summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-07-08KVM: x86: Prioritize #UD on MOV DR over #GP due to non-zero CPLSean Christopherson
Manually handle the CPL check for MOV DR instructions instead of using the Priv flag, *after* checking for #UD scenarios, as #GP due to CPL>0 has lower priority than all #UDs. Fixes: 1e470be5a108 ("KVM: x86 emulator: fix mov dr to inject #UD when needed.") Reviewed-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260612230113.684301-5-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Manually check DR4/5 write values to fix SVM intercept prioritySean Christopherson
Manually (pre)check the values being written to DR4/5, i.e. the DR6/DR7 aliases, instead of relying on ->set_dr() => kvm_set_dr() to signal a #GP. SVM unfortunately prioritizes all exceptions over an instruction intercept, i.e. nSVM is relying on the emulator to perform *all* exception checks prior to attempting to execute the instruction. Fixes: 3b88e41a4134 ("KVM: SVM: Add intercept check for accessing dr registers") Reviewed-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260612230113.684301-4-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Prioritize DR7.GD #DB over #GP due to illegal DR6/7 valueSean Christopherson
When emulating a MOV DR, specifically a write to DR6 or DR7, treat a #DB due to DR7.GD (General Detect) as higher priority than a #GP due to an illegal value. While neither Intel's SDM nor AMD's APM says anything about the relative priority, empirical testing on Intel and AMD shows that the #DB has higher priority. And for VMX, where the instruction intercept has priority over *all* exceptions, KVM already treats the #DB as having higher priority. Cc: Maciej W. Rozycki <macro@orcam.me.uk> Fixes: 3b88e41a4134 ("KVM: SVM: Add intercept check for accessing dr registers") Reviewed-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260612230113.684301-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Treat any non-zero return from set_dr() as a faulting conditionCarlos López
When emulating a MOV to a debug register, em_dr_write() calls @ctxt->ops->set_dr(), which is forwarded to emulator_set_dr() and then kvm_set_dr(). The latter checks that the written value is valid, otherwise returning an error, in which case the emulator is supposed to inject a #GP fault into the guest. Commit 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr to callers") changed the contract of kvm_set_dr() (and thus emulator_set_dr()), returning 1 as an error instead of -1, but the caller in em_dr_write() was never updated, checking only if the returned value is negative. The end result is that em_dr_write() does not detect the error, so an invalid write does not generate a #GP, but at the same time the register value is not updated. The practical impact is limited, as check_dr_write() already checks DR6 and DR7 manually. However, it misses DR4/DR5, which alias DR6/DR7 when CR4.DE=0. Fix the bug by treating any non-zero return from set_dr() as a reason to inject #GP. Note, the manual checks on DR6 and DR7 are flawed, as they incorrectly prioritize the #GP over a DR7.GD=1 #DB (the General Detect #DB has priority on both Intel and AMD). Note #2, relying on ->set_dr() to detect #GP is also flawed as all exceptions have higher priority than the instruction intercept on SVM, i.e. the manual checks need to be extended to DR4 and DR5 (after the priority bug is fixed). Fixes: 996ff5429e98 ("KVM: x86: move kvm_inject_gp up from kvm_set_dr to callers") Signed-off-by: Carlos López <clopez@suse.de> Link: https://patch.msgid.link/20260601133320.91479-2-clopez@suse.de [sean: drop explicit "!= 0", massage changelog] Reviewed-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260612230113.684301-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Fix emulated CPUID features being applied to wrong sub-leafBinbin Wu
