summaryrefslogtreecommitdiff
path: root/drivers/firmware
AgeCommit message (Collapse)Author
2026-05-12firmware: arm_scmi: Simplify clock rates exposed interfaceCristian Marussi
Introduce a new internal struct scmi_clock_desc so as to be able to hide, in the future, some of the needlessly public fields currently kept inside scmi_clock_info, while keeping exposed only the two new min_rate and max_rate fields for each clock. No functional change. Reviewed-by: Peng Fan <peng.fan@nxp.com> Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260508153300.2224715-5-cristian.marussi@arm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-12firmware: arm_scmi: Add clock determine_rate operationCristian Marussi
Add a clock operation to help determining the effective rate, closest to the required one, that a specific clock can support. Calculation is currently performed kernel side and the logic is taken directly from the SCMI Clock driver: embedding the determinate rate logic in the protocol layer enables simplifications in the SCMI Clock protocol interface and will more easily accommodate further evolutions where such determine_rate logic into is optionally delegated to the platform SCMI server. Signed-off-by: Cristian Marussi <cristian.marussi@arm.com> Tested-by: Florian Fainelli <florian.fainelli@broadcom.com> Tested-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/20260508153300.2224715-3-cristian.marussi@arm.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-07firmware: psci: Set pm_set_resume/suspend_via_firmware() for SYSTEM_SUSPENDKonrad Dybcio
PSCI specification defines the SYSTEM_SUSPEND feature which enables the firmware to implement the suspend to RAM (S2RAM) functionality by transitioning the system to a deeper low power state. When the system enters such state, the power to the peripheral devices might be removed. So the respective device drivers must prepare for the possible removal of the power by performing actions such as shutting down or resetting the device in their system suspend callbacks. The Linux PM framework allows the platform drivers to convey this info to device drivers by calling the pm_set_suspend_via_firmware() and pm_set_resume_via_firmware() APIs. Hence, if the PSCI firmware supports SYSTEM_SUSPEND feature, call the above mentioned APIs in the psci_system_suspend_begin() and psci_system_suspend_enter() callbacks. Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org> Reviewed-by: Sudeep Holla <sudeep.holla@arm.com> [mani: reworded the description to be more elaborative] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com> Tested-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Jon Hunter <jonathanh@nvidia.com> Acked-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Signed-off-by: Arnd Bergmann <arnd@arndb.de>
2026-05-06firmware: raspberrypi: Change dependency to ARCH_BCM2835 and COMPILE_TESTChen-Yu Tsai
The Raspberry Pi firmware driver has no compile dependencies on the BCM2835 mailbox driver. It's just a indirect runtime dependency: the driver only works on a Raspberry Pi. Change the dependency from BCM2835_MBOX to ARCH_BCM2835. Also allow compile tests. This allows drivers that have build time dependencies on this firmware driver to be compile tested as well. More dependencies are added to account for build time dependencies: - depends on MAILBOX for mailbox API (not stubbed) usage - depends on ARM || ARM64 for dsb() usage Also make it built by default if ARCH_BCM2835, since many functions will not work without this firmware driver. Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> Link: https://lore.kernel.org/r/20260427091058.2669812-1-wenst@chromium.org Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
2026-05-06treewide: Explicitly include the x86 CPUID headersAhmed S. Darwish
Modify all CPUID call sites which implicitly include any of the CPUID headers to explicitly include them instead. For KVM's reverse_cpuid.h, just include <asm/cpuid/types.h> since it references the CPUID_EAX..EDX symbols without using the CPUID APIs. Note, this allows removing the inclusion of <asm/cpuid/api.h> from within <asm/processor.h> next. That allows the CPUID API headers to include <asm/processor.h> without introducing a circular dependency. Signed-off-by: Ahmed S. Darwish <darwi@linutronix.de> Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de> Link: https://lore.kernel.org/20260327021645.555257-1-darwi@linutronix.de
2026-05-05firmware: arm_ffa: Fix sched-recv callback partition lookupSudeep Holla
ffa_sched_recv_cb_update() used list_for_each_entry_safe() to search for a matching partition and then tested the iterator against NULL. That is not a valid end-of-list check for circular lists and can fall through with an invalid pointer. Use a normal iterator and detect the not-found case correctly before touching the partition state. Fixes: be61da938576 ("firmware: arm_ffa: Allow multiple UUIDs per partition to register SRI callback") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-11-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_ffa: Snapshot notifier callbacks under lockSudeep Holla
Both notification handlers currently look up a notifier callback under notify_lock, drop the lock, and then dereference the returned notifier entry. A concurrent unregister can delete and free that entry in the gap, leaving the handler to dereference stale memory. Copy the callback pointer and callback data while notify_lock is still held and invoke the callback only after the lock is dropped. This keeps the existing callback execution model while removing the use-after-free window in both the framework and non-framework notification paths. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-10-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_ffa: Align RxTx buffer size before mappingSudeep Holla
Commit 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during RXTX_MAP") advertises PAGE_ALIGN(rxtx_bufsz) to firmware when mapping the buffers but the driver continues to stores the minimum FF-A buffer size in drv_info->rxtx_bufsz which is used elsewhere in the driver. Align the size before storing it so that the allocation, validation and FFA_RXTX_MAP all use the same buffer size. Fixes: 83210251fd70 ("firmware: arm_ffa: Use the correct buffer size during RXTX_MAP") Cc: Sebastian Ene <sebastianene@google.com> Link: https://sashiko.dev/#/patchset/20260402113939.930221-1-sebastianene@google.com Reviewed-by: Sebastian Ene <sebastianene@google.com> Link: https://patch.msgid.link/20260428-ffa_fixes-v2-9-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_ffa: Validate framework notification message layoutSudeep Holla
Framework notifications carry an indirect message in the shared RX buffer. Validate the reported offset and size before using them, reject zero-length payloads, and ensure that any non-header payload starts at the UUID field rather than in the middle of the message header. Use the validated offset and size values for both kmemdup() and the UUID parsing path so malformed firmware data cannot drive an out-of-bounds read or an oversized allocation. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-8-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_ffa: Keep framework RX release under lockSudeep Holla
