Pull more KVM updates from Paolo Bonzini:
 "ARM64:

   - Fix a couple of embarrassing merge mistakes in kvmarm-7.4

   - Cleanup the HCR_EL2 bit fields to exclusively use the generated
     definitions, fixings a nasty regression introduced in 6.16, where
     barriers were not upgraded from NSH to ISH anymore

   - Fix publication of state when a vcpu is forced out of the guest

   - Let vcpu pausing nest correctly

   - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the
     architecture

   - Don't warn on SMCCC filter reserved range allocation failure

   - Prevent GICv5 and TLBI hypercalls to be used from the host when
     pKVM is active

   - Enforce that only GICv3 guests are supported for pKVM

   - Don't try to access GICv5 EL2 sysregs from EL1

   - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
     by checking the feature dependencies

   - Require matching VGIC and ITS model

   - Cleanup TRACE_REMOTE dependencies

   - Fix random comments

  ARM64 selftests:

   - selftests: Skip unwritable ID fields in the failed-run test

   - Move pkvm_selftests() after all CPUs have initialized EL2

  RISC-V:

   - Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest

   - Implement KVM_PRE_FAULT_MEMORY ioctl()

   - Replace imsic switch-case macros with range checks

  RISC-V fixes:

   - Avoid redundant interrupt check for pending timers

   - Reject vCPU creation after AIA initialization

   - Fix build with vector support disabled

   - Fix IPI delivery for out-of-order vcpu_id

   - Use a raw lock for IMSIC wakeup state

   - Reject vCPU creation after AIA initialization

  RISC-V selftests:

   - Lazy V-extension enablement for KVM selftests

   - Show sepc/scause/stval CSRs in KVM selftests vcpu dump"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits)
  KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC
  KVM: arm64: vgic: Require matching VGIC and ITS models
  KVM: arm64: gic-v5: Drop unused addr variable
  KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
  KVM: arm64: selftests: Skip unwritable ID fields in the failed-run test
  tracing/remotes: Fix TRACE_REMOTE build when TRACING=n
  KVM: arm64: Move pkvm_selftests() after all CPUs have initialized EL2
  KVM: arm64: Get rid of compatibility HCR_EL2 aliases
  KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz
  KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests
  KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch
  KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1
  KVM: arm64: Validate the host-provided vgic model in pKVM
  KVM: arm64: Reject the stage-2 flush hypercalls under pKVM
  KVM: arm64: Return on kvm_gmem_get_pfn() failure in gmem_abort()
  KVM: riscv: selftest: add Zicclsm, Ziccamoa, Ziccif, Za64rs
  RISC-V: KVM: Allow Zicclsm, Ziccamoa, Ziccif, Za64rs in guest
  MAINTAINERS: name the kvm-riscv/linux riscv_kvm_next branch
  RISC-V: KVM: Don't write MMIO load result to x0
  RISC-V: KVM: Use a raw lock for IMSIC wakeup state
  ...

Pull arm64 fixes from Catalin Marinas:
 "Three fixes that turned up during the merging window: shadow stack not
  freed during a failed fork or it is unmapped from parent when a worker
  thread exits (same commit covers both); PTE_CONT set on PROT_NONE
  entries but subsequently ignored by the unfolding code since
  pte_valid() is false (pte_present() is true); an MPAM lock not
  released on the error path.

  Summary:

   - Release the GCS on a failed fork.

     copy_thread() can allocate a GCS for CLONE_VM threads but a later
     copy_process() failure left the VMA in the parent's mm. Implement
     exit_thread() to free it and stop kernel threads and user workers
     inheriting the parent's GCS base/size. Add a kselftest for the
     clone3() failure case

   - Do not set PTE_CONT on invalid PTEs in contpte_set_ptes().

     Batched set_ptes() of present-invalid entries (e.g. PROT_NONE)
     created contpte groups that the single-PTE helpers did not unfold,
     corrupting a neighbouring guard marker via
     test_and_clear_young_ptes()

   - Release the MPAM mon_sel lock on the mpam_save_mbwu_state() error
     paths"

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  selftests/arm64: GCS must not leak on a failed clone3
  arm64/gcs: release GCS on failed fork
  arm64/mm: restrict transparent contpte mappings to valid PTEs
  arm_mpam: Release the mon_sel lock on mpam_save_mbwu_state() errors

Pull more MM updates from Andrew Morton:

 - "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
   Stoakes):

   Replace VM_SPECIAL with helpers describing mapping ownership and
   behavior. Enforce the mmap flag rules and convert affected drivers,
   removing ambiguous tests shared by driver mappings and ordinary
   memory.

 - "support kselftest on nommu platform" (Hajime Tazaki):

   Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
   to avoid its fork-dependent timeout command and document the build
   and runtime requirements.

 - "mm/collapse: separate a collapse from its callers" (Kiryl
   Shutsemau):

   Separate huge-page collapse from caller policy. Replace khugepaged
   identity checks with explicit permissions, and separate scanning from
   collapse with the mmap_lock drop in one place.

 - "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
   Stoakes):

   Provide a common helper for testing whether a VMA has anonymous
   reverse mappings. Document the locking rules, annotate intentional
   concurrent reads for KCSAN, and convert the core MM callers.

 - "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
   (David Hildenbrand):

   Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
   Simplify sparse memory initialization, section metadata handling and
   related PFN validity checks.

 - "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):

   Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
   been unusable since the NO_BOOTMEM conversion, leaving only the code
   and data overhead.

 - "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
   Song):

   Unify the generic device DAX and HugeTLB vmemmap population paths and
   shared tail-page handling. Remove the duplicate DAX machinery while
   retaining the powerpc radix implementation.

 - "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
   Yun):

   Fix huge-page split tests racing with khugepaged recollapse. Use
   pagemap and page flags instead of VMA-boundary assumptions which fail
   when glibc has already enabled THP.

 - "memcg: move memcgid refcount to objcg to unpin dying memcgs"
   (Bingfang Guo):

   Let dying memcgs be freed while swapped-out shmem still holds their
   IDs. Move ID references to reparentable objcgs, with the necessary
   swap accounting and RCU lifetime changes.

 - "mm/truncate: fix data loss when truncating straddling large folios"
   (Zhang Yi):

   Preserve out-of-range data when truncating straddling large folios.
   Fix a lookup race and split-failure handling, and handle minimum
   folio orders for the forthcoming ext4 iomap buffered I/O path.

 - "mm/damon: introduce damos quota goal target metric complement flag"
   (SJ Park):

   Let DAMOS quota goals use a metric's complement, so utilization can
   also express free-memory goals without adding separate metrics. Add
   the sysfs interface, documentation and tests.

 - "arm64/mm: Standardize printing for pgtable entries" (Anshuman
   Khandual):

   Use the generic formatter for arm64 page-table entries, ready for
   future wider entries. Move the safe-PTE-update check out of the
   header to avoid an include cycle.

 - "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):

   Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
   Free backing pages before removing their mappings, and share the
   teardown with partial-allocation cleanup.

 - "mm/damon/core: preserve quota state when constructing schemes" (Karl
   Mehltretter):

   Preserve running DAMOS quota state while validating parameter
   updates. Even rejected updates could reset accounting and exceed the
   quota window; add tests for both accepted and rejected updates.

 - "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):

   Fix vmalloc_dump_obj() lookups for last-page addresses and
   allocations spanning vmap zones. These allocations were being missed
   in diagnostic output.

 - "mm: various (urgent?) fixes" (David Hildenbrand):

   Fix mmap charge leaks and hugetlb use-after-free, wrong-address
   unmapping, stuck locks and endless faults. Also preserve reservations
   on failed mremap and handle stale userfaultfd bits.

 - "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
   Charisis):

   Fix pointer and metadata confusion during RCU destruction of
   maple_range_64 nodes, avoiding double frees and invalid accesses. Add
   a regression test; no in-tree user currently uses this combination.

 - "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
   Li):

   Fix hugetlb migration and preallocation accounting so /proc/vmstat
   retains the correct count and memory.numa_stat follows the folio to
   its new node.

 - "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):

   Fix 32-bit DAMON age overflow which made old regions look young.
   Share hugetlb folio acquisition code and add a regression test for
   the previously fixed last-region skipping bug.

 - "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
   Park):

   Reduce kdamond stack usage and remove unused enums. Add deterministic
   PSI quota-goal tests which do not depend on the machine's current
   memory pressure.

 - "mm/damon: fix the temporal goal tuner's size quota conversion"
   (Donggeun Yoo):

   Bound the temporal tuner's quota conversion to prevent overflow and
   zero effective quotas, which could stop schemes making progress. Add
   boundary tests.

 - "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):

   Remove redundant GFP_DMA flags from coherent DMA allocation calls.
   The DMA API already selects the zone from device limits and ignores
   the caller's flag.

 - "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
   Yun):

   Propagate child-process failures in the khugepaged tests and prevent
   background collapse from racing their checks. This removes false
   passes and intermittent failures.

 - "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
   (Enze Li):

   Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
   the right maintainers. Also label the closing hugetlb_cgroup.h
   include guard.

Summary of the 65 singletons in this merge:

  The singletons include a few worthwhile performance fixes. Avoiding
  unnecessary reverse-map tree updates gave a reported 15.9% improvement
  in UnixBench's execl test on a 192-core x86 system. A reclaim retry
  fix stops defrag_mode from spinning under memory.low protection; a
  reported file-creation stress test ran 5.7 times faster, with far less
  memory pressure. Narrower hugetlb invalidations also spare KVM guests
  needless refaults: the reported Redis-in-VM P99 QPS penalty while
  punching holes fell from 7.09% to 1.45%.

  Several fixes prevent lost data or corrupted memory. Lazyfree
  huge-page races with mremap()/munmap() could lose data or access freed
  memory, and MADV_COLD could lose a concurrent write's dirty bit.
  Another fix prevents stale migration entries from outliving large
  folios. On filesystems with blocks smaller than a page, extending a
  file by 4 GiB or more could expose bytes written past the old EOF
  through mmap instead of zeroes. That is fixed, along with
  use-after-free races in PAGEMAP_SCAN during process exit and in
  memory-cgroup accounting on PREEMPT_RT kernels.

  Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
  which could wedge other memory operations, and stop mremap() leaking
  commit charges until allocations fail under strict overcommit. A
  further fix keeps userfaultfd tracking intact on neighboring mappings.
  NUMA binding no longer prevents long-term pins when the chosen node
  has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
  registration failures. MGLRU also gets a fix for early-boot crashes
  with memory cgroups disabled at boot, notably in small crash kernels.

* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
  mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
  mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
  mm/memcontrol: publish null pointer before dropping css reference
  test_maple_tree: test maple_range_64 node in RCU mode
  maple_tree: fix maple_range_64 crashes in RCU mode
  mm/vma: avoid broken uffd merge on mremap
  tools/testing/shared: catch a failed posix_memalign()
  mm/damon/core: remove unreachable damos charge_{target,addr}_from
  mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
  riscv: mm: exclude invalid THP PMDs from page table check
  mm/damon/core: filter out damos address filter-split failed region
  fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
  mm/mempolicy: apply bind policies against the scoped allocation zone
  mm/vmscan: reclaim every zone in per-node proactive reclaim
  mm/mremap: correctly uncharge accountable VMAs in error path
  mm/mremap: populate calculated fields in vrm state correctly
  MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
  mm: bdi: reset min_ratio after the sysfs attributes are gone
  mm/page_vma_mapped: continue past nonmatching huge PMDs
  selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
  ...

The transparent contpte layer treats PTE_CONT as software grouping state.
When a valid PTE has PTE_CONT set, the contpte helpers may align an
operation to a CONT_PTE_SIZE block and operate on the whole block. The
current single-PTE helpers use pte_valid_cont() to identify such groups;
this is a helper contract, not an architectural restriction on using
PTE_CONT with present-invalid descriptors. Explicit users such as hugetlb
manage their contiguous encodings separately.

contpte_set_ptes() currently sets PTE_CONT from alignment alone. Batched
set_ptes() users can therefore install present-invalid PTEs with
PTE_CONT set, for example mprotect(PROT_NONE), NUMA hinting through
modify_prot_commit_ptes(), fork() copying a PROT_NONE large folio, or a
PMD split installing PAGE_NONE PTEs.

This is not a hardware programming problem: invalid descriptors are not
translated, so the hardware ignores descriptor bits such as PTE_CONT. It
is a software-state problem. Some arm64 fast paths, such as
test_and_clear_young_ptes(), test pte_cont() directly instead of
pte_valid_cont().

In the observed failure, mprotect(PROT_NONE) installed a full
CONT_PTE_SIZE range of present-invalid PTEs with PTE_CONT set.
MADV_GUARD_INSTALL then zapped one PTE. The nr == 1 clear_full_ptes()
path only unfolds pte_valid_cont() entries, so the neighbouring
present-invalid entries kept PTE_CONT while the target entry became a
guard marker.

clear_refs_pte_range() then reached the marker through:

  ptep_test_and_clear_young()
  test_and_clear_young_ptes()
  contpte_test_and_clear_young_ptes()
  contpte_align_addr_ptep()
  __ptep_test_and_clear_young()

The marker changed from old_pte=0x00000000000047c0 to
new_pte=0x00000000000043c0 by clearing PTE_AF. For swap PTEs, bit 10 is
part of the swap type field, bits 6-10: 0x47c0 is SWP_PTE_MARKER with
offset 4, while 0x43c0 has type 15 and is decoded as an ordinary swap
entry. Zap later warned in swap_put_entries_direct() with a bad swap
entry.

Present-invalid PTEs could retain PTE_CONT as software grouping state,
but their single-PTE modification paths would then need to recognize
and unfold those groups consistently. Since current helpers mostly use
pte_valid_cont() for membership, avoid creating present-invalid
transparent contpte groups in contpte_set_ptes(). They bring no hardware
benefit while invalid, and eligible valid ranges can be grouped again
when they are installed.

The public set_ptes() wrapper already clears PTE_CONT before calling
contpte_set_ptes(). Return invalid PTEs through __set_ptes() directly,
and warn if a future direct caller unexpectedly passes an invalid PTE
with PTE_CONT set.

This is triggerable by a user process against its own address space. On
systems running with panic_on_warn, the warning becomes a denial of
service.

Fixes: 4602e5757bcc ("arm64/mm: wire up PTE_CONT for user mappings")
Cc: stable@vger.kernel.org
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Tested-by: Lance Yang <lance.yang@linux.dev>
Signed-off-by: Zhao Gongyi <zhaogongyi@bytedance.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

* kvm-arm64/misc-fixes-7.4-1:
  : \
  : Misc fixes:
  :
  : - Don't warn on SMCCC filter reserved range allocation failure
  :
  : - Correctly prevent GICv5 and some TLBI hypercalls to be used from
  :   the host when pKVM is active
  :
  : - Enforce that only GICv3 guests are supported for pKVM
  :
  : - Don't try to access GICv5 EL2 sysregs from EL1
  :
  : - Cleanup TRACE_REMOTE dependencies
  :
  : - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E
  :   by checking the feature dependencies
  :
  : - Fix random comments
  : /
  KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E
  tracing/remotes: Fix TRACE_REMOTE build when TRACING=n
  KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch
  KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1
  KVM: arm64: Validate the host-provided vgic model in pKVM
  KVM: arm64: Reject the stage-2 flush hypercalls under pKVM
  KVM: arm64: Reject the GICv5 CPU interface hypercalls under pKVM
  KVM: arm64: Don't WARN on SMCCC filter reserved range allocation failure

Signed-off-by: Marc Zyngier <maz@kernel.org>

* kvm-arm64/cross-vcpu-sync:
  : \
  : Fix a number of issues related to publication of state when a vcpu
  : is forced out of the guest, address other problems related to the
  : nesting and overhead of pausing the VM, and apply all of that to
  : some of the nasty corners of the VGIC handling.
  :
  : This eventually simplifies the handling of operations that are
  : inherently racy by pausing the involved vcpus.
  : /
  KVM: arm64: vgic-its: Remove the pending state of a discarded LPI
  KVM: arm64: vgic-its: Don't map an LPI from more than one event
  KVM: arm64: vgic-its: Stop the VM when handling MOVALL
  KVM: arm64: vgic: Stop the target vcpu when disabling LPIs
  KVM: arm64: Add helpers to halt a vCPU
  KVM: arm64: Turn vcpu->arch.pause into a counter
  KVM: arm64: Move IN_GUEST_MODE ahead of state being loaded
  KVM: arm64: Move OUTSIDE_GUEST_MODE publication past context being saved
  KVM: arm64: nv: Move L2->L1 switch on interrupt early

Signed-off-by: Marc Zyngier <maz@kernel.org>

* kvm-arm64/hcr-cleanup:
  : \
  : Cleanup the HCR_EL2 bit fields to exclusively use the generated
  : definitions. This also fixes a nasty regression introduced in
  : 6.16, where barriers were not upgraded from NSH to ISH anymore.
  : /
  KVM: arm64: Get rid of compatibility HCR_EL2 aliases
  KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz
  KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests

Signed-off-by: Marc Zyngier <maz@kernel.org>

KVM uses the VM's ID registers as the source of truth for what the
guest has, but userspace can expose S1PIE or S1POE without the features
they imply. As per the architecture, both imply TCR2 and ATS1A, and
S1POE also implies HPDS. With TCR2 hidden, the world switch skips
PIR_EL1, PIRE0_EL1 and POR_EL1 while KVM doesn't trap them, so the guest
accesses registers that are neither trapped nor switched. Under VHE,
that leaks values between guests. On nVHE and hVHE, pKVM included, the
host kernel resumes with the guest's PIR_EL1 and PIRE0_EL1.

On first run, clear S1PIE and S1POE from the VM's ID registers when the
features they imply are missing, before anything derives state from
them. The guest and userspace then see neither feature, and the guest's
accesses to their registers UNDEF.

Fixes: 70ed7238297fb ("KVM: arm64: Sanitise ID_AA64MMFR3_EL1")
Fixes: d4a89e5aee23e ("KVM: arm64: Expose S1PIE to guests")
Reported-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20260930-arm64-gcs-v21-2-3556644cd927@kernel.org
Link: https://lore.kernel.org/r/8633u229lq.wl-maz@kernel.org
Cc: stable@vger.kernel.org
Co-developed-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Link: https://patch.msgid.link/20261020064306.1542865-1-fuad.tabba@linux.dev
Signed-off-by: Marc Zyngier <maz@kernel.org>

init_subsystems() installs the hyp vector on all CPUs. By running
pkvm_selftests() in init_hyp_mode(), there's a risk for a migration to a
CPU where the hyp stub is still in place which would fail to run one of
the HVCs necessary for the selftest.

While init_subsystems() is the earliest we can call pkvm_selftests(),
move it to finalize_pkvm() to avoid having to export the selftest
function out of pkvm.c.

Fixes: bd93068340e9 ("KVM: arm64: Add selftests for the pKVM heap allocator")
Reported-by: Fuad Tabba <fuad.tabba@linux.dev>
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Link: https://patch.msgid.link/20261019094258.1582756-1-vdonnefort@google.com
Signed-off-by: Marc Zyngier <maz@kernel.org>

Now that we dropped out reliance on the old HCR_EL2 aliases, do the
right thing and purge the kernel of the compatibility definitions.

Reviewed-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Fuad Tabba <fuad.tabba@linux.dev>
Tested-by: Itaru Kitayama <itaru.kitayama@fujitsu.com>
Link: https://patch.msgid.link/20261015173605.1072963-3-maz@kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>