[PATCH 00/10] irqchip/gic-v5: Fix misc IRS and ITS host driver issues

[PATCH 00/10] irqchip/gic-v5: Fix misc IRS and ITS host driver issues

[Sascha Bischoff]

This series fixes issues in the GICv5 host IRS and ITS drivers.

The ITS invalidation serialisation fix addresses Sashiko's report of a
race between event and device invalidation commands [1]. The other
patches correct IRS allocation and routing behaviour, serialise IRS
synchronisation, and fix ITS L1/L2 table selection, cache maintenance,
ACPI coherency handling, and resource cleanup.

The IRS changes:
* Reject allocation of an SPI without an IRS, preventing a null-pointer
  dereference, and warn about low-quality firmware.
* Only program IRS_PE_CR0.DPS when 1-of-N routing is supported as this field
  is RES0, otherwise.
* Serialise IRS synchronisation requests, as the IRS ignores a request while
  an earlier one is still active.

The ITS changes:
* Serialise event and device cache invalidations because both use the ITS's
  shared DIDR register, so concurrent writes are a bad idea!
* Select linear device and interrupt translation tables when one L2
  table covers the full ID space. Currently, this selects the wrong
  path, then the L1 table code rejects the attempt to create the
  table.
* Check the ACPI noncoherent flag with ACPI, rather than checking the
  DT's property.
* Correct cache-maintenance sizing after limiting the DeviceID width.
* Invalidate the device cache before freeing an ITT.
* Use firmware-node names in initialisation warnings.
* Release the reserved MMIO region if DT-based ITS initialisation fails.

I've CC'd stable for the IRS/ITS locking fixes, the ITS table alloc
issue, and the ACPI coherency fix, as these are the most important
changes to backport.

The series is based on v7.4-rc1. Thanks for taking a look!

Sascha

[1] https://sashiko.dev/#/patchset/20261016155741.979985-1-sascha.bischoff@arm.com?part=11

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
Sascha Bischoff (10):
      irqchip/gic-v5: Reject SPIs not backed by an IRS
      irqchip/gic-v5: Only set IRS DPS when 1ofN routing is supported
      irqchip/gic-v5: Serialise IRS synchronisation requests
      irqchip/gic-v5: Serialise ITS invalidation commands
      irqchip/gic-v5: Use linear DT and ITT when L2 covers all IDs
      irqchip/gic-v5: Honour ACPI ITS noncoherent flag
      irqchip/gic-v5: Use firmware node name in ITS warning
      irqchip/gic-v5: Invalidate ITS device cache before freeing ITT
      irqchip/gic-v5: Clean the allocated linear device table size
      irqchip/gic-v5: Release ITS MMIO region on DT probe failure

 drivers/irqchip/irq-gic-v5-irs.c   | 22 +++++++++++++++-------
 drivers/irqchip/irq-gic-v5-its.c   | 29 ++++++++++++++++++++++++-----
 drivers/irqchip/irq-gic-v5.c       |  9 +++++++++
 include/linux/irqchip/arm-gic-v5.h |  1 +
 4 files changed, 49 insertions(+), 12 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261102-host_gicv5_fixes-1eeea29d2ea4

Best regards,
--  
Sascha Bischoff <sascha.bischoff@arm.com>

[PATCH 01/10] irqchip/gic-v5: Reject SPIs not backed by an IRS

[Sascha Bischoff]

It is possible to build a multi-IRS GICv5 system where there are gaps
in the global SPI range that are not backed by any IRS. In the current
incarnation, this results in dereferencing a null pointer.

Reject cases where the firmware attempts to use those SPIs during IRQ
allocation by catching the case where there is no chip_data associated
with the irq (meaning that there is no IRS to back it). Spit out a
warning about broken firmware when this is encountered as it shouldn't
be using non-existent SPIs in the first place.

Fixes: 5cb1b6dab2def ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
index 8c0303af71e7d..f3cce2bd28cc3 100644
--- a/drivers/irqchip/irq-gic-v5.c
+++ b/drivers/irqchip/irq-gic-v5.c
@@ -727,6 +727,15 @@ static int gicv5_irq_spi_domain_alloc(struct irq_domain *domain, unsigned int vi
 
 	irqd = irq_desc_get_irq_data(irq_to_desc(virq));
 	chip_data = gicv5_irs_lookup_by_spi_id(hwirq);
+	/*
+	 * The global SPI range may contain IDs not covered by any IRS, i.e., it
+	 * may have gaps, in which case there is no IRS to back the SPI. Catch
+	 * broken firmware trying to use any of those SPIs.
+	 */
+	if (!chip_data) {
+		pr_warn("Firmware bug! Unimplemented SPI (0x%lx)!\n", hwirq);
+		return -EINVAL;
+	}
 
 	irq_domain_set_info(domain, virq, hwirq, &gicv5_spi_irq_chip, chip_data,
 			    handle_fasteoi_irq, NULL, NULL);

-- 
2.34.1

[PATCH 02/10] irqchip/gic-v5: Only set IRS DPS when 1ofN routing is supported

[Sascha Bischoff]

IRS_PE_CR0.DPS is RES0 when the IRS does not support 1ofN routing.
Read the capability from IRS_IDR0 and skip programming DPS on systems
without support for 1ofN routing, rather than blindly writing it.

