WireGuard for the Linux kernel https://git.zx2c4.com/wireguard-linux/atom/arch/arm64/mm?h=stable 2026-09-03T12:58:12Z 2026-09-03T12:58:12Z Karl Mehltretter kmehltretter@gmail.com 2026-08-28T17:41:31Z urn:sha1:a77644d009dece1104b6fcc6e322b0e4503db0d6 show_pte() walks page tables locklessly and can run with interrupts enabled. A concurrent teardown can free a table page while it is being walked. It can also clear a parent entry after show_pte() checked it; the regular pXd_offset() helpers then reread the cleared entry and can derive a bogus lower-level pointer and fault again. Use the lockless offset helpers with the saved parent entries, as gup_fast() does, and pass the saved PMD to pte_offset_map(). For task page tables, arm64 selects MMU_GATHER_RCU_TABLE_FREE. Disable local interrupts around the walk to hold off RCU-deferred table frees and block the tlb_remove_table_sync_one() IPI until the walk is finished. Place the IRQ guard after the header print. This does not make the output a consistent snapshot, but prevents the task page-table walk from dereferencing a released table page or deriving a pointer from a different parent value. Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Will Deacon <will@kernel.org> 2026-08-28T16:02:04Z Linus Torvalds torvalds@linux-foundation.org 2026-08-28T16:02:04Z urn:sha1:9d607ae0f7d629dc068aed5f498e24d3e9875ef1 Pull arm64 fixes from Will Deacon: "A mixture of ptdump, compat and MTE fixes that came in during the merge window: - Fix address handling of final memory region in ptdump - Fix emulation of decrementing load/store multiple from 32-bit task - Fix SCTLR context-switching for store-only MTE mode - Fix numerous issues in MTE selftests" * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: selftests/arm64: Add MTE test config fragment selftests/arm64: Fix MTE prctl TAP plan selftests/arm64: Treat KSM merge_across_nodes as optional selftests/arm64: Print missing MTE TAP headers arm64: compat: Fix decrementing LDM/STM alignment emulation arm64: process: Fix context switching MTE store-only tag check KVM: arm64: ptdump: Flush the last region arm64: ptdump: Make note_page_flush() range aware 2026-08-24T18:35:46Z Linus Torvalds torvalds@linux-foundation.org 2026-08-24T18:35:46Z urn:sha1:2f43193b88188b184a967c9427602e019f1b8708 Pull dma-mapping updates from Marek Szyprowski: - swiotlb: - new configuration option for the default pool size (Jagadeesh Pagadala) - reduce overhead for high watermark tracking (chenhuguanshen) - minor code cleanups and improvements (Vova Sharaienko, Honglei Huang and Marek Szyprowski) - add proper tracking of the shared DMA state through direct, pool and swiotlb paths (Aneesh Kumar K.V) This is important for confidential-computing * tag 'dma-mapping-7.3-2026-08-24' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: dma/swiotlb: decouple high watermark tracking from CONFIG_DEBUG_FS MAINTAINERS: update tree for DMA MAPPING HELPERS dma/swiotlb: introduce Kconfig option for compile-time default pool size dma-direct: Improve readability of the dma_direct_map_sg() for P2PDMA case iommu/dma: simplify dma_iova_destroy() and drop the free_iova helper dma-coherent: use KiB in DMA allocation logs dma-coherent: fix spacing coding style issue * tag 'dma-mapping-7.3-2026-08-24-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (23 commits) swiotlb: remove unused SWIOTLB_FORCE flag dma: swiotlb: handle set_memory_decrypted() failures dma: swiotlb: free dynamic pools from process context dma-direct: rename ret to cpu_addr in alloc helpers dma-direct: select DMA address encoding from __DMA_ATTR_ALLOC_CC_SHARED dma-direct: set decrypted flag for remapped DMA allocations dma-direct: make dma_direct_map_phys() honor DMA_ATTR_CC_SHARED dma-direct: Move dma_direct_map_phys() to dma/direct.c dma-direct: pass attrs to dma_capable() for DMA_ATTR_CC_SHARED checks dma-mapping: make dma_pgprot() honor __DMA_ATTR_ALLOC_CC_SHARED dma: swiotlb: track pool encryption state and honor DMA_ATTR_CC_SHARED dma: swiotlb: pass mapping attributes by reference dma-pool: track decrypted atomic pools and select them via attrs dma-direct: use __DMA_ATTR_ALLOC_CC_SHARED in alloc/free paths dma-mapping: Add internal shared allocation attribute coco: arm64: s390: powerpc: Mark secure guests with CC_ATTR_GUEST_MEM_ENCRYPT dma-direct: swiotlb: handle swiotlb alloc/free outside __dma_direct_alloc_pages s390: Expose protected virtualization through cc_platform_has() swiotlb: Preserve allocation virtual address for dynamic pools dma: free atomic pool pages by physical address ... 