summaryrefslogtreecommitdiff
path: root/drivers/firmware
AgeCommit message (Collapse)Author
16 hoursMerge branch 'next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
17 hoursMerge branch 'for-firmware-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git
17 hoursMerge branch 'for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
19 hoursMerge branch 'drm-next' of https://gitlab.freedesktop.org/drm/kernel.gitMark Brown
# Conflicts: # drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c # drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_irq.c # drivers/gpu/drm/nouveau/nouveau_connector.c # drivers/gpu/drm/nouveau/nvkm/subdev/gsp/rm/r570/fbsr.c # drivers/gpu/drm/xe/xe_pagefault.c
20 hoursMerge branch 'linux-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
20 hoursMerge branch 'riscv-soc-for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/conor/linux.git
20 hoursMerge branch 'ti-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/ti/linux.git
20 hoursMerge branch 'for-linux-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git
20 hoursMerge branch 'for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git
20 hoursMerge branch 'for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/frank.li/linux.git
20 hoursMerge branch 'kbuild-for-next' of ↵Mark Brown
ssh://git@gitolite.kernel.org/pub/scm/linux/kernel/git/kbuild/linux.git
3 daysMerge branches 'arm64-defconfig-for-7.4', 'arm64-fixes-for-7.3', ↵Bjorn Andersson
'arm64-for-7.4', 'clk-fixes-for-7.3', 'clk-for-7.4', 'drivers-fixes-for-7.3' and 'drivers-for-7.4' into for-next
4 daystee: remove TZMEM_MODE_GENERICJulian Braha
'select' does not work on config options in a 'choice', so currently it is possible to enable QCOMTEE without QCOM_TZMEM_MODE_SHMBRIDGE, even though this is needed at runtime. There are no users of the generic allocator option, QCOM_TZMEM_MODE_GENERIC, so let's remove it. Then, we can remove the containing choice..endchoice, which allows the 'select' to work as intended. Suggested-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Julian Braha <julianbraha@gmail.com> Reviewed-by: Arnd Bergmann <arnd@arndb.de> Reviewed-by: Nathan Chancellor <nathan@kernel.org> Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com> Link: https://patch.msgid.link/20260807175041.3299349-1-julianbraha@gmail.com Signed-off-by: Nathan Chancellor <nathan@kernel.org>
5 daysMerge branches 'imx/drivers', 'imx/dt', 'imx/dt64', 'imx/ele', 'imx/fixes' ↵Frank Li
and 'imx/soc' into for-next
5 daysfirmware: imx: adds miscdevPankaj Gupta
Adds the driver for communication interface to secure-enclave, that enables exchanging messages with NXP secure enclave HW IP(s) like EdgeLock Enclave, from: - User-Space Applications via character driver. ABI documentation for the NXP secure-enclave driver. User-space library using this driver: - i.MX Secure Enclave library: -- URL: https://github.com/nxp-imx/imx-secure-enclave.git, - i.MX Secure Middle-Ware: -- URL: https://github.com/nxp-imx/imx-smw.git Following checks are performed on the incoming msg-header, to block exchanging invalid arbitrary commands: - maximum allowed words, - check if command-tag & response-tag are valid - version, - command id validation check, to allow limited base-line API(s) and restrict following: - exchanging power management commands. - reset requests. - BBSM configuration requests. - re-initializing the FW. - RNG init - CAAM resource release management - SE's internal memory management. from user-space. Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
5 daysMerge branches 'for-next/scmi/updates' and 'for-next/juno/updates' of ↵Sudeep Holla
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux * 'for-next/scmi/updates' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (21 commits) firmware: arm_scmi: Validate PCC shared memory signature firmware: arm_scmi: Initialise known ACPI protocol devices and channels firmware: arm_scmi: Add ACPI PCC transport firmware: arm_scmi: Refactor protocol device creation logic firmware: arm_scmi: Pass protocol ID to transport chan_available() firmware: arm_scmi: Fall back to ACPI HID when "compatible" is absent firmware: arm_scmi: Convert OF-only paths to generic fwnode in SCMI core firmware: arm_scmi: Extend transport driver macro to support ACPI firmware: arm_scmi: Set generated device fwnode with platform helpers firmware: arm_scmi: Merge scmi_reset_proto_ops.name_get() and .latency_get() firmware: arm_scmi: Fix error path leak in scmi_raw_message_send() firmware: arm_scmi: Don't reuse raw xfers with async_done still armed firmware: arm_scmi: Protect xfer->async_done with xfer->lock include: trace: Use string helpers in msg_dump trace events firmware: arm_scmi: Fix typo "upto" in comment firmware: arm_ffa: Tear down driver during shutdown clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS ... * 'for-next/juno/updates' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: arm64: dts: fvp: Add additional PCIe memory region arm64: dts: fvp: Add EL2 Generic watchdog arm64: dts: fvp: Add cpu-map property