Pass the CPUID index into cpuid_func_emulated() and return no emulated features for indexed CPUID leaves with a non-zero index. KVM currently emulates CPUID features only for index 0, but kvm_vcpu_after_set_cpuid() looks up emulated features by function alone. As a result, reverse_cpuid[] entries that share a function but use a non-zero index, e.g. CPUID.7.1:ECX, can inherit emulated features that belong to index 0. For example, RDPID, which is CPUID.7.0:ECX[22], can be incorrectly OR'd into CPUID.7.1:ECX. This is benign today because the affected bits do not correspond to features KVM cares about, but it can become a real bug as new CPUID features are defined. Make the helper index-aware so emulated features are applied only to the CPUID entry they actually describe. Fixes: e592ec657d84 ("KVM: x86: Initialize guest cpu_caps based on KVM support") Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Binbin Wu <binbin.wu@linux.intel.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Link: https://patch.msgid.link/20260609075748.612704-1-binbin.wu@linux.intel.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: TDX: Return EINVAL, not EOPNOTSUPP, for NULL INIT_MEM_REGION sourceSean Christopherson
Return EINVAL instead of EOPNOTSUPP if userspace attempts to pass a NULL pointer for the source page of INIT_MEM_REGION, so that KVM's ABI is consistent between TDX and SNP (for LAUNCH_UPDATE). EOPNOTSUPP was chosen to be a forward-looking error code for when guest_memfd supports in-place conversion, but even when in-place conversion comes along, it's an awkward error code as KVM is deliberately choosing to disallow virtual address '0', which is technically a legal userspace address. I.e. it's not so much a lack of support as it is that KVM reserves address '0' to simplify KVM's internal implementation. Opportunistically move the check so that it's co-located with the other checks on the userspace address, and so that it's more obvious that a NULL source address is explicitly disallowed. Fixes: 2a62345b3052 ("KVM: guest_memfd: GUP source pages prior to populating guest memory") Cc: Yan Zhao <yan.y.zhao@intel.com> Cc: Ackerley Tng <ackerleytng@google.com> Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com> Acked-by: Kiryl Shutsemau (Meta) <kas@kernel.org> Reviewed-by: Binbin Wu <binbin.wu@linxu.intel.com> Reviewed-by: Yan Zhao <yan.y.zhao@intel.com> Tested-by: Yan Zhao <yan.y.zhao@intel.com> Reviewed-by: Ackerley Tng <ackerleytng@google.com> Link: https://patch.msgid.link/20260630213711.479692-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: SEV: Explicitly disallow NULL user address for SNP_LAUNCH_UPDATEJoerg Roedel
Explicitly reject a NULL userspace virtual address for the source page of SNP_LAUNCH_UPDATE instead of relying on the post-populate callback to do the check, and don't WARN on failure, as the scenario is blatantly user- triggerable, as reported by Sashiko. Waiting until post-populate to check the address "works", but makes it unnecessarily difficult to see that KVM's ABI is to disallow a NULL source page for non-ZERO pages. Note, several existing VMMs pass a valid userspace address for the ZERO case, i.e. KVM can't *require* the userspace address to be NULL for ZERO pages, at least not without breaking userspace. Fixes: dee5a47cc7a4 ("KVM: SEV: Add KVM_SEV_SNP_LAUNCH_UPDATE command") Reported-by: Sashiko Bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260611125849.9ED631F00893@smtp.kernel.org Signed-off-by: Joerg Roedel <joerg.roedel@amd.com> Co-developed-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Ackerley Tng <ackerleytng@google.com> Link: https://patch.msgid.link/20260630213711.479692-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: nVM: Ensure INVVPID is emulated on the correct physical CPUYosry Ahmed
