kernel/git/next/linux-next.git/arch/x86/include/uapi, branch master

perf/x86: Support SSP sampling using sample_regs_* fields

2026-09-02T11:10:46+00:00

Support sampling of CET SSP register via the sample_regs_* fields. To sample SSP, the sample_simd_regs_enabled field must be set. This allows the spare space (reclaimed from the original XMM space) in the sample_regs_* fields to be used for representing SSP. Similar to eGPRs sampling, the perf_reg_value() function needs to check if the PERF_SAMPLE_REGS_ABI_SIMD flag is set first, and then determine whether to output SSP or legacy XMM registers to userspace. Additionally, arch-PEBS supports sampling SSP, which is placed into the GPRs group. Also enables arch-PEBS-based SSP sampling. Currently, SSP sampling is only supported on the x86_64 architecture, as CET is only available on x86_64 platforms. SSP sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-20-dapeng1.mi@linux.intel.com

perf/x86: Support eGPRs sampling using sample_regs_* fields

2026-09-02T11:10:45+00:00

Support sampling of APX eGPRs (R16 ~ R31) via the sample_regs_* fields. To sample eGPRs, the sample_simd_regs_enabled field must be set. This allows the spare space (reclaimed from the original XMM space) in the sample_regs_* fields to be used for representing eGPRs. The perf_reg_value() function needs to check if the PERF_SAMPLE_REGS_ABI_SIMD flag is set first, and then determine whether to output eGPRs or legacy XMM registers to userspace. The perf_reg_validate() function first checks the simd_enabled argument to determine if the eGPRs bitmap is represented in sample_regs_* fields. It then validates the eGPRs bitmap accordingly. Currently, eGPRs sampling is only supported on the x86_64 architecture, as APX is only available on x86_64 platforms. APX eGPRs sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Suggested-by: Peter Zijlstra (Intel) Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-19-dapeng1.mi@linux.intel.com

perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields

2026-09-02T11:10:45+00:00

Support sampling of OPMASK registers via the sample_simd_pred_reg_* fields. Each OPMASK register consists of 1 u64 word. Current x86 hardware supports 8 OPMASK registers. The perf_simd_reg_value() function is responsible for outputting OPMASK value to userspace. Additionally, sample_simd_pred_reg_qwords should be set to 1 to indicate OPMASK sampling. OPMASK sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-17-dapeng1.mi@linux.intel.com

perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields

2026-09-02T11:10:44+00:00

Support sampling of ZMM registers via the sample_simd_vec_reg_* fields. Each ZMM register consists of 8 u64 words. Current x86 hardware supports up to 32 ZMM registers. For ZMM registers from ZMM0 to ZMM15, they are assembled from three parts: XMM (the lower 2 u64 words), YMMH (the middle 2 u64 words), and ZMMH (the upper 4 u64 words). The perf_simd_reg_value() function is responsible for assembling these three parts into a complete ZMM register for output to userspace. For ZMM registers ZMM16 to ZMM31, each register can be read as a whole and directly outputted to userspace. Additionally, sample_simd_vec_reg_qwords should be set to 8 to indicate ZMM sampling. ZMM sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-16-dapeng1.mi@linux.intel.com

perf/x86: Support YMM sampling using sample_simd_vec_reg_* fields

2026-09-02T11:10:44+00:00

Support sampling of YMM registers via the sample_simd_vec_reg_* fields. Each YMM register consists of 4 u64 words, assembled from two halves: XMM (the lower 2 u64 words) and YMMH (the upper 2 u64 words). Although both XMM and YMMH data can be retrieved with a single xsaves instruction, they are stored in separate locations. The perf_simd_reg_value() function is responsible for assembling these halves into a complete YMM register for output to userspace. Additionally, sample_simd_vec_reg_qwords should be set to 4 to indicate YMM sampling. YMM sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-15-dapeng1.mi@linux.intel.com

perf/x86: Support XMM sampling using sample_simd_vec_reg_* fields

2026-09-02T11:10:44+00:00

Support sampling of XMM registers using the sample_simd_vec_reg_* fields. When sample_simd_regs_enabled is set, the original XMM space in the sample_regs_* field is treated as reserved. An INVAL error will be reported to user space if any bit is set in the original XMM space while sample_simd_regs_enabled is set. The perf_reg_value function requires ABI information to understand the layout of sample_regs. To accommodate this, a new abi field is introduced in the struct x86_perf_regs to represent ABI information. Additionally, the x86 specific perf_simd_reg_value() function is implemented to retrieve the XMM register values. XMM sampling will be enabled in a subsequent patch that sets PERF_PMU_CAP_SIMD_REGS. Co-developed-by: Kan Liang Signed-off-by: Kan Liang Signed-off-by: Dapeng Mi Signed-off-by: Peter Zijlstra (Intel) Link: https://patch.msgid.link/20260824082731.1013973-14-dapeng1.mi@linux.intel.com

