5551 Commits
Author SHA1 Message Date
Linus Torvalds 827751b699 Merge tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
 "From a RISC-V point of view, there's one notable fix here, reverting
  an earlier bogus fix to the pointer masking code. Fortunately the
  practical impact appears to be small.

   - Revert a bad fix, likely LLM-generated, in the pointer masking code
     that confused the RISC-V hardware pointer masking implementation
     with the Linux kernel tagged address feature

   - Fix unexpected faults caused by kprobe instruction slot writes when
     !CONFIG_STRICT_MODULE_RWX

   - Fix unexpected faults on minimal configurations during runtime code
     patching on !CONFIG_STRICT_MODULE_RWX systems

   - Fix a misplaced variable clear causing incorrect reuse of previous
     values in the RISC-V hardware feature probing code

   - Fix two bugs in the PMU SBI perf code on rv32: use BIT_ULL rather
     than BIT on 64-bit masks; and use a bitmap rather than an unsigned
     long on a quantity that can exceed 32 bits

  And a few miscellaneous cleanups:

   - Avoid a potential dereference-before-NULL-pointer-check bug in the
     PMU SBI perf driver

   - Use CONFIG_GENERIC_BUG_RELATIVE_POINTERS to simplify the rv32 bug
     table code (like x86 and PPC)

   - Report the RISC-V standard ISA extensions Z[v]fhmin when support is
     claimed for the superset RISC-V standard ISA extensions Z[v]fh; and
     simplify our FPU test code to only check for the presence of the D
     extension

   - Use an existing kernel string helper in place of some open-coded
     code in kernel/usercfi.c

   - Fix some yamllint issues in the RISC-V DT bindings for CPUs

   - Convert one use of __ASSEMBLY__ to __ASSEMBLER__ that snuck into
     the RISC-V CFI selftest code

   - Update the translation for the simplified Chinese translation of
     the RISC-V kernel patch acceptance policy"

* tag 'riscv-for-linus-7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
  kselftest/riscv: Replace __ASSEMBLY__ with __ASSEMBLER__
  docs/zh_CN: Update arch/riscv/patch-acceptance.rst translation
  dt-bindings: riscv: cpus: Fix yamllint style issues
  riscv: hwprobe: simplify has_fpu() to check D extension only
  perf: RISC-V: check cpu_hw_evt before dereference in overflow IRQ
  riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
  perf: RISC-V: store available counter mask as bitmap
  perf: RISC-V: use BIT_ULL for u64 overflow masks
  riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
  riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
  riscv: use string helper in setup_global_riscv_enable()
  Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
  riscv: patch: skip fixmap mapping when kernel text is already writable
  riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
2026-09-11 13:15:13 -07:00
Linus Torvalds 2beb1b31a1 Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf
Pull bpf fixes from Alexei Starovoitov:
 "This mainly contains verifier fixes that address bugs reported by
  Nicholas Carlini.

   - Fix incorrect non-NULL inference in pointer comparisons: pointer
     types that may be NULL at runtime, pointers with unbounded offsets,
     JMP32 comparisons with zero, and imprecise zero registers (Eduard
     Zingerman)

   - Fix precision tracking for half-dead zero spills, ld_abs/ld_ind
     implicit subprog exit, bpf_loop() callbacks, linked scalar ids and
     NULL call arguments (Eduard Zingerman)

   - Reject BPF_PSEUDO_FUNC reference to the main program, fix zero
     extension of arena 32-bit cmpxchg, don't rewrite bpf_fastcall
     patterns entered by a jump (Eduard Zingerman)

   - Fix percpu map update and BPF_F_CPU validation with sparse CPU IDs
     (Hui Su)

   - Fix NULL-ptr-derefs in bpf_snprintf_btf() for void and VAR types,
     and reject key-less BTF for hash maps (Jiayuan Chen)

   - Various fixes (Kumar Kartikeya Dwivedi):
       - Fix out-of-bounds access in disassembler on invalid LDSX
         instruction
       - mark siginfo of signal tracepoints as scalar and
         sched_process_wait argument as nullable
       - mark faultable stack helpers as sleepable
       - reject tail calls and legacy packet loads from callbacks
       - enforce rbtree callback lock restrictions for resilient locks
       - require MEM_PERCPU for percpu kptr stores
       - clear NON_OWN_REF after RCU protection ends
       - mark NULL kptr stores precise
       - preserve inner map identity in callback frames
       - reject non-scalar bpf_loop() iteration counts

   - Fix trampoline allocation slowdown on x86 by using
     EXECMEM_MODULE_DATA (Mike Rapoport)

   - Keep bpf_refcount_acquire() nullable for borrowed RCU kptrs and
     reject untrusted allocated-object pointers (Ning Ding)

   - Fix special fields handling in recycled rhtab elements (Nuoqi Gui,
     Yuan Chen)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (86 commits)
  bpf, riscv: Make arena support depend on ZACAS
  selftests/bpf: Test pointer bpf_loop iteration count rejection
  bpf: Reject non-scalar bpf_loop iteration counts
  bpf: use mark_arg_precision() in check_mem_size_reg()
  bpf: propagate mark_chain_precision() errors out of loop_flag_is_zero()
  selftests/bpf: precision of a NULL global subprogram BTF_ID argument
  bpf: mark a NULL BTF_ID argument of a global subprogram precise
  selftests/bpf: precision of a NULL kfunc argument
  bpf: mark a NULL kfunc argument precise
  selftests/bpf: precision of a NULL global subprogram memory argument
  bpf: mark a NULL memory argument of a call precise
  selftests/bpf: precision of a NULL helper argument
  bpf: mark a NULL call argument precise
  selftests/bpf: Test inner map identities in callbacks
  bpf: Preserve inner map identity in callback frames
  selftests/bpf: Test imprecise scalar kptr stores
  bpf: Mark NULL kptr stores precise
  selftests/bpf: Test rhtab kptr cancellation semantics
  bpf: Cancel special fields when recycling rhtab elements
  selftests/bpf: Test timer field on recycled rhtab element
  ...
2026-09-06 13:49:44 -07:00
Chen Pei 536b523b40 bpf, riscv: Make arena support depend on ZACAS
The arena range tree allocates its nodes with kmalloc_nolock() since
commit f8c67d8550 ("bpf: Use kmalloc_nolock() in range tree").
kmalloc_nolock() requires slab caches with cmpxchg128 support
(__CMPXCHG_DOUBLE); on riscv cmpxchg128 is provided by the ZACAS
extension. On systems without ZACAS every arena map creation fails
with a misleading -ENOMEM.

Report the missing support instead: make bpf_jit_supports_arena()
return system_has_cmpxchg128() where it is defined, so arena map
creation fails with -EOPNOTSUPP on systems without ZACAS. The macro
is only defined when both CONFIG_RISCV_ISA_ZACAS and
CONFIG_TOOLCHAIN_HAS_ZACAS are enabled, so guard it with #ifdef the
same way mm/slab.h consumes it, and reject arena otherwise. This
matches how arena BPF_CMPXCHG instructions are already gated on ZACAS
in bpf_jit_supports_insn().

Fixes: f8c67d8550 ("bpf: Use kmalloc_nolock() in range tree")
Signed-off-by: Chen Pei <cp0613@linux.alibaba.com>
Acked-by: Pu Lehui <pulehui@huawei.com>
Acked-by: Björn Töpel <bjorn@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/bpf/20260902061451.1416-1-cp0613@linux.alibaba.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-09-06 16:23:12 +02:00
Kees Cook 3a2c4d55e3 treewide: refresh kmalloc_obj() conversions
This is another run of the Coccinelle script for converting kmalloc()
family of allocations to kmalloc_obj() via the existing rules in
scripts/coccinelle/api/kmalloc_objs.cocci

This catches both the set of kmalloc() uses added since the first
kmalloc_obj() conversions in v7.0 and adds a large group missed in the
first pass due to Coccinelle not interacting well with the cleanup.h
scoped_...() family of macros[1]. I worked around this with spatch's
"--macro-file" argument to a file with all the scoped_...() macros mapped
to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control
flow indicator I could find.

Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc,
riscv, and s390 with no new warnings.

Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1]
Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2]
Signed-off-by: Kees Cook <kees+treewide@kernel.org>
2026-09-04 21:37:00 -07:00
Andy Chiu b94cec5761 riscv: skip software algning code for HAVE_EFFICIENT_UNALIGNED_ACCESS
We can jump straight into the copy loop if the kernel is compiled for a
hardware that natively supports misaligned access. The user copy
bandwidth improvement on K3 and Ascaolon is shown as below:

Misaligned user copy, size: 512B (offset: [0:15] except 0, 8)
BW Improvement	| Write	| Read	|
K3		| 6.19%	| 3.43%	|
Ascalon		| 10.0%	| 11.4%	|

Aligned user copy, size: 512B (offset: 0, 8)
BW Improvement	| Write	| Read	|
K3		| 1.69%	| 0.90%	|
Ascalon		| 1.25%	| 3.32%	|

Suggested-by: Anton Blanchard <antonb@tenstorrent.com>
Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Link: https://patch.msgid.link/20260901192334.3543340-1-tchiu@tenstorrent.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-09-02 11:47:08 -06:00
Ivy Lopez 93a27367ba riscv: hwprobe: simplify has_fpu() to check D extension only
The kernel never supports D without F, since D depends on F. The
D-extension flag is cleared during devicetree/ACPI parsing whenever
F is not present, so has_fpu() checking either extension with '||'
never actually produces a different result than checking D alone -
F without D cannot occur in practice, and there is no observable
impact on RISCV_HWPROBE_IMA_FD or userspace.

Simplify has_fpu() to check D only, matching the expectations set
elsewhere in the kernel for this dependency, rather than relying on
a redundant OR condition.

sys_hwprobe.c already calls has_fpu() and needs no changes.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=221874
Suggested-by: Conor Dooley <conor.dooley@microchip.com>
Suggested-by: Andreas Schwab <schwab@suse.de>
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260901013746.19386-1-skunkolee@gmail.com
[pjw@kernel.org: updated to apply]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-09-01 19:20:13 -06:00
JinRui 248dbaf777 riscv: report Zfhmin/Zvfhmin when Zfh/Zvfh are present
The RISC-V ISA manual specifies that Zfh implies Zfhmin, a normative
rule clarified in
https://github.com/riscv/riscv-isa-manual/pull/3070. Zvfh likewise
implies Zvfhmin, as stated by the vector extension specification.

The kernel currently reports ZFH and ZFHMIN (and ZVFH and ZVFHMIN) as
independent hwprobe bits derived only from what the device tree
declares. Platforms that declare just "zfh" (Zfh being a superset that
already contains all Zfhmin instructions) therefore report
RISCV_HWPROBE_EXT_ZFHMIN=0, which breaks userspace RVA23 conformance
checks (e.g. snapd installing core26 on riscv64).

Use the existing superset mechanism to set the implied subset bits:
  - zfh implies zfhmin
  - zvfh implies zvfhmin

Add a hwprobe selftest asserting the implication holds and update the
hwprobe documentation accordingly.

This is complementary to the rva23u64 base behavior discussion: the
RVA23 conformance query proposed there is derived from the
per-extension bits fixed here, so correct EXT_0 reporting is a
prerequisite for it to work on harts whose device tree declares only
"zfh".

Tested on a RISC-V QEMU VM whose device tree only declares "zfh" and
"zvfh": with this change both /proc/cpuinfo and the hwprobe
RISCV_HWPROBE_KEY_IMA_EXT_0 bitmap report ZFHMIN and ZVFHMIN, and the
hwprobe selftest (including the new implication check) passes.

Link: https://lore.kernel.org/kvm-riscv/20260206002349.96740-1-andrew.jones@oss.qualcomm.com/
Signed-off-by: JinRui <jinrui@haiwei.tech>
Link: https://patch.msgid.link/7190E4DB338251C3+20260811081513.2849980-1-jinrui@haiwei.tech
[pjw@kernel.org: trimmed superfluous blank line in tags]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-09-01 19:19:44 -06:00
Jisheng Zhang ddeaa39406 riscv: bug: Make RV32 use GENERIC_BUG_RELATIVE_POINTERS
x86 did this in commit b0a848f4a4 ("x86/bugs: Make i386 use
GENERIC_BUG_RELATIVE_POINTERS")

powerpc did this in commit 1baa1f70ef ("powerpc: Allow relative
pointers in bug table entries")

Similar as x86 and powerpc does, make RV32 use
GENERIC_BUG_RELATIVE_POINTERS for "there is only one code path." and
"less #ifdef is more better".

Signed-off-by: Jisheng Zhang <jszhang@kernel.org>
Link: https://patch.msgid.link/20260221024255.3552-1-jszhang@kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:23 -06:00
Andy Chiu d0fc6fab20 riscv: hwprobe: initialize pair->value in hwprobe_one_pair()
The vendor-extension handlers reached from hwprobe_one_pair()
(hwprobe_isa_vendor_ext_thead_0() and friends) only OR the present bits
into pair->value via VENDOR_EXTENSION_SUPPORTED() and clear their own
missing bits; they assume the caller has already zeroed pair->value.

That holds for hwprobe_get_values() (it zeroes each pair) and
hwprobe_get_cpus() (it re-initializes its scratch pair per key), but not
for complete_hwprobe_vdso_data(), which reuses a single pair across all
keys without re-zeroing. A vendor key therefore inherits stale bits from
the previously probed key, and the wrong value is cached in the vDSO
all_cpu_hwprobe_values[] and handed to userspace on the fast patih.

