github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-28 01:55:51 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,461,722 Commits 1 Branch 940 Tags 24 GiB
v7.2-rc1
Commit Graph

52139 Commits

Author SHA1 Message Date
Linus Torvalds
c75597caad s390: 
* Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
   unrelated capabilities
 
 * Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
   memory corruption in some scenarios
 
 * A bunch of misc gmap fixes (locking, behaviour under memory pressure)
 
 * Fix CMMA dirty tracking
 
 x86:
 
 * Tidy up some WARN_ON() and BUG_ON(), replacing them with WARN_ON_ONCE()
   or KVM_BUG_ON().  All of these have obviously never triggered, or
   somebody would have been annoyed earlier, but still.
 
 * Fix missing interrupt due to stale CR8 intercept
 
 * Add a statistic that can come in handy to debug leaks as well as the
   vulnerability to a class of recently-discovered issues.
 
 * Do not ask arch/x86/kernel to export default_cpu_present_to_apicid()
   just for KVM.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmo7xaAUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroN7bwf/Ua6PrRrgdzfUGiIruBDnFGtXnaKf
 UPGpgl35Kl4ntPlmH6wRG6N0jP9sloa17Qj/Y33O1Um3Mi/eDV0UESW8o8tfFE2J
 CWUPc3/adw2urhnkXsoleSFy21a89TgLd0p4tot832p+IHi3iNJ45fx7XxftBeGt
 fa/liscncEX5tGwie0ZVkIEE/ob3+eX4ZYsTLXMi6FxAlyGPYNrp4jwJeYH9AFSd
 ZYGqVbDjDq14vhnppKXM8DMfHTXN4OVYw2RJZ9Y7u2h7ku3sN0XakzVTAUz5gtoM
 h+iu8dn5yslODBZiNGlls8UYm2bweOBCumH1ZITe/eTNuEdUOJGILorKRw==
 =QzfV
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "s390:

   - Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
     unrelated capabilities

   - Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
     memory corruption in some scenarios

   - A bunch of misc gmap fixes (locking, behaviour under memory
     pressure)

   - Fix CMMA dirty tracking

  x86:

   - Tidy up some WARN_ON() and BUG_ON(), replacing them with
     WARN_ON_ONCE() or KVM_BUG_ON(). All of these have obviously never
     triggered, or somebody would have been annoyed earlier, but still...

   - Fix missing interrupt due to stale CR8 intercept

   - Add a statistic that can come in handy to debug leaks as well as
     the vulnerability to a class of recently-discovered issues

   - Do not ask arch/x86/kernel to export
     default_cpu_present_to_apicid() just for KVM"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  x86/apic: KVM: Use cpu_physical_id() to get APIC ID of running vCPU for AVIC
  KVM: x86/mmu: Expose number of shadow MMU shadow pages as a stat
  KVM: x86: Unconditionally recompute CR8 intercept on PPR update
  KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
  KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails
  KVM: x86: WARN and fail kvm_set_irq() if a PIC or I/O APIC vector is invalid
  KVM: x86: Bug the VM, not the kernel, if the ISR count {under,over}flows
  KVM: x86/mmu: Bug the VM, not the host kernel, if KVM write-protects upper SPTEs
  KVM: x86: Replace BUG_ON() with WARN_ON_ONCE() on "bad" nested GPA translation
  KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
  KVM: s390: Return failure in case of failure in kvm_s390_set_cmma_bits()
  KVM: s390: selftests: Fix cmma selftest
  KVM: s390: Fix cmma dirty tracking
  KVM: s390: Fix locking in kvm_s390_set_mem_control()
  KVM: s390: Fix handle_{sske,pfmf} under memory pressure
  KVM: s390: Fix code typo in gmap_protect_asce_top_level()
  KVM: s390: Do not set special large pages dirty
  KVM: s390: Fix dat_peek_cmma() overflow
  s390/mm: Fix handling of _PAGE_UNUSED pte bit
  KVM: s390: Fix typo in UCONTROL documentation
  ...
 2026-06-25 10:21:13 -07:00
Linus Torvalds
962528fef9 gpio fixes for v7.2-rc1 
- fix locking context with shared GPIOs in gpio-tegra
 - fix IRQ domain leak in error path in gpio-davinci
 - fix returning a potentially uninitialized integer in
   gpiochip_set_multiple()
 - use raw spinlock in gpio-eic-sprd and gpio-sch to address locking
   context issues
 - bail out of probe() if registering the GPIO chip fails in gpio-mlxbf3
 - fix varible type for storing the "ngpios" property in gpio-pisosr
 - fix out-of-bounds pin access in GPIO ACPI
 - make GPIO ACPI core only trigger interrupts on boot that are marked as
   ActiveBoth
 - fix kerneldoc in gpio-tb10x
 - reference the real software node of the cs5535 GPIO controller in
   Geode board file
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmo86vUACgkQBZ0uy/82
 hMNNWRAAmZmRGrQtGsl50IOsZBgdONYapPftkk36rAJ7JKfxIAnO1ebcU+GjHve5
 0F1D12Oz8mhrPnpGXm9im5msrwzVJtO6BGiQUqz8YvoajTDEqzCcOkDPNMbkseob
 3L/XEzsz6MWtc4JvEyx6sFLCsIr2z/uzitX8nq+9KGkeC1PCEQ7zROLuoTxGcMQe
 33nftgrJ2Ch+NP7QYDayI7imB+y7j01jQgfNuhsdwcqPam9CAJYX/hBkke8WyaIm
 c84u9fXEto+u3CIgK3zxLDkzodSDWw+8zPtwEYV7QgyAZyp7rXEEkbOJLxQCMiGK
 puJUDLCt+3jCAp6GjORewrPysReR27zn0KGaL70OKObKvIJ4tDEHnPI/GdTsUEOh
 n9/bZkF8eXOfT3RQV5ezdQgLrt0+/J3lM44nVkx3bno2OXumXXIW7+8frvhFy9TB
 C5Pn638XUPAPdlHiZlazLbJzQnchNPqH3wu0Hfcwrid+43byrb/lidtT6e6cmezl
 l+AdqV3ppZcVJlW6ORLvIk1UT7JNsE7+DHL8/8XWLsLZrtjG8aotVMBpxAqgsl1s
 adbJ3q96C4P27Zz93D7qyR/zopqRBa2BA+F3j8PDQOzuSO0Ps3y3kyIJH9OCEnLY
 ztyyuMH3tXFkkq9zStbe66VlMpEMMW8YZyHx6jIyc7/gVYnK4dk=
 =53+g
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix locking context with shared GPIOs in gpio-tegra

 - fix IRQ domain leak in error path in gpio-davinci

 - fix returning a potentially uninitialized integer in
   gpiochip_set_multiple()

 - use raw spinlock in gpio-eic-sprd and gpio-sch to address locking
   context issues

 - bail out of probe() if registering the GPIO chip fails in gpio-mlxbf3

 - fix varible type for storing the "ngpios" property in gpio-pisosr

 - fix out-of-bounds pin access in GPIO ACPI

 - make GPIO ACPI core only trigger interrupts on boot that are marked
   as ActiveBoth

 - fix kerneldoc in gpio-tb10x

 - reference the real software node of the cs5535 GPIO controller in
   Geode board file

* tag 'gpio-fixes-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
  gpio: tegra: do not call pinctrl for GPIO direction
  gpio: tb10x: fix struct tb10x_gpio kernel-doc
  gpiolib: initialize return value in gpiochip_set_multiple()
  x86/platform/geode: reference the real node of the cs5535 GPIO controller
  gpio: eic-sprd: use raw_spinlock_t in the irq startup path
  gpio: sch: use raw_spinlock_t in the irq startup path
  gpiolib: acpi: Prevent out-of-bounds pin access in OperationRegion handler
  gpiolib: acpi: Add robust bounds-checking for GPIO pin resources
  gpio: mlxbf3: fail probe if gpiochip registration fails
  gpio: pisosr: Read "ngpios" as u32
  gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
 2026-06-25 09:33:23 -07:00
Sean Christopherson
098e32cba3 x86/apic: KVM: Use cpu_physical_id() to get APIC ID of running vCPU for AVIC 
Use cpu_physical_id() instead of default_cpu_present_to_apicid() when
getting the APIC ID of the pCPU on which a vCPU is running/loaded, as the
kernel has gone way off the rails if a vCPU is loaded on a pCPU that has
been physically removed from the system.  Even if the impossible were to
happen, the absolutely worst case scenario is that hardware will ring the
AIVC doorbell on the wrong pCPU, i.e. a severely broken system will
experience mild performance issues.

Kill off KVM's superfluous kvm_cpu_get_apicid() wrapper along with the
for-KVM export of default_cpu_present_to_apicid(), as they existed purely
for the wonky AVIC usage.

Cc: Kai Huang <kai.huang@intel.com>
Cc: Yosry Ahmed <yosry@kernel.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Message-ID: <20260612185459.591892-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 07:52:24 -04:00
Sean Christopherson
02953418a1 KVM: x86/mmu: Expose number of shadow MMU shadow pages as a stat 
Turn arch.n_used_mmu_pages into a stat, mmu_shadow_pages, as the number of
live shadow pages is arguably _the_ most critical datapoint when it comes
to analyzing the shadow MMU.  Before the TDP MMU came along, i.e. when the
shadow MMU was the only MMU, explicitly tracking the number of shadow pages
wasn't as interesting, because the same information could more or less be
gleaned from the pages_{1g,2m,4k} stats.  But with the TDP MMU, where the
shadow MMU is only used for nested TDP, it becomes extremely difficult, if
not impossible, to determine which SPTEs are coming from the TDP MMU, and
which are coming from the shadow MMU.

E.g. when triaging/debugging shadow MMU performance issues due to "too many
shadow pages", being able to observe that 99%+ of all shadow pages are
unsync is critical to being able to deduce that KVM is effectively leaking
shadow pages.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260612133727.411902-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 07:52:23 -04:00
Carlos López
bb365a506b KVM: x86: Unconditionally recompute CR8 intercept on PPR update 
The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits
when the guest's virtual TPR falls under the specified threshold,
allowing KVM to inject previously masked interrupts.

KVM handles these VM exits in handle_tpr_below_threshold().
Commit eb90f3417a ("KVM: vmx: speed up TPR below threshold vmexits")
optimized this function by calling apic_update_ppr() instead of raising
KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is
a pending, deliverable interrupt.

However, if there are no new interrupts pending, apic_update_ppr() does
not issue the request. Thus, kvm_lapic_update_cr8_intercept() and
vmx_update_cr8_intercept() are not called before VM entry, which results
in a high, stale TPR_THRESHOLD. This is problematic due to the following
sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM:

  The following check is performed if the “use TPR shadow” VM-execution
  control is 1 and the “virtualize APIC accesses” and “virtual-interrupt
  delivery” VM-execution controls are both 0: the value of bits 3:0 of
  the TPR threshold VM-execution control field should not be greater
  than the value of bits 7:4 of VTPR.

This error condition is typically not observed when KVM runs on a bare
metal system because modern processors support APICv, which enables
virtual-interrupt delivery, and which KVM uses when possible. This
causes the processor to no longer generate TPR-below-threshold exits
and to no longer check TPR_THRESHOLD on entry. However, when running
on older platforms, or under nested virtualization on a hypervisor that
does not support virtual-interrupt delivery and enforces this check
(like Hyper-V) this can cause a VM entry failure with hardware error
0x7, as seen in [1].

Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not
find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).
Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in
apic_update_ppr(), as they now become redundant. This ensures that any
path that updates the guest's PPR also figures out if KVM needs to wait
for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).

Link: https://github.com/coconut-svsm/svsm/issues/1081 [1]
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Cc: stable@vger.kernel.org
Fixes: eb90f3417a ("KVM: vmx: speed up TPR below threshold vmexits")
Signed-off-by: Carlos López <clopez@suse.de>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:55:14 +02:00
Sean Christopherson
7ef78d71ca KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode 
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.

  ------------[ cut here ]------------
  debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
  WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
  WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
  Modules linked in:
  CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
  RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
  RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
  Call Trace:
   <TASK>
   apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
   kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
   kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
   kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
   kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
   kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

No functional change intended.

Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:55:13 +02:00
Sean Christopherson
cc3d0e1afd KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails 
WARN once if KVM's tracking for pending EOIs for Real-Time Clock IRQs goes
off the rails, as there's no reason to bug the host or risk a DoS due to
spamming dmesg with endless WARNs.  Absolute worst case scenario, guest
time will go awry.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618174527.1982333-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:54:29 +02:00
Sean Christopherson
ea3c995921 KVM: x86: WARN and fail kvm_set_irq() if a PIC or I/O APIC vector is invalid 
WARN and return an error up the stack if the PIC or I/O APIC encounters an
invalid vector when injecting an IRQ, as there is no danger to the host and
thus no justification for potentially panicking the kernel.  Don't bug the
VM either, as the risk of corrupting the guest is minuscule, and the guest
might even be completely tolerant of a lost interrupt.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185213.2019937-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:53:36 +02:00
Sean Christopherson
ac604b5611 KVM: x86: Bug the VM, not the kernel, if the ISR count {under,over}flows 
Bug the VM, not the host kernel, if KVM's ISR count {under,over}flows when
tracking in-flight ISRs.  There is zero danger to the host if KVM messes up
its IRQ tracking.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185350.2020845-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:52:54 +02:00
Sean Christopherson
8e5d793fc7 KVM: x86/mmu: Bug the VM, not the host kernel, if KVM write-protects upper SPTEs 
Instead of bugging the host kernel, WARN and terminate the VM if KVM
attempts to write-protect at a level that cannot use leaf SPTEs.
There is no reason to bring down the entire host; even termininating
the VM is likely overkill, but in theory a missed write could corrupt
guest memory, so play it safe.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185641.2022368-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:33:04 +02:00
Sean Christopherson
39e9c35e44 KVM: x86: Replace BUG_ON() with WARN_ON_ONCE() on "bad" nested GPA translation 
If KVM attempts to translate what it thinks is an L2 GPA with a non-nested
MMU, simply WARN and return the GPA, i.e. trust the MMU more than the
caller, as there is zero reason to potentially panic the host kernel just
because KVM misused an API.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185746.2023283-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-24 11:25:21 +02:00
Linus Torvalds
bade58eb06 - Prevent NULL dereference on theoretical missing IO bitmap 
(Li RongQing)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmo6wFMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hOmBAAsFd4cotcp2OQt0Cn6ZNMt1WwoJc5Qplw
 RCMEuTzWmf5zIjCOYXNHNd4lDKKTvMQr3BKOX7oG8noZgnYXxdMlhvN4j9y0Pc0h
 UXIXamzGRzI+2I4kSLL2iee3/utj1Srs19g5ONtaHkJEiH37mw00BIJVgE51TT5t
 6KDMbdHZ2ZmtDjtD7BEdecVrhpKLVejFHIpljPJ8GGVPC6QmrF91d+Lv7r2B0IjR
 3WlDHHXbRvDNbd6r0wvlIbxOUEwUtYMCDIErvohfN2ZU/HVNKivJ42L4dgG8yx5q
 q8ZLbmI15Qa2vEcMesr8liXqT992INMvn+TjCJ0huY3qoyRvf285Xla3DKaA50rL
 1btj9c0i4O6GfKN568nwx+K5YGWb2EH1s79vs3VmG6L6pmnX8CGawMRBDIXY2+qQ
 kFfWsiFCid3TDTwoA1bkOpakNM77d4BAAvYg7yGxlN2wYWiddN8slx77iunDhw+s
 xCi7rQ5Kb35SfWAg3DiKHd5wqptvpK/EkgwCVfzkLf6VFxqFPdaiP4bDn23daUP7
 XhUo3symJ8KLh1bLlR1DLgyzRp5t5yW3/Rocs7RS1h1bTvd96vF04PEQncH5c6Lw
 bB8AXKnB3am1AmBfWbQ3kg/AQJV1tlgCkCozjr990uSVgwRAy1XigioPn/y/eNPW
 pBqWCO4B7aA=
 =mOJb
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Prevent NULL dereference on theoretical missing IO bitmap (Li
   RongQing)

* tag 'x86-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap
 2026-06-23 17:16:31 -07:00
Linus Torvalds
f31c00c377 platform-drivers-x86 for v7.2-1 
Highlights:
 
 - amd/hfi: Add support for dynamic ranking tables (version 3)
 
 - amd/pmc:
   - Add PMC driver support for AMD 1Ah M80H SoC
   - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
     switch problems after s2idle
 
 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver
 
 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR
 
 - asus-wmi: add keystone dongle support
 
 - dell-dw5826e: Add reset driver for DW5826e
 
 - dell-laptop: Fix rollback path
 
 - hp-wmi:
   - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F
 
 - intel-hid:
   - Add HP ProBook x360 440 G1 5 button array support
   - Prevent racing ACPI notify handlers
 
 - intel/pmc:
   - Add Nova Lake support
   - Rate-limit LTR scale-factor warning
 
 - intel-uncore-freq:
   - Expose instance ID in the sysfs
   - Fix current_freq_khz after CPU hotplug
 
 - intel/vsec: Restore BAR fallback for header walk
 
 - ISST: Restore SST-PP control to all domains
 
 - lenovo-wmi-*:
   - Add more CPU tunable attributes
   - Add GPU tunable attributes
   - Add WMI battery charge limiting
 
 - oxpec: add support for OneXPlayer Super X
 
 - sel3350-platform: Retain LED state on load and unload
 
 - surface: SAM: Add support for Surface Pro 12in
 
 - uniwill-laptop: Add support for battery charge modes
 
 - tools/power/x86/intel-speed-select: Harden daemon pidfile open
 
 - Major refactoring efforts:
   - ACPI driver to platform driver conversion
   - Converting drivers to use the improved WMI API
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 ACPI:
  -  provide acpi_bus_find_device_by_name()
 
 alienware-wmi-base:
  -  Transition to new WMI API
 
 amd: hfi:
  -  Support for ranking table versions
 
 amd/hsmp:
  -  Clamp ioctl/send_message indices (Spectre v1)
 
 amd/pmc:
  -  Add delay_suspend module parameter
  -  Add PMC driver support for AMD 1Ah M80H SoC
  -  Check for intermediate wakeup in function
  -  Delay suspend for some Lenovo Laptops
  -  Don't log during intermediate wakeups
  -  Use per-SoC cpu_info struct for SMU mailbox and IP info
 
 apple-gmux:
  -  Drop unused assignment of pnp_device_id driver data
 
 arm64:
  -  Add driver for EC found on Qualcomm reference devices
 
 arm64: qcom-hamoa-ec:
  -  Fix indentation in comment tables
 
 arm64 Use named initializers for struct i2c_device_id:
  - arm64 Use named initializers for struct i2c_device_id
 
 asus-armoury:
  -  add support for FX608JPR
  -  add support for G614PR
  -  add support for GA402NJ
  -  add support for GA403UM
 
 asus-wmi:
  -  add keystone dongle support
 
 barco-p50-gpio:
  -  attach software node to its target GPIO device
 
 classmate-laptop:
  -  Address memory leaks on driver removal
  -  Convert accel driver to a platform one
  -  Convert ipml driver to a platform one
  -  Convert keys driver to a platform one
  -  Convert tablet driver to a platform one
  -  Convert v4 accel driver to a platform one
  -  Pass struct device pointer to helpers
  -  Register ACPI notify handlers directly
  -  Rename two helper functions
  -  Unify probe rollback and remove code
 
 dell-ddv:
  -  Use new buffer-based WMI API
 
 dell-descriptor:
  -  Use new buffer-based WMI API
 
 dell-dw5826e:
  -  Add reset driver for DW5826e
 
 dell-laptop:
  -  add Inspiron N5110 to touchpad LED quirk table
  -  fix missing cleanups in init error path
 
 dell-privacy:
  -  correct CONFIG_DELL_WMI_PRIVACY macro name in comments
  -  Use new buffer-based WMI API
 
 dell_rbu:
  -  use strscpy in image_type_write
 
 dell-smbios-wmi:
  -  Use new buffer-based WMI API
 
 dell-wmi-base:
  -  Use new buffer-based WMI API
 
 docs:
  -  fix typo in uniwill-laptop.rst
 
 hp-wmi:
  -  Add support for Omen 16-ap0xxx (8D26)
  -  Add support for Omen 16-ap0xxx (8E35)
  -  Add thermal support for board 8B2F
 
 hwmon:
  -  (dell-smm) Use new buffer-based WMI API
 
 intel-hid:
  -  Add HP ProBook x360 440 G1 to button_array_table
  -  Protect ACPI notify handler against recursion
 
 intel/pmc:
  -  Add ACPI PWRM telemetry driver for Nova Lake S
  -  Add Nova Lake support to intel_pmc_core driver
  -  Add NVL PCI IDs for SSRAM telemetry discovery
  -  Add PMC SSRAM Kconfig description
  -  Add support for variable DMU offsets
  -  Enable Pkgc blocking residency counter
  -  Enable PkgC LTR blocking counter
  -  rate-limit LTR scale-factor warning
  -  Retrieve PMC info only for available PMCs
 
 intel/pmc/ssram:
  -  Add ACPI discovery scaffolding
  -  Add PCI platform data
  -  Make PMT registration optional
  -  Refactor DEVID/PWRMBASE extraction into helper
  -  Rename probe and PCI ID table for consistency
  -  Switch to static array with per-index probe state
 
 intel/pmc:
  -  Use __free() in pmc_core_punit_pmt_init()
  -  Use PCI DID for PMC SSRAM device discovery
 
 intel/pmt:
  -  Add pre/post decode hooks around header parsing
  -  Cache the telemetry discovery header
 
 intel/pmt/crashlog:
  -  Split init into pre-decode
 
 intel/pmt:
  -  Pass discovery index instead of resource
 
 intel/pmt/telemetry:
  -  Move overlap check to post-decode hook
 
 intel/pmt:
  -  Unify header fetch and add ACPI source
 
 intel/tpmi:
  -  convert mutex in mem_write() to guard
  -  use cleanup helpers in mem_write()
 
 intel-uncore-freq:
  -  Expose instance ID in the sysfs
  -  Fix current_freq_khz after CPU hotplug
  -  Rename instance_id
 
 intel/vsec:
  -  allocate res with intel_vsec_dev
  -  Restore BAR fallback for header walk
 
 ISST:
  -  Restore SST-PP control to all domains
 
 lenovo-wmi-capdata:
  -  Add debugfs file for dumping capdata
 
 lenovo-wmi-helpers:
  -  Add helper for creating per-device debugfs dir
 
 lenovo-wmi-other:
  -  Add force_load_psy_ext module parameter
  -  Add GPU tunable attributes
  -  Add missing CPU tunable attributes
  -  Add WMI battery charge limiting
  -  Rename LWMI_OM_FW_ATTR_BASE_PATH
 
 meraki-mx100:
  -  use real software node references
 
 modpost:
  -  Handle malformed WMI GUID strings
 
 Move delayed work on system_dfl_wq:
  - Move delayed work on system_dfl_wq
 
 msi-ec:
  -  Add support for MSI Pulse GL66 12th Gen
 
 oxpec:
  -  add support for OneXPlayer Super X
 
 panasonic-laptop:
  -  simplify allocation of sinf
 
 pcengines-apuv2:
  -  reduce indiraction in swnode assignment
 
 pmc_atom:
  -  Use named initializer for pci_device_id array
 
 sel3350-platform:
  -  Retain LED state on load and unload
 
 sonypi:
  -  use strscpy() in sonypi_acpi_probe
 
 surface: SAM:
  -  Add support for Surface Pro 12in
 
 thinkpad_acpi:
  -  Add debugfs entry to display HWDD raw
  -  Remove unneeded goto
 
 tools/power/x86/intel-speed-select:
  -  Harden daemon pidfile open
 
 uniwill-laptop:
  -  Add support for battery charge modes
  -  Enable battery charge modes on supported devices
  -  Mark EC_ADDR_OEM_4 as volatile
  -  Rework FN lock/super key suspend handling
 
 use u8 * for raw byte buffers:
  - use u8 * for raw byte buffers
 
 wmi:
  -  Make sysfs attributes const
  -  Make wmi_bus_class const
 
 x86-android-tablets:
  -  enable fwnode matching of GPIO chips
  -  Use named initializers for struct i2c_device_id
 
 x86/platform/olpc: xo15:
  -  Convert ACPI driver to a platform one
  -  Drop wakeup source on driver removal
 
 xo15-ebook:
  -  Convert ACPI driver to a platform one
  -  Fix formatting of labels
  -  Fix wakeup source and GPE handling
  -  Register ACPI notify handler directly
  -  Use devres-based resource management
 
 Merges:
  -  Merge branch 'fixes' into for-next
  -  Merge branch 'fixes' of into for-next
  -  Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into review-ilpo-next
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCajl8LgAKCRBZrE9hU+XO
 MZ47AP0Z0IoiT8WEcXL4wuTQyR6ruXWClYk82wiroAFEko8Z5AD/WYNWCBXqjZk+
 FlJbtleRLA/ADmgT3Mj+biHNTIqyBA0=
 =Q3d+
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen:

 - amd/hfi: Add support for dynamic ranking tables (version 3)

 - amd/pmc:
     - Add PMC driver support for AMD 1Ah M80H SoC
     - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
       switch problems after s2idle

 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver

 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR

 - asus-wmi: add keystone dongle support

 - dell-dw5826e: Add reset driver for DW5826e

 - dell-laptop: Fix rollback path

 - hp-wmi:
     - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F

 - intel-hid:
     - Add HP ProBook x360 440 G1 5 button array support
     - Prevent racing ACPI notify handlers

 - intel/pmc:
     - Add Nova Lake support
     - Rate-limit LTR scale-factor warning

 - intel-uncore-freq:
     - Expose instance ID in the sysfs
     - Fix current_freq_khz after CPU hotplug

 - intel/vsec: Restore BAR fallback for header walk

 - ISST: Restore SST-PP control to all domains

 - lenovo-wmi-*:
     - Add more CPU tunable attributes
     - Add GPU tunable attributes
     - Add WMI battery charge limiting

 - oxpec: add support for OneXPlayer Super X

 - sel3350-platform: Retain LED state on load and unload

 - surface: SAM: Add support for Surface Pro 12in

 - uniwill-laptop: Add support for battery charge modes

 - tools/power/x86/intel-speed-select: Harden daemon pidfile open

 - Major refactoring efforts:
     - ACPI driver to platform driver conversion
     - Converting drivers to use the improved WMI API

 - Miscellaneous cleanups / refactoring / improvements

* tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (115 commits)
  platform/x86/intel/pmc: Add NVL PCI IDs for SSRAM telemetry discovery
  platform/x86/intel/pmc/ssram: Make PMT registration optional
  platform/x86/intel/pmc/ssram: Add ACPI discovery scaffolding
  platform/x86/intel/pmc/ssram: Switch to static array with per-index probe state
  platform/x86/intel/pmc/ssram: Refactor DEVID/PWRMBASE extraction into helper
  platform/x86/intel/pmc/ssram: Add PCI platform data
  platform/x86/intel/pmc/ssram: Rename probe and PCI ID table for consistency
  platform/x86/intel/pmc: Add ACPI PWRM telemetry driver for Nova Lake S
  platform/x86/intel/pmc: Add PMC SSRAM Kconfig description
  platform/x86/intel/pmt: Unify header fetch and add ACPI source
  platform/x86/intel/pmt: Cache the telemetry discovery header
  platform/x86/intel/pmt: Pass discovery index instead of resource
  platform/x86/intel/pmt/telemetry: Move overlap check to post-decode hook
  platform/x86/intel/pmt/crashlog: Split init into pre-decode
  platform/x86/intel/pmt: Add pre/post decode hooks around header parsing
  modpost: Handle malformed WMI GUID strings
  platform/wmi: Make sysfs attributes const
  platform/wmi: Make wmi_bus_class const
  hwmon: (dell-smm) Use new buffer-based WMI API
  platform/x86: dell-ddv: Use new buffer-based WMI API
  ...
 2026-06-23 08:31:33 -07:00
Linus Torvalds
6e869de3a1 hyperv-next for v7.2-rc1 
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmo41jgTHHdlaS5saXVA
 a2VybmVsLm9yZwAKCRB2FHBfkEGgXjo1CACiN+Ifxj67WZAy1c1tqlHTJbD/OcAh
 KlbZQCVG3QoV9RC8yc9U2DyzSv488YujrqaJhsRg35Cjqs91dFlaXOemArF9dk8f
 ICy3SU48sCGvm6v95ndClUyvncAkqcPR/tyfNs7l5rPh6fZnXEov2SdtOlMMayOA
 HD/s+urd4AiIT3ffj/Ikl/+VrxC7rkYw5oXRF83y4oG79BDtXxgsSlHCudCAM15O
 FvBeUyTT7/7Phz7jk+oNiNBEtJTq6CQo/2Xp5TBpSBl2F/MjfCudAa/XqJakZO27
 UMi5lH8DALYNek4dckyfvt7cVHfeCma0ho77V9AscChFtnAnv74sJyEK
 =ADO8
 -----END PGP SIGNATURE-----

Merge tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv updates from Wei Liu:

 - Use wakeup mailbox to boot APs in Hyper-V VTL2 TDX guests (Yunhong
   Jiang, Ricardo Neri)

 - Move the Hyper-V IOMMU to its own subdirectory (Mukesh Rathor)

 - Cosmetic changes to mshv and balloon driver (Junrui Luo, Markus
   Elfring)

* tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  mshv: add bounds check on vp_index in mshv_intercept_isr()
  hv_balloon: Simplify data output in hv_balloon_debug_show()
  x86/hyperv: Cosmetic changes in irqdomain.c for readability
  iommu/hyperv: Create hyperv subdirectory under drivers/iommu
  x86/hyperv/vtl: Use the wakeup mailbox to boot secondary CPUs
  x86/hyperv/vtl: Mark the wakeup mailbox page as private
  x86/acpi: Add a helper to get the address of the wakeup mailbox
  x86/hyperv/vtl: Setup the 64-bit trampoline for TDX guests
  x86/realmode: Make the location of the trampoline configurable
  x86/hyperv/vtl: Set real_mode_header in hv_vtl_init_platform()
  x86/dt: Parse the Wakeup Mailbox for Intel processors
  dt-bindings: reserved-memory: Wakeup Mailbox for Intel processors
  x86/acpi: Add functions to setup and access the wakeup mailbox
  x86/topology: Add missing struct declaration and attribute dependency
 2026-06-22 08:06:13 -07:00
Linus Torvalds
1a3746ccbb strncpy removal for v7.2-rc1 
- Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
   x86, and xtensa
 
 - Remove strncpy API
 
 Over the last 6 years working on strncpy removal there were 362 commits
 by 70 contributors. Folks with more than 1 commit were:
 
     211  Justin Stitt <justinstitt@google.com>
      22  Xu Panda <xu.panda@zte.com.cn>
      21  Kees Cook <kees@kernel.org>
      17  Thorsten Blum <thorsten.blum@linux.dev>
      12  Arnd Bergmann <arnd@arndb.de>
       4  Pranav Tyagi <pranav.tyagi03@gmail.com>
       4  Lee Jones <lee@kernel.org>
       2  Steven Rostedt <rostedt@goodmis.org>
       2  Sam Ravnborg <sam@ravnborg.org>
       2  Marcelo Moreira <marcelomoreira1905@gmail.com>
       2  Krzysztof Kozlowski <krzk@kernel.org>
       2  Kalle Valo <kvalo@kernel.org>
       2  Jaroslav Kysela <perex@perex.cz>
       2  Daniel Thompson <danielt@kernel.org>
       2  Andrew Lunn <andrew@lunn.ch>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCajSC5QAKCRA2KwveOeQk
 u+L0AQCqbRKDuNHKWwbdwv5Sy6nbsHLLd4//m+dJDesqbdMYfgD/UQyygfeicqep
 tXcP2krB9Mcl6qsMqNgkKAPpNTCPAwE=
 =FZ+4
 -----END PGP SIGNATURE-----

Merge tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull strncpy removal from Kees Cook:

 - Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
   x86, and xtensa

 - Remove strncpy API

   Over the last 6 years working on strncpy removal there were 362
   commits by 70 contributors. Folks with more than 1 commit were:

    211  Justin Stitt <justinstitt@google.com>
     22  Xu Panda <xu.panda@zte.com.cn>
     21  Kees Cook <kees@kernel.org>
     17  Thorsten Blum <thorsten.blum@linux.dev>
     12  Arnd Bergmann <arnd@arndb.de>
      4  Pranav Tyagi <pranav.tyagi03@gmail.com>
      4  Lee Jones <lee@kernel.org>
      2  Steven Rostedt <rostedt@goodmis.org>
      2  Sam Ravnborg <sam@ravnborg.org>
      2  Marcelo Moreira <marcelomoreira1905@gmail.com>
      2  Krzysztof Kozlowski <krzk@kernel.org>
      2  Kalle Valo <kvalo@kernel.org>
      2  Jaroslav Kysela <perex@perex.cz>
      2  Daniel Thompson <danielt@kernel.org>
      2  Andrew Lunn <andrew@lunn.ch>

* tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  string: Remove strncpy() from the kernel
  xtensa: Remove arch-specific strncpy() implementation
  x86: Remove arch-specific strncpy() implementation
  powerpc: Remove arch-specific strncpy() implementation
  m68k: Remove arch-specific strncpy() implementation
  alpha: Remove arch-specific strncpy() implementation
 2026-06-19 14:56:45 -07:00
Linus Torvalds
a552c81ff4 mm.git review status for mm-hotfixes-stable..mm-stable 
Everything:
 
 Total patches:       321
 Reviews/patch:       1.52
 Reviewed rate:       68%
 
 Excluding DAMON:
 
 Total patches:       227
 Reviews/patch:       2.07
 Reviewed rate:       90%
 
 Excluding DAMON and selftests:
 
 Total patches:       203
 Reviews/patch:       2.14
 Reviewed rate:       91%
 
 Patchsets in this merge:
 
 - The 2 patch series "selftests/mm: clean up build output and verbosity"
   from Li Wang removes some noise from the MM selftests build out.
 
 - The 3 patch series "mm: Free contiguous order-0 pages efficiently"
   from Ryan Roberts speeds up the freeing of a batch of 0-order pages by
   first scanning them for coalescing opportunities.  This is applicable to
   vfree() and to the releasing of frozen pages.
 
 - The 11 patch series "mm/damon: introduce DAMOS failed region quota
   charge ratio" from SeongJae Park addresses a DAMOS usability issue: The
   DAMOS quota often exhausts prematurely because it charges for all memory
   attempted, causing slow and inconsistent performance when actions fail
   on unreclaimable memory.
 
   To fix this, a new feature lets users set a smaller, flexible quota
   charge ratio (via a numerator and denominator) for failed regions.
   Since failed actions cause less overhead, reducing their quota cost
   ensures more predictable and efficient DAMOS processing
 
 - The 8 patch series "selftests/cgroup: improve zswap tests robustness
   and support large page sizes" from Li Wang fixes various spurious
   failures and improves the overall robustness of the cgroup zswap
   selftests.
 
 - The 3 patch series "fix MAP_DROPPABLE not supported errno" from
   Anthony Yznaga fixes an issue in the mlock selftests on arm32.
 
 - The 2 patch series "mm: huge_memory: clean up defrag sysfs with
   shared" from Breno Leitao does some maintenance work in the huge_memory
   code.
 
 - The 3 patch series "treewide: fixup gfp_t printks" from Brendan
   Jackman uses the special vprintf() gfp_t conversion in various places.
 
 - The 6 patch series "mm: Fix vmemmap optimization accounting and
   initialization" from Muchun Song fixes several bugs in the vmemmap
   optimization, mainly around incorrect page accounting and memmap
   initialization in the DAX and memory hotplug paths.  It also fixes
   pageblock migratetype initialization and struct page initialization for
   ZONE_DEVICE compound pages.
 
 - The 4 patch series "mm/damon: repost non-hotfix reviewed patches in
   damon/next tree" from is a sprinkle of unrelated minor bugfixes for
   DAMON.
 
 - The 3 patch series "mm: remove page_mapped()" from David Hildenbrand
   remove this function from the tree, replacing it with folio_mapped().
 
 - The 10 patch series "mm/damon: let DAMON be paused and resumed" from
   SeongJae Park permits DAMON to be paused and resumed without losing its
   current state.
 
 - The 3 patch series "kasan: hw_tags: Disable tagging for stack and
   page-tables" from Muhammad Usama Anjum simplifies and speeds up kasan by
   removing its ineffective tagging of stacks and page tables.
 
 - The 7 patch series "mm/damon/reclaim,lru_sort: monitor all system rams
   by default" from SeongJae Park simplifies deployment on diverse hardware
   like NUMA systems by updating DAMON_RECLAIM and DAMON_LRU_SORT to
   automatically monitor the physical address range covering all System RAM
   areas by default, replacing the overly restrictive behavior that only
   targeted the single largest memory block to save on negligible overhead.
 
 - The 2 patch series "mm/damon/sysfs: document filters/ directory as
   deprecated" from SeongJae Park updates some DAMON docs.
 
 - The 8 patch series "mm: use spinlock guards for zone lock" from Dmitry
   Ilvokhin switches zone->lock handling over to using the guard()
   mechanisms.
 
 - The 2 patch series "mm/filemap: tighten mmap_miss hit accounting" from
   fujunjie fixes a flaw where the mmap_miss counter over-credited page
   cache hits during fault-arounds and page-fault retries.  This results in
   significant reduction of redundant synchronous mmap readahead I/O,
   drastically cutting down execution time and gigabytes read for sparse
   random or strided memory access workloads.
 
 - The 2 patch series "selftests/cgroup: Fix false positive failures in
   test_percpu_basic" from Li Wang fixes a couple of false-positives in the
   cgroup kmem selftests.
 
 - The 2 patch series "mm/damon/reclaim: support monitoring intervals
   auto-tuning" from SeongJae Park adds a new parameter to DAMON permitting
   DAMON_RECLAIM to automatically tune DAMON's sampling and aggregation
   intervals.
 
 - The 2 patch series "mm/damon/stat: add kdamond_pid parameter" from
   SeongJae Park chnges DAMON_STAT to provide the pid of its kdamond.
 
 - The 2 patch series "mm/kmemleak: dedupe verbose scan output" from
   Breno Leitao removes large amounts of duplicated backtraces from the
   verbose-mode kmemleak output.
 
 - The 8 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)"
   from David Hildenbrand reduces our use of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   with a view to removing it entirely in a later series.
 
 - The 2 patch series "mm/damon: validate min_region_size to be power of
   2" from Liew Rui Yan prevents users from passing a non-power-of-2 value
   of `addr_unit', as this later results in undesirable behavior.
 
 - The 2 patch series "mm: document read_pages and simplify usage" from
   Frederick Mayle does as claimed.
 
 - The 3 patch series "tools/mm/page-types: Fix misc bugs" from Ye Liu
   fixes three issues in tools/mm/page-types.c.
 
 - The 4 patch series "mm: misc cleanups from __GFP_UNMAPPED series" from
   Brendan Jackman implements several cleanups in the page allocator and
   related code.
 
 - The 12 patch series "mm, swap: swap table phase IV: unify allocation"
   from Kairui Song unifies the allocation and charging of anon and shmem
   swap in folios, provides better synchronization, consolidates the
   metadata management, hence dropping the static array and map, and
   improves performance.
 
 - The 28 patch series "mm/damon: introduce data attributes monitoring"
   from SeongJae Park extends DAMON for monitoring general data attributes
   other than accesses.
 
 - The 5 patch series "mm/vmalloc: free unused pages on vrealloc()
   shrink" from Shivam Kalra implements the TODO in vrealloc() to unmap and
   free unused pages when shrinking across a page boundary.
 
 - The 3 patch series "mm/damon: documentation and comment fixes" from
   niecheng does as advertised.
 
 - The 3 patch series "remove mmap_action success, error hooks" from
   Lorenzo Stoakes eliminates custom hooks from mmap_action by removing the
   problematic success_hook which allowed drivers to improperly access
   uninitialized VMAs.  It replaces the error_hook with a simple error-code
   field and updates the memory char driver accordingly.
 
 - The 14 patch series "mm/damon: minor improvements for code readability
   and tests" from SeongJae Park implements minor improvements in code
   readability and tests for DAMON.
 
 - The 2 patch series "mm/damon: fix macro arguments and clarify quota
   goals doc" from Maksym Shcherba does those things.
 
 - The 2 patch series "userfaultfd: merge fs/userfaultfd.c into
   mm/userfaultfd.c" from Mike Rapoport performs that code movement.
 
 - The 15 patch series "mm/mglru: improve reclaim loop and dirty folio"
   from Kairui Song and others cleans up and slightly improves MGLRU's
   reclaim loop and dirty writeback handling.  Large performance
   improvements are measured.
 
 - The 3 patch series "use vma locks for proc/pid/{smaps|numa_maps}
   reads" from Suren Baghdasaryan uses per-vma locks when reading
   /proc/pid/smaps and /proc/pid/numa_maps similar to reduce contention on
   central mmap_lock.
 
 - The 2 patch series "refactors thpsize_shmem_enabled_store() and
   thpsize_shmem_enabled_show()" from Ran Xiaokai provides some cleanup
   work in the THP code.
 
 - The 2 patch series "selftests/memfd: fix compilation warnings" from
   Konstantin Khorenko fixes a few build glitches in the memfd selftest
   code.
 
 - The 4 patch series "memcg: shrink obj_stock_pcp and cache multiple
   objcgs" from Shakeel Butt resolves a 68% performance regression caused
   by NUMA-node cache thrashing around struct obj_stock_pcp by shrinking
   its existing fields and expanding it into a multi-slot array that caches
   up to five obj_cgroup pointers per CPU, allowing per-node variants of
   the same memcg to coexist within a single 64-byte cache line.
 
 - The 2 patch series "zram: writeback fixes" from Sergey Senozhatsky
   addresses a couple of unrelated zram writeback issues.
 
 - The 9 patch series "mm: switch THP shrinker to list_lru" from Johannes
   Weiner resolves NUMA-awareness issues and streamlines callsite
   interaction by refactoring and extending the list_lru API to completely
   replace the complex, open-coded deferred split queue for Transparent
   Huge Pages (THPs).
 
 - The 2 patch series "mm: improve large folio readahead for exec memory"
   from Usama Arif improves large-folio readahead on systems like 64K-page
   arm64 by preventing the mmap_miss check from permanently disabling
   target-oriented VM_EXEC readahead, and by generalizing the
   force_thp_readahead gate to support mappings with any usefully large
   maximum folio order under the cache cap.
 
 - The 6 patch series "userfaultfd/pagemap: pre-existing fixes" from
   Kiryl Shutsemau fixes a bunch of minor issues in the
   userfaultfd/pagemap, all of which were flagged by Sashiko review of
   proposed new material.
 
 - The 5 patch series "mm/sparse-vmemmap: Provide generic
   vmemmap_set_pmd() and vmemmap_check_pmd()" from Muchun Song provides
   generic versions of these two functions so the four arch-specific
   implementations can be removed.
 
