Changes in cpucaps

303bff3637d13f0ecbb280c7cb403470c440a2a6 - Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Tue, 20 Oct 2026 19:55:19 +0200

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linuxPull arm64 updates from Catalin Marinas: "Here are the arm64 updates for 7.4. The more interesting bits are the removal of big-endian kernel support (already marked BROKEN for some time), preemptible this_cpu_*() operations and MPAM support for the firmware-backed (Fb) interface. CCA (Arm's confidential compute) is slowly trickling in with host RMI (Realm Management Interface) support and some refactoring, including a dedicated SMCCC bus to advertise firmware services. There are also the usual PMU updates for new hardware and a few fixes/cleanups. Core features: - Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has depended on BROKEN for a while, so drop the remaining code (BE hypervisor object, BPF JIT, assembly/crypto/library routines, endianness helper macros, selftests) and force a little-endian build - Add preemptible this_cpu_*() operations (read/write, RMW, xchg, cmpxchg and cmpxchg128) that no longer need to disable preemption around the per-CPU address generation and access - Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on arm64 Memory management: - Treat faults taken by EFI runtime firmware as kernel faults - Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty state management enabled, this is not truly read-only) - Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA configurations (28/26/24 bits for 4K/16K/64K pages) - Implement clear_page[s]() using memset() - Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU Perf and PMU: - Support for HiSilicon's ITS PMU - Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs and a cycle counter for the latest version of HiSilicon's MN PMU hardware - A bunch of fixes to the CXL PMU driver to address pre-existing issues from Sashiko - Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM drivers - Reduce excessive stack consumption in the Marvell DDR PMU driver - Minor driver updates and cleanups all over Arm Confidential Compute Architecture (CCA): - Add an Arm SMCCC bus for firmware services discovered through SMCCC and move the TRNG and CCA guest (TSM provider) drivers onto it, removing the dummy CCA platform device and adding a sysfs ABI for Realm guests - Move the Realm Service Interface (RSI) code out of arch/arm64/ into drivers/firmware/arm_rmm/ - Add the host side of the Realm Management Interface (RMI): detect, configure and activate the RMM, add SRO support and wrappers for the Realm RMI commands - Block hibernation (new arch hook in the PM core) and kexec while the RMM is active. To be revisited in the future with proper support for deactivation - Handle Granule Protection Faults (GPFs) taken by the host, caused by accesses to memory delegated to the RMM. In a future patch, the exception table lookup will be limited to is_kdump_kernel() cases MPAM (Memory Partitioning And Monitoring): - Add support for the MPAM firmware-backed (Fb) interface, allowing MSC accesses to be mediated by firmware - Fix a list of theoretical issues with the driver (MSC access error propagation, MBWU monitor save/restore and locking, resctrl class handling, error interrupt restore, maximum number of PARTIDs) - Add the mailing list and a missing file to the MAINTAINERS entry - Document when to set arm64.nompam Errata and CPU features: - Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM capability type for SoC-level errata Miscellaneous: - Mask debug exceptions (DAIF) around the hardware breakpoint register manipulations when called from generic kernel code - Don't zero the SVE state buffer when the SVE state is live - Return -EPERM instead of -EBUSY from the GCS prctl() locking failures (matching x86), with the selftest updated. Slight ABI change but no software deployment yet - kselftest: fix unsound MTE fault skipping by introducing MTE-safe memory accessors, avoid copying each signal test binary more than once - Update sysreg definitions (fix three enum values and two field names, mark architecturally dropped fields as RES0) and remove the TME transaction state check from the BRBE driver - Fix the description of ARM64_HAS_LPA2 and remove a redundant ID_AA64MMFR0 define"* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits) arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code kselftest/arm64: signal: copy each test binary only once kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store ... List of files: /linux/arch/arm64/tools/cpucaps

34fa781e25a6caa8862acd923e89d08cd9a9f37e - Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', 'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core

