* [patch 08/18] x86/syscall: Use [syscall_]enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, x86, Michael Ellerman, Shrikanth Hegde,
linuxppc-dev, Kees Cook, Huacai Chen, loongarch, Paul Walmsley,
Palmer Dabbelt, linux-riscv, Sven Schnelle, linux-s390,
Mark Rutland, Jinjie Ruan, Andy Lutomirski, Oleg Nesterov,
Richard Henderson, Russell King, Catalin Marinas, Guo Ren,
Geert Uytterhoeven, Thomas Bogendoerfer, Helge Deller,
Yoshinori Sato, Richard Weinberger, Chris Zankel,
linux-arm-kernel, linux-alpha, linux-csky, linux-m68k, linux-mips,
linux-parisc, linux-sh, linux-um, Arnd Bergmann, Vineet Gupta,
Will Deacon, Brian Cain, Michal Simek, Dinh Nguyen,
David S. Miller, Andreas Larsson, linux-snps-arc, linux-hexagon,
linux-openrisc, sparclinux, linux-arch, Michal Suchánek,
Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
These functions integrate the stack randomization.
syscall_enter_from_user_mode_randomize_stack() has the advantage that the
randomization happens early right after enter_from_user_mode().
In both cases also the overhead of get/put_cpu_var() in
add_random_kstack_offset() is avoided.
No functional change.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: x86@kernel.org
---
arch/x86/entry/syscall_32.c | 19 +++++--------------
arch/x86/entry/syscall_64.c | 3 +--
arch/x86/include/asm/entry-common.h | 1 -
3 files changed, 6 insertions(+), 17 deletions(-)
--- a/arch/x86/entry/syscall_32.c
+++ b/arch/x86/entry/syscall_32.c
@@ -142,10 +142,9 @@ static __always_inline bool int80_is_ext
* int80_is_external() below which calls into the APIC driver.
* Identical for soft and external interrupts.
*/
- enter_from_user_mode(regs);
+ enter_from_user_mode_randomize_stack(regs);
instrumentation_begin();
- add_random_kstack_offset();
/* Validate that this is a soft interrupt to the extent possible */
if (unlikely(int80_is_external()))
@@ -210,11 +209,9 @@ DEFINE_FREDENTRY_RAW(int80_emulation)
{
int nr;
- enter_from_user_mode(regs);
+ enter_from_user_mode_randomize_stack(regs);
instrumentation_begin();
- add_random_kstack_offset();
-
/*
* FRED pushed 0 into regs::orig_ax and regs::ax contains the
* syscall number.
@@ -252,10 +249,10 @@ DEFINE_FREDENTRY_RAW(int80_emulation)
* orig_ax, the int return value truncates it. This matches
* the semantics of syscall_get_nr().
*/
- nr = syscall_enter_from_user_mode(regs, nr);
+ nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
+
instrumentation_begin();
- add_random_kstack_offset();
do_syscall_32_irqs_on(regs, nr);
instrumentation_end();
@@ -268,15 +265,9 @@ static noinstr bool __do_fast_syscall_32
int nr = syscall_32_enter(regs);
int res;
- /*
- * This cannot use syscall_enter_from_user_mode() as it has to
- * fetch EBP before invoking any of the syscall entry work
- * functions.
- */
- enter_from_user_mode(regs);
+ enter_from_user_mode_randomize_stack(regs);
instrumentation_begin();
- add_random_kstack_offset();
local_irq_enable();
/* Fetch EBP from where the vDSO stashed it. */
if (IS_ENABLED(CONFIG_X86_64)) {
--- a/arch/x86/entry/syscall_64.c
+++ b/arch/x86/entry/syscall_64.c
@@ -86,10 +86,9 @@ static __always_inline bool do_syscall_x
/* Returns true to return using SYSRET, or false to use IRET */
__visible noinstr bool do_syscall_64(struct pt_regs *regs, int nr)
{
- nr = syscall_enter_from_user_mode(regs, nr);
+ nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
instrumentation_begin();
- add_random_kstack_offset();
if (!do_syscall_x64(regs, nr) && !do_syscall_x32(regs, nr) && nr != -1) {
/* Invalid system call, but still a system call. */
--- a/arch/x86/include/asm/entry-common.h
+++ b/arch/x86/include/asm/entry-common.h
@@ -2,7 +2,6 @@
#ifndef _ASM_X86_ENTRY_COMMON_H
#define _ASM_X86_ENTRY_COMMON_H
-#include <linux/randomize_kstack.h>
#include <linux/user-return-notifier.h>
#include <asm/nospec-branch.h>
^ permalink raw reply
* [patch 07/18] s390/syscall: Use enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Sven Schnelle, linux-s390, Michael Ellerman,
Shrikanth Hegde, linuxppc-dev, Kees Cook, Huacai Chen, loongarch,
Paul Walmsley, Palmer Dabbelt, linux-riscv, x86, Mark Rutland,
Jinjie Ruan, Andy Lutomirski, Oleg Nesterov, Richard Henderson,
Russell King, Catalin Marinas, Guo Ren, Geert Uytterhoeven,
Thomas Bogendoerfer, Helge Deller, Yoshinori Sato,
Richard Weinberger, Chris Zankel, linux-arm-kernel, linux-alpha,
linux-csky, linux-m68k, linux-mips, linux-parisc, linux-sh,
linux-um, Arnd Bergmann, Vineet Gupta, Will Deacon, Brian Cain,
Michal Simek, Dinh Nguyen, David S. Miller, Andreas Larsson,
linux-snps-arc, linux-hexagon, linux-openrisc, sparclinux,
linux-arch, Michal Suchánek, Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
enter_from_user_mode_randomize_stack() replaces enter_from_user_mode() and
the subsequent invocation of add_random_kstack_offset_irqsoff().
As a bonus this avoids the overhead of get/put_cpu_var() in
add_random_kstack_offset().
No functional change.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Sven Schnelle <svens@linux.ibm.com>
Cc: linux-s390@vger.kernel.org
---
arch/s390/kernel/syscall.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/s390/kernel/syscall.c
+++ b/arch/s390/kernel/syscall.c
@@ -97,8 +97,8 @@ void noinstr __do_syscall(struct pt_regs
{
unsigned long nr;
- enter_from_user_mode(regs);
- add_random_kstack_offset();
+ enter_from_user_mode_randomize_stack(regs);
+
regs->psw = get_lowcore()->svc_old_psw;
regs->int_code = get_lowcore()->svc_int_code;
update_timer_sys();
^ permalink raw reply
* [patch 06/18] riscv/syscall: Use syscall_enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Paul Walmsley, Palmer Dabbelt, linux-riscv,
Michael Ellerman, Shrikanth Hegde, linuxppc-dev, Kees Cook,
Huacai Chen, loongarch, Sven Schnelle, linux-s390, x86,
Mark Rutland, Jinjie Ruan, Andy Lutomirski, Oleg Nesterov,
Richard Henderson, Russell King, Catalin Marinas, Guo Ren,
Geert Uytterhoeven, Thomas Bogendoerfer, Helge Deller,
Yoshinori Sato, Richard Weinberger, Chris Zankel,
linux-arm-kernel, linux-alpha, linux-csky, linux-m68k, linux-mips,
linux-parisc, linux-sh, linux-um, Arnd Bergmann, Vineet Gupta,
Will Deacon, Brian Cain, Michal Simek, Dinh Nguyen,
David S. Miller, Andreas Larsson, linux-snps-arc, linux-hexagon,
linux-openrisc, sparclinux, linux-arch, Michal Suchánek,
Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
syscall_enter_from_user_mode_randomize_stack() replaces
syscall_enter_from_user_mode() and the subsequent invocation of
add_random_kstack_offset().
The advantage is that it applies the stack randomization right after
enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var()
as that code is invoked with interrupts disabled.
No functional change.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Paul Walmsley <pjw@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: linux-riscv@lists.infradead.org
---
arch/riscv/kernel/traps.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/arch/riscv/kernel/traps.c
+++ b/arch/riscv/kernel/traps.c
@@ -7,7 +7,6 @@
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/irqflags.h>
-#include <linux/randomize_kstack.h>
#include <linux/sched.h>
#include <linux/sched/debug.h>
#include <linux/sched/signal.h>
@@ -333,9 +332,7 @@ void do_trap_ecall_u(struct pt_regs *reg
riscv_v_vstate_discard(regs);
- syscall = syscall_enter_from_user_mode(regs, syscall);
-
- add_random_kstack_offset();
+ syscall = syscall_enter_from_user_mode_randomize_stack(regs, syscall);
if (syscall >= 0 && syscall < NR_syscalls) {
syscall = array_index_nospec(syscall, NR_syscalls);
^ permalink raw reply
* [patch 05/18] powerpc/syscall: Use syscall_enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Michael Ellerman, Shrikanth Hegde, linuxppc-dev,
Kees Cook, Huacai Chen, loongarch, Paul Walmsley, Palmer Dabbelt,
linux-riscv, Sven Schnelle, linux-s390, x86, Mark Rutland,
Jinjie Ruan, Andy Lutomirski, Oleg Nesterov, Richard Henderson,
Russell King, Catalin Marinas, Guo Ren, Geert Uytterhoeven,
Thomas Bogendoerfer, Helge Deller, Yoshinori Sato,
Richard Weinberger, Chris Zankel, linux-arm-kernel, linux-alpha,
linux-csky, linux-m68k, linux-mips, linux-parisc, linux-sh,
linux-um, Arnd Bergmann, Vineet Gupta, Will Deacon, Brian Cain,
Michal Simek, Dinh Nguyen, David S. Miller, Andreas Larsson,
linux-snps-arc, linux-hexagon, linux-openrisc, sparclinux,
linux-arch, Michal Suchánek, Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
syscall_enter_from_user_mode_randomize_stack() replaces
syscall_enter_from_user_mode() and the subsequent invocation of
add_random_kstack_offset().
The advantage is that it applies the stack randomization right after
enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var()
as that code is invoked with interrupts disabled.
No functional change.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Shrikanth Hegde <sshegde@linux.ibm.com>
Cc: linuxppc-dev@lists.ozlabs.org
---
arch/powerpc/kernel/syscall.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/arch/powerpc/kernel/syscall.c
+++ b/arch/powerpc/kernel/syscall.c
@@ -2,7 +2,6 @@
#include <linux/compat.h>
#include <linux/context_tracking.h>
-#include <linux/randomize_kstack.h>
#include <linux/entry-common.h>
#include <asm/interrupt.h>
@@ -19,8 +18,7 @@ notrace long system_call_exception(struc
long ret;
syscall_fn f;
- r0 = syscall_enter_from_user_mode(regs, r0);
- add_random_kstack_offset();
+ r0 = syscall_enter_from_user_mode_randomize_stack(regs, r0);
if (unlikely(r0 >= NR_syscalls)) {
if (unlikely(trap_is_unsupported_scv(regs))) {
^ permalink raw reply
* [patch 04/18] loongarch/syscall: Use syscall_enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Huacai Chen, loongarch, Michael Ellerman,
Shrikanth Hegde, linuxppc-dev, Kees Cook, Paul Walmsley,
Palmer Dabbelt, linux-riscv, Sven Schnelle, linux-s390, x86,
Mark Rutland, Jinjie Ruan, Andy Lutomirski, Oleg Nesterov,
Richard Henderson, Russell King, Catalin Marinas, Guo Ren,
Geert Uytterhoeven, Thomas Bogendoerfer, Helge Deller,
Yoshinori Sato, Richard Weinberger, Chris Zankel,
linux-arm-kernel, linux-alpha, linux-csky, linux-m68k, linux-mips,
linux-parisc, linux-sh, linux-um, Arnd Bergmann, Vineet Gupta,
Will Deacon, Brian Cain, Michal Simek, Dinh Nguyen,
David S. Miller, Andreas Larsson, linux-snps-arc, linux-hexagon,
linux-openrisc, sparclinux, linux-arch, Michal Suchánek,
Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
syscall_enter_from_user_mode_randomize_stack() replaces
syscall_enter_from_user_mode() and the subsequent invocation of
add_random_kstack_offset().