The framework notification handler drops rx_lock before issuing FFA_RX_RELEASE, leaving a window where another RX-buffer user can start a new FF-A transaction before ownership has actually been returned to firmware. Move the FFA_RX_RELEASE calls so they execute while rx_lock is still held on both the kmemdup() failure path and the normal success path. While doing that, switch the handler to scoped_guard() to keep the critical section explicit. Fixes: 285a5ea0f542 ("firmware: arm_ffa: Add support for handling framework notifications") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-7-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_ffa: Bound PARTITION_INFO_GET_REGS copiesSudeep Holla
The register-based PARTITION_INFO_GET path trusted the firmware-provided indices when copying partition descriptors into the caller buffer. Reject inconsistent counts or index progressions so the copy loop cannot write past the allocated array. Fixes: ba85c644ac8d ("firmware: arm_ffa: Add support for FFA_PARTITION_INFO_GET_REGS") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-6-8595ae450034@kernel.org (fixed cur_idx when exactly one descriptor in the first fragment) Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: Convert to list_for_each_entry()Geert Uytterhoeven
Simplify the loop in scmi_handle_get() by using list_for_each_entry(). Suggested-by: Marek Vasut <marek.vasut@mailbox.org> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/bccbd4a64ef4619afd5454e9e533073b00aeaba6.1775205358.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: quirk: Simplify quirk table iterationGeert Uytterhoeven
The current table entry is assigned in both the init and loop expressions of the for-statement. Merge this into a single assignment in the conditional expression, to simplify the code. While at it, make the loop counter unsigned and loop-local. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/8577f4b103cf04420c3b67dcaad528daff867287.1775205358.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: quirk: Improve quirk range parsingGeert Uytterhoeven
When a range contains only an end ("-X"), the number string is parsed twice, as both "sep == first" and "sep != last" are true. Fix this by dropping the superfluous number parsing for "sep == first". This does have a harmless functional impact for the unbounded range: "-" is now accepted, while it was rejected before. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/fe257b3b7b7b5c17fd0e5727bb9746c731bd7e3c.1775205358.git.geert+renesas@glider.be (sudeep.holla: Initialise ret to 0 as it will be uninitialise for "-" range) Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: Rename struct scmi_revision_info to scmi_base_infoMarek Vasut
Rename struct scmi_revision_info to struct scmi_base_info , to accurately represent its content. The scmi_revision_info is no longer accurate, because the structure now contains more than only SCMI base protocol revision, it now also contains number of protocols, agents, vendor and subvendor strings. All those are fetched from the base protocol, so rename the structure to scmi_base_info, to match the other scmi_*_info structure names. No functional change. Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org> Link: https://patch.msgid.link/20260406155343.72087-1-marek.vasut+renesas@mailbox.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: imx: sm-misc: Print boot/shutdown reasonsPeng Fan
Add reset reason string table for i.MX95 and introduce a helper (scmi_imx_misc_get_reason) to query and print both system and LM (Logical Machine) reset reasons via the SCMI MISC protocol. Signed-off-by: Peng Fan <peng.fan@nxp.com> Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-2-18de78978ba9@nxp.com Acked-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-05firmware: arm_scmi: imx: Support getting reset reason of MISC protocolPeng Fan
MISC protocol supports getting reset reason per Logical Machine or System. Add the API for user to retrieve the information from System Manager. Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com> Link: https://patch.msgid.link/20260305-scmi-imx-reset-v1-1-18de78978ba9@nxp.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-05-03firmware: google: Skip failing entries instead of aborting populateTitouan Ameline de Cadeville
coreboot_table_populate() registers devices one by one. If device_register() fails for one entry, the current code returns immediately, leaving previously registered devices orphaned on the coreboot bus with no cleanup path. Since coreboot table entries are independent of each other, a failure on one entry should not prevent the others from being registered. This mirrors the strategy used by of_platform_populate(), which skips individual failures rather than aborting. Move ptr_entry increment before device_register(), log a warning on failure, and continue the loop rather than aborting. Signed-off-by: Titouan Ameline de Cadeville <titouan.ameline@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org> Acked-by: Brian Norris <briannorris@chromium.org> Link: https://lore.kernel.org/r/20260501094322.123160-1-titouan.ameline@gmail.com Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-04-30firmware: stratix10-svc: change get provision data to async SMC callSiew Chin Lim
Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync to avoid long runtime which may cause the watchdog timeout issue. Signed-off-by: Richard Gong <richard.gong@intel.com> Signed-off-by: Siew Chin Lim <elly.siew.chin.lim@intel.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-04-30firmware: stratix10-svc: kmalloc_array + kzalloc to flexRosen Penev
Use a flexible array member to combine allocations. Simplifies memory management. Add __counted_by for extra runtime analysis. Also move counting variable assignment up as required by __counted_by. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
2026-04-30remoteproc: xlnx: Check remote core stateTanmay Shah
The remote state is set to RPROC_DETACHED if the resource table is found in the memory. However, this can be wrong if the remote is not started, but firmware is still loaded in the memory. Use PM_GET_NODE_STATUS call to the firmware to request the state of the RPU node. If the RPU is actually out of reset and running, only then move the remote state to RPROC_DETACHED, otherwise keep the remote state to RPROC_OFFLINE. Signed-off-by: Tanmay Shah <tanmay.shah@amd.com> Fixes: bca4b02ef92e ("remoteproc: xlnx: Add attach detach support") Reviewed-by: Beleswar Padhi <b-padhi@ti.com> Acked-by: Michal Simek <michal.simek@amd.com> Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20260428221855.313752-1-tanmay.shah@amd.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
2026-04-29firmware: arm_ffa: Unregister bus notifier on teardown for FF-A v1.0Sudeep Holla
For FF-A v1.0 the driver registers a bus notifier to backfill UUID matching, but the notifier was never unregistered on cleanup paths. Track the registration state and unregister it during teardown and early partition-setup failure. Fixes: 9dd15934f60d ("firmware: arm_ffa: Move the FF-A v1.0 NULL UUID workaround to bus notifier") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-5-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-04-29firmware: arm_ffa: Fix per-vcpu self notifications handling in workqueueSudeep Holla
