summaryrefslogtreecommitdiff
path: root/drivers/s390/char
AgeCommit message (Collapse)Author
8 daysMerge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull KVM updates from Paolo Bonzini: "ARM: - pKVM state isolation: years after pKVM started being enabled upstream, we finally get the basics in the form of state isolation. The vcpu state is now off-limit for the host for protected VMs - pKVM also grows a hypervisor-private memory allocator, allowing it to deal with sub-page allocation, much like everywhere else - pKVM also lands a trace_printk() equivalent, which hopefully will make debugging a bit easier - First shot at annotating portions of the KVM/arm64 code to be extracted and built on s390. The real fun is yet to come - Allow pre-faulting of stage-2 canonical mappings from userspace, joining x86 and s390 in implementing this feature - Add a reverse mapping infrastructure for shadow stage-2, significantly improving performance when MMU notifiers kick in, and avoiding full unmap of all shadow tables for this VM - Next step of GICv5 enablement, adding support for the IRS block, and providing both SPI and LPI support. This is the first point where KVM/arm64 can support an SMP GICv5 guest - As a preliminary to eventually enabling CCA, add a bunch of infrastructure to KVM/arm64, splitting some of the basic operations into individual backends (normal VM, normal pKVM VM, protected pKVM VM). This allows CCA to later slot in without polluting the rest of KVM with its firmware-driven nonsense - Make ID registers immutable from the point where a vcpu is able to run, even if it fails to run. This prevents KVM from sampling untrusted values - Restore some type checking to the EL2 object. KVM/arm64 originally had some strong type checking between the kernel and the EL2 object, but lost it along the way when the private hypercall interface was (somewhat pointlessly) converted to SMCCC. Type checking is back, syscall style, and with added sparse goodies - Expand the FFA support to FFA_NOTIFICATION_*, and add some sanitisation of the protocol that pKVM relays to the "trusted" runtime - Make GICv3 RD assignment more robust to userspace nonsense - Convert the remaining MMU fault handler backends to kvm_s2_fault_vma_info and co., fixing a number of bugs in the process - Fix the SError/SEA selftests to be both more robust and less braindead - Fix a smattering of documentation bugs, some of them as a result of our AI friends spitting out credible assertions based on non-existing symbols - The usual collection of low impact bug fixes (SMCCC, timers, PMU) Loongarch: - Add separate vmid support - Simplify MSI interrupt injection - Add crash hypercall support - Allow to set pv_feature until vCPU run - Enable HW page table walk automatically in selftests s390: - rework page allocation for secure guest variable storage - Selftests and documentation improvements - Replace get_zeroed_page with kzalloc - Fix corner cases of floating interrupt injection - Initial arm64 on s390 support x86: - Clean up the handling of vcpu->arch.xen.long_mode to be consistent and correctly handle 32-bit/64-bit alignment, and various other bug fixes have accumulated over the months since v1 - Grab KVM's SRCU "lock" in kvm_zap_gfn_range() to fix a recurring bug where callers fail to do so - Fix a variety of issues in the pre-fault code that are mostly benign in the current code base, but will show up in big ways if/when the pre-faulting logic is used to implementing prefetch-on-fault for the TDP MMU - For PREEMPT_RT=y kernels, drop the rmaps' individual bit-spinlock and just walk the rmaps' with mmu_lock taken. On the write side (which always uses mmu_lock), the bit-spinlock was assuming that preemption was disabled, but that is *not* true when rwlocks become sleepable - Prepare a memory_fault exit (paired with -EFAULT) when KVM hits an error PFN, e.g. so that userspace can resolve transient issues instead of killing the guest. Convert a variety of WARN()+EFAULT paths into KVM_BUG_ON()+EIO so that KVM can hard commit to filling memory_fault on -EFAULTs that occur in the page fault path - Fix a NX hugepage un-accounting bug where KVM would always uncharge the shadow MMU, even when handling TDP MMU pages - Mask off the address space ID when checking for illegal usage of kvm_set_internal_memslot() to prevent false negatives on the sanity check - Explicitly zero reserved flags when delivering a SynIC message to avoid leaking a byte of stack information to the guest - Rework TDX's handling of the canonical MMU root level to not rely on userspace to fill CPUID correctly, as doing so lets userspace trivially trigger a KVM_BUG_ON() - Reject KVM_SET_NESTED_STATE if userspace "restores" L1 with EFER.LMA=1 && EFER.LME=0, which confuses KVM into trying to configure an 64-bit MMU without PAE - Ignore EFER.LMA (clear it from KVM's cached save state) if EFER.LME=0 when preparing L2 state, to fix another way to confuse KVM's MMU (and because real hardware also ignores EFER.LMA) - Improve KVM's sanity checks for a misconfigured MMU to (hopefully) detect all of the ways KVM can botch EFER.LMA vs. CR4.PAE - Remove the "full" out-param from kvm_x86_ops.flush_tlb_gva() as the param is only used to avoid what effectively amounts to a single memory write - Fix a mostly-benign bug where KVM can write through a guest's read-only mapping due to not checking the error code when expediting emulated MMIO page faults - Honor the guest's view of the "EFER.LMSLE must be zero" defeature so that userspace can provide migration compatibility between Rome and Milan+ - Pend a KVM_REQ_EVENT request when an exception is morphed into a nested VM-Exit, otherwise KVM can fail to actually deliver the nested VM-Exit, e.g. when injecting a page fault - Add support for PML on SVM - Add support for virtualizing Bus Lock Detect on SVM, and fix a number of DR6 bugs and warts along the way - Fix a variety of warts in KVM's handling of guest TSC, kvmclock, and timekeeping in general, as a (big) first step towards addressing several longstanding problems with the kvmclock implementation. Most notably, fix a precision issue where get_kvmclock_ns() computed the clock from the *host* TSC without applying guest TSC scaling, causing systemic drift from the values the guest computes from its own TSC - Rip out KVM's shadow timekeeping structures, now that ktime snapshots are powerful enough to replace it - Misc fixes and cleanups x86 (AMD): - Fix a benign-in-practice bug where KVM unintentionally sets a non-zero error code when delivering exceptions to SEV-ES+ guests - Force a new ASID in both VMCBs on pCPU migration to fix a bug where KVM can run a VMCB with a stale ASID due to the tracking being per-CPU, not per-VMCB - Return INVALID_INPUT to the guest instead of exiting to userspace with -EIO if KVM can't access "guest request" buffer, i.e. try to keep the guest alive if the guest or userspace goofs x86 (Intel): - Enable Notify VM-Exits (now called Instruction Timeout in the SDM) and Bus Lock VM-Exits for TDX guests when they're enabled by userspace (KVM forgot to wire up the TDX Module knobs) - Move all common (between VMX and TDX) APIs/helpers to common.h/main.c, and change all namespace prefixes from "vmx" to "vt" - Fix a thankfully benign bug (due to other areas of KVM being hardened) where userspace can bypass INIT_MEM_REGION's address wrap check by providing a nr_pages that will overflow a u64 when converted to bytes, and fix an also- benign off-by-one bug in the check (inclusive vs. exclusive) - Set the vmcs.GUEST_ACTIVITY_STATE back to ACTIVE when userspace sets KVM's mp_state to anything other than HALTED, e.g. so that a vCPU doesn't get stuck in HLT if userspace emulates RESET guest_memfd: - Take the invalidate lock when unbinding a dying file to fix a race with kvm_gmem_invalidate_end() that results in KVM leaving the MMU invalidation count elevated. Not taking the lock in the