Commit Graph

1428441 Commits

Author SHA1 Message Date
Sascha Bischoff
91d940cd67 irqchip/gic-v5: Introduce minimal irq_set_type() for PPIs
GICv5 does not support configuring the handling mode or trigger mode
of PPIs at runtime - these choices are made at implementation time,
and most of the architected PPIs have an architected handling mode (as
reported in the ICH_PPI_HMRn_EL1 registers). As chip->set_irq_type()
is optional, this has not been implemented for GICv5 PPIs as it served
no real purpose.

However, although the set_irq_type() function is marked as optional,
the lack of it breaks attempts to create a domain hierarchy on top of
GICv5's PPI domain. This is due to __irq_set_trigger() calling
chip->set_irq_type(), which returns -ENOSYS if the parent domain
doesn't implement the set_irq_type() call.

In order to make things work, this change introduces a set_irq_type()
call for GICv5 PPIs. This performs a basic sanity check (that the
hardware's handling mode (Level/Edge) matches what is being set as the
type, and does nothing else.

This is sufficient to get hierarchical domains working for GICv5 PPIs
(such as the one KVM introduces for the arch timer). It has the side
benefit (or drawback) that it will catch cases where the firmware
description doesn't match what the hardware reports.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-31-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
a3ca7cf9b3 KVM: arm64: gic-v5: Initialise ID and priority bits when resetting vcpu
Determine the number of priority bits and ID bits exposed to the guest
as part of resetting the vcpu state. These values are presented to the
guest by trapping and emulating reads from ICC_IDR0_EL1.

GICv5 supports either 16- or 24-bits of ID space (for SPIs and
LPIs). It is expected that 2^16 IDs is more than enough, and therefore
this value is chosen irrespective of the hardware supporting more or
not.

The GICv5 architecture only supports 5 bits of priority in the CPU
interface (but potentially fewer in the IRS). Therefore, this is the
default value chosen for the number of priority bits in the CPU
IF.

Note: We replicate the way that GICv3 uses the num_id_bits and
num_pri_bits variables. That is, num_id_bits stores the value of the
hardware field verbatim (0 means 16-bits, 1 would mean 24-bits for
GICv5), and num_pri_bits stores the actual number of priority bits;
the field value + 1.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-30-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
f4d37c7c35 KVM: arm64: gic-v5: Create and initialise vgic_v5
Update kvm_vgic_create to create a vgic_v5 device. When creating a
vgic, FEAT_GCIE in the ID_AA64PFR2 is only exposed to vgic_v5-based
guests, and is hidden otherwise. GIC in ~ID_AA64PFR0_EL1 is never
exposed for a vgic_v5 guest.

When initialising a vgic_v5, skip kvm_vgic_dist_init as GICv5 doesn't
support one. The current vgic_v5 implementation only supports PPIs, so
no SPIs are initialised either.

The current vgic_v5 support doesn't extend to nested guests. Therefore,
the init of vgic_v5 for a nested guest is failed in vgic_v5_init.

As the current vgic_v5 doesn't require any resources to be mapped,
vgic_v5_map_resources is simply used to check that the vgic has indeed
been initialised. Again, this will change as more GICv5 support is
merged in.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-29-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
b88d05a893 KVM: arm64: gic-v5: Support GICv5 interrupts with KVM_IRQ_LINE
Interrupts under GICv5 look quite different to those from older Arm
GICs. Specifically, the type is encoded in the top bits of the
interrupt ID.

Extend KVM_IRQ_LINE to cope with GICv5 PPIs and SPIs. The requires
subtly changing the KVM_IRQ_LINE API for GICv5 guests. For older Arm
GICs, PPIs had to be in the range of 16-31, and SPIs had to be
32-1019, but this no longer holds true for GICv5. Instead, for a GICv5
guest support PPIs in the range of 0-127, and SPIs in the range
0-65535. The documentation is updated accordingly.

The SPI range doesn't cover the full SPI range that a GICv5 system can
potentially cope with (GICv5 provides up to 24-bits of SPI ID space,
and we only have 16 bits to work with in KVM_IRQ_LINE). However, 65k
SPIs is more than would be reasonably expected on systems for years to
come.

In order to use vgic_is_v5(), the kvm/arm_vgic.h header is added to
kvm/arm.c.

Note: As the GICv5 KVM implementation currently doesn't support
injecting SPIs attempts to do so will fail. This restriction will by
lifted as the GICv5 KVM support evolves.

Co-authored-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-28-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
5a98d0e17e KVM: arm64: gic-v5: Implement direct injection of PPIs
GICv5 is able to directly inject PPI pending state into a guest using
a mechanism called DVI whereby the pending bit for a paticular PPI is
driven directly by the physically-connected hardware. This mechanism
itself doesn't allow for any ID translation, so the host interrupt is
directly mapped into a guest with the same interrupt ID.

When mapping a virtual interrupt to a physical interrupt via
kvm_vgic_map_irq for a GICv5 guest, check if the interrupt itself is a
PPI or not. If it is, and the host's interrupt ID matches that used
for the guest DVI is enabled, and the interrupt itself is marked as
directly_injected.

When the interrupt is unmapped again, this process is reversed, and
DVI is disabled for the interrupt again.

Note: the expectation is that a directly injected PPI is disabled on
the host while the guest state is loaded. The reason is that although
DVI is enabled to drive the guest's pending state directly, the host
pending state also remains driven. In order to avoid the same PPI
firing on both the host and the guest, the host's interrupt must be
disabled (masked). This is left up to the code that owns the device
generating the PPI as this needs to be handled on a per-VM basis. One
VM might use DVI, while another might not, in which case the physical
PPI should be enabled for the latter.

Co-authored-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-27-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
4a5444d239 KVM: arm64: Introduce set_direct_injection irq_op
GICv5 adds support for directly injected PPIs. The mechanism for
setting this up is GICv5 specific, so rather than adding
GICv5-specific code to the common vgic code, we introduce a new
irq_op.

This new irq_op is intended to be used to enable or disable direct
injection for interrupts that support it. As it is an irq_op, it has
no effect unless explicitly populated in the irq_ops structure for a
particular interrupt.  The usage is demonstracted in the subsequent
change.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-26-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
d1328c6151 KVM: arm64: gic-v5: Trap and mask guest ICC_PPI_ENABLERx_EL1 writes
A guest should not be able to detect if a PPI that is not exposed to
the guest is implemented or not. Avoid the guest enabling any PPIs
that are not implemented as far as the guest is concerned by trapping
and masking writes to the two ICC_PPI_ENABLERx_EL1 registers.

When a guest writes these registers, the write is masked with the set
of PPIs actually exposed to the guest, and the state is written back
to KVM's shadow state. As there is now no way for the guest to change
the PPI enable state without it being trapped, saving of the PPI
Enable state is dropped from guest exit.

Reads for the above registers are not masked. When the guest is
running and reads from the above registers, it is presented with what
KVM provides in the ICH_PPI_ENABLERx_EL2 registers, which is the
masked version of what the guest last wrote.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-25-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
933e5288fa KVM: arm64: gic-v5: Check for pending PPIs
This change allows KVM to check for pending PPI interrupts. This has
two main components:

First of all, the effective priority mask is calculated.  This is a
combination of the priority mask in the VPEs ICC_PCR_EL1.PRIORITY and
the currently running priority as determined from the VPE's
ICH_APR_EL1. If an interrupt's priority is greater than or equal to
the effective priority mask, it can be signalled. Otherwise, it
cannot.

Secondly, any Enabled and Pending PPIs must be checked against this
compound priority mask. The reqires the PPI priorities to by synced
back to the KVM shadow state on WFI entry - this is skipped in general
operation as it isn't required and is rather expensive. If any Enabled
and Pending PPIs are of sufficient priority to be signalled, then
there are pending PPIs. Else, there are not. This ensures that a VPE
is not woken when it cannot actually process the pending interrupts.

As the PPI priorities are not synced back to the KVM shadow state on
every guest exit, they must by synced prior to checking if there are
pending interrupts for the guest. The sync itself happens in
vgic_v5_put() if, and only if, the vcpu is entering WFI as this is the
only case where it is not planned to run the vcpu thread again. If the
vcpu enters WFI, the vcpu thread will be descheduled and won't be
rescheduled again until it has a pending interrupt, which is checked
from kvm_arch_vcpu_runnable().

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-24-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
f20554ad3c KVM: arm64: gic-v5: Clear TWI if single task running
Handle GICv5 in kvm_vcpu_should_clear_twi(). Clear TWI if there is a
single task running, and enable it otherwise. This is a sane default
for GICv5 given the current level of support.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-23-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
da8d9636be KVM: arm64: gic-v5: Init Private IRQs (PPIs) for GICv5
Initialise the private interrupts (PPIs, only) for GICv5. This means
that a GICv5-style intid is generated (which encodes the PPI type in
the top bits) instead of the 0-based index that is used for older
GICs.

Additionally, set all of the GICv5 PPIs to use Level for the handling
mode, with the exception of the SW_PPI which uses Edge. This matches
the architecturally-defined set in the GICv5 specification (the CTIIRQ
handling mode is IMPDEF, so Level has been picked for that).

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-22-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
4d591252ba KVM: arm64: gic-v5: Implement PPI interrupt injection
This change introduces interrupt injection for PPIs for GICv5-based
guests.

The lifecycle of PPIs is largely managed by the hardware for a GICv5
system. The hypervisor injects pending state into the guest by using
the ICH_PPI_PENDRx_EL2 registers. These are used by the hardware to
pick a Highest Priority Pending Interrupt (HPPI) for the guest based
on the enable state of each individual interrupt. The enable state and
priority for each interrupt are provided by the guest itself (through
writes to the PPI registers).

When Direct Virtual Interrupt (DVI) is set for a particular PPI, the
hypervisor is even able to skip the injection of the pending state
altogether - it all happens in hardware.

The result of the above is that no AP lists are required for GICv5,
unlike for older GICs. Instead, for PPIs the ICH_PPI_* registers
fulfil the same purpose for all 128 PPIs. Hence, as long as the
ICH_PPI_* registers are populated prior to guest entry, and merged
back into the KVM shadow state on exit, the PPI state is preserved,
and interrupts can be injected.

When injecting the state of a PPI the state is merged into the
PPI-specific vgic_irq structure. The PPIs are made pending via the
ICH_PPI_PENDRx_EL2 registers, the value of which is generated from the
vgic_irq structures for each PPI exposed on guest entry. The
queue_irq_unlock() irq_op is required to kick the vCPU to ensure that
it seems the new state. The result is that no AP lists are used for
private interrupts on GICv5.

Prior to entering the guest, vgic_v5_flush_ppi_state() is called from
kvm_vgic_flush_hwstate(). This generates the pending state to inject
into the guest, and snapshots it (twice - an entry and an exit copy)
in order to track any changes. These changes can come from a guest
consuming an interrupt or from a guest making an Edge-triggered
interrupt pending.

When returning from running a guest, the guest's PPI state is merged
back into KVM's vgic_irq state in vgic_v5_merge_ppi_state() from
kvm_vgic_sync_hwstate(). The Enable and Active state is synced back for
all PPIs, and the pending state is synced back for Edge PPIs (Level is
driven directly by the devices generating said levels). The incoming
pending state from the guest is merged with KVM's shadow state to
avoid losing any incoming interrupts.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-21-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
4a9a32d353 KVM: arm64: gic: Introduce queue_irq_unlock to irq_ops
There are times when the default behaviour of vgic_queue_irq_unlock()
is undesirable. This is because some GICs, such a GICv5 which is the
main driver for this change, handle the majority of the interrupt
lifecycle in hardware. In this case, there is no need for a per-VCPU
AP list as the interrupt can be made pending directly. This is done
either via the ICH_PPI_x_EL2 registers for PPIs, or with the VDPEND
system instruction for SPIs and LPIs.

The vgic_queue_irq_unlock() function is made overridable using a new
function pointer in struct irq_ops. vgic_queue_irq_unlock() is
overridden if the function pointer is non-null.

This new irq_op is unused in this change - it is purely providing the
infrastructure itself. The subsequent PPI injection changes provide a
demonstration of the usage of the queue_irq_unlock irq_op.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-20-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
8f1fbe2fd2 KVM: arm64: gic-v5: Finalize GICv5 PPIs and generate mask
We only want to expose a subset of the PPIs to a guest. If a PPI does
not have an owner, it is not being actively driven by a device. The
SW_PPI is a special case, as it is likely for userspace to wish to
inject that.

Therefore, just prior to running the guest for the first time, we need
to finalize the PPIs. A mask is generated which, when combined with
trapping a guest's PPI accesses, allows for the guest's view of the
PPI to be filtered. This mask is global to the VM as all VCPUs PPI
configurations must match.

In addition, the PPI HMR is calculated.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-19-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
9b8e3d4ca0 KVM: arm64: gic-v5: Implement GICv5 load/put and save/restore
This change introduces GICv5 load/put. Additionally, it plumbs in
save/restore for:

* PPIs (ICH_PPI_x_EL2 regs)
* ICH_VMCR_EL2
* ICH_APR_EL2
* ICC_ICSR_EL1

A GICv5-specific enable bit is added to struct vgic_vmcr as this
differs from previous GICs. On GICv5-native systems, the VMCR only
contains the enable bit (driven by the guest via ICC_CR0_EL1.EN) and
the priority mask (PCR).

A struct gicv5_vpe is also introduced. This currently only contains a
single field - bool resident - which is used to track if a VPE is
currently running or not, and is used to avoid a case of double load
or double put on the WFI path for a vCPU. This struct will be extended
as additional GICv5 support is merged, specifically for VPE doorbells.

Co-authored-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-18-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
af325e87af KVM: arm64: gic-v5: Add vgic-v5 save/restore hyp interface
Introduce the following hyp functions to save/restore GICv5 state:

* __vgic_v5_save_apr()
* __vgic_v5_restore_vmcr_apr()
* __vgic_v5_save_ppi_state()	- no hypercall required
* __vgic_v5_restore_ppi_state()	- no hypercall required
* __vgic_v5_save_state()	- no hypercall required
* __vgic_v5_restore_state()	- no hypercall required

Note that the functions tagged as not requiring hypercalls are always
called directly from the same context. They are either called via the
vgic_save_state()/vgic_restore_state() path when running with VHE, or
via __hyp_vgic_save_state()/__hyp_vgic_restore_state() otherwise. This
mimics how vgic_v3_save_state()/vgic_v3_restore_state() are
implemented.

Overall, the state of the following registers is saved/restored:

* ICC_ICSR_EL1
* ICH_APR_EL2
* ICH_PPI_ACTIVERx_EL2
* ICH_PPI_DVIRx_EL2
* ICH_PPI_ENABLERx_EL2
* ICH_PPI_PENDRx_EL2
* ICH_PPI_PRIORITYRx_EL2
* ICH_VMCR_EL2

All of these are saved/restored to/from the KVM vgic_v5 CPUIF shadow
state, with the exception of the PPI active, pending, and enable
state. The pending state is saved and restored from kvm_host_data as
any changes here need to be tracked and propagated back to the
vgic_irq shadow structures (coming in a future commit). Therefore, an
entry and an exit copy is required. The active and enable state is
restored from the vgic_v5 CPUIF, but is saved to kvm_host_data. Again,
this needs to by synced back into the shadow data structures.

The ICSR must be save/restored as this register is shared between host
and guest. Therefore, to avoid leaking host state to the guest, this
must be saved and restored. Moreover, as this can by used by the host
at any time, it must be save/restored eagerly. Note: the host state is
not preserved as the host should only use this register when
preemption is disabled.

As with GICv3, the VMCR is eagerly saved as this is required when
checking if interrupts can be injected or not, and therefore impacts
things such as WFI.

As part of restoring the ICH_VMCR_EL2 and ICH_APR_EL2, GICv3-compat
mode is also disabled by setting the ICH_VCTLR_EL2.V3 bit to 0. The
correspoinding GICv3-compat mode enable is part of the VMCR & APR
restore for a GICv3 guest as it only takes effect when actually
running a guest.

Co-authored-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-17-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:28 +00:00
Sascha Bischoff
070543a85a KVM: arm64: gic-v5: Trap and emulate ICC_IDR0_EL1 accesses
Unless accesses to the ICC_IDR0_EL1 are trapped by KVM, the guest
reads the same state as the host. This isn't desirable as it limits
the migratability of VMs and means that KVM can't hide hardware
features such as FEAT_GCIE_LEGACY.

Trap and emulate accesses to the register, and present KVM's chosen ID
bits and Priority bits (which is 5, as GICv5 only supports 5 bits of
priority in the CPU interface). FEAT_GCIE_LEGACY is never presented to
the guest as it is only relevant for nested guests doing mixed GICv5
and GICv3 support.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-16-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
607871ce63 KVM: arm64: gic-v5: Add emulation for ICC_IAFFIDR_EL1 accesses
GICv5 doesn't provide an ICV_IAFFIDR_EL1 or ICH_IAFFIDR_EL2 for
providing the IAFFID to the guest. A guest access to the
ICC_IAFFIDR_EL1 must therefore be trapped and emulated to avoid the
guest accessing the host's ICC_IAFFIDR_EL1.

The virtual IAFFID is provided to the guest when it reads
ICC_IAFFIDR_EL1 (which always traps back to the hypervisor). Writes are
rightly ignored. KVM treats the GICv5 VPEID, the virtual IAFFID, and
the vcpu_id as the same, and so the vcpu_id is returned.

The trapping for the ICC_IAFFIDR_EL1 is always enabled when in a guest
context.

Co-authored-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Timothy Hayes <timothy.hayes@arm.com>
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-15-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
9d6d9514c0 KVM: arm64: gic-v5: Support GICv5 FGTs & FGUs
Extend the existing FGT/FGU infrastructure to include the GICv5 trap
registers (ICH_HFGRTR_EL2, ICH_HFGWTR_EL2, ICH_HFGITR_EL2). This
involves mapping the trap registers and their bits to the
corresponding feature that introduces them (FEAT_GCIE for all, in this
case), and mapping each trap bit to the system register/instruction
controlled by it.

As of this change, none of the GICv5 instructions or register accesses
are being trapped.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-14-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
a258a383b9 KVM: arm64: gic-v5: Sanitize ID_AA64PFR2_EL1.GCIE
Add in a sanitization function for ID_AA64PFR2_EL1, preserving the
already-present behaviour for the FPMR, MTEFAR, and MTESTOREONLY
fields. Add sanitisation for the GCIE field, which is set to IMP if
the host supports a GICv5 guest and NI, otherwise.

Extend the sanitisation that takes place in kvm_vgic_create() to zero
the ID_AA64PFR2.GCIE field when a non-GICv5 GIC is created. More
importantly, move this sanitisation to a separate function,
kvm_vgic_finalize_sysregs(), and call it from kvm_finalize_sys_regs().

We are required to finalize the GIC and GCIE fields a second time in
kvm_finalize_sys_regs() due to how QEMU blindly reads out then
verbatim restores the system register state. This avoids the issue
where both the GCIE and GIC features are marked as present (an
architecturally invalid combination), and hence guests fall over. See
the comment in kvm_finalize_sys_regs() for more details.

Overall, the following happens:

* Before an irqchip is created, FEAT_GCIE is presented if the host
  supports GICv5-based guests.
* Once an irqchip is created, all other supported irqchips are hidden
  from the guest; system register state reflects the guest's irqchip.
* Userspace is allowed to set invalid irqchip feature combinations in
  the system registers, but...
* ...invalid combinations are removed a second time prior to the first
  run of the guest, and things hopefully just work.

All of this extra work is required to make sure that "legacy" GICv3
guests based on QEMU transparently work on compatible GICv5 hosts
without modification.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-13-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
f656807150 KVM: arm64: gic-v5: Detect implemented PPIs on boot
As part of booting the system and initialising KVM, create and
populate a mask of the implemented PPIs. This mask allows future PPI
operations (such as save/restore or state, or syncing back into the
shadow state) to only consider PPIs that are actually implemented on
the host.

The set of implemented virtual PPIs matches the set of implemented
physical PPIs for a GICv5 host. Therefore, this mask represents all
PPIs that could ever by used by a GICv5-based guest on a specific
host, albeit pre-filtered by what we support in KVM (see next
paragraph).

Only architected PPIs are currently supported in KVM with
GICv5. Moreover, as KVM only supports a subset of all possible PPIS
(Timers, PMU, GICv5 SW_PPI) the PPI mask only includes these PPIs, if
present. The timers are always assumed to be present; if we have KVM
we have EL2, which means that we have the EL1 & EL2 Timer PPIs. If we
have a PMU (v3), then the PMUIRQ is present. The GICv5 SW_PPI is
always assumed to be present.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-12-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
da92ff15ca KVM: arm64: gic-v5: Add Arm copyright header
This header was mistakenly omitted during the creation of this
file. Add it now. Better late than never.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-11-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
eb8bce08ec KVM: arm64: gic: Introduce interrupt type helpers
GICv5 has moved from using interrupt ranges for different interrupt
types to using some of the upper bits of the interrupt ID to denote
the interrupt type. This is not compatible with older GICs (which rely
on ranges of interrupts to determine the type), and hence a set of
helpers is introduced. These helpers take a struct kvm*, and use the
vgic model to determine how to interpret the interrupt ID.

Helpers are introduced for PPIs, SPIs, and LPIs. Additionally, a
helper is introduced to determine if an interrupt is private - SGIs
and PPIs for older GICs, and PPIs only for GICv5.

Additionally, vgic_is_v5() is introduced (which unsurpisingly returns
true when running a GICv5 guest), and the existing vgic_is_v3() check
is moved from vgic.h to arm_vgic.h (to live alongside the vgic_is_v5()
one), and has been converted into a macro.

The helpers are plumbed into the core vgic code, as well as the Arch
Timer and PMU code.

There should be no functional changes as part of this change.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Joey Gouly <joey.gouly@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-10-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
c547c51ff4 KVM: arm64: gic-v5: Add ARM_VGIC_V5 device to KVM headers
This is the base GICv5 device which is to be used with the
KVM_CREATE_DEVICE ioctl to create a GICv5-based vgic.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-9-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
59991153f0 arm64/sysreg: Add GICR CDNMIA encoding
The encoding for the GICR CDNMIA system instruction is thus far unused
(and shall remain unused for the time being). However, in order to
plumb the FGTs into KVM correctly, KVM needs to be made aware of the
encoding of this system instruction.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-8-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
2808a83370 arm64/sysreg: Add remaining GICv5 ICC_ & ICH_ sysregs for KVM support
Add the GICv5 system registers required to support native GICv5 guests
with KVM. Many of the GICv5 sysregs have already been added as part of
the host GICv5 driver, keeping this set relatively small. The
registers added in this change complete the set by adding those
required by KVM either directly (ICH_) or indirectly (FGTs for the
ICC_ sysregs).

The following system registers and their fields are added:

	ICC_APR_EL1
	ICC_HPPIR_EL1
	ICC_IAFFIDR_EL1
	ICH_APR_EL2
	ICH_CONTEXTR_EL2
	ICH_PPI_ACTIVER<n>_EL2
	ICH_PPI_DVI<n>_EL2
	ICH_PPI_ENABLER<n>_EL2
	ICH_PPI_PENDR<n>_EL2
	ICH_PPI_PRIORITYR<n>_EL2

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20260319154937.3619520-7-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
663594aafb KVM: arm64: vgic: Split out mapping IRQs and setting irq_ops
Prior to this change, the act of mapping a virtual IRQ to a physical
one also set the irq_ops. Unmapping then reset the irq_ops to NULL. So
far, this has been fine and hasn't caused any major issues.

Now, however, as GICv5 support is being added to KVM, it has become
apparent that conflating mapping/unmapping IRQs and setting/clearing
irq_ops can cause issues. The reason is that the upcoming GICv5
support introduces a set of default irq_ops for PPIs, and removing
this when unmapping will cause things to break rather horribly.

Split out the mapping/unmapping of IRQs from the setting/clearing of
irq_ops. The arch timer code is updated to set the irq_ops following a
successful map. The irq_ops are intentionally not removed again on an
unmap as the only irq_op introduced by the arch timer only takes
effect if the hw bit in struct vgic_irq is set. Therefore, it is safe
to leave this in place, and it avoids additional complexity when GICv5
support is introduced.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-6-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 18:21:27 +00:00
Sascha Bischoff
cbd8c958be KVM: arm64: Return early from kvm_finalize_sys_regs() if guest has run
If the guest has already run, we have no business finalizing the
system register state - it is too late. Therefore, check early and
bail if the VM has already run.

This change also stops kvm_init_nv_sysregs() from being called once
the RM has run once. Although this looks like a behavioural change,
the function returns early once it has been called the first time.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-4-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 16:25:55 +00:00
Sascha Bischoff
3a2857da94 KVM: arm64: vgic: Rework vgic_is_v3() and add vgic_host_has_gicvX()
The GIC version checks used to determine host capabilities and guest
configuration have become somewhat conflated (in part due to the
addition of GICv5 support). vgic_is_v3() is a prime example, which
prior to this change has been a combination of guest configuration and
host cabability.

Split out the host capability check from vgic_is_v3(), which now only
checks if the vgic model itself is GICv3. Add two new functions:
vgic_host_has_gicv3() and vgic_host_has_gicv5(). These explicitly
check the host capabilities, i.e., can the host system run a GICvX
guest or not.

The vgic_is_v3() check in vcpu_set_ich_hcr() has been replaced with
vgic_host_has_gicv3() as this only applies on GICv3-capable hardware,
and isn't strictly only applicable for a GICv3 guest (it is actually
vital for vGICv2 on GICv3 hosts).

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-3-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 16:25:55 +00:00
Sascha Bischoff
90f0155f87 KVM: arm64: vgic-v3: Drop userspace write sanitization for ID_AA64PFR0.GIC on GICv5
Drop a check that blocked userspace writes to ID_AA64PFR0_EL1 for
writes that set the GIC field to 0 (NI) on GICv5 hosts. There is no
such check for GICv3 native systems, and having inconsistent behaviour
both complicates the logic and risks breaking existing userspace
software that expects to be able to write the register.

This means that userspace is now able to create a GICv3 guest on GICv5
hosts, and disable the guest from seeing that it has a GICv3. This
matches the already existing behaviour for GICv3-native VMs, allowing
for fewer issues when migrating from GICv3 hosts to compatible GICv5
hosts.

Additionally, this allows the trap and FGU infrastucture to kick in as
these rely on the state of the feature bits that have been set.

Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Link: https://patch.msgid.link/20260319154937.3619520-2-sascha.bischoff@arm.com
Signed-off-by: Marc Zyngier <maz@kernel.org>
2026-03-19 16:25:55 +00:00
Linus Torvalds
f338e77383 Linux 7.0-rc4 2026-03-15 13:52:05 -07:00
Linus Torvalds
5c2fe8d11a SCSI fixes on 20260315
The one core change is a re-roll of the tag allocation fix from the
 last pull request that uses the correct goto to unroll all the
 allocations.  The remianing fixes are all small ones in drivers.
 
 Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com>
 -----BEGIN PGP SIGNATURE-----
 
 iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCabbZ8xsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy
 c2hpcC5jb20ACgkQ50LJTO6YrIW4hAEAyEbXcyUa4tNTsQfRPeJitgq4WDyPDv83
 lnAvY/J5IEoBAJel9hRJ8lJfwziXVhMsxU3XHSXqQdA22N8tS7n4gTtq
 =IGTE
 -----END PGP SIGNATURE-----

Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "The one core change is a re-roll of the tag allocation fix from the
  last pull request that uses the correct goto to unroll all the
  allocations. The remianing fixes are all small ones in drivers"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: hisi_sas: Fix NULL pointer exception during user_scan()
  scsi: qla2xxx: Completely fix fcport double free
  scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend
  scsi: core: Fix error handling for scsi_alloc_sdev()
2026-03-15 13:15:39 -07:00
Linus Torvalds
d9bf296c39 Probes fixes for v7.0-rc3
- kprobes: avoid crash when rmmod/insmod after ftrace killed
   This fixes a kernel crash caused by kprobes on the symbol in a
   module which is unloaded after ftrace_kill() is called.
 - kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
   Remove unneeded WARN messages which can be kicked if the kprobe is
   using ftrace and it fails to enable the ftrace. Since kprobes
   correctly handle such failure, we don't need to warn it.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmm2hk8bHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bBZkH+gP3OllhdIU3AUB+vXEb
 UEE3VE5IZRufSgtjbbJnYI3b8U2dWXw7wmb+fBJ0i0Zf6F+2IUr3hUg1pHNARvlL
 MMu1YW7PG8gKGUsNc7jpHBVXrnefA4XpzXe7wtxaGvqAV16nL/6xhZlanGgL50Gv
 +F9cETMIGZ8duF6XVgEMmUUCg88Iwpp9MjzDQOjpRK7z41LND3ccJ2V88ODzDevj
 idnRbnk12Q9b7xZwGL5P5Ab163kHPFExsXQQnPmy/0fLcyGi8U3hY5EwYhOT85J0
 qRZVHpR1yrXqBpaxD/7as5/pfuUluxdzwmDkyRuQGYW6y7xkhlVNEGWqsWZeYLuW
 IZU=
 =Zkm3
 -----END PGP SIGNATURE-----

Merge tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull probes fixes from Masami Hiramatsu:

 - Avoid crash when rmmod/insmod after ftrace killed

   This fixes a kernel crash caused by kprobes on the symbol in a module
   which is unloaded after ftrace_kill() is called.

 - Remove unneeded warnings from __arm_kprobe_ftrace()

   Remove unneeded WARN messages which can be triggered if the kprobe is
   using ftrace and it fails to enable the ftrace. Since kprobes
   correctly handle such failure, we don't need to warn it.

* tag 'probes-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  kprobes: Remove unneeded warnings from __arm_kprobe_ftrace()
  kprobes: avoid crash when rmmod/insmod after ftrace killed
2026-03-15 13:08:05 -07:00
Linus Torvalds
62cda74c79 Bootconfig fixes for v7.0-rc3
- lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace
   error; This fixes a wrong error place in unclosed brace error
   message.
 - lib/bootconfig: check bounds before writing in __xbc_open_brace();
   This fixes to check the array index before setting array, so that
   the bootconfig can support 16th-depth nested brace correctly.
 - lib/bootconfig: fix snprintf truncation check in
   xbc_node_compose_key_after(); This fixes to handle the return
   value of snprintf() correctly in case of the return value ==
   size.
 - bootconfig: Add bootconfig tests about braces
   Add test cases for checking error position about unclosed brace
   and ensuring supporting 16th depth nested braces correctly.
 -----BEGIN PGP SIGNATURE-----
 
 iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmmz2oUbHG1hc2FtaS5o
 aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bVUsH/RZ1L9qQzbUH5gFtnKuP
 cv8R84lVOf9+Yg9H+RCT689qCOTtLIVuK6LaDCChhbeiaF05hXIvRu0Dr1WmVrxc
 O7ur1LucRNbEsB2O2UCWZjW1SBbNa9zvgaYGMFhBbkViGUUfj9uJgyn5zin0A6Pl
 nwHuN3BNqEmR2aayikdLESwJ3IBYyrtPWg0/lBT+Dy5lcnh6h5+2HP1u70W3i7+c
 4psAqA0A+a1nY9yQD+tw8kzUb8ZXgyTrkGkWECRkb/M7K843X/Csi64GYCGNlmuw
 FXcIwxgGk5X3yQgDOoPHB6sBB7Cgo6jokxUJwrCiJintZJEQj5Ryzun8FmAi9vvO
 NmU=
 =15kg
 -----END PGP SIGNATURE-----

Merge tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull bootconfig fixes from Masami Hiramatsu:

 - fix off-by-one in xbc_verify_tree() unclosed brace error. This fixes
   a wrong error place in unclosed brace error message

 - check bounds before writing in __xbc_open_brace(). This fixes to
   check the array index before setting array, so that the bootconfig
   can support 16th-depth nested brace correctly

 - fix snprintf truncation check in xbc_node_compose_key_after(). This
   fixes to handle the return value of snprintf() correctly in case of
   the return value == size

 - Add bootconfig tests about braces Add test cases for checking error
   position about unclosed brace and ensuring supporting 16th depth
   nested braces correctly

* tag 'bootconfig-fixes-v7.0-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  bootconfig: Add bootconfig tests about braces
  lib/bootconfig: fix snprintf truncation check in xbc_node_compose_key_after()
  lib/bootconfig: check bounds before writing in __xbc_open_brace()
  lib/bootconfig: fix off-by-one in xbc_verify_tree() unclosed brace error
2026-03-15 12:50:05 -07:00
Linus Torvalds
11e8c7e947 ARM:
- Correctly handle deeactivation of interrupts that were activated from
   LRs.  Since EOIcount only denotes deactivation of interrupts that
   are not present in an LR, start EOIcount deactivation walk *after*
   the last irq that made it into an LR.
 
 - Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when
   pKVM is already enabled -- not only thhis isn't possible (pKVM
   will reject the call), but it is also useless: this can only
   happen for a CPU that has already booted once, and the capability
   will not change.
 
 - Fix a couple of low-severity bugs in our S2 fault handling path,
   affecting the recently introduced LS64 handling and the even more
   esoteric handling of hwpoison in a nested context
 
 - Address yet another syzkaller finding in the vgic initialisation,
   where we would end-up destroying an uninitialised vgic with nasty
   consequences
 
 - Address an annoying case of pKVM failing to boot when some of the
   memblock regions that the host is faulting in are not page-aligned
 
 - Inject some sanity in the NV stage-2 walker by checking the limits
   against the advertised PA size, and correctly report the resulting
   faults
 
 PPC:
 
 - Fix a PPC e500 build error due to a long-standing wart that was exposed by
   the recent conversion to kmalloc_obj(); rip out all the ugliness that
   led to the wart.
 
 RISC-V:
 
 - Prevent speculative out-of-bounds access using array_index_nospec()
   in APLIC interrupt handling, ONE_REG regiser access, AIA CSR access,
   float register access, and PMU counter access
 
 - Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(),
   kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr()
 
 - Fix potential null pointer dereference in kvm_riscv_vcpu_aia_rmw_topei()
 
 - Fix off-by-one array access in SBI PMU
 
 - Skip THP support check during dirty logging
 
 - Fix error code returned for Smstateen and Ssaia ONE_REG interface
 
 - Check host Ssaia extension when creating AIA irqchip
 
 x86:
 
 - Fix cases where CPUID mitigation features were incorrectly marked as
   available whenever the kernel used scattered feature words for them.
 
 - Validate _all_ GVAs, rather than just the first GVA, when processing
   a range of GVAs for Hyper-V's TLB flush hypercalls.
 
 - Fix a brown paper bug in add_atomic_switch_msr().
 
 - Use hlist_for_each_entry_srcu() when traversing mask_notifier_list,
   to fix a lockdep warning; KVM doesn't hold RCU, just irq_srcu.
 
 - Ensure AVIC VMCB fields are initialized if the VM has an in-kernel local
   APIC (and AVIC is enabled at the module level).
 
 - Update CR8 write interception when AVIC is (de)activated, to fix a bug
   where the guest can run in perpetuity with the CR8 intercept enabled.
 
 - Add a quirk to skip the consistency check on FREEZE_IN_SMM, i.e. to allow
   L1 hypervisors to set FREEZE_IN_SMM.  This reverts (by default) an
   unintentional tightening of userspace ABI in 6.17, and provides some
   amount of backwards compatibility with hypervisors who want to freeze
   PMCs on VM-Entry.
 
 - Validate the VMCS/VMCB on return to a nested guest from SMM, because
   either userspace or the guest could stash invalid values in memory
   and trigger the processor's consistency checks.
 
 Generic:
 
 - Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from being
   unnecessary and confusing, triggered compiler warnings due to
   -Wflex-array-member-not-at-end.
 
 - Document that vcpu->mutex is take outside of kvm->slots_lock and
   kvm->slots_arch_lock, which is intentional and desirable despite being
   rather unintuitive.
 
 Selftests:
 
 - Increase the maximum number of NUMA nodes in the guest_memfd selftest to
   64 (from 8).
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmmy6n8UHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroNX7ggAhWoCG+AE6P3yrp6Mi+nRYpeRGC3q
 q2IiZCn0UoCg6q3c2kgn7b/N2zLJs0Q8FZRCEp2Je+2uvptpmdp/BMEfiIU3n2/a
 61z+Dydbpyc+kUmhJzUJ+aotq5FnMNmAAmqSKoc19GhAx2OQhQmBP/JOZ0P/eqLE
 Is0qNBgr/Zms2ib3GFf/JT+urysL2mX47qe92HTzq1T9EEG0KleID0Jz8vYQI8Fr
 I5N9+lTxagQDi8ytwOM85Cn8K7wh+CQIgzmciHcVErpAvAWkrEjrPlQltpEz2C5B
 aWEcRgw46utEaAiwPQGJRW6TeoKUG0pUR3v6T90nBkjjJ1npm6gPVE6TBA==
 =7nQ9
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "Quite a large pull request, partly due to skipping last week and
  therefore having material from ~all submaintainers in this one. About
  a fourth of it is a new selftest, and a couple more changes are large
  in number of files touched (fixing a -Wflex-array-member-not-at-end
  compiler warning) or lines changed (reformatting of a table in the API
  documentation, thanks rST).

  But who am I kidding---it's a lot of commits and there are a lot of
  bugs being fixed here, some of them on the nastier side like the
  RISC-V ones.

  ARM:

   - Correctly handle deactivation of interrupts that were activated
     from LRs. Since EOIcount only denotes deactivation of interrupts
     that are not present in an LR, start EOIcount deactivation walk
     *after* the last irq that made it into an LR

   - Avoid calling into the stubs to probe for ICH_VTR_EL2.TDS when pKVM
     is already enabled -- not only thhis isn't possible (pKVM will
     reject the call), but it is also useless: this can only happen for
     a CPU that has already booted once, and the capability will not
     change

   - Fix a couple of low-severity bugs in our S2 fault handling path,
     affecting the recently introduced LS64 handling and the even more
     esoteric handling of hwpoison in a nested context

   - Address yet another syzkaller finding in the vgic initialisation,
     where we would end-up destroying an uninitialised vgic with nasty
     consequences

   - Address an annoying case of pKVM failing to boot when some of the
     memblock regions that the host is faulting in are not page-aligned

   - Inject some sanity in the NV stage-2 walker by checking the limits
     against the advertised PA size, and correctly report the resulting
     faults

  PPC:

   - Fix a PPC e500 build error due to a long-standing wart that was
     exposed by the recent conversion to kmalloc_obj(); rip out all the
     ugliness that led to the wart

  RISC-V:

   - Prevent speculative out-of-bounds access using array_index_nospec()
     in APLIC interrupt handling, ONE_REG regiser access, AIA CSR
     access, float register access, and PMU counter access

   - Fix potential use-after-free issues in kvm_riscv_gstage_get_leaf(),
     kvm_riscv_aia_aplic_has_attr(), and kvm_riscv_aia_imsic_has_attr()

   - Fix potential null pointer dereference in
     kvm_riscv_vcpu_aia_rmw_topei()

   - Fix off-by-one array access in SBI PMU

   - Skip THP support check during dirty logging

   - Fix error code returned for Smstateen and Ssaia ONE_REG interface

   - Check host Ssaia extension when creating AIA irqchip

  x86:

   - Fix cases where CPUID mitigation features were incorrectly marked
     as available whenever the kernel used scattered feature words for
     them

   - Validate _all_ GVAs, rather than just the first GVA, when
     processing a range of GVAs for Hyper-V's TLB flush hypercalls

   - Fix a brown paper bug in add_atomic_switch_msr()

   - Use hlist_for_each_entry_srcu() when traversing mask_notifier_list,
     to fix a lockdep warning; KVM doesn't hold RCU, just irq_srcu

   - Ensure AVIC VMCB fields are initialized if the VM has an in-kernel
     local APIC (and AVIC is enabled at the module level)

   - Update CR8 write interception when AVIC is (de)activated, to fix a
     bug where the guest can run in perpetuity with the CR8 intercept
     enabled

   - Add a quirk to skip the consistency check on FREEZE_IN_SMM, i.e. to
     allow L1 hypervisors to set FREEZE_IN_SMM. This reverts (by
     default) an unintentional tightening of userspace ABI in 6.17, and
     provides some amount of backwards compatibility with hypervisors
     who want to freeze PMCs on VM-Entry

   - Validate the VMCS/VMCB on return to a nested guest from SMM,
     because either userspace or the guest could stash invalid values in
     memory and trigger the processor's consistency checks

  Generic:

   - Remove a subtle pseudo-overlay of kvm_stats_desc, which, aside from
     being unnecessary and confusing, triggered compiler warnings due to
     -Wflex-array-member-not-at-end

   - Document that vcpu->mutex is take outside of kvm->slots_lock and
     kvm->slots_arch_lock, which is intentional and desirable despite
     being rather unintuitive

  Selftests:

   - Increase the maximum number of NUMA nodes in the guest_memfd
     selftest to 64 (from 8)"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (43 commits)
  KVM: selftests: Verify SEV+ guests can read and write EFER, CR0, CR4, and CR8
  Documentation: kvm: fix formatting of the quirks table
  KVM: x86: clarify leave_smm() return value
  selftests: kvm: add a test that VMX validates controls on RSM
  selftests: kvm: extract common functionality out of smm_test.c
  KVM: SVM: check validity of VMCB controls when returning from SMM
  KVM: VMX: check validity of VMCS controls when returning from SMM
  KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated
  KVM: SVM: Initialize AVIC VMCB fields if AVIC is enabled with in-kernel APIC
  KVM: x86: Introduce KVM_X86_QUIRK_VMCS12_ALLOW_FREEZE_IN_SMM
  KVM: x86: Fix SRCU list traversal in kvm_fire_mask_notifiers()
  KVM: VMX: Fix a wrong MSR update in add_atomic_switch_msr()
  KVM: x86: hyper-v: Validate all GVAs during PV TLB flush
  KVM: x86: synthesize CPUID bits only if CPU capability is set
  KVM: PPC: e500: Rip out "struct tlbe_ref"
  KVM: PPC: e500: Fix build error due to using kmalloc_obj() with wrong type
  KVM: selftests: Increase 'maxnode' for guest_memfd tests
  KVM: arm64: pkvm: Don't reprobe for ICH_VTR_EL2.TDS on CPU hotplug
  KVM: arm64: vgic: Pick EOIcount deactivations from AP-list tail
  KVM: arm64: Remove the redundant ISB in __kvm_at_s1e2()
  ...
2026-03-15 12:22:10 -07:00
Linus Torvalds
4f3df2e5ea powerpc fixes for 7.0 #3
- Fix KUAP warning in VMX usercopy path
  - Fix lockdep warning during PCI enumeration
  - Fix to move CMA reservations to arch_mm_preinit
  - Fix to check current->mm is alive before getting user callchain
 
 Thanks to: Aboorva Devarajan, Christophe Leroy (CS GROUP), Dan Horák, Nicolin
 Chen, Nilay Shroff, Qiao Zhao, Ritesh Harjani (IBM), Saket Kumar Bhaskar,
 Sayali Patil, Shrikanth Hegde, Venkat Rao Bagalkote, Viktor Malik,
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEqX2DNAOgU8sBX3pRpnEsdPSHZJQFAmm2KVsACgkQpnEsdPSH
 ZJT6VBAAlmediTysFMpS6qnxrhJ/ZbERskIvfGkcW4i8lPr5yluPjQhj75Q9RYIy
 eRFS5eYssQVXbhS1/YWfsQKcG2tH7ucl0ocYfl8xvGGCgpSEu+wYTwECj2OVSF7T
 BiQ6VsHcOLJJ1SxCoS17n+sl8WGuIGikWKYM2ECeNx7iysrFczcj4RQ9Z4aYWT91
 xmgDyQwrNmxSy85OXq5ITLcY5IcVLtwnpjyTp4z94fP2Ho/R/muL9i3Sven7Iiqm
 a5I5XDozMFxtFtOxYlh7y8cKisDEYqinqoA/9P59kEtZ5XML8yp/s7rJ7Gjl/AmF
 O3fEAbtevTz2XvpVpx6XiRAXDtdRyR+YFUZMTABawDFlHZffD7m4eg/9A4JvDJ/8
 LxklCGLECZes+dEULGG/kXoOD7e2jJKDBsGYjgGWXU5+ZI8qjhfSWdiXAcl1DEHd
 gYZ2N6eYNWP/m2wqs5FUiabdB0yPdcpI7ukxmECpQDdS4TCA4sU3DI0FRyGktABV
 nNaYBZezZhlCWzNo/NBxFAvj6OHmo8WYHX1G6piE6nJKYyPlbjLyV5/tvkW9oxlM
 HlejFBKF4Us9ZotNgWxQdJzZCJ3qWmuxDgukzShX4mDbGdK8+4Vv9Qjk1SwsCypS
 HQ/ff0SNcHVdDJkw41jOJxoTv/2+vEB+1FmytmZ7s/fxUs/qW04=
 =OrN9
 -----END PGP SIGNATURE-----

Merge tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux

Pull powerpc fixes from Madhavan Srinivasan:

 - Fix KUAP warning in VMX usercopy path

 - Fix lockdep warning during PCI enumeration

 - Fix to move CMA reservations to arch_mm_preinit

 - Fix to check current->mm is alive before getting user callchain

Thanks to Aboorva Devarajan, Christophe Leroy (CS GROUP), Dan Horák,
Nicolin Chen, Nilay Shroff, Qiao Zhao, Ritesh Harjani (IBM), Saket Kumar
Bhaskar, Sayali Patil, Shrikanth Hegde, Venkat Rao Bagalkote, and Viktor
Malik.

* tag 'powerpc-7.0-3' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/iommu: fix lockdep warning during PCI enumeration
  powerpc/selftests/copyloops: extend selftest to exercise __copy_tofrom_user_power7_vmx
  powerpc: fix KUAP warning in VMX usercopy path
  powerpc, perf: Check that current->mm is alive before getting user callchain
  powerpc/mem: Move CMA reservations to arch_mm_preinit
2026-03-15 11:36:11 -07:00
Linus Torvalds
13af67f599 Work around S2RAM hang if the firmware unexpectedly re-enables
the x2apic hardware while it was disabled by the kernel.
 Force-disable it again and issue a warning into the syslog.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2KNoRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hfDA/+O/SDkyk/FWwe7loZJ0A2jZCJgHfyJakS
 aaIkIqtOWLt2L5TtPDMBzPr/bwER+aj4sXBqAJA37Ky+UGwTkTLDHOO6t/WFc/Ef
 4R+XdcLl64QNmqsm2bAi9PP2G7N6xDT6HKoRwKml/URM6Hfi0R63Mh8BG0FAY5RU
 oAMQg8V36TWb9FBMjU4XgoVOAu4Eec1Vx65wYdoxsOZn+M6eL55gTdTd5FR2Nc0p
 WZLakpjGnxAsu9QH6XJ5uD4G7lJkMauyxStHig1nG4C9U0briTS0D5V+95TWTmO0
 8DBelOr3zDZ11DB/rVsFS54nxH66uWkA7jbZFC3xyHq53GbAHIuYqZAl2Q8ZmVY/
 wEy1nbEF7NIidT1pZuczJ69eGGooiMrPAEF10HmBxlzYx367SI3hFhSblRODwPiH
 cdD0cmQhraUfWKhLJBBT2/+URFbjZnUtA+O/3P3V6XODIDGESFU5yYKGLlEdi+wV
 HBxMIXAVbbXXqzZ1nsahnvCjgFr1nwRpbDw8l5wapjbFwso2+RSe2pPUPKzbgt0I
 /IrPKr8p7UepDe4EPytLwWotSuok4GQRMFIX4V1OLxcQSQvk+IfLwjmMvyOm3UU+
 OaWRplD3oGXrJvMqtsPgs6itu3SW7DjshBLbSpTOc/Eee8OlDpFJ13X0JqimOzj/
 RfPPSpD3iyE=
 =VNhj
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:
 "Work around S2RAM hang if the firmware unexpectedly re-enables the
  x2apic hardware while it was disabled by the kernel.

  Force-disable it again and issue a warning into the syslog"

* tag 'x86-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/apic: Disable x2apic on resume if the kernel expects so
2026-03-15 11:26:36 -07:00
Linus Torvalds
164cb546e9 Fix function tracer recursion bug by marking jiffies_64_to_clock_t()
notrace.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2J6MRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hQ9g//Qwq0Esh58yP0UkySArlf7xrOEBrfIF2R
 W7aLDRevhTCklN5z4BlkCaT7XyfZL19CF2AXW1PZ9fSJKlM/vK0xkFToSiKuG6Pc
 2BvfYOvePrmT+8AMnhFe2ekzJclUi9s+ars3H0i59Xu6D+CCOqDvvdGoVkdfuL5+
 eYlxVZK2TtrZEDkdXkBD0vPvcrXqYxDnZD3Pkpys9NQBxSyIDwVdCr+uNVv3hCsf
 L6TAnOzUbI7jWp805izAgdQ4E0P2ywb83nK8op++p4J8PpVaGSnW6LmfDmBsKvRG
 V+cyqXdMToZjEayBdjDgk3GH6M4K2lFWsg1TVfqE1K05fwEdNDYJY7G7eKvhrLH1
 2oNvsEMKLXNVSTgn7gSr63IQBC7+J0eKkmBp1Lv9WWjqYC4QYacrFm4Fc5OCmec0
 GI3QQwPvNa+i7GByvLbXe8+8q/BLIWOIcCutlU8GRdYaghA1lOynI8dQmKfSdM+j
 O1TMIqI56ymffsiBe4d9iUyzCWUdB1LXR0Hm36wm+SJmydc6/Ael1gUlFjqXpGKq
 Ui4h5rRtNvZgsqmsGGgjMvdiZ9dN/e7tz4tdyp4oCcpKhfDT7qNLdHeoyvDxhDs/
 uTvpAK5iH6Wxa91DXt4M+17gf97Ws1dIHU6G9og4B1l5bptyXmrMuVPmK8L/wxDu
 POJGsxuIStA=
 =Obpb
 -----END PGP SIGNATURE-----

Merge tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull timer fix from Ingo Molnar:
 "Fix function tracer recursion bug by marking jiffies_64_to_clock_t()
  notrace"

* tag 'timers-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  time/jiffies: Mark jiffies_64_to_clock_t() notrace
2026-03-15 11:14:09 -07:00
Linus Torvalds
63724e9519 More MM-CID fixes, mostly fixing hangs/races:
- Fix CID hangs due to a race between concurrent forks
 
  - Fix vfork()/CLONE_VM MMCID bug causing hangs
 
  - Remove pointless preemption guard
 
  - Fix CID task list walk performance regression on large systems
    by removing the known-flaky and slow counting logic using
    for_each_process_thread() in mm_cid_*fixup_tasks_to_cpus(),
    and implementing a simple sched_mm_cid::node list instead
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2JvIRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hTqg/+K7b4LDOi3nVblmoj6q+mQj2i8DFPbi10
 zeAWJJnamYWPvUi+Wxq30JjZJ9v+15Ddcmbhea9m/3u1YO6nAL5TbGeQcJ2LU/7p
 Ynu9cznv9PfqO4X7WQc3gJC9xx8PbcM00E3JzGxDX/3NDmDBaTOwwuTp41ymcbhm
 cGfnUQWGt81sMummVzqehszfIRMZHnWflYDJ2gC66rcGXMNBlEX125F8jybOm66n
 Ez6gO7e9EGn28+hZIufySsxaeeK/3NFVKj1UjGP/FMuBwQFAjHPv61nic33nOKXT
 yrw7U8DIaYUqFN4d1lplTG72j2YSUj7snn3Q+ubxpzFmOt7RmouVqwlVGEoey5fh
 cEe2VYSQFoZKQioWWyms1LP1hTOa2JkNVhdjBfRZ8IM+Wp47OaDiw1h1+zwwMDbJ
 xpDAXEuU+sBZiv2SeBLFQgrGj58gb8pdjN4o47X89mx8TKYWtStrCMsD+MF10LBm
 dz780Eiinbw5D8JBsxU/ehETpgrAAVmo1KbFx2Q2grAgkJs7jSqBN2KF8NpmH/ZS
 Jk8SpQOn4Vp8iO32TbpsV/GErG9EQgixQxnkTukv2Qd9kguhmjwbi/blN3rLBlBb
 XbmR9rRAMfAjlPrk84tn9ecXNWO0NV83IYheAwjip36alSbOs+OcxdhrZ78nxh8C
 EsKqGl3PeOk=
 =ce5G
 -----END PGP SIGNATURE-----

Merge tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull scheduler fixes from Ingo Molnar:
 "More MM-CID fixes, mostly fixing hangs/races:

   - Fix CID hangs due to a race between concurrent forks

   - Fix vfork()/CLONE_VM MMCID bug causing hangs

   - Remove pointless preemption guard

   - Fix CID task list walk performance regression on large systems
     by removing the known-flaky and slow counting logic using
     for_each_process_thread() in mm_cid_*fixup_tasks_to_cpus(), and
     implementing a simple sched_mm_cid::node list instead"

* tag 'sched-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/mmcid: Avoid full tasklist walks
  sched/mmcid: Remove pointless preempt guard
  sched/mmcid: Handle vfork()/CLONE_VM correctly
  sched/mmcid: Prevent CID stalls due to concurrent forks
2026-03-15 10:49:47 -07:00
Linus Torvalds
9745031130 Miscellaneous objtool fixes:
- Fix cross-build bug by using HOSTCFLAGS for HAVE_XXHASH test
  - Fix klp bug by fixing detection of corrupt static branch/call entries
  - Handle unsupported pr_debug() usage more gracefully
  - Fix hypothethical klp bug by avoiding NULL pointer dereference when printing code symbol name
  - Fix data alignment bug in elf_add_data() causing mangled strings
  - Fix confusing ERROR_INSN() error message
  - Handle unexpected Clang RSP musical chairs causing false positive warnings
  - Fix another objtool stack overflow in validate_branch()
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2I2QRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hcbQ/9F77gitPLuQ0RHujGYXrGMrPs+msXC+kN
 IlCJekmVck2v7QKXO45WKLs5kRHePWlRb6KAbpx5Yhzrt6LEUsxzM/Qk6kxdrlaK
 w5sRbIPDkrV7vr1Lk28NyniJCtllA1xRSQ8pAfzqmiAwI7qpNuqOtNDmNQwEK61S
 CF3YQnUSg1AmJ8R4yuXLOAGExrnfuLwxLA4AZVm42q5Ind9cRSNPXT5K/llhAmer
 GyXEVRY+w+7al7/3uuSRvP6X4XxLswefYMcaYY6ZPCwe3Kv+eivqgxU8sde3y4Cy
 txRkrLWswOazMzIhkxfMh5XEjg32bFqjMq9OqY/ntVBXwGFIwZv9r9mgJdYTgVdg
 URZgo275yyYZyCl5am5N3hYUH4PNGY6trrzU58WpIuxZ4wy4//DXH8Z0IahQ4QNV
 NdN9ovXPbjlIpN3r/XtSTIjMIuTzTEMRiwuh1ffLd2GM+DidKfmoiiMULyOljhyN
 b+nprW8om4jd552Dbtoi7MzzfY23c+gbJE3YJd4QQ72iAQntUoafBbsDGM+XmRlj
 bjki8kDlQhhmH61cGEZffw2nw1TrPYZQvx3qWYnZXBtpUXswT91tNeomFlFvKJsh
 Fi8llS6g6yoIDmOeSwgUak4HLiRdcgLqZCa8OjoJ6tXZ86gvEAv4NJpeAzMbvE3W
 p935MRCK0bo=
 =JEz6
 -----END PGP SIGNATURE-----

Merge tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull objtool fixes from Ingo Molnar:

 - Fix cross-build bug by using HOSTCFLAGS for HAVE_XXHASH test

 - Fix klp bug by fixing detection of corrupt static branch/call entries

 - Handle unsupported pr_debug() usage more gracefully

 - Fix hypothetical klp bug by avoiding NULL pointer dereference when
   printing code symbol name

 - Fix data alignment bug in elf_add_data() causing mangled strings

 - Fix confusing ERROR_INSN() error message

 - Handle unexpected Clang RSP musical chairs causing false positive
   warnings

 - Fix another objtool stack overflow in validate_branch()

* tag 'objtool-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  objtool: Fix another stack overflow in validate_branch()
  objtool: Handle Clang RSP musical chairs
  objtool: Fix ERROR_INSN() error message
  objtool: Fix data alignment in elf_add_data()
  objtool: Use HOSTCFLAGS for HAVE_XXHASH test
  objtool/klp: Avoid NULL pointer dereference when printing code symbol name
  objtool/klp: Disable unsupported pr_debug() usage
  objtool/klp: Fix detection of corrupt static branch/call entries
2026-03-15 10:36:01 -07:00
Linus Torvalds
be2e3750ce Two fixes for the riscv-aplic irqchip driver:
- Fix probing dependency bug on probing failure
  - Fix double register_syscore() bug
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmm2H2YRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hPXhAApm61pOCQ18dxPgRLzJ0Q2+NSFWsI+C7w
 epAxScujo7f0FcwpztxFLRUuRkUgnU1lujW1QoEdnZWm0rWnyrfQiibX/8V774VH
 5d7+QQWNMp/0B7UcEE/zN0x4ceCn9PSCgSqR72n7STNlNH052yJyMKzfCXDJ8Evl
 rY7WdOKFv+QtCcYVoVr9Z7qIhDzBv1cHqpLsymq9ZutJSvO5VlkChBt/InxKwR8K
 2z/gsn1CG08DnXQi2QFog9iwnSDeozEuBlpj6w8KdhMDp9qUgdj1RO0N7bSjQw7s
 sXtH2cX6aKb6cDdd6BMb0RK1yAFx7me/iIZ/8Q1s3q/aCAJnd99SPSJvIcEp9Rf1
 h+kPUtzWdhO+L7rAh2l6lqMAhd2aAgug5DoR3WgnryUCwC4iW7snZsMjoarqE4Hb
 pmrXeay5HGXDswqUesSfaFAwfEPLGUO2dSprBDEoEBNDNEDh3ymsRrOE6XHuNJk5
 FadOEJyHT+12M/902HknFleHd05RRT5mGr78Snlg9vS0tVX5uEMgMUT0QZIfQVoj
 zzwkRN1IolY4vt60nXFHNIlD4twS2P1PYG3xQpElP5k2046dPz2MCmxadDvziQ8L
 bNhMAfXKZP7nas2Zq4FP3NcLe8d5JKoU7yZzlF0KFADQh+G2t4VJ1y80iJo4HqXd
 GGnib/X+G5o=
 =E4U3
 -----END PGP SIGNATURE-----

Merge tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull irq fixes from Ingo Molnar:
 "Two fixes for the riscv-aplic irqchip driver:

   - Fix probing dependency bug on probing failure

   - Fix double register_syscore() bug"

* tag 'irq-urgent-2026-03-15' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/riscv-aplic: Register syscore operations only once
  irqchip/riscv-aplic: Do not clear ACPI dependencies on probe failure
2026-03-15 10:32:57 -07:00
Linus Torvalds
9a48d4a130 I3C fixes for 7.0
Subsystem:
  - simplify combined i3c/i2c dependencies
 
 Drivers:
  - dw: handle 2C properly, fix possible race condition
  - mipi-i3c-hci: many DMA related fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEBqsFVZXh8s/0O5JiY6TcMGxwOjIFAmm13MwACgkQY6TcMGxw
 OjJ9EQ//ZoiUxGeiLkfqHDWq0uEQVuOnYXFhcpNkDrxBB9GUJvt3FWgrAHFt/VqV
 rSgzC1PfPs7TVRoRtpOXoxcj7J97a5m3BgnqeoDtKXM4aiYx5PoUf7WmOGVSGp+m
 9QsQZdJre4WJz7Q4Ozb+XMO4WEgHyZYn2GPVjg2k99S45IfbKXxT5WpAeymdLqL4
 Hyz1RpVqhLPdQItQMp6/AIc99L+CDCso4rrwDsRa62fPUFQdLfYPG9XdC/VRexi2
 p9EUgmBg8Dw9CzniXknxzB24ZsmCsHwBhK2lfrjmTwElvHG0sUUrVttG2QbMl7MC
 u3KcKr8ZDAETC7498wkcgdeDA6a5gX7DKRWl9lJ7CCa4QUcCHhdKtLgLSDIhDOLf
 LPU0AfPZQfZd2g3ErZt6pt8nXstcqAJrbcOBbwe1bHvE4VNl947B+STyfsYTdJOD
 qyFKe2Qb2ZUUFWyjiAO+lN5QJBxX4fjqJPkCe+PakXxkRhrKGrCBf647UbUNcwjV
 qs1kdfmH4JYi7WwL1AFmWKkBAEtPGKUXBoVb2nmfArrXawYhYjyWRhAZqthg/gaj
 iyH/SWe0bOw3sf/bHgxYlzUP3mwqwtln6DihKHlEq3OeW6DoBkE29rc7NhuphTW0
 Os9epJIbaKsbvmSV7TA3izpgZHg6qDXliprrvfP/ahSh7w/Gl6g=
 =Ojo2
 -----END PGP SIGNATURE-----

Merge tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux

Pull i3c fixes from Alexandre Belloni:
 "This introduces the I3C_OR_I2C symbol which is not a fix per se but is
  affecting multiple subsystems so it is included to ease
  synchronization.

  Apart from that, Adrian is mostly fixing the mipi-i3c-hci driver DMA
  handling, and I took the opportunity to add two fixes for the dw-i3c
  driver.

  Subsystem:
   - simplify combined i3c/i2c dependencies

  Drivers:
   - dw: handle 2C properly, fix possible race condition
   - mipi-i3c-hci: many DMA related fixes"

* tag 'i3c/fixes-for-7.0' of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux:
  i3c: dw-i3c-master: Set SIR_REJECT in DAT on device attach and reattach
  i3c: master: dw-i3c: Fix missing of_node for virtual I2C adapter
  i3c: mipi-i3c-hci: Fallback to software reset when bus disable fails
  i3c: mipi-i3c-hci: Fix handling of shared IRQs during early initialization
  i3c: mipi-i3c-hci: Fix race in DMA error handling in interrupt context
  i3c: mipi-i3c-hci: Consolidate common xfer processing logic
  i3c: mipi-i3c-hci: Restart DMA ring correctly after dequeue abort
  i3c: mipi-i3c-hci: Add missing TID field to no-op command descriptor
  i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue
  i3c: mipi-i3c-hci: Fix race between DMA ring dequeue and interrupt handler
  i3c: mipi-i3c-hci: Fix race in DMA ring dequeue
  i3c: mipi-i3c-hci: Fix race in DMA ring enqueue for parallel xfers
  i3c: mipi-i3c-hci: Consolidate spinlocks
  i3c: mipi-i3c-hci: Factor out DMA mapping from queuing path
  i3c: mipi-i3c-hci: Fix Hot-Join NACK
  i3c: mipi-i3c-hci: Use ETIMEDOUT instead of ETIME for timeout errors
  i3c: simplify combined i3c/i2c dependencies
2026-03-14 16:25:10 -07:00
Linus Torvalds
f26de90c68 i2c-for-7.0-rc4
designware: DT binding maintainer update
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmm1zpcACgkQFA3kzBSg
 Kbbl8A//c3ZI9AQKm2DU3Real5nMdM7QyYxU4cai1xjEiZDDoodNNpkeZOn1aUyc
 xGC7XCH8BemqGQVxrrlT5XJM5lU/tWUxFa8VF43ARr/8yiH/X9dlLvwXwek22Bvj
 4wDoCkL122QFaA6qm2PwyvjMRvRaLaoWuoQOUykrXTSYcoNc7xEU1KN6HjyiS48i
 wuSW1uDALrmDX39n3zRsf3wTgvAzSjsF5BJpagt16uWcHxGQLJIVPYe5EgkECTz6
 5UgO2TIpNt62H7aY9MQ1DIUVzNsjFrFxIDlcGEFy5zOTGfC1MRwAL9RlYm0scPK2
 ESWM1Ux9qt4vfXB0fqBEEWN8/pDpRVIyrqP0c5P37KDmdIkcvpCUAqQ76Z0TU1Ss
 RDxRZPpxk0uKr+OFfJlizYhaXphI009ImdfZKYpawortfRogJYklQybi5z9H32wy
 jHshZlU4+yUcGer+t/5Zhw8goOEtHtDeS2z76YecOA17/zADyxOW/qZ1ejSRXOys
 0VpB8tXhYohCUhoXGrX46K92kyqIkx3U8Jy6vuvVSw9G8vBRrk8wzWaXFZmMo4OA
 USJ/de7LTZgeP5P2065jFxcyqC1FAmlDxh9EhwYcHtbRetKnot8D8pWVPZqLy8k4
 IbTkxACIqPy+IEqiRzrBzC0PgOsvzCSS6swV2cBuXXbvqL0fMrU=
 =6eyN
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c fix from Wolfram Sang:
 "Designware DT binding maintainer update"

* tag 'i2c-for-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  dt-bindings: i2c: dw: Update maintainer
2026-03-14 16:15:49 -07:00
Linus Torvalds
267594792a Rust fixes for v7.0 (2nd)
Toolchain and infrastructure:
 
  - Remap paths to avoid absolute ones starting with the upcoming Rust
    1.95.0 release. This improves build reproducibility, avoids leaking
    the exact path and avoids having the same path appear in two forms.
 
    The approach here avoids remapping debug information as well, in
    order to avoid breaking tools that used the paths to access source
    files, which was the previous attempt that needed to be reverted.
 
  - Allow 'unused_features' lint for the upcoming Rust 1.96.0 release.
    While well-intentioned, we do not benefit much from the new lint.
 
  - Emit dependency information into '$(depfile)' directly to avoid
    a temporary '.d' file (it was an old approach).
 
 'kernel' crate:
 
  - 'str' module: fix warning under '!CONFIG_BLOCK' by making
    'NullTerminatedFormatter' public.
 
  - 'cpufreq' module: suppress false positive Clippy warning.
 
 'pin-init' crate:
 
  - Remove '#[disable_initialized_field_access]' attribute which was
    unsound. This means removing the support for structs with unaligned
    fields (through the 'repr(packed)' attribute), for now.
 
    And document the load-bearing fact of field accessors (i.e. that they
    are required for soundness).
 
  - Replace shadowed return token by 'unsafe'-to-create token in order
    to remain sound in the face of the likely upcoming Type Alias Impl
    Trait (TAIT) and the next trait solver in upstream Rust.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPjU5OPd5QIZ9jqqOGXyLc2htIW0FAmm1r2MACgkQGXyLc2ht
 IW17OhAAoRMLTOf/iTNu29njOtjG5iYABeC5zMnxYUErWGLOooz8D82UEiB85Whs
 uhVeW6YZ1jCcizglmbXOduKUOmSvEUYSv5/wj1w5OIF0FWW/6BA/aNdgDijHTbSU
 v/x5NfKwxZ7JD8ivl+Z7RxtA3ggEODr/pn8USIKaZr0wEjEcnP1xBedZR6+NXuBT
 CUXYm9g0BMfBbHsaI6DgD6/aj3TuHjbp1GGFlMmKd7YJGzFihhxU7nKtzkRDxAUd
 HROY1Pi+iEUXFYmeXbgObVgRqzcTYV37CkbMfPk1SoIdXXhtPcO8TJ1GguAMuVMO
 alAaVEAGFBKvnNGFoocCoxRt8U9hhiOiqlP+QMu2sbVWxWdmdBRcXlB+t4YIqFWy
 6Icp/5K8C6Tf7ZrDZhccn6T6jqp+mvNzfanppi0/DFlZiN+1oSABQgEV3YtAiEIW
 UHLT5bO5YEkHW73S9mSKhBhbH58h8IX7oGv/wteovI3gjMA9of/8/6MArWXbLpxj
 o6ws7p595/xRV+xZURm7YQm6wtbjBr4Eipgd3vIoc0Z+VbCnDLEs/n8cEYY2CtIg
 9Ze+MbBaqnf58qvhwj9Zy8ncQVnCtpQmybUE/i/YfdXo7AMsKtdUppv09xfz4fMC
 NWRqJttuWiUttGsLvi/GTxzkz5bT6Y6ZHHNqTyIKWXEIBTtRxK8=
 =7LgC
 -----END PGP SIGNATURE-----

Merge tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux

Pull Rust fixes from Miguel Ojeda:
 "Toolchain and infrastructure:

   - Remap paths to avoid absolute ones starting with the upcoming Rust
     1.95.0 release. This improves build reproducibility, avoids leaking
     the exact path and avoids having the same path appear in two forms

     The approach here avoids remapping debug information as well, in
     order to avoid breaking tools that used the paths to access source
     files, which was the previous attempt that needed to be reverted

   - Allow 'unused_features' lint for the upcoming Rust 1.96.0 release.
     While well-intentioned, we do not benefit much from the new lint

   - Emit dependency information into '$(depfile)' directly to avoid a
     temporary '.d' file (it was an old approach)

  'kernel' crate:

   - 'str' module: fix warning under '!CONFIG_BLOCK' by making
     'NullTerminatedFormatter' public

   - 'cpufreq' module: suppress false positive Clippy warning

  'pin-init' crate:

   - Remove '#[disable_initialized_field_access]' attribute which was
     unsound. This means removing the support for structs with unaligned
     fields (through the 'repr(packed)' attribute), for now

     And document the load-bearing fact of field accessors (i.e. that
     they are required for soundness)

   - Replace shadowed return token by 'unsafe'-to-create token in order
     to remain sound in the face of the likely upcoming Type Alias Impl
     Trait (TAIT) and the next trait solver in upstream Rust"

* tag 'rust-fixes-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
  rust: kbuild: allow `unused_features`
  rust: cpufreq: suppress clippy::double_parens in Policy doctest
  rust: pin-init: replace shadowed return token by `unsafe`-to-create token
  rust: pin-init: internal: init: document load-bearing fact of field accessors
  rust: pin-init: internal: init: remove `#[disable_initialized_field_access]`
  rust: build: remap path to avoid absolute path
  rust: kbuild: emit dep-info into $(depfile) directly
  rust: str: make NullTerminatedFormatter public
2026-03-14 12:35:16 -07:00
Linus Torvalds
69237f8c1f USB fixes for 7.0-rc4
Here is a large chunk of USB driver fixes for 7.0-rc4.  Included in here
 are:
   - usb gadget reverts due to reported issues, and then a follow-on fix
     to hopefully resolve the reported overall problem
   - xhci driver fixes
   - dwc3 driver fixes
   - usb core "killable" bulk message api addition to fix a usbtmc driver
     bug where userspace could hang the driver for forever
   - small USB driver fixes for reported issues
   - new usb device quirks
 
 All except the last USB device quirk change have been in linux-next with
 no reported issues.  That one came in too late, and is "obviously
 correct" :)
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCabVKjw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynxIACfUxlNXBrfcAz2xTRqEvFSFKiLscoAoMnGZG1U
 l7DU2htiO4Gacf5g6Yvj
 =wXSL
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB fixes from Greg KH:
 "Here is a large chunk of USB driver fixes for 7.0-rc4. Included in
  here are:

   - usb gadget reverts due to reported issues, and then a follow-on fix
     to hopefully resolve the reported overall problem

   - xhci driver fixes

   - dwc3 driver fixes

   - usb core "killable" bulk message api addition to fix a usbtmc
     driver bug where userspace could hang the driver for forever

   - small USB driver fixes for reported issues

   - new usb device quirks

  All except the last USB device quirk change have been in linux-next
  with no reported issues. That one came in too late, and is 'obviously
  correct' :)"

* tag 'usb-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (35 commits)
  USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed
  usb: roles: get usb role switch from parent only for usb-b-connector
  Revert "tcpm: allow looking for role_sw device in the main node"
  usb: gadget: f_ncm: Fix net_device lifecycle with device_move
  Revert "usb: gadget: u_ether: add gether_opts for config caching"
  Revert "usb: gadget: u_ether: use <linux/hex.h> header file"
  Revert "usb: gadget: u_ether: Add auto-cleanup helper for freeing net_device"
  Revert "usb: gadget: f_ncm: align net_device lifecycle with bind/unbind"
  Revert "usb: legacy: ncm: Fix NPE in gncm_bind"
  Revert "usb: gadget: f_ncm: Fix atomic context locking issue"
  usb: typec: altmode/displayport: set displayport signaling rate in configure message
  usb: dwc3: pci: add support for the Intel Nova Lake -H
  usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
  usb: gadget: uvc: fix interval_duration calculation
  xhci: Fix NULL pointer dereference when reading portli debugfs files
  usb: xhci: Prevent interrupt storm on host controller error (HCE)
  usb: xhci: Fix memory leak in xhci_disable_slot()
  usb: class: cdc-wdm: fix reordering issue in read code path
  usb: renesas_usbhs: fix use-after-free in ISR during device removal
  usb: cdc-acm: Restore CAP_BRK functionnality to CH343
  ...
2026-03-14 09:43:12 -07:00
Linus Torvalds
5c75125672 Char/Misc/IIO fixes for 7.0-rc1
Here are some char/misc/iio/binder fixes for 7.0-rc1.  Nothing major in
 here, just the usual:
   - lots of iio driver fixes for reported issues
   - rust binder fixes for problems found
   - gpib driver binding to the wrong device fix
   - firmware driver fix
 
 All of these have been in linux-next with no reported issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCabVFPA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ylXhQCaA1brq2J4IpLOtE27n1fjcpAxT4sAnA965yU2
 PnZmjUJq45WnuTeJumHT
 =k9IL
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull char / misc / IIO driver fixes from Greg KH:
 "Here are some char/misc/iio/binder fixes for 7.0-rc4. Nothing major in
  here, just the usual:

   - lots of iio driver fixes for reported issues

   - rust binder fixes for problems found

   - gpib driver binding to the wrong device fix

   - firmware driver fix

  All of these have been in linux-next with no reported issues"

* tag 'char-misc-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (28 commits)
  gpib: lpvo_usb: fix unintended binding of FTDI 8U232AM devices
  firmware: stratix10-svc: Add Multi SVC clients support
  rust_binder: use lock_vma_under_rcu() in use_page_slow()
  rust_binder: call set_notification_done() without proc lock
  rust_binder: avoid reading the written value in offsets array
  rust_binder: check ownership before using vma
  rust_binder: fix oneway spam detection
  firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled
  iio: imu: adis: Fix NULL pointer dereference in adis_init
  iio: imu: inv_icm45600: fix regulator put warning when probe fails
  iio: buffer: Fix wait_queue not being removed
  iio: gyro: mpu3050-core: fix pm_runtime error handling
  iio: gyro: mpu3050-i2c: fix pm_runtime error handling
  iio: adc: ad7768-1: Fix ERR_PTR dereference in ad7768_fill_scale_tbl
  iio: chemical: sps30_serial: fix buffer size in sps30_serial_read_meas()
  iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas()
  iio: magnetometer: tlv493d: remove erroneous shift in X-axis data
  iio: proximity: hx9023s: Protect against division by zero in set_samp_freq
  iio: proximity: hx9023s: fix assignment order for __counted_by
  iio: chemical: bme680: Fix measurement wait duration calculation
  ...
2026-03-14 09:38:49 -07:00
Linus Torvalds
4dad25aa60 Staging driver fixes for 7.0-rc4
Here are 3 small staging driver fixes for 7.0-rc4 that resolve some
 reported problems.  They are:
   - two rtl8723bs data validation bugfixes
   - sm750fb removal path bugfix
 
 All of these have been in linux-next for many weeks with no reported
 issues
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iGwEABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCabVGCw8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ynB3ACYx5YgUWTcKBybsYr3giJCz9bcGQCfb+UsN0gd
 aM0IulE6FNOCswgjWts=
 =bAkJ
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver fixes from Greg KH:
 "Here are three small staging driver fixes for 7.0-rc4 that resolve
  some reported problems. They are:

   - two rtl8723bs data validation bugfixes

   - sm750fb removal path bugfix

  All of these have been in linux-next for many weeks with no reported
  issues"

* tag 'staging-7.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
  staging: rtl8723bs: properly validate the data in rtw_get_ie_ex()
  staging: sm750fb: add missing pci_release_region on error and removal
2026-03-14 09:33:58 -07:00
Linus Torvalds
1c9982b496 drm-fixes for 7.0-rc4
rust:
 - Fix safety issue in dma_read! and dma_write!.
 
 nova-core:
 - Fix UB in DmaGspMem pointer accessors.
 - Fix stack overflow in GSP memory allocation.
 
 loongsoon:
 - mark drm driver as unmaintained
 
 msm:
 - Core:
   - Adjusted msm_iommu_pagetable_prealloc_allocate() allocation type
 - DPU:
   - Fixed blue screens on Hamoa laptops by reverting the LM reservation
   - Fixed the size of the LM block on several platforms
   - Dropped usage of %pK (again)
   - Fixed smatch warning on SSPP v13+ code
   - Fixed INTF_6 interrupts on Lemans
 - DSI:
   - Fixed DSI PHY revision on Kaanapali
   - Fixed pixel clock calculation for the bonded DSI mode panels with
     compression enabled
 - DT bindings:
   - Fixed DisplayPort description on Glymur
   - Fixed model name in SM8750 MDSS schema
 - GPU:
   - Added MODULE_DEVICE_TABLE to the GPU driver
   - Fix bogus protect error on X2-85
   - Fix dma_free_attrs() buffer size
   - Gen8 UBWC fix for Glymur
 
 i915:
 - Avoid hang when configuring VRR [icl]
 - Fix sg_table overflow with >4GB folios
 - Fix PSR Selective Update handling
 - Fix eDP ALPM read-out sequence
 
 amdgpu:
 - SMU13 fix
 - SMU14 fix
 - Fixes for bringup hw testing
 - Kerneldoc fix
 - GC12 idle power fix for compute workloads
 - DCCG fixes
 
 amdkfd:
 - Fix missing BO unreserve in an error path
 
 ivpu:
 - drop unnecessary bootparams register setting
 
 amdxdna:
 - fix runtime/suspend resume deadlock
 
 bridge:
 - ti-sn65dsi83: fix DSI rounding and dual LVDS
 
 gud:
 - fix NULL crtc dereference on display disable
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEEKbZHaGwW9KfbeusDHTzWXnEhr4FAmm0d64ACgkQDHTzWXnE
 hr5GGxAAi8YD0xwrA4Aks7HdEisEPQzNrtBTLzdz6zI05RBQrS7kOYMJ/X1ikLR1
 1HEVr4YqxK44t5mTmHKFnbxa+pk98JYOGFzNuAc3UWSMcaiDdFi5UHiR0sF3RGVm
 GxDg2JOGpyiGFTLo9gIPkU3cEp3SJT08frumSLpasnm6rjpGqDEDlyoK2UnX6i7t
 51VDY5X5IEnDUArH07dPU/Ee+zDDJ91yrQP/2ckNbJcOfJKG/T+9q95qr6Qgv8Kq
 VP767sg+N6XKYe3XQKohsIW9QbnahNmg+n5o9LNoIx2LCQnpIRHL8Um0pZEsFeaQ
 g/t61bXV39bstVrR9r4KFfvLrOUH2e8julSKXvhuIkFT3+efWPGA2kAJM8nZfkeL
 kl+/3gDvSW+301EqE+ack5YS2+EWgoyscFXXlc96/PiElX2scaVgOHoyYVMfiHqc
 JNq5+1hJZtQB0NR3Z1l4/tjIBWAsRJIYFf8o8AazdxLD/o9WBLPVScSqW6MuvKSg
 Ud17wGeWBC/RiiHG9qLBgWmdjrdSV1xEDzK1gTtEQI3EkQBgYURok5VoVXLuooGv
 QsbJAZb5KdOGeKQ1MJaSk98peVfNAVbkEonesdk+CqoRxjJtAhH4wGFNen7WVHSB
 eXa2kjzeh3ANWxlwIZiAV9P4IuL31X+nGmlDFwDhY4ft2bg9uVQ=
 =Aqmr
 -----END PGP SIGNATURE-----

Merge tag 'drm-fixes-2026-03-14' of https://gitlab.freedesktop.org/drm/kernel

Pull drm fixes from Dave Airlie:
 "The weekly drm fixes. This is mostly msm fixes across the functions,
  with amdgpu and i915. It also has a core rust fix and changes in
  nova-core to take advantage of it, and otherwise just has some minor
  driver fixes, and marks loongsoon as orphaned.

  rust:
   - Fix safety issue in dma_read! and dma_write!

  nova-core:
   - Fix UB in DmaGspMem pointer accessors
   - Fix stack overflow in GSP memory allocation

  loongsoon:
   - mark drm driver as unmaintained

  msm:
   - Core:
      - Adjusted msm_iommu_pagetable_prealloc_allocate() allocation type
   - DPU:
      - Fixed blue screens on Hamoa laptops by reverting the LM
        reservation
      - Fixed the size of the LM block on several platforms
      - Dropped usage of %pK (again)
      - Fixed smatch warning on SSPP v13+ code
      - Fixed INTF_6 interrupts on Lemans
   - DSI:
      - Fixed DSI PHY revision on Kaanapali
      - Fixed pixel clock calculation for the bonded DSI mode panels
        with compression enabled
   - DT bindings:
      - Fixed DisplayPort description on Glymur
      - Fixed model name in SM8750 MDSS schema
   - GPU:
      - Added MODULE_DEVICE_TABLE to the GPU driver
      - Fix bogus protect error on X2-85
      - Fix dma_free_attrs() buffer size
      - Gen8 UBWC fix for Glymur

  i915:
   - Avoid hang when configuring VRR [icl]
   - Fix sg_table overflow with >4GB folios
   - Fix PSR Selective Update handling
   - Fix eDP ALPM read-out sequence

  amdgpu:
   - SMU13 fix
   - SMU14 fix
   - Fixes for bringup hw testing
   - Kerneldoc fix
   - GC12 idle power fix for compute workloads
   - DCCG fixes

  amdkfd:
   - Fix missing BO unreserve in an error path

  ivpu:
   - drop unnecessary bootparams register setting

  amdxdna:
   - fix runtime/suspend resume deadlock

  bridge:
   - ti-sn65dsi83: fix DSI rounding and dual LVDS

  gud:
   - fix NULL crtc dereference on display disable"

* tag 'drm-fixes-2026-03-14' of https://gitlab.freedesktop.org/drm/kernel: (44 commits)
  drm/amd: Set num IP blocks to 0 if discovery fails
  drm/amdkfd: Unreserve bo if queue update failed
  drm/amd/display: Check for S0i3 to be done before DCCG init on DCN21
  drm/amd/display: Add missing DCCG register entries for DCN20-DCN316
  gpu: nova-core: gsp: fix UB in DmaGspMem pointer accessors
  drm/loongson: Mark driver as orphaned
  accel/amdxdna: Fix runtime suspend deadlock when there is pending job
  gpu: nova-core: fix stack overflow in GSP memory allocation
  accel/ivpu: Remove boot params address setting via MMIO register
  drm/i915/dp: Read ALPM caps after DPCD init
  drm/i915/psr: Write DSC parameters on Selective Update in ET mode
  drm/i915/dsc: Add helper for writing DSC Selective Update ET parameters
  drm/i915/dsc: Add Selective Update register definitions
  drm/i915/psr: Repeat Selective Update area alignment
  drm/i915: Fix potential overflow of shmem scatterlist length
  drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL
  drm/bridge: ti-sn65dsi83: halve horizontal syncs for dual LVDS output
  drm/bridge: ti-sn65dsi83: fix CHA_DSI_CLK_RANGE rounding
  drm/gud: fix NULL crtc dereference on display disable
  drm/sitronix/st7586: fix bad pixel data due to byte swap
  ...
2026-03-13 15:38:55 -07:00
Linus Torvalds
9abff5748e workqueue: Fixes for v7.0-rc3
- Improve workqueue stall diagnostics: dump all busy workers (not just
   running ones), show wall-clock duration of in-flight work items, and
   add a sample module for reproducing stalls.
 
 - Fix POOL_BH vs WQ_BH flag namespace mismatch in pr_cont_worker_id().
 
 - Rename pool->watchdog_ts to pool->last_progress_ts and related
   functions for clarity.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCabRyOg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGaAEAP9xJvKzVtyXBMWxIQNJKqN58VaT/5bNk3tYfm3O
 ZOuBrQD+Lsxjvv/pSSKFscZJ/x0dthdYncYI8DF3/G6Lnf+LDAc=
 =MT3y
 -----END PGP SIGNATURE-----

Merge tag 'wq-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq

Pull workqueue fixes from Tejun Heo:

 - Improve workqueue stall diagnostics: dump all busy workers (not just
   running ones), show wall-clock duration of in-flight work items, and
   add a sample module for reproducing stalls

 - Fix POOL_BH vs WQ_BH flag namespace mismatch in pr_cont_worker_id()

 - Rename pool->watchdog_ts to pool->last_progress_ts and related
   functions for clarity

* tag 'wq-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:
  workqueue: Rename show_cpu_pool{s,}_hog{s,}() to reflect broadened scope
  workqueue: Add stall detector sample module
  workqueue: Show all busy workers in stall diagnostics
  workqueue: Show in-flight work item duration in stall diagnostics
  workqueue: Rename pool->watchdog_ts to pool->last_progress_ts
  workqueue: Use POOL_BH instead of WQ_BH when checking pool flags
2026-03-13 15:11:05 -07:00
Linus Torvalds
b073bcb8d4 cgroup: Fixes for v7.0-rc3
- Hide PF_EXITING tasks from cgroup.procs to avoid exposing dead tasks
   that haven't been removed yet, fixing a systemd timeout issue on
   PREEMPT_RT.
 
 - Call rebuild_sched_domains() directly in CPU hotplug instead of
   deferring to a workqueue, fixing a race where online/offline CPUs
   could briefly appear in stale sched domains.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCabRyLQ4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGXk4APwKw2HtGyI3OQAHfDBL+wlblPtf8acz0zpDwGCT
 9+TWFQD/Rhmtvkb/X/LTwT5PKJksoHOfkD4MqmVMGStKGdxtBAY=
 =DJ17
 -----END PGP SIGNATURE-----

Merge tag 'cgroup-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup

Pull cgroup fixes from Tejun Heo:

 - Hide PF_EXITING tasks from cgroup.procs to avoid exposing dead tasks
   that haven't been removed yet, fixing a systemd timeout issue on
   PREEMPT_RT

 - Call rebuild_sched_domains() directly in CPU hotplug instead of
   deferring to a workqueue, fixing a race where online/offline CPUs
   could briefly appear in stale sched domains

* tag 'cgroup-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: Don't expose dead tasks in cgroup
  cgroup/cpuset: Call rebuild_sched_domains() directly in hotplug
2026-03-13 15:06:31 -07:00
Linus Torvalds
8369b2e97d sched_ext: Fixes for v7.0-rc3
- Fix data races flagged by KCSAN: add missing READ_ONCE()/WRITE_ONCE()
   annotations for lock-free accesses to module parameters and dsq->seq.
 
 - Fix silent truncation of upper 32 enqueue flags (SCX_ENQ_PREEMPT and
   above) when passed through the int sched_class interface.
 
 - Documentation updates: scheduling class precedence, task ownership
   state machine, example scheduler descriptions, config list cleanup.
 
 - Selftest fix for format specifier and buffer length in
   file_write_long().
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCabRyHg4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGZiWAQCmUOHiGAk73p9DDn6Zyrm+o/iQm/iOinchBeUs
 ZiG0bgEAn15giAnLCA5Zs6cG7PemxBH1v7ctyzTjh1VsBds0rwo=
 =zXix
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext fixes from Tejun Heo:

 - Fix data races flagged by KCSAN: add missing READ_ONCE()/WRITE_ONCE()
   annotations for lock-free accesses to module parameters and dsq->seq

 - Fix silent truncation of upper 32 enqueue flags (SCX_ENQ_PREEMPT and
   above) when passed through the int sched_class interface

 - Documentation updates: scheduling class precedence, task ownership
   state machine, example scheduler descriptions, config list cleanup

 - Selftest fix for format specifier and buffer length in
   file_write_long()

* tag 'sched_ext-for-7.0-rc3-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Use WRITE_ONCE() for the write side of scx_enable helper pointer
  sched_ext: Fix enqueue_task_scx() truncation of upper enqueue flags
  sched_ext: Documentation: Update sched-ext.rst
  sched_ext: Use READ_ONCE() for scx_slice_bypass_us in scx_bypass()
  sched_ext: Documentation: Mention scheduling class precedence
  sched_ext: Document task ownership state machine
  sched_ext: Use READ_ONCE() for lock-free reads of module param variables
  sched_ext/selftests: Fix format specifier and buffer length in file_write_long()
  sched_ext: Use WRITE_ONCE() for the write side of dsq->seq update
2026-03-13 14:54:56 -07:00