Linaro-mm-sig

linaro-mm-sig@lists.linaro.org

28 participants
7088 discussions

by Williamia Hight

Exploring the World of Vehicle Engineering in Drive Mad Drive Mad changes how we think about traditional racing games. You are not just pushing a gas pedal to win. You are managing the weight and the center of gravity of your machine. Every car has a different personality in this game. Some are heavy and stable while others are light and bouncy. Choosing the right vehicle for the level is your first strategic step. The levels in Drive Mad are more like mechanical puzzles than race tracks. You have to understand the triggers that move the obstacles. A platform might drop only when you reach a certain point. You must time your approach to avoid the trap. It requires you to observe the environment before you take action. This brain work makes the game much more satisfying than simple racing titles. You will encounter many moments of frustration during your progress. This is the main appeal of the game for many players. You learn from every mistake you make on the road. Eventually you find the perfect rhythm to clear the most difficult gaps. The feeling of success after a hard level is unmatched. Keep your focus sharp and your hands ready to drive. https://drivinggames.io

55 minutes

Validate Message Report

by Webmail Support

10 hours, 34 minutes

[PATCH v4 00/10] vfio/pci: Add mmap() for DMABUFs

by Matt Evans

Hi all, This series is based on previous RFCs/discussions: Tech topic: https://lore.kernel.org/linux-iommu/20250918214425.2677057-1-amastro@fb.com/ RFCv1: https://lore.kernel.org/all/20260226202211.929005-1-mattev@meta.com/ RFCv2: https://lore.kernel.org/kvm/20260312184613.3710705-1-mattev@meta.com/ The background/rationale is covered in more detail in the RFC cover letters. The TL;DR is: The goal is to enable userspace driver designs that use VFIO to export DMABUFs representing subsets of PCI device BARs, and "vend" those buffers from a primary process to other subordinate processes by fd. These processes then mmap() the buffers and their access to the device is isolated to the exported ranges. This is an improvement on sharing the VFIO device fd to subordinate processes, which would allow unfettered access. This is achieved by enabling mmap() of vfio-pci DMABUFs, passed by fd to subordinate processes. Second, a new revocation mechanism is added to allow the primary process to forcibly revoke access to previously-shared BAR spans, even if the subordinate processes haven't cleanly exited. (The related topic of safe delegation of iommufd control to the subordinate processes is not addressed here, and is follow-up work.) As well as isolation and revocation, another advantage to accessing a BAR through a VMA backed by a DMABUF is that it's straightforward to mmap() the buffer with access attributes, such as write-combining. Feedback from the RFCs requested that, instead of creating DMABUF-specific vm_ops and .fault paths, to go the whole way and migrate the existing VFIO PCI BAR mmap() to be backed by a DMABUF too, resulting in a common vm_ops and fault handler for mmap()s of both the VFIO device and explicitly-exported DMABUFs. This will help future iommufd emulation of VFIO Type1 peer-to-peer, making it easier to get a DMABUF for a VFIO BAR as a DMA target. mmap() conversion to use DMABUF underneath has been done for vfio-pci, but not sub-drivers: nvgrace-gpu's mmap() override path is unchanged; I kept this out of scope for now not least because I don't have a thorough test setup for this system. I would prefer to help the nvgrace-gpu maintainers enable BAR mmap() DMABUFs themselves. Notes on patches ================ PCI/P2PDMA: Split pool-related cleanup out of pci_p2pdma_release() PCI/P2PDMA: Add CONFIG_PCI_P2PDMA_CORE Later in the series, vfio-pci's mmap() is going to depend on pcim_p2pdma_provider() which depended on CONFIG_PCI_P2PDMA, which in turn depended on ZONE_DEVICE. That isn't available on 32-bit and some archs, because they lack MEMORY_HOTPLUG and friends. VFIO does _not_ require actual P2P to be present for basic mmap() functionality, only for the optional CONFIG_DMA_SHARED_BUFFER feature. These split out p2pdma_core.c under CONFIG_PCI_P2PDMA_CORE (which currently contains pcim_p2pdma_provider()), and an optional CONFIG_PCI_P2PDMA which depends on ZONE_DEVICE etc. providing P2P functionality in the existing p2pdma.c. The first splits out pool cleanup from the release path, and the second does the refactor/code move to the new file. vfio/pci: Add a helper to look up PFNs for DMABUFs vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA The first adds a DMABUF VMA fault handler helper to determine arbitrary-sized PFNs from ranges in DMABUF. Secondly, refactor DMABUF export for use by the existing export feature and add a helper that creates a DMABUF corresponding to a VFIO BAR mmap() request. vfio/pci: Convert BAR mmap() to use a DMABUF The vfio-pci core mmap() creates a DMABUF with the helper, and the vm_ops fault handler uses the other helper to resolve the fault. Because this depends on DMABUF structs/code, CONFIG_VFIO_PCI_CORE needs to depend on CONFIG_DMA_SHARED_BUFFER. The CONFIG_VFIO_PCI_DMABUF still conditionally enables the export support code. NOTE: The user mmap()s a device fd, but the resulting VMA's vm_file becomes that of the DMABUF. The DMABUF takes ownership of the device file and put()s it on release, which maintains the existing behaviour of a VMA keeping the VFIO device open. BAR zapping then happens via the existing vfio_pci_dma_buf_move() path, which now needs to unmap PTEs in the DMABUF's address_space. vfio/pci: Provide a user-facing name for BAR mappings There was a request for decent debug naming in /proc/<pid>/maps etc. comparable to the existing VFIO names: since the VMAs are DMABUFs, they have a "dmabuf:" prefix and can't be 100% identical to before. This is a user-visible change, but this patch at least now gives us extra info on the BDF & BAR being mapped. vfio/pci: Clean up BAR zap and revocation In general (see NOTE!) the vfio_pci_zap_bars() is now obsolete, since it unmaps PTEs in the VFIO device address_space which is now unused. This consolidates all calls (e.g. around reset) with the neighbouring vfio_pci_dma_buf_move()s into new functions, to revoke/unrevoke (making the steps clearer). NOTE: Because drivers can use their own vm_ops and override .mmap, the core must conservatively assume an overridden .mmap might still add PTEs to the VFIO device address_space and therefore still does the zap. A new flag, zap_bars_on_revoke, enables the zap when .mmap is overridden. A driver that does not need the zap can clear this to opt-out, e.g. if the driver calls down to the common mmap (and so uses DMABUFs). vfio/pci: Support mmap() of a VFIO DMABUF Adds mmap() for a DMABUF fd exported from vfio-pci. It was a goal to keep the VFIO device fd lifetime behaviour unchanged with respect to the DMABUFs. An application can close all device fds, and this will revoke/clean up all DMABUFs; no mappings or other access can be performed now. When enabling mmap() of the DMABUFs, this means access through the VMA is also revoked. This complicates the fault handler because whilst the DMABUF exists, it has no guarantee that the corresponding VFIO device is still alive. Adds synchronisation ensuring the vdev is available before vdev->memory_lock is touched; this holds the device registration so that even if the buffer has been cleaned up, vdev hasn't been freed and so the lock can be safely taken. vfio/pci: Permanently revoke a DMABUF on request By weight, this is mostly a rename of revoked to an enum, status. There are now 3 states for a buffer, usable and revoked temporary/permanent. A new VFIO feature is added, VFIO_DEVICE_FEATURE_DMA_BUF_REVOKE, which takes a DMABUF (exported from the same device) and permanently revokes it. Thus a userspace driver can guarantee any downstream consumers of a shared fd are prevented from accessing a BAR range, and that range can be reused. NOTE: This might block userspace, waiting on importers to detach. The code doing revocation in vfio_pci_dma_buf_move() is moved, to a common function for use by ..._move() and this new feature. NOTE: See changelog, by request v4 added a condition to the existing code to elide the unnecessary invalidation/sync on the un-revoke path.) vfio/pci: Add mmap() attributes to DMABUF feature Adds a new VFIO feature, VFIO_DEVICE_FEATURE_DMA_BUF_MEMATTR. After a DMABUF is exported, this feature is used to set a memory attribute that will be used by future mmap()s of the DMABUF fd. It doesn't affect existing maps. The default is UC, and via the feature one can specify CPU access as WC. The attribute is an enum/scalar rather than bitmap/cumulative. The attributes follow a "try-fail" model where a client can request an attribute and either succeed or fail with ENOENT if it's unknown; if future attributes are platform-specific then their support can be probed. Since it's just UC/WC for now, there is no reservation or numeric structure to the namespace yet, but we could support system/arch-specific values in future by carving out base + arch-specific + IMPDEF ranges. Testing ======= (The [RFC ONLY] userspace test program, for QEMU edu-plus, can be found in the GitHub branch below. It at least illustrates how the export, map, revoke, attribute, and close semantics interoperate.) This code has been tested in mapping DMABUFs of single/multiple ranges from multiple BARs, aliasing mmap()s, aliasing ranges across DMABUFs, vm_pgoff > 0, revocation, shutdown/cleanup scenarios, and hugepage mappings. I've lightly tested WC mappings also (by observing resulting PTEs as having the correct attributes...). No regressions observed on the VFIO selftests, or on our internal vfio-pci applications. VFIO on i386 has been build-tested. Dear Reviewers, =============== I was grateful for the reviews and Reviewed-Bys on previous versions from several of you; I've added some Reviewed-Bys. But, various changes were also requested and I'm erring on the conservative side: I have NOT included your Reviewed-Bys where the patch has changed after your review (or where requested changes ended up more than super-trivial). I hope that's okay. End === This is based on v7.1. These commits are on GitHub for easier browsing, along with "[RFC ONLY] selftests: vfio: Add standalone vfio_dmabuf_mmap_test": https://github.com/metamev/linux/compare/8cd9520d35a6...dev/mev/vfio-dmabuf… Thanks for reading, Matt ================================================================================ Changelog: v4: - Rebased on v7.1 - 1/9: Split the p2pdma.c pool release code into a new patch, making the second patch a pure code-move exercise. Reworded the commit messages, comment cleanups. - 2/9 Look up PFNs helper: renamed DMABUF range search loop variables for clarity, and simplified search loop and fallthrough/exit logic. Moved WARN to ratelimited warnings. Rearranged pfn arithmetic to avoid potential overflow. Clarified comments, better explanation of vma_pgoff_adjust, spelling. - 4/9 convert BAR mmap(): Trivial comment change, move. Used 'true' instead of '1' for unmap_mapping_range() arg, consistent with elsewhere in vfio-pci. - 5/9 User-facing name for mappings: Uses kasprintf() instead. - 6/9 Clean up BAR zap: Renamed functions to simplify/shorten names, emphasising "revoke/unrevoke" actions. (Then internally this will do a DMABUF revoke and possibly a PTE zap.) NOTE: We debated ordering of a previous zap before a transition to D0 before reset. The conclusion was the current patch is OK. - 7/9 mmap() of a DMABUF: Added helper vfio_pci_set_vma_ops() to keep ops struct static/local. Squashed vfio_pci_dma_buf_mmap() comments for space/clarity. - 8/9 DMABUF revoke: Fix typos in commit message. Implement request to add a condition to revocation path to only invalidate/wait when a buffer is being revoked (avoiding it on un-revoke). NOTE: This means a (small) change to the code moved from vfio_pci_dma_buf_move. NOTE: Also, we discussed adding warnings for setting a state matching the existing state; I didn't add them after all, because these situations can occur in normal usage (e.g. a revoke of a buffer from a device in D3, or a cleanup of a lingering user-revoked buffer). v3: https://lore.kernel.org/all/20260610154327.37758-1-matt@ozlabs.org/ - Refactor p2pdma.c: split out pcim_p2pdma_provider() into a new p2pdma_core.c under CONFIG_PCI_P2PDMA_CORE. - vfio_pci_dma_buf_find_pfn() cleanups: Rename parameter to priv, remove bad WARN, move unnecessary addition out of inner loop. - vfio_pci_core_mmap_prep_dmabuf() cleanups: Remove uint32_t, remove unnecessary const variable. - Conversion of BAR mmap() to DMABUF: VFIO_PCI_DMABUF depends on VFIO_PCI_CORE. vfio_pci_mmap_huge_fault(): move dev_dbg() outside of lock (argh), remove READ_ONCE(vdev)/move priv->vdev read and improve comment explanation. - On revoke, BAR zap defaults to on if .mmap is overridden by a driver (and implements an opt-out for the hisi_acc_vfio_pci driver, which overrides mmap() with a simple wrapper that ends up using the common DMABUF mmap() rather than custom mappings). - Reworded commit "vfio/pci: Support mmap() of a VFIO DMABUF" message for clarity. Reworded vfio_pci_mmap_huge_fault() comment for accuracy (vdev validity depends on not being revoked). Added comment in mmap() explaining belt-and-braces approach for early detecting a map of a revoked buffer. - Revoke now uses VFIO_DEVICE_FEATURE_DMA_BUF rather than a new ioctl(); instead of the revoke helper taking 'revoked/permanently' bools, it's become vfio_pci_dma_buf_set_status() taking a single status enum. Added a READ_ONCE() for the lockless test of priv->vdev (flags it as intentional, even if it's in practice going to be a single-copy atomic read). - Removed GET on vfio_pci_core_feature_dma_buf_memattr(), removed unnecessary taking of memory_lock, fixed error return values. In particular, removes ENOTSUPP, and uses ENOENT to indicate an unknown attribute enum value was passed to SET. In the discussion here, https://lore.kernel.org/all/20260602131417.41366391@shazbot.org/ we'd agreed on EOPNOTSUPP before I realised that's already used elsewhere. ENOENT uniquely indicates an unknown attribute. v2: https://lore.kernel.org/all/20260527102319.100128-1-mattev@meta.com/ - Rebase on VFIO next, picking up Alex's vfio_pci_dma_buf_move()/vfio_pci_dma_buf_cleanup() fixes, and dropping "vfio/pci: Fix vfio_pci_dma_buf_cleanup() double-put" - Added "PCI/P2PDMA: Add CONFIG_PCI_P2PDMA_CORE" so that the newly-added vfio-pci hard dependency on the P2PDMA provider instead pulls in the _CORE variant and not the full-fat CONFIG_PCI_P2PDMA. This means that the core of vfio-pci does not need ZONE_DEVICE, but if it's available then enabling P2PDMA in turn enables DMABUF export. Fixes basic VFIO operation on 32b or other platforms without ZONE_DEVICE. - Fixed comment inaccuracy in vfio_pci_dma_buf_revoke() and cleaned up vdev validity test. - vfio_pci_dma_buf_find_pfn(): use PAGE_ALIGN(), better span variable naming, OVF check - Made vm_pgoffs use consistent (keeping the resource index at the top and masking where offset is used). For BAR mmap, use new vma_pgoff_adjust to create the DMABUF with the exact mmap()ed span instead of from the start of the BAR with an invisible portion before the mapping. - Added VFIO_DEVICE_FEATURE_DMA_BUF_MEMATTR to set memory attributes, instead of using the export `flags` field. - vfio_pci_ioctl_reset: Moved vfio_pci_zap_revoke_bars() (effectively, vfio_pci_dma_buf_move()) back after D0 transition. Note, if a BAR zap is needed, it's done in this function so now happens after this D0 transition with the _move; it was done before it at the time of the memory_lock taking. - Minimised vfio_pci_dma_buf_mmap() (removed redundant span check), added READ_ONCE for memattr - Misc fixes: comment in DMABUF name generation, removed superfluous READ_ONCE from faulthandler v1: https://lore.kernel.org/kvm/20260416131815.2729131-1-mattev@meta.com/ - Cleanup of the common DMABUF-aware VMA vm_ops fault handler and export code. - Fixed a lot of races, particularly faults racing with DMABUF cleanup (if the VFIO device fds close, for example). - Added nicer human-readable names for VFIO mmap() VMAs RFCv2: Respin based on the feedback/suggestions: https://lore.kernel.org/kvm/20260312184613.3710705-1-mattev@meta.com/ - Transform the existing VFIO BAR mmap path to also use DMABUFs behind the scenes, and then simply share that code for explicitly-mapped DMABUFs. Jason wanted to go that direction to enable iommufd VFIO type 1 emulation to pick up a DMABUF for an IO mapping. - Revoke buffers using a VFIO device fd ioctl RFCv1: https://lore.kernel.org/all/20260226202211.929005-1-mattev@meta.com/ Matt Evans (10): PCI/P2PDMA: Split pool-related cleanup out of pci_p2pdma_release() PCI/P2PDMA: Add CONFIG_PCI_P2PDMA_CORE vfio/pci: Add a helper to look up PFNs for DMABUFs vfio/pci: Add a helper to create a DMABUF for a BAR-map VMA vfio/pci: Convert BAR mmap() to use a DMABUF vfio/pci: Provide a user-facing name for BAR mappings vfio/pci: Clean up BAR zap and revocation vfio/pci: Support mmap() of a VFIO DMABUF vfio/pci: Permanently revoke a DMABUF on request vfio/pci: Add mmap() attributes to DMABUF feature MAINTAINERS | 2 +- drivers/pci/Kconfig | 10 +- drivers/pci/Makefile | 1 + drivers/pci/p2pdma.c | 109 +--- drivers/pci/p2pdma.h | 29 + drivers/pci/p2pdma_core.c | 118 ++++ drivers/vfio/pci/Kconfig | 5 +- drivers/vfio/pci/Makefile | 3 +- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 8 + drivers/vfio/pci/vfio_pci_config.c | 30 +- drivers/vfio/pci/vfio_pci_core.c | 211 +++++-- drivers/vfio/pci/vfio_pci_dmabuf.c | 568 +++++++++++++++--- drivers/vfio/pci/vfio_pci_priv.h | 63 +- include/linux/pci-p2pdma.h | 24 +- include/linux/pci.h | 2 +- include/linux/vfio_pci_core.h | 1 + include/uapi/linux/vfio.h | 47 ++ 17 files changed, 960 insertions(+), 271 deletions(-) create mode 100644 drivers/pci/p2pdma.h create mode 100644 drivers/pci/p2pdma_core.c -- 2.50.1 (Apple Git-155)

10 hours, 51 minutes

[PATCH] dma-buf: explicitely forbid exposing pages from get_user_pages()

by Christian König

We recently had another incident where two drivers put pages they got from get_user_pages() into a DMA-buf and cause quite a number of problems. Explicitely document that this is not something exporters can do. Signed-off-by: Christian König <christian.koenig(a)amd.com> --- drivers/dma-buf/dma-buf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c index 71f37544a5c6..aa5af4f439c2 100644 --- a/drivers/dma-buf/dma-buf.c +++ b/drivers/dma-buf/dma-buf.c @@ -685,6 +685,14 @@ static struct file *dma_buf_getfile(size_t size, int flags) * * For the detailed semantics exporters are expected to implement see * &dma_buf_ops. + * + * It is explicitely forbidden for exporters to expose buffers they don't "own" + * as DMA-buf. This includes pages acquired by get_user_pages() or other import + * mechanism. Not following this rule can create numerous security problems. + * + * It is also strongly discouraged to expose the same backing store through + * multiple DMA-bufs at the same time. This eventually creates aliasing and + * cache coherency problems which are extremely hard to debug and fix. */ /** -- 2.43.0

15 hours, 12 minutes

[PATCH v19 00/40] DEPT(DEPendency Tracker)

by Byungchul Park

Hi Linus and folks, DEPT(DEPendency Tracker) is a runtime deadlock detection framework that sees what lockdep cannot. I'm thrilled to share that DEPT has moved beyond theory and is now catching real deadlocks in the wild: https://lore.kernel.org/lkml/6383cde5-cf4b-facf-6e07-1378a485657d@I-love.SA… https://lore.kernel.org/lkml/1674268856-31807-1-git-send-email-byungchul.pa… https://lore.kernel.org/all/b6e00e77-4a8c-4e05-ab79-266bf05fcc2d@igalia.com/ I've added comprehensive documentation explaining DEPT's design and usage. Getting started is as simple as enabling CONFIG_DEPT and watching dmesg. THE PROBLEM LOCKDEP CANNOT SOLVE -------------------------------- Lockdep has been our trusted deadlock detector for two decades, but it has a fundamental blind spot: it tracks lock acquisition order, not the actual waits and events that cause deadlocks. This means lockdep misses: * Deadlocks involving folio locks (not released within the context) * Cross-context synchronization like wait_for_completion()/complete() * DMA fence waits, RCU waits, and general waitqueue patterns * Any synchronization primitive outside the classic lock/unlock model Consider this real deadlock pattern that lockdep cannot detect: context X context Y context Z mutex_lock A folio_lock B folio_lock B <- DEADLOCK mutex_lock A <- DEADLOCK folio_unlock B folio_unlock B mutex_unlock A mutex_unlock A Lockdep sees lock acquisitions. DEPT sees the actual dependency: "mutex_unlock A in context Y cannot happen until folio_lock B is awakened by the owner's folio_unlock B, and vice versa in context Z." It's a circular dependency that means deadlock. THE DEPT APPROACH ----------------- DEPT asks a simpler question: "What is this context waiting for, and what event will wake it up?" Every deadlock is fundamentally about unreachable events. DEPT tracks: [S] Where an event context begins (the code path that will trigger an event) [W] Where a wait for another event apears between [S] and [E] [E] Where the event for [S] occurs By building a dependency graph of "[E] cannot occur until the event that [W] waits for occurs", DEPT detects circular dependencies regardless of the underlying synchronization primitives involved. WHAT DEPT BRINGS TO THE TABLE ----------------------------- * Universal coverage: Works with any wait/event-based synchronization, not just locks * Correct read-lock handling: No more blind spots for read-side dependencies * Continuous operation: Unlike lockdep, DEPT keeps running after reports, catching multiple deadlocks in a single session * Clean annotation API: Simple, intuitive interfaces for subsystem maintainers to refine detection * Battle-tested: Already catching real deadlocks as the links above demonstrate FALSE POSITIVES: THE HONEST CONVERSATION ---------------------------------------- Like any powerful detection tool, DEPT faces the false positive challenge. This is not unique to DEPT — lockdep spent years building its annotation infrastructure (lock classes, subclasses, lockdep_map) to separate real bugs from intentional patterns. DEPT is on the same journey. We have: * Event site recovery: Declare when an event has fallback paths * Subclass-based classification: Distinguish per-CPU, per-device, and modality-specific waits * Page usage tracking: Separate block device mappings from regular file mappings to avoid spurious reports (currently being worked on) But comprehensive annotation requires subsystem maintainer expertise. This is where I need your help. THE PATH TO MAINLINE -------------------- DEPT is marked EXPERIMENTAL in Kconfig for a reason. Like lockdep, it will mature through collaboration: 1. Core framework: Stabilized and ready for review 2. Subsystem pilots: Working with maintainers to add annotations where they matter most (mm, block, drm, networking, ...) 3. Gradual enablement: DEPT and lockdep coexist; DEPT takes over dependency checking when ready I am not proposing to replace lockdep. Lockdep's lock usage validation remains invaluable. The vision is: LOCKDEP: Validates correct lock usage | v DEPT: Performs dependency checking with full wait/event coverage WHY MERGE NOW? -------------- Some might suggest: "Fix all false positives out-of-tree first." But the affected subsystems span the entire kernel. Like lockdep's two-decade annotation journey, DEPT needs mainline visibility for: * Proper annotation placement (maintainers know their code best) * Real-world testing across configurations and workloads * Incremental improvement through community feedback CONFIG_DEPT is opt-in. It won't affect your default kernel build. But for those debugging complex synchronization issues, DEPT is ready to help today. ACKNOWLEDGMENTS --------------- This work would not be possible without: Harry Yoo <harry.yoo(a)oracle.com> Gwan-gyeong Mun <gwan-gyeong.mun(a)intel.com> Yunseong Kim <ysk(a)kzalloc.com> Yeoreum Yun <yeoreum.yun(a)arm.com> And the countless kernel developers whose lockdep annotations over two decades showed us the path forward. FAQ --- Q. Isn't this the cross-release feature that got reverted? A. Cross-release (commit b09be676e0ff2) attempted to extend lockdep with wait/event tracking. It found real bugs but introduced false positives that masked further issues. DEPT learns from that experience with a cleaner design and flexible reporting that makes false positives less disruptive. Q. Why not build DEPT into lockdep? A. Lockdep is stable, battle-tested code. I chose separation because while DEPT borrows BFS and hashing ideas, the wait/event model requires rebuilding from scratch. Lockdep was designed for lock acquisition order — retrofitting it would risk its stability. Q. Will DEPT replace lockdep? A. No. Lockdep validates correct lock usage — that's not going away. DEPT supersedes only the dependency-checking logic when mature. Q. Should we merge DEPT now or wait for more annotations out-of-tree? A. Now. The annotation journey requires mainline collaboration. Lockdep didn't become useful overnight — it grew through maintainer contributions. DEPT needs the same path. Q. What if I enable DEPT and get false positives? A. That's the point — report them. Work with us to add annotations that distinguish your intentional patterns from real deadlocks. This is how lockdep became indispensable, and it's how DEPT will too. GETTING STARTED --------------- 1. Enable CONFIG_DEPT (EXPERIMENTAL) 2. Boot your kernel 3. Check dmesg for DEPT reports 4. Read Documentation/dev-tools/dept.rst for interpretation DEPT is a tool for understanding your code's synchronization behavior. Even if you never see a deadlock report, the visibility it provides is invaluable. I look forward to your feedback, patches, and collaboration. Let's make DEPT as indispensable to kernel developers as lockdep has been. --- Changes from v18: 1. Rebase on v7.0. 2. Add 'Reviewed-by: Jeff Layton <jlayton(a)kernel.org>' on 37th patch, 'SUNRPC: relocate struct rcu_head to the first field of struct rpc_xprt'. (thanks to Jeff Layton) 3. Refine and supplement dept documents and comments, and fix typos. (feedbacked by Bagas Sanjaya and Yunseong Kim) 4. Add __rust_helper to rust_helper_wait_for_completion(). (feedbacked by Dirk Behme) 5. Remove the part supporting recover events tracking - I will keep maintaining it out of tree tho - as it unnecessarily complicates the initial DEPT patchset and significantly increases the review burden. 6. Get rid of 'extern' keyword with function declarations. (feedbacked by Petr Pavlu) Changes from v17: 1. Rebase on the mainline as of 2025 Dec 5. 2. Convert the documents' format from txt to rst. (feedbacked by Jonathan Corbet and Bagas Sanjaya) 3. Move the documents from 'Documentation/dependency' to 'Documentation/dev-tools'. (feedbakced by Jonathan Corbet) 4. Improve the documentation. (feedbacked by NeilBrown) 5. Use a common function, enter_from_user_mode(), instead of arch specific code, to notice context switch from user mode. (feedbacked by Dave Hansen, Mark Rutland, and Mark Brown) 6. Resolve the header dependency issue by using dept's internal header, instead of relocating 'struct llist_{head,node}' to another header. (feedbacked by Greg KH) 7. Improve page(or folio) usage type APIs. 8. Add rust helper for wait_for_completion(). (feedbacked by Guangbo Cui, Boqun Feng, and Danilo Krummrich) 9. Refine some commit messages. Changes from v16: 1. Rebase on v6.17. 2. Fix a false positive from rcu (by Yunseong Kim) 3. Introduce APIs to set page's usage, dept_set_page_usage() and dept_reset_page_usage() to avoid false positives. 4. Consider lock_page() as a potential wait unconditionally. 5. Consider folio_lock_killable() as a potential wait unconditionally. 6. Add support for tracking PG_writeback waits and events. 7. Fix two build errors due to the additional debug information added by dept. (by Yunseong Kim) Changes from v15: 1. Fix typo and improve comments and commit messages (feedbacked by ALOK TIWARI, Waiman Long, and kernel test robot). 2. Do not stop dept on detection of cicular dependency of recover event, allowing to keep reporting. 3. Add SK hynix to copyright. 4. Consider folio_lock() as a potential wait unconditionally. 5. Fix Kconfig dependency bug (feedbacked by kernel test rebot). 6. Do not suppress reports that involve classes even that have already involved in other reports, allowing to keep reporting. Changes from v14: 1. Rebase on the current latest, v6.15-rc6. 2. Refactor dept code. 3. With multi event sites for a single wait, even if an event forms a circular dependency, the event can be recovered by other event(or wake up) paths. Even though informing the circular dependency is worthy but it should be suppressed once informing it, if it doesn't lead an actual deadlock. So introduce APIs to annotate the relationship between event site and recover site, that are, event_site() and dept_recover_event(). 4. wait_for_completion() worked with dept map embedded in struct completion. However, it generates a few false positves since all the waits using the instance of struct completion, share the map and key. To avoid the false positves, make it not to share the map and key but each wait_for_completion() caller have its own key by default. Of course, external maps also can be used if needed. 5. Fix a bug about hardirq on/off tracing. 6. Implement basic unit test for dept. 7. Add more supports for dma fence synchronization. 8. Add emergency stop of dept e.g. on panic(). 9. Fix false positives by mmu_notifier_invalidate_*(). 10. Fix recursive call bug by DEPT_WARN_*() and DEPT_STOP(). 11. Fix trivial bugs in DEPT_WARN_*() and DEPT_STOP(). 12. Fix a bug that a spin lock, dept_pool_spin, is used in both contexts of irq disabled and enabled without irq disabled. 13. Suppress reports with classes, any of that already have been reported, even though they have different chains but being barely meaningful. 14. Print stacktrace of the wait that an event is now waking up, not only stacktrace of the event. 15. Make dept aware of lockdep_cmp_fn() that is used to avoid false positives in lockdep so that dept can also avoid them. 16. Do do_event() only if there are no ecxts have been delimited. 17. Fix a bug that was not synchronized for stage_m in struct dept_task, using a spin lock, dept_task()->stage_lock. 18. Fix a bug that dept didn't handle the case that multiple ttwus for a single waiter can be called at the same time e.i. a race issue. 19. Distinguish each kernel context from others, not only by system call but also by user oriented fault so that dept can work with more accuracy information about kernel context. That helps to avoid a few false positives. 20. Limit dept's working to x86_64 and arm64. Changes from v13: 1. Rebase on the current latest version, v6.9-rc7. 2. Add 'dept' documentation describing dept APIs. Changes from v12: 1. Refine the whole document for dept. 2. Add 'Interpret dept report' section in the document, using a deadlock report obtained in practice. Hope this version of document helps guys understand dept better. https://lore.kernel.org/lkml/6383cde5-cf4b-facf-6e07-1378a485657d@I-love.SA… https://lore.kernel.org/lkml/1674268856-31807-1-git-send-email-byungchul.pa… Changes from v11: 1. Add 'dept' documentation describing the concept of dept. 2. Rewrite the commit messages of the following commits for using weaker lockdep annotation, for better description. fs/jbd2: Use a weaker annotation in journal handling cpu/hotplug: Use a weaker annotation in AP thread (feedbacked by Thomas Gleixner) Changes from v10: 1. Fix noinstr warning when building kernel source. 2. dept has been reporting some false positives due to the folio lock's unfairness. Reflect it and make dept work based on dept annotaions instead of just wait and wake up primitives. 3. Remove the support for PG_writeback while working on 2. I will add the support later if needed. 4. dept didn't print stacktrace for [S] if the participant of a deadlock is not lock mechanism but general wait and event. However, it made hard to interpret the report in that case. So add support to print stacktrace of the requestor who asked the event context to run - usually a waiter of the event does it just before going to wait state. 5. Give up tracking raw_local_irq_{disable,enable}() since it totally messed up dept's irq tracking. So make it work in the same way as lockdep does. I will consider it once any false positives by those are observed again. 6. Change the manual rwsem_acquire_read(->j_trans_commit_map) annotation in fs/jbd2/transaction.c to the try version so that it works as much as it exactly needs. 7. Remove unnecessary 'inline' keyword in dept.c and add '__maybe_unused' to a needed place. Changes from v9: 1. Fix a bug. SDT tracking didn't work well because of my big mistake that I should've used waiter's map to indentify its class but it had been working with waker's one. FYI, PG_locked and PG_writeback weren't affected. They still worked well. (reported by YoungJun) Changes from v8: 1. Fix build error by adding EXPORT_SYMBOL(PG_locked_map) and EXPORT_SYMBOL(PG_writeback_map) for kernel module build - appologize for that. (reported by kernel test robot) 2. Fix build error by removing header file's circular dependency that was caused by "atomic.h", "kernel.h" and "irqflags.h", which I introduced - appolgize for that. (reported by kernel test robot) Changes from v7: 1. Fix a bug that cannot track rwlock dependency properly, introduced in v7. (reported by Boqun and lockdep selftest) 2. Track wait/event of PG_{locked,writeback} more aggressively assuming that when a bit of PG_{locked,writeback} is cleared there might be waits on the bit. (reported by Linus, Hillf and syzbot) 3. Fix and clean bad style code e.i. unnecessarily introduced a randome pattern and so on. (pointed out by Linux) 4. Clean code for applying dept to wait_for_completion(). Changes from v6: 1. Tie to task scheduler code to track sleep and try_to_wake_up() assuming sleeps cause waits, try_to_wake_up()s would be the events that those are waiting for, of course with proper dept annotations, sdt_might_sleep_weak(), sdt_might_sleep_strong() and so on. For these cases, class is classified at sleep entrance rather than the synchronization initialization code. Which would extremely reduce false alarms. 2. Remove the dept associated instance in each page struct for tracking dependencies by PG_locked and PG_writeback thanks to the 1. work above. 3. Introduce CONFIG_dept_AGGRESIVE_TIMEOUT_WAIT to suppress reports that waits with timeout set are involved, for those who don't like verbose reporting. 4. Add a mechanism to refill the internal memory pools on running out so that dept could keep working as long as free memory is available in the system. 5. Re-enable tracking hashed-waitqueue wait. That's going to no longer generate false positives because class is classified at sleep entrance rather than the waitqueue initailization. 6. Refactor to make it easier to port onto each new version of the kernel. 7. Apply dept to dma fence. 8. Do trivial optimizaitions. Changes from v5: 1. Use just pr_warn_once() rather than WARN_ONCE() on the lack of internal resources because WARN_*() printing stacktrace is too much for informing the lack. (feedback from Ted, Hyeonggon) 2. Fix trivial bugs like missing initializing a struct before using it. 3. Assign a different class per task when handling onstack variables for waitqueue or the like. Which makes dept distinguish between onstack variables of different tasks so as to prevent false positives. (reported by Hyeonggon) 4. Make dept aware of even raw_local_irq_*() to prevent false positives. (reported by Hyeonggon) 5. Don't consider dependencies between the events that might be triggered within __schedule() and the waits that requires __schedule(), real ones. (reported by Hyeonggon) 6. Unstage the staged wait that has prepare_to_wait_event()'ed *and* yet to get to __schedule(), if we encounter __schedule() in-between for another sleep, which is possible if e.g. a mutex_lock() exists in 'condition' of ___wait_event(). 7. Turn on CONFIG_PROVE_LOCKING when CONFIG_DEPT is on, to rely on the hardirq and softirq entrance tracing to make dept more portable for now. Changes from v4: 1. Fix some bugs that produce false alarms. 2. Distinguish each syscall context from another *for arm64*. 3. Make it not warn it but just print it in case dept ring buffer gets exhausted. (feedback from Hyeonggon) 4. Explicitely describe "EXPERIMENTAL" and "dept might produce false positive reports" in Kconfig. (feedback from Ted) Changes from v3: 1. dept shouldn't create dependencies between different depths of a class that were indicated by *_lock_nested(). dept normally doesn't but it does once another lock class comes in. So fixed it. (feedback from Hyeonggon) 2. dept considered a wait as a real wait once getting to __schedule() even if it has been set to TASK_RUNNING by wake up sources in advance. Fixed it so that dept doesn't consider the case as a real wait. (feedback from Jan Kara) 3. Stop tracking dependencies with a map once the event associated with the map has been handled. dept will start to work with the map again, on the next sleep. Changes from v2: 1. Disable dept on bit_wait_table[] in sched/wait_bit.c reporting a lot of false positives, which is my fault. Wait/event for bit_wait_table[] should've been tagged in a higher layer for better work, which is a future work. (feedback from Jan Kara) 2. Disable dept on crypto_larval's completion to prevent a false positive. Changes from v1: 1. Fix coding style and typo. (feedback from Steven) 2. Distinguish each work context from another in workqueue. 3. Skip checking lock acquisition with nest_lock, which is about correct lock usage that should be checked by lockdep. Changes from RFC(v0): 1. Prevent adding a wait tag at prepare_to_wait() but __schedule(). (feedback from Linus and Matthew) 2. Use try version at lockdep_acquire_cpus_lock() annotation. 3. Distinguish each syscall context from another. Byungchul Park (39): dept: implement DEPT(DEPendency Tracker) dept: add single event dependency tracker APIs dept: add lock dependency tracker APIs dept: tie to lockdep and IRQ tracing dept: add proc knobs to show stats and dependency graph dept: distinguish each kernel context from another dept: distinguish each work from another dept: add a mechanism to refill the internal memory pools on running out dept: record the latest one out of consecutive waits of the same class dept: apply sdt_might_sleep_{start,end}() to wait_for_completion()/complete() dept: apply sdt_might_sleep_{start,end}() to swait dept: apply sdt_might_sleep_{start,end}() to waitqueue wait dept: apply sdt_might_sleep_{start,end}() to hashed-waitqueue wait dept: apply sdt_might_sleep_{start,end}() to dma fence dept: track timeout waits separately with a new Kconfig dept: apply timeout consideration to wait_for_completion()/complete() dept: apply timeout consideration to swait dept: apply timeout consideration to waitqueue wait dept: apply timeout consideration to hashed-waitqueue wait dept: apply timeout consideration to dma fence wait dept: make dept able to work with an external wgen dept: track PG_locked with dept dept: print staged wait's stacktrace on report locking/lockdep: prevent various lockdep assertions when lockdep_off()'ed dept: add documents for dept cpu/hotplug: use a weaker annotation in AP thread dept: assign dept map to mmu notifier invalidation synchronization dept: assign unique dept_key to each distinct dma fence caller dept: make dept aware of lockdep_set_lock_cmp_fn() annotation dept: make dept stop from working on debug_locks_off() dept: assign unique dept_key to each distinct wait_for_completion() caller completion, dept: introduce init_completion_dmap() API dept: call dept_hardirqs_off() in local_irq_*() regardless of irq state dept: introduce APIs to set page usage and use subclasses_evt for the usage dept: track PG_writeback with dept SUNRPC: relocate struct rcu_head to the first field of struct rpc_xprt mm: percpu: increase PERCPU_DYNAMIC_SIZE_SHIFT on DEPT and large PAGE_SIZE rust: completion: Add __rust_helper to rust_helper_wait_for_completion() dept: implement a basic unit test for dept Yunseong Kim (1): rcu/update: fix same dept key collision between various types of RCU Documentation/dev-tools/dept.rst | 905 ++++++++ Documentation/dev-tools/dept_api.rst | 124 + Documentation/dev-tools/index.rst | 2 + drivers/dma-buf/dma-fence.c | 23 +- include/linux/completion.h | 124 +- include/linux/dept.h | 267 +++ include/linux/dept_ldt.h | 78 + include/linux/dept_sdt.h | 68 + include/linux/dept_unit_test.h | 61 + include/linux/dma-fence.h | 74 +- include/linux/hardirq.h | 3 + include/linux/irq-entry-common.h | 4 + include/linux/irqflags.h | 21 +- include/linux/local_lock_internal.h | 1 + include/linux/lockdep.h | 105 +- include/linux/lockdep_types.h | 3 + include/linux/mm_types.h | 4 + include/linux/mmu_notifier.h | 26 + include/linux/mutex.h | 1 + include/linux/page-flags.h | 217 +- include/linux/pagemap.h | 37 +- include/linux/percpu-rwsem.h | 2 +- include/linux/percpu.h | 4 + include/linux/rcupdate_wait.h | 13 +- include/linux/rtmutex.h | 1 + include/linux/rwlock_types.h | 1 + include/linux/rwsem.h | 1 + include/linux/sched.h | 111 + include/linux/seqlock.h | 2 +- include/linux/spinlock_types_raw.h | 3 + include/linux/srcu.h | 2 +- include/linux/sunrpc/xprt.h | 9 +- include/linux/swait.h | 3 + include/linux/wait.h | 3 + include/linux/wait_bit.h | 3 + init/init_task.c | 2 + init/main.c | 2 + kernel/Makefile | 1 + kernel/cpu.c | 2 +- kernel/dependency/Makefile | 5 + kernel/dependency/dept.c | 3222 ++++++++++++++++++++++++++ kernel/dependency/dept_hash.h | 10 + kernel/dependency/dept_internal.h | 314 +++ kernel/dependency/dept_object.h | 13 + kernel/dependency/dept_proc.c | 94 + kernel/dependency/dept_unit_test.c | 149 ++ kernel/exit.c | 1 + kernel/fork.c | 2 + kernel/locking/lockdep.c | 33 + kernel/module/main.c | 2 + kernel/rcu/rcu.h | 1 + kernel/rcu/update.c | 5 +- kernel/sched/completion.c | 62 +- kernel/sched/core.c | 9 + kernel/workqueue.c | 3 + lib/Kconfig.debug | 48 + lib/debug_locks.c | 2 + lib/locking-selftest.c | 2 + mm/filemap.c | 38 + mm/mm_init.c | 3 + mm/mmu_notifier.c | 31 +- rust/helpers/completion.c | 5 + 62 files changed, 6247 insertions(+), 120 deletions(-) create mode 100644 Documentation/dev-tools/dept.rst create mode 100644 Documentation/dev-tools/dept_api.rst create mode 100644 include/linux/dept.h create mode 100644 include/linux/dept_ldt.h create mode 100644 include/linux/dept_sdt.h create mode 100644 include/linux/dept_unit_test.h create mode 100644 kernel/dependency/Makefile create mode 100644 kernel/dependency/dept.c create mode 100644 kernel/dependency/dept_hash.h create mode 100644 kernel/dependency/dept_internal.h create mode 100644 kernel/dependency/dept_object.h create mode 100644 kernel/dependency/dept_proc.c create mode 100644 kernel/dependency/dept_unit_test.c base-commit: 028ef9c96e96197026887c0f092424679298aae8 -- 2.17.1

17 hours, 49 minutes

Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()

by Robin Murphy

On 07/07/2026 2:36 pm, Mike Rapoport wrote: > On Tue, Jul 07, 2026 at 02:17:29PM +0100, Robin Murphy wrote: >> >> Given the precedent of memblock_mark_nomap(), as long as the reusable >> reserved-memory regions also get split into distinct memblocks, then it >> seems like in principle we ought to be able to give them a new >> MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in >> map_mem() without needing to override force_pte_mapping() globally? > > Please don't. _nomap() caused enough pain. Indeed I was there for pretty much the whole pfn_valid() saga :) Bad example maybe - in this case the only actual similarity to nomap would be the fact that it would also be set by the of_reserved_mem code based on what it finds in DT; in all other aspects it should be functionally closer to something like MEMBLOCK_RSRV_NOINIT, i.e. just carrying information through the mm init phase, then ceasing to matter at all once the linear mapping is done. Cheers, Robin.

17 hours, 52 minutes

Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()

by Robin Murphy

On 07/07/2026 12:27 pm, Will Deacon wrote: > On Mon, Jul 06, 2026 at 03:49:24PM +0200, Thierry Reding wrote: >> On Fri, Jul 03, 2026 at 06:13:31PM +0100, Will Deacon wrote: >>> On Thu, Jul 02, 2026 at 06:41:23PM +0200, Thierry Reding wrote: >>>> On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote: >>>>> On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote: >>>>>> On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote: >>>>>>> From: Chun Ng <chunn(a)nvidia.com> >>>>>>> >>>>>>> Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits >>>>>>> on a kernel-linear-map range. >>>>>> >>>>>> That sounds like a really terrible idea. Why is this necessary and how >>>>>> does it interact with things like load_unaligned_zeropad()? >>>>> >>>>> This is necessary because once the memory controller has walled off the >>>>> new memory region the CPU must not access it under any circumstances or >>>>> it'll cause the CPU to lock up (I think technically it'll hit an SError >>>>> but in practice that just means it'll freeze, as far as I can tell). >>>>> >>>>> Probably doesn't interact well at all with load_unaligned_zeropad(). >>>>> >>>>>> I think you should unmap the memory from the linear map and memremap() >>>>>> it instead. >>>>> >>>>> Given that the memory can never be accessed by the CPU after the memory >>>>> controller locks it down, I don't think we'll even need memremap(). The >>>>> only thing we really need is the sg_table we hand out via the DMA BUFs >>>>> so that they can be used by device drivers to program their DMA engines >>>>> internally. >>>>> >>>>> Looking through some of the architecture code around this, shouldn't we >>>>> simply be using set_memory_encrypted() and set_memory_decrypted() for >>>>> this? While they might've been created for slightly other use-cases, >>>>> they seem to be doing exactly what we want (i.e. remove the page range >>>>> from the linear mapping and flushing it, or restoring the valid bit and >>>>> standard permissions, respectively). >>>> >>>> Ah... I guess we can't do it because we're not in a realm world and so >>>> the early checks in __set_memory_enc_dec() would return early and turn >>>> it into a no-op. >>>> >>>> How about if I extract a common helper and provide set_memory_p() and >>>> set_memory_np() in terms of those. Those are available on x86 and >>>> PowerPC as well, so fairly standard. I suppose at that point we're >>>> closer to set_memory_valid(). >>> >>> Why not just call set_direct_map_invalid_noflush() + >>> flush_tlb_kernel_range() for each page? We already have APIs for this. >> >> Having a "standard" helper with a fixed and documented purposed seemed >> like a preferable approach for this particular case. We also may want to >> make the driver that uses this buildable as a module, in which case we'd >> need to export these rather low-level APIs. And then there's also the >> fact that we typically call this on a rather large region of memory >> (usually something like 512 MiB), so doing it page-by-page is rather >> suboptimal. >> >>> The big challenge I see with any linear map manipulation, however, is >>> that it will rely on can_set_direct_map() which likely means you need to >>> give up some performance and/or security to make this work. Does memory >>> become inaccesible dynamically at runtime? If not, the best bet would >>> be to describe it as a carveout in the DT and mark it as "no-map" so >>> we avoid mapping it in the first place. >> >> VPR exists in two modes: static and resizable. For static VPR we do >> exactly that: describe it as carveout in DT with no-map and deal with it >> accordingly in the driver. Resizable VPR is for device that have small >> amounts of RAM. Content-protected video playback will in the worst case >> consume around 1.8 GiB of RAM, so we want to be able to reuse for other >> purposes when VPR is unused on those devices. In that case, the memory >> is also described as a reserved-memory region in DT, but it is marked as >> reusable so that it can be managed by CMA. >> >> The resize operation is fairly slow to begin with because we need to >> stall the GPU and put it into reset before the operation, then take it >> out of reset and resume it afterwards. >> >> What kind of performance impact do you expect? > > You'll need to measure it, but we've seen reports of double-digit > percentage regressions in performance and power. As I said, the problem > is that you need to split the linear map to 4k page at runtime to unmap > the dynamic carveout, but that isn't something that can be done on most > CPUs. Therefore you end up having to use page-granular mappings for the > entire thing, similarly to how 'rodata_full' drives can_set_direct_map() > and the perf/power hit affects everything. > > It's hard to know what to suggest... I wonder if any of the memory > hotplug logic could help here? Given the precedent of memblock_mark_nomap(), as long as the reusable reserved-memory regions also get split into distinct memblocks, then it seems like in principle we ought to be able to give them a new MEMBLOCK_PTEMAP (or whatever) flag which could then be picked up in map_mem() without needing to override force_pte_mapping() globally? Cheers, Robin.

18 hours, 50 minutes

Re: [PATCH v3 04/11] arm64/mm: Add set_memory_device() and set_memory_normal()

by Robin Murphy

On 06/07/2026 2:49 pm, Thierry Reding wrote: > On Fri, Jul 03, 2026 at 06:13:31PM +0100, Will Deacon wrote: >> On Thu, Jul 02, 2026 at 06:41:23PM +0200, Thierry Reding wrote: >>> On Thu, Jul 02, 2026 at 03:46:44PM +0200, Thierry Reding wrote: >>>> On Thu, Jul 02, 2026 at 10:18:47AM +0100, Will Deacon wrote: >>>>> On Wed, Jul 01, 2026 at 06:08:15PM +0200, Thierry Reding wrote: >>>>>> From: Chun Ng <chunn(a)nvidia.com> >>>>>> >>>>>> Add helpers to swap PROT_NORMAL and PROT_DEVICE_nGnRnE protection bits >>>>>> on a kernel-linear-map range. >>>>> >>>>> That sounds like a really terrible idea. Why is this necessary and how >>>>> does it interact with things like load_unaligned_zeropad()? >>>> >>>> This is necessary because once the memory controller has walled off the >>>> new memory region the CPU must not access it under any circumstances or >>>> it'll cause the CPU to lock up (I think technically it'll hit an SError >>>> but in practice that just means it'll freeze, as far as I can tell). >>>> >>>> Probably doesn't interact well at all with load_unaligned_zeropad(). >>>> >>>>> I think you should unmap the memory from the linear map and memremap() >>>>> it instead. >>>> >>>> Given that the memory can never be accessed by the CPU after the memory >>>> controller locks it down, I don't think we'll even need memremap(). The >>>> only thing we really need is the sg_table we hand out via the DMA BUFs >>>> so that they can be used by device drivers to program their DMA engines >>>> internally. >>>> >>>> Looking through some of the architecture code around this, shouldn't we >>>> simply be using set_memory_encrypted() and set_memory_decrypted() for >>>> this? While they might've been created for slightly other use-cases, >>>> they seem to be doing exactly what we want (i.e. remove the page range >>>> from the linear mapping and flushing it, or restoring the valid bit and >>>> standard permissions, respectively). >>> >>> Ah... I guess we can't do it because we're not in a realm world and so >>> the early checks in __set_memory_enc_dec() would return early and turn >>> it into a no-op. >>> >>> How about if I extract a common helper and provide set_memory_p() and >>> set_memory_np() in terms of those. Those are available on x86 and >>> PowerPC as well, so fairly standard. I suppose at that point we're >>> closer to set_memory_valid(). >> >> Why not just call set_direct_map_invalid_noflush() + >> flush_tlb_kernel_range() for each page? We already have APIs for this. > > Having a "standard" helper with a fixed and documented purposed seemed > like a preferable approach for this particular case. We also may want to > make the driver that uses this buildable as a module, in which case we'd > need to export these rather low-level APIs. And then there's also the > fact that we typically call this on a rather large region of memory > (usually something like 512 MiB), so doing it page-by-page is rather > suboptimal. > >> The big challenge I see with any linear map manipulation, however, is >> that it will rely on can_set_direct_map() which likely means you need to >> give up some performance and/or security to make this work. Does memory >> become inaccesible dynamically at runtime? If not, the best bet would >> be to describe it as a carveout in the DT and mark it as "no-map" so >> we avoid mapping it in the first place. > > VPR exists in two modes: static and resizable. For static VPR we do > exactly that: describe it as carveout in DT with no-map and deal with it > accordingly in the driver. Resizable VPR is for device that have small > amounts of RAM. Content-protected video playback will in the worst case > consume around 1.8 GiB of RAM, so we want to be able to reuse for other > purposes when VPR is unused on those devices. In that case, the memory > is also described as a reserved-memory region in DT, but it is marked as > reusable so that it can be managed by CMA. OK, so this is dynamic TrustZone, which is essentially identical to CCA delegation as far as we're concerned from the Non-Secure side. IIRC there was some ongoing talk about explicitly keeping track of the state of physical memory ranges in terms of being delegated to CoCo VMs or not, so eventually plumbing a "delegated to TEE/other" state through all the same mechanisms seems a pretty achievable goal. For now, though, firstly I'll note we have seen this sort of thing before: https://lore.kernel.org/dri-devel/20240515112308.10171-1-yong.wu@mediatek.c… although that didn't seem to need explicit unmapping (likely it involved a TrustZone controller that just made NS accesses RAZ/WI instead of external-aborting). If you want to be nice and start trying to build the general abstraction for this, then as a first step I'd suggest following the shape of the current CCA machinery - build a "delegate to TEE" operation around the existing set_memory_valid() paradigm[1] with can_set_direct_map() safeguards, and have something like a have_dynamic_tz() that echoes is_realm_world() in terms of being set at boot when one of these regions is detected by the early reserved-memory parsing, then considered in force_pte_mapping() (such that it only matters if BBML3 doesn't already have us covered). Thanks, Robin. [1] Personally I'd be inclined to stay away from set_memory_*crypted() until that mess gets sorted out properly, but the argument could also be made the other way that the "delegated" state is currently mixed up in "encrypted", so technically it wouldn't be entirely inaccurate to use, it would just mean that we're intentionally adding more to that cleanup effort. For now it seems nicer to me to keep a distinct "made invalid (due to delegation)" state that can eventually converge into a proper "delegated" state once that exists, rather than get mixed up in the current guest-shared/guest-private/host-shared/host-private/host-delegated mess most of which is not relevant for non-CoCo uses. > The resize operation is fairly slow to begin with because we need to > stall the GPU and put it into reset before the operation, then take it > out of reset and resume it afterwards. > > What kind of performance impact do you expect? > > Thierry

19 hours, 52 minutes

Re: [PATCH v3 06/11] mm/cma: Allow dynamically creating CMA areas

by Marek Szyprowski

On 01.07.2026 18:08, Thierry Reding wrote: > From: Thierry Reding <treding(a)nvidia.com> > > There is no technical reason why there should be a limited number of CMA > regions, so extract some code into helpers and use them to create extra > functions (cma_create() and cma_free()) that allow creating and freeing, > respectively, CMA regions dynamically at runtime. Well, the technical reason for not creating cma regions dynamically at runtime is that on some architectures (like 32bit ARM) the early fixup for the region is needed to make it functional for DMA. I would add a comment about that in the cma_create() and ensure that its future callers explicitly depend on !ARM_32BIT. > The static array of CMA areas cannot be replaced by dynamically created > areas because for many of them, allocation must not fail and some cases > may need to initialize them before the slab allocator is even available. > To account for this, keep these "early" areas in a separate list and > track the dynamic areas in a separate list. > > Signed-off-by: Thierry Reding <treding(a)nvidia.com> > --- > Changes in v3: > - rebase on top of recent linux-next, update kernel/dma/contiguous.c > - use kzalloc_obj() instead of kzalloc() with sizeof() > > Changes in v2: > - rename fixed number of CMA areas to reflect their main use > - account for pages in dynamically allocated regions > --- > arch/arm/mm/dma-mapping.c | 2 +- > arch/s390/mm/init.c | 2 +- > include/linux/cma.h | 8 +- > kernel/dma/contiguous.c | 2 +- > mm/cma.c | 187 +++++++++++++++++++++++++++++++++++++--------- > mm/cma.h | 5 +- > 6 files changed, 165 insertions(+), 41 deletions(-) > > diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c > index f9bc53b60f99..934952ab2102 100644 > --- a/arch/arm/mm/dma-mapping.c > +++ b/arch/arm/mm/dma-mapping.c > @@ -254,7 +254,7 @@ struct dma_contig_early_reserve { > unsigned long size; > }; > -static struct dma_contig_early_reserve dma_mmu_remap[MAX_CMA_AREAS] __initdata; > +static struct dma_contig_early_reserve dma_mmu_remap[MAX_EARLY_CMA_AREAS] __initdata; > static int dma_mmu_remap_num __initdata; > diff --git a/arch/s390/mm/init.c b/arch/s390/mm/init.c > index f07168a0d3dd..f8f78f1434ea 100644 > --- a/arch/s390/mm/init.c > +++ b/arch/s390/mm/init.c > @@ -241,7 +241,7 @@ static int s390_cma_mem_notifier(struct notifier_block *nb, > mem_data.start = arg->start_pfn << PAGE_SHIFT; > mem_data.end = mem_data.start + (arg->nr_pages << PAGE_SHIFT); > if (action == MEM_GOING_OFFLINE) > - rc = cma_for_each_area(s390_cma_check_range, &mem_data); > + rc = cma_for_each_early_area(s390_cma_check_range, &mem_data); > return notifier_from_errno(rc); > } > diff --git a/include/linux/cma.h b/include/linux/cma.h > index 8555d38a97b1..fb7a4923c3ba 100644 > --- a/include/linux/cma.h > +++ b/include/linux/cma.h > @@ -7,7 +7,7 @@ > #include <linux/numa.h> > #ifdef CONFIG_CMA_AREAS > -#define MAX_CMA_AREAS CONFIG_CMA_AREAS > +#define MAX_EARLY_CMA_AREAS CONFIG_CMA_AREAS > #endif > #define CMA_MAX_NAME 64 > @@ -57,8 +57,14 @@ struct page *cma_alloc_frozen_compound(struct cma *cma, unsigned int order); > bool cma_release_frozen(struct cma *cma, const struct page *pages, > unsigned long count); > +extern int cma_for_each_early_area(int (*it)(struct cma *cma, void *data), void *data); > extern int cma_for_each_area(int (*it)(struct cma *cma, void *data), void *data); > extern bool cma_intersects(struct cma *cma, unsigned long start, unsigned long end); > extern void cma_reserve_pages_on_error(struct cma *cma); > + > +extern struct cma *cma_create(phys_addr_t base, phys_addr_t size, > + unsigned int order_per_bit, const char *name); > +extern void cma_free(struct cma *cma); > + > #endif > diff --git a/kernel/dma/contiguous.c b/kernel/dma/contiguous.c > index f754079a287d..7975551f69b3 100644 > --- a/kernel/dma/contiguous.c > +++ b/kernel/dma/contiguous.c > @@ -52,7 +52,7 @@ > #define CMA_SIZE_MBYTES 0 > #endif > -static struct cma *dma_contiguous_areas[MAX_CMA_AREAS]; > +static struct cma *dma_contiguous_areas[MAX_EARLY_CMA_AREAS]; > static unsigned int dma_contiguous_areas_num; > static int dma_contiguous_insert_area(struct cma *cma) > diff --git a/mm/cma.c b/mm/cma.c > index a13ce4999b39..f989e2e98594 100644 > --- a/mm/cma.c > +++ b/mm/cma.c > @@ -34,7 +34,12 @@ > #include "internal.h" > #include "cma.h" > -struct cma cma_areas[MAX_CMA_AREAS]; > +static DEFINE_MUTEX(cma_lock); > + > +struct cma cma_early_areas[MAX_EARLY_CMA_AREAS]; > +unsigned int cma_early_area_count; > + > +static LIST_HEAD(cma_areas); > unsigned int cma_area_count; > phys_addr_t cma_get_base(const struct cma *cma) > @@ -198,7 +203,6 @@ static void __init cma_activate_area(struct cma *cma) > free_reserved_page(pfn_to_page(pfn)); > } > } > - totalcma_pages -= cma->count; > cma->available_count = cma->count = 0; > pr_err("CMA area %s could not be activated\n", cma->name); > } > @@ -207,8 +211,8 @@ static int __init cma_init_reserved_areas(void) > { > int i; > - for (i = 0; i < cma_area_count; i++) > - cma_activate_area(&cma_areas[i]); > + for (i = 0; i < cma_early_area_count; i++) > + cma_activate_area(&cma_early_areas[i]); > return 0; > } > @@ -219,41 +223,77 @@ void __init cma_reserve_pages_on_error(struct cma *cma) > set_bit(CMA_RESERVE_PAGES_ON_ERROR, &cma->flags); > } > +static void __init cma_init_area(struct cma *cma, const char *name, > + phys_addr_t size, unsigned int order_per_bit) > +{ > + if (name) > + strscpy(cma->name, name); > + else > + snprintf(cma->name, CMA_MAX_NAME, "cma%d\n", cma_area_count); > + > + cma->available_count = cma->count = size >> PAGE_SHIFT; > + cma->order_per_bit = order_per_bit; > + > + INIT_LIST_HEAD(&cma->node); > +} > + > static int __init cma_new_area(const char *name, phys_addr_t size, > unsigned int order_per_bit, > struct cma **res_cma) > { > struct cma *cma; > - if (cma_area_count == ARRAY_SIZE(cma_areas)) { > + if (cma_early_area_count == ARRAY_SIZE(cma_early_areas)) { > pr_err("Not enough slots for CMA reserved regions!\n"); > return -ENOSPC; > } > + mutex_lock(&cma_lock); > + > /* > * Each reserved area must be initialised later, when more kernel > * subsystems (like slab allocator) are available. > */ > - cma = &cma_areas[cma_area_count]; > - cma_area_count++; > + cma = &cma_early_areas[cma_early_area_count]; > + cma_early_area_count++; > - if (name) > - strscpy(cma->name, name); > - else > - snprintf(cma->name, CMA_MAX_NAME, "cma%d\n", cma_area_count); > + cma_init_area(cma, name, size, order_per_bit); > - cma->available_count = cma->count = size >> PAGE_SHIFT; > - cma->order_per_bit = order_per_bit; > - *res_cma = cma; > totalcma_pages += cma->count; > + *res_cma = cma; > + > + mutex_unlock(&cma_lock); > return 0; > } > static void __init cma_drop_area(struct cma *cma) > { > + mutex_lock(&cma_lock); > totalcma_pages -= cma->count; > - cma_area_count--; > + cma_early_area_count--; > + mutex_unlock(&cma_lock); > +} > + > +static int __init cma_check_memory(phys_addr_t base, phys_addr_t size) > +{ > + if (!size || !memblock_is_region_reserved(base, size)) > + return -EINVAL; > + > + /* > + * CMA uses CMA_MIN_ALIGNMENT_BYTES as alignment requirement which > + * needs pageblock_order to be initialized. Let's enforce it. > + */ > + if (!pageblock_order) { > + pr_err("pageblock_order not yet initialized. Called during early boot?\n"); > + return -EINVAL; > + } > + > + /* ensure minimal alignment required by mm core */ > + if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) > + return -EINVAL; > + > + return 0; > } > /** > @@ -276,22 +316,9 @@ int __init cma_init_reserved_mem(phys_addr_t base, phys_addr_t size, > struct cma *cma; > int ret; > - /* Sanity checks */ > - if (!size || !memblock_is_region_reserved(base, size)) > - return -EINVAL; > - > - /* > - * CMA uses CMA_MIN_ALIGNMENT_BYTES as alignment requirement which > - * needs pageblock_order to be initialized. Let's enforce it. > - */ > - if (!pageblock_order) { > - pr_err("pageblock_order not yet initialized. Called during early boot?\n"); > - return -EINVAL; > - } > - > - /* ensure minimal alignment required by mm core */ > - if (!IS_ALIGNED(base | size, CMA_MIN_ALIGNMENT_BYTES)) > - return -EINVAL; > + ret = cma_check_memory(base, size); > + if (ret < 0) > + return ret; > ret = cma_new_area(name, size, order_per_bit, &cma); > if (ret != 0) > @@ -444,7 +471,7 @@ static int __init __cma_declare_contiguous_nid(phys_addr_t *basep, > pr_debug("%s(size %pa, base %pa, limit %pa alignment %pa)\n", > __func__, &size, &base, &limit, &alignment); > - if (cma_area_count == ARRAY_SIZE(cma_areas)) { > + if (cma_early_area_count == ARRAY_SIZE(cma_early_areas)) { > pr_err("Not enough slots for CMA reserved regions!\n"); > return -ENOSPC; > } > @@ -1051,12 +1078,12 @@ bool cma_release_frozen(struct cma *cma, const struct page *pages, > return true; > } > -int cma_for_each_area(int (*it)(struct cma *cma, void *data), void *data) > +int cma_for_each_early_area(int (*it)(struct cma *cma, void *data), void *data) > { > int i; > - for (i = 0; i < cma_area_count; i++) { > - int ret = it(&cma_areas[i], data); > + for (i = 0; i < cma_early_area_count; i++) { > + int ret = it(&cma_early_areas[i], data); > if (ret) > return ret; > @@ -1065,6 +1092,25 @@ int cma_for_each_area(int (*it)(struct cma *cma, void *data), void *data) > return 0; > } > +int cma_for_each_area(int (*it)(struct cma *cma, void *data), void *data) > +{ > + struct cma *cma; > + > + mutex_lock(&cma_lock); > + > + list_for_each_entry(cma, &cma_areas, node) { > + int ret = it(cma, data); > + > + if (ret) { > + mutex_unlock(&cma_lock); > + return ret; > + } > + } > + > + mutex_unlock(&cma_lock); > + return 0; > +} > + > bool cma_intersects(struct cma *cma, unsigned long start, unsigned long end) > { > int r; > @@ -1147,3 +1193,74 @@ void __init *cma_reserve_early(struct cma *cma, unsigned long size) > return ret; > } > + > +struct cma *__init cma_create(phys_addr_t base, phys_addr_t size, > + unsigned int order_per_bit, const char *name) > +{ > + struct cma *cma; > + int ret; > + > + ret = cma_check_memory(base, size); > + if (ret < 0) > + return ERR_PTR(ret); > + > + cma = kzalloc_obj(*cma, GFP_KERNEL); > + if (!cma) > + return ERR_PTR(-ENOMEM); > + > + cma_init_area(cma, name, size, order_per_bit); > + cma->ranges[0].base_pfn = PFN_DOWN(base); > + cma->ranges[0].early_pfn = PFN_DOWN(base); > + cma->ranges[0].count = cma->count; > + cma->nranges = 1; > + > + cma_activate_area(cma); > + > + mutex_lock(&cma_lock); > + list_add_tail(&cma->node, &cma_areas); > + totalcma_pages += cma->count; > + cma_area_count++; > + mutex_unlock(&cma_lock); > + > + return cma; > +} > + > +void cma_free(struct cma *cma) > +{ > + unsigned int i; > + > + /* > + * Safety check to prevent a CMA with active allocations from being > + * released. > + */ > + for (i = 0; i < cma->nranges; i++) { > + unsigned long nbits = cma_bitmap_maxno(cma, &cma->ranges[i]); > + > + if (!bitmap_empty(cma->ranges[i].bitmap, nbits)) { > + WARN(1, "%s: range %u not empty\n", cma->name, i); > + return; > + } > + } > + > + /* free reserved pages and the bitmap */ > + for (i = 0; i < cma->nranges; i++) { > + struct cma_memrange *cmr = &cma->ranges[i]; > + unsigned long end_pfn, pfn; > + > + end_pfn = cmr->base_pfn + cmr->count; > + for (pfn = cmr->base_pfn; pfn < end_pfn; pfn++) > + free_reserved_page(pfn_to_page(pfn)); > + > + bitmap_free(cmr->bitmap); > + } > + > + mutex_destroy(&cma->alloc_mutex); > + > + mutex_lock(&cma_lock); > + totalcma_pages -= cma->count; > + list_del(&cma->node); > + cma_area_count--; > + mutex_unlock(&cma_lock); > + > + kfree(cma); > +} > diff --git a/mm/cma.h b/mm/cma.h > index c70180c36559..ae4db9819e38 100644 > --- a/mm/cma.h > +++ b/mm/cma.h > @@ -41,6 +41,7 @@ struct cma { > unsigned long available_count; > unsigned int order_per_bit; /* Order of pages represented by one bit */ > spinlock_t lock; > + struct list_head node; > struct mutex alloc_mutex; > #ifdef CONFIG_CMA_DEBUGFS > struct hlist_head mem_head; > @@ -71,8 +72,8 @@ enum cma_flags { > CMA_ACTIVATED, > }; > -extern struct cma cma_areas[MAX_CMA_AREAS]; > -extern unsigned int cma_area_count; > +extern struct cma cma_early_areas[MAX_EARLY_CMA_AREAS]; > +extern unsigned int cma_early_area_count; > static inline unsigned long cma_bitmap_maxno(struct cma *cma, > struct cma_memrange *cmr) > Best regards -- Marek Szyprowski, PhD Samsung R&D Institute Poland

22 hours, 5 minutes

Pharma Marketing Automation: How AI Is Transforming HCP Engagement in 2026

by ankitsinghmultiplierai＠gmail.com

Pharma marketing has entered a new phase. The old model of mass emails, broad segments, and manual follow-up no longer delivers results in a market where physician attention is scarce and expectations are high. In its place, pharma marketing automation powered by AI is becoming the standard for commercial teams that want to reach the right healthcare professional, with the right message, at the right time, and prove the return on every campaign. This post breaks down what pharma marketing automation actually means in 2026, why it matters now, and how AI-driven HCP engagement is reshaping commercial performance across the industry. What Is Pharma Marketing Automation? Pharma marketing automation is the use of technology to plan, execute, personalize, and measure marketing activity across channels, with minimal manual effort. It covers everything from HCP email campaigns and content delivery to lead scoring, engagement tracking, and performance reporting. The difference in 2026 is intelligence. Traditional automation followed fixed rules. Modern pharma marketing automation uses AI to understand each healthcare professional, predict what will resonate, and adapt campaigns in real time. It moves marketing from a batch-and-blast model to genuine one-to-one engagement at scale. For commercial teams, this shift turns marketing from a cost center into a measurable growth engine. Why Traditional HCP Engagement Stopped Working Three forces have made the old approach obsolete. Physician access is shrinking. Fewer doctors take in-person meetings, and digital inboxes are saturated. Generic outreach is ignored. Relevance is now the price of attention. HCP data quality is a barrier. Fragmented, duplicated, and outdated doctor data means campaigns reach the wrong audience. Poor data quietly undermines every downstream marketing activity, no matter how good the creative. Measurement has become non-negotiable. Commercial leaders are under pressure to justify spend. Marketing that cannot connect activity to physician engagement and prescription impact loses budget to channels that can. AI-driven pharma marketing automation addresses all three by fixing the data foundation, personalizing engagement, and making performance fully measurable. How AI-Powered Pharma Marketing Automation Works Modern platforms share a common architecture that turns raw data into commercial results. Unified, enriched HCP profiles. The foundation is accurate physician data. AI resolves duplicate records into a single profile and enriches it with specialty, research interests, and engagement signals. A clean GenAI doctor data platform ensures every campaign starts from reliable information rather than a flawed list. Intelligent segmentation and targeting. Instead of broad categories, AI groups physicians by real behavior and clinical focus, so messaging reaches those most likely to engage. Personalized content at scale. With enriched profiles in place, teams deliver hyper personalized content tailored to each physician's specialty and interests. An oncologist and a cardiologist receive materially different, relevant communication, which lifts engagement well above generic benchmarks. Automated, compliant orchestration. Campaigns run across email, digital, and messaging channels with compliance built in. Consent is tracked, claims are checked against approved language, and every interaction is logged for auditability. Real-time measurement. Dashboards show engagement, response, and cost per outcome by channel and specialty, so teams can shift spend to what works and drop what does not. The Business Impact of AI-Driven HCP Engagement Pharma marketing automation is not a technology upgrade for its own sake. It changes the numbers commercial leaders are measured on. Field productivity rises as teams stop wasting time on bad data and focus on relevant physicians. Campaign performance improves as personalized outreach outperforms generic email. Marketing return climbs as spend concentrates on the physicians most likely to engage and convert. And compliance becomes stronger, not weaker, because engagement is auditable and consent-aware by design. The result is a marketing function that drives measurable commercial growth rather than simply generating activity. How to Choose the Right Pharma Marketing Automation Platform Not every tool marketed as AI-enabled holds up in a regulated pharma environment. When evaluating options, weigh five factors: whether the platform was built for pharma rather than adapted from a generic marketing tool, how it unifies and refreshes HCP data, whether compliance is designed in rather than added later, how well it integrates with existing CRM systems like Salesforce and Veeva, and whether the vendor can show proven outcomes with comparable pharma organizations. Where Multiplier AI Fits Multiplier AI builds validated, compliance-first pharma marketing automation for commercial teams that want to modernize HCP engagement and drive measurable growth. Its platforms unify fragmented doctor data, power personalized physician engagement, and keep compliance built into the workflow. Trusted by global pharma and medical device leaders including Eli Lilly, Sandoz, Merck, Abbott, and Medtronic, Multiplier AI helps organizations turn marketing from activity into outcomes. The future of pharma marketing belongs to teams that engage physicians with precision, relevance, and accountability. AI-driven automation is how they get there. https://multiplierai.co/

1 day, 1 hour

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

Linaro-mm-sig