summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-07-15x86/mm/pat: Take cpa_lock around large-page collapseDenis V. Lunev
Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes: BUG: KASAN: use-after-free in __change_page_attr+0x7cc/0x7e0 Write of size 8 at addr ffff888181139718 by task modprobe ... The buggy address belongs to the physical page: pfn:0x181139 ... page_type: f2(table) cpa_collapse_large_pages() rebuilds a leaf PMD from its 4K PTEs and frees the old PTE-table pages, while __change_page_attr() fetches a PTE pointer from a lockless lookup_address_in_pgd_attr() and writes it with set_pte_atomic() only later. When module text is served from a shared large ROX mapping the two run on the same PMD: CPU A (module load) CPU B (module finalize) ------------------- ----------------------- execmem_make_temp_rw set_memory_nx __change_page_attr split 2M -> 4K table P kpte = &P[i] (lockless) execmem_restore_rox set_memory_rox (CPA_COLLAPSE) cpa_collapse_large_pages rebuild leaf PMD flush_tlb_all pagetable_free(P) set_pte_atomic(kpte, ...) -> writes into freed P P is a page-table page (page_type: table), reused at once, so the write corrupts whatever got the page next: a bad-pte or bad-page splat, or a fatal fault once P has been turned into read-only text. The flush_tlb_all() before the free does not close this: its IPI only serializes against page-table walkers that run with interrupts off (e.g. GUP-fast); the walk in __change_page_attr() runs with interrupts on, so nothing stops it from holding a stale pointer into P. Serialize the collapse - the PMD rebuild, TLB flush and PTE-table free - under cpa_lock, the same lock __change_page_attr() now takes unconditionally since commit ("x86/mm/pat: stop gating cpa_lock on debug_pagealloc_enabled()"), so a concurrent walker can no longer hold a pointer into a table the collapse is about to free. Fixes: 41d88484c71c ("x86/mm/pat: restore large ROX pages after fragmentation") Signed-off-by: Denis V. Lunev <den@openvz.org> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org> Link: https://patch.msgid.link/20260715183453.2381141-1-den@openvz.org
2026-07-15riscv: hwprobe: Avoid uninitialized read in hwprobe_get_cpus()Mark Harris
When cpusetsize < cpumask_size(), hwprobe_get_cpus() did not fully initialize its copy of the cpu mask, which could cause non-deterministic results from the riscv_hwprobe syscall on a system with more than 8 CPUs when the supplied cpu mask is empty. Address this by fully initializing the cpu mask. Fixes: e178bf146e4b ("RISC-V: hwprobe: Introduce which-cpus flag") Signed-off-by: Mark Harris <mark.hsj@gmail.com> Reviewed-by: Nam Cao <namcao@linutronix.de> Reviewed-by: Michael Ellerman <mpe@kernel.org> Link: https://patch.msgid.link/20260714003056.73707-1-mark.hsj@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-15s390/perf_cpum_cf: Add missing array_index_nospec() to __hw_perf_event_init()Sumanth Korikkar
ev variable is userspace controlled via event->attr.config and used as an array index after bounds checking, but without speculation barriers. Add the missing array_index_nospec() call to prevent speculative execution. Cc: stable@vger.kernel.org Fixes: 212188a596d1 ("[S390] perf: add support for s390x CPU counters") Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Thomas Richter <tmricht@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-15s390/checksum: Fix csum_partial() without vector facilityVasily Gorbik
Currently csum_partial() calls csum_copy() with copy=false and dst=NULL. On machines without the vector facility, csum_copy() falls back to cksm(dst, ...), causing the checksum to be calculated from address zero instead of the source buffer. The VX implementation already checksums data loaded from src. Make the fallback do the same by passing src to cksm(). Fixes: dcd3e1de9d17 ("s390/checksum: provide csum_partial_copy_nocheck()") Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-15x86/mm/pat: Don't gate cpa_lock on debug_pagealloc_enabled()Mike Rapoport (Microsoft)