Fixes: 5cb1b6dab2def ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-irs.c   | 14 +++++++++-----
 include/linux/irqchip/arm-gic-v5.h |  1 +
 2 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 9d60f474aa4f6..4edf787f3f97f 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -541,12 +541,15 @@ int gicv5_irs_register_cpu(int cpuid)
 		return -ENXIO;
 	}
 
-	cr0 = FIELD_PREP(GICV5_IRS_PE_CR0_DPS, 0x1);
-	irs_writel_relaxed(irs_data, cr0, GICV5_IRS_PE_CR0);
+	/* IRS_PE_CR0.DPS is RES0 when 1ofN routing is unsupported. */
+	if (gicv5_global_data.one_of_n) {
+		cr0 = FIELD_PREP(GICV5_IRS_PE_CR0_DPS, 0x1);
+		irs_writel_relaxed(irs_data, cr0, GICV5_IRS_PE_CR0);
 
-	ret = gicv5_irs_wait_for_pe_cr0(irs_data);
-	if (ret)
-		return ret;
+		ret = gicv5_irs_wait_for_pe_cr0(irs_data);
+		if (ret)
+			return ret;
+	}
 
 	pr_debug("CPU %d enabled PE IAFFID 0x%x\n", cpuid, iaffid);
 
@@ -725,6 +728,7 @@ static int __init gicv5_irs_init(struct gicv5_irs_chip_data *irs_data)
 	if (list_empty(&irs_nodes)) {
 		idr = irs_readl_relaxed(irs_data, GICV5_IRS_IDR0);
 		gicv5_global_data.virt_capable = !!FIELD_GET(GICV5_IRS_IDR0_VIRT, idr);
+		gicv5_global_data.one_of_n = !!FIELD_GET(GICV5_IRS_IDR0_ONE_N, idr);
 
 		idr = irs_readl_relaxed(irs_data, GICV5_IRS_IDR1);
 		irs_setup_pri_bits(idr);
diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
index 299e75bc95255..34e22e7d4a4c7 100644
--- a/include/linux/irqchip/arm-gic-v5.h
+++ b/include/linux/irqchip/arm-gic-v5.h
@@ -532,6 +532,7 @@ struct gicv5_chip_data {
 	u8			cpuif_id_bits;
 	u8			irs_pri_bits;
 	bool			virt_capable;
+	bool			one_of_n;
 	struct {
 		__le64 *l1ist_addr;
 		u32 l2_size;

-- 
2.34.1

[PATCH 03/10] irqchip/gic-v5: Serialise IRS synchronisation requests

[Sascha Bischoff]

IRS_SYNCR writes are ignored while IRS_SYNC_STATUSR.IDLE is clear.
Calls to gicv5_irs_syncr() for different IRQs can overlap, allowing
the second request to be dropped. Its caller can then observe the
first request completing and assume that its own events have been
processed.

Serialise the request and completion poll with a raw spinlock. We use
atomic polling, as the lock cannot be held over a sleeping wait.

Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
Cc: stable@vger.kernel.org
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-irs.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
index 4edf787f3f97f..ead76560ea08f 100644
--- a/drivers/irqchip/irq-gic-v5-irs.c
+++ b/drivers/irqchip/irq-gic-v5-irs.c
@@ -10,6 +10,7 @@
 #include <linux/log2.h>
 #include <linux/of.h>
 #include <linux/of_address.h>
+#include <linux/spinlock.h>
 
 #include <linux/irqchip.h>
 #include <linux/irqchip/arm-gic-v5.h>
@@ -22,6 +23,8 @@
 #define LPI_ID_BITS_LINEAR		12
 
 static DEFINE_PER_CPU_READ_MOSTLY(struct gicv5_irs_chip_data *, per_cpu_irs_data);
+/* Synchronization requests must not overlap in an IRS Domain. */
+static DEFINE_RAW_SPINLOCK(irs_sync_lock);
 static LIST_HEAD(irs_nodes);
 
 static u32 irs_readl_relaxed(struct gicv5_irs_chip_data *irs_data,
@@ -507,10 +510,11 @@ void gicv5_irs_syncr(void)
 		return;
 
 	syncr = FIELD_PREP(GICV5_IRS_SYNCR_SYNC, 1);
+	guard(raw_spinlock_irqsave)(&irs_sync_lock);
 	irs_writel_relaxed(irs_data, syncr, GICV5_IRS_SYNCR);
 