first place was pure misguided paranoid - When binding a memslot, purge the bindings if storing the new memslot fails, as Xarray's "store range" API can subtly fail partway through - Establish memslot<=>guest_memfd bindings *after* the memslot is ready, as the memslot becomes reachable the instant the binding is installed - Don't grab a page refcount when reloading an SNP VMSA and stop returning a "struct page" from guest_memfd's PFN lookup altogether, to ensure that KVM doesn't hold any unnecessary refcounts (the lifetime of the page is ensured by MMU notifiers and similar hooks). Preventing unnecessary refcounts greatly simplifies supporting in-place SHARED=>PRIVATE conversions - Add support for in-place PRIVATE<=>SHARED conversion, i.e. allow a single guest_memfd instance to be used for both PRIVATE and SHARED variations of CoCo guests' memory (though not at the same time). This eliminates the need to double allocate guest memory for TDX and SNP, and is basically a hard requirement for pKVM, which relies on being able to preserve memory contents on conversions - Hack-a-fix a deadlock bug in ->error_remove_folio() by returning -EBUSY if the filemap invalidate lock is contended. Punt on a proper fix for the moment, as a proper fix likely involves reworking truncate_error_folio() - Add a pile of selftests for in-place conversions - Misc guest_memfd cleanups Generic: - Move some configuration items to preprocessor symbols, to help with arm-on-s390's need to compile the same code twice with different values - Allow KVM implementations to choose alternative device names, also for s390's support of ARM virtualmachines - Switch the KVM-VFIO interface and external consumers over to standard file-based reference counting, eliminating all external KVM symbol exports Selftests: - Rework KVM selftest's handling of memory regions all so that PPC can force its page table allocations to be naturally aligned - PPC support - Fix emulation of VMPTRST and VMPTRLD when eVMCS is in-use to match real Hyper-V's behavior - Saturate L2's TSC frequency if stacking L1 and L2 scaling multipliers exceeds what hardware supports, as attempting to run L2 with an illegal multiplier will either cause VM-Entry to fail (VMX) or trigger a #GP when writing MSR_AMD64_TSC_RATIO (SVM). The #GP is thankfully benign in the grand scheme as even "unsafe" WRMSRs have exception fixup - Rework KVM selftest's handling of memory regions so that PPC can force its page table allocations to be naturally aligned - Clean up selftest's VMX instruction helpers, and drop an absurd number of completely useless return values, e.g. functions that unconditionally return %true and then have every caller assert success - Add selftests support for Zhaoxin CPUs - Overhaul the TSC scaling test to add a regression test for the saturation behavior, and to increase its coverage in general - Fix selftests usage various NUMA syscalls to account for an undocumented, but known since 2007, off-by-one kernel bug. Add helpers to try and avoid re-introducing the same flaws in the future - Automatically run xAPIC IPI migration test (between NUMA nodes) when possible, as the entire point of the test is verify KVM's handling of page migration of the APIC backing page - Misc cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (506 commits) KVM: always make in-place conversion a compile-time constant when possible KVM: x86: leave the legacy private attribute in for TDX and SEV KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES selftests: kvm: remove useless comma operator arm64: Use proper include variant MAINTAINERS: Add entry for ARM on s390 KVM KVM: s390: arm64: Integrate arm on s390 KVM: s390: arm64: Implement basic page fault handler KVM: s390: arm64: Implement vCPU IOCTLs KVM: s390: arm64: Implement vm/vcpu create destroy KVM: s390: arm64: Implement required functions KVM: s390: Add basic arm64 kvm module s390/hwcaps: Report SAE support as hwcap KVM: s390: arm64: Introduce host definitions s390: Introduce Start Arm Execution instruction KVM: s390: Use arm64 code s390/tools: Use arm64 headers KVM: s390: Use dedicated function for migration mode s390/Kconfig: remove PCI dependency from HAS_IOMEM KVM: s390: Kick PV cpus at the right time for service irqs ...
11 daysMerge tag 's390-7.4-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux Pull s390 updates from Heiko Carstens: - Add support for sclp-vt220 terminal resize events e.g. for QEMU - Warn if kernel command line contains non-printable EBCDIC characters - Improve show_code() disassembly output by using reliable markers for the instruction address and faulting instruction - Rework exception handling to require only a single exception table entry per faulting instruction: convert all inline assemblies from EX_TABLE to the new EX_TABLE_INSN macros. The previous exception handling was error prone since it usually required two EX_TABLE entries: one pointing at the instruction, and one pointing behind it - Disallow kprobes on instructions with exception table entries to avoid exception handlers decoding a breakpoint instead of the original instruction - Preemptible percpu ops changes: - Simplify percpu_entry() and percpu_exit() by encoding the percpu base, offset, and pointer registers into the lowcore marker, allowing percpu_exit() to update the percpu pointer on CPU migration without comparing the interrupted instruction - Convert this_cpu_cmpxchg(), this_cpu_xchg(), and this_cpu_cmpxchg128() to preemptible percpu ops; provide this_cpu_try_cmpxchg() - Emulate virtual timer in appldata via delayed work and remove the s390 specific vtimer infrastructure - Add lock contention tracepoints to rwlock slowpath - Fix incorrect return address in signal frame setup - Fix cpum_cf CPU hotplug handling - Convert various __get_free_pages() / get_zeroed_page() users to kmalloc() / kzalloc() - PCI: - Improve RPCIT instruction tracing - Fix double-free, use-after-free, and resource leaks in zPCI MSI and IRQ setup / cleanup paths - Crypto and zcrypt: - Improve reply message and length verification checks for CCA, EP11, and ICA messages to prevent out-of-bounds reads - Add missing array_index_nospec() for domain index uses in zcrypt to prevent speculative execution bypass - Fix out-of-bounds read in cca_query_crypto_facility() - Various other small fixes and improvements * tag 's390-7.4-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (102 commits) s390/signal: Cleanup coding style s390/signal: Fix incorrect return address in signal frame s390/probes: Fix wrong mnemonic comment for clgib s390/probes: Add missing fixup for bctgr and bic s390/probes: Fix wrong opcode for cgrb fixup s390: Select ARCH_MEMORY_ORDER_TSO s390/mm: Cleanup pXXp_flush_lazy() routines s390/pci: Add function handle to RPCIT insn trace s390/pci: Use 32-bit fh outside of inline asm s390/pci: Adjust alignment in insn trace s390/sclp: Remove redundant memset after memblock_alloc_low() s390/entry: Save lowcore on invalid kernel stack s390/entry: Last breaking event vs invalid kernel stack s390/percpu: ImplemenHeiko Carstenst this_cpu_try_cmpxchg() s390/percpu: Drop unused output register from arch_this_cpu_to_op() s390/percpu: Drop unused output register from arch_this_cpu_add() s390/percpu: Use asm_inline for arch_this_cpu_add() s390/extable: Remove EX_TABLE macros and fallback extable search s390/bpf: Simplify exception table entry handling s390/sclp: Convert inline assembly to EX_TABLE_INSN ...
12 daysMerge tag 'kvm-s390-next-7.4-2' of ↵Paolo Bonzini
git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD KVM: s390: Changes for 7.4 - rework page allocation for secure guest variable storage - selftests - documentation - replace get_zeroed_page with kzalloc - fix floating interrupt inject for corner cases - initial arm64 on s390 support This also contains the patch "arm64: Use proper include variant" as a build fix. It is also part of the arm tree.