The splitting and merging of kernel page table mappings between small and large is protected by cpa_lock. The merging is relatively new but the splitting is ancient. The splitting has a locking optimization: since DEBUG_PAGEALLOC forces all mappings to 4k, there are no large pages to split. So the code that *might* cause a split can just skip the locking (and a few other things). This is entertaining, but it adds complexity and makes for weird locking rules. Plus it's all for a debugging feature which makes the kernel super slow in the first place. Optimizing something which is already super slow and not used in production is not the best way to spend our complexity budget. Stop gating cpa_lock on debug_pagealloc_enabled() to simplify the code and the locking rules. [ dhansen: flesh out changelog ] Suggested-by: Dave Hansen <dave.hansen@intel.com> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Link: https://patch.msgid.link/20260715144519.934289-1-rppt@kernel.org Link: https://lore.kernel.org/all/aab44f08-89f8-47fe-bee4-0ab6b25968c6@intel.com/
2026-07-15irqchip/gic-v3: Add Renesas R-Car Gen4 erratum workaroundMarek Vasut
Renesas R-Car S4/V4H/V4M GIC600 integration has address width for AXI or APB interface configured to 32 bit, it can therefore access only the first 4 GiB of physical address space. This information comes from R-Car V4H Interface Specification sheet; there is currently no technical update number assigned to this limitation. Further input from hardware engineer indicates that this limitation also applies to R-Car S4 and V4M. Name the limitation GEN4GICITS1, and add a driver quirk to mitigate this limitation. The quirk is keyed on the combination of the GIC implementation and the platform identification in the device tree. Co-developed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com> Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Acked-by: Marc Zyngier <maz@kernel.org> Acked-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260707203743.88299-5-marek.vasut+renesas@mailbox.org
2026-07-15calibrate: Rework delay timer calibrationThomas Gleixner
The header define in asm/timex,h and the naming of the function to read the delay timer are confusing at best. Convert it to a config switch selected by the archictures which provide the functionality and rename the function to delay_read_timer(), which makes the purpose clear. Move the declaration to linux/delay.h where it belongs. Remove the resulting empty asm/timex.h files as well. No functional change. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260410120317.978403520@kernel.org
2026-07-15treewide: Remove CLOCK_TICK_RATEThomas Gleixner
This has been scheduled for removal more than a decade ago and the comments related to it have been dutifully ignored. The last dependencies are gone. Remove it along with various now empty asm/timex.h files. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://patch.msgid.link/20260410120317.910770161@kernel.org
2026-07-15x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATEThomas Gleixner
CLOCK_TICK_RATE is only used in x86 but defined all over the tree for no reason with comments that it's scheduled for removal for more than a decade. Use PIT_TICK_RATE for registering refined jiffies to get rid of the last dependency. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260410120317.843419270@kernel.org
2026-07-15KVM: riscv: Fix Spectre-v1 in vector register accessZongmin Zhou
User-controlled register indices from the ONE_REG ioctl are used to index into the vector register buffer (v0..v31). Sanitize the calculated offset with array_index_nospec() to prevent speculative out-of-bounds access. Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260715030818.75657-1-min_halo@163.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-15soc: document mergesAlexandre Belloni
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-07-15Merge branch 'soc/arm' into soc/for-nextAlexandre Belloni
* soc/arm: ARM: use CONFIG_AEABI by default everywhere ARM: limit OABI support to StrongARM CPUs ARM: rework ARM11 CPU selection logic ARM: deprecate support for ARM1136r0 ARM: turn CONFIG_ATAGS off by default ARM: mark CPU_ENDIAN_BE8 as deprecated ARM: update DEPRECATED_PARAM_STRUCT removal timeline ARM: s3c64xx: extend deprecation schedule ARM: update FPE_NWFPE help text ARM: mark IWMMXT as deprecated ARM: mark ARCH_DOVE as deprecated ARM: PXA: mark remaining board files as deprecated ARM: orion5x: mark all board files as deprecated ARM: mark mach-sa1100 as deprecated ARM: mark RiscPC as deprecated ARM: mark footbridge as deprecated ARM: mark Cortex-M3/M4/M7 based boards as deprecated ARM: mark axxia platform as deprecated ARM: mark mv78xx0 support as deprecated
2026-07-15Merge tag 'arm-feature-deprecation-for-7.3' of ↵Alexandre Belloni