When emulating INVVPID, KVM executes INVVPID on the physical CPU using vpid02 (instead of the L1 assigned VPID), after doing some validations on the operands. However, it is possible that the physical CPU KVM executes INVVPID on is different from the CPU L2 is running on. For example, in the following scenario: - L2 runs on CPU #1 and exits to L1 (vmx->nested.vmcs02.cpu=1) - L1 migrates to CPU #2 and executes INVVPID - KVM executes INVVPID on CPU #2 - L1 migrates back to CPU #1 and runs L2 (vmx->nested.vmcs02.cpu=1) The TLB entries on CPU #1 are never invalidated, because INVVPID was executed on CPU #2, and vmcs02 never ran on a different pCPU (i.e. vmx_vcpu_load_vmcs() will *not* request KVM_REQ_TLB_FLUSH). Ensure that INVVPID is being executed on the same pCPU that L2 last ran on, and if not, fallback to clearing last_vpid=0 to trigger a full VPID flush on the next nested VM-Enter (as KVM will detect L1 using a different VPID for L2). If L2 ends up running on a different pCPU, KVM will flush the TLB anyway through vmx_vcpu_load_vmcs(). Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Link: https://patch.msgid.link/20260616214652.2157032-4-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: nVMX: Decouple INVVPID operand checks from flushing of vpid02Sean Christopherson
Separate the INVVPID operand checks from the actual flushing of vpid02 so the flushing can be adjusted to do the right thing when vmcs02 was last loaded on a different pCPU, without having to duplicate the logic across multiple case-statements. Opportunistically let the VM-Fail paths poke out past 80 chars. No functional change intended. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Link: https://patch.msgid.link/20260616214652.2157032-3-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: nVMX: Always flush vpid02 on first useYosry Ahmed
Make sure vpid02 is always flushed on first use by setting last_vpid=0 when allocating vpid02. nested_vmx_transition_tlb_flush() will always detect a VPID change on first VM-Enter after VMXON, because VPID=0 in vmcs12 is not allowed if L1 enables VPID. This avoids using stale TLB entries from a previous lifetime of the VPID, that might have been associated with a different vCPU (or a completely different VM). Note that last_vpid is already being initialized as 0 when the vCPU is created, but it is not reset when vpid02 is freed on VMXOFF. Hence, the problem can only occur if L1 does VMXOFF -> VMXON, runs an L2, and KVM happens to reuse a VPID that has TLB entries on the physical CPU. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260616214652.2157032-2-yosry@kernel.org Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: nVMX: Don't use vmcs01.GUEST_CR3 to snapshot L1's CR3 when EPT is disabledSean Christopherson
Add a dedicated field in "struct nested_vmx" to track L1's pre-VM-Enter CR3 instead of using vmcs01.GUEST_CR3, which isn't anywhere near as safe as the comment purports it to be. E.g. in addition to the warn_on_missed_cc bug (that was fixed by relocating the consistency check), if getting vmcs12 pages (during actual nested VM-Entry) fails and EPT is disabled (in KVM), KVM will return control to userspace with vmcs01.GUEST_CR3 holding a guest- controlled value. Alternatively, KVM could force a reload of vmcs01.GUEST_CR3 by resetting the MMU context in the error path, but as above, the safety of the vmcs01 approach is extremely questionable, e.g. it took all of ~4 months for the code to break. Fixes: 671ddc700fd0 ("KVM: nVMX: Don't leak L1 MMIO regions to L2") Cc: stable@vger.kernel.org Cc: Jim Mattson <jmattson@google.com> Link: https://patch.msgid.link/20260612145642.452392-3-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: nVMX: Move vTPR vs. TPR Threshold consistency check into "normal" checksSean Christopherson
Move the off-by-default consistency check for vmcs12.tpr_threshold vs. the virtual APIC vTPR into the "normal" controls checks, as waiting until KVM has loaded some amount of state is unnecessary and actively dangerous. Specifically, failure to unwind vmcs01.GUEST_CR3 to KVM's value when EPT is disabled results in KVM running L1 with an L1-controlled CR3, not with KVM's CR3! Alternatively, KVM could simply reset the MMU to force a reload of vmcs01.GUEST_CR3, but the _only_ reason the check was shoved into a "late" flow was to wait until the vmcs12 pages were retrieved. Rather than build up more crusty code, simply access vTPR using a regular guest memory access (performance isn't a concern). To circumvent the restrictions that led to KVM deferring nested_get_vmcs12_pages(), (a) use a VM-scoped API to read guest memory so that it always hits non-SMM memslots (for RSM), and (b) skip the check (since its off-by-default anyways) when the vCPU doesn't want to run, i.e. when userspace is restoring/stuffing state. If reading guest memory fails, simply skip the consistency check, as KVM's de facto ABI is that VMX instruction accesses to non-existent memory get PCI Bus Error semantics, where reads return 0xFFs. And if vTPR=0xFF, then the vTPR is guaranteed to be greater than or equal to TPR_THRESHOLD. Fixes: 1100e4910ad2 ("KVM: nVMX: Add an off-by-default module param to WARN on missed consistency checks") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260612145642.452392-2-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Ignore pending PV EOI if the vCPU has since disabled PV EOIsSean Christopherson
Ignore KVM's internal "service pending PV EOI" request if the vCPU has disabled PV EOIs since the request was made. Asserting that PV EOIs are enabled can fail if reading guest memory in pv_eoi_get_user() fails, i.e. if pv_eoi_test_and_clr_pending() bails early, *and* the vCPU also disables PV EOIs. kernel BUG at arch/x86/kvm/lapic.c:3338! Oops: invalid opcode: 0000 [#1] SMP CPU: 4 UID: 1000 PID: 890 Comm: pv_eoi_test Not tainted 7.0.0-d585aa5894d8-vm #337 PREEMPT Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:kvm_lapic_sync_from_vapic+0x12b/0x140 [kvm] Call Trace: <TASK> kvm_arch_vcpu_ioctl_run+0x1075/0x1c30 [kvm] kvm_vcpu_ioctl+0x2d5/0x980 [kvm] __x64_sys_ioctl+0x8a/0xd0 do_syscall_64+0xb5/0xb40 entry_SYSCALL_64_after_hwframe+0x4b/0x53 </TASK> Modules linked in: kvm_intel kvm irqbypass ---[ end trace 0000000000000000 ]--- Fixes: ae7a2a3fb6f8 ("KVM: host side for eoi optimization") Cc: stable@vger.kernel.org Reviewed-by: Kai Huang <kai.huang@intel.com> Link: https://patch.msgid.link/20260624220516.3033391-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08KVM: x86: Nullify irqfd->producer if updating IRTE for bypass failsleixiang
Nullify irqfd->producer if updating the IRTE for bypass fails, as leaving a dangling pointer will result in a use-after-free if the irqfd is reachable through KVM's routing, but the producer is freed separately. E.g. for VFIO PCI, the producer is embedded in struct "vfio_pci_irq_ctx" and freed when the vector is disabled, which can happen independent of routing updates. Fixes: 77e1b8332d1d ("KVM: x86: Decouple device assignment from IRQ bypass") Cc: stable@vger.kernel.org Signed-off-by: leixiang <leixiang@kylinos.cn> Link: https://patch.msgid.link/1782119051448443.14545.seg@mailgw.kylinos.cn [sean: drop PPC change, massage changelog] Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-07-08riscv: defconfig: enable ARCH_ULTRARISCJia Wang
Enable `ARCH_ULTRARISC` in the default RISC-V defconfig. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Link: https://patch.msgid.link/20260515-ultrarisc-pinctrl-v1-9-bf559589ea8a@ultrarisc.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-08riscv: add UltraRISC SoC family Kconfig supportJia Wang
The first SoC in the UltraRISC series is UR-DP1000, containing octa UltraRISC CP100 cores. Signed-off-by: Jia Wang <wangjia@ultrarisc.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260427-ultrarisc-pcie-v4-1-98935f6cdfb5@ultrarisc.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-08s390/traps: Add exception statisticsSven Schnelle
Add a new debugfs file which displays the number of exceptions (program checks) per CPU. This is helpful for debugging purposes. The statistics are typically available at /sys/kernel/debug/s390/exceptions. [ hca@linux.ibm.com: Forward ported code, changed file location ] Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/configs: Enable cpuidle driver on s390Mete Durlu
Enable cpuidle infrastructure, idle governor and s390 cpuidle driver by default. They can be disabled via config options before compile or via setting cpuidle.off kernel commandline option. When cpuidle.off=1 set, given architecture's specific implementation is used as a fallback without any governor or idle state support. During runtime individual states of cpuidle driver can also be disabled via sysfs attributes: echo 1 > /sys/devices/system/cpu<N>/cpuidle/state<M>/disable Signed-off-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/idle: Introduce cpuidle for s390Mete Durlu
