Repository navigation
Rebase edera/mainline onto master @ 4403278e4ea2 - #46
Closed
edera-rebase-app[bot] wants to merge 2460 commits into
Closed
edera-rebase-app[bot] wants to merge 2460 commits into
edera-rebase-app[bot] wants to merge 2460 commits into
Conversation
After the on_each_cpu() rendezvous, migrate_flush_tlb_page() walks the other CPUs and zeroes their mm->context[cpu] when mm_users is at most one, described as mimicking flush_tlb_mm()'s mm_users<=1 optimization. It is not one. flush_tlb_mm() tests mm_users before deciding whether to send the IPIs; here every CPU has already been visited and waited for, so nothing is saved. The callback has also just set each CPU's own slot correctly, so the loop only overwrites it, and does so while that CPU may still be running in the address space. Remove it. The shootdown shortcuts in flush_tlb_mm(), flush_tlb_page() and flush_icache_user_page() clear remote slots too; once the next patch removes those as well, every runtime update of mm->context[cpu] is made by CPU cpu itself. That patch relies on the invariant when it reads those slots to decide whether a shootdown can be skipped, so this one is tagged for stable as its prerequisite. Fixes: dd5712f ("alpha: fix user-space corruption during memory compaction") Cc: stable@vger.kernel.org Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20261010144621.974850-2-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
flush_tlb_mm(), flush_tlb_page() and flush_icache_user_page() skip the
shootdown IPI when mm_users <= 1, on the assumption that no other CPU can
be running the mm. A task that borrows an mm through kthread_use_mm()
takes mmgrab() rather than mmget(), so it never appears in mm_users, and
kthread_use_mm() may be handed an mm that is already the caller's
active_mm and loaded on that CPU. Such a CPU was not only left without
an IPI, its mm->context[cpu] was cleared from under it.
mm->context[cpu] is already the record of which CPUs hold an ASN for the
mm. Test it rather than clearing it: take the shortcut only when no
other CPU has one, and otherwise fall through to the IPI, which
invalidates those CPUs properly. A CPU that merely ran the mm in the
past also holds a context and now costs an IPI, which errs in the safe
direction.
Change ipi_flush_tlb_mm(), ipi_flush_icache_page() and the migration
callback ipi_flush_mm_and_page() to test current->mm, like
ipi_flush_tlb_page(). A CPU that only retains the mm lazily then clears
its own slot through flush_tlb_other(), rather than publishing a new ASN
on every IPI or migration rendezvous. The migration callback still does
its per-VA tbi() afterwards. Returning to the mm allocates a fresh ASN
through ev5_switch_mm(), or through the direct-load path when
kthread_use_mm() switches current's mm.
Once these historical slots are gone, the shortcut is available again
if mm_users remains at most one and no other CPU has taken or kept a
context. An explicit kthread_use_mm() borrower has current->mm set and
still receives the invalidate it needs.
The caller-side tests in flush_tlb_mm() and flush_icache_user_page()
remain current->active_mm. A kernel thread that flushes its lazily held
mm can therefore publish its own context slot. Those branches also
perform the shortcut check, which excludes the calling CPU's slot, so
leave them unchanged. This is distinct from a remote lazy CPU keeping
its slot populated through repeated callbacks.
Together with the preceding patch, dropping these clearing loops leaves
every runtime write to mm->context[] targeting the writing CPU's own slot,
so the array becomes a lockless publication of which CPUs may be using the
mm, with a single writer per slot. Mark the two stores that are now
observed from other CPUs; flush_tlb_other() already uses WRITE_ONCE().
The uniprocessor flush_icache_user_page() is left alone, as nothing reads
another CPU's slot there, and init_new_context() runs before the mm is
shared.
Order the slot reads after the page-table changes with smp_mb(). On the
publishing CPU, the store in ev5_switch_mm() precedes the mb() in Alpha's
arch_spin_unlock(), when finish_lock_switch() drops the rq lock. This
relies on Alpha's unlock implementation, not a generic scheduler promise
of a full barrier on unlock; document that reliance at the store. Also
issue smp_mb() after publishing in __load_new_mm_context(), before loading
and using the mm.
This covers every caller, including check_mmu_context(), which can
publish a replacement after finish_lock_switch() has already run.
This requires the preceding removal of remote slot clearing from
migrate_flush_tlb_page(). It also requires the stale-TLB series to set
need_new_asn on both the reused and newly allocated ASN paths. Otherwise
an IPI between finish_lock_switch() and check_mmu_context() can zero a
new slot while asn_lock is set, and the task can return to user space
with a live ASN that the shortcut cannot see.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: <stable@vger.kernel.org> # 53ab52cfe5ce: alpha: load the MMU context when switch_mm() switches the current task
Cc: <stable@vger.kernel.org> # 01df8f401888: alpha: run check_mmu_context() from finish_arch_post_lock_switch()
Cc: <stable@vger.kernel.org> # ef43cfc28c42: alpha: only use a targeted tbi() when the target mm is really current
Cc: <stable@vger.kernel.org> # 738cf8f7a78f: alpha: invalidate the local context in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 62c92086f30e: alpha: fix the local TLB invalidate in flush_tlb_page()
Cc: <stable@vger.kernel.org> # 3faee097b939: alpha: fix the local TLB invalidate in the UP flush_tlb_page()
Cc: <stable@vger.kernel.org> # b2c3b654bb64: alpha: invalidate the local context in flush_tlb_mm()
Cc: <stable@vger.kernel.org> # f19ae6f51a38: alpha: invalidate the local context in flush_icache_user_page()
Cc: <stable@vger.kernel.org> # 471e7f9c890b: alpha: do not clear remote MMU contexts in migrate_flush_tlb_page()
Cc: stable@vger.kernel.org
Reviewed-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Link: https://lore.kernel.org/r/20261010144621.974850-3-linmag7@gmail.com
Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Enable the seccomp BPF selftests on Alpha with a fallback seccomp syscall number and architecture-specific syscall register accessors. Use the NT_PRSTATUS register layout rather than struct pt_regs. The register set contains r0-r30 followed by pc and unique. Read and update the syscall number in r1, and set both r0 and the r19/a3 error flag when synthesizing syscall results. At syscall entry, r19 still contains the fourth syscall argument, so callers setting a synthetic return value must also set the syscall number to -1 to skip execution. Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20261010134214.974565-1-linmag7@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
nolibc does not support position independent executables (PIE).
However a toolchain might generate these by default depending on various
circumstances. Recently clang started to do so for hexagon. See LLVM
commit ab43cb8520c0 ("[Hexagon] Pass -pie to linker when PIE is the
toolchain default (#189723)").
As clang can also be configured to create PIE for other architectures by
default disable it globally. While we are at it also pass the argument
for GCC to be on the safe side.
If PIE is disabled already, clang will generate
-Wunused-command-line-argument warnings. Inhibit those.
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Reviewed-by: Willy Tarreau <w@1wt.eu>
Link: https://patch.msgid.link/20261018-nolibc-unused-arguments-v1-1-6cba71555fe8@weissschuh.net
PALcode keeps the user stack pointer in the PCB, not the trap frame, so pt_regs->usp is only valid where entry code stores it: entSys, do_entArith() and do_entIF(). Interrupts, page faults and unaligned traps leave it stale, and ptrace and /proc/<pid>/syscall read it through user_stack_pointer(). A user-mode pt_regs is at the top of its task's stack, so find the thread_info from it and use rdusp() for current or pcb.usp otherwise, as KSTK_ESP() and the regset code already do. Fixes: 8a2857b ("alpha: enable regset-based ptrace and core dumps") Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Magnus Lindholm <linmag7@gmail.com> Tested-by: Magnus Lindholm <linmag7@gmail.com> Acked-by: Ian Rogers <irogers@google.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Link: https://lore.kernel.org/r/20261018-alpha-perf-regs-v3-v3-1-52be85332c57@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Nothing reads pt_regs->usp now that user_stack_pointer() uses the PCB. Drop the stores, which saves a PAL_rdusp call on every syscall, and give the field back its old name. Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Magnus Lindholm <linmag7@gmail.com> Tested-by: Magnus Lindholm <linmag7@gmail.com> Acked-by: Ian Rogers <irogers@google.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Link: https://lore.kernel.org/r/20261018-alpha-perf-regs-v3-v3-2-52be85332c57@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Both open-code the same PCB lookup. Assisted-by: Claude:claude-opus-5-5 Tested-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Magnus Lindholm <linmag7@gmail.com> Acked-by: Ian Rogers <irogers@google.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Link: https://lore.kernel.org/r/20261018-alpha-perf-regs-v3-v3-3-52be85332c57@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Let perf sample registers and dump the user stack, which is what the perf tool needs for --call-graph dwarf. The register indices follow the hardware numbering, so r0-r30 map directly to DWARF register numbers, with pc after them. r9-r15 are callee-saved and live in switch_stack rather than pt_regs, so they cannot be sampled. Without r15 an unwinder cannot recover the CFA of a first frame that uses $15 as its frame pointer. sp is not in pt_regs either: for user frames it comes from user_stack_pointer(), and for kernel frames (PERF_SAMPLE_REGS_INTR) it is the end of the trap frame, as in stacktrace.c. Software events such as context switches and tracepoints hand perf a per-CPU pt_regs filled in by perf_fetch_caller_regs() instead of a trap frame. It is not on the stack and has no room for sp, so report sp as 0 there rather than the address of the per-CPU buffer. Assisted-by: Claude:claude-opus-5-5 Acked-by: Ian Rogers <irogers@google.com> Tested-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Magnus Lindholm <linmag7@gmail.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Link: https://lore.kernel.org/r/20261018-alpha-perf-regs-v3-v3-4-52be85332c57@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Context switch and tracepoint events have no trap frame, so perf builds one with perf_fetch_caller_regs(). Alpha does not define perf_arch_fetch_caller_regs(), which leaves that pt_regs zeroed, and these samples report pc as 0. Record the caller's address as pc. The zero ps already marks the frame as kernel mode, and pt_regs has nowhere to keep sp, so pc is all that can be filled in. perf_fetch_caller_regs() gets that address from CALLER_ADDR0, which alpha defines as 0 when CONFIG_FRAME_POINTER is disabled. Finding the level zero return address does not need a frame pointer, so make alpha_ftrace_return_address0() available in both configurations. Only ftrace_return_address(n) still depends on frame pointers. Reported-by: Magnus Lindholm <linmag7@gmail.com> Closes: https://lore.kernel.org/all/CA%2B%3DFv5S8-Zk8-LUpZnWiBfTGSQXthepmRc_-a9O%2BpEPmVW0mRA@mail.gmail.com/ Suggested-by: Magnus Lindholm <linmag7@gmail.com> Assisted-by: Claude:claude-opus-5-5 Reviewed-by: Magnus Lindholm <linmag7@gmail.com> Acked-by: Ian Rogers <irogers@google.com> Signed-off-by: Matt Turner <mattst88@gmail.com> Tested-by: Magnus Lindholm <linmag7@gmail.com> Link: https://lore.kernel.org/r/20261018-alpha-perf-regs-v3-v3-5-52be85332c57@gmail.com Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Move the existing handler and PCI error clearing helpers without changing their behavior. Build the error objects for ALPHA_TSUNAMI so that all Tsunami configurations, including non-generic Shark, can use them. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Define the five system-specific quadwords in the SRM logout frame, as documented in the AlphaServer ES40 Service Guide, Table D-19. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
The ES40 Service Guide, Table D-19, documents a correctable frame with its system area at 0x58 and total size 0x80. The existing EV6 decoder interprets system words as extended CPU registers and reads past its end. This establishes the layout for ES40; whether Titan and Nautilus PALcode also emits this short frame has not been verified. Validate the processor area before decoding it and only print extended registers when present. Preserve rejected frames with a raw dump rather than trusting their invalid offsets. Cap the dump at 1 KiB and round down to complete quadwords. This still relies on firmware supplying an accessible frame of its advertised size; the cap is not pointer validation. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Decode PCI and ECC transactions separately, honor invalid transaction information, and select Pchip errors using the logout summary. Report master aborts without importing Titan-specific dismissal policy. Delegate processor vectors to the bounded EV6 decoder. On system vectors 660/620, capture live PERROR and MISC before acknowledging their defined W1C bits and report live status absent from the saved frame. Leave live chipset registers alone on CPU and environmental vectors: HRM 10.2.5.6 warns that PERROR can have INV set before the error reaches DRIR. Consuming that state from a CPU vector could lose the transaction and its pending system-error notification. Leave PERRMASK as configured by firmware. HRM 10.2.5.7 says a cleared mask bit prevents the corresponding PERROR bit from being set, including by PERRSET. Table 10-43 gives a reset value of zero, so this reporting depends on firmware enabling the errors; changing masks does not establish that previously latched state is cleared. Table 10-42 marks PERROR bit 9 reserved (MBZ/RAZ); remove the obsolete RTO definition and reserve its bitfield. Use the system vector and frame bounds without restricting the reason code to the ES40 values. Preserve invalid frames and unknown environmental layouts in bounded raw dumps. Print CPU registers for uncorrectable system errors, including the PC needed to diagnose NXM. Gate correctable system register dumps on CONFIG_VERBOSE_MCHECK and alpha_verbose_mcheck while retaining their error decode. Keep transaction information unavailable whenever SERR is set, as required by HRM 8.8.2.6. Table 10-42 selects ECC fields for CRE/UECC. The first error freezes PERROR and only LOST can be set afterwards, so mixed error bits were detected together. The expected-probe path has no active Tsunami writer. Reporting and acknowledgment do not establish recovery; panic policy remains separate. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Restrict ES40 live environmental decoding to Clipper. Validate frame bounds and string-table masks, and separate fault bits from status context. Report valid notifications even when no recognized fault bits are set, so door-closed and supply-return notifications remain visible. A single status snapshot does not establish a recovery transition. Keep SMIR bit 0 and inverted halt/reset bits as raw context. During the ES40 PSU cable test, bit 0 remained set after the individual PSU failure indication cleared. Its polarity/latching is unverified, so do not call it a current PSU failure. Use mask 0x14 for the remaining SMIR faults. Decode only QW1 through QW7 as live environmental status, as documented in the ES40 Service Guide, Tables D-20 and D-21. Use plain door-status messages. Preserve unknown or truncated frames in bounded raw dumps. Firmware console-log scanning is independent of the live environmental handler. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
Clipper console logs have an HWRPB byte count. Bound wrapper and child traversal by that count before decoding embedded processor and system logout frames. Print the wrapper name and event/halt timestamp, halt code, and recorded CPU ID for processor packets. Acknowledge the log only after a complete termination packet. Retain the firmware pointer on unknown or incomplete wrappers and print at most 1 KiB of raw bytes using print_hex_dump(). This avoids the generic scanner's unconditional acknowledgment after a parsing failure. The ES40 record observed during testing is class 5, type 4. Its wrapper layout is unknown and remains raw and unacknowledged; it may therefore be printed again at each boot. Successful decoding of a nonempty hardware log remains unverified. Keep console scanning independent of the live machine-check and environmental handlers and restrict it to Clipper. Console environmental payloads also remain raw: ES40 Service Guide Table D-18's sys_offset conflicts with its field offsets. No register layout is assumed for unverified extended subpacket types 6 and 7. The scanner invokes the payload decoder directly during PCI init; no generic subpacket-handler registration is needed. Mark its helpers __init and retain the PCI init hook in sys_dp264.c. Signed-off-by: Magnus Lindholm <linmag7@gmail.com> Reviewed-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Magnus Lindholm <linmag7@gmail.com>
… into edac-updates
* ras/edac-drivers:
MAINTAINERS: Orphan drivers/edac/i3200_edac.c
EDAC/skx_base: Fix ambiguous bitwise and logical operator style
EDAC/i10nm: Fix mdev reference leak in i10nm_get_ddr_munits()
MAINTAINERS: Orphan drivers/edac/xgene_edac.c
MAINTAINERS: Orphan drivers/edac/x38_edac.c
MAINTAINERS: Orphan drivers/edac/i82975x_edac.c
EDAC/dummy: Add a dummy EDAC driver
EDAC/ie31200: Disable PCI device when probing fails
EDAC/intel-bff: Report frequent filter overflows
EDAC/intel-bff: Compute unique ID for overflowed filter
EDAC/intel-bff: Reset bitfix filter when it overflows
EDAC/intel-bff: Add Diamond Rapids support
EDAC/intel-bff: Add stub Intel bitfix filter driver
x86/mce: Add enumeration for Intel bitfix filter reset
cacheinfo: Export get_cpu_cacheinfo_id() for loadable modules
EDAC/i10nm: Fix Granite Rapids ADXL MC mapping
* ras/edac-misc:
EDAC/{bluefield,loongson}: Use named initializers for acpi_device_id
MAINTAINERS: Update Qiuxu Zhuo's email address
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Merge ACPICA updates and ACPI thermal control updates for 7.4: - Add IOVT IOMMU support to ACPICA (Bibo Mao) - Fix PCC OperationRegion command offsets in ACPICA (Sudeep Holla) - Fix memory leak in acpi_ds_create_field() related to the handling of internal_pcc_buffer allocations (Breno Leitao) - Fix memory leak due to leftover devm_kcalloc() argument in the ACPI fan driver (Rafael Wysocki) - Fix backlight unregistration ordering in the ACPI video bus device driver (Rafael Wysocki) - Update the thermal core to allow the registration of thermal class cooling devices under specific parents and convert the ACPI fan, ACPI processor, and ACPI video bus device drivers to do so (Rafael Wysocki) - Adjust the ACPI thermal zone driver to use thermal class cooling device parent information for binding cooling devices to trip points in thermal zones (Rafael Wysocki) - Use cooling device data that is a better match for a given driver instread of a struct acpi_device pointer that had to be used for this purpose previously in the ACPI fan and processor drivers (Rafael Wysocki) - Fix acpi_thermal_guess_offset() in the ACPI thermal zone driver for thermal zone devices with a 273.0°K offset (Hans de Goede) - Define a free for ACPI objects allocated by ACPICA helpers and use it to simplify AML error handling in the ACPI fan driver (Rafael Wysocki) * acpica: ACPICA: actbl2.h: Add bit constants of the Flags field in the IOVT IOMMU structure ACPICA: Fix PCC OperationRegion command offsets ACPICA: Fix memory leak in acpi_ds_create_field() * acpi-thermal: ACPI: fan: Use __free() to simplify AML error handling ACPI: thermal: Fix acpi_thermal_guess_offset() for device with a 273.0°K offset ACPI: fan: Use more suitable cooling device data ACPI: fan: Store ACPI device pointer in struct acpi_fan ACPI: processor: thermal: Use more suitable cooling device data ACPI: thermal: Use cooling device parent for thermal zone binding ACPI: fan: Use thermal_cooling_device_create() ACPI: video: Use thermal_cooling_device_create() ACPI: processor: thermal: Use thermal_cooling_device_create() thermal: core: Introduce thermal_cooling_device_create() ACPI: video: Fix backlight unregistration ordering ACPI: fan: Fix memory leak due to leftover devm_kcalloc() argument
Merge changes related to ACPI support in device drivers for 7.4: - Switch over the users of acpi_get_first_physical_node(), that was inherently racy and therefore not really safe to use, to use its replacement acpi_bus_get_primary_device(), and eliminate the former (Rafael Wysocki) - Add !CONFIG_ACPI stubs for acpi_find_child_device() and acpi_device_uid() (Mario Limonciello and Robin Murphy) * acpi-driver: ACPI: bus: Drop acpi_get_first_physical_node() efi/dev-path-parser: Switch to use acpi_bus_get_primary_device() ALSA: hda: tas2781: Switch to use acpi_bus_get_primary_device() ALSA: hda: cs35l41: Switch to use acpi_bus_get_primary_device() iommu/arm-smmu-v3: Switch to use acpi_bus_get_primary_device() ACPI: Add stub for acpi_find_child_device() ACPI: bus: Provide !ACPI stub for acpi_device_uid() ALSA: hda: aw88399: Switch to use acpi_bus_get_primary_device() ASoC: loongson: Switch to use acpi_bus_get_primary_device() ASoC: intel: boards: Switch to use acpi_bus_get_primary_device() ASoC: amd: acp3x-es83xx: Switch to use acpi_bus_get_primary_device() ASoC: amd: acp-es8336: Switch to use acpi_bus_get_primary_device() thunderbolt: Switch to use acpi_bus_get_primary_device() platform/x86: apple-gmux: Switch to use acpi_bus_get_primary_device() platform/x86: x86-android-tablets: Use acpi_bus_get_primary_device() platform/x86: serdev_helpers: Switch to use acpi_bus_get_primary_device() platform/x86: yogabook: Switch to use acpi_bus_get_primary_device() ACPI: amba: Switch to use acpi_bus_get_primary_device() ACPI: bus: Use acpi/acpi_bus.h without CONFIG_ACPI
…deo' Merge updates of the ACPI battery, ACPI SBS (Smart Battery System), ACPI button, and ACPI video bus device drivers for 7.4: - Fix bogus cycle count values on systems without _BIX in the ACPI battery driver (Armin Wolf) - Fix NULL pointer dereference on allocation failure and report relative state of charge as CAPACITY in the ACPI SBS driver (Itay Shem-tov and Guangshuo Li) - Add lid_init_state quirk for Razer Blade Stealth 13 (Early 2020) RZ09-0310 to the ACPI button driver (Ian Gallagher) - Add new quirks to force the native backlight on Dell OptiPlex AIO 7410 35W and Acer Nitro AN515-58 in the ACPI video bus device driver (Chitransh Mandhaniya and Dirga Yuza) * acpi-battery: ACPI: battery: Fix bogus cycle count values on systems without _BIX * acpi-sbs: ACPI: SBS: Fix NULL pointer dereference on allocation failure ACPI: SBS: report relative state of charge as CAPACITY * acpi-button: ACPI: button: Add lid_init_state quirk for Razer Blade Stealth 13 (Early 2020) RZ09-0310 * acpi-video: ACPI: video: force native backlight on Dell OptiPlex AIO 7410 35W ACPI: video: add backlight=native DMI quirk on Acer Nitro AN515-58
… 'pnp' Merge updates of the ACPI PCC (Platform Communications Channel) driver, ACPI NUMA support code, ACPI Platform Firmware Runtime Update and Telemetry driver, ACPI WMI support code, and a PNP update for 7.4: - Fix the shared memory signature handling in the ACPI PCC address space handler, free the PCC mailbox channel on operation region deactivation, and avoid unnecessary repeated computations of the PCC operation region command timeout (Sudeep Holla) - Fix a log message typo in the ACPI NUMA support code (Hemanth Selam) - Zero-initialize capability query result in the ACPI Platform Firmware Runtime Update and Telemetry driver to avoid disclosure of kernel stack data to user space (Karl Mehltretter) - Replace the remaining built-in/module check for CONFIG_ACPI_WMI in a header file with IS_ENABLED() macro (Lalit Shankar Chowdhury) - Detach device after resource transition failure in pnp_device_probe() to avoid blocking later manual PNP configuration attempts (Myeonghun Pak) * acpi-pcc: ACPI: PCC: Cache OpRegion command timeout ACPI: PCC: Free channel on OpRegion deactivation ACPI: PCC: Preserve shared memory signature in OpRegion handler * acpi-numa: ACPI: NUMA: fix typo in log message * acpi-pfrut: ACPI: pfr_update: zero-initialize capability query result * acpi-misc: ACPI: WMI: use IS_ENABLED() to simplify built-in or module check * pnp: PNP: Detach device after resource transition failure
Merge ACPI CPPC library updates the CPPC cpufreq driver updates based on them for 7.4: - Fix multiple issues related to input validation, synchronization, access safety, memory layout and register field validation, and error handling in the ACPI CPPC library (Christian Loehle and Sumit Gupta) - Select the frequency-invariance callback per CPU in the CPPC cpufreq driver and create the FIE worker before enabling PCC callbacks in it to avoid queueing work through a missing worker and dereferencing a NULL pointer (Christian Loehle) - Update the CPPC cpufreq driver entry in MAINTAINERS and add a new entry for the ACPI CPPC library (Christian Loehle) * acpi-cppc: (22 commits) MAINTAINERS: ACPI: Add a separate CPPC entry MAINTAINERS: cpufreq: Replace CPPC reviewer cpufreq: CPPC: Create the FIE worker before enabling PCC callbacks cpufreq: CPPC: Select the frequency-invariance callback per CPU ACPI: CPPC: Accept requests to retain immutable autonomous selection ACPI: CPPC: Propagate errors from cross-CPU FFH calls ACPI: CPPC: Validate FFH register fields before hardware access ACPI: CPPC: Keep Performance Limited clearable on NVIDIA T41 ACPI: CPPC: Clear Performance Limited without a stale read ACPI: CPPC: Validate SystemIO overlaps across processors ACPI: CPPC: Validate PCC overlaps across processors ACPI: CPPC: Validate SystemIO register layouts ACPI: CPPC: Validate and access PCC register layouts ACPI: CPPC: Reject direct reads of write-only controls ACPI: CPPC: Reject unsafe cross-CPU SystemMemory RMW ACPI: CPPC: Release PCC data after probe failures ACPI: CPPC: Release CPC descriptors through kobject ACPI: CPPC: Serialize PCC EPP payload updates ACPI: CPPC: Serialize PCC single-register payload updates ACPI: CPPC: Propagate performance-control write errors ...
Merge cpufreq updates for 7.4: - Minor fixes in various cpufreq drivers (Alexander Koskovich, Daniel Schwierzeck, Frank Zhang, Haotian Zhang, Kathiravan Thirumoorthy, Sumeet Pawnikar, and Xueqin Luo) - Fix wrong behaviors on multi-node servers in the Loongson cpufreq driver (Huacai Chen) - Reject NULL from cpufreq_cpu_get() in the Rust code (Mehmet Koseoglu) - Add suspend OPP to mediatek cpufreq driver and DT (Ryan Brue) - Fixups for a few bugs identified by Sashiko in the amd-pstate cpufreq driver (Mario Limoncielloi, Wentao Guan) - Initial support for maximum frequency capacity handling on Zen6 client in amd-pstate (Mario Limonciello) - Fix for amd-pstate-ut with 'Requested CPU Min frequency' BIOS option (K Prateek Nayak) - New Zen6 tuning values for EPP in amd-pstate (Mario Limonciello, Vishal Badole) - amd-pstate documentation fix (Karl Mehltretter) - Restrict deferred downscaling to low load for shared policies in the conservative cpufreq governor to avoid undesirable CPU frequency reduction in some cases (Shengming Hu) - Serialize sugov_start() against rate limit updates in the schedutil cpufreq governor to avoid using a stale rate limit value (Hui Su) * pm-cpufreq: (34 commits) cpufreq: loongson3: Replace IOCSR read/write with MMIO ones cpufreq: loongson3: Use global physical CPU ID in get/target callbacks cpufreq: loongson3: Replace per-package mutex with per-node cpufreq: loongson3: Adjust the width of id and val in smc_message cpufreq: loongson3: Make this driver depend on MACH_LOONGSON64 cpufreq: schedutil: Serialize sugov_start() against rate limit updates arm64: dts: mediatek: mt8173: Mark the lowest CPU OPPs for suspend cpufreq: mediatek: Enter system sleep at the suspend OPP cpufreq: qcom-cpufreq-hw: fix device node refcount leak in phandle parsing cpufreq: qcom-nvmem: Add IPQ9650 support cpufreq: Add Milos to cpufreq-dt-platdev blocklist cpufreq: Use %pe to print error pointers symbolically rust: rcpufreq_dt: add module alias cpufreq: sti: avoid NULL dereference in dev_err() cpufreq: tegra194: fix double-pointer error in get_cpu_ndiv cpufreq: sparc-us2e: fix frequency table index copy-paste error rust: cpufreq: reject NULL from cpufreq_cpu_get() cpufreq: amd-pstate-ut: Fix max_freq and EPP test failures on Zen6 cpufreq: amd-pstate: Propagate cppc_set_auto_sel() errors on mode change cpufreq: amd-pstate: Restore previous mode when changing driver mode fails ...
Merge cpuidle and power capping updates for 7.4: - Prevent cpuidle governors menu and teo from returning idle state 0 after it has been disabled (Xueqin Luo) - Replace min_t() with the better alternatives in the intel_idle driver and make it use 2-argument strscpy() (Andy Shevchenko) - Fix two repeated phrase instances in cpuidle (Hemanth Selam, Syazwina Fazrul) - Add rugged Panther Lake support to the intel_rapl power capping driver and make it use %pe for printing error pointers (Srinivas Pandruvada and Sumeet Pawnikar) * pm-cpuidle: Documentation: power/cpuidle: Fix repeating phrase cpuidle: tegra: fix repeated word 'that' in comment cpuidle: teo: Do not return a disabled idle state cpuidle: menu: Do not return a disabled idle state intel_idle: Use 2-argument strscpy() intel_idle: Replace min_t() with the better alternatives * pm-powercap: powercap: intel_rapl: Use %pe to print error pointers symbolically powercap: intel_rapl: Add rugged Panther Lake support
Merge updates related to runtime PM for 7.4:
- Update and improve runtime PM documentation and add a kunit test for
supplier idle/suspend (Brian Norris)
- Add a pm_runtime_dont_use_autosuspend() call to pm_runtime_reinit()
to ensure autosuspend disabling on driver teardown (Joshua Crofts)
* pm-runtime:
PM: runtime: Expand introduction with core concepts and structure
PM: runtime: Clarify driver callback expectations and structure Section 2
PM: runtime: Clarify ->runtime_idle() callback return value handling
PM: runtime: Add "Section" hyperlinks
PM: runtime: Misc improvements to runtime_pm.rst
PM: runtime: More kerneldoc formatting
PM: runtime: Correct pm_runtime_autosuspend_expiration() doc
PM: runtime: call pm_runtime_dont_use_autosuspend() on reinit()
PM: core: Document struct dev_pm_info with kerneldoc
PM: runtime: Pull API docs from kerneldoc
PM: runtime: kerneldoc wording improvements
PM: runtime: Improve set_{status,active,suspended} docs
PM: runtime: kerneldoc fixes
PM: runtime: Add kunit test for supplier idle/suspend
PM: runtime: Only queue an idle check for RPM-linked suppliers
Merge updates related to system sleep, an energy model handling update, a generic CPU PM driver update, a clock framework PM update, and a pm-graph utility update for 7.4: - Ignore page-zero RAM in E820 checksum during hibernation on x86 to avoid rejecting images created after kexec() (Matthias Goergens) - Add resume event mapping for PMSG_POWEROFF to the PM core to allow it to carry out device shutdown in the future (Mario Limonciello) - Add DPM watchdog to prepare/late/early/noirq/complete phases of device suspend and resume (Mayank Rungta) - Update swsusp.txt references to swsusp.rst in hibernation documentation (Li Jun) - Fix use-after-free of perf domain in netlink doit handlers for energy models (Fan Wu) - Add synchronize_rcu() back to cpu_pm_unregister_notifier() after it was removed inadvertently in previous development cycles to avoid use-after-free (Bradley Morgan) - Unregister CPU PM notifier outside the timer lock in the timer-ti-dm clocksource driver (Bradley Morgan) - Fix typo "sucessfully" in a comment in pm_clk_add_clk() kerneldoc comment and typo "hierachy" in a comment in pm-graph (Hemanth Selam) * pm-sleep: x86/hibernate: Ignore page-zero RAM in E820 checksum PM: sleep: Add resume event mapping for PMSG_POWEROFF PM: sleep: Add DPM watchdog to prepare/late/early/noirq/complete phases PM: hibernate: docs: update swsusp.txt references to swsusp.rst * pm-em: PM: EM: Fix use-after-free of perf domain in netlink doit handlers * pm-cpu: PM: CPU: Restore synchronize_rcu() to cpu_pm_unregister_notifier() clocksource/drivers/timer-ti-dm: Unregister CPU PM notifier outside of the timer lock * pm-misc: PM: clk: fix typo "sucessfully" in comment * pm-tools: tools: power: pm-graph: fix typo "hierachy" in comment
Merge updates of thermal control drivers for Intel platforms, a thermal control documentation update and two miscellaneous thermal control updates for 7.4: - Make the Intel powerclamp thermal driver reject invalid window_size values, drop redundant clamp() from duration_set() in it, and simplify 4 functions in it (Thorsten Blum) - Add rugged Panther Lake support to the intel_tcc_cooling thermal driver (Srinivas Pandruvada) - Fix temperature selection around 0 C in the int340x thermal driver, drop redundant else from proc_thermal_add() in it, and simplify slider_def_*_set() in it (Thorsten Blum) - Drop unbalanced paren from cpu-idle-cooling.rst (Manuel Ebner) - Use %pe to print error pointers symbolically in the thermal control code and fix assorted typos in comments in it (Sumeet Pawnikar and Hemanth Selam) * thermal-intel: thermal: intel: int340x: soc_slider: Simplify slider_def_*_set() thermal: intel: powerclamp: Simplify max_idle_set() thermal: intel: powerclamp: Simplify duration_get() thermal: intel: powerclamp: Simplify idle_inject_update() thermal: intel: int340x: Fix temperature selection around 0 C thermal: intel: powerclamp: Simplify check_invalid() thermal: intel: intel_tcc_cooling: Add rugged Panther Lake support thermal: intel: powerclamp: Drop redundant clamp() in duration_set() thermal: intel: int340x: Drop redundant else in proc_thermal_add() thermal: intel: powerclamp: Reject invalid window_size values * thermal-docs: thermal: docs: cpu-idle-cooling.rst: Drop unbalanced paren * thermal-misc: thermal: Use %pe to print error pointers symbolically thermal: fix assorted typos in comments
Merge updates of assorted thermal control drivers for 7.4: - Add the Exynos ACPM thermal driver for Google GS101, along with DT bindings and a MAINTAINERS entry (Tudor Ambarus) - Add Renesas RZ/G3L thermal sensor support and DT bindings, and move default calibration values to per-SoC match data (Biju Das) - Add Qualcomm MSM8952 TSENS support and the corresponding DT binding compatible (Muzaffer Kadir) - Document the Qualcomm PMAU0102 Master BandGap temperature monitor compatible in the DT bindings (Dhruvin Rajpura) - Extend the QCom TSENS v2 trip temperature limits to the hardware range of -204°C to +204°C to prevent interrupt storms when operating beyond the previous software limits (Priyansh Jain) - Fix temperature threshold map indexing in the QCom SPMI temperature alarm driver to prevent out-of-bounds reads (Georgi Djakov) - Describe the additional bus clock required by the Amlogic T7 thermal sensor and switch the driver to the clk_bulk API to manage multiple clocks (Ronald Claveau) - Request the Airoha EN7581 IRQ after thermal zone registration to prevent the interrupt handler from accessing an unregistered or already freed thermal zone (Vitaliy Sochnev) - Fix the Airoha AN7583 ADC mux field mapping, serialize access to the shared ADC, and verify mux selection to avoid invalid temperature readings and spurious critical shutdowns (Vitaliy Sochnev) - Register separate thermal zones for the AN7583 bandgap, GbE and CPU sensors, and update the DT bindings to use one thermal sensor cell to select the sensor (Vitaliy Sochnev) - Fix signed integer overflow in the Renesas RZ/G3E temperature-to-code conversion, preserve compare interrupt state across runtime PM, and prevent overlapping temperature conversions (Ovidiu Panait) - Remove redundant trip window validation and runtime PM pm_runtime_mark_last_busy() calls from the Renesas RZ/G3E driver (Ovidiu Panait) - Propagate reset assertion failures from Renesas RZ/G3E suspend and attempt to restore power if the sensor was active (Pengpeng Hou) - Stop the TI bandgap alert IRQ before removing sensor interfaces and cancel pending alert work to prevent use-after-free on driver removal (Weigang He) - Validate Spreadtrum sensor IDs read from the device tree before using them for register offsets and array indexing (Weigang He) - Convert the TI OMAP bandgap DT bindings to schema and document the DRA752 compatible and thermal sensor cells (Bhargav Joshi) - Use DT property helpers matching the signed temperature and unsigned hysteresis types defined by the thermal zone bindings (Rob Herring) - Reuse common error handling code in the power allocator governor bind callback (Markus Elfring) - Constify the thermal zone device operations in the i.MX9 driver (Christophe JAILLET) - Fix kernel-doc parameter names and firmware node references in the cooling device registration helpers (Aryan Sinha) - Correct the documented return value of ti_bandgap_get_sensor_data() to describe validation errors and potentially NULL stored data (Karl Mehltretter) - Ensure NUL-termination when copying the cooling device command-line argument in tmon and fix the associated string truncation warning (Florian Fainelli) - Fix undefined behavior caused by a signed shift in the tmon thermal zone binding display (Liu Jing) - Fix wording in tmon comments (Hemanth Selam) - Simplify cpufreq_set_cur_state() in the cpufreq_cooling thermal control driver (Thorsten Blum) * thermal-drivers: (36 commits) thermal/drivers/rzg3e: Propagate reset assertion failure from suspend thermal: ti-soc-thermal: Fix the return value in ti_bandgap_get_sensor_data() kernel-doc thermal/fw: Fix kernel-doc parameter names thermal/qcom/tsens: Add support for MSM8952 tsens dt-bindings: thermal: tsens: Add MSM8952 thermal/drivers/amlogic: Switch to clk_bulk API to support multiple clocks dt-bindings: thermal: amlogic: describe bus clock for t7-thermal tools/thermal/tmon: Fix string truncation warning in optarg copy thermal/drivers/airoha: Register a thermal zone per AN7583 sensor dt-bindings: arm: airoha: Use one thermal sensor cell for AN7583 thermal/drivers/airoha: Serialise access to the shared ADC thermal/drivers/airoha: Fix AN7583 ADC mux field mapping thermal/drivers/sprd: validate the sensor id from the device tree thermal/drivers/ti-soc-thermal: Cancel pending alert work on remove thermal/drivers/qcom-spmi-temp-alarm: Fix temp_map indexing thermal: gov_power_allocator: Use common error handling code in power_allocator_bind() tools/thermal/tmon: Fix signed shift UB in binding display MAINTAINERS: Add entry for Samsung Exynos ACPM thermal driver thermal/drivers/samsung: Add Exynos ACPM TMU driver GS101 dt-bindings: thermal: Add Google GS101 TMU ...
GCC may emit libcalls to __mulsi3(). As modpost is not aware that this function is provided through the linked in libgcc, it fails: ERROR: modpost: kernel/locking/test-ww_mutex.ko: symbol '__mulsi3' undefined! ERROR: modpost: kernel/time/test_udelay.ko: symbol '__mulsi3' undefined! ERROR: modpost: kernel/resource_kunit.ko: symbol '__mulsi3' undefined! ERROR: modpost: fs/fuse/virtiofs.ko: symbol '__mulsi3' undefined! etc. Make sure modpost can see the symbol from libgcc. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202610171933.J4bFOfL8-lkp@intel.com/ Fixes: 2fc8483 ("nios2: Build infrastructure") Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Acked-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
…rnel/git/vfs/vfs Pull ipc fix from Christian Brauner: "This fixes a leak in mqueue. A task in another thread group sharing the file table could register an mq_notify() and exit without closing the queue. The registration was never torn down and pinned the notification skb, the netlink socket, a pid reference and a user namespace reference forever. Stale registrations are released on inode eviction now" * tag 'ipc-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: ipc/mqueue: release notification resources during inode eviction
…nux/kernel/git/vfs/vfs Pull namespace updates from Christian Brauner: - Reject uid_map, gid_map and projid_map values that don't fit in a u32. map_write() parsed with simple_strtoul() and truncated modulo 2^32 on 64-bit so "4294967301 1000 1" was installed as "5 1000 1" without an error. Each field is parsed with kstrtou32() now and selftests cover the out-of-range, negative and in-range cases. This isn't a security fix. The truncated values were valid ids and every later check still applied to them. - Annotate struct uid_gid_map's forward and reverse pointers with __counted_by_ptr and add a KUnit suite for inserting and sorting extents. insert_extent() wrote to forward[nr_extents] before bumping the count which the annotation flags, so it bumps first now. Two follow-up fixes rename the now global helpers to uid_gid_map_insert_extent() and uid_gid_map_sort(), since the btrfs self-tests have their own insert_extent(), and guard the declarations on CONFIG_KUNIT. - Drop the BUG_ON() NULL checks in copy_mnt_ns() and copy_utsname(). create_new_namespaces() always passes a valid pointer and the other copy_*_ns() helpers don't check either. - Remove a dead key_put() on the create_user_ns() error path. * tag 'namespace-7.4-rc1.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: selftests/namespaces: add uid_map/gid_map range tests userns: reject uid_map/gid_map values that do not fit in u32 userns: declare the KUnit-visible helpers whenever KUnit is enabled userns: rename insert_extent() and sort_idmaps() userns: Add KUnit test suite for uid_gid_map userns: Add __counted_by_ptr attribute to struct uid_gid_map fs: namespace: drop BUG_ON() in copy_mnt_ns() uts: drop BUG_ON() in copy_utsname() userns: remove dead key_put() on the create_user_ns() error path
Previously we would read randomize_va_space in openpax_setup_flags, and then again later after calling openpax_setup_flags. As randomize_va_space is a sysctl, its value can change at any time. Accordingly, snapshot randomize_va_space before calling openpax_set_flags and pass the snapshot value to openpax_set_flags. This resolves a minor race condition where one may be able to slightly weaken process ASLR by turning ASLR on or off during an exec call. Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
Otherwise we have to add a bunch of #ifdefs when we otherwise would not need to. Fixes: a78588f ("init: add pax_softmode= kernel command-line option") Fixes: edera-dev#1 Signed-off-by: Ariadne Conill <ariadne@ariadne.space>
XENMEM_populate_physmap takes an extent order, but the only wrapper exposed here pins it to EXTENT_ORDER, the order that covers one native page and nothing more. Add a variant that takes an additional order, so a caller can ask Xen to back a run of pages with a single machine-contiguous allocation rather than one frame per page. For a PV domain Xen reports back only the base machine frame of each ordered extent, the rest of the extent following it. For a PVH domain it reports nothing, as the guest never handles machine frames. No functional change: xenmem_reservation_increase() becomes a wrapper at order 0 and the new variant has no callers yet. Backends: PV, PVH Direction: deflate (frames move from Xen to the guest) Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
A PV domain's page tables hold machine frames, so moving a page between
the guest and Xen means rewriting its direct map PTE through Xen. The
per-page helpers in drivers/xen/mem-reservation.c make one
HYPERVISOR_update_va_mapping call per page.
Add exported helpers that do the same for a contiguous run in batches,
through HYPERVISOR_mmu_update as xen_remap_pfn() does:
- xen_zap_contig_pfns() unmaps a run and invalidates its p2m entries,
for pages about to be handed to Xen.
- xen_remap_contig_pfns() maps a run onto frames Xen has just
populated. It writes the p2m with __set_phys_to_machine(), which
never allocates, so the caller runs xen_prealloc_p2m_range() over
the run first, before the populate hypercall, while a failure can
still be backed out of.
Both return the first failure, whether a PTE they could not find or Xen
refused to update, or a p2m entry that could not be written, and leave
what to do about it to the caller. mmu_update reports a failure back to its caller, where a
multicall batch would only log it.
Neither flushes the TLB: the intended caller only maps over PTEs that
were already cleared, and flushes after unmapping itself.
PVH domains never reach these: their page tables hold guest frames,
which do not change when Xen moves the machine frames behind them.
No callers yet.
Backends: PV only
Direction: inflate and deflate
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
A PV domain's page tables hold machine frames, so moving a page between
the guest and Xen means updating its direct map PTE and p2m entry. The
existing helpers for that take parallel arrays of pages and frames, one
entry per page. That fits order-0 extents, where Xen reports a frame per
page, but not an ordered extent, where it reports only the base frame.
Add variants that take a base page, and for mapping a base frame, and
derive the rest of a contiguous run from them, on top of the batched arch
helpers:
- xenmem_reservation_va_mapping_reset_contig() unmaps a run before its
frames are handed to Xen.
- xenmem_reservation_p2m_prealloc() and
xenmem_reservation_va_mapping_update_contig() map a run in once Xen
has populated it. The mapping step cannot allocate, so the
preallocation is a separate call, made before asking Xen to
populate: it is the only step expected to fail, and failing after
the populate would strand the frames Xen handed over.
The two directions treat a failed update differently:
- A failed map is fatal, as in the per-page helper. Callers treat the
run as mapped once the call returns, and a page with no mapping
would fault wherever it was next used, far from the cause.
- A failed unmap only warns, unlike the per-page helper. The frame
stays mapped, and Xen will not hand it to another domain while it
is, so the frame leaks but nothing is corrupted.
All three are no-ops outside a PV domain, like the helpers they sit
beside.
No functional change: the new helpers have no callers yet.
Backends: PV only
Direction: inflate and deflate
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
The balloon inflates a page at a time: it takes whatever pages the guest
buddy allocator hands out and returns their frames to Xen one order-0
extent each. Those frames need not form an aligned run, so Xen's
free_heap_pages() cannot merge them back into a 2 MiB buddy.
Add a second unit of trade, a block of 1 << 9 Xen pages: 2 MiB, the
largest extent Xen grants a domain asking on its own behalf. Inflate now
takes a whole free block with one alloc_pages() and parks it on a block
list, so its frames go back to Xen as an aligned run. On PV the block is
unmapped with the batched contiguous-run helper; on PVH there is nothing
to unmap.
The extents submitted stay order-0. XENMEM_decrease_reservation
releases each frame individually whatever the extent order, so an
ordered extent would change nothing there while asking Xen to trust that
the block is machine-contiguous, a claim it cannot check for a PV
domain, where the frame number it is handed is already the machine
frame.
A block is only an option, never a requirement, in either direction:
- balloon_inflate() takes a block only when the guest has a whole free
2 MiB run, without reclaiming or compacting to make one, and
otherwise inflates a page at a time. A guest with plenty of free
memory can still have no such run, and that must not stop it
shrinking.
- Deflate still populates a page at a time and walks only the page
list, which cannot see blocks. When that list is empty it now breaks
a parked block onto it, so the guest can always grow back into
memory it gave up as a block.
The OOM notifier sized its deflate from the page list counters alone,
so a balloon holding only blocks would look empty to it and the OOM
killer would run while the balloon still held memory. It now counts
block pages too, and its deflate reaches them through the block-breaking
path above.
Set xen.balloon_superpages=0 to inflate a page at a time as before.
Backends: PV, PVH
Direction: inflate (frames move from the guest to Xen); deflate only
changes to consume blocks
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
Deflate still breaks a parked block into pages and asks Xen to populate
each with its own order-0 extent, which lets Xen back the block with any
512 frames it has.
Populate a parked block as a single order-9 extent instead, so that Xen
allocates one machine-contiguous 2 MiB run for it:
- On PVH Xen maps that run with a single 2 MiB EPT entry rather than
512 4 KiB ones.
- On PV there is no EPT, and the guest cannot use 2 MiB mappings. The
guest maps the run in itself, with the batched contiguous-run
helper, from the base machine frame Xen reports.
The p2m leaves of each block are preallocated while walking the block
list, before the populate hypercall: mapping the block afterwards cannot
allocate, and once Xen has populated an extent there is no way to hand
it back. Failing there only shortens the batch.
A block is only an option here too. balloon_deflate() falls back to the
page at a time path when a block makes no progress: Xen refuses an
order-9 extent when the host has no free 2 MiB run, or when the domain
is less than 2 MiB below its max_pages ceiling, and neither should stop
the guest growing by what it can still get. Credits smaller than a block
take the page at a time path as well.
Blocks are populated at most BALLOON_BLOCK_BATCH at a time, which bounds
the work done under balloon_mutex; the OOM notifier can only trylock it.
Backends: PV, PVH
Direction: deflate (frames move from Xen to the guest)
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
The OOM notifier deflates through increase_reservation(), which works a page at a time and reaches parked blocks only by breaking them up. Deflate through balloon_deflate() instead, so that an OOM deflate populates a whole block as a single order-9 extent where Xen can supply one, and still falls back to single pages where it cannot, including the last 2 MiB below the domain's max_pages ceiling. Backends: PV, PVH Direction: deflate (frames move from Xen to the guest) Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
xen_init_time_common() points x86_platform.calibrate_tsc at xen_tsc_khz() but leaves calibrate_cpu native, so tsc_early_init() -> determine_cpu_tsc_frequencies() still calls native_calibrate_cpu_early() for cpu_khz. That tries CPUID 0x16, then MSR_PLATFORM_INFO, and then falls through to quick_pit_calibrate() -- which on a PVH guest waits out its full 50ms timeout on a PIT that is not there, prints "Fast TSC calibration failed", and arrives at a value the hypervisor had already been asked for a moment later. It is 48ms of every boot, and it is the largest single item in one: a 512 MiB PVH guest reached "Run /init as init process" at 0.330s, and 0.118s once this and the xenbus boot wait were out of the way. There is nothing for the calibration to find out here. Xen reports the TSC frequency, tsc_khz already comes from it, and cpu_khz differing from tsc_khz under a hypervisor is not information -- determine_cpu_tsc_frequencies() would overwrite cpu_khz with tsc_khz anyway once they disagree by more than 10%. Note that tsc_early_khz= does not help: it only short-circuits calibrate_tsc, and the 50ms is spent in calibrate_cpu. Set in xen_init_time_common() so PV and PVH/HVM guests both get it, which is where calibrate_tsc is already set for the same reason. Signed-off-by: Alex Zenla <alex@edera.dev>
boot_wait_for_devices() sleeps HZ/10 between checks, so on a CONFIG_HZ=100 kernel it waits a tenth of a second to notice something that has already happened. What it is waiting for is not slow: a toolstack has every backend sitting in XenbusStateInitWait before it unpauses the guest, so the wait covers the frontend half of the handshake, which finishes a few milliseconds after the late_initcall starts looking. Measured on a PVH guest, the last frontend connected at 0.232s and init started at 0.311s -- 79ms of sleeping past the event. Frontends move to XenbusStateConnected (and blkfront sets is_ready) from their otherend_changed callback, which runs from the frontend bus's backend_changed() watch. Bump a sequence count and wake a wait queue there, and have wait_for_devices() sleep on it instead of for a fixed interval. The sequence is sampled before each check, so a change that lands between the check and the sleep still wakes the waiter. The HZ/10 interruptible sleep stays as the timeout, so state changes that do not come through the watch are noticed no later than before, and the 30/270-second budgets and their reporting are unchanged. Signed-off-by: Alex Zenla <alex@edera.dev>
Port the nightly upstream rebase from the Xen tree to the kernel. Every night at 03:23 UTC, Claude rebases edera/mainline onto torvalds master, following .automation/skills/upstream-rebase/SKILL.md: it replays the series, resolves conflicts, fixes what the replay broke, builds, audits upstream fixes that meet the series, and writes a report. The model's own account of its result decides nothing. It runs with a read-only token; its branch leaves the job as a git bundle and is judged by scripts taken from the commit the run started from: - verify-upstream-rebase.sh (unchanged from Xen) proves the series sits on the upstream tip, is linear, kept every commit, and moved the tree by exactly the upstream delta; - kernel-build.sh builds x86_64 and arm64 vmlinux with the Hyper-V, Xen dom0/backend, PV-IOMMU, NUMA affinity and OpenPaX options built in, and fails if olddefconfig drops any of them. If both pass and the report asks for no decision, edera/mainline is force-pushed with a lease pinned to the tip the rebase started from, and the old tip is kept as a backup branch. Otherwise the result goes up as a pull request carrying the report, and approving it lands it (rebase-land.yml). A night with no result opens an issue. Every job clones blobless: the jobs need the kernel's commit graph but only the contents of the files the series and upstream touch.
The rebase runs from a scheduled or dispatched event and needs its own federation rule rather than the organization-wide one, so read it from vars.REBASE_FEDERATION_RULE_ID.
edera/6.18-lts carries its own rebase automation, but scheduled workflows run only from the default branch. Add a workflow here whose only job is to dispatch edera/6.18-lts's kernel-nightly.yml each night.
OPENPAX currently defaults to y, which means OpenPaX gets enabled for any configuration that picks up the new symbol, including ones that never asked for it. Default it to n so it has to be selected explicitly. While at it, make OPENPAX_SOFTMODE depend on OPENPAX. Soft mode does nothing without OpenPaX enabled, so there is no reason for it to be selectable (and default y) on its own. Signed-off-by: Alex Zenla <alex@edera.dev> (cherry picked from commit 514cd60)
edera/6.18-lts proposes a backport of each pull request merged into edera/mainline, driven by its own workflows. Add a workflow here whose only job is to dispatch that, skipping pull requests labelled no-backport and the nightly's rebase pull requests.
xen-pciback seizes a hidden device in an fs_initcall, but the Xen IOMMU registered from a device_initcall. Registering probes every PCI device that already exists, so a hidden device was found with a driver bound and the IOMMU core warned about a late probe at driver bind. Register from subsys_initcall_sync instead, so the IOMMU is in place before pciback binds anything. Signed-off-by: Alex Zenla <alex@edera.dev>
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
All of the extra memory Linux reserves at boot goes to the mapping pool, so dom0's balloon starts empty. Growing dom0 at runtime then means memory hotplug, which places the new range at the first free physical address: on PVH that is the host's own map, where nothing guarantees the range is not a device's MMIO window. Keep the part of the extra memory dom0 may grow into on the balloon instead. Xen's ceiling for dom0 (dom0_mem=...,max:) sizes that part, so a host booted without a max: keeps today's behaviour. Every region gives up the same fraction, which spreads the growth over the NUMA nodes on PVH and leaves each node's mapping pool its share, and the last memory section stays with the pool so that early grant mappings never fall back to holes in the physical map. Signed-off-by: Alexander M. Merritt <alexander@edera.dev>
A request that does not fit in its ring sleeps in io_wait_event_killable() until the backend frees space, but the event handler wakes the ring with wake_up_interruptible(), which only wakes TASK_INTERRUPTIBLE sleepers. A TASK_KILLABLE waiter therefore sleeps until it is killed, which hangs a guest that has enough large requests in flight to fill a ring. Wake the ring with wake_up() so killable waiters see the freed space. Fixes: 9523fea ("net/9p: Switch to wait_event_killable()") Signed-off-by: Alex Zenla <alex@edera.dev>
The frontend's resume handler only warned that suspend and resume are unsupported. After a restore its rings, grant references and event channels are gone, yet the mounted client kept writing requests into them, so every request on the mount hung. The next InitWait from the backend then allocated a second frontend instance for the same device, which no client used. On resume, collect any replies the backend left in the rings, free the rings, fail the requests that are still unanswered with -EIO, and publish Initialising so that a backend which still serves the old rings starts over. When the backend reaches InitWait, allocate and publish new rings for the existing frontend, keeping its clients. Requests that arrive while the frontend is not connected wait until it is, and a rw_semaphore keeps them off the rings while a resume replaces them. Signed-off-by: Alex Zenla <alex@edera.dev>
A forked, restored or imported domain resumes against a new backend whose fid table is empty, while the guest's 9P clients still hold the fids of the session they were suspended with. With the transport reconnected every request on those fids still fails, so even an idle mount comes back unusable. When the backend advertises feature-session-transfer, wait at suspend for the requests in flight to be answered, then ask the backend for its fid table with Tsession_save and keep the pages in guest memory, where they survive into whatever domain the guest resumes in. Once a restored frontend's new backend connects, replay the pages with Tsession_restore before any request can use the rings. The pages are opaque to the frontend; the backend validates every entry as it would a walk or open. Signed-off-by: Alex Zenla <alex@edera.dev>
The toolstack has to know whether a guest can carry its 9P session into a new backend before it exports the domain, because a guest that cannot comes back with every open file on its mounts unusable. Until now only the backend advertised the feature, and the frontend's support was invisible from dom0. Publish feature-session-transfer = 1 in the frontend's own xenstore directory, next to version and num-rings. Signed-off-by: Alex Zenla <alex@edera.dev>
arch/x86/xen/enlighten.c includes xen/interface/memory.h for XENMEM_maximum_reservation, but memory.h uses xen_ulong_t, domid_t and GUEST_HANDLE without including where they are defined, xen/interface/xen.h. Other configurations reach those through an earlier include. The zone-tiny configuration does not, and fails to build with CONFIG_WERROR=y: include/xen/interface/physdev.h:41:5: error: unknown type name 'xen_ulong_t' Include xen/interface/xen.h first, as arch/arm/xen/enlighten.c does. Signed-off-by: Alex Zenla <alex@edera.dev>
A node whose pool is short called fill_list() even when other nodes still held free pages. fill_list() takes new address space from iomem_resource, which on a PVH dom0 can overlap MMIO that Xen has identity mapped. A later grant map onto such a gfn makes Xen refuse the p2m change and crash dom0. Carve a new region only when every node's pool is short, and otherwise take pages from the preferred node first, then the others. Return pages to the pool of their own node when the PV p2m allocation fails.
…ode variant Borrowing across nodes made xen_alloc_unpopulated_pages_node() best effort, so a caller that asked for a node could get pages of another. The node variant now takes pages only from the requested node's pool and fails with -ENOMEM when it is short. It no longer carves a region. xen_alloc_unpopulated_pages() has no node requirement: it prefers the local pool, borrows from other nodes, and carves a region only when every pool is short. xenbus falls back to it when the node's pool is short, and gnttab_alloc_pages_node() uses it for NUMA_NO_NODE.
3 of 4 tasks
Author
|
Superseded by #48. |
edera-rebase-app
Bot
deleted the
rebase/edera-mainline/20261022-4e04beff425b-4403278e4ea2
branch
October 23, 2026 04:35
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nightly rebase of
edera/mainline(4e04beff425b) ontomaster(4403278e4ea2), driven by Claude. Not pushed automatically because the checker found drift. Run log.Important
Do not use the merge button: this branch replaces
edera/mainlinerather than merging into it. Approve the pull request to land it; the land workflow force-pushesedera/mainlineto the approved head, pinned to4e04beff425b, and keeps a backup.Independent checks
Builds: success (x86_64 and arm64 vmlinux with the Edera features built in; per-build results in the run).
4e04beff425bf34bd0f7ff4dc03c1a14507d4403278e4ea2Commits whose hunk context moved (own +/- lines identical)
4dea901e50b7 xen-blkfront: place per-ring buffers on per-hctx nodes→ff77b7e8495aef5473f15598 xattr: add support for retrieving PaX flags stored in xattrs→926892c25091e29043736bdb arm64: determine stack entropy based on mmap entropy→ba1adc2c7385Drift (changed lines: upstream delta vs. actual change)
Claude's report
Summary
Rebased
edera/mainline(4e04beff425b) onto torvalds master4403278e4ea2(v7.2-rc5-23991-g4403278e4ea2), from merge basec03c1a14507d(v7.2-rc5-21622-gc03c1a14507d): 2195 new upstream commits. All 91 downstream commits were replayed linearly ontorebase-result(f34bd0f7ff4d). One conflict came up (xen-blkfront) and was resolved; no commits were dropped and no build fixes were needed. Two more commits (xattr PaX flags, arm64 stack entropy) changed only in hunk context.verify-upstream-rebase.shpasses every check except "Downstream drift", and that drift is exactly the xen-blkfront resolution described below. Expect the checker to report that drift.Needs a decision
None.
Conflicts resolved
xen-blkfront: place per-ring buffers on per-hctx nodesindrivers/block/xen-blkfront.c, functionblkif_free_ring(). It collided with upstreamf3e27b795572 xen-blkfront: unbind irq before tearing down ring and shadow requests(Fixes:, Cc: stable). That fix movesunbind_from_irqhandler()from the end ofblkif_free_ring()to the start, so the event-channel handler can no longer race with the freeing of persistent grants, shadow requests and the shared ring. The downstream commit had wrapped the old trailing unbind so that it first callsirq_update_affinity_hint(rinfo->irq, NULL). That call drops the affinity hintsetup_blkring()now installs, sofree_irq()does not warn. Resolution: keep upstream's early position and add the downstream hint-clearing in front of the unbind there. The trailing copy is removed, so the IRQ is torn down once, first, as the fix requires. Clearing the hint beforefree_irq()is the same order the downstream commit used. This is the only drift the checker reports.Dropped downstream commits
None.
Build fixes
None.
Upstream commits that meet the series
Fixes (Fixes:/stable/CVE), checked in the final tree:
f3e27b795572 xen-blkfront: unbind irq before tearing down ring and shadow requests: conflicted, see above. In the final tree the unbind (with the downstream hint clear) is the first thingblkif_free_ring()does. The downstreamsetup_blkring()failure path callsblkif_free()→blkif_free_ring(), so it is covered by the fix as well.61b6d1df1d62 xen-blkfront: Fix IO race during unplug(stable): intact.blkfront_closing()only callsblk_mark_disk_dead(). The series does not touchblkfront_closing(). The remainingblk_mq_stop_hw_queues()call inblkif_free()is also in upstream.2176dea8d8c1 xen/gntdev: prevent private mappings from becoming writable(Fixes:, stable): intact.gntdev_mmap()still clearsVM_MAYWRITEfor non-shared VMAs. The downstreamgntdev_relocate_map()runs insidegntdev_map_grant_pages()and only changes which placeholder pages back the map. It does not touch the VMA flags, so the check still covers relocated maps.3b4854b69ee7 xen/pcifront: check that an AER callback exists before calling it(Fixes:, stable): intact. NULL checks are present formmio_enabled,slot_resetandresume.5d12c51bd98c xen/pcifront: Fix PCI device reference leak in AER handling(Fixes:): intact.pcidevis declared__free(pci_dev_put). The downstreampcifront_machine_sbdf()is a separate function and takes no pci_dev references.9b4df0baa2aa xen/blkback: Prevent missed completion when draining I/O(Fixes:): touchesblkback.c, which the series does not touch. The downstream blkback NUMA placement commit does not affect draining.Other upstream commits touching files the series touches (none conflicted):
738989053b0a xen: use get_user()/put_user() in gntdev and privcmd: present ingntdev_copy(). No__get_user/__put_userremains in gntdev.c or privcmd.c.2e2f69fc8ae2 PCI/MSI: Skip MSI/MSI-X programming while the channel is offline: all offline checks are present. The downstreamxen_pv_domain()early return inpci_write_msg_msix()sits below the newpci_channel_offline()check in__pci_write_msi_msg(), so the two do not interact.71d59fc2a5e3 xen: fix typos in comments(xen.h, xenbus.h): comments only.03a56ee3418b,737362c7012a,16d90b57d843,0c18a70900ee, plus025756ee7b47(fs/namespace): theconst struct mnt_idmapport. The downstreampax_getxattr()passesfile_mnt_idmap(file)straight toinode_permission(), so the const change carries through. The builds confirm it compiles.98a2606e3295,3f0993fbe42b,c2fe52e23c12coredump cleanups (fs/binfmt_elf.c): onlyelf_core_dump()/fill_note_info(), which the OpenPaX changes inload_elf_binary()do not touch.e93a371bb49f arm64: Remove all usage of __AARCH64EB__(arch/arm64/include/asm/elf.h): sits next to the downstreamSTACK_RND_MASKchange, which only moved in context.5b9a28eeed37 sched: dynamic: Remove HAVE_PREEMPT_DYNAMIC_{CALL,KEY}(arch/Kconfig): unrelated to the downstreamARCH_MMAP_RND_*BITSdefault change.228200f695c0 x86/CPU/AMD: Fix Zen5 TLB sizes reporting(amd.c): unrelated to the downstream Xen domU guard inprint_s5_reset_status_mmio().d80ff69c9a37 drivers: Kconfig: Simplify dependencies on ARM64 && !CPU_BIG_ENDIAN(drivers/hv/Kconfig): this loosens the HYPERV arm64 dependency only. The x86 dependency that the nested-on-Xen code relies on is unchanged.4630bd788534,3179c85ef46e,b4f053ce51ee,5de907d24919,c0fa92ccfdc9,813f2ad27003,eb0fde98fee4,648d44bda731,358c2e2c229d,496a8c6bac54,e74e01e917fa,582f575b9b66,c7be8d92b77b,67a8d2024f62,e165c1a08aa8,9cff73421bbe,11d447e9f26c,c8663e0457e6: docs only. The downstreampax_softmode=entry replayed cleanly.Builds
BUILDS_PLACEHOLDER