summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-08-06arch: arm64: add early_param idle=<wfi|yield|nop>Yureka Lilian
Overriding the idle mechanism might be useful for debugging and performance testing. Add a cmdline parameter for it, similar to the existing idle= parameter already present for the x86 and ppc architectures. It is also useful on platforms where the WFI instruction misbehaves, such as Apple Silicon SoCs. Generally, a misbehaving instruction should be treated as an erratum and patched using the alternatives framework. However, in the Apple Silicon case we need more flexibility because it is difficult to detect whether the erratum applies. For example, Linux VMs inside macOS have the same MIDR and may even seem like they're running in EL2 in the case of NV, but should continue using WFI (it's trapped and handled correctly by the hypervisor there). Thus, we prefer to let the m1n1 bootloader add the idle=nop parameter[1]. Link[1]: https://lore.kernel.org/all/99b69262-e54b-424e-baa2-96ef7013b87a@kernel.org/ Suggested-by: Will Deacon <will@kernel.org> Signed-off-by: Yureka Lilian <yureka@cyberchaos.dev> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06Merge branch 'openvswitch-remove-support-for-legacy-tunnel-ports'Paolo Abeni
Ilya Maximets says: ==================== openvswitch: remove support for legacy tunnel ports ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking: https://lore.kernel.org/r/CAAVpQUDmZEaQNDSySLayqexgTrUbhBaL7XPCt9XNQzh+NGQ=UQ@mail.gmail.com Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. There are 3 parts to this set: 1. The first patch does the tunnel port removal, which is the primary goal here. 2. Patches 2 and 3 remove extra infrastructure that is no longer in use by anything inside the openvswitch module. 3. Patches 4-6 remove functions from gre/vxlan/geneve modules that were added for openvswitch in the past to support the tunnel types. openvswitch is the only in-tree consumer of these functions. Version 1: - Rebased. - Removed the tunnel modules from the new OVS selftest config. - Addressed RFC review from Sashiko: * Made ovs_netdev_link() static. * Restored -EOPNOTSUPP if OVS_VPORT_ATTR_OPTIONS was provided. * Removed retry in ovs_vport_cmd_new() as not needed anymore. RFC: - https://lore.kernel.org/r/20260513183559.2141010-1-i.maximets@ovn.org ==================== Link: https://patch.msgid.link/20260804182049.2289754-1-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: vxlan: remove unused vxlan_dev_createIlya Maximets
The vport-vxlan in openvswitch was the last user and it is now gone. And we can now rename the internal function to have a better name. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-7-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: gre: remove unused gretap_fb_dev_createIlya Maximets
The only user was vport-gre in openvswitch and now it is gone. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-6-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06net: geneve: remove unused geneve_dev_create_fbIlya Maximets
The only user was vport-geneve in openvswitch and now it is gone. This also removes the last exported function in geneve module, significantly reducing complexity of the locking analysis. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-5-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: vport: remove infrastructure for separate modulesIlya Maximets
Since removal of legacy tunnel vport types only the built-in ones remain. So, there is no need for the extra infrastructure for dynamic module loading. Can be reinstated in the future if we need a new vport type. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type. At this time we're not aware of anyone doing that. People running out-of-tree modules normally just have an out-of-tree openvswitch module as a whole. And there are actually no supported out-of-tree implementations of the openvswitch module known to the community. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-4-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: vport: remove infrastructure for vport optionsIlya Maximets