Introduce generic cpuidle driver on s390. Use a two stage approach to handle idle scenarios and use idle governor for idle stage selection. Two stages are, from shallow to deep, idle polling and enabled wait. Suggested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Loehle <christian.loehle@arm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390: Enable TIF_POLLING_NRFLAGMete Durlu
Enable TIF_POLLING_NRFLAG to support idle polling state in the upcoming cpuidle driver. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/tick: Remove CIF_NOHZ_DELAY flagMete Durlu
Remove obsolete tick delay heuristic [1]. The upcoming cpuidle driver handles frequent sleep/wakeup cycles more effectively. [1] https://lore.kernel.org/all/20090929122533.402715150@de.ibm.com/ Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Mete Durlu <meted@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Rafael J. Wysocki (Intel) <rafael@kernel.org> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/mm: Use set_pmd() / set_pud() for hugetlb pagetable entriesGerald Schaefer
hugetlb code is known to view all pagetable entries as PTEs, instead of corresponding upper levels like PMD or PUD. For s390, with different pagetable entry layout for different levels, this requires some conversion action under the hood. The converted PMD and PUD entries are then written via set_pte() function, but that might add some PTE-specific modifications. There is no functional problem with current code, and the clearing of _PAGE_UNUSED in set_pte(). Avoid future problems by using the set_pmd() and set_pud() functions instead. Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Reviewed-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390: Add build salt to the vDSOBastian Blank
The vDSO needs to have a unique build id in a similar manner to the kernel and modules. Use the build salt macro. Signed-off-by: Bastian Blank <waldi@debian.org> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/mm: Fix type mismatch in get_align_mask().Gerald Schaefer
Commit 86f48f922ba79 ("s390/mmap: disable mmap alignment when randomize_va_space = 0") introduced get_align_mask() with return type of 'int', while the target field 'info.align_mask' in struct vm_unmapped_area_info is 'unsigned long'. With currently used masks, this should not cause truncation issues, but fix it and return 'unsigned long' to avoid future problems. Fixes: 86f48f922ba79 ("s390/mmap: disable mmap alignment when randomize_va_space = 0") Cc: stable@vger.kernel.org # v6.9+ Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()Heiko Carstens
'level' is user space controlled and used to read from an array. Add the missing array_index_nospec() call to prevent speculative execution. Cc: stable@vger.kernel.org Fixes: 0d30871739ab ("s390/diag: Add memory topology information via diag310") Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Mete Durlu <meted@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-08arm64: dts: qcom: sm8250: Add memory-region for audio PDVinayak Katoch
Reserve memory region for audio PD dynamic loading and remote heap requirements. Add the required VMID list for memory ownership transfers. Signed-off-by: Vinayak Katoch <vinayak.katoch@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260619-sm8250-audio-v1-1-8a76e033e209@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-08m68k: coldfire: fix breakage of missed IO access updatesGreg Ungerer
Commit e1f3a00670d1 ("m68k: coldfire: use ColdFire specifc IO access in SoC code") incorrectly updated a couple of local IO access uses. They use "read8" when they should be using the new "mcf_read8". Fix them. This causes compile time breakage for two specific SoC types, the ColdFire 5235 and 5282. They got missed in original testing due to not having any defconfigs for these specific parts. Fixes: e1f3a00670d1 ("m68k: coldfire: use ColdFire specifc IO access in SoC code") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607040536.BiSGmESw-lkp@intel.com/ Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Greg Ungerer <gerg@linux-m68k.org>
