summaryrefslogtreecommitdiff
AgeCommit message (Collapse)AuthorFilesLines
2026-04-08thermal: core: Allocate thermal_class staticallyRafael J. Wysocki1-18/+12
Define thermal_class as a static structure to simplify thermal_init() and to simplify thermal class availability checks that will need to be carried out during the suspend and resume of thermal zones after subsequent changes. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/10831981.nUPlyArG6x@rafael.j.wysocki
2026-04-08thermal: core: Adjust thermal_wq allocation flagsRafael J. Wysocki1-2/+1
The thermal workqueue doesn't need to be freezable or per-CPU, so drop WQ_FREEZABLE and WQ_PERCPU from the flags when allocating it. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> [ rjw: Subject rewrite ] Link: https://patch.msgid.link/3413335.44csPzL39Z@rafael.j.wysocki Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
2026-04-08thermal: core: Drop redundant check from thermal_zone_device_update()Rafael J. Wysocki1-7/+1
Since __thermal_zone_device_update() checks if tz->state is TZ_STATE_READY and bails out immediately otherwise, it is not necessary to check the thermal_zone_is_present() return value in thermal_zone_device_update(). Namely, tz->state is equal to TZ_STATE_FLAG_INIT initially and that flag is only cleared in thermal_zone_init_complete() after adding tz to the list of thermal zones, and thermal_zone_exit() sets TZ_STATE_FLAG_EXIT in tz->state while removing tz from that list. Thus tz->state is not TZ_STATE_READY when tz is not in the list and the check mentioned above is redundant. Accordingly, drop the redundant thermal_zone_is_present() check from thermal_zone_device_update() and drop the former altogether because it has no more users. No intentional functional impact. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/3406806.aeNJFYEL58@rafael.j.wysocki
2026-04-08thermal: core: Free thermal zone ID later during removalRafael J. Wysocki1-2/+4
The thermal zone removal ordering is different from the thermal zone registration rollback path ordering and the former is arguably problematic because freeing a thermal zone ID prematurely may cause it to be used during the registration of another thermal zone which may fail as a result. Prevent that from occurring by changing the thermal zone removal ordering to reflect the thermal zone registration rollback path ordering. Also more the ida_destroy() call from thermal_zone_device_unregister() to thermal_release() for consistency. Fixes: b31ef8285b19 ("thermal core: convert ID allocation to IDA") Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/5063934.GXAFRqVoOG@rafael.j.wysocki
2026-04-08thermal: core: Fix thermal zone governor cleanup issuesRafael J. Wysocki1-3/+4
If thermal_zone_device_register_with_trips() fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which may lead to a memory leak. In turn, thermal_zone_device_unregister() calls thermal_set_governor() without acquiring the thermal zone lock beforehand which may race with a governor update via sysfs and may lead to a use-after-free in that case. Address these issues by adding two thermal_set_governor() calls, one to thermal_release() to remove the governor from the given thermal zone, and one to the thermal zone registration error path to cover failures preceding the thermal zone device registration. Fixes: e33df1d2f3a0 ("thermal: let governors have private data for each thermal zone") Cc: All applicable <stable@vger.kernel.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Link: https://patch.msgid.link/5092923.31r3eYUQgx@rafael.j.wysocki
2026-04-08pmdomain: qcom: rpmhpd: Add power domains for Hawi SoCFenglin Wu1-0/+38
Add the RPMh power domains required for the Hawi SoC. This includes new definitions for domains supplying specific hardware components: - DCX: supplies VDD_DISP - GBX: supplies VDD_GFX_BX Reviewed-by: Taniya Das <taniya.das@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-04-08pmdomain: Merge branch dt into nextUlf Hansson2-0/+13
Merge the immutable branch dt into next, to allow the updated DT bindings to be tested together with the pmdomain changes that are targeted for the next release. Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-04-08dt-bindings: power: qcom,rpmhpd: Add RPMh power domain for Hawi SoCFenglin Wu2-0/+13