Since removal of tunnel vport types, there aren't any vports that support options. Let's remove the options-related infrastructure. Can be reinstated if we ever need a new vport type or if we need extra options for the existing ones. The uAPI attribute remains. Clarification comment is added to highlight that none of the supported vports support options at the moment. If the options are provided, the code now directly replies with -EOPNOTSUPP to keep the behavior the same for remaining vport types. Note: It is technically possible that someone has an out-of-tree module named vport-type-N that implements a different vport type and they have options for this vport type. However, our message size calculations do not account for whatever options such a port would have and so it is dangerous to load such a module without modifying the code in the main datapath.c, unless the options are smaller than the ones we had for vxlan. A more robust solution would be to have a different version of the entire openvswitch module instead, so the use case of a separate vport-type-N loaded with the upstream openvswitch module is unlikely. At this time we're not aware of anyone doing that. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-3-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06openvswitch: remove support for legacy tunnel typesIlya Maximets
ovs-vswitchd doesn't use OVS_VPORT_TYPE_GRE/VXLAN/GENEVE with the Linux kernel module since adding support for standard tunnel devices with COLLECT_METADATA back in 2017. The code to use them was only activated as a fallback for old kernels, so not used in practice. And it is now fully removed in the upcoming OVS 4.0 release. Modern way to use tunnels with OVS is to create standard tunnel ports with RTM_NEWLINK + COLLECT_METADATA and add them as OVS_VPORT_TYPE_NETDEV. Device reference management and the netlink options parsing for these legacy port types is complicated and was a CVE magnet in the previous release cycles. Existence of these modules also makes locking analysis for geneve module and other core tunnel devices unnecessarily more complicated, especially in light of migration to per-netns locking. Since there are no actual users for these port types for a very long time, let's just remove the support entirely. There is no practical reason to run OVS from 2017 on a recent kernel. While it's technically a uAPI change in some sense, from the user's perspective this removal looks indistinguishable from the kernel built with CONFIG_OPENVSWITCH_GENEVE/VXLAN/GRE disabled. And it seems like removal of unused drivers/modules is not a rare event these days. A comment is added to the uAPI header noting that standard RTM_NEWLINK with COLLECT_METADATA followed by OVS_VPORT_CMD_NEW with the simple OVS_VPORT_TYPE_NETDEV should be used instead. Modules responsible for these tunnel ports are removed as well as selftests covering this functionality. Further cleanups will follow. Signed-off-by: Ilya Maximets <i.maximets@ovn.org> Link: https://patch.msgid.link/20260804182049.2289754-2-i.maximets@ovn.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06mfd: rave-sp: validate received frame payload lengthsPengpeng Hou
A received RAVE-SP frame contains protocol data followed by a variant-specific one- or two-byte checksum. rave_sp_receive_frame() derives a checksum pointer before proving that the frame contains the checksum, then passes the checksum-inclusive length to handlers that index the command, acknowledgment ID and event-data bytes or derive a reply payload length. Name those protocol field offsets, prove the checksum extent before deriving the protocol-data length, pass only that data length to the handlers, and require the complete event or reply prefix before consuming it. Fixes: 538ee27290fa ("mfd: Add driver for RAVE Supervisory Processor") Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Link: https://lore.kernel.org/all/20260706092337.78754-1-pengpeng@iscas.ac.cn/ Link: https://patch.msgid.link/20260720115523.99956-1-pengpeng@iscas.ac.cn Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06arm64: entry: mask DAIF before returning from C EL1 handlersAda Couprie Diaz
Most EL1 exceptions already call local_daif_mask() before returning, with the exception of debug exception handlers which do not change DAIF, and the IRQ/FIQ/Error handlers. However, DAIF get masked in kernel_exit() in all cases when returning from EL1 C handlers anyway. Move this masking from assembly to C by calling local_daif_mask() before irqentry_nmi_exit(). Unlike the raw DAIF masking helper, local_daif_mask() invokes trace_hardirqs_off(), so it must execute while RCU is still watching. Remove the disable_daif assembly macro, as this was its only use. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: suspend: Initialize PMR on resumeVladimir Murzin