Thu, 15 Oct 2026 20:09:10 +0200

Merge branches 'for-next/misc', 'for-next/be-gone', 'for-next/smccc-bus', 'for-next/preemptible-this-cpu', 'for-next/cpu-errata', 'for-next/mpam', 'for-next/kselftest', 'for-next/efi', 'for-next/secondary-boot-prep', 'for-next/sysreg' and 'for-next/gcs', remote-tracking branch 'arm64/for-next/perf' into for-next/core* arm64/for-next/perf: (22 commits) drivers/perf: apple_m1: Add macOS 27 M2 Event perf/marvell: cn10k_tad: Publish the OF module alias perf: xgene: initialize lock before requesting IRQ perf: marvell: avoid large stack variables perf/dwc_pcie: Fix PCI device reference leak in probe coresight: perf: Suppress ITRACE start records perf: arm_spe: Suppress redundant ITRACE start records perf/core: Export perf_event_itrace_started() perf/cxl: Clear stale overflow status before using a counter perf/cxl: Don't log through pmu.dev in the overflow interrupt handler perf/cxl: Validate the hardware-reported counter width perf/cxl: Unfreeze counters after handling an overflow interrupt perf/cxl: Don't share the overflow interrupt, and keep it pinned cxl/pci: Add the PMUs after configuring events perf/cxl: Split the MSI vector out of info->irq perf/cxl: Accept an overflow interrupt on MSI message number 0 perf/cxl: Fix the counter overflow delta fixup perf/cxl: Clear stale event fields before reprogramming a counter perf/cxl: Program the requested event group on configurable counters drivers/perf: hisi: Add cycle event for new MN PMU ...* for-next/misc: arm64: cpufeature: Enable BBML2 for NVIDIA Rigel arm64: cputype: Add NVIDIA Rigel definitions arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA arm64/debug: mask debug exceptions when called from common code arm64: clear_page[s] using memset arm64/sve: Don't zero the SVE state buffer when the SVE state is live arm64/cpufeature: Drop redundant define(ID_AA64MMFR0..._SUPPORTED_LPA2) arm64: Use proper include variant arm64: include: fix repeated word 'to' in comment selftests: arm64: fix typo "hander" in comment arm64: fix typos in comments docs: arm64: Fix typo "initalised" in booting.rst arm64: alternative: Remove 'cfg' parameter arm64: mte-kasan: Use IS_ENABLED() rather than ALTERNATIVE() 'cfg' parameter arm64/cpufeature: Change description for ARM64_HAS_LPA2* for-next/be-gone: drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN arm64: Kbuild: Remove vestigial big-endian support gve: Add explicit ARM64 dependency to Kconfig crypto: hisilicon/sec2: Remove check of CONFIG_CPU_LITTLE_ENDIAN arm64: Remove all usage of __AARCH64EB__ arm64: Remove all usage of CONFIG_CPU_BIG_ENDIAN KVM: arm64: Remove support for a big-endian hypervisor object arm64: vdso32: Always build compat vDSO object as little-endian arm64: assembler: Remove endianness helper macros arm64: lib: Assume a little-endian kernel in optimised string routines arm64: lib: Assume a little-endian kernel in custom library routines arm64: crypto: Assume a little-endian kernel arm64: bpf: Remove big-endian support from the JIT compiler selftests/arm64: Remove big-endian support* for-next/smccc-bus: : Switch Arm SMCCC firmware services to an SMCCC bus arm64: rsi: Correct type of realm_config::hash_algo firmware: smccc: Pass only the required device probe arguments firmware: arm_rmm: Add SPDX and sort the Kconfig and Makefile entries coco: guest: arm64: Remove dummy CCA platform device coco: guest: arm64: Add sysfs ABI for CCA Realm guests firmware: smccc: arm-cca-guest: Bind the TSM provider to an SMCCC device virt: coco: arm-cca-guest: Rename TSM report source file arm64: realm: Move Realm memory encryption ops to RSI code firmware: arm_rmm: Move RSI support out of arch/arm64 firmware: hwrng: arm_smccc_trng: Register as an SMCCC device firmware: smccc: Add an Arm SMCCC bus* for-next/preemptible-this-cpu: : Preemptible this_cpu_*() operations arm64: percpu: Remove _pcp_protect*() wrappers arm64: percpu: Implement preemptible CMPXCHG128 ops arm64: percpu: Implement preemptible CMPXCHG ops arm64: percpu: Implement preemptible XCHG ops arm64: percpu: Implement preemptible return RMW ops arm64: percpu: Implement preemptible void RMW ops arm64: percpu: Implement preemptible read/write ops arm64: percpu: Add infrastructure for preemptible this_cpu_*() ops arm64: entry: sdei: Make 'tsk' available arm64: entry: sdei: Restore all clobberable GPRs arm64: gpr-num: add __GPR_NUM() helper arm64: gpr-num: Add wxN aliases for wN registers arm64: percpu: Factor out percpu offset asm arm64: ptrace: Always inline pt_regs_{read,write}_reg() arm64: preempt: Treat should_resched() as unlikely arm64: preempt: Simplify and optimize __preempt_count_dec_and_test() arm64: cmpxchg128: LSE: Remove redundant operands arm64: cmpxchg: LL/SC: Avoid redundant extension* for-next/cpu-errata: : Various CPU errata workarounds arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue arm64: cpufeature: Add ARM64_CPUCAP_SOC_ERRATUM for SoC-level errata* for-next/mpam: (30 commits) : MPAM updates arm_mpam: make the mon_sel guard conditional only arm_mpam: On saving mbwu state read the monitors before clearing CFG_MBWU_CTL arm_mpam: detect and enable MPAM-Fb PCC support arm_mpam: change MPAM-Fb error IRQ to use a threaded IRQ handler arm_mpam: add MPAM-Fb MSC firmware access support arm_mpam: prepare mon_sel locking for MPAM-Fb arm_mpam: propagate MSC access errors in mpam_reset_class_locked() arm_mpam: propagate MSC access errors for interrupt control arm_mpam: propagate MSC access errors for mpam_reprogram_ris_partid() arm_mpam: propagate MSC access errors for state saving function arm_mpam: propagate MSC access errors for __ris_msmon_read() arm_mpam: propagate MSC access errors for msmon helpers arm_mpam: propagate MSC access errors for MBWU counters arm_mpam: propagate MSC access errors for hw_probe functions arm_mpam: let low level MSC accessors return an error MAINTAINERS: Use linux-arm-kernel list for the MPAM driver MAINTAINERS: Add mpam.rst to the MPAM DRIVER entry arm_mpam: resctrl: Don't stop early when tearing down a class arm_mpam: Switch to kvzmalloc_objs() for allocation of component cfg arm_mpam: Don't loop forever if there is the maximum possible amount of PARTIDs ...* for-next/kselftest: : arm64 kselftest updates kselftest/arm64: signal: copy each test binary only once kselftest/arm64/mte: Use MTE safe memory accessors kselftest/arm64/mte: Introduce MTE safe memory accessors kselftest/arm64: Extend gcs-locking to cover cases where enable is unlocked* for-next/efi: : arm64 EFI updates/fixes arm64/mm: Treat faults taken by EFI runtime firmware as kernel faults arm64/efi: Clear PTE_WRITE when applying EFI_MEMORY_RO* for-next/secondary-boot-prep: : cpuinfo cleanup in preparation for parallel secondary bring-up arm64: smp: Defer RCU registration during secondary CPU bringup arm64: smp: Don't bother printing the I-cache policy for each CPU arm64: smp: Defer update of secondary CPU capabilities arm64: smp: Tidy up cpuinfo init and cpufeature updates arm64: smp: Tidy up smp_prepare_cpus() arm64: cpufeature: Store every ID register with its overrides applied arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu() arm64: cpufeature: Add read_cpuid_with_overrides() arm64: cpufeature: Check arm64_ftr_regs[] before the first store* for-next/sysreg: : sysreg updates perf: arm_brbe: Remove the check for TME transaction states arm64: sysreg: Mark fields the architecture dropped as RES0 arm64: sysreg: Fix the names of two misspelt fields arm64: sysreg: Fix three incorrect enum values* for-next/gcs: : GCS updates/fixes kselftest/arm64: Check for -EPERM not -EBUSY in the locking test arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures List of files: /linux/arch/arm64/tools/cpucaps

