summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-03-02KVM: SVM: Mark module parameters as __ro_after_init for security and performanceLi RongQing
SVM module parameters such as avic, sev_enabled, npt_enabled, and pause_filter_thresh are configured exclusively during initialization (via kernel command line) and remain constant throughout runtime. Additionally, sev_supported_vmsa_features and svm_gp_erratum_intercept, while not exposed as module parameters, share the same initialization pattern and runtime constancy. Mark these variables with '__ro_after_init' to: - Harden against accidental or malicious runtime modification - Enable compiler and CPU optimizations (improved caching, branch prediction) - Align with kernel security best practices for init-only configuration The exception is 'iopm_base', which retains '__read_mostly' as it requires updates during module unloading. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Li RongQing <lirongqing@baidu.com> Link: https://patch.msgid.link/20260202095004.1765-1-lirongqing@baidu.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: nSVM: Mark all of vmcb02 dirty when restoring nested stateYosry Ahmed
When restoring a vCPU in guest mode, any state restored before KVM_SET_NESTED_STATE (e.g. KVM_SET_SREGS) will mark the corresponding dirty bits in vmcb01, as it is the active VMCB before switching to vmcb02 in svm_set_nested_state(). Hence, mark all fields in vmcb02 dirty in svm_set_nested_state() to capture any previously restored fields. Fixes: cc440cdad5b7 ("KVM: nSVM: implement KVM_GET_NESTED_STATE and KVM_SET_NESTED_STATE") CC: stable@vger.kernel.org Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev> Link: https://patch.msgid.link/20260210010806.3204289-1-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: VMX: Use ASM_INPUT_RM in __vmcs_writelUros Bizjak
Use the ASM_INPUT_RM macro for VMCS write operation in vmx_ops.h to work around clang problems with "rm" asm constraint. clang seems to always chose the memory input, while it is almost always the worst choice. Signed-off-by: Uros Bizjak <ubizjak@gmail.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Thomas Gleixner <tglx@kernel.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Acked-by: Nathan Chancellor <nathan@kernel.org> Link: https://patch.msgid.link/20260211102928.100944-2-ubizjak@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: VMX: Drop obsolete branch hint prefixes from inline asmUros Bizjak
Remove explicit branch hint prefixes (.byte 0x2e / 0x3e) from VMX inline assembly sequences. These prefixes (CS/DS segment overrides used as branch hints on very old x86 CPUs) have been ignored by modern processors for a long time. Keeping them provides no measurable benefit and only enlarges the generated code. No functional change intended. Signed-off-by: Uros Bizjak <ubizjak@gmail.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Thomas Gleixner <tglx@kernel.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Link: https://patch.msgid.link/20260211102928.100944-1-ubizjak@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: x86/pmu: annotate struct kvm_x86_pmu_event_filter with __counted_by()Carlos López
struct kvm_x86_pmu_event_filter has a flexible array member, so annotate it with the field that describes the amount of entries in such array. Opportunistically replace the open-coded array size calculation with flex_array_size() when copying the array portion of the struct from userspace. Signed-off-by: Carlos López <clopez@suse.de> Link: https://patch.msgid.link/20260212140556.3883030-2-clopez@suse.de Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: x86: Zero-initialize temporary fxregs_state buffers in FXSAVE emulationUros Bizjak
Explicitly zero-initialize stack-allocated struct fxregs_state variables in em_fxsave() and fxregs_fixup() to ensure all padding and unused fields are cleared before use. Both functions declare temporary fxregs_state buffers that may be partially written by fxsave. Although the emulator copies only the architecturally defined portion of the state to userspace, any padding or otherwise untouched bytes in the structure can remain uninitialized. This can lead to the use of uninitialized stack data and may trigger KMSAN reports. In the worst case, it could result in leaking stack contents if such bytes are ever exposed. No functional change intended. Suggested-by: Sean Christopherson <seanjc@google.com> Signed-off-by: Uros Bizjak <ubizjak@gmail.com> Cc: Sean Christopherson <seanjc@google.com> Cc: Paolo Bonzini <pbonzini@redhat.com> Cc: Thomas Gleixner <tglx@kernel.org> Cc: Ingo Molnar <mingo@kernel.org> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: "H. Peter Anvin" <hpa@zytor.com> Link: https://patch.msgid.link/20260212212457.24483-1-ubizjak@gmail.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02arm64: dts: imx93-phyboard-segin: Add peb-av-02 overlayAndrej Picej