2026-08-24T13:31:19Z Wei-Lin Chang weilin.chang@arm.com 2026-08-14T22:24:57Z urn:sha1:902caade3cfd60f99bf71b355e7c86344bd831e5 note_page_flush() calls note_page() with addr == 0 and level == -1 to dump the last row of a ptdump. addr == 0 (1 << 64 wrapped around) renders a huge region with enormous size for address spaces with IA bits < 64. For example the stage-2 page tables and the EFI runtime page table. More importantly, the last region of the address space and everything after the address space up to 1 << 64 are merged into one row of output. If the last region within the address space is valid, it will appear to remain valid up to 1 << 64 with the same attributes. Currently only the EFI runtime ptdump is affected by this, but KVM will soon fix its stage-2 ptdump by using note_page_flush(). Here is an example of an EFI runtime ptdump (last row): 0x0000008000000000-0x0000000000000000 17179868672G PGD With this patch: 0x0000008000000000-0x0001000000000000 261632G PGD To fix this, cache the end address of a ptdump in ptdump_pg_state so note_page_flush() can call the final note_page() with the correct end address. Fixes: 9d80448ac92b ("efi/arm64: Add debugfs node to dump UEFI runtime page tables") Signed-off-by: Wei-Lin Chang <weilin.chang@arm.com> Reviewed-by: Marc Zyngier <maz@kernel.org> Signed-off-by: Will Deacon <will@kernel.org> 2026-08-18T18:57:17Z Linus Torvalds torvalds@linux-foundation.org 2026-08-18T18:57:17Z urn:sha1:85cdaca6970028bf6f544c355c90035586836ddf Pull arm64 updates from Will Deacon: "There's a reasonable amount of stuff here, including a bunch of updates to the perf PMU drivers and some MPAM updates to expose the memory bandwidth counters via resctrl. On the architecture side, some highlights include support for BBML3 and steps towards support for an architectural NMI solution, all wrapped up in a web of fixes for latent issues identified by Sashiko. ACPI: - Combine reads of AMU counters into a single FFH feedback counter op Confidential computing: - Fix smp_processor_id() in preemptible context when retrieving an attestation token inside a realm - Convert pKVM over to a "CC platform" - Clean-up our SWIOTLB configuration in preparation for reworking the handling of encrypted/decryped DMA buffers in the dma-mapping tree CPU errata handling: - Work around broken device memory ordering on NVIDIA Olympus cores - Fix broken 'nospectre_bhb' command-line option - Select the idle loop backend instruction on the command-line CPU features: - Replace our BBML2-noabort feature with the new architectural BBML3 feature - Disable in-kernel BTI for recent versions of Clang due to issues with livepatch that are still being investigated - Clean-up documentation describing which ID register fields are exposed to userspace Interrupts: - Preliminary work towards supporting FEAT_NMI, which cleans up our IRQ entry code and fixes some latent issues with pseudo-NMI - Support for an SDEI backend to trigger an NMI backtrace Memory management: - Treat all devices as coherent when CLIDR_EL1.LoC == 0 - Fix no-map handling of sub-page-sized regions - Second attempt at unmapping the linear aliases of the kernel data and bss sections - Fix EFI runtime calls when software-PAN is enabled Miscellaneous: - Add Mark Rutland as a reviewer! - Tidy-up our futex cmpxchg logic when using the new LSUI instructions - Drop the requirement on DYNAMIC_FTRACE_WITH_CALL_OPS when selecting HAVE_DYNAMIC_FTRACE_WITH_DIRECT_CALLS - Fix a false-positive KCSCAN splat in the delay loop - Use a portable typedef for 128-bit scalar types in our UAPI headers - Non-critical fixes for Sashiko reports all over MPAM: - Hook MPAM memory bandwidth counters into resctrl's counter assignment