summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-07-30RISC-V: KVM: Add more arch-specific tracepointsYuhang.Chen
Add RISC-V KVM tracepoints for events that are useful when debugging guest exits and in-kernel emulation paths. The existing kvm_entry and kvm_exit tracepoints are kept, with the kvm_entry PC format fixed to use zero-padded hexadecimal output. The newly added tracepoints cover: - kvm_vcpu_exit for synchronous guest traps - kvm_vcpu_irq for VS-mode interrupt set/clear - kvm_mmio_emulate for MMIO load/store emulation kvm_vcpu_exit reports the full trap context (sepc/scause/stval/htval/ htinst) so userspace can filter by scause, and is placed after the interrupt early-return so it fires only for synchronous traps. kvm_vcpu_irq covers every set/unset_interrupt() caller from a single place. Example trace output: kvm_vcpu_exit: VCPU: 0, SEPC: 0x80200000, SCAUSE: 0x17, STVAL: 0x10000000, HTVAL: 0x4000000, HTINST: 0x2023 kvm_mmio_emulate: VCPU: 0, Store MMIO at 0x10000000, len 4, insn 0x2023, sepc 0x80200000 kvm_vcpu_irq: VCPU: 0, IRQ: 10, level: 1 Testing: A QEMU-based test program was used to exercise: - Guest page faults - MMIO emulation - IRQ injection Verified trace output generation for: - kvm_vcpu_exit - kvm_vcpu_irq - kvm_mmio_emulate Assisted-by: YuanSheng:deepseek-v4-pro Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Yuhang.Chen <yhchen312@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260730065711.3721489-1-yhchen312@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-30RISC-V: KVM: Mark the reset callback of FWFT extension always dirties CSRInochi Amaoto
As the CSR is only flushed when the csr_dirty is set, always set the csr_dirty field in kvm_sbi_ext_fwft_reset() so the CSR change can take effect immediately. This unconditional set should be safe as all supported FWFT features change the CSR state currently. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729232527.139183-5-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-30RISC-V: KVM: Reset the SBI extension when disable itInochi Amaoto
The SBI extension validation callback can only fix the parameter if the extension is enabled. However, if the extension is disabled after modifty some parameters, the state of the extension is still broken. Reset the extension when the extension is disabled so it can have a clear context. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729232527.139183-4-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-30RISC-V: KVM: Add SBI FWFT validation supportInochi Amaoto
Since the KVM SBI has extension parameters validation support, implement it for the SBI FWFT support. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729232527.139183-3-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-30RISC-V: KVM: Add SBI extension validate callbackInochi Amaoto
When user disable FWFT extension after setting any value of the FWFT feature, the state of vCPU will be broken since the value of disable FWFT feature is still functional. Add the generic SBI extension validate callback so the FWFT extension can fix its parameters before the first run. Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729232527.139183-2-inochiama@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29riscv: vdso: Only try to install vDSO when presentThomas Weißschuh
vdso.so.dbg is only built with CONFIG_MMU. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607090258.iSAUYlO1-lkp@intel.com/ Fixes: f157d411a9eb ("riscv: add missing vdso_install target") Fixes: 3edf39916977 ("vDSO, kbuild: Provide vDSO debug variants at runtime") Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Link: https://patch.msgid.link/20260709-riscv-install-vdso-v1-1-0ba4345419ca@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29riscv: mm: Fix out-of-bounds page-table walk during memory hot-removeKarl Mehltretter
remove_pud_mapping() and remove_p4d_mapping() obtain a child table base with pud_offset(p4dp, 0) and p4d_offset(pgd, 0), then add the index for addr. RISC-V folds page-table levels at runtime. When a level is folded, its offset helper returns the parent entry itself, but the index can still be nonzero. Adding it walks past the parent table. Sv48 folds P4D, while Sv39 folds both P4D and PUD, so memory hot-remove can descend into unrelated memory and pass an invalid page to __free_pages(). This can trigger: kernel BUG at include/linux/mm.h:1810! VM_BUG_ON_PAGE(page_ref_count(page) == 0) arch_remove_memory+0x1e/0x5c try_remove_memory+0x15e/0x200 remove_memory+0x24/0x3c Only add the index when the corresponding page-table level is enabled, matching p4d_offset() and pud_offset(). Fixes: c75a74f4ba19 ("riscv: mm: Add memory hotplugging support") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Link: https://patch.msgid.link/20260729012132.24882-1-kmehltretter@gmail.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29ARM: dts: BCM5301X: EA9200: fix NVRAM sizeRosen Penev
