summaryrefslogtreecommitdiff
path: root/include
AgeCommit message (Collapse)Author
2026-07-22bitmap: Return size when no zero area is foundYury Norov
Return the bitmap size, rather than size + 1, when bitmap_find_next_zero_area_off() cannot find a suitable area. This matches the conventional find_bit() failure sentinel and still lets callers detect failure with an out-of-range check. Document the public failure contract as a value greater than or equal to the bitmap size, without requiring callers to depend on the exact sentinel. Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22bitmap: drop bitmap_next_set_region()Yury Norov
The function is a dead code. Drop it. Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes()Li RongQing
__nodemask_pr_numnodes() currently returns MAX_NUMNODES as the field width for '%*pb[l]' nodemask printing. MAX_NUMNODES is a compile-time upper bound and can be much larger than the runtime node id range, resulting in excessive zero padding in bitmap-form output. For example, /proc/<pid>/status prints Mems_allowed with '%*pb' using the nodemask_pr_args() helper. On systems built with MAX_NUMNODES=1024 but booted with a much smaller possible-node range, this produces: Mems_allowed: 00000000,00000000,...,00000003 Switch to nr_node_ids, matching the behavior of cpumask_pr_args() which uses nr_cpu_ids. This reduces the output width from MAX_NUMNODES bits to the runtime node id range: Mems_allowed: 3 Visible impact on in-tree users: - Bitmap format ('%*pb') users: * /proc/<pid>/status Mems_allowed (format changes as shown above) - List format ('%*pbl') users, output is unchanged, as list formatter only prints set bit ranges: * /sys/devices/system/node/{possible,online,has_normal_memory, ...} * NVMe multipath sysfs numa_nodes * memory tier sysfs nodelist * cpuset cgroup mems and effective_mems files * /proc/<pid>/status Mems_allowed_list * mempolicy strings in /proc/<pid>/numa_maps * SLUB debugfs output * Kernel log messages printing nodemasks Move nr_node_ids and nr_online_nodes declarations earlier in the file to allow __nodemask_pr_numnodes() to use nr_node_ids. Cc: Yury Norov <yury.norov@gmail.com> Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk> Cc: Andrew Morton <akpm@linux-foundation.org> Cc: linux-mm@kvack.org Signed-off-by: Li RongQing <lirongqing@baidu.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22lib/bitmap-str: get rid of cpumap_print_to_pagebuf()Yury Norov
Now that all users of the function are switched to the alternatives, drop the function. Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22bitops: make the *_bit_le functions use unsigned longBenjamin Marzinski
The *_bit_le functions use a signed integer for the bit number. However, the *_bit functions can use an unsigned long. This causes problems if there is a large bitmap and a bit number > 0x80000000 is passed in. Since that is a negative int, it will get sign extended to a long when getting passed to the *_bit function, turning it into a huge bit number. This usually ends up with the memory address wrapping around and the function accessing memory before the start of the bitmap. Avoid this by making the *_bit_le functions take an unsigned long. This can be triggered by faking an almost 4TB dm-mirror device, which uses bitmaps to track the mirror regions: $ dmsetup create bigzero --table '0 8589934590 zero' $ dmsetup create mymirror --table '0 8589934590 mirror core 2 2 nosync 2 /dev/mapper/bigzero 0 /dev/mapper/bigzero 0' This will access memory before the start of the sync_bits bitmap, and likely hit the guard page of the previously allocated clean_bits bitmap, causing a kernel panic with the old code. I looked and didn't see any crazy code using the signed int to intentionally try and access bits before some address within the bitmap. Signed-off-by: Benjamin Marzinski <bmarzins@redhat.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22bitmap: Replace __ASSEMBLY__ with __ASSEMBLER__ in header filesThomas Huth
While the GCC and Clang compilers already define __ASSEMBLER__ automatically when compiling assembly code, __ASSEMBLY__ is a macro that only gets defined by the Makefiles in the kernel. This can be very confusing when switching between userspace and kernelspace coding, or when dealing with uapi headers that rather should use __ASSEMBLER__ instead. So let's standardize now on the __ASSEMBLER__ macro that is provided by the compilers. This is a completely mechanical patch (done with a simple "sed -i" statement). Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Yury Norov <ynorov@nvidia.com>
2026-07-22lib/crypto: aes: Add CCM supportEric Biggers
Add support for AES-CCM to the crypto library. This will be used to provide a streamlined implementation of the "ccm(aes)" crypto_aead algorithm. Most users of "ccm(aes)" will also be able to switch to the library, which as usual will be faster and simpler, e.g.: - fs/smb/client/ - fs/smb/server/ - net/mac80211/ - net/mac802154/ (I've already written proof-of-concept patches for all the above, and they helped inform the API design.) As in the AES-GCM API, incremental operation is supported. It has to be used carefully, especially when decrypting, but it makes the API general enough to work well for all users. The AES-CCM library code calls aes_cbcmac_blocks() directly, bypassing the higher-level aes_cbcmac_init(), aes_cbcmac_update(), and aes_cbcmac_final(). The latter set of functions is useful only for AES-CCM, so they don't make sense to keep around and will be removed once the "ccm(aes)" crypto_aead starts using the AES-CCM library. Initial test coverage is provided by the crypto_aead support added in a later commit. I'm planning a KUnit test suite as well. Link: https://patch.msgid.link/20260715221153.246410-8-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-22lib/crypto: aes: Add GCM supportEric Biggers