Zero pair->value once at the top of hwprobe_one_pair() so every handler
starts from a clean value regardless of the caller, and drop the now
redundant zeroing in the *_BLOCK_SIZE cases. hwprobe_isa_ext0() keeps its
own zeroing because hwprobe_ext0_has() calls it directly, bypassing
hwprobe_one_pair().

Fixes: a5ea53da65 ("riscv: hwprobe: Add thead vendor extension probing")
Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Jesse Taube <jtaubepe@redhat.com>
Link: https://patch.msgid.link/20260725001614.2578617-2-tchiu@tenstorrent.com
Cc: stable@vger.kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:23 -06:00
Dmitry Antipov 12381af010 riscv: use string helper in setup_global_riscv_enable()
Prefer the convenient string choice 'str_disabled_enabled()'
helper over hardcoded strings in 'setup_global_riscv_enable()'.

Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Link: https://patch.msgid.link/20260819160546.3219942-1-dmantipov@yandex.ru
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:23 -06:00
Samuel Holland 2d2184ac90 Revert "riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set"
This reverts commit 3033b2b1e3.

The reverted patch is userspace-visible behavior change, not a bug fix.
The two variables here (pmm and pmlen) control two independent features:
pmm is the _hardware_ pointer masking mode that applies while executing
in userspace. pmlen is the shift amount that the _kernel_ uses when
untagging addresses; PMLEN_0 means no untagging occurs, so the kernel
does not accept tagged addresses in syscall arguments.

It is valid (as documented and tested by the self test) to enable
pointer masking without enabling the tagged address ABI. This separation
is necessary to allow userspace to create an execution environment
similar to what the kernel supports on arm64 by default, where TBI is
enabled but the tagged address ABI is not. (On arm64, there is no
equivalent to PR_PMLEN_MASK because TBI is always enabled.)

Signed-off-by: Samuel Holland <samuel.holland@sifive.com>
Link: https://patch.msgid.link/20260820014551.1979772-1-samuel.holland@sifive.com
Cc: stable@vger.kernel.org
Fixes: 3033b2b1e3 ("riscv: Reset pmm when PR_TAGGED_ADDR_ENABLE is not set")
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:23 -06:00
Xiaofeng Yuan 8718e5a309 riscv: patch: skip fixmap mapping when kernel text is already writable
patch_map() always creates a temporary writable mapping via fixmap for
kernel text addresses, even when CONFIG_STRICT_KERNEL_RWX is disabled
and the kernel text is already mapped with _PAGE_WRITE.

This is unnecessary overhead at best, and on minimal configurations
it can cause page faults.

Skip the fixmap path for kernel text when CONFIG_STRICT_KERNEL_RWX
is not enabled, since the text pages are already writable in that case.
The module text path is already gated on CONFIG_STRICT_MODULE_RWX and
is kept unchanged.

Reported-by: Klara Modin <klara@kasm.eu>
Closes: https://lore.kernel.org/all/ant_8TaBbov_GS4i@soda.int.kasm.eu/
Reported-by: Lad Prabhakar <prabhakar.csengg@gmail.com>
Closes: https://lore.kernel.org/all/CA+V-a8tQK8rih9SGGTyqrEBGpNkx4H0eX2YccCRrgkVAPr+EBg@mail.gmail.com/
Tested-by: Klara Modin <klarasmodin@gmail.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Link: https://patch.msgid.link/20260814082742.148403-3-xiaofengmian@163.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:23 -06:00
Xiaofeng Yuan bdc46e507b riscv: mm: make EXECMEM_KPROBES writable without CONFIG_STRICT_MODULE_RWX
When CONFIG_STRICT_MODULE_RWX is not set, execmem cannot create
temporary writable mappings for read-only executable pages. In this
case, the execmem ranges must already have writable permissions.

Currently EXECMEM_KPROBES unconditionally uses PAGE_KERNEL_READ_EXEC,
which causes kprobe instruction slot writes to trigger page faults
on systems where CONFIG_STRICT_MODULE_RWX is not enabled.

Fix this by using PAGE_KERNEL_EXEC when CONFIG_STRICT_MODULE_RWX
is not available.

Signed-off-by: Xiaofeng Yuan <xiaofengmian@163.com>
Tested-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260814082742.148403-2-xiaofengmian@163.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-31 19:11:22 -06:00
Linus Torvalds 7bb6284aa7 Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm updates from Paolo Bonzini:
 "ARM64:

   - Add support for 'slot' based PMU events, paired with new UAPI that
     compels the user to select a specific PMU implementation

   - Lazy save/restore of vCPU state for pKVM, along with various fixes
     and cleanups to the management of vCPU state between the untrusted
     host and pKVM hypervisor

   - Disable traps of EL1 registers for nested hypervisors when
     FEAT_NV2p1 is present, guaranteeing that EL2-specific register bits
     are stateful in the EL1 counterpart

   - Leverage FEAT_NV3 to avoid unnecessary ERET/TLBI traps when the
     scope of those instructions remains 'in host' (i.e. L1
     kernel/userspace)

   - Pile of fixes for the management of the VNCR pseudo-TLB, such as
     under-invalidations and races with concurrent TLBIs on other vCPUs

   - Consolidate the non-protected and pKVM view of ICH_VTR_EL2 to a
     runtime-patched constant, allowing the same data to be shared with
     pKVM prior to dropping host privileges

   - Considerable pile of LLM-assisted fixes around the shop but mostly
     in the VGIC, our in-kernel generator of bugs (and sometimes
     interrupts)

  LoongArch:

   - Advertise already-supported capabilities

   - Some bug fixes about timer and MMIO

   - Some hardening about interrupt injection

   - Replace kvm_err() with kvm_pr_unimpl()

   - Add FPU/LSX/LASX test cases for selftests

  RISC-V:

   - Svadu/Zicfiss/Zicfilp FWFT support for Guest

   - Use try_cmpxchg for IMSIC MRIF RMW

   - More arch-specific tracepoints in KVM RISC-V

   - Eager page splitting when enabling dirty logging

   - Optimize hfence request handling for SMP Guests

   - Improve dirty log clearing by skipping zero bits in mask

   - Guard HFENCE range loops against overflow

   - CPU PM notifiers in KVM RISC-V for non-retentive idle states

   - Fix kernel-mode vector context save/restore for Guest

  s390:

   - Fixes for vfio-ap

   - Fixes for the gmap rework

   - Fixes for vsie

   - AI triggered fixes all over

   - diag9c tracing

   - code move preparation for the additional arm64 support

   - enable CONTEXT_ANALYSIS

  x86:

   - Perform spring cleaning on x86.{c,h} and asm/kvm_host.h, by adding
     regs.c (the kvm_cache_regs.h => regs.h is already applied) and
     msrs.{c,h}, and moving relevant code out of x86.c

   - Split kvm_mmu in three parts, respectively to describe the format
     of page tables, walking the guest page tables and building the page
     tables. Always use the same page table walker kvm->arch.gva_walk as
     the entry point to convert a guest's virtual address, where the
     previous code used two different kvm_mmu structs depending on
     whether the walk included nested EPT/NPT or not. Make page fault
     vmexits reuse the permission checking machinery that is used for
     guest page faults. This is both a cleanup and a baby step towards
     supporting XS/XU memory permissions

   - Document some of the "fun" gotchas with the APIC base when creating
     IRQCHIPs on x86

   - Remove a defunct masterclock update from kvm_xen_shared_info_init().
     It could result in incorrect kvmclock due to triggering an
     unnecessary switch to/from masterclock mode

   - Skip Xen runstate time updates if time has effectively gone
     backwards, so that the guest doesn't report 100% steal time for
     a very, very long time

   - Drop KVM's runtime updates of the Xen PV timing CPUID leaf, as KVM
     was updating the wrong sub-leaf, and upstream KVM will soon provide
     all the information needed by userspace to populate the CPUID field
     itself

   - Fix a bug where KVM would walk a newly created rmap without holding
     the rmap lock (or mmu_lock) during aging

   - Fix a bug where aging TDP MMU SPTEs could clobber FROZEN SPTEs

   - Fix a variety of #DB priority bugs

   - Fix a class of races related to enabling Hyper-V emulation on a
     vCPU after the vCPU is visible to the rest of KVM

   - Use static calls for nested virtualization ops

   - Move more KVM-internal code out of x86's kvm_host.h

   - Enumerate support for a variety of Zhaoxin instructions that don't
     require explicit virtualization

   - Fix missing EFER validation bugs, including in the KVM_SET_SREGS*
     path

   - Harden kvm_vcpu_map() against double-mapping and thus leaking
     references

   - Misc fixes and cleanups, e.g. for largely benign syzkaller splats

  x86 (Intel):

   - Zero a vCPU's entry in VMX's Posted Interrupt Descriptor table used
     for IPI virtualization when the vCPU is freed, to fix a
     use-after-free where hardware will write to a freed vCPU's PID

   - Service local TLB flushes on a failed nested VM-Enter to fix a bug
     where KVM could miss a TLB on a future, successful VM-Enter with
     the same L2 VPID

   - Cap the maximum value shoved into the VMX Preemption Timer to
     workaround an erratum that affects all existing Intel CPUs that
     support CPUID 0x15

   - Fix VPID virtualization bugs where KVM would fail to flush hardware
     TLBs

   - Harden the TDX "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  x86 (AMD):

   - Forcefully invalidate SNP VMSA pages if their backing guest_memfd
     page is zapped/invalidated, e.g. due to a PUNCH_HOLE in response to
     a Page-State Change request

   - Remove a dying VM from the GA Log notifier list before the VM is
     actually destroyed, to fix a potential use-after-free

   - While FOLL_WRITE was needed in the past to trigger CoW unsharing,
     nowadays FOLL_LONGTERM does that already even without FOLL_WRITE,
     and in fact, get_user_pages() actually disallows FOLL_WRITE
     together with FOLL_LONGTERM. So don't pass FOLL_WRITE when
     registering encrypted memory regions, i.e. when pinning SEV/SEV-ES
     guest memory, to fix a regression with file-backed memory
     introduced by KVM's (correct) usage of long-term pins

     (This was reviewed by mm maintainers; for more information, see
     commit ee1a586dd1 "KVM: SEV: Drop FOLL_WRITE for encrypted region
     registration")

   - Allocate full pages for SEV/SEV-ES {DE,EN}CRYPT ops on SNP-enabled
     hosts to fix a data corruption issue due to the PSP driver
     assigning to-be-written pages to firmware (as required by the SNP
     specs)

   - Unconditionally intercept ICBEP so that KVM generates the correct
     guest RIP when handling an ICEBP-induced TASK_SWITCH #VMEXIT

   - Harden the SNP "populate" ioctls against bad input, and to prepare
     for supporting in-place private<=>shared conversion

  Generic:

   - Remove kvm_debugfs_dir if kvm_init() fails after creating KVM's
     debugfs

   - Add a per-VM bitmap to track which vCPU IDs have been "claimed" but
     for which the vCPU isn't yet online, and use the bitmap to reject
     duplicate IDs before calling into arch code. This allows arch code
     to consume vcpu_id without having to worry about cross-vCPU
     clobbering (at least s390 and x86 have had related bugs)

   - Rework the so called "prepare" and "invalidate" guest_memfd hooks
     to prepare for in-place private<=>shared conversion, and clean up a
     few warts along the way

  Selftests:

   - Automatically allocate a full page for L2 guest stacks on x86
     instead of requiring test-specific L1 guest code to carve out a
     portion of the L1 stack for L2 usage, and to ensure the L2 stack
     also adheres to the x86-64 calling convention ABI

   - Add a selftest to verify {Guest,Host}-Only behavior in x86's
     mediated PMU

   - Clean up nested SVM's handling of GPRs on L2<=>L1 transitions,
     reuse the functionality for nested VMX, and drop the ucall hack
     that was fudging around the lack of GPR switching on nVMX

   - Add a stress test to verify KVM doesn't clobber/drop #PF state,
     e.g. CR2, across save/restore, including when L2 is active

   - Add a test to verify KVM_CREATE_VM accepts exactly what is reported
     by KVM_CAP_VM_TYPES

   - Misc selftests fixes and cleanups

   - Fix several issues with seeding the pRNG, and rework the pRNG APIs
     to that the pRNG can be sanely used in host code, not just guest
     code

   - Add an IRQ test to validate virtual IRQ deliverty for IRQs wired up
     via KVM_IRQFD + KVM_SET_GSI_ROUTING, with optional support for
     triggering IRQs via writes to an assigned VFIO device

   - Add syscall wrappers to assert success on a variety of pthreads and
     CPU affinity APIs

   - Set vCPU pthread affinity as early as possible to reduce contention
     issues that were surfaced by PREEMPT_LAZY, which result in runtimes
     of over a minute on large hosts, versus the expected ~5 seconds

   - Rework the PMU counters test to run each testcase using a single VM
     with many vCPUs for each sub-testcase, instead of using a unique VM
     for each sub-testcase. This cuts the runtime by ~20x

  Miscellaneous:

   - MAINTAINERS updates for vfio-ap, guest_memfd, kvm-x86. Mostly
     representing the status quo more accurately, but also... welcome
     David Hildenbrand as guest_memfd reviewer!"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (413 commits)
  KVM: arm64: Validate GICv5 timer PPIs before claiming ownership
  KVM: arm64: vgic: Reject out-of-range GICv5 PPI IDs
  KVM: arm64: vgic: Prevent speculative SPI array underflow
  KVM: arm64: vgic: Free gic_kvm_info on initialization failure
  KVM: arm64: Avoid mismatched accesses to 'struct kvm_nvhe_init_params'
  s390/vfio-ap: Fix NULL deref in status_show() during queue probe
  s390/vfio-ap: Fix hot-unplug skipped when last AP adapter or domain removed
  s390/vfio-ap: fix potential use of uninitialized apm_filtered bitmap
  s390/vfio-ap: Fix control domain removal in vfio_ap_mdev_cfg_remove
  s390/vfio-ap: Fix required lock not held during update of ap_matrix_mdev object
  s390/vfio-ap: Fix missing lock required to access list of ap_matrix_mdev objects
  s390/vfio-ap: Fix dereference matrix_mdev->kvm without checking for NULL
  s390/vfio-ap: Fix stale do_remove flag across iterations in vfio_ap_mdev_cfg_remove
  RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
  riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
  riscv: vector: refactor riscv_v_start_kernel_context
  KVM: s390: gmap: Make prefix handling optional
  KVM: s390: gmap: Make CMMA optional
  KVM: s390: gmap: Make storage keys optional
  KVM: s390: Prepare gmap for a second KVM implementation
  ...
2026-08-25 11:48:04 -07:00
Linus Torvalds ed3b875bea Merge tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull MM updates from Andrew Morton:

 - "mm: drop "sub" prefix from various places" (Dev Jain)

   page->folio conversion and a naming cleanup

 - "mm/kasan: remove redundant initialization for kasan_flag_write_only"
   (Igor Putko)

   KASAN cleanup work

 - "mm/filemap: reduce unnecessary xarray lookups" (Chi Zhiling)

   Small speedup in the pagecaache read code

 - "mm/percpu: Fix possible NOFS/NOIO reclaim recursion" (Kaitao Cheng)

   Improve the vmalloc code - mainly the avoidance of GFP_KERNEL
   allocations when the caller asked for GFP_NOFS or GFP_NOIO

 - "mm/kmemleak: avoid soft lockup when scanning task stacks" (Breno
   Leitao)

   Avoid a soft lockup watchdog trigger from the kmemleak scanning code
   in extreme situations

 - "mm/page_owner: misc cleanups" (Ye Liu)

   Cleanups to the page_owner code. For some reason lots of people have
   been working on the page_owner code this cycle.

 - "mm: convert to walk_page_range_vma() to eliminate find_vma()"
   (Kefeng Wang)

   Simplify and accelerate the page walking library function

 - "mm/migrate: preparatory cleanups for batch copy and offload"
   (Shivank Garg)

   Cleanups in the migration code

 - "mm/page_owner: add per-fd filter infrastructure for print_mode and
   NUMA filtering" (Zhen Ni)

   Per-fd filtering to page_owner in order to reduce the sometimes vast
   amount of output it can produce

 - "mm: Refactor bootmem gigantic hugepage allocation" (Muchun Song)

   Fixes and preparatory cleanups around bootmem HugeTLB handling,
   sparse initialization ordering, and related vmemmap setup

 - "mm/zsmalloc: reduce lock contention in zs_free()" (Wenchao Hao)

   Reduce lock contention in zs_free(), which dominates the unmap path
   under memory pressure on Android (LMK kills) and on x86 servers
   running zswap-heavy workloads.

   Up to 1.83x improvement in microbenchmarking.

 - "move alloc_tag.c file under mm/" (Suren Baghdasaryan)

 - "samples/damon: handle damon_{start,stop}() failures" (SJ Park)

   Fix improper handling of damon_start(), damon_stop(), and
   damon_call() failures across DAMON sample modules to prevent
   potential memory leaks, operation disruptions and use-after-free
   bugs

 - "mm/damon/sysfs: kobject_del() directories that users can
   create/remove" (SJ Park)

   Fix delayed sysfs directory removal under DEBUG_KOBJECT_RELEASE
   causeing creation failures due to duplicate directory names by adding
   missing kobject_del() calls before creating new directories

 - "mm: cleanup clear_not_present_full_ptes()" (David Hildenbrand)

   Clean up the core pte handling code

 - "selftests/damon: misc fixes for test bugs" (Kunwu Chan)

   Fix several bugs in the DAMON selftests

 - "selftests/damon: fix memcg_path staging handling" (Cheng Nie)

   Fix a bug in _damon_sysfs.py for damos_filter memcg_path setup, and
   add a test case for it in sysfs.py.

 - "selftests/damon: test kdamond refresh_ms" (Ruslan Valiyev)

   Selftest coverage for DAMON's refresh_ms sysfs feature by updating
   the test control module and verifying that scheme stats update
   automatically without manual intervention

 - "mm/damon: five misc fixups" (Akinobu Mita)

   Miscellaneous DAMON fixups.

 - "mm/damon/core: detect internal variation above max_nr_regions/2"
   (Jiayuan Chen)

   Fix DAMON's region splitting behavior when region counts exceed half
   the maximum budget by dynamically scaling down the split fraction as
   the limit approaches, preventing large regions from staying un-split,
   and add corresponding KUnit test coverage

 - "mm: preparatory patches for PMD level swap entries" (Usama Arif)

   Refactor and clean up PMD softleaf helpers, call sites, and
   architecture flags to lay the groundwork for a follow-up series that
   introduces PMD page table swap entries

 - "mm/damon: update, optimize, and clean up doc, tests, and code" (SJ
   Park)

   Update DAMON design and ABI documentation, expands unit and selftest
   coverage, optimize damon_commit_target_regions(), and clean up
   recently added sysfs interface code for better readability

 - "mm/vmpressure: reduce CPU, memory and code overhead on cgroup v2"
   (Usama Arif)

   Optimize vmpressure() by skipping unnecessary work on cgroup v2 for
   userspace event notifications and refactor v1-only eventfd handling
   into mm/memcontrol-v1.c to reduce memory overhead and code complexity

 - "selftests/mm: refactor pkey helpers and fix mmap error handling"
   (Hongfu Li)

   Refactor pkeys shared tracing and assertion helpers into a common
   file, unify protection key selftests to use consistent diagnostic
   logging and assertions, and enforce standardized MAP_FAILED return
   checks for mmap() calls across the tests

 - "mm/damon: optimize out nr_accesses_bp" (SJ Park)

   Replace the error-prone, continuously updated nr_accesses_bp field in
   damon_region with an on-demand moving sum function, reducing
   structure memory overhead and avoiding state corruption bugs

 - "Open HugeTLB allocation routine for more generic use" (Ackerley Tng)

   Decouple HugeTLB folio allocation from VMA dependencies by
   introducing hugetlb_alloc_folio(), enabling subsystems like
   guest_memfd to allocate HugeTLB folios without standard VMA
   reservations or pseudo-VMAs

 - "mm/damon: provide pseudo moving sum probe_hits" (SJ Park)

   Integrate DAMON's probe_hits attribute counter into the pseudo moving
   sum infrastructure, enabling real-time, online monitoring without
   waiting for full aggregation intervals

 - "mm: Some cleanups for page allocator APIs" (Brendan Jackman)

   Simplify and refactor the page allocator entry points and flags by
   unifying allocation paths, adding internal alloc_flags arguments, and
   eliminating redundant __ prefixed alloc_pages variants.

 - "Fix incorrect access of hugetlb pte entries" (Dev Jain)

   Enforce the consistent use of huge_ptep_get() instead of ptep_get()
   for HugeTLB entries and fixes an unaligned address issue in arm64's
   huge_ptep_get() implementation

 - "mm/damon: validate all parameters in the core" (SJ Park)

   Consolidate parameter validation into the DAMON core specifically
   within damon_start() and damon_commit_ctx() to centralize error
   checking, eliminate caller-side redundant checks and to improve
   maintenance efficiency

 - "tools/mm/page_owner_sort: fix filtering and cleanup issues" (Yichong
   Chen)

   Rename is_need() to filter_record() for clearer return semantics, fix
   per-record allocation memory leaks and bound output copies in
   search_pattern() to address an existing buffer issue

 - "memcg: bail out reclaim when memcg is dying" (Jiayuan Chen)

   Mitigate a system-wide stall which occurs when a cgroup is removed
   while one of its memory control files is doing synchronous reclaim

 - "mm/memory-failure: add panic option for unrecoverable pages" (Breno
   Leitao)

   Introduce an opt-in vm.panic_on_unrecoverable_memory_failure sysctl
   that immediately panics the kernel on unrecoverable memory errors in
   kernel-owned pages to preserve error context and prevent delayed,
   silent data corruption

 - "mm/damon: refactor damon_{start,stop,commit}() for simple error
   handling" (SJ Park)

   Refactor the DAMON core API functions to guarantee that all contexts
   are fully stopped when damon_start(), damon_stop(), or damon_commit()
   fail, eliminating the need for complex and error-prone caller-side
   cleanup code

 - "Keep tail page private zero at free and folio split" (Zi Yan)

   Add checks to ensure tail_page->private is zero when freeing compound
   or high-order pages and when promoting tail pages during large folio
   splits. By validating these fields at free and split time, it allows
   the removal of redundant private field clearing inside
   prep_compound_tail()

 - "mm: drop redundant lru_add_drain in anon folio reuse paths" (Barry
   Song)

   Eliminate redundant lru_add_drain() calls in
   wp_can_reuse_anon_folio() and do_swap_page() to reduce LRU lock
   contention and system overhead

   By validating folio refcounts against the LRU cache before draining
   and removing unnecessary drains in the swap path, it achieves up to a
   30.5% reduction in drain calls during heavy swap workloads

 - "mm: clean up folio LRU and swap declarations" (Jianyue Wu)

   Reorganize folio LRU and swap code by relocating page-cluster state
   to mm/swap_state.c, renaming mm/swap.c to mm/folio.c, and moving
   MM-internal reclaim declarations into mm/internal.h.

 - "userfaultfd: working set tracking for VM guest memory" (Kiryl
   Shutsemau)

   Add userfaultfd support for tracking the working set of VM guest
   memory, so a VMM can identify hot pages and reclaim cold ones to
   tiered or remote storage

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 2)" (David
   Hildenbrand)

   Remove the remaining pieces of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   performing some smaller cleanups around freeing of reserved vmemmap
   pages on the way.

 - "mm/damon: update probe hits for runtime parameter commits" (SJ Park)

   Ensure that DAMON's probe_hits attribute counter is properly updated
   when monitoring intervals are changed at runtime, matching the
   behavior of nr_accesses. To achieve this, it refactors and renames
   existing helper functions for shared use, applies the updates to
   probe_hits, and handles edge cases in damon_probe_hits_mvsum() to
   maintain measurement accuracy.

 - "KSM: performance optimizations for rmap_walk_ksm" (xu xin)

   Resolve a severe KSM reverse-mapping performance bottleneck where
   thousands of split VMAs sharing a single anon_vma cause extended lock
   contention.

   By adding an interval-filtering check during the rmap walk, it
   reduces worst-case anon_vma lock hold times from over 500ms down to
   under 2ms, preventing application freezes and latency spikes under
   memory pressure.

 - "mm: split a couple of headers from internal.h" (Mike Rapoport)

   Split declarations related to mm_init, memblock, vmalloc and sparse
   into new headers

 - "KSM: use linear_page_index in collect_procs_ksm()" (xu xin)

   Apply the interval tree optimization from rmap_walk_ksm() to
   collect_procs_ksm() to avoid iterating over non-matching VMAs during
   KSM memory error handling.

   It hoists loop-invariant address initialization and restricts the
   anon_vma_interval_tree_foreach walk to a targeted page offset range,
   reducing redundant checks and improving lookup efficiency.

 - "selftests/mm: avoid false failures in hugetlb and KSM tests" (Sayali
   Patil)

   Fix issues in the hugetlb and KSM MM selftest categories that can
   report failures when the prerequisites for the tests are not
   satisfied

 - "mm/damon: introduce data attributes only monitoring" (SJ Park)

   Introduce attribute-weighted region management in DAMON, allowing
   users to prioritize specific data attributes (such as page sizes or
   cgroups) over or instead of access monitoring.

   By assigning weights to attribute probes, DAMON can completely
   disable access tracking and adjust monitoring regions based on
   weighted probe-hit counters to optimize monitoring quality for
   attribute-focused workloads.

 - "mm/hmm: Add mmap lock-drop support for userfaultfd-backed mappings"
   (Stanislav Kinsburskii)

   Extend hmm_range_fault() to support userfaultfd-backed regions by
   allowing the mmap lock to be dropped during fault handling via a new
   hmm_range_fault_locked() helper.

   By accepting a locked pointer and signaling retry status when lock
   release occurs, it enables page fault resolution in userfaultfd
   regions while preserving backward compatibility for existing callers.

 - "mm: make VMA page offset handling more consistent" (Lorenzo Stoakes)

   Clean up and standardize how vma->vm_pgoff is accessed and
   manipulated across file-backed and anonymous mappings in the kernel

   It introduces dedicated helper functions such as vma_start_pgoff(),
   vma_end_pgoff(), vma_set_pgoff() and linear_page_delta() while
   renaming rmap interval tree helpers to better reflect their
   functionality.

   These changes establish a cleaner foundation for future work that
   will unify virtual page offset indexing for all anonymous and CoW'd
   folios.

 - "mm: handle device-private PMDs in walk callbacks" (Usama Arif)

   Address kernel panics and state corruption caused by MM walk
   callbacks reaching non-present device-private PMD swap entries
   created during HMM migrations

   It ensures that functions which acquire pmd_trans_huge_lock()
   properly recognize device-private PMDs instead of assuming a present
   THP or a standard migration entry.

 - "mm/rmap: Refactor try_to_unmap_one" (Dev Jain)

   Refactor try_to_unmap_one by modularizing Hugetlb,
   anonymous-lazyfree, and anonymous-swapbacked logic into dedicated
   functions, laying the structural groundwork for batched anonymous
   large folio unmapping.

 - "Docs/ABI/damon: sysfs ABI document fixes and additions" (Song Hu)

   Fix typos and fills in missing entries in the DAMON sysfs ABI
   document

 - "dax/kmem: atomic whole-device hotplug via sysfs" (Gregory Price)

   Introduce an atomic sysfs state attribute and supporting DAX/MM
   infrastructure to prevent userland races when offlining and removing
   entire memory regions

   By adding an unplugged state alongside standard online modes, it
   enables whole-device atomic hotplug control while preserving backward
   compatibility.

 - "mm: convert more vm_flags_t users to vma_flags_t" (Lorenzo Stoakes)

   Continue transitioning the kernel from the deprecated vm_flags_t type
   to vma_flags_t across core memory management infrastructure.

   It replaces legacy type usage in core functions such as do_mmap(),
   unmapped area allocation, mm->def_vma_flags, and VMA operations like
   mlock, mprotect, and mremap.

 - "Two small patches to clean up mm/mm_slot.h" (xu xin)

   Refactor mm_slot.h by introducing mm_slot_remove() to unify duplicate
   slot deletion sequences in khugepaged and KSM. It also adds code
   documentation explaining why mm_slot_lookup and mm_slot_insert must
   remain as preprocessor macros rather than static inline functions.

 - "mm/damon/core: hide core-private struct fields" (SJ Park)

   Clean up DAMON core structures by consistently marking internal-only
   fields with private: comment tags to prevent improper direct access
   from outer layers.

   It enforces encapsulation across core structures including
   damon_region, damon_target, and damon_ctx and updates DAMON_SYSFS to
   interact through approved access APIs instead of exposing raw struct
   members.

 - "mm/damon: unurgent fixes for infinite loop, NULL de-ref and races"
   (SJ Park)

   Address potential infinite loops, NULL dereferences, and race
   conditions identified in DAMON

   It fixes an infinite loop triggered by extreme user configurations, a
   NULL pointer dereference within unit tests and minor monitoring
   accuracy degradation caused by subtle runtime races.

 - "mm/page_alloc: fixes for free_pages_nolock() on RT/UP" (Brendan
   Jackman)

   Fix an NMI safety flaw in __free_frozen_pages() where freeing pages
   on non-SMP or PREEMPT_RT kernels can bypass can_spin_trylock() checks
   via non-PCP or isolated migration paths.

   It also resolves potential kernel crashes and privilege escalation
   risks triggered when BPF tracing runs in NMI context alongside memory
   hotplug or large allocation frees.

 - "mm/page_alloc: couple of followups for recent cleanups" (Brendan
   Jackman)

   Clean up and update page allocator nomenclature, documentation, and
   debug assertions.

   It aligns internal FPI_ flags with the public "nolock" naming
   convention, removes outdated internal implementation details from
   high-level page allocator comments, and eliminates obsolete
   VM_BUG_ON() assertions in allocation paths.

 - "mm/mseal: further cleanups" (Lorenzo Stoakes)

   Refactor and simplify the mseal implementation by clarifying API
   boundaries and removing unnecessary code complexity.

   It replaces generic do_mseal() usage outside the syscall with a
   dedicated mseal_mmap_page_zero() helper for MMAP_PAGE_ZERO,
   eliminates mm_struct parameters to enforce that sealing applies only
   to current->mm, and streamlines overall logic and comments with no
   functional changes intended.

 - "mm/vmscan: fix swappiness=max and clean up per-node proactive
   reclaim" (Ridong Chen)

   Resolve reclaim behavior bugs and clean up function parameters across
   memory reclaim paths

   It fixes swappiness=max in both standard reclaim and MGLRU so
   unswappable anonymous memory no longer falls back to evicting page
   cache, ensures reclaim_store() returns accurate error codes instead
   of collapsing all failures into -EAGAIN, and removes the obsolete
   gfp_mask parameter from __node_reclaim().

 - "mm: mincore: misc cleanups" (Kefeng Wang)

   Clean up and simplifies the mincore code. Most importantly, it
   removes the historical special behavior that always reports VM_PFNMAP
   pages as non-resident.

 - "mm/huge_memory: drop dead split helper variants" (Kiryl Shutsemau)

   Two trivial cleanups in the folio split API

 - "mm/damon: fix uninitialized DAMOS field and kunit exec expectation
   bugs" (SJ Park)

   Resolve minor operational and testing bugs in DAMON identified by
   Sashiko. It initializes the damos->last_applied field to prevent
   occasional efficiency degradation and fixes invalid memory accesses
   in DAMON KUnit tests during test failure handling.

 - "cleanup for stable_page_flags()" (Jinjiang Tu)

   Clean up and refactor stable_page_flags() used by /proc/kpageflags
   without altering functionality.

   It uses BIT_ULL() to prevent shift-overflow warnings on 64-bit flag
   bits, converts folio-specific flag checks to standard folio_test_*()
   helpers, and removes redundant CONFIG_PAGE_IDLE_FLAG handling.

 - "Batch unmap of uffd-wp file folios" (Dev Jain)

   Extend batched folio unmapping support to file folios within
   userfaultfd write-protect (uffd-wp) VMAs by adding batching
   capabilities to pte_install_uffd_wp_if_needed().

   This removes special-case restrictions on uffd-wp VMAs in
   try_to_unmap_one(), significantly simplifying the function's control
   flow and complexity.

 - "mm/early_ioremap: clarify and clean up early_ioremap_reset()"
   (Sang-Heon Jeon)

   Clarify and clean up the architecture-specific usage of
   __late_set_fixmap() and __late_clear_fixmap() after
   early_ioremap_reset()

   It adds explicit documentation regarding when early_ioremap_reset()
   must be called and removes redundant macro definitions and reset
   calls in the RISC-V and ARM64 architectures.

 - "mm: fix reclaim storms in defrag_mode" (Johannes Weiner)

   Address severe performance regressions, swap storms, and spurious
   OOMs caused by vm.defrag_mode=1 under high memory pressure in Meta
   production

   It updates the page allocator slowpath so non-movable allocation
   requests actively trigger direct reclaim and direct compaction at
   pageblock_order scale, allowing them to claim whole pageblocks rather
   than spinning unproductively.

 - "zram: lockmap tweaks" (Sebastian Siewior)

   Optimize and fix lockdep tracking for zram devices by consolidating
   per-entry lockmaps and isolate lock classes across multiple instances

   This reduces memory overhead by replacing per-entry lockdep_map
   instances with a single map per struct zram, and assigns a dynamic
   lock_class_key to each instance to prevent false deadlock reports
   when different zram devices are backed by distinct filesystems.

* tag 'mm-stable-2026-08-18-18-39' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (501 commits)
  selftests/mm: thuge-gen: fix test_shmget() for PAGE_SIZE check
  selftests/mm: unpoison pages in memory-failure teardown
  mm/shmem: downgrade final i_blocks check in shmem_evict_inode() to pr_warn()
  mm/khugepaged: replace mutex_lock/mutex_unlock usage with guard macro
  mm/zsmalloc: fix release order of locks in zs_page_migrate()
  Documentation: zram: remove sections numbering
  ksm: stop iterating VMAs when ksm_test_exit returns true
  mm: fold userfaultfd_rwp() to false without CONFIG_ARCH_HAS_PTE_PROTNONE
  mm/migrate: report RCU-tasks quiescent states in migrate_pages_batch()
  zram: use a custom key for each zram object
  zram: move lockmap to be per-zram instead per table
  selftests/mm: fix gup_longterm EINVAL error message
  mm: page_alloc: fix non-movable reclaim storm in defrag_mode
  mm: page_alloc: move capture_control to the page allocator
  mm: compaction: support non-movable compaction for pageblock requests
  mm: page_alloc: __GFP_FS lockdep annotation for direct compaction
  hugetlb: evaluate subpool free state while locked
  mm/damon: remove trailing semicolons after function definitions
  mm/damon/ops-common: prevent migration fallback to non-target nodes
  mm/damon: update outdated comment about DAMOS filter handling
  ...
2026-08-20 18:17:08 -07:00
Linus Torvalds 073e62fd33 Merge tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V updates from Paul Walmsley

 - Add initial definitions and discovery for the Smcsrind, Sscsrind,
   Smcntrpmf, Ssccfg, Smcdeleg, Zicclsm, Ziccamoa, Ziccif, Ziccrse,
   Za64rs, and Ssqosid RISC-V ISA extensions

 - Improve the RISC-V update_mmu_cache_range() implementation by using
   flush-by-ASID, enabling performance improvements on
   microarchitectures that support related optimizations; and by taking
   advantage of the Svinval RISC-V ISA extension on microarchitectures
   that support it

 - Shrink CFI shadow stack allocation further (to 512MB) to save virtual
   address space (and physical memory on systems with strict overcommit
   policies)

 - Add initial CPU context switch support for QoS tagging (Ssqosid)

 - Change our vector misaligned access speed test code to be
   synchronous, avoiding a bunch of bugs related to unnecessary
   asynchronicity

 - Enable ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V to help with ACPI table
   debugging (similar to ARM64 and x86)

 - Extract vDSO section offsets at build time, rather than run time, to
   avoid the boot time overhead

 - Use assembler directives to control the use of instructions from the
   RISC-V ISA extensions Zacas and Zabha, rather than compiler -march
   flags that could affect the whole kernel (similar to ARM64)

 - Add a kselftest for kprobes support for the c.jal instruction on
   RISC-V

 - When UEFI runtime services are available, use them to restart and
   power off

 - Fix ARCH_HAS_ACPI_TABLE_UPGRADE for RISC-V by adding a missing
   include file to the ACPI code

 - Move contiguous DMA memory reservation later in the boot, to ensure
   that the correct global and per-node pools are allocated when
   CONFIG_CMA_SIZE_PERNUMA is enabled

 - Disallow probes on breakpoint handlers to avoid recursing
   indefinitely into do_trap_break()

 - Patch the compat vDSO during runtime alternatives processing, not
   only the standard vDSO

 - Remove some leftover XIP support elements missed by commit
   9b3a2be848 ("riscv: Remove support for XIP kernel")

 - Fix broadcast timer switching in ACPI LPI power states by
   implementing a RISC-V version of arch_get_idle_state_flags()

 - Miscellaneous fixes, including: vDSO makefile simplification; marking
   our default_power_off() as __noreturn; error path fixes in the PMU
   SBI perf driver; RISC-V extension capitalization consistency; the use
   of BIT() macros in one of our include files; and some documentation
   fixes

* tag 'riscv-for-linus-7.3-mw1' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux: (39 commits)
  RISC-V: hwprobe: Use BIT macro to avoid warnings
  riscv: alternative: Also patch the compat vDSO
  riscv: alternative: Use the statically extracted vDSO section offsets
  riscv: vdso: Add symbols for the alternative section boundaries
  riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
  riscv: Add Zicclsm to cpufeature and hwprobe
  riscv: cpufeature: Clarify ISA spec version for canonical order
  riscv: Standardize extension capitalization
  riscv: kprobes: Prevent probes in breakpoint handlers
  riscv: cmpxchg: Use .option arch for Zacas and Zabha
  riscv: acpi: Handle LPI architectural context loss flags
  riscv: further remove XIP
  riscv: Add support for srmcfg CSR from Ssqosid extension
  riscv: Detect the Ssqosid extension
  dt-bindings: riscv: Add Ssqosid extension description
  dt-bindings: riscv: add Counter delegation ISA extensions description
  RISC-V: Add Ssccfg/Smcdeleg ISA extension definition and parsing
  RISC-V: Add Ssccfg extension CSR definition
  dt-bindings: riscv: add Smcntrpmf ISA extension description
  RISC-V: Add Smcntrpmf extension parsing
  ...
2026-08-20 14:53:54 -07:00
Linus Torvalds 5a8cd539ac Merge tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next
Pull bpf updates from Daniel Borkmann:
 "Major changes:

   - Redesign the verifier error reporting: failures now carry source
     and instruction annotations along with the causal event history
     that led to them, making program rejections far easier to debug and
     repair (Kumar Kartikeya Dwivedi)

   - Add arena argument support to kfuncs and struct_ops through the new
     __arena and __arena__nullable suffixes (Tejun Heo, Puranjay Mohan,
     Kumar Kartikeya Dwivedi, Ihor Solodrai)

   - Signed BPF program loader rework to accommodate both BPF and
     security community needs where the kernel runs the signature
     verification at BPF_PROG_LOAD time before the LSM admission hook
     (Daniel Borkmann)

   - Add a set of ksock kfuncs which let BPF LSM and syscall programs
     create, connect and send on UDP sockets in order to emit telemetry
     data (Mahe Tardy)

   - Unify helper and kfunc call argument verification and classify
     kfunc arguments purely from BTF into a generated bpf_func_proto
     which is computed once at add-call time (Amery Hung)

  Other features and fixes:

   - Enable EXECMEM_ROX_CACHE for BPF allocations on x86 (Mike Rapoport)

   - Add bidirectional VLAN support to bpf_fib_lookup() through the new
     BPF_FIB_LOOKUP_VLAN and BPF_FIB_LOOKUP_VLAN_INPUT flags (Avinash
     Duduskar)

   - Infer zext_dst from static register liveness analysis to fix 32-bit
     zero-extension semantics, and remove the artificial limitations on
     pointer types eligible for spilling (Eduard Zingerman)

   - Inline the numeric open-coded iterator kfuncs so that bpf_for()
     loops no longer pay a kfunc call on every iteration (Puranjay
     Mohan)

   - Add an arena-based bitmap data structure to libarena along with
     serial and parallel selftests (Emil Tsalapatis)

   - Teach resolve_btfids to discover kfuncs from the kernel's BTF ID
     sets and to emit kfunc BTF decl tags, reducing the kernel build's
     dependency on pahole features (Ihor Solodrai)

   - Add BPF_F_ADJ_ROOM_DECAP_* flags to bpf_skb_adjust_room() so that
     tunnel decapsulation can update the GSO and encapsulation state of
     the skb (Nick Hudson)

   - Fix the ring buffer pending_pos walk and the available-data
     accounting on 32-bit position wrap (Israel Téllez García)

   - Add memory usage accounting for arena maps and fix an mmap_lock
     deadlock on arena lock failure (Jiayuan Chen)

   - Add tracing_multi link info support to the kernel UAPI and bpftool,
     and refactor the stack map code to run with preemption disabled
     (Jiri Olsa)

   - Support BPF_F_EGRESS in bpf_redirect_peer() to emit the skb in the
     egress direction of the target's peer device (Jordan Rife)

   - Add a KF_SPINLOCK_SAFE kfunc flag so that providers, in particular
     modules, can declare kfuncs safe to call under bpf_spin_lock
     instead of relying on the verifier's hard-coded allowlist (Kaitao
     Cheng)

   - Introduce global percpu data for BPF programs with libbpf probing
     and bpftool skeleton support, and stop exposing uninitialized
     kernel heap memory when copying per-CPU map values (Leon Hwang)

   - Add s390 JIT support for load-acquire and store-release
     instructions (Maxim Khmelevskii)

   - Fix a CFI mismatch in the task work callback and an arm64 KASAN
     false positive after bpf_throw() (Mykyta Yatsenko)

   - Reject writes through untrusted BTF pointers and bound the
     rdonly/rdwr_buf_size kfunc arguments (Nicholas Dudar)

   - Invalidate RCU pointers only after the final spin unlock and
     account for preempt and IRQ disabled regions as overlapping RCU
     protection (Ning Ding)

   - Support mixing bpf2bpf calls and tail calls on RV64, add signed
     operations and 32-bit atomics to the RV32 JIT, and add timed
     may_goto support (Pu Lehui, Kuan-Wei Chiu, Feng Jiang)

   - Fix a use-after-free on mm_struct in bpf_find_vma() for foreign
     tasks and an mmap_lock leak in the irq_work path (Sanghyun Park)

   - Populate mmap-able BPF array map memory lazily which makes mmap()
     O(1) instead of proportional to the map size (Song Liu)

   - Introduce a jit_required flag and reject programs with inlined
     helpers when no JIT is available, where the interpreter would
     otherwise jump into an invalid address (Tiezhu Yang)

   - Fix the x86 JIT per-CPU address resolution into an extended
     register where the REX prefix dropped the high destination register
     bit (Vineet Gupta)

   - Reject MEM_ALLOC BTF accesses past object bounds, arena frees below
     the arena base, and mixed arena and ordinary atomic paths (Yiyang
     Chen)

   - Fix the trampoline handling of 128-bit arguments and of return
     values larger than 8 bytes (Yonghong Song)

   - Ensure that any fault prone load is rewritten with exception table
     handling, and fix the arena load-acquire and atomic fetch handling
     in the x86, arm64, riscv and s390 JITs (Daniel Borkmann)

   - Many more fixes and cleanups across the verifier, arena,
     trampolines, sockmap, cgroup, ring buffer, x86/arm64/riscv/s390
     JITs, libbpf, bpftool, resolve_btfids and selftests"

* tag 'bpf-next-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (373 commits)
  selftests/bpf: Add tests for a store on a fault prone qdisc pointer
  selftests/bpf: Add tests for fault prone loads out of RCU pointers
  selftests/bpf: Add tests for pointer type merge at a shared load
  selftests/bpf: Remove duplicate copies of the arena spinlock qnodes
  selftests/bpf: Retry stat generation in cgroup_iter_memcg
  selftests/bpf: Test pseudo-function policy diagnostics
  bpf: Distinguish function references in policy diagnostics
  bpf: Preserve source attribution without source text
  selftests/bpf: Test kfunc argument diagnostics
  bpf: Correct kfunc argument diagnostics
  bpf: Use canonical stack argument names in diagnostics
  bpf: Preserve R0 lineage across helper calls
  selftests/bpf: Exercise negative optlen in cgroup getsockopt hook
  bpf: Reject negative optlen in cgroup getsockopt hook
  selftests/bpf: tc_tunnel - validate decap GSO and encapsulation state
  bpf: Clear decap state on skb_adjust_room shrink path
  bpf: Allow new DECAP flags and add guard rails
  bpf: Add BPF_F_ADJ_ROOM_DECAP_* flags for tunnel decapsulation
  bpf: Refactor masks for ADJ_ROOM flags and encap validation
  bpf: Name the enum for BPF_FUNC_skb_adjust_room flags
  ...
2026-08-20 07:36:20 -07:00
Linus Torvalds 6eb1ea5ff4 Merge tag 'soc-defconfig-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC defconfig updates from Arnd Bergmann:
 "Just the usual updates to the main defconfig files as well as the
  omap2 specific one, to enable more loadable modules for better default
  hardware support"

* tag 'soc-defconfig-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
  riscv: defconfig: thead: enable PCA953X GPIO driver
  arm64: defconfig: Enable drivers for BeagleBadge
  arm64: defconfig: Enable Qualcomm BAM-DMUX WWAN driver
  arm64: defconfig: Enable Sound DMIC driver
  arm: omap2plus_defconfig: Enable multi-LED
  arm64: defconfig: Enable Qualcomm reference device EC driver
  ARM: omap2plus_defconfig: enable things required by iwd
  arm: multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x and AM335x
  arm64: defconfig: Enable Allwinner LRADC input driver
2026-08-18 19:47:08 -07:00
Linus Torvalds cbe8aadf15 Merge tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC devicetree updates from Arnd Bergmann:
 "There are two new mystery SoCs with very little public information
  about them so far, Qualcomm's Cortex-A78C based "Shikra" and Altera's
  Cortex-A720 based Agilex72 SOCFPGA.

  We have also gained support for a couple of SoCs from the 2023/2024
  timeframe that have been in the making for a while:

   - The Apple platform gains support for M3 Pro, Max and Ultra SoC,
     following the basic M3 support from 7.2.

   - Samsung Exynos 1580 is a high-end mobile phone SoC from 2024

   - Canaan K230 is a RISC-V based 64-bit AI SoC, based on the earlier
     K210 chip

   - Sophgo SG2000 is a mixed Arm/RISC-V chip that was already supported
     using the Arm core but is now also added for RISC-V along with
     several other variants of the cv18xx series

  In terms of newly added machines we have reference platforms for all
  the chips above, plus

   - Only four 32-bit Arm boards: two older phones and two older
     industrial/embedded boards; using Allwinner, Qualcomm and Rockchip
     SoCs

   - Three laptops und three phones using Qualcomm SoCs

   - Ten 64-bit Rockchips based single-board computers, along with one
     NAS box and a game console.

   - Seven industrial/embedded boards and modules using NXP i.MX8/9
     SoCs.

   - A Lenovo desktop box based on NVIDIA Jetson Xavier NX

   - A few more single-board computers based on Allwinnner A133,
     Spacemit K1 and TI AM62.

  As usual, there is a constant stream of minor cleanups and fixes
  towards addressing the 'dt-check-style --mode strict' warnings, and
  everyone is expected to address those warnings for new submissions
  now"

* tag 'soc-dt-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (864 commits)
  Revert "riscv: dts: spacemit: k3: add i2s0-i2s5 nodes"
  Documentation/process: maintainer-soc: Mention expectation about dt-check-style
  ARM: dts: helios4: add SATA regulator supplies
  ARM: dts: helios4: add vcc-supply to GPIO expander
  ARM: dts: helios4: add vcc-supply to EEPROM
  arm64: dts: turris-mox: fix usb3 phys
  arm64: dts: ti: Correct white-space style
  arm64: dts: ti: k3-am64: Fix MDIO clock reference for ICSSG0 node
  arm64: dts: qcom: talos-evk: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: sa8155p-adp: Fix swapped USB and UFS QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: eliza-mtp: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: lemans: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: glymur: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: kaanapali: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: sar2130p: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: sm8750: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: sm8650: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: purwa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: hamoa: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  arm64: dts: qcom: sc8180x: Fix swapped USB QMP PHY vdda-phy/vdda-pll supplies
  ...
2026-08-18 19:36:32 -07:00
Linus Torvalds 104a813376 Merge tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull VDSO updates from Thomas Gleixner:

 - Consolidate the VDSO datastore further and provide support for
   mlock_all() and prefaulting.

 - Provide 32-bit legacy time related functionality only if
   CONFIG_COMPAT_32BIT_TIME is enabled. The config switch exists,
   but architecture code still exposes the legacy functionality even
   disabled.

   Clean this up by adding the missing guards and validating at build
   time that the VDSO is legacy free if disabled.

 - Consolidate the VDSO related config options in core and drivers,
   which removes some non-sensical dependencies and quite an amount of
   #ifdeffery.

 - Clean up the PAGE_SIZE definition maze

* tag 'timers-vdso-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (30 commits)
  random: vDSO: Drop custom PAGE_SIZE definitions
  LoongArch: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/timer-riscv: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/arm_arch_timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  clocksource/drivers/mips-gic-timer: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  MIPS: csrc-r4k: Remove CONFIG_GENERIC_GETTIMEOFDAY ifdeffery
  vDSO: Make clockmode constants available without CONFIG_GENERIC_GETTIMEOFDAY
  kbuild: Support generated asm-headers in subdirectories
  vdso: Rename HAVE_GENERIC_VDSO to VDSO_DATASTORE
  vdso: Drop HAVE_GENERIC_VDSO from architecture kconfig files
  vdso: Automatically select HAVE_GENERIC_VDSO if necessary
  MIPS: vdso: Stop using CONFIG_HAVE_GENERIC_VDSO
  vdso: Remove the dependency on HAVE_GENERIC_VDSO from ARCH_HAS_VDSO_ARCH_DATA
  futex: Remove dependency on HAVE_GENERIC_VDSO from FUTEX_ROBUST_UNLOCK
  vdso/gettimeofday: Verify COMPAT_32BIT_TIME interactions
  sparc: vdso: Respect COMPAT_32BIT_TIME
  MIPS: VDSO: Respect COMPAT_32BIT_TIME
  powerpc/vdso: Respect COMPAT_32BIT_TIME
  ARM: VDSO: Respect COMPAT_32BIT_TIME
  arm64: vdso32: Respect COMPAT_32BIT_TIME
  ...
2026-08-18 16:56:25 -07:00
Linus Torvalds 030c9f813b Merge tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull treewide timer related cleanups from Thomas Gleixner:

 - Remove the leftover CLOCK_TICK_RATE which has been scheduled for
   removal more than a decade ago along with some now empty asm/timex.h
   files.

 - Consolidate delay timer calibration

   The construct of having a define in a header requires that
   architectures provided asm/timex.h for no reason. Also the function
   name for reading the delay timer is confusing at best.

   Use a config switch to enable that functionality and rename the
   function to delay_read_timer() to make the purpose clear.

   This removes some more now empty asm/timex.h files as well.

* tag 'timers-cleanups-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  calibrate: Rework delay timer calibration
  treewide: Remove CLOCK_TICK_RATE
  x86: Use PIT_TICK_RATE instead of CLOCK_TICK_RATE
2026-08-18 15:58:29 -07:00
Linus Torvalds 3424d8c18a Merge tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull generic entry code updates from Thomas Gleixner:

 - Make syscall user dispatching configurable

   Not all architectures can makes use of syscall user dispatching.
   Allow them to disable the feature completely.

 - Consolidate stack randomization for the generic entry code and the
   architectures using it.

   Stack randomization on syscall entry was sprinkled throughout the
   architecture specific low level entry code and in some cases at the
   wrong points, e.g. before establishing state, which violates the
   non-instrumentable constraints of that code.

   Clean this up by integrating stack randomization into the generic
   entry code helpers so that it is invoked at the earliest possible
   point right after establishing state and converting all generic entry
   code using architecture over.

 - Clean up the syscall number handling in the generic entry code. It
   works correctly for architectures which have a separate return value
   storage in pt_regs, but fails to distinguish the case where user
   space handed in -1 as syscall number from the case where the entry
   code rejects it by returning -1 to the callers. Aside of that the
   return value functionality of those interfaces is not really
   intuitive.

   Fix this by separating the decision to reject a syscall (user
   dispatch, ptrace, seccomp ...) from the potential modification of the
   syscall number through these mechanisms.

   This solves most of the problems for architectures which do not have
   a separate return value storage in pt_regs except for the case where
   a tracepoint has a BPF script or a probe attached which overwrite
   both the syscall number and the return value. But that's a problem
   which cannot be solved in the generic code, that only can be
   addressed by separating the storage model in the affected
   architectures.

* tag 'core-entry-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (23 commits)
  entry, treewide: Make syscall_enter_from_user_mode[_work]() indicate syscall execution
  entry: Make return type of syscall_trace_enter() bool
  entry: Rework trace_syscall_enter()
  entry: Rework syscall_audit_enter()
  syscall_user_dispatch: Introduce ARCH_SUPPORTS_SYSCALL_USER_DISPATCH
  entry: Fix seccomp bypass after ptrace with TSYNC
  x86/entry: Simplify the syscall number logic
  x86/entry: Get rid of the sys_ni_syscall() indirection
  x86/entry: Make syscall functions static
  ptrace, treewide: Rename ptrace_report_syscall_entry() to ptrace_report_syscall_permit_entry()
  seccomp, treewide: Rename and convert __secure_computing() to return boolean
  entry: Use syscall number instead of rereading it
  entry: Remove syscall_enter_from_user_mode()
  x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack()
  s390/syscall: Use enter_from_user_mode_randomize_stack()
  riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack()
  entry: Provide [syscall_]enter_from_user_mode_randomize_stack()
  randomize_kstack: Provide add_random_kstack_offset_irqsoff()
  ...
2026-08-18 15:00:56 -07:00
Linus Torvalds dfa35434d7 Merge tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
 "Futexes:

   - Use runtime constants for futex_hash computation (K Prateek Nayak,
     Peter Zijlstra)

   - Optimise the size check get_futex_key() (Sebastian Andrzej Siewior)

   - Avoid private hash use-after-free on final put (Felix Hoffmann)

   - Tell kmemleak we're not leaking __futex_queues (Peter Zijlstra)

  Rust integration updates:

   - Implement refcounted interrupt disable and SpinLockIrq for Rust
     (Boqun Feng, Heiko Carstens, Joel Fernandes, Lyude Paul)

   - Rust sync: add helpers for mb, dma_mb and friends; add generic
     memory barriers and use LKMM atomics instead of Rust atomics in the
     revocable code (Gary Guo)

   - Add abstraction and integrate synchronize_rcu() (Philipp Stanner)

  Lock debugging:

   - Add qspinlock contended_release tracepoint (Dmitry Ilvokhin, Peter
     Zijlstra)

   - Enable the printing of held locks of remote running tasks and print
     task CPU (Ingo Molnar)

   - percpu-rwsem: Annotate intentional data race in readers_active_check()
     (Sun Shaojie)

  Misc fixes and updates by Boqun Feng, Peter Zijlstra, Fangrui Song,
  Naveen Kumar Chaudhary and Thomas Huth"

* tag 'locking-core-2026-08-17' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (44 commits)
  rust: sync: Introduce SpinLockIrq::lock_with() and friends
  rust: sync: Add SpinLockIrq
  rust: sync: Use super::* in spinlock.rs
  rust: helper: Add spin_{un,}lock_irq_{enable,disable}() helpers
  rust: Introduce interrupt module
  s390/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  arm64: sched/preempt: Enable HAS_SEPARATE_PREEMPT_RESCHED_BITS
  preempt: Introduce HAS_SEPARATE_PREEMPT_RESCHED_BITS
  sched: Avoid signed comparison of preempt_count() in __cant_migrate()
  sched: Remove the unused preempt_offset parameter of __cant_sleep()
  locking: Switch to _irq_{disable,enable}() variants in cleanup guards
  irq: Add KUnit test for refcounted interrupt enable/disable
  irq,spin_lock: Add counted interrupt disabling/enabling
  openrisc: Include <linux/cpumask.h> in smp.h
  preempt: Introduce __preempt_count_{sub,add}_return()
  preempt: Introduce HARDIRQ_DISABLE_BITS
  preempt: Track NMI nesting to separate per-CPU counter
  futex: Tell kmemleak we're not leaking __futex_queues
  x86/paravirt: Trace contended_release on unlock
  tracing/lock: Use TRACE_EVENT_FN() for contended_release
  ...
2026-08-18 13:07:17 -07:00
Linus Torvalds ba24659b1d Merge tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux
Pull kexec updates from Mike Rapoport:

 - Deduplicate crash memory allocation and the exclusion of reserved
   crash kernel regions from architecture specific code into a generic
   crash_prepare_headers() and enable crashkernel CMA reservation on
   arm64 and riscv reservation on arm64 and riscv.

 - Skip purgatory checksum verification when the kexec segments cannot
   be corrupted by DMA, which saves about 250ms on kexec.

 - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in
   include/linux/kexec.h.

 - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key
   restore path, which over-dropped the user keyring reference when
   more than one key was restored.

* tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  crash_dump: release keyring reference at the correct time
  kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file
  kexec_file: skip checksum verification when safe
  riscv: kexec_file: Add support for crashkernel CMA reservation
  arm64: kexec_file: Add support for crashkernel CMA reservation
  powerpc/kexec_file: Use crash_exclude_core_ranges() helper
  LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code
  riscv: kexec_file: Use crash_prepare_headers() helper to simplify code
  x86/crash: Use crash_prepare_headers() helper to simplify code
  arm64: kexec_file: Use crash_prepare_headers() helper to simplify code
  crash: Add crash_prepare_headers() to exclude crash kernel memory
  powerpc/crash: sort crash memory ranges before preparing elfcorehdr
  riscv: kexec_file: Fix crashk_low_res not exclude bug
2026-08-18 10:28:28 -07:00
Linus Torvalds 38fda1d9d2 Merge tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock
Pull memblock updates from Mike Rapoport:
 "Non-urgent fixes:

   - Fix calculation of node_spanned_pages when running
     with 'kernelcore=mirror'

   - Properly handle failure to allocate per_cpu_nodestats
     in free_area_init_core_hotplug()

   - Fix deferred initialization of the memory map for
     configurations where node's RAM end is not aligned
     on PAGES_PER_SECTION

  Cleanups:

   - Remove redundant pageblock_align() call in free_unused_memmap()

   - Remove unnecessary invalid range checks in users of memblock
     iterators. Some users of for_each_mem_range() and
     for_each_mem_pfn_range() verify that start < end for each range.

     This is redundant because memblock iterators guarantee to never
     return an invalid range

   - Stop overlapping zones with 'kernelcore=mirror' and align behaviour
     of 'kernelcore=mirror' with other variants of kernelcore and
     movablecore

   - Remove redundant updates of numa_nodes_parsed mask in the callers
     of numa_add_memblk(), the latter always updates the mask anyway

   - Remove unnecessary initialization of pgdat->per_cpu_nodestats to
     NULL, the variable is reset to the actual value a few lines below"

* tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: (25 commits)
  mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn
  mm/mm_init: remove unnecessary initialization of pgdat->per_cpu_nodestats
  mm/mm_init: remove redundant memset in free_area_init()
  mm: numa_memblks: use numa_add_reserved_memblk() in numa_cleanup_meminfo()
  arch_numa: remove redundant node_possible_map assignment
  mm: numa_memblks: remove redundant numa_nodemask_from_meminfo()
  LoongArch: remove redundant numa_nodes_parsed node_set()
  arch_numa: remove redundant numa_nodes_parsed node_set()
  x86/numa: remove redundant numa_nodes_parsed node_set()
  of/numa: remove redundant numa_nodes_parsed node_set()
  ACPI: NUMA: remove redundant numa_nodes_parsed node_set()
  mm: numa_memblks: set numa_nodes_parsed in numa_add_memblk()
  mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug
  mm/mm_init: drop overlap_memmap_init()
  mm/mm_init: don't overlap NORMAL and MOVABLE zones with kernelcore=mirror
  mm/hugetlb: remove unnecessary empty range check in hugetlb_bootmem_set_nodes()
  mm: remove unnecessary empty range check in early_calculate_totalpages()
  powerpc64/kasan: Remove unreachable invalid range check in kasan_init_phys_region()
  ARM: remove unreachable invalid range check in kasan_init()
  riscv: remove unreachable invalid range check in kasan_init()
  ...
2026-08-18 10:03:54 -07:00
Linus Torvalds 0d508f1745 Merge tag 'acpi-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support updates from Rafael Wysocki:
 "The most significant change here is the elimination of struct
  acpi_driver that has no more users in the tree now along with some
  documentation related to it, and a follow-up update to set the "no PM"
  flag for all ACPI devices that are now only going to play the role of
  other devices' "companions" (in analogy with DT nodes).

  There is also a significant update of irqchip code related to ACPI
  done in order to enable GICv5 IWB ACPI probe ordering detection on
  ARM, which involves RISC-V interrupt controller management code
  refactoring to extract generic code from it into the common ACPI IRQ
  code.

  The rest is mostly fixes, including some fallout of the _OSC handling
  rework in 7.0, ACPI CPPC library fixes, a workaround for registering
  ACPI platform devices with overlapping I/O or memory resources, an
  ACPI EC driver fix related to probe deferral on platforms using
  HW-reduced ACPI, two ACPI battery driver fixes and a workaround for
  handling model numbers with unprintable characters in it, probe error
  cleanup and driver unload code path fixes, hardware error reporting
  fixes, documentation fixes, and assorted code cleanups all over.

  Specifics:

   - Eliminate struct acpi_driver whose users have all been converted to
     bind to platform devices or auxiliary devices and set the "no power
     management" flag for all struct acpi_device objects (Rafael
     Wysocki)

   - Avoid complaints regarding missing _OSC features on platforms where
     OSC_CAPABILITIES_MASK_ERROR is set in _OSC error bits even though
     all of the requested features are actually acknowledged (Rafael
     Wysocki)

   - Avoid printing confusing _OSC messages for non-PCIe host bridges
     without _OSC which is a valid configuration (Kazuma Kondo)

   - Use correct region struct for BERT region size check and properly
     map BERT and CCEL data to their ACPI tables (Thomas Renninger)

   - Add acpi_device_clear_deps(), refactor RISC-V interrupt controller
     management code to extract generic code from it into the common
     ACPI IRQ code, and enable GICv5 IWB ACPI probe ordering detection
     on ARM on top of that (Lorenzo Pieralisi)

   - Stop using acpi_device_name() in the PNP core, stop setting
     acpi_device_name/class() in the Xen variant of the ACPI PAD
     (Processor Aggregator Device) driver, and make the Loongarch laptop
     driver stop setting acpi_device_class() (Rafael Wysocki)

   - Fix issues related to the desired_perf register access in the ACPI
     CPPC library and update it to avoid unnecessary overhead (Christian
     Loehle)

   - Simplify acpi_get_pci_dev() with the help of a mutex guard,
     introduce acpi_dev_get_pci_dev() for code that has a struct ACPI
     device for which it wants to get the struct pci_dev pointer of the
     associated PCI device, and use it in the ACPI video bus driver
     (Rafael Wysocki)

   - Avoid registering platform devices with resource overlaps in the
     ACPI core device enumeration code (Rafael Wysocki)

   - Clean up the list of included header files in the NHLT table parser
     and validate the table and record lengths in the FPDT parser (Andy
     Shevchenko and Pengpeng Hou)

   - Unregister the cpufreq notifier on init failure in the ACPI
     processor driver (Can Peng)

   - Validate MADT IOAPIC entry bounds during IOAPIC hotplug lookup in
     the ACPI processor driver (Pengpeng Hou)

   - Avoid _REG disconnect on probe deferrals related to GPIO IRQ in the
     ACPI EC driver (Zhu Ling)

   - Update kerneldoc comments of two structures in the ACPI bus type
     code to use correct struct member names to avoid warnings (Randy
     Dunlap)

   - Use a correct function parameter name in kernel-doc in the ACPI fan
     driver (Randy Dunlap)

   - Update ACPI fan IDs to follow modern style and clean up header file
     inclusions in the ACPI fan driver (Andy Shevchenko)

   - Use devm_acpi_install_notify_handler() to replace a custom
     open-coded devres-based management of an ACPI notify handler in the
     ACPI fan driver (Rafael Wysocki)

   - Adjust charging status validation check in the ACPI battery driver
     to avoid incorrect status reporting (Rafael Wysocki)

   - Merge consecutive battery notifications in the ACPI battery driver
     to reduce the pressure on STA, _BST and _BIX/_BIF ACPI control
     methods and make that driver use kstrtoul() instead of
     sscanf("%lu\n") (Rong Zhang)

   - Sanitise model_number in the ACPI battery driver by dropping
     unprintable characters (Kate Hsuan)

   - Remove a node_set() call that is redundant from
     acpi_parse_memory_affinity() (Sang-Heon Jeon)

   - Prevent kernel-doc warnings by converting 2 function description
     comments to kernel-doc format (Randy Dunlap)

   - Fix docs build error in the ACPI admin-guide documentation (Randy
     Dunlap)

   - Replace __get_free_page() with kmalloc() in the code handling ACPI
     NVS memory during system suspend/resume (Mike Rapoport)

   - Fix card device cleanup on registration failure in the core PNP
     code (Yuho Choi)

   - Drop an unused assignment of pnp_device_id driver data (Uwe
     Kleine-König)

   - Clear driver_data on all paths that free acpi_pci_root in
     acpi_pci_root_add() (Chen Pei)

   - Add locking around evaluation of ACPI control methods in the ACPI
     TAD driver to avoid race conditions (Rafael Wysocki)

   - Handle repeated SEA error storms in APEI (Junhao He)

   - Fix ERST timeout unit conversion in APEI (Nirmoy Das)

   - Fix ARM section length accounting after header in the ACPI APEI
     GHES driver (TanZheng)

   - Mark ghes_in_nmi_spool_from_list() as maybe unused (Rui Qi)

   - Introduce helper function acpi_dev_is_video_device() and use it in
     the core ACPI device enumeration code, in the ACPI video bus
     driver, in the ACPI support code for I2C, in the PCI VGA driver,
     and in the x86 platform thinkpad_acpi driver (Andy Shevchenko)

   - Add a quirk to use the native backlight on Acer Nitro AN515-46 to
     the ACPI video bus driver (Marcos Paulo Medeiros)

   - Release PCI device reference after lookup in
     video_detect_portege_r100() in the ACPI video bus driver (Yuho
     Choi)"

* tag 'acpi-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (61 commits)
  ACPI: scan: Avoid registering platform devices with resource overlaps
  ACPI: APEI: Handle repeated SEA error storms
  ACPI: APEI: Fix ERST timeout unit conversion
  ACPI: APEI: GHES: fix ARM section length accounting after header
  ACPI: video: Release PCI device reference after lookup
  ACPI: PCI: Avoid misleading _OSC messages for non-PCIe host bridges without _OSC
  ACPI: TAD: Add locking around AML evaluations
  ACPI: video: force native backlight on Acer Nitro AN515-46
  ACPI: CPPC: Evaluate performance-control PCC use once
  ACPI: CPPC: Avoid locking standalone full-width registers
  ACPI: CPPC: Avoid unnecessary reads for full-width writes
  ACPI: CPPC: Stop reading desired_perf in cppc_get_perf()
  ACPI: CPPC: Skip desired_perf read in cppc_get_perf()
  ACPI: CPPC: Reject desired_perf reads on _CPC revision 4+
  ACPI: processor: Unregister cpufreq notifier on init failure
  ACPI: bus: Avoid confusing complaints regarding missing _OSC features
  ACPI: battery: Adjust charging status validation check
  ACPI: pmtmr: Convert to kernel-doc format
  ACPI: bus: Use correct struct member names
  ACPI: fan: Use correct function parameter name in kernel-doc
  ...
2026-08-18 08:29:30 -07:00
Paolo Bonzini 4136288688 Merge tag 'loongarch-kvm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson into HEAD
LoongArch KVM changes for v7.3

1. Advertise already-supported capabilities.
2. Some bug fixes about timer and MMIO.
3. Some hardening about interrupt injection.
4. Replace kvm_err() with kvm_pr_unimpl().
5. Add FPU/LSX/LASX test cases for selftests.
2026-08-18 13:11:45 +02:00
Pu Lehui f2aaa62159 riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args
On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc
args. However, the RV64 JIT currently does not perform sign-extension for
such kfunc args.