The advantage is that it applies the stack randomization right after
enter_from_user_mode() and thereby avoids the overhead of get/put_cpu_var()
as that code is invoked with interrupts disabled.
No functional change.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: loongarch@lists.linux.dev
---
arch/loongarch/kernel/syscall.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/arch/loongarch/kernel/syscall.c
+++ b/arch/loongarch/kernel/syscall.c
@@ -11,7 +11,6 @@
#include <linux/linkage.h>
#include <linux/nospec.h>
#include <linux/objtool.h>
-#include <linux/randomize_kstack.h>
#include <linux/syscalls.h>
#include <linux/unistd.h>
@@ -70,9 +69,7 @@ void noinstr __no_stack_protector do_sys
regs->orig_a0 = regs->regs[4];
regs->regs[4] = -ENOSYS;
- nr = syscall_enter_from_user_mode(regs, nr);
-
- add_random_kstack_offset();
+ nr = syscall_enter_from_user_mode_randomize_stack(regs, nr);
if (nr < NR_syscalls) {
syscall_fn = sys_call_table[array_index_nospec(nr, NR_syscalls)];
^ permalink raw reply
* [patch 03/18] entry: Provide [syscall_]enter_from_user_mode_randomize_stack()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Michael Ellerman, Shrikanth Hegde, linuxppc-dev,
Kees Cook, Huacai Chen, loongarch, Paul Walmsley, Palmer Dabbelt,
linux-riscv, Sven Schnelle, linux-s390, x86, Mark Rutland,
Jinjie Ruan, Andy Lutomirski, Oleg Nesterov, Richard Henderson,
Russell King, Catalin Marinas, Guo Ren, Geert Uytterhoeven,
Thomas Bogendoerfer, Helge Deller, Yoshinori Sato,
Richard Weinberger, Chris Zankel, linux-arm-kernel, linux-alpha,
linux-csky, linux-m68k, linux-mips, linux-parisc, linux-sh,
linux-um, Arnd Bergmann, Vineet Gupta, Will Deacon, Brian Cain,
Michal Simek, Dinh Nguyen, David S. Miller, Andreas Larsson,
linux-snps-arc, linux-hexagon, linux-openrisc, sparclinux,
linux-arch, Michal Suchánek, Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
Randomizing the syscall stack can only happen after state is established
via enter_from_user_mode() or syscall_enter_from_user_mode(). The earlier
it happens the better.
Provide two new macros to consolidate that:
- enter_from_user_mode_randomize_stack()
enter_from_user_mode();
add_random_kstack_offset_irqsoff();
- syscall_enter_from_user_mode_randomize_stack()
enter_from_user_mode_randomize_stack();
syscall_enter_from_user_mode_work();
to reduce boiler plate code.
Those are macros and not inline functions as the latter would limit the
stack randomization scope to the inline function itself.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
---
include/linux/entry-common.h | 56 +++++++++++++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
--- a/include/linux/entry-common.h
+++ b/include/linux/entry-common.h
@@ -6,6 +6,7 @@
#include <linux/irq-entry-common.h>
#include <linux/livepatch.h>
#include <linux/ptrace.h>
+#include <linux/randomize_kstack.h>
#include <linux/resume_user_mode.h>
#include <linux/seccomp.h>
#include <linux/sched.h>
@@ -150,6 +151,61 @@ static __always_inline long syscall_ente
}
/**
+ * enter_from_user_mode_randomize_stack - Establish state and add stack randomization
+ * before invoking syscall_enter_from_user_mode_work()
+ * @regs: Pointer to currents pt_regs
+ *
+ * Invoked from architecture specific syscall entry code with interrupts
+ * disabled. The calling code has to be non-instrumentable. When the function
+ * returns all state is correct, interrupts are still disabled and the
+ * subsequent functions can be instrumented.
+ *
+ * Implemented as a macro so that the stack randomization is effective
+ * throughout the function in which it is invoked. An inline would only make it
+ * effective in the scope of the inline function.
+ */
+#define enter_from_user_mode_randomize_stack(regs) \
+do { \
+ enter_from_user_mode(regs); \
+ instrumentation_begin(); \
+ add_random_kstack_offset_irqsoff(); \
+ instrumentation_end(); \
+} while (0)
+
+/**
+ * syscall_enter_from_user_mode_randomize_stack - Establish state and check and handle work
+ * before invoking a syscall
+ * @regs: Pointer to currents pt_regs
+ * @syscall: The syscall number
+ *
+ * Invoked from architecture specific syscall entry code with interrupts
+ * disabled. The calling code has to be non-instrumentable. When the
+ * function returns all state is correct, interrupts are enabled and the
+ * subsequent functions can be instrumented.
+ *
+ * This is the combination of enter_from_user_mode_randomize_stack() and
+ * syscall_enter_from_user_mode_work() to be used when there is no
+ * architecture specific work to be done between the two.
+ *
+ * Returns: The original or a modified syscall number. See
+ * syscall_enter_from_user_mode_work() for further explanation.
+ *
+ * Implemented as a macro to make stack randomization effective in the calling
+ * scope.
+ */
+#define syscall_enter_from_user_mode_randomize_stack(regs, syscall) \
+({ \
+ enter_from_user_mode_randomize_stack(regs); \
+ \
+ instrumentation_begin(); \
+ local_irq_enable(); \
+ long _ret = syscall_enter_from_user_mode_work(regs, syscall); \
+ instrumentation_end(); \
+ \
+ _ret; \
+})
+
+/**
* syscall_enter_from_user_mode - Establish state and check and handle work
* before invoking a syscall
* @regs: Pointer to currents pt_regs
^ permalink raw reply
* [patch 02/18] randomize_kstack: Provide add_random_kstack_offset_irqsoff()
From: Thomas Gleixner @ 2026-07-07 19:06 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Kees Cook, Michael Ellerman, Shrikanth Hegde,
linuxppc-dev, Huacai Chen, loongarch, Paul Walmsley,
Palmer Dabbelt, linux-riscv, Sven Schnelle, linux-s390, x86,
Mark Rutland, Jinjie Ruan, Andy Lutomirski, Oleg Nesterov,
Richard Henderson, Russell King, Catalin Marinas, Guo Ren,
Geert Uytterhoeven, Thomas Bogendoerfer, Helge Deller,
Yoshinori Sato, Richard Weinberger, Chris Zankel,
linux-arm-kernel, linux-alpha, linux-csky, linux-m68k, linux-mips,
linux-parisc, linux-sh, linux-um, Arnd Bergmann, Vineet Gupta,
Will Deacon, Brian Cain, Michal Simek, Dinh Nguyen,
David S. Miller, Andreas Larsson, linux-snps-arc, linux-hexagon,
linux-openrisc, sparclinux, linux-arch, Michal Suchánek,
Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
add_random_kstack_offset() uses get/put_cpu_var() which is pointless
overhead when it is invoked from low level entry code with interrupts
disabled.
Provide a irqsoff() variant, which avoids that.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Kees Cook <kees@kernel.org>
---
include/linux/randomize_kstack.h | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/include/linux/randomize_kstack.h
+++ b/include/linux/randomize_kstack.h
@@ -77,8 +77,27 @@ static __always_inline u32 get_kstack_of
} \
} while (0)
+/**
+ * add_random_kstack_offset_irqsoff - Increase stack utilization by a random offset.
+ *
+ * This should be used in the syscall entry path after user registers have been
+ * stored to the stack. Interrupts must be still disabled.
+ */
+#define add_random_kstack_offset_irqsoff() \
+do { \
+ lockdep_assert_irqs_disabled(); \
+ if (static_branch_maybe(CONFIG_RANDOMIZE_KSTACK_OFFSET_DEFAULT, \
+ &randomize_kstack_offset)) { \
+ u32 offset = prandom_u32_state(raw_cpu_ptr(&kstack_rnd_state)); \
+ u8 *ptr = __kstack_alloca(KSTACK_OFFSET_MAX(offset)); \
+ /* Keep allocation even after "ptr" loses scope. */ \
+ asm volatile("" :: "r"(ptr) : "memory"); \
+ } \
+} while (0)
+
#else /* CONFIG_RANDOMIZE_KSTACK_OFFSET */
#define add_random_kstack_offset() do { } while (0)
+#define add_random_kstack_offset_irqsoff() do { } while (0)
#endif /* CONFIG_RANDOMIZE_KSTACK_OFFSET */
#endif
^ permalink raw reply
* [patch 01/18] powerpc: Move stack randomization after syscall_enter_from_user_mode()
From: Thomas Gleixner @ 2026-07-07 19:05 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Michael Ellerman, Shrikanth Hegde, linuxppc-dev,
Kees Cook, Huacai Chen, loongarch, Paul Walmsley, Palmer Dabbelt,
linux-riscv, Sven Schnelle, linux-s390, x86, Mark Rutland,
Jinjie Ruan, Andy Lutomirski, Oleg Nesterov, Richard Henderson,
Russell King, Catalin Marinas, Guo Ren, Geert Uytterhoeven,
Thomas Bogendoerfer, Helge Deller, Yoshinori Sato,
Richard Weinberger, Chris Zankel, linux-arm-kernel, linux-alpha,
linux-csky, linux-m68k, linux-mips, linux-parisc, linux-sh,
linux-um, Arnd Bergmann, Vineet Gupta, Will Deacon, Brian Cain,
Michal Simek, Dinh Nguyen, David S. Miller, Andreas Larsson,
linux-snps-arc, linux-hexagon, linux-openrisc, sparclinux,
linux-arch, Michal Suchánek, Jonathan Corbet, linux-doc
In-Reply-To: <20260707181957.433213175@kernel.org>
add_random_kstack_offset() is invoked before syscall_enter_from_user_mode()
establishes state. That's wrong because add_random_kstack_offset() calls
into instrumentable code.
Move it after syscall_enter_from_user_mode() to ensure that state is
correctly established.