d5a821f66047c2effd06147b84775f9b2ce0f4aa - regmap: Fix cache lifecycle locking and teardown

Tue, 13 Oct 2026 01:11:44 +0200

regmap: Fix cache lifecycle locking and teardownMichael Reeves says:Fix an "Invalid wait context" lockdep warning during Apple GPIO probe andcorrect debugfs ordering during cache teardown.Tested on Apple M3 MacBook Air (T8122):- All 4 GPIO controllers probe successfully with lockdep enabled.- The "Invalid wait context" warning no longer occurs.- The regmap KUnit suite passes and lockdep remains enabled.Link: https://patch.msgid.link/20261006-regcache-lifecycle-submit-v3-0-37bdd82fd47c@gmail.com List of files: /linux/arch/arm64/tools/cpucaps

d44e08dab27d908510f526dc27c4529b3167be4c - arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issue

Fri, 09 Oct 2026 19:19:46 +0200

arm64: errata: Add NXP i.MX8QM/8QP workaround for A53 cache coherency issueAccording to NXP errata document IMX8_1N94W[1], the i.MX8QuadMax andi.MX8QuadPlus SoCs suffer from a cache coherency issue (ERR050104). Theupper bits, above bit 35, of the ARADDR and ACADDR buses within the ArmA53 subsystem have been incorrectly connected. This causes some TLBI andIC maintenance operations exchanged between the A53 and A72 coreclusters to be corrupted.The workaround requires: - Downgrading targeted TLBI operations to broadcast-all variants. Instead of patching the low-level __TLBI_1 macro (which causes excessive over-invalidation), redirect high-level TLB flush functions (flush_tlb_mm, __do_flush_tlb_range, flush_tlb_kernel_range, __flush_tlb_kernel_pgtable) to use VMALLE1IS via alternatives. - Upgrading IC IVAU to IC IALLUIS for both kernel (via ALTERNATIVE in invalidate_icache_by_line) and EL0 userspace (via trap-and-upgrade in user_cache_maint_handler with SCTLR_EL1.UCI=0). - Disabling KVM since correct TLB maintenance cannot be guaranteed for guests. - No need to touch SMMU Broadcast TLB Maintenance (BTM) since the arm-smmu driver does not use it.SoC detection uses devicetree compatible string "fsl,imx8qm" or"fsl,imx8qp" since the boot CPU MIDR_EL1 (0x410fd034) and AIDR_EL1 (0)are not unique to these SoCs.[1] https://www.nxp.com/docs/en/errata/IMX8_1N94W.pdf[ Reworked per review feedback from Will Deacon and Mark Rutland: - Move TLBI workaround from __TLBI_1 macro to high-level flush functions to avoid excessive over-invalidation - Add kernel IC IVAU upgrade via ALTERNATIVE in assembler.h - Add cpucap_is_possible() entry for compile-time elimination]Tested-by: Franz Schnyder # Toradex Apalis iMX8QMCo-developed-by: Ivan T. Ivanov Signed-off-by: Ivan T. Ivanov Signed-off-by: Peng Fan [catalin.marinas@arm.com: Kconfig and errata text, sysreg_clear_set(), of_machine_compatible_match()]Signed-off-by: Catalin Marinas List of files: /linux/arch/arm64/tools/cpucaps

07c75552f7fe636a0695baae506a7d72fabd3be4 - Merge tag 'asoc-fix-v7.3-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

Thu, 08 Oct 2026 10:49:55 +0200

Merge tag 'asoc-fix-v7.3-rc6' of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linusASoC: Fixes for v7.3A fairly small collection of fixes and a few device quirks, nothingespecially remarkable unless you have the affected system. List of files: /linux/arch/arm64/tools/cpucaps

fb52d063456741c623967882785e01272501949b - ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedback

Wed, 07 Oct 2026 13:20:06 +0200

ASoC: cs35l56/57/62/63: Use the correct SoundWire DP for feedbackRichard Fitzgerald says:The amp feedback path (AEC) was incorrectly using SoundWire DP3.The firmware outputs SDCA OT25 feedback on DP4. DP3 is reserved forSDCA companion amp.This series adds a DAI for OT25 and switches the sdw machine driverto use the new DAI for the feedback path.Link: https://patch.msgid.link/20261005155235.1386525-1-rf@opensource.cirrus.com List of files: /linux/arch/arm64/tools/cpucaps

c5adb6c8a26d653fe1d0ee52908d998f7471e9eb - Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