https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc into soc/arm ARM: platform and feature deprecation for 7.3 This is an attempt to bring the source code to the state that we discussed back in 2024, regarding a timeline for deprecating and removing features, in particular platforms and ABIs that are basically unused and are also getting in the way of maintenance. The earlier consensus was to remove these features in 2025 or 2026 after the corresponding LTS kernel release. I would suggest pushing these to early 2027 now, see the patch description for details on each one: - all board files that are still not converted to DT (except for OMAP1 and S3C) - iWMMXt FPU support - ARMv6/ARM1136r0 (not ARMv6K/ARM1136r1/ARM1176) along with the OMAP24xx and i.MX31 SoCs using it - Cortex-M3/M4/M7 based microcontroller support (stm32, imxrt, lpc18xx, samv7) - LSI Axxia platform - OABI, OABI-compat and NWFPE are confined to StrongARM based builds and scheduled for removal once StrongARM is gone. - DEPRECATED_PARAM_STRUCT, which was originally scheduled for removal in 2006 (!) The ARCH_S3C64XX platform was scheduled for removal in 2024, but is still actively used and will get removed once Mark Brown stops using it. The OMAP1 platform has some remaining boardfiles and is expected to get converted to DT. Big-endian ARMv7 CPU support is not scheduled for removal but marked as broken the same way as ARM64 has, to reduce the need for testing unused configurations. This may be removed in the future if arm64 does it as well. Note that big-endian ARMv5 support is can still be enabled since the patches to revive little-endianm mode are still fresh. Regarding actually removing the code, I would suggest linux-7.4 (January 2027), removing both the board files and any drivers that have either become newly unused or were missed in a previous machine removal series, followed by removing support for then unused CPUs a release later. Links to previous discussion: https://lore.kernel.org/linux-arm-kernel/20210109174357.GB1551@shell.armlinux.org.uk/ https://lore.kernel.org/linux-arm-kernel/2831c5a6-cfbf-4fe0-b51c-0396e5b0aeb7@app.fastmail.com/ https://lore.kernel.org/all/20241204102904.1863796-1-arnd@kernel.org/ https://lore.kernel.org/all/20260701212353.2196041-1-arnd@kernel.org/ Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-07-15KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest stateSean Christopherson
Put all vmcs12 pages if KVM synthesizes a nested VM-Exit due to invalid guest while emulating VMLAUNCH or VMRESUME. The invalid guest state path doesn't use nested_vmx_vmexit() as that API is intended to be used if and only if L2 is active, and the open coded equivalent neglects to put the vmcs12 pages. Failure to put the vmcs12 pages leaks any pinned pages (and/or mappings) if L1 retries VMLAUNCH/VMRESUME. Note, the !from_vmenter scenario doesn't suffer the same problem, as vmx_get_nested_state_pages() only gets/pins/maps the vmcs12 pages if L2 is active, i.e. if a "full" VM-Exit is guaranteed before KVM will retry getting vmcs12 pages. Fixes: 96c66e87deee ("KVM/nVMX: Use kvm_vcpu_map when mapping the virtual APIC page") Fixes: 3278e0492554 ("KVM/nVMX: Use kvm_vcpu_map when mapping the posted interrupt descriptor table") Fixes: fe1911aa443e ("KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page") Reported-by: Minh Nguyen <minhnguyen.080505@gmail.com> Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-07-15Merge tag 'kvm-s390-master-7.2-1' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Fixes for 7.2 - more gmap KVM memory management fixes - PCI passthru fixes
2026-07-15Merge tag 'kvm-x86-fixes-7.2-rc4' of https://github.com/kvm-x86/linux into HEADPaolo Bonzini
KVM x86 fixes for 7.2-rcN - Fix a bug where KVM will trigger a UAF if updating IOMMU IRTEs fails when registering an IRQ-bypass producer. - Ignore pending PV EOI instead of BUG()ing the host if the feature was disabled by the guest. - Fix nVMX bugs where KVM would run L1 with an L1-controlled CR3 after a failed "late" consistency check when KVM is NOT using EPT. - Disallow intra-host migration/mirroring of SNP VMs as KVM doesn't yet support moving/mirroring SNP state. - Fix a TOCTOU bug in KVM's handling of the "trusted" CPUID for TDX guests. - Fix a NULL pointer deref in trace_kvm_inj_exception() where a change to the core infrastructure missed KVM's unique (ab)use of __print_symbolic().
