summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)AuthorFilesLines
2026-06-03Merge tag 'stm32-dt-for-7.2-1' of ↵Linus Walleij6-138/+320
git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32 into soc/dt STM32 DT for v7.2, round 1 Highlights: ---------- - MPU: - STM32MP13: - Enable PHY SSC (Spread Spectrum) on DHCORE DHSBC board. - Add board pin documentation stm32mp135f-dk to help user. - STMP32MP15: - Protonic: - Update MECIOR0 ans MECIOR1 boards: - Define ADC channels and GPIO line definitions in board and no longer in common file. - Fix ADC sampling. - STM32MP25: - Fix SAI addresses. * tag 'stm32-dt-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/atorgue/stm32: arm64: dts: st: Fix SAI addresses on stm32mp251 ARM: dts: stm32: stm32mp15x-mecio1-io: Move expander gpio-line-names to board files ARM: dts: stm32: stm32mp15x-mecio1-io: Fix expander gpio line typo ARM: dts: stm32: stm32mp15x-mecio1-io: Move gpio-line-names to board files ARM: dts: stm32: stm32mp15x-mecio1-io: Fix GPIO names typo ARM: dts: stm32: stm32mp15x-mecio1-io: Move divergent mecio1 ADC channels to board files ARM: dts: stm32: stm32mp15x-mecio1-io: Fix ADC sampling times ARM: dts: stm32: stm32mp15x-mecio1-io: Enable internal ADC reference ARM: dts: stm32: add board pin documentation stm32mp135f-dk ARM: dts: stm32: Enable PHY SSC on DH STM32MP13xx DHCOR DHSBC board Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-03Merge tag 'samsung-dt64-7.2' of ↵Linus Walleij8-5/+52
https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/dt Samsung DTS ARM64 changes for v7.2 1. Exynos850: Implement proper power off to fully shutdown the board and reduce drawn current. 2. ExynosAutov920: Add UFS storage. 3. Add Peter Griffin as a co-maintainer. I have multiple subsystems to care of and limited time. Also, with joining to SoC team I figured out it is good to plan my succession. Or backup. Peter shown both time and interest in keeping Samsung Exynos code working. He already works on and maintains Google Tensor SoC, which shares a lot with Samsung Exynos processors. Considering all this, I proposed Peter to become a co-maintainer here (same for pinctrl, which went via different tree). I will still be the one handling patches for this and (probably) next cycle, but in a further timeframe the roles could reverse with me only providing acks or reviews. If this works then depending on other duties and amount of work, I might be slowly transitioning to leave Samsung SoC maintainership. * tag 'samsung-dt64-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux: MAINTAINERS: Add Peter Griffin as a co-maintainer of Samsung Exynos SoCs arm64: dts: exynos: Add EL2 virtual timer interrupt arm64: dts: exynosautov920: enable support for ufs controller arm64: dts: exynosautov920: Add syscon hsi2 node arm64: dts: exynos850: Add syscon-poweroff node Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-03Merge tag 'tegra-for-7.2-arm-dt' of ↵Linus Walleij13-37/+2201
git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt ARM: tegra: Device tree changes for v7.2-rc1 The bulk of this is various improvements for some of the older ASUS and LG devices, but there's also support for interconnects on Tegra114 to help improve memory frequency scaling. * tag 'tegra-for-7.2-arm-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: ARM: tegra: tf600t: Invert accelerometer calibration matrix ARM: tegra: tf600t: Drop backlight regulator ARM: tegra: tf600t: Configure panel ARM: tegra: transformers: Add connector node for common trees ARM: tegra: transformer: Add support for front camera ARM: tegra: grouper: Add support for front camera ARM: tegra: p880: Lower CPU thermal limit ARM: tegra: lg-x3: Set PMIC's RTC address ARM: tegra: lg-x3: Complete video device graph ARM: tegra: Configure Tegra114 power domains ARM: tegra: Add DC interconnections for Tegra114 ARM: tegra: Add EMC OPP and ICC properties to Tegra114 EMC and ACTMON device-tree nodes ARM: tegra: Add #{address,size}-cells to Chromium-based /firmware dt-bindings: memory: Document Tegra114 External Memory Controller dt-bindings: memory: Document Tegra114 Memory Controller Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-03Merge tag 'gemini-for-v7.2' of ↵Linus Walleij7-12/+458
git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator into soc/dt Gemini device tree updates: - Add two new devices: the Verbatim Gigabit NAS and the Raidsonic IB-4210-B, including ACKed binding updates. - Fix up boot device for the SQ201. - Use the right LED trigger for disk activity. - Add the SSP/SPI block to the SoC. - Fix up the RUT1xx device tree. * tag 'gemini-for-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-integrator: ARM: dts: gemini: Correct the RUT1xx ARM: dts: Add a Raidsonic IB-4210-B DTS ARM: dts: Add a Verbatim Gigabit NAS DTS dt-bindings: arm: Add two missing Gemini devices dt-bindings: vendor-prefixes: Add Verbatim Corporation ARM: dts: gemini: Add SSP/SPI block ARM: dts: gemini: Tag disk led for disk-activity ARM: dts: gemini: iTian SQ201 need to boot from mtdblock3 Signed-off-by: Linus Walleij <linusw@kernel.org>
2026-06-03arm64: kernel: Disable CNP on HiSilicon HIP09Zeng Heng2-2/+20
