| Age | Commit message (Collapse) | Author |
|---|
|
The Quote buffer size is a constant sprinkled across several places.
Read it from a helper instead. And rename the constant to avoid using a
verb.
This sets up the plumbing for a later change that makes the size
dynamic.
There are several "sizes" at play here: the raw Quote data, the Quote
buffer (the header metadata plus the raw data), and the allocation (the
page-padded Quote buffer). The helper returns the Quote buffer size and
leaves page alignment to callers that need it.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Signed-off-by: Peter Fang <peter.fang@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://patch.msgid.link/20260930103739.2851980-5-peter.fang@intel.com
|
|
struct tdx_quote_buf has a trailing flexible array member.
struct_size() calculates the size of this kind of struct safely. It
handles overflow, which helps since the Quote size comes from the host.
Use it to rewrite the bounds check logic, since
"header_size + data_size > buf_size"
... is more readable than "data_size > buf_size - header_size".
This also prepares for a later change that needs the same
"header_size + data_size" calculation for the Quote buffer size.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Signed-off-by: Peter Fang <peter.fang@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Link: https://patch.msgid.link/20260930103739.2851980-4-peter.fang@intel.com
|
|
The Quote buffer is always a "struct tdx_quote_buf", but its global
pointer is a "void *". A function would have to convert it back to make
sense of it.
Declare the global with its actual type, and give it a better name.
This creates variable shadowing in wait_for_quote_completion(), so
rename its parameter for clarity.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Signed-off-by: Peter Fang <peter.fang@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Link: https://patch.msgid.link/20260930103739.2851980-3-peter.fang@intel.com
|
|
tdx_hcall_get_quote() takes a "u8 *" buffer unnecessarily. It is never
used as such, since only the buffer's memory address matters.
Accept a "void *" buffer instead. This avoids a cast to "u8 *" when a
later change gives the guest driver's Quote buffer an explicit type.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Signed-off-by: Peter Fang <peter.fang@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Link: https://patch.msgid.link/20260930103739.2851980-2-peter.fang@intel.com
|
|
There are few remaining attestation related functions which are exported
via EXPORT_SYMBOL_GPL, yet they are solely used by the 'tdx-guest'
driver. Let's just limit their visibility by using the namespaced
EXPORT_SYMBOL_FOR_MODULES.
Suggested-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Nikolay Borisov <nik.borisov@suse.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://patch.msgid.link/20260925131808.2415177-1-nik.borisov@suse.com
|
|
The tsm_report_ops->report_new() function takes a void* argument for
implementations to use. But, TDX does not use the argument. It
relies entirely on the 'struct tsm_report'.
Despite that, the TDX code passes 'data' around needlessly from
tdx_report_new()=>tdx_report_new_locked() where it is completely
unused and ignored.
This is not just a cleanup or bike-shedding rename. The variable is a
real liability because there are 'quote_data' variables and even a
tdx_quote_buf->data[] that can get literally referred to as "data".
Remove the unused argument.
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
|
|
The TDX architecture includes a syscall-like ABI for OSes to communicate
with SEAM mode software. This ABI has the concept of a "leaf". Each leaf
is roughly analogous to a Linux syscall: it has a set of register
arguments and does one logical thing like adding a page of memory to a
VM or running a VM. The TDX architecture refers to this interface
function as a "SEAMCALL leaf".
Just like syscalls, the TDX architecture wants to evolve the ABI to
extend functionality while keeping compatibility. But unlike syscalls,
which do this by picking a totally new syscall number, the ABI encodes
the "version" number directly into the bits of a register argument. So
instead of openatN being whatever the next free number is, the SEAMCALL
leaf number and version number are encoded into certain bits in how the
RAX register is defined in the ABI.
In Linux, several seamcall*() wrappers have been introduced to invoke
SEAMCALL leafs. They all take a u64 "fn" argument for the leaf number
which eventually gets set in the register. As above, the version number
lives in the same register as the leaf number. So callers that want to
select a specific version of the leaf, can jam it in the right place in
the register by passing it in the "fn" argument. Today only the caller
of TDH.VP.INIT does this hack, but future kernel changes will need to
select versions for more SEAMCALL leafs. So a less hacky solution is
needed.
Explicitly define the arguments for seamcall*() wrappers:
- Add a build-time assertion to ensure "fn" only contains valid
SEAMCALL leaf number bits. Note the P-SEAMLDR selector bit (bit 63)
is part of the leaf number for SEAM loader calls, so it is allowed.
This also means the "fn" can't be a narrower type, such as u16, to
exclude unrelated bits.
- Add a "version" field in struct tdx_module_args [1], so most
existing callers get a default "version == 0" behavior without code
churn. Update the TDH.VP.INIT caller to specify the version
descriptively.
Encode the leaf number and tdx_module_args.version into RAX in assembly,
because this is the place where the "fn" and struct tdx_module_args
fields are marshaled into registers.
AI was used under supervision to review code and workshop logs. In
particular, it helped evaluate the assembly changes.
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Reviewed-by: Kishen Maloor <kishen.maloor@intel.com>
Link: https://lore.kernel.org/kvm/4f4b0f29-424b-45ed-8cfd-c77da2ea390f@intel.com/ # [1]
Link: https://patch.msgid.link/20260921-seamcall-version-v7-1-cf05fe76b467@linux.intel.com
|
|
Expand TDX documentation to include information on the Dynamic PAMT
feature.
The new section explains PAMT support in the TDX module and how Dynamic
PAMT affects the kernel memory use.
Some of the docs verbiage was provided by Dave Hansen (see link). AI was
used under supervision to review the docs.
Based on a patch originally by Kiryl Shutsemau.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://lore.kernel.org/all/8e40862e-891a-4cad-8bb8-06ad25ad6061@intel.com/
Link: https://patch.msgid.link/20260904215841.303070-11-rick.p.edgecombe@intel.com
|
|
The Physical Address Metadata Table (PAMT) holds TDX metadata for
physical memory and must be allocated by the kernel during TDX module
initialization. Dynamic PAMT (DPAMT) is a TDX module feature that can
reduce this memory use by allocating part of the PAMT dynamically.
DPAMT's memory savings are significant enough to make it a good default
configuration. So turn it on whenever the TDX module reports support.
There is a TDX module bug where on unusual BIOS keyid configurations, the
TDX module reports DPAMT as supported even when it can't handle it. Expect
this not to be an issue in practice and don't attempt to work around it on
the kernel side.
The feature increases the kernel size by 2KB (when TDX is configured in the
build).