Fixes: [ 0.182121] WARNING: CPU: 0 PID: 1 at drivers/nvmem/brcm_nvram.c:85 brcm_nvram_probe+0x400/0x480 [ 0.182159] Unexpected (big) NVRAM size: 1056112 B Fixes: 90a77291ac09 ("ARM: dts: BCM5301X: R8000 add NVRAM with MAC address for WAN port") Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://lore.kernel.org/r/20260628231049.1248899-1-rosenp@gmail.com Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2026-07-29ARM: dts: BCM5301X: fix PCIe controller 2 second interruptRosen Penev
PCIe controller 2 has interrupts 0-4 mapping to GIC SPI 138-142. The mapping for interrupt 1 was incorrectly set to 138 due to a copy-paste error. Fix it to 139. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev <rosenp@gmail.com> Link: https://lore.kernel.org/r/20260725215722.9323-1-rosenp@gmail.com Fixes: 3b3e35b279be ("ARM: dts: BCM5301X: Relicense AXI interrupts code to the GPL 2.0+ / MIT") Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2026-07-30s390/configs: Increase CONFIG_LOCKDEP_CHAINS_BITSChristian Borntraeger
With btrfs and other complex code paths the message BUG_MAX_LOCKDEP_CHAIN_HLOCKS_TOO_LOW is triggered. To avoid disabling lockdep increase CONFIG_LOCKDEP_CHAINS_BITS to 18. Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390: Add support for DCACHE_WORD_ACCESS (again)Heiko Carstens
Implement load_unaligned_zeropad() and enable DCACHE_WORD_ACCESS to speed up string operations in fs/dcache.c and fs/namei.c. With the secure storage access exception cases addressed, add support for DCACHE_WORD_ACCESS again. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Use goto statement in do_secure_storage_access()Heiko Carstens
Make do_secure_storage_access() look more like the do_exception() by using a goto statement to get rid of an extra open coded mmap_read_unlock() call. Just cosmetic, no functional change. Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Use handle_fault_error() in do_secure_storage_access()Heiko Carstens
Similar to the normal exception handler use handle_fault_error() which handles accesses from user space and kernel space differently. This also addresses failing kernel accesses via e.g. copy_from_user() to user space: instead of an endless loop, the fixup handling is performed. Even though this could only happen if arch_make_folio_accessible() would permanently fail, which is not realistic. Therefore this is rather a cleanup patch. Acked-by: Vasily Gorbik <gor@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Remove folio handling for kernel faults in do_secure_storage_access()Heiko Carstens
Remove folio handling for secure storage access exceptions that happen via the kernel mapping. Using folio_try_get() for exceptions via the kernel mapping is racy: for example such an exception may happen on one CPU, while a different CPU frees the corresponding page. Subsequently the page can be part of a folio of different size, before the faulting CPU executes folio_try_get(). This may lead to data corruption. As of now this scenario does not seem to be possible, however with the upcoming load_unaligned_zeropad() this is possible. As a side effect PG_arch_1 is not cleared anymore for such faults via the kernel mapping. However given that this bit is over-indicating it shouldn't matter. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Fix handling of vmalloc area in do_secure_storage_access()Heiko Carstens
Secure storage access exceptions in vmalloc area need to be handled separately since virt_to_phys() does not work on such addresses. Given that there cannot be a valid access let such exceptions fail immediately. The kernel will either fixup or crash. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> --- Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Use lock_mm_and_find_vma() in do_secure_storage_access()Heiko Carstens
