summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-06-25KVM: x86/mmu: move remaining permission fields to struct kvm_pagewalkPaolo Bonzini
As promised, this removes the remaining instances of container_of(w, struct kvm_mmu, w), meaning that struct kvm_pagewalk's definition is pretty much complete. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: change CPU-role accessor fields to take struct kvm_pagewalkPaolo Bonzini
With this change, walk_addr_generic and its callees do not need to use container_of() anymore. There are only two remaining occurrences of container_of, in permission_fault() and kvm_mmu_refresh_passthrough_bits(). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: move CPU-related fields to struct kvm_pagewalkPaolo Bonzini
struct kvm_pagewalk's behavior depends on the CPU state and its page format. Move related fields so that walk_mmu remains self contained. Note that for now, some of the accessors still use kvm_mmu to split the churn. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: move inject_page_fault to struct kvm_pagewalkPaolo Bonzini
Injection of page faults is also part of accesses to guest page tables; in particular, __kvm_inject_emulated_page_fault() calls it on walk_mmu. Move it to struct kvm_pagewalk as part of converting walk_mmu to a struct kvm_pagewalk. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: move get_pdptr to struct kvm_pagewalkPaolo Bonzini
Continue with yet another callback used in FNAME(walk_addr_generic), as another step towards removing container_of() from there. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: move gva_to_gpa to struct kvm_pagewalkPaolo Bonzini
gva_to_gpa is the main entry point into walk_mmu, which is only used for guest page table walking (as opposed to building the page tables). Moving gva_to_gpa to struct kvm_pagewalk is a step towards making walk_mmu a struct kvm_pagewalk, and removes several uses of struct kvm_mmu in x86.c. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: move get_guest_pgd to struct kvm_pagewalkPaolo Bonzini
Start moving page walking functionality out of kvm_mmu; the easiest target is the callbacks. Change the kvm_mmu_get_guest_pgd() wrapper to take a struct kvm_pagewalk too, avoiding the MMU indirection (and associated container_of) whenever the caller already has one. All container_of uses need to go before nested_mmu can be changed to a struct kvm_pagewalk, signifying that it is not used to build page tables. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/mmu: introduce struct kvm_pagewalkPaolo Bonzini
In preparation for separating walking and building of page tables, introduce a dummy struct kvm_pagewalk and pass it around instead of its containing kvm_mmu to functions that do not build the page tables. Outermost functions retrieve the mmu via container_of, while internal functions can pass around the struct kvm_pagewalk pointer. x86.c is still mostly oblivious to the existence of struct kvm_pagewalk, with are only a couple exceptions for now, but the plan is for it to use struct kvm_pagewalk whenever dealing with guest page tables and have only limited knowledge of struct kvm_mmu. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25KVM: x86/hyperv: remove unnecessary mmu_is_nested() checkPaolo Bonzini
Just always go through kvm_translate_gpa(), which will either invoke the vendor check or just return hc->ingpa back. This is a better way to fix the issue of commit 464af6fc2b1d ("KVM: x86: check for nEPT/nNPT in slow flush hypercalls", 2026-05-03). Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-25LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K2000Hongliang Wang
Add missing clocks and clock-frequency properties to i2c nodes for LS2K2000. Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K1000Hongliang Wang
Add missing clocks and clock-frequency properties to i2c nodes for LS2K1000. Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K0500Hongliang Wang
Add missing clocks and clock-frequency properties to i2c nodes for LS2K0500. Signed-off-by: Hongliang Wang <wanghongliang@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: BPF: Inline bpf_get_smp_processor_id() helperTiezhu Yang
The pointer to thread_info is always available in the $tp register, so the call to bpf_get_smp_processor_id() can be inlined into a single load instruction. (1) Here is the sample test.c: #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("raw_tp/sys_enter") int test_cpuid(void *ctx) { return bpf_get_smp_processor_id(); } char _license[] SEC("license") = "GPL"; (2) Here are the test steps: sudo yum install libbpf-devel kernel-devel bpftool clang -target bpf -O2 -c test.c -o test.o sudo sysctl -w net.core.bpf_jit_enable=1 sudo bpftool prog show name test_cpuid sudo rm -f /sys/fs/bpf/test_cpuid sudo bpftool prog load test.o /sys/fs/bpf/test_cpuid ID=$(sudo bpftool prog show pinned /sys/fs/bpf/test_cpuid | grep -oE '^[0-9]+') sudo bpftool prog dump jited id $ID (3) Here are the test results: Before: 6 instructions ... 64: lu12i.w $t1, 1213 68: ori $t1, $t1, 1680 6c: lu32i.d $t1, 0 70: lu52i.d $t1, $t1, -1792 74: jirl $ra, $t1, 0 78: move $a5, $a0 ... After: 1 instruction ... 64: ld.wu $a5, $tp, 16 ... This is similar with commit 2ddec2c80b44 ("riscv, bpf: inline bpf_get_smp_processor_id()"). Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: BPF: Inline bpf_get_current_task/_btf() helpersTiezhu Yang
The pointer to task_struct is always available in the $tp register, so the calls to bpf_get_current_task() and bpf_get_current_task_btf() can be inlined into a single move instruction. (1) Here is the sample test.c: #include <linux/bpf.h> #include <bpf/bpf_helpers.h> SEC("raw_tp/sys_enter") long test_task(void *ctx) { return (long)bpf_get_current_task(); } char _license[] SEC("license") = "GPL"; (2) Here are the test steps: sudo yum install libbpf-devel kernel-devel bpftool clang -target bpf -O2 -c test.c -o test.o sudo sysctl -w net.core.bpf_jit_enable=1 sudo bpftool prog show name test_task sudo rm -f /sys/fs/bpf/test_task sudo bpftool prog load test.o /sys/fs/bpf/test_task ID=$(sudo bpftool prog show pinned /sys/fs/bpf/test_task | grep -oE '^[0-9]+') sudo bpftool prog dump jited id $ID (3) Here are the test results: Before: 6 instructions ... 64: lu12i.w $t1, 1093 68: ori $t1, $t1, 3320 6c: lu32i.d $t1, 0 70: lu52i.d $t1, $t1, -1792 74: jirl $ra, $t1, 0 78: move $a5, $a0 ... After: 1 instruction ... 64: move $a5, $tp ... This is similar with commit 2bb138cb20a6 ("bpf, arm64: Inline bpf_get_current_task/_btf() helpers"). Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: BPF: Fix off-by-one error in tail callTiezhu Yang