Before commit 7ce090afbf ("bpf: Infer zext_dst based on static register
liveness analysis"), state pruning could potentially omit zero-extension
of 32-bit subregisters, which inadvertently masked the above issue by making
the args appear as if they had been properly sign-extended. After that
commit, the problem is exposed, causing the kfunc_call/kfunc_call_test4
selftest to fail.

Fix this by extending the existing sign-extension logic to handle signed
1-byte and 2-byte kfunc args as well.

Fixes: 443574b033 ("riscv, bpf: Fix kfunc parameters incompatibility between bpf and riscv abi")
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20260814064726.3607615-1-pulehui@huaweicloud.com
2026-08-14 18:31:58 +02:00
Andy Chiu b5060a4aa3 RISC-V: KVM: fix vcpu vector context handling for kernel-mode vector
Running vector workloads like perf + mcf on KVM can result in an
unexpected termination due to a vtype corruption. This happens because
the kernel-mode vector (KMV) misattributes the guest's vcpu context as
the user's context and source from a wrong status.VS.

The simplified call chain that results in this problem is shown as
follow:

__riscv_sys_ioctl()
    kvm_arch_vcpu_ioctl_run()
      kvm_riscv_vcpu_exit()
        kvm_riscv_vcpu_sbi_ecall()
          kvm_riscv_vcpu_pmu_ctr_stop()
            kvm_vcpu_write_guest()
              __copy_to_user()
                enter_vector_usercopy()
                  kernel_vector_begin()

kernel_vector_begin() should use the sstatus.VS from guest's vcpu
context instead of task_pt_reg(current). Also, it should not save
guest's v-reg into the user's context memory.

To resolve this, the vcpu context must be correctly saved when KMV is
serving a guest. However, invoking KVM functions directly from generic
RISC-V architecture code introduces a reverse dependency, breaking
builds when KVM is configured as N or M.

Address this by registering an RCU-protected callback for context
flushing. KVM registers this callback at module initialization and
unregisters it on exit. When KMV starts a kernel context, it can now
safely flush the vector context via the callback.

Fixes: ecd2ada8a5 ("riscv: Add support for kernel mode vector")
Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260803215250.824417-4-tchiu@tenstorrent.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13 13:20:02 +05:30
Andy Chiu 848a973c5f riscv: vector: allow non-preemptible kernel-mode vector with IRQs off
Similar to commit 7137a203b2 ("arm64/fpsimd: Permit kernel mode NEON
with IRQs off"), we are upgrading get/put_cpu_vector_context such that
kvm_arch_vcpu_load/put can be safely called under both irq off and
regular process context.

Also, export both symbols so the kvm module can call into it.

Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260803215250.824417-3-tchiu@tenstorrent.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13 13:20:02 +05:30
Andy Chiu 8f798d6d7f riscv: vector: refactor riscv_v_start_kernel_context
Refactor riscv_v_start_kernel_context() to drop `is_nested` variable and
simplify the logic.

This introduces no functional change and works as a preparatory patch for
the kernel-mode vector fix.

Signed-off-by: Andy Chiu <tchiu@tenstorrent.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260803215250.824417-2-tchiu@tenstorrent.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-13 13:20:02 +05:30
Daniel Borkmann 1519f488e8 bpf, riscv: Clear fetch destination on faulting arena atomic
A RMW atomic on an arena pointer is converted to BPF_PROBE_ATOMIC and
gets an exception table entry, but that entry records no destination
register to clear unless the instruction is a load-acquire today. That
is right for a plain BPF_{ADD,AND,OR,XOR}, which only writes memory,
but an RMW carrying BPF_FETCH also reads the old value into a register:
src_reg for BPF_{ADD,AND,OR,XOR} | BPF_FETCH and BPF_XCHG, and r0 for
BPF_CMPXCHG. emit_atomic_rmw() emits it that way, e.g.:

  [...]
  case BPF_XCHG:
          ctx->ex_insn_off = ctx->ninsns;
          emit(is64 ? rv_amoswap_d(rs, rs, rd, 1, 1) :
               rv_amoswap_w(rs, rs, rd, 1, 1), ctx);
  [...]

Thus, a fault over an unmapped arena page ex_handler_bpf() jumps over
the access but leaves rs untouched, and the program resumes with
whatever it held before the atomic instead of the 0 that every other
BPF_PROBE_* access delivers. Fill the exception table entry in from
bpf_atomic_load_reg(), which returns the BPF register an atomic reads
the memory operand into or -1 when it has none. A load-acquire ends up
with the same register it gets today, it just goes through the helper.
Unlike x86-64 and arm64, riscv64 does not report arena violations from
its exception handler, so there is no access direction to correct here,
only the missing register clear.

Fixes: fb7cefabae ("riscv, bpf: Add support arena atomics for RV64")
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Pu Lehui <pulehui@huawei.com>
Link: https://patch.msgid.link/20260811131600.506721-2-daniel@iogearbox.net
Signed-off-by: Eduard Zingerman <eddyz87@gmail.com>
2026-08-12 10:33:53 -07:00
Yong-Xuan Wang df81f80c35 KVM: RISC-V: Add CPU PM notifier for non-retention idle states
Register a CPU_PM notifier to restore hypervisor CSR content during CPU
non-retention idle states. When a CPU enters a deep idle state that
powers off the CPU domain, hypervisor CSRs and VS CSRs lose their state
and must be saved before entry and restored after exit.

This completes KVM's power management coverage for RISC-V:
- CPU hotplug: handled by kvm_online_cpu/kvm_offline_cpu (cpuhp callbacks)
- System suspend: handled by kvm_suspend/kvm_resume (syscore ops)
- CPU idle (retention): no action needed, CSRs are retained
- CPU idle (non-retention): handled by this CPU_PM notifier

Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260810-kvm-cpu-pm-v5-1-6c9e4c95caf5@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-12 22:07:07 +05:30
Arnd Bergmann 545ecc3577 Merge tag 'riscv-sophgo-dt-for-v7.3' of https://github.com/sophgo/linux into soc/dt
RISC-V Devicetrees for v7.3

Sophgo:

The changes of this PR are all for CV18xx serials.
There are three major changes. The first is to allow
DMA multiplexer setting channel number for DMA controller;
the second is to add initial RISC-V support for "Duo S"
board, which uses SG2000, a dual-arch SoC (RISC-V and
ARM64); the third is to add support for "Duo 256M"
board, another dev-board based on SG2002 SoC.

Signed-off-by: Chen Wang <chen.wang@linux.dev>

* tag 'riscv-sophgo-dt-for-v7.3' of https://github.com/sophgo/linux:
  riscv: dts: sophgo: Add Milk-V Duo 256M board support
  riscv: dts: sophgo: cv180x: Add PWR_GPIO controller
  dt-bindings: soc: sophgo: add Milk-V Duo 256M board
  riscv64: dts: sophgo: add initial Milk-V Duo S board support
  riscv64: dts: sophgo: add SG2000 dtsi
  riscv: dts: sophgo: cv180x: Allow the DMA multiplexer to set channel number for DMA controller

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10 17:21:50 +02:00
Arnd Bergmann 1f5d8228ca Revert "riscv: dts: spacemit: k3: add i2s0-i2s5 nodes"
This reverts commit cd01c67786, which
caused a build failure:

Lexical error: ../arch/riscv/boot/dts/spacemit/k3.dtsi:1181.20-39 Unexpected 'CLK_MPMU_I2S_SYSCLK'

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-08-10 17:20:09 +02:00
Alexandre Belloni b981359d9e Merge tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/dt
arm64: tegra: Device tree changes for v7.3-rc1

This contains a new device tree for the Lenove ThinkEdge SE70 Edge
Client device as well as a number of fixes and cleanups for Tegra234 and
Tegra194. Tegra264 sees a number of additions to enable more features.

* tag 'tegra-for-7.3-arm64-dt' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: (1469 commits)
  arm64: tegra: Correct Tegra234 p3740 interrupt flags
  arm64: tegra: Correct Tegra234 p3737 interrupt flags
  arm64: tegra: Correct Tegra194 p2972 interrupt flags
  arm64: tegra: Drop CPU masks from GICv3 PPI interrupts
  arm64: tegra: Add Lenovo ThinkEdge SE70 device tree
  arm64: tegra: Add pinctrl nodes for Tegra264
  arm64: tegra: Fix CMDQV interrupt type on Tegra264
  arm64: tegra: Properly sort devices on Tegra264
  arm64: tegra: Add GTE nodes for Tegra264
  arm64: tegra: Add Host1x and VIC on Tegra264
  arm64: tegra: Populate CPU and L2 cache nodes on Tegra264
  arm64: tegra: Enable GPCDMA in Tegra264 and add iommu-map
  Linux 7.2-rc5
  super: fix emergency thaw deadlock on frozen block devices
  tracing: perf: Fix stale head for perf syscall tracing
  ftrace: Add global mutex to serialize trace_parser access
  tracing: Delay module ref count for "enable_event" trigger
  tracing: Fix use-after-free freeing trigger private data
  bpf, sockmap: Fix cork use-after-free in tcp_bpf_sendmsg()
  tracing: Fix context switch counter truncation
  ...

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-09 03:46:57 +02:00
Michael Neuling 5d588c6848 riscv: lib: Fix ZBB strnlen reading past count boundary
The ZBB-optimized strnlen loop loads one word ahead before checking the
aligned boundary:

    REG_L   t1, SZREG(t0)       // load next word
    addi    t0, t0, SZREG       // advance
    orc.b   t1, t1
    bgeu    t0, t4, 4f          // boundary check AFTER load

where t4 = (s + count) & -SZREG.  When s is aligned and count is a
multiple of SZREG, t4 equals s + count and the loop loads a full word
starting at exactly s + count.  If s + count falls on a page boundary
with the next page unmapped, this faults.

Fix by computing the aligned boundary from the last valid byte
(s + count - 1) instead of s + count.  This makes the loop stop at the
word containing the last valid byte rather than potentially loading the
word after it.  The count == 0 case is already handled by the beqz
early exit.

Also add a pre-loop guard (bgeu t0, t4) for the case where all valid
bytes fit within the first word.  With the adjusted boundary, t4 can
equal t0, and entering the loop with stale register state from the
first-word processing would produce incorrect results.

The final minu clamp ensures the result is still correct when the last
loaded word extends past s + count - 1 within the same aligned word.

Fixes: 5ba15d419f ("riscv: lib: add strnlen() implementation")
Signed-off-by: Michael Neuling <mikey@neuling.org>
Assisted-by: Claude Opus4.6 High Thinking
Link: https://patch.msgid.link/20260413010738.1622423-1-mikey@neuling.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-08 11:45:33 -06:00
Alexandre Belloni ff1d40db21 Merge tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux into soc/dt
Allwinner device tree changes for 7.3

Some changes for old chips/devices and some for recent ones.

