summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-07-21ASoC: aw88399: extract shared device libraryMarco Giunta6-1929/+2008
Extract the device-level functions from aw88399.c into a new shared library module (aw88399-lib.c) with a shared header at include/sound/aw88399.h, following the pattern established by CS35L41 (cs35l41-lib.c / include/sound/cs35l41.h) for chips that need both ASoC and HDA drivers. The shared header at include/sound/aw88399.h contains the register definitions, bit-field masks, hardware constants, device enums, the struct aw88399 definition, and the library function declarations. The ASoC-private header at sound/soc/codecs/aw88399.h is reduced to ASoC-specific definitions (PCM formats/rates, ALSA kcontrol helpers, calibration constants) and includes the shared header. The library contains the chip initialization, firmware loading, playback start/stop sequences, and all their internal dependencies (PLL checks, DSP management, volume control, calibration, CRC verification, etc.). The ASoC codec driver retains the ALSA controls, DAPM widgets, codec probe/remove, calibration service, and I2C bus driver registration. A new Kconfig symbol SND_SOC_AW88399_LIB is introduced. SND_SOC_AW88399 (the existing ASoC codec) selects it, ensuring no change for current users. The HDA side codec driver (introduced later in this series) selects the library without pulling in the full ASoC codec module. This avoids a build-time dependency on the full ASoC driver and follows the established pattern used by CS35L41 (SND_SOC_CS35L41_LIB) for chips with both ASoC and HDA drivers. Some library functions (DSP control, volume setting, mute, calibration updates, profile management, and status helpers) are used internally by the library's start/stop sequences but are also called directly by the ASoC driver's remaining code. These are exported from the library so the ASoC module can access them. This is a pure code movement with no functional changes. The moved functions are identical to their originals in aw88399.c. Tested-by: Nadim Kobeissi <nadim@symbolic.software> Tested-by: Xia Yun'an <imitoy@imitoy.top> Tested-by: Munzir Taha <munzirtaha@gmail.com> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/DS7PR19MB772415C485FAF74297673FD7FCC62@DS7PR19MB7724.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21net: mvneta: bm: fix device reference leak on failed lookupJohan Hovold1-2/+13
Make sure to drop the reference taken to the buffer manager device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a device does not prevent its driver data from going away. Cc: stable+noautosel@kernel.org # untested fix to unlikely error path Cc: Gregory CLEMENT <gregory.clement@bootlin.com> Signed-off-by: Johan Hovold <johan@kernel.org> Reviewed-by: Harshitha Ramamurthy <hramamurthy@google.com> Link: https://patch.msgid.link/20260709082713.829446-1-johan@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21mptcp: only set DATA_FIN when a mapping is presentMichael Bommarito1-6/+6
mptcp_get_options() clears only the status group of struct mptcp_options_received; data_seq, subflow_seq and data_len are filled in by mptcp_parse_option() exclusively inside the DSS mapping block, which runs only when the DSS M (mapping present) bit is set. A peer can send a DSS option with the DATA_FIN flag set but the mapping bit clear. The parser then records mp_opt->data_fin while leaving data_len and data_seq uninitialized. For a zero-length segment mptcp_incoming_options() evaluates if (mp_opt.data_fin && mp_opt.data_len == 1 && mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64)) which reads the uninitialized data_len and data_seq; KMSAN reports an uninit-value in mptcp_incoming_options(). The stale data_seq can also be fed into the receive-side DATA_FIN sequence tracking. Record the DATA_FIN flag only when the DSS option carries a mapping, so data_fin is never set without data_seq and data_len also being present. data_fin is part of the status group that mptcp_get_options() clears up front, so on the no-map path it stays zero and the zero-length DATA_FIN branch is simply skipped. A DATA_FIN is always transmitted together with a mapping (mptcp_write_data_fin() sets use_map along with data_seq and data_len), so legitimate DATA_FIN handling is unaffected. Move the pr_debug() that logs the parsed DSS flags below the mapping block, so it reports the final data_fin value instead of the stale one it would otherwise print before the assignment. Fixes: 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine") Suggested-by: Paolo Abeni <pabeni@redhat.com> Cc: stable@vger.kernel.org Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20260709191925.2811195-1-michael.bommarito@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21ASoC: qcom: preparation for Card capsulingMark Brown3-12/+10