Sat, 03 Oct 2026 16:54:58 +0200

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linuxPull arm64 fixes from Will Deacon: "Half of this is broken hardware (AMU counters and TLB invalidation) and the other half is broken software (frequency scaling and signals). So it seems as though we're all as bad as each other. The AMU workaround is a little noisy, as it refactors an existing workaround so that it can more easily be applied to additional CPUs. Summary: - Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME"* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems arm64: errata: Add Cortex-A725 erratum 3821522 workaround arm64: errata: Factor out broken AMU const counter cap arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz arm64: mm: Fix the break-before-make flush range for erratum 2645198 List of files: /linux/arch/arm64/tools/cpucaps

573371caf7aea8582212da81dcead2c3f48fac4b - arm64: errata: Factor out broken AMU const counter cap

Thu, 01 Oct 2026 11:00:31 +0200

arm64: errata: Factor out broken AMU const counter capMove the workaround from the erratum 2457168-specific cpucap to a genericbroken AMU constant-counter one. This keeps the existing Cortex-A510handling unchanged while allowing other errata with similar AMU constantcounter issue to share the capability bit and call sites.Signed-off-by: Beata Michalska Reviewed-by: Vladimir Murzin Signed-off-by: Will Deacon List of files: /linux/arch/arm64/tools/cpucaps

67f8bc848ee31831336bd478e57d2f993551902e - Merge drm/drm-fixes into drm-misc-fixes

Tue, 01 Sep 2026 09:38:51 +0200

Merge drm/drm-fixes into drm-misc-fixesLet's start the 7.3 drm-misc-fixes cycle.Signed-off-by: Maxime Ripard List of files: /linux/arch/arm64/tools/cpucaps

b2128290c29902315e632ea59e0504d6bc9e9b42 - Merge remote-tracking branch 'drm/drm-next' into msm-next-backmerge

Sat, 18 Jul 2026 17:06:55 +0200

Merge remote-tracking branch 'drm/drm-next' into msm-next-backmergeBackmerge of drm-next, mainly to pick up dt bindings docs updates toavoid conflicts.Signed-off-by: Rob Clark List of files: /linux/arch/arm64/tools/cpucaps

7bb6284aa7b3c369b41e7f33fcbe193161f008e7 - Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Tue, 25 Aug 2026 20:48:04 +0200

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmPull kvm updates from Paolo Bonzini: "ARM64: - Add support for 'slot' based PMU events, paired with new UAPI that compels the user to select a specific PMU implementation - Lazy save/restore of vCPU state for pKVM, along with various fixes and cleanups to the management of vCPU state between the untrusted host and pKVM hypervisor - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits are stateful in the EL1 counterpart - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope of those instructions remains 'in host' (i.e. L1 kernel/userspace) - Pile of fixes for the management of the VNCR pseudo-TLB, such as under-invalidations and races with concurrent TLBIs on other vCPUs - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a runtime-patched constant, allowing the same data to be shared with pKVM prior to dropping host privileges - Considerable pile of LLM-assisted fixes around the shop but mostly in the VGIC, our in-kernel generator of bugs (and sometimes interrupts) LoongArch: - Advertise already-supported capabilities - Some bug fixes about timer and MMIO - Some hardening about interrupt injection - Replace kvm_err() with kvm_pr_unimpl() - Add FPU/LSX/LASX test cases for selftests RISC-V: - Svadu/Zicfiss/Zicfilp FWFT support for Guest - Use try_cmpxchg for IMSIC MRIF RMW - More arch-specific tracepoints in KVM RISC-V - Eager page splitting when enabling dirty logging - Optimize hfence request handling for SMP Guests - Improve dirty log clearing by skipping zero bits in mask - Guard HFENCE range loops against overflow - CPU PM notifiers in KVM RISC-V for non-retentive idle states - Fix kernel-mode vector context save/restore for Guest s390: - Fixes for vfio-ap - Fixes for the gmap rework - Fixes for vsie - AI triggered fixes all over - diag9c tracing - code move preparation for the additional arm64 support - enable CONTEXT_ANALYSIS x86: - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c (the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving relevant code out of x86.c - Split kvm_mmu in three parts, respectively to describe the format of page tables, walking the guest page tables and building the page tables. Always use the same page table walker kvm->arch.gva_walk as the entry point to convert a guest's virtual address, where the previous code used two different kvm_mmu structs depending on whether the walk included nested EPT/NPT or not. Make page fault vmexits reuse the permission checking machinery that is used for guest page faults. This is both a cleanup and a baby step towards supporting XS/XU memory permissions - Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs on x86 - Remove a defunct masterclock update from kvm_xen_shared_info_init(). It could result in incorrect kvmclock due to triggering an unnecessary switch to/from masterclock mode - Skip Xen runstate time updates if time has effectively gone backwards, so that the guest doesn't report 100% steal time for a very, very long time - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was updating the wrong sub-leaf, and upstream KVM will soon provide all the information needed by userspace to populate the CPUID field itself - Fix a bug where KVM would walk a newly created rmap without holding the rmap lock (or mmu_lock) during aging - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs - Fix a variety of #DB priority bugs - Fix a class of races related to enabling Hyper-V emulation on a vCPU after the vCPU is visible to the rest of KVM - Use static calls for nested virtualization ops - Move more KVM-internal code out of x86's kvm_host.h - Enumerate support for a variety of Zhaoxin instructions that don't require explicit virtualization - Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path - Harden kvm_vcpu_map() against double-mapping and thus leaking references - Misc fixes and cleanups, e.g. for largely benign syzkaller splats x86 (Intel): - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI virtualization when the vCPU is freed, to fix a use-after-free where hardware will write to a freed vCPU's PID - Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM could miss a TLB on a future, successful VM-Enter with the same L2 VPID - Cap the maximum value shoved into the VMX Preemption Timer to workaround an erratum that affects all existing Intel CPUs that support CPUID 0x15 - Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs - Harden the TDX "populate" ioctls against bad input, and to prepare for supporting in-place private<=>shared conversion x86 (AMD): - Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State Change request - Remove a dying VM from the GA Log notifier list before the VM is actually destroyed, to fix a potential use-after-free - While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact, get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM. So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory introduced by KVM's (correct) usage of long-term pins (This was reviewed by mm maintainers; for more information, see commit ee1a586dd1fa "KVM: SEV: Drop FOLL_WRITE for encrypted region registration") - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled hosts to fix a data corruption issue due to the PSP driver assigning to-be-written pages to firmware (as required by the SNP specs) - Unconditionally intercept ICBEP so that KVM generates the correct guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT - Harden the SNP "populate" ioctls against bad input, and to prepare for supporting in-place private<=>shared conversion Generic: - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's debugfs - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but for which the vCPU isn't yet online, and use the bitmap to reject duplicate IDs before calling into arch code. This allows arch code to consume vcpu_id without having to worry about cross-vCPU clobbering (at least s390 and x86 have had related bugs) - Rework the so called "prepare" and "invalidate" guest_memfd hooks to prepare for in-place private<=>shared conversion, and clean up a few warts along the way Selftests: - Automatically allocate a full page for L2 guest stacks on x86 instead of requiring test-specific L1 guest code to carve out a portion of the L1 stack for L2 usage, and to ensure the L2 stack also adheres to the x86-64 calling convention ABI - Add a selftest to verify {Guest,Host}-Only behavior in x86's mediated PMU - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions, reuse the functionality for nested VMX, and drop the ucall hack that was fudging around the lack of GPR switching on nVMX - Add a stress test to verify KVM doesn't clobber/drop #PF state, e.g. CR2, across save/restore, including when L2 is active - Add a test to verify KVM_CREATE_VM accepts exactly what is reported by KVM_CAP_VM_TYPES - Misc selftests fixes and cleanups - Fix several issues with seeding the pRNG, and rework the pRNG APIs to that the pRNG can be sanely used in host code, not just guest code - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for triggering IRQs via writes to an assigned VFIO device - Add syscall wrappers to assert success on a variety of pthreads and CPU affinity APIs - Set vCPU pthread affinity as early as possible to reduce contention issues that were surfaced by PREEMPT_LAZY, which result in runtimes of over a minute on large hosts, versus the expected ~5 seconds - Rework the PMU counters test to run each testcase using a single VM with many vCPUs for each sub-testcase, instead of using a unique VM for each sub-testcase. This cuts the runtime by ~20x Miscellaneous: - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly representing the status quo more accurately, but also... welcome David Hildenbrand as guest_memfd reviewer!"* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits) KVM: arm64: Validate GICv5 timer PPIs before claiming ownership KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs KVM: arm64: vgic: Prevent speculative SPI array underflow KVM: arm64: vgic: Free gic_kvm_info on initialization failure KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params' s390/vfio-ap: Fix NULL deref in status_show() during queue probe s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector riscv: vector: allow non-preemptible kernel-mode vector with IRQs off riscv: vector: refactor riscv_v_start_kernel_context KVM: s390: gmap: Make prefix handling optional KVM: s390: gmap: Make CMMA optional KVM: s390: gmap: Make storage keys optional KVM: s390: Prepare gmap for a second KVM implementation ... List of files: /linux/arch/arm64/tools/cpucaps

76671054f9a1ff6abb976583cd8da37650acdc97 - Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD

Mon, 24 Aug 2026 18:42:07 +0200

Merge tag 'kvmarm-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEADKVM/arm64 changes for 7.3 - Add support for 'slot' based PMU events, paired with new UAPI that compels the user to select a specific PMU implementation - Lazy save/restore of vCPU state for pKVM, along with various fixes and cleanups to the management of vCPU state between the untrusted host and pKVM hypervisor - Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits are stateful in the EL1 counterpart - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope of those instructions remains 'in host' (i.e. L1 kernel/userspace) - Pile of fixes for the management of the VNCR pseudo-TLB, such as under-invalidations and races with concurrent TLBIs on other vCPUs - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a runtime-patched constant, allowing the same data to be shared with pKVM prior to dropping host privileges - Considerable pile of LLM-assisted fixes around the shop but mostly in the VGIC, our in-kernel generator of bugs (and sometimes interrupts) List of files: /linux/arch/arm64/tools/cpucaps

2791de535400bc40fd837baa756117434df7895d - Merge branch 'kvm-arm64/vtr-patch' into next

Wed, 19 Aug 2026 23:05:49 +0200

Merge branch 'kvm-arm64/vtr-patch' into next* kvm-arm64/vtr-patch: : Inline patching of ICH_VTR_EL2 constant, courtesy of Marc Zyngier : : Unify readers of ICH_VTR_EL2 on an instruction-patched constant value, : avoiding system register accesses known to trap under nested : virtualization and sharing the implementation between pKVM and 'regular' : KVM. KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2 KVM: arm64: vgic-v3: Simplify initial GICv3 configuration sampling KVM: arm64: Convert most ICH_VTR_EL2 accesses to inlined literal value KVM: arm64: Add a helper providing an inlined literal value for ICH_VTR_EL2 KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata KVM: arm64: vgic-v3: Make vtr_to_* helpers use architectural field symbolsSigned-off-by: Oliver Upton List of files: /linux/arch/arm64/tools/cpucaps

5f44f603b0daeda535b6d307cd02ef9a24b3b8c5 - Merge branch 'kvm-arm64/feat-nv3' into next

Wed, 19 Aug 2026 21:27:53 +0200

Merge branch 'kvm-arm64/feat-nv3' into next* kvm-arm64/feat-nv3: (29 commits) : Support for FEAT_NV2p1 and FEAT_NV3, courtesy of Marc Zyngier : : Couple of accelerations for nested virtualization: : : - Elide traps for EL1 alias registers when hardware guarantees that : EL2-only bits are stateful (NV2p1) : : - Use TGE-aware hardware to avoid unnecesary ERET/TLBI traps that : remain 'in-context' (i.e. L1 kernel/userspace) arm64: Add override for ID_AA64MMFR4_EL1.NV_frac KVM: arm64: selftest: Add NVHCR_EL2 to get-reg-list KVM: arm64: Expose FEAT_NV3 to guests KVM: arm64: Add FEAT_NV3 detection KVM: arm64: Engage NV3 TLBI trap elision KVM: arm64: Engage NV3 ERET trap elision KVM: arm64: Add NVHCR_EL2 context switching KVM: arm64: Add routing for NVHCR_EL2 trap KVM: arm64: Add NVHCR_EL2 handling to the sysreg array KVM: arm64: Add sanitisation for NVHCR_EL2 KVM: arm64: Make HCR_EL2 a non-VNCR register KVM: arm64: Add kvm_has_nv{2,3}() predicates KVM: arm64: Add NV3 control bits to HCRX_EL2 sanitisation KVM: arm64: Split NV-specific exit fixups from the non-NV handling arm64: Add ARM64_HAS_NV3 capability arm64: sysreg: Add HCRX_EL2 bits related to FEAT_NV3 arm64: sysreg: Add NVHCR_EL2 description as a mirror of HCR_EL2 arm64: Add FEAT_NV2p1 detection KVM: arm64: Expose FEAT_NV2p1 to NV guests KVM: arm64: Relax CNTHCTL_EL2 handling when FEAT_NV2p1 is present ...Signed-off-by: Oliver Upton List of files: /linux/arch/arm64/tools/cpucaps

637315cb400eed1dbe721954fea437a61a2d65b2 - Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEAD

Tue, 18 Aug 2026 13:07:31 +0200

Merge tag 'kvm-riscv-7.3-1' of https://github.com/kvm-riscv/linux into HEADKVM/riscv changes for 7.3- Svadu/Zicfiss/Zicfilp FWFT support for Guest- Use try_cmpxchg for IMSIC MRIF RMW- More arch-specific tracepoints in KVM RISC-V- Eager Page Splitting for KVM RISC-V- Optimize hfence request handling for SMP Guests- Improve dirty log clearing by skipping zero bits in mask- Guard HFENCE range loops against overflow- CPU PM notifiers in KVM RISC-V for non-retentive idle states- Fix kernel-mode vector context save/restore for Guest List of files: /linux/arch/arm64/tools/cpucaps

5be1b8de27dce70af8cd0bf7fa87f7c4c592aec2 - arm64: Add ARM64_HAS_NV3 capability

Thu, 30 Jul 2026 09:10:08 +0200

arm64: Add ARM64_HAS_NV3 capabilityAs a bunch of KVM code is going to depend on FEAT_NV3 being detectedon the host, add a new capability that will describe it.Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260730071022.296811-16-maz@kernel.orgSigned-off-by: Oliver Upton List of files: /linux/arch/arm64/tools/cpucaps

0dbb49dcdbbe9ea1546a80548b95e5199328b181 - arm64: Add ARM64_HAS_NV2P1 capability

Thu, 30 Jul 2026 09:10:01 +0200

arm64: Add ARM64_HAS_NV2P1 capabilityAs we're about to deal with FEAT_NV2P1, add a new capability thatwill be used to key any support for it.Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260730071022.296811-9-maz@kernel.orgSigned-off-by: Oliver Upton List of files: /linux/arch/arm64/tools/cpucaps

27a263e1a0fa23374066696aa7732a01bfde7a4e - KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrata

Tue, 21 Jul 2026 19:07:50 +0200

KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrataUsing is_midr_in_range_list() in a noinstr function isn't a good idea.And yet kvm_compute_ich_hcr_trap_bits() is doing that by callingvgic_v3_broken_seis().Move all the broken SEIS detection logic to the errata detectionframework, and use a new ARM64_WORKAROUND_GICv3_BROKEN_SEIS capto indicate that we're running on broken CPUs.This reuses the MIDR list used for IMPDEF PMU detection, whichhas a 100% overlap with the SEIS stuff...Signed-off-by: Marc Zyngier Link: https://patch.msgid.link/20260721170754.3150521-3-maz@kernel.orgSigned-off-by: Oliver Upton List of files: /linux/arch/arm64/tools/cpucaps

efe86f088f48f18c27b648e5724048947f3b7fb4 - Merge drm/drm-next into drm-xe-next

Tue, 14 Jul 2026 15:40:31 +0200

Merge drm/drm-next into drm-xe-nextSync some i915/display changesSigned-off-by: Rodrigo Vivi List of files: /linux/arch/arm64/tools/cpucaps

6d177908bad5992e17669030db41caab88041d5e - Merge drm/drm-next into drm-intel-next

Tue, 30 Jun 2026 14:55:43 +0200

Merge drm/drm-next into drm-intel-nextSync with v7.2-rc1.Signed-off-by: Jani Nikula List of files: /linux/arch/arm64/tools/cpucaps