2026-10-15s390/hwcaps: Report SAE support as hwcapHendrik Brueckner
Report SAE support as hwcap (and /proc/cpuinfo) Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com> Reviewed-by: Steffen Eiden <seiden@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Steffen Eiden <seiden@linux.ibm.com> Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com>
2026-10-14s390/sclp: Remove redundant memset after memblock_alloc_low()Sang-Heon Jeon
memblock_alloc_low() returns zeroed memory, so the memset after the allocation in sclp_early_get_core_info() is redundant. So remove the memset. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Acked-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-10-13s390/sclp: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert the sclp_service_call exception table entries to use EX_TABLE_INSN. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-10-13s390/diag_ftp: Convert inline assembly to EX_TABLE_INSNHeiko Carstens
Convert the diag_ftp exception table entry to use EX_TABLE_INSN. Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-10-05s390/fs3270: Return -ENOTTY for unknown ioctls in fs3270_ioctl()Shirong Zhao
fs3270_ioctl() initializes rc to 0 and its cmd switch has no default branch, so an unrecognized ioctl command returns success without doing anything. Follow the ioctl convention and reject unknown commands with -ENOTTY. [hca@linux.ibm.com: shortened commit description] Signed-off-by: Shirong Zhao <shxzhaosr@163.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-10-05s390/vmcp: Initialize full session info to zeroChristian Borntraeger
The cma_alloc bit as well as the response can contain old data. cma_release will not free the kmalloced memory in that case and the response code might leak kernel stack data to CAP_SYS_ADMIN users. Cc: stable@vger.kernel.org Signed-off-by: Christian Borntraeger <borntraeger@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-30s390/sclp: Implement resize for sclp-vt220 consoleMaximilian Immanuel Brandtner
Add support for sclp vt220 resize events to enable host-initiated terminal resizing when using the sclp-vt220 console. This allows QEMU to dynamically resize the console. On older kernel versions, these events are safely ignored as the kernel drops events with undefined tty codes. Signed-off-by: Maximilian Immanuel Brandtner <maxbr@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-30s390/sclp: Introduce dedicated sclp-vt220 event buffer typeMaximilian Immanuel Brandtner
Introduce sclp-vt220 event buffer type to replace the byte-manipulation behavior in the receiver function with well defined primitives. Signed-off-by: Maximilian Immanuel Brandtner <maxbr@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-22s390/keyboard: Allocate key_maps and func_table with ARRAY_SIZE()Kees Cook
In preparation for converting the kmalloc family of allocators to the type-aware kmalloc_obj family, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (The kmalloc family returns "void *", which can be implicitly cast to any pointer type.) These allocate as many pointers as ebc_key_maps and ebc_func_table hold, but the sizes were taken from the whole arrays, which would make the allocation types pointers to those arrays rather than the "u_short **" and "char **" being assigned. Allocate ARRAY_SIZE-many entries instead. The resulting allocation sizes are the same. Build tested ARCH=s390 allmodconfig with GCC s390x-linux-gnu 16.1.0: drivers/s390/char/keyboard.o Assisted-by: LLM coccinelle Signed-off-by: Kees Cook <kees+treewide@kernel.org> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-09-17s390: Fix typos in commentsHemanth Selam
Fix typos in comments, reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-08-11s390/char: Enable CONTEXT_ANALYSISHeiko Carstens
All character drivers pass clang's compile time context analysis. Therefore enable CONTEXT_ANALYSIS. Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-08-11s390/con3215: Add __must_hold() attribute to raw3215_make_room()Heiko Carstens
Add __must_hold() attribute to raw3215_make_room() in order to let clang's context analysis know that "get_ccwdev_lock(raw->cdev)" must be held on function entry. This can also be easily verified when inspecting the function. Without this annotation this leads to a valid warning when context analysis is enabled: drivers/s390/char/con3215.c:485:9: warning: expecting spinlock 'raw->cdev->ccwlock' to be held at start of each loop [-Wthread-safety-analysis] 485 | while (RAW3215_BUFFER_SIZE - raw->count < length) { Reviewed-by: Sven Schnelle <svens@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-08-05KVM: s390: Remove cond_resched() callsHeiko Carstens
Since [1] cond_resched() is a no-op on s390. Remove all calls. This also entirely removes uv_call_sched() and replaces all call sites with uv_call(), since both functions are identical after the removal of cond_resched(). [1] commit 7dadeaa6e851 ("sched: Further restrict the preemption modes") Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-31s390/sclp: Allow SCLP Action Qualifiers for Spyre card status reportingNiklas Schnelle
Add SCLP Action Qualifiers used by the Spyre stack for reporting of the card's initialization status, recoverable errors, and telemetry data. Co-developed-by: Andreas Krebbel <krebbel@linux.ibm.com> Signed-off-by: Andreas Krebbel <krebbel@linux.ibm.com> Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Reviewed-by: Benjamin Block <bblock@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-07-02s390/monwriter: Reject buffer reuse with different data lengthGerald Schaefer
When data buffers are reused, e.g. for interval sample records, the first record determines the data length, and the size of the buffer for user copy. Current monwriter code does not check if the data length was changed for subsequent records, which also would never happen for valid user programs. However, a malicious user could change the data length, resulting in out of bounds user copy to the kernel buffer, and memory corruption. By default, the monwriter misc device is created with root-only permissions, so practical impact is typically low. Fix this by checking for changed data length and rejecting such records. Cc: stable@vger.kernel.org Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com> Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-06-19Merge tag 'mm-stable-2026-06-18-09-26' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: - "selftests/mm: clean up build output and verbosity" (Li Wang) Remove some noise from the MM selftests build - "mm: Free contiguous order-0 pages efficiently" (Ryan Roberts) Speed up the freeing of a batch of 0-order pages by first scanning them for coalescing opportunities. This is applicable to vfree() and to the releasing of frozen pages - "mm/damon: introduce DAMOS failed region quota charge ratio" (SeongJae Park) Address a DAMOS usability issue: The DAMOS quota often exhausts prematurely because it charges for all memory attempted, causing slow and inconsistent performance when actions fail on unreclaimable memory. To fix this, a new feature lets users set a smaller, flexible quota charge ratio (via a numerator and denominator) for failed regions. Since failed actions cause less overhead, reducing their quota cost ensures more predictable and efficient DAMOS processing - "selftests/cgroup: improve zswap tests robustness and support large page sizes" (Li Wang) Fix various spurious failures and improves the overall robustness of the cgroup zswap selftests - "fix MAP_DROPPABLE not supported errno" (Anthony Yznaga) Fix an issue in the mlock selftests on arm32 - "mm: huge_memory: clean up defrag sysfs with shared" (Breno Leitao) Some maintenance work in the huge_memory code - "treewide: fixup gfp_t printks" (Brendan Jackman) Use the special vprintf() gfp_t conversion in various places - "mm: Fix vmemmap optimization accounting and initialization" (Muchun