Add overlay for Audio-Video module PEB-AV-02. Add support for panel display, capacitive touchscreen and backlight. The pwm-backlight uses the GPIO based PWM implementation for now. Switch to the FlexIO PWM support once available. Signed-off-by: Andrej Picej <andrej.picej@norik.com> [rework commit message, use local regulator, remove compatible] Signed-off-by: Primoz Fiser <primoz.fiser@norik.com> Signed-off-by: Christian Hemp <c.hemp@phytec.de> [m.felsch@pengutronix.de: cleanup downstream commit] Tested-by: Primoz Fiser <primoz.fiser@norik.com> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: freescale: Add the GOcontroll Moduline MiniMaud Spierings
The Moduline Mini is a part of the wider GOcontroll Moduline ecosystem. These are embedded controllers that focus on modularity with their swappable IO modules. Features: - up to 4 Moduline IO modules - 2 CAN busses - 1 Ethernet - 4 RGB leds - 1 3D accelerometer - optional Wi-Fi/Bluetooth - optional 4G/GPS Signed-off-by: Maud Spierings <maudspierings@gocontroll.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: freescale: Add the GOcontroll Moduline IVMaud Spierings
The Moduline IV is a part of the wider GOcontroll Moduline ecosystem. These are embedded controllers that focus on modularity with their swappable IO modules. Features: - up to 8 Moduline IO modules - 4 CAN busses - 1 LIN bus - 1 Ethernet - 4 RGB leds - optional Wi-Fi/Bluetooth - optional 4G/GPS Signed-off-by: Maud Spierings <maudspierings@gocontroll.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: freescale: add Ka-Ro Electronics tx8m-1610 COMMaud Spierings
The Ka-Ro Electronics tx8m-1610 is a COM based on the imx8mm SOC. It has 1 GB of ram and 4 GB of eMMC storage on board. Add it to enable boards based on this module Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Maud Spierings <maudspierings@gocontroll.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx8mm: Add pinctrl config definitionsMaud Spierings
Currently to configure each IOMUXC_SW_PAD_CTL_PAD the raw value of this register is written in the dts, these values are not obvious. Add defines which describe the fields of this register which can be or-ed together to produce readable settings. Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Maud Spierings <maudspierings@gocontroll.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: freescale: add NXP FRDM-IMX91S board supportYanan Yang
Add DeviceTree support for the NXP FRDM-IMX91S development board based on the i.MX91 SoC. FRDM-IMX91S is a cost-optimized variant of FRDM-IMX91 and differs in memory, storage, Ethernet, and PMIC configuration: - 512MB LPDDR4 (FRDM-IMX91 uses 1GB) - 256MB FlexSPI-NAND (FRDM-IMX91 uses 8GB eMMC) - Single GbE port (FRDM-IMX91 has dual GbE) - PMIC PF9453 (FRDM-IMX91 uses PCA9451A) This DT enables: - ADC1 - UART1 and UART5 - I2C bus and children nodes - USB and related nodes - uSDHC1 and uSDHC2 - FlexSPI NAND flash - Watchdog3 - Ethernet (eqos) - FlexCAN - MQS Link: https://www.nxp.com/design/design-center/development-boards-and-designs/FRDM-IMX91S (FRDM-IMX91S board page) Link: https://www.nxp.com/design/design-center/development-boards-and-designs/FRDM-IMX91 (FRDM-IMX91 board page) Co-developed-by: Lei Xu <lei.xu@nxp.com> Signed-off-by: Lei Xu <lei.xu@nxp.com> Co-developed-by: Xiaofeng Wei <xiaofeng.wei@nxp.com> Signed-off-by: Xiaofeng Wei <xiaofeng.wei@nxp.com> Signed-off-by: Yanan Yang <yanan.yang@nxp.com> Tested-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx91-11x11-evk: Add usdhc3 for SDIO WiFi supportSherry Sun
Add usdhc3 to support M.2 SDIO WiFi on i.MX91 11x11 EVK board. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx8mp-evk: Add usdhc1 for SDIO WiFi supportSherry Sun
Add usdhc1 to support M.2 SDIO WiFi on i.MX8MP EVK board. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02KVM: x86: Defer non-architectural deliver of exception payload to userspace readSean Christopherson