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Shrikanth Hegde <sshegde@linux.ibm.com>
Cc: linuxppc-dev@lists.ozlabs.org
---
arch/powerpc/kernel/syscall.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/kernel/syscall.c
+++ b/arch/powerpc/kernel/syscall.c
@@ -19,8 +19,8 @@ notrace long system_call_exception(struc
long ret;
syscall_fn f;
- add_random_kstack_offset();
r0 = syscall_enter_from_user_mode(regs, r0);
+ add_random_kstack_offset();
if (unlikely(r0 >= NR_syscalls)) {
if (unlikely(trap_is_unsupported_scv(regs))) {
^ permalink raw reply
* [patch 00/18] entry: Consolidate and rework syscall entry handling
From: Thomas Gleixner @ 2026-07-07 19:05 UTC (permalink / raw)
To: LKML
Cc: Peter Zijlstra, Michael Ellerman, Shrikanth Hegde, linuxppc-dev,
Kees Cook, Huacai Chen, loongarch, Paul Walmsley, Palmer Dabbelt,
linux-riscv, Sven Schnelle, linux-s390, x86, Mark Rutland,
Jinjie Ruan, Andy Lutomirski, Oleg Nesterov, Richard Henderson,
Russell King, Catalin Marinas, Guo Ren, Geert Uytterhoeven,
Thomas Bogendoerfer, Helge Deller, Yoshinori Sato,
Richard Weinberger, Chris Zankel, linux-arm-kernel, linux-alpha,
linux-csky, linux-m68k, linux-mips, linux-parisc, linux-sh,
linux-um, Arnd Bergmann, Vineet Gupta, Will Deacon, Brian Cain,
Michal Simek, Dinh Nguyen, David S. Miller, Andreas Larsson,
linux-snps-arc, linux-hexagon, linux-openrisc, sparclinux,
linux-arch, Michal Suchánek, Jonathan Corbet, linux-doc
Sorry for the long CC list, but this is a treewide change.
Michal recently posted a RFC patch to separate the potential syscall number
modifications in syscall_enter_user_mode_work() from the information
whether the syscall should be processed and the return value modified:
https://lore.kernel.org/lkml/CE1qW@kunlun.suse.cz
The existing logic is:
arch_syscall()
regs->result = -ENOSYS;
syscallnr = syscall_enter_from_user_mode(regs, syscall);
if (syscallnr != -1L)
regs->result = invoke_syscall(regs, syscall;
syscall_enter_from_user_mode() invokes ptrace, seccomp and
tracing/BPF/Probes. All of them can modify the syscall number.
ptrace and seccomp explicitly set the syscall number to -1L to indicate
that the syscall invocation needs to be skipped and the result has not to
be modified as it might have been modified by ptrace or seccomp. The
tracer/BPF/Probes mechanism can modify the syscall number as well and
relies implicitly on the -1L logic.
This can obviously not be differentiated from a syscall invocation where
userspace provided -1 as syscall number.
The general agreement of the discussion was that the current mechanism,
while functionally correct is non-intuitive and something like Michals
proposal would make that code clearer and easier to handle on the
architecture side:
arch_syscall()
regs->result = -ENOSYS;
if (syscall_enter_from_user_mode(regs, &syscall))
regs->result = invoke_syscall(regs, syscall;
That discussion made me look deeper into the related code and as usual
there were a lot of other things to discover.
1) Stack randomization
add_random_kstack_offset() can only be invoked after
enter_from_user_mode() established proper state as it calls into
instrumentable code.
PowerPC got that wrong and the other architectures either invoke it
after enter_from_user_mode() or after syscall_enter_from_user_mode().
The latter is suboptimal as the randomization takes place after all
the user mode entry work. Aside of that add_random_kstack_offset()
uses get/put_cpu_var(), which makes it usable in preemptible code, but
when invoked in the interrupt disabled region that's pointless
overhead.
2) As discussed in the above thread just changing the function signature
of syscall_enter_from_user_mode[_work]() so they take a pointer
argument for the syscall and then return 0 on success is not really
intuitive either. Aside of that this breaks the implicit assumption of
the tracer when setting the syscall number to -1.
3) The x86 entry code has some historically accumulated oddities
The following series addresses this by:
1) Providing new [syscall_]enter_from_user_mode() variants, which include
stack randomization and utilize a new add_random_kstack_offset_irqsoff()
variant, which avoids the get/put_cpu_var() overhead and converting all
usage sites over
2) Picking up Jinjie's seccomp patch from:
https://lore.kernel.org/lkml/20260629130616.642022-2-ruanjinjie@huawei.com
and addressing the feedback (renaming the seccomp functions)
3) Making the ptrace and tracer related functions return a boolean value
to indicate syscall permission
4) Addressing the x86 oddities
5) Converting the tree over to the new scheme
With that all architectures using the generic syscall entry code follow the
same scheme, apply stack randomization at the correct and earliest possible
place and skip syscall processing depending on the boolean return value of
syscall_enter_from_user_mode[_work]().
There should be no functional changes, at least there are none intended.
The resulting text size for the syscall entry code on x8664 is slightly
smaller than before these changes.
Testing syscall heavy workloads and micro benchmarks shows a small
performance gain for the general rework, but the last patch, which changes
the logic to be more understandable has no measurable impact in either
direction.
The series applies on Linus tree and is also available from git:
git://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git entry-rework-v1
Thanks,
tglx
---
Documentation/core-api/entry.rst | 33 +++++---
arch/alpha/kernel/ptrace.c | 4 -
arch/arc/kernel/ptrace.c | 2
arch/arm/kernel/ptrace.c | 4 -
arch/arm64/kernel/ptrace.c | 4 -
arch/csky/kernel/ptrace.c | 4 -
arch/hexagon/kernel/traps.c | 2
arch/loongarch/kernel/syscall.c | 17 +---
arch/m68k/kernel/ptrace.c | 4 -
arch/microblaze/kernel/ptrace.c | 2
arch/mips/kernel/ptrace.c | 4 -
arch/nios2/kernel/ptrace.c | 2
arch/openrisc/kernel/ptrace.c | 2
arch/parisc/kernel/ptrace.c | 12 +--
arch/powerpc/kernel/syscall.c | 5 -
arch/riscv/kernel/traps.c | 14 +--
arch/s390/kernel/syscall.c | 11 +-
arch/sh/kernel/ptrace_32.c | 4 -
arch/sparc/kernel/ptrace_32.c | 2
arch/sparc/kernel/ptrace_64.c | 2
arch/um/kernel/ptrace.c | 2
arch/um/kernel/skas/syscall.c | 2
arch/x86/entry/syscall_32.c | 70 +++++++------------
arch/x86/entry/syscall_64.c | 61 ++++++----------
arch/x86/entry/vsyscall/vsyscall_64.c | 14 +--
arch/x86/include/asm/entry-common.h | 1
arch/x86/include/asm/syscall.h | 10 --
arch/xtensa/kernel/ptrace.c | 5 -
include/asm-generic/syscall.h | 4 -
include/linux/entry-common.h | 125 ++++++++++++++++++++--------------
include/linux/irq-entry-common.h | 6 -
include/linux/ptrace.h | 13 +--
include/linux/randomize_kstack.h | 19 +++++
include/linux/seccomp.h | 12 +--
kernel/entry/syscall-common.c | 7 +
kernel/seccomp.c | 35 ++++-----
36 files changed, 264 insertions(+), 256 deletions(-)
^ permalink raw reply
* Re: [PATCH v2 00/11] lib/cpumask: get rid of cpumap_print_to_pagebuf()
From: Yury Norov @ 2026-07-07 18:42 UTC (permalink / raw)
To: Andrew Morton, Rasmus Villemoes
Cc: Russell King, Frank Li, Sascha Hauer, Pengutronix Kernel Team,
Fabio Estevam, Madhavan Srinivasan, Michael Ellerman,
Nicholas Piggin, Christophe Leroy (CS GROUP), Peter Zijlstra,
Ingo Molnar, Arnaldo Carvalho de Melo, Namhyung Kim, Mark Rutland,
Alexander Shishkin, Jiri Olsa, Ian Rogers, Adrian Hunter,
James Clark, Thomas Gleixner, Borislav Petkov, Dave Hansen,
H. Peter Anvin, Rafael J. Wysocki, Greg Kroah-Hartman,
Danilo Krummrich, Chanwoo Choi, MyungJoo Ham, Kyungmin Park,
Heiko Stuebner, Xu Yilun, Tom Rix, Moritz Fischer, Yicong Yang,
Jonathan Cameron, Dennis Dalessandro, Jason Gunthorpe,
Leon Romanovsky, Bjorn Helgaas, Shuai Xue, Will Deacon,
Jiucheng Xu, Neil Armstrong, Kevin Hilman, Jerome Brunet,
Martin Blumenstingl, Robin Murphy, Jing Zhang, Xu Yang,
Linu Cherian, Gowthami Thiagarajan, Ji Sheng Teoh, Khuong Dinh,
Yury Norov, Kees Cook, Thomas Weißschuh, Aboorva Devarajan,
Ilkka Koskinen, Besar Wicaksono, Ma Ke, Chengwen Feng,
Ritesh Harjani, Yushan Wang, linux-arm-kernel, imx, linux-kernel,
linuxppc-dev, linux-perf-users, x86, driver-core, linux-pm,
linux-rockchip, linux-fpga, linux-rdma, linux-pci, linux-amlogic,
linux-cxl, linux-arm-msm
In-Reply-To: <20260702154725.185376-1-ynorov@nvidia.com>
Added in bitmap-for-next. Thanks.
On Thu, Jul 02, 2026 at 11:47:13AM -0400, Yury Norov wrote:
> cpumap_print_to_pagebuf() is the equivalent for the "&*pb[l]" notation
> in printk-like functions. In some cases, it makes people to create
> temporary buffers for the printed cpumasks, where it can be avoided.
>
> Get rid of it in a favor of more standard printing API.
>
> Each patch, except for the last one, is independent and may be moved with
> the corresponding subsystem. Or I can take it in bitmap-for-next, at
> maintainers' discretion.
>
> On top of -next.
>
> This is the resend of:
>
> https://lore.kernel.org/all/20260528183625.870813-1-ynorov@nvidia.com/
>
> Except the patches merged in 7.1 cycle. I'm going to apply the material
> in 7.2 unless explicit NAKs received.
