Add NetHunter support for Google Pixel 9 Pro Fold (comet)

README.md

@@ -148,3 +148,32 @@ a maintainer tree)
     - tag the patch subject with `ANDROID:`
     - add a `Bug:` tag with the Android bug (required for android-specific features)
 
+---
+
+## NetHunter for Pixel 9 Pro Fold (`comet`)
+
+This branch includes support for building a Kali NetHunter kernel for the Google Pixel 9 Pro Fold (Tensor G4, codename `comet`).
+
+### Quick Start: `nethunter-launch.sh`
+
+An interactive launcher script is included for managing NetHunter on the device:
+
+```bash
+./nethunter-launch.sh              # Interactive menu
+./nethunter-launch.sh check        # Verify kernel, root, app, chroot
+./nethunter-launch.sh launch       # Start NetHunter app via ADB
+./nethunter-launch.sh chroot       # Enter Kali chroot with auto-mounts
+./nethunter-launch.sh flash        # Flash AnyKernel zip to both A/B slots
+./nethunter-launch.sh recovery     # Reboot to TWRP
+./nethunter-launch.sh fastboot     # Reboot to bootloader
+```
+
+### Building the Kernel
+
+```bash
+cd kali-nethunter-kernel-builder
+./build.sh
+# Select N (NetHunter build) or T (AnyKernel test build)
+```
+
+See `NET-HUNTER-PIXEL-9-PRO-FOLD-GUIDE.md` for the complete setup guide.

arch/arm64/configs/comet_defconfig

@@ -0,0 +1,24 @@
+# private/google-modules/radio/samsung/s5400/Kconfig
+CONFIG_EXYNOS_MODEM_IF=m
+CONFIG_SEC_MODEM_S5100=m
+CONFIG_SHM_IPC=m
+CONFIG_CP_PKTPROC=m
+CONFIG_CP_PKTPROC_UL=m
+CONFIG_MODEM_IF_QOS=m
+CONFIG_CPIF_AP_SUSPEND_DURING_VOICE_CALL=y
+CONFIG_CPIF_TP_MONITOR=m
+CONFIG_LINK_DEVICE_PCIE_SOC_EXYNOS=y
+CONFIG_LINK_DEVICE_PCIE_IOCC=y
+CONFIG_LINK_DEVICE_PCIE_IOMMU=y
+CONFIG_CH_EXTENSION=m
+CONFIG_CP_THERMAL=m
+CONFIG_CP_PMIC=m
+
+# private/google-modules/touch/common/Kconfig
+CONFIG_TOUCHSCREEN_TBN=m
+CONFIG_TOUCHSCREEN_TBN_AOC_CHANNEL_MODE=y
+CONFIG_TOUCHSCREEN_OFFLOAD=m
+CONFIG_GOOG_TOUCH_INTERFACE=m
+
+# private/google-modules/touch/sec/Kconfig
+CONFIG_TOUCHSCREEN_SEC_TS=m

arch/arm64/configs/comet_nethunter_defconfig

@@ -0,0 +1,61 @@
+# private/google-modules/radio/samsung/s5400/Kconfig
+CONFIG_EXYNOS_MODEM_IF=m
+CONFIG_SEC_MODEM_S5100=m
+CONFIG_SHM_IPC=m
+CONFIG_CP_PKTPROC=m
+CONFIG_CP_PKTPROC_UL=m
+CONFIG_MODEM_IF_QOS=m
+CONFIG_CPIF_AP_SUSPEND_DURING_VOICE_CALL=y
+CONFIG_CPIF_TP_MONITOR=m
+CONFIG_LINK_DEVICE_PCIE_SOC_EXYNOS=y
+CONFIG_LINK_DEVICE_PCIE_IOCC=y
+CONFIG_LINK_DEVICE_PCIE_IOMMU=y
+CONFIG_CH_EXTENSION=m
+CONFIG_CP_THERMAL=m
+CONFIG_CP_PMIC=m
+
+# private/google-modules/touch/common/Kconfig
+CONFIG_TOUCHSCREEN_TBN=m
+CONFIG_TOUCHSCREEN_TBN_AOC_CHANNEL_MODE=y
+CONFIG_TOUCHSCREEN_OFFLOAD=m
+CONFIG_GOOG_TOUCH_INTERFACE=m
+
+# private/google-modules/touch/sec/Kconfig
+CONFIG_TOUCHSCREEN_SEC_TS=m
+
+# WiFi core
+CONFIG_CFG80211=m
+CONFIG_MAC80211=m
+
+# Atheros / ath9k_htc (AR9271, AR7010)
+CONFIG_WLAN_VENDOR_ATH=y
+CONFIG_ATH9K_HTC=m
+CONFIG_CARL9170=m
+
+# ath10k USB
+CONFIG_ATH10K=m
+CONFIG_ATH10K_USB=m
+
+# Realtek USB
+CONFIG_WLAN_VENDOR_REALTEK=y
+CONFIG_RTL8187=m
+CONFIG_RTL8XXXU=m
+CONFIG_RTL8XXXU_UNTESTED=y
+
+# Ralink/MediaTek USB
+CONFIG_WLAN_VENDOR_RALINK=y
+CONFIG_RT2800USB=m
+CONFIG_RT2800USB_RT33XX=y
+CONFIG_RT2800USB_RT35XX=y
+CONFIG_RT2800USB_RT3573=y
+CONFIG_RT2800USB_RT53XX=y
+CONFIG_RT2800USB_RT55XX=y
+CONFIG_RT2800USB_UNKNOWN=y
+
+CONFIG_WLAN_VENDOR_MEDIATEK=y
+CONFIG_MT7601U=m
+
+# Broadcom USB
+CONFIG_WLAN_VENDOR_BROADCOM=y
+CONFIG_BRCMFMAC=m
+CONFIG_BRCMFMAC_USB=y

arch/arm64/kvm/sys_regs.c

@@ -2940,7 +2940,7 @@ int kvm_sys_reg_table_init(void)
 {
 	bool valid = true;
 	unsigned int i;
-	struct sys_reg_desc clidr;
+	struct sys_reg_desc clidr = {};
 
 	/* Make sure tables are unique and in order. */
 	valid &= check_sysreg_table(sys_reg_descs, ARRAY_SIZE(sys_reg_descs), false);

drivers/bluetooth/btusb.c

@@ -671,6 +671,9 @@ static const struct usb_device_id blacklist_table[] = {
 	{ USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK },
 
+	/* TP-Link UB500 (Realtek 8761B) */
+	{ USB_DEVICE(0x2357, 0x0604), .driver_info = BTUSB_REALTEK },
+
 	/* Additional Realtek 8822BE Bluetooth devices */
 	{ USB_DEVICE(0x13d3, 0x3526), .driver_info = BTUSB_REALTEK },
 	{ USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK },

google-modules/soc/gs/drivers/soc/google/vh/kernel/metrics/thermal_metrics.c

@@ -382,7 +382,10 @@ tr_handle register_temp_residency_stats(const char *name, char *group_name)
 	set_residency_thresholds(instance, default_thresholds);
 	stats->started = false;
 	stats->use_callback = false;
-	stats->ops = (struct temp_residency_stats_callbacks){NULL, NULL, NULL, NULL};
+	stats->ops = (struct temp_residency_stats_callbacks){.set_thresholds = NULL,
+								     .get_thresholds = NULL,
+								     .get_stats = NULL,
+								     .reset_stats = NULL};
 
 	thermal_group = create_thermal_group(group_name);
 	if (!thermal_group)
@@ -422,7 +425,10 @@ int unregister_temp_residency_stats(tr_handle instance)
 	stats = &residency_stat_array[instance];
 	strncpy(stats->name, "", THERMAL_NAME_LENGTH);
 	set_residency_thresholds(instance, default_thresholds);
-	stats->ops = (struct temp_residency_stats_callbacks){NULL, NULL, NULL, NULL};
+	stats->ops = (struct temp_residency_stats_callbacks){.set_thresholds = NULL,
+								     .get_thresholds = NULL,
+								     .get_stats = NULL,
+								     .reset_stats = NULL};
 	stats->use_callback = false;
 	return 0;
 }

mm/vmscan.c

@@ -213,6 +213,7 @@ static void set_task_reclaim_state(struct task_struct *task,
 static LIST_HEAD(shrinker_list);
 static DEFINE_SPINLOCK(shrinker_lock);
 static DEFINE_RWLOCK(shrinker_rwlock);
+DECLARE_RWSEM(shrinker_rwsem);
 
 #ifdef CONFIG_MEMCG
 static int shrinker_nr_max;

net/mac80211/cfg.c

@@ -926,7 +926,8 @@ static int ieee80211_set_monitor_channel(struct wiphy *wiphy,
 							 chandef,
 							 IEEE80211_CHANCTX_EXCLUSIVE);
 		}
-	} else if (local->open_count == local->monitors) {
+	} else /*if (local->open_count == local->monitors)*/ {
+		/* Allow channel change even with a normal vif active */
 		local->_oper_chandef = *chandef;
 		ieee80211_hw_config(local, 0);
 	}

net/mac80211/tx.c

@@ -846,11 +846,18 @@ ieee80211_tx_h_sequence(struct ieee80211_tx_data *tx)
 
 	/*
 	 * Packet injection may want to control the sequence
-	 * number, if we have no matching interface then we
-	 * neither assign one ourselves nor ask the driver to.
+	 * number, so if an injected packet is found, skip
+	 * renumbering it. Also make the packet NO_ACK to avoid
+	 * excessive retries (ACKing and retrying should be
+	 * handled by the injecting application).
+	 * FIXME This may break hostapd and some other injectors.
+	 * This should be done using a radiotap flag.
 	 */
-	if (unlikely(info->control.vif->type == NL80211_IFTYPE_MONITOR))
+	if (unlikely(info->flags & IEEE80211_TX_CTL_INJECTED)) {
+		if (!ieee80211_has_morefrags(hdr->frame_control))
+			info->flags |= IEEE80211_TX_CTL_NO_ACK;
 		return TX_CONTINUE;
+	}
 
 	if (unlikely(ieee80211_is_ctl(hdr->frame_control)))
 		return TX_CONTINUE;
@@ -2088,7 +2095,10 @@ void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
 		}
 	}
 
-	ieee80211_set_qos_hdr(sdata, skb);
+	/* Don't overwrite QoS header on injected frames */
+	if (likely(!(info->flags & IEEE80211_TX_CTL_INJECTED))) {
+		ieee80211_set_qos_hdr(sdata, skb);
+	}
 	ieee80211_tx(sdata, sta, skb, false);
 }
 

net/wireless/chan.c

@@ -1393,8 +1393,10 @@ int cfg80211_set_monitor_channel(struct cfg80211_registered_device *rdev,
 {
 	if (!rdev->ops->set_monitor_channel)
 		return -EOPNOTSUPP;
-	if (!cfg80211_has_monitors_only(rdev))
-		return -EBUSY;
+	/* Allow user to change channel even if there is another normal
+	 * virtual interface using the device. */
+	//if (!cfg80211_has_monitors_only(rdev))
+	//	return -EBUSY;
 
 	return rdev_set_monitor_channel(rdev, chandef);
 }