Commit graph

245,994 commits

Author SHA1 Message Date
Linus Torvalds
c75597caad s390:
* Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
   unrelated capabilities
 
 * Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
   memory corruption in some scenarios
 
 * A bunch of misc gmap fixes (locking, behaviour under memory pressure)
 
 * Fix CMMA dirty tracking
 
 x86:
 
 * Tidy up some WARN_ON() and BUG_ON(), replacing them with WARN_ON_ONCE()
   or KVM_BUG_ON().  All of these have obviously never triggered, or
   somebody would have been annoyed earlier, but still.
 
 * Fix missing interrupt due to stale CR8 intercept
 
 * Add a statistic that can come in handy to debug leaks as well as the
   vulnerability to a class of recently-discovered issues.
 
 * Do not ask arch/x86/kernel to export default_cpu_present_to_apicid()
   just for KVM.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmo7xaAUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroN7bwf/Ua6PrRrgdzfUGiIruBDnFGtXnaKf
 UPGpgl35Kl4ntPlmH6wRG6N0jP9sloa17Qj/Y33O1Um3Mi/eDV0UESW8o8tfFE2J
 CWUPc3/adw2urhnkXsoleSFy21a89TgLd0p4tot832p+IHi3iNJ45fx7XxftBeGt
 fa/liscncEX5tGwie0ZVkIEE/ob3+eX4ZYsTLXMi6FxAlyGPYNrp4jwJeYH9AFSd
 ZYGqVbDjDq14vhnppKXM8DMfHTXN4OVYw2RJZ9Y7u2h7ku3sN0XakzVTAUz5gtoM
 h+iu8dn5yslODBZiNGlls8UYm2bweOBCumH1ZITe/eTNuEdUOJGILorKRw==
 =QzfV
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "s390:

   - Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
     unrelated capabilities

   - Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
     memory corruption in some scenarios

   - A bunch of misc gmap fixes (locking, behaviour under memory
     pressure)

   - Fix CMMA dirty tracking

  x86:

   - Tidy up some WARN_ON() and BUG_ON(), replacing them with
     WARN_ON_ONCE() or KVM_BUG_ON(). All of these have obviously never
     triggered, or somebody would have been annoyed earlier, but still...

   - Fix missing interrupt due to stale CR8 intercept

   - Add a statistic that can come in handy to debug leaks as well as
     the vulnerability to a class of recently-discovered issues

   - Do not ask arch/x86/kernel to export
     default_cpu_present_to_apicid() just for KVM"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  x86/apic: KVM: Use cpu_physical_id() to get APIC ID of running vCPU for AVIC
  KVM: x86/mmu: Expose number of shadow MMU shadow pages as a stat
  KVM: x86: Unconditionally recompute CR8 intercept on PPR update
  KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
  KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails
  KVM: x86: WARN and fail kvm_set_irq() if a PIC or I/O APIC vector is invalid
  KVM: x86: Bug the VM, not the kernel, if the ISR count {under,over}flows
  KVM: x86/mmu: Bug the VM, not the host kernel, if KVM write-protects upper SPTEs
  KVM: x86: Replace BUG_ON() with WARN_ON_ONCE() on "bad" nested GPA translation
  KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
  KVM: s390: Return failure in case of failure in kvm_s390_set_cmma_bits()
  KVM: s390: selftests: Fix cmma selftest
  KVM: s390: Fix cmma dirty tracking
  KVM: s390: Fix locking in kvm_s390_set_mem_control()
  KVM: s390: Fix handle_{sske,pfmf} under memory pressure
  KVM: s390: Fix code typo in gmap_protect_asce_top_level()
  KVM: s390: Do not set special large pages dirty
  KVM: s390: Fix dat_peek_cmma() overflow
  s390/mm: Fix handling of _PAGE_UNUSED pte bit
  KVM: s390: Fix typo in UCONTROL documentation
  ...
2026-06-25 10:21:13 -07:00
Linus Torvalds
962528fef9 gpio fixes for v7.2-rc1
- fix locking context with shared GPIOs in gpio-tegra
 - fix IRQ domain leak in error path in gpio-davinci
 - fix returning a potentially uninitialized integer in
   gpiochip_set_multiple()
 - use raw spinlock in gpio-eic-sprd and gpio-sch to address locking
   context issues
 - bail out of probe() if registering the GPIO chip fails in gpio-mlxbf3
 - fix varible type for storing the "ngpios" property in gpio-pisosr
 - fix out-of-bounds pin access in GPIO ACPI
 - make GPIO ACPI core only trigger interrupts on boot that are marked as
   ActiveBoth
 - fix kerneldoc in gpio-tb10x
 - reference the real software node of the cs5535 GPIO controller in
   Geode board file
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEkeUTLeW1Rh17omX8BZ0uy/82hMMFAmo86vUACgkQBZ0uy/82
 hMNNWRAAmZmRGrQtGsl50IOsZBgdONYapPftkk36rAJ7JKfxIAnO1ebcU+GjHve5
 0F1D12Oz8mhrPnpGXm9im5msrwzVJtO6BGiQUqz8YvoajTDEqzCcOkDPNMbkseob
 3L/XEzsz6MWtc4JvEyx6sFLCsIr2z/uzitX8nq+9KGkeC1PCEQ7zROLuoTxGcMQe
 33nftgrJ2Ch+NP7QYDayI7imB+y7j01jQgfNuhsdwcqPam9CAJYX/hBkke8WyaIm
 c84u9fXEto+u3CIgK3zxLDkzodSDWw+8zPtwEYV7QgyAZyp7rXEEkbOJLxQCMiGK
 puJUDLCt+3jCAp6GjORewrPysReR27zn0KGaL70OKObKvIJ4tDEHnPI/GdTsUEOh
 n9/bZkF8eXOfT3RQV5ezdQgLrt0+/J3lM44nVkx3bno2OXumXXIW7+8frvhFy9TB
 C5Pn638XUPAPdlHiZlazLbJzQnchNPqH3wu0Hfcwrid+43byrb/lidtT6e6cmezl
 l+AdqV3ppZcVJlW6ORLvIk1UT7JNsE7+DHL8/8XWLsLZrtjG8aotVMBpxAqgsl1s
 adbJ3q96C4P27Zz93D7qyR/zopqRBa2BA+F3j8PDQOzuSO0Ps3y3kyIJH9OCEnLY
 ztyyuMH3tXFkkq9zStbe66VlMpEMMW8YZyHx6jIyc7/gVYnK4dk=
 =53+g
 -----END PGP SIGNATURE-----

Merge tag 'gpio-fixes-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux

Pull gpio fixes from Bartosz Golaszewski:

 - fix locking context with shared GPIOs in gpio-tegra

 - fix IRQ domain leak in error path in gpio-davinci

 - fix returning a potentially uninitialized integer in
   gpiochip_set_multiple()

 - use raw spinlock in gpio-eic-sprd and gpio-sch to address locking
   context issues

 - bail out of probe() if registering the GPIO chip fails in gpio-mlxbf3

 - fix varible type for storing the "ngpios" property in gpio-pisosr

 - fix out-of-bounds pin access in GPIO ACPI

 - make GPIO ACPI core only trigger interrupts on boot that are marked
   as ActiveBoth

 - fix kerneldoc in gpio-tb10x

 - reference the real software node of the cs5535 GPIO controller in
   Geode board file

* tag 'gpio-fixes-for-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:
  gpio: davinci: fix IRQ domain leak on devm_kzalloc failure
  gpio: tegra: do not call pinctrl for GPIO direction
  gpio: tb10x: fix struct tb10x_gpio kernel-doc
  gpiolib: initialize return value in gpiochip_set_multiple()
  x86/platform/geode: reference the real node of the cs5535 GPIO controller
  gpio: eic-sprd: use raw_spinlock_t in the irq startup path
  gpio: sch: use raw_spinlock_t in the irq startup path
  gpiolib: acpi: Prevent out-of-bounds pin access in OperationRegion handler
  gpiolib: acpi: Add robust bounds-checking for GPIO pin resources
  gpio: mlxbf3: fail probe if gpiochip registration fails
  gpio: pisosr: Read "ngpios" as u32
  gpiolib: acpi: Only trigger ActiveBoth interrupts on boot
2026-06-25 09:33:23 -07:00
Linus Torvalds
26ae421f7f pci-v7.2-changes
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEEgMe7l+5h9hnxdsnuWYigwDrT+vwFAmo7CrQUHGJoZWxnYWFz
 QGdvb2dsZS5jb20ACgkQWYigwDrT+vxsvw/7B4rHdVs1/LERE4H0bBKKNz7mr6g/
 6JOBDYc9ERgZpDgAwBKm+uuFzg8KLK0lf5PU7p2zNxjMVia+c4AMTHw/icN91yfL
 NZLP013GQmZ6s1r290AMnVtUqd1hNm2R+r4nzXTm85y9B25tZIiJj3gssIXPKDTE
 74rrRiNVO9+zj8JTED6kbSoAq40iv94Ux9VnumHy6kF1izsFAht7eJmkICgeOLRX
 okBq86Tqivwv85XpqOQZTHudBwvS91HHsAdClW9UcXyRQo3RJAcba2tkglfZ2Ozo
 RbfqxxKNuW/3TTziOflfzm/oImZuMQdlvu98udMQ+LacOmLN+SWPdyVFly9X87i+
 ZGH4bKxtqcba8EYFZ+VRrG3JNuOWwcfmAPC93WhuwhywJ6evRg9Wufffss6GLUmH
 g9id/KbMI0RRkYnne7w9nmmCwLge0/3klhf5dwyZZ/q9IyKPUqjyagdbjFA4Esp5
 wLK1H9645pXtZtj5h8qMlZQ+rrDt/IYWqsCo15pB1Z4y3Lpb+JaYsHOS+Ye/3PDA
 0MDeCoTvK4scZGtM6l10jn3fdGVy6EL+3thteQz/+FHzmMEXp53TnrQTBhKtdGc0
 RfPLZEMuFCjbr+6u6bSu3thD1eH4TgQHIWY1Fl4FdczXzc6+A6blBY4BSZAqX8kU
 xjNfpptAieR4BtM=
 =h+xD
 -----END PGP SIGNATURE-----

Merge tag 'pci-v7.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci

Pull pci updates from Bjorn Helgaas:
 "Enumeration:

   - Remove MPS/MRRS Kconfig settings (CONFIG_PCIE_BUS_*) that worked
     around a WiFi device defect; use a quirk or boot-time
     "pci=pcie_bus_tune_*" kernel parameter instead (Bjorn Helgaas)

   - Always lift 2.5GT/s restriction in PCIe failed link retraining to
     avoid clamping a link to 2.5GT/s after hot-plug changes the device
     (Maciej W. Rozycki)

   - Request bus reassignment when not probe-only to fix an enumeration
     regression on Marvell CN106XX and possibly other DT-based systems
     (Ratheesh Kannoth)

   - Fix procfs race between pci_proc_init() and pci_bus_add_device()
     that resulted in 'proc_dir_entry ... already registered' warnings
     and pointer corruption (Krzysztof Wilczyński)

   - Fix sysfs race that causes 'duplicate filename' warnings and boot
     panics by converting PCI resource files to static attributes
     (Krzysztof Wilczyński)

   - Expose sysfs 'resourceN_resize' attributes only on platforms with
     PCI mmap (Krzysztof Wilczyński)

   - Require CAP_SYS_ADMIN to write to sysfs 'resourceN_resize'
     attributes (Krzysztof Wilczyński)

   - Add security_locked_down(LOCKDOWN_PCI_ACCESS) to alpha PCI resource
     mmap path to match the generic path (Krzysztof Wilczyński)

   - Use kstrtobool() to parse the 'rom' attribute input to avoid the
     unexpected behavior of enabling the ROM when writing '0' with no
     trailing newline (Krzysztof Wilczyński)

  Resource management:

   - Improve resource claim logging for debuggability (Ilpo Järvinen)

   - Clean up several uses of const parameters (Ilpo Järvinen)

   - Check option ROM header signatures and lengths before accessing to
     avoid page faults and alignment faults (Guixin Liu)

  ASPM:

   - Don't reconfigure ASPM when entering low-power D-state; only do it
     when returning back to D0 (Carlos Bilbao)

  Power management:

   - During suspend, set power state to 'unknown' for all devices, not
     just those with drivers (Lukas Wunner)

   - Skip restoring Resizable BARs and VF Resizable BARs if device
     doesn't respond to config reads, to avoid invalid array accesses
     (Marco Nenciarini)

   - Add pci_suspend_retains_context() so drivers can tell whether
     devices retain internal state across suspend/resume, since some
     platforms reset devices on suspend; use this in nvme to avoid
     issues on Qcom RCs (Manivannan Sadhasivam)

  Power control:

   - Only to power on/off devices that actually support power control to
     avoid poking at incompatible devices mentioned in DT (Manivannan
     Sadhasivam)

  Virtualization and resets:

   - Log device readiness timeouts as errors, not warnings, because the
     device is likely unusable in this case (Bjorn Helgaas)

   - Wait for device readiness after soft reset (D3hot ->
     D0uninitialized transition), when the device may respond with
     Request Retry Status (RRS) if it needs more time to initialize
     (Bjorn Helgaas)

   - Drop unnecessary retries when restoring BARs because resets should
     now already include all required delays (Lukas Wunner)

   - Avoid FLR for MediaTek MT7925 WiFi, where FLR fails after a VM
     terminates uncleanly (Jose Ignacio Tornos Martinez)

   - Avoid SBR for Qualcomm WCN6855/WCN7850 WiFi, SDX62/SDX65 modems,
     which seem not to support it correctly (Jose Ignacio Tornos
     Martinez)

  Peer-to-peer DMA:

   - Prevent P2PDMA as well as CPU access to non-mappable BARs, e.g.,
     s390 ISM BARs (Matt Evans)

   - Add Intel QAT, DSA, IAA devices to whitelist (Lukas Wunner)

  Endpoint framework:

   - Add endpoint controller APIs for use by function drivers to
     discover auxiliary blocks like DMA engines (Koichiro Den)

   - Remember DesignWare eDMA engine base/size and expose them via the
     EPC aux-resource API (Koichiro Den)

   - Add endpoint embedded doorbell fallback, used if MSI allocation
     fails (Koichiro Den)

   - Validate BAR index and remove dead BAR read in endpoint doorbell
     test (Carlos Bilbao)

   - Unwind MSI/MSI-X vectors if NTB initialization fails part-way
     through (Koichiro Den)

   - Cache sleepable pci_irq_vector() value at ISR setup to avoid
     calling it from hardirq context (Koichiro Den)

   - Call sleepable pci_epc_raise_irq() from a work item instead of
     atomic context, e.g., when setting bits in NTB peer doorbells in
     the ntb_peer_db_set() path (Koichiro Den)

   - Report 0-based vNTB doorbell vector to account for link event 0 and
     historically skipped slot 1 (Koichiro Den)

   - Prevent configfs writes to vNTB db_count and other values that are
     already in use after EPC attach (Koichiro Den)

   - Account for vNTB db_valid reserved slots (link event 0 and
     historically skipped slot 1) so they don't appear as valid
     doorbells (Koichiro Den)

   - Implement vNTB .db_vector_count()/mask() for doorbells so clients
     can use multiple vectors and avoid thundering herds (Koichiro Den)

   - Report 0-based NTB doorbell vector to account for link event 0 and
     historically skipped slot 1 (Koichiro Den)

   - Fix doorbell bitmask and IRQ vector handling to clear only
     specified bits, use the correct vector for non-contiguous Linux IRQ
     numbers, and validate incoming vectors (Koichiro Den)

   - Implement NTB .db_vector_count()/mask() for doorbells so clients
     can use multiple vectors (Koichiro Den)

  Native PCIe controller infrastructure:

   - Add pci_host_common_link_train_delay() for the mandatory delay
     after > 5GT/s Link training completes and use it for cadence HPA,
     j721e, LGA; dwc; aardvark, mediatek-gen3, rzg3s (Hans Zhang)

   - Protect root bus removal with rescan lock in altera, brcmstb,
     cadence, dwc, iproc, mediatek, plda, rockchip to prevent
     use-after-free or crashes when racing with sysfs rescan or hotplug
     (Hans Zhang)

   - Add pci_host_common_parse_ports() for use by any native driver to
     parse Root Port properties (per-Link features like width, speed,
     PHY, power and reset control, etc should be described in Root Port
     stanzas, not the host bridge; currently only reset GPIOs
     implemented) (Sherry Sun)

  New native PCIe controller drivers:

   - Add DT binding and driver for UltraRISC DP1000 PCIe controller
     (Xincheng Zhang, Jia Wang)

  Altera PCIe controller driver:

   - Do not dispose of the parent IRQ mapping, which belongs to the
     parent interrupt controller (Mahesh Vaidya)

   - Fix chained IRQ handler ordering issue and resource leaks on probe
     failure (Mahesh Vaidya)

  AMD MDB PCIe controller driver:

   - Assert PERST# on shutdown so any connected Endpoints are held in
     reset during shutdown (Sai Krishna Musham)

  Amlogic Meson PCIe controller driver:

   - Propagate devm_add_action_or_reset() failure to fix probe error
     path (Shuvam Pandey)