When we resume from cpu_suspend() context tracking, specially, ct_idle_exit() performs IRQ save/restore sequence. It doesn't cause any functional issues since we have masked all exceptions prior suspend and have not restored them. However, in case of pseudo-NMI PMR can be set by firmware to arbitrary value, thus IRQ save/restore routines manipulates this arbitrary value. Again, it doesn't cause any issues since PMR variant of IRQ save helper carries a __pmr_irqs_disabled_flags() guard. Going forward __pmr_irqs_disabled_flags() guard will be gone and we will call __pmr_local_irq_disable() unconditionally - that would cause warning in case CONFIG_ARM64_DEBUG_PRIORITY_MASKING is set. Initialize PMR to a value known to Linux on resume until the normal exception restore path restores the saved DAIF and PMR state. Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: suspend: rely on daif helpers to handle PMRAda Couprie Diaz
Commit 77345ef70445 ("arm64: suspend: Use cpuidle context helpers in cpu_suspend()") added cpuidle helpers to handle PMR manipulation and restoration to ensure that the CPU receives interrupts when suspended and pseudo-NMIs are enabled. However, those helpers are called in between a pair of `local_daif_save()` and `local_daif_restore()`, which already configure the PMR as expected. Effectively, `arm_cpuidle_save_irq_context()` is a no-op here, even when using pseudo-NMIs, and `arm_cpuidle_restore_irq_context()` would not restore proper interrupt masking configuration early enough if there were unexpected changes during suspend or resume. (This can be observed with Trusted Firmware A (TF-A) at EL3 handling suspend through PSCI. Even though it should not be the case, TF-A can reset `ICC_PMR_EL1` during CPU_SUSPEND, thus resuming the kernel with an inconsistent priority mask value on hardware implementing more than the minimum number of priority levels, such as Morello.) Thus : remove the cpuidle context helpers as they do not do anything, but keep the comment mentioning the need for interrupts to reach the CPU if we are using pseudo-NMIs. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: hibernate: Restore DAIF state on errorVladimir Murzin
Sashiko AI has reported that if swsusp_mte_save_tags() for some reason fails we return from swsusp_arch_suspend() with DAIF being masked - that is not what we'd expect. Restore the saved DAIF state before returning from the error path. Fixes: ee11f332af96 ("arm64: mte: Save tags when hibernating") Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: hibernate: mask DAIF before restoring hibernated kernelAda Couprie Diaz
The arm64 hibernate code manages the exception masking in an unsound way, leading to potential crashes and/or warnings during resume. When a hibernation image is saved in `swsusp_arch_suspend()`, all DAIF exceptions are masked (by virtue of `local_daif_save()`), and the suspended image is saved assuming that all DAIF exceptions will remain masked when the image is restored. When a hibernation image is resumed by `swsusp_arch_resume()`, only interrupts are masked (by virtue of `local_irq_disable()` in `resume_target_kernel()`). When pseudo-NMI is enabled the DAIF.IF bits will be clear, and regardless of pseudo-NMI the DAIF.DA bits will be clear. This means that there are two problems: (1) It is possible to take Debug, SError, or pseudo-NMI exceptions during the resume process. This is unsafe, as during the resume process both the old ane new kernels will tranisently be in an inconsistent state, and swsusp_arch_suspend_exit() won't retain an executable mapping of any exception vectors. Any exception taken here will be fatal and silent. (2) When re-entering the resumed kernel, some DAIF bits will be clear unexpectedly. This permits Debug, SError, or pseudo-NMI exceptions to be taken for a short period while the resumed kernel is not yet in a consistent state. This is detected by CONFIG_ARM64_DEBUG_PRIORITY_MASKING. Avoid these issues by masking all DAIF exceptions during resume. Fixes: 82869ac57b5d ("arm64: kernel: Add support for hibernate/suspend-to-disk") Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: debug: don't mask DAIF for mdscr_write()Ada Couprie Diaz