The current code updates the tail call counter (TCC) using a pre-increment approach, it stores the incremented value back to memory before performing any boundary or target validation checks. This causes two major issues: 1. When a tail call fails because the target program is NULL, the TCC is incorrectly incremented and saved in memory anyway. 2. This dummy increment implicitly consumes one slot of the allowed tail call budget. As a result, the subsequent loop reaches the maximum limit prematurely, leading to a test failure where the actual loop count is 32 instead of the expected 33. Fix this by deferring the counter update. Change the branch condition to BPF_JSGE (greater or equal) so that we check the boundary first. The TCC is only incremented and stored back to memory after the boundary check and the NULL-target check both pass. Before: $ sudo ./test_progs -t tailcalls/tailcall_3 ... test_tailcall_count:FAIL:tailcall count unexpected tailcall count: actual 32 != expected 33 ... #465/3 tailcalls/tailcall_3:FAIL #465 tailcalls:FAIL After: $ sudo ./test_progs -t tailcalls/tailcall_3 #465/3 tailcalls/tailcall_3:OK #465 tailcalls:OK Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED Fixes: c0fcc955ff82 ("LoongArch: BPF: Fix the tailcall hierarchy") Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: BPF: Fix outdated tail call commentsTiezhu Yang
The current LoongArch BPF JIT implementation hardcodes the number of prologue instructions skipped during a tail call as a magic number '7' in the jirl instruction. However, the accompanying comment explaining this offset is completely outdated. It inaccurately states that only a single TCC initialization instruction is bypassed, but in reality, multiple setup slots are skipped, so fix these outdated comments in __build_epilogue(). While at it, refine the comments in build_prologue() to describe the skipped setup slots (RA saving, fentry nops, and the TCC register slot) using proper dynamic tracing context. Also, remove the magic number '7' by introducing descriptive macros to formally define the prologue layout and make the tail call jump offset self-documenting. Fixes: 61319d15a560 ("LoongArch: BPF: Adjust the jump offset of tail calls") Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Add build salt to the vDSOBastian Blank
The vDSO needs to have a unique build id in a similar manner to the kernel and modules. Use the build salt macro. Signed-off-by: Bastian Blank <waldi@debian.org> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Fix nr passing in set_direct_map_valid_noflush()Xuewen Wang
set_direct_map_valid_noflush() incorrectly passes 1 to __set_memory() instead of nr. This causes only the first page's attr to be updated when nr > 1. Other architectures all pass nr correctly. Cc: stable@vger.kernel.org Fixes: 0c6378a71574 ("arch: introduce set_direct_map_valid_noflush()") Signed-off-by: Xuewen Wang <wangxuewen@kylinos.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()Hongchen Zhang
When hardware page table walker (PTW) is enabled on LoongArch, the CPU may set _PAGE_DIRTY directly in the page table entry during a write TLB miss, without going through the software TLB store handler. The software TLB store handler (tlbex.S:254) sets both _PAGE_DIRTY and_PAGE_MODIFIED together: ori t0, t0, (_PAGE_VALID | _PAGE_DIRTY | _PAGE_MODIFIED) Since hardware PTW only sets _PAGE_DIRTY, the software-only bit, i.e. _PAGE_MODIFIED is left unchanged. This creates a window where a PTE has _PAGE_DIRTY set (hardware knows the page is dirty) but _PAGE_MODIFIED clear (software is unaware). When fork()/clone() triggers copy-on-write, __copy_present_ptes() calls pte_wrprotect(), which unconditionally clears both the _PAGE_WRITE and _PAGE_DIRTY bits: pte_val(pte) &= ~(_PAGE_WRITE | _PAGE_DIRTY); Since _PAGE_MODIFIED was never set, the dirtiness information is lost completely. Subsequently, when memory pressure triggers page reclaim, page_mkclean() / try_to_unmap() sees the page as clean (i.e. pte_dirty() returns false) and the page may be freed without writeback, causing data corruption. Fix this by propagating the _PAGE_DIRTY bit to the _PAGE_MODIFIED bit in both pte_wrprotect() and pmd_wrprotect() before clearing writeable bits: if (pte_val(pte) & _PAGE_DIRTY) pte_val(pte) |= _PAGE_MODIFIED; The pmd_wrprotect() fix handles the CONFIG_TRANSPARENT_HUGEPAGE case, where pmd entries need the same treatment. This ensures the software dirty tracking bit (checked by pte_dirty() and pmd_dirty(), which read both the _PAGE_DIRTY and _PAGE_MODIFIED bits) is preserved across fork COW write-protection. The issue was found by the LTP madvise09 test case, which exercises page reclaim after "madvise(MADV_FREE), write and fork" operation sequence on private anonymous mappings. Cc: stable@vger.kernel.org Fixes: 09cfefb7fa70 ("LoongArch: Add memory management") Co-developed-by: Tianyang Zhang <zhangtianyang@loongson.cn> Signed-off-by: Tianyang Zhang <zhangtianyang@loongson.cn> Signed-off-by: Hongchen Zhang <zhanghongchen@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Move struct kimage forward declaration before use谢致邦 (XIE Zhibang)
arch_kimage_file_post_load_cleanup() and load_other_segments(), both inside the CONFIG_KEXEC_FILE block, take a struct kimage pointer before the forward declaration appears. Move the forward declaration above so it precedes its first use instead of relying on a transitive include. Fixes: d162feec6b6e ("LoongArch: Add preparatory infrastructure for kexec_file") Signed-off-by: 谢致邦 (XIE Zhibang) <Yeking@Red54.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Report dying CPU to RCU in stop_this_cpu()Huacai Chen
