summaryrefslogtreecommitdiff
path: root/drivers/firmware
AgeCommit message (Collapse)Author
21 hoursMerge branch 'next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/efi/efi.git
22 hoursMerge branch 'for-firmware-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux.git
22 hoursMerge branch 'for-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git
23 hoursMerge branch 'linux-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm.git
23 hoursMerge branch 'riscv-soc-for-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git
23 hoursMerge branch 'ti-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux.git
23 hoursMerge branch 'for-linux-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git
23 hoursMerge branch 'for-next' of ↵Mark Brown
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git
39 hoursMerge tag 'scmi-ffa-fixes-7.3' of ↵Sudeep Holla
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux Arm firmware fixes for v7.3 SCPI fixes address resource leaks and invalid firmware responses, while FF-A gains shutdown cleanup needed for normal kexec. - Release the device node reference acquired during SCPI domain lookup. - Validate SCPI DVFS OPP counts and indices returned by firmware to prevent out-of-bounds accesses and invalid clock rates. - Register the SCPI cpufreq device only once across DVFS providers, preserving the registered device pointer for cleanup and allowing retries after registration failure. - Run FF-A teardown during orderly shutdown so notifications, partition devices and RX/TX mappings are released before a replacement kernel boots through normal kexec. Also includes replacing a literal platform device ID with PLATFORM_DEVID_NONE and correcting an SCMI comment typo. * tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment firmware: arm_ffa: Tear down driver during shutdown clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id
39 hoursMerge branches 'for-next/ffa/fixes' and 'for-next/scmi/fixes' of ↵Sudeep Holla
git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux * 'for-next/ffa/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Tear down driver during shutdown * 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id
39 hoursfirmware: microchip: use kzalloc_objs() instead of kzalloc() with multiplyHrushiraj Gandhi
response_msg is sized as AUTO_UPDATE_FEATURE_RESP_SIZE * sizeof(*response_msg) by hand in both call sites. Use kzalloc_objs() instead, matching the kzalloc_obj() already used elsewhere in this same file for the other allocations in these functions, and getting the same overflow-checked size computation kzalloc_obj() already benefits from. No functional change. Signed-off-by: Hrushiraj Gandhi <hrushirajg23@gmail.com> Signed-off-by: Conor Dooley <conor.dooley@microchip.com>
46 hoursASoC: SDCA: SimpleJack support and small cleanupMark Brown
Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com> says: These two patches were originally part of https://lore.kernel.org/all/20260907083727.733705-1-srinivas.kandagatla@oss.qualcomm.com/ As Suggested by Charles and Pierre am sending them as independent of the rest of that series and can be picked up on their own. Patch 1 adds SDCA_FUNCTION_TYPE_SIMPLE_JACK to the class function driver's auxiliary id table so a SimpleJack auxdev is bound and enumerated as an ASoC component, and wires set_jack for this function type so the machine driver can register an ASoC jack against it. Patch 2 is a small cleanup: find_sdca_control_reset() only ever returns 0, so convert it to void and drop the dead error check in the caller. No functional change. Both patches already carry Reviewed-by tags from Charles and Pierre-Louis from the original posting. Link: https://patch.msgid.link/20260908063644.463819-1-srinivas.kandagatla@oss.qualcomm.com
2 daysfirmware: coreboot: Use named initializers for acpi_device_idPawel Zalewski
Use a named initializer for the acpi_device_id fields which makes the code more readable and consistent with how lists are initialized in the rest of the kernel code base. Also drop explicitly setting fields to 0 where it is redundant. Signed-off-by: Pawel Zalewski <pzalewski@thegoodpenguin.co.uk> Link: https://lore.kernel.org/r/20260907-acpi-firmware-v2-1-e0b6d40823d1@thegoodpenguin.co.uk Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
3 daysfirmware: cirrus: fix typo "upto" in commentHemanth Selam
Correct "upto" to "up to", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com> Link: https://patch.msgid.link/20260907045331.16932-3-hemanth.selam@gmail.com Signed-off-by: Mark Brown <broonie@kernel.org>
3 daysMerge branch 'acpi-apei' into linux-nextRafael J. Wysocki
