mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/
synced 2026-11-10 20:48:12 +00:00
248,526 commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
53cbbb09c1 |
x86/core update:
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUo24RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i2PhAAm4V2NsF3knhwSQ2WC55RTZbXmlYLAJAq
57rUJejuVM7eHrNhsT0FJIesMLbIDHz5RzVSllN7ESBB5zEkbiyIxRonaG6WTiKk
G0y/IyPsA4BWFp9Ojq5NyDhD95do0gTc08Oxd8eEeJULBzGAaErGl8ExX15SQJkh
eMVdAN4RcathkVrgKbdTklXkECa9j4I+rfBlkX4g8bJ22mbi8h8nfYNrlkX9vncf
IxWNwUh3eKAamLHnKeqbmDUOUrP7ss/hWGWRG0La7G+8jWoX3YlWQdzJeMtWzdV6
unNeFIjjP4lvBtKDkfUBf0JZN+mKo/Zwl5dWNQ/A26vOJTJmmFx03YsuWYDXR0+Q
Vqvm09PSSPbKdGWT7MmlJNhEdBUPOLmCSOT06hfHYKsk+Qkx8XMUIz/bTbNW5gVP
eeok5YWMBn3dQ2B4+LfBqxwMeu+jripgJjN0bj1JOHwkMzYthRce3SHyWRW6hsIh
oOReFnmxaImkh22ia1RLnPscp2efkV9InL5IpNXIH3MXpvlNiUfd0OiDMSGS6ici
AnErf5LK1aXLI+agmBx+7XovUb7umnWpUyvLy3f93E6i6o3urGJ2Tg9Eq+pLJPOR
OAYkzsdJiLCVZqiFm+S+8xNCmlnOs76rKk9bOElOBXUej80q0zwQXHzJ8Pl+yBU1
zw54ecYyK8A=
=xZLR
-----END PGP SIGNATURE-----
Merge tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86/core update from Ingo Molnar:
- Emit the FineIBT paranoid "cs" prefix as a byte,
to work around a GNU toolchain build warning (Kees Cook)
* tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
|
||
|
Linus Torvalds
|
23a38e7bb2 |
x86 fix:
- Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
kCFI mode (Kees Cook)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUkT8RHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1i61BAAiBzFw9ztotYF8xYfsdETueYkK9Qh04sz
7zPFIe6XcGUCKO25EScQlG49wuLFO/n+tGuAEw4MgLsaM6wlzsAz1AY4xTVbkj4T
G7dckQWn0gYt3kooqO+YyTLpko1EGWSngGvLFEEGHpP6rTYVzI3sckfWcJvM1GJ1
UmfPnlOAJDDlzUeGzTJz6J7S5y5/Cb/AWTaktnHb2oiQo0TQFlo5vm2uWR7s4uRp
80WesVJi+lWpCf3BS+qDovXI0wsJCV7g4DpaxZGKuLUspOUjAOqG0/X2LJuNz0jD
PTZT4JZOf3q7k5av10nNRyu3FwSHm/6zR99UXeJgQDq6aLtaOAoEgOz7W0si10gS
uEzzwL0JaavDDtaSUMI6x12bcGmBddCXT4+w+/xWyPSQEj+26JJ0cj5RG1KvXUg/
iTHKd7PZHC6v2B1/8w6hexBxrYvpSb08eO/8w5kOO82fhhS/os5mvaPd1NafeUSM
xqiQYRvGUjJPywdYAFZFeTU7HMZQAa9N3dhA0T1G4ERjqHhd/MufNgiFadh/1DA1
VF+ManJ3KsG+BN0DcP9si5l9MTUJsy6f2n7BRjU4vvx7sCuhsAcQYNhGvAy1F7/0
VsYIpFvFkyUY4SDGEoZw+5t5goAcWDFDZxdjsbXvjdsDpDIHfbWRwU6KpfcoQ7Qr
s5STEOpNHhY=
=vXkY
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fix from Ingo Molnar:
- Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in
kCFI mode (Kees Cook)
* tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/kcfi: Decode the kCFI check from the trap address
|
||
|
Linus Torvalds
|
8573787061 |
Perf events fixes:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrUjygRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1jyHg/9EZ9g8CN+qf0pOiLM3yOZbyoe88VMZ2ZH
QBYGc1JgBVrrjT6JQYjuNQLakv9BJmbgQ1S/xtpaD93CtzJDzK/Jsg4SwuTINlE7
wB+P8lpoTMhE1tfP7rwOaGdZD9qmkJIwALaDmTFayk5z87MzEbSmlLzRRC2TlB8g
R3hF4KOtYtBwQKCrPIXiHi/LbHmx0c0zP4J9M/MbRvNLM8iZ47mF5PL++mpLyuTS
z+YhUu21cp5SAotOZNsgD1VrVOcPy0vpIdJVYSSC9+OWfvuENoqkcciyoSXWNkT0
O7RbMtBwfS7k2+wA2JgQ8ETcGVB0+G45NWXwHBmLHuU5XK5/Whbzn5cUKhvIdS0J
xnr1MCWm/R+cC6i/wgfH1ysd8VACI/51Lng88ckXaVmkUajj6RZPo+VB2FRG4pvq
FMC/Ap/fSjk2SdAjKHRMp87g19aOsoz+aWb6nGZPApMj0EGcxpPAZAcMSi+HUNyI
N5MmAOiD5imMPWB6UX3OCeDgjwUD2Hnbn3NkZeK2Glm7dUUr1MZTEgQ1QlnBv+Ou
vYMkVVEVEq9NJVA2ShnBF5+wRwUpLzI0+9w8L7ZUQPkiYL9tXAB988qYaQ5k08SZ
iUo9EVj48QFqR4ILNY4iAyp9AuT7LuKMF0cnO+O8rEGR8gxHBOBYLxVzR/xB12lq
48D1b2q3EiQ=
=AxtL
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix x86 Intel uncore driver bug on Diamond Rapids CPUs
that erroneously always-cleared the invert bit (Guixiong Wei)
- Fix accounting bug in the perf mlock 'gift' code causing
unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes)
- Fix perf_pmu_migrate_context() bug leaving events behind during
CPU hot-unplug (Haris Okanovic)
- Update cgroup time when rotating multiplexed events, to fix
time_running & scaled counts accounting bug (Antoine Huret)
* tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Update cgroup time when rotating multiplexed events
perf: Fix perf_pmu_migrate_context() leaving events behind
perf: Track the perf mlock gift separately
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
|
||
Lukas Zobernig
|
32c52ec87d |
x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()
Commit |
||
Guixiong Wei
|
cf1f186e08 |
perf/x86/intel/uncore: Fix DMR CXL CM invert filter
The DMR CXL CM PMU places its invert filter at config bit 21 and its
9-bit threshold at bits 23-31. However, dmr_uncore_cxlcm uses
GENERIC_PMON_RAW_EVENT_MASK, which covers the threshold through the
generic bit 23 invert field and bits 24-31 threshold field, but does not
include the relocated invert bit. As a result, uncore_pmu_event_init()
silently clears bit 21 and inv=1 programs the same configuration as
inv=0.
Add bit 21 to a DMR CXL CM-specific event mask so the requested invert
filter reaches hardware.
Fixes:
|
||
|
Linus Torvalds
|
2f2f7eeef8 |
soc: fixes for 7.3, part 3
A small number of last minute bug fixes came up since LPC.
Most of these are for devicetree files:
- Tegra264 needs fan descriptions to keep the system from
overheating
- A cleanup on TI DRA7 caused a regression on PCI support
and needs a fixup
- The beaglev-fire board can no longer probe the mcp3564
sensor after a an inconsistent update in 7.1
- A few fixes address compile time dtc warnings on tegra
The other three patches are all addressing minor problems
in tegra drivers and the sama5 defconfig.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrRN+gACgkQmmx57+YA
GNk1DBAAiYSI8eVMq5N2EllU+A8Sdi2xf/2SwGlJ9StAR8IiQJy9hp+RvyKxfESJ
0Y00nME3eHklrDtlL8WZn3k9UmqK+yJDO+XuE2ZqIlDajWyzAWodyVRvsAT8KCNT
UqCyDTOWVdKO7J5E1PqGBdkYofyMzn12vmdlJxZT/GTs1tE0EXDuRIqoMcAwNAFw
TPMqhuFhpyNUTLBTyroUkQT/wkO+rGwSlgD0xVH3C+EO0FT9/RfeOiyJt/DjFJpF
XRrQyzglVuQG4IUfLyX/vJWTYnnMDH+2urFZKr70FmLwnaowv19NAUUMfDq2SM82
/XKYwDrV4PZrASQO8i7z6x+gyNs3J+mJccqO0DORxZ2y020SMLe6ovWyHJkvr2PQ
+bQD8XfocAV+GpoqdX9+jlg/xRsavtg56uToMP+wMkbzc1P0/Ujuz+AyOUmoiA+p
pMjOZX1Q+0UoKH+R5OgjoEXCnhWRsvvvpMpdDDfW3/c7KIzYtW/PumEqX2xphhHR
RC7b6iehd9/n+t8pBA2lScLTxuNVBPLz23yEEKbH5En7dJh9Wk1Prmdcx/uOFzRk
Iin7OFuc/vWVWGbUe+StY+HCPEOvCG8wEjNLc0eTbmyGIyC5CW8p5pJwoUznkomT
6Sa7z9+QpF14x+upjy38TiA4LdYh5oDfkacu0wram6HF6rSIu04=
=EhfK
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
"A small number of last minute bug fixes came up since LPC.
Most of these are for devicetree files:
- Tegra264 needs fan descriptions to keep the system from overheating
- A cleanup on TI DRA7 caused a regression on PCI support and needs a
fixup
- The beaglev-fire board can no longer probe the mcp3564 sensor after
a an inconsistent update in 7.1
- A few fixes address compile time dtc warnings on tegra
The other three patches are all addressing minor problems
in tegra drivers and the sama5 defconfig"
* tag 'soc-fixes-7.3-3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
ARM: configs: sama5: enable current Microchip KSZ DSA symbols
soc/tegra: pmc: Fix uninitialised clock rate
riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts
ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition
soc/tegra: fuse: Add missing newline to APBMISC error message
arm64: tegra: Add PCIe root ports on Tegra264
arm64: tegra: Reorder reg and reg-names to match bindings
arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit
arm64: tegra: Add PWM controllers on Tegra264
|
||
|
Linus Torvalds
|
9aa622dbaa |
Even more x86 fixes:
- Avoid a false positive panic in the #PF handler, if the kernel triggers
a page fault within the asynchronous page fault handler before the flags
are reset. This can happen for example because of a perf NMI.