This is a port of MIPS commit 9f3f3bdc6d9dac1 ("MIPS: smp: report dying CPU to RCU in stop_this_cpu()"). smp_send_stop() parks all secondary CPUs in stop_this_cpu(). And the function marks the CPU offline for the scheduler via set_cpu_online(false) but never informs RCU, so RCU keeps expecting a quiescent state from CPUs that are now spinning forever with interrupts disabled. As long as nothing waits for an RCU grace period after smp_send_stop() this is harmless, which is why it went unnoticed. However, since commit 91840be8f710370 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT"), irq_work_sync() calls synchronize_rcu() on architectures without an irq_work self-IPI, i.e. where arch_irq_work_has_interrupt() returns false. Any irq_work_sync() issued in the reboot/shutdown/halt path after smp_send_stop() then blocks on a grace period that can never complete, hanging the reboot: WARNING: CPU: 0 PID: 15 at kernel/irq_work.c:144 irq_work_queue_on ... rcu: INFO: rcu_sched detected stalls on CPUs/tasks: rcu: Offline CPU 1 blocking current GP. rcu: Offline CPU 2 blocking current GP. rcu: Offline CPU 3 blocking current GP. This issue needs some hacks to reproduce, and it was not noticed on LoongArch because arch_irq_work_has_interrupt() usually returns true. Call rcutree_report_cpu_dead() once interrupts are disabled, mirroring the generic CPU-hotplug offline path, so RCU stops waiting on the parked CPUs and grace periods can still complete. LoongArch shuts down all CPUs here without going through the CPU-hotplug mechanism, so this report is not otherwise issued. Cc: <stable@vger.kernel.org> Fixes: 91840be8f710 ("irq_work: Fix use-after-free in irq_work_single() on PREEMPT_RT") Reviewed-by: Guo Ren <guoren@kernel.org> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Add PIO for early access before ACPI PCI root registerHuacai Chen
For ACPI system we suppose the ISA/LPC PIO range is registered together with PCI root bridge. But the fact is there may be some early access to the ISA/LPC PIO range before ACPI PCI root register (most of them are due to abnormal BIOS). Unconditionally register the ISA/LPC PIO range usually causes ACPI PCI root register fail because of the address range confliction. So we add a pair of helpers: acpi_add_early_pio() to add PIO for early access, and acpi_remove_early_pio() to remove PIO before PCI root register. Since acpi_remove_early_pio() may be called multiple times, we add an acpi_pio flag to ensure PIO be removed only once. Cc: <stable@vger.kernel.org> Tested-by: Yuanzhen Gan <elysia-best@simplelinux.cn.eu.org> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-25LoongArch: Add THREAD_INFO_IN_TASK implementationTiezhu Yang
Like other architectures such as x86, arm64, riscv, powerpc and s390, select THREAD_INFO_IN_TASK for LoongArch to move thread_info off the stack into task_struct. This follows modern kernel standards and also makes the system more secure. With this patch, thread_info is included in task_struct at an offset of 0 instead of being placed at the bottom of the kernel stack. Thus, the $tp register points to both thread_info and task_struct. To support this, introduce a per-CPU variable cpu_tasks to store the pointer to the current task_struct. This decouples the recovery of the $tp register from the stack pointer during exception entry. Then initialize cpu_tasks for the primary and secondary CPUs during arch-specific setup and SMP boot paths. To eliminate the dangerous windows during the early initialization where the cpu_tasks remains uninitialized, set_current() is invoked as early as possible in both setup_arch() and start_secondary(). This ensures the $tp recovery barrier is armed in case any early boot exceptions or kernel panics occur. Modify SAVE_SOME and handle_syscall to restore the $tp register from cpu_tasks, and also use the la_abs absolute addressing for cpu_tasks access in assembly to bypass the relocation limits within exception handling sections. By advancing the preservation of u0 in SAVE_SOME, we reuse the PERCPU_BASE_KS value in u0 for the cpu_tasks calculation, effectively eliminating a duplicate csrrd instruction execution on SMP platforms. Update <asm/switch_to.h> and <kernel/switch.S> to fully support the CONFIG_THREAD_INFO_IN_TASK feature. Remove the obsolete next_ti argument from __switch_to(), which shifts the remaining arguments ahead in the calling convention (sched_ra from a3 to a2, and sched_cfa from a4 to a3). Under the new configuration, __switch_to() now directly derives the thread pointer ($tp) from the next task_struct pointer in a1. To preserve the optimal and clean "move tp, a1" path for 64-bit kernels, the thread pointer ($tp) is assigned directly from a1 in the core path. For 32-bit kernels, where a1 carries a 2000-byte structural pointer bias at entry, an explicit adjustment "PTR_ADDI tp, tp, -TASK_STRUCT_OFFSET" is introduced at the function exit. In the context of __switch_to(), local interrupts are disabled, and the kernel is in a critical switching phase where handling any synchronous exception is practically impossible and prohibited. If any synchronous exception or watchpoint does trigger in this narrow window, it constitutes a fatal double fault and the kernel is expected to die/panic immediately anyway. Therefore, the temporary biased value in $tp is safe and acceptable here. Additionally, evaluate the stack lookup as a single load instruction "LONG_LPTR t0, a1, (TASK_STACK - TASK_STRUCT_OFFSET)", this perfectly satisfies both 32-bit and 64-bit kernels. Using the "next" pointer in a1 as the base register, rather than $tp, effectively unchains the data dependency (RAW hazard) from the preceding move instruction, maximizing the instruction-level parallelism and superscalar execution efficiency while naturally adapting the structural shift. With CONFIG_THREAD_INFO_IN_TASK enabled, the kernel stack life cycle is decoupled from task_struct and can be freed concurrently. Currently, show_stacktrace() reads raw stack data via __get_addr() and subsequently calls show_backtrace() to unwind the frame, without holding any reference to the target task's stack. If show_stacktrace() is called on a concurrently exiting task, it could attempt to read from a freed or reallocated kernel stack. This introduces a severe use-after-free (UAF) read risk or kernel panics. Wrap the entire stack inspection process inside show_stacktrace() with a try_get_task_stack() and put_task_stack() pair. This ensures the task stack remains pinned safely during both the raw stack data dump loop and the subsequent stack unwinding phase. Also, ensure that the task pointer is initialized to "current" early if it is NULL, so that try_get_task_stack() always operates on a valid task reference. Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-06-24Merge tag 'pci-v7.2-changes' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci Pull pci updates from Bjorn Helgaas: "Enumeration: - Remove MPS/MRRS Kconfig settings (CONFIG_PCIE_BUS_*) that worked around a WiFi device defect; use a quirk or boot-time "pci=pcie_bus_tune_*" kernel parameter instead (Bjorn Helgaas) - Always lift 2.5GT/s restriction in PCIe failed link retraining to avoid clamping a link to 2.5GT/s after hot-plug changes the device (Maciej W. Rozycki) - Request bus reassignment when not probe-only to fix an enumeration regression on Marvell CN106XX and possibly other DT-based systems (Ratheesh Kannoth) - Fix procfs race between pci_proc_init() and pci_bus_add_device() that resulted in 'proc_dir_entry ... already registered' warnings and pointer corruption (Krzysztof Wilczyński) - Fix sysfs race that causes 'duplicate filename' warnings and boot panics by converting PCI resource files to static attributes (Krzysztof Wilczyński) - Expose sysfs 'resourceN_resize' attributes only on platforms with PCI mmap (Krzysztof Wilczyński) - Require CAP_SYS_ADMIN to write to sysfs 'resourceN_resize' attributes (Krzysztof Wilczyński) - Add security_locked_down(LOCKDOWN_PCI_ACCESS) to alpha PCI resource mmap path to match the generic path (Krzysztof Wilczyński) - Use kstrtobool() to parse the 'rom' attribute input to avoid the unexpected behavior of enabling the ROM when writing '0' with no trailing newline (Krzysztof Wilczyński) Resource management: - Improve resource claim logging for debuggability (Ilpo Järvinen) - Clean up several uses of const parameters (Ilpo Järvinen) - Check option ROM header signatures and lengths before accessing to avoid page faults and alignment faults (Guixin Liu) ASPM: - Don't reconfigure ASPM when entering low-power D-state; only do it when returning back to D0 (Carlos Bilbao) Power management: - During suspend, set power state to 'unknown' for all devices, not just those with drivers (Lukas Wunner) - Skip restoring Resizable BARs and VF Resizable BARs if device doesn't respond to config reads, to avoid invalid array accesses (Marco Nenciarini) - Add pci_suspend_retains_context() so drivers can tell whether devices retain internal state across suspend/resume, since some platforms reset devices on suspend; use this in nvme to avoid issues on Qcom RCs (Manivannan Sadhasivam) Power control: - Only to power on/off devices that actually support power control to avoid poking at incompatible devices mentioned in DT (Manivannan Sadhasivam) Virtualization and resets: - Log device readiness timeouts as errors, not warnings, because the device is likely unusable in this case (Bjorn Helgaas) - Wait for device readiness after soft reset (D3hot -> D0uninitialized transition), when the device may respond with Request Retry Status (RRS) if it needs more time to initialize (Bjorn Helgaas) - Drop unnecessary retries when restoring BARs because resets should now already include all required delays (Lukas Wunner) - Avoid FLR for MediaTek MT7925 WiFi, where FLR fails after a VM terminates uncleanly (Jose Ignacio Tornos Martinez) - Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems, which seem not to support it correctly (Jose Ignacio Tornos Martinez) Peer-to-peer DMA: - Prevent P2PDMA as well as CPU access to non-mappable BARs, e.g., s390 ISM BARs (Matt Evans) - Add Intel QAT, DSA, IAA devices to whitelist (Lukas Wunner) Endpoint framework: - Add endpoint controller APIs for use by function drivers to discover auxiliary blocks like DMA engines (Koichiro Den) - Remember DesignWare eDMA engine base/size and expose them via the EPC aux-resource API (Koichiro Den) - Add endpoint embedded doorbell fallback, used if MSI allocation fails (Koichiro Den) - Validate BAR index and remove dead BAR read in endpoint doorbell test (Carlos Bilbao) - Unwind MSI/MSI-X vectors if NTB initialization fails part-way through (Koichiro Den) - Cache sleepable pci_irq_vector() value at ISR setup to avoid calling it from hardirq context (Koichiro Den) - Call sleepable pci_epc_raise_irq() from a work item instead of atomic context, e.g., when setting bits in NTB peer doorbells in the ntb_peer_db_set() path (Koichiro Den) - Report 0-based vNTB doorbell vector to account for link event 0 and historically skipped slot 1 (Koichiro Den) - Prevent configfs writes to vNTB db_count and other values that are already in use after EPC attach (Koichiro Den) - Account for vNTB db_valid reserved slots (link event 0 and historically skipped slot 1) so they don't appear as valid doorbells (Koichiro Den) - Implement vNTB .db_vector_count()/mask() for doorbells so clients can use multiple vectors and avoid thundering herds (Koichiro Den) - Report 0-based NTB doorbell vector to account for link event 0 and historically skipped slot 1 (Koichiro Den) - Fix doorbell bitmask and IRQ vector handling to clear only specified bits, use the correct vector for non-contiguous Linux IRQ numbers, and validate incoming vectors (Koichiro Den) - Implement NTB .db_vector_count()/mask() for doorbells so clients can use