When attempting to play nice with userspace that hasn't enabled KVM_CAP_EXCEPTION_PAYLOAD, defer KVM's non-architectural delivery of the payload until userspace actually reads relevant vCPU state, and more importantly, force delivery of the payload in *all* paths where userspace saves relevant vCPU state, not just KVM_GET_VCPU_EVENTS. Ignoring userspace save/restore for the moment, delivering the payload before the exception is injected is wrong regardless of whether L1 or L2 is running. To make matters even more confusing, the flaw *currently* being papered over by the !is_guest_mode() check isn't even the same bug that commit da998b46d244 ("kvm: x86: Defer setting of CR2 until #PF delivery") was trying to avoid. At the time of commit da998b46d244, KVM didn't correctly handle exception intercepts, as KVM would wait until VM-Entry into L2 was imminent to check if the queued exception should morph to a nested VM-Exit. I.e. KVM would deliver the payload to L2 and then synthesize a VM-Exit into L1. But the payload was only the most blatant issue, e.g. waiting to check exception intercepts would also lead to KVM incorrectly escalating a should-be-intercepted #PF into a #DF. That underlying bug was eventually fixed by commit 7709aba8f716 ("KVM: x86: Morph pending exceptions to pending VM-Exits at queue time"), but in the interim, commit a06230b62b89 ("KVM: x86: Deliver exception payload on KVM_GET_VCPU_EVENTS") came along and subtly added another dependency on the !is_guest_mode() check. While not recorded in the changelog, the motivation for deferring the !exception_payload_enabled delivery was to fix a flaw where a synthesized MTF (Monitor Trap Flag) VM-Exit would drop a pending #DB and clobber DR6. On a VM-Exit, VMX CPUs save pending #DB information into the VMCS, which is emulated by KVM in nested_vmx_update_pending_dbg() by grabbing the payload from the queue/pending exception. I.e. prematurely delivering the payload would cause the pending #DB to not be recorded in the VMCS, and of course, clobber L2's DR6 as seen by L1. Jumping back to save+restore, the quirked behavior of forcing delivery of the payload only works if userspace does KVM_GET_VCPU_EVENTS *before* CR2 or DR6 is saved, i.e. before KVM_GET_SREGS{,2} and KVM_GET_DEBUGREGS. E.g. if userspace does KVM_GET_SREGS before KVM_GET_VCPU_EVENTS, then the CR2 saved by userspace won't contain the payload for the exception save by KVM_GET_VCPU_EVENTS. Deliberately deliver the payload in the store_regs() path, as it's the least awful option even though userspace may not be doing save+restore. Because if userspace _is_ doing save restore, it could elide KVM_GET_SREGS knowing that SREGS were already saved when the vCPU exited. Link: https://lore.kernel.org/all/20200207103608.110305-1-oupton@google.com Cc: Yosry Ahmed <yosry.ahmed@linux.dev> Cc: stable@vger.kernel.org Reviewed-by: Yosry Ahmed <yosry.ahmed@linux.dev> Tested-by: Yosry Ahmed <yosry.ahmed@linux.dev> Link: https://patch.msgid.link/20260218005438.2619063-1-seanjc@google.com Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02KVM: nSVM: Use vcpu->arch.cr2 when updating vmcb12 on nested #VMEXITYosry Ahmed
KVM currently uses the value of CR2 from vmcb02 to update vmcb12 on nested #VMEXIT. This value is incorrect in some cases, causing L1 to run L2 with a corrupted CR2. This could lead to segfaults or data corruption if L2 is in the middle of handling a #PF and reads a corrupted CR2. Use the correct value in vcpu->arch.cr2 instead. The value in vcpu->arch.cr2 is sync'd to vmcb02 shortly before a VMRUN of L2, and sync'd back to vcpu->arch.cr2 shortly after. The value are only out-of-sync in two cases: after save+restore, and after a #PF is injected into L2. In either case, if a #VMEXIT to L1 is synthesized before L2 runs, using the value in vmcb02 would be incorrect. After save+restore, the value of CR2 is restored by KVM_SET_SREGS into vcpu->arch.cr2. It is not reflect in vmcb02 until a VMRUN of L2. Before that, it holds whatever was in vmcb02 before restore, which would be zero on a new vCPU that never ran nested. If a #VMEXIT to L1 is synthesized before L2 ever runs, using vcpu->arch.cr2 to update vmcb12 is the right thing to do. The #PF injection case is more nuanced. Although the APM is a bit unclear about when CR2 is written during a #PF, the SDM is more clear: Processors update CR2 whenever a page fault is detected. If a second page fault occurs while an earlier page fault is being delivered, the faulting linear address of the second fault will overwrite the contents of CR2 (replacing the previous address). These updates to CR2 occur even if the page fault results in a double fault or occurs during the delivery of a double fault. KVM injecting the exception surely counts as the #PF being "detected". More importantly, when an