Add support for AES-GCM to the crypto library. This will be used to provide streamlined implementations of the "gcm(aes)" and "rfc4106(gcm(aes))" crypto_aead algorithms. Most users of these will also be able to switch to the library, which as usual will be faster and simpler, e.g.: - drivers/net/macsec.c - fs/smb/client/ - fs/smb/server/ - net/ceph/messenger_v2.c - net/mac80211/ (for both GMAC and GCMP) - net/tipc/crypto.c - security/keys/trusted-keys/trusted_dcp.c (I've already written proof-of-concept patches for all the above, and they helped inform the API design.) As usual, the architecture-optimized AES-GCM code will be migrated into the library as well (using the hooks provided in this commit as well as the GHASH ones), eliminating lots of repetitive boilerplate code. Incremental en/decryption is supported. Incremental operation is a bit controversial in AEAD APIs because users have to be careful not to consume any decrypted data that hasn't been authenticated yet. But I do think it's the right choice here. It's not fundamentally different from the existing incremental MAC APIs, and it's the only approach that's general enough to work well for all users in the kernel: - An array of virtually-addressed buffers (like that used by BoringSSL's EVP_AEAD_CTX_sealv() and EVP_AEAD_CTX_openv()) doesn't work in the kernel in general, since in some cases the data for a single AES-GCM message is contained in a large number of highmem pages that each need to be mapped into memory individually. That can be done efficiently only by using CPU-local mappings, but there is a limited number of those. Ceph messenger v2 is a great example, as it can send or receive up to 32 MiB in a single AES-GCM message. And it needs the en/decrypted data to go into a (potentially large) number of bvecs provided by a custom iterator, as well as into four virtually-addressed buffers, two of which can be large buffers in the vmalloc region. Even just allocating an array big enough to store all the pointers can be problematic in the kernel. There are cases in which decryption runs in GFP_NOIO context or even in softirq context, where memory allocations are not as reliable as they normally are. - Meanwhile, 'struct scatterlist' (the choice of crypto_aead) has turned out to be really inconvenient for anyone who *does* just have virtually-addressed buffers. This is especially true if they can be in the vmalloc region, including the stack, as in that case the conversion to a scatterlist has to be done page-by-page. And even for users who have all of their data in bare 'struct page', none of them actually use 'struct scatterlist' as their native data structure anyway. They actually use skbs, bvecs, or other formats. - iov_iter is attractive, but ultimately not general enough either (considering the Ceph case for example), but also too general in some ways (like having support for userspace addresses). Additional iter types like ITER_SKB would help a bit, but bloating iov_iter with more types would reduce performance elsewhere in the kernel. Initial test coverage is provided by the crypto_aead support added in a later commit. I'm planning a KUnit test suite as well. Link: https://patch.msgid.link/20260715221153.246410-7-ebiggers@kernel.org Link: https://patch.msgid.link/20260722021730.16897-1-ebiggers@kernel.org Signed-off-by: Eric Biggers <ebiggers@kernel.org>
2026-07-22netfilter: nf_conntrack_expect: add and use nf_ct_expect_related_pair()Pablo Neira Ayuso
Add a new function to insert a pair of expectations, this is required by the SIP and H323 NAT helpers. The spinlock is held to check if there is a slot for both expectations, in such case, insert them. This removes the need for nf_ct_unexpect_related() inside the loop to find a pair of consecutive ports, otherwise inserting expectations whose dead flag is already set on can happen. Bump master_help->expecting for the expectation class after checking if the expectation fits in the master expectation list, which is needed for this new _pair() function variant to run the eviction routine including the preallocated slot for the first expectation in the pair. Fixes: b8b09dc2bf35 ("netfilter: nf_conntrack_expect: use conntrack GC to reap expectations") Reported-by: Jaeyeong Lee <iostreampy@proton.me> Link: https://patch.msgid.link/178377968720.33756.12204817361601593230@proton.me/ Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-22netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()Xiang Mei
sip_help_tcp() stores the size change of each NAT-rewritten SIP message in s16 diff and accumulates it in s16 tdiff, but a single message can grow by more than S16_MAX while the packet stays under the 65535 enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long Contact list expands the message by tens of kilobytes. diff then wraps, and "datalen = datalen + diff - msglen" yields a huge unsigned datalen, so the next iteration's ct_sip_get_header() reads past the linearized skb tail. Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the 65535 byte packet limit, and the seqadj core is already s32 (nf_ct_seqadj_set() takes s32), so no previously accepted input is rejected. BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25 ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464) sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694) nf_confirm (net/netfilter/nf_conntrack_proto.c:183) nf_hook_slow (net/netfilter/core.c:619) ip6_output (net/ipv6/ip6_output.c:246) ip6_forward (net/ipv6/ip6_output.c:690) ipv6_rcv (net/ipv6/ip6_input.c:351) __netif_receive_skb_one_core (net/core/dev.c:6212) process_backlog (net/core/dev.c:6676) __napi_poll (net/core/dev.c:7735) net_rx_action (net/core/dev.c:7955) handle_softirqs (kernel/softirq.c:622) run_ksoftirqd (kernel/softirq.c:1076) ... Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support") Reported-by: Weiming Shi <bestswngs@gmail.com> Link: https://patch.msgid.link/netfilter-devel/20260712234201.3213635-1-xmei5@asu.edu Assisted-by: Claude:claude-opus-4-8 Signed-off-by: Xiang Mei <xmei5@asu.edu> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-07-22Merge tag 'for-net-2026-07-21' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth Luiz Augusto von Dentz says: ==================== bluetooth pull request for net: - hci_sync: Protect UUID list traversal - RFCOMM: Fix session UAF in set_termios - btusb: validate Realtek vendor event length * tag 'for-net-2026-07-21' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: Bluetooth: btusb: validate Realtek vendor event length Bluetooth: RFCOMM: Fix session UAF in set_termios Bluetooth: hci_sync: Protect UUID list traversal ==================== Link: https://patch.msgid.link/20260721160240.884274-1-luiz.dentz@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22Merge tag 'ath-next-20260722' of ↵Johannes Berg
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.3 (PR #1) There has been quite a bit of activity across the ath drivers. Significant changes in ath12k include: Align with new Qualcomm generic Peripheral Authentication Service (PAS). Ongoing infrastructure changes to support the QCC2072 platform. Ongoing infrastructure changes to support the IPQ5332 platform. Enhance datapath statistics. Tuning of datapath parameters. In addition, an assortment of cleanups and minor bug fixes across ath6kl, ath10k, ath11k, ath12k, and carl9170. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-22fs: add iput_if_not_last() helperYun Zhou
Add a helper that drops an inode reference only if the caller does not hold the last one. Returns true if the reference was dropped, false otherwise. This is useful for filesystems that need to release inode references in contexts where triggering final iput (and thus eviction) would be unsafe due to lock ordering constraints. The caller can check the return value and defer the final iput to a safe context. Unlike iput_not_last() which BUG_ON's if called with the last ref, this variant is designed to be called speculatively. Signed-off-by: Yun Zhou <yun.zhou@windriver.com> Suggested-by: Jan Kara <jack@suse.cz> Suggested-by: Mateusz Guzik <mjguzik@gmail.com> Reviewed-by: Jan Kara <jack@suse.cz> Reviewed-by: Christian Brauner (Amutable) <brauner@kernel.org> Tested-by: syzbot@syzkaller.appspotmail.com Link: https://patch.msgid.link/20260710030851.2791589-2-yun.zhou@windriver.com Signed-off-by: Theodore Ts'o <tytso@mit.edu>
2026-07-22io_uring/zcrx: rename notif to eventPavel Begunkov
"Notification" is too long and the abbreviated version is used in several places, which is inconsistent and more ambiguous for users. Rename it to event, which is easier to keep consistent. To keep the change small, only change uapi/ + do necessary fix ups, and the rest of internals can be adjusted in the next release. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/f95ca6717da3c8d3649a1a7f0d883a563f545052.1784726895.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-22io_uring/zcrx: rename ZCRX_NOTIF_NO_BUFFERSPavel Begunkov
ZCRX_NOTIF_NO_BUFFERS tells when page pool fails to allocate memory from zcrx. "No buffers" could be more confusing, rename it to ZCRX_NOTIF_ALLOC_FAIL. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/29bd4fc069bc89691868beba0627ffbe570c2722.1784726895.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-22io_uring/zcrx: drop "notif" from stats struct namesPavel Begunkov
Keep zcrx statistics generic and don't stick "notif" to its uapi definitions. Stats dosn't need to be bound to notification details, it makes it cleaner and more readable. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/6a39676b6f71b67d3f89c6ebab7a3739873834a3.1784726895.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk>
2026-07-22bpf, x86: Make sure allocation in arch_bpf_trampoline_size() is writableMike Rapoport (Microsoft)
arch_bpf_trampoline_size() allocates a buffer to get actual size required for a trampoline. This buffer must be in the module address space because __arch_prepare_bpf_trampoline() calculates rel32 offsets relatively to that buffer. In preparation for enabling ROX mode for EXECMEM_BPF make sure that the allocated memory is writable. Add bpf_jit_alloc_exec_rw() wrapper for execmem_alloc_rw() and use it for buffer allocation in arch_bpf_trampoline_size(). Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Acked-by: Song Liu <song@kernel.org> Link: https://lore.kernel.org/bpf/20260716-execmem-x86-rox-bpf-v0-v3-4-4e76158c01c5@kernel.org Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-22seg6: add FIB table attribute for post-encap SID route lookupAndrea Mayer
