kernel/git/next/linux-next-history.git/virt, branch master

Merge branch 'vfio'

2026-05-28T02:12:36Z

* vfio: KVM: VFIO: update coherency only if file was deleted KVM: VFIO: deduplicate file release logic KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce() KVM: VFIO: clean up control flow in kvm_vfio_file_add()

Merge branch 'sev'

2026-05-28T02:12:33Z

* sev: KVM: SEV: Mark source page dirty when writing back CPUID data on failure KVM: SEV: Unmap local kmaps in LIFO order, per highmem requirements KVM: SEV: Pin source page for write when adding CPUID data for SNP guest KVM: SEV: Allocate only as many bytes as needed for temp crypt buffers KVM: SEV: Rewrite logic to {de,en}crypt memory for debug KVM: SEV: Add helper function to pin/unpin a single page KVM: SEV: Explicitly validate the dst buffer for debug operations KVM: selftests: Add a test to verify SEV {en,de}crypt debug ioctls KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path KVM: selftests: Teach sev_*_test about revoking VM types KVM: SEV: Don't advertise VM types that are disabled by firmware KVM: SEV: Don't advertise support for unusable VM types KVM: SEV: Consolidate logic for printing state of SEV{,-ES,-SNP} enabling KVM: SEV: Set supported SEV+ VM types during sev_hardware_setup() crypto/ccp: export firmware supported vm types crypto/ccp: hoist kernel part of SNP_PLATFORM_STATUS

Merge branch 'gmem'

2026-05-28T02:12:27Z

* gmem: KVM: selftests: Remove unnecessary "%s" formatting of a constant string KVM: selftests: Test guest_memfd binding overlap without GPA overlap KVM: guest_memfd: Return -EEXIST for overlapping bindings

Merge branch 'generic'

2026-05-28T02:12:26Z

* generic: call_once:: Fix typo in comment for call_once() KVM: Fix kvm_vcpu_map[_readonly]() function prototypes KVM: Rename invalidate_begin to invalidate_start for consistency

KVM: guest_memfd: Return -EEXIST for overlapping bindings

2026-05-26T19:23:36Z

KVM_SET_USER_MEMORY_REGION2 rejects guest_memfd ranges that overlap an existing binding, but kvm_gmem_bind() currently reports the failure through its generic -EINVAL path. That makes binding conflicts indistinguishable from malformed guest_memfd parameters. Return -EEXIST when the target guest_memfd range is already bound, matching the errno used for overlapping GPA memslots and making the two types of range conflicts report the same class of error to userspace. Note, returning -EINVAL was definitely not intentional, as guest_memfd support was accompanied by a selftest to verify that attempting to create overlapping bindings fails with -EEXIST. Except the selftest was also flawed in that it unintentionally overlapped memslot GPAs, and so failed on KVM's common memslot checks before reaching guest_memfd. Fixes: a7800aa80ea4 ("KVM: Add KVM_CREATE_GUEST_MEMFD ioctl() for guest-specific backing memory") Signed-off-by: Zongyao Chen Reviewed-by: Ackerley Tng Tested-by: Ackerley Tng [sean: call out that the original intent was to return -EEXIST] Link: https://patch.msgid.link/20260522172151.3530267-2-seanjc@google.com Signed-off-by: Sean Christopherson

KVM: SEV: Pin source page for write when adding CPUID data for SNP guest

2026-05-26T16:56:34Z

When populating a guest_memfd instance with the initial CPUID data for an SNP guest, acquire a writable pin on the source page as KVM will write back the "correct" CPUID information if the userspace provided data is rejected by trusted firmware. Because KVM writes to the source page using a kernel mapping, pinning for read could result in KVM clobbering read-only memory. Note, well-behaved VMMs are unlikely to be affected, as CPUID information is almost always dynamically generated by userspace, i.e. it's unlikely for the CPUID information to be backed by a read-only mapping. Fixes: 2a62345b30529 ("KVM: guest_memfd: GUP source pages prior to populating guest memory") Cc: stable@vger.kernel.org Signed-off-by: Ackerley Tng Link: https://patch.msgid.link/20260522-fix-sev-gmem-post-populate-v2-1-3f196bfad5a1@google.com [sean: rewrite shortlog and changelog, tag for stable@] Signed-off-by: Sean Christopherson

KVM: VFIO: update coherency only if file was deleted

2026-05-13T18:12:40Z

When servicing a KVM_DEV_VFIO_FILE_DEL request, if a file is removed from kv->file_list, kv->noncoherent needs to be updated, in case we can revert to using coherent DMA. However, if we found no candidate to remove, there is no need to re-scan the list, so do it only if a matching file was found. To simplify the control flow, use a mutex guard so that we can return early from within the search loop if the maching file is found. Signed-off-by: Carlos López Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260313122040.1413091-7-clopez@suse.de Signed-off-by: Sean Christopherson

KVM: VFIO: deduplicate file release logic

2026-05-13T18:12:39Z

There are two callsites which destroy files in kv->file_list: the function servicing KVM_DEV_VFIO_FILE_DEL, and the relase of the whole KVM VFIO device. The process involves several steps, so move all those into a single function, removing duplicate code. Signed-off-by: Carlos López Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260313122040.1413091-6-clopez@suse.de Signed-off-by: Sean Christopherson

KVM: VFIO: use mutex guard in kvm_vfio_file_set_spapr_tce()

2026-05-13T18:12:36Z

Use a mutex guard to hold a lock for the entirety of the function, which removes the need for a goto (whose label even has a misleading name since 8152f8201088 ("fdget(), more trivial conversions")) Signed-off-by: Carlos López Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260313122040.1413091-5-clopez@suse.de Signed-off-by: Sean Christopherson

KVM: VFIO: clean up control flow in kvm_vfio_file_add()

2026-05-13T18:04:47Z

The struct file that this function fgets() is always passed to fput() before returning, so use automatic cleanup via __free() to avoid several jumps to the end of the function. Similarly, use a mutex guard to completely remove the need to use gotos. Signed-off-by: Carlos López Reviewed-by: Alex Williamson Link: https://patch.msgid.link/20260313122040.1413091-4-clopez@suse.de Signed-off-by: Sean Christopherson