[edera-rebase-app]

Nightly rebase of edera/mainline (8f315d39b605) onto master (05441d697f7f), driven by Claude. Not pushed automatically because the checker found drift and Claude's report asks for a decision. Run log.

Important

Do not use the merge button: this branch replaces edera/mainline rather than merging into it. Approve the pull request to land it; the land workflow force-pushes edera/mainline to the approved head, pinned to 8f315d39b605, and keeps a backup.

Independent checks

Builds: success (x86_64 vmlinux on the Edera host config and arm64 vmlinux, both with the Edera features built in; per-build results in the run).

Old tip	8f315d39b605
New tip	a726ab2b6103
Old upstream base	864c07de0c7d
New upstream base	05441d697f7f

• New branch is based on the upstream tip.
• Downstream series is linear.
• Downstream commit set changed: 110 before, 110 after; 1 commit(s) lost, added, or with different +/- lines.
• Downstream drift: the tree changed by more than the upstream delta.

Commits whose hunk context moved (own +/- lines identical)

• ea62ac9f1b0f iommu/xen: Add Xen PV-IOMMU driver → 8eb1463d84bd
• bd1c0dba57c3 sysctl: wire up PaX softmode setting → 6d236746bd06
• 849ed61740ea use maximum supported mmap rnd entropy by default → 540fc3e8147c
• 5b1ff5bbc8cb 9p/xen: carry the 9P session across a restore → 76c211cb8768

Commits lost, added, or whose own +/- lines changed

Before	After
f492e4d0cb26 9p/xen: reconnect to the backend on resume	29e1bfa11fd3 9p/xen: reconnect to the backend on resume

Drift (changed lines: upstream delta vs. actual change)