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I will post Card capsuling patch. To makes its review easy, tidyup meson drivers to reduce un-related diff as preparation. No functional change, but is preparation for cleanup driver. Link: https://patch.msgid.link/87qzkxi0j5.wl-kuninori.morimoto.gx@renesas.com
2026-07-21ASoC: qcom: storm: use dev instead of card on storm_parse_of()Kuninori Morimoto1-6/+6
storm_parse_of() can be processed without using *card. No functional change, but is preparation for Card capsuling. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/87mrvli0hx.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: qcom: sdm845: remove unused cardKuninori Morimoto1-2/+0
It is not used. Let's remove. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/87o6g1i0i6.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: qcom: common: use devKuninori Morimoto1-4/+4
qcom_snd_parse_of() already have dev. Let's use it. No functional change, but is preparation for Card capsuling. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/87pl0hi0il.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: amd: preparation for Card capsulingMark Brown2-12/+12
Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> says: I will post Card capsuling patch. To makes its review easy, tidyup its drivers to reduce un-related diff as preparation. No functional change, but is preparation for cleanup driver. Link: https://patch.msgid.link/87bjc1i05a.wl-kuninori.morimoto.gx@renesas.com
2026-07-21ASoC: amd: acp-sdw-sof-mach: use &pdev->dev instead of card->devKuninori Morimoto1-5/+5
acp-sdw-sof-mach.c will be updated when Card capsuling. To makes its review easy, use &pdev->dev instead of card->dev in mc_probe(). There is no diff, because static int mc_probe(...) { ... card->dev = &pdev->dev; ... } No functional change, but is preparation for cleanup driver. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Link: https://patch.msgid.link/878q75i04q.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: amd: acp-sdw-legacy-mach: use &pdev->dev instead of card->devKuninori Morimoto1-7/+7
acp-sdw-legacy-mach.c will be updated when Card capsuling. To makes its review easy, use &pdev->dev instead of card->dev in mc_probe(). There is no diff, because static int mc_probe(...) { ... card->dev = &pdev->dev; ... } No functional change, but is preparation for cleanup driver. Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com> Reviewed-by: Vijendar Mukunda <Vijendar.Mukunda@amd.com> Link: https://patch.msgid.link/87a4rli04u.wl-kuninori.morimoto.gx@renesas.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21selftests/net/openvswitch: add ICMPv6 echo type match testMinxi Hou2-7/+100
Register OVS_KEY_ATTR_ICMPV6 in the flow key parser so that icmpv6(type=...) can be used in flow specifications. Without this registration the parser silently drops the token and the kernel rejects the flow with EINVAL because the expected ICMPv6 key attribute is missing. While here, add convert_int() to the ovs_key_ipv6 and ovs_key_icmp fields_map entries so that specifying a field value produces the correct wildcard mask. The IPv6 flow label uses convert_int(20) to produce a 20-bit mask (0x000FFFFF), matching the kernel constraint in flow_netlink.c that rejects masks with bits 20-31 set; byte-wide fields use convert_int(8). The ipv4 counterpart already does this via convert_int(); the ipv6 and icmp classes were simply missing the fifth tuple element. Existing callers that pass empty parentheses are unaffected because convert_int("") returns (0, 0). Add test_icmpv6 exercising the ICMPv6 echo flow key. The test uses static neighbour entries with nud permanent to prevent racy NDP, then verifies in three steps: install icmpv6(type=128) and icmpv6(type=129) flows and confirm ping works, remove the flows and confirm ping fails, reinstall and confirm recovery. Signed-off-by: Minxi Hou <houminxi@gmail.com> Reviewed-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260709120541.3556748-1-houminxi@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21regulator: dt-bindings: tps51632: Convert to DT schemaBhargav Joshi2-27/+55
Convert Texas Instruments TPS51632 Voltage regulators from legacy text to DT schema. No functional changes are introduced. Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260717-ti-regulator-tp-v1-1-a49d41dc56d3@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: dt-bindings: ti,omap4-dmic: Convert to DT schemaBhargav Joshi2-20/+58
Convert the TI OMAP4+ dmic bindings from txt to DT schema. Following changes are introduced during converson: - Drop ti,hwmods property as it is not needed since the sysc conversion no existing DTS uses it. - Add dma, dma-names, reg-names properties to match the DTS. - Update example node to match existing DTS. Signed-off-by: Bhargav Joshi <j.bhargav.u@gmail.com> Reviewed-by: Rob Herring (Arm) <robh@kernel.org> Link: https://patch.msgid.link/20260713-ti-omap4-dmic-v1-1-3cc6e13decec@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2Marc Zyngier6-15/+10
kvm_vgic_global_state.ich_vtr_el2 is the last bit of caching that we can get rid of. Not as bad as a sysreg access, but still worse than a constant. Move over to the inlined stuff and remove the cached value. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-7-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21KVM: arm64: vgic-v3: Simplify initial GICv3 configuration samplingMarc Zyngier4-28/+8
Now that we have our magic inline helper for ICH_VTR_EL2, we can get rid of the hack that was reporting a combination of that register and of the indication of the CPU interface supporting GICv2 compatibility. We now only report the latter. As a small benefit, GICv5 is not involved in this stuff anymore, since it never has GICv2 compatibility.. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-6-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21KVM: arm64: Convert most ICH_VTR_EL2 accesses to inlined literal valueMarc Zyngier1-9/+9
Now that we have a new helper that inlines the value of ICH_VTR_EL2 into the code, use this to replace most of the sysreg accesses to that register. This avoids a lot of traps when running KVM under NV. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-5-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21KVM: arm64: Add a helper providing an inlined literal value for ICH_VTR_EL2Marc Zyngier3-0/+73
We already have two ways to deal with ICH_VTR_EL2: - directly read the system register - read a cached copy in the vgic global state Add a third way, in the form of an inlined literal value that will eventually replace all of the above. This literal value is computed at boot time, and patched in the relevant code locations. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-4-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21KVM: arm64: Move GICv3 broken SEIS implementation detection to a CPU errrataMarc Zyngier3-25/+19
Using is_midr_in_range_list() in a noinstr function isn't a good idea. And yet kvm_compute_ich_hcr_trap_bits() is doing that by calling vgic_v3_broken_seis(). Move all the broken SEIS detection logic to the errata detection framework, and use a new ARM64_WORKAROUND_GICv3_BROKEN_SEIS cap to indicate that we're running on broken CPUs. This reuses the MIDR list used for IMPDEF PMU detection, which has a 100% overlap with the SEIS stuff... Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-3-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21KVM: arm64: vgic-v3: Make vtr_to_* helpers use architectural field symbolsMarc Zyngier1-3/+3
vgic-v3-sr.c still contains some hardcoded constants for some of the ICH)VTR_EL2 fields. Bring them into the modern world by using the named symbols from the sysreg file. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-2-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21Merge branch 'selftests-bpf-a-few-edge-case-fixes'Kumar Kartikeya Dwivedi3-5/+8
Ricardo B. Marlière says: ==================== selftests/bpf: A few edge case fixes Hi, Please consider merging the following fixes, found by means of targeting BPF selftests through openQA [1]. [1]: e.g. https://openqa.opensuse.org/tests/6087703 1/4 ("libbpf: Search /lib64 and /lib in resolve_full_path()") - Hit by testing an older SLES root filesystem. 2/4 ("selftests/bpf: Fix lsm_bdev dev_t encoding mismatch") - https://openqa.opensuse.org/tests/6087703/logfile?filename=test_progs.tap.txt#line-2706 3/4 ("selftests/bpf: Install resolve_btfids.test.o.BTF where the test expects it") - https://openqa.opensuse.org/tests/6087703/logfile?filename=test_progs.tap.txt#line-3332 4/4 ("selftests/bpf: Install bpftool where test_progs expects to find it") - https://openqa.opensuse.org/tests/6087703/logfile?filename=test_progs.tap.txt#line-806 - https://openqa.opensuse.org/tests/6087703#step/test_bpftool_build_sh/1 - https://openqa.opensuse.org/tests/6087703#step/test_doc_build_sh/1 The build process is done at runtime with BPF_STRICT_BUILD=0: https://openqa.opensuse.org/tests/6087703/logfile?filename=serial_terminal.txt#line-1937 Assisted-by: Claude Sonnet 5 Signed-off-by: Ricardo B. Marlière <rbm@suse.com> --- Changes in v2: - Squashed first 2 commits - Removed redundant copy of bpftool due to TEST_GEN_PROGS_EXTENDED - Installed *.BTF instead of only resolve_btfids.test.o.BTF - Link to v1: https://patch.msgid.link/20260710-selftests-bpf_fixes-v1-0-aa24dfd6f4f9@suse.com To: Andrii Nakryiko <andrii@kernel.org> To: Eduard Zingerman <eddyz87@gmail.com> To: Alexei Starovoitov <ast@kernel.org> To: Daniel Borkmann <daniel@iogearbox.net> To: Kumar Kartikeya Dwivedi <memxor@gmail.com> To: Martin KaFai Lau <martin.lau@linux.dev> To: Song Liu <song@kernel.org> To: Yonghong Song <yonghong.song@linux.dev> To: Jiri Olsa <jolsa@kernel.org> To: Emil Tsalapatis <emil@etsalapatis.com> To: Shuah Khan <shuah@kernel.org> To: "Alexis Lothoré (eBPF Foundation)" <alexis.lothore@bootlin.com> To: Ihor Solodrai <ihor.solodrai@linux.dev> To: Christian Brauner <brauner@kernel.org> Cc: bpf@vger.kernel.org Cc: linux-kselftest@vger.kernel.org Cc: linux-kernel@vger.kernel.org --- Ricardo B. Marlière (3): selftests/bpf: Fix make install target selftests/bpf: Fix lsm_bdev dev_t encoding mismatch libbpf: Search /lib64 and /lib in resolve_full_path() tools/lib/bpf/libbpf.c | 3 ++- tools/testing/selftests/bpf/Makefile | 7 ++++--- tools/testing/selftests/bpf/prog_tests/lsm_bdev.c | 3 ++- 3 files changed, 8 insertions(+), 5 deletions(-) --- base-commit: 1590cf0329716306e948a8fc29f1d3ee87d3989f change-id: 20260710-selftests-bpf_fixes-06e9a2eb3c67 Best regards, -- Ricardo B. Marlière <rbm@suse.com> ==================== Link: https://patch.msgid.link/20260720-selftests-bpf_fixes-v2-0-b450eda93dfe@suse.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21drm/i915/bw: Fix spelling mistake "threshod" -> "threshold"Colin Ian King1-1/+1
There is a spelling mistake in a drm_dbg_kms message. Fix it. Signed-off-by: Colin Ian King <colin.i.king@gmail.com> Link: https://patch.msgid.link/20260720161630.326016-1-colin.i.king@gmail.com Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
2026-07-21libbpf: Search /lib64 and /lib in resolve_full_path()Ricardo B. Marlière1-1/+2
attach_probe/uprobe-lib and uprobe_autoattach selftests fail with "failed to resolve full path for libc.so.6" on older non-usrmerged distros, where libc.so.6 lives under a top-level /lib64 or /lib rather than /usr/lib64 or /usr/lib. Add /lib64:/lib to the search paths, alongside the existing /usr/lib64:/usr/lib and Debian multiarch entries. Fixes: 1ce3a60e3c28 ("libbpf: auto-resolve programs/libraries when necessary for uprobes") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260720-selftests-bpf_fixes-v2-3-b450eda93dfe@suse.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21selftests/bpf: Fix lsm_bdev dev_t encoding mismatchRicardo B. Marlière1-1/+2
progs/lsm_bdev.c keys its verity_devices hashmap with the raw kernel dev_t read straight off bdev->bd_dev, i.e. MKDEV(major, minor) = (major << 20) | minor. prog_tests/lsm_bdev.c instead builds its lookup key with dev_key = (__u32)st.st_rdev from stat(2), but the stat(2) syscall fills st_rdev via the kernel's new_encode_dev(), a different bit layout: (minor & 0xff) | (major << 8) | ((minor & ~0xff) << 12). For any device with a non-trivial major these two values differ, so the lookup can never find what the BPF program stored, and test_lsm_bdev() always fails with: test_lsm_bdev:FAIL:map lookup unexpected error: -2 (errno 2) Reconstruct the raw kernel dev_t from the decoded major/minor instead of casting st_rdev directly, restoring the layout the BPF program actually reads. Fixes: 96f4c251a087 ("selftests/bpf: add block device management selftests") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260720-selftests-bpf_fixes-v2-2-b450eda93dfe@suse.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21selftests/bpf: Fix make install targetRicardo B. Marlière1-3/+4
After "make install", test_progs fails because two files end up in the wrong place: - bpftool: TEST_GEN_PROGS_EXTENDED flattens it into $(INSTALL_PATH), losing the tools/sbin/ prefix that detect_bpftool_path() expects. Remove it from TEST_GEN_PROGS_EXTENDED and install it explicitly under tools/sbin/ instead. - *.BTF: resolve_btfids writes resolve_btfids.test.o.BTF as a side-effect of the build but INSTALL_RULE never copies it over. Install all *.BTF files alongside the rest of the per-flavor output. Fixes: f21fae577446 ("selftests/bpf: Add a few helpers for bpftool testing") Fixes: 522397d05e7d ("resolve_btfids: Change in-place update with raw binary output") Signed-off-by: Ricardo B. Marlière <rbm@suse.com> Acked-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://lore.kernel.org/bpf/20260720-selftests-bpf_fixes-v2-1-b450eda93dfe@suse.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21geneve: ensure the skb is writable before fixing its headersAntoine Tenart1-2/+11
Make sure the IPv4/6 and UDP headers are writable before fixing them up in geneve_post_decap_hint. As skb_ensure_writable can reallocate the skb linear area, reload the GRO hint header pointer and only set the IPv4/6 header ones after the call. Fixes: fd0dd796576e ("geneve: use GRO hint option in the RX path") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260529144713.780938-1-atenart%40kernel.org Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260709125000.141092-1-atenart@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21wifi: mac80211: ibss: read deauth reason_code after frame length checkShahar Tzarfati1-1/+3
The function was reading reason_code from the frame before validating that the frame is at least IEEE80211_DEAUTH_FRAME_LEN bytes long. Move the reason_code read to after the length check so the field is guaranteed to be present before it is accessed. Signed-off-by: Shahar Tzarfati <shahar.tzarfati@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715212706.db26604650bd.I2caa73c396b8c9d357224b9334d5df3cafac498e@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: cfg80211: clarify and tighten key checksJohannes Berg4-38/+86
