Changes in Kconfig

25a01b5155d207e72bdd31b138406f37788403cb - Merge tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux

Tue, 16 Jun 2026 01:38:13 +0200

Merge tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linuxPull s390 updates from Alexander Gordeev: - Use CIO device online variable instead of the internal FSM state to determine device availability during purge operations - Remove extra check of task_stack_page() because try_get_task_stack() already takes care of that when reading /proc//wchan - Allow user-space to use the new SCLP action qualifier 4 for to provide NVMe SMART log data to the platform. - Send AP CHANGE uevents on successful bind and successful association to notify user-space about SE operations on AP queue devices - Add an s390dbf kernel parameter to configure debug log levels and area sizes during early boot - On arm64 the empty zero page is going to be mapped read-only. Do the same for s390 with an explicit set_memory_ro() call - Improve s390-specific bcr_serialize() and cpu_relax() implementations - Remove all unused variables to avoid allmodconfig W=1 build fails with latest clang-23 - Cleanup default Kconfig values for s390 selftests - Add a s390-tod trace clock to allow comparing trace timestamps between different systems or virtual machines on s390 - Remove the s390 implementation of strlcat() in favor of the generic variant - Make consistent the calling order between page_table_check_pte_clear() and secure page conversion across all code paths - Rearrange some fields within AP and zcrypt structs to reduce memory consumption and unused holes - Shorten GR_NUM and VX_NUM macros and move them to a separate header - Replace __get_free_page() with kmalloc() in few sources - Introduce an infrastructure for more efficient this_cpu operations. Eliminate conditional branches when PREEMPT_NONE is removed - Enable Rust support - Use z10 as minimum architecture level, similar to the boot code, to enforce a defined architecture level set - Improve and convert various mem*() helper functions to C. For that add .noinstr.text section to avoid orphaned warnings from the linker - Fix the function pointer type in __ret_from_fork() to correct the indirect call to match kernel thread return type of int - Revert support for DCACHE_WORD_ACCESS to avoid an endless exception loop on read from donated Ultravisor pages at unaligned addresses* tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux: (52 commits) s390: Revert support for DCACHE_WORD_ACCESS s390/process: Fix kernel thread function pointer type s390/tishift: Convert __ashlti3(), __ashrti3(), __lshrti3() to C s390/memmove: Optimize backward copy case s390/string: Convert memset(16|32|64)() to C s390/string: Convert memcpy() to C s390/string: Convert memset() to C s390/string: Convert memmove() to C s390/string: Add -ffreestanding compile option to string.o s390: Add .noinstr.text to boot and purgatory linker scripts s390/purgatory: Enforce z10 minimum architecture level s390: Enable Rust support s390/cmpxchg: Fix KASAN stack-out-of-bounds in atomic helpers rust: helpers: Add memchr wrapper for string operations rust/bindgen_parameters: Mark s390 types as opaque to prevent repr conflicts s390/jump_label: Implement ARCH_STATIC_BRANCH_JUMP_ASM and ARCH_STATIC_BRANCH_ASM macros s390/bug: Provide ARCH_WARN_ASM for Rust WARN/BUG support s390/ap: Fix locking issue in SE bind and associate sysfs functions s390/percpu: Provide arch_this_cpu_write() implementation s390/percpu: Provide arch_this_cpu_read() implementation ... List of files: /linux/arch/s390/Kconfig

186d3c4e92242351afc24d9784f31cb4cd08a4b7 - Merge tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Mon, 15 Jun 2026 10:27:13 +0200

Merge tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tipPull vdso updates from Thomas Gleixner: - Remove the redundant CONFIG_GENERIC_TIME_VSYSCALL after converting the remaining users over. - Rework and sanitize the MIPS VDSO handling, so it does not handle the time related VDSO if there is no VDSO capable clocksource available. Also stop mapping VDSO data pages unconditionally even if there is no usage possible.* tag 'timers-vdso-2026-06-13' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: MIPS: VDSO: Fold MIPS_CLOCK_VSYSCALL into MIPS_GENERIC_GETTIMEOFDAY MIPS: VDSO: Gate microMIPS restriction on GCC version MIPS: VDSO: Fold MIPS_DISABLE_VDSO into MIPS_GENERIC_GETTIMEOFDAY clocksource/drivers/mips-gic-timer: Only use VDSO_CLOCKMODE_GIC when it is a available MIPS: csrc-r4k: Only use VDSO_CLOCKMODE_R4K when it is a available MIPS: VDSO: Only map the data pages when the vDSO is used MIPS: Introduce Kconfig MIPS_GENERIC_GETTIMEOFDAY vdso/datastore: Always provide symbol declarations MAINTAINERS: Add include/linux/vdso_datastore.h to vDSO block vdso/gettimeofday: Rename __arch_get_vdso_u_timens_data() vdso/treewide: Drop GENERIC_TIME_VSYSCALL vdso/vsyscall: Gate update_vsyscall() behind CONFIG_GENERIC_GETTIMEOFDAY riscv: vdso: Drop CONFIG_GENERIC_TIME_VSYSCALL guard around syscall fallbacks List of files: /linux/arch/s390/Kconfig