2026-07-15Merge tag 'kvmarm-fixes-7.2-2' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #2 - Move locking for kvm_io_bus_get_dev() into the caller, ensuring race-free checks that the returned object is of the correct type - Fix initialisation of the page-table walk level when relaxing permissions - Correctly update the XN attribute when relaxing permissions - Fix the sign extension of loads from emulated MMIO regions - Assorted collection of fixes for pKVM's FFA proxy, together with a couple of FFA driver adjustments
2026-07-15Merge tag 'kvmarm-fixes-7.2-1' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD KVM/arm64 fixes for 7.2, take #1 - Fix an accounting buglet when reclaiming pages from a protected guest - Fix a bunch of architectural compliance issues when injecting a synthesised exception, most of which were missing the PSTATE.IL bit indicating a 32bit-wide instruction - Another set of fixes addressing issues with translation of VNCR_EL2, including corner cases where the guest point that register at a RO page... - Don't warn when trapping accesses to ZCR_EL2 from an L2 guest, as that's not unexpected at all - Address a bunch of races with LPI migration vs LPIs being disabled - Fix a total howler of a bug combining FEAT_MOPS and NV, resulting in exception returning in the wrong place... - Coerce Fuad Tabba into a reviewer role, and may his Inbox catch fire!
2026-07-15vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTOREThomas Weißschuh
Over time the meaning of HAVE_GENERIC_VDSO has become off. Today it only controls the availability of the vDSO datastore. Rename the symbol to match its function. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Reviewed-by: Philippe Mathieu-Daudé <philmd@oss.qualcomm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-6-d2e1061f268b@linutronix.de
2026-07-15vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig filesThomas Weißschuh
Now that GENERIC_GETTIMEOFDAY and VDSO_GETRANDOM enable HAVE_GENERIC_VDSO automatically, the architecture specific kconfig files do not need to do so anymore. Remove the corresponding lines. Keep them for riscv, loongarch and powerpc as those have their own explicit usage of the vDSO datastore provided by HAVE_GENERIC_VDSO. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-5-d2e1061f268b@linutronix.de
2026-07-15MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSOThomas Weißschuh
HAVE_GENERIC_VDSO is about to become an implementation detail. Use the MIPS-specific symbol instead. It is equivalent here. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-3-d2e1061f268b@linutronix.de
2026-07-15vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATAThomas Weißschuh
Align ARCH_HAS_VDSO_ARCH_DATA with ARCH_HAS_VDSO_TIME_DATA, making it selectable even without HAVE_GENERIC_VDSO. It will only have an effect when HAVE_GENERIC_VDSO is enabled anyways, but this makes the architecture Kconfig files a bit simpler. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Vincenzo Frascino <vincenzo.frascino@arm.com> Link: https://patch.msgid.link/20260709-vdso-have_generic_vdso-v1-2-d2e1061f268b@linutronix.de
2026-07-15RISC-V: KVM: Serialize virtual interrupt pending state updatesXie Bo
KVM RISC-V tracks guest local interrupt state with two bitmaps: - irqs_pending: interrupts that should be visible to the guest - irqs_pending_mask: interrupts whose pending state changed The current code updates those bitmaps with independent atomic bitops and assumes a multiple-producer, single-consumer protocol. That model does not actually hold. kvm_riscv_vcpu_sync_interrupts() is not a pure consumer. When the guest changes guest-visible HVIP state, sync_interrupts() writes both irqs_pending and irqs_pending_mask to reflect the new guest state back into KVM state. As a result, irqs_pending and irqs_pending_mask form a single logical state transition, but they are not updated atomically as a pair. This allows a race where a newly injected interrupt is lost. For example: CPU0 CPU1 ---- ---- kvm_riscv_vcpu_set_interrupt(VS_SOFT) set_bit(VS_SOFT, irqs_pending) kvm_riscv_vcpu_sync_interrupts() sees guest-cleared HVIP.VSSIP sets irqs_pending_mask clear_bit(IRQ_VS_SOFT, irqs_pending) set_bit(VS_SOFT, irqs_pending_mask) kvm_vcpu_kick() After that interleaving, a later flush can update HVIP without VSSIP even though a new virtual interrupt was injected. In practice, the guest can remain blocked in WFI with work pending. The same pending/mask protocol is shared by VS soft interrupts, PMU overflow delivery, and AIA high interrupt synchronization, so the race is not limited to one interrupt source. Fix this by serializing all updates to irqs_pending and irqs_pending_mask with a per-vCPU raw