summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-08-06drm/ssd130x: Add per-family update backlight logicAmit Barzilai1-3/+21
ssd130x_update_bl() runs for every SSD13xx panel, but it only works for SSD130x and SSD132x: it writes the single global SSD13XX_CONTRAST (0x81) command, which those two families expose. SSD133x has no such command -- it has three per-channel contrast registers (CONTRAST_A/B/C) that must be scaled together -- so ssd130x_update_bl() has no effect on it. Make backlight_ops.update_status a per-family choice. SSD130x and SSD132x keep ssd130x_update_bl() because they share the SSD13XX_CONTRAST interface, while SSD133x gets ssd133x_update_bl(), which drives the three channels through ssd133x_set_contrast(). Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-3-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06drm/ssd130x: Scale ssd133x per-channel contrast by brightness on initAmit Barzilai1-3/+38
ssd133x_init() wrote the SSD133X_CONTRAST_A/B/C commands with magic hex values (0x91/0x50/0x7d). These are a per-channel white-balance calibration: the A/B/C channels drive sub-pixels whose OLED materials differ in luminous efficiency, so the values set the white point at full brightness. Extract them into ssd133x_set_contrast(), which scales each channel by a requested brightness via ssd130x_scale_contrast(), instead of writing the calibration unconditionally. This makes the sequence readable, avoids repetition, and is a prerequisite for wiring up an ssd133x backlight controller that dims while preserving the white point. Note this changes the ssd133x power-on brightness. Previously the init wrote the calibration unscaled and ignored ssd130x->contrast, so the panel always booted at full brightness. It now scales by the shared default contrast of 127, i.e. half of MAX_CONTRAST (255). This is intentional and matches ssd130x, whose contrast register also defaults to 127 (mid-scale), so all families now power on at ~50% and report props.brightness = 127 / max_brightness = 255 to userspace. Assisted-by: Claude:claude-fable-5 Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-2-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06net: phy: mediatek: fix TX blink masks using the RX bitsAhmed Naseef1-4/+4
MTK_GPHY_LED_TX_BLINK_SET and MTK_2P5GPHY_LED_TX_BLINK_SET are built from the RX blink bits instead of the TX ones, so both TX masks are identical to their RX counterparts. The TX bits they should be using, MTK_PHY_LED_BLINK_{10,100,1000,2500}TX, are otherwise only referenced by the per-speed branch of mtk_phy_led_hw_ctrl_set(). A TX trigger selected without a link trigger therefore programs the RX blink bits, and the LED blinks on received traffic. The masks are also used to decode the blink register in mtk_phy_led_hw_ctrl_get(), which as a result cannot tell the two triggers apart: an RX-only configuration reads back as RX and TX, and a TX-only configuration reads back as neither. Fixes: 7f9c320c98db ("net: phy: mediatek: Move LED helper functions into mtk phy lib") Cc: stable@vger.kernel.org Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260804113511.3371248-1-naseefkm@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06block: rename bi_bvec_donePavel Begunkov16-36/+36
struct bvec_iter::bi_bvec_done is used an offset in the current bvec, let's rename it accordingly for better clarity. I also plan to use it for non-bvec based iteration in the future like dma-buf, so drop the "bvec" part. Suggested-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/4e4c21858705a200bd8848ffe4080522e3eb5c1c.1786018753.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-06ASoC: Rework the SDCA HID codeMark Brown13-124/+211
Charles Keepax <ckeepax@opensource.cirrus.com> says: This series reworks the SDCA HID code, the primary goals being to no longer store runtime HID data in the DisCo data structures and remove the need to pass the soundwire device into the ACPI parsing code. To achieve this the HID device registration is moved to the IRQ work flow rather than the ACPI work flow. Also a few small issues are fixed up along the way, some formatting, some missing cleanup/docs. Link: https://patch.msgid.link/20260805124205.4152543-1-ckeepax@opensource.cirrus.com