2026-07-08perf/x86/amd/core: Avoid enabling BRS from the SVM reload pathSandipan Das
Branch Sampling (BRS) and Last Branch Record (LBR) are mutually exclusive hardware features, and users of both are tracked via cpuc->lbr_users. When SVM is toggled on a CPU, the host perf events are reprogrammed to update the HostOnly filter bit (set when virtualization is enabled, cleared when it is disabled). On PerfMonV2-capable processors, this reprogramming is performed by calling amd_pmu_enable_all() to rewrite the event selectors. However, amd_pmu_enable_all() also calls amd_brs_enable_all(), which enables BRS whenever cpuc->lbr_users > 0. Having active LBR events satisfies this gating on processors that have LBR but not BRS. The kernel then tries to set the BRS enable bit in DebugExtnCfg (MSR 0xc000010f). Since that bit is deprecated on such hardware, the write results in a #GP: Call Trace: <IRQ> amd_pmu_enable_all+0x1d/0x90 amd_pmu_disable_virt+0x62/0xb0 kvm_arch_disable_virtualization_cpu+0xa/0x40 [kvm] hardware_disable_nolock+0x1a/0x30 [kvm] __flush_smp_call_function_queue+0x9b/0x410 __sysvec_call_function+0x18/0xc0 sysvec_call_function+0x69/0x90 </IRQ> <TASK> asm_sysvec_call_function+0x16/0x20 RIP: 0010:cpuidle_enter_state+0xc4/0x450 ? cpuidle_enter_state+0xb7/0x450 cpuidle_enter+0x29/0x40 cpuidle_idle_call+0xf5/0x160 do_idle+0x7b/0xe0 cpu_startup_entry+0x26/0x30 start_secondary+0x115/0x140 secondary_startup_64_no_verify+0x194/0x19b </TASK> Fix this by ensuring that BRS is not enabled from the event selector reprogramming path even when cpuc->lbr_users > 0. Fixes: bae19fdd7e9e ("perf/x86/amd/core: Fix reloading events for SVM") Signed-off-by: Sandipan Das <sandipan.das@amd.com> Signed-off-by: Ingo Molnar <mingo@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://patch.msgid.link/702fa204d574b03d14e3664c7d4b201db048bbfd.1783506528.git.sandipan.das@amd.com
2026-07-08arm64: dts: xilinx: zynqmp-sck: Correct indentationKrzysztof Kozlowski
Correct spaces or mix of tabs+spaces into proper tab-indented lines. No functional impact (same DTB). Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Signed-off-by: Michal Simek <michal.simek@amd.com>
2026-07-08syscall_user_dispatch: Make it configurable in KconfigGregory Price
Syscall User Dispatch is presently built under CONFIG_GENERIC_SYSCALL and cannot be disabled independently. Add CONFIG_SYSCALL_USER_DISPATCH to make it an optional feature. Signed-off-by: Gregory Price <gourry@gourry.net> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260706140020.873735-2-gourry@gourry.net
2026-07-07arm64: dts: qcom: talos: Add passive polling-delay for gpu-thermal zoneHaritha S K
Introduce a passive polling delay to ensure more than one "passive" thermal point is considered when throttling the GPU thermal zone. Signed-off-by: Haritha S K <haritha.k@oss.qualcomm.com> Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260505-qcs615_gpu_cooling-v2-1-1ba42260b29d@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: purwa: Add Microsoft Surface Pro 12inHarrison Vanderbyl
Initial device tree for Microsoft Surface Pro 12in Currently supported: - UFS - Touchscreen - Pen - USB 3.2 x2 (DP Alt Mode) - Audio - Wifi - Bluetooth - CDSP - ADSP - GPU Not currently supported: - Accelerometer - Front, Back and IR cameras - IRIS video decoder Tested on Surface_Pro_12in_1st_Ed_with_Snapdragon_2110 Signed-off-by: Harrison Vanderbyl <harrison.vanderbyl@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260609145906.40854-2-harrison.vanderbyl@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: monaco-arduino-monza: Remove duplicate includesKonrad Dybcio
monaco-arduino-monza.dts includes monaco-monza-som.dtsi, which aleady includes monaco.dtsi and monaco-pmics.dtsi. Remove the duplicates. The resulting DTB file is identical. Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260617-topic-monza_includes-v1-1-fcef9ce489fb@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sm7325: Add Xiaomi 12 Lite 5G (taoyao) DTSStanislav Zaikin
