linux-toradex.git/arch/x86/kernel, branch master

Merge tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-09-14T00:50:28+00:00

Pull x86 fixes from Dave Hansen:
 "The most notable fix is THP not silently losing user data and having
  been around for a couple of years. The main explanation I'd have for
  its longevity is that it requires a few different things to align at
  the same time: MADV_FREE, THP and heavy reclaim.

   - Fix user-space data loss with THP

   - Fix set_memory oopses

   - Fix addition of large constants in mul_u64_add_u64_div_u64()

   - Fix FineIBT hash offset in cfi_get_func_hash()

   - Fix PCI device reference counting in amd_smn_init()"

* tag 'x86_urgent_for_7.3-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/amd_node: Fix PCI device reference counting in amd_smn_init()
  x86/div64: Fix addition of large constants in mul_u64_add_u64_div_u64()
  x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()
  x86/mm: Fix user-space data loss with MADV_FREE and THP
  x86/mm/pat: Allocate split page tables as kernel page tables
  x86/alternatives: Exclude text poking against change_page_attr()
  x86/mm/pat: Acquire init_mm read lock on attribute changes to avoid UAF
  x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

x86/amd_node: Fix PCI device reference counting in amd_smn_init()

2026-09-11T01:05:43+00:00

The local "root" pointer is a temporary variable used during the device
search. Therefore, refcount related to the search iterators should be cleaned
up after the search is complete.

Use the __free() cleanup macro to ensure the refcount is decremented when the
temporary pointer goes out of scope.

Additionally, increment the refcount when caching a root pointer. This ensures
the in-use refcount is separate from the temporary search refcounting.

Finally, drop the redundant "root = NULL" before the second search loop. The
pci_get_class() iterator always decrements the refcount of its "from"
argument, so the first loop can only fall through with "root" already NULL.

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Closes: https://sashiko.dev/#/patchset/20260806160159.230453-1-jason.andryuk%40amd.com
Reported-by: Sashiko 
Assisted-by: LLM
Signed-off-by: Yazen Ghannam 
Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Mario Limonciello (AMD) 
Cc: 
Link: https://patch.msgid.link/20260903154325.74343-1-yazen.ghannam@amd.com

x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()

2026-09-10T09:01:31+00:00

The switch of the FineIBT preamble from "subl $hash, %r10d" to the
shorter "subl $hash, %eax" moved the hash immediate from offset 7 to
offset 5 of the preamble. fineibt_preamble_hash was updated to match,
but the open-coded offset in cfi_get_func_hash() was missed and it
still reads the hash at offset 7.

cfi_get_func_hash() is used by the BPF JIT to give a struct_ops
trampoline the CFI hash of the stub function it stands in for. With
FineIBT the trampoline now gets the upper half of the real hash
followed by the first two bytes of the next instruction, so the first
indirect call from the kernel into a struct_ops program,
tcp_init_congestion_control() calling ->init() of a BPF congestion
control for example, fails the FineIBT check and the kernel dies with
a CFI failure.

Move the FineIBT preamble template and its offset defines above
cfi_get_func_hash() and use fineibt_preamble_hash there, so every
reader of the preamble shares one definition of its layout. The
CFI_FINEIBT arm is only built with CONFIG_FINEIBT, the only
configuration in which cfi_mode can take that value.
cfi_get_func_arity() does not need the same treatment: the __bhi_args
call whose displacement it reads still ends at the function address.

Fixes: 85a2d4a890dc ("x86,ibt: Use UDB instead of 0xEA")
Assisted-by: LLM
Signed-off-by: Soheil Hassas Yeganeh 
Signed-off-by: Peter Zijlstra (Intel) 
Cc: stable@vger.kernel.org # 6.18+
Link: https://patch.msgid.link/20260831-b4-x86-cfi-fineibt-func-hash-v1-1-6ffc0af5c4ec@gmail.com

x86/alternatives: Exclude text poking against change_page_attr()

2026-09-09T06:39:10+00:00

From time to time, the following BUG can be observed
in the x86 alternatives patching code [0]:

  > kernel BUG at arch/x86/kernel/alternative.c:2576!
  > Oops: invalid opcode: 0000 [#1] SMP NOPTI
  > CPU: 0 UID: 0 PID: 355 Comm: (udev-worker) Not tainted 7.1.3-1-default #1 PREEMPT(full) openSUSE Tumbleweed  8c1795b03ec64f997e57a8ad38b1161e3b98da64
  > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS unknown 02/02/2022
  > RIP: 0010:__text_poke+0x2aa/0x450
  > Call Trace:
  >  
  >  smp_text_poke_batch_finish+0x2a7/0x320
  >  __static_call_transform+0xb7/0x220
  >  arch_static_call_transform+0x5b/0xb0
  >  __static_call_init+0xe9/0x270
  >  static_call_module_notify+0x11f/0x150
  >  notifier_call_chain+0x61/0xe0
  >  blocking_notifier_call_chain_robust+0x63/0xc0
  >  load_module+0x1c92/0x20c0
  >  init_module_from_file+0xd8/0x140
  >  idempotent_init_module+0x100/0x2f0
  >  __x64_sys_finit_module+0x71/0xe0
  >  do_syscall_64+0xe1/0x610
  >  entry_SYSCALL_64_after_hwframe+0x76/0x7e

which matches the following BUG_ON() in alternative.c:

	/*
	 * If something went wrong, crash and burn since recovery paths are not
	 * implemented.
	 */
	BUG_ON(!pages[0] || (cross_page_boundary && !pages[1]));

This can happen if vmalloc_to_page() fails, for any reason. Such can happen
if text poking races with CPA, which can possibly result in the collapsing
of page tables (or breaking of PMD hugepages). It is not a problem for most
users of vmalloc_to_page() (they solely own the vmalloc'd range) but, when
CONFIG_ARCH_HAS_EXECMEM_ROX=y, various modules own a single execmem vmalloc
range, and can call set_memory_*() in parallel on it. This can happen to
race against __text_poke and cause havoc in vmalloc_to_page().

Fix it by excluding against CPA using the init_mm mmap read lock.

[ dhansen: Fix up SoB ordering. The actual code flow here was:
	   Pedro=>Lorenzo=>Mike=>Me which is reflected in the SoB chain
	   now. I *believe* Mike simply picked up Lorenzo's update to
	   Pedro's post from the Link ]

Fixes: 64f6a4e10c05 ("x86: re-enable EXECMEM_ROX support")
Reported-by: Jiri Slaby 
Reported-by: Steffen Dirkwinkel 
Signed-off-by: Pedro Falcato 
Signed-off-by: Lorenzo Stoakes (ARM) 
Co-developed-by: Lorenzo Stoakes (ARM) 
Signed-off-by: Mike Rapoport (Microsoft) 
Signed-off-by: Dave Hansen 
Signed-off-by: Ingo Molnar 
Tested-by: Jiri Slaby 
Tested-by: Atish Patra 
Tested-by: Nikunj A Dadhania 
Cc: stable@vger.kernel.org
Link: https://bugzilla.opensuse.org/show_bug.cgi?id=1271202 [0]
Link: https://lore.kernel.org/linux-mm/555ea1d43a12c30a8f1eaf10c899b3790d728f33.camel@dirkwinkel.cc/
Link: https://patch.msgid.link/20260813-cpa-fixes-v2-3-39b4ff90f91d@kernel.org

Merge tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-09-08T19:54:56+00:00

Pull x86 fixes from Dave Hansen:
 "These are fixes for some older AMD device topology and machine check
  issues. But, they are issues that are affecting real users and aren't
  just cleaning up AI drive-by reports.

  These is coming a wee bit later than the usual Sundays because of a
  late breaking issue with one of the patches which is now temporarily
  kicked out"

* tag 'x86_urgent_for_7.3-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/MCE/AMD: Fix inverted interrupt enablement during storm handling
  x86/amd_node: Fix potential NULL pointer dereference
  x86/amd_node: Avoid divide by zero on virtualized systems

x86/MCE/AMD: Fix inverted interrupt enablement during storm handling

2026-09-08T07:16:32+00:00

mce_amd_handle_storm() currently does the opposite of what storm
handling needs: it enables thresholding interrupts when a storm is
detected and disables them when the storm subsides.

Flip the "on" function argument before passing it to threshold_restart_bank()
as it should have been done.

To clarify: "on" to mce_handle_storm() means, the storm is on now when
"on" is true, and off when "on" is false.

  [ bp: Simplify. ]

Fixes: 5c4663ed1eac ("x86/mce: Handle AMD threshold interrupt storms")
Signed-off-by: Jasjeet Rangi 
Signed-off-by: Borislav Petkov (AMD) 
Signed-off-by: Ingo Molnar 
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260812221514.598842-2-jrangi@purestorage.com

x86/amd_node: Fix potential NULL pointer dereference

2026-09-08T07:16:22+00:00

amd_smn_read/write() are exported functions around __amd_smn_rw(), so
they are always available even if amd_smn_init() fails. In that case,
'amd_roots' is NULL and __amd_smn_rw() will access uninitialized memory.

Then, commit:

  83518453074d ("x86/amd_node: Add SMN offsets to exclusive region access")

added the 'smn_exclusive' flag, which indicated the calls to
pci_request_config_region_exclusive() succeeded, to prevent
concurrent userspace access.

Commit:

  0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")

re-ordered initialization so pci_request_config_region_exclusive() is
called earlier and a failure exits amd_smn_init() before allocating
'amd_roots'. The setting of 'smn_exclusive' moved to the end of
amd_smn_init(), after 'amd_roots' is allocated. It became redundant
and can be removed.

Replace 'smn_exclusive' with directly checking 'amd_roots', to fix a
potential NULL pointer dereference and to simplify the logic.

  [ bp: Reorg commit message, touchup comment. ]
  [ mingo: Rebase & further touchups. ]

Fixes: 77466b798d59 ("x86/amd_node: Remove dependency on AMD_NB")
Signed-off-by: Jason Andryuk 
Signed-off-by: Borislav Petkov (AMD) 
Signed-off-by: Ingo Molnar 
Reviewed-by: Yazen Ghannam 
Reviewed-by: Mario Limonciello (AMD) 
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260825214805.39148-3-jason.andryuk@amd.com

x86/itmt: Don't make ITMT enablement depend on debugfs

2026-09-02T07:17:50+00:00

sched_set_itmt_support() treats debugfs file creation failures as fatal.
When CONFIG_DEBUG_FS is disabled, debugfs stubs return ERR_PTR(-ENODEV),
causing ITMT to be silently disabled.

debugfs is a debug-only facility; its return values should be ignored.
Drop the fatal error handling and enable ITMT unconditionally.

Fixes: d04013a4b21b ("x86/itmt: Move the "sched_itmt_enabled" sysctl to debugfs")
Reported-by: Klaus Kusche 
Signed-off-by: Mario Limonciello 
Signed-off-by: Peter Zijlstra (Intel) 
Reviewed-by: Tim Chen 
Reviewed-by: K Prateek Nayak 
Tested-by: K Prateek Nayak 
Link: https://patch.msgid.link/20260831053836.1881864-1-mario.limonciello@amd.com

x86/amd_node: Avoid divide by zero on virtualized systems

2026-08-31T01:25:42+00:00

On a virtualized system, the number of nodes does not have a relationship to
the number of roots.  A Xen PVH dom0 can calculate roots_per_node as 0, which
crashes with a divide by zero in:

  if (count++ % roots_per_node)

because the underlying topology code on Xen ends up making num_nodes
2 and num_roots 1 and the integer division result is 0.

The issue is seen with Xen, but it could affect other systems.

Set roots_per_node to 1 in this case. Print a firmware bug when this is
performed for non-virtualized systems.

  [ bp: Massage commit message. ]

Fixes: 0a4b61d9c2e4 ("x86/amd_node: Fix AMD root device caching")
Suggested-by: Borislav Petkov 
Signed-off-by: Jason Andryuk 
Signed-off-by: Borislav Petkov (AMD) 
Reviewed-by: Yazen Ghannam 
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260825214805.39148-2-jason.andryuk@amd.com

Merge tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-08-26T23:47:40+00:00

Pull hyperv updates from Wei Liu:

 - Decrypt netvsc buffer on contiguous direct-map addresses (Kameron
   Carr)

 - Drop WS2012/2012R2 & Win8/8.1 Hyper-V support (Michael Kelley)

 - Use more meaningful errnos for hypercall status code (Hardik Garg)

 - Fix lost interrupts on CPU hot-unplug for Hyper-V PCI/MSI (Naman
   Jain)

 - Reserve more MSHV vectors for Linux root partition (Wei Liu)

* tag 'hyperv-next-signed-20260826' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  clocksource: hyper-v: Remove support for stimer interrupts in message mode
  scsi: storvsc: Remove support for storvsc protocol of old Hyper-V hosts
  hv_netvsc: Remove GPADL teardown special case for old Hyper-V hosts
  hv_sock: Remove check for old Hyper-V hosts
  Drivers: hv: Remove support for WS2012/2012R2 & Win8/8.1 version of Hyper-V
  hv_netvsc: Allocate send/receive buffers using vmbus_alloc_buffer()
  Drivers: hv: vmbus: Add vmbus_alloc_buffer()/vmbus_free_buffer() for CoCo VMs
  Drivers: hv: vmbus: add vmbus_establish_gpadl_caller_decrypted()
  Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition
  x86/hyperv: reserve more vectors
  PCI: hv: Set irq_retrigger callback for the Hyper-V PCI MSI irqchip
  Drivers: hv: Use meaningful errnos for hypercall status codes