spinlock. This keeps the pending bit and the dirty mask as one state transition across: - set/unset interrupt - guest HVIP sync - interrupt flush to guest CSR state - vCPU reset - AIA CSR writes that clear dirty state Use non-atomic bitmap operations while holding the lock. Hold the lock across the AIA sync, flush, and pending checks as well, so both bitmap words share the same serialization domain. This intentionally replaces the existing lockless protocol instead of trying to repair it with additional barriers. The problem is not memory ordering on a single field; it is that two separate bitmaps encode one shared state machine while both producers and sync paths can modify them. A per-vCPU raw spinlock keeps the fix small, local, and suitable for backporting. Fixes: cce69aff689e ("RISC-V: KVM: Implement VCPU interrupts and requests handling") Cc: stable@vger.kernel.org Signed-off-by: Xie Bo <xb@ultrarisc.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260715020359.1521354-2-xb@ultrarisc.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-15powerpc: Remove dead non-preemption codeChristophe Leroy (CS GROUP)
Since commit 7dadeaa6e851 ("sched: Further restrict the preemption modes"), powerpc always has CONFIG_PREEMPTION because only CONFIG_PREEMPT and CONFIG_PREEMPT_LAZY are possible, even in dynamic preemption mode (see sched_dynamic_mode). As a consequence, need_irq_preemption() is always true and can be removed. And because commit bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature") includes linux/irq-entry-common.h which already declares sk_dynamic_irqentry_exit_cond_resched static key, asm/preempt.h becauses useless and can be removed. Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/2bf10a0afffefb6aca44bf2f864cc17471a80e31.1781870889.git.chleroy@kernel.org
2026-07-15powerpc/dt_cpu_ftrs: Set CPU_FTR_P11_PVR for Power11 and later processorsAmit Machhiwal
When using device tree CPU features (dt-cpu-ftrs), the kernel bypasses the traditional cputable-based CPU identification and instead derives CPU features from the device tree's "ibm,powerpc-cpu-features" node provided by firmware. However, CPU_FTR_P11_PVR is a kernel-internal feature flag used to identify Power11 and later processors, and is not represented in the device tree's ISA feature set. While ISA v3.1 support (indicated by CPU_FTR_ARCH_31) is present on both Power10 and Power11, the CPU_FTR_P11_PVR flag is specifically needed by code that must distinguish between Power10 and Power11 processors. Without this flag set, code that checks for Power11 using cpu_has_feature(CPU_FTR_P11_PVR) will incorrectly return false on Power11+ systems using dt-cpu-ftrs, leading to incorrect behavior. This issue manifests specifically in powernv environments (bare-metal or QEMU TCG with powernv machine type), where skiboot/OPAL firmware provides the "ibm,powerpc-cpu-features" node, causing the kernel to use dt-cpu-ftrs. The issue does not affect pseries guests, where SLOF firmware does not provide this node, causing the kernel to fall back to the traditional cputable path (identify_cpu) which correctly sets CPU_FTR_P11_PVR during PVR-based CPU identification. In powernv TCG guests, the missing flag causes KVM code to trigger warnings when attempting to create KVM guests, as cpu_features shows 0x000c00eb8f4fb187 (missing bit 53) instead of the correct 0x002c00eb8f4fb187 (with bit 53 set). Fix this by setting CPU_FTR_P11_PVR for all processors with PVR >= PVR_POWER11 when ISA v3.1 support is detected in cpufeatures_setup_start(). This approach ensures forward compatibility with future processor generations. Fixes: 96e266e3bcd6 ("KVM: PPC: Book3S HV: Add Power11 capability support for Nested PAPR guests") Cc: stable@vger.kernel.org # v6.13+ Signed-off-by: Amit Machhiwal <amachhiw@linux.ibm.com> Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com> Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260614173437.26352-1-amachhiw@linux.ibm.com
2026-07-15powerpc/pseries: fix memory leak on krealloc failure in papr_initThorsten Blum
When krealloc() fails, free the original esi_buf before returning to avoid a memory leak. Fixes: 3c14b73454cf ("powerpc/pseries: Interface to represent PAPR firmware attributes") Cc: stable@vger.kernel.org Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260614142356.658212-2-thorsten.blum@linux.dev
2026-07-15powerpc/uaccess: correct check for CONFIG_PPC_E500 in mask_user_address()Ethan Nelson-Moore