5 daysfirmware: qcom: scm: Allow QSEECOM on Asus Zenbook A14 (UX3407NA)Bjorn Andersson
In line with other Glymur-based machines, the Asus Zenbook A14 (UX3407NA) exposes EFI variables through the "uefisecapp". Add it to the QSEECOM allowlist to enable this access. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@oss.qualcomm.com> Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260915-zenbook-dts-v2-3-41de8669a7a8@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
6 daysfirmware: arm_scmi: Validate PCC shared memory signatureSudeep Holla
Validate the PCC shared memory signature when setting up an SCMI PCC channel. Reject channels whose shared memory signature does not encode PCC_SIGNATURE combined with the PCC subspace ID, so misconfigured firmware is caught before the transport starts using the shared memory region. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-9-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Initialise known ACPI protocol devices and channelsSudeep Holla
Unlike Device Tree, the ACPI SCMI namespace device does not provide child fwnodes to represent each protocol. Iterate over the non-BASE entries in scmi_dsd_info_list to initialize their protocol devices and transport channels. The BASE channel and device are handled by the common setup path. Let the transport channel-availability and SCMI protocol implementation checks decide which of the known protocols are usable on the platform. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-8-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Add ACPI PCC transportSudeep Holla
Add an SCMI transport for ACPI-described systems using PCCT PCC subspaces through the Linux PCC mailbox layer. Parse the SCMI Device Properties _DSD packages defined by Arm document 111115A v1.0, sections 2.2.1.1, 2.2.2.1 and 2.2.3. Map transport UIDs to PCC subspaces for common and protocol-exclusive A2P and P2A channels, validate the mappings, and cache them for channel setup. Support the Powercap and System Telemetry protocol properties and add the System Telemetry protocol ID. Implement PCC channel management, message framing, shared-memory bounds validation, and response and notification delivery. Add the corresponding Kconfig, module and ARML0001 ACPI matching plumbing. Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-7-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Refactor protocol device creation logicSudeep Holla
Move the protocol validation and device creation logic in scmi_probe() into a reusable scmi_device_check_create() helper. The helper centralizes checks for the protocol ID range, implementation availability and duplicate activation before invoking scmi_create_protocol_devices(). This preserves the existing behavior while allowing the logic to be reused by the ACPI path, where protocol child fwnodes are absent. No functional change intended. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-6-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Pass protocol ID to transport chan_available()Sudeep Holla
Pass the protocol ID to the transport chan_available() callback so a transport can distinguish channels associated with different protocols when they share the same firmware node. This is required by the ACPI PCC transport to resolve protocol-exclusive PCC subspaces. Update all transport implementations for the new callback signature. Existing transports ignore the protocol ID, so there is no functional change. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-5-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Fall back to ACPI HID when "compatible" is absentSudeep Holla
scmi_debugfs_common_setup() uses the "compatible" property to populate the debugfs transport type string. ACPI-described SCMI devices do not provide that DT property, so the string remains NULL and debugfs setup falls through the allocation failure path. Check the property lookup result and use the ACPI HID as the fallback transport type when an ACPI companion is present. All supported DT SCMI platforms are expected to provide "compatible", so the non-ACPI fallback is not needed for normal DT operation. Keep the explicit "unknown" fallback anyway to avoid passing NULL to kstrdup() if that assumption is ever violated. Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-4-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Convert OF-only paths to generic fwnode in SCMI coreSudeep Holla
