linux-next.git/arch/arm64/kernel, branch master

Merge branch 'master' of https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git

2026-09-04T17:51:04+00:00

Merge branch 'kexec-fixes' of https://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux.git

2026-09-04T16:46:39+00:00

arm64: Don't read GMID_EL1 when MTE is disabled

2026-09-03T13:03:23+00:00

__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw ID_AA64PFR1_EL1, so it reads the register even when the kernel has disabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5 in that case, and pKVM injects an UNDEF the host cannot handle: Internal error: Oops - Undefined instruction: 0000000002000000 [#1] SMP pc : __cpuinfo_store_cpu+0xf4/0x264 Kernel panic - not syncing: Attempted to kill the idle task! Only pKVM reaches it, and only after a CPU is offlined and brought back online: its CPU_ON relay sets the host HCR before the CPU enters EL1, while plain nVHE sets it at CPUHP_AP_KVM_ONLINE. Gate the read on the CPU's own ID_AA64PFR1_EL1 with the command-line override applied, and on CONFIG_ARM64_MTE, which no register reflects. The boot CPU stores its registers before init_cpu_features() strips an unsafe override, so clamp against the hardware value here too. Fixes: f35abcbb8a084 ("KVM: arm64: Trap MTE access and discovery when MTE is disabled") Cc: stable@vger.kernel.org Signed-off-by: Fuad Tabba Reviewed-by: Catalin Marinas Signed-off-by: Will Deacon

arm64: errata: pass REVIDR when matching target implementation CPUs

2026-09-03T13:02:01+00:00

When target implementation CPUs are provided, is_affected_midr_range() accidentally passed the MIDR as both arguments to __is_affected_midr_range(), so the REVIDR mask check operated on the wrong register. Pass REVIDR as intended. Fixes: 86edf6bdcf05 ("smccc/kvm_guest: Enable errata based on implementation CPUs") Cc: stable@vger.kernel.org Signed-off-by: Khushit Shah Reviewed-by: Zenghui Yu (Huawei) Acked-by: Marc Zyngier Reviewed-by: Shameer Kolothum Signed-off-by: Will Deacon

arm64: trans_pgd: clone only the linear map that exists at runtime

2026-09-03T13:01:15+00:00

kexec_file_load() fails on arm64 if we have CONFIG_ARM64_VA_BITS_52 but it runs on a !FEAT_LPA2 host (such as my loving Grace machine). That is because trans_pgd_create_copy() uses the compile time PAGE_OFFSET (VA 52) instead of the actual VA size (48 -- due to the lack of LPA2). With the fifth level folded, pgd_none() is always false, so the walk cannot skip the 15 extra PGDIR_SIZE slots, and they all alias back to the same table: the whole kernel page table gets cloned 16 times, KASAN shadow included. Without KASAN it does not blow up, it just wastes ~RAM/32 in page tables. Fix it by copying the linear map that is the actual one, not the compiled one. Fixes: a6bbf5d4d9d1 ("arm64: mm: Add definitions to support 5 levels of paging") Signed-off-by: Breno Leitao Tested-by: Yury Smirnov Signed-off-by: Will Deacon

sched: Convert paravirt_steal to new static key APIs

2026-09-02T08:28:24+00:00

paravirt_steal_rq_enabled and paravirt_steal_enabled use raw static_key APIs which are now deprecated. Use the new API instead. No functional change. Signed-off-by: Hongyan Xia Signed-off-by: Peter Zijlstra (Intel) Acked-by: Juergen Gross Link: https://patch.msgid.link/20260819081207.12150-1-hongyan.xia@transsion.com

Merge patch series "kexec: fix probe error codes and error propagation"

2026-09-02T04:41:29+00:00

Mukesh Pilaniya says: kexec: fix probe error codes and error propagation While debugging a misleading error on s390x where kexec -s reported "syscall kexec_file_load not available" instead of the actual EINVAL from a kernel command line that exceeded the architecture limit, it was found that some kexec image probe functions return -EINVAL instead of -ENOEXEC for format mismatches, and kexec_image_probe_default() has a bug where it returns whatever the last loader returned rather than always returning -ENOEXEC when no loader matches. * Fix all probe functions to return -ENOEXEC when they do not recognize the image format. * Fix kexec_image_probe_default() to distinguish format mismatches (-ENOEXEC) from real errors (e.g. -ENOMEM), propagating real errors immediately and only continuing to the next loader on -ENOEXEC. kexec-tools patch: https://lore.kernel.org/all/20260814075329.30203-1-mpilaniy@redhat.com/ Link: https://patch.msgid.link/20260821-mpilaniy-v3-0-76b355399d2e@redhat.com Signed-off-by: Mike Rapoport (Microsoft)

kexec: return -ENOEXEC from image probe functions on mismatch

2026-09-02T04:41:28+00:00

Several kexec_file_load() image probe functions return -EINVAL when they do not recognize the image format. A probe function that rejects an image should return -ENOEXEC to indicate that the image is not a recognized executable format. -EINVAL implies a problem with the syscall parameters, not with image recognition. kexec_image_probe_default() iterates through registered loaders and returns the last probe's error code to the caller. That error propagates as the kexec_file_load() return value to userspace. Returning -EINVAL from a probe when no loader matches is semantically incorrect and misleads userspace about the nature of the failure. Return -ENOEXEC from all probe functions and their helpers when the image format is not recognized. Signed-off-by: Mukesh Pilaniya Reviewed-by: Philipp Rudo Reviewed-by: Pratyush Yadav Reviewed-by: Bradley Morgan Link: https://patch.msgid.link/20260821-mpilaniy-v3-1-76b355399d2e@redhat.com Signed-off-by: Mike Rapoport (Microsoft)

Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux

2026-08-28T16:02:04+00:00

Pull arm64 fixes from Will Deacon: "A mixture of ptdump, compat and MTE fixes that came in during the merge window: - Fix address handling of final memory region in ptdump - Fix emulation of decrementing load/store multiple from 32-bit task - Fix SCTLR context-switching for store-only MTE mode - Fix numerous issues in MTE selftests" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftests/arm64: Add MTE test config fragment selftests/arm64: Fix MTE prctl TAP plan selftests/arm64: Treat KSM merge_across_nodes as optional selftests/arm64: Print missing MTE TAP headers arm64: compat: Fix decrementing LDM/STM alignment emulation arm64: process: Fix context switching MTE store-only tag check KVM: arm64: ptdump: Flush the last region arm64: ptdump: Make note_page_flush() range aware

arm64: compat: Fix decrementing LDM/STM alignment emulation

2026-08-27T14:16:04+00:00

The compat alignment emulator inherited unsigned long data addresses from the 32-bit ARM implementation. In do_alignment_ldmstm(), nr_regs is an unsigned int holding the transfer size. The function uses the same address addition for both transfer directions, negating nr_regs first for a decrementing LDM or STM. The 32-bit negation wraps before the addition, so the handler adds nearly 4 GiB instead of subtracting the transfer size. The resulting address lies outside the compat task's address space, so decrementing LDM/STM emulation fails, while incrementing forms work. For example, a backwards-moving copy routine using decrementing LDM/STM can take an alignment fault when called with unaligned pointers. The compat handler should emulate the transfer, but this bug instead causes SIGBUS. The offset negated in do_alignment_finish_ldst() is offset_union.un, which is already unsigned long and does not have this width mismatch. Make nr_regs unsigned long so its negation and the address arithmetic use the same width. Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads") Cc: stable@vger.kernel.org Suggested-by: Arnd Bergmann Assisted-by: Codex:gpt-5.6-sol Signed-off-by: Karl Mehltretter Signed-off-by: Will Deacon