Currently, we accept per-STA GTK for any interface type if the IBSS_RSN flag is set, which doesn't make sense, and also accept various key indices that aren't really (meant to be) supported, such as IGTK/BIGTK on IBSS or AP_VLAN etc. For MESH and NAN_DATA interface types, per-STA GTKs are required, so their support shouldn't depend on IBSS_RSN. Conversely a driver setting IBSS_RSN doesn't really say it also accepts per-STA GTK for other interface types. Move more checks into cfg80211_valid_key_idx() and make them more precise: - allow IGTK and, if supported, BIGTK for NAN - allow per-STA (RX) GTK only for - NAN_DATA - IBSS if IBSS_RSN is supported - MESH - allow B/I/GTK for station/P2P-client without mac_addr for RX with the current AP (historic API quirk), subject to support - allow TX GTK for AP/P2P-GO/AP_VLAN - allow TX IGTK/BIGTK for AP/P2P-GO subject to support Other settings are rejected, clearing up corner cases and disallowing unexpected settings. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715212403.725e6b63e890.I24684374112bb94d0633d61ef76ecb8a1517f7f1@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: cfg80211: improve multi-BSSID profile continuation parserJohannes Berg1-26/+23
The previous change from John Walker fixed the loop iteration, but the code is written in a bad way. Pass the pointers needed for the iteration to the function instead. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715211048.04877081fd0a.I48f0135ba83dcc5f0b736b61f8f9e86ecc72583f@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: use UHR operation field presence bitsJohannes Berg4-28/+25
The spec originally had the idea that the fact that it's a beacon frame determines the (non-)presence of the values, but added presence bits in D1.4. Use those presence bits in addition to the enable bits. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715210407.3b1a79b0d002.Iaa762c55b4b6dc63d55f2d7b8b42acd47e640d50@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211: always send regulatory connectivity elementJohannes Berg3-12/+29
The spec says to include it if the STA is "capable of operating as STA 6G", which is a bit unclear because this is defined at a STA level and not at the MLD level or so, but WFA requires this to be included. Either way, the element is completely advisory and intended mostly for debugging (and perhaps a bit steering), so just include it in association request all the time if 6 GHz is supported. To determine what exactly to include, check all the channels that aren't disabled. That way, it ends up being a lowest common denominator, which is most useful for steering etc. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715210322.02a4f3fced21.I94bbd08ac38001e11d5143a8b3f54dcea8ae8e15@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211: don't encrypt pre-auth (ETH_P_PREAUTH) framesDeepanshu Kartikey1-0/+3
Pre-authentication frames (ETH_P_PREAUTH, 0x88C7) are sent before the authentication handshake completes with the target AP, so no encryption key exists for them yet. Unlike normal EAPOL frames (ETH_P_8021X, 0x888E) which are registered as the control port protocol, pre-auth frames are not recognized as control port frames, causing the kernel to incorrectly assign the current AP's key and attempt encryption, resulting in a WARN_ON in ieee80211_encrypt_tx_skb when the cipher is not handled. Fix this by setting IEEE80211_TX_INTFL_DONT_ENCRYPT for pre-auth frames in ieee80211_tx_h_check_control_port_protocol(), so that key selection skips them and they are sent unencrypted as intended. Note that the only driver hitting this path is hwsim. Reported-by: syzbot+b6ce23950fd636e6efb6@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b6ce23950fd636e6efb6 Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com> Link: https://patch.msgid.link/20260713015946.44636-1-kartikey406@gmail.com [add note about hwsim, fix subject] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21Merge tag 'mm81x-driver-08-07-2026' of https://github.com/MorseMicro/linuxJohannes Berg36-0/+13902
Lachlan Hodges says: ==================== Introduce mm81x driver for mm81x based chipsets plus associated SDIO ids. ==================== [list the full vendor directory in MAINTAINERS] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21geneve: fix hint header definition wrt endiannessAntoine Tenart1-1/+10
Bitfields are packed differently depending on the endianness, take it into account in the GRO hint header definition. Fixes: e0a12cbf262b ("geneve: add GRO hint output path") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260529144713.780938-1-atenart%40kernel.org Signed-off-by: Antoine Tenart <atenart@kernel.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260709124801.140632-1-atenart@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21arm64: dts: broadcom: bcm2712: Remove non-functional EL2 virtual timerDaniel Drake1-2/+0
