mirror of
https://github.com/torvalds/linux.git
synced 2026-09-25 17:42:03 +02:00
master
5551 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
827751b699 |
RISC-V updates for v7.3-rc3
- Revert a bad fix, likely LLM-generated, in the pointer masking code
that confused the RISC-V hardware pointer masking implementation
with the Linux kernel tagged address feature
- Fix unexpected faults caused by kprobe instruction slot writes when
!CONFIG_STRICT_MODULE_RWX
- Fix unexpected faults on minimal configurations during runtime code
patching on !CONFIG_STRICT_MODULE_RWX systems
- Fix a misplaced variable clear causing incorrect reuse of previous
values in the RISC-V hardware feature probing code
- Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
than BIT on 64-bit masks; and use a bitmap rather than an unsigned
long on a quantity that can exceed 32 bits
And a few miscellaneous cleanups:
- Avoid a potential dereference-before-NULL-pointer-check bug in the
PMU SBI perf driver
- Simplify the rv32 bug table code by using
CONFIG_GENERIC_BUG_RELATIVE_POINTERS (following x86 and PPC)
- Report the RISC-V standard ISA extensions Z[v]fhmin when support is
claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
simplify our FPU test code to only check for the presence of the D
extension
- Use an existing kernel string helper in place of some open-coded
code in kernel/usercfi.c
- Fix some yamllint issues in the RISC-V DT bindings for CPUs
- Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into the
RISC-V CFI selftest code
- Update the translation for the simplified Chinese translation of the
RISC-V kernel patch acceptance policy
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmqghcoACgkQx4+xDQu9
KkvmEQ/7BVmPFuoR6OLNk2Eu8Exqen6a41KxdM/B91NJBEbBM60GAyejjWDXWmm0
K21yhRu58RGbfg2kKUJMvawzwIfuDswxCS31VtpDKnTrmP4HQz1Yvnh2M7jH9D2d
/wJCIYcJ0hJx0yDIZOUhU24aoy63ZXRygp8nTOgjkAxhkF31w+MJxTPDD0Ir7Eai
y4sRMTCabMonmyA0qozfnMoXaO3FkPv9l7pw/LHfqUYjaLNQyMHiiDPrRj1oNZPD
GQFUWykRgMccMW6kIgTJrjmzn7+vEJ7UZ/fvOD97+rGeaoyE19vcW8owUQWp6Hgb
Jq3WyS9HImrpCBTr079ht5lhu3ZucpAEP6sK5v/m4GOlBv1HdYHUS6JH0qo4DnXZ
aFrxg7WXxaFZ8dD3P8ErZkXy5Vid3+ZlpK//AOfWAqxX7q6c4K1w3lJm4bPKyNBX
vh3ASQr5oEj3KpGbihsrX2lVB/5LVP3pWTcH5f6rBBYiVFMMhWKLJXA3pjiRFN7v
ZXClKh5MznvS6ycMp5pXVYpVn2Kk+Y/mywsDqNRUigHwppkxI9MTJBq8+qcOiM9I
a7mHna4XHVVu0+B4/JMhkWgnGYRjFD6bsGzxPZODLFcmBUxmsoa5+HOENLAGdQ1w
s/Z2HmDO8yL37DxLq5O2aF3KNPSkXNBl+upQwj5lTTzR/bmghjc=
=oMU+
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"From a RISC-V point of view, there's one notable fix here, reverting
an earlier bogus fix to the pointer masking code. Fortunately the
practical impact appears to be small.
- Revert a bad fix, likely LLM-generated, in the pointer masking code
that confused the RISC-V hardware pointer masking implementation
with the Linux kernel tagged address feature
- Fix unexpected faults caused by kprobe instruction slot writes when
!CONFIG_STRICT_MODULE_RWX
- Fix unexpected faults on minimal configurations during runtime code
patching on !CONFIG_STRICT_MODULE_RWX systems
- Fix a misplaced variable clear causing incorrect reuse of previous
values in the RISC-V hardware feature probing code
- Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
than BIT on 64-bit masks; and use a bitmap rather than an unsigned
long on a quantity that can exceed 32 bits
And a few miscellaneous cleanups:
- Avoid a potential dereference-before-NULL-pointer-check bug in the
PMU SBI perf driver
- Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
table code (like x86 and PPC)
- Report the RISC-V standard ISA extensions Z[v]fhmin when support is
claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
simplify our FPU test code to only check for the presence of the D
extension
- Use an existing kernel string helper in place of some open-coded
code in kernel/usercfi.c
- Fix some yamllint issues in the RISC-V DT bindings for CPUs
- Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
the RISC-V CFI selftest code
- Update the translation for the simplified Chinese translation of
the RISC-V kernel patch acceptance policy"
* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
dt-bindings: riscv: cpus: Fix yamllint style issues
riscv: hwprobe: simplify has_fpu() to check D extension only
perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
perf: RISC-V: store available counter mask as bitmap
perf: RISC-V: use BIT_ULL for u64 overflow masks
riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
riscv: use string helper in setup_global_riscv_enable()
Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
riscv: patch: skip fixmap mapping when kernel text is already writable
riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
|
||
|
Linus Torvalds
|
2beb1b31a1 |
bpf-fixes
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmqdhRMACgkQ6rmadz2v
bTo8vRAAnP+x1z6FBOgHawGmmBpXtazoipRFeok/+/YGQ4SbS+evvFNvmkeCyihZ
7EeNHGuWEbA6xQBAcMf0StMjmr3jkJvUA6lsHSxBiFLpHGqNt0Fz9IXvAL/8QWPg
F7+CBs5A+J61i66LEmINbWzW1ujDf7baU/1VWui9zfPxnmPu40V/74eXzm6DmH/V
oHTsCscCYNe+N+Wix6B6nLrObY537fcJU12N56uqpkaSc0+6H1fBQJmyFGpYroTX
+4g+DNzEHyIYmt6B3+oDpbT0Zh/pP6ROq5TPDNJSSa+5B/uPo5C5pH520HwXF9hJ
04uaD7y2fpE809Nwl3OEK4ozpJ+mEGU1NKZPvFAxckY6GCiBtfbGd1etFno7r+4F
mZhNBKbQVEQX4XJUlcoqn9n7T2OCDnjiuneZAjIi4vUdevnSnakr0rCTFriiHP54
jg4fEkXxvYjPiqs5SQbxoGxmYSfg9fYaSfK4HgFdlfbwp+3Vmv4BW/tcsIJ9dcPs
L3YWkUU3znjbu2BLy0CP9fGt/1ik8p4/tA8vvZwz0yqpDMJkLy1TziGMef51UQ7k
1Pe/Ln5J3C6xnWs+3TRF11y8PuuCF0y47DGPACfwPoQxca1ufJ5fgmLXRRQToZe4
RjDmoeQvvI9w9kxh6gVhTHoiiEeD0wcQqx2CMHKTrU/PbM7d4Co=
=oz4Z
-----END PGP SIGNATURE-----
Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
"This mainly contains verifier fixes that address bugs reported by
Nicholas Carlini.
- Fix incorrect non-NULL inference in pointer comparisons: pointer
types that may be NULL at runtime, pointers with unbounded offsets,
JMP32 comparisons with zero, and imprecise zero registers (Eduard
Zingerman)
- Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
NULL call arguments (Eduard Zingerman)
- Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
patterns entered by a jump (Eduard Zingerman)
- Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
(Hui Su)
- Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
and reject key-less BTF for hash maps (Jiayuan Chen)
- Various fixes (Kumar Kartikeya Dwivedi):
- Fix out-of-bounds access in disassembler on invalid LDSX
instruction
- mark siginfo of signal tracepoints as scalar and
sched_process_wait argument as nullable
- mark faultable stack helpers as sleepable
- reject tail calls and legacy packet loads from callbacks
- enforce rbtree callback lock restrictions for resilient locks
- require MEM_PERCPU for percpu kptr stores
- clear NON_OWN_REF after RCU protection ends
- mark NULL kptr stores precise
- preserve inner map identity in callback frames
- reject non-scalar bpf_loop() iteration counts
- Fix trampoline allocation slowdown on x86 by using
EXECMEM_MODULE_DATA (Mike Rapoport)
- Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
reject untrusted allocated-object pointers (Ning Ding)
- Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
Yuan Chen)"
* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
bpf, riscv: Make arena support depend on ZACAS
selftests/bpf: Test pointer bpf_loop iteration count rejection
bpf: Reject non-scalar bpf_loop iteration counts
bpf: use mark_arg_precision() in check_mem_size_reg()
bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
selftests/bpf: precision of a NULL global subprogram BTF_ID argument
bpf: mark a NULL BTF_ID argument of a global subprogram precise
selftests/bpf: precision of a NULL kfunc argument
bpf: mark a NULL kfunc argument precise
selftests/bpf: precision of a NULL global subprogram memory argument
bpf: mark a NULL memory argument of a call precise
selftests/bpf: precision of a NULL helper argument
bpf: mark a NULL call argument precise
selftests/bpf: Test inner map identities in callbacks
bpf: Preserve inner map identity in callback frames
selftests/bpf: Test imprecise scalar kptr stores
bpf: Mark NULL kptr stores precise
selftests/bpf: Test rhtab kptr cancellation semantics
bpf: Cancel special fields when recycling rhtab elements
selftests/bpf: Test timer field on recycled rhtab element
...
|
||
|
Chen Pei
|
536b523b40
|
bpf, riscv: Make arena support depend on ZACAS
The arena range tree allocates its nodes with kmalloc_nolock() since commit |
||
|
Kees Cook
|
3a2c4d55e3 |
treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org> |
||
|
Andy Chiu
|
b94cec5761 |
riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
We can jump straight into the copy loop if the kernel is compiled for a hardware that natively supports misaligned access. The user copy bandwidth improvement on K3 and Ascaolon is shown as below: Misaligned user copy, size: 512B (offset: [0:15] except 0, 8) BW Improvement | Write | Read | K3 | 6.19% | 3.43% | Ascalon | 10.0% | 11.4% | Aligned user copy, size: 512B (offset: 0, 8) BW Improvement | Write | Read | K3 | 1.69% | 0.90% | Ascalon | 1.25% | 3.32% | Suggested-by: Anton Blanchard <antonb@tenstorrent.com> Signed-off-by: Andy Chiu <tchiu@tenstorrent.com> Link: https://patch.msgid.link/20260901192334.3543340-1-tchiu@tenstorrent.com Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Ivy Lopez
|
93a27367ba |
riscv: hwprobe: simplify has_fpu() to check D extension only
The kernel never supports D without F, since D depends on F. The D-extension flag is cleared during devicetree/ACPI parsing whenever F is not present, so has_fpu() checking either extension with '||' never actually produces a different result than checking D alone - F without D cannot occur in practice, and there is no observable impact on RISCV_HWPROBE_IMA_FD or userspace. Simplify has_fpu() to check D only, matching the expectations set elsewhere in the kernel for this dependency, rather than relying on a redundant OR condition. sys_hwprobe.c already calls has_fpu() and needs no changes. Link: https://bugzilla.kernel.org/show_bug.cgi?id=221874 Suggested-by: Conor Dooley <conor.dooley@microchip.com> Suggested-by: Andreas Schwab <schwab@suse.de> Signed-off-by: Ivy Lopez <skunkolee@gmail.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260901013746.19386-1-skunkolee@gmail.com [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
JinRui
|
248dbaf777 |
riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
The RISC-V ISA manual specifies that Zfh implies Zfhmin, a normative rule clarified in https://github.com/riscv/riscv-isa-manual/pull/3070. Zvfh likewise implies Zvfhmin, as stated by the vector extension specification. The kernel currently reports ZFH and ZFHMIN (and ZVFH and ZVFHMIN) as independent hwprobe bits derived only from what the device tree declares. Platforms that declare just "zfh" (Zfh being a superset that already contains all Zfhmin instructions) therefore report RISCV_HWPROBE_EXT_ZFHMIN=0, which breaks userspace RVA23 conformance checks (e.g. snapd installing core26 on riscv64). Use the existing superset mechanism to set the implied subset bits: - zfh implies zfhmin - zvfh implies zvfhmin Add a hwprobe selftest asserting the implication holds and update the hwprobe documentation accordingly. This is complementary to the rva23u64 base behavior discussion: the RVA23 conformance query proposed there is derived from the per-extension bits fixed here, so correct EXT_0 reporting is a prerequisite for it to work on harts whose device tree declares only "zfh". Tested on a RISC-V QEMU VM whose device tree only declares "zfh" and "zvfh": with this change both /proc/cpuinfo and the hwprobe RISCV_HWPROBE_KEY_IMA_EXT_0 bitmap report ZFHMIN and ZVFHMIN, and the hwprobe selftest (including the new implication check) passes. Link: https://lore.kernel.org/kvm-riscv/20260206002349.96740-1-andrew.jones@oss.qualcomm.com/ Signed-off-by: JinRui <jinrui@haiwei.tech> Link: https://patch.msgid.link/7190E4DB338251C3+20260811081513.2849980-1-jinrui@haiwei.tech [pjw@kernel.org: trimmed superfluous blank line in tags] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Jisheng Zhang
|
ddeaa39406 |
riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
x86 did this in commit |
||
|
Andy Chiu
|
d0fc6fab20 |
riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
The vendor-extension handlers reached from hwprobe_one_pair()
(hwprobe_isa_vendor_ext_thead_0() and friends) only OR the present bits
into pair->value via VENDOR_EXTENSION_SUPPORTED() and clear their own
missing bits; they assume the caller has already zeroed pair->value.
That holds for hwprobe_get_values() (it zeroes each pair) and
hwprobe_get_cpus() (it re-initializes its scratch pair per key), but not
for complete_hwprobe_vdso_data(), which reuses a single pair across all
keys without re-zeroing. A vendor key therefore inherits stale bits from
the previously probed key, and the wrong value is cached in the vDSO
all_cpu_hwprobe_values[] and handed to userspace on the fast patih.
Zero pair->value once at the top of hwprobe_one_pair() so every handler
starts from a clean value regardless of the caller, and drop the now
redundant zeroing in the *_BLOCK_SIZE cases. hwprobe_isa_ext0() keeps its
own zeroing because hwprobe_ext0_has() calls it directly, bypassing
hwprobe_one_pair().
Fixes:
|
||
|
Dmitry Antipov
|
12381af010 |
riscv: use string helper in setup_global_riscv_enable()
Prefer the convenient string choice 'str_disabled_enabled()' helper over hardcoded strings in 'setup_global_riscv_enable()'. Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru> Link: https://patch.msgid.link/20260819160546.3219942-1-dmantipov@yandex.ru Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Samuel Holland
|
2d2184ac90 |
Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
This reverts commit |
||
|
Xiaofeng Yuan
|
8718e5a309 |
riscv: patch: skip fixmap mapping when kernel text is already writable
patch_map() always creates a temporary writable mapping via fixmap for kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled and the kernel text is already mapped with _PAGE_WRITE. This is unnecessary overhead at best, and on minimal configurations it can cause page faults. Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX is not enabled, since the text pages are already writable in that case. The module text path is already gated on CONFIG_STRICT_MODULE_RWX and is kept unchanged. Reported-by: Klara Modin <klara@kasm.eu> Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/ Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com> Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/ Tested-by: Klara Modin <klarasmodin@gmail.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Link: https://patch.msgid.link/20260814082742.148403-3-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Xiaofeng Yuan
|
bdc46e507b |
riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create temporary writable mappings for read-only executable pages. In this case, the execmem ranges must already have writable permissions. Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC, which causes kprobe instruction slot writes to trigger page faults on systems where CONFIG_STRICT_MODULE_RWX is not enabled. Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX is not available. Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com> Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260814082742.148403-2-xiaofengmian@163.com Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Linus Torvalds
|
7bb6284aa7 |
Arm:
* Add support for 'slot' based PMU events, paired with new UAPI that
compels the user to select a specific PMU implementation
* Lazy save/restore of vCPU state for pKVM, along with various fixes
and cleanups to the management of vCPU state between the untrusted
host and pKVM hypervisor
* Disable traps of EL1 registers for nested hypervisors when FEAT_NV2p1
is present, guaranteeing that EL2-specific register bits are stateful
in the EL1 counterpart
* Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the scope
of those instructions remains 'in host' (i.e. L1 kernel/userspace)
* Pile of fixes for the management of the VNCR pseudo-TLB, such as
under-invalidations and races with concurrent TLBIs on other vCPUs
* Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
runtime-patched constant, allowing the same data to be shared with
pKVM prior to dropping host privileges
* Considerable pile of LLM-assisted fixes around the shop but mostly in
the VGIC, our in-kernel generator of bugs (and sometimes interrupts)
LoongArch:
* Advertise already-supported capabilities.
* Some bug fixes about timer and MMIO.
* Some hardening about interrupt injection.
* Replace kvm_err() with kvm_pr_unimpl().
* Add FPU/LSX/LASX test cases for selftests.
RISC-V:
* Svadu/Zicfiss/Zicfilp FWFT support for Guest
* Use try_cmpxchg for IMSIC MRIF RMW
* More arch-specific tracepoints in KVM RISC-V
* Eager page splitting when enabling dirty logging
* Optimize hfence request handling for SMP Guests
* Improve dirty log clearing by skipping zero bits in mask
* Guard HFENCE range loops against overflow
* CPU PM notifiers in KVM RISC-V for non-retentive idle states
* Fix kernel-mode vector context save/restore for Guest
s390:
* Fixes for vfio-ap
* Fixes for the gmap rework
* Fixes for vsie
* AI triggered fixes all over
* diag9c tracing
* code move preparation for the additional arm64 support
* enable CONTEXT_ANALYSIS
x86:
* Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding regs.c
(the kvm_cache_regs.h => regs.h is already applied) and msrs.{c,h}, and moving
relevant code out of x86.c.
* Split kvm_mmu in three parts, respectively to describe the format of page
tables, walking the guest page tables and building the page tables. Always
use the same page table walker kvm->arch.gva_walk as the entry point to
convert a guest's virtual address, where the previous code used two
different kvm_mmu structs depending on whether the walk included nested
EPT/NPT or not. Make page fault vmexits reuse the permission checking
machinery that is used for guest page faults. This is both a cleanup
and a baby step towards supporting XS/XU memory permissions.
* Document some of the "fun" gotchas with the APIC base when creating IRQCHIPs
on x86.
* Remove a defunct masterclock update from kvm_xen_shared_info_init(). It
could result in incorrect kvmclock due to triggering an unnecessary
switch to/from masterclock mode.
* Skip Xen runstate time updates if time has effectively gone backwards, so
that the guest doesn't report 100% steal time for a very, very long time.
* Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM was
updating the wrong sub-leaf, and upstream KVM will soon provide all the
information needed by userspace to populate the CPUID field itself.
* Fix a bug where KVM would walk a newly created rmap without holding the rmap
lock (or mmu_lock) during aging.
* Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs.
* Fix a variety of #DB priority bugs.
* Fix a class of races related to enabling Hyper-V emulation on a vCPU after
the vCPU is visible to the rest of KVM.
* Use static calls for nested virtualization ops.
* Move more KVM-internal code out of x86's kvm_host.h.
* Enumerate support for a variety of Zhaoxin instructions that don't require
explicit virtualization.
* Fix missing EFER validation bugs, including in the KVM_SET_SREGS* path.
* Harden kvm_vcpu_map() against double-mapping and thus leaking references.
* Misc fixes and cleanups, e.g. for largely benign syzkaller splats.
x86 (Intel):
* Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used for IPI
virtualization when the vCPU is freed, to fix a use-after-free where hardware
will write to a freed vCPU's PID.
* Service local TLB flushes on a failed nested VM-Enter to fix a bug where KVM
could miss a TLB on a future, successful VM-Enter with the same L2 VPID.
* Cap the maximum value shoved into the VMX Preemption Timer to workaround an
erratum that affects all existing Intel CPUs that support CPUID 0x15.
* Fix VPID virtualization bugs where KVM would fail to flush hardware TLBs.
* Harden the TDX "populate" ioctls against bad input, and to prepare
for supporting in-place private<=>shared conversion.
x86 (AMD):
* Forcefully invalidate SNP VMSA pages if their backing guest_memfd page is
zapped/invalidated, e.g. due to a PUNCH_HOLE in response to a Page-State
Change request.
* Remove a dying VM from the GA Log notifier list before the VM is actually
destroyed, to fix a potential use-after-free.
* While FOLL_WRITE was needed in the past to trigger CoW unsharing, nowadays
FOLL_LONGTERM does that already even without FOLL_WRITE, and in fact,
get_user_pages() actually disallows FOLL_WRITE together with FOLL_LONGTERM.
So don't pass FOLL_WRITE when registering encrypted memory regions, i.e. when
pinning SEV/SEV-ES guest memory, to fix a regression with file-backed memory
introduced by KVM's (correct) usage of long-term pins.
(This was reviewed by mm maintainers; for more information, see commit
|
||
|
Linus Torvalds
|
ed3b875bea |
mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
Total patches: 501
Reviews/patch: 1.66
Reviewed rate: 70%
Excluding DAMON:
Total patches: 356
Reviews/patch: 2.26
Reviewed rate: 90%
Excluding DAMON and selftests:
Total patches: 329
Reviews/patch: 2.31
Reviewed rate: 92%
Excluding DAMON, selftests and maple_tree:
Total patches: 328
Reviews/patch: 2.31
Reviewed rate: 92%
Summary of patch series in this merge:
- The 2 patch series "mm: drop "sub" prefix from various places" from
Dev Jain implements some page->folio conversion and a naming cleanup.
- The 2 patch series "mm/kasan: remove redundant initialization for
kasan_flag_write_only" from Igor Putko provides some KASAN cleanup work.
- The 2 patch series "mm/filemap: reduce unnecessary xarray lookups"
from Chi Zhiling provides a small speedup in the pagecaache read code.
- The 4 patch series "mm/percpu: Fix possible NOFS/NOIO reclaim
recursion" from Kaitao Cheng improves a few things in the vmalloc code -
mainly the avoidance of GFP_KERNEL allocations when the caller asked for
GFP_NOFS or GFP_NOIO.
- The 3 patch series "mm/kmemleak: avoid soft lockup when scanning task
stacks" from Breno Leitao avoids a soft lockup watchdog trigger from the
kmemleak scanning code in extreme situations.
- The 6 patch series "mm/page_owner: misc cleanups" from Ye Liu is a
collection of unrelated cleanups to the page_owner code. For some
reason lots of people have been working on the page_owner code this
cycle.
- The 4 patch series "mm: convert to walk_page_range_vma() to eliminate
find_vma()" from Kefeng Wang simplifies and accelerates the page walking
library function.
- The 3 patch series "mm/migrate: preparatory cleanups for batch copy
and offload" from Shivank Garg implements cleanups in the migration
code.
- The 4 patch series "mm/page_owner: add per-fd filter infrastructure
for print_mode and NUMA filtering" from Zhen Ni provides per-fd
filtering to page_owner in order to reduce the sometimes vast amount of
output it can produce.
- The 19 patch series "mm: Refactor bootmem gigantic hugepage
allocation" from Muchun Song is a "set of fixes and preparatory cleanups
around bootmem HugeTLB handling, sparse initialization ordering, and
related vmemmap setup".
- The 4 patch series "mm/zsmalloc: reduce lock contention in zs_free()"
from Wenchao Hao reduces lock contention in zs_free(), which dominates
the unmap path under memory pressure on Android (LMK kills) and on x86
servers running zswap-heavy workloads. Up to 1.83x improvement in
microbenchmarking.
- The 2 patch series "move alloc_tag.c file under mm/" from Suren
Baghdasaryan does that.
- The 6 patch series "samples/damon: handle damon_{start,stop}()
failures" from SJ Park fixes improper handling of damon_start(),
damon_stop(), and damon_call() failures across DAMON sample modules to
prevent potential memory leaks, operation disruptions and use-after-free
bugs.
- The 11 patch series "mm/damon/sysfs: kobject_del() directories that
users can create/remove" from SJ Park resolves an issue where delayed
sysfs directory removal under CONFIG_DEBUG_KOBJECT_RELEASE causes
creation failures due to duplicate directory names by adding missing
kobject_del() calls before creating new directories.
- The 3 patch series "mm: cleanup clear_not_present_full_ptes()" from
David Hildenbrand cleans up the core pte handling code.
- The 3 patch series "selftests/damon: misc fixes for test bugs" from
Kunwu Chan fixes several bugs in the DAMON selftests.
- The 2 patch series "selftests/damon: fix memcg_path staging handling"
from Cheng Nie fixes a bug in _damon_sysfs.py for damos_filter
memcg_path setup, and adds a test case for it in sysfs.py.
- The 2 patch series "selftests/damon: test kdamond refresh_ms" from
Ruslan Valiyev introduces selftest coverage for DAMON's refresh_ms sysfs
feature by updating the test control module and verifying that scheme
stats update automatically without manual intervention.
- The 5 patch series "mm/damon: five misc fixups" from Akinobu Mita
contains miscellaneous DAMON fixups.
- The 2 patch series "mm/damon/core: detect internal variation above
max_nr_regions/2" from Jiayuan Chen fixes DAMON's region splitting
behavior when region counts exceed half the maximum budget by
dynamically scaling down the split fraction as the limit approaches,
preventing large regions from staying un-split, and adds corresponding
KUnit test coverage.
- The 6 patch series "mm: preparatory patches for PMD level swap
entries" from Usama Arif refactors and cleans up PMD softleaf helpers,
call sites, and architecture flags to lay the groundwork for a follow-up
series that introduces PMD page table swap entries.
- The 11 patch series "mm/damon: update, optimize, and clean up doc,
tests, and code" from SJ Park updates DAMON design and ABI
documentation, expands unit and selftest coverage, optimizes
damon_commit_target_regions(), and cleans up recently added sysfs
interface code for better readability.
- The 2 patch series "mm/vmpressure: reduce CPU, memory and code
overhead on cgroup v2" from Usama Arif optimizes vmpressure() by
skipping unnecessary work on cgroup v2 for userspace event notifications
and refactors v1-only eventfd handling into mm/memcontrol-v1.c to reduce
memory overhead and code complexity.
- The 10 patch series "selftests/mm: refactor pkey helpers and fix mmap
error handling" from Hongfu Li refactors pkeys shared tracing and
assertion helpers into a common file, unifies protection key selftests
to use consistent diagnostic logging and assertions, and enforces
standardized MAP_FAILED return checks for mmap() calls across the tests.
- The 18 patch series "mm/damon: optimize out nr_accesses_bp" from SJ
Park replaces the error-prone, continuously updated nr_accesses_bp field
in damon_region with an on-demand moving sum function
(damon_nr_accesses_mvsum()), reducing structure memory overhead and
avoiding state corruption bugs.
- The 6 patch series "Open HugeTLB allocation routine for more generic
use" from Ackerley Tng decouples HugeTLB folio allocation from VMA
dependencies by introducing hugetlb_alloc_folio(), enabling subsystems
like guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs.
- The 3 patch series "mm/damon: provide pseudo moving sum probe_hits"
from SJ Park integrates DAMON's probe_hits attribute counter into the
pseudo moving sum infrastructure, enabling real-time, online monitoring
without waiting for full aggregation intervals.
- The 18 patch series "mm: Some cleanups for page allocator APIs" from
Brendan Jackman simplifies and refactors the page allocator entry points
and flags by unifying allocation paths, adding internal alloc_flags
arguments, and eliminating redundant __ prefixed alloc_pages variants.
- The 5 patch series "Fix incorrect access of hugetlb pte entries" from
Dev Jain enforces the consistent use of huge_ptep_get() instead of
ptep_get() for HugeTLB entries and fixes an unaligned address issue in
arm64's huge_ptep_get() implementation.
- The 8 patch series "mm/damon: validate all parameters in the core"
from SJ Park consolidates parameter validation into the DAMON core
specifically within damon_start() and damon_commit_ctx() to centralize
error checking, eliminate caller-side redundant checks and to improve
maintenance efficiency.
- The 3 patch series "tools/mm/page_owner_sort: fix filtering and
cleanup issues" from Yichong Chen renames is_need() to filter_record()
for clearer return semantics, fixes per-record allocation memory leaks
and bounds output copies in search_pattern() to address an existing
buffer issue.
- The 4 patch series "memcg: bail out reclaim when memcg is dying" from
Jiayuan Chen mitigates a system-wide stall which occurs when a cgroup is
removed while one of its memory control files is doing synchronous
reclaim.
- The 5 patch series "mm/memory-failure: add panic option for
unrecoverable pages" from Breno Leitao introduces an opt-in
vm.panic_on_unrecoverable_memory_failure sysctl that immediately panics
the kernel on unrecoverable memory errors in kernel-owned pages to
preserve error context and prevent delayed, silent data corruption.
- The 11 patch series "mm/damon: refactor damon_{start,stop,commit}()
for simple error handling" from SJ Park refactors the DAMON core API
functions to guarantee that all contexts are fully stopped when
damon_start(), damon_stop(), or damon_commit() fail, eliminating the
need for complex and error-prone caller-side cleanup code.
- The 5 patch series "Keep tail page private zero at free and folio
split" from Zi Yan adds checks to ensure tail_page->private is zero when
freeing compound or high-order pages and when promoting tail pages
during large folio splits. By validating these fields at free and split
time, it allows the removal of redundant private field clearing inside
prep_compound_tail().
- The 4 patch series "mm: drop redundant lru_add_drain in anon folio
reuse paths" from Barry Song eliminates redundant lru_add_drain() calls
in wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead.
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads.
- The 3 patch series "mm: clean up folio LRU and swap declarations" from
Jianyue Wu reorganizes folio LRU and swap code by relocating
page-cluster state to mm/swap_state.c, renaming mm/swap.c to mm/folio.c,
and moving MM-internal reclaim declarations into mm/internal.h.
- The 15 patch series "userfaultfd: working set tracking for VM guest
memory" from Kiryl Shutsemau adds userfaultfd support for tracking the
working set of VM guest memory, so a VMM can identify hot pages and
reclaim cold ones to tiered or remote storage.
- The 10 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part
2)" from David Hildenbrand removes the remaining pieces of
CONFIG_HAVE_BOOTMEM_INFO_NODE, performing some smaller cleanups around
freeing of reserved vmemmap pages on the way.
- The 7 patch series "mm/damon: update probe hits for runtime parameter
commits" from SJ Park ensures that DAMON's probe_hits attribute counter
is properly updated when monitoring intervals are changed at runtime,
matching the behavior of nr_accesses. To achieve this, it refactors and
renames existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- The 3 patch series "KSM: performance optimizations for rmap_walk_ksm"
from xu xin resolves a severe KSM reverse-mapping performance bottleneck
where thousands of split VMAs sharing a single anon_vma cause extended
lock contention. By adding an interval-filtering check during the rmap
walk, it reduces worst-case anon_vma lock hold times from over 500ms
down to under 2ms, preventing application freezes and latency spikes
under memory pressure.
- The 3 patch series "mm: split a couple of headers from internal.h"
from Mike Rapoport splits declarations related to mm_init, memblock,
vmalloc and sparse into new headers.
- The 2 patch series "KSM: use linear_page_index in collect_procs_ksm()"
from xu xin applies the interval tree optimization from rmap_walk_ksm()
to collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling. It hoists loop-invariant address
initialization and restricts the anon_vma_interval_tree_foreach walk to
a targeted page offset range, reducing redundant checks and improving
lookup efficiency.
- The 3 patch series "selftests/mm: avoid false failures in hugetlb and
KSM tests" from Sayali Patil fixes issues in the hugetlb and KSM MM
selftest categories that can report failures when the prerequisites for
the tests are not satisfied.
- The 19 patch series "mm/damon: introduce data attributes only
monitoring" from SJ Park introduces attribute-weighted region management
in DAMON, allowing users to prioritize specific data attributes (such as
page sizes or cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely disable
access tracking and adjust monitoring regions based on weighted
probe-hit counters to optimize monitoring quality for attribute-focused
workloads.
- The 8 patch series "mm/hmm: Add mmap lock-drop support for
userfaultfd-backed mappings" from Stanislav Kinsburskii extends
hmm_range_fault() to support userfaultfd-backed regions by allowing the
mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd regions
while preserving backward compatibility for existing callers.
- The 33 patch series "mm: make VMA page offset handling more
consistent" from Lorenzo Stoakes cleans up and standardizes how
vma->vm_pgoff is accessed and manipulated across file-backed and
anonymous mappings in the kernel.
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while renaming
rmap interval tree helpers to better reflect their functionality.
These changes establish a cleaner foundation for future work that will
unify virtual page offset indexing for all anonymous and CoW'd folios.
- The 3 patch series "mm: handle device-private PMDs in walk callbacks"
from Usama Arif addresses kernel panics and state corruption caused by
MM walk callbacks reaching non-present device-private PMD swap entries
created during HMM migrations.
It ensures that functions which acquire pmd_trans_huge_lock() properly
recognize device-private PMDs instead of assuming a present THP or a
standard migration entry.
- The 5 patch series "mm/rmap: Refactor try_to_unmap_one" from Dev Jain
refactors try_to_unmap_one by modularizing Hugetlb, anonymous-lazyfree,
and anonymous-swapbacked logic into dedicated functions, laying the
structural groundwork for batched anonymous large folio unmapping.
- The 4 patch series "Docs/ABI/damon: sysfs ABI document fixes and
additions" from Song Hu fixes typos and fills in missing entries in the
DAMON sysfs ABI document.
- The 10 patch series "dax/kmem: atomic whole-device hotplug via sysfs"
from Gregory Price introduces an atomic sysfs state attribute and
supporting DAX/MM infrastructure to prevent userland races when
offlining and removing entire memory regions.
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- The 13 patch series "mm: convert more vm_flags_t users to vma_flags_t"
from Lorenzo Stoakes continues transitioning the kernel from the
deprecated vm_flags_t type to vma_flags_t across core memory management
infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- The 2 patch series "Two small patches to clean up mm/mm_slot.h" from
xu xin refactors mm_slot.h by introducing mm_slot_remove() to unify
duplicate slot deletion sequences in khugepaged and KSM. It also adds
code documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- The 10 patch series "mm/damon/core: hide core-private struct fields"
from SJ Park cleans up DAMON core structures by consistently marking
internal-only fields with private: comment tags to prevent improper
direct access from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- The 6 patch series "mm/damon: unurgent fixes for infinite loop, NULL
de-ref and races" from SJ Park addresses potential infinite loops, NULL
dereferences, and race conditions identified in DAMON.
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- The 2 patch series "mm/page_alloc: fixes for free_pages_nolock() on
RT/UP" from Brendan Jackman fixes an NMI safety flaw in
__free_frozen_pages() where freeing pages on non-SMP or PREEMPT_RT
kernels can bypass can_spin_trylock() checks via non-PCP or isolated
migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- The 4 patch series "mm/page_alloc: couple of followups for recent
cleanups" from Brendan Jackman cleans up and updates page allocator
nomenclature, documentation, and debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete VM_BUG_ON()
assertions in allocation paths.
- The 3 patch series "mm/mseal: further cleanups" from Lorenzo Stoakes
refactors and simplifies the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO, eliminates
mm_struct parameters to enforce that sealing applies only to
current->mm, and streamlines overall logic and comments with no
functional changes intended.
- The 4 patch series "mm/vmscan: fix swappiness=max and clean up
per-node proactive reclaim" from Ridong Chen resolves reclaim behavior
bugs and cleans up function parameters across memory reclaim paths.
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead of
collapsing all failures into -EAGAIN, and removes the obsolete gfp_mask
parameter from __node_reclaim().
- The 6 patch series "mm: mincore: misc cleanups" from Kefeng Wang
cleans up and simplifies the mincore code. Most importantly, it removes
the historical special behavior that always reports VM_PFNMAP pages as
non-resident.
- The 2 patch series "mm/huge_memory: drop dead split helper variants"
from Kiryl Shutsemau implements two trivial cleanups in the folio split
API.
- The 7 patch series "mm/damon: fix uninitialized DAMOS field and kunit
exec expectation bugs" from SJ Park resolves minor operational and
testing bugs in DAMON identified by Sashiko. It initializes the
damos->last_applied field to prevent occasional efficiency degradation
and fixes invalid memory accesses in DAMON KUnit tests during test
failure handling.
- The 3 patch series "cleanup for stable_page_flags()" from Jinjiang Tu
cleans up and refactors stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- The 3 patch series "Batch unmap of uffd-wp file folios" from Dev Jain
extends batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching capabilities
to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- The 3 patch series "mm/early_ioremap: clarify and clean up
early_ioremap_reset()" from Sang-Heon Jeon clarifies and cleans up the
architecture-specific usage of __late_set_fixmap() and
__late_clear_fixmap() after early_ioremap_reset().
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset calls
in the RISC-V and ARM64 architectures.
- The 4 patch series "mm: fix reclaim storms in defrag_mode" from
Johannes Weiner addresses severe performance regressions, swap storms,
and spurious OOMs caused by vm.defrag_mode=1 under high memory pressure
in Meta production.
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- The 2 patch series "zram: lockmap tweaks" from Sebastian Siewior
optimizes and fixes lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolating lock classes across multiple instances.
It reduces memory overhead by replacing per-entry lockdep_map instances
with a single map per struct zram, and assigns a dynamic lock_class_key
to each instance to prevent false deadlock reports when different zram
devices are backed by distinct filesystems.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCaoUJbQAKCRDdBJ7gKXxA
jqrzAP9WoPU0hiK4qS/kSjhtoZxhjpS5eLSUCy/utKuEvZbfGgEAu1zA+LH+X9Tm
THK5ex4iUZxiFbXpWfLMxE/Q9PmQYQ8=
=QTyb
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:
- "mm: drop "sub" prefix from various places" (Dev Jain)
page->folio conversion and a naming cleanup
- "mm/kasan: remove redundant initialization for kasan_flag_write_only"
(Igor Putko)
KASAN cleanup work
- "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)
Small speedup in the pagecaache read code
- "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)
Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
allocations when the caller asked for GFP_NOFS or GFP_NOIO
- "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
Leitao)
Avoid a soft lockup watchdog trigger from the kmemleak scanning code
in extreme situations
- "mm/page_owner: misc cleanups" (Ye Liu)
Cleanups to the page_owner code. For some reason lots of people have
been working on the page_owner code this cycle.
- "mm: convert to walk_page_range_vma() to eliminate find_vma()"
(Kefeng Wang)
Simplify and accelerate the page walking library function
- "mm/migrate: preparatory cleanups for batch copy and offload"
(Shivank Garg)
Cleanups in the migration code
- "mm/page_owner: add per-fd filter infrastructure for print_mode and
NUMA filtering" (Zhen Ni)
Per-fd filtering to page_owner in order to reduce the sometimes vast
amount of output it can produce
- "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)
Fixes and preparatory cleanups around bootmem HugeTLB handling,
sparse initialization ordering, and related vmemmap setup
- "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)
Reduce lock contention in zs_free(), which dominates the unmap path
under memory pressure on Android (LMK kills) and on x86 servers
running zswap-heavy workloads.
Up to 1.83x improvement in microbenchmarking.
- "move alloc_tag.c file under mm/" (Suren Baghdasaryan)
- "samples/damon: handle damon_{start,stop}() failures" (SJ Park)
Fix improper handling of damon_start(), damon_stop(), and
damon_call() failures across DAMON sample modules to prevent
potential memory leaks, operation disruptions and use-after-free
bugs
- "mm/damon/sysfs: kobject_del() directories that users can
create/remove" (SJ Park)
Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
causeing creation failures due to duplicate directory names by adding
missing kobject_del() calls before creating new directories
- "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)
Clean up the core pte handling code
- "selftests/damon: misc fixes for test bugs" (Kunwu Chan)
Fix several bugs in the DAMON selftests
- "selftests/damon: fix memcg_path staging handling" (Cheng Nie)
Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
add a test case for it in sysfs.py.
- "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)
Selftest coverage for DAMON's refresh_ms sysfs feature by updating
the test control module and verifying that scheme stats update
automatically without manual intervention
- "mm/damon: five misc fixups" (Akinobu Mita)
Miscellaneous DAMON fixups.
- "mm/damon/core: detect internal variation above max_nr_regions/2"
(Jiayuan Chen)
Fix DAMON's region splitting behavior when region counts exceed half
the maximum budget by dynamically scaling down the split fraction as
the limit approaches, preventing large regions from staying un-split,
and add corresponding KUnit test coverage
- "mm: preparatory patches for PMD level swap entries" (Usama Arif)
Refactor and clean up PMD softleaf helpers, call sites, and
architecture flags to lay the groundwork for a follow-up series that
introduces PMD page table swap entries
- "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
Park)
Update DAMON design and ABI documentation, expands unit and selftest
coverage, optimize damon_commit_target_regions(), and clean up
recently added sysfs interface code for better readability
- "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
(Usama Arif)
Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
userspace event notifications and refactor v1-only eventfd handling
into mm/memcontrol-v1.c to reduce memory overhead and code complexity
- "selftests/mm: refactor pkey helpers and fix mmap error handling"
(Hongfu Li)
Refactor pkeys shared tracing and assertion helpers into a common
file, unify protection key selftests to use consistent diagnostic
logging and assertions, and enforce standardized MAP_FAILED return
checks for mmap() calls across the tests
- "mm/damon: optimize out nr_accesses_bp" (SJ Park)
Replace the error-prone, continuously updated nr_accesses_bp field in
damon_region with an on-demand moving sum function, reducing
structure memory overhead and avoiding state corruption bugs
- "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)
Decouple HugeTLB folio allocation from VMA dependencies by
introducing hugetlb_alloc_folio(), enabling subsystems like
guest_memfd to allocate HugeTLB folios without standard VMA
reservations or pseudo-VMAs
- "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)
Integrate DAMON's probe_hits attribute counter into the pseudo moving
sum infrastructure, enabling real-time, online monitoring without
waiting for full aggregation intervals
- "mm: Some cleanups for page allocator APIs" (Brendan Jackman)
Simplify and refactor the page allocator entry points and flags by
unifying allocation paths, adding internal alloc_flags arguments, and
eliminating redundant __ prefixed alloc_pages variants.
- "Fix incorrect access of hugetlb pte entries" (Dev Jain)
Enforce the consistent use of huge_ptep_get() instead of ptep_get()
for HugeTLB entries and fixes an unaligned address issue in arm64's
huge_ptep_get() implementation
- "mm/damon: validate all parameters in the core" (SJ Park)
Consolidate parameter validation into the DAMON core specifically
within damon_start() and damon_commit_ctx() to centralize error
checking, eliminate caller-side redundant checks and to improve
maintenance efficiency
- "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
Chen)
Rename is_need() to filter_record() for clearer return semantics, fix
per-record allocation memory leaks and bound output copies in
search_pattern() to address an existing buffer issue
- "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)
Mitigate a system-wide stall which occurs when a cgroup is removed
while one of its memory control files is doing synchronous reclaim
- "mm/memory-failure: add panic option for unrecoverable pages" (Breno
Leitao)
Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
that immediately panics the kernel on unrecoverable memory errors in
kernel-owned pages to preserve error context and prevent delayed,
silent data corruption
- "mm/damon: refactor damon_{start,stop,commit}() for simple error
handling" (SJ Park)
Refactor the DAMON core API functions to guarantee that all contexts
are fully stopped when damon_start(), damon_stop(), or damon_commit()
fail, eliminating the need for complex and error-prone caller-side
cleanup code
- "Keep tail page private zero at free and folio split" (Zi Yan)
Add checks to ensure tail_page->private is zero when freeing compound
or high-order pages and when promoting tail pages during large folio
splits. By validating these fields at free and split time, it allows
the removal of redundant private field clearing inside
prep_compound_tail()
- "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
Song)
Eliminate redundant lru_add_drain() calls in
wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
contention and system overhead
By validating folio refcounts against the LRU cache before draining
and removing unnecessary drains in the swap path, it achieves up to a
30.5% reduction in drain calls during heavy swap workloads
- "mm: clean up folio LRU and swap declarations" (Jianyue Wu)
Reorganize folio LRU and swap code by relocating page-cluster state
to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
MM-internal reclaim declarations into mm/internal.h.
- "userfaultfd: working set tracking for VM guest memory" (Kiryl
Shutsemau)
Add userfaultfd support for tracking the working set of VM guest
memory, so a VMM can identify hot pages and reclaim cold ones to
tiered or remote storage
- "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
Hildenbrand)
Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
performing some smaller cleanups around freeing of reserved vmemmap
pages on the way.
- "mm/damon: update probe hits for runtime parameter commits" (SJ Park)
Ensure that DAMON's probe_hits attribute counter is properly updated
when monitoring intervals are changed at runtime, matching the
behavior of nr_accesses. To achieve this, it refactors and renames
existing helper functions for shared use, applies the updates to
probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
maintain measurement accuracy.
- "KSM: performance optimizations for rmap_walk_ksm" (xu xin)
Resolve a severe KSM reverse-mapping performance bottleneck where
thousands of split VMAs sharing a single anon_vma cause extended lock
contention.
By adding an interval-filtering check during the rmap walk, it
reduces worst-case anon_vma lock hold times from over 500ms down to
under 2ms, preventing application freezes and latency spikes under
memory pressure.
- "mm: split a couple of headers from internal.h" (Mike Rapoport)
Split declarations related to mm_init, memblock, vmalloc and sparse
into new headers
- "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)
Apply the interval tree optimization from rmap_walk_ksm() to
collect_procs_ksm() to avoid iterating over non-matching VMAs during
KSM memory error handling.
It hoists loop-invariant address initialization and restricts the
anon_vma_interval_tree_foreach walk to a targeted page offset range,
reducing redundant checks and improving lookup efficiency.
- "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
Patil)
Fix issues in the hugetlb and KSM MM selftest categories that can
report failures when the prerequisites for the tests are not
satisfied
- "mm/damon: introduce data attributes only monitoring" (SJ Park)
Introduce attribute-weighted region management in DAMON, allowing
users to prioritize specific data attributes (such as page sizes or
cgroups) over or instead of access monitoring.
By assigning weights to attribute probes, DAMON can completely
disable access tracking and adjust monitoring regions based on
weighted probe-hit counters to optimize monitoring quality for
attribute-focused workloads.
- "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
(Stanislav Kinsburskii)
Extend hmm_range_fault() to support userfaultfd-backed regions by
allowing the mmap lock to be dropped during fault handling via a new
hmm_range_fault_locked() helper.
By accepting a locked pointer and signaling retry status when lock
release occurs, it enables page fault resolution in userfaultfd
regions while preserving backward compatibility for existing callers.
- "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)
Clean up and standardize how vma->vm_pgoff is accessed and
manipulated across file-backed and anonymous mappings in the kernel
It introduces dedicated helper functions such as vma_start_pgoff(),
vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
renaming rmap interval tree helpers to better reflect their
functionality.
These changes establish a cleaner foundation for future work that
will unify virtual page offset indexing for all anonymous and CoW'd
folios.
- "mm: handle device-private PMDs in walk callbacks" (Usama Arif)
Address kernel panics and state corruption caused by MM walk
callbacks reaching non-present device-private PMD swap entries
created during HMM migrations
It ensures that functions which acquire pmd_trans_huge_lock()
properly recognize device-private PMDs instead of assuming a present
THP or a standard migration entry.
- "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)
Refactor try_to_unmap_one by modularizing Hugetlb,
anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
functions, laying the structural groundwork for batched anonymous
large folio unmapping.
- "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)
Fix typos and fills in missing entries in the DAMON sysfs ABI
document
- "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)
Introduce an atomic sysfs state attribute and supporting DAX/MM
infrastructure to prevent userland races when offlining and removing
entire memory regions
By adding an unplugged state alongside standard online modes, it
enables whole-device atomic hotplug control while preserving backward
compatibility.
- "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)
Continue transitioning the kernel from the deprecated vm_flags_t type
to vma_flags_t across core memory management infrastructure.
It replaces legacy type usage in core functions such as do_mmap(),
unmapped area allocation, mm->def_vma_flags, and VMA operations like
mlock, mprotect, and mremap.
- "Two small patches to clean up mm/mm_slot.h" (xu xin)
Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
slot deletion sequences in khugepaged and KSM. It also adds code
documentation explaining why mm_slot_lookup and mm_slot_insert must
remain as preprocessor macros rather than static inline functions.
- "mm/damon/core: hide core-private struct fields" (SJ Park)
Clean up DAMON core structures by consistently marking internal-only
fields with private: comment tags to prevent improper direct access
from outer layers.
It enforces encapsulation across core structures including
damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
interact through approved access APIs instead of exposing raw struct
members.
- "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
(SJ Park)
Address potential infinite loops, NULL dereferences, and race
conditions identified in DAMON
It fixes an infinite loop triggered by extreme user configurations, a
NULL pointer dereference within unit tests and minor monitoring
accuracy degradation caused by subtle runtime races.
- "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
Jackman)
Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
via non-PCP or isolated migration paths.
It also resolves potential kernel crashes and privilege escalation
risks triggered when BPF tracing runs in NMI context alongside memory
hotplug or large allocation frees.
- "mm/page_alloc: couple of followups for recent cleanups" (Brendan
Jackman)
Clean up and update page allocator nomenclature, documentation, and
debug assertions.
It aligns internal FPI_ flags with the public "nolock" naming
convention, removes outdated internal implementation details from
high-level page allocator comments, and eliminates obsolete
VM_BUG_ON() assertions in allocation paths.
- "mm/mseal: further cleanups" (Lorenzo Stoakes)
Refactor and simplify the mseal implementation by clarifying API
boundaries and removing unnecessary code complexity.
It replaces generic do_mseal() usage outside the syscall with a
dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
eliminates mm_struct parameters to enforce that sealing applies only
to current->mm, and streamlines overall logic and comments with no
functional changes intended.
- "mm/vmscan: fix swappiness=max and clean up per-node proactive
reclaim" (Ridong Chen)
Resolve reclaim behavior bugs and clean up function parameters across
memory reclaim paths
It fixes swappiness=max in both standard reclaim and MGLRU so
unswappable anonymous memory no longer falls back to evicting page
cache, ensures reclaim_store() returns accurate error codes instead
of collapsing all failures into -EAGAIN, and removes the obsolete
gfp_mask parameter from __node_reclaim().
- "mm: mincore: misc cleanups" (Kefeng Wang)
Clean up and simplifies the mincore code. Most importantly, it
removes the historical special behavior that always reports VM_PFNMAP
pages as non-resident.
- "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)
Two trivial cleanups in the folio split API
- "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
bugs" (SJ Park)
Resolve minor operational and testing bugs in DAMON identified by
Sashiko. It initializes the damos->last_applied field to prevent
occasional efficiency degradation and fixes invalid memory accesses
in DAMON KUnit tests during test failure handling.
- "cleanup for stable_page_flags()" (Jinjiang Tu)
Clean up and refactor stable_page_flags() used by /proc/kpageflags
without altering functionality.
It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
bits, converts folio-specific flag checks to standard folio_test_*()
helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.
- "Batch unmap of uffd-wp file folios" (Dev Jain)
Extend batched folio unmapping support to file folios within
userfaultfd write-protect (uffd-wp) VMAs by adding batching
capabilities to pte_install_uffd_wp_if_needed().
This removes special-case restrictions on uffd-wp VMAs in
try_to_unmap_one(), significantly simplifying the function's control
flow and complexity.
- "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
(Sang-Heon Jeon)
Clarify and clean up the architecture-specific usage of
__late_set_fixmap() and __late_clear_fixmap() after
early_ioremap_reset()
It adds explicit documentation regarding when early_ioremap_reset()
must be called and removes redundant macro definitions and reset
calls in the RISC-V and ARM64 architectures.
- "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)
Address severe performance regressions, swap storms, and spurious
OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
production
It updates the page allocator slowpath so non-movable allocation
requests actively trigger direct reclaim and direct compaction at
pageblock_order scale, allowing them to claim whole pageblocks rather
than spinning unproductively.
- "zram: lockmap tweaks" (Sebastian Siewior)
Optimize and fix lockdep tracking for zram devices by consolidating
per-entry lockmaps and isolate lock classes across multiple instances
This reduces memory overhead by replacing per-entry lockdep_map
instances with a single map per struct zram, and assigns a dynamic
lock_class_key to each instance to prevent false deadlock reports
when different zram devices are backed by distinct filesystems.
* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
selftests/mm: unpoison pages in memory-failure teardown
mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
mm/zsmalloc: fix release order of locks in zs_page_migrate()
Documentation: zram: remove sections numbering
ksm: stop iterating VMAs when ksm_test_exit returns true
mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
zram: use a custom key for each zram object
zram: move lockmap to be per-zram instead per table
selftests/mm: fix gup_longterm EINVAL error message
mm: page_alloc: fix non-movable reclaim storm in defrag_mode
mm: page_alloc: move capture_control to the page allocator
mm: compaction: support non-movable compaction for pageblock requests
mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
hugetlb: evaluate subpool free state while locked
mm/damon: remove trailing semicolons after function definitions
mm/damon/ops-common: prevent migration fallback to non-target nodes
mm/damon: update outdated comment about DAMOS filter handling
...
|
||
|
Linus Torvalds
|
073e62fd33 |
RISC-V updates for v7.3
- Add initial definitions and discovery for the Smcsrind, Sscsrind, Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse, Za64rs, and Ssqosid RISC-V ISA extensions - Improve the RISC-V update_mmu_cache_range() implementation by using flush-by-ASID, enabling performance improvements on microarchitectures that support related optimizations; and by taking advantage of the Svinval RISC-V ISA extension on microarchitectures that support it - Shrink CFI shadow stack allocation further (to 512MB) to save virtual address space (and physical memory on systems with strict overcommit policies) - Add initial CPU context switch support for QoS tagging (Ssqosid) - Change our vector misaligned access speed test code to be synchronous, avoiding a bunch of bugs related to unnecessary asynchronicity - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table debugging (similar to ARM64 and x86) - Extract vDSO section offsets at build time, rather than run time, to avoid the boot time overhead - Use assembler directives to control the use of instructions from the RISC-V ISA extensions Zacas and Zabha, rather than compiler -march flags that could affect the whole kernel (similar to ARM64) - Add a kselftest for kprobes support for the c.jal instruction on RISC-V - When UEFI runtime services are available, use them to restart and power off - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing include file to the ACPI code - Move contiguous DMA memory reservation later in the boot, to ensure that the correct global and per-node pools are allocated when CONFIG_CMA_SIZE_PERNUMA is enabled - Disallow probes on breakpoint handlers to avoid recursing indefinitely into do_trap_break() - Patch the compat vDSO during runtime alternatives processing, not only the standard vDSO - Remove some leftover XIP support elements missed by commit |
||
|
Linus Torvalds
|
5a8cd539ac |
Major changes:
- Redesign the verifier error reporting: failures now carry source and
instruction annotations along with the causal event history that led
to them, making program rejections far easier to debug and repair
(Kumar Kartikeya Dwivedi)
- Add arena argument support to kfuncs and struct_ops through the new
__arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
Kumar Kartikeya Dwivedi, Ihor Solodrai)
- Signed BPF program loader rework to accommodate both BPF and security
community needs where the kernel runs the signature verification at
BPF_PROG_LOAD time before the LSM admission hook (Daniel Borkmann)
- Add a set of ksock kfuncs which let BPF LSM and syscall programs
create, connect and send on UDP sockets in order to emit telemetry
data (Mahe Tardy)
- Unify helper and kfunc call argument verification and classify kfunc
arguments purely from BTF into a generated bpf_func_proto which is
computed once at add-call time (Amery Hung)
Other features and fixes:
- Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)
- Add bidirectional VLAN support to bpf_fib_lookup() through the new
BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags
(Avinash Duduskar)
- Infer zext_dst from static register liveness analysis to fix 32-bit
zero-extension semantics, and remove the artificial limitations on
pointer types eligible for spilling (Eduard Zingerman)
- Inline the numeric open-coded iterator kfuncs so that bpf_for() loops
no longer pay a kfunc call on every iteration (Puranjay Mohan)
- Add an arena-based bitmap data structure to libarena along with
serial and parallel selftests (Emil Tsalapatis)
- Teach resolve_btfids to discover kfuncs from the kernel's BTF ID sets
and to emit kfunc BTF decl tags, reducing the kernel build's
dependency on pahole features (Ihor Solodrai)
- Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
tunnel decapsulation can update the GSO and encapsulation state of
the skb (Nick Hudson)
- Fix the ring buffer pending_pos walk and the available-data
accounting on 32-bit position wrap (Israel Téllez García)
- Add memory usage accounting for arena maps and fix an mmap_lock
deadlock on arena lock failure (Jiayuan Chen)
- Add tracing_multi link info support to the kernel UAPI and bpftool,
and refactor the stack map code to run with preemption disabled
(Jiri Olsa)
- Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
egress direction of the target's peer device (Jordan Rife)
- Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
modules, can declare kfuncs safe to call under bpf_spin_lock instead
of relying on the verifier's hard-coded allowlist (Kaitao Cheng)
- Introduce global percpu data for BPF programs with libbpf probing
and bpftool skeleton support, and stop exposing uninitialized kernel
heap memory when copying per-CPU map values (Leon Hwang)
- Add s390 JIT support for load-acquire and store-release instructions
(Maxim Khmelevskii)
- Fix a CFI mismatch in the task work callback and an arm64 KASAN
false positive after bpf_throw() (Mykyta Yatsenko)
- Reject writes through untrusted BTF pointers and bound the
rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)
- Invalidate RCU pointers only after the final spin unlock and account
for preempt and IRQ disabled regions as overlapping RCU protection
(Ning Ding)
- Support mixing bpf2bpf calls and tail calls on RV64, add signed
operations and 32-bit atomics to the RV32 JIT, and add timed may_goto
support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)
- Fix a use-after-free on mm_struct in bpf_find_vma() for foreign tasks
and an mmap_lock leak in the irq_work path (Sanghyun Park)
- Populate mmap-able BPF array map memory lazily which makes mmap() O(1)
instead of proportional to the map size (Song Liu)
- Introduce a jit_required flag and reject programs with inlined
helpers when no JIT is available, where the interpreter would
otherwise jump into an invalid address (Tiezhu Yang)
- Fix the x86 JIT per-CPU address resolution into an extended register
where the REX prefix dropped the high destination register bit
(Vineet Gupta)
- Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
the arena base, and mixed arena and ordinary atomic paths
(Yiyang Chen)
- Fix the trampoline handling of 128-bit arguments and of return values
larger than 8 bytes (Yonghong Song)
- Ensure that any fault prone load is rewritten with exception table
handling, and fix the arena load-acquire and atomic fetch handling
in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)
- Many more fixes and cleanups across the verifier, arena, trampolines,
sockmap, cgroup, ring buffer, x86/arm64/riscv/s390 JITs, libbpf,
bpftool, resolve_btfids and selftests.
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-----BEGIN PGP SIGNATURE-----
iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCaoNzBBUcZGFuaWVsQGlv
Z2VhcmJveC5uZXQACgkQ2yufC7HISIOb3QEAy5cyrLXY+VWofhsC9wULkHyETOdj
oTkdohQomZp4VhEA/1RZXdHVS1ANFgreWv0fMorUOHEKv2ZuNokfk3LWgW4L
=VRyL
-----END PGP SIGNATURE-----
Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Daniel Borkmann:
"Major changes:
- Redesign the verifier error reporting: failures now carry source
and instruction annotations along with the causal event history
that led to them, making program rejections far easier to debug and
repair (Kumar Kartikeya Dwivedi)
- Add arena argument support to kfuncs and struct_ops through the new
__arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
Kumar Kartikeya Dwivedi, Ihor Solodrai)
- Signed BPF program loader rework to accommodate both BPF and
security community needs where the kernel runs the signature
verification at BPF_PROG_LOAD time before the LSM admission hook
(Daniel Borkmann)
- Add a set of ksock kfuncs which let BPF LSM and syscall programs
create, connect and send on UDP sockets in order to emit telemetry
data (Mahe Tardy)
- Unify helper and kfunc call argument verification and classify
kfunc arguments purely from BTF into a generated bpf_func_proto
which is computed once at add-call time (Amery Hung)
Other features and fixes:
- Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)
- Add bidirectional VLAN support to bpf_fib_lookup() through the new
BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash
Duduskar)
- Infer zext_dst from static register liveness analysis to fix 32-bit
zero-extension semantics, and remove the artificial limitations on
pointer types eligible for spilling (Eduard Zingerman)
- Inline the numeric open-coded iterator kfuncs so that bpf_for()
loops no longer pay a kfunc call on every iteration (Puranjay
Mohan)
- Add an arena-based bitmap data structure to libarena along with
serial and parallel selftests (Emil Tsalapatis)
- Teach resolve_btfids to discover kfuncs from the kernel's BTF ID
sets and to emit kfunc BTF decl tags, reducing the kernel build's
dependency on pahole features (Ihor Solodrai)
- Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
tunnel decapsulation can update the GSO and encapsulation state of
the skb (Nick Hudson)
- Fix the ring buffer pending_pos walk and the available-data
accounting on 32-bit position wrap (Israel Téllez García)
- Add memory usage accounting for arena maps and fix an mmap_lock
deadlock on arena lock failure (Jiayuan Chen)
- Add tracing_multi link info support to the kernel UAPI and bpftool,
and refactor the stack map code to run with preemption disabled
(Jiri Olsa)
- Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
egress direction of the target's peer device (Jordan Rife)
- Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
modules, can declare kfuncs safe to call under bpf_spin_lock
instead of relying on the verifier's hard-coded allowlist (Kaitao
Cheng)
- Introduce global percpu data for BPF programs with libbpf probing
and bpftool skeleton support, and stop exposing uninitialized
kernel heap memory when copying per-CPU map values (Leon Hwang)
- Add s390 JIT support for load-acquire and store-release
instructions (Maxim Khmelevskii)
- Fix a CFI mismatch in the task work callback and an arm64 KASAN
false positive after bpf_throw() (Mykyta Yatsenko)
- Reject writes through untrusted BTF pointers and bound the
rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)
- Invalidate RCU pointers only after the final spin unlock and
account for preempt and IRQ disabled regions as overlapping RCU
protection (Ning Ding)
- Support mixing bpf2bpf calls and tail calls on RV64, add signed
operations and 32-bit atomics to the RV32 JIT, and add timed
may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)
- Fix a use-after-free on mm_struct in bpf_find_vma() for foreign
tasks and an mmap_lock leak in the irq_work path (Sanghyun Park)
- Populate mmap-able BPF array map memory lazily which makes mmap()
O(1) instead of proportional to the map size (Song Liu)
- Introduce a jit_required flag and reject programs with inlined
helpers when no JIT is available, where the interpreter would
otherwise jump into an invalid address (Tiezhu Yang)
- Fix the x86 JIT per-CPU address resolution into an extended
register where the REX prefix dropped the high destination register
bit (Vineet Gupta)
- Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
the arena base, and mixed arena and ordinary atomic paths (Yiyang
Chen)
- Fix the trampoline handling of 128-bit arguments and of return
values larger than 8 bytes (Yonghong Song)
- Ensure that any fault prone load is rewritten with exception table
handling, and fix the arena load-acquire and atomic fetch handling
in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)
- Many more fixes and cleanups across the verifier, arena,
trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390
JITs, libbpf, bpftool, resolve_btfids and selftests"
* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits)
selftests/bpf: Add tests for a store on a fault prone qdisc pointer
selftests/bpf: Add tests for fault prone loads out of RCU pointers
selftests/bpf: Add tests for pointer type merge at a shared load
selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
selftests/bpf: Retry stat generation in cgroup_iter_memcg
selftests/bpf: Test pseudo-function policy diagnostics
bpf: Distinguish function references in policy diagnostics
bpf: Preserve source attribution without source text
selftests/bpf: Test kfunc argument diagnostics
bpf: Correct kfunc argument diagnostics
bpf: Use canonical stack argument names in diagnostics
bpf: Preserve R0 lineage across helper calls
selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
bpf: Reject negative optlen in cgroup getsockopt hook
selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
bpf: Clear decap state on skb_adjust_room shrink path
bpf: Allow new DECAP flags and add guard rails
bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
bpf: Refactor masks for ADJ_ROOM flags and encap validation
bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
...
|
||
|
Linus Torvalds
|
6eb1ea5ff4 |
soc: defconfig updates for 7.3
Just the usual updates to the main defconfig files as well as the omap2 specific one, to enable more loadable modules for better default hardware support. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqDZfQACgkQmmx57+YA GNmmRA//b6TBVM2OAAqAM+gjUeY1pGQJab3kJHGpE+13vOn39PhQv8/V8qUcv9mv i9w15ivsaS/KKjTYuGc09A7fctSt5g1oPY2PA5v3d4ao4dygqVEIGwUIE0hldNAy 1BZF+dMoRd07doKFZesG1d0l85Mec5j999OI+MluFfSWwO9sg8Ht9LxAwHCwrxcl Go4oJd16l47FIJ4G6eE8qa+qUy44zWeamhQGpEStQOyQIZsFjAk1OFpIvdRH7MEg zB0T41vTtYuxyZ8gEv71rrDkK74HS/Zychxw+I7snhna5jTfh11smm1zr9fHUiwN 93vrrzqqpldanJiExaAxF9z5LLYTajpQB/uM7Em5ytD+zSxlra1r/KCQrfmRGjdZ XdaP25vx6ivUhyJDFUPXzb6s8ujmybxdNfn7uxq24IzwZAsntJEvP1hbpSssZP7K s7Z0kCfjUurvVXiIC557AHI38C1tH7IN+shFR1I+Iql8K4X1tWODWWp8ghLryQxe V92F7WghM1wgE72M38sN3/knkNr/OjCJp2sjkl1rLxEtHWXg1sXS3uvxALiOAPsu z363cPF3L0FmlaEiZ577D+7q864fowbfgpZJzsaY4Xij7zE1XILUgThQRRPwno9S dwhgnUmy5rAc8SsF9K+tGWMQVlUneVKgZe+Evh4uFdBIfc4T47E= =iSun -----END PGP SIGNATURE----- Merge tag 'soc-defconfig-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC defconfig updates from Arnd Bergmann: "Just the usual updates to the main defconfig files as well as the omap2 specific one, to enable more loadable modules for better default hardware support" * tag 'soc-defconfig-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: riscv: defconfig: thead: enable PCA953X GPIO driver arm64: defconfig: Enable drivers for BeagleBadge arm64: defconfig: Enable Qualcomm BAM-DMUX WWAN driver arm64: defconfig: Enable Sound DMIC driver arm: omap2plus_defconfig: Enable multi-LED arm64: defconfig: Enable Qualcomm reference device EC driver ARM: omap2plus_defconfig: enable things required by iwd arm: multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x and AM335x arm64: defconfig: Enable Allwinner LRADC input driver |
||
|
Linus Torvalds
|
cbe8aadf15 |
soc: devicetree updates for 7.3
There are two new mystery SoCs with very little public information
about them so far, Qualcomm's Cortex-A78C based "Shikra" and
Altera's Cortex-A720 based Agilex72 SOCFPGA.
We have also gained support for a couple of SoCs from the
2023/2024 timeframe that have been in the making for a while:
- The Apple platform gains support for M3 Pro, Max and Ultra SoC,
following the basic M3 support from 7.2.
- Samsung Exynos 1580 is a high-end mobile phone SoC from 2024
- Canaan K230 is a RISC-V based 64-bit AI SoC, based on the
earlier K210 chip
- Sophgo SG2000 is a mixed Arm/RISC-V chip that was already
supported using the Arm core but is now also added for RISC-V
along with several other variants of the cv18xx series
In terms of newly added machines we have reference platforms
for all the chips above, plus
- only four 32-bit Arm boards: two older phones and two
older industrial/embedded boards; using Allwinner, Qualcomm and
Rockchip SoCs
- Three laptops und three phones using Qualcomm SoCs
- Ten 64-bit Rockchips based single-board computers, along with one
NAS box and a game console.
- Seven industrial/embedded boards and modules using NXP i.MX8/9 SoCs.
- A Lenovo desktop box based on NVIDIA Jetson Xavier NX
- A few more single-board computers based on Allwinnner A133,
Spacemit K1 and TI AM62.
As usual, there is a constant stream of minor cleanups and fixes
towards addressing the 'dt-check-style --mode strict' warnings,
and everyone is expected to address those warnings for new
submissions now.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqDZaMACgkQmmx57+YA
GNkkiRAAusVNTkNVcpq+QGDhd6DfLd+d4vcvTJkBZ5WyJuqKs1qZPFIMQ0iMW1cY
hahBeYoowRX1oaB7KZc/MBE0IkOna35CEwiL6dm553xq+P208auqpNLpXTSKWsvx
jW4eYpdA6Bt6SM9J/583Ix71b5UFsLV+W3YKT2CBUZYn9yilAEz6kPa/Hxxa1Sia
3841Fdy6jcqusw1alzLQvrR7FxdtPFCs1f/a/GzBmZI7fxnj/cBwVghinSF9F0XW
BzDaUjMDzBYqSlMb7auNH0IpDeVuTx2Pch+YLrE8YVVPVf3nawd48ziwXO6zRsGx
HccLDuHpBqwnHsAh+bWi9UdxUSzjGW4KQ/W8Fj6O2SNqxPqrK2hyRYMp+76Tl65x
2diQOajmnZ4m8E5ToWsxpRxrlo6TKo33W63HglGIA24vr0gEi9FpA3kYiaWP2ZBD
qZz5xMeRmO1son1vtWX1CzsWFdogqBuGdztOyMoY4viSeY/ltT1EvIC0AiTIeSOt
krOFFDxwHvu+HOPJJ15VCVwEutUnGytB2nwBc/krhNS6MSlwg9DpY53RAhBxl0Jh
KXpPqBUpbl0Flty2rxdPx2EAt7MqeLTNXSSdzP7tvvumsT1Ik+zlPk+MkgLZ0Y5u
71fJrcij+0LeFDCzw81jGLoYSCw+9aNaELcF+OluL6rK8YFaBOE=
=RQan
-----END PGP SIGNATURE-----
Merge tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC devicetree updates from Arnd Bergmann:
"There are two new mystery SoCs with very little public information
about them so far, Qualcomm's Cortex-A78C based "Shikra" and Altera's
Cortex-A720 based Agilex72 SOCFPGA.
We have also gained support for a couple of SoCs from the 2023/2024
timeframe that have been in the making for a while:
- The Apple platform gains support for M3 Pro, Max and Ultra SoC,
following the basic M3 support from 7.2.
- Samsung Exynos 1580 is a high-end mobile phone SoC from 2024
- Canaan K230 is a RISC-V based 64-bit AI SoC, based on the earlier
K210 chip
- Sophgo SG2000 is a mixed Arm/RISC-V chip that was already supported
using the Arm core but is now also added for RISC-V along with
several other variants of the cv18xx series
In terms of newly added machines we have reference platforms for all
the chips above, plus
- Only four 32-bit Arm boards: two older phones and two older
industrial/embedded boards; using Allwinner, Qualcomm and Rockchip
SoCs
- Three laptops und three phones using Qualcomm SoCs
- Ten 64-bit Rockchips based single-board computers, along with one
NAS box and a game console.
- Seven industrial/embedded boards and modules using NXP i.MX8/9
SoCs.
- A Lenovo desktop box based on NVIDIA Jetson Xavier NX
- A few more single-board computers based on Allwinnner A133,
Spacemit K1 and TI AM62.
As usual, there is a constant stream of minor cleanups and fixes
towards addressing the 'dt-check-style --mode strict' warnings, and
everyone is expected to address those warnings for new submissions
now"
* tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (864 commits)
Revert "riscv: dts: spacemit: k3: add i2s0-i2s5 nodes"
Documentation/process: maintainer-soc: Mention expectation about dt-check-style
ARM: dts: helios4: add SATA regulator supplies
ARM: dts: helios4: add vcc-supply to GPIO expander
ARM: dts: helios4: add vcc-supply to EEPROM
arm64: dts: turris-mox: fix usb3 phys
arm64: dts: ti: Correct white-space style
arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
arm64: dts: qcom: talos-evk: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: eliza-mtp: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: glymur: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: kaanapali: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
...
|
||
|
Linus Torvalds
|
104a813376 |
VDSO updates:
- Consolidate the VDSO datastore further and provide support for
mlock_all() and prefaulting.
- Provide 32-bit legacy time related functionality only if
CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists, but
architecture code still exposes the legacy functionality even disabled.
Clean this up by adding the missing guards and validating at build time
that the VDSO is legacy free if disabled.
- Consolidate the VDSO related config options in core and drivers, which
removes some non-sensical dependencies and quite an amount of #ifdeffery.
- Clean up the PAGE_SIZE definition maze
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCxfkQHHRnbHhAa2Vy
bmVsLm9yZwAKCRCmGPVMDXSYoSQkEADEOmcrm3vwMbaElrAfQRp4MOQMnDpKPCDa
0EwdkXKJyqfOGx1PNKbcWZe10qShpXqyz+q3MUbHiOVh7KxkaGj0GOA/+xD+Tgs5
RAFXCq+CY4Ccjix7vlyOBLvGgomuznAtRDCFprVq5OTXyQfVvS++5SHzaU/0xXiY
ZZEInrFP61BEJ8LJycpoN5431EBcUX7XpSkr9eHtuSOslOBzbTEtBbDp0AjDGse0
5qM/oZDufZDQQr31kVQiL0dN9bBWwdGNtBwZBjsf6KioY9M00LO0E9twSCSrI39F
kgD2N97RDjTewu/zEe0fvCDVypqel2mBvjfiYU4c8g6pprdJ4Hq1qMcDAtMBUDBZ
9jR8B09eYZwHLdbM5PFjiMf9d6p25P7X+twFI9Hylcm1YZtM4OTnamDhQOQDp1Fd
QdrFevXg1zvYVi1rrDYarcPfg/tGsetOTujMQ1m50/AJZOoEdcX9jZR/wfdW8ti6
X9TIn3SDzhauXkmeR86tHxtOmHDirVfBWCCCEyVT2YzGIIje25cf266fCPdcGRYl
kzhtycg8LqpTRMWjhlaf56NtD9qQlbvDY8L23tQLJUYhDp8xOxqyuRPRdpJVM0b3
4vp/Z8Sgz8tpEHO2ARsXfuu2CzilTBH0B2KL3f+a8CwpzIEadjIfc+6EEYqwgOAn
+/RhckFp/A==
=jHl1
-----END PGP SIGNATURE-----
Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:
- Consolidate the VDSO datastore further and provide support for
mlock_all() and prefaulting.
- Provide 32-bit legacy time related functionality only if
CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists,
but architecture code still exposes the legacy functionality even
disabled.
Clean this up by adding the missing guards and validating at build
time that the VDSO is legacy free if disabled.
- Consolidate the VDSO related config options in core and drivers,
which removes some non-sensical dependencies and quite an amount of
#ifdeffery.
- Clean up the PAGE_SIZE definition maze
* tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits)
random: vDSO: Drop custom PAGE_SIZE definitions
LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY
kbuild: Support generated asm-headers in subdirectories
vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE
vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files
vdso: Automatically select HAVE_GENERIC_VDSO if necessary
MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO
vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA
futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK
vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions
sparc: vdso: Respect COMPAT_32BIT_TIME
MIPS: VDSO: Respect COMPAT_32BIT_TIME
powerpc/vdso: Respect COMPAT_32BIT_TIME
ARM: VDSO: Respect COMPAT_32BIT_TIME
arm64: vdso32: Respect COMPAT_32BIT_TIME
...
|
||
|
Linus Torvalds
|
030c9f813b |
Treewide timer related cleanups:
- Remove the leftover CLOCK_TICK_RATE which has been scheduled for
removal more than a decade ago along with some now empty asm/timex.h
files.
- Consolidate delay timer calibration
The construct of having a define in a header requires that
architectures provided asm/timex.h for no reason. Also the function
name for reading the delay timer is confusing at best.
Use a config switch to enable that functionality and rename the
function to delay_read_timer() to make the purpose clear.
This removes some more now empty asm/timex.h files as well.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCuTUQHHRnbHhAa2Vy
bmVsLm9yZwAKCRCmGPVMDXSYoU77EACd8W1/bIYBW1XtlNMrc5PLS0wCIG55D793
03ebljTfGGfrNcPJIXHXT7yQLaUF7me/4d3xv1SCbDOjv2dR+Ma5Bhq7DpgIaNaj
xUTvKT+mEsSXbh+sFd/2rrqQ3fPAfDiobDA3yEnuV/8zfCqtrFf5dGRAvobw3yl8
kdGSp3PCF5O/0ynpqUnJ1/fdWft2wNA8B0MT322MU4X+DVvTWv4wxDGStA8mnVv/
x6kCNnCe2KRIwi6pZBhodjhl+BYHdMh6c0nJOrmTNKyrfcUMKbnttyfyvAKX9uPZ
L5XDVLy8n8iC7P1FZMGipAylGI4abhQgDz6RXAwEygjC+S/ppjc7HFcx17TdzKYa
0BzgWOsdDbbtorB4Ro24x6aNBW2ReN8UJsNSH2ZlmdtHH861uOsAJCfCkpCLMdRF
Ysbj6gFSn6sf9l0TyPlJds53r5B1L4CNOM4UKztNRoZ944wvTD+J78homvmjlF75
JcfQD7YvDEqgolfZNkmWoMJe5HU9pZk0mcYxpnj/Xa3HCm2M7qE8iWq4EesCxAXW
C+IBpTVaZyf2h1jo47ZLeYYFXXSz3F542jmuC/EiLNFNT8MEFtG59+1x1KbcaHlh
hmi72YncoW2QES6yzjCNyuVq687A3bKs+bCkKVXkn5vlFodilnLgJUZ2sK5yIAU7
hI1IpZLl1A==
=V0WX
-----END PGP SIGNATURE-----
Merge tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull treewide timer related cleanups from Thomas Gleixner:
- Remove the leftover CLOCK_TICK_RATE which has been scheduled for
removal more than a decade ago along with some now empty asm/timex.h
files.
- Consolidate delay timer calibration
The construct of having a define in a header requires that
architectures provided asm/timex.h for no reason. Also the function
name for reading the delay timer is confusing at best.
Use a config switch to enable that functionality and rename the
function to delay_read_timer() to make the purpose clear.
This removes some more now empty asm/timex.h files as well.
* tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
calibrate: Rework delay timer calibration
treewide: Remove CLOCK_TICK_RATE
x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATE
|
||
|
Linus Torvalds
|
3424d8c18a |
Generic entry code updates:
- Make syscall user dispatching configurable
Not all architectures can makes use of syscall user dispatching. Allow
them to disable the feature completely.
- Consolidate stack randomization for the generic entry code and the
architectures using it.
Stack randomization on syscall entry was sprinkled throughout the
architecture specific low level entry code and in some cases at the
wrong points, e.g. before establishing state, which violates the
non-instrumentable constraints of that code.
Clean this up by integrating stack randomization into the generic entry
code helpers so that it is invoked at the earliest possible point right
after establishing state and converting all generic entry code using
architecture over.
- Clean up the syscall number handling in the generic entry code. It
works correctly for architectures which have a separate return value
storage in pt_regs, but fails to distinguish the case where user space
handed in -1 as syscall number from the case where the entry code
rejects it by returning -1 to the callers. Aside of that the return
value functionality of those interfaces is not really intuitive.
Fix this by separating the decision to reject a syscall (user dispatch,
ptrace, seccomp ...) from the potential modification of the syscall
number through these mechanisms.
This solves most of the problems for architectures which do not have a
separate return value storage in pt_regs except for the case where a
tracepoint has a BPF script or a probe attached which overwrite both
the syscall number and the return value. But that's a problem which
cannot be solved in the generic code, that only can be addressed by
separating the storage model in the affected architectures.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmqCs10QHHRnbHhAa2Vy
bmVsLm9yZwAKCRCmGPVMDXSYoaf6D/0ZBG1Yb0/C/6lrI185qPu38aGOROuAcxP+
RV1O1x6C83w2hCLBH8LeswY2x4/iGbdftne/hfmvu8eNCE5MzBfYvXhLL4If75Tc
IJ6C8uummnDmrT1TFuWHryTAfjyF28gt0+GGq0Zy5Hyz9b4CTJqOMx5u6KV4cZuJ
odoNQpE/GlWo40wCSTYP/Tt5xONrogk2pMQtFyV8JEoaXkdYSj/V815yojEmofYU
fmgPPO5/vOnZzE4b29gZyndXnU1Boah7r1l5fg7c9za376yCEEzh/ApPhovHyY0A
t8zjnrtooZ27IUKbcsyycrAM14asfcmViDNDgaCj8ttBioQaCnxO1BpKWjVxEZhE
AbM6q3Q66ER4Df6GNhZjPqT5Lr7E7+vLLarhXLWztsGQklIx4AFbrsa73hA20UC9
1PSeMd45JSxH3yA8vMauXAGHFK1tD1V8Lgofu69+2Z3jtKB+aU0fqWeL1jesSEM0
oCGhUb3hIC1pz3KVA0MGmNTm0yyQJYTGZL7wADYNV5NbxJVqXgo37qa/0n94Gf/4
TG3OwY4Sb/H/sve7v/eY4IvxVh+xs3dLZP8ZoqMlPCp9JIxc6iNoe6VHqPI7PFnM
fXwDtsy+bRF/SKnB/32qxnR7UJqmdNH3XIjd+lXWliKt6UYoC79/MEKN5DmJcO9P
CykZUWa72A==
=XUd9
-----END PGP SIGNATURE-----
Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull generic entry code updates from Thomas Gleixner:
- Make syscall user dispatching configurable
Not all architectures can makes use of syscall user dispatching.
Allow them to disable the feature completely.
- Consolidate stack randomization for the generic entry code and the
architectures using it.
Stack randomization on syscall entry was sprinkled throughout the
architecture specific low level entry code and in some cases at the
wrong points, e.g. before establishing state, which violates the
non-instrumentable constraints of that code.
Clean this up by integrating stack randomization into the generic
entry code helpers so that it is invoked at the earliest possible
point right after establishing state and converting all generic entry
code using architecture over.
- Clean up the syscall number handling in the generic entry code. It
works correctly for architectures which have a separate return value
storage in pt_regs, but fails to distinguish the case where user
space handed in -1 as syscall number from the case where the entry
code rejects it by returning -1 to the callers. Aside of that the
return value functionality of those interfaces is not really
intuitive.
Fix this by separating the decision to reject a syscall (user
dispatch, ptrace, seccomp ...) from the potential modification of the
syscall number through these mechanisms.
This solves most of the problems for architectures which do not have
a separate return value storage in pt_regs except for the case where
a tracepoint has a BPF script or a probe attached which overwrite
both the syscall number and the return value. But that's a problem
which cannot be solved in the generic code, that only can be
addressed by separating the storage model in the affected
architectures.
* tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits)
entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution
entry: Make return type of syscall_trace_enter() bool
entry: Rework trace_syscall_enter()
entry: Rework syscall_audit_enter()
syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH
entry: Fix seccomp bypass after ptrace with TSYNC
x86/entry: Simplify the syscall number logic
x86/entry: Get rid of the sys_ni_syscall() indirection
x86/entry: Make syscall functions static
ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry()
seccomp, treewide: Rename and convert __secure_computing() to return boolean
entry: Use syscall number instead of rereading it
entry: Remove syscall_enter_from_user_mode()
x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack()
s390/syscall: Use enter_from_user_mode_randomize_stack()
riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack()
powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack()
loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack()
entry: Provide [syscall_]enter_from_user_mode_randomize_stack()
randomize_kstack: Provide add_random_kstack_offset_irqsoff()
...
|
||
|
Linus Torvalds
|
dfa35434d7 |
Locking updates for v7.3:
Futexes:
- Use runtime constants for futex_hash computation
(K Prateek Nayak, Peter Zijlstra)
- Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)
- Avoid private hash use-after-free on final put (Felix Hoffmann)
- Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)
Rust integration updates:
- Implement refcounted interrupt disable and SpinLockIrq for Rust
(Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)
- Rust sync: add helpers for mb, dma_mb and friends;
add generic memory barriers and use LKMM atomics
instead of Rust atomics in the revocable code (Gary Guo)
- Add abstraction and integrate synchronize_rcu() (Philipp Stanner)
Lock debugging:
- Add qspinlock contended_release tracepoint
(Dmitry Ilvokhin, Peter Zijlstra)
- Enable the printing of held locks of remote running tasks and print
task CPU (Ingo Molnar)
- percpu-rwsem: Annotate intentional data race in readers_active_check()
(Sun Shaojie)
Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
Naveen Kumar Chaudhary and Thomas Huth.
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmqC2KMRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1gNwg//awvTQONfhPanAyTgl7CLDSlMSHdqmlyh
Ue0/Q8Ef1Cy4jwXY2FE2A0b1VcM6cGpDPoryVdg/wMdUXRNwinzAEXmxIkRy9kve
4LybrZwDShgLxJ7pJ6KKhgjgDiat8EdYmOwCBEE3LnP7AYhkAb8BFetA3YZJvzPa
KfA2BRYCgvBTid6yOAuXWm55Ev92AczOBamBzTxCadcaDGtNGXtQO6LfnqiQDOav
X5tVoANBeaQtSs1+LxE41WdNOiRoBuy0IFFvXtZRal6PZYuGGmZ5tbQvscD099em
haVwQyzDHQrqzglv71M0KRTXvYzdGveMRg/Au1SQnuLO3V6Vd5rMQ1g7I2M9Ln0f
Pg+tlRvQ77mLoqcgrtl0W/u0fRR4eDkiJ1pmG+98oniPwau23RdbFhC0vKFz3ikF
WHMgk3/9TcULylgF1Tj6QLmNrBY3Vx8LBdsFjhflEw7bG4cW42D91npmXIiEDE6K
tJc9CcaVdyE75o59z2Dtjj+qQVBlNPlfKQFXFL7p3jU/gFw2SzYuqon66X3kGmr0
mKJ9UNJdkLdiCjxS/QiMcDeYhwJksJqxFBkH50z3Kzmo84JsSpUFkoa6GM4aSiGn
HEwgC0Q7oOXVNIKUBYk5QaRW0HSk55hbsX2TWkvpeBYkE1zXshVZCCmgpaTSJgb5
oFmiwrGfUjo=
=slqC
-----END PGP SIGNATURE-----
Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
"Futexes:
- Use runtime constants for futex_hash computation (K Prateek Nayak,
Peter Zijlstra)
- Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)
- Avoid private hash use-after-free on final put (Felix Hoffmann)
- Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)
Rust integration updates:
- Implement refcounted interrupt disable and SpinLockIrq for Rust
(Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)
- Rust sync: add helpers for mb, dma_mb and friends; add generic
memory barriers and use LKMM atomics instead of Rust atomics in the
revocable code (Gary Guo)
- Add abstraction and integrate synchronize_rcu() (Philipp Stanner)
Lock debugging:
- Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter
Zijlstra)
- Enable the printing of held locks of remote running tasks and print
task CPU (Ingo Molnar)
- percpu-rwsem: Annotate intentional data race in readers_active_check()
(Sun Shaojie)
Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
Naveen Kumar Chaudhary and Thomas Huth"
* tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits)
rust: sync: Introduce SpinLockIrq::lock_with() and friends
rust: sync: Add SpinLockIrq
rust: sync: Use super::* in spinlock.rs
rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers
rust: Introduce interrupt module
s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
sched: Avoid signed comparison of preempt_count() in __cant_migrate()
sched: Remove the unused preempt_offset parameter of __cant_sleep()
locking: Switch to _irq_{disable,enable}() variants in cleanup guards
irq: Add KUnit test for refcounted interrupt enable/disable
irq,spin_lock: Add counted interrupt disabling/enabling
openrisc: Include <linux/cpumask.h> in smp.h
preempt: Introduce __preempt_count_{sub,add}_return()
preempt: Introduce HARDIRQ_DISABLE_BITS
preempt: Track NMI nesting to separate per-CPU counter
futex: Tell kmemleak we're not leaking __futex_queues
x86/paravirt: Trace contended_release on unlock
tracing/lock: Use TRACE_EVENT_FN() for contended_release
...
|
||
|
Linus Torvalds
|
ba24659b1d |
kexec: updates for v7.3-rc1
* Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. * Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. * Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. * Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. -----BEGIN PGP SIGNATURE----- iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmp9ouoACgkQOQOGJssO /ZEH/Af/b1qmnw8uUe2wzd1zcAEEsk6YwF8lmS5o4k7skiVKlHWQuDzPrwrxFTvg d6obJrLllMN2ULyLQ8ghMKbsdo8RCGBIpXF+bPEXmIF8bA/PhtDaxvi3scsxvie6 zU3geZbExlzg0Ik525I0DyPoEZc2JAg5ietp8bF6ZN5HNkDtBoNvi2ROc4mR9kzO agrczVnIEuIE3Tk+IfD6081iS3Wz/PjRC+yPBU1yYFobA6/bL7kFma7kED8PnxvI 2+oENcd1FtC/WBlmluZE0BC4SjNcsT1geyzAFlGlRvNzbHdtj13j6mTBSsbRpJMW WdewVpIpFGUqRbUIIdvOISLOcf62lg== =PjFs -----END PGP SIGNATURE----- Merge tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux Pull kexec updates from Mike Rapoport: - Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. - Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. * tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: crash_dump: release keyring reference at the correct time kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file kexec_file: skip checksum verification when safe riscv: kexec_file: Add support for crashkernel CMA reservation arm64: kexec_file: Add support for crashkernel CMA reservation powerpc/kexec_file: Use crash_exclude_core_ranges() helper LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code riscv: kexec_file: Use crash_prepare_headers() helper to simplify code x86/crash: Use crash_prepare_headers() helper to simplify code arm64: kexec_file: Use crash_prepare_headers() helper to simplify code crash: Add crash_prepare_headers() to exclude crash kernel memory powerpc/crash: sort crash memory ranges before preparing elfcorehdr riscv: kexec_file: Fix crashk_low_res not exclude bug |
||
|
Linus Torvalds
|
38fda1d9d2 |
memblock: updates for 7.3-rc1
Non-urgent fixes:
* Fix calculation of node_spanned_pages when running with kernelcore=mirror
* Properly handle failure to allocate per_cpu_nodestats in
free_area_init_core_hotplug()
* Fix deferred initialization of the memory map for configurations where
node's RAM end is not aligned on PAGES_PER_SECTION
Cleanups:
* Remove redundant pageblock_align() call in free_unused_memmap()
* Remove unnecessary invalid range checks in users of memblock iterators.
Some users of for_each_mem_range() and for_each_mem_pfn_range() verify
that start < end for each range. This is redundant because memblock
iterators guarantee to never return an invalid range
* Stop overlapping zones with kernelcore=mirror and align behaviour of
kernelcore=mirror with other variants of kernelcore=/movablecore=
* Remove redundant updates of numa_nodes_parsed mask in the callers of
numa_add_memblk(), the latter always updates the mask anyway
* Remove unnecessary initialization of pgdat->per_cpu_nodestats to NULL,
the variable is reset to the actual value a few lines below
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmp9lIIACgkQOQOGJssO
/ZEgNggAgzHeTtb+CK6s4mXlkIaoau/7I/nxmvl9/EwH4uNZrRSn7lKOp7FkTYk0
IvtrMj8XspA8vDMzkxAutVfgGFo7zItzpkIF8Y8r6vbP+fhZhieZ6NnxeyjEfYJJ
/r800vL+Q8ru0WUv5qsiBwlRC3RNoVQvO2zLsoBUbBqNluv9L+eDrs7pgcVbrkhy
r3rDHjnj2v9mqPZl+CTGifCWq0y40bhcw0dbRpn7165c2qwEMSwlan5ERuaZmja1
NJrWNiqYxD7mQ3DyDIc4C9jvZaHLkVkaAE6uRrTXb1rJFmyh/ghQ4YdTZ9GTcEVP
6AQk/eX3V3k5QUVngJBFqUq/kD2eIQ==
=vCS2
-----END PGP SIGNATURE-----
Merge tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
Pull memblock updates from Mike Rapoport:
"Non-urgent fixes:
- Fix calculation of node_spanned_pages when running
with 'kernelcore=mirror'
- Properly handle failure to allocate per_cpu_nodestats
in free_area_init_core_hotplug()
- Fix deferred initialization of the memory map for
configurations where node's RAM end is not aligned
on PAGES_PER_SECTION
Cleanups:
- Remove redundant pageblock_align() call in free_unused_memmap()
- Remove unnecessary invalid range checks in users of memblock
iterators. Some users of for_each_mem_range() and
for_each_mem_pfn_range() verify that start < end for each range.
This is redundant because memblock iterators guarantee to never
return an invalid range
- Stop overlapping zones with 'kernelcore=mirror' and align behaviour
of 'kernelcore=mirror' with other variants of kernelcore and
movablecore
- Remove redundant updates of numa_nodes_parsed mask in the callers
of numa_add_memblk(), the latter always updates the mask anyway
- Remove unnecessary initialization of pgdat->per_cpu_nodestats to
NULL, the variable is reset to the actual value a few lines below"
* tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: (25 commits)
mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
mm/mm_init: remove unnecessary initialization of pgdat->per_cpu_nodestats
mm/mm_init: remove redundant memset in free_area_init()
mm: numa_memblks: use numa_add_reserved_memblk() in numa_cleanup_meminfo()
arch_numa: remove redundant node_possible_map assignment
mm: numa_memblks: remove redundant numa_nodemask_from_meminfo()
LoongArch: remove redundant numa_nodes_parsed node_set()
arch_numa: remove redundant numa_nodes_parsed node_set()
x86/numa: remove redundant numa_nodes_parsed node_set()
of/numa: remove redundant numa_nodes_parsed node_set()
ACPI: NUMA: remove redundant numa_nodes_parsed node_set()
mm: numa_memblks: set numa_nodes_parsed in numa_add_memblk()
mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
mm/mm_init: drop overlap_memmap_init()
mm/mm_init: don't overlap NORMAL and MOVABLE zones with kernelcore=mirror
mm/hugetlb: remove unnecessary empty range check in hugetlb_bootmem_set_nodes()
mm: remove unnecessary empty range check in early_calculate_totalpages()
powerpc64/kasan: Remove unreachable invalid range check in kasan_init_phys_region()
ARM: remove unreachable invalid range check in kasan_init()
riscv: remove unreachable invalid range check in kasan_init()
...
|
||
|
Linus Torvalds
|
0d508f1745 |
ACPI support updates for 7.3-rc1
- Eliminate struct acpi_driver whose users have all been converted to
bind to platform devices or auxiliary devices and set the "no power
management" flag for all struct acpi_device objects (Rafael Wysocki)
- Avoid complaints regarding missing _OSC features on platforms where
OSC_CAPABILITIES_MASK_ERROR is set in _OSC error bits even though all
of the requested features are actually acknowledged (Rafael Wysocki)
- Avoid printing confusing _OSC messages for non-PCIe host bridges
without _OSC which is a valid configuration (Kazuma Kondo)
- Use correct region struct for BERT region size check and properly
map BERT and CCEL data to their ACPI tables (Thomas Renninger)
- Add acpi_device_clear_deps(), refactor RISC-V interrupt controller
management code to extract generic code from it into the common ACPI
IRQ code, and enable GICv5 IWB ACPI probe ordering detection on ARM
on top of that (Lorenzo Pieralisi)
- Stop using acpi_device_name() in the PNP core, stop setting
acpi_device_name/class() in the Xen variant of the ACPI PAD
(Processor Aggregator Device) driver, and make the Loongarch
laptop driver stop setting acpi_device_class() (Rafael Wysocki)
- Fix issues related to the desired_perf register access in the ACPI
CPPC library and update it to avoid unnecessary overhead (Christian
Loehle)
- Simplify acpi_get_pci_dev() with the help of a mutex guard, introduce
acpi_dev_get_pci_dev() for code that has a struct ACPI device for
which it wants to get the struct pci_dev pointer of the associated
PCI device, and use it in the ACPI video bus driver (Rafael Wysocki)
- Avoid registering platform devices with resource overlaps in the ACPI
core device enumeration code (Rafael Wysocki)
- Clean up the list of included header files in the NHLT table parser
and validate the table and record lengths in the FPDT parser (Andy
Shevchenko and Pengpeng Hou)
- Unregister the cpufreq notifier on init failure in the ACPI processor
driver (Can Peng)
- Validate MADT IOAPIC entry bounds during IOAPIC hotplug lookup in the
ACPI processor driver (Pengpeng Hou)
- Avoid _REG disconnect on probe deferrals related to GPIO IRQ in the
ACPI EC driver (Zhu Ling)
- Update kerneldoc comments of two structures in the ACPI bus type code
to use correct struct member names to avoid warnings (Randy Dunlap)
- Use a correct function parameter name in kernel-doc in the ACPI fan
driver (Randy Dunlap)
- Update ACPI fan IDs to follow modern style and clean up header file
inclusions in the ACPI fan driver (Andy Shevchenko)
- Use devm_acpi_install_notify_handler() to replace a custom open-coded
devres-based management of an ACPI notify handler in the ACPI fan
driver (Rafael Wysocki)
- Adjust charging status validation check in the ACPI battery driver to
avoid incorrect status reporting (Rafael Wysocki)
- Merge consecutive battery notifications in the ACPI battery driver to
reduce the pressure on STA, _BST and _BIX/_BIF ACPI control methods
and make that driver use kstrtoul() instead of sscanf("%lu\n") (Rong
Zhang)
- Sanitise model_number in the ACPI battery driver by dropping
unprintable characters (Kate Hsuan)
- Remove a node_set() call that is redundant from
acpi_parse_memory_affinity() (Sang-Heon Jeon)
- Prevent kernel-doc warnings by converting 2 function description
comments to kernel-doc format (Randy Dunlap)
- Fix docs build error in the ACPI admin-guide documentation (Randy
Dunlap)
- Replace __get_free_page() with kmalloc() in the code handling ACPI
NVS memory during system suspend/resume (Mike Rapoport)
- Fix card device cleanup on registration failure in the core PNP
code (Yuho Choi)
- Drop an unused assignment of pnp_device_id driver data (Uwe
Kleine-König)
- Clear driver_data on all paths that free acpi_pci_root in
acpi_pci_root_add() (Chen Pei)
- Add locking around evaluation of ACPI control methods in the ACPI TAD
driver to avoid race conditions (Rafael Wysocki)
- Handle repeated SEA error storms in APEI (Junhao He)
- Fix ERST timeout unit conversion in APEI (Nirmoy Das)
- Fix ARM section length accounting after header in the ACPI APEI GHES
driver (TanZheng)
- Mark ghes_in_nmi_spool_from_list() as maybe unused (Rui Qi)
- Introduce helper function acpi_dev_is_video_device() and use it in
the core ACPI device enumeration code, in the ACPI video bus driver,
in the ACPI support code for I2C, in the PCI VGA driver, and in the
x86 platform thinkpad_acpi driver (Andy Shevchenko)
- Add a quirk to use the native backlight on Acer Nitro AN515-46 to the
ACPI video bus driver (Marcos Paulo Medeiros)
- Release PCI device reference after lookup in video_detect_portege_r100()
in the ACPI video bus driver (Yuho Choi)
-----BEGIN PGP SIGNATURE-----
iQFGBAABCAAwFiEEcM8Aw/RY0dgsiRUR7l+9nS/U47UFAmp+DIkSHHJqd0Byand5
c29ja2kubmV0AAoJEO5fvZ0v1OO13jQH/2+Xfd7gzUh7to1lIqulfBMc52i3Cp9w
RC3HUc+/sJV93MO7Lbsje6s+6199citBPaqG9cwl5E+jdsvOOqg2aCy14nYKGRNs
QLr0TnDMO/mOl0OR2zOLlW6To9W59GtdQ3RkJAqJhKKZakNfvqRCOj5PZhjN8jb7
XOhNxkS+rIBreCsf14t51K8KQUsqhlXqeReRPyzCYLaxVNwCzGNyVTjSKNGAYRAR
VcMdjWMczLz6WpWLEVK3EwPhxF385ildUw3cky66l5zmLbxJIBkz9P5YziuyUSi2
5udUpOXumiEbZwlewpY+kGhL7Jd0cJu5KDt0zM0Rt4OwPIj/ootyyz0=
=nNPc
-----END PGP SIGNATURE-----
Merge tag 'acpi-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support updates from Rafael Wysocki:
"The most significant change here is the elimination of struct
acpi_driver that has no more users in the tree now along with some
documentation related to it, and a follow-up update to set the "no PM"
flag for all ACPI devices that are now only going to play the role of
other devices' "companions" (in analogy with DT nodes).
There is also a significant update of irqchip code related to ACPI
done in order to enable GICv5 IWB ACPI probe ordering detection on
ARM, which involves RISC-V interrupt controller management code
refactoring to extract generic code from it into the common ACPI IRQ
code.
The rest is mostly fixes, including some fallout of the _OSC handling
rework in 7.0, ACPI CPPC library fixes, a workaround for registering
ACPI platform devices with overlapping I/O or memory resources, an
ACPI EC driver fix related to probe deferral on platforms using
HW-reduced ACPI, two ACPI battery driver fixes and a workaround for
handling model numbers with unprintable characters in it, probe error
cleanup and driver unload code path fixes, hardware error reporting
fixes, documentation fixes, and assorted code cleanups all over.
Specifics:
- Eliminate struct acpi_driver whose users have all been converted to
bind to platform devices or auxiliary devices and set the "no power
management" flag for all struct acpi_device objects (Rafael
Wysocki)
- Avoid complaints regarding missing _OSC features on platforms where
OSC_CAPABILITIES_MASK_ERROR is set in _OSC error bits even though
all of the requested features are actually acknowledged (Rafael
Wysocki)
- Avoid printing confusing _OSC messages for non-PCIe host bridges
without _OSC which is a valid configuration (Kazuma Kondo)
- Use correct region struct for BERT region size check and properly
map BERT and CCEL data to their ACPI tables (Thomas Renninger)
- Add acpi_device_clear_deps(), refactor RISC-V interrupt controller
management code to extract generic code from it into the common
ACPI IRQ code, and enable GICv5 IWB ACPI probe ordering detection
on ARM on top of that (Lorenzo Pieralisi)
- Stop using acpi_device_name() in the PNP core, stop setting
acpi_device_name/class() in the Xen variant of the ACPI PAD
(Processor Aggregator Device) driver, and make the Loongarch laptop
driver stop setting acpi_device_class() (Rafael Wysocki)
- Fix issues related to the desired_perf register access in the ACPI
CPPC library and update it to avoid unnecessary overhead (Christian
Loehle)
- Simplify acpi_get_pci_dev() with the help of a mutex guard,
introduce acpi_dev_get_pci_dev() for code that has a struct ACPI
device for which it wants to get the struct pci_dev pointer of the
associated PCI device, and use it in the ACPI video bus driver
(Rafael Wysocki)
- Avoid registering platform devices with resource overlaps in the
ACPI core device enumeration code (Rafael Wysocki)
- Clean up the list of included header files in the NHLT table parser
and validate the table and record lengths in the FPDT parser (Andy
Shevchenko and Pengpeng Hou)
- Unregister the cpufreq notifier on init failure in the ACPI
processor driver (Can Peng)
- Validate MADT IOAPIC entry bounds during IOAPIC hotplug lookup in
the ACPI processor driver (Pengpeng Hou)
- Avoid _REG disconnect on probe deferrals related to GPIO IRQ in the
ACPI EC driver (Zhu Ling)
- Update kerneldoc comments of two structures in the ACPI bus type
code to use correct struct member names to avoid warnings (Randy
Dunlap)
- Use a correct function parameter name in kernel-doc in the ACPI fan
driver (Randy Dunlap)
- Update ACPI fan IDs to follow modern style and clean up header file
inclusions in the ACPI fan driver (Andy Shevchenko)
- Use devm_acpi_install_notify_handler() to replace a custom
open-coded devres-based management of an ACPI notify handler in the
ACPI fan driver (Rafael Wysocki)
- Adjust charging status validation check in the ACPI battery driver
to avoid incorrect status reporting (Rafael Wysocki)
- Merge consecutive battery notifications in the ACPI battery driver
to reduce the pressure on STA, _BST and _BIX/_BIF ACPI control
methods and make that driver use kstrtoul() instead of
sscanf("%lu\n") (Rong Zhang)
- Sanitise model_number in the ACPI battery driver by dropping
unprintable characters (Kate Hsuan)
- Remove a node_set() call that is redundant from
acpi_parse_memory_affinity() (Sang-Heon Jeon)
- Prevent kernel-doc warnings by converting 2 function description
comments to kernel-doc format (Randy Dunlap)
- Fix docs build error in the ACPI admin-guide documentation (Randy
Dunlap)
- Replace __get_free_page() with kmalloc() in the code handling ACPI
NVS memory during system suspend/resume (Mike Rapoport)
- Fix card device cleanup on registration failure in the core PNP
code (Yuho Choi)
- Drop an unused assignment of pnp_device_id driver data (Uwe
Kleine-König)
- Clear driver_data on all paths that free acpi_pci_root in
acpi_pci_root_add() (Chen Pei)
- Add locking around evaluation of ACPI control methods in the ACPI
TAD driver to avoid race conditions (Rafael Wysocki)
- Handle repeated SEA error storms in APEI (Junhao He)
- Fix ERST timeout unit conversion in APEI (Nirmoy Das)
- Fix ARM section length accounting after header in the ACPI APEI
GHES driver (TanZheng)
- Mark ghes_in_nmi_spool_from_list() as maybe unused (Rui Qi)
- Introduce helper function acpi_dev_is_video_device() and use it in
the core ACPI device enumeration code, in the ACPI video bus
driver, in the ACPI support code for I2C, in the PCI VGA driver,
and in the x86 platform thinkpad_acpi driver (Andy Shevchenko)
- Add a quirk to use the native backlight on Acer Nitro AN515-46 to
the ACPI video bus driver (Marcos Paulo Medeiros)
- Release PCI device reference after lookup in
video_detect_portege_r100() in the ACPI video bus driver (Yuho
Choi)"
* tag 'acpi-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (61 commits)
ACPI: scan: Avoid registering platform devices with resource overlaps
ACPI: APEI: Handle repeated SEA error storms
ACPI: APEI: Fix ERST timeout unit conversion
ACPI: APEI: GHES: fix ARM section length accounting after header
ACPI: video: Release PCI device reference after lookup
ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC
ACPI: TAD: Add locking around AML evaluations
ACPI: video: force native backlight on Acer Nitro AN515-46
ACPI: CPPC: Evaluate performance-control PCC use once
ACPI: CPPC: Avoid locking standalone full-width registers
ACPI: CPPC: Avoid unnecessary reads for full-width writes
ACPI: CPPC: Stop reading desired_perf in cppc_get_perf()
ACPI: CPPC: Skip desired_perf read in cppc_get_perf()
ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
ACPI: processor: Unregister cpufreq notifier on init failure
ACPI: bus: Avoid confusing complaints regarding missing _OSC features
ACPI: battery: Adjust charging status validation check
ACPI: pmtmr: Convert to kernel-doc format
ACPI: bus: Use correct struct member names
ACPI: fan: Use correct function parameter name in kernel-doc
...
|
||
|
Paolo Bonzini
|
4136288688 |
LoongArch KVM changes for v7.3
1. Advertise already-supported capabilities. 2. Some bug fixes about timer and MMIO. 3. Some hardening about interrupt injection. 4. Replace kvm_err() with kvm_pr_unimpl(). 5. Add FPU/LSX/LASX test cases for selftests. -----BEGIN PGP SIGNATURE----- iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmp9ca4WHGNoZW5odWFj YWlAa2VybmVsLm9yZwAKCRAChivD8uImelAuD/4jhprQWR9b8RMQ9bGYaBDml+98 fCRW8NPyicnct+97U/E9EXJrrMyyDOqJtOSnNQOVmTjz3IGQtzLoHULaJPqUv0Dh 7xUbpmb7qkqxrykUEUa81tDnClpISfLcgUBWKsg0VGLyF7MIEnbtECTadbzQEd10 hNXy/Pv8OiAIZe4rtlGWxOU5JxU6OVf0zEmXiS6cbqXrwxVl4STbF97/5ULqjU+D 4KMMs1IcOdf4klQeoE1oKvWsCiedZQBkKbtsv2hpDMmY4lUdheJg9+0atr8Oh7VS TtlO6Fmt7ilK9eFOCapDcs4gf5WQgs8WXKAyVUYSoteyEXQ9kSF2bHMYiC+WaKhb kMRR9ZyJa086FwDvW9/TyMrP8HLR4ORa7ksOeBnGt4Uv9A92ZbGqvEqLILPoKsIR LBJUM17XuLlR9J56sYNtid3Rdq88VLo84Wfc0hW966b+6oNdOVQBPI2YRpk4wDT1 Mtra60dtzwQ3jCW/GTjJThueEC4lqOFKHpYPIP3rd4aL8oCvfgLYlYZ4TiXHUjpX MgQ9rm8nDZAWipsjvt2yADFnv3YW4kD6hrn1S0EaDJXsTtT7pB6Mr0jlxQE/ZJdA ibXSubO5cakIdpMnAylL78ZyGZOWn6YOSG1pEjHjkI+in73sZ5a89k4s5ErxKxtB Hnc/FXwVWbylUdJkKw== =eMRy -----END PGP SIGNATURE----- Merge tag 'loongarch-kvm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD LoongArch KVM changes for v7.3 1. Advertise already-supported capabilities. 2. Some bug fixes about timer and MMIO. 3. Some hardening about interrupt injection. 4. Replace kvm_err() with kvm_pr_unimpl(). 5. Add FPU/LSX/LASX test cases for selftests. |
||
|
Pu Lehui
|
f2aaa62159 |
riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such kfunc args. Before commit |
||
|
Andy Chiu
|
b5060a4aa3 |
RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
Running vector workloads like perf + mcf on KVM can result in an
unexpected termination due to a vtype corruption. This happens because
the kernel-mode vector (KMV) misattributes the guest's vcpu context as
the user's context and source from a wrong status.VS.
The simplified call chain that results in this problem is shown as
follow:
__riscv_sys_ioctl()
kvm_arch_vcpu_ioctl_run()
kvm_riscv_vcpu_exit()
kvm_riscv_vcpu_sbi_ecall()
kvm_riscv_vcpu_pmu_ctr_stop()
kvm_vcpu_write_guest()
__copy_to_user()
enter_vector_usercopy()
kernel_vector_begin()
kernel_vector_begin() should use the sstatus.VS from guest's vcpu
context instead of task_pt_reg(current). Also, it should not save
guest's v-reg into the user's context memory.
To resolve this, the vcpu context must be correctly saved when KMV is
serving a guest. However, invoking KVM functions directly from generic
RISC-V architecture code introduces a reverse dependency, breaking
builds when KVM is configured as N or M.
Address this by registering an RCU-protected callback for context
flushing. KVM registers this callback at module initialization and
unregisters it on exit. When KMV starts a kernel context, it can now
safely flush the vector context via the callback.
Fixes:
|
||
|
Andy Chiu
|
848a973c5f |
riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
Similar to commit
|
||
|
Andy Chiu
|
8f798d6d7f |
riscv: vector: refactor riscv_v_start_kernel_context
Refactor riscv_v_start_kernel_context() to drop `is_nested` variable and simplify the logic. This introduces no functional change and works as a preparatory patch for the kernel-mode vector fix. Signed-off-by: Andy Chiu <tchiu@tenstorrent.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260803215250.824417-2-tchiu@tenstorrent.com Signed-off-by: Anup Patel <anup@brainfault.org> |
||
|
Daniel Borkmann
|
1519f488e8 |
bpf, riscv: Clear fetch destination on faulting arena atomic
A RMW atomic on an arena pointer is converted to BPF_PROBE_ATOMIC and
gets an exception table entry, but that entry records no destination
register to clear unless the instruction is a load-acquire today. That
is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,
but an RMW carrying BPF_FETCH also reads the old value into a register:
src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for
BPF_CMPXCHG. emit_atomic_rmw() emits it that way, e.g.:
[...]
case BPF_XCHG:
ctx->ex_insn_off = ctx->ninsns;
emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) :
rv_amoswap_w(rs, rs, rd, 1, 1), ctx);
[...]
Thus, a fault over an unmapped arena page ex_handler_bpf() jumps over
the access but leaves rs untouched, and the program resumes with
whatever it held before the atomic instead of the 0 that every other
BPF_PROBE_* access delivers. Fill the exception table entry in from
bpf_atomic_load_reg(), which returns the BPF register an atomic reads
the memory operand into or -1 when it has none. A load-acquire ends up
with the same register it gets today, it just goes through the helper.
Unlike x86-64 and arm64, riscv64 does not report arena violations from
its exception handler, so there is no access direction to correct here,
only the missing register clear.
Fixes:
|
||
|
Yong-Xuan Wang
|
df81f80c35 |
KVM: RISC-V: Add CPU PM notifier for non-retention idle states
Register a CPU_PM notifier to restore hypervisor CSR content during CPU non-retention idle states. When a CPU enters a deep idle state that powers off the CPU domain, hypervisor CSRs and VS CSRs lose their state and must be saved before entry and restored after exit. This completes KVM's power management coverage for RISC-V: - CPU hotplug: handled by kvm_online_cpu/kvm_offline_cpu (cpuhp callbacks) - System suspend: handled by kvm_suspend/kvm_resume (syscore ops) - CPU idle (retention): no action needed, CSRs are retained - CPU idle (non-retention): handled by this CPU_PM notifier Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Reviewed-by: Anup Patel <anup@brainfault.org> Link: https://lore.kernel.org/r/20260810-kvm-cpu-pm-v5-1-6c9e4c95caf5@sifive.com Signed-off-by: Anup Patel <anup@brainfault.org> |
||
|
Arnd Bergmann
|
545ecc3577 |
RISC-V Devicetrees for v7.3
Sophgo: The changes of this PR are all for CV18xx serials. There are three major changes. The first is to allow DMA multiplexer setting channel number for DMA controller; the second is to add initial RISC-V support for "Duo S" board, which uses SG2000, a dual-arch SoC (RISC-V and ARM64); the third is to add support for "Duo 256M" board, another dev-board based on SG2002 SoC. Signed-off-by: Chen Wang <chen.wang@linux.dev> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTYPcWJ6By3aFu8IuKHG95Quc97dgUCanKEvQAKCRCHG95Quc97 dn44AP9HHp2ut8rY0UnmS/s+rCAbWX/2YkhGWdWPPk1o4VkSdQEArt9F9RpXg/Mp RfmT/LEx81g7zR7wqpGlpy1a5F+TBw4= =SAg0 -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmp57JAACgkQmmx57+YA GNla7xAAqMRFdMgCOH74zaNtohonnSgbmJi4dL6RakzJHCjZO+VWMnxavg/A8qTb DrSugeW0SV1pe/NbOKaJbqZ6xa/gJJitivPNJIgn8uM3WauetzE55isGPb+smR1r soqTG/3AYocT88fy7FgLL3GmvY9yd1dAOHA/CFdTpmBdrqfV5fSSmed08wM0lVQe O1EgjHe7eNk+v3DYo80buRxwljiW0gpbhFFsz84hbdFoL/Cf/GAXWP1xhZjCTKo1 9/Zex3J7SsdNAaZjDzMyF0S0eolyAPJW0SzToDkMniE/tSYc2lkjW7R1I55iuQvi BJ+kKK1k2/TrSbmvjuvqCEnwfOh9BzXPf4UWuLrUrEVTpdEBtpe0otFGRBqzg0lO RkgUPdHWR8uhL57Oos8HM4WH2VN4s0jqP0FN1sUp46fnnQFCEi/nO4vRTnOt+ppy HxNjJyQRrP97OH7s7zpUTyCVVJBZPL3EF3NuNCzioooXK3LHI4MSApTtDIt9bPBi yS5U1SaUaNm4RwCaFH9QZSQHXdoEXKe0DPX/P9cROr62T6eSyDhZnIIcucveMw+6 tJie38mJChficq8mCo3/S1P3gMELy5lmBw68XCg/UMBcdV76Mq4AgFq6o5Ow+oXp KS/sO+RkxZPD7ImnGLKrSuurJnIsMpOR/69lLFBkZ0LBtdZY9W4= =CrHg -----END PGP SIGNATURE----- Merge tag 'riscv-sophgo-dt-for-v7.3' of https://github.com/sophgo/linux into soc/dt RISC-V Devicetrees for v7.3 Sophgo: The changes of this PR are all for CV18xx serials. There are three major changes. The first is to allow DMA multiplexer setting channel number for DMA controller; the second is to add initial RISC-V support for "Duo S" board, which uses SG2000, a dual-arch SoC (RISC-V and ARM64); the third is to add support for "Duo 256M" board, another dev-board based on SG2002 SoC. Signed-off-by: Chen Wang <chen.wang@linux.dev> * tag 'riscv-sophgo-dt-for-v7.3' of https://github.com/sophgo/linux: riscv: dts: sophgo: Add Milk-V Duo 256M board support riscv: dts: sophgo: cv180x: Add PWR_GPIO controller dt-bindings: soc: sophgo: add Milk-V Duo 256M board riscv64: dts: sophgo: add initial Milk-V Duo S board support riscv64: dts: sophgo: add SG2000 dtsi riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
1f5d8228ca |
Revert "riscv: dts: spacemit: k3: add i2s0-i2s5 nodes"
This reverts commit
|
||
|
Alexandre Belloni
|
b981359d9e |
arm64: tegra: Device tree changes for v7.3-rc1
This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcb8ACgkQ3SOs138+ s6EVRg//e3keeg7ehCUFVA8mDnGfxtIR5ErkU0I5LkCaQucREvHveHuNSayiNSM0 DQVcqv3n/egea4Nnon+eH4ddpa0fosFUm0tW1agLdvhn41nKhiTg/vNcPUwqNE+p qw43rl5ecChZslW8l8+4eln9sRoTnxBKKlydu5aKKVQtpLbn23uZTwtlSwMWcduO 0GjNOpvrjNyLWzGQ6lrO7uxRxrTHJPYm68Y/sVt38tZYHKC/Ksosy1/o0fKwJd4Q kMfk2lu1DxY6LGihNmNgpoITva0EaxtwDN1I4IO+dWLNq+feOrwCdTIaanycQPSw 29COUfEcpblWvkRxd6ffWLwsAEk1ydR49FaJLgaAddb0ImEJfEeiaz8roAMqW24Q QEEDtSwg8JeC4dhWSgOqPOin328hiz3gEG3qYkP/Bi9NgCq2a0eVRlWfBOkgPI8u isGcVm1yfb2cxdgC26QWivLtuTxDNeHp/rcyGAinWrzd5FJFMvd/tn76inOS33X1 U4shiIvnYDMh0j1VkvHa2ZvN1lqOTmbAGqHOF0iuCC2fhHuu6VW3/7j7wYgtv4gP Mp2dfVWEdj1Yp+iedS63XN+rFnEqMqw2733TkI1ThLzF3PXz0BO73QMvY+qAujlV 8eLPr5091lXQKYCKCLx8AGBpLtXOFHzS1BxR/tr+OPWAutGFoXA= =qSTk -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt arm64: tegra: Device tree changes for v7.3-rc1 This contains a new device tree for the Lenove ThinkEdge SE70 Edge Client device as well as a number of fixes and cleanups for Tegra234 and Tegra194. Tegra264 sees a number of additions to enable more features. * tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits) arm64: tegra: Correct Tegra234 p3740 interrupt flags arm64: tegra: Correct Tegra234 p3737 interrupt flags arm64: tegra: Correct Tegra194 p2972 interrupt flags arm64: tegra: Drop CPU masks from GICv3 PPI interrupts arm64: tegra: Add Lenovo ThinkEdge SE70 device tree arm64: tegra: Add pinctrl nodes for Tegra264 arm64: tegra: Fix CMDQV interrupt type on Tegra264 arm64: tegra: Properly sort devices on Tegra264 arm64: tegra: Add GTE nodes for Tegra264 arm64: tegra: Add Host1x and VIC on Tegra264 arm64: tegra: Populate CPU and L2 cache nodes on Tegra264 arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map Linux 7.2-rc5 super: fix emergency thaw deadlock on frozen block devices tracing: perf: Fix stale head for perf syscall tracing ftrace: Add global mutex to serialize trace_parser access tracing: Delay module ref count for "enable_event" trigger tracing: Fix use-after-free freeing trigger private data bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg() tracing: Fix context switch counter truncation ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Michael Neuling
|
5d588c6848 |
riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:
REG_L t1, SZREG(t0) // load next word
addi t0, t0, SZREG // advance
orc.b t1, t1
bgeu t0, t4, 4f // boundary check AFTER load
where t4 = (s + count) & -SZREG. When s is aligned and count is a
multiple of SZREG, t4 equals s + count and the loop loads a full word
starting at exactly s + count. If s + count falls on a page boundary
with the next page unmapped, this faults.
Fix by computing the aligned boundary from the last valid byte
(s + count - 1) instead of s + count. This makes the loop stop at the
word containing the last valid byte rather than potentially loading the
word after it. The count == 0 case is already handled by the beqz
early exit.
Also add a pre-loop guard (bgeu t0, t4) for the case where all valid
bytes fit within the first word. With the adjusted boundary, t4 can
equal t0, and entering the loop with stale register state from the
first-word processing would produce incorrect results.
The final minu clamp ensures the result is still correct when the last
loaded word extends past s + count - 1 within the same aligned word.
Fixes:
|
||
|
Alexandre Belloni
|
ff1d40db21 |
Allwinner device tree changes for 7.3
Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) -----BEGIN PGP SIGNATURE----- iQJEBAABCgAuFiEE2nN1m/hhnkhOWjtHOJpUIZwPJDAFAmpwvNYQHHdlbnNAa2Vy bmVsLm9yZwAKCRA4mlQhnA8kMC8qD/0R7T3AqT3n2HChF6NLv5mGqbJSxmTqG7FN FsJ9YuL+6ooeMRnktXypf1tagaVwZjz31U6LsCEPtmyxMZBrNXW0vE5iukvXVxG7 /F1Ar9vezQ1BVtd5qAdLbsWGQRfxsaTtk38sqYP+m1EObFKaxIKrf6VN8pX94uyM pJFXnIY0uEgHedEIzHphJYJP/y+r0WuvcI2ydpRU2u0yyBIj8JxY+pYvCeG8mw9x QXSZkDrz3ImdsHQqyMDN9lUEsgg/41DL9PyEcaiu0hv0Jiik0hQmX+NRZvo16LmO JZJjpPyVVxIxTGB15Bnh1z8dU+fPcmXxTOYJfDmYEI87Y81nUD1tG3UtyrOsirt2 aler/di3aAPUw9IysEyTU56vrAE2e76iCHhgO/Ba27Wi9HYjnRD4t+xSmLO5LXOv HlcRrzg5VPzlrXlabkuZQbJPfeqoZlwi08NCZxAo5mFeuDWuEDC5qnJzHezouicG DpAMchWZaTr+6wdFOUegZbGeNIp9LqK4Im/ySFmP2pGtBQ6avyLii9vlp52cc5Na banc4LgSigNFJVGKZ48DCk6q9ACfG8MTGLkT0wyRr5/1C4Aqrsd4LBptcsESk2Wv FbAneZj/nIs/Zke+Ek3tuVCx76KOt+2jxeTIp8gd7WWJGOWT+q2I5UBv2qTOvhfA 0Z/dB/ll4A== =S3xU -----END PGP SIGNATURE----- Merge tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt Allwinner device tree changes for 7.3 Some changes for old chips/devices and some for recent ones. - A10 PMU interrupt number fixed - A100/A133 gained LRADC - enabled overlay support for sun8i-h2-plus pi boards - A523 family gained consumer IR receiver - H728-based X96QPRO+ gained SPDIF audio output - PinePhone's mpu6050 mount orientation fixed - style fixes New board added: - Baijie Helper A133 - NetCube Systems OpenNMC (dobermann) * tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux: arm64: dts: allwinner: Correct white-space style ARM: dts: allwinner: Correct white-space style arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+ arm64: dts: allwinner: a523: Add SPDIF output PH pin mux option arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix arm64: dts: allwinner: a523: enable IR on the Avaota A1 arm64: dts: allwinner: a523: enable IR receiver on the X96Q Pro+ arm64: dts: allwinner: a523: add IR receiver nodes media: dt-bindings: allwinner,sun4i-a10-ir: add A523 compatible ARM: dts: allwinner: a10: Fix PMU interrupt ARM: dts: allwinner: enable overlay support for sun8i-h2-plus pi boards ARM: dts: allwinner: add support for NetCube Systems OpenNMC (dobermann) riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann) ARM: dts: allwinner: sun8i-h3: Correct indentation arm64: dts: allwinner: A133: add support for Baijie Helper A133 board arm64: dts: allwinner: a100: Add LRADC node dt-bindings: input: sun4i-lradc-keys: Add A100/A133 compatible dt-bindings: arm: sunxi: Add Baijie HelperBoard A133 compatible dt-bindings: vendor-prefixes: Add Shenzhen Baijie Technology Co., Ltd. Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Alexandre Belloni
|
0b02b8f941 |
RISC-V SpacemiT DT changes for 7.3
For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe -----BEGIN PGP SIGNATURE----- Version: GnuPG v2 iQKvBAABCgCZFiEEtbq4ycMbcRVnAiPcMarqR1lNu+0FAmpupawbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25z Lm9wZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRCNUJBQjhDOUMzMUI3MTE1NjcwMjIz REMzMUFBRUE0NzU5NERCQkVEAAoJEDGq6kdZTbvtuDgP/0+IIPDo/U7U0IhT+dAx Mxr1fWX1M4h5nEmirD8Zsx8TSfvZrpZr5MvazjrHxZ5U2U4ntkqrcoByhIqEy6Dn wz3A8arOEe3BU1zXf4UAPAW0CZA3Bp9rEDgwbgsTfyelSLyeDqaMX8l/8XQLU8Sl f28L5p+5AQota4Cutl36yE/KP6cK+7SBSgXA2Rnb9SXzvwC9cQGuOUq71zUsS7jI FdpYcvyCbLFmUiq2XoeFAdGB04nYs28VWiFnHg7FNdrCqWH6pgi/zxd3QtlTxjd6 oIrp/NsBnx9WAyx9GDhckpqOLt+sA49BjMTArBHmytVBI0ku2kbueQXJIS2J2OEq Cj4jkMD36Mbk21UP/3OOohARxPYWDDsRQ6NzvAMqNnmFdGa2lTCGA2pBsXF6pzYA cgFoSQq3s37ArNWaFxeCgnAnzyUWtEUEA3wcp+04xh4s9a90khxuU/rpF+GuyZwp 5Bfppy9L9dI6BogmfAcMsVHcLd0UhDoC6nokx8QLCtrVKEnpvWHfAtWProzEINfX k9K+f+fLtvL4aWGevKfZZfbMwFRrDaARI03HqW/flUjLBVggoC2FFo63WOfEmvZr ldCmIWM2iDgr7gBTSy8FSX+3FNROyc2xDFhM189crVvK0+LCCMyqGhHFNnk6NYbU NRf7S+rwIN9yrBSUgrX6GCXs =WKqT -----END PGP SIGNATURE----- Merge tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt RISC-V SpacemiT DT changes for 7.3 For K3 SoC - Enable SD card support - Enable QSPI - Fix reset delay of ETH PHY - Fix PHY ID of ETH - Symbolic PDAM ID - Add SPI controller support - Add USB and PHY support - Add I2S nodes For K1 SoC - Symbolic PDAM ID - Enable cpufreq support - Fix max CPU core voltage For boards of K3 - Pico-ITX - Enable ALDPS on RTL8211F PHY - Disable 125MHz clock on RTL8211F PHY - Enable NOR flash - Add EEPROM support - CoM260 - Add EEPROM support For boards of K1 - Milk-V Jupiter - Enable CPU DVFS - Banana Pi BPI-CM6 - Add initial support - OrangePi R2S - Enable PCIe * tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits) riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board riscv: dts: spacemit: k3: add i2s0-i2s5 nodes riscv: dts: spacemit: k3: add USB controller and USB phy support riscv: dts: spacemit: enable PCIe on OrangePi R2S riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1 riscv: dts: spacemit: k3-com260: add eeprom on i2c2 riscv: dts: spacemit: add SPI controllers for K3 riscv: dts: spacemit: add K3 PDMA request numbers riscv: dts: spacemit: Fix phy id check for the phy on com260 board riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX ... Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
||
|
Yong-Xuan Wang
|
dfdf1374fd |
KVM: RISC-V: Clear former VCPU cache on virtualization disable
When a CPU is taken offline or enters deep idle states, hypervisor CSR
state is lost. The kvm_former_vcpu fast-path optimization caches the
last VCPU that ran on each CPU to avoid expensive CSR restoration when
the same VCPU is re-scheduled on the same CPU. However, if this cache
is not cleared when CSR state is lost, the next VCPU entry will
incorrectly skip CSR restoration, leading to corrupt hypervisor state.
Add kvm_riscv_clear_former_vcpu() to invalidate the per-CPU cache and
call it from kvm_arch_disable_virtualization_cpu() to ensure proper CSR
restoration after CPU offline or system suspend events.
Fixes:
|
||
|
Guidong Han
|
735bc20c24 |
RISC-V: KVM: Fix PMU event info array size overflow
SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)
in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010
truncate to 16. KVM then allocates one entry but loops over the original
num_events, causing out-of-bounds reads and writes. A nested guest
triggered:
BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
Read of size 4 at addr ff600000074d46b0 by task init/1
Call Trace:
[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268
[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540
[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80
Allocated by task 1:
__kmalloc_noprof+0x19e/0x4b0
kvm_riscv_vcpu_pmu_event_info+0x72/0x142
kvm_sbi_ext_pmu_handler+0xca/0x268
kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
kvm_riscv_vcpu_exit+0x48c/0x540
kvm_arch_vcpu_ioctl_run+0x37e/0xc80
The buggy address is located 0 bytes to the right of
allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)
Store the shared-memory size in size_t and reject multiplication overflow.
Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged
to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.
Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index
to match num_events.
Reported-by: Naveed Khan <naveed@digiscrypt.com>
Closes: https://lore.kernel.org/kvm/178345245327.72065.13249716450708539854@digiscrypt.com/
Fixes:
|
||
|
Pengpeng Hou
|
f06b670cfd |
RISC-V: KVM: Avoid one-word masks for SBI v0.1 all-harts
KVM already treats a NULL hart-mask pointer in SBI v0.1 calls as all
harts, matching OpenSBI's legacy handling. The current handler builds that
target set as (1UL << online_vcpus) - 1 before iterating the mask.
That expression shifts by the type width once the VM has BITS_PER_LONG
online vCPUs, and a single word cannot represent larger VMs. A count-based
mask also selects the wrong IDs when vCPU IDs are sparse.
Handle SEND_IPI with a NULL hart-mask by iterating all online vCPUs
directly. For remote fence calls, use the existing hbase == -1UL
convention so the common fence request helper targets the whole VM
without consulting hmask.
Non-NULL guest hart masks keep the existing v0.1 behavior.
Fixes:
|
||
|
Pengpeng Hou
|
4a94f45ef7 |
RISC-V: KVM: Guard HFENCE range loops against overflow
The local HFENCE range helpers build the loop end with addr + size and
then step through the range by the requested page order. If addr + size
wraps, a small range near the top of the address space can be treated as
empty and skip the intended fence. The final loop step can also wrap
before the loop condition is evaluated again.
Treat wrapped ranges conservatively as full-range HFENCE requests and stop
each bounded loop before the next step can wrap past the computed end. This
keeps the existing large-range fallback and only changes local GVMA/VVMA
range construction.
Fixes:
|
||
|
Jesse Taube
|
8da45c93df |
RISC-V: hwprobe: Use BIT macro to avoid warnings
In uapi/asm/hwprobe.h file, (1 << N) is used to define the bit field which causes checkpatch to warn. Use _BITUL(N) and _BITULL(N) to avoid these warnings. Signed-off-by: Jesse Taube <jtaubepe@redhat.com> Link: https://patch.msgid.link/20260805153346.1036988-1-jtaubepe@redhat.com [pjw@kernel.org: updated to apply and to cover new extensions] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Thomas Weißschuh
|
42cd1e1fc8 |
riscv: alternative: Also patch the compat vDSO
The vDSO for compat processes can also contain alternative entries. Patch those, too. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-3-a32fd89b7b1c@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Thomas Weißschuh
|
63aecaba41 |
riscv: alternative: Use the statically extracted vDSO section offsets
Currently the alternative sections are extracted from the vDSO binaries at runtime. This has runtime overhead and also doesn't work for the compat vDSO. Use the offsets generated during the build instead, fixing both issues. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-2-a32fd89b7b1c@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Thomas Weißschuh
|
7f2a7bbcd9 |
riscv: vdso: Add symbols for the alternative section boundaries
Currently the alternative sections are extracted from the vDSO binaries at runtime. This has runtime overhead and also doesn't work for the compat vDSO. Extract the offsets of the alternative section during the build with the existing symbol extraction machinery. Also add dummy symbols as fallback. Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Reviewed-by: Nam Cao <namcao@linutronix.de> Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-1-a32fd89b7b1c@linutronix.de Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Andrew Jones
|
f61959a3a8 |
riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
Add Ziccamoa, Ziccif, and Za64rs to riscv_isa_ext[] so they can be parsed from devicetree/ACPI ISA strings. Ziccrse is already present in cpufeature; this patch only adds its hwprobe exposure. Expose all four extensions via hwprobe through new bits in RISCV_HWPROBE_KEY_IMA_EXT_1 (RISCV_HWPROBE_EXT_ZICCAMOA, _ZICCIF, _ZICCRSE, _ZA64RS), so userspace can probe each of these RVA23U64-mandatory extensions individually. Reviewed-by: Jesse Taube <jtaubepe@redhat.com> Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Signed-off-by: Guodong Xu <docular.xu@gmail.com> Link: https://patch.msgid.link/20260701-rva23u64-hwprobe-v2-v5-6-2c61f94a695a@gmail.com [pjw@kernel.org: updated to apply] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Jesse Taube
|
3cd63bc30c |
riscv: Add Zicclsm to cpufeature and hwprobe
Zicclsm requires misaligned support for all regular load and store instructions, both scalar and vector, but not AMOs or other specialized forms of memory access, to main memory regions with both the cacheability and coherence PMAs, as defined in the profiles spec. Even though mandated, misaligned loads and stores might execute extremely slowly. Standard software distributions should assume their existence only for correctness, not for performance. Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Reviewed-by: Andy Chiu <andy.chiu@sifive.com> Reviewed-by: Charlie Jenkins <charlie@rivosinc.com> Tested-by: Charlie Jenkins <charlie@rivosinc.com> Signed-off-by: Jesse Taube <jesse@rivosinc.com> [andrew.jones: Rebased, rewrote doc text, minor commit message revisions] Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com> Signed-off-by: Guodong Xu <docular.xu@gmail.com> Link: https://patch.msgid.link/20260701-rva23u64-hwprobe-v2-v5-5-2c61f94a695a@gmail.com [pjw@kernel.org: updated to apply; added Andrew's username to his tag comments] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Guodong Xu
|
fdef048705 |
riscv: cpufeature: Clarify ISA spec version for canonical order
Specify that chapter 27 refers to version 20191213 of the RISC-V ISA
Unprivileged Architecture. The chapter numbering differs across
specification versions - for example, in version 20250508, the ISA
Extension Naming Conventions is chapter 36, not chapter 27.
Historical versions of the RISC-V specification can be found via Link [1].
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://riscv.org/specifications/ratified/ [1]
Fixes:
|