2026-08-06ASoC: SDCA: Pass swft table through sdca_dev_register()Charles Keepax7-15/+13
Rather than passing the SoundWire slave into find_sdca_filesets(), stash the swift table whilst processing sdca_dev_register(). This allows us to completely remove the passing of the sdw_slave into the ACPI parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-9-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing HID kernel docCharles Keepax1-0/+6
Add missing kernel doc for the function sdca_add_hid_device() Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing destroy for HID deviceCharles Keepax3-0/+19
The SDCA code is currently missing a cleanup for HID devices when the drivers are unbound. Add the missing HID cleanup as part of the IRQ cleanup to mirror when the HID device is created. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Update HID DisCo parsingCharles Keepax1-45/+74
Add more error checking on the parsing of the HID DisCo and bring the code more inline with the rest of the DisCo parsing. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID descriptors to functionCharles Keepax3-32/+63
The HID descriptors are defined at the function level in DisCo and as such it makes more sense to parse and store them at that level in the SDCA code. This shouldn't really make much practical difference but is conceptually better and avoids passing the function node down to the entity parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID registration to IRQ timeCharles Keepax7-38/+43
Currently, the SDCA code registers the HID device whilst parsing the DisCo information. This necessitates storing the HID device in the DisCo structs, which are intended to only store the parsed DisCo. Having the HID device registered so early in the process also causes some issues with cleaning up. Update the code to register the HID device as the IRQs are handled, this alleviates the previous concerns and brings the support inline with the other SDCA event handling. As part of this move the naming for the SDCA HID is also updated, it saves some complexity around the passing of the SoundWire device to include this in this patch. Update to using the dev_name for the phys, which is more consistent with other HID users, and use the actual function name/address for the HID name itself. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Remove unused dev pointer argumentCharles Keepax4-13/+12
Remove the now unused device pointer from sdca_asoc_pde_poll_actual_ps(). Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Tidy up error messageCharles Keepax1-1/+1
Bring the entity_pde_event() error message slightly more in line with the other SDCA error messages. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06drm/tests/gpu_buddy: fix interleaving in buffer clearance testArunpravin Paneer Selvam1-24/+33
The resume clearance test skipped every other allocation, expecting an interleaved clear/dirty layout. But the buddy allocator hands out blocks contiguously, so this just allocated half the pages in one chunk and never exercised gpu_buddy_reset_clear()'s force-merge of opposite-state buddies. Allocate all pages into two lists instead and free one cleared, one dirty, to build a truly interleaved pattern. v2: Use for loops instead of do-while for the allocation loops (Jani Nikula) Fixes: e3335ccbf4da ("drm/tests/gpu_buddy: add a new test case for buffer clearance during resume") Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260721114236.507578-1-Arunpravin.PaneerSelvam@amd.com?part=1 Cc: Matthew Auld <matthew.auld@intel.com> Cc: Christian König <christian.koenig@amd.com> Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260803065656.2960810-1-Arunpravin.PaneerSelvam@amd.com
2026-08-06ASoC: dt-bindings: cirrus,cs42l43: Add CS42L44 variantCharles Keepax1-0/+1
The cs42l44 is a cost optimised variant of cs42l43b. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805131942.45729-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBMLinu Cherian1-8/+4
Add ID_AA64MMFR2_EL1.BBM based BBML3 feature detection in cpu_supports_bbml3() so that cpus with the feature would not have to be added into MIDR based supports_bbml3_list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> [will: Tidy up cpu_supports_bbml3()] Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cpufeature: Rename BBML2_NOABORT as BBML3Linu Cherian6-67/+50