--- upstream-lines
+++ actual-lines
@@ -852322,6 +852322,18 @@
 +	return ret;
 +}
 +
++#ifdef CONFIG_OPENPAX_SOFTMODE
++static const struct ctl_table pax_table[] = {
++	{
++		.procname       = "softmode",
++		.data           = &pax_softmode,
++		.maxlen         = sizeof(int),
++		.mode           = 0600,
++		.proc_handler   = proc_dointvec,
++	},
++};
++#endif
++
 +static const struct ctl_table sysctl_subsys_table[] = {
 +	{
 +		.procname	= "sysctl_writes_strict",
@@ -852369,6 +852381,9 @@
 +int __init sysctl_init_bases(void)
 +{
 +	register_sysctl_init("kernel", sysctl_subsys_table);
++#ifdef CONFIG_OPENPAX_SOFTMODE
++	register_sysctl_init("kernel/pax", pax_table);
++#endif
 +
 +	return 0;
 +}
@@ -852402,6 +852417,18 @@
 -	mutex_unlock(&static_key_mutex);
 -	return ret;
 +	return -ENOSYS;
+-#ifdef CONFIG_OPENPAX_SOFTMODE
+-static const struct ctl_table pax_table[] = {
+-	{
+-		.procname       = "softmode",
+-		.data           = &pax_softmode,
+-		.maxlen         = sizeof(int),
+-		.mode           = 0600,
+-		.proc_handler   = proc_dointvec,
+-	},
+-};
+-#endif
+-
 -static const struct ctl_table sysctl_subsys_table[] = {
 -#ifdef CONFIG_SYSCTL
 -	{
@@ -852451,6 +852478,9 @@
 -int __init sysctl_init_bases(void)
 -{
 -	register_sysctl_init("kernel", sysctl_subsys_table);
+-#ifdef CONFIG_OPENPAX_SOFTMODE
+-	register_sysctl_init("kernel/pax", pax_table);
+-#endif
 -
 -	return 0;
 -}
@@ -885304,64 +885334,15 @@
 +
 +			if (req)
 +				p9_req_put(priv->client, req);
--	if (priv->rings) {
--		for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
--			struct xen_9pfs_dataring *ring = &priv->rings[i];
-+	for (i = 0; i < XEN_9PFS_NUM_RINGS; i++) {
-+		struct xen_9pfs_dataring *ring = &priv->rings[i];
--			cancel_work_sync(&ring->work);
-+		if (!ring->intf)
-+			break;
-+		if (ring->irq >= 0) {
-+			unbind_from_irqhandler(ring->irq, ring);
-+			ring->irq = -1;
-+		}
+-		cancel_work_sync(&ring->work);
+-
 +		cancel_work_sync(&ring->work);
--			if (!ring->intf)
--				break;
--			if (ring->irq >= 0) {
--				unbind_from_irqhandler(ring->irq, ring);
--				ring->irq = -1;
--			}
--			if (ring->data.in) {
--				for (j = 0; j < (1 << ring->intf->ring_order);
--				     j++) {
--					grant_ref_t ref;
--
--					ref = ring->intf->ref[j];
--					gnttab_end_foreign_access(ref, NULL);
--					ring->intf->ref[j] = INVALID_GRANT_REF;
--				}
--				free_pages_exact(ring->data.in,
--						 1UL << (ring->intf->ring_order +
--							 XEN_PAGE_SHIFT));
--				ring->data.in = NULL;
--				ring->data.out = NULL;
--			}
--			if (ring->ref != INVALID_GRANT_REF) {
--				gnttab_end_foreign_access(ring->ref, NULL);
--				ring->ref = INVALID_GRANT_REF;
-+		if (ring->data.in) {
-+			for (j = 0; j < (1 << ring->intf->ring_order); j++) {
-+				grant_ref_t ref;
-+
-+				ref = ring->intf->ref[j];
-+				gnttab_end_foreign_access(ref, NULL);
-+				ring->intf->ref[j] = INVALID_GRANT_REF;
--			free_page((unsigned long)ring->intf);
--			ring->intf = NULL;
-+			free_pages_exact(ring->data.in,
-+					 1UL << (ring->intf->ring_order +
-+						 XEN_PAGE_SHIFT));
-+			ring->data.in = NULL;
-+			ring->data.out = NULL;
++
+-	if (priv->rings) {
+-		xen_9pfs_front_free_rings(priv);
 -		kfree(priv->rings);
-+		if (ring->ref != INVALID_GRANT_REF) {
-+			gnttab_end_foreign_access(ring->ref, NULL);
-+			ring->ref = INVALID_GRANT_REF;
-+		}
-+		free_page((unsigned long)ring->intf);
-+		ring->intf = NULL;
+-	}
++	xen_9pfs_front_free_rings(priv);
 -	priv->rings = kzalloc_objs(*priv->rings, XEN_9PFS_NUM_RINGS);
 -	if (!priv->rings) {
 -		kfree(priv);

Claude's report

Summary

Rebased edera/mainline (8f315d39b605) onto torvalds master 05441d697f7f (v7.2-rc5-41534-g05441d697f7f) from merge base 864c07de0c7d (v7.2-rc5-26646-g864c07de0c7d). That is 14082 non-merge upstream commits (merge window). All 110 downstream commits were replayed onto rebase-result (new tip a726ab2b6103). Four conflicts were resolved: kernel/sysctl.c, arch/Kconfig, and two in net/9p/trans_xen.c. No commit was dropped, squashed, reordered or reworded, and no build fixes were needed. x86_64 and arm64 vmlinux both build. verify-upstream-rebase.sh reports "commit set changed" and "drift". I expected both, and all of it comes from the resolutions below: base and linearity pass, 110 commits before and 110 after, and only 29e1bfa11fd3 9p/xen: reconnect to the backend on resume has different +/- lines. Two upstream changes reach downstream features without conflicting, so they are listed for a decision.