multiple vectors (Koichiro Den) Native PCIe controller infrastructure: - Add pci_host_common_link_train_delay() for the mandatory delay after > 5GT/s Link training completes and use it for cadence HPA, j721e, LGA; dwc; aardvark, mediatek-gen3, rzg3s (Hans Zhang) - Protect root bus removal with rescan lock in altera, brcmstb, cadence, dwc, iproc, mediatek, plda, rockchip to prevent use-after-free or crashes when racing with sysfs rescan or hotplug (Hans Zhang) - Add pci_host_common_parse_ports() for use by any native driver to parse Root Port properties (per-Link features like width, speed, PHY, power and reset control, etc should be described in Root Port stanzas, not the host bridge; currently only reset GPIOs implemented) (Sherry Sun) New native PCIe controller drivers: - Add DT binding and driver for UltraRISC DP1000 PCIe controller (Xincheng Zhang, Jia Wang) Altera PCIe controller driver: - Do not dispose of the parent IRQ mapping, which belongs to the parent interrupt controller (Mahesh Vaidya) - Fix chained IRQ handler ordering issue and resource leaks on probe failure (Mahesh Vaidya) AMD MDB PCIe controller driver: - Assert PERST# on shutdown so any connected Endpoints are held in reset during shutdown (Sai Krishna Musham) Amlogic Meson PCIe controller driver: - Propagate devm_add_action_or_reset() failure to fix probe error path (Shuvam Pandey) - Add .remove() callback to deinitialize the host bridge and power off the PHY (Shuvam Pandey) Broadcom iProc PCIe controller driver: - Restore .map_irq() assignment; its removal broke INTx on the iproc platform bus driver (Mark Tomlinson) Broadcom STB PCIe controller driver: - No change, but products using certain WiFi devices may be affected by removal of CONFIG_PCIE_BUS_* (see above) Freescale i.MX6 PCIe controller driver: - Move IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling into the core reset functions (Richard Zhu) - Assert PERST# before enabling regulators to ensure that even if power is enabled, endpoint stays inactive until REFCLK is stable (Sherry Sun) - Parse reset properties in Root Port nodes (falling back to host bridge) to help support Key E connectors and the pwrctrl framework (Sherry Sun) - Configure i.MX95 REF_USE_PAD before PHY reset (Richard Zhu) - Assert i.MX95 ref_clk_en after reference clock stabilizes (Richard Zhu) - Integrate new pwrctrl API for DTs with Root Port-level power supplies (Sherry Sun) Intel Gateway PCIe controller driver: - Enable clock before PHY init for correct ordering (Florian Eckert) - Add .start_link() callback so the driver works again (Florian Eckert) - Stop overwriting the ATU base address discovered by dw_pcie_get_resources() (Florian Eckert) - Add DT 'atu' region since this is hardware-specific, and fall back to driver default if lacking (Florian Eckert) Loongson PCIe controller driver: - Ignore downstream devices only on internal bridges to avoid Loongson hardware issue (Rong Zhang) - Quirk old Loongson-3C6000 bridges that advertise incorrect supported link speeds (Ziyao Li) Marvell MVEBU PCIe controller driver: - Use fixed-width interrupt masks to avoid truncation in 64-bit builds (Rosen Penev) MediaTek PCIe controller driver: - Use FIELD_PREP() to fix incorrect operator precedence in PCIE_FTS_NUM_L0 (Li RongQing) - Fix IRQ domain leak when port fails to enable (Manivannan Sadhasivam) - Use actual physical address for MSI message address instead of virt_to_phys() (Manivannan Sadhasivam) - Add EcoNet EN7528 to DT binding (Caleb James DeLisle) MediaTek PCIe Gen3 controller driver: - Deassert PCIE_PHY_RSTB so REFCLK is stable for at least 100ms (PCIE_T_PVPERL_MS) before deasserting PERST# (Jian Yang) - Add .shutdown() to assert PERST# before powering down device (Jian Yang) - Do full device power down on removal, including asserting PERST#, when removing driver (Chen-Yu Tsai) - Fix a 'failed to create pwrctrl devices' error message that was inadvertently skipped (Chen-Yu Tsai) NVIDIA Tegra194 PCIe controller driver: - Program the DesignWare PORT_AFR L1 entrance latency based on the 'aspm-l1-entry-delay-ns' DT property (Manikanta Maddireddy) Qualcomm PCIe controller driver: - Add Eliza SoC compatible in DT binding (Krishna Chaitanya Chundru) - Set max OPP during resume so DBI register accesses don't fail with NoC errors (Qiang Yu) - Add pci_host_common_d3cold_possible() to determine whether downstream devices are already in D3hot and wakeup-enabled devices are capable of generating PME from D3cold (Krishna Chaitanya Chundru) - Add .get_ltssm() callback to get the LTSSM status without DBI, since DBI may be inaccessible after PME_Turn_Off (Krishna Chaitanya Chundru) - Power down PHY via PARF_PHY_CTRL before disabling rails/clocks to avoid power leakage (Krishna Chaitanya Chundru) - Decide whether suspend should put the link in L2 and power down using pci_host_common_d3cold_possible() instead of checking whether ASPM L1 is enabled (Krishna Chaitanya Chundru) - Add qcom D3cold support to tear down interconnect bandwidth and OPP votes (Krishna Chaitanya Chundru) - Handle unsupported mixed PERST#/PHY DT configurations, e.g., PHY in RP node while PERST# is in the RC node, but warn about the DT issue (Qiang Yu) - Program T_POWER_ON based on DT 't-power-on-us' property in case hardware advertises incorrect values (Krishna Chaitanya Chundru) - Disable ASPM L0s for SA8775P (Shawn Guo) - Initialize DWC MSI lock for firmware-managed ECAM hosts, which don't use the dw_pcie_host_init() path that initializes the lock (Yadu M G) Renesas RZ/G3S PCIe controller driver: - Add RZ/V2N DT support (Lad Prabhakar) SOPHGO PCIe controller driver: - Add 'dma-coherent' DT property for sg2042-pcie driver (Han Gao) Synopsys DesignWare PCIe controller driver: - Apply ECRC TLP Digest workaround for all DesignWare cores prior to 5.10a, not just 4.90a and 5.00a (Manikanta Maddireddy) - Use common struct dw_pcie 'mode' rather than duplicating it in artpec6, dra7xx, dwc-pcie, and keembay driver structs (Hans Zhang) - Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs to reduce boilerplate and fix a seq_file memory leak by including a .release() callback (Hans Zhang) - Fix a signedness bug in fault injection test code (Dan Carpenter) - Avoid NULL pointer dereference when tearing down debugfs for controller that lacks RAS DES capability (Shuvam Pandey) MicroSemi Switchtec management driver: - Add Gen6 Device IDs (Ben Reed) Miscellaneous: - Remove unused gpio.h include from amd-mdb, designware-plat, fu740, visconti drivers (Andy Shevchenko) - Fix typos in documentation (josh ziegler) - Use FIELD_MODIFY() instead of open-coding it (Hans Zhang)" * tag 'pci-v7.