- As bbml2_noabort is functionally equivalent to bbml3, rename cpu/system_supports_bbml2_noabort to cpu/system_supports_bbml3. The ARM64 capability name is also renamed accordingly. - As BBML2_NOABORT or the equivalent BBML3 is the kernel requirement for setting up linear map with block/contpte mappings and not BBML2, replace all bbml2 references with bbml3. FEAT_BBML3, is introduced as part of 2025 Architecture Extensions. https://developer.arm.com/documentation/109697/2026_03/2025-Architecture-Extensions No functional changes are introduced with this patch. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: sysreg: Add BBM_3Linu Cherian1-0/+1
Add BBM_3 definition for ID_AA64MMFR2_EL1 register. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cpufeature: Extend bbml2_noabort support listLinu Cherian2-0/+14
Add below cpus to the midr list, which supports BBML2_NOABORT. Cortex A520(AE) Cortex A715 Cortex A720(AE) Cortex A725 Neoverse N3 C1-Nano C1-Pro C1-Ultra C1-Premium C1-Ultra and C1-Premium both suffer from erratum 3683289, where Break-Before-Make must be followed to avoid a livelock. For both CPUs, the erratum is fixed from r1p1. Hence we do not enable BBML2_NOABORT for CPU revisions <= r1p0. The relevant SDENs are: * C1-Ultra: https://developer.arm.com/documentation/111077/9-00/ * C1-Premium: https://developer.arm.com/documentation/111078/9-00/ Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cputype: Add C1-Nano definitionsLinu Cherian1-0/+2
Add cputype definitions for C1-Nano. The definition can be found in C1-Nano TRM, https://developer.arm.com/documentation/107753/0002 as part of MIDR_EL1 bit descriptions. This is going to be used in the bbml3 support list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cputype: Add Cortex-A520AE definitionsLinu Cherian1-0/+2
Add cputype definitions for Cortex-A520AE. The definition can be found in Cortex-A520AE TRM, https://developer.arm.com/documentation/107726/0001/ as part of MIDR_EL1 bit descriptions. This is going to be used in the bbml3 support list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06wifi: nxpwifi: bound uAP association event IEs to the event bufferLinmao Li1-2/+20
nxpwifi_uap_event_sta_assoc() exposes the association request IEs that the firmware reports in the uAP association event, which the driver copies into the fixed-size event_body[] buffer. event->len is supplied by firmware and is not validated. A value smaller than the header underflows the subtraction used for assoc_req_ies_len, while a larger value can make the IE range extend beyond event_body[]. Subsequent IE parsing can then read past the adapter object. Validate both bounds before using the firmware-reported length. nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi: mwifiex: bound uAP association event IEs to the event buffer") and retains the same unchecked length. Apply the equivalent bounds check here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com> Link: https://patch.msgid.link/20260729082457.1897303-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxpwifi: detach sync command buffer on interrupted waitLinmao Li2-0/+22
nxpwifi synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there, for example nxpwifi_get_chan_type() and the timeshare_coex debugfs handlers. If wait_event_interruptible_timeout() is interrupted or times out, the caller can return and release that stack object while the command is still current. nxpwifi_cancel_all_pending_cmd() deliberately keeps the current command because a response may still arrive. A late firmware response can then write through cmd_node->data_buf into the stale stack address. After cancelling pending commands, detach the caller-owned buffer from the still-current command under nxpwifi_cmd_lock. Unlike the host command response path, several command response callbacks do not tolerate a NULL data buffer. Most of them ignore it or check it already, but nxpwifi_ret_sta_get_chan_info(), nxpwifi_ret_sta_hs_wakeup_reason() and nxpwifi_ret_sta_robust_coex() dereference it unconditionally, so let them discard a detached response. No caller passes a NULL buffer to these commands today, so this only affects the newly introduced detached state. nxpwifi was derived from mwifiex before commit ef06882c7d8a ("wifi: mwifiex: Detach sync cmd buffer on interrupted wait") and retains the same lifetime bug. Apply the equivalent buffer detachment here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260729124713.2849018-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()Abdun Nihaal1-1/+2