- Always reset a vCPU's MMU pointer back to the root MMU when loading
nested guest state fails during RSM or KVM_SET_NESTED_STATE. Otherwise,
KVM tries to run a non-nested guest with a nested MMU, which can result
in a NULL pointer dereference attempting to get the nested MMU's pgd
(EPTP or nested CR3).
-----BEGIN PGP SIGNATURE-----
iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrQj4kUHHBib256aW5p
QHJlZGhhdC5jb20ACgkQv/vSX3jHroOVGQf/cWZSdm/Ct31wH7UjwZiPkRUNQFMy
Oy8jrGwXd/h/nfVAgF25wY49gx9JopCPHWJ1EU5NPSkOLTDJ+eMNZUfoCMuhDyYS
gbMdvAbAEILKlgBAbC1pWr1fg6kMUQTJilp54elEP9XhKCOBG+KxfYu9BEvbonoc
SvW/lN3RhIfHKLhTaOMwAA55Ta5ypebEUhjzZZXWFduWgOJn2F2L9ur8KlcpGQDq
fXIeZihH0gmz3n00Q2M+F6BhGnNIxalmjvJ0khHHSUuLBUqKmvAPlzAcHwEbENWT
gVGzq5Jr8nCVey6iLoUQu2Y1Tms/t+zFyAJXFsDE0TBCswW3XAX7DG8hxg==
=4PsA
-----END PGP SIGNATURE-----
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"Even more x86 fixes:
- Avoid a false positive panic in the #PF handler, if the kernel
triggers a page fault within the asynchronous page fault handler
before the flags are reset.
This can happen for example because of a perf NMI.
- Always reset a vCPU's MMU pointer back to the root MMU when loading
nested guest state fails during RSM or KVM_SET_NESTED_STATE.
Otherwise KVM tries to run a non-nested guest with a nested MMU,
which can result in a NULL pointer dereference attempting to get
the nested MMU's pgd (EPTP or nested CR3)"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
|
||
|
Linus Torvalds
|
6a66840a68 |
Hyper-V fixes for 7.3-rc8
-----BEGIN PGP SIGNATURE----- iQFHBAABCgAxFiEEIbPD0id6easf0xsudhRwX5BBoF4FAmrQiJsTHHdlaS5saXVA a2VybmVsLm9yZwAKCRB2FHBfkEGgXp1UB/4uruLK5Zg/Sf4PguV7WgO9hrEYCTnk urzYhnkOB3G8w0/2p9HVVQUXX29E6oz5w5V/h5piPLXNUSLyei119qhIaZx5BbTe EjCbsIMaqSzI3cGojUNEp6F93wl4ztrKFHQ6nELOfJtFu07R9dr00FRjP8qvJdcn IPCTDotMtRseV/ALG6DCfvWxykmmxGG0odKYQKJTT80q8GEPdDDo+p5SL/4RtxtO h+S2VZ21VgHoU4N6qdJH/dFj0g58wwIMYgj5j2mhpiriXPBMVAQjK1kiMRM7n1xP JvhrKoW794vCMJBHFSTPRl2oxUwbLU1FYacshNcIa8TRm9YAnIhO+Nef =Vqks -----END PGP SIGNATURE----- Merge tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux Pull Hyper-V fixes from Wei Liu: - Typo and comment fixes (Hemanth Selam, Jiangshan Yi) - Update maintainers list (Wei Liu, Long Li) - Two Hyper-V PCI driver fixes (Naman Jain, Sahil Chandna) - Small fixes for core Hyper-V code (Hardik Garg, Michael Kelley, Waiman Long) * tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: MAINTAINERS: drop KY from Hyper-V maintainers list PCI: hv: Warn when wait_for_response() waits indefinitely PCI: hv: Probe vPCI buses asynchronously MAINTAINERS: remove myself from the Hyper-V entries mshv_vtl: Check per-CPU register page before mmap tools/hv: fix typo "retrive" in comment Drivers: hv: vmbus: fix typo "substract" in comment Drivers: hv: Don't reset VMBus connection state on error/exit paths x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() x86/hyperv: Fix stale comments after stimer message mode removal Drivers: hv: Avoid infinite retry loop in init_vp_index() |
||
Amirmohammad Eftekhar
|
c8f4cfe1cf |
KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry
Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM trying to run L1 with a nested MMU, and is especially problematic if the vCPU manages to free its nested state before the VM crashes. Constructing the root for a nested EPT MMU goes through vmcs12, which is dynamically allocated/freed when nVMX is enabled/disabled. And so if the nested state is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL pointer deref when attempting to get L1=>L2 EPTP. BUG: kernel NULL pointer dereference, address: 0000000000000078 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Call Trace: <TASK> kvm_mmu_load+0xcd/0x870 [kvm] kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm] kvm_vcpu_ioctl+0x2c7/0x970 [kvm] __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x9c/0x4d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47491b </TASK> Modules linked in: kvm_intel kvm irqbypass CR2: 0000000000000078 ---[ end trace 0000000000000000 ]--- RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Cc: David Woodhouse <dwmw2@infradead.org> Fixes: |
||
EJ Campbell
|
81d99abe2b |
x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context
An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags, and the NMI handler itself takes a #PF, that fault reads and clears the flags belonging to the #PF it interrupted. It then finds interrupts disabled in the NMI context it interrupted, and panics: Kernel panic - not syncing: Host injected async #PF in interrupt disabled region Call Trace: <NMI> panic+0x52/0x60 __kvm_handle_async_pf+0xb0/0xb0 exc_page_fault+0x71/0xb0 asm_exc_page_fault+0x27/0x30 RIP: 0010:__get_user_nocheck_8+0x6/0x20 perf_callchain_user+0x147/0x1a0 get_perf_callchain+0x12d/0x1c0 ... perf_event_nmi_handler+0x26/0x50 exc_nmi+0xe8/0x110 RIP: 0010:asm_exc_page_fault+0x0/0x30 </NMI> The last RIP line shows the NMI landing on the first instruction of the #PF entry. perf with user call chains takes such a fault: the sampling NMI walks the user stack with __get_user(), which faults when a saved frame pointer is not a valid user address or the walk runs off the top of the stack. The same window exists when KVM, running as an L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after a #PF VM-exit. The NMI entry code saves and restores CR2 for this nesting, but not the async #PF reason. Andy Lutomirski described the race, with perf as the example, when async #PF delivery was reworked in 2020 [1]. Saving and clearing the flags across the NMI, next to CR2, was discussed there but not merged. Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS, so the host delivers "page not present" only for user mode faults and a kernel-mode fault in NMI context (including kernel-mode #MC and #DB) cannot be an async page fault. In that case, return without touching the flags so that the interrupted handler finds them intact. Tested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot whose memory is served on demand through userfaultfd, so that reading it back takes async #PFs, while every thread samples hardware cycles with user call chains and points its frame pointer at an unmapped page. Without this patch the guest panicked as above in 3 of 3 runs. With it, the guest survived 3 of 3 runs of 60 seconds, and the host counted 148,441 to 153,334 kvm_async_pf_not_present events in the first 20 seconds of each. On 6.18.50 the results were the same: the guest panicked without the patch and survived with it. Link: https://lore.kernel.org/all/ed71d0967113a35f670a9625a058b8e6e0b2f104.1583547991.git.luto@kernel.org/ [1] Link: https://lore.kernel.org/all/20211126123145.2772-1-jiangshanlai@gmail.com/ [2] Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: EJ Campbell <ejc3@meta.com> Link: https://patch.msgid.link/CADkxfh-uQTca_6jB1JPDq1MsKffF_UKGQR339oQSJNcoV75GNQ@mail.gmail.com Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> |
||
|
Linus Torvalds
|
4056b3c9d3 |
NIOS2: update for v7.4
- Fix __wsum type degradation in csum_fold() -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEoHhMeiyk5VmwVMwNGZQEC4GjKPQFAmrOwjwACgkQGZQEC4Gj KPQ4eA//T6JMiR10m9y1bdOZToEfPzJS8st30iwGBTdj0hRWPyxZC8ggOLBpNgFV yJ3/ItNLb97X4tDH2FQSfwNgwK3zexP2Qpj42UbhlIt5O8B2TNN2w4ZCYj4m10z8 d0xbQUQiqJtpeLJwl3wAyGUJVFyTrvYLNHcuqFNTRamQau5Ssf5SzXSyLa78K/qR rfHrYVD2+uI41j2JcZ0HhK2kaI/+oqLNOfWjwdnhPonlnWmGhpLq0J2A5uKQCl3T InF4Vl9Zipq3UZahA79RhVTkidlOsvz36D8PKhREsxxWOP5DTQIWMrhHyMITShMC xnDXUzvPs2zqoeS6m4VxgEJ4JYWtflC92eiDMZ9KdA6CNFjRc1jfzxHty8QrjA6D 8s4fUL43ytUrgJGGr15E8bygK3DPzsiDhAziuilIarh90OuTPdaAinafHjWpz2aL HUGkCavJb9PV24xrvs5JgS+FGGE73GIl903YFSkXt6t69HYk9Y8tasIh8I2DxFhJ evzEIc+/g+E87zjjqHQmPI7zJNui7q11XpHZvbmrgOLD8h6QEbuhrmZk7dClFDgv Ho4VuFDImpzpCtuM44+3BxTLUXLCHCSnkYmcQKJj5Zsc8EoB8lN3woq5fnd96Ph9 +kqviVJ9yhISq4rrmOLG9TAscv31dGfOqlUX7NIyN0G++O7P6co= =Fhwg -----END PGP SIGNATURE----- Merge tag 'nios2_update_for_v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux Pull NIOS2 fix from Dinh Nguyen: - Fix __wsum type degradation in csum_fold() * tag 'nios2_update_for_v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/dinguyen/linux: nios2: fix __wsum type degradation in csum_fold() |
||
|
Linus Torvalds
|
03741bcea0 |
More x86 fixes:
- Fix a WARN if the SS bit is set in #NPF exit codes; the AMD manual is unclear about whether it can be set when the guest uses CET but the SupervisorShadowStackEn feature (which KVM does not use) is disabled. However, Hyper-V has started using CET now that KVM supports GMET (it wants the two feature in pairs), and that dissolves all the doubts: the SS bit *is* reported and not clearing it causes a WARN and/or a UBSAN splat. - If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID table used by hardware to perform IPI Virtualization and delivered posted IRQs. I.e. plug the same use-after-free hole related to IPI virtualization and posted IRQs that was fixed for APICv by commit |
||
Keith Busch
|
b963f2345f |
nios2: fix __wsum type degradation in csum_fold()
csum_fold() shifts a bitwise __wsum type, which sparse reports as
"restricted __wsum degrades to integer". Sparse only checks the body of
a static inline once something instantiates it, so this went unnoticed
until a recent block layer change added the first csum_fold() caller to
a file built on this architecture.