Based on a patch originally by Kiryl Shutsemau.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-10-rick.p.edgecombe@intel.com
|
|
Add Dynamic PAMT support to KVM's S-EPT MMU by "getting" a PAMT page when
adding guest memory (PAGE.ADD or PAGE.AUG), and "putting" the page when
removing guest memory (PAGE.REMOVE).
To access the per-vCPU PAMT caches without plumbing @vcpu throughout the
TDP MMU, begrudgingly use kvm_get_running_vcpu() to get the vCPU, and bug
the VM if KVM attempts to set an S-EPT leaf without an active vCPU. KVM
only supports creating _new_ mappings in page (pre)fault paths, all of
which require an active vCPU.
The PAMT memory holds metadata for TDX protected memory. With Dynamic
PAMT, PAMT_4K is allocated on demand. The kernel supplies the TDX module
with a few pages that cover 2MB of host physical memory.
Releases are balanced via tdx_pamt_put(): every control-page free goes
through tdx_free_control_page(), and guest data pages are put directly on
the successful tdh_mem_page_remove() path and in the
tdx_mem_page_add/aug() error path.
Co-developed-by: Sean Christopherson <seanjc@google.com>
[rick: enhance log, reviewing, rebase, with help from AI tooling]
Co-developed-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-9-rick.p.edgecombe@intel.com
|
|
When handling an EPT violation, KVM holds a spinlock while manipulating
the EPT. Before entering the spinlock it doesn't know how many EPT page
tables will need to be installed or whether a huge page will be used. For
this reason it allocates a worst case number of page tables that it might
need as part of servicing the EPT violation.
Under Dynamic PAMT (DPAMT) these pre-allocated pages will potentially need
to have DPAMT backing pages installed for them. KVM already has helpers to
manage topping up page caches before taking the MMU lock, but they cannot
be passed from KVM to arch/x86 code.
The problem of how and when to install the DPAMT backing pages for the
pages given to the TDX module during the fault path has had a lot of
design attempts.
- Extracting KVM's MMU caches requires too much inlined code added to
headers.
- A few varieties of installing DPAMT backing when allocating the
S-EPT page tables. (see links)
- Using mempool_t to transfer the pages between KVM and arch/x86 doesn't
work because the component is designed more around maintaining a pool
of pages, rather than topping up a continually drained cache.
So don't do these as they all had various problems. Instead just create a
small simple data structure to use for handing a pre-allocated list of
pages between KVM and arch/x86 code. Model this on KVM's existing MMU
memory caches.
Add a tdx_pamt_cache arg to tdx_pamt_get() so it can draw pages from a
cache when needed. Not all DPAMT page installations will happen under
spinlock, for example TD and vCPU scoped control pages. So have
tdx_pamt_get() maintain the existing behavior of allocating from the page
allocator when NULL is passed for the struct tdx_pamt_cache arg. This
prevents excess allocations for cases where it can be avoided.
Export the new helpers for KVM.
AI was used under supervision to review code and workshop logs.
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://lore.kernel.org/kvm/aXENNKjAKTM9UJNH@google.com/
Link: https://lore.kernel.org/kvm/20260129011517.3545883-20-seanjc@google.com/
Link: https://lore.kernel.org/kvm/aYW5CbUvZrLogsWF@yzhao56-desk.sh.intel.com/
Link: https://patch.msgid.link/20260904215841.303070-8-rick.p.edgecombe@intel.com
|
|
Use control page helpers for allocating and freeing TD control structures,
such that these operations can work for Dynamic PAMT.
The TDX module tracks some state for each page of physical memory that it
might use. It calls this state the PAMT. It includes separate state for
each page size a physical page could be utilized at within the TDX module
(1GB, 2MB, 4KB). In Dynamic PAMT, only the 4KB page size state is
allocated dynamically. So the kernel must ensure PAMT backing is installed
for any 4KB page being gifted to the TDX module, and must tear down the
backing when all associated gifted pages are reclaimed.
TD scoped control pages (TDR, TDCS) and vCPU scoped control pages (TDVPR,
TDCX) are all handed to the TDX module at 4KB page size and are therefore
subject to this requirement. Replace the raw alloc_page()/__free_page()
calls for these pages with tdx_alloc/free_control_page().
Switching between special Dynamic PAMT operations or normal page
alloc/free operations is handled internally in
tdx_alloc/free_control_page(). So don't check for Dynamic PAMT around these
calls. Just call them unconditionally. Similarly, drop the NULL checks
before freeing, as tdx_free_control_page() handles NULL internally.
No functional change intended when DPAMT is not in use.
[sean: handle alloc+free+reclaim in one patch]
[rick: enhance log, reviewing, rebase, with help from AI tooling]
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Acked-by: Sean Christopherson <seanjc@google.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-7-rick.p.edgecombe@intel.com
|
|
__tdx_pamt_get()/__tdx_pamt_put() unconditionally add or remove Dynamic
PAMT (DPAMT) backing for the 2MB region covering the passed page. However,
multiple callers can add or remove 4KB pages that fall within the same 2MB
region and in that scenario only a single PAMT entry is required.
Make the helpers handle only adding/removing DPAMT backing when required,
by refcounting each 2MB range. Gate the actual DPAMT add and remove on
refcount transitions (0->1 and 1->0). Serialize the refcount check and
SEAMCALL with a global spinlock so the read-decide-act sequence is atomic.
This also avoids TDX module BUSY errors, as the DPAMT add and remove
SEAMCALLs take internal TDX module locks for the 2MB ranges of the
specified PFN and the PAMT page pair PFNs. So simultaneous attempts on
the same 2MB ranges of the PFNs would otherwise encounter an error, which
would not be handleable in the put case.
The lock is global and heavyweight. Use simple conditional logic to keep
correctness obvious. This will be optimized in a later change.
The dpamt_refcounts[] are atomic_t's. They do not strictly need to be
because all access is protected by pamt_lock. The overhead of an atomic_t
in this situation is minuscule compared to the global lock. Leave the
atomic_t in place to enable future optimization with minimal churn.
Since the DPAMT helpers are broadly functional now, drop the "__"
to rename them tdx_pamt_get/put() and tdx_alloc/free_control_page().
Export them for use in KVM in subsequent changes.
AI was used under supervision to collect/apply feedback, split patches,
review code and workshop logs.
Based on a patch originally by Kiryl Shutsemau.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Nikolay Borisov <nik.borisov@suse.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-6-rick.p.edgecombe@intel.com
|
|
The PAMT memory holds metadata for all possible TDX protected memory. Each
physical address range is covered by PAMT entries at three levels (1GB,
2MB, 4KB). With Dynamic PAMT (DPAMT), the 4KB level of PAMT is allocated
on demand. The kernel supplies the TDX module with page pairs to store the
4KB level entries, which cover 2MB of host physical memory. The kernel must
provide this page pair before using pages from the range for TDX. If this
is not done, SEAMCALLs that give the pages to be protected by the TDX
module will fail.