The memory allocated for buf is not freed in some of the error paths in brcmf_sdio_read_control(). Fix that by adding vfree() calls. Cc: stable@vger.kernel.org Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control frame buffer") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> [arend: rework as suggested by Johannes] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260803093506.1647790-1-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: rsi: Fix types to appease CFIStefan Hansson7-11/+15
Avoids errors like: CFI failure at kthread+0x124/0x1cc (target: rsi_coex_scheduler_thread+0x0/0x1b4 [redpine_91x]; expected type: 0x89fb613d) As seen in the aforementioned error this was tested using the downstream redpine_91x driver found in the Librem 5's downstream source tree. However, it appears that this driver is a modified version of the rsi driver found in mainline Linux and as such I decided to port the changes here too. Signed-off-by: Stefan Hansson <newbyte@postmarketos.org> Link: https://patch.msgid.link/20260804-rsi-cfi-fix-v2-1-59679a520240@postmarketos.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: mac80211: skip default WMM setup for AP_VLAN linksFelix Fietkau1-1/+2
AP_VLAN interfaces are never passed to the driver, so setting default WMM parameters on their links trips the check-sdata-in-driver warning in drv_conf_tx(), as well as in the BSS_CHANGED_QOS link info notification. Skip it, matching the existing AP_VLAN handling in this function. Fixes: 2259d14499d1 ("wifi: mac80211: set default WMM parameters on all links") Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260804082608.2011433-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxpwifi: fix multiple static analysis errors and warningsJeff Chen8-43/+60
Fix various development-phase bugs, code quality, and logical issues reported by the kernel test robot (using the Smatch static analysis tool). The following addressable fixes are included: - 11n.c & 11ax.c: Fix potential NULL pointer dereferences by correcting logical operators (&& to ||) in 11n.c and hoisting the bss_desc verification to the top of the function in 11ax.c. - 11n.c: Fix a severe Use-After-Free (UAF) memory corruption during RCU list traversal. Restore the proper list_for_each_entry_safe() loop structure along with the required array index [i] within the locked writer path. - sdio.c: Fix a missing unwind resource cleanup pathway where a protocol error branch returned directly via -EINVAL instead of using 'goto term_cmd', leaving the SDIO hardware state machine out of sync. - main.h: Fix a signedness mismatch bug where nxpwifi_get_unused_bss_num() could return -2 as an unsigned integer fallback. - util.c: Remove a redundant and dead condition check (position <= 15) which was always true for a 4-bit unsigned bit-field member variable. - cfg80211.c: Clean up a dead unreachable 'return 0' at the bottom of the switch-case logic. - uap_txrx.c: Clean up mismatched and inconsistent indentations within the handling of multicast RX forward paths. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608020855.QwN5n7i5-lkp@intel.com/ Assisted-by: Gemini:unknown-model Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com> Link: https://patch.msgid.link/20260803162741.438820-1-chunfan.chen@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06regcache: Sort the local copy of an unsorted reg_defaults arrayPeter Ujfalusi1-1/+16
regcache_lookup_reg() bsearch()es the reg_defaults array, which requires it to be sorted by ascending register address. Entries following a descending step are never found, so regcache_reg_needs_sync() reports that they need a sync and they are written to the device on every regcache_sync() even when they were never touched. Detect the misordering while reg_defaults is validated against the register stride and sort the local copy. The check needs no new loop and sort() only runs for the affected drivers, which are also warned about. Note that sort() is not stable, so for arrays with duplicated register addresses it remains unspecified which entry is found. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805132250.2637-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06wifi: morsemicro: MM81X should be invisible and selected by its usersGeert Uytterhoeven1-3/+5