>
> Yury Norov (11):
> arm: Use sysfs_emit() for cpumask show callbacks
> powerpc: Use sysfs_emit() for cpumask show callbacks
> x86/events: Use sysfs_emit() for cpumask show callbacks
> cpu: Use sysfs_emit() for cpumask show callback
> devfreq: Use sysfs_emit() for cpumask show callbacks
> fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show
> hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show
> RDMA/hfi1: Use sysfs_emit() for cpumask show helper
> PCI/sysfs: Use sysfs_emit() for cpumask show callbacks
> perf: Use sysfs_emit() for cpumask show callbacks
> lib/bitmap-str: get rid of cpumap_print_to_pagebuf()
>
> arch/arm/mach-imx/mmdc.c | 2 +-
> arch/arm/mm/cache-l2x0-pmu.c | 2 +-
> arch/powerpc/kernel/cacheinfo.c | 3 ++-
> arch/powerpc/perf/hv-24x7.c | 2 +-
> arch/powerpc/perf/hv-gpci.c | 2 +-
> arch/powerpc/perf/imc-pmu.c | 2 +-
> arch/x86/events/amd/iommu.c | 2 +-
> arch/x86/events/amd/power.c | 2 +-
> arch/x86/events/amd/uncore.c | 2 +-
> arch/x86/events/intel/core.c | 2 +-
> arch/x86/events/intel/uncore.c | 2 +-
> drivers/base/cpu.c | 2 +-
> drivers/devfreq/event/rockchip-dfi.c | 2 +-
> drivers/devfreq/hisi_uncore_freq.c | 2 +-
> drivers/fpga/dfl-fme-perf.c | 2 +-
> drivers/hwtracing/ptt/hisi_ptt.c | 2 +-
> drivers/infiniband/hw/hfi1/sdma.c | 3 ++-
> drivers/pci/pci-sysfs.c | 7 ++++---
> drivers/perf/alibaba_uncore_drw_pmu.c | 2 +-
> drivers/perf/amlogic/meson_ddr_pmu_core.c | 2 +-
> drivers/perf/arm-cci.c | 2 +-
> drivers/perf/arm-ccn.c | 2 +-
> drivers/perf/arm-cmn.c | 2 +-
> drivers/perf/arm-ni.c | 2 +-
> drivers/perf/arm_cspmu/arm_cspmu.c | 2 +-
> drivers/perf/arm_dmc620_pmu.c | 4 ++--
> drivers/perf/arm_dsu_pmu.c | 2 +-
> drivers/perf/arm_pmu.c | 2 +-
> drivers/perf/arm_smmuv3_pmu.c | 2 +-
> drivers/perf/arm_spe_pmu.c | 2 +-
> drivers/perf/cxl_pmu.c | 2 +-
> drivers/perf/dwc_pcie_pmu.c | 2 +-
> drivers/perf/fsl_imx8_ddr_perf.c | 2 +-
> drivers/perf/fsl_imx9_ddr_perf.c | 2 +-
> drivers/perf/fujitsu_uncore_pmu.c | 2 +-
> drivers/perf/hisilicon/hisi_pcie_pmu.c | 2 +-
> drivers/perf/hisilicon/hisi_uncore_pmu.c | 2 +-
> drivers/perf/marvell_cn10k_ddr_pmu.c | 2 +-
> drivers/perf/marvell_cn10k_tad_pmu.c | 2 +-
> drivers/perf/marvell_pem_pmu.c | 2 +-
> drivers/perf/nvidia_t410_c2c_pmu.c | 2 +-
> drivers/perf/nvidia_t410_cmem_latency_pmu.c | 2 +-
> drivers/perf/qcom_l2_pmu.c | 2 +-
> drivers/perf/qcom_l3_pmu.c | 2 +-
> drivers/perf/starfive_starlink_pmu.c | 2 +-
> drivers/perf/thunderx2_pmu.c | 2 +-
> drivers/perf/xgene_pmu.c | 2 +-
> include/linux/cpumask.h | 19 -------------------
> kernel/events/core.c | 2 +-
> lib/bitmap-str.c | 9 ++++-----
> 50 files changed, 58 insertions(+), 75 deletions(-)
>
> --
> 2.53.0
^ permalink raw reply
* Re: [PATCH RFC] RAS: hwerr_tracking: move recoverable hardware error tracking out of vmcoreinfo
From: Borislav Petkov @ 2026-07-07 18:35 UTC (permalink / raw)
To: Breno Leitao
Cc: Tony Luck, Thomas Gleixner, Ingo Molnar, Dave Hansen, x86,
H. Peter Anvin, Rafael J. Wysocki, Hanjun Guo,
Mauro Carvalho Chehab, Shuai Xue, Len Brown, Mahesh J Salgaonkar,
Oliver O'Halloran, Bjorn Helgaas, Breno Leitao, linux-kernel,
linux-edac, linux-acpi, linuxppc-dev, linux-pci, kernel-team
In-Reply-To: <ak0sGAX_NWMyeofC@gmail.com>
On Tue, Jul 07, 2026 at 09:53:34AM -0700, Breno Leitao wrote:
> The current vmcoreinfo implementation defaults to enabled, so I wanted to
> preserve that behavior to avoid silently removing symbols that existing
> tools may depend on. Would you prefer a different default?
You do know Linus' stance on enabling things by default which are not
ubiquitous, right?
Logging hw errors in vmcore is really necessary to be enabled everywhere?
> I agree the sysfs exposure duplicates existing infrastructure, points
> taken. However, tracking fatal hardware errors provides value at crash
> analysis time—it lets us quickly determine whether a fatal hardware
> error occurred during the kernel's lifetime, which is useful for
> root-cause attribution.
Yes, that's why you put it in vmcore. You can't read sysfs if you encounter
a fatal hw error.
> For this, would you like to keep it in vmcore info (as of today), or
> move to RAS subsystem?
You mean, would I like to pay attention to more patches than now?
Not really - I can barely manage as it is.
:-)
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply
* Re: [PATCH 17/42] drm: ingenic: Use devm_of_reserved_mem_device_init()
From: Paul Cercueil @ 2026-07-07 18:06 UTC (permalink / raw)
To: Mukesh Ojha, Bjorn Andersson, Konrad Dybcio, Liviu Dudau,
Maarten Lankhorst, Maxime Ripard, Thomas Zimmermann, David Airlie,
Simona Vetter, Joel Stanley, Andrew Jeffery, Anitha Chrisanthus,
Paul Kocialkowski, Linus Walleij, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland, Alexey Brodkin, Laurent Pinchart, Tomi Valkeinen,
Michal Simek, Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Eddie James, Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
Minghsiu Tsai, Houlong Wei, Matthias Brugger,
AngeloGioacchino Del Regno, Joseph Liu, Marvin Lin,
Dmitry Osipenko, Krzysztof Kozlowski, Thierry Reding,
Jonathan Hunter, Srinivas Kandagatla, Arnd Bergmann,
Greg Kroah-Hartman, Ge Gordon, Adrian Hunter, Ulf Hansson,
Rob Herring, Saravana Kannan, Mathieu Poirier, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Liam Girdwood, Mark Brown,
Frank Li, Sascha Hauer, Peter Ujfalusi, Bard Liao, Daniel Baluta,
Orson Zhai, Baolin Wang, Peter Chen, Fugang Duan
Cc: Ekansh Gupta, BST Linux Kernel Upstream Group, Fabio Estevam,
Nicolin Chen, Pengutronix Kernel Team, Kai Vehmanen,
Pierre-Louis Bossart, Vijendar Mukunda, Chunyan Zhang,
CIX Linux Kernel Upstream Group, linux-arm-msm, linux-kernel,
dri-devel, linux-aspeed, linux-arm-kernel, linux-mips,
linux-sunxi, linux-media, openbmc, linux-mediatek, kernel,
linux-tegra, linux-mmc, devicetree, linux-remoteproc,
linux-staging, linux-sound, linuxppc-dev, imx,
sound-open-firmware
In-Reply-To: <20260703193855.110619-18-mukesh.ojha@oss.qualcomm.com>
Hi,
Le samedi 04 juillet 2026 à 01:08 +0530, Mukesh Ojha a écrit :
> Replace the hand-rolled devm wrapper (ingenic_drm_release_rmem +
> devm_add_action_or_reset) with the standard
> devm_of_reserved_mem_device_init(), letting the device resource
> manager handle cleanup automatically.
>
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Cheers,
-Paul
> ---
> drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 13 +------------
> 1 file changed, 1 insertion(+), 12 deletions(-)
>
> diff --git a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> index 7e569af22391..990c3b4625fa 100644
> --- a/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> +++ b/drivers/gpu/drm/ingenic/ingenic-drm-drv.c
> @@ -1060,11 +1060,6 @@ static void ingenic_drm_unbind_all(void *d)
> component_unbind_all(priv->dev, &priv->drm);
> }
>
> -static void __maybe_unused ingenic_drm_release_rmem(void *d)
> -{
> - of_reserved_mem_device_release(d);
> -}
> -
> static void ingenic_drm_configure_hwdesc(struct ingenic_drm *priv,
> unsigned int hwdesc,
> unsigned int next_hwdesc,
> u32 id)
> @@ -1127,16 +1122,10 @@ static int ingenic_drm_bind(struct device
> *dev, bool has_components)
> }
>
> if (IS_ENABLED(CONFIG_OF_RESERVED_MEM)) {
> - ret = of_reserved_mem_device_init(dev);
> + ret = devm_of_reserved_mem_device_init(dev);
>
> if (ret && ret != -ENODEV)
> dev_warn(dev, "Failed to get reserved
> memory: %d\n", ret);
> -
> - if (!ret) {
> - ret = devm_add_action_or_reset(dev,
> ingenic_drm_release_rmem, dev);
> - if (ret)
> - return ret;
> - }
> }
>
> priv = devm_drm_dev_alloc(dev, &ingenic_drm_driver_data,
^ permalink raw reply
* [PATCH] powerpc/970: fix nap return address corruption on async interrupt exit
From: Mukesh Kumar Chaurasiya (IBM) @ 2026-07-07 17:24 UTC (permalink / raw)
To: maddy, mpe, npiggin, chleroy, sshegde, mchauras, mkchauras,
ruanjinjie, thuth, linuxppc-dev, linux-kernel
Cc: Andreas Schwab
On PowerMac G5 (PPC970, CONFIG_PPC_970_NAP) the system panics shortly
after boot with symptoms including instruction fetch faults, kernel data
access faults, and stack corruption, predominantly on SMP and always
somewhere inside softirq processing.
The PPC970 idle path works by setting _TLF_NAPPING in the current
thread's local flags before entering the MSR_POW nap loop. When any
async interrupt wakes the CPU, nap_adjust_return() is expected to detect
_TLF_NAPPING, clear it, and rewrite regs->NIP to power4_idle_nap_return
so that the interrupt returns cleanly to the caller of power4_idle_nap()
rather than back into the nap spin loop.
DEFINE_INTERRUPT_HANDLER_ASYNC generates the following sequence:
irq_enter_rcu();
____func(regs); /* timer_interrupt / do_IRQ body */
irq_exit_rcu(); /* softirqs run here, irqs re-enabled */
arch_interrupt_async_exit_prepare(regs); /* nap_adjust_return was here */
irqentry_exit(regs, state);
irq_exit_rcu() calls invoke_softirq() -> do_softirq_own_stack(), which
runs softirqs with hardware interrupts re-enabled. A nested async
interrupt can therefore arrive while _TLF_NAPPING is still set. That
nested interrupt reaches nap_adjust_return() in its own
arch_interrupt_async_exit_prepare() call, finds _TLF_NAPPING set, and
redirects *its own* regs->NIP to power4_idle_nap_return. Returning via
that blr with an unrelated LR on the softirq stack jumps to a garbage
address, causing the observed crashes.
The comment that previously lived in arch_interrupt_async_exit_prepare()
even described this exact hazard ("must come before irq_exit()"), but
nap_adjust_return() was placed after irq_exit_rcu() in the macro, so
the protection was never effective.
Fix this by calling nap_adjust_return() inside DEFINE_INTERRUPT_HANDLER_ASYNC
immediately before irq_exit_rcu(), ensuring _TLF_NAPPING is cleared and
regs->NIP is adjusted before any code that can re-enable interrupts or
invoke softirqs runs. Move the explanatory comment into
nap_adjust_return() itself and remove it from arch_interrupt_async_exit_prepare().
Fixes: bee25f97ad24 ("powerpc: Enable GENERIC_ENTRY feature")
Closes: https://lore.kernel.org/all/87wlvazrdy.fsf@igel.home/
Reported-by: Andreas Schwab <schwab@linux-m68k.org>
Signed-off-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
---
arch/powerpc/include/asm/entry-common.h | 15 +++++++--------
arch/powerpc/include/asm/interrupt.h | 1 +
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/include/asm/entry-common.h b/arch/powerpc/include/asm/entry-common.h
index fc636c42e89a..c5adb5006361 100644
--- a/arch/powerpc/include/asm/entry-common.h
+++ b/arch/powerpc/include/asm/entry-common.h
@@ -66,6 +66,13 @@ static inline void srr_regs_clobbered(void)
static inline void nap_adjust_return(struct pt_regs *regs)
{
#ifdef CONFIG_PPC_970_NAP
+ /*
+ * Adjust the nap return address before irq_exit_rcu(). irq_exit_rcu()
+ * may invoke softirqs with interrupts re-enabled, allowing a nested
+ * async interrupt to arrive. If _TLF_NAPPING is still set at that
+ * point, the nested interrupt would erroneously redirect its own
+ * return address to power4_idle_nap_return, corrupting the stack.
