev --- arch/powerpc/kexec/file_load.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/arch/powerpc/kexec/file_load.c b/arch/powerpc/kexec/file_load.c index 4284f76cbef5..597998235136 100644 --- a/arch/powerpc/kexec/file_load.c +++ b/arch/powerpc/kexec/file_load.c @@ -36,25 +36,19 @@ char *setup_kdump_cmdline(struct kimage *image, char *cmdline, unsigned long cmdline_len) { - int elfcorehdr_strlen; char *cmdline_ptr; - cmdline_ptr = kzalloc(COMMAND_LINE_SIZE, GFP_KERNEL); + cmdline_ptr = kmalloc(COMMAND_LINE_SIZE, GFP_KERNEL); if (!cmdline_ptr) return NULL; - elfcorehdr_strlen = sprintf(cmdline_ptr, "elfcorehdr=0x%lx ", - image->elf_load_addr); - - if (elfcorehdr_strlen + cmdline_len > COMMAND_LINE_SIZE) { - pr_err("Appending elfcorehdr= exceeds cmdline size\n"); + if (snprintf(cmdline_ptr, COMMAND_LINE_SIZE, "elfcorehdr=0x%lx %s", + image->elf_load_addr, cmdline_len ? cmdline : "") >= COMMAND_LINE_SIZE) { + pr_err("Prepending elfcorehdr= exceeds cmdline size\n"); kfree(cmdline_ptr); return NULL; } - memcpy(cmdline_ptr + elfcorehdr_strlen, cmdline, cmdline_len); - // Ensure it's nul terminated - cmdline_ptr[COMMAND_LINE_SIZE - 1] = '\0'; return cmdline_ptr; } From 73dca15a3b813048b01e9c06c260c6508088c2ff Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Thu, 28 May 2026 10:23:58 +0200 Subject: [PATCH 11/62] powerpc/boot: drop redundant assignment in serial_edit_cmdline Drop the redundant buffer assignment in serial_edit_cmdline() since the cp pointer is immediately overwritten. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260528082357.1397611-3-thorsten.blum@linux.dev --- arch/powerpc/boot/serial.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c index c6d32a8c3612..1d221ff420fd 100644 --- a/arch/powerpc/boot/serial.c +++ b/arch/powerpc/boot/serial.c @@ -37,7 +37,6 @@ static void serial_edit_cmdline(char *buf, int len, unsigned int timeout) char ch, *cp; struct serial_console_data *scdp = console_ops.data; - cp = buf; count = strlen(buf); cp = &buf[count]; count++; From c7b7cea42cd4977f95ce520400c9740712b909a2 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Thu, 28 May 2026 22:12:27 +0200 Subject: [PATCH 12/62] powerpc: rtas: use get_user to simplify manage_flash_write Drop the local 10-byte buffer. The old code copied at most 9 bytes from the user buffer, but only the first byte was used to select the RTAS operation. Use get_user() to read the command byte instead and compare it directly with '0' and '1'. Drop the explicit user buffer check, since get_user() will fail on a NULL pointer and correctly return -EFAULT instead of -EINVAL. Remove the now-obsolete string constants as well as any strncmp() and strlen() calls. Return the original count instead of a potentially capped value, since the full user write has been consumed once the command is accepted. Use unsigned int op to better match the manage_flash() interface. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260528201226.1599977-3-thorsten.blum@linux.dev --- arch/powerpc/kernel/rtas_flash.c | 27 ++++++++++----------------- 1 file changed, 10 insertions(+), 17 deletions(-) diff --git a/arch/powerpc/kernel/rtas_flash.c b/arch/powerpc/kernel/rtas_flash.c index 583dc16e9d3c..722dbfb6fbf8 100644 --- a/arch/powerpc/kernel/rtas_flash.c +++ b/arch/powerpc/kernel/rtas_flash.c @@ -394,30 +394,23 @@ static ssize_t manage_flash_write(struct file *file, const char __user *buf, size_t count, loff_t *off) { struct rtas_manage_flash_t *const args_buf = &rtas_manage_flash_data; - static const char reject_str[] = "0"; - static const char commit_str[] = "1"; - char stkbuf[10]; - int op; + unsigned int op; + char cmd; guard(mutex)(&rtas_manage_flash_mutex); if ((args_buf->status == MANAGE_AUTH) || (count == 0)) return count; - op = -1; - if (buf) { - if (count > 9) count = 9; - if (copy_from_user (stkbuf, buf, count)) - return -EFAULT; - if (strncmp(stkbuf, reject_str, strlen(reject_str)) == 0) - op = RTAS_REJECT_TMP_IMG; - else if (strncmp(stkbuf, commit_str, strlen(commit_str)) == 0) - op = RTAS_COMMIT_TMP_IMG; - } - - if (op == -1) { /* buf is empty, or contains invalid string */ + if (get_user(cmd, buf)) + return -EFAULT; + + if (cmd == '0') + op = RTAS_REJECT_TMP_IMG; + else if (cmd == '1') + op = RTAS_COMMIT_TMP_IMG; + else return -EINVAL; - } manage_flash(args_buf, op); return count; From 7cc3d3fdc97fa32f1e1d7b15810e723fe524b0f8 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Fri, 26 Jun 2026 13:07:18 +0200 Subject: [PATCH 13/62] powerpc/pseries: Simplify attribute description check in papr_init() Check only the first byte instead of scanning the entire string with strnlen(). Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260626110718.4367-2-thorsten.blum@linux.dev --- arch/powerpc/platforms/pseries/papr_platform_attributes.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/arch/powerpc/platforms/pseries/papr_platform_attributes.c b/arch/powerpc/platforms/pseries/papr_platform_attributes.c index 9c3758aa54c6..aacdaa1ebf63 100644 --- a/arch/powerpc/platforms/pseries/papr_platform_attributes.c +++ b/arch/powerpc/platforms/pseries/papr_platform_attributes.c @@ -323,12 +323,8 @@ static int __init papr_init(void) } for (idx = 0; idx < num_attrs; idx++) { - bool show_val_desc = true; - /* Do not add the value desc attr if it does not exist */ - if (strnlen(esi_attrs[idx].value_desc, - sizeof(esi_attrs[idx].value_desc)) == 0) - show_val_desc = false; + bool show_val_desc = *esi_attrs[idx].value_desc != '\0'; if (add_attr_group(be64_to_cpu(esi_attrs[idx].id), &papr_groups[idx], From 6a7f74525a9964ef3228f6e1d1af261e92964987 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Sat, 27 Jun 2026 12:47:30 +0200 Subject: [PATCH 14/62] powerpc/rtasd: Use struct_size() to simplify log_rtas_len() Now that struct rtas_error_log uses a flexible array member for the extended log buffer, use struct_size() to calculate the total RTAS error log size and avoid using the hard-coded header size of 8 bytes. Use min() to replace the open-coded implementation while at it. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260627104730.276858-3-thorsten.blum@linux.dev --- arch/powerpc/kernel/rtasd.c | 19 ++++++------------- 1 file changed, 6 insertions(+), 13 deletions(-) diff --git a/arch/powerpc/kernel/rtasd.c b/arch/powerpc/kernel/rtasd.c index 6336ec9aedd0..fd40864bdb70 100644 --- a/arch/powerpc/kernel/rtasd.c +++ b/arch/powerpc/kernel/rtasd.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include @@ -160,25 +161,17 @@ static void printk_log_rtas(char *buf, int len) static int log_rtas_len(char * buf) { - int len; + size_t len; struct rtas_error_log *err; - uint32_t extended_log_length; + u32 extended_log_length; - /* rtas fixed header */ - len = 8; err = (struct rtas_error_log *)buf; - extended_log_length = rtas_error_extended_log_length(err); - if (rtas_error_extended(err) && extended_log_length) { - - /* extended header */ - len += extended_log_length; - } + extended_log_length = rtas_error_extended(err) ? rtas_error_extended_log_length(err) : 0; + len = struct_size(err, buffer, extended_log_length); if (rtas_error_log_max == 0) rtas_error_log_max = rtas_get_error_log_max(); - - if (len > rtas_error_log_max) - len = rtas_error_log_max; + len = min(len, rtas_error_log_max); return len; } From 351496d6aea664f25cbd6411bf5567210328e419 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Sat, 27 Jun 2026 12:47:31 +0200 Subject: [PATCH 15/62] powerpc/pseries/ras: Use struct_size() to simplify fwnmi_get_errinfo() Now that struct rtas_error_log uses a flexible array member for the extended log buffer, use struct_size() to calculate the total RTAS error log size and avoid using the hard-coded header size of 8 bytes. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260627104730.276858-4-thorsten.blum@linux.dev --- arch/powerpc/platforms/pseries/ras.c | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c index adafd593d9d3..7b8713bdd978 100644 --- a/arch/powerpc/platforms/pseries/ras.c +++ b/arch/powerpc/platforms/pseries/ras.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include @@ -440,6 +441,8 @@ static __be64 *fwnmi_get_savep(struct pt_regs *regs) static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) { struct rtas_error_log *h; + u32 extended_log_length; + size_t len; __be64 *savep; savep = fwnmi_get_savep(regs); @@ -449,17 +452,12 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs) regs->gpr[3] = be64_to_cpu(savep[0]); /* restore original r3 */ h = (struct rtas_error_log *)&savep[1]; + extended_log_length = rtas_error_extended(h) ? rtas_error_extended_log_length(h) : 0; + len = struct_size(h, buffer, extended_log_length); + len = min(len, RTAS_ERROR_LOG_MAX); /* Use the per cpu buffer from paca to store rtas error log */ memset(local_paca->mce_data_buf, 0, RTAS_ERROR_LOG_MAX); - if (!rtas_error_extended(h)) { - memcpy(local_paca->mce_data_buf, h, sizeof(__u64)); - } else { - int len, error_log_length; - - error_log_length = 8 + rtas_error_extended_log_length(h); - len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX); - memcpy(local_paca->mce_data_buf, h, len); - } + memcpy(local_paca->mce_data_buf, h, len); return (struct rtas_error_log *)local_paca->mce_data_buf; } From b6cfbfd6b2992e3f34d255c983dc9f20ef0f5cd8 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Wed, 1 Jul 2026 13:44:28 +0200 Subject: [PATCH 16/62] powerpc/dt_cpu_ftrs: Avoid separate strlen() in scan_callback() Check only the first byte instead of scanning the entire string with strlen(). While at it, keep dt_cpu_name static, but move it into dt_cpu_ftrs_scan_callback(), where it is assigned. Signed-off-by: Thorsten Blum Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260701114428.818748-3-thorsten.blum@linux.dev --- arch/powerpc/kernel/dt_cpu_ftrs.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c index e5853daa6a48..1b15e47e5340 100644 --- a/arch/powerpc/kernel/dt_cpu_ftrs.c +++ b/arch/powerpc/kernel/dt_cpu_ftrs.c @@ -90,8 +90,6 @@ static void __restore_cpu_cpufeatures(void) init_pmu_registers(); } -static char dt_cpu_name[64]; - static struct cpu_spec __initdata base_cpu_spec = { .cpu_name = NULL, .cpu_features = CPU_FTRS_DT_CPU_BASE, @@ -1078,6 +1076,7 @@ static int __init count_cpufeatures_subnodes(unsigned long node, static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char *uname, int depth, void *data) { + static char dt_cpu_name[64]; const __be32 *prop; int count, i; u32 isa; @@ -1115,8 +1114,8 @@ static int __init dt_cpu_ftrs_scan_callback(unsigned long node, const char } prop = of_get_flat_dt_prop(node, "display-name", NULL); - if (prop && strlen((char *)prop) != 0) { - strscpy(dt_cpu_name, (char *)prop, sizeof(dt_cpu_name)); + if (prop && *(char *)prop != 0) { + strscpy(dt_cpu_name, (char *)prop); cur_cpu_spec->cpu_name = dt_cpu_name; } From 6050e3196d97c679ea06c035dbb3c64264c01281 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 21 Jul 2026 01:11:53 +0200 Subject: [PATCH 17/62] powerpc/ps3: Use cpu_relax() in ps3_create_spu() Use cpu_relax() to wait for the execution status SPE_EX_STATE_EXECUTED. Drop the comments while at it. Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260720231153.116827-2-thorsten.blum@linux.dev --- arch/powerpc/platforms/ps3/spu.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/platforms/ps3/spu.c b/arch/powerpc/platforms/ps3/spu.c index e4e0b45e1b9d..8545c72385de 100644 --- a/arch/powerpc/platforms/ps3/spu.c +++ b/arch/powerpc/platforms/ps3/spu.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include @@ -363,12 +364,9 @@ static int __init ps3_create_spu(struct spu *spu, void *data) if (result) goto fail_enable; - /* Make sure the spu is in SPE_EX_STATE_EXECUTED. */ - - /* need something better here!!! */ - while (in_be64(&spu_pdata(spu)->shadow->spe_execution_status) - != SPE_EX_STATE_EXECUTED) - (void)0; + while (in_be64(&spu_pdata(spu)->shadow->spe_execution_status) != + SPE_EX_STATE_EXECUTED) + cpu_relax(); return result; From a2144b13a6ec01e2298c88548af2e3f6d1163de6 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 21 Jul 2026 01:14:52 +0200 Subject: [PATCH 18/62] powerpc/powermac: Simplify bootx_scan_dt_build_struct() Assign the empty string directly instead of NULL checking namep again. Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260720231453.117271-2-thorsten.blum@linux.dev --- arch/powerpc/platforms/powermac/bootx_init.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/powerpc/platforms/powermac/bootx_init.c b/arch/powerpc/platforms/powermac/bootx_init.c index 72eb99aba40f..abceae91dfde 100644 --- a/arch/powerpc/platforms/powermac/bootx_init.c +++ b/arch/powerpc/platforms/powermac/bootx_init.c @@ -284,9 +284,7 @@ static void __init bootx_scan_dt_build_struct(unsigned long base, dt_push_token(OF_DT_BEGIN_NODE, mem_end); /* get the node's full name */ - namep = np->full_name ? (char *)(base + np->full_name) : NULL; - if (namep == NULL) - namep = ""; + namep = np->full_name ? (char *)(base + np->full_name) : ""; l = strlen(namep); DBG("* struct: %s\n", namep); From 86bb4d74da626064136d30367d1b35372b8320fb Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 21 Jul 2026 17:53:45 +0200 Subject: [PATCH 19/62] powerpc/powernv: Avoid strlen() in pnv_restart() Check only the first byte instead of scanning the entire string with strlen(). Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260721155346.121975-3-thorsten.blum@linux.dev --- arch/powerpc/platforms/powernv/setup.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c index 06ed5e2aa265..2af92e7ba4ee 100644 --- a/arch/powerpc/platforms/powernv/setup.c +++ b/arch/powerpc/platforms/powernv/setup.c @@ -312,7 +312,7 @@ static void __noreturn pnv_restart(char *cmd) pnv_prepare_going_down(); do { - if (!cmd || !strlen(cmd)) + if (!cmd || *cmd == '\0') rc = opal_cec_reboot(); else if (strcmp(cmd, "full") == 0) rc = opal_cec_reboot2(OPAL_REBOOT_FULL_IPL, NULL); From 903cc6e45401d7f3821758901f229b0b59e4f27c Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 21 Jul 2026 17:53:46 +0200 Subject: [PATCH 20/62] powerpc/pseries: Avoid strlen() in do_{remove,update}_property() Check only the first byte instead of scanning the entire string with strlen(). Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260721155346.121975-4-thorsten.blum@linux.dev --- arch/powerpc/platforms/pseries/reconfig.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c index 7faebcffc9df..18e3f1a036e3 100644 --- a/arch/powerpc/platforms/pseries/reconfig.c +++ b/arch/powerpc/platforms/pseries/reconfig.c @@ -307,7 +307,7 @@ static int do_remove_property(char *buf, size_t bufsize) if (tmp) *tmp = '\0'; - if (strlen(buf) == 0) + if (*buf == '\0') return -EINVAL; return of_remove_property(np, of_find_property(np, buf, NULL)); @@ -330,7 +330,7 @@ static int do_update_property(char *buf, size_t bufsize) if (!next_prop) return -EINVAL; - if (!strlen(name)) + if (*name == '\0') return -ENODEV; newprop = new_property(name, length, value, NULL); From 3b232a0cce4182851ee8f2788180c93e49d9ab96 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Fri, 24 Jul 2026 19:21:58 +0200 Subject: [PATCH 21/62] powerpc/boot: Remove unused sprintf() There have been no sprintf() callers in the boot wrapper since commit e275e023aa69 ("powerpc/44x: Warp patches for the new NDFC driver"). Remove the function definition and declaration. Signed-off-by: Thorsten Blum Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260724172200.208722-2-thorsten.blum@linux.dev --- arch/powerpc/boot/stdio.c | 11 ----------- arch/powerpc/boot/stdio.h | 3 --- 2 files changed, 14 deletions(-) diff --git a/arch/powerpc/boot/stdio.c b/arch/powerpc/boot/stdio.c index 31eece29f56d..b12aa2c0b8e7 100644 --- a/arch/powerpc/boot/stdio.c +++ b/arch/powerpc/boot/stdio.c @@ -326,17 +326,6 @@ int vsprintf(char *buf, const char *fmt, va_list args) return str-buf; } -int sprintf(char * buf, const char *fmt, ...) -{ - va_list args; - int i; - - va_start(args, fmt); - i=vsprintf(buf,fmt,args); - va_end(args); - return i; -} - static char sprint_buf[1024]; int diff --git a/arch/powerpc/boot/stdio.h b/arch/powerpc/boot/stdio.h index 884d5959a9ae..d5a7a0f54453 100644 --- a/arch/powerpc/boot/stdio.h +++ b/arch/powerpc/boot/stdio.h @@ -12,9 +12,6 @@ extern int printf(const char *fmt, ...) __attribute__((format(printf, 1, 2))); #define fprintf(fmt, args...) printf(args) -extern int sprintf(char *buf, const char *fmt, ...) - __attribute__((format(printf, 2, 3))); - extern int vsprintf(char *buf, const char *fmt, va_list args); #endif /* _PPC_BOOT_STDIO_H_ */ From be57ed769406eb2cafd3b98f83ffebd5f703940f Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Thu, 30 Jul 2026 00:38:07 +0200 Subject: [PATCH 22/62] powerpc/serial: Use generic BASE_BAUD in asm/serial.h Include asm-generic/serial.h and use the generic BASE_BAUD definition instead of redefining it. Signed-off-by: Thorsten Blum Reviewed-by: Amit Machhiwal Reviewed-by: Christophe Leroy (CS GROUP) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260729223807.570178-3-thorsten.blum@linux.dev --- arch/powerpc/include/asm/serial.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/include/asm/serial.h b/arch/powerpc/include/asm/serial.h index cd6c18d0e66e..eca0ef56f874 100644 --- a/arch/powerpc/include/asm/serial.h +++ b/arch/powerpc/include/asm/serial.h @@ -9,8 +9,8 @@ * through the device tree. */ -/* Default baud base if not found in device-tree */ -#define BASE_BAUD ( 1843200 / 16 ) +/* Provides BASE_BAUD, used as fallback if not found in device tree. */ +#include #ifdef CONFIG_PPC_UDBG_16550 extern void find_legacy_serial_ports(void); From ca16219e9babc874349a6ac307d56523871a9137 Mon Sep 17 00:00:00 2001 From: "Christophe Leroy (CS GROUP)" Date: Wed, 29 Jul 2026 11:56:48 +0200 Subject: [PATCH 23/62] powerpc: implement get_direction() in cpm2 The lack of get_direction() callback in this driver causes GPIOLIB to emit a warning. Implement it. Fixes: e623c4303ed1 ("gpiolib: sanitize the return value of gpio_chip::get_direction()") Signed-off-by: Christophe Leroy (CS GROUP) Reviewed-by: Bartosz Golaszewski Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/c6eb70aa0e1ba6e15f947c827006aa79edace05c.1785318836.git.chleroy@kernel.org --- arch/powerpc/sysdev/cpm_common.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/arch/powerpc/sysdev/cpm_common.c b/arch/powerpc/sysdev/cpm_common.c index 07ea605ab0e6..b5d200e3ad68 100644 --- a/arch/powerpc/sysdev/cpm_common.c +++ b/arch/powerpc/sysdev/cpm_common.c @@ -181,6 +181,18 @@ static int cpm2_gpio32_dir_in(struct gpio_chip *gc, unsigned int gpio) return 0; } +static int cpm2_gpio32_get_direction(struct gpio_chip *gc, unsigned int gpio) +{ + struct cpm2_gpio32_chip *cpm2_gc = gpiochip_get_data(gc); + struct cpm2_ioports __iomem *iop = cpm2_gc->regs; + u32 pin_mask = 1 << (31 - gpio); + + if (in_be32(&iop->dir) & pin_mask) + return GPIO_LINE_DIRECTION_OUT; + + return GPIO_LINE_DIRECTION_IN; +} + int cpm2_gpiochip_add32(struct device *dev) { struct device_node *np = dev->of_node; @@ -199,6 +211,7 @@ int cpm2_gpiochip_add32(struct device *dev) gc->ngpio = 32; gc->direction_input = cpm2_gpio32_dir_in; gc->direction_output = cpm2_gpio32_dir_out; + gc->get_direction = cpm2_gpio32_get_direction; gc->get = cpm2_gpio32_get; gc->set = cpm2_gpio32_set; gc->parent = dev; From b9254d222d0b38cc6f7b73119fad6316f65278be Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Sat, 16 May 2026 23:37:54 -0700 Subject: [PATCH 24/62] powerpc/44x: Set GPIO chip parent The PPC4xx GPIO driver stopped assigning an explicit parent to the gpio_chip when it moved away from of_mm_gpiochip_add_data(). Restore that association from the platform device so OF GPIO lookup can match phandles to the registered gpiochip. Tested on: Cisco MX60W. No more probe deferral. Assisted-by: Codex:GPT-5.5 Fixes: 1044dbaf2a77 ("powerpc/44x: Change GPIO driver to a proper platform driver") Signed-off-by: Rosen Penev Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260517063754.21819-1-rosenp@gmail.com --- arch/powerpc/platforms/44x/gpio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/platforms/44x/gpio.c b/arch/powerpc/platforms/44x/gpio.c index aea0d913b59d..4413a94cf7a6 100644 --- a/arch/powerpc/platforms/44x/gpio.c +++ b/arch/powerpc/platforms/44x/gpio.c @@ -169,6 +169,7 @@ static int ppc4xx_gpio_probe(struct platform_device *ofdev) gc = &chip->gc; + gc->parent = dev; gc->base = -1; gc->ngpio = 32; gc->direction_input = ppc4xx_gpio_dir_in; From 4cc4b586007fbbf8edba4f1d0849e9a06b0cf6c3 Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Wed, 29 Jul 2026 09:29:46 +0800 Subject: [PATCH 25/62] powerpc/crash: Fix possible memory leak in update_crash_elfcorehdr() In get_crash_memory_ranges(), if crash_exclude_mem_range() failed after realloc_mem_ranges() has successfully allocated the cmem memory, it just returns an error but leaves cmem pointing to the allocated memory, nor is it freed in the caller update_crash_elfcorehdr(), which cause a memory leak, goto out to free the cmem. Fixes: 849599b702ef ("powerpc/crash: add crash memory hotplug support") Reviewed-by: Sourabh Jain Signed-off-by: Jinjie Ruan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260729012948.2797865-2-ruanjinjie@huawei.com --- arch/powerpc/kexec/crash.