37540b8c287fc817bdbd0c62bb75ad6eab0e5d03 - s390: Revert support for DCACHE_WORD_ACCESS

Thu, 11 Jun 2026 17:37:46 +0200

s390: Revert support for DCACHE_WORD_ACCESSload_unaligned_zeropad() reads eight bytes from unaligned addresses and maycross page boundaries. It handles exceptions which may happen if readingfrom the second page results in an exception.For pages which are donated to the Ultravisor for secure execution purposesthe do_secure_storage_access() exception handler however does not handlesuch exceptions correctly. Such an exception may result in an endlessexception loop which will never be resolved.An attempt to fix this [1] turned out to be not sufficient. For now revertload_unaligned_zeropad() until this problem has been resolved in a properway.Note that the implementation of load_unaligned_zeropad() itself iscorrect. The revert is just a temporary workaround until there is completefix for secure storage access exceptions.[1] commit b00be77302d7 ("s390/mm: Add missing secure storage access fixups for donated memory")Fixes: 802ba53eefc5 ("s390: add support for DCACHE_WORD_ACCESS")Cc: stable@vger.kernel.orgAcked-by: Christian Borntraeger Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

982c89c9b9eed1f512038a163d5cab6b0b8117ff - Merge branch 'rust-for-s390' into features

Wed, 10 Jun 2026 16:52:38 +0200

Merge branch 'rust-for-s390' into featuresJan Polensky says:===================Rust support on s390 requires a small set of architecture-specific piecesbefore the generic Rust kernel infrastructure can be used.The series wires up s390 as a Rust-capable 64-bit architecture, adds themissing assembly interfaces needed by Rust for WARN/BUG reporting and forstatic branches, adjusts bindgen parameters to avoid repr layout conflictscaused by packed and aligned s390 structures, and fixes issues discoveredduring testing.s390 currently requires rustc with support for -Zpacked-stack, and theminimum tool version gating is adjusted accordingly.Link: https://github.com/Rust-for-Linux/linux/issues/2Tested against: rustc 1.96.0 (ac68faa20 2026-05-25)===================Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

3f70ebe638581e73c8df6b3fa7eed9b45d90b083 - s390: Enable Rust support

Mon, 01 Jun 2026 19:46:25 +0200

s390: Enable Rust supportEnable building Rust code on s390 by wiring the architecture into thekernel Rust infrastructure.Add s390 to the Rust arch support documentation, provide the s390 Rusttarget and required compiler flags, and set the bindgen target forarch/s390. Adjust the Rust target generation and minimum rustc versiongating so the s390 setup is handled explicitly.The Rust toolchain uses the "s390x" triple naming for the 64 bit target.Rust support is currently incompatible with CONFIG_EXPOLINE, whichrelies on compiler support for the -mindirect-branch= and-mfunction_return= options. Therefore, select HAVE_RUST only whenEXPOLINE is disabled.Acked-by: Miguel Ojeda Acked-by: Gary Guo Acked-by: Heiko Carstens Signed-off-by: Jan Polensky Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

1f57f68c4dd101e5e8ffc9ffa6428f45bcdd776a - s390: Remove GENERIC_LOCKBREAK Kconfig option

Fri, 05 Jun 2026 17:32:06 +0200

s390: Remove GENERIC_LOCKBREAK Kconfig options390 selects GENERIC_LOCKBREAK if PREEMPT is enabled. Reason is a historic18 years old commit [1] which fixed a compile error for PREEMPT enabledkernels. Back than only PREEMPT_NONE and PREEMPT_VOLUNTARY kernels wereconsidered to be important for s390. PREEMPT should "just work".However, since recently PREEMPT is always enabled [2], which also causesGENERIC_LOCKBREAK to be always enabled. For some workloads this leads tomassive performance degradation; e.g. a simple kernel compile on machineswith many CPUs may take up to four times longer.To fix this just remove the GENERIC_LOCKBREAK from s390's Kconfig, sincethe compile error from 18 years ago does not exist anymore.[1] commit b6b40c532a36 ("[S390] Define GENERIC_LOCKBREAK.")[2] commit 7dadeaa6e851 ("sched: Further restrict the preemption modes")Cc: stable@vger.kernel.orgReported-by: Massimiliano Pellizzer Reviewed-by: Sven Schnelle Signed-off-by: Heiko Carstens Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

96942092d5e67c71af246fa3bc1422cdf80a5dc9 - vdso/treewide: Drop GENERIC_TIME_VSYSCALL