Masking DAIF around the write to MDSCR_EL1 doesn't do anything: we can write to sysregs with interrupts unmasked, and writing to PSTATE is not a context synchronization event so it does not synchronize it. This is done in the context of a general interrupt handling cleanup, so it does not address the missing context synchronization for the MDSCR_EL1 write, staying consistent with the current state. This should be addressed in a future patch. Signed-off-by: Ada Couprie Diaz <ada.coupriediaz@arm.com> Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: ptrace: Remove INIT_PSTATE_EL2Vladimir Murzin
Last user of INIT_PSTATE_EL2 has gone with ae4b7e38e9a9 ("arm64: Allow sticky E2H when entering EL1"), so remove it. Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06exfat: fix overflow in cluster-to-dentry conversionYang Wen
The cluster-to-dentry calculation is performed as u32 and may overflow and wrap around on large volumes. This can result in an incorrect max_dentries value, causing readdir to stop early and omit directory entries. Cast nr_clusters to u64 before shifting to avoid the overflow. Signed-off-by: Yang Wen <anmuxixixi@gmail.com> Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
2026-08-06mfd: sm501: Fix potential memory leaks during removeAbdun Nihaal
The memory allocated for struct sm501_devdata in sm501_pci_probe() and sm501_plat_probe() is not freed by the corresponding remove functions sm501_pci_remove() and sm501_plat_remove(). Fix that by adding a call to kfree(). Fixes: b6d6454fdb66 ("[PATCH] mfd: SM501 core driver") Cc: stable@vger.kernel.org Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> Link: https://patch.msgid.link/20260720113836.73133-1-nihaal@cse.iitm.ac.in Signed-off-by: Lee Jones <lee@kernel.org>
2026-08-06spi: dt-bindings: snps,dw-apb-ssi: Document Axiado AX3005Swark Yang
The Axiado AX3005 SPI controller is software-compatible with the Synopsys DesignWare APB SSI 1.01a programming interface. Document the "axiado,ax3005-spi" SoC-specific compatible with "snps,dwc-ssi-1.01a" as its fallback. This preserves identification of the AX3005 integration while allowing the controller to use the existing DesignWare APB SSI support. Signed-off-by: Swark Yang <syang@axiado.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260805-upstrea-ax3005-spi-v4-v4-1-5b8bc11cb841@axiado.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06drm/ssd130x: Add per-family update backlight logicAmit Barzilai
ssd130x_update_bl() runs for every SSD13xx panel, but it only works for SSD130x and SSD132x: it writes the single global SSD13XX_CONTRAST (0x81) command, which those two families expose. SSD133x has no such command -- it has three per-channel contrast registers (CONTRAST_A/B/C) that must be scaled together -- so ssd130x_update_bl() has no effect on it. Make backlight_ops.update_status a per-family choice. SSD130x and SSD132x keep ssd130x_update_bl() because they share the SSD13XX_CONTRAST interface, while SSD133x gets ssd133x_update_bl(), which drives the three channels through ssd133x_set_contrast(). Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-3-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06drm/ssd130x: Scale ssd133x per-channel contrast by brightness on initAmit Barzilai
ssd133x_init() wrote the SSD133X_CONTRAST_A/B/C commands with magic hex values (0x91/0x50/0x7d). These are a per-channel white-balance calibration: the A/B/C channels drive sub-pixels whose OLED materials differ in luminous efficiency, so the values set the white point at full brightness. Extract them into ssd133x_set_contrast(), which scales each channel by a requested brightness via ssd130x_scale_contrast(), instead of writing the calibration unconditionally. This makes the sequence readable, avoids repetition, and is a prerequisite for wiring up an ssd133x backlight controller that dims while preserving the white point. Note this changes the ssd133x power-on brightness. Previously the init wrote the calibration unscaled and ignored ssd130x->contrast, so the panel always booted at full brightness. It now scales by the shared default contrast of 127, i.e. half of MAX_CONTRAST (255). This is intentional and matches ssd130x, whose contrast register also defaults to 127 (mid-scale), so all families now power on at ~50% and report props.brightness = 127 / max_brightness = 255 to userspace. Assisted-by: Claude:claude-fable-5 Signed-off-by: Amit Barzilai <amit.barzilai22@gmail.com> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260729053054.29374-2-amit.barzilai22@gmail.com Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
2026-08-06net: phy: mediatek: fix TX blink masks using the RX bitsAhmed Naseef
MTK_GPHY_LED_TX_BLINK_SET and MTK_2P5GPHY_LED_TX_BLINK_SET are built from the RX blink bits instead of the TX ones, so both TX masks are identical to their RX counterparts. The TX bits they should be using, MTK_PHY_LED_BLINK_{10,100,1000,2500}TX, are otherwise only referenced by the per-speed branch of mtk_phy_led_hw_ctrl_set(). A TX trigger selected without a link trigger therefore programs the RX blink bits, and the LED blinks on received traffic. The masks are also used to decode the blink register in mtk_phy_led_hw_ctrl_get(), which as a result cannot tell the two triggers apart: an RX-only configuration reads back as RX and TX, and a TX-only configuration reads back as neither. Fixes: 7f9c320c98db ("net: phy: mediatek: Move LED helper functions into mtk phy lib") Cc: stable@vger.kernel.org Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Reviewed-by: Andrew Lunn <andrew@lunn.ch> Link: https://patch.msgid.link/20260804113511.3371248-1-naseefkm@gmail.com Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-08-06block: rename bi_bvec_donePavel Begunkov
struct bvec_iter::bi_bvec_done is used an offset in the current bvec, let's rename it accordingly for better clarity. I also plan to use it for non-bvec based iteration in the future like dma-buf, so drop the "bvec" part. Suggested-by: Christoph Hellwig <hch@lst.de> Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/4e4c21858705a200bd8848ffe4080522e3eb5c1c.1786018753.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-08-06ASoC: Rework the SDCA HID codeMark Brown
Charles Keepax <ckeepax@opensource.cirrus.com> says: This series reworks the SDCA HID code, the primary goals being to no longer store runtime HID data in the DisCo data structures and remove the need to pass the soundwire device into the ACPI parsing code. To achieve this the HID device registration is moved to the IRQ work flow rather than the ACPI work flow. Also a few small issues are fixed up along the way, some formatting, some missing cleanup/docs. Link: https://patch.msgid.link/20260805124205.4152543-1-ckeepax@opensource.cirrus.com
2026-08-06ASoC: SDCA: Pass swft table through sdca_dev_register()Charles Keepax
Rather than passing the SoundWire slave into find_sdca_filesets(), stash the swift table whilst processing sdca_dev_register(). This allows us to completely remove the passing of the sdw_slave into the ACPI parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-9-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing HID kernel docCharles Keepax
Add missing kernel doc for the function sdca_add_hid_device() Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-8-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Add missing destroy for HID deviceCharles Keepax
The SDCA code is currently missing a cleanup for HID devices when the drivers are unbound. Add the missing HID cleanup as part of the IRQ cleanup to mirror when the HID device is created. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-7-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Update HID DisCo parsingCharles Keepax
Add more error checking on the parsing of the HID DisCo and bring the code more inline with the rest of the DisCo parsing. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-6-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID descriptors to functionCharles Keepax
The HID descriptors are defined at the function level in DisCo and as such it makes more sense to parse and store them at that level in the SDCA code. This shouldn't really make much practical difference but is conceptually better and avoids passing the function node down to the entity parsing code. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-5-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Move HID registration to IRQ timeCharles Keepax
Currently, the SDCA code registers the HID device whilst parsing the DisCo information. This necessitates storing the HID device in the DisCo structs, which are intended to only store the parsed DisCo. Having the HID device registered so early in the process also causes some issues with cleaning up. Update the code to register the HID device as the IRQs are handled, this alleviates the previous concerns and brings the support inline with the other SDCA event handling. As part of this move the naming for the SDCA HID is also updated, it saves some complexity around the passing of the SoundWire device to include this in this patch. Update to using the dev_name for the phys, which is more consistent with other HID users, and use the actual function name/address for the HID name itself. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-4-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Remove unused dev pointer argumentCharles Keepax
Remove the now unused device pointer from sdca_asoc_pde_poll_actual_ps(). Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-3-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06ASoC: SDCA: Tidy up error messageCharles Keepax
Bring the entity_pde_event() error message slightly more in line with the other SDCA error messages. Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.dev> Link: https://patch.msgid.link/20260805124205.4152543-2-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06drm/tests/gpu_buddy: fix interleaving in buffer clearance testArunpravin Paneer Selvam
The resume clearance test skipped every other allocation, expecting an interleaved clear/dirty layout. But the buddy allocator hands out blocks contiguously, so this just allocated half the pages in one chunk and never exercised gpu_buddy_reset_clear()'s force-merge of opposite-state buddies. Allocate all pages into two lists instead and free one cleared, one dirty, to build a truly interleaved pattern. v2: Use for loops instead of do-while for the allocation loops (Jani Nikula) Fixes: e3335ccbf4da ("drm/tests/gpu_buddy: add a new test case for buffer clearance during resume") Reported-by: Sashiko-bot <sashiko-bot@kernel.org> Closes: https://sashiko.dev/#/patchset/20260721114236.507578-1-Arunpravin.PaneerSelvam@amd.com?part=1 Cc: Matthew Auld <matthew.auld@intel.com> Cc: Christian König <christian.koenig@amd.com> Assisted-by: GitHub_Copilot:claude-opus-4.8 Signed-off-by: Arunpravin Paneer Selvam <Arunpravin.PaneerSelvam@amd.com> Reviewed-by: Matthew Auld <matthew.auld@intel.com> Link: https://patch.msgid.link/20260803065656.2960810-1-Arunpravin.PaneerSelvam@amd.com
2026-08-06ASoC: dt-bindings: cirrus,cs42l43: Add CS42L44 variantCharles Keepax
The cs42l44 is a cost optimised variant of cs42l43b. Acked-by: Rob Herring (Arm) <robh@kernel.org> Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805131942.45729-1-ckeepax@opensource.cirrus.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06arm64: cpufeature: Detect BBML3 based on ID_AA64MMFR2_EL1.BBMLinu Cherian
Add ID_AA64MMFR2_EL1.BBM based BBML3 feature detection in cpu_supports_bbml3() so that cpus with the feature would not have to be added into MIDR based supports_bbml3_list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> [will: Tidy up cpu_supports_bbml3()] Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cpufeature: Rename BBML2_NOABORT as BBML3Linu Cherian
- As bbml2_noabort is functionally equivalent to bbml3, rename cpu/system_supports_bbml2_noabort to cpu/system_supports_bbml3. The ARM64 capability name is also renamed accordingly. - As BBML2_NOABORT or the equivalent BBML3 is the kernel requirement for setting up linear map with block/contpte mappings and not BBML2, replace all bbml2 references with bbml3. FEAT_BBML3, is introduced as part of 2025 Architecture Extensions. https://developer.arm.com/documentation/109697/2026_03/2025-Architecture-Extensions No functional changes are introduced with this patch. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: sysreg: Add BBM_3Linu Cherian
Add BBM_3 definition for ID_AA64MMFR2_EL1 register. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cpufeature: Extend bbml2_noabort support listLinu Cherian
Add below cpus to the midr list, which supports BBML2_NOABORT. Cortex A520(AE) Cortex A715 Cortex A720(AE) Cortex A725 Neoverse N3 C1-Nano C1-Pro C1-Ultra C1-Premium C1-Ultra and C1-Premium both suffer from erratum 3683289, where Break-Before-Make must be followed to avoid a livelock. For both CPUs, the erratum is fixed from r1p1. Hence we do not enable BBML2_NOABORT for CPU revisions <= r1p0. The relevant SDENs are: * C1-Ultra: https://developer.arm.com/documentation/111077/9-00/ * C1-Premium: https://developer.arm.com/documentation/111078/9-00/ Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cputype: Add C1-Nano definitionsLinu Cherian
Add cputype definitions for C1-Nano. The definition can be found in C1-Nano TRM, https://developer.arm.com/documentation/107753/0002 as part of MIDR_EL1 bit descriptions. This is going to be used in the bbml3 support list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06arm64: cputype: Add Cortex-A520AE definitionsLinu Cherian
Add cputype definitions for Cortex-A520AE. The definition can be found in Cortex-A520AE TRM, https://developer.arm.com/documentation/107726/0001/ as part of MIDR_EL1 bit descriptions. This is going to be used in the bbml3 support list. Reviewed-by: Gavin Shan <gshan@redhat.com> Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com> Signed-off-by: Linu Cherian <linu.cherian@arm.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-08-06wifi: nxpwifi: bound uAP association event IEs to the event bufferLinmao Li
nxpwifi_uap_event_sta_assoc() exposes the association request IEs that the firmware reports in the uAP association event, which the driver copies into the fixed-size event_body[] buffer. event->len is supplied by firmware and is not validated. A value smaller than the header underflows the subtraction used for assoc_req_ies_len, while a larger value can make the IE range extend beyond event_body[]. Subsequent IE parsing can then read past the adapter object. Validate both bounds before using the firmware-reported length. nxpwifi was derived from mwifiex before commit f0858bfc7d3c ("wifi: mwifiex: bound uAP association event IEs to the event buffer") and retains the same unchecked length. Apply the equivalent bounds check here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Reviewed-by: Jeff Chen <jeff.chen_1@nxp.com> Link: https://patch.msgid.link/20260729082457.1897303-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxpwifi: detach sync command buffer on interrupted waitLinmao Li
nxpwifi synchronous commands keep the caller-provided data buffer in cmd_node->data_buf. Several callers pass stack-allocated objects there, for example nxpwifi_get_chan_type() and the timeshare_coex debugfs handlers. If wait_event_interruptible_timeout() is interrupted or times out, the caller can return and release that stack object while the command is still current. nxpwifi_cancel_all_pending_cmd() deliberately keeps the current command because a response may still arrive. A late firmware response can then write through cmd_node->data_buf into the stale stack address. After cancelling pending commands, detach the caller-owned buffer from the still-current command under nxpwifi_cmd_lock. Unlike the host command response path, several command response callbacks do not tolerate a NULL data buffer. Most of them ignore it or check it already, but nxpwifi_ret_sta_get_chan_info(), nxpwifi_ret_sta_hs_wakeup_reason() and nxpwifi_ret_sta_robust_coex() dereference it unconditionally, so let them discard a detached response. No caller passes a NULL buffer to these commands today, so this only affects the newly introduced detached state. nxpwifi was derived from mwifiex before commit ef06882c7d8a ("wifi: mwifiex: Detach sync cmd buffer on interrupted wait") and retains the same lifetime bug. Apply the equivalent buffer detachment here. Fixes: 73b01e57ed3e ("wifi: nxp: add nxpwifi driver for IW61x") Signed-off-by: Linmao Li <lilinmao@kylinos.cn> Link: https://patch.msgid.link/20260729124713.2849018-1-lilinmao@kylinos.cn Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: brcmfmac: Fix memory leak in brcmf_sdio_read_control()Abdun Nihaal
The memory allocated for buf is not freed in some of the error paths in brcmf_sdio_read_control(). Fix that by adding vfree() calls. Cc: stable@vger.kernel.org Fixes: dd43a01c5cdb ("brcmfmac: use dynamically allocated control frame buffer") Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in> [arend: rework as suggested by Johannes] Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com> Link: https://patch.msgid.link/20260803093506.1647790-1-arend.vanspriel@broadcom.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: rsi: Fix types to appease CFIStefan Hansson
Avoids errors like: CFI failure at kthread+0x124/0x1cc (target: rsi_coex_scheduler_thread+0x0/0x1b4 [redpine_91x]; expected type: 0x89fb613d) As seen in the aforementioned error this was tested using the downstream redpine_91x driver found in the Librem 5's downstream source tree. However, it appears that this driver is a modified version of the rsi driver found in mainline Linux and as such I decided to port the changes here too. Signed-off-by: Stefan Hansson <newbyte@postmarketos.org> Link: https://patch.msgid.link/20260804-rsi-cfi-fix-v2-1-59679a520240@postmarketos.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: mac80211: skip default WMM setup for AP_VLAN linksFelix Fietkau
AP_VLAN interfaces are never passed to the driver, so setting default WMM parameters on their links trips the check-sdata-in-driver warning in drv_conf_tx(), as well as in the BSS_CHANGED_QOS link info notification. Skip it, matching the existing AP_VLAN handling in this function. Fixes: 2259d14499d1 ("wifi: mac80211: set default WMM parameters on all links") Signed-off-by: Felix Fietkau <nbd@nbd.name> Link: https://patch.msgid.link/20260804082608.2011433-1-nbd@nbd.name Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxpwifi: fix multiple static analysis errors and warningsJeff Chen
Fix various development-phase bugs, code quality, and logical issues reported by the kernel test robot (using the Smatch static analysis tool). The following addressable fixes are included: - 11n.c & 11ax.c: Fix potential NULL pointer dereferences by correcting logical operators (&& to ||) in 11n.c and hoisting the bss_desc verification to the top of the function in 11ax.c. - 11n.c: Fix a severe Use-After-Free (UAF) memory corruption during RCU list traversal. Restore the proper list_for_each_entry_safe() loop structure along with the required array index [i] within the locked writer path. - sdio.c: Fix a missing unwind resource cleanup pathway where a protocol error branch returned directly via -EINVAL instead of using 'goto term_cmd', leaving the SDIO hardware state machine out of sync. - main.h: Fix a signedness mismatch bug where nxpwifi_get_unused_bss_num() could return -2 as an unsigned integer fallback. - util.c: Remove a redundant and dead condition check (position <= 15) which was always true for a 4-bit unsigned bit-field member variable. - cfg80211.c: Clean up a dead unreachable 'return 0' at the bottom of the switch-case logic. - uap_txrx.c: Clean up mismatched and inconsistent indentations within the handling of multicast RX forward paths. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202608020855.QwN5n7i5-lkp@intel.com/ Assisted-by: Gemini:unknown-model Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com> Link: https://patch.msgid.link/20260803162741.438820-1-chunfan.chen@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06regcache: Sort the local copy of an unsorted reg_defaults arrayPeter Ujfalusi
regcache_lookup_reg() bsearch()es the reg_defaults array, which requires it to be sorted by ascending register address. Entries following a descending step are never found, so regcache_reg_needs_sync() reports that they need a sync and they are written to the device on every regcache_sync() even when they were never touched. Detect the misordering while reg_defaults is validated against the register stride and sort the local copy. The check needs no new loop and sort() only runs for the affected drivers, which are also warned about. Note that sort() is not stable, so for arrays with duplicated register addresses it remains unspecified which entry is found. Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Tested-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260805132250.2637-1-peter.ujfalusi@linux.intel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-06wifi: morsemicro: MM81X should be invisible and selected by its usersGeert Uytterhoeven
Morse Micro MM81x wireless devices can have either SDIO or USB interfaces. Hence there is no point in asking the user about these devices when configuring a kernel without MMC or USB support. Fix this by making the core driver symbol invisible, and selecting it by its users when needed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/3415bda97c2faf7c56eff7fe79a91b218d0d6731.1786010705.git.geert+renesas@glider.be Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06wifi: nxp: NXPWIFI should be invisible and selected by its usersGeert Uytterhoeven
All supported NXP WiFi wireless adapters have an SDIO interface. Hence there is no point in asking the user about these adapters when configuring a kernel without MMC support. Fix this by making the core driver symbol invisible, and selecting it by its user when needed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/aefb37d8398175cb2fb520cb5f725a85bcd3049d.1786010763.git.geert+renesas@glider.be Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-08-06Merge tag 'ath-next-20260803' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.3 (PR #2) For ath12k, add MultiPD support for AHB platforms. Other than that, just an assortment of cleanups and minor bug fixes across ath6kl, ath10k, ath11k, and ath12k. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>