Commit Graph

1441233 Commits

Author SHA1 Message Date
Mykyta Yatsenko
8a20655749
selftests/bpf: Add tests for sleepable tracepoint programs
Cover all three sleepable tracepoint types (tp_btf.s, raw_tp.s, tp.s)
and sys_exit (via bpf_task_pt_regs) with functional tests using
bpf_copy_from_user() on getcwd. Verify alias and bare SEC variants,
bpf_prog_test_run_raw_tp() with BPF_F_TEST_RUN_ON_CPU rejection,
attach-time rejection on non-faultable tracepoints, and load-time
rejection for sleepable tp_btf on non-faultable tracepoints.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-6-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:30 +02:00
Mykyta Yatsenko
0cd420a6f4
libbpf: Add section handlers for sleepable tracepoints
Add SEC_DEF entries for sleepable tracepoint variants:
  - "tp_btf.s+"     for sleepable BTF-based raw tracepoints
  - "raw_tp.s+"     for sleepable raw tracepoints
  - "raw_tracepoint.s+" (alias)
  - "tp.s+"         for sleepable classic tracepoints
  - "tracepoint.s+" (alias)

Extract sec_name_match_prefix() to share the prefix matching logic
between attach_tp() and attach_raw_tp(), eliminating duplicated
loops and hardcoded strcmp() checks for bare section names.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-5-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:30 +02:00
Mykyta Yatsenko
8cfb77d309
bpf: Verifier support for sleepable tracepoint programs
Allow BPF_PROG_TYPE_RAW_TRACEPOINT, BPF_PROG_TYPE_TRACEPOINT, and
BPF_TRACE_RAW_TP (tp_btf) programs to be sleepable by adding them
to can_be_sleepable().

For BTF-based raw tracepoints (tp_btf), add a load-time check in
bpf_check_attach_target() that rejects sleepable programs attaching
to non-faultable tracepoints with a descriptive error message.

For raw tracepoints (raw_tp), add an attach-time check in
bpf_raw_tp_link_attach() that rejects sleepable programs on
non-faultable tracepoints. The attach-time check is needed because
the tracepoint name is not known at load time for raw_tp.

The attach-time check for classic tracepoints (tp) in
__perf_event_set_bpf_prog() was added in the previous patch.

Replace the verbose error message that enumerates allowed program
types with a generic "Program of this type cannot be sleepable"
message, since the list of sleepable-capable types keeps growing.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-4-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:29 +02:00
Mykyta Yatsenko
57918341dd
bpf: Add sleepable support for classic tracepoint programs
Add trace_call_bpf_faultable(), a variant of trace_call_bpf() for
faultable tracepoints that supports sleepable BPF programs. It uses
rcu_tasks_trace for lifetime protection and
bpf_prog_run_array_sleepable() for per-program RCU flavor selection,
following the uprobe_prog_run() pattern.

Restructure perf_syscall_enter() and perf_syscall_exit() to run BPF
programs before perf event processing. Previously, BPF ran after the
per-cpu perf trace buffer was allocated under preempt_disable,
requiring cleanup via perf_swevent_put_recursion_context() on filter.
Now BPF runs in faultable context before preempt_disable, reading
syscall arguments from local variables instead of the per-cpu trace
record, removing the dependency on buffer allocation. This allows
sleepable BPF programs to execute and avoids unnecessary buffer
allocation when BPF filters the event. The perf event submission
path (buffer allocation, fill, submit) remains under preempt_disable
as before. Since BPF no longer runs within the buffer allocation
context, the fake_regs output parameter to perf_trace_buf_alloc()
is no longer needed and is replaced with NULL.

Add an attach-time check in __perf_event_set_bpf_prog() to reject
sleepable BPF_PROG_TYPE_TRACEPOINT programs on non-syscall
tracepoints, since only syscall tracepoints run in faultable context.

This prepares the classic tracepoint runtime and attach paths for
sleepable programs. The verifier changes to allow loading sleepable
BPF_PROG_TYPE_TRACEPOINT programs are in a subsequent patch.

To: Peter Zijlstra <peterz@infradead.org>
To: Steven Rostedt <rostedt@goodmis.org>

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> # for BPF bits
Acked-by: Steven Rostedt <rostedt@goodmis.org>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-3-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:29 +02:00
Mykyta Yatsenko
12628ffaf9
bpf: Add bpf_prog_run_array_sleepable()
Add bpf_prog_run_array_sleepable() for running BPF program arrays
on faultable tracepoints. Unlike bpf_prog_run_array_uprobe(), it
includes per-program recursion checking for private stack safety
and hardcodes is_uprobe to false.

Skip dummy_bpf_prog at the top of the loop. When
bpf_prog_array_delete_safe() replaces a detached program with
dummy_bpf_prog on allocation failure, the dummy is statically
allocated and has NULL active, stats, and aux fields. Identify
it by prog->len == 0, since every real program has at least one
instruction.

Keep bpf_prog_run_array_uprobe() unchanged for uprobe callers.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-2-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:29 +02:00
Mykyta Yatsenko
439ebd5b57
bpf: Add sleepable support for raw tracepoint programs
Rework __bpf_trace_run() to support sleepable BPF programs by using
explicit RCU flavor selection, following the uprobe_prog_run() pattern.

For sleepable programs, use rcu_read_lock_tasks_trace() for lifetime
protection with migrate_disable(). For non-sleepable programs, use the
regular rcu_read_lock_dont_migrate().

Remove the preempt_disable_notrace/preempt_enable_notrace pair from
the faultable tracepoint BPF probe wrapper in bpf_probe.h, since
migration protection and RCU locking are now handled per-program
inside __bpf_trace_run().

Adapt bpf_prog_test_run_raw_tp() for sleepable programs: reject
BPF_F_TEST_RUN_ON_CPU since sleepable programs cannot run in hardirq
or preempt-disabled context, and call __bpf_prog_test_run_raw_tp()
directly instead of via smp_call_function_single(). Rework
__bpf_prog_test_run_raw_tp() to select RCU flavor per-program and
add per-program recursion context guard for private stack safety.

Signed-off-by: Mykyta Yatsenko <yatsenko@meta.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260422-sleepable_tracepoints-v13-1-99005dff21ef@meta.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-22 22:44:24 +02:00
Maxim Khmelevskii
9012cf2491 s390/bpf: Inline smp_processor_id and current_task
Inline these calls in bpf jit:
 - bpf_get_smp_processor_id()
 - bpf_get_current_task()
 - bpf_get_current_task_btf()

s390 has a 8 KiB per-CPU prefix area in the CPU's
virtual address space, called the lowcore. It is a
struct that contains the cpu number and a pointer
to the current task. These are exactly the values
returned by the BPF helpers.

Emit a load from the lowcore instead of a helper
function call.

JIT output for `bpf_get_smp_processor_id`:

 Before:                       After:
---------------               ----------------
brasl   %r14,0x3ffe0385460    ly      %r14,928
lgr     %r14,%r2

JIT output for `bpf_get_current_task`:

 Before:                        After:
---------------                ----------------
brasl   %r14,0x3ffe0362a90     lg      %r14,832
lgr     %r14,%r2

Benchmark using [1] on KVM(virtme-ng).

./benchs/run_bench_trigger.sh glob-arr-inc arr-inc hash-inc

+---------------+--------------------+--------------------+--------------+
|     Name      |       Before       |       After        |   % change   |
|---------------+--------------------+--------------------+--------------|
| glob-arr-inc  | 244.954 ± 0.654M/s | 278.501 ± 0.834M/s |   + 13.70%   |
| arr-inc       | 311.597 ± 1.016M/s | 313.610 ± 0.331M/s |   + 0.65%    |
| hash-inc      | 47.421 ± 0.017M/s  | 47.600 ± 0.004M/s  |   + 0.38%    |
+---------------+--------------------+--------------------+--------------+

[1] https://github.com/anakryiko/linux/commit/8dec900975ef

Signed-off-by: Maxim Khmelevskii <max@linux.ibm.com>
Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Link: https://lore.kernel.org/r/20260414142930.528751-1-max@linux.ibm.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-21 15:53:45 -07:00
Jie Meng
c8f0ee969f bpf: Exhaustive test coverage for signed division and modulo
Extend lib/test_bpf.c to provide comprehensive test coverage for BPF
signed division (SDIV) and signed modulo (SMOD) instructions, both
32-bit and 64-bit variants with immediate operands.

Introduce F_ALU32 and F_SIGNED flags to replace the less readable
bool alu32 and s16 off parameters throughout the test helpers. The
BPF instruction 'off' field is derived from flags only at the point
of instruction encoding.

Changes:
- Add enum { F_ALU32 = 1, F_SIGNED = 2 } for readable test flags.
- __bpf_alu_result(): take u32 flags instead of separate signed/alu32
  parameters. Narrows operands internally for ALU32 (unsigned via u32
  cast, signed via s32 cast) before computing the reference result.
- __bpf_emit_alu64_imm(), __bpf_emit_alu32_imm(): pass flags through
  to __bpf_alu_result, derive 'off' for instruction encoding locally.
- __bpf_fill_alu_imm_regs(): take u32 flags, use F_ALU32/F_SIGNED for
  operand setup and single-line __bpf_alu_result() call.
- __bpf_fill_alu_shift(), __bpf_fill_alu_shift_same_reg(): convert
  bool alu32 parameter to u32 flags for consistency.
- New test fill functions: bpf_fill_alu{32,64}_{sdiv,smod}_imm() and
  bpf_fill_alu{32,64}_{sdiv,smod}_imm_regs(), each testing all
  immediate value magnitudes and all register pair combinations.
- All existing unsigned tests updated to use flags (0 or F_ALU32),
  preserving backward compatibility.

8 new test cases added:
  ALU64_SDIV_K, ALU64_SMOD_K (immediate magnitudes + register combos)
  ALU32_SDIV_K, ALU32_SMOD_K (immediate magnitudes + register combos)

Test results:
  test_bpf: Summary: 1061 PASSED, 0 FAILED, [1049/1049 JIT'ed]
  test_bpf: test_tail_calls: Summary: 10 PASSED, 0 FAILED, [10/10 JIT'ed]
  test_bpf: test_skb_segment: Summary: 2 PASSED, 0 FAILED

Assisted-by: Claude:claude-opus-4-6
Signed-off-by: Jie Meng <jmeng@fb.com>
Link: https://lore.kernel.org/r/20260413172311.3918767-1-jmeng@fb.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:57:36 -07:00
Alexei Starovoitov
552ad802ca Merge branch 'bpf-extend-btf-uapi-vlen-kinds-to-use-unused-bits'
Alan Maguire says:

====================
bpf: Extend BTF UAPI vlen, kinds to use unused bits

Currently BTF types can have a maximum of 65535 vlen-specified
objects.  While this limit has not yet been surpassed for existing
cases (struct/union fields, enum values, function arguments and
datasec), upcoming BTF location information - specifically inline
sites - will hit that limit.  Utilize unused BTF info bits in
struct btf_type to increase limit to 24-bits (over 16 million).
This is more than an order of magnitude greater than inline
site counts for the kernel (~400,000) so should be enough for
the near future at least.

Similarly, struct btf_type uses 5 bits for BTF kind values;
currently we use 20 kinds, but BTF location information will
take another 3, and conceivably providing better support for Rust
types in BTF (now that modules can be built using Rust) could
push us close to the max of 31.  Use 2 unused bits to provide
a max possible kind of 127.

Patch 1 handles UAPI and kernel-related changes.

Patch 2 updates libbpf to have btf_vlen() return a __u32 instead
of __u16 and updates consumers in libbpf accordingly.  Also adds
bounds checking for max vlen.

Patch 3 cleans up __u16 vlen usage in bpftool.

Patch 4 fixes up a test that relies on BTF info overflowing
maximum kind value; fix up the expected error to be an
invalid kind rather than (now impossible) invalid btf_info.

Patch 5 fixes up __u16 vlen usage in selftests/bpf.

Patch 6 syncs BTF documentation with UAPI changes.

Changes since v2 [1]:

- dropped backwards-compatibility macros (Alexei, patch 1)
- added additional vlen bounds check in btf__add_field()
  (sashiko, bpf bot, patch 2)
- dropped sanitization check in libbpf as older kernels will
  reject BTF with extended vlen/kinds using BTF info mask
  (Alexei)
- fix more vlen assumptions in prog_test/ctx_rewrite.c
  (sashiko, patch 5)

Changes since v1 [2]:

- added redundant macros to UAPI in case enum switch for BTF_MAX*
  values causes problems (sashiko, patch 1)
- updated feature test to use BTF loading rather than vmlinux BTF
  lookup, in line with other BTF feature tests (sashiko, patch 3)
- fixed up a few more kernel, libbpf, bpftool instances of __u16 usage
  (bpf bot, sashiko, patches 1, 2, 4)
- fixed up sanitize selftest cleanup (Mykyta, patch 5)
- used unlikely-to-be-used kind (sashiko, patch 6)
- fixed a few lingering selftests uses of __u16 for kind (patch 7)
- update btf.rst with new vlen, kind sizes (patch 8)

[1] https://lore.kernel.org/bpf/20260416143904.1220662-1-alan.maguire@oracle.com/
[2] https://lore.kernel.org/bpf/20260414195019.684531-1-alan.maguire@oracle.com/
====================

Link: https://patch.msgid.link/20260417143023.1551481-1-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:49 -07:00
Alan Maguire
65350a0ecd Documentation/bpf: Update btf doc with updated vlen, kind sizes
Sync doc with updated UAPI changes utilizing unused bts for
extended vlen, kind values.

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-7-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Alan Maguire
ad256554f1 selftests/bpf: Fix up __u16 vlen assumptions
Fix up a few cases where we assume vlen is 16 bits.

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-6-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Alan Maguire
855af3e775 selftests/bpf: Fix up btf/invalid test for extended kind
With extended kinds, 32 becomes a valid (but not used)
BTF info kind value; fix up the test to check for the
"Invalid kind" rather than "Invalid btf_info" message.
Since all bits are used in BTF info, it is no longer
possible to craft an invalid BTF info value.  Use
127 (new maximum possible kind value).

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-5-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Alan Maguire
22b402457e bpftool: Support 24-bit vlen
Adjust btf_vlen() usage to handle 24-bit vlen.

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-4-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Alan Maguire
cacd6729c0 libbpf: Adjust btf_vlen() to return a __u32
Now that vlen is 24 bits, btf_vlen() must return a __u32.
Adjust use cases in libbpf accordingly.  Also add error
handling to avoid vlen overflow in btf_type_inc_vlen().

Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-3-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Alan Maguire
f7a6b9eaff bpf: Extend BTF UAPI vlen, kinds to use unused bits
BTF maximum vlen is encoded using 16 bits with a maximum vlen
of 65535.  This has sufficed for structs, function parameters
and enumerated type values.  However, with upcoming BTF location
information - in particular information about inline sites -
this limit is surpassed.  Use bits 16-23 - currently unused in
BTF info - to extend to 24 bits, giving a max vlen of (2^24 - 1),
or 16 million.

Also extend BTF kind encoding from 5 to 7 bits, giving a maximum
available number of kinds of 128.  Since with the BTF location work
we use another 3 kinds, we are fast approaching the current limit
of 32.

Convert BTF_MAX_* values to enums to allow them to be encoded in
kernel BTF; this will allow us to detect if the running kernel
supports a 24-bit vlen or not.  Add one for max _possible_
(not used) kind.

Fix up a few places in the kernel where a 16-bit vlen is assumed;
remove BTF_INFO_MASK as now all bits are used.

The vlen expansion was suggested by Andrii in [1]; the kind expansion
is tackled here too as it may be needed also to support new kinds
in BTF.

[1] https://lore.kernel.org/bpf/CAEf4BzZx=X6vGqcA8SPU6D+v6k+TR=ZewebXMuXtpmML058piw@mail.gmail.com/

Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/r/20260417143023.1551481-2-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-20 17:52:48 -07:00
Matt Bobrowski
0aa6378695
selftests/bpf: Fix off-by-one in bpf_cpumask_populate related selftest
The test_populate test uses >= instead of > when checking if the
runtime nr_cpus exceeds the bit capacity of a cpumask_t.

On a system where the physical CPU core count perfectly matches the
CONFIG_NR_CPUS upper bound (e.g. nr_cpus = 512 and CONFIG_NR_CPUS =
512), the condition nr_cpus >= CPUMASK_TEST_MASKLEN * 8 evaluates to
true (512 >= 512). This incorrectly causes the test to fail with an
error value of 3.

