Commit graph

1,462,772 commits

Author SHA1 Message Date
Daniel Borkmann
96fda937b4 selftests/net: Use public NetDrvContEnv API in nk_qlease fixtures
Expose the netkit host ifname as a public attribute nk_host_ifname
(symmetric with the already-public nk_guest_ifname), rename _attach_bpf
to a public attach_bpf, and add a public detach_bpf helper that
encapsulates the tc-filter teardown bookkeeping. Switch the fixtures
to this public API. No functional change and keeps pylint happy.

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://patch.msgid.link/20260614102607.863838-3-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:58:01 -07:00
Daniel Borkmann
bc5c25c8f6 selftests/net: Move netkit lease hw setup into per-test fixtures
The HW counterpart of nk_qlease.py was carrying its lease setup in main()
and stashing src_queue / nk_queue / nk_*_ifname on cfg, which had drawbacks
called out during the review at [0].

This is the deferred half of the cleanup that landed in commit e254ffb950
("selftests/net: Split netdevsim tests from HW tests in nk_qlease") which
was the SW counterpart of nk_qlease.py.

While at it, convert the open-coded "ip netns exec" prefixes in the test
bodies over to the ns= argument of cmd() / bkg().

Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: Bobby Eshleman <bobbyeshleman@meta.com>
Link: https://lore.kernel.org/netdev/20260408162238.16709090@kernel.org/ [0]
Link: https://patch.msgid.link/20260614102607.863838-2-daniel@iogearbox.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:58:00 -07:00
Linus Torvalds
6b617c8258 pwm: Changes for v7.2-rc1
The usual mixture of minor fixes, a few cleanups, a new driver and dt
 updates for the pwm subsystem.
 
 Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus, Ronaldo
 Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual changes and
 Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski and Rob
 Herring for reviews and acks.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmovj1UACgkQj4D7WH0S
 /k4ATQf/YNPhLsDzLj0q7VM4wmMdBkX5s8e1yRAu4rRKMevWGP041MQMKxSiYU5k
 7vSEvxGaK2c5nmM6Iop6KJ1+wkL3fQNG+o2e5iOyedgFlayoHTE/vMOsooLPyJ7G
 thKFRQYqXenMtetY9n2fHaOtHayid/JWfZ1lQ9dlf8RDS1eN8dlgR/E4pNL5HUCv
 n3McnhbBxUrxpQaSeTfBRGwVahCORcS01srlLeT/VXlCHVGAwIZu/qtWTlHH7jXZ
 JO3iKxWlcUHvgt8BYxjpio3gYB9LZhunL23FtIHg48+HjYLyRS+JD2SYSWV2FZ+l
 0oRKImnotlW2zeFskp8VIqReUrJMgg==
 =4Uq3
 -----END PGP SIGNATURE-----

Merge tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull pwm updates from Uwe Kleine-König:
 "The usual mixture of minor fixes, a few cleanups, a new driver and dt
  updates for the pwm subsystem.

  Thanks to Chen Ni, Devi Priya, Manish Baing, Maurice Hieronymus,
  Ronaldo Nunez, Rosen Penev, Shiji Yang and Yixun Lan for the actual
  changes and Bjorn Andersson, Conor Dooley, Frank Li, Michal Wilczynski
  and Rob Herring for reviews and acks"

* tag 'pwm/for-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  pwm: th1520: Remove requirement for mul_u64_u64_div_u64_roundup
  dt-bindings: pwm: stmpe: Drop legacy binding
  pwm: pca9685: Use named initializers for struct i2c_device_id
  pwm: pxa: Add optional bus clock
  dt-bindings: pwm: marvell,pxa-pwm: Add SpacemiT K3 PWM support
  pwm: ipq: Add missing module description
  pwm: stm32: Make use of mul_u64_u64_div_u64_roundup()
  pwm: Consistently define pci_device_ids using named initializers
  pwm: Driver for qualcomm ipq6018 pwm block
  pwm: imx27: Fix variable truncation in .apply()
  pwm: mediatek: correct mt7628 clock source setting
  pwm: mediatek: set mt7628 pwm45_fixup flag to false
  pwm: atmel-tcb: Remove unneeded semicolon
2026-06-16 07:26:47 +05:30
Linus Torvalds
fd1878584d chrome-platform-firmware: Updates for v7.2
* Improvements
 
   - Add bound checks when iterating the coreboot table.
   - Skip failing entries only instead of aborting the whole device
     populate from the coreboot table.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQS0yQeDP3cjLyifNRUrxTEGBto89AUCai9pAxMcdHp1bmdiaUBr
 ZXJuZWwub3JnAAoJECvFMQYG2jz0Al8A/2+K6Up3CzuMZQyDJDOwkFb4Qx4CxfFu
 iSecYI5xvUAqAQC28M9Tlg73QBl88ZOzcR9WGE8b7P+sW4UQ/Z8BQ1RTBg==
 =HJUM
 -----END PGP SIGNATURE-----

Merge tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome-platform firmware updates from Tzung-Bi Shih:

 - Add bound checks when iterating the coreboot table

 - Skip failing entries only instead of aborting the whole device
   populate from the coreboot table

* tag 'chrome-platform-firmware-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  firmware: google: Skip failing entries instead of aborting populate
  firmware: google: Add bounds checks in coreboot_table_populate()
2026-06-16 07:21:48 +05:30
Linus Torvalds
2b5f5609ae chrome-platform: Updates for v7.2
* Improvements
 
   - Use named initializers for struct i2c_device_id.
 
 * Fixes
 
   - Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs.
   - Check for the presence of ACPI_COMPANION() for drivers converted
     from acpi_driver to platform_driver to avoid issues where
     device_match_driver_override() might forcibly match the driver to
     the device.
   - Fix a possible UAF in cros_ec_chardev.
   - Prevent build for big-endian systems as CHROME_PLATFORMS drivers are
     only running and testing under little-endian systems.
 
 * Cleanups
 
   - Drop some redundant bits in cros_kbd_led_backlight and Kconfig.
 -----BEGIN PGP SIGNATURE-----
 
 iIkEABYKADEWIQS0yQeDP3cjLyifNRUrxTEGBto89AUCai9lxRMcdHp1bmdiaUBr
 ZXJuZWwub3JnAAoJECvFMQYG2jz04cYBALQW7+ddzPPKSShIxACyFsdMV7+DvfUT
 QH8RjhxrYDrjAQC+LGgyy14jGngfuo/mPjEuefuqdPwT2EBDlGXRnLYNDg==
 =lFBr
 -----END PGP SIGNATURE-----

Merge tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux

Pull chrome-platform updates from Tzung-Bi Shih:
 "Improvements:

   - Use named initializers for struct i2c_device_id

  Fixes:

   - Fix a probe race between cros_ec_sensorhub and cros_ec_sysfs

   - Check for the presence of ACPI_COMPANION() for drivers converted
     from acpi_driver to platform_driver to avoid issues where
     device_match_driver_override() might forcibly match the driver to
     the device

   - Fix a possible UAF in cros_ec_chardev

   - Prevent build for big-endian systems as CHROME_PLATFORMS drivers
     are only running and testing under little-endian systems

  Cleanups:

   - Drop some redundant bits in cros_kbd_led_backlight and Kconfig"

* tag 'chrome-platform-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux:
  platform/chrome: Prevent build for big-endian systems
  platform/chrome: Remove superfluous dependencies from CROS_EC
  platform/chrome: cros_ec_chardev: Introduce rwsem for protecting ec_dev
  platform/chrome: cros_ec_chardev: Add event relayer
  platform/chrome: cros_ec_chardev: Move data to chardev_pdata
  platform/chrome: cros_ec_chardev: Introduce chardev_data
  platform/chrome: Use named initializers for struct i2c_device_id
  platform/chrome: wilco_ec: event: Check ACPI_COMPANION()
  platform/chrome: chromeos_tbmc: Check ACPI_COMPANION()
  platform/chrome: chromeos_privacy_screen: Check ACPI_COMPANION()
  platform/chrome: cros_kbd_led_backlight: Drop CONFIG_MFD_CROS_EC_DEV ifdeffery
  platform/chrome: cros_kbd_led_backlight: Pass keyboard_led as parameter
  platform/chrome: cros_kbd_led_backlight: Drop max_brightness from driver data
  platform/chrome: Resolve kb_wake_angle visibility race
2026-06-16 07:19:53 +05:30
Arnaldo Carvalho de Melo
d669529868 perf trace: Guard __probe_ip suppression with evsel__is_probe()
trace__fprintf_tp_fields() compares every field name against
"__probe_ip" for all tracepoint events, but this field is only
implicitly added by the Ftrace subsystem to bare dynamic probes.

Add an evsel__is_probe() check before the strcmp so the string
comparison is skipped entirely for non-probe events.

Reviewed-by: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-15 22:17:41 -03:00
Arnaldo Carvalho de Melo
9212e395c6 perf evsel: Add lazy-initialized probe type detection helpers
Several places in perf need to check whether an evsel is a kprobe or
uprobe, which requires looking up the PMU by name via evsel__find_pmu().
This lookup walks the PMU list each time, which is wasteful when the
same evsel is checked repeatedly.

Add evsel__is_kprobe(), evsel__is_uprobe(), and evsel__is_probe() that
resolve the probe type on first call via evsel__pmu_name() and cache
the result in a 3-bit field (probe_type) in struct evsel.  The field
fits in existing padding after the bool fields, so struct size does not
grow.