+ */
if (unlikely(test_thread_local_flags(_TLF_NAPPING))) {
/* Can avoid a test-and-clear because NMIs do not call this */
clear_thread_local_flags(_TLF_NAPPING);
@@ -286,14 +293,6 @@ static inline void arch_interrupt_async_enter_prepare(struct pt_regs *regs)
static inline void arch_interrupt_async_exit_prepare(struct pt_regs *regs)
{
- /*
- * Adjust at exit so the main handler sees the true NIA. This must
- * come before irq_exit() because irq_exit can enable interrupts, and
- * if another interrupt is taken before nap_adjust_return has run
- * here, then that interrupt would return directly to idle nap return.
- */
- nap_adjust_return(regs);
-
arch_interrupt_exit_prepare(regs);
}
diff --git a/arch/powerpc/include/asm/interrupt.h b/arch/powerpc/include/asm/interrupt.h
index fb42a664ae54..1b45a49e9bed 100644
--- a/arch/powerpc/include/asm/interrupt.h
+++ b/arch/powerpc/include/asm/interrupt.h
@@ -246,6 +246,7 @@ interrupt_handler void func(struct pt_regs *regs) \
instrumentation_begin(); \
irq_enter_rcu(); \
____##func (regs); \
+ nap_adjust_return(regs); \
irq_exit_rcu(); \
instrumentation_end(); \
arch_interrupt_async_exit_prepare(regs); \
--
2.55.0
^ permalink raw reply related
* Re: [PATCH V16 4/7] rust/powerpc: Set min rustc version for powerpc
From: Mukesh Kumar Chaurasiya @ 2026-07-07 17:11 UTC (permalink / raw)
To: Link Mauve
Cc: Miguel Ojeda, maddy, mpe, npiggin, chleroy, peterz, jpoimboe,
jbaron, aliceryhl, rostedt, ardb, ojeda, boqun, gary, bjorn3_gh,
lossin, a.hindborg, tmgross, dakr, nathan, nick.desaulniers+lkml,
morbo, justinstitt, daniel.almeida, acourbot, fujita.tomonori,
gregkh, prafulrai522, tamird, kees, lyude, airlied, linuxppc-dev,
linux-kernel, rust-for-linux, llvm
In-Reply-To: <akzTCxnSgxba7Yen@luna>
On Tue, Jul 07, 2026 at 12:20:59PM +0200, Link Mauve wrote:
> On Tue, Jul 07, 2026 at 12:41:37PM +0530, Mukesh Kumar Chaurasiya wrote:
> > On Tue, Jun 30, 2026 at 11:15:03AM +0530, Mukesh Kumar Chaurasiya wrote:
> > > On Mon, Jun 29, 2026 at 11:11:44AM +0200, Miguel Ojeda wrote:
> > > > On Mon, Jun 29, 2026 at 6:57 AM Mukesh Kumar Chaurasiya
> > > > <mkchauras@gmail.com> wrote:
> > > > >
> > > > > Sure i'll bisect. Meanwhile i would still like to get this upstream.
> > > >
> > > > It is very early on the cycle -- I would suggest bisecting first.
> > > >
> > > > But it is up to ppc, of course.
> > > >
> > > > Cheers,
> > > > Miguel
> > Hey Miguel,
> >
> > I was able to bisect this. This got fixed in 1.87 with
> > #![feature(asm_experimental_arch)].
>
> On 1.85.0 though, with this feature allowed, the kernel gets built
> perfectly without any need for 1.87.0. You might want to require 1.87.0
> only with altivec enabled, whereas on 32-bit we can build on 1.85.0 just
> fine.
>
Even without altivec and vsx disabled, It's not building for ppc64le.
Regards,
Mukesh
> >
> > 1st commit that contributed towards this is
> > e4f539ea17a3 ("Bump to version 1.87.0")
> >
> > This caused another issue to come up while building
> >
> > ```
> > error: extern blocks must be unsafe
> > --> /home/mkchauras/.local/rustc-src/lib/rustlib/src/rust/library/core/src/../../stdarch/crates/core_arch/src/powerpc/vsx.rs:38:1
> > |
> > 38 | / extern "C" {
> > 39 | | #[link_name = "llvm.ppc.altivec.vperm"]
> > 40 | | fn vperm(
> > 41 | | a: vector_signed_int,
> > ... |
> > 44 | | ) -> vector_signed_int;
> > 45 | | }
> > | |_^
> > ```
> >
> > Which is fixed by
> > a78d1b092c9c ("Update stdarch")
> >
> > Both these commits went in 1.87.0 and fixed the build.
> >
> > Regards,
> > Mukesh
> >
> > > Sure, I'll bisect it first.
> > >
> > > Regards,
> > > Mukesh
> >
>
> --
> Link Mauve
^ permalink raw reply
* Re: [PATCH v7 08/22] coco: arm64: s390: powerpc: Mark secure guests with CC_ATTR_GUEST_MEM_ENCRYPT
From: Catalin Marinas @ 2026-07-07 16:58 UTC (permalink / raw)
To: Aneesh Kumar K.V (Arm)
Cc: iommu, linux-arm-kernel, linux-kernel, linux-coco, Robin Murphy,
Marek Szyprowski, Will Deacon, Marc Zyngier, Steven Price,
Suzuki K Poulose, Jiri Pirko, Jason Gunthorpe, Mostafa Saleh,
Petr Tesarik, Alexey Kardashevskiy, Dan Williams, Xu Yilun,
linuxppc-dev, linux-s390, Madhavan Srinivasan, Michael Ellerman,
Nicholas Piggin, Christophe Leroy (CS GROUP), Alexander Gordeev,
Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, x86
In-Reply-To: <20260701054926.825925-9-aneesh.kumar@kernel.org>
On Wed, Jul 01, 2026 at 11:19:12AM +0530, Aneesh Kumar K.V (Arm) wrote:
> arm64 Realms, powerpc secure guests and s390 protected virtualization
> guests currently report CC_ATTR_MEM_ENCRYPT, but not
> CC_ATTR_GUEST_MEM_ENCRYPT.
>
> These environments are all secure guest configurations. Their
> force_dma_unencrypted() implementations also treat the same secure guest
> state as requiring unencrypted DMA. Report CC_ATTR_GUEST_MEM_ENCRYPT for
> the same condition so generic confidential-computing code can distinguish
> guest memory encryption from host memory encryption instead of relying only
> on CC_ATTR_MEM_ENCRYPT.
>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
For arm64:
Acked-by: Catalin Marinas <catalin.marinas@arm.com>
^ permalink raw reply
* Re: [PATCH v5 0/8] Generic IRQ entry/exit support for powerpc
From: Mukesh Kumar Chaurasiya @ 2026-07-07 16:54 UTC (permalink / raw)
To: Andreas Schwab
Cc: Christophe Leroy (CS GROUP), maddy, mpe, npiggin, ryabinin.a.a,
glider, andreyknvl, dvyukov, vincenzo.frascino, oleg, kees, luto,
wad, mchauras, sshegde, thuth, ruanjinjie, akpm, macro, ldv,
charlie, deller, kevin.brodsky, ritesh.list, yeoreum.yun,
agordeev, segher, mark.rutland, ryan.roberts, pmladek, feng.tang,
peterz, linuxppc-dev, linux-kernel, kasan-dev
In-Reply-To: <875x2qu5ay.fsf@igel.home>
On Tue, Jul 07, 2026 at 06:34:45PM +0200, Andreas Schwab wrote:
> On Jul 07 2026, Mukesh Kumar Chaurasiya wrote:
>
> > diff --git a/arch/powerpc/include/asm/entry-common.h b/arch/powerpc/include/asm/entry-common.h
> > index fc636c42e89a..b6373bae4524 100644
> > --- a/arch/powerpc/include/asm/entry-common.h
> > +++ b/arch/powerpc/include/asm/entry-common.h
> > @@ -286,14 +286,6 @@ static inline void arch_interrupt_async_enter_prepare(struct pt_regs *regs)
> >
> > static inline void arch_interrupt_async_exit_prepare(struct pt_regs *regs)
> > {
> > - /*
> > - * Adjust at exit so the main handler sees the true NIA. This must
> > - * come before irq_exit() because irq_exit can enable interrupts, and
> > - * if another interrupt is taken before nap_adjust_return has run
> > - * here, then that interrupt would return directly to idle nap return.
> > - */
> > - nap_adjust_return(regs);
> > -
> > arch_interrupt_exit_prepare(regs);
> > }
> >
> > diff --git a/arch/powerpc/include/asm/interrupt.h b/arch/powerpc/include/asm/interrupt.h
> > index fb42a664ae54..1b45a49e9bed 100644
> > --- a/arch/powerpc/include/asm/interrupt.h
> > +++ b/arch/powerpc/include/asm/interrupt.h
> > @@ -246,6 +246,7 @@ interrupt_handler void func(struct pt_regs *regs) \
> > instrumentation_begin(); \
> > irq_enter_rcu(); \
> > ____##func (regs); \
> > + nap_adjust_return(regs); \
> > irq_exit_rcu(); \
> > instrumentation_end(); \
> > arch_interrupt_async_exit_prepare(regs); \
>
> This allows the system to boot normally.
>
Thanks for testing this. I am assuming you tried this without
"powersave=off" command line option.
I'll send out a fix for this.
Regards,
Mukesh
> --
> Andreas Schwab, schwab@linux-m68k.org
> GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
> "And now for something completely different."
^ permalink raw reply
* Re: [PATCH RFC] RAS: hwerr_tracking: move recoverable hardware error tracking out of vmcoreinfo
From: Breno Leitao @ 2026-07-07 16:53 UTC (permalink / raw)
To: Borislav Petkov
Cc: Tony Luck, Thomas Gleixner, Ingo Molnar, Dave Hansen, x86,
H. Peter Anvin, Rafael J. Wysocki, Hanjun Guo,
Mauro Carvalho Chehab, Shuai Xue, Len Brown, Mahesh J Salgaonkar,
Oliver O'Halloran, Bjorn Helgaas, Breno Leitao, linux-kernel,
linux-edac, linux-acpi, linuxppc-dev, linux-pci, kernel-team
In-Reply-To: <20260707160247.GBak0jJwNxVHlvzijD@fat_crate.local>
On Tue, Jul 07, 2026 at 09:02:47AM -0700, Borislav Petkov wrote:
> On Tue, Jul 07, 2026 at 07:02:34AM -0700, Breno Leitao wrote:
> > Move the implementation to drivers/ras/hwerr_tracking.c and the
> > declaration (with its no-op stub) to <linux/ras.h>. Give it a dedicated
> > CONFIG_RAS_HWERR (bool, under RAS, default y) rather than riding
>
> Definitely not default y.
The current vmcoreinfo implementation defaults to enabled, so I wanted to
preserve that behavior to avoid silently removing symbols that existing
tools may depend on. Would you prefer a different default?
> Do not explain the WHAT - that's visible from the diff below; explain the WHY.
Will do.