A 512-bit cpumask_t provides enough bits (indices 0 through 511) to
represent 512 CPUs. The subsequent bpf_for(i, 0, nr_cpus) loop
iterates up to nr_cpus - 1 (511), which perfectly aligns with the
maximum valid index of the bitmask.

Change the condition to nr_cpus > CPUMASK_TEST_MASKLEN * 8 to fix the
false positive failure on these systems.

Fixes: 918ba2636d ("selftests: bpf: add bpf_cpumask_populate selftests")
Signed-off-by: Matt Bobrowski <mattbobrowski@google.com>
Acked-by: Paul Chaignon <paul.chaignon@gmail.com>
Link: https://lore.kernel.org/bpf/20260420093734.2400330-1-mattbobrowski@google.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-20 16:22:20 +02:00
Amery Hung
31f61ac330
bpf: Refactor dynptr mutability tracking
Redefine dynptr mutability and fix inconsistency in the verifier and
kfunc signatures. Dynptr mutability is at two levels. The first is
the bpf_dynptr structure and the second is the memory the dynptr points
to. The verifer currently tracks the mutability of the bpf_dynptr struct
through helper and kfunc prototypes, where "const struct bpf_dynptr *"
means the structure itself is immutable. The second level is tracked
in upper bit of bpf_dynptr->size in runtime and is not changed in this
patch.

There are two type of inconsistency in the verfier regarding the
mutability of the bpf_dynptr struct. First, there are many existing
kfuncs whose prototypes are wrong. For example, bpf_dynptr_adjust()
mutates a dynptr's start and offset but marks the argument as a const
pointer. At the same time many other kfuncs that does not mutate the
dynptr but mark themselves as mutable. Second, the verifier currently
does not honor the const qualifier in kfunc prototypes as it determines
whether tagging the arg_type with MEM_RDONLY or not based on the register
state.

Since all the verifier care is to prevent CONST_PTR_TO_DYNPTR from
being destroyed in callback and global subprogram, redefine the
mutability at the bpf_dynptr level to just bpf_dynptr_kern->data. Then,
explicitly prohibit passing CONST_PTR_TO_DYNPTR to an argument tagged
with MEM_UNINIT or OBJ_RELEASE. The mutability of a dynptr's view is not
really interesting so drop MEM_RDONLY annotation for dynptr from the
helpers and kfuncs. Plus, if the mutability of the entire bpf_dynptr
were to be done correctly, it would kill the bpf_dynptr_adjust() usage
in callback and global subporgram.

Implementation wise

- First, make sure all kfunc arg are correctly tagged: Tag the dynptr
  argument of bpf_dynptr_file_discard() with OBJ_RELEASE.
- Then, in process_dynptr_func(), make sure CONST_PTR_TO_DYNPTR cannot
  be passed to argument tagged with MEM_UNINIT or OBJ_RELEASE. For
  MEM_UNINIT, it is already checked by is_dynptr_reg_valid_uninit().
  For OBJ_RELEASE, check against OBJ_RELEASE instead of MEM_RDONLY and
  drop a now identical check in unmark_stack_slots_dynptr().
- Remove the mutual exclusive check between MEM_UNINIT and MEM_RDONLY,
  but don't add a MEM_UNINIT and OBJ_RELEASE version as it is obviously
  wrong.

Note that while this patch stops following the C semantic for the
mutability of bpf_dynptr, the prototype of kfuncs are still fixed to
maintain the correct C semantics in the implementation. Adding or
removing the const qualifier does not break backward compatibility.
In addition, fix kfuncs dropping the const qualifier when casting the
opaque bpf_dynptr to bpf_dynptr_kern.

In test_kfunc_dynptr_param.c, initialize dynptr to 0 to avoid
-Wuninitialized-const-pointer warning.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260414191014.1218567-1-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-19 15:16:44 +02:00
Amery Hung
7c528b364b
selftests/bpf: Trace bpf_local_storage_update to debug flaky local storage tests
task_local_storage/sys_enter_exit and cgrp_local_storage/
cgroup_iter_sleepable occasionally fail in CI possibly because
bpf_{task,cgrp}_storage_get() returns NULL. Add a fexit probe on
bpf_local_storage_update() to capture the actual error code when this
happens. It will allow us to tell if it is trylock failure in
kmalloc_nolock(), timeout/deadlock in rqspinlock or something else.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Acked-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
Link: https://lore.kernel.org/bpf/20260417233631.1443199-1-ameryhung@gmail.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-19 13:52:50 +02:00
Aaron Tomlin
ad35d80186
libbpf: Report error when a negative kprobe offset is specified
In attach_kprobe(), the parsing logic uses sscanf() to extract the
target function name and offset from the section definition. Currently,
if a user specifies a negative offset (e.g., SEC("kprobe/func+-100")),
the input is not explicitly caught and reported as an error.

This commit updates the logic to explicitly notify the user when a
negative integer is provided. To facilitate this check, the offset
variable is changed from unsigned long to long so that sscanf()
can accurately capture a negative input for evaluation.

If a negative offset is detected, the loader will now print an
informative warning stating that the offset must be non-negative,
and return -EINVAL.

Additionally, free(func) is called in this new error path to prevent
a memory leak, as the function name string is dynamically allocated
by sscanf().

Fixes: e3f9bc35ea ("libbpf: Allow decimal offset for kprobes")
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Acked-by: Mykyta Yatsenko <yatsenko@meta.com>
Link: https://lore.kernel.org/bpf/20260419030944.1423642-1-atomlin@atomlin.com
Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-04-19 13:52:34 +02:00
Linus Torvalds
eb5249b125 parisc architecture fixes and updates for kernel v7.1-rc1:
- A fix to make modules on 32-bit parisc architecture work again
 - Drop ip_fast_csum() inline assembly to avoid unaligned memory accesses
 - Allow to build kernel without 32-bit VDSO
 - Reference leak fix in error path in LED driver
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQS86RI+GtKfB8BJu973ErUQojoPXwUCaeOk+QAKCRD3ErUQojoP
 X6fjAQD0DK47ZT3fuUGVH0T1mg6kZ2a7fSrNkjbGW+B87jlZVQD/ez6eLdZ7+B4f
 k+sQ9Y0e18Ypgi1uvtNFe1lzX25jrQg=
 =GnPk
 -----END PGP SIGNATURE-----

Merge tag 'parisc-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux

Pull parisc architecture updates from Helge Deller:

 - A fix to make modules on 32-bit parisc architecture work again

 - Drop ip_fast_csum() inline assembly to avoid unaligned memory
   accesses

 - Allow to build kernel without 32-bit VDSO

 - Reference leak fix in error path in LED driver

* tag 'parisc-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: led: fix reference leak on failed device registration
  module.lds.S: Fix modules on 32-bit parisc architecture
  parisc: Allow to build without VDSO32
  parisc: Include 32-bit VDSO only when building for 32-bit or compat mode
  parisc: Allow to disable COMPAT mode on 64-bit kernel
  parisc: Fix default stack size when COMPAT=n
  parisc: Fix signal code to depend on CONFIG_COMPAT instead of CONFIG_64BIT
  parisc: is_compat_task() shall return false for COMPAT=n
  parisc: Avoid compat syscalls when COMPAT=n
  parisc: _llseek syscall is only available for 32-bit userspace
  parisc: Drop ip_fast_csum() inline assembly implementation
  parisc: update outdated comments for renamed ccio_alloc_consistent()
2026-04-18 11:37:36 -07:00
Linus Torvalds
9055c64567 memblock: updates for 7.0-rc1
* improve debugability of reserve_mem kernel parameter handling with print
   outs in case of a failure and debugfs info showing what was actually
   reserved
 * Make memblock_free_late() and free_reserved_area() use the same core
   logic for freeing the memory to buddy and ensure it takes care of
   updating memblock arrays when ARCH_KEEP_MEMBLOCK is enabled.
 -----BEGIN PGP SIGNATURE-----
 
 iQFEBAABCgAuFiEEeOVYVaWZL5900a/pOQOGJssO/ZEFAmnjRmsQHHJwcHRAa2Vy
 bmVsLm9yZwAKCRA5A4Ymyw79kYh0CAC4NpZGFqpEBep1eQcfqsPH05dvp1LUXDNk
 i5GwS2ht/F5D9GcD+EyoYRQjRM8k+XZyOe3sqEF01Uav/rHAv3XrITg/pfiA92AR
 K7CvQv4NvyQqUNcv/mEb+P8niriJ4oHRXCag9inop1jo/x3Mym07oEy73rknAx9r
 ZQKwoFNOM/QQGVb9hZUANKCkE8cAsUXG89yEOH0n17FOahC0PZbK/vxjeO+br3IL
 HxEoC5l1j4cUauf8XEhsVXXdch0iqit/fB3ROePYFNCx7koVYHk6Yl1w++AM0RUA
 ypOmfPsSiqLY2ciuTIAnpTeMfQkkhEmMI3mp6T5BUBwSKJxLRaSM
 =c1xd
 -----END PGP SIGNATURE-----

Merge tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock

Pull memblock updates from Mike Rapoport:

 - improve debuggability of reserve_mem kernel parameter handling with
   print outs in case of a failure and debugfs info showing what was
   actually reserved

 - Make memblock_free_late() and free_reserved_area() use the same core
   logic for freeing the memory to buddy and ensure it takes care of
   updating memblock arrays when ARCH_KEEP_MEMBLOCK is enabled.

* tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock:
  x86/alternative: delay freeing of smp_locks section
  memblock: warn when freeing reserved memory before memory map is initialized
  memblock, treewide: make memblock_free() handle late freeing
  memblock: make free_reserved_area() update memblock if ARCH_KEEP_MEMBLOCK=y
  memblock: extract page freeing from free_reserved_area() into a helper
  memblock: make free_reserved_area() more robust
  mm: move free_reserved_area() to mm/memblock.c
  powerpc: opal-core: pair alloc_pages_exact() with free_pages_exact()
  powerpc: fadump: pair alloc_pages_exact() with free_pages_exact()
  memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name()
  memblock: move reserve_bootmem_range() to memblock.c and make it static
  memblock: Add reserve_mem debugfs info
  memblock: Print out errors on reserve_mem parser
2026-04-18 11:29:14 -07:00
Linus Torvalds
fba676bd29 i2c-for-7.1-rc1-part1
- generic cleanups in npcm7xx, qcom-cci, xiic and designware DT
   bindings
 - atr: use kzalloc_flex for alias pool allocation
 - ixp4xx: convert bindings to DT schema
 - ocores: use read_poll_timeout_atomic() for polling waits
 - qcom-geni: skip extra TX DMA TRE for single read messages
 - s3c24xx: validate SMBus block length before using it
 - spacemit: refactor xfer path and add K1 PIO support
 - tegra: identify DVC and VI with SoC data variants
 - tegra: support SoC-specific register offsets
 - xiic: switch to devres and generic fw properties
 - xiic: skip input clock setup on non-OF systems
 - various minor improvements in other drivers
 
 rtl9300:
 - add per-SoC callbacks and clock support for RTL9607C
 - add support for new 50 kHz and 2.5 MHz bus speeds
 - general refactoring in preparation for RTL9607C support
 
 New support:
 - DesignWare GOOG5000 (ACPI HID)
 - Intel Nova Lake (ACPI ID)
 - Realtek RTL9607C
 - SpacemiT K3 binding
 - Tegra410 register layout support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEOZGx6rniZ1Gk92RdFA3kzBSgKbYFAmnjHO8ACgkQFA3kzBSg
 KbaWaw//eCB8xtFFo2S4i/ZJrnLnEo317VJBtHiAQjQdV+9LgVIk8S66JG5mzzJO
 yFVBXZ6Qx6RuPUxYo8V+PvW/4/GemcWANcnztT3G6+SQXF6ATcnnDzzCf9KjV5PI
 m7RNH44hZInP39TBpAj/hG2eas4F4S0zkcpuV+s5IB7tUkxdQhkSjrseMoTVZGh8
 FDEsiQIlJR3qxjIa/FPw1/iuC7FJHJfuWjT3czNil0uLb/i+xOpHWjDvgaAXi+wU
 U58zz2AyJTbUPclO0H4udbQbQ+qACjOSaelEf+v5wlWmy6BT0ZI+CO/pRteD+Iix
 UHb/zPilrBG42JN+L7ndJat4jW1POEi6fol9y1gg9yWtH09QGEfR16+YlqDag4/M
 Cgu1I3QUatGlT7jXkg8pr2Q/u7IFi4XGyvsNIs4k7oqYkbZKMCyWFDPVC5EByNus
 JcnpRACuJldDv3Rj1jZXUjVE1vDBb438lR8XRrrGpYd+j7xS7vFRjDxE/47y+weR
 sP83ODZH2GesQx3VkZPOnINd9/qfKEPYqilxkkoAO+0mh+iCdstyrjg3VlFbZNpf
 eeSZqlGNLVcDEpY8HENSLxdp3PANRxTqDVlGrYPEt3WH0EmWOhhXLOysKtDEgehL
 qKYiouyXgcCwVgBkp3sR7REQ0+LfRi+U8Y2Rw02WKjMk1jclRUA=
 =G0Mn
 -----END PGP SIGNATURE-----

Merge tag 'i2c-for-7.1-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

Pull i2c updates from Wolfram Sang:
 "The biggest news in this pull request is that it will start the last
  cycle of me handling the I2C subsystem. From 7.2. on, I will pass
  maintainership to Andi Shyti who has been maintaining the I2C drivers
  for a while now and who has done a great job in doing so.

  We will use this cycle for a hopefully smooth transition. Thanks must
  go to Andi for stepping up! I will still be around for guidance.

  Updates:
   - generic cleanups in npcm7xx, qcom-cci, xiic and designware DT
     bindings
   - atr: use kzalloc_flex for alias pool allocation
   - ixp4xx: convert bindings to DT schema
   - ocores: use read_poll_timeout_atomic() for polling waits
   - qcom-geni: skip extra TX DMA TRE for single read messages
   - s3c24xx: validate SMBus block length before using it
   - spacemit: refactor xfer path and add K1 PIO support
   - tegra: identify DVC and VI with SoC data variants
   - tegra: support SoC-specific register offsets
   - xiic: switch to devres and generic fw properties
   - xiic: skip input clock setup on non-OF systems
   - various minor improvements in other drivers

  rtl9300:
   - add per-SoC callbacks and clock support for RTL9607C
   - add support for new 50 kHz and 2.5 MHz bus speeds
   - general refactoring in preparation for RTL9607C support

  New support:
   - DesignWare GOOG5000 (ACPI HID)
   - Intel Nova Lake (ACPI ID)
   - Realtek RTL9607C
   - SpacemiT K3 binding
   - Tegra410 register layout support"

* tag 'i2c-for-7.1-rc1-part1' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (40 commits)
  i2c: usbio: Add ACPI device-id for NVL platforms
  i2c: qcom-geni: Avoid extra TX DMA TRE for single read message in GPI mode
  i2c: atr: use kzalloc_flex
  i2c: spacemit: introduce pio for k1
  i2c: spacemit: move i2c_xfer_msg()
  i2c: xiic: skip input clock setup on non-OF systems
  i2c: xiic: use numbered adapter registration
  i2c: xiic: cosmetic: use resource format specifier in debug log
  i2c: xiic: cosmetic cleanup
  i2c: xiic: switch to generic device property accessors
  i2c: xiic: remove duplicate error message
  i2c: xiic: switch to devres managed APIs
  i2c: rtl9300: add RTL9607C i2c controller support
  i2c: rtl9300: introduce new function properties to driver data
  i2c: rtl9300: introduce clk struct for upcoming rtl9607 support
  dt-bindings: i2c: realtek,rtl9301-i2c: extend for clocks and RTL9607C support
  i2c: rtl9300: introduce a property for 8 bit width reg address
  i2c: rtl9300: introduce F_BUSY to the reg_fields struct
  i2c: rtl9300: introduce max length property to driver data
  i2c: rtl9300: split data_reg into read and write reg
  ...
2026-04-18 09:44:22 -07:00
Linus Torvalds
1e76965696 ipmi: Small updates and fixes
Mostly fixes to the BMC software.
 
 Fix one issue in the host side driver where a kthread can be left
 running on a specific memory allocation failre at probe time.
 
 Replace system_wq with system_percpu_wq so system_wq can eventually go
 away.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE/Q1c5nzg9ZpmiCaGYfOMkJGb/4EFAmni3QYACgkQYfOMkJGb
 /4Fk1hAAmBN9WJHDeJrZ0WvS4O2iQ2rfQM7nc1H7eBR+it6mntEy4bn4Sn2WTXmo
 TzGWTY9mKKVQmiAWtw16gHhlDqZN0JKjnfxq0K+MgJA36+Mg1bLrK34Lf7NsQXUS
 6SMk5y6ZesfDugYP7LMfg4Bttf3BXo6kqjn+GZwWWrlbOvPDcouAenia1BmJhQ95
 6UBniqE5X8yStuCo+CbfgapD3sTD9DJEKmk7KsWHG0Dk52RS4PiFwnPsiIBXQz+U
 1sadtY7S6jBAnFcJcMcrs2vfx80XluoqG3AS+LIhTss2Qf4XeutXgyi2v38GdmtO
 0J1GdKO8IE44ax1adiXPsvNETYiJEZvgJxZ1qq7TppVD1ui0nfIdCjFcjR1xe0Lq
 Sl+18qVCYi/jKvw+XIU4zCEJunhZxoF5lvW/aScml92CTTM+S928WRRgixatDJL1
 MNyRTdw3dLj0I8lKSSfXGqAdOF4i+4SmsG/jeV9lOJi9RE6WzPrReN1fyWG5T/nR
 ihpIoXsCa3EkQP4i3NPL39Il/YiLTnyttBWHnGU8ct8Igpd5mrOv+0fPECFRGw07
 sPAudBvNPzPmGg9rFmIltsVWnldffxA/jw+GRYhvD5nV4GVJf7SH8HvuBoPDDeHx
 h7nfbca5TxXDIwJvGuLWz1EY7Jj9YLfDAb3CcqM5Px3HlAScNbA=
 =549p
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.1-1' of https://github.com/cminyard/linux-ipmi

Pull ipmi updates from Corey Minyard:
 "Small updates and fixes (mostly to the BMC software):

   - Fix one issue in the host side driver where a kthread can be left
     running on a specific memory allocation failre at probe time

   - Replace system_wq with system_percpu_wq so system_wq can eventually
     go away"

* tag 'for-linus-7.1-1' of https://github.com/cminyard/linux-ipmi:
  ipmi:ssif: Clean up kthread on errors
  ipmi:ssif: Remove unnecessary indention
  ipmi: ssif_bmc: Fix KUnit test link failure when KUNIT=m
  ipmi: ssif_bmc: add unit test for state machine
  ipmi: ssif_bmc: change log level to dbg in irq callback
  ipmi: ssif_bmc: fix message desynchronization after truncated response
  ipmi: ssif_bmc: fix missing check for copy_to_user() partial failure
  ipmi: ssif_bmc: cancel response timer on remove
  ipmi: Replace use of system_wq with system_percpu_wq
2026-04-18 09:33:54 -07:00
Linus Torvalds
df8f6181ab perf tools updates for 7.1
perf report:
 
  - Add 'comm_nodigit' sort key to combine similar threads that only have
    different numbers in the comm.  In the following example, the
    'comm_nodigit' will have samples from all threads starting with
    "bpfrb/" into an entry "bpfrb/<N>".
 
     $ perf report -s comm_nodigit,comm -H
     ...
     #
     #    Overhead  CommandNoDigit / Command
     # ...........  ........................
     #
         20.30%     swapper
            20.30%     swapper
         13.37%     chrome
            13.37%     chrome
         10.07%     bpfrb/<N>
             7.47%     bpfrb/0
             0.70%     bpfrb/1
             0.47%     bpfrb/3
             0.46%     bpfrb/2
             0.25%     bpfrb/4
             0.23%     bpfrb/5
             0.20%     bpfrb/6
             0.14%     bpfrb/10
             0.07%     bpfrb/7
 
  - Support flat layout for symfs.  The --symfs option is to specify the
    location of debugging symbol files.  The default 'hierarchy' layout
    would search the symbol file using the same path of the original file
    under the symfs root.  The new 'flat' layout would search only in the
    root directory.
 
  - Update 'simd' sort key for ARM SIMD flags to cover ASE/SME and more
    predicate flags.
 
 perf stat:
 
  - Add --pmu-filter option to select specific PMUs.  This would be
    useful when you measure metrics from multiple instance of uncore PMUs
    with similar names.
 
     # perf stat -M cpa_p0_avg_bw
      Performance counter stats for 'system wide':
 
         19,417,779,115      hisi_sicl0_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                      0      hisi_sicl0_cpa0/cpa_p0_wr_dat/
                      0      hisi_sicl0_cpa0/cpa_p0_rd_dat_64b/
                      0      hisi_sicl0_cpa0/cpa_p0_rd_dat_32b/
         19,417,751,103      hisi_sicl10_cpa0/cpa_cycles/     #     0.00 cpa_p0_avg_bw
                      0      hisi_sicl10_cpa0/cpa_p0_wr_dat/
                      0      hisi_sicl10_cpa0/cpa_p0_rd_dat_64b/
                      0      hisi_sicl10_cpa0/cpa_p0_rd_dat_32b/
         19,417,730,679      hisi_sicl2_cpa0/cpa_cycles/      #     0.31 cpa_p0_avg_bw
             75,635,749      hisi_sicl2_cpa0/cpa_p0_wr_dat/
             18,520,640      hisi_sicl2_cpa0/cpa_p0_rd_dat_64b/
                      0      hisi_sicl2_cpa0/cpa_p0_rd_dat_32b/
         19,417,674,227      hisi_sicl8_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                      0      hisi_sicl8_cpa0/cpa_p0_wr_dat/
                      0      hisi_sicl8_cpa0/cpa_p0_rd_dat_64b/
                      0      hisi_sicl8_cpa0/cpa_p0_rd_dat_32b/
 
           19.417734480 seconds time elapsed
 
    With --pmu-filter, users can select only hisi_sicl2_cpa0 PMU.
 
     # perf stat --pmu-filter hisi_sicl2_cpa0 -M cpa_p0_avg_bw
      Performance counter stats for 'system wide':
 
          6,234,093,559      cpa_cycles                       #     0.60 cpa_p0_avg_bw
             50,548,465      cpa_p0_wr_dat
              7,552,182      cpa_p0_rd_dat_64b
                      0      cpa_p0_rd_dat_32b
 
            6.234139320 seconds time elapsed
 
 Data type profiling:
 
  - Quality improvements by tracking register state more precisely.
  - Ensure array members to get the type.
  - Handle more cases for global variables.
 
 Vendor event/metric updates:
 
  - Update various Intel events and metrics
  - Add NVIDIA Tegra 410 Olympus events
 
 Internal changes:
 
  - Verify perf.data header for maliciously crafted files.
  - Update perf test to cover more usages and make them robust.
  - Move a couple of copied kernel headers not to annoy objtool build.
  - Fix a bug in map sorting in name order.
  - Remove some unused codes.
 
 Misc:
 
  - Fix module symbol resolution with non-zero text address.
  - Add -t/--threads option to `perf bench mem mmap`.
  - Track duration of exit*() syscall by `perf trace -s`.
  - Add core.addr2line-timeout and core.addr2line-disable-warn config
    items.
 
 Signed-off-by: Namhyung Kim <namhyung@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSo2x5BnqMqsoHtzsmMstVUGiXMgwUCaeKePAAKCRCMstVUGiXM
 g5HiAQD7V4hiNd1atnY2slRfvkqSV7wlrXjYEQj01Ht0eJxJwAEA+3991R+6+RTZ
 9AbC0LvjBgKhnRDR1/DE+GkXUmQZnwA=
 =rlNN
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-for-v7.1-2026-04-17' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools updates from Namhyung Kim:
 "perf report:

   - Add 'comm_nodigit' sort key to combine similar threads that only
     have different numbers in the comm. In the following example, the
     'comm_nodigit' will have samples from all threads starting with
     "bpfrb/" into an entry "bpfrb/<N>".

        $ perf report -s comm_nodigit,comm -H
        ...
        #
        #    Overhead  CommandNoDigit / Command
        # ...........  ........................
        #
            20.30%     swapper
               20.30%     swapper
            13.37%     chrome
               13.37%     chrome
            10.07%     bpfrb/<N>
                7.47%     bpfrb/0
                0.70%     bpfrb/1
                0.47%     bpfrb/3
                0.46%     bpfrb/2
                0.25%     bpfrb/4
                0.23%     bpfrb/5
                0.20%     bpfrb/6
                0.14%     bpfrb/10
                0.07%     bpfrb/7

   - Support flat layout for symfs. The --symfs option is to specify the
     location of debugging symbol files. The default 'hierarchy' layout
     would search the symbol file using the same path of the original
     file under the symfs root. The new 'flat' layout would search only
     in the root directory.

   - Update 'simd' sort key for ARM SIMD flags to cover ASE/SME and more
     predicate flags.

  perf stat:

   - Add --pmu-filter option to select specific PMUs. This would be
     useful when you measure metrics from multiple instance of uncore
     PMUs with similar names.

        # perf stat -M cpa_p0_avg_bw
         Performance counter stats for 'system wide':

            19,417,779,115      hisi_sicl0_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                         0      hisi_sicl0_cpa0/cpa_p0_wr_dat/
                         0      hisi_sicl0_cpa0/cpa_p0_rd_dat_64b/
                         0      hisi_sicl0_cpa0/cpa_p0_rd_dat_32b/
            19,417,751,103      hisi_sicl10_cpa0/cpa_cycles/     #     0.00 cpa_p0_avg_bw
                         0      hisi_sicl10_cpa0/cpa_p0_wr_dat/
                         0      hisi_sicl10_cpa0/cpa_p0_rd_dat_64b/
                         0      hisi_sicl10_cpa0/cpa_p0_rd_dat_32b/
            19,417,730,679      hisi_sicl2_cpa0/cpa_cycles/      #     0.31 cpa_p0_avg_bw
                75,635,749      hisi_sicl2_cpa0/cpa_p0_wr_dat/
                18,520,640      hisi_sicl2_cpa0/cpa_p0_rd_dat_64b/
                         0      hisi_sicl2_cpa0/cpa_p0_rd_dat_32b/
            19,417,674,227      hisi_sicl8_cpa0/cpa_cycles/      #     0.00 cpa_p0_avg_bw
                         0      hisi_sicl8_cpa0/cpa_p0_wr_dat/
                         0      hisi_sicl8_cpa0/cpa_p0_rd_dat_64b/
                         0      hisi_sicl8_cpa0/cpa_p0_rd_dat_32b/

              19.417734480 seconds time elapsed

     With --pmu-filter, users can select only hisi_sicl2_cpa0 PMU.

        # perf stat --pmu-filter hisi_sicl2_cpa0 -M cpa_p0_avg_bw
         Performance counter stats for 'system wide':

             6,234,093,559      cpa_cycles                       #     0.60 cpa_p0_avg_bw
                50,548,465      cpa_p0_wr_dat
                 7,552,182      cpa_p0_rd_dat_64b
                         0      cpa_p0_rd_dat_32b

               6.234139320 seconds time elapsed

  Data type profiling:

   - Quality improvements by tracking register state more precisely

   - Ensure array members to get the type

   - Handle more cases for global variables

  Vendor event/metric updates:

   - Update various Intel events and metrics

   - Add NVIDIA Tegra 410 Olympus events

  Internal changes:

   - Verify perf.data header for maliciously crafted files

   - Update perf test to cover more usages and make them robust

   - Move a couple of copied kernel headers not to annoy objtool build

   - Fix a bug in map sorting in name order

   - Remove some unused codes

  Misc:

   - Fix module symbol resolution with non-zero text address

   - Add -t/--threads option to `perf bench mem mmap`

   - Track duration of exit*() syscall by `perf trace -s`

   - Add core.addr2line-timeout and core.addr2line-disable-warn config
     items"

* tag 'perf-tools-for-v7.1-2026-04-17' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (131 commits)
  perf loongarch: Fix build failure with CONFIG_LIBDW_DWARF_UNWIND
  perf annotate: Use jump__delete when freeing LoongArch jumps
  perf test: Fixes for check branch stack sampling
  perf test: Fix inet_pton probe failure and unroll call graph
  perf build: fix "argument list too long" in second location
  perf header: Add sanity checks to HEADER_BPF_BTF processing
  perf header: Sanity check HEADER_BPF_PROG_INFO
  perf header: Sanity check HEADER_PMU_CAPS
  perf header: Sanity check HEADER_HYBRID_TOPOLOGY
  perf header: Sanity check HEADER_CACHE
  perf header: Sanity check HEADER_GROUP_DESC
  perf header: Sanity check HEADER_PMU_MAPPINGS
  perf header: Sanity check HEADER_MEM_TOPOLOGY
  perf header: Sanity check HEADER_NUMA_TOPOLOGY
  perf header: Sanity check HEADER_CPU_TOPOLOGY
  perf header: Sanity check HEADER_NRCPUS and HEADER_CPU_DOMAIN_INFO
  perf header: Bump up the max number of command line args allowed
  perf header: Validate nr_domains when reading HEADER_CPU_DOMAIN_INFO
  perf sample: Fix documentation typo
  perf arm_spe: Improve SIMD flags setting
  ...
2026-04-18 09:24:56 -07:00
Linus Torvalds
8541d8f725 * MTD changes
mtdconcat finally makes it in, after several years of being merged and
 reverted.
 
 Baikal SoC support is being removed, so MTD bits are being removed as
 well.
 
 All the other changes are misc cleanups.
 
 * NAND changes
 
 The main changes happened in the SunXi driver in order to
 support new versions of the Allwinner NAND controller.
 
 There are also some DT-binding improvements and cleanups.
 
 Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND),
 aside with the usual load of misc changes.
 
 * SPI NOR changes
 
 There is only a collection of bugfixes this time around, with no notable
 changes to the core. Some of the more noteworthy bugfixes listed below.
 
 - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup
   since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for fixing
   mt35xu02gcba") but did not add it due to lack of hardware to test on.
 
 - Fix locking on some Winbond w25q series flashes.
 
 - Fix Auto Address Increment (AAI) writes on SST that flashes that start
   on odd address. The write enable latch needs to be set again after the
   single byte program.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmnikDUACgkQJWrqGEe9
 VoQFDgf/WvlAbHSY1NLNB6tRgNj9n7Y8tDbSLY4nI7PjBJdQeu92PMHTs45TvMLS
 ZYyJ7ew2yf3i5KScMrz7LBGmLocGkUXD6HlFXLSy2uuwNk9REF+zwFpKLF0sLP4P
 mU1ZRukql8VTPrPA3iMJzTn7atya3PtOhAFSXDagUWzIFFdkfynTHJgPBpZYZr0n
 0xyn+uFSJCUJntfR4mPPsXH+IwGfpthI4olWAu/K4TTwZUv9qxlfe9TDEYG8PIJ4
 7DsvG/XqF2gQcWR7+VM5Wsow/EvgKqfvwgTRD2INetwUvYbJCw+xyVQGzN/3IMpR
 AMM1cv2t4dPEPgydrZiLDG5d3jynvQ==
 =sOg7
 -----END PGP SIGNATURE-----

Merge tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull MTD updates from Miquel Raynal:
 "MTD changes:

   - mtdconcat finally makes it in, after several years of being merged
     and reverted

   - Baikal SoC support is being removed, so MTD bits are being removed
     as well

   - misc cleanups

  NAND changes:

   - SunXi driver support for new versions of the Allwinner NAND
     controller.

   - DT-binding improvements and cleanups.

   - A few fixes (Realtek ECC and Winbond SPI NAND), aside with the
     usual load of misc changes.

  SPI NOR fixes:

   - Enable die erase on MT35XU02GCBA. We knew this flash needed this
     fixup since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for
     fixing mt35xu02gcba") but did not add it due to lack of hardware to
     test on.

   - Fix locking on some Winbond w25q series flashes.

   - Fix Auto Address Increment (AAI) writes on SST that flashes that
     start on odd address. The write enable latch needs to be set again
     after the single byte program"

* tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (44 commits)
  mtd: spinand: winbond: Declare the QE bit on W25NxxJW
  mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA
  mtd: spi-nor: winbond: Fix locking support for w25q256jw
  mtd: spi-nor: sst: Fix write enable before AAI sequence
  mtd: spi-nor: winbond: Fix locking support for w25q64jvm
  mtd: spi-nor: winbond: Fix locking support for w25q256jwm
  dt-bindings: mtd: mxc-nand: add missing compatible string and ref to nand-controller-legacy.yaml
  dt-bindings: mtd: gpmi-nand: ref to nand-controller-legacy.yaml
  dt-bindings: mtd: refactor NAND bindings and add nand-controller-legacy.yaml
  mtd: spinand: winbond: Clarify when to enable the HS bit
  mtd: rawnand: sunxi: introduce maximize variable user data length
  mtd: rawnand: sunxi: fix typos in comments
  mtd: rawnand: sunxi: change error prone variable name
  mtd: rawnand: sunxi: remove dead code
  mtd: rawnand: sunxi: make the code more self-explanatory
  mtd: rawnand: sunxi: replace hard coded value by a define - take2
  mtd: rawnand: sunxi: do not count BBM bytes twice
  mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
  mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarification
  mtd: cmdlinepart: use a flexible array member
  ...
2026-04-17 17:57:04 -07:00
Linus Torvalds
a436a0b847 Various clean ups and bug fixes in ext4 for 7.1:
* Refactor code paths involved with partial block zero-out in
     prearation for converting ext4 to use iomap for buffered writes.
   * Remove use of d_alloc() from ext4 in preparation for the deprecation
     of this interface.
   * Replace some J_ASSERTS with a journal abort so we can avoid a kernel
     panic for a localized file system error
   * Simplify various code paths in mballoc, move_extent, and fast commit
   * Fix rare deadlock in jbd2_journal_cancel_revoke() that can be
     triggered by generic/013 when blocksize < pagesize.
   * Fix memory leak when releasing an extended attribute when its
     value is stored in an ea_inode
   * Fix various potential kunit test bugs in fs/ext4/extents.c
   * Fix potential out-of-bounds access in check_xattr() with a corrupted
     file system
   * Make the jbd2_inode dirty range tracking safe for lockless reads
   * Avoid a WARN_ON when writeback files due to a corrupted file system;
     we already print an ext4 warning indicatign that data will be lost,
     so the WARN_ON is not necessary and doesn't add any new information
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCAAdFiEEK2m5VNv+CHkogTfJ8vlZVpUNgaMFAmniS4wACgkQ8vlZVpUN
 gaM1lgf/e9Csrz5Zxyf+VEdE5+kQjuaT0feTe/gUMM53jqMiT7cC30JBF1istkaz
 O3qBe6x8O5iHDv1Z/umcI+A4GtAUj6SsTjwggQPJyJvUqHDPsruGfyD6wBmmNyJ2
 N9Y3OZ8I5W7c7ecES6/a7W7VheSe9kkgPDD5eBhw7R4l71Q+B2foW4snQ8wcGTNm
 uO/QosbaOArGsXHTTcOmOdwxEDIUV16g/iJMhszCI1gaukmL14DIzFtwYkateUBD
 Wi1+tmZmMvqSkKJ/6PELLoawiUPhTL6OuPANyIid/1Yv5dxMec8XiO/CXRt7r2X3
 q9Nrpqfs3fxv63r2IUJ7+yQVYGXK9g==
 =MG/0
 -----END PGP SIGNATURE-----

Merge tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4

Pull ext4 updates from Ted Ts'o:

 - Refactor code paths involved with partial block zero-out in
   prearation for converting ext4 to use iomap for buffered writes

 - Remove use of d_alloc() from ext4 in preparation for the deprecation
   of this interface

 - Replace some J_ASSERTS with a journal abort so we can avoid a kernel
   panic for a localized file system error

 - Simplify various code paths in mballoc, move_extent, and fast commit

 - Fix rare deadlock in jbd2_journal_cancel_revoke() that can be
   triggered by generic/013 when blocksize < pagesize

 - Fix memory leak when releasing an extended attribute when its value
   is stored in an ea_inode

 - Fix various potential kunit test bugs in fs/ext4/extents.c

 - Fix potential out-of-bounds access in check_xattr() with a corrupted
   file system

 - Make the jbd2_inode dirty range tracking safe for lockless reads

 - Avoid a WARN_ON when writeback files due to a corrupted file system;
   we already print an ext4 warning indicatign that data will be lost,
   so the WARN_ON is not necessary and doesn't add any new information

* tag 'ext4_for_linux-7.0-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (37 commits)
  jbd2: fix deadlock in jbd2_journal_cancel_revoke()
  ext4: fix missing brelse() in ext4_xattr_inode_dec_ref_all()
  ext4: fix possible null-ptr-deref in mbt_kunit_exit()
  ext4: fix possible null-ptr-deref in extents_kunit_exit()
  ext4: fix the error handling process in extents_kunit_init).
  ext4: call deactivate_super() in extents_kunit_exit()
  ext4: fix miss unlock 'sb->s_umount' in extents_kunit_init()
  ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access
  ext4: zero post-EOF partial block before appending write
  ext4: move pagecache_isize_extended() out of active handle
  ext4: remove ctime/mtime update from ext4_alloc_file_blocks()
  ext4: unify SYNC mode checks in fallocate paths
  ext4: ensure zeroed partial blocks are persisted in SYNC mode
  ext4: move zero partial block range functions out of active handle
  ext4: pass allocate range as loff_t to ext4_alloc_file_blocks()
  ext4: remove handle parameters from zero partial block functions
  ext4: move ordered data handling out of ext4_block_do_zero_range()
  ext4: rename ext4_block_zero_page_range() to ext4_block_zero_range()
  ext4: factor out journalled block zeroing range
  ext4: rename and extend ext4_block_truncate_page()
  ...
2026-04-17 17:08:31 -07:00
Linus Torvalds
30999ad049 Orangefs: changes for 7.1
Fixes:
 orangefs: validate getxattr response length
 orangefs_readahead: don't overflow the bufmap slot.
 orangefs-debugfs.c: fix parsing problem with kernel debug keywords.
 
 Cleanup:
 debugfs: take better advantage of strscpy.
 
 New:
 bufmap: manage as folios
 orangefs: add usercopy whitelist to orangefs_op_cache
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEWLOQAZkv9m2xtUCf/Vh1C1u0YnAFAmniPnUACgkQ/Vh1C1u0
 YnAUcxAAjZecgHRAhKDrZ4vbTwJW10aLBcwPzzh1VETU9pVXHtW4jn/FKuoJzL+T
 yHMMZq3NBs6KMHZoLbf9Qtsl6n4mEGvOfmWaYjb/Lc5WhCHoavDpnotA2AWnOVQL
 Gmv+rDkl1GrXelhsXucquUpu4WzBJDoQfKSyIlIRUjih6Noq/HpbNElxNi/oMG0u
 8EQZOQWHWrhozP2yV8sF+9MscI0TuD0snY0a3jjqpndzLwhDk1ierdUSct2XUPMe
 iT8UTG+tVE8XDEd2/wzWXSc+rY1HmOuNyKq1j4Hc5E86NpV9gDdNG8cqhdRA/ZlQ
 1O6nYkezA9WcG+pCUWbtOs+ZfSKv8xDLCB7lt1Uy1tlWJSOE5nOvKqcggvdeNrcA
 2JwQ7oXNGvpXezN415CVlcnBQKW+A61gMPX9TKxN4XX+Gjqsu7ZWNm4rQd+vlLsw
 Rz4kgu72LusYkWXwmt0imKpfenn4W89DT7JujolZaElCGJoWWo1VLFMogiePzbxt
 9YsUyXPb4G9I5Wfh4hIqLV11x52rk0uddG7DU4GOZBdE5fXbbhXThl7c3+7MyW9h
 QpDAgG/hEY4UcpVv8wUqpXXNdl1Lo5Op1b2QI0LHEXWZ5Hb5LIuHq/NeBBrnIxVu
 Ad7CWkH7GYLFl+km/oRv9gm0SG1rTIrwSczZSh0BNV5E8v539is=
 =cEBr
 -----END PGP SIGNATURE-----

Merge tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

Pull orangefs updates from Mike Marshall:
 "Fixes:
   - validate getxattr response length
   - don't overflow the bufmap slot on readahead
   - fix parsing problem with kernel debug keywords

  Cleanup:
   - take better advantage of strscpy

  New:
   - manage bufmap as folios
   - add usercopy whitelist to orangefs_op_cache"

* tag 'for-linus-7.1-ofs1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  bufmap: manage as folios, V2.
  orangefs: validate getxattr response length
  orangefs_readahead: don't overflow the bufmap slot.
  debugfs: take better advantage of strscpy.
  orangefs: add usercopy whitelist to orangefs_op_cache
  orangefs-debugfs.c: fix parsing problem with kernel debug keywords.
2026-04-17 17:03:43 -07:00
Linus Torvalds
cdd4dc3aeb Major changes:
- Write support:
   Implemented full write support based on the classic read-only NTFS
   driver. Added delayed allocation to improve write performance through
   multi-cluster allocation and reduced fragmentation of the cluster
   bitmap.
 
 - iomap conversion:
   Switched buffered IO (reads/writes), direct IO, file extent mapping,
   readpages, and writepages to use iomap.
 
 - Remove buffer_head:
   Completely removed buffer_head usage by converting to folios.
   As a result, the dependency on CONFIG_BUFFER_HEAD has been removed
   from Kconfig.
 
 - Stability improvements:
   The new ntfs driver passes 326 xfstests, compared to 273 for ntfs3.
   All tests passed by ntfs3 are a complete subset of the tests passed
   by this implementation. Added support for fallocate, idmapped mounts,
   permissions, and more.
 
 - xfstests Results report:
   Total tests run: 787
   Passed         : 326
   Failed         : 38
   Skipped        : 423
 
 Failed tests breakdown:
   - 34 tests require metadata journaling
   - 4 other tests:
       094: No unwritten extent concept in NTFS on-disk format
       563: cgroup v2 aware writeback accounting not supported
       631: RENAME_WHITEOUT support required
       787: NFS delegation test
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCgA0FiEE6NzKS6Uv/XAAGHgyZwv7A1FEIQgFAmnhuSoWHGxpbmtpbmpl
 b25Aa2VybmVsLm9yZwAKCRBnC/sDUUQhCCtPD/9SCy3cCJZqzAtiRIYmrVD4ji9a
 vE4rZLu2A1SfTATjpKOgn7gLjBq0b2m3MxpdE8AawtXKmqOPLQFD4zj2sWePznfJ
 zy1tim2b5rEKNBQjlzoMGpmbuL+GvDWRE/RtlFQAy5uxLrqCWxtlsP0VcgKwvi+1
 MvhghuLNPCAtYA3ajadLUXK8LmhMtPVNHEqykFzTjcKAPqZyWAyS4wW7UXfPYccW
 u+XBxuR6qdlWoVpQ3ig+gJSkadViQ/PfpjzCGPsyyvaiR0t3//SexOnhHKNgPStm
 zKmD3X38y0X3wUaoDysNboPCM9+d0WsHX8whMgcCUXrIv0SRy5IL5RH0GmotaVha
 n6uUfAJ3BsBbF0DgXe4VKbY9M7UoQfjPEre52F5arM6y0qcQ+2HtvBZPCqQccb4o
 MsbuhgjyArN4LVwDb6sMK7psLjrxvuAiPtvUMUzgAt2cqCgFnHUR/SAOLy3q/RR4
 6QCcfoOJX4YK5AJYgQdAXuF8h8T865OR3dPIKyz5SMyjcj+epPdf/mf4Fhe3xfpO
 a8iFoQlKwLbD6zvpZcD5PMEAFpaVJEyYaAZ7DJLhfRpBofbn7y1U84/Ryq52+n1K
 Me8ePvuN2Q2HjTr2RjoqnV+SAgVFeifOyrYUCu8HiGVkfpFw5UfQRJUflt4l5+cd
 wA2frad6InBq4nGO4A==
 =x5UX
 -----END PGP SIGNATURE-----

Merge tag 'ntfs-for-7.1-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs

Pull ntfs resurrection from Namjae Jeon:
 "Ever since Kari Argillander’s 2022 report [1] regarding the state of
  the ntfs3 driver, I have spent the last 4 years working to provide
  full write support and current trends (iomap, no buffer head, folio),
  enhanced performance, stable maintenance, utility support including
  fsck for NTFS in Linux.

  This new implementation is built upon the clean foundation of the
  original read-only NTFS driver, adding:

   - Write support:

     Implemented full write support based on the classic read-only NTFS
     driver. Added delayed allocation to improve write performance
     through multi-cluster allocation and reduced fragmentation of the
     cluster bitmap.

   - iomap conversion:

     Switched buffered IO (reads/writes), direct IO, file extent
     mapping, readpages, and writepages to use iomap.

   - Remove buffer_head:

     Completely removed buffer_head usage by converting to folios. As a
     result, the dependency on CONFIG_BUFFER_HEAD has been removed from
     Kconfig.

   - Stability improvements:

     The new ntfs driver passes 326 xfstests, compared to 273 for ntfs3.
     All tests passed by ntfs3 are a complete subset of the tests passed
     by this implementation. Added support for fallocate, idmapped
     mounts, permissions, and more.

  xfstests Results report:

     Total tests run: 787
     Passed         : 326
     Failed         : 38
     Skipped        : 423

  Failed tests breakdown:
    - 34 tests require metadata journaling
    - 4 other tests:
         094: No unwritten extent concept in NTFS on-disk format
         563: cgroup v2 aware writeback accounting not supported
         631: RENAME_WHITEOUT support required
         787: NFS delegation test"

Link: https://lore.kernel.org/all/da20d32b-5185-f40b-48b8-2986922d8b25@stargateuniverse.net/ [1]

[ Let's see if this undead filesystem ends up being of the "Easter
  miracle" kind, or the "Nosferatu of filesystems" kind... ]

* tag 'ntfs-for-7.1-rc1-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (46 commits)
  ntfs: remove redundant out-of-bound checks
  ntfs: add bound checking to ntfs_external_attr_find
  ntfs: add bound checking to ntfs_attr_find
  ntfs: fix ignoring unreachable code warnings
  ntfs: fix inconsistent indenting warnings
  ntfs: fix variable dereferenced before check warnings
  ntfs: prefer IS_ERR_OR_NULL() over manual NULL check
  ntfs: harden ntfs_listxattr against EA entries
  ntfs: harden ntfs_ea_lookup against malformed EA entries
  ntfs: check $EA query-length in ntfs_ea_get
  ntfs: validate WSL EA payload sizes
  ntfs: fix WSL ea restore condition
  ntfs: add missing newlines to pr_err() messages
  ntfs: fix pointer/integer casting warnings
  ntfs: use ->mft_no instead of ->i_ino in prints
  ntfs: change mft_no type to u64
  ntfs: select FS_IOMAP in Kconfig
  ntfs: add MODULE_ALIAS_FS
  ntfs: reduce stack usage in ntfs_write_mft_block()
  ntfs: fix sysctl table registration and path
  ...
2026-04-17 16:35:49 -07:00
Linus Torvalds
eb0d6d97c2 bpf-fixes
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmnihOkACgkQ6rmadz2v
 bTqjQA/+K6R/teQRwVmP1GDrfBjz2TXUzCN1WQQLzbnJNR96Mzq72+aTWjza89BK
 yEUP379qiOeUfEyyV7DNfHh8hAclUAMKuvI3T3pshLQhpOS0+YcpfbakEZbos+My
 AzEGhGl2nhT7S5twHFznCpuSaLgqldHkdAy4BZIiFkOS5lPBX9CU++OAslFPM+f8
 R28JQYWuv2/b1mRsz8zDmQQXxwH/Rpz9hdJKcpm/kCYYBay3cAFV7ArFJfn+Y5se
 9I6mTwNQ+xtSxtsmR/lftlGo1Vv9ah6qM9gKwgju0SkNrS+9UBlNUSmTrJk1fz+d
 SxdppCrqxwHY3UVd62eF4fWWgusC+oMuKzTh6d+D/ZkKvnEjdAx5XQ7uUQyYhKil
 G12vvKWcHit0Qz9RAhqlEEZ+GIpFTtLql6aW7pRmQKE8/vmQwAD1HBqNqWYKjokW
 btlJ3fUOGu8VHtnYbI3FN6VsK8BU9t/xMny9Fys9X4KmtWBLsm4udmiorV9uC+w6
 xV2s+x+ahythTEzVICB6BlQotSRyMd9kR5qisJsetWk+7NBY0Bwn7C0kfVGepHh0
 WerFSYdSifTvBWQjXnvqmAX7YspmpZvevw8PCtoPq1xq5d1FrYu1K5GX/xzpy+pH
 p13afkbN7Mk6OwteFefD1B0ofug3V9sx3HBI72ENs1Z+hh1KdOQ=
 =79I2
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:
 "Most of the diff stat comes from Xu Kuohai's fix to emit ENDBR/BTI,
  since all JITs had to be touched to move constant blinding out and
  pass bpf_verifier_env in.

   - Fix use-after-free in arena_vm_close on fork (Alexei Starovoitov)

   - Dissociate struct_ops program with map if map_update fails (Amery
     Hung)

   - Fix out-of-range and off-by-one bugs in arm64 JIT (Daniel Borkmann)

   - Fix precedence bug in convert_bpf_ld_abs alignment check (Daniel
     Borkmann)

   - Fix arg tracking for imprecise/multi-offset in BPF_ST/STX insns
     (Eduard Zingerman)

   - Copy token from main to subprogs to fix missing kallsyms (Eduard
     Zingerman)

   - Prevent double close and leak of btf objects in libbpf (Jiri Olsa)

   - Fix af_unix null-ptr-deref in sockmap (Michal Luczaj)

   - Fix NULL deref in map_kptr_match_type for scalar regs (Mykyta
     Yatsenko)

   - Avoid unnecessary IPIs. Remove redundant bpf_flush_icache() in
     arm64 and riscv JITs (Puranjay Mohan)

   - Fix out of bounds access. Validate node_id in arena_alloc_pages()
     (Puranjay Mohan)

   - Reject BPF-to-BPF calls and callbacks in arm32 JIT (Puranjay Mohan)

   - Refactor all JITs to pass bpf_verifier_env to emit ENDBR/BTI for
     indirect jump targets on x86-64, arm64 JITs (Xu Kuohai)

   - Allow UTF-8 literals in bpf_bprintf_prepare() (Yihan Ding)"

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (32 commits)
  bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
  bpf: Dissociate struct_ops program with map if map_update fails
  bpf: Validate node_id in arena_alloc_pages()
  libbpf: Prevent double close and leak of btf objects
  selftests/bpf: cover UTF-8 trace_printk output
  bpf: allow UTF-8 literals in bpf_bprintf_prepare()
  selftests/bpf: Reject scalar store into kptr slot
  bpf: Fix NULL deref in map_kptr_match_type for scalar regs
  bpf: Fix precedence bug in convert_bpf_ld_abs alignment check
  bpf, arm64: Emit BTI for indirect jump target
  bpf, x86: Emit ENDBR for indirect jump targets
  bpf: Add helper to detect indirect jump targets
  bpf: Pass bpf_verifier_env to JIT
  bpf: Move constants blinding out of arch-specific JITs
  bpf, sockmap: Take state lock for af_unix iter
  bpf, sockmap: Fix af_unix null-ptr-deref in proto update
  selftests/bpf: Extend bpf_iter_unix to attempt deadlocking
  bpf, sockmap: Fix af_unix iter deadlock
  bpf, sockmap: Annotate af_unix sock:: Sk_state data-races
  selftests/bpf: verify kallsyms entries for token-loaded subprograms
  ...
2026-04-17 15:58:22 -07:00
Linus Torvalds
12bffaef28 CXL changes for v7.1
Misc patches:
 tools/testing/cxl: Enable replay of user regions as auto regions
 cxl/region: Add a region sysfs interface for region lock status
 cxl/core: Check existence of cxl_memdev_state in poison test
 cxl: Add endpoint decoder flags clear when PCI reset happens
 ACPI: NUMA: Only parse CFMWS at boot when CXL_ACPI is on
 MAINTAINERS: Update address for Dan Williams
 cxl/hdm: Add support for 32 switch decoders
 MAINTAINERS: Update Jonathan Cameron's email address
 
 Ensure endppoint complete initialization before usage:
 cxl/pci: Check memdev driver binding status in cxl_reset_done()
 cxl/pci: Hold memdev lock in cxl_event_trace_record()
 
 Type2 prepatory patches:
 cxl/region: Factor out interleave granularity setup
 cxl/region: Factor out interleave ways setup
 cxl: Make region type based on endpoint type
 cxl/pci: Remove redundant cxl_pci_find_port() call
 cxl: Move pci generic code from cxl_pci to core/cxl_pci
 cxl: export internal structs for external Type2 drivers
 cxl: support Type2 when initializing cxl_dev_state
 
 Patch series that deals with soft reserved memory conflict between CXL and HMEM:
 tools/testing/cxl: Test dax_hmem takeover of CXL regions
 tools/testing/cxl: Simulate auto-assembly failure
 dax/hmem: Parent dax_hmem devices
 dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices
 dax/hmem: Reduce visibility of dax_cxl coordination symbols
 cxl/region: Constify cxl_region_resource_contains()
 cxl/region: Limit visibility of cxl_region_contains_resource()
 dax/cxl: Fix HMEM dependencies
 cxl/region: Fix use-after-free from auto assembly failure
 dax/hmem, cxl: Defer and resolve Soft Reserved ownership
 cxl/region: Add helper to check Soft Reserved containment by CXL regions
 dax: Track all dax_region allocations under a global resource tree
 dax/cxl, hmem: Initialize hmem early and defer dax_cxl binding
 dax/hmem: Gate Soft Reserved deferral on DEV_DAX_CXL
 dax/hmem: Request cxl_acpi and cxl_pci before walking Soft Reserved ranges
 dax/hmem: Factor HMEM registration into __hmem_register_device()
 dax/bus: Use dax_region_put() in alloc_dax_region() error path
 
 Refactor CXL core/region code to make region code more manageable by
 splitting out DAX and PMEM code from RAM handling code:
 cxl/core: use cleanup.h for devm_cxl_add_dax_region
 cxl/core/region: move dax region device logic into region_dax.c
 cxl/core/region: move pmem region driver logic into region_pmem.c
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE5DAy15EJMCV1R6v9YGjFFmlTOEoFAmnhDpYACgkQYGjFFmlT
 OEovUw//cRx5xgX6JIYb2UNOkBD4HEF7pTGTANZD9iAnHpMXg8cUuDjyd/Fw6+oJ
 dt84ntzX9olJXioc8NONpfDwlqQs0c3Yx+J/81PoQKrcproibCUCEcc/XFZazAJM
 1dSDQLy27H1TzCycwOqSwl9aKUXBVyHQgqYRL0kTf9mjroAM8FFhwa5ICxOSi0DS
 LX89CXvXHi7hJmoC4QHGbAKs8u76bC1uBazCfHIR25uuF57Q2LQhNQkd8rRPO5H4
 9c57BzxPGMSjrW9TEabtwwOCPqyTgwGmhlEbL2spJjkkY2PEsFZ+omGVWf3Y559s
 BFrSx68L1g/SySRqj4eqlFzyxvmd+bhOzsta081e2ysLi3cKfXyksRfukze3zg+n
 HQjNeLNWnIxfLj78ZnxBkYXhuZGF4LQQvaeJhVCSgjLR9Fb2Ke3as6uK0FQs+xZj
 S9B/PdboDX1OMuv0Mkyw5wAYMOnv90eODVPBXUkpmB57xy6UntQS6WFsIQZIquX+
 y4NGEb2yVaFREWal5fEaPNsFacp8A+M6AdTi/zkz8k6zQ78Q6F68bjNsKkhv+ncb
 HkI7QFtZXvYhJ5xLGBMvYl6sxzGb6nv9GEFpCn1Fg/FkaWP76z8/0YxBu6awrmE5
 DMuTC/1jli/YUHRgVoW2H1QLDZKerB/x6fDHvv1LudeeyznMwK0=
 =uJpx
 -----END PGP SIGNATURE-----

Merge tag 'cxl-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl

Pull CXL (Compute Express Link) updates from Dave Jiang:
 "The significant change of interest is the handling of soft reserved
  memory conflict between CXL and HMEM. In essence CXL will be the first
  to claim the soft reserved memory ranges that belongs to CXL and
  attempt to enumerate them with best effort. If CXL is not able to
  enumerate the ranges it will punt them to HMEM.

  There are also MAINTAINERS email changes from Dan Williams and
  Jonathan Cameron"

* tag 'cxl-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/cxl/cxl: (37 commits)
  MAINTAINERS: Update Jonathan Cameron's email address
  cxl/hdm: Add support for 32 switch decoders
  MAINTAINERS: Update address for Dan Williams
  tools/testing/cxl: Enable replay of user regions as auto regions
  cxl/region: Add a region sysfs interface for region lock status
  tools/testing/cxl: Test dax_hmem takeover of CXL regions
  tools/testing/cxl: Simulate auto-assembly failure
  dax/hmem: Parent dax_hmem devices
  dax/hmem: Fix singleton confusion between dax_hmem_work and hmem devices
  dax/hmem: Reduce visibility of dax_cxl coordination symbols
  cxl/region: Constify cxl_region_resource_contains()
  cxl/region: Limit visibility of cxl_region_contains_resource()
  dax/cxl: Fix HMEM dependencies
  cxl/region: Fix use-after-free from auto assembly failure
  cxl/core: Check existence of cxl_memdev_state in poison test
  cxl/core: use cleanup.h for devm_cxl_add_dax_region
  cxl/core/region: move dax region device logic into region_dax.c
  cxl/core/region: move pmem region driver logic into region_pmem.c
  dax/hmem, cxl: Defer and resolve Soft Reserved ownership
  cxl/region: Add helper to check Soft Reserved containment by CXL regions
  ...
2026-04-17 15:52:58 -07:00
Linus Torvalds
7d672741a5 Stop-machine pull request for v7.1
This pull request contains kernel-doc updates for the stop_machine()
 and stop_machine_cpuslocked() functions.
 -----BEGIN PGP SIGNATURE-----
 
 iQJHBAABCgAxFiEEbK7UrM+RBIrCoViJnr8S83LZ+4wFAmnhHn8THHBhdWxtY2tA
 a2VybmVsLm9yZwAKCRCevxLzctn7jA6wD/4jEnqMfINebh3d5pgjspTHeSIYZbIN
 FKMQ1C6DohTgz7RzeXwlJjG+yu6/EgMC7vcTNY25ASuOcgbV0XAbD0xAo4fidqDX
 Xr/a9D+G6+iq7PWNhDFhOqzAH3WrhQ+CglWCvIVOevX57HtZGUFBIdbCnKqdUxuq
 gSoXbIjVidrUT706oQh1er5Rrm5TBBxWGlW5KQYFcQ8/ArWFUX+p4+yn3XWdquVg
 rzKx9Tv+/OAp3U5Q3QsqwdpBKrNyA0tknLRsqj4Ab2nTV3BWf/CXC4zFi2zfL4Wt
 rzzsPNCVxWsE9Aeb0abwTM3ML/0fdrxXKRxdY89vEEuSXiSGd6mjt5PZmBR7qXmg
 n1BPN7ff89g5GGvSFSUqZaJdL69eqzvykoEd4GM5UsbuBxXKV2hXFuEZmwIW9YBz
 K/qc9pG6I3OJo3hTapu7N+xqEIXYJ5cOn3tSRVPWzuQ+zVxdO1gtpqKFsKFpG9mt
 3FEWLQcWW0oS5nF1VAtJSVylv3Z9qcKlFQvajjawohbTx7Lvsxi3I+c9s2ErNwQg
 +simaeXmqZOVLHwq7zCsQqJwezOUGhnBvuSfDn0TRzoaRF7m96MdohSHI3YtjpTW
 dgQTRyM8PNDQnExhdKOAxu/x85Ba6QL3vTkiQCfCWi2YsypWPxybum1PMVY6Nxsl
 CnQ7Jtg19cRDrg==
 =7X9q
 -----END PGP SIGNATURE-----

Merge tag 'stop-machine.2026.04.16a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu

Pull stop-machine update from Paul McKenney:

 - kernel-doc updates for stop_machine() and stop_machine_cpuslocked()
   functions

* tag 'stop-machine.2026.04.16a' of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:
  stop_machine: Fix the documentation for a NULL cpus argument
2026-04-17 15:48:36 -07:00
Linus Torvalds
9cdca33667 integrity-v7.1
-----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQQdXVVFGN5XqKr1Hj7LwZzRsCrn5QUCad/SPRQcem9oYXJAbGlu
 dXguaWJtLmNvbQAKCRDLwZzRsCrn5TDuAQCT+OttUlEqKfGLUrmXjsqw+BdgSm59
 vOwTUfY0uIjAsgEAzFY8bOt5WWud9bpfEE3iarKIZQI0RidSHylyaB4FRg8=
 =6soG
 -----END PGP SIGNATURE-----

Merge tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity

Pull integrity updates from Mimi Zohar:
 "There are two main changes, one feature removal, some code cleanup,
  and a number of bug fixes.

  Main changes:
   - Detecting secure boot mode was limited to IMA. Make detecting
     secure boot mode accessible to EVM and other LSMs
   - IMA sigv3 support was limited to fsverity. Add IMA sigv3 support
     for IMA regular file hashes and EVM portable signatures

  Remove:
   - Remove IMA support for asychronous hash calculation originally
     added for hardware acceleration

  Cleanup:
   - Remove unnecessary Kconfig CONFIG_MODULE_SIG and CONFIG_KEXEC_SIG
     tests
   - Add descriptions of the IMA atomic flags

  Bug fixes:
   - Like IMA, properly limit EVM "fix" mode
   - Define and call evm_fix_hmac() to update security.evm
   - Fallback to using i_version to detect file change for filesystems
     that do not support STATX_CHANGE_COOKIE
   - Address missing kernel support for configured (new) TPM hash
     algorithms
   - Add missing crypto_shash_final() return value"

* tag 'integrity-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/zohar/linux-integrity:
  evm: Enforce signatures version 3 with new EVM policy 'bit 3'
  integrity: Allow sigv3 verification on EVM_XATTR_PORTABLE_DIGSIG
  ima: add support to require IMA sigv3 signatures
  ima: add regular file data hash signature version 3 support
  ima: Define asymmetric_verify_v3() to verify IMA sigv3 signatures
  ima: remove buggy support for asynchronous hashes
  integrity: Eliminate weak definition of arch_get_secureboot()
  ima: Add code comments to explain IMA iint cache atomic_flags
  ima_fs: Correctly create securityfs files for unsupported hash algos
  ima: check return value of crypto_shash_final() in boot aggregate
  ima: Define and use a digest_size field in the ima_algo_desc structure
  powerpc/ima: Drop unnecessary check for CONFIG_MODULE_SIG
  ima: efi: Drop unnecessary check for CONFIG_MODULE_SIG/CONFIG_KEXEC_SIG
  ima: fallback to using i_version to detect file change
  evm: fix security.evm for a file with IMA signature
  s390: Drop unnecessary CONFIG_IMA_SECURE_AND_OR_TRUSTED_BOOT
  evm: Don't enable fix mode when secure boot is enabled
  integrity: Make arch_ima_get_secureboot integrity-wide
2026-04-17 15:42:01 -07:00
Linus Torvalds
ba314ed1bf hwspinlock updates for v7.1
Remove the unused u8500 hardware spinlock driver, and clean out the
 hwspinlock_pdata struct as this was the last user of the struct.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnikfUOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcVoyRAAhO2o0MdHJqqcTTEIXM3hBY8/Q/wMi6PyIWeS
 eSCYpoLXcfYEYdcY4TzXCEYBZDMK5FPjn/0GXG85kXzlj1CHNOXR3EP6JH5dKLOl
 E/W2Ppp+mjdgwCtP7EvNhobVQuMKiXo9D+eRdgWkaDsP1vrfWMY8AnMQjhgECeLU
 9zn6SqUstYnYf27rf8+1mqGGH5mLnuH2BpW8cyJJ4eslvuZ5vSQMwVIB8z8dA87y
 RZ2Qq4i04KwUJ0fQ5c8vkSv+TYB4PulKLCFKy1BPL65RoDGdZ3w2JQQe+uHEelVU
 nVQER5ODFnHGlIAPaUO5hLItlnrKlJ24unOT/OUYxN6lpmXmwVAC8MhhDeMB3yIL
 YlLwmNviuEiUXWiD8KS3FaGzeLRFA7iqnmVwX9YDwfEtLhS8EtzsuOXa9XO7Glkp
 1EuA0keKlvB6PMvkDNZnSzqURyXtCi++bGfpekmnPSaOXTvuDgXkjVIFl3cpf0Km
 dbB8Oha+6kGe45pxK4asApsDyHBQYUredBumLGWaSZh9tGceca5rxqK9eIinUKKm
 PrUV4ooqPZc+IjJyDxCJfOr6pZYkpKyYww5rNeLOxd6vovgOpkuJ/bk131WEvAkH
 I0sccs5I6QVT+fgQdCyRTyn9N/iobUAn1KqKy8Vl56TGxTnflm68VYmOznwPL59R
 LHU5jow=
 =2T5q
 -----END PGP SIGNATURE-----

Merge tag 'hwlock-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull hwspinlock updates from Bjorn Andersson:
 "Remove the unused u8500 hardware spinlock driver, and clean out the
  hwspinlock_pdata struct as this was the last user of the struct"

* tag 'hwlock-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  hwspinlock: remove now unused pdata from header file
  hwspinlock: u8500: delete driver
2026-04-17 14:21:40 -07:00
Linus Torvalds
3d2d10e1f5 rpmsg updates for v7.1
Mark "data" argument in rpmsg_send() const, and perculate to related
 drivers. Replace deprecated class_destroy() with class_unregister().
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnhmuEOHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcUueg/7BdyiqXliMGJhb0ECGLpZaCddpzUcR2fMzVVV
 efrsezEhYe/B3QnMnfOaNB67CbambjHJtV161tjf6lH3kgSdI5CmGulusufyeJag
 9+IoNkjiUoMuDjWiBdUlZ3FQ6/BuyJhscGSSGYwtQzYNSd+GG4MMk8z9GH+8zLw+
 h1om0G8ydJwtTqBjLW/t6jRWwgz53S/We5sPLtvfw6gHTaPoLcWZRZZu1UjbMir1
 1LxHPDg6a7GFyVTM2xFSV4dIE6ylgiWfrQgIIBEZUoUT4eSeEGkA5P6Ai1jrG0tB
 2wTMseLdA7jhTf6s5gPHRMmWFvcNp9GN6ckEIhoF06y4dZX4fmho/M8yL/ytg8yw
 bz1OsbWCKsZAPVWThLcmxN8foFo6h3Uctk0FO9PTQQ8iXgB4ZLp0qm+KRBheOhCe
 NRIk/WEbEruer7NCY3I51MQj4gtVPH66PtUP13YlcK2Tk94Loes/v/egCgRxJklA
 AULONp8/zi/qAyRENof0+KbpGP8lWl7uF4NN6p6qC5FHHwCGdH4iVimIWYrtW+K9
 SxtgOl4CckS/P+p/bRaAaQc5EJdIGgn31olDuKUpYGV5u0q1VB+JswiCwjAGdwKB
 npHHh52ftTV6yv8q03DhBzYjbADO2uhBvm0Ed+AJVJyPvUbFIWwntyaVJ18BYHLJ
 zxQHnPc=
 =MGvD
 -----END PGP SIGNATURE-----

Merge tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull rpmsg updates from Bjorn Andersson:
 "Mark 'data' argument in rpmsg_send() const, and perculate to related
  drivers. Replace deprecated class_destroy() with class_unregister()"

* tag 'rpmsg-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:
  media: platform: mtk-mdp3: Constify buffer passed to mdp_vpu_sendmsg()
  ASoC: qcom: Constify GPR packet being send over GPR interface
  rpmsg: Constify buffer passed to send API
  remoteproc: mtk_scp: Constify buffer passed to scp_send_ipi()
  remoteproc: mtk_scp_ipi: Constify buffer passed to scp_ipi_send()
  drivers: rpmsg: class_destroy() is deprecated
2026-04-17 14:18:55 -07:00
Linus Torvalds
d65218de87 remoteproc updates for v7.1
Move requesting of IRQs in TI Keystone driver to probe time instead of
 remoteproc start, to allow better handling of errors.
 
 Introduce support for more than 10 entries in the Qualcomm minidump
 implementation.
 
 Add audio DSP remoteproc support for the Qualcomm Eliza platform. Add
 modem remoteproc support for the Qualcomm MDM9607, MSM8917, MSM8937, and
 MSM8940 platforms.
 
 Add list of Qualcomm QMI service ids to the QMI header file, in order to
 avoid sprinkling them across the various drivers using them. Migrate
 sysmon to use this constant.
 
 Fix several issues related to DeviceTree parsing and mailbox handling in
 the Xilinx R5F remote processor driver.
 
 Fix incorrect error checks in reserved memory handling and polish the
 code across i.MX and TI drivers.
 -----BEGIN PGP SIGNATURE-----
 
 iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmnikW0OHGJqb3JuQGty
 eW8uc2UACgkQCx85Pw2ZrcUa8BAAtFLoFqIOUTWLnQJkmIHB1BXlQiwDQZrA3YHU
 ouoOhxJK44qInXdXfkKykJsvpO5czytG0JirpKp9XuOTOQ/D61/MzASrgp+DFrWC
 dDEiCSD418n7XcZYhU/885lkgNsFwWee4KKqxv4rSIszzEjdpkCv+uuTRFFRRRUy
 8GzjyEMZ5CphpC21C1S0Snbs+C8ZnNIrAeVgQmfE1BOS2PbtSP3gfEf2mxhAJiY8
 H8emmY41tnmvMfW8w4H+25Q3K41UV2E6v4FwY/Cyn8RGm1wpGRGi6g6woVGuRgxi
 51RafOzk7rvd41p0KwJDubjFYl2NtrZN/dA5aukbqa8oRyciACHKeuM7BfWPUAhB
 ZUGB9hrnh5sFWSuFjMTqd2hQQYl6uOE9u/pZ7FmCn5Gqg6cGHKWnVD4sxE9QEVDt
 ASQnBkCzedo0T/8vCVBGIKh433jXBXF+jJvifrGZQrSfbSXFHybQCMqMlyj/wjdz
 +e3BHd/cmZzfCJK6QbQnisVm+VpKggCRh9d/5/RjqfVwUbHphXT6sqQsO7XuddMG
 5AfJvrijrgxn9uHlEgaHLEYNox3uV1es7G7cnWoftdhFC1/8bdrnxlG/dHiSI/c6
 ZcxRxuWMS1HjOKahe0xQVtrUzs2eWpde59CZQ5hTNpyuf4r7dIwxt13w7zw6pkNh
 frMxDtg=
 =Jqmf
 -----END PGP SIGNATURE-----

Merge tag 'rproc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

Pull remoteproc updates from Bjorn Andersson:

 - Move requesting of IRQs in TI Keystone driver to probe time instead
   of remoteproc start, to allow better handling of errors.

 - Introduce support for more than 10 entries in the Qualcomm minidump
   implementation.

 - Add audio DSP remoteproc support for the Qualcomm Eliza platform. Add
   modem remoteproc support for the Qualcomm MDM9607, MSM8917, MSM8937,
   and MSM8940 platforms.

 - Add list of Qualcomm QMI service ids to the QMI header file, in order
   to avoid sprinkling them across the various drivers using them.
   Migrate sysmon to use this constant.

 - Fix several issues related to DeviceTree parsing and mailbox handling
   in the Xilinx R5F remote processor driver.

 - Fix incorrect error checks in reserved memory handling and polish the
   code across i.MX and TI drivers.

* tag 'rproc-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (35 commits)
  remoteproc: qcom: pas: Add Eliza ADSP support
  dt-bindings: remoteproc: qcom,milos-pas: Document Eliza ADSP
  remoteproc: qcom: Add missing space before closing bracket
  dt-bindings: remoteproc: qcom: Drop types for firmware-name
  remoteproc: qcom: Fix minidump out-of-bounds access on subsystems array
  dt-bindings: remoteproc: k3-r5f: Add memory-region-names
  dt-bindings: remoteproc: k3-r5f: Split up memory regions
  remoteproc: use SIZE_MAX in rproc_u64_fit_in_size_t()
  dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur CDSP
  dt-bindings: remoteproc: qcom,sm8550-pas: Add Glymur ADSP
  remoteproc: xlnx: Release mailbox channels on shutdown
  remoteproc: sysmon: Use the unified QMI service ID instead of defining it locally
  remoteproc: xlnx: Only access buffer information if IPI is buffered
  remoteproc: xlnx: Avoid mailbox setup
  remoteproc: keystone: Request IRQs in probe()
  remoteproc: pru: Remove empty remove callback
  remoteproc: pru: Use rproc_of_parse_firmware() to get firmware name
  remoteproc: da8xx: Reorder resource fetching in probe()
  remoteproc: da8xx: Remove unused local struct data
  remoteproc: da8xx: Use dev_err_probe()
  ...
2026-04-17 14:16:15 -07:00
Linus Torvalds
e2d10998e4 Devicetree updates for v7.1:
DT core:
 - Cleanup of the reserved memory code to keep CMA specifics in CMA code
 
 - Add and convert several users to new of_machine_get_match() helper
 
 - Validate nul termination in string properties
 
 - Update dtc to upstream v1.7.2-69-g53373d135579
 
 - Limit matching reserved memory devices to /reserved-memory nodes
 
 - Fix some UAF in unittests
 
 - Remove Baikal SoC bus driver
 
 - Fix false DT_SPLIT_BINDING_PATCH checkpatch warning
 
 - Allow fw_devlink device-tree on x86
 
 - Fix kerneldoc return description for of_property_count_elems_of_size()
 
 DT bindings:
 - Add fsl,imx25-aips, fsl,imx25-tcq, qcom,eliza-pdc,
   qcom,eliza-spmi-pmic-arb, qcom,hawi-imem, qcom,milos-imem,
   qcom,hawi-pdc, and lg,sw49410 bindings
 
 - Convert arm,vexpress-scc to DT schema
 
 - Deprecate Qualcomm generic CPU compatibles. Add Apple M3 CPU cores.
 
 - Move some dual-link display panels to the dual-link schema
 
 - Drop mux controller node name constraints
 
 - Remove Baikal SoC bus bindings
 
 - Fix a false warning in the thermal trip node binding
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEktVUI4SxYhzZyEuo+vtdtY28YcMFAmnhBKQACgkQ+vtdtY28
 YcO7iw//ZHGjSI4WTwwtthgBsn108x0iRMpo3d8rYN6ESDEIgXELbEDFzWSbIzBB
 yCWUUmbNzv1YcwUF+XOoiQzdMZP6GdSTL/vvj3KgRPDgkOgNlnEgxJEPyC1mbUf5
 oJ5S/f8sr1+hfFp6LJiDnZTU6RcJHZSsLlwW4GfA87hjHCun8lQSfP+E4x1RyS4s
 6+LA+mYQNk0OFfqmE/w/Jqn44nHqoduD3Ay/I/5sd8YECtowiI9ZZ+85GkYPtDFa
 R5pW4eSoffYr5vXDTdCyBARSUxUcm++yIB/yAgi5B4xQCEKK5ds7M6YL0ylGXdey
 8ezINGXHhFsc40e4Gp/13m6/jYy322PF6kEeUWb63uZ0djJMxba7SFmEAUs00zme
 UQ8irtGay80tgRnS9btRChKFOqKcXFr5bsN5L6tkVdoJMTAziz7B77fwo7W+x+7b
 MTdlUfFMupuQJWETte9o04TkGZ5/tqnlcbpF/iTws3vCyeFyZ0LWHueQpSwhO2oy
 wzdDZ1VLHATPdVlGV757yfH9O8BkyHtdG8lXVLLoR0C1JOqUlyfScGxfLFwawUC8
 cERw9bU4f2IT+lJbr5WqpG+BnQ6TnwoNOvqajXHAByDQ/Gd8MLZoX91ykZflaWxQ
 EIvXVytWdwmQ4iReD+9ETPHBXC8v3W4+hkqrJxCAqVHPxBkXS40=
 =Ia0F
 -----END PGP SIGNATURE-----

Merge tag 'devicetree-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux

Pull devicetree updates from Rob Herring:
 "DT core:

   - Cleanup of the reserved memory code to keep CMA specifics in CMA
     code

   - Add and convert several users to new of_machine_get_match() helper

   - Validate nul termination in string properties

   - Update dtc to upstream v1.7.2-69-g53373d135579

   - Limit matching reserved memory devices to /reserved-memory nodes

   - Fix some UAF in unittests

   - Remove Baikal SoC bus driver

   - Fix false DT_SPLIT_BINDING_PATCH checkpatch warning

   - Allow fw_devlink device-tree on x86

   - Fix kerneldoc return description for of_property_count_elems_of_size()

  DT bindings:

   - Add fsl,imx25-aips, fsl,imx25-tcq, qcom,eliza-pdc,
     qcom,eliza-spmi-pmic-arb, qcom,hawi-imem, qcom,milos-imem,
     qcom,hawi-pdc, and lg,sw49410 bindings

   - Convert arm,vexpress-scc to DT schema

   - Deprecate Qualcomm generic CPU compatibles. Add Apple M3 CPU cores.

   - Move some dual-link display panels to the dual-link schema

   - Drop mux controller node name constraints

   - Remove Baikal SoC bus bindings

   - Fix a false warning in the thermal trip node binding"

* tag 'devicetree-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (39 commits)
  dt-bindings: display: panel: panel-simple: Add lg,sw49410 compatible
  dt-bindings: display: ti, am65x-dss: Fix AM62L DSS reg and clock constraints
  dt-bindings: display: simple: Move Innolux G156HCE-L01 panel to dual-link
  dt-bindings: display: simple: Move AUO 21.5" FHD to dual-link
  dt-bindings: thermal: Fix false warning with 'phandle' in trips nodes
  of: unittest: fix use-after-free in testdrv_probe()
  of: unittest: fix use-after-free in of_unittest_changeset()
  dt-bindings: qcom,pdc: document the Hawi Power Domain Controller
  dt-bindings: ARM: arm,vexpress-scc: convert to DT schema
  drivers/of: fdt: validate flat DT string properties before string use
  drivers/of: fdt: validate stdout-path properties before parsing them
  dt-bindings: sram: Document qcom,hawi-imem compatible
  dt-bindings: sram: Allow multiple-word prefixes to sram subnode
  dt-bindings: sram: Document qcom,milos-imem
  scripts/dtc: Update to upstream version v1.7.2-69-g53373d135579
  of: property: Allow fw_devlink device-tree on x86
  dt-bindings: arm: cpus: Add Apple M3 CPU core compatibles
  dt-bindings: display: lt8912b: Drop redundant endpoint properties
  dt-bindings: opp-v2: Fix example 3 CPU reg value
  dt-bindings: connector: add pd-disable dependency
  ...
2026-04-17 14:09:02 -07:00
Linus Torvalds
430cc9f42b hte: changes for v7.1-rc1
The changes for the hte/timestamp subsystem include the following:
 
 - Add tegra264 HTE driver and dt binding support
 - Remove tegra194 SoC Kconfig dependency
 - Replace use of system_unbound_wq with system_dfl_wq
 -----BEGIN PGP SIGNATURE-----
 
 iIgEABYIADAWIQT4slW2T0Q/rXAa29f4pUxhzZTZKAUCad6E7BIcZGlwZW5wQG52
 aWRpYS5jb20ACgkQ+KVMYc2U2ShqLQD+OGR3jSUKAGbD4DJUUVM1kF9UdNe0+xq0
 7ja++JvMUFkA/3YF6Qbkhsl6sNh3WEr9x9Hocux97GpuA7LZ96N0vUAF
 =AXvF
 -----END PGP SIGNATURE-----

Merge tag 'for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux

Pull hte updates from Dipen Patel:

 - Add tegra264 HTE driver and dt binding support

 - Remove tegra194 SoC Kconfig dependency

 - Replace use of system_unbound_wq with system_dfl_wq

* tag 'for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/pateldipen1984/linux:
  hte: tegra194: Add Tegra264 GTE support
  dt-bindings: timestamp: Add Tegra264 support
  hte: tegra194: remove Kconfig dependency on Tegra194 SoC
  hte: replace use of system_unbound_wq with system_dfl_wq
2026-04-17 13:50:10 -07:00
Miquel Raynal
b2a4fe0960 The main changes happened in the SunXi driver in order to
support new versions of the Allwinner NAND controller.
 
 There are also some DT-binding improvements and cleanups.
 
 Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND),
 aside with the usual load of misc changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmniUUwACgkQJWrqGEe9
 VoQdxwf/d+kCElzsrRv0wGP4bOQcFdl4By/H/9WTqn4SZtgN5gNwl4QJgwoVj5Cy
 VNqBdxijHa7NaPmdAFjkx/JENRf//MuGyqmdjxAyUg8aGfdxQNSNAxkTtq/qFUMf
 koI6HA7xdplD3kmCPcbv6Wij3Rj2n87txqzgaJJMtgghS94LnDNhogkvERse+zB5
 WfvNwZlOzJPu/QOnA7KMCwWRjC3ZVJFc0AP5TswQ3qlrAJvoJJjUPyX45UAwORLi
 gDUV4JecRTaGw3KscUpinQc2d3EKs235b/O7GnWmc2/b5dQKhDv80sOXnEeDK9EH
 X/kndsX4SnhV8UOYUEvVim4wjD2HeQ==
 =VoQs
 -----END PGP SIGNATURE-----

Merge tag 'nand/for-7.1' into mtd/next

The main changes happened in the SunXi driver in order to
support new versions of the Allwinner NAND controller.

There are also some DT-binding improvements and cleanups.

Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND),
aside with the usual load of misc changes.
2026-04-17 21:51:05 +02:00
Miquel Raynal
357e460a30 SPI NOR changes for 7.1
There is only a collection of bugfixes this time around, with no notable
 changes to the core. Some of the more noteworthy bugfixes listed below.
 
 - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup
 since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for fixing
 mt35xu02gcba") but did not add it due to lack of hardware to test on.
 
 - Fix locking on some Winbond w25q series flashes.
 
 - Fix Auto Address Increment (AAI) writes on SST that flashes that start
   on odd address. The write enable latch needs to be set again after the
   single byte program.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQTlUWNzXGEo3bFmyIR4drqP028CQUCadZCtwAKCRAR4drqP028
 Cbv7AP9zoHnkxrT+evOzRMazhMp0+FNna0SgrN83zUkvo9QMmQD/SK6UJBqxnT3r
 vPBcGgfljIGfhPNYMtBj3w7UkrSi4wc=
 =ZvDx
 -----END PGP SIGNATURE-----

Merge tag 'spi-nor/for-7.1' into mtd/next

SPI NOR changes for 7.1

There is only a collection of bugfixes this time around, with no notable
changes to the core. Some of the more noteworthy bugfixes listed below.

- Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup
since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for fixing
mt35xu02gcba") but did not add it due to lack of hardware to test on.

- Fix locking on some Winbond w25q series flashes.

- Fix Auto Address Increment (AAI) writes on SST that flashes that start
  on odd address. The write enable latch needs to be set again after the
  single byte program.
2026-04-17 21:50:54 +02:00
Puranjay Mohan
e1d486445a bpf, arm32: Reject BPF-to-BPF calls and callbacks in the JIT
The ARM32 BPF JIT does not support BPF-to-BPF function calls
(BPF_PSEUDO_CALL) or callbacks (BPF_PSEUDO_FUNC), but it does
not reject them either.

When a program with subprograms is loaded (e.g. libxdp's XDP
dispatcher uses __noinline__ subprograms, or any program using
callbacks like bpf_loop or bpf_for_each_map_elem), the verifier
invokes bpf_jit_subprogs() which calls bpf_int_jit_compile()
for each subprogram.

For BPF_PSEUDO_CALL, since ARM32 does not reject it, the JIT
silently emits code using the wrong address computation:

    func = __bpf_call_base + imm

where imm is a pc-relative subprogram offset, producing a bogus
function pointer.

For BPF_PSEUDO_FUNC, the ldimm64 handler ignores src_reg and
loads the immediate as a normal 64-bit value without error.

In both cases, build_body() reports success and a JIT image is
allocated. ARM32 lacks the jit_data/extra_pass mechanism needed
for the second JIT pass in bpf_jit_subprogs(). On the second
pass, bpf_int_jit_compile() performs a full fresh compilation,
allocating a new JIT binary and overwriting prog->bpf_func. The
first allocation is never freed. bpf_jit_subprogs() then detects
the function pointer changed and aborts with -ENOTSUPP, but the
original JIT binary has already been leaked. Each program
load/unload cycle leaks one JIT binary allocation, as reported
by kmemleak:

    unreferenced object 0xbf0a1000 (size 4096):
      backtrace:
        bpf_jit_binary_alloc+0x64/0xfc
        bpf_int_jit_compile+0x14c/0x348
        bpf_jit_subprogs+0x4fc/0xa60

Fix this by rejecting both BPF_PSEUDO_CALL in the BPF_CALL
handler and BPF_PSEUDO_FUNC in the BPF_LD_IMM64 handler, falling
through to the existing 'notyet' path. This causes build_body()
to fail before any JIT binary is allocated, so
bpf_int_jit_compile() returns the original program unjitted.
bpf_jit_subprogs() then sees !prog->jited and cleanly falls
back to the interpreter with no leak.

Acked-by: Daniel Borkmann <daniel@iogearbox.net>
Fixes: 1c2a088a66 ("bpf: x64: add JIT support for multi-function programs")
Reported-by: Jonas Rebmann <jre@pengutronix.de>
Closes: https://lore.kernel.org/bpf/b63e9174-7a3d-4e22-8294-16df07a4af89@pengutronix.de
Tested-by: Jonas Rebmann <jre@pengutronix.de>
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260417143353.838911-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-17 12:05:45 -07:00
Amery Hung
f75aeb2de8 bpf: Dissociate struct_ops program with map if map_update fails
Currently, when bpf_struct_ops_map_update_elem() fails, the programs'
st_ops_assoc will remain set. They may become dangling pointers if the
map is freed later, but they will never be dereferenced since the
struct_ops attachment did not succeed. However, if one of the programs
is subsequently attached as part of another struct_ops map, its
st_ops_assoc will be poisoned even though its old st_ops_assoc was stale
from a failed attachment.

Fix the spurious poisoned st_ops_assoc by dissociating struct_ops
programs with a map if the attachment fails. Move
bpf_prog_assoc_struct_ops() to after *plink++ to make sure
bpf_prog_disassoc_struct_ops() will not miss a program when iterating
st_map->links.

Note that, dissociating a program from a map requires some attention as
it must not reset a poisoned st_ops_assoc or a st_ops_assoc pointing to
another map. The former is already guarded in
bpf_prog_disassoc_struct_ops(). The latter also will not happen since
st_ops_assoc of programs in st_map->links are set by
bpf_prog_assoc_struct_ops(), which can only be poisoned or pointing to
the current map.

Signed-off-by: Amery Hung <ameryhung@gmail.com>
Link: https://lore.kernel.org/r/20260417174900.2895486-1-ameryhung@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-17 12:04:14 -07:00
Linus Torvalds
59bd5ae0db power supply and reset changes for the 7.1 series
* power-supply drivers
   - S2MU005: new battery fuel gauge driver
   - macsmc-power: new driver for Apple Silicon
   - qcom_battmgr: Add support for Glymur and Kaanapali
   - max17042: add support for max77759
   - qcom_smbx: allow disabling charging
   - bd71828: add input current limit support
   - multiple drivers: use new device managed workqueue allocation
     function
   - misc. small cleanups and fixes
  * reset core
   - Expose sysfs for registered reboot_modes
  * reset drivers
   - misc. small cleanups and fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmniTwkACgkQ2O7X88g7
 +pqZCA//ZETuZH1fB1/uJQocXxC6wksAaYUq4BvRlmj5e/dc42ouLbC8IfzMnAET
 aMc9zHOSKdUdW0a9DpWlOZaXT4AZ5EN7Pjd5XeRjrWwaufPvvZgX0Abjb9UpT6nU
 yYMbKvJeNMIVGqByboneWK0LOekijJVz8dkAe31eE+8tNNAn3Y/V8v9FiS9nG5sL
 0WqnhmCNBd9vS/QYvoxSMB9UC64LxYISYlDl/v525mqFRoDdkIh9q+WO7Wdq3Mtk
 tOGIRu1i001jpXxLwtIx9N1Uoq62inyuuPeBrpdKAjxKQyXQSiKrcVX1gQdbBmZm
 ggAFJ5p6wWYeDXA5/9C4z0wsud+/ZbgvzJvYOqTbkJQA2c/+Sz928EjHrRre9DzU
 l3Z0eVLtuekKXMhwiXRN66JjYmYjZJA5gJXKgd+8slHSXSpgp6scv5zMQYCTny5d
 Jj+Ztp5k70RLrl88Y0Dihi7lKy07NhlrYMO7HPNrwEnydxPRTdLfLahZkb/SJep0
 YTX/r0s/Ab+VG+qWmAlvVjwbDglmsYDMcmyJarJKvXoE7CE+jwL1447UiI0BAOjO
 ZDUGojBHst36ySORWjq0LmjP6F2r582hXWzeY08Skuj05n2bBJpT89rEF+BGYwhR
 KhQgH7mCvsbG8QJuTROGK/fpDZ5L7aGwJBfMchgdWmDs8r9zY5M=
 =5Yic
 -----END PGP SIGNATURE-----

Merge tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply

Pull power supply and reset updates from Sebastian Reichel:
 "Power-supply drivers:
   - S2MU005: new battery fuel gauge driver
   - macsmc-power: new driver for Apple Silicon
   - qcom_battmgr: Add support for Glymur and Kaanapali
   - max17042: add support for max77759
   - qcom_smbx: allow disabling charging
   - bd71828: add input current limit support
   - multiple drivers: use new device managed workqueue allocation
     function
   - misc small cleanups and fixes

  Reset core:
   - Expose sysfs for registered reboot_modes

  Reset drivers
   - misc small cleanups and fixes"

* tag 'for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (36 commits)
  power: supply: qcom_smbx: allow disabling charging
  power: reset: drop unneeded dependencies on OF_GPIO
  power: supply: bd71828: add input current limit property
  dt-bindings: power: reset: cortina,gemini-power-controller: convert to DT schema
  power: supply: add support for S2MU005 battery fuel gauge device
  dt-bindings: power: supply: document Samsung S2MU005 battery fuel gauge
  power: reset: reboot-mode: fix -Wformat-security warning
  power: supply: ipaq_micro: Simplify with devm
  power: supply: mt6370: Simplify with devm_alloc_ordered_workqueue()
  power: supply: max77705: Free allocated workqueue and fix removal order
  power: supply: max77705: Drop duplicated IRQ error message
  power: supply: cw2015: Free allocated workqueue
  power: reset: keystone: Use register_sys_off_handler(SYS_OFF_MODE_RESTART)
  power: supply: twl4030_madc: Drop unused header includes
  power: supply: bq24190: Avoid rescheduling after cancelling work
  power: supply: axp288_charger: Simplify returns of dev_err_probe()
  power: supply: axp288_charger: Do not cancel work before initializing it
  power: supply: cpcap-battery: pass static battery cell data from device tree
  dt-bindings: power: supply: cpcap-battery: document monitored-battery property
  power: supply: qcom_battmgr: Add support for Glymur and Kaanapali
  ...
2026-04-17 11:41:33 -07:00
Linus Torvalds
e0dcd2b2a0 HSI changes for the 7.1 series
* core: use flexible array member for hsi_port in hsi_controller
  * misc. small fixes
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE72YNB0Y/i3JqeVQT2O7X88g7+poFAmnheVoACgkQ2O7X88g7
 +pqzjA//RYSY5xZGDqgKXmuXUb3U9dHsk4kDOGP7UnAhH4mJixRAd4+GvBt/Hy1F
 XutMKmJGEDAGV3nMQbez6PJdbXMLczHoo6PkYJMHNAoW2RWJZnskny+E3foZdofJ
 frOXGl/ERFo0KxUqhvZROYUq+h7ajs8dYLef3KRZXEaSmRxUln9CwUBNxW3a7Cf1
 3gJCbH5JhoUu93E0qttctKcv/hKCwqv9zHk7Cixz2xYB7nWWimehlADH6yFwYz6E
 cQOyAlB8Lxz03f4t9TL2axSS2Y+/0JrOCVd8CtK1EiTiHt/ANmYZVW9IabdLopJX
 tEVM5P7S3o6gWRebjgmT6q7OWWop0W4UVNAoiWRmrv9BCF+OH4RMrnIwXgRz0DDY
 r2e4i6SaO7bKh36FCW/depv2uCKh+oyNI5eKIE7aLf+P7qwq2+fO47qDT/xIwjCw
 TP5M4FgHZCLKKSFnNJzLzvtgCtz4K6yCeA7JU1o8wNZ0yHmnvQQ7nU8JmRyUJm+d
 cd3desS9J61L8W6Kg1IC2cnAGs1u+ITKkd80c+aN7TSdnN0+hcKwINut9MjmOxx6
 pWiPZQm4DlgXe5FH5cDOJg2NMrHenMns0FL6DmSLtICYQyHd6kcVIBPCB8H81kFf
 72CgtPRvP5KArb+e1t6uLkqrcGSJkWdijYNxnP2gtBdE5JBJgyI=
 =uQXI
 -----END PGP SIGNATURE-----

Merge tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi

Pull HSI updates from Sebastian Reichel:

 - use flexible array member for hsi_port in hsi_controller

 - misc small fixes

* tag 'hsi-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-hsi:
  HSI: omap_ssi_port: remove depends on ARM
  HSI: omap_ssi_port: remove set but unused variables
  HSI: cmt_speech: fix wrong printf format
  HSI: omap_ssi_port: remove null check from FAM
  hsi: hsi_core: use kzalloc_flex
2026-04-17 11:32:01 -07:00
Linus Torvalds
d97e7d7c30 hid-for-linus-2026041601
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEL65usyKPHcrRDEicpmLzj2vtYEkFAmnhNL4ACgkQpmLzj2vt
 YEmEyQ/+LTJ8CLjONWfamsF2XK2vcOWa9E41ot9vnaUZon4IKbGSFzpKxLGWO3zu
 gnu0wKvRtK4NZwN/T2M24pOgfAMzYh9YZ5oP4kdo3ZrJnw9GcBriY0KF1D10N+Ij
 qMz/8rzhOjM6GkINYZfR6iX3/vstFpavuVcHru2TBN5IPNTWOVS5ALAAp2WjRN7c
 da8XazEzk+xt2z7/Iv6t2Y/Bi826CS16vuXjYa5/2wM7kRH/y+It35MpwXK/KHol
 Foeor166Q2b6LPpvavusf1A6YWvagPyDvWvJssWw5Mi3heyq9YeOU0qZApJmTVRz
 neS9NYUFaZ+1YuZ/vRkJuvbqH9M6xYHXYXatXBmUJK2V18wHgD9X/Et4Crud8mmj
 thw3WNLWOCl5rtOQ3rKjy/o/QQfsjNHeb9XBfF4lmyY6ASeXQcJmVEK/XEQGVSJr
 71v7Q8ONFHgw44WJbIPeZcWRqcVGgnH08s/aQS890tZUyMBHAOzUqbNX5pBWlfnf
 btSMdK4KNikldgKBxZXQfIFRq8gpHjMVUfzhdGQ+IiZAqjipEipjlz/uS432oybR
 Nhukw8Lfr+LlwRvfzeCdV7/2qqLER+LFfJP8Q1jPb0fa/ET3A36Mwrd1ew3lMcLm
 +24BUDNUhcKSUMIMEeHZKnbW3/UnuRu8EMh0htdviB+08hKW9z4=
 =w455
 -----END PGP SIGNATURE-----

Merge tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid

Pull HID updates from Jiri Kosina:
 "Core:
   - fixed handling of 0-sized reports (Dmitry Torokhov)
   - convert core code to __free() (Dmitry Torokhov)
   - support for multiple batteries per HID device (Lucas Zampieri)

  Drivers:
   - support for rumble effects in winwing driver (Ivan Gorinov)
   - new support for a variety of Sony Rock Band and Sony DJ Hero
     Turntable devices (Rosalie Wanders)
   - new driver for Lenovo Legion Go / S devices (Derek J. Clark)
   - power management improvements to intel-thc-hid driver (Even Xu)

  ... other assorted cleanups, fixes and device-specific quirks"

* tag 'hid-for-linus-2026041601' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid: (73 commits)
  HID: core: clamp report_size in s32ton() to avoid undefined shift
  HID: logitech-dj: fix wrong detection of bad DJ_SHORT output report
  HID: logitech-hidpp: fix race condition when accessing stale stack pointer
  HID: winwing: Enable rumble effects
  HID: core: do not allow parsing 0-sized reports
  HID: usbhid: refactor endpoint lookup
  HID: huawei: fix CD30 keyboard report descriptor issue
  HID: playstation: validate num_touch_reports in DualShock 4 reports
  HID: drop 'default !EXPERT' from tristate symbols
  HID: usbhid: fix deadlock in hid_post_reset()
  HID: apple: ensure the keyboard backlight is off if suspending
  HID: quirks: Set ALWAYS_POLL for LOGITECH_BOLT_RECEIVER
  HID: alps: fix NULL pointer dereference in alps_raw_event()
  HID: logitech-dj: Prevent REPORT_ID_DJ_SHORT related user initiated OOB write
  HID: logitech-dj: Standardise hid_report_enum variable nomenclature
  HID: sony: update module description
  HID: logitech-hidpp: Check bounds when deleting force-feedback effects
  HID: sony: add battery status support for Rock Band 4 PS5 guitars
  HID: sony: fix style issues
  HID: quirks: update hid-sony supported devices
  ...
2026-04-17 11:24:00 -07:00
Linus Torvalds
87768582a4 dma-mapping updates for Linux 7.0:
- added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)
 
