- Mark the Meson GPIO controller as sleeping to avoid a
context splat.
- Fix up the I2S2 and SWR TX group settings in the
Qualcomm SM8350 LPASS pin controller, and implement the
proper .get_direction() callback.
- Fix a pin typo in the TG1520 pin controller.
- Fix a group name in the Marvell armada 3710 XB pin
controller that got mangled in a DT schema rewrite.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElDRnuGcz/wPCXQWMQRCzN7AZXXMFAml5wogACgkQQRCzN7AZ
XXOiBg//RL9rLkA1THGTHbFGyIWtK5YO/xb2wnQ1xTbjimutC3Ud5ttLFxaW3uRM
21NFHNVYwM81Uj+OWdtWUyZQoVwaOyiZ570I0f2p2duFc7uVo0Q2a3HVXwr/8yJ7
j4MpXCBW069CprEZJd1FqSqMS9N+SawPXu3frxTcGrLlW8TXc3BeC9bSic83cBMW
WrHdaXddDFMR3ETU2FDA4bV33tupXCmdOsXFDuyxKtDO0HjFiepKzH93/UIRfwpi
YcPtHY6/EZlYe0B3Fjs2XqkMNzmoIse0+anmvQtgOR32cJJVku944xyaF96eKp1E
Nwg+htWLjksk1a5IKQqm381dmFX/xuSPGk1xctoXxcdtb4N2JLQLpLuxbs1qODJI
4asjHre+KGDiKbG7cbiLA9KQ5GKBOrIea49hIDoabYBqoQnPo+o8eHXJz2mcFewO
kdGFszdQztvFJLzs4Z60HZzzA1gw83E3pFys2V2pJRtZdiM5tMQKrbCxE8DT4+Ii
HxPGEmm1CvGuAQ4Wz+rwMoy+ats5PWgigJ2zuUPmhcgLmOFGkyVz0anKV55OalJ/
RZhbaqqSVvA/tCfisQr7g4LTJ+s2VNeoUE6e8rZIDqQcScdCAQCrJ8psFL1yuTZp
pFo1sOumjfAqiy7jP5NJMyKjiqMckywEv5T813P9UBKkEVqUEUg=
=P63k
-----END PGP SIGNATURE-----
Merge tag 'pinctrl-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl
Pull pin control fixes from Linus Walleij:
- Mark the Meson GPIO controller as sleeping to avoid a
context splat
- Fix up the I2S2 and SWR TX group settings in the
Qualcomm SM8350 LPASS pin controller, and implement the
proper .get_direction() callback
- Fix a pin typo in the TG1520 pin controller
- Fix a group name in the Marvell armada 3710 XB pin
controller that got mangled in a DT schema rewrite
* tag 'pinctrl-v6.19-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
dt-bindings: pinctrl: marvell,armada3710-xb-pinctrl: fix 'usb32_drvvbus0' group name
pinctrl: lpass-lpi: implement .get_direction() for the GPIO driver
pinctrl: th1520: Fix typo
pinctrl: qcom: sm8350-lpass-lpi: Merge with SC7280 to fix I2S2 and SWR TX pins
pinctrl: meson: mark the GPIO controller as sleeping
- Ensure early return semantics are preserved for pKVM fault handlers
- Fix case where the kernel runs with the guest's PAN value when
CONFIG_ARM64_PAN is not set
- Make stage-1 walks to set the access flag respect the access
permission of the underlying stage-2, when enabled
- Propagate computed FGT values to the pKVM view of the vCPU at
vcpu_load()
- Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
tables
- Check that the VM is actually using VGICv3 before accessing the GICv3
CPU interface
- Delete some unused code
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAml0eFAUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroP+6Qf/QyjSaQHurVqfigKoj4XI9QsF2IoD
m4anhrLyzkcE1vMShHkaw6Xx7GjZcrbCqZ5L1qY94B4yUdIaFGR5hkGYPX4OXqrn
XP6Oq5lO+1iOzxfOQ+7gZVBYBIHt6OBjFpBRxv9AtRHuin1GkxEmh7g5oPsy/zT6
8IHCtf85mnJXZNDGwVuzII1QXj4CnYwCL37lzNTo+bzf9os7Xtn1RSj3p2OoMKsM
IKzF2oevMblj3r+L4pOQLXkc22S5OF3nkti+Q6uu2nBoiZ9ivWOTHxjkYU5QAXwm
tyRkEMHuV5zNGIaAhRDe+0wxx0iD5DTJQfioE+z8vfLASqZ8nmY5DRyaQw==
=+Y93
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull arm64 kvm fixes from Paolo Bonzini:
- Ensure early return semantics are preserved for pKVM fault handlers
- Fix case where the kernel runs with the guest's PAN value when
CONFIG_ARM64_PAN is not set
- Make stage-1 walks to set the access flag respect the access
permission of the underlying stage-2, when enabled
- Propagate computed FGT values to the pKVM view of the vCPU at
vcpu_load()
- Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
tables
- Check that the VM is actually using VGICv3 before accessing the GICv3
CPU interface
- Delete some unused code
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: arm64: Invert KVM_PGTABLE_WALK_HANDLE_FAULT to fix pKVM walkers
KVM: arm64: Don't blindly set set PSTATE.PAN on guest exit
KVM: arm64: nv: Respect stage-2 write permssion when setting stage-1 AF
KVM: arm64: Remove unused vcpu_{clear,set}_wfx_traps()
KVM: arm64: Remove unused parameter in synchronize_vcpu_pstate()
KVM: arm64: Remove extra argument for __pvkm_host_{share,unshare}_hyp()
KVM: arm64: Inject UNDEF for a register trap without accessor
KVM: arm64: Copy FGT traps to unprotected pKVM VCPU on VCPU load
KVM: arm64: Fix EL2 S1 XN handling for hVHE setups
KVM: arm64: gic: Check for vGICv3 when clearing TWI
- Ensure early return semantics are preserved for pKVM fault handlers
- Fix case where the kernel runs with the guest's PAN value when
CONFIG_ARM64_PAN is not set
- Make stage-1 walks to set the access flag respect the access
permission of the underlying stage-2, when enabled
- Propagate computed FGT values to the pKVM view of the vCPU at
vcpu_load()
- Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
tables
- Check that the VM is actually using VGICv3 before accessing the GICv3
CPU interface
- Delete some unused code
-----BEGIN PGP SIGNATURE-----
iI0EABYKADUWIQSNXHjWXuzMZutrKNKivnWIJHzdFgUCaWiyJBccb2xpdmVyLnVw
dG9uQGxpbnV4LmRldgAKCRCivnWIJHzdFqVhAQDM4Lbrq0F80X+YzvO7oxWioOy4
JiTATSii9Lit8KY6fgEAvLD4qaggLdF3+WY+V37YmTj3UDgI31ClBr+xSvSengA=
=XaL0
-----END PGP SIGNATURE-----
Merge tag 'kvmarm-fixes-6.19-1' of https://git.kernel.org/pub/scm/linux/kernel/git/kvmarm/kvmarm into HEAD
KVM/arm64 fixes for 6.19
- Ensure early return semantics are preserved for pKVM fault handlers
- Fix case where the kernel runs with the guest's PAN value when
CONFIG_ARM64_PAN is not set
- Make stage-1 walks to set the access flag respect the access
permission of the underlying stage-2, when enabled
- Propagate computed FGT values to the pKVM view of the vCPU at
vcpu_load()
- Correctly program PXN and UXN privilege bits for hVHE's stage-1 page
tables
- Check that the VM is actually using VGICv3 before accessing the GICv3
CPU interface
- Delete some unused code
- A set of fixes for FPSIMD/SVE/SME state management (around signal
handling and ptrace) where a task can be placed in an invalid state
- __nocfi added to swsusp_arch_resume() to avoid a data abort on
resuming from hibernate
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlzvVUACgkQa9axLQDI
XvFWZQ/8DUqOm0tHQMi/kgh82T7Iv1GslfPhlSfgWftbDIqiOlJqo4eCa+p1YrSZ
uwXBF4B4d1KpSr+46ScbLUPjdlla9zpXM7AXQzSY7xAP0+dNKAWzyRlh1ZpUz0KY
VrgOdrqN90H6EuZ1VC+9nGAT/AuiLLvBc5cSETVAJAKvZ+zVE/1VeJ6AnDndOamD
dlPYyolyG8RgP9tHxcIsuHQ4y/CoKmTgSEM5l9A5STwigzTspdk1hKJUuhfocklZ
PXvCD3rRe0Skaokl9hHxpGa7mS+YPWrGMI3zSkGarBgwYcFGOJ2g9zIPElT6r8a9
t5reRhuZad6UeE4zdv6VWrjTJxQO7iGoMfQoxqtmoqdkM8/49eWBE/xCEHp4J1+H
X3DPEbHl1sGYBLHFZEGWBCw2H3vI3Whxx0frv3ysrB4agzdPD5VZpUhgq+/c7QXA
mySddycGv0upBygahW7ORWt8mVwEjheJnz+jm37gfUEvt9tvXcoZW/zxW0kpyw0u
fYGuizmVR3ysmrCpG2Awkrt46tTn2kyv4VWhTLeULIgcgTHNBq0idNS3+ZNH3ElM
EiKgWXlI39LZKlX+p/yg2TQz/vDtqgGLKsSQg9zF+62FP7vpCVz1cgaX2czAcYXY
0Yx4mx8fp15JWBLd6epHeTAWcRQATnhVwoSrn9+HzOVFebPACno=
=8SiM
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
- A set of fixes for FPSIMD/SVE/SME state management (around signal
handling and ptrace) where a task can be placed in an invalid state
- __nocfi added to swsusp_arch_resume() to avoid a data abort on
resuming from hibernate
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: Set __nocfi on swsusp_arch_resume()
arm64/fpsimd: signal: Fix restoration of SVE context
arm64/fpsimd: signal: Allocate SSVE storage when restoring ZA
arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
When SME is supported, Restoring SVE signal context can go wrong in a
few ways, including placing the task into an invalid state where the
kernel may read from out-of-bounds memory (and may potentially take a
fatal fault) and/or may kill the task with a SIGKILL.