Xiaomi 12 Lite 5G is a handset released in 2022 This commit has the following features working: - Display (with simple fb) - Touchscreen - UFS - Power and volume buttons - Pinctrl - RPM Regulators - Remoteprocs - wifi, bluetooth - USB (Device Mode) Signed-off-by: Stanislav Zaikin <zstaseg@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260608143329.252033-3-zstaseg@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: talos-evk-som: Enable Adreno 612 GPUJie Zhang
Enable GPU for talos-evk-som platform and provide path for zap shader. Signed-off-by: Jie Zhang <jie.zhang@oss.qualcomm.com> Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260427-talos-evt-gpu-v1-1-d40b6dffa108@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: kodiak: avoid EFI overlap for ADSP remote heapJianping Li
On KODIAK platforms boot can fail when the DT "adsp-rpc-remote-heap" reserved-memory region overlaps with firmware allocations (UEFI/EFI runtime). The kernel then reports failure to reserve the region and subsequent EFI runtime activity may trigger aborts. The remote heap node was described as a fixed "no-map" region, which turns it into a hard carveout. Replace it with a "shared-dma-pool" reserved memory region with reusable CMA-backed allocation, specifying alignment and size. This avoids hard carveouts and reduces the chance of conflicting with firmware memory maps while keeping an explicit pool for ADSP remote heap usage. Fixes: 90a58ffa9c55 ("arm64: dts: qcom: kodiak: Add memory region for audiopd") Cc: stable@kernel.org Signed-off-by: Jianping Li <jianping.li@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260429073443.2027-1-jianping.li@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sm8750: Add UART15Teguh Sobirin
Add uart15 node for the UART bus present on the sm8750 SoC. Signed-off-by: Teguh Sobirin <teguh@sobir.in> Signed-off-by: Aaron Kling <webgeek1234@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260605-sm8750-uart15-v1-1-93e660722e61@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: qcs615-ride: fix sdhc_2 vqmmc-supply for UHS-I modeMonish Chunara
SD card is detected as SDHS instead of UHS-I because sdhc_2 was configured with vreg_s4a as vqmmc-supply, which cannot switch between 1.8V and 3.3V. Switch vqmmc-supply to vreg_l2a and update its voltage range to 1800000-2960000 uV to enable proper UHS-I signaling. Signed-off-by: Monish Chunara <monish.chunara@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260522105020.3588377-1-mchunara@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sc8180x-lenovo-flex-5g: Describe the display power netKonrad Dybcio
Describe and wire up the power supplies for the eDP panel and its backlight. Previously, this was only working because of settings inherited from the bootloader. Fixes: 20dea72a393c ("arm64: dts: qcom: sc8180x: Introduce Lenovo Flex 5G") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-4-167785993231@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sc8180x-lenovo-flex-5g: Rename regulator nodesKonrad Dybcio
Align with the contemporary way of naming regulator nodes (regulator- prefix) in preparation for adding more of them. Reorder the renamed entries to match the expectations of the DT coding style doc. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-3-167785993231@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sc8180x-primus: Describe the display power netKonrad Dybcio
Describe and wire up the power supplies for the eDP panel and its backlight. Previously, this was only working because of settings inherited from the bootloader. Fixes: 2ce38cc1e8fe ("arm64: dts: qcom: sc8180x: Introduce Primus") Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-2-167785993231@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sc8180x-primus: Rename regulator nodesKonrad Dybcio
The nodes would be sorted correctly, if their names started with "regulator-" (which is the style used in the latest submissions). Touch that up. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260616-topic-8180_disp_power-v2-1-167785993231@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sm8650: fix soundwire ports propertiesNeil Armstrong