Allocate reference counters for every 2MB range to track TDX memory usage.
This can be used to handle concurrent get/put callers, in order to
accurately determine when the dynamic 4KB level of DPAMT needs to be
allocated and when it can be freed.
This allocation will currently consume 2MB for every 1TB of address
space from 0 to max_pfn. The allocation size will depend on how the RAM is
physically laid out. In a worst case scenario where the entire 52 bit
address space is covered this would be 8GB. Then the DPAMT refcount
allocations could hypothetically cause the savings from DPAMT to go
negative on exotic platforms with sparse, small amounts of memory.
Future changes could reduce this refcount overhead to be only allocating
refcounts for physical ranges that contain memory that TDX can use.
However, this is left for future work.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Based on a patch originally by Kiryl Shutsemau.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-5-rick.p.edgecombe@intel.com
|
|
Add helpers to use when allocating or preparing pages that are handed to
the TDX module for use as control/S-EPT pages, and thus need Dynamic PAMT
(DPAMT) adjustments.
The TDX module tracks some state for each page of physical memory that it
might use. It calls this state the PAMT. It includes separate state for
each page size a physical page could be utilized at within the TDX module
(1GB, 2MB, 4KB). In DPAMT, only the 4KB page size state is
allocated dynamically.
KVM will need to hand pages to the TDX module that it will use at 4KB
granularity. So these pages will need DPAMT backing added before they are
used by the TDX module, and removed afterwards.
Create __tdx_pamt_get/put() to handle installing DPAMT 4KB backing for
pages that are already allocated (such as KVM's use of S-EPT page tables
or guest private memory). Have them take a pfn instead of a struct page,
as future changes will want to use these helpers for guest pages which are
tracked by PFN.
Also add __tdx_alloc_control_page() and __tdx_free_control_page() to handle
both page allocation and DPAMT installation. Make them behave like
normal alloc/free functions where allocation can fail in the case of no
memory, but free (with any necessary DPAMT release) always
succeeds. Do this so they can eventually support the existing TDX flows
that require teardowns to succeed.
Don't CLFLUSH the DPAMT pages handed to the TDX module, as is done
for some other SEAMCALLs, as the TDX docs specify that this is only
needed on "TD private memory or TD control structure page".
Since these allocations will be easily user triggerable, account the
memory.
Only one pair of DPAMT pages is required for each 2MB-aligned physical
region, so multiple callers could trip over each other if they try to
manage the shared backing for two separate 4KB pages contained in one.
To build the logic up iteratively, don't do anything to handle pages
from the same 2MB region yet. Functionality to handle this will be added
before DPAMT can be enabled.
AI was used under supervision to collect/apply feedback, split patches,
review code and workshop logs.
Based on a patch originally by Kiryl Shutsemau.
Co-developed-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-4-rick.p.edgecombe@intel.com
|
|
The TDX Physical Address Metadata Table (PAMT) holds data about the
physical memory used by TDX, and must be allocated by the kernel during
TDX module initialization.
The exact size of the required PAMT memory is determined by the TDX module
and may vary between TDX module versions. Currently it is approximately
0.4% of the system memory. This is a significant commitment, especially if
it is not known upfront whether the machine will run any TDX guests.
Each memory region that the TDX module might use needs three separate PAMT
allocations. One for each supported page size (1GB, 2MB, 4KB). The
TDX module supports a new feature designed to reduce PAMT overhead called
Dynamic PAMT (DPAMT). Under DPAMT the 4KB level is allocated dynamically
during runtime, while the 1GB and 2MB levels remain allocated on TDX
module initialization.
However, in the details, DPAMT still needs some smaller per 4KB page
scoped data (currently it is 1 bit per page). The TDX module exposes the
number of bits as a separate piece of metadata than the 4KB static
allocation for normal PAMT. Although the size is enumerated differently,
it is handed to the TDX module in the same way the 4KB page size PAMT
allocation is for normal PAMT.
Begin to implement DPAMT in the kernel by reading the bits-per-page needed
for DPAMT. Calculate the size needed for the bitmap, and use it instead of
the 4KB size determined for normal PAMT, in the case of DPAMT.
The existing metadata reading code was generated by a script, but the
current plan is to stop generating this code, as the script has continued
to need adjustments. So add manually written code and adjust the comment
about it being autogenerated to be more generic. Start to adopt a more
normal kernel code style without the ternary statements and if
conditionals assignments that the auto generated code has.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Based on a patch originally by Kiryl Shutsemau.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-3-rick.p.edgecombe@intel.com
|
|
For each memory region that the TDX module might use (called TDMR), three
separate traditional PAMT allocations are needed. There is one for each
supported page size (1GB, 2MB, 4KB). These store information on each page
in the TDMR. In Linux, they are allocated out of one physically contiguous
block, in order to more efficiently use some internal TDX module
bookkeeping resources. So some simple math is needed to break the single
large allocation into three smaller allocations for each page size.
There are some commonalities in the math needed to calculate the base and
size for each smaller allocation, and so an effort was made to share logic
across the three. Unfortunately doing this turned out unnaturally tortured,
with a loop iterating over the three page sizes, only to call into a
function with case statements for each page size. In the future Dynamic
PAMT will add more logic that is special to the 4KB page size, making the
benefit of the math sharing even more questionable.
Three is not a very high number, so get rid of the loop and just duplicate
the small calculation three times. In doing so, setup for future Dynamic
PAMT changes.
Since the loop that iterates over it is gone, further simplify the code by
dropping the array of intermediate size and base storage. Just store the
values to their final locations.
AI was used under supervision to collect/apply feedback, review code and
workshop logs.
