Josua Mayer [Thu, 26 Feb 2026 16:36:30 +0000 (18:36 +0200)]
dt-bindings: arm: fsl: Add various solidrun i.MX8M boards
Add bindings for various SolidRun boards:
- i.MX8MP HummingBoard IIoT - based on the SolidRun i.MX8M Plus SoM
- SolidSense N8 - single-board design with i.MX8M Nano
- i.MX8M Mini System on Module
- i.MX8M Mini HummingBoard Ripple
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> Signed-off-by: Josua Mayer <josua@solid-run.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
Biju Das [Wed, 25 Mar 2026 19:24:31 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Add shared interrupt support
The RZ/G3L SoC has 16 external interrupts, of which 8 are shared with TINT
(GPIO interrupts), whereas RZ/G2L has only 8 external interrupts with no
sharing. The shared interrupt line selection between external interrupt and
GPIO interrupt is based on the INTTSEL register. Add shared_irq_cnt
variable to struct rzg2l_hw_info handle these differences.
Add used_irqs bitmap to struct rzg2l_irqc_priv to track allocation state.
In the alloc callback, use test_and_set_bit() to enforce mutual exclusion
and configure the INTTSEL register to route to either the external
interrupt or TINT. In the free callback, use test_and_clear_bit() to
release the shared interrupt line and reset the INTTSEL. Also add INTTSEL
register save/restore support to the suspend/resume path.
Biju Das [Wed, 25 Mar 2026 19:24:30 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Add RZ/G3L support
The IRQC block on the RZ/G3L SoC is almost identical to the one found on
the RZ/G2L SoC, with the following differences:
- The number of GPIO interrupts for TINT selection is 113 instead of 123.
- The pin index and TINT selection index are not in the 1:1 map.
- The number of external interrupts are 16 instead of 8, out of these
8 external interrupts are shared with TINT.
Add support for the RZ/G3L driver by filling the rzg2l_hw_info table and
adding LUT for mapping between pin index and TINT selection index.
Biju Das [Wed, 25 Mar 2026 19:24:29 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Drop IRQC_IRQ_COUNT macro
The total number of external interrupts in RZ/G2L and RZ/G3L SoC are
different. The RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8
external interrupts. Add irq_count variable in struct rzg2l_hw_info to
handle these differences and drop the macro IRQC_IRQ_COUNT.
Biju Das [Wed, 25 Mar 2026 19:24:28 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Drop IRQC_TINT_START macro
The IRQC_TINT_START value is different for RZ/G3L and RZ/G2L SoC. Add
tint_start variable in struct rzg2l_hw_info to handle this difference and
drop the macro IRQC_TINT_START.
While at it, update the variable type of titseln, tssr_offset, tssr_index,
index, and sense to unsigned int, in rzg2l_tint_set_edge() as these
variables are used only for calculation.
Biju Das [Wed, 25 Mar 2026 19:24:27 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Drop IRQC_NUM_IRQ macro
The total number of interrupts in RZ/G2L and RZ/G3L SoC are different.
Introduce struct rzg2l_hw_info to handle the hardware differences and
replace the macro IRQC_NUM_IRQ with num_irq variable in struct
rzg2l_hw_info.
The total number of interrupts in RZ/G2L and RZ/G3L SoC are different. The
RZ/G3L has 16 external interrupts whereas RZ/G2L has only 8 external
interrupts. Dynamically allocate fwspec memory instead of static allocation
to support both SoCs.
Biju Das [Wed, 25 Mar 2026 19:24:25 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Split rzfive_irqc_{mask,unmask} into separate IRQ and TINT handlers
rzfive_irqc_mask() and rzfive_irqc_unmask() use hw_irq range checks to
dispatch between IRQ and TINT masking operations. Split each into two
dedicated handlers — rzfive_irqc_irq_mask(), rzfive_irqc_tint_mask(),
rzfive_irqc_irq_unmask(), and rzfive_irqc_tint_unmask() — each operating
unconditionally on its respective interrupt type, removing the runtime
conditionals.
Assign the IRQ-specific handlers to rzfive_irqc_irq_chip and the
TINT-specific handlers to rzfive_irqc_tint_chip, consistent with the
separation applied to the EOI, set_type, and enable/disable callbacks in
previous patches.
While at it, simplify rzfive_irqc_{irq,tint}_{mask,unmask}() by replacing
raw_spin_lock locking/unlocking with scoped_guard().
Biju Das [Wed, 25 Mar 2026 19:24:24 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Split rzfive_tint_irq_endisable() into separate IRQ and TINT helpers
rzfive_tint_irq_endisable() handles both IRQ and TINT enable/disable paths
via a hw_irq range check.
Split this into two dedicated helpers, rzfive_irq_endisable() for IRQ
interrupts and rzfive_tint_endisable() for TINT interrupts, each operating
unconditionally on their respective interrupt type.
While at it, simplify rzfive_{irq,tint}_endisable by replacing
raw_spin_lock locking/unlocking with guard() and update the variable types
of offset, tssr_offset, and tssr_index to unsigned int, as these variables
are used only for calculation.
Biju Das [Wed, 25 Mar 2026 19:24:23 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Replace rzg2l_irqc_irq_{enable,disable} with TINT-specific handlers
rzg2l_irqc_irq_disable() and rzg2l_irqc_irq_enable() are used by both the
IRQ and TINT chips, but only perform TINT-specific work via
rzg2l_tint_irq_endisable(), guarded by a hw_irq range check.
Since the IRQ chip does not require this extra enable/disable handling,
replace its callbacks with the generic irq_chip_disable_parent() and
irq_chip_enable_parent() directly.
While at it, simplify rzfive_irqc_irq_enable() by replacing raw_spin_lock
locking/unlocking with guard() and update the variable types of offset,
tssr_offset, and tssr_index to unsigned int, as these variables are used
only for calculation.
Biju Das [Wed, 25 Mar 2026 19:24:22 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Split set_type handler into separate IRQ and TINT functions
The common rzg2l_irqc_set_type() handler uses hw_irq range checks to
dispatch to either rzg2l_irq_set_type() or rzg2l_tint_set_edge().
Split this into two dedicated handlers, rzg2l_irqc_irq_set_type() and
rzg2l_irqc_tint_set_type(), each calling only their respective type
configuration function without runtime conditionals.
Biju Das [Wed, 25 Mar 2026 19:24:21 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Split EOI handler into separate IRQ and TINT functions
The common rzg2l_irqc_eoi() handler uses a conditional to determine whether
to clear an IRQ or an TINT interrupt.
Split this into two dedicated handlers, rzg2l_irqc_irq_eoi() and
rzg2l_irqc_tint_eoi(), each handling only their respective interrupt type
without the need for range checks.
While at it, simplify rzg2l_irqc_{irq,tint}_eoi() by replacing
raw_spin_lock locking/unlocking with scoped_guard().
Biju Das [Wed, 25 Mar 2026 19:24:20 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Replace single irq_chip with per-region irq_chip instances
The driver uses a single irq_chip instance shared across all interrupt
types, relying on dispatcher callbacks to differentiate between IRQ and
TINT regions at runtime.
Replace the per-SoC irq_chip and its dispatcher callbacks with dedicated
irq_chip instances for each interrupt region: IRQ and TINT. Subsequent
patches will add per-region callbacks for IRQ and TINT from the common
code.
Biju Das [Wed, 25 Mar 2026 19:24:19 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Drop redundant IRQC_TINT_START check in rzg2l_irqc_alloc()
The check `hwirq < IRQC_TINT_START` in rzg2l_irqc_alloc() is unnecessary as
the condition is already guaranteed to be false at that point in the code.
The outer `if (hwirq > IRQC_IRQ_COUNT)` block ensures that hwirq is always
above IRQC_IRQ_COUNT before reaching this check, and since IRQC_TINT_START
<= IRQC_IRQ_COUNT, the guard can never trigger.
Remove the dead code to simplify the allocation path.
Biju Das [Wed, 25 Mar 2026 19:24:18 +0000 (19:24 +0000)]
irqchip/renesas-rzg2l: Fix error path in rzg2l_irqc_common_probe()
Replace pm_runtime_put() with pm_runtime_put_sync() when
irq_domain_create_hierarchy() fails to ensure the device suspends
synchronously before devres cleanup disables runtime PM via
pm_runtime_disable().
[ tglx: Fix up subject and change log to be precise ]
Document RZ/G3L (R9A08G046) IRQC. The IRQC block on the RZ/G3L SoC is
nearly identical to that found on the RZ/G3S SoC, with the following
differences: it supports more external interrupts and GPT error
interrupts, and adds registers for GPT/MTU interrupt selection and shared
interrupt selection between external interrupt and TINT. A new compatible
string "renesas,r9a08g046-irqc" is therefore introduced for the RZ/G3L
SoC.
Jiakai Xu [Tue, 3 Mar 2026 01:08:59 +0000 (01:08 +0000)]
RISC-V: KVM: selftests: Add RISC-V SBI STA shmem alignment tests
Add RISC-V KVM selftests to verify the SBI Steal-Time Accounting (STA)
shared memory alignment requirements.
The SBI specification requires the STA shared memory GPA to be 64-byte
aligned, or set to all-ones to explicitly disable steal-time accounting.
This test verifies that KVM enforces the expected behavior when
configuring the SBI STA shared memory via KVM_SET_ONE_REG.
Specifically, the test checks that:
- misaligned GPAs are rejected with -EINVAL
- 64-byte aligned GPAs are accepted
- all-ones GPA is accepted
Jiakai Xu [Tue, 3 Mar 2026 01:08:58 +0000 (01:08 +0000)]
KVM: selftests: Refactor UAPI tests into dedicated function
Move steal time UAPI tests from steal_time_init() into a separate
check_steal_time_uapi() function for better code organization and
maintainability.
Previously, x86 and ARM64 architectures performed UAPI validation
tests within steal_time_init(), mixing initialization logic with
uapi tests.
Changes by architecture:
x86_64:
- Extract MSR reserved bits test from steal_time_init()
- Move to check_steal_time_uapi() which tests that setting
MSR_KVM_STEAL_TIME with KVM_STEAL_RESERVED_MASK fails
ARM64:
- Extract three UAPI tests from steal_time_init():
Device attribute support check
Misaligned IPA rejection (EINVAL)
Duplicate IPA setting rejection (EEXIST)
- Move all tests to check_steal_time_uapi()
RISC-V:
- Add empty check_steal_time_uapi() stub for future use
- No changes to steal_time_init() (had no tests to extract)
The new check_steal_time_uapi() function:
- Is called once before the per-VCPU test loop
No functional change intended.
Suggested-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260303010859.1763177-3-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
Jiakai Xu [Tue, 3 Mar 2026 01:08:57 +0000 (01:08 +0000)]
RISC-V: KVM: Validate SBI STA shmem alignment in kvm_sbi_ext_sta_set_reg()
The RISC-V SBI Steal-Time Accounting (STA) extension requires the shared
memory physical address to be 64-byte aligned, or set to all-ones to
explicitly disable steal-time accounting.
KVM exposes the SBI STA shared memory configuration to userspace via
KVM_SET_ONE_REG. However, the current implementation of
kvm_sbi_ext_sta_set_reg() does not validate the alignment of the configured
shared memory address. As a result, userspace can install a misaligned
shared memory address that violates the SBI specification.
Such an invalid configuration may later reach runtime code paths that
assume a valid and properly aligned shared memory region. In particular,
KVM_RUN can trigger the following WARN_ON in
kvm_riscv_vcpu_record_steal_time():
WARNING: arch/riscv/kvm/vcpu_sbi_sta.c:49 at
kvm_riscv_vcpu_record_steal_time
WARN_ON paths are not expected to be reachable during normal runtime
execution, and may result in a kernel panic when panic_on_warn is enabled.
Fix this by validating the computed shared memory GPA at the
KVM_SET_ONE_REG boundary. A temporary GPA is constructed and checked
before committing it to vcpu->arch.sta.shmem. The validation allows
either a 64-byte aligned GPA or INVALID_GPA (all-ones), which disables
STA as defined by the SBI specification.
This prevents invalid userspace state from reaching runtime code paths
that assume SBI STA invariants and avoids unexpected WARN_ON behavior.
Fixes: f61ce890b1f074 ("RISC-V: KVM: Add support for SBI STA registers") Signed-off-by: Jiakai Xu <xujiakai2025@iscas.ac.cn> Signed-off-by: Jiakai Xu <jiakaiPeanut@gmail.com> Reviewed-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260303010859.1763177-2-xujiakai2025@iscas.ac.cn Signed-off-by: Anup Patel <anup@brainfault.org>
Alice Ryhl [Thu, 26 Mar 2026 15:25:37 +0000 (15:25 +0000)]
rust: drm: use new sync::aref path for imports
ARef and AlwaysRefCounted are being moved to sync::aref, and the
re-exports under types are planned to be removed. Thus, update imports
to the new path.
Alice Ryhl [Thu, 26 Mar 2026 15:25:36 +0000 (15:25 +0000)]
rust: workqueue: use new sync::aref path for imports
ARef and AlwaysRefCounted are being moved to sync::aref, and the
re-exports under types are planned to be removed. Thus, update imports
to the new path.