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kexec/crash.c b/arch/powerpc/kexec/crash.c index e6539f213b3d..a520f851c3a6 100644 --- a/arch/powerpc/kexec/crash.c +++ b/arch/powerpc/kexec/crash.c @@ -502,7 +502,7 @@ static void update_crash_elfcorehdr(struct kimage *image, struct memory_notify * ret = get_crash_memory_ranges(&cmem); if (ret) { pr_err("Failed to get crash mem range\n"); - return; + goto out; } /* From 761eda315a6e1fda3e8e2185b28430771fb1ac29 Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Wed, 29 Jul 2026 09:29:47 +0800 Subject: [PATCH 26/62] powerpc/kexec_file: Fix null-ptr-def in extra size calculation A static Sashiko AI review identified a potential NULL pointer dereference in kexec_extra_fdt_size_ppc64(). On platforms without any reserved memory regions, get_reserved_memory_ranges() can return 0 while leaving 'rmem' unallocated as NULL. Passing it directly leads to a kernel panic when evaluating 'rmem->nr_ranges'. Add a NULL check for 'rmem' to prevent this crash. Cc: stable@vger.kernel.org Fixes: 0d3ff067331e ("powerpc/kexec_file: fix extra size calculation for kexec FDT") Signed-off-by: Jinjie Ruan Reviewed-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260729012948.2797865-3-ruanjinjie@huawei.com --- arch/powerpc/kexec/file_load_64.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kexec/file_load_64.c b/arch/powerpc/kexec/file_load_64.c index 8c72e12ea44e..6075b1c88511 100644 --- a/arch/powerpc/kexec/file_load_64.c +++ b/arch/powerpc/kexec/file_load_64.c @@ -664,7 +664,7 @@ unsigned int kexec_extra_fdt_size_ppc64(struct kimage *image, struct crash_mem * extra_size += (cpu_nodes - boot_cpu_node_count) * cpu_node_size(); /* Consider extra space for reserved memory ranges if any */ - if (rmem->nr_ranges > 0) + if (rmem && rmem->nr_ranges > 0) extra_size += sizeof(struct fdt_reserve_entry) * rmem->nr_ranges; return extra_size + kdump_extra_fdt_size_ppc64(image, cpu_nodes); From fa40f9dbdd4af53e7445d9135b5b207eb8adf372 Mon Sep 17 00:00:00 2001 From: Jinjie Ruan Date: Wed, 29 Jul 2026 09:29:48 +0800 Subject: [PATCH 27/62] powerpc/kexec_file: Prevent kexec range truncation Sashiko AI review pointed out the following issue. The __merge_memory_ranges() function incorrectly handles overlapping memory ranges when merging them. Although sort_memory_ranges() sorts all ranges by their start address in ascending order beforehand, the merge logic remains defective in two ways: 1. It compares the current range's start against the previous element (i-1) instead of the running target index (idx) 2. It unconditionally overwrites 'ranges[idx].end' with 'ranges[i].end'. This logic flaw leads to critical memory truncation when a larger memory range completely subsumes subsequent smaller ranges. For example, consider a sorted input array with three ranges: Range A (idx=0): [0x1000 - 0x9000] Range B (i=1): [0x2000 - 0x5000] (completely inside Range A) Range C (i=2): [0x6000 - 0x8000] (completely inside Range A) 1. When i=1 (Range B): ranges[1].start (0x2000) <= ranges[0].end + 1 (0x9001) is TRUE. The code executes: ranges[0].end = ranges[1].end, which erroneously shrinks Range A's end from 0x9000 down to 0x5000. 2. When i=2 (Range C): ranges[2].start (0x6000) <= ranges[1].end + 1 (0x5001) is FALSE. The code falls into the else block, creating a broken new range. As a result, valid memory fragments [0x5001 - 0x5fff] and [0x8001 - 0x9000] are completely lost from the kexec exclude lists, potentially allowing the crash kernel to overwrite active memory, causing data corruption or crashes. Fix this by ensuring the start of the current range is compared against the end of the active merged range (idx), and use max() to safely prevent the outer boundary from being truncated. Cc: stable@vger.kernel.org Fixes: 180adfc532a8 ("powerpc/kexec_file: Add helper functions for getting memory ranges") Signed-off-by: Jinjie Ruan Reviewed-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260729012948.2797865-4-ruanjinjie@huawei.com --- arch/powerpc/kexec/ranges.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/arch/powerpc/kexec/ranges.c b/arch/powerpc/kexec/ranges.c index 867135560e5c..eb45e89502ca 100644 --- a/arch/powerpc/kexec/ranges.c +++ b/arch/powerpc/kexec/ranges.c @@ -21,6 +21,7 @@ #include #include #include +#include #include #include #include @@ -105,19 +106,16 @@ static void __merge_memory_ranges(struct crash_mem *mem_rngs) struct range *ranges; int i, idx; - if (!mem_rngs) + if (!mem_rngs || mem_rngs->nr_ranges <= 1) return; idx = 0; - ranges = &(mem_rngs->ranges[0]); + ranges = mem_rngs->ranges; for (i = 1; i < mem_rngs->nr_ranges; i++) { - if (ranges[i].start <= (ranges[i-1].end + 1)) - ranges[idx].end = ranges[i].end; + if (ranges[i].start <= (ranges[idx].end + 1)) + ranges[idx].end = max(ranges[idx].end, ranges[i].end); else { idx++; - if (i == idx) - continue; - ranges[idx] = ranges[i]; } } From f068fca7e8b7014014296b0e458ba9c5aa77f954 Mon Sep 17 00:00:00 2001 From: Gou Hao Date: Mon, 27 Jul 2026 18:42:11 +0800 Subject: [PATCH 28/62] powerpc/xive: make xive IPI allocation NULL-safe MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit __GFP_NOFAIL should not be used in new code [1]. xive_init_ipis() allocates the xive_ipis array with __GFP_NOFAIL, which makes the subsequent NULL check unreachable dead code. Remove __GFP_NOFAIL so the allocation can fail, and make all xive_ipis access paths NULL-safe: - Return XIVE_BAD_IRQ from xive_ipi_cpu_to_irq() when xive_ipis is NULL. - Set xive_ipis to NULL after kfree() in the error path to prevent use-after-free. - Guard xive_setup_cpu_ipi() and xive_cleanup_cpu_ipi() against xive_ipi_irq == XIVE_BAD_IRQ to avoid dereferencing an uninitialized or already-freed xive_ipis array. No functional change when allocation succeeds. Link: https://lore.kernel.org/all/20260725202632.dcb325658896a470df91cf57@linux-foundation.org/ [1] Fixes: 7dcc37b3eff9 ("powerpc/xive: Map one IPI interrupt per node") Signed-off-by: Gou Hao Suggested-by: Andrew Morton Suggested-by: Cédric Le Goater Suggested-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Reviewed-by: Cédric Le Goater Reviewed-by: Andrew Morton Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-2-gouhao@uniontech.com --- arch/powerpc/sysdev/xive/common.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c index dadd1f46ec93..86c78af1f68e 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c @@ -74,6 +74,8 @@ static struct xive_ipi_desc { */ static unsigned int xive_ipi_cpu_to_irq(unsigned int cpu) { + if (!xive_ipis) + return XIVE_BAD_IRQ; return xive_ipis[early_cpu_to_node(cpu)].irq; } #endif @@ -1132,8 +1134,7 @@ static int __init xive_init_ipis(void) if (!ipi_domain) goto out_free_fwnode; - xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids, - GFP_KERNEL | __GFP_NOFAIL); + xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids, GFP_KERNEL); if (!xive_ipis) goto out_free_domain; @@ -1158,6 +1159,7 @@ static int __init xive_init_ipis(void) out_free_xive_ipis: kfree(xive_ipis); + xive_ipis = NULL; out_free_domain: irq_domain_remove(ipi_domain); out_free_fwnode: @@ -1190,6 +1192,9 @@ static int xive_setup_cpu_ipi(unsigned int cpu) pr_debug("Setting up IPI for CPU %d\n", cpu); + if (xive_ipi_irq == XIVE_BAD_IRQ) + return -EIO; + xc = per_cpu(xive_cpu, cpu); /* Check if we are already setup */ @@ -1234,6 +1239,9 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc) /* Disable the IPI and free the IRQ data */ + if (xive_ipi_irq == XIVE_BAD_IRQ) + return; + /* Already cleaned up ? */ if (xc->hw_ipi == XIVE_BAD_IRQ) return; From ab5ae5dceb86614f6c9e7488f91b652000edfdc5 Mon Sep 17 00:00:00 2001 From: Gou Hao Date: Mon, 27 Jul 2026 18:42:12 +0800 Subject: [PATCH 29/62] powerpc/xive: add error return value to xive_smp_probe() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit xive_smp_probe() calls xive_init_ipis() which can fail, but its return value is currently ignored. Change xive_smp_probe() to return int so that errors can be propagated to callers. This is a preparatory patch for the next one. No functional change yet; the return value is always 0 at this point. Signed-off-by: Gou Hao Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-3-gouhao@uniontech.com --- arch/powerpc/include/asm/xive.h | 4 ++-- arch/powerpc/sysdev/xive/common.c | 4 +++- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/include/asm/xive.h b/arch/powerpc/include/asm/xive.h index efb0f5effcc6..4e3e3358993c 100644 --- a/arch/powerpc/include/asm/xive.h +++ b/arch/powerpc/include/asm/xive.h @@ -91,7 +91,7 @@ static inline bool xive_enabled(void) { return __xive_enabled; } bool xive_spapr_init(void); bool xive_native_init(void); -void xive_smp_probe(void); +int xive_smp_probe(void); int xive_smp_prepare_cpu(unsigned int cpu); void xive_smp_setup_cpu(void); void xive_smp_disable_cpu(void); @@ -153,7 +153,7 @@ static inline bool xive_enabled(void) { return false; } static inline bool xive_spapr_init(void) { return false; } static inline bool xive_native_init(void) { return false; } -static inline void xive_smp_probe(void) { } +static inline int xive_smp_probe(void) { return -EINVAL; } static inline int xive_smp_prepare_cpu(unsigned int cpu) { return -EINVAL; } static inline void xive_smp_setup_cpu(void) { } static inline void xive_smp_disable_cpu(void) { } diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c index 86c78af1f68e..9f80c16be23f 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c @@ -1265,7 +1265,7 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc) xive_ops->put_ipi(cpu, xc); } -void __init xive_smp_probe(void) +int __init xive_smp_probe(void) { smp_ops->cause_ipi = xive_cause_ipi; @@ -1274,6 +1274,8 @@ void __init xive_smp_probe(void) /* Allocate and setup IPI for the boot CPU */ xive_setup_cpu_ipi(smp_processor_id()); + + return 0; } #endif /* CONFIG_SMP */ From 411a3c016e7a95f5fa105a0587e07d0647a77727 Mon Sep 17 00:00:00 2001 From: Gou Hao Date: Mon, 27 Jul 2026 18:42:13 +0800 Subject: [PATCH 30/62] powerpc/xive: propagate IPI init errors to prevent use-after-free MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free. Now that xive_smp_probe() returns int (previous patch), propagate the error from xive_init_ipis() and xive_setup_cpu_ipi() through xive_smp_probe(). Check the return value in both pnv_smp_probe() and pSeries_smp_probe() so that IPI setup is aborted cleanly on failure, avoiding the use-after-free. Fixes: 243e25112d06 ("powerpc/xive: Native exploitation of the XIVE interrupt controller") Fixes: cbc06f051c52 ("powerpc/xive: Do not skip CPU-less nodes when creating the IPIs") Signed-off-by: Gou Hao Reviewed-by: Wentao Guan Reviewed-by: jiazhenyuan Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-4-gouhao@uniontech.com --- arch/powerpc/platforms/powernv/smp.c | 8 +++++--- arch/powerpc/platforms/pseries/smp.c | 8 +++++--- arch/powerpc/sysdev/xive/common.c | 10 ++++++---- 3 files changed, 16 insertions(+), 10 deletions(-) diff --git a/arch/powerpc/platforms/powernv/smp.c b/arch/powerpc/platforms/powernv/smp.c index 8f41ef364fc6..b1201dbafcaf 100644 --- a/arch/powerpc/platforms/powernv/smp.c +++ b/arch/powerpc/platforms/powernv/smp.c @@ -332,10 +332,12 @@ static void pnv_cause_ipi(int cpu) static void __init pnv_smp_probe(void) { - if (xive_enabled()) - xive_smp_probe(); - else + if (xive_enabled()) { + if (xive_smp_probe() < 0) + return; + } else { xics_smp_probe(); + } if (cpu_has_feature(CPU_FTR_DBELL)) { ic_cause_ipi = smp_ops->cause_ipi; diff --git a/arch/powerpc/platforms/pseries/smp.c b/arch/powerpc/platforms/pseries/smp.c index db99725e752b..14cd0634eeca 100644 --- a/arch/powerpc/platforms/pseries/smp.c +++ b/arch/powerpc/platforms/pseries/smp.c @@ -194,10 +194,12 @@ static int pseries_cause_nmi_ipi(int cpu) static __init void pSeries_smp_probe(void) { - if (xive_enabled()) - xive_smp_probe(); - else + if (xive_enabled()) { + if (xive_smp_probe() < 0) + return; + } else { xics_smp_probe(); + } /* No doorbell facility, must use the interrupt controller for IPIs */ if (!cpu_has_feature(CPU_FTR_DBELL)) diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c index 9f80c16be23f..bbe7c85274ea 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c @@ -1267,15 +1267,17 @@ noinstr static void xive_cleanup_cpu_ipi(unsigned int cpu, struct xive_cpu *xc) int __init xive_smp_probe(void) { + int ret; + smp_ops->cause_ipi = xive_cause_ipi; /* Register the IPI */ - xive_init_ipis(); + ret = xive_init_ipis(); + if (ret < 0) + return ret; /* Allocate and setup IPI for the boot CPU */ - xive_setup_cpu_ipi(smp_processor_id()); - - return 0; + return xive_setup_cpu_ipi(smp_processor_id()); } #endif /* CONFIG_SMP */ From 37d401c9c4b89c3c193726e177493ef06c657f40 Mon Sep 17 00:00:00 2001 From: Gou Hao Date: Mon, 27 Jul 2026 18:42:14 +0800 Subject: [PATCH 31/62] powerpc/xive: defer setting cause_ipi until IPI init succeeds MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit xive_smp_probe() currently assigns smp_ops->cause_ipi = xive_cause_ipi before calling xive_init_ipis() and xive_setup_cpu_ipi(). If either call fails, the platform probe handler returns early but cause_ipi remains pointing to xive_cause_ipi -- which accesses per-cpu IPI data (xc->ipi_data) that was never properly initialized, leading to a WARN and a crash. Move the cause_ipi assignment to after both calls succeed, so that smp_ops->cause_ipi is only set when the IPI subsystem is fully initialized. Signed-off-by: Gou Hao Suggested-by: Cédric Le Goater Reviewed-by: jiazhenyuan Reviewed-by: Cédric Le Goater Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-5-gouhao@uniontech.com --- arch/powerpc/sysdev/xive/common.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c index bbe7c85274ea..8ae088632337 100644 --- a/arch/powerpc/sysdev/xive/common.c +++ b/arch/powerpc/sysdev/xive/common.c @@ -1269,15 +1269,19 @@ int __init xive_smp_probe(void) { int ret; - smp_ops->cause_ipi = xive_cause_ipi; - /* Register the IPI */ ret = xive_init_ipis(); if (ret < 0) return ret; /* Allocate and setup IPI for the boot CPU */ - return xive_setup_cpu_ipi(smp_processor_id()); + ret = xive_setup_cpu_ipi(smp_processor_id()); + if (ret < 0) + return ret; + + smp_ops->cause_ipi = xive_cause_ipi; + + return 0; } #endif /* CONFIG_SMP */ From 5aabc192702defb8950e7c81b05c3f4ca8ee43ec Mon Sep 17 00:00:00 2001 From: Gou Hao Date: Mon, 27 Jul 2026 18:42:15 +0800 Subject: [PATCH 32/62] powerpc/smp: add NULL guard for cause_ipi in smp_muxed_ipi_message_pass smp_muxed_ipi_message_pass() calls smp_ops->cause_ipi() without checking whether it has been set. On platforms using muxed IPI (e.g. powernv/pseries), smp_ops->cause_ipi is initialized to NULL in the static smp_ops and only assigned during the platform smp_probe() handler. If the IPI subsystem fails to initialize -- for example when xive_init_ipis() fails and xive_smp_probe() returns an error -- the probe handler returns early and cause_ipi is never set. Any subsequent IPI send (e.g. arch_smp_send_reschedule()) would dereference the NULL pointer. Add a NULL check to avoid the crash in that situation. Fixes: 23d72bfd8f9f ("powerpc: Consolidate ipi message mux and demux") Signed-off-by: Gou Hao Reviewed-by: jiazhenyuan Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727104215.184786-6-gouhao@uniontech.com --- arch/powerpc/kernel/smp.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/arch/powerpc/kernel/smp.c b/arch/powerpc/kernel/smp.c index 3467f86fd78f..6a5a5469aaae 100644 --- a/arch/powerpc/kernel/smp.c +++ b/arch/powerpc/kernel/smp.c @@ -289,6 +289,9 @@ void smp_muxed_ipi_set_message(int cpu, int msg) void smp_muxed_ipi_message_pass(int cpu, int msg) { + if (!smp_ops->cause_ipi) + return; + smp_muxed_ipi_set_message(cpu, msg); /* From 884ea0283f4effac97ee8f451464a7d1be480d7c Mon Sep 17 00:00:00 2001 From: Amit Machhiwal Date: Tue, 14 Jul 2026 23:24:32 +0530 Subject: [PATCH 33/62] KVM: PPC: Book3S HV: Validate arch_compat against host compatibility mode On IBM POWER systems, newer processor generations can operate in compatibility modes corresponding to earlier generations. This becomes relevant for nested virtualization, where nested KVM guests may need to run with a specific processor compatibility level. Currently, when running a nested KVM guest (L2) inside a Power11 pSeries logical partition (L1) booted in Power10 compatibility mode, the guest fails to boot while setting 'arch_compat'. This happens because the CPU class is derived from the hardware PVR (via mfspr()), which reflects the physical processor generation (Power11), rather than the effective compatibility mode (Power10). As a result, userspace may request a Power11 arch_compat for the L2 guest. However, the L1 partition, running in Power10 compatibility, has only negotiated support up to Power10 with the Power Hypervisor (L0). When H_GUEST_SET_STATE is invoked with a Power11 Logical PVR, the hypervisor rejects the request, leading to a late guest boot failure: KVM-NESTEDv2: couldn't set guest wide elements [..KVM reg dump..] This situation should be detected earlier and rejected by KVM. Without proper validation, if userspace ignores the error, the guest may continue to boot in Power11 raw mode on a Power10 compatibility host, which should not be allowed. Introduce a validation mechanism that detects unsupported arch_compat values early in the guest initialization path. When an unsupported arch_compat is requested (e.g., Power11 on a Power10 compatibility mode host), kvmppc_set_arch_compat() uses cpu_has_feature(CPU_FTR_P11_PVR) to detect the mismatch and sets arch_compat to PVR_ARCH_INVALID (0xffffffff). This sentinel value is architecturally safe: PAPR specifies that valid logical PVR values must have 0x0f as the first byte, ensuring 0xffffffff lies permanently outside the specification-defined range. Setting this value triggers kvmppc_sanity_check() to mark the vCPU as invalid by setting vcpu->arch.sane to false. On the next vCPU run, kvmppc_vcpu_run_hv() checks this flag and returns -EINVAL, preventing the guest from running with an invalid processor compatibility configuration. With this, when a Power11 arch_compat is requested on a Power10 compatibility mode host, the guest fails early during boot with: error: kvm run failed Invalid argument This provides a much clearer failure mode compared to the previous behavior where the guest could boot in Power11 raw mode (if userspace ignored the error) or fail late during H_GUEST_SET_STATE. Suggested-by: Vaibhav Jain Reviewed-by: Vaibhav Jain Tested-by: Anushree Mathur Acked-by: Gautam Menghani Cc: stable@vger.kernel.org # v6.13+ Reviewed-by: Ritesh Harjani (IBM) Reviewed-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260714175432.86388-1-amachhiw@linux.ibm.com --- arch/powerpc/include/asm/reg.h | 12 ++++++++++++ arch/powerpc/kvm/book3s_hv.c | 15 ++++++++++++++- arch/powerpc/kvm/powerpc.c | 6 ++++++ 3 files changed, 32 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h index 3449dd2b577d..b9ab9df1e2bc 100644 --- a/arch/powerpc/include/asm/reg.h +++ b/arch/powerpc/include/asm/reg.h @@ -1357,6 +1357,18 @@ #define PVR_ARCH_31 0x0f000006 #define PVR_ARCH_31_P11 0x0f000007 +/* + * Kernel-internal sentinel for invalid processor compatibility modes. + * PAPR specifies that the first byte of a valid logical PVR value is + * 0x0f. So 0xffffffff lies permanently outside the PAPR-defined range + * and is safe to repurpose. KVM stores it in vcpu->arch.arch_compat + * when userspace requests an unsupported compatibility mode (e.g., + * Power11 PVR on a Power11 host booted in Power10 compat). + * kvmppc_sanity_check() detects this and prevents the vCPU from + * running with an unsupported arch_compat. + */ +#define PVR_ARCH_INVALID 0xffffffff + /* Macros for setting and retrieving special purpose registers */ #ifndef __ASSEMBLER__ diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c index 3cfe9a7be9c6..15b422861894 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c @@ -446,7 +446,19 @@ static int kvmppc_set_arch_compat(struct kvm_vcpu *vcpu, u32 arch_compat) guest_pcr_bit = PCR_ARCH_300; break; case PVR_ARCH_31: + guest_pcr_bit = PCR_ARCH_31; + break; case PVR_ARCH_31_P11: + /* + * Need to check this for ISA 3.1, as Power10 and + * Power11 share the same PCR. For any subsequent ISA + * versions, this will be taken care of by the guest vs + * host PCR comparison below. + */ + if (!cpu_has_feature(CPU_FTR_P11_PVR)) { + arch_compat = PVR_ARCH_INVALID; + goto out; + } guest_pcr_bit = PCR_ARCH_31; break; default: @@ -469,6 +481,7 @@ static int kvmppc_set_arch_compat(struct kvm_vcpu *vcpu, u32 arch_compat) return -EINVAL; } +out: spin_lock(&vc->lock); vc->arch_compat = arch_compat; kvmhv_nestedv2_mark_dirty(vcpu, KVMPPC_GSID_LOGICAL_PVR); @@ -479,7 +492,7 @@ static int kvmppc_set_arch_compat(struct kvm_vcpu *vcpu, u32 arch_compat) vc->pcr = (host_pcr_bit - guest_pcr_bit) | PCR_MASK; spin_unlock(&vc->lock); - return 0; + return kvmppc_sanity_check(vcpu); } static void kvmppc_dump_regs(struct kvm_vcpu *vcpu) diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c index be5e48ae0c6c..7ae1aa674d4c 100644 --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -277,6 +277,12 @@ int kvmppc_sanity_check(struct kvm_vcpu *vcpu) if (!vcpu->arch.pvr) goto out; +#if defined(CONFIG_KVM_BOOK3S_HV_POSSIBLE) + if (vcpu->arch.vcore && + vcpu->arch.vcore->arch_compat == PVR_ARCH_INVALID) + goto out; +#endif + /* PAPR only works with book3s_64 */ if ((vcpu->arch.cpu_type != KVM_CPU_3S_64) && vcpu->arch.papr_enabled) goto out; From 516a254918453ec99660201263d01189c082332c Mon Sep 17 00:00:00 2001 From: Sourabh Jain Date: Mon, 27 Jul 2026 11:04:14 +0530 Subject: [PATCH 34/62] powerpc/pseries: Move H_WATCHDOG definitions to a common header The H_WATCHDOG input and output definitions are currently local to the pseries watchdog driver. The next patch in this series also needs these definitions to issue H_WATCHDOG hypercalls outside the watchdog driver. Move the H_WATCHDOG definitions to a new common header, asm/papr-watchdog.h, so they can be shared without duplicating the PAPR watchdog definitions. No functional changes. Cc: stable@vger.kernel.org Suggested-by: Ritesh Harjani (IBM) Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727053416.276317-2-sourabhjain@linux.ibm.com --- arch/powerpc/include/asm/papr-watchdog.h | 58 ++++++++++++++++++++++++ drivers/watchdog/pseries-wdt.c | 53 +--------------------- 2 files changed, 59 insertions(+), 52 deletions(-) create mode 100644 arch/powerpc/include/asm/papr-watchdog.h diff --git a/arch/powerpc/include/asm/papr-watchdog.h b/arch/powerpc/include/asm/papr-watchdog.h new file mode 100644 index 000000000000..308ffb73932d --- /dev/null +++ b/arch/powerpc/include/asm/papr-watchdog.h @@ -0,0 +1,58 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ + +#ifndef _ASM_POWERPC_PAPR_WATCHDOG_H +#define _ASM_POWERPC_PAPR_WATCHDOG_H + +/* + * H_WATCHDOG Input + * + * R4: "flags": + * + * Bits 48-55: "operation" + */ +#define PSERIES_WDTF_OP_START 0x100UL /* start timer */ +#define PSERIES_WDTF_OP_STOP 0x200UL /* stop timer */ +#define PSERIES_WDTF_OP_QUERY 0x300UL /* query timer capabilities */ + +/* + * Bits 56-63: "timeoutAction" (for "Start Watchdog" only) + */ +#define PSERIES_WDTF_ACTION_HARD_POWEROFF 0x1UL /* poweroff */ +#define PSERIES_WDTF_ACTION_HARD_RESTART 0x2UL /* restart */ +#define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */ + +/* + * H_WATCHDOG Output + * + * R3: Return code + * + * H_SUCCESS The operation completed. + * + * H_BUSY The hypervisor is too busy; retry the operation. + * + * H_PARAMETER The given "flags" are somehow invalid. Either the + * "operation" or "timeoutAction" is invalid, or a + * reserved bit is set. + * + * H_P2 The given "watchdogNumber" is zero or exceeds the + * supported maximum value. + * + * H_P3 The given "timeoutInMs" is below the supported + * minimum value. + * + * H_NOOP The given "watchdogNumber" is already stopped. + * + * H_HARDWARE The operation failed for ineffable reasons. + * + * H_FUNCTION The H_WATCHDOG hypercall is not supported by this + * hypervisor. + * + * R4: + * + * - For the "Query Watchdog Capabilities" operation, a 64-bit + * structure: + */ +#define PSERIES_WDTQ_MIN_TIMEOUT(cap) (((cap) >> 48) & 0xffff) +#define PSERIES_WDTQ_MAX_NUMBER(cap) (((cap) >> 32) & 0xffff) + +#endif /* _ASM_POWERPC_PAPR_WATCHDOG_H */ diff --git a/drivers/watchdog/pseries-wdt.c b/drivers/watchdog/pseries-wdt.c index 48d67f7c972a..e97b943e1d3c 100644 --- a/drivers/watchdog/pseries-wdt.c +++ b/drivers/watchdog/pseries-wdt.c @@ -12,61 +12,10 @@ #include #include #include +#include #define DRV_NAME "pseries-wdt" -/* - * H_WATCHDOG Input - * - * R4: "flags": - * - * Bits 48-55: "operation" - */ -#define PSERIES_WDTF_OP_START 0x100UL /* start timer */ -#define PSERIES_WDTF_OP_STOP 0x200UL /* stop timer */ -#define PSERIES_WDTF_OP_QUERY 0x300UL /* query timer capabilities */ - -/* - * Bits 56-63: "timeoutAction" (for "Start Watchdog" only) - */ -#define PSERIES_WDTF_ACTION_HARD_POWEROFF 0x1UL /* poweroff */ -#define PSERIES_WDTF_ACTION_HARD_RESTART 0x2UL /* restart */ -#define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */ - -/* - * H_WATCHDOG Output - * - * R3: Return code - * - * H_SUCCESS The operation completed. - * - * H_BUSY The hypervisor is too busy; retry the operation. - * - * H_PARAMETER The given "flags" are somehow invalid. Either the - * "operation" or "timeoutAction" is invalid, or a - * reserved bit is set. - * - * H_P2 The given "watchdogNumber" is zero or exceeds the - * supported maximum value. - * - * H_P3 The given "timeoutInMs" is below the supported - * minimum value. - * - * H_NOOP The given "watchdogNumber" is already stopped. - * - * H_HARDWARE The operation failed for ineffable reasons. - * - * H_FUNCTION The H_WATCHDOG hypercall is not supported by this - * hypervisor. - * - * R4: - * - * - For the "Query Watchdog Capabilities" operation, a 64-bit - * structure: - */ -#define PSERIES_WDTQ_MIN_TIMEOUT(cap) (((cap) >> 48) & 0xffff) -#define PSERIES_WDTQ_MAX_NUMBER(cap) (((cap) >> 32) & 0xffff) - static const unsigned long pseries_wdt_action[] = { [0] = PSERIES_WDTF_ACTION_HARD_POWEROFF, [1] = PSERIES_WDTF_ACTION_HARD_RESTART, From e65b526affa621b50646cafdf6b06505af07032e Mon Sep 17 00:00:00 2001 From: Sourabh Jain Date: Mon, 27 Jul 2026 11:04:15 +0530 Subject: [PATCH 35/62] powerpc/pseries: Handle and log pseries-wdt registration failures The pseries watchdog initialization registers the pseries-wdt platform device using platform_device_register_simple(), but currently ignores its return value. Check the returned pointer for errors, log a descriptive error message when registration fails, and propagate the failure code to the caller. This avoids silently ignoring platform device registration failures. Cc: stable@vger.kernel.org Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727053416.276317-3-sourabhjain@linux.ibm.com --- arch/powerpc/platforms/pseries/setup.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index 1223dc961242..aed12412c600 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -191,8 +191,18 @@ static void __init fwnmi_init(void) */ static __init int pseries_wdt_init(void) { - if (firmware_has_feature(FW_FEATURE_WATCHDOG)) - platform_device_register_simple("pseries-wdt", 0, NULL, 0); + struct platform_device *pdev; + + if (!firmware_has_feature(FW_FEATURE_WATCHDOG)) + return 0; + + pdev = platform_device_register_simple("pseries-wdt", 0, NULL, 0); + + if (IS_ERR(pdev)) { + pr_err("Failed to register pseries-wdt platform device\n"); + return PTR_ERR(pdev); + } + return 0; } machine_subsys_initcall(pseries, pseries_wdt_init); From fb43ba4256543ce18ca0540fc37022bda438a293 Mon Sep 17 00:00:00 2001 From: Sourabh Jain Date: Mon, 27 Jul 2026 11:04:16 +0530 Subject: [PATCH 36/62] powerpc/crash: stop watchdogs before booting kdump kernel On pseries LPAR systems, watchdog timers configured from userspace can remain active after a kernel panic. When a panic triggers kdump, the crashing kernel jumps directly to the kdump kernel without stopping active watchdogs. As a result, the watchdogs remain active after the kdump kernel starts. If dump capture takes longer than the watchdog timeout, PHYP resets the LPAR before the dump is fully captured, causing dump capture to fail. Fix this by issuing the `H_WATCHDOG` hcall during the crash shutdown sequence to stop all active watchdogs before booting the kdump kernel. Cc: stable@vger.kernel.org Fixes: 69472ffa6575 ("watchdog/pseries-wdt: initial support for H_WATCHDOG-based watchdog timers") Reported-by: Mahesh Kumar G Suggested-by: Ritesh Harjani (IBM) Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Sourabh Jain Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260727053416.276317-4-sourabhjain@linux.ibm.com --- arch/powerpc/include/asm/papr-watchdog.h | 6 ++++++ arch/powerpc/platforms/pseries/setup.c | 14 ++++++++++++++ 2 files changed, 20 insertions(+) diff --git a/arch/powerpc/include/asm/papr-watchdog.h b/arch/powerpc/include/asm/papr-watchdog.h index 308ffb73932d..bf876fc2caae 100644 --- a/arch/powerpc/include/asm/papr-watchdog.h +++ b/arch/powerpc/include/asm/papr-watchdog.h @@ -21,6 +21,12 @@ #define PSERIES_WDTF_ACTION_HARD_RESTART 0x2UL /* restart */ #define PSERIES_WDTF_ACTION_DUMP_RESTART 0x3UL /* dump + restart */ +/* + * R5: "watchdogNumber": + * PAPR says use -1 (all ones) to stop all watchdogs. + */ +#define PSERIES_WDT_NUM_ALL ((unsigned long)-1) + /* * H_WATCHDOG Output * diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c index aed12412c600..f29e7547c995 100644 --- a/arch/powerpc/platforms/pseries/setup.c +++ b/arch/powerpc/platforms/pseries/setup.c @@ -77,6 +77,7 @@ #include #include #include +#include #include "pseries.h" @@ -185,6 +186,16 @@ static void __init fwnmi_init(void) #endif } +static void pseries_crash_stop_watchdogs(void) +{ + long rc; + + rc = plpar_hcall_norets_notrace(H_WATCHDOG, PSERIES_WDTF_OP_STOP, + PSERIES_WDT_NUM_ALL); + if (rc != H_SUCCESS && rc != H_NOOP) + pr_warn("Could not stop watchdogs before kdump rc=%ld\n", rc); +} + /* * Affix a device for the first timer to the platform bus if * we have firmware support for the H_WATCHDOG hypercall. @@ -203,6 +214,9 @@ static __init int pseries_wdt_init(void) return PTR_ERR(pdev); } + if (crash_shutdown_register(pseries_crash_stop_watchdogs)) + pr_warn("Could not register watchdog crash shutdown handler\n"); + return 0; } machine_subsys_initcall(pseries, pseries_wdt_init); From 69cb2be898be6d5826cacd1a628f6945a24480b6 Mon Sep 17 00:00:00 2001 From: "Mukesh Kumar Chaurasiya (IBM)" Date: Fri, 31 Jul 2026 13:45:21 +0530 Subject: [PATCH 37/62] powerpc/syscall: Fix syscall skip handling for seccomp and ptrace MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit After enabling GENERIC_ENTRY on PowerPC, syscall_enter_from_user_mode() returns -1 as a sentinel to signal that seccomp or ptrace has intercepted the syscall and already set a return value via syscall_set_return_value(). system_call_exception() was not handling this sentinel, and since -1UL is >= NR_syscalls, the code fell into the out-of-range path and returned -ENOSYS, overwriting the errno already placed in regs->gpr[3]. The naive fix of checking r0 == -1L before the NR_syscalls bounds check is ambiguous: a user legitimately calling syscall(-1) also produces r0 == -1L, and a tracer intercepting such a call would have its injected return value silently discarded. Fix this by introducing a thread flag that is set whenever syscall_set_return_value() explicitly updates the return value. In system_call_exception(), check and clear this flag before dispatching the syscall, and return the preset value directly when it is present. This ensures that an explicitly supplied return value always suppresses syscall execution, regardless of the syscall number. This handles all seccomp actions correctly: - SECCOMP_RET_ERRNO, SECCOMP_RET_TRACE (no tracer), SECCOMP_RET_USER_NOTIF: all call syscall_set_return_value(), flag is set, injected value returned. - SECCOMP_RET_TRAP, SECCOMP_RET_KILL: call syscall_rollback() and deliver a signal; flag is not set, but the process is dying so the return value is irrelevant. The fix covers both ppc32 and ppc64 with no #ifdefs. Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") Reported-by: Michal Suchánek Closes: https://lore.kernel.org/all/ajpp-_XnbF3UTM_E@kunlun.suse.cz/ Tested-by: Michal Suchánek Reviewed-by: Michal Suchánek Signed-off-by: Mukesh Kumar Chaurasiya (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260731081521.1852133-1-mkchauras@gmail.com --- arch/powerpc/include/asm/syscall.h | 6 ++++++ arch/powerpc/include/asm/thread_info.h | 1 + arch/powerpc/kernel/syscall.c | 3 +++ 3 files changed, 10 insertions(+) diff --git a/arch/powerpc/include/asm/syscall.h b/arch/powerpc/include/asm/syscall.h index 834fcc4f7b54..19d1739af0b7 100644 --- a/arch/powerpc/include/asm/syscall.h +++ b/arch/powerpc/include/asm/syscall.h @@ -98,6 +98,12 @@ static inline void syscall_set_return_value(struct task_struct *task, regs->gpr[3] = val; } } + /* + * Mark that a return value has been explicitly set by seccomp or + * ptrace so that system_call_exception() can skip the syscall + * unconditionally, even when the user requested syscall(-1). + */ + set_thread_flag(TIF_SYSCALL_RET); } static inline void syscall_get_arguments(struct task_struct *task, diff --git a/arch/powerpc/include/asm/thread_info.h b/arch/powerpc/include/asm/thread_info.h index ee3b9adb5b67..bf08b476fb3b 100644 --- a/arch/powerpc/include/asm/thread_info.h +++ b/arch/powerpc/include/asm/thread_info.h @@ -119,6 +119,7 @@ void arch_setup_new_exec(void); #endif #define TIF_POLLING_NRFLAG 19 /* true if poll_idle() is polling TIF_NEED_RESCHED */ #define TIF_32BIT 20 /* 32 bit binary */ +#define TIF_SYSCALL_RET 21 /* syscall error value set */ /* as above, but as bit values */ #define _TIF_SYSCALL_TRACE (1<= NR_syscalls)) { if (unlikely(trap_is_unsupported_scv(regs))) { /* Unsupported scv vector */ From e8ee988c0087248324dbd3da486d22045e4a4079 Mon Sep 17 00:00:00 2001 From: Madhavan Srinivasan Date: Thu, 30 Jul 2026 11:16:02 +0530 Subject: [PATCH 38/62] powerpc64/bpf: Fix build break in bpf_jit_emit_func_call_rel() With CONFIG_PPC_KERNEL_PCREL enabled, build breaks with below error: CC mm/dmapool.o CC fs/readdir.o arch/powerpc/net/bpf_jit_comp64.c: In function 'bpf_jit_emit_func_call_rel': arch/powerpc/net/bpf_jit_comp64.c:475:13: error: unused variable 'ret' [-Werror=unused-variable] 475 | int ret; | ^~~ Commit b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") introduced "ret" at function scope, but it is only used within its respective conditional blocks. Same holds true for reladdr. Move both variable declarations to the scopes where they are actually used: "reladdr" to the CONFIG_PPC_KERNEL_PCREL block and "ret" to the non-PCREL else block. Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") Signed-off-by: Saket Kumar Bhaskar Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/e8e582fb425db165a72f00e3337cdf4c6ae383ad.1785387718.git.skb99@linux.ibm.com --- arch/powerpc/net/bpf_jit_comp64.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c index dab106cae22b..fc9db691e820 100644 --- a/arch/powerpc/net/bpf_jit_comp64.c +++ b/arch/powerpc/net/bpf_jit_comp64.c @@ -471,8 +471,6 @@ static int bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 f int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context *ctx, u64 func) { unsigned long func_addr = func ? ppc_function_entry((void *)func) : 0; - long __maybe_unused reladdr; - int ret; /* bpf to bpf call, func is not known in the initial pass. Emit 5 nops as a placeholder */ if (!func) { @@ -487,6 +485,8 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context * } #ifdef CONFIG_PPC_KERNEL_PCREL + long reladdr; + reladdr = func_addr - local_paca->kernelbase; /* @@ -525,7 +525,7 @@ int bpf_jit_emit_func_call_rel(u32 *image, u32 *fimage, struct codegen_context * EMIT(PPC_RAW_BCTRL()); #else if (core_kernel_text(func_addr)) { - ret = bpf_jit_emit_func_call(image, ctx, func_addr, _R12); + int ret = bpf_jit_emit_func_call(image, ctx, func_addr, _R12); if (ret) return ret; } else { From e1e5e682511eda648aa91372542cc8f665ad0bff Mon Sep 17 00:00:00 2001 From: Saket Kumar Bhaskar Date: Thu, 30 Jul 2026 11:16:03 +0530 Subject: [PATCH 39/62] powerpc64/bpf: Fix build break for arch_bpf_timed_may_goto With CONFIG_PPC_KERNEL_PCREL enabled, calling bpf_check_timed_may_goto() using a bl instruction results in a link-time failure: arch/powerpc/net/bpf_timed_may_goto.o: in function `arch_bpf_timed_may_goto': (.text+0x28): call to `bpf_check_timed_may_goto' lacks nop, can't restore toc Use CFUNC() macro instead of direct 'bl' to properly annotate the call to bpf_check_timed_may_goto(). On PCREL builds, CFUNC() expands to 'bl name@notoc', informing the linker that TOC restoration is not needed, avoiding the "lacks nop, can't restore toc" linker error. Fixes: b55b6b9ad76c ("powerpc64/bpf: Add powerpc64 JIT support for timed may_goto") Signed-off-by: Saket Kumar Bhaskar Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/f75e5aa911afb984a94c0e85d58b1be5fb428548.1785387718.git.skb99@linux.ibm.com --- arch/powerpc/net/bpf_timed_may_goto.S | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/net/bpf_timed_may_goto.S b/arch/powerpc/net/bpf_timed_may_goto.S index 6fd8b1c9f4ac..84ecf6fa7f5d 100644 --- a/arch/powerpc/net/bpf_timed_may_goto.S +++ b/arch/powerpc/net/bpf_timed_may_goto.S @@ -36,7 +36,7 @@ SYM_FUNC_START(arch_bpf_timed_may_goto) * BPF_REG_FP is r31; BPF_REG_AX is r12 (stack offset in bytes). */ add r3, r31, r12 - bl bpf_check_timed_may_goto + bl CFUNC(bpf_check_timed_may_goto) /* Put return value back into AX */ mr r12, r3 From 00be69070d91d2be978e752bb117a0a4db0e1281 Mon Sep 17 00:00:00 2001 From: Saket Kumar Bhaskar Date: Mon, 3 Aug 2026 10:58:43 +0530 Subject: [PATCH 40/62] powerpc/irq: Fix missing r2 clobber in PCREL inline assembly In CONFIG_PPC_KERNEL_PCREL mode, r2 is no longer reserved for the TOC pointer and is available as a caller-saved register [0]. Both call_do_irq() and call_do_softirq() use inline assembly to call functions with stack switching, but fail to list r2 in their clobber lists. This causes the compiler to assume r2 is preserved across these calls, leading to register corruption when the called functions (__do_irq and __do_softirq) clobber r2. As a result of this kernel crash during interrupt handling is seen and the kernel fails to boot: BUG: Unable to handle kernel data access on write at 0xc000000404697638 Faulting instruction address: 0xc0000000000181ec Oops: Kernel access of bad area, sig: 11 [#1] NIP [c0000000000181ec] __do_IRQ+0x6c/0xc0 With older GCC, the compiler would conservatively allocate callee-saved registers (like r31) for values spanning function calls, accidentally avoiding the bug: <__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f8 ff e1 fb std r31,-8(r1) f0 ff c1 fb std r30,-16(r1) 2d 03 10 06 pla r31,53297316 ... 