Needs a decision

• UNSURE: Upstream 228e21764b38 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown moved hv_kexec_handler() (vmbus_initiate_unload() plus cpuhp_remove_state(hyperv_cpuhp_online), which runs hv_synic_cleanup() on every CPU) out of x86 hv_machine_shutdown() and into a VMBus syscore .shutdown callback. That callback runs whenever kexec_is_in_progress(). In the nested-on-Xen dom0 mode (hyperv_nested_on_xen), ms_hyperv_init_platform() never runs, because the detected hypervisor is Xen. So machine_ops.shutdown = hv_machine_shutdown was never installed, and VMBus was never unloaded on kexec. After this rebase it will be, on a Linux-side kernel_kexec(), through the downstream SynIC host-frame and Xen VIRQ bridge setup.
  • Reading 1: this is a fix the nested mode also gets (a clean VMBus unload before kexec).
  • Reading 2: the path has never run with Xen-side SynIC pages and the VIRQ_HYPERV_VMBUS bridge, and hyperv_remove_xen_vmbus_irq() is not called on this path.
  • Committed: upstream's change as-is, nothing downstream changed. Someone who knows the nested-on-Xen kexec flow should confirm it is safe. If Xen-mediated kexec in dom0 never goes through kernel_kexec(), the callback is not reached and this does not matter.
• UNSURE: Upstream 241d46901226 9p: reject RERROR/RLERROR with zero errcode closes a hole in p9_check_errors() (net/9p/client.c). The downstream session-transfer control path in net/9p/trans_xen.c, xen_9pfs_front_ctl() (from 9p/xen: carry the 9P session across a restore), parses RLERROR itself and returns -(int)ecode. With ecode == 0 it returns 0, which callers treat as success:
  • Tsession_restore: the reply is treated as accepted.
  • Tsession_save: len underflows, kvmalloc then fails with -ENOMEM and the saved session is discarded.
  • This is not a regression from the rebase. The same code existed before, and the upstream fix does not reach it because it bypasses p9_check_errors().
  • Reading 1: leave it, since only a malicious backend triggers it and the effect is a failed save or restore.
  • Reading 2: mirror upstream and map ecode == 0 to -EPROTO in xen_9pfs_front_ctl().
  • Committed: unchanged. Fixing it would be a downstream behaviour change, which belongs in its own commit, not in a rebase.

Conflicts resolved

• sysctl: wire up PaX softmode setting, kernel/sysctl.c.
  • Collided with: 443bea2f71c5 sysctl: consolidate CONFIG_SYSCTL into a single block in kernel/sysctl.c (and acd19f2c56f2, which dropped the inner #ifdef CONFIG_SYSCTL). Upstream moved sysctl_subsys_table and sysctl_init_bases() into the first CONFIG_SYSCTL block and added a proc_do_static_key() stub to the #else branch.
  • Kept: upstream's layout. The downstream pax_table (#ifdef CONFIG_OPENPAX_SOFTMODE) goes before sysctl_subsys_table at its new location, and the register_sysctl_init("kernel/pax", pax_table) call goes into the moved sysctl_init_bases(). The added lines are identical to the original; only their position changed.
• use maximum supported mmap rnd entropy by default, arch/Kconfig.
  • Collided with: 8cdae75cebe0 arch/Kconfig: fix dead conditions by removing dead options, which deleted ARCH_MMAP_RND_BITS_DEFAULT and ARCH_MMAP_RND_COMPAT_BITS_DEFAULT and their always-false default ... if ... lines.
  • Kept: upstream's removal, plus the downstream change itself (default ARCH_MMAP_RND_BITS_MIN → default ARCH_MMAP_RND_BITS_MAX, and the same for COMPAT). The removed lines never applied (an int used as a condition is always false), so the resolved value is the same as before.
  • Results: x86_64 resolves to 32 (the max). arm64 resolves to 28, from the arch-specific default in arch/arm64/Kconfig (ac9de62b1902, already in the old base). That is unchanged from the old tip.
• 9p/xen: reconnect to the backend on resume, net/9p/trans_xen.c.
  • Collided with:
    • b3d07d64832c 9p/xen: Use array for data rings: rings became a fixed rings[XEN_9PFS_NUM_RINGS] member, and the kzalloc_objs/kfree(priv->rings) calls were removed.
    • 7b6f2e3c29fb 9p/xen: drain response work after unbinding IRQ (Fixes:, Cc: stable): cancel_work_sync() now runs after unbind_from_irqhandler().
  • Kept: upstream's fixed array, so no allocation and no if (priv->rings) guard. xen_9pfs_front_free() now calls xen_9pfs_front_free_rings() unconditionally.
  • Kept: the stable fix's ordering (unbind the IRQ, then cancel_work_sync()) inside the downstream xen_9pfs_front_free_rings(). That function is also what the resume/disconnect path uses, so that path gets the fix too.
  • Added the downstream fields ring_order, rings_sem and connected, and the init_rwsem()/ring_order setup in xen_9pfs_front_init().
  • The reconnect logic does not depend on rings being a pointer: it re-allocates the per-ring resources into the same array. This is the one commit whose own +/- lines changed, because its original diff contained the kzalloc_objs/kfree lines and the old cancel_work_sync() position.
• 9p/xen: carry the 9P session across a restore, net/9p/trans_xen.c.
  • Collided with:
    • 9b4cf60c6b73 9p/xen: validate the response size from the backend (Fixes:, Cc: stable).
    • b3d07d64832c again.
  • Kept: upstream's h.size < sizeof(h) || h.size > queued check first in p9_xen_response(), with the downstream P9_NOTAG control-reply branch after it. A malformed control reply now hits the check before the code does cons += h.size. In that case the control waiter gets -ETIMEDOUT through its existing wait_for_completion_timeout().
  • For the array conversion: dropped the commit's kzalloc_objs/kfree(priv->rings) lines, and kept its INIT_LIST_HEAD(&priv->session), init_completion(&priv->ctl_done) and xen_9pfs_front_session_free() additions.
  • The commit's other priv->rings uses (ring == priv->rings, XEN_9PFS_RING_SIZE(priv->rings)) work unchanged with the array, which decays to &priv->rings[0].
  • The checker lists this commit as context-moved only.