Commit d87773de9efe1 ("clocksource/drivers/arm_arch_timer: Default to EL2 virtual timer when running VHE") causes boot to hang on Raspberry Pi 5. The newly-selected EL2 virtual timer does not generate any interrupts, even though the GIC_DIST_ENABLE_SET flag has been confirmed set via readback. It is highly unusual that this timer interrupt is non-operational because this is a standard GIC interrupt corresponding to a standard Cortex-A76 CPU timer. However, Broadcom have confirmed for this SoC: > the interrupt line was never connected in the first place as this was > not identified as being a requirement Remove the corresponding DeviceTree entry. Reported-by: Marek Szyprowski <m.szyprowski@samsung.com> Closes: https://lore.kernel.org/all/ea15cce1-b393-43f6-8d58-3d6f90f0c0cd@samsung.com/ Fixes: faa3381267d0 ("arm64: dts: broadcom: Add minimal support for Raspberry Pi 5") Signed-off-by: Daniel Drake <dan@reactivated.net> Link: https://lore.kernel.org/r/20260716-bcm2712-el2-v2-1-e708f7fb42fa@reactivated.net Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2026-07-21bpf: Zero queue and stack outputs on lock failureKumar Kartikeya Dwivedi1-2/+6
Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it. Clear the output before returning -EBUSY so BPF programs cannot observe uninitialized stack contents after a failed helper call. Fixes: a34a9f1a19af ("bpf: Avoid deadlock when using queue and stack maps from NMI") Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com> Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com> Link: https://lore.kernel.org/bpf/20260719125419.1782196-1-memxor@gmail.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21wifi: brcmfmac: set F2 blocksize to 256 for BCM43752LiangCheng Wang1-0/+1
The BCM43752 is not reliable with the default 512-byte SDIO function 2 block size: on an i.MX8MP board with an AMPAK AP6275S module at SDR104 / 200 MHz, an iperf TX stress test kills WLAN within seconds: mmc_submit_one: CMD53 sg block write failed -84 brcmf_sdio_dpc: failed backplane access over SDIO, halting operation Commit d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization") set up the 43752 like the 4373 for the F2 watermark but missed the F2 block size, which the 4373 limits to 256 bytes. The vendor driver (bcmdhd) also programs a 256-byte F2 block size for this chip and runs the same hardware without errors. Group the 43752 with the 4373, matching the F2 watermark handling. With this change a 10-minute bidirectional iperf3 soak completes with zero SDIO errors at ~270 Mbit/s in each direction. Backporting note: kernels before v6.18 name this id SDIO_DEVICE_ID_BROADCOM_CYPRESS_43752, so on those trees the case label added by this patch must be adjusted to that name. Cherry-picking the rename commit 74e2ef72bd4b ("wifi: brcmfmac: fix 43752 SDIO FWVID incorrectly labelled as Cypress (CYW)") first is not a clean alternative: on trees before v6.17 its context collides with the 43751 additions, and trees before v6.2 lack the FWVID framework it touches. Fixes: d2587c57ffd8 ("brcmfmac: add 43752 SDIO ids and initialization") Cc: stable@vger.kernel.org # see patch description, needs adjustments for <= 6.17 Signed-off-by: LiangCheng Wang <zaq14760@gmail.com> Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260715-b43752-f2-blksz-v2-1-f9be49856050@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21platform/x86: acer-wmi: reject missing gaming WMI resultsYousef Alhouseen1-1/+3
WMI_gaming_execute_u32_u64() returns success when firmware supplies no output object, leaving the caller output untouched. Gaming getters then inspect an uninitialized result value. When the caller requests an output value, return -ENOMSG if firmware supplies no object. Preserve a NULL output pointer as the supported way for callers to ignore the result. Fixes: 2d76708c2221 ("platform/x86: acer-wmi: use WMI calls for platform profile handling") Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Link: https://patch.msgid.link/20260701164208.8998-1-alhouseenyousef@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-21platform/x86/intel/pmc: initialize empty PMT read resultYousef Alhouseen1-1/+1
pmc_core_pmt_get_lpm_req() returns the last telemetry read status. When firmware exposes no enabled low-power modes, the loop does not run and the function returns an uninitialized stack value. Initialize the status to success so an empty mode set is handled deterministically. Signed-off-by: Yousef Alhouseen <alhouseenyousef@gmail.com> Reviewed-by: David E. Box <david.e.box@linux.intel.com> Link: https://patch.msgid.link/20260630105101.54016-1-alhouseenyousef@gmail.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-21platform/x86: uniwill-laptop: Add Avell A60 MUV supportWerner Sembach1-0/+7
Add support for the Avell A60 MUV based on information from tuxedo-drivers, formerly known as tuxedo-keyboard: https://github.com/tuxedocomputers/tuxedo-keyboard/pull/91 Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20260708211950.568799-2-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-21platform/x86: uniwill-laptop: Add 2 new feature defines for TUXEDO devicesWerner Sembach1-22/+37
Add 2 of the new feature defines, UNIWILL_FEATURE_AC_AUTO_BOOT and UNIWILL_FEATURE_USB_POWERSHARE, to TUXEDO devices where applicable. Signed-off-by: Werner Sembach <wse@tuxedocomputers.com> Link: https://patch.msgid.link/20260708211950.568799-1-wse@tuxedocomputers.com Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
2026-07-21wifi: mac80211_hwsim: clear PMSR request state on abortZhao Li1-3/+7
mac80211_hwsim saves the in-flight cfg80211 PMSR request and its wdev in data->pmsr_request / data->pmsr_request_wdev when a measurement starts, and clears them only when it reports completion. mac80211_hwsim_abort_pmsr() never cleared that saved state. cfg80211 owns the request and frees it once the abort callback returns (cfg80211_pmsr_process_abort() calls rdev_abort_pmsr() then kfree(req)), so after an abort data->pmsr_request dangles. A later hwsim PMSR report then dereferences the freed request in hwsim_pmsr_report_nl() and completes it; a use-after-free. Clear data->pmsr_request and data->pmsr_request_wdev once the abort matches the active request. Move the wmediumd/virtio notification check below the clear so the saved state is dropped even when no notification is sent. Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260708195911.84365-2-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211_hwsim: authenticate PMSR report sendersZhao Li1-0/+9
hwsim_pmsr_report_nl() looks up the radio by HWSIM_ATTR_ADDR_TRANSMITTER and, when data->pmsr_request is set, parses the reported peer results, hands them to cfg80211_pmsr_report(), then unconditionally clears data->pmsr_request and calls cfg80211_pmsr_complete() to end the measurement. Unlike the sibling wmediumd data-path handlers hwsim_tx_info_frame_received_nl() and hwsim_cloned_frame_received_nl(), which check the sending socket's netgroup against data->netgroup and its portid against data->wmediumd, this handler did not check the sender at all, and its genl op carries no GENL_UNS_ADMIN_PERM flag. In non-virtio (wmediumd) mode any process in the netns that can reach the hwsim generic netlink family could therefore send a report. The transmitter address is not secret, so such a process could inject spoofed ranging results for another radio's in-flight request and, because the handler always completes the measurement, terminate a ranging operation owned by the real wmediumd session. Reject reports whose sender does not match the registered wmediumd instance, mirroring the sibling handlers: in non-virtio mode require the sending socket's netgroup to equal data->netgroup and info->snd_portid to equal data->wmediumd before touching the request state. Assisted-by: Codex:gpt-5 Assisted-by: Claude:opus-4.8 Signed-off-by: Zhao Li <enderaoelyther@gmail.com> Link: https://patch.msgid.link/20260708195911.84365-3-enderaoelyther@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21bpf, arm64: Optimize cast_user code generationPuranjay Mohan1-6/+19
cast_user converts an arena offset into a user address by combining the low 32 bits of the pointer with the upper 32 bits of user_vm_start, while keeping a NULL pointer NULL. The current sequence always emits six instructions: it materializes user_vm_start >> 32 into a register, shifts it into place, and ORs in the offset. The upper half of user_vm_start is a constant, so it can be written directly onto the offset with MOVK. Move the 32-bit offset into dst (which also zeroes the upper 32 bits), then MOVK the non-zero halfwords of the upper address, branching over the MOVKs when the offset is zero so NULL is preserved. This emits at most four instructions, and only one when the upper half of user_vm_start is zero. The generated code is equivalent. Before: ; bpf_addr_space_cast(page1, 1, 0); 7c: mov w10, w8 80: mov w8, #1 84: lsl x8, x8, #32 88: cbz x10, 0xffff800087b80c20 8c: orr x10, x8, x10 90: mov x8, x10 After: ; bpf_addr_space_cast(page1, 1, 0); 7c: mov w8, w8 80: cbz w8, 0xffff800087b80c28 84: movk x8, #1, lsl #32 Signed-off-by: Puranjay Mohan <puranjay@kernel.org> Acked-by: Xu Kuohai <xukuohai@huawei.com> Link: https://lore.kernel.org/bpf/20260721105921.1070501-1-puranjay@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21PCI: vmd: Handle BUS_RESTRICT_CFG value 3 for Arrow Lake-HXAli Alaei1-0/+3