interface - Fix a quirk in the MPAM bandwidth counting on Nvidia T241 so that it also applies to 63 bit counters Perf: - Workarounds for hardware issues in the CMN-S3 PMU (Graviton 5) and CPU PMU (NVIDIA Olympus again!) - Add support for the DDR PMU on Marvell CN20K SoCs - Add support for Picoheart implementations of the DCW PCIe PMU - Add support for Channel/Rank/Bank filtering in the CXL PMU driver - Add support for 64-bit counters in the CSPMU device - Add support for revision 2 of the CMN S3 PMU Ptrace: - Fix a decade-old bug in our handling of seccomp and tracing on syscall entry - Fix regset handling for inactive SVE and SSVE registers Selftests - Add some tests for the decade-old bug that we just tried to fix in our syscall entry path - Fix SVE test crash on SME-only CPUs" * tag 'arm64-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux: (95 commits) arm64/efi: Avoid voluntary preemption with efi_mm installed arm64: bti: Disable in-kernel BTI with recent versions of Clang arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit irqchip/gic-v3: make the unmasking of pseudo-NMIs explicit when handling IRQs arm64: Disable KCSAN instrumentation in delay.o arm_mpam: Disable driver unbind to avoid UAF arm_mpam: Fix a NULL pointer dereference on unbinding after an error interrupt perf: arm_pmuv3: Zero initialize hw_id branch stack field arm64: mm: Unmap kernel data/bss entirely from the linear map iommu/arm-smmu-v3-sva: Use system_supports_bbml3() to detect CPU feature perf/arm-cmn: Support CMN S3 r2 perf/arm-cmn: Plumb in new filter types perf/arm-cmn: Refactor event filter data perf/arm-cmn: Refactor event filter programming perf/arm-cmn: Rename filter variables for clarity arm64: mm: fix accidental linear mapping of no-map reserved memory tools: Ensure tools copy of linux/filter.h exports the UAPI kselftest/arm64: Fix abi test compilation errors arch: arm64: add early_param idle=<wfi|yield|nop> arm64: entry: mask DAIF before returning from C EL1 handlers ... 2026-08-18T17:28:28Z Linus Torvalds torvalds@linux-foundation.org 2026-08-18T17:28:28Z urn:sha1:ba24659b1dbee90d4ce7ffc7577e299f085533a1 Pull kexec updates from Mike Rapoport: - Deduplicate crash memory allocation and the exclusion of reserved crash kernel regions from architecture specific code into a generic crash_prepare_headers() and enable crashkernel CMA reservation on arm64 and riscv reservation on arm64 and riscv. - Skip purgatory checksum verification when the kexec segments cannot be corrupted by DMA, which saves about 250ms on kexec. - Replace __ASSEMBLY__ with the compiler provided __ASSEMBLER__ in include/linux/kexec.h. - Fix a keyring refcount imbalance in the kdump kernel's dm-crypt key restore path, which over-dropped the user keyring reference when more than one key was restored. * tag 'kexec-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/liveupdate/linux: crash_dump: release keyring reference at the correct time kexec: Replace __ASSEMBLY__ with __ASSEMBLER__ in header file kexec_file: skip checksum verification when safe riscv: kexec_file: Add support for crashkernel CMA reservation arm64: kexec_file: Add support for crashkernel CMA reservation powerpc/kexec_file: Use crash_exclude_core_ranges() helper LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify code riscv: kexec_file: Use crash_prepare_headers() helper to simplify code x86/crash: Use crash_prepare_headers() helper to simplify code arm64: kexec_file: Use crash_prepare_headers() helper to simplify code crash: Add crash_prepare_headers() to exclude crash kernel memory powerpc/crash: sort crash memory ranges before preparing elfcorehdr riscv: kexec_file: Fix crashk_low_res not exclude bug 2026-08-18T17:03:54Z Linus Torvalds torvalds@linux-foundation.org 2026-08-18T17:03:54Z urn:sha1:38fda1d9d2f5df55bd1c095aec07de3699091316 Pull memblock updates from Mike Rapoport: "Non-urgent fixes: - Fix calculation of node_spanned_pages when running with 'kernelcore=mirror' - Properly handle failure to allocate per_cpu_nodestats in free_area_init_core_hotplug() - Fix deferred initialization of the memory map for configurations where node's RAM end