platform/x86/amd/hsmp: Add IOCTL_GET_TELEMETRY_DATA for metric table reads

2026-07-28T18:09:17+00:00

The metric table needs to be delivered to userspace as a single atomic snapshot, but the current sysfs metrics_bin path is a file read: userspace can read it in chunks and observe a torn snapshot if an SMU refresh happens between read() calls. The same path is also bounded by PAGE_SIZE, so the ~13 KB table used by HSMP protocol version 7 on Family 1Ah Model 50h-5Fh cannot be returned at all, regardless of how userspace reads it. Rather than extend sysfs to lift both restrictions, expose the metric table through the existing HSMP character device using a new ioctl that always copies the table in one shot. Add struct hsmp_telemetry_data and HSMP_IOCTL_GET_TELEMETRY_DATA to the UAPI header. Under the surrounding #pragma pack(4), placing the __u64 user pointer first gives a tight 16-byte layout that is identical for 32- and 64-bit callers, and the trailing __u16 reserved field is rejected with -EINVAL if non-zero so future kernels can repurpose it without breaking already-deployed userspace. The command is encoded with _IOW because the kernel only reads the request struct; the snapshot travels through the user pointer it carries. The requested size may be anything from one byte up to the size firmware reported for that socket's table. A short request returns the leading bytes of the snapshot, so userspace built against an older table layout keeps working on firmware that grew the table, mirroring the relaxed response_sz rule applied to HSMP messages earlier in this series. A request larger than the firmware table is rejected with -EINVAL rather than short-written, so a caller can never mistake a partial copy for a full one. Dispatch hsmp_ioctl() on the ioctl command: the existing message handler is factored out as hsmp_ioctl_msg() for HSMP_IOCTL_CMD, and HSMP_IOCTL_GET_TELEMETRY_DATA goes to a new hsmp_ioctl_get_telemetry() helper. /dev/hsmp is a singleton character device that outlives an individual socket unbind, so an ioctl issued on an already-open fd can run concurrently with socket teardown. hsmp_sock_rwsem is the driver's contract for that: the data plane takes it for read, and probe and remove take it for write to drain the data plane before freeing the socket array, unmapping the metric tables and destroying the per-socket mutexes. hsmp_ioctl_get_telemetry() takes it for read across the socket lookup, the checks on that socket's metric-table state and the table read itself, so none of that state can be torn down underneath it. Without this the handler would sleep in its kvmalloc() holding no lock at all, and could resume with a freed socket, locking a destroyed mutex and reading from an unmapped iomem region. The lock is dropped before the copy_to_user(), because faulting in the destination can block indefinitely on a userfaultfd-backed buffer and would otherwise leave a socket unbind waiting for the write lock. Since hsmp_metric_tbl_read() reached the mailbox through hsmp_send_message(), which takes hsmp_sock_rwsem itself, calling it with the lock already held would recursively take the read side and can deadlock against a queued writer. Split out hsmp_metric_tbl_read_locked(), which asserts the lock and uses hsmp_send_message_locked(), and leave hsmp_metric_tbl_read() as a wrapper that takes the read lock for the sysfs callers. This also brings the whole fill-and-copy under the rwsem for those callers, where the memcpy_fromio() previously ran outside it, and makes the lock order uniformly hsmp_sock_rwsem -> metric_read_lock -> hsmp_sem. The user-controlled socket index in HSMP_IOCTL_GET_TELEMETRY_DATA is clamped with array_index_nospec() before indexing hsmp_pdev.sock[], mitigating Spectre v1 (CVE-2017-5753). Include linux/nospec.h, which the file relied on getting transitively. Co-developed-by: Muthusamy Ramalingam Signed-off-by: Muthusamy Ramalingam Signed-off-by: Muralidhara M K Link: https://patch.msgid.link/20260727141542.3370108-5-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen

platform/x86/amd/hsmp: Source metric-table size from firmware

2026-07-28T18:09:16+00:00

The driver hard-codes the metric-table region size to sizeof(struct hsmp_metric_table). That is correct for HSMP protocol version 6 but mis-sizes the ioremap of the SMU DRAM region on newer platforms: Family 1Ah Model 50h-5Fh exposes a ~13 KB table under protocol version 7, and the table is expected to keep growing on future firmware. The same hard-coded value also forces hsmp_metric_tbl_read() to reject any read that follows the actual firmware layout. Pick up the table size from firmware instead. SMU on Family 1Ah Model 50h and later populates HSMP_GET_METRIC_TABLE_DRAM_ADDR's args[2] with the DRAM region size in bytes; older firmware leaves it 0. Bump the descriptor's response_sz to 3 so the field is read, and store the result in the new per-socket hsmp_socket.metric_tbl_size, which is then used both for the ioremap() of the region and as the expected size in hsmp_metric_tbl_read(). The size is stored per socket rather than per platform because hsmp_get_tbl_dram_base() runs once per socket and each socket maps its own region. A single platform-wide field would let the last socket's size be used to copy out of an earlier socket's smaller mapping. Bump DRIVER_VERSION to 2.6. Behaviour on existing protocol-version-6 hardware is unchanged. Reading a third response word is safe there: for this command SMU leaves args[2] as 0 rather than a stale value from an earlier mailbox transaction, so the fallback always applies, yielding the same value as the previous hard-coded one, and both the ioremap and the size check produce the same result as before. Co-developed-by: Muthusamy Ramalingam Signed-off-by: Muthusamy Ramalingam Signed-off-by: Muralidhara M K Link: https://patch.msgid.link/20260727141542.3370108-4-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen

platform/x86/amd/hsmp: Add HSMP messages for Family 1Ah, Model 50h-5Fh

2026-07-28T18:09:09+00:00

Family 1Ah Model 50h-5Fh firmware exposes new HSMP messages (0x29-0x2A, 0x33-0x3A) for PC6/CC6 control, CCD power/thermal monitoring, DIMM sideband access, floor- and SDPS-limit control, and command-enable discovery. The same firmware extends three existing SET-only messages (HSMP_SET_XGMI_LINK_WIDTH 0x0C, HSMP_SET_DF_PSTATE 0x0D, HSMP_SET_PSTATE_MAX_MIN 0x22) with a read-back path selected by bit[31] of args[0] (0 = set, 1 = get). Add the new IDs and convert the three messages to HSMP_SET_GET. Also add PQoS-related HSMP messages HSMP_PQOS_TRAFFIC_PRIORITY (0x3B) and HSMP_PQOS_FLOATING_BW (0x3C) with matching hsmp_msg_desc_table[] descriptors so userspace can reach the new functionality. Backward compatibility is preserved on prior platforms: new IDs previously occupied HSMP_RSVD slots, and existing userspace that leaves bit[31] = 0 continues to take a pure SET path. Converting the three SET messages to HSMP_SET_GET also keeps them accepted by validate_message(), which already applies a relaxed upper-bound check on response_sz for that type. Co-developed-by: Muthusamy Ramalingam Signed-off-by: Muthusamy Ramalingam Signed-off-by: Muralidhara M K Link: https://patch.msgid.link/20260727141542.3370108-2-muralidhara.mk@amd.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen

KVM: x86: nSVM: Save/restore gPAT with KVM_{GET,SET}_NESTED_STATE

2026-05-14T12:45:13+00:00

Add a 'gpat' field to kvm_svm_nested_state_hdr to carry L2's guest PAT value across save and restore. When KVM_X86_QUIRK_NESTED_SVM_SHARED_PAT is disabled and the vCPU is in guest mode with nested NPT enabled, save vmcb02's g_pat into the header on KVM_GET_NESTED_STATE, and restore it on KVM_SET_NESTED_STATE. Host-initiated accesses to IA32_PAT (via KVM_GET/SET_MSRS) always target L1's hPAT, so they cannot be used to save or restore gPAT. The separate header field ensures that KVM_GET/SET_MSRS and KVM_GET/SET_NESTED_STATE are independent and can be ordered arbitrarily during save and restore. Note that struct kvm_svm_nested_state_hdr is included in a union padded to 120 bytes, so there is room to add the gpat field without changing any offsets. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") Signed-off-by: Jim Mattson Link: https://patch.msgid.link/20260407190343.325299-9-jmattson@google.com Signed-off-by: Sean Christopherson