(1) Restoring a context with SVE_SIG_FLAG_SM set can place the task into
an invalid state where SVCR.SM is set (and sve_state is non-NULL)
but TIF_SME is clear, consequently resuting in out-of-bounds memory
reads and/or killing the task with SIGKILL.
This can only occur in unusual (but legitimate) cases where the SVE
signal context has either been modified by userspace or was saved in
the context of another task (e.g. as with CRIU), as otherwise the
presence of an SVE signal context with SVE_SIG_FLAG_SM implies that
TIF_SME is already set.
While in this state, task_fpsimd_load() will NOT configure SMCR_ELx
(leaving some arbitrary value configured in hardware) before
restoring SVCR and attempting to restore the streaming mode SVE
registers from memory via sve_load_state(). As the value of
SMCR_ELx.LEN may be larger than the task's streaming SVE vector
length, this may read memory outside of the task's allocated
sve_state, reading unrelated data and/or triggering a fault.
While this can result in secrets being loaded into streaming SVE
registers, these values are never exposed. As TIF_SME is clear,
fpsimd_bind_task_to_cpu() will configure CPACR_ELx.SMEN to trap EL0
accesses to streaming mode SVE registers, so these cannot be
accessed directly at EL0. As fpsimd_save_user_state() verifies the
live vector length before saving (S)SVE state to memory, no secret
values can be saved back to memory (and hence cannot be observed via
ptrace, signals, etc).
When the live vector length doesn't match the expected vector length
for the task, fpsimd_save_user_state() will send a fatal SIGKILL
signal to the task. Hence the task may be killed after executing
userspace for some period of time.
(2) Restoring a context with SVE_SIG_FLAG_SM clear does not clear the
task's SVCR.SM. If SVCR.SM was set prior to restoring the context,
then the task will be left in streaming mode unexpectedly, and some
register state will be combined inconsistently, though the task will
be left in legitimate state from the kernel's PoV.
This can only occur in unusual (but legitimate) cases where ptrace
has been used to set SVCR.SM after entry to the sigreturn syscall,
as syscall entry clears SVCR.SM.
In these cases, the the provided SVE register data will be loaded
into the task's sve_state using the non-streaming SVE vector length
and the FPSIMD registers will be merged into this using the
streaming SVE vector length.
Fix (1) by setting TIF_SME when setting SVCR.SM. This also requires
ensuring that the task's sme_state has been allocated, but as this could
contain live ZA state, it should not be zeroed. Fix (2) by clearing
SVCR.SM when restoring a SVE signal context with SVE_SIG_FLAG_SM clear.
For consistency, I've pulled the manipulation of SVCR, TIF_SVE, TIF_SME,
and fp_type earlier, immediately after the allocation of
sve_state/sme_state, before the restore of the actual register state.
This makes it easier to ensure that these are always modified
consistently, even if a fault is taken while reading the register data
from the signal context. I do not expect any software to depend on the
exact state restored when a fault is taken while reading the context.
Fixes: 85ed24dad2 ("arm64/sme: Implement streaming SVE signal handling")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The code to restore a ZA context doesn't attempt to allocate the task's
sve_state before setting TIF_SME. Consequently, restoring a ZA context
can place a task into an invalid state where TIF_SME is set but the
task's sve_state is NULL.
In legitimate but uncommon cases where the ZA signal context was NOT
created by the kernel in the context of the same task (e.g. if the task
is saved/restored with something like CRIU), we have no guarantee that
sve_state had been allocated previously. In these cases, userspace can
enter streaming mode without trapping while sve_state is NULL, causing a
later NULL pointer dereference when the kernel attempts to store the
register state:
| # ./sigreturn-za
| Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
| Mem abort info:
| ESR = 0x0000000096000046
| EC = 0x25: DABT (current EL), IL = 32 bits
| SET = 0, FnV = 0
| EA = 0, S1PTW = 0
| FSC = 0x06: level 2 translation fault
| Data abort info:
| ISV = 0, ISS = 0x00000046, ISS2 = 0x00000000
| CM = 0, WnR = 1, TnD = 0, TagAccess = 0
| GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
| user pgtable: 4k pages, 52-bit VAs, pgdp=0000000101f47c00
| [0000000000000000] pgd=08000001021d8403, p4d=0800000102274403, pud=0800000102275403, pmd=0000000000000000
| Internal error: Oops: 0000000096000046 [#1] SMP
| Modules linked in:
| CPU: 0 UID: 0 PID: 153 Comm: sigreturn-za Not tainted 6.19.0-rc1 #1 PREEMPT
| Hardware name: linux,dummy-virt (DT)
| pstate: 214000c9 (nzCv daIF +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
| pc : sve_save_state+0x4/0xf0
| lr : fpsimd_save_user_state+0xb0/0x1c0
| sp : ffff80008070bcc0
| x29: ffff80008070bcc0 x28: fff00000c1ca4c40 x27: 63cfa172fb5cf658
| x26: fff00000c1ca5228 x25: 0000000000000000 x24: 0000000000000000
| x23: 0000000000000000 x22: fff00000c1ca4c40 x21: fff00000c1ca4c40
| x20: 0000000000000020 x19: fff00000ff6900f0 x18: 0000000000000000
| x17: fff05e8e0311f000 x16: 0000000000000000 x15: 028fca8f3bdaf21c
| x14: 0000000000000212 x13: fff00000c0209f10 x12: 0000000000000020
| x11: 0000000000200b20 x10: 0000000000000000 x9 : fff00000ff69dcc0
| x8 : 00000000000003f2 x7 : 0000000000000001 x6 : fff00000c1ca5b48
| x5 : fff05e8e0311f000 x4 : 0000000008000000 x3 : 0000000000000000
| x2 : 0000000000000001 x1 : fff00000c1ca5970 x0 : 0000000000000440
| Call trace:
| sve_save_state+0x4/0xf0 (P)
| fpsimd_thread_switch+0x48/0x198
| __switch_to+0x20/0x1c0
| __schedule+0x36c/0xce0
| schedule+0x34/0x11c
| exit_to_user_mode_loop+0x124/0x188
| el0_interrupt+0xc8/0xd8
| __el0_irq_handler_common+0x18/0x24
| el0t_64_irq_handler+0x10/0x1c
| el0t_64_irq+0x198/0x19c
| Code: 54000040 d51b4408 d65f03c0 d503245f (e5bb5800)
| ---[ end trace 0000000000000000 ]---
Fix this by having restore_za_context() ensure that the task's sve_state
is allocated, matching what we do when taking an SME trap. Any live
SVE/SSVE state (which is restored earlier from a separate signal
context) must be preserved, and hence this is not zeroed.