   - Add .remove() callback to deinitialize the host bridge and power
     off the PHY (Shuvam Pandey)

  Broadcom iProc PCIe controller driver:

   - Restore .map_irq() assignment; its removal broke INTx on the iproc
     platform bus driver (Mark Tomlinson)

  Broadcom STB PCIe controller driver:

   - No change, but products using certain WiFi devices may be affected
     by removal of CONFIG_PCIE_BUS_* (see above)

  Freescale i.MX6 PCIe controller driver:

   - Move IMX6SX_GPR12_PCIE_TEST_POWERDOWN handling into the core reset
     functions (Richard Zhu)

   - Assert PERST# before enabling regulators to ensure that even if
     power is enabled, endpoint stays inactive until REFCLK is stable
     (Sherry Sun)

   - Parse reset properties in Root Port nodes (falling back to host
     bridge) to help support Key E connectors and the pwrctrl framework
     (Sherry Sun)

   - Configure i.MX95 REF_USE_PAD before PHY reset (Richard Zhu)

   - Assert i.MX95 ref_clk_en after reference clock stabilizes (Richard
     Zhu)

   - Integrate new pwrctrl API for DTs with Root Port-level power
     supplies (Sherry Sun)

  Intel Gateway PCIe controller driver:

   - Enable clock before PHY init for correct ordering (Florian Eckert)

   - Add .start_link() callback so the driver works again (Florian
     Eckert)

   - Stop overwriting the ATU base address discovered by
     dw_pcie_get_resources() (Florian Eckert)

   - Add DT 'atu' region since this is hardware-specific, and fall back
     to driver default if lacking (Florian Eckert)

  Loongson PCIe controller driver:

   - Ignore downstream devices only on internal bridges to avoid
     Loongson hardware issue (Rong Zhang)

   - Quirk old Loongson-3C6000 bridges that advertise incorrect
     supported link speeds (Ziyao Li)

  Marvell MVEBU PCIe controller driver:

   - Use fixed-width interrupt masks to avoid truncation in 64-bit
     builds (Rosen Penev)

  MediaTek PCIe controller driver:

   - Use FIELD_PREP() to fix incorrect operator precedence in
     PCIE_FTS_NUM_L0 (Li RongQing)

   - Fix IRQ domain leak when port fails to enable (Manivannan
     Sadhasivam)

   - Use actual physical address for MSI message address instead of
     virt_to_phys() (Manivannan Sadhasivam)

   - Add EcoNet EN7528 to DT binding (Caleb James DeLisle)

  MediaTek PCIe Gen3 controller driver:

   - Deassert PCIE_PHY_RSTB so REFCLK is stable for at least 100ms
     (PCIE_T_PVPERL_MS) before deasserting PERST# (Jian Yang)

   - Add .shutdown() to assert PERST# before powering down device (Jian
     Yang)

   - Do full device power down on removal, including asserting PERST#,
     when removing driver (Chen-Yu Tsai)

   - Fix a 'failed to create pwrctrl devices' error message that was
     inadvertently skipped (Chen-Yu Tsai)

  NVIDIA Tegra194 PCIe controller driver:

   - Program the DesignWare PORT_AFR L1 entrance latency based on the
     'aspm-l1-entry-delay-ns' DT property (Manikanta Maddireddy)

  Qualcomm PCIe controller driver:

   - Add Eliza SoC compatible in DT binding (Krishna Chaitanya Chundru)

   - Set max OPP during resume so DBI register accesses don't fail with
     NoC errors (Qiang Yu)

   - Add pci_host_common_d3cold_possible() to determine whether
     downstream devices are already in D3hot and wakeup-enabled devices
     are capable of generating PME from D3cold (Krishna Chaitanya
     Chundru)

   - Add .get_ltssm() callback to get the LTSSM status without DBI,
     since DBI may be inaccessible after PME_Turn_Off (Krishna Chaitanya
     Chundru)

   - Power down PHY via PARF_PHY_CTRL before disabling rails/clocks to
     avoid power leakage (Krishna Chaitanya Chundru)

   - Decide whether suspend should put the link in L2 and power down
     using pci_host_common_d3cold_possible() instead of checking whether
     ASPM L1 is enabled (Krishna Chaitanya Chundru)

   - Add qcom D3cold support to tear down interconnect bandwidth and OPP
     votes (Krishna Chaitanya Chundru)

   - Handle unsupported mixed PERST#/PHY DT configurations, e.g., PHY in
     RP node while PERST# is in the RC node, but warn about the DT issue
     (Qiang Yu)

   - Program T_POWER_ON based on DT 't-power-on-us' property in case
     hardware advertises incorrect values (Krishna Chaitanya Chundru)

   - Disable ASPM L0s for SA8775P (Shawn Guo)

   - Initialize DWC MSI lock for firmware-managed ECAM hosts, which
     don't use the dw_pcie_host_init() path that initializes the lock
     (Yadu M G)

  Renesas RZ/G3S PCIe controller driver:

   - Add RZ/V2N DT support (Lad Prabhakar)

  SOPHGO PCIe controller driver:

   - Add 'dma-coherent' DT property for sg2042-pcie driver (Han Gao)

  Synopsys DesignWare PCIe controller driver:

   - Apply ECRC TLP Digest workaround for all DesignWare cores prior to
     5.10a, not just 4.90a and 5.00a (Manikanta Maddireddy)

   - Use common struct dw_pcie 'mode' rather than duplicating it in
     artpec6, dra7xx, dwc-pcie, and keembay driver structs (Hans Zhang)

   - Use DEFINE_SHOW_ATTRIBUTE for ltssm_status debugfs to reduce
     boilerplate and fix a seq_file memory leak by including a
     .release() callback (Hans Zhang)

   - Fix a signedness bug in fault injection test code (Dan Carpenter)

   - Avoid NULL pointer dereference when tearing down debugfs for
     controller that lacks RAS DES capability (Shuvam Pandey)

  MicroSemi Switchtec management driver:

   - Add Gen6 Device IDs (Ben Reed)

  Miscellaneous:

   - Remove unused gpio.h include from amd-mdb, designware-plat, fu740,
     visconti drivers (Andy Shevchenko)

   - Fix typos in documentation (josh ziegler)

   - Use FIELD_MODIFY() instead of open-coding it (Hans Zhang)"

* tag 'pci-v7.2-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/pci/pci: (168 commits)
  PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
  PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap
  PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init()
  PCI/sysfs: Convert legacy I/O and memory attributes to static definitions
  PCI/sysfs: Add __weak pci_legacy_has_sparse() helper
  alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()
  PCI: Add macros for legacy I/O and memory address space sizes
  PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()
  alpha/PCI: Convert resource files to static attributes
  alpha/PCI: Add static PCI resource attribute macros
  alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits()
  alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
  alpha/PCI: Use PCI resource accessor macros
  alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer
  alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
  PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope
  PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files()
  PCI/sysfs: Warn about BAR resize failure in __resource_resize_store()
  PCI/sysfs: Convert PCI resource files to static attributes
  PCI/proc: Fix race between pci_proc_init() and pci_bus_add_device()
  ...
2026-06-24 12:48:43 -07:00
Linus Torvalds
0587402115 This includes the following changes related to sparc for v7.2:
- Align sparc to other archs by providing ucontext.h wrapper
 
 - Fix buffer underflow in led driver
 
 - Export mcount for clang and disable compat when using lld for linking
 
 - API choice improvement for sysfs code for vio
 
 - Fix build warnings and notification of missing prototype
 
 - Remove dead code and dead configs
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYIADIWIQQfqfbgobF48oKMeq81AykqDLayywUCajuFDhQcYW5kcmVhc0Bn
 YWlzbGVyLmNvbQAKCRA1AykqDLayy2QqAQDLwIeGHu6ZzVpAvmZlBn3Hl823/UoZ
 LnAn1UfSmXL3JQEAyeu/EN9/+8IVIDECWxYzSp+1OCLdla/v/cVrAvv7BQ4=
 =cUkR
 -----END PGP SIGNATURE-----

Merge tag 'sparc-for-7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc

Pull sparc updates from Andreas Larsson:

 - Align sparc to other archs by providing ucontext.h wrapper

 - Fix buffer underflow in led driver

 - Export mcount for clang and disable compat when using lld for linking

 - API choice improvement for sysfs code for vio

 - Fix build warnings and notification of missing prototype

 - Remove dead code and dead configs

* tag 'sparc-for-7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/alarsson/linux-sparc:
  sparc: Remove remaining defconfig references to the pktcdvd driver
  sparc: led: avoid trimming a newline from empty writes
  sparc: Export mcount for Clang-built modules
  sparc: Disable compat support with LLD
  sparc: Avoid -Wunused-but-set-parameter in clear_user_page()
  sparc: add _mcount() prototype
  sparc64: uprobes: add missing break
  sparc: remove unused SERIAL_CONSOLE config option
  sparc32: remove deadwood swift_flush_tlb_page() debug code
  sparc: uapi: Add ucontext.h
  sparc: vio: use sysfs_emit in sysfs show functions
2026-06-24 12:39:09 -07:00
Sean Christopherson
098e32cba3 x86/apic: KVM: Use cpu_physical_id() to get APIC ID of running vCPU for AVIC
Use cpu_physical_id() instead of default_cpu_present_to_apicid() when
getting the APIC ID of the pCPU on which a vCPU is running/loaded, as the
kernel has gone way off the rails if a vCPU is loaded on a pCPU that has
been physically removed from the system.  Even if the impossible were to
happen, the absolutely worst case scenario is that hardware will ring the
AIVC doorbell on the wrong pCPU, i.e. a severely broken system will
experience mild performance issues.

Kill off KVM's superfluous kvm_cpu_get_apicid() wrapper along with the
for-KVM export of default_cpu_present_to_apicid(), as they existed purely
for the wonky AVIC usage.

Cc: Kai Huang <kai.huang@intel.com>
Cc: Yosry Ahmed <yosry@kernel.org>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Acked-by: Naveen N Rao (AMD) <naveen@kernel.org>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Reviewed-by: Yosry Ahmed <yosry@kernel.org>
Message-ID: <20260612185459.591892-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 07:52:24 -04:00
Sean Christopherson
02953418a1 KVM: x86/mmu: Expose number of shadow MMU shadow pages as a stat
Turn arch.n_used_mmu_pages into a stat, mmu_shadow_pages, as the number of
live shadow pages is arguably _the_ most critical datapoint when it comes
to analyzing the shadow MMU.  Before the TDP MMU came along, i.e. when the
shadow MMU was the only MMU, explicitly tracking the number of shadow pages
wasn't as interesting, because the same information could more or less be
gleaned from the pages_{1g,2m,4k} stats.  But with the TDP MMU, where the
shadow MMU is only used for nested TDP, it becomes extremely difficult, if
not impossible, to determine which SPTEs are coming from the TDP MMU, and
which are coming from the shadow MMU.

E.g. when triaging/debugging shadow MMU performance issues due to "too many
shadow pages", being able to observe that 99%+ of all shadow pages are
unsync is critical to being able to deduce that KVM is effectively leaking
shadow pages.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260612133727.411902-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 07:52:23 -04:00
Paolo Bonzini
91b16b53a0 KVM: s390: Fix S390_USER_OPEREXEC and more gmap fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoWuZBM6M3lCBSfTnuARItAMU6BMFAmo7nlMACgkQuARItAMU
 6BPr+A//VLw9/5C2pgKVWRvJRVNcf8kIgAF1feONXJVoJiDGrbyiFcy4oCrppIZi
 OxAB2GvqV7Dbyu+tWH/iqPp3gxLf86sNh8JLkba8puWXP5SElyvVpEADYw8T97pX
 dL6j+9vYptMSTIVrhEYgiS5ghgCW6NymM2/6d+uWOCcPjuCaa2owO7K9fCsaLfAK
 O2D6HeRKEQdDszNKdplloSP5FjNn/t/zdPINclhfHdDNl7zSCF5Z3Y9cWGf+L2vL
 fYUiCPRPGANOreBcGMEBtDif667/U7nwiq7daC1rB+Q0MwRoq4h5jk0130aTTgXs
 hOA2EypipNO/ELO1hPJBNYTaSF1XjJMlrq5FHGkXXC+byWTsoKJgFXYkC9pQVd+r
 dcpu7S9nh9jkjSgc8F1+sNQ3+GHc9XrI214ALYgDr1PIZBevSlXaE3dtcU98+qtH
 IfKkonDEeRc8oZUTVLiINkQtZwtHqDKhqdhn5z508xJw5n+qr2oLEe/76NMjwH+E
 jteqA4WFaS2TGnOVf6IsYVdOQFMuOKrl+Se/M7fE1ZQ41IL4+aWT4gnpz3O+8sg9
 XmgiZJHXRtcH5nXfLbGryoO4HZPvwoV2mv0GmbmMVHBkve5qGqdElCRIQLAVImGc
 77/1DL73Kln7XawIik/MFDkCdt7GG3Qbqu1ALbKObCdJRSiFhzk=
 =OiBj
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-next-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

* Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
  unrelated capabilities

* Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
  memory corruption in some scenarios

* A bunch of misc gmap fixes (locking, behaviour under memory pressure)

* Fix CMMA dirty tracking
2026-06-24 13:41:41 +02:00
Carlos López
bb365a506b KVM: x86: Unconditionally recompute CR8 intercept on PPR update
The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits
when the guest's virtual TPR falls under the specified threshold,
allowing KVM to inject previously masked interrupts.

KVM handles these VM exits in handle_tpr_below_threshold().
Commit eb90f3417a ("KVM: vmx: speed up TPR below threshold vmexits")
optimized this function by calling apic_update_ppr() instead of raising
KVM_REQ_EVENT. apic_update_ppr() then raises KVM_REQ_EVENT if there is
a pending, deliverable interrupt.

However, if there are no new interrupts pending, apic_update_ppr() does
not issue the request. Thus, kvm_lapic_update_cr8_intercept() and
vmx_update_cr8_intercept() are not called before VM entry, which results
in a high, stale TPR_THRESHOLD. This is problematic due to the following
sentence in 28.2.1.1 "VM-Execution Control Fields" in the SDM:

  The following check is performed if the “use TPR shadow” VM-execution
  control is 1 and the “virtualize APIC accesses” and “virtual-interrupt
  delivery” VM-execution controls are both 0: the value of bits 3:0 of
  the TPR threshold VM-execution control field should not be greater
  than the value of bits 7:4 of VTPR.

This error condition is typically not observed when KVM runs on a bare
metal system because modern processors support APICv, which enables
virtual-interrupt delivery, and which KVM uses when possible. This
causes the processor to no longer generate TPR-below-threshold exits
and to no longer check TPR_THRESHOLD on entry. However, when running
on older platforms, or under nested virtualization on a hypervisor that
does not support virtual-interrupt delivery and enforces this check
(like Hyper-V) this can cause a VM entry failure with hardware error
0x7, as seen in [1].

Call kvm_lapic_update_cr8_intercept() if apic_update_ppr() does not
find a deliverable interrupt (and thus does not raise KVM_REQ_EVENT).
Remove calls to kvm_lapic_update_cr8_intercept() on paths that end up in
apic_update_ppr(), as they now become redundant. This ensures that any
path that updates the guest's PPR also figures out if KVM needs to wait
for a TPR change (using TPR_THRESHOLD on VMX or CR8 intercepts on SVM).

Link: https://github.com/coconut-svsm/svsm/issues/1081 [1]
Tested-by: Stefano Garzarella <sgarzare@redhat.com>
Cc: stable@vger.kernel.org
Fixes: eb90f3417a ("KVM: vmx: speed up TPR below threshold vmexits")
Signed-off-by: Carlos López <clopez@suse.de>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-3-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:55:14 +02:00
Sean Christopherson
7ef78d71ca KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
When updating CR8 intercepts, get vmcs12 if and only if the vCPU is in
guest mode so that a future change can have update CR8 intercepts during
vCPU creation, without running afoul of get_vmcs12()'s lockdep assertion.

  ------------[ cut here ]------------
  debug_locks && !(lock_is_held(&(&vcpu->mutex)->dep_map) || !refcount_read(&vcpu->kvm->users_count))
  WARNING: arch/x86/kvm/vmx/nested.h:61 at get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline], CPU#0: syz.2.19/5879
  WARNING: arch/x86/kvm/vmx/nested.h:61 at vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879, CPU#0: syz.2.19/5879
  Modules linked in:
  CPU: 0 UID: 0 PID: 5879 Comm: syz.2.19 Not tainted syzkaller #0 PREEMPT(full)
  Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
  RIP: 0010:get_vmcs12 arch/x86/kvm/vmx/nested.h:60 [inline]
  RIP: 0010:vmx_update_cr8_intercept+0x3de/0x4e0 arch/x86/kvm/vmx/vmx.c:6879
  Call Trace:
   <TASK>
   apic_update_ppr arch/x86/kvm/lapic.c:984 [inline]
   kvm_lapic_reset+0x1c24/0x2980 arch/x86/kvm/lapic.c:3023
   kvm_vcpu_reset+0x44c/0x1bf0 arch/x86/kvm/x86.c:12986
   kvm_arch_vcpu_create+0x746/0x8b0 arch/x86/kvm/x86.c:12847
   kvm_vm_ioctl_create_vcpu+0x428/0x930 virt/kvm/kvm_main.c:4201
   kvm_vm_ioctl+0x893/0xd50 virt/kvm/kvm_main.c:5159
   vfs_ioctl fs/ioctl.c:51 [inline]
   __do_sys_ioctl fs/ioctl.c:597 [inline]
   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
   do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>

No functional change intended.

