summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2026-07-31Merge tag 'ntfs-for-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs Pull ntfs fixes from Namjae Jeon: - Keep RECALL_ON_OPEN in inode flags when reloading them from $FILE_NAME - Check runlist reallocation sizes for negative values and overflow - Drop stale page cache after shrinking non-resident attributes to prevent writeback failures and data loss * tag 'ntfs-for-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: ntfs: drop stale page-cache when shrinking a non-resident attr ntfs: harden runlist realloc size calculations ntfs: preserve RECALL_ON_OPEN on WSL special-file reparse points
2026-07-31Merge tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbdLinus Torvalds
Pull smb server fixes from Steve French: - Use memcmp() when comparing fixed-size binary ClientGUIDs, so embedded NUL bytes are handled correctly - Reject repeated SMB2 NEGOTIATE requests after dialect selection This prevents preauth_info leaks, enforces the SMB2 protocol requirements, and serializes negotiation state updates. - Fix a use-after-free in __close_file_table_ids() by removing the volatile file ID from the owning IDR before dropping the IDR reference * tag 'v7.2-rc5-smb3-server-fixes' of git://git.samba.org/ksmbd: ksmbd: use memcmp() to compare ClientGUIDs ksmbd: reject repeated SMB2 NEGOTIATE requests ksmbd: fix use-after-free in __close_file_table_ids()
2026-07-31net/sched: cls_route: fix fastmap use-after-free on filterJamal Hadi Salim
The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers. Fixes: 1109c00547fc ("net: sched: RCU cls_route") Reported-by: zdi-disclosures@trendmicro.com Reported-by: Santosh Kalluri <santosh.kalluri129@gmail.com> Suggested-by: Paolo Abeni <pabeni@redhat.com> Tested-by: Victor Nogueira <victor@mojatatu.com> Tested-by: Santosh Kalluri <santosh.kalluri129@gmail.com> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com> Link: https://patch.msgid.link/20260729094411.46257-1-jhs@mojatatu.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31Merge tag 'ata-7.2-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux Pull ata fixes from Damien Le Moal: - Fix PCI resource initialization in the sata_mv driver to keep legacy Marvell boards functional (Rosen) - Fix ahci_ceva driver initialization error path (Radhey) - Fix libata header file to remove a kernel doc compilation warning (Randy) - Increase the timeout for the STANDBY IMMEDIATE command to avoid suspend failures with drives that are slow to respond to this command (Matt) - Fixes for the handling of timed out commands in the presence of deferred non-NCQ commands, to avoid excessive delays in executing the error handler (me) - Disable link power management for a couple of WD drives that have been identified as not functioning properly when power management is used (Niklas) - Fix the device iteration loop when checking for link power management support to correctly handle port multiplier setups (Niklas) * tag 'ata-7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux: ata: libata-sata: fix ata_scsi_lpm_supported() iteration ata: libata-core: Disable LPM on WD Green 2.5 480GB ata: libata-core: Disable LPM on some WD drives scsi: libsas: terminate deferred commands on time out ata: libata-scsi: schedule deferred atapi command ata: libata-scsi: terminate deferred commands on time out ata: libata-eh: Increase STANDBY IMMEDIATE timeout ata: libata: avoid kernel-doc warnings ata: ahci_ceva: fix error paths in ceva_ahci_platform_enable_resources() ata: sata_mv: accept 1 or 2 resources in platform probe
2026-07-31inet: frags: publish queues before arming timerZhiling Zou
inet_frag_create() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published. The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference. Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inet_frag_kill() can remove the node and balance the hash reference. Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Signed-off-by: Zhiling Zou <zhilinz@nebusec.ai> Signed-off-by: Ren Wei <enjou1224z@gmail.com> Link: https://patch.msgid.link/bf66785e7c0c139d7a1900e2f01faeeab344b960.1784948849.git.zhilinz@nebusec.ai Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-01ASoC: codecs: lpass-{tx,wsa}-macro: fix enum kcontrol accessesMark Brown
Dawid Wróbel <me@dawidwrobel.com> says: Both drivers access enumerated controls through value.integer.value[0] instead of value.enumerated.item[0]. The same bug was fixed in rx-macro and va-macro in 2022 (bcfe5f76cc40, 0ea5eff7c606); tx-macro and wsa-macro were missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check, and every read of the affected controls fails with -EINVAL. Reproduced and fixed on a Xiaomi Mi Pad 5 Pro (SM8250) for tx-macro. wsa-macro is compile-tested only — that codec is not instantiated on this hardware. Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-0-6d091c736116@dawidwrobel.com
