linux-toradex.git/kernel/events, branch master

Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-10-27T22:23:17+00:00

Pull more MM updates from Andrew Morton:

- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):

Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.

- "support kselftest on nommu platform" (Hajime Tazaki):

Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.

- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):

Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.

- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):

Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.

- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):

Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.

- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):

Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.

- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):

Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.

- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):

Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.

- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):

Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.

- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):

Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.

- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):

Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.

- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):

Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.

- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):

Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.

- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):

Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.

- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):

Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.

- "mm: various (urgent?) fixes" (David Hildenbrand):

Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.

- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):

Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.

- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):

Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.

- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):

Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.

- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):

Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.

- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):

Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.

- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):

Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.

- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):

Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.

- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):

Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.

Summary of the 65 singletons in this merge:

The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.

Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.

Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.

* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...

Merge tag 'perf-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-10-26T03:52:28+00:00

Pull perf events fixes from Ingo Molnar:

 - Fix Alpha build failure caused by a semantic conflict
   between perf and arch-alpha changes (Thomas Weißschuh)

 - Fix UAF in attach_task_ctx_data() (Lee Jia Jie)

 - Fix perf_remove_from_context() event scheduling (Peter Zijlstra)

* tag 'perf-urgent-2026-10-25' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf: Fix perf_remove_from_context() event scheduling
  perf: Fix UAF in attach_task_ctx_data()
  alpha: add simd_enabled argument to perf_reg_validate()

mm: rename is_vm_hugetlb_page() to vma_is_hugetlb()

2026-10-24T08:56:18+00:00

The is_vm_hugetlb_page() predicate is badly named - the mapping can span
more than a page and it is inconsistent with other VMA predicates that
typically are prefixed by vma_.

Rename to vma_is_hugetlb() for consistency, and while we're here update
some VM_BUG_ON_VMA() to VM_WARN_ON_ONCE_VMA() as to avoid unnecessary
oopses.

No functional change intended.

Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-28-1aa3c9b139f9@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) 
Signed-off-by: Andrew Morton 
Acked-by: Marc Zyngier 
Acked-by: Claudio Imbrenda 
Acked-by: Anup Patel 
Acked-by: Zi Yan 
Acked-by: David Hildenbrand (Arm) 
Cc: Liam R. Howlett 
Cc: Vlastimil Babka 
Cc: Jann Horn 
Cc: Pedro Falcato 
Cc: Mike Rapoport 
Cc: Suren Baghdasaryan 
Cc: Michal Hocko 
Cc: Jonathan Corbet 
Cc: Greg Kroah-Hartman 
Cc: Dennis Dalessandro 
Cc: Jason Gunthorpe 
Cc: Leon Romanovsky 
Cc: Paul Moore 
Cc: Stephen Smalley 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Cc: Alexei Starovoitov 
Cc: Daniel Borkmann 
Cc: Andrii Nakryiko 
Cc: Eduard Zingerman 
Cc: Kumar Kartikeya Dwivedi 
Cc: Baolin Wang 
Cc: Nico Pache 
Cc: Ryan Roberts 
Cc: Dev Jain 
Cc: Barry Song 
Cc: Lance Yang 
Cc: Usama Arif 
Cc: Kiryl Shutsemau 
Cc: Doug Gilbert 
Cc: James Bottomley 
Cc: Martin K. Petersen 
Cc: Simona Vetter 
Cc: Helge Deller 
Cc: Sebastian Reichel 
Cc: John Hubbard 
Cc: Peter Xu 
Cc: Masami Hiramatsu 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Ingo Molnar 
Cc: Borislav Petkov 
Cc: Dave Hansen 
Cc: Arnaldo Carvalho de Melo 
Cc: Namhyung Kim 
Cc: Mark Rutland 
Cc: Rik van Riel 
Cc: Harry Yoo 
Cc: Juri Lelli 
Cc: Vincent Guittot 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: Thomas Zimmermann 
Cc: David Airlie 
Cc: Will Deacon 
Cc: Aneesh Kumar K.V 
Cc: Nicholas Piggin 
Cc: Arnd Bergmann 
Cc: Muchun Song 
Cc: Oscar Salvador 
Cc: Matthew Wilcox (Oracle) 
Cc: Jan Kara 
Cc: Oliver Upton 
Cc: Catalin Marinas 
Cc: Madhavan Srinivasan 
Cc: Paul Walmsley 
Cc: Palmer Dabbelt 
Cc: Albert Ou 
Cc: Christian Borntraeger 
Cc: Janosch Frank 
Cc: Alexander Gordeev 
Cc: Gerald Schaefer 
Cc: Heiko Carstens 
Cc: Vasily Gorbik 
Cc: David S. Miller 
Cc: Andreas Larsson 
Cc: Al Viro 
Cc: Christian Brauner 
Cc: Matthew Brost 
Cc: Joshua Hahn 
Cc: Rakie Kim 
Cc: Byungchul Park 
Cc: Gregory Price 
Cc: Ying Huang 
Cc: Alistair Popple 
Cc: Chris Li 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Nhat Pham 
Cc: Baoquan He 
Cc: Youngjun Park 
Cc: Johannes Weiner 
Cc: Qi Zheng 
Cc: Shakeel Butt 
Cc: Axel Rasmussen 
Cc: Yuanchu Xie 
Cc: Wei Xu 
Cc: Chengming Zhou 
Cc: Michal Hocko 
Cc: Miklos Szeredi 
Cc: Xu Xin 
Cc: Ihor Solodrai 
Cc: Bert Karwatzki

uprobes: remove VM_IO, set VM_MIXEDMAP for mapped kernel pages

2026-10-24T08:56:16+00:00

These are not MMIO pages so VMA_IO_BIT is an inappropriate flag to set.

Instead, set them VMA_MIXEDMAP_BIT as they are kernel mappings and this is
the appropriate flag to set for those.

This provides the semantics required - no VMA merging is permitted, but
does not prevent GUP.

However this has no meaningful impact as these are refcounted and thus can
be GUPed.

A previous commit already prevented __mm_populate() from being invoked on
XOL areas, which VMA_IO_BIT was previously relied upon to do, so that is no
longer required.

Both VMAs set a VMA name, so always_dump_vma() returns true before
vma_dump_size() reaches its VMA_IO_BIT check, and thus there is no change
in core dump behaviour.

Change this for both the core xol_add_vma() function and the x86-specific
get_uprobe_trampoline() function.

Link: https://lore.kernel.org/20261013-b4-mmap-prepare-vma-flag-sanify-v6-22-1aa3c9b139f9@kernel.org
Signed-off-by: Lorenzo Stoakes (ARM) 
Signed-off-by: Andrew Morton 
Reviewed-by: Suren Baghdasaryan 
Acked-by: David Hildenbrand (Arm) 
Cc: Liam R. Howlett 
Cc: Vlastimil Babka 
Cc: Jann Horn 
Cc: Pedro Falcato 
Cc: Mike Rapoport 
Cc: Michal Hocko 
Cc: Jonathan Corbet 
Cc: Greg Kroah-Hartman 
Cc: Dennis Dalessandro 
Cc: Jason Gunthorpe 
Cc: Leon Romanovsky 
Cc: Paul Moore 
Cc: Stephen Smalley 
Cc: Jaroslav Kysela 
Cc: Takashi Iwai 
Cc: Alexei Starovoitov 
Cc: Daniel Borkmann 
Cc: Andrii Nakryiko 
Cc: Eduard Zingerman 
Cc: Kumar Kartikeya Dwivedi 
Cc: Zi Yan 
Cc: Baolin Wang 
Cc: Nico Pache 
Cc: Ryan Roberts 
Cc: Dev Jain 
Cc: Barry Song 
Cc: Lance Yang 
Cc: Usama Arif 
Cc: Kiryl Shutsemau 
Cc: Doug Gilbert 
Cc: James Bottomley 
Cc: Martin K. Petersen 
Cc: Simona Vetter 
Cc: Helge Deller 
Cc: Sebastian Reichel 
Cc: John Hubbard 
Cc: Peter Xu 
Cc: Masami Hiramatsu 
Cc: Oleg Nesterov 
Cc: Peter Zijlstra 
Cc: Thomas Gleixner 
Cc: Ingo Molnar 
Cc: Borislav Petkov 
Cc: Dave Hansen 
Cc: Arnaldo Carvalho de Melo 
Cc: Namhyung Kim 
Cc: Mark Rutland 
Cc: Rik van Riel 
Cc: Harry Yoo 
Cc: Juri Lelli 
Cc: Vincent Guittot 
Cc: Maarten Lankhorst 
Cc: Maxime Ripard 
Cc: Thomas Zimmermann 
Cc: David Airlie 
Cc: Will Deacon 
Cc: Aneesh Kumar K.V 
Cc: Nicholas Piggin 
Cc: Arnd Bergmann 
Cc: Muchun Song 
Cc: Oscar Salvador 
Cc: Matthew Wilcox (Oracle) 
Cc: Jan Kara 
Cc: Marc Zyngier 
Cc: Oliver Upton 
Cc: Catalin Marinas 
Cc: Madhavan Srinivasan 
Cc: Anup Patel 
Cc: Paul Walmsley 
Cc: Palmer Dabbelt 
Cc: Albert Ou 
Cc: Christian Borntraeger 
Cc: Janosch Frank 
Cc: Claudio Imbrenda 
Cc: Alexander Gordeev 
Cc: Gerald Schaefer 
Cc: Heiko Carstens 
Cc: Vasily Gorbik 
Cc: David S. Miller 
Cc: Andreas Larsson 
Cc: Al Viro 
Cc: Christian Brauner 
Cc: Matthew Brost 
Cc: Joshua Hahn 
Cc: Rakie Kim 
Cc: Byungchul Park 
Cc: Gregory Price 
Cc: Ying Huang 
Cc: Alistair Popple 
Cc: Chris Li 
Cc: Kairui Song 
Cc: Kemeng Shi 
Cc: Nhat Pham 
Cc: Baoquan He 
Cc: Youngjun Park 
Cc: Johannes Weiner 
Cc: Qi Zheng 
Cc: Shakeel Butt 
Cc: Axel Rasmussen 
Cc: Yuanchu Xie 
Cc: Wei Xu 
Cc: Chengming Zhou 
Cc: Michal Hocko 
Cc: Miklos Szeredi 
Cc: Xu Xin 
Cc: Ihor Solodrai 
Cc: Bert Karwatzki

Merge tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

2026-10-23T17:42:11+00:00

Pull MM updates from Andrew Morton:

- "selftests/mm: improve khugepaged coverage" (Kiryl Shutsemau):

Give khugepaged a proper workout. Extend the tests to all supported
mTHP orders, check exactly which windows collapsed, and make scan
completion deterministic. Race collapse against faults, pinning, fork
and remap; verify that the contents survive.

Add coverage for whole-page-table zaps and memory pressure too.

- "selftests/mm: separate GUP microbenchmarking from functional testing"
(Sarthak Sharma):

Untangle GUP benchmarking from correctness testing. Move the
benchmark into tools/mm, add a standalone harness-based GUP selftest,
and move shared helpers into tools/lib/mm. Give each tool one job
instead of mixing timing measurements with correctness checks.

Cover the mapping, pinning and batch-size combinations explicitly.

- "mm: Switch device DAX to section-based vmemmap optimization" (Muchun
Song):

Apply section-based vmemmap optimization to device DAX. Rework the
backing metadata layout to save memory while preserving the handling
of device memory hotplug and its different alignment and lifetime
requirements.

- "mm: Introduce section-based vmemmap optimization for HugeTLB"
(Muchun Song):

Cut the memory consumed by HugeTLB's struct page array with
section-based vmemmap optimization. Arrange the metadata so large
huge pages need fewer backing pages, while keeping initialization,
teardown and the various hugepage configurations straight.

- "mm/huge_memory: clean up and decouple the anon and file split
helpers" (Kairui Song):

Separate anonymous and file-backed folio splitting, which have rather
different locking and bookkeeping requirements. Move the work into
separate helpers, drop dead checks and tidy swap-cache handling. Fix
error paths, including one that could leave a folio frozen.

Keep the swap cache cases separate from file-cache splitting.

- "mm: Unconditional per-VMA locks and cleanups" (Dave Hansen):

Make per-VMA locking unconditional and clean up the old conditional
code around it. This removes configuration-dependent plumbing and
lets callers depend on one locking model rather than carrying both
cases along.

- "memcg: remove the v1 soft limit" (Shakeel Butt):

Remove the old cgroup v1 memory soft-limit machinery. This has long
since been superseded by the newer memory-control interfaces; hauling
around a separate reclaim scheme for it no longer buys us much.

- "read proc/pid/smaps_rollup under per-vma lock" (Suren Baghdasaryan):

Read /proc/PID/smaps_rollup using per-VMA locks where possible,
rather than holding mmap_lock across the entire walk. Retain the
contention fallback and add tearing tests. This considerably reduces
latency when another thread is busy changing its mappings.

- "mm/damon: introduce data access-as-a-data attribute" (SJ Park):

Teach DAMON to expose memory access observations as data attributes,
making them available to the probe and filtering machinery. Extend
the interfaces, documentation and tests so the new information can be
used rather than merely collected.

- "Remove PG_private by using page/folio->private checks instead" (Zi
Yan):

Get rid of PG_private and use the folio's private pointer to say
whether private data is attached. Convert the filesystem users,
including erofs, f2fs and md, and clean up the old accessors and
flags. There are a few special cases, notably swapcache and hugetlb,
which need explicit care.

- "mm: make userland page table freeing RCU-safe" (Lorenzo Stoakes):

Make freeing userspace page tables safe against RCU readers. Sort out
the page-table lifetime and locking rules so walkers cannot stumble
over freed tables while mappings are being torn down.

- "make unused huge shrinker memcg aware" (Qi Zheng):

Make shmem's unused-huge-folio shrinker aware of memory cgroups, so
reclaim can find those folios under the right memcg. Wire up the
per-memcg tracking and its lifetime rules, and give the shrinklist
its own lockdep class to avoid spurious dependency reports.

- "mm: Drop pxd_ERROR()" (Anshuman Khandual):

Remove the old pxd_ERROR() page-table checks and their
architecture-specific baggage. Simplify the common page-table
interfaces and callers now that these checks no longer serve a
useful purpose.

- "memcg: group struct fields by access pattern" (Shakeel Butt):

Rearrange memcg's hot and cold fields according to how they're
actually accessed. Keep frequently updated counters and their
neighboring state from fighting over cachelines and reduce needless
cacheline traffic.

- "mm/damon/core: fix the size charged for a filter-trimmed region"
(Donggeun Yoo):

Fix DAMOS quota accounting when a filter trims a monitoring region.
Charge only the part left after filtering, not the original region,
and add KUnit coverage. Previously the excluded memory could eat into
the quota and make schemes run more slowly than requested.

- "mm/damon: add kunit and selftests for probes and probe weights" (SJ
Park):

Add more tests for DAMON probes and their weights, including
validation and the results reported to userspace. This is mostly
about catching regressions in the newer probe infrastructure before
they become harder to diagnose.

- "mm: memcontrol: constify the read side of the read side of the memcg
API" (Tal Zussman):

Mark the read-only parts of the memcg interface const, from folio and
lruvec accessors to counters and swap helpers. Most of this is
mechanical, but it makes the contracts clearer and lets the compiler
catch accidental writes.

- "mm/damon/vaddr: support {prep,apply}_probes" (SJ Park):

Support the new prepare/apply probe operations in DAMON's
virtual-address backend. This brings vaddr monitoring into line with
the probe infrastructure and makes the added probe types useful there
too.

- "mm/mglru: clean up folio counters and flag usage" (Kairui Song):

Simplify MGLRU's folio counters and flag handling. Remove redundant
accounting paths and make the state transitions easier to follow
without changing the intended reclaim policy.

- "arch, mm/execmem: resolve confusion about set_direct_map_valid_noflush()"
(Mike Rapoport (Microsoft)):

Clarify and straighten out the set_direct_map_valid_noflush()
interface across architectures and execmem. Make the requested
mapping changes and the callers' expectations agree, rather than
relying on subtly different architecture behavior.

- "mm: zswap: free cold writeback folios promptly" (Alexandre Ghiti):

Free zswap writeback folios as soon as their disk write completes.
They are cold temporary buffers, so putting them on the LRU only
makes reclaim rediscover them later. Extend swap-cache dropbehind and
let zswap keep these folios off the LRU altogether.

- "mm: gup: cleanup gup_fast call chain" (Aristeu Rozanski):

Clean up the GUP-fast call chain and simplify how the fast-path
helpers pass their arguments and results around. Keep the page-pin
behavior the same while making the call sequence easier to maintain.

- "mm: optimize zone-device memmap initialization" (Li Zhe):

Speed up initialization of zone-device struct pages. Avoid redundant
work when setting up large device-memory ranges, where touching every
descriptor can get expensive.

- "mm/zswap: shrink zswap_entry via a pool id" (Jianyue Wu):

Reduce the size of zswap_entry by storing a compact pool identifier
instead of a full pointer. Keep the pool lookup and lifetime handling
correct while saving per-entry metadata.

- "mm/damon: support access monitoring of hugetlb-backed memory"
(Krishna Iyer):

Let DAMON monitor hugetlb-backed memory too. Extend the relevant
access checks and add coverage so those mappings no longer fall
through a hole in the monitoring machinery.

- "mm/execmem: fixes and cleanups for the ROX cache" (Mike Rapoport):

Tidy execmem's read-only-executable cache and fix its handling of the
awkward allocation and release cases. The aim is to make the cache's
ownership and permission transitions more predictable.

- "zsmallc: remove old object read API" (Sergey Senozhatsky):

Drop zsmalloc's old object-read API and move its remaining users to
the supported access mechanism. This removes a duplicate interface
which we no longer need.

- "mm/mempolicy: stop copying state in the interleave paths" (Gregory
Price):

Stop copying mempolicy state in the interleave paths when a reference
to the existing policy will do. This avoids extra work and makes the
ownership rules less obscure.

- "mm/mglru: speed up inc_min_seq() and fix cold/hot inversions" (Barry
Song):

Make MGLRU's generation advancement cheaper and fix cases where cold
and hot folios end up in the wrong order. Adjust the counter and list
handling so reclaim doesn't keep passing over the better eviction
candidates.

- "mm: Fix MF_DELAYED handling on memory failure" (Lisa Wang):

Treat MF_DELAYED as a partially completed memory-failure operation,
not an outright failure. Propagate that result correctly through
shmem and the generic handler, fix the extra-reference accounting,
and add tests for the resulting SIGBUS behavior.

- "tools/mm/page_owner_sort: fix --sort, add module filter, improve
usage" (Ye Liu):

Fix page_owner_sort's --sort handling, add module-based filtering and
make the usage output more helpful. This makes the tool less
frustrating when tracking down who is holding on to pages.

- "mm/damon: move damos filter range arguments validation to core" (SJ
Park):

Move DAMOS filter range validation into the core, where all callers
can share it. Also close the sysfs read-twice races which could pass
inconsistent ranges, and add tests for invalid input.

- "mm/damon: misc cleanups" (Zenghui Yu):

Clean up a collection of small DAMON rough edges in the core,
interfaces and tests. No large behavior change here, just simpler
code and fewer opportunities for confusion.

- "mm/damon: cleanup code, add test cases, and update guidances in
docs" (SJ Park):

Clean up DAMON's core and interfaces, add missing test cases and
bring the documentation into line with the code. These changes should
make the newer facilities easier to understand and maintain.

- "mm/damon: introduce hugepage_size probe filter" (SJ Park):

Add a DAMON probe filter for hugepage size. Let users select a range
of folio sizes through sysfs, validate the range and document the new
interface, so monitoring can concentrate on memory backed by the
desired hugepage sizes.

- "selftests/mm: pagemap_ioctl test fixes and cleanups" (Zenghui Yu):

Fix some pagemap ioctl test assumptions and clean up their setup and
reporting. Make failures point to the operation that went wrong
rather than to test harness bookkeeping.

- "mm: avoid large folio splits when swap is unavailable" (Johannes
Weiner):

Avoid splitting large folios merely to attempt swap when no swap
space is available. There is little point paying for an expensive
split when reclaim cannot actually swap the resulting pages out.

- "mm: workingset: fix the shadow node budget under MGLRU" (Hui Zhu):

Fix the workingset shadow-node budget with MGLRU enabled. Keep the
shadow entries within the intended limits so refault tracking does
not quietly consume more metadata than it should.

- "selftests/mm: TAP output and global-state fixes" (Song Hu):

Fix selftests which produce misleading TAP output or fail to restore
global settings after a run. A test ought to leave the system as it
found it, particularly when a whole suite follows behind.

- "mm: remove page_swap_entry()" (Tal Zussman):

Remove page_swap_entry() and convert its remaining users to the folio
and swap-entry helpers. Lose an old page-level interface and make the
swap paths a little more consistent.

- "mm: refactor zonelist constructors and iterators" (Gregory Price):

Refactor the zonelist construction and walk helpers to reduce
duplicated logic. Keep the allocation ordering rules intact while
making it clearer how zones are selected.

- "mm: kmemleak: batch the struct page scan" (Breno Leitao):

Scan adjacent struct pages in batches instead of taking kmemleak_lock
once for every single page. This preserves scan coverage and the
lock-hold bound, while cutting overhead substantially on debug
kernels.

- "mm/damon: misc improvements in tests and documents" (Zenghui Yu):

Fix some DAMON selftests which leave kdamond running or fail under
Python safe-path mode, and improve the KUnit coverage and
documentation. Nothing especially glamorous, but these are worth
doing.

- "mm/damon: introduce probe_hits_wsum DAMOS core filter" (SJ Park):

Add a DAMOS core filter using weighted probe-hit counts. This gives
schemes another way to select regions based on what the monitoring
probes observed.

- "mm/mglru: fix ineffective memory protection for non-kswapd reclaim"
(Ridong Chen):

Fix MGLRU's memory protection handling for reclaim outside kswapd.
The protection settings weren't having the intended effect in these
paths, leaving protected memory more exposed than requested.

- "mm/damon: improve readability, clarity and test coverage" (SJ Park):

Simplify a handful of DAMON core helpers, clarify their behavior and
expand test coverage. There are no intended userspace-visible changes
in this batch.

- "mm: replace PF_KCOMPACTD/PF_KSWAPD with kthread_func()" (Kefeng
Wang):

Stop identifying reclaim and compaction workers through the PF_KSWAPD
and PF_KCOMPACTD task flags. Use their kthread functions instead and
remove the redundant flag plumbing.

- "mm/hugetlb: fix surplus accounting and availability checks during
demotion" (Longlong Xia):

Fix HugeTLB surplus accounting and availability checks when demoting
huge pages. Keep the counters and reservation decisions consistent as
one huge page turns into several smaller ones.

- "mm/damon: add kunit tests for probe_hits handling and probe params
validation" (Jason Angelov):

Add KUnit tests for DAMON probe-hit handling and invalid probe
parameters. These cover edge cases that were too easy to miss in
ordinary monitoring tests.

- "mm/damon: fix misc bugs in kunit, quota goals and sysfs refresh_ms"
(SJ Park):

Fix a few DAMON bugs in KUnit tests, quota-goal handling and the
sysfs refresh interval. Small fixes, but the incorrect results and
control behavior were real.

- "mm: zswap: optimize zswap invalidate and store" (Kefeng Wang):

Simplify zswap's invalidate and store paths to avoid avoidable
lookups and work. Keep the entry lifetime rules intact while making
those frequent operations cheaper.

- "mm: replace custom ratelimiting logic" (Pedro Falcato):

Replace hand-rolled MM rate limiting with the common kernel helpers.
There is no need to maintain another local version of the same
mechanism.

- "mm/vmalloc: minor cleanups" (Ye Liu):

Tidy some vmalloc initialization and reporting code, and pull
duplicated vmap-area insertion work into a helper. No functional
changes are intended.

- "mm/mglru: clean up isolate_folios for readability and clarity"
(Ridong Chen):

Clean up MGLRU's isolate_folios() so the decisions are easier to read
and verify. Keep reclaim behavior unchanged while removing
unnecessary twists in the control flow.

- "Catch automatic storage in IDA and Maple Tree definitions" (Yury
Norov):

Catch IDA and maple-tree definitions placed in automatic storage
where the lifetime rules are wrong or easy to get wrong. Add checks
so such mistakes are harder to slip through unnoticed.

- "mm, swap: some random fixes and cleanups" (Kemeng Shi):

Fix and simplify a few unrelated swap paths, removing redundant work
and tidying up error handling. A small collection of things which
were better fixed than left lying around.

- "mm/page_io: folio conversion cleanups" (Tal Zussman):

Finish some page-to-folio conversions in swap I/O, removing obsolete
wrappers and using folio operations consistently. The I/O behavior is
intended to remain the same.

- "mm/swap: skip empty clusters in the swapoff scan" (Youngjun Park):

Skip empty swap clusters during swapoff instead of walking slots
which have nothing to release. This avoids pointless work on sparsely
used swap devices.

- "mm: trace: decode architecture-specific VMA flags" (Meijing Zhao):

Teach the VMA trace output to decode architecture-specific flags,
rather than leaving them as unexplained bits. That should make
tracing a good deal more useful when debugging unusual mappings.

- "mm, swap: don't spin on a bad swap entry" (Breno Leitao):

Stop repeatedly retrying a swap entry which is already known to be
bad. Make the error path terminate cleanly instead of wasting CPU
chasing an entry that cannot be used.

- "mm/page_isolation: fix UBSAN shift-out-of-bounds in
isolate_single_pageblock" (Qi Xi):

Fix an out-of-range shift in isolate_single_pageblock() and tighten
its associated boundary handling. UBSAN found the issue; the result
should be more robust pageblock isolation.

- "mm: khugepaged: fix tracepoint UAF" (Vernon Yang):

Fix a use-after-free in khugepaged tracepoint handling. Make sure the
information recorded by tracing stays valid for as long as the trace
event needs it.

- "mm/damon: fix DAMOS bugs in core, paddr and vaddr" (SJ Park):

Fix several DAMOS problems across the core and physical- and
virtual-address backends. The changes close error cases and bring the
implementations back into agreement.

- "mm/hugetlb_cgroup: move the per-node usage along with the folio"
(Hongfu Li):

Move HugeTLB per-node usage accounting when folios migrate between
nodes or are reparented to another cgroup. Otherwise numa_stat can
retain stale charges and even underflow when the folio is freed.

- "docs/core-api: memory-allocation: add k[mz]alloc_obj() and clarify
kmalloc" (Mike Rapoport):

Document the typed k[mz]alloc_obj() allocation helpers and clear up
some kmalloc guidance. Make it easier for callers to choose the right
interface.

- "selftests/mm: Validate selections and scope memfd_secret setup"
(Tianyi Chen):

Check selftest selections before running and confine memfd_secret
setup to the cases that actually need it. Avoid confusing failures
caused by the test harness itself.

- "mm/damon: move zero damos quota target_value handling to the core
layer" (SJ Park):

Handle a zero DAMOS quota goal target in the core rather than making
each user of the interface invent its own rule. Keep quota decisions
consistent across callers.

- "mm/damon: Introduce a huge page collapsing mechanism using auto
tuning" (Asier Gutierrez):

Add an auto-tuned DAMON mechanism for collapsing huge pages. Use
monitoring feedback to decide when collapse is worthwhile rather than
forcing one fixed policy onto every workload.

- "kmemleak: fix stale documentation and raise the verbose default"
(Breno Leitao):

Bring the kmemleak documentation up to date and require a third
confirming scan before verbose kernels print a suspected leak. The
extra scan helps suppress transient false positives in noisy debug
builds.

- "mm/memory: improve insert_pages() error handling" (Avi Weiss):

Tighten insert_pages() error handling so partial failures are
reported and cleaned up consistently. The caller should not have to
guess how far the operation got.

- "mm/damon: allow NULL or unstarted damon_ctx parameter for
damon_call()" (SJ Park):

Make damon_call() handle NULL and not-yet-started contexts safely.
Simplify the rules for callers and avoid an indefinite wait on an
invalid state.

- "mm/damon: introduce pgidle_set probe filter type" (SJ Park):

Add a pgidle_set DAMON probe filter, giving monitoring users another
way to select pages by their idle-tracking state. Wire it through the
filter interfaces and tests.

- "mm/damon/core: remove unused helper functions" (Cheng-Han Wu):

Remove DAMON core helpers which no longer have callers. Keep the API
surface smaller rather than retaining dead code just in case.

- "mm: stop calling pmd_folio() on special PMDs" (Gregory Price):

Avoid calling pmd_folio() on special PMD mappings that have no struct
page. The old assumption could fault in procfs walkers; use the
normal-folio checks and handle those mappings properly.

- "mm: remove three unused helpers from mm.h" (Tal Zussman):

Remove three unused helpers from mm.h. Fewer obsolete interfaces for
the next person to stumble over.

- "mm/damon: improvements in efficiency, error handling, documents"
(Liew Rui Yan):

Skip needless DAMOS quota work once the quota is full, propagate a
missing sysfs error and tidy a couple of comments. The ignored error
could make a monitoring-start request appear successful when it
wasn't.

- "docs/mm/damon/design: add explanation of nr_snapshots" (Liew Rui
Yan):

Explain DAMON's nr_snapshots accounting in the design documentation
and straighten out the associated terminology. Make it clearer what
users should expect from that counter.

- "selftests/cgroup: fixes for test_zswap on single core VM" (Wilson
Felipe Pereira):

Fix two test_zswap failures on single-CPU VMs. Wait for the exiting
child's cgroup to become unpopulated before reconfiguring it, and
avoid another test assumption which breaks under constrained
scheduling.

- "docs/ksm: fix advisor documentation and comment" (Jinjiang Tu):

Correct the KSM advisor documentation and a misleading code comment.
Keep the description aligned with how the advisor actually works.

- "Fix bugs in HugeTLB allocation when mem_cgroup_charge_hugetlb()
fails" (Ackerley Tng):

Fix HugeTLB allocation cleanup when the memcg charge fails. Make sure
failure exits undo what was allocated rather than leaving stale
accounting or resources behind.

- "mm, memcg: fix memory.peak reset clobbering other fds' watermark"
(Ridong Chen):

Fix memory.peak reset handling so resetting one file descriptor
doesn't overwrite the watermark kept for another. Keep those per-open
measurements independent as intended.

- "mm: reject zone device folios in more folio walkers" (Gregory
Price):

Reject zone-device folios in page walkers that cannot safely handle
them. Extend the existing checks rather than assuming every folio has
ordinary system-memory backing.

- "percpu: remove code with no effect" (Sang-Heon Jeon):

Remove a few pieces of percpu code which no longer do anything. There
is no reason to keep maintaining dead paths.

* tag 'mm-stable-2026-10-19-21-33' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (539 commits)
mm: shmem: assign a lock class to the unused huge shrinklist
mm: vmscan: put rotation-missed folios at the LRU tail
mm: kmemleak: scan the struct page array in MAX_SCAN_SIZE batches
mm: kmemleak: move the struct page scan into a helper
mm/damon: document that a zero sample_interval is accepted
mm/damon: fix typos in comments
mm/damon/sysfs: propagate damon_call() error in turn_damon_on
mm/damon/core: skip quota score setup when the quota is full
mm/damon/tests/core-kunit: test the size charged for a filter-trimmed region
mm/damon/core: charge only the part of a region the filter left
mm: disallow raw PFN mappings of huge/shared zeropage
selftests/mm: zap whole PTE tables in the khugepaged race harness
selftests/mm: add memory-pressure threads to the khugepaged race harness
selftests/mm: race the collapse of windows with holes
selftests/mm: add khugepaged race harness
selftests/mm: check that one khugepaged pass collapses one window
selftests/mm: run every supported collapse order by default
selftests/mm: cover a shared-source collapse write race
selftests/mm: parameterize the mixed-source collapse case by source order
selftests/mm: add order-parameterized khugepaged collapse cases
...

perf: Fix perf_remove_from_context() event scheduling

2026-10-23T17:09:52+00:00

Q8 noted that it is possible to get into an inconsistent state when
using perf_remove_from_context() on a group leader event.

Specifically, when the leader gets scheduled out, we should (when not
destroying the grouping) schedule out the complete group, similar to
__perf_event_disable().

Reported-by: Q8 
Tested-by: Q8 
Signed-off-by: Peter Zijlstra (Intel)

perf: Fix UAF in attach_task_ctx_data()

2026-10-23T17:09:52+00:00

struct perf_ctx_data is RCU protected. In attach_task_ctx_data(),
the cmpxchg retry loop runs without holding rcu_read_lock(). If
task->perf_ctx_data already holds a pointer (call it `cd1`), then
try_cmpxchg(&task->perf_ctx_data, &old, cd) fails and loads old = cd1.
A concurrent thread running detach_task_ctx_data() could free cd1
leading to UAF and further memory corruption when cd1 is reclaimed by
another thread.

  CPU 0: attach_task_ctx_data()     CPU 1: detach_task_ctx_data()
  -----------------------------     -----------------------------
  try_cmpxchg(&task->perf_ctx_data,
              &old, cd2)
    -> fails; loads old = cd1

                                    refcount_dec_and_test(&cd1->refcount)
                                    try_cmpxchg(&task->perf_ctx_data,
                                                &cd1, NULL)
                                    perf_free_ctx_data_rcu(cd1)
                                    [ RCU grace period -> kfree(cd1) ]

  refcount_inc_not_zero(&old->refcount)
    -> UAF on freed cd1

Fix this by taking rcu_read_lock across the race window.

Fixes: 506e64e710ff ("perf: attach/detach PMU specific data")
Signed-off-by: Lee Jia Jie 
Signed-off-by: Peter Zijlstra (Intel)

Merge __{get,put}_user() removal branch

2026-10-21T17:19:30+00:00

This is long over-due: the __get_user() and __put_user() functions are
entirely historical, and are never the rigth thing to use any more.  And
when mis-used (read: every case) they are not only slower than the right
thing, but also insecure because they don't check the user address
range.

Most of the usage sites have been converted long ago, but various
left-overs remained.  So this started out as a single patch that I wrote
as a "show people how to convert __{get,put}_user() to modern code".

In particular, Thomas last year implemented the very nice new scoped
user access region helpers (see commit e497310b4ffb: "uaccess: Provide
scoped user access regions") that makes the modern interfaces
particularly easy to use and really removes any excuse for the old
horrors.

That small example patch then grew to this, partly using Claude as a
glorified coccinelle script to apply the pattern to other places.

There were a few different reasons for using __put_user() and
__get_user() rather than the alternatives, but the original historical
one was performance: when doing multiple accesses off the same base
pointer, doing a single range check followed by multiple non-checked
accesses used to create smaller and faster code.

The keyword here is "used to".  It hasn't been true for years, because
the range check isn't actually the real cost these days.  The real cost
of user accesses on modern hardware is turning the user accesses on and
off in the first place (on x86, using the STAC/CLAC instructions).

Those sequences get turned into 'scoped_user_read_access() { }' blocks,
see for example that first patch in the series: "signal: use scoped user
access for old-style sigaction".

Another, historical reason for using __get_user() and friends is that
you actually want to do a kernel pointer access, but the pointer might
not be entirely reliable (typically during fault handling), so you want
to have exception handling for the kernel access.

The modern way to do that kind of non-faulting kernel access is using
"get_kernel_nofault()", but some code predates that helper existing at
all, and used __get_user() as a way to just get a memory access with
exception handling.  For that pattern, see for example "alpha: use
get_kernel_nofault() in dik_show_code()"

A third bad reason for using __get_user() and friends was that the
proper get_user() had a "might_fault()" in it, and code that ran in
atomic regions but hadn't disabled page faults would result in a
warning.  That kind of code needs to explicitly disable page faults,
because "atomic region" is not well defined at run-time and can be
invisible (eg a preempt-off region in a non-preemptible kernel).

See "vdpa_sim: disable page faults around vringh_need_notify_iotlb()"
for an example of that pattern, where the local_bh_disable() now also
grows a pagefault_disable(), which makes the normal get_user() no longer
warn about the user access in non-process context, because it can see
that the potential page fault will not cause problems.

And finally, the really nasty reason to use __get_user() and friends:
pointers that can be either kernel pointers or user pointers.  We've
gotten rid of almost all such cases, but a couple remained.  See for
example "x86/sev: Use explicit user-or-kernel accessors for #VC memory
operands".

NOTE! This series removes all __get/put_user() calls from generic code
but only does the final removal of the whole interface on x86.  Other
architectures have not been entirely converted, for a variety of reasons:

 - arm64 makes __{get,put}_user() be exactly the same as
   {get,put}_user() so it's harmless and didn't have the dangers of the
   legacy use cases.

 - any architecture that uses  will still use
   __{get,put}_user as the underlying helper function name

 - several architectures had some legacy uses that weren't entirely
   trivial and I didn't want to extend this patch series to things that
   I don't know and that don't really matter.

but I did do a couple of the obvious "follows the exact same pattern"
just because it could be done mindlessly and automatically.

Let's see if I broke anything, but we should have done this years ago.

* uaccess-cleanups: (48 commits)
  drm/i915/gem: ignore errors on presumed_offset write-back
  powerpc/align: use get_user_instr() for a user-mode instruction
  powerpc/signal64: use scoped user access in setup_trampoline()
  powerpc/signal64: use get_user() for the single context reads
  powerpc/signal32: use get_user() for the single context reads
  KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd
  powerpc/powernv: use get_user()/put_user() in the LPC debugfs files
  s390: use get_user()/put_user() instead of the unchecked variants
  ARM: OABI: use scoped user access in epoll_put_uevent()
  ARM: signal: stop using __put_user() for the signal frame
  ARM: signal: check the FDPIC function descriptor address
  alpha: split the prefetch check in do_page_fault() by mode
  openrisc: use get_kernel_nofault() in show_registers()
  alpha: use get_kernel_nofault() in dik_show_code()
  nios2: use scoped user access for the signal frame
  nios2: check the signal frame address before writing to it
  hexagon: use scoped user access for the signal frame
  alpha: use scoped user access when setting up signal frames
  alpha: use scoped user access in the sigreturn path
  alpha: use scoped user access in osf_sigaction()
  ...

Merge tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-10-20T23:00:41+00:00

Pull perf events updates from Ingo Molnar:

 - Support SIMD/eGPRs/SSP register sampling in perf
   (Dapeng Mi, Kan Liang)

 - Turn amd_uncore_ctx events into a flexible array (Rosen Penev)

 - Finish the work related to fixing the guest PEBS path to not
   set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
   are upstream already (Sean Christopherson)

 - Drop redundant counter slot searches in the AMD uncore
   driver (Usama Arif)

 - Don't WARN when the ext_regs_buf allocation fails (vineash)

 - Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)

* tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (34 commits)
  perf/x86: Don't WARN when the ext_regs_buf allocation fails
  perf/x86/amd/uncore: Free counter slot by index
  perf/x86/amd/uncore: Remove redundant event slot scan
  perf/x86/intel: Check only PMC bits in PEBS_ENABLED when detecting host PEBS usage
  KVM: VMX: Only tell perf to enable PEBS counters for fully enabled PMCs
  KVM: VMX: Drop a redundant pmu->global_ctrl check when processing pebs_enable
  perf/x86/intel: KVM: Handle cross-mapped PEBS PMCs entirely within KVM
  perf/x86: KVM: Have perf define a dedicated struct for getting guest PEBS data
  perf/x86/intel: Invert names of intel_ctrl_{guest,host}_mask
  perf/x86/intel: Annotate x86_pmu::hybrid_pmu with __counted_by_ptr
  perf/x86/amd/uncore: Turn amd_uncore_ctx events into a flexible array
  perf/x86/intel: Add sanity check for PEBS record/fragment size
  perf/x86: Activate back-to-back NMI detection for arch-PEBS induced NMIs
  perf/x86/intel: Advertise PERF_PMU_CAP_SIMD_REGS capability
  perf/x86/intel: Support arch-PEBS based SIMD/eGPRs sampling
  perf/x86: Support SSP sampling using sample_regs_* fields
  perf/x86: Support eGPRs sampling using sample_regs_* fields
  perf: Enhance perf_reg_validate() with simd_enabled argument
  perf/x86: Support OPMASK sampling using sample_simd_pred_reg_* fields
  perf/x86: Support ZMM sampling using sample_simd_vec_reg_* fields
  ...

Merge tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2026-10-20T17:55:19+00:00

Pull arm64 updates from Catalin Marinas:
 "Here are the arm64 updates for 7.4.

  The more interesting bits are the removal of big-endian kernel support
  (already marked BROKEN for some time), preemptible this_cpu_*()
  operations and MPAM support for the firmware-backed (Fb) interface.

  CCA (Arm's confidential compute) is slowly trickling in with host RMI
  (Realm Management Interface) support and some refactoring, including a
  dedicated SMCCC bus to advertise firmware services. There are also the
  usual PMU updates for new hardware and a few fixes/cleanups.

  Core features:

   - Remove big-endian kernel support: CONFIG_CPU_BIG_ENDIAN has
     depended on BROKEN for a while, so drop the remaining code (BE
     hypervisor object, BPF JIT, assembly/crypto/library routines,
     endianness helper macros, selftests) and force a little-endian
     build

   - Add preemptible this_cpu_*() operations (read/write, RMW, xchg,
     cmpxchg and cmpxchg128) that no longer need to disable preemption
     around the per-CPU address generation and access

   - Preparation patches for implementing CONFIG_HOTPLUG_PARALLEL on
     arm64

  Memory management:

   - Treat faults taken by EFI runtime firmware as kernel faults

   - Clear PTE_WRITE for EFI_MEMORY_RO mappings (with hardware dirty
     state management enabled, this is not truly read-only)

   - Raise the default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
     configurations (28/26/24 bits for 4K/16K/64K pages)

   - Implement clear_page[s]() using memset()

   - Enable BBML2 no-abort (a.k.a. BBML3) for the NVIDIA Rigel CPU

  Perf and PMU:

   - Support for HiSilicon's ITS PMU

   - Add support for some new events: INST_SIMD_ALU_VEC for Apple PMUs
     and a cycle counter for the latest version of HiSilicon's MN PMU
     hardware

   - A bunch of fixes to the CXL PMU driver to address pre-existing
     issues from Sashiko

   - Fix generation of PERF_RECORD_ITRACE_START records for SPE and ETM
     drivers

   - Reduce excessive stack consumption in the Marvell DDR PMU driver

   - Minor driver updates and cleanups all over

  Arm Confidential Compute Architecture (CCA):

   - Add an Arm SMCCC bus for firmware services discovered through SMCCC
     and move the TRNG and CCA guest (TSM provider) drivers onto it,
     removing the dummy CCA platform device and adding a sysfs ABI for
     Realm guests

   - Move the Realm Service Interface (RSI) code out of arch/arm64/ into
     drivers/firmware/arm_rmm/

   - Add the host side of the Realm Management Interface (RMI): detect,
     configure and activate the RMM, add SRO support and wrappers for
     the Realm RMI commands

   - Block hibernation (new arch hook in the PM core) and kexec while
     the RMM is active. To be revisited in the future with proper
     support for deactivation

   - Handle Granule Protection Faults (GPFs) taken by the host, caused
     by accesses to memory delegated to the RMM. In a future patch, the
     exception table lookup will be limited to is_kdump_kernel() cases

  MPAM (Memory Partitioning And Monitoring):

   - Add support for the MPAM firmware-backed (Fb) interface, allowing
     MSC accesses to be mediated by firmware

   - Fix a list of theoretical issues with the driver (MSC access error
     propagation, MBWU monitor save/restore and locking, resctrl class
     handling, error interrupt restore, maximum number of PARTIDs)

   - Add the mailing list and a missing file to the MAINTAINERS entry

   - Document when to set arm64.nompam

  Errata and CPU features:

   - Add the NXP i.MX8QM/8QP workaround for the Cortex-A53 cache
     coherency issue (ERR050104), using a new ARM64_CPUCAP_SOC_ERRATUM
     capability type for SoC-level errata

  Miscellaneous:

   - Mask debug exceptions (DAIF) around the hardware breakpoint
     register manipulations when called from generic kernel code

   - Don't zero the SVE state buffer when the SVE state is live

   - Return -EPERM instead of -EBUSY from the GCS prctl() locking
     failures (matching x86), with the selftest updated. Slight ABI
     change but no software deployment yet

   - kselftest: fix unsound MTE fault skipping by introducing MTE-safe
     memory accessors, avoid copying each signal test binary more than
     once

   - Update sysreg definitions (fix three enum values and two field
     names, mark architecturally dropped fields as RES0) and remove the
     TME transaction state check from the BRBE driver

   - Fix the description of ARM64_HAS_LPA2 and remove a redundant
     ID_AA64MMFR0 define"

* tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (144 commits)
  arm64: cpufeature: Enable BBML2 for NVIDIA Rigel
  arm64: cputype: Add NVIDIA Rigel definitions
  arm64: raise default ARCH_MMAP_RND_BITS for 48-bit and 52-bit VA
  arm64/debug: mask debug exceptions when called from common code
  kselftest/arm64: signal: copy each test binary only once
  kselftest/arm64: Check for -EPERM not -EBUSY in the locking test
  arm64: gcs: Return -EPERM not -EBUSY for prctl() locking failures
  perf: arm_brbe: Remove the check for TME transaction states
  arm64: sysreg: Mark fields the architecture dropped as RES0
  arm64: sysreg: Fix the names of two misspelt fields
  arm64: sysreg: Fix three incorrect enum values
  arm64: smp: Defer RCU registration during secondary CPU bringup
  arm64: smp: Don't bother printing the I-cache policy for each CPU
  arm64: smp: Defer update of secondary CPU capabilities
  arm64: smp: Tidy up cpuinfo init and cpufeature updates
  arm64: smp: Tidy up smp_prepare_cpus()
  arm64: cpufeature: Store every ID register with its overrides applied
  arm64: cpufeature: Read MPAMIDR_EL1 in __cpuinfo_store_cpu()
  arm64: cpufeature: Add read_cpuid_with_overrides()
  arm64: cpufeature: Check arm64_ftr_regs[] before the first store
  ...