Fixes: 39782210eb ("arm64/sme: Implement ZA signal handling")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
When SVE is supported but SME is not supported, a ptrace write to the
NT_ARM_SVE regset can place the tracee into an invalid state where
(non-streaming) SVE register data is stored in FP_STATE_SVE format but
TIF_SVE is clear. This can result in a later warning from
fpsimd_restore_current_state(), e.g.
WARNING: CPU: 0 PID: 7214 at arch/arm64/kernel/fpsimd.c:383 fpsimd_restore_current_state+0x50c/0x748
When this happens, fpsimd_restore_current_state() will set TIF_SVE,
placing the task into the correct state. This occurs before any other
check of TIF_SVE can possibly occur, as other checks of TIF_SVE only
happen while the FPSIMD/SVE/SME state is live. Thus, aside from the
warning, there is no functional issue.
This bug was introduced during rework to error handling in commit:
9f8bf718f2 ("arm64/fpsimd: ptrace: Gracefully handle errors")
... where the setting of TIF_SVE was moved into a block which is only
executed when system_supports_sme() is true.
Fix this by removing the system_supports_sme() check. This ensures that
TIF_SVE is set for (SVE-formatted) writes to NT_ARM_SVE, at the cost of
unconditionally manipulating the tracee's saved svcr value. The
manipulation of svcr is benign and inexpensive, and we already do
similar elsewhere (e.g. during signal handling), so I don't think it's
worth guarding this with system_supports_sme() checks.
Aside from the above, there is no functional change. The 'type' argument
to sve_set_common() is only set to ARM64_VEC_SME (in ssve_set())) when
system_supports_sme(), so the ARM64_VEC_SME case in the switch statement
is still unreachable when !system_supports_sme(). When
CONFIG_ARM64_SME=n, the only caller of sve_set_common() is sve_set(),
and the compiler can constant-fold for the case where type is
ARM64_VEC_SVE, removing the logic for other cases.
Reported-by: syzbot+d4ab35af21e99d07ce67@syzkaller.appspotmail.com
Fixes: 9f8bf718f2 ("arm64/fpsimd: ptrace: Gracefully handle errors")
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: <stable@vger.kernel.org>
Cc: Mark Brown <broonie@kernel.org>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Add missing power-domains to the SC8280XP RPM power-domain and ensure
these are voted for from the remoteproc instances while powering them
up.
Clear a couple of DeviceTree validation warnings in SM8550 and SM8650
USB controller nodes.
Specify the correct display panel on the OnePlus 6.
Correct the UFS clock mapping on Talos, to ensure UFS is properly
clocked.
Add Abel's old emails address to .mailmap.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmluVH0ACgkQCx85Pw2Z
rcWJIxAAywFqiEYYvtFVm8Kn9yM7gZH1xhcQKKOpGtK+I/fSLurgsYgaFIB6pnEk
Zfo8mUtJUUxyjq25sI3b2fjcx9L92HpH91UZNWXHxvJaMNtOdLxy5uJOKVGD0D3q
IiVmhuk/zzeLuTvWL2KxyodQWagmu6YcMBeQCQpW9Wt6IRcbVs4f3Lpv8GkSG8Ex
EXgozt2mMDCzBZAL+Nui9UvTZaSO/0NCAbYxq/VRah6uAaUJhYcTY1cp54ylTHcG
N1k7luZwEcBZgY2oVpsQYhwJYtlL9ccjy14CxR3F2XhsPhMj1xHMt2TYqlUbONZx
Yr77wDJ8uX2xhUqRbUnYN/lOm8G8GX/lj0Vqf/QdorLGhv0UIbmHByCLnQm2ea0o
ufyGBbeA+On5F9MRAvbvAomGmEktuuwnyOtT/asMdR21/Rf/JVfIPlPc13dXO7+c
v01/g8aaHAijxfAr6hEKyQEb4M02t0LExbNoJt22l/dwChrH0nHagQ2vUaSzNswn
gQRoN9CZYDAlJUhRRVzUkiXyenIthlnbehBXxxbPyJk6ITYh0bfkS74vEce17aFw
CGacW2e7bkwSP9V1pjZprPp1MiOS+KLLQt70LXT1FXBqnwjrxGnL/Q8Hnq466nFU
AcRmP7Clnev9+7IG/6RNe6Qg/r7LvTODp8/1+RRWu4pp/O5dSH8=
=ztcO
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlwk8QACgkQmmx57+YA
GNm57RAAwsvs5kINIUFFMC2B9usx+sd3cq1/psAXl3AhkpI7rrqIKA8lieReLGeW
we2kAepIFu4X1NaFU3iguvekszHuALDl+c99SDXIdn3nsEMew8tkz/SmFfMU0qPV
FEg3zeqCl5tI4cnJQ21D33QweZd7MPZYfMCENGGT7Tjap4U8rTT9r7BECdooWUXH
O+u+XWxqD1vqUBWNyuBE1gAQJ94DdcFodfCWMC8qSgYKtAd4aVAdWktlyQelYGi9
1m38JXQ82cJ4+srEi4bWluLKrChwh3UWthwCvA70fDvPr/urAkb35KAtxWIYl6tQ
/XESAmsz+7eO8WyCIIFo8QdHnrfHH1bnwv6et0NKh5bsQxVSSMyYvFkYITeLpfn2
bB7oMIbci73sEmkGwTivR8cHcB3gV156SZleoVgw2DGuIdpjGR5GXxkvTFNpP9wM
sKQcwArqrQHk2MdVBFp6TnHYOapTHX79HTKonxiYTuGiN1/mu9yslXIQr1Fkv+MI
xappY499fCeHEJc6Y2v5MhfZmy8xLQ6hfaGWajsK2TH7hduO85F0P1ApbASyzyY4
CmgNWjA9W/sfh5UeGYPgxeltxOdVxg88ByAD2Ed7+bNVJmhD5sEYo/nzA+yrJF5J
q0FWmnzam/NjNGID6mlCLGRh0MdTm3Doo4Dx3rwtN4GNwiQSCIM=
=Tt/r
-----END PGP SIGNATURE-----
Merge tag 'qcom-arm64-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes
Qualcomm Arm64 DeviceTree fixes for v6.19
Add missing power-domains to the SC8280XP RPM power-domain and ensure
these are voted for from the remoteproc instances while powering them
up.
Clear a couple of DeviceTree validation warnings in SM8550 and SM8650
USB controller nodes.
Specify the correct display panel on the OnePlus 6.
Correct the UFS clock mapping on Talos, to ensure UFS is properly
clocked.
Add Abel's old emails address to .mailmap.