Reported-by: syzbot ci <syzbot+ci493c6d734b63e050@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/all/6a2adf3b.3b0a2d4e.8c8d1.0012.GAE@google.com
Cc: stable@vger.kernel.org
Signed-off-by: Sean Christopherson <seanjc@google.com>
Message-ID: <20260618174347.1981064-2-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:55:13 +02:00
Sean Christopherson
cc3d0e1afd KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails
WARN once if KVM's tracking for pending EOIs for Real-Time Clock IRQs goes
off the rails, as there's no reason to bug the host or risk a DoS due to
spamming dmesg with endless WARNs.  Absolute worst case scenario, guest
time will go awry.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618174527.1982333-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:54:29 +02:00
Sean Christopherson
ea3c995921 KVM: x86: WARN and fail kvm_set_irq() if a PIC or I/O APIC vector is invalid
WARN and return an error up the stack if the PIC or I/O APIC encounters an
invalid vector when injecting an IRQ, as there is no danger to the host and
thus no justification for potentially panicking the kernel.  Don't bug the
VM either, as the risk of corrupting the guest is minuscule, and the guest
might even be completely tolerant of a lost interrupt.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185213.2019937-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:53:36 +02:00
Sean Christopherson
ac604b5611 KVM: x86: Bug the VM, not the kernel, if the ISR count {under,over}flows
Bug the VM, not the host kernel, if KVM's ISR count {under,over}flows when
tracking in-flight ISRs.  There is zero danger to the host if KVM messes up
its IRQ tracking.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185350.2020845-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:52:54 +02:00
Sean Christopherson
8e5d793fc7 KVM: x86/mmu: Bug the VM, not the host kernel, if KVM write-protects upper SPTEs
Instead of bugging the host kernel, WARN and terminate the VM if KVM
attempts to write-protect at a level that cannot use leaf SPTEs.
There is no reason to bring down the entire host; even termininating
the VM is likely overkill, but in theory a missed write could corrupt
guest memory, so play it safe.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185641.2022368-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:33:04 +02:00
Sean Christopherson
39e9c35e44 KVM: x86: Replace BUG_ON() with WARN_ON_ONCE() on "bad" nested GPA translation
If KVM attempts to translate what it thinks is an L2 GPA with a non-nested
MMU, simply WARN and return the GPA, i.e. trust the MMU more than the
caller, as there is zero reason to potentially panic the host kernel just
because KVM misused an API.

Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Kai Huang <kai.huang@intel.com>
Message-ID: <20260618185746.2023283-1-seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
2026-06-24 11:25:21 +02:00
Claudio Imbrenda
babe08404e KVM: s390: Return failure in case of failure in kvm_s390_set_cmma_bits()
If the allocation of the bits array failed, kvm_s390_set_cmma_bits()
would return 0 instead of an error code.

Rework the function to use the __free() macros and thus simplify the
code flow; when the above mentioned allocation fails, simply return
-ENOMEM.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-10-imbrenda@linux.ibm.com>
2026-06-24 10:08:57 +02:00
Claudio Imbrenda
6cfd47f91f KVM: s390: Fix cmma dirty tracking
It is possible that some guest memory areas have not been touched yet
when starting migration mode, and thus have no ptes allocated. Only
existing and allocated ptes should count toward the total of dirty cmma
entries.

When starting migration mode, enable the migration_mode flag
immediately, so that any subsequent ESSA will trap in the host and
cause cmma_dirty_pages to be increased as needed.
Subsequently, set the cmma_d bit on all existing cmma-clean PGSTEs,
increasing cmma_dirty_pages as needed. Skipping cmma-dirty pages
prevents double counting.

Conversely, when disabling migration mode, set cmma_dirty_pages to 0
and clear the cmma_d bit in all existing PGSTEs.

The invariant is that when migration mode is off, no PGSTE has its
cmma_d bit set, and cmma_dirty_pages is 0. kvm->slots_lock protects
kvm_s390_vm_start_migration() and kvm_s390_vm_stop_migration() from
each other and from kvm_s390_get_cmma_bits().

Also fix dat_get_cmma() to properly wrap around if the first attempt
reached the end of guest memory without finding cmma-dirty pages.

[ imbrenda: Moved kvm_s390_sync_request_broadcast() before gmap_set_cmma_all_dirty() ]

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-8-imbrenda@linux.ibm.com>
2026-06-24 10:08:57 +02:00
Claudio Imbrenda
9b0bf9b93c KVM: s390: Fix locking in kvm_s390_set_mem_control()
Add the missing locking around dat_reset_cmma().

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-7-imbrenda@linux.ibm.com>
2026-06-24 10:08:57 +02:00
Claudio Imbrenda
2bd74dce08 KVM: s390: Fix handle_{sske,pfmf} under memory pressure
Under heavy memory pressure, handle_sske() and handle_pfmf() might
cause an endless loop if the mmu cache runs empty, the atomic
allocations fail, and the top-up function also fails. While quite
unlikely, that scenario is not impossible.

Fix the issue by not ignoring the return value of
kvm_s390_mmu_cache_topup(), and appropriately returning an error code
in case of failure.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-6-imbrenda@linux.ibm.com>
2026-06-24 10:08:57 +02:00
Claudio Imbrenda
6e976afdfe KVM: s390: Fix code typo in gmap_protect_asce_top_level()
The correct length to pass to kvm_s390_get_guest_pages() is asce.tl + 1,
not asce.dt + 1. It was a typo, which, due to fortuitous circumstances,
did not cause bugs. It should nonetheless be fixed.

Fixes: e5f98a6899 ("KVM: s390: Add some helper functions needed for vSIE")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-5-imbrenda@linux.ibm.com>
2026-06-24 10:08:56 +02:00
Claudio Imbrenda
e6c9b322c8 KVM: s390: Do not set special large pages dirty
Special pages / folios should not be set dirty. This also applies to
large pages.

Add a missing check in gmap_clear_young_crste() to prevent setting the
large page dirty if it is a special page.

Fixes: a2c17f9270 ("KVM: s390: New gmap code")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-4-imbrenda@linux.ibm.com>
2026-06-24 10:08:56 +02:00
Claudio Imbrenda
7a386efcb2 KVM: s390: Fix dat_peek_cmma() overflow
If userspace passes a start address that is out of bounds,
_dat_walk_gfn_range() will fail with -EFAULT, but state.end will not be
touched and will stay 0. This will cause *count to underflow and report
a very high number, and the function will end up erroneously reporting
success.

Fix by only setting *count if the end address is not smaller than the
starting address. This way invalid starting addresses will correctly
return -EFAULT and *count will correctly indicate that no values have
been returned.

Fixes: 7b368470e1 ("KVM: s390: KVM page table management functions: CMMA")
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-3-imbrenda@linux.ibm.com>
2026-06-24 10:08:56 +02:00
Claudio Imbrenda
d4bb00704a s390/mm: Fix handling of _PAGE_UNUSED pte bit
The _PAGE_UNUSED softbit should not really be lying around. Its sole
purpose is to signal to try_to_unmap_one() and try_to_migrate_one()
that the page can be discarded instead of being moved / swapped.

KVM has no way to know why a page is being unmapped, so it sets the bit
on userspace ptes corresponding to unused guest pages every time they
get unmapped. KVM has no reasonable way to clear the bit once the page
is in use again.

While set_ptes() checks and clears the bit, other paths that set new
ptes did not. This led to used pages being thrown out as if they were
unused, causing guest corruption.

Fix the issue by clearing the _PAGE_UNUSED bit for present ptes in
set_pte(), i.e. whenever a present pte is getting set. The check in
set_ptes() is then redundant and can be removed.

Also fix gmap_helper_try_set_pte_unused() to only set the bit if the
pte is present; the _PAGE_UNUSED bit is only defined for present ptes
and thus should not be set for non-present ptes.

Fixes: c98175b791 ("KVM: s390: Add gmap_helper_set_unused()")
Acked-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-2-imbrenda@linux.ibm.com>
2026-06-24 10:08:56 +02:00
Eric Farman
02d61d3370 KVM: s390: Fix S390_USER_OPEREXEC enablement without STFLE 74
The KVM_CAP_S390_USER_OPEREXEC capability allows operation exceptions
to be forwarded to userspace. But the actual enablement at the hardware
level occurs in kvm_arch_vcpu_postcreate(), and only if STFLE.74 or
user_instr0 are enabled. The latter is associated with a separate
capability (KVM_CAP_S390_USER_INSTR0), so the only way this happens
for the USER_OPEREXEC capability is if STFLE.74 is enabled. KVM
unconditionally enables this bit in kvm_arch_init_vm(), but the guest
could disable it from the CPU model and thus ignore this capability.

Add USER_OPEREXEC to the check in kvm_arch_vcpu_postcreate(), such that
either capability would enable this type of exception.

Fixes: 8e8678e740 ("KVM: s390: Add capability that forwards operation exceptions")
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
[Fixed patch title, as recommended by frankja@linux.ibm.com]
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260507200836.3500368-2-farman@linux.ibm.com>
2026-06-24 10:01:56 +02:00
Linus Torvalds
bade58eb06 - Prevent NULL dereference on theoretical missing IO bitmap
(Li RongQing)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmo6wFMRHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hOmBAAsFd4cotcp2OQt0Cn6ZNMt1WwoJc5Qplw
 RCMEuTzWmf5zIjCOYXNHNd4lDKKTvMQr3BKOX7oG8noZgnYXxdMlhvN4j9y0Pc0h
 UXIXamzGRzI+2I4kSLL2iee3/utj1Srs19g5ONtaHkJEiH37mw00BIJVgE51TT5t
 6KDMbdHZ2ZmtDjtD7BEdecVrhpKLVejFHIpljPJ8GGVPC6QmrF91d+Lv7r2B0IjR
 3WlDHHXbRvDNbd6r0wvlIbxOUEwUtYMCDIErvohfN2ZU/HVNKivJ42L4dgG8yx5q
 q8ZLbmI15Qa2vEcMesr8liXqT992INMvn+TjCJ0huY3qoyRvf285Xla3DKaA50rL
 1btj9c0i4O6GfKN568nwx+K5YGWb2EH1s79vs3VmG6L6pmnX8CGawMRBDIXY2+qQ
 kFfWsiFCid3TDTwoA1bkOpakNM77d4BAAvYg7yGxlN2wYWiddN8slx77iunDhw+s
 xCi7rQ5Kb35SfWAg3DiKHd5wqptvpK/EkgwCVfzkLf6VFxqFPdaiP4bDn23daUP7
 XhUo3symJ8KLh1bLlR1DLgyzRp5t5yW3/Rocs7RS1h1bTvd96vF04PEQncH5c6Lw
 bB8AXKnB3am1AmBfWbQ3kg/AQJV1tlgCkCozjr990uSVgwRAy1XigioPn/y/eNPW
 pBqWCO4B7aA=
 =mOJb
 -----END PGP SIGNATURE-----

Merge tag 'x86-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull x86 fix from Ingo Molnar:

 - Prevent NULL dereference on theoretical missing IO bitmap (Li
   RongQing)

* tag 'x86-urgent-2026-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/ioperm: Prevent NULL dereference on theoretical missing IO bitmap
2026-06-23 17:16:31 -07:00
Bjorn Helgaas
8b3a73b4fe Merge branch 'pci/sysfs'
- Require CAP_SYS_ADMIN to write to sysfs 'resourceN_resize' attributes
  (Krzysztof Wilczyński)

- Convert PCI resource files to static attributes to avoid races that cause
  'duplicate filename' warnings and boot panics (Krzysztof Wilczyński)

- Remove pci_create_sysfs_dev_files() and pci_remove_sysfs_dev_files(),
  which are obsolete after converting to static attributes (Krzysztof
  Wilczyński)

- Add security_locked_down(LOCKDOWN_PCI_ACCESS) to alpha PCI resource mmap
  path to match the generic path (Krzysztof Wilczyński)

- Convert sysfs 'legacy_io' and 'legacy_mem' to static attributes
  (Krzysztof Wilczyński)

- Remove pci_create_legacy_files() and pci_sysfs_init(), which are obsolete
  after converting to static attributes (Krzysztof Wilczyński)

- Expose sysfs 'resourceN_resize' attributes only on platforms with PCI
  mmap (Krzysztof Wilczyński)

- Use kstrtobool() to parse the 'rom' attribute input to avoid the
  unexpected behavior of enabling the ROM when writing '0' with no trailing
  newline (Krzysztof Wilczyński)

* pci/sysfs:
  PCI/sysfs: Use kstrtobool() to parse the ROM attribute input
  PCI/sysfs: Limit BAR resize attribute scope to platforms with PCI mmap
  PCI/sysfs: Remove pci_create_legacy_files() and pci_sysfs_init()
  PCI/sysfs: Convert legacy I/O and memory attributes to static definitions
  PCI/sysfs: Add __weak pci_legacy_has_sparse() helper
  alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()
  PCI: Add macros for legacy I/O and memory address space sizes
  PCI/sysfs: Remove pci_{create,remove}_sysfs_dev_files()
  alpha/PCI: Convert resource files to static attributes
  alpha/PCI: Add static PCI resource attribute macros
  alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits()
  alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
  alpha/PCI: Use PCI resource accessor macros
  alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer
  alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
  PCI/sysfs: Limit pci_sysfs_init() late_initcall compile scope
  PCI/sysfs: Add stubs for pci_{create,remove}_sysfs_dev_files()
  PCI/sysfs: Warn about BAR resize failure in __resource_resize_store()
  PCI/sysfs: Convert PCI resource files to static attributes
  PCI/sysfs: Add static PCI resource attribute macros
  PCI/sysfs: Add CAP_SYS_ADMIN check to __resource_resize_store()
  PCI/sysfs: Split pci_llseek_resource() for device and legacy attributes
  PCI/sysfs: Only allow supported resource types in I/O and MMIO helpers
  PCI: Add pci_resource_is_io() and pci_resource_is_mem() helpers
  PCI/sysfs: Use PCI resource accessor macros
2026-06-23 17:32:03 -05:00
Krzysztof Wilczyński
4e14b965a6 PCI/sysfs: Convert legacy I/O and memory attributes to static definitions
Currently, legacy_io and legacy_mem are dynamically allocated and created
by pci_create_legacy_files(), with pci_adjust_legacy_attr() updating the
attributes at runtime on Alpha to rename them and shift the size for sparse
addressing.

Convert to four static const attributes (legacy_io, legacy_io_sparse,
legacy_mem, legacy_mem_sparse) with .is_bin_visible() callbacks that use
pci_legacy_has_sparse() to select the appropriate variant per bus.  The
sizes are compile-time constants and .size is set directly on each
attribute.

Register the groups in pcibus_groups[] under a HAVE_PCI_LEGACY guard so the
driver model handles creation and removal automatically.

Stub out pci_create_legacy_files() and pci_remove_legacy_files() as the
dynamic creation is no longer needed.  Remove the __weak
pci_adjust_legacy_attr(), Alpha's override, and its declaration from both
Alpha and PowerPC asm/pci.h headers.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Link: https://patch.msgid.link/20260508043543.217179-23-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
574b5470f8 PCI/sysfs: Add __weak pci_legacy_has_sparse() helper
Currently, Alpha's sparse/dense legacy attribute handling is done via
pci_adjust_legacy_attr(), which updates dynamically allocated attributes at
runtime.  The upcoming conversion to static attributes needs a way to
determine sparse support at visibility check time.

Add a __weak pci_legacy_has_sparse() that returns false by default.  Alpha
overrides it to check has_sparse() on the bus host controller.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Link: https://patch.msgid.link/20260508043543.217179-22-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
385ec1d407 alpha/PCI: Compute legacy size in pci_mmap_legacy_page_range()
Currently, pci_mmap_legacy_page_range() reads the legacy resource size from
bus->legacy_mem->size or bus->legacy_io->size.  This couples the mmap
bounds check to the struct pci_bus fields that will be removed when legacy
attributes are converted to static definitions.

Compute the size directly using PCI_LEGACY_MEM_SIZE (0x100000) and
PCI_LEGACY_IO_SIZE (0xffff) macros, and shift by 5 bits for sparse systems.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-21-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
b7a57ffd4d alpha/PCI: Convert resource files to static attributes
Previously, Alpha's PCI resource files (resourceN, resourceN_sparse,
resourceN_dense) were dynamically created by pci_create_resource_files(),
which overrides the generic __weak implementation.  The previous code
allocated bin_attributes at runtime and managed them via the res_attr[] and
res_attr_wc[] fields in struct pci_dev.

Convert to static const attributes with three attribute groups (plain,
sparse, dense), each with an .is_bin_visible() callback that checks
resource length, has_sparse(), and sparse_mem_mmap_fits().  A .bin_size()
callback provides the resource size to the kernfs node, with the sparse
variant shifting by 5 bits for byte-level addressing.

Register the groups via ARCH_PCI_DEV_GROUPS so the driver model handles
creation and removal automatically.

Use the new pci_resource_is_mem() helper for the type check, replacing the
open-coded bitwise flag test.

Finally, remove pci_create_resource_files(), pci_remove_resource_files(),
pci_create_attr(), and pci_create_one_attr() which are no longer needed.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-18-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
5980dcbc4b alpha/PCI: Add static PCI resource attribute macros
Add macros for declaring static binary attributes for Alpha's PCI resource
files:

  - pci_dev_resource_attr(),        for dense/BWX systems (mmap dense)
  - pci_dev_resource_sparse_attr(), for sparse systems (mmap sparse)
  - pci_dev_resource_dense_attr(),  for dense companion files (mmap dense)

Each macro creates a const bin_attribute with the BAR index stored in the
.private property and the appropriate .mmap() callback.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-17-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
29840080f5 alpha/PCI: Remove WARN from __pci_mmap_fits() and __legacy_mmap_fits()
Remove the WARN() that fires when userspace attempts to mmap beyond the BAR
bounds.  The check still returns 0 to reject the mapping, but the warning
is excessive for normal operation.

A similar warning was removed from the PCI core in the commit 3b519e4ea6
("PCI: fix size checks for mmap() on /proc/bus/pci files").

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
[bhelgaas: squash https://lore.kernel.org/all/20260508045824.GA3160093@rocinante]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-16-kwilczynski@kernel.org
2026-06-23 15:19:09 -05:00
Krzysztof Wilczyński
802a3b3f47 alpha/PCI: Fix __pci_mmap_fits() overflow for zero-length BARs
Currently, __pci_mmap_fits() computes the BAR size using
"pci_resource_len() - 1", which wraps to a large value when the BAR length
is zero, causing the bounds check to incorrectly succeed.

Add an early return for empty resources.

Fixes: 10a0ef39fb ("PCI/alpha: pci sysfs resources")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-15-kwilczynski@kernel.org
2026-06-23 15:19:08 -05:00
Krzysztof Wilczyński
30d01a8c3a alpha/PCI: Use PCI resource accessor macros
Replace direct pdev->resource[] accesses with pci_resource_n(), and
open-coded res->flags type checks with pci_resource_is_mem() and
pci_resource_start() helpers.

While at it, move the pci_resource_n() call directly into
pcibios_resource_to_bus() and drop the local struct resource pointer.

No functional changes intended.

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-14-kwilczynski@kernel.org
2026-06-23 15:19:08 -05:00
Krzysztof Wilczyński
7d9779cb10 alpha/PCI: Use BAR index in sysfs attr->private instead of resource pointer
Currently, Alpha's pci_create_one_attr() stores a resource pointer in
attr->private, and pci_mmap_resource() loops through all BARs to find
the matching index.

Store the BAR index directly in attr->private and retrieve the resource via
pci_resource_n().  This eliminates the loop and aligns with the convention
used by the generic PCI sysfs code.

The PCI core change was first added in the commit dca40b186b ("PCI: Use
BAR index in sysfs attr->private instead of resource pointer").

Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-13-kwilczynski@kernel.org
2026-06-23 15:19:08 -05:00
Krzysztof Wilczyński
78a228f0aa alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
Currently, Alpha's pci_mmap_resource() does not check
security_locked_down(LOCKDOWN_PCI_ACCESS) before allowing userspace to mmap
PCI BARs.

The generic version has had this check since commit eb627e1772 ("PCI:
Lock down BAR access when the kernel is locked down") to prevent DMA
attacks when the kernel is locked down.

Add the same check to Alpha's pci_mmap_resource().

Fixes: eb627e1772 ("PCI: Lock down BAR access when the kernel is locked down")
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Tested-by: Magnus Lindholm <linmag7@gmail.com>
Tested-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Acked-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://patch.msgid.link/20260508043543.217179-12-kwilczynski@kernel.org
2026-06-23 15:19:08 -05:00
Ilpo Järvinen
79a648209d PCI: Make pci_sriov_resource_alignment() pci_dev const
pci_sriov_resource_alignment() inputs struct pci_dev which it should not
need to alter to calculate alignment.

Make pci_dev pci_sriov_resource_alignment() inputs const. It requires
making pci_iov_resource_size() input const as well.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260429122617.7324-8-ilpo.jarvinen@linux.intel.com
2026-06-23 12:08:51 -05:00
Ilpo Järvinen
9f331c50b3 powerpc/pseries: Make pseries_get_iov_fw_value() & pnv_iov_get() pci_dev const
Convert input pci_dev for pseries_get_iov_fw_value() and pnv_iov_get() to
const to be able to convert pcibios_iov_resource_alignment() as well in an
upcoming change.

Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20260429122617.7324-7-ilpo.jarvinen@linux.intel.com
2026-06-23 12:08:51 -05:00
Linus Torvalds
f31c00c377 platform-drivers-x86 for v7.2-1
Highlights:
 
 - amd/hfi: Add support for dynamic ranking tables (version 3)
 
 - amd/pmc:
   - Add PMC driver support for AMD 1Ah M80H SoC
   - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
     switch problems after s2idle
 
 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver
 
 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR
 
 - asus-wmi: add keystone dongle support
 
 - dell-dw5826e: Add reset driver for DW5826e
 
 - dell-laptop: Fix rollback path
 
 - hp-wmi:
   - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F
 
 - intel-hid:
   - Add HP ProBook x360 440 G1 5 button array support
   - Prevent racing ACPI notify handlers
 
 - intel/pmc:
   - Add Nova Lake support
   - Rate-limit LTR scale-factor warning
 
 - intel-uncore-freq:
   - Expose instance ID in the sysfs
   - Fix current_freq_khz after CPU hotplug
 
 - intel/vsec: Restore BAR fallback for header walk
 
 - ISST: Restore SST-PP control to all domains
 
 - lenovo-wmi-*:
   - Add more CPU tunable attributes
   - Add GPU tunable attributes
   - Add WMI battery charge limiting
 
 - oxpec: add support for OneXPlayer Super X
 
 - sel3350-platform: Retain LED state on load and unload
 
 - surface: SAM: Add support for Surface Pro 12in
 
 - uniwill-laptop: Add support for battery charge modes
 
 - tools/power/x86/intel-speed-select: Harden daemon pidfile open
 
 - Major refactoring efforts:
   - ACPI driver to platform driver conversion
   - Converting drivers to use the improved WMI API
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 ACPI:
  -  provide acpi_bus_find_device_by_name()
 
 alienware-wmi-base:
  -  Transition to new WMI API
 
 amd: hfi:
  -  Support for ranking table versions
 
 amd/hsmp:
  -  Clamp ioctl/send_message indices (Spectre v1)
 
 amd/pmc:
  -  Add delay_suspend module parameter
  -  Add PMC driver support for AMD 1Ah M80H SoC
  -  Check for intermediate wakeup in function
  -  Delay suspend for some Lenovo Laptops
  -  Don't log during intermediate wakeups
  -  Use per-SoC cpu_info struct for SMU mailbox and IP info
 
 apple-gmux:
  -  Drop unused assignment of pnp_device_id driver data
 
 arm64:
  -  Add driver for EC found on Qualcomm reference devices
 
 arm64: qcom-hamoa-ec:
  -  Fix indentation in comment tables
 
 arm64 Use named initializers for struct i2c_device_id:
  - arm64 Use named initializers for struct i2c_device_id
 
 asus-armoury:
  -  add support for FX608JPR
  -  add support for G614PR
  -  add support for GA402NJ
  -  add support for GA403UM
 
 asus-wmi:
  -  add keystone dongle support
 
 barco-p50-gpio:
  -  attach software node to its target GPIO device
 
 classmate-laptop:
  -  Address memory leaks on driver removal
  -  Convert accel driver to a platform one
  -  Convert ipml driver to a platform one
  -  Convert keys driver to a platform one
  -  Convert tablet driver to a platform one
  -  Convert v4 accel driver to a platform one
  -  Pass struct device pointer to helpers
  -  Register ACPI notify handlers directly
  -  Rename two helper functions
  -  Unify probe rollback and remove code
 
 dell-ddv:
  -  Use new buffer-based WMI API
 
 dell-descriptor:
  -  Use new buffer-based WMI API
 
 dell-dw5826e:
  -  Add reset driver for DW5826e
 
 dell-laptop:
  -  add Inspiron N5110 to touchpad LED quirk table
  -  fix missing cleanups in init error path
 
 dell-privacy:
  -  correct CONFIG_DELL_WMI_PRIVACY macro name in comments
  -  Use new buffer-based WMI API
 
 dell_rbu:
  -  use strscpy in image_type_write
 
 dell-smbios-wmi:
  -  Use new buffer-based WMI API
 
 dell-wmi-base:
  -  Use new buffer-based WMI API
 
 docs:
  -  fix typo in uniwill-laptop.rst
 
 hp-wmi:
  -  Add support for Omen 16-ap0xxx (8D26)
  -  Add support for Omen 16-ap0xxx (8E35)
  -  Add thermal support for board 8B2F
 
 hwmon:
  -  (dell-smm) Use new buffer-based WMI API
 
 intel-hid:
  -  Add HP ProBook x360 440 G1 to button_array_table
  -  Protect ACPI notify handler against recursion
 
 intel/pmc:
  -  Add ACPI PWRM telemetry driver for Nova Lake S
  -  Add Nova Lake support to intel_pmc_core driver
  -  Add NVL PCI IDs for SSRAM telemetry discovery
  -  Add PMC SSRAM Kconfig description
  -  Add support for variable DMU offsets
  -  Enable Pkgc blocking residency counter
  -  Enable PkgC LTR blocking counter
  -  rate-limit LTR scale-factor warning
  -  Retrieve PMC info only for available PMCs
 
 intel/pmc/ssram:
  -  Add ACPI discovery scaffolding
  -  Add PCI platform data
  -  Make PMT registration optional
  -  Refactor DEVID/PWRMBASE extraction into helper
  -  Rename probe and PCI ID table for consistency
  -  Switch to static array with per-index probe state
 
 intel/pmc:
  -  Use __free() in pmc_core_punit_pmt_init()
  -  Use PCI DID for PMC SSRAM device discovery
 
 intel/pmt:
  -  Add pre/post decode hooks around header parsing
  -  Cache the telemetry discovery header
 
 intel/pmt/crashlog:
  -  Split init into pre-decode
 
 intel/pmt:
  -  Pass discovery index instead of resource
 
 intel/pmt/telemetry:
  -  Move overlap check to post-decode hook
 
 intel/pmt:
  -  Unify header fetch and add ACPI source
 
 intel/tpmi:
  -  convert mutex in mem_write() to guard
  -  use cleanup helpers in mem_write()
 
 intel-uncore-freq:
  -  Expose instance ID in the sysfs
  -  Fix current_freq_khz after CPU hotplug
  -  Rename instance_id
 
 intel/vsec:
  -  allocate res with intel_vsec_dev
  -  Restore BAR fallback for header walk
 
 ISST:
  -  Restore SST-PP control to all domains
 
 lenovo-wmi-capdata:
  -  Add debugfs file for dumping capdata
 
 lenovo-wmi-helpers:
  -  Add helper for creating per-device debugfs dir
 
 lenovo-wmi-other:
  -  Add force_load_psy_ext module parameter
  -  Add GPU tunable attributes
  -  Add missing CPU tunable attributes
  -  Add WMI battery charge limiting
  -  Rename LWMI_OM_FW_ATTR_BASE_PATH
 
 meraki-mx100:
  -  use real software node references
 
 modpost:
  -  Handle malformed WMI GUID strings
 
 Move delayed work on system_dfl_wq:
  - Move delayed work on system_dfl_wq
 
 msi-ec:
  -  Add support for MSI Pulse GL66 12th Gen
 
 oxpec:
  -  add support for OneXPlayer Super X
 
 panasonic-laptop:
  -  simplify allocation of sinf
 
 pcengines-apuv2:
  -  reduce indiraction in swnode assignment
 
 pmc_atom:
  -  Use named initializer for pci_device_id array
 
 sel3350-platform:
  -  Retain LED state on load and unload
 
 sonypi:
  -  use strscpy() in sonypi_acpi_probe
 
 surface: SAM:
  -  Add support for Surface Pro 12in
 
 thinkpad_acpi:
  -  Add debugfs entry to display HWDD raw
  -  Remove unneeded goto
 
 tools/power/x86/intel-speed-select:
  -  Harden daemon pidfile open
 
 uniwill-laptop:
  -  Add support for battery charge modes
  -  Enable battery charge modes on supported devices
  -  Mark EC_ADDR_OEM_4 as volatile
  -  Rework FN lock/super key suspend handling
 
 use u8 * for raw byte buffers:
  - use u8 * for raw byte buffers
 
 wmi:
  -  Make sysfs attributes const
  -  Make wmi_bus_class const
 
 x86-android-tablets:
  -  enable fwnode matching of GPIO chips
  -  Use named initializers for struct i2c_device_id
 
 x86/platform/olpc: xo15:
  -  Convert ACPI driver to a platform one
  -  Drop wakeup source on driver removal
 
 xo15-ebook:
  -  Convert ACPI driver to a platform one
  -  Fix formatting of labels
  -  Fix wakeup source and GPE handling
  -  Register ACPI notify handler directly
  -  Use devres-based resource management
 
 Merges:
  -  Merge branch 'fixes' into for-next
  -  Merge branch 'fixes' of into for-next
  -  Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into review-ilpo-next
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCajl8LgAKCRBZrE9hU+XO
 MZ47AP0Z0IoiT8WEcXL4wuTQyR6ruXWClYk82wiroAFEko8Z5AD/WYNWCBXqjZk+
 FlJbtleRLA/ADmgT3Mj+biHNTIqyBA0=
 =Q3d+
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen:

 - amd/hfi: Add support for dynamic ranking tables (version 3)

 - amd/pmc:
     - Add PMC driver support for AMD 1Ah M80H SoC
     - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
       switch problems after s2idle

 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver

 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR

 - asus-wmi: add keystone dongle support

 - dell-dw5826e: Add reset driver for DW5826e

 - dell-laptop: Fix rollback path

 - hp-wmi:
     - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F

 - intel-hid:
     - Add HP ProBook x360 440 G1 5 button array support
     - Prevent racing ACPI notify handlers

 - intel/pmc:
     - Add Nova Lake support
     - Rate-limit LTR scale-factor warning

 - intel-uncore-freq:
     - Expose instance ID in the sysfs
     - Fix current_freq_khz after CPU hotplug

 - intel/vsec: Restore BAR fallback for header walk

 - ISST: Restore SST-PP control to all domains

 - lenovo-wmi-*:
     - Add more CPU tunable attributes
     - Add GPU tunable attributes
     - Add WMI battery charge limiting

 - oxpec: add support for OneXPlayer Super X

 - sel3350-platform: Retain LED state on load and unload

 - surface: SAM: Add support for Surface Pro 12in

 - uniwill-laptop: Add support for battery charge modes

 - tools/power/x86/intel-speed-select: Harden daemon pidfile open

 - Major refactoring efforts:
     - ACPI driver to platform driver conversion
     - Converting drivers to use the improved WMI API

 - Miscellaneous cleanups / refactoring / improvements

* tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (115 commits)
  platform/x86/intel/pmc: Add NVL PCI IDs for SSRAM telemetry discovery
  platform/x86/intel/pmc/ssram: Make PMT registration optional
  platform/x86/intel/pmc/ssram: Add ACPI discovery scaffolding
  platform/x86/intel/pmc/ssram: Switch to static array with per-index probe state
  platform/x86/intel/pmc/ssram: Refactor DEVID/PWRMBASE extraction into helper
  platform/x86/intel/pmc/ssram: Add PCI platform data
  platform/x86/intel/pmc/ssram: Rename probe and PCI ID table for consistency
  platform/x86/intel/pmc: Add ACPI PWRM telemetry driver for Nova Lake S
  platform/x86/intel/pmc: Add PMC SSRAM Kconfig description
  platform/x86/intel/pmt: Unify header fetch and add ACPI source
  platform/x86/intel/pmt: Cache the telemetry discovery header
  platform/x86/intel/pmt: Pass discovery index instead of resource
  platform/x86/intel/pmt/telemetry: Move overlap check to post-decode hook
  platform/x86/intel/pmt/crashlog: Split init into pre-decode
  platform/x86/intel/pmt: Add pre/post decode hooks around header parsing
  modpost: Handle malformed WMI GUID strings
  platform/wmi: Make sysfs attributes const
  platform/wmi: Make wmi_bus_class const
  hwmon: (dell-smm) Use new buffer-based WMI API
  platform/x86: dell-ddv: Use new buffer-based WMI API
  ...
2026-06-23 08:31:33 -07:00
Linus Torvalds
4708cac0e2 Staging driver updates for 7.2-rc1
Here is the big set of staging driver updates for 7.2-rc1.
 
 Nothing major in here, just constant grind of tiny cleanups and coding
 style fixes and wrapper removals.  Overall more code was removed than
 added, always a nice sign that things are progressing forward.
 
 Changes outside of drivers/staging/ was due to the octeon driver
 changes, which for some reason also lives partially in the mips
 subsystem, someday that all will be untangled and cleaned up, or just
 removed entirely, it's hard to tell which is going to be its fate.
 
 Other than octeon driver cleanups, in here are the usual:
   - rtl8723bs driver reworking and cleanups, being the bulk of this
     merge window given all of the issues and wrappers involved in that
     beast of a driver.
   - most driver cleanups
   - sm750fb driver cleanups (which might be done, as this really should
     be moved to the drm layer one of these days...)
   - other tiny staging driver cleanups and fixes
 
 All of these have been in linux-next for many weeks with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCajk7UA8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymqGwCfTWeRfHlodxLtncg/2yLDpb+Z1oEAoMJml/AV
 XAdQzdJVI1nOH6w9Qch/
 =bqYI
 -----END PGP SIGNATURE-----

Merge tag 'staging-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging

Pull staging driver updates from Greg KH:
 "Here is the big set of staging driver updates for 7.2-rc1.

  Nothing major in here, just constant grind of tiny cleanups and coding
  style fixes and wrapper removals. Overall more code was removed than
  added, always a nice sign that things are progressing forward.

  Changes outside of drivers/staging/ was due to the octeon driver
  changes, which for some reason also lives partially in the mips
  subsystem, someday that all will be untangled and cleaned up, or just
  removed entirely, it's hard to tell which is going to be its fate.

  Other than octeon driver cleanups, in here are the usual:

   - rtl8723bs driver reworking and cleanups, being the bulk of this
     merge window given all of the issues and wrappers involved in that
     beast of a driver

   - most driver cleanups

   - sm750fb driver cleanups (which might be done, as this really should
     be moved to the drm layer one of these days...)

   - other tiny staging driver cleanups and fixes

  All of these have been in linux-next for many weeks with no reported
  issues"

* tag 'staging-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (199 commits)
  staging: most: video: avoid double free on video register failure
  staging: sm750: rename CamelCase variable Bpp to bpp
  staging: rtl8723bs: delete superfluous switch statement
  staging: sm750fb: Mark g_noaccel, g_nomtrr and g_dualview as __ro_after_init
  staging: rtl8723bs: propagate errno through hal xmit path
  staging: rtl8723bs: propagate errno through xmit enqueue path
  staging: rtl8723bs: convert rtw_xmit_classifier to return errno
  staging: rtl8723bs: make rtw_xmit_classifier static
  staging: rtl8723bs: simplify rtw_xmit_classifier control flow
  staging: rtl8723bs: make _rtw_enqueue_cmd return 0 on success
  staging: rtl8723bs: simplify rtw_enqueue_cmd control flow
  staging: rtl8723bs: make _rtw_enqueue_cmd static
  staging: rtl8723bs: simplify _rtw_enqueue_cmd control flow
  staging: rtl8723bs: fix multiple blank lines in more hal/ files
  staging: rtl8723bs: remove unused TXDESC_64_BYTES code
  staging: rtl8723bs: remove unused DBG_XMIT_BUF and DBG_XMIT_BUF_EXT code
  staging: rtl8723bs: fix multiple blank lines in hal/Hal* files
  staging: rtl8723bs: fix multiple blank lines in hal/ files
  staging: rtl8723bs: rtw_mlme: add blank line for readability
  staging: rtl8723bs: rtw_mlme: wrap rtw_sitesurvey_cmd condition
  ...
2026-06-22 12:43:16 -07:00
Linus Torvalds
0000d9ccbc Char/Misc/IIO/FPGA/GPIB/etc driver updates for 7.2-rc1
Here is the big set of char, misc, iio, fpga, and other small driver
 subsystems changes for 7.2-rc1.
 
 Lots of little stuff in here, the majority being of course the IIO
 driver updates, as a list they are:
   - IIO driver updates and additions
   - GPIB driver bugfixes and cleanups
   - Android binder driver updates (rust and C version)
   - counter driver updates
   - MHI driver updates
   - mei driver updates
   - w1 driver updates
   - interconnect driver updates
   - Comedi driver fixes and updates
   - some obsolete char drivers removed (applicom and dtlk)
   - hwtracing driver updates
   - other tiny driver updates
 
 All of these have been in linux-next for a while with no reported
 issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCajk4Gg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+yl89wCdG1WBLsvKHZ3zaFWd4POE8G/gS1YAnRf0GcRB
 0F1/iBXSZLaRF/p9dsGq
 =fg13
 -----END PGP SIGNATURE-----

Merge tag 'char-misc-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

Pull misc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, fpga, and other small driver
  subsystems changes for 7.2-rc1.

  Lots of little stuff in here, the majority being of course the IIO
  driver updates, as a list they are:

   - IIO driver updates and additions

   - GPIB driver bugfixes and cleanups

   - Android binder driver updates (rust and C version)

   - counter driver updates

   - MHI driver updates

   - mei driver updates

   - w1 driver updates

   - interconnect driver updates

   - Comedi driver fixes and updates

   - some obsolete char drivers removed (applicom and dtlk)

   - hwtracing driver updates

   - other tiny driver updates

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (406 commits)
  w1: ds2482: Use named initializers for arrays of i2c_device_data
  firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version
  firmware: stratix10-rsu: avoid blocking reboot_image sysfs when busy
  coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
  iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure
  iio: chemical: scd30: Replace manual locking with RAII locking
  iio: light: tsl2591: remove unneeded tsl2591_compatible_als_persist_cycle()
  iio: dac: ad5686: create bus ops struct
  iio: dac: ad5686: cleanup doc header of local structs
  iio: dac: ad5686: add control_sync() for single-channel devices
  iio: dac: ad5686: add helpers to handle powerdown masks
  iio: dac: ad5686: add of_match table to the spi driver
  iio: dac: ad5686: drop enum id
  iio: dac: ad5686: remove redundant register definition
  iio: dac: ad5686: refactor include headers
  iio: adc: ad4080: fix AD4880 chip ID
  iio: light: veml3328: add support for new device
  dt-bindings: iio: light: veml6030: add veml3328
  fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
  fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
  ...
2026-06-22 12:20:21 -07:00
Linus Torvalds
364f4a55c6 USB/Thunderbolt driver changes for 7.2-rc1
Here is the big set of USB and Thunderbolt driver changes for 7.2-rc1.
 
 Lots of little stuff in here, major highlights include:
   - USB4STREAM support for Thunderbolt devices.  A new way to send "raw"
     data very quickly over a USB4 connection to another system directly.
   - Other thunderbolt updates and changes to make the stream code work
   - xhci driver updates and additions
   - typec driver updates and additions
   - usb gadget driver updates and fixes for reported issues
   - zh_CN documentation translation of the USB documentation
   - usb-serial driver updates
   - dts cleanups for some USB platforms
   - other minor USB driver updates and tweaks
 
 All of these have been in linux-next for over a week with no reported
 issues, most of them for many many weeks.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCajk1lg8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymieQCg1VgSwN2sXBtMDGi4Sca+ecADx2kAn0bm/e/C
 JjShAcuQ/vj/6zNJm0ll
 =vXkP
 -----END PGP SIGNATURE-----

Merge tag 'usb-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb

Pull USB and Thunderbolt driver updates from Greg KH:
 "Here is the big set of USB and Thunderbolt driver changes for 7.2-rc1.

  Lots of little stuff in here, major highlights include:

   - USB4STREAM support for Thunderbolt devices. A new way to send "raw"
     data very quickly over a USB4 connection to another system directly

   - Other thunderbolt updates and changes to make the stream code work

   - xhci driver updates and additions

   - typec driver updates and additions

   - usb gadget driver updates and fixes for reported issues

   - zh_CN documentation translation of the USB documentation

   - usb-serial driver updates

   - dts cleanups for some USB platforms

   - other minor USB driver updates and tweaks

  All of these have been in linux-next for over a week with no reported
  issues, most of them for many many weeks"

* tag 'usb-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (131 commits)
  usb: ucsi: huawei_gaokun: support mode switching
  thunderbolt: debugfs: Fix sideband write size check
  thunderbolt: debugfs: Fix margining error counter buffer leak
  usb: host: xhci-rcar: Split R-Car Gen2 and Gen3 .plat_start() handling
  usb: host: xhci-rcar: Remove SET_XHCI_PLAT_PRIV_FOR_RCAR() macro
  usb: xhci: allocate internal DCBAA mirror dynamically
  usb: xhci: allocate DCBAA based on host controller max slots
  usb: xhci: refactor DCBAA struct
  xhci: Prevent queuing new commands if xhci is inaccessible
  xhci: dbc: detect and recover hung DbC during enumeraton
  xhci: dbc: add timestamps to DbC state changes in a new helper.
  xhci: dbc: add helper to set and clear DbC DCE enable bit
  xhci: dbc: serialize enabling and disabling dbc
  xhci: dbc: Fix sysfs ABI Documentation for xhci dbc states
  usb: xhci: Improve Soft Retries after short transfers
  usb: xhci: Remove isochronous URB_SHORT_NOT_OK handling
  usb: xhci: Remove skip_isoc_td()
  usb: xhci: Simplify xhci_quiesce()
  usb: xhci: remove legacy 'num_trbs_free' tracking
  usb: xhci: fix typo in xhci_set_port_power() comment
  ...
2026-06-22 12:09:47 -07:00
Linus Torvalds
8a500fd093 TTY / Serial driver update for 7.2-rc1
Here is the big set of TTY and Serial driver updates for 7.2-rc1.
 Overall we end up removing more code than added, due to an obsolete
 synclink_gt driver being removed from the tree, always a nice thing to
 see happen.
 
 Other than that driver removal, major things included in here are:
   - max310x serial driver updates and fixes
   - 8250 driver updates and rework in places to make it more "modern"
   - dts file updates
   - serial driver core tweaks and updates
   - vt code cleanups
   - vc_screen crash fixes
   - other minor driver updates and cleanups
 
 All of these have been in linux-next for well over a week with no
 reported issues.
 
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 -----BEGIN PGP SIGNATURE-----
 
 iG0EABECAC0WIQT0tgzFv3jCIUoxPcsxR9QN2y37KQUCajk2xQ8cZ3JlZ0Brcm9h
 aC5jb20ACgkQMUfUDdst+ymyewCeKSdE2vNK6LQz9hdev9qBh/J0n7oAn091vfYP
 i9C0vxEB+sS9vMsRAro5
 =14Tn
 -----END PGP SIGNATURE-----

Merge tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

Pull tty / serial driver updates from Greg KH:
 "Here is the big set of TTY and Serial driver updates for 7.2-rc1.

  Overall we end up removing more code than added, due to an obsolete
  synclink_gt driver being removed from the tree, always a nice thing to
  see happen.

  Other than that driver removal, major things included in here are:

   - max310x serial driver updates and fixes

   - 8250 driver updates and rework in places to make it more "modern"

   - dts file updates

   - serial driver core tweaks and updates

   - vt code cleanups

   - vc_screen crash fixes

   - other minor driver updates and cleanups

  All of these have been in linux-next for well over a week with no
  reported issues"

* tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)
  serial: 8250_pci: Don't specify conflicting values to pci_device_id members
  vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
  vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()
  serial: 8250: fix possible ISR soft lockup
  dt-bindings: serial: rs485: remove deprecated .txt binding stub
  serial: qcom-geni: trace: Add tracepoint support for Qualcomm GENI serial
  tty: serial: Use named initializers for arrays of i2c_device_data
  serial: 8250_dw: remove clock-notifier infrastructure
  serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
  amba/serial: amba-pl011: Bring back zx29 UART support
  serial: 8250: Add support for console flow control
  serial: 8250: Check LSR timeout on console flow control
  serial: 8250: Set cons_flow on port registration
  tty: serial: 8250: protect against NULL uart->port.dev in register
  arm64: dts: add support for A9 based Amlogic BY401
  dt-bindings: arm: amlogic: add A311Y3 support
  serial: max310x: fix compile errors if CONFIG_SPI_MASTER is disabled
  serial: qcom-geni: Avoid probing debug console UART without console support
  serial: max310x: add comments for PLL limits
  ...
2026-06-22 11:51:49 -07:00
Linus Torvalds
6e869de3a1 hyperv-next for v7.2-rc1
-----BEGIN PGP SIGNATURE-----
 
 iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmo41jgTHHdlaS5saXVA
 a2VybmVsLm9yZwAKCRB2FHBfkEGgXjo1CACiN+Ifxj67WZAy1c1tqlHTJbD/OcAh
 KlbZQCVG3QoV9RC8yc9U2DyzSv488YujrqaJhsRg35Cjqs91dFlaXOemArF9dk8f
 ICy3SU48sCGvm6v95ndClUyvncAkqcPR/tyfNs7l5rPh6fZnXEov2SdtOlMMayOA
 HD/s+urd4AiIT3ffj/Ikl/+VrxC7rkYw5oXRF83y4oG79BDtXxgsSlHCudCAM15O
 FvBeUyTT7/7Phz7jk+oNiNBEtJTq6CQo/2Xp5TBpSBl2F/MjfCudAa/XqJakZO27
 UMi5lH8DALYNek4dckyfvt7cVHfeCma0ho77V9AscChFtnAnv74sJyEK
 =ADO8
 -----END PGP SIGNATURE-----

Merge tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

Pull hyperv updates from Wei Liu:

 - Use wakeup mailbox to boot APs in Hyper-V VTL2 TDX guests (Yunhong
   Jiang, Ricardo Neri)

 - Move the Hyper-V IOMMU to its own subdirectory (Mukesh Rathor)

 - Cosmetic changes to mshv and balloon driver (Junrui Luo, Markus
   Elfring)

* tag 'hyperv-next-signed-20260621' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  mshv: add bounds check on vp_index in mshv_intercept_isr()
  hv_balloon: Simplify data output in hv_balloon_debug_show()
  x86/hyperv: Cosmetic changes in irqdomain.c for readability
  iommu/hyperv: Create hyperv subdirectory under drivers/iommu
  x86/hyperv/vtl: Use the wakeup mailbox to boot secondary CPUs
  x86/hyperv/vtl: Mark the wakeup mailbox page as private
  x86/acpi: Add a helper to get the address of the wakeup mailbox
  x86/hyperv/vtl: Setup the 64-bit trampoline for TDX guests
  x86/realmode: Make the location of the trampoline configurable
  x86/hyperv/vtl: Set real_mode_header in hv_vtl_init_platform()
  x86/dt: Parse the Wakeup Mailbox for Intel processors
  dt-bindings: reserved-memory: Wakeup Mailbox for Intel processors
  x86/acpi: Add functions to setup and access the wakeup mailbox
  x86/topology: Add missing struct declaration and attribute dependency
2026-06-22 08:06:13 -07:00
Linus Torvalds
2580f89860 more s390 updates for 7.2 merge window
- consolidate s390 idle time accounting by moving all CPU time tracking
   to the architecture backend and eliminate the mix of architecture-
   specific and common code accounting
 
 - Add missing EXPORT_SYMBOL_GPL() to kcpustat_field_idle() and
   kcpustat_field_iowait() functions
 
 - Finalize ptep_get() conversion by replacing direct page table entry
   dereferencing with proper accessors (ptep_get(), pmdp_get(), etc.)
 
 - Explicitly check the buffer length in PKEY_VERIFYPROTK ioctl and
   pkey_pckmo implementations and fail if the length is exceeded
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCajlD5xccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8K6cAP48oh4X6XLdK3Eohkm9WjkI0mxZ
 Qh/tkI1o1GcckwU/zAD+O0LKfJIcb4mo0cH7FgTOJTUCbmPBX711zjom2t9Bvww=
 =BTXg
 -----END PGP SIGNATURE-----

Merge tag 's390-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull more s390 updates from Alexander Gordeev:

 - consolidate s390 idle time accounting by moving all CPU time tracking
   to the architecture backend and eliminate the mix of architecture-
   specific and common code accounting

 - Add missing EXPORT_SYMBOL_GPL() to kcpustat_field_idle() and
   kcpustat_field_iowait() functions

 - Finalize ptep_get() conversion by replacing direct page table entry
   dereferencing with proper accessors (ptep_get(), pmdp_get(), etc.)

 - Explicitly check the buffer length in PKEY_VERIFYPROTK ioctl and
   pkey_pckmo implementations and fail if the length is exceeded

* tag 's390-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/pkey: Check length in pkey_pckmo handler implementation
  s390/pkey: Check length in PKEY_VERIFYPROTK ioctl
  s390/idle: Add missing EXPORT_SYMBOL_GPL()
  s390/mm: Complete ptep_get() conversion
  s390/idle: Remove idle time and count sysfs files
  s390/idle: Provide arch specific kcpustat_field_idle()/kcpustat_field_iowait()
  s390/irq/idle: Use stcke instead of stckf for time stamps
  s390/timex: Move union tod_clock type to separate header
2026-06-22 07:43:48 -07:00
Linus Torvalds
2e05544060 mm.git review status for mm-hotfixes-stable..mm-nonmm-stable
Everything:
 
 Total patches:       108
 Reviews/patch:       0.84
 Reviewed rate:       75%
 
 Patch series in this merge:
 
 - The 2 patch series "taskstats: fix TGID dead-thread stat retention"
   from Yiyang Chen fixes a taskstats TGID aggregation bug where fields
   added in the TGID query path were not preserved after thread exit, and
   adds a kselftest covering the regression.
 
 - The 2 patch series "lib/tests: string_helpers: Slight improvements"
   from Andy Shevchenko improves lib/tests/string_helpers_kunit.c a little.
 
 - The 2 patch series "lib/base64: decode fixes" from Josh Law addreesses
   minor issues in lib/base64.c.
 
 - The 3 patch series "selftests/filelock: Make output more kselftestish"
   from Mark Brown makes the output from the ofdlocks test a bit easier for
   tooling to work with, and also ignores the generated file.
 
 - The 3 patch series "uaccess: unify inline vs outline
   copy_{from,to}_user() selection" from Yury Norov simplifies the usercopy
   code by removing the selectability of inlining copy_{from,to}_user().
 
 - The 5 patch series "ocfs2: validate inline xattr header consumers"
   from ZhengYuan Huang fixes a number of possible issues in the ocfs2
   xattr code.
 
 - The 8 patch series "lib and lib/cmdline enhancements" from Dmitry
   Antipov provides additional robustness checking in the cmdline handling
   code and its in-kernel testing and selftests.
 
 - The 18 patch series "cleanup the RAID6 P/Q library" from Christoph
   Hellwig cleans up the RAID6 P/Q library to match the recent updates to
   the RAID 5 XOR library and other CRC/crypto libraries.
 
 - The 3 patch series "ocfs2: harden inode validators against forged
   metadata" from Michael Bommarito adds three structural checks to OCFS2
   dinode validation so malformed on-disk fields are rejected before
   ocfs2_populate_inode() copies them into the in-core inode.
 
 - The 2 patch series "lib/raid: replace __get_free_pages() call with
   kmalloc()" from Mike Rapoport cleans up the lib/raid code by using
   kmalloc() in more places.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCajgeIQAKCRDdBJ7gKXxA
 jmlWAQCLJVDZNJMFaXy4a+YHdu3tfemLpSy83A0Le61tOZUdBQD/Sf/7rhgeaM74
 32yp53TZLA8xHImCGEin/1ddPJ8DbgY=
 =GW2I
 -----END PGP SIGNATURE-----

Merge tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull non-MM updates from Andrew Morton:

 - "taskstats: fix TGID dead-thread stat retention" (Yiyang Chen)

   Fix a taskstats TGID aggregation bug where fields added in the TGID
   query path were not preserved after thread exit, and adds a kselftest
   covering the regression.

 - "lib/tests: string_helpers: Slight improvements" (Andy Shevchenko)

   Improve lib/tests/string_helpers_kunit.c a little

 - "lib/base64: decode fixes" (Josh Law)

   Address minor issues in lib/base64.c

 - "selftests/filelock: Make output more kselftestish" (Mark Brown)

   Make the output from the ofdlocks test a bit easier for tooling to
   work with. Also ignore the generated file

 - "uaccess: unify inline vs outline copy_{from,to}_user() selection"
   (Yury Norov)

   Simplify the usercopy code by removing the selectability of inlining
   copy_{from,to}_user().

 - "ocfs2: validate inline xattr header consumers" (ZhengYuan Huang)

   Fix a number of possible issues in the ocfs2 xattr code

 - "lib and lib/cmdline enhancements" (Dmitry Antipov)

   Provide additional robustness checking in the cmdline handling code
   and its in-kernel testing and selftests

 - "cleanup the RAID6 P/Q library" (Christoph Hellwig)

   Clean up the RAID6 P/Q library to match the recent updates to the
   RAID 5 XOR library and other CRC/crypto libraries

 - "ocfs2: harden inode validators against forged metadata" (Michael
   Bommarito)

   Add three structural checks to OCFS2 dinode validation so malformed
   on-disk fields are rejected before ocfs2_populate_inode() copies them
   into the in-core inode

 - "lib/raid: replace __get_free_pages() call with kmalloc()" (Mike
   Rapoport)

   Clean up the lib/raid code by using kmalloc() in more places

* tag 'mm-nonmm-stable-2026-06-21-10-22' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (108 commits)
  ocfs2: fix circular locking dependency in ocfs2_dio_end_io_write
  ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
  lib: interval_tree_test: validate benchmark parameters
  ocfs2: avoid moving extents to occupied clusters
  treewide: fix transposed "sign" typos and update spelling.txt
  ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
  fat: reject BPB volumes whose data area starts beyond total sectors
  selftests/uevent: increase __UEVENT_BUFFER_SIZE to avoid ENOBUFS on busy systems
  lib/test_firmware: allocate the configured into_buf size
  fs: efs: remove unneeded debug prints
  checkpatch: cuppress warnings when Reported-by: is followed by Link:
  MAINTAINERS: add Alexander as a kcov reviewer
  mailmap: update Alexander Sverdlin's Email addresses
  fs: fat: inode: replace sprintf() with scnprintf()
  ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
  ocfs2: fix race between ocfs2_control_install_private() and ocfs2_control_release()
  ocfs2/dlm: require a ref for locking_state debugfs open
  ocfs2: reject FITRIM ranges shorter than a cluster
  ocfs2: validate fast symlink target during inode read
  ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
  ...
2026-06-21 13:20:19 -07:00
Linus Torvalds
1e762b53a8 OpenRISC updates for 7.2
A few fixes for text patching related code:
 
  * Update the section of map_page used in text patching.  It was
    left with __init when text patching was introduced to OpenRISC.
  * Add fix to invalidate remote SMP core i-caches after text is patched.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE2cRzVK74bBA6Je/xw7McLV5mJ+QFAmo2KLoACgkQw7McLV5m
 J+Rc6g/+IGKEW1snpoq8Gwfi3nYHhrwpR7oFvq+hwCIMd1srnsKy9r5O2bZmahha
 dSST4ZnSdxu1j0sS8tmNPK+ese7AKP5W0Qp79TnagqF0USTgp/ea5POA0mCxiswB
 YjmV6FbueYJV85sX6caiJyV4WHYoFr3RyydmJvq64eiTV5u4oekRpvFtXEJfTY+J
 ACvJ7hVDg6ZogdUfhWJDdMGTS+fdeOeBLyspFVDaWUCaWVyADgC8zMJT2+Z3mgDt
 2tUgN/QGW3vfWsjttstvvCRB5KwmSo1NhUumcUsWr30qioxR04DZwV1UgT3MNqE1
 pj9dNakhYU5PMosKK6GQ4JTh8tLJ4sbo1CLUrmtMMhZc65K30gF9v0xX+oYsh+J7
 Rmb/hLqp/nOptp0PHcwPgPXJIujBEHCul5vDbgYFd3CpQLl1CtCy/+FHldNm11NW
 CmfUgXLLLd5ftZqcXVRyo1f5r03bvidgNi4xdVvS4g/H0wHt0A6L8j7VZO6DjmAF
 AwbBJBQRXf7xSBbzYNzoZz+WClJ8CKsL1GKr07CRLS7vTQVtLWQXE/2wLqYTKTcq
 R7JoaaBvQIMQDhTM++26rQwSp5Y3dl7GAWjUNiMHMCUiwIZ1k30W5qbE+v2upf72
 bD8vgc3A8bYSAz70rCwjC4vBexVGYB6imq6HoQNDTfZZo5od49E=
 =aHUx
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of https://github.com/openrisc/linux

Pull OpenRISC updates from Stafford Horne:
 "A few fixes for text patching related code:

   - Update the section of map_page used in text patching. It was
     left with __init when text patching was introduced to OpenRISC

   - Add fix to invalidate remote SMP core i-caches after text is
     patched"

* tag 'for-linus' of https://github.com/openrisc/linux:
  openrisc: Fix jump_label smp syncing
  openrisc: Add full instruction cache invalidate functions
  openrisc: Cache invalidation cleanup
  openrisc: mm: Fix section mismatch between map_page and __set_fixmap
2026-06-21 09:43:59 -07:00
Linus Torvalds
1a3746ccbb strncpy removal for v7.2-rc1
- Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
   x86, and xtensa
 
 - Remove strncpy API
 
 Over the last 6 years working on strncpy removal there were 362 commits
 by 70 contributors. Folks with more than 1 commit were:
 
     211  Justin Stitt <justinstitt@google.com>
      22  Xu Panda <xu.panda@zte.com.cn>
      21  Kees Cook <kees@kernel.org>
      17  Thorsten Blum <thorsten.blum@linux.dev>
      12  Arnd Bergmann <arnd@arndb.de>
       4  Pranav Tyagi <pranav.tyagi03@gmail.com>
       4  Lee Jones <lee@kernel.org>
       2  Steven Rostedt <rostedt@goodmis.org>
       2  Sam Ravnborg <sam@ravnborg.org>
       2  Marcelo Moreira <marcelomoreira1905@gmail.com>
       2  Krzysztof Kozlowski <krzk@kernel.org>
       2  Kalle Valo <kvalo@kernel.org>
       2  Jaroslav Kysela <perex@perex.cz>
       2  Daniel Thompson <danielt@kernel.org>
       2  Andrew Lunn <andrew@lunn.ch>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCajSC5QAKCRA2KwveOeQk
 u+L0AQCqbRKDuNHKWwbdwv5Sy6nbsHLLd4//m+dJDesqbdMYfgD/UQyygfeicqep
 tXcP2krB9Mcl6qsMqNgkKAPpNTCPAwE=
 =FZ+4
 -----END PGP SIGNATURE-----

Merge tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

Pull strncpy removal from Kees Cook:

 - Remove the per-arch strncpy implementations in alpha, m68k, powerpc,
   x86, and xtensa

 - Remove strncpy API

   Over the last 6 years working on strncpy removal there were 362
   commits by 70 contributors. Folks with more than 1 commit were:

    211  Justin Stitt <justinstitt@google.com>
     22  Xu Panda <xu.panda@zte.com.cn>
     21  Kees Cook <kees@kernel.org>
     17  Thorsten Blum <thorsten.blum@linux.dev>
     12  Arnd Bergmann <arnd@arndb.de>
      4  Pranav Tyagi <pranav.tyagi03@gmail.com>
      4  Lee Jones <lee@kernel.org>
      2  Steven Rostedt <rostedt@goodmis.org>
      2  Sam Ravnborg <sam@ravnborg.org>
      2  Marcelo Moreira <marcelomoreira1905@gmail.com>
      2  Krzysztof Kozlowski <krzk@kernel.org>
      2  Kalle Valo <kvalo@kernel.org>
      2  Jaroslav Kysela <perex@perex.cz>
      2  Daniel Thompson <danielt@kernel.org>
      2  Andrew Lunn <andrew@lunn.ch>

* tag 'strncpy-removal-v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
  string: Remove strncpy() from the kernel
  xtensa: Remove arch-specific strncpy() implementation
  x86: Remove arch-specific strncpy() implementation
  powerpc: Remove arch-specific strncpy() implementation
  m68k: Remove arch-specific strncpy() implementation
  alpha: Remove arch-specific strncpy() implementation
2026-06-19 14:56:45 -07:00
Linus Torvalds
a552c81ff4 mm.git review status for mm-hotfixes-stable..mm-stable
Everything:
 
 Total patches:       321
 Reviews/patch:       1.52
 Reviewed rate:       68%
 
 Excluding DAMON:
 
 Total patches:       227
 Reviews/patch:       2.07
 Reviewed rate:       90%
 
 Excluding DAMON and selftests:
 
 Total patches:       203
 Reviews/patch:       2.14
 Reviewed rate:       91%
 
 Patchsets in this merge:
 
 - The 2 patch series "selftests/mm: clean up build output and verbosity"
   from Li Wang removes some noise from the MM selftests build out.
 
 - The 3 patch series "mm: Free contiguous order-0 pages efficiently"
   from Ryan Roberts speeds up the freeing of a batch of 0-order pages by
   first scanning them for coalescing opportunities.  This is applicable to
   vfree() and to the releasing of frozen pages.
 
 - The 11 patch series "mm/damon: introduce DAMOS failed region quota
   charge ratio" from SeongJae Park addresses a DAMOS usability issue: The
   DAMOS quota often exhausts prematurely because it charges for all memory
   attempted, causing slow and inconsistent performance when actions fail
   on unreclaimable memory.
 
   To fix this, a new feature lets users set a smaller, flexible quota
   charge ratio (via a numerator and denominator) for failed regions.
   Since failed actions cause less overhead, reducing their quota cost
   ensures more predictable and efficient DAMOS processing
 
 - The 8 patch series "selftests/cgroup: improve zswap tests robustness
   and support large page sizes" from Li Wang fixes various spurious
   failures and improves the overall robustness of the cgroup zswap
   selftests.
 
 - The 3 patch series "fix MAP_DROPPABLE not supported errno" from
   Anthony Yznaga fixes an issue in the mlock selftests on arm32.
 
 - The 2 patch series "mm: huge_memory: clean up defrag sysfs with
   shared" from Breno Leitao does some maintenance work in the huge_memory
   code.
 
 - The 3 patch series "treewide: fixup gfp_t printks" from Brendan
   Jackman uses the special vprintf() gfp_t conversion in various places.
 
 - The 6 patch series "mm: Fix vmemmap optimization accounting and
   initialization" from Muchun Song fixes several bugs in the vmemmap
   optimization, mainly around incorrect page accounting and memmap
   initialization in the DAX and memory hotplug paths.  It also fixes
   pageblock migratetype initialization and struct page initialization for
   ZONE_DEVICE compound pages.
 
 - The 4 patch series "mm/damon: repost non-hotfix reviewed patches in
   damon/next tree" from is a sprinkle of unrelated minor bugfixes for
   DAMON.
 
 - The 3 patch series "mm: remove page_mapped()" from David Hildenbrand
   remove this function from the tree, replacing it with folio_mapped().
 
 - The 10 patch series "mm/damon: let DAMON be paused and resumed" from
   SeongJae Park permits DAMON to be paused and resumed without losing its
   current state.
 
 - The 3 patch series "kasan: hw_tags: Disable tagging for stack and
   page-tables" from Muhammad Usama Anjum simplifies and speeds up kasan by
   removing its ineffective tagging of stacks and page tables.
 
 - The 7 patch series "mm/damon/reclaim,lru_sort: monitor all system rams
   by default" from SeongJae Park simplifies deployment on diverse hardware
   like NUMA systems by updating DAMON_RECLAIM and DAMON_LRU_SORT to
   automatically monitor the physical address range covering all System RAM
   areas by default, replacing the overly restrictive behavior that only
   targeted the single largest memory block to save on negligible overhead.
 
 - The 2 patch series "mm/damon/sysfs: document filters/ directory as
   deprecated" from SeongJae Park updates some DAMON docs.
 
 - The 8 patch series "mm: use spinlock guards for zone lock" from Dmitry
   Ilvokhin switches zone->lock handling over to using the guard()
   mechanisms.
 
 - The 2 patch series "mm/filemap: tighten mmap_miss hit accounting" from
   fujunjie fixes a flaw where the mmap_miss counter over-credited page
   cache hits during fault-arounds and page-fault retries.  This results in
   significant reduction of redundant synchronous mmap readahead I/O,
   drastically cutting down execution time and gigabytes read for sparse
   random or strided memory access workloads.
 
 - The 2 patch series "selftests/cgroup: Fix false positive failures in
   test_percpu_basic" from Li Wang fixes a couple of false-positives in the
   cgroup kmem selftests.
 
 - The 2 patch series "mm/damon/reclaim: support monitoring intervals
   auto-tuning" from SeongJae Park adds a new parameter to DAMON permitting
   DAMON_RECLAIM to automatically tune DAMON's sampling and aggregation
   intervals.
 
 - The 2 patch series "mm/damon/stat: add kdamond_pid parameter" from
   SeongJae Park chnges DAMON_STAT to provide the pid of its kdamond.
 
 - The 2 patch series "mm/kmemleak: dedupe verbose scan output" from
   Breno Leitao removes large amounts of duplicated backtraces from the
   verbose-mode kmemleak output.
 
 - The 8 patch series "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)"
   from David Hildenbrand reduces our use of CONFIG_HAVE_BOOTMEM_INFO_NODE,
   with a view to removing it entirely in a later series.
 
 - The 2 patch series "mm/damon: validate min_region_size to be power of
   2" from Liew Rui Yan prevents users from passing a non-power-of-2 value
   of `addr_unit', as this later results in undesirable behavior.
 
 - The 2 patch series "mm: document read_pages and simplify usage" from
   Frederick Mayle does as claimed.
 
 - The 3 patch series "tools/mm/page-types: Fix misc bugs" from Ye Liu
   fixes three issues in tools/mm/page-types.c.
 
 - The 4 patch series "mm: misc cleanups from __GFP_UNMAPPED series" from
   Brendan Jackman implements several cleanups in the page allocator and
   related code.
 
 - The 12 patch series "mm, swap: swap table phase IV: unify allocation"
   from Kairui Song unifies the allocation and charging of anon and shmem
   swap in folios, provides better synchronization, consolidates the
   metadata management, hence dropping the static array and map, and
   improves performance.
 
 - The 28 patch series "mm/damon: introduce data attributes monitoring"
   from SeongJae Park extends DAMON for monitoring general data attributes
   other than accesses.
 
 - The 5 patch series "mm/vmalloc: free unused pages on vrealloc()
   shrink" from Shivam Kalra implements the TODO in vrealloc() to unmap and
   free unused pages when shrinking across a page boundary.
 
 - The 3 patch series "mm/damon: documentation and comment fixes" from
   niecheng does as advertised.
 
 - The 3 patch series "remove mmap_action success, error hooks" from
   Lorenzo Stoakes eliminates custom hooks from mmap_action by removing the
   problematic success_hook which allowed drivers to improperly access
   uninitialized VMAs.  It replaces the error_hook with a simple error-code
   field and updates the memory char driver accordingly.
 
 - The 14 patch series "mm/damon: minor improvements for code readability
   and tests" from SeongJae Park implements minor improvements in code
   readability and tests for DAMON.
 
 - The 2 patch series "mm/damon: fix macro arguments and clarify quota
   goals doc" from Maksym Shcherba does those things.
 
 - The 2 patch series "userfaultfd: merge fs/userfaultfd.c into
   mm/userfaultfd.c" from Mike Rapoport performs that code movement.
 
 - The 15 patch series "mm/mglru: improve reclaim loop and dirty folio"
   from Kairui Song and others cleans up and slightly improves MGLRU's
   reclaim loop and dirty writeback handling.  Large performance
   improvements are measured.
 
 - The 3 patch series "use vma locks for proc/pid/{smaps|numa_maps}
   reads" from Suren Baghdasaryan uses per-vma locks when reading
   /proc/pid/smaps and /proc/pid/numa_maps similar to reduce contention on
   central mmap_lock.
 
 - The 2 patch series "refactors thpsize_shmem_enabled_store() and
   thpsize_shmem_enabled_show()" from Ran Xiaokai provides some cleanup
   work in the THP code.
 
 - The 2 patch series "selftests/memfd: fix compilation warnings" from
   Konstantin Khorenko fixes a few build glitches in the memfd selftest
   code.
 
 - The 4 patch series "memcg: shrink obj_stock_pcp and cache multiple
   objcgs" from Shakeel Butt resolves a 68% performance regression caused
   by NUMA-node cache thrashing around struct obj_stock_pcp by shrinking
   its existing fields and expanding it into a multi-slot array that caches
   up to five obj_cgroup pointers per CPU, allowing per-node variants of
   the same memcg to coexist within a single 64-byte cache line.
 
 - The 2 patch series "zram: writeback fixes" from Sergey Senozhatsky
   addresses a couple of unrelated zram writeback issues.
 
 - The 9 patch series "mm: switch THP shrinker to list_lru" from Johannes
   Weiner resolves NUMA-awareness issues and streamlines callsite
   interaction by refactoring and extending the list_lru API to completely
   replace the complex, open-coded deferred split queue for Transparent
   Huge Pages (THPs).
 
 - The 2 patch series "mm: improve large folio readahead for exec memory"
   from Usama Arif improves large-folio readahead on systems like 64K-page
   arm64 by preventing the mmap_miss check from permanently disabling
   target-oriented VM_EXEC readahead, and by generalizing the
   force_thp_readahead gate to support mappings with any usefully large
   maximum folio order under the cache cap.
 
 - The 6 patch series "userfaultfd/pagemap: pre-existing fixes" from
   Kiryl Shutsemau fixes a bunch of minor issues in the
   userfaultfd/pagemap, all of which were flagged by Sashiko review of
   proposed new material.
 
 - The 5 patch series "mm/sparse-vmemmap: Provide generic
   vmemmap_set_pmd() and vmemmap_check_pmd()" from Muchun Song provides
   generic versions of these two functions so the four arch-specific
   implementations can be removed.
 
 - The 2 patch series "mm/swap, PM: hibernate: fix swapoff race in
   uswsusp by pinning swap device" from Youngjun Park addresses a
   uswsusp-vs-swapoff race and reduces the swap device reference
   taking/releasing frequency.
 
 - The 2 patch series "mm/hmm: A fix and a selftest" from Dev Jain does
   as claimed.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCajQcWQAKCRDdBJ7gKXxA
 jkjFAQD14ZCAS7c/lsNHPRpOARR2zrCJiIp+vhZDEx5V+d8u0QD+I4ca11CnQ+OA
 dKCeabWWYuTR1GDtTHbLVCRfpGexBwM=
 =cWPO
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull MM updates from Andrew Morton:

 - "selftests/mm: clean up build output and verbosity" (Li Wang)

   Remove some noise from the MM selftests build

 - "mm: Free contiguous order-0 pages efficiently" (Ryan Roberts)

   Speed up the freeing of a batch of 0-order pages by first scanning
   them for coalescing opportunities. This is applicable to vfree() and
   to the releasing of frozen pages

 - "mm/damon: introduce DAMOS failed region quota charge ratio"
   (SeongJae Park)

   Address a DAMOS usability issue: The DAMOS quota often exhausts
   prematurely because it charges for all memory attempted, causing slow
   and inconsistent performance when actions fail on unreclaimable
   memory.

   To fix this, a new feature lets users set a smaller, flexible quota
   charge ratio (via a numerator and denominator) for failed regions.
   Since failed actions cause less overhead, reducing their quota cost
   ensures more predictable and efficient DAMOS processing

 - "selftests/cgroup: improve zswap tests robustness and support large
   page sizes" (Li Wang)

   Fix various spurious failures and improves the overall robustness of
   the cgroup zswap selftests

 - "fix MAP_DROPPABLE not supported errno" (Anthony Yznaga)

   Fix an issue in the mlock selftests on arm32

 - "mm: huge_memory: clean up defrag sysfs with shared" (Breno Leitao)

   Some maintenance work in the huge_memory code

 - "treewide: fixup gfp_t printks" (Brendan Jackman)

   Use the special vprintf() gfp_t conversion in various places

 - "mm: Fix vmemmap optimization accounting and initialization" (Muchun
   Song)

   Fix several bugs in the vmemmap optimization, mainly around incorrect
   page accounting and memmap initialization in the DAX and memory
   hotplug paths. It also fixes pageblock migratetype initialization and
   struct page initialization for ZONE_DEVICE compound pages

 - "mm/damon: repost non-hotfix reviewed patches in damon/next tree"

   A sprinkle of unrelated minor bugfixes for DAMON

 - "mm: remove page_mapped()" (David Hildenbrand)

   Remove this function from the tree, replacing it with folio_mapped()

 - "mm/damon: let DAMON be paused and resumed" (SeongJae Park)

   Allow DAMON to be paused and resumed without losing its current state

 - "kasan: hw_tags: Disable tagging for stack and page-tables" (Muhammad
   Usama Anjum)

   Simplify and speed up kasan by removing its ineffective tagging of
   stacks and page tables

 - "mm/damon/reclaim,lru_sort: monitor all system rams by default"
   (SeongJae Park)

   Simplify deployment on diverse hardware like NUMA systems by updating
   DAMON_RECLAIM and DAMON_LRU_SORT to automatically monitor the
   physical address range covering all System RAM areas by default,
   replacing the overly restrictive behavior that only targeted the
   single largest memory block to save on negligible overhead

 - "mm/damon/sysfs: document filters/ directory as deprecated" (SeongJae
   Park)

   Update some DAMON docs

 - "mm: use spinlock guards for zone lock" (Dmitry Ilvokhin)

   Switch zone->lock handling over to using the guard() mechanisms

 - "mm/filemap: tighten mmap_miss hit accounting" (fujunjie)

   Fix a flaw where the mmap_miss counter over-credited page cache hits
   during fault-arounds and page-fault retries. This results in
   significant reduction of redundant synchronous mmap readahead I/O,
   drastically cutting down execution time and gigabytes read for sparse
   random or strided memory access workloads

 - "selftests/cgroup: Fix false positive failures in test_percpu_basic"
   (Li Wang)

   Fix a couple of false-positives in the cgroup kmem selftests

 - "mm/damon/reclaim: support monitoring intervals auto-tuning"
   (SeongJae Park)

   Add a new parameter to DAMON permitting DAMON_RECLAIM to
   automatically tune DAMON's sampling and aggregation intervals

 - "mm/damon/stat: add kdamond_pid parameter" (SeongJae Park)

   Change DAMON_STAT to provide the pid of its kdamond

 - "mm/kmemleak: dedupe verbose scan output" (Breno Leitao)

   Remove large amounts of duplicated backtraces from the verbose-mode
   kmemleak output

 - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)" (David
   Hildenbrand)

   Reduce our use of CONFIG_HAVE_BOOTMEM_INFO_NODE, with a view to
   removing it entirely in a later series

 - "mm/damon: validate min_region_size to be power of 2" (Liew Rui Yan)

   Prevent users from passing a non-power-of-2 value of `addr_unit', as
   this later results in undesirable behavior

 - "mm: document read_pages and simplify usage" (Frederick Mayle)

 - "tools/mm/page-types: Fix misc bugs" (Ye Liu)

   Fix three issues in tools/mm/page-types.c

 - "mm: misc cleanups from __GFP_UNMAPPED series" (Brendan Jackman)

   Implement several cleanups in the page allocator and related code

 - "mm, swap: swap table phase IV: unify allocation" (Kairui Song)

   Unify the allocation and charging of anon and shmem swap in folios,
   provides better synchronization, consolidates the metadata
   management, hence dropping the static array and map, and improves
   performance

 - "mm/damon: introduce data attributes monitoring" (SeongJae Park(

   Extend DAMON to monitor general data attributes other than accesses

 - "mm/vmalloc: free unused pages on vrealloc() shrink" (Shivam Kalra)

   Implement the TODO in vrealloc() to unmap and free unused pages when
   shrinking across a page boundary

 - "mm/damon: documentation and comment fixes" (niecheng)

 - "remove mmap_action success, error hooks" (Lorenzo Stoakes)

   Eliminate custom hooks from mmap_action by removing the problematic
   success_hook which allowed drivers to improperly access uninitialized
   VMAs. It replaces the error_hook with a simple error-code field and
   updates the memory char driver accordingly

 - "mm/damon: minor improvements for code readability and tests"
   (SeongJae Park)

 - "mm/damon: fix macro arguments and clarify quota goals doc" (Maksym
   Shcherba)

 - "userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c" (Mike
   Rapoport)

 - "mm/mglru: improve reclaim loop and dirty folio" (Kairui Song and
   others)

   Clean up and slightly improves MGLRU's reclaim loop and dirty
   writeback handling. Large performance improvements are measured

 - "use vma locks for proc/pid/{smaps|numa_maps} reads" (Suren
   Baghdasaryan)

   Use per-vma locks when reading /proc/pid/smaps and numa_maps similar
   to reduce contention on central mmap_lock

 - "refactors thpsize_shmem_enabled_store() and thpsize_shmem_enabled_show()"
   (Ran Xiaokai)

   Some cleanup work in the THP code

 - "selftests/memfd: fix compilation warnings" (Konstantin Khorenko)

   Fix a few build glitches in the memfd selftest code.

 - "memcg: shrink obj_stock_pcp and cache multiple objcgs" (Shakeel
   Butt)

   Resolve a 68% performance regression caused by NUMA-node cache
   thrashing around struct obj_stock_pcp by shrinking its existing
   fields and expanding it into a multi-slot array that caches up to
   five obj_cgroup pointers per CPU, allowing per-node variants of the
   same memcg to coexist within a single 64-byte cache line.

 - "zram: writeback fixes" (Sergey Senozhatsky)

   address a couple of unrelated zram writeback issues

 - "mm: switch THP shrinker to list_lru" (Johannes Weiner)

   Resolve NUMA-awareness issues and streamlines callsite interaction by
   refactoring and extending the list_lru API to completely replace the
   complex, open-coded deferred split queue for Transparent Huge Pages

 - "mm: improve large folio readahead for exec memory" (Usama Arif)

   Improve large-folio readahead on systems like 64K-page arm64 by
   preventing the mmap_miss check from permanently disabling
   target-oriented VM_EXEC readahead, and by generalizing the
   force_thp_readahead gate to support mappings with any usefully large
   maximum folio order under the cache cap.

 - "userfaultfd/pagemap: pre-existing fixes" (Kiryl Shutsemau)

   Fix a bunch of minor issues in the userfaultfd/pagemap, all of which
   were flagged by Sashiko review of proposed new material

 - "mm/sparse-vmemmap: Provide generic vmemmap_set_pmd() and
   vmemmap_check_pmd()" (Muchun Song)

   Provide generic versions of these two functions so the four
   arch-specific implementations can be removed.

 - "mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap
   device" (Youngjun Park)

   Address a uswsusp-vs-swapoff race and reduces the swap device
   reference taking/releasing frequency.

 - "mm/hmm: A fix and a selftest" (Dev Jain)

* tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (321 commits)
  selftests/mm/hmm-tests: test pagemap reads of PMD device-private entries
  fs/proc/task_mmu: do not warn on seeing non-migration pmd entry
  lib/test_hmm: check alloc_page_vma() return value and handle OOM
  mm/compaction: cap compact_gap() at COMPACT_CLUSTER_MAX
  mm/swap: remove redundant swap device reference in alloc/free
  mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device
  mm/filemap: use folio_next_index() for start
  vmalloc: fix NULL pointer dereference in is_vm_area_hugepages()
  sparc/mm: drop vmemmap_check_pmd helper and use generic code
  loongarch/mm: drop vmemmap_check_pmd helper and use generic code
  riscv/mm: drop vmemmap_pmd helpers and use generic code
  arm64/mm: drop vmemmap_pmd helpers and use generic code
  mm/sparse-vmemmap: provide generic vmemmap_set_pmd() and vmemmap_check_pmd()
  rust: page: mark Page::nid as inline
  userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks
  userfaultfd: gate must_wait writability check on pte_present()
  mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade
  fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole()
  fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry()
  fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race
  ...
2026-06-19 10:14:34 -07:00
Linus Torvalds
c98d767b34 Arm:
"This is a bit of an odd merge window on the KVM/arm64 front. There is
 absolutely no new feature in the pull request. It is purely fixes,
 because it is simply becoming too hard to review new stuff when so
 many AI-fuelled fixes hit the list".
 
 - Significant cleanup of the vgic-v5 PPI support which was merged in
   7.1. This makes the code more maintainable, and squashes a couple
   of bugs in the meantime.
 
 - Set of fixes for the handling of the MMU in an NV context,
   particularly VNCR-triggered faults. S1POE support is fixed
   as well.
 
 - Large set of pKVM fixes, mostly addressing recurring issues
   around hypervisor tracking of donated pages in obscure cases
   where the donation could fail and leave things in a bizarre
   state.
 
 - Fixes for the so-called "lazy vgic init", which resulted in
   sleeping operations in non-preemptible sections. This turned
   out to be far more invasive than initially expected...
 
 - Reduce the overhead of L1/L2 context switch by not touching
   the FP registers.
 
 - Fix the way non-implemented page sizes are dealt with when
   a guest insist on using them for S2 translation.
 
 - The usual set of low-impact fixes and cleanups all over the map.
 
 Loongarch:
 
 - On a request for lazy FPU load, load all FPU state that the VM
   supports instead of enabling only the part (FPU, LSX or LASX)
   that caused the FPU load request.
 
 - Some enhancements about interrupt injection.
 
 - Some bug fixes and other small changes.
 
 RISC-V:
 
 - Batch G-stage TLB flushes for GPA range based page table updates
 
 - Convert HGEI line management to fully per-HART
 
 - Fix missing CSR dirty marking when FWFT state updated via ONE_REG
 
 - Fix stale FWFT feature exposure to Guest/VM
 
 - Speed up dirty logging write faults using MMU rwlock and atomic
   PTE updates using cmpxchg() for permission-only changes
 
 - Use flexible array for APLIC IRQ state
 
 - Use kvm_slot_dirty_track_enabled() for logging enable check on
   a memslot
 
 - Avoid skipping valid pages in kvm_riscv_gstage_wp_range()
 
 - Avoid skipping valid pages in kvm_riscv_gstage_unmap_range()
 
 - Use endian-specific __lelong for NACL shared memory
 
 S390:
 
 - KVM_PRE_FAULT_MEMORY support
 
 - Support for 2G hugepages
 
 - Support for the ASTFLEIE 2 facility
 
 - Support for fast inject using kvm_arch_set_irq_inatomic
 
 - Fix potential leak of uninitialized bytes
 
 - A few more misc gmap fixes.
 
 x86:
 
 - Generic support for the more granular permissions allowed by EPT,
   namely "read" (which was previously usurping the U bit) and
   separate execution bits for kernel and userspace.
 
 - Do not assume that all page tables start with U=1/W=1/NX=0 at the
   root, as AMD GMET needs to have U=0 at the root.
 
 - Introduce common assembly macros for use within Intel and AMD
   vendor-specific vmentry code.  This touches the SPEC_CTRL handling,
   which is now entirely done in assembly for Intel (by reusing the
   AMD code that already existed), and register save/restore which
   uses some macro magic to compute the offsets in the struct.  Both
   of these are preparatory changes for upcoming APX support.
 