Document the RPMh power domain for Hawi SoC, and add definitions for the new power domains which present in Hawi SoC: - RPMHPD_DCX (Display Core X): supplies VDD_DISP for the display subsystem - RPMHPD_GBX (Graphics Box): supplies VDD_GFX_BX for the GPU/graphics subsystem Also, add constants for new power domain levels that supported in Hawi SoC, including: LOW_SVS_D3_0, LOW_SVS_D1_0, LOW_SVS_D0_0, SVS_L2_0, TURBO_L1_0/1/2, TURBO_L1_0/1/2. Signed-off-by: Fenglin Wu <fenglin.wu@oss.qualcomm.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-04-08pmdomain: qcom: cpr: add COMPILE_TEST supportRosen Penev1-1/+1
Allows the buildbots to build the driver on other platforms. There's nothing special arch specific thing going on here. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2026-04-08entry: Split preemption from irqentry_exit_to_kernel_mode()Mark Rutland1-14/+59
Some architecture-specific work needs to be performed between the state management for exception entry/exit and the "real" work to handle the exception. For example, arm64 needs to manipulate a number of exception masking bits, with different exceptions requiring different masking. Generally this can all be hidden in the architecture code, but for arm64 the current structure of irqentry_exit_to_kernel_mode() makes this particularly difficult to handle in a way that is correct, maintainable, and efficient. The gory details are described in the thread surrounding: https://lore.kernel.org/lkml/acPAzdtjK5w-rNqC@J2N7QTR9R3/ The summary is: * Currently, irqentry_exit_to_kernel_mode() handles both involuntary preemption AND state management necessary for exception return. * When scheduling (including involuntary preemption), arm64 needs to have all arm64-specific exceptions unmasked, though regular interrupts must be masked. * Prior to the state management for exception return, arm64 needs to mask a number of arm64-specific exceptions, and perform some work with these exceptions masked (with RCU watching, etc). While in theory it is possible to handle this with a new arch_*() hook called somewhere under irqentry_exit_to_kernel_mode(), this is fragile and complicated, and doesn't match the flow used for exception return to user mode, which has a separate 'prepare' step (where preemption can occur) prior to the state management. To solve this, refactor irqentry_exit_to_kernel_mode() to match the style of {irqentry,syscall}_exit_to_user_mode(), moving preemption logic into a new irqentry_exit_to_kernel_mode_preempt() function, and moving state management in a new irqentry_exit_to_kernel_mode_after_preempt() function. The existing irqentry_exit_to_kernel_mode() is left as a caller of both of these, avoiding the need to modify existing callers. There should be no functional change as a result of this change. [ tglx: Updated kernel doc ] Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260407131650.3813777-6-mark.rutland@arm.com
2026-04-08entry: Split kernel mode logic from irqentry_{enter,exit}()Mark Rutland2-95/+142
The generic irqentry code has entry/exit functions specifically for exceptions taken from user mode, but doesn't have entry/exit functions specifically for exceptions taken from kernel mode. It would be helpful to have separate entry/exit functions specifically for exceptions taken from kernel mode. This would make the structure of the entry code more consistent, and would make it easier for architectures to manage logic specific to exceptions taken from kernel mode. Move the logic specific to kernel mode out of irqentry_enter() and irqentry_exit() into new irqentry_enter_from_kernel_mode() and irqentry_exit_to_kernel_mode() functions. These are marked __always_inline and placed in irq-entry-common.h, as with irqentry_enter_from_user_mode() and irqentry_exit_to_user_mode(), so that they can be inlined into architecture-specific wrappers. The existing out-of-line irqentry_enter() and irqentry_exit() functions retained as callers of the new functions. The lockdep assertion from irqentry_exit() is moved into irqentry_exit_to_user_mode() and irqentry_exit_to_kernel_mode(). This was previously missing from irqentry_exit_to_user_mode() when called directly, and any new lockdep assertion failure relating from this change is a latent bug. Aside from the lockdep change noted above, there should be no functional change as a result of this change. [ tglx: Updated kernel doc ] Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260407131650.3813777-5-mark.rutland@arm.com