* tag 'qcom-arm64-fixes-for-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux:
arm64: dts: qcom: sm8650: Fix compile warnings in USB controller node
arm64: dts: qcom: sm8550: Fix compile warnings in USB controller node
arm64: dts: qcom: sc8280xp: Add missing VDD_MXC links
pmdomain: qcom: rpmhpd: Add MXC to SC8280XP
dt-bindings: power: qcom,rpmpd: Add SC8280XP_MXC_AO
arm64: dts qcom: sdm845-oneplus-enchilada: Specify panel name within the compatible
mailmap: Update email address for Abel Vesa
arm64: dts: qcom: talos: Correct UFS clocks ordering
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Qualcomm SC7280 and SM8350 SoCs have slightly different LPASS audio
blocks (v9.4.5 and v9.2), however the LPASS LPI pin controllers are
exactly the same. The driver for SM8350 has two issues, which can be
fixed by simply moving over to SC7280 driver which has them correct:
1. "i2s2_data_groups" listed twice GPIO12, but should have both GPIO12
and GPIO13,
2. "swr_tx_data_groups" contained GPIO5 for "swr_tx_data2" function, but
that function is also available on GPIO14, thus listing it twice is
not necessary. OTOH, GPIO5 has also "swr_rx_data1", so selecting
swr_rx_data function should not block the TX one.
Fixes: be9f6d5638 ("pinctrl: qcom: sm8350-lpass-lpi: add SM8350 LPASS TLMM")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Linus Walleij <linusw@kernel.org>
the next peripheral, Nano Pi M5 sound was not working correctly, the
adc-keys voltage levels for 2 buttons on the Pinephone Pro were wrong
and a really wrong PCIe linkspeed was removed from helios64.
Apart from that there are a number of dt-cleanlieness fixes.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCAAuFiEE7v+35S2Q1vLNA3Lx86Z5yZzRHYEFAmlmRpMQHGhlaWtvQHNu
dGVjaC5kZQAKCRDzpnnJnNEdga/NB/4rqhVfKrxotl5AmAdDmJrz86C1Qxa6cOxB
WD011An0u00V0oSARJM0r9Ng7ZpFUy1wf1VpRl4oSKiGWJKdAiJ0IzvUQyy9T7nM
vleEyST80y9t+Xq0ePXzDs3ADDhO5d9g1uJ2E9d+g2rsOFBVUWmUizeqiuY8YRmy
kgaHsz6xrPsvdS+bMHhhgsXdFXOU6TFITLMpliPr6QCBi539R/N6o4cVhh6gK+Fd
4TqoNne3cYiWsOrQ5qf57N3HPQ0sNBk4aikVFb2wrJYsMl+yFGML64CmXzhyfpIb
v4vg3T90l0OontCKJ7/lP4LZdiO47pUSct29o52XJBfty7KpCso1
=XPJU
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlpHOwACgkQmmx57+YA
GNnbjQ/+NWB20eyslWokB53g9ZCI2K3ORWtrrzDNPHPRfcF85Cjm/Gp50QrT3yR/
xNGOz9T2iDFVa0uwTWEpRZhjDzew46YxMeAWCvYl5LNnPpgpISeTQ3nc3uRs1qFo
SKRNd7CL2qkRYAwANoV8VIHhXa6u8N+TlPykUKvVnmfwJEJdzjYLz14E2NJDytSr
c57JjLae4FwLoPFTMwTqhBKUVVFj22HK4leZ6nGRbOt8Z3opMwtFBPfQURir19+w
rNHOHJatqdRKiaVlDCJSHaav+hijx4Ik7JQp+nXbZLWX6BJKHhID90Bs63OrhNxc
OR3i399y3Smi9dg9HLmGoB1XJYLiz39Oh/FVl3/C8qDnqddurhuwbrvJroauOMw4
4gv2j8FtZ5rXxWblvP2t3otEx71Vo5kTMzz8Xa25gomhxoOZx3k5CDwIPcE2gxsC
zj1xshF7yzDOm32EVeJ7F/b8BgsFi5E6otafgxitgnsYoIuwOplZYcHOolRbBhJ2
+Wb0tTf6Q0Mk/OgeR0rJNDmRb0ucL6U3rexOotnPsm6yuKPKoeb7l/xhlFjLbie8
SzsVOuaT07LxdbOndVn3+/4kvPcSuz5JQXqu4SlZANeDcDZ1MQafGrEXERQihNOO
JsWkAq5mMyBC67I0Ydg1ce+7dbVlyVUOkn+arj9TUaLwE8plgu8=
=nISS
-----END PGP SIGNATURE-----
Merge tag 'v6.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip into arm/fixes
In terms of bigger fixes, RK3576 GPU register range was overflowing into
the next peripheral, Nano Pi M5 sound was not working correctly, the
adc-keys voltage levels for 2 buttons on the Pinephone Pro were wrong
and a really wrong PCIe linkspeed was removed from helios64.
Apart from that there are a number of dt-cleanlieness fixes.
* tag 'v6.19-rockchip-dtsfixes1' of git://git.kernel.org/pub/scm/linux/kernel/git/mmind/linux-rockchip:
arm64: dts: rockchip: Drop unsupported properties
arm64: dts: rockchip: Fix gpio pinctrl node names
arm64: dts: rockchip: Fix pinctrl property typo on rk3326-odroid-go3
arm64: dts: rockchip: Drop "sitronix,st7789v" fallback compatible from rk3568-wolfvision
arm64: dts: rockchip: Fix wrong register range of rk3576 gpu
arm64: dts: rockchip: Configure MCLK for analog sound on NanoPi M5
arm64: dts: rockchip: Fix headphones widget name on NanoPi M5
arm64: dts: rockchip: remove redundant max-link-speed from nanopi-r4s
arm64: dts: rockchip: remove dangerous max-link-speed from helios64
arm64: dts: rockchip: fix unit-address for RK3588 NPU's core1 and core2's IOMMU
arm64: dts: rockchip: Fix wifi interrupts flag on Sakura Pi RK3308B
arm64: dts: rockchip: Fix voltage threshold for volume keys for Pinephone Pro
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Commit 59a42707a094 ("arm64: tegra: Add interconnect properties for
Tegra210") populated interconnect properties for Tegra210 and this is
preventing the Tegra DRM driver from probing successfully. The following
error is observed on boot ...
drm drm: failed to initialize 54240000.dc: -517
For now revert this change, until a fix is available.
Fixes: 59a42707a094 ("arm64: tegra: Add interconnect properties for Tegra210")
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Commit ddcadb297c ("KVM: arm64: Ignore EAGAIN for walks outside of a
fault") introduced a new walker flag ('KVM_PGTABLE_WALK_HANDLE_FAULT')
to KVM's page-table code. When set, the walk logic maintains its
previous behaviour of terminating a walk as soon as the visitor callback
returns an error. However, when the flag is clear, the walk will
continue if the visitor returns -EAGAIN and the error is then suppressed
and returned as zero to the caller.
Clearing the flag is beneficial when write-protecting a range of IPAs
with kvm_pgtable_stage2_wrprotect() but is not useful in any other
cases, either because we are operating on a single page (e.g.
kvm_pgtable_stage2_mkyoung() or kvm_phys_addr_ioremap()) or because the
early termination is desirable (e.g. when mapping pages from a fault in
user_mem_abort()).
Subsequently, commit e912efed48 ("KVM: arm64: Introduce the EL1 pKVM
MMU") hooked up pKVM's hypercall interface to the MMU code at EL1 but
failed to propagate any of the walker flags. As a result, page-table
walks at EL2 fail to set KVM_PGTABLE_WALK_HANDLE_FAULT even when the
early termination semantics are desirable on the fault handling path.
Rather than complicate the pKVM hypercall interface, invert the flag so
that the whole thing can be simplified and only pass the new flag
('KVM_PGTABLE_WALK_IGNORE_EAGAIN') from the wrprotect code.