Per-vcpu notification handling already runs from a per-cpu work item on the target cpu. Routing that path back through smp_call_function_single() re-enters the call-function IPI path and executes the notification handler with interrupts disabled. That makes the framework path unsafe, since it takes a mutex, allocates memory with GFP_KERNEL, and invokes client callbacks. Handle per-vcpu self notifications directly from the existing per-cpu work item instead. This keeps the per-vcpu path in task context and avoids the extra IPI hop entirely. Fixes: 3a3e2b83e805 ("firmware: arm_ffa: Avoid queuing work when running on the worker queue") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-4-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-04-29firmware: arm_ffa: Avoid collapsing NPI work from different CPUsSudeep Holla
Notification pending interrupts are registered as per-CPU IRQs, but the driver queues all NPI handling through a single shared work_struct. That allows queue_work_on() calls from different CPUs to collapse onto a single pending work item even though the work function uses the CPU it runs on to fetch and handle per-CPU notifications. Move notif_pcpu_work into the per-CPU ffa_pcpu_irq state and initialize one work item per CPU. This keeps NPI handling independent per CPU and avoids losing notifications when multiple CPUs queue work concurrently. Link: https://patch.msgid.link/20260428-ffa_fixes-v2-3-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-04-29firmware: arm_ffa: Skip free_pages on RX buffer alloc failureSudeep Holla
If the RX buffer allocation fails in ffa_init(), the error path jumps to free_pages even though no buffer has been allocated yet. Route that case directly to free_drv_info so the cleanup path is only used after at least one RX/TX buffer allocation has succeeded. Fixes: 3bbfe9871005 ("firmware: arm_ffa: Add initial Arm FFA driver support") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-2-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-04-29firmware: arm_ffa: Check for NULL FF-A ID table while driver registrationSudeep Holla
The bus match callback assumes that every FF-A driver provides an id_table and dereferences it unconditionally. Enforce that contract at registration time so a buggy client driver cannot crash the bus during match. Fixes: 92743071464f ("firmware: arm_ffa: Ensure drivers provide a probe function") Link: https://patch.msgid.link/20260428-ffa_fixes-v2-1-8595ae450034@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
2026-04-29efi/libstub: Synchronize instruction cache after kernel relocationWANG Rui
The relocated kernel image is copied to its new location using memcpy(). On architectures with separate instruction and data caches, the copied instructions may remain stale in the instruction cache, leading to the execution of outdated contents. Call efi_cache_sync_image() after the relocation copy to ensure the instruction cache is synchronized with the updated memory contents before control is transferred to the relocated kernel. Signed-off-by: WANG Rui <r@hev.cc> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-29efi/loongarch: Implement efi_cache_sync_image()WANG Rui
Provide a LoongArch implementation of efi_cache_sync_image() to ensure instruction cache coherency after the kernel image is relocated. Signed-off-by: WANG Rui <r@hev.cc> Reviewed-by: Huacai Chen <chenhuacai@loongson.cn> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-29efi/libstub: Move efi_relocate_kernel() into its only remaining userArd Biesheuvel
LoongArch is the only arch that still uses efi_relocate_kernel(), so before making changes to it that LoongArch needs, turn it into a private function. Move efi_low_alloc_above() into mem.c while at it, and drop the relocate.c source file altogether. Tested-by: WANG Rui <wangrui@loongson.cn> Reviewed-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-28efi: pstore: Drop efivar lock when efi_pstore_open() returns with an errorThomas Huth
If kzalloc fails, the function returns -ENOMEM without calling efivar_unlock(). Since open() returned an error, the calling site in pstore_get_backend_records() won't call the close() function, so the lock is never released. Thus drop the lock in case of errors here. Fixes: 859748255b434 ("efi: pstore: Omit efivars caching EFI varstore access layer") Assisted-by: Claude:claude-opus-4-6 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-28firmware: google: Add bounds checks in coreboot_table_populate()Titouan Ameline de Cadeville
coreboot_table_populate() iterates over firmware-provided table entries with no validation that the entries stay within the mapped memory region. A corrupt table with a large `entry->size` advances `ptr_entry` past the mapped region, causing an out-of-bounds read on the next iteration. Add a check before dereferencing `ptr_entry` to ensure the entry header is readable, and a second check after reading `entry->size` to ensure the full entry stays within the mapped region. Pass `len` from coreboot_table_probe() into coreboot_table_populate() to make the mapped region size available for validation. Signed-off-by: Titouan Ameline de Cadeville <titouan.ameline@gmail.com> Reviewed-by: Julius Werner <jwerner@chromium.org> Link: https://lore.kernel.org/r/20260426214739.117131-1-titouan.ameline@gmail.com Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-04-24Merge tag 'loongarch-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson Pull LoongArch updates from Huacai Chen: - Adjust build infrastructure for 32BIT/64BIT - Add HIGHMEM (PKMAP and FIX_KMAP) support - Show and handle CPU vulnerabilites correctly - Batch the icache maintenance for jump_label - Add more atomic instructions support for BPF JIT - Add more features (e.g. fsession) support for BPF trampoline - Some bug fixes and other small changes * tag 'loongarch-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson: (21 commits) selftests/bpf: Enable CAN_USE_LOAD_ACQ_STORE_REL for LoongArch LoongArch: BPF: Add fsession support for trampolines LoongArch: BPF: Introduce emit_store_stack_imm64() helper LoongArch: BPF: Support up to 12 function arguments for trampoline LoongArch: BPF: Support small struct arguments for trampoline LoongArch: BPF: Open code and remove invoke_bpf_mod_ret() LoongArch: BPF: Support load-acquire and store-release instructions LoongArch: BPF: Support 8 and 16 bit read-modify-write instructions LoongArch: BPF: Add the default case in emit_atomic() and rename it LoongArch: Define instruction formats for AM{SWAP/ADD}.{B/H} and DBAR LoongArch: Batch the icache maintenance for jump_label LoongArch: Add flush_icache_all()/local_flush_icache_all() LoongArch: Add spectre boundry for syscall dispatch table LoongArch: Show CPU vulnerabilites correctly LoongArch: Make arch_irq_work_has_interrupt() true only if IPI HW exist LoongArch: Use get_random_canary() for stack canary init LoongArch: Improve the logging of disabling KASLR LoongArch: Align FPU register state to 32 bytes LoongArch: Handle CONFIG_32BIT in syscall_get_arch() LoongArch: Add HIGHMEM (PKMAP and FIX_KMAP) support ...