is not aligned on PAGES_PER_SECTION Cleanups: - Remove redundant pageblock_align() call in free_unused_memmap() - Remove unnecessary invalid range checks in users of memblock iterators. Some users of for_each_mem_range() and for_each_mem_pfn_range() verify that start < end for each range. This is redundant because memblock iterators guarantee to never return an invalid range - Stop overlapping zones with 'kernelcore=mirror' and align behaviour of 'kernelcore=mirror' with other variants of kernelcore and movablecore - Remove redundant updates of numa_nodes_parsed mask in the callers of numa_add_memblk(), the latter always updates the mask anyway - Remove unnecessary initialization of pgdat->per_cpu_nodestats to NULL, the variable is reset to the actual value a few lines below" * tag 'memblock-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: (25 commits) mm/mm_init: deferred_grow_zone(): fix out-of-range first_deferred_pfn mm/mm_init: remove unnecessary initialization of pgdat->per_cpu_nodestats mm/mm_init: remove redundant memset in free_area_init() mm: numa_memblks: use numa_add_reserved_memblk() in numa_cleanup_meminfo() arch_numa: remove redundant node_possible_map assignment mm: numa_memblks: remove redundant numa_nodemask_from_meminfo() LoongArch: remove redundant numa_nodes_parsed node_set() arch_numa: remove redundant numa_nodes_parsed node_set() x86/numa: remove redundant numa_nodes_parsed node_set() of/numa: remove redundant numa_nodes_parsed node_set() ACPI: NUMA: remove redundant numa_nodes_parsed node_set() mm: numa_memblks: set numa_nodes_parsed in numa_add_memblk() mm/mm_init: handle alloc_percpu failure in free_area_init_core_hotplug mm/mm_init: drop overlap_memmap_init() mm/mm_init: don't overlap NORMAL and MOVABLE zones with kernelcore=mirror mm/hugetlb: remove unnecessary empty range check in hugetlb_bootmem_set_nodes() mm: remove unnecessary empty range check in early_calculate_totalpages() powerpc64/kasan: Remove unreachable invalid range check in kasan_init_phys_region() ARM: remove unreachable invalid range check in kasan_init() riscv: remove unreachable invalid range check in kasan_init() ... 2026-08-14T10:16:10Z Will Deacon will@kernel.org 2026-08-14T10:16:10Z urn:sha1:221349eab618776df753d5402e7b156d85d28ea7 * for-next/nmi: arm64: entry: Avoid unnecessary local_irq_disable() on kernel exit irqchip/gic-v3: make the unmasking of pseudo-NMIs explicit when handling IRQs arm64: entry: mask DAIF before returning from C EL1 handlers arm64: suspend: Initialize PMR on resume arm64: suspend: rely on daif helpers to handle PMR arm64: hibernate: Restore DAIF state on error arm64: hibernate: mask DAIF before restoring hibernated kernel arm64: debug: don't mask DAIF for mdscr_write() arm64: ptrace: Remove INIT_PSTATE_EL2 2026-08-14T10:16:09Z Will Deacon will@kernel.org 2026-08-14T10:16:09Z urn:sha1:1a6b708e895f6f8d443745adb306099a75416a36 * for-next/mm: arm64/efi: Avoid voluntary preemption with efi_mm installed arm64: mm: Unmap kernel data/bss entirely from the linear map arm64: mm: fix accidental linear mapping of no-map reserved memory arm64: pgtable: convert pte_present() from macro to static inline arm64: mm: Treat all devices as dma-coherent when CLIDR_EL1.LoC == 0 2026-08-14T10:16:07Z Will Deacon will@kernel.org 2026-08-14T10:16:07Z urn:sha1:dc61684f5c7c809e47a1b2a2d7c2148d1cb22fff * for-next/cpufeature: arm64: bti: Disable in-kernel BTI with recent versions of Clang iommu/arm-smmu-v3-sva: Use system_supports_bbml3() to detect CPU feature arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBM arm64: cpufeature: Rename BBML2_NOABORT as BBML3 arm64: sysreg: Add BBM_3 arm64: cpufeature: Extend bbml2_noabort support list arm64: cputype: Add C1-Nano definitions arm64: cputype: Add Cortex-A520AE definitions arm64: cpucaps: Remove stale comment about keeping capabilities sorted arm64: fix cpu-feature-registers Malformed table arm64: Remove hidden bitfields from cpu-feature-registers.rst arm64: Sort registers in cpu-feature-registers.rst arm64: Document missing bitfields in cpu-feature-registers.rst arm64: Don't number registers in cpu-feature-registers.rst