do_secure_storage_access() uses find_vma() without verifying that the faulting address is within the returned vma. Add this missing check by converting to lock_mm_and_find_vma(). This is not a critical fix, since the worst that could happen is a WARN_ON_ONCE() in folio_walk_start(). Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/ Link: https://lore.kernel.org/all/20260717093904.E4A421F00A3E@smtp.kernel.org/ Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/mm: Add missing mm check to do_secure_storage_access()Heiko Carstens
Similar like the normal exception handler the secure storage access exception handler needs to verify if mm is not NULL, which may happen with kernel threads. Reported-by: sashiko-bot <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260717132345.539A11F00A3A@smtp.kernel.org/ Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>> --- Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30KVM: s390: pv: Use VM_SPARSE area for guest variable storage areaHeiko Carstens
The guest variable storage area is allocated with vmalloc and then donated to the ultravisor. Any kernel access to that area will result in a secure storage access exception (aka fault). This is a problem if such a memory area is read via /proc/kcore. This causes an exception via vread_iter() and results in an unexpected short read. Avoid this by allocating a custom VM_SPARSE area. If such an area is read, vread_iter() returns zeroes for the entire area. Note that the function which frees the area does not update ptes. This is intentional to allow for deferred / lazy pte updates and TLB flushing like the generic vfree() code is doing that. See vunmap_pte_range(). This assumes that s390 will gain full support for lazy_mmu_mode_enable() and lazy_mmu_mode_disable() in the future, since as of now the used ptep_get_and_clear() in vunmap_pte_range() does indeed invalidate and flush every single pte entry, but only for s390. Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/spinlock: Add contention tracepoints to lock slowpathCiunas Bennett
Instrument arch_spin_lock_wait() with trace_contention_begin() and trace_contention_end(). These tracepoints are used by lock contention analysis tools such as perf lock contention to identify contended locks and measure wait times. Both the generic implementation and powerpc emit the same events from their spinlock slow path. Place the tracepoints in arch_spin_lock_wait(), which is only entered when lock acquisition falls back to the contention path. Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Ciunas Bennett <ciunas@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/ipl: Improve readabilityMete Durlu
Use explicit decleration on all shutdown_action/shutdown_trigger declerations and reformat shutdown_actions_list decleration to improve readability. No functional changes. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/ipl: Use ARRAY_SIZE macroMete Durlu
Use ARRAY_SIZE macro instead of reimplementing it. Signed-off-by: Mete Durlu <meted@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/maccess: Use proper PTE accessors for copying old memoryAlexander Gordeev
Follow the pattern established by commit c33c794828f2 ("mm: ptep_get() conversion") and use proper PTE accessors instead of a direct pointer dereference in memcpy_real_iter(). Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/vdso: Use symbolic constants for the PHDR permission flagsJens Remus
While at it explicitly specify GNU_EH_FRAME PHDR to be read-only. Inspired by x86 commit 8717b02b8c03 ("x86/entry/vdso: Include GNU_PROPERTY and GNU_STACK PHDRs"). Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/vdso: Pass --eh-frame-hdr to the linkerJens Remus
Commit 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") accidentally broke the GNU_EH_FRAME program table entry in the vDSO, causing it to be empty: $ readelf --program-headers arch/s390/kernel/vdso/vdso.so ... Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align ... GNU_EH_FRAME 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x8 ... Originally, the compiler would implicitly add --eh-frame-hdr when invoking the linker, but when this Makefile was converted from invoking the linker via the compiler, to invoking it directly, the option was missed. This is the s390 variant of x86 commit cd01544a268a ("x86/vdso: Pass --eh-frame-hdr to the linker"). Fixes: 2b2a25845d53 ("s390/vdso: Use $(LD) instead of $(CC) to link vDSO") Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/syscalls: Use define instead of '1' to indicate PER trapSven Schnelle
Make the code a bit easier to read by defining SYSCALL_PER_TRAP instead of passing '1' to __do_syscall(). Suggested-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/traps: Remove PIF_GUEST_FAULTSven Schnelle