Abel Vesa [Mon, 23 Mar 2026 18:57:12 +0000 (20:57 +0200)]
clk: qcom: gcc-eliza: Enable FORCE_MEM_CORE_ON for UFS AXI PHY clock
According to internal documentation, the UFS AXI PHY clock requires
FORCE_MEM_CORE_ON to be enabled for UFS MCQ mode to work. Without this,
the UFS controller fails when operating in MCQ mode, which is already
enabled in the device tree.
The UFS PHY ICE core clock already has this bit set, so apply the same
configuration to the UFS PHY AXI clock.
Fixes: 3d356ab4a1ec ("clk: qcom: Add support for Global clock controller on Eliza") Reported-by: Nitin Rawat <nitin.rawat@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260323-eliza-gcc-set-ufs-axi-phyforce-mem-core-on-v1-1-b6b7a6f3f8c5@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
perf/arm-cmn: Fix resource_size_t printk specifier in arm_cmn_init_dtc()
When building for 32-bit ARM, there is a warning when using the %llx
specifier to print a resource_size_t variable:
drivers/perf/arm-cmn.c: In function 'arm_cmn_init_dtc':
drivers/perf/arm-cmn.c:2149:73: error: format '%llx' expects argument of type 'long long unsigned int', but argument 4 has type 'resource_size_t' {aka 'unsigned int'} [-Werror=format=]
2149 | "Failed to request DTC region 0x%llx\n", base);
| ~~~^ ~~~~
| | |
| | resource_size_t {aka unsigned int}
| long long unsigned int
| %x
Use the %pa specifier to handle the possible sizes of phys_addr_t
properly. This requires passing the variable by reference.
Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Robin murphy <robin.murphy@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
Chen Ni [Thu, 26 Mar 2026 09:08:56 +0000 (17:08 +0800)]
perf/arm-cmn: Fix incorrect error check for devm_ioremap()
Check devm_ioremap() return value for NULL instead of ERR_PTR and return
-ENOMEM on failure. devm_ioremap() never returns ERR_PTR, using IS_ERR()
skips the error path and may cause a NULL pointer dereference.
Fixes: 5394396ff548 ("perf/arm-cmn: Stop claiming entire iomem region") Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Signed-off-by: Will Deacon <will@kernel.org>
Linus Torvalds [Thu, 26 Mar 2026 15:22:07 +0000 (08:22 -0700)]
Merge tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux
Pull dma-mapping fixes from Marek Szyprowski:
"A set of fixes for DMA-mapping subsystem, which resolve false-
positive warnings from KMSAN and DMA-API debug (Shigeru Yoshida
and Leon Romanovsky) as well as a simple build fix (Miguel Ojeda)"
* tag 'dma-mapping-7.0-2026-03-25' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux:
dma-mapping: add missing `inline` for `dma_free_attrs`
mm/hmm: Indicate that HMM requires DMA coherency
RDMA/umem: Tell DMA mapping that UMEM requires coherency
iommu/dma: add support for DMA_ATTR_REQUIRE_COHERENT attribute
dma-direct: prevent SWIOTLB path when DMA_ATTR_REQUIRE_COHERENT is set
dma-mapping: Introduce DMA require coherency attribute
dma-mapping: Clarify valid conditions for CPU cache line overlap
dma-mapping: handle DMA_ATTR_CPU_CACHE_CLEAN in trace output
dma-debug: Allow multiple invocations of overlapping entries
dma: swiotlb: add KMSAN annotations to swiotlb_bounce()
Le Qi [Tue, 10 Feb 2026 02:40:37 +0000 (10:40 +0800)]
arm64: dts: qcom: hamoa-evk: Add DP0/DP1 audio playback support
The hamoa-evk DTS currently lacks DAI links for DP0 and DP1, preventing
the sound card from exposing these playback paths. Add the missing links
to enable audio output on both DP interfaces.
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Le Qi <le.qi@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260210024037.3719191-1-le.qi@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Icenowy Zheng [Sat, 21 Mar 2026 09:20:30 +0000 (17:20 +0800)]
irqchip/loongson-pch-lpc: Extract non-ACPI-related code from ACPI init
A lot of code can be shared between the existing ACPI init flow with the
upcoming OF init flow.
Extract it into a dedicated function.