-	gicv5_wait_for_op(irs_data->irs_base, GICV5_IRS_SYNC_STATUSR,
-			  GICV5_IRS_SYNC_STATUSR_IDLE);
+	gicv5_wait_for_op_atomic(irs_data->irs_base, GICV5_IRS_SYNC_STATUSR,
+				 GICV5_IRS_SYNC_STATUSR_IDLE, NULL);
 }
 
 int gicv5_irs_register_cpu(int cpuid)

-- 
2.34.1

[PATCH 04/10] irqchip/gic-v5: Serialise ITS invalidation commands

[Sascha Bischoff]

The ITS uses DIDR and EIDR to select the translation to invalidate.
These registers are shared by all interrupts targeting the ITS. Event
invalidation can run concurrently for different IRQs, and device
invalidation can overlap it. The per-IRQ descriptor lock does not
serialise the commands, so one CPU can accidentally issue an
invalidation using another CPU's DeviceID or EventID.

Add a raw spinlock to each ITS and hold it across the command register
writes and the STATUSR.IDLE poll for both invalidation paths. A raw
spinlock is required because the forwarding path calls the event
invalidation helper with the IRQ descriptor lock held.

Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
Reported-by: Sashiko AI <sashiko-bot@kernel.org>
Link: https://sashiko.dev/#/patchset/20261016155741.979985-1-sascha.bischoff@arm.com?part=11
Cc: stable@vger.kernel.org
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 28e39b065de0e..6d98f3dbe34b6 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -16,6 +16,7 @@
 #include <linux/of_address.h>
 #include <linux/of_irq.h>
 #include <linux/slab.h>
+#include <linux/spinlock.h>
 
 #include <linux/irqchip.h>
 #include <linux/irqchip/arm-gic-v5.h>
@@ -28,6 +29,8 @@
 struct gicv5_its_chip_data {
 	struct	xarray			its_devices;
 	struct	mutex			dev_alloc_lock;
+	/* Event and device invalidation commands share DIDR. */
+	raw_spinlock_t			inv_lock;
 	struct	fwnode_handle		*fwnode;
 	struct gicv5_its_devtab_cfg	devtab_cfgr;
 	void	__iomem			*its_base;
@@ -129,6 +132,8 @@ static int gicv5_its_itt_cache_inv(struct gicv5_its_chip_data *its, u32 device_i
 	eidr = FIELD_PREP(GICV5_ITS_EIDR_EVENTID, event_id);
 	eventr = FIELD_PREP(GICV5_ITS_INV_EVENTR_I, 0x1);
 
+	guard(raw_spinlock_irqsave)(&its->inv_lock);
+
 	its_writeq_relaxed(its, didr, GICV5_ITS_DIDR);
 	its_writel_relaxed(its, eidr, GICV5_ITS_EIDR);
 	its_writel_relaxed(its, eventr, GICV5_ITS_INV_EVENTR);
@@ -371,6 +376,9 @@ static int gicv5_its_device_cache_inv(struct gicv5_its_chip_data *its,
 		  FIELD_PREP(GICV5_ITS_INV_DEVICER_EVENTID_BITS,
 			     its_dev->itt_cfg.event_id_bits)	|
 		  FIELD_PREP(GICV5_ITS_INV_DEVICER_L1, 0x0);
+
+	guard(raw_spinlock_irqsave)(&its->inv_lock);
+
 	its_writeq_relaxed(its, didr, GICV5_ITS_DIDR);
 	its_writel_relaxed(its, devicer, GICV5_ITS_INV_DEVICER);
 
@@ -1112,6 +1120,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
 		return -ENOMEM;
 
 	mutex_init(&its_node->dev_alloc_lock);
+	raw_spin_lock_init(&its_node->inv_lock);
 	xa_init(&its_node->its_devices);
 	its_node->fwnode = handle;
 	its_node->its_base = its_base;

-- 
2.34.1

[PATCH 05/10] irqchip/gic-v5: Use linear DT and ITT when L2 covers all IDs

[Sascha Bischoff]

The DT and ITT level selector incorrectly chooses a two-level table
when the selected L2 table has exactly enough entries to cover the
full ID space. There are no L1 index bits in this case. ITT allocation
correctly rejects the layout and device registration fails; the DT
path instead allocates an unnecessary one-entry L1 table.

Select a linear DT or ITT when the L2 width equals the ID width.

Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
Cc: stable@vger.kernel.org
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 6d98f3dbe34b6..866c238f08dfe 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -337,7 +337,7 @@ static bool gicv5_its_l2sz_two_level(bool devtab, u32 its_idr1, u8 id_bits, u8 *
 
 	l2_bits = gicv5_its_l2sz_to_l2_bits(l2_sz);
 
-	if (l2_bits > id_bits)
+	if (l2_bits >= id_bits)
 		return false;
 
 	*sz = l2_sz;

-- 
2.34.1

[PATCH 06/10] irqchip/gic-v5: Honour ACPI ITS noncoherent flag

[Sascha Bischoff]

The ACPI ITS probe passes its noncoherent flag to
gicv5_its_init_bases(), but the common initializer checks a DT
property instead. For an ACPI ITS, this always selects coherent cache
settings and skips the cache maintenance required for its tables.

Use the noncoherent argument, which both firmware paths already
supply.

Fixes: a97efa5ba5946 ("irqchip/gic-v5: Add ACPI ITS probing")
Cc: stable@vger.kernel.org
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 866c238f08dfe..c5d057f713134 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1135,7 +1135,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
 			goto out_free_node;
 	}
 
-	if (of_property_read_bool(np, "dma-noncoherent")) {
+	if (noncoherent) {
 		/*
 		 * A non-coherent ITS implies that some cache levels cannot be
 		 * used coherently by the cores and GIC. Our only option is to mark

-- 
2.34.1

[PATCH 07/10] irqchip/gic-v5: Use firmware node name in ITS warning

[Sascha Bischoff]

The common ITS initialiser can be called with an ACPI firmware node.
If firmware leaves the ITS enabled, the warning dereferences the DT
node pointer, which is NULL on that path.

Use the firmware node name for the warning and drop the DT-only pointer.

Fixes: a97efa5ba5946 ("irqchip/gic-v5: Add ACPI ITS probing")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index c5d057f713134..8628de326f28d 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1109,7 +1109,6 @@ static int gicv5_its_init_domain(struct gicv5_its_chip_data *its, struct irq_dom
 static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_handle *handle,
 				       struct irq_domain *parent_domain, bool noncoherent)
 {
-	struct device_node *np = to_of_node(handle);
 	struct gicv5_its_chip_data *its_node;
 	u32 cr0, cr1;
 	bool enabled;
@@ -1129,7 +1128,8 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
 
 	cr0 = its_readl_relaxed(its_node, GICV5_ITS_CR0);
 	enabled = FIELD_GET(GICV5_ITS_CR0_ITSEN, cr0);
-	if (WARN(enabled, "ITS %s enabled, disabling it before proceeding\n", np->full_name)) {
+	if (WARN(enabled, "ITS %s enabled, disabling it before proceeding\n",
+		 fwnode_get_name(handle))) {
 		ret = gicv5_its_disable(its_node);
 		if (ret)
 			goto out_free_node;

-- 
2.34.1

[PATCH 08/10] irqchip/gic-v5: Invalidate ITS device cache before freeing ITT

[Sascha Bischoff]

A cached device table entry can still reference the ITT after its
memory is freed via kfree(), even if the DTE has been marked as
invalid. Once the memory has been released, it could be reallocated,
and it would be unfortunate for the hardware to interpret this as a
valid ITT.

Invalidate the device cache and wait for completion before freeing the
ITT during device teardown.

Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 8628de326f28d..4de07bbdc4923 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -556,6 +556,7 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
 				       struct gicv5_its_dev *its_dev)
 {
 	__le64 *dte;
+	int ret;
 
 	dte = gicv5_its_devtab_get_dte_ref(its, its_dev->device_id, false);
 
@@ -568,9 +569,10 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
 	/* Zero everything - make it clear that this is an invalid entry */
 	its_write_table_entry(its, dte, 0);
 
+	ret = gicv5_its_device_cache_inv(its, its_dev);
 	gicv5_its_free_itt(its_dev);
 
-	return gicv5_its_device_cache_inv(its, its_dev);
+	return ret;
 }
 
 /*

-- 
2.34.1

[PATCH 09/10] irqchip/gic-v5: Clean the allocated linear device table size

[Sascha Bischoff]

When the linear device table exceeds the kmalloc limit, the driver
caps the DeviceID width before allocation but keeps the original size
for cache maintenance. On a noncoherent ITS, this cleans beyond the
allocated table.

Recalculate the size after capping the DeviceID width.

Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index 4de07bbdc4923..c0f3982229194 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -601,6 +601,7 @@ static int gicv5_its_alloc_devtab_linear(struct gicv5_its_chip_data *its,
 		pr_warn("Limiting device ID bits from %u to %u\n",
 			device_id_bits, device_id_cap);
 		device_id_bits = device_id_cap;
+		sz = BIT_ULL(device_id_bits) * sizeof(*devtab);
 	}
 
 	devtab = kcalloc(BIT(device_id_bits), sizeof(*devtab), GFP_KERNEL);

-- 
2.34.1

[PATCH 10/10] irqchip/gic-v5: Release ITS MMIO region on DT probe failure

[Sascha Bischoff]

of_io_request_and_map() reserves the ITS configuration frame region.
If ITS initialisation fails after mapping it, the error path only
unmaps the registers and leaves the region reserved.