Since commit 9e53a66a2f2f ("soundwire: qcom: deprecate qcom,din/out-ports"), the ports are checked against the actul hardware configuration, leading to: qcom-soundwire 6ad0000.soundwire: din-ports (0) mismatch with controller (1) qcom-soundwire 6d30000.soundwire: dout-ports (0) mismatch with controller (1) Fix the ports count and properties of the corresponding soundwire controllers. Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20260615-topic-sm8650-upstream-cpu-props-v3-3-eeb6e9fa7581@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sm8650: add CPU cache size propertiesNeil Armstrong
Add the L1 cache size and its line size (cache-size and cache-line-size) with the corresponding L1-I cache and L1-D cache. L1 cache is unified, but clidr_el1 register (get_cache_type) tells that L1 cache is separated (CACHE_TYPE_SEPARATE), add i-cache-line-size and d-cache-line-size and cache-line-size of L3 cache is specified. All cache line sizes were confirmed by checking ccsidr_el1. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20260615-topic-sm8650-upstream-cpu-props-v3-2-eeb6e9fa7581@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sm8650: update the cpus capacity-dmips-mhzNeil Armstrong
After some more advanced benchmarks with Integer, Floaring Point, Encryption, Compression, NEON, ... on the A520, A720 and X4 cpus, the median gain with the same frequency range is: - 281% of A720 over A520 - 126% of X4 over A720 When adjusted with the frequency delta, we get better values describing the difference in capacity, showing the weakness of the A520 designed for very small tasks while the A720 and X4 are much more powerful. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Link: https://lore.kernel.org/r/20260615-topic-sm8650-upstream-cpu-props-v3-1-eeb6e9fa7581@linaro.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: qcm6490-fairphone-fp5: Add AW88261 amplifiersLuca Weiss
Add nodes for the two AW88261 amplifiers, for the top and bottom speakers of this phone. Hook them up to the sound card. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Co-developed-by: Bharadwaj Raju <bharadwaj.raju@machinesoul.in> Signed-off-by: Bharadwaj Raju <bharadwaj.raju@machinesoul.in> Signed-off-by: Luca Weiss <luca.weiss@fairphone.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260612-fp5-aw88261-v2-1-f7ef7d060170@fairphone.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: ipq9574: Add missing PCIe global IRQsKathiravan Thirumoorthy
IPQ9574 also has the dedicated 'global' IRQ line for each PCIe controller. Add the same. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260610-ipq9574_pcie_global_irq-v1-1-6d6333b95c43@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: defconfig: Enable Qualcomm BAM-DMUX WWAN driverVishnu Santhosh
Enable the BAM Data Multiplexer WWAN driver as a module to support modem data channels on Qualcomm Shikra SoC. The driver is also used by other platforms with A2 BAM hardware such as MSM8916 and MSM8939. Signed-off-by: Vishnu Santhosh <vishnu.santhosh@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260611-qcom-arm64-defconfig-bam-dmux-v1-1-599190f17fc9@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: sdm670-google: add lpi reserved gpiosRichard Acayan
Add reserved GPIOs for the Pixel 3a, which blocks access to the sensor GPIOs. The hunk in the original patch was dropped in the commit because it depended on an unapplied patch, which is now commit fe9f4a46895d ("arm64: dts: qcom: sdm670-google: add common device tree include"). Fixes: c4b423835ee7 ("arm64: dts: qcom: sdm670: add lpi pinctrl") Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260602021722.30760-1-mailingradian@gmail.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-07arm64: dts: qcom: ipq5424: Move PHYs and PERST# to Root Port nodeKathiravan Thirumoorthy
Follow the new binding style by defining PHYs and PERST# (now RESET#) under the Root Port node. Avoid mixing styles and move these properties to the RP node. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260609-move_perst_to_rp-v2-2-6c731523d08c@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-09 10:22:32 +0000