The re-ordering of parent interrupt allocation requires the architecture
code to reserve legacy interrupts from the dynamic allocation by overriding
arch_dynirq_lower_bound(), otherwise the parent of LPC irqchip will be
allocated in the intended static range of LPC interrupts, which leads to
allocation failure of LPC interrupts.
Co-developed-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Link: https://patch.msgid.link/20260321092032.3502701-5-zhengxingda@iscas.ac.cn
Icenowy Zheng [Sat, 21 Mar 2026 09:20:28 +0000 (17:20 +0800)]
LoongArch: Override arch_dynirq_lower_bound to reserve LPC IRQs
Loongson 7A PCH chips all contain a LPC controller, which is used in
some devices to connect legacy ISA devices (e.g. 8259 PS/2 controller).
The LPC irqchip driver will register LPC interrupts at the fixed range
0~15, and the PCH PIC irqchip driver uses dynamic allocation. However the
LPC interrupt numbers are currently not exempted from dynamic allocation.
The current setup work by accident because the LPC interrupt controller is
the first consumer of PIC interrupt controller, and the PIC interrupt
number is allocated after LPC interrupts are registered. Such setup is
fragile and will stop to work when the LPC irqchip driver is reworked.
Override arch_dynirq_lower_bound() to reserve LPC interrupts from dynamic
allocation, to prevent interrupt number collision and allow rework of the
LPC irqchip driver.
Icenowy Zheng [Sat, 21 Mar 2026 09:20:27 +0000 (17:20 +0800)]
MIPS: loongson64: Override arch_dynirq_lower_bound to reserve LPC IRQs
On some Loongson 3A devices, a LPC bus is present and some legacy devices
(e.g. 8259) on it expect hardcoded low interrupt numbers. However currently
the expected low range interrupt numbers are not exempted from the dynamic
allocation, which leads to conflicts when registering LPC interrupts in the
fixed range.
Override arch_dynirq_lower_bound() to reserve these low range interrupt
numbers and prevent them from being dynamically allocated.
Hao-Yu Yang [Fri, 13 Mar 2026 12:47:56 +0000 (20:47 +0800)]
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().
This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
Peter Zijlstra [Thu, 26 Mar 2026 12:35:53 +0000 (13:35 +0100)]
futex: Require sys_futex_requeue() to have identical flags
Nicholas reported that his LLM found it was possible to create a UaF
when sys_futex_requeue() is used with different flags. The initial
motivation for allowing different flags was the variable sized futex,
but since that hasn't been merged (yet), simply mandate the flags are
identical, as is the case for the old style sys_futex() requeue
operations.
Fixes: 0f4b5f972216 ("futex: Add sys_futex_requeue()") Reported-by: Nicholas Carlini <npc@anthropic.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:19 +0000 (14:17 +0100)]
KVM: s390: Fix KVM_S390_VCPU_FAULT ioctl
A previous commit changed the behaviour of the KVM_S390_VCPU_FAULT
ioctl. The current (wrong) implementation will trigger a guest
addressing exception if the requested address lies outside of a
memslot, unless the VM is UCONTROL.
Restore the previous behaviour by open coding the fault-in logic.
Fixes: 3762e905ec2e ("KVM: s390: use __kvm_faultin_pfn()") Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:18 +0000 (14:17 +0100)]
KVM: s390: vsie: Fix guest page tables protection
When shadowing, the guest page tables are write-protected, in order to
trap changes and properly unshadow the shadow mapping for the nested
guest. Already shadowed levels are skipped, so that only the needed
levels are write protected.
Currently the levels that get write protected are exactly one level too
deep: the last level (nested guest memory) gets protected in the wrong
way, and will be protected again correctly a few lines afterwards; most
importantly, the highest non-shadowed level does *not* get write
protected.
Moreover, if the nested guest is running in a real address space, there
are no DAT tables to shadow.
Write protect the correct levels, so that all the levels that need to
be protected are protected, and avoid double protecting the last level;
skip attempting to shadow the DAT tables when the nested guest is
running in a real address space.
Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Tested-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:17 +0000 (14:17 +0100)]
KVM: s390: vsie: Fix unshadowing while shadowing
If shadowing causes the shadow gmap to get unshadowed, exit early to
prevent an attempt to dereference the parent pointer, which at this
point is NULL.
Opportunistically add some more checks to prevent NULL parents.
Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Fixes: e5f98a6899bd ("KVM: s390: Add some helper functions needed for vSIE") Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:14 +0000 (14:17 +0100)]
KVM: s390: Correctly handle guest mappings without struct page
Introduce a new special softbit for large pages, like already presend
for normal pages, and use it to mark guest mappings that do not have
struct pages.