- A10 PMU interrupt number fixed
- A100/A133 gained LRADC
- enabled overlay support for sun8i-h2-plus pi boards
- A523 family gained consumer IR receiver
- H728-based X96QPRO+ gained SPDIF audio output
- PinePhone's mpu6050 mount orientation fixed
- style fixes

New board added:
- Baijie Helper A133
- NetCube Systems OpenNMC (dobermann)

* tag 'sunxi-dt-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sunxi/linux:
  arm64: dts: allwinner: Correct white-space style
  ARM: dts: allwinner: Correct white-space style
  arm64: dts: allwinner: a523: Enable SPDIF on X96QPRO+
  arm64: dts: allwinner: a523: Add SPDIF output PH pin mux option
  arm64: dts: allwinner: sun50i-a64-pinephone: Fix mpu6050 mount matrix
  arm64: dts: allwinner: a523: enable IR on the Avaota A1
  arm64: dts: allwinner: a523: enable IR receiver on the X96Q Pro+
  arm64: dts: allwinner: a523: add IR receiver nodes
  media: dt-bindings: allwinner,sun4i-a10-ir: add A523 compatible
  ARM: dts: allwinner: a10: Fix PMU interrupt
  ARM: dts: allwinner: enable overlay support for sun8i-h2-plus pi boards
  ARM: dts: allwinner: add support for NetCube Systems OpenNMC (dobermann)
  riscv: dts: allwinner: d1s-t113: Add uart4 pinctrl required by NetCube Systems OpenNMC
  dt-bindings: arm: sunxi: Add NetCube Systems OpenNMC (dobermann)
  ARM: dts: allwinner: sun8i-h3: Correct indentation
  arm64: dts: allwinner: A133: add support for Baijie Helper A133 board
  arm64: dts: allwinner: a100: Add LRADC node
  dt-bindings: input: sun4i-lradc-keys: Add A100/A133 compatible
  dt-bindings: arm: sunxi: Add Baijie HelperBoard A133 compatible
  dt-bindings: vendor-prefixes: Add Shenzhen Baijie Technology Co., Ltd.

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08 19:00:43 +02:00
Alexandre Belloni 0b02b8f941 Merge tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux into soc/dt
RISC-V SpacemiT DT changes for 7.3

For K3 SoC
- Enable SD card support
- Enable QSPI
- Fix reset delay of ETH PHY
- Fix PHY ID of ETH
- Symbolic PDAM ID
- Add SPI controller support
- Add USB and PHY support
- Add I2S nodes

For K1 SoC
- Symbolic PDAM ID
- Enable cpufreq support
- Fix max CPU core voltage

For boards of K3
- Pico-ITX
  - Enable ALDPS on RTL8211F PHY
  - Disable 125MHz clock on RTL8211F PHY
  - Enable NOR flash
  - Add EEPROM support
- CoM260
  - Add EEPROM support

For boards of K1
- Milk-V Jupiter
  - Enable CPU DVFS
- Banana Pi BPI-CM6
  - Add initial support
- OrangePi R2S
  - Enable PCIe

* tag 'spacemit-dt-for-7.3-1' of https://git.kernel.org/pub/scm/linux/kernel/git/spacemit/linux: (33 commits)
  riscv: dts: spacemit: Add cpu scaling for Milk-V Jupiter
  riscv: dts: spacemit: k1-bananapi-cm6: fix maximum CPU core voltage
  riscv: dts: spacemit: k1-orangepi-r2s: fix maximum CPU core voltage
  riscv: dts: spacemit: k1-musepi-pro: fix maximum CPU core voltage
  riscv: dts: spacemit: k1-orangepi-rv2: fix maximum CPU core voltage
  riscv: dts: spacemit: k1-milkv-jupiter: fix maximum CPU core voltage
  riscv: dts: spacemit: k1-bananapi-f3: fix maximum CPU core voltage
  riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 com260 board
  riscv: dts: spacemit: Make dtschema recognize the etherent PHY correctly on K3 pico-itx board
  riscv: dts: spacemit: k3: add i2s0-i2s5 nodes
  riscv: dts: spacemit: k3: add USB controller and USB phy support
  riscv: dts: spacemit: enable PCIe on OrangePi R2S
  riscv: dts: spacemit: k3-com260-ifx: add eeprom on i2c1
  riscv: dts: spacemit: k3-com260: add eeprom on i2c2
  riscv: dts: spacemit: add SPI controllers for K3
  riscv: dts: spacemit: add K3 PDMA request numbers
  riscv: dts: spacemit: Fix phy id check for the phy on com260 board
  riscv: dts: spacemit: Fix phy id check for the phy on pico-itx board
  riscv: dts: spacemit: Add enough deassert time for the PHY on com260 board
  riscv: dts: spacemit: Add enough deassert time for the PHY on PICO ITX
  ...

Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-08-08 18:51:39 +02:00
Yong-Xuan Wang dfdf1374fd KVM: RISC-V: Clear former VCPU cache on virtualization disable
When a CPU is taken offline or enters deep idle states, hypervisor CSR
state is lost. The kvm_former_vcpu fast-path optimization caches the
last VCPU that ran on each CPU to avoid expensive CSR restoration when
the same VCPU is re-scheduled on the same CPU. However, if this cache
is not cleared when CSR state is lost, the next VCPU entry will
incorrectly skip CSR restoration, leading to corrupt hypervisor state.

Add kvm_riscv_clear_former_vcpu() to invalidate the per-CPU cache and
call it from kvm_arch_disable_virtualization_cpu() to ensure proper CSR
restoration after CPU offline or system suspend events.

Fixes: 1323a5cfe5 ("KVM: riscv: Skip CSR restore if VCPU is reloaded on the same core")
Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com>
Reviewed-by: Nutty Liu <nutty.liu@hotmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260721-kvm-cpu-pm-v4-1-146bf942547d@sifive.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-08 19:18:11 +05:30
Guidong Han 735bc20c24 RISC-V: KVM: Fix PMU event info array size overflow
SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo)
in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010
truncate to 16. KVM then allocates one entry but loops over the original
num_events, causing out-of-bounds reads and writes. A nested guest
triggered:

BUG: KASAN: slab-out-of-bounds in kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
Read of size 4 at addr ff600000074d46b0 by task init/1
Call Trace:
[<ffffffff8006471c>] kvm_riscv_vcpu_pmu_event_info+0xa4/0x142
[<ffffffff800690c0>] kvm_sbi_ext_pmu_handler+0xca/0x268
[<ffffffff8006779e>] kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
[<ffffffff8006008c>] kvm_riscv_vcpu_exit+0x48c/0x540
[<ffffffff8005ea0a>] kvm_arch_vcpu_ioctl_run+0x37e/0xc80
Allocated by task 1:
 __kmalloc_noprof+0x19e/0x4b0
 kvm_riscv_vcpu_pmu_event_info+0x72/0x142
 kvm_sbi_ext_pmu_handler+0xca/0x268
 kvm_riscv_vcpu_sbi_ecall+0xec/0x1e6
 kvm_riscv_vcpu_exit+0x48c/0x540
 kvm_arch_vcpu_ioctl_run+0x37e/0xc80
The buggy address is located 0 bytes to the right of
 allocated 16-byte region [ff600000074d46a0, ff600000074d46b0)

Store the shared-memory size in size_t and reject multiplication overflow.
Allocate the guest-driven array with GFP_KERNEL_ACCOUNT so it is charged
to kmemcg, and use __GFP_NOWARN to suppress allocation failure warnings.
Use kvcalloc() to allow vmalloc fallback and an unsigned long loop index
to match num_events.

Reported-by: Naveed Khan <naveed@digiscrypt.com>
Closes: https://lore.kernel.org/kvm/178345245327.72065.13249716450708539854@digiscrypt.com/
Fixes: e309fd113b ("RISC-V: KVM: Implement get event info function")
Cc: stable@vger.kernel.org
Signed-off-by: Guidong Han <2045gemini@gmail.com>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260730092533.1369531-1-2045gemini@gmail.com
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-08 19:04:08 +05:30
Pengpeng Hou f06b670cfd RISC-V: KVM: Avoid one-word masks for SBI v0.1 all-harts
KVM already treats a NULL hart-mask pointer in SBI v0.1 calls as all
harts, matching OpenSBI's legacy handling. The current handler builds that
target set as (1UL << online_vcpus) - 1 before iterating the mask.

That expression shifts by the type width once the VM has BITS_PER_LONG
online vCPUs, and a single word cannot represent larger VMs. A count-based
mask also selects the wrong IDs when vCPU IDs are sparse.

Handle SEND_IPI with a NULL hart-mask by iterating all online vCPUs
directly. For remote fence calls, use the existing hbase == -1UL
convention so the common fence request helper targets the whole VM
without consulting hmask.

Non-NULL guest hart masks keep the existing v0.1 behavior.

Fixes: a046c2d857 ("RISC-V: KVM: Reorganize SBI code by moving SBI v0.1 to its own file")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260718040000.010.826fe94e-caplitmus-rv@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-08 11:40:39 +05:30
Pengpeng Hou 4a94f45ef7 RISC-V: KVM: Guard HFENCE range loops against overflow
The local HFENCE range helpers build the loop end with addr + size and
then step through the range by the requested page order. If addr + size
wraps, a small range near the top of the address space can be treated as
empty and skip the intended fence. The final loop step can also wrap
before the loop condition is evaluated again.

Treat wrapped ranges conservatively as full-range HFENCE requests and stop
each bounded loop before the next step can wrap past the computed end. This
keeps the existing large-range fallback and only changes local GVMA/VVMA
range construction.

Fixes: 2415e46e3a ("RISC-V: KVM: Introduce range based local HFENCE functions")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Reviewed-by: Anup Patel <anup@brainfault.org>
Link: https://lore.kernel.org/r/20260718040000.008.17bfd3bd-caplitmus-rv@iscas.ac.cn
Signed-off-by: Anup Patel <anup@brainfault.org>
2026-08-08 11:29:41 +05:30
Jesse Taube 8da45c93df RISC-V: hwprobe: Use BIT macro to avoid warnings
In uapi/asm/hwprobe.h file, (1 << N) is used to define the bit field
which causes checkpatch to warn. Use _BITUL(N) and _BITULL(N) to avoid
these warnings.

Signed-off-by: Jesse Taube <jtaubepe@redhat.com>
Link: https://patch.msgid.link/20260805153346.1036988-1-jtaubepe@redhat.com
[pjw@kernel.org: updated to apply and to cover new extensions]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:34 -06:00
Thomas Weißschuh 42cd1e1fc8 riscv: alternative: Also patch the compat vDSO
The vDSO for compat processes can also contain alternative entries.

Patch those, too.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-3-a32fd89b7b1c@linutronix.de
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:34 -06:00
Thomas Weißschuh 63aecaba41 riscv: alternative: Use the statically extracted vDSO section offsets
Currently the alternative sections are extracted from the vDSO
binaries at runtime. This has runtime overhead and also doesn't
work for the compat vDSO.

Use the offsets generated during the build instead, fixing both issues.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-2-a32fd89b7b1c@linutronix.de
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:33 -06:00
Thomas Weißschuh 7f2a7bbcd9 riscv: vdso: Add symbols for the alternative section boundaries
Currently the alternative sections are extracted from the vDSO
binaries at runtime. This has runtime overhead and also doesn't
work for the compat vDSO.

Extract the offsets of the alternative section during the build with the
existing symbol extraction machinery.

Also add dummy symbols as fallback.

Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Reviewed-by: Nam Cao <namcao@linutronix.de>
Link: https://patch.msgid.link/20260630-riscv-vdso32-alternative-v1-1-a32fd89b7b1c@linutronix.de
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:33 -06:00
Andrew Jones f61959a3a8 riscv: Add Ziccamoa, Ziccif, Ziccrse, and Za64rs to cpufeature and hwprobe
Add Ziccamoa, Ziccif, and Za64rs to riscv_isa_ext[] so they can be
parsed from devicetree/ACPI ISA strings. Ziccrse is already present
in cpufeature; this patch only adds its hwprobe exposure.

Expose all four extensions via hwprobe through new bits in
RISCV_HWPROBE_KEY_IMA_EXT_1 (RISCV_HWPROBE_EXT_ZICCAMOA, _ZICCIF,
_ZICCRSE, _ZA64RS), so userspace can probe each of these
RVA23U64-mandatory extensions individually.

Reviewed-by: Jesse Taube <jtaubepe@redhat.com>
Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Guodong Xu <docular.xu@gmail.com>
Link: https://patch.msgid.link/20260701-rva23u64-hwprobe-v2-v5-6-2c61f94a695a@gmail.com
[pjw@kernel.org: updated to apply]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:33 -06:00
Jesse Taube 3cd63bc30c riscv: Add Zicclsm to cpufeature and hwprobe
Zicclsm requires misaligned support for all regular load and store
instructions, both scalar and vector, but not AMOs or other
specialized forms of memory access, to main memory regions with both
the cacheability and coherence PMAs, as defined in the profiles spec.
Even though mandated, misaligned loads and stores might execute
extremely slowly. Standard software distributions should assume their
existence only for correctness, not for performance.

Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Andy Chiu <andy.chiu@sifive.com>
Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Tested-by: Charlie Jenkins <charlie@rivosinc.com>
Signed-off-by: Jesse Taube <jesse@rivosinc.com>
[andrew.jones: Rebased, rewrote doc text, minor commit message revisions]
Signed-off-by: Andrew Jones <andrew.jones@oss.qualcomm.com>
Signed-off-by: Guodong Xu <docular.xu@gmail.com>
Link: https://patch.msgid.link/20260701-rva23u64-hwprobe-v2-v5-5-2c61f94a695a@gmail.com
[pjw@kernel.org: updated to apply; added Andrew's username to his tag comments]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:33 -06:00
Guodong Xu fdef048705 riscv: cpufeature: Clarify ISA spec version for canonical order
Specify that chapter 27 refers to version 20191213 of the RISC-V ISA
Unprivileged Architecture. The chapter numbering differs across
specification versions - for example, in version 20250508, the ISA
Extension Naming Conventions is chapter 36, not chapter 27.

Historical versions of the RISC-V specification can be found via Link [1].

Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://riscv.org/specifications/ratified/ [1]
Fixes: 99e2266f24 ("RISC-V: clarify ISA string ordering rules in cpu.c")
Signed-off-by: Guodong Xu <guodong@riscstar.com>
Link: https://patch.msgid.link/20260125-supm-ext-id-v2-3-1e3b9714c860@riscstar.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-08-07 19:24:33 -06:00