Song) Fix several bugs in the vmemmap optimization, mainly around incorrect page accounting and memmap initialization in the DAX and memory hotplug paths. It also fixes pageblock migratetype initialization and struct page initialization for ZONE_DEVICE compound pages - "mm/damon: repost non-hotfix reviewed patches in damon/next tree" A sprinkle of unrelated minor bugfixes for DAMON - "mm: remove page_mapped()" (David Hildenbrand) Remove this function from the tree, replacing it with folio_mapped() - "mm/damon: let DAMON be paused and resumed" (SeongJae Park) Allow DAMON to be paused and resumed without losing its current state - "kasan: hw_tags: Disable tagging for stack and page-tables" (Muhammad Usama Anjum) Simplify and speed up kasan by removing its ineffective tagging of stacks and page tables - "mm/damon/reclaim,lru_sort: monitor all system rams by default" (SeongJae Park) Simplify deployment on diverse hardware like NUMA systems by updating DAMON_RECLAIM and DAMON_LRU_SORT to automatically monitor the physical address range covering all System RAM areas by default, replacing the overly restrictive behavior that only targeted the single largest memory block to save on negligible overhead - "mm/damon/sysfs: document filters/ directory as deprecated" (SeongJae Park) Update some DAMON docs - "mm: use spinlock guards for zone lock" (Dmitry Ilvokhin) Switch zone->lock handling over to using the guard() mechanisms - "mm/filemap: tighten mmap_miss hit accounting" (fujunjie) Fix a flaw where the mmap_miss counter over-credited page cache hits during fault-arounds and page-fault retries. This results in significant reduction of redundant synchronous mmap readahead I/O, drastically cutting down execution time and gigabytes read for sparse random or strided memory access workloads - "selftests/cgroup: Fix false positive failures in test_percpu_basic" (Li Wang) Fix a couple of false-positives in the cgroup kmem selftests - "mm/damon/reclaim: support monitoring intervals auto-tuning" (SeongJae Park) Add a new parameter to DAMON permitting DAMON_RECLAIM to automatically tune DAMON's sampling and aggregation intervals - "mm/damon/stat: add kdamond_pid parameter" (SeongJae Park) Change DAMON_STAT to provide the pid of its kdamond - "mm/kmemleak: dedupe verbose scan output" (Breno Leitao) Remove large amounts of duplicated backtraces from the verbose-mode kmemleak output - "mm: remove CONFIG_HAVE_BOOTMEM_INFO_NODE (Part 1)" (David Hildenbrand) Reduce our use of CONFIG_HAVE_BOOTMEM_INFO_NODE, with a view to removing it entirely in a later series - "mm/damon: validate min_region_size to be power of 2" (Liew Rui Yan) Prevent users from passing a non-power-of-2 value of `addr_unit', as this later results in undesirable behavior - "mm: document read_pages and simplify usage" (Frederick Mayle) - "tools/mm/page-types: Fix misc bugs" (Ye Liu) Fix three issues in tools/mm/page-types.c - "mm: misc cleanups from __GFP_UNMAPPED series" (Brendan Jackman) Implement several cleanups in the page allocator and related code - "mm, swap: swap table phase IV: unify allocation" (Kairui Song) Unify the allocation and charging of anon and shmem swap in folios, provides better synchronization, consolidates the metadata management, hence dropping the static array and map, and improves performance - "mm/damon: introduce data attributes monitoring" (SeongJae Park( Extend DAMON to monitor general data attributes other than accesses - "mm/vmalloc: free unused pages on vrealloc() shrink" (Shivam Kalra) Implement the TODO in vrealloc() to unmap and free unused pages when shrinking across a page boundary - "mm/damon: documentation and comment fixes" (niecheng) - "remove mmap_action success, error hooks" (Lorenzo Stoakes) Eliminate custom hooks from mmap_action by removing the problematic success_hook which allowed drivers to improperly access uninitialized VMAs. It replaces the error_hook with a simple error-code field and updates the memory char driver accordingly - "mm/damon: minor improvements for code readability and tests" (SeongJae Park) - "mm/damon: fix macro arguments and clarify quota goals doc" (Maksym Shcherba) - "userfaultfd: merge fs/userfaultfd.c into mm/userfaultfd.c" (Mike Rapoport) - "mm/mglru: improve reclaim loop and dirty folio" (Kairui Song and others) Clean up and slightly improves MGLRU's reclaim loop and dirty writeback handling. Large performance improvements are measured - "use vma locks for proc/pid/{smaps|numa_maps} reads" (Suren Baghdasaryan) Use per-vma locks when reading /proc/pid/smaps and numa_maps similar to reduce contention on central mmap_lock - "refactors thpsize_shmem_enabled_store() and thpsize_shmem_enabled_show()" (Ran Xiaokai) Some cleanup work in the THP code - "selftests/memfd: fix compilation warnings" (Konstantin Khorenko) Fix a few build glitches in the memfd selftest code. - "memcg: shrink obj_stock_pcp and cache multiple objcgs" (Shakeel Butt) Resolve a 68% performance regression caused by NUMA-node cache thrashing around struct obj_stock_pcp by shrinking its existing fields and expanding it into a multi-slot array that caches up to five obj_cgroup pointers per CPU, allowing per-node variants of the same memcg to coexist within a single 64-byte cache line. - "zram: writeback fixes" (Sergey Senozhatsky) address a couple of unrelated zram writeback issues - "mm: switch THP shrinker to list_lru" (Johannes Weiner) Resolve NUMA-awareness issues and streamlines callsite interaction by refactoring and extending the list_lru API to completely replace the complex, open-coded deferred split queue for Transparent Huge Pages - "mm: improve large folio readahead for exec memory" (Usama Arif) Improve large-folio readahead on systems like 64K-page arm64 by preventing the mmap_miss check from permanently disabling target-oriented VM_EXEC readahead, and by generalizing the force_thp_readahead gate to support mappings with any usefully large maximum folio order under the cache cap. - "userfaultfd/pagemap: pre-existing fixes" (Kiryl Shutsemau) Fix a bunch of minor issues in the userfaultfd/pagemap, all of which were flagged by Sashiko review of proposed new material - "mm/sparse-vmemmap: Provide generic vmemmap_set_pmd() and vmemmap_check_pmd()" (Muchun Song) Provide generic versions of these two functions so the four arch-specific implementations can be removed. - "mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device" (Youngjun Park) Address a uswsusp-vs-swapoff race and reduces the swap device reference taking/releasing frequency. - "mm/hmm: A fix and a selftest" (Dev Jain) * tag 'mm-stable-2026-06-18-09-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (321 commits) selftests/mm/hmm-tests: test pagemap reads of PMD device-private entries fs/proc/task_mmu: do not warn on seeing non-migration pmd entry lib/test_hmm: check alloc_page_vma() return value and handle OOM mm/compaction: cap compact_gap() at COMPACT_CLUSTER_MAX mm/swap: remove redundant swap device reference in alloc/free mm/swap, PM: hibernate: fix swapoff race in uswsusp by pinning swap device mm/filemap: use folio_next_index() for start vmalloc: fix NULL pointer dereference in is_vm_area_hugepages() sparc/mm: drop vmemmap_check_pmd helper and use generic code loongarch/mm: drop vmemmap_check_pmd helper and use generic code riscv/mm: drop vmemmap_pmd helpers and use generic code arm64/mm: drop vmemmap_pmd helpers and use generic code mm/sparse-vmemmap: provide generic vmemmap_set_pmd() and vmemmap_check_pmd() rust: page: mark Page::nid as inline userfaultfd: build __VMA_UFFD_FLAGS from config-gated masks userfaultfd: gate must_wait writability check on pte_present() mm/huge_memory: preserve pmd_swp_uffd_wp on device-private PMD downgrade fs/proc/task_mmu: fix hugetlb self-deadlock in pagemap_scan_pte_hole() fs/proc/task_mmu: use huge_page_size() in pagemap_scan_hugetlb_entry() fs/proc/task_mmu: fix make_uffd_wp_huge_pte() prot-update race ...
2026-06-19Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmLinus Torvalds
Pull kvm updates from Paolo Bonzini: "arm64: This is a bit of an odd merge window on the KVM/arm64 front. There is absolutely no new feature in the pull request. It is purely fixes, because it is simply becoming too hard to review new stuff when so many AI-fuelled fixes hit the list. - Significant cleanup of the vgic-v5 PPI support which was merged in 7.1. This makes the code more maintainable, and squashes a couple of bugs in the meantime - Set of fixes for the handling of the MMU in an NV context, particularly VNCR-triggered faults. S1POE support is fixed as well - Large set of pKVM fixes, mostly addressing recurring issues around hypervisor tracking of donated pages in obscure cases where the donation could fail and leave things in a bizarre state - Fixes for the so-called "lazy vgic init", which resulted in sleeping operations in non-preemptible sections. This turned out to be far more invasive than initially expected.. - Reduce the overhead of L1/L2 context switch by not touching the FP registers - Fix the way non-implemented page sizes are dealt with when a guest insist on using them for S2 translation - The usual set of low-impact fixes and cleanups all over the map Loongarch: - On a request for lazy FPU load, load all FPU state that the VM supports instead of enabling only the part (FPU, LSX or LASX) that caused the FPU load request - Some enhancements about interrupt injection - Some bug fixes and other small changes RISC-V: - Batch G-stage TLB flushes for GPA range based page table updates - Convert HGEI line management to fully per-HART - Fix missing CSR dirty marking when FWFT state updated via ONE_REG - Fix stale FWFT feature exposure to Guest/VM - Speed up dirty logging write faults using MMU rwlock and atomic PTE updates using cmpxchg() for permission-only changes - Use flexible array for APLIC IRQ state - Use kvm_slot_dirty_track_enabled() for logging enable check on a memslot - Avoid skipping valid pages in kvm_riscv_gstage_wp_range() - Avoid skipping valid pages in kvm_riscv_gstage_unmap_range() - Use endian-specific __lelong for NACL shared memory S390: - KVM_PRE_FAULT_MEMORY support - Support for 2G hugepages - Support for the ASTFLEIE 2 facility - Support for fast inject using kvm_arch_set_irq_inatomic - Fix potential leak of uninitialized bytes - A few more misc gmap fixes x86: - Generic support for the more granular permissions allowed by EPT, namely "read" (which was previously usurping the U bit) and separate execution bits for kernel and userspace - Do not assume that all page tables start with U=1/W=1/NX=0 at the root, as AMD GMET needs to have U=0 at the root - Introduce common assembly macros for use within Intel and AMD vendor-specific vmentry code. This touches the SPEC_CTRL handling, which is now entirely done in assembly for Intel (by reusing the AMD code that already existed), and register save/restore which uses some macro magic to compute the offsets in the struct. Both of these are preparatory changes for upcoming APX support - Clean up KVM's register tracking and storage, primarily to prepare for APX support, which expands the maximum number of GPRs from 16 to 32 - Keep a single copy of the PDPTRs rather than two, since architecturally there is just one - Handle EXIT_FASTPATH_EXIT_USERSPACE in vendor code to ensure vendor code gets a chance to handle things like reaping the PML buffer - Update KVM's view of PV async enabling if and only if the MSR write fully succeeds - Fix a variety of issues where the emulator doesn't honor guest-debug state, and clean up related code along the way - Synthesize EPT Violation and #NPF "error code" bits when injecting faults into L1 that didn't originate in hardware (in which case the VMCS/VMCB doesn't hold relevant information) - Add support for virtualizing (well, emulating) AMD's flavor of CPL>0 CPUID faulting - Clean up the GPR APIs so that KVM's use of "raw" is consistent, and fix a variety of minor bugs along the way - Fix an OOB memory access due to not checking the VP ID when handling a Hyper-V PV TLB flush for L2 - Fix a bug in the mediated PMU's handling of fixed counters that allowed the guest to bypass the PMU event filter - Allow userspace to return EAGAIN when handling SNP and TDX hypercalls, so the KVM can forward a "retry" status code to the guest, and reserve all unused error codes for future usage - Overhaul the TDP MMU => S-EPT code to move as much S-EPT specific logic as possible into the TDX code, and to funnel (almost) all S-EPT updates into a single chokepoint. The motivation is largely to prepare for upcoming Dynamic PAMT support, but the cleanups are nice to have on their own - Plug a hole in shadow page table handling, where KVM fails to recursively zap nested EPT/NPT shadow page tables when the nested hypervisor tears down its own EPT/NPT page tables from the bottom up x86 (Intel): - Support for nested MBEC (Mode-Based Execute Control), see above in the generic section; also run with MBEC enabled even for non-nested mode - Use the kernel's "enum pg_level" in the TDX APIs instead of the TDX-Module's level definitions (which are 0-based) - Rework the TDX memory APIs to not require/assume that guest memory is backed by "struct page" (in prepartion for guest_memfd hugepage support) - Fix a largely benign bug where KVM TDX would incorrectly state it could emulate several x2APIC MSRs - Use the "safe" WRMSR API when proxying LBR MSR writes as the to-be-written value is guest controlled and completely unvalidated x86 (AMD): - Support for nested GMET (Guest Mode Execution Trap), see above in the generic section; also run with GMET enabled even for non-nested mode - Fixes and minor cleanups to GHCB handling, on top of the earlier work already merged into 7.1-rc - Ensure KVM's copy of CR0 and CR3 are up-to-date prior to invoking fastpath handlers - Add support for virtualizing gPAT (KVM previously just used L1's PAT when running L2) - Fix goofs where KVM mishandles side effects (e.g. single-step and PMC updates) when emulating VMRUN - Fix a variety of bugs in AVIC's handling of x2APIC MSR interception, most notably where KVM didn't disable interception of IRR, ISR, and TMR regs - Add support for virtualizing Host-Only/Guest-Only bits in the mediated PMU - Don't advertise support for unusable VM types, and account for VM types that are disabled by firmware, e.g. to mitigate security vulnerabilities - Rewrite the SEV {en,de}crypt debug ioctls as they were riddle with bugs and unnecessarily complicated, and add comprehensive tests - Clean up and deduplicate the SEV page pinning code - Fix minor goofs related to writing back CPUID information after firmware rejects a CPUID page for an SNP vCPU Generic: - Rename invalidate_begin() to invalidate_start() throughout KVM to follow the kernel's nomenclature, e.g. for mmu_notifiers - Use guard() to cleanup up various KVM+VFIO flows - Minor cleanups guest_memfd: - Return -EEXIST instead of -EINVAL if userspace attempts to bind a gmem range to multiple memslots, and fix the test that was supposed to ensure KVM returns -EEXIST - Treat memslot binding offsets and sizes as unsigned values to fix a bug where KVM interprets a large "offset + size" as a negative value and allows a nonsensical offset - Use the inode number instead of the page offset for the NUMA interleaving index to fix a bug where the effective index would jump by two for consecutive pages (the caller also adds in the page offset) Selftests: - Randomize the dirty log test's delay when reaping the bitmap on the first pass, as always waiting only 1ms hid a KVM RISC-V bug as the test reaped the bitmap before KVM could build up enough state to hit the bug - A pile of one-off fixes and cleanups" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (326 commits) KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level KVM: x86: Fix shadow paging use-after-free due to unexpected role KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject KVM: s390: Enable adapter_indicators_set to use mapped pages KVM: s390: Add map/unmap ioctl and clean mappings post-guest riscv: kvm: Use endian-specific __lelong for NACL shared memory KVM: selftests: access_tracking_perf_test: bump number of NUMA nodes to 32 KVM: s390: vsie: Implement ASTFLEIE facility 2 KVM: s390: vsie: Refactor handle_stfle s390/sclp: Detect ASTFLEIE 2 facility KVM: s390: Minor refactor of base/ext facility lists KVM: x86/mmu: move pdptrs out of the MMU KVM: x86: check that kvm_handle_invpcid is only invoked with shadow paging KVM: nSVM: invalidate cached PDPTRs across nested NPT transitions KVM: nVMX: remove unnecessary code in prepare_vmcs02_rare KVM: x86: remove nested_mmu from mmu_is_nested() KVM: arm64: vgic-its: Make ABI commit helpers return void KVM: s390: Initialize KVM_S390_GET_CMMA_BITS memory LoongArch: KVM: Add missing slots_lock for device register/unregister LoongArch: KVM: Validate irqchip index in irqfd routing ...
2026-06-12s390/sclp: Detect ASTFLEIE 2 facilityNina Schoetterl-Glausch
Detect alternate STFLE interpretive execution facility 2. Signed-off-by: Nina Schoetterl-Glausch <nsg@linux.ibm.com> Signed-off-by: Christoph Schlameuss <schlameuss@linux.ibm.com> Reviewed-by: Janosch Frank <frankja@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com> Message-ID: <20260612-vsie-alter-stfle-fac-v4-2-74f0e1559929@linux.ibm.com>
2026-06-03s390/con3270: Replace __get_free_page() with kmalloc()Mike Rapoport (Microsoft)
con3270_alloc_view() allocates a staging buffer used to assemble 3270 datastream content before it is copied into channel program requests. This buffer can be allocated with kmalloc() as there's nothing special about it to go directly to the page allocator. kmalloc() provides a better API that does not require ugly casts and kfree() does not need to know the size of the freed object. Performance difference between kmalloc() and __get_free_pages() is not measurable as both allocators take an object/page from a per-CPU list for fast path allocations. For the slow path the performance is anyway determined by the amount of reclaim involved rather than by what allocator is used. Replace use of __get_free_page() with kmalloc() and free_page() with kfree(). Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-06-02drivers/base/memory: make memory block get/put explicitMuchun Song
Rename the memory block lookup helper to make the acquired reference explicit, add memory_block_put() to wrap put_device(), remove find_memory_block(), and use memory_block_get() as the single block-id based lookup interface. This makes it clearer to callers that a successful lookup holds a reference that must be dropped, reducing the chance of forgetting the matching put and leaking the memory block device reference. Link: https://lore.kernel.org/linux-mm/7887915D-E598-42B3-9AFE-BFFBACE8DE2D@linux.dev/#t Link: https://lore.kernel.org/20260512072635.3969576-1-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun@bytedance.com> Acked-by: Oscar Salvador <osalvador@suse.de> Acked-by: David Hildenbrand (Arm) <david@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Tested-by: Donet Tom <donettom@linux.ibm.com> Reviewed-by: Lorenzo Stoakes <ljs@kernel.org> Tested-by: Sumanth Korikkar <sumanthk@linux.ibm.com> #s390 Cc: Richard Cheng <icheng@nvidia.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Alexander Gordeev <agordeev@linux.ibm.com> Cc: Christian Borntraeger <borntraeger@linux.ibm.com> Cc: Danilo Krummrich <dakr@kernel.org> Cc: Doug Anderson <dianders@chromium.org> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Heiko Carstens <hca@linux.ibm.com> Cc: Kees Cook <kees@kernel.org> Cc: Liam R. Howlett <liam@infradead.org> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Nicholas Piggin <npiggin@gmail.com> Cc: "Rafael J. Wysocki" <rafael@kernel.org> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Sven Schnelle <svens@linux.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Vlastimil Babka <vbabka@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-05-26s390/zcore: Use octal permissionHeiko Carstens
Replace symbolic permissions with octal permissions, which are preferred. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26s390/zcore: Removed unused variablesHeiko Carstens
allmodconfig with clang W=1 points out unused global variables: drivers/s390/char/zcore.c:49:23: error: variable 'zcore_reipl_file' set but not used [-Werror,-Wunused-but-set-global] drivers/s390/char/zcore.c:50:23: error: variable 'zcore_hsa_file' set but not used [-Werror,-Wunused-but-set-global] Remove both of them, since there is no point in keeping them. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-26s390/sclp: Remove unused sclp_vt220_buffered_chars variableHeiko Carstens
allmodconfig with clang W=1 points out an unused global variable: drivers/s390/char/sclp_vt220.c:85:12: error: variable 'sclp_vt220_buffered_chars' set but not used [-Werror,-Wunused-but-set-global] Just remove it. Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-05-06s390/sclp: Allow user-space to provide PCI reports for NVMe SMART dataNiklas Schnelle
The new SCLP action qualifier 4 is used by user-space code to provide NVMe SMART log data to the platform. Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com> Acked-by: Heiko Carstens <hca@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-04-28s390/sclp: Remove SCLP_OFB Kconfig optionHeiko Carstens
Remove the SCLP_OFB Kconfig option and enable the guarded code unconditionally. This guards only a few lines of code, so the impact is very low while at the same time this reduces the large number of Kconfig options. Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com> Acked-by: Alexander Gordeev <agordeev@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2026-04-02s390/hmcdrv: Remove commented out codeJori Koolstra
The create_class() api is retiring in favor of class_register() (see: https://lore.kernel.org/all/2023040244-duffel-pushpin-f738@gregkh/). The HMCDRV_DEV_CLASS define is hiding a use of create_class(), but it is permanently disabled as it is commented out. To avoid supporting code that is disabled, the suggestion is to remove all code hiding be behind any #ifdef HMCDRV_DEV_CLASS. Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Link: https://lore.kernel.org/r/20260308103255.757461-1-jkoolstra@xs4all.nl Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
2026-02-21Convert more 'alloc_obj' cases to default GFP_KERNEL argumentsLinus Torvalds
This converts some of the visually simpler cases that have been split over multiple lines. I only did the ones that are easy to verify the resulting diff by having just that final GFP_KERNEL argument on the next line. Somebody should probably do a proper coccinelle script for this, but for me the trivial script actually resulted in an assertion failure in the middle of the script. I probably had made it a bit _too_ trivial. So after fighting that far a while I decided to just do some of the syntactically simpler cases with variations of the previous 'sed' scripts. The more syntactically complex multi-line cases would mostly really want whitespace cleanup anyway. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21Convert 'alloc_obj' family to use the new default GFP_KERNEL argumentLinus Torvalds
This was done entirely with mindless brute force, using git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' | xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/' to convert the new alloc_obj() users that had a simple GFP_KERNEL argument to just drop that argument. Note that due to the extreme simplicity of the scripting, any slightly more complex cases spread over multiple lines would not be triggered: they definitely exist, but this covers the vast bulk of the cases, and the resulting diff is also then easier to check automatically. For the same reason the 'flex' versions will be done as a separate conversion. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21treewide: Replace kmalloc with kmalloc_obj for non-scalar typesKees Cook
This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-19s390/tape: Fix device driver nameJan Höppner
Recent cleanups and code consolidations in the s390 tape device driver renamed files and function namespaces from tape_34xx to tape_3490 to better reflect the single support of the IBM 3490E device in the codebase. These changes also renamed the driver name to tape_3490, which consequently broke userspace as the sysfs driver path is now /sys/bus/ccw/drivers/tape_3490/ instead of /sys/bus/ccw/drivers/tape_34xx/. Change the device driver name back to tape_34xx to fix userspace. Fixes: 9872dae6102e ("s390/tape: Rename tape_34xx.c to tape_3490.c") Reported-by: Alexander Egorenkov <egorenar@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Tested-by: Alexander Egorenkov <egorenar@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-05s390/tape: Consolidate tape config options and modulesJan Höppner
The tape device driver only supports 3490E devices on Virtual Tape Server (VTS). There is no point in keeping separated options and modules for different device types and general hardware support. Consolidate the tape config option into a single option, which enables the complete tape support with one singular module called 'tape_s390'. The corresponding module entry points are adapted and consolidate in tape_init() and tape_exit() respectively in tape_core.c The current module author and descriptions of the individual tape modules are outdated and haven't been changed for quite some time. Change it to a more generic description that is in line with the corresponding supported s390 architecture for the single tape module. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Rename tape_34xx.c to tape_3490.cJan Höppner
The driver now exclusively supports 3490 tape devices, given support for 3480 tape devices has been removed. Update the device driver name, its source file name, and change any occurrences of "34xx/34XX" to "3490" in the source code and comments. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Cleanup sense data analysis and error handlingJan Höppner
