Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 updates from Catalin Marinas:
"Here are the arm64 updates for 7.4.

The more interesting bits ar

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 updates from Catalin Marinas:
"Here are the arm64 updates for 7.4.

The more interesting bits are the removal of big-endian kernel support
(already marked BROKEN for some time), preemptible this_cpu_*()
operations and MPAM support for the firmware-backed (Fb) interface.

CCA (Arm's confidential compute) is slowly trickling in with host RMI
(Realm Management Interface) support and some refactoring, including a
dedicated SMCCC bus to advertise firmware services. There are also the
usual PMU updates for new hardware and a few fixes/cleanups.

Core features:

- Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has
depended on BROKEN for a while, so drop the remaining code (BE
hypervisor object, BPF JIT, assembly/crypto/library routines,
endianness helper macros, selftests) and force a little-endian
build

- Add preemptible this_cpu_*() operations (read/write, RMW, xchg,
cmpxchg and cmpxchg128) that no longer need to disable preemption
around the per-CPU address generation and access

- Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on
arm64

Memory management:

- Treat faults taken by EFI runtime firmware as kernel faults

- Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty
state management enabled, this is not truly read-only)

- Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
configurations (28/26/24 bits for 4K/16K/64K pages)

- Implement clear_page[s]() using memset()

- Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU

Perf and PMU:

- Support for HiSilicon's ITS PMU

- Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs
and a cycle counter for the latest version of HiSilicon's MN PMU
hardware

- A bunch of fixes to the CXL PMU driver to address pre-existing
issues from Sashiko

- Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM
drivers

- Reduce excessive stack consumption in the Marvell DDR PMU driver

- Minor driver updates and cleanups all over

Arm Confidential Compute Architecture (CCA):

- Add an Arm SMCCC bus for firmware services discovered through SMCCC
and move the TRNG and CCA guest (TSM provider) drivers onto it,
removing the dummy CCA platform device and adding a sysfs ABI for
Realm guests

- Move the Realm Service Interface (RSI) code out of arch/arm64/ into
drivers/firmware/arm_rmm/

- Add the host side of the Realm Management Interface (RMI): detect,
configure and activate the RMM, add SRO support and wrappers for
the Realm RMI commands

- Block hibernation (new arch hook in the PM core) and kexec while
the RMM is active. To be revisited in the future with proper
support for deactivation

- Handle Granule Protection Faults (GPFs) taken by the host, caused
by accesses to memory delegated to the RMM. In a future patch, the
exception table lookup will be limited to is_kdump_kernel() cases

MPAM (Memory Partitioning And Monitoring):

- Add support for the MPAM firmware-backed (Fb) interface, allowing
MSC accesses to be mediated by firmware

- Fix a list of theoretical issues with the driver (MSC access error
propagation, MBWU monitor save/restore and locking, resctrl class
handling, error interrupt restore, maximum number of PARTIDs)

- Add the mailing list and a missing file to the MAINTAINERS entry

- Document when to set arm64.nompam

Errata and CPU features:

- Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache
coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM
capability type for SoC-level errata

Miscellaneous:

- Mask debug exceptions (DAIF) around the hardware breakpoint
register manipulations when called from generic kernel code

- Don't zero the SVE state buffer when the SVE state is live

- Return -EPERM instead of -EBUSY from the GCS prctl() locking
failures (matching x86), with the selftest updated. Slight ABI
change but no software deployment yet

- kselftest: fix unsound MTE fault skipping by introducing MTE-safe
memory accessors, avoid copying each signal test binary more than
once

- Update sysreg definitions (fix three enum values and two field
names, mark architecturally dropped fields as RES0) and remove the
TME transaction state check from the BRBE driver

- Fix the description of ARM64_HAS_LPA2 and remove a redundant
ID_AA64MMFR0 define"

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits)
arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
arm64: cputype: Add NVIDIA Rigel definitions
arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
arm64/debug: mask debug exceptions when called from common code
kselftest/arm64: signal: copy each test binary only once
kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
perf: arm_brbe: Remove the check for TME transaction states
arm64: sysreg: Mark fields the architecture dropped as RES0
arm64: sysreg: Fix the names of two misspelt fields
arm64: sysreg: Fix three incorrect enum values
arm64: smp: Defer RCU registration during secondary CPU bringup
arm64: smp: Don't bother printing the I-cache policy for each CPU
arm64: smp: Defer update of secondary CPU capabilities
arm64: smp: Tidy up cpuinfo init and cpufeature updates
arm64: smp: Tidy up smp_prepare_cpus()
arm64: cpufeature: Store every ID register with its overrides applied
arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
arm64: cpufeature: Add read_cpuid_with_overrides()
arm64: cpufeature: Check arm64_ftr_regs[] before the first store
...

show more ...

Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', 'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/seco

Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', 'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core

* arm64/for-next/perf: (22 commits)
drivers/perf: apple_m1: Add macOS 27 M2 Event
perf/marvell: cn10k_tad: Publish the OF module alias
perf: xgene: initialize lock before requesting IRQ
perf: marvell: avoid large stack variables
perf/dwc_pcie: Fix PCI device reference leak in probe
coresight: perf: Suppress ITRACE start records
perf: arm_spe: Suppress redundant ITRACE start records
perf/core: Export perf_event_itrace_started()
perf/cxl: Clear stale overflow status before using a counter
perf/cxl: Don't log through pmu.dev in the overflow interrupt handler
perf/cxl: Validate the hardware-reported counter width
perf/cxl: Unfreeze counters after handling an overflow interrupt
perf/cxl: Don't share the overflow interrupt, and keep it pinned
cxl/pci: Add the PMUs after configuring events
perf/cxl: Split the MSI vector out of info->irq
perf/cxl: Accept an overflow interrupt on MSI message number 0
perf/cxl: Fix the counter overflow delta fixup
perf/cxl: Clear stale event fields before reprogramming a counter
perf/cxl: Program the requested event group on configurable counters
drivers/perf: hisi: Add cycle event for new MN PMU
...

* for-next/misc:
arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
arm64: cputype: Add NVIDIA Rigel definitions
arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
arm64/debug: mask debug exceptions when called from common code
arm64: clear_page[s] using memset
arm64/sve: Don't zero the SVE state buffer when the SVE state is live
arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2)
arm64: Use proper include variant
arm64: include: fix repeated word 'to' in comment
selftests: arm64: fix typo "hander" in comment
arm64: fix typos in comments
docs: arm64: Fix typo "initalised" in booting.rst
arm64: alternative: Remove 'cfg' parameter
arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter
arm64/cpufeature: Change description for ARM64_HAS_LPA2

* for-next/be-gone:
drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN
arm64: Kbuild: Remove vestigial big-endian support
gve: Add explicit ARM64 dependency to Kconfig
crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN
arm64: Remove all usage of __AARCH64EB__
arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN
KVM: arm64: Remove support for a big-endian hypervisor object
arm64: vdso32: Always build compat vDSO object as little-endian
arm64: assembler: Remove endianness helper macros
arm64: lib: Assume a little-endian kernel in optimised string routines
arm64: lib: Assume a little-endian kernel in custom library routines
arm64: crypto: Assume a little-endian kernel
arm64: bpf: Remove big-endian support from the JIT compiler
selftests/arm64: Remove big-endian support

* for-next/smccc-bus:
: Switch Arm SMCCC firmware services to an SMCCC bus
arm64: rsi: Correct type of realm_config::hash_algo
firmware: smccc: Pass only the required device probe arguments
firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries
coco: guest: arm64: Remove dummy CCA platform device
coco: guest: arm64: Add sysfs ABI for CCA Realm guests
firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device
virt: coco: arm-cca-guest: Rename TSM report source file
arm64: realm: Move Realm memory encryption ops to RSI code
firmware: arm_rmm: Move RSI support out of arch/arm64
firmware: hwrng: arm_smccc_trng: Register as an SMCCC device
firmware: smccc: Add an Arm SMCCC bus

* for-next/preemptible-this-cpu:
: Preemptible this_cpu_*() operations
arm64: percpu: Remove _pcp_protect*() wrappers
arm64: percpu: Implement preemptible CMPXCHG128 ops
arm64: percpu: Implement preemptible CMPXCHG ops
arm64: percpu: Implement preemptible XCHG ops
arm64: percpu: Implement preemptible return RMW ops
arm64: percpu: Implement preemptible void RMW ops
arm64: percpu: Implement preemptible read/write ops
arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops
arm64: entry: sdei: Make 'tsk' available
arm64: entry: sdei: Restore all clobberable GPRs
arm64: gpr-num: add __GPR_NUM() helper
arm64: gpr-num: Add wxN aliases for wN registers
arm64: percpu: Factor out percpu offset asm
arm64: ptrace: Always inline pt_regs_{read,write}_reg()
arm64: preempt: Treat should_resched() as unlikely
arm64: preempt: Simplify and optimize __preempt_count_dec_and_test()
arm64: cmpxchg128: LSE: Remove redundant operands
arm64: cmpxchg: LL/SC: Avoid redundant extension

* for-next/cpu-errata:
: Various CPU errata workarounds
arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue
arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata

* for-next/mpam: (30 commits)
: MPAM updates
arm_mpam: make the mon_sel guard conditional only
arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL
arm_mpam: detect and enable MPAM-Fb PCC support
arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler
arm_mpam: add MPAM-Fb MSC firmware access support
arm_mpam: prepare mon_sel locking for MPAM-Fb
arm_mpam: propagate MSC access errors in mpam_reset_class_locked()
arm_mpam: propagate MSC access errors for interrupt control
arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid()
arm_mpam: propagate MSC access errors for state saving function
arm_mpam: propagate MSC access errors for __ris_msmon_read()
arm_mpam: propagate MSC access errors for msmon helpers
arm_mpam: propagate MSC access errors for MBWU counters
arm_mpam: propagate MSC access errors for hw_probe functions
arm_mpam: let low level MSC accessors return an error
MAINTAINERS: Use linux-arm-kernel list for the MPAM driver
MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry
arm_mpam: resctrl: Don't stop early when tearing down a class
arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg
arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs
...

* for-next/kselftest:
: arm64 kselftest updates
kselftest/arm64: signal: copy each test binary only once
kselftest/arm64/mte: Use MTE safe memory accessors
kselftest/arm64/mte: Introduce MTE safe memory accessors
kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked

* for-next/efi:
: arm64 EFI updates/fixes
arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults
arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO

* for-next/secondary-boot-prep:
: cpuinfo cleanup in preparation for parallel secondary bring-up
arm64: smp: Defer RCU registration during secondary CPU bringup
arm64: smp: Don't bother printing the I-cache policy for each CPU
arm64: smp: Defer update of secondary CPU capabilities
arm64: smp: Tidy up cpuinfo init and cpufeature updates
arm64: smp: Tidy up smp_prepare_cpus()
arm64: cpufeature: Store every ID register with its overrides applied
arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
arm64: cpufeature: Add read_cpuid_with_overrides()
arm64: cpufeature: Check arm64_ftr_regs[] before the first store

* for-next/sysreg:
: sysreg updates
perf: arm_brbe: Remove the check for TME transaction states
arm64: sysreg: Mark fields the architecture dropped as RES0
arm64: sysreg: Fix the names of two misspelt fields
arm64: sysreg: Fix three incorrect enum values

* for-next/gcs:
: GCS updates/fixes
kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures

show more ...

regmap: Fix cache lifecycle locking and teardown

Michael Reeves <michael.reeves077@gmail.com> says:

Fix an "Invalid wait context" lockdep warning during Apple GPIO probe and
correct debugfs orderin

regmap: Fix cache lifecycle locking and teardown

Michael Reeves <michael.reeves077@gmail.com> says:

Fix an "Invalid wait context" lockdep warning during Apple GPIO probe and
correct debugfs ordering during cache teardown.

Tested on Apple M3 MacBook Air (T8122):

- All 4 GPIO controllers probe successfully with lockdep enabled.
- The "Invalid wait context" warning no longer occurs.
- The regmap KUnit suite passes and lockdep remains enabled.

Link: https://patch.msgid.link/20261006-regcache-lifecycle-submit-v3-0-37bdd82fd47c@gmail.com

show more ...

arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue

According to NXP errata document IMX8_1N94W[1], the i.MX8QuadMax and
i.MX8QuadPlus SoCs suffer from a cache coherency issu

arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue

According to NXP errata document IMX8_1N94W[1], the i.MX8QuadMax and
i.MX8QuadPlus SoCs suffer from a cache coherency issue (ERR050104). The
upper bits, above bit 35, of the ARADDR and ACADDR buses within the Arm
A53 subsystem have been incorrectly connected. This causes some TLBI and
IC maintenance operations exchanged between the A53 and A72 core
clusters to be corrupted.

The workaround requires:

- Downgrading targeted TLBI operations to broadcast-all variants.
Instead of patching the low-level __TLBI_1 macro (which causes
excessive over-invalidation), redirect high-level TLB flush
functions (flush_tlb_mm, __do_flush_tlb_range,
flush_tlb_kernel_range, __flush_tlb_kernel_pgtable) to use VMALLE1IS
via alternatives.

- Upgrading IC IVAU to IC IALLUIS for both kernel (via ALTERNATIVE in
invalidate_icache_by_line) and EL0 userspace (via trap-and-upgrade
in user_cache_maint_handler with SCTLR_EL1.UCI=0).

- Disabling KVM since correct TLB maintenance cannot be guaranteed
for guests.

- No need to touch SMMU Broadcast TLB Maintenance (BTM) since the
arm-smmu driver does not use it.

SoC detection uses devicetree compatible string "fsl,imx8qm" or
"fsl,imx8qp" since the boot CPU MIDR_EL1 (0x410fd034) and AIDR_EL1 (0)
are not unique to these SoCs.

[1] https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf

[ Reworked per review feedback from Will Deacon and Mark Rutland:
- Move TLBI workaround from __TLBI_1 macro to high-level flush
functions to avoid excessive over-invalidation
- Add kernel IC IVAU upgrade via ALTERNATIVE in assembler.h
- Add cpucap_is_possible() entry for compile-time elimination]

Tested-by: Franz Schnyder <franz.schnyder@toradex.com> # Toradex Apalis iMX8QM
Co-developed-by: Ivan T. Ivanov <iivanov@suse.de>
Signed-off-by: Ivan T. Ivanov <iivanov@suse.de>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
[catalin.marinas@arm.com: Kconfig and errata text, sysreg_clear_set(), of_machine_compatible_match()]
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

show more ...

Merge tag 'asoc-fix-v7.3-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.3

A fairly small collection of fixes and a few device quirks, nothin

Merge tag 'asoc-fix-v7.3-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v7.3

A fairly small collection of fixes and a few device quirks, nothing
especially remarkable unless you have the affected system.

show more ...

ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback

Richard Fitzgerald <rf@opensource.cirrus.com> says:

The amp feedback path (AEC) was incorrectly using SoundWire DP3.
The firmware o

ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback

Richard Fitzgerald <rf@opensource.cirrus.com> says:

The amp feedback path (AEC) was incorrectly using SoundWire DP3.
The firmware outputs SDCA OT25 feedback on DP4. DP3 is reserved for
SDCA companion amp.

This series adds a DAI for OT25 and switches the sdw machine driver
to use the new DAI for the feedback path.

Link: https://patch.msgid.link/20261005155235.1386525-1-rf@opensource.cirrus.com

show more ...

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
"Half of this is broken hardware (AMU counters and TLB invalidation)
and th

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Pull arm64 fixes from Will Deacon:
"Half of this is broken hardware (AMU counters and TLB invalidation)
and the other half is broken software (frequency scaling and signals).
So it seems as though we're all as bad as each other.

The AMU workaround is a little noisy, as it refactors an existing
workaround so that it can more easily be applied to additional CPUs.

Summary:

- Fix handling of CPU erratum #2645198 when batching pte updates

- Fix truncation of CPU frequency calculation by using 64-bit
arithmetic in arch_freq_get_on_cpu()

- Work around AMU erratum #3821522 on Cortex-A725

- Fix panic when trying to restore an SVE sigframe on a CPU that only
supports SME"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems
arm64: errata: Add Cortex-A725 erratum 3821522 workaround
arm64: errata: Factor out broken AMU const counter cap
arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz
arm64: mm: Fix the break-before-make flush range for erratum 2645198

show more ...

arm64: errata: Factor out broken AMU const counter cap

Move the workaround from the erratum 2457168-specific cpucap to a generic
broken AMU constant-counter one. This keeps the existing Cortex-A510

arm64: errata: Factor out broken AMU const counter cap

Move the workaround from the erratum 2457168-specific cpucap to a generic
broken AMU constant-counter one. This keeps the existing Cortex-A510
handling unchanged while allowing other errata with similar AMU constant
counter issue to share the capability bit and call sites.

Signed-off-by: Beata Michalska <beata.michalska@arm.com>
Reviewed-by: Vladimir Murzin <vladimir.murzin@arm.com>
Signed-off-by: Will Deacon <will@kernel.org>

show more ...

Merge drm/drm-fixes into drm-misc-fixes

Let's start the 7.3 drm-misc-fixes cycle.

Signed-off-by: Maxime Ripard <mripard@kernel.org>

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Backmerge of drm-next, mainly to pick up dt bindings docs updates to
avoid conflicts.

Signed-off-by: Rob Clark <robin.clark@oss.q

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Backmerge of drm-next, mainly to pick up dt bindings docs updates to
avoid conflicts.

Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>

show more ...

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
"ARM64:

- Add support for 'slot' based PMU events, paired with new UAPI that
compels

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
"ARM64:

- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation

- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor

- Disable traps of EL1 registers for nested hypervisors when
FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
are stateful in the EL1 counterpart

- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
scope of those instructions remains 'in host' (i.e. L1
kernel/userspace)

- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs

- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges

- Considerable pile of LLM-assisted fixes around the shop but mostly
in the VGIC, our in-kernel generator of bugs (and sometimes
interrupts)

LoongArch:

- Advertise already-supported capabilities

- Some bug fixes about timer and MMIO

- Some hardening about interrupt injection

- Replace kvm_err() with kvm_pr_unimpl()

- Add FPU/LSX/LASX test cases for selftests

RISC-V:

- Svadu/Zicfiss/Zicfilp FWFT support for Guest

- Use try_cmpxchg for IMSIC MRIF RMW

- More arch-specific tracepoints in KVM RISC-V

- Eager page splitting when enabling dirty logging

- Optimize hfence request handling for SMP Guests

- Improve dirty log clearing by skipping zero bits in mask

- Guard HFENCE range loops against overflow

- CPU PM notifiers in KVM RISC-V for non-retentive idle states

- Fix kernel-mode vector context save/restore for Guest

s390:

- Fixes for vfio-ap

- Fixes for the gmap rework

- Fixes for vsie

- AI triggered fixes all over

- diag9c tracing

- code move preparation for the additional arm64 support

- enable CONTEXT_ANALYSIS

x86:

- Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
regs.c (the kvm_cache_regs.h => regs.h is already applied) and
msrs.{c,h}, and moving relevant code out of x86.c

- Split kvm_mmu in three parts, respectively to describe the format
of page tables, walking the guest page tables and building the page
tables. Always use the same page table walker kvm->arch.gva_walk as
the entry point to convert a guest's virtual address, where the
previous code used two different kvm_mmu structs depending on
whether the walk included nested EPT/NPT or not. Make page fault
vmexits reuse the permission checking machinery that is used for
guest page faults. This is both a cleanup and a baby step towards
supporting XS/XU memory permissions

- Document some of the "fun" gotchas with the APIC base when creating
IRQCHIPs on x86

- Remove a defunct masterclock update from kvm_xen_shared_info_init().
It could result in incorrect kvmclock due to triggering an
unnecessary switch to/from masterclock mode

- Skip Xen runstate time updates if time has effectively gone
backwards, so that the guest doesn't report 100% steal time for
a very, very long time

- Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
was updating the wrong sub-leaf, and upstream KVM will soon provide
all the information needed by userspace to populate the CPUID field
itself

- Fix a bug where KVM would walk a newly created rmap without holding
the rmap lock (or mmu_lock) during aging

- Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs

- Fix a variety of #DB priority bugs

- Fix a class of races related to enabling Hyper-V emulation on a
vCPU after the vCPU is visible to the rest of KVM

- Use static calls for nested virtualization ops

- Move more KVM-internal code out of x86's kvm_host.h

- Enumerate support for a variety of Zhaoxin instructions that don't
require explicit virtualization

- Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
path

- Harden kvm_vcpu_map() against double-mapping and thus leaking
references

- Misc fixes and cleanups, e.g. for largely benign syzkaller splats

x86 (Intel):

- Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
for IPI virtualization when the vCPU is freed, to fix a
use-after-free where hardware will write to a freed vCPU's PID

- Service local TLB flushes on a failed nested VM-Enter to fix a bug
where KVM could miss a TLB on a future, successful VM-Enter with
the same L2 VPID

- Cap the maximum value shoved into the VMX Preemption Timer to
workaround an erratum that affects all existing Intel CPUs that
support CPUID 0x15

- Fix VPID virtualization bugs where KVM would fail to flush hardware
TLBs

- Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion

x86 (AMD):

- Forcefully invalidate SNP VMSA pages if their backing guest_memfd
page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
a Page-State Change request

- Remove a dying VM from the GA Log notifier list before the VM is
actually destroyed, to fix a potential use-after-free

- While FOLL_WRITE was needed in the past to trigger CoW unsharing,
nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
and in fact, get_user_pages() actually disallows FOLL_WRITE
together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins

(This was reviewed by mm maintainers; for more information, see
commit ee1a586dd1fa "KVM: SEV: Drop FOLL_WRITE for encrypted region
registration")

- Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
hosts to fix a data corruption issue due to the PSP driver
assigning to-be-written pages to firmware (as required by the SNP
specs)

- Unconditionally intercept ICBEP so that KVM generates the correct
guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT

- Harden the SNP "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion

Generic:

- Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
debugfs

- Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
for which the vCPU isn't yet online, and use the bitmap to reject
duplicate IDs before calling into arch code. This allows arch code
to consume vcpu_id without having to worry about cross-vCPU
clobbering (at least s390 and x86 have had related bugs)

- Rework the so called "prepare" and "invalidate" guest_memfd hooks
to prepare for in-place private<=>shared conversion, and clean up a
few warts along the way

Selftests:

- Automatically allocate a full page for L2 guest stacks on x86
instead of requiring test-specific L1 guest code to carve out a
portion of the L1 stack for L2 usage, and to ensure the L2 stack
also adheres to the x86-64 calling convention ABI

- Add a selftest to verify {Guest,Host}-Only behavior in x86's
mediated PMU

- Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
reuse the functionality for nested VMX, and drop the ucall hack
that was fudging around the lack of GPR switching on nVMX

- Add a stress test to verify KVM doesn't clobber/drop #PF state,
e.g. CR2, across save/restore, including when L2 is active

- Add a test to verify KVM_CREATE_VM accepts exactly what is reported
by KVM_CAP_VM_TYPES

- Misc selftests fixes and cleanups

- Fix several issues with seeding the pRNG, and rework the pRNG APIs
to that the pRNG can be sanely used in host code, not just guest
code

- Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
triggering IRQs via writes to an assigned VFIO device

- Add syscall wrappers to assert success on a variety of pthreads and
CPU affinity APIs

- Set vCPU pthread affinity as early as possible to reduce contention
issues that were surfaced by PREEMPT_LAZY, which result in runtimes
of over a minute on large hosts, versus the expected ~5 seconds

- Rework the PMU counters test to run each testcase using a single VM
with many vCPUs for each sub-testcase, instead of using a unique VM
for each sub-testcase. This cuts the runtime by ~20x

Miscellaneous:

- MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
representing the status quo more accurately, but also... welcome
David Hildenbrand as guest_memfd reviewer!"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
KVM: arm64: vgic: Prevent speculative SPI array underflow
KVM: arm64: vgic: Free gic_kvm_info on initialization failure
KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
s390/vfio-ap: Fix NULL deref in status_show() during queue probe
s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
riscv: vector: refactor riscv_v_start_kernel_context
KVM: s390: gmap: Make prefix handling optional
KVM: s390: gmap: Make CMMA optional
KVM: s390: gmap: Make storage keys optional
KVM: s390: Prepare gmap for a second KVM implementation
...

show more ...

Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 changes for 7.3

- Add support for 'slot' based PMU events, paired with new UAPI that

Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

KVM/arm64 changes for 7.3

- Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation

- Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor

- Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart

- Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)

- Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs

- Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges

- Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)

show more ...

Merge branch 'kvm-arm64/vtr-patch' into next

* kvm-arm64/vtr-patch:
: Inline patching of ICH_VTR_EL2 constant, courtesy of Marc Zyngier
:
: Unify readers of ICH_VTR_EL2 on an instruction-patch

Merge branch 'kvm-arm64/vtr-patch' into next

* kvm-arm64/vtr-patch:
: Inline patching of ICH_VTR_EL2 constant, courtesy of Marc Zyngier
:
: Unify readers of ICH_VTR_EL2 on an instruction-patched constant value,
: avoiding system register accesses known to trap under nested
: virtualization and sharing the implementation between pKVM and 'regular'
: KVM.
KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2
KVM: arm64: vgic-v3: Simplify initial GICv3 configuration sampling
KVM: arm64: Convert most ICH_VTR_EL2 accesses to inlined literal value
KVM: arm64: Add a helper providing an inlined literal value for ICH_VTR_EL2
KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata
KVM: arm64: vgic-v3: Make vtr_to_* helpers use architectural field symbols

Signed-off-by: Oliver Upton <oupton@kernel.org>

show more ...

Merge branch 'kvm-arm64/feat-nv3' into next

* kvm-arm64/feat-nv3: (29 commits)
: Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier
:
: Couple of accelerations for nested virtualiza

Merge branch 'kvm-arm64/feat-nv3' into next

* kvm-arm64/feat-nv3: (29 commits)
: Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier
:
: Couple of accelerations for nested virtualization:
:
: - Elide traps for EL1 alias registers when hardware guarantees that
: EL2-only bits are stateful (NV2p1)
:
: - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that
: remain 'in-context' (i.e. L1 kernel/userspace)
arm64: Add override for ID_AA64MMFR4_EL1.NV_frac
KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list
KVM: arm64: Expose FEAT_NV3 to guests
KVM: arm64: Add FEAT_NV3 detection
KVM: arm64: Engage NV3 TLBI trap elision
KVM: arm64: Engage NV3 ERET trap elision
KVM: arm64: Add NVHCR_EL2 context switching
KVM: arm64: Add routing for NVHCR_EL2 trap
KVM: arm64: Add NVHCR_EL2 handling to the sysreg array
KVM: arm64: Add sanitisation for NVHCR_EL2
KVM: arm64: Make HCR_EL2 a non-VNCR register
KVM: arm64: Add kvm_has_nv{2,3}() predicates
KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation
KVM: arm64: Split NV-specific exit fixups from the non-NV handling
arm64: Add ARM64_HAS_NV3 capability
arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3
arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2
arm64: Add FEAT_NV2p1 detection
KVM: arm64: Expose FEAT_NV2p1 to NV guests
KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present
...

Signed-off-by: Oliver Upton <oupton@kernel.org>

show more ...

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

KVM/riscv changes for 7.3

- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

KVM/riscv changes for 7.3

- Svadu/Zicfiss/Zicfilp FWFT support for Guest
- Use try_cmpxchg for IMSIC MRIF RMW
- More arch-specific tracepoints in KVM RISC-V
- Eager Page Splitting for KVM RISC-V
- Optimize hfence request handling for SMP Guests
- Improve dirty log clearing by skipping zero bits in mask
- Guard HFENCE range loops against overflow
- CPU PM notifiers in KVM RISC-V for non-retentive idle states
- Fix kernel-mode vector context save/restore for Guest

show more ...

arm64: Add ARM64_HAS_NV3 capability

As a bunch of KVM code is going to depend on FEAT_NV3 being detected
on the host, add a new capability that will describe it.

Signed-off-by: Marc Zyngier <maz@ke

arm64: Add ARM64_HAS_NV3 capability

As a bunch of KVM code is going to depend on FEAT_NV3 being detected
on the host, add a new capability that will describe it.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260730071022.296811-16-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>

show more ...

arm64: Add ARM64_HAS_NV2P1 capability

As we're about to deal with FEAT_NV2P1, add a new capability that
will be used to key any support for it.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: ht

arm64: Add ARM64_HAS_NV2P1 capability

As we're about to deal with FEAT_NV2P1, add a new capability that
will be used to key any support for it.

Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260730071022.296811-9-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>

show more ...

KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata

Using is_midr_in_range_list() in a noinstr function isn't a good idea.
And yet kvm_compute_ich_hcr_trap_bits() is doing t

KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata

Using is_midr_in_range_list() in a noinstr function isn't a good idea.
And yet kvm_compute_ich_hcr_trap_bits() is doing that by calling
vgic_v3_broken_seis().

Move all the broken SEIS detection logic to the errata detection
framework, and use a new ARM64_WORKAROUND_GICv3_BROKEN_SEIS cap
to indicate that we're running on broken CPUs.

This reuses the MIDR list used for IMPDEF PMU detection, which
has a 100% overlap with the SEIS stuff...

Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://patch.msgid.link/20260721170754.3150521-3-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>

show more ...

Merge drm/drm-next into drm-xe-next

Sync some i915/display changes

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-next into drm-intel-next

Sync with v7.2-rc1.

Signed-off-by: Jani Nikula <jani.nikula@intel.com>

Merge drm/drm-next into drm-misc-next

Backmerging to get drm-misc-next to v7.2-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge tag 'v7.2-rc1' into drm-rust-next

Merge v7.2-rc1 into drm-rust-next to start the next cycle.

Devres now requires T: 'static, which conflicts with shmem::Object using
Devres<SGTableMap<T, C>>

Merge tag 'v7.2-rc1' into drm-rust-next

Merge v7.2-rc1 into drm-rust-next to start the next cycle.

Devres now requires T: 'static, which conflicts with shmem::Object using
Devres<SGTableMap<T, C>> without that bound. Resolve by adding 'static
as a supertrait to DriverObject and DeviceContext, which does not
restrict any current use cases since DriverObject is always implemented
on owned, refcounted types and DeviceContext is a sealed marker trait
with only unit-type implementors.

If DriverObject (or DeviceContext) ever becomes lifetime-parameterized
(e.g. via a GAT for TTM backed objects), the 'static supertrait can be
relaxed at that point.

Signed-off-by: Danilo Krummrich <dakr@kernel.org>

show more ...

Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource

- Use designated initializers for sh_mtu2, sh_cmt, and sh_tmu, and
dro

Merge tag 'timers-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/daniel.lezcano/linux into timers/clocksource

- Use designated initializers for sh_mtu2, sh_cmt, and sh_tmu, and
drop the unused initializer in the platform_device_id table for
sh_mtu2 (Uwe Kleine-König)

- Remove redundant dev_err()/dev_err_probe() messages when
devm_request_*_irq() fails, as the helper already logs an error
message (Pan Chuang)

- Fix a boot hang on Allwinner D1 when a forced minimum delta is used
with the sun4i timer (Felix Yan)

- Fix an IRQ leak in the cpuhp_setup_state() error path by freeing the
IRQ on failure in the NXP PIT driver (WenTao Liang)

- Fix incorrect unmapping of shared MMIO between the clocksource and
clockevent drivers. If one of them fails to initialize, the error
path unmaps the shared MMIO region, leaving the other driver with an
invalid mapping on clps711x (Guangshuo Li)

- Make the samsung_pwm driver compatible with PREEMPT_RT by replacing
regular spinlocks with raw_spinlock_t in atomic contexts (Marek
Szyprowski)

- Use __raw_readl() and __raw_writel() instead of ioread32() and
iowrite32() to support SWAP_IO_SPACE in the rtl-otto driver (Rustam
Adilov)

- Fix a missing clk_disable_unprepare() call in the timer
initialization error path of the Armada driver (Yuho Choi)

Link: https://lore.kernel.org/lkml/75feea31-683d-45a1-87f4-ab045e0152ae@oss.qualcomm.com

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 7.3 merge window.

Merge tag 'v7.2-rc3' into next

Sync up with mainline to pull in stable fixes to avoid merge conflicts.