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (168 commits) PCI/sysfs: Use kstrtobool() to parse the ROM attribute input PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init() PCI/sysfs: Convert legacy I/O and memory attributes to static definitions PCI/sysfs: Add __weak pci_legacy_has_sparse() helper alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range() PCI: Add macros for legacy I/O and memory address space sizes PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files() alpha/PCI: Convert resource files to static attributes alpha/PCI: Add static PCI resource attribute macros alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits() alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs alpha/PCI: Use PCI resource accessor macros alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer alpha/PCI: Add security_locked_down() check to pci_mmap_resource() PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files() PCI/sysfs: Warn about BAR resize failure in __resource_resize_store() PCI/sysfs: Convert PCI resource files to static attributes PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device() ...
2026-06-24Merge tag 'sparc-for-7.2-tag1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc Pull sparc updates from Andreas Larsson: - Align sparc to other archs by providing ucontext.h wrapper - Fix buffer underflow in led driver - Export mcount for clang and disable compat when using lld for linking - API choice improvement for sysfs code for vio - Fix build warnings and notification of missing prototype - Remove dead code and dead configs * tag 'sparc-for-7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc: sparc: Remove remaining defconfig references to the pktcdvd driver sparc: led: avoid trimming a newline from empty writes sparc: Export mcount for Clang-built modules sparc: Disable compat support with LLD sparc: Avoid -Wunused-but-set-parameter in clear_user_page() sparc: add _mcount() prototype sparc64: uprobes: add missing break sparc: remove unused SERIAL_CONSOLE config option sparc32: remove deadwood swift_flush_tlb_page() debug code sparc: uapi: Add ucontext.h sparc: vio: use sysfs_emit in sysfs show functions
2026-06-24arm64: mm: Defer read-only remap of data/bss linear aliasArd Biesheuvel
Since commit f2ba877402e5 ("arm64: mm: Map the kernel data/bss read-only in the linear map") the linear alias of the .data and .bss regions is remapped read-only early during the boot. (Note that a subsequent patch to unmap this region entirely was reverted just before the v7.2 merge window, and will be brought back in an improved form for the v7.3 cycle) Fuad reports that in some cases, the KVM init code may apply relocations to variables that reside in .data, and does so via the linear map. This means that remapping .data read-only beforehand is a bad idea, and results in an early boot crash. These variables in .data are only present when CONFIG_NVHE_EL2_DEBUG or CONFIG_NVHE_EL2_TRACING are enabled, which is why it was not spotted in testing. So move the remap to mark_rodata_ro(), which is a reasonable place to put this, and ensures that it happens much later during the boot. It also means that rodata=off is now taken into account, and so the linear alias will remain writable in that case. Fixes: f2ba877402e5 ("arm64: mm: Map the kernel data/bss read-only in the linear map") Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev> Tested-by: Fuad Tabba <fuad.tabba@linux.dev> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-24KVM: x86: Move a pile of stuff from kvm_host.h => x86.hSean Christopherson
Move the majority of remaining KVM-internal declarations and defines in kvm_host.h to x86.h, so that kvm_host.h only holds structure and function definitions that need to be visible to arch-neutral KVM. Land the emulator interfaces in x86.h, even though kvm_emulate.h *seems* like a good home, as the interfaces and defines being moved are provided by x86.c. I.e. keep kvm_emulate.h as an interface to the emulator proper. Note, any "misses" are likely unintentional. Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260613000329.732085-31-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: move TSS constants from kvm_host.h to tss.hPaolo Bonzini
Suggested-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86/mmu: Move kvm_mmu_do_page_fault() from mmu_internal.h => mmu.cSean Christopherson
Move kvm_mmu_do_page_fault() into mmu.c, as there are no users outside of mmu.c, and the function typically isn't inlined by the compiler anyways. This will allow moving the EMULTYPE_xxx definitions into x86.h without having to include x86.h in mmu_internal.h, i.e. will help preserve the goal of making x86.h KVM x86's "top-level" include. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-30-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86/mmu: Move kvm_arch_async_page_ready() below kvm_tdp_page_fault()Sean Christopherson
Move the implementation of kvm_arch_async_page_ready() "down" in mmu.c so that it lives below kvm_tdp_page_fault(). This will allow moving kvm_mmu_do_page_fault() into mmu.c without needing a forward declaration. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-29-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Rework kvm_arch_interrupt_allowed() into kvm_is_interrupt_allowed()Sean Christopherson
Rename kvm_arch_interrupt_allowed() to kvm_is_interrupt_allowed() and change its return type to a boolean, as the purpose of the helper is purely to check if interrupts are architecturally allowed. I.e. whether or not interrupts are temporarily disallowed due a pending nested VM-Enter is irrelevant (and callers are most definitely not supposed to care). Opportunistically bury the helper in x86.c, as it hasn't been referenced by arch-neutral code since commit a1b37100d9e2 ("KVM: Reduce runnability interface with arch support code"), and has long since gained _very_ x86-specific semantics (see above). Opportunistically add a comment to call out that treating -EBUSY as "allowed" is intentional. For all intents and purposes, no functional change intended (KVM treats -EBUSY as "allowed" before and after). Cc: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260613000329.732085-28-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Don't treat interrupts as allowed just because a nested run is pendingSean Christopherson
When querying whether or not interrupts (IRQs) are allowed, check for a pending nested run _after_ checking whether or not interrupts are blocked. If L1 is running L2 _without_ nested_exit_on_intr(), i.e. if L1 IRQs can be blocked while running L2, and interrupts will indeed be blocked once the nested VM-Enter to L2 is completed, then KVM should treat interrupts as not being allowed. For injection, this avoids an unnecessary (forced) VM-Exit, as KVM can immediately request an IRQ window, instead of forcing an exit and _then_ requesting an IRQ window (because after the forced exit, KVM will see that interrupts are blocked). For non-injection usage, only kvm_vcpu_ready_for_interrupt_injection() is affected in practice. Barring KVM bugs or misbehaving userspace (at which point all architectural guarantees are off), kvm_vcpu_has_events() is unreachable when a nested run is pending. To reach kvm_vcpu_has_events(), kvm_vcpu_running() needs to return false, i.e. vcpu->arch.mp_state needs to be something other than RUNNABLE. If nested_run_pending is true, then mp_state *must* be RUNNABLE (again barring bugs or stupid userspace), because KVM shouldn't emulate VMRUN/VMLAUNCH/VMRESUME while the vCPU is !RUNNABLE. The one "near miss" is VMX's GUEST_ACTIVITY_STATE field, which allows L1 to put the vCPU into HLT or WFS as part of nested VMLAUNCH/VMRESUME. However, KVM clears nested_run_pending prior to calling kvm_emulate_halt_noskip() when putting L2 into HLT via GUEST_ACTIVITY_HLT, and also clears the flag before setting mp_state to INIT_RECEIVED. SVM has no equivalent to GUEST_ACTIVITY_STATE. I.e. the vCPU will always be runnable if a nested run is pending, and thus kvm_arch_vcpu_runnable() => kvm_vcpu_has_events() is effectively dead code, as is __kvm_emulate_halt() => kvm_vcpu_has_events(). Oh, and TDX doesn't support nested VMX. Similarly, kvm_can_do_async_pf() is unreachable as KVM shouldn't be faulting in memory with a pending nested VM-Enter. As for kvm_vcpu_ready_for_interrupt_injection(), KVM's current behavior of incorrectly treating interrupts as being allowed could result in KVM prematurely exiting to userspace to accept an ExtINT. But, KVM will still hold/block the ExtINT and request its own IRQ window. I.e. the net effect is more or less the same as the for-injection case, the unnecessary exit just happens at a different boundary. Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260613000329.732085-27-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move kvm_pv_send_ipi() declaration from kvm_host.h => lapic.hSean Christopherson
Move the declaration of kvm_pv_send_ipi() into lapic.h, as its implementation is provided by lapic.c (sending PV IPIs relies on the optimized APIC map provided by the in-kernel local APIC), and it's only used by KVM x86 code. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-26-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move IRQ-related helper declarations from kvm_host.h => irq.hSean Christopherson
Move the function declaration for APIs to get/query pending IRQs from kvm_host.h to irq.h, as the APIs are only used by KVM x86 code. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-25-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move __kvm_irq_line_state() from kvm_host.h => ioapic.hSean Christopherson
Bury __kvm_irq_line_state() in CONFIG_KVM_IOAPIC=y code, as it's only used by PIC and I/O APIC code. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-24-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move misc "VALID MASK" defines from kvm_host.h => x86.cSean Christopherson
Move a variety of "VALID MASK" defines, e.g. that capture which flags in a given ioctl are supported by KVM, from kvm_host.h to x86.c. The set of valid flags/bits is very much a KVM-internal detail, as the values from the hardcoded #defines are often captured and massaged by KVM's setup code, i.e. *directly* using the macros outside of KVM x86 would be actively dangerous. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-23-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move LLDT assembly wrappers into VMXSean Christopherson
Move kvm_{load,read}_ldt() into vmx.c, as vmx_{load,store}_ldt(), as they are exclusively used by VMX to save/restore host state, and have no business being globally visible. Ideally, KVM-specific helpers wouldn't exist at all, as they are nothing more than assembly wrappers for SLDT and LLDT, i.e. should be provided by the kernel, not by KVM. Punt that cleanup to the future, as arch/x86/include/asm/desc.h _does_ provide helpers, but load_ldt() is only available for CONFIG_PARAVIRT_XXL=n builds, and both {load,store}_ldt() unnecessarily constrain the operands to memory. No functional change intended. Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-22-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move MMU helper declarations from kvm_host.h => mmu.hSean Christopherson
Move a pile of MMU helper declarations and macros into mmu.h, as they are very much KVM x86 internal APIs and details, and not intended to be exposed to arch-neutral KVM, and certainly not to the broader kernel. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-21-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86/pmu: Move "struct kvm_x86_pmu_event_filter" definition to pmu.cSean Christopherson