Quite a few Error Recovery Action (ERA) codes and sense data entries are not relevant anymore for the Virtual Tape Server (VTS) and are not being used by VTS. Most of them were relevant for actual physical errors when a tape cartridge got stuck or a tape didn't rewind properly for example. Remove these codes from the sense data analysis as it's dead code anyway. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Remove 3480 tape device typeJan Höppner
The only supported device type by the Virtual Tape Server is 3490. The 3480 device type was an old physical tape model and doesn't exist anymore. Remove 3480 from the list and any mention of it. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Remove unused command definitionsJan Höppner
Quite a few command definitions are either not used or don't exist for 3490 tape devices on Virtual Tape Servers (VTS). Cleanup the list, which makes it easier to understand what commands are actually implemented by the driver. The lists below outline the exact reason for the removal. Description for existing commands are adapted to reflect the removal of support for old device types. The following commands don't exist in VTS for 3490 devices and are unused: INVALID_00 0x00 DIAG_MODE_SET 0x0B FORCE_STREAM_CNT 0xEB LOOP_WRITE_TO_READ 0x8B MODE_SET_C3 0xC3 MODE_SET_CB 0xCB MODE_SET_D3 0xD3 NEW_MODE_SET 0xEB RELEASE 0xD4 REQ_TRK_IN_ERROR 0x1B RESERVE 0xF4 SET_DIAGNOSE 0x4B The following command definitions are not used: CONTROL_ACCESS 0xE3 PERF_SUBSYS_FUNC 0x77 READ_BACKWARD 0x0C READ_BUFFER 0x12 READ_BUFF_LOG 0x24 READ_CONFIG_DATA 0xFA READ_DEV_CHAR 0x64 READ_MESSAGE_ID 0x4E READ_SUBSYS_DATA 0x3E SENSE_GROUP_ID 0x34 SENSE_ID 0xE4 SET_GROUP_ID 0xAF SET_INTERFACE_ID 0x73 SET_TAPE_WRITE_IMMED 0xC3 SUSPEND 0x5B SYNC 0x43 Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Remove special block id handlingJan Höppner
For real 3490 tape models a logical block was composed of a direction bit (wrap), a segment number, a format mode, and a logical block number. This is represented in a 4byte identifier. The Virtual Tape Server (VTS) emulates 3490 tape devices and uses a stripped block id format where bit 0-9 of the 4byte identifier are always 0. Bit 10-31 represent the logical block number. All tapes use the 3480-2 XF format, which was defined via TAPE34XX_FMT_3480_2_XF but never used. There is also no special handling required anymore as this is the only format being used. Since VTS doesn't require any special handling of block ids and format, corresponding code is removed. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Remove tape load display supportJan Höppner
The LOAD_DISPLAY (LDD) X'9F' is still accepted by the Virtual Tape Server (VTS) but does not perform any action. Remove all functions and definitions related to this command. The tape_34xx_ioctl() function is also removed as it was mainly used to handle additional ioctl functionality. LOAD_DISPLAY was the only left case. All other ioctls are handled in tapechar_ioctl(). With LOAD_DISPLAY, the remaining definitions in asm/tape390.h are gone. Delete the file. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2026-02-04s390/tape: Remove support for 3590/3592 modelsJan Höppner
Physical 3590/3592 tape models are not supported anymore for a very long time. The Virtual Tape Server (VTS) emulates and presents only 3490E models to the host. This is the only supported model and storage server. Remove the entire code base for 3590/3592 models as it can be considered dead code for quite some time already. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-12-07s390: Unmap early KASAN shadow on memory offliningVasily Gorbik
Teach the memory hotplug path to tear down KASAN shadow that was mapped during early boot when a memory block is offlined. Track for each sclp_mem whether its range was covered by the early KASAN shadow via an early_shadow_mapped flag. When such a block is deconfigured and removed via sclp_config_mem_store(), compute the corresponding shadow range and call vmemmap_free() to unmap the boot mapped shadow, then clear the flag. Using vmemmap_free() for the early shadow is safe despite the use of large mappings in the boot-time KASAN setup. The initial shadow is mapped with 1M and 2G pages, where possible. The minimum hotplug memory block size is 128M and always aligned (the identity mapping is at least 2G aligned), which corresponds to a 16M chunk of at least 1M aligned shadow. PMD-mapped 1M shadow pages therefore never need splitting, and PUD-mapped 2G shadow pages can now be split following the preceding changes. Relax the modify_pagetable() sanity check in vmem so that, with KASAN enabled, it may also operate on the KASAN shadow region in addition to the 1:1 mapping and vmemmap area. This allows the KASAN shadow unmapping to reuse the common vmem helpers. Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-12-07s390/vmur: Use scnprintf() instead of sprintf()Heiko Carstens
Use scnprintf() instead of sprintf() for those cases where the destination is an array and the size of the array is known at compile time. This prevents theoretical buffer overflows, but also avoids that people again and again spend time to figure out if the code is actually safe. Reviewed-by: Jan Polensky <japo@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-12-05Merge tag 'mm-stable-2025-12-03-21-26' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Pull MM updates from Andrew Morton: "__vmalloc()/kvmalloc() and no-block support" (Uladzislau Rezki) Rework the vmalloc() code to support non-blocking allocations (GFP_ATOIC, GFP_NOWAIT) "ksm: fix exec/fork inheritance" (xu xin) Fix a rare case where the KSM MMF_VM_MERGE_ANY prctl state is not inherited across fork/exec "mm/zswap: misc cleanup of code and documentations" (SeongJae Park) Some light maintenance work on the zswap code "mm/page_owner: add debugfs files 'show_handles' and 'show_stacks_handles'" (Mauricio Faria de Oliveira) Enhance the /sys/kernel/debug/page_owner debug feature by adding unique identifiers to differentiate the various stack traces so that userspace monitoring tools can better match stack traces over time "mm/page_alloc: pcp->batch cleanups" (Joshua Hahn) Minor alterations to the page allocator's per-cpu-pages feature "Improve UFFDIO_MOVE scalability by removing anon_vma lock" (Lokesh Gidra) Address a scalability issue in userfaultfd's UFFDIO_MOVE operation "kasan: cleanups for kasan_enabled() checks" (Sabyrzhan Tasbolatov) "drivers/base/node: fold node register and unregister functions" (Donet Tom) Clean up the NUMA node handling code a little "mm: some optimizations for prot numa" (Kefeng Wang) Cleanups and small optimizations to the NUMA allocation hinting code "mm/page_alloc: Batch callers of free_pcppages_bulk" (Joshua Hahn) Address long lock hold times at boot on large machines. These were causing (harmless) softlockup warnings "optimize the logic for handling dirty file folios during reclaim" (Baolin Wang) Remove some now-unnecessary work from page reclaim "mm/damon: allow DAMOS auto-tuned for per-memcg per-node memory usage" (SeongJae Park) Enhance the DAMOS auto-tuning feature "mm/damon: fixes for address alignment issues in DAMON_LRU_SORT and DAMON_RECLAIM" (Quanmin Yan) Fix DAMON_LRU_SORT and DAMON_RECLAIM with certain userspace configuration "expand mmap_prepare functionality, port more users" (Lorenzo Stoakes) Enhance the new(ish) file_operations.mmap_prepare() method and port additional callsites from the old ->mmap() over to ->mmap_prepare() "Fix stale IOTLB entries for kernel address space" (Lu Baolu) Fix a bug (and possible security issue on non-x86) in the IOMMU code. In some situations the IOMMU could be left hanging onto a stale kernel pagetable entry "mm/huge_memory: cleanup __split_unmapped_folio()" (Wei Yang) Clean up and optimize the folio splitting code "mm, swap: misc cleanup and bugfix" (Kairui Song) Some cleanups and a minor fix in the swap discard code "mm/damon: misc documentation fixups" (SeongJae Park) "mm/damon: support pin-point targets removal" (SeongJae Park) Permit userspace to remove a specific monitoring target in the middle of the current targets list "mm: MISC follow-up patches for linux/pgalloc.h" (Harry Yoo) A couple of cleanups related to mm header file inclusion "mm/swapfile.c: select swap devices of default priority round robin" (Baoquan He) improve the selection of swap devices for NUMA machines "mm: Convert memory block states (MEM_*) macros to enums" (Israel Batista) Change the memory block labels from macros to enums so they will appear in kernel debug info "ksm: perform a range-walk to jump over holes in break_ksm" (Pedro Demarchi Gomes) Address an inefficiency when KSM unmerges an address range "mm/damon/tests: fix memory bugs in kunit tests" (SeongJae Park) Fix leaks and unhandled malloc() failures in DAMON userspace unit tests "some cleanups for pageout()" (Baolin Wang) Clean up a couple of minor things in the page scanner's writeback-for-eviction code "mm/hugetlb: refactor sysfs/sysctl interfaces" (Hui Zhu) Move hugetlb's sysfs/sysctl handling code into a new file "introduce VM_MAYBE_GUARD and make it sticky" (Lorenzo Stoakes) Make the VMA guard regions available in /proc/pid/smaps and improves the mergeability of guarded VMAs "mm: perform guard region install/remove under VMA lock" (Lorenzo Stoakes) Reduce mmap lock contention for callers performing VMA guard region operations "vma_start_write_killable" (Matthew Wilcox) Start work on permitting applications to be killed when they are waiting on a read_lock on the VMA lock "mm/damon/tests: add more tests for online parameters commit" (SeongJae Park) Add additional userspace testing of DAMON's "commit" feature "mm/damon: misc cleanups" (SeongJae Park) "make VM_SOFTDIRTY a sticky VMA flag" (Lorenzo Stoakes) Address the possible loss of a VMA's VM_SOFTDIRTY flag when that VMA is merged with another "mm: support device-private THP" (Balbir Singh) Introduce support for Transparent Huge Page (THP) migration in zone device-private memory "Optimize folio split in memory failure" (Zi Yan) "mm/huge_memory: Define split_type and consolidate split support checks" (Wei Yang) Some more cleanups in the folio splitting code "mm: remove is_swap_[pte, pmd]() + non-swap entries, introduce leaf entries" (Lorenzo Stoakes) Clean up our handling of pagetable leaf entries by introducing the concept of 'software leaf entries', of type softleaf_t "reparent the THP split queue" (Muchun Song) Reparent the THP split queue to its parent memcg. This is in preparation for addressing the long-standing "dying memcg" problem, wherein dead memcg's linger for too long, consuming memory resources "unify PMD scan results and remove redundant cleanup" (Wei Yang) A little cleanup in the hugepage collapse code "zram: introduce writeback bio batching" (Sergey Senozhatsky) Improve zram writeback efficiency by introducing batched bio writeback support "memcg: cleanup the memcg stats interfaces" (Shakeel Butt) Clean up our handling of the interrupt safety of some memcg stats "make vmalloc gfp flags usage more apparent" (Vishal Moola) Clean up vmalloc's handling of incoming GFP flags "mm: Add soft-dirty and uffd-wp support for RISC-V" (Chunyan Zhang) Teach soft dirty and userfaultfd write protect tracking to use RISC-V's Svrsw60t59b extension "mm: swap: small fixes and comment cleanups" (Youngjun Park) Fix a small bug and clean up some of the swap code "initial work on making VMA flags a bitmap" (Lorenzo Stoakes) Start work on converting the vma struct's flags to a bitmap, so we stop running out of them, especially on 32-bit "mm/swapfile: fix and cleanup swap list iterations" (Youngjun Park) Address a possible bug in the swap discard code and clean things up a little [ This merge also reverts commit ebb9aeb980e5 ("vfio/nvgrace-gpu: register device memory for poison handling") because it looks broken to me, I've asked for clarification - Linus ] * tag 'mm-stable-2025-12-03-21-26' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (321 commits) mm: fix vma_start_write_killable() signal handling mm/swapfile: use plist_for_each_entry in __folio_throttle_swaprate mm/swapfile: fix list iteration when next node is removed during discard fs/proc/task_mmu.c: fix make_uffd_wp_huge_pte() huge pte handling mm/kfence: add reboot notifier to disable KFENCE on shutdown memcg: remove inc/dec_lruvec_kmem_state helpers selftests/mm/uffd: initialize char variable to Null mm: fix DEBUG_RODATA_TEST indentation in Kconfig mm: introduce VMA flags bitmap type tools/testing/vma: eliminate dependency on vma->__vm_flags mm: simplify and rename mm flags function for clarity mm: declare VMA flags by bit zram: fix a spelling mistake mm/page_alloc: optimize lowmem_reserve max lookup using its semantic monotonicity mm/vmscan: skip increasing kswapd_failures when reclaim was boosted pagemap: update BUDDY flag documentation mm: swap: remove scan_swap_map_slots() references from comments mm: swap: change swap_alloc_slow() to void mm, swap: remove redundant comment for read_swap_cache_async mm, swap: use SWP_SOLIDSTATE to determine if swap is rotational ...
2025-11-24s390: Remove KMSG_COMPONENT macroHeiko Carstens
The KMSG_COMPONENT macro is a leftover of the s390 specific "kernel message catalog" which never made it upstream. Remove the macro in order to get rid of a pointless indirection. Replace all users with the string it defines. In almost all cases this leads to a simple replacement like this: - #define KMSG_COMPONENT "appldata" - #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt + #define pr_fmt(fmt) "appldata: " fmt Except for some special cases this is just mechanical/scripted work. Acked-by: Thomas Richter <tmricht@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-17s390: Remove compat supportHeiko Carstens
There shouldn't be any 31 bit code around anymore that matters. Remove the compat layer support required to run 31 bit code. Reason for removal is code simplification and reduced test effort. Note that this comes without any deprecation warnings added to config options, or kernel messages, since most likely those would be ignored anyway. If it turns out there is still a reason to keep the compat layer this can be reverted at any time in the future. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-11-16treewide: include linux/pgalloc.h instead of asm/pgalloc.hHarry Yoo
For now, including <asm/pgalloc.h> instead of <linux/pgalloc.h> is technically fine unless the .c file calls p*d_populate_kernel() helper functions. But it is a better practice to always include <linux/pgalloc.h>. Include <linux/pgalloc.h> instead of <asm/pgalloc.h> outside arch/. Link: https://lkml.kernel.org/r/20251024113047.119058-3-harry.yoo@oracle.com Signed-off-by: Harry Yoo <harry.yoo@oracle.com> Acked-by: David Hildenbrand <david@redhat.com> Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com> Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vlastimil Babka <vbabka@suse.cz> Cc: SeongJae Park <sj@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2025-11-06s390/sclp_mem: Consider global memory_hotplug.memmap_on_memory settingSumanth Korikkar
When the global kernel command line parameter memory_hotplug.memmap_on_memory is set to false, per-memory-block memmap_on_memory setting can still be set to true. However, when configuring memory block, add_memory_resource() would configure it without memmap_on_memory. i.e. Even if the MHP_MEMMAP_ON_MEMORY flag is set, mhp_supports_memmap_on_memory() returns false unless the kernel command line parameter "memory_hotplug.memmap_on_memory" is enabled. When both the flag and the cmdline parameter are set, the memory block can be configured with or without memmap_on_memory support. To ensure consistent behavior, permit configuring per-memory-block memmap_on_memory only when the memory_hotplug.memmap_on_memory kernel command line parameter is enabled. This is similar to commit 73954d379efd ("dax: add a sysfs knob to control memmap_on_memory behavior") Fixes: ff18dcb19aab ("s390/sclp: Add support for dynamic (de)configuration of memory") Signed-off-by: Sumanth Korikkar <sumanthk@linux.ibm.com> Reviewed-by: Heiko Carstens <hca@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-10-21Merge branch 'tape-block-sizes'Heiko Carstens
Jan Höppner says: ==================== The tape device driver is limited to a block size of 65535 bytes since a single CCW can only transfer up to 64K-1 bytes (The count field is a 16bit value). This series introduces data chaining for all read/write functions to support block sizes larger than 65535. The tape device type 3490 (emulated) and 3590/3592 can handle up to 256K. [1] [1] https://www.ibm.com/docs/en/zos/3.1.0?topic=blksize-system-determined-block-size ==================== Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
2025-10-21s390/tape: Add support for bigger block sizesJan Höppner
The tape device type 3590/3592 and emulated 3490 VTS can handle a block size of up to 256K bytes. Currently the tape device driver is limited to a block size of 65535 bytes (64K-1). This limitation stems from the maximum of 65535 bytes of data that can be transferred with one Channel-Command Word (CCW). To work around this limitation data chaining is used which uses several CCW to transfer an entire 256K block of data. A single CCW holds a maximum of 65535 bytes of data. Set MAX_BLOCKSIZE to 262144 (= 256K) to allow for data transfers with larger block sizes. The read_block() and write_block() discipline functions calculate the number of CCWs required based on the IDAL buffer array size that was created for a given block size. If there is more than one CCW required for the data transfer, the new helper function tape_ccw_dc_idal() is used to build the data chain accordingly. The Interruption-Repsonse Block (irb) is added to the tape_request struct so that the tapechar_read/write() functions can analyze what data was read or written accordingly. Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Jens Remus <jremus@linux.ibm.com> Signed-off-by: Heiko Carstens <hca@linux.ibm.com>