mask_user_address() incorrectly checks for CONFIG_E500 instead of CONFIG_PPC_E500, causing mask_user_address_isel() to not be used on E500 hardware. Fix the check to use the correct name. Fixes: 861574d51bbd ("powerpc/uaccess: Implement masked user access") Cc: stable@vger.kernel.org # 7.0+ Signed-off-by: Ethan Nelson-Moore <enelsonmoore@gmail.com> Fixes: 861574d51bbd ("powerpc/uaccess: Implement masked user access") Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260615233729.29386-1-enelsonmoore@gmail.com
2026-07-15powerpc/vtime: Initialize starttime at boot for native accountingShrikanth Hegde
It was observed that /proc/stat had very large value for one ore more CPUs. It was more visible after recent code simplifications around cpustats. System has 240 CPUs. cat /proc/uptime; 194.18 46500.55 cat /proc/stat cpu 5966 39 837032887 4650070 164 185 100 0 0 0 cpu0 108 0 837030890 19109 24 4 23 0 0 0 Since uptime is 194s, system time of each CPU can't be more than 19400. Sum of system time of all CPUs can't be more than 19400*240 4656000. In fact huge value is close to mftb(). Note mftb doesn't reset on powerVM when the LPAR restart. It only resets when whole system resets. The same issue exists for kexec too. This happens since starttime is not setup at init time. Once it is set then subsequent vtime_delta will return the right delta. Fix it by initializing the starttime during CPU initialization. This fixes the large times seen. cat /proc/uptime; cat /proc/stat 15.78 3694.63 cpu 6035 35 1347 369479 23 144 49 0 0 0 cpu0 19 0 38 1508 0 1 14 0 0 0 Now, system time is reported as expected. Fixes: cf9efce0ce31 ("powerpc: Account time using timebase rather than PURR") Reviewed-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Suggested-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Signed-off-by: Shrikanth Hegde <sshegde@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260605124329.377533-1-sshegde@linux.ibm.com
2026-07-15powerpc/85xx: Add fsl,ifc to common device idsRosen Penev
Add fsl,ifc to mpc85xx_common_ids so that of_platform_bus_probe creates a platform device for the IFC node even without 'simple-bus' in its compatible property. On P1010 and similar platforms the IFC node is a direct child of the root, so it must be explicitly matched to be populated. Fixes: 0bf51cc9e9e5 ("powerpc: dts: mpc85xx: remove "simple-bus" compatible from ifc node") Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260604043309.91280-1-rosenp@gmail.com
2026-07-14arch/riscv: vdso: remove CFI landing pad from rt_sigreturnAurelien Jarno
When CONFIG_RISCV_USER_CFI is enabled, the CFI version of the vDSO, has a CFI landing pad instruction at the start of __vdso_rt_sigreturn. This breaks libgcc's unwinding code which matches on the first two instructions. Other unwinders that rely on similar instruction matching may also be affected. Since __vdso_rt_sigreturn is reached as part of signal-return handling rather than via an indirect call/jump from userspace, it does not need a CFI landing pad. Remove it and restore the instruction sequence expected by existing unwinding code. This matches what was done on arm64 in commit 9a964285572b ("arm64: vdso: Don't prefix sigreturn trampoline with a BTI C instruction") for a similar issue. Cc: stable@vger.kernel.org Fixes: 37f57bd3faea ("arch/riscv: compile vdso with landing pad and shadow stack note") Co-authored-by: Joel Stanley <joel@jms.id.au> Signed-off-by: Aurelien Jarno <aurelien@aurel32.net> Signed-off-by: Joel Stanley <joel@jms.id.au> Link: https://patch.msgid.link/20260623204058.498120-1-aurelien@aurel32.net [pjw@kernel.org: fixed comment style] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-14arm64: dts: imx8mm-var-dart: Add support for Variscite Sonata boardStefano Radaelli
Add device tree support for the Variscite Sonata carrier board with the DART-MX8M-MINI system on module. The Sonata board includes - uSD Card support - USB ports and OTG - Uart, SPI and I2C interfaces - GPIO Expanders - RTC module - TPM module - CAN peripherals Link: https://variscite.com/carrier-boards/sonata-board/ Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-14arm64: dts: freescale: Add support for Variscite DART-MX8M-MINIStefano Radaelli
Add device tree support for the Variscite DART-MX8MM system on module. This SOM is designed to be used with various carrier boards. The module includes: - NXP i.MX8M Mini MPU processor - Up to 4GB of LPDDR4 memory - Up to 128GB of eMMC storage memory - Integrated 10/100/1000 Mbps Ethernet Transceiver - Codec audio WM8904 - WIFI6 dual-band 802.11ax/ac/a/b/g/n with optional 802.15.4 and Bluetooth Only SOM-specific peripherals are enabled by default. Carrier board specific interfaces are left disabled to be enabled in the respective carrier board device trees. Link: https://variscite.com/system-on-module-som/i-mx-8/i-mx-8m-mini/dart-mx8m-mini/ Signed-off-by: Stefano Radaelli <stefano.r@variscite.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-14arm64: dts: apple: Add pmgr-misc nodes to t60xxSasha Finkelstein