Cc: Fuad Tabba <tabba@google.com>
Cc: Quentin Perret <qperret@google.com>
Cc: Marc Zyngier <maz@kernel.org>
Cc: Oliver Upton <oupton@kernel.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Fixes: fce886a602 ("KVM: arm64: Plumb the pKVM MMU in KVM")
Signed-off-by: Will Deacon <will@kernel.org>
Reviewed-by: Quentin Perret <qperret@google.com>
Link: https://msgid.link/20260105154939.11041-2-will@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
- Do not return false if !preemptible() in current_in_efi(). EFI
runtime services can now run with preemption enabled
- Fix uninitialised variable in the arm MPAM driver, reported by sparse
- Fix partial kasan_reset_tag() use in change_memory_common() when
calculating page indices or comparing ranges
- Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
is lost
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE5RElWfyWxS+3PLO2a9axLQDIXvEFAmlhSCwACgkQa9axLQDI
XvFj5w/+MUtRj+UL2p2Z2BsQvU6eheiKvvoVYr6kRURlYE1YahXh1lmp8S7t2St5
VYi41VUyT+udAmzIyQvM9GHB1co4d0BPOJcrmU+lKNM5uz/obQ6+Gf8RrHBh6XDM
ZuoEaWB1cRlLQF3NNUNO8IHHW2PwU88jxriZSbq0jnsqFudu1n70XxSH6FH+ilb7
MSkjP1NwaqiA+lTLAL6vCWL0XFA+qgXKMKfUPgW2QwVOM0irPAvmAciXHSwUJe69
W3Fj5UApJVAlwCNkXh6phzwqzorCMshXebVi/Kjxoo8XA/FJ6ezIzjLIsfxTzkgp
GrBW2sAH0xb5BQDsDsihcikKUZBF9Rpf7HtsVaaGcV5yJabo4Yz/cIyKzs9KLfI0
INl9Scno21FK2wqH1dZn+hbLUoRewbtw5+j3HK99Y9b0vNGccHU1g0uS6Kf8Bda3
if8adLIozRz3tcNQn9EWFAlkUYHH8XOKS0kaKTt1VVZWhRRBBTnnFqlDYxQ7Q3WH
t1S1a568UYi6Op0kAHNm5Gl2w0xF3oMQMHnI/hNn94q63m6S/rpvjyoT4Cmg0f0F
xW1Olxlqeve/4Siv5pBrl9SdwQT/0yZsCEqHi1NffDGooQOosXiWYR1xx+PsFRqf
qNvBsREqWkCg/KygtFeDSajrDjOKiN+vsleMR/absogBzvHF8vc=
=GVR8
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Catalin Marinas:
- Do not return false if !preemptible() in current_in_efi(). EFI
runtime services can now run with preemption enabled
- Fix uninitialised variable in the arm MPAM driver, reported by sparse
- Fix partial kasan_reset_tag() use in change_memory_common() when
calculating page indices or comparing ranges
- Save/restore TCR2_EL1 during suspend/resume, otherwise the E0POE bit
is lost
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: Fix cleared E0POE bit after cpu_suspend()/resume()
arm64: mm: Fix incomplete tag reset in change_memory_common()
arm_mpam: Stop using uninitialized variables in __ris_msmon_read()
arm64/efi: Don't fail check current_in_efi() if preemptible
The main code change is a revert of the Raspberry Pi RP1 overlay
support that was decided to not be ready.
The other fixes are all for devicetree sources:
- ethernet configuration on ixp42x-actiontec-mi424wr is
board revision specific
- validation warning fixes for imx27/imx51/imx6, hikey960 and k3
- Minor corrections across imx8 boards, addressing all types of
issues with interrups, dma, ethernet and clock settings, all
simple one-line changes.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlhOYAACgkQmmx57+YA
GNlViQ/8CrVllBec/x8Mp7hqTTvRxYSkxnbkPcgqgOLgMyNwg0gZZeA06+EAEJK/
Pqx/Ht86w61A9yZo2OH/p5w6GjmT17J7a0DHYSKjCuW0Dc52ZB+Xqpng2bI92YmL
MjdG4XZ0wJDHCJ2Vt8fHPb06szZAzRyTrDQ4iK1r2/vbOep+4lvXzcS70uKlWYHY
ipIknMork833I5lV434WRhXIg7P/wDfv6U/lXH969pngf2fbxUQipwzHxWZ5OjeE
s1E8ESdJ7QyBhNeMJXIgeNc0jcHV/8jmyxz7D7rkcULpPeo+dNI/l65n6G9j91V/
vt7SarnQbkoWj5Z3skwb7coMJ4P8iVBruqxT9z5yotTDgy8rR4vivwuPqiB0Kahm
gWc00OfdyX9LxBGSdiwq1Ms+tHv2gMrfVkxzI7ppQzRlG+tokD5ZBElM6+cUdMIL
vUoEolm42GIG8FX/QwFLCBqjrZ0b2pI41Bh8UIEBNV4w8qvcJ9BrOGBWKGI4R1uq
vdYSS+jvqdOEsW9q9iWz2EdCSjLHoIf43ljWdYzDt3T9xw+g92b7/8h7drJwf17w
O4nA3G7WFn57lP3YlLmZ/xeR59Zg5i/fC0Za4j5kyu96karn4ySTinxJfOPcqKMb
mhYxs1N0cdp1r/wsXDEAxOCOQS0Yij0oQc16BfDamrsNq13BdjY=
=2kPF
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"The main code change is a revert of the Raspberry Pi RP1 overlay
support that was decided to not be ready.
The other fixes are all for devicetree sources:
- ethernet configuration on ixp42x-actiontec-mi424wr is board
revision specific
- validation warning fixes for imx27/imx51/imx6, hikey960 and k3
- Minor corrections across imx8 boards, addressing all types of
issues with interrups, dma, ethernet and clock settings, all simple
one-line changes"
* tag 'soc-fixes-6.19' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (25 commits)
arm64: dts: hisilicon: hikey960: Drop "snps,gctl-reset-quirk" and "snps,tx_de_emphasis*" properties
Documentation/process: maintainer-soc: Mark 'make' as commands
Documentation/process: maintainer-soc: Be more explicit about defconfig
arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
arm64: dts: freescale: moduline-display: fix compatible
dt-bindings: arm: fsl: moduline-display: fix compatible
ARM: dts: imx6q-ba16: fix RTC interrupt level
arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
arm64: dts: add off-on-delay-us for usdhc2 regulator
arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
ARM: dts: nxp: imx: Fix mc13xxx LED node names
arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
MAINTAINERS: Fix a linusw mail address
arm64: dts: broadcom: rp1: drop RP1 overlay
arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
misc: rp1: drop overlay support
...
We set PSTATE.PAN to 1 on exiting from a guest if PAN support has
been compiled in and that it exists on the HW. However, this is not
necessarily correct.
In a nVHE configuration, there is no notion of PAN at EL2, so setting
PSTATE.PAN to anything is pointless.
Furthermore, not setting PAN to 0 when CONFIG_ARM64_PAN isn't set
means we run with the *guest's* PSTATE.PAN (which might be set to 1),
and we will explode on the next userspace access. Yes, the architecture
is delightful in that particular corner.
Fix the whole thing by always setting PAN to something when running
VHE (which implies PAN support), and only ignore it when running nVHE.
Reported-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260107124600.2736328-1-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
Naturally, updating the Access Flag in a stage-1 descriptor requires
write permission at stage-2, although this isn't actually enforced in
KVM's software PTW.
Generate a stage-2 permission fault if the stage-1 walk attempts to
update the descriptor and its corresponding stage-2 translation lacks
write permission.
Fixes: bff8aa213d ("KVM: arm64: Implement HW access flag management in stage-1 SW PTW")
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260108204230.677172-1-oupton@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
Function vcpu_{clear,set}_wfx_traps() are unused since
commit 0b5afe0537 ("KVM: arm64: Add early_param to
control WFx trapping").
Remove it.
Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Dongxu Sun <sundongxu1024@163.com>
Link: https://msgid.link/20260109080226.761107-1-sundongxu1024@163.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
"pinctrl-names" is not valid without a pinctrl-N property.