Morse Micro MM81x wireless devices can have either SDIO or USB interfaces. Hence there is no point in asking the user about these devices when configuring a kernel without MMC or USB support. Fix this by making the core driver symbol invisible, and selecting it by its users when needed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/3415bda97c2faf7c56eff7fe79a91b218d0d6731.1786010705.git.geert+renesas@glider.be Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxp: NXPWIFI should be invisible and selected by its usersGeert Uytterhoeven1-2/+3
All supported NXP WiFi wireless adapters have an SDIO interface. Hence there is no point in asking the user about these adapters when configuring a kernel without MMC support. Fix this by making the core driver symbol invisible, and selecting it by its user when needed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/aefb37d8398175cb2fb520cb5f725a85bcd3049d.1786010763.git.geert+renesas@glider.be Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06Merge tag 'ath-next-20260803' of ↵Johannes Berg23-120/+550
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.3 (PR #2) For ath12k, add MultiPD support for AHB platforms. Other than that, just an assortment of cleanups and minor bug fixes across ath6kl, ath10k, ath11k, and ath12k. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06regcache: Use a consistent sort for defaults tableMark Brown1-9/+1
When we look up registers in the defaults table we use a binary search, and we have a regcache_sort_defaults() API to help drivers that constuct their defaults tables on the fly. Unfortunately the lookup and the sort don't use the same comparison function, and to make matters worse the comparison function used during lookups is written for signed register numbers rather than the unsigned ones we actually have so can produce suprising results when some of the addresses have the top bit set. Standardise on the more explicitly coded function to ensure consistent results. Reviewed-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805-regmap-regcache-sort-v1-1-162186aad8b9@kernel.org Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06Merge tag 'asoc-fix-v7.2-rc6' of ↵Takashi Iwai502-2827/+6687
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus ASoC: Fixes for v7.2 A moderately large set of fixes, but mostly unremarkable: - A series of robustness fixes for the SOF code that came from testing. - Fixes for user visible issues with some of the Qualcomm controls. - Fixes to the register default tables in Cirrus drivers which ensure correcy syncing on resume. This is a wider problem which will be fixed with a regmap core change but I'd already applied these, the rest of the fixes will come in the merge window. - Making the existing RT645 driver user selectable so it can be used with more machines. - Quite a few new AMD laptop quirks. - A MAINTAINERS update for SpacemiT.
2026-08-06dm-era: fix shadowed superblock leak on take-snap failureliyouhong1-0/+5
metadata_take_snap() bumps the live superblock refcount and then dm_tm_shadow_block() allocates a new block for the metadata snapshot. If the subsequent dm_sm_inc_block() of writeset_tree_root or era_array_root fails, the function only unlocks the clone and returns. The newly allocated shadow block is never returned to the metadata space map, so each failed take-snap permanently leaks one metadata block. Free the clone with dm_sm_dec_block() on those error paths, matching the final step of metadata_drop_snap(). Fixes: eec40579d848 ("dm: add era target") Cc: stable@vger.kernel.org Signed-off-by: liyouhong <liyouhong@kylinos.cn> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-08-06mfd: viperboard: Fix native fields type in structures as little-endianMikhail Lukianchikov1-5/+5