Switch SCMI core plumbing from struct device_node * to struct fwnode_handle * so the core can describe SCMI instances and protocols using firmware nodes rather than OF nodes directly. This change: - Replaces core OF property lookups with fwnode_property_*() helpers. - Plumbs fwnode through the SCMI device creation and channel setup paths. - Updates transport ->chan_available() callbacks to take a fwnode. - Stores per-protocol child fwnodes in info->active_protocols so the core can later locate the descriptor for a given protocol ID. - Updates mailbox/optee/smc/virtio transports to accept fwnodes and map back to OF nodes where their existing parsing remains DT-specific. DT-only transports such as mailbox, OP-TEE and SMC still parse DT properties by mapping the fwnode back to an OF node. On non-DT systems these transports report no channel available. This is a mechanical step towards firmware-node neutrality and prepares the SCMI core for non-DT transports, such as an ACPI/PCC transport. DT users continue to work unchanged; no non-DT transport is enabled by this patch. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-3-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Extend transport driver macro to support ACPISudeep Holla
Extend the SCMI transport driver helper to support ACPI-based systems. Introduce an internal helper macro that accepts both OF and ACPI match tables, and expose two wrappers: - DEFINE_SCMI_TRANSPORT_DRIVER(...) for DT/OF transports - DEFINE_SCMI_ACPI_TRANSPORT_DRIVER(...) for ACPI transports For ACPI, set the generated platform_driver .acpi_match_table via ACPI_PTR(). The ACPI wrapper relies on the firmware-node propagation provided by the preceding change so fwnode lookups on the spawned platform device see the correct firmware description. Keep existing DT users unchanged while allowing transports to be probed using struct acpi_device_id tables on ACPI platforms. Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-2-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
6 daysfirmware: arm_scmi: Set generated device fwnode with platform helpersSudeep Holla
The SCMI transport probe helper creates a platform device for the SCMI core. device_set_of_node_from_dev() propagates the supplier's OF node, but leaves generated devices for non-DT transports without a firmware node. Use platform_device_set_of_node_from_dev() for devicetree suppliers so the shared OF node is referenced and marked as reused. For all other suppliers, use platform_device_set_fwnode() so ACPI and other firmware nodes are propagated with a reference that platform_device_release() can balance. Link: https://patch.msgid.link/20260915-acpi_scmi_pcc-v5-1-298579e9f359@kernel.org Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
7 daysfirmware: imx: dsp: fix mailbox channel leak on kasprintf failureLinkai Gong
If kasprintf() fails while setting up mailbox channels, already requested channels from earlier iterations were never freed. Route the failure through the existing cleanup path. Fixes: ffbf23d50353 ("firmware: imx: Add DSP IPC protocol interface") Signed-off-by: Linkai Gong <gonglinkai@kylinos.cn> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 daysfirmware: imx: device context dedicated to privPankaj Gupta
Add priv_dev_ctx to prepare enabling misc-device context based send-receive path, to communicate with FW. No functionality change. Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 daysfirmware: imx: add driver for NXP EdgeLock EnclavePankaj Gupta
Add MU-based communication interface for secure enclave. NXP hardware IP(s) for secure-enclaves like Edgelock Enclave(ELE), are embedded in the SoC to support the features like HSM, SHE & V2X, using message based communication interface. The secure enclave FW communicates with Linux over single or multiple dedicated messaging unit(MU) based interface(s). Exists on i.MX SoC(s) like i.MX8ULP, i.MX93, i.MX95 etc. For i.MX9x SoC(s) there is at least one dedicated ELE MU(s) for each world - Linux(one or more) and OPTEE-OS (one or more). Other dependent kernel drivers will be: - NVMEM: that supports non-volatile devices like EFUSES, managed by NXP's secure-enclave. Signed-off-by: Pankaj Gupta <pankaj.gupta@nxp.com> Reviewed-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com>
8 daysMerge tag 'scmi-ffa-fixes-7.3' of ↵Arnd Bergmann
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes Arm firmware fixes for v7.3 SCPI fixes address resource leaks and invalid firmware responses, while FF-A gains shutdown cleanup needed for normal kexec. - Release the device node reference acquired during SCPI domain lookup. - Validate SCPI DVFS OPP counts and indices returned by firmware to prevent out-of-bounds accesses and invalid clock rates. - Register the SCPI cpufreq device only once across DVFS providers, preserving the registered device pointer for cleanup and allowing retries after registration failure. - Run FF-A teardown during orderly shutdown so notifications, partition devices and RX/TX mappings are released before a replacement kernel boots through normal kexec. Also includes replacing a literal platform device ID with PLATFORM_DEVID_NONE and correcting an SCMI comment typo. * tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment firmware: arm_ffa: Tear down driver during shutdown clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id Signed-off-by: Arnd Bergmann <arnd@arndb.de>
8 daysMerge branches 'acpi-apei' and 'acpi-osl' into linux-nextRafael J. Wysocki
* acpi-apei: Documentation: ACPI: EINJ: Update stale driver source reference cxl/ras: Make cxl_cper_handle_prot_err() static ACPI: APEI: GHES: Bound AER info copy and sanitize software metadata ACPI: APEI: GHES: Validate memory error section length before payload access efi/cper: Read only validated fields in cper_mem_err_pack() ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length ACPI: extlog: Fix CONFIG_ACPI_APEI_PCIEAER guard typo ACPI: extlog: Validate PCIe error section length before payload access ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion ACPI: extlog: Validate elog record length before walking sections efi/cper: Reject an error status block length that wraps a u32 efi/cper: Reject CPER records with an out-of-range error_data_length * acpi-osl: ACPI: OSL: Use vsnprintf() in acpi_os_vprintf()
11 daysfirmware: arm_scmi: Merge scmi_reset_proto_ops.name_get() and .latency_get()Geert Uytterhoeven
The SCMI reset domain protocol operations structure does not provide a .info_get() method, unlike most other protocols. Instead, it provides two separate methods to get a domain's name and reset latency. Merge the .name_get() and .latency_get() methods into a single .info_get() method, to increase uniformity. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://patch.msgid.link/77c9651a11715013c0eaa8a56dbbc7dc3d9ddeec.1788429130.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
11 daysfirmware: qcom: scm: Allow QSEECOM on Yoga Slim 7x Gen11Konrad Dybcio
Allow the use of QSEECOM on the Glymur-based Lenovo Yoga Slim 7x Gen11, as there seem to be no issues with the firmware that would mandate disabling it. Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com> Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Tested-by: Oleg Keri <okerixx@gmail.com> Link: https://lore.kernel.org/r/20260731-topic-yoga_submission-v2-3-f1887031da4f@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
12 daysfirmware: QCOM interfaces should depend on ARCH_QCOMGeert Uytterhoeven
The various Qualcomm firmware interfaces are only present on Qualcomm systems. Hence add dependencies on ARCH_QCOM, to prevent asking the user about them when configuring a kernel without Qualcomm SoC support. Make QCOM_PAS invisible instead, as it is already selected by its users when needed. Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be> Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com> Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Link: https://lore.kernel.org/r/888efe8e63b6a18fae4acd5a90a1e0e69dcdf2ca.1786012495.git.geert+renesas@glider.be Signed-off-by: Bjorn Andersson <andersson@kernel.org>
12 daysfirmware/sysfb: Remove rotation quirk for Lenovo D330Thomas Zimmermann
The Lenovo D330 is a notebook with detachable display. The display is installed in landscape orientation, but the display mode is in portrait orientation. By default, the display output is rotated to the left by 90°. The sysfb quirk breaks the display by swapping display width and height; and thus mixing up the display geometry. Fix this by keeping the display as-is. The sysfb DRM drivers, usually efidrm, will pick the correct panel orientation for the display. The exact behavior might depend on the version of the BIOS release, but the exact version numbers of broken and good releases are unknown. Users are advised to update to the latest firmware. Tested on a Lenovo D330-10IGM IdeaPad with firmware 8NCN43WW. v3: - mention possible dependency on BIOS release in commit description Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de> Acked-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Javier Martinez Canillas <javierm@redhat.com> Link: https://patch.msgid.link/20260904090850.43060-2-tzimmermann@suse.de
12 daysfirmware: arm_scmi: Fix error path leak in scmi_raw_message_send()Roland Dreier
When the is_transport_polling_capable() check fails in scmi_raw_message_send(), it returns -EINVAL without doing scmi_xfer_raw_put(), which will leak a struct scmi_xfer. Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://sashiko.dev/#/patchset/20260909-scmi-async-done-race-v2-0-cc5dec25c6be%40rivian.com Fixes: 07cb8c324b63 ("firmware: arm_scmi: Add polling support to raw mode") Signed-off-by: Roland Dreier <rolanddreier@rivian.com> Link: https://patch.msgid.link/20260909-scmi-raw-v1-1-de3fa75d2c6f@rivian.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
12 daysfirmware: arm_scmi: Don't reuse raw xfers with async_done still armedRoland Dreier