3d e8 ff 4b bl c0000000000165ac <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 4d e9 ld r10,40(r13) 40 00 21 38 addi r1,r1,64 2a f9 aa 7f stdx r29,r10,r31 With newer GCC 14, the compiler uses r2 for such values, exposing the missing clobber specification: <__do_IRQ>: 00 00 00 60 nop a6 02 08 7c mflr r0 f0 ff c1 fb std r30,-16(r1) f8 ff e1 fb std r31,-8(r1) 29 02 10 06 pla r2,36252592 # c0000000022aadc0 <__irq_regs> ... 85 dc ff 4b bl c000000000015ee0 <__do_irq> 00 00 21 e8 ld r1,0(r1) 28 00 2d e9 ld r9,40(r13) 30 00 21 38 addi r1,r1,48 2a 11 c9 7f stdx r30,r9,r2 Fix this by adding r2 to the clobber list for both call_do_irq() and call_do_softirq() when CONFIG_PPC_KERNEL_PCREL is enabled. [0]: https://www.mail-archive.com/gcc-patches@gcc.gnu.org/msg313226.html Fixes: 7e3a68be42e1 ("powerpc/64: vmlinux support building with PCREL addresing") Signed-off-by: Saket Kumar Bhaskar Reviewed-by: Christophe Leroy (CS GROUP) Reviewed-by: Hari Bathini Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/10fc2cda485cd22e209a31d786bed1984bdf3982.1785732393.git.skb99@linux.ibm.com --- arch/powerpc/kernel/irq.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c index f69de08ad347..15a3c3fd8e70 100644 --- a/arch/powerpc/kernel/irq.c +++ b/arch/powerpc/kernel/irq.c @@ -217,8 +217,12 @@ static __always_inline void call_do_softirq(const void *sp) [sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE), [callee] "i" (__do_softirq) : // Clobbers - "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", - "cr7", "r0", "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", + "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0", + /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */ +#ifdef CONFIG_PPC_KERNEL_PCREL + "r2", +#endif + "r3", "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12" ); } @@ -275,8 +279,12 @@ static __always_inline void call_do_irq(struct pt_regs *regs, void *sp) [sp] "b" (sp), [offset] "i" (THREAD_SIZE - STACK_FRAME_MIN_SIZE), [callee] "i" (__do_irq) : // Clobbers - "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", - "cr7", "r0", "r4", "r5", "r6", "r7", "r8", "r9", "r10", + "lr", "xer", "ctr", "memory", "cr0", "cr1", "cr5", "cr6", "cr7", "r0", + /* r2 may be clobbered by the callee when using PCREL mode in the ELFv2 ABI. */ +#ifdef CONFIG_PPC_KERNEL_PCREL + "r2", +#endif + "r4", "r5", "r6", "r7", "r8", "r9", "r10", "r11", "r12" ); } From 76ea1257924f64521f708db91c99014ce7249bbf Mon Sep 17 00:00:00 2001 From: Nikhil Kumar Singh Date: Mon, 6 Jul 2026 13:57:08 +0530 Subject: [PATCH 41/62] powerpc/64s: Clarify copy_and_flush() cache sync loop comment The value loaded into r0 in copy_and_flush() represents the number of 8-byte words processed between cache synchronization operations. The existing comment refers to cache line size, which can make it appear that the value is a cache line size in bytes rather than a loop count. Clarify the comment to explain that the loop processes 8 words (64 bytes) per cache synchronization iteration, and that increasing the value would skip cache maintenance for intermediate cache lines. This is a comment-only change with no functional impact. Signed-off-by: Nikhil Kumar Singh Reviewed-by: Mahesh Salgaonkar Reviewed-by: Aditya Gupta Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260706082708.43918-1-nikhilks@linux.ibm.com --- arch/powerpc/kernel/head_64.S | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S index 63432a33ec49..a54f6f979173 100644 --- a/arch/powerpc/kernel/head_64.S +++ b/arch/powerpc/kernel/head_64.S @@ -713,14 +713,18 @@ p_end: .8byte _end - copy_to_here _GLOBAL(copy_and_flush) addi r5,r5,-8 addi r6,r6,-8 -4: li r0,8 /* Use the smallest common */ - /* denominator cache line */ - /* size. This results in */ - /* extra cache line flushes */ - /* but operation is correct. */ - /* Can't get cache line size */ - /* from NACA as it is being */ - /* moved too. */ +4: li r0,8 /* r0 is the number of 8-byte words */ + /* to copy per cache sync iteration. */ + /* 8 words * 8 bytes = 64 bytes. 64B is */ + /* the current default cache line size. */ + /* This is a loop count, not a byte */ + /* count. Increasing it may skip */ + /* dcbst/icbi for lines in between and */ + /* leave stale instructions in icache. */ + /* This results in extra cache line */ + /* flushes but operation is correct. */ + /* Can't get cache line size from NACA */ + /* as it is being moved too. */ mtctr r0 /* put # words/line in ctr */ 3: addi r6,r6,8 /* copy a cache line */ From 5458b50b5291390ce0af2872a1baa51cc58e8f08 Mon Sep 17 00:00:00 2001 From: Yanfei Xu Date: Sun, 31 May 2026 21:53:26 +0800 Subject: [PATCH 42/62] KVM: PPC: Validate irqchip index in MPIC routing Sashiko reported that the irqchip index is not validated for PowerPC. Add validation and reject out-of-range irqchip indexes to avoid indexing past the routing table's chip array. Fixes: de9ba2f36368 ("KVM: PPC: Support irq routing and irqfd for in-kernel MPIC") Reported-by: Sashiko Closes: https://lore.kernel.org/kvm/20260525051714.485D51F000E9@smtp.kernel.org/ Reviewed-by: Harsh Prateek Bora Signed-off-by: Yanfei Xu Signed-off-by: Madhavan Srinivasan --- arch/powerpc/kvm/mpic.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/powerpc/kvm/mpic.c b/arch/powerpc/kvm/mpic.c index 3070f36d9fb8..fb5f9e65e02e 100644 --- a/arch/powerpc/kvm/mpic.c +++ b/arch/powerpc/kvm/mpic.c @@ -1833,7 +1833,8 @@ int kvm_set_routing_entry(struct kvm *kvm, e->set = mpic_set_irq; e->irqchip.irqchip = ue->u.irqchip.irqchip; e->irqchip.pin = ue->u.irqchip.pin; - if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS) + if (e->irqchip.pin >= KVM_IRQCHIP_NUM_PINS || + e->irqchip.irqchip >= KVM_NR_IRQCHIPS) goto out; break; case KVM_IRQ_ROUTING_MSI: From 972a7b78722cd2faee75148278322d844f4274bb Mon Sep 17 00:00:00 2001 From: Mahesh Salgaonkar Date: Thu, 6 Aug 2026 10:41:17 +0530 Subject: [PATCH 43/62] powerpc/pseries: Limit PVR list to 16 entries for CAS negotiation Current Power system firmware caps the PVR list array size at 16 entries during CAS (Client Architecture Support) negotiation. Passing more than capped size to older firmware could cause an undefined behaviour and breaks compatibility. Future Power system firmware releases will lift this restriction and support greater than 16 array entries. Ensure that when running on Power11 or below hardware, the number of PVR entries passed during CAS negotiation does not exceed the firmware-imposed limit of 16. In prom_send_capabilities(), compute start_index to skip the oldest leading pvrs[] entries when running on Power11 or below hardware, so that the pointer passed to ibm,client-architecture-support points to ibm_architecture_vec.pvrs[start_index], presenting exactly 16 entries to firmware. Signed-off-by: Mahesh Salgaonkar Tested-by: Praveen K Pandey Reviewed-by: Nikhil Kumar Singh Reviewed-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260806051120.3703698-2-mahesh@linux.ibm.com --- arch/powerpc/kernel/prom_init.c | 34 +++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c index 53503937de0e..055cb5f2d37f 100644 --- a/arch/powerpc/kernel/prom_init.c +++ b/arch/powerpc/kernel/prom_init.c @@ -86,6 +86,12 @@ */ #define ADDR(x) (u32)(unsigned long)(x) +/* + * Current Power system firmware caps the PVR list array size at 16 entries + * during CAS (Client Architecture Support) negotiation. + */ +#define CAS_MAX_PVR_ENTRIES 16 + #ifdef CONFIG_PPC64 #define OF_WORKAROUNDS 0 #else @@ -979,6 +985,10 @@ static const struct ibm_arch_vec ibm_architecture_vec_template __initconst = { .mask = cpu_to_be32(0xfffe0000), /* POWER5/POWER5+ */ .val = cpu_to_be32(0x003a0000), }, + { + .mask = cpu_to_be32(0xffffffff), /* all 2.04-compliant and earlier */ + .val = cpu_to_be32(0x0f000001), + }, { .mask = cpu_to_be32(0xffff0000), /* POWER6 */ .val = cpu_to_be32(0x003e0000), @@ -1032,13 +1042,9 @@ static const struct ibm_arch_vec ibm_architecture_vec_template __initconst = { .val = cpu_to_be32(0x0f000003), }, { - .mask = cpu_to_be32(0xffffffff), /* all 2.05-compliant */ + .mask = cpu_to_be32(0xfffffffd), /* all 2.05-compliant */ .val = cpu_to_be32(0x0f000002), }, - { - .mask = cpu_to_be32(0xfffffffe), /* all 2.04-compliant and earlier */ - .val = cpu_to_be32(0x0f000001), - }, }, .num_vectors = NUM_VECTORS(6), @@ -1403,6 +1409,22 @@ static void __init prom_send_capabilities(void) ihandle root; prom_arg_t ret; u32 cores; + int start_index = 0; + + /* + * Ensure that when running on Power11 or below hardware, the number + * of PVR entries passed during CAS negotiation does not exceed the + * firmware-imposed limit of 16. + * + * Compute the start_index to skip the oldest leading pvrs[] entries + * when running on Power11 or below hardware, so that the pointer + * passed to ibm,client-architecture-support points to + * ibm_architecture_vec.pvrs[start_index], presenting exactly 16 + * entries to firmware. + */ + if ((ARRAY_SIZE(ibm_architecture_vec_template.pvrs) > CAS_MAX_PVR_ENTRIES) && + (PVR_VER(mfspr(SPRN_PVR)) <= PVR_POWER11)) + start_index = ARRAY_SIZE(ibm_architecture_vec_template.pvrs) - CAS_MAX_PVR_ENTRIES; /* Check ibm,arch-vec-5-platform-support and fixup vec5 if required */ prom_check_platform_support(); @@ -1427,7 +1449,7 @@ static void __init prom_send_capabilities(void) if (call_prom_ret("call-method", 3, 2, &ret, ADDR("ibm,client-architecture-support"), root, - ADDR(&ibm_architecture_vec)) == 0) { + ADDR(&ibm_architecture_vec.pvrs[start_index])) == 0) { /* the call exists... */ if (ret) prom_printf("\nWARNING: ibm,client-architecture" From e671e147ea51e95d7535940ccb2b76ce681ff765 Mon Sep 17 00:00:00 2001 From: Nicholas Piggin Date: Thu, 6 Aug 2026 10:41:18 +0530 Subject: [PATCH 44/62] powerpc: Add Power12 raw mode Add CPU table entries for raw mode. Signed-off-by: Nicholas Piggin Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Mahesh Salgaonkar Tested-by: Praveen K Pandey Reviewed-by: Nikhil Kumar Singh Reviewed-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260806051120.3703698-3-mahesh@linux.ibm.com --- arch/powerpc/include/asm/cpu_setup.h | 2 ++ arch/powerpc/include/asm/cputable.h | 17 +++++++-- arch/powerpc/include/asm/mmu.h | 1 + arch/powerpc/include/asm/reg.h | 5 ++- arch/powerpc/include/asm/synch.h | 6 +++- arch/powerpc/include/uapi/asm/cputable.h | 1 + arch/powerpc/kernel/cpu_setup_power.c | 43 +++++++++++++++++++++++ arch/powerpc/kernel/cpu_specs_book3s_64.h | 22 ++++++++++++ arch/powerpc/kernel/dt_cpu_ftrs.c | 37 +++++++++++++++++++ arch/powerpc/kernel/setup-common.c | 1 + arch/powerpc/kvm/book3s_hv.c | 9 +++-- arch/powerpc/mm/book3s64/hash_native.c | 22 ++++++++---- arch/powerpc/mm/init_64.c | 4 ++- 13 files changed, 157 insertions(+), 13 deletions(-) diff --git a/arch/powerpc/include/asm/cpu_setup.h b/arch/powerpc/include/asm/cpu_setup.h index 30e2fe389502..26d2c0e2c99c 100644 --- a/arch/powerpc/include/asm/cpu_setup.h +++ b/arch/powerpc/include/asm/cpu_setup.h @@ -9,10 +9,12 @@ void __setup_cpu_power7(unsigned long offset, struct cpu_spec *spec); void __setup_cpu_power8(unsigned long offset, struct cpu_spec *spec); void __setup_cpu_power9(unsigned long offset, struct cpu_spec *spec); void __setup_cpu_power10(unsigned long offset, struct cpu_spec *spec); +void __setup_cpu_power12(unsigned long offset, struct cpu_spec *spec); void __restore_cpu_power7(void); void __restore_cpu_power8(void); void __restore_cpu_power9(void); void __restore_cpu_power10(void); +void __restore_cpu_power12(void); void __setup_cpu_e500v1(unsigned long offset, struct cpu_spec *spec); void __setup_cpu_e500v2(unsigned long offset, struct cpu_spec *spec); diff --git a/arch/powerpc/include/asm/cputable.h b/arch/powerpc/include/asm/cputable.h index ec16c12296da..a3be81c47df3 100644 --- a/arch/powerpc/include/asm/cputable.h +++ b/arch/powerpc/include/asm/cputable.h @@ -194,6 +194,7 @@ static inline void cpu_feature_keys_init(void) { } #define CPU_FTR_DAWR1 LONG_ASM_CONST(0x0008000000000000) #define CPU_FTR_DEXCR_NPHIE LONG_ASM_CONST(0x0010000000000000) #define CPU_FTR_P11_PVR LONG_ASM_CONST(0x0020000000000000) +#define CPU_FTR_ARCH_32 LONG_ASM_CONST(0x0040000000000000) #ifndef __ASSEMBLER__ @@ -457,6 +458,18 @@ static inline void cpu_feature_keys_init(void) { } #define CPU_FTRS_POWER11 (CPU_FTRS_POWER10 | CPU_FTR_P11_PVR) +#define CPU_FTRS_POWER12 (CPU_FTR_LWSYNC | \ + CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | CPU_FTR_ARCH_206 |\ + CPU_FTR_MMCRA | CPU_FTR_SMT | \ + CPU_FTR_COHERENT_ICACHE | \ + CPU_FTR_PURR | CPU_FTR_SPURR | CPU_FTR_REAL_LE | \ + CPU_FTR_DSCR | \ + CPU_FTR_STCX_CHECKS_ADDRESS | CPU_FTR_POPCNTB | CPU_FTR_POPCNTD | \ + CPU_FTR_CFAR | CPU_FTR_HVMODE | CPU_FTR_VMX_COPY | \ + CPU_FTR_DBELL | CPU_FTR_HAS_PPR | CPU_FTR_ARCH_207S | \ + CPU_FTR_ARCH_300 | CPU_FTR_ARCH_31 | CPU_FTR_ARCH_32 | \ + CPU_FTR_DAWR | CPU_FTR_DAWR1) + #define CPU_FTRS_CELL (CPU_FTR_LWSYNC | \ CPU_FTR_PPCAS_ARCH_V2 | CPU_FTR_CTRL | \ CPU_FTR_ALTIVEC_COMP | CPU_FTR_MMCRA | CPU_FTR_SMT | \ @@ -476,7 +489,7 @@ static inline void cpu_feature_keys_init(void) { } (CPU_FTRS_POWER7 | CPU_FTRS_POWER8E | CPU_FTRS_POWER8 | \ CPU_FTR_ALTIVEC_COMP | CPU_FTR_VSX_COMP | CPU_FTRS_POWER9 | \ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2 | \ - CPU_FTRS_POWER9_DD2_3 | CPU_FTRS_POWER10 | CPU_FTRS_POWER11) + CPU_FTRS_POWER9_DD2_3 | CPU_FTRS_POWER10 | CPU_FTRS_POWER11 | CPU_FTRS_POWER12) #else #define CPU_FTRS_POSSIBLE \ (CPU_FTRS_PPC970 | CPU_FTRS_POWER5 | \ @@ -484,7 +497,7 @@ static inline void cpu_feature_keys_init(void) { } CPU_FTRS_POWER8 | CPU_FTRS_CELL | CPU_FTRS_PA6T | \ CPU_FTR_VSX_COMP | CPU_FTR_ALTIVEC_COMP | CPU_FTRS_POWER9 | \ CPU_FTRS_POWER9_DD2_1 | CPU_FTRS_POWER9_DD2_2 | \ - CPU_FTRS_POWER9_DD2_3 | CPU_FTRS_POWER10 | CPU_FTRS_POWER11) + CPU_FTRS_POWER9_DD2_3 | CPU_FTRS_POWER10 | CPU_FTRS_POWER11 | CPU_FTRS_POWER12) #endif /* CONFIG_CPU_LITTLE_ENDIAN */ #endif #else diff --git a/arch/powerpc/include/asm/mmu.h b/arch/powerpc/include/asm/mmu.h index 5f9c5d436e17..4fd7f81a2930 100644 --- a/arch/powerpc/include/asm/mmu.h +++ b/arch/powerpc/include/asm/mmu.h @@ -133,6 +133,7 @@ #define MMU_FTRS_POWER9 MMU_FTRS_POWER6 #define MMU_FTRS_POWER10 MMU_FTRS_POWER6 #define MMU_FTRS_POWER11 MMU_FTRS_POWER6 +#define MMU_FTRS_POWER12 MMU_FTRS_POWER6 #define MMU_FTRS_CELL MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \ MMU_FTR_CI_LARGE_PAGE #define MMU_FTRS_PA6T MMU_FTRS_DEFAULT_HPTE_ARCH_V2 | \ diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h index b9ab9df1e2bc..541a493e13bf 100644 --- a/arch/powerpc/include/asm/reg.h +++ b/arch/powerpc/include/asm/reg.h @@ -492,11 +492,12 @@ * determine both the compatibility level which we want to emulate and the * compatibility level which the host is capable of emulating. */ +#define PCR_ARCH_31 0x20 /* Architecture 3.1 */ #define PCR_ARCH_300 0x10 /* Architecture 3.00 */ #define PCR_ARCH_207 0x8 /* Architecture 2.07 */ #define PCR_ARCH_206 0x4 /* Architecture 2.06 */ #define PCR_ARCH_205 0x2 /* Architecture 2.05 */ -#define PCR_LOW_BITS (PCR_ARCH_207 | PCR_ARCH_206 | PCR_ARCH_205 | PCR_ARCH_300) +#define PCR_LOW_BITS (PCR_ARCH_207 | PCR_ARCH_206 | PCR_ARCH_205 | PCR_ARCH_300 | PCR_ARCH_31) #define PCR_MASK ~(PCR_HIGH_BITS | PCR_LOW_BITS) /* PCR Reserved Bits */ #define SPRN_HEIR 0x153 /* Hypervisor Emulated Instruction Register */ #define SPRN_TLBINDEXR 0x154 /* P7 TLB control register */ @@ -1344,6 +1345,7 @@ #define PVR_POWER9 0x004E #define PVR_POWER10 0x0080 #define PVR_POWER11 0x0082 +#define PVR_POWER12 0x0083 #define PVR_BE 0x0070 #define PVR_PA6T 0x0090 @@ -1356,6 +1358,7 @@ #define PVR_ARCH_300 0x0f000005 #define PVR_ARCH_31 0x0f000006 #define PVR_ARCH_31_P11 0x0f000007 +#define PVR_ARCH_32 0x0f000008 /* * Kernel-internal sentinel for invalid processor compatibility modes. diff --git a/arch/powerpc/include/asm/synch.h b/arch/powerpc/include/asm/synch.h index 0d3ccb34adfb..d0e9765dee28 100644 --- a/arch/powerpc/include/asm/synch.h +++ b/arch/powerpc/include/asm/synch.h @@ -37,8 +37,12 @@ static inline void ppc_after_tlbiel_barrier(void) * accelerators mapped will use tlbie (which does invalidate the copy) * to invalidate translations. It's not possible to limit POWER10 this * way due to local copy-paste. + * + * POWER12 does not need it. */ - asm volatile(ASM_FTR_IFSET(PPC_CP_ABORT, "", %0) : : "i" (CPU_FTR_ARCH_31) : "memory"); + asm volatile(ASM_FTR_IF(PPC_CP_ABORT, "", %0, %1) : + : "i" (CPU_FTR_ARCH_31|CPU_FTR_ARCH_32), "i" (CPU_FTR_ARCH_31) + : "memory"); } #endif /* __ASSEMBLER__ */ diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h index 731b97dc2d15..bc9bd225f587 100644 --- a/arch/powerpc/include/uapi/asm/cputable.h +++ b/arch/powerpc/include/uapi/asm/cputable.h @@ -52,6 +52,7 @@ #define PPC_FEATURE2_HTM_NO_SUSPEND 0x00080000 /* TM w/out suspended state */ #define PPC_FEATURE2_ARCH_3_1 0x00040000 /* ISA 3.1 */ #define PPC_FEATURE2_MMA 0x00020000 /* Matrix Multiply Assist */ +#define PPC_FEATURE2_ARCH_3_2 0x00010000 /* ISA 3.2 */ /* * IMPORTANT! diff --git a/arch/powerpc/kernel/cpu_setup_power.c b/arch/powerpc/kernel/cpu_setup_power.c index 98bd4e6c1770..5de704ac031d 100644 --- a/arch/powerpc/kernel/cpu_setup_power.c +++ b/arch/powerpc/kernel/cpu_setup_power.c @@ -286,3 +286,46 @@ void __restore_cpu_power10(void) init_HFSCR(); init_PMU_HV(); } + +void __setup_cpu_power12(unsigned long offset, struct cpu_spec *t) +{ + init_FSCR_power10(); + init_PMU(); + init_PMU_ISA31(); + + if (!init_hvmode_206(t)) + return; + + mtspr(SPRN_PSSCR, 0); + mtspr(SPRN_LPID, 0); + mtspr(SPRN_PID, 0); + mtspr(SPRN_AMOR, ~0); + mtspr(SPRN_PCR, PCR_MASK); + init_LPCR_ISA300((mfspr(SPRN_LPCR) | LPCR_PECEDH | LPCR_PECE_HVEE |\ + LPCR_HVICE | LPCR_HEIC) & ~(LPCR_UPRT | LPCR_HR), 0); + init_HFSCR(); + init_PMU_HV(); +} + +void __restore_cpu_power12(void) +{ + u64 msr; + + init_FSCR_power10(); + init_PMU(); + init_PMU_ISA31(); + + msr = mfmsr(); + if (!