> > Link: https://lore.kernel.org/all/aYvi4Y_HNqk_u1-v@fedora/ [1]
> > Signed-off-by: Breno Leitao <leitao@debian.org>
> > ---
> > Once we move it outside of vmcore info, I am planning to add new
> > features that are in the limbo now, given they don't belong to vmcore
> > info, such as:
> >
> > Track fatal hardware errors
> > https://lore.kernel.org/all/20260617-hwerr-v1-0-ff131cd6203c@debian.org/
> >
> > Expose hardware error recovery statistics via sysfs
> > https://lore.kernel.org/all/20260202-vmcoreinfo_sysfs-v2-0-8f3b5308b894@debian.org/
>
> We already have rasdaemon and a whole pile of infrastructure around reporting
> errors. Why isn't what we have, enough?
>
> The stick-the-error-into-vmcore makes sense as a use case, sure. But this
> other information we already have plenty. I think you should use/extend that
> instead of adding more.
I agree the sysfs exposure duplicates existing infrastructure, points
taken. However, tracking fatal hardware errors provides value at crash
analysis time—it lets us quickly determine whether a fatal hardware
error occurred during the kernel's lifetime, which is useful for
root-cause attribution.
> The stick-the-error-into-vmcore makes sense as a use case
For this, would you like to keep it in vmcore info (as of today), or
move to RAS subsystem?
Thanks for the review and direction,
--breno
^ permalink raw reply
* Re: [PATCH v5 0/8] Generic IRQ entry/exit support for powerpc
From: Andreas Schwab @ 2026-07-07 16:34 UTC (permalink / raw)
To: Mukesh Kumar Chaurasiya
Cc: Christophe Leroy (CS GROUP), maddy, mpe, npiggin, ryabinin.a.a,
glider, andreyknvl, dvyukov, vincenzo.frascino, oleg, kees, luto,
wad, mchauras, sshegde, thuth, ruanjinjie, akpm, macro, ldv,
charlie, deller, kevin.brodsky, ritesh.list, yeoreum.yun,
agordeev, segher, mark.rutland, ryan.roberts, pmladek, feng.tang,
peterz, linuxppc-dev, linux-kernel, kasan-dev
In-Reply-To: <akyWi0a69Az59X5Z@li-1a3e774c-28e4-11b2-a85c-acc9f2883e29.ibm.com>
On Jul 07 2026, Mukesh Kumar Chaurasiya wrote:
> diff --git a/arch/powerpc/include/asm/entry-common.h b/arch/powerpc/include/asm/entry-common.h
> index fc636c42e89a..b6373bae4524 100644
> --- a/arch/powerpc/include/asm/entry-common.h
> +++ b/arch/powerpc/include/asm/entry-common.h
> @@ -286,14 +286,6 @@ static inline void arch_interrupt_async_enter_prepare(struct pt_regs *regs)
>
> static inline void arch_interrupt_async_exit_prepare(struct pt_regs *regs)
> {
> - /*
> - * Adjust at exit so the main handler sees the true NIA. This must
> - * come before irq_exit() because irq_exit can enable interrupts, and
> - * if another interrupt is taken before nap_adjust_return has run
> - * here, then that interrupt would return directly to idle nap return.
> - */
> - nap_adjust_return(regs);
> -
> arch_interrupt_exit_prepare(regs);
> }
>
> diff --git a/arch/powerpc/include/asm/interrupt.h b/arch/powerpc/include/asm/interrupt.h
> index fb42a664ae54..1b45a49e9bed 100644
> --- a/arch/powerpc/include/asm/interrupt.h
> +++ b/arch/powerpc/include/asm/interrupt.h
> @@ -246,6 +246,7 @@ interrupt_handler void func(struct pt_regs *regs) \
> instrumentation_begin(); \
> irq_enter_rcu(); \
> ____##func (regs); \
> + nap_adjust_return(regs); \
> irq_exit_rcu(); \
> instrumentation_end(); \
> arch_interrupt_async_exit_prepare(regs); \
This allows the system to boot normally.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply
* Re: [PATCH v5 0/8] Generic IRQ entry/exit support for powerpc
From: Andreas Schwab @ 2026-07-07 16:08 UTC (permalink / raw)
To: Shrikanth Hegde
Cc: Christophe Leroy (CS GROUP), Mukesh Kumar Chaurasiya (IBM), maddy,
mpe, npiggin, ryabinin.a.a, glider, andreyknvl, dvyukov,
vincenzo.frascino, oleg, kees, luto, wad, mchauras, thuth,
ruanjinjie, akpm, macro, ldv, charlie, deller, kevin.brodsky,
ritesh.list, yeoreum.yun, agordeev, segher, mark.rutland,
ryan.roberts, pmladek, feng.tang, peterz, kan.liang, linuxppc-dev,
linux-kernel, kasan-dev
In-Reply-To: <18acdffe-a06b-4bfa-bbf6-e38274700b04@linux.ibm.com>
On Jul 07 2026, Shrikanth Hegde wrote:
> Can you try "powersave=off" commandline to disable idlestate and
> see if it boots?
Yes, that allows it to boot normally.
--
Andreas Schwab, schwab@linux-m68k.org
GPG Key fingerprint = 7578 EB47 D4E5 4D69 2510 2552 DF73 E780 A9DA AEC1
"And now for something completely different."
^ permalink raw reply
* Re: [PATCH v3 05/20] driver core: update kerneldoc for platform_device_alloc()
From: Andy Shevchenko @ 2026-07-07 16:05 UTC (permalink / raw)
To: Bartosz Golaszewski
Cc: Lee Jones, Mark Brown, Thierry Reding, Sebastian Hesselbarth,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Srinivas Kandagatla, Greg Kroah-Hartman, Vinod Koul,
Rafael J. Wysocki, Danilo Krummrich, Rob Herring, Saravana Kannan,
Madhavan Srinivasan, Michael Ellerman, Nicholas Piggin,
Christophe Leroy (CS GROUP), Andi Shyti, Joerg Roedel,
Will Deacon, Robin Murphy, Doug Berger, Florian Fainelli,
Broadcom internal kernel review list, Ulf Hansson, Frank Li,
Sascha Hauer, Pengutronix Kernel Team, Fabio Estevam,
Matthew Brost, Thomas Hellström, Rodrigo Vivi, David Airlie,
Simona Vetter, Peter Chen, Paul Cercueil, Bin Liu, Philipp Zabel,
Maximilian Luz, Hans de Goede, Ilpo Järvinen,
Krzysztof Kozlowski, Benjamin Herrenschmidt, brgl, linux-kernel,
netdev, linux-arm-msm, linux-sound, driver-core, devicetree,
linuxppc-dev, linux-i2c, iommu, linux-pm, imx, linux-arm-kernel,
intel-xe, dri-devel, linux-usb, linux-mips, platform-driver-x86,
mfd, Manuel Ebner
In-Reply-To: <20260706-pdev-fwnode-ref-v3-5-1ff028e33779@oss.qualcomm.com>
On Mon, Jul 06, 2026 at 02:44:17PM +0200, Bartosz Golaszewski wrote:
> Users of platform_device_alloc() + platform_device_add() must not modify
> certain fields of the dynamically created platform device object. Update
> the kernel doc to say which fields are affected and which functions to
> use.
Consider using __private checker attribute for them as well. It will make
sparse scream.
> Suggested-by: Manuel Ebner <manuelebner@mailbox.org>
> Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
--
With Best Regards,
Andy Shevchenko
^ permalink raw reply
* Re: [PATCH RFC] RAS: hwerr_tracking: move recoverable hardware error tracking out of vmcoreinfo
From: Borislav Petkov @ 2026-07-07 16:02 UTC (permalink / raw)
To: Breno Leitao
Cc: Tony Luck, Thomas Gleixner, Ingo Molnar, Dave Hansen, x86,
H. Peter Anvin, Rafael J. Wysocki, Hanjun Guo,
Mauro Carvalho Chehab, Shuai Xue, Len Brown, Mahesh J Salgaonkar,
Oliver O'Halloran, Bjorn Helgaas, Breno Leitao, linux-kernel,
linux-edac, linux-acpi, linuxppc-dev, linux-pci, kernel-team
In-Reply-To: <20260707-hwerr-ras-v1-1-4aea4a79d085@debian.org>
On Tue, Jul 07, 2026 at 07:02:34AM -0700, Breno Leitao wrote:
> The recoverable hardware error tracking (hwerr_log_error_type() and the
> hwerr_data[] counters) was added under vmcoreinfo, but it uses none of the
> vmcoreinfo note machinery: hwerr_data[] is a plain global array that crash
> tools read from the vmcore by symbol, like any other global. Functionally
> it is RAS code, fed only by the hardware error paths (x86 MCE, APEI GHES
> and PCIe AER).
>
> I wanted to expand it, and Baoquan suggested moving it away from vmcore
> info, which makes sense. [1]
>
> Move the implementation to drivers/ras/hwerr_tracking.c and the
> declaration (with its no-op stub) to <linux/ras.h>. Give it a dedicated
> CONFIG_RAS_HWERR (bool, under RAS, default y) rather than riding
Definitely not default y.
> CONFIG_VMCORE_INFO, so it is a first-class RAS feature that can be turned
> off on its own. The producers now reach hwerr_log_error_type() through
> <linux/ras.h>: x86 MCE and APEI GHES already include it, so drop their
> <linux/vmcore_info.h> include; PCIe AER switches its include from
> <linux/vmcore_info.h> to <linux/ras.h>.
>
> enum hwerr_error_type stays in <uapi/linux/vmcore.h> as it has been part
> of the UAPI since the feature shipped; <linux/ras.h> includes it from
> there.
>
> hwerr_data[] keeps its name and layout, so existing crash/drgn recipes
> keep working. The config gate moves from CONFIG_VMCORE_INFO to
> CONFIG_RAS_HWERR (default y).
Do not explain the WHAT - that's visible from the diff below; explain the WHY.
> Link: https://lore.kernel.org/all/aYvi4Y_HNqk_u1-v@fedora/ [1]
> Signed-off-by: Breno Leitao <leitao@debian.org>
> ---
> Once we move it outside of vmcore info, I am planning to add new
> features that are in the limbo now, given they don't belong to vmcore
> info, such as:
>
> Track fatal hardware errors
> https://lore.kernel.org/all/20260617-hwerr-v1-0-ff131cd6203c@debian.org/
>
> Expose hardware error recovery statistics via sysfs
> https://lore.kernel.org/all/20260202-vmcoreinfo_sysfs-v2-0-8f3b5308b894@debian.org/
We already have rasdaemon and a whole pile of infrastructure around reporting
errors. Why isn't what we have, enough?
The stick-the-error-into-vmcore makes sense as a use case, sure. But this
other information we already have plenty. I think you should use/extend that
instead of adding more.
Thx.
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
^ permalink raw reply
* Re: [PATCH v7 08/22] coco: arm64: s390: powerpc: Mark secure guests with CC_ATTR_GUEST_MEM_ENCRYPT
From: Suzuki K Poulose @ 2026-07-07 15:41 UTC (permalink / raw)
To: Aneesh Kumar K.V (Arm), iommu, linux-arm-kernel, linux-kernel,
linux-coco
Cc: Robin Murphy, Marek Szyprowski, Will Deacon, Marc Zyngier,
Steven Price, Catalin Marinas, Jiri Pirko, Jason Gunthorpe,
Mostafa Saleh, Petr Tesarik, Alexey Kardashevskiy, Dan Williams,
Xu Yilun, linuxppc-dev, linux-s390, Madhavan Srinivasan,
Michael Ellerman, Nicholas Piggin, Christophe Leroy (CS GROUP),
Alexander Gordeev, Gerald Schaefer, Heiko Carstens, Vasily Gorbik,
Christian Borntraeger, Sven Schnelle, x86
In-Reply-To: <20260701054926.825925-9-aneesh.kumar@kernel.org>
On 01/07/2026 06:49, Aneesh Kumar K.V (Arm) wrote:
> arm64 Realms, powerpc secure guests and s390 protected virtualization
> guests currently report CC_ATTR_MEM_ENCRYPT, but not
> CC_ATTR_GUEST_MEM_ENCRYPT.
>
> These environments are all secure guest configurations. Their
> force_dma_unencrypted() implementations also treat the same secure guest
> state as requiring unencrypted DMA. Report CC_ATTR_GUEST_MEM_ENCRYPT for
> the same condition so generic confidential-computing code can distinguish
> guest memory encryption from host memory encryption instead of relying only
> on CC_ATTR_MEM_ENCRYPT.
>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
For arm64 bits:
> ---
> arch/arm64/kernel/rsi.c | 1 +
> arch/powerpc/platforms/pseries/cc_platform.c | 1 +
> arch/s390/mm/init.c | 1 +
> 3 files changed, 3 insertions(+)
>
> diff --git a/arch/arm64/kernel/rsi.c b/arch/arm64/kernel/rsi.c
> index 92160f2e57ff..207e36db1e7a 100644
> --- a/arch/arm64/kernel/rsi.c
> +++ b/arch/arm64/kernel/rsi.c
> @@ -27,6 +27,7 @@ bool cc_platform_has(enum cc_attr attr)
> {
> switch (attr) {
> case CC_ATTR_MEM_ENCRYPT:
> + case CC_ATTR_GUEST_MEM_ENCRYPT:
> return is_realm_world();
> default:
> return false;
Reviewed-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Suzuki
^ permalink raw reply
* Re: [PATCH v8] mm: pgtable: free kernel page tables via RCU to fix ptdump UAF
From: Lorenzo Stoakes @ 2026-07-07 15:18 UTC (permalink / raw)
To: David Carlier
Cc: Andrew Morton, Dev Jain, David Hildenbrand, Liam R . Howlett,
Vlastimil Babka, Mike Rapoport, Suren Baghdasaryan, Michal Hocko,
Paul Walmsley, Palmer Dabbelt, Albert Ou, Alexandre Ghiti,
Dave Hansen, Lu Baolu, Madhavan Srinivasan, Michael Ellerman,
Nicholas Piggin, Christophe Leroy, Ritesh Harjani,
syzbot+fd95a72470f5a44e464c, linux-mm, linux-kernel, linux-riscv,
linuxppc-dev
In-Reply-To: <20260706203128.162335-1-devnexen@gmail.com>
Hi David C,
This has been through a lot of revisions so I think for the sake of expediency
the best solution here is for me to grab this and fiddle with it a bit then post
it out myself.
TO BE VERY CLEAR - I will keep your authorship and attribution :), and simply
stick my name on a Co-developed-by tag.
So this will remain your patch.
Cheers, Lorenzo
On Mon, Jul 06, 2026 at 09:31:27PM +0100, David Carlier wrote:
> ptdump_walk_pgd() walks the kernel page tables under get_online_mems().
> That does not stop vmalloc from freeing a kernel PTE page underneath the
> walk.
>
> When vmap_try_huge_pmd() promotes a range to a huge PMD it collapses the
> existing PTE table and frees it via pmd_free_pte_page(). On x86, riscv and
> powerpc this runs without the init_mm mmap lock; only arm64 takes it, and
> not on the block-split path. So ptdump can dereference a just-freed PTE
> page, which is the use after free syzbot hit in ptdump_pte_entry().
>
> The race is not new. ptdump walks the whole kernel address space, including
> ranges other code is actively mapping, so it reads page tables it does not
> own. Commit 5ba2f0a15564 ("mm: introduce deferred freeing for kernel page
> tables") only widened the window; the Fixes tag points there for that
> reason.
>
> Every other walker works on a range it owns and is the only one mutating
> it: set_memory() on arm64/riscv/loongarch, the arm64 block-split path, the
> openrisc DMA path and the hugetlb_vmemmap remap. Nothing frees those ranges
> concurrently, so they cannot race and do not need RCU. ptdump is the only
> walker that traverses ranges it does not own.
>
> Defer the free by an RCU grace period. pagetable_free_kernel() now frees
> via call_rcu() in both the async and non-async configs. The async path
> still flushes the TLB first, then queues the per-page RCU free. The page
> stays valid until any walk that may have observed it drops its RCU read
> lock.
>
> x86, arm64 and riscv reach pagetable_free_kernel() for the collapsed PTE
> page (the ptdesc carries PT_kernel), so the deferral covers them. powerpc
> uses its own fragment allocator: pte_free_kernel() there frees the page
> synchronously via pte_fragment_free() and the ptdesc is not flagged kernel,
> so defer the kernel case in pte_fragment_free() as well. arm64 also takes
> init_mm.mmap_lock around the free under a static key; that is now redundant
> with the RCU deferral but left in place.
>
> On the read side walk_page_range_debug() walks the init_mm range in bounded
> chunks, taking rcu_read_lock() around each chunk and calling cond_resched()
> between them. It uses the lockless walker as the mmap lock is no longer
> held, and pgd_addr_end() to bound each chunk without overflowing at the top
> of the address space. A walker either sees the cleared PMD and skips, or
> keeps the page alive until it drops the lock. The owned-range walkers are
> unchanged.
>
> Stop taking mmap_write_lock() in ptdump_walk_pgd() for init_mm. It never
> guarded against this free -- most architectures free the collapsed PTE
> table without it -- and RCU now provides the synchronisation. efi_mm and
> current->mm page tables are not RCU-freed, so they keep the mmap write
> lock.
>
> ptdump callbacks run under RCU within a chunk, so they must not sleep. The
> arch note_page() and effective_prot() callbacks only format into the
> preallocated seq_file buffer; the only GFP_KERNEL marker setup runs before
> the walk, and cond_resched() happens between chunks, outside the read lock.
>
> Fixes: 5ba2f0a15564 ("mm: introduce deferred freeing for kernel page tables")
> Reported-by: syzbot+fd95a72470f5a44e464c@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a287988.39669fcc.33b062.00a0.GAE@google.com/T/
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: David Carlier <devnexen@gmail.com>
> ---
> v8: fix four issues raised by the Gemini review of v7 (relayed by Andrew).
> - the init_mm walk called walk_kernel_page_table_range(), which
> asserts init_mm.mmap_lock -- but that lock is now dropped; use the
> lockless walker instead.
> - only stop taking mmap_write_lock() for init_mm; efi_mm and
> current->mm are not RCU-freed and keep it.
> - bound each chunk with pgd_addr_end() so the last chunk does not
> overflow at the top of the address space.
> - powerpc frees kernel PTE pages synchronously via pte_fragment_free()
> and never sets PT_kernel, so it bypassed the RCU deferral; defer the
> kernel case there too.
> v7: no code change; add version tag and per-revision changelog (Dev).
> v6: chunk the init_mm walk in walk_page_range_debug() and take
> rcu_read_lock() per chunk (reverting v5's caller-side lock + assert)
> so the read section stays bounded on large kernel address spaces and
> can cond_resched() between chunks; drop the now-redundant
> mmap_write_lock() in ptdump_walk_pgd().
> v5: reframe changelog around the pre-existing race and range ownership;
> correct the mmap-lock description (arm64 is the exception, not x86);
> move rcu_read_lock() into ptdump_walk_pgd() and assert it in
> walk_page_range_debug(); drop walk_kernel_page_table_range_rcu(); fix
> the pgtable-generic.c comment; document the no-sleep audit of the
> callbacks.
> v4: defer the free in both the async and non-async configs, not just the
> async one; add a walk_kernel_page_table_range_rcu() helper.
> v3: take rcu_read_lock() in the init_mm branch of walk_page_range_debug().
> v2: use call_rcu() instead of synchronize_rcu().
> arch/powerpc/mm/pgtable-frag.c | 7 ++++++-
> include/linux/mm.h | 7 -------
> mm/pagewalk.c | 36 +++++++++++++++++++++++++++++-----
> mm/pgtable-generic.c | 22 ++++++++++++++++++++-
> mm/ptdump.c | 11 +++++++++--
> 5 files changed, 67 insertions(+), 16 deletions(-)
>
> diff --git a/arch/powerpc/mm/pgtable-frag.c b/arch/powerpc/mm/pgtable-frag.c
> index ae742564a3d5..1e1e88f831f7 100644
> --- a/arch/powerpc/mm/pgtable-frag.c
> +++ b/arch/powerpc/mm/pgtable-frag.c
> @@ -123,7 +123,12 @@ void pte_fragment_free(unsigned long *table, int kernel)
>
> BUG_ON(atomic_read(&ptdesc->pt_frag_refcount) <= 0);
> if (atomic_dec_and_test(&ptdesc->pt_frag_refcount)) {
> - if (kernel || !folio_test_clear_active(ptdesc_folio(ptdesc)))
> + /*
> + * Kernel page tables may be walked locklessly under RCU by
> + * ptdump, so defer their free by a grace period too, like the
> + * lockless-GUP case below for user tables.
> + */
> + if (!kernel && !folio_test_clear_active(ptdesc_folio(ptdesc)))
> pte_free_now(&ptdesc->pt_rcu_head);
> else
> call_rcu(&ptdesc->pt_rcu_head, pte_free_now);
> diff --git a/include/linux/mm.h b/include/linux/mm.h
> index 485df9c2dbdd..79408a17a1b0 100644
> --- a/include/linux/mm.h
> +++ b/include/linux/mm.h
> @@ -3695,14 +3695,7 @@ static inline void __pagetable_free(struct ptdesc *pt)
> __free_pages(page, compound_order(page));
> }
>
> -#ifdef CONFIG_ASYNC_KERNEL_PGTABLE_FREE
> void pagetable_free_kernel(struct ptdesc *pt);
> -#else
> -static inline void pagetable_free_kernel(struct ptdesc *pt)
> -{
> - __pagetable_free(pt);
> -}
> -#endif
> /**
> * pagetable_free - Free pagetables
> * @pt: The page table descriptor
> diff --git a/mm/pagewalk.c b/mm/pagewalk.c
> index 3ae2586ff45b..fc2fe014ac8c 100644
> --- a/mm/pagewalk.c
> +++ b/mm/pagewalk.c
> @@ -620,7 +620,7 @@ int walk_page_range(struct mm_struct *mm, unsigned long start,
> * Note: Be careful to walk the kernel pages tables, the caller may be need to
> * take other effective approaches (mmap lock may be insufficient) to prevent
> * the intermediate kernel page tables belonging to the specified address range
> - * from being freed (e.g. memory hot-remove).
> + * from being freed (e.g. memory hot-remove, vmap huge page promotion).
> */
> int walk_kernel_page_table_range(unsigned long start, unsigned long end,
> const struct mm_walk_ops *ops, pgd_t *pgd, void *private)
> @@ -643,7 +643,7 @@ int walk_kernel_page_table_range(unsigned long start, unsigned long end,
> * Use this function to walk the kernel page tables locklessly. It should be
> * guaranteed that the caller has exclusive access over the range they are
> * operating on - that there should be no concurrent access, for example,
> - * changing permissions for vmalloc objects.