The enum uses PROBE__UNKNOWN (0) as the uninitialized sentinel —
explicitly set in evsel__init() — so the lookup happens on first use.
PROBE__NOPE (1) caches "not a probe" to avoid repeated negative lookups.

PMU-based probes (kprobe/uprobe PMU) are detected by PMU name.
Ftrace-based dynamic probes (created via tracefs, reported as PMU
"tracepoint") are detected by the __probe_ip field that the kernel
adds to all dynamic probe formats.  This covers kprobes, uprobes, and
fprobes regardless of their group/system name.

Cc: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-16 16:35:43 -03:00
Arnaldo Carvalho de Melo
e22a422854 perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field()
When building without libtraceevent (NO_LIBTRACEEVENT=1), evsel__field()
and evsel__common_field() are declared but never defined, causing link
errors in any code path that references them.

Add inline stubs that return NULL when HAVE_LIBTRACEEVENT is not defined,
matching the pattern used by other evsel accessor functions.

Cc: Aaron Tomlin <atomlin@atomlin.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-16 16:37:09 -03:00
Arnaldo Carvalho de Melo
542e88a4c6 perf cs-etm: Reject CPU IDs that would overflow signed comparison
metadata[j][CS_ETM_CPU] is a u64 from perf.data, but the comparison
with max_cpu casts it to (int).  A crafted value like 0xFFFFFFFF becomes
-1 after the cast, which compares less than max_cpu (0), so the queue
array is never sized to accommodate it.  When the value is later passed
to cs_etm__get_queue(), it indexes queue_array with the original large
value, causing an out-of-bounds access.

Validate that CS_ETM_CPU fits in an int before using it in the signed
comparison.

Fixes: 57880a7966 ("perf: cs-etm: Allocate queues for all CPUs")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: James Clark <james.clark@arm.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:29:07 -03:00
Arnaldo Carvalho de Melo
4a7500d772 perf c2c: Free format list entries when releasing c2c hist entries
c2c_hists__init() calls hpp_list__parse() which allocates and registers
format entries on hists->list.  When c2c_he_free() destroys a c2c hist
entry, it deletes the histogram entries and frees the hists container but
never unregisters the format list entries, leaking them.

Call perf_hpp__reset_output_field() before freeing the hists to properly
unregister and free all format entries.

Fixes: f485e33c4543ac31 ("perf c2c report: Add cacheline hists processing")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:29:03 -03:00
Arnaldo Carvalho de Melo
033e85edfb perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
bpil_offs_to_addr() converts offsets stored in perf.data's
bpf_prog_info_linear structure into heap pointers by adding the offset
to the data allocation base.  The offsets come from untrusted file input
and are not validated against data_len.

If an offset exceeds data_len, the computed address points outside the
allocated data buffer.  Callers like synthesize_bpf_prog_name() then
dereference prog_tags[sub_id] or func_info pointers, reading arbitrary
heap memory.

Add a bounds check: when an offset exceeds data_len, zero the field
and skip the conversion.  This prevents out-of-bounds pointer
construction from crafted perf.data files.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 6ac22d036f ("perf bpf: Pull in bpf_program__get_prog_info_linear()")
Cc: Dave Marchevsky <davemarchevsky@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:29:00 -03:00
Arnaldo Carvalho de Melo
2d6ea08750 perf bpf: Reject oversized BPF metadata events that truncate header.size
bpf_metadata_alloc() computes event_size from the number of BPF metadata
variables and stores it in header.size, which is __u16.  With 204 or
more .rodata variables prefixed "bpf_metadata_", event_size exceeds
65535 and silently truncates.

The truncated header.size causes synthesize_perf_record_bpf_metadata()
to allocate a buffer sized by the truncated value, then memcpy the full
event data into it — a heap buffer overflow.

Add a check that event_size fits in __u16 before proceeding.  BPF
programs with that many metadata variables are exotic enough that
silently dropping the metadata is acceptable.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: ab38e84ba9 ("perf record: collect BPF metadata from existing BPF programs")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Blake Jones <blakejones@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:57 -03:00
Arnaldo Carvalho de Melo
10b3c3d63e perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
synthesize_bpf_prog_name() computes a pointer into the func_info array
using sub_id * info->func_info_rec_size without validating either value.
Both come from perf.data and are untrusted:

- A func_info_rec_size smaller than sizeof(struct bpf_func_info) means
  the finfo pointer would reference a truncated entry, reading past it
  into adjacent data.

- A sub_id >= nr_func_info computes an offset past the func_info buffer,
  causing an out-of-bounds read.

Add bounds checks for both values before computing the pointer offset.
When validation fails, fall through to the non-BTF name path instead
of reading garbage.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 7b612e291a ("perf tools: Synthesize PERF_RECORD_* for loaded BPF programs")
Cc: Song Liu <songliubraving@fb.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:53 -03:00
Arnaldo Carvalho de Melo
500f5dd0a8 perf sched: Replace (void*)1 sentinel with proper runtime allocation
map__findnew_thread() marks color-pid threads by storing (void*)1 as
the thread private data via thread__set_priv().  This sentinel value
causes two problems:

1. thread__get_runtime() returns (void*)1 as a struct thread_runtime
   pointer.  Any field access (e.g. tr->shortname) dereferences address
   1, which is an unmapped page — immediate segfault.

2. cmd_sched() registers free() as the thread priv destructor, so thread
   cleanup calls free((void*)1) — undefined behavior that corrupts the
   heap on many allocators.

Fix by adding a 'color' flag to struct thread_runtime and allocating a
real runtime struct for color-pid threads.  thread__has_color() now
checks the flag instead of relying on priv being non-NULL.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 58a606149c ("perf sched: Avoid union type punning undefined behavior")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:50 -03:00
Arnaldo Carvalho de Melo
cfafef390c perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
hwmon_pmu__describe_items() checks 'if (fd > 0)' after openat(), which
incorrectly rejects fd 0.  While fd 0 is normally stdin, if stdin has
been closed (common in daemon/service contexts), the kernel reuses fd 0
for the next open.  With fd > 0, the sysfs file is not read and the fd
is leaked.

Change to 'if (fd >= 0)' to match the standard openat() error check.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 53cc0b351e ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:47 -03:00
Arnaldo Carvalho de Melo
7b0df6f4d4 perf tools: Use snprintf() for root_dir path construction
get_kernel_version() in machine.c and dso__load_guest_kernel_sym() in
symbol.c use sprintf() to construct paths by prepending root_dir to
"/proc/version" and "/proc/kallsyms" respectively.  Both write into
PATH_MAX stack buffers, but root_dir comes from --guestmount or KVM
configuration and is not length-checked.  A root_dir at or near
PATH_MAX causes a stack buffer overflow.

Switch to snprintf() with sizeof(path) to prevent overflow.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: a1645ce12a ("perf: 'perf kvm' tool for monitoring guest performance from host")
Cc: Zhang Yanmin <yanmin_zhang@linux.intel.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:44 -03:00
Arnaldo Carvalho de Melo
d2c6069d68 perf dso: Set error code when open() fails on uncompressed fallback path
filename__decompress() has an early return for files that are not
actually compressed, where it calls open() directly.  When open()
fails, the function returns -1 but never sets *err.  The caller chain
(decompress_kmodule → dso__decompress_kmodule_path → dso__get_filename)
then reads *dso__load_errno(dso) to set errno, but that field was never
populated, so errno gets a stale or zero value.

With errno=0, __open_dso() computes fd = -errno = 0, which is non-
negative, so callers treat fd 0 (stdin) as a valid DSO file descriptor.

Set *err = errno when open() fails on the uncompressed path, matching
the error handling on the compressed path at line 354.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 8b42b7e5e8 ("perf tools: Add is_compressed callback to compressions array")
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:40 -03:00
Arnaldo Carvalho de Melo
f973e52a99 perf dso: Fix heap overflow in dso__get_filename() on decompressed path
dso__get_filename() allocates name with malloc(PATH_MAX), but the
dso__filename_with_chroot() path replaces name with an asprintf'd
exact-size string (e.g. 8 bytes for "/a/b.ko").  When the DSO needs
decompression, dso__decompress_kmodule_path() writes the temp path
("/tmp/perf-kmod-XXXXXX", 22 bytes) into newpath, and strcpy(name,
newpath) overflows the smaller allocation.

Replace the strcpy with strdup(newpath) + free(name) so the buffer
is always correctly sized for its content.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 1d6b3c9ba7 ("perf tools: Decompress kernel module when reading DSO data")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:37 -03:00
Arnaldo Carvalho de Melo
063c647b24 perf symbols: Break infinite loop on zero-filled notes in sysfs__read_build_id()
sysfs__read_build_id() iterates ELF note headers from sysfs files in a
while(1) loop.  If the file contains a zero-filled note header (both
n_namesz and n_descsz are 0), the code computes n = namesz + descsz = 0
and calls read(fd, bf, 0).  read() with count 0 returns 0, which
matches the expected (ssize_t)n value, so the error check passes and
the loop repeats — reading the same zero bytes and spinning forever.

This can happen with corrupted or zero-padded sysfs pseudo-files.

Add a check for n == 0 before the read, since no valid ELF note has
both name and description of zero length.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: f1617b4059 ("perf symbols: Record the build_ids of kernel modules too")
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:28:31 -03:00
Arnaldo Carvalho de Melo
2a37165443 perf symbols: Validate p_filesz before use in filename__read_build_id()
filename__read_build_id() stores ELF p_filesz in a ssize_t variable.
A crafted 32-bit ELF with p_filesz = 0xFFFFFFFF produces ssize_t value
-1.  The comparison `p_filesz > buf_size` evaluates false because signed
-1 is less than any non-negative buf_size, so the realloc is skipped and
buf remains NULL.