"max-freq" is not a defined property name. Maybe it was supposed to be
"spi-max-frequency", but changing to that would be a change in behavior.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260108230607.1348879-1-robh@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
The pinctrl node names "gpios" or with "-gpio" suffix collide with GPIO
property names creating false warnings. Add a "-pins?" suffix to avoid
the issue.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260108230623.1349310-1-robh@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
"pinctrl" is not a defined property name. The correct name is
"pinctrl-0".
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
[added missing pinctrl-names property]
Link: https://patch.msgid.link/20260108230613.1349060-1-robh@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
"sitronix,st7789v" is not a defined fallback for
"jasonic,jt240mhqs-hwt-ek-e3", so drop it.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://patch.msgid.link/20260108230600.1348699-1-robh@kernel.org
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
TCR2_ELx.E0POE is set during smp_init().
However, this bit is not reprogrammed when the CPU enters suspension and
later resumes via cpu_resume(), as __cpu_setup() does not re-enable E0POE
and there is no save/restore logic for the TCR2_ELx system register.
As a result, the E0POE feature no longer works after cpu_resume().
To address this, save and restore TCR2_EL1 in the cpu_suspend()/cpu_resume()
path, rather than adding related logic to __cpu_setup(), taking into account
possible future extensions of the TCR2_ELx feature.
Fixes: bf83dae90f ("arm64: enable the Permission Overlay Extension for EL0")
Cc: <stable@vger.kernel.org> # 6.12.x
Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
synchronize_vcpu_pstate() doesn't make use of the reference to exit_code,
remove the parameter.
Reviewed-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Tested-by: Fuad Tabba <tabba@google.com>
Link: https://msgid.link/20251216103053.47224-5-alexandru.elisei@arm.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
__pvkm_host_share_hyp() and __pkvm_host_unshare_hyp() both have one
parameter, the pfn, not two. Even though correctness isn't impacted because
the SMCCC handlers pass the first argument and ignore the second one, let's
call the functions with the proper number of arguments.
Reviewed-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Tested-by: Fuad Tabba <tabba@google.com>
Link: https://msgid.link/20251216103053.47224-4-alexandru.elisei@arm.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
Configuring a register trap without specifying an accessor function is
abviously a bug. Instead of calling die() when that happens, let's be a
bit more helpful and print the register encoding. Also inject an
undefined instruction exception in the guest, similar to other unhandled
register accesses.
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://msgid.link/20251216103053.47224-3-alexandru.elisei@arm.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
Commit fb10ddf35c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()")
introduced per-VCPU FGT traps. For an unprotected pKVM VCPU, the untrusted
host FGT configuration is copied in pkvm_vcpu_init_traps(), which is called
from __pkvm_init_vcpu(). __pkvm_init_vcpu() is called once per VCPU (when
the VCPU is first run) which means that the uninitialized, zero, values for
the FGT registers end up being used for the entire lifetime of the VCPU.
This causes both unwanted traps (for the inverse polarity trap bits) and
the guest being allowed to access registers it shouldn't.
Fix it by copying the FGT traps for unprotected pKVM VCPUs when the
untrusted host loads the VCPU.
Fixes: fb10ddf35c ("KVM: arm64: Compute per-vCPU FGTs at vcpu_load()")
Acked-by: Will Deacon <will@kernel.org>
Tested-by: Fuad Tabba <tabba@google.com>
Reviewed-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Alexandru Elisei <alexandru.elisei@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20251216103053.47224-2-alexandru.elisei@arm.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
The current XN implementation is tied to the EL2 translation regime,
and fall flat on its face with the EL2&0 one that is used for hVHE,
as the permission bit for privileged execution is a different one.
Fixes: 6537565fd9 ("KVM: arm64: Adjust EL2 stage-1 leaf AP bits when ARM64_KVM_HVHE is set")
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Fuad Tabba <tabba@google.com>
Link: https://msgid.link/20251210173024.561160-2-maz@kernel.org
Signed-off-by: Oliver Upton <oupton@kernel.org>
Explicitly check for the vgic being v3 when disabling TWI. Failure to
check this can result in using the wrong view of the vgic CPU IF union
causing undesirable/unexpected behaviour.
Signed-off-by: Sascha Bischoff <sascha.bischoff@arm.com>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://msgid.link/20260106165154.3321753-1-sascha.bischoff@arm.com
Signed-off-by: Oliver Upton <oupton@kernel.org>
Running KASAN KUnit tests with {HW,SW}_TAGS mode triggers a fault in
change_memory_common():
Call trace:
change_memory_common+0x168/0x210 (P)
set_memory_ro+0x20/0x48
vmalloc_helpers_tags+0xe8/0x338
kunit_try_run_case+0x74/0x188
kunit_generic_run_threadfn_adapter+0x30/0x70
kthread+0x11c/0x200
ret_from_fork+0x10/0x20
---[ end trace 0000000000000000 ]---
# vmalloc_helpers_tags: try faulted
not ok 67 vmalloc_helpers_tags
Commit a06494adb7 ("arm64: mm: use untagged address to calculate page index")
fixed a KASAN warning in the BPF subsystem by adding kasan_reset_tag() to
the index calculation. In the execmem flow:
bpf_prog_pack_alloc()
-> bpf_jit_alloc_exec()
-> execmem_alloc()
The returned address from execmem_vmalloc/execmem_cache_alloc is passed
through kasan_reset_tag(), so start has no tag while area->addr still
retains the original tag. The fix correctly handled this case by resetting
the tag on area->addr:
(start - (unsigned long)kasan_reset_tag(area->addr)) >> PAGE_SHIFT
However, in normal vmalloc paths, both start and area->addr have matching
tags(or no tags). Resetting only area->addr causes a mismatch when
subtracting a tagged address from an untagged one, resulting in an
incorrect index.
Fix this by resetting tags on both addresses in the index calculation.
This ensures correct results regardless of the tag state of either address.
Tested with KASAN KUnit tests under CONFIG_KASAN_GENERIC,
CONFIG_KASAN_SW_TAGS, and CONFIG_KASAN_HW_TAGS - all pass. Also verified
the original BPF KASAN warning from [1] is still fixed.
[1] https://lore.kernel.org/all/20251118164115.GA3977565@ax162/
Fixes: a06494adb7 ("arm64: mm: use untagged address to calculate page index")
Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
"snps,tx_de_emphasis" is supposed to be a u8, not a u32. Since it is big
endian, 0 will be read rather than 1. The DWC3 Linux driver simply ORs
the value if "snps,tx_de_emphasis_quirk" is set, so the 2 properties
have no effect. (The driver doesn't clear the field either which is
another problem).
"snps,gctl-reset-quirk" is not documented nor used in the driver, so
drop it as well.
Signed-off-by: Rob Herring (Arm) <robh@kernel.org>
Link: https://lore.kernel.org/r/20260105174002.2997615-1-robh@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
- A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger
type
- An i.MX95 fix from Carlos Song to correct I3C2 pclk
- A couple of imx8qm-mek changes from Haibo Chen to fix light sensor
interrupt type and usdhc2 regulator configuration
- An imx6q-ba16 change from Ian Ray to fix RTC interrupt level
- An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet
link bouncing caused by interruptions on the PHY reference clock
- A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible
and eqos nvmem-cells
- An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names
- An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for
LPUART
- A couple of imx95-toradex-smarc changes from Vitor Soares to fix
ethphy1 interrupt and SMARC_SDIO_WP label position
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEFmJXigPl4LoGSz08UFdYWoewfM4FAmlUl0EACgkQUFdYWoew
fM4rVAf8CoKCxw3wY6WWGnykrwxb7QNIr1CIfUCJC+6PtSxEsuuwMWmrhsEpvs36
Idh5YXGl89hC/6DYr9NLy6GHKX+pp8TX5ah/bY4gIkRZ9gc3+TuU7qUv/iFkk9Q7
DgpMvE7TUKrLrUvkX4nN5rcLFOODkz3+KrJLLi7D3GOBQA3PEQ31dXBlTRygO/WP
AvaBkbmcCUMM8jpr0b4jcloSwMGunCzI/bpdGrBaFw4peOBCPzhYvAjtE+4FRBX+
QaO11t7VYFSZ1Asqc944vjpNWaqLMzABjaLvOSAsERm5M8vfjkHD4cLJX7yYeCAa
Can4xx7yVHmCzPryWH6Asnpx9BttQg==
=im41
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlejoMACgkQmmx57+YA
GNm7rBAAvrbS1D81cjkuU9atoRodFtfW3MvspJRWO2VrgA2uNH9TkmYucgApyGPc
RJyHoR0rwUIFZfBBX0A3D7CvdIu4KKLBR9Gbx7/0OshTHto7knBxW4nNEh2GUiF2
2hXQ4dMqtCD+JmD4l4LlAAnvmZ7MYYi/s3+1t34FrTOv5GmItNv7+Vtcx6NpVkiV
J4ihr7q8L6IB/H3XaVogDnBxqTAwbgNMuXKcPypI2NyCQoJaf8SDEZXh+sesIl+H
CKIWjhNxs5Tei0lM277xX0C7Oz6FUUUbaKegRT7iPiljpoG6717xqyDVfIcqP7fE
m7teGkao2faLrSN97sGzcdb6x5Q0s+PMK/a6CeZd6nerEAkfEmeg8CfL7ys75k3O
yYXr96u4OLWk3laW5xug6ZouJXyobINzy5/FVzKayDb+vXu9iHYuA/olm1L3xGS9
QWRvK32OCuZ8cBdSZtHfDjFXW6rgIpzhIU8H4vn0ACKNE4gjLqk9RvNW0+gb1JpE
aH5qgTVsqQDjA9UUcjwbXirBIDBJJcbm8UMu1a1QzRbn7Dcd0hekfp9Ueb8lMww5
BW2qRj+QXXB06qMM6GTsam2fL1GSwkUEWsl2DoLEfU3OrRiVUxzw02maOBvGJXoO
INK+TRgFKhvVC2uI0PvNVqf52lieby5blWFH6W+gMJI2Kkn/+oo=
=BjZ2
-----END PGP SIGNATURE-----
Merge tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux into arm/fixes
i.MX fixes for 6.19:
- A mba8mx fix from Alexander Stein to correct Ethernet PHY IRQ trigger
type
- An i.MX95 fix from Carlos Song to correct I3C2 pclk
- A couple of imx8qm-mek changes from Haibo Chen to fix light sensor
interrupt type and usdhc2 regulator configuration
- An imx6q-ba16 change from Ian Ray to fix RTC interrupt level
- An imx8mp-dhcom-som change from Marek Vasut to fix sporadic Ethernet
link bouncing caused by interruptions on the PHY reference clock
- A couple of imx8mp-tx8p changes from Maud Spierings to fix compatible
and eqos nvmem-cells
- An ARM i.MX fix from Rob Herring to correct mc13xxx LED node names
- An imx8qm-ss-dma change from Sherry Sun to correct DMA channels for
LPUART
- A couple of imx95-toradex-smarc changes from Vitor Soares to fix
ethphy1 interrupt and SMARC_SDIO_WP label position
* tag 'imx-fixes-6.19' of https://git.kernel.org/pub/scm/linux/kernel/git/shawnguo/linux:
arm64: dts: mba8mx: Fix Ethernet PHY IRQ support
arm64: dts: imx8qm-ss-dma: correct the dma channels of lpuart
arm64: dts: imx8mp: Fix LAN8740Ai PHY reference clock on DH electronics i.MX8M Plus DHCOM
arm64: dts: freescale: tx8p-ml81: fix eqos nvmem-cells
arm64: dts: freescale: moduline-display: fix compatible
dt-bindings: arm: fsl: moduline-display: fix compatible
ARM: dts: imx6q-ba16: fix RTC interrupt level
arm64: dts: freescale: imx95-toradex-smarc: fix SMARC_SDIO_WP label position
arm64: dts: freescale: imx95-toradex-smarc: use edge trigger for ethphy1 interrupt
arm64: dts: add off-on-delay-us for usdhc2 regulator
arm64: dts: imx8qm-mek: correct the light sensor interrupt type to low level
ARM: dts: nxp: imx: Fix mc13xxx LED node names
arm64: dts: imx95: correct I3C2 pclk to IMX95_CLK_BUSWAKEUP
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
6.19, please pull the following:
- Andrea fixes the RP1 DeviceTree hierarchy and drop overlay support,
this resolves a number of DTC warnings and other issues
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEm+Rq3+YGJdiR9yuFh9CWnEQHBwQFAmlFuWQACgkQh9CWnEQH
BwSl9g/9EXHS5ElbrZMTzolABdvD85T6Ab0I8W0rxwagb0YDRog8o9GMplRk7V69
ggNB9j0K/IvK/ucFjdLZbhUXztDfbrWHvb5kBMo+04J+LMu2XkAJu0t2qFL3eQHa
FEjzmjTHoa+fGTRmIWGKgk2yBk2GnUJxit/xAeEvCxzLh9r6YDnDBQUhTtkg3ebY
kXI4l6tUlhmpoAgBpN9gcoUfhLYO7pi2Kbsg87aKXdsiuuhszmgzKyB+RvFH2/vK
ShmtFr/DZ0zyYmM8TrcQW3LJLbNXeZDnYuomOO+tpQvjErCza5XAPl+ogsZwQ8Bw
Z7nca8L+9ozcxlohfWBRB/9saO5tteksH2vvcjBeZalRhCABWtzxV1YTTvSWbpHP
poWhJjthykkUhZ+vENvQRSzv8Hku2tegO18SHPBeqgImfHo6Xghzy8+bQVxy1Jcz
6Uvtzmj/z8yyz4N0aaY2NNz3DplOM7SpuU7tEFf/e9ZZFChCzyjMOX1YCSV8sOJ1
ccp8o6ryWhQguSlqS2oMkE/aNwmPQTphxPXA0bOSR6lN4WUdePgwguEbi2T+6N/d
B2MDtFm7VT/QXJFJZRmpgZC1pq43dyoHAP4shsG4Qek6sz/8lUHvb9pt8e2HICX0
cY1taqpZrdEKTFa51Vfyl0aMEXPHoH/2+7SI3cdOlEd0+ODMRpY=
=JCKi
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmlejZ8ACgkQmmx57+YA
GNl+MhAArb5i/a89Se6g4ORJR9v+6mj+XgYc7lMpulU/XZafz1gNS8PqHkquG62R
5ZYSi99E44Ibk2HvFv4SD62f8XnuUCmHgmo7dmldjpDn36FMmyTuNOoV/Iil9PzM
kcrHx/SGIcSDdXns54r2UbWhgkq0WD5UCfrDgVYH2IPY+shzoGeSr5DUAb2Z4Z4y
ROrnPNaxp0Z5azf44lIHW5zTl6ea6MF8s26zxchkxm8ZhoB5OEejdLKX6lQA124z
xmFlv1xtcD7tArxT9M+4gQ1OjrWuGQw20nJDOZhaPFb47YAdOiMkEMycqYSPg7yl
zOxGiq6OjvoAO3WKJ7kaRCg4do9YQK1GtWOYFzoMR9M+GMqxjYBlWFdm2vJsFC8/
tRM5X+DTTiKK+4sbAolBY1tJe2iOt84mv4n91sgZ1LCywNwUndyFU6h2YmayGvRJ
1JBeA5pv1y+qMviDzsxX3llVdNjQuL62CakFRxdNyLw2JTqGrrphEIiCFzkLqX9G
3IWrALY40L2p4OcUP9VIRPVNe96mBuJOnILMxiB5mA0tTVrZIi9MlvZ1egL+qo2U
PHR2TPuYMhTUogwOCEF7G+YtCgGSVAb72L3AYKGrOSgLleT/CUd79HfsLfv3Gs1j
MTonYjRoIgSX1eFR6XHwO3+ZSeoXwvrCh98pIV/IWqMmk2nHiUA=
=IlUv
-----END PGP SIGNATURE-----
Merge tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux into arm/fixes
This pull request contains Broadcom ARM64-SoC Device Tree fixes for
6.19, please pull the following:
- Andrea fixes the RP1 DeviceTree hierarchy and drop overlay support,
this resolves a number of DTC warnings and other issues
* tag 'arm-soc/for-6.19/devicetree-arm64-fixes' of https://github.com/Broadcom/stblinux:
arm64: dts: broadcom: rp1: drop RP1 overlay
arm64: dts: broadcom: bcm2712: fix RP1 endpoint PCI topology
misc: rp1: drop overlay support
dt-bindings: misc: pci1de4,1: add required reg property for endpoint
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
According to RK3576 TRM part1 Table 1-1 Address Mapping, the size of
the GPU registers is 128 KB.
The current mapping incorrectly includes the addresses of multiple
following IP like the eInk interface at 0x27900000. This has not
been detected by the DT tooling as none of the extra mapped IP is
described in the upstream RK3576 DT so far.
Fixes: 57b1ce9039 ("arm64: dts: rockchip: Add rk3576 SoC base DT")
Signed-off-by: Chaoyi Chen <chaoyi.chen@rock-chips.com>
Reviewed-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://patch.msgid.link/20260106071513.209-1-kernel@airkyi.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
NanoPi M5 derives its analog sound signal from SAI2 in M0 pin mode, so the
MCLK pin should be configured accordingly for the sound codec to get its
I2S signal from the SoC. Request the required pin config.
The clock itself should also be CLK_SAI2_MCLKOUT_TO_IO for the sound to
work (otherwise there is only silence out of the audio out jack).
Fixes: 96cbdfdd3a ("arm64: dts: rockchip: Add FriendlyElec NanoPi M5 support")
Cc: stable@vger.kernel.org
Signed-off-by: Alexey Charkov <alchark@gmail.com>
Link: https://patch.msgid.link/20251229-rk3576-sound-v1-2-2f59ef0d19b1@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
As EFI runtime services can now be run without disabling preemption remove
the check for non preemptible in current_in_efi(). Without this change,
firmware errors that were previously recovered from by
__efi_runtime_kernel_fixup_exception() will lead to a kernel oops.
Fixes: a5baf582f4 ("arm64/efi: Call EFI runtime services without disabling preemption")
Signed-off-by: Ben Horgan <ben.horgan@arm.com>
Reviewed-by: Yeoreum Yun <yeoreum.yun@arm.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Reviewed-by: Richard Lyu <richard.lyu@suse.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
The commit 616effc027 ("arm64: dts: imx8: Fix lpuart DMA channel
order") swap uart rx and tx channel at common imx8-ss-dma.dtsi. But miss
update imx8qm-ss-dma.dtsi.
The commit 5a8e9b022e ("arm64: dts: imx8qm-ss-dma: Pass lpuart
dma-names") just simple add dma-names as binding doc requirement.
Correct lpuart0 - lpuart3 dma rx and tx channels, and use defines for
the FSL_EDMA_RX flag.
Fixes: 5a8e9b022e ("arm64: dts: imx8qm-ss-dma: Pass lpuart dma-names")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Add missing 'clocks' property to LAN8740Ai PHY node, to allow the PHY driver
to manage LAN8740Ai CLKIN reference clock supply. This fixes sporadic link
bouncing caused by interruptions on the PHY reference clock, by letting the
PHY driver manage the reference clock and assure there are no interruptions.
This follows the matching PHY driver recommendation described in commit
bedd8d78ab ("net: phy: smsc: LAN8710/20: add phy refclk in support")
Fixes: 8d6712695b ("arm64: dts: imx8mp: Add support for DH electronics i.MX8M Plus DHCOM and PDK2")
Signed-off-by: Marek Vasut <marek.vasut@mailbox.org>
Tested-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
On this SoM eqos is the primary ethernet interface, Ka-Ro fuses the
address for it in eth_mac1, eth_mac2 seems to be left unfused. In their
downstream u-boot they fetch it from eth_mac1 [1][2], by setting alias
of eqos to ethernet0, the driver then fetches the mac address based on
the alias number.
Set eqos to read from eth_mac1 instead of eth_mac2. Also set fec to
point at eth_mac2 as it may be fused later even though it is disabled
by default.
With this changed barebox is now capable of loading the correct address.
Link: 3805432784/drivers/net/dwc_eth_qos.c (L1167) [1]
Link: 3805432784/arch/arm/dts/imx8mp-karo.dtsi (L12) [2]
Fixes: bac63d7c5f ("arm64: dts: freescale: add Ka-Ro Electronics tx8p-ml81 COM")
Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
The compatibles should include the SoM compatible, this board is based
on the Ka-Ro TX8P-ML81 SoM, so add it to allow using shared code in the
bootloader which uses upstream Linux devicetrees as a base.
Also add the hardware revision to the board compatible to handle
revision specific quirks in the bootloader/userspace.
This is a breaking change, but it is early enough that it can be
corrected without causing any issues.
Fixes: 03f07be54c ("arm64: dts: freescale: Add the GOcontroll Moduline Display baseboard")
Signed-off-by: Maud Spierings <maudspierings@gocontroll.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Fix the SMARC_SDIO_WP gpio-line-name position. It should be on line 15
of som_gpio_expander_1, not line 17.
Fixes: 90bbe88e0e ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Change the PHY interrupt trigger type from IRQ_TYPE_LEVEL_LOW to
IRQ_TYPE_EDGE_FALLING to match the PCA9745 GPIO expander hardware
capabilities and avoid emulated level detection.
Fixes: 90bbe88e0e ("arm64: dts: freescale: add Toradex SMARC iMX95")
Signed-off-by: Vitor Soares <vitor.soares@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
For SD card, according to the spec requirement, for sd card power reset
operation, it need sd card supply voltage to be lower than 0.5v and keep
over 1ms, otherwise, next time power back the sd card supply voltage to
3.3v, sd card can't support SD3.0 mode again.
To match such requirement on imx8qm-mek board, add 4.8ms delay between
sd power off and power on.
Fixes: 307fd14d4b ("arm64: dts: imx: add imx8qm mek support")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
light sensor isl29023 share the interrupt with lsm303arg, but these
two devices use different interrupt type. According to the datasheet
of these two devides, both support low level trigger type, so correct
the interrupt type here to avoid the following error log:
irq: type mismatch, failed to map hwirq-11 for gpio@5d0c0000!
Fixes: 9918092cbb ("arm64: dts: imx8qm-mek: add i2c0 and children devices")
Fixes: 1d8a9f043a ("arm64: dts: imx8: use defines for interrupts")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
I3C2 is in WAKEUP domain. Its pclk should be IMX95_CLK_BUSWAKEUP.
Fixes: 969497ebef ("arm64: dts: imx95: Add i3c1 and i3c2")
Signed-off-by: Carlos Song <carlos.song@nxp.com>
Cc: stable@vger.kernel.org
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
The Device Tree specification specifies[1] that
"""
Each node in the devicetree is named according to the following
convention:
node-name@unit-address
[...]
The unit-address must match the first address specified in the reg
property of the node.
"""
The first address in the reg property is fdaXa000 and not fdaX9000. This
is likely a copy-paste error as the IOMMU for core0 has two entries in
the reg property, the first one being fdab9000 and the second fdaba000.
Let's fix this oversight to match what the spec is expecting.
[1] https://github.com/devicetree-org/devicetree-specification/releases/download/v0.4/devicetree-specification-v0.4.pdf 2.2.1 Node Names
Fixes: a31dfc060a ("arm64: dts: rockchip: Add nodes for NPU and its MMU to rk3588-base")
Cc: stable@vger.kernel.org
Signed-off-by: Quentin Schulz <quentin.schulz@cherry.de>
Link: https://patch.msgid.link/20251215-npu-dt-node-address-v1-1-840093e8a2bf@cherry.de
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