Dropped downstream commits

None.

Build fixes

None.

Upstream commits that meet the series

Fixes (Fixes:, Cc: stable, or a fix by description) and my reading of the final tree:

• 7b6f2e3c29fb 9p/xen: drain response work after unbinding IRQ: intact. xen_9pfs_front_free_rings() unbinds the IRQ, then runs cancel_work_sync(), then frees. The downstream disconnect path (schedule_work + flush_work under rings_sem, then free_rings) goes through the same function.
• 9b4cf60c6b73 9p/xen: validate the response size from the backend: intact, and it runs before the downstream control-reply branch (see conflicts).
• 4d183e6f1532 9p/xen: fix refcount leak in p9_xen_response() on wrong tag: intact (p9_req_put() in the wrong-tag branch).
• 241d46901226 9p: reject RERROR/RLERROR with zero errcode: intact in p9_check_errors(). The downstream additions to net/9p/client.c are pure additions. The downstream Xen control path has its own copy of the issue (see Needs a decision).
• 2acd800de882 9p: fix caches_show() out-of-bounds write: intact. Downstream only adds the separate features_show attribute.
• 7fb9bd365905 9p: fix privport option setting wrong RDMA field: intact. Downstream adds only Opt_tag.
• 0f4a9e682f7f xattr: always invoke cap_convert_nscap() for security.capability writes: intact. Downstream adds only pax_getxattr(), which reads a user. xattr.
• 1c8f6308e557 iommu/dma: Catch scatterlist length overflows, fdd81f15fc43 iommu/dma: Clean up redundant MSI cookie check: intact. Downstream only adds the xen_iommu_manages_iova() check in iova_reserve_iommu_regions().
• 228e21764b38 Drivers: hv: Run VMBus kexec cleanup from syscore shutdown: intact. It reaches the nested-on-Xen mode semantically (see Needs a decision).
• dd57772e36f7 Drivers: hv: vmbus: Check ACPI companion before use: intact. The downstream hunks in vmbus_bus_init()/vmbus_exit() are elsewhere.
• 278b2abf660a init/bootconfig: pass init arguments in documented order, 51e766bcd35e init/main: fix false-positive kernel panic on environment variable overwrite, b82ed0e3a1da init/main: fix off-by-one in argv_init cleanup: intact. Downstream only adds pax_softmode and its __setup.
• 68cb098eadda mm/vma: avoid broken uffd merge on mremap, 7135a05838e8 mm/vma: avoid spurious write locks when mm->mm_lock_seq overflows, dc0b17144d62 mm/vma: don't remove VMA from rmap if pgoff unchanged, 5728d3523f12 memblock: reject non-page-aligned reserve_mem regions, 8bb0279930cc 9p: skip intermediate directory entry name copy in p9dirent_read(): none of them touch the downstream lines. The downstream changes in mm/ are limited to map_deny_write_exec(), brk(), arch_randomize_brk(), create_init_stack_vma() and one include, and upstream did not change those functions' contracts.
• 6eecb67b69af xen/grant-table: stop setting PG_private on pages for grant mapping: downstream gnttab_alloc_pages_node() goes through gnttab_pages_set_private()/gnttab_pages_clear_private(), so it picks up the new behaviour. A tree-wide grep finds no PagePrivate/SetPagePrivate/ClearPagePrivate use in drivers/xen or arch/x86/xen.

Semantic checks I ruled out:

• 2690d4156b51 iommu/hyperv: Add para-virtualized IOMMU support for Hyper-V guest: it hooks x86_init.iommu.iommu_init only from hyperv_init(). The nested-on-Xen path uses its own init (arch/x86/hyperv/hv_init.c, called from xen_hyperv_init()), so it cannot activate next to the Xen PV-IOMMU.
• 118bdac10546 Drivers: hv: Add logical device ID registry for vPCI devices: pci-hyperv now registers each bus in an rhashtable that hv_common_init() sets up. The nested-on-Xen init calls hv_common_init(), so the table is there.
• 1ae140d0f272 iommu: Make iommu-dma helpers private: xen-iommu.c already includes iommu-priv.h, and the build passes. dma-iommu.c now includes iommu-priv.h twice (once from upstream, once from downstream iommu/dma: Don't reserve PCI windows under a paravirtual IOMMU). That is harmless because the header is guarded, and I left it to keep the downstream commit unchanged.
• 8cdae75cebe0 arch/Kconfig: fix dead conditions by removing dead options: no reference to the removed symbols remains in the tree or in kernel-build.sh.

Other upstream commits that touch shared files (refactors or features, no fix tag; no interaction found beyond the above):
9eb9b583ea35 9p: remove duplicated assignment in v9fs_fill_super(), 33625427a382 net/9p: add vsock transport (a new p9_trans_module; the downstream share_client field defaults to false for it), 5852cdf0006f net/9p: fix typos in comments, 14a5c975b138, 38564710f443, 6a9ef02c60bf, 72a993449cb0, 44debd840ec9, c911e7ebebf5, 94c86564538e, 88d77002e1a1, 9201d0f5b9d5, 7fdbc26b69c0, b7b4d8f37a4f, 4852f3421456, 9cae38dc11da, 86a779c53204, f85eb0656c40, e59c9a971a9f, 4b019e056f6c, 35e340a47888, 47e725702b0b, 69d38c792c53, 2e83e2ce34ff, c2d4ccfbba3f (mm/vma and arch/Kconfig), 56fb075b77f8 mshv: Redesign hypervisor memory deposit logic, d0ec95a8a4e7 hv_netvsc: Advertise the SR-IOV capability for CoCo VMs, 28d5df7b7274, 537ec2b15fdd, 681f3b68f435 (KVM docs and Kconfig), 0bf031ba8c49, 42eed9bb9ca4 (iommu Kconfig/Makefile), 641a9b9cc697, 95d2fec40c48 (dma-mapping), 084100a1b579, aabe6e1b36ce, 677f83795fdf, 958c01049e0a, 10823ced2f18, 8ebd2eb87f50 (init/bootconfig/kho), 443bea2f71c5, acd19f2c56f2, 242bac52294e, d08ab285b096, 2bfbb09b505c (sysctl; pax_table is a scalar proc_dointvec entry, so the vector-handling changes do not affect it), bbe5d3b3d402, f000a06da2a5, abaa0835b4f3, 264d8fd2794f, 799203afd298, e3e7a85730a4 (kernel-parameters.txt).

Builds

• x86_64: pass. Edera host config with CONFIG_XEN_IOMMU, CONFIG_HYPERV, CONFIG_HYPERV_PVIOMMU, CONFIG_NET_9P_XEN and CONFIG_OPENPAX_SOFTMODE all =y; net/9p/trans_xen.o and kernel/sysctl.o were built.
• arm64: pass (defconfig plus the downstream features; net/9p/trans_xen.o was built).

Superseded by #93.