* acpi-apei: cxl/ras: Make cxl_cper_handle_prot_err() static ACPI: APEI: GHES: Bound AER info copy and sanitize software metadata ACPI: APEI: GHES: Validate memory error section length before payload access efi/cper: Read only validated fields in cper_mem_err_pack() ACPI: APEI: GHES: Validate CXL protocol error section length before RAS cap copy ACPI: APEI: GHES: Bound CXL event record copy to the firmware section length ACPI: extlog: Fix CONFIG_ACPI_APEI_PCIEAER guard typo ACPI: extlog: Validate PCIe error section length before payload access ACPI: extlog: Avoid populating software AER metadata from raw hardware buffer ACPI: extlog: Defer CXL protocol error handling to avoid lock inversion ACPI: extlog: Validate elog record length before walking sections efi/cper: Reject an error status block length that wraps a u32 efi/cper: Reject CPER records with an out-of-range error_data_length
5 daystreewide: refresh kmalloc_obj() conversionsKees Cook
This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook <kees+treewide@kernel.org>
6 daysefi/cper: Read only validated fields in cper_mem_err_pack()Dave Jiang
cper_mem_err_pack() copies extended, rank, mem_array_handle and mem_dev_handle unconditionally. Those live at offsets 73 to 79, past the end of struct cper_sec_mem_err_old, the 73-byte UEFI 2.1/2.2 layout that older firmware still emits and that cper_estatus_print_section() admits. On such a record the copy reads up to seven bytes past the payload, and off the end of the error status block when that section is the last one. Copy each of the four only when its validation bit is set, and zero it otherwise. Nothing is lost: a 2.1/2.2 record leaves those bits clear, and every consumer of struct cper_mem_err_compact already gates the fields on the same bits. Zeroing also stops callers reading them back out of the uninitialised on-stack struct they pass in. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=7 Fixes: 2dfb7d51a61d ("trace, RAS: Add eMCA trace event interface") Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260904172337.1409775-11-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
6 daysefi/cper: Reject an error status block length that wraps a u32Dave Jiang
cper_estatus_len() sums the firmware-controlled data_length (or raw_data_offset plus raw_data_length) into a u32. A data_length of 0xffffffec wraps that sum to 0, and a length that reads back short defeats every bound built on it: bert_print_all() passes its "remain < estatus_len" check, then advances "estatus += estatus_len" by zero and loops forever. GHES survives only because __ghes_check_estatus() rejects a length below sizeof(*estatus) first. Reject a length that cannot be expressed in a u32 in cper_estatus_check_header(), which both of today's callers reach: GHES via __ghes_check_estatus() and BERT via cper_estatus_check(). extlog reaches neither yet; a later patch routes it through cper_estatus_check(), whose ELOG_ENTRY_LEN bound needs this to hold. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=1 Fixes: 06d65deade9a ("ACPI, APEI, UEFI Common Platform Error Record (CPER) header") Reviewed-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com> Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260904172337.1409775-3-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
6 daysefi/cper: Reject CPER records with an out-of-range error_data_lengthDave Jiang
cper_estatus_check() sizes each section with acpi_hest_get_record_size(), which adds the firmware-controlled u32 error_data_length to the header size as a signed int (see <acpi/ghes.h>). A value in the top sizeof(*gdata) bytes of the u32 range wraps the sum small rather than large, so it slips past the "record_size > data_len" check: against the 72-byte v300 header, 0xffffffb9 sizes the record at 1 and acpi_hest_get_next() walks it a byte at a time, off the end. 0xffffffb8 sizes it at 0 and loops forever. Use check_add_overflow() to reject a sum that will not fit the int those helpers return, since the walk advances by that value. That subsumes the "acpi_hest_get_size(gdata) > data_len" test above it, because record_size is never smaller than the header. The later "len < sizeof(*foo)" guards rely on this per-section upper bound; they are lower bounds only. Reported-by: sashiko-bot@kernel.org Closes: https://sashiko.dev/#/patchset/20260714231835.303081-1-dave.jiang@intel.com?part=1 Fixes: 45b14a4ffcc1 ("efi: cper: Fix possible out-of-bounds access") Reviewed-by: Hanjun Guo <guohanjun@huawei.com> Reviewed-by: Shuai Xue <xueshuai@linux.alibaba.com> Signed-off-by: Dave Jiang <dave.jiang@intel.com> Link: https://patch.msgid.link/20260904172337.1409775-2-dave.jiang@intel.com Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
6 daysefi/libstub: factor shared static GUID variablesVincent Mailhol
Some GUIDs are used several times in the same translation unit. Factor the duplicated EFI_FILE_SYSTEM_GUID, EFI_RNG_PROTOCOL_GUID and EFI_GRAPHICS_OUTPUT_PROTOCOL_GUID objects at file scope within their translation units. Leave the single-use GUID objects at function scope. For an x86_64 build with gcc 15.3.0, bloat-o-meter reports: add/remove: 0/0 grow/shrink: 0/3 up/down: 0/-48 (-48) Function old new delta rng_proto 32 16 -16 graphics_output_guid 32 16 -16 fs_proto 32 16 -16 Total: Before=28471, After=28423, chg -0.17% Signed-off-by: Vincent Mailhol <mailhol@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