The subsequent read(fd, NULL, -1) returns -1, which equals p_filesz,
passing the error check.  read_build_id() then dereferences the NULL
buffer.

Add an explicit check for p_filesz <= 0 before using the value,
catching both zero-length and sign-wrapped negative sizes from crafted
ELF files.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: ba0b7081f7 ("perf symbol-minimal: Fix ehdr reading in filename__read_build_id")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:25:14 -03:00
Arnaldo Carvalho de Melo
081b387c73 perf symbols: Fix bswap copy-paste error for 32-bit ELF p_filesz
filename__read_build_id() byte-swaps 32-bit ELF program headers on
cross-endian files, but line 178 passes p_offset to bswap_32() instead
of p_filesz:

  hdrs.phdr32[i].p_filesz = bswap_32(hdrs.phdr32[i].p_offset);

This clobbers p_filesz with the already-swapped p_offset value.  The
64-bit path on line 182 is correct and swaps p_filesz from p_filesz.

The consequence is that the PT_NOTE segment read uses the wrong size,
which can cause either a short read (missing the build-id) or an
oversized read (reading past the segment into adjacent data).

Fix by swapping the correct field.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: fef8f648bb ("perf symbol: Fix use-after-free in filename__read_build_id")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2026-06-17 08:25:03 -03:00
Jakub Kicinski
987257c49b Merge branch 'ionic-expose-more-port-stats-to-ethtool'
Eric Joyner says:

====================
ionic: Expose more port stats to ethtool [part]

The primary aim of this patchset is to support the reporting of new port
statistics (and one old one) that firmware sends to the driver. A scheme
for these extra stats is introduced in order to prevent devices that
don't support these new statistics from unconditionally setting them or
reporting them in ethtool.
====================

Link: https://patch.msgid.link/20260614205303.48088-1-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:15:12 -07:00
Eric Joyner
3277e605ac ionic: Get "link_down_count" ext link stat from firmware
The number of times that link has gone down at the port level is tracked
by the firmware and sent to the driver via regular DMA writes to an
instance of struct ionic_port_status in the driver's memory.

This statistic was never reported in favor of a driver-derived stat, but
doing it in the driver was never necessary since firmware had been
reporting it the whole time. Since it would be more accurate and true to
the description of the statistic to get this count at the PHY level,
replace the driver-calculated statistic with one derived from the
firmware one and remove the driver-calculated one entirely.

The stat reported by the ethtool .get_link_ext_stats() handler is
normalized to 0 on driver load and any device resets that require the
driver to rebuild state while also handling overflows.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-5-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:15:08 -07:00
Eric Joyner
cb683ff6ee ionic: Report "rx_bits_phy" stat to ethtool
This stat contains the number of total bits that the PHY has received;
it's useful for BER calculations. Add it to the ethtool stats output.

However, since this is one of the new "extra port stats", it's reported
in a different manner than the existing port stats and only
conditionally added to the ethtool stats output list: both the
DEV_CAP_EXTRA_STATS capability must be supported by the firmware, and
the firmware must set the value of the statistic to something other than
IONIC_STAT_INVALID.

To help support this scheme, the extra port stats region is initialized to
0xff's/IONIC_STAT_INVALID by the driver, to ensure the statistics that
the driver knows about but the firmware does not are still invalid
to the driver.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-4-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:15:08 -07:00
Eric Joyner
433bc50081 ionic: Update ionic_if.h with new extra port stats
Add a new structure to report additional statistics from the firmware to
struct ionic_port_info. This new struct currently only contains FEC
related statistics, but any new port-level statistics collected by the
firmware would go into it.

The new structure is located in the same area as the unused
ionic_port_pb_stats structure, so this patch also removes that and its
supporting enumerations since they was never used in this driver.

Finally, to indicate firmware support for the new structure, introduce a
new device capability that the driver can use to see if the attached
device supports reporting these extra stats.

Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-3-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:15:08 -07:00
Brett Creeley
7678e69079 ionic: Fix check in ionic_get_link_ext_stats
The current check will fail if SR-IOV is not initialized for the
physical function; this is because is_physfn is 0 if sriov_init() isn't
run or fails. Change the check that prevents getting the link down count
to use is_virtfn instead so that VFs don't get this functionality, which
was the original intent.

Fixes: 132b4ebfa0 ("ionic: add support for ethtool extended stat link_down_count")
Signed-off-by: Brett Creeley <brett.creeley@amd.com>
Signed-off-by: Eric Joyner <eric.joyner@amd.com>
Link: https://patch.msgid.link/20260614205303.48088-2-eric.joyner@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 18:15:08 -07:00
Martin K. Petersen
4f87e9068b Merge branch 7.1/scsi-fixes into 7.2/scsi-staging
Pull in outstanding commits from 7.1 branch.

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
2026-06-15 21:01:30 -04:00
Linus Torvalds
b082086174 * Add TDX module update support
* Make kexec and TDX finally place nice together
  * Put TDX error codes into a single header
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVgUACgkQaDWVMHDJ
 krDwsw/9FKXndYdeSc7P8sJwjSlc9U4PFy/6rdUfnYCP1c2BTeVqNxZvCz+T9E4V
 Ld4UjjTLCbEq1uQ2UdYugpLnSKSNzf6MEp06Tsq2cRlEcPQBLGaACo+7dnBrUf6g
 zVUY0lPh1Jlxa+FBzMLf/H1qyUGl/Lv8msmgrC9fHHwQgsPYMgKUU6t72ScRG6FA
 kUk0crzI1DlSpFFVbXuRIpZSmLFPgyx5TNkteGJrP6q3iR6zYuc30MQsV2GalFrv
 qrn4cz3EmW0vousqpg7EA6J7okTUem/iswbxbQnpR4AMdJ7NwkKfa/OvHa6UB9UL
 Nb5gE7lxplKOlJKfeGjrL6ABazpwsk0J4oS9r2GoWDfs30ji3TX5ixVvJ1KCFAFZ
 dEkS1SazNjAWuDWuptVbu3+4DV34XSUg+kvcCXNTlOHz5KVg5ASzjF0QFvXexjCD
 BhcIqJ3OI8VtL4AI+HXg+GTpHOUYtGct/Y+5gB16VvoSuX9vNOPBYx2M9Q4Nhb/C
 U9eM7wqaS6lxX4UGId0ZgrNwHROreTEeGBScn1q1Rm7B6qJgeYo7wrzuKXCyRgcb
 /evbcZ1DWJTXEORsJobzNiXHQWBtAEs4rLycOKAGx8//kD7vEmy2itslPlEaSgFq
 jvoAHRNpiE3VW/hItB8WFTgWxiKaIz624gNrMjI2RYI/JSNhKVo=
 =Y3yy
 -----END PGP SIGNATURE-----

Merge tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 TDX updates from Dave Hansen:
 "There are a few cleanups, and some changes that should allow TDX and
  kexec to coexist nicely.

  The biggest change, however, is support for updating the TDX module
  after boot, just like CPU microcode. TDX users really want this
  because it lets them do security updates without tearing things down
  and rebooting.

   - Add TDX module update support

   - Make kexec and TDX finally place nice together

   - Put TDX error codes into a single header"

* tag 'x86_tdx_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip: (30 commits)
  x86/virt/tdx: Document TDX module update
  x86/virt/tdx: Enable TDX module runtime updates
  x86/virt/tdx: Refresh TDX module version after update
  coco/tdx-host: Lock out module updates when reading version
  x86/virt/seamldr: Add module update locking
  x86/virt/tdx: Restore TDX module state
  x86/virt/seamldr: Initialize the newly-installed TDX module
  x86/virt/seamldr: Install a new TDX module
  x86/virt/tdx: Reset software states during TDX module shutdown
  x86/virt/seamldr: Shut down the current TDX module
  x86/virt/seamldr: Abort updates after a failed step
  x86/virt/seamldr: Introduce skeleton for TDX module updates
  x86/virt/seamldr: Allocate and populate a module update request
  coco/tdx-host: Implement firmware upload sysfs ABI for TDX module updates
  coco/tdx-host: Don't expose P-SEAMLDR information on CPUs with erratum
  coco/tdx-host: Expose P-SEAMLDR information via sysfs
  x86/virt/seamldr: Add a helper to retrieve P-SEAMLDR information
  x86/virt/seamldr: Introduce a wrapper for P-SEAMLDR SEAMCALLs
  coco/tdx-host: Expose TDX module version
  coco/tdx-host: Introduce a "tdx_host" device
  ...
2026-06-16 06:26:12 +05:30
Linus Torvalds
7d36844ae7 * Fix freeing of PMD-sized vmemmap pages
* Update comment about pgd_list
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVdwACgkQaDWVMHDJ
 krARXA//c+FCH86tcGuZndWmebCP5ZuPFDkZMQuK53cg2hZq6OHUSxDL989iq/AO
 YMfKR+CFJtpMd3fiLiASbks+mctWLJYjX1eWFvjtGaZPsH4u0CdlbPkYsfY5OKcA
 NYeZ9Pbag/DYDu/SvSylDaYR0P1VgncaF4fhP5gH3YbhEU4rzNyrf6T+HBPz0B1h
 iXWre0QAkXLrx2pkKRx8h55uy+hNLjLfExD6tbMMxnOHtOVaBL+JHG8czBgv6P7F
 VrQ2vu8BKBqq8+rPGFVuolvGri2iM+hpddemKzc/wFHxP9oW7bLj9bieuoQk3R3p
 1ILhDF0rfwoTzgzw2wD3yJpzP5BNB+tqlOqnN+KUFK8w1l01I1dbzfz/Ib/ozH3O
 fAOLCAC9nlZ0VFozzPvpe3YHGI2feK/sW0Wh3X7YcfibmofpCHn8BkSgCo0cEjXs
 JkcMqyCPEyYQUwWvbV39yeMKUnfi447UQdr95q4QNxi8stozQewLN6r/Y4DnGuEi
 qZWzOSBGr3wCK25Tn0MF4vv0oVWb+4UFhF/79FkJBPZq78390XcmyYBC/tiWx8KJ
 qQPhpfk3TIga2mmQsq1qwr4am7XXwjmB6sZHaprV7LDq/YLFnJTsmhIsq0nicrYZ
 88S+XF94z/woCEUMaYjcp7E+bBUu5n4i2yWocu5yHwFd0pmuDGo=
 =tM/K
 -----END PGP SIGNATURE-----

Merge tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 mm updates from Dave Hansen:
 "There's a small comment fixup, followed by an actual bug fix. The bug
  fix is slightly new territory for us. It fixes a real regression, but
  it is from ~6.18 not a _new_ regression. It was mostly only biting
  folks doing hotplug memory testing. So, it was queued in here and held
  for the merge window instead of going via x86/urgent.

   - Fix freeing of PMD-sized vmemmap pages

   - Update comment about pgd_list"

* tag 'x86_mm_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/mm: Fix freeing of PMD-sized vmemmap pages
  x86: Update comment about pgd_list
2026-06-16 06:17:23 +05:30
Linus Torvalds
ee7a8593c0 * Move Rick Edgecombe to TDX maintainer
* Remove unused header
  * Ensure printf() validation in all configs
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEV76QKkVc4xCGURexaDWVMHDJkrAFAmowVYsACgkQaDWVMHDJ
 krCtFhAAjNOBz4+N7RHyG45U8AX5zLFSvKLia0SIEvgnprYNT7WJqFHDYLajRV4C
 62m6OBinY4NkG5tbwABOj4XsdYGC1S2tVOTqTxtvC/6FvsUE8gKkjYDL58fnFeST
 m1RCryPiDyrauc5mrN41pMvYIHE8Dgw+8Yor35RzZP1Nr4wwN5LtOPHmIZbz/QVj
 XVcheDNBQU4jRa5OnTnmx97spywTlT9JnWyO1F9gKkTwBA6+sl1tAd9FXsfxGw9t
 JWLJqPxpz/1G/gI13KOau6WkfwdPUxQioJ4ZIbO+C2UemUFYu+ZGwbdHnSVkdzdJ
 4xU6w3lS9MdprS01V7EQrwaZmsdH7z6lvoHsnwN2Wal+Sagt3Ukr/dEBWDlJmzTB
 +HfFFEmZL9UTPDoHGUoLOVEy4NafAwZZBDOciJe8K0qLGqg4S8xCw2W9LhfJGIGp
 W6fSYssmOJX40qFvDpLX6GOK/MEkCerqfUfcFFCaKd2ZGnM4qsKtfHxYLbHL1Soq
 TkWsC5hMWImi1tiuEdqDtPUODWiZ7k0HTN2C/9pI4IIUMUxdB3Jm3c43GuGsZNl0
 y9PGVq8uIZiRV8FAu8NBsPb65UzRNVFPH8WATxTK2mVsMqzGxwMpM5ROQ3pkiPu+
 DL1izUOADIYkxkvt00K5Lc5tOP29vCE6lKH5neXeZjhvfLEHb0U=
 =8iBm
 -----END PGP SIGNATURE-----

Merge tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull misc x86 updates from Dave Hansen:
 "These are the usual random pile, with the one exception of moving Rick
  over to be a TDX maintainer. Rick has been doing a great job with TDX
  contributions, especially on the host side of things. It's time to
  promote him to "M".

   - Move Rick Edgecombe to TDX maintainer

   - Remove unused header

   - Ensure printf() validation in all configs"

* tag 'x86_misc_for_7.2-rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  MAINTAINERS: Move Rick Edgecombe to TDX maintainer
  x86: Remove unnecessary architecture-specific <asm/device.h>
  x86/bug: Put HAVE_ARCH_BUG_FORMAT_ARGS WARN definitions inside __ASSEMBLER__
  x86/bug: Add printf() validation to HAVE_ARCH_BUG_FORMAT_ARGS WARNs
2026-06-16 06:10:22 +05:30
Linus Torvalds
c61f479852 - Remove redundant GHCB initialization guards in the SEV page state and SVSM
call paths now that the GHCB helpers handle early-boot fallback internally
 
 - Skip SNP initialization in the CCP driver immediately when the preparation
   step fails rather than proceeding to an operation that will certainly fail
 
 - Abort SNP preparation and return an error when not all CPUs are online,
   since the firmware enforces that every CPU enables SNP and will fail init if
   not
 
 - Simplify the VMM communication exception entry path by replacing separate
   kernel and user mode macros with a single handler that dispatches based on
   the current privilege level
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowORwACgkQEsHwGGHe
 VUqphg//VVXH3Svs2K5+++WQvavXDVwB5B+W4KA5WYYz3I77nmXgb2++aGSptGfy
 ckC8ESFwyRWRh6aaOMtWGdbTQryS9e72sqiZEphbAZCe2XwR/A0N60uUktUCGm1W
 3ce/VRkeTJI4LTkx3g+VSPTGzDpqfbwwTAJQZt8Ny8kooQCUH+VA7JvyLOYFvyTg
 4NtjP2MVTzjE1io9SpZdSAbG/wdn7l7cFI+xC1QXYKZBzHSK5e4vUwnSGd86lrCa
 2Q+zVcGcA7w2J6Obx4dNde5Y7AhGmYnhDxbFtNp9iUmG/o75LpVvP+8v7wshSGiL
 HjTsRy5tkjrF9MUNXZd6cwFQ9gs6wWAwxXUsPtfs2N8R6Ve0W9aR49MUp1sEFuKm
 hNgRLA7idSQ0RUSrL4f3c7Zx8ML6nXM2yRgE+4UTbr5/untHCqYunHelEIy1uay5
 2vbqJ5VzT+pfY9qZn+q41AM2E1+ZzLmXFuGPBSOU4G+dU0CoVo+OUrsKZh8Q/4Ff
 DajeiTW1+UidZyk2nb+HoX3DIa7jsUBeA3IGAQv8wK31jj3XhKwJTFPwPGkdjcpw
 iR35vPzZFh0JLm+AHGrjgLI2+DkWEKl3j6lxI94UxsugaqkywtPZ5XJhJC54YHS9
 iOwlpZK37eYy6zITx1+bwfzrW4oSsEZyYHkNgYJhU/RW4MrNJiU=
 =Wq1K
 -----END PGP SIGNATURE-----

Merge tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 SEV updates from Borislav Petkov:

 - Remove redundant GHCB initialization guards in the SEV page state and
   SVSM call paths now that the GHCB helpers handle early-boot fallback
   internally

 - Skip SNP initialization in the CCP driver immediately when the
   preparation step fails rather than proceeding to an operation that
   will certainly fail

 - Abort SNP preparation and return an error when not all CPUs are
   online, since the firmware enforces that every CPU enables SNP and
   will fail init if not

 - Simplify the VMM communication exception entry path by replacing
   separate kernel and user mode macros with a single handler that
   dispatches based on the current privilege level

* tag 'x86_sev_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/sev: Remove redundant ghcbs_initialized checks around __sev_{get,put}_ghcb()
  crypto/ccp: Skip SNP_INIT if preparation fails
  x86/sev: Do not initialize SNP if missing CPUs
  x86/entry: Zap the #VC entry user and kernel macros
2026-06-16 05:57:30 +05:30
Jakub Kicinski
1959005463 Merge branch 'net-dsa-mxl862xx-serdes-ports'
Daniel Golle says:

====================
net: dsa: mxl862xx: SerDes ports

Add support for the two SerDes PCS interfaces of the MxL862xx switch
ICs, which can both either be used to connect PHYs or SFP cages, or as
CPU port(s). 1000Base-X, 2500Base-X, 10GBase-R, 10GBase-KR, SGMII,
QSGMII and USXGMII (single 10G or quad 2.5G) are supported.

The firmware only added the API to directly control the PCS as of
version 1.0.84, so the PCS features are gated behind a version check.

As the driver is growing do some refactoring to break out the phylink
parts into mxl862xx-phylink.h.
====================

Link: https://patch.msgid.link/cover.1781319534.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 17:18:03 -07:00
Daniel Golle
13ea4d4888 net: dsa: mxl862xx: add support for SerDes ports
The MxL862xx has two XPCS/SerDes interfaces (XPCS0 for ports 9-12,
XPCS1 for ports 13-16). Each can operate in various single-lane modes
(SGMII, 1000Base-X, 2500Base-X, 10GBase-R, 10GBase-KR, USXGMII) or as
QSGMII or 10G_QXGMII providing four sub-ports per interface.

Implement phylink PCS operations using the firmware's XPCS API:

  - pcs_enable/pcs_disable: refcount the sub-ports sharing an XPCS
    and power it down once the last sub-port is released.
  - pcs_config: configure negotiation mode and CL37/SGMII advertising.
  - pcs_get_state: read link state and the link-partner ability word
    from firmware and decode using phylink's standard CL37, SGMII, and
    USXGMII decoders.
  - pcs_an_restart: restart CL37 or CL73 auto-negotiation.
  - pcs_link_up: force speed/duplex for SGMII.
  - pcs_inband_caps: report per-mode in-band status capabilities.

Register a PCS instance for each SerDes interface and
QSGMII/10G_QXGMII sub-ports during setup. Advertise the supported
interface modes in phylink_get_caps based on port number.

Firmware older than 1.0.84 lacks the XPCS API and instead configures
the SerDes itself, using defaults stored in flash. mac_select_pcs()
returns NULL in that case while the single-lane interface modes stay
advertised, so a CPU port keeps working in the firmware-configured
mode.

Lacking support for expressing PHY-side role modes in Linux only the
MAC-side of SGMII, QSGMII, USXGMII and 10G_QXGMII are implemented for
now.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Link: https://patch.msgid.link/736e4df02e4cb8c530c1670cbe7efac20b5d696d.1781319534.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 17:18:01 -07:00
Daniel Golle
7dab839724 net: dsa: mxl862xx: move API macros to mxl862xx-host.h
Move the MXL862XX_API_WRITE, MXL862XX_API_READ and
MXL862XX_API_READ_QUIET convenience macros from mxl862xx.c to
mxl862xx-host.h next to the mxl862xx_api_wrap() prototype they wrap.
This makes them available to other compilation units that include
mxl862xx-host.h, which is needed once the SerDes PCS code in
mxl862xx-phylink.c also calls firmware commands.

No functional change.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/914f57931e79cc3932a9f32813465c08d29cf4bf.1781319534.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 17:18:01 -07:00
Daniel Golle
c103433200 net: dsa: mxl862xx: move phylink stubs to mxl862xx-phylink.c
Move the phylink MAC operations and get_caps callback from mxl862xx.c
into a dedicated mxl862xx-phylink.c file. This prepares for the SerDes
PCS implementation which adds substantial phylink/PCS code -- keeping
it in a separate file avoids function-position churn in the main
driver file.

No functional change.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Link: https://patch.msgid.link/fb9336de94bef47a0834287cbca87954e5e4c795.1781319534.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 17:18:00 -07:00
Daniel Golle
937137db79 net: dsa: mxl862xx: store firmware version for feature gating
Query the firmware version at init (already done in wait_ready),
cache it in priv->fw_version, and provide MXL862XX_FW_VER_MIN()
for version-gated code paths throughout the driver.

MXL862XX_FW_VER() packs major/minor/revision into a u32 with
bitwise shifts so that versions compare with natural ordering,
independent of host endianness.

Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/91a26a8ffeaa2ce1729f98347e93e779973976bb.1781319534.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 17:18:00 -07:00
Linus Torvalds
97cc7dc16a - Move the zero-revision fixup for AMD microcode to the patch level
retrieval function and restrict it to Zen family processors, ensuring
   patch level arithmetic always operates on a valid revision
 
 - Fix an incorrect comment about which CPUID bit is checked when
   determining whether the microcode loader should be disabled
 
 - Add the latest Intel microcode revision data for a broad range of
   processor models and steppings and add the script which generates the
   header of minimum expected Intel microcode revisions
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowMfYACgkQEsHwGGHe
 VUq4jRAAiUoRmAPSgxfw6fNzn+VcH2pxRa987HtZM/teJO9dec2fswhnOsOdx1Y+
 hbQ1uxPdgZzowg2CJL/Il+QNGjpVkA0SaVbnlamX5bRMuEKdWXXawf0eeV3EMmmh
 f+LaN/jQ3+vuE5boSOh1tVGQOTPyuyOg977leXSPlXxyTMyrVuLAN6+Zs/qsuhSY
 vWTKY40E+1ZeDHCXcNtOhxKXR7tGjgGrjqLMx0bbs8z1DOP2OJpILHdgPB9igghb
 hg5uUSj2LTd+28/H0HIu5RqfI7/ulQPBmLFYmw6ENLSR4U3GEtg0gItZEXL6E8Dz
 UZVMqorpAMV41cPyBvStfK6R8cvGEe6m+iidmsTQDVvQWX9xnSNX1N+HV6Xr+fjN
 kuPZLEGhkmDRe8mup+n5t/wqw4iDFrfqhgPGgFN2fwDFcs9oJfAHTgMvpdvWGG/2
 hbME8PGWFv+N3Piy4GqROuVjcm0cbTTzdzWmWEZ8qO3OakSDC9vex5061/O5DmFB
 vI7QHanc3Xe3vuf20Jnbc8LFkw54zHBSITrguah0yJFsVqE4tktSsy3NIHLxdP87
 7e4oCzmP7oelCgxzvKyZiHzNtzrngGT9L0Nowcg9y/iibWzOkW8F9Ek5NqMaUyo4
 JEKXizudArM6oZUtk+E6CAhGotL1en/FhfBmungtaExA2BnCJtc=
 =KarZ
 -----END PGP SIGNATURE-----

Merge tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 microcode loader updates from Borislav Petkov:

 - Move the zero-revision fixup for AMD microcode to the patch level
   retrieval function and restrict it to Zen family processors, ensuring
   patch level arithmetic always operates on a valid revision

 - Fix an incorrect comment about which CPUID bit is checked when
   determining whether the microcode loader should be disabled

 - Add the latest Intel microcode revision data for a broad range of
   processor models and steppings and add the script which generates the
   header of minimum expected Intel microcode revisions

* tag 'x86_microcode_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/microcode/AMD: Move the no-revision fixup to get_patch_level()
  x86/microcode: Fix comment in microcode_loader_disabled()
  scripts/x86/intel: Add a script to update the old microcode list
  x86/microcode/intel: Refresh old_microcode defines with Nov 2025 release
2026-06-16 05:45:36 +05:30
Linus Torvalds
454761e121 - The usual pile of cleanups and fixlets the cat dragged in
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowF/UACgkQEsHwGGHe
 VUqPFQ//WJ62+aEsmuuZZ/HWuU/Warawn3R5Hm0DxgXAssUviuyOKBJhoP9ApaCK
 SfyNxSqcu2QJed0tZXfJsF+qH8OrNf/FjkenWpgrBJDtl+qiRRT/WRekVtzUR5WO
 HFemO+vnR5lgKKPwPlDFGs3/rARHPWs8HEl984PrjZJajwWnQujhkdZA88Hj8ehH
 hglS780Uitdp/8aqYB8mlsDdb1JPL2m3Ajoagij7nX9FjLz4fayMjiQW+w/XfYTw
 VP9vJtwXsVHP8inFLJPctKx2XRNYKU4g6WOGd2j3tIIeE9pvOpRbLJopeFgWAzbU
 zhxCMMlW30KmuBIRAUQAG6B2xlJxAqsZbH7om7QPXRNLYJ8wMlqPqZ5Q3WW52cmo
 YLbFDtcrHSn79Gukn0RZIN66xc6h1zKakhByZ5IPAB4GK2aJcS1f6OJCMIVknZUy
 FlkCH+YiRSWn3yJVUgeVK8QbG0+n4r+a2QhnT/ems2nVzmBvLYHbV9QtKEdfxTj8
 aD8Nwjh40mYvzOkbzCVyPO7QR/7SxIumaT/LsDvxMMMKBzuzS6BEy8WBtztxhhsU
 yTABDf8WInRwTPe8P8jCArpFRlRbLeXkkBqzvQlWMJEty1Md1Id+LdAF+hCEOTip
 jEYPWnmsaEnIFcJUQ/Am9f+ST8sq91kR92fLadxiWIuLjyQA1bo=
 =sSrt
 -----END PGP SIGNATURE-----

Merge tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 cleanups from Borislav Petkov:

 - The usual pile of cleanups and fixlets the cat dragged in

* tag 'x86_cleanups_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  x86/cpu: Remove obsolete aperfmperf_get_khz() declaration
  x86/pmem: Check for platform_device_alloc() retval
  x86/platform/uv: Use str_enabled_disabled() in uv_nmi_setup_hubless_intr()
  x86/cpu: Keep the PROCESSOR_SELECT menu together
  x86/tlb: Convert copy_from_user() + kstrtouint() to kstrtouint_from_user()
  x86/purgatory: Fix #endif comment
  x86/boot: Get rid of kstrtoull()
  x86/boot/compressed: Use boot_kstrtoul() for hugepages= parsing
2026-06-16 05:41:22 +05:30
Linus Torvalds
3c26a6bc40 Preparatory work for MPAM counter assignment:
- Simplify the error handling path when creating monitor group event
   configuration directories
 
 - Make the MBM event filter configurable only on architectures that
   support it and expose this with the respective file modes in the event
   config
 
 - Disallow the MBA software controller on systems where MBM counters are
   assignable, as it requires continuous bandwidth measurement that
   assignable counters do not guarantee
 
 - Replace a compile-time Kconfig option for fixed counter assignment
   with a per-architecture runtime property, and expose whether the
   counter assignment mode is changeable to userspace
 
 - Continue counter allocation across all domains instead of aborting at
   the first failure
 
 - Document that automatic MBM counter assignment is best effort and may
   not assign counters to all domains
 