(msr & MSR_HV)) + return; + + mtspr(SPRN_PSSCR, 0); + mtspr(SPRN_LPID, 0); + mtspr(SPRN_PID, 0); + mtspr(SPRN_AMOR, ~0); + mtspr(SPRN_PCR, PCR_MASK); + init_LPCR_ISA300((mfspr(SPRN_LPCR) | LPCR_PECEDH | LPCR_PECE_HVEE |\ + LPCR_HVICE | LPCR_HEIC) & ~(LPCR_UPRT | LPCR_HR), 0); + init_HFSCR(); + init_PMU_HV(); +} diff --git a/arch/powerpc/kernel/cpu_specs_book3s_64.h b/arch/powerpc/kernel/cpu_specs_book3s_64.h index 98d4274a1b6b..7619dd157646 100644 --- a/arch/powerpc/kernel/cpu_specs_book3s_64.h +++ b/arch/powerpc/kernel/cpu_specs_book3s_64.h @@ -63,6 +63,11 @@ #define COMMON_USER_POWER11 COMMON_USER_POWER10 #define COMMON_USER2_POWER11 COMMON_USER2_POWER10 +#define COMMON_USER_POWER12 COMMON_USER_POWER10 +#define COMMON_USER2_POWER12 (COMMON_USER2_POWER10 | \ + PPC_FEATURE2_ARCH_3_2) + + static struct cpu_spec cpu_specs[] __initdata = { { /* PPC970 */ .pvr_mask = 0xffff0000, @@ -485,6 +490,23 @@ static struct cpu_spec cpu_specs[] __initdata = { .machine_check_early = __machine_check_early_realmode_p10, .platform = "power11", }, + { /* Power12 */ + .pvr_mask = 0xffff0000, + .pvr_value = 0x00830000, + .cpu_name = "Power12 (raw)", + .cpu_features = CPU_FTRS_POWER12, + .cpu_user_features = COMMON_USER_POWER12, + .cpu_user_features2 = COMMON_USER2_POWER12, + .mmu_features = MMU_FTRS_POWER12, + .icache_bsize = 128, + .dcache_bsize = 128, + .num_pmcs = 6, + .pmc_type = PPC_PMC_IBM, + .cpu_setup = __setup_cpu_power12, + .cpu_restore = __restore_cpu_power12, + .machine_check_early = __machine_check_early_realmode_p10, + .platform = "power12", + }, { /* Cell Broadband Engine */ .pvr_mask = 0xffff0000, .pvr_value = 0x00700000, diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c index 1b15e47e5340..a87b22f555b2 100644 --- a/arch/powerpc/kernel/dt_cpu_ftrs.c +++ b/arch/powerpc/kernel/dt_cpu_ftrs.c @@ -26,6 +26,7 @@ /* Device-tree visible constants follow */ #define ISA_V3_0B 3000 #define ISA_V3_1 3100 +#define ISA_V3_2 3200 #define USABLE_PR (1U << 0) #define USABLE_OS (1U << 1) @@ -464,6 +465,35 @@ static int __init feat_enable_mce_power11(struct dt_cpu_feature *f) return 1; } +static void init_pmu_power12(void) +{ + init_pmu_power10(); +} + +static int __init feat_enable_pmu_power12(struct dt_cpu_feature *f) +{ + hfscr_pmu_enable(); + + init_pmu_power12(); + init_pmu_registers = init_pmu_power12; + + cur_cpu_spec->cpu_features |= CPU_FTR_MMCRA; + cur_cpu_spec->cpu_user_features |= PPC_FEATURE_PSERIES_PERFMON_COMPAT; + + cur_cpu_spec->num_pmcs = 6; + cur_cpu_spec->pmc_type = PPC_PMC_IBM; + + return 1; +} + +static int __init feat_enable_mce_power12(struct dt_cpu_feature *f) +{ + cur_cpu_spec->platform = "power12"; + cur_cpu_spec->machine_check_early = __machine_check_early_realmode_p10; + + return 1; +} + static int __init feat_enable_tm(struct dt_cpu_feature *f) { #ifdef CONFIG_PPC_TRANSACTIONAL_MEM @@ -655,9 +685,11 @@ static struct dt_cpu_feature_match __initdata {"machine-check-power9", feat_enable_mce_power9, 0}, {"machine-check-power10", feat_enable_mce_power10, 0}, {"machine-check-power11", feat_enable_mce_power11, 0}, + {"machine-check-power12", feat_enable_mce_power12, 0}, {"performance-monitor-power9", feat_enable_pmu_power9, 0}, {"performance-monitor-power10", feat_enable_pmu_power10, 0}, {"performance-monitor-power11", feat_enable_pmu_power10, 0}, + {"performance-monitor-power12", feat_enable_pmu_power12, 0}, {"event-based-branch-v3", feat_enable, 0}, {"random-number-generator", feat_enable, 0}, {"system-call-vectored", feat_disable, 0}, @@ -712,6 +744,11 @@ static void __init cpufeatures_setup_start(u32 isa) if (PVR_VER(mfspr(SPRN_PVR)) >= PVR_POWER11) cur_cpu_spec->cpu_features |= CPU_FTR_P11_PVR; } + + if (isa >= ISA_V3_2) { + cur_cpu_spec->cpu_features |= CPU_FTR_ARCH_32; + cur_cpu_spec->cpu_user_features2 |= PPC_FEATURE2_ARCH_3_2; + } } static bool __init cpufeatures_process_feature(struct dt_cpu_feature *f) diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c index 67c545f61f0d..4afaba19b586 100644 --- a/arch/powerpc/kernel/setup-common.c +++ b/arch/powerpc/kernel/setup-common.c @@ -304,6 +304,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) break; case 0x004e: /* POWER9 bits 12-15 give chip type */ case 0x0080: /* POWER10 bit 12 gives SMT8/4 */ + case 0x0083: /* POWER12 bit 12 gives SMT8/4 */ maj = (pvr >> 8) & 0x0F; min = pvr & 0xFF; break; diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c index 15b422861894..1b5f5ebea4a3 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c @@ -388,7 +388,7 @@ static void kvmppc_set_pvr_hv(struct kvm_vcpu *vcpu, u32 pvr) } /* Dummy value used in computing PCR value below */ -#define PCR_ARCH_31 (PCR_ARCH_300 << 1) +#define PCR_ARCH_32 (PCR_ARCH_31 << 1) static inline unsigned long map_pcr_to_cap(unsigned long pcr) { @@ -417,7 +417,9 @@ static int kvmppc_set_arch_compat(struct kvm_vcpu *vcpu, u32 arch_compat) struct kvmppc_vcore *vc = vcpu->arch.vcore; /* We can (emulate) our own architecture version and anything older */ - if (cpu_has_feature(CPU_FTR_P11_PVR) || cpu_has_feature(CPU_FTR_ARCH_31)) + if (cpu_has_feature(CPU_FTR_ARCH_32)) + host_pcr_bit = PCR_ARCH_32; + else if (cpu_has_feature(CPU_FTR_P11_PVR) || cpu_has_feature(CPU_FTR_ARCH_31)) host_pcr_bit = PCR_ARCH_31; else if (cpu_has_feature(CPU_FTR_ARCH_300)) host_pcr_bit = PCR_ARCH_300; @@ -461,6 +463,9 @@ static int kvmppc_set_arch_compat(struct kvm_vcpu *vcpu, u32 arch_compat) } guest_pcr_bit = PCR_ARCH_31; break; + case PVR_ARCH_32: + guest_pcr_bit = PCR_ARCH_32; + break; default: return -EINVAL; } diff --git a/arch/powerpc/mm/book3s64/hash_native.c b/arch/powerpc/mm/book3s64/hash_native.c index e9e2dd70c060..ab2a80e59011 100644 --- a/arch/powerpc/mm/book3s64/hash_native.c +++ b/arch/powerpc/mm/book3s64/hash_native.c @@ -184,9 +184,14 @@ static inline void __tlbiel(unsigned long vpn, int psize, int apsize, int ssize) va |= ssize << 8; sllp = get_sllp_encoding(apsize); va |= sllp << 5; - asm volatile(ASM_FTR_IFSET("tlbiel %0", PPC_TLBIEL_v205(%0, 0), %1) - : : "r" (va), "i" (CPU_FTR_ARCH_206) - : "memory"); + + if (cpu_has_feature(CPU_FTR_ARCH_32)) { + asm volatile(PPC_TLBIEL(%0, %1, 0, 0, 0) : : "r"(va), "r"(0) : "memory"); + } else { + asm volatile(ASM_FTR_IFSET("tlbiel %0", PPC_TLBIEL_v205(%0, 0), %1) + : : "r" (va), "i" (CPU_FTR_ARCH_206) + : "memory"); + } break; default: /* We need 14 to 14 + i bits of va */ @@ -203,9 +208,14 @@ static inline void __tlbiel(unsigned long vpn, int psize, int apsize, int ssize) */ va |= (vpn & 0xfe); va |= 1; /* L */ - asm volatile(ASM_FTR_IFSET("tlbiel %0", PPC_TLBIEL_v205(%0, 1), %1) - : : "r" (va), "i" (CPU_FTR_ARCH_206) - : "memory"); + + if (cpu_has_feature(CPU_FTR_ARCH_32)) { + asm volatile(PPC_TLBIEL(%0, %1, 0, 0, 0) : : "r"(va), "r"(0) : "memory"); + } else { + asm volatile(ASM_FTR_IFSET("tlbiel %0", PPC_TLBIEL_v205(%0, 1), %1) + : : "r" (va), "i" (CPU_FTR_ARCH_206) + : "memory"); + } break; } trace_tlbie(0, 1, va, 0, 0, 0, 0); diff --git a/arch/powerpc/mm/init_64.c b/arch/powerpc/mm/init_64.c index 64f0df5bb5cd..0e777d7dc332 100644 --- a/arch/powerpc/mm/init_64.c +++ b/arch/powerpc/mm/init_64.c @@ -628,7 +628,9 @@ void __init mmu_early_init_devtree(void) of_scan_flat_dt(dt_scan_mmu_pid_width, NULL); if (hvmode && !mmu_lpid_bits) { - if (early_cpu_has_feature(CPU_FTR_ARCH_207S)) + if (early_cpu_has_feature(CPU_FTR_ARCH_32)) + mmu_lpid_bits = 16; /* POWER12 */ + else if (early_cpu_has_feature(CPU_FTR_ARCH_207S)) mmu_lpid_bits = 12; /* POWER8-10 */ else mmu_lpid_bits = 10; /* POWER7 */ From 287df870bf47d191875ca12f951dde7a6f913251 Mon Sep 17 00:00:00 2001 From: "Ritesh Harjani (IBM)" Date: Thu, 6 Aug 2026 10:41:19 +0530 Subject: [PATCH 45/62] powerpc: Add Power12 architected mode PVR value of 0x0f000008 means we are arch v3.2 compliant (i.e. Power12). This is used by phyp and kvm when booting as a pseries guest to detect the presence of new Power12 features and to enable the appropriate hwcap and facility bits. Signed-off-by: Ritesh Harjani (IBM) Signed-off-by: Nicholas Piggin Signed-off-by: Mahesh Salgaonkar Tested-by: Praveen K Pandey Reviewed-by: Nikhil Kumar Singh Reviewed-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260806051120.3703698-4-mahesh@linux.ibm.com --- arch/powerpc/include/asm/prom.h | 3 ++- arch/powerpc/include/uapi/asm/cputable.h | 1 + arch/powerpc/kernel/cpu_specs_book3s_64.h | 14 ++++++++++++++ arch/powerpc/kernel/prom_init.c | 12 ++++++++++-- 4 files changed, 27 insertions(+), 3 deletions(-) diff --git a/arch/powerpc/include/asm/prom.h b/arch/powerpc/include/asm/prom.h index f4991d10d89e..2076852e6c2e 100644 --- a/arch/powerpc/include/asm/prom.h +++ b/arch/powerpc/include/asm/prom.h @@ -117,7 +117,8 @@ extern unsigned int boot_cpu_node_count; #define OV1_PPC_2_07 0x01 /* set if we support PowerPC 2.07 */ #define OV1_PPC_3_00 0x80 /* set if we support PowerPC 3.00 */ -#define OV1_PPC_3_1 0x40 /* set if we support PowerPC 3.1 */ +#define OV1_PPC_3_1 0x40 /* set if we support PowerPC 3.1 */ +#define OV1_PPC_3_2 0x20 /* set if we support PowerPC 3.2 */ /* Option vector 2: Open Firmware options supported */ #define OV2_REAL_MODE 0x20 /* set if we want OF in real mode */ diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h index bc9bd225f587..68215b7ce67e 100644 --- a/arch/powerpc/include/uapi/asm/cputable.h +++ b/arch/powerpc/include/uapi/asm/cputable.h @@ -53,6 +53,7 @@ #define PPC_FEATURE2_ARCH_3_1 0x00040000 /* ISA 3.1 */ #define PPC_FEATURE2_MMA 0x00020000 /* Matrix Multiply Assist */ #define PPC_FEATURE2_ARCH_3_2 0x00010000 /* ISA 3.2 */ +#define PPC_FEATURE2_DMF 0x00008000 /* Dense Math Facility */ /* * IMPORTANT! diff --git a/arch/powerpc/kernel/cpu_specs_book3s_64.h b/arch/powerpc/kernel/cpu_specs_book3s_64.h index 7619dd157646..26fa40aa34db 100644 --- a/arch/powerpc/kernel/cpu_specs_book3s_64.h +++ b/arch/powerpc/kernel/cpu_specs_book3s_64.h @@ -303,6 +303,20 @@ static struct cpu_spec cpu_specs[] __initdata = { .cpu_restore = __restore_cpu_power10, .platform = "power11", }, + { /* 3.2-compliant processor, i.e. Power12 "architected" mode */ + .pvr_mask = 0xffffffff, + .pvr_value = 0x0f000008, + .cpu_name = "Power12 (architected)", + .cpu_features = CPU_FTRS_POWER12, + .cpu_user_features = COMMON_USER_POWER12, + .cpu_user_features2 = COMMON_USER2_POWER12, + .mmu_features = MMU_FTRS_POWER12, + .icache_bsize = 128, + .dcache_bsize = 128, + .cpu_setup = __setup_cpu_power12, + .cpu_restore = __restore_cpu_power12, + .platform = "power12", + }, { /* Power7 */ .pvr_mask = 0xffff0000, .pvr_value = 0x003f0000, diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c index 055cb5f2d37f..eb9f556b0937 100644 --- a/arch/powerpc/kernel/prom_init.c +++ b/arch/powerpc/kernel/prom_init.c @@ -953,7 +953,7 @@ struct option_vector7 { } __packed; struct ibm_arch_vec { - struct { __be32 mask, val; } pvrs[16]; + struct { __be32 mask, val; } pvrs[18]; u8 num_vectors; @@ -1021,6 +1021,14 @@ static const struct ibm_arch_vec ibm_architecture_vec_template __initconst = { .mask = cpu_to_be32(0xffff0000), /* POWER11 */ .val = cpu_to_be32(0x00820000), }, + { + .mask = cpu_to_be32(0xffff0000), /* POWER12 */ + .val = cpu_to_be32(0x00830000), + }, + { + .mask = cpu_to_be32(0xffffffff), /* all 3.2-compliant */ + .val = cpu_to_be32(0x0f000008), + }, { .mask = cpu_to_be32(0xffffffff), /* P11 compliant */ .val = cpu_to_be32(0x0f000007), @@ -1054,7 +1062,7 @@ static const struct ibm_arch_vec ibm_architecture_vec_template __initconst = { .byte1 = 0, .arch_versions = OV1_PPC_2_00 | OV1_PPC_2_01 | OV1_PPC_2_02 | OV1_PPC_2_03 | OV1_PPC_2_04 | OV1_PPC_2_05 | OV1_PPC_2_06 | OV1_PPC_2_07, - .arch_versions3 = OV1_PPC_3_00 | OV1_PPC_3_1, + .arch_versions3 = OV1_PPC_3_00 | OV1_PPC_3_1 | OV1_PPC_3_2, }, .vec2_len = VECTOR_LENGTH(sizeof(struct option_vector2)), From aca7cf5b1ffe07f1a1aab5db71a6cd14e07165f4 Mon Sep 17 00:00:00 2001 From: Athira Rajeev Date: Thu, 6 Aug 2026 10:41:20 +0530 Subject: [PATCH 46/62] powerpc/perf: Add power12 Base Performance Monitoring support Base enablement patch to register performance monitoring hardware support for power12. Patch introduce the raw event encoding format, defines the supported list of events, config fields for the event attributes and their corresponding bit values which are exported via sysfs. Signed-off-by: Athira Rajeev Signed-off-by: Mahesh Salgaonkar Tested-by: Praveen K Pandey Reviewed-by: Nikhil Kumar Singh Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260806051120.3703698-5-mahesh@linux.ibm.com --- arch/powerpc/perf/Makefile | 2 +- arch/powerpc/perf/core-book3s.c | 2 + arch/powerpc/perf/internal.h | 1 + arch/powerpc/perf/power12-events-list.h | 78 ++++ arch/powerpc/perf/power12-pmu.c | 466 ++++++++++++++++++++++++ 5 files changed, 548 insertions(+), 1 deletion(-) create mode 100644 arch/powerpc/perf/power12-events-list.h create mode 100644 arch/powerpc/perf/power12-pmu.c diff --git a/arch/powerpc/perf/Makefile b/arch/powerpc/perf/Makefile index 78dd7e25219e..bcc804c41338 100644 --- a/arch/powerpc/perf/Makefile +++ b/arch/powerpc/perf/Makefile @@ -7,7 +7,7 @@ obj-$(CONFIG_PPC_PERF_CTRS) += core-book3s.o obj64-$(CONFIG_PPC_PERF_CTRS) += ppc970-pmu.o power5-pmu.o \ power5+-pmu.o power6-pmu.o power7-pmu.o \ isa207-common.o power8-pmu.o power9-pmu.o \ - generic-compat-pmu.o power10-pmu.o bhrb.o + generic-compat-pmu.o power10-pmu.o bhrb.o power12-pmu.o obj32-$(CONFIG_PPC_PERF_CTRS) += mpc7450-pmu.o obj-$(CONFIG_PPC_POWERNV) += imc-pmu.o diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c index 720b1a500922..10ded865583c 100644 --- a/arch/powerpc/perf/core-book3s.c +++ b/arch/powerpc/perf/core-book3s.c @@ -2613,6 +2613,8 @@ static int __init init_ppc64_pmu(void) return 0; else if (!init_power11_pmu()) return 0; + else if (!init_power12_pmu()) + return 0; else if (!init_ppc970_pmu()) return 0; else diff --git a/arch/powerpc/perf/internal.h b/arch/powerpc/perf/internal.h index a70ac471a5a5..84d6ca209c49 100644 --- a/arch/powerpc/perf/internal.h +++ b/arch/powerpc/perf/internal.h @@ -11,4 +11,5 @@ int __init init_power8_pmu(void); int __init init_power9_pmu(void); int __init init_power10_pmu(void); int __init init_power11_pmu(void); +int __init init_power12_pmu(void); int __init init_generic_compat_pmu(void); diff --git a/arch/powerpc/perf/power12-events-list.h b/arch/powerpc/perf/power12-events-list.h new file mode 100644 index 000000000000..cc26796d418b --- /dev/null +++ b/arch/powerpc/perf/power12-events-list.h @@ -0,0 +1,78 @@ +/* SPDX-License-Identifier: GPL-2.0-or-later */ +/* + * Performance counter support for POWER12 processors. + * + * Copyright 2026 Athira Rajeev, IBM Corporation. + */ + +/* + * Power12 event codes. + */ +EVENT(PM_CYC, 0x600f4); +EVENT(PM_DISP_STALL_CYC, 0x100f8); +EVENT(PM_EXEC_STALL, 0x30008); +EVENT(PM_INST_CMPL, 0x500fa); +EVENT(PM_BR_CMPL, 0x4d05e); +EVENT(PM_BR_MPRED_CMPL, 0x400f6); +EVENT(PM_BR_FIN, 0x10068); +EVENT(PM_MPRED_BR_FIN, 0x27098); +EVENT(PM_LD_DEMAND_MISS_L1_FIN, 0x400f0); + +/* All L1 D cache load references counted at finish, gated by reject */ +EVENT(PM_LD_REF_L1, 0x100fc); +/* Load Missed L1 */ +EVENT(PM_LD_MISS_L1, 0x3e054); +/* Store Missed L1 */ +EVENT(PM_ST_MISS_L1, 0x300f0); +/* L1 cache data prefetches */ +EVENT(PM_LD_PREFETCH_CACHE_LINE_MISS, 0x1002c); +/* Demand iCache Miss */ +EVENT(PM_L1_ICACHE_MISS, 0x200fc); +/* Instruction fetches from L1 */ +EVENT(PM_INST_FROM_L1, 0x04080); +/* Instruction Demand sectors writtent into IL1 */ +EVENT(PM_INST_FROM_L1MISS, 0x03F00000001C040); +/* Instruction prefetch written into IL1 */ +EVENT(PM_IC_PREF_REQ, 0x040a0); +/* The data cache was reloaded from local core's L3 due to a demand load */ +EVENT(PM_DATA_FROM_L3, 0x10340000003C040); +/* Demand LD - L3 Miss (not L2 hit and not L3 hit) */ +EVENT(PM_DATA_FROM_L3MISS, 0x300fe); +/* All successful D-side store dispatches for this thread */ +EVENT(PM_L2_ST, 0x010000046080); +/* All successful D-side store dispatches for this thread that were L2 Miss */ +EVENT(PM_L2_ST_MISS, 0x26880); +/* Total HW L3 prefetches(Load+store) */ +EVENT(PM_L3_PF_MISS_L3, 0x100000016080); +/* Data PTEG reload */ +EVENT(PM_DTLB_MISS, 0x300fc); +/* ITLB Reloaded */ +EVENT(PM_ITLB_MISS, 0x400fc); + +EVENT(PM_CYC_ALT, 0x0001e); +EVENT(PM_INST_CMPL_ALT, 0x00002); + +/* + * Memory Access Events + * + * Primary PMU event used here is PM_MRK_INST_CMPL (0x401e0) + * To enable capturing of memory profiling, these MMCRA bits + * needs to be programmed and corresponding raw event format + * encoding. + * + * MMCRA bits encoding needed are + * SM (Sampling Mode) + * EM (Eligibility for Random Sampling) + * TECE (Threshold Event Counter Event) + * TS (Threshold Start Event) + * TE (Threshold End Event) + * + * Corresponding Raw Encoding bits: + * sample [EM,SM] + * thresh_sel (TECE) + * thresh start (TS) + * thresh end (TE) + */ + +EVENT(MEM_LOADS, 0x35340401e0); +EVENT(MEM_STORES, 0x353c0401e0); diff --git a/arch/powerpc/perf/power12-pmu.c b/arch/powerpc/perf/power12-pmu.c new file mode 100644 index 000000000000..89cc704b8324 --- /dev/null +++ b/arch/powerpc/perf/power12-pmu.c @@ -0,0 +1,466 @@ +// SPDX-License-Identifier: GPL-2.0-or-later +/* + * Performance counter support for Power12 processors. + * + * Copyright 2026 Athira Rajeev, IBM Corporation. + */ + +#define pr_fmt(fmt) "power12-pmu: " fmt + +#include "isa207-common.h" + +/* + * Raw event encoding for Power12: + * + * 60 56 52 48 44 40 36 32 + * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | + * | | [ ] [ src_match ] [ src_mask ] | [ ] [ l2l3_sel ] [ thresh_ctl ] + * | | | | | | + * | | *- IFM (Linux) | | thresh start/stop -* + * | *- BHRB (Linux) | src_sel + * *- EBB (Linux) *invert_bit + * + * 28 24 20 16 12 8 4 0 + * | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | - - - - | + * [ ] [ sample ] [ ] [ ] [ pmc ] [unit ] [ ] | m [ pmcxsel ] + * | | | | | | | + * | | | | | | *- mark + * | | | *- L1/L2/L3 cache_sel | |*-radix_scope_qual + * | | sdar_mode | + * | *- sampling mode for marked events *- combine + * | + * *- thresh_sel + * + * Below uses IBM bit numbering. + * + * MMCR1[x:y] = unit (PMCxUNIT) + * MMCR1[24] = pmc1combine[0] + * MMCR1[25] = pmc1combine[1] + * MMCR1[26] = pmc2combine[0] + * MMCR1[27] = pmc2combine[1] + * MMCR1[28] = pmc3combine[0] + * MMCR1[29] = pmc3combine[1] + * MMCR1[30] = pmc4combine[0] + * MMCR1[31] = pmc4combine[1] + * + * if pmc == 3 and unit == 0 and pmcxsel[0:6] == 0b0101011 + * MMCR1[20:27] = thresh_ctl + * else if pmc == 4 and unit == 0xf and pmcxsel[0:6] == 0b0101001 + * MMCR1[20:27] = thresh_ctl + * else + * MMCRA[48:55] = thresh_ctl (THRESH START/END) + * + * if thresh_sel: + * MMCRA[45:47] = thresh_sel + * + * if l2l3_sel: + * MMCR2[56:60] = l2l3_sel[0:4] + * + * MMCR1[16] = cache_sel[0] + * MMCR1[17] = cache_sel[1] + * MMCR1[18] = radix_scope_qual + * + * if mark: + * MMCRA[63] = 1 (SAMPLE_ENABLE) + * MMCRA[57:59] = sample[0:2] (RAND_SAMP_ELIG) + * MMCRA[61:62] = sample[3:4] (RAND_SAMP_MODE) + * + * if EBB and BHRB: + * MMCRA[32:33] = IFM + * + * MMCRA[SDAR_MODE] = sdar_mode[0:1] + */ + +/* + * Some power12 event codes. + */ +#define EVENT(_name, _code) enum{_name = _code} + +#include "power12-events-list.h" + +#undef EVENT + +/* MMCRA IFM bits - POWER12 */ +#define POWER12_MMCRA_IFM1 0x0000000040000000UL +#define POWER12_MMCRA_IFM2 0x0000000080000000UL +#define POWER12_MMCRA_IFM3 0x00000000C0000000UL +#define POWER12_MMCRA_BHRB_MASK 0x00000000C0000000UL + +extern u64 PERF_REG_EXTENDED_MASK; + +/* Table of alternatives, sorted by column 0 */ +static const unsigned int power12_event_alternatives[][MAX_ALT] = { + { PM_INST_CMPL_ALT, PM_INST_CMPL }, + { PM_CYC_ALT, PM_CYC }, +}; + +static int power12_get_alternatives(u64 event, unsigned int flags, u64 alt[]) +{ + int num_alt = 0; + + num_alt = isa207_get_alternatives(event, alt, + ARRAY_SIZE(power12_event_alternatives), flags, + power12_event_alternatives); + + return num_alt; +} + +static int power12_check_attr_config(struct perf_event *ev) +{ + u64 val; + u64 event = ev->attr.config; + + val = (event >> EVENT_SAMPLE_SHIFT) & EVENT_SAMPLE_MASK; + if (val == 0x10 || isa3XX_check_attr_config(ev)) + return -EINVAL; + + return 0; +} + +GENERIC_EVENT_ATTR(cpu-cycles, PM_CYC); +GENERIC_EVENT_ATTR(instructions, PM_INST_CMPL); +GENERIC_EVENT_ATTR(branch-instructions, PM_BR_FIN); +GENERIC_EVENT_ATTR(branch-misses, PM_MPRED_BR_FIN); +GENERIC_EVENT_ATTR(cache-references, PM_LD_REF_L1); +GENERIC_EVENT_ATTR(cache-misses, PM_LD_DEMAND_MISS_L1_FIN); +GENERIC_EVENT_ATTR(mem-loads, MEM_LOADS); +GENERIC_EVENT_ATTR(mem-stores, MEM_STORES); + +CACHE_EVENT_ATTR(L1-dcache-load-misses, PM_LD_MISS_L1); +CACHE_EVENT_ATTR(L1-dcache-loads, PM_LD_REF_L1); +CACHE_EVENT_ATTR(L1-dcache-prefetches, PM_LD_PREFETCH_CACHE_LINE_MISS); +CACHE_EVENT_ATTR(L1-dcache-store-misses, PM_ST_MISS_L1); +CACHE_EVENT_ATTR(L1-icache-load-misses, PM_L1_ICACHE_MISS); +CACHE_EVENT_ATTR(L1-icache-loads, PM_INST_FROM_L1); +CACHE_EVENT_ATTR(L1-icache-prefetches, PM_IC_PREF_REQ); +CACHE_EVENT_ATTR(LLC-load-misses, PM_DATA_FROM_L3MISS); +CACHE_EVENT_ATTR(LLC-loads, PM_DATA_FROM_L3); +CACHE_EVENT_ATTR(LLC-prefetches, PM_L3_PF_MISS_L3); +CACHE_EVENT_ATTR(LLC-store-misses, PM_L2_ST_MISS); +CACHE_EVENT_ATTR(LLC-stores, PM_L2_ST); +CACHE_EVENT_ATTR(branch-load-misses, PM_BR_MPRED_CMPL); +CACHE_EVENT_ATTR(branch-loads, PM_BR_CMPL); +CACHE_EVENT_ATTR(dTLB-load-misses, PM_DTLB_MISS); +CACHE_EVENT_ATTR(iTLB-load-misses, PM_ITLB_MISS); + +static struct attribute *power12_events_attr[] = { + GENERIC_EVENT_PTR(PM_CYC), + GENERIC_EVENT_PTR(PM_INST_CMPL), + GENERIC_EVENT_PTR(PM_BR_FIN), + GENERIC_EVENT_PTR(PM_MPRED_BR_FIN), + GENERIC_EVENT_PTR(PM_LD_REF_L1), + GENERIC_EVENT_PTR(PM_LD_DEMAND_MISS_L1_FIN), + GENERIC_EVENT_PTR(MEM_LOADS), + GENERIC_EVENT_PTR(MEM_STORES), + CACHE_EVENT_PTR(PM_LD_MISS_L1), + CACHE_EVENT_PTR(PM_LD_REF_L1), + CACHE_EVENT_PTR(PM_LD_PREFETCH_CACHE_LINE_MISS), + CACHE_EVENT_PTR(PM_ST_MISS_L1), + CACHE_EVENT_PTR(PM_L1_ICACHE_MISS), + CACHE_EVENT_PTR(PM_INST_FROM_L1), + CACHE_EVENT_PTR(PM_IC_PREF_REQ), + CACHE_EVENT_PTR(PM_DATA_FROM_L3MISS), + CACHE_EVENT_PTR(PM_DATA_FROM_L3), + CACHE_EVENT_PTR(PM_L3_PF_MISS_L3), + CACHE_EVENT_PTR(PM_L2_ST_MISS), + CACHE_EVENT_PTR(PM_L2_ST), + CACHE_EVENT_PTR(PM_BR_MPRED_CMPL), + CACHE_EVENT_PTR(PM_BR_CMPL), + CACHE_EVENT_PTR(PM_DTLB_MISS), + CACHE_EVENT_PTR(PM_ITLB_MISS), + NULL +}; + +static const struct attribute_group power12_pmu_events_group = { + .name = "events", + .attrs = power12_events_attr, +}; + +PMU_FORMAT_ATTR(event, "config:0-59"); +PMU_FORMAT_ATTR(pmcxsel, "config:0-7"); +PMU_FORMAT_ATTR(mark, "config:8"); +PMU_FORMAT_ATTR(combine, "config:10-11"); +PMU_FORMAT_ATTR(unit, "config:12-15"); +PMU_FORMAT_ATTR(pmc, "config:16-19"); +PMU_FORMAT_ATTR(cache_sel, "config:20-21"); +PMU_FORMAT_ATTR(sdar_mode, "config:22-23"); +PMU_FORMAT_ATTR(sample_mode, "config:24-28"); +PMU_FORMAT_ATTR(thresh_sel, "config:29-31"); +PMU_FORMAT_ATTR(thresh_stop, "config:32-35"); +PMU_FORMAT_ATTR(thresh_start, "config:36-39"); +PMU_FORMAT_ATTR(l2l3_sel, "config:40-44"); +PMU_FORMAT_ATTR(src_sel, "config:45-46"); +PMU_FORMAT_ATTR(invert_bit, "config:47"); +PMU_FORMAT_ATTR(src_mask, "config:48-53"); +PMU_FORMAT_ATTR(src_match, "config:54-59"); +PMU_FORMAT_ATTR(radix_scope, "config:9"); +PMU_FORMAT_ATTR(thresh_cmp, "config1:0-17"); + +static struct attribute *power12_pmu_format_attr[] = { + &format_attr_event.attr, + &format_attr_pmcxsel.attr, + &format_attr_mark.attr, + &format_attr_combine.attr, + &format_attr_unit.attr, + &format_attr_pmc.attr, + &format_attr_cache_sel.attr, + &format_attr_sdar_mode.attr, + &format_attr_sample_mode.attr, + &format_attr_thresh_sel.attr, + &format_attr_thresh_stop.attr, + &format_attr_thresh_start.attr, + &format_attr_l2l3_sel.attr, + &format_attr_src_sel.attr, + &format_attr_invert_bit.attr, + &format_attr_src_mask.attr, + &format_attr_src_match.attr, + &format_attr_radix_scope.attr, + &format_attr_thresh_cmp.attr, + NULL, +}; + +static const struct attribute_group power12_pmu_format_group = { + .name = "format", + .attrs = power12_pmu_format_attr, +}; + +static const struct attribute_group *power12_pmu_attr_groups[] = { + &power12_pmu_format_group, + &power12_pmu_events_group, + NULL, +}; + +static int power12_generic_events[] = { + [PERF_COUNT_HW_CPU_CYCLES] = PM_CYC, + [PERF_COUNT_HW_INSTRUCTIONS] = PM_INST_CMPL, + [PERF_COUNT_HW_BRANCH_INSTRUCTIONS] = PM_BR_FIN, + [PERF_COUNT_HW_BRANCH_MISSES] = PM_MPRED_BR_FIN, + [PERF_COUNT_HW_CACHE_REFERENCES] = PM_LD_REF_L1, + [PERF_COUNT_HW_CACHE_MISSES] = PM_LD_DEMAND_MISS_L1_FIN, +}; + +static u64 power12_bhrb_filter_map(u64 branch_sample_type) +{ + u64 pmu_bhrb_filter = 0; + + /* BHRB and regular PMU events share the same privilege state + * filter configuration. BHRB is always recorded along with a + * regular PMU event. As the privilege state filter is handled + * in the basic PMC configuration of the accompanying regular + * PMU event, we ignore any separate BHRB specific request. + */ + + /* No branch filter requested */ + if (branch_sample_type & PERF_SAMPLE_BRANCH_ANY) + return pmu_bhrb_filter; + + /* Invalid branch filter options - HW does not support */ + if (branch_sample_type & PERF_SAMPLE_BRANCH_ANY_RETURN) + return -1; + + if (branch_sample_type & PERF_SAMPLE_BRANCH_IND_CALL) { + pmu_bhrb_filter |= POWER12_MMCRA_IFM2; + return pmu_bhrb_filter; + } + + if (branch_sample_type & PERF_SAMPLE_BRANCH_COND) { + pmu_bhrb_filter |= POWER12_MMCRA_IFM3; + return pmu_bhrb_filter; + } + + if (branch_sample_type & PERF_SAMPLE_BRANCH_CALL) + return -1; + + if (branch_sample_type & PERF_SAMPLE_BRANCH_ANY_CALL) { + pmu_bhrb_filter |= POWER12_MMCRA_IFM1; + return pmu_bhrb_filter; + } + + /* Every thing else is unsupported */ + return -1; +} + +static void power12_config_bhrb(u64 pmu_bhrb_filter) +{ + pmu_bhrb_filter &= POWER12_MMCRA_BHRB_MASK; + + /* Enable BHRB filter in PMU */ + mtspr(SPRN_MMCRA, (mfspr(SPRN_MMCRA) | pmu_bhrb_filter)); +} + +#define C(x) PERF_COUNT_HW_CACHE_##x + +/* + * Table of generalized cache-related events. + * 0 means not supported, -1 means nonsensical, other values + * are event codes. + */ +static u64 power12_cache_events[C(MAX)][C(OP_MAX)][C(RESULT_MAX)] = { + [C(L1D)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = PM_LD_REF_L1, + [C(RESULT_MISS)] = PM_LD_MISS_L1, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = 0, + [C(RESULT_MISS)] = PM_ST_MISS_L1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = PM_LD_PREFETCH_CACHE_LINE_MISS, + [C(RESULT_MISS)] = 0, + }, + }, + [C(L1I)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = PM_INST_FROM_L1, + [C(RESULT_MISS)] = PM_L1_ICACHE_MISS, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = PM_INST_FROM_L1MISS, + [C(RESULT_MISS)] = -1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = PM_IC_PREF_REQ, + [C(RESULT_MISS)] = 0, + }, + }, + [C(LL)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = PM_DATA_FROM_L3, + [C(RESULT_MISS)] = PM_DATA_FROM_L3MISS, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = PM_L2_ST, + [C(RESULT_MISS)] = PM_L2_ST_MISS, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = PM_L3_PF_MISS_L3, + [C(RESULT_MISS)] = 0, + }, + }, + [C(DTLB)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = 0, + [C(RESULT_MISS)] = PM_DTLB_MISS, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + }, + [C(ITLB)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = 0, + [C(RESULT_MISS)] = PM_ITLB_MISS, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + }, + [C(BPU)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = PM_BR_CMPL, + [C(RESULT_MISS)] = PM_BR_MPRED_CMPL, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + }, + [C(NODE)] = { + [C(OP_READ)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + [C(OP_WRITE)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + [C(OP_PREFETCH)] = { + [C(RESULT_ACCESS)] = -1, + [C(RESULT_MISS)] = -1, + }, + }, +}; + +#undef C + +/* + * Set the MMCR0[CC56RUN] bit to enable counting for + * PMC5 and PMC6 regardless of the state of CTRL[RUN], + * so that we can use counters 5 and 6 as PM_INST_CMPL and + * PM_CYC. + */ +static int power12_compute_mmcr(u64 event[], int n_ev, + unsigned int hwc[], struct mmcr_regs *mmcr, + struct perf_event *pevents[], u32 flags) +{ + int ret; + + ret = isa207_compute_mmcr(event, n_ev, hwc, mmcr, pevents, flags); + if (!ret) + mmcr->mmcr0 |= MMCR0_C56RUN; + return ret; +} + +static struct power_pmu power12_pmu = { + .name = "Power12", + .n_counter = MAX_PMU_COUNTERS, + .add_fields = ISA207_ADD_FIELDS, + .test_adder = ISA207_TEST_ADDER, + .group_constraint_mask = CNST_CACHE_PMC4_MASK, + .group_constraint_val = CNST_CACHE_PMC4_VAL, + .compute_mmcr = power12_compute_mmcr, + .config_bhrb = power12_config_bhrb, + .bhrb_filter_map = power12_bhrb_filter_map, + .get_constraint = isa207_get_constraint, + .get_alternatives = power12_get_alternatives, + .get_mem_data_src = isa207_get_mem_data_src, + .get_mem_weight = isa207_get_mem_weight, + .disable_pmc = isa207_disable_pmc, + .flags = PPMU_HAS_SIER | PPMU_ARCH_207S | + PPMU_ARCH_31 | PPMU_HAS_ATTR_CONFIG1 | + PPMU_P10, + .n_generic = ARRAY_SIZE(power12_generic_events), + .generic_events = power12_generic_events, + .cache_events = &power12_cache_events, + .attr_groups = power12_pmu_attr_groups, + .bhrb_nr = 32, + .capabilities = PERF_PMU_CAP_EXTENDED_REGS, + .check_attr_config = power12_check_attr_config, +}; + +int __init init_power12_pmu(void) +{ + unsigned int pvr; + int rc; + + pvr = mfspr(SPRN_PVR); + if (PVR_VER(pvr) != PVR_POWER12) + return -ENODEV; + + /* Set the PERF_REG_EXTENDED_MASK here */ + PERF_REG_EXTENDED_MASK = PERF_REG_PMU_MASK_31; + + rc = register_power_pmu(&power12_pmu); + if (rc) + return rc; + + /* Tell userspace that EBB is supported */ + cur_cpu_spec->cpu_user_features2 |= PPC_FEATURE2_EBB; + + return 0; +} From ad0889338bfed33da6b8127d7d8ae0a4d6e4cd5d Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 4 Aug 2026 13:20:12 +0200 Subject: [PATCH 47/62] KVM: PPC: booke: Use min() in watchdog_next_timeout() Replace min_t() with the simpler min() macro since the values are unsigned and compatible. Signed-off-by: Thorsten Blum Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260804112011.59416-3-thorsten.blum@linux.dev --- arch/powerpc/kvm/booke.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/powerpc/kvm/booke.c b/arch/powerpc/kvm/booke.c index 5fba199dfdd6..13ad4cf5fa71 100644 --- a/arch/powerpc/kvm/booke.c +++ b/arch/powerpc/kvm/booke.c @@ -598,7 +598,7 @@ static unsigned long watchdog_next_timeout(struct kvm_vcpu *vcpu) if (do_div(nr_jiffies, tb_ticks_per_jiffy)) nr_jiffies++; - return min_t(unsigned long long, nr_jiffies, TIMER_NEXT_MAX_DELTA); + return min(nr_jiffies, TIMER_NEXT_MAX_DELTA); } static void arm_next_watchdog(struct kvm_vcpu *vcpu) From 0fcdb510932b90160c47d3c38f6ce43852d7e14f Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 4 Aug 2026 13:20:13 +0200 Subject: [PATCH 48/62] KVM: PPC: Use min() in kvm_vm_ioctl_check_extension() Replace min_t() with the simpler min() macro since the values are unsigned and compatible. Signed-off-by: Thorsten Blum Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260804112011.59416-4-thorsten.blum@linux.dev --- arch/powerpc/kvm/powerpc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c index 7ae1aa674d4c..51c48fbce55f 100644 --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -660,9 +660,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) * implementations just count online CPUs. */ if (hv_enabled) - r = min_t(unsigned int, num_present_cpus(), KVM_MAX_VCPUS); + r = min(num_present_cpus(), KVM_MAX_VCPUS); else - r = min_t(unsigned int, num_online_cpus(), KVM_MAX_VCPUS); + r = min(num_online_cpus(), KVM_MAX_VCPUS); break; case KVM_CAP_MAX_VCPUS: r = KVM_MAX_VCPUS; From 66da1ae19672a295507b0c66cd74231e5bf482a9 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:32 -0700 Subject: [PATCH 49/62] gpio: move ppc4xx gpio driver from arch/powerpc to drivers/gpio Move the ppc4xx gpio driver out of arch/powerpc/platforms/44x/ into drivers/gpio/gpio-ppc44x.c. The driver has no architecture-specific dependencies and follows the same pattern as other PowerPC GPIO drivers already in drivers/gpio/ (e.g. gpio-mpc8xxx, gpio-mpc5200). - Renamed Kconfig symbol from PPC4xx_GPIO to GPIO_PPC44X - Updated ppc44x_defconfig and warp_defconfig to use the new symbol - Marked the new option as tristate (was bool) since the driver supports module build via module_platform_driver() Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-2-rosenp@gmail.com --- arch/powerpc/configs/44x/warp_defconfig | 2 +- arch/powerpc/configs/ppc44x_defconfig | 2 +- arch/powerpc/platforms/44x/Kconfig | 7 ------- arch/powerpc/platforms/44x/Makefile | 2 +- drivers/gpio/Kconfig | 7 +++++++ drivers/gpio/Makefile | 1 + .../platforms/44x/gpio.c => drivers/gpio/gpio-ppc44x.c | 0 7 files changed, 11 insertions(+), 10 deletions(-) rename arch/powerpc/platforms/44x/gpio.c => drivers/gpio/gpio-ppc44x.c (100%) diff --git a/arch/powerpc/configs/44x/warp_defconfig b/arch/powerpc/configs/44x/warp_defconfig index 5757625469c4..d6014b9c5708 100644 --- a/arch/powerpc/configs/44x/warp_defconfig +++ b/arch/powerpc/configs/44x/warp_defconfig @@ -12,7 +12,7 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_BLK_DEV_BSG is not set # CONFIG_EBONY is not set CONFIG_WARP=y -CONFIG_PPC4xx_GPIO=y +CONFIG_GPIO_PPC44X=y CONFIG_HZ_1000=y CONFIG_CMDLINE="ip=on" # CONFIG_PCI is not set diff --git a/arch/powerpc/configs/ppc44x_defconfig b/arch/powerpc/configs/ppc44x_defconfig index 0dc537f6aff3..d351551e266f 100644 --- a/arch/powerpc/configs/ppc44x_defconfig +++ b/arch/powerpc/configs/ppc44x_defconfig @@ -22,7 +22,7 @@ CONFIG_GLACIER=y CONFIG_REDWOOD=y CONFIG_EIGER=y CONFIG_YOSEMITE=y -CONFIG_PPC4xx_GPIO=y +CONFIG_GPIO_PPC44X=y CONFIG_MATH_EMULATION=y CONFIG_NET=y CONFIG_PACKET=y diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig index fc79f8466933..150813cea945 100644 --- a/arch/powerpc/platforms/44x/Kconfig +++ b/arch/powerpc/platforms/44x/Kconfig @@ -227,13 +227,6 @@ config PPC44x_SIMPLE help This option enables the simple PowerPC 44x platform support. -config PPC4xx_GPIO - bool "PPC4xx GPIO support" - depends on 44x - select GPIOLIB - help - Enable gpiolib support for ppc440 based boards - # 44x specific CPU modules, selected based on the board above. config 440EP bool diff --git a/arch/powerpc/platforms/44x/Makefile b/arch/powerpc/platforms/44x/Makefile index ca7b1bb442d9..4598d8b89bf4 100644 --- a/arch/powerpc/platforms/44x/Makefile +++ b/arch/powerpc/platforms/44x/Makefile @@ -15,4 +15,4 @@ obj-$(CONFIG_FSP2) += fsp2.o obj-$(CONFIG_PCI) += pci.o obj-$(CONFIG_PPC4xx_HSTA_MSI) += hsta_msi.o obj-$(CONFIG_PPC4xx_CPM) += cpm.o -obj-$(CONFIG_PPC4xx_GPIO) += gpio.o + diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig index 28cf6d2e83c2..b91e04128766 100644 --- a/drivers/gpio/Kconfig +++ b/drivers/gpio/Kconfig @@ -593,6 +593,13 @@ config GPIO_POLARFIRE_SOC help Say yes here to support the GPIO controllers on Microchip FPGAs. +config GPIO_PPC44X + tristate "PPC44x GPIO support" + depends on 44x + select GPIO_GENERIC + help + Enable gpiolib support for ppc440 based boards. + config GPIO_PXA bool "PXA GPIO support" depends on ARCH_PXA || ARCH_MMP || COMPILE_TEST diff --git a/drivers/gpio/Makefile b/drivers/gpio/Makefile index 4d0e900402fc..23aedc107cc5 100644 --- a/drivers/gpio/Makefile +++ b/drivers/gpio/Makefile @@ -147,6 +147,7 @@ obj-$(CONFIG_GPIO_PCIE_IDIO_24) += gpio-pcie-idio-24.o obj-$(CONFIG_GPIO_PCI_IDIO_16) += gpio-pci-idio-16.o obj-$(CONFIG_GPIO_PISOSR) += gpio-pisosr.o obj-$(CONFIG_GPIO_PL061) += gpio-pl061.o +obj-$(CONFIG_GPIO_PPC44X) += gpio-ppc44x.o obj-$(CONFIG_GPIO_PMIC_EIC_SPRD) += gpio-pmic-eic-sprd.o obj-$(CONFIG_GPIO_POLARFIRE_SOC) += gpio-mpfs.o obj-$(CONFIG_GPIO_PXA) += gpio-pxa.o diff --git a/arch/powerpc/platforms/44x/gpio.c b/drivers/gpio/gpio-ppc44x.c similarity index 100% rename from arch/powerpc/platforms/44x/gpio.c rename to drivers/gpio/gpio-ppc44x.c From f9476e237ab351b840f99aadc865c0fc913b65f9 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:33 -0700 Subject: [PATCH 50/62] gpio: ppc44x: update all 4xx to 44x The kernel lost support for 4xx platforms and now only supports 44x. Since this driver is being moved to drivers/gpio/ , take the opportunity to modernize the name. Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-3-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 68 +++++++++++++++++++------------------- 1 file changed, 34 insertions(+), 34 deletions(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index 4413a94cf7a6..9b874ff8b124 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -1,6 +1,6 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * PPC4xx gpio driver + * PPC44x gpio driver * * Copyright (c) 2008 Harris Corporation * Copyright (c) 2008 Sascha Hauer , Pengutronix @@ -23,7 +23,7 @@ #define GPIO_MASK2(gpio) (0xc0000000 >> ((gpio) * 2)) /* Physical GPIO register layout */ -struct ppc4xx_gpio { +struct ppc44x_gpio { __be32 or; __be32 tcr; __be32 osrl; @@ -44,7 +44,7 @@ struct ppc4xx_gpio { __be32 isr3h; }; -struct ppc4xx_gpio_chip { +struct ppc44x_gpio_chip { struct gpio_chip gc; void __iomem *regs; spinlock_t lock; @@ -56,19 +56,19 @@ struct ppc4xx_gpio_chip { * There are a maximum of 32 gpios in each gpio controller. */ -static int ppc4xx_gpio_get(struct gpio_chip *gc, unsigned int gpio) +static int ppc44x_gpio_get(struct gpio_chip *gc, unsigned int gpio) { - struct ppc4xx_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc4xx_gpio __iomem *regs = chip->regs; + struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct ppc44x_gpio __iomem *regs = chip->regs; return !!(in_be32(®s->ir) & GPIO_MASK(gpio)); } static inline void -__ppc4xx_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) +__ppc44x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) { - struct ppc4xx_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc4xx_gpio __iomem *regs = chip->regs; + struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct ppc44x_gpio __iomem *regs = chip->regs; if (val) setbits32(®s->or, GPIO_MASK(gpio)); @@ -76,14 +76,14 @@ __ppc4xx_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) clrbits32(®s->or, GPIO_MASK(gpio)); } -static int ppc4xx_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) +static int ppc44x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) { - struct ppc4xx_gpio_chip *chip = gpiochip_get_data(gc); + struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); unsigned long flags; spin_lock_irqsave(&chip->lock, flags); - __ppc4xx_gpio_set(gc, gpio, val); + __ppc44x_gpio_set(gc, gpio, val); spin_unlock_irqrestore(&chip->lock, flags); @@ -92,10 +92,10 @@ static int ppc4xx_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) return 0; } -static int ppc4xx_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) +static int ppc44x_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) { - struct ppc4xx_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc4xx_gpio __iomem *regs = chip->regs; + struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct ppc44x_gpio __iomem *regs = chip->regs; unsigned long flags; spin_lock_irqsave(&chip->lock, flags); @@ -121,16 +121,16 @@ static int ppc4xx_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) } static int -ppc4xx_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) +ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) { - struct ppc4xx_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc4xx_gpio __iomem *regs = chip->regs; + struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct ppc44x_gpio __iomem *regs = chip->regs; unsigned long flags; spin_lock_irqsave(&chip->lock, flags); /* First set initial value */ - __ppc4xx_gpio_set(gc, gpio, val); + __ppc44x_gpio_set(gc, gpio, val); /* Disable open-drain function */ clrbits32(®s->odr, GPIO_MASK(gpio)); @@ -154,11 +154,11 @@ ppc4xx_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) return 0; } -static int ppc4xx_gpio_probe(struct platform_device *ofdev) +static int ppc44x_gpio_probe(struct platform_device *ofdev) { struct device *dev = &ofdev->dev; struct device_node *np = dev->of_node; - struct ppc4xx_gpio_chip *chip; + struct ppc44x_gpio_chip *chip; struct gpio_chip *gc; chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL); @@ -172,10 +172,10 @@ static int ppc4xx_gpio_probe(struct platform_device *ofdev) gc->parent = dev; gc->base = -1; gc->ngpio = 32; - gc->direction_input = ppc4xx_gpio_dir_in; - gc->direction_output = ppc4xx_gpio_dir_out; - gc->get = ppc4xx_gpio_get; - gc->set = ppc4xx_gpio_set; + gc->direction_input = ppc44x_gpio_dir_in; + gc->direction_output = ppc44x_gpio_dir_out; + gc->get = ppc44x_gpio_get; + gc->set = ppc44x_gpio_set; gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np); if (!gc->label) @@ -188,24 +188,24 @@ static int ppc4xx_gpio_probe(struct platform_device *ofdev) return devm_gpiochip_add_data(dev, gc, chip); } -static const struct of_device_id ppc4xx_gpio_match[] = { +static const struct of_device_id ppc44x_gpio_match[] = { { .compatible = "ibm,ppc4xx-gpio", }, {}, }; -MODULE_DEVICE_TABLE(of, ppc4xx_gpio_match); +MODULE_DEVICE_TABLE(of, ppc44x_gpio_match); -static struct platform_driver ppc4xx_gpio_driver = { - .probe = ppc4xx_gpio_probe, +static struct platform_driver ppc44x_gpio_driver = { + .probe = ppc44x_gpio_probe, .driver = { - .name = "ppc4xx-gpio", - .of_match_table = ppc4xx_gpio_match, + .name = "ppc44x-gpio", + .of_match_table = ppc44x_gpio_match, }, }; -static int __init ppc4xx_gpio_init(void) +static int __init ppc44x_gpio_init(void) { - return platform_driver_register(&ppc4xx_gpio_driver); + return platform_driver_register(&ppc44x_gpio_driver); } -arch_initcall(ppc4xx_gpio_init); +arch_initcall(ppc44x_gpio_init); From f17b0ef8593d2c9f38197c396146b63e918e46fc Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:34 -0700 Subject: [PATCH 51/62] gpio: ppc44x: Use module platform driver helper for GPIO Replace the open-coded arch initcall registration with module_platform_driver(). The initcall level changes from arch_initcall to device_initcall, which is safe since the driver no longer needs architecture-specific ordering. Added MODULE info as a result, otherwise these warnings appear ERROR: modpost: missing MODULE_LICENSE() in drivers/gpio/gpio-ppc4xx.o WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/gpio/gpio-ppc4xx.o Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-4-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index 9b874ff8b124..99fb11cd7966 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -204,8 +204,7 @@ static struct platform_driver ppc44x_gpio_driver = { }, }; -static int __init ppc44x_gpio_init(void) -{ - return platform_driver_register(&ppc44x_gpio_driver); -} -arch_initcall(ppc44x_gpio_init); +MODULE_DESCRIPTION("PPC44x gpio driver"); +MODULE_LICENSE("GPL"); + +module_platform_driver(ppc44x_gpio_driver); From 8ab2d98f635f77132c9fca4e3983c53729ef52cf Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:35 -0700 Subject: [PATCH 52/62] gpio: ppc44x: Use platform resource helper for GPIO MMIO Map the PPC44x GPIO register block through the platform device resource instead of reparsing the firmware node directly. The GPIO node now probes as a platform device, so use the platform helper to keep resource handling aligned with the converted driver model and to report mapping failures with the platform device context. Move ioremap up in order to avoid doing extra work in case of -EPROBE_DEFER. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-5-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index 99fb11cd7966..5db5217c0225 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -158,13 +158,20 @@ static int ppc44x_gpio_probe(struct platform_device *ofdev) { struct device *dev = &ofdev->dev; struct device_node *np = dev->of_node; + struct ppc44x_gpio __iomem *regs; struct ppc44x_gpio_chip *chip; struct gpio_chip *gc; + regs = devm_platform_ioremap_resource(ofdev, 0); + if (IS_ERR(regs)) + return PTR_ERR(regs); + chip = devm_kzalloc(dev, sizeof(*chip), GFP_KERNEL); if (!chip) return -ENOMEM; + chip->regs = regs; + spin_lock_init(&chip->lock); gc = &chip->gc; @@ -181,10 +188,6 @@ static int ppc44x_gpio_probe(struct platform_device *ofdev) if (!gc->label) return -ENOMEM; - chip->regs = devm_of_iomap(dev, np, 0, NULL); - if (IS_ERR(chip->regs)) - return PTR_ERR(chip->regs); - return devm_gpiochip_add_data(dev, gc, chip); } From 714d445a1c8eeefc3167a0e1a6dc766cbc162e40 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:36 -0700 Subject: [PATCH 53/62] gpio: ppc44x: Convert GPIO to generic MMIO Use gpio_generic_chip_init() to set up the PPC44x GPIO chip instead of open-coding the basic get, set, locking and state handling. Keep the PPC44x-specific direction callbacks because they still need to program ODR and the OSR/TSR registers around the generic data and direction registers. Assisted-by: Codex:GPT-5.5 Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-6-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 71 +++++++++++++++----------------------- 1 file changed, 27 insertions(+), 44 deletions(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index 5db5217c0225..d9048452162a 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -11,10 +11,9 @@ #include #include -#include #include #include -#include +#include #include #include #include @@ -45,9 +44,8 @@ struct ppc44x_gpio { }; struct ppc44x_gpio_chip { - struct gpio_chip gc; + struct gpio_generic_chip chip; void __iomem *regs; - spinlock_t lock; }; /* @@ -56,55 +54,34 @@ struct ppc44x_gpio_chip { * There are a maximum of 32 gpios in each gpio controller. */ -static int ppc44x_gpio_get(struct gpio_chip *gc, unsigned int gpio) -{ - struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc44x_gpio __iomem *regs = chip->regs; - - return !!(in_be32(®s->ir) & GPIO_MASK(gpio)); -} - static inline void __ppc44x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) { struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); - struct ppc44x_gpio __iomem *regs = chip->regs; + struct gpio_generic_chip *gen_gc = &chip->chip; if (val) - setbits32(®s->or, GPIO_MASK(gpio)); + gen_gc->sdata |= GPIO_MASK(gpio); else - clrbits32(®s->or, GPIO_MASK(gpio)); -} + gen_gc->sdata &= ~GPIO_MASK(gpio); -static int ppc44x_gpio_set(struct gpio_chip *gc, unsigned int gpio, int val) -{ - struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); - unsigned long flags; - - spin_lock_irqsave(&chip->lock, flags); - - __ppc44x_gpio_set(gc, gpio, val); - - spin_unlock_irqrestore(&chip->lock, flags); - - pr_debug("%s: gpio: %d val: %d\n", __func__, gpio, val); - - return 0; + gpio_generic_write_reg(gen_gc, gen_gc->reg_set, gen_gc->sdata); } static int ppc44x_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) { struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct gpio_generic_chip *gen_gc = &chip->chip; struct ppc44x_gpio __iomem *regs = chip->regs; - unsigned long flags; - spin_lock_irqsave(&chip->lock, flags); + guard(gpio_generic_lock_irqsave)(gen_gc); /* Disable open-drain function */ clrbits32(®s->odr, GPIO_MASK(gpio)); /* Float the pin */ clrbits32(®s->tcr, GPIO_MASK(gpio)); + gen_gc->sdir &= ~GPIO_MASK(gpio); /* Bits 0-15 use TSRL/OSRL, bits 16-31 use TSRH/OSRH */ if (gpio < 16) { @@ -115,8 +92,6 @@ static int ppc44x_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) clrbits32(®s->tsrh, GPIO_MASK2(gpio)); } - spin_unlock_irqrestore(&chip->lock, flags); - return 0; } @@ -124,10 +99,10 @@ static int ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) { struct ppc44x_gpio_chip *chip = gpiochip_get_data(gc); + struct gpio_generic_chip *gen_gc = &chip->chip; struct ppc44x_gpio __iomem *regs = chip->regs; - unsigned long flags; - spin_lock_irqsave(&chip->lock, flags); + guard(gpio_generic_lock_irqsave)(gen_gc); /* First set initial value */ __ppc44x_gpio_set(gc, gpio, val); @@ -137,6 +112,7 @@ ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) /* Drive the pin */ setbits32(®s->tcr, GPIO_MASK(gpio)); + gen_gc->sdir |= GPIO_MASK(gpio); /* Bits 0-15 use TSRL, bits 16-31 use TSRH */ if (gpio < 16) { @@ -147,8 +123,6 @@ ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) clrbits32(®s->tsrh, GPIO_MASK2(gpio)); } - spin_unlock_irqrestore(&chip->lock, flags); - pr_debug("%s: gpio: %d val: %d\n", __func__, gpio, val); return 0; @@ -160,7 +134,9 @@ static int ppc44x_gpio_probe(struct platform_device *ofdev) struct device_node *np = dev->of_node; struct ppc44x_gpio __iomem *regs; struct ppc44x_gpio_chip *chip; + struct gpio_generic_chip_config config; struct gpio_chip *gc; + int ret; regs = devm_platform_ioremap_resource(ofdev, 0); if (IS_ERR(regs)) @@ -172,17 +148,24 @@ static int ppc44x_gpio_probe(struct platform_device *ofdev) chip->regs = regs; - spin_lock_init(&chip->lock); + config = (struct gpio_generic_chip_config) { + .dev = dev, + .sz = 4, + .dat = ®s->ir, + .set = ®s->or, + .dirout = ®s->tcr, + .flags = GPIO_GENERIC_BIG_ENDIAN | + GPIO_GENERIC_BIG_ENDIAN_BYTE_ORDER, + }; - gc = &chip->gc; + ret = gpio_generic_chip_init(&chip->chip, &config); + if (ret) + return ret; + gc = &chip->chip.gc; gc->parent = dev; - gc->base = -1; - gc->ngpio = 32; gc->direction_input = ppc44x_gpio_dir_in; gc->direction_output = ppc44x_gpio_dir_out; - gc->get = ppc44x_gpio_get; - gc->set = ppc44x_gpio_set; gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np); if (!gc->label) From 595f5f25a96adb4ffec89e973756161c30753276 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:37 -0700 Subject: [PATCH 54/62] gpio: ppc44x: drop PPC-specific IO helpers Replace PPC-specific clrbits32()/setbits32() with local helpers using ioread32be()/iowrite32be() which are equivalent on PPC since commit 894fa235eb4c ("powerpc: inline iomap accessors"). Add COMPILE_TEST as a result to increase compile coverage. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-7-rosenp@gmail.com --- drivers/gpio/Kconfig | 2 +- drivers/gpio/gpio-ppc44x.c | 40 ++++++++++++++++++++++++++------------ 2 files changed, 29 insertions(+), 13 deletions(-) diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig index b91e04128766..7a09e42672b4 100644 --- a/drivers/gpio/Kconfig +++ b/drivers/gpio/Kconfig @@ -595,7 +595,7 @@ config GPIO_POLARFIRE_SOC config GPIO_PPC44X tristate "PPC44x GPIO support" - depends on 44x + depends on 44x || COMPILE_TEST select GPIO_GENERIC help Enable gpiolib support for ppc440 based boards. diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index d9048452162a..fd543fbb959a 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -48,6 +48,22 @@ struct ppc44x_gpio_chip { void __iomem *regs; }; +static inline void ppc44x_clrbits32(void __iomem *addr, u32 mask) +{ + u32 val = ioread32be(addr); + + val &= ~mask; + iowrite32be(val, addr); +} + +static inline void ppc44x_setbits32(void __iomem *addr, u32 mask) +{ + u32 val = ioread32be(addr); + + val |= mask; + iowrite32be(val, addr); +} + /* * GPIO LIB API implementation for GPIOs * @@ -77,19 +93,19 @@ static int ppc44x_gpio_dir_in(struct gpio_chip *gc, unsigned int gpio) guard(gpio_generic_lock_irqsave)(gen_gc); /* Disable open-drain function */ - clrbits32(®s->odr, GPIO_MASK(gpio)); + ppc44x_clrbits32(®s->odr, GPIO_MASK(gpio)); /* Float the pin */ - clrbits32(®s->tcr, GPIO_MASK(gpio)); + ppc44x_clrbits32(®s->tcr, GPIO_MASK(gpio)); gen_gc->sdir &= ~GPIO_MASK(gpio); /* Bits 0-15 use TSRL/OSRL, bits 16-31 use TSRH/OSRH */ if (gpio < 16) { - clrbits32(®s->osrl, GPIO_MASK2(gpio)); - clrbits32(®s->tsrl, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->osrl, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->tsrl, GPIO_MASK2(gpio)); } else { - clrbits32(®s->osrh, GPIO_MASK2(gpio)); - clrbits32(®s->tsrh, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->osrh, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->tsrh, GPIO_MASK2(gpio)); } return 0; @@ -108,19 +124,19 @@ ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) __ppc44x_gpio_set(gc, gpio, val); /* Disable open-drain function */ - clrbits32(®s->odr, GPIO_MASK(gpio)); + ppc44x_clrbits32(®s->odr, GPIO_MASK(gpio)); /* Drive the pin */ - setbits32(®s->tcr, GPIO_MASK(gpio)); + ppc44x_setbits32(®s->tcr, GPIO_MASK(gpio)); gen_gc->sdir |= GPIO_MASK(gpio); /* Bits 0-15 use TSRL, bits 16-31 use TSRH */ if (gpio < 16) { - clrbits32(®s->osrl, GPIO_MASK2(gpio)); - clrbits32(®s->tsrl, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->osrl, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->tsrl, GPIO_MASK2(gpio)); } else { - clrbits32(®s->osrh, GPIO_MASK2(gpio)); - clrbits32(®s->tsrh, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->osrh, GPIO_MASK2(gpio)); + ppc44x_clrbits32(®s->tsrh, GPIO_MASK2(gpio)); } pr_debug("%s: gpio: %d val: %d\n", __func__, gpio, val); From 9c4d539d112fb32355a403513023f08bd17360bc Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:38 -0700 Subject: [PATCH 55/62] gpio: ppc44x: fix undefined behavior in GPIO_MASK2 macro Shifting a 32-bit unsigned integer by 32 or more places is undefined behavior in C. GPIO_MASK2 computes its shift amount as (gpio) * 2, and for pins 16-31 in the OSRH/TSRH bank this yields shifts of 32-62. While this happens to work on PowerPC because slw masks the shift count to the low 5 bits, compilers performing value-range propagation may assume the else branch is unreachable and optimize it away, or may evaluate the shift as zero on other architectures via COMPILE_TEST. Mask gpio to the 16-pin bank index so the shift stays within [0, 30]. The registers are banked (OSRL/TSRL for gpio 0-15, OSRH/TSRH for gpio 16-31) with an identical 2-bit-per-pin layout from MSB to LSB, so masking to the within-bank index preserves the intended behavior. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-8-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index fd543fbb959a..9fdc84e922f4 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -19,7 +19,7 @@ #include #define GPIO_MASK(gpio) (0x80000000 >> (gpio)) -#define GPIO_MASK2(gpio) (0xc0000000 >> ((gpio) * 2)) +#define GPIO_MASK2(gpio) (0xc0000000 >> (((gpio) % 16) * 2)) /* Physical GPIO register layout */ struct ppc44x_gpio { From 98a39710fc8d9c70fcf9bacbb0cc802b0c1a0bbe Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 3 Aug 2026 15:35:39 -0700 Subject: [PATCH 56/62] gpio: ppc44x: use dev_name() for chip label Replace devm_kasprintf() with dev_name() for the chip label. dev_name() returns a stable pointer to the device name, so the separate allocation and -ENOMEM check can be dropped. Using dev_name() seems to be common for GPIO labels. Signed-off-by: Rosen Penev Reviewed-by: Linus Walleij Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803223539.86303-9-rosenp@gmail.com --- drivers/gpio/gpio-ppc44x.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/gpio/gpio-ppc44x.c b/drivers/gpio/gpio-ppc44x.c index 9fdc84e922f4..189667e0e1ba 100644 --- a/drivers/gpio/gpio-ppc44x.c +++ b/drivers/gpio/gpio-ppc44x.c @@ -147,7 +147,6 @@ ppc44x_gpio_dir_out(struct gpio_chip *gc, unsigned int gpio, int val) static int ppc44x_gpio_probe(struct platform_device *ofdev) { struct device *dev = &ofdev->dev; - struct device_node *np = dev->of_node; struct ppc44x_gpio __iomem *regs; struct ppc44x_gpio_chip *chip; struct gpio_generic_chip_config config; @@ -179,14 +178,11 @@ static int ppc44x_gpio_probe(struct platform_device *ofdev) return ret; gc = &chip->chip.gc; + gc->label = dev_name(dev); gc->parent = dev; gc->direction_input = ppc44x_gpio_dir_in; gc->direction_output = ppc44x_gpio_dir_out; - gc->label = devm_kasprintf(dev, GFP_KERNEL, "%pOF", np); - if (!gc->label) - return -ENOMEM; - return devm_gpiochip_add_data(dev, gc, chip); } From ac3e65ddddf3128c1f0c2187889fab458fcf4a70 Mon Sep 17 00:00:00 2001 From: Amit Machhiwal Date: Sat, 8 Aug 2026 21:41:45 +0530 Subject: [PATCH 57/62] KVM: PPC: Introduce KVM_CAP_PPC_COMPAT_CAPS and wire up ioctl Introduce a new capability and ioctl to expose CPU compatibility modes supported by the host processor for nested guests. On IBM POWER systems, newer processor generations (N) can operate in compatibility modes corresponding to earlier generations, like (N-1) and (N-2). This is particularly relevant for nested virtualization, where nested KVM guests may need to run with a specific processor compatibility level. Introduce KVM_CAP_PPC_COMPAT_CAPS capability and the corresponding KVM_PPC_GET_COMPAT_CAPS vm ioctl. The ioctl returns a bitmap describing the compatibility modes supported by the host in respective bit numbers, allowing userspace (e.g., QEMU) to select an appropriate compatibility level when configuring nested KVM guests. The ioctl handling is added in kvm_arch_vm_ioctl() and retrieves host CPU compatibility capabilities via a PowerPC-specific backend implementation when available. The struct kvm_ppc_compat_caps places the 'size' field first so it can be read alone via get_user() before copy_struct_from_user() is called, avoiding pointer arithmetic to locate the size field. The ioctl is defined using _IO so the ioctl number remains stable even if the struct grows in future versions. It uses copy_struct_from_user() and copy_struct_to_user() to provide forward- and backward-compatible extensibility: older userspace passing a smaller struct to a newer kernel gets zero-padded trailing fields. Newer userspace passing a larger struct to an older kernel (usize > ksize) succeeds if trailing bytes are zero (the kernel reports back min(usize, ksize) as the filled size); if trailing bytes are non-zero, the kernel writes back ksize into host_caps.size and returns -E2BIG so userspace can retry with the correct size. KVM_PPC_COMPAT_CAPS_SIZE_VER0 is defined as a frozen integer constant (24) marking the size of the initial struct version, used as the minimum floor for size field validation, similar to other versioned struct interfaces in the kernel. The 'flags' field is reserved for future use. The kernel rejects any call where flags is non-zero with -EINVAL, preventing garbage values from being baked into ABI permanently. The ioctl returns appropriate error codes: E2BIG if usize exceeds PAGE_SIZE, or if new userspace provides a larger struct with non-zero trailing bytes (with ksize written back into host_caps.size for the retry); EINVAL for an invalid size or non-zero reserved fields; EFAULT for failed copy operations; and ENOTTY if the backend doesn't implement get_compat_caps. Suggested-by: Vaibhav Jain Tested-by: Gautam Menghani Reviewed-by: Gautam Menghani Tested-by: Anushree Mathur Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260808161148.66673-2-amachhiw@linux.ibm.com --- arch/powerpc/include/asm/kvm_ppc.h | 1 + arch/powerpc/include/uapi/asm/kvm.h | 8 +++ arch/powerpc/kvm/powerpc.c | 78 +++++++++++++++++++++++++++++ include/uapi/linux/kvm.h | 3 ++ 4 files changed, 90 insertions(+) diff --git a/arch/powerpc/include/asm/kvm_ppc.h b/arch/powerpc/include/asm/kvm_ppc.h index 0953f2daa466..169ea6a7fbad 100644 --- a/arch/powerpc/include/asm/kvm_ppc.h +++ b/arch/powerpc/include/asm/kvm_ppc.h @@ -319,6 +319,7 @@ struct kvmppc_ops { bool (*hash_v3_possible)(void); int (*create_vm_debugfs)(struct kvm *kvm); int (*create_vcpu_debugfs)(struct kvm_vcpu *vcpu, struct dentry *debugfs_dentry); + int (*get_compat_caps)(struct kvm_ppc_compat_caps *host_caps); }; extern struct kvmppc_ops *kvmppc_hv_ops; diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h index 077c5437f521..19e53d5ae540 100644 --- a/arch/powerpc/include/uapi/asm/kvm.h +++ b/arch/powerpc/include/uapi/asm/kvm.h @@ -437,6 +437,14 @@ struct kvm_ppc_cpu_char { __u64 behaviour_mask; /* valid bits in behaviour */ }; +/* For KVM_PPC_GET_COMPAT_CAPS */ +struct kvm_ppc_compat_caps { + __u64 size; /* Size of this structure */ + __u64 flags; /* Reserved for future use */ + __u64 compat_capabilities; /* Capabilities supported by the host */ +}; +#define KVM_PPC_COMPAT_CAPS_SIZE_VER0 24 /* sizeof first published struct */ + /* * Values for character and character_mask. * These are identical to the values used by H_GET_CPU_CHARACTERISTICS. diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c index 51c48fbce55f..9194cf492d1c 100644 --- a/arch/powerpc/kvm/powerpc.c +++ b/arch/powerpc/kvm/powerpc.c @@ -722,6 +722,13 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) } } break; +#if defined(CONFIG_KVM_BOOK3S_HV_POSSIBLE) + case KVM_CAP_PPC_COMPAT_CAPS: + r = 0; + if (hv_enabled && kvmhv_on_pseries()) + r = 1; + break; +#endif /* CONFIG_KVM_BOOK3S_HV_POSSIBLE */ default: r = 0; break; @@ -2488,6 +2495,77 @@ int kvm_arch_vm_ioctl(struct file *filp, unsigned int ioctl, unsigned long arg) r = kvm->arch.kvm_ops->svm_off(kvm); break; } + case KVM_PPC_GET_COMPAT_CAPS: { + struct kvm_ppc_compat_caps host_caps = {}; + u64 usize; + + /* + * Read the size field first to drive copy_struct_from_user. + * size must be the first field of the struct. + */ + r = -EFAULT; + if (get_user(usize, (__u64 __user *)argp)) + goto out; + + r = -E2BIG; + if (unlikely(usize > PAGE_SIZE)) + goto out; + + /* + * Enforce a minimum: reject buffers smaller than the initial + * struct version (VER0). This allows old userspace compiled + * against the original struct to still work on a newer kernel + * that has grown the struct with appended fields. + */ + r = -EINVAL; + if (usize < KVM_PPC_COMPAT_CAPS_SIZE_VER0) + goto out; + + /* + * copy_struct_from_user() handles forward/backward compat: + * usize == ksize: verbatim copy + * usize < ksize: zero-pad trailing (old userspace, new kernel) + * usize > ksize: succeed iff trailing bytes are zero, else -E2BIG + */ + r = copy_struct_from_user(&host_caps, sizeof(host_caps), + argp, usize); + if (r) { + /* + * New userspace with a larger struct called an older + * kernel. Write back ksize in host_caps.size so + * userspace knows which older struct to retry with, + * then fail with -E2BIG. + */ + if (r == -E2BIG) + if (put_user((__u64)sizeof(host_caps), + (__u64 __user *)argp)) + r = -EFAULT; + goto out; + } + + /* Reserved fields must be zero */ + r = -EINVAL; + if (host_caps.flags) + goto out; + + r = -ENOTTY; + if (!kvm->arch.kvm_ops->get_compat_caps) + goto out; + + r = kvm->arch.kvm_ops->get_compat_caps(&host_caps); + if (r) + goto out; + + /* + * Report the number of bytes actually populated by the kernel, + * not usize: if new userspace passed a larger struct with zero + * trailing bytes, we only filled sizeof(host_caps) bytes. + */ + host_caps.size = min_t(u64, usize, sizeof(host_caps)); + r = copy_struct_to_user(argp, usize, &host_caps, + sizeof(host_caps), NULL); + break; + } default: { struct kvm *kvm = filp->private_data; r = kvm->arch.kvm_ops->arch_vm_ioctl(filp, ioctl, arg); diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h index 419011097fa8..70e36e6a0ad4 100644 --- a/include/uapi/linux/kvm.h +++ b/include/uapi/linux/kvm.h @@ -997,6 +997,7 @@ struct kvm_enable_cap { #define KVM_CAP_S390_KEYOP 247 #define KVM_CAP_S390_VSIE_ESAMODE 248 #define KVM_CAP_S390_HPAGE_2G 249 +#define KVM_CAP_PPC_COMPAT_CAPS 250 struct kvm_irq_routing_irqchip { __u32 irqchip; @@ -1341,6 +1342,8 @@ struct kvm_s390_keyop { /* Available with KVM_CAP_COUNTER_OFFSET */ #define KVM_ARM_SET_COUNTER_OFFSET _IOW(KVMIO, 0xb5, struct kvm_arm_counter_offset) #define KVM_ARM_GET_REG_WRITABLE_MASKS _IOR(KVMIO, 0xb6, struct reg_mask_range) +/* Available with KVM_CAP_PPC_COMPAT_CAPS */ +#define KVM_PPC_GET_COMPAT_CAPS _IO(KVMIO, 0xb8) /* ioctl for vm fd */ #define KVM_CREATE_DEVICE _IOWR(KVMIO, 0xe0, struct kvm_create_device) From b76fb087efcdaf6eb5c2c6c5e53c763640fc4b02 Mon Sep 17 00:00:00 2001 From: Amit Machhiwal Date: Sat, 8 Aug 2026 21:41:46 +0530 Subject: [PATCH 58/62] KVM: PPC: Book3S HV: Implement compat CPU capability retrieval for KVM on PowerVM On POWER systems, the host CPU may run in a compatibility mode (e.g., a Power11 processor operating in Power10 compatibility mode). In such cases, the effective CPU level exposed to guests differs from the physical processor generation. When running nested KVM guests, QEMU derives the host CPU type using mfpvr(), which reflects the physical processor version. This can result in a mismatch between the CPU model selected by QEMU and the compatibility mode enforced by the host, leading to guest boot failures. For example, booting a nested guest on a Power11 LPAR configured in Power10 compatibility mode fails with: KVM-NESTEDv2: couldn't set guest wide elements [..KVM reg dump..] This occurs because QEMU selects a CPU model corresponding to the physical processor (via mfpvr()), while the host operates in a lower compatibility mode. As a result, KVM rejects the requested compatibility level during guest initialization. On pseries nestedv2 systems, add support for retrieving host CPU compatibility capabilities for nested guests on PowerVM. The capability bitmap reflects the processor modes negotiated between the Power hypervisor (L0) and the host partition (L1) via the H_GUEST_GET_CAPABILITIES hcall, but is retrieved from the cached nested_capabilities value populated during module initialization, avoiding repeated hypervisor calls. A WARN_ON_ONCE() flags the unexpected case where nested_capabilities is zero on a nestedv2 system. The implementation defines KVM-specific capability constants (KVM_PPC_COMPAT_CAP_POWER9/10/11), masks unsupported bits, and exposes the result through the KVM_PPC_GET_COMPAT_CAPS ioctl. Hook the implementation into the Book3S HV kvmppc_ops so that it can be invoked by the generic KVM ioctl handling code. Suggested-by: Vaibhav Jain Tested-by: Gautam Menghani Reviewed-by: Gautam Menghani Tested-by: Anushree Mathur Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260808161148.66673-3-amachhiw@linux.ibm.com --- arch/powerpc/include/uapi/asm/kvm.h | 10 ++++++++++ arch/powerpc/kvm/book3s_hv.c | 20 ++++++++++++++++++++ 2 files changed, 30 insertions(+) diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h index 19e53d5ae540..913a64b901a3 100644 --- a/arch/powerpc/include/uapi/asm/kvm.h +++ b/arch/powerpc/include/uapi/asm/kvm.h @@ -445,6 +445,16 @@ struct kvm_ppc_compat_caps { }; #define KVM_PPC_COMPAT_CAPS_SIZE_VER0 24 /* sizeof first published struct */ +/* + * Capability bits for compat_capabilities field in kvm_ppc_compat_caps. + * These bits indicate which processor compatibility modes are supported. + */ +#define KVM_PPC_COMPAT_CAP_POWER9 (1ULL << 62) +#define KVM_PPC_COMPAT_CAP_POWER10 (1ULL << 61) +#define KVM_PPC_COMPAT_CAP_POWER11 (1ULL << 60) +#define KVM_PPC_COMPAT_BITMASK (KVM_PPC_COMPAT_CAP_POWER9 | \ + KVM_PPC_COMPAT_CAP_POWER10 | \ + KVM_PPC_COMPAT_CAP_POWER11) /* * Values for character and character_mask. * These are identical to the values used by H_GET_CPU_CHARACTERISTICS. diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c index 1b5f5ebea4a3..5286ad3fa0f4 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c @@ -6539,6 +6539,25 @@ static bool kvmppc_hash_v3_possible(void) return true; } + +static int kvmppc_get_compat_caps(struct kvm_ppc_compat_caps *host_caps) +{ + unsigned long capabilities = 0; + long rc = -EINVAL; + + if (kvmhv_on_pseries()) { + if (kvmhv_is_nestedv2()) { + WARN_ON_ONCE(!nested_capabilities); + capabilities = nested_capabilities; + rc = 0; + } + } + + host_caps->compat_capabilities = capabilities & KVM_PPC_COMPAT_BITMASK; + + return rc; +} + static struct kvmppc_ops kvm_ops_hv = { .get_sregs = kvm_arch_vcpu_ioctl_get_sregs_hv, .set_sregs = kvm_arch_vcpu_ioctl_set_sregs_hv, @@ -6581,6 +6600,7 @@ static struct kvmppc_ops kvm_ops_hv = { .hash_v3_possible = kvmppc_hash_v3_possible, .create_vcpu_debugfs = kvmppc_arch_create_vcpu_debugfs_hv, .create_vm_debugfs = kvmppc_arch_create_vm_debugfs_hv, + .get_compat_caps = kvmppc_get_compat_caps, }; static int kvm_init_subcore_bitmap(void) From 8735048f54ec827102dcbd757a6c1c1e02613fc4 Mon Sep 17 00:00:00 2001 From: Amit Machhiwal Date: Sat, 8 Aug 2026 21:41:47 +0530 Subject: [PATCH 59/62] KVM: PPC: Book3S HV: Add support for compat CPU capabilities for KVM on PowerNV Currently, when booting a compatibility-mode KVM guest (L1) on a PowerNV hypervisor (L0), the guest runs with the expected processor compatibility level. However, when booting a nested KVM guest (L2) inside the L1, QEMU derives the CPU model from the raw host PVR and attempts to run the nested guest at that level, instead of honoring the compatibility mode of the L1. Extend host CPU compatibility capability reporting to support nested virtualization on PowerNV systems (PAPR nested API v1). For nested API v2 (PowerVM), compatibility capabilities are served from the cached nested_capabilities value (populated at module init via kvmhv_nested_init() using the H_GUEST_GET_CAPABILITIES hcall). This information is not available on PowerNV systems. For nested API v1, derive the compatibility capabilities from the L1 guest by reading the "cpu-version" property from the device tree, which reflects the effective (logical) processor compatibility level. Map this value to the corresponding compatibility capability bitmap using KVM-specific constants. The mapping is cumulative: a system running at a given compatibility level is assumed to also support older generations down the supported chain. Note that unlike KVM on PowerVM (nested API v2), KVM on PowerNV currently does not strictly enforce older generation compatibility modes for nested guests - the reported capabilities reflect what the host CPU can present, not what the hypervisor independently validates. Introduce a helper kvmppc_map_compat_capabilities() to translate CPU version values into KVM_PPC_COMPAT_CAP bits using a fallthrough switch, and integrate it into kvmppc_get_compat_caps(). The implementation applies masking to ensure only supported processor modes are exposed. This allows userspace to query host CPU compatibility modes on both KVM on PowerVM and on PowerNV platforms via the KVM_PPC_GET_COMPAT_CAPS ioctl. Suggested-by: Vaibhav Jain Tested-by: Gautam Menghani Reviewed-by: Gautam Menghani Tested-by: Anushree Mathur Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260808161148.66673-4-amachhiw@linux.ibm.com --- arch/powerpc/kvm/book3s_hv.c | 36 ++++++++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c index 5286ad3fa0f4..0409ac9e7b31 100644 --- a/arch/powerpc/kvm/book3s_hv.c +++ b/arch/powerpc/kvm/book3s_hv.c @@ -6539,20 +6539,56 @@ static bool kvmppc_hash_v3_possible(void) return true; } +static int kvmppc_map_compat_capabilities(u32 cpu_version, + unsigned long *capabilities) +{ + switch (cpu_version) { + case PVR_ARCH_31_P11: + *capabilities |= KVM_PPC_COMPAT_CAP_POWER11; + fallthrough; + case PVR_ARCH_31: + *capabilities |= KVM_PPC_COMPAT_CAP_POWER10; + fallthrough; + case PVR_ARCH_300: + *capabilities |= KVM_PPC_COMPAT_CAP_POWER9; + break; + default: + return -EINVAL; + } + + return 0; +} static int kvmppc_get_compat_caps(struct kvm_ppc_compat_caps *host_caps) { + struct device_node *np; unsigned long capabilities = 0; long rc = -EINVAL; + u32 cpu_version = 0; if (kvmhv_on_pseries()) { if (kvmhv_is_nestedv2()) { WARN_ON_ONCE(!nested_capabilities); capabilities = nested_capabilities; rc = 0; + } else { + for_each_node_by_type(np, "cpu") { + if (!of_property_read_u32(np, "cpu-version", + &cpu_version)) { + of_node_put(np); + break; + } + } + if (!cpu_version) + return -EINVAL; + rc = kvmppc_map_compat_capabilities(cpu_version, + &capabilities); } } + if (rc < 0) + return rc; + host_caps->compat_capabilities = capabilities & KVM_PPC_COMPAT_BITMASK; return rc; From c1721e584244ff79a593d6f0ad0405a2e07b765a Mon Sep 17 00:00:00 2001 From: Amit Machhiwal Date: Sat, 8 Aug 2026 21:41:48 +0530 Subject: [PATCH 60/62] KVM: PPC: Document KVM_PPC_GET_COMPAT_CAPS ioctl Add documentation for the KVM_PPC_GET_COMPAT_CAPS ioctl to the KVM API documentation. The ioctl exposes host processor compatibility modes supported for nested KVM guests on PowerPC systems. The documentation covers error code descriptions including E2BIG for forward compatibility, KVM_PPC_COMPAT_CAPS_SIZE_VER0 as the minimum size floor, the rationale for rejecting non-zero reserved fields to prevent ABI ambiguity, bit numbering clarification for IBM MSB-0 convention, and KVM-specific capability bit constants. Tested-by: Gautam Menghani Reviewed-by: Gautam Menghani Tested-by: Anushree Mathur Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Amit Machhiwal Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260808161148.66673-5-amachhiw@linux.ibm.com --- Documentation/virt/kvm/api.rst | 77 ++++++++++++++++++++++++++++++++++ 1 file changed, 77 insertions(+) diff --git a/Documentation/virt/kvm/api.rst b/Documentation/virt/kvm/api.rst index a5f9ee92f43e..2918653b2ab4 100644 --- a/Documentation/virt/kvm/api.rst +++ b/Documentation/virt/kvm/api.rst @@ -6566,6 +6566,83 @@ KVM_S390_KEYOP_SSKE Sets the storage key for the guest address ``guest_addr`` to the key specified in ``key``, returning the previous value in ``key``. +4.145 KVM_PPC_GET_COMPAT_CAPS +----------------------------- +:Capability: KVM_CAP_PPC_COMPAT_CAPS +:Architectures: powerpc +:Type: vm ioctl +:Parameters: struct kvm_ppc_compat_caps (in/out) +:Returns: 0 on success, negative value on failure + +Errors include: + + ======== ============================================================ + EFAULT if ``struct kvm_ppc_compat_caps`` cannot be read from or + written to userspace + EINVAL if the ``size`` field is smaller than + ``KVM_PPC_COMPAT_CAPS_SIZE_VER0``, if the ``flags`` field + is non-zero, or if the backend fails to retrieve or map + CPU compatibility capabilities + E2BIG if ``size`` exceeds ``PAGE_SIZE`` (pathological input guard), + or if ``size`` is larger than the kernel's struct size and + the unknown trailing bytes are non-zero (new userspace on + old kernel with non-default fields set); in the latter case + the kernel writes back its own struct size into the ``size`` + field so userspace can retry with the correct size + ENOTTY if the backend does not implement the ``get_compat_caps`` + operation (e.g., on non-HV KVM implementations where the + required KVM operations are not available) + ======== ============================================================ + +IBM POWER system server-based processors provide a compatibility mode feature +where an Nth generation processor can operate in modes consistent with earlier +generations such as (N-1) and (N-2). + +This ioctl provides userspace with information about the CPU compatibility modes +supported by the current host processor for booting the nested KVM guests on +KVM on PowerNV (nested API v1) and KVM on PowerVM (nested API v2) platforms. + +:: + + struct kvm_ppc_compat_caps { + __u64 size; /* Size of this structure */ + __u64 flags; /* Reserved for future use, must be 0 */ + __u64 compat_capabilities; /* Capabilities supported by the host */ + }; + +Before calling this ioctl, userspace must set the ``size`` field to +``sizeof(struct kvm_ppc_compat_caps)`` and zero the ``flags`` field. +The kernel rejects non-zero ``flags`` with ``-EINVAL`` to prevent +uninitialized stack values from being silently accepted, keeping the +field available for future use without ABI ambiguity. + +The ioctl uses ``copy_struct_from_user()`` and ``copy_struct_to_user()`` +to support extensible versioning. + +``KVM_PPC_COMPAT_CAPS_SIZE_VER0`` (24) is a frozen constant marking the +size of the initial struct version. + +The ``compat_capabilities`` bit field describes the processor compatibility +modes supported by the host. The following bits indicate support for specific +processor modes (using IBM's MSB-0 convention where bit 0 is the most +significant bit): + +- ``KVM_PPC_COMPAT_CAP_POWER9`` (bit 1) -- KVM guests can run in Power9 processor mode +- ``KVM_PPC_COMPAT_CAP_POWER10`` (bit 2) -- KVM guests can run in Power10 processor mode +- ``KVM_PPC_COMPAT_CAP_POWER11`` (bit 3) -- KVM guests can run in Power11 processor mode + +.. note:: + + The bit numbering above uses IBM's MSB-0 convention (bit 0 is the most + significant bit). In the actual implementation, these are defined as: + + - ``KVM_PPC_COMPAT_CAP_POWER9`` = ``(1ULL << 62)`` + - ``KVM_PPC_COMPAT_CAP_POWER10`` = ``(1ULL << 61)`` + - ``KVM_PPC_COMPAT_CAP_POWER11`` = ``(1ULL << 60)`` + + Userspace should use the defined constants from ```` rather + than hardcoding bit positions. + .. _kvm_run: 5. The kvm_run structure From 3921cfc2e8155a767235801be88cbd0e4c73508d Mon Sep 17 00:00:00 2001 From: Michael Walle Date: Thu, 30 Jul 2026 12:52:18 +0200 Subject: [PATCH 61/62] powerpc/configs: enable CONFIG_RAS to fix EDAC support Before commit e3c4ff6d8c94 ("EDAC: Remove EDAC_MM_EDAC") EDAC_MM_EDAC selected RAS, after that commit, EDAC depends on RAS, but nobody enables it. Enable it in the config again. Fixes: e3c4ff6d8c94 ("EDAC: Remove EDAC_MM_EDAC") Signed-off-by: Michael Walle Acked-by: Borislav Petkov (AMD) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260730105546.3658570-1-mwalle@kernel.org --- arch/powerpc/configs/85xx-hw.config | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/powerpc/configs/85xx-hw.config b/arch/powerpc/configs/85xx-hw.config index 2b19c20a9a2c..6b8471810143 100644 --- a/arch/powerpc/configs/85xx-hw.config +++ b/arch/powerpc/configs/85xx-hw.config @@ -90,6 +90,7 @@ CONFIG_PPC_EPAPR_HV_BYTECHAN=y CONFIG_QE_GPIO=y CONFIG_QUICC_ENGINE=y CONFIG_RAPIDIO=y +CONFIG_RAS=y CONFIG_RTC_CLASS=y CONFIG_RTC_DRV_CMOS=y CONFIG_RTC_DRV_DS1307=y From 1304643a1c20badbb91b86a5084dd76cb7620c05 Mon Sep 17 00:00:00 2001 From: Gaurav Batra Date: Mon, 3 Aug 2026 17:40:29 -0500 Subject: [PATCH 62/62] powerpc/pseries/iommu: switch to Default DMA window during kdump In PowerPC (pseries) a non-virtualized adapter will have 2 DMA windows - 2GB default and a larger Dynamic DMA Window (DDW). DDW is large enough to map total RAM to a device. During normal functioning of OS, since RAM is pre-mapped, 2GB default window is not used. The only scenario it might get used is when buffers in pmemory are mapped to the device for DMA. As of today, during kdump, during early device discovery, pci_dma_find() finds that the device has 2 DMA windows. It selects to use DDW. This is a kdump path and DMA window is needed for IO to the device. Although commit 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV") fixed an issue during kdump with SR-IOV case, but this also made the kdump prefer DDW over the default DMA window when both are present (dedicated adapter case). Since the DDW is fully mapped by the previous kernel, iommu_table_clear() can free only KDUMP_MIN_TCE_ENTRIES (2048) TCEs for use by kdump kernel. This is not enough when the dump device is NVMe over Fibre Channel. Because nvme-fc driver DMA-maps the cmds and resp IUs of every pre-allocated request and each such mapping consumes roughly: 32 (IO queues, one per cpus = nr_cpus) * 64 (queue_depth, blk-mq kdump limit) * 2 (cmd+resp) = 4096 This is already double of what we have without counting admin queues and lpfc driver's own allocations / mapping requirement. Hence this results into iommu_alloc failures like - lpfc 0153:70:00.0: iommu_alloc failed, tbl 0000000034ebcf5e vaddr 00000000d814df0b npages 1 lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed. lpfc 0153:70:00.0: iommu_alloc failed, tbl 0000000034ebcf5e vaddr 000000009779e4d2 npages 1 lpfc 0153:70:00.0: FCP Op failed - cmdiu dma mapping failed. iommu_map_phys+0x1c4/0x1f0 (unreliable) dma_iommu_map_phys+0x54/0xa0 dma_map_phys+0x3f8/0x590 __nvme_fc_init_request+0x110/0x300 [nvme_fc] nvme_fc_init_request+0x60/0xb8 [nvme_fc] blk_mq_alloc_map_and_rqs+0x388/0x510 blk_mq_alloc_tag_set+0x2a4/0x5f0 nvme_alloc_io_tag_set+0xe0/0x1e0 [nvme_core] nvme_fc_connect_ctrl_work+0x85c/0xdac [nvme_fc] process_one_work+0x1e4/0x5a0 worker_thread+0x1ec/0x3e0 Increasing the number of free TCE entries in iommu_table_clear() will increase the probability of hitting EEH since there could still be some active IOs from the previous life of the kernel. Hence this patch partially reverts the previous fixes commit and switches the kdump's default back to 2GB default DMA window instead of DDW window. This window will mostly be empty. Or, could be slightly used if buffers in pmemory were mapped for IO. Fixes: 09a3c1e46142 ("powerpc/pseries/iommu: IOMMU table is not initialized for kdump over SR-IOV") Cc: stable@vger.kernel.org Signed-off-by: Gaurav Batra Reviewed-by: Ritesh Harjani (IBM) Signed-off-by: Madhavan Srinivasan Link: https://patch.msgid.link/20260803224029.60538-1-gbatra@linux.ibm.com --- arch/powerpc/platforms/pseries/iommu.c | 23 ++++++++++++----------- 1 file changed, 12 insertions(+), 11 deletions(-) diff --git a/arch/powerpc/platforms/pseries/iommu.c b/arch/powerpc/platforms/pseries/iommu.c index 3e1f915fe4f6..272e9aab66d4 100644 --- a/arch/powerpc/platforms/pseries/iommu.c +++ b/arch/powerpc/platforms/pseries/iommu.c @@ -812,18 +812,11 @@ static struct device_node *pci_dma_find(struct device_node *dn, /* parse DMA window property. During normal system boot, only default * DMA window is passed in OF. But, for kdump, a dedicated adapter might - * have both default and DDW in FDT. In this scenario, DDW takes precedence - * over default window. + * have both default and DDW in FDT. In this scenario, default window + * takes precedence over DDW. For a dedicated adapter, default window will + * potentially have more unused TCEs. */ - if (ddw_win) { - struct dynamic_dma_window_prop *p; - - p = (struct dynamic_dma_window_prop *)ddw_prop; - prop->liobn = p->liobn; - prop->dma_base = p->dma_base; - prop->tce_shift = p->tce_shift; - prop->window_shift = p->window_shift; - } else if (default_win) { + if (default_win) { unsigned long offset, size, liobn; of_parse_dma_window(rdn, default_prop, &liobn, &offset, &size); @@ -832,6 +825,14 @@ static struct device_node *pci_dma_find(struct device_node *dn, prop->dma_base = cpu_to_be64(offset); prop->tce_shift = cpu_to_be32(IOMMU_PAGE_SHIFT_4K); prop->window_shift = cpu_to_be32(order_base_2(size)); + } else { + struct dynamic_dma_window_prop *p; + + p = (struct dynamic_dma_window_prop *)ddw_prop; + prop->liobn = p->liobn; + prop->dma_base = p->dma_base; + prop->tce_shift = p->tce_shift; + prop->window_shift = p->window_shift; } return rdn;