After SRv6 encapsulation the kernel looks up the route for the first SID, that is the outer IPv6 destination of the encapsulated packet. This post-encap SID route lookup uses the FIB table of the current routing context. When the encap route is installed in a VRF, the VRF's table may not have a route matching the SID. In that case another table should handle it, e.g. one configured for underlay connectivity. Add an optional SEG6_IPTUNNEL_TABLE attribute that selects the FIB table used for this lookup. When set by the user, the attribute is honored on both the input path (forwarded traffic) and the output path (locally originated traffic). SRv6 encap routes that do not set the attribute use the current routing context, as before. For example: # SID route installed in the underlay table 500 ip -6 route add fc00::100/128 via fd00::1 dev veth0 table 500 # encap route in vrf-100; the first SID is looked up in table 500 ip -6 route add cafe::1/128 vrf vrf-100 \ encap seg6 mode encap segs fc00::100 lookup 500 dev veth0 # or look up the SID in the main table ip -6 route add cafe::1/128 vrf vrf-100 \ encap seg6 mode encap segs fc00::100 lookup main dev veth0 Suggested-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it> Reviewed-by: Nicolas Dichtel <nicolas.dichtel@6wind.com> Acked-by: David Ahern <dsahern@kernel.org> Link: https://patch.msgid.link/20260711162907.6521-2-andrea.mayer@uniroma2.it Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-22ASoC: qcom: qdsp6: Remove unused Q6AFE_MAX_CLK_ID definePrasad Kumpatla
Q6AFE_MAX_CLK_ID is not used anywhere. Remove the unused define. Signed-off-by: Prasad Kumpatla <prasad.kumpatla@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Link: https://patch.msgid.link/20260722111655.3558096-1-prasad.kumpatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-22wifi: cfg80211: say why the auth/assoc BSS lookup failedLouis Kotze
The BSS lookup for an authentication or association request can fail for three distinct reasons: cfg80211 has no scan entry at all for the BSSID/channel, an entry exists but is older than IEEE80211_SCAN_RESULT_EXPIRE (and not held), or a fresh entry exists but its use_for flags do not allow this use. All three currently surface as the same generic extack message "Error fetching BSS for link" on the MLO association path, and as a bare -ENOENT with no message at all on the authentication and non-MLO association paths. Since wpa_supplicant logs the extack message verbatim ("nl80211: kernel reports: ..."), that message is often the only diagnostic a user sees when an MLO association degrades to fewer links, and it does not say whether a fresh scan could have helped. In practice the expired case is common for MLO partner links: 6 GHz is passive-scan in many regulatory domains, so the partner-link entry is routinely stale by the time userspace requests the association even though the link is perfectly usable. Let __cfg80211_get_bss() take an optional extack and record, during the same bss_lock walk that fails the lookup, whether any matching entry was rejected for being expired or for not being usable for the requested use, and set a distinct message for each case (and a combined one when different entries were rejected for different reasons). Reorder the checks in the walk so that an entry's identity (type, privacy, channel, BSSID/SSID) is established before the usability checks; this doesn't change which entry is returned since an entry is only used when all checks pass. Also give the -EINVAL paths in nl80211_assoc_bss() proper messages while at it, and keep pointing the bad_attr at the failing link on the MLO path there; the message for that case is already set by the lookup itself. Signed-off-by: Louis Kotze <loukot@gmail.com> Link: https://patch.msgid.link/20260722070734.3612581-2-loukot@gmail.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-22wifi: mac80211: implement STA-mode peer probingPriyansha Tiwari
Add STA/P2P-client support to ieee80211_probe_peer(): when called for a station interface, send a null-data frame (TODS) to the associated AP and report the ACK via cfg80211_probe_status(). For MLO connections the driver/firmware selects the link (IEEE80211_LINK_UNSPECIFIED); for non-MLO the single link is used. Signed-off-by: Priyansha Tiwari <priyansha.tiwari@oss.qualcomm.com> Link: https://patch.msgid.link/20260709114228.672317-2-pritiwa@qti.qualcomm.com Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-22ACPI: CPPC: Check all controls for fast switchingChristian Loehle
ACPI 6.2, Section 6.2.11.2 permits _CPC registers to use flexible address spaces. Linux advertises that capability through _OSC and parses the address space of each _CPC register independently. A directly accessible DESIRED_PERF combined with PCC-backed limits is therefore a valid configuration. cppc_allow_fast_switch() only checks DESIRED_PERF, although the fast-switch callback passes DESIRED_PERF, MIN_PERF and MAX_PERF to cppc_set_perf(). If a limit uses PCC, that function can sleep while called from scheduler context. Allow fast switching only when every supported control used by the callback has an address space already accepted for fast access. Check the complete policy domain, including initialized CPUs that are currently offline and may later become the policy's managing CPU. Fixes: 658fa7b1c47a ("ACPI: CPPC: Add cppc_get_perf() API to read performance controls") Cc: stable@vger.kernel.org Signed-off-by: Christian Loehle <christian.loehle@arm.com> Link: https://patch.msgid.link/20260722093825.1030594-2-christian.loehle@arm.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-22Merge branch 'big-tcp-for-udp-tunnels'Paolo Abeni
Alice Mikityanska says: ==================== BIG TCP for UDP tunnels This series is a follow-up to "BIG TCP without HBH in IPv6", and it adds support for BIG TCP IPv4/IPv6 workloads in vxlan and geneve. Now that IPv6 BIG TCP doesn't require stripping the HBH in all various combinations in tunneled traffic, adding BIG TCP becomes feasible. Patch 01 adds accessors for the length field in the UDP header, as suggested by Paolo in review. The usage of udp_set_len is then added in the following patches that start using length=0 in BIG TCP UDP packets. Patches 02-04 close the gaps that prevent BIG TCP packets from going through UDP tunnel code. Patch 05 validates packets in udp_gro_receive to exclude packets with length=0 from GRO aggregation. Patch 06 is for proper formatting in tcpdump (set UDP len to 0 rather than a trimmed value on overflow). Patches 07-08 bump up tso_max_size for VXLAN and GENEVE. Patch 09 adds selftests. ====================$ Link: https://patch.msgid.link/20260710134242.216538-1-alice.kernel@fastmail.im Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22net: Use helpers to get/set UDP len tree-wideAlice Mikityanska
Since BIG TCP for UDP tunnels will start using len=0 in the UDP header as an indicator of a GSO packet bigger than 65535 bytes, this commit introduces the following getter and setters to use tree-wide, in order to explicitly mark places where len=0 may be expected, and handle them properly: 1. udp_set_len() sets uh->len to its real value if it's not bigger than 65535, and to 0 otherwise: to be used in GSO context with aggregated packets. 2. udp_set_len_short() is to be used when the length is known to fit 16 bits. It WARNs when the caller tries to assign a bigger value if CONFIG_DEBUG_NET=y. 3. udp_get_len_short() returns len in host byte order: to be used on the RX side to deal with non-aggregated packets, or to access the raw value of the len field. 4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether the packet is GSO to guard from malformed packets. At the moment udp_set_len() is not used, a following commit will start using it after enabling len>65535 for GSO. Raw uh->len (in network byte order) is still accessed in a few places for checksum calculation purposes, and to decode len=0 in udpv6_rcv for jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP tunnels. Signed-off-by: Alice Mikityanska <alice@isovalent.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Acked-by: Jason A. Donenfeld <Jason@zx2c4.com> Link: https://patch.msgid.link/20260710134242.216538-2-alice.kernel@fastmail.im Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-07-22Merge back ACPI video bus driver changes for 7.3Rafael J. Wysocki
Merge the introduction of acpi_dev_is_video_device() along with some following driver updates related to it (from Andy Shevchenko). * acpi-video: platform/x86: thinkpad_acpi: Convert to use acpi_dev_is_video_device() helper PCI/VGA: Convert to use acpi_dev_is_video_device() helper i2c: acpi: Convert to use acpi_dev_is_video_device() helper ACPI: video: Convert to use acpi_dev_is_video_device() helper ACPI: scan: Convert to use acpi_dev_is_video_device() helper ACPI: utils: Introduce acpi_dev_is_video_device() helper
2026-07-22RDMA/efa: Add Completion Counters supportMichael Margolin
Implement completion counters for the EFA device. Each completion counter is backed by two EFA event counters, one for success completions and one for error completions. The driver creates umem for counters from private descriptor ioctl attributes using core utility. Read operations are not implemented as the counter values are accessed directly from userspace through the mapped memory. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-7-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/core: Add Completion Counters to resource trackingMichael Margolin
Track completion counter objects in the resource tracking database so they are visible through the rdma netlink interface. The rdma tool displays the comp_cntr count in the resource summary. Add RDMA_RESTRACK_COMP_CNTR type, embed rdma_restrack_entry in ib_comp_cntr, and add the res_to_dev mapping. Register the resource on create and remove it on destroy. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-5-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/core: Expose Completion Counter capabilities to userspaceMichael Margolin
Add a dedicated query interface for completion counter capabilities via UVERBS_METHOD_QUERY_COMP_CNTR_CAPS on the device object. The query returns the maximum number of counters, maximum counter value, and a bitmask of supported QP attach operations. Each field is an optional ioctl attribute, allowing userspace to request only the capabilities it needs. Drivers implement the query_comp_cntr_caps operation to report device-specific capabilities. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-4-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/core: Prevent destroying in-use completion countersMichael Margolin
Reject comp_cntr destroy while it is attached to any QP. Track attachments using an xarray in ib_qp keyed by the attach op_mask. Use op bitmask to reject overlapping attaches early. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-3-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/core: Add Completion Counters supportMichael Margolin
Add core infrastructure for Completion Counters, a light-weight alternative to polling CQ for tracking operation completions. Define the UVERBS_OBJECT_COMP_CNTR ioctl object with create, destroy, modify and read methods for both success and error counters. Add a QP attach method on the QP object to associate a completion counter with a queue pair. Add ib_comp_cntr struct, ib_comp_cntr_attach_attr, device ops, and DECLARE_RDMA_OBJ_SIZE for driver object allocation. Only userspace Completion Counters are supported at this stage. Reviewed-by: Yonatan Nachum <ynachum@amazon.com> Signed-off-by: Michael Margolin <mrgolin@amazon.com> Link: https://patch.msgid.link/20260722083603.30334-2-mrgolin@amazon.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/mlx5: move mlx5 clock info to common struct ib_uverbs_clock_infoAbhijit Gangurde
Use struct ib_uverbs_clock_info from ib_user_verbs.h for clock info. Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260610154216.712374-6-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22RDMA/ionic: map PHC state into user spaceAbhijit Gangurde
Enable user space applications to access the PHC state page when firmware RDMA completion timestamp is supported. This mapping allows user space to convert RDMA completion timestamps to system wall time without kernel transitions, minimizing latency overhead. Applications can directly read the PHC state through mmap, enabling efficient timestamp correlation for precision timing applications. Co-developed-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260610154216.712374-4-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-22net: ionic: Add PHC state page for user space accessAbhijit Gangurde
Add a page associated with the PHC that can be mapped to user space, allowing applications to access hardware timestamp information. In order to synchronize between kernel and user space, a sequence number is incremented at the beginning and end of each update. An odd number means the data is being updated while an even number means the update is complete. To guarantee that the data structure was accessed atomically, user space will: repeat: seq1 = <read sequence> goto <repeat> if odd <read PHC state> seq2 = <read sequence> if seq1 != seq2 goto repeat This mechanism acts as a guard against reading invalid state during concurrent updates. Co-developed-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Allen Hubbe <allen.hubbe@amd.com> Signed-off-by: Abhijit Gangurde <abhijit.gangurde@amd.com> Link: https://patch.msgid.link/20260610154216.712374-3-abhijit.gangurde@amd.com Signed-off-by: Leon Romanovsky <leon@kernel.org>
2026-07-21perf/arm_pmu: Skip PMCCNTR_EL0 on NVIDIA OlympusBesar Wicaksono
The PMCCNTR_EL0 in NVIDIA Olympus CPU may increment while in WFI/WFE, which does not align with counting CPU_CYCLES on a programmable counter. Add a MIDR range entry and refuse PMCCNTR_EL0 for cycle events on affected parts so perf does not mix the two behaviors. Also keep PMCCNTR_EL0 unavailable to EL0 direct counter reads on affected CPUs. When userspace counter access is enabled, avoid setting PMUSERENR_EL0.CR for PMUs that must avoid PMCCNTR_EL0, while still allowing direct reads from programmable event counters. For 64-bit userspace CPU_CYCLES events on PMUs without native long event counters, reject the event if the only valid direct-read path would be PMCCNTR_EL0. Signed-off-by: Besar Wicaksono <bwicaksono@nvidia.com> Signed-off-by: Will Deacon <will@kernel.org>
2026-07-21Merge tag 'nxpwifi-2026-07-15' of https://github.com/jeffchen71/nxpwifiJohannes Berg
Jeff Chen says: =============== wifi: nxp: patches for wireless-next In nxpwifi, introduce initial driver support for NXP IW61x Wi-Fi chipsets. The driver supports 802.11ac/ax, SDIO interface, Station and uAP modes. =============== [list the full vendor directory in MAINTAINERS] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21wifi: mac80211: parse enhanced critical updates fieldJohannes Berg
For association and link reconfiguration response, parse and store the enhanced BSS parameter change counter out of the enhanced critical updates field in the multi-link common info or per-STA profile. These are required for UHR connections. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260714134154.adb9fc29252d.I625580fbadbbf4a1440d88d3675586477f1a3263@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21ACPI: pmtmr: Convert to kernel-doc formatRandy Dunlap
Prevent kernel-doc warnings by converting 2 functions to kernel-doc format: Warning: ./include/linux/acpi_pmtmr.h:29 This comment starts with '/**', but isn't a kernel-doc comment. * Register callback for suspend and resume event Warning: ./include/linux/acpi_pmtmr.h:37 This comment starts with '/**', but isn't a kernel-doc comment. * Remove registered callback for suspend and resume event Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260720032341.3087008-3-rdunlap@infradead.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-21ACPI: bus: Use correct struct member namesRandy Dunlap
Avoid kernel-doc warnings by using the correct struct member names: Warning: ./include/acpi/acpi_bus.h:429 struct member 'crs_csi2_local' not described in 'acpi_device_software_node_port' Warning: ./include/acpi/acpi_bus.h:429 Excess struct member 'crs_crs2_local' description in 'acpi_device_software_node_port' Warning: ./include/acpi/acpi_bus.h:445 struct member 'nodeptrs' not described in 'acpi_device_software_nodes' Warning: ./include/acpi/acpi_bus.h:445 Excess struct member 'nodeprts' description in 'acpi_device_software_nodes' Signed-off-by: Randy Dunlap <rdunlap@infradead.org> Link: https://patch.msgid.link/20260720032341.3087008-2-rdunlap@infradead.org Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-21power: supply: leds: create triggers based on properties, not typeSteffen Dirkwinkel
Currently only battery power supplies get triggers for other properties and other supplies only get the online trigger. This changes it to provide the triggers for any power supply depending on what properties are available. Batteries will still get the same triggers if the properties are there, but now other power supplies can get the triggers too. Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com> Link: https://patch.msgid.link/20260625-std-power-supply-triggers-v1-1-d80db570d329@beckhoff.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21power: supply: Add PbAc, NiZn, RAM, and ZnAr supportBoris Shtrasman
Add four new members to the POWER_SUPPLY_TECHNOLOGY enum and sysfs interface to represent the Smart Battery Data Specification v1.1 (Section 5.1.30 DeviceChemistry) battery types: - Lead Acid (PbAc) - Nickel Zinc (NiZn) - Rechargeable Alkaline-Manganese (RAM) - Zinc Air (ZnAr) Update documentation to express these types. Update ABI testing for these types. Link: https://sbs-forum.org/specs/sbdat110.pdf Signed-off-by: Boris Shtrasman <borissh1983@gmail.com> Link: https://patch.msgid.link/20260624135718.286771-2-borissh1983@gmail.com Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
2026-07-21ACPI: NHLT: Remove always included kconfig.hAndy Shevchenko
The inclusion of <linux/kconfig.h> is unneeded as it's guaranteed by the build starting from the commit 2a11c8ea20bf ("kconfig: Introduce IS_ENABLED(), IS_BUILTIN() and IS_MODULE()"). Remove it here. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Link: https://patch.msgid.link/20260717171635.1783543-1-andriy.shevchenko@linux.intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-07-21ALSA: hda: Add AW88399 HDA side codec driver for Lenovo LegionMark Brown
Marco Giunta <marco_giunta@outlook.it> says: Several Lenovo Legion laptops (Pro 7i 16IAX10H, Y9000P IAX10, Pro 7 16AFR10H, R9000P ADR10) use AWINIC AW88399 smart amplifiers to drive their bass woofers, connected via I2C as side codecs to a Realtek ALC287 HDA codec. Without a driver for these amplifiers, only the tweeters produce sound, resulting in quiet and tinny audio. An ASoC driver for the AW88399 already exists in-tree (sound/soc/codecs/aw88399.c), contributed by AWINIC, but it targets ASoC topologies and cannot drive the chip when it sits behind an HDA controller. This series adds a proper HDA side codec driver, following the established pattern used by the CS35L41, CS35L56, and TAS2781 drivers. Patch 1 extracts the device-level functions from the existing ASoC driver into a shared library module (SND_SOC_AW88399_LIB) with a shared header at include/sound/aw88399.h, following the CS35L41 precedent (SND_SOC_CS35L41_LIB / include/sound/cs35l41.h). This avoids a build-time dependency on the full ASoC codec module and ensures clean separation between the ASoC and HDA drivers. Patches 2 through 5 prepare the shared library for use on ACPI-based HDA systems: patch 2 extends channel assignment to work without Device Tree properties, patch 3 adds a per-instance flag to bypass an unreliable hardware status bit on certain boards, patch 4 adds a firmware reload flag so that the HDA driver can signal that DSP firmware needs to be re-uploaded after system sleep, and patch 5 adds a channel setter so that the HDA driver can configure the amplifier without depending on ASoC-internal device headers. NOTE ON FIRMWARE: This driver requires the firmware file aw88399_acf.bin, which uses the same format and request path as the existing ASoC driver. This firmware is not yet available in the linux-firmware repository. We intend to coordinate with the AWINIC maintainers (CC'd) to arrange its inclusion. In the meantime, users can extract the firmware from the Windows driver and place it in /lib/firmware/. This work builds on the initial driver development by Yakov Till ("Lyapsus") and the bounty effort organized by Nadim Kobeissi: https://github.com/nadimkobeissi/16iax10h-linux-sound-saga Link: https://patch.msgid.link/DS7PR19MB77247D9AD698CF0FF37DB58BFCC62@DS7PR19MB7724.namprd19.prod.outlook.com
2026-07-21bpf: Extract the is_struct_ops_tramp helperPu Lehui
Extract the is_struct_ops_tramp helper, and use it in riscv as the current checks are somewhat hacky. Signed-off-by: Pu Lehui <pulehui@huawei.com> Reviewed-by: Björn Töpel <bjorn@kernel.org> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/bpf/20260708064436.2971933-2-pulehui@huaweicloud.com Signed-off-by: Kumar Kartikeya Dwivedi <memxor@gmail.com>
2026-07-21ASoC: aw88399: add channel setter for HDA side codecMarco Giunta
Add aw88399_dev_set_channel() to the shared library so that the HDA side codec driver can set the amplifier's channel assignment without including the aw88395 device header directly. The AW88399's struct aw_device is defined in aw88395_device.h, which lives under sound/soc/codecs/aw88395/. Without this accessor, the HDA driver would need a cross-subsystem relative include path to access the channel field. Providing a setter in the library keeps the interface clean and avoids coupling the HDA driver to ASoC-internal headers. Tested-by: Nadim Kobeissi <nadim@symbolic.software> Tested-by: Xia Yun'an <imitoy@imitoy.top> Tested-by: Munzir Taha <munzirtaha@gmail.com> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/DS7PR19MB7724E8A1AD36D1E623FA2A0AFCC62@DS7PR19MB7724.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: aw88399: add firmware reload flag for resumeMarco Giunta
Add a fw_needs_reload flag to struct aw88399 that, when set, causes aw88399_start to perform a full DSP firmware upload instead of assuming the firmware binary is already present in memory. After system sleep, the AW88399 loses its memory contents. The existing start sequence assumes the firmware binary persists from initialization and only uploads register configuration and DSP config (AW88399_DSP_FW_UPDATE_OFF). When memory is empty, this causes the subsequent CRC check to fail, triggering the retry mechanism in aw88399_start_pa which re-uploads the firmware on the second attempt. While the retry mechanism recovers correctly, it produces misleading error-level log messages on every resume cycle. The fw_needs_reload flag allows the HDA side codec driver to signal that a full firmware reload is needed after resume, eliminating the spurious CRC failures. The flag defaults to false via kzalloc, preserving the original behavior for existing ASoC users. No existing code path sets this flag; it will be set by the HDA side codec driver's system suspend handler. Tested-by: Nadim Kobeissi <nadim@symbolic.software> Tested-by: Xia Yun'an <imitoy@imitoy.top> Tested-by: Munzir Taha <munzirtaha@gmail.com> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/DS7PR19MB77240CB79188C0B7AE243829FCC62@DS7PR19MB7724.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: aw88399: add per-instance BSTS status bypass flagMarco Giunta
Add a bsts_unreliable flag to struct aw88399 that, when set, causes the startup status check (aw_dev_check_sysst) to skip the BSTS (boost startup finished) requirement. On some hardware, the BSTS bit in the SYSST register (0x01, bit 9) does not reliably assert even during normal audio playback. Register inspection on affected Lenovo Legion hardware shows both amplifiers reporting BSTS=0 on both channels despite clean audio output. Per the AW88399 datasheet, BSTS indicates boost startup completion. If BSTS never reliably sets to 1, the chip is never allowed to start by aw_dev_check_sysst, regardless of whether the boot failure is genuine. The new flag defaults to false via kzalloc, preserving the original check behavior for all existing users. No existing code path sets this flag; it will be set by the forthcoming HDA side codec property driver for affected hardware. Tested-by: Nadim Kobeissi <nadim@symbolic.software> Tested-by: Xia Yun'an <imitoy@imitoy.top> Tested-by: Munzir Taha <munzirtaha@gmail.com> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/DS7PR19MB77242B8E5BB8BFB5E69816E9FCC62@DS7PR19MB7724.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21ASoC: aw88399: extract shared device libraryMarco Giunta
Extract the device-level functions from aw88399.c into a new shared library module (aw88399-lib.c) with a shared header at include/sound/aw88399.h, following the pattern established by CS35L41 (cs35l41-lib.c / include/sound/cs35l41.h) for chips that need both ASoC and HDA drivers. The shared header at include/sound/aw88399.h contains the register definitions, bit-field masks, hardware constants, device enums, the struct aw88399 definition, and the library function declarations. The ASoC-private header at sound/soc/codecs/aw88399.h is reduced to ASoC-specific definitions (PCM formats/rates, ALSA kcontrol helpers, calibration constants) and includes the shared header. The library contains the chip initialization, firmware loading, playback start/stop sequences, and all their internal dependencies (PLL checks, DSP management, volume control, calibration, CRC verification, etc.). The ASoC codec driver retains the ALSA controls, DAPM widgets, codec probe/remove, calibration service, and I2C bus driver registration. A new Kconfig symbol SND_SOC_AW88399_LIB is introduced. SND_SOC_AW88399 (the existing ASoC codec) selects it, ensuring no change for current users. The HDA side codec driver (introduced later in this series) selects the library without pulling in the full ASoC codec module. This avoids a build-time dependency on the full ASoC driver and follows the established pattern used by CS35L41 (SND_SOC_CS35L41_LIB) for chips with both ASoC and HDA drivers. Some library functions (DSP control, volume setting, mute, calibration updates, profile management, and status helpers) are used internally by the library's start/stop sequences but are also called directly by the ASoC driver's remaining code. These are exported from the library so the ASoC module can access them. This is a pure code movement with no functional changes. The moved functions are identical to their originals in aw88399.c. Tested-by: Nadim Kobeissi <nadim@symbolic.software> Tested-by: Xia Yun'an <imitoy@imitoy.top> Tested-by: Munzir Taha <munzirtaha@gmail.com> Signed-off-by: Marco Giunta <marco_giunta@outlook.it> Link: https://patch.msgid.link/DS7PR19MB772415C485FAF74297673FD7FCC62@DS7PR19MB7724.namprd19.prod.outlook.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-21KVM: arm64: vgic-v3: Kill kvm_vgic_global_state.ich_vtr_el2Marc Zyngier
kvm_vgic_global_state.ich_vtr_el2 is the last bit of caching that we can get rid of. Not as bad as a sysreg access, but still worse than a constant. Move over to the inlined stuff and remove the cached value. Signed-off-by: Marc Zyngier <maz@kernel.org> Link: https://patch.msgid.link/20260721170754.3150521-7-maz@kernel.org Signed-off-by: Oliver Upton <oupton@kernel.org>
2026-07-21wifi: use UHR operation field presence bitsJohannes Berg
The spec originally had the idea that the fact that it's a beacon frame determines the (non-)presence of the values, but added presence bits in D1.4. Use those presence bits in addition to the enable bits. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> Link: https://patch.msgid.link/20260715210407.3b1a79b0d002.Iaa762c55b4b6dc63d55f2d7b8b42acd47e640d50@changeid Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-07-21drm/connector: Fix epoch_counter docs to reflect realityNicolas Frattaroli
Since the very day epoch_counter in drm_connector was introduced, its documentation was not accurate. It claims it's used to detect "any other changes [...] besides status", when in reality, it's used to detect changes including status, as a status change also increases the epoch counter. Adjust the documentation to rectify this discrepancy. Fixes: 5186421cbfe2 ("drm: Introduce epoch counter to drm_connector") Reviewed-by: Daniel Stone <daniels@collabora.com> Signed-off-by: Nicolas Frattaroli <nicolas.frattaroli@collabora.com> Link: https://patch.msgid.link/20260526-hot-plug-passup-v10-1-f62351a9ea3e@collabora.com Signed-off-by: Daniel Stone <daniels@collabora.com>