Move the definition of "struct kvm_x86_pmu_event_filter" to pmu.c, as the as the details of the filters are very much implementation details that can and should be buried in pmu.c. While the _existence_ of filters is public knowledge, almost by definition, the contents don't need to be exposed outside of the PMU code as the filter data is provided by userspace, i.e. it pretty much has to be dynamically allocated, and thus never should be fully embedded in a globally visible structure. No functional change intended Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-20-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move "struct kvm_x86_msr_filter" definition to msrs.cSean Christopherson
Move the definition of "struct kvm_x86_msr_filter" and its associate, "struct msr_bitmap_range", to msrs.c, as the details of the filters are very much implementation details that can and should be buried in msrs.c. While the _existence_ of filters is public knowledge, almost by definition, the contents don't need to be exposed outside of the MSR code as the filter data is provided by userspace, i.e. it pretty much has to be dynamically allocated, and thus never should be fully embedded in a globally visible structure. Note, this creates a discrepancy with the PMU event filter structure; that will be remedied shortly. No functional change intended. Suggested-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-19-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move MSR helper declarations from kvm_host.h => msrs.hSean Christopherson
Relocate declarations of MSR helpers (and kvm_nr_uret_msrs) from x86's kvm_host.h to msrs, to continue trimming down kvm_host.h. Deliberately leave the funky read_msr() where it is, as it will hopefully be removed entirely as part of a broader kernel-API cleanup. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-18-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move kvm_{g,s}et_segment() to inline helpers in regs.hSean Christopherson
Define kvm_{g,s}et_segment() as inline functions in regs.h, as they are literally one-line wrappers to invoke vendor code. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-17-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move register helper declarations from kvm_host.h => regs.hSean Christopherson
Relocate declarations of Control/Debug Register, EFLAGS and RIP helpers from x86's kvm_host.h to regs.h, to continue trimming down kvm_host.h. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-16-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move the bulk of MSR specific code from x86.c to msrs.{c,h}Sean Christopherson
Introduce msrs.{c,h}, and move the vast majority of MSR specific code out of x86.{c,h}. Use a plural "msrs" instead of just "msr" to be consistent with regs.{c,h}, and to make it easier to differentiate KVM's code from the other 5+ msr.c files in the kernel. Opportunistically drop the "x86.h" include from mtrr.c, mostly as proof that the bulk of the MSR code is indeed being relocated to msrs.c. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-15-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Expose several TSC helpers via x86.h for use by MSR codeSean Christopherson
Begrudgingly move adjust_tsc_offset_{guest,host}() to x86.h as inlines, and expose several other TSC helpers in anticipation of moving KVM's MSR code to a dedicated msrs.c. Unfortunately for KVM, several MSRs that KVM emulates can affect TSC state. Opportunistically drop a superfluous local "tsc_offset" variable, whose existence causes checkpatch to complain about lack of a blank line. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Message-ID: <20260613000329.732085-14-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Extract get/set MSR (list) ioctl logic to helpersSean Christopherson
Extract the code for getting/setting MSRs and MSR lists to dedicated helpers in anticipation of moving the MSR code to a new msrs.c. No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-13-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move kvm_{load,put}_guest_fpu() to fpu.hSean Christopherson
Move the kvm_{load,put}_guest_fpu() helpers to fpu.h in anticipation of moving the bulk of KVM's MSR handling code out of x86.c. KVM needs to load and put the FPU when accessing MSRs that are managed via XSTATE, a.k.a. the so called "FPU". No functional change intended. Reviewed-by: Yosry Ahmed <yosry@kernel.org> Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-12-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86/hyperv: Eliminate an unnecessary include of x86.h in hyperv.hSean Christopherson
Drop an mostly unused include of x86.h from hyperv.h, and instead pull in regs.h, which is need for at least is_guest_mode(). This eliminates the last include of x86.h from a common x86 header, i.e. solidifies that x86.h is the top of the pyramid. Add a missing x86.h include in cpuid.c to avoid build breakage. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-11-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move eager_page_split to mmu.{c,h}Sean Christopherson
Move KVM's eager_page_split module param to the MMU, as it is very much an MMU knob. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-10-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24KVM: x86: Move tdp_enabled from kvm_host.h to mmu.hSean Christopherson
Relocated the declaration of tdp_enabled into mmu.h, and opportunistically hoist tdp_mmu_enabled up to the top so that the two are co-located. No functional change intended. Reviewed-by: Kai Huang <kai.huang@intel.com> Reviewed-by: Yosry Ahmed <yosry@kernel.org> Signed-off-by: Sean Christopherson <seanjc@google.com> Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com> Message-ID: <20260613000329.732085-9-seanjc@google.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>