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Binbin Wu <binbin.wu@linux.intel.com>
Reviewed-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Reviewed-by: Chao Gao <chao.gao@intel.com>
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Reviewed-by: Tony Lindgren <tony.lindgren@linux.intel.com>
Reviewed-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Vishal Annapurve <vannapurve@google.com>
Acked-by: Sohil Mehta <sohil.mehta@intel.com>
Tested-by: Hongyu Ning <hongyu.ning@linux.intel.com>
Link: https://patch.msgid.link/20260904215841.303070-2-rick.p.edgecombe@intel.com
|
|
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux
Pull i2c fixes from Andi Shyti:
"Fixes mainly for teardown and resource handling, runtime PM and
hardware-specific controller issues:
- fix debugfs use-after-free when removing the adapter
- designware: apply interrupt mask quirk for HJMC3001
- imx-lpi2c: avoid target accesses on master-only controllers
- mux: release channel node when adapter registration fails
- qcom-cci: fix autosuspend and runtime PM cleanup on removal
- qcom-geni: fix timing parameters for 32 MHz clock"
* tag 'i2c-fixes-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux:
i2c: core: fix debugfs UAF on adapter removal
i2c: imx-lpi2c: avoid accessing target registers on master-only controllers
i2c: qcom-cci: fix autosuspend cleanup
i2c: designware: Enable interrupt mask workaround for HJMC3001
i2c: qcom-geni: update frequency table to fix timing parameters
i2c: mux: Fix channel node leak on adapter add failure
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux
Pull Coccinelle updates from Julia Lawall:
- Clean up a number of the semantic patches in the scripts/coccinelle
directory, particularly with respect to functions that no longer
exist in the kernel (Sang-Heon Jeon)
He and I have also done some reorganizations that improve
performance.
- Eliminate some false positives (me)
- Fix an out of date URL (相浦彰)
* tag 'cocci-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jlawall/linux:
coccinelle: ifnulldev_put: update error message
coccinelle: ifnulldev_put: update outdated helper names
coccinelle: atomic_as_refcounter: drop atomic_long_dec_and_lock
coccinelle: kfree_mismatch: drop vmalloc_exec
coccinelle: pool_zalloc-simple: drop the pci_pool_alloc rules
coccinelle: zalloc-simple: drop the kmem_alloc rules
coccinelle: alloc_cast: drop removed allocators
coccinelle: remove obsolete pci_free_consistent.cocci
scripts: coccinelle: devm_free: reduce false positives
coccinelle: misc: struct_size: drop unneeded parentheses
coccinelle: mini_lock: improve performance when searching loops
coccinelle: api: check for macro context
coccinelle: update Coccinelle website URL
coccinelle: misc: minmax: avoid unhelpful isomorphisms
coccinelle: misc: minmax: check for the presence of if cases
coccinelle: misc: minmax: drop unneeded parentheses
coccinelle: misc: minmax: improve performance when no candidate exists
coccinelle: double_lock: improve performance when no double lock exists
|
|
Add myself to CREDITS because apparently I've never done that; and
update mailmap so that all my old email addresses get remapped to the
kernel.org redirector.
Signed-off-by: "Darrick J. Wong" <djwong@kernel.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull timer fix from Ingo Molnar:
- Fix UM build regression caused by the removal of the UM
specific timex.h header (Thomas Weißschuh)
* tag 'timers-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
um: Use asm-generic/timex.h over the host architecture one
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull locking fix from Ingo Molnar:
- Revert a commit to spinlock cleanup guards that got caught up
in the subtle limitations & fragility of guards (again...) and
caused a regression (Peter Zijlstra)
* tag 'locking-urgent-2026-08-30' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
locking: Revert switching guards to _irq_{disable,enable}()
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux
Pull Rust fixes from Miguel Ojeda:
"Toolchain and infrastructure:
- Fix KCFI failures, such as in Rust doctests, by disabling function
merging when CFI is enabled. Gary reported the LLVM bug to upstream
and it is now fixed in their mainline.
- Fix 'objtool' fallthrough warnings under the experimental
'CONFIG_RUST_INLINE_HELPERS' by passing (for the combined Rust and
helpers code) the LLVM options needed to preserve the unreachable
traps that 'rustc' normally emits.
In addition, fix 'objtool' errors when LTO is enabled on top, by
also filtering out the LTO flags (for the combined Rust and helpers
code) so that the traps are kept in place.
- Fix 'objtool' warnings by adding one more 'noreturn' function.
- Fix 'make rusttest' target when the 'rustc-dev' component is
installed and Rust >= 1.82.0, <= 1.87.0 is used.
'kernel' crate:
- 'num' module: fix soundness issue in the 'Bounded' conversion from
'bool' by restricting the conversions to unsigned 'Bounded'.
- 'jump_label' module: fix future 'make rusttest' target failures
when 'ARCH=' is set to an arch different than the host's.
- 'list' module: fix incorrect 'pop_back()' comment"
* tag 'rust-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/ojeda/linux:
rust: kbuild: disambiguate `zerocopy_derive` for `rusttest`
rust: num: restrict bool conversion to unsigned Bounded
kbuild: rust: keep Rust objects out of Clang LTO with inline helpers
kbuild: rust: preserve unreachable traps with inline helpers
rust: cfi: disable function merging if CFI is enabled
rust: jump_label: skip arch-specific asm in `testlib` builds
objtool/rust: add one more `noreturn` Rust function
rust: kernel: list: fix incorrect pop_back example comment
|
|
Pull arm updates from Russell King:
"Updates for 7.3:
- add module description for kprobes testing module
- remove references to CONFIG_CPU_ARM92x_CPU_IDLE options
- expand comment in ARM's __switch_to()
Also a number of fixes that missed 7.2:
- disable broken eBPF on RiscPC
- more BKPT fixes (guys, it's a *very* bad idea when everyone uses
the BKPT instruction for their own differing purposes)
- another preempt-rt fix, this time for siglock / CPU timers
- fix another path where we try to send signals to processes with
interrupts disabled
- acquire mmap write lock for show_pte() with user faults"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rmk/linux:
ARM: 9480/1: entry: expand comment in __switch_to
ARM: 9478/1: Remove references to removed CONFIG_CPU_ARM92x_CPU_IDLE options
ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults
ARM: 9484/1: enable interrupts when unhandled user faults are triggered
ARM: 9483/1: select HAVE_POSIX_CPU_TIMERS_TASK_WORK
ARM: 9481/2: breakpoint: CFI breakpoints only on demand
ARM: 9477/1: Disable broken eBPF JIT on the Risc PC
ARM: 9473/1: kprobes: test: add MODULE_DESCRIPTION
|
|
Pull OpenRISC updates from Stafford Horne:
"One small trivial macro cleanup and one bug fix.
The bug fix is to fix an unchecked access in our or1k_atomic syscall,
I am debating if we should just deprecate this as there is minimal
need for it"
* tag 'for-linus' of https://github.com/openrisc/linux:
openrisc: fix arbitrary kernel memory access via or1k_atomic syscall
openrisc: drop unneeded semicolon
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull tracing fixes from Steven Rostedt:
- Fix error output of boot instance creation failure
Currently if a boot instance creation fails, instead of printing out
the name of the instance that failed, it prints "(null)". That is
because it prints "cur_str" that had already been processed by
strsep(). Print the saved name instead.
While at it, print the error code of the failure.