Keep the resource description and release the region on that path.

Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
---
 drivers/irqchip/irq-gic-v5-its.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
index c0f3982229194..91abe63cb5cf9 100644
--- a/drivers/irqchip/irq-gic-v5-its.c
+++ b/drivers/irqchip/irq-gic-v5-its.c
@@ -1188,6 +1188,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
 
 static int __init gicv5_its_init(struct device_node *node)
 {
+	struct resource res;
 	void __iomem *its_base;
 	int ret, idx;
 
@@ -1197,6 +1198,11 @@ static int __init gicv5_its_init(struct device_node *node)
 		return -ENODEV;
 	}
 
+	/* Save the region to release if ITS setup fails after mapping it. */
+	ret = of_address_to_resource(node, idx, &res);
+	if (ret)
+		return ret;
+
 	its_base = of_io_request_and_map(node, idx, of_node_full_name(node));
 	if (IS_ERR(its_base)) {
 		pr_err("%pOF: unable to map GICv5 ITS_CONFIG_FRAME\n", node);
@@ -1213,6 +1219,7 @@ static int __init gicv5_its_init(struct device_node *node)
 
 out_unmap:
 	iounmap(its_base);
+	release_mem_region(res.start, resource_size(&res));
 	return ret;
 }
 

-- 
2.34.1

Re: [PATCH 01/10] irqchip/gic-v5: Reject SPIs not backed by an IRS

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:32:54PM +0000, Sascha Bischoff wrote:
> It is possible to build a multi-IRS GICv5 system where there are gaps
> in the global SPI range that are not backed by any IRS. In the current
> incarnation, this results in dereferencing a null pointer.
> 
> Reject cases where the firmware attempts to use those SPIs during IRQ
> allocation by catching the case where there is no chip_data associated
> with the irq (meaning that there is no IRS to back it). Spit out a
> warning about broken firmware when this is encountered as it shouldn't
> be using non-existent SPIs in the first place.
> 
> Fixes: 5cb1b6dab2def ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

> diff --git a/drivers/irqchip/irq-gic-v5.c b/drivers/irqchip/irq-gic-v5.c
> index 8c0303af71e7d..f3cce2bd28cc3 100644
> --- a/drivers/irqchip/irq-gic-v5.c
> +++ b/drivers/irqchip/irq-gic-v5.c
> @@ -727,6 +727,15 @@ static int gicv5_irq_spi_domain_alloc(struct irq_domain *domain, unsigned int vi
>  
>  	irqd = irq_desc_get_irq_data(irq_to_desc(virq));
>  	chip_data = gicv5_irs_lookup_by_spi_id(hwirq);
> +	/*
> +	 * The global SPI range may contain IDs not covered by any IRS, i.e., it
> +	 * may have gaps, in which case there is no IRS to back the SPI. Catch
> +	 * broken firmware trying to use any of those SPIs.
> +	 */
> +	if (!chip_data) {
> +		pr_warn("Firmware bug! Unimplemented SPI (0x%lx)!\n", hwirq);
> +		return -EINVAL;
> +	}
>  
>  	irq_domain_set_info(domain, virq, hwirq, &gicv5_spi_irq_chip, chip_data,
>  			    handle_fasteoi_irq, NULL, NULL);
> 
> -- 
> 2.34.1
> 

Re: [PATCH 02/10] irqchip/gic-v5: Only set IRS DPS when 1ofN routing is supported

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:32:55PM +0000, Sascha Bischoff wrote:
> IRS_PE_CR0.DPS is RES0 when the IRS does not support 1ofN routing.
> Read the capability from IRS_IDR0 and skip programming DPS on systems
> without support for 1ofN routing, rather than blindly writing it.
> 
> Fixes: 5cb1b6dab2def ("irqchip/gic-v5: Add GICv5 IRS/SPI support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-irs.c   | 14 +++++++++-----
>  include/linux/irqchip/arm-gic-v5.h |  1 +
>  2 files changed, 10 insertions(+), 5 deletions(-)