Whenever a leaf DAT entry becomes dirty, check the special softbit and
only call SetPageDirty() if there is an actual struct page.
Move the logic to mark pages dirty inside _gmap_ptep_xchg() and
_gmap_crstep_xchg_atomic(), to avoid needlessly duplicating the code.
Fixes: 5a74e3d93417 ("KVM: s390: KVM-specific bitfields and helper functions") Fixes: a2c17f9270cc ("KVM: s390: New gmap code") Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:13 +0000 (14:17 +0100)]
KVM: s390: Fix gmap_link()
The slow path of the fault handler ultimately called gmap_link(), which
assumed the fault was a major fault, and blindly called dat_link().
In case of minor faults, things were not always handled properly; in
particular the prefix and vsie marker bits were ignored.
Move dat_link() into gmap.c, renaming it accordingly. Once moved, the
new _gmap_link() function will be able to correctly honour the prefix
and vsie markers.
This will cause spurious unshadows in some uncommon cases.
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:12 +0000 (14:17 +0100)]
KVM: s390: vsie: Fix check for pre-existing shadow mapping
When shadowing a nested guest, a check is performed and no shadowing is
attempted if the nested guest is already shadowed.
The existing check was incomplete; fix it by also checking whether the
leaf DAT table entry in the existing shadow gmap has the same protection
as the one specified in the guest DAT entry.
Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Biju Das [Mon, 23 Mar 2026 12:49:14 +0000 (12:49 +0000)]
irqchip/renesas-rzv2h: Fix error path in rzv2h_icu_probe_common()
Replace pm_runtime_put() with pm_runtime_put_sync() when
irq_domain_create_hierarchy() fails to ensure the device suspends
synchronously before devres cleanup disables runtime PM via
pm_runtime_disable().
Claudio Imbrenda [Thu, 26 Mar 2026 13:17:10 +0000 (14:17 +0100)]
KVM: s390: vsie: Fix dat_split_ste()
If the guest misbehaves and puts the page tables for its nested guest
inside the memory of the nested guest itself, and the guest and nested
guest are being mapped with large pages, the shadow mapping will
lose synchronization with the actual mapping, since this will cause the
large page with the vsie notification bit to be split, but the
vsie notification bit will not be propagated to the resulting small
pages.
Fix this by propagating the vsie_notif bit from large pages to normal
pages when splitting a large page.
The mbox_client for qcom-mpm sends NULL doorbell messages via
mbox_send_message() but never signals TX completion.
Set knows_txdone=true and call mbox_client_txdone() after a successful
send, matching the pattern used by other Qualcomm mailbox clients (smp2p,
smsm, qcom_aoss etc).
Fixes: a6199bb514d8a6 "irqchip: Add Qualcomm MPM controller driver" Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Douglas Anderson <dianders@chromium.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260322171533.608436-1-jassisinghbrar@gmail.com
Nate DeSimone [Tue, 24 Mar 2026 23:14:54 +0000 (16:14 -0700)]
ACPI: FPDT: expose FBPT and S3PT subtables via sysfs
Add sysfs files at /sys/firmware/acpi/fpdt/FBPT and
/sys/firmware/acpi/fpdt/S3PT that expose the raw contents of the
FPDT subtables.
Note that /sys/firmware/acpi/tables/FPDT only provides the top level
table, not the subtables. Adding access to the subtables enables a
usage model similar to /sys/firmware/dmi/tables/DMI, allowing
userspace tools to interpret newer record types (e.g. String Event
Records, Microcontroller Boot Performance Data Records, etc.) defined
in recent ACPI specifications [1] without requiring kernel changes.
Thomas Weißschuh [Thu, 26 Mar 2026 11:42:31 +0000 (12:42 +0100)]
timens: Remove dependency on the vDSO
Previously, missing time namespace support in the vDSO meant that time
namespaces needed to be disabled globally. This was expressed in a hard
dependency on the generic vDSO library. This also meant that architectures
without any vDSO or only a stub vDSO could not enable time namespaces.
Now that all architectures using a real vDSO are using the generic library,
that dependency is not necessary anymore.
Remove the dependency and let all architectures enable time namespaces.
Abel Vesa [Tue, 24 Mar 2026 15:29:43 +0000 (17:29 +0200)]
arm64: dts: qcom: eliza: Add missing msi-parent for UFS
Wire up the UFS controller to the GIC ITS by specifying the
msi-parent property. The UFS host uses MSI and requires a valid
ITS mapping in order to allocate and receive interrupts.