2026-04-22LoongArch: Adjust build infrastructure for 32BIT/64BITHuacai Chen
Adjust build infrastructure (Kconfig, Makefile and ld scripts) to let us enable both 32BIT/64BIT kernel build. Reviewed-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Jiaxun Yang <jiaxun.yang@flygoat.com> Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
2026-04-18Merge tag 'memblock-v7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock Pull memblock updates from Mike Rapoport: - improve debuggability of reserve_mem kernel parameter handling with print outs in case of a failure and debugfs info showing what was actually reserved - Make memblock_free_late() and free_reserved_area() use the same core logic for freeing the memory to buddy and ensure it takes care of updating memblock arrays when ARCH_KEEP_MEMBLOCK is enabled. * tag 'memblock-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rppt/memblock: x86/alternative: delay freeing of smp_locks section memblock: warn when freeing reserved memory before memory map is initialized memblock, treewide: make memblock_free() handle late freeing memblock: make free_reserved_area() update memblock if ARCH_KEEP_MEMBLOCK=y memblock: extract page freeing from free_reserved_area() into a helper memblock: make free_reserved_area() more robust mm: move free_reserved_area() to mm/memblock.c powerpc: opal-core: pair alloc_pages_exact() with free_pages_exact() powerpc: fadump: pair alloc_pages_exact() with free_pages_exact() memblock: reserve_mem: fix end caclulation in reserve_mem_release_by_name() memblock: move reserve_bootmem_range() to memblock.c and make it static memblock: Add reserve_mem debugfs info memblock: Print out errors on reserve_mem parser
2026-04-16Merge tag 'soc-drivers-7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc Pull SoC driver updates from Arnd Bergmann: "The driver updates again are all over the place with many minor fixes going into platform specific code. The most notable changes are: - Support for Microchip pic64gx system controllers - Work on cleaning up devicetree bindings for SoC drivers, and converting them into the new format - Lots of smaller changes for Qualcomm SoC drivers, including support for a number of newly supported chips - reset controller API cleanups and a new driver for Cix Sky1 - Reworks of the Tegra PMC and CBB drivers, along with a change to how individual Tegra SoCs get selected in Kconfig and BPMP firmware driver updates including a refresh of the ABI header to match the version used by firmware - STM32 updates to the firewall bus driver and support for the debug bus through OP-TEE - SCMI firmware driver improvements for reliability, in particular for dealing with broken firmware interrupts - Memory driver updates for Tegra, and a patch to remove the unused Baikal T1 driver" * tag 'soc-drivers-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (193 commits) firmware: arm_ffa: Use the correct buffer size during RXTX_MAP firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X clk: spear: fix resource leak in clk_register_vco_pll() reset: rzv2h-usb2phy: Add support for VBUS mux controller registration reset: rzv2h-usb2phy: Convert to regmap API dt-bindings: reset: renesas,rzv2h-usb2phy: Document RZ/G3E USB2PHY reset dt-bindings: reset: renesas,rzv2h-usb2phy: Add '#mux-state-cells' property soc: microchip: add mpfs gpio interrupt mux driver dt-bindings: soc: microchip: document PolarFire SoC's gpio interrupt mux gpio: mpfs: Add interrupt support soc: qcom: ubwc: add helpers to get programmable values soc: qcom: ubwc: add helper to get min_acc length firmware: qcom: scm: Register gunyah watchdog device soc: qcom: socinfo: Add SoC ID for SA8650P dt-bindings: arm: qcom,ids: Add SoC ID for SA8650P firmware: qcom: scm: Allow QSEECOM on Mahua CRD soc: qcom: wcnss: simplify allocation of req soc: qcom: pd-mapper: Add support for Eliza soc: qcom: aoss: compare against normalized cooling state soc: qcom: llcc: fix v1 SB syndrome register offset ...
2026-04-16Merge tag 'efi-next-for-v7.1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: "Again not a busy cycle for EFI, just some minor tweaks and bug fixes: - Enable boot graphics resource table (BGRT) on Xen/x86 - Correct a misguided assumption in the memory attributes table sanity check - Start tagging efi_mem_reserve()'d regions as MEMBLOCK_RSRV_KERN - Some other minor fixes and cleanups" * tag 'efi-next-for-v7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efi/capsule-loader: fix incorrect sizeof in phys array reallocation efi: Tag memblock reservations of boot services regions as RSRV_KERN memblock: Permit existing reserved regions to be marked RSRV_KERN efi/memattr: Fix thinko in table size sanity check efi: libstub: fix type of fdt 32 and 64bit variables efi: Drop unused efi_range_is_wc() function efi: Enable BGRT loading under Xen efi: make efi_mem_type() and efi_mem_attributes() work on Xen PV
2026-04-15Merge tag 'wq-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wqLinus Torvalds
Pull workqueue updates from Tejun Heo: - New default WQ_AFFN_CACHE_SHARD affinity scope subdivides LLCs into smaller shards to improve scalability on machines with many CPUs per LLC - Misc: - system_dfl_long_wq for long unbound works - devm_alloc_workqueue() for device-managed allocation - sysfs exposure for ordered workqueues and the EFI workqueue - removal of HK_TYPE_WQ from wq_unbound_cpumask - various small fixes * tag 'wq-for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq: (21 commits) workqueue: validate cpumask_first() result in llc_populate_cpu_shard_id() workqueue: use NR_STD_WORKER_POOLS instead of hardcoded value workqueue: avoid unguarded 64-bit division docs: workqueue: document WQ_AFFN_CACHE_SHARD affinity scope workqueue: add test_workqueue benchmark module tools/workqueue: add CACHE_SHARD support to wq_dump.py workqueue: set WQ_AFFN_CACHE_SHARD as the default affinity scope workqueue: add WQ_AFFN_CACHE_SHARD affinity scope workqueue: fix typo in WQ_AFFN_SMT comment workqueue: Remove HK_TYPE_WQ from affecting wq_unbound_cpumask workqueue: unlink pwqs from wq->pwqs list in alloc_and_link_pwqs() error path workqueue: Remove NULL wq WARN in __queue_delayed_work() workqueue: fix parse_affn_scope() prefix matching bug workqueue: devres: Add device-managed allocate workqueue workqueue: Add system_dfl_long_wq for long unbound works tools/workqueue/wq_dump.py: add NODE prefix to all node columns tools/workqueue/wq_dump.py: fix column alignment in node_nr/max_active section tools/workqueue/wq_dump.py: remove backslash separator from node_nr/max_active header efi: Allow to expose the workqueue via sysfs workqueue: Allow to expose ordered workqueues via sysfs ...