 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)
 
 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and its
   clients (Marek Szyprowski, shared branch with device-tree updates to
   avoid merge conflicts)
 
 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)
 
 - added support for benchmarking dma_map_sg() calls to tools/dma utility
   (Qinxin Xia)
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYIAB0WIQSrngzkoBtlA8uaaJ+Jp1EFxbsSRAUCaeCbdQAKCRCJp1EFxbsS
 RHbWAQCt70dzrU0lu0omTR1HdDP4GTYfuM6nZR91e8/itGN1+QD/XH4I/0wuybzk
 v5uxbIC6lR3abQRc3YNRXfi+i5j26A4=
 =Oee2
 -----END PGP SIGNATURE-----

Merge tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux

Pull dma-mapping updates from Marek Szyprowski:

 - added support for batched cache sync, what improves performance of
   dma_map/unmap_sg() operations on ARM64 architecture (Barry Song)

 - introduced DMA_ATTR_CC_SHARED attribute for explicitly shared memory
   used in confidential computing (Jiri Pirko)

 - refactored spaghetti-like code in drivers/of/of_reserved_mem.c and
   its clients (Marek Szyprowski, shared branch with device-tree updates
   to avoid merge conflicts)

 - prepared Contiguous Memory Allocator related code for making dma-buf
   drivers modularized (Maxime Ripard)

 - added support for benchmarking dma_map_sg() calls to tools/dma
   utility (Qinxin Xia)

* tag 'dma-mapping-7.1-2026-04-16' of git://git.kernel.org/pub/scm/linux/kernel/git/mszyprowski/linux: (24 commits)
  dma-buf: heaps: system: document system_cc_shared heap
  dma-buf: heaps: system: add system_cc_shared heap for explicitly shared memory
  dma-mapping: introduce DMA_ATTR_CC_SHARED for shared memory
  mm: cma: Export cma_alloc(), cma_release() and cma_get_name()
  dma: contiguous: Export dev_get_cma_area()
  dma: contiguous: Make dma_contiguous_default_area static
  dma: contiguous: Make dev_get_cma_area() a proper function
  dma: contiguous: Turn heap registration logic around
  of: reserved_mem: rework fdt_init_reserved_mem_node()
  of: reserved_mem: clarify fdt_scan_reserved_mem*() functions
  of: reserved_mem: rearrange code a bit
  of: reserved_mem: replace CMA quirks by generic methods
  of: reserved_mem: switch to ops based OF_DECLARE()
  of: reserved_mem: use -ENODEV instead of -ENOENT
  of: reserved_mem: remove fdt node from the structure
  dma-mapping: fix false kernel-doc comment marker
  dma-mapping: Support batch mode for dma_direct_{map,unmap}_sg
  dma-mapping: Separate DMA sync issuing and completion waiting
  arm64: Provide dcache_inval_poc_nosync helper
  arm64: Provide dcache_clean_poc_nosync helper
  ...
2026-04-17 11:12:42 -07:00
Linus Torvalds
d662a710c6 dmaengine updates for v7.1
Core:
   - New devm_of_dma_controller_register() API
 
  New Support:
   - Support for RZ/G3L SoC
   - Loongson Multi-Channel DMA controller support
   - Conversion of Xilinx AXI DMA binding
   - DW AXI CV1800B DMA support
   - Switchtec DMA engine driver
 
  Updates:
   - AMD MDB Endpoint and non-LL mode support
   - DW edma virtual IRQ for interrupt-emulation, cyclic transfers support
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh8XgACgkQfBQHDyUj
 g0e7WQ//d6UvT8cv+2OUtbM3I3OeqhiHJvTYvuLLWkxG1vm5vCj3h8gvaeI+2GiP
 dN6UhKTMZz0fn3lacCaYBDL3ebR2P3z9HuXPljz5kxr+akM58r9ehevbzY0Vgivg
 jh+zw/sNYAv1Cwld75jglPaBotS2Qmne3a28WIioeGSp1QqO2veWRqFOFzL2P6Fc
 EEWGB45UkgrKp4tiG8GZf3plOFu+S46oYOAsRyT26IkS/DxNlEXbLaI62XBThr5Z
 4q1xJ0wLJRzFt9fMyBJ3Uz/pPui1TXb8R1060Vx1TPXgKF0g2qtMLmEoJ1rw1u4t
 8w49po1YvDHV7NuC6ZuXdQTb7J9X8+q5/IyK3794pKKz+2jM1CS3FN6Z0VEYvvQQ
 nhFnLAvtW0ziKL1+U3P9FJnI7ztbgMpltvQ3NGuNC0bp3JMoOaVcMr01M7sMMzpl
 gX0qtWZO94jTO5dYjFvLUQU9HtM1rG/3p7o99RtGfe1EKudF7w209LLYC5g6OSm/
 s2I4MNOirViKUhweEU2PbFxTgaPWbIlp/UewEvKQrnmxmikgzzYDVoMTjq8fGt3X
 uyxaAudFBMVWrAHlk3RLjTgYew8njqahjNzTR05atWLRpawbULQKHKHW1UFuxJTI
 apsjbbrlZCT4tIyYZT0XSt3KzEtB+4KwYMBzV2S5b0q0DQuvGJQ=
 =uoUT
 -----END PGP SIGNATURE-----

Merge tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine

Pull dmaengine updates from Vinod Koul:
 "Core:
   - New devm_of_dma_controller_register() API

  New Support:
   - Support for RZ/G3L SoC
   - Loongson Multi-Channel DMA controller support
   - Conversion of Xilinx AXI DMA binding
   - DW AXI CV1800B DMA support
   - Switchtec DMA engine driver

  Updates:
   - AMD MDB Endpoint and non-LL mode support
   - DW edma virtual IRQ for interrupt-emulation, cyclic transfers support"

* tag 'dmaengine-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (65 commits)
  dmaengine: dw-edma: Add non-LL mode
  dmaengine: dw-edma: Add AMD MDB Endpoint Support
  dt-bindings: dmaengine: Fix spelling mistake "Looongson" -> "Looogson"
  dmaengine: loongson: Fix spelling mistake "Looongson" -> "Looogson"
  dmaengine: loongson: New driver for the Loongson Multi-Channel DMA controller
  dt-bindings: dmaengine: Add Loongson Multi-Channel DMA controller
  dmaengine: loongson: loongson2-apb: Simplify locking with guard() and scoped_guard()
  dmaengine: loongson: loongson2-apb: Convert to devm_clk_get_enabled()
  dmaengine: loongson: loongson2-apb: Convert to dmaenginem_async_device_register()
  dmaengine: loongson: New directory for Loongson DMA controllers drivers
  dt-bindings: dma: xlnx,axi-dma: Convert to DT schema
  dt-bindings: dma: rz-dmac: Add conditional schema for RZ/G3L
  dmaengine: sh: rz-dmac: Add device_{pause,resume}() callbacks
  dmaengine: sh: rz-dmac: Add device_tx_status() callback
  dmaengine: sh: rz-dmac: Use rz_lmdesc_setup() to invalidate descriptors
  dmaengine: sh: rz-dmac: Drop unnecessary local_irq_save() call
  dmaengine: sh: rz-dmac: Drop goto instruction and label
  dmaengine: sh: rz-dmac: Drop read of CHCTRL register
  dmaengine: sh: rz_dmac: add RZ/{T2H,N2H} support
  dt-bindings: dma: renesas,rz-dmac: document RZ/{T2H,N2H}
  ...
2026-04-17 10:29:01 -07:00
Linus Torvalds
3f887edd35 phy-for-7.1
- New Support
   - Qualcomm Eliza QMP UFS PHY
   - Canaan K230 USB 2.0 PHY driver
   - Mediatek mt8167 dsi-phy
   - Eswin EIC7700 SATA PHY driver
 
 - Updates
   - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh4msACgkQfBQHDyUj
 g0ctew/+K/rVLCUu/UgbvnV1hPH3q/OCytwcymurSp5+lZ2TGsHcwjzGNKrGxCAp
 nxgzffHwukyuRGq/FHDc1QQa+i5bDzf6dlE3CuZYnZWka8mxbqcBetMQvLb93LXL
 9MEQ8YQgjh96AyX87sP0r5IhBVLl3LiGHj2+L6VXoTzMsJeqT6Kx2rABHgFjXM97
 gjurp1PbHwi2EGQowa9zjsoQnRnN2C4O2xlZsXeNljzS2KPpToQ+sjADwHSau8nw
 b9idowJlJMlN+RFrNKJWgja7ro/E17IGQptJT9Hz89j2dXg0QiWIY/uok25o6XAn
 h0yYWpXP6gaQH1mnpS5Meb8d+ljTL4SNLv/64pYSGPzqXUbuJXVx2Rn7ZBuB3R/H
 +pmVbrdWSUwhXcgXDyVCMLguhCxns4M/SmaYrjVayrogDiz9gqHlGMTfsSmYCnbI
 UDqHyFSa6HRZIFnba0pBkb3eyrKE9qMK0FFgQURQp8GCOJu8waeNyCZ4fTCjXo6v
 MULhauFWDC267LNogt6KGgTC6sFmsitsI8jymMQGfb3g6FdhJUFpQLmNvwYpoHXH
 AofeTHrzdXWRVNiVKO01J2tPskVCczx5R5q5dfDGTM0mIRXMaHCuzT2RNdRmBpNk
 rgBlCvIiiE9VbusN+zybPQfTJAQa2eVMTvBRzjwkdLUYeMUJS0I=
 =qz0Z
 -----END PGP SIGNATURE-----

Merge tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy

Pull phy updates from Vinod Koul:
 "New Support:
   - Qualcomm Eliza QMP UFS PHY
   - Canaan K230 USB 2.0 PHY driver
   - Mediatek mt8167 dsi-phy
   - Eswin EIC7700 SATA PHY driver

  Updates:
   - Sorted subsytem Makefile/Kconfig and some kernel-doc udpates"

* tag 'phy-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy:
  dt-bindings: phy: qcom,sc8280xp-qmp-ufs-phy: document the Eliza QMP UFS PHY
  phy: qcom: m31-eusb2: clear PLL_EN during init
  phy: eswin: Create eswin directory and add EIC7700 SATA PHY driver
  dt-bindings: phy: eswin: Document the EIC7700 SoC SATA PHY
  phy: apple: apple: Use local variable for ioremap return value
  phy: qcom: qmp-usbc: Simplify check for non-NULL pointer
  phy: marvell: mmp3-hsic: Avoid re-casting __iomem
  phy: apple: atc: Make atcphy_dwc3_reset_ops variable static
  dt-bindings: phy: mediatek,dsi-phy: Add support for mt8167
  phy: usb: Add driver for Canaan K230 USB 2.0 PHY
  dt-bindings: phy: Add Canaan K230 USB PHY
  phy: phy-mtk-tphy: Update names and format of kernel-doc comments
  phy: Sort the subsystem Kconfig
  phy: Sort the subsystem Makefile
  phy: move spacemit pcie driver to its subfolder
2026-04-17 10:22:08 -07:00
Linus Torvalds
65bec0c4ea soundwire updates for 7.1
- Core: DP prepare polling for avoiding interrupt deadlock
  - AMD clock init and bandwidth refactoring
  - Intel more codecs to wake list, clear message on before signaling waiting thread
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE+vs47OPLdNbVcHzyfBQHDyUjg0cFAmnh3twACgkQfBQHDyUj
 g0eZwhAApdSFRhk43yNAMWr33Vxb+IFjRylNaJb6h5IWS7+0Z3yfq6zOuM3tW7Yh
 C9804L0RkncHwq6th0T5pi3neAwm/dVi1zmnzXiAe5Kgzl/Eru4ZNMh59VD8aNwQ
 K/emES6AJR6ulezYHNDE5Y74kjQHzMQUWiUo1DoAapoqr+WnZvfK+ZYAYh7I/ctY
 FxzBxx13yIHInDHsl3WQ+r1CSinDEe3RiQHW5+5DWdmmw8LfHLGUBBFIJQcVxRN/
 8NlNYr1wvRxUij11cZMPc3TetPfSsIGFpa7eOKezX1P9GxwY7qWvPvPmO0kzgLvH
 AsbFXOHZKYbtPy87agF1QdGq0Seym9x6OhNFucXs1yXIk1t/isv9bOrrOOmnSbR2
 U3ycbMCUmJEUKhd7MWPWRaFUCEM2j/CRugFwpIbeE7AgJ5hZIUXlfWykDdlFxDTM
 e9IQ1jMTSnwyXs705FLLF3hxjIIAWS1kHIgEPWrxuSkAD9/Xx6sbD2fca7Ca6qrm
 W90TlprDAj/KiisEvje0tjEfZ8fTUanLC67d2sbxtrpzwpus4u8GzD62RAgsLlYP
 y9qGeAE1I5FMtJB83dewiYPCIofoez4DizM5wemojI+TtmvZwEWYfeXievD3ibad
 xN3uXtX6fqZ6BWUVIaxjdhSEB2FYdaZjTWPSmcUIwKlApOso0dY=
 =0cvn
 -----END PGP SIGNATURE-----

Merge tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire

Pull soundwire updates from Vinod Koul:

 - Core: DP prepare polling for avoiding interrupt deadlock

 - AMD clock init and bandwidth refactoring

 - Intel more codecs to wake list, clear message on before signaling
   waiting thread

* tag 'soundwire-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:
  soundwire: intel_auxdevice: Add cs42l49 to wake_capable_list
  soundwire: cadence: Clear message complete before signaling waiting thread
  soundwire: Intel: test bus.bpt_stream before assigning it
  soundwire: bus: demote UNATTACHED state warnings to dev_dbg()
  soundwire: stream: Poll for DP prepare to avoid interrupt deadlock
  soundwire: amd: refactor bandwidth calculation logic
  soundwire: amd: add clock init control function
  soundwire: intel_auxdevice: Add CS47L47 to wake_capable_list
  soundwire: slave: Don't register devices that are disabled in ACPI
  soundwire: sdw.h: repair names and format of kernel-doc comments
2026-04-17 10:16:53 -07:00
Puranjay Mohan
2845989f2e bpf: Validate node_id in arena_alloc_pages()
arena_alloc_pages() accepts a plain int node_id and forwards it through
the entire allocation chain without any bounds checking.

Validate node_id before passing it down the allocation chain in
arena_alloc_pages().

Fixes: 317460317a ("bpf: Introduce bpf_arena.")
Signed-off-by: Puranjay Mohan <puranjay@kernel.org>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Link: https://lore.kernel.org/r/20260417152135.1383754-1-puranjay@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2026-04-17 10:12:55 -07:00
Linus Torvalds
0b6bc3dbe6 tracing latency updates for 7.1:
- Add TIMERLAT_ALIGN osnoise option
 
   Add a timer alignment option for timerlat that makes it work like the
   cyclictest -A option. timelat creates threads to test the latency of the
   kernel. The alignment option will have these threads trigger at the
   alignment offsets from each other. Instead of having each thread wake up
   at the exact same time, if the alignment is set to "20" each thread will
   wake up at 20 microseconds from the previous one.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaeIBaBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qqM8AQCyz4uL1lCLQtJb5thG8V9QFRkYh5F3
 +DyuRNoht3ijyAD+K4nZPAu4F09feWuHkssONtSZECKEuN6EhiHE4XX6Pgc=
 =WYYW
 -----END PGP SIGNATURE-----

Merge tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull tracing latency update from Steven Rostedt:

 - Add TIMERLAT_ALIGN osnoise option

   Add a timer alignment option for timerlat that makes it work like the
   cyclictest -A option. timelat creates threads to test the latency of
   the kernel. The alignment option will have these threads trigger at
   the alignment offsets from each other. Instead of having each thread
   wake up at the exact same time, if the alignment is set to "20" each
   thread will wake up at 20 microseconds from the previous one.

* tag 'trace-latency-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing/osnoise: Add option to align tlat threads
2026-04-17 10:12:11 -07:00