In SCMI raw mode, scmi_xfer_raw_worker() releases the xfer before releasing the waiter that disarms xfer->async_done, and scmi_xfer_get() does not clear async_done when it hands out a recycled xfer. A concurrent transaction can therefore pick up the xfer while it still points at the old waiter's completion, so: - a delayed response arriving for the new transaction can be signalled on the old waiter's completion, which may already be re-armed for yet another unrelated transaction, making that transaction's wait return early; and - the old waiter's disarm, which still runs after the xfer has been released, clobbers the arming just installed by the new transaction, so the new waiter times out even if its delayed response arrives. Release the waiter first, while the worker still holds a reference on the xfer, so that an xfer can never reach the free list still armed. Track whether a delayed response is expected in the waiter itself instead of peeking at xfer->async_done outside xfer->lock, and wait on the waiter's own embedded completion. (The new async flag is not strictly needed but it makes the logic easier to reason about) Finally, harden scmi_xfer_get() to clear async_done when handing out an xfer, so that no future release-ordering change can leak a stale arming into a new transaction. Fixes: 3c3d818a9317 ("firmware: arm_scmi: Add core raw transmission support") Signed-off-by: Roland Dreier <rolanddreier@rivian.com> Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Tested-by: Cristian Marussi <cristian.marussi@arm.com> Link: https://patch.msgid.link/20260909-scmi-async-done-race-v2-2-cc5dec25c6be@rivian.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
12 daysfirmware: arm_scmi: Protect xfer->async_done with xfer->lockRoland Dreier
Asynchronous SCMI commands are completed by a delayed response. The RX path signals the response with complete(xfer->async_done). Unlike xfer->done, xfer->async_done is a pointer to a completion owned by whoever is waiting for the delayed response, and it stays valid only for as long as that waiter is still waiting. In do_xfer_with_response() it is a DECLARE_COMPLETION_ONSTACK() in the caller's stack frame. Nothing serialises the RX path against a waiter that gives up on a timeout. scmi_msg_response_validate() does read xfer->async_done under xfer->lock, and documents that as a requirement, but the lock is dropped again before scmi_handle_response() dereferences the pointer, and neither the arming nor the disarming side takes it at all. So a delayed response arriving just as the wait times out can be signalled on a completion that is already gone: waiter RX path (IRQ context) ------ --------------------- do_xfer_with_response(): xfer->async_done = &async_response do_xfer(xfer) wait_for_completion_timeout(xfer->async_done, tmo) /* returns 0, gives up */ /* response receive interrupt */ scmi_handle_response(): scmi_xfer_command_acquire() lock xfer->lock validate: async_done != NULL unlock xfer->lock xfer->async_done = NULL return -ETIMEDOUT /* async_response goes out of scope */ complete(xfer->async_done) That last complete() has two possible bad outcomes: it either dereferences the NULL just stored by the waiter or - if that store is not yet visible on the RX CPU - it takes a lock and writes to a stack frame that the waiter may already have returned from. Fix this by making xfer->lock cover xfer->async_done end-to-end. Add helpers to arm and disarm it under the lock, use them on both the regular and the raw paths, and have the RX path read and signal the completion under that same lock. A waiter that is timing out then either completes its disarm before the RX path looks, in which case the delayed response is dropped, or blocks in the disarm until the RX path is done with the completion, in which case the completion is still alive. Log the dropped case, so every path where a delayed response that was matched to a pending xfer and then discarded produces an error. (This is the same treatment scmi_msg_response_validate() already gives a delayed response that arrives after the waiter has disarmed the xfer) Fixes: 58ecdf03dbb9 ("firmware: arm_scmi: Add support for asynchronous commands and delayed response") Signed-off-by: Roland Dreier <rolanddreier@rivian.com> Reviewed-by: Cristian Marussi <cristian.marussi@arm.com> Tested-by: Cristian Marussi <cristian.marussi@arm.com> Link: https://patch.msgid.link/20260909-scmi-async-done-race-v2-1-cc5dec25c6be@rivian.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
12 daysefi/libstub: Fix grammar in efi_kaslr_relocate_kernel() commentThorsten Blum
Fix the grammar in the kernel-doc comment and indent the @image_addr description correctly. Signed-off-by: Thorsten Blum <blum@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
12 daysefi/libstub: Simplify check_image_region()Thorsten Blum
Drop the local ret variable and the break statement by returning the result directly. Also use unsigned long for map_offset, since map_size and desc_size are both unsigned long. Signed-off-by: Thorsten Blum <blum@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
12 daysefistub/x86: Use struct boot_e820_entry for size calculationsThorsten Blum
alloc_e820ext() and setup_e820() use sizeof(struct e820_entry) when calculating the sizes of boot_e820_entry structures. Even though struct e820_entry and struct boot_e820_entry have the same size, use sizeof(struct boot_e820_entry) for consistency instead. Signed-off-by: Thorsten Blum <blum@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
12 daysefi/capsule-loader: Replace kmap() with kmap_local_page()Danish Khateeb
kmap() is deprecated in favour of kmap_local_page(), as described in Documentation/mm/highmem.rst. The conversion is safe here. efi_capsule_write() maps the page and releases it within the same call, on both the success and the fail_unmap error path, so the mapping never escapes the thread that created it and the stack-based unmap ordering is preserved. No atomic context is involved: the page is allocated with alloc_page(GFP_KERNEL) just above, and the copy_from_user() performed while the page is mapped is fine because faults are permitted in a local kmap region. efi_capsule_setup_info() also runs while the mapping is live, but only reads through the pointer. kunmap_local() is handed a pointer that has been advanced into the page, which is fine as it masks the address back down to the page boundary. Build-tested only, on i386 with CONFIG_HIGHMEM=y -- where kmap_local_page() actually establishes a mapping rather than returning the direct-map address -- and on x86_64. No new gcc or sparse warnings. Assisted-by: LLM sparse Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
12 daysfirmware: efi: fix typo "existance" in commentHemanth Selam
Correct "existance" to "existence", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
12 daysefi/libstub: Fix efi_set_event_at() parameter documentationKarl Mehltretter
efi_set_event_at() documents ids although its array index argument is named idx. This produces missing and excess parameter warnings. Match the argument name and fix the adjacent spelling of array. Fixes: 8c0a839c2bcc ("efi/libstub: Descriptions for stub helper functions") Assisted-by: LLM Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
13 daysMerge branches 'for-next/ffa/fixes' and 'for-next/scmi/fixes' of ↵Sudeep Holla
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux * 'for-next/ffa/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Tear down driver during shutdown * 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id
13 daysfirmware: microchip: use kzalloc_objs() instead of kzalloc() with multiplyHrushiraj Gandhi
response_msg is sized as AUTO_UPDATE_FEATURE_RESP_SIZE * sizeof(*response_msg) by hand in both call sites. Use kzalloc_objs() instead, matching the kzalloc_obj() already used elsewhere in this same file for the other allocations in these functions, and getting the same overflow-checked size computation kzalloc_obj() already benefits from. No functional change. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
14 daysASoC: SDCA: SimpleJack support and small cleanupMark Brown
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> says: These two patches were originally part of https://lore.kernel.org/all/20260907083727.733705-1-srinivas.kandagatla@oss.qualcomm.com/ As Suggested by Charles and Pierre am sending them as independent of the rest of that series and can be picked up on their own. Patch 1 adds SDCA_FUNCTION_TYPE_SIMPLE_JACK to the class function driver's auxiliary id table so a SimpleJack auxdev is bound and enumerated as an ASoC component, and wires set_jack for this function type so the machine driver can register an ASoC jack against it. Patch 2 is a small cleanup: find_sdca_control_reset() only ever returns 0, so convert it to void and drop the dead error check in the caller. No functional change. Both patches already carry Reviewed-by tags from Charles and Pierre-Louis from the original posting. Link: https://patch.msgid.link/20260908063644.463819-1-srinivas.kandagatla@oss.qualcomm.com
2026-09-08firmware: coreboot: Use named initializers for acpi_device_idPawel Zalewski
Use a named initializer for the acpi_device_id fields which makes the code more readable and consistent with how lists are initialized in the rest of the kernel code base. Also drop explicitly setting fields to 0 where it is redundant. Signed-off-by: Pawel Zalewski <pzalewski@thegoodpenguin.co.uk> Link: https://lore.kernel.org/r/20260907-acpi-firmware-v2-1-e0b6d40823d1@thegoodpenguin.co.uk Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
2026-09-07firmware: cirrus: fix typo "upto" in commentHemanth Selam
Correct "upto" to "up to", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260907045331.16932-3-hemanth.selam@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
2026-09-04treewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>