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

> diff --git a/drivers/irqchip/irq-gic-v5-irs.c b/drivers/irqchip/irq-gic-v5-irs.c
> index 9d60f474aa4f6..4edf787f3f97f 100644
> --- a/drivers/irqchip/irq-gic-v5-irs.c
> +++ b/drivers/irqchip/irq-gic-v5-irs.c
> @@ -541,12 +541,15 @@ int gicv5_irs_register_cpu(int cpuid)
>  		return -ENXIO;
>  	}
>  
> -	cr0 = FIELD_PREP(GICV5_IRS_PE_CR0_DPS, 0x1);
> -	irs_writel_relaxed(irs_data, cr0, GICV5_IRS_PE_CR0);
> +	/* IRS_PE_CR0.DPS is RES0 when 1ofN routing is unsupported. */
> +	if (gicv5_global_data.one_of_n) {
> +		cr0 = FIELD_PREP(GICV5_IRS_PE_CR0_DPS, 0x1);
> +		irs_writel_relaxed(irs_data, cr0, GICV5_IRS_PE_CR0);
>  
> -	ret = gicv5_irs_wait_for_pe_cr0(irs_data);
> -	if (ret)
> -		return ret;
> +		ret = gicv5_irs_wait_for_pe_cr0(irs_data);
> +		if (ret)
> +			return ret;
> +	}
>  
>  	pr_debug("CPU %d enabled PE IAFFID 0x%x\n", cpuid, iaffid);
>  
> @@ -725,6 +728,7 @@ static int __init gicv5_irs_init(struct gicv5_irs_chip_data *irs_data)
>  	if (list_empty(&irs_nodes)) {
>  		idr = irs_readl_relaxed(irs_data, GICV5_IRS_IDR0);
>  		gicv5_global_data.virt_capable = !!FIELD_GET(GICV5_IRS_IDR0_VIRT, idr);
> +		gicv5_global_data.one_of_n = !!FIELD_GET(GICV5_IRS_IDR0_ONE_N, idr);
>  
>  		idr = irs_readl_relaxed(irs_data, GICV5_IRS_IDR1);
>  		irs_setup_pri_bits(idr);
> diff --git a/include/linux/irqchip/arm-gic-v5.h b/include/linux/irqchip/arm-gic-v5.h
> index 299e75bc95255..34e22e7d4a4c7 100644
> --- a/include/linux/irqchip/arm-gic-v5.h
> +++ b/include/linux/irqchip/arm-gic-v5.h
> @@ -532,6 +532,7 @@ struct gicv5_chip_data {
>  	u8			cpuif_id_bits;
>  	u8			irs_pri_bits;
>  	bool			virt_capable;
> +	bool			one_of_n;
>  	struct {
>  		__le64 *l1ist_addr;
>  		u32 l2_size;
> 
> -- 
> 2.34.1
> 

Re: [PATCH 06/10] irqchip/gic-v5: Honour ACPI ITS noncoherent flag

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:32:59PM +0000, Sascha Bischoff wrote:
> The ACPI ITS probe passes its noncoherent flag to
> gicv5_its_init_bases(), but the common initializer checks a DT
> property instead. For an ACPI ITS, this always selects coherent cache
> settings and skips the cache maintenance required for its tables.
> 
> Use the noncoherent argument, which both firmware paths already
> supply.
> 
> Fixes: a97efa5ba5946 ("irqchip/gic-v5: Add ACPI ITS probing")
> Cc: stable@vger.kernel.org
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 866c238f08dfe..c5d057f713134 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -1135,7 +1135,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
>  			goto out_free_node;
>  	}
>  
> -	if (of_property_read_bool(np, "dma-noncoherent")) {
> +	if (noncoherent) {

Bah. This is a very stupid thinko. Apologies.

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

>  		/*
>  		 * A non-coherent ITS implies that some cache levels cannot be
>  		 * used coherently by the cores and GIC. Our only option is to mark
> 
> -- 
> 2.34.1
> 

Re: [PATCH 07/10] irqchip/gic-v5: Use firmware node name in ITS warning

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:33:00PM +0000, Sascha Bischoff wrote:
> The common ITS initialiser can be called with an ACPI firmware node.
> If firmware leaves the ITS enabled, the warning dereferences the DT
> node pointer, which is NULL on that path.
> 
> Use the firmware node name for the warning and drop the DT-only pointer.
> 
> Fixes: a97efa5ba5946 ("irqchip/gic-v5: Add ACPI ITS probing")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index c5d057f713134..8628de326f28d 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -1109,7 +1109,6 @@ static int gicv5_its_init_domain(struct gicv5_its_chip_data *its, struct irq_dom
>  static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_handle *handle,
>  				       struct irq_domain *parent_domain, bool noncoherent)
>  {
> -	struct device_node *np = to_of_node(handle);
>  	struct gicv5_its_chip_data *its_node;
>  	u32 cr0, cr1;
>  	bool enabled;
> @@ -1129,7 +1128,8 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
>  
>  	cr0 = its_readl_relaxed(its_node, GICV5_ITS_CR0);
>  	enabled = FIELD_GET(GICV5_ITS_CR0_ITSEN, cr0);
> -	if (WARN(enabled, "ITS %s enabled, disabling it before proceeding\n", np->full_name)) {
> +	if (WARN(enabled, "ITS %s enabled, disabling it before proceeding\n",
> +		 fwnode_get_name(handle))) {
>  		ret = gicv5_its_disable(its_node);
>  		if (ret)
>  			goto out_free_node;
> 
> -- 
> 2.34.1
> 

Re: [PATCH 09/10] irqchip/gic-v5: Clean the allocated linear device table size

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:33:02PM +0000, Sascha Bischoff wrote:
> When the linear device table exceeds the kmalloc limit, the driver
> caps the DeviceID width before allocation but keeps the original size
> for cache maintenance. On a noncoherent ITS, this cleans beyond the
> allocated table.
> 
> Recalculate the size after capping the DeviceID width.
> 
> Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 4de07bbdc4923..c0f3982229194 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -601,6 +601,7 @@ static int gicv5_its_alloc_devtab_linear(struct gicv5_its_chip_data *its,
>  		pr_warn("Limiting device ID bits from %u to %u\n",
>  			device_id_bits, device_id_cap);
>  		device_id_bits = device_id_cap;
> +		sz = BIT_ULL(device_id_bits) * sizeof(*devtab);
>  	}
>  

Or sz = KMALLOC_MAX_SIZE;

that's what we are doing after all.

I wonder whether moving:

sz = BIT_ULL(device_id_bits) * sizeof(*devtab);

after the capping out of the if and do:

if (BIT_ULL(device_id_bits) * sizeof(*devtab) > KMALLOC_MAX_SIZE)

to check whether mem alloc should be capped makes this any easier
to read.

Regardless, this patch is a fix and it is right to make it as small
as possible:

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

>  	devtab = kcalloc(BIT(device_id_bits), sizeof(*devtab), GFP_KERNEL);
> 
> -- 
> 2.34.1
> 

Re: [PATCH 10/10] irqchip/gic-v5: Release ITS MMIO region on DT probe failure

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:33:03PM +0000, Sascha Bischoff wrote:
> of_io_request_and_map() reserves the ITS configuration frame region.
> If ITS initialisation fails after mapping it, the error path only
> unmaps the registers and leaves the region reserved.
> 
> Keep the resource description and release the region on that path.
> 
> Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 7 +++++++
>  1 file changed, 7 insertions(+)

A minor note on coding style below, other than that:

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index c0f3982229194..91abe63cb5cf9 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -1188,6 +1188,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
>  
>  static int __init gicv5_its_init(struct device_node *node)
>  {
> +	struct resource res;

FIR tree ordering.

https://docs.kernel.org/process/maintainer-tip.html

>  	void __iomem *its_base;
>  	int ret, idx;
>  
> @@ -1197,6 +1198,11 @@ static int __init gicv5_its_init(struct device_node *node)
>  		return -ENODEV;
>  	}
>  
> +	/* Save the region to release if ITS setup fails after mapping it. */
> +	ret = of_address_to_resource(node, idx, &res);
> +	if (ret)
> +		return ret;
> +
>  	its_base = of_io_request_and_map(node, idx, of_node_full_name(node));
>  	if (IS_ERR(its_base)) {
>  		pr_err("%pOF: unable to map GICv5 ITS_CONFIG_FRAME\n", node);
> @@ -1213,6 +1219,7 @@ static int __init gicv5_its_init(struct device_node *node)
>  
>  out_unmap:
>  	iounmap(its_base);
> +	release_mem_region(res.start, resource_size(&res));
>  	return ret;
>  }
>  
> 
> -- 
> 2.34.1
> 

Re: [PATCH 08/10] irqchip/gic-v5: Invalidate ITS device cache before freeing ITT

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:33:01PM +0000, Sascha Bischoff wrote:
> A cached device table entry can still reference the ITT after its
> memory is freed via kfree(), even if the DTE has been marked as
> invalid. Once the memory has been released, it could be reallocated,
> and it would be unfortunate for the hardware to interpret this as a
> valid ITT.
> 
> Invalidate the device cache and wait for completion before freeing the
> ITT during device teardown.
> 
> Fixes: 57d72196dfc85 ("irqchip/gic-v5: Add GICv5 ITS support")
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 8628de326f28d..4de07bbdc4923 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -556,6 +556,7 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
>  				       struct gicv5_its_dev *its_dev)
>  {
>  	__le64 *dte;
> +	int ret;
>  
>  	dte = gicv5_its_devtab_get_dte_ref(its, its_dev->device_id, false);
>  
> @@ -568,9 +569,10 @@ static int gicv5_its_device_unregister(struct gicv5_its_chip_data *its,
>  	/* Zero everything - make it clear that this is an invalid entry */
>  	its_write_table_entry(its, dte, 0);
>  
> +	ret = gicv5_its_device_cache_inv(its, its_dev);
>  	gicv5_its_free_itt(its_dev);
>  
> -	return gicv5_its_device_cache_inv(its, its_dev);
> +	return ret;

Patch is right, though we don't check ret (gicv5_its_device_unregister()) so
rather that pretending to return anything useful I'd just drop it
(gicv5_wait_for_op_s() spits an error already on timeout, not sure more than
that there is anything we can do at this stage).