2026-04-15Merge tag 'sound-7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "Nothing too thrilling here, but we see lots of driver updates and bug fixes, including quirk additions and refactoring works, while there have been little changes in the core functionality. Here are some highlights: Core: - Add validation for the control API put callback - Fixes in compress-offload API timestamp handling - Continued ASoC core API cleanups ASoC: - Add support for bus keepers (for Apple devices in future) - Enhancements to the SDCA support, including retaskable jacks - Test improvements for Cirrus Logic drivers - Lots of fixes for the NXP, nVidia and Qualcomm - Support for AMD RPL DMIC, Cirrus Logic CS42L43 and CS47L47, nVidia machines with CPCAP and WM8962 USB-audio: - Quirks for Huawei Headset, Focusrite Novation, MV-Silicon, Studio 1824, Arturia AF16Rig, Hotone Audio, Feaulle Rainbow, PreSonus AudioBox, Moondrop Ju Jiu, Scarlett 18i20, etc - Extended mixer volume quirk handling - UAF and other fixes for us144mkii, 6fire and caiaq drivers HD-audio: - Add quirks or fixes for Acer, Lenovo, HP, ASUS machines - Fixes & cleanups of GPIO helper code Misc: - Add suspend/resume support for multiple legacy ISA and Apple drivers - Further regression fixes for ctxfi driver" * tag 'sound-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (359 commits) ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() ALSA: usb-audio: Fix missing error handling for get_min_max*() ALSA: hda/realtek - fixed speaker no sound update ALSA: hda/realtek: Add quirk for Acer PT316-51S headset mic ALSA: usb-audio: Exclude Scarlett 18i20 1st Gen from SKIP_IFACE_SETUP ALSA: hda/realtek: Add quirk for Legion S7 15IMH ALSA: hda/realtek: Add quirk for HP Spectre x360 14-ea ALSA: caiaq: take a reference on the USB device in create_card() ASoC: dt-bindings: rockchip: convert rk3399-gru-sound to DT Schema ALSA: sscape: Add suspend and resume support ALSA: sscape: Cache per-card resources for board reinitialization ALSA: usb-audio: Do not expose sticky mixers ALSA: usb-audio: Move volume control resolution check into a function ALSA: usb-audio: Add error checks against get_min_max*() ALSA: usb-audio: Add quirk for PreSonus AudioBox USB ALSA: interwave: guard PM-only restore helpers with CONFIG_PM ALSA: usb-audio: Evaluate packsize caps at the right place ALSA: sc6000: Restore board setup across suspend ALSA: sc6000: Keep the programmed board state in card-private data ALSA: 6fire: fix use-after-free on disconnect ...
2026-04-15Merge tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - new DRM RAS infrastructure using netlink - amdgpu: enable DC on CIK APUs, and more IP enablement, and more user queue work - xe: purgeable BO support, and new hw enablement - dma-buf : add revocable operations Full summary: mm: - two-pass MMU interval notifiers - add gpu active/reclaim per-node stat counters math: - provide __KERNEL_DIV_ROUND_CLOSEST() in UAPI - implement DIV_ROUND_CLOSEST() with __KERNEL_DIV_ROUND_CLOSEST() rust: - shared tag with driver-core: register macro and io infra - core: rework DMA coherent API - core: add interop::list to interop with C linked lists - core: add more num::Bounded operations - core: enable generic_arg_infer and add EMSGSIZE - workqueue: add ARef<T> support for work and delayed work - add GPU buddy allocator abstraction - add DRM shmem GEM helper abstraction - allow drm:::Device to dispatch work and delayed work items to driver private data - add dma_resv_lock helper and raw accessors core: - introduce DRM RAS infrastructure over netlink - add connector panel_type property - fourcc: add ARM interleaved 64k modifier - colorop: add destroy helper - suballoc: split into alloc and init helpers - mode: provide DRM_ARGB_GET*() macros for reading color components edid: - provide drm_output_color_Format dma-buf: - provide revoke mechanism for shared buffers - rename move_notify to invalidate_mappings - always enable move_notify - protect dma_fence_ops with RCU and improve locking - clean pages with helpers atomic: - allocate drm_private_state via callback - helper: use system_percpu_wq buddy: - make buddy allocator available to gpu level - add kernel-doc for buddy allocator - improve aligned allocation ttm: - fix fence signalling - improve tests and docs - improve handling of gfp_retry_mayfail - use per-node stat counters to track memory allocations - port pool to use list_lru - drop NUMA specific pools - make pool shrinker numa aware - track allocated pages per numa node coreboot: - cleanup coreboot framebuffer support sched: - fix race condition in drm_sched_fini pagemap: - enable THP support - pass pagemap_addr by reference gem-shmem: - Track page accessed/dirty status across mmap/vmap gpusvm: - reenable device to device migration - fix unbalanced unclock bridge: - anx7625: Support USB-C plus DT bindings - connector: Fix EDID detection - dw-hdmi-qp: Support Vendor-Specfic and SDP Infoframes; improve others - fsl-ldb: Fix visual artifacts plus related DT property 'enable-termination-resistor' - imx8qxp-pixel-link: Improve bridge reference handling - lt9611: Support Port-B-only input plus DT bindings - tda998x: Support DRM_BRIDGE_ATTACH_NO_CONNECTOR; Clean up - Support TH1520 HDMI plus DT bindings - waveshare-dsi: Fix register and attach; Support 1..4 DSI lanes plus DT bindings - anx7625: Fix USB Type-C handling - cdns-mhdp8546-core: Handle HDCP state in bridge atomic_check - Support Lontium LT8713SX DP MST bridge plus DT bindings - analogix_dp: Use DP helpers for link training panel: - panel-jdi-lt070me05000: Use mipi-dsi multi functions - panel-edp: Support Add AUO B116XAT04.1 (HW: 1A); Support CMN N116BCL-EAK (C2); Support FriendlyELEC plus DT changes - panel-edp: Fix timings for BOE NV140WUM-N64 - ilitek-ili9882t: Allow GPIO calls to sleep - jadard: Support TAIGUAN XTI05101-01A - lxd: Support LXD M9189A plus DT bindings - mantix: Fix pixel clock; Clean up - motorola: Support Motorola Atrix 4G and Droid X2 plus DT bindings - novatek: Support Novatek/Tianma NT37700F plus DT bindings - simple: Support EDT ET057023UDBA plus DT bindings; Support Powertip PH800480T032-ZHC19 plus DT bindings; Support Waveshare 13.3" - novatek-nt36672a: Use mipi_dsi_*_multi() functions - panel-edp: Support BOE NV153WUM-N42, CMN