 - The 2 patch series "mm/swap, PM: hibernate: fix swapoff race in
   uswsusp by pinning swap device" from Youngjun Park addresses a
   uswsusp-vs-swapoff race and reduces the swap device reference
   taking/releasing frequency.
 
 - The 2 patch series "mm/hmm: A fix and a selftest" from Dev Jain does
   as claimed.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCajQcWQAKCRDdBJ7gKXxA
 jkjFAQD14ZCAS7c/lsNHPRpOARR2zrCJiIp+vhZDEx5V+d8u0QD+I4ca11CnQ+OA
 dKCeabWWYuTR1GDtTHbLVCRfpGexBwM=
 =cWPO
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "selftests/mm: clean up build output and verbosity" (Li Wang)

   Remove some noise from the MM selftests build

 - "mm: Free contiguous order-0 pages efficiently" (Ryan Roberts)

   Speed up the freeing of a batch of 0-order pages by first scanning
   them for coalescing opportunities. This is applicable to vfree() and
   to the releasing of frozen pages

 - "mm/damon: introduce DAMOS failed region quota charge ratio"
   (SeongJae Park)

   Address a DAMOS usability issue: The DAMOS quota often exhausts
   prematurely because it charges for all memory attempted, causing slow
   and inconsistent performance when actions fail on unreclaimable
   memory.

   To fix this, a new feature lets users set a smaller, flexible quota
   charge ratio (via a numerator and denominator) for failed regions.
   Since failed actions cause less overhead, reducing their quota cost
   ensures more predictable and efficient DAMOS processing

 - "selftests/cgroup: improve zswap tests robustness and support large
   page sizes" (Li Wang)

   Fix various spurious failures and improves the overall robustness of
   the cgroup zswap selftests

 - "fix MAP_DROPPABLE not supported errno" (Anthony Yznaga)

   Fix an issue in the mlock selftests on arm32

 - "mm: huge_memory: clean up defrag sysfs with shared" (Breno Leitao)

   Some maintenance work in the huge_memory code

 - "treewide: fixup gfp_t printks" (Brendan Jackman)

   Use the special vprintf() gfp_t conversion in various places

 - "mm: Fix vmemmap optimization accounting and initialization" (Muchun
   Song)

   Fix several bugs in the vmemmap optimization, mainly around incorrect
   page accounting and memmap initialization in the DAX and memory
   hotplug paths. It also fixes pageblock migratetype initialization and
   struct page initialization for ZONE_DEVICE compound pages

 - "mm/damon: repost non-hotfix reviewed patches in damon/next tree"

   A sprinkle of unrelated minor bugfixes for DAMON

 - "mm: remove page_mapped()" (David Hildenbrand)

   Remove this function from the tree, replacing it with folio_mapped()

 - "mm/damon: let DAMON be paused and resumed" (SeongJae Park)

   Allow DAMON to be paused and resumed without losing its current state

 - "kasan: hw_tags: Disable tagging for stack and page-tables" (Muhammad
   Usama Anjum)

   Simplify and speed up kasan by removing its ineffective tagging of
   stacks and page tables

 - "mm/damon/reclaim,lru_sort: monitor all system rams by default"
   (SeongJae Park)

   Simplify deployment on diverse hardware like NUMA systems by updating
   DAMON_RECLAIM and DAMON_LRU_SORT to automatically monitor the
   physical address range covering all System RAM areas by default,
   replacing the overly restrictive behavior that only targeted the
   single largest memory block to save on negligible overhead

 - "mm/damon/sysfs: document filters/ directory as deprecated" (SeongJae
   Park)

   Update some DAMON docs

 - "mm: use spinlock guards for zone lock" (Dmitry Ilvokhin)

   Switch zone->lock handling over to using the guard() mechanisms

 - "mm/filemap: tighten mmap_miss hit accounting" (fujunjie)

   Fix a flaw where the mmap_miss counter over-credited page cache hits
   during fault-arounds and page-fault retries. This results in
   significant reduction of redundant synchronous mmap readahead I/O,
   drastically cutting down execution time and gigabytes read for sparse
   random or strided memory access workloads

 - "selftests/cgroup: Fix false positive failures in test_percpu_basic"
   (Li Wang)

   Fix a couple of false-positives in the cgroup kmem selftests

 - "mm/damon/reclaim: support monitoring intervals auto-tuning"
   (SeongJae Park)

   Add a new parameter to DAMON permitting DAMON_RECLAIM to
   automatically tune DAMON's sampling and aggregation intervals

 - "mm/damon/stat: add kdamond_pid parameter" (SeongJae Park)

   Change DAMON_STAT to provide the pid of its kdamond

 - "mm/kmemleak: dedupe verbose scan output" (Breno Leitao)

   Remove large amounts of duplicated backtraces from the verbose-mode
   kmemleak output

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)" (David
   Hildenbrand)

   Reduce our use of CONFIG_HAVE_BOOTMEM_INFO_NODE, with a view to
   removing it entirely in a later series

 - "mm/damon: validate min_region_size to be power of 2" (Liew Rui Yan)

   Prevent users from passing a non-power-of-2 value of `addr_unit', as
   this later results in undesirable behavior

 - "mm: document read_pages and simplify usage" (Frederick Mayle)

 - "tools/mm/page-types: Fix misc bugs" (Ye Liu)

   Fix three issues in tools/mm/page-types.c

 - "mm: misc cleanups from __GFP_UNMAPPED series" (Brendan Jackman)

   Implement several cleanups in the page allocator and related code

 - "mm, swap: swap table phase IV: unify allocation" (Kairui Song)

   Unify the allocation and charging of anon and shmem swap in folios,
   provides better synchronization, consolidates the metadata
   management, hence dropping the static array and map, and improves
   performance

 - "mm/damon: introduce data attributes monitoring" (SeongJae Park(

   Extend DAMON to monitor general data attributes other than accesses

 - "mm/vmalloc: free unused pages on vrealloc() shrink" (Shivam Kalra)

   Implement the TODO in vrealloc() to unmap and free unused pages when
   shrinking across a page boundary

 - "mm/damon: documentation and comment fixes" (niecheng)

 - "remove mmap_action success, error hooks" (Lorenzo Stoakes)

   Eliminate custom hooks from mmap_action by removing the problematic
   success_hook which allowed drivers to improperly access uninitialized
   VMAs. It replaces the error_hook with a simple error-code field and
   updates the memory char driver accordingly

 - "mm/damon: minor improvements for code readability and tests"
   (SeongJae Park)

 - "mm/damon: fix macro arguments and clarify quota goals doc" (Maksym
   Shcherba)

 - "userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c" (Mike
   Rapoport)

 - "mm/mglru: improve reclaim loop and dirty folio" (Kairui Song and
   others)

   Clean up and slightly improves MGLRU's reclaim loop and dirty
   writeback handling. Large performance improvements are measured

 - "use vma locks for proc/pid/{smaps|numa_maps} reads" (Suren
   Baghdasaryan)

   Use per-vma locks when reading /proc/pid/smaps and numa_maps similar
   to reduce contention on central mmap_lock

 - "refactors thpsize_shmem_enabled_store() and thpsize_shmem_enabled_show()"
   (Ran Xiaokai)

   Some cleanup work in the THP code

 - "selftests/memfd: fix compilation warnings" (Konstantin Khorenko)

   Fix a few build glitches in the memfd selftest code.

 - "memcg: shrink obj_stock_pcp and cache multiple objcgs" (Shakeel
   Butt)

   Resolve a 68% performance regression caused by NUMA-node cache
   thrashing around struct obj_stock_pcp by shrinking its existing
   fields and expanding it into a multi-slot array that caches up to
   five obj_cgroup pointers per CPU, allowing per-node variants of the
   same memcg to coexist within a single 64-byte cache line.

 - "zram: writeback fixes" (Sergey Senozhatsky)

   address a couple of unrelated zram writeback issues

 - "mm: switch THP shrinker to list_lru" (Johannes Weiner)

   Resolve NUMA-awareness issues and streamlines callsite interaction by
   refactoring and extending the list_lru API to completely replace the
   complex, open-coded deferred split queue for Transparent Huge Pages

 - "mm: improve large folio readahead for exec memory" (Usama Arif)

   Improve large-folio readahead on systems like 64K-page arm64 by
   preventing the mmap_miss check from permanently disabling
   target-oriented VM_EXEC readahead, and by generalizing the
   force_thp_readahead gate to support mappings with any usefully large
   maximum folio order under the cache cap.

 - "userfaultfd/pagemap: pre-existing fixes" (Kiryl Shutsemau)

   Fix a bunch of minor issues in the userfaultfd/pagemap, all of which
   were flagged by Sashiko review of proposed new material

 - "mm/sparse-vmemmap: Provide generic vmemmap_set_pmd() and
   vmemmap_check_pmd()" (Muchun Song)

   Provide generic versions of these two functions so the four
   arch-specific implementations can be removed.

 - "mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap
   device" (Youngjun Park)

   Address a uswsusp-vs-swapoff race and reduces the swap device
   reference taking/releasing frequency.

 - "mm/hmm: A fix and a selftest" (Dev Jain)

* tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (321 commits)
  selftests/mm/hmm-tests: test pagemap reads of PMD device-private entries
  fs/proc/task_mmu: do not warn on seeing non-migration pmd entry
  lib/test_hmm: check alloc_page_vma() return value and handle OOM
  mm/compaction: cap compact_gap() at COMPACT_CLUSTER_MAX
  mm/swap: remove redundant swap device reference in alloc/free
  mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device
  mm/filemap: use folio_next_index() for start
  vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
  sparc/mm: drop vmemmap_check_pmd helper and use generic code
  loongarch/mm: drop vmemmap_check_pmd helper and use generic code
  riscv/mm: drop vmemmap_pmd helpers and use generic code
  arm64/mm: drop vmemmap_pmd helpers and use generic code
  mm/sparse-vmemmap: provide generic vmemmap_set_pmd() and vmemmap_check_pmd()
  rust: page: mark Page::nid as inline
  userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks
  userfaultfd: gate must_wait writability check on pte_present()
  mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade
  fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
  fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
  fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
  ...
 2026-06-19 10:14:34 -07:00
Linus Torvalds
c98d767b34 Arm: 
"This is a bit of an odd merge window on the KVM/arm64 front. There is
 absolutely no new feature in the pull request. It is purely fixes,
 because it is simply becoming too hard to review new stuff when so
 many AI-fuelled fixes hit the list".
 
 - Significant cleanup of the vgic-v5 PPI support which was merged in
   7.1. This makes the code more maintainable, and squashes a couple
   of bugs in the meantime.
 
 - Set of fixes for the handling of the MMU in an NV context,
   particularly VNCR-triggered faults. S1POE support is fixed
   as well.
 
 - Large set of pKVM fixes, mostly addressing recurring issues
   around hypervisor tracking of donated pages in obscure cases
   where the donation could fail and leave things in a bizarre
   state.
 
 - Fixes for the so-called "lazy vgic init", which resulted in
   sleeping operations in non-preemptible sections. This turned
   out to be far more invasive than initially expected...
 
 - Reduce the overhead of L1/L2 context switch by not touching
   the FP registers.
 
 - Fix the way non-implemented page sizes are dealt with when
   a guest insist on using them for S2 translation.
 
 - The usual set of low-impact fixes and cleanups all over the map.
 
 Loongarch:
 
 - On a request for lazy FPU load, load all FPU state that the VM
   supports instead of enabling only the part (FPU, LSX or LASX)
   that caused the FPU load request.
 
 - Some enhancements about interrupt injection.
 
 - Some bug fixes and other small changes.
 
 RISC-V:
 
 - Batch G-stage TLB flushes for GPA range based page table updates
 
 - Convert HGEI line management to fully per-HART
 
 - Fix missing CSR dirty marking when FWFT state updated via ONE_REG
 
 - Fix stale FWFT feature exposure to Guest/VM
 
 - Speed up dirty logging write faults using MMU rwlock and atomic
   PTE updates using cmpxchg() for permission-only changes
 
 - Use flexible array for APLIC IRQ state
 
 - Use kvm_slot_dirty_track_enabled() for logging enable check on
   a memslot
 
 - Avoid skipping valid pages in kvm_riscv_gstage_wp_range()
 
 - Avoid skipping valid pages in kvm_riscv_gstage_unmap_range()
 
 - Use endian-specific __lelong for NACL shared memory
 
 S390:
 
 - KVM_PRE_FAULT_MEMORY support
 
 - Support for 2G hugepages
 
 - Support for the ASTFLEIE 2 facility
 
 - Support for fast inject using kvm_arch_set_irq_inatomic
 
 - Fix potential leak of uninitialized bytes
 
 - A few more misc gmap fixes.
 
 x86:
 
 - Generic support for the more granular permissions allowed by EPT,
   namely "read" (which was previously usurping the U bit) and
   separate execution bits for kernel and userspace.
 
 - Do not assume that all page tables start with U=1/W=1/NX=0 at the
   root, as AMD GMET needs to have U=0 at the root.
 
 - Introduce common assembly macros for use within Intel and AMD
   vendor-specific vmentry code.  This touches the SPEC_CTRL handling,
   which is now entirely done in assembly for Intel (by reusing the
   AMD code that already existed), and register save/restore which
   uses some macro magic to compute the offsets in the struct.  Both
   of these are preparatory changes for upcoming APX support.
 
 - Clean up KVM's register tracking and storage, primarily to prepare for
   APX support, which expands the maximum number of GPRs from 16 to 32.
 
 - Keep a single copy of the PDPTRs rather than two, since architecturally
   there is just one.
 
 - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code
   gets a chance to handle things like reaping the PML buffer.
 
 - Update KVM's view of PV async enabling if and only if the MSR write fully
   succeeds.
 
 - Fix a variety of issues where the emulator doesn't honor guest-debug state,
   and clean up related code along the way.
 
 - Synthesize EPT Violation and #NPF "error code" bits when injecting faults
   into L1 that didn't originate in hardware (in which case the VMCS/VMCB
   doesn't hold relevant information).
 
 - Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID
   faulting.
 
 - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a
   variety of minor bugs along the way.
 
 - Fix an OOB memory access due to not checking the VP ID when handling a
   Hyper-V PV TLB flush for L2.
 
 - Fix a bug in the mediated PMU's handling of fixed counters that allowed the
   guest to bypass the PMU event filter.
 
 - Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so
   the KVM can forward a "retry" status code to the guest, and reserve all
   unused error codes for future usage.
 
 - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as
   possible into the TDX code, and to funnel (almost) all S-EPT updates into
   a single chokepoint.  The motivation is largely to prepare for upcoming
   Dynamic PAMT support, but the cleanups are nice to have on their own.
 
 - Plug a hole in shadow page table handling, where KVM fails to recursively
   zap nested EPT/NPT shadow page tables when the nested hypervisor tears
   down its own EPT/NPT page tables from the bottom up
 
 x86 (Intel):
 
 - Support for nested MBEC (Mode-Based Execute Control), see above in the
   generic section; also run with MBEC enabled even for non-nested mode.
 
 - Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's
   level definitions (which are 0-based).
 
 - Rework the TDX memory APIs to not require/assume that guest memory is
   backed by "struct page" (in prepartion for guest_memfd hugepage support).
 
 - Fix a largely benign bug where KVM TDX would incorrectly state it could
   emulate several x2APIC MSRs.
 
 - Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written
   value is guest controlled and completely unvalidated.
 
 x86 (AMD):
 
 - Support for nested GMET (Guest Mode Execution Trap), see above in the
   generic section; also run with GMET enabled even for non-nested mode.
 
 - Fixes and minor cleanups to GHCB handling, on top of the earlier work
   already merged into 7.1-rc.
 
 - Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking
   fastpath handlers.
 
 - Add support for virtualizing gPAT (KVM previously just used L1's PAT when
   running L2).
 
 - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
   updates) when emulating VMRUN.
 
 - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
   notably where KVM didn't disable interception of IRR, ISR, and TMR regs.
 
 - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.
 
 - Don't advertise support for unusable VM types, and account for VM types
   that are disabled by firmware, e.g. to mitigate security vulnerabilities.
 
 - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and
   unnecessarily complicated, and add comprehensive tests.
 
 - Clean up and deduplicate the SEV page pinning code.
 
 - Fix minor goofs related to writing back CPUID information after firmware
   rejects a CPUID page for an SNP vCPU.
 
 Generic:
 
 - Rename invalidate_begin() to invalidate_start() throughout KVM to follow
   the kernel's nomenclature, e.g. for mmu_notifiers.
 
 - Use guard() to cleanup up various KVM+VFIO flows.
 
 - Minor cleanups.
 
 guest_memfd:
 
 - Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem
   range to multiple memslots, and fix the test that was supposed to ensure
   KVM returns -EEXIST.
 
 - Treat memslot binding offsets and sizes as unsigned values to fix a bug
   where KVM interprets a large "offset + size" as a negative value and allows
   a nonsensical offset.
 
 - Use the inode number instead of the page offset for the NUMA interleaving
   index to fix a bug where the effective index would jump by two for
   consecutive pages (the caller also adds in the page offset).
 
 Selftests:
 
 - Randomize the dirty log test's delay when reaping the bitmap on the first
   pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the
   bitmap before KVM could build up enough state to hit the bug.
 
 - A pile of one-off fixes and cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoypI0UHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroNCSAf8CyuvicojnZGFsNcoY4DZ0whBj5l8
 IwVkHaptuyGLSwPAebC/DwtU2NBY4CQdbtLjGmxenf+fSQOtcz1YWKbdY4Nr0hJG
 euAb/wO47RqKp1C4WPi7lL2P4XHgmUgD5XZ1qDnRV9gnGddZi3QLLmKgAtNq9Z4m
 +pAdGD2/RyZeI0Dx61+5ufE/z8YBlH6GrzgBTxfvvRNKqNDFykBenxYHI7seEfHC
 BPz0LxjHDD8BMDUo86qaylZnaeQSmFTGO/eTgvCvabxG6WbM1s0w3K1owmUmP7o3
 p9o8274Xh53iK2JYD/qGOtAJXejIwbYKT5bnvUQX0O1EH2+ouvSFapLQ9Q==
 =sSqM
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "arm64:

     This is a bit of an odd merge window on the KVM/arm64 front. There
     is absolutely no new feature in the pull request. It is purely
     fixes, because it is simply becoming too hard to review new stuff
     when so many AI-fuelled fixes hit the list.

   - Significant cleanup of the vgic-v5 PPI support which was merged in
     7.1. This makes the code more maintainable, and squashes a couple
     of bugs in the meantime

   - Set of fixes for the handling of the MMU in an NV context,
     particularly VNCR-triggered faults. S1POE support is fixed as well

   - Large set of pKVM fixes, mostly addressing recurring issues around
     hypervisor tracking of donated pages in obscure cases where the
     donation could fail and leave things in a bizarre state

   - Fixes for the so-called "lazy vgic init", which resulted in
     sleeping operations in non-preemptible sections. This turned out to
     be far more invasive than initially expected..

   - Reduce the overhead of L1/L2 context switch by not touching the FP
     registers

   - Fix the way non-implemented page sizes are dealt with when a guest
     insist on using them for S2 translation

   - The usual set of low-impact fixes and cleanups all over the map

  Loongarch:

   - On a request for lazy FPU load, load all FPU state that the VM
     supports instead of enabling only the part (FPU, LSX or LASX) that
     caused the FPU load request

   - Some enhancements about interrupt injection

   - Some bug fixes and other small changes

  RISC-V:

   - Batch G-stage TLB flushes for GPA range based page table updates

   - Convert HGEI line management to fully per-HART

   - Fix missing CSR dirty marking when FWFT state updated via ONE_REG

   - Fix stale FWFT feature exposure to Guest/VM

   - Speed up dirty logging write faults using MMU rwlock and atomic PTE
     updates using cmpxchg() for permission-only changes

   - Use flexible array for APLIC IRQ state

   - Use kvm_slot_dirty_track_enabled() for logging enable check on a
     memslot

   - Avoid skipping valid pages in kvm_riscv_gstage_wp_range()

   - Avoid skipping valid pages in kvm_riscv_gstage_unmap_range()

   - Use endian-specific __lelong for NACL shared memory

  S390:

   - KVM_PRE_FAULT_MEMORY support

   - Support for 2G hugepages

   - Support for the ASTFLEIE 2 facility

   - Support for fast inject using kvm_arch_set_irq_inatomic

   - Fix potential leak of uninitialized bytes

   - A few more misc gmap fixes

  x86:

   - Generic support for the more granular permissions allowed by EPT,
     namely "read" (which was previously usurping the U bit) and
     separate execution bits for kernel and userspace

   - Do not assume that all page tables start with U=1/W=1/NX=0 at the
     root, as AMD GMET needs to have U=0 at the root

   - Introduce common assembly macros for use within Intel and AMD
     vendor-specific vmentry code. This touches the SPEC_CTRL handling,
     which is now entirely done in assembly for Intel (by reusing the
     AMD code that already existed), and register save/restore which
     uses some macro magic to compute the offsets in the struct. Both of
     these are preparatory changes for upcoming APX support

   - Clean up KVM's register tracking and storage, primarily to prepare
     for APX support, which expands the maximum number of GPRs from 16
     to 32

   - Keep a single copy of the PDPTRs rather than two, since
     architecturally there is just one

   - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor
     code gets a chance to handle things like reaping the PML buffer

   - Update KVM's view of PV async enabling if and only if the MSR write
     fully succeeds

   - Fix a variety of issues where the emulator doesn't honor
     guest-debug state, and clean up related code along the way

   - Synthesize EPT Violation and #NPF "error code" bits when injecting
     faults into L1 that didn't originate in hardware (in which case the
     VMCS/VMCB doesn't hold relevant information)

   - Add support for virtualizing (well, emulating) AMD's flavor of
     CPL>0 CPUID faulting

   - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and
     fix a variety of minor bugs along the way

   - Fix an OOB memory access due to not checking the VP ID when
     handling a Hyper-V PV TLB flush for L2

   - Fix a bug in the mediated PMU's handling of fixed counters that
     allowed the guest to bypass the PMU event filter

   - Allow userspace to return EAGAIN when handling SNP and TDX
     hypercalls, so the KVM can forward a "retry" status code to the
     guest, and reserve all unused error codes for future usage

   - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific
     logic as possible into the TDX code, and to funnel (almost) all
     S-EPT updates into a single chokepoint. The motivation is largely
     to prepare for upcoming Dynamic PAMT support, but the cleanups are
     nice to have on their own

   - Plug a hole in shadow page table handling, where KVM fails to
     recursively zap nested EPT/NPT shadow page tables when the nested
     hypervisor tears down its own EPT/NPT page tables from the bottom
     up

  x86 (Intel):

   - Support for nested MBEC (Mode-Based Execute Control), see above in
     the generic section; also run with MBEC enabled even for non-nested
     mode

   - Use the kernel's "enum pg_level" in the TDX APIs instead of the
     TDX-Module's level definitions (which are 0-based)

   - Rework the TDX memory APIs to not require/assume that guest memory
     is backed by "struct page" (in prepartion for guest_memfd hugepage
     support)

   - Fix a largely benign bug where KVM TDX would incorrectly state it
     could emulate several x2APIC MSRs

   - Use the "safe" WRMSR API when proxying LBR MSR writes as the
     to-be-written value is guest controlled and completely unvalidated

  x86 (AMD):

   - Support for nested GMET (Guest Mode Execution Trap), see above in
     the generic section; also run with GMET enabled even for non-nested
     mode

   - Fixes and minor cleanups to GHCB handling, on top of the earlier
     work already merged into 7.1-rc

   - Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking
     fastpath handlers

   - Add support for virtualizing gPAT (KVM previously just used L1's
     PAT when running L2)

   - Fix goofs where KVM mishandles side effects (e.g. single-step and
     PMC updates) when emulating VMRUN

   - Fix a variety of bugs in AVIC's handling of x2APIC MSR
     interception, most notably where KVM didn't disable interception of
     IRR, ISR, and TMR regs

   - Add support for virtualizing Host-Only/Guest-Only bits in the
     mediated PMU

   - Don't advertise support for unusable VM types, and account for VM
     types that are disabled by firmware, e.g. to mitigate security
     vulnerabilities

   - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with
     bugs and unnecessarily complicated, and add comprehensive tests

   - Clean up and deduplicate the SEV page pinning code

   - Fix minor goofs related to writing back CPUID information after
     firmware rejects a CPUID page for an SNP vCPU

  Generic:

   - Rename invalidate_begin() to invalidate_start() throughout KVM to
     follow the kernel's nomenclature, e.g. for mmu_notifiers

   - Use guard() to cleanup up various KVM+VFIO flows

   - Minor cleanups

  guest_memfd:

   - Return -EEXIST instead of -EINVAL if userspace attempts to bind a
     gmem range to multiple memslots, and fix the test that was supposed
     to ensure KVM returns -EEXIST

   - Treat memslot binding offsets and sizes as unsigned values to fix a
     bug where KVM interprets a large "offset + size" as a negative
     value and allows a nonsensical offset

   - Use the inode number instead of the page offset for the NUMA
     interleaving index to fix a bug where the effective index would
     jump by two for consecutive pages (the caller also adds in the page
     offset)

  Selftests:

   - Randomize the dirty log test's delay when reaping the bitmap on the
     first pass, as always waiting only 1ms hid a KVM RISC-V bug as the
     test reaped the bitmap before KVM could build up enough state to
     hit the bug

   - A pile of one-off fixes and cleanups"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (326 commits)
  KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
  KVM: x86: Fix shadow paging use-after-free due to unexpected role
  KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject
  KVM: s390: Enable adapter_indicators_set to use mapped pages
  KVM: s390: Add map/unmap ioctl and clean mappings post-guest
  riscv: kvm: Use endian-specific __lelong for NACL shared memory
  KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32
  KVM: s390: vsie: Implement ASTFLEIE facility 2
  KVM: s390: vsie: Refactor handle_stfle
  s390/sclp: Detect ASTFLEIE 2 facility
  KVM: s390: Minor refactor of base/ext facility lists
  KVM: x86/mmu: move pdptrs out of the MMU
  KVM: x86: check that kvm_handle_invpcid is only invoked with shadow paging
  KVM: nSVM: invalidate cached PDPTRs across nested NPT transitions
  KVM: nVMX: remove unnecessary code in prepare_vmcs02_rare
  KVM: x86: remove nested_mmu from mmu_is_nested()
  KVM: arm64: vgic-its: Make ABI commit helpers return void
  KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
  LoongArch: KVM: Add missing slots_lock for device register/unregister
  LoongArch: KVM: Validate irqchip index in irqfd routing
  ...
 2026-06-19 08:56:49 -07:00
Bartosz Golaszewski
442d60df74 x86/platform/geode: reference the real node of the cs5535 GPIO controller 
GPIO software node lookup should rely exclusively on matching the
addresses of the referenced firmware nodes. Commit e5d527be7e ("gpio:
swnode: don't use the swnode's name as the key for GPIO lookup") tried to
enforce this but had to be reverted: it broke existing users who abuse the
software node mechanism by creating "dummy" software nodes named after the
device they want to get GPIOs from, without ever attaching them to the
actual GPIO devices. Those users rely on GPIOLIB matching the label of the
GPIO controller against the name of the software node rather than on a real
firmware node link.

Un-reverting e5d527be7e therefore requires converting all such users to
real firmware node lookup. The geode board setup is one of them: it
references the cs5535 GPIO controller through a locally-defined dummy node
named "cs5535-gpio".

The cs5535 MFD driver now exports the software node associated with its
GPIO controller cell as cs5535_gpio_swnode. Use it as the target of the
GPIO software node references in geode-common.c instead of the dummy node,
so the lookup resolves by firmware node address. As the referenced node
must exist at lookup time, make the cs5535 driver built-in for all boards
selecting GEODE_COMMON (depend on GPIO_CS5535=y). The node is exported in
the "CS5535" namespace, so import it in this module.

Acked-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://patch.msgid.link/20260611-cs5535-swnode-v3-1-2b0c517c0c03@oss.qualcomm.com
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
 2026-06-19 10:52:09 +02:00
Kees Cook
dfe05fcca8 x86: Remove arch-specific strncpy() implementation 
strncpy() has no remaining callers in the kernel[1]. Remove the
x86-32-specific inline assembly implementation and __HAVE_ARCH_STRNCPY
define, falling back to the generic version in lib/string.c.

Link: https://github.com/KSPP/linux/issues/90 [1]
Signed-off-by: Kees Cook <kees@kernel.org>
 2026-06-18 16:37:13 -07:00
Linus Torvalds
59a6c7ac0a bitmap updates for v7.2 
- new handy helper FIELD_GET_SIGNED() (Yury);
  - arch test_and_set_bit_lock() and clear_bit_unlock() cleanup (Randy);
  - __bf_shf() simplification (Yury);
  - bitmap_print_to_pagebuf() removal (Yury);
  - RISCV/bitrev conditional support (Jindie, Yury);
 -----BEGIN PGP SIGNATURE-----
 
 iQGzBAABCgAdFiEEi8GdvG6xMhdgpu/4sUSA/TofvsgFAmowS0sACgkQsUSA/Tof
 vshqLgwAw2RkV8ZHAniyPgz4noGztto+fcD70UbMgkh48n46PSKIUPCUvOj4RGHc
 Nzcjg6VkHLlypb7U3fHoXOHhkt+nTt+OeVDtZCmr8OzlRYmWXAo9TptfalDAlH1A
 OucRocjYSkwl/nbuYk0EQ/0+AcTFlfVTeyyus6wUYt7Nj1ncCNjKF2K5EjtF4aoQ
 JiA4d9LKWCIN4qFodP/9aFDzLX5MvqHgvOmBPSSFZKkMAer9HHCa/V3jHH3JMh21
 bMPjZvaPUCI9oywLL+pDe0RRhP1CYFevxJ/Tnpcx0elV+CekrzuSsM3zpRbPt6hR
 0P+8VVzUuoI8yth5mSH1gvUn9ZDvDeognTpKpXR574lB83A8Ub/Gu/NGMXO3TY0q
 mtuVbI5ZG0dCqahjEZvJQJmZ/qqbmwDhQDBtPS0x3S9XyzhNAga+JFpr6FXhULx8
 b8ZrDPc5BGLtTt5aBOAgpN10CeFM8JHxku1B489sqRXQWaeKW++GkVfVTZ9UOK1E
 8c3l/1Bl
 =z8f4
 -----END PGP SIGNATURE-----

Merge tag 'bitmap-for-7.2' of https://github.com/norov/linux

Pull bitmap updates from Yury Norov:
 "This includes the new FIELD_GET_SIGNED() helper,
  bitmap_print_to_pagebuf() removal, RISCV/bitrev support, and a couple
  cleanups.

   - new handy helper FIELD_GET_SIGNED() (Yury)

   - arch test_and_set_bit_lock() and clear_bit_unlock() cleanup (Randy)

   - __bf_shf() simplification (Yury)

   - bitmap_print_to_pagebuf() removal (Yury)

   - RISCV/bitrev conditional support (Jindie, Yury)"

* tag 'bitmap-for-7.2' of https://github.com/norov/linux:
  MAINTAINERS: BITOPS: include bitrev.[ch]
  arch/riscv: Add bitrev.h file to support rev8 and brev8
  bitops: Define generic___bitrev8/16/32 for reuse
  lib/bitrev: Introduce GENERIC_BITREVERSE
  arch: select HAVE_ARCH_BITREVERSE conditionally on BITREVERSE
  bitmap: fix find helper documentation
  bitmap: drop bitmap_print_to_pagebuf()
  cpumask: switch cpumap_print_to_pagebuf() to using scnprintf()
  bitfield: wire __bf_shf to __builtin_ctzll
  bitops: use common function parameter names
  ptp: switch to using FIELD_GET_SIGNED()
  rtc: rv3032: switch to using FIELD_GET_SIGNED()
  wifi: rtw89: switch to using FIELD_GET_SIGNED()
  iio: mcp9600: switch to using FIELD_GET_SIGNED()
  iio: pressure: bmp280: switch to using FIELD_GET_SIGNED()
  iio: magnetometer: yas530: switch to using FIELD_GET_SIGNED()
  iio: intel_dc_ti_adc: switch to using FIELD_GET_SIGNED()
  x86/extable: switch to using FIELD_GET_SIGNED()
  bitfield: add FIELD_GET_SIGNED()
 2026-06-17 11:38:38 +01:00
Linus Torvalds
9c87e61e3c bpf-next-7.2 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmowIHwACgkQ6rmadz2v
 bTqRog/+KIO6wpvuizt8N+vzgKeEYR/KlEPEyV5dGAopIk1Ct5Ahzti1/V6zg7hk
 oddWhPewF7QncVLdnL6zRCRahXCHOi30148acG8pj3Fwj/iYw/zVihVkppVt9qRU
 REAvFj0/hYJOGzttSt9UfQ78ZftrZNhXFCRIK/zUWj72IVMJD04Vbawo8iIixVtu
 I+fCB3A1kv+RMlZ/3TWk11z3Fko4lK/jKpujegIzv6s+n+0lAraF0aw0cWMwNpUj
 mtJx2PktPHYbjA5CwE1Fyxf6EhV4OhV5gwyET7gzqITG5zjUo45pMNcA7EAxDyiC
 NvTGIZMsAC+9iSSLNSfdjBWExXFYHHuCkeoxkw9ei05Qrye/7lYzwwtgImuyhBZG
 xNXrnSNCG5BPl+DCLy09LzzwNdRoP7zYZV3QH/ZU0uMTS6foegYoSM8jSa2skmM+
 mR8a4qrMeZTv+XWvScduOqtFMBOv3mSPkZMkoyqReLaMIPse5NuUOTxOGn5REu4X
 tQLW0GLa6ad/7udv7DYrSfmwK1dihyOPmZl/GMuGroXm4rW4jNojljNBdTFEWjCQ
 Rd9qArq1Z1z/g8mWjTdiRRGa/QzF5rmJRLgjjUKIzUlQ5/77t96ls0jLexsRZQx5
 hCdu/HoK+pIRIUy20NtdqA8ykowsfUkyEBjYR28GV4RHvtmgW5k=
 =rtQD
 -----END PGP SIGNATURE-----

Merge tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next

Pull bpf updates from Alexei Starovoitov:
 "Major changes:

   - Recover from BPF arena page faults using a scratch page and add
     ptep_try_set() for lockless empty-slot installs on x86 and arm64.

     This allows BPF kfuncs to access arena pointers directly.

     The 'arena_direct_access' stable branch was created for this work
     and was pulled into sched-ext and bpf-next trees (Tejun Heo, Kumar
     Kartikeya Dwivedi)

   - Lift old restriction and support 6+ arguments in BPF programs and
     kfuncs on x86 and arm64 (Yonghong Song, Puranjay Mohan)

  Other features and fixes:

   - Add 24-bit BTF vlen and reclaim unused bits in the BTF UAPI to ease
     addition of new BTF kinds (Alan Maguire)

   - Raise the maximum BPF call chain depth from 8 to 16 frames (Alexei
     Starovoitov)

   - Refactor object relationship tracking in the verifier and fix a
     dynptr use-after-free bug (Amery Hung)

   - Harden the signed program loader and reject exclusive maps as inner
     maps (Daniel Borkmann)

   - Replace the verifier min/max bounds fields with a circular number
     (cnum) representation and improve 32->64 bit range refinements
     (Eduard Zingerman)

   - Introduce the arena library and runtime (libarena) with a buddy
     allocator, rbtree and SPMC queue data structures, ASAN support and
     a parallel test harness. Allow subprograms to return arena pointers
     and switch to a BTF type-tag based __arena annotation (Emil
     Tsalapatis)

   - Cache build IDs in the sleepable stackmap path and avoid faultable
     build ID reads under mm locks (Ihor Solodrai)

   - Introduce the tracing_multi link to attach a single BPF program to
     many kernel functions at once. Allow specifying the uprobe_multi
     target via FD (Jiri Olsa)

   - Extend the bpf_list family of kfuncs with bpf_list_add/del(), and
     bpf_list_is_first/is_last/empty() (Kaitao Cheng)

   - Extend the BPF syscall with common attributes support for
     prog_load, btf_load and map_create (Leon Hwang)

   - Wrap rhashtable as BPF map (Mykyta Yatsenko, Herbert Xu)

   - Add sleepable support for tracepoint programs and fix deadlocks in
     LRU map due to NMI reentry (Mykyta Yatsenko)

   - Fix OOB access in bpf_flow_keys, fix nullness analysis of inner
     arrays, enforce write checks for global subprograms (Nuoqi Gui)

   - Report the maximum combined stack depth and print a breakdown of
     instructions processed per subprogram (Paul Chaignon)

   - Add an XDP load-balancer benchmark and arm64 JIT support for stack
     arguments (Puranjay Mohan)

   - Add kfuncs to traverse over wakeup_sources (Samuel Wu)

   - Allow sleepable BPF programs to use LPM trie maps directly (Vlad
     Poenaru)

   - Many more fixes and cleanups across the verifier, BTF, sockmap,
     devmap, bpffs, security hooks, s390/riscv/loongarch JITs,
     rqspinlock, libbpf, bpftool, selftests"

* tag 'bpf-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (336 commits)
  selftests/bpf: Work around llvm stack overflow in crypto progs
  selftests/bpf: add test for bpf_msg_pop_data() overflow
  bpf, sockmap: fix integer overflow in bpf_msg_pop_data() bounds check
  sockmap: Fix use-after-free in udp_bpf_recvmsg()
  bpf, sockmap: keep sk_msg copy state in sync
  bpf, sockmap: Fix wrong rsge offset in bpf_msg_push_data()
  bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data()
  selftsets/bpf: Retry map update on helper_fill_hashmap()
  selftests/bpf: Add test for sleepable lsm_cgroup rejection
  selftests/bpf: Add test to verify the fix for bpf_setsockopt() helper
  bpf: Fix bpf_get/setsockopt to tos for ipv4-mapped ipv6 socket
  selftests/bpf: Avoid static LLVM linking for cross builds
  selftests/bpf: Use common CFLAGS for urandom_read
  selftests/bpf: Initialize operation name before use
  tools/bpf: build: Append extra cflags
  libbpf: Initialize CFLAGS before including Makefile.include
  bpftool: Append extra host flags
  bpftool: Avoid adding EXTRA_CFLAGS to HOST_CFLAGS
  bpftool: Pass host flags to bootstrap libbpf
  selftests/bpf: correct CONFIG_PPC64 macro name in comment
  ...
 2026-06-17 09:18:14 +01:00
Linus Torvalds
b082086174 * Add TDX module update support 
* Make kexec and TDX finally place nice together
  * Put TDX error codes into a single header
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVgUACgkQaDWVMHDJ
 krDwsw/9FKXndYdeSc7P8sJwjSlc9U4PFy/6rdUfnYCP1c2BTeVqNxZvCz+T9E4V
 Ld4UjjTLCbEq1uQ2UdYugpLnSKSNzf6MEp06Tsq2cRlEcPQBLGaACo+7dnBrUf6g
 zVUY0lPh1Jlxa+FBzMLf/H1qyUGl/Lv8msmgrC9fHHwQgsPYMgKUU6t72ScRG6FA
 kUk0crzI1DlSpFFVbXuRIpZSmLFPgyx5TNkteGJrP6q3iR6zYuc30MQsV2GalFrv
 qrn4cz3EmW0vousqpg7EA6J7okTUem/iswbxbQnpR4AMdJ7NwkKfa/OvHa6UB9UL
 Nb5gE7lxplKOlJKfeGjrL6ABazpwsk0J4oS9r2GoWDfs30ji3TX5ixVvJ1KCFAFZ
 dEkS1SazNjAWuDWuptVbu3+4DV34XSUg+kvcCXNTlOHz5KVg5ASzjF0QFvXexjCD
 BhcIqJ3OI8VtL4AI+HXg+GTpHOUYtGct/Y+5gB16VvoSuX9vNOPBYx2M9Q4Nhb/C
 U9eM7wqaS6lxX4UGId0ZgrNwHROreTEeGBScn1q1Rm7B6qJgeYo7wrzuKXCyRgcb
 /evbcZ1DWJTXEORsJobzNiXHQWBtAEs4rLycOKAGx8//kD7vEmy2itslPlEaSgFq
 jvoAHRNpiE3VW/hItB8WFTgWxiKaIz624gNrMjI2RYI/JSNhKVo=
 =Y3yy
 -----END PGP SIGNATURE-----

Merge tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 TDX updates from Dave Hansen:
 "There are a few cleanups, and some changes that should allow TDX and
  kexec to coexist nicely.

  The biggest change, however, is support for updating the TDX module
  after boot, just like CPU microcode. TDX users really want this
  because it lets them do security updates without tearing things down
  and rebooting.

   - Add TDX module update support

   - Make kexec and TDX finally place nice together

   - Put TDX error codes into a single header"

* tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (30 commits)
  x86/virt/tdx: Document TDX module update
  x86/virt/tdx: Enable TDX module runtime updates
  x86/virt/tdx: Refresh TDX module version after update
  coco/tdx-host: Lock out module updates when reading version
  x86/virt/seamldr: Add module update locking
  x86/virt/tdx: Restore TDX module state
  x86/virt/seamldr: Initialize the newly-installed TDX module
  x86/virt/seamldr: Install a new TDX module
  x86/virt/tdx: Reset software states during TDX module shutdown
  x86/virt/seamldr: Shut down the current TDX module
  x86/virt/seamldr: Abort updates after a failed step
  x86/virt/seamldr: Introduce skeleton for TDX module updates
  x86/virt/seamldr: Allocate and populate a module update request
  coco/tdx-host: Implement firmware upload sysfs ABI for TDX module updates
  coco/tdx-host: Don't expose P-SEAMLDR information on CPUs with erratum
  coco/tdx-host: Expose P-SEAMLDR information via sysfs
  x86/virt/seamldr: Add a helper to retrieve P-SEAMLDR information
  x86/virt/seamldr: Introduce a wrapper for P-SEAMLDR SEAMCALLs
  coco/tdx-host: Expose TDX module version
  coco/tdx-host: Introduce a "tdx_host" device
  ...
 2026-06-16 06:26:12 +05:30
Linus Torvalds
7d36844ae7 * Fix freeing of PMD-sized vmemmap pages 
* Update comment about pgd_list
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVdwACgkQaDWVMHDJ
 krARXA//c+FCH86tcGuZndWmebCP5ZuPFDkZMQuK53cg2hZq6OHUSxDL989iq/AO
 YMfKR+CFJtpMd3fiLiASbks+mctWLJYjX1eWFvjtGaZPsH4u0CdlbPkYsfY5OKcA
 NYeZ9Pbag/DYDu/SvSylDaYR0P1VgncaF4fhP5gH3YbhEU4rzNyrf6T+HBPz0B1h
 iXWre0QAkXLrx2pkKRx8h55uy+hNLjLfExD6tbMMxnOHtOVaBL+JHG8czBgv6P7F
 VrQ2vu8BKBqq8+rPGFVuolvGri2iM+hpddemKzc/wFHxP9oW7bLj9bieuoQk3R3p
 1ILhDF0rfwoTzgzw2wD3yJpzP5BNB+tqlOqnN+KUFK8w1l01I1dbzfz/Ib/ozH3O
 fAOLCAC9nlZ0VFozzPvpe3YHGI2feK/sW0Wh3X7YcfibmofpCHn8BkSgCo0cEjXs
 JkcMqyCPEyYQUwWvbV39yeMKUnfi447UQdr95q4QNxi8stozQewLN6r/Y4DnGuEi
 qZWzOSBGr3wCK25Tn0MF4vv0oVWb+4UFhF/79FkJBPZq78390XcmyYBC/tiWx8KJ
 qQPhpfk3TIga2mmQsq1qwr4am7XXwjmB6sZHaprV7LDq/YLFnJTsmhIsq0nicrYZ
 88S+XF94z/woCEUMaYjcp7E+bBUu5n4i2yWocu5yHwFd0pmuDGo=
 =tM/K
 -----END PGP SIGNATURE-----

Merge tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 mm updates from Dave Hansen:
 "There's a small comment fixup, followed by an actual bug fix. The bug
  fix is slightly new territory for us. It fixes a real regression, but
  it is from ~6.18 not a _new_ regression. It was mostly only biting
  folks doing hotplug memory testing. So, it was queued in here and held
  for the merge window instead of going via x86/urgent.

   - Fix freeing of PMD-sized vmemmap pages

   - Update comment about pgd_list"

* tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/mm: Fix freeing of PMD-sized vmemmap pages
  x86: Update comment about pgd_list
 2026-06-16 06:17:23 +05:30
Linus Torvalds
ee7a8593c0 * Move Rick Edgecombe to TDX maintainer 
* Remove unused header
  * Ensure printf() validation in all configs
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVYsACgkQaDWVMHDJ
 krCtFhAAjNOBz4+N7RHyG45U8AX5zLFSvKLia0SIEvgnprYNT7WJqFHDYLajRV4C
 62m6OBinY4NkG5tbwABOj4XsdYGC1S2tVOTqTxtvC/6FvsUE8gKkjYDL58fnFeST
 m1RCryPiDyrauc5mrN41pMvYIHE8Dgw+8Yor35RzZP1Nr4wwN5LtOPHmIZbz/QVj
 XVcheDNBQU4jRa5OnTnmx97spywTlT9JnWyO1F9gKkTwBA6+sl1tAd9FXsfxGw9t
 JWLJqPxpz/1G/gI13KOau6WkfwdPUxQioJ4ZIbO+C2UemUFYu+ZGwbdHnSVkdzdJ
 4xU6w3lS9MdprS01V7EQrwaZmsdH7z6lvoHsnwN2Wal+Sagt3Ukr/dEBWDlJmzTB
 +HfFFEmZL9UTPDoHGUoLOVEy4NafAwZZBDOciJe8K0qLGqg4S8xCw2W9LhfJGIGp
 W6fSYssmOJX40qFvDpLX6GOK/MEkCerqfUfcFFCaKd2ZGnM4qsKtfHxYLbHL1Soq
 TkWsC5hMWImi1tiuEdqDtPUODWiZ7k0HTN2C/9pI4IIUMUxdB3Jm3c43GuGsZNl0
 y9PGVq8uIZiRV8FAu8NBsPb65UzRNVFPH8WATxTK2mVsMqzGxwMpM5ROQ3pkiPu+
 DL1izUOADIYkxkvt00K5Lc5tOP29vCE6lKH5neXeZjhvfLEHb0U=
 =8iBm
 -----END PGP SIGNATURE-----

Merge tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull misc x86 updates from Dave Hansen:
 "These are the usual random pile, with the one exception of moving Rick
  over to be a TDX maintainer. Rick has been doing a great job with TDX
  contributions, especially on the host side of things. It's time to
  promote him to "M".

   - Move Rick Edgecombe to TDX maintainer

   - Remove unused header

   - Ensure printf() validation in all configs"

* tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  MAINTAINERS: Move Rick Edgecombe to TDX maintainer
  x86: Remove unnecessary architecture-specific <asm/device.h>
  x86/bug: Put HAVE_ARCH_BUG_FORMAT_ARGS WARN definitions inside __ASSEMBLER__
  x86/bug: Add printf() validation to HAVE_ARCH_BUG_FORMAT_ARGS WARNs
 2026-06-16 06:10:22 +05:30
Linus Torvalds
c61f479852 - Remove redundant GHCB initialization guards in the SEV page state and SVSM 
call paths now that the GHCB helpers handle early-boot fallback internally
 
 - Skip SNP initialization in the CCP driver immediately when the preparation
   step fails rather than proceeding to an operation that will certainly fail
 
 - Abort SNP preparation and return an error when not all CPUs are online,
   since the firmware enforces that every CPU enables SNP and will fail init if
   not
 
 - Simplify the VMM communication exception entry path by replacing separate
   kernel and user mode macros with a single handler that dispatches based on
   the current privilege level
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowORwACgkQEsHwGGHe
 VUqphg//VVXH3Svs2K5+++WQvavXDVwB5B+W4KA5WYYz3I77nmXgb2++aGSptGfy
 ckC8ESFwyRWRh6aaOMtWGdbTQryS9e72sqiZEphbAZCe2XwR/A0N60uUktUCGm1W
 3ce/VRkeTJI4LTkx3g+VSPTGzDpqfbwwTAJQZt8Ny8kooQCUH+VA7JvyLOYFvyTg
 4NtjP2MVTzjE1io9SpZdSAbG/wdn7l7cFI+xC1QXYKZBzHSK5e4vUwnSGd86lrCa
 2Q+zVcGcA7w2J6Obx4dNde5Y7AhGmYnhDxbFtNp9iUmG/o75LpVvP+8v7wshSGiL
 HjTsRy5tkjrF9MUNXZd6cwFQ9gs6wWAwxXUsPtfs2N8R6Ve0W9aR49MUp1sEFuKm
 hNgRLA7idSQ0RUSrL4f3c7Zx8ML6nXM2yRgE+4UTbr5/untHCqYunHelEIy1uay5
 2vbqJ5VzT+pfY9qZn+q41AM2E1+ZzLmXFuGPBSOU4G+dU0CoVo+OUrsKZh8Q/4Ff
 DajeiTW1+UidZyk2nb+HoX3DIa7jsUBeA3IGAQv8wK31jj3XhKwJTFPwPGkdjcpw
 iR35vPzZFh0JLm+AHGrjgLI2+DkWEKl3j6lxI94UxsugaqkywtPZ5XJhJC54YHS9
 iOwlpZK37eYy6zITx1+bwfzrW4oSsEZyYHkNgYJhU/RW4MrNJiU=
 =Wq1K
 -----END PGP SIGNATURE-----

Merge tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 SEV updates from Borislav Petkov:

 - Remove redundant GHCB initialization guards in the SEV page state and
   SVSM call paths now that the GHCB helpers handle early-boot fallback
   internally

 - Skip SNP initialization in the CCP driver immediately when the
   preparation step fails rather than proceeding to an operation that
   will certainly fail

 - Abort SNP preparation and return an error when not all CPUs are
   online, since the firmware enforces that every CPU enables SNP and
   will fail init if not

 - Simplify the VMM communication exception entry path by replacing
   separate kernel and user mode macros with a single handler that
   dispatches based on the current privilege level

* tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
  crypto/ccp: Skip SNP_INIT if preparation fails
  x86/sev: Do not initialize SNP if missing CPUs
  x86/entry: Zap the #VC entry user and kernel macros
 2026-06-16 05:57:30 +05:30
Linus Torvalds
97cc7dc16a - Move the zero-revision fixup for AMD microcode to the patch level 
retrieval function and restrict it to Zen family processors, ensuring
   patch level arithmetic always operates on a valid revision
 
 - Fix an incorrect comment about which CPUID bit is checked when
   determining whether the microcode loader should be disabled
 
 - Add the latest Intel microcode revision data for a broad range of
   processor models and steppings and add the script which generates the
   header of minimum expected Intel microcode revisions
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowMfYACgkQEsHwGGHe
 VUq4jRAAiUoRmAPSgxfw6fNzn+VcH2pxRa987HtZM/teJO9dec2fswhnOsOdx1Y+
 hbQ1uxPdgZzowg2CJL/Il+QNGjpVkA0SaVbnlamX5bRMuEKdWXXawf0eeV3EMmmh
 f+LaN/jQ3+vuE5boSOh1tVGQOTPyuyOg977leXSPlXxyTMyrVuLAN6+Zs/qsuhSY
 vWTKY40E+1ZeDHCXcNtOhxKXR7tGjgGrjqLMx0bbs8z1DOP2OJpILHdgPB9igghb
 hg5uUSj2LTd+28/H0HIu5RqfI7/ulQPBmLFYmw6ENLSR4U3GEtg0gItZEXL6E8Dz
 UZVMqorpAMV41cPyBvStfK6R8cvGEe6m+iidmsTQDVvQWX9xnSNX1N+HV6Xr+fjN
 kuPZLEGhkmDRe8mup+n5t/wqw4iDFrfqhgPGgFN2fwDFcs9oJfAHTgMvpdvWGG/2
 hbME8PGWFv+N3Piy4GqROuVjcm0cbTTzdzWmWEZ8qO3OakSDC9vex5061/O5DmFB
 vI7QHanc3Xe3vuf20Jnbc8LFkw54zHBSITrguah0yJFsVqE4tktSsy3NIHLxdP87
 7e4oCzmP7oelCgxzvKyZiHzNtzrngGT9L0Nowcg9y/iibWzOkW8F9Ek5NqMaUyo4
 JEKXizudArM6oZUtk+E6CAhGotL1en/FhfBmungtaExA2BnCJtc=
 =KarZ
 -----END PGP SIGNATURE-----

Merge tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 microcode loader updates from Borislav Petkov:

 - Move the zero-revision fixup for AMD microcode to the patch level
   retrieval function and restrict it to Zen family processors, ensuring
   patch level arithmetic always operates on a valid revision

 - Fix an incorrect comment about which CPUID bit is checked when
   determining whether the microcode loader should be disabled

 - Add the latest Intel microcode revision data for a broad range of
   processor models and steppings and add the script which generates the
   header of minimum expected Intel microcode revisions

* tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/microcode/AMD: Move the no-revision fixup to get_patch_level()
  x86/microcode: Fix comment in microcode_loader_disabled()
  scripts/x86/intel: Add a script to update the old microcode list
  x86/microcode/intel: Refresh old_microcode defines with Nov 2025 release
 2026-06-16 05:45:36 +05:30
Linus Torvalds
454761e121 - The usual pile of cleanups and fixlets the cat dragged in 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowF/UACgkQEsHwGGHe
 VUqPFQ//WJ62+aEsmuuZZ/HWuU/Warawn3R5Hm0DxgXAssUviuyOKBJhoP9ApaCK
 SfyNxSqcu2QJed0tZXfJsF+qH8OrNf/FjkenWpgrBJDtl+qiRRT/WRekVtzUR5WO
 HFemO+vnR5lgKKPwPlDFGs3/rARHPWs8HEl984PrjZJajwWnQujhkdZA88Hj8ehH
 hglS780Uitdp/8aqYB8mlsDdb1JPL2m3Ajoagij7nX9FjLz4fayMjiQW+w/XfYTw
 VP9vJtwXsVHP8inFLJPctKx2XRNYKU4g6WOGd2j3tIIeE9pvOpRbLJopeFgWAzbU
 zhxCMMlW30KmuBIRAUQAG6B2xlJxAqsZbH7om7QPXRNLYJ8wMlqPqZ5Q3WW52cmo
 YLbFDtcrHSn79Gukn0RZIN66xc6h1zKakhByZ5IPAB4GK2aJcS1f6OJCMIVknZUy
 FlkCH+YiRSWn3yJVUgeVK8QbG0+n4r+a2QhnT/ems2nVzmBvLYHbV9QtKEdfxTj8
 aD8Nwjh40mYvzOkbzCVyPO7QR/7SxIumaT/LsDvxMMMKBzuzS6BEy8WBtztxhhsU
 yTABDf8WInRwTPe8P8jCArpFRlRbLeXkkBqzvQlWMJEty1Md1Id+LdAF+hCEOTip
 jEYPWnmsaEnIFcJUQ/Am9f+ST8sq91kR92fLadxiWIuLjyQA1bo=
 =sSrt
 -----END PGP SIGNATURE-----

Merge tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 cleanups from Borislav Petkov:

 - The usual pile of cleanups and fixlets the cat dragged in

* tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
  x86/pmem: Check for platform_device_alloc() retval
  x86/platform/uv: Use str_enabled_disabled() in uv_nmi_setup_hubless_intr()
  x86/cpu: Keep the PROCESSOR_SELECT menu together
  x86/tlb: Convert copy_from_user() + kstrtouint() to kstrtouint_from_user()
  x86/purgatory: Fix #endif comment
  x86/boot: Get rid of kstrtoull()
  x86/boot/compressed: Use boot_kstrtoul() for hugepages= parsing
 2026-06-16 05:41:22 +05:30
Linus Torvalds
3c26a6bc40 Preparatory work for MPAM counter assignment: 
- Simplify the error handling path when creating monitor group event
   configuration directories
 
 - Make the MBM event filter configurable only on architectures that
   support it and expose this with the respective file modes in the event
   config
 
 - Disallow the MBA software controller on systems where MBM counters are
   assignable, as it requires continuous bandwidth measurement that
   assignable counters do not guarantee
 
 - Replace a compile-time Kconfig option for fixed counter assignment
   with a per-architecture runtime property, and expose whether the
   counter assignment mode is changeable to userspace
 
 - Continue counter allocation across all domains instead of aborting at
   the first failure
 
 - Document that automatic MBM counter assignment is best effort and may
   not assign counters to all domains
 
 - Document the behavior of task ID 0 and idle tasks in the resctrl tasks
   file
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowEfYACgkQEsHwGGHe
 VUoqpA//SQnC9ehAKVg+tf/V0H5s4sAQimTI3fl9pMYWfduoHCQkdPs/lSWF4Su+
 YNhjr/+nffC1oqSpklG2XEDHYD3HoKnBqSrALX0lmEVPr4MHtAnOAQs/G57Jqp8G
 p1nniOgPqwDltndHYUl2vLX/dFpjIprqPG3lWfjPCFUzrVaOlTPd7Kkv8kSdmZOL
 IYMpMP8IPjA8QfLdGtcqKbtjsNu6gxNs9TS2pXSyy/NuPqaS9CAzsOwj0KNlYPOk
 Hi7KVXc87GAHAUS1LK8+ZjEao/BHtUE8XJlsnTNtPlvwfS7uuOCIrrQyooJS8uT4
 CKv5KbCxZKlRlWNnZLW6IsfYd85N+7gse9n0U2BNlqMor535AEp/X5bka6QO4mLa
 CuN72A8Tkw2bNEcUfOc1akeKNj7bQ9lgz0AESJefmaFNkLmaWJi5mNA/27JFAXBQ
 KfGvPHlKcwt7e8Mj3OaDnhEstf9kVppD2NAL+tl5eGA0mHixyK0WNrDqX1ZjiPkL
 Lf2w5bHA0tTUPtFR/71RqWyHL5N7jjctC6aeVmGDgji7dIkodD8bUFEj/ORY02iS
 oAX7n0E8ccC/E8+jAb8n+zukpbHE4V2ASr+tncLuGVNRuq03YfK5RXIwK0wN6OnM
 dDN1DjaNNMI5pkB48zytDhl1RK6QKVtOqBRBO2TMbQHypnjUMDI=
 =6iVq
 -----END PGP SIGNATURE-----

Merge tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 resource control updates from Borislav Petkov:
 "Preparatory work for MPAM counter assignment:

   - Simplify the error handling path when creating monitor group event
     configuration directories

   - Make the MBM event filter configurable only on architectures that
     support it and expose this with the respective file modes in the
     event config

   - Disallow the MBA software controller on systems where MBM counters
     are assignable, as it requires continuous bandwidth measurement
     that assignable counters do not guarantee

   - Replace a compile-time Kconfig option for fixed counter assignment
     with a per-architecture runtime property, and expose whether the
     counter assignment mode is changeable to userspace

   - Continue counter allocation across all domains instead of aborting
     at the first failure

   - Document that automatic MBM counter assignment is best effort and
     may not assign counters to all domains

   - Document the behavior of task ID 0 and idle tasks in the resctrl
     tasks file"

* tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  fs/resctrl: Document tasks file behaviour for task id 0 and idle tasks
  fs/resctrl: Document that automatic counter assignment is best effort
  fs/resctrl: Continue counter allocation after failure
  fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed'
  fs/resctrl: Disallow the software controller when MBM counters are assignable
  x86,fs/resctrl: Create 'event_filter' files read only if they're not configurable
  fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs()
 2026-06-16 05:35:40 +05:30
Sean Christopherson
ef057cbf82 KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level 
When recovering hugepages in the shadow MMU, verify that the base gfn of
the shadow page is actually contained within the target memslot, *before*
querying the max mapping level given the shadow page's gfn.  Failure to
pre-check the validity of the gfn can lead to an out-of-bounds access to
the slot's lpage_info (which typically manifests as a host #PF because the
lpage_info is vmalloc'd) if the guest creates a hugepage mapping (in its
PTEs) that extends "below" the bounds of a memslot.

When faulting in memory for a guest, and the size of the guest mapping is
greater than KVM's (current) max mapping, then KVM will create a "direct"
shadow page (direct in that there are no gPTEs to shadow, and so the target
gfn is a direct calculation given the base gfn of the shadow page).  The
hugepage recovery flow looks for such direct shadow pages, as forcing 4KiB
mappings when dirty logging generates the guest > host mapping size case.
When the 4KiB restriction is lifted, then KVM can replace the shadow page
with a hugepage.

But if KVM originally used a smaller mapping than the guest because the
range of memory covered by the guest hugepage exceeds the bounds of a
memslot, then KVM will link a direct shadow page with a gfn that is outside
the bounds of the memslot being used to fault in memory.  The rmap entry
added for the leaf mapping is correct and within bounds, but the gfn of the
leaf SPTE's parent shadow page will be out of bounds.

  BUG: unable to handle page fault for address: ffffc90000806ffc
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page
  PGD 100000067 P4D 100000067 PUD 1002a7067 PMD 10612f067 PTE 0
  Oops: Oops: 0000 [#1] SMP
  CPU: 13 UID: 1000 PID: 757 Comm: mmu_stress_test Not tainted 7.1.0-rc1-48ce1e26eace-x86_pir_to_irr_comments-vm #341 PREEMPT
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015
  RIP: 0010:kvm_mmu_max_mapping_level+0x79/0x2b0 [kvm]
  Call Trace:
   <TASK>
   kvm_mmu_recover_huge_pages+0x21b/0x320 [kvm]
   kvm_set_memslot+0x1ee/0x590 [kvm]
   kvm_set_memory_region.part.0+0x3a1/0x4d0 [kvm]
   kvm_vm_ioctl+0x9bf/0x15d0 [kvm]
   __x64_sys_ioctl+0x8a/0xd0
   do_syscall_64+0xb7/0xbb0
   entry_SYSCALL_64_after_hwframe+0x4b/0x53
  RIP: 0033:0x7f21c0f1a9bf
   </TASK>

Don't bother pre-checking the bounds of the potential hugepage, i.e. don't
check that e.g. sp->gfn + KVM_PAGES_PER_HPAGE(sp->role.level + 1) is also
within the memslot, as the checks performed by kvm_mmu_max_mapping_level()
are a superset of the basic bounds checks.  I.e. pre-checking the full
range would be a dubious micro-optimization.

Fixes: 9eba50f8d7 ("KVM: x86/mmu: Consult max mapping level when zapping collapsible SPTEs")
Cc: stable@vger.kernel.org
Cc: David Matlack <dmatlack@google.com>
Cc: James Houghton <jthoughton@google.com>
Cc: Alexander Bulekov <bkov@amazon.com>
Cc: Fred Griffoul <fgriffo@amazon.co.uk>
Cc: Alexander Graf <graf@amazon.de>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Filippo Sironi <sironi@amazon.de>
Cc: Ivan Orlov <iorlov@amazon.co.uk>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-16 00:39:57 +02:00
Paolo Bonzini
81ccda30b4 KVM: x86: Fix shadow paging use-after-free due to unexpected role 
Commit 0cb2af2ea6 ("KVM: x86: Fix shadow paging use-after-free due
to unexpected GFN") fixed a shadow paging mismatch between stored and
computed GFNs; the bug could be triggered by changing a PDE mapping from
outside the guest, and then deleting a memslot.  The rmap_remove()
call would miss entries created after the PDE change because the GFN
of the leaf SPTE does not match the GFN of the struct kvm_mmu_page.

A similar hole however remains if the modified PDE points to a non-leaf
page.  In this case the gfn can be made to match, but the role does not
match: the original large 2MB page creates a kvm_mmu_page with direct=1,
while the new 4KB needs a kvm_mmu_page with direct=0.  However,
kvm_mmu_get_child_sp() does not compare the role, and therefore reuses
the page.

The next step is installing a leaf (4KB) SPTE on the new path which
records an rmap entry under the gfn resolved by the walk.  But when
that child is zapped its parent kvm_mmu_page has direct=1 and
kvm_mmu_page_get_gfn() computes the gfn for the 4KB page as
sp->gfn + index instead of using sp->shadowed_translation[] (or sp->gfns[]
in older kernels).  It therefore fails to remove the recorded entry.

When the memslot is dropped the shadow page is freed but the rmap
entry survives, as in the scenario that was already fixed.  Code that
later walks that gfn (dirty logging, MMU notifier invalidation, and
so on) dereferences an sptep that lies in the freed page, causing the
use-after-free.

Fixes: 2032a93d66 ("KVM: MMU: Don't allocate gfns page for direct mmu pages")
Reported-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-16 00:39:56 +02:00
Linus Torvalds
ff5ccdb8d5 x86/cpu updates for v7.2: 
- CPUID API updates (Ahmed S. Darwish):
 
    - Introduce a centralized CPUID parser
    - Introduce a centralized CPUID data model
    - Introduce <asm/cpuid/leaf_types.h>
    - Rename cpuid_leaf()/cpuid_subleaf() APIs
    - treewide: Explicitly include the x86 CPUID headers
 
  - Update to x86-cpuid-db v3.1 (Maciej Wieczor-Retman)
 
  - Continued removal of pre-i586 support and related
    simplifications (Ingo Molnar)
 
  - Add Intel CPU model number for rugged Panther Lake
    (Tony Luck)
 
  - Misc fixes, updates and cleanups by Arnd Bergmann, Chao Gao,
    Lukas Bulwahn, Sohil Mehta, Maciej Wieczor-Retman.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmou1LcRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1h16Q/9GvxrQDX13qd7/XrjOKNYtoLIGh1GhvHM
 2ZdbYh80LX36bDOg7Mhoy0bvElwmzaz2x1Zrb5SAIqpQXYqjfuRCe7a1SPQxYtCK
 A6j1YeD/CJMm36jaQITYkuCYxwaw5LQ62u0ShpEvyzZzarEJt8c8COWJjbE57FN2
 qusr+6K1sBwpEUl5mLabbJWXqhpPRYCz+nl2GF9BCHe6z7Nw7Q8VZf4w1weONJOy
 lMpC2X08w5TE2f4OwvnRbZLelyROz6pr1c3osUoQSVtBkprO9TsYHgd9yBva1E2E
 KxdWm+uSSUXM7cFBzY3RLBzKpG6iLtqircoDFBVdxOlT8I8KFggzbYy4JPlDEHQS
 FqUwWL+2duoRciOncnZn9hydxlg5So4w7OscvTVNp94/Pb2pMdpOB+bsN05WTpXc
 VMQVxrfsmwT1rV1oppzRizTMnb6yGg8BQvZPE+wrMDdH+/wwhzok4GdZzKVCzUoD
 nDFhJL7t8ikRwwuq5RAl1EcT7qLFJx3ba77B5REf2Uos2liTExO/XzcmQnzSV1M1
 RXpajQ1ikEBtJPAD3Zy0ASm/QPjB27o+6Kj6hW3NLlPoi5l0Lu6xQzH3wNrpQpst
 02NCWEn2X00YUQt2ukNcDFJiMHJzXAnBQDBSrWwwd97wol3sKnT9RR2NZVFzn7ls
 GOF8yJ0Wuec=
 =tpai
 -----END PGP SIGNATURE-----

Merge tag 'x86-cpu-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 cpuid updates from Ingo Molnar:

 - CPUID API updates (Ahmed S. Darwish):
    - Introduce a centralized CPUID parser
    - Introduce a centralized CPUID data model
    - Introduce <asm/cpuid/leaf_types.h>
    - Rename cpuid_leaf()/cpuid_subleaf() APIs
    - treewide: Explicitly include the x86 CPUID headers

 - Update to x86-cpuid-db v3.1 (Maciej Wieczor-Retman)

 - Continued removal of pre-i586 support and related simplifications
   (Ingo Molnar)

 - Add Intel CPU model number for rugged Panther Lake (Tony Luck)

 - Misc fixes, updates and cleanups by Arnd Bergmann, Chao Gao, Lukas
   Bulwahn, Sohil Mehta, Maciej Wieczor-Retman.

* tag 'x86-cpu-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (25 commits)
  x86/cpu: Make CONFIG_X86_CX8 unconditional
  x86/cpu: Remove unused !CONFIG_X86_TSC code
  x86/cpuid: Update bitfields to x86-cpuid-db v3.1
  tools/x86/kcpuid: Update bitfields to x86-cpuid-db v3.1
  x86/cpu: Make CONFIG_X86_TSC unconditional
  MAINTAINERS: Drop obsolete FPU EMULATOR section
  x86/cpu: Fix a F00F bug warning and clean up surrounding code
  x86/cpu: Add Intel CPU model number for rugged Panther Lake
  x86/cpuid: Introduce a centralized CPUID parser
  x86/cpu: Introduce a centralized CPUID data model
  x86/cpuid: Introduce <asm/cpuid/leaf_types.h>
  x86/cpuid: Rename cpuid_leaf()/cpuid_subleaf() APIs
  x86/cpu: Do not include the CPUID API header in asm/processor.h
  Documentation: core-api/cpu_hotplug: Remove stale cpu0_hotplug docs
  x86/cpu, cpufreq: Remove AMD ELAN support
  x86/fpu: Remove the math-emu/ FPU emulation library
  x86/fpu: Remove the 'no387' boot option
  x86/fpu: Remove MATH_EMULATION and related glue code
  treewide: Explicitly include the x86 CPUID headers
  x86/cpu: Remove the CONFIG_X86_INVD_BUG quirk
  ...
 2026-06-15 15:25:17 +05:30
Linus Torvalds
7561361d76 x86/msr updates for v7.2: 
- Large series to reorganize the rdmsr/wrmsr APIs to remove
    32-bit variants and convert to 64-bit variants (Juergen Gross)
 
  - Fix W=1 warning (HyeongJun An)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmou1ucRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1gqYRAAstZaQnaca7PjkVbmcESzqkWSF30V3YmV
 P/Fe4eozPttfcRootPGxW/srm+c0c2u07Dk7zYrS5BF8OuX4960HRLwC4kQs4lvq
 F7ngDAtiGjZm5kNtwnITc2CxJLjDlewW9JqRNNK960IgD0H7X3wdkZWk8kox27Up
 2/SwYSZnzUoYVXLzLJjEpKJ6Lx0sHcql+K3tQOK+uXoNLf/cYHoyjXwWRw7X2H6h
 PnxmnaVf9YmM4ghCZlS0hgxsc32cQUFE93ZnBCMQHe5sF5amGBt7Xy/mVwmKxq6h
 0qKx7Y9SuKjT3dOg+h749C5xzGH9iXhFSfl5Tq3tM7B1aGCfn62X1Uz6KMyeqmgT
 av+iS0oCfCJ3vPdHBRy/Q++jovsIPP3Ty+wWYgIoiRLMP9NtWoFuSsSTGjevkC3U
 NiOecBX5SMYJuqSmwVFEDUjIbKcXRgWAqnIYVzjGO1cT48mE4589GflAPPZHWqua
 BZ7GE7COgAXpxa4tktQFv8/9dfpxfc83CXgFR3BLlv777C/abFDSmJmUyLj61FKe
 Lr4AGpcrjMhhbp9ECZdzUb4YO6xUTnFYRAsquDy9/Cg13KiHuxLeSJ4v1q96ly5c
 gW2cX6KyVLCWMms47i1Hknjn+Vf0dfke1esEwGMd8i2Ji4eqD7Dr4ZvV/Ju9N6UB
 QtBs5sxZVq0=
 =YynE
 -----END PGP SIGNATURE-----

Merge tag 'x86-msr-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86/msr updates from Ingo Molnar:

 - Large series to reorganize the rdmsr/wrmsr APIs to remove
   32-bit variants and convert to 64-bit variants (Juergen Gross)

 - Fix W=1 warning (HyeongJun An)

* tag 'x86-msr-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/msr: Remove wrmsrl()
  x86/msr: Switch wrmsrl() users to wrmsrq()
  x86/msr: Remove rdmsrl()
  x86/msr: Switch rdmsrl() users to rdmsrq()
  x86/msr: Remove wrmsr_safe_on_cpu()
  x86/msr: Switch wrmsr_safe_on_cpu() users to wrmsrq_safe_on_cpu()
  x86/msr: Remove rdmsr_safe_on_cpu()
  x86/msr: Switch rdmsr_safe_on_cpu() users to rdmsrq_safe_on_cpu()
  x86/msr: Don't use rdmsr_safe_on_cpu() in rdmsrq_safe_on_cpu()
  x86/msr: Remove wrmsr_on_cpu()
  x86/msr: Switch wrmsr_on_cpu() users to wrmsrq_on_cpu()
  x86/msr: Remove rdmsr_on_cpu()
  x86/msr: Switch rdmsr_on_cpu() users to rdmsrq_on_cpu()
  x86/msr: Remove rdmsrl_on_cpu()
  x86/msr: Switch rdmsrl_on_cpu() user to rdmsrq_on_cpu()
  x86/process: Convert rdmsr() to rdmsrq() in arch_post_acpi_subsys_init() to address W=1 warning
 2026-06-15 15:08:14 +05:30
Linus Torvalds
2cbf335f8c Scheduler updates for v7.2: 
SMP load-balancing updates:
 
  - A large series to introduce infrastructure for cache-aware load
    balancing, with the goal of co-locating tasks that share data
    within the same Last Level Cache (LLC) domain. By improving cache
    locality, the scheduler can reduce cache bouncing and cache misses,
    ultimately improving data access efficiency.
 
    Implemented by Chen Yu and Tim Chen, based on early prototype work
    by Peter Zijlstra, with fixes by Jianyong Wu, Peter Zijlstra and
    Shrikanth Hegde.
 
  - A series to simplify CONFIG_SCHED_SMT ifdef usage (Shrikanth Hegde)
 
 Fair scheduler updates:
 
  - A series to improve SD_ASYM_CPUCAPACITY scheduling by introducing
    SMT awareness (Andrea Righi, K Prateek Nayak)
 
  - A series to optimize cfs_rq and sched_entity allocation for
    better data locality (Zecheng Li)
 
  - A preparatory series to change fair/cgroup scheduling to a single
    runqueue, without the final change (Peter Zijlstra)
 
  - Auto-manage ext/fair dl_server bandwidth (Andrea Righi)
 
  - Fix cpu_util runnable_avg arithmetic (Hongyan Xia)
 
  - Optimize update_tg_load_avg()'s rate-limiting code
    (Rik van Riel)
 
  - Allow account_cfs_rq_runtime() to throttle current hierarchy
    (K Prateek Nayak)
 
  - Update util_est after updating util_avg during dequeue, to fix
    the util signal update logic, which reduces signal noise
    (Vincent Guittot)
 
 Scheduler topology updates:
 
  - Allow multiple domains to claim sched_domain_shared (K Prateek Nayak)
 
  - Add parameter to split LLC (Peter Zijlstra)
 
 Core scheduler updates:
 
  - Use trace_call__<tp>() to save a static branch (Gabriele Monaco)
 
 Scheduler statistics updates:
 
  - Drop now-stale mul_u64_u64_div_u64() cputime over-approximation guard
    (Nicolas Pitre)
 
 Deadline scheduler updates:
 
  - Reject debugfs dl_server writes for offline CPUs (Andrea Righi)
 
  - Fix replenishment logic for non-deferred servers
    (Yuri Andriaccio)
 
 RT scheduling updates:
 
  - Turn RT_PUSH_IPI default off for non PREEMPT_RT (Steven Rostedt)
 
  - Update default bandwidth for real-time tasks to 1.0
    (Yuri Andriaccio)
 
 Proxy scheduling updates:
 
  - A series to implement Optimized Donor Migration for Proxy Execution
    (John Stultz, Peter Zijlstra)
 
  - Various proxy scheduling cleanups and fixes
    (Peter Zijlstra, K Prateek Nayak)
 
 Misc fixes, improvements and cleanups by Aaron Lu, Andrea Righi,
 Zenghui Yu, Chen Yu, Guanyou.Chen, John Stultz, Shrikanth Hegde,
 Peter Zijlstra, Liang Luo and Yiyang Chen.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmouy9ERHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1iLrxAApGz9fhzT8k8slnaSe9kzX5K3OtBLivi1
 ZHPeyNHggonASdZ7+apwJq+sdtmAgEw/phMN69fHhteIIa24WCHEpFtLndDHAkAm
 eUKRgBI/eAMrOBECldZ69QO1pfYmMV/2aZH/IyTDtgFvXYZS2+UtsE9fPCvx84V2
 Uxa5r7a8NTrpbhsZ2YhncpLkrJx0SfaBQBtvckDVWQBbh5stvIZncCatYjX0M33x
 yddLVkM7e5f6nenb5+rwW3TMayfzhkeaR+r9vUuZE1mt9ItwIqKfsi9PBFRFXNyr
 zzTxGpN6iQCgtFtySJQpIYamjxJhMZYpWcirYXRkXbmjPgc3PIgA9fRcPcj9bZ0A
 Z1sM9yBDFjvZ7Eds9TW7iEsmxSpbXDAXDs6SjQa34QU8bh7qJEOG9AQYDcULXZQM
 5NK7+b6GEMvcS7P4Y66CKwvxYFFGVGzX3CrFEgngkOWNJeoWhz5EpgmYIocgl/uS
 1TPIWASdFLyvvtnGxMx9iWcdb4mGbXvMLbDa3luSBDWAtYxQe0w9iLi87eqypSvU
 irZBSbKX737OlrOzNy/d4DKk9sbNsk/In1IK3jfHCt+7iRpVB5aWBfekrg0DIREw
 Jo83ln1nApdusK11DLQpbZcUerLHsvmGXRlGJa3IRGAXUS7MAnJ+XpYkKgmjW8Vm
 rw4QLfkMbP4=
 =V3Wc
 -----END PGP SIGNATURE-----

Merge tag 'sched-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull scheduler updates from Ingo Molnar:
 "SMP load-balancing updates:

   - A large series to introduce infrastructure for cache-aware load
     balancing, with the goal of co-locating tasks that share data
     within the same Last Level Cache (LLC) domain. By improving cache
     locality, the scheduler can reduce cache bouncing and cache misses,
     ultimately improving data access efficiency.

     Implemented by Chen Yu and Tim Chen, based on early prototype work
     by Peter Zijlstra, with fixes by Jianyong Wu, Peter Zijlstra and
     Shrikanth Hegde.

   - A series to simplify CONFIG_SCHED_SMT ifdef usage (Shrikanth Hegde)

  Fair scheduler updates:

   - A series to improve SD_ASYM_CPUCAPACITY scheduling by introducing
     SMT awareness (Andrea Righi, K Prateek Nayak)

   - A series to optimize cfs_rq and sched_entity allocation for better
     data locality (Zecheng Li)

   - A preparatory series to change fair/cgroup scheduling to a single
     runqueue, without the final change (Peter Zijlstra)

   - Auto-manage ext/fair dl_server bandwidth (Andrea Righi)

   - Fix cpu_util runnable_avg arithmetic (Hongyan Xia)

   - Optimize update_tg_load_avg()'s rate-limiting code (Rik van Riel)

   - Allow account_cfs_rq_runtime() to throttle current hierarchy
     (K Prateek Nayak)

   - Update util_est after updating util_avg during dequeue, to fix the
     util signal update logic, which reduces signal noise (Vincent
     Guittot)

  Scheduler topology updates:

   - Allow multiple domains to claim sched_domain_shared (K Prateek
     Nayak)

   - Add parameter to split LLC (Peter Zijlstra)

  Core scheduler updates:

   - Use trace_call__<tp>() to save a static branch (Gabriele Monaco)

  Scheduler statistics updates:

   - Drop now-stale mul_u64_u64_div_u64() cputime over-approximation
     guard (Nicolas Pitre)

  Deadline scheduler updates:

   - Reject debugfs dl_server writes for offline CPUs (Andrea Righi)

   - Fix replenishment logic for non-deferred servers (Yuri Andriaccio)

  RT scheduling updates:

   - Turn RT_PUSH_IPI default off for non PREEMPT_RT (Steven Rostedt)

   - Update default bandwidth for real-time tasks to 1.0 (Yuri
     Andriaccio)

  Proxy scheduling updates:

   - A series to implement Optimized Donor Migration for Proxy Execution
     (John Stultz, Peter Zijlstra)

   - Various proxy scheduling cleanups and fixes (Peter Zijlstra,
     K Prateek Nayak)

  Misc fixes, improvements and cleanups by Aaron Lu, Andrea Righi,
  Zenghui Yu, Chen Yu, Guanyou.Chen, John Stultz, Shrikanth Hegde,
  Peter Zijlstra, Liang Luo and Yiyang Chen"

* tag 'sched-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (91 commits)
  sched/fair: Fix newidle vs core-sched
  sched/deadline: Use task_on_rq_migrating() helper
  sched/core: Combine separate 'else' and 'if' statements
  sched/fair: Fix cpu_util runnable_avg arithmetic
  sched/fair: Unify cfs_rq throttling via account_cfs_rq_runtime()
  sched/fair: Move the throttled tasks to a local list in tg_unthrottle_up()
  sched/fair: Call update_curr() before unthrottling the hierarchy
  sched/fair: Use throttled_csd_list for local unthrottle
  sched/fair: Convert cfs bandwidth throttling to use guards
  sched/fair: Allocate cfs_tg_state with percpu allocator
  sched/fair: Remove task_group->se pointer array
  sched/fair: Co-locate cfs_rq and sched_entity in cfs_tg_state
  sched: restore timer_slack_ns when resetting RT policy on fork
  MAINTAINERS: Fix spelling mistake in Peter's name
  sched: Simplify ttwu_runnable()
  sched/proxy: Remove superfluous clear_task_blocked_in()
  sched/proxy: Remove PROXY_WAKING
  sched/proxy: Switch proxy to use p->is_blocked
  sched/proxy: Only return migrate when needed
  sched: Be more strict about p->is_blocked
  ...
 2026-06-15 14:50:18 +05:30
Linus Torvalds
0bcc2dc22f Performance events updates for v7.2: 
Core perf code updates:
 
  - Reveal PMU type in fdinfo (Chun-Tse Shao)
 
 Intel CPU PMU driver updates:
 
  - Fix various inaccurate hard-coded event configurations
    (Dapeng Mi)
 
 Intel uncore PMU driver updates (Zide Chen):
 
  - Fix discovery unit lookup bug for multi-die systems
  - Guard against invalid box control address
  - Fix PCI device refcount leak in UPI discovery
  - Defer ADL global PMON enable to enable_box() to save power
  - Fix uncore_die_to_cpu() for offline dies
  - Implement global init callback for GNR uncore
 
 AMD CPU PMU driver updates:
 
  - Always use the NMI latency mitigation (Sandipan Das)
 
 AMD uncore PMU driver updates:
 
  - Use Node ID to identify DF and UMC domains (Sandipan Das)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmouvyARHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hVSA//RmBeZ9R7QiCJn770b+9ZPvk90PKN8TYQ
 TXcPMTB1gZRtw7q4CF8/CFxUvxGySD+/RaekXkQzfATPurwgHkwKv3xpOZuSGcfW
 dTsuAV3k+Azj3on3dGjmGZoZeWsdG12c0uF7YNylW/hfPQ/KAW1THVKv7ufX6Mcx
 VrEh7oh/5N9paAqtZz5TmesB2wfC05vToj27jE0HL6tnDovF4Q8IsZkfC3P139Kd
 iCwvOnc/jpfke26UP5csPnQIF5zTIy2TZrvDQVlqryPZ4NrmMnA6XC117u8VAIm2
 29JBP72wbMvRT4hXSs8thfvPj1zF/y3YMCN0D+wkxpYD6gqlsjlHhoY9fJ+Ann7t
 gMi0ccSGNC6COVMq1RhzrGdf6JscGcIxXzS1abNJw6cLmfv45UmlbF1ePq9nPV3n
 8ZbotrBovS9TonLPmmXNpR9dKKLSH2URCF/xD92KS5Wbvod7sum8N/rpV3Ncmxxf
 6g8qTsOxpJjEq9pnTndycqvtzZnyf0/68db5Y+5ag1zKNVPhbsV7AU/tVytZt1Hk
 1bTNcc7lCp2GRBPAmDCk5KI235C0UpLS/llG2jEEwXmTzLxk7pzwoJMcl5sABHNA
 VL6AhLP8rmHY+r0e8otdI10xg8Pt/WWvKNuOY4i4PiIf34YG1ARoY0EwzmlwcSmF
 WsKdagUmIqQ=
 =Di4Y
 -----END PGP SIGNATURE-----

Merge tag 'perf-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull performance events updates from Ingo Molnar:
 "Core perf code updates:

   - Reveal PMU type in fdinfo (Chun-Tse Shao)

  Intel CPU PMU driver updates:

   - Fix various inaccurate hard-coded event configurations (Dapeng Mi)

  Intel uncore PMU driver updates (Zide Chen):

   - Fix discovery unit lookup bug for multi-die systems

   - Guard against invalid box control address

   - Fix PCI device refcount leak in UPI discovery

   - Defer ADL global PMON enable to enable_box() to save power

   - Fix uncore_die_to_cpu() for offline dies

   - Implement global init callback for GNR uncore

  AMD CPU PMU driver updates:

   - Always use the NMI latency mitigation (Sandipan Das)

  AMD uncore PMU driver updates:

   - Use Node ID to identify DF and UMC domains (Sandipan Das)"

* tag 'perf-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (22 commits)
  perf/x86/amd/uncore: Use Node ID to identify DF and UMC domains
  perf: Reveal PMU type in fdinfo
  perf/x86/intel/uncore: Implement global init callback for GNR uncore
  perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies
  perf/x86/intel/uncore: Move die_to_cpu() to uncore.c
  perf/x86/intel/uncore: Defer ADL global PMON enable to enable_box()
  perf/x86/intel/uncore: Fix PCI device refcount leak in UPI discovery
  perf/x86/intel/uncore: Guard against invalid box control address
  perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems
  perf/x86/amd/core: Always use the NMI latency mitigation
  perf/x86/intel: Update event constraints and cache_extra_regsfor CWF
  perf/x86/intel: Update event constraints and cache_extra_regsfor SRF
  perf/x86/intel: Update event constraints and cache_extra_regsfor NVL
  perf/x86/intel: Update event constraints for PTL
  perf/x86/intel: Update event constraints and cache_extra_regsfor ARL
  perf/x86/intel: Update event constraints and cache_extra_regsfor LNL
  perf/x86/intel: Update event constraints and cache_extra_regsfor MTL
  perf/x86/intel: Update event constraints and cache_extra_regsfor ADL
  perf/x86/intel: Update event constraints for DMR
  perf/x86/intel: Update event constraints and cache_extra_regsfor SPR
  ...
 2026-06-15 14:45:41 +05:30
Linus Torvalds
d8d706a274 Objtool updates for v7.2: 
- A large series of KLP fixes and improvements, in preparation of
    the arm64 port (Josh Poimboeuf)
 
  - Fix a number of bugs and issues on specific distro, LTO,
    FineIBT and kCFI configs (Josh Poimboeuf)
 
  - Misc other fixes by Josh Poimboeuf and Joe Lawrence.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmouvAgRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1g1rBAAuJwhyKKa5KxdgoGC3uSCyILZ77n5en+I
 e5kCpeON2zbiGzg5N1D6Rgr1D1m1Fj1puiPy6FtqDkIO4a5b86Pt/Nv91CZG3A7n
 lYNRJtqVyMNpBr7O9aaxalEnhrEY1kDK5DRebSAidy97hL6HelMFBy3EkV2nzsUI
 eekUg3frCNq3k2oYWdtC5DZ6S7oK8rdAi/Ay3A3XTL6CLjYDPpMHd+pjDdtQsBYg
 ybMoVQthfKb1SDazy2od9bbTJDngJkMVgIqHPrQcnvqMqp1knI46YvEwMJzQ9DWB
 AaS8Xnm1jyk0/cFjIp5xNWo+VVuKiY0upewtFAodH35tvIuqptbt7btIkV5ZX7nu
 IaMfqwh88yHvf3PJMrbAy+5lIE9h6dKEDLTJVBT8Swb7Y6rUG0qMyJ3Ah/RrlAgu
 jcLUN89u8HXVaffWYAfpEj2ehSRsuy9BX2zCUeQoMH/5MCbDY2q4j6i07ylTJCkr
 flYjTosIXma/NwimXIyPzMl+vUtrznMwoubH6Ns2yu7DKAK1Ntb0W9H7oy/vZIPi
 ZAiV2OdmRet6iXdcIwBlS+7Du/eUMIkKlJsf4twWMgU7R4ApxTWoylr1z8yKqQam
 109MNt7d98wFu+iYEWB0S+Uz7I/ZAGwY1Rj7tZ7mHUlSBfcVsYp3b3NEOG4J9YLy
 K6L9ZECJ/Ow=
 =D5SB
 -----END PGP SIGNATURE-----

Merge tag 'objtool-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull objtool updates from Ingo Molnar:

 - A large series of KLP fixes and improvements, in preparation of the
   arm64 port (Josh Poimboeuf)

 - Fix a number of bugs and issues on specific distro, LTO, FineIBT and
   kCFI configs (Josh Poimboeuf)

 - Misc other fixes by Josh Poimboeuf and Joe Lawrence

* tag 'objtool-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (53 commits)
  objtool/klp: Cache dont_correlate() result
  objtool: Improve and simplify prefix symbol detection
  objtool/klp: Fix kCFI prefix finding/cloning
  objtool: Grow __cfi_* prefix symbols for all CFI+CALL_PADDING
  objtool/klp: Fix position-dependent checksums for non-relocated jumps/calls
  objtool: Add insn_sym() helper
  objtool/klp: Add correlation debugging output
  objtool/klp: Rewrite symbol correlation algorithm
  objtool/klp: Calculate object checksums
  klp-build: Validate short-circuit prerequisites
  objtool/klp: Remove "objtool --checksum"
  klp-build: Use "objtool klp checksum" subcommand
  objtool/klp: Add "objtool klp checksum" subcommand
  objtool: Consolidate file decoding into decode_file()
  objtool/klp: Extricate checksum calculation from validate_branch()
  objtool: Add is_cold_func() helper
  objtool: Add is_alias_sym() helper
  objtool/klp: Handle Clang .data..Lanon anonymous data sections
  objtool/klp: Create empty checksum sections for function-less object files
  objtool: Include libsubcmd headers directly from source tree
  ...
 2026-06-15 14:31:58 +05:30
Linus Torvalds
764e77d868 Locking updates for v7.2: 
Futex updates:
 
  - Optimize futex hash bucket access patterns (Peter Zijlstra)
 
  - Large series to address the robust futex unlock race for real,
    by Thomas Gleixner:
 
     "The robust futex unlock mechanism is racy in respect
      to the clearing of the robust_list_head::list_op_pending
      pointer because unlock and clearing the pointer are not
      atomic. The race window is between the unlock and clearing the
      pending op pointer. If the task is forced to exit in this
      window, exit will access a potentially invalid pending op
      pointer when cleaning up the robust list. That happens if
      another task manages to unmap the object containing the lock
      before the cleanup, which results in an UAF. In the worst case
      this UAF can lead to memory corruption when unrelated content
      has been mapped to the same address by the time the access
      happens.
 
      User space can't solve this problem without help from the kernel.
      This series provides the kernel side infrastructure to help it
      along:
 
       1) Combined unlock, pointer clearing, wake-up for the
          contended case
 
       2) VDSO based unlock and pointer clearing helpers with a
          fix-up function in the kernel when user space was interrupted
          within the critical section.
 
     ... with help by André Almeida:
 
      - Add a note about robust list race condition (André Almeida)
      - Add self-tests for robust release operations (André Almeida)
 
 Context analysis updates:
 
  - Implement context analysis for 'struct rt_mutex'.
    (Bart Van Assche)
  - Bump required Clang version to 23 (Marco Elver)
 
 Guard infrastructure updates:
 
  - Series to remove NULL check from unconditional guards
    (Dmitry Ilvokhin)
 
 Lockdep updates:
 
  - Restore self-test migrate_disable() and sched_rt_mutex
    state on PREEMPT_RT (Karl Mehltretter)
 
 Membarriers updates:
 
  - Use per-CPU mutexes for targeted commands (Aniket Gattani)
  - Modernize membarrier_global_expedited with cleanup guards
    (Aniket Gattani)
  - Add rseq stress test for CFS throttle interactions (Aniket Gattani)
 
 percpu-rwsems updates:
 
  - Extract __percpu_up_read() to optimize inlining overhead
    (Dmitry Ilvokhin)
 
 Seqlocks updates:
 
  - Allow UBSAN_ALIGNMENT to fail optimizing (Heiko Carstens)
 
 Lock tracing:
 
  - Add contended_release tracepoint to sleepable locks
    such as mutexes, percpu-rwsems, rtmutexes, rwsems
    and semaphores. (Dmitry Ilvokhin)
 
 MAINTAINERS updates:
 
  - MAINTAINERS: Add RUST [SYNC] entry (Boqun Feng)
 
 Misc updates and fixes by Randy Dunlap, YE WEI-HONG,
 Fabricio Parra, Dmitry Ilvokhin and Peter Zijlstra.
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmoujYURHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1jQFw//SNo1zxqGJuVudIWTpk5hUbWO6La9dc2C
 2RW4lMNM551AaGFK6V01u1hD7dBZkWBqER+f3+CMtkqi734pAevTfkYJOitnGOOX
 YZicGqTufV+Q+hcEiHAY3ADF6384SiyvAGNHL5wk3eLqC+Raug0f0cNt4opzFvr7
 I6vRcW02JQMRKBe50+Aoa5zg7ymmbqaH0KkiPvfY5UFl38MKABhkY1izA9o+/Q/S
 1/joNo5iQ3Ciqf6tn76vTg4Xiz7napikHB5LfWxorgmQo7FEdUY54GGMaa8aBOPi
 EfgIV9p+qOJhmWn4H1HgVSYlnUn3tJICYnVVCruXWXD+pzITS+F5qSQ3p25F3VIt
 c3jh3NaVW71pR/Sbj4zGvf8QguJL340RGJs/e5qcj91pjOSCH5B75ruNgFgYK9Lv
 iRi6dnHBBHxaN57YHTOrhphvjyfc0L7i6cGyJgHJWwyi0y3XBYlNuP/VLPuwquKl
 anK86hlkl9W4kO0OOukD1xhfuRv7066EdJc3iWWlp9yz+yI5xDGuV4FhvEHRoy38
 R9VY2bwzgZrW/NkodHIb95+W30qEmeq2z1W4wiBu+mf1JnyW2g/n8jKkc6AINMpI
 VGcom3MdinxjUtmybZT9Fx0SzBYCc+aRPkh7lPV7eXdZAWufxUO/6eVKiHBQ2HUO
 RFDkOZU0r+c=
 =gpHw
 -----END PGP SIGNATURE-----

Merge tag 'locking-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull locking updates from Ingo Molnar:
 "Futex updates:

   - Optimize futex hash bucket access patterns (Peter Zijlstra)

   - Large series to address the robust futex unlock race for real, by
     Thomas Gleixner:

      "The robust futex unlock mechanism is racy in respect to the
       clearing of the robust_list_head::list_op_pending pointer because
       unlock and clearing the pointer are not atomic.

       The race window is between the unlock and clearing the pending op
       pointer. If the task is forced to exit in this window, exit will
       access a potentially invalid pending op pointer when cleaning up
       the robust list.

       That happens if another task manages to unmap the object
       containing the lock before the cleanup, which results in an UAF.

       In the worst case this UAF can lead to memory corruption when
       unrelated content has been mapped to the same address by the time
       the access happens.

       User space can't solve this problem without help from the kernel.
       This series provides the kernel side infrastructure to help it
       along:

        1) Combined unlock, pointer clearing, wake-up for the
           contended case

        2) VDSO based unlock and pointer clearing helpers with a
           fix-up function in the kernel when user space was interrupted
           within the critical section.

      ... with help by André Almeida:

        - Add a note about robust list race condition (André Almeida)
        - Add self-tests for robust release operations (André Almeida)

  Context analysis updates:

   - Implement context analysis for 'struct rt_mutex'. (Bart Van Assche)
   - Bump required Clang version to 23 (Marco Elver)

  Guard infrastructure updates:

   - Series to remove NULL check from unconditional guards (Dmitry
     Ilvokhin)

  Lockdep updates:

   - Restore self-test migrate_disable() and sched_rt_mutex state on
     PREEMPT_RT (Karl Mehltretter)

  Membarriers updates:

   - Use per-CPU mutexes for targeted commands (Aniket Gattani)
   - Modernize membarrier_global_expedited with cleanup guards (Aniket
     Gattani)
   - Add rseq stress test for CFS throttle interactions (Aniket Gattani)

  percpu-rwsems updates:

   - Extract __percpu_up_read() to optimize inlining overhead (Dmitry
     Ilvokhin)

  Seqlocks updates:

   - Allow UBSAN_ALIGNMENT to fail optimizing (Heiko Carstens)

  Lock tracing:

   - Add contended_release tracepoint to sleepable locks such as
     mutexes, percpu-rwsems, rtmutexes, rwsems and semaphores (Dmitry
     Ilvokhin)

  MAINTAINERS updates:

   - MAINTAINERS: Add RUST [SYNC] entry (Boqun Feng)

  Misc updates and fixes by Randy Dunlap, YE WEI-HONG, Fabricio Parra,
  Dmitry Ilvokhin and Peter Zijlstra"

* tag 'locking-core-2026-06-14' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (36 commits)
  locking: Add contended_release tracepoint to sleepable locks
  locking/percpu-rwsem: Extract __percpu_up_read()
  tracing/lock: Remove unnecessary linux/sched.h include
  futex: Optimize futex hash bucket access patterns
  rust: sync: completion: Mark inline complete_all and wait_for_completion
  MAINTAINERS: Add RUST [SYNC] entry
  cleanup: Specify nonnull argument index
  selftests: futex: Add tests for robust release operations
  Documentation: futex: Add a note about robust list race condition
  x86/vdso: Implement __vdso_futex_robust_try_unlock()
  x86/vdso: Prepare for robust futex unlock support
  futex: Provide infrastructure to plug the non contended robust futex unlock race
  futex: Add robust futex unlock IP range
  futex: Add support for unlocking robust futexes
  futex: Cleanup UAPI defines
  x86: Select ARCH_MEMORY_ORDER_TSO
  uaccess: Provide unsafe_atomic_store_release_user()
  futex: Provide UABI defines for robust list entry modifiers
  futex: Move futex related mm_struct data into a struct
  futex: Make futex_mm_init() void
  ...
 2026-06-15 14:21:14 +05:30
Linus Torvalds
186d3c4e92 A series of updates for the VDSO: 
- Remove the redundant CONFIG_GENERIC_TIME_VSYSCALL after converting the
     remaining users over.
 
   - Rework and sanitize the MIPS VDSO handling, so it does not handle the
     time related VDSO if there is no VDSO capable clocksource available.
     Also stop mapping VDSO data pages unconditionally even if there is no
     usage possible.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmotog4QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoYD5D/41UOOboDxkv3Ei0gS12RfFL/pHWPotWMvA
 eUS4Ohko2pYubZB+iv87QQD5HC6TBN9yXbUjpvS0wN9jVSlXgQOdJ0JkNYYbPfjH
 nsBt7g/ksCA0Tv0KxnUUtECCTu6frtXkSi5iDU03DVNvxLMDmRaXg+D10TKGiCfb
 q1g2IoenA6YWz8pUkwOSI5wInepN8Dt9s5VXRsBQS9J9Uin/ZWAIwghIEhfFPNZu
 braNUSyJ+A7xISipOjWD1kEfBjcUzr24AuMZ9XHpxnykdWoa57qNEoTnjm+bVWpU
 hK0ED4nXSM8qxioV1Kye0h+hUi0T7amNtq6OSfAL+oXWHINvUe2PybqK+sZ1pPFb
 0MSP/J4mV9CIvriPA33fTXw/VxigI/puCMtGuSLLXHwh2xW8hadz7wGU9lqF4E7E
 f+X9NYqZSmx/82z0KKPFtIQyfrozquRBzy2ZiUloh7ek7GKF5tvuN8lds3Ghuf/6
 9Hqr/YquG1Zuu+j95ozVIm7fhDjmMktxAwyAbg5WkNGqOEw7MyhoUGXjKKG29uLa
 PRitT9DklL5vndzjizkLc1C2DuC++OhpnJCqRWOjJ9/TbvBC6Rn6aKwYyVTFX9xM
 4VauNLQg0q9uG0TyW6o3aakaFk9OIKT+vl7bWO0G4g2YZaKDOs7s+b9sdNNNQq5R
 lTL5F0KUCQ==
 =Z90m
 -----END PGP SIGNATURE-----

Merge tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull vdso updates from Thomas Gleixner:

 - Remove the redundant CONFIG_GENERIC_TIME_VSYSCALL after converting
   the remaining users over.

 - Rework and sanitize the MIPS VDSO handling, so it does not handle the
   time related VDSO if there is no VDSO capable clocksource available.
   Also stop mapping VDSO data pages unconditionally even if there is no
   usage possible.

* tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  MIPS: VDSO: Fold MIPS_CLOCK_VSYSCALL into MIPS_GENERIC_GETTIMEOFDAY
  MIPS: VDSO: Gate microMIPS restriction on GCC version
  MIPS: VDSO: Fold MIPS_DISABLE_VDSO into MIPS_GENERIC_GETTIMEOFDAY
  clocksource/drivers/mips-gic-timer: Only use VDSO_CLOCKMODE_GIC when it is a available
  MIPS: csrc-r4k: Only use VDSO_CLOCKMODE_R4K when it is a available
  MIPS: VDSO: Only map the data pages when the vDSO is used
  MIPS: Introduce Kconfig MIPS_GENERIC_GETTIMEOFDAY
  vdso/datastore: Always provide symbol declarations
  MAINTAINERS: Add include/linux/vdso_datastore.h to vDSO block
  vdso/gettimeofday: Rename __arch_get_vdso_u_timens_data()
  vdso/treewide: Drop GENERIC_TIME_VSYSCALL
  vdso/vsyscall: Gate update_vsyscall() behind CONFIG_GENERIC_GETTIMEOFDAY
  riscv: vdso: Drop CONFIG_GENERIC_TIME_VSYSCALL guard around syscall fallbacks
 2026-06-15 13:57:13 +05:30
Linus Torvalds
2d6d57f889 Updates for NTP/timekeeping and PTP: 
- Expand timekeeping snapshot mechanisms
 
     The various snapshot functions are mostly used for PTP to collect
     "atomic" snapshots of various involved clocks.
 
     They lack support for the recently introduced AUX clocks and do not
     provide the underlying counter value (e.g. TSC) to user space. Exposing
     the counter value snapshot allows for better control and steering.
 
     Convert the hard wired ktime_get_snapshot() to take a clock ID, which
     allows the caller to select the clock ID to be captured along with
     CLOCK_MONONOTONIC_RAW. Additionally capture the underlying hardware
     counter value and the clock source ID of the counter.
 
     Expand the hardware based snapshot capture where devices provide a
     mechanism to snapshot the hardware PTP clock and the system counter
     (usually via PCI/PTM) to support AUX clocks and also provide the
     captured counter value back to the caller and not only the clock
     timestamps derived from it.
 
   - Add a new optional read_snapshot() callback to clocksources
 
     That is required to capture atomic snapshots from clocksources which
     are derived from TSC with a scaling mechanism (e.g. Hyper-V, KVMclock).
 
     The value pair is handed back in the snapshot structure to the callers,
     so they can do the necessary correlations in a more precise way.
 
 This touches usage sites of the affected functions and data structure all
 over the tree, but stays fully backwards compatible for the existing user
 space exposed interfaces. New PTP IOCTLs will provide access to the
 extended functionality in later kernel versions.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmotoSAQHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoYWbEACv/g3pGDxWxfzOI2h6vQgGxDvD3LwmdhPE
 bzXRRaxp3/J0rZTQmCghknVGDPVjepNQgKkUMXfaFG2UZmiPHG5qVTXO6DddguS4
 cQc0SUO3e422lUPCoBmTULZ+vlctb4LJsWXPQHYNKC73KqMJtWte7T2HBiFDK5RB
 O0S34DZtkvOW4tHIu0RwlwCXZ0gcO+zsjxKA8K/P6sMtKBQU1/rRkZZCx2KCvq0F
 Rx3NTGoY4if/C83YBq1cEn8BvXrcQQH4ZOOWuySsLGJGRPZ1dXGP+JtfRWutk/f9
 HZztlaXcEz71dJXlhBxc0Eb/86uC3POEq7ZYvQdzLbsSZ/3AbalksL9CLyxgdHtc
 U964SuwOVPcYfEytd4TWb1nu7JgOR0olYK+l4AbCt4EdKst5TADCJ7rtlZV3Idp+
 Yg1GN3TwJcKItUNX9Szk+7MbvB8EWOEl7Obahfm48qDK1pqFe08qhOzSCeRXu+Bb
 QiupC3ndzUB1Yjf3DPV6wQl4Fl/TscrAVrPlnGCOJEKXtUKFxvcKquy/W29UD//w
 NuxKO2zK05UDsbBEwnZiCrdSGGNiLBYUbHfx2UvA7M0rfrrbjmG4rCFPotxhNb54
 UuqgdM8G45MkyBV3qSSh3VC0XeD7UqzQtMYgUjjhvtapLlsri69vzL2DnQUcajSG
 dgjzIg9O3g==
 =kBrz
 -----END PGP SIGNATURE-----

Merge tag 'timers-ptp-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull timekeeping updates from Thomas Gleixner:
 "Updates for NTP/timekeeping and PTP:

   - Expand timekeeping snapshot mechanisms

     The various snapshot functions are mostly used for PTP to collect
     "atomic" snapshots of various involved clocks.

     They lack support for the recently introduced AUX clocks and do not
     provide the underlying counter value (e.g. TSC) to user space.
     Exposing the counter value snapshot allows for better control and
     steering.

     Convert the hard wired ktime_get_snapshot() to take a clock ID,
     which allows the caller to select the clock ID to be captured along
     with CLOCK_MONONOTONIC_RAW. Additionally capture the underlying
     hardware counter value and the clock source ID of the counter.

     Expand the hardware based snapshot capture where devices provide a
     mechanism to snapshot the hardware PTP clock and the system counter
     (usually via PCI/PTM) to support AUX clocks and also provide the
     captured counter value back to the caller and not only the clock
     timestamps derived from it.

   - Add a new optional read_snapshot() callback to clocksources

     That is required to capture atomic snapshots from clocksources
     which are derived from TSC with a scaling mechanism (e.g. Hyper-V,
     KVMclock).

     The value pair is handed back in the snapshot structure to the
     callers, so they can do the necessary correlations in a more
     precise way.

  This touches usage sites of the affected functions and data structure
  all over the tree, but stays fully backwards compatible for the
  existing user space exposed interfaces. New PTP IOCTLs will provide
  access to the extended functionality in later kernel versions"

* tag 'timers-ptp-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (28 commits)
  ptp: vmclock: Use hw_cycles from snapshot for precise TSC pairing
  x86/kvmclock: Implement read_snapshot() for kvmclock clocksource
  clocksource/hyperv: Implement read_snapshot() for TSC page clocksource
  timekeeping: Add clocksource read_snapshot() method and hw_cycles to snapshot
  ptp: Switch to ktime_get_snapshot_id() for pre/post timestamps
  timekeeping: Add support for AUX clock cross timestamping
  timekeeping: Remove system_device_crosststamp::sys_realtime
  ALSA: hda/common: Use system_device_crosststamp::sys_systime
  wifi: iwlwifi: Use system_device_crosststamp::sys_systime
  ptp: Use system_device_crosststamp::sys_systime
  timekeeping: Prepare for cross timestamps on arbitrary clock IDs
  timekeeping: Remove ktime_get_snapshot()
  virtio_rtc: Use provided clock ID for history snapshot
  net/mlx5: Use provided clock ID for history snapshot
  igc: Use provided clock ID for history snapshot
  ice/ptp: Use provided clock ID for history snapshot
  wifi: iwlwifi: Adopt PTP cross timestamps to core changes
  timekeeping: Add CLOCK ID to system_device_crosststamp
  timekeeping: Add system_counterval_t to struct system_device_crosststamp
  timekeeping: Add CLOCK_AUX support for ktime_get_snapshot_id()
  ...
 2026-06-15 13:51:27 +05:30
Linus Torvalds
13e1a6d6a1 Interrupt core code changes: 
- Rework of /proc/interrupt handling:
 
       /proc/interrupts was subject to micro optimizations for a long time,
       but most of the low hanging fruit was left on the table. This rework
       addresses the major time consuming issues:
 
         - Printing a long series of zeros one by one via a format string
           instead of counting subsequent zeros and emitting a string
           constant.
 
         - Simplify and cache the conditions whether interrupts should be printed
 
 	- Use a proper iteration over the interrupt descriptor xarray
           instead of walking and testing one by one.
 
         - Provide helper functions for the architecture code to emit the
           architecture specific counters
 
 	- Convert the counter structure in x86 to an array, which
           simplifies the output and add mechanisms to suppress unused
           architecture interrupts, which just occupy space for
           nothing. Adopt the new core mechanisms.
 
       This adjusts the gdb scripts related to interrupt counter statitics
       to work with the new mechanisms.
 
     - Prevent a string overflow in the /proc/irq/$N/ directory name
       creation code.
 -----BEGIN PGP SIGNATURE-----
 
 iQJEBAABCgAuFiEEQp8+kY+LLUocC4bMphj1TA10mKEFAmoths8QHHRnbHhAa2Vy
 bmVsLm9yZwAKCRCmGPVMDXSYoSoMEACRODwHjNfULjgD2heHbiPKsmPMRZvwO1Ud
 xu5XAoNT1gwxnLo4D+KrGCZeyxka+byRpby6eNg7HdRJuu3DUf8umwt/Q472I9a9
 ck8OGFp8ntbxnueISKfzxY/O2eXHYxSKmmfZMv3wdOKbvn5OUlFT6eHPjb8PzVUM
 7DiXsBL8s3MNHwdJ3grG5lBh60pt5fujzURwYAqvh/i8jlDHxsFRTMGuhR710knr
 YZrgZ4/7ffnEbDsn98xezPewRomIbhhEijgfjkkbnYYUub6Y2RHJqOzZhlp6zNgi
 vTsU/suW3ryVuzG34rL2uHvsxOcJY1HNA+ING7fkRmPuKxRGKOMBQfPmLQcWqP69
 GxwGIlBvNbAEYievgTCS7GNHTy3t0JbxTGhHcBvX3oMtnnOSTttqH9XzvrTwGxjj
 fMUykfvB+40Fp47D+t0JDhgyNNEkixSBjW8/gogZFQ0OdMFX6BQZNT/DLhMMC0LR
 JbqMpfsffp5+gYam/wixv3sPlxajMpQ2w8ocgyUHVAeFMo1LOY1spUuO3+Tq7nSj
 xt95xVg6HQDr+L+8QmZmnRq27uG276CxPpLotbPMsrn0Ax5PL+fymfmVsFmJFjAR
 ZHKK3tSD6M94GtklfKlB/yBJGNRafH4MVZbMa0iUxGI6UyAFr/Yror3mfDK9NsIA
 WTwwaqI8qw==
 =z6vj
 -----END PGP SIGNATURE-----

Merge tag 'irq-core-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull interrupt core updates from Thomas Gleixner:

  - Rework of /proc/interrupt handling:

    /proc/interrupts was subject to micro optimizations for a long time,
    but most of the low hanging fruit was left on the table. This rework
    addresses the major time consuming issues:

      - Printing a long series of zeros one by one via a format string
        instead of counting subsequent zeros and emitting a string
        constant.

      - Simplify and cache the conditions whether interrupts should be
        printed

      - Use a proper iteration over the interrupt descriptor xarray
        instead of walking and testing one by one.

      - Provide helper functions for the architecture code to emit the
        architecture specific counters

      - Convert the counter structure in x86 to an array, which
        simplifies the output and add mechanisms to suppress unused
        architecture interrupts, which just occupy space for nothing.
        Adopt the new core mechanisms.

    This adjusts the gdb scripts related to interrupt counter statistics
    to work with the new mechanisms.

  - Prevent a string overflow in the /proc/irq/$N/ directory name
    creation code.

* tag 'irq-core-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/irq: Add missing 's' back to thermal event printout
  genirq/proc: Speed up /proc/interrupts iteration
  genirq/proc: Runtime size the chip name
  genirq: Expose irq_find_desc_at_or_after() in core code
  genirq: Add rcuref count to struct irq_desc
  genirq/proc: Increase default interrupt number precision to four
  genirq: Calculate precision only when required
  genirq: Cache the condition for /proc/interrupts exposure
  genirq/manage: Make NMI cleanup RT safe
  genirq: Expose nr_irqs in core code
  scripts/gdb: Update x86 interrupts to the array based storage
  x86/irq: Move IOAPIC misrouted and PIC/APIC error counts into irq_stats
  x86/irq: Suppress unlikely interrupt stats by default
  x86/irq: Make irqstats array based
  genirq/proc: Utilize irq_desc::tot_count to avoid evaluation
  genirq/proc: Avoid formatting zero counts in /proc/interrupts
  x86/irq: Optimize interrupts decimals printing
  genirq/proc: Size interrupt directory names for 10-digit interrupt numbers
 2026-06-15 13:19:41 +05:30
Li RongQing
2d36d3b451 x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap 
Outside the IOPL emulation path, the IO bitmap is always expected
to be allocated when TIF_IO_BITMAP is set. The paranoid WARN_ON_ONCE()
handles the case where the flag and the pointer got out of sync.
In this theoretical scenario, which presumes some other bug in the
code that triggers the WARN_ON_ONCe(), return early, instead of
continuing and dereferencing a NULL pointer.

[ mingo: Clarified the changelog. ]

Signed-off-by: Li RongQing <lirongqing@baidu.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Link: https://patch.msgid.link/20260615070115.4720-1-lirongqing@baidu.com
 2026-06-15 09:40:45 +02:00
Linus Torvalds
2bfc56d9f5 xen: branch for v7.2-rc1 
-----BEGIN PGP SIGNATURE-----
 
 iJEEABYKADkWIQRTLbB6QfY48x44uB6AXGG7T9hjvgUCaivrshsUgAAAAAAEAA5t
 YW51MiwyLjUrMS4xMiwyLDIACgkQgFxhu0/YY75HWAD/UWqFaTfWhpS3mJbcOE8G
 NTfZMunls/XyAoPxL4T6ThMA/jrdrFMerb27S1xHwKIr84YH71P8naXkiv+71UZz
 JCkE
 =Hh59
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.2-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip

Pull xen updates from Juergen Gross:

 - Several small cleanups of various Xen related drivers
   (xen/platform-pci, xen-balloon, xenbus, xen/mcelog)

 - Cleanup for Xen PV-mode related code (includes dropping the Xen
   debugfs code)

 - Drop the additional lazy mmu mode tracking done by Xen specific code

* tag 'for-linus-7.2-rc1-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  xen/xenbus: Replace strcpy() with memcpy()
  x86/xen: Replace generic lazy tracking with cpu specific one
  x86/xen: Get rid of last XEN_LAZY_MMU uses
  mm: Refactor lazy_mmu_mode_pause() and lazy_mmu_mode_resume()
  x86/xen: Change interface of xen_mc_issue()
  x86/xen: Drop lazy mode from trace entries
  x86/xen: Remove Xen debugfs support
  x86/xen: Cleanup Xen related trace points
  x86/xen: Guard PV-only stuff in xen-ops.h with CONFIG_XEN_PV
  xen: balloon: Replace sprintf() with sysfs_emit()
  xen/mcelog: mark g_physinfo, ncpus and xen_mce_chrdev_device as __ro_after_init
  xen: constify xsd_errors array
  xen/platform-pci: Simplify initialization of pci_device_id array
 2026-06-15 05:06:02 +05:30
Linus Torvalds
73f399414a Kbuild / Kconfig changes for 7.2 
Kbuild:
 
 - Remove broken module linking exclusion for BTF
 
 - Add documentation around how offset header files work
 
 - Include unstripped vDSO libraries in pacman packages
 
 - Bump minimum version of LLVM for building the kernel to 17.0.1 and
   clean up unnecessary workarounds
 
 - Use a context manager in run-clang-tools
 
 - Add dist macro value if present to release tag for RPM packages
 
 - Detect and report truncated buf_printf() output in modpost
 
 - Add __llvm_covfun and __llvm_covmap to section whitelist in modpost
 
 - Support Clang's distributed ThinLTO mode
 
 - Remove architecture specific configurations for AutoFDO and Propeller
   to ease individual architecture maintenance
 
 Kconfig:
 
 - Add kconfig-sym-check target to look for dangling Kconfig symbol
   references and invalid tristate literal values
 
 - Harden against potential NULL pointer dereference
 
 - Fix typo in Kconfig test comment
 
 Signed-off-by: Nathan Chancellor <nathan@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR74yXHMTGczQHYypIdayaRccAalgUCaijIpwAKCRAdayaRccAa
 lszAAQD0PuP+a0IejIyubuvEeB0ecG5nvKZIV99veIaivp9J4QD+PwYuPf+Y9A0r
 PqiV0IBrnhbmjNrSj8Clt2eHXqa4jg4=
 =J1xQ
 -----END PGP SIGNATURE-----

Merge tag 'kbuild-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux

Pull Kbuild / Kconfig updates from Nathan Chancellor:
 "Kbuild:

   - Remove broken module linking exclusion for BTF

   - Add documentation around how offset header files work

   - Include unstripped vDSO libraries in pacman packages

   - Bump minimum version of LLVM for building the kernel to 17.0.1 and
     clean up unnecessary workarounds

   - Use a context manager in run-clang-tools

   - Add dist macro value if present to release tag for RPM packages

   - Detect and report truncated buf_printf() output in modpost

   - Add __llvm_covfun and __llvm_covmap to section whitelist in modpost

   - Support Clang's distributed ThinLTO mode

   - Remove architecture specific configurations for AutoFDO and
     Propeller to ease individual architecture maintenance

  Kconfig:

   - Add kconfig-sym-check target to look for dangling Kconfig symbol
     references and invalid tristate literal values

   - Harden against potential NULL pointer dereference

   - Fix typo in Kconfig test comment"

* tag 'kbuild-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (31 commits)
  kconfig: tests: fix typo in comment
  kconfig: Remove the architecture specific config for Propeller
  kconfig: Remove the architecture specific config for AutoFDO
  modpost: Add __llvm_covfun and __llvm_covmap to section_white_list
  kconfig: add kconfig-sym-check static checker
  kbuild: Remove unnecessary 'T' modifier in cmd_ar_builtin_fixup
  kbuild: distributed build support for Clang ThinLTO
  kbuild: move vmlinux.a build rule to scripts/Makefile.vmlinux_a
  scripts: modpost: detect and report truncated buf_printf() output
  kbuild: rpm-pkg: append %{?dist} macro to Release tag
  run-clang-tools: run multiprocessing.Pool as context manager
  compiler-clang.h: Drop explicit version number from "all" diagnostic macro
  compiler-clang.h: Remove __cleanup -Wunused-variable workaround
  kbuild: Remove check for broken scoping with clang < 17 in CC_HAS_ASM_GOTO_OUTPUT
  x86/entry/vdso32: Remove conditional omission of '.cfi_offset eflags'
  x86/module: Revert "Deal with GOT based stack cookie load on Clang < 17"
  x86/build: Drop unnecessary '-ffreestanding' addition to KBUILD_CFLAGS
  scripts/Makefile.warn: Drop -Wformat handling for clang < 16
  riscv: Drop tautological condition from TOOLCHAIN_NEEDS_OLD_ISA_SPEC
  riscv: Remove tautological condition from selection of ARCH_SUPPORTS_CFI
  ...
 2026-06-15 05:01:15 +05:30
Thomas Gleixner
8f72761513 x86/irq: Add missing 's' back to thermal event printout 
The /proc/interrupt handling rework dropped a 's' in the thermal event
printout, which breaks the thermal test in the Intel LKVS suite.

Bring the important letter back.

Fixes: 2b57c69917 ("x86/irq: Make irqstats array based")
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Closes: https://lore.kernel.org/oe-lkp/202606121325.97b29701-lkp@intel.com
 2026-06-13 15:47:59 +02:00
Paolo Bonzini
4e6df93968 Merge branch 'kvm-single-pdptrs' into HEAD 
The non-MMU changes/preliminary cleanups from the "split kvm_mmu in
three" series[1].  The final outcome is to have a single copy of the
PDPTRs (in vcpu->arch) instead of two (in root_mmu and nested_mmu).

[1] https://lore.kernel.org/kvm/20260603105814.10236-1-pbonzini@redhat.com/T/#t
 2026-06-12 10:47:24 +02:00
Paolo Bonzini
8b9ef32200 KVM: x86/mmu: move pdptrs out of the MMU 
PDPTRs are part of the CPU state.  A bit unconventionally, they are
reached via vcpu->arch.walk_mmu instead of being stored in vcpu->arch
directly.  That is nice in principle---it would allow TDP shadow paging
to have its own PDPTRs---but it is not necessary, because EPT has no
PDPTRs and NPT does not cache them.

Since kvm_pdptr_read does not otherwise need the MMU, drop the pdptrs
from the MMU altogether.  There is however something to be careful
about, in that PDPTRs are now not stored separately in root_mmu and
nested_mmu for L1 and L2 guests.  In practice this was already not
an issue:

- for EPT the VMCS0x has to keep them up to date; and for the purpose
  of emulation they are always loaded from the VMCS on vmentry/vmexit,
  thanks to the clearing of dirty and available register bitmaps in
  vmx_switch_vmcs()

- for NPT, VCPU_EXREG_PDPTR is similarly cleared for nNPT, which does
  not cache the PDPTRs; while for non-nNPT the PDPTRs are loaded
  together with the load of CR3.

Note that page table PDPTRs are not affected, since they are stored
in pae_root.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260530165545.25599-6-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-12 10:43:52 +02:00
Paolo Bonzini
af7b2ff7d4 KVM: x86: check that kvm_handle_invpcid is only invoked with shadow paging 
This is true for both Intel and AMD.  On Intel, "enable INVPCID" is
set unconditionally if supported, but the vmexit is triggered by the
"INVLPG exiting" control which is disabled by enable_ept.  On AMD, KVM
can intercept INVPCID if NPT is enabled but only in order to inject #UD
in the guest.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260530165545.25599-5-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-12 10:43:52 +02:00
Paolo Bonzini
62bad2b2cc KVM: nSVM: invalidate cached PDPTRs across nested NPT transitions 
When L2 runs under nested NPT and uses PAE paging, KVM's cached PDPTRs
in mmu->pdptrs[] can hold stale or wrong values after nested
transitions and across migration restore, because both
nested_svm_load_cr3() and svm_get_nested_state_pages() only refresh
PDPTRs on the !nested_npt path.

The user-visible bug is on migration restore of an L2 running with nested
NPT and 32-bit PAE paging, if userspace uses KVM_SET_SREGS rather than
KVM_SET_SREGS2.  In that case, load_pdptrs() leaves VCPU_EXREG_PDPTR
marked as available, and kvm_pdptr_read() will use a stale translation
that used L1 GPAs instead of L2 nGPAs.  svm_get_nested_state_pages()
runs on first KVM_RUN but skips the refresh because nested_npt_enabled()
is true.  The CPU itself reads L2's PDPTRs correctly from memory via
L1's NPT, but KVM-side walking of guest PAE page tables uses the bogus
cached values.

Unlike Intel's GUEST_PDPTR0..3 fields in the VMCS, SVM has no
VMCB-cached PDPTR state: the in-memory PDPTEs at the current CR3 are
the only source of truth, and svm_cache_reg(VCPU_EXREG_PDPTR) simply
reloads them from memory via load_pdptrs().  Clearing the avail
bit (and the dirty bit because !avail/dirty is invalid) to force
a reload when PDPTRs as needed fixes the bug.

Do the same for nested_svm_load_cr3()'s nested_npt branch, so that
the invariant "PDPTRs need reloading" is handled similarly for both
immediate and deferred loading.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260530165545.25599-4-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-12 10:43:52 +02:00
Paolo Bonzini
9eff3e99a8 KVM: nVMX: remove unnecessary code in prepare_vmcs02_rare 
The early vmwrite of the PDPTRs in prepare_vmcs02_rare() is redundant, because
every write it does will be performed by prepare_vmcs02() if it is actually
needed.

In any case where the emulator or the processor need the PDPTR, either
is_pae_paging() is true on vmentry, or a write of CR0, CR4 or EFER will
cause a vmexit to L0.  The next vmentry will refresh the PDPTRs in the
vmcs02 from vmcs12.

In fact, the original version[1] of what ended up being commit
c7554efc83 ("KVM: nVMX: Copy PDPTRs to/from vmcs12 only when
necessary"), the writes in what is now prepare_vmcs02_rare() were removed.
When the mega-collection of optimizations was posted[2], the removal of
that code got dropped as a rebase good, so reinstate it.

[1] https://lore.kernel.org/all/20190507160640.4812-16-sean.j.christopherson@intel.com
[2] https://lore.kernel.org/all/1560445409-17363-31-git-send-email-pbonzini@redhat.com

Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260530165545.25599-3-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-12 10:43:52 +02:00
Paolo Bonzini
8503953e26 KVM: x86: remove nested_mmu from mmu_is_nested() 
nested_mmu is always stored into vcpu->arch.walk_mmu at the same time as
guest_mmu is stored into vcpu->arch.mmu.  But nested_mmu is not even
a proper MMU, it is only used for page walking; plus the fact that
walk_mmu has to be switched at all is just an implementation detail.

In the end what matters here is whether the guest is using nested
page tables; vmx/nested.c and svm/nested.c check it to see if they
are in nEPT or nNPT context respectively.  So switch to checking
root_mmu vs. guest_mmu, which is a more cogent test.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260511150648.685374-2-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20260530165545.25599-2-pbonzini@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 2026-06-12 10:43:52 +02:00
Paolo Bonzini
743204d772 KVM SVN changes for 7.2 
- Add support for virtualizing gPAT (KVM previously just used L1's PAT when
    running L2).
 
  - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
    updates) when emulating VMRUN.
 
  - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
    notably where KVM didn't disable interception of IRR, ISR, and TMR regs.
 
  - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEKTobbabEP7vbhhN9OlYIJqCjN/0FAmorQ78ACgkQOlYIJqCj
 N/3bCxAAoXU8uJ37PIm58P7ok5hF2OFXeDLCYE1BpOfYOaT4b0vWW+Rb5I3y+2K6
 511IxlBE2RcGBg6LHb1d1a/IEvs0NpzXOZFp7NseJC8sIn01Lndgn2SvoLoMVRy8
 Yda4WyCNV1rSeq+duZKtMRhXiNY5Zdgsz6S5MdnslAK9OCbjS2XsQ6F7afMwM1g0
 D3/kVUdBwUrKrllgmJ+XprLvYGEVji8xVCosdJm1ZAxb0xIr395/Oy7tnx3O2XNz
 NjpEqabFRjcL8JMiOPnYdTfdqsNagr7qSqunJkCMUtuq+ZBaAA332ZKRbR/Rh83c
 XprJMMw3+t77AjMSOHGmQY9ykVugT29bG7mjN/5bqhqqSzS1zjpGKd7ToEqvpKBn
 lCnbUoSUQkvfBMZr6WUQppZvNfZaNi2Nuq4EKkZzqOiKUMO6ggfIh/1+M7s93mmT
 rCa/35JEoBL3uwJcc75c25Y3QZWQyJjuNmFOuDt4s+yzDJ70F6II8FMykC5LGlFn
 m9oZ/KIFEY1H9r8GyjoCIksQI/GBPxAKULA8wfY4WsMr+NzzKIhB39FfR6FnyZTN
 XmPRlAKvWCGAqnrbOwgWvdu8Gsj18SpU38+AhngZRS7cVqB4+tQEZ4tcp9oSz6dy
 UMYsZD0N8TFgGNqRf34DmgB+NSIamttAAYhMPWgAoqdvseHSvp0=
 =4LNF
 -----END PGP SIGNATURE-----

Merge tag 'kvm-x86-svm-7.2' of https://github.com/kvm-x86/linux into HEAD

KVM SVM changes for 7.2

 - Add support for virtualizing gPAT (KVM previously just used L1's PAT when
   running L2).

 - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
   updates) when emulating VMRUN.

 - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
   notably where KVM didn't disable interception of IRR, ISR, and TMR regs.

 - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.
 2026-06-12 10:16:59 +02:00