exception is injected into L2 at the time of a synthesized #VMEXIT, KVM updates exit_int_info in vmcb12 accordingly, such that an L1 hypervisor can re-inject the exception. If CR2 is not written at that point, the L1 hypervisor have no way of correctly re-injecting the #PF. Hence, if a #VMEXIT to L1 is synthesized after the #PF is injected into L2 but before it actually runs, using vcpu->arch.cr2 to update vmcb12 is also the right thing to do. Note that KVM does _not_ update vcpu->arch.cr2 when a #PF is pending for L2, only when it is injected. The distinction is important, because only injected (but not intercepted) exceptions are propagated to L1 through exit_int_info. It would be incorrect to update CR2 in vmcb12 for a pending #PF, as L1 would perceive an updated CR2 value with no #PF. Cc: stable@vger.kernel.org Signed-off-by: Yosry Ahmed <yosry.ahmed@linux.dev> Link: https://patch.msgid.link/20260203201010.1871056-1-yosry.ahmed@linux.dev Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-03-02x86/mtrr: Use kstrtoul() in parse_mtrr_spare_reg()Thorsten Blum
Replace the deprecated simple_strtoul()¹ with kstrtoul() for parsing the early boot parameter mtrr_spare_reg_nr. simple_strtoul() silently sets nr_mtrr_spare_reg to 0 for invalid input instead of rejecting it and keeping the default value. Return kstrtoul()'s retval directly to propagate parsing failures instead of treating them as success. Also return -EINVAL when '=' is missing from the boot parameter and 'arg' is NULL. ¹ https://www.kernel.org/doc/html/latest/process/deprecated.html#simple-strtol-simple-strtoll-simple-strtoul-simple-strtoull [ bp: Massage commit message. ] Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20260302135341.3473-2-thorsten.blum@linux.dev
2026-03-02arm64: dts: imx8mp-evk: Enable pull select bit for PCIe regulator GPIO (M.2 ↵Sherry Sun
W_DISABLE1) The current pin configuration for MX8MP_IOMUXC_SD1_DATA4__GPIO2_IO06 sets the weak pull-up but does not enable the pull select field. Bit 8 in the IOMUX register must be set in order for the weak pull-up to actually take effect. Update the pinctrl setting from 0x40 to 0x140 to enable both the pull select and the weak pull-up, ensuring the line behaves as expected. Fixes: d50650500064 ("arm64: dts: imx8mp-evk: Add PCIe support") Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx943-evk: add usdhc3 for SDIO WiFi supportSherry Sun
Add usdhc3 to support M.2 SDIO WiFi on i.MX943 EVK board. Signed-off-by: Sherry Sun <sherry.sun@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx952-evk: add MT35XU01G spi nor flashHaibo Chen
Add spi nor flash MT35XU01G support, it support OCT DTR mode at 200MHz. Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: imx952: Add xspi nodeHaibo Chen
Add xspi node for i.MX952 Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-03-02arm64: dts: marvell: armada-37xx: drop redundant status propertyGabor Juhos
Remove the 'status' property from the 'armada-3700-rwtm' node. Device nodes are enabled by default, so specifying the status as "okay" is superfluous. Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm64: dts: marvell: armada-37xx: align 'phy-names' of EHCI node with DT schemaGabor Juhos
According to the 'generic-ehci.yaml' schema, the name of the first phy in an EHCI node must be "usb", however the 'usb@5e000' node in the 'armada-37xx.dtsi' uses "usb2-utmi-host-phy" instead. This causes dtbs_check warnings like the following ones: arch/arm64/boot/dts/marvell/armada-3720-atlas-v5.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml arch/arm64/boot/dts/marvell/armada-3720-db.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml arch/arm64/boot/dts/marvell/armada-3720-eDPU.dtb: usb@5e000 (marvell,armada-3700-ehci): phy-names:0: 'usb' was expected from schema $id: http://devicetree.org/schemas/usb/generic-ehci.yaml ... Use "usb" as a name for the phy to avoid the warnings. No functional change, the USB interface works after the change: [ 1.472393] orion-ehci d005e000.usb: EHCI Host Controller [ 1.477847] orion-ehci d005e000.usb: new USB bus registered, assigned bus number 1 [ 1.487127] orion-ehci d005e000.usb: irq 40, io mem 0xd005e000 [ 1.505759] orion-ehci d005e000.usb: USB 2.0 started, EHCI 1.00 [ 1.512493] hub 1-0:1.0: USB hub found [ 1.516434] hub 1-0:1.0: 1 port detected ... [ 4.175746] usb 1-1: new high-speed USB device number 2 using orion-ehci [ 4.347643] usb-storage 1-1:1.0: USB Mass Storage device detected [ 4.359972] scsi host0: usb-storage 1-1:1.0 [ 5.367100] scsi 0:0:0:0: Direct-Access ADATA USB Flash Drive 1.00 PQ: 0 ANSI: 6 [ 5.387091] sd 0:0:0:0: [sda] 30869504 512-byte logical blocks: (15.8 GB/14.7 GiB) [ 5.398420] sd 0:0:0:0: [sda] Write Protect is off [ 5.408108] sd 0:0:0:0: [sda] Write cache: disabled, read cache: disabled, doesn't support DPO or FUA [ 5.477359] sda: sda1 [ 5.480037] sd 0:0:0:0: [sda] Attached SCSI removable disk Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm64: dts: marvell: armada-3720: drop 'marvell,xenon-emmc' propertiesGabor Juhos