HiSilicon HIP09 implements TLB entry matching behavior that deviates from the ARM architecture specification when the CNP (Common not Private) bit is set in TTBRx_ELx. When TTBRx.CNP=1, TLB entries may be incorrectly shared between CPU cores, leading to TLB conflicts and stale mappings. This affects coherency and can result in incorrect translations. Add the hardware erratum workaround (Hisilicon erratum 162100125) to disable CNP on affected HIP09 cores. Co-developed-by: Tong Tiangen <tongtiangen@huawei.com> Signed-off-by: Tong Tiangen <tongtiangen@huawei.com> Signed-off-by: Zeng Heng <zengheng4@huawei.com> Reviewed-by: Vladimir Murzin <vladimir.murzin@arm.com> Acked-by: Wei Xu <xuwei5@hisilicon.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-03arm64: cpufeature: Add WORKAROUND_DISABLE_CNP capabilityZeng Heng5-7/+20
The NVIDIA Carmel CNP erratum is not the only case requiring CNP to be disabled. Abstract this into a common WORKAROUND_DISABLE_CNP capability to facilitate adding errata for future chips and reduce duplicate checks in has_useable_cnp(). This serves as a prerequisite for the subsequent Hisilicon erratum 162100125. Suggested-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Zeng Heng <zengheng4@huawei.com> Reviewed-by: Vladimir Murzin <vladimir.murzin@arm.com> Acked-by: Wei Xu <xuwei5@hisilicon.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-03x86/vdso: Implement __vdso_futex_robust_try_unlock()Thomas Gleixner10-5/+117
When the FUTEX_ROBUST_UNLOCK mechanism is used for unlocking (PI-)futexes, then the unlock sequence in userspace looks like this: 1) robust_list_set_op_pending(mutex); 2) robust_list_remove(mutex); lval = gettid(); 3) if (atomic_try_cmpxchg(&mutex->lock, lval, 0)) 4) robust_list_clear_op_pending(); else 5) sys_futex(OP,...FUTEX_ROBUST_UNLOCK); That still leaves a minimal race window between #3 and #4 where the mutex could be acquired by some other task which observes that it is the last user and: 1) unmaps the mutex memory 2) maps a different file, which ends up covering the same address When then the original task exits before reaching #5 then the kernel robust list handling observes the pending op entry and tries to fix up user space. In case that the newly mapped data contains the TID of the exiting thread at the address of the mutex/futex the kernel will set the owner died bit in that memory and therefore corrupt unrelated data. Provide a VDSO function which exposes the critical section window in the VDSO symbol table. The resulting addresses are updated in the task's mm when the VDSO is (re)map()'ed. The core code detects when a task was interrupted within the critical section and is about to deliver a signal. It then invokes an architecture specific function which determines whether the pending op pointer has to be cleared or not. The unlock assembly sequence on 64-bit is: mov %esi,%eax // Load TID into EAX xor %ecx,%ecx // Set ECX to 0 lock cmpxchg %ecx,(%rdi) // Try the TID -> 0 transition .Lstart: jnz .Lend movq %rcx,(%rdx) // Clear list_op_pending .Lend: ret So the decision can be simply based on the ZF state in regs->flags. The pending op pointer is always in DX independent of the build mode (32/64-bit) to make the pending op pointer retrieval uniform. The size of the pointer is stored in the matching criticial section range struct and the core code retrieves it from there. So the pointer retrieval function does not have to care. It is bit-size independent: return regs->flags & X86_EFLAGS_ZF ? regs->dx : NULL; There are two entry points to handle the different robust list pending op pointer size: __vdso_futex_robust_list64_try_unlock() __vdso_futex_robust_list32_try_unlock() The 32-bit VDSO provides only __vdso_futex_robust_list32_try_unlock(). The 64-bit VDSO provides always __vdso_futex_robust_list64_try_unlock() and when COMPAT is enabled also the list32 variant, which is required to support multi-size robust list pointers used by gaming emulators. The unlock function is inspired by an idea from Mathieu Desnoyers. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Acked-by: Uros Bizjak <ubizjak@gmail.com> Link: https://lore.kernel.org/20260311185409.1988269-1-mathieu.desnoyers@efficios.com Link: https://patch.msgid.link/20260602090535.883796247@kernel.org
2026-06-03x86/vdso: Prepare for robust futex unlock supportThomas Gleixner3-6/+43
There will be a VDSO function to unlock non-contended robust futexes in user space. The unlock sequence is racy vs. clearing the list_pending_op pointer in the task's robust list head. To plug this race the kernel needs to know the critical section window so it can clear the pointer when the task is interrupted within that race window. The window is determined by labels in the inline assembly. Add these symbols to the vdso2c generator and use them in the VDSO VMA code to update the critical section addresses in mm_struct::futex on (re)map(). The symbols are not exported to user space, but available in the debug version of the vDSO. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.828312645@kernel.org
2026-06-03x86: Select ARCH_MEMORY_ORDER_TSOThomas Gleixner1-0/+1
The generic unsafe_atomic_store_release_user() implementation does: if (!IS_ENABLED(CONFIG_ARCH_MEMORY_ORDER_TSO)) smp_mb(); unsafe_put_user(); As x86 implements Total Store Order (TSO) which means stores imply release, select ARCH_MEMORY_ORDER_TSO to avoid the unnecessary smp_mb(). Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.564499644@kernel.org
2026-06-03uaccess: Provide unsafe_atomic_store_release_user()Thomas Gleixner1-0/+4
The upcoming support for unlocking robust futexes in the kernel requires store release semantics. Syscalls do not imply memory ordering on all architectures so the unlock operation requires a barrier. This barrier can be avoided when stores imply release like on x86. Provide a generic version with a smp_mb() before the unsafe_put_user(), which can be overridden by architectures. Provide also a ARCH_MEMORY_ORDER_TSO Kconfig option, which can be selected by architectures with Total Store Order (TSO), where store implies release, so that the smp_mb() in the generic implementation can be avoided. If that is set a barrier() is used instead of smp_mb(), which is not required for the use case at hand, but makes it future proof for other usage to prevent the compiler from reordering. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: André Almeida <andrealmeid@igalia.com> Link: https://patch.msgid.link/20260602090535.513181528@kernel.org
2026-06-03percpu: Sanitize __percpu_qual include hellThomas Gleixner4-6/+20
Slapping __percpu_qual into the next available header is sloppy at best. It's required by __percpu which is defined in compiler_types.h and that is meant to be included without requiring a boatload of other headers so that a struct or function declaration can contain a __percpu qualifier w/o further prerequisites. This implicit dependency on linux/percpu.h makes that impossible and causes a major problem when trying to separate headers. Create asm/percpu_types.h and move it there. Include that from compiler_types.h and the whole recursion problem goes away. Fix up UM so it uses the generic header and includes it in the UM_HOST build, which pulls in compiler_types.h. The USER_CFLAGS fix was suggested by Richard. Signed-off-by: Thomas Gleixner <tglx@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260602090535.254874125@kernel.org
2026-06-03riscv: dts: sophgo: reduce SG2042 MSI count to 16Icenowy Zheng1-1/+1
The SG2042 MSI controller has one 32-bit doorbell register, and each bit corresponds to an interrupt. At a glance, it seems that the MSI controller can support 32 interrupts; however the PCI MSI capability only supports 16-bit messages, which makes the high 16 interrupts unusable in such way. Reduce the MSI count to 16 to prevent producing MSI message values that cannot fit 16-bit integers. Signed-off-by: Icenowy Zheng <zhengxingda@iscas.ac.cn> Reviewed-by: Chen Wang <unicorn_wang@outlook.com> Tested-by: Chen Wang <unicorn_wang@outlook.com> on Pioneerbox. Link: https://patch.msgid.link/20260407160143.1182430-1-zhengxingda@iscas.ac.cn Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
2026-06-03riscv: dts: sophgo: sg2042: use hex for CPU unit addressInochi Amaoto1-118/+118
Previous the CPU unit address cpu of sg2042 use decimal, it is not following the general convention for unit addresses of the OF. Convent the unit address to hex to resolve this problem. The introduces a small change for the CPU node name, but it should affect nothing since there is no direct full-path reference to these CPU nodes. Fixes: ae5bac370ed4 ("riscv: dts: sophgo: Add initial device tree of Sophgo SRD3-10") Tested-by: Chen Wang <unicorn_wang@outlook.com> # Pioneerbox. Reviewed-by: Guo Ren <guoren@kernel.org> Reviewed-by: Chen Wang <unicorn_wang@outlook.com> Acked-by: Conor Dooley <conor.dooley@microchip.com> Tested-by: Chen Wang <unicorn_wang@outlook.com> on Pioneerbox. Link: https://patch.msgid.link/20260426013449.694435-3-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
2026-06-03riscv: dts: sophgo: sg2044: use hex for CPU unit addressInochi Amaoto1-118/+118
Previous the CPU unit address cpu of sg2044 use decimal, it is not following the general convention for unit addresses of the OF. Convent the unit address to hex to resolve this problem. The introduces a small change for the CPU node name, but it should nothing since there is no direct full-path reference to these CPU nodes. Fixes: 967a94a92aaa ("riscv: dts: add initial Sophgo SG2042 SoC device tree") Reviewed-by: Chen Wang <unicorn_wang@outlook.com> Reviewed-by: Guo Ren <guoren@kernel.org> Link: https://patch.msgid.link/20260426013449.694435-2-inochiama@gmail.com Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
2026-06-02drivers/base/memory: make memory block get/put explicitMuchun Song1-10/+4
Rename the memory block lookup helper to make the acquired reference explicit, add memory_block_put() to wrap put_device(), remove find_memory_block(), and use memory_block_get() as the single block-id based lookup interface. This makes it clearer to callers that a successful lookup holds a reference that must be dropped, reducing the chance of forgetting the matching put and leaking the memory block device reference. Link: https://lore.kernel.org/linux-mm/7887915D-E598-42B3-9AFE-BFFBACE8DE2D@linux.dev/#t Link: https://lore.kernel.org/20260512072635.3969576-1-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun@bytedance.com> Acked-by: Oscar Salvador <osalvador@suse.de> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Tested-by: Donet Tom <donettom@linux.ibm.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Tested-by: Sumanth Korikkar <sumanthk@linux.ibm.com> #s390 Cc: Richard Cheng <icheng@nvidia.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Doug Anderson <dianders@chromium.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Kees Cook <kees@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-02powerpc/mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODEDavid Hildenbrand (Arm)1-8/+0
register_page_bootmem_info_node() essentially only calls register_page_bootmem_memmap(). However, on powerpc that function is a nop. So there is not benefit in using CONFIG_HAVE_BOOTMEM_INFO_NODE anymore, let's just drop it. We can stop including bootmem_info.h. Link: https://lore.kernel.org/20260511-bootmem_info_prep-v1-8-3fb0be6fc688@kernel.org Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Oscar Salvador <osalvador@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: David S. Miller <davem@davemloft.net> Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-02s390/mm: use free_reserved_page() in vmem_free_pages()David Hildenbrand (Arm)1-2/+1
We never select CONFIG_HAVE_BOOTMEM_INFO_NODE on s390. Therefore, free_bootmem_page() nowadays always translates to free_reserved_page(). Let's use free_reserved_page() to replace the free_bootmem_page() loop. We can stop including bootmem_info.h. Likely, vmemmap freeing code could be factored out into the core in the future. Link: https://lore.kernel.org/20260511-bootmem_info_prep-v1-7-3fb0be6fc688@kernel.org Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Oscar Salvador <osalvador@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: David S. Miller <davem@davemloft.net> Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-02sparc/mm: remove register_page_bootmem_info()David Hildenbrand (Arm)1-20/+0
Patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)". We want to remove CONFIG_HAVE_BOOTMEM_INFO_NODE. As a first step, let's limit the remaining harm to x86 and core code, removing sparc, ppc and s390 leftovers, starting the stepwise removal by removing and simplifying some code. Once a related x86 vmemmap fix [1] is in, we can merge part 2 that will remove CONFIG_HAVE_BOOTMEM_INFO_NODE entirely. Tested on x86-64 with hugetlb vmemmap optimization in combination with KMEMLEAK, making sure that the problem reported in dd0ff4d12dd2 ("bootmem: remove the vmemmap pages from kmemleak in put_page_bootmem") does not reappear -- hoping I managed to trigger the original problem. This patch (of 8): sparc does not select CONFIG_HAVE_BOOTMEM_INFO_NODE, therefore, register_page_bootmem_info_node() is a nop. Let's just get rid of register_page_bootmem_info(). Link: https://lore.kernel.org/20260511-bootmem_info_prep-v1-0-3fb0be6fc688@kernel.org Link: https://lore.kernel.org/20260511-bootmem_info_prep-v1-1-3fb0be6fc688@kernel.org Link: https://lore.kernel.org/r/20260429-vmemmap-v2-1-8dfcacffd877@kernel.org [1] Signed-off-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Oscar Salvador <osalvador@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Reviewed-by: Lance Yang <lance.yang@linux.dev> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Andreas Larsson <andreas@gaisler.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: David S. Miller <davem@davemloft.net> Cc: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Liam R. Howlett <liam@infradead.org> Cc: Lorenzo Stoakes <ljs@kernel.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-06-03riscv: dts: sophgo: Add dma-coherent to SG2042 PCIe controllersHan Gao1-0/+4
SG2042's PCIe root complexes are cache-coherent with the CPU. Mark all four PCIe controller nodes (pcie_rc0 through pcie_rc3) as dma-coherent so the kernel uses coherent DMA mappings instead of non-coherent bounce buffering. Cc: stable@vger.kernel.org Signed-off-by: Han Gao <gaohan@iscas.ac.cn> Link: https://patch.msgid.link/20260331171248.973014-3-gaohan@iscas.ac.cn Signed-off-by: Inochi Amaoto <inochiama@gmail.com> Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
2026-06-02x86/platform/uv: Use str_enabled_disabled() in uv_nmi_setup_hubless_intr()Thorsten Blum1-1/+2
Replace hard-coded strings with the str_enabled_disabled() helper. This unifies the output and helps the linker with deduplication, which can result in a smaller binary. Additionally, address the following Coccinelle/coccicheck warning reported by string_choices.cocci: opportunity for str_enabled_disabled(uv_pch_intr_now_enabled) Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Kyle Meyer <kyle.meyer@hpe.com> Link: https://patch.msgid.link/20260504181945.143928-2-thorsten.blum@linux.dev
2026-06-02arm64: dts: rockchip: Fix vcc_sdio regulator max voltage on Pinebook ProHugo Osvaldo Barrera1-1/+1
The vcc_sdio regulator supports 1.8V to 3.4V output range according to its datasheet. The current DT incorrectly limits the max voltage to 3.0V. This limit causes issues issues downstream with u-boot, which refuses to apply the out-of range value, and falls back to the minimum in that range: 1.8V. This is insufficient to power the SD card, so driver initialisation fails and booting from it does not work. Set regulator-max-microvolt to 3400000 µV to match hardware capability. This matches the rk3399-orangepi for the same regulator. Signed-off-by: Hugo Osvaldo Barrera <hugo@whynothugo.nl> Reviewed-by: Dang Huynh <dang.huynh@mainlining.org> Link: https://patch.msgid.link/20260519094439.7918-1-hugo@whynothugo.nl Signed-off-by: Heiko Stuebner <heiko@sntech.de>
2026-06-02arm64: dts: rockchip: Enable USB 2.0 ports on NanoPi Zero2Jonas Karlman1-0/+29
The NanoPi Zero2 has one USB 2.0 Type-A HOST port and one USB 2.0 Type-C OTG port. Add support for using the USB 2.0 ports on NanoPi Zero2. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260529190355.4148175-6-heiko@sntech.de
2026-06-02arm64: dts: rockchip: Enable USB 2.0 ports on ArmSoM Sige1Jonas Karlman1-0/+25
The ArmSoM Sige1 has two USB 2.0 Type-A HOST ports behind an onboard USB hub, and one USB 2.0 Type-C OTG port. Add support for using the USB 2.0 ports on ArmSoM Sige1. The onboard USB hub handles OHCI so only the EHCI controller is enabled. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> [added phy-supply for otg port] Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260529190355.4148175-5-heiko@sntech.de
2026-06-02arm64: dts: rockchip: Enable USB ports on Radxa ROCK 2A/2FJonas Karlman3-0/+40
The ROCK 2A has three USB 2.0 Type-A HOST ports behind an onboard USB hub, and one USB 3.0 Type-A port. And the ROCK 2F has two USB 2.0 Type-A HOST ports behind an onboard USB hub, and one USB 2.0 Type-C OTG port. Add support for using the USB ports on Radxa ROCK 2A/2F. The onboard USB hub handles OHCI so only the EHCI controller is enabled. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260529190355.4148175-4-heiko@sntech.de
2026-06-02arm64: dts: rockchip: Enable USB 2.0 ports on Radxa E20CJonas Karlman1-0/+60
The Radxa E20C has one USB2.0 Type-A HOST port and one USB2.0 Type-C port. The Type-C port is conneced to a FE1.1s_QFN USB hub on the board, with its ports being connected to the XHCI usb controller and an usb-uart bridge. This also means, the XHCI controller can only be used in device-mode. Add support for using the USB 2.0 ports on Radxa E20C. Signed-off-by: Jonas Karlman <jonas@kwiboo.se> [set xhci to peripheral and add comment about the outward-facing hub] Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260529190355.4148175-3-heiko@sntech.de
2026-06-02arm64: dts: rockchip: Add USB nodes for RK3528Jonas Karlman1-0/+80
Rockchip RK3528 has one USB 3.0 DWC3 controller and oneUSB 2.0 EHCI/OHCI controller and uses an Innosilicon-USB2PHY for USB 2.0. The DWC3 controller additionally uses the Naneng Combo PHY for USB3. Add device tree nodes to describe these USB controllers along with the USB 2.0 PHYs. [moved snps,dis_u2_susphy_quirk here from individual boards, describe both usb2+3 default phy connections, usb2 boards can override] Signed-off-by: Jonas Karlman <jonas@kwiboo.se> Signed-off-by: Heiko Stuebner <heiko@sntech.de> Link: https://patch.msgid.link/20260529190355.4148175-2-heiko@sntech.de
2026-06-02vdso/treewide: Drop GENERIC_TIME_VSYSCALLThomas Weißschuh9-9/+0
This Kconfig symbol is not used anymore, remove it. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260519-vdso-generic_time_vsyscal-v1-3-5c2a5905d5f5@linutronix.de
2026-06-02riscv: vdso: Drop CONFIG_GENERIC_TIME_VSYSCALL guard around syscall fallbacksThomas Weißschuh1-8/+0
The syscall definitions can be built just fine for 32-bit systems. Also the guard does not cover __arch_get_hw_counter() which is always used together with those system call fallbacks. Also this header is unused when no vDSO is built anyways. Drop the ifdeffery. The logic will be simpler to understand. Furthermore this prepares the complete removal of CONFIG_GENERIC_TIME_VSYSCALL. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Link: https://patch.msgid.link/20260519-vdso-generic_time_vsyscal-v1-1-5c2a5905d5f5@linutronix.de
2026-06-02ARM: dts: freescale: add bootph-all to i.MX7ULP watchdog nodesAlice Guo1-0/+12
Add the bootph-all property to ULP watchdog nodes for i.MX7ULP, ensuring the watchdog is available during all boot phases. Signed-off-by: Alice Guo <alice.guo@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-02s390/time: Prepare to stop elapsing in dynticks-idleFrederic Weisbecker3-9/+73
Currently the tick subsystem stores the idle cputime accounting in private fields, allowing cohabitation with architecture idle vtime accounting. The former is fetched on online CPUs, the latter on offline CPUs. For consolidation purposes, architecture vtime accounting will continue to account the cputime but will make a break when the idle tick is stopped. The dyntick cputime accounting will then be relayed by the tick subsystem so that the idle cputime is still seen advancing coherently even when the tick isn't there to flush the idle vtime. Prepare for that and introduce three new APIs which will be used in subsequent patches: - vtime_dynticks_start() is deemed to be called when idle enters in dyntick mode. The idle cputime that elapsed so far is accumulated and accounted. Also idle time accounting is ignored. - vtime_dynticks_stop() is deemed to be called when idle exits from dyntick mode. The vtime entry clocks are fast-forward to current time so that idle accounting restarts elapsing from now. Also idle time accounting is resumed. - vtime_reset() is deemed to be called from dynticks idle IRQ entry to fast-forward the clock to current time so that the IRQ time is still accounted by vtime while nohz cputime is paused. Also accumulated vtime won't be flushed from dyntick-idle ticks to avoid accounting twice the idle cputime, along with nohz accounting. Co-developed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20260508131647.43868-7-frederic@kernel.org
2026-06-02powerpc/time: Prepare to stop elapsing in dynticks-idleFrederic Weisbecker1-0/+41
Currently the tick subsystem stores the idle cputime accounting in private fields, allowing cohabitation with architecture idle vtime accounting. The former is fetched on online CPUs, the latter on offline CPUs. For consolidation purpose, architecture vtime accounting will continue to account the cputime but will make a break when the idle tick is stopped. The dyntick cputime accounting will then be relayed by the tick subsystem so that the idle cputime is still seen advancing coherently even when the tick isn't there to flush the idle vtime. Prepare for that and introduce three new APIs which will be used in subsequent patches: - vtime_dynticks_start() is deemed to be called when idle enters in dyntick mode. The idle cputime that elapsed so far is accumulated. - vtime_dynticks_stop() is deemed to be called when idle exits from dyntick mode. The vtime entry clocks are fast-forward to current time so that idle accounting restarts elapsing from now. - vtime_reset() is deemed to be called from dynticks idle IRQ entry to fast-forward the clock to current time so that the IRQ time is still accounted by vtime while nohz cputime is paused. Also accumulated vtime won't be flushed from dyntick-idle ticks to avoid accounting twice the idle cputime, along with nohz accounting. Signed-off-by: Frederic Weisbecker <frederic@kernel.org> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Tested-by: Shrikanth Hegde <sshegde@linux.ibm.com> Reviewed-by: Shrikanth Hegde <sshegde@linux.ibm.com> Link: https://patch.msgid.link/20260508131647.43868-6-frederic@kernel.org
2026-06-02Merge tag 'soc-fixes-7.1-2' of ↵Linus Torvalds9-27/+24
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC fixes from Arnd Bergmann: "Following the previous set of fixes, this addresses another significant number of small issues found in firmware drivers (tee, optee, qcomtee, qcom ice, exynos acpm) drivers through various tools. This is about error handling, resource leaks, concurrency and a use-after-free bug. The fixes for the Qualcomm ICE driver also introduce interface changes in the UFS and MMC drivers using it. Outside of firmware drivers, there are a few fixes across the tree: - Minor driver code mistakes in the Atmel EBI memory controller, the i.MX soc ID driver and socfpga boot logic - A defconfig change to avoid a boot time regression on multiple qualcomm boards - Device tree fixes for qualcomm, at91 and gemini, addressing mostly minor configuration mistakes" * tag 'soc-fixes-7.1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (28 commits) firmware: samsung: acpm: Fix infinite loop on sequence number exhaustion firmware: samsung: acpm: Fix missing LKMM barriers in sequence allocator firmware: samsung: acpm: Fix false timeouts and Use-After-Free in polling ARM: dts: gemini: Fix partition offsets ARM: socfpga: Fix OF node refcount leak in SMP setup soc: qcom: ice: Fix the error code when 'qcom,ice' property is not found arm64: dts: qcom: eliza: Add power-domain and iface clk for ice node arm64: dts: qcom: milos: Add power-domain and iface clk for ice node tee: qcomtee: add missing va_end in early return qcomtee_object_user_init() tee: fix params_from_user() error path in tee_ioctl_supp_recv tee: shm: fix shm leak in register_shm_helper() tee: fix tee_ioctl_object_invoke_arg padding arm64: defconfig: Enable PCI M.2 power sequencing driver scsi: ufs: ufs-qcom: Remove NULL check from devm_of_qcom_ice_get() mmc: sdhci-msm: Remove NULL check from devm_of_qcom_ice_get() soc: qcom: ice: Return proper error codes from devm_of_qcom_ice_get() instead of NULL soc: qcom: ice: Return -ENODEV if the ICE platform device is not found soc: qcom: ice: Fix race between qcom_ice_probe() and of_qcom_ice_get() ARM: dts: microchip: sam9x7: fix GMAC clock configuration firmware: samsung: acpm: Fix mailbox channel leak on probe error ...
2026-06-02ARM: dts: imx7: add nvmem-layoutAlexander Feilke1-0/+10
TQMa7 has board-information located in EEPROM at offset 0x20. Add necessary nodes and properties for nvmem cell. Signed-off-by: Alexander Feilke <Alexander.Feilke@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-02KVM: s390: Remove ptep_zap_softleaf_entry()Claudio Imbrenda1-20/+5
Migration entries do not need to be removed. The swap subsystem has been (and still is being) heavily reworked. The current implementation of ptep_zap_softleaf_entry() has been slowly modified and is now wrong, since it unconditionally calls swap_put_entries_direct() for both swap and migration entries. Remove ptep_zap_softleaf_entry() altogether, merge the path for proper swap entries directly in the only caller, and ignore migration entries. Fixes: 200197908dc4 ("KVM: s390: Refactor and split some gmap helpers") Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260602142356.169458-11-imbrenda@linux.ibm.com>
2026-06-02KVM: s390: Fix possible reference leak in fault-in codeClaudio Imbrenda1-8/+8
If kvm_s390_new_mmu_cache() fails, kvm_s390_faultin_gfn() returns without releasing the faulted page. Fix this by moving the allocation of the memory cache outside of the loop. There is no reason to check at every iteration. Opportunistically fix a comment. Fixes: e907ae530133 ("KVM: s390: Add helper functions for fault handling") Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260602142356.169458-10-imbrenda@linux.ibm.com>
2026-06-02KVM: s390: Prevent memslots outside the ASCE rangeClaudio Imbrenda1-5/+28
With KVM_S390_VM_MEM_LIMIT_SIZE, userspace can set the highest address allowed for the VM. Creating a memslot that lies over the maximum address does not make sense and is only a potential source of bugs. Prevent creation of memslots over the maximum address, and prevent the maximum address from being reduced below the end of existing memslots. Fixes: e38c884df921 ("KVM: s390: Switch to new gmap") Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260602142356.169458-9-imbrenda@linux.ibm.com>
2026-06-02KVM: x86: Take PIC lock on KVM_GET_IRQCHIP pathCarlos López1-0/+4
When userspace issues the KVM_SET_IRQCHIP ioctl to set the state of the PIC, kvm_vm_ioctl_set_irqchip() grabs @kvm->arch.vpic->lock before updating the state. However, the KVM_GET_IRQCHIP ioctl to retrieve the same PIC state does not grab such lock, potentially causing torn reads for userspace. Fix this by grabbing the lock on the read path. This issue goes all the way back. The bug was introduced with the addition of PIC ioctl code itself in 6ceb9d791eee ("KVM: Add get/ set irqchip ioctls for in-kernel PIC live migration support"). Later, 894a9c5543ab ("KVM: x86: missing locking in PIT/IRQCHIP/SET_BSP_CPU ioctl paths") added the locking for kvm_vm_ioctl_set_irqchip(), but missed kvm_vm_ioctl_get_irqchip(). Fixes: 6ceb9d791eee ("KVM: Add get/set irqchip ioctls for in-kernel PIC live migration support") Fixes: 894a9c5543ab ("KVM: x86: missing locking in PIT/IRQCHIP/SET_BSP_CPU ioctl paths") Reported-by: Claude Code:claude-opus-4.6 Signed-off-by: Carlos López <clopez@suse.de> Link: https://patch.msgid.link/20260529140013.14925-2-clopez@suse.de Signed-off-by: Sean Christopherson <seanjc@google.com>
2026-06-02arm64: mm: Unmap kernel data/bss entirely from the linear mapArd Biesheuvel1-4/+41
The linear aliases of the kernel text and rodata are also mapped read-only in the linear map. Given that the contents of these regions are mostly identical to the version in the loadable image, mapping them read-only and leaving their contents visible is a reasonable hardening measure. Data and bss, however, are now also mapped read-only but the contents of these regions are more likely to contain data that we'd rather not leak. So let's unmap these entirely in the linear map when the kernel is running normally. When going into hibernation or waking up from it, these regions need to be mapped, so map the region initially, and toggle the valid bit so map/unmap the region as needed. Doing so is required because pages covering the kernel image are marked as PageReserved, and therefore disregarded for snapshotting by the hibernate logic unless they are mapped. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Map the kernel data/bss read-only in the linear mapArd Biesheuvel1-2/+13
On systems where the bootloader adheres to the original arm64 boot protocol, the placement of the kernel in the physical address space is highly predictable, and this makes the placement of its linear alias in the kernel virtual address space equally predictable, given the lack of randomization of the linear map. The linear aliases of the kernel text and rodata regions are already mapped read-only, but the kernel data and bss are mapped read-write in this region. This is not needed, so map them read-only as well. Note that the statically allocated kernel page tables do need to be modifiable via the linear map, so leave these mapped read-write. Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02sh: Drop cache flush of the zero page at bootArd Biesheuvel1-3/+0
SuperH performs cache maintenance on the zero page during boot, presumably because before commit 6215d9f4470f ("arch, mm: consolidate empty_zero_page") the zero page did double duty as a boot params region, and was cleared separately, as it was not part of BSS. The memset() in question was dropped by that commit, but the __flush_wback_region() call remained. As empty_zero_page[] has been moved to BSS, it can be treated as any other BSS memory, and so the cache flush can be dropped. Cc: Yoshinori Sato <ysato@users.sourceforge.jp> Cc: Rich Felker <dalias@libc.org> Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> Cc: Mike Rapoport <rppt@kernel.org> Cc: Geert Uytterhoeven <geert+renesas@glider.be> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02powerpc/code-patching: Avoid r/w mapping of the zero pageArd Biesheuvel1-50/+2
The only remaining use of map_patch_area() is mapping the zero page, and immediately unmapping it again so that the intermediate page table levels are all guaranteed to be populated. The use of the zero page here is completely arbitrary, and not harmful per se, but currently, it creates a writable mapping, and does so in a manner that requires that the empty_zero_page[] symbol is not const-qualified. Given that this is about to change, and that map_patch_area() now never maps anything other than the zero page, let's simplify the code and - remove the helpers and call [un]map_kernel_page() directly - take the PA of empty_zero_page directly - create a read-only temporary mapping. This allows empty_zero_page[] to be repainted as const u8[] in a subsequent patch, without making substantial changes to this code patching logic. Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: Christophe Leroy (CS GROUP) <chleroy@kernel.org> Link: https://lore.kernel.org/all/20260520085423.485402-1-ardb@kernel.org/ Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Don't abuse memblock NOMAP to check for overlapsArd Biesheuvel1-16/+10
Now that the linear region mapping routines respect existing table mappings and contiguous block and page mappings, it is no longer needed to fiddle with the memblock tables to set and clear the NOMAP attribute in order to omit text and rodata when creating the linear map. Instead, map the kernel text and rodata alias first with the desired initial attributes and granularity, so that the loop iterating over the memblocks will not remap it in a manner that prevents it from being remapped with updated attributes later. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: Move fixmap and kasan page tables to end of kernel imageArd Biesheuvel4-5/+13
Move the fixmap and kasan page tables out of the BSS section, and place them at the end of the image, right before the init_pg_dir section where some of the other statically allocated page tables live. These page tables are currently the only data objects in vmlinux that are meant to be accessed via the kernel image's linear alias, and so placing them together allows the remainder of the data/bss section to be remapped read-only or unmapped entirely. Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Permit contiguous attribute for preliminary mappingsArd Biesheuvel1-7/+3
There are a few cases where we omit the contiguous hint for mappings that start out as read-write and are remapped read-only later, on the basis that manipulating live descriptors with the PTE_CONT attribute set is unsafe. When support for the contiguous hint was added to the code, the ARM ARM was ambiguous about this, and so we erred on the side of caution. In the meantime, this has been clarified [0], and regions that will be remapped in their entirety, retaining the contiguous bit on all entries, can use the contiguous hint both in the initial mapping as well as the one that replaces it. Note that this requires that the logic that may be called to remap overlapping regions respects existing valid descriptors that have the contiguous bit cleared. So omit the NO_CONT_MAPPINGS flag in places where it is unneeded. [0] RJQQTC For a TLB lookup in a contiguous region mapped by translation table entries that have consistent values for the Contiguous bit, but have the OA, attributes, or permissions misprogrammed, that TLB lookup is permitted to produce an OA, access permissions, and memory attributes that are consistent with any one of the programmed translation table values. Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: kfence: Avoid NOMAP tricks when mapping the early poolArd Biesheuvel1-21/+6
Now that the map_mem() routines respect existing page mappings and contiguous granule sized blocks with the contiguous bit cleared, there is no longer a reason to play tricks with the memblock NOMAP attribute. Instead, the kfence pool can be allocated and mapped with page granularity first, and this granularity will be respected when the rest of DRAM is mapped later, even if block and contiguous mappings are allowed for the remainder of those mappings. Add the NO_EXEC_MAPPINGS flag to ensure that hierarchical XN attributes are set on the intermediate page tables that are allocated when mapping the pool. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Permit contiguous descriptors to be manipulatedArd Biesheuvel1-4/+0
Currently, pgattr_change_is_safe() is overly pedantic when it comes to descriptors with the contiguous hint attribute set, as it rejects assignments even if the old and the new value are the same. In fact, as per ARM ARM RJQQTC, manipulating descriptors with the contiguous bit set is safe as long as the bit itself does not change value, in the sense that no TLB conflict aborts or other exceptions may be raised as a result. Inconsistent permission attributes within the contiguous region may result in any of the alternatives to be taken to apply to the entire region, which might be a programming error, but it does not constitute an unsafe manipulation in terms of what pgattr_change_is_safe() is intended to detect. So drop the special PTE_CONT check, but still omit PTE_CONT from 'mask' so that modifying the bit is still regarded as unsafe. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Preserve non-contiguous descriptors when mapping DRAMArd Biesheuvel2-2/+24
Instead of blindly overwriting existing live entries regardless of the value of their contiguous bit when mapping DRAM regions at contiguous-hint granularity, check whether the contiguous region in question contains any valid descriptors that have the contiguous bit cleared, and in that case, leave the contiguous bit unset on the entire region. This permits the logic of mapping the kernel's linear alias to be simplified in a subsequent patch. Note that this can only result in a misprogrammed contiguous bit (as per ARM ARM RNGLXZ) if the region in question already contains a mix of valid contiguous and valid non-contiguous descriptors, in which case it was already misprogrammed to begin with. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Preserve existing table mappings when mapping DRAMArd Biesheuvel1-2/+4
Instead of blindly overwriting an existing table entry when mapping DRAM regions, take care not to replace a pre-existing table entry with a block entry. This permits the logic of mapping the kernel's linear alias to be simplified in a subsequent patch. Reviewed-by: Ryan Roberts <ryan.roberts@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Check for pud_/pmd_set_huge() failures on kernel mappingsArd Biesheuvel1-2/+2
Sashiko reports: | If pmd_set_huge() rejects an unsafe page table transition (such as | mapping a different physical address over an existing block mapping), | it returns 0 and leaves the page table entry unmodified. | | Because *pmdp remains unmodified, READ_ONCE(pmd_val(*pmdp)) will equal | pmd_val(old_pmd). The transition from old_pmd to old_pmd is evaluated | as safe by pgattr_change_is_safe(), so the BUG_ON never triggers. | | This allows invalid and unsafe mapping updates to be silently dropped | instead of panicking, leaving stale memory mappings active while the | caller assumes the update was successful. The same applies to pud_set_huge() in alloc_init_pud(). Given how it is generally preferred to limp on rather than blow up the system if an unexpected condition such as this one occurs, and the fact that there are no known cases where this disparity results in real problems, let's WARN on these failures rather than BUG, allowing the system to survive to the point where it can actually report them. Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>
2026-06-02arm64: mm: Drop redundant pgd_t* argument from map_mem()Ard Biesheuvel1-13/+12
__map_memblock() and map_mem() always operate on swapper_pg_dir, so there is no need to pass around a pgd_t pointer between them. Reviewed-by: Ryan Roberts <ryan.roberts@arm.com> Reviewed-by: Kevin Brodsky <kevin.brodsky@arm.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Will Deacon <will@kernel.org>