[edera-rebase-app]

Nightly rebase of edera/mainline (6990bf0bee64) onto master (6628e7d4c6b2), driven by Claude. Not pushed automatically because the checker found drift and Claude's report asks for a decision. Run log.

Important

Do not use the merge button: this branch replaces edera/mainline rather than merging into it. Approve the pull request to land it; the land workflow force-pushes edera/mainline to the approved head, pinned to 6990bf0bee64, and keeps a backup.

Independent checks

Builds: success (x86_64 vmlinux on the Edera host config and arm64 vmlinux, both with the Edera features built in; per-build results in the run).

Old tip	6990bf0bee64
New tip	c2409fc72c46
Old upstream base	864c07de0c7d
New upstream base	6628e7d4c6b2

• New branch is based on the upstream tip.
• Downstream series is linear.
• All 105 downstream commits replayed; 3 changed only in hunk context (listed below).
• Downstream drift: the tree changed by more than the upstream delta.

Commits whose hunk context moved (own +/- lines identical)

• ea62ac9f1b0f iommu/xen: Add Xen PV-IOMMU driver → 3d17f52db513
• bd1c0dba57c3 sysctl: wire up PaX softmode setting → 692285d6572b
• 849ed61740ea use maximum supported mmap rnd entropy by default → c1bae0d26b9b

Drift (changed lines: upstream delta vs. actual change)

--- upstream-lines
+++ actual-lines
@@ -851242,6 +851242,18 @@
 +	return ret;
 +}
 +
++#ifdef CONFIG_OPENPAX_SOFTMODE
++static const struct ctl_table pax_table[] = {
++	{
++		.procname       = "softmode",
++		.data           = &pax_softmode,
++		.maxlen         = sizeof(int),
++		.mode           = 0600,
++		.proc_handler   = proc_dointvec,
++	},
++};
++#endif
++
 +static const struct ctl_table sysctl_subsys_table[] = {
 +	{
 +		.procname	= "sysctl_writes_strict",
@@ -851289,6 +851301,9 @@
 +int __init sysctl_init_bases(void)
 +{
 +	register_sysctl_init("kernel", sysctl_subsys_table);
++#ifdef CONFIG_OPENPAX_SOFTMODE
++	register_sysctl_init("kernel/pax", pax_table);
++#endif
 +
 +	return 0;
 +}
@@ -851322,6 +851337,18 @@
 -	mutex_unlock(&static_key_mutex);
 -	return ret;
 +	return -ENOSYS;
+-#ifdef CONFIG_OPENPAX_SOFTMODE
+-static const struct ctl_table pax_table[] = {
+-	{
+-		.procname       = "softmode",
+-		.data           = &pax_softmode,
+-		.maxlen         = sizeof(int),
+-		.mode           = 0600,
+-		.proc_handler   = proc_dointvec,
+-	},
+-};
+-#endif
+-
 -static const struct ctl_table sysctl_subsys_table[] = {
 -#ifdef CONFIG_SYSCTL
 -	{
@@ -851371,6 +851398,9 @@
 -int __init sysctl_init_bases(void)
 -{
 -	register_sysctl_init("kernel", sysctl_subsys_table);
+-#ifdef CONFIG_OPENPAX_SOFTMODE
+-	register_sysctl_init("kernel/pax", pax_table);
+-#endif
 -
 -	return 0;
 -}

Claude's report

Summary

edera/mainline (6990bf0bee64) rebased onto torvalds master 6628e7d4c6b2 (v7.2-rc5-41402-g6628e7d4c6b2) from the old base 864c07de0c7d (v7.2-rc5-26646-g864c07de0c7d): 13964 upstream commits (merge window). All 105 downstream commits were replayed in order onto rebase-result (new tip c2409fc72c46). Two conflicts were resolved, both in OpenPaX commits, both by moving the downstream hunk to where upstream moved the surrounding code. No commit was dropped or went empty, and no build fixes were needed. x86_64 and arm64 vmlinux both build. verify-upstream-rebase.sh passes the base, linearity and commit-count checks. It fails the drift check, and that is expected: the only drift is the kernel/sysctl.c relocation from conflict 1, explained below. One upstream change reaches the Hyper-V-nested-on-Xen feature without touching its lines. It is raised under Needs a decision.

Needs a decision

• UNSURE: 228e21764b38 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown now runs the VMBus kexec teardown on a Xen PV dom0 nested under Hyper-V. Before this change, on x86 hv_kexec_handler() was only reached through hv_machine_shutdown(). That hook is installed by ms_hyperv_init_platform() and so only exists when x86_hyper_type == X86_HYPER_MS_HYPERV. The nested dom0 is XEN_PV, so it never ran the handler. Upstream now calls the handler from hv_vmbus_syscore's .shutdown callback, which hv_acpi_init() registers. On the nested path that registration happens because hv_is_hyperv_initialized() returns true when hyperv_nested_on_xen is set. On a kexec from that dom0, the kernel will now call vmbus_initiate_unload(false) and then cpuhp_remove_state(hyperv_cpuhp_online). That sends CHANNELMSG_UNLOAD and waits for the reply over the Xen VIRQ bridge, then tears down the SynIC on each CPU through Xen-proxied MSRs. The handler does not call hyperv_remove_xen_vmbus_irq().
  • Reading A: this is desirable. It brings the nested dom0 in line with native guests, so the next kernel does not inherit a live VMBus connection and SynIC state. No change is needed.
  • Reading B: the path is untested under Xen proxying. The unload wait and the SynIC teardown might hang or misbehave during kexec, and the Xen bridge IRQ stays bound. In that case the nested case should skip the handler (for example, hv_vmbus_syscore_shutdown() returns early when hyperv_nested_on_xen), or the downstream VMBus-via-Xen-VIRQ commit should add the bridge teardown.
  • What I committed: upstream's code unchanged (reading A by default). No downstream commit was modified for this. Someone who knows how Edera dom0 kexec works on this platform (whether it goes through Xen's kexec, and whether syscore_shutdown() runs at all) should decide.

Conflicts resolved

• bd1c0dba57c3 sysctl: wire up PaX softmode setting → 692285d6572b. File: kernel/sysctl.c. Collided with 443bea2f71c5 sysctl: consolidate CONFIG_SYSCTL into a single block in kernel/sysctl.c (with acd19f2c56f2 before it). Upstream moved sysctl_subsys_table[] and sysctl_init_bases() up into the first #ifdef CONFIG_SYSCTL block. It left only a proc_do_static_key() stub in the #else branch, where the downstream hunk used to apply. I kept upstream's layout exactly and the #else branch as upstream has it. I re-applied the downstream hunks unchanged at the table's new location: the CONFIG_OPENPAX_SOFTMODE pax_table[] just before sysctl_subsys_table[], and the register_sysctl_init("kernel/pax", pax_table) call in sysctl_init_bases(). The commit's own +/- lines are identical to the original. It is still inside CONFIG_SYSCTL, as before. This relocation is the entire drift the checker reports.
• 849ed61740ea use maximum supported mmap rnd entropy by default → c1bae0d26b9b. File: arch/Kconfig. Collided with 8cdae75cebe0 arch/Kconfig: fix dead conditions by removing dead options. Upstream deleted ARCH_MMAP_RND_BITS_DEFAULT and ARCH_MMAP_RND_COMPAT_BITS_DEFAULT and their default X if X lines. Those lines were dead: an int symbol used as a condition is always false, and no arch selected them. I kept upstream's removal and applied the downstream change (default ..._MIN → default ..._MAX for both symbols). Behaviour matches the old tree, because the removed line never applied. The checker reports this commit as context-only, with no drift.

Dropped downstream commits

None.

Build fixes

None.

Upstream commits that meet the series

65 upstream commits touch a file the series also touches (23 shared files). Fixes (Fixes:/stable tags; there are no CVE references) and my reading of the final tree:

• 278b2abf660a init/bootconfig: pass init arguments in documented order (Fixes, Cc stable). Intact in init/main.c: extra init args are parsed before after_dashes. The downstream changes to this file (pax_softmode, near the top) are far from the hunk.
• 51e766bcd35e init/main: fix false-positive kernel panic on environment variable overwrite (Fixes). Intact: the strncmp break comes before the MAX_INIT_ENVS panic check.
• b82ed0e3a1da init/main: fix off-by-one in argv_init cleanup (Fixes). Intact: both loops are i <= MAX_INIT_ARGS.
• 0f4a9e682f7f xattr: always invoke cap_convert_nscap() for security.capability writes (Fixes). Intact in vfs_setxattr(). The downstream pax_getxattr() is a read path through __vfs_getxattr() and is not affected.
• 1c8f6308e557 iommu/dma: Catch scatterlist length overflows (Fixes). Intact: both overflows_type() and check_add_overflow() are in iommu_dma_map_sg(). The downstream change to dma-iommu.c (skip PCI window reservation under the Xen PV-IOMMU) is in iova_reserve_iommu_regions().
• dd57772e36f7 Drivers: hv: vmbus: Check ACPI companion before use (Fixes). Intact in vmbus_acpi_add(). The downstream VMBus-via-Xen-VIRQ hunks are in vmbus_bus_init() and vmbus_exit().
• 228e21764b38 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown (Fixes). Applied intact. It reaches the nested-on-Xen path; see Needs a decision.
• 7135a05838e8 mm/vma: avoid spurious write locks when mm->mm_lock_seq overflows (Fixes, Cc stable). Intact. The downstream pax_flags field in mm_struct and the tools/testing/vma stubs are separate hunks.
• 68cb098eadda mm/vma: avoid broken uffd merge on mremap (Fixes, Cc stable). The test stub is intact next to the downstream get_random_u32() stub.
• 799203afd298, e3e7a85730a4, 681f3b68f435, 5728d3523f12: documentation-only changes in kernel-parameters.txt. Intact, with the downstream pax_softmode= entry alongside.

Non-fix commits I checked for semantic effect on the series:

• 6eecb67b69af xen/grant-table: stop setting PG_private on pages for grant mapping: the downstream gnttab_alloc_pages_node() still goes through gnttab_pages_set_private(), and nothing downstream tests PagePrivate() on grant pages (grepped drivers/xen, arch/x86/xen, include/xen). No effect.
• 1ae140d0f272 iommu: Make iommu-dma helpers private: the Xen PV-IOMMU uses neither iommu_get_dma_domain() nor iommu_deferred_attach(). No effect. aa416fa911ad iommu: Finalize deferred attachments when mapping MSI pages (not in a shared file) is also a no-op for it: the driver has no is_attach_deferred, and it reserves MSI as IOMMU_RESV_MSI, not SW_MSI.
• 2690d4156b51 iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest: only hooked from hyperv_init(), which the nested-on-Xen path (hyperv_init_nested_on_xen()) does not call. Its new Kconfig entry is why ea62ac9f1b0f iommu/xen: Add Xen PV-IOMMU driver replays with moved context.
• 118bdac10546 Drivers: hv: Add logical device ID registry for vPCI devices: a software rhashtable with no hypercall. It does not interact with the nested-on-Xen pci-hyperv.c changes.
• d0ec95a8a4e7 hv_netvsc: Advertise the SR-IOV capability for CoCo VMs: SR-IOV was already advertised on the nested path, because hv_is_isolation_supported() is false there. The downstream DMA-map hunks are untouched.
• 242bac52294e, d08ab285b096, 2bfbb09b505c (sysctl handler rework): pax_table is a single int with proc_dointvec. No effect.
• 9cae38dc11da and the other mm/vma refactors: map_deny_write_exec() (which the OpenPaX MPROTECT hunk extends) still has the same two callers, in mm/mprotect.c and mm/vma.c.

Full list:

278b2abf660a init/bootconfig: pass init arguments in documented order
0f4a9e682f7f xattr: always invoke cap_convert_nscap() for security.capability writes
799203afd298 nvme-tcp: validate the TLS handshake timeout
e3e7a85730a4 nvmet-tcp: validate the TLS handshake timeout
68cb098eadda mm/vma: avoid broken uffd merge on mremap
7135a05838e8 mm/vma: avoid spurious write locks when mm->mm_lock_seq overflows
dc0b17144d62 mm/vma: don't remove VMA from rmap if pgoff unchanged
14a5c975b138 mm: update comments to refer to anon rmap rather than anon_vma
38564710f443 mm: implement and use vma_has_anon_rmap(), silence KCSAN
6a9ef02c60bf mm/vma: const-ify vma_assert_stabilised() and associated functions
72a993449cb0 mm: eliminate VM_SPECIAL, VMA_SPECIAL_FLAGS
44debd840ec9 mm/vma: introduce vma[_flags]_is_mm_backed()
c911e7ebebf5 mm: rename is_vm_hugetlb_page() to vma_is_hugetlb()
94c86564538e mm: remove hugetlb_inline.h
88d77002e1a1 mm: remove VMA_IO_BIT check in vma[_flags]_is_mm_managed()
9201d0f5b9d5 mm/vma: add and use vma_[flags]_is_fixed_mapping
7fdbc26b69c0 mm/vma: add vma[_flags]_is_mm_managed() predicates
b7b4d8f37a4f mm: add mmap action for discontiguous kernel page mapping
4852f3421456 mm/vma: tidy up map kernel pages enum values
9cae38dc11da mm: consistently validate VMA state after mmap[_prepare] hooks
86a779c53204 mm/vma: introduce and use vma_[flags_]can_merge()
f85eb0656c40 mm/vma: fix mmap_prepare file handling, remove file_doesnt_need_get
2e83e2ce34ff arch, mm: promote DEBUG_WX to CHECK_WX
c2d4ccfbba3f mm: fix typos in various comments
f000a06da2a5 docs: admin-guide: Fix typo in kernel-parameters.txt
56fb075b77f8 mshv: Redesign hypervisor memory deposit logic
28d5df7b7274 KVM: split CONFIG_KVM_PRIVATE_MEMATTR_VM out of KVM_VM_MEMORY_ATTRIBUTES
228e21764b38 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown
dd57772e36f7 Drivers: hv: vmbus: Check ACPI companion before use
084100a1b579 tracing: Parse filter from boot event string
aabe6e1b36ce init/main.c: remove unreachable check in obsolete_checksetup()
677f83795fdf bootconfig: Move BOOTCONFIG_FOOTER_SIZE to include/linux/bootconfig.h
958c01049e0a bootconfig: Skip printing early params to cmdline from bootconfig
10823ced2f18 kho: rename kho_scratch= commandline parameter to kho_bootmem=
8ebd2eb87f50 kho: rename KHO scratch to KHO bootmem
fdd81f15fc43 iommu/dma: Clean up redundant MSI cookie check
1c8f6308e557 iommu/dma: Catch scatterlist length overflows
2690d4156b51 iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest
118bdac10546 Drivers: hv: Add logical device ID registry for vPCI devices
1ae140d0f272 iommu: Make iommu-dma helpers private
bbe5d3b3d402 treewide: remove PagePrivate() and PG_private from comments and docs
6eecb67b69af xen/grant-table: stop setting PG_private on pages for grant mapping
e59c9a971a9f mm/vma: make MAP_PRIVATE-mapped /dev/zero mappings truly anonymous
4b019e056f6c mm: implement file_is_dev_zero() to uniquely identify /dev/zero
35e340a47888 mm: userland pgtable freeing is RCU-safe now, remove leftover bits
8cdae75cebe0 arch/Kconfig: fix dead conditions by removing dead options
51e766bcd35e init/main: fix false-positive kernel panic on environment variable overwrite
b82ed0e3a1da init/main: fix off-by-one in argv_init cleanup
47e725702b0b mm: make per-VMA locks available universally
681f3b68f435 KVM: guest_memfd: Fix the in-place conversion documentation
0bf031ba8c49 iommu: Add Broadcom BCM2712 IOMMU driver
42eed9bb9ca4 iommu: apple-dart: Support specifying the DMA aperture in the DT
537ec2b15fdd KVM: Let userspace disable per-VM mem attributes, enable per-gmem attributes
69d38c792c53 mm: Add copy_remote_mm_str()
5728d3523f12 memblock: reject non-page-aligned reserve_mem regions
443bea2f71c5 sysctl: consolidate CONFIG_SYSCTL into a single block in kernel/sysctl.c
acd19f2c56f2 sysctl: collapse redundant CONFIG_SYSCTL nesting in kernel/sysctl.c
242bac52294e sysctl: Disallow partial updates for erroneous sysctl vectors
d08ab285b096 sysctl: Reject uint arrays before calling the general proc_vec
2bfbb09b505c sysctl: Split data conversion and file position handling
641a9b9cc697 dma-mapping: use exact allocation for DMA pages
95d2fec40c48 dma-mapping: rename dma_opt_mapping_size()
d0ec95a8a4e7 hv_netvsc: Advertise the SR-IOV capability for CoCo VMs
abaa0835b4f3 bpf: Refuse caller-supplied keyrings when the bpf one is active
264d8fd2794f bpf, keys: Add a bpf keyring for program signature validation

Builds

• x86_64: pass (kernel-build.sh x86_64, Edera host.config from edera-dev/linux-kernel-oci@6865daedf8cc; every forced option survived olddefconfig).
• arm64: pass (kernel-build.sh arm64, defconfig plus the common downstream options).