laptop-kernel/arch/x86, branch master

x86/split_lock: turn off by default

2026-10-19T15:59:16Z

I don't want the log spam. Signed-off-by: Jason A. Donenfeld

Merge tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-10-18T17:48:22Z

Pull x86/core update from Ingo Molnar: - Emit the FineIBT paranoid "cs" prefix as a byte, to work around a GNU toolchain build warning (Kees Cook) * tag 'x86-core-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kcfi: Emit the FineIBT paranoid "cs" prefix as a byte

Merge tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-10-18T17:38:37Z

Pull x86 fix from Ingo Molnar: - Fix kCFI decoding bug on CONFIG_FINEIBT=y kernels running in kCFI mode (Kees Cook) * tag 'x86-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/kcfi: Decode the kCFI check from the trap address

Merge tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2026-10-18T17:20:03Z

Pull perf events fixes from Ingo Molnar: - Fix x86 Intel uncore driver bug on Diamond Rapids CPUs that erroneously always-cleared the invert bit (Guixiong Wei) - Fix accounting bug in the perf mlock 'gift' code causing unrelated RLIMIT_MEMLOCK functionality to fail (Lorenzo Stoakes) - Fix perf_pmu_migrate_context() bug leaving events behind during CPU hot-unplug (Haris Okanovic) - Update cgroup time when rotating multiplexed events, to fix time_running & scaled counts accounting bug (Antoine Huret) * tag 'perf-urgent-2026-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: perf: Update cgroup time when rotating multiplexed events perf: Fix perf_pmu_migrate_context() leaving events behind perf: Track the perf mlock gift separately perf/x86/intel/uncore: Fix DMR CXL CM invert filter

x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()

2026-10-17T16:36:20Z

Commit 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") made for_each_insn_prefix() declare its own loop counter named idx. get_seg_reg_override_idx() keeps its result in a local of the same name, so the assignments in the loop body now write the loop counter: - the function always returns INAT_SEG_REG_DEFAULT, so FS and GS overrides are ignored; - a CS override sets the counter to INAT_SEG_REG_CS (2), the increment makes it 3, and prefixes.bytes[3] holds the last prefix, 0x2e again, so the loop never terminates. The UMIP emulation reaches this from the #GP handler for user space: an SGDT, SIDT or SMSW with a memory operand and a CS prefix leaves the task spinning in the kernel, never returning to user space, with a SIGKILL that is never delivered. Any user can thus tie up CPUs until reboot. With an FS or GS prefix, the emulated result is written to the wrong address. Rename the internal macro iterator variable. [ Lukas' original patch renamed the use site, I changed it to rename the iterator in the macro instead, but left Lukas' commit message and authorship - Linus ] Fixes: 45e1dccc0653 ("x86/insn: Simplify for_each_insn_prefix()") Signed-off-by: Lukas Zobernig Acked-by: Peter Zijlstra Acked-by: Borislav Petkov Signed-off-by: Linus Torvalds

perf/x86/intel/uncore: Fix DMR CXL CM invert filter

2026-10-16T07:49:00Z

The DMR CXL CM PMU places its invert filter at config bit 21 and its 9-bit threshold at bits 23-31. However, dmr_uncore_cxlcm uses GENERIC_PMON_RAW_EVENT_MASK, which covers the threshold through the generic bit 23 invert field and bits 24-31 threshold field, but does not include the relocated invert bit. As a result, uncore_pmu_event_init() silently clears bit 21 and inv=1 programs the same configuration as inv=0. Add bit 21 to a DMR CXL CM-specific event mask so the requested invert filter reaches hardware. Fixes: 6daf2c35b835 ("perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids") Signed-off-by: Guixiong Wei Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Zide Chen Link: https://patch.msgid.link/20261008051953.6293-2-weiguixiong@bytedance.com

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

2026-10-15T15:12:47Z

Pull kvm fixes from Paolo Bonzini: "Even more x86 fixes: - Avoid a false positive panic in the #PF handler, if the kernel triggers a page fault within the asynchronous page fault handler before the flags are reset. This can happen for example because of a perf NMI. - Always reset a vCPU's MMU pointer back to the root MMU when loading nested guest state fails during RSM or KVM_SET_NESTED_STATE. Otherwise KVM tries to run a non-nested guest with a nested MMU, which can result in a NULL pointer dereference attempting to get the nested MMU's pgd (EPTP or nested CR3)" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

Merge tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux

2026-10-15T15:06:26Z

Pull Hyper-V fixes from Wei Liu: - Typo and comment fixes (Hemanth Selam, Jiangshan Yi) - Update maintainers list (Wei Liu, Long Li) - Two Hyper-V PCI driver fixes (Naman Jain, Sahil Chandna) - Small fixes for core Hyper-V code (Hardik Garg, Michael Kelley, Waiman Long) * tag 'hyperv-fixes-signed-20261015' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux: MAINTAINERS: drop KY from Hyper-V maintainers list PCI: hv: Warn when wait_for_response() waits indefinitely PCI: hv: Probe vPCI buses asynchronously MAINTAINERS: remove myself from the Hyper-V entries mshv_vtl: Check per-CPU register page before mmap tools/hv: fix typo "retrive" in comment Drivers: hv: vmbus: fix typo "substract" in comment Drivers: hv: Don't reset VMBus connection state on error/exit paths x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index() x86/hyperv: Fix stale comments after stimer message mode removal Drivers: hv: Avoid infinite retry loop in init_vp_index()

KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry

2026-10-14T14:42:40Z

Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling KVM_SET_NESTED_STATE. Failure to unwind the MMU pointer results in KVM trying to run L1 with a nested MMU, and is especially problematic if the vCPU manages to free its nested state before the VM crashes. Constructing the root for a nested EPT MMU goes through vmcs12, which is dynamically allocated/freed when nVMX is enabled/disabled. And so if the nested state is freed with the MMU still pointing at the nested MMU, KVM will hit a NULL pointer deref when attempting to get L1=>L2 EPTP. BUG: kernel NULL pointer dereference, address: 0000000000000078 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 114a2d067 P4D 111743067 PUD 11141f067 PMD 0 Oops: Oops: 0000 [#1] SMP CPU: 20 UID: 1000 PID: 1272 Comm: nested_tdp_faul Not tainted 7.3.0-rc4-8c89f11d1a99b-sink-vm #1914 PREEMPTLAZY Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Call Trace: kvm_mmu_load+0xcd/0x870 [kvm] kvm_arch_vcpu_ioctl_run+0x18f5/0x1f80 [kvm] kvm_vcpu_ioctl+0x2c7/0x970 [kvm] __x64_sys_ioctl+0x90/0xd0 do_syscall_64+0x9c/0x4d0 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x47491b Modules linked in: kvm_intel kvm irqbypass CR2: 0000000000000078 ---[ end trace 0000000000000000 ]--- RIP: 0010:nested_ept_get_eptp+0xb/0x10 [kvm_intel] Cc: David Woodhouse Fixes: 72e9cbdb4338 ("KVM: nVMX: fix SMI injection in guest mode") Fixes: 8fcc4b5923af ("kvm: nVMX: Introduce KVM_CAP_NESTED_STATE") Cc: stable@vger.kernel.org Signed-off-by: Amirmohammad Eftekhar [sean: write changelog] Signed-off-by: Sean Christopherson Link: https://patch.msgid.link/20261001214356.3825100-2-seanjc@google.com Signed-off-by: Paolo Bonzini

x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

2026-10-14T14:10:15Z

An async #PF "page not present" event arrives through the #PF vector, and its reason sits in the per-CPU apf_reason.flags until __kvm_handle_async_pf() reads and clears it. If an NMI arrives after the event is injected and before the #PF handler reads the flags, and the NMI handler itself takes a #PF, that fault reads and clears the flags belonging to the #PF it interrupted. It then finds interrupts disabled in the NMI context it interrupted, and panics: Kernel panic - not syncing: Host injected async #PF in interrupt disabled region Call Trace: panic+0x52/0x60 __kvm_handle_async_pf+0xb0/0xb0 exc_page_fault+0x71/0xb0 asm_exc_page_fault+0x27/0x30 RIP: 0010:__get_user_nocheck_8+0x6/0x20 perf_callchain_user+0x147/0x1a0 get_perf_callchain+0x12d/0x1c0 ... perf_event_nmi_handler+0x26/0x50 exc_nmi+0xe8/0x110 RIP: 0010:asm_exc_page_fault+0x0/0x30 The last RIP line shows the NMI landing on the first instruction of the #PF entry. perf with user call chains takes such a fault: the sampling NMI walks the user stack with __get_user(), which faults when a saved frame pointer is not a valid user address or the walk runs off the top of the stack. The same window exists when KVM, running as an L1 hypervisor with DELIVERY_AS_PF_VMEXIT, reads the flags itself after a #PF VM-exit. The NMI entry code saves and restores CR2 for this nesting, but not the async #PF reason. Andy Lutomirski described the race, with perf as the example, when async #PF delivery was reworked in 2020 [1]. Saving and clearing the flags across the NMI, next to CR2, was discussed there but not merged. Since that rework, Linux has stopped setting KVM_ASYNC_PF_SEND_ALWAYS, so the host delivers "page not present" only for user mode faults and a kernel-mode fault in NMI context (including kernel-mode #MC and #DB) cannot be an async page fault. In that case, return without touching the flags so that the interrupted handler finds them intact. Tested on v7.3-rc5 in a 4-vCPU, 2 GiB guest restored from a snapshot whose memory is served on demand through userfaultfd, so that reading it back takes async #PFs, while every thread samples hardware cycles with user call chains and points its frame pointer at an unmapped page. Without this patch the guest panicked as above in 3 of 3 runs. With it, the guest survived 3 of 3 runs of 60 seconds, and the host counted 148,441 to 153,334 kvm_async_pf_not_present events in the first 20 seconds of each. On 6.18.50 the results were the same: the guest panicked without the patch and survived with it. Link: https://lore.kernel.org/all/ed71d0967113a35f670a9625a058b8e6e0b2f104.1583547991.git.luto@kernel.org/ [1] Link: https://lore.kernel.org/all/20211126123145.2772-1-jiangshanlai@gmail.com/ [2] Cc: stable@vger.kernel.org # v5.9+ Signed-off-by: EJ Campbell Link: https://patch.msgid.link/CADkxfh-uQTca_6jB1JPDq1MsKffF_UKGQR339oQSJNcoV75GNQ@mail.gmail.com Signed-off-by: Paolo Bonzini