 - Document the behavior of task ID 0 and idle tasks in the resctrl tasks
   file
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmowEfYACgkQEsHwGGHe
 VUoqpA//SQnC9ehAKVg+tf/V0H5s4sAQimTI3fl9pMYWfduoHCQkdPs/lSWF4Su+
 YNhjr/+nffC1oqSpklG2XEDHYD3HoKnBqSrALX0lmEVPr4MHtAnOAQs/G57Jqp8G
 p1nniOgPqwDltndHYUl2vLX/dFpjIprqPG3lWfjPCFUzrVaOlTPd7Kkv8kSdmZOL
 IYMpMP8IPjA8QfLdGtcqKbtjsNu6gxNs9TS2pXSyy/NuPqaS9CAzsOwj0KNlYPOk
 Hi7KVXc87GAHAUS1LK8+ZjEao/BHtUE8XJlsnTNtPlvwfS7uuOCIrrQyooJS8uT4
 CKv5KbCxZKlRlWNnZLW6IsfYd85N+7gse9n0U2BNlqMor535AEp/X5bka6QO4mLa
 CuN72A8Tkw2bNEcUfOc1akeKNj7bQ9lgz0AESJefmaFNkLmaWJi5mNA/27JFAXBQ
 KfGvPHlKcwt7e8Mj3OaDnhEstf9kVppD2NAL+tl5eGA0mHixyK0WNrDqX1ZjiPkL
 Lf2w5bHA0tTUPtFR/71RqWyHL5N7jjctC6aeVmGDgji7dIkodD8bUFEj/ORY02iS
 oAX7n0E8ccC/E8+jAb8n+zukpbHE4V2ASr+tncLuGVNRuq03YfK5RXIwK0wN6OnM
 dDN1DjaNNMI5pkB48zytDhl1RK6QKVtOqBRBO2TMbQHypnjUMDI=
 =6iVq
 -----END PGP SIGNATURE-----

Merge tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip

Pull x86 resource control updates from Borislav Petkov:
 "Preparatory work for MPAM counter assignment:

   - Simplify the error handling path when creating monitor group event
     configuration directories

   - Make the MBM event filter configurable only on architectures that
     support it and expose this with the respective file modes in the
     event config

   - Disallow the MBA software controller on systems where MBM counters
     are assignable, as it requires continuous bandwidth measurement
     that assignable counters do not guarantee

   - Replace a compile-time Kconfig option for fixed counter assignment
     with a per-architecture runtime property, and expose whether the
     counter assignment mode is changeable to userspace

   - Continue counter allocation across all domains instead of aborting
     at the first failure

   - Document that automatic MBM counter assignment is best effort and
     may not assign counters to all domains

   - Document the behavior of task ID 0 and idle tasks in the resctrl
     tasks file"

* tag 'x86_cache_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/tip/tip:
  fs/resctrl: Document tasks file behaviour for task id 0 and idle tasks
  fs/resctrl: Document that automatic counter assignment is best effort
  fs/resctrl: Continue counter allocation after failure
  fs/resctrl: Add monitor property 'mbm_cntr_assign_fixed'
  fs/resctrl: Disallow the software controller when MBM counters are assignable
  x86,fs/resctrl: Create 'event_filter' files read only if they're not configurable
  fs/resctrl: Tidy up the error path in resctrl_mkdir_event_configs()
2026-06-16 05:35:40 +05:30
Linus Torvalds
4b5713ef2f - Fix a malformed Kconfig default for the AMD Address Translation Library
- Make sure i10nm loads successfully when the ADXL address decoder is absent
   because former has decoding capabilities too
 
 - Ensure error reporting is cleanly disabled on driver teardown and on failed
   initialization for several legacy Intel EDAC drivers
 
 - Fix a grammar issue in a diagnostic warning in the Sandy Bridge driver
 
 - Fix a missing resource release callback and incorrect memory topology
   parsing in the igen6 driver, and add support for Intel Panther Lake-H and
   Nova Lake-H SoCs
 
 - Fix an out-of-bounds shift causing undefined behaviour in the Skylake
   driver
 
 - Consolidate memory controller register access helpers into shared common
   code across the Intel Skylake, Ice Lake, and Meteor Lake drivers
 
 - Introduce sub-channel awareness and Rank Retry Logic improvements to
   the Intel Skylake and i10nm drivers in preparation for Diamond Rapids
   server support
 
 - Add Rank Retry Logic support for Intel Diamond Rapids server to
   imh_edac
 
 - Make In-Band ECC detection registers configurable per SoC in the igen6
   driver
 
 - Standardize PCI device ID table definitions across all EDAC drivers to
   use named field initializers and standard PCI helper macros
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEzv7L6UO9uDPlPSfHEsHwGGHeVUoFAmovc4AACgkQEsHwGGHe
 VUqnzhAAmgpZ1hrzP/yzhKs3ThDHrU4wacmmVKsV8ToNzuQ+4KtLty/faLIHx9kp
 fJri2FWXQwY4Y9L5ZWB6vf/zQJG8mjJAoMFuexpJ2Fw+8BWUYTJOdD7FayG0v3ck
 x+cVPe57toVxsvmZAO4hBcdacOf7vss9c0ceVtAOqS1GXYsGLTcBg2y71stCBr4q
 +aOjM4dXh7sR5RYIOijacYEs1p5UNXmzUZbtChW0zHJ0dJF+U8psO+cU3cMKFRzt
 EhCEI6i4z2iemWA3KIEy9zXtOzoSj96/8g+SIeNrhIs5ANtDjTXu/5nBGPbvw0xV
 ndsMvetv3EqrvI472rRUL4A00WLtYMfeB69kBFyGDEmqRutpesqW6d7zTqq5p2qB
 dbNycPQur2Qj3yMEzOMxTpT+98fxKEg/S0hJ4lxJPdcuVxdhuPncR4ZNRPd5q40C
 veJt17pAn4FQOMCWyjReJdK5rBlmM716Osd4B2SNpG1JsQkmvVDeT6n6Xg1e03mZ
 MUvTH2fdegZOocfSK5i6hlhmn8mYPNRUrsnh565ivxDhrpT7ffiJoqHUBYqAcYnm
 5o9WEgYjtxcncyyVkf0KmWLuJGWMJ2xxAVE6zXhNW0pP2/FDYWcDVGdTUV9oKS7t
 1vY/rM+6GYNf6cSXW4F54SmUJuaCkSUn2Nhucf9lKmE3GBu/8Rs=
 =WiqU
 -----END PGP SIGNATURE-----

Merge tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras

Pull EDAC updates from Borislav Petkov:

 - Fix a malformed Kconfig default for the AMD Address Translation
   Library

 - Make sure i10nm loads successfully when the ADXL address decoder is
   absent because former has decoding capabilities too

 - Ensure error reporting is cleanly disabled on driver teardown and on
   failed initialization for several legacy Intel EDAC drivers

 - Fix a grammar issue in a diagnostic warning in the Sandy Bridge
   driver

 - Fix a missing resource release callback and incorrect memory topology
   parsing in the igen6 driver, and add support for Intel Panther Lake-H
   and Nova Lake-H SoCs

 - Fix an out-of-bounds shift causing undefined behaviour in the Skylake
   driver

 - Consolidate memory controller register access helpers into shared
   common code across the Intel Skylake, Ice Lake, and Meteor Lake
   drivers

 - Introduce sub-channel awareness and Rank Retry Logic improvements to
   the Intel Skylake and i10nm drivers in preparation for Diamond Rapids
   server support

 - Add Rank Retry Logic support for Intel Diamond Rapids server to
   imh_edac

 - Make In-Band ECC detection registers configurable per SoC in the
   igen6 driver

 - Standardize PCI device ID table definitions across all EDAC drivers
   to use named field initializers and standard PCI helper macros

* tag 'edac_updates_for_v7.2_rc1' of gitolite.kernel.org:pub/scm/linux/kernel/git/ras/ras: (22 commits)
  EDAC: Consistently define pci_device_ids using named initializers
  EDAC/igen6: Add Intel Nova Lake-H SoC support
  EDAC/igen6: Make registers for detecting IBECC configurable
  EDAC/imh: Add RRL support for Intel Diamond Rapids server
  EDAC/{skx_common,i10nm}: Prepare RRL for sub-channel granularity
  EDAC/skx_common: Add SubChannel support to ADXL decode
  EDAC/{skx_common,i10nm}: Move RRL handling to common code
  EDAC/{skx_common,i10nm}: Introduce rrl_ctrl_mode
  EDAC/{skx_common,i10nm}: Rename rrl_mode to rrl_source_type
  EDAC/{skx_common,skx,i10nm}: Split skx_set_decode()
  EDAC/{skx_common,i10nm,imh}: Move MC register access helpers to skx_common
  EDAC/{skx_common,skx}: Fix UBSAN shift-out-of-bounds in skx_get_dimm_info
  EDAC/igen6: Add one Intel Panther Lake-H SoC support
  EDAC/igen6: Fix memory topology parsing for Panther Lake-H SoCs
  EDAC/igen6: Fix call trace due to missing release()
  EDAC/sb_edac: fix grammar in sb_decode_ddr3 warning
  EDAC/i5400: disable error reporting at teardown and refactor helper
  EDAC/i5100: disable error reporting at teardown and create helper
  EDAC/i5000: disable error reporting at teardown and refactor helper
  EDAC/i7300: disable error reporting if init fails and refactor helper
  ...
2026-06-16 05:31:01 +05:30
Linus Torvalds
80476f22b8 arm64 updates for 7.2
CPU errata handling:
 - Extend CnP disabling workaround to HiSilicon HIP09 hardware.
 - Work around eternally broken broadcast TLB invalidation on more CPUs.
 - Documentation and code cleanups.
 
 CPU features:
 - Add new hwcaps for the 2025 dpISA extensions.
 
 Floating point / SVE / SME:
 - Significant cleanup to the low-level state management code in the core
   architecture code and KVM.
 - Use correct register widths during SVE/SME save/restore assembly.
 - Expose SVE/SME save/restore memory accesses to sanitisers.
 
 Memory management:
 - Preparatory work for unmapping the kernel data and bss sections from
   the linear map.
 
 Miscellaneous:
 - Inline DAIF manipulation helpers so they can be used safely from
   non-instrumentable code.
 - Fix handling of the 'nosmp' cmdline option to avoid marking secondary
   cores as "possible".
 
 MPAM:
 - Add support for v0.1 of the MPAM architecture.
 
 Perf:
 - Update HiSilicon PMU MAINTAINERS entry.
 - Fix event encodings for the DVM node in the CMN driver.
 
 Selftests:
 - Extend sigframe tests to cover POE context.
 - Add coverage for the newly added 2025 dpISA hwcaps.
 
 System registers:
 - Add new registers and ESR encodings for the HDBSS feature.
 
 Plus minor fixes and cleanups across the board.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEPxTL6PPUbjXGY88ct6xw3ITBYzQFAmoun+0QHHdpbGxAa2Vy
 bmVsLm9yZwAKCRC3rHDchMFjNFEvB/9scDYXHUCxQOqoRB5TPUi63pgl5vl83IfI
 TWE2r2wNsrjqXlAV2FDbzuTWxLpACS+vpk5ltsb57aUfENQ5wZEFCDvJlbpNZuHS
 5/zAQmCajPpgC5TFDo7rbgSv2BSR4TXuFfvGS349+a82c9C12EUulBFvR1DDVElh
 FCYT5PfHNu1Khas4YiUln+9WSqS8qSHfYsz4Qb/lDaZcAmh22jQBPZQFU7fMlZST
 Fr/nzSy6cxkARotqU7RlRQLgtDHBEqTYrNHCP0WSQ2aPJN8SeFUyjEcQas/Zak+S
 Bme8OHcqn4pZPll5TfHUTaJp91oIJAA9uX5RSwE+G3NvAGNbptuw
 =LXuh
 -----END PGP SIGNATURE-----

Merge tag 'arm64-upstream' of gitolite.kernel.org:pub/scm/linux/kernel/git/arm64/linux

Pull arm64 updates from Will Deacon:
 "It feels like the new world of AI tooling has slowed us down a little
  on the feature side when compared to the fixes side. The extra rounds
  of Sashiko review have also pushed a few things out until next time.

  Still, there's some good foundational stuff here for the fpsimd code
  and hardening work towards removing the predictable linear alias of
  the kernel image.

  CPU errata handling:
   - Extend CnP disabling workaround to HiSilicon HIP09 hardware.
   - Work around eternally broken broadcast TLB invalidation on more
     CPUs.
   - Documentation and code cleanups.

  CPU features:
   - Add new hwcaps for the 2025 dpISA extensions.

  Floating point / SVE / SME:
   - Significant cleanup to the low-level state management code in the
     core architecture code and KVM.
   - Use correct register widths during SVE/SME save/restore assembly.
   - Expose SVE/SME save/restore memory accesses to sanitisers.

  Memory management:
   - Preparatory work for unmapping the kernel data and bss sections
     from the linear map.

  Miscellaneous:
   - Inline DAIF manipulation helpers so they can be used safely from
     non-instrumentable code.
   - Fix handling of the 'nosmp' cmdline option to avoid marking
     secondary cores as "possible".

  MPAM:
   - Add support for v0.1 of the MPAM architecture.

  Perf:
   - Update HiSilicon PMU MAINTAINERS entry.
   - Fix event encodings for the DVM node in the CMN driver.

  Selftests:
   - Extend sigframe tests to cover POE context.
   - Add coverage for the newly added 2025 dpISA hwcaps.

  System registers:
   - Add new registers and ESR encodings for the HDBSS feature.

  Plus minor fixes and cleanups across the board"

* tag 'arm64-upstream' of gitolite.kernel.org:pub/scm/linux/kernel/git/arm64/linux: (73 commits)
  arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU
  arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU
  arm64: errata: Mitigate TLBI errata on various Arm CPUs
  arm64: cputype: Add C1-Premium definitions
  arm64: cputype: Add C1-Ultra definitions
  Revert "arm64: mm: Unmap kernel data/bss entirely from the linear map"
  Revert "arm64: mm: Defer remap of linear alias of data/bss"
  arm64: arch_timer: reuse arch_timer_read_cnt{p,v}ct_el0() helpers
  arm64/mm: Rename ptdesc_t
  arm64: mm: Defer remap of linear alias of data/bss
  KVM: arm64: Omit tag sync on stage-2 mappings of the zero page
  arm64: Avoid double evaluation of __ptep_get()
  kasan: Move generic KASAN page tables out of BSS too
  arm64: Rename page table BSS section to .bss..pgtbl
  arm64: patching: replace min_t with min in __text_poke
  perf/arm-cmn: Fix DVM node events
  arm64: fpsimd: Remove <asm/fpsimdmacros.h>
  arm64: fpsimd: Move SME save/restore inline
  arm64: fpsimd: Move sve_flush_live() inline
  arm64: fpsimd: Move SVE save/restore inline
  ...
2026-06-16 05:18:04 +05:30
Linus Torvalds
25a01b5155 s390 updates for 7.2 merge window
- Use CIO device online variable instead of the internal FSM state to
   determine device availability during purge operations
 
 - Remove extra check of task_stack_page() because try_get_task_stack()
   already takes care of that when reading /proc/<pid>/wchan
 
 - Allow user-space to use the new SCLP action qualifier 4 for to
   provide NVMe SMART log data to the platform.
 
 - Send AP CHANGE uevents on successful bind and successful association
   to notify user-space about SE operations on AP queue devices
 
 - Add an s390dbf kernel parameter to configure debug log levels and
   area sizes during early boot
 
 - On arm64 the empty zero page is going to be mapped read-only.
   Do the same for s390 with an explicit set_memory_ro() call
 
 - Improve s390-specific bcr_serialize() and cpu_relax() implementations
 
 - Remove all unused variables to avoid allmodconfig W=1 build fails
   with latest clang-23
 
 - Cleanup default Kconfig values for s390 selftests
 
 - Add a s390-tod trace clock to allow comparing trace timestamps
   between different systems or virtual machines on s390
 
 - Remove the s390 implementation of strlcat() in favor of the
   generic variant
 
 - Make consistent the calling order between page_table_check_pte_clear()
   and secure page conversion across all code paths
 
 - Rearrange some fields within AP and zcrypt structs to reduce
   memory consumption and unused holes
 
 - Shorten GR_NUM and VX_NUM macros and move them to a separate header
 
 - Replace __get_free_page() with kmalloc() in few sources
 
 - Introduce an infrastructure for more efficient this_cpu operations.
   Eliminate conditional branches when PREEMPT_NONE is removed
 
 - Enable Rust support
 
 - Use z10 as minimum architecture level, similar to the boot code,
   to enforce a defined architecture level set
 
 - Improve and convert various mem*() helper functions to C. For that
   add .noinstr.text section to avoid orphaned warnings from the linker
 
 - Fix the function pointer type in __ret_from_fork() to correct
   the indirect call to match kernel thread return type of int
 
 - Revert support for DCACHE_WORD_ACCESS to avoid an endless exception
   loop on read from donated Ultravisor pages at unaligned addresses
 -----BEGIN PGP SIGNATURE-----
 
 iI0EABYKADUWIQQrtrZiYVkVzKQcYivNdxKlNrRb8AUCai/rTRccYWdvcmRlZXZA
 bGludXguaWJtLmNvbQAKCRDNdxKlNrRb8KNOAPwMpGVtXcKF4HftCv49X0WpqKbU
 tdYO9hbq9wanIGpgIgEAk5vggxe74pj+palTbtCDteVjDpnSp811x8gfmLlPrgU=
 =qzZ2
 -----END PGP SIGNATURE-----

Merge tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux

Pull s390 updates from Alexander Gordeev:

 - Use CIO device online variable instead of the internal FSM state to
   determine device availability during purge operations

 - Remove extra check of task_stack_page() because try_get_task_stack()
   already takes care of that when reading /proc/<pid>/wchan

 - Allow user-space to use the new SCLP action qualifier 4 for to
   provide NVMe SMART log data to the platform.