Again, this is a fix so I can clean this up later:

Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org>

>  }
>  
>  /*
> 
> -- 
> 2.34.1
> 

Re: [PATCH 04/10] irqchip/gic-v5: Serialise ITS invalidation commands

[Lorenzo Pieralisi]

On Mon, Nov 02, 2026 at 01:32:57PM +0000, Sascha Bischoff wrote:
> The ITS uses DIDR and EIDR to select the translation to invalidate.
> These registers are shared by all interrupts targeting the ITS. Event
> invalidation can run concurrently for different IRQs, and device
> invalidation can overlap it. The per-IRQ descriptor lock does not
> serialise the commands, so one CPU can accidentally issue an
> invalidation using another CPU's DeviceID or EventID.

"Another CPU's DeviceID or EventID " can probably be explained better
(or just removed because it is unclear) I understand there is a link to
Sashiko's report but it is worth updating the log IMO.

"using the DeviceID or EventID associated with an IRQ that is invalidated
on another CPU" or something like that.

> Add a raw spinlock to each ITS and hold it across the command register
> writes and the STATUSR.IDLE poll for both invalidation paths. A raw
> spinlock is required because the forwarding path calls the event

Can you please define "the forwarding path" more explicitly ?  See above.

Thanks,
Lorenzo

> invalidation helper with the IRQ descriptor lock held.
> 
> Fixes: 57d72196dfc8 ("irqchip/gic-v5: Add GICv5 ITS support")
> Reported-by: Sashiko AI <sashiko-bot@kernel.org>
> Link: https://sashiko.dev/#/patchset/20261016155741.979985-1-sascha.bischoff@arm.com?part=11
> Cc: stable@vger.kernel.org
> Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
> ---
>  drivers/irqchip/irq-gic-v5-its.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/irqchip/irq-gic-v5-its.c b/drivers/irqchip/irq-gic-v5-its.c
> index 28e39b065de0e..6d98f3dbe34b6 100644
> --- a/drivers/irqchip/irq-gic-v5-its.c
> +++ b/drivers/irqchip/irq-gic-v5-its.c
> @@ -16,6 +16,7 @@
>  #include <linux/of_address.h>
>  #include <linux/of_irq.h>
>  #include <linux/slab.h>
> +#include <linux/spinlock.h>
>  
>  #include <linux/irqchip.h>
>  #include <linux/irqchip/arm-gic-v5.h>
> @@ -28,6 +29,8 @@
>  struct gicv5_its_chip_data {
>  	struct	xarray			its_devices;
>  	struct	mutex			dev_alloc_lock;
> +	/* Event and device invalidation commands share DIDR. */
> +	raw_spinlock_t			inv_lock;
>  	struct	fwnode_handle		*fwnode;
>  	struct gicv5_its_devtab_cfg	devtab_cfgr;
>  	void	__iomem			*its_base;
> @@ -129,6 +132,8 @@ static int gicv5_its_itt_cache_inv(struct gicv5_its_chip_data *its, u32 device_i
>  	eidr = FIELD_PREP(GICV5_ITS_EIDR_EVENTID, event_id);
>  	eventr = FIELD_PREP(GICV5_ITS_INV_EVENTR_I, 0x1);
>  
> +	guard(raw_spinlock_irqsave)(&its->inv_lock);
> +
>  	its_writeq_relaxed(its, didr, GICV5_ITS_DIDR);
>  	its_writel_relaxed(its, eidr, GICV5_ITS_EIDR);
>  	its_writel_relaxed(its, eventr, GICV5_ITS_INV_EVENTR);
> @@ -371,6 +376,9 @@ static int gicv5_its_device_cache_inv(struct gicv5_its_chip_data *its,
>  		  FIELD_PREP(GICV5_ITS_INV_DEVICER_EVENTID_BITS,
>  			     its_dev->itt_cfg.event_id_bits)	|
>  		  FIELD_PREP(GICV5_ITS_INV_DEVICER_L1, 0x0);
> +
> +	guard(raw_spinlock_irqsave)(&its->inv_lock);
> +
>  	its_writeq_relaxed(its, didr, GICV5_ITS_DIDR);
>  	its_writel_relaxed(its, devicer, GICV5_ITS_INV_DEVICER);
>  
> @@ -1112,6 +1120,7 @@ static int __init gicv5_its_init_bases(void __iomem *its_base, struct fwnode_han
>  		return -ENOMEM;
>  
>  	mutex_init(&its_node->dev_alloc_lock);
> +	raw_spin_lock_init(&its_node->inv_lock);
>  	xa_init(&its_node->its_devices);
>  	its_node->fwnode = handle;
>  	its_node->its_base = its_base;
> 
> -- 
> 2.34.1
>