Sparse reports several warnings about incorrect type in assignment (different base types) when building the i2c-viperboard.c driver: warning: incorrect type in assignment (different base types) expected unsigned short [usertype] addr got restricted __le16 [usertype] Signed-off-by: Mikhail Lukianchikov <avermoal@gmail.com> Link: https://patch.msgid.link/20260717121015.11666-2-avermoal@gmail.com Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06ARM: PXA: Fix build error for PXA93xUlf Hansson1-1/+1
Add a missing semicolon to fix the build error for PXA93x. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202607301822.cl0lEkQt-lkp@intel.com/ Fixes: ab9c44bbf6d7 ("ARM: PXA: remove remnants of PXA93x support") Cc: Ethan Nelson-Moore <enelsonmoore@gmail.com> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
2026-08-06arm64: pgtable: convert pte_present() from macro to static inlineYeoreum Yun1-4/+8
pte_present() is used as the basis for both pmd_present() and pud_present(). It is currently implemented as a macro composed of pte_val() and pte_present_invalid(). When pte_present() or its higher-level variants are used directly with ptep_get() or pXdp_get(), for example: pte_present(ptep_get(pte)); pmd_present(pmdp_get(pmd)); pud_present(pudp_get(pud)); the macro expansion causes the compiler to evaluate the argument twice, resulting in redundant loads. For example, pte_present() expands to: !pte_val(READ_ONCE(*pte) || pte_present_invalid(READ_ONCE(*pte)) A typical example is pud_free_pmd_page(), where the expansion of pmd_present() generates: ... /* pmd_present() (x20 = pmdp) */ 1b88: f9400288 ldr x8, [x20] // read pmdp. 1b8c: f9000fa8 str x8, [x29, #0x18] 1b90: 3707fec8 tbnz w8, #0x0, 0x1b68 <pud_free_pmd_page+0xd0> 1b94: f9400288 ldr x8, [x20] // redundant read of pmdp. 1b98: 8a170109 and x9, x8, x23 1b9c: f9000fa8 str x8, [x29, #0x18] 1ba0: f120013f cmp x9, #0x800 1ba4: 54fffe20 b.eq 0x1b68 <pud_free_pmd_page+0xd0> 1ba8: 17fffff4 b 0x1b78 <pud_free_pmd_page+0xe0> ... Convert pte_present() to static inline function so that prevent the generation of redundant code and move pte_valid() and pte_present_invalid() further up so the inline function can use them. After this change, the generated code becomes: ... /* pmd_present() (x20 = pmdp) */ 1a30: f9400288 ldr x8, [x20] 1a34: 8a170109 and x9, x8, x23 1a38: f9000fa8 str x8, [x29, #0x18] 1a3c: f120013f cmp x9, #0x800 1a40: 54fffe80 b.eq 0x1a10 <pud_free_pmd_page+0xd0> 1a44: 3607fee8 tbz w8, #0x0, 0x1a20 <pud_free_pmd_page+0xe0> 1a48: 17fffff2 b 0x1a10 <pud_free_pmd_page+0xd0> ... This eliminates the redundant load and also reduces code size at call sites using this pattern. For example, pud_free_pmd_page() shrinks from 7,500 bytes to 7,148 bytes, a reduction of approximately 4.7%. Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06perf/arm_cspmu: Support 64-bit programmers' modelRobin Murphy3-34/+114
The 64-bit Programmers' model extension, now named FEAT_CSPMU_EXT64, makes all the non-counter registers 64-bit as well, of which we most need to care PMEVFILTR<n>, PMEVTYPER<n>, and PMCR since it changes location. Our event config fields are ready for this internally, but we need a few more tweaks to propagate 64-bit values properly from end to end. Since 64-bit events leave no room for our existing "cycles" encoding, and we don't really expect to see implementations of it anyway, we deliberately omit generic support for the architectural fixed cycle counter in this case to save some bother. At worst, vendor modules can still implement their own encoding if they really want to. Signed-off-by: Robin Murphy <robin.murphy@arm.com> Reviewed-by: Ilkka Koskinen <ilkka@os.amperecomputing.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06dt-bindings: arm-smmu: qcom: add compatible for IPQ9650 SoCKathiravan Thirumoorthy1-0/+2
Add the compatible string for the APPS SMMU present on the Qualcomm IPQ9650 SoC. Signed-off-by: Kathiravan Thirumoorthy <kathiravan.thirumoorthy@oss.qualcomm.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06net/smc: fix TOCTOU race between smc_listen_out() and listener closeSidraya Jayagond1-1/+2
smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition: smc_listen_work (smc_hs_wq) smc_close_active() ------------------------------- ------------------------- release_sock(child) if (sk_state == SMC_LISTEN) TRUE lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work) lock_sock_nested(listener) smc_accept_enqueue(listener, child) /* child enqueued on dead listener */ smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory. Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock. Fixes: fd57770dd198 ("net/smc: wait for pending work before clcsock release_sock") Reviewed-by: Mahanta Jambigi <mjambigi@linux.ibm.com> Signed-off-by: Sidraya Jayagond <sidraya@linux.ibm.com> Reviewed-by: Breno Leitao <leitao@debian.org> Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Link: https://patch.msgid.link/20260803070701.126339-1-sidraya@linux.ibm.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06RDMA/erdma: restrict the driver to little-endian systemsLeon Romanovsky1-1/+1
The eRDMA device interface requires explicit byte ordering, but several DMA-visible values that should be little-endian remain native-endian. Command request payloads are copied verbatim, data-path SQE headers are written without cpu_to_le64(), and kernel doorbell records are assigned plain u64 values. The command completion path also reads a little-endian SQE header without conversion. These paths are byte-swapped on big-endian kernels and can break command processing during probe. Since complete big-endian support requires converting every device-visible structure, depend on !CPU_BIG_ENDIAN. Fixes: ca7fd6cff3b8 ("RDMA/erdma: Add driver to kernel build environment") Link: https://patch.msgid.link/20260806-missing-endianness-conversion-for-64-v1-1-896327c1aff1@nvidia.com Acked-by: Cheng Xu <chengyou@linux.alibaba.com> Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
2026-08-06dm dust: make badblock messages target-relativeSamuel Moelius1-9/+7
dm-dust currently treats addbadblock, removebadblock and queryblock arguments as block numbers on the underlying device. That is surprising for a device-mapper target: a dm-dust table with a non-zero backing offset can add bad blocks that are outside the mapped target, and a badblock added for logical block 0 is missed because the I/O path checks the remapped backing-device block instead. Interpret badblock message arguments as blocks relative to the start of the dm-dust target instead. Bound the arguments by the target length and perform badblock lookup using target-relative sectors before remapping the bio to the underlying device. This intentionally changes the non-zero backing-offset behavior to make the badblock control interface match the mapped dm-dust device, rather than the underlying device. Assisted-by: Codex:gpt-5.5-cyber-preview Signed-off-by: Samuel Moelius <sam.moelius@trailofbits.com> Tested-by: Bryan Gurney <bgurney@redhat.com> Reviewed-by: Benjamin Marzinski <bmarzins@redhat.com> Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
2026-08-06gpu/tests/gpu_buddy: Add KUnit test for gpu_buddy_allocated_addr_to_blockTejas Upadhyay1-0/+45
Add a new KUnit test gpu_test_buddy_addr_to_block() that validates the gpu_buddy_allocated_addr_to_block() helper which traces a address back to its allocated buddy block. The test covers: - Exact address matching returns the correct allocated block - An unallocated address inside the manager should return NULL - An address outside the manager should return -ENXIO v4(MattA): - Add test for unaligned address v3(Sashiko): - remove unused target_addr variable v2(Sashiko): - Drop the mutex and lockdep annotation; standalone KUnit tests do not register a driver lock. Signed-off-by: Tejas Upadhyay <tejas.upadhyay@intel.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Link: https://patch.msgid.link/20260806053624.3215216-6-tejas.upadhyay@intel.com
2026-08-06module/dups: Clean up includesPetr Pavlu1-20/+12
The kernel/module/dups.c file relies on the following definitions and associated functions: * module_param() -> linux/moduleparam.h, * DEFINE_MUTEX() -> linux/mutex.h, * LIST_HEAD(), list_for_each_entry(), ... -> linux/list.h, * refcount_t, refcount_inc(), ... -> linux/refcount.h, * MODULE_NAME_LEN -> linux/module.h, * completion, complete_all(), ... -> linux/completion.h, * delayed_work, work_struct, ... -> linux/workqueue.h, * lockdep_assert_held() -> linux/lockdep.h, * strcmp(), memcpy() -> linux/string.h, * container_of() -> linux/container_of.h, * DEFINE_FREE(), __free(), scoped_guard() -> linux/cleanup.h, * kzalloc_obj(), kfree() -> linux/slab.h, * pr_debug(), pr_warn() -> linux/printk.h, * WARN() -> linux/bug.h, * TASK_KILLABLE -> linux/sched.h, * HZ -> linux/param.h. Update the file's include list accordingly. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06module/dups: Use strcmp() to compare module namesPetr Pavlu1-4/+2
Use strcmp() instead of strlen()+memcmp() to compare module names in kmod_dup_request_lookup(), since all strings are NUL-terminated. Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06module/dups: Use scope-based cleanup helpersPetr Pavlu1-33/+23
Use scope-based cleanup helpers for kmod_dup_mutex and kmod_req to shorten the code and to clarify where the lock is taken in kmod_dup_request_exists_wait(). Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06module/dups: Avoid unnecessary kmod_dup_req allocationsPetr Pavlu1-16/+22
The kmod dups code preallocates kmod_dup_req before taking kmod_dup_mutex to avoid allocating memory while holding the lock. This provides little benefit, since the allocation is fast and can safely be done under the lock. On the other hand, it leads to unnecessary allocations when the request turns out to be a duplicate and slightly complicates the code. Allocate kmod_dup_req only when needed and introduce a helper function alloc_kmod_req() to initialize the structure. Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06module/dups: Fix use-after-free in kmod_dup_req lifetime handlingPetr Pavlu1-16/+40
The kmod dups code uses RCU to ensure that a kmod_dup_req instance is freed only after it is no longer referenced. When releasing an instance, the kmod_dup_request_delete() function removes the kmod_dup_req from the dup_kmod_reqs list, waits via synchronize_rcu() and finally frees it. However, this doesn't work correctly because parallel users referencing the instance in kmod_dup_request_exists_wait() don't enter an RCU read-side critical section. This can result in a use-after-free. The kmod_dup_request_exists_wait() function may need to hold a valid reference to a kmod_dup_req instance across a blocking wait until the corresponding modprobe command completes. This makes it unsuitable for RCU. Fix the issue by changing the lifecycle management of kmod_dup_req to use reference counting. Fixes: 8660484ed1cf ("module: add debugging auto-load duplicate module support") Reviewed-by: Aaron Tomlin <atomlin@atomlin.com> Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06module/dups: Inform duplicate requests about the result directlyPetr Pavlu1-34/+9
When kmod_dup_request_announce() announces the completion of a request_module() call to duplicate waiters, it queues a work item to invoke kmod_dup_request_complete(), and only that function calls complete_all(). This adds an arbitrary delay that is unnecessary and provides little benefit. Call complete_all() directly from kmod_dup_request_announce() instead. Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-08-06rust: module_param: support bool parametersWenzhao Liao4-1/+18
Add support for parsing boolean module parameters in the Rust module! macro. Currently, only integer types are supported by the `module_param!` macros. This patch implements the `ModuleParam` trait for `bool` by delegating the string parsing to the existing C implementation via `kstrtobool_bytes()`. It also wires up `PARAM_OPS_BOOL` so that the Rust parameter system correctly links to the C `param_ops_bool` structure. For demonstration and verification, a boolean parameter is added to `samples/rust/rust_minimal.rs`. Support for boolean parameters will initially be used by the Rust null block driver [1]. Link: https://lore.kernel.org/all/20260609-rnull-v6-19-rc5-send-v2-4-82c7404542e2@kernel.org/ [1] Assisted-by: Codex:GPT-5 Signed-off-by: Wenzhao Liao <wenzhaoliao@ruc.edu.cn> Tested-by: Andreas Hindborg <a.hindborg@kernel.org> Reviewed-by: Andreas Hindborg <a.hindborg@kernel.org> Link: https://lore.kernel.org/linux-modules/20260411130254.3510128-1-wenzhaoliao@ruc.edu.cn/ [ppavlu: add motivation to the commit message and rebase the patch] Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
generated by cgit (git 2.54.0.dirty) at 2026-09-29 23:37:27 +0000