kernel/git/next/linux-next.git/drivers/firmware/efi, branch master

Merge branch 'next' of https://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git

2026-09-14T15:08:08+00:00

Merge branch 'drm-next' of https://gitlab.freedesktop.org/drm/kernel.git

2026-09-14T14:21:21+00:00

# Conflicts: # drivers/gpu/drm/xe/xe_pagefault.c

firmware/sysfb: Remove rotation quirk for Lenovo D330

2026-09-10T13:44:51+00:00

The Lenovo D330 is a notebook with detachable display. The display is installed in landscape orientation, but the display mode is in portrait orientation. By default, the display output is rotated to the left by 90°. The sysfb quirk breaks the display by swapping display width and height; and thus mixing up the display geometry. Fix this by keeping the display as-is. The sysfb DRM drivers, usually efidrm, will pick the correct panel orientation for the display. The exact behavior might depend on the version of the BIOS release, but the exact version numbers of broken and good releases are unknown. Users are advised to update to the latest firmware. Tested on a Lenovo D330-10IGM IdeaPad with firmware 8NCN43WW. v3: - mention possible dependency on BIOS release in commit description Signed-off-by: Thomas Zimmermann Acked-by: Ard Biesheuvel Reviewed-by: Javier Martinez Canillas Link: https://patch.msgid.link/20260904090850.43060-2-tzimmermann@suse.de

efi/libstub: Fix grammar in efi_kaslr_relocate_kernel() comment

2026-09-10T07:46:08+00:00

Fix the grammar in the kernel-doc comment and indent the @image_addr description correctly. Signed-off-by: Thorsten Blum Signed-off-by: Ard Biesheuvel

efi/libstub: Simplify check_image_region()

2026-09-10T07:46:08+00:00

Drop the local ret variable and the break statement by returning the result directly. Also use unsigned long for map_offset, since map_size and desc_size are both unsigned long. Signed-off-by: Thorsten Blum Signed-off-by: Ard Biesheuvel

efistub/x86: Use struct boot_e820_entry for size calculations

2026-09-10T07:38:45+00:00

alloc_e820ext() and setup_e820() use sizeof(struct e820_entry) when calculating the sizes of boot_e820_entry structures. Even though struct e820_entry and struct boot_e820_entry have the same size, use sizeof(struct boot_e820_entry) for consistency instead. Signed-off-by: Thorsten Blum Signed-off-by: Ard Biesheuvel

efi/capsule-loader: Replace kmap() with kmap_local_page()

2026-09-10T07:37:17+00:00

kmap() is deprecated in favour of kmap_local_page(), as described in Documentation/mm/highmem.rst. The conversion is safe here. efi_capsule_write() maps the page and releases it within the same call, on both the success and the fail_unmap error path, so the mapping never escapes the thread that created it and the stack-based unmap ordering is preserved. No atomic context is involved: the page is allocated with alloc_page(GFP_KERNEL) just above, and the copy_from_user() performed while the page is mapped is fine because faults are permitted in a local kmap region. efi_capsule_setup_info() also runs while the mapping is live, but only reads through the pointer. kunmap_local() is handed a pointer that has been advanced into the page, which is fine as it masks the address back down to the page boundary. Build-tested only, on i386 with CONFIG_HIGHMEM=y -- where kmap_local_page() actually establishes a mapping rather than returning the direct-map address -- and on x86_64. No new gcc or sparse warnings. Assisted-by: LLM sparse Signed-off-by: Danish Khateeb Signed-off-by: Ard Biesheuvel

firmware: efi: fix typo "existance" in comment

2026-09-10T07:32:53+00:00

Correct "existance" to "existence", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Ard Biesheuvel

efi/libstub: Fix efi_set_event_at() parameter documentation

2026-09-10T07:13:56+00:00

efi_set_event_at() documents ids although its array index argument is named idx. This produces missing and excess parameter warnings. Match the argument name and fix the adjacent spelling of array. Fixes: 8c0a839c2bcc ("efi/libstub: Descriptions for stub helper functions") Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Ard Biesheuvel

efi/cper: Read only validated fields in cper_mem_err_pack()

2026-09-04T18:22:05+00:00

cper_mem_err_pack() copies extended, rank, mem_array_handle and mem_dev_handle unconditionally. Those live at offsets 73 to 79, past the end of struct cper_sec_mem_err_old, the 73-byte UEFI 2.1/2.2 layout that older firmware still emits and that cper_estatus_print_section() admits. On such a record the copy reads up to seven bytes past the payload, and off the end of the error status block when that section is the last one. Copy each of the four only when its validation bit is set, and zero it otherwise. Nothing is lost: a 2.1/2.2 record leaves those bits clear, and every consumer of struct cper_mem_err_compact already gates the fields on the same bits. Zeroing also stops callers reading them back out of the uninitialised on-stack struct they pass in. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=7 Fixes: 2dfb7d51a61d ("trace, RAS: Add eMCA trace event interface") Reviewed-by: Hanjun Guo Reviewed-by: Shuai Xue Signed-off-by: Dave Jiang Link: https://patch.msgid.link/20260904172337.1409775-11-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki