Skip to content

Backport feature FEAT_SVE_B1616 and 2023 DPISA extensions - #150

Closed
hbrobin wants to merge 28 commits into
openvelinux:opensource-lts_upgrade_6.6.151-2026-08-21_20-50-15from
hbrobin:6.6.151-lts-2023dpisa
Closed

hbrobin wants to merge 28 commits into
openvelinux:opensource-lts_upgrade_6.6.151-2026-08-21_20-50-15from
hbrobin:6.6.151-lts-2023dpisa

Conversation

@hbrobin

@hbrobin hbrobin commented Sep 16, 2026

Copy link
Copy Markdown

Backport patch serials:
https://lore.kernel.org/linux-arm-kernel/20230915-arm64-zfr-b16b16-el0-v1-0-f9aba807bdb5@kernel.org/
https://lore.kernel.org/linux-arm-kernel/20240306-arm64-2023-dpisa-v5-0-c568edc8ed7f@kernel.org/

Patch List

Type          Commit        Subject
prerequisite  9fb5dc53a117  arm64/sysreg: Add definition for ID_AA64PFR2_EL1
prerequisite  6e3dcfd13975  arm64/sysreg: Update ID_AA64ISAR2_EL1 defintion for DDI0601 2023-09
prerequisite  b5aefb668701  arm64/sysreg: Add definition for ID_AA64ISAR3_EL1
prerequisite  9e4f409b07df  arm64/sysreg: Add definition for ID_AA64FPFR0_EL1
prerequisite  8afe582d7700  arm64/sysreg: Update ID_AA64SMFR0_EL1 definition for DDI0601 2023-09
prerequisite  a6052284a9f9  arm64/sysreg: Update SCTLR_EL1 for DDI0601 2023-09
prerequisite  126cb3a60d35  arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09
prerequisite  e3a649ecf8b9  arm64/sysreg: Add definition for FPMR
prerequisite  d3a181588df9  arm64/fpsimd: Add fpsimd_save_and_flush_current_state()
upstream_fix  3aa4d74438af  arm64/fpsimd: signal32: Always save+flush state early
SVE_B16B16    5d5b4e8c2d9e  arm64/sve: Report FEAT_SVE_B16B16 to userspace
SVE_B16B16    3accaef1f61e  kselftest/arm64: Verify HWCAP2_SVE_B16B16
2023_DPISA    cc9f69a3dad3  arm64/cpufeature: Hook new identification registers up to cpufeature
2023_DPISA    b6c0b424cb91  arm64/fpsimd: Enable host kernel access to FPMR
2023_DPISA    203f2b95a882  arm64/fpsimd: Support FEAT_FPMR
2023_DPISA    8c46def44409  arm64/signal: Add FPMR signal handling
2023_DPISA    4035c22ef7d4  arm64/ptrace: Expose FPMR via ptrace
2023_DPISA    c1932cac7902  arm64/hwcap: Define hwcaps for 2023 DPISA features
2023_DPISA    f4dcccdda586  kselftest/arm64: Handle FPMR context in generic signal frame parser
2023_DPISA    7bcebadda045  kselftest/arm64: Add basic FPMR test
2023_DPISA    44d10c27bd75  kselftest/arm64: Add 2023 DPISA hwcap test coverage
upstream_fix  f5d71291841a  arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR
upstream_fix  e5fa85fce08b  arm64/fpsimd: Don't corrupt FPMR when streaming mode changes
upstream_fix  a90878f297d3  arm64/fpsimd: Reset FPMR upon exec()
upstream_fix  b0d80dbc378d  kselftest/arm64: hwcap: fix f8dp2 cpuinfo name
upstream_fix  69c0d8247798  kselftest/arm64: Fix encoding for SVE B16B16 test
upstream_fix  929fa99b1215  arm64/fpsimd: signal: Always save+flush state early
upstream_fix  f699c66691fb  arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused

ByteDance ci-checker Results

Key:
[----] : patches are identical
[####] : number of functional differences between upstream/downstream patch
[down] : patch is downstream-only
The flags [FC] indicate (F)unctional and (C)ontextual differences, respectively

001/28:[----] [--] 'arm64/sysreg: Add definition for ID_AA64PFR2_EL1'
002/28:[----] [--] 'arm64/sysreg: Update ID_AA64ISAR2_EL1 defintion for DDI0601 2023-09'
003/28:[----] [--] 'arm64/sysreg: Add definition for ID_AA64ISAR3_EL1'
004/28:[----] [--] 'arm64/sysreg: Add definition for ID_AA64FPFR0_EL1'
005/28:[----] [--] 'arm64/sysreg: Update ID_AA64SMFR0_EL1 definition for DDI0601 2023-09'
006/28:[----] [--] 'arm64/sysreg: Update SCTLR_EL1 for DDI0601 2023-09'
007/28:[----] [--] 'arm64/sysreg: Update HCRX_EL2 definition for DDI0601 2023-09'
008/28:[----] [-C] 'arm64/sysreg: Add definition for FPMR'
009/28:[0002] [FC] 'arm64/fpsimd: Add fpsimd_save_and_flush_current_state()'
010/28:[----] [--] 'arm64/fpsimd: signal32: Always save+flush state early'
011/28:[0002] [FC] 'arm64/sve: Report FEAT_SVE_B16B16 to userspace'
012/28:[----] [--] 'kselftest/arm64: Verify HWCAP2_SVE_B16B16'
013/28:[----] [-C] 'arm64/cpufeature: Hook new identification registers up to cpufeature'
014/28:[----] [-C] 'arm64/fpsimd: Enable host kernel access to FPMR'
015/28:[----] [-C] 'arm64/fpsimd: Support FEAT_FPMR'
016/28:[----] [-C] 'arm64/signal: Add FPMR signal handling'
017/28:[----] [--] 'arm64/ptrace: Expose FPMR via ptrace'
018/28:[0012] [FC] 'arm64/hwcap: Define hwcaps for 2023 DPISA features'
019/28:[----] [--] 'kselftest/arm64: Handle FPMR context in generic signal frame parser'
020/28:[----] [--] 'kselftest/arm64: Add basic FPMR test'
021/28:[----] [-C] 'kselftest/arm64: Add 2023 DPISA hwcap test coverage'
022/28:[----] [--] 'arm64: ptrace: fix partial SETREGSET for NT_ARM_FPMR'
023/28:[----] [-C] 'arm64/fpsimd: Don't corrupt FPMR when streaming mode changes'
024/28:[----] [--] 'arm64/fpsimd: Reset FPMR upon exec()'
025/28:[----] [--] 'kselftest/arm64: hwcap: fix f8dp2 cpuinfo name'
026/28:[----] [--] 'kselftest/arm64: Fix encoding for SVE B16B16 test'
027/28:[----] [-C] 'arm64/fpsimd: signal: Always save+flush state early'
028/28:[----] [--] 'arm64/fpsimd: Avoid warning when sve_to_fpsimd() is unused'

To view diffs later, you may run:
009/28: 'vimdiff <(git show d3a181588df9^\!) <(git show 93ceb59acdf7^\!)'
011/28: 'vimdiff <(git show 5d5b4e8c2d9e^\!) <(git show 5090f3003395^\!)'
018/28: 'vimdiff <(git show c1932cac7902^\!) <(git show f0b3f71a7d3c^\!)'

============================================
 Summary
============================================

 Total checks: 5
 Passed:       4
 Failed:       1

  downstream-format-validator    PASS
  upstream-format-validator      PASS
  upstream-fix-tag-validator     PASS
  upstream-fix-scanner           PASS
  upstream-variance-viewer       FAIL

upstream-variance-viewer flags expected functional differences introduced by the veLinux 6.6 API and context adaptations in the SVE B16B16, cpufeature, and HWCAP patches.

Unit Test Results
All eight test cases passed using the same candidate kernel Image on QEMU E0 (cortex-a57) and E1 (max):

TC0 Build:
    The shared E0/E1 Image built successfully with CONFIG_COMPAT=y and CONFIG_ARM64_SVE=y.
TC1 Boot:
    Both guests booted, completed the test runner, and shut down cleanly without abnormal termination.
TC2 Compat FPSIMD:
    The ELF32 signal test confirmed correct FPSIMD state restoration from original and modified signal frames, including preservation during contention and vCPU migration.
TC3 HWCAP:
    HWCAP, /proc/cpuinfo, and instruction probes were consistent on E0 and E1. Unsupported E1 SME and SME FP8 probes were skipped as expected.
TC4 Signal frame:
    Selected arm64 signal selftests passed, covering bad-frame, PSTATE, SVE, and FPMR handling. Unsupported E1 SME cases were skipped.
TC5 Context switching:
    fp-stress completed without worker failures, validating FPSIMD and SVE state preservation under signal stress.
TC6 FPMR restore:
    rt_sigreturn correctly restored FPMR state from both unchanged and modified signal frames.
TC7 SVE restore:
    VL 16 and VL 32 each completed restoring SVE and FPSIMD state from original and modified signal frames.

broonie and others added 28 commits September 11, 2026 14:40
commit 9fb5dc5 upstream.

DDI0601 2023-09 defines a new system register ID_AA64PFR2_EL1 which
enumerates FPMR and some new MTE features. Add a definition of this
register.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-5-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 6e3dcfd upstream.

DDI0601 2023-09 defines some new fields in previously RES0 space in
ID_AA64ISAR2_EL1, together with one new enum value. Update the system
register definition to reflect this.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-6-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit b5aefb6 upstream.

DDI0601 2023-09 adds a new system register ID_AA64ISAR3_EL1 enumerating
new floating point and TLB invalidation features. Add a defintion for it.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-7-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 9e4f409 upstream.

DDI0601 2023-09 defines a new feature register ID_AA64FPFR0_EL1 which
enumerates a number of FP8 related features. Add a definition for it.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-8-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 8afe582 upstream.

The 2023-09 release of DDI0601 defines a number of new feature enumeration
fields in ID_AA64SMFR0_EL1. Add these fields.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-9-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit a605228 upstream.

DDI0601 2023-09 defines some new fields in SCTLR_EL1 controlling new MTE
and floating point features. Update our sysreg definition to reflect these.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-10-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 126cb3a upstream.

DDI0601 2023-09 defines new fields in HCRX_EL2 controlling access to new
system registers, update our definition of HCRX_EL2 to reflect this.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-11-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit e3a649e upstream.

DDI0601 2023-09 defines a new sysrem register FPMR (Floating Point Mode
Register) which configures the new FP8 features. Add a definition of this
register.

Signed-off-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://lore.kernel.org/r/20231209-b4-arm64-sysreg-additions-v1-12-45284e538474@kernel.org
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit d3a181588df9401d319fe2dc24bf1a364a687cc2 upstream.

When the current task's FPSIMD/SVE/SME state may be live on *any* CPU in
the system, special care must be taken when manipulating that state, as
this manipulation can race with preemption and/or asynchronous usage of
FPSIMD/SVE/SME (e.g. kernel-mode NEON in softirq handlers).

Even when manipulation is is protected with get_cpu_fpsimd_context() and
get_cpu_fpsimd_context(), the logic necessary when the state is live on
the current CPU can be wildly different from the logic necessary when
the state is not live on the current CPU. A number of historical and
extant issues result from failing to handle these cases consistetntly
and/or correctly.

To make it easier to get such manipulation correct, add a new
fpsimd_save_and_flush_current_state() helper function, which ensures
that the current task's state has been saved to memory and any stale
state on any CPU has been "flushed" such that is not live on any CPU in
the system. This will allow code to safely manipulate the saved state
without risk of races.

Subsequent patches will use the new function.

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250409164010.3480271-11-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ bh: veLinux 6.6.151 uses ownership-aware fpsimd_save() as a substitute for the unavailable upstream fpsimd_save_user_state() helper. ]
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 3aa4d74438afa1324513a7a6bc30f57e8727ad86 upstream.

There are several issues with the way the native signal handling code
manipulates FPSIMD/SVE/SME state. To fix those issues, subsequent
patches will rework the native signal handling code to always save+flush
the current task's FPSIMD/SVE/SME state before manipulating that state.

In preparation for those changes, rework the compat signal handling code
to save+flush the current task's FPSIMD state before manipulating it.

Subsequent patches will remove fpsimd_signal_preserve_current_state()
and fpsimd_update_current_state(). Compat tasks can only have FPSIMD
state, and cannot have any SVE or SME state. Thus, the SVE state
manipulation present in fpsimd_signal_preserve_current_state() and
fpsimd_update_current_state() is not necessary, and it is safe to
directly manipulate current->thread.uw.fpsimd_state once it has been
saved+flushed.

Use fpsimd_save_and_flush_current_state() to save+flush the state for
both signal delivery and signal return, before the state is manipulated
in any way. While it would be safe for compat_restore_vfp_context() to
use fpsimd_flush_task_state(current), there are several extant issues in
the native signal code resulting from incorrect use of
fpsimd_flush_task_state(), and for consistency it is preferable to use
fpsimd_save_and_flush_current_state().

Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250409164010.3480271-12-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 5d5b4e8 upstream.

SVE 2.1 introduced a new feature FEAT_SVE_B16B16 which adds instructions
supporting the BFloat16 floating point format. Report this to userspace
through the ID registers and hwcap.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20230915-arm64-zfr-b16b16-el0-v1-1-f9aba807bdb5@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ bh: veLinux 6.6.151 uses HWCAP_CAP_MATCH_ID() for SVE_B16B16 capability checks, requiring both system_supports_sve() and ID-register feature.]
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 3accaef upstream.

Validate that SVE B16B16 support is reported correctly and consistently to
userspace.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20230915-arm64-zfr-b16b16-el0-v1-2-f9aba807bdb5@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit cc9f69a upstream.

The 2023 architecture extensions have defined several new ID registers,
hook them up to the cpufeature code so we can add feature checks and hwcaps
based on their contents.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-1-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit b6c0b42 upstream.

FEAT_FPMR provides a new generally accessible architectural register FPMR.
This is only accessible to EL0 and EL1 when HCRX_EL2.EnFPM is set to 1,
do this when the host is running. The guest part will be done along with
context switching the new register and exposing it via guest management.

Acked-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-2-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 203f2b9 upstream.

FEAT_FPMR defines a new EL0 accessible register FPMR use to configure the
FP8 related features added to the architecture at the same time. Detect
support for this register and context switch it for EL0 when present.

Due to the sharing of responsibility for saving floating point state
between the host kernel and KVM FP8 support is not yet implemented in KVM
and a stub similar to that used for SVCR is provided for FPMR in order to
avoid bisection issues. To make it easier to share host state with the
hypervisor we store FPMR as a hardened usercopy field in uw (along with
some padding).

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-3-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 8c46def upstream.

Expose FPMR in the signal context on systems where it is supported. The
kernel validates the exact size of the FPSIMD registers so we can't readily
add it to fpsimd_context without disruption.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-4-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 4035c22 upstream.

Add a new regset to expose FPMR via ptrace. It is not added to the FPSIMD
registers since that structure is exposed elsewhere without any allowance
for extension we don't add there.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-5-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit c1932ca upstream.

The 2023 architecture extensions include a large number of floating point
features, most of which simply add new instructions. Add hwcaps so that
userspace can enumerate these features.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-6-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ bh: veLinux 6.6.151 uses HWCAP_CAP_MATCH_ID() for SME capability checks and retains upstream matchers elsewhere. ]
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit f4dcccd upstream.

Teach the generic signal frame parsing code about the newly added FPMR
frame, avoiding warnings every time one is generated.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-7-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 7bcebad upstream.

Verify that a FPMR frame is generated on systems that support FPMR and not
generated otherwise.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-8-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 44d10c2 upstream.

Add the hwcaps added for the 2023 DPISA extensions to the hwcaps test
program.

Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240306-arm64-2023-dpisa-v5-9-c568edc8ed7f@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit f5d71291841aecfe5d8435da2dfa7f58ccd18bc8 upstream.

Currently fpmr_set() doesn't initialize the temporary 'fpmr' variable,
and a SETREGSET call with a length of zero will leave this
uninitialized. Consequently an arbitrary value will be written back to
target->thread.uw.fpmr, potentially leaking up to 64 bits of memory from
the kernel stack. The read is limited to a specific slot on the stack,
and the issue does not provide a write mechanism.

Fix this by initializing the temporary value before copying the regset
from userspace, as for other regsets (e.g. NT_PRSTATUS, NT_PRFPREG,
NT_ARM_SYSTEM_CALL). In the case of a zero-length write, the existing
contents of FPMR will be retained.

Before this patch:

| # ./fpmr-test
| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d
| SETREGSET(nt=0x40e, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d
|
| Attempting to write NT_ARM_FPMR (zero length)
| SETREGSET(nt=0x40e, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0xffff800083963d50

After this patch:

| # ./fpmr-test
| Attempting to write NT_ARM_FPMR::fpmr = 0x900d900d900d900d
| SETREGSET(nt=0x40e, len=8) wrote 8 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d
|
| Attempting to write NT_ARM_FPMR (zero length)
| SETREGSET(nt=0x40e, len=0) wrote 0 bytes
|
| Attempting to read NT_ARM_FPMR::fpmr
| GETREGSET(nt=0x40e, len=8) read 8 bytes
| Read NT_ARM_FPMR::fpmr = 0x900d900d900d900d

Fixes: 4035c22 ("arm64/ptrace: Expose FPMR via ptrace")
Cc: <stable@vger.kernel.org> # 6.9.x
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20241205121655.1824269-3-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit e5fa85fce08b21ed41643cb7968bf66bbd0532e3 upstream.

When the effective value of PSTATE.SM is changed from 0 to 1 or from 1
to 0 by any method, an entry or exit to/from streaming SVE mode is
performed, and hardware automatically resets a number of registers. As
of ARM DDI 0487 L.a, this means:

* All implemented bits of the SVE vector registers are set to zero.

* All implemented bits of the SVE predicate registers are set to zero.

* All implemented bits of FFR are set to zero, if FFR is implemented in
  the new mode.

* FPSR is set to 0x0000_0000_0800_009f.

* FPMR is set to 0, if FPMR is implemented.

Currently task_fpsimd_load() restores FPMR before restoring SVCR (which
is an accessor for PSTATE.{SM,ZA}), and so the restored value of FPMR
may be clobbered if the restored value of PSTATE.SM happens to differ
from the initial value of PSTATE.SM.

Fix this by moving the restore of FPMR later.

Note: this was originally posted as [1].

Fixes: 203f2b9 ("arm64/fpsimd: Support FEAT_FPMR")
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/linux-arm-kernel/20241204-arm64-sme-reenable-v2-2-bae87728251d@kernel.org/
[ Rutland: rewrite commit message ]
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20250409164010.3480271-7-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit a90878f297d3dba906a6261deccb1bd4a791ba52 upstream.

An exec() is expected to reset all FPSIMD/SVE/SME state, and barring
special handling of the vector lengths, the state is expected to reset
to zero. This reset is handled in fpsimd_flush_thread(), which the core
exec() code calls via flush_thread().

When support was added for FPMR, no logic was added to
fpsimd_flush_thread() to reset the FPMR value, and thus it is
erroneously inherited across an exec().

Add the missing reset of FPMR.

Fixes: 203f2b9 ("arm64/fpsimd: Support FEAT_FPMR")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250409164010.3480271-9-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit b0d80dbc378d52155c9ecf9579986edccceed3aa upstream.

The F8DP2 DPISA extension has a separate cpuinfo field, named
accordingly.
Change the erroneously placed name of "f8dp4" to "f8dp2".

Fixes: 44d10c2 ("kselftest/arm64: Add 2023 DPISA hwcap test coverage")
Signed-off-by: Andre Przywara <andre.przywara@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20240816153251.2833702-3-andre.przywara@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 69c0d824779843b51ca2339b2163db4d3b40c54c upstream.

The test for SVE_B16B16 had a cut'n'paste of a SME instruction, fix it with
a relevant SVE instruction.

Fixes: 44d10c2 ("kselftest/arm64: Add 2023 DPISA hwcap test coverage")
Signed-off-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20241028-arm64-b16b16-test-v1-1-59a4a7449bdf@kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit 929fa99b1215966fc8a6ccc2e14b92e36c3c42f3 upstream.

There are several issues with the way the native signal handling code
manipulates FPSIMD/SVE/SME state, described in detail below. These
issues largely result from races with preemption and inconsistent
handling of live state vs saved state.

Known issues with native FPSIMD/SVE/SME state management include:

* On systems with FPMR, the code to save/restore the FPMR accesses the
  register while it is not owned by the current task. Consequently, this
  may corrupt the FPMR of the current task and/or may corrupt the FPMR
  of an unrelated task. The FPMR save/restore has been broken since it
  was introduced in commit:

    8c46def ("arm64/signal: Add FPMR signal handling")

* On systems with SME, setup_return() modifies both the live register
  state and the saved state register state regardless of whether the
  task's state is live, and without holding the cpu fpsimd context.
  Consequently:

  - This may corrupt the state an unrelated task which has PSTATE.SM set
    and/or PSTATE.ZA set.

  - The task may enter the signal handler in streaming mode, and or with
    ZA storage enabled unexpectedly.

  - The task may enter the signal handler in non-streaming SVE mode with
    stale SVE register state, which may have been inherited from
    streaming SVE mode unexpectedly. Where the streaming and
    non-streaming vector lengths differ, this may be packed into
    registers arbitrarily.

  This logic has been broken since it was introduced in commit:

    40a8e87 ("arm64/sme: Disable ZA and streaming mode when handling signals")

  Further incorrect manipulation of state was added in commits:

    ea64baa ("arm64/signal: Flush FPSIMD register state when disabling streaming mode")
    baa8515 ("arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE")

* Several restoration functions use fpsimd_flush_task_state() to discard
  the live FPSIMD/SVE/SME while the in-memory copy is stale.

  When a subset of the FPSIMD/SVE/SME state is restored, the remainder
  may be non-deterministically reset to a stale snapshot from some
  arbitrary point in the past.

  This non-deterministic discarding was introduced in commit:

    8cd969d ("arm64/sve: Signal handling support")

  As of that commit, when TIF_SVE was initially clear, failure to
  restore the SVE signal frame could reset the FPSIMD registers to a
  stale snapshot.

  The pattern of discarding unsaved state was subsequently copied into
  restoration functions for some new state in commits:

    3978221 ("arm64/sme: Implement ZA signal handling")
    ee072cf ("arm64/sme: Implement signal handling for ZT")

* On systems with SME/SME2, the entire FPSIMD/SVE/SME state may be
  loaded onto the CPU redundantly. Either restore_fpsimd_context() or
  restore_sve_fpsimd_context() will load the entire FPSIMD/SVE/SME state
  via fpsimd_update_current_state() before restore_za_context() and
  restore_zt_context() each discard the state via
  fpsimd_flush_task_state().

  This is purely redundant work, and not a functional bug.

To fix these issues, rework the native signal handling code to always
save+flush the current task's FPSIMD/SVE/SME state before manipulating
that state. This avoids races with preemption and ensures that state is
manipulated consistently regardless of whether it happened to be live
prior to manipulation. This largely involes:

* Using fpsimd_save_and_flush_current_state() to save+flush the state
  for both signal delivery and signal return, before the state is
  manipulated in any way.