2026-08-01ASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accessesDawid Wróbel
EAR SPKR PA Gain" and the four "WSA RX* Mux" controls are enumerated, but their get and put callbacks access the value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but wsa-macro was missed. On 64-bit kernels with CONFIG_SND_CTL_DEBUG this trips the elem value sanity check and every read of these controls fails with -EINVAL. Fixes: 809bcbcecebf ("ASoC: codecs: lpass-wsa-macro: Add support to WSA Macro") Fixes: 2c4066e5d428 ("ASoC: codecs: lpass-wsa-macro: add dapm widgets and route") Assisted-by: Claude:claude-fable-5 Cc: stable@vger.kernel.org Signed-off-by: Dawid Wróbel <me@dawidwrobel.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-2-6d091c736116@dawidwrobel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accessesDawid Wróbel
The "DEC0 MODE" to "DEC7 MODE" controls are enumerated, but tx_macro_dec_mode_get() and tx_macro_dec_mode_put() access their value through ucontrol->value.integer.value[0] (a long) instead of ucontrol->value.enumerated.item[0] (an unsigned int). This same pattern was fixed in the sibling drivers by commit bcfe5f76cc40 ("ASoC: codecs: rx-macro: fix accessing array out of bounds for enum type") and commit 0ea5eff7c606 ("ASoC: codecs: va-macro: fix accessing array out of bounds for enum type"), but tx-macro was missed. On 64-bit kernels built with CONFIG_SND_CTL_DEBUG, the elem value sanity check catches the 4 bytes written past the enumerated item and every read of these controls fails with -EINVAL: snd-sm8250 sound: control 2:0:0:DEC0 MODE:0: access overflow Fixes: c39667ddcfc5 ("ASoC: codecs: lpass-tx-macro: add support for lpass tx macro") Assisted-by: Claude:claude-fable-5 Cc: stable@vger.kernel.org Signed-off-by: Dawid Wróbel <me@dawidwrobel.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730-worktree-lpass-tx-macro-enum-fix-v2-1-6d091c736116@dawidwrobel.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-31net: stmmac: dwxgmac2: configure INTM for per-channel interrupt routingZxyan Zhu
The XGMAC DMA_MODE register has an INTM field (bits 13:12) that controls interrupt routing behavior for DMA transfer completion events: 00 (default): sbd_perch_* are pulse signals, sbd_intr_o is also asserted for each completion event. 01: sbd_perch_* are level signals, sbd_intr_o is NOT asserted for packet transfer completion events. When multi-MSI is enabled, per-channel TX/RX interrupts are expected to arrive on their dedicated lines. In the default INTM=00 mode, sbd_intr_o also fires for DMA completion events, but the multi-MSI handler stmmac_mac_interrupt() only processes MAC-layer events (LPI, PMT, timestamps) and returns IRQ_NONE for every DMA completion interrupt, resulting in a continuous stream of unhandled interrupts on the common IRQ. Hardware verification with XGMAC and multi-MSI enabled: INTM=00: 5.4 million common IRQ interrupts in 3 seconds, ~1.8 million IRQ_NONE returns per second. INTM=01: 0 common IRQ interrupts, per-channel IRQs work normally, 10G line rate works correctly. Set INTM to mode 1 when multi-MSI is enabled. This matches the existing GMAC4 implementation. XGMAC multi-MSI has never worked correctly since it was introduced. Signed-off-by: Zxyan Zhu <zxyan0222@gmail.com> Reviewed-by: Qingfang Deng <qingfang.deng@linux.dev> Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com> Link: https://patch.msgid.link/20260729023653.1162763-1-zxyan0222@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error pathMasami Hiramatsu (Google)
In rb_allocate_cpu_buffer(), cpu_buffer->subbuf_ids is allocated using kcalloc() when buffer->remote is non-NULL. If a subsequent page allocation fails (e.g., ring_buffer_desc_page() returns NULL or rb_allocate_pages() fails), execution jumps to fail_free_reader. While __free(kfree) automatically frees the outer cpu_buffer structure at scope exit, kfree(cpu_buffer) does not recursively free nested heap pointers such as cpu_buffer->subbuf_ids, resulting in a memory leak. Fix this by explicitly freeing cpu_buffer->subbuf_ids in the fail_free_reader error unwinding path when cpu_buffer->remote is set. Link: https://patch.msgid.link/178550740672.380917.6067449683620196150.stgit@devnote2 Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-01ASoC: qcom: sc8280xp: add monaco/monza controls for qcs8275Srinivas Kandagatla
Update dai-ids and add DAPM widgets, sysclk and controls required for the VENTUNO-Q platform which uses MAX98090 codec. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260731162626.1588561-5-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qcom: sc8280xp: rename snd_soc_common to qcom_snd_soc_commonSrinivas Kandagatla
The driver-local structure was named 'snd_soc_common', which occupies the generic snd_soc_ ASoC namespace even though it is specific to the Qualcomm sc8280xp machine driver. Rename the type to qcom_snd_soc_common so the identifier is properly scoped to this driver, and rename the pointer field in sc8280xp_snd_data from 'snd_soc_common_priv' to 'priv' so the shorter name doesn't repeat the type name at every use. No functional change. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260731162626.1588561-4-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qcom: qdsp6: q6prm: add the missing MCLK clock IDsNeil Armstrong
Add the missing MCLK ids for the q6prm DSP interface. Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260731162626.1588561-3-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qcom: sc8280xp: tolerate -ENOTSUPP from codec set_sysclkSrinivas Kandagatla
Not all codecs implement the set_sysclk operation. When the board enables codec_sysclk_set, snd_soc_dai_set_sysclk() on the codec DAI can return -ENOTSUPP, which currently aborts hw_params and breaks playback/capture on such boards even though the missing clock setup is harmless. Ignore -ENOTSUPP for the codec set_sysclk call. Fixes: 766f3f79c312 ("ASoC: qcom: sc8280xp: enhance machine driver for board-specific config") Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260731162626.1588561-2-srinivas.kandagatla@oss.qualcomm.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-07-31Merge tag 'block-7.2-20260731' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull block fixes from Jens Axboe: - A set of fixes for s390/dasd, via Stefan - Fix for a missing stop of the timeout timer, if a disk has never been added - Clear kernel owned fields on ublk setup by default * tag 'block-7.2-20260731' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: s390/dasd: Fix undersized format-check buffer s390/dasd: Fix potential NULL pointer dereference s390/dasd: Fix path verification interrupted by concurrent dasd_sleep_on_immediatly block: stop the timeout timer when releasing a never added disk ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev()
2026-07-31perf machine: Check snprintf truncation for guest kallsyms pathArnaldo Carvalho de Melo
machines__create_guest_kernel_maps() builds the guest kallsyms path with snprintf() without checking the return value. A truncated path could pass the access() check if a prefix directory happens to contain a file named "kallsyms", leading to the wrong file being used for symbol resolution. Check for truncation and skip the directory. Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Free scandir entries in guest kernel map creationArnaldo Carvalho de Melo
machines__create_guest_kernel_maps() calls scandir() which allocates both the namelist array and each individual dirent entry. The code frees the namelist array but not the individual entries, leaking memory proportional to the number of directories under guestmount. Free each namelist[i] after it is no longer needed. Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Reset errno before strtol in guest kernel map creationArnaldo Carvalho de Melo
machines__create_guest_kernel_maps() checks errno == ERANGE after strtol() to detect overflow, but does not clear errno first. A stale ERANGE from an earlier library call (e.g. scandir internals) causes valid numeric directory names to be incorrectly skipped. Set errno = 0 before strtol() so only the current conversion can trigger the ERANGE check. Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Don't abort guest map creation on first inaccessible dirArnaldo Carvalho de Melo
machines__create_guest_kernel_maps() jumps to the failure label when one guest directory's kallsyms file fails access(), skipping all remaining valid guest directories. An inaccessible directory is not fatal — other guests may still be reachable. Replace 'goto failure' with 'continue' so the loop processes all directories, and remove the now-unreferenced failure label. Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Check snprintf truncation in machines__findnew()Arnaldo Carvalho de Melo
The guestmount path is built with snprintf() into a PATH_MAX buffer without checking the return value. If symbol_conf.guestmount is long enough to cause truncation, the truncated path could match a different directory, causing the wrong guest to be associated with the pid. Check for truncation and bail out early. Fixes: a1645ce12adb ("perf: 'perf kvm' tool for monitoring guest performance from host") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Zhang, Yanmin <yanmin_zhang@linux.intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Guard against NULL strlist in machines__findnew()Arnaldo Carvalho de Melo
The static 'seen' strlist caches guestmount paths that have already been reported as inaccessible, to avoid repeating the error message. If strlist__new() fails (OOM), 'seen' stays NULL and the next call dereferences it via strlist__has_entry() and strlist__add(). Guard both calls so that on allocation failure the error message is still printed (just not deduplicated) instead of crashing. Fixes: c80c3c269011 ("perf kvm: Limit repetitive guestmount message to once per directory") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: David Ahern <dsahern@gmail.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Fix NULL parent dereference in fork event processingArnaldo Carvalho de Melo
machine__process_fork_event() calls machine__findnew_thread() for the parent thread, which can return NULL on allocation failure. The code then dereferences parent via thread__pid(parent) without a NULL check when validating whether the parent PID matches. The later NULL check at thread__fork() does not prevent this earlier dereference. Add a NULL guard before accessing the parent thread. Fixes: 5cb73340d92a ("perf tools: Make fork event processing more resilient") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31perf machine: Fix fd leak on bounds check in maps__set_modules_path_dir()Arnaldo Carvalho de Melo
The bounds check for root_len >= path_size returns -1 directly without closing the directory fd opened by io_dir__init() a few lines above. Jump to the out label instead, which calls close(iod.dirfd). Fixes: e7af1946818b ("perf machine: Reuse module path buffer") Reported-by: sashiko-bot <sashiko-bot@kernel.org> Cc: Ian Rogers <irogers@google.com> Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
2026-07-31net: bridge: mrp: fix uninitialised bytes on the wireBaul Lee
br_mrp_alloc_test_skb() builds MRP test frames on an skb from dev_alloc_skb(), which does not clear the linear data area. On the MRA ring-role branch the sub-option TLV header is appended with sub_tlv = skb_put(skb, sizeof(*sub_tlv)); sub_tlv->type = BR_MRP_SUB_TLV_HEADER_TEST_AUTO_MGR; so sub_tlv->length is never written, and the two trailing alignment bytes are appended with a bare skb_put() that does not clear them either. The neighbouring oui and sub_opt regions are explicitly zeroed, so three uninitialised bytes are left in every MRA MRP_Test frame that goes out. Put the sub-option TLV header and the alignment padding in a single skb_put_zero(), which clears both. The AUTO_MGR sub-TLV carries no payload, so the zeroed length field is already the value it should have. Fixes: f7458934b079 ("net: bridge: mrp: Update the Test frames for MRA") Suggested-by: Nikolay Aleksandrov <razor@blackwall.org> Cc: stable@vger.kernel.org Signed-off-by: Baul Lee <baul.lee@xbow.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260729131941.10254-1-baul.lee@xbow.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31Merge branch 'net-dsa-microchip-add-ptp-support-for-ksz8463'Jakub Kicinski
Bastien Curutchet says: ==================== net: dsa: microchip: add PTP support for KSZ8463 This series adds PTP support for the KSZ8463. The KSZ8463 differs quite a lot from other KSZ switches supporting PTP: it has a different interrupt logic and a different 'PTP engine'. This third iteration addresses two more Sashiko comments from v2. I didn't address some other Sashiko comments, I said why in the v2 thread. Patches 1 to 4 add interrupt support for the KSZ8463 Patches 5 to 10 add the PTP support for the KSZ8463 ==================== Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-0-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: add two-steps PTP support for KSZ8463Bastien Curutchet (Schneider Electric)
The KSZ8463 switch supports PTP but it's not supported by the driver. Add L2 two-step PTP support for the KSZ8463. IPv4 and IPv6 layers aren't supported. Neither is one-step PTP. Use KSZ8463-specific implementations of the .get_ts_info and .port_hwtstamp_set callbacks. The pdelay_req and pdelay_resp timestamps share one interrupt bit status while they're located in two different registers. So introduce last_tx_is_pdelayresp to keep track of the last sent event type. This flag is set by the xmit worker right before sending the packet and then used in the interrupt handler to retrieve the timestamp location. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-10-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: explicitly enable detection of L2 PTP framesBastien Curutchet (Schneider Electric)
Detection of L2 PTP frames needs to be enabled for PTP to work at the L2 layer. The bit enabling this detection is set by default on the switches currently supported by the driver, but it is unset by default on the KSZ8463 for which support will be added in upcoming patches. Explicitly enable the detection of L2 PTP frames for all switches when PTP is enabled. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-9-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: add KSZ8463 tail tag handlingBastien Curutchet (Schneider Electric)
KSZ8463 uses the KSZ9893 DSA TAG driver. However, the KSZ8463 doesn't use the tail tag to convey timestamps to the host as KSZ9893 does. It uses the reserved fields in the PTP header instead. Add a KSZ8463-specific DSA_TAG driver to handle KSZ8463 timestamps. There is no information in the tail tag to distinguish PTP packets from others so use the ptp_classify_raw() helper to find the PTP packets and extract the timestamp from their PTP headers. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-8-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: tag_ksz: share code for KSZ8795 and KSZ9893 xmit operationsBastien Curutchet (Schneider Electric)
KSZ8795 and KSZ9893 have very similar tag handling in the xmit path, leading to code duplication. There are only two differences between the two ksz*_xmit(): - the KSZ8795 doesn't handle priorities between frames - ksz8795_xmit() directly returns the SKB instead of calling ksz_defer_xmit(). Yet, ksz_defer_xmit() also returns directly the SKB if no clone is present inside the SKB. Clones are only created by the KSZ driver when the PTP feature is enabled. Since KSZ8795 doesn't support PTP, returning the SKB directly or ksz_defer_xmit() is the same. The upcoming support for the KSZ8463 also requires a similar xmit(). Gather the common code from ksz8795_xmit() and ksz9893_xmit() into a new ksz_common_xmit() function that takes three input arguments: - do_tstamp to tell whether ksz_xmit_timestamp() should be called - prio to give the priority tag (if any) - override_mask to give the location of the override bit (if any) Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-7-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: tag_ksz: move the KSZ8795 tag handling below ksz_xmit_timestamp()Bastien Curutchet (Schneider Electric)
Upcoming patch reduces code duplication between KSZ8795 and KSZ9893 by introducing a common xmit() function. This rework needs the KSZ8795 handlers to be implemented below ksz_defer_xmit(). Do the move now to reduce the noise in next patch. No functionnal change is intended in this patch. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-6-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: adapt port offset for KSZ8463's PTP registerBastien Curutchet (Schneider Electric)
In KSZ8463 register's layout, the offset between port 1 and port 2 registers isn't the same in the generic control register area than in the PTP register area. The get_port_addr() always uses the same offset so it doesn't work when it's used to access PTP registers. Adapt the port offset in get_port_addr() when the accessed register is in the PTP area. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-5-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: add PTP interrupt handling for KSZ8463Bastien Curutchet (Schneider Electric)
KSZ8463 PTP interrupts aren't handled by the driver. The interrupt layout in KSZ8463 has nothing to do with the other switches: - Its global interrupt enable register is 16-bits long and follow an 'enable' logic, instead of a 'mask' one - all the interrupts of all ports are grouped into one status register while others have one interrupt register per port - xdelay_req and pdresp timestamps share one single interrupt bit on the KSZ8463 while each of them has its own interrupt bit on other switches Create a KSZ8463-specific set of interrupt domain operations to handle the global IRQ layer. To limit code duplication, it uses the same interrupt handler than the other switches. Since other switches have 8-bits registers, only the high-byte of the interrupt status/enable registers are used. This high-byte is where the PTP interrupts are located. The low-byte contains the wake-up detection interrupts so if at some points these interrupts are needed we'll need a bit of rework here. Create KSZ8463-specific functions to setup the PTP interrupts. The created IRQ domain is tied to the first port of the KSZ8463. Again, the same PTP interrupt handler than the others switches is used. Implement the teardown callback to release the interrupts. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-4-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: allow the use of other IRQ operations.Bastien Curutchet (Schneider Electric)
The IRQ setup uses an hardcoded set of IRQ operations. These operations don't fit with the KSZ8463 which has an inverted bit logic (it uses an 'enable irq' register instead of a 'mask irq' one) and 16-bits registers. Take the IRQ domain operations as input of ksz_irq_common_setup() to allow KSZ8463 to use the already existing setup with its own set of IRQ operations. Expose ksz_irq_common_setup() and ksz_irq_bus_lock/unlock() so they can be used by ksz8.c. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-3-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: split ksz8_config_cpu_port()Bastien Curutchet (Schneider Electric)
ksz8_config_cpu_port() is only called twice, once by ksz8_setup() and once by ksz8463_setup(). It contains a ksz8463 branch that could be avoided in the ksz8_setup() case and a ksz87xx/ksz88xx branches that could be avoided in ksz8463_setup() case. Create ksz8463_config_cpu_port() that only handles the ksz8463 case and remove the ksz8463 specificities from the common ksz8_config_cpu_port(). Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-2-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net: dsa: microchip: implement ksz8463_setup()Bastien Curutchet (Schneider Electric)
KSZ8463 uses the ksz8_setup() as setup() callback for its DSA operations. Its behavior is quite different than other KSZ8 switches, especially its interrupt scheme. Remove from the ksz8_setup()/ksz8_reset_switch() everything that is ksz8463-related. Create a dedicated ksz8463_setup() and a ksz8463_reset_switch() function. This new ksz8463_setup() is widely inspired from ksz8_setup, it has following differences: - it doesn't configure drive strength (not supported on KSZ8463) - it uses the ksz8463_reset_switch() - it doesn't call ksz8_handle_global_errata() (the handled errata only affects the KSZ87xx variant) - it doesn't configure IRQs. Note that ksz8_setup()'s IRQ initialization doesn't work for the KSZ8463 anyway. Proper support for it comes in upcoming patches. Remove the teardown implementation from the KSZ8463 operations. Since PTP and interrupts aren't setup, the common ksz_teardown() wouldn't do anything anyway. Signed-off-by: Bastien Curutchet (Schneider Electric) <bastien.curutchet@bootlin.com> Link: https://patch.msgid.link/20260727-ksz-new-ptp-v3-1-caba39e680e3@bootlin.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-07-31net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in ↵Mahanta Jambigi
smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message. The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation. The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly. Fixes: 0fb0b02bd6fd ("net/smc: adapt SMC client code to use the LLC flow") Signed-off-by: Mahanta Jambigi <mjambigi@linux.ibm.com> Reviewed-by: Hidayath Khan <hidayath@linux.ibm.com> Reviewed-by: Sidraya Jayagond <sidraya@linux.ibm.com> Reviewed-by: Dust Li <dust.li@linux.alibaba.com> Link: https://patch.msgid.link/20260729130153.970800-1-mjambigi@linux.ibm.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-08-01SDM660 sound card and internal MI2S supportMark Brown
Richard Acayan <mailingradian@gmail.com> says: This adds support for the SDM660 (formerly "SDM660 internal") sound card and support for WCD codecs over internal MI2S (represented in APIs as LPI MI2S). Like on MSM8916 and MSM8953, some SDM660 and SDM670 devices connect to a digital and analog codec. The connection to the digital codec is through special "internal" MI2S ports. The digital and analog codecs are used on the Xiaomi Redmi Note 7 for headset (playback + capture) and earpiece, and also on the Google Pixel 3a for the headset. This series does not include devicetree patches. Link: https://patch.msgid.link/20260730174353.108023-1-mailingradian@gmail.com
2026-08-01ASoC: msm8916-wcd-analog: add quirk for cajon 2.0Richard Acayan
The codec version CAJON_2_0 on the Snapdragon 670 requires touching the HPH test registers. Add the quirk so this driver can also support SDM670. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Link: https://patch.msgid.link/20260730174353.108023-16-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: msm8916-wcd-analog: add pm8953 codecVladimir Lypak
Add regs overrides for PM8953 codec. Signed-off-by: Vladimir Lypak <vladimir.lypak@gmail.com> [Adam: rename codec] Signed-off-by: Adam Skladowski <a39.skl@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Acayan <mailingradian@gmail.com> Link: https://patch.msgid.link/20260730174353.108023-15-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: msm8916-wcd-analog: add pm8950 codecAdam Skladowski
Add regs overrides for PM8950 codec and implement matching reg overrides via compatible. Signed-off-by: Adam Skladowski <a39.skl@gmail.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org> Signed-off-by: Richard Acayan <mailingradian@gmail.com> Link: https://patch.msgid.link/20260730174353.108023-14-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qcom: sm8250: add SDM660 compatibleRichard Acayan
Add the compatible for SDM660 and SDM670 devices, which can use the support for WCD codecs connected to internal MI2S. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-13-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qcom: sm8250: add support for LPI_MI2S_RX_0 and LPI_MI2S_TX_3Richard Acayan
The LPI_MI2S_RX_0 and LPI_MI2S_TX_3 ports on SDM660 can be connected to the digital and analog WCD codecs. They can be supported with the same logic for other ports, but just need to be explicitly stated. Add support for these ports. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-12-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qdsp6: common: support headphone jacks connected to lpi mi2sRichard Acayan
On SDM660, LPI MI2S ports can be connected to a WCD codec which may support headphones. Register the headphone jack on codecs connected to the playback port, LPI_MI2S_RX_0. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-11-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qdsp6: q6routing: add lpi mi2s supportRichard Acayan
Add the ASM-AFE routing for LPI MI2S ports which represent internal MI2S ports on SDM660. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-10-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qdsp6: q6afe-dai: add internal mi2s supportRichard Acayan
The bindings for LPI MI2S ports, originally exclusive to q6apm, can be used for internal MI2S ports on q6afe. Add the internal MI2S ports found on the SDM660 internal sound card using the LPI MI2S bindings. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-9-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qdsp6: q6afe: add internal mi2s supportRichard Acayan
The bindings for LPI MI2S ports, originally exclusive to q6apm, can be used for internal MI2S ports on q6afe. Add the port mappings for internal MI2S, found on the Snapdragon 660 internal sound card. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-8-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: qdsp6: q6dsp-lpass-ports: add support for lpi mi2s ports 5-6Richard Acayan
Add the extra LPI MI2S ports used for internal MI2S on SDM660. Link: https://android.googlesource.com/kernel/msm-extra/+/530cffa4cc977a348753831b163eb9d3302b954a/asoc/msm-dai-q6-v2.c#4597 Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-7-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: dt-bindings: msm8916-digital-codec: Add SDM660 compatibleRichard Acayan
The MSM8916 digital codec is also found on SDM660, typically connected to the SDM660 internal sound card. Provide a space for specific compatibles and add the compatible for SDM660. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-6-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: dt-bindings: pm8916-analog-codec: Add PM660L compatibleRichard Acayan
The PM8953 (cajon 2.0) revision of the PM8916 analog codec is also found on PM660L, typically connected to the SDM660 internal sound card via the digital codec. Provide a space for specific compatibles and add the compatible for PM660L. Signed-off-by: Richard Acayan <mailingradian@gmail.com> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-5-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-08-01ASoC: dt-bindings: pm8916-wcd-analog-codec: Document pm8950/pm8953Adam Skladowski
Document pm8950 and pm8953 analog audio codecs. Signed-off-by: Adam Skladowski <a39.skl@gmail.com> [richard: add back empty line] Signed-off-by: Richard Acayan <mailingradian@gmail.com> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com> Link: https://patch.msgid.link/20260730174353.108023-4-mailingradian@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-09-11 00:25:23 +0000