Adds the PMGR misc control nodes for M1/2 Pro/Max/Ultra series devices. Reviewed-by: Sven Peter <sven@kernel.org> Signed-off-by: Sasha Finkelstein <k@chaosmail.tech> Reviewed-by: Joshua Peisach <jpeisach@ubuntu.com> Link: https://patch.msgid.link/20260705-pmgr-misc-v3-3-51b75fed6f73@chaosmail.tech Signed-off-by: Sven Peter <sven@kernel.org>
2026-07-14x86/entry/fred: Encode frame pointer on entryDavid Stevens
Add missing ENCODE_FRAME_POINTER macro invocation into FRED_ENTER macro, to prevent the unwinder from encountering a NULL stack frame pointer when CONFIG_UNWINDER_FRAME_POINTER is enabled Fixes: 14619d912b65 ("x86/fred: FRED entry/exit and dispatch code") Signed-off-by: David Stevens <stevensd@google.com> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com> Acked-by: H. Peter Anvin (Intel) <hpa@zytor.com> Link: https://patch.msgid.link/20260424191456.2679717-12-stevensd@google.com
2026-07-14arm64: dts: imx8qm: add scu power key supportFrank Li
Add scu power key node. Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-07-14syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCHJinjie Ruan
Currently, only x86 genuinely implements and supports Syscall User Dispatch (SUD). Multiple architectures provide a stub arch_syscall_is_vdso_sigreturn() returning 'false' simply to satisfy GENERIC_ENTRY compilation, which creates a false impression of feature support. Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH to decouple this mechanism from GENERIC_ENTRY. Select it exclusively on x86 and remove the redundant stub functions from other architectures. Suggested-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260713035422.582771-1-ruanjinjie@huawei.com
2026-07-14RISC-V: KVM: Inject instruction access fault on unmapped guest fetchQingwei Hu
When an instruction guest-page-fault targets a GPA that is not backed by any memslot, KVM has no MMIO emulation path for the fetch. Load and store guest-page faults can be routed through MMIO emulation, but an instruction fetch has no data payload or access size for userspace to complete in the same way. Treat this case as an architectural access fault in the guest. On bare metal, fetching from an inaccessible physical address raises an instruction access fault for the supervisor to handle through its trap vector. Reflect EXC_INST_ACCESS back to the guest so the guest observes the same class of exception rather than leaving the fetch as a host-handled condition. stval contains the virtual address of the portion of the instruction that caused the fault, while sepc points to the beginning of the instruction. Signed-off-by: Qingwei Hu <qingwei.hu@bytedance.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260707122548.281685-1-qingwei.hu@bytedance.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-14x86/boot: Validate console=uart8250 baud rate to fix early boot hangThorsten Blum
When the baud rate is empty, 0, invalid, or overflows to 0 when stored as an int, the system will hang during early boot because of a division by zero in early_serial_init(). Fall back to DEFAULT_BAUD when the resulting baud rate is 0 to prevent an early system hang. Fixes: ce0aa5dd20e4 ("x86, setup: Make the setup code also accept console=uart8250") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: "H. Peter Anvin" <hpa@zytor.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260713194924.126472-3-thorsten.blum@linux.dev
2026-07-14arm64: dts: renesas: r9a09g047: Fix PCIe dma-ranges memory space codeLad Prabhakar
The RZ/G3E SoC supports up to 8 GiB of memory. Update the PCIe dma-ranges property to use the 64-bit prefetchable memory space code. Fixes: 1ac57c9830cb ("arm64: dts: renesas: r9a09g047: Add PCIe node") Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708172849.227915-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g056: Fix PCIe dma-ranges memory space codeLad Prabhakar
The RZ/V2N SoC supports up to 8 GiB of memory. Update the PCIe dma-ranges property to use the 64-bit prefetchable memory space code. Fixes: 4c443296ff17 ("arm64: dts: renesas: r9a09g056: Add PCIe node") Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708172849.227915-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g057h44-rzv2h-evk: Enable PCIeLad Prabhakar
Enable the PCIE1 slot which is connected to PCIe0 channel. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708163311.222176-3-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g057: Add PCIe nodesLad Prabhakar
Add PCIe nodes to Renesas RZ/V2H(P) ("R9A09G057") SoC DTSI. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260708163311.222176-2-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14ARM: dts: renesas: r9a06g032-rzn1d400-eb: Enable SPI-FRAMWolfram Sang
