kernel/git/stable/linux.git/drivers/fwctl, branch master

rust: introduce abstractions for fwctl

2026-08-14T22:21:17+00:00

Introduce safe Rust wrappers around struct fwctl_device and struct fwctl_uctx. This lets Rust drivers register fwctl devices and implement firmware RPC callbacks through a typed trait interface. The abstraction keeps lifetime and reference-count handling inside the wrapper, exposes pinned per-FD user contexts to drivers, and validates the layout assumptions required by the C fwctl allocation model. Allocation sizes are padded so the kmalloc-backed C allocations also satisfy Rust alignment requirements. Registration owns driver private data with a lifetime tied to the bound parent device and verifies the parent identity before registration. Callbacks access that data through a higher-ranked closure, preventing its erased lifetime from escaping, while Device remains only the refcounted fwctl object. This avoids requiring Rust drop glue from the fwctl_device release path after unregister or module teardown. RPC callbacks receive typed scope information, a mutable request/response buffer, and the userspace output-buffer size. Response pointer conversion, length validation, and raw output-length handling remain inside the abstraction. Add the Rust sources to the FWCTL MAINTAINERS entry and add myself as the maintainer for the Rust abstractions. Link: https://patch.msgid.link/r/20260813152312.1311142-2-zhiw@nvidia.com Co-developed-by: Danilo Krummrich Signed-off-by: Danilo Krummrich Signed-off-by: Zhi Wang Reviewed-by: Alexandre Courbot Signed-off-by: Jason Gunthorpe

fwctl/bnxt: Add DMA buffer support for HWRM commands

2026-08-07T17:18:13+00:00

Several HWRM commands carry __le64 DMA address fields in their input structures; firmware reads from or writes to the memory those addresses point to. Have a static per-command descriptor table in the driver that records the details of the DMA fields in each supported HWRM input struct. When a DMA-bearing HWRM command arrives, the driver reads the userspace pointer out of each declared address field and clears the field, allocates a DMA-coherent kernel buffer sized from the command's own length information, copies data to/from the userspace pointer, and patches the field with the real DMA bus address before the command is sent to firmware. Responses are copied back to the original userspace pointer afterward. Scope-gated allow-list and timeout value list are updated with the new the commands. Signed-off-by: Pavan Chebbi Link: https://patch.msgid.link/20260807125846.45570-3-pavan.chebbi@broadcom.com Signed-off-by: Jason Gunthorpe

fwctl: pds: Validate RPC input size before parsing

2026-05-19T13:44:32+00:00

The fwctl core allocates the device-specific RPC input buffer with fwctl_rpc.in_len and passes that buffer to the driver callback. pdsfc_fw_rpc() casts the buffer to struct fwctl_rpc_pds and then calls pdsfc_validate_rpc(), which reads fields from that structure before checking that the input buffer is large enough to contain it. A short in_len can make pds_fwctl read beyond the allocation. Reject pds RPC buffers that are smaller than struct fwctl_rpc_pds before parsing any pds-specific fields. Fixes: 92c66ee829b9 ("pds_fwctl: add rpc and query support") Link: https://patch.msgid.link/r/20260517062232.1858747-1-gganji11@naver.com Cc: stable@vger.kernel.org # v6.15+ Signed-off-by: Heechan Kang Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe

fwctl: Fix class init ordering to avoid NULL pointer dereference on device removal

2026-04-10T14:21:06+00:00

CXL is linked before fwctl in drivers/Makefile. Both use `module_init, so `cxl_pci_driver_init()` runs first. When `cxl_pci_probe()` calls `fwctl_register()` and then `device_add()`, fwctl_class is not yet registered because fwctl_init() hasn't run, causing `class_to_subsys()` to return NULL and skip knode_class initialization. On device removal, `class_to_subsys()` returns non-NULL, and `device_del()` calls `klist_del()` on the uninitialized knode, triggering a NULL pointer dereference. Fixes: 858ce2f56b52 ("cxl: Add FWCTL support to CXL") Link: https://patch.msgid.link/r/20260409051902.40218-1-icheng@nvidia.com Signed-off-by: Richard Cheng Reviewed-by: Kai-Heng Feng Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe

fwctl/bnxt_fwctl: Add bnxt fwctl device

2026-03-31T16:33:54+00:00

Create bnxt_fwctl device. This will bind to bnxt's aux device. On the upper edge, it will register with the fwctl subsystem. It will make use of bnxt's ULP functions to send FW commands. Link: https://patch.msgid.link/r/20260314151605.932749-5-pavan.chebbi@broadcom.com Reviewed-by: Andy Gospodarek Reviewed-by: Dave Jiang Signed-off-by: Pavan Chebbi Signed-off-by: Jason Gunthorpe

Convert 'alloc_obj' family to use the new default GFP_KERNEL argument

2026-02-22T01:09:51+00:00

This was done entirely with mindless brute force, using git grep -l '\

treewide: Replace kmalloc with kmalloc_obj for non-scalar types

2026-02-21T09:02:28+00:00

This is the result of running the Coccinelle script from scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to avoid scalar types (which need careful case-by-case checking), and instead replace kmalloc-family calls that allocate struct or union object instances: Single allocations: kmalloc(sizeof(TYPE), ...) are replaced with: kmalloc_obj(TYPE, ...) Array allocations: kmalloc_array(COUNT, sizeof(TYPE), ...) are replaced with: kmalloc_objs(TYPE, COUNT, ...) Flex array allocations: kmalloc(struct_size(PTR, FAM, COUNT), ...) are replaced with: kmalloc_flex(*PTR, FAM, COUNT, ...) (where TYPE may also be *VAR) The resulting allocations no longer return "void *", instead returning "TYPE *". Signed-off-by: Kees Cook

pds_fwctl: Replace kzalloc + copy_from_user with memdup_user in pdsfc_fw_rpc

2025-09-22T13:33:10+00:00

Replace kzalloc() followed by copy_from_user() with memdup_user() to improve and simplify pdsfc_fw_rpc(). Return early if an error occurs and remove the obsolete 'err_out' label. No functional changes intended. Link: https://patch.msgid.link/r/20250917150941.168887-1-thorsten.blum@linux.dev Signed-off-by: Thorsten Blum Reviewed-by: Dave Jiang Reviewed-by: Jason Gunthorpe Tested-by: Brett Creeley Signed-off-by: Jason Gunthorpe

fwctl/mlx5: Add Adjacent function query commands and their scope

2025-09-17T13:02:09+00:00

MLX5_CMD_OP_QUERY_ADJACENT_FUNCTIONS_ID: - Query Adjacent functions (PFs/VFs) of the function calling FW. MLX5_CMD_OP_DELEGATE_VHCA_MANAGEMENT: - Delegates own VFs to be managed/seen by other adjacent PFs MLX5_CMD_OP_QUERY_DELEGATED_VHCA: - Query current function delegation state. Link: https://patch.msgid.link/r/20250908165256.1255985-3-saeed@kernel.org Signed-off-by: Saeed Mahameed Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe

fwctl/mlx5: Allow MODIFY_CONG_STATUS command

2025-09-17T13:02:09+00:00

MODIFY_CONG_STATUS command is used to enable or disable congestion control according to a given priority and protocol. Add MODIFY_CONG_STATUS to the allowed commands under configuration scope. Link: https://patch.msgid.link/r/20250908165256.1255985-2-saeed@kernel.org Signed-off-by: Avihai Horon Reviewed-by: Dave Jiang Signed-off-by: Jason Gunthorpe