 - Clean up KVM's register tracking and storage, primarily to prepare for
   APX support, which expands the maximum number of GPRs from 16 to 32.
 
 - Keep a single copy of the PDPTRs rather than two, since architecturally
   there is just one.
 
 - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code
   gets a chance to handle things like reaping the PML buffer.
 
 - Update KVM's view of PV async enabling if and only if the MSR write fully
   succeeds.
 
 - Fix a variety of issues where the emulator doesn't honor guest-debug state,
   and clean up related code along the way.
 
 - Synthesize EPT Violation and #NPF "error code" bits when injecting faults
   into L1 that didn't originate in hardware (in which case the VMCS/VMCB
   doesn't hold relevant information).
 
 - Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID
   faulting.
 
 - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a
   variety of minor bugs along the way.
 
 - Fix an OOB memory access due to not checking the VP ID when handling a
   Hyper-V PV TLB flush for L2.
 
 - Fix a bug in the mediated PMU's handling of fixed counters that allowed the
   guest to bypass the PMU event filter.
 
 - Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so
   the KVM can forward a "retry" status code to the guest, and reserve all
   unused error codes for future usage.
 
 - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as
   possible into the TDX code, and to funnel (almost) all S-EPT updates into
   a single chokepoint.  The motivation is largely to prepare for upcoming
   Dynamic PAMT support, but the cleanups are nice to have on their own.
 
 - Plug a hole in shadow page table handling, where KVM fails to recursively
   zap nested EPT/NPT shadow page tables when the nested hypervisor tears
   down its own EPT/NPT page tables from the bottom up
 
 x86 (Intel):
 
 - Support for nested MBEC (Mode-Based Execute Control), see above in the
   generic section; also run with MBEC enabled even for non-nested mode.
 
 - Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's
   level definitions (which are 0-based).
 
 - Rework the TDX memory APIs to not require/assume that guest memory is
   backed by "struct page" (in prepartion for guest_memfd hugepage support).
 
 - Fix a largely benign bug where KVM TDX would incorrectly state it could
   emulate several x2APIC MSRs.
 
 - Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written
   value is guest controlled and completely unvalidated.
 
 x86 (AMD):
 
 - Support for nested GMET (Guest Mode Execution Trap), see above in the
   generic section; also run with GMET enabled even for non-nested mode.
 
 - Fixes and minor cleanups to GHCB handling, on top of the earlier work
   already merged into 7.1-rc.
 
 - Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking
   fastpath handlers.
 
 - Add support for virtualizing gPAT (KVM previously just used L1's PAT when
   running L2).
 
 - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC
   updates) when emulating VMRUN.
 
 - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most
   notably where KVM didn't disable interception of IRR, ISR, and TMR regs.
 
 - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU.
 
 - Don't advertise support for unusable VM types, and account for VM types
   that are disabled by firmware, e.g. to mitigate security vulnerabilities.
 
 - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and
   unnecessarily complicated, and add comprehensive tests.
 
 - Clean up and deduplicate the SEV page pinning code.
 
 - Fix minor goofs related to writing back CPUID information after firmware
   rejects a CPUID page for an SNP vCPU.
 
 Generic:
 
 - Rename invalidate_begin() to invalidate_start() throughout KVM to follow
   the kernel's nomenclature, e.g. for mmu_notifiers.
 
 - Use guard() to cleanup up various KVM+VFIO flows.
 
 - Minor cleanups.
 
 guest_memfd:
 
 - Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem
   range to multiple memslots, and fix the test that was supposed to ensure
   KVM returns -EEXIST.
 
 - Treat memslot binding offsets and sizes as unsigned values to fix a bug
   where KVM interprets a large "offset + size" as a negative value and allows
   a nonsensical offset.
 
 - Use the inode number instead of the page offset for the NUMA interleaving
   index to fix a bug where the effective index would jump by two for
   consecutive pages (the caller also adds in the page offset).
 
 Selftests:
 
 - Randomize the dirty log test's delay when reaping the bitmap on the first
   pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the
   bitmap before KVM could build up enough state to hit the bug.
 
 - A pile of one-off fixes and cleanups.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmoypI0UHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroNCSAf8CyuvicojnZGFsNcoY4DZ0whBj5l8
 IwVkHaptuyGLSwPAebC/DwtU2NBY4CQdbtLjGmxenf+fSQOtcz1YWKbdY4Nr0hJG
 euAb/wO47RqKp1C4WPi7lL2P4XHgmUgD5XZ1qDnRV9gnGddZi3QLLmKgAtNq9Z4m
 +pAdGD2/RyZeI0Dx61+5ufE/z8YBlH6GrzgBTxfvvRNKqNDFykBenxYHI7seEfHC
 BPz0LxjHDD8BMDUo86qaylZnaeQSmFTGO/eTgvCvabxG6WbM1s0w3K1owmUmP7o3
 p9o8274Xh53iK2JYD/qGOtAJXejIwbYKT5bnvUQX0O1EH2+ouvSFapLQ9Q==
 =sSqM
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm updates from Paolo Bonzini:
 "arm64:

     This is a bit of an odd merge window on the KVM/arm64 front. There
     is absolutely no new feature in the pull request. It is purely
     fixes, because it is simply becoming too hard to review new stuff
     when so many AI-fuelled fixes hit the list.

   - Significant cleanup of the vgic-v5 PPI support which was merged in
     7.1. This makes the code more maintainable, and squashes a couple
     of bugs in the meantime

   - Set of fixes for the handling of the MMU in an NV context,
     particularly VNCR-triggered faults. S1POE support is fixed as well

   - Large set of pKVM fixes, mostly addressing recurring issues around
     hypervisor tracking of donated pages in obscure cases where the
     donation could fail and leave things in a bizarre state

   - Fixes for the so-called "lazy vgic init", which resulted in
     sleeping operations in non-preemptible sections. This turned out to
     be far more invasive than initially expected..

   - Reduce the overhead of L1/L2 context switch by not touching the FP
     registers

   - Fix the way non-implemented page sizes are dealt with when a guest
     insist on using them for S2 translation

   - The usual set of low-impact fixes and cleanups all over the map

  Loongarch:

   - On a request for lazy FPU load, load all FPU state that the VM
     supports instead of enabling only the part (FPU, LSX or LASX) that
     caused the FPU load request

   - Some enhancements about interrupt injection

   - Some bug fixes and other small changes

  RISC-V:

   - Batch G-stage TLB flushes for GPA range based page table updates

   - Convert HGEI line management to fully per-HART

   - Fix missing CSR dirty marking when FWFT state updated via ONE_REG

   - Fix stale FWFT feature exposure to Guest/VM

   - Speed up dirty logging write faults using MMU rwlock and atomic PTE
     updates using cmpxchg() for permission-only changes

   - Use flexible array for APLIC IRQ state

   - Use kvm_slot_dirty_track_enabled() for logging enable check on a
     memslot

   - Avoid skipping valid pages in kvm_riscv_gstage_wp_range()

   - Avoid skipping valid pages in kvm_riscv_gstage_unmap_range()

   - Use endian-specific __lelong for NACL shared memory

  S390:

   - KVM_PRE_FAULT_MEMORY support

   - Support for 2G hugepages

   - Support for the ASTFLEIE 2 facility

   - Support for fast inject using kvm_arch_set_irq_inatomic

   - Fix potential leak of uninitialized bytes

   - A few more misc gmap fixes

  x86:

   - Generic support for the more granular permissions allowed by EPT,
     namely "read" (which was previously usurping the U bit) and
     separate execution bits for kernel and userspace

   - Do not assume that all page tables start with U=1/W=1/NX=0 at the
     root, as AMD GMET needs to have U=0 at the root

   - Introduce common assembly macros for use within Intel and AMD
     vendor-specific vmentry code. This touches the SPEC_CTRL handling,
     which is now entirely done in assembly for Intel (by reusing the
     AMD code that already existed), and register save/restore which
     uses some macro magic to compute the offsets in the struct. Both of
     these are preparatory changes for upcoming APX support

   - Clean up KVM's register tracking and storage, primarily to prepare
     for APX support, which expands the maximum number of GPRs from 16
     to 32

   - Keep a single copy of the PDPTRs rather than two, since
     architecturally there is just one

   - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor
     code gets a chance to handle things like reaping the PML buffer

   - Update KVM's view of PV async enabling if and only if the MSR write
     fully succeeds

   - Fix a variety of issues where the emulator doesn't honor
     guest-debug state, and clean up related code along the way

   - Synthesize EPT Violation and #NPF "error code" bits when injecting
     faults into L1 that didn't originate in hardware (in which case the
     VMCS/VMCB doesn't hold relevant information)

   - Add support for virtualizing (well, emulating) AMD's flavor of
     CPL>0 CPUID faulting

   - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and
     fix a variety of minor bugs along the way

   - Fix an OOB memory access due to not checking the VP ID when
     handling a Hyper-V PV TLB flush for L2

   - Fix a bug in the mediated PMU's handling of fixed counters that
     allowed the guest to bypass the PMU event filter

   - Allow userspace to return EAGAIN when handling SNP and TDX
     hypercalls, so the KVM can forward a "retry" status code to the
     guest, and reserve all unused error codes for future usage

   - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific
     logic as possible into the TDX code, and to funnel (almost) all
     S-EPT updates into a single chokepoint. The motivation is largely
     to prepare for upcoming Dynamic PAMT support, but the cleanups are
     nice to have on their own

   - Plug a hole in shadow page table handling, where KVM fails to
     recursively zap nested EPT/NPT shadow page tables when the nested
     hypervisor tears down its own EPT/NPT page tables from the bottom
     up

  x86 (Intel):

   - Support for nested MBEC (Mode-Based Execute Control), see above in
     the generic section; also run with MBEC enabled even for non-nested
     mode

   - Use the kernel's "enum pg_level" in the TDX APIs instead of the
     TDX-Module's level definitions (which are 0-based)

   - Rework the TDX memory APIs to not require/assume that guest memory
     is backed by "struct page" (in prepartion for guest_memfd hugepage
     support)

   - Fix a largely benign bug where KVM TDX would incorrectly state it
     could emulate several x2APIC MSRs

   - Use the "safe" WRMSR API when proxying LBR MSR writes as the
     to-be-written value is guest controlled and completely unvalidated

  x86 (AMD):

   - Support for nested GMET (Guest Mode Execution Trap), see above in
     the generic section; also run with GMET enabled even for non-nested
     mode

   - Fixes and minor cleanups to GHCB handling, on top of the earlier
     work already merged into 7.1-rc

   - Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking
     fastpath handlers

   - Add support for virtualizing gPAT (KVM previously just used L1's
     PAT when running L2)

   - Fix goofs where KVM mishandles side effects (e.g. single-step and
     PMC updates) when emulating VMRUN

   - Fix a variety of bugs in AVIC's handling of x2APIC MSR
     interception, most notably where KVM didn't disable interception of
     IRR, ISR, and TMR regs

   - Add support for virtualizing Host-Only/Guest-Only bits in the
     mediated PMU

   - Don't advertise support for unusable VM types, and account for VM
     types that are disabled by firmware, e.g. to mitigate security
     vulnerabilities

   - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with
     bugs and unnecessarily complicated, and add comprehensive tests

   - Clean up and deduplicate the SEV page pinning code

   - Fix minor goofs related to writing back CPUID information after
     firmware rejects a CPUID page for an SNP vCPU

  Generic:

   - Rename invalidate_begin() to invalidate_start() throughout KVM to
     follow the kernel's nomenclature, e.g. for mmu_notifiers

   - Use guard() to cleanup up various KVM+VFIO flows

   - Minor cleanups

  guest_memfd:

   - Return -EEXIST instead of -EINVAL if userspace attempts to bind a
     gmem range to multiple memslots, and fix the test that was supposed
     to ensure KVM returns -EEXIST

   - Treat memslot binding offsets and sizes as unsigned values to fix a
     bug where KVM interprets a large "offset + size" as a negative
     value and allows a nonsensical offset

   - Use the inode number instead of the page offset for the NUMA
     interleaving index to fix a bug where the effective index would
     jump by two for consecutive pages (the caller also adds in the page
     offset)

  Selftests:

   - Randomize the dirty log test's delay when reaping the bitmap on the
     first pass, as always waiting only 1ms hid a KVM RISC-V bug as the
     test reaped the bitmap before KVM could build up enough state to
     hit the bug

   - A pile of one-off fixes and cleanups"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (326 commits)
  KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level
  KVM: x86: Fix shadow paging use-after-free due to unexpected role
  KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject
  KVM: s390: Enable adapter_indicators_set to use mapped pages
  KVM: s390: Add map/unmap ioctl and clean mappings post-guest
  riscv: kvm: Use endian-specific __lelong for NACL shared memory
  KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32
  KVM: s390: vsie: Implement ASTFLEIE facility 2
  KVM: s390: vsie: Refactor handle_stfle
  s390/sclp: Detect ASTFLEIE 2 facility
  KVM: s390: Minor refactor of base/ext facility lists
  KVM: x86/mmu: move pdptrs out of the MMU
  KVM: x86: check that kvm_handle_invpcid is only invoked with shadow paging
  KVM: nSVM: invalidate cached PDPTRs across nested NPT transitions
  KVM: nVMX: remove unnecessary code in prepare_vmcs02_rare
  KVM: x86: remove nested_mmu from mmu_is_nested()
  KVM: arm64: vgic-its: Make ABI commit helpers return void
  KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory
  LoongArch: KVM: Add missing slots_lock for device register/unregister
  LoongArch: KVM: Validate irqchip index in irqfd routing
  ...
2026-06-19 08:56:49 -07:00
Linus Torvalds
08c7183f5b - use software nodes for GPIO code
- cleanups and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCAA4FiEEbt46xwy6kEcDOXoUeZbBVTGwZHAFAmo1JiIaHHRzYm9nZW5k
 QGFscGhhLmZyYW5rZW4uZGUACgkQeZbBVTGwZHDNBQ//X28UvppTn3NQnbQRL4ba
 Na6HVSRiPMqIiCQ5b1kOYXYSAZtPW0Y+GU9X7NVNKJJJTUMbqTGpNgLCR9u7MyP9
 me7uX+duscjZrSH3934/sOXm2xS2Z+JLI4O5GVWpB6hxXW2IiGdxw38mFyPtO4t/
 Z+Lz4LZbn/MC8jGXZ1pNNEH2xF/dq8/nNpLqOqTZbehabsyKkZZN9uJ5JJYxL5Vh
 QsbWo8hYt/O3zuF/nb6e/kTulKNcDmSQzPyeeMrEQbbzSAcWtbMbFRce7qKPgWPv
 B0xkNJcSh5mDc5SD6LHGCmE4FG3jdgdPjTtvmW2UDYZYgndBeWW9knwDIEc4TL0j
 gVBXoXXygvv4GDtccfOxxaU0EiP1JiUfnrqci5cyzYG50gzKJb6cK9GsJBnbbXQ2
 oKU5i/dmfRbePZH6vkm765Je+4x/lSQM44hR7DhSxnr6BQpBhARm8J5qrbi9eUdK
 ii2uaqn2raFvZ3NHSP7lqj/5HpHDRGeK9fsiHEQbOibYSTDQK4Urqc6nrcyt7+cA
 wG/xa6oqFozJKpMEQONcbW47skCIQc6QJckJlRHisAMsr82IGGZ5O+YlDjxJa31H
 +hyzgG1VuiVEgUrNaTvx9srECqN8OxWMa3kIgIx+DcTaMqr4vxM/fLTZcz+MfA4G
 Swnnt5PzxuFBUhQyqcyr6kU=
 =t5+n
 -----END PGP SIGNATURE-----

Merge tag 'mips_7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux

Pull MIPS updates from Thomas Bogendoerfer:

 - use software nodes for GPIO code

 - cleanups and fixes

* tag 'mips_7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (41 commits)
  mips: select legacy gpiolib interfaces where used
  MIPS: lib: Remove '.hidden' for local symbols
  MIPS: VDSO: Avoid including .got in dynamic segment
  MIPS: smp: report dying CPU to RCU in stop_this_cpu()
  MIPS: kernel: proc: Delete unnecessary braces in show_cpuinfo()
  MIPS: kernel: proc: Use seq_putc() calls in show_cpuinfo()
  mips: sched: Fix CPUMASK_OFFSTACK memory corruption
  MIPS: mm: Fix out-of-bounds write in maar_res_walk()
  MIPS: ath79: reduce ARCH_DMA_MINALIGN
  mips: dts: ar9132: fix wdt node name
  mips: Remove remaining defconfig references to the pktcdvd driver
  MIPS: mm: remove comment referring to removed CONFIG_MIPS_CMP
  MIPS: alchemy: db1300: switch to static device properties
  MIPS: alchemy: gpr: switch to static device properties
  MIPS: alchemy: db1000: use nodes attached to GPIO chips in properties
  MIPS: alchemy: mtx1: attach software nodes to GPIO chips
  MIPS: alchemy: provide visible function prototypes to board files
  MIPS: alchemy: platform: add missing include
  MIPS: ip22-gio: do not export device release function
  MIPS: ip22-gio: switch to dynamic root device
  ...
2026-06-19 07:46:16 -07:00