Activate the FRAM and the SPI bus which it is attached to. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260626180326.9593-5-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14ARM: dts: renesas: r9a06g032: Describe SPI controllersWolfram Sang
Add nodes for the 6 SPI controllers of the Renesas RZ/N1D SoC. The first 4 can only be controllers, the latter 2 can only be targets. DMA nodes are not added yet because DMA needs some extra code in the drivers and cannot be tested yet. Basic FIFO mode works reliably, though. Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com> Tested-by: Herve Codina <herve.codina@bootlin.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260626180326.9593-4-wsa+renesas@sang-engineering.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzt2h-n2h-evk-common: Add memory nodesLad Prabhakar
Add memory nodes for the RZ/T2H and RZ/N2H EVK boards. These boards populate 8GiB of DDR memory, which is exposed through two address ranges. Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260622170733.1703585-1-prabhakar.mahadev-lad.rj@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: Add soc: labels to soc nodesMarek Vasut
Add soc: labels to the /soc {} nodes to align DTS with r8a77951.dtsi which already has that soc: label. The soc: label is useful in U-Boot where it is used in U-Boot extras DT fragments. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260621025052.406507-1-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-2-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-3-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-4-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-5-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-6-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-7-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-8-marek.vasut+renesas@mailbox.org Link: https://patch.msgid.link/20260621025052.406507-9-marek.vasut+renesas@mailbox.org Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g047e57-smarc: Add DA7212 audio codec supportJohn Madieu
RZ/G3E SMARC board has a DA7212 audio codec connected via I2C1 for sound input/output using SSI3/SSI4 where: - The codec receives its master clock from the Versa3 clock generator present on the SoM, - SSI4 shares clock pins with SSI3 to provide a separate data line for full-duplex audio capture. Enable audio support on RZ/G3E SMARC2 EVK boards with a DA7212 audio codec. Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Link: https://patch.msgid.link/20260619083951.3777556-5-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzg3e-smarc-som: Add audio pinmux definitionsJohn Madieu
Add pinmux definitions for SSI3/SSI4 audio interface on RZ/G3E SMARC SoM: - sound_clk_pins: AUDIO_CLKB and AUDIO_CLKC clock outputs, - sound_pins: SSI3_SCK, SSI3_WS, SSI3_SDATA (playback) and SSI4_SDATA (capture). Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-4-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: rzg3e-smarc-som: Add Versa3 clock generatorJohn Madieu
Add the Renesas 5P35023 (Versa3) programmable clock generator on the I2C2 bus along with its 24MHz input clock (x2 oscillator) to feed the audio subsystem. The Versa3 provides the following clock outputs: - Output 0: 24MHz (reference), - Output 1: 12.288MHz (audio, 48kHz family), - Output 2: 11.2896MHz (audio, 44.1kHz family), - Output 3: 12.288MHz (audio), - Output 4: 25MHz (DIFF1, Ethernet). These clocks are required for the audio codec and the Ethernet controller found on the RZ/G3E SMARC EVK. Output 5 (DIFF2) is left out, as it is not connected on this board. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-3-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
2026-07-14arm64: dts: renesas: r9a09g047: Add RZ/G3E Sound supportJohn Madieu
Add the snd_rzg3e node for the RZ/G3E SoC with all sub-components: - SSI (Serial Sound Interface) units 0-9, - SSIU (Serial Sound Interface Unit) units 0-27, - SRC (Sample Rate Converter) units 0-9, - CTU (Channel Transfer Unit) units 0-7, - DVC (Digital Volume Control) units 0-1, - MIX (Mixer) units 0-1. Sub-node names follow the new RZ/G3E sound binding: unprefixed 'ssi', 'ssiu', 'src', 'dvc', 'mix', 'ctu' wrapper nodes instead of the legacy 'rcar_sound,xxx' R-Car prefix. Wire up all 5 DMA controllers (dmac0-dmac4) for each audio sub-node with repeated channel names, so that the DMA core can pick the first available controller. Signed-off-by: John Madieu <john.madieu.xa@bp.renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260619083951.3777556-2-john.madieu.xa@bp.renesas.com Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-07 08:39:10 +0000