* Removing fpsimd_signal_preserve_current_state() and updating
  preserve_fpsimd_context() to explicitly ensure that the FPSIMD state
  is up-to-date, as preserve_fpsimd_context() is the only consumer of
  the FPSIMD state during signal delivery.

* Modifying fpsimd_update_current_state() to not reload the FPSIMD state
  onto the CPU. Ideally we'd remove fpsimd_update_current_state()
  entirely, but I've left that for subsequent patches as there are a
  number of of other problems with the FPSIMD<->SVE conversion helpers
  that should be addressed at the same time. For now I've removed the
  misleading comment.

For setup_return(), we need to decide (for ABI reasons) whether signal
delivery should have all the side-effects of an SMSTOP. For now I've
left a TODO comment, as there are other questions in this area that I'll
address with subsequent patches.

Fixes: 8c46def ("arm64/signal: Add FPMR signal handling")
Fixes: 40a8e87 ("arm64/sme: Disable ZA and streaming mode when handling signals")
Fixes: ea64baa ("arm64/signal: Flush FPSIMD register state when disabling streaming mode")
Fixes: baa8515 ("arm64/fpsimd: Track the saved FPSIMD state type separately to TIF_SVE")
Fixes: 8cd969d ("arm64/sve: Signal handling support")
Fixes: 3978221 ("arm64/sme: Implement ZA signal handling")
Fixes: ee072cf ("arm64/sme: Implement signal handling for ZT")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20250409164010.3480271-13-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
[ bh: veLinux 6.6.151 adapts the upstream saved-state transition to the target save+flush model while preserving SVE/SME safeguards. ]
Signed-off-by: Bin Huang <bin.huang2@arm.com>
commit f699c66691fb7e08a5a631c5baf5f2a19b7a6468 upstream.

Historically fpsimd_to_sve() and sve_to_fpsimd() were (conditionally)
called by functions which were defined regardless of CONFIG_ARM64_SVE.
Hence it was necessary that both fpsimd_to_sve() and sve_to_fpsimd()
were always defined and not guarded by ifdeffery.

As a result of the removal of fpsimd_signal_preserve_current_state() in
commit:

  929fa99b1215966f ("arm64/fpsimd: signal: Always save+flush state early")

... sve_to_fpsimd() has no callers when CONFIG_ARM64_SVE=n, resulting in
a build-time warnign that it is unused:

| arch/arm64/kernel/fpsimd.c:676:13: warning: unused function 'sve_to_fpsimd' [-Wunused-function]
|   676 | static void sve_to_fpsimd(struct task_struct *task)
|       |             ^~~~~~~~~~~~~
| 1 warning generated.

In contrast, fpsimd_to_sve() still has callers which are defined when
CONFIG_ARM64_SVE=n, and it would be awkward to hide this behind
ifdeffery and/or to use stub functions.

For now, suppress the warning by marking both fpsimd_to_sve() and
sve_to_fpsimd() as 'static inline', as we usually do for stub functions.
The compiler will no longer warn if either function is unused.

Aside from suppressing the warning, there should be no functional change
as a result of this patch.

Link: https://lore.kernel.org/linux-arm-kernel/20250429194600.GA26883@willie-the-truck/
Reported-by: Will Deacon <will@kernel.org>
Fixes: 929fa99b1215 ("arm64/fpsimd: signal: Always save+flush state early")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20250430173240.4023627-1-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Bin Huang <bin.huang2@arm.com>
@hbrobin
hbrobin force-pushed the 6.6.151-lts-2023dpisa branch from 7a4c828 to 939cf75 Compare September 17, 2026 06:17
@hbrobin

hbrobin commented Sep 21, 2026

Copy link
Copy Markdown
Author

Superseded by the aggregated PR #156 for the FPSIMD/SVE/SME P0 changes. Closing this PR.

@hbrobin hbrobin closed this Sep 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants