linux-next.git/arch/x86/kernel, branch master

Merge branch into tip/master: 'x86/sgx'

2026-09-03T19:00:02+00:00

# New commits in x86/sgx: 993b65a2fc6f ("x86/sgx: Report RCU-Tasks quiescent state in EPC sanitization loop") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'x86/kdump'

2026-09-03T19:00:01+00:00

# New commits in x86/kdump: d949fa7b1ec5 ("crash: Update stale NR_CPUS_DEFAULT references in elfcorehdr sizing docs") 6664ad1026b5 ("x86/crash: Reserve elfcorehdr for CONFIG_NR_CPUS, not CONFIG_NR_CPUS_DEFAULT") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'x86/cpu'

2026-09-03T19:00:00+00:00

# New commits in x86/cpu: f4cadf2d1ee3 ("x86/shstk: Shadow stack enabling write return code change") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'x86/bugs'

2026-09-03T18:59:59+00:00

# New commits in x86/bugs: ae1d2082d93b ("x86/bugs: Adapt SRSO mitigation to Zen6") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'sched/core'

2026-09-03T18:59:58+00:00

# New commits in sched/core: ef9293b3b797 ("sched: dynamic: Fix preemption model strings") 879eaa76e608 ("sched: Remove unneeded function type cast in do_balance_callbacks()") f549101187c8 ("sched/deadline: check start_dl_timer expiry with ktime_before()") 2a672daa4b27 ("sched/feat: Use the new static key API for sched_feat") a5576ebce920 ("sched: Convert paravirt_steal to new static key APIs") 9650ce11f2e3 ("sched: dynamic: Simplify preempt model accessors") 5b9a28eeed37 ("sched: dynamic: Remove HAVE_PREEMPT_DYNAMIC_{CALL,KEY}") aa4178f63847 ("sched: dynamic: Simplify irqentry_exit_cond_resched()") b9d267b9d632 ("sched: dynamic: Simplify preempt_schedule{,_notrace}()") 88e0b3bb9930 ("sched: dynamic: Simplify {cond,might}_resched()") d3d16750693b ("sched: dynamic: Make PREEMPT_DYNAMIC depend on ARCH_HAS_PREEMPT_LAZY") 772d9ffbfd26 ("sched: Migrate whole chain in proxy_migrate_task()") 6b73a09e943f ("sched: Break out core of attach_tasks() helper into sched.h") 1f8805138593 ("sched: Switch rq->next_class in proxy_reset_donor()") 09351db90a28 ("sched/core: Don't proxy-exec unmatched cookie lock owners") 9be817f991e2 ("sched/core: Avoid migrating blocked_on tasks") 3dd95f077371 ("sched/core: Don't steal a proxy-exec donor") Signed-off-by: Ingo Molnar

Merge branch into tip/master: 'x86/urgent'

2026-09-03T18:59:58+00:00

# New commits in x86/urgent: 7755fae2ea37 ("x86/MCE/AMD: Fix inverted interrupt enablement during storm handling") 60714fb1d494 ("x86/amd_node: Prevent potential NULL pointer dereference") 453e78594434 ("x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()") 0e33126d5def ("x86/mm/pat: Allocate split page tables as kernel page tables") e679ba098375 ("x86/alternative: Exclude text poking against change_page_attr()") 884801a901bd ("x86/mm/pat: Acquire init_mm read lock on attribute change to avoid UAF") 4cfad2657c7c ("x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF") 72bd92bd8190 ("x86/amd_node: Avoid divide by zero on virtualized systems") Signed-off-by: Ingo Molnar

x86/crash: Reserve elfcorehdr for CONFIG_NR_CPUS, not CONFIG_NR_CPUS_DEFAULT

2026-09-02T21:25:06+00:00

NR_CPUS_DEFAULT is purely a Kconfig thing. Its entire purpose in life is to start NR_CPUS at a sane value. There is precisely one (buggy) reference to it outside of Kconfig in the whole kernel: the x86 crash code. That code undersizes the elfcorehdr reservation whenever NR_CPUS exceeds NR_CPUS_DEFAULT, because the header carries one phdr per possible CPU and num_possible_cpus() is bounded by NR_CPUS. kexec_file_load(2) then fails with -EINVAL from sanity_check_segment_list(), and kexec_load(2) silently truncates the elfcorehdr, which surfaces later as a bad or unusable dump. Size the elfcorehdr reservation with NR_CPUS instead. Fixes: ea53ad9cf73b ("x86/crash: add x86 crash hotplug support") Signed-off-by: Ionut Nechita Signed-off-by: Dave Hansen Reviewed-by: Jinjie Ruan Reviewed-by: Bradley Morgan Reviewed-by: Sourabh Jain Acked-by: Baoquan He Link: https://patch.msgid.link/20260901071041.16311-2-ionut.nechita@windriver.com

x86/MCE/AMD: Fix inverted interrupt enablement during storm handling

2026-09-02T21:20:59+00:00

mce_amd_handle_storm() currently does the opposite of what storm handling needs: it enables thresholding interrupts when a storm is detected and disables them when the storm subsides. Flip the "on" function argument before passing it to threshold_restart_bank() as it should have been done. To clarify: "on" to mce_handle_storm() means, the storm is on now when "on" is true, and off when "on" is false. [ bp: Simplify. ] Fixes: 5c4663ed1eac ("x86/mce: Handle AMD threshold interrupt storms") Signed-off-by: Jasjeet Rangi Signed-off-by: Borislav Petkov (AMD) Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260812221514.598842-2-jrangi@purestorage.com

x86/shstk: Shadow stack enabling write return code change

2026-09-02T21:06:27+00:00

The WRSS instruction (the special instruction that writes to shadow stacks) cannot be used in userspace unless IA32_U_CET.SH_STK_EN=1 (user shadow stack is enabled). So the kernel *should* return -EINVAL to userspace if it tries to enable it when shadow stack is disabled. However, currently, it will return -EPERM. But, that error code doesn't fit the condition as the failure is due to an invalid state change request not a permission issue. Investigating userspace call sites, like glibc and criu (checkpoint code), they do not rely on this specific error message, nor could a userspace effectively utilize this specific return error code to indicate a difference in "I cannot enable write because of invalid permissions" versus "I cannot enable write because the shadow stack is disabled". Signed-off-by: Bill Roberts Signed-off-by: Dave Hansen Reviewed-by: Rick Edgecombe Link: https://patch.msgid.link/20260707184542.1721085-1-bill.roberts@arm.com

x86/sgx: Report RCU-Tasks quiescent state in EPC sanitization loop

2026-09-02T20:52:59+00:00

When the kernel boots from kexec, the EPC pages may have a stale state. The kernel sanitizes all EPC pages to reset them to a clean state before their first use in any enclave. The EPC size could be several GBs and resetting them could take a significant amount of time. Because of that, the kernel performs the reset in a loop through a kernel thread ksgxd() at early boot, and there's a cond_resched() after resetting each EPC page. This is fine in most cases, but becomes a problem when there's other kernel code waiting for an RCU-Tasks grace period but the cond_resched() in ksgxd() never triggers rescheduling. Because cond_resched() doesn't report a quiescent state when it doesn't trigger rescheduling, the thread that is waiting for an RCU-Tasks grace period will wait until all EPC pages are reset. For instance, BPF LSM subsystem can invoke synchronize_rcu_tasks() at kernel boot time. A VM with a large EPC assigned and BPF LSM enabled can take a long time to boot, with a call trace triggered: rcu_tasks_wait_gp: rcu_tasks grace period number 1 (since boot) is 130631 jiffies old. INFO: task systemd:1 blocked for more than 122 seconds. ... task:systemd state:D stack:0 pid:1 tpid:1 ppid:0 flags:0x00000002 Call Trace: ... schedule_timeout+0x157/0x170 wait_for_completion+0x88/0x150 __wait_rcu_gp+0x17e/0x190 synchronize_rcu_tasks_generic+0x64/0x60 ... synchronize_rcu_tasks+0x15/0x20 register_ftrace_direct+0x31f/0x350 ... bpf_trampoline_link_prog+0x33/0x60 bpf_tracing_prog_attach+0x3c5/0x5f0 Replace cond_resched() with cond_resched_tasks_rcu_qs() which explicitly reports quiescent state regardless of whether actual rescheduling is triggered. Resetting all EPC pages in ksgxd() isn't performance critical so the extra cost of cond_resched_tasks_rcu_qs() isn't a problem. Tests showed this reduced the VM kernel boot time from ~50s to ~700ms. Co-developed-by: Fan Du Fixes: e7e0545299d8 ("x86/sgx: Initialize metadata for Enclave Page Cache (EPC) sections") Suggested-by: Kai Huang Signed-off-by: Fan Du Signed-off-by: Jun Miao Signed-off-by: Dave Hansen Reviewed-by: Kai Huang Reviewed-by: Jarkko Sakkinen Tested-by: Challvy Tee Link: https://github.com/systemd/systemd/issues/40423 Link: https://patch.msgid.link/20260902013653.690506-1-jun.miao@intel.com