Merge drm/drm-fixes into drm-misc-fixes

Getting fixes and updates from v7.1-rc1.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
"Arm:

- Add support for tracing in the standalone EL2 hypervisor code,
which should

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
"Arm:

- Add support for tracing in the standalone EL2 hypervisor code,
which should help both debugging and performance analysis. This
uses the new infrastructure for 'remote' trace buffers that can be
exposed by non-kernel entities such as firmware, and which came
through the tracing tree

- Add support for GICv5 Per Processor Interrupts (PPIs), as the
starting point for supporting the new GIC architecture in KVM

- Finally add support for pKVM protected guests, where pages are
unmapped from the host as they are faulted into the guest and can
be shared back from the guest using pKVM hypercalls. Protected
guests are created using a new machine type identifier. As the
elusive guestmem has not yet delivered on its promises, anonymous
memory is also supported

This is only a first step towards full isolation from the host; for
example, the CPU register state and DMA accesses are not yet
isolated. Because this does not really yet bring fully what it
promises, it is hidden behind CONFIG_ARM_PKVM_GUEST +
'kvm-arm.mode=protected', and also triggers TAINT_USER when a VM is
created. Caveat emptor

- Rework the dreaded user_mem_abort() function to make it more
maintainable, reducing the amount of state being exposed to the
various helpers and rendering a substantial amount of state
immutable

- Expand the Stage-2 page table dumper to support NV shadow page
tables on a per-VM basis

- Tidy up the pKVM PSCI proxy code to be slightly less hard to
follow

- Fix both SPE and TRBE in non-VHE configurations so that they do not
generate spurious, out of context table walks that ultimately lead
to very bad HW lockups

- A small set of patches fixing the Stage-2 MMU freeing in error
cases

- Tighten-up accepted SMC immediate value to be only #0 for host
SMCCC calls

- The usual cleanups and other selftest churn

LoongArch:

- Use CSR_CRMD_PLV for kvm_arch_vcpu_in_kernel()

- Add DMSINTC irqchip in kernel support

RISC-V:

- Fix steal time shared memory alignment checks

- Fix vector context allocation leak

- Fix array out-of-bounds in pmu_ctr_read() and pmu_fw_ctr_read_hi()

- Fix double-free of sdata in kvm_pmu_clear_snapshot_area()

- Fix integer overflow in kvm_pmu_validate_counter_mask()

- Fix shift-out-of-bounds in make_xfence_request()

- Fix lost write protection on huge pages during dirty logging

- Split huge pages during fault handling for dirty logging

- Skip CSR restore if VCPU is reloaded on the same core

- Implement kvm_arch_has_default_irqchip() for KVM selftests

- Factored-out ISA checks into separate sources

- Added hideleg to struct kvm_vcpu_config

- Factored-out VCPU config into separate sources

- Support configuration of per-VM HGATP mode from KVM user space

s390:

- Support for ESA (31-bit) guests inside nested hypervisors

- Remove restriction on memslot alignment, which is not needed
anymore with the new gmap code

- Fix LPSW/E to update the bear (which of course is the breaking
event address register)

x86:

- Shut up various UBSAN warnings on reading module parameter before
they were initialized

- Don't zero-allocate page tables that are used for splitting
hugepages in the TDP MMU, as KVM is guaranteed to set all SPTEs in
the page table and thus write all bytes

- As an optimization, bail early when trying to unsync 4KiB mappings
if the target gfn can just be mapped with a 2MiB hugepage

x86 generic:

- Copy single-chunk MMIO write values into struct kvm_vcpu (more
precisely struct kvm_mmio_fragment) to fix use-after-free stack
bugs where KVM would dereference stack pointer after an exit to
userspace

- Clean up and comment the emulated MMIO code to try to make it
easier to maintain (not necessarily "easy", but "easier")

- Move VMXON+VMXOFF and EFER.SVME toggling out of KVM (not *all* of
VMX and SVM enabling) as it is needed for trusted I/O

- Advertise support for AVX512 Bit Matrix Multiply (BMM) instructions

- Immediately fail the build if a required #define is missing in one
of KVM's headers that is included multiple times