On Intel Arrow Lake-HX systems (e.g. Core Ultra 9 275HX on Acer Predator PH16-73), the VMD controller reports BUS_RESTRICT_CFG = 3 in the VMCONFIG register. The existing switch statement only handled values 0, 1, and 2, causing vmd_get_bus_number_start() to return -ENODEV and aborting the entire VMD probe. This leaves NVMe drives behind the VMD controller invisible to the kernel. Hardware registers (VMCAP/VMCONFIG at offsets 0x40/0x44): VMD 0000:00:0e.0 (8086:ad0b): VMCAP=0x000f, VMCONFIG=0x03b8 BUS_RESTRICT_CFG(0x03b8) = (0x03b8 >> 8) & 0x3 = 3 Add cfg=3 as a fallthrough to cfg=2, setting busn_start=224, which is the correct bus number base for this hardware. Also add a PCI_POSSIBLE_ERROR() guard after reading VMCONFIG: a failed config space read returns 0xFFFF, and BUS_RESTRICT_CFG(0xFFFF) = 3, so without this guard a removed or errored device would falsely match the new case 3 instead of being caught as an error. Reported-by: Lin Mohan <linmhwork@outlook.com> Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221137 # Arrow-Lake-S Closes: https://bugzilla.kernel.org/show_bug.cgi?id=221136 # Arrow-Lake-S Signed-off-by: Ali Alaei <ali.alaei.tabatabaei@gmail.com> Signed-off-by: Manivannan Sadhasivam <mani@kernel.org> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/20260628143450.92492-1-ali.alaei.tabatabaei@gmail.com
2026-07-21PCI: Add ACS quirk for Pericom PI7C9X2G608 switches [12d8:2608]Tim Harvey1-0/+4
The Pericom PI7C9X2G608 6-port Gen2 PCIe switch is also affected by the PI7C9X2G errata per the errata document: E2: ACS P2P Request Redirect Is Not Functional Apply the same quirk to this PCI ID as well to apply the workaround required if using ACS. Fixes: acd61ffb2f16 ("PCI: Add ACS quirk for Pericom PI7C9X2G switches") Signed-off-by: Tim Harvey <tharvey@gateworks.com> Signed-off-by: Bjorn Helgaas <bhelgaas@google.com> Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260720215718.2139510-1-tharvey@gateworks.com
2026-07-21rndis_host: add overflow check in rndis_rx_fixup()Griffin Kroah-Hartman1-1/+5
Add an overflow check to ensure that data_offset + data_len + 8 does not wrap, which would enable an OOB read of the USB data buffer. Cc: Andrew Lunn <andrew+netdev@lunn.ch> Cc: Shaoxu Liu <shaoxul@foxmail.com> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/2026070900-denim-brook-52d4@gregkh Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21Merge branch 'net-fix-two-issues-in-sk_clone-error-path'Jakub Kicinski1-5/+5
Kuniyuki Iwashima says: ==================== net: Fix two issues in sk_clone() error path. Sashiko reported issues in the sk_clone() error path. https://lore.kernel.org/bpf/20260709032007.9E4D61F000E9@smtp.kernel.org/ This series fixes them. ==================== Link: https://patch.msgid.link/20260709183315.965751-1-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21net: Call net_enable_timestamp() before failure in sk_clone().Kuniyuki Iwashima1-3/+3
When sk_clone() fails, sk_destruct() is called for the new socket. If the parent socket has SK_FLAGS_TIMESTAMP in sk->sk_flags, net_disable_timestamp() is called for the child socket even though net_enable_timestamp() is not called for it. Let's call net_enable_timestamp() before any failure path in sk_clone(). Fixes: 704da560c0a0 ("tcp: update the netstamp_needed counter when cloning sockets") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260709183315.965751-3-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21soreuseport: Clear sk_reuseport_cb before failure in sk_clone().Kuniyuki Iwashima1-2/+2
When sk_clone() fails, sk_destruct() is called for the new socket. If the parent socket has sk->sk_reuseport_cb, the child will call reuseport_detach_sock() for the reuseport group. Let's clear sk->sk_reuseport_cb before any failure path in sk_clone(). Note that this was not a problem before the cited commit because reuseport_detach_sock() did nothing if the socket was not found in the reuseport array. Fixes: 5dc4c4b7d4e8 ("bpf: Introduce BPF_MAP_TYPE_REUSEPORT_SOCKARRAY") Reported-by: Sashiko <sashiko-bot@kernel.org> Closes: https://lore.kernel.org/all/20260709032007.9E4D61F000E9@smtp.kernel.org/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260709183315.965751-2-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-21amd-xgbe: fix MAC_AUTO_SW handling in CL37 ANPrashanth Kumar KR1-3/+8
MAC_AUTO_SW (VR_MII_DIG_CTRL1 bit 9) enables automatic XPCS speed mode switching after CL37 auto-negotiation and is only meaningful in SGMII MAC mode. The original code unconditionally set this bit on every call to xgbe_an37_set(), including when called from xgbe_an37_disable() with enable=false. This left MAC_AUTO_SW=1 after AN was disabled, causing the XPCS to autonomously switch speed from stale AN state during subsequent mode changes, breaking SGMII speed negotiation on 1G copper SFP modules. Patrick: This was breaking negotiation for all 1G SFP modules, not just copper modules. Fixes: 42fd432fe6d3 ("amd-xgbe: align CL37 AN sequence as per databook") Reported-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Link: https://lore.kernel.org/netdev/CAEg67GmFS0Q4oSZkz8zWdOzckSth9_vBPiOy6a7-d697C2w2Xg@mail.gmail.com Signed-off-by: Prashanth Kumar KR <PrashanthKumar.K.R@amd.com> Tested-by: Patrick Oppenlander <patrick.oppenlander@gmail.com> Link: https://patch.msgid.link/20260709095006.3683940-1-prashanthkumar.k.r@amd.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
generated by cgit (git 2.54.0.dirty) at 2026-09-30 23:21:36 +0000