- Fix use-after-free for same named historgrams
Histograms can be named so that they can be used in multiple events.
But if the named histogram has a variable attached, the second event
that uses the named histogram which duplicates it and needs to free
the original after duplication leaves the old variable in place and
still visible. If another histogram uses than variable, it will use
the stale one which will try to reference the freed duplicate
histogram and crash the kernel.
Free the duplicate variables along with the duplicated histogram
data.
- Check return value of kthread_run() in event self test
The events self tests uses a kthread for testing but does not check
if it succeeded in creating a kthread. If the kthread creation were
to fail, the code will still try to call kthread_stop() on the error
returned.
- Fix race between reading trace_pipe and updating subbuffer size
If a user is reading the trace_pipe file at the same time they update
the ring buffer sub-buffer size, can cause the trace_pipe read to
read stale data. Add trace_access_lock() around updating the ring
buffer sub-buffer size.
- Fix eventfs_inode on failure path in creation of the events directory
In the creation of the "events" directory, if after allocating the
eventfs_inode a failure is detected, it calls cleanup_ei() which
calls free_ei(). The free_ei() will test if eventfs_inode being freed
has no children. It is a bug if it does. But on the failure case of
the creation of the "events" directory, the children lists have not
yet been initialized and the free will trigger a warning because
list_empty() on an uninitialized list returns false.
Move the initialization into init_ei() where it makes more sense and
makes sure that a created eventfs_inode has its lists initialized
upon creation.
- Check return value of kthread_run() in ftrace direct sample code
The sample code that shows how to use the ftrace direct calls does
not test the return of kthread_run() to see if it succeeds. Return a
failure if the kthread_run() doesn't succeed.
- Clear user events state on fork in case of alloc failure
On fork, the child gets a pointer to the parent's user events state.
It makes a copy of it then updates the child's pointer to it. But if
the allocation fails, the duplication function leaves the child with
a pointer to its parent's descriptor. When the child cleans up its
data, it will free the parent's descriptor while the parent is still
using it.
In the duplication function, set the child's user_event_mm to NULL
before testing if the allocation succeeded, and when it exits it will
not free the parent's descriptor.
- Fix retry exhaustion in simple ring buffer reader swap
simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a
failed replacement leaves it at -1.
But the check for success expects the retry value to be non-zero and
exits with an error on zero. This is the opposite result. Fix it.
- Fail nicely when the remote swap_reader_page() returns an error
Currently, if the swap_reader_page() of a remote buffer fails, it
triggers a WARN_ON_ONCE() and continues normally. Instead, have it
exit with an error and a pr_warn() print instead of a full WARNING.
* tag 'trace-v7.3-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
ring-buffer: Stop remote reader update when page swap fails
tracing: Fix retry exhaustion in simple ring buffer reader swap
tracing/user_events: Clear copied tracing state before fork duplication
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify
samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify
eventfs: Initialize ei->children and ei->list in init_ei()
tracing: Fix use-after-free in trace_pipe read on sub-buffer order change
tracing: Fix crash passing ERR_PTR to kthread_stop()
tracing: Fix use-after-free with same-name named triggers
tracing: Fix logged instance name on creation failure
|
|
|
|
Update the report and org mode messages to reflect the new
function names.
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
dev_put_track() and dev_hold_track() were renamed to netdev_put() and
netdev_hold() by commit d62607c3fe45 ("net: rename reference+tracking
helpers").
So update the names.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
atomic_long_dec_and_lock() has never existed. So drop it from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
vmalloc_exec() was removed by commit 7a0e27b2a0ce ("mm: remove
vmalloc_exec").
So drop it from the rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
pci_pool_alloc() and pci_pool_zalloc() were removed by commit
88dee3b0efe4 ("PCI: Remove unused pci_pool wrappers").
So drop the pci_pool_alloc rules.
No functional change.
Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com>
Signed-off-by: Julia Lawall <Julia.Lawall@inria.fr>
|
|
Pull more SCSI updates from Martin Petersen:
"Remaining updates for the 7.3 merge window. The only core change is
enabling context analysis for the SCSI layer and UFS.
The remaining changes are either bug fixes or hardening"
* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mkp/scsi: (26 commits)
scsi: snic: Fix SCSI host leak on workqueue allocation failure
scsi: MAINTAINERS: Update my email address
scsi: MAINTAINERS: Leave the cumana_1 and oak drivers to the RISCPC maintainers
scsi: leapraid: Standardize NCQ priority sysfs attributes
scsi: leapraid: Serialize firmware log mmap with teardown
scsi: leapraid: Balance host references for firmware log VMAs
scsi: lpfc: Remove unnnecessary NULL check
scsi: qla2xxx: Fix an loop timeout test
scsi: qla2xxx: Fix an error code in qla_get_tmf()
scsi: ibmvfc: Fix use of uninitialized rport in ibmvfc_do_work()
scsi: core: Enable context analysis for hosts.o
scsi: lpfc: Replace strlcat() with sysfs_emit_at() in the sysfs show functions
scsi: lpfc: Replace strlcat() with seq_buf in the debugfs dump helpers
scsi: lpfc: Replace strlcat() with seq_buf in lpfc_rx_monitor_report()
scsi: lpfc: Replace strlcat() with scnprintf() in lpfc_vport_symbolic_node_name()
scsi: lpfc: Replace strlcat() with seq_buf in lpfc_info()
scsi: core: Enable context analysis
scsi: core: Protect host state changes with the host lock
scsi: core: Add lock context annotations
scsi: core: Pass the SCSI host pointer directly to scanning functions
...
|
|
sys_or1k_atomic() (syscall 244 in the "or1k" ABI) takes two user
pointers, v1 and v2, and swaps the words they point to in hand-written
assembly.
l.lwz r29,0(r4)
l.lwz r27,0(r5)
l.sw 0(r4),r27
l.sw 0(r5),r29
The pointers are not checked with access_ok(). The four memory
accesses also have no exception table entries.
A caller passes a kernel address as either pointer, and the syscall
reads from and writes to it directly.
This gives an unprivileged process a kernel read/write primitive. It
overwrites kernel data such as the sys_call_table, gaining code
execution in kernel context.
Check both pointers before entering the critical section. Add fixups
for the four memory accesses so faults on valid but unmapped user
addresses return -EFAULT.