2026-04-08entry: Move irqentry_enter() prototype laterMark Rutland1-22/+22
Subsequent patches will rework the irqentry_*() functions. The end result (and the intermediate diffs) will be much clearer if the prototype for the irqentry_enter() function is moved later, immediately before the prototype of the irqentry_exit() function. Move the prototype later. This is purely a move; there should be no functional change as a result of this change. Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260407131650.3813777-4-mark.rutland@arm.com
2026-04-08entry: Remove local_irq_{enable,disable}_exit_to_user()Mark Rutland3-34/+3
local_irq_enable_exit_to_user() and local_irq_disable_exit_to_user() are never overridden by architecture code, and are always equivalent to local_irq_enable() and local_irq_disable(). These functions were added on the assumption that arm64 would override them to manage 'DAIF' exception masking, as described by Thomas Gleixner in these threads: https://lore.kernel.org/all/20190919150809.340471236@linutronix.de/ https://lore.kernel.org/all/alpine.DEB.2.21.1910240119090.1852@nanos.tec.linutronix.de/ In practice arm64 did not need to override either. Prior to moving to the generic irqentry code, arm64's management of DAIF was reworked in commit: 97d935faacde ("arm64: Unmask Debug + SError in do_notify_resume()") Since that commit, arm64 only masks interrupts during the 'prepare' step when returning to user mode, and masks other DAIF exceptions later. Within arm64_exit_to_user_mode(), the arm64 entry code is as follows: local_irq_disable(); exit_to_user_mode_prepare_legacy(regs); local_daif_mask(); mte_check_tfsr_exit(); exit_to_user_mode(); Remove the unnecessary local_irq_enable_exit_to_user() and local_irq_disable_exit_to_user() functions. Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260407131650.3813777-3-mark.rutland@arm.com
2026-04-08entry: Fix stale comment for irqentry_enter()Mark Rutland1-1/+1
The kerneldoc comment for irqentry_enter() refers to idtentry_exit(), which is an accidental holdover from the x86 entry code that the generic irqentry code was based on. Correct this to refer to irqentry_exit(). Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: Thomas Gleixner <tglx@kernel.org> Reviewed-by: Jinjie Ruan <ruanjinjie@huawei.com> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://patch.msgid.link/20260407131650.3813777-2-mark.rutland@arm.com
2026-04-08m68k: defconfig: Update defconfigs for v7.0-rc1Geert Uytterhoeven7-1/+13
- Restore the state of the standard black-and-white and 16-color Linux logos (no longer auto-enabled since commit 994fcd4b107d747b ("video/logo: don't select LOGO_LINUX_MONO and LOGO_LINUX_VGA16 by default")). Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/67dd5553e9289757c274d79ce1b13fca33fde25d.1772446429.git.geert@linux-m68k.org
2026-04-08m68k: emu: Replace unbounded sprintf() in nfhd_init_one()Thorsten Blum1-1/+2
Replace unbounded sprintf() with the safer snprintf(). Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Reviewed-by: Kees Cook <kees@kernel.org> Reviewed-by: Geert Uytterhoeven <geert@linux-m68k.org> Link: https://patch.msgid.link/20260318001632.2974-3-thorsten.blum@linux.dev Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
2026-04-08ALSA: usb-audio: qcom: Fix incorrect type in enable_audio_streamsongxiebing1-1/+1
Fix sparse warning: sound/usb/qcom/qc_audio_offload.c:943:27: sparse: incorrect type in argument 2 expected unsigned int val but got snd_pcm_format_t. Explicitly cast pcm_format to unsigned int for snd_mask_leave(). Fixes: 326bbc348298 ("ALSA: usb-audio: qcom: Introduce QC USB SND offloading support") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604062109.Oxi8JjWW-lkp@intel.com/ Signed-off-by: songxiebing <songxiebing@kylinos.cn> Link: https://patch.msgid.link/20260408083311.774173-1-songxiebing@kylinos.cn Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-08Merge tag 'pin-init-v7.1' of https://github.com/Rust-for-Linux/linux into ↵Miguel Ojeda10-36/+75
rust-next Pull pin-init updates from Benno Lossin: - Replace the 'Zeroable' impls for 'Option<NonZero*>' with impls of 'ZeroableOption' for 'NonZero*'. - Improve feature gate handling for unstable features. - Declutter the documentation of implementations of 'Zeroable' for tuples. - Replace uses of 'addr_of[_mut]!' with '&raw [mut]'. * tag 'pin-init-v7.1' of https://github.com/Rust-for-Linux/linux: rust: pin-init: replace `addr_of_mut!` with `&raw mut` rust: pin-init: implement ZeroableOption for NonZero* integer types rust: pin-init: doc: de-clutter documentation with fake-variadics rust: pin-init: properly document let binding workaround rust: pin-init: build: simplify use of nightly features
2026-04-08Merge tag 'rust-timekeeping-for-v7.1' of ↵Miguel Ojeda838-5503/+10271
https://github.com/Rust-for-Linux/linux into rust-next Pull timekeeping updates from Andreas Hindborg: - Expand the example section in the 'HrTimer' documentation. - Mark the 'ClockSource' trait as unsafe to ensure valid values for 'ktime_get()'. - Add 'Delta::from_nanos()'. This is a back merge since the pull request has a newer base -- we will avoid that in the future. And, given it is a back merge, it happens to resolve the "subtle" conflict around '--remap-path-{prefix,scope}' that I discussed in linux-next [1], plus a few other common conflicts. The result matches what we did for next-20260407. The actual diffstat (i.e. using a temporary merge of upstream first) is: rust/kernel/time.rs | 32 ++++- rust/kernel/time/hrtimer.rs | 336 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 362 insertions(+), 6 deletions(-) Link: https://lore.kernel.org/linux-next/CANiq72kdxB=W3_CV1U44oOK3SssztPo2wLDZt6LP94TEO+Kj4g@mail.gmail.com/ [1] * tag 'rust-timekeeping-for-v7.1' of https://github.com/Rust-for-Linux/linux: hrtimer: add usage examples to documentation rust: time: make ClockSource unsafe trait rust/time: Add Delta::from_nanos()
2026-04-08ALSA: i2c: ak4xxx-adda: implement AK4529 reset handlingCássio Gabriel1-1/+26
Delta 410 uses snd_akm4xxx_reset() both around DFS changes and from its PM callbacks, but the AK4529 case in this helper is still left unimplemented and never drives the codec reset path. The AK4529 datasheet documents register 09h.RSTN as an internal timing reset. Clearing RSTN powers down the ADC and DAC blocks, but does not reinitialize the register map. That matches the existing ak4xxx helper model, which already keeps the desired codec state in the software register cache. Implement AK4529 reset handling by clearing 09h.RSTN on state == 1, then replaying the cached register image and setting RSTN back to 1 on state == 0. This restores cached Delta 410 mixer state after resume and gives the AK4529 DFS-change path a real codec reset sequence. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Link: https://patch.msgid.link/20260407-ak4529-reset-handling-v1-1-b971c18b1a32@gmail.com Signed-off-by: Takashi Iwai <tiwai@suse.de>
2026-04-08crypto: Remove michael_mic from crypto_shash APIEric Biggers53-296/+0
Remove the "michael_mic" crypto_shash algorithm, since it's no longer used. Its only users were wireless drivers, which have now been converted to use the michael_mic() function instead. It makes sense that no other users ever appeared: Michael MIC is an insecure algorithm that is specific to WPA TKIP, which itself was an interim security solution to replace the broken WEP standard. Acked-by: Geert Uytterhoeven <geert@linux-m68k.org> Signed-off-by: Eric Biggers <ebiggers@kernel.org> Acked-by: Herbert Xu <herbert@gondor.apana.org.au> Link: https://patch.msgid.link/20260408030651.80336-7-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08ALSA: interwave: add ISA and PnP suspend and resume callbacksCássio Gabriel1-27/+151
interwave still leaves both its ISA and PnP PM callbacks disabled even though the shared GUS suspend and resume path now exists. This board needs InterWave-specific glue around the shared GUS PM path. The attached WSS codec has its own register image that must be saved and restored across suspend, the InterWave-specific GF1 compatibility, decode, MPU401, and emulation settings must be rewritten after the shared GF1 resume path reinitializes the chip, and the probe-detected InterWave memory layout must be restored without rerunning the destructive DRAM/ROM detection path. Track the optional STB TEA6330T bus at probe time, restore its cached mixer state after resume, add resume-safe helpers for the InterWave register and memory-configuration state, and wire both the ISA and PnP front-ends up to the shared GUS PM helpers. The resume path intentionally restores only the cached hardware setup. It does not attempt to preserve sample RAM contents across suspend. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-3-8dd96c6129e9@gmail.com
2026-04-08ALSA: tea6330t: add mixer state restore helperCássio Gabriel2-1/+39
The InterWave STB variant uses a TEA6330T mixer on its private I2C bus. The mixer state is cached in software, but there is no helper to push that register image back to hardware after system resume. Add a small restore helper that reapplies the cached TEA6330T register image to the device so board drivers can restore the external mixer state as part of their PM resume path. Take snd_i2c_lock() around the full device lookup and restore sequence so the bus device list traversal is also protected. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-2-8dd96c6129e9@gmail.com
2026-04-08ALSA: tea6330t: move snd_tea6330t_detect() EXPORT_SYMBOLCássio Gabriel1-1/+1
Move the remaining standalone snd_tea6330t_detect() EXPORT_SYMBOL() declaration next to its function definition so tea6330t.c follows the usual layout. No functional change intended. Signed-off-by: Cássio Gabriel <cassiogabrielcontato@gmail.com> Signed-off-by: Takashi Iwai <tiwai@suse.de> Link: https://patch.msgid.link/20260407-alsa-interwave-pm-v2-1-8dd96c6129e9@gmail.com
2026-04-08USB: serial: iuu_phoenix: fix iuutool author nameThorsten Blum1-1/+1
The original iuutool author is Juan Carlos Borrás - fix the spelling. Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Johan Hovold <johan@kernel.org>
2026-04-08um: drivers: call kernel_strrchr() explicitly in cow_user.cMichael Bommarito1-1/+7
Building ARCH=um on glibc >= 2.43 fails: arch/um/drivers/cow_user.c: error: implicit declaration of function 'strrchr' [-Wimplicit-function-declaration] glibc 2.43's C23 const-preserving strrchr() macro does not survive UML's global -Dstrrchr=kernel_strrchr remap from arch/um/Makefile. Call kernel_strrchr() directly in cow_user.c so the source no longer depends on the -D rewrite. Fixes: 2c51a4bc0233 ("um: fix strrchr() problems") Suggested-by: Johannes Berg <johannes@sipsolutions.net> Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-6 Assisted-by: Codex:gpt-5-4 Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com> Link: https://patch.msgid.link/20260408070102.2325572-1-michael.bommarito@gmail.com [remove unnecessary 'extern'] Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08gpio: bd72720: handle missing regmapMatti Vaittinen1-0/+2
Currently the probe does not check whether getting the regmap succeeded. This can cause crash when regmap is used, if it wasn't successfully obtained. Failing to get the regmap is unlikely, especially since this driver is expected to be kicked by the MFD driver only after registering the regmap - but it is still better to handle this gracefully. Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com> Fixes: e7eef0bd4075 ("regulator: bd71828-regulator.c: Fix LDON-HEAD mode") Link: https://patch.msgid.link/5bfffee380863bcf24f3062e48094c8eb7b1342f.1775565381.git.mazziesaccount@gmail.com Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
2026-04-08wifi: ipw2x00: Use michael_mic() from cfg80211Eric Biggers2-116/+5
Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://patch.msgid.link/20260408030651.80336-6-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: ath12k: Use michael_mic() from cfg80211Eric Biggers6-62/+8
Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Note: when the kernel is booted with fips=1, crypto_alloc_shash("michael_mic", 0, 0) always returned ERR_PTR(-ENOENT), because Michael MIC is not a "FIPS allowed" algorithm. For now, just preserve that behavior exactly, to ensure that TKIP is not allowed to be used in FIPS mode. This logic actually seems to disable the entire driver in FIPS mode and not just TKIP, but that was the existing behavior. Supporting this driver in FIPS mode, if anyone actually needs it there, should be a separate commit. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://patch.msgid.link/20260408030651.80336-5-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: ath11k: Use michael_mic() from cfg80211Eric Biggers4-57/+7
Just use the michael_mic() function from cfg80211 instead of a local implementation of it using the crypto_shash API. Note: when the kernel is booted with fips=1, crypto_alloc_shash("michael_mic", 0, 0) always returned ERR_PTR(-ENOENT), because Michael MIC is not a "FIPS allowed" algorithm. For now, just preserve that behavior exactly, to ensure that TKIP is not allowed to be used in FIPS mode. This logic actually seems to disable the entire driver in FIPS mode and not just TKIP, but that was the existing behavior. Supporting this driver in FIPS mode, if anyone actually needs it there, should be a separate commit. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://patch.msgid.link/20260408030651.80336-4-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: mac80211, cfg80211: Export michael_mic() and move it to cfg80211Eric Biggers6-26/+10
Export michael_mic() so that the ath11k and ath12k drivers can call it. In addition, move it from mac80211 to cfg80211 so that the ipw2x00 drivers, which depend on cfg80211 but not mac80211, can also call it. Currently these drivers have their own local implementations of michael_mic() based on crypto_shash, which is redundant and inefficient. By consolidating all the Michael MIC code into cfg80211, we'll be able to remove the duplicate Michael MIC code in the crypto/ directory. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://patch.msgid.link/20260408030651.80336-3-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: ipw2x00: Rename michael_mic() to libipw_michael_mic()Eric Biggers1-3/+3
Rename the driver-local michael_mic() function to libipw_michael_mic() to prevent a name conflict with the common michael_mic() function. Note that this code will be superseded later when libipw starts using the common michael_mic(). This commit just prevents a bisection hazard. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Link: https://patch.msgid.link/20260408030651.80336-2-ebiggers@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08Merge tag 'ath-next-20260407' of ↵Johannes Berg17-46/+383
git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath Jeff Johnson says: ================== ath.git patches for v7.1 (PR #3) Add ath12k support for IPQ5424. And of course there is the usual set of cleanups and bug fixes touching the ath10k and ath12k drivers. ================== Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: libertas_tf: refactor endpoint lookupJohan Hovold1-25/+21
Use the common USB helpers for looking up bulk and interrupt endpoints (and determining max packet size) instead of open coding. Note that the driver has an implicit max packet size check which is kept. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260407151111.3187826-4-johan@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: libertas: refactor endpoint lookupJohan Hovold1-17/+16
Use the common USB helpers for looking up bulk and interrupt endpoints (and determining max packet size) instead of open coding. Note that the driver has an implicit max packet size check which is kept. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260407151111.3187826-3-johan@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08wifi: at76c50x: refactor endpoint lookupJohan Hovold1-18/+4
Use the common USB helper for looking up bulk and interrupt endpoints instead of open coding. Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260407151111.3187826-2-johan@kernel.org Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2026-04-08netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use itPablo Neira Ayuso3-2/+17
Add a new helper function to retrieve the next action entry in flow rule, check if the maximum number of actions is reached, bail out in such case. Replace existing opencoded iteration on the action array by this helper function. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nf_conntrack_h323: Correct indentation when H323_TRACE definedDavid Laight1-19/+19
The trace lines are indented using PRINT("%*.s", xx, " "). Userspace will treat this as "%*.0s" and will output no characters when 'xx' is zero, the kernel treats it as "%*s" and will output a single ' ' - which is probably what is intended. Change all the formats to "%*s" removing the default precision. This gives a single space indent when level is zero. Signed-off-by: David Laight <david.laight.linux@gmail.com> Reviewed-by: Petr Mladek <pmladek@suse.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nft_meta: add double-tagged vlan and pppoe supportPablo Neira Ayuso6-13/+82
Currently: add rule netdev x y ip saddr 1.1.1.1 does not work with neither double-tagged vlan nor pppoe packets. This is because the network and transport header offset are not pointing to the IP and transport protocol headers in the stack. This patch expands NFT_META_PROTOCOL and NFT_META_L4PROTO to parse double-tagged vlan and pppoe packets so matching network and transport header fields becomes possible with the existing userspace generated bytecode. Note that this parser only supports double-tagged vlan which is composed of vlan offload + vlan header in the skb payload area for simplicity. NFT_META_PROTOCOL is used by bridge and netdev family as an implicit dependency in the bytecode to match on network header fields. Similarly, there is also NFT_META_L4PROTO, which is also used as an implicit dependency when matching on the transport protocol header fields. Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slowFlorian Westphal1-23/+9
nft_pipapo_avx2_lookup_slow will never be used in reality, because the common sizes are handled by avx2 optimized versions. However, nft_pipapo_avx2_lookup_slow loops over the data just like the avx2 functions. However, _slow doesn't need to do that. As-is, first loop sets all the right result bits and the next iterations boil down to 'x = x & x'. Remove the loop. Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nft_set_pipapo: increment data in one stepFlorian Westphal2-6/+1
Since commit e807b13cb3e3 ("nft_set_pipapo: Generalise group size for buckets") there is no longer a need to increment the data pointer in two steps. Switch to a single invocation of NFT_PIPAPO_GROUPS_PADDED_SIZE() helper, like the avx2 implementation. [ Stefano: Improve commit message ] Reviewed-by: Stefano Brivio <sbrivio@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nf_tables: add netlink policy based cap on registersFlorian Westphal20-28/+32
Should have no effect in practice; all of these use the nft_parse_register_load/store apis which is mandatory anyway due to the need to further validate the register load/store, e.g. that the size argument doesn't result in out-of-bounds load/store. OTOH this is a simple method to reject obviously wrong input at earlier stage. Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: add more netlink-based policy range checksFlorian Westphal23-30/+43
These spots either already check the attribute range manually before use or the consuming functions tolerate unexpected values. Nevertheless, add more range checks via netlink policy so we gain more users and avoid possible re-use in other places that might not have the required manual checks. This also improves error reporting: netlink core can generate extack errors. Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nf_conntrack_h323: remove unreliable debug code in decode_octstrFlorian Westphal1-7/+0
The debug code (not enabled in any build) reads up to 6 octets of the inpt buffer, but does so without bound checks. Zap this. Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: add deprecation warning for dccp supportFlorian Westphal2-0/+6
Add a deprecation warning for the xt_dccp match and the nft exthdr code. Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nf_conntrack_sip: remove net variable shadowingFlorian Westphal1-2/+1
net is already set, derived from nf_conn. I don't see how the device could be living in a different netns than the conntrack entry. Remove the extra variable and re-use existing one. Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: nf_tables: Fix typo in enum descriptionJelle van der Waa1-1/+1
Fix the spelling of "options". Signed-off-by: Jelle van der Waa <jelle@vdwaa.nl> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08netfilter: use function typedefs for __rcu NAT helper hook pointersSun Jian10-60/+51
After commit 07919126ecfc ("netfilter: annotate NAT helper hook pointers with __rcu"), sparse can warn about type/address-space mismatches when RCU-dereferencing NAT helper hook function pointers. The hooks are __rcu-annotated and accessed via rcu_dereference(), but the combination of complex function pointer declarators and the WRITE_ONCE() machinery used by RCU_INIT_POINTER()/rcu_assign_pointer() can confuse sparse and trigger false positives. Introduce typedefs for the NAT helper function types, so __rcu applies to a simple "fn_t __rcu *" pointer form. Also replace local typeof(hook) variables with "fn_t *" to avoid propagating __rcu address space into temporaries. No functional change intended. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603022359.3dGE9fwI-lkp@intel.com/ Signed-off-by: Sun Jian <sun.jian.kdev@gmail.com> Signed-off-by: Florian Westphal <fw@strlen.de>
2026-04-08Input: uinput - fix circular locking dependency with ff-coreMikhail Gavrilov1-7/+21
A lockdep circular locking dependency warning can be triggered reproducibly when using a force-feedback gamepad with uinput (for example, playing ELDEN RING under Wine with a Flydigi Vader 5 controller): ff->mutex -> udev->mutex -> input_mutex -> dev->mutex -> ff->mutex The cycle is caused by four lock acquisition paths: 1. ff upload: input_ff_upload() holds ff->mutex and calls uinput_dev_upload_effect() -> uinput_request_submit() -> uinput_request_send(), which acquires udev->mutex. 2. device create: uinput_ioctl_handler() holds udev->mutex and calls uinput_create_device() -> input_register_device(), which acquires input_mutex. 3. device register: input_register_device() holds input_mutex and calls kbd_connect() -> input_register_handle(), which acquires dev->mutex. 4. evdev release: evdev_release() calls input_flush_device() under dev->mutex, which calls input_ff_flush() acquiring ff->mutex. Fix this by introducing a new state_lock spinlock to protect udev->state and udev->dev access in uinput_request_send() instead of acquiring udev->mutex. The function only needs to atomically check device state and queue an input event into the ring buffer via uinput_dev_event() -- both operations are safe under a spinlock (ktime_get_ts64() and wake_up_interruptible() do not sleep). This breaks the ff->mutex -> udev->mutex link since a spinlock is a leaf in the lock ordering and cannot form cycles with mutexes. To keep state transitions visible to uinput_request_send(), protect writes to udev->state in uinput_create_device() and uinput_destroy_device() with the same state_lock spinlock. Additionally, move init_completion(&request->done) from uinput_request_send() to uinput_request_submit() before uinput_request_reserve_slot(). Once the slot is allocated, uinput_flush_requests() may call complete() on it at any time from the destroy path, so the completion must be initialised before the request becomes visible. Lock ordering after the fix: ff->mutex -> state_lock (spinlock, leaf) udev->mutex -> state_lock (spinlock, leaf) udev->mutex -> input_mutex -> dev->mutex -> ff->mutex (no back-edge) Fixes: ff462551235d ("Input: uinput - switch to the new FF interface") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/all/CABXGCsMoxag+kEwHhb7KqhuyxfmGGd0P=tHZyb1uKE0pLr8Hkg@mail.gmail.com/ Signed-off-by: Mikhail Gavrilov <mikhail.v.gavrilov@gmail.com> Link: https://patch.msgid.link/20260407075031.38351-1-mikhail.v.gavrilov@gmail.com Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
2026-04-08powerpc32/bpf: fix loading fsession func metadata using PPC_LI32Abhishek Dubey1-2/+2
PPC_RAW_LI32 is not a valid macro in the PowerPC BPF JIT. Use PPC_LI32, which correctly handles immediate loads for large values. Fixes the build error introduced when adding fsession support on ppc32. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202604040212.jIxEd2DW-lkp@intel.com/ Fixes: 92258b5bf1ec ("powerpc32/bpf: Add fsession support") Signed-off-by: Abhishek Dubey <adubey@linux.ibm.com> Reviewed-by: Hari Bathini <hbathini@linux.ibm.com> Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260408055301.232745-1-adubey@linux.ibm.com