Force cast to a __u32 for the shift, as the other architectures do.
Fixes:
|
||
Paolo Bonzini
|
e90ab36691 |
KVM: x86/mmu: Cope with the SS bit being set in #NPF exit codes
When running Hyper-V from Windows 11, KVM is seeing the SS bit set in nested page fault error codes produced for shadowed NPT. The AMD manual is unclear about when SS is set, including whether it can be set when SupervisorShadowStackEn (bit 6) is not set in the MISC_CTL field of the VMCB. Nevertheless, the unexpected SS bit causes out of bounds accesses in permission_fault(), seen as either WARNs or UBSAN reports: kernel: UBSAN: array-index-out-of-bounds in arch/x86/kvm/mmu.h:225:27 kernel: index 34 is out of range for type 'u16 [16]' (in this case, the page fault error code is 34*2=0x44, i.e. SS|U; the report shows SS|U|W happening as well). Fix the handling of unknown error codes by dropping SS and (with a WARN) any bits not among those that permission_fault() expects to receive. At the same time, given the uncertainty about when hardware sets SS, follow the processor's behavior when constructing the fault's error code, and preserve the SS bit as passed to FNAME(walk_addr_generic). While the behavior is surprising, there's a possibility that Hyper-V expects it (Hyper-V does not even enable CET unless it finds MBEC/GMET!), so retain the information when reflecting the fault to L1 instead of unconditionally discarding it. Bisection shows that this started happening with commit |
||
Kees Cook
|
41d1119e2f |
x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte
The "cs" prefix on the LEA in the FineIBT paranoid caller template is padding: it places the LEA's 0xf0 immediate byte where it doubles as the LOCK prefix that makes the failing Jcc raise #UD. GNU as warns about it in every CONFIG_FINEIBT=y build: Warning: segment override on `lea' is ineffectual Clang's integrated assembler does not warn, and both assemble the same bytes. Emit the prefix with ".byte 0x2e" to silence GNU as. Build tested ARCH=x86_64 defconfig with CONFIG_CFI=y, with GCC 17.0.0 (experimental, with the kCFI series) and GNU as 2.47, and with Clang 24.0.0git: GNU as no longer warns, and the template assembles to the same bytes as before with both. Under QEMU with cfi=fineibt,paranoid, the paranoid caller check catches LKDTM's CFI_FORWARD_PROTO with both. Assisted-by: LLM Signed-off-by: Kees Cook <kees@kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20261012090436.1676525-2-kees@kernel.org |
||
|
Kees Cook
|
4505a262de |
x86/kcfi: Decode the kCFI check from the trap address
Since commit |
||
Arnd Bergmann
|
59f522f5a0 |
Microchip AT91 fixes for v7.3
This update includes: - use the correct Kconfig flags for the Microchip KSZ switch -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQTsZ8eserC1pmhwqDmejrg/N2X7/QUCasgArwAKCRCejrg/N2X7 /W8VAP9hLLiVdnALOjkSIAqNqeJauUEdeH6te2Z3wWgo/056JQEAtBJG07U44iD7 jN9rOO5rHArikOUJgyEo7sn+YC4UkAk= =dGAU -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMmhAACgkQmmx57+YA GNnjVBAAjKpVCdY+3xzPPj5BRF8OeWrThBPXpQFWC7Or8T+MnQK0g38Oa/Qhdk+t 8owb56uwry7TwxCtITsDQmbBkLCydA2In2lOS6fMfG1hUMdOPeAtFHUYKIE9M2Yz a8aIqGfCjMPZakWQlo9Ti0yQVDyy09UvA1uofgLgTd1mUUip+HkYrGYp1evxn1N+ +6VanhOedksyI4u5tMmmGgStHIbHSgjL90xJtSb3yzjDBifSSmejaztUSHBpVQdB 0IQxnC4b+y0o8KuDNROCe7vBGsGTXog5xqSSxx/AUXCzQlGTM67OQB8oN1TYoafA 771s8SHVnUdSMl3o9Bt+SFJfoSGiwuLrtDVHPsGviJ5SPCp+H2AdHoTsev9rbx7K bC4by5wE66HjJQAPueOgVuJJoWhDnUdcDXwDlIcECBbcyMVSdxNgDKq0z0v7jFTt ofa1jpZky/AM4R7FMIrZ6P6qvo5PMUE+XyGbqR2cbIjlsioj9imUzJ6stAVU9F3x yrTfs/IPqx8MJnnJTyYwXX3u7PVoMbyzVryKfiRZV6/6cQ88dBy1fTBPdDnVuFLA PMFixJ9K+2MCq7Bxf+6gC0E/SEZW0iEFY3iEUxrQay0O/2jxn5Ao5jOIqNn2r2QG JCakJ0tEApOFanHMlx5YrNUrlXngUdoecEP1GRIavC8cerkyuPM= =/imz -----END PGP SIGNATURE----- Merge tag 'at91-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux into arm/fixes Microchip AT91 fixes for v7.3 This update includes: - use the correct Kconfig flags for the Microchip KSZ switch * tag 'at91-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/at91/linux: ARM: configs: sama5: enable current Microchip KSZ DSA symbols Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
558c56d4bf |
arm64: tegra: Device tree fixes for v7.3
This contains various fixes for Tegra264. While the PWM and fan patches look like they'd be feature additions, I'd like to get them into stable kernels because without them, these devices either end up with the fan running at full speed or not at all, neither of which are great, but in case of the fan not running at all, it can cause the system to overheat. The remainder are some minor fixes for PCIe, mostly to satisfy the device tree validation. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmrA0E8ACgkQ3SOs138+ s6EZoA//aYGrH6UJvTMak8A/o8mP/Ftb7jK3nEyjOiDRim3QcpMGao2PrLrMykJy U8TsiY0G6+lWDP1M+3v+SRR05KSN37qy3zXR17618yBR8cjf3fV75uwQfUSFzmQM UMiOjRQIn4iIQnc5Ln0zG5osT2uC9BpmabZlnsxZfM6J4xK9gidO0kmUUWjylwa4 bZbX1DwgE8pB0JRNSwExrJTvmFwfNhi+KYMhaM6OE2i2G0KS1MJT3hK6ZUmWNTha ZJtTznJCK+slqCVfizBfY0Jj7C4DCckHZ/F02/uCsSvGvN6Yvi86yXCj1NG+LcBM lop3pjcjPa0yF1BGQgYgyzQgzX6sZvXCMlnxctM+hfWScrC8NwwgHJ7UFFRXAEqm FM6OndcZLACIq7FXmHTio59fxcQsm03gtr780MUFasQjH4K6E7b2+JaWyWxLodwb HZJKMgKN6mrnjSn+vfI+Zg9xnrgkuMa2EBIF16IvfZr0be1/GFFmQEUdWpQ1M0e2 KcxYtV8uem6IrDLUW1phxQZc/lJOnuQwIB2yO8eBSGP/3QUEqvfGof/AkYJDgUew yP+5lrYW6gwp7JqkveAjcbBBygf4DFqc5qV4Pyhsj5Xy/rdvOjFGWVGkg1HM2WYm f/fWEUwDuVyCCu6o285W+Ge7OmXq+e4HscFdBZIIsuDxBbgpVAI= =iIxj -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMlsAACgkQmmx57+YA GNn+8w//Q/uvSlFR1iFm8MAkw1AfU8pDiO3ret/ecex+pgDhQqBLVW08XIi6EkTZ 2qoZTAFGRgW+QnOW4qZCBsf46P3uv6IOKaZ4Ip2Xo3rzWHXy+vOeXdLdqBEAKbvi 6uRKcrndZs2qUBSJQ4Gfk/R1w47nJOlpIUqBQ9m8+nqM80d1frDdrVPLqGFwPooJ 9B6Johce0gQfhjQAzZeXR2hG+ouF09VOjIvRU4Qnw0NH5g/vJGUr7GgsOHyYBGGy rZ/psCFVVq0EaNj4GWacm06Fqd45spR7j7r7NciBmyAsRyGSGCxM/85ROPW601Y2 uG4MsNKRklTLDVszPlzxqUKEaVTTGNxbHJznjkhk+ZQ30quH+5slbrjXruzsuJL9 AYFoJeSucUwZkEMFsgAa1Huib995+WKqX48uFaxNUB7iJfSSfC5qX6OpxafYeZgU lwFhUMHngV+DKQBOGmwJhiJtaV2u4RKU3ykrA8AsDLfI9L/Yhuzdw6a3Dhr+4ANH WR8mDGn0ndejwRnZPdHbkErCTIQNhwWvCdarT3IDLNuk9x9V6ktKufHUIYPFGfPo jmF4XOEm/v7gDHPEpseWlwXMrxzyZ0pzGqZWzDSGU8NrxN8BSyT6f8pli06EzgFz F/TOoJVsCaUHJ+/e84zUYttbWffMVEnoqZboYzDemkds6O6977E= =cwei -----END PGP SIGNATURE----- Merge tag 'tegra-for-7.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into arm/fixes arm64: tegra: Device tree fixes for v7.3 This contains various fixes for Tegra264. While the PWM and fan patches look like they'd be feature additions, I'd like to get them into stable kernels because without them, these devices either end up with the fan running at full speed or not at all, neither of which are great, but in case of the fan not running at all, it can cause the system to overheat. The remainder are some minor fixes for PCIe, mostly to satisfy the device tree validation. * tag 'tegra-for-7.3-arm64-dt-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux: arm64: tegra: Add PCIe root ports on Tegra264 arm64: tegra: Reorder reg and reg-names to match bindings arm64: tegra: Add PWM fan on Jetson AGX Thor DevKit arm64: tegra: Add PWM controllers on Tegra264 Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
182d918a68 |
ARM: dts: OMAP fixes for v7.3-rc
- ti/omap: dra7: fix PCIe PHY clock divider definition -----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEe4dGDhaSf6n1v/EMWTcYmtP7xmUFAmq6pFgACgkQWTcYmtP7 xmUYBw/+KSPwiHM/bQBVXfFtezIxsrJ1Iwhy1BABChGJRsaSBPeF9GNCpKMMK5Gx XvT1G2+tMczNVsinzWoOFwnpl3O/X6CMl8eG4OoCUbk78OSWVkxx9HHH4RlVo7jp zCNhIdCatNX5x0l3LT3S8e5Y5NUR7r771lnKJP9Ky4Roucp1PbjpnNaRpEO3pLrI 9/p4D5JII0t2sY8X+K8KRgcd/N/J2jQ2lJCZsIItSXbRTKKML7ApFpWFDEYKAE2o 9cB6NCDIyf+zR3t09Ubdprco5xE3pVTRuZ8LNKF5eYxMvNMBpfnuxSHALef7I4wX lxDklP06uvKEGhstgbzETt+L0XGJ7aTchx5Fjx1HdlhHGn1CI1RbFolhDHulCSz+ aMzcCDzaZ6lLaspTLNKNRpI8gLi5v41/FjvbjhRXQngl3Wh+ZYzrkLD9CTEyRZh+ VQNcA2nu4J12YtXaYkjo4k305X1ttWTN7fxSHjpeJTLBPZiMUFwum7WT2LL9JWNi ebq8D5qnUEtK/dWzh6OWSfYbdmMwlXD576X6bikve0vSdlQExbBgaQtUw5T+Xgua m3k+OkFX2MxdkzP5BVbt5+WqpgB6iWtISFzIlK87nJth4CK0B7Njl9ZmdiWUQwus Z7kWNV6IAAwNtOYZacHIsMpiTX0uRsW2WpS8HwvaHphUBfcW5zg= =yBBF -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrMi2QACgkQmmx57+YA GNlboRAAhbm4bM8M7UhlwU5b20kwPjNBFW1yMTyvcFYyIqdawHs9yUQ5lSD9XvK9 OOCfA4mPNlkosxpNGQy4ci4MI05z7Y13dN3exJE7T8OKTdNYtqdy7JWHgIs194xE SA044nDKhphp5/wfehFlGhP9/wzMeOoKErZG4dFA5+Fw7xtje6w1zFWmrtQsA5Pn s81NGNgO0QRmkI+C4c2Y87aVi9xoGoidYwj0GXZG5QJi+OKjV/WBY/6EJ593pUGg cPByAwV46ucOEscaFDwMpzmidU3pVKda7yGrajGriSLyRVx5yIbFpxay+x3neJ1Q qVyrwBx0vT3YjEDNRr7z/6QGMWTM9kHsOFhnALbIO1SBOob7drzExN8+73nAdDFN v8vrjxXAkXLjvdPIr8WMZhsqbsZvCipkYnsAVsaJXpGJOIaeZ4HRx8a5UmVjix1i m2vrKBW/cZuw7359BGpNzgGTMIftQgRGfThYN4cLUKExeG4rF645SeoPbc3sS9yv lJDAVpPZ6w2aIBJ7Gm5KlGIUtFxGpnKavkOdSr7JSU77dfrJ458EwDvT+PToG5Gp mGJKpLtJZVvdDG8p5ah06gAFrwoawrCw+6hlQlaJFR62XemVI/dIKap3JKGZyUgB vsNQMPTuuQCIrQGGb6VjZW2YjFYrV5gI2nvnEWszMurD64Wl1Bs= =2WyM -----END PGP SIGNATURE----- Merge tag 'omap-for-v7.3/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap into arm/fixes ARM: dts: OMAP fixes for v7.3-rc - ti/omap: dra7: fix PCIe PHY clock divider definition * tag 'omap-for-v7.3/fixes-signed' of git://git.kernel.org/pub/scm/linux/kernel/git/khilman/linux-omap: ARM: dts: ti/omap: dra7: fix PCIe PHY clock divider definition Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
2f46e80fa9 |
RISC-V devicetrees fixes for v7.3-rc
Microchip: Remove double definition of interrupts on the BeagleV-Fire, which cause the sensor to be associated the wrong plic interrupt. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRh246EGq/8RLhDjO14tDGHoIJi0gUCaranWQAKCRB4tDGHoIJi 0s31AP4hv9Vv6RhMscNC9uyNsiwDvXMhg/Xx1JQY6kAJiRUaSAEA1zPUblcy1D/w QiJp5LLikCsP/xlF10TnyQFJMrK62g4= =S04/ -----END PGP SIGNATURE----- Merge tag 'riscv-dt-fixes-for-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux into arm/fixes RISC-V devicetrees fixes for v7.3-rc Microchip: Remove double definition of interrupts on the BeagleV-Fire, which cause the sensor to be associated the wrong plic interrupt. Signed-off-by: Conor Dooley <conor.dooley@microchip.com> * tag 'riscv-dt-fixes-for-v7.3-rc' of https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux: riscv: dts: microchip: beaglev-fire: remove double definition of gpio interrupts |
||
|
Linus Torvalds
|
4d61397c86 |
x86 fix:
- Work around AMD TLBI Erratum #1718 (Borislav Petkov) Signed-off-by: Ingo Molnar <mingo@kernel.org> -----BEGIN PGP SIGNATURE----- iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrLN7QRHG1pbmdvQGtl cm5lbC5vcmcACgkQEnMQ0APhK1hFohAAqJHoyW96qIFMKak6sY63CaJ3lDfFmaB2 8aZW8oKhmjTCECHH/Ff7wDxIL733CsdaxynnJ9YxAmujpsAmaO6Tk8PxuGaVPJsJ pTW8w4ViVJdnsaNzCQpbm8iB3Q5anmiqwgSd/2C8mmEZVF04ZtzmMKyGeGG99GPH p7AzpQKkh0UAjIGCV0i1KXQzboHXld4APJGcoiQIAmNBzdHjJBVrJA+vsUzdcLOf nufTe01afNa2ehlB2cwy0eOn9/+cnZsF4jObFBvmXYjD1rucYSRvUCWOFTMNt5vP Sj57hhhU5ozSHkZVz9I2l6W+7txk9qhLXPA3cFs3FDFjhXFqUo/mmRn/oQxwGzCR fsMq5ImTWTzdTuTzlhWFbNLUJOc0OFWMidyVb2eul9kipz451KFVssuTEWwpV3Mb fEfjPZnnuEAz+0kVckuLGEsROQFst0VDv53BVUSfmunIGZFtyWH1rIpEn4AeIYUC vT66l/pPYqF1tJcX2OB2tHgY2Qw2OCfQPloYrchLTsE2us+fpwZIp8du2yqjasGK 75V0AGDFV2xNkt+x76HZ0bKaFihfg3M7e0NZbon1BF3d4w/Z0HZ/JVaUEBglKTnz QdLD6Y8nKroaTazHfwCwR8JUPesFOuxAqIlZdEXWt2/adfgs7HaTjwu14nD5rrbQ eQhaUR6PyUE= =x9f4 -----END PGP SIGNATURE----- Merge tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 fix from Ingo Molnar: - Work around AMD TLBI Erratum #1718 (Borislav Petkov) * tag 'x86-urgent-2026-10-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Fix AMD TLBI Erratum #1718 |
||
|
Linus Torvalds
|
b2d929a1c2 |
RISC-V updates for v7.3-rc7
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when !CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when PTRACE_SETREGSET
is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to SiFive
errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEElRDoIDdEz9/svf2Kx4+xDQu9KksFAmrLCxIACgkQx4+xDQu9
Kkv0uRAAmTamkNXZpPx0WF9/i48d+40TS7U45u+w0wKbNxgRR+R4jNHOGr91bNQn
82pOG7c8AQbDJv0bed9EgdYQCQR58VC+GXLcCdV9ZvINs9ffIpyoYlD0kL5YXjSv
0kEM6ZCFn3+tLLko8e3UuBGZwnwN2VeyBae1TOutJx/jjTU6R2vrZHAsNd4ol3PB
CcZX533cbNDY4NKZHzniPXdWPdzWK42I5+HwNayf3BFUEsnN/JUZwHI0sTt3wgZo
DpOTRm/C883VelF8NnpPl0cAEux/0KfTP0GPsnPFOvuvIDA/Hn/PfRhweyjCRZ1r
LYWYLpvpbkCOPvyzFL0eKzl1DOgz8KtqdqOA/qUUooxog1egJ9uBynXrh0We4IV1
EbxRjKDiJ7QJJsX8m0xpWtMFYU0hQ3MHxePAxeSVdA5mHksEhWxvudWScwm2Cpt7
9Vq01WmyV3uBMlq7Cd9KJxyNGOTikpciMnUIR4h0WaHZxuevAfgXhs2dVRS2u/Be
a2CztPGV931/1BGLP+wV6I6BXqet+4Q86VDo1Dcj7u6Zr0NyjmJYfz64cmNrSVWZ
CDm9wvxhEedD+9fNvP4fx8B+8nRNZDpWtpevkFy5iDHkd9xeauKax9njrH/gw2S4
lIZZ1+5D14c/d6s0OJIwrMe+xcYu3cZ6qVCEmQXuO3jTHiXky4I=
=ZFs2
-----END PGP SIGNATURE-----
Merge tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux
Pull RISC-V fixes from Paul Walmsley:
"Several security fixes, a significant strnlen() regression fix, and
several other miscellaneous fixes:
- Fix a regression in the Zbb-enabled strnlen() implementation when
huge counts are specified
- When userspace pointer masking is enabled, strip the tag from
user-specified pointers in two spots in the RISC-V futex code where
this was missing
- When CONFIG_SHADOW_CALL_STACK=y, use a supervisor mode-only CSR bit
to determine whether the trap came from userspace or not, rather
than a userspace-writable register
- Reset the HSTATUS.HU bit during CPU initialization to avoid
unexpected behavior, as the RISC-V specification does not require
this bit to be hardware-reset
- Fix the T-Head GhostWrite probing code when
!CONFIG_ERRATA_THEAD_MAE
- Fix RV32 boots using 32-bit.config by constraining NR_CPUS
- Implement a workaround for SiFive MAL-9092, which requires fences
around hypervisor load/store instructions
- Fix the RISC-V patch_map() code to work properly for EXECMEM
addresses when !CONFIG_STRICT_MODULE_RWX
- Fix ptrace register set access reporting when CFI landing pad or
shadow stack support is enabled
- Avoid copying garbage into the target's vstate when
PTRACE_SETREGSET is called with a short iov_len
- Fix load_unaligned_zeropad() on RV32 kernels with
CONFIG_RISCV_EFFICIENT_UNALIGNED_ACCESS=y
- Fix build breakage for any userspace program that includes
uapi/asm/vendor/mips.h
- Fix a build warning for 32-bit allmodconfig builds related to
SiFive errata
- Fix misspecified inline assembly constraints in the vector context
save/restore code"
* tag 'riscv-for-linus-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
riscv: fix load_unaligned_zeropad() fixup for RV32
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
riscv: ptrace: Zero-initialize regset buffers before copyin
riscv: ptrace: reject CFI regset access when extensions are absent
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
riscv: futex: untag the user pointer before the atomic access
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
riscv: patch: fix handling of bpf-jit execmem addresses
RISC-V: Clear HSTATUS.HU on CPU initialization
RISC-V: errata: Add SiFive MAL-9092 workaround
riscv: vector: Fix output operands in context save
riscv: vector: Fix data pointer constraints in context save/restore
riscv: limit sifive errata to CONFIG_64BIT
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
|
||
|
Linus Torvalds
|
9515f634db |
arm64 fixes for -rc7
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU.
- Fix kcov boot selftest failure by excluding our early IRQ entry code.
-----BEGIN PGP SIGNATURE-----
iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmrH1N8QHHdpbGxAa2Vy
bmVsLm9yZwAKCRC3rHDchMFjNHG0CACV2EKHHOdY/g1+PA6NmNeWzVlFT0nczOSh
m/iF+SHdZ+ZcFdipKFQd5cMVpDyVubOvJjuvlFQYreM1AkNrbTqavYfHwbF8mmdF
iqSZIjimjPUBmAJtxlobgP1UPUypI6Chnu0GTnLohufaznEhVqBj97aaE3xyMe3F
muX6d5yybK+wUi/iNt+gnsDNnGS9nDv0/Az7lUeqE1kSFWISz0UQa/pyEDtm4XT9
kzaWsRuRiRNb86nxalA5lvGaZd+RRXtMkUGp0OB3TCgN5WyfgFf3QiSufcYS3RlN
aozeM3nZFaSU4XMH8Ce1XbUkfr1HNA18MgwMSzorjLMBs56PAvax
=Xwu1
-----END PGP SIGNATURE-----
Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"It finally seems to have calmed down on the arm64 fixes front, so
please pull these two straightforward fixes for -rc7. One fixes the
EL2 trap configuration for implementation-defined CPU PMU hardware
during boot and the other fixes a kcov selftest failure by excluding
our softirq early entry code:
- Fix PMU EL2 trap configuration for CPUs with an IMPDEF PMU
- Fix kcov boot selftest failure by excluding our early IRQ entry
code"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
arm64: irq: exclude the softirq stack switch from KCOV
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
|
||
|
Paolo Bonzini
|
bb44efdb08 |
KVM x86 fixed for 7.3-rcN
- If creating a vCPU ultimately fails, clear its entry in the AVIC Physical ID
table used by hardware to perform IPI Virtualization and delivered posted
IRQs. I.e. plug the same use-after-free hole related to IPI virtualization
and posted IRQs that was fixed for APICv by commit
|
||
|
Linus Torvalds
|
af32da41b0 |
Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth: iavf: fix regressions in reconfig impacting bonding
- eth: mana: fix packet forwarding performance regression
- eth: stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth: bnxt: fix PCIe AER recovery and FLR handling issues
- eth: macb: don't modify Tx skbs before taking ownership
- eth: axienet: don't leak Tx skbs on interface stop
- wifi: nxpwifi: number of LLM-ish fixes
- wifi: assorted mt76 fixes
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmrH6sMACgkQMUZtbf5S
IrtsDg//UvqATFotE+zcXa9yD3Pdg35wSH3uGZJYWIr+ZzEFW3hQdbh9rZy5ulX3
XUhFKlFSeEIarV4UstlvEbkLXSEqbaaFMfYBw03L6os3mGVQqMwi+C+7gn3aoqd4
NE1ct2NChnryr8ORCRjZW3OXjAguGuQBXZ4BFRnDWatbY0Cfuf35ap/RdNKztcEd
hct5rsd3LCNgGspjKq19LvD3npEcURebD9Do7mpwoIlw/AECLdCqUW0QkIJW/F6L
qZic95CyZXy39guuhI88cmfnSiZfz2grm8az4nlF9cDoJS1CW7peor6KzzisbT6m
Iltkwwj6v0NcVKE3f86oSSE5RS8kOJx+YcftNe0S+flZmCLpxopbF6VGfTJUmlyJ
CsQ6+n7iQd+1MoZZDGaJjgx14se5pqnnkJ38dVVi1OhomS/jpFYuw2U1dw1GzrJN
hLjPxmeF+HIFIKEbVjMyMbTCQGb8CfCQnH0qQ7XJnezImln+oA9ub66b/Zgwbubl
k8elLxkiFKgjT9bnwm4/+ZtI5VW8QRgV6sxPxpxD4tyVIaKrs2b9sqv9do3YPjPa
HGzMcRL9YMtGcv87gS8gjJRlAdkOWWzVDzw3nf3gMvAiedHIqvtUBcjB22+ueXqg
mJ0dT46BBTNbzrl8gljVTU5zm6ZYHxKm2vTTgbMdGJTzASNKfmE=
=+sxU
-----END PGP SIGNATURE-----
Merge tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
Pull networking fixes from Jakub Kicinski:
"Including fixes from wireless, wireguard, CAN and Bluetooth.
We have one known regression to wrap up in VLAN handling.
Current release - regressions:
- Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex
Previous releases - regressions:
- can: fix regression in handling RPS after migrating metadata to skb_ext
- eth:
- iavf: fix regressions in reconfig impacting bonding
- mana: fix packet forwarding performance regression
- stmmac: remove buggy VLAN acceleration support
Previous releases - always broken:
- a few high prio fixes for tun, and af_packet
- amt: fix a UaF on tunnel teardown
- eth:
- bnxt: fix PCIe AER recovery and FLR handling issues
- macb: don't modify Tx skbs before taking ownership
- axienet: don't leak Tx skbs on interface stop
- wifi:
- nxpwifi: number of LLM-ish fixes
- assorted mt76 fixes"
* tag 'net-7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)
net: macb: copy shared skbs before appending the FCS
net: macb: check TX ring before modifying skb
vsock: Fix memory leak in vmci_transport_recv_dgram_cb()
wireguard: noise: reject response consumption after intermediate initiation
wireguard: queueing: preserve tstamp_type when encapsulating packet
net: openvswitch: validate transport header presence in set_ipv6_addr
net/smc: protect clcsock lifetime in smc_getname
ipv6: do not warn on route notification size race
ipv4: do not warn on route notification size race
ipv4: validate checksum_start before completing checksum
ptp: ocp: fix PCIe delay estimation calculation
xen/netfront: don't leak the skb when xennet_fill_frags() fails
net/packet: call packet_parse_headers after virtio_net_hdr_to_skb
xen/netfront: drop RX packets with a short Ethernet header
net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()
net: sparx5: free the matchall entry on destroy
selftests: mlxsw: Test port range occupancy on template create
mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()
net: dsa: microchip: fix KSZ8765 fiber detection
net/mlx5e: Order ICOSQ cc update after CQ doorbell
...
|
||
|
Linus Torvalds
|
0c2669a9f4 |
soc: fixes for 7.3, part 2
There are fixes in three ares this time:
- Four distinct issues in TEE firmware, all fairly minor
- Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm
based machines, one of these may cause file system corruption
from an incorrect SD card supply voltage
- Five fixes for clk drivers on new Qualcomm platforms,
addressing issues with incorrect enable states
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrBd1cACgkQmmx57+YA
GNlYxBAAhJs6mulHyhGSKOHYbvPHHHsCPFcWT6gLZRRy4lA50GwzptT8SAk6TmlS
C6wm81nVG27hdju5TMiExDUfjiTFd3sxpT8xDP1DVNAgZD6+s2LyFrFbAqRs0zxS
SoaZgzsu7q2pD4wBQpQgOM38YODl05CdzwY4YZqiFoomYHSQzI4xlTVGY6/fcJcm
79fRV63LUznRVtsy+ETMg9TdBcJjPY6huuH/C8JifXvl4Q6P99FGXvZp2rpiFqU0
Y3GXA58XtDqUyrwjbUXFrosmqAqsEU5x+iCA1EV2Y1P460rG4jyhXFAYHimJl9UH
Pnfq5Sb2r+JeK1li4HgHX8g3wDr6KUO/biuInNCUAUEFxQ6W7l+NRZTgjisB9m2W
O6Ju0WMXLMvDsm4OMxYyepxcV3fmxzYMvzs36EmJo67OAhETrTCRmU1M8l5N2s50
84wlGoGdLXYoYCKOzLKZBj77Y1zjoYcxBEDx5PLZR2kMWjxtW+zLkKK1NME39691
nDU+NfMAxbMl+28NCtP91ceaVvb+8Zf9vGDcf7RBz6fTZpwUtW9Z9L7x8MVl873a
88oZNHQrGXO+J6VcwskOIhlR5bDCPfpRQm2y2Y+wY6iz/Ie4Jh5n7J8prpzabs43
AuoGpNqHAVrkfklsr66cDzT43XX1KK59+QQwJiOXe5sDetk5m64=
=Mq24
-----END PGP SIGNATURE-----
Merge tag 'soc-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
Pull SoC fixes from Arnd Bergmann:
- Four distinct issues in TEE firmware, all fairly minor
- Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm
based machines, one of these may cause file system corruption
from an incorrect SD card supply voltage
- Five fixes for clk drivers on new Qualcomm platforms,
addressing issues with incorrect enable states
* tag 'soc-fixes-7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:
MAINTAINERS: update my email address
tee: optee: ffa: support shared memory offsets on large-page kernels
optee: register TEE devices only once fully initialized
tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()
arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply
arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value
arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single
arm64: dts: lx2160a: fix incorrect pinmux
clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable
clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable
clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks
clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks
clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks
arm64: dts: qcom: x1-denali: Fix microphone distortion
tee: qcomtee: fix kernel-doc warnings
|
||
Karl Mehltretter
|
d4f25b097e |
riscv: fix load_unaligned_zeropad() fixup for RV32
The fixup for load_unaligned_zeropad() runs when REG_L crosses into an
unmapped page. REG_L is lw on RV32 and ld on RV64, but the fixup assumes
an 8-byte load: it rounds the address down to 8 bytes and derives the
shift from three address bits.
On RV32, a load starting in the last three bytes of a mapped page selects
the word four bytes earlier and shifts it by 40, 48, or 56 bits, more than
the register width. The caller gets earlier bytes instead of the string
tail followed by zeroes. This affects RV32 MMU kernels built with
RISCV_EFFICIENT_UNALIGNED_ACCESS=y, which selects DCACHE_WORD_ACCESS
and lets dcache name hashing and comparison and strscpy() use this
path.
Derive the alignment and offset masks from sizeof(data) instead of a fixed
8. This makes RV32 use the correct source word. RV64 code is unchanged: the
complete extable.o is byte-for-byte identical before and after.
Fixes:
|
||
Ziyi Guo
|
4d0697f192 |
riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
Under CONFIG_SHADOW_CALL_STACK, handle_exception() reloads the kernel
shadow call stack pointer (gp) only when the trap came from userspace.
It made that decision with scs_load_current_if_task_changed, which
compares the trap-time tp (read back from sscratch into s5) against the
current tp:
beq \prev, tp, _skip_scs
scs_load_current
_skip_scs:
tp is a user-writable register. A user task that sets tp to the
linear-map address of its own task_struct (¤t) before trapping
makes the comparison succeed (can achieve by brute force with KASLR
enable under our test), so the kernel skips scs_load_current and
keeps running with the gp that userspace left in place. Under
CONFIG_SHADOW_CALL_STACK gp is the shadow call stack pointer and
load_global_pointer is a no-op, so the compiler-emitted
"sd ra, -8(gp)" / "ld ra, -8(gp)" in every non-leaf function then write
to, and return through, an attacker-controlled address -- an
unprivileged kernel arbitrary-write and control-flow-hijack primitive.
The poisoned gp is saved to task_struct.scs_sp on return, so the reload
is skipped on every subsequent entry as well.
Decide "came from userspace" from the hardware sstatus.SPP bit (already
in s1 at this point) instead of from tp, mirroring the check that
ret_from_exception already uses a few instructions later. SPP is
written by hardware on trap entry and cannot be forged from U-mode.
Legitimate behaviour is unchanged: user entries (SPP=0) reload the task
shadow call stack, nested kernel entries (SPP=1) skip it.
Fixes:
|
||
Zongmin Zhou
|
59052a88ba |
riscv: ptrace: Zero-initialize regset buffers before copyin
user_regset_copyin() only copies `count` bytes, so a PTRACE_SETREGSET request with a short iov_len leaves the rest of the stack buffer uninitialized. In riscv_vr_set() that garbage is validated and copied into the target's vstate, and in riscv_cfi_set() it can be stored as the target's shadow stack pointer. Zero both buffers, as the get path already does. Fixes: |
||
Chen Pei
|
adadf6df0b |
riscv: ptrace: reject CFI regset access when extensions are absent
riscv_cfi_get() and riscv_cfi_set() do not check whether the Zicfilp
or Zicfiss extensions are present. On systems without them,
PTRACE_GETREGSET on REGSET_CFI still succeeds and returns a zeroed
user_cfi_state, misleading debuggers into believing the register set
is available, and PTRACE_SETREGSET silently accepts writes that have
no effect (e.g. clearing SR_ELP).
Reject the access with -EINVAL when neither branch landing pads nor
shadow stack is available to userspace, using the same availability
helpers as the prctl path.
Fixes:
|
||
Leo Yu-Chi Liang
|
07e23d0b6f |
riscv: fix NR_CPUS range leaking 64-bit default onto 32-bit builds
rv32_defconfig is built in two stages:
- the generic (64-bit-oriented) "defconfig" target runs first
and resolves a concrete NR_CPUS value using the 64BIT default.
- then 32-bit.config is merged on top via merge_config.sh,
which does not touch NR_CPUS.
The final "make olddefconfig" pass sees NR_CPUS=256 is still within
the "2 512" range therefore never recalculates it against the 32BIT
default of 32, silently keeping the leaked 64-bit-stage value.
The NR_CPUS-scaled regions (percpu areas, ...etc) of the resulting
CONFIG_NR_CPUS=256 on a 32-bit build bloats and does not fit in the
percpu/stack layout for rv32 and hangs early boot on QEMU's virt machine.
Fix this by explicitly specify the range for 32/64 and SBI_V01/!SBI_V01.
Fixes:
|
||
|
Zongmin Zhou
|
298510bbc7 |
riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE
errata_probe_ghostwrite() only marks the CPU as vulnerable when it is
called at the RISCV_ALTERNATIVES_EARLY_BOOT stage, and the mitigation
in ghostwrite_enable_mitigation() only takes effect if the vulnerable
state was recorded before the boot alternatives are patched.
The early boot stage is only executed when CONFIG_RISCV_ALTERNATIVE_EARLY
is enabled, which currently is only selected by ERRATA_THEAD_MAE. In a
kernel built with ERRATA_THEAD_GHOSTWRITE=y but ERRATA_THEAD_MAE=n, the
early alternatives never run, so ghostwrite_state is never set to
VULNERABLE: ghostwrite_enable_mitigation() returns false, xtheadvector
remains enabled, and sysfs reports "Not affected" on a vulnerable
T-Head C9xx CPU.
Select RISCV_ALTERNATIVE_EARLY from ERRATA_THEAD_GHOSTWRITE so that the
vulnerability is detected in the early boot stage and the default
mitigation is applied.
Fixes:
|
||
|
Ziyi Guo
|
405290be96 |
riscv: futex: untag the user pointer before the atomic access
access_ok() checks untagged_addr(uaddr), but arch_futex_atomic_op_inuser()
and futex_atomic_cmpxchg_inatomic() hand the raw uaddr to the inline asm
amoswap/amoadd/.../lr.w+sc.w through the "+m" (*uaddr) operand. When the
tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM, prctl
PR_SET_TAGGED_ADDR_CTRL with PMLEN != 0), those two addresses differ: a
user pointer whose top PMLEN bits hold a tag passes access_ok() after
untagging, but the atomic is then performed on the still-tagged raw
address.
Supervisor-mode data accesses are not subject to the U-mode pointer
masking (that is governed by menvcfg.PMM, which the kernel does not set),
so hardware does not strip the tag for the kernel's own access. With
Sv57 and PMLEN=16 the tag bits overlap the canonical-address bits, so a
tagged pointer can name a canonical kernel virtual address (e.g. in the
linear map) whose untagged form is a valid user address. An unprivileged
process can thus make FUTEX_WAKE_OP perform an atomic read-modify-write on
an arbitrary kernel address, with the matching FUTEX_OP_CMP_* result
serving as a read oracle.
get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer
after the access_ok() check; do the same in the futex helpers so the
atomic operates on the address that was actually validated.
Fixes:
|
||
|
Karl Mehltretter
|
a9cd14bfb0 |
arm64: irq: exclude the softirq stack switch from KCOV
On IRQ exit, __irq_exit_rcu() drops HARDIRQ_OFFSET before calling
invoke_softirq(). The arm64 do_softirq_own_stack() wrapper and its
____do_softirq() trampoline run before __do_softirq() establishes
softirq context, so KCOV records their PCs in the interrupted task's
coverage buffer. They also run outside softirq accounting when
local_bh_enable() reaches do_softirq().
The IRQ-exit coverage makes the KCOV boot selftest fail even after
the scheduler and timer coverage leaks are suppressed. The generic
softirq.o is already excluded from KCOV, but that exclusion does not
cover the separately compiled arm64 wrappers.
Exclude irq.o from KCOV instrumentation, as is already done for the
arm64 entry code. This covers both wrappers even with compilers that
lack the no_sanitize_coverage attribute. The softirq action functions
remain instrumented for explicit remote coverage.
Fixes:
|
||
Eric Dumazet
|
44378d02c5 |
net: always dissect GSO packets in __virtio_net_hdr_to_skb()
Commit |
||
Shao Mingyin
|
282f4a8aa9 |
riscv: lib: Fix ZBB strnlen wrap-around regression on huge counts
The aligned scan boundary is derived from the last valid byte, (s + count - 1). When count is huge (e.g. SIZE_MAX, which FORTIFY strcat/strlcat pass when the destination size is not known at compile time), s + count wraps around and the boundary lands before s, so the ZBB path returns a bogus length. The original implementation ( |
||
Wei-Jie Hung
|
a510e1ae8c |
riscv: patch: fix handling of bpf-jit execmem addresses
Commit |
||
Yong-Xuan Wang
|
6694612317 |
RISC-V: Clear HSTATUS.HU on CPU initialization
The RISC-V privileged specification does not mandate HSTATUS reset values, leaving the HU bit potentially set after hardware reset. When HU=1, hypervisor instructions (HLV/HLVX/HSV) can execute in U-mode to access guest memory, which may cause unintended behavior if not explicitly controlled. Clear HSTATUS.HU during CPU initialization to ensure hypervisor instructions are only available in HS-mode, preventing unexpected guest memory access from U-mode code. Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Reviewed-by: Samuel Holland <samuel.holland@sifive.com> Link: https://patch.msgid.link/20260924-hstatus_hu-v2-1-7e970f5f1d8d@sifive.com Cc: stable@vger.kernel.org [pjw@kernel.org: capitalized RISCV_ISA_EXT_h to fix build; added stable cc] Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
|
Yong-Xuan Wang
|
148ab873d8 |
RISC-V: errata: Add SiFive MAL-9092 workaround
SiFive cores with MAL-9092 require fence.rw instructions around HLV/HLVX/HSV hypervisor instructions to ensure proper memory ordering when accessing guest memory. Note that HSTATUS.HU is cleared during KVM initialization, restricting hypervisor instructions to HS-mode only. If future changes enable HSTATUS.HU for U-mode access, additional errata considerations will be needed. Signed-off-by: Yong-Xuan Wang <yongxuan.wang@sifive.com> Reviewed-by: Samuel Holland <samuel.holland@sifive.com> Link: https://patch.msgid.link/20260817-sifive-errata-v1-1-6a80f1a2743d@sifive.com Signed-off-by: Paul Walmsley <pjw@kernel.org> |
||
Aurelien Jarno
|
55b1276ef9 |
riscv: vector: Fix output operands in context save
The __vstate_csr_save() inline assembly declares vcsr as an output
operand while the assembly only writes vstart, vtype, and vl. Remove it
as it is later saved by the C code.
Fixes:
|
||
Troy Mitchell
|
572b25f3a6 |
riscv: vector: Fix data pointer constraints in context save/restore
The standard vector save/restore asm advances datap but declares it as
input-only. An inlined caller reusing the original pointer may therefore
use the advanced address instead.
Declare datap as read-write so the compiler can preserve the original
pointer when needed.
Fixes:
|
||
|
Arnd Bergmann
|
756724133b |
riscv: limit sifive errata to CONFIG_64BIT
There are two errata for this vendor, and they both individually depend on
CONFIG_64BIT already. However, an 32-bit allmodconfig produces this warning
from clang for a condition that can never be true.
arch/riscv/errata/sifive/errata.c:29:14: error: result of comparison of constant 9223372036854775815 with expression of type 'unsigned long' is always true [-Werror,-Wtautological-constant-out-of-range-compare]
29 | if (arch_id != 0x8000000000000007 ||
| ~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~
arch/riscv/errata/sifive/errata.c:42:14: error: result of comparison of constant 9223372036854775815 with expression of type 'unsigned long' is always true [-Werror,-Wtautological-constant-out-of-range-compare]
42 | if (arch_id != 0x8000000000000007 && arch_id != 0x1)
| ~~~~~~~ ^ ~~~~~~~~~~~~~~~~~~
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://patch.msgid.link/20260916083752.47310-1-arnd@kernel.org
Signed-off-by: Paul Walmsley <pjw@kernel.org>
|
||
|
Zongmin Zhou
|
edba6017c1 |
riscv: hwprobe: use _BITULL() rather than BIT() in MIPS vendor uapi header
BIT() is a kernel-internal macro that is not available to userspace, but
the MIPS vendor extension uapi header uses it without defining or
including it. Any userspace program that includes this header and uses
RISCV_HWPROBE_VENDOR_EXT_XMIPSEXECTL fails to build.
Use _BITULL(0) from linux/const.h instead, which keeps the value at 1,
so there is no ABI change.
Fixes:
|
||
Borislav Petkov (AMD)
|
87db7795cb |
x86/CPU/AMD: Fix AMD TLBI Erratum #1718
The processor may fail to invalidate a TLB entry while executing an
INVLPGB/TLBSYNC instruction pair.
Detect the erratum and apply a software workaround when a microcode fix
is not present.
Fixes:
|
||
|
Linus Torvalds
|
06ac073129 |
x86 architecture fixes [with an UM fix included]:
- Don't apply va_align to hugetlb mappings on AMD F15h systems
that have custom va_align.bits values (Laurent Wandrebeck)
- Fix PMD teardown handling regression flagged by lockdep
(Mikhail Gavrilov)
- Hide ptrace header register offset macros behind __ASSEMBLER__ or
__FRAME_OFFSETS, to fix user-space build errors that may trigger
if they happen to shadow these short and generic macro names
(Nick Desaulniers)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCBfsRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hhvxAAiRvv7gz6K9VIJ7S24PdQOf8VuiuLT4De
JUxTb6tUJ3VQ9+qk0xKSAg10z603PKn2Ow01znUNV5wTrRcumpkKTk39ut+x9Yl5
qLDeLVTI/NFAkrYajtjPq3OrwZKnLcAYoZaM9cWtZIoIVCBVIDAsJgS7lIJbUjQ8
FVvI4UUFaToM79jBMvAA89QOK5FrwO26/ENZLbRyceHzHnPrw/pYObaWpUhUs3S6
r0OS2NRUacDid3s3SrVJqkJ9siZvS1OdVQZZwSSKz7oNPsk3yH5aqkFrLrCZJNsa
VG3gCtb7ZLe3omFDmW9RzCYo5afbaUNbdHDOtameVoAT4h71cPoBr3mzAWDJiNEq
NFu7ICAt7XP9Kvfoa4k0n4HhbYNxH1VAyoXOAiquqpPtsU+ZtG2HhqwZknrqGxM4
9S127eCrAyGN9CLrYgcnZlALd1HUJ/nGHqdaSVxyxhaJxgxu9e717YmgsxXVl79p
uCASyox64F4JrKr1n7Yp08UwfPvsquc8ViTyxsfHCuHj59hLnLfxPefr6N86Ztdc
97yQhb7tDq7z8S8IUQTJuOtcDuqIUdm/VRg6+8SP+hVZquCW2zo0lla24Yi/cS1+
om89Mfy4l9v+VzkBy2TvNU0cLy0ClK1BQTquHALWFuCDDEmJ4vftc7eWV4VQ+Idh
lQDDgs0Q66g=
=j39M
-----END PGP SIGNATURE-----
Merge tag 'x86-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Ingo Molnar:
- Don't apply va_align to hugetlb mappings on AMD F15h systems
that have custom va_align.bits values (Laurent Wandrebeck)
- Fix PMD teardown handling regression flagged by lockdep
(Mikhail Gavrilov)
- Hide ptrace header register offset macros behind __ASSEMBLER__ or
__FRAME_OFFSETS, to fix user-space build errors that may trigger
if they happen to shadow these short and generic macro names
(Nick Desaulniers)
* tag 'x86-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
{x86,um}/uapi/ptrace: Guard register offset macros with __ASSEMBLER__ or __FRAME_OFFSETS
x86/mm: Drop unnecessary PMD page copy when freeing
x86/mm: Don't apply va_align to hugetlb mappings on AMD F15h
|
||
|
Linus Torvalds
|
a27611f899 |
Perf events fixes:
- Fix race between perf_event_exit_task() and perf_pending_task()
(Luo Gengkun)
- Fix perf header output management regressions (Ian Rogers)
- Require kernel access for text poke events (Zhengchuan Liang)
Signed-off-by: Ingo Molnar <mingo@kernel.org>
-----BEGIN PGP SIGNATURE-----
iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmrCAjwRHG1pbmdvQGtl
cm5lbC5vcmcACgkQEnMQ0APhK1hTzw/+IJzVOLjNe2TaHJF20uYtuFVp80FGckH3
qGMQcSSxEsdH2zWgA196UWYCuxcNtq9gRVkBw90u30Tka8F/C57r9fWf2Mx6iUBy
zRrf70Lp4RsACAnM7kscX5ieJvesflYK5Vdr1je7DtQGE9P40Hq/45zquZt1B0uJ
IqMVeDnqR46QIdAc/xNkn6G6FmI4CTJ1znwE1ZUm2HoDJ7Ya3zy0Gm9HNvdTaUN5
IU5HWgNSEyL1id+2hwrv4/f+TPgmFSkJUf/t2hn/Rvzf1eOmRHuB/d8ZEBOEBDxk
H5qeq/CGStzGMZsJprfQ65BGj/8QlXWNI8a6bzTnpAL2Ss9VKFvLvwmWDXmGo+B6
n4+MOevA9LWDuZoSxRWzM00nBFp3h8YxyjSLYScZpoA3t0n45ckA+saK/ZDFBjYZ
meWQX5mVVbktUX39hA/BeR2ps1KuHO8l2hq7BTlyK5nJfC69ptpM3OT2q0Jx/jD2
kWKlhBLBhSObe3PX2uZiHDwXdEzuiMK0VKSYfz7gr0UDFoBbwe0AETOFIN9qhEXC
4Lwln4vBpZTPGcGZYmBiWLS0uesy0mUa+FKzD8pZn7DKh8QY210Z9mr3+Tja3gsV
pVjTs+7cpT9dsfX9z4PuSSnw8VGPfoM6iwGON5byva6Ylss+uL5iCCSQ3+heQFOz
9aDZYLimUj4=
=58mT
-----END PGP SIGNATURE-----
Merge tag 'perf-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events fixes from Ingo Molnar:
- Fix race between perf_event_exit_task() and perf_pending_task()
(Luo Gengkun)
- Fix perf header output management regressions (Ian Rogers)
- Require kernel access for text poke events (Zhengchuan Liang)
* tag 'perf-urgent-2026-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
perf: Require kernel access for text poke events
perf: Replace perf_event_header__init_id with full header init
perf: Fix race between perf_event_exit_task() and perf_pending_task()
|
||
Fuad Tabba
|
b52ef45013 |
arm64/boot: Don't set PMUv3p9 FGT2 bits without PMUv3
On a CPU with FGT2 and an IMPLEMENTATION DEFINED PMU (PMUVer 0b1111),
__init_el2_fgt2 sets the PMUv3p9 bits in HDFGRTR2_EL2 and HDFGWTR2_EL2,
which are RES0 there. The macro only checks that PMUVer is at least
PMUv3p9, and 0b1111 passes.
Exclude 0b1111 before the compare, as __init_el2_debug does.
Fixes:
|
||
|
Linus Torvalds
|
c5adb6c8a2 |
arm64 fixes for -rc6
- Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME -----BEGIN PGP SIGNATURE----- iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmq/tpYQHHdpbGxAa2Vy bmVsLm9yZwAKCRC3rHDchMFjNJ6gB/9ZmDMU4ED2AbyP7T8Q6FttzvH01X85F2yz hlaaXv/2MDzjGSiz0spxDAZOuteJF+WSLj1WjZhlyr95xnQWfumc6D89D+kHeNre +twed6hbOQTWJzLB+u8Ef+4nKGcztIZ/FafFvPD6PKjFuhG048al8X/6oNXetBPy Ka13ywRYhnccflsWaXyWlvSwfKn2xJHOnpu4Mfbsb9DfaULDLLahz2ug+6apwX23 tc/dy40Fi0G6wFzUQGF83R3nsyZgLiOv7LFBjjqDmoiu7W86KXn83UXEwHXrp8de Zbynk7F4Bxf0lsp6y+bxTmwzm8CwI355/NFU2ccxxu17e7Qv6PnJ =TRoC -----END PGP SIGNATURE----- Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux Pull arm64 fixes from Will Deacon: "Half of this is broken hardware (AMU counters and TLB invalidation) and the other half is broken software (frequency scaling and signals). So it seems as though we're all as bad as each other. The AMU workaround is a little noisy, as it refactors an existing workaround so that it can more easily be applied to additional CPUs. Summary: - Fix handling of CPU erratum #2645198 when batching pte updates - Fix truncation of CPU frequency calculation by using 64-bit arithmetic in arch_freq_get_on_cpu() - Work around AMU erratum #3821522 on Cortex-A725 - Fix panic when trying to restore an SVE sigframe on a CPU that only supports SME" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems arm64: errata: Add Cortex-A725 erratum 3821522 workaround arm64: errata: Factor out broken AMU const counter cap arm64: topology: fix arch_freq_get_on_cpu() overflow above 4.19 GHz arm64: mm: Fix the break-before-make flush range for erratum 2645198 |
||
|
Arnd Bergmann
|
8166a32515 |
iMX fixes for 7.3
- Fix incorrect pinmux values for LX2160A. - Fix Sonata SD I/O supply to avoid filesystem I/O errors because the kernel was disabling LDO5 during late init. -----BEGIN PGP SIGNATURE----- iQHFBAABCgAvFiEEJS45w2QNr0ezLVaoNF3oRQ23YkwFAmqylZ8RHGZyYW5rLmxp QG54cC5jb20ACgkQNF3oRQ23Ykyylgv8Di1CV50Pb0BlCL6AYfYAoDnmS0SzfFmE OrW57Lfi3CRq42klg4RfKY1/RoFcpD1ACkynuiiE1gyvRu/+fpsZD3qXh5KB3TYI Pr7zzR55anWgKP6GWGzCMDPnd2UQB0KaxWYYHCjyVFzkx7V6uWZAtlRxKkhIVxra 3hJrw9COfG130WICP6YUXR2ULCUZNWP+l5b/isz2McxkAw1f45x4tJEfAkwb3Cyh 4Yn+QSUto9QFcGUFt3r1V/eFzS8ebSC08679Jn4z9P3VvtjEKqLAG8XQIxYcILBi WBuJz3Nv8nGJUW2UUubSSVBDy/dZYWE4fkjRiK3cT0x3kuzZNZBMRjhVPjL1J02X 39xT7oLUtVwOk9yU45cYRpXLuJPMTUt8SIag+eEy3rXLWcVfBbhsY11atuHKHj+D aah++mqYVRcwQO0ooVsGDSarQ+zi5RmXyhioohB0181S3UAB1r2fln8lpB3vIv4T fiohlbth/ztvfz/sIWCYIGGwrVamgyD5 =JKsd -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAJF8ACgkQmmx57+YA GNmBmw//cBANa1oHA9AsVgTW+60W9fcmOk9rWYDvxawZrE2ufJ+EjcXjQqxlAZ2+ +KUX4tIxSeJdI36djhRCPy62RZW5YeW1zzWhWwQvzVNWYBR/4BdR8J+VaXA4hdu+ 9w+W+dUs/hlJQUuE9JXzuCV36hILRG0PS801WaRKXqdFhFC/PSF289PHUsmgX7lW /dywG9J54tzp/XHSWlXNRSKVgcOOiZAfM/qVf/iPmwrDRetAAUAmsfTosIc707u/ bUUn0hkjJNB7NTJ5wY2N7s9lHECZfR7/8iP9GjqZM1T72O0xFfEfvLt9EbBLpxEo As6GSQXWYiLx0WsjPHcP7b/XH2JI6BN7Ns0OsdRaroICItxlllRsG+C4b90AGoRu SlvQQevjj7n/MVLeos9SzdMnmtIks9IUWuyTuT2kHHGR7uNSgb4i0ez2uaW8nwQI M/ff3nfEO8xm1EeUitYX7ERvCM32mi66KPZepT6RWToO+/NAFFhLtbiXiqyPR9t5 FYnxGltvAOnlNQLjGb/bmcxtNCIoexIALahlZNNU7SiAEXsYxr0lfHJzkVdU9MDs adCDdITRQl6kw3whJCR45ovxVL24/gBgAspAdCuyuySJ5fkJyFEhNgS9UFZ4bcpc K/jrwjZMKyOelaY3NFVF0hjPyXsQbqePXNRvYk6iSlabqxPsSHc= =QdkN -----END PGP SIGNATURE----- Merge tag 'imx-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux into arm/fixes iMX fixes for 7.3 - Fix incorrect pinmux values for LX2160A. - Fix Sonata SD I/O supply to avoid filesystem I/O errors because the kernel was disabling LDO5 during late init. * tag 'imx-fixes-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/frank.li/linux: arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single arm64: dts: lx2160a: fix incorrect pinmux Signed-off-by: Arnd Bergmann <arnd@arndb.de> |
||
|
Arnd Bergmann
|
26fb480bee |
Qualcomm Arm64 DeviceTree fix for v7.3
Fix microphone distortion on Hamoa and Purwa-based Surface Pro 11. -----BEGIN PGP SIGNATURE----- iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmqygIAOHGJqb3JuQGty eW8uc2UACgkQCx85Pw2ZrcWRdA/5AUOlYj3UAcM0xGQEqeYXiMfIOdsyf/q9sCrG TRGZPlyqk+gJLXyxvs21dYzTx2pjf3Z74oriD6UzcAleoJ2qXzcYpEh4HCxf6xMu AREVPnI3QMmQeXl3sKSoehafasLfd1JJ7f496Bj7IOD9Tj4sQQJCyG3l0iQGYeXu 5uOF/0BgbbAYpH4qzsRN4FJePCPymMGbU6cRjuJKbG4VP69jwAyT8QKWTjqi6I44 woW5n1S9SournwN29xBMF7mHlfjTIZ4YpKHrEOrq1JCUjzKptqXWqpENlsTl/Noy fy4eV+ku8FU1TIQaUkawqkyOEbF7AgEPwJYrj545XxrZDM6OcwXtstoxQmfbncmm dCNTk6B2/EfFLBKbErD3BMDIMNvMkr7I2C8mA5W8jgbK7h/TfaulGky6cqM2dugi XxWge41NjRftbyTq/BMV/PJ4IjwwKbEnIKYz5hZIqalClHmrNCYjjjx/jXhf3hTZ KESTthejQguU5KnGjyDtJVP0ey0p7I+n6NlQ87h7qhKjaZvEf0NzUIJAipBFfH/a +X600JcWw5PJ7WwlNe9RdzukpGwup4KjClKi2EGVwG7u3Gpfh6YOvWWBF7YM+Lu2 xBrzYDZ5/3Ovx3apQYFQHAQ8d8Cxxt2N1HxmfFosujrseaFvwTdRk2LmsPUaXjPk NwdfGqQ= =4rAk -----END PGP SIGNATURE----- gpgsig -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmrAJDkACgkQmmx57+YA GNmDYA//aOxUgY9LDwtJQvOgcNtIwp0vI6Ea7XTrZDW5/yAfZ6KbazfOKKyTyPVj 1PqBP6EEkPni0qfI62R8zUaD52tgdnuGp/JXj+PwWnYhPECoUzzFSk3A4c4sVN9X S/VhZsAcS/nUtkUO/vzvtnAsWMfHW1CGMPpmcGgXpFE8SKaRgMsWeaQ25PViZn09 PV4JmhdWwjRHYbbwCVw71FFRLBRAEEd/UAGomczqZWgEFR/rGNodZlBUoVUvYZHd Fb8ENxkg4TClEKLa/G6Sxkursv5hdC3seBI8tGRDniR6ukT6za8wJojdiVcHpL3G vC6tMAb6GJLzEFxRZ711qTDrMWEx2v9IWvgyI6P/el+PE1ek3U9R2ajmdVGCxuBL 9nR0wHAhGfn9HoJmyglXenR5WAJ1ZGoMM8hX3XRTVRUum9kMmaQGSlYeGfq8bWlR K1mhxs5kQ7vGPB9spa2HXjbWBkq7ogTRZeyes8fcX/GPjANpODAsfueXCO4tCkXs imARkdvgD9du1vuVYoGILe2cD79ggoJOHuQZiz+P4Qml/xSfElrh21YB3ed/zLmb +RwAfKRicGFnfG6aO5zssEVanpZzTmx0h6oVZvcXzF5H6y9QQq6eGSpT1Kegcila vGRCkgtkpCi5xoP13zniktocNfW+dQmnwsDPCqLVgFo1df+fsaE= =TD8z -----END PGP SIGNATURE----- Merge tag 'qcom-arm64-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into arm/fixes Qualcomm Arm64 DeviceTree fix for v7.3 Fix microphone distortion on Hamoa and Purwa-based Surface Pro 11. * tag 'qcom-arm64-fixes-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: arm64: dts: qcom: x1-denali: Fix microphone distortion Signed-off-by: Arnd Bergmann <arnd@arndb.de> |