Merge tag 'perf-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull perf events updates from Ingo Molnar:
- Support SIMD/eGPRs/SSP register sampling in perf
(Dapeng Mi, Kan Liang)
- Turn amd_uncore_ctx events into a flexible array (Rosen Penev)
- Finish the work related to fixing the guest PEBS path to not
set unwanted PERF_GLOBAL_CTRL bits, for which urgent fixes
are upstream already (Sean Christopherson)
- Drop redundant counter slot searches in the AMD uncore
driver (Usama Arif)
- Don't WARN when the ext_regs_buf allocation fails (vineash)
- Annotate x86_pmu::hybrid_pmu with __counted_by_ptr (Thorsten Blum)
[23 lines not shown]
Merge tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull objtool updates from Ingo Molnar:
- Add unit test suite for objtool klp functionality and
known failure modes (by Song Liu and Puranjay Mohan,
with fixes by Joe Lawrence)
* tag 'objtool-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (58 commits)
objtool/klp: Add test for ThinLTO symbols sharing a demangled name
objtool/klp: Add test for Clang switch jump tables
objtool/klp: Add test for UBSAN metadata in an unchanged function
objtool/klp: Add test for absolute and __ADDRESSABLE symbols
objtool/klp: Add test for a patch which strips a data annotation
objtool/klp: Add test for the alignment of cloned data sections
objtool/klp: Add test for alternative replacement code in checksums
objtool/klp: Add test for instruction operand checksums
objtool/klp: Add test for a static call introduced by the patch
objtool/klp: Add test for tracepoint and pr_debug static branch keys
[11 lines not shown]
Merge tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking updates from Ingo Molnar:
- In the refcount checking code, BUG() on UAF related errors if
CONFIG_BUG_ON_DATA_CORRUPTION=y (Jann Horn)
- Add {over,under}flow detection for local_interrupt_{enable,disable}()
(Boqun Feng)
- Add kunit test case for max local_interrupt_disable() nesting level
(Boqun Feng)
- Clarify comment (Boqun Feng)
* tag 'locking-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
irq: Add max local_interrupt_disable() nesting level kunit test case
irq: Explain better on NMI_MASK overflow condition
irq: Add {over,under}flow detection for local_interrupt_{enable,disable}
refcount: Use CONFIG_BUG_ON_DATA_CORRUPTION for UAF-related errors
Merge tag 'x86_tdx_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 TDX updates from Dave Hansen:
"There are two high-level things going on here.
First, TDX host systems currently consume ~0.4% of physical memory for
their own memory metadata. This is all-or-nothing; you either pay the
0.4% or can not use TDX. A new TDX module feature (Dynamic PAMT)
allows this metadata to be allocated for 2MB of host memory at a time.
This, of course, saves precious DRAM when TDX utilization is low on a
host.
Second, the TDX ABI has fixed-size "quotes" that are passed around
during attestation operations. These 128k buffers are far too small
for post-quantum cryptography where the quotes grow substantially. The
TDX module now has the ability to enumerate the sizes of the quote
buffers. Plumb the new size enumeration into the kernel"
* tag 'x86_tdx_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
[19 lines not shown]
Merge tag 'x86_mm_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 mm updates from Dave Hansen:
"The __add_pages() and pgd_clear() ones are pretty mundane.
But the W^X ones are worth calling out. Effectively, the checks that
were supposed to be looking out for Write+Exec permission mappings
were busted. This fixes them, so we should all be on the lookout for
new warnings, both false positives and real ones.
Summary:
- Fix void/int conditional in pgd_clear()
- Fix spurious warning on __add_pages() failure
- Make W^X detection actually work"
* tag 'x86_mm_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/mm: Fix spurious warning on __add_pages() failure
x86/mm: Fix void/int conditional in pgd_clear()
x86/mm/pat: Use pr_warn() for early W^X warnings
x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
Merge tag 'x86_microcode_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 microcode loader update from Dave Hansen:
"This one simply brings the 'old microcode' list up to the May 2026
release.
This continues the policy of intentionally lagging Intel's releases by
roughly six months, so when the kernel complains, it it for _really_
old microcode"
* tag 'x86_microcode_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/microcode/intel: Refresh old_microcode defines with the May 2026 release
Merge tag 'x86_kdump_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 kdump update from Dave Hansen:
"Some kdump code is using NR_CPUS_DEFAULT as if it were the actual,
in-use max number of CPUs. Move it over to use NR_CPUS instead.
I suspect this one being in-tree for a few years means that the vast
majority of kdump users are on distro kernels that don't drop NR_CPUS
below the defaults"
* tag 'x86_kdump_for_7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
crash: Update stale NR_CPUS_DEFAULT references in elfcorehdr sizing docs
x86/crash: Reserve elfcorehdr for CONFIG_NR_CPUS, not CONFIG_NR_CPUS_DEFAULT
Merge tag 'x86_sev_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 SEV updates from Borislav Petkov:
- Report in sysfs which SEV confidential computing features are enabled
in the environment so that related components like a SVSM can query
them and do appropriate configuration
- Add support for a new AMD SEV instruction called RMPOPT which can be
used to reduce the performance overhead of doing confidential guests'
page ownership verification and the like. Work by Ashish Kalra
* tag 'x86_sev_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/sev: Report MSR_AMD64_SEV in sysfs
x86/sev: Do RMP optimizations on SNP guest shutdown
x86/sev: Perform RMP optimizations asynchronously
x86/sev: Initialize RMPOPT configuration MSRs
x86/sev: Disable CPU hotplug while SNP is active
x86/cpufeatures: Add X86_FEATURE_RMPOPT feature flag
Merge tag 'x86_platform_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 platform updates from Borislav Petkov:
- Remove code for a no-longer supported Technology Systems 5500 board
- Use named initializers for struct acpi_device_id in the OLPC platform
driver
* tag 'x86_platform_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/platform/olpc: Use named initializers for acpi_device_id
x86/platform: Remove Technology Systems 5500 board
Merge tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 FPU state updates from Borislav Petkov:
- Document and cleanup the signal frame handling with the goal to allow
process migration between CPUs with different FPU capabilities but
which use only a common set of FPU features, i.e., think
checkpoint/restore (Andrei Vagin)
- Consolidate how XSTATE features are checked by doing them once during
boot with the intent of removing cpu_has_xfeatures(). Latter will
happen in the next cycle (Eric Biggers)
- Other cleanups
* tag 'x86_fpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/fpu: Remove additional remnants of math emulation
x86/fpu: Remove unnecessary checks for X86_FEATURE_FPU
selftests/x86: Add tests for signal frame FPU portability
[13 lines not shown]
Merge tag 'x86_cpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 cpu feature updates from Borislav Petkov:
- Rework early CPU features detection code to handle a case
where recorded CPU capabilities are temporarily cleared in
an interruptible region.
The practical implication of this lead to, for example, KASAN
complaining due to 5-level pagetable support disappearing
intermittently (Ihor Solodrai)
- AMD Zen5 started reporting TLB sizes as multiples of 32 so adjust
the TLB sizes reporting code to consider that
- Return the proper retval when trying to enable user shadow stacks
* tag 'x86_cpu_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/cpu: Don't transiently clear the boot CPU's capabilities
[6 lines not shown]
Merge tag 'x86_cleanups_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 cleanups from Borislav Petkov:
- The usual pile of cleanups all over the place
* tag 'x86_cleanups_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/asm: Remove CR4 read fault handler
x86/um: Remove unused <asm/required-features.h> header
x86/cpu: Constify struct x86_cpu_id
x86/asm/string_64: Remove unused linux/jump_label.h include
x86/mtrr: Fix kernel-doc notation of amd_set_mtrr()
powerpc/align: use get_user_instr() for a user-mode instruction
fix_alignment() already reads the instruction with
copy_inst_from_kernel_nofault() when the PC is a kernel address, and
only uses __get_user_instr() when it is not. That pointer is an
ordinary user address, so read it with get_user_instr(). On powerpc
__get_user() already does might_fault() and opens user access for the
read itself, so the only difference is the address check.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
powerpc/signal64: use get_user() for the single context reads
swapcontext and rt_sigreturn read the signal mask with
__get_user_sigset(), and rt_sigreturn also reads the MSR and uc_link
words of the transactional-memory path, each with one __get_user()
after an access_ok() on the whole context.
Make the helper get_user_sigset(), built on get_user(), and use
get_user() for the other two. On powerpc __get_user() already does
might_fault() and opens user access for the read itself, so the only
difference is the address check, which these pointers pass anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
powerpc/signal64: use scoped user access in setup_trampoline()
setup_trampoline() writes the seven words of the on-stack sigreturn
trampoline with __put_user(), relying on the frame having been checked
when the frame setup opened its user write access. It is called after
that access has been closed again, so each of the seven writes opens and
closes user access on its own.
Write them inside one scoped_user_write_access_size() covering the
whole trampoline instead. Everything in it is a store, so a write-only
window is enough, and the instruction cache flush stays outside it.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
powerpc/signal32: use get_user() for the single context reads
A few places in the 32-bit and compat signal code read a single field
with __get_user(): the uc_regs and MSR words in swapcontext and the
transactional-memory sigreturn and setcontext paths, and uc_link in
rt_sigreturn. They are not part of a run of accesses, and either rely
on an earlier access_ok() or on compat pointers being below 4GB.
Use get_user(). On powerpc __get_user() already does might_fault() and
opens user access for the read itself, so the only difference is the
address check, which these pointers pass anyway.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
KVM: PPC: Book3S HV: use get_user()/put_user() for the HPT fd
kvm_htab_read() and kvm_htab_write() check the user buffer with
access_ok() once and then move each HPT entry with two __put_user() or
__get_user() calls, with real work between entries. Each of those
accesses opens and closes user access on its own, so the up-front check
saves nothing.
Use put_user() and get_user(). On powerpc the only difference is the
address check: __get_user() and __put_user() already do might_fault().
kvm_htab_write() holds mmu_setup_lock across the loop, but it already
reads each header with __copy_from_user() under that lock, so nothing
new happens under it. The access_ok() calls stay.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
powerpc/powernv: use get_user()/put_user() in the LPC debugfs files
lpc_debug_read() and lpc_debug_write() check the user buffer with
access_ok() once and then move it one access at a time with
__put_user() or __get_user(), with an OPAL call in between each. Each
of those accesses opens and closes user access on its own, so the
up-front check saves nothing.
Use put_user() and get_user(). The access_ok() stays, so a bad buffer
still fails before any LPC cycle is done.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
ARM: signal: stop using __put_user() for the signal frame
The signal frame is checked with access_ok() once, in get_sigframe(),
and a few of its fields are then written with __put_user(): the ucontext
flags and link, the end marker after the coprocessor state, and the
sigreturn trampoline words.
Use scoped_user_write_access() with unsafe_put_user() where there are
several writes in a row, and put_user() for the two single ones. ARM
has no user_access_begin(), so the scopes are the same access_ok() and
the same accesses as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
ARM: OABI: use scoped user access in epoll_put_uevent()
The generic epoll_put_uevent() writes the two fields of each event
inside scoped_user_write_access_size(). The ARM override, which also
handles the packed OABI layout, still does it with __put_user(), relying
on the access_ok() that ep_check_params() does on the whole array.
Do it the same way as the generic version, for both layouts. ARM has no
user_access_begin(), so the accesses are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
s390: use get_user()/put_user() instead of the unchecked variants
On s390 user space is a separate address space, so access_ok() has
nothing to check, and get_user() and put_user() are __get_user() and
__put_user() plus might_fault(). The remaining callers can use the
normal accessors directly:
- signal frame setup writes the back chain, the signal number and the
ucontext header in process context;
- the user stack walker for stack traces and perf callchains already
runs under pagefault_disable(), where might_fault() returns early;
- the general register set writer for ptrace runs in the tracer's
process context with no locks held.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
ARM: signal: check the FDPIC function descriptor address
When a task has FDPIC_FUNCPTRS in its personality, setup_return() treats
the signal handler as a pointer to a function descriptor and reads the
entry point and GOT pointer from it with __get_user(). Nothing checks
that pointer: it is whatever the task passed to sigaction(), and any
task can set FDPIC_FUNCPTRS with personality(2). BINFMT_ELF_FDPIC is
not limited to !MMU on ARM.
On most configurations this is harmless only by accident. With
CPU_SPECTRE (ARMv7) __get_user() is get_user(). With CPU_USE_DOMAINS
(ARMv5 and older) it uses the unprivileged ldrt, but that only stops at
kernel memory when software PAN has put the kernel domain in client
mode; with ARM_PAN=n the kernel domain stays in manager mode, where
permissions are not checked. So on an ARMv6-only MMU kernel, or an
ARMv5 or older one without ARM_PAN, it reads two words of kernel memory
that end up in the task's PC and r9.
Use get_user(), which checks the address. This goes back to commit
[4 lines not shown]
Merge tag 'x86_cache_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 resource control updates from Borislav Petkov:
- Push down into arch code the rounding of bandwidth control user
values due to the different ways ARM and x86 report MBA
- Fix task reporting for the default group for systems which support
only bandwidth monitoring, aka Haswell vintage computing
- The usual fixlets and improvements
* tag 'x86_cache_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
fs/resctrl: Ensure default group reports tasks on monitor-only systems
x86,fs/resctrl: Add event group descriptions for Intel Diamond Rapids
x86/resctrl: Update documented unit for the "activity" event
fs/resctrl: Simplify pseudo_lock_measure_trigger()
fs/resctrl: Avoid extra call to strlen() in schemata_list_add()
fs/resctrl: Factor MBA parse-time conversion to be per-arch
[2 lines not shown]
Merge tag 'x86_bugs_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 CPU speculation updates from Borislav Petkov:
- AMD Zen6's BTB has per-context tagging so there's no need for the
expensive SRSO SafeRET mitigation anymore; add glue to detect and
handle that
- Fix Spectre v2 mitigation reporting for RETPOLINE=n builds
* tag 'x86_bugs_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/bugs: Fix CONFIG_MITIGATION_RETPOLINE=n mitigation reporting
x86/bugs: Adapt SRSO mitigation to Zen6
alpha: split the prefetch check in do_page_fault() by mode
Before EV6, a load into $31 or $f31 could fault, so do_page_fault()
reads the faulting instruction and skips it if it is such a prefetch.
The PC can be a user or a kernel address, since the check runs for
faults from either mode, and it reads it with __get_user() either way.
That only works because alpha's __get_user() does no address check. It
also ignores the error, relying on the fault fixup zeroing the
instruction, which does not decode as a prefetch.
Move the check into is_prefetch(), and read the instruction with
get_user() for a user-mode PC and get_kernel_nofault() for a kernel one.
A failed read now explicitly means "not a prefetch".
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
openrisc: use get_kernel_nofault() in show_registers()
show_registers() dumps the stack and the code around the PC, but only
for a kernel-mode fault, and only after checking that each address is
at or above PAGE_OFFSET. Both are kernel addresses that may not be
mapped.
It reads them with __get_user(), which predates get_kernel_nofault(),
the interface for exactly this: a kernel address that may not be mapped,
read with page faults disabled.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
alpha: use get_kernel_nofault() in dik_show_code()
dik_show_code() dumps the instructions around the PC when the kernel
dies. Both callers, die_if_kernel() and the kernel unaligned-access
handler, only get there for a kernel-mode PC: die_if_kernel() returns
early for user mode, and user-mode unaligned traps go to
do_entUnaUser() instead.
It reads that kernel text with __get_user() through a cast to a user
pointer. That works only because alpha's __get_user() does no address
check, and it predates get_kernel_nofault(), which is the interface for
exactly this: a kernel address that may not be mapped, read with page
faults disabled.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
Merge tag 'x86_boot_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 boot updates from Borislav Petkov
- Rework the early decompressor some and drop the version of panic()
there which used vsnprintf() supplied by the EFI stub even in legacy
boot cases, where the EFI stub is not present (Ard Biesheuvel)
- Fix unbootable VMs with CONFIG_PVH=y and CONFIG_KASAN_GENERIC=y where
the compiler decides not to inline __builtin_{memcmp,memset}(). Force
the inlining with the kernel's own __inline_* versions (Mauricio
Faria de Oliveira)
- Cleanups and fixlets
* tag 'x86_boot_for_v7.4_rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
x86/boot: Drop unused implementation of panic()
x86/boot: Move unaccepted memory handling out of the decompressor
x86/tdx: Share tdx_panic() with the EFI stub
[5 lines not shown]
nios2: use scoped user access for the signal frame
rt_setup_ucontext() and rt_restore_ucontext() move the saved registers
with __put_user() and __get_user(), OR-ing the errors together, relying
on the access_ok() done on the whole frame by setup_rt_frame() and
do_rt_sigreturn(). setup_rt_frame() writes the ucontext flags and link
the same way.
Do those accesses inside scoped_user_{write,read}_access() instead, with
unsafe_{put,get}_user(). The gregs pointer is now derived inside each
scope, from the pointer the scope checked. restore_altstack() is called
after the scope. The access_ok() calls stay: do_rt_sigreturn() still
needs its own for the __copy_from_user() of the signal mask.
A fault part way through now stops at the first failing access instead
of carrying on. Either way the task gets SIGSEGV. nios2 has no
user_access_begin(), so the accesses themselves are the same as before.
This is part of getting rid of __get_user() and __put_user() entirely.
[2 lines not shown]