[shorne@gmail.com: fix comment style]
Fixes: 9d02a4283e9c ("OpenRISC: Boot code")
Cc: stable@vger.kernel.org
Signed-off-by: Ali Ahmet Memis <ali@iusegentoo.com>
Signed-off-by: Stafford Horne <shorne@gmail.com>
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring fixes from Jens Axboe:
"A few smaller fixes for io_uring that should go into the 7.3-rc1
kernel, all three headed to stable as well. This contains:
- A few fixes around cancellation and teardown for waitid
- Cap the user size for the query interface copy-out"
* tag 'io_uring-7.3-20260828' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/waitid: avoid siginfo copy during ring teardown
io_uring/waitid: honor task_work cancellation
io_uring/query: cap user size passed to copy_struct_to_user
|
|
Pull more drm updates from Dave Airlie:
"As mentioned last week, an msm pull request fell down the side of the
couch or whatever the email equivalent of that is. This has the msm
next stuff + the usual fixes for amd/intel.
core:
- use drm_warn instead of warn
msm:
- Bindings:
- Added Shikra support
- Document a840, a704, a722
- Core:
- Use drm_client buffers for fbdev emulation
- teardown fixes
- ARM32 DMA fixup
- Remove objects from evict list when re-validated
- Bunch of corner case and error path fixes
- DPU:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Fixed SSPP offsets of Kaanapali
- DP:
- Dropped dev_pm_opp_set_rate(0) preventing burnout
- Cleaned up core code in preparation for MST support
- Fixed prepare() to let Pipewire continue in case of the unplugged cable
- GPU:
- Add support for a704
- Add support for a722
- HDMI:
- Simplifed register access
amdgpu:
- eGPU fixes
- Runtime PM fix
- UserQ fixes
- Backlight fix
- Discovery sysfs fix
- Reset handling fixes
- Buffer func handling fix for xgmi
- VCN boundary check fix
- DC lut handling fixes
- MES fixes
- UVD fix
- VCE 3 fix
- Enforce isolation fix
- HPD fix for VGA/LVDS
- DML fix
- DCN 6 fixes
- DC gpu reset fix
amdkfd:
- Fix return value
- CU occupancy for GFX 11
- CU occupancy for GFX 12/12.1
- Queue bounds checking fix
- SVM fixes
- CRIU bounds checking fix
radeon:
- iMac display fix
xe:
- error message cleanups
- i2c global register definitions as dependency for xe/i2c fixes
- Media workardound
- Add CCS to gt_idle debugfs print
- Page fault related fix
- i2c related fixes
- System Controller mailbox bit fix"
* tag 'drm-next-2026-08-29' of https://gitlab.freedesktop.org/drm/kernel: (121 commits)
drm/xe/sysctrl: Read mailbox phase bit from hardware
drm/xe/i2c: Keep the i2c controller always enabled
drm/xe/i2c: Fix the interrupt handling
i2c: designware: Global register definitions
drm/xe: Reject page faults from non-fault-mode scratch VMs
drm/xe/xe_gt_idle: Add CCS to the powergating info print
drm/xe: Do not apply WA 14025883347 to media 3503
drm/amd/display: fix dc_lock leak on GPU reset error paths
drm/amd/display: Fix redundant GPUVMEnable checks in dcn6 flip schedule
drm/amd/display: Fix wrong bytes-per-pixel value for dml2_422_packed_10
drm/amdkfd: guard against NULL restore_mqd in CRIU queue restore
drm/amdgpu/userq: fix lock missing for userq fence error set
drm/amdkfd: Fix the case that vm range is hole at svm_migrate_copy_to_vram
drm/amdkfd: Fix error path at svm_migrate_copy_to_ram
drm/amd/display: Log details when failing to register HPD IRQ
drm/amd/display: Fix HPD consideration for VGA/LVDS connectors on DCE
drm/amdgpu: clamp the isolation index for rings outside a partition
drm/amdkfd: Reject zero-sized AQL queue allocations after size halving
drm/amdgpu: Fix VCE 3 ring align_mask
drm/kfd: Add CU occupancy support to GFX12.1
...
|
|
Pull ipmi updates from Corey Minyard:
"Several cleanup on error fixes and a missing RCU wait and proper
validation on a received message in one place.
The biggest change is the initialization of the driver can be done
asynchronously on a work queue. That saves significant boot time"
* tag 'for-linus-7.3-1' of https://github.com/cminyard/linux-ipmi:
ipmi: Fix use-after-free of cmd_rcvr in _ipmi_destroy_user()
ipmi:msghandler: Cancel work cleanly on an error
ipmi:si: Add async init to ipmi_si
char: ipmi: use named initializers for acpi_device_id
ipmi: Fix leak in __ipmi_bmc_register
ipmi: Remove all sysfs files on registration failure
ipmi: si: Fix NULL pointer dereference after failed registration
ipmi: ipmb: validate write message length
|
|
Pull ceph updates from Ilya Dryomov:
"A wide variety of mostly CephFS fixes and cleanups, split between
changes that address edge cases (Sam, Xiubo, Matthew), efficiency
improvements (Max) and AI-assisted hardening (Michael, Jeremy).
One thing that stands out is Alex's change to how CephFS behaves in
NEARFULL scenarios: the long-standing "make all writes synchronous"
behavior has become opt-in. It was always somewhat controversial and
doesn't make much sense for modern deployments; the new default is to
continue normal operation (i.e. buffer writes as MDS allows, etc). The
behavior in case the cluster reaches any FULL state remains the same
as before"
* tag 'ceph-for-7.3-rc1' of https://github.com/ceph/ceph-client: (32 commits)
ceph: force a cap message when a deferred revoke can't be acked immediately
libceph: reject buckets with mismatched CRUSH ids
ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode
ceph: fix leaked inode reference on writeback abort at umount
libceph: remove ceph_put_page_vector()
libceph: validate banner payload length
ceph: make nearfull sync writes opt-in
ceph: do not repeat ceph_trim_dentries() if no progress possible
ceph: drop mdsc->mutex before decoding the MDS reply
ceph: fix UAF in check_new_map() on session freed during unlock
ceph: fix UAF in __kick_flushing_caps() on cf entry freed during unlock
ceph: pass inode pointer around instead of reloading it
ceph: mark cap remove with RB_CLEAR_NODE() instead of setting ci=NULL
ceph: add helper function ceph_cap_is_removed()
ceph: make __ceph_remove_cap() static
ceph: cap delegated inode count in ceph_parse_deleg_inos()
ceph: bound num_export_targets array for mds info v2/v3
ceph: bound MDSCapAuth path and fs_name decode in handle_session()
ceph: bound xattr value length in __build_xattrs()
ceph: bound copied dentry name length in NFS export get_name
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs
Pull UBI and UBIFS updates from Richard Weinberger:
"UBI:
- Support for a per-device wear-leveling threshold
- Various fixes and cleanups of error paths
- Correctly preserve torture flag up wear-leveling
UBIFS:
- Various fixes and cleanups of error paths and kernel-doc"
* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
UBI: support per-device wear-leveling threshold
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
mtd: ubi: Release device reference on busy detach
ubi: Fix rollback for explicit UBI device numbers
ubifs: fix out-of-bounds read in signature length check
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ubifs: ubifs.h: clean up kernel-doc comments
ubifs: key.h: use correct function parameter name
ubifs: debug.h: fix kernel-doc struct prototypes
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs
Pull f2fs updates from Jaegeuk Kim:
"In this round, key enhancements focus on reducing inode management
memory overhead, introducing resizable tail sections with unified
pinned allocation, and boosting I/O throughput via parallel
multi-device flushes and asynchronous f2fs_write_end_io() execution.
We also add dynamic device alias reservations to allow on-the-fly
space donation from user partitions.
Alongside these features, critical bug fixes resolve folio race
conditions, lingering dirty flags, dentry and block counter leaks, and
potential deadloops in f2fs_fsync_node_pages(). Additional stability
patches address error-path handling across symlink, sync, and
rename/unlink operations, prevent pinned file fragmentation, and
correct segment migration and free section accounting in
free_segment_range.
Enhancements:
- reduce memory footprint of ino management
- support dynamic reserve/release for device aliasing
- issue multi-device flushes in parallel
- add a way to run f2fs_write_end_io() asynchronously
- support resizable tail section and unify pinned allocation
Bug fixes:
- fix to pass folio->index to f2fs_sanity_check_node_footer()
- fix folio_nr_pages() race after put in large folio invalidate
- fix to clear dirty flag on folio in error path
- accurately adjust free_sections during free_segment_range
- fix to avoid potential deadloop in f2fs_fsync_node_pages()
- fix the error path in symlink, device alias in rename/unlink,
f2fs_sync_fs
- fix to migrate all curseg types during free_segment_range
- fix to avoid pinfile fragment on fragment:{block, segment} mode
- fix valid block count leak on data block allocation failure
- fix dentry folio leak in find_in_level
- reject overlapping move range after len expansion
- fix some bugs related to file pinning, GC functions, i_size
And, the series includes a number of minor bug fixes"
* tag 'f2fs-for-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jaegeuk/f2fs: (51 commits)
f2fs: support resizable tail section and unify pinned allocation
f2fs: don't leave the hashed inode while it's unlinked
f2fs: accurately adjust free_sections during free_segment_range
f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()
f2fs: use adjusted write range after f2fs_write_checks()
f2fs: fix to propagate error from f2fs_sync_fs()
f2fs: return symlink writeback errors
f2fs: fix error handling on device alias check in rename and unlink
f2fs: fix to reset all pinned status during fggc
f2fs: use f2fs_{down, up}_(read, write}_trace() for nat_tree_lock
f2fs: reduce memory footprint of ino management
f2fs: fix i_size when pinned fallocate partially fails
f2fs: fix to migrate all curseg types during free_segment_range
f2fs: avoid setting SBI_NEED_FSCK on transient resize failure
f2fs: fix to avoid pinfile fragment on fragment:{block, segment} mode
f2fs: cleanup w/ f2fs_need_rand_{blk, seg, seg_blk}
f2fs: fix to shrink gc_lock coverage in f2fs_gc_range()
f2fs: fix to reclaim space in f2fs_allocate_pinning_section()
f2fs: unify add/remove ino entry API for all ino types
f2fs: fix to zero post-EOF data when extending file size
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound
Pull sound fixes from Takashi Iwai:
"A collection of various small fixes since the last PR. Most changes
are device-specific fixes, while there are a few fixes addressing the
issues reported recently by fuzzers.
Here are highlights:
ALSA Core:
- Prevent adding invalid kcontrols to the LED layer
- Workaround for a false-positive mutex lockdep warning in rawmidi
USB-audio:
- Relaxed the sticky mixer behavior check that caused regressions
- Fix an OOB write in Novation MIDI output
- Proper cleanup after system-resume errors
- Quirk updates for M-Audio Venom, Audient iD14 MkI, Logitech PRO X
Wireless, SMSL USB DAC, and Creative Sound Blaster Play! 3
HD-audio:
- Conexant headset plugin fixes
- Quirk additions and fixes for HP Laptop 15, Lenovo IdeaPad Slim 3,
TongFang XxAF5xxx, Lenovo Legion Pro 7, and Lenovo Yoga Pro 9
ASoC:
- DAPM: Fix off-by-one check on the second enum channel
- Tegra: Fix and sort register defaults
- AMD quirk updates for ASUS FA401EA, HP OmniBook X Flip 16,
HVY-WXX9/M1060, Alienware m18 R1, and MSI Thin A15 B7UC
- Fixes Qualcomm TDM handling
- Fix double put_device() on SoundWire
- Codec fixes for rt766, tac5xx2, rt712, tas2783, and max98926
Misc:
- Fix card leak on probe error on ice1712 driver
- Hardening for legacy aoa, mtpav and pcxhr drivers"
* tag 'sound-fix-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (53 commits)
ALSA: control: Don't add invalid kcontrols to LED layer
ASoC: amd: acp-config: change quirks to cover all ASUS FA401EA variants
ALSA: hda/conexant: Always enable the headset-mic pin on plugin
ASoC: dapm: Fix off-by-one check on the second enum channel
ASoC: amd: acp-config: force SoundWire probe on HP OmniBook X Flip 16
ASoC: amd: acp3x-es83xx: Add HVY-WXX9/M1060 DMI quirk
ASoC: amd: acp-config: Add HVY-WXX9/M1060 DMI quirk
ASoC: soc-generic-dmaengine: Fix DMA channel request warning
ALSA: rawmidi: Another workaround for false-positive mutex lockdep warning
ASoC: amd: yc: Add DMI entry for Alienware m18 R1 AMD
ASoC: amd: yc: Add DMI entry for MSI Thin A15 B7UC
ALSA: hda/realtek: Fix speaker mute LED for HP Laptop 15-fd0039nt
ALSA: usb-audio: Complete cleanup after system-resume errors
ALSA: hda/realtek: Add quirk for Lenovo IdeaPad Slim 3 15ABR8
ALSA: aoa: i2sbus: Check IRQ before requesting it
ALSA: usb-audio: Skip mixer creation on M-Audio Venom
ALSA: usb-audio: Skip reading sample rate on M-Audio Venom
ASoC: rt766: add RT766/RT767 VA1 device IDs
ALSA: hda/realtek: Add quirk for TongFang XxAF5xxx
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
Pull RTC updates from Alexandre Belloni:
"The RZN1 driver got a fairly comprehensive cleanup. More DT binding
are converted to DT schema, leaving only 5 remaining files to convert.