The 'marvell,xenon-emmc' property used in some device trees of Armada 3720 based boards is not documented. Due to this dtbs_check throws warnings: .../armada-3720-atlas-v5.dtb: mmc@d8000 (marvell,armada-3700-sdhci): Unevaluated properties are not allowed ('marvell,xenon-emmc' was unexpected) .../armada-3720-espressobin-emmc.dtb: mmc@d8000 (marvell,armada-3700-sdhci): Unevaluated properties are not allowed ('marvell,xenon-emmc' was unexpected) Apart from the warnings, 'git grep' says that the property is used in device trees only: $ git grep -n 'marvell,xenon-emmc' arch/arm64/boot/dts/marvell/armada-3720-atlas-v5.dts:85: marvell,xenon-emmc; arch/arm64/boot/dts/marvell/armada-3720-espressobin.dtsi:81: marvell,xenon-emmc; Although handling of the property was there in an early version of the 'sdhci-xenon' driver during the initial submission [1], but that part has been removed in later versions. Drop the property from the affected device trees due to the reasons mentioned above. No functional changes intended, compile tested only. Link: https://lore.kernel.org/r/0390e7a05b6163deabb545f93729ea615eeaaee2.1477911954.git-series.gregory.clement@free-electrons.com # [1] Signed-off-by: Gabor Juhos <j4g8y7@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm64: dts: marvell: uDPU: add ethernet aliasesRobert Marko
On eDPU plus, which is an updated revision of eDPU which uses an external MV88E6361 switch we are relying on U-Boot to detect the board, and then enable and disable the required nodes for that revision. However, it seems that I missed adding the required aliases for ethernet controllers, and this worked as in OpenWrt we had added those locally. Cc: stable@vger.kernel.org Fixes: 660b8b2f3944 ("arm64: dts: marvell: eDPU: add support for version with external switch") Signed-off-by: Robert Marko <robert.marko@sartura.hr> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm/arm64: dts: marvell: Drop unused .dtsiRob Herring (Arm)
These .dtsi files are not included anywhere in the tree and can't be tested. Signed-off-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Elad Nachman <enachman@marvell.com> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm64: dts: a7k: use phy handleElad Nachman
Documentation/devicetree/bindings/net/ethernet-controller.yaml phy: : #/properties/phy-handle deprecated: true New dts files should not be using deprecated properties. What should be used is: phy-handle: : /schemas/types.yaml#/definitions/phandle description: Specifies a reference to a node representing a PHY device. Suggested-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Elad Nachman <enachman@marvell.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Signed-off-by: Gregory CLEMENT <gregory.clement@bootlin.com>
2026-03-02arm64: dts: rockchip: Make Jaguar PCIe-refclk pin use pull-up configHeiko Stuebner
The hardware PU/PD config of the pin after reset is to pull-up and on Jaguar this will also keep the device in reset until the driver actually enables the pin. So restore this boot pull-up config of the pin on Jaguar instead of setting it to pull-none. Suggested-by: Quentin Schulz <quentin.schulz@cherry.de> Fixes: 0ec7e1096332 ("arm64: dts: rockchip: add PCIe3 support on rk3588-jaguar") Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260210080303.680403-5-heiko@sntech.de Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: rockchip: add pinctrl for clk-generator GPIO on rk3588-tigerHeiko Stuebner
While specific driver in the Linux-Kernel handles GPIOs gracefully without matching pinctrl entries, this might not be true for other operating systems. So having pinctrl entries makes the hardware-description more complete. The somewhat similar rk3588-jaguar board has a pinctrl entry already, so also add one for rk3588-tiger. Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de> Link: https://patch.msgid.link/20260210080303.680403-4-heiko@sntech.de Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-tigerHeiko Stuebner
Using a combination of fixed clock and gpio-gate clock works but does not describe the actual hardware. Use the gated-fixed-clock binding to describe this in a nicer way. Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260210080303.680403-3-heiko@sntech.de Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: rockchip: use gated-fixed-clock for pcie-refclk on rk3588-jaguarHeiko Stuebner
Using a combination of fixed clock and gpio-gate clock works but does not describe the actual hardware. Use the gated-fixed-clock binding to describe this in a nicer way. Signed-off-by: Heiko Stuebner <heiko.stuebner@cherry.de> Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com> Reviewed-by: Quentin Schulz <quentin.schulz@cherry.de> Link: https://patch.msgid.link/20260210080303.680403-2-heiko@sntech.de Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: rockchip: Enable displayport for rk3576 evb2Chaoyi Chen
The rk3576 evb2 has a full size displayport connector. Enable it. Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com> Link: https://patch.msgid.link/20260224083818.109-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: rockchip: Add battery and charger on rk3566-pinenoteSamuel Holland
The PineNote has a single cell 4000mAh battery which can be charged via the rk817 PMIC. Signed-off-by: Samuel Holland <samuel@sholland.org> Co-developed-by: Maximilian Weigand <mweigand@mweigand.net> Signed-off-by: Maximilian Weigand <mweigand@mweigand.net> Signed-off-by: Diederik de Haas <diederik@cknow-tech.com> Link: https://patch.msgid.link/20260224170531.516392-1-diederik@cknow-tech.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02riscv: dts: spacemit: adapt regulator node name to preferred formYixun Lan
The preferred node name for fixed-regulators has changed to pattern [1]: '^regulator(-[0-9]+v[0-9]+|-[0-9a-z-]+)?$' Adjust all SpacemiT DT regulator node names to fix this. Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://lore.kernel.org/r/20240426215147.3138211-1-robh@kernel.org [1] Link: https://lore.kernel.org/r/20260226-02-k1-regulator-names-v1-1-e87695d50159@kernel.org Signed-off-by: Yixun Lan <dlan@kernel.org>
2026-03-02arm64: dts: rockchip: Fix sdmmc pwren pinctrl for rk3576-evb2Chaoyi Chen
In rk3576.dtsi, sdmmc0_pwren is configured as part of the sdmmc pinctrl. However, on the rk3576 evb2 board, sdmmc0_pwren is used as the regulator for vmmc-supply. Therefore, we need to reassign the sdmmc pinctrl and remove sdmmc0_pwren to avoid conflicts. Cc: Shawn Lin <shawn.lin@rock-chips.com> Fixes: 86a82f7a7eed ("arm64: dts: rockchip: Add rk3576 evb2 board") Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com> Link: https://patch.msgid.link/20260226102052.63-1-kernel@airkyi.com Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-03-02arm64: dts: zena: Add support for Zena CSSDebbie Horsfall
Introduce the Zena CSS Fixed Virtual Platform (FVP) dts. This is currently the only Zena CSS variant, however the common definitions are included in a common dtsi for extensibility. Signed-off-by: Debbie Horsfall <debbie.horsfall@arm.com> Message-Id: <20260212-zena-css-v2-2-d33ea23cb9c2@arm.com> Reviewed-by: Andre Przywara <andre.przywara@arm.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-03-02ARM: provide individual is_translation_fault() and is_permission_fault()Russell King (Oracle)
Provide individual LPAE and non-LPAE definitions for both these functions, rather than having ifdefs inside the function body. This places the functions closer to their associated definitions. Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02ARM: move FSR fault status definitions before fsr_fs()Russell King (Oracle)
The FSR's fault status bits depend on whether LPAE is enabled. Rather than always exposing both LPAE and non-LPAE to all code, move them inside the ifdef blocks dependent on LPAE to restrict their visibility. No code other than fsr_fs() makes use of these. Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02ARM: use BIT() and GENMASK() for fault status register fieldsRussell King (Oracle)
Modernise the fault status field definitions by using BIT() and GENMASK(). Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02ARM: move is_permission_fault() and is_translation_fault() to fault.hRussell King (Oracle)
is_permission_fault() and is_translation_fault() are both conditional on the FSR encodings, which are dependent on LPAE. We define the constants in fault.h. Move these inline functions to fault.h to be near the FSR definitions. Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02ARM: move vmalloc() lazy-page table populationRussell King (Oracle)
Split the vmalloc() lazy-page table population from do_translation_fault() into a new vmalloc_fault() function. Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02ARM: ensure interrupts are enabled in __do_user_fault()Russell King (Oracle)
__do_user_fault() may be called from fault handling paths where the interrupts are enabled or disabled. E.g. do_page_fault() calls this with interrupts enabled, whereas do_sect_fault()->do_bad_area() will call this with interrupts disabled. Since this is a userspace fault, we know that interrupts were enabled in the parent context, so call local_irq_enable() here to give a consistent interrupt state. This is necessary for force_sig_info() when PREEMPT_RT is enabled. Reported-by: Yadi.hu <yadi.hu@windriver.com> Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
2026-03-02arm64: dts: mediatek: mt7988a-bpi-r4pro: fix model stringFrank Wunderlich
Fix incorrect model string in Devicetree for BPI-R4-Pro. Fixes: f397471a6a8c ("arm64: dts: mediatek: mt7988: Add devicetree for BananaPi R4 Pro") Signed-off-by: Frank Wunderlich <frank-w@public-files.de> Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
2026-03-02x86/sev: Allow IBPB-on-Entry feature for SNP guestsKim Phillips
The SEV-SNP IBPB-on-Entry feature does not require a guest-side implementation. It was added in Zen5 h/w, after the first SNP Zen implementation, and thus was not accounted for when the initial set of SNP features were added to the kernel. In its abundant precaution, commit 8c29f0165405 ("x86/sev: Add SEV-SNP guest feature negotiation support") included SEV_STATUS' IBPB-on-Entry bit as a reserved bit, thereby masking guests from using the feature. Allow guests to make use of IBPB-on-Entry when supported by the hypervisor, as the bit is now architecturally defined and safe to expose. Fixes: 8c29f0165405 ("x86/sev: Add SEV-SNP guest feature negotiation support") Signed-off-by: Kim Phillips <kim.phillips@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Nikunj A Dadhania <nikunj@amd.com> Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Cc: stable@kernel.org Link: https://patch.msgid.link/20260203222405.4065706-2-kim.phillips@amd.com
2026-03-02x86/boot/sev: Move SEV decompressor variables into the .data sectionTom Lendacky
As part of the work to remove the dependency on calling into the decompressor code (startup_64()) for a UEFI boot, a call to rmpadjust() was removed from sev_enable() in favor of checking the value of the snp_vmpl variable. When booting through a non-UEFI path and calling startup_64(), the call to sev_enable() is performed before the BSS section is zeroed. With the removal of the rmpadjust() call and the corresponding check of the return code, the snp_vmpl variable is checked. Since the kernel is running at VMPL0, the snp_vmpl variable will not have been set and should be the default value of 0. However, since the call occurs before the BSS is zeroed, the snp_vmpl variable may not actually be zero, which will cause the guest boot to fail. Since the decompressor relocates itself, the BSS would need to be cleared both before and after the relocation, but this would, in effect, cause all of the changes to BSS variables before relocation to be lost after relocation. Instead, move the snp_vmpl variable into the .data section so that it is initialized and the value made safe during relocation. As a pre-caution against future changes, move other SEV-related decompressor variables into the .data section, too. Fixes: 68a501d7fd82 ("x86/boot: Drop redundant RMPADJUST in SEV SVSM presence check") Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Changyuan Lyu <changyuanl@google.com> Tested-by: Kevin Hui <kevinhui@meta.com> Tested-by: Changyuan Lyu <changyuanl@google.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/5648b7de5b0a5d0dfef3785f9582b718678c6448.1770217260.git.thomas.lendacky@amd.com
2026-03-01Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm fixes from Paolo Bonzini: "Arm: - Make sure we don't leak any S1POE state from guest to guest when the feature is supported on the HW, but not enabled on the host - Propagate the ID registers from the host into non-protected VMs managed by pKVM, ensuring that the guest sees the intended feature set - Drop double kern_hyp_va() from unpin_host_sve_state(), which could bite us if we were to change kern_hyp_va() to not being idempotent - Don't leak stage-2 mappings in protected mode - Correctly align the faulting address when dealing with single page stage-2 mappings for PAGE_SIZE > 4kB - Fix detection of virtualisation-capable GICv5 IRS, due to the maintainer being obviously fat fingered... [his words, not mine] - Remove duplication of code retrieving the ASID for the purpose of S1 PT handling - Fix slightly abusive const-ification in vgic_set_kvm_info() Generic: - Remove internal Kconfigs that are now set on all architectures - Remove per-architecture code to enable KVM_CAP_SYNC_MMU, all architectures finally enable it in Linux 7.0" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: always define KVM_CAP_SYNC_MMU KVM: remove CONFIG_KVM_GENERIC_MMU_NOTIFIER KVM: arm64: Deduplicate ASID retrieval code irqchip/gic-v5: Fix inversion of IRS_IDR0.virt flag KVM: arm64: Revert accidental drop of kvm_uninit_stage2_mmu() for non-NV VMs KVM: arm64: Fix protected mode handling of pages larger than 4kB KVM: arm64: vgic: Handle const qualifier from gic_kvm_info allocation type KVM: arm64: Remove redundant kern_hyp_va() in unpin_host_sve_state() KVM: arm64: Fix ID register initialization for non-protected pKVM guests KVM: arm64: Optimise away S1POE handling when not supported by host KVM: arm64: Hide S1POE from guests when not supported by the host
2026-03-01Merge tag 'x86-urgent-2026-03-01' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fixes from Ingo Molnar: - Fix speculative safety in fred_extint() - Fix __WARN_printf() trap in early_fixup_exception() - Fix clang-build boot bug for unusual alignments, triggered by CONFIG_DEBUG_FORCE_FUNCTION_ALIGN_64B=y - Replace the final few __ASSEMBLY__ stragglers that snuck in lately into non-UAPI x86 headers and use __ASSEMBLER__ consistently (again) * tag 'x86-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/headers: Replace __ASSEMBLY__ stragglers with __ASSEMBLER__ x86/cfi: Fix CFI rewrite for odd alignments x86/bug: Handle __WARN_printf() trap in early_fixup_exception() x86/fred: Correct speculative safety in fred_extint()
2026-03-01Merge tag 'perf-urgent-2026-03-01' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull perf events fixes from Ingo Molnar: - Fix lock ordering bug found by lockdep in perf_event_wakeup() - Fix uncore counter enumeration on Granite Rapids and Sierra Forest - Fix perf_mmap() refcount bug found by Syzkaller - Fix __perf_event_overflow() vs perf_remove_from_context() race * tag 'perf-urgent-2026-03-01' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Fix __perf_event_overflow() vs perf_remove_from_context() race perf/core: Fix refcount bug and potential UAF in perf_mmap perf/x86/intel/uncore: Add per-scheduler IMC CAS count events perf/core: Fix invalid wait context in ctx_sched_in()
2026-03-01Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf before 7.0-rc2Alexei Starovoitov
Cross-merge BPF and other fixes after downstream PR. No conflicts. Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-02-28Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpfLinus Torvalds
Pull bpf fixes from Alexei Starovoitov: - Fix alignment of arm64 JIT buffer to prevent atomic tearing (Fuad Tabba) - Fix invariant violation for single value tnums in the verifier (Harishankar Vishwanathan, Paul Chaignon) - Fix a bunch of issues found by ASAN in selftests/bpf (Ihor Solodrai) - Fix race in devmpa and cpumap on PREEMPT_RT (Jiayuan Chen) - Fix show_fdinfo of kprobe_multi when cookies are not present (Jiri Olsa) - Fix race in freeing special fields in BPF maps to prevent memory leaks (Kumar Kartikeya Dwivedi) - Fix OOB read in dmabuf_collector (T.J. Mercier) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (36 commits) selftests/bpf: Avoid simplification of crafted bounds test selftests/bpf: Test refinement of single-value tnum bpf: Improve bounds when tnum has a single possible value bpf: Introduce tnum_step to step through tnum's members bpf: Fix race in devmap on PREEMPT_RT bpf: Fix race in cpumap on PREEMPT_RT selftests/bpf: Add tests for special fields races bpf: Retire rcu_trace_implies_rcu_gp() from local storage bpf: Delay freeing fields in local storage bpf: Lose const-ness of map in map_check_btf() bpf: Register dtor for freeing special fields selftests/bpf: Fix OOB read in dmabuf_collector selftests/bpf: Fix a memory leak in xdp_flowtable test bpf: Fix stack-out-of-bounds write in devmap bpf: Fix kprobe_multi cookies access in show_fdinfo callback bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing selftests/bpf: Don't override SIGSEGV handler with ASAN selftests/bpf: Check BPFTOOL env var in detect_bpftool_path() selftests/bpf: Fix out-of-bounds array access bugs reported by ASAN selftests/bpf: Fix array bounds warning in jit_disasm_helpers ...