Add the ITS reference along with the device ID to match the SMMU
stream ID.
Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-3-3a4a03e72f8f@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Abel Vesa [Tue, 24 Mar 2026 15:29:42 +0000 (17:29 +0200)]
arm64: dts: qcom: eliza: Add missing CX power domain to GCC
Unless CX is declared the power-domain of GCC votes (power and
performance) on the GDSCs provided by GCC will not propagate to the CX,
which might result in under-voltage conditions.
Add the missing power-domains property to associate GCC with RPMHPD_CX.
Fixes: db7fe6963466 ("arm64: dts: qcom: Introduce Eliza Soc base dtsi") Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260324-eliza-base-dt-fixes-v3-2-3a4a03e72f8f@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Dmitry Baryshkov [Fri, 20 Mar 2026 02:51:00 +0000 (04:51 +0200)]
arm64: dts: qcom: patch mahua thermal zones by label
Updating DT nodes by the full path is fragile and frowned upon, it's
easy to miss the rename of the node in the main tree. Add necessary
labels and patch thermal zones for Mahua using those labels.
Dmitry Baryshkov [Fri, 20 Mar 2026 02:33:15 +0000 (04:33 +0200)]
arm64: dts: qcom: purwa: deduplicate thermal sensors with Hamoa
Hamoa and Purwa have pretty close thermal zones definitions. The major
difference is that several zones are absent (because of the lack of the
CPU cluster) and several zones use tsens2 instead of tsens3.
Instead of completely duplicating thermal zones for Purwa, reuse themal
zones from Hamoa, patching them where required.
arm64: dts: qcom: sm8750: Enable TSENS and thermal zones
The sm8750 includes four TSENS instances, with a total of 47 thermal
sensors distributed across various locations on the SoC.
The TSENS max/reset threshold is configured to 130°C in the hardware.
Enable all TSENS instances, and define the thermal zones with a hot trip
at 120°C and critical trip at 125°C.
Fix GIC_SPI interrupt numbers for QUPv3 SE6 nodes on Lemans SoC.
Using incorrect interrupt lines can prevent IRQs from triggering
and break I2C, SPI, and UART operation.
arm64: dts: qcom: qrb5165-rb5: Drop redundant non-controllable supplies
Drop completely redundant non-controllable chain of "regulator-fixed"
supplies, which serve no purpose except growing DTS and kernel boot
time. They represent no added value and because of being completely
transparent for any users of DTS (except the bloat), they should not be
represented in DTS, just like we do not represent every transistor
there.
For the few regulators being actively used and supplied by removed
dummies, change the supply to match the actual final source without
these dummy intermediaries.
arm64: dts: qcom: qrb4210-rb2: Drop redundant non-controllable supplies
Drop completely redundant non-controllable chain of "regulator-fixed"
supplies, which serve no purpose except growing DTS and kernel boot
time. They represent no added value and because of being completely
transparent for any users of DTS (except the bloat), they should not be
represented in DTS, just like we do not represent every transistor
there.
arm64: dts: qcom: qrb2210-rb1: Drop redundant non-controllable supplies
Drop completely redundant non-controllable chain of "regulator-fixed"
supplies, which serve no purpose except growing DTS and kernel boot
time. They represent no added value and because of being completely
transparent for any users of DTS (except the bloat), they should not be
represented in DTS, just like we do not represent every transistor
there.
arm64: dts: qcom: qcs615-ride: Drop redundant non-controllable supplies
Drop completely redundant non-controllable chain of "regulator-fixed"
supplies, which serve no purpose except growing DTS and kernel boot
time. They represent no added value and because of being completely
transparent for any users of DTS (except the bloat), they should not be
represented in DTS, just like we do not represent every transistor
there.
arm64: dts: qcom: lemans-ride: Drop redundant non-controllable supplies
Drop completely redundant non-controllable chain of "regulator-fixed"
supplies, which serve no purpose except growing DTS and kernel boot
time. They represent no added value and because of being completely
transparent for any users of DTS (except the bloat), they should not be
represented in DTS, just like we do not represent every transistor
there.
Md Sadre Alam [Fri, 6 Mar 2026 11:39:39 +0000 (17:09 +0530)]
arm64: dts: qcom: ipq5424-rdp466: Enable QPIC SPI NAND support
Enable QPIC SPI NAND flash controller support on the IPQ5424 RDP466
reference design platform.