Tue, 19 May 2026 08:26:17 +0200

vdso/treewide: Drop GENERIC_TIME_VSYSCALLThis Kconfig symbol is not used anymore, remove it.Signed-off-by: Thomas Weißschuh Signed-off-by: Thomas Gleixner Link: https://patch.msgid.link/20260519-vdso-generic_time_vsyscal-v1-3-5c2a5905d5f5@linutronix.de List of files: /linux/arch/s390/Kconfig

30cc5e2ad826a6d2308acdec3b462c1a6497b7b7 - s390/Kconfig: Cleanup defaults for selftests

Tue, 12 May 2026 19:43:36 +0200

s390/Kconfig: Cleanup defaults for selftestsRemove unconditional 'n' defaults from def_tristate statements,as they override the later 'KUNIT_ALL_TESTS' default, renderingit dead Kconfig code.This dead code was identified by kconfirm, a static analysis toolfor Kconfig.Also include S390_KPROBES_SANITY_TEST in KUNIT_ALL_TESTS.Signed-off-by: Julian Braha Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

a2cec6863709d6673a025acc066c962b85a75842 - s390/debug: Add s390dbf kernel parameter

Wed, 06 May 2026 16:53:27 +0200

s390/debug: Add s390dbf kernel parameterProblem determination using s390dbf logging sometimes requires changingthe default logging level or log area size. While this is possibleusing sysfs interfaces, there is no easy way to adjust these parametersfor early boot code that emits logs before userspace is available.Add an s390dbf kernel parameter to address this shortcoming. Theparameter can be used to specify log level and area size (in units ofpages). A level of '-' turns logging off for an area. Logs can beidentified by name or a shell-style pattern.Parameter format: s390dbf=:[|-]:[][,...]Example: s390dbf=cio*:6:128,sclp_err::2Specified parameters are applied immediately during debug arearegistration for regular log areas. For early, static debug areas,log levels are changed during early_param() parsing, while sizechanges are applied at arch_initcall-time.Signed-off-by: Peter Oberparleiter Tested-by: Vineeth Vijayan Reviewed-by: Heiko Carstens Signed-off-by: Alexander Gordeev List of files: /linux/arch/s390/Kconfig

2a4c0c11c0193889446cdb6f1540cc2b9aff97dd - Merge tag 's390-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Wed, 22 Apr 2026 20:13:45 +0200

Merge tag 's390-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linuxPull s390 updates from Vasily Gorbik: - Add support for CONFIG_PAGE_TABLE_CHECK and enable it in debug_defconfig. s390 can only tell user from kernel PTEs via the mm, so mm_struct is now passed into pxx_user_accessible_page() callbacks - Expose the PCI function UID as an arch-specific slot attribute in sysfs so a function can be identified by its user-defined id while still in standby. Introduces a generic ARCH_PCI_SLOT_GROUPS hook in drivers/pci/slot.c - Refresh s390 PCI documentation to reflect current behavior and cover previously undocumented sysfs attributes - zcrypt device driver cleanup series: consistent field types, clearer variable naming, a kernel-doc warning fix, and a comment explaining the intentional synchronize_rcu() in pkey_handler_register() - Provide an s390 arch_raw_cpu_ptr() that avoids the detour via get_lowcore() using alternatives, shrinking defconfig by ~27 kB - Guard identity-base randomization with kaslr_enabled() so nokaslr keeps the identity mapping at 0 even with RANDOMIZE_IDENTITY_BASE=y - Build S390_MODULES_SANITY_TEST as a module only by requiring KUNIT && m, since built-in would not exercise module loading - Remove the permanently commented-out HMCDRV_DEV_CLASS create_class() code in the hmcdrv driver - Drop stale ident_map_size extern conflicting with asm/page.h* tag 's390-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: Fix warning about wrong kernel doc comment PCI: s390: Expose the UID as an arch specific PCI slot attribute docs: s390/pci: Improve and update PCI documentation s390/pkey: Add comment about synchronize_rcu() to pkey base s390/hmcdrv: Remove commented out code s390/zcrypt: Slight rework on the agent_id field s390/zcrypt: Explicitly use a card variable in _zcrypt_send_cprb s390/zcrypt: Rework MKVP fields and handling s390/zcrypt: Make apfs a real unsigned int field s390/zcrypt: Rework domain processing within zcrypt device driver s390/zcrypt: Move inline function rng_type6cprb_msgx from header to code s390/percpu: Provide arch_raw_cpu_ptr() s390: Enable page table check for debug_defconfig s390/pgtable: Add s390 support for page table check s390/pgtable: Use set_pmd_bit() to invalidate PMD entry mm/page_table_check: Pass mm_struct to pxx_user_accessible_page() s390/boot: Respect kaslr_enabled() for identity randomization s390/Kconfig: Make modules sanity test a module-only option s390/setup: Drop stale ident_map_size declaration List of files: /linux/arch/s390/Kconfig

9cdca336677b4d15579ec462e33c8a330ab3a9de - Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Sat, 18 Apr 2026 00:42:01 +0200

Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrityPull integrity updates from Mimi Zohar: "There are two main changes, one feature removal, some code cleanup, and a number of bug fixes. Main changes: - Detecting secure boot mode was limited to IMA. Make detecting secure boot mode accessible to EVM and other LSMs - IMA sigv3 support was limited to fsverity. Add IMA sigv3 support for IMA regular file hashes and EVM portable signatures Remove: - Remove IMA support for asychronous hash calculation originally added for hardware acceleration Cleanup: - Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG tests - Add descriptions of the IMA atomic flags Bug fixes: - Like IMA, properly limit EVM "fix" mode - Define and call evm_fix_hmac() to update security.evm - Fallback to using i_version to detect file change for filesystems that do not support STATX_CHANGE_COOKIE - Address missing kernel support for configured (new) TPM hash algorithms - Add missing crypto_shash_final() return value"* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity: evm: Enforce signatures version 3 with new EVM policy 'bit 3' integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG ima: add support to require IMA sigv3 signatures ima: add regular file data hash signature version 3 support ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures ima: remove buggy support for asynchronous hashes integrity: Eliminate weak definition of arch_get_secureboot() ima: Add code comments to explain IMA iint cache atomic_flags ima_fs: Correctly create securityfs files for unsupported hash algos ima: check return value of crypto_shash_final() in boot aggregate ima: Define and use a digest_size field in the ima_algo_desc structure powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG ima: fallback to using i_version to detect file change evm: fix security.evm for a file with IMA signature s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT evm: Don't enable fix mode when secure boot is enabled integrity: Make arch_ima_get_secureboot integrity-wide List of files: /linux/arch/s390/Kconfig

078f80f909ba9fa3060e89dc634ff4b1defc43d3 - mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE

Thu, 19 Mar 2026 09:19:40 +0100

mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVEPatch series "mm: remove CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE and cleanupCONFIG_MIGRATION".While working on memory hotplug code cleanups, I realized thatCONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE is not really required anymore.Changing that revealed some rather nasty looking CONFIG_MIGRATIONhandling.Let's clean that up by introducing a dedicated CONFIG_NUMA_MIGRATIONoption and reducing the dependencies that CONFIG_MIGRATION has.This patch (of 2):All architectures that select CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE alsoselect CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG. So we can just removeCONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE.For CONFIG_MIGRATION, make it depend on CONFIG_MEMORY_HOTREMOVE instead,and make CONFIG_MEMORY_HOTREMOVE select CONFIG_MIGRATION (just likeCONFIG_CMA and CONFIG_COMPACTION already do).We'll clean up CONFIG_MIGRATION next.Link: https://lkml.kernel.org/r/20260319-config_migration-v1-0-42270124966f@kernel.orgLink: https://lkml.kernel.org/r/20260319-config_migration-v1-1-42270124966f@kernel.orgSigned-off-by: David Hildenbrand (Arm) Acked-by: Zi Yan Reviewed-by: Lorenzo Stoakes (Oracle) Reviewed-by: Joshua Hahn Reviewed-by: Gregory Price Reviewed-by: Mike Rapoport (Microsoft) Reviewed-by: Jonathan Cameron Cc: Albert Ou Cc: Alexander Gordeev Cc: Alexandre Ghiti Cc: Alistair Popple Cc: "Borislav Petkov (AMD)" Cc: Byungchul Park Cc: Catalin Marinas Cc: Christian Borntraeger Cc: Heiko Carstens Cc: "H. Peter Anvin" Cc: Huacai Chen Cc: "Huang, Ying" Cc: Ingo Molnar Cc: Liam Howlett Cc: Madhavan Srinivasan Cc: Matthew Brost Cc: Michael Ellerman Cc: Michal Hocko Cc: Nicholas Piggin Cc: Palmer Dabbelt Cc: Rakie Kim Cc: Sebastian Andrzej Siewior Cc: Steven Rostedt Cc: Suren Baghdasaryan Cc: Sven Schnelle Cc: Vasily Gorbik Cc: WANG Xuerui Cc: Will Deacon Signed-off-by: Andrew Morton List of files: /linux/arch/s390/Kconfig

7caedbb5ade345df0eec0bf01035c780919a9f56 - integrity: Eliminate weak definition of arch_get_secureboot()

Mon, 09 Mar 2026 21:37:02 +0100

integrity: Eliminate weak definition of arch_get_secureboot()security/integrity/secure_boot.c contains a single __weak function,which breaks recordmcount when building with clang: $ make -skj"$(nproc)" ARCH=powerpc LLVM=1 ppc64_defconfig security/integrity/secure_boot.o Cannot find symbol for section 2: .text. security/integrity/secure_boot.o: failedIntroduce a Kconfig symbol, CONFIG_HAVE_ARCH_GET_SECUREBOOT, to indicatethat an architecture provides a definition of arch_get_secureboot().Provide a static inline stub when this symbol is not defined to achievethe same effect as the __weak function, allowing secure_boot.c to beremoved altogether. Move the s390 definition of arch_get_secureboot()out of the CONFIG_KEXEC_FILE block to ensure it is always available, asit does not actually depend on KEXEC_FILE.Reported-by: Arnd Bergmann Fixes: 31a6a07eefeb ("integrity: Make arch_ima_get_secureboot integrity-wide")Signed-off-by: Nathan Chancellor Acked-by: Arnd Bergmann Signed-off-by: Mimi Zohar List of files: /linux/arch/s390/Kconfig

7bbf70131f937ee5871e22d159ed2fc66795722f - Merge branch 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into features

Fri, 13 Mar 2026 00:13:51 +0100

Merge branch 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux into featuresAdd s390 support for CONFIG_PAGE_TABLE_CHECK.* 'page-table-check-support' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390: Enable page table check for debug_defconfig s390/pgtable: Add s390 support for page table check s390/pgtable: Use set_pmd_bit() to invalidate PMD entry mm/page_table_check: Pass mm_struct to pxx_user_accessible_page()Signed-off-by: Vasily Gorbik List of files: /linux/arch/s390/Kconfig

7b4dde5e40ad68d68a6b3bdc9621cb4cdce54e43 - s390/pgtable: Add s390 support for page table check

Fri, 06 Mar 2026 17:16:32 +0100

s390/pgtable: Add s390 support for page table checkAdd page table check hooks into routines that modify user pagetables.Unlike other architectures s390 does not have means to distinguishbetween kernel and user page table entries. Rely on the fact thepage table check infrastructure itself operates on non-init_mmmemory spaces only.Use the provided mm_struct to verify that the memory space is notinit_mm (aka not the kernel memory space) indeed. That check issupposed to be succeeded already (on some code paths even twice).If the passed memory space by contrast is init_mm that would be anunexpected semantical change in generic code, so do VM_BUG_ON() insuch case.Unset _SEGMENT_ENTRY_READ bit to indicate that pmdp_invalidate()was applied against a huge PMD and is going to be updated byset_pmd_at() shortly. The hook pmd_user_accessible_page() shouldskip such entries until that, otherwise the page table accountingfalls apart and BUG_ON() gets hit as result.The invalidated huge PMD entry should not be confused with a PROT_NONEentry as reported by pmd_protnone(), though the entry characteristicsexactly match: _SEGMENT_ENTRY_LARGE is set while _SEGMENT_ENTRY_READ isunset. Since pmd_protnone() implementation depends on NUMA_BALANCINGconfiguration option, it should not be used in pmd_user_accessible_page()check, which is expected to be CONFIG_NUMA_BALANCING-agnostic.Nevertheless, an invalidated huge PMD is technically still pmd_protnone()entry and it should not break other code paths once _SEGMENT_ENTRY_READis unset. As of now, all pmd_protnone() checks are done under page tablelocks or exercise GUP-fast and HMM code paths, which are expected to besafe against concurrent page table updates.Alternative approach would be using the last remaining unused PMD entrybit 0x800 to indicate that pmdp_invalidate() was called on a PMD. Thatwould allow avoiding collisions with pmd_protnone() handling code paths,but saving the bit is more preferable way to go.Reviewed-by: Gerald Schaefer Signed-off-by: Tobias Huschle Co-developed-by: Alexander Gordeev Signed-off-by: Alexander Gordeev Link: https://lore.kernel.org/r/4db8a681205bd555298d62441cdcfca43317a35a.1772812343.git.agordeev@linux.ibm.comSigned-off-by: Vasily Gorbik List of files: /linux/arch/s390/Kconfig

20216c126bd946248d28d875c4a82cd1a79ba794 - s390/Kconfig: Make modules sanity test a module-only option

Wed, 25 Feb 2026 10:30:25 +0100

s390/Kconfig: Make modules sanity test a module-only optionThe modules sanity test must be built as a module to actually exercisemodule loading. Require KUNIT && m to prevent built-in builds and avoidmisuse, so it is either 'n' or 'm'.Reviewed-by: Heiko Carstens Signed-off-by: Vasily Gorbik List of files: /linux/arch/s390/Kconfig

a2e507afd9a25e333b7a58082f5db8c4de2bd12d - s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT

Fri, 13 Feb 2026 02:28:48 +0100

s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOTCommit b5ca117365d9 ("ima: prevent kexec_load syscall based on runtimesecureboot flag") and commit 268a78404973 ("s390/kexec_file: Disablekexec_load when IPLed secure") disabled the kexec_load syscall basedon the secureboot mode. Commit 9e2b4be377f0 ("ima: add a new CONFIGfor loading arch-specific policies") needed to detect the secure bootmode, not to load an IMA architecture specific policy. Since there isthe new CONFIG_INTEGRITY_SECURE_BOOT, dropCONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT for s390.Signed-off-by: Coiby Xu Tested-by: Alexander Egorenkov [Vasily Gorbik: Fix missing arch_get_secureboot() prototype warning]link: https://lore.kernel.org/linux-integrity/c00-01.ttbfdx5@ub.hpns/Signed-off-by: Mimi Zohar List of files: /linux/arch/s390/Kconfig

9806790115d1949ee0bd6ef8533293b5a293a1bb - Merge tag 's390-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Fri, 20 Feb 2026 18:24:45 +0100

Merge tag 's390-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linuxPull s390 fixes from Heiko Carstens: - Make KEXEC_SIG available again for CONFIG_MODULES=n - The s390 topology code used to call rebuild_sched_domains() before common code scheduling domains were setup. This was silently ignored by common code, but now results in a warning. Address by avoiding the early call - Convert debug area lock from spinlock to raw spinlock to address lockdep warnings - The recent 3490 tape device driver rework resulted in a different device driver name, which is visible via sysfs for user space. This breaks at least one user space application. Change the device driver name back to its old name to fix this* tag 's390-7.0-2' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/tape: Fix device driver name s390/debug: Convert debug area lock from a spinlock to a raw spinlock s390/smp: Avoid calling rebuild_sched_domains() early s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n List of files: /linux/arch/s390/Kconfig

dd3411959b57df6e05a3ccbac67b0a836871c0c4 - s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=n

Mon, 16 Feb 2026 07:29:16 +0100

s390/kexec: Make KEXEC_SIG available when CONFIG_MODULES=nThe commit c8424e776b09 ("MODSIGN: Export module signature definitions")replaced the dependency of KEXEC_SIG on SYSTEM_DATA_VERIFICATION with thedependency on MODULE_SIG_FORMAT. This change disables KEXEC_SIG in s390kernels built with MODULES=n if nothing else selects MODULE_SIG_FORMAT.Furthermore, the signature verification in s390 kexec does not requireMODULE_SIG_FORMAT because it requires only the struct module_signature and,therefore, does not depend on code in kernel/module_signature.c.But making ARCH_SUPPORTS_KEXEC_SIG depend on SYSTEM_DATA_VERIFICATION isalso incorrect because it makes KEXEC_SIG available on s390 only if someother arbitrary option (for instance a file system or device driver)selects it directly or indirectly.To properly make KEXEC_SIG available for s390 kernels built with MODULES=yas well as MODULES=n _and_ also not depend on arbitrary options selectingSYSTEM_DATA_VERIFICATION, set ARCH_SUPPORTS_KEXEC_SIG=y for s390 and selectSYSTEM_DATA_VERIFICATION when KEXEC_SIG=y.Fixes: c8424e776b09 ("MODSIGN: Export module signature definitions")Suggested-by: Heiko Carstens Signed-off-by: Alexander Egorenkov Signed-off-by: Heiko Carstens List of files: /linux/arch/s390/Kconfig

cb5573868ea85ddbc74dd9a917acd1e434d21390 - Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Fri, 13 Feb 2026 20:31:15 +0100

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvmPull KVM updates from Paolo Bonzini: "Loongarch: - Add more CPUCFG mask bits - Improve feature detection - Add lazy load support for FPU and binary translation (LBT) register state - Fix return value for memory reads from and writes to in-kernel devices - Add support for detecting preemption from within a guest - Add KVM steal time test case to tools/selftests ARM: - Add support for FEAT_IDST, allowing ID registers that are not implemented to be reported as a normal trap rather than as an UNDEF exception - Add sanitisation of the VTCR_EL2 register, fixing a number of UXN/PXN/XN bugs in the process - Full handling of RESx bits, instead of only RES0, and resulting in SCTLR_EL2 being added to the list of sanitised registers - More pKVM fixes for features that are not supposed to be exposed to guests - Make sure that MTE being disabled on the pKVM host doesn't give it the ability to attack the hypervisor - Allow pKVM's host stage-2 mappings to use the Force Write Back version of the memory attributes by using the "pass-through' encoding - Fix trapping of ICC_DIR_EL1 on GICv5 hosts emulating GICv3 for the guest - Preliminary work for guest GICv5 support - A bunch of debugfs fixes, removing pointless custom iterators stored in guest data structures - A small set of FPSIMD cleanups - Selftest fixes addressing the incorrect alignment of page allocation - Other assorted low-impact fixes and spelling fixes RISC-V: - Fixes for issues discoverd by KVM API fuzzing in kvm_riscv_aia_imsic_has_attr(), kvm_riscv_aia_imsic_rw_attr(), and kvm_riscv_vcpu_aia_imsic_update() - Allow Zalasr, Zilsd and Zclsd extensions for Guest/VM - Transparent huge page support for hypervisor page tables - Adjust the number of available guest irq files based on MMIO register sizes found in the device tree or the ACPI tables - Add RISC-V specific paging modes to KVM selftests - Detect paging mode at runtime for selftests s390: - Performance improvement for vSIE (aka nested virtualization) - Completely new memory management. s390 was a special snowflake that enlisted help from the architecture's page table management to build hypervisor page tables, in particular enabling sharing the last level of page tables. This however was a lot of code (~3K lines) in order to support KVM, and also blocked several features. The biggest advantages is that the page size of userspace is completely independent of the page size used by the guest: userspace can mix normal pages, THPs and hugetlbfs as it sees fit, and in fact transparent hugepages were not possible before. It's also now possible to have nested guests and guests with huge pages running on the same host - Maintainership change for s390 vfio-pci - Small quality of life improvement for protected guests x86: - Add support for giving the guest full ownership of PMU hardware (contexted switched around the fastpath run loop) and allowing direct access to data MSRs and PMCs (restricted by the vPMU model). KVM still intercepts access to control registers, e.g. to enforce event filtering and to prevent the guest from profiling sensitive host state. This is more accurate, since it has no risk of contention and thus dropped events, and also has significantly less overhead. For more information, see the commit message for merge commit bf2c3138ae36 ("Merge tag 'kvm-x86-pmu-6.20' ...") - Disallow changing the virtual CPU model if L2 is active, for all the same reasons KVM disallows change the model after the first KVM_RUN - Fix a bug where KVM would incorrectly reject host accesses to PV MSRs when running with KVM_CAP_ENFORCE_PV_FEATURE_CPUID enabled, even if those were advertised as supported to userspace, - Fix a bug with protected guest state (SEV-ES/SNP and TDX) VMs, where KVM would attempt to read CR3 configuring an async #PF entry - Fail the build if EXPORT_SYMBOL_GPL or EXPORT_SYMBOL is used in KVM (for x86 only) to enforce usage of EXPORT_SYMBOL_FOR_KVM_INTERNAL. Only a few exports that are intended for external usage, and those are allowed explicitly - When checking nested events after a vCPU is unblocked, ignore -EBUSY instead of WARNing. Userspace can sometimes put the vCPU into what should be an impossible state, and spurious exit to userspace on -EBUSY does not really do anything to solve the issue - Also throw in the towel and drop the WARN on INIT/SIPI being blocked when vCPU is in Wait-For-SIPI, which also resulted in playing whack-a-mole with syzkaller stuffing architecturally impossible states into KVM - Add support for new Intel instructions that don't require anything beyond enumerating feature flags to userspace - Grab SRCU when reading PDPTRs in KVM_GET_SREGS2 - Add WARNs to guard against modifying KVM's CPU caps outside of the intended setup flow, as nested VMX in particular is sensitive to unexpected changes in KVM's golden configuration - Add a quirk to allow userspace to opt-in to actually suppress EOI broadcasts when the suppression feature is enabled by the guest (currently limited to split IRQCHIP, i.e. userspace I/O APIC). Sadly, simply fixing KVM to honor Suppress EOI Broadcasts isn't an option as some userspaces have come to rely on KVM's buggy behavior (KVM advertises Supress EOI Broadcast irrespective of whether or not userspace I/O APIC supports Directed EOIs) - Clean up KVM's handling of marking mapped vCPU pages dirty - Drop a pile of *ancient* sanity checks hidden behind in KVM's unused ASSERT() macro, most of which could be trivially triggered by the guest and/or user, and all of which were useless - Fold "struct dest_map" into its sole user, "struct rtc_status", to make it more obvious what the weird parameter is used for, and to allow fropping these RTC shenanigans if CONFIG_KVM_IOAPIC=n - Bury all of ioapic.h, i8254.h and related ioctls (including KVM_CREATE_IRQCHIP) behind CONFIG_KVM_IOAPIC=y - Add a regression test for recent APICv update fixes - Handle "hardware APIC ISR", a.k.a. SVI, updates in kvm_apic_update_apicv() to consolidate the updates, and to co-locate SVI updates with the updates for KVM's own cache of ISR information - Drop a dead function declaration - Minor cleanups x86 (Intel): - Rework KVM's handling of VMCS updates while L2 is active to temporarily switch to vmcs01 instead of deferring the update until the next nested VM-Exit. The deferred updates approach directly contributed to several bugs, was proving to be a maintenance burden due to the difficulty in auditing the correctness of deferred updates, and was polluting "struct nested_vmx" with a growing pile of booleans - Fix an SGX bug where KVM would incorrectly try to handle EPCM page faults, and instead always reflect them into the guest. Since KVM doesn't shadow EPCM entries, EPCM violations cannot be due to KVM interference and can't be resolved by KVM - Fix a bug where KVM would register its posted interrupt wakeup handler even if loading kvm-intel.ko ultimately failed - Disallow access to vmcb12 fields that aren't fully supported, mostly to avoid weirdness and complexity for FRED and other features, where KVM wants enable VMCS shadowing for fields that conditionally exist - Print out the "bad" offsets and values if kvm-intel.ko refuses to load (or refuses to online a CPU) due to a VMCS config mismatch x86 (AMD): - Drop a user-triggerable WARN on nested_svm_load_cr3() failure - Add support for virtualizing ERAPS. Note, correct virtualization of ERAPS relies on an upcoming, publicly announced change in the APM to reduce the set of conditions where hardware (i.e. KVM) *must* flush the RAP - Ignore nSVM intercepts for instructions that are not supported according to L1's virtual CPU model - Add support for expedited writes to the fast MMIO bus, a la VMX's fastpath for EPT Misconfig - Don't set GIF when clearing EFER.SVME, as GIF exists independently of SVM, and allow userspace to restore nested state with GIF=0 - Treat exit_code as an unsigned 64-bit value through all of KVM - Add support for fetching SNP certificates from userspace - Fix a bug where KVM would use vmcb02 instead of vmcb01 when emulating VMLOAD or VMSAVE on behalf of L2 - Misc fixes and cleanups x86 selftests: - Add a regression test for TPR<=>CR8 synchronization and IRQ masking - Overhaul selftest's MMU infrastructure to genericize stage-2 MMU support, and extend x86's infrastructure to support EPT and NPT (for L2 guests) - Extend several nested VMX tests to also cover nested SVM - Add a selftest for nested VMLOAD/VMSAVE - Rework the nested dirty log test, originally added as a regression test for PML where KVM logged L2 GPAs instead of L1 GPAs, to improve test coverage and to hopefully make the test easier to understand and maintain guest_memfd: - Remove kvm_gmem_populate()'s preparation tracking and half-baked hugepage handling. SEV/SNP was the only user of the tracking and it can do it via the RMP - Retroactively document and enforce (for SNP) that KVM_SEV_SNP_LAUNCH_UPDATE and KVM_TDX_INIT_MEM_REGION require the source page to be 4KiB aligned, to avoid non-trivial complexity for something that no known VMM seems to be doing and to avoid an API special case for in-place conversion, which simply can't support unaligned sources - When populating guest_memfd memory, GUP the source page in common code and pass the refcounted page to the vendor callback, instead of letting vendor code do the heavy lifting. Doing so avoids a looming deadlock bug with in-place due an AB-BA conflict betwee mmap_lock and guest_memfd's filemap invalidate lock Generic: - Fix a bug where KVM would ignore the vCPU's selected address space when creating a vCPU-specific mapping of guest memory. Actually this bug could not be hit even on x86, the only architecture with multiple address spaces, but it's a bug nevertheless"* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (267 commits) KVM: s390: Increase permitted SE header size to 1 MiB MAINTAINERS: Replace backup for s390 vfio-pci KVM: s390: vsie: Fix race in acquire_gmap_shadow() KVM: s390: vsie: Fix race in walk_guest_tables() KVM: s390: Use guest address to mark guest page dirty irqchip/riscv-imsic: Adjust the number of available guest irq files RISC-V: KVM: Transparent huge page support RISC-V: KVM: selftests: Add Zalasr extensions to get-reg-list test RISC-V: KVM: Allow Zalasr extensions for Guest/VM KVM: riscv: selftests: Add riscv vm satp modes KVM: riscv: selftests: add Zilsd and Zclsd extension to get-reg-list test riscv: KVM: allow Zilsd and Zclsd extensions for Guest/VM RISC-V: KVM: Skip IMSIC update if vCPU IMSIC state is not initialized RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_rw_attr() RISC-V: KVM: Fix null pointer dereference in kvm_riscv_aia_imsic_has_attr() RISC-V: KVM: Remove unnecessary 'ret' assignment KVM: s390: Add explicit padding to struct kvm_s390_keyop KVM: LoongArch: selftests: Add steal time test case LoongArch: KVM: Add paravirt vcpu_is_preempted() support in guest side LoongArch: KVM: Add paravirt preempt feature in hypervisor side ... List of files: /linux/arch/s390/Kconfig