linux-toradex.git/arch/x86/kernel, branch master

x86/ftrace: Mark jmp mode by clearing bit 63 of trampoline address

2026-10-30T21:21:46+00:00

Since commit 0c3772a8db1f ("x86/ftrace: Implement DYNAMIC_FTRACE_WITH_JMP")
ftrace_call_replace() emits a jmp instead of a call when bit 0 of the
target is set, the mark of a direct trampoline that is entered by a jmp.
ftrace_update_ftrace_func() and arch_ftrace_update_trampoline() use it
too, for the call of the ftrace callback in ftrace_caller, ftrace_regs_caller
and the ftrace trampolines, but a callback is a C function and can start
at an odd address. It does with gcc13 and CONFIG_CC_OPTIMIZE_FOR_SIZE=y:
gcc13 has no -fmin-function-alignment, so CONFIG_CC_HAS_SANE_FUNCTION_ALIGNMENT
is not set, and the -falign-functions=16 used in its place does not apply
to functions optimized for size. Here ftrace_ops_list_func() starts at:

  ffffffff810e0147 T ftrace_ops_list_func

ftrace_regs_call then becomes a jmp to the byte before it:

  ftrace_regs_call ffffffff810374f3: e9 4e 8c 0a 00

That byte is the last one of the preceding function's tail jump, and with
the first two of ftrace_ops_list_func() it decodes as an inc DWORD PTR
[rcx+0x57], which swallows the push %r15 of the prologue. Entered without
a return address and one push short, the list function returns through
the pt_regs that ftrace_regs_caller saved, here to the saved R14:

  BUG: unable to handle page fault for address: ffff888116c29f40
  #PF: supervisor instruction fetch in kernel mode
  RIP: 0010:0xffff888116c29f40
  R13: 0000000000000000 R14: ffff888116c29f40 R15: 0000000000000000
  Call Trace:
   ? bpf_trampoline_6442499918+0x1/0x149
   ? bpf_lsm_file_open+0x5/0x8
   ? bpf_lsm_file_open+0x5/0x8
   ? security_file_open+0x19/0x46
   ? do_dentry_open+0x16c/0x32a

The list function is installed whenever two ftrace_ops are registered,
and a function that two of them trace calls it. A kprobe next to a BPF
trampoline is one such case, and with the single ftrace_ops of the BPF
trampolines every update_ftrace_direct_mod() is another, as it registers
a stub ops for the sites it modifies. Here, detaching one of several BPF
LSM programs from a busy hook crashed the tasks that ran the hook during
the update.

Bit 0 is free only in the direct trampolines that a dyn_ftrace record can
point to, but bit 63 is set in every kernel text address on x86_64. Thus,
mark jmp mode by clearing bit 63 instead, so that ftrace_is_jmp() is false
for any callback, whatever its alignment, and ftrace_regs_caller sets the
bit again where it cleared bit 0 before. A marked address is not canonical,
so a return or indirect branch to one that missed ftrace_jmp_get() faults
instead of running from a byte before its target.

Fixes: 0c3772a8db1f ("x86/ftrace: Implement DYNAMIC_FTRACE_WITH_JMP")
Suggested-by: Steven Rostedt 
Signed-off-by: Daniel Borkmann 
Signed-off-by: Alexei Starovoitov 
Reviewed-by: Jiri Olsa 
Reviewed-by: Steven Rostedt 
Link: https://patch.msgid.link/20261028202345.1215859-1-daniel@iogearbox.net

Merge tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-10-29T22:39:45+00:00

Pull hyperv updates from Wei Liu:

 - Update to documents and code comments (Michael Kelley)

 - Harden Vmbus (Kameron Carr)

 - Rework MSHV driver page deposit logic (Mukesh Rathor)

 - Vmbus kexec bug fix (Shradha Gupta)

 - Miscellaneous bug fixes (Daehyeon Ko, Jiale Yao, Sasha Levin)

* tag 'hyperv-next-signed-20261028' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
  Drivers: hv: Remove leftover support for old Hyper-V versions
  mshv: Remove unused *_old memory deposit functions
  mshv: Redesign hypervisor memory deposit logic
  mshv: Rename memory deposit memory functions to _old
  mshv_vtl: reject poll files with multiple waitqueues
  mshv_vtl: detach poll waiter on POLLFREE
  mshv_vtl: initialize poll file mutex before device registration
  Documentation: hyperv: Update information on guest CPU offlining
  Documentation: hyperv: Remove support for guests on Hyper-V 2012/2012R2
  Drivers: hv: Run VMBus kexec cleanup from syscore shutdown
  kexec: Add helper to report an active kexec reboot
  tools: hv: remove unused rte_smp_mb()
  Documentation: hyperv: Update documentation for sending VMBus packets
  Drivers: hv: vmbus: Check ACPI companion before use
  Documentation: hyperv: Describe validation of the ring buffer indices
  Drivers: hv: vmbus: Keep the ring byte counts sane for a bad index
  Drivers: hv: vmbus: Compute ring byte counts from a caller-held snapshot
  Drivers: hv: vmbus: Use *_ONCE() to access shared ring buffer indices
  Drivers: hv: vmbus: Bounds check the shared ring buffer indices

Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-10-27T22:23:17+00:00

Pull more MM updates from Andrew Morton:

- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):

Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.

- "support kselftest on nommu platform" (Hajime Tazaki):

Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.

- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):

Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.

- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):

Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.

- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):

Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.

- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):

Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.

- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):

Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.

- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):

Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.

- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):

Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.

- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):

Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.

- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):

Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.

- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):

Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.

- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):

Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.

- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):

Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.

- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):

Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.

- "mm: various (urgent?) fixes" (David Hildenbrand):

Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.

- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):

Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.

- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):

Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.

- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):

Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.

- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):

Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.

- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):

Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.

- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):

Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.

- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):

Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.

- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):

Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.

Summary of the 65 singletons in this merge:

The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.

Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.

Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.

* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...

Merge tag 'liveupdate-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux

2026-10-26T03:42:42+00:00

Pull liveupdate updates from Mike Rapoport:

 - Several small fixes to KHO and LiveUpdate selftest

 - A series that renames "KHO scratch" to "KHO bootmem" because this
   memory is way more important in kexec'ed kernels rather than in the
   original cold boot kernel and the new name reflects it

* tag 'liveupdate-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux:
  kho: do not reserve empty per-node bootmem areas
  selftests/liveupdate: Prefer KVM and HVF over TCG in vmtest.sh
  kho: rename kho_scratch= commandline parameter to kho_bootmem=
  kho: rename KHO scratch to KHO bootmem
  memblock: rename KHO_SCRATCH to KHO_NOPRSRV
  memblock: get rid of CONFIG_MEMBLOCK_KHO_SCRATCH
  kho: docs: fix scratch_phys debugfs cross-reference
  kho: do not reserve scratch memory in the kdump kernel

uprobes: remove VM_IO, set VM_MIXEDMAP for mapped kernel pages

2026-10-24T08:56:16+00:00

These are not MMIO pages so VMA_IO_BIT is an inappropriate flag to set.

Instead, set them VMA_MIXEDMAP_BIT as they are kernel mappings and this is
the appropriate flag to set for those.

This provides the semantics required - no VMA merging is permitted, but
does not prevent GUP.

However this has no meaningful impact as these are refcounted and thus can
be GUPed.

A previous commit already prevented __mm_populate() from being invoked on
XOL areas, which VMA_IO_BIT was previously relied upon to do, so that is no
longer required.

Both VMAs set a VMA name, so always_dump_vma() returns true before
vma_dump_size() reaches its VMA_IO_BIT check, and thus there is no change
in core dump behaviour.

Change this for both the core xol_add_vma() function and the x86-specific
get_uprobe_trampoline() function.

Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-22-1aa3c9b139f9@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) 
Signed-off-by: Andrew Morton 
Reviewed-by: Suren Baghdasaryan 
Acked-by: David Hildenbrand (Arm) 
Cc: Liam R. Howlett 
Cc: Vlastimil Babka 
Cc: Jann Horn 
Cc: Pedro Falcato 
Cc: Mike Rapoport 
Cc: Michal Hocko 
Cc: Jonathan Corbet 
Cc: Greg Kroah-Hartman 
Cc: Dennis Dalessandro 
Cc: Jason Gunthorpe 
Cc: Leon Romanovsky 
Cc: Paul Moore 
Cc: Stephen Smalley 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Cc: Alexei Starovoitov 
Cc: Daniel Borkmann 
Cc: Andrii Nakryiko 
Cc: Eduard Zingerman 
Cc: Kumar Kartikeya Dwivedi 
Cc: Zi Yan 
Cc: Baolin Wang 
Cc: Nico Pache 
Cc: Ryan Roberts 
Cc: Dev Jain 
Cc: Barry Song 
Cc: Lance Yang 
Cc: Usama Arif 
Cc: Kiryl Shutsemau 
Cc: Doug Gilbert 
Cc: James Bottomley 
Cc: Martin K. Petersen 
Cc: Simona Vetter 
Cc: Helge Deller 
Cc: Sebastian Reichel 
Cc: John Hubbard 
Cc: Peter Xu 
Cc: Masami Hiramatsu 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Ingo Molnar 
Cc: Borislav Petkov 
Cc: Dave Hansen 
Cc: Arnaldo Carvalho de Melo 
Cc: Namhyung Kim 
Cc: Mark Rutland 
Cc: Rik van Riel 
Cc: Harry Yoo 
Cc: Juri Lelli 
Cc: Vincent Guittot 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: Thomas Zimmermann 
Cc: David Airlie 
Cc: Will Deacon 
Cc: Aneesh Kumar K.V 
Cc: Nicholas Piggin 
Cc: Arnd Bergmann 
Cc: Muchun Song 
Cc: Oscar Salvador 
Cc: Matthew Wilcox (Oracle) 
Cc: Jan Kara 
Cc: Marc Zyngier 
Cc: Oliver Upton 
Cc: Catalin Marinas 
Cc: Madhavan Srinivasan 
Cc: Anup Patel 
Cc: Paul Walmsley 
Cc: Palmer Dabbelt 
Cc: Albert Ou 
Cc: Christian Borntraeger 
Cc: Janosch Frank 
Cc: Claudio Imbrenda 
Cc: Alexander Gordeev 
Cc: Gerald Schaefer 
Cc: Heiko Carstens 
Cc: Vasily Gorbik 
Cc: David S. Miller 
Cc: Andreas Larsson 
Cc: Al Viro 
Cc: Christian Brauner 
Cc: Matthew Brost 
Cc: Joshua Hahn 
Cc: Rakie Kim 
Cc: Byungchul Park 
Cc: Gregory Price 
Cc: Ying Huang 
Cc: Alistair Popple 
Cc: Chris Li 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Nhat Pham 
Cc: Baoquan He 
Cc: Youngjun Park 
Cc: Johannes Weiner 
Cc: Qi Zheng 
Cc: Shakeel Butt 
Cc: Axel Rasmussen 
Cc: Yuanchu Xie 
Cc: Wei Xu 
Cc: Chengming Zhou 
Cc: Michal Hocko 
Cc: Miklos Szeredi 
Cc: Xu Xin 
Cc: Ihor Solodrai 
Cc: Bert Karwatzki

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2026-10-23T23:37:12+00:00

Pull KVM updates from Paolo Bonzini:
 "ARM:

   - pKVM state isolation: years after pKVM started being enabled
     upstream, we finally get the basics in the form of state isolation.
     The vcpu state is now off-limit for the host for protected VMs

   - pKVM also grows a hypervisor-private memory allocator, allowing it
     to deal with sub-page allocation, much like everywhere else

   - pKVM also lands a trace_printk() equivalent, which hopefully will
     make debugging a bit easier

   - First shot at annotating portions of the KVM/arm64 code to be
     extracted and built on s390. The real fun is yet to come

   - Allow pre-faulting of stage-2 canonical mappings from userspace,
     joining x86 and s390 in implementing this feature

   - Add a reverse mapping infrastructure for shadow stage-2,
     significantly improving performance when MMU notifiers kick in, and
     avoiding full unmap of all shadow tables for this VM

   - Next step of GICv5 enablement, adding support for the IRS block,
     and providing both SPI and LPI support. This is the first point
     where KVM/arm64 can support an SMP GICv5 guest

   - As a preliminary to eventually enabling CCA, add a bunch of
     infrastructure to KVM/arm64, splitting some of the basic operations
     into individual backends (normal VM, normal pKVM VM, protected pKVM
     VM). This allows CCA to later slot in without polluting the rest of
     KVM with its firmware-driven nonsense

   - Make ID registers immutable from the point where a vcpu is able to
     run, even if it fails to run. This prevents KVM from sampling
     untrusted values

   - Restore some type checking to the EL2 object. KVM/arm64 originally
     had some strong type checking between the kernel and the EL2
     object, but lost it along the way when the private hypercall
     interface was (somewhat pointlessly) converted to SMCCC. Type
     checking is back, syscall style, and with added sparse goodies

   - Expand the FFA support to FFA_NOTIFICATION_*, and add some
     sanitisation of the protocol that pKVM relays to the "trusted"
     runtime

   - Make GICv3 RD assignment more robust to userspace nonsense

   - Convert the remaining MMU fault handler backends to
     kvm_s2_fault_vma_info and co., fixing a number of bugs in the
     process

   - Fix the SError/SEA selftests to be both more robust and less
     braindead

   - Fix a smattering of documentation bugs, some of them as a result of
     our AI friends spitting out credible assertions based on
     non-existing symbols

   - The usual collection of low impact bug fixes (SMCCC, timers, PMU)

  Loongarch:

   - Add separate vmid support

   - Simplify MSI interrupt injection

   - Add crash hypercall support

   - Allow to set pv_feature until vCPU run

   - Enable HW page table walk automatically in selftests

  s390:

   - rework page allocation for secure guest variable storage

   - Selftests and documentation improvements

   - Replace get_zeroed_page with kzalloc

   - Fix corner cases of floating interrupt injection

   - Initial arm64 on s390 support

  x86:

   - Clean up the handling of vcpu->arch.xen.long_mode to be consistent
     and correctly handle 32-bit/64-bit alignment, and various other bug
     fixes have accumulated over the months since v1

   - Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring
     bug where callers fail to do so

   - Fix a variety of issues in the pre-fault code that are mostly
     benign in the current code base, but will show up in big ways
     if/when the pre-faulting logic is used to implementing
     prefetch-on-fault for the TDP MMU

   - For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock
     and just walk the rmaps' with mmu_lock taken. On the write side
     (which always uses mmu_lock), the bit-spinlock was assuming that
     preemption was disabled, but that is *not* true when rwlocks become
     sleepable

   - Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an
     error PFN, e.g. so that userspace can resolve transient issues
     instead of killing the guest. Convert a variety of WARN()+EFAULT
     paths into KVM_BUG_ON()+EIO so that KVM can hard commit to filling
     memory_fault on -EFAULTs that occur in the page fault path

   - Fix a NX hugepage un-accounting bug where KVM would always uncharge
     the shadow MMU, even when handling TDP MMU pages

   - Mask off the address space ID when checking for illegal usage of
     kvm_set_internal_memslot() to prevent false negatives on the sanity
     check

   - Explicitly zero reserved flags when delivering a SynIC message to
     avoid leaking a byte of stack information to the guest

   - Rework TDX's handling of the canonical MMU root level to not rely
     on userspace to fill CPUID correctly, as doing so lets userspace
     trivially trigger a KVM_BUG_ON()

   - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with
     EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to
     configure an 64-bit MMU without PAE

   - Ignore EFER.LMA (clear it from KVM's cached save state) if
     EFER.LME=0 when preparing L2 state, to fix another way to confuse
     KVM's MMU (and because real hardware also ignores EFER.LMA)

   - Improve KVM's sanity checks for a misconfigured MMU to (hopefully)
     detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE

   - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the
     param is only used to avoid what effectively amounts to a single
     memory write

   - Fix a mostly-benign bug where KVM can write through a guest's
     read-only mapping due to not checking the error code when
     expediting emulated MMIO page faults

   - Honor the guest's view of the "EFER.LMSLE must be zero" defeature
     so that userspace can provide migration compatibility between Rome
     and Milan+

   - Pend a KVM_REQ_EVENT request when an exception is morphed into a
     nested VM-Exit, otherwise KVM can fail to actually deliver the
     nested VM-Exit, e.g. when injecting a page fault

   - Add support for PML on SVM

   - Add support for virtualizing Bus Lock Detect on SVM, and fix a
     number of DR6 bugs and warts along the way

   - Fix a variety of warts in KVM's handling of guest TSC, kvmclock,
     and timekeeping in general, as a (big) first step towards
     addressing several longstanding problems with the kvmclock
     implementation. Most notably, fix a precision issue where
     get_kvmclock_ns() computed the clock from the *host* TSC without
     applying guest TSC scaling, causing systemic drift from the values
     the guest computes from its own TSC

   - Rip out KVM's shadow timekeeping structures, now that ktime
     snapshots are powerful enough to replace it

   - Misc fixes and cleanups

  x86 (AMD):

   - Fix a benign-in-practice bug where KVM unintentionally sets a
     non-zero error code when delivering exceptions to SEV-ES+ guests

   - Force a new ASID in both VMCBs on pCPU migration to fix a bug where
     KVM can run a VMCB with a stale ASID due to the tracking being
     per-CPU, not per-VMCB

   - Return INVALID_INPUT to the guest instead of exiting to userspace
     with -EIO if KVM can't access "guest request" buffer, i.e. try to
     keep the guest alive if the guest or userspace goofs

  x86 (Intel):

   - Enable Notify VM-Exits (now called Instruction Timeout in the SDM)
     and Bus Lock VM-Exits for TDX guests when they're enabled by
     userspace (KVM forgot to wire up the TDX Module knobs)

   - Move all common (between VMX and TDX) APIs/helpers to
     common.h/main.c, and change all namespace prefixes from "vmx" to
     "vt"

   - Fix a thankfully benign bug (due to other areas of KVM being
     hardened) where userspace can bypass INIT_MEM_REGION's address wrap
     check by providing a nr_pages that will overflow a u64 when
     converted to bytes, and fix an also- benign off-by-one bug in the
     check (inclusive vs. exclusive)

   - Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace
     sets KVM's mp_state to anything other than HALTED, e.g. so that a
     vCPU doesn't get stuck in HLT if userspace emulates RESET

  guest_memfd:

   - Take the invalidate lock when unbinding a dying file to fix a race
     with kvm_gmem_invalidate_end() that results in KVM leaving the MMU
     invalidation count elevated. Not taking the lock in the first place
     was pure misguided paranoid

   - When binding a memslot, purge the bindings if storing the new
     memslot fails, as Xarray's "store range" API can subtly fail
     partway through

   - Establish memslot<=>guest_memfd bindings *after* the memslot is
     ready, as the memslot becomes reachable the instant the binding is
     installed

   - Don't grab a page refcount when reloading an SNP VMSA and stop
     returning a "struct page" from guest_memfd's PFN lookup altogether,
     to ensure that KVM doesn't hold any unnecessary refcounts (the
     lifetime of the page is ensured by MMU notifiers and similar
     hooks). Preventing unnecessary refcounts greatly simplifies
     supporting in-place SHARED=>PRIVATE conversions

   - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a
     single guest_memfd instance to be used for both PRIVATE and SHARED
     variations of CoCo guests' memory (though not at the same time).
     This eliminates the need to double allocate guest memory for TDX
     and SNP, and is basically a hard requirement for pKVM, which relies
     on being able to preserve memory contents on conversions

   - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning
     -EBUSY if the filemap invalidate lock is contended. Punt on a
     proper fix for the moment, as a proper fix likely involves
     reworking truncate_error_folio()

   - Add a pile of selftests for in-place conversions

   - Misc guest_memfd cleanups

  Generic:

   - Move some configuration items to preprocessor symbols, to help with
     arm-on-s390's need to compile the same code twice with different
     values

   - Allow KVM implementations to choose alternative device names, also
     for s390's support of ARM virtualmachines

   - Switch the KVM-VFIO interface and external consumers over to
     standard file-based reference counting, eliminating all external
     KVM symbol exports

  Selftests:

   - Rework KVM selftest's handling of memory regions all so that PPC
     can force its page table allocations to be naturally aligned

   - PPC support

   - Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match
     real Hyper-V's behavior

   - Saturate L2's TSC frequency if stacking L1 and L2 scaling
     multipliers exceeds what hardware supports, as attempting to run L2
     with an illegal multiplier will either cause VM-Entry to fail (VMX)
     or trigger a #GP when writing MSR_AMD64_TSC_RATIO (SVM). The #GP is
     thankfully benign in the grand scheme as even "unsafe" WRMSRs have
     exception fixup

   - Rework KVM selftest's handling of memory regions so that PPC can
     force its page table allocations to be naturally aligned

   - Clean up selftest's VMX instruction helpers, and drop an absurd
     number of completely useless return values, e.g. functions that
     unconditionally return %true and then have every caller assert
     success

   - Add selftests support for Zhaoxin CPUs

   - Overhaul the TSC scaling test to add a regression test for the
     saturation behavior, and to increase its coverage in general

   - Fix selftests usage various NUMA syscalls to account for an
     undocumented, but known since 2007, off-by-one kernel bug. Add
     helpers to try and avoid re-introducing the same flaws in the
     future

   - Automatically run xAPIC IPI migration test (between NUMA nodes)
     when possible, as the entire point of the test is verify KVM's
     handling of page migration of the APIC backing page

   - Misc cleanups"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (506 commits)
  KVM: always make in-place conversion a compile-time constant when possible
  KVM: x86: leave the legacy private attribute in for TDX and SEV
  KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES
  selftests: kvm: remove useless comma operator
  arm64: Use proper include variant
  MAINTAINERS: Add entry for ARM on s390 KVM
  KVM: s390: arm64: Integrate arm on s390
  KVM: s390: arm64: Implement basic page fault handler
  KVM: s390: arm64: Implement vCPU IOCTLs
  KVM: s390: arm64: Implement vm/vcpu create destroy
  KVM: s390: arm64: Implement required functions
  KVM: s390: Add basic arm64 kvm module
  s390/hwcaps: Report SAE support as hwcap
  KVM: s390: arm64: Introduce host definitions
  s390: Introduce Start Arm Execution instruction
  KVM: s390: Use arm64 code
  s390/tools: Use arm64 headers
  KVM: s390: Use dedicated function for migration mode
  s390/Kconfig: remove PCI dependency from HAS_IOMEM
  KVM: s390: Kick PV cpus at the right time for service irqs
  ...

Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux

2026-10-23T19:32:44+00:00

Pull module updates from Petr Pavlu:

 - Ignore local labels and mapping symbols during module load

   These symbols were already ignored during kallsyms address-to-symbol
   lookups. Filter them out earlier during module loading to reduce
   lookup overhead and prevent them from appearing in /proc/kallsyms.

 - Fix potentially incorrect access of SetOnce when setting Rust
   module parameters.

 - Fix a potential read of an uninitialized count when printing taint
   information for unloaded modules.

 - Allocate the kmod argument array using kmalloc_array() in preparation
   for conversion to type-aware allocators.

 - Clean up includes in linux/kmod.h

   Add explicit includes of linux/umh.h to files that use usermode
   helpers. Then clean up the #include list in linux/kmod.h, notably
   removing the compatibility linux/umh.h include.

 - Remove the error-injection.h include from linux/module.h

   Add explicit includes of linux/error-injection.h to files that use
   the ALLOW_ERROR_INJECTION() macro and currently rely on it being
   provided indirectly via linux/module.h. Then remove the unnecessary
   linux/error-injection.h include from linux/module.h.

 - Replace __MODULE_STRING() with __stringify() in various drivers in
   preparation for removing the former macro.

* tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux:
  drivers: Replace __MODULE_STRING() with __stringify()
  module: Fix uninitialized count read of unloaded taint tracking record
  rust: module_param: Fix potentially incorrect access of `SetOnce`
  module: Remove the error-injection.h include from linux/module.h
  drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION()
  drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION()
  syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION()
  net: Include error-injection.h for ALLOW_ERROR_INJECTION()
  block: Include error-injection.h for ALLOW_ERROR_INJECTION()
  module: Bring includes in linux/kmod.h up to date
  time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ...
  umh, treewide: Explicitly include linux/umh.h where needed
  modules/kmod: Allocate argv with kmalloc_array()
  module/kallsyms: Ignore local labels and mapping symbols during module load
  module/kallsyms: Refactor current symbol filtering into is_core_symbol()
  module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()

Merge tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux

2026-10-23T01:01:57+00:00

Pull hardening updates from Kees Cook:

 - Provide kmalloc_obj*-style API for devm_kmalloc()

 - Improve seq_buf API for saner C String handling with several bug
   fixes along the way (Kees Cook, Bill Wendling)

 - Overflow helper readability improvements (Bill Wendling)

 - Unexport native_write_cr4() (Dennis Chen)

 - um: fix CONFIG_GCOV for built-in code (Johannes Berg)

 - Improve stackinit test coverage (Justin Stitt)

 - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann)

 - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim)

 - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov)

 - Fix randstruct to recognize new container_of() behavior

 - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too

 - Fix a couple remaining allocation return type mismatches

* tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits)
  overflow: Match arithmetic in both parts of __builtin_choose_expr
  lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4()
  extcon: realtek: Remove const from type_c_cfg allocation type
  coresight: cti: Add const to con_groups allocation type
  docs: core-api: Document the seq_buf API
  nvdimm: ndtest: Return the string length from flags_show()
  powerpc/papr_scm: Return the string length from the sysfs show functions
  seq_buf: Add seq_buf_init_append()
  bpf: Remove dead newline stripping from format_disasm_line()
  seq_buf: Add seq_buf_terminate()
  seq_buf: Add seq_buf_strlen()
  seq_buf: Clear what a writer did not claim when a seq_buf overflows
  seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow
  scsi: lpfc: Print rx monitor records straight into the seq_buf
  seq_buf: Do not pop from an overflowed seq_buf
  seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk()
  .get_maintainer.ignore: Add Kees Cook
  devres: Provide kmalloc_obj*-style API for devm_kmalloc
  mm: Move default_gfp() into gfp_types.h
  kunit/stackinit: Clean up XFAIL under instrumentation
  ...

Merge tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core

2026-10-22T04:53:14+00:00

Pull driver core updates from Danilo Krummrich:
 "Core:

   - Add TAINT_FORCED_BIND to taint the kernel and driver module before
     manual sysfs bind/unbind operations; make add_taint_module()
     available to driver core and update taint decoding tools and
     documentation

   - Constify device_show/store_*() attribute parameters and adapt x86
     MCE and perf users to prepare for const dev_ext_attribute instances

   - Fix UAF in NUMA access node registration failure handling by
     dropping the device reference with put_device() instead of directly
     freeing the node

  debugfs:

   - Make debugfs_create_str() read-only to eliminate double-free races
     between concurrent writers; reject writable modes; convert
     interconnect and SoundWire users to local file operations with
     mutex-protected strings

  kobject:

   - Fix out-of-bounds access in kobject_action_type() when parsing
     action strings containing embedded NUL bytes

   - Fix the kobject_set_name() reference in kset_register() kernel-doc

  Rust:

   - DMA:

      - Tie Coherent, CoherentBox and CoherentHandle to the device's
        bound lifetime to prevent retaining DMA allocations beyond
        driver unbind; propagate the lifetime through nova-core and the
        DMA sample driver

   - I/O:

      - Require explicit base types for registers and replace relative
        registers with typed subregion projections; reimplement
        register!() as a proc macro, support registers using existing
        types without inline bitfields, and convert nova-core, Tyr and
        the PCI sample; add AsRepr/AsReprMut and transmute helpers with
        deferred size checks for representation conversions

      - Wrap ResourceSize in a transparent newtype with explicit
        conversions, including checked conversion to usize

   - PCI:

      - Add typed PCIe extended capability lookup and SR-IOV accessors
        for the First VF Offset and decoded VF BAR addresses and widths,
        keeping raw SR-IOV registers private to preserve PCI core
        ownership of their state

   - scatterlist:

      - Honor the device's maximum segment size as well as the DMA
        mapping limit when constructing SG tables

      - Return u32 from SGEntry::dma_len() to match the C segment length
        type

   - misc:

      - Validate auxiliary DeviceId name length explicitly to improve
        compile-time diagnostics for oversized device ID table entries

      - Drop unnecessary 'static bounds from debugfs ScopedDir file
        creation methods to support data containing non-'static
        references, including DMA buffers

  Misc:

   - Add Johan Hovold as driver core maintainer

   - Simplify platform_device_alloc() by returning early on allocation
     failure

   - Fix typos in driver core and kernfs comments"

* tag 'driver-core-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/driver-core/driver-core: (41 commits)
  rust: pci: add extended capability and SR-IOV support
  kobject: Fix the kobj_set_name reference in kset_register() kernel-doc
  rust: io: convert ResourceSize into a transparent newtype
  rust: scatterlist: return u32 from SGEntry::dma_len()
  MAINTAINERS: add myself as driver core maintainer
  debugfs: make debugfs_create_str() read-only
  soundwire: debugfs: replace writable string helper
  interconnect: debugfs: replace writable string helper
  docs: admin-guide: Handle TAINT_FORCED_BIND when parsing /proc/sys/kernel/tainted
  driver core: platform: Simplify platform_device_alloc()
  kobject: fix out-of-bounds access in kobject_action_type()
  rust: scatterlist: honor the device's maximum segment size
  driver core: add TAINT_FORCED_BIND for when userspace manually messes with devices and drivers
  module: fix up documentation for add_taint() and add_taint_module()
  module: pull out add_taint_module() to be public
  driver core: Constify the signature of device_show/store_*()
  drivers: perf: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  x86/mce: Use __DEVICE_ATTR() macro to initialize dev_ext_attribute
  rust: auxiliary: validate DeviceId name length
  driver core: fix typos in comments
  ...

Merge tag 'pm-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm

2026-10-22T00:24:26+00:00

Pull power management updates from Rafael Wysocki:
 "This time, the most visible part are the ACPI CPPC updates from
  Christian Loehle, including CPPC cpufreq driver changes, even though
  updates of cpufreq drivers proper are still the largest topic group.
  However, the updates of cpufreq drivers depend on the ACPI CPPC
  updates, so they should really be counted together and that is well
  over 1/2 of the total commit count.

  Interestingly enough, almost all of the updates included here are
  fixes or cleanups, with some new feature support in the amd-pstate
  cpufreq driver and IPQ9650 support in the qcom-nvmem cpufreq driver.
  The runtime PM documentation improvements from Brian Norris can also
  be mostly regarded as fixes, but a new kunit test goes along with
  them.

  Specifics:

   - Fix multiple issues related to input validation, synchronization,
     access safety, memory layout and register field validation, and
     error handling in the ACPI CPPC library (Christian Loehle and Sumit
     Gupta)

   - Select the frequency-invariance callback per CPU in the CPPC
     cpufreq driver and create the FIE worker before enabling PCC
     callbacks in it to avoid queueing work through a missing worker and
     dereferencing a NULL pointer (Christian Loehle)

   - Update the CPPC cpufreq driver entry in MAINTAINERS and add a new
     entry for the ACPI CPPC library (Christian Loehle)

   - Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel
     Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy,
     Sumeet Pawnikar, and Xueqin Luo)

   - Fix wrong behaviors on multi-node servers in the Loongson cpufreq
     driver (Huacai Chen)

   - Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet
     Koseoglu)

   - Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue)

   - Fixups for a few bugs identified by Sashiko in the amd-pstate
     cpufreq driver (Mario Limoncielloi, Wentao Guan)

   - Initial support for maximum frequency capacity handling on Zen6
     client in amd-pstate (Mario Limonciello)

   - Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS
     option (K Prateek Nayak)

   - New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello,
     Vishal Badole)

   - amd-pstate documentation fix (Karl Mehltretter)

   - Restrict deferred downscaling to low load for shared policies in
     the conservative cpufreq governor to avoid undesirable CPU
     frequency reduction in some cases (Shengming Hu)

   - Serialize sugov_start() against rate limit updates in the schedutil
     cpufreq governor to avoid using a stale rate limit value (Hui Su)

   - Prevent cpuidle governors menu and teo from returning idle state 0
     after it has been disabled (Xueqin Luo)

   - Replace min_t() with the better alternatives in the intel_idle
     driver and make it use 2-argument strscpy() (Andy Shevchenko)

   - Fix two repeated phrase instances in cpuidle (Hemanth Selam,
     Syazwina Fazrul)

   - Add rugged Panther Lake support to the intel_rapl power capping
     driver and make it use %pe for printing error pointers (Srinivas
     Pandruvada and Sumeet Pawnikar)

   - Update and improve runtime PM documentation and add a kunit test
     for supplier idle/suspend (Brian Norris)

   - Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
     to ensure autosuspend disabling on driver teardown (Joshua Crofts)

   - Ignore page-zero RAM in E820 checksum during hibernation on x86 to
     avoid rejecting images created after kexec() (Matthias Goergens)

   - Add resume event mapping for PMSG_POWEROFF to the PM core to allow
     it to carry out device shutdown in the future (Mario Limonciello)

   - Add DPM watchdog to prepare/late/early/noirq/complete phases of
     device suspend and resume (Mayank Rungta)

   - Update swsusp.txt references to swsusp.rst in hibernation
     documentation (Li Jun)

   - Fix use-after-free of perf domain in netlink doit handlers for
     energy models (Fan Wu)

   - Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it
     was removed inadvertently in previous development cycles to avoid
     use-after-free (Bradley Morgan)

   - Unregister CPU PM notifier outside the timer lock in the
     timer-ti-dm clocksource driver (Bradley Morgan)

   - Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc
     comment and typo "hierachy" in a comment in pm-graph (Hemanth
     Selam)

   - Fix the return value in dev_pm_opp_get_of_node() kernel-doc (Karl
     Mehltretter)"

* tag 'pm-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (89 commits)
  cpufreq: loongson3: Replace IOCSR read/write with MMIO ones
  cpufreq: loongson3: Use global physical CPU ID in get/target callbacks
  cpufreq: loongson3: Replace per-package mutex with per-node
  cpufreq: loongson3: Adjust the width of id and val in smc_message
  cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64
  PM: runtime: Expand introduction with core concepts and structure
  cpufreq: schedutil: Serialize sugov_start() against rate limit updates
  MAINTAINERS: ACPI: Add a separate CPPC entry
  MAINTAINERS: cpufreq: Replace CPPC reviewer
  arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend
  cpufreq: mediatek: Enter system sleep at the suspend OPP
  cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing
  cpufreq: qcom-nvmem: Add IPQ9650 support
  cpufreq: Add Milos to cpufreq-dt-platdev blocklist
  cpufreq: Use %pe to print error pointers symbolically
  rust: rcpufreq_dt: add module alias
  cpufreq: sti: avoid NULL dereference in dev_err()
  cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv
  cpufreq: sparc-us2e: fix frequency table index copy-paste error
  rust: cpufreq: reject NULL from cpufreq_cpu_get()
  ...