N153JCA-ELK, CSW MNF307QS3-2 - support Himax HX83121A plus DT bindings - support JuTouch JT070TM041 plus DT bindings - support Samsung S6E8FC0 plus DT bindings - himax-hx83102c: support Samsung S6E8FC0 plus DT bindings; support backlight - ili9806e: support Rocktech RK050HR345-CT106A plus DT bindings - simple: support Tianma TM050RDH03 plus DT bindings amdgpu: - enable DC by default on CIK APUs - userq fence ioctl param size fixes - set panel_type to OLED for eDP - refactor DC i2c code - FAMS2 update - rework ttm handling to allow multiple engines - DC DCE 6.x cleanup - DC support for NUTMEG/TRAVIS DP bridge - DCN 4.2 support - GC12 idle power fix for compute - use struct drm_edid in non-DC code - enable NV12/P010 support on primary planes - support newer IP discovery tables - VCN/JPEG 5.0.2 support - GC/MES 12.1 updates - USERQ fixes - add DC idle state manager - eDP DSC seamless boot amdkfd: - GC 12.1 updates - non 4K page fixes xe: - basic Xe3p_LPG and NVL-P enabling patches - allow VM_BIND decompress support - add purgeable buffer object support - add xe_vm_get_property_ioctl - restrict multi-lrc to VCS/VECS engines - allow disabling VM overcommit in fault mode - dGPU memory optimizations - Workaround cleanups and simplification - Allow VFs VRAM quote changes using sysfs - convert GT stats to per-cpu counters - pagefault refactors - enable multi-queue on xe3p_xpc - disable DCC on PTL - make MMIO communication more robust - disable D3Cold for BMG on specific platforms - vfio: improve FLR sync for Xe VFIO i915/display: - C10/C20/LT PHY PLL divider verification - use trans push mechanism to generate PSR frame change on LNL+ - refactor DP DSC slice config - VGA decode refactoring - refactor DPT, gen2-4 overlay, masked field register macro helpers - refactor stolen memory allocation decisions - prepare for UHBR DP tunnels - refactor LT PHY PLL to use DPLL framework - implement register polling/waiting in display code - add shared stepping header between i915 and display i915: - fix potential overflow of shmem scatterlist length nouveau: - provide Z cull info to userspace - initial GA100 support - shutdown on PCI device shutdown nova-core: - harden GSP command queue - add support for large RPCs - simplify GSP sequencer and message handling - refactor falcon firmware handling - convert to new register macro - conver to new DMA coherent API - use checked arithmetic - add debugfs support for gsp-rm log buffers - fix aux device registration for multi-GPU msm: - CI: - Uprev mesa - Restore CI jobs for Qualcomm APQ8016 and APQ8096 devices - Core: - Switched to of_get_available_child_by_name() - DPU: - Fixes for DSC panels - Fixed brownout because of the frequency / OPP mismatch - Quad pipe preparation (not enabled yet) - Switched to virtual planes by default - Dropped VBIF_NRT support - Added support for Eliza platform - Reworked alpha handling - Switched to correct CWB definitions on Eliza - Dropped dummy INTF_0 on MSM8953 - Corrected INTFs related to DP-MST - DP: - Removed debug prints looking into PHY internals - DSI: - Fixes for DSC panels - RGB101010 support - Support for SC8280XP - Moved PHY bindings from display/ to phy/ - GPU: - Preemption support for x2-85 and a840 - IFPC support for a840 - SKU detection support for x2-85 and a840 - Expose AQE support (VK ray-pipeline) - Avoid locking in VM_BIND fence signaling path - Fix to avoid reclaim in GPU snapshot path - Disallow foreign mapping of _NO_SHARE BOs - HDMI: - Fixed infoframes programming - MDP5: - Dropped support for MSM8974v1 - Dropped now unused code for MSM8974 v1 and SDM660 / MSM8998 panthor: - add tracepoints for power and IRQs - fix fence handling - extend timestamp query with flags - support various sources for timestamp queries tyr: - fix names and model/versions rockchip: - vop2: use drm logging function - rk3576 displayport support - support CRTC background color atmel-hlcdc: - support sana5d65 LCD controller tilcdc: - use DT bindings schema - use managed DRM interfaces - support DRM_BRIDGE_ATTACH_NO_CONNECTOR verisilicon: - support DC8200 + DT bindings virtgpu: - support PRIME import with 3D enabled komeda: - fix integer overflow in AFBC checks mcde: - improve bridge handling gma500: - use drm client buffer for fbdev framebuffer amdxdna: - add sensors ioctls - provide NPU power estimate - support column utilization sensor - allow forcing DMA through IOMMU IOVA - support per-BO mem usage queries - refactor GEM implementation ivpu: - update boot API to v3.29.4 - limit per-user number of doorbells/contexts - perform engine reset on TDR error loongson: - replace custom code with drm_gem_ttm_dumb_map_offset() imx: - support planes behind the primary plane - fix bus-format selection vkms: - support CRTC background color v3d: - improve handling of struct v3d_stats komeda: - support Arm China Linlon D6 plus DT bindings imagination: - improve power-off sequence - support context-reset notification from firmware mediatek: - mtk_dsi: enable hs clock during pre-enable - Remove all conflicting aperture devices during probe - Add support for mt8167 display blocks" * tag 'drm-next-2026-04-15' of https://gitlab.freedesktop.org/drm/kernel: (1735 commits) drm/ttm/tests: Remove checks from ttm_pool_free_no_dma_alloc drm/ttm/tests: fix lru_count ASSERT drm/vram: remove DRM_VRAM_MM_FILE_OPERATIONS from docs drm/fb-helper: Fix a locking bug in an error path dma-fence: correct kernel-doc function parameter @flags ttm/pool: track allocated_pages per numa node. ttm/pool: make pool shrinker NUMA aware (v2) ttm/pool: drop numa specific pools ttm/pool: port to list_lru. (v2) drm/ttm: use gpu mm stats to track gpu memory allocations. (v4) mm: add gpu active/reclaim per-node stat counters (v2) gpu: nova-core: fix missing colon in SEC2 boot debug message gpu: nova-core: vbios: use from_le_bytes() for PCI ROM header parsing gpu: nova-core: bitfield: fix broken Default implementation gpu: nova-core: falcon: pad firmware DMA object size to required block alignment gpu: nova-core: gsp: fix undefined behavior in command queue code drm/shmem_helper: Make sure PMD entries get the writeable upgrade accel/ivpu: Trigger recovery on TDR with OS scheduling drm/msm: Use of_get_available_child_by_name() dt-bindings: display/msm: move DSI PHY bindings to phy/ subdir ...
2026-04-14Merge tag 'x86-platform-2026-04-13' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip Pull x86 platform updates from Ingo Molnar: - Remove M486/M486SX/ELAN support, first minimal step (Ingo Molnar) - Print AGESA string from DMI additional information entry (Yazen Ghannam, Mario Limonciello) - Improve and fix the DMI code (Mario Limonciello): - Correct an indexing error in <linux/dmi.h> - Adjust dmi_decode() to use enums <linux/dmi.h> - Add pr_fmt() for dmi_scan.c to fix & standardize the log prefixes * tag 'x86-platform-2026-04-13' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: x86/CPU/AMD: Print AGESA string from DMI additional information entry firmware: dmi: Add pr_fmt() for dmi_scan.c firmware: dmi: Adjust dmi_decode() to use enums firmware: dmi: Correct an indexing error in dmi.h x86/cpu: Remove M486/M486SX/ELAN support
2026-04-14Merge tag 'kbuild-7.1-1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux Pull Kbuild/Kconfig updates from Nicolas Schier: "Kbuild: - reject unexpected values for LLVM= - uapi: remove usage of toolchain headers - switch from '-fms-extensions' to '-fms-anonymous-structs' when available (currently: clang >= 23.0.0) - reduce the number of compiler-generated suffixes for clang thin-lto build - reduce output spam ("GEN Makefile") when building out of tree - improve portability for testing headers - also test UAPI headers against C++ compilers - drop build ID architecture allow-list in vdso_install - only run checksyscalls when necessary - update the debug information notes in reproducible-builds.rst - expand inlining hints with -fdiagnostics-show-inlining-chain Kconfig: - forbid multiple entries with the same symbol in a choice - error out on duplicated kconfig inclusion" * tag 'kbuild-7.1-1' of git://git.kernel.org/pub/scm/linux/kernel/git/kbuild/linux: (35 commits) kbuild: expand inlining hints with -fdiagnostics-show-inlining-chain kconfig: forbid multiple entries with the same symbol in a choice Documentation: kbuild: Update the debug information notes in reproducible-builds.rst checksyscalls: move instance functionality into generic code checksyscalls: only run when necessary checksyscalls: fail on all intermediate errors checksyscalls: move path to reference table to a variable kbuild: vdso_install: drop build ID architecture allow-list kbuild: vdso_install: gracefully handle images without build ID kbuild: vdso_install: hide readelf warnings kbuild: vdso_install: split out the readelf invocation kbuild: uapi: also test UAPI headers against C++ compilers kbuild: uapi: provide a C++ compatible dummy definition of NULL kbuild: uapi: handle UML in architecture-specific exclusion lists kbuild: uapi: move all include path flags together kbuild: uapi: move some compiler arguments out of the command definition check-uapi: use dummy libc includes check-uapi: honor ${CROSS_COMPILE} setting check-uapi: link into shared objects kbuild: reduce output spam when building out of tree ...
2026-04-13Merge tag 'gpio-updates-for-v7.1-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux Pull gpio updates from Bartosz Golaszewski: "For this merge window we have two new drivers: support for GPIO-signalled ACPI events on Intel platforms and a generic GPIO-over-pinctrl driver using the ARM SCMI protocol for controlling pins. Several things have been reworked in GPIO core: we unduplicated GPIO hog handling, reduced the number of SRCU locks and dereferences, improved support for software-node-based lookup and removed more legacy code after converting remaining users to modern alternatives. There's also a number of driver reworks and refactoring, documentation updates, some bug-fixes and new tests. GPIO core: - defer probe on software node lookups when the remote software node exists but has not been registered as a firmware node yet - unify GPIO hog handling by moving code duplicated in OF and ACPI modules into GPIO core and allow setting up hogs with software nodes - allow matching GPIO controllers by secondary firmware node if matching by primary does not succeed - demote deferral warnings to debug level as they are quite normal when using software nodes which don't support fw_devlink yet - disable the legacy GPIO character device uAPI v1 supprt in Kconfig by default - rework several core functions in preparation for the upcoming Revocable helper library for protecting resources against sudden removal, this reduces the number of SRCU dereferences in GPIO core - simplify file descriptor logic in GPIO character device code by using FD_PREPARE() - introduce a header defining symbols used by both GPIO consumers and providers to avoid having to include provider-specific headers from drivers which only consume GPIOs - replace snprintf() with strscpy() where formatting is not required New drivers: - add the gpio-by-pinctrl generic driver using the ARM SCMI protocol to control GPIOs (along with SCMI changes pulled from the pinctrl tree) - add a driver providing support for handling of platform events via GPIO-signalled ACPI events (used on Intel Nova Lake and later platforms) Driver changes: - extend the gpio-kempld driver with support for more recent models, interrupts and setting/getting multiple values at once - improve interrupt handling in gpio-brcmstb - add support for multi-SoC systems in gpio-tegra186 - make sure we return correct values from the .get() callbacks in several GPIO drivers by normalizing any values other than 0, 1 or negative error numbers - use flexible arrays in several drivers to reduce the number of required memory allocations - simplify synchronous waiting for virtual drivers to probe and remove the dedicated, a bit overengineered helper library dev-sync-probe - remove unneeded Kconfig dependencies on OF_GPIO in several drivers and subsystems - convert the two remaining users of of_get_named_gpio() to using GPIO descriptors and remove the (no longer used) function along with the header that declares it - add missing includes in gpio-mmio - shrink and simplify code in gpio-max732x by using guard(mutex) - remove duplicated code handling the 'ngpios' property from gpio-ts4800, it's already handled in GPIO core - use correct variable type in gpio-aspeed - add support for a new model in gpio-realtek-otto - allow to specify the active-low setting of simulated hogs over the configfs interface (in addition to existing devicetree support) in gpio-sim Bug fixes: - clear the OF_POPULATED flag on hog nodes in GPIO chip remove path on OF systems - fix resource leaks in error path in gpiochip_add_data_with_key() - drop redundant device reference in gpio-mpsse Tests: - add selftests for use-after-free cases in GPIO character device code DT bindings: - add a DT binding document for SCMI based, gpio-over-pinctrl devices - fix interrupt description in microchip,mpfs-gpio - add new compatible for gpio-realtek-otto - describe the resets of the mpfs-gpio controller - fix maintainer's email in gpio-delay bindings - remove the binding document for cavium,thunder-8890 as the corresponding device is bound over PCI and not firmware nodes Documentation: - update the recommended way of converting legacy boards to using software nodes for GPIO description - describe GPIO line value semantics - misc updates to kerneldocs Misc: - convert OMAP1 ams-delta board to using GPIO hogs described with software nodes" * tag 'gpio-updates-for-v7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux: (79 commits) gpio: swnode: defer probe on references to unregistered software nodes dt-bindings: gpio: cavium,thunder-8890: Remove DT binding Documentation: gpio: update the preferred method for using software node lookup gpio: gpio-by-pinctrl: s/used to do/is used to do/ gpio: aspeed: fix unsigned long int declaration gpio: rockchip: convert to dynamic GPIO base allocation gpio: remove dev-sync-probe gpio: virtuser: stop using dev-sync-probe gpio: aggregator: stop using dev-sync-probe gpio: sim: stop using dev-sync-probe gpio: Add Intel Nova Lake ACPI GPIO events driver gpiolib: Make deferral warnings debug messages gpiolib: fix hogs with multiple lines gpio: fix up CONFIG_OF dependencies gpio: gpio-by-pinctrl: add pinctrl based generic GPIO driver gpio: dt-bindings: Add GPIO on top of generic pin control firmware: arm_scmi: Allow PINCTRL_REQUEST to return EOPNOTSUPP pinctrl: scmi: ignore PIN_CONFIG_PERSIST_STATE pinctrl: scmi: Delete PIN_CONFIG_OUTPUT_IMPEDANCE_OHMS support pinctrl: scmi: Add SCMI_PIN_INPUT_VALUE ...
2026-04-11Merge tag 'ffa-fix-7.1' of ↵Krzysztof Kozlowski
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers Arm FF-A fix for v7.1 Use the page aligned backing allocation size when computing the RXTX_MAP page count. This fixes FF-A RX/TX buffer registration on kernels built with 16K/64K PAGE_SIZE, where alloc_pages_exact() backs the buffer with a larger aligned span than the discovered minimum buffer size. * tag 'ffa-fix-7.1' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Use the correct buffer size during RXTX_MAP Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-11Merge tag 'qcom-drivers-for-7.1-2' of ↵Krzysztof Kozlowski
ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers One more Qualcomm driver update for v7.1 Flag Lenovo IdeaCentre Mini X to have functional QSEECOM/uefisecapp. * tag 'qcom-drivers-for-7.1-2' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux: firmware: qcom: scm: Allow QSEECOM on Lenovo IdeaCentre Mini X Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
2026-04-10efi/capsule-loader: fix incorrect sizeof in phys array reallocationThomas Huth
The krealloc() call for cap_info->phys in __efi_capsule_setup_info() uses sizeof(phys_addr_t *) instead of sizeof(phys_addr_t), which might be causing an undersized allocation. The allocation is also inconsistent with the initial array allocation in efi_capsule_open() that allocates one entry with sizeof(phys_addr_t), and the efi_capsule_write() function that stores phys_addr_t values (not pointers) via page_to_phys(). On 64-bit systems where sizeof(phys_addr_t) == sizeof(phys_addr_t *), this goes unnoticed. On 32-bit systems with PAE where phys_addr_t is 64-bit but pointers are 32-bit, this allocates half the required space, which might lead to a heap buffer overflow when storing physical addresses. This is similar to the bug fixed in commit fccfa646ef36 ("efi/capsule-loader: fix incorrect allocation size") which fixed the same issue at the initial allocation site. Fixes: f24c4d478013 ("efi/capsule-loader: Reinstate virtual capsule mapping") Assisted-by: Claude:claude-sonnet-4-5 Signed-off-by: Thomas Huth <thuth@redhat.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-09Merge tag 'efi-fixes-for-v7.0-4' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI fix from Ard Biesheuvel: "Fix an incorrect preprocessor conditional that may result in duplicate instances of sysfb_primary_display on x86" * tag 'efi-fixes-for-v7.0-4' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: firmware: efi: Never declare sysfb_primary_display on x86
2026-04-09Merge tag 'pmdomain-v7.0-rc6' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm Pull pmdomain fixes from Ulf Hansson: - imx: Prevent hang at power down for imx8mp-blk-ctrl - thead: Fix buffer overflow for TH1520 AON driver - Change Ulf Hansson's email * tag 'pmdomain-v7.0-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm: MAINTAINERS, mailmap: Change Ulf Hansson's email pmdomain: imx8mp-blk-ctrl: Keep the NOC_HDCP clock enabled firmware: thead: Fix buffer overflow and use standard endian macros
2026-04-09efi: Tag memblock reservations of boot services regions as RSRV_KERNArd Biesheuvel
By definition, EFI memory regions of type boot services code or data have no special significance to the firmware at runtime, only to the OS. In some cases, the firmware will allocate tables and other assets that are passed in memory in regions of this type, and leave it up to the OS to decide whether or not to treat the allocation as special, or simply consume the contents at boot and recycle the RAM for ordinary use. The reason for this approach is that it avoids needless memory reservations for assets that the OS knows nothing about, and therefore doesn't know how to free either. This means that any memblock reservations covering such regions can be marked as MEMBLOCK_RSRV_KERN - this is a better match semantically, and is useful on x86 to distinguish true reservations from temporary reservations that are only needed to work around firmware bugs. Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-09efi/memattr: Fix thinko in table size sanity checkArd Biesheuvel
While it is true that each PE/COFF runtime driver in memory can generally be split into 3 different regions (the header, the code/rodata region and the data/bss region), each with different permissions, it does not mean that 3x the size of the memory map is a suitable upper bound. This is due to the fact that all runtime drivers could be coalesced into a single EFI runtime code region by the firmware, and if the firmware does a good job of keeping the fragmentation down, it is conceivable that the memory attributes table has more entries than the EFI memory map itself. So instead, base the sanity check on whether the descriptor size matches the EFI memory map's descriptor size closely enough (which is not mandated by the spec but extremely unlikely to differ in practice), and whether the size of the whole table does not exceed 64k entries. Reviewed-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-04-08firmware: efi: Never declare sysfb_primary_display on x86Thomas Zimmermann
The x86 architecture comes with its own instance of the global state variable sysfb_primary_display. Never declare it in the EFI subsystem. Fix the test for CONFIG_FIRMWARE_EDID accordingly. Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Fixes: e65ca1646311 ("efi: export sysfb_primary_display for EDID") Signed-off-by: Ard Biesheuvel <ardb@kernel.org>