 - Send AP CHANGE uevents on successful bind and successful association
   to notify user-space about SE operations on AP queue devices

 - Add an s390dbf kernel parameter to configure debug log levels and
   area sizes during early boot

 - On arm64 the empty zero page is going to be mapped read-only. Do the
   same for s390 with an explicit set_memory_ro() call

 - Improve s390-specific bcr_serialize() and cpu_relax() implementations

 - Remove all unused variables to avoid allmodconfig W=1 build fails
   with latest clang-23

 - Cleanup default Kconfig values for s390 selftests

 - Add a s390-tod trace clock to allow comparing trace timestamps
   between different systems or virtual machines on s390

 - Remove the s390 implementation of strlcat() in favor of the generic
   variant

 - Make consistent the calling order between
   page_table_check_pte_clear() and secure page conversion across all
   code paths

 - Rearrange some fields within AP and zcrypt structs to reduce memory
   consumption and unused holes

 - Shorten GR_NUM and VX_NUM macros and move them to a separate header

 - Replace __get_free_page() with kmalloc() in few sources

 - Introduce an infrastructure for more efficient this_cpu operations.
   Eliminate conditional branches when PREEMPT_NONE is removed

 - Enable Rust support

 - Use z10 as minimum architecture level, similar to the boot code, to
   enforce a defined architecture level set

 - Improve and convert various mem*() helper functions to C. For that
   add .noinstr.text section to avoid orphaned warnings from the linker

 - Fix the function pointer type in __ret_from_fork() to correct the
   indirect call to match kernel thread return type of int

 - Revert support for DCACHE_WORD_ACCESS to avoid an endless exception
   loop on read from donated Ultravisor pages at unaligned addresses

* tag 's390-7.2-1' of gitolite.kernel.org:pub/scm/linux/kernel/git/s390/linux: (52 commits)
  s390: Revert support for DCACHE_WORD_ACCESS
  s390/process: Fix kernel thread function pointer type
  s390/tishift: Convert __ashlti3(), __ashrti3(), __lshrti3() to C
  s390/memmove: Optimize backward copy case
  s390/string: Convert memset(16|32|64)() to C
  s390/string: Convert memcpy() to C
  s390/string: Convert memset() to C
  s390/string: Convert memmove() to C
  s390/string: Add -ffreestanding compile option to string.o
  s390: Add .noinstr.text to boot and purgatory linker scripts
  s390/purgatory: Enforce z10 minimum architecture level
  s390: Enable Rust support
  s390/cmpxchg: Fix KASAN stack-out-of-bounds in atomic helpers
  rust: helpers: Add memchr wrapper for string operations
  rust/bindgen_parameters: Mark s390 types as opaque to prevent repr conflicts
  s390/jump_label: Implement ARCH_STATIC_BRANCH_JUMP_ASM and ARCH_STATIC_BRANCH_ASM macros
  s390/bug: Provide ARCH_WARN_ASM for Rust WARN/BUG support
  s390/ap: Fix locking issue in SE bind and associate sysfs functions
  s390/percpu: Provide arch_this_cpu_write() implementation
  s390/percpu: Provide arch_this_cpu_read() implementation
  ...
2026-06-16 05:08:13 +05:30
Lorenzo Bianconi
a459b560e5 net: airoha: use int instead of atomic_t for qdma users counter
QDMA users counter is always accessed holding RTNL lock so we do not
require atomic_t for it.

Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:35:41 -07:00
Jakub Kicinski
fbc6a80cb5 Merge branch 'mac-phy-interrupt-changed-to-level-triggered-interrupt'
Selvamani Rajagopal says:

====================
MAC-PHY interrupt changed to level triggered interrupt

According to OPEN Alliance 10BASE-T1x MAC-PHY Serial Interface
specification, MAC-PHY interrupt is "active low, level triggered".
The specification mentions about the conditions in which the IRQ
is asserted and deasserted.

Bug is inadvertently introduced by treating the IRQ in the OA TC6
framework driver and in dt-binding YAML file as edge triggered.

With the changes to use level triggered interrupt, use of threaded
irq is more efficient than the current method that has interrupt hander
working with work queue.

This change of interrupt handler mechanism exposed couple of race
conditions due to the fact that interrupts were not masked on protocol
error. And pointers were not initialized with null after skbs are freed.

Changes are done in two files
 - OA TC6 framework Ethernet driver
 - YAML file for the vendor that already uses OA TC6 framework.

Maintainer for this driver is already informed and aware of these
changes. Testing for these changes was done in onsemi's setup and
found to be working.
====================

Link: https://patch.msgid.link/20260611-level-trigger-v5-0-4533a9e85ce2@onsemi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:32:14 -07:00
Selvamani Rajagopal
31e56112e6 dt-bindings: net: updated interrupt type to be active low, level triggered
According to OPEN Alliance 10BASE-T1x MACPHY Serial Interface (TC6)
specification, interrupt type is active low, level triggered interrupt.

Specification calls for when interrupt level will be asserted and what
condition it is de-asserted. By using edge triggered interrupt, there is a
potential chance to miss it, particularly if it is asserted when interrupt
is disabled.

Level triggered interrupt can't be missed as it gets de-asserted only on
interrupt handler taking actions on interrupting conditions.

Fixes: ac49b950be ("dt-bindings: net: add Microchip's LAN865X 10BASE-T1S MACPHY")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Link: https://patch.msgid.link/20260611-level-trigger-v5-4-4533a9e85ce2@onsemi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:32:10 -07:00
Selvamani Rajagopal
a5a1d11dd3 net: ethernet: oa_tc6: Remove FCS size in RX frame
OA TC6 MAC-PHY appends FCS to the incoming frame. It must be
removed from the frame before being passed to the stack.

With FCS in the frame, many applications, like ping or any
application that uses IP layer may work as they may
carry the packet size information in the protocol.

Application like ptp4l, particularly if it uses layer 2
for its communication, it will fail with "bad message" due to
the extra 4 bytes added by the presence of FCS.

Fixes: d70a0d8f2f ("net: ethernet: oa_tc6: implement receive path to receive rx ethernet frames")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
Link: https://patch.msgid.link/20260611-level-trigger-v5-3-4533a9e85ce2@onsemi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:32:10 -07:00
Selvamani Rajagopal
a221d3f7e3 net: ethernet: oa_tc6: mdiobus->parent initialized with NULL
As "dev" pointer in oa_tc6 structure is never initialized,
mbiobus->parent was initialized with NULL.  This change
fixes it by initializing it with device pointer of spi.

Fixes: 8f9bf857e4 ("net: ethernet: oa_tc6: implement internal PHY initialization")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
Link: https://patch.msgid.link/20260611-level-trigger-v5-2-4533a9e85ce2@onsemi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:32:09 -07:00
Selvamani Rajagopal
b542d13fab net: ethernet: oa_tc6: Interrupt is active low, level triggered.
According OPEN Alliance 10BASET1x MAC-PHY Serial Interface
specification, interrupt is active low, level triggered.

Code used edge triggered interrupt which has the risk of losing an
interrupt on instances like when interrupt is disabled. Level
triggered interrupt won't be deasserted unless handler runs and
clear the interrupting conditions.

Interrupt handler mechanism is changed to threaded irq from
interrupt handler and kernel thread waiting on work queue.
Threaded irq mechanism is best suited for level triggered interrupt
as it disables the interrupt until handler is run in thread level,
while giving us an ability to have interrupt context handler to
signal the threaded irq handler.

Introduced a logic to disable the device interrupt on error. Error
could be due in data chunk's header and footer or SPI interface itself.
This will avoid having repeated interrupts, in case the driver couldn't
recover from the error condition with the available recovery mechanism.

Fixes: 2c6ce53544 ("net: ethernet: oa_tc6: implement mac-phy interrupt")
Signed-off-by: Selvamani Rajagopal <Selvamani.Rajagopal@onsemi.com>
Link: https://patch.msgid.link/20260611-level-trigger-v5-1-4533a9e85ce2@onsemi.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-06-15 16:32:09 -07:00
Linus Torvalds
44308fbe8f m68k updates for v7.2
- Replace more deprecated functions by safer counterparts,
   - Switch Mac NuBus to a dynamic root device,
   - Defconfig updates,
   - Miscellaneous fixes and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQ9qaHoIs/1I4cXmEiKwlD9ZEnxcAUCai/JUgAKCRCKwlD9ZEnx
 cJtwAQD8bDlhP5wLD/U/H+KnZEmNcYyzlxxJLFHgZCR0lTGm5wEAl/zR3L7IJvNp
 rSzpeFrh8DWLly6+xGZPX0/0C1uInw8=
 =a1n/
 -----END PGP SIGNATURE-----

Merge tag 'm68k-for-v7.2-tag1' of gitolite.kernel.org:pub/scm/linux/kernel/git/geert/linux-m68k

Pull m68k updates from Geert Uytterhoeven:
 - Replace more deprecated functions by safer counterparts
 - Switch Mac NuBus to a dynamic root device
 - defconfig updates
 - Miscellaneous fixes and improvements

* tag 'm68k-for-v7.2-tag1' of gitolite.kernel.org:pub/scm/linux/kernel/git/geert/linux-m68k:
  m68k: Correct CONFIG_MVME16x macro name in #endif comment
  m68k: hash: Use lower_16_bits() helper
  m68k: defconfig: Update defconfigs for v7.1-rc1
  dio: Update DIO_SCMAX comment
  dio: Use tabs and avoid continuation logging in dio_init
  dio: Replace deprecated strcpy with strscpy in dio_init
  nubus: Switch to dynamic root device
  zorro: sysfs: Replace sprintf() by sysfs_emit()
2026-06-16 05:01:42 +05:30
Aman Kumar Pandey
8d8afa4283 i3c: master: Expose the APIs to support I3C hub
Change the below internal static functions to APIs to allow new I3C hub
driver to use them

1) i3c_dev_enable_ibi_locked()
2) i3c_dev_disable_ibi_locked()
3) i3c_dev_request_ibi_locked()
4) i3c_dev_free_ibi_locked()
5) i3c_master_reattach_i3c_dev_locked()

Signed-off-by: Aman Kumar Pandey <aman.kumarpandey@nxp.com>
Signed-off-by: Lakshay Piplani <lakshay.piplani@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20260612111816.3688240-3-lakshay.piplani@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
2026-06-16 01:27:25 +02:00