> + * changing permissions for vmalloc objects, or vmap huge page promotion.
> */
> int walk_kernel_page_table_range_lockless(unsigned long start, unsigned long end,
> const struct mm_walk_ops *ops, pgd_t *pgd, void *private)
> @@ -692,9 +692,35 @@ int walk_page_range_debug(struct mm_struct *mm, unsigned long start,
> };
>
> /* For convenience, we allow traversal of kernel mappings. */
> - if (mm == &init_mm)
> - return walk_kernel_page_table_range(start, end, ops,
> - pgd, private);
> + if (mm == &init_mm) {
> + unsigned long addr = start;
> +
> + /*
> + * Walk in bounded chunks so the RCU read lock is never held
> + * across the whole kernel address space. A kernel page table
> + * freed via pagetable_free_kernel() stays valid until the walk
> + * that may have observed it drops the lock; releasing the lock
> + * between chunks is safe as no page table pointer is held
> + * across the gap. The mmap lock is not held, so use the
> + * lockless walker; RCU, not the lock, keeps the table alive.
> + */
> + while (addr < end) {
> + unsigned long next = pgd_addr_end(addr, end);
> + int err;
> +
> + rcu_read_lock();
> + err = walk_kernel_page_table_range_lockless(addr, next, ops,
> + pgd, private);
> + rcu_read_unlock();
> + if (err)
> + return err;
> +
> + addr = next;
> + cond_resched();
> + }
> + return 0;
> + }
> +
> if (start >= end || !walk.mm)
> return -EINVAL;
> if (!check_ops_safe(ops))
> diff --git a/mm/pgtable-generic.c b/mm/pgtable-generic.c
> index b91b1a98029c..7a32e4821957 100644
> --- a/mm/pgtable-generic.c
> +++ b/mm/pgtable-generic.c
> @@ -410,6 +410,13 @@ pte_t *pte_offset_map_lock(struct mm_struct *mm, pmd_t *pmd,
> goto again;
> }
>
> +static void kernel_pgtable_free_rcu(struct rcu_head *head)
> +{
> + struct ptdesc *pt = container_of(head, struct ptdesc, pt_rcu_head);
> +
> + __pagetable_free(pt);
> +}
> +
> #ifdef CONFIG_ASYNC_KERNEL_PGTABLE_FREE
> static void kernel_pgtable_work_func(struct work_struct *work);
>
> @@ -434,8 +441,15 @@ static void kernel_pgtable_work_func(struct work_struct *work)
> spin_unlock(&kernel_pgtable_work.lock);
>
> iommu_sva_invalidate_kva_range(PAGE_OFFSET, TLB_FLUSH_ALL);
> +
> + /*
> + * Debug walkers (ptdump) may walk ranges they do not own and race this
> + * free, so they walk under rcu_read_lock(). Free after a grace period:
> + * a walker either already saw the cleared PMD, or keeps the page alive
> + * until it drops the RCU lock.
> + */
> list_for_each_entry_safe(pt, next, &page_list, pt_list)
> - __pagetable_free(pt);
> + call_rcu(&pt->pt_rcu_head, kernel_pgtable_free_rcu);
> }
>
> void pagetable_free_kernel(struct ptdesc *pt)
> @@ -446,4 +460,10 @@ void pagetable_free_kernel(struct ptdesc *pt)
>
> schedule_work(&kernel_pgtable_work.work);
> }
> +#else
> +void pagetable_free_kernel(struct ptdesc *pt)
> +{
> + /* Defer the free by a grace period; see kernel_pgtable_work_func(). */
> + call_rcu(&pt->pt_rcu_head, kernel_pgtable_free_rcu);
> +}
> #endif
> diff --git a/mm/ptdump.c b/mm/ptdump.c
> index 973020000096..537be9995e1a 100644
> --- a/mm/ptdump.c
> +++ b/mm/ptdump.c
> @@ -177,13 +177,20 @@ void ptdump_walk_pgd(struct ptdump_state *st, struct mm_struct *mm, pgd_t *pgd)
> const struct ptdump_range *range = st->range;
>
> get_online_mems();
> - mmap_write_lock(mm);
> + /*
> + * init_mm is walked locklessly under RCU by walk_page_range_debug().
> + * efi_mm / current->mm page tables are not RCU-freed, so hold the
> + * mmap write lock to keep them stable against concurrent teardown.
> + */
> + if (mm != &init_mm)
> + mmap_write_lock(mm);
> while (range->start != range->end) {
> walk_page_range_debug(mm, range->start, range->end,
> &ptdump_ops, pgd, st);
> range++;
> }
> - mmap_write_unlock(mm);
> + if (mm != &init_mm)
> + mmap_write_unlock(mm);
> put_online_mems();
>
> /* Flush out the last page */
> --
> 2.53.0
>
^ permalink raw reply
* Re: [PATCH 31/42] ASoC: cix-ipbloq: Use devm_of_reserved_mem_device_init()
From: Gary Yang @ 2026-07-07 1:34 UTC (permalink / raw)
To: Mukesh Ojha
Cc: Bjorn Andersson, Konrad Dybcio, Liviu Dudau, Maarten Lankhorst,
Maxime Ripard, Thomas Zimmermann, David Airlie, Simona Vetter,
Joel Stanley, Andrew Jeffery, Paul Cercueil, Anitha Chrisanthus,
Paul Kocialkowski, Linus Walleij, Chen-Yu Tsai, Jernej Skrabec,
Samuel Holland, Alexey Brodkin, Laurent Pinchart, Tomi Valkeinen,
Michal Simek, Daniel Scally, Jacopo Mondi, Mauro Carvalho Chehab,
Eddie James, Tiffany Lin, Andrew-CT Chen, Yunfei Dong,
Minghsiu Tsai, Houlong Wei, Matthias Brugger,
AngeloGioacchino Del Regno, Joseph Liu, Marvin Lin,
Dmitry Osipenko, Krzysztof Kozlowski, Thierry Reding,
Jonathan Hunter, Srinivas Kandagatla, Arnd Bergmann,
Greg Kroah-Hartman, Ge Gordon, Adrian Hunter, Ulf Hansson,
Rob Herring, Saravana Kannan, Mathieu Poirier, Jaroslav Kysela,
Takashi Iwai, Shengjiu Wang, Xiubo Li, Liam Girdwood, Mark Brown,
Frank Li, Sascha Hauer, Peter Ujfalusi, Bard Liao, Daniel Baluta,
Orson Zhai, Baolin Wang, Peter Chen, Fugang Duan, Ekansh Gupta,
BST Linux Kernel Upstream Group, Fabio Estevam, Nicolin Chen,
Pengutronix Kernel Team, Kai Vehmanen, Pierre-Louis Bossart,
Vijendar Mukunda, Chunyan Zhang, CIX Linux Kernel Upstream Group,
linux-arm-msm, linux-kernel, dri-devel, linux-aspeed,
linux-arm-kernel, linux-mips, linux-sunxi, linux-media, openbmc,
linux-mediatek, kernel, linux-tegra, linux-mmc, devicetree,
linux-remoteproc, linux-staging, linux-sound, linuxppc-dev, imx,
sound-open-firmware
In-Reply-To: <20260703193855.110619-32-mukesh.ojha@oss.qualcomm.com>
On 2026-07-04 01:08, Mukesh Ojha wrote:
> [Some people who received this message don't often get email from mukesh.ojha@oss.qualcomm.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> EXTERNAL EMAIL
>
> Use the devres-managed devm_of_reserved_mem_device_init() to ensure
> the reserved memory region is released on device removal, fixing a
> missing cleanup in the original code.
>
> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> ---
> sound/hda/controllers/cix-ipbloq.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/sound/hda/controllers/cix-ipbloq.c b/sound/hda/controllers/cix-ipbloq.c
> index c1084a915c13..815932e5c58b 100644
> --- a/sound/hda/controllers/cix-ipbloq.c
> +++ b/sound/hda/controllers/cix-ipbloq.c
> @@ -257,7 +257,7 @@ static int cix_ipbloq_hda_probe(struct platform_device *pdev)
>
> dma_set_mask_and_coherent(hda->dev, DMA_BIT_MASK(32));
>
> - err = of_reserved_mem_device_init(hda->dev);
> + err = devm_of_reserved_mem_device_init(hda->dev);
> if (err < 0 && err != -ENODEV) {
> dev_err(hda->dev,
> "failed to init reserved mem for DMA, err = %d\n", err);
Reviewed-by: Gary Yang <gary.yang@cixtech.com>
> --
> 2.53.0
>
^ permalink raw reply
* [PATCH 2/2] powerpc: Move CONFIG_QE_GPIO to SoC
From: Christophe Leroy (CS GROUP) @ 2026-07-07 15:00 UTC (permalink / raw)
To: Qiang Zhao, Madhavan Srinivasan, Christophe Leroy (CS GROUP)
Cc: linux-kernel, linuxppc-dev, linux-arm-kernel, Paul Louvel
In-Reply-To: <b08f76c1d8ff864774246f1e2c2158c223c001be.1783435914.git.chleroy@kernel.org>
Commit 7aa1aa6ecec2 ("QE: Move QE from arch/powerpc to drivers/soc")
moved QE into drivers/soc including gpio.c but left CONFIG_QE_GPIO
in powerpc's Kconfig.
Move it to SoC as well as it is the only place it is used:
drivers/soc/fsl/qe/Makefile:obj-$(CONFIG_QE_GPIO) += gpio.o qe_ports_ic.o
include/soc/fsl/qe/qe.h:#ifdef CONFIG_QE_GPIO
include/soc/fsl/qe/qe.h:#endif /* CONFIG_QE_GPIO */
Link: https://lore.kernel.org/r/16a187116511f5c844c43a12d09f263e77f4fd60.1780936729.git.chleroy@kernel.org
Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org>
---
arch/powerpc/platforms/Kconfig | 8 --------
drivers/soc/fsl/qe/Kconfig | 8 ++++++++
2 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/arch/powerpc/platforms/Kconfig b/arch/powerpc/platforms/Kconfig
index c4e61843d9d99..2f797ac6f1b3f 100644
--- a/arch/powerpc/platforms/Kconfig
+++ b/arch/powerpc/platforms/Kconfig
@@ -228,14 +228,6 @@ config TAU_AVERAGE
If in doubt, say N here.
-config QE_GPIO
- bool "QE GPIO support"
- depends on QUICC_ENGINE
- select GPIOLIB
- help
- Say Y here if you're going to use hardware that connects to the
- QE GPIOs.
-
config CPM2
bool "Enable support for the CPM2 (Communications Processor Module)"
depends on (FSL_SOC_BOOKE && PPC32) || PPC_82xx
diff --git a/drivers/soc/fsl/qe/Kconfig b/drivers/soc/fsl/qe/Kconfig
index eb03f42ab9781..b35a8fd30ebfb 100644
--- a/drivers/soc/fsl/qe/Kconfig
+++ b/drivers/soc/fsl/qe/Kconfig
@@ -67,3 +67,11 @@ config QE_USB
default y if USB_FSL_QE
help
QE USB Controller support
+
+config QE_GPIO
+ bool "QE GPIO support"
+ depends on QUICC_ENGINE
+ select GPIOLIB
+ help
+ Say Y here if you're going to use hardware that connects to the
+ QE GPIOs.
--
2.54.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox