Pull s390 fixes from Vasily Gorbik:

 - Fix missing array_index_nospec() call in diag310 memory topology code
   to prevent speculative execution with a user controlled array index

 - Fix get_align_mask() return type to match vm_unmapped_area_info
   align_mask, avoiding possible truncation for future larger masks

 - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver
   removal

 - Add build salt to the vDSO so it gets a unique build id, similar to
   the kernel and modules

* tag 's390-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: Add build salt to the vDSO
  s390/zcrypt: Remove the empty file
  s390/mm: Fix type mismatch in get_align_mask().
  s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

Pull RISC-V fixes from Paul Walmsley:
 "The most notable change involves the rseq kselftest common Makefile
  (as it is not RISC-V-specific). The basic approach in the patch
  appears similar to one used in the KVM and S390 selftests (grep for
  LINUX_TOOL_ARCH_INCLUDE and SUBARCH), and the rseq kselftests pass a
  quick build test on x86 after this.

   - Avoid a null pointer deference in machine_kexec_prepare() that the
     IMA subsystem can trigger

   - Bypass libc in part of the ptrace_v_not_enabled kselftest to avoid
     noise from child atfork handlers that libc might run

   - Include Kconfig support for UltraRISC SoCs, already referenced by
     some device drivers; and enable it in our defconfig

   - Fix the build of the rseq kselftest for RISC-V by borrowing a
     technique from the KVM and S390 kselftests that includes
     arch-specific header files from tools/arch/<arch>/include

   - Fix some memory leaks in the RISC-V vector ptrace kselftests

   - Clean up some DT bindings and hwprobe documentation"

* tag 'riscv-for-linus-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
  selftests/riscv: ptrace: Fix memory leak of regset_data in vector tests
  selftests/rseq: Fix a building error for riscv arch
  riscv: defconfig: enable ARCH_ULTRARISC
  riscv: add UltraRISC SoC family Kconfig support
  riscv: hwprobe.rst: Document EXT_ZICFISS and EXT_ZICFILP
  riscv: hwprobe.rst: Make indentation consistent
  dt-bindings: riscv: sort multi-letter Z extensions alphanumerically
  selftests: riscv: Bypass libc in inactive vector ptrace test
  riscv: Prevent NULL pointer dereference in machine_kexec_prepare()

Pull m68knommu fix from Greg Ungerer:
 "Fix incorrectly updated local SoC IO access function names.

  Testing didn't pick them up because there was no specific defconfig
  for these particular SoC parts. New defconfigs will be introduced in
  the next merge cycle to remedy that"

* tag 'm68knommu-fixes-on-top-off-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
  m68k: coldfire: fix breakage of missed IO access updates

Pull perf events fixes from Ingo Molnar:

 - Fix SVM #GP on AMD CPUs that LBR but not BRS (Sandipan Das)

 - Fix UAF bug in the perf AUX code (Lee Jia Jie)

 - Fix address leakage in the AMD LBR code (Sandipan Das)

 - Fix address leakage in the AMD BRS code (Sandipan Das)

* tag 'perf-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/amd/brs: Fix kernel address leakage
  perf/x86/amd/lbr: Fix kernel address leakage
  perf/aux: Fix page UAF in map_range()
  perf/x86/amd/core: Avoid enabling BRS from the SVM reload path

Pull x86 fixes from Ingo Molnar:

 - Fix resctrl resource leak (Tony Luck)

 - Fix resctrl umount race (Tony Luck)

 - Fix resctrl double-free (Reinette Chatre)

 - Fix x86 VGA display fallback logic during bootup on
   certain multi-GPU systems (Mario Limonciello)

 - Re-add a WBINVD call to the SNP bootstrap path to
   fix an SNP regression (Tycho Andersen)

* tag 'x86-urgent-2026-07-11' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/virt/sev: Revert "Drop WBINVD before setting MSR_AMD64_SYSCFG_SNP_EN"
  x86/video: Only fall back to vga_default_device() without screen info
  fs/resctrl: Fix double-add of pseudo-locked region's RMID to free list
  fs/resctrl: Fix use-after-free during unmount
  fs/resctrl: Free mon_data structures on rdt_get_tree() failure

A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_BRS (Zen 3 only), perf can still report entries
such as SYSRET/interrupt returns for which the branch-from addresses
are in the kernel.

E.g.

  $ perf record -j any,u -c 4000 -e branch-brs -o - -- \
        perf bench syscall basic --loop 1000 | \
        perf script -i - -F brstack|tr ' ' '\n'| \
        grep -E '0x[89a-f][0-9a-f]{15}'

  ...
  0xffffffff810001c4/0x72e2e32955eb/-/-/-/0//-
  0xffffffff810001c4/0x72e2d94a9821/-/-/-/0//-
  0xffffffff810001c4/0x72e2d94ffa1b/-/-/-/0//-
  ...

BRS provides no hardware branch filtering, so privilege level
filtering is performed entirely in software. However, amd_brs_match_plm()
only validates the branch-to address against the requested privilege
levels. For branches from the kernel to user space, the branch-from
address is left unchecked and is leaked. Extend the software filter to
also validate the branch-from address, so that any branch record whose
branch-from address is in the kernel is dropped when
PERF_SAMPLE_BRANCH_USER is requested.

Fixes: 8910075d61a3 ("perf/x86/amd: Enable branch sampling priv level filtering")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Link: https://patch.msgid.link/f05931c4f89a146c364bd5dc6b8170b1ac611c65.1783701239.git.sandipan.das@amd.com
Closes: https://lore.kernel.org/all/20260710110235.F3FD81F000E9@smtp.kernel.org/

Pull arm64 fixes from Will Deacon:

 - Fix crash when using SMT hotplug on ACPI systems in conjunction with
   maxcpus=

 - Fix 30% kswapd performance regression introduced by C1-Pro SME
   erratum workaround

 - Fix TLB over-invalidation regression during memory hotplug

 - Fix incorrect encoding of FEAT_BWE2 value in ID_AA64DFR2_EL1.BWE

 - Typo fixes in the arm64 selftests

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  selftests/arm64: fix spelling errors in comments
  arm64/sysreg: Fix BWE field encoding in ID_AA64DFR2_EL1
  arm64/mm: Optimize TLB flush in unmap_hotplug_[pmd|pud]_range()
  arm64: Avoid eager DVMSync reclaim batches with C1-Pro SME erratum
  cpu/hotplug: Fix NULL kobject warning in cpuhp_smt_enable()
  arm64: smp: Fix hot-unplug tearing by forcing unregistration

A user-only branch stack can contain branches that originate from
the kernel. As a result, kernel addresses are exposed to user space
even when PERF_SAMPLE_BRANCH_USER is requested. On AMD processors
supporting X86_FEATURE_AMD_LBR_V2, perf can still report SYSRET/ERET
entries for which the branch-from addresses are in the kernel.

E.g.

  $ perf record -e cycles -o - -j any,save_type,u -- \
        perf bench syscall basic --loop 1000 | \
        perf script -i - -F brstack|tr ' ' '\n'| \
        grep -E '0x[89a-f][0-9a-f]{15}'

  ...
  0xffffffff81001268/0x717a90a38f1a/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a90a39157/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a90a2c628/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a90a41b60/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a90a260db/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a8bef1c30/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  0xffffffff81001268/0x717a8e4d3c90/M/-/-/0/ERET/NON_SPEC_CORRECT_PATH
  ...

The reason is that the hardware filter only considers the privilege
level applicable to the branch target. Extend software filtering to
also validate the branch-from addresses against br_sel, so that any
branch record whose branch-from address is in the kernel is dropped
when PERF_SAMPLE_BRANCH_USER is requested.

Fixes: f4f925dae741 ("perf/x86/amd/lbr: Add LbrExtV2 hardware branch filter support")
Reported-by: Ian Rogers <irogers@google.com>
Signed-off-by: Sandipan Das <sandipan.das@amd.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: stable@vger.kernel.org
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://patch.msgid.link/a898a29725f6b2f30518354cdc2e432db66c43cf.1783680119.git.sandipan.das@amd.com

Enable `ARCH_ULTRARISC` in the default RISC-V defconfig.

Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
Link: https://patch.msgid.link/20260515-ultrarisc-pinctrl-v1-9-bf559589ea8a@ultrarisc.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>

The first SoC in the UltraRISC series is UR-DP1000, containing octa
UltraRISC CP100 cores.

Signed-off-by: Jia Wang <wangjia@ultrarisc.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://patch.msgid.link/20260427-ultrarisc-pcie-v4-1-98935f6cdfb5@ultrarisc.com
Signed-off-by: Paul Walmsley <pjw@kernel.org>