summaryrefslogtreecommitdiff
path: root/arch
AgeCommit message (Collapse)Author
2026-07-01bpf: Restrict JIT predictor flush to cBPFPawan Gupta
Currently predictor flush on memory reuse is done for all BPF JIT allocations, but only cBPF programs can be loaded by an unprivileged user. eBPF is privileged by default, and flushing predictors for all CPUs on every eBPF reuse penalizes the common case for no security benefit. eBPF allocations can be frequent on busy systems, only flush predictors for cBPF programs. Trampoline and dispatcher allocations also skip the flush as they are eBPF-only. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-07-01x86/bugs: Enable IBPB flush on BPF JIT allocationPawan Gupta
Enable hardening against JIT spraying when Spectre-v2 mitigations are in use. Specifically, issue an IBPB flush on BPF JIT memory reuse. Skip enabling the IBPB flush if the BPF dispatcher is already using a retpoline sequence. This hardening applies only when BPF-JIT is in use. Guard the enabling under CONFIG_BPF_JIT so that bugs.c still builds with CONFIG_BPF_JIT=n. Signed-off-by: Pawan Gupta <pawan.kumar.gupta@linux.intel.com> Acked-by: Daniel Borkmann <daniel@iogearbox.net> Acked-by: Dave Hansen <dave.hansen@linux.intel.com> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
2026-07-01powerpc64/kasan: Remove unreachable invalid range check in ↵Sang-Heon Jeon
kasan_init_phys_region() kasan_init() maps each memblock region with for_each_mem_range() and passes it to kasan_init_phys_region(), which does nothing when start >= end. for_each_mem_range() never returns an invalid range, so start < end always. Therefore the start >= end check is unreachable, so remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-7-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-01ARM: remove unreachable invalid range check in kasan_init()Sang-Heon Jeon
kasan_init() maps each memblock region with for_each_mem_range(), which guarantees pa_start < pa_end. Then it skips any region with pa_start >= arm_lowmem_limit, so pa_start < arm_lowmem_limit is guaranteed as well. When pa_end <= arm_lowmem_limit, pa_start < pa_end means start < end, so the start >= end check is unreachable. When pa_end > arm_lowmem_limit, end is clamped to __va(arm_lowmem_limit), and pa_start < arm_lowmem_limit means start < end, so the check is unreachable as well. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-6-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-01riscv: remove unreachable invalid range check in kasan_init()Sang-Heon Jeon
kasan_init() populates the linear mapping shadow with for_each_mem_range() and breaks the loop when start >= end. for_each_mem_range() never returns an invalid range, so start < end always. Therefore the start >= end check is unreachable, so remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-5-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-01riscv: remove unreachable invalid range check in ↵Sang-Heon Jeon
create_linear_mapping_page_table() create_linear_mapping_page_table() iterates memblock regions with for_each_mem_range() and breaks the loop when start >= end. for_each_mem_range() never returns an invalid range, so start < end always. Therefore the start >= end check is unreachable, so remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Tested-by: Charlie Jenkins <thecharlesjenkins@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-4-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-01LoongArch: remove unreachable invalid range check in kasan_init()Sang-Heon Jeon
kasan_init() populates the linear mapping shadow with for_each_mem_range() and breaks the loop when start >= end. for_each_mem_range() never returns an invalid range, so start < end always. Therefore the start >= end check is unreachable, so remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-3-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-07-01arm64: mm: remove unreachable invalid range check in kasan_init_shadow()Sang-Heon Jeon
kasan_init_shadow() maps each memblock region with for_each_mem_range() and breaks the loop when start >= end. for_each_mem_range() never returns an invalid range, so start < end always. Therefore the start >= end check is unreachable, so remove it. No functional change. Signed-off-by: Sang-Heon Jeon <ekffu200098@gmail.com> Reviewed-by: Andrey Ryabinin <ryabinin.a.a@gmail.com> Link: https://patch.msgid.link/20260630150413.1718632-2-ekffu200098@gmail.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30riscv: probes: save original sp in rethook trampolineMartin Kaiser
Reading a word from the stack in a kretprobe crashes a risc-v kernel. $ cd /sys/kernel/tracing/ $ echo 'r n_tty_write $stack0' > dynamic_events $ echo 1 > events/kprobes/enable Unable to handle kernel paging request at virtual address 0000000200000128 ... [<ffffffff80016d16>] regs_get_kernel_stack_nth+0x26/0x38 [<ffffffff80177196>] process_fetch_insn+0x3ee/0x760 [<ffffffff80177836>] kretprobe_trace_func+0x116/0x1f0 [<ffffffff8017795a>] kretprobe_dispatcher+0x4a/0x58 [<ffffffff8013572e>] kretprobe_rethook_handler+0x5e/0x90 [<ffffffff80180838>] rethook_trampoline_handler+0x70/0x108 [<ffffffff8001ba32>] arch_rethook_trampoline_callback+0x12/0x1c [<ffffffff8001ba84>] arch_rethook_trampoline+0x48/0x94 [<ffffffff8067872a>] tty_write+0x1a/0x30 In regs_get_kernel_stack_nth, regs->sp contains an arbitrary value. arch_rethook_trampoline saves the registers from the probed function in a struct pt_regs. sp is not saved. Instead, sp is decremented for arch_rethook_trampoline's local stack. Fix this crash and save the original sp along with the other registers. Use a0 as a temporary register, it is overwritten anyway. Cc: stable@vger.kernel.org Fixes: c22b0bcb1dd02 ("riscv: Add kprobes supported") Signed-off-by: Martin Kaiser <martin@kaiser.cx> Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Link: https://patch.msgid.link/20260630194010.1824039-1-martin@kaiser.cx [pjw@kernel.org: added Fixes tag; cc'ed stable] Signed-off-by: Paul Walmsley <pjw@kernel.org>
2026-06-30x86/fpu: Fix kernel-doc formatting above fpu_enable_guest_xfd_features()Chao Gao
Adjust the indentation and use tabs between function parameters and their descriptions to align with the convention used in FPU code. Signed-off-by: Chao Gao <chao.gao@intel.com> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://patch.msgid.link/20250620052152.490414-1-chao.gao@intel.com
2026-06-30arm64: dts: imx943-evk: add PCIe root port node and according propertiesRichard Zhu
Since describing the PCIe PERST# property under Host Bridge node is now deprecated, it is recommended to add it to the Root Port node, so creating the root port node and add the reset-gpios property in root port. Move the regulator to root port nodes as well, because that the PCI pwrctrl framework had been integrated into pci-imx6 driver. The backward compatibility is not a concern since i.MX94 is a newly introduced platform that is still under active development. Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com> Reviewed-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-30arm64: dts: imx94: add PCIe Root Port nodeRichard Zhu
Since describing the PCIe PERST# property under Host Bridge node is now deprecated, it is recommended to add it to the Root Port node, so creating the root port node and pave the path to add the reset-gpios and so on properties in root port later. Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com> Reviewed-by: Sherry Sun <sherry.sun@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-30riscv: kexec_file: Add support for crashkernel CMA reservationJinjie Ruan
Commit 35c18f2933c5 ("Add a new optional ",cma" suffix to the crashkernel= command line option") and commit ab475510e042 ("kdump: implement reserve_crashkernel_cma") added CMA support for kdump crashkernel reservation. This allows the kernel to dynamically allocate contiguous memory for crash dumping when needed, rather than permanently reserving a fixed region at boot time. So extend crashkernel CMA reservation support to riscv. The following changes are made to enable CMA reservation: - Parse and obtain the CMA reservation size along with other crashkernel parameters. - Call reserve_crashkernel_cma() to allocate the CMA region for kdump. - Include the CMA-reserved ranges for kdump kernel to use, which was already done in of_kexec_alloc_and_setup_fdt(). - Exclude the CMA-reserved ranges from the crash kernel memory to prevent them from being exported through /proc/vmcore, which was already done in the crash core. Update kernel-parameters.txt to document CMA support for crashkernel on riscv architecture. Cc: Paul Walmsley <pjw@kernel.org> Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Albert Ou <aou@eecs.berkeley.edu> Cc: Alexandre Ghiti <alex@ghiti.fr> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Paul Walmsley <pjw@kernel.org> # arch/riscv Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-11-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30arm64: kexec_file: Add support for crashkernel CMA reservationJinjie Ruan
Commit 35c18f2933c5 ("Add a new optional ",cma" suffix to the crashkernel= command line option") and commit ab475510e042 ("kdump: implement reserve_crashkernel_cma") added CMA support for kdump crashkernel reservation. Crash kernel memory reservation wastes production resources if too large, risks kdump failure if too small, and faces allocation difficulties on fragmented systems due to contiguous block constraints. The new CMA-based crashkernel reservation scheme splits the "large fixed reservation" into a "small fixed region + large CMA dynamic region": the CMA memory is available to userspace during normal operation to avoid waste, and is reclaimed for kdump upon crash—saving memory while improving reliability. So extend crashkernel CMA reservation support to arm64. The following changes are made to enable CMA reservation: - Parse and obtain the CMA reservation size along with other crashkernel parameters. - Call reserve_crashkernel_cma() to allocate the CMA region for kdump. - Include the CMA-reserved ranges for kdump kernel to use. - Exclude the CMA-reserved ranges from the crash kernel memory to prevent them from being exported through /proc/vmcore, which is already done in the crash core. Update kernel-parameters.txt to document CMA support for crashkernel on arm64 architecture. Tested-by: Breno Leitao <leitao@debian.org> Acked-by: Catalin Marinas <catalin.marinas@arm.com> Acked-by: Rob Herring (Arm) <robh@kernel.org> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-10-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30powerpc/kexec_file: Use crash_exclude_core_ranges() helperJinjie Ruan
The crash memory exclude of crashk_res and crashk_cma memory on powerpc are almost identical to the generic crash_exclude_core_ranges(). By introducing the architecture-specific arch_crash_exclude_mem_range() function with a default implementation of crash_exclude_mem_range(), and using crash_exclude_mem_range_guarded as powerpc's separate implementation, the generic crash_exclude_core_ranges() helper function can be reused. Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Hari Bathini <hbathini@linux.ibm.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Mahesh Salgaonkar <mahesh@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Cc: Shivang Upadhyay <shivangu@linux.ibm.com> Acked-by: Breno leitao <leitao@debian.org> Acked-by: Baoquan He <bhe@redhat.com> Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-9-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30LoongArch: kexec_file: Use crash_prepare_headers() helper to simplify codeJinjie Ruan
Use the newly introduced crash_prepare_headers() function to replace the existing prepare_elf_headers(), allocate cmem and exclude crash kernel memory in the crash core, which reduce code duplication. Only the following two architecture functions need to be implemented: - arch_get_system_nr_ranges(). Use for_each_mem_range to traverse and pre-count the max number of memory ranges. - arch_crash_populate_cmem(). Use for_each_mem_range to traverse and collect the memory ranges and fills them into cmem. Cc: Huacai Chen <chenhuacai@kernel.org> Cc: WANG Xuerui <kernel@xen0n.name> Cc: Youling Tang <tangyouling@kylinos.cn> Cc: Baoquan He <bhe@redhat.com> Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-8-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30riscv: kexec_file: Use crash_prepare_headers() helper to simplify codeJinjie Ruan
Use the newly introduced crash_prepare_headers() function to replace the existing prepare_elf_headers(), allocate cmem and exclude crash kernel memory in the crash core, which reduce code duplication. Only the following two architecture functions need to be implemented: - arch_get_system_nr_ranges(). Call get_nr_ram_ranges_callback() to pre-counts the max number of memory ranges. - arch_crash_populate_cmem(). Use prepare_elf64_ram_headers_callback() to collects the memory ranges and fills them into cmem. Cc: Paul Walmsley <pjw@kernel.org> Cc: Palmer Dabbelt <palmer@dabbelt.com> Cc: Albert Ou <aou@eecs.berkeley.edu> Cc: Alexandre Ghiti <alex@ghiti.fr> Cc: Guo Ren <guoren@kernel.org> Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Reviewed-by: Guo Ren <guoren@kernel.org> Link: https://patch.msgid.link/20260629094746.191843-7-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30x86/crash: Use crash_prepare_headers() helper to simplify codeJinjie Ruan
Use the newly introduced crash_prepare_headers() function to replace the existing prepare_elf_headers(), allocate cmem and exclude crash kernel memory in the crash core, which reduce code duplication. Only the following three architecture functions need to be implemented: - arch_get_system_nr_ranges(). Call get_nr_ram_ranges_callback() to pre-count the max number of memory ranges. - arch_crash_populate_cmem(). Use prepare_elf64_ram_headers_callback() to collect the memory ranges and fills them into cmem. - arch_crash_exclude_ranges(). Exclude the low 1M for x86. While at it, remove the unused "nr_mem_ranges" in arch_crash_handle_hotplug_event(). Cc: Thomas Gleixner <tglx@kernel.org> Cc: Ingo Molnar <mingo@redhat.com> Cc: Borislav Petkov <bp@alien8.de> Cc: Dave Hansen <dave.hansen@linux.intel.com> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Vivek Goyal <vgoyal@redhat.com> Acked-by: Borislav Petkov (AMD) <bp@alien8.de> Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-6-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30arm64: kexec_file: Use crash_prepare_headers() helper to simplify codeJinjie Ruan
Use the newly introduced crash_prepare_headers() function to replace the existing prepare_elf_headers(), allocate cmem and exclude crash kernel memory in the crash core, which reduce code duplication. Only the following two architecture functions need to be implemented: - arch_get_system_nr_ranges(). Use for_each_mem_range() to traverse and pre-count the max number of memory ranges. - arch_crash_populate_cmem(). Use for_each_mem_range to traverse and collect the memory ranges and fills them into cmem. Acked-by: Catalin Marinas <catalin.marinas@arm.com> Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com> Acked-by: Baoquan He <bhe@redhat.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-5-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30powerpc/crash: sort crash memory ranges before preparing elfcorehdrSourabh Jain
During a memory hot-remove event, the elfcorehdr is rebuilt to exclude the removed memory. While updating the crash memory ranges for this operation, the crash memory ranges array can become unsorted. This happens because remove_mem_range() may split a memory range into two parts and append the higher-address part as a separate range at the end of the array. So far, no issues have been observed due to the unsorted crash memory ranges. However, this could lead to problems once crash memory range removal is handled by generic code, as introduced in the upcoming patches in this series. Currently, powerpc uses a platform-specific function, remove_mem_range(), to exclude hot-removed memory from the crash memory ranges. This function performs the same task as the generic crash_exclude_mem_range() in crash_core.c. The generic helper also ensures that the crash memory ranges remain sorted. So remove the redundant powerpc-specific implementation and instead call crash_exclude_mem_range_guarded() (which internally calls crash_exclude_mem_range()) to exclude the hot-removed memory ranges. Cc: Andrew Morton <akpm@linux-foundation.org> Cc: Baoquan he <bhe@redhat.com> Cc: Jinjie Ruan <ruanjinjie@huawei.com> Cc: Hari Bathini <hbathini@linux.ibm.com> Cc: Madhavan Srinivasan <maddy@linux.ibm.com> Cc: Mahesh Salgaonkar <mahesh@linux.ibm.com> Cc: Michael Ellerman <mpe@ellerman.id.au> Cc: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Cc: Shivang Upadhyay <shivangu@linux.ibm.com> Cc: linux-kernel@vger.kernel.org Acked-by: Baoquan He <bhe@redhat.com> Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com> Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://patch.msgid.link/20260629094746.191843-3-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30riscv: kexec_file: Fix crashk_low_res not exclude bugJinjie Ruan
As done in commit 944a45abfabc ("arm64: kdump: Reimplement crashkernel=X") and commit 4831be702b95 ("arm64/kexec: Fix missing extra range for crashkres_low.") for arm64, while implementing crashkernel=X,[high,low], riscv should have excluded the "crashk_low_res" reserved ranges from the crash kernel memory to prevent them from being exported through /proc/vmcore, and the exclusion would need an extra crash_mem range. Just simply tested on qemu with crashkernel=4G with kexec in [1] mentioned in [2]. And the second kernel can be started normally. # dmesg | grep crash [ 0.000000] crashkernel low memory reserved: 0xf8000000 - 0x100000000 (128 MB) [ 0.000000] crashkernel reserved: 0x000000017fe00000 - 0x000000027fe00000 (4096 MB) [1]: https://github.com/chenjh005/kexec-tools/tree/build-test-riscv-v2 [2]: https://lore.kernel.org/all/20230726175000.2536220-1-chenjiahao16@huawei.com/ Cc: Guo Ren <guoren@kernel.org> Cc: Baoquan He <bhe@redhat.com> Fixes: 5882e5acf18d ("riscv: kdump: Implement crashkernel=X,[high,low]") Reviewed-by: Guo Ren <guoren@kernel.org> Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com> Link: https://github.com/chenjh005/kexec-tools/tree/build-test-riscv-v2 Link: https://lore.kernel.org/all/20230726175000.2536220-1-chenjiahao16@huawei.com/ Link: https://patch.msgid.link/20260629094746.191843-2-ruanjinjie@huawei.com Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
2026-06-30perf/x86/intel: Drop fixed-counter PEBS constraints for baseline PEBSDapeng Mi
On Sapphire Rapids (SPR) guests where pebs_baseline is not advertised, running command $ ./perf record -e cpu/event=0x00,umask=0x01,i\ name=INST_RETIRED.PREC_DIST/p -c 10000 sleep 1 can trigger: unchecked MSR access error: WRMSR to 0x3f1 ... in\ intel_pmu_pebs_enable_all() This occurs because SPR-specific PEBS constraints allow fixed-counter scheduling (for example, INST_RETIRED.PREC_DIST on fixed counter 0). In guests lacking pebs_baseline, KVM does not support PEBS sampling on fixed counters, so enabling such events reaches an invalid MSR programming path. Starting with Icelake, regardless of whether Extended PEBS or Architectural PEBS is in use, all counters (including fixed counters) support PEBS sampling, and the PMU_FL_PEBS_ALL flag is set by default. As long as PMU_FL_PEBS_ALL is set, constraint lookup automatically falls back to the corresponding non-PEBS constraints if no matching entry is found in the PEBS constraints table. Since non-PEBS event constraints already contain the same fixed-counter constraints, it is safe to remove these fixed-counter entries from the PEBS constraints table. The fallback mechanism will ensure that fixed PEBS events are scheduled onto the correct fixed counters. So, directly drop the fixed-counter entries from the PEBS constraint table. Without pebs_baseline, these fixed-counter PEBS events will now resolve to empty constraints and will not be scheduled or enabled, thereby avoiding the warning and bypassing the broken guest PEBS path. Reported-by: Yi Lai <yi1.lai@intel.com> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-7-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Validate the return value of intel_pmu_init_hybrid()Dapeng Mi
The intel_pmu_init_hybrid() function allocates memory for the x86_pmu.hybrid_pmu[] array. If this allocation fails under memory pressure, hybrid PMU initialization will fail. Currently, the caller does not check the return value of intel_pmu_init_hybrid(). This can lead to a null-pointer dereference or invalid memory access when attempting to use the uninitialized array, potentially triggering a system panic. Fix this by validating the return value of intel_pmu_init_hybrid(). Additionally, reset x86_pmu.num_hybrid_pmus to 0 on failure, and defer intel_pmu_arch_lbr_init() until after hybrid PMU initialization succeeds. This reordering avoids the need to explicitly destroy the kmem cache if the memory allocation fails. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-6-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Fix kernel address leakages in LBR stackDapeng Mi
Before Arch LBR gained CPL filtering support, a user-only branch stack could still contain kernel addresses. As a result, kernel branch records may be exposed to user space even when PERF_SAMPLE_BRANCH_USER is requested. For example, on Intel Tiger Lake, the following command can still report SYSRET/ERET entries with kernel-space from addresses: $ ./perf record -e cycles:p -o - --branch-filter any,save_type,u -- \ ./perf bench syscall basic --loop 1000 | \ ./perf script -i - --fields brstack|tr ' ' '\n'| \ grep -E '0x[89a-f][0-9a-f]{15}' Total time: 0.000 [sec] 0.219000 usecs/op 4,566,210 ops/sec [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.551 MB - ] 0xffffffff93c001c8/0x7f12a2b1d647/P/-/-/16959/SYSRET/- 0xffffffff93c001c8/0x7f12a2b1d5c2/P/-/-/17535/SYSRET/- 0xffffffff93c01928/0x7f12a2861000/P/-/-/6719/ERET/- 0xffffffff93c01928/0x7f12a297a000/P/-/-/8575/ERET/- The problem is that intel_pmu_lbr_filter() does not fully validate the privilege level of sampled entries. It filters some mismatches based on the branch type and the to address, but it does not reject entries whose from address violates the requested branch privilege filter. Fix this by extending software filtering to validate both from and to addresses against br_sel. Any LBR entry contains kernel address does not match the requested user filter is dropped. This prevents kernel addresses from appearing in user-only branch stacks. Fixes: 47125db27e47 ("perf/x86/intel/lbr: Support Architectural LBR") Reported-by: Ian Rogers <irogers@google.com> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616044654.3468742-5-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Fallback to sw branch type decoding if no hw decodingDapeng Mi
intel_pmu_lbr_filter() currently assumes arch-LBR provides hardware branch-type decoding and skips software decoding on that path. However, arch-LBR may not always expose branch-type information. In that case, treating entries as hardware-decoded can misclassify sampled branches (for example, defaulting to JCC), which breaks branch-type filtering results. Fix this by using software branch-type decoding when hardware branch-type decoding is unavailable (that is, when x86_lbr_type is not enabled). This keeps branch classification and filtering behavior correct across arch-LBR configurations. Since x86_lbr_type is only set to true when arch-LBR is supported, it's unnecessary to check if the CPU has the arch-LBR feature. Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-4-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Keep cap_user_rdpmc in sync with RDPMC user-disable stateDapeng Mi
After introducing the RDPMC user disable feature, user-space RDPMC may return 0 instead of the actual event count. This creates an inconsistency with cap_user_rdpmc, where cap_user_rdpmc is set, but user-space RDPMC only returns 0. To accurately represent the user-space RDPMC capability, update cap_user_rdpmc (depending on PERF_EVENT_FLAG_USER_READ_CNT) according to the RDPMC user disable state. If RDPMC user disable is enabled, cap_user_rdpmc is updated to false eventually, allowing user-space programs to fall back to the read() syscall to obtain the real event count. Because PERF_EVENT_FLAG_USER_READ_CNT is evaluated in x86_pmu_event_init(), move intel_pmu_update_rdpmc_user_disable() earlier into intel_pmu_hw_config(). This ensures that the user-disable state is updated before updating PERF_EVENT_FLAG_USER_READ_CNT. Note that since event->ctx is not yet assigned at this stage, use the PERF_ATTACH_TASK flag to detect whether the event is task-attached. While at it, fix the indentation of x86_pmu_has_rdpmc_user_disable() to adhere to the kernel coding style. Fixes: 59af95e028d4 ("perf/x86/intel: Add support for rdpmc user disable feature") Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260616044654.3468742-3-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel: Remove anythread_deprecated bit from perf_capabilitiesDapeng Mi
AnyThread mode deprecation is enumerated by CPUID.0AH:EDX[15] instead of PERF_CAPABILITIES MSR. It's not a good practice to define a bit to represent "anythread deprecation" in perf_capabilities. It leads to the anythread_deprecated bit could be overwritten by the real value of PERF_CAPABILITIES MSR, just like the below code in update_pmu_cap() does. if (!intel_pmu_broken_perf_cap()) { /* Perf Metric (Bit 15) and PEBS via PT (Bit 16) are hybrid enumeration */ rdmsrq(MSR_IA32_PERF_CAPABILITIES, hybrid(pmu, intel_cap).capabilities); } It leads to the anythread_deprecated bit is cleared to 0 and the "any" attribute is incorrectly shown in the /sys/devices/cpu/format/ folder on these support Perfmon v6 platforms, like Clearwater Forest. $ grep . /sys/devices/cpu/format/* /sys/devices/cpu/format/acr_mask:config2:0-63 /sys/devices/cpu/format/any:config:21 /sys/devices/cpu/format/cmask:config:24-31 So remove the anythread_deprecated bit from perf_capabilities structure and directly depends on CPUID.0AH:EDX[15] to judge if anythread is deprecated. Fixes: cadbaa039b99 ("perf/x86/intel: Make anythread filter support conditional") Reported-by: Namhyung Kim <namhyung@kernel.org> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Zide Chen <zide.chen@intel.com> Reviewed-by: Thomas Falcon <thomas.falcon@intel.com> Acked-by: Namhyung Kim <namhyung@kernel.org> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260616044654.3468742-2-dapeng1.mi@linux.intel.com
2026-06-30perf/x86/intel/uncore: Implement lazy setup for MSR/MMIO PMUsZide Chen
MSR and MMIO uncore PMUs are currently registered at module init time and appear in sysfs even when no PMU boxes are functional. Apply the same lazy registration model used by PCI uncore PMUs: the PMU is registered when the first box is successfully initialized, and unregistered when the last box exits. If a box fails to initialize on a subsequent die, the PMU is marked broken but remains registered to avoid disrupting any in-flight perf events. Box allocation and freeing remain at module init/exit time to avoid repeated kfree/alloc cycles across CPU offline/online events. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-9-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix uncore_box ref/unref orderingZide Chen
In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case. Thus, box->refcnt is one count below the true value, and in the CPU offline path, the box will be torn down on the second-to-last CPU. In uncore_event_cpu_offline(), uncore_box_unref() was called after uncore_change_context(), so box->cpu is already -1 when the collector CPU goes offline, which prevents it from tearing down the box. Fix by swapping the call order in both paths so that uncore_box_{ref,unref}() runs at the point where box->cpu reflects the correct context. Move allocate_boxes() out of uncore_box_ref() to enable this reordering. Fixes: c74443d92f68 ("perf/x86/uncore: Support per PMU cpumask") Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-8-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Introduce PMU flags and broken stateZide Chen
Replace the boolean 'registered' field in intel_uncore_pmu with an unsigned long 'flags' field, and add a PMU_BROKEN flag to track box setup failures. The broken flag is sticky, meaning it is cleared only by a module reload or system reboot. Broken PMUs are skipped in the CPU hotplug and box allocation paths. When any box fails to initialize, the PMU is marked broken. Broken PMUs reject new event assignments and skip future box setup attempts. If the PMU was already registered, it remains so to avoid disrupting in-flight events on other boxes. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-7-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Factor out box setup codeZide Chen
The PCI uncore PMU path already implements a lazy registration model: the PMU is registered when the first active box appears and unregistered when the last active box is removed. Factor this registration management into a shared helper, so the same code can be reused by the MSR and MMIO paths in later changes. No functional change intended. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-6-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Keep PCI PMUs working when MMIO/MSR setup failsZide Chen
uncore_event_cpu_online() returns -ENOMEM early when both the MSR and MMIO box allocations fail. This also aborts PCI uncore setup, even though PCI PMUs are independent of the MSR/MMIO paths. Remove the early return so PCI uncore setup always runs regardless of whether MSR or MMIO box allocation succeeds. Fixes: 3da04b8a00dd ("perf/x86/intel/uncore: Support MMIO type uncore blocks") Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-5-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Let init_box() callback report failuresZide Chen
The init_box() callback currently returns void, so initialization failures are silently ignored and the box is still marked initialized. Change the callback to return int so platform code can report errors back to the common uncore layer. Update uncore_box_init() to set the initialized flag only when init_box() succeeds. Because box->refcnt guarantees that at most one CPU calls uncore_box_init() for a given box at a time, plain __set_bit() is safe for the initialized flag without atomic overhead. Convert all init_box() implementations to return 0 on success or a negative error code on failure. This is a prerequisite for propagating initialization errors to the caller so they can be handled properly. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Ian Rogers <irogers@google.com> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-4-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix refcnt and other cleanupsZide Chen
Fix typo UNCORE_BOX_FLAG_INITIATED to UNCORE_BOX_FLAG_INITIALIZED. Rename the 'id' parameter in uncore_box_{ref,unref}() to 'die' to reflect its actual meaning and be consistent with other functions. box->refcnt is incremented in the PCI PMU register path but has never been checked or decremented. Although for PCI PMUs box->refcnt effectively tracks only a single user, add atomic_dec_return() in the PCI PMU unregister path to make the reference counting complete and consistent. Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://patch.msgid.link/20260611160033.66760-3-zide.chen@intel.com
2026-06-30perf/x86/intel/uncore: Fix PCI PMU cleanup on setup failureZide Chen
When uncore_pci_pmu_register() fails, pmu->boxes[die] is set to NULL before returning. In the uncore_pci_remove() path, this causes uncore_pci_pmu_unregister() to be skipped entirely, leaking pmu->activeboxes. In the uncore_bus_notify() path, uncore_pci_pmu_unregister() may still be called and must exit early when pmu->boxes[die] is NULL to avoid a NULL pointer dereference, and to ensure activeboxes is only decremented for a previously active box. Additionally, since pci_get_drvdata() returns NULL on registration failure, uncore_pci_remove() can no longer treat NULL drvdata as an indicator of an auxiliary PCI device. Remove the associated WARN_ON_ONCE(). Signed-off-by: Zide Chen <zide.chen@intel.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Dapeng Mi <dapeng1.mi@linux.intel.com> Link: https://sashiko.dev/#/patchset/20260512233048.9577-1-zide.chen@intel.com?part=1 Link: https://patch.msgid.link/20260611160033.66760-2-zide.chen@intel.com
2026-06-29ARM: imx: Drop obsolete stuff from common.hUwe Kleine-König (The Capable Hub)
i.MX21 (and thus imx21_init_early()) is gone since v5.10-rc1 (commit 4b563a066611 ("ARM: imx: Remove imx21 support")). The init_irq() functions are gone since v5.12-rc5 (commit e2c1b0ff38c9 ("ARM: imx: avic: Convert to using IRQCHIP_DECLARE")). And mxc_device_init() was removed for v5.10-rc1 (in commit 8485adf17a15 ("ARM: imx: Remove imx device directory")). The last user of imx1_reset_init() is gone since v4.9-rc1 (commit e1291cffcc50 ("ARM: i.MX: Remove i.MX1 non-DT support")). Drop declaration of enum mxc_cpu_pwr_mode, the actual definition follows later in common.h without a usage in-between. All users of of_device_id also include <linux/of.h>, <linux/of_address.h> or <linux/of_platform.h> which is enough to not need the forward declaration. Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-29arm64: dts: imx8mp-ab2: Enable MU2 for DSP communicationShengjiu Wang
Enable the MU2 (Message Unit 2) node on the i.MX8MP Audio Board v2. MU2 is required for inter-processor communication between the application CPU and the HiFi4 DSP, allowing DSP firmware to exchange control and status messages with the Linux host. Without this change, the DSP driver cannot establish the message channel and DSP audio processing is non-functional. Fixes: bf68c18150efc ("arm64: dts: imx8mp-ab2: add support for NXP i.MX8MP audio board (version 2)") Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-29arm64: dts: freescale: imx95-toradex-smarc: add alias for lpuart5Francesco Dolcini
Add alias for lpuart5 so the UART gets a stable line number. Without this alias, the lpuart driver fails: fsl-lpuart 42590000.serial: failed to get alias id, errno -19 This prevents the Bluetooth controller connected to this UART from working. Fixes: 104a391bb6ff ("arm64: dts: freescale: imx95-toradex-smarc: Enable bluetooth on lpuart5") Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com> Acked-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-29arm64: dts: imx93-kontron: set memory node to 0x80000000/1GiBFrieder Schrempf
The start address of the DRAM area is 0x80000000. The minimal size of the DDR on the SoM is 1 GiB. Fixes: 2b52fd6035b7 ("arm64: dts: Add support for Kontron i.MX93 OSM-S SoM and BL carrier board") Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> Signed-off-by: Frank Li <Frank.Li@nxp.com>
2026-06-29ARM: omap2plus_defconfig: enable things required by iwdAndreas Kemnade
Several crypto related things are missing for opreation of iwd, turn them on according to the list being printed out. :~# /usr/libexec/iwd & :~# No HMAC(SHA1) support found No HMAC(MD5) support found No CMAC(AES) support found No HMAC(SHA256) support not found No HMAC(SHA512) support found, certain TLS connections might fail DES support not found AES support not found No CBC(DES3_EDE) support found, certain TLS connections might fail No CBC(AES) support found, WPS will not be available No Diffie-Hellman support found, WPS will not be available The following options are missing in the kernel: CONFIG_CRYPTO_USER_API_HASH CONFIG_CRYPTO_USER_API_SKCIPHER CONFIG_KEY_DH_OPERATIONS CONFIG_CRYPTO_ECB CONFIG_CRYPTO_MD5 CONFIG_CRYPTO_CBC CONFIG_CRYPTO_SHA256 CONFIG_CRYPTO_AES CONFIG_CRYPTO_DES CONFIG_CRYPTO_CMAC CONFIG_CRYPTO_HMAC CONFIG_CRYPTO_SHA512 CONFIG_CRYPTO_SHA1 Apparently missing USER_API_SKCIPHER did also hide some things for iwd. Signed-off-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260616175152.1373709-1-andreas@kemnade.info Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29arm: multi_v7_defconfig: Enable BRIDGE and DP83848_PHY for TI AM57xx, AM437x ↵Parvathi Pudi
and AM335x This patch enables BRIDGE and DP83848_PHY as kernel modules for AM57xx, AM437x and AM335x SoCs. BRIDGE is to support STP/RSTP Switch mode using PRU-ICSS which got recently merged and DP83848 PHY driver to support TI TLK10X PHY. Signed-off-by: Parvathi Pudi <parvathi@couthit.com> Link: https://patch.msgid.link/20260428085003.3023464-1-parvathi@couthit.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29ARM: OMAP2+: Fix OF node reference leaks in omap_hwmodYuho Choi
The OF helpers that return device nodes acquire references that must be released by the caller. _init() leaks the "ocp" bus node returned by of_find_node_by_name() on all paths after lookup, and also leaks the child returned by of_get_next_child() when parsing module flags. Route the post-lookup returns through a common cleanup path and release the child after use. omap_hwmod_setup_earlycon_flags() leaks the /chosen node and the UART node resolved from stdout-path. Track them separately and drop both references after use. Fixes: 1aa8f0cb19e5 ("ARM: OMAP2+: Remove unused legacy code for interconnects") Fixes: 4f2122473363 ("ARM: OMAP2+: Check also the first dts child for hwmod flags") Fixes: 8dd6666f4937 ("ARM: OMAP2+: omap_hwmod: Add support for earlycon") Signed-off-by: Yuho Choi <dbgh9129@gmail.com> Reviewed-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260504164711.2854116-1-dbgh9129@gmail.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29ARM: OMAP2+: Add CFI type for omap4_finish_suspendMithil Bavishi
With CONFIG_CFI enabled, OMAP4 can trap in omap4_enter_lowpower() because omap_pm_ops.finish_suspend points directly to the assembly routine omap4_finish_suspend, which lacks the expected KCFI type metadata. Annotate omap4_finish_suspend with SYM_TYPED_FUNC_START so the assembly routine carries the KCFI type metadata. Signed-off-by: Mithil Bavishi <bavishimithil@gmail.com> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Andreas Kemnade <andreas@kemnade.info> Link: https://patch.msgid.link/20260604054048.18980-1-bavishimithil@gmail.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29ARM: dts: ti: Fix typos in commentsVidhu Sarwal
Fix comment typos found with codespell across DaVinci and OMAP board files: limitaion -> limitation swithes -> switches converstion -> conversion differnet -> different Signed-off-by: Vidhu Sarwal <vidhu.linux@gmail.com> Link: https://patch.msgid.link/20260626111720.56688-1-vidhu.linux@gmail.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29ARM: dts: ti: Add specific compatibles for SCM conf nodesKrzysztof Kozlowski
writing-bindings.rst rules dictate that "syscon" must come with a specific compatible identifying the register layout. Add specific compatibles for these devices. This also allows to solve a different problem: "syscon" is contradictory to "simple-bus". A system controller with registers having their own functions is not really a trivial MMIO simple bus. These two cannot be used together, unless listed as an exception. Reviewed-by: Andreas Kemnade <andreas@kemnade.info> Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Reviewed-by: Conor Dooley <conor.dooley@microchip.com> Link: https://patch.msgid.link/20260608-n-dt-bindings-simple-bus-syscon-v3-3-4eba9ec1212a@oss.qualcomm.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29arm: dts: ti: Add device tree support for PRU-ICSS on AM335xRoger Quadros
The TI Sitara AM335x ICE-V2 consists of single PRU-ICSS instance, This patch adds the new device tree overlay file in-order to enable PRU-ICSS instance, along with makefile changes. PRU-ICSS instance consists of two PRU cores along with various peripherals such as the Interrupt Controller (PRU_INTC), the Industrial Ethernet Peripheral(IEP), the Real Time Media Independent Interface controller (MII_RT), and the Enhanced Capture (eCAP) event module. am33xx-l4.dtsi - Adds IEP and eCAP peripheral as child nodes of the PRUSS subsystem node. am335x-icev2-prueth.dtso - Adds PRU-ICSS instance node along with PRU eth port information and corresponding port configuration. It includes interrupt mapping for packet reception, HW timestamp collection, and PRU Ethernet ports in MII mode, GPIO configuration, boot strapping along with delay configuration for individual PRU Ethernet port and other required nodes. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Andrew F. Davis <afd@ti.com> Signed-off-by: Murali Karicheri <m-karicheri2@ti.com> Signed-off-by: Basharath Hussain Khaja <basharath@couthit.com> Signed-off-by: Parvathi Pudi <parvathi@couthit.com> Reviewed-by: MD Danish Anwar <danishanwar@ti.com> Link: https://patch.msgid.link/20260428072046.3022679-4-parvathi@couthit.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29arm: dts: ti: Add device tree support for PRU-ICSS on AM437xRoger Quadros
The TI Sitara AM437x series of devices consists of 2 PRU-ICSS instances (PRU-ICSS0 and PRU-ICSS1). This patch adds the device tree nodes for the PRU-ICSS1 instance to support DUAL-MAC mode of operation. Support for Ethernet over PRU is available only for ICSS1 instance. PRU-ICSS instance consists of two PRU cores along with various peripherals such as the Interrupt Controller (PRU_INTC), the Industrial Ethernet Peripheral(IEP), the Real Time Media Independent Interface controller (MII_RT), and the Enhanced Capture (eCAP) event module. am4372.dtsi - Adds IEP and eCAP peripheral as child nodes of the PRUSS subsystem node. am437x-idk-evm.dts - Adds PRU-ICSS instance node along with PRU eth port information and corresponding port configuration. It includes interrupt mapping for packet reception, HW timestamp collection, and PRU Ethernet ports in MII mode, GPIO configuration, boot strapping along with delay configuration for individual PRU Ethernet port and other required nodes. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Andrew F. Davis <afd@ti.com> Signed-off-by: Murali Karicheri <m-karicheri2@ti.com> Signed-off-by: Basharath Hussain Khaja <basharath@couthit.com> Signed-off-by: Parvathi Pudi <parvathi@couthit.com> Reviewed-by: MD Danish Anwar <danishanwar@ti.com> Link: https://patch.msgid.link/20260428072046.3022679-3-parvathi@couthit.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29arm: dts: ti: Add device tree support for PRU-ICSS on AM57xxRoger Quadros
The TI Sitara AM57xx series of devices consists of 2 PRU-ICSS instances (PRU-ICSS1 and PRU-ICSS2). This patch adds the device tree nodes for the PRU-ICSS2 instance to support DUAL-MAC mode of operation. Each PRU-ICSS instance consists of two PRU cores along with various peripherals such as the Interrupt Controller (PRU_INTC), the Industrial Ethernet Peripheral(IEP), the Real Time Media Independent Interface controller (MII_RT), and the Enhanced Capture (eCAP) event module. am57-pruss.dtsi - Adds IEP and eCAP peripheral as child nodes of the PRUSS subsystem node. am57xx-idk-common.dtsi - Adds PRU-ICSS2 instance node along with PRU eth port information and corresponding port configuration. It includes interrupt mapping for packet reception, HW timestamp collection, and PRU Ethernet ports in MII mode. am571x-idk.dts, am572x-idk.dts and am574x-idk.dts - GPIO configuration along with delay configuration for individual PRU Ethernet port. Signed-off-by: Roger Quadros <rogerq@ti.com> Signed-off-by: Andrew F. Davis <afd@ti.com> Signed-off-by: Murali Karicheri <m-karicheri2@ti.com> Signed-off-by: Basharath Hussain Khaja <basharath@couthit.com> Signed-off-by: Parvathi Pudi <parvathi@couthit.com> Reviewed-by: MD Danish Anwar <danishanwar@ti.com> Link: https://patch.msgid.link/20260428072046.3022679-2-parvathi@couthit.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29ARM: dts: ti: var-som-om44: Add USB Ethernet controller nodeThomas Richard
Add USB tree description, including the Gigabit Ethernet controller (LAN7500). Adding the LAN7500 node will allow the bootloader to patch the devicetree and set the MAC address. Reviewed-by: Nicolai Buchwitz <nb@tipi-net.de> Signed-off-by: Thomas Richard <thomas.richard@bootlin.com> Link: https://patch.msgid.link/20260506-b4-var-som-om44-lan7500-v2-2-b8af59ab877c@bootlin.com Signed-off-by: Kevin Hilman (TI) <khilman@baylibre.com>
2026-06-29arm64: dts: freescale: Add dual-channel LVDS overlay for TQMa8MPxSAlexander Stein
This adds an overlay for the supported LVDS display AUO G133HAN01. Configure the video PLL frequency to exactly match typical pixel clock of 141.200 MHz. Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>