The RDP466 board features a SPI NAND flash device connected to the QPIC
controller for primary storage. This patch enables the QPIC BAM DMA
controller and SPI NAND interface of QPIC, and configures the necessary
pin control settings for proper operation.
Md Sadre Alam [Fri, 6 Mar 2026 11:39:38 +0000 (17:09 +0530)]
arm64: dts: qcom: ipq5332: Add QPIC SPI NAND controller support
Add device tree nodes for QPIC SPI NAND flash controller support
on IPQ5332 SoC.
The IPQ5332 SoC includes a QPIC controller that supports SPI NAND flash
devices with hardware ECC capabilities and DMA support through BAM
(Bus Access Manager).
Md Sadre Alam [Fri, 6 Mar 2026 11:39:37 +0000 (17:09 +0530)]
arm64: dts: qcom: ipq5424: Add QPIC SPI NAND controller support
Add device tree nodes for QPIC SPI NAND flash controller support
on IPQ5424 SoC.
The IPQ5424 SoC includes a QPIC controller that supports SPI NAND flash
devices with hardware ECC capabilities and DMA support through BAM
(Bus Access Manager).
Enable PCA9538 expander as interrupt controller on Lemans EVK and configure
the corresponding TLMM pins via pinctrl to operate as GPIO inputs with
internal pull-ups.
Umang Chheda [Wed, 4 Mar 2026 16:59:25 +0000 (22:29 +0530)]
arm64: dts: qcom: lemans-evk: Add IFP Mezzanine
The Interface Plus [IFP] Mezzanine is an hardware expansion add-on
board designed to be stacked on top of Lemans EVK.
It has following peripherals :
- 4x Type A USB ports in host mode.
- TC9563 PCIe switch, which has following three downstream ports (DSP) :
- 1st DSP is routed to an M.2 E-key connector, intended for
WLAN modules.
- 2nd DSP is routed to an M.2 B-key connector, intended for
cellular modems.
- 3rd DSP with support for Dual Ethernet ports.
- eMMC.
- Additional 2.5GbE Ethernet PHY connected to native EMAC with support for
MAC Address configuration via NVMEM.
- EEPROM.
- LVDS Display.
- 2*mini DP.
Add support for following peripherals :
- TC9563 PCIe Switch.
- Additional 2.5GbE Ethernet Port.
- EEPROM.
Enable support for USB hub, LVDS display and mini-DP later once
dependent changes are available in lemans-evk core-kit.
Written with inputs from :
Mohd Ayaan Anwar <mohd.anwar@oss.qualcomm.com> - Ethernet.
Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> - PCIe
Monish Chunara <monish.chunara@oss.qualcomm.com> - EEPROM.
Umang Chheda [Tue, 3 Mar 2026 16:43:14 +0000 (22:13 +0530)]
arm64: dts: qcom: monaco-evk: Add IFP Mezzanine
The IFP Mezzanine is an hardware expansion add-on board designed
to be stacked on top of Monaco EVK.
It has following peripherals :
- 4x Type A USB ports in host mode.
- TC9563 PCIe switch, which has following three downstream ports (DSP) :
- 1st DSP is routed to an M.2 E-Key connector, intended for
WLAN modules.
- 2nd DSP is routed to an M.2 B-key connector, intended for
cellular modems.
- 3rd DSP with support for Dual Ethernet ports.
- EEPROM.
- LVDS Display.
- 2*mini DP.
Add support for following peripherals :
- TC9563 PCIe Switch.
- EEPROM.
Enable support for USB hub, LVDS display and mini-DP later once dependent
changes are available in monaco-evk core-kit.
Written with inputs from :
Krishna Chaitanya Chundru <krishna.chundru@oss.qualcomm.com> - PCIe
Monish Chunara <monish.chunara@oss.qualcomm.com> - EEPROM.
Iris driver doesn't support non-PAS/TZ setup for setting up the Iris
core. It's expected that the ABI that is going to be used in a long-term
would be different from the defined venus-firmware subnode.
Granted that the SC7280 Chromebooks were cancelled before reaching wide
audience and granted the feature ABI changes, drop venus configuration
for SC7280 ChromeOS devices.
Suggested-by: Stephan Gerhold <stephan.gerhold@linaro.org> Cc: Douglas Anderson <dianders@chromium.org> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Acked-by: Douglas Anderson <dianders@chromium.org> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260131-venus-iris-flip-switch-v4-1-e10b886771e1@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
projects / thirdparty / kernel / stable.git / log