6 daysefi/libstub: make local GUID variables staticVincent Mailhol
Local efi_guid_t variables with automatic storage produce assembly similar to passing the address of the GUID macro directly. For the same reason, make these GUID variables static. Put the static declarations first in their local declaration block to visually separate them from the automatic variables. For an x86_64 build with gcc 15.3.0, bloat-o-meter reports: add/remove: 15/0 grow/shrink: 0/10 up/down: 336/-742 (-406) Function old new delta tbl_guid - 32 +32 rng_proto - 32 +32 pci_proto - 32 +32 guid - 32 +32 fs_proto - 32 +32 cc_guid - 32 +32 tpm2_guid - 16 +16 text_to_dp_guid - 16 +16 tcg2_guid - 16 +16 rng_table_guid - 16 +16 rng_algo_raw - 16 +16 proto - 16 +16 linux_eventlog_guid - 16 +16 lf2_proto_guid - 16 +16 info_guid - 16 +16 efi_get_memory_map 707 696 -11 efi_pci_disable_bridge_busmaster 1199 1184 -15 efi_get_random_bytes 216 188 -28 efi_remap_image 357 328 -29 efi_load_initrd 1113 1065 -48 efi_random_get_seed 1368 1297 -71 efi_measure_tagged_event 935 854 -81 efi_retrieve_eventlog 1686 1570 -116 handle_cmdline_files 2501 2341 -160 efi_stub_entry 4136 3953 -183 Total: Before=28877, After=28471, chg -1.41% Signed-off-by: Vincent Mailhol <mailhol@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
6 daysefi/libstub: move direct GUID references to static storageVincent Mailhol
Some EFI stub call sites pass the address of a GUID macro directly to EFI boot services. With gcc, this makes the compiler materialize the GUID data at the call site, which is wasteful in the size-sensitive EFI stub. For example, consider this program: #include <linux/efi.h> #define GUID \ EFI_GUID(0xaaaaaaaa, 0xbbbb, 0xcccc, \ 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd, 0xdd) void foo(const efi_guid_t *guid); void guid_direct(void) { foo(&GUID); } void guid_static(void) { static efi_guid_t guid = GUID; foo(&guid); } For guid_direct(), gcc materializes the GUID on the stack: 0: f3 0f 1e fa endbr64 4: 48 b8 aa aa aa aa bb movabs $0xccccbbbbaaaaaaaa,%rax b: bb cc cc e: 48 83 ec 18 sub $0x18,%rsp 12: 48 89 04 24 mov %rax,(%rsp) 16: 48 89 e7 mov %rsp,%rdi 19: 48 b8 dd dd dd dd dd movabs $0xdddddddddddddddd,%rax 20: dd dd dd 23: 48 89 44 24 08 mov %rax,0x8(%rsp) 28: e8 00 00 00 00 call 2d <guid_direct+0x2d> 2d: 48 83 c4 18 add $0x18,%rsp 31: c3 ret For guid_static(), gcc stores the GUID in .data and emits a RIP-relative address load: 32: f3 0f 1e fa endbr64 36: 48 8d 3d 00 00 00 00 lea 0x0(%rip),%rdi 3d: e9 00 00 00 00 jmp 42 <guid_static+0x10> Overall, guid_direct() consumes 50 bytes in the .text segment whereas guid_static() needs only 32 bytes in total: 16 bytes in .data and 16 bytes in .text. Move these direct GUID references to function-local static objects and pass their address instead. EFI boot service prototypes take non-const efi_guid_t pointers, so keep the GUID non-const to prevent a -Wdiscarded-qualifiers warning. For an x86_64 build with gcc 15.3.0, bloat-o-meter reports: add/remove: 6/0 grow/shrink: 0/3 up/down: 112/-458 (-346) Function old new delta graphics_output_guid - 32 +32 smbios_guid - 16 +16 edid_discovered_guid - 16 +16 edid_active_guid - 16 +16 console_out_device_guid - 16 +16 apple_set_os_guid - 16 +16 efi_stub_entry 4180 4136 -44 efi_get_smbios_record 283 226 -57 efi_setup_graphics 2210 1853 -357 Total: Before=29223, After=28877, chg -1.18% Signed-off-by: Vincent Mailhol <mailhol@kernel.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
6 daysfirmware: ti_sci: Fix typo "upto" in commentsHemanth Selam
Correct "upto" to "up to", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260904123541.38602-2-hemanth.selam@gmail.com Signed-off-by: Nishanth Menon <nm@ti.com>
6 daysfirmware: arm_scmi: Fix typo "upto" in commentHemanth Selam
Correct "upto" to "up to", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam <hemanth.selam@gmail.com> Link: https://patch.msgid.link/20260904103732.7320-1-hemanth.selam@gmail.com Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
7 daysMerge branches 'arm64-defconfig-for-7.4', 'arm64-fixes-for-7.3', ↵Bjorn Andersson
'arm64-for-7.4', 'clk-fixes-for-7.3', 'clk-for-7.4', 'drivers-fixes-for-7.3' and 'drivers-for-7.4' into for-next
7 daysfirmware: qcom: scm: Use devm_of_reserved_mem_device_init()Mukesh Ojha
Switch from of_reserved_mem_device_init() to the new resource managed devm_of_reserved_mem_device_init() so that the reserved memory region is released automatically on probe failure or device unbind. This eliminates the err_rmem cleanup label and the need to call of_reserved_mem_device_release() explicitly on error paths. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260902193948.1999595-1-mukesh.ojha@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
7