- Reject SET_GUEST_DEBUG with -EBUSY if there's an already injected
exception, mostly to prevent syzkaller from abusing the uAPI to
trigger WARNs, but also because it can help prevent userspace from
unintentionally crashing the VM

- Exempt SMM from CPUID faulting on Intel, as per the spec

- Misc hardening and cleanup changes

x86 (AMD):

- Fix and optimize IRQ window inhibit handling for AVIC; make it
per-vCPU so that KVM doesn't prematurely re-enable AVIC if multiple
vCPUs have to-be-injected IRQs

- Clean up and optimize the OSVW handling, avoiding a bug in which
KVM would overwrite state when enabling virtualization on multiple
CPUs in parallel. This should not be a problem because OSVW should
usually be the same for all CPUs

- Drop a WARN in KVM_MEMORY_ENCRYPT_REG_REGION where KVM complains
about a "too large" size based purely on user input

- Clean up and harden the pinning code for KVM_MEMORY_ENCRYPT_REG_REGION

- Disallow synchronizing a VMSA of an already-launched/encrypted
vCPU, as doing so for an SNP guest will crash the host due to an
RMP violation page fault

- Overhaul KVM's APIs for detecting SEV+ guests so that VM-scoped
queries are required to hold kvm->lock, and enforce it by lockdep.
Fix various bugs where sev_guest() was not ensured to be stable for
the whole duration of a function or ioctl

- Convert a pile of kvm->lock SEV code to guard()

- Play nicer with userspace that does not enable
KVM_CAP_EXCEPTION_PAYLOAD, for which KVM needs to set CR2 and DR6
as a response to ioctls such as KVM_GET_VCPU_EVENTS (even if the
payload would end up in EXITINFO2 rather than CR2, for example).
Only set CR2 and DR6 when consumption of the payload is imminent,
but on the other hand force delivery of the payload in all paths
where userspace retrieves CR2 or DR6

- Use vcpu->arch.cr2 when updating vmcb12's CR2 on nested #VMEXIT
instead of vmcb02->save.cr2. The value is out of sync after a
save/restore or after a #PF is injected into L2

- Fix a class of nSVM bugs where some fields written by the CPU are
not synchronized from vmcb02 to cached vmcb12 after VMRUN, and so
are not up-to-date when saved by KVM_GET_NESTED_STATE

- Fix a class of bugs where the ordering between KVM_SET_NESTED_STATE
and KVM_SET_{S}REGS could cause vmcb02 to be incorrectly
initialized after save+restore

- Add a variety of missing nSVM consistency checks

- Fix several bugs where KVM failed to correctly update VMCB fields
on nested #VMEXIT

- Fix several bugs where KVM failed to correctly synthesize #UD or
#GP for SVM-related instructions

- Add support for save+restore of virtualized LBRs (on SVM)

- Refactor various helpers and macros to improve clarity and
(hopefully) make the code easier to maintain

- Aggressively sanitize fields when copying from vmcb12, to guard
against unintentionally allowing L1 to utilize yet-to-be-defined
features

- Fix several bugs where KVM botched rAX legality checks when
emulating SVM instructions. There are remaining issues in that KVM
doesn't handle size prefix overrides for 64-bit guests

- Fail emulation of VMRUN/VMLOAD/VMSAVE if mapping vmcb12 fails
instead of somewhat arbitrarily synthesizing #GP (i.e. don't double
down on AMD's architectural but sketchy behavior of generating #GP
for "unsupported" addresses)

- Cache all used vmcb12 fields to further harden against TOCTOU bugs

x86 (Intel):

- Drop obsolete branch hint prefixes from the VMX instruction macros

- Use ASM_INPUT_RM() in __vmcs_writel() to coerce clang into using a
register input when appropriate

- Code cleanups

guest_memfd:

- Don't mark guest_memfd folios as accessed, as guest_memfd doesn't
support reclaim, the memory is unevictable, and there is no storage
to write back to

LoongArch selftests:

- Add KVM PMU test cases

s390 selftests:

- Enable more memory selftests

x86 selftests:

- Add support for Hygon CPUs in KVM selftests

- Fix a bug in the MSR test where it would get false failures on
AMD/Hygon CPUs with exactly one of RDPID or RDTSCP

- Add an MADV_COLLAPSE testcase for guest_memfd as a regression test
for a bug where the kernel would attempt to collapse guest_memfd
folios against KVM's will"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (373 commits)
KVM: x86: use inlines instead of macros for is_sev_*guest
x86/virt: Treat SVM as unsupported when running as an SEV+ guest
KVM: SEV: Goto an existing error label if charging misc_cg for an ASID fails
KVM: SVM: Move lock-protected allocation of SEV ASID into a separate helper
KVM: SEV: use mutex guard in snp_handle_guest_req()
KVM: SEV: use mutex guard in sev_mem_enc_unregister_region()
KVM: SEV: use mutex guard in sev_mem_enc_ioctl()
KVM: SEV: use mutex guard in snp_launch_update()
KVM: SEV: Assert that kvm->lock is held when querying SEV+ support
KVM: SEV: Document that checking for SEV+ guests when reclaiming memory is "safe"
KVM: SEV: Hide "struct kvm_sev_info" behind CONFIG_KVM_AMD_SEV=y
KVM: SEV: WARN on unhandled VM type when initializing VM
KVM: LoongArch: selftests: Add PMU overflow interrupt test
KVM: LoongArch: selftests: Add basic PMU event counting test
KVM: LoongArch: selftests: Add cpucfg read/write helpers
LoongArch: KVM: Add DMSINTC inject msi to vCPU
LoongArch: KVM: Add DMSINTC device support
LoongArch: KVM: Make vcpu_is_preempted() as a macro rather than function
LoongArch: KVM: Move host CSR_GSTAT save and restore in context switch
LoongArch: KVM: Move host CSR_EENTRY save and restore in context switch
...

show more ...

Merge tag 'kvm-x86-vmxon-7.1' of https://github.com/kvm-x86/linux into HEAD

KVM x86 VMXON and EFER.SVME extraction for 7.1

Move _only_ VMXON+VMXOFF and EFER.SVME toggling out of KVM (versus all of

Merge tag 'kvm-x86-vmxon-7.1' of https://github.com/kvm-x86/linux into HEAD

KVM x86 VMXON and EFER.SVME extraction for 7.1

Move _only_ VMXON+VMXOFF and EFER.SVME toggling out of KVM (versus all of VMX
and SVM enabling) out of KVM and into the core kernel so that non-KVM TDX
enabling, e.g. for trusted I/O, can make SEAMCALLs without needing to ensure
KVM is fully loaded.

TIO isn't a hypervisor, and isn't trying to be a hypervisor. Specifically, TIO
should _never_ have it's own VMCSes (that are visible to the host; the
TDX-Module has it's own VMCSes to do SEAMCALL/SEAMRET), and so there is simply
no reason to move that functionality out of KVM.

With that out of the way, dealing with VMXON/VMXOFF and EFER.SVME is a fairly
simple refcounting game.

show more ...

KVM: x86: Move "kvm_rebooting" to kernel as "virt_rebooting"

Move "kvm_rebooting" to the kernel, exported for KVM, as one of many steps
towards extracting the innermost VMXON and EFER.SVME managemen

KVM: x86: Move "kvm_rebooting" to kernel as "virt_rebooting"

Move "kvm_rebooting" to the kernel, exported for KVM, as one of many steps
towards extracting the innermost VMXON and EFER.SVME management logic out
of KVM and into to core x86.

For lack of a better name, call the new file "hw.c", to yield "virt
hardware" when combined with its parent directory.

No functional change intended.

Tested-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Tested-by: Sagi Shahar <sagis@google.com>
Link: https://patch.msgid.link/20260214012702.2368778-4-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>

show more ...

Merge branch 'next' into for-linus

Prepare input updates for 6.11 merge window.

Merge tag 'v6.9' into next

Sync up with the mainline to bring in the new cleanup API.

Merge remote-tracking branch 'drm-misc/drm-misc-next' into HEAD

Merge drm-misc-next tree into the msm-next tree in order to be able to
use HDMI connector framework for the MSM HDMI driver.

Merge drm/drm-next into drm-intel-gt-next

Some display refactoring patches are needed in order to allow conflict-
less merging.

Signed-off-by: Tvrtko Ursulin <tursulin@ursulin.net>

Merge topic branches 'clkdev' and 'fixes' into for-linus

Merge remote-tracking branch 'drm/drm-fixes' into drm-misc-fixes

v6.10-rc1 is released, forward from v6.9

Signed-off-by: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>

Merge 6.9-rc5 into driver-core-next

We want the kernfs fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge 6.9-rc2 into staging-next

We need the staging fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge 6.9-rc2 into usb-next

We need the USB fixes in here as well.

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Merge remote-tracking branch 'torvalds/master' into perf-tools-next

To pick up fixes sent via perf-tools, by Namhyung Kim.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Merge branch 'master' into mm-stable

Merge tag 'v6.9-rc2' into media_stage

Linux 6.9-rc2

This is needed to pull in commit 11763a8598f88 ("fs/9p: fix uaf in
in v9fs_stat2inode_dotl"), which fixes the broken virtme. With this
fix the me

Merge tag 'v6.9-rc2' into media_stage

Linux 6.9-rc2

This is needed to pull in commit 11763a8598f88 ("fs/9p: fix uaf in
in v9fs_stat2inode_dotl"), which fixes the broken virtme. With this
fix the media regression tests can be run again without crashing.

show more ...

Merge branch 'topic/hda-config-pm-cleanup' into for-next

Pull HD-audio CONFIG_PM cleanup.

Signed-off-by: Takashi Iwai <tiwai@suse.de>

Merge x86 bugfixes from Linux 6.9-rc3

Pull fix for SEV-SNP late disable bugs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Merge drm/drm-next into drm-xe-next

Backmerging drm-next in order to get up-to-date and in particular
to access commit 9ca5facd0400f610f3f7f71aeb7fc0b949a48c67.

Signed-off-by: Thomas Hellström <tho

Merge drm/drm-next into drm-xe-next

Backmerging drm-next in order to get up-to-date and in particular
to access commit 9ca5facd0400f610f3f7f71aeb7fc0b949a48c67.

Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>

show more ...

ASoC: Intel: avs: Fixes and cleanups for 6.10

Merge series from Cezary Rojewski <cezary.rojewski@intel.com>:

Set of changes targeting the avs-driver only. No new features, patchset
either fixes or

ASoC: Intel: avs: Fixes and cleanups for 6.10

Merge series from Cezary Rojewski <cezary.rojewski@intel.com>:

Set of changes targeting the avs-driver only. No new features, patchset
either fixes or fortifies existing code.

Patchset starts off with a fix for debugbility on ICL+ platforms which I
have forgotten to fixup when providing support for these initially.
The next two address copier module initialization, most importantly,
silence the gcc 'field-spanning write' false-positive.

The following four:
6/13 ASoC: Intel: avs: Replace risky functions with safer variants
7/13 ASoC: Intel: avs: Fix potential integer overflow
8/13 ASoC: Intel: avs: Test result of avs_get_module_entry()
9/13 ASoC: Intel: avs: Remove dead code

address problems found out by Coverity static analysis tool.

The last two worth mentioning are: recommendation from the firmware team
to wake subsystem from D0ix when starting any pipeline -and- shielding
against invalid period/buffer sizes. Audio format shall be taken into
consideration when calculating either of these.

Amadeusz Sławiński (2):
ASoC: Intel: avs: Restore stream decoupling on prepare
ASoC: Intel: avs: Add assert_static to guarantee ABI sizes

Cezary Rojewski (11):
ASoC: Intel: avs: Fix debug-slot offset calculation
ASoC: Intel: avs: Silence false-positive memcpy() warnings
ASoC: Intel: avs: Fix config_length for config-less copiers
ASoC: Intel: avs: Fix ASRC module initialization
ASoC: Intel: avs: Replace risky functions with safer variants
ASoC: Intel: avs: Fix potential integer overflow
ASoC: Intel: avs: Test result of avs_get_module_entry()
ASoC: Intel: avs: Remove dead code
ASoC: Intel: avs: Wake from D0ix when starting streaming
ASoC: Intel: avs: Init debugfs before booting firmware
ASoC: Intel: avs: Rule invalid buffer and period sizes out

sound/soc/intel/avs/avs.h | 1 +
sound/soc/intel/avs/cldma.c | 2 +-
sound/soc/intel/avs/core.c | 4 +--
sound/soc/intel/avs/icl.c | 12 ++++++---
sound/soc/intel/avs/loader.c | 6 +++--
sound/soc/intel/avs/messages.h | 47 ++++++++++++++++++++++++++++++++--
sound/soc/intel/avs/path.c | 13 ++++------
sound/soc/intel/avs/pcm.c | 34 +++++++++++++++++++++++-
sound/soc/intel/avs/probes.c | 14 ++++++----
9 files changed, 109 insertions(+), 24 deletions(-)

--
2.25.1

show more ...

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Cross-merge networking fixes after downstream PR.

Conflicts:

net/ipv4/ip_gre.c
17af420545a7 ("erspan: make sure erspan_base_hdr is

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Cross-merge networking fixes after downstream PR.

Conflicts:

net/ipv4/ip_gre.c
17af420545a7 ("erspan: make sure erspan_base_hdr is present in skb->head")
5832c4a77d69 ("ip_tunnel: convert __be16 tunnel flags to bitmaps")
https://lore.kernel.org/all/20240402103253.3b54a1cf@canb.auug.org.au/

Adjacent changes:

net/ipv6/ip6_fib.c
d21d40605bca ("ipv6: Fix infinite recursion in fib6_dump_done().")
5fc68320c1fb ("ipv6: remove RTNL protection from inet6_dump_fib()")

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

show more ...

Merge drm/drm-next into drm-intel-next

Catching up on 6.9-rc2

Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>

Merge drm/drm-next into drm-misc-next

Backmerging to get v6.9-rc2 changes into drm-misc-next.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>

regulator: new API for voltage reference supplies

Merge series from David Lechner <dlechner@baylibre.com>:

In the IIO subsystem, we noticed a pattern in many drivers where we need
to get, enable an

regulator: new API for voltage reference supplies

Merge series from David Lechner <dlechner@baylibre.com>:

In the IIO subsystem, we noticed a pattern in many drivers where we need
to get, enable and get the voltage of a supply that provides a reference
voltage. In these cases, we only need the voltage and not a handle to
the regulator. Another common pattern is for chips to have an internal
reference voltage that is used when an external reference is not
available. There are also a few drivers outside of IIO that do the same.

So we would like to propose a new regulator consumer API to handle these
specific cases to avoid repeating the same boilerplate code in multiple
drivers.

As an example of how these functions are used, I have included a few
patches to consumer drivers. But to avoid a giant patch bomb, I have
omitted the iio/adc and iio/dac patches I have prepared from this
series. I will send those separately but these will add 36 more users
of devm_regulator_get_enable_read_voltage() in addition to the 6 here.
In total, this will eliminate nearly 1000 lines of similar code and will
simplify writing and reviewing new drivers in the future.

show more ...

Add bridged amplifiers to cs42l43

Merge series from Charles Keepax <ckeepax@opensource.cirrus.com>:

In some cs42l43 systems a couple of cs35l56 amplifiers are attached
to the cs42l43's SPI and I2S.

Add bridged amplifiers to cs42l43

Merge series from Charles Keepax <ckeepax@opensource.cirrus.com>:

In some cs42l43 systems a couple of cs35l56 amplifiers are attached
to the cs42l43's SPI and I2S. On Windows the cs42l43 is controlled
by a SDCA class driver and these two amplifiers are controlled by
firmware running on the cs42l43. However, under Linux the decision
was made to interact with the cs42l43 directly, affording the user
greater control over the audio system. However, this has resulted
in an issue where these two bridged cs35l56 amplifiers are not
populated in ACPI and must be added manually. There is at least an
SDCA extension unit DT entry we can key off.

The process of adding this is handled using a software node, firstly the
ability to add native chip selects to software nodes must be added.
Secondly, an additional flag for naming the SPI devices is added this
allows the machine driver to key to the correct amplifier. Then finally,
the cs42l43 SPI driver adds the two amplifiers directly onto its SPI
bus.

An additional series will follow soon to add the audio machine driver
parts (in the sof-sdw driver), however that is fairly orthogonal to
this part of the process, getting the actual amplifiers registered.

show more ...