PIF_GUEST_FAULT is only used to pass information whether a fault was caused when executing SIE or when executing host code. Instead of using ptregs for this, just pass the flag directly as argument to __do_pgm_check(). This also saves the time required to read the flag from ptregs, although this likely isn't much as it is already in the data cache. Signed-off-by: Sven Schnelle <svens@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/uapi: Remove obsolete unistd_32.h from Kbuild fileThomas Huth
unistd_32.h is not build anymore since commit 4ac286c4a8d90 ("s390/syscalls: Switch to generic system call table generation"). Thus drop the superfluous line from the Kbuild file now, too. Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390: Select SWIOTLB_DYNAMIC and DMA_COHERENT_POOLJaehoon Kim
SWIOTLB_DYNAMIC allows the SWIOTLB to grow on demand when the initial bounce-buffer area is exhausted, instead of relying only on the pool reserved at boot. This improves behavior under sustained I/O pressure. In testing, exhaustion of the initial SWIOTLB area was observed under real workloads such as large file transfers and package installation workloads, where continued availability of bounce buffering was needed to avoid guest-visible I/O stalls or failures. When the current SWIOTLB capacity is exhausted, the dynamic expansion path schedules asynchronous pool growth and then attempts immediate non-blocking allocation of transient bounce-buffer memory. In that path, the current implementation uses the generic DMA coherent atomic pool for transient bounce-buffer allocations. Selecting DMA_COHERENT_POOL together with SWIOTLB_DYNAMIC on s390 makes that atomic fallback path available. The coherent atomic pool is a generic DMA facility. By default, its size is 128 KiB per 1 GiB of memory, with a minimum default size of 128 KiB, and it can be adjusted with the coherent_pool= kernel parameter. The pool itself can be exhausted, so this improves behavior under pressure, but does not guarantee that DMA mappings will always succeed. Select both options from s390 Kconfig so this support is available by default on s390 systems. Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com> Acked-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Joshua Daley <jdaley@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-30s390/pv: Enable SWIOTLB_ANY for s390 PVJaehoon Kim
In s390 protected virtualization (PV) environments, guests use SWIOTLB for virtio DMA. Because SWIOTLB_ANY is currently not passed to swiotlb_init(), the SWIOTLB buffer is allocated from low memory, i.e. from the first 2G of the physical address space on s390. This restriction is unnecessary for s390 PV guests and limits the available address range for the SWIOTLB buffer. In turn, that can limit the maximum practical SWIOTLB size and make larger allocations more likely to fail at boot, especially under memory fragmentation. Pass SWIOTLB_ANY in pv_init() so the SWIOTLB buffer can be allocated from any suitable memory instead of being restricted to low memory. Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com> Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Halil Pasic <pasic@linux.ibm.com> Tested-by: Joshua Daley <jdaley@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-29KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is activeSean Christopherson
Always update x2APIC MSR intercepts for L1 when AVIC is deactivated, even if L2 is active and KVM is using a separate MSR bitmap to run L2. If AVIC is fully enabled prior to running L2, and is then inhibited while L2 is active (for a VM-scoped inhibit), then KVM will run L1 with AVIC disabled, but with x2APIC MSR intercepts disabled, i.e. will allow L1 to read most of the host's APIC state, send arbitrary interrupts, change task priority, and ultimately trivially DoS the host. E.g. sending a self-IPI in L1 on HYPERV_REENLIGHTENMENT_VECTOR, 0xee, with CONFIG_HYPERV=n in the host kernel as a "safe" PoC, yields: Spurious interrupt (vector 0xee) on CPU#425. Acked And hacking KVM to abuse kvm_set_posted_intr_wakeup_handler() to register a handler and WARN on POSTED_INTR_WAKEUP_VECTOR yields: ------------[ cut here ]------------ WARNING: arch/x86/kvm/svm/svm.c:5594 at pi_wakeup_handler+0x9/0x10 [kvm_amd], CPU#156: nested_x2apic_t/316940 CPU: 156 UID: 0 PID: 316940 Comm: nested_x2apic_t Tainted: G S U Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER Hardware name: Google Astoria-Turin/astoria, BIOS 0.20260209.0-0 02/09/2026 RIP: 0010:pi_wakeup_handler+0x9/0x10 [kvm_amd] Call Trace: <IRQ> sysvec_kvm_posted_intr_wakeup_ipi+0x64/0x80 </IRQ> <TASK> asm_sysvec_kvm_posted_intr_wakeup_ipi+0x1a/0x20 RIP: 0010:vcpu_run+0x1430/0x1e40 [kvm] kvm_arch_vcpu_ioctl_run+0x2c1/0x600 [kvm] kvm_vcpu_ioctl+0x580/0x6b0 [kvm] __se_sys_ioctl+0x6d/0xb0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x46ff4b </TASK> ---[ end trace 0000000000000000 ]--- Fixes: 091abbf578f9 ("KVM: x86: nSVM: optimize svm_set_x2apic_msr_interception") Cc: stable@vger.kernel.org Cc: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Link: https://patch.msgid.link/20260729213558.639074-1-pbonzini@redhat.com/ Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-07-29arm64: dts: qcom: eliza: Describe the ADSP GPR nodeAbel Vesa
Describe the ADSP Generic Packet Router (GPR) devicetree node as part of audio subsystem on Qualcomm Eliza SoC. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-dts-qcom-eliza-add-gpr-v3-1-2595beb0cdec@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-29arm64: dts: qcom: eliza-evk: Add support for USB and SD cardAbel Vesa
Even though the EVK comes with 3 Type-C ports, the Eliza EVK only has one USB controller and a single set of PHYs, which are connected to the port marked as JUSB. Also, the EVK comes with an SD card slot. So describe the PMIC GLINK node, the connector graph, the PHYs and repeater supplies and enable the USB controller. Also enable the second SD host controller, describe the card detect GPIO and the board specific supplies. Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-dts-qcom-eliza-cqs-evk-enable-usb-sdcard-v3-1-eadf9da69226@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-29arm64: dts: qcom: eliza: Fix DSI1 phy reference clock rateKrzysztof Kozlowski
The DSI PHY CXO clock input is the SoC CXO divided by two. DSI0 already uses correct one, but DSI1 got copy-paste from SM8750, which had same problem and copy-pasted code from SM8650. Wrong clock parent will cause incorrect DSI1 PHY PLL frequencies to be used making the DSI panel non-working, although there is no upstream user of DSI1. Fixes: 159d252ed800 ("arm64: dts: qcom: eliza: Add display (MDSS) with Display CC") Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260713125837.727632-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-29arm64: dts: qcom: eliza: Enable cpufreq cooling devicesHaritha S K
Add cooling-cells property to the CPU nodes to support cpufreq cooling devices. Signed-off-by: Haritha S K <haritha.k@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260724-eliza-cpufreq-v1-1-38f01e47f0f1@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-07-29x86/CPU/AMD: Carve out a Zen5 models rangePratik Vishwakarma
Family 0x1a, model 0xd0..0xd7 belongs to the Zen5 generation. Carve it out from the larger, Zen6 range where former doesn't belong. [ bp: Rewrite commit message, add tags. ] Fixes: b5f53e6d3d32 ("x86/CPU/AMD: Add more Zen6 models") Signed-off-by: Pratik Vishwakarma <Pratik.Vishwakarma@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Cc: <stable@kernel.org> Link: https://patch.msgid.link/20260729055459.15904-1-Pratik.Vishwakarma@amd.com
2026-07-29riscv: drop __init from vec_check_unaligned_access_speed_all_cpusAnirudh Srinivasan
This function runs within a kthread and need not necessarily finish before system finishes boot and free_initmem() unmaps the .init.text section. This function makes calls to SBI for probing unaligned access speed, and if this is slow for some reason (say some debug prints were added to SBI), the kthread can still be running at this point and result in an instruction page fault when trying to fetch from the freed region. [ 25.642087] Unable to handle kernel paging request at virtual address ffffffff80a04ef8 [ 25.646694] Current vec_check_unali pgtable: 4K pagesize, 48-bit VAs, pgdp=0x00004000316e9000 [ 25.653170] [ffffffff80a04ef8] pgd=000010004be7e401, p4d=000010004be7e401, pud=000010004be7e001, pmd=000010000c3000e3 [ 25.661244] Oops [#1] [ 25.662997] Modules linked in: [ 25.665357] CPU: 3 UID: 0 PID: 42 Comm: vec_check_unali Not tainted 7.0.0-tt-blackhole-asrinivasan-00007-g30ff73f18211 #570 PREEMPTLAZY [ 25.674669] Hardware name: Tenstorrent Blackhole (DT) [ 25.678545] epc : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.683458] ra : vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.688372] epc : ffffffff80a04ef8 ra : ffffffff80a04ef8 sp : ffff8f8000203e20 [ 25.693874] gp : ffffffff814dc168 tp : ffffaf8001ad9900 t0 : 0000000000000000 [ 25.699401] t1 : fffffffffffffff0 t2 : ffffaf8001ad9a10 s0 : ffff8f8000203e30 [ 25.704912] s1 : ffffaf80018dc780 a0 : 0000000000000000 a1 : 0000000000000002 [ 25.710407] a2 : 00000000000001f0 a3 : 0000000000000018 a4 : 0000000000000000 [ 25.715917] a5 : 0000000000000000 a6 : ffffaf8001c03d98 a7 : ffffaf8001c03e30 [ 25.721419] s2 : ffff8f8000023c98 s3 : ffffaf8001aa1240 s4 : ffffffff80a04ee0 [ 25.726937] s5 : 0000000000000000 s6 : 0000000000000000 s7 : 0000000000000000 [ 25.732450] s8 : 0000000000000000 s9 : 0000000000000000 s10: 0000000000000000 [ 25.737944] s11: 0000000000000000 t3 : 0000000000000002 t4 : 0000000000000402 [ 25.743481] t5 : 0000000000000040 t6 : 0000000000000004 ssp : 0000000000000000 [ 25.749024] status: 0000000200000120 badaddr: ffffffff80a04ef8 cause: 000000000000000c [ 25.755060] [<ffffffff80a04ef8>] vec_check_unaligned_access_speed_all_cpus+0x18/0x2c [ 25.760964] [<ffffffff80047a10>] kthread+0xd8/0xfc [ 25.764660] [<ffffffff80010c48>] ret_from_fork_kernel+0x18/0x1c4 [ 25.769220] [<ffffffff80895fe6>] ret_from_fork_kernel_asm+0x16/0x18 [ 25.774018] Code: cccc cccc cccc cccc cccc cccc cccc cccc cccc cccc (cccc) cccc Drop __init from its signature so that this doesn't happen. Fixes: a00e022be531 ("riscv: Annotate unaligned access init functions") Signed-off-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Assisted-by: Claude:claude-opus-4-6 Link: https://patch.msgid.link/20260612-vec_unaligned_drop_init-v1-1-df969210ae34@oss.tenstorrent.com Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29riscv: mm: fix SWIOTLB initialization for systems with DRAM above 4GBTroy Mitchell
On RISC-V platforms where the entire physical memory (DRAM) resides above the 32-bit address space (i.e., above dma32_phys_limit), the current SWIOTLB initialization logic fails. This patch addresses two interconnected issues on such platforms: 1. Incorrect 32-bit DMA bounce assumption: The existing condition `max_pfn > PFN_DOWN(dma32_phys_limit)` assumes that a 32-bit DMA bounce buffer is required simply because the maximum PFN exceeds the 32-bit limit. However, if all DRAM starts above 4GB, no memory exists below the limit to satisfy this allocation. Fix this by adding a check to ensure `memblock_start_of_DRAM()` is actually below the 32-bit limit before enforcing 32-bit SWIOTLB. 2. kmalloc() bounce buffer allocation failure on non-coherent systems: For non-coherent DMA, kmalloc() buffers whose sizes are not cache-line-aligned still require bouncing, even if 32-bit DMA bouncing is skipped. Without the `SWIOTLB_ANY` flag, swiotlb_init() defaults to allocating from low memory, which fails completely when DRAM only exists in high memory. By appending `SWIOTLB_ANY` to swiotlb_flags, the allocator is permitted to allocate this bounce buffer from high memory. With this patch, systems with non-coherent DMA and DRAM entirely above 4GB can successfully map the software IO TLB in high memory and boot normally. Tested-by: Anirudh Srinivasan <asrinivasan@oss.tenstorrent.com> Signed-off-by: Troy Mitchell <troy.mitchell@linux.dev> Link: https://patch.msgid.link/20260727-fix-riscv-swiotlb-v3-1-59479b23736c@linux.dev Reviewed-by: Drew Fustini <fustini@kernel.org> Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29riscv/sifive: remove warning in errataYong-Xuan Wang
The alternative patching of sifive vendor extensions also calls the sifive_errata_patch_func(), but the patch_id of the vendor extension (ext + RISCV_VENDOR_EXT_ALTERNATIVES_BASE) is always larger than ERRATA_SIFIVE_NUMBER. Remove this unnecessary warning. Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Link: https://patch.msgid.link/20260503-sifive_errata-v1-1-6f12a81bc267@sifive.com [pjw@kernel.org: drop unnecessary braces] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29riscv: time: Add missing __iomem in get_cycles() and get_cycles_hi()Nam Cao
__iomem is missing while calling readl_relaxed() in get_cycles() and get_cycles_hi() and sparse complains. Add __iomem to silence the sparse warnings. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607160619.14G8GHp5-lkp@intel.com/ Signed-off-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260716053319.2178937-1-namcao@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-07-29RISC-V: KVM: Use try_cmpxchg for IMSIC MRIF RMWYicong Yang
Currently the RMW for IMSIC MRIF is implemented with word LRSC loop. This will only cover the lower 32bit on a 64bit system. Instead of guard the implementation with CONFIG_64BIT here, use try_cmpxchg() wrapper which has already take care this to fix this issue. It can also use AMO instructions on supported system. Fixes: db8b7e97d613 ("RISC-V: KVM: Add in-kernel virtualization of AIA IMSIC") Signed-off-by: Yicong Yang <yang.yicong@picoheart.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260728141938.95845-1-yang.yicong@picoheart.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29arm64: dts: rockchip: Add EmbedFire LubanCat 4 boardPufan Jin
Add device tree for the EmbedFire LubanCat 4 single board computer, featuring the Rockchip RK3588S SoC. Supported peripherals: - UART2 debug console - RK806 SPI PMIC with the full regulator tree, and RK8602/RK8603 fan53555-family supplies for the big CPU cluster and NPU - eMMC (HS400 enhanced strobe) and SD card (UHS SDR104) - GMAC1 with RGMII PHY on MDIO1 (Realtek RTL8211F, described via the generic clause-22 compatible) - HDMI0 output through hdptxphy0 and VOP2 - PCIe 2.0 x1 (mini PCIe slot) via combphy0_ps - USB 2.0 host ports and one USB 3.0 host port - HYM8563 RTC on I2C0 - On-board heartbeat LED and PWM fan header Tested on hardware: gmac1 negotiates 1000Mbps/Full duplex with phy-mode = "rgmii" (Realtek RTL8211F PHY, PCB provides ~2ns clock skew on both TXC and RXC). Signed-off-by: Pufan Jin <2254650260@qq.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> #for gmac1 + mdio1 Link: https://patch.msgid.link/tencent_D22A164B3AEEA50562C1EC988862BA827A09@qq.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29RISC-V: KVM: Widen G-stage fault address to gpa_tBingyu.Xian
fault_addr in gstage_page_fault() and the fault_addr parameter of kvm_riscv_vcpu_mmio_load/store() are unsigned long. On RV32 with Sv32x4, guest physical addresses are 34 bits, so a 32-bit unsigned long truncates bits 32/33 at two points: - reconstruction: fault_addr = (trap->htval << 2) | ... is evaluated in 32-bit arithmetic, dropping bits 32/33 before widening; - the MMIO handler call: even with the local widened, the handler's unsigned long parameter narrows it back to 32 bits, aliasing accesses above 4 GB into the low 4 GB. Widen fault_addr to gpa_t end to end: the local in gstage_page_fault(), the (gpa_t) cast before the <<2 shift, and the fault_addr parameters of kvm_riscv_vcpu_mmio_load/store(). The handlers' internal uses (run->mmio.phys_addr is __u64, kvm_io_bus_read/write() take gpa_t) are already 64-bit, so no further changes are needed. Also in preparation for sharing a common struct kvm_page_fault across architectures, where fault_addr is gpa_t. No functional change on RV64. Fixes: 9d05c1fee837 ("RISC-V: KVM: Implement stage2 page table programming") Assisted-by: YuanSheng: deepseek-v4-pro Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Bingyu Xian <shanbeeyoo@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729120733.829457-4-shanbeeyoo@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29RISC-V: KVM: Use unsigned int for vma_pageshiftBingyu.Xian
vma_pageshift in kvm_riscv_mmu_map() was declared short. Use unsigned int, the conventional kernel type for bit widths and shift counts, in preparation for sharing a common struct kvm_page_fault across architectures. No functional change. Assisted-by: YuanSheng: deepseek-v4-pro Co-developed-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Quan Zhou <zhouquan@iscas.ac.cn> Signed-off-by: Bingyu Xian <shanbeeyoo@gmail.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260729120733.829457-3-shanbeeyoo@gmail.com Signed-off-by: Anup Patel <anup@brainfault.org>
2026-07-29arm64: tegra: Add EL2 virtual timer interrupt for Tegra194Jon Hunter
Commit d87773de9efe ("clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE") updated the ARM arch timer driver to use the virtual timer by default if the CPU is running at EL2 with VHE enabled. If the CPU is running at EL2 with VHE enabled but there is no interrupt provided for the virtual timer, then the following warning is displayed: arch_timer: [Firmware Bug]: VHE-capable CPU without EL2 virtual timer interrupt This warning is observed on Tegra194 platforms. Tegra194 SoC includes NVIDIA Carmel ARM v8.2 CPUs and support an EL2 virtual timer. Fix the above warning by adding the PPI for the EL2 virtual timer interrupt for Tegra194. Fixes: 5425fb15d8ee ("arm64: tegra: Add Tegra194 chip device tree") Signed-off-by: Jon Hunter <jonathanh@nvidia.com> Signed-off-by: Thierry Reding <treding@nvidia.com>
2026-07-29arm64: dts: rockchip: Keep rk3399-roc-pc-plus work LED onFabio Estevam
The rk3399-roc-pc-plus inherits the work LED heartbeat trigger from the common rk3399-roc-pc.dtsi. On the rk3399-roc-pc-plus this LED is the prominent blue front-panel status LED. Blinking it continuously is distracting for a PC-style board. The usual default is a steady power/status indication while the system is running. Use the default-on trigger for this board instead. This keeps the LED useful as a simple running indicator and still lets userspace select a different trigger or turn it off after boot. Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260717010736.578419-3-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29arm64: dts: rockchip: Enable wireless on rk3399-roc-pc-plusFabio Estevam
The rk3399-roc-pc-plus board has an Ampak AP6256 Wi-Fi/Bluetooth module. Describe the Wi-Fi function on SDIO0 and the Bluetooth function on UART0. Add the Bluetooth wake and shutdown pinctrl entries, enable SDIO0 as a non-removable SDIO device, and add the power sequencing delays needed by the module. The module uses the RK808 CLKOUT2 output as its 32 kHz low-power clock. Drop the duplicate HYM8563 clock-output-names property and remove the same clock from the SDIO power sequencer so the Bluetooth node can request the shared LPO clock directly. Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260717010736.578419-2-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29arm64: dts: rockchip: Fix rk3399-roc-pc-plus analog audioFabio Estevam
The ES8388 sound card on the rk3399-roc-pc-plus fails to probe because i2s1 cannot claim its MCLK pin: pinctrl: pin gpio4-0 already requested by ff880000.i2s; cannot claim for ff890000.i2s pinctrl: error -EINVAL: pin-128 (ff890000.i2s) pinctrl: error -EINVAL: could not request pin 128 (gpio4-0) from group i2s-8ch-mclk-pin on device rockchip-pinctrl GPIO4_A0 is routed as SCLK_I2S_8CH_OUT and is used by i2s1 as the external MCLK for the ES8388 codec. The board dts already removes GPIO4_A0 from the i2s0_8ch_bus pin group, but i2s0 still claims the same pin through its bclk_off state. Since the i2s driver requests both states, this blocks i2s1 pinctrl setup and leaves the simple-audio-card deferred with a parse error. Override i2s0_8ch_bus_bclk_off as well, matching the existing i2s0_8ch_bus override, so GPIO4_A0 is left for i2s1/ES8388 audio. Cc: stable@vger.kernel.org Fixes: 6d9a7bd6a13c ("arm64: dts: rockchip: add support for Firefly ROC-RK3399-PC-PLUS") Signed-off-by: Fabio Estevam <festevam@nabladev.com> Link: https://patch.msgid.link/20260717010736.578419-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29arm64: dts: rockchip: Add CSI-2 bus type to ROCK 5B+ camera overlaysFabio Estevam
The Rockchip RK3568 MIPI CSI-2 receiver binding requires the bus-type property in its input endpoint. Specify that the Radxa CAM4K modules connected to CSI2 and CSI4 use a MIPI CSI-2 D-PHY bus. This fixes the following dtbs_check warning: endpoint: 'bus-type' is a required property Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260727174007.2581714-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29arm64: dts: rockchip: Drop data-mapping from Engicam PX30 CoreFabio Estevam
The panel-simple schema only allows data-mapping overrides for panels whose mapping is not fixed by their compatible. Consequently, the property on the Ampire AM-1280800N3TZQW-T00H panel fails validation: (ampire,am-1280800n3tzqw-t00h): False schema does not allow ['vesa-24'] The panel descriptor already selects 8 bits per color and MEDIA_BUS_FMT_RGB888_1X7X4_SPWG. The DRM OF helpers translate "vesa-24" to that exact bus format, and panel-simple falls back to the descriptor's format when the property is absent. Removing the property therefore has no functional effect. Drop the redundant property to satisfy the binding. Signed-off-by: Fabio Estevam <festevam@gmail.com> Link: https://patch.msgid.link/20260727175502.2585290-1-festevam@gmail.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-07-29Merge tag 'cix-dt-v7.3-rc1' of https://github.com/cixtech/linux-mainline ↵Arnd Bergmann
into soc/dt dt: add DMA-350 support for Sky1 * tag 'cix-dt-v7.3-rc1' of https://github.com/cixtech/linux-mainline: arm64: dts: cix: add sky1 DMA-350 node with channel IRQ entries Signed-off-by: Arnd Bergmann <arnd@arndb.de>
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-20 22:43:38 +0000