Subsystem:
- patchwork project is moving to kernel.org
- fully initialize clk_init_data
- add missing MODULE_DEVICE_TABLE()
- DT bindings conversions to DT schema
Drivers:
- ds1307: fix WADA bit for alarms on RX8130
- rzn1: add support for RZ/T2H and RZ/N2H, many fixes"
* tag 'rtc-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux: (42 commits)
MAINTAINERS: update rtc subsystem patchwork location
rtc: msc313: Select by default on MSTARV7
rtc: microcrystal: Make sure clk_init_data is fully initialized
rtc: philips: Make sure clk_init_data is fully initialized
rtc: nct3018y: Make sure clk_init_data is fully initialized
rtc: m41t80: Make sure clk_init_data is fully initialized
rtc: hym8563: Make sure clk_init_data is fully initialized
rtc: rzn1: Add support for Renesas RZ/T2H and RZ/N2H SoCs
rtc: rzn1: Drop trailing comma from OF match table sentinel
rtc: rzn1: Add OF match data to gate SUBU register access
rtc: rzn1: use FIELD_PREP/FIELD_GET and GENMASK for register access
rtc: rzn1: Consistently use dev_err_probe()
rtc: rzn1: Use temporary variable for struct device
rtc: rzn1: Dynamically calculate synchronization delay based on clock rate
rtc: rzn1: Replace remove callback with devm_add_action_or_reset()
rtc: rzn1: Use pm_runtime_put_sync()
rtc: Kconfig: Broaden RTC_DRV_RZN1 dependency to ARCH_RENESAS
rtc: rzn1: Fix malformed MODULE_AUTHOR string
rtc: rzn1: Disable alarm interrupt before reprogramming alarm registers
rtc: rzn1: Fix alarm range check truncation on 32-bit systems
...
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd
Pull TPM updates from Jarkko Sakkinen:
"The bulk of this is Ross Philipson's TPM enablement for Trenchboot.
That exposes TPM constants, and decouple and improve robustness of
tpm_buf a bit in order to implement a minimal early TPM driver.
Early boot code will call either SKINIT on AMD or GETSEC[SENTER] on
Intel before jumping into kernel's entry point. They re-initalize TPM
PCRs but leave up to the early boot code measure initrd, boot_params
and Trenchboot associated metadata.
The motivation here is just that we would want in future iterations of
the series put our full focus to the x86 part of the review, and call
it a day as per TPM changes. Further, even if Trenchboot turned out to
be empty lottery the worst possible outcome for TPM driver is that
things get cleaned up a bit"
* tag 'for-next-tpm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
tpm-buf: Add TPM buffer support header for standalone reuse
tpm-buf: Memory-safe allocations
tpm-buf: Remove chip parameter from tpm_buf_append_handle()
tpm-buf: Merge TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW
tpm: Remove main TPM header from TPM event log header
tpm: Move platform specific definitions to the new PTP header
tpm: Move TPM common base definitions to the command header
tpm: Move TPM2 specific definitions to the command header
tpm: Move TPM1 specific definitions to the command header
tpm: Initial step to reorganize TPM public headers
tpm: st33zp24: Validate locality read result
tpm: st33zp24: Return zero on status read failure
tpm: tpm_tis_spi: fix nodef CR50 tpm_tis_spi_resume is null
tpm: atmel: depend on X86
tpm: Remove redundant dev_err()
tpm: tpm_i2c_nuvoton: disable IRQ on wait timeout
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6
Pull crypto fix from Herbert Xu:
"Fix a memory allocation overrun in crypto acomp"
* tag 'v7.3-p2' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
crypto: acomp - allocate async request context when cloning
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm
Pull ACPI support fix from Rafael Wysocki:
"Revert an incomplete recent commit that may cause ACPI device power
management to stop working"
* tag 'acpi-7.3-rc1-3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
Revert "ACPI: scan: Defer device power initialization"
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
Pull arm64 fixes from Will Deacon:
"A mixture of ptdump, compat and MTE fixes that came in during the
merge window:
- Fix address handling of final memory region in ptdump
- Fix emulation of decrementing load/store multiple from 32-bit task
- Fix SCTLR context-switching for store-only MTE mode
- Fix numerous issues in MTE selftests"
* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
selftests/arm64: Add MTE test config fragment
selftests/arm64: Fix MTE prctl TAP plan
selftests/arm64: Treat KSM merge_across_nodes as optional
selftests/arm64: Print missing MTE TAP headers
arm64: compat: Fix decrementing LDM/STM alignment emulation
arm64: process: Fix context switching MTE store-only tag check
KVM: arm64: ptdump: Flush the last region
arm64: ptdump: Make note_page_flush() range aware
|
|
Pull Xtensa updates from Max Filippov:
- use strnlen() to improve iss_console_write()
- remove unused function setup_profiling_timer()
- fix CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment
* tag 'xtensa-20260828' of https://github.com/jcmvbkbc/linux-xtensa:
xtensa: remove unused setup_profiling_timer function
xtensa: correct CONFIG_XTENSA_CALIBRATE_CCOUNT macro name in comment
tty: xtensa/iss: use strnlen to improve iss_console_write
|
|
git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu
Pull m68knommu updates from Greg Ungerer:
"This includes a couple more new defconfigs to improve test build
coverage, changes to use the more correct linux/gpio/legacy.h and
platform setup for the reset device of the ColdFire 5441x SoC
hardware.
- new defconfigs for 2 more ColdFire boards
- change to use linux/gpio/legacy.h
- add platform setup for reset device of the 5441x SoC boards"
* tag 'm68knommu-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
m68k: coldfire/5441x: register mcf-rcm-reset platform device
m68k/coldfire: replace linux/gpio.h inclusions
m68k: defconfig: add config for M5282EVB board
m68k: defconfig: add config for M52358EVB board
|
|
https://gitlab.freedesktop.org/agd5f/linux into drm-next
amd-drm-next-7.3-2026-08-27:
amdgpu:
- MES fixes
- Userq fixes
- UVD fix
- VCE 3 fix
- Enforce isolation fix
- HPD fix for VGA/LVDS
- DML fix
- DCN 6 fixes
- DC gpu reset fix
amdkfd:
- CU occupancy for GFX 11
- CU occupancy for GFX 12/12.1
- Queue bounds checking fix
- SVM fixes
- CRIU bounds checking fix
Signed-off-by: Dave Airlie <airlied@redhat.com>
From: Alex Deucher <alexander.deucher@amd.com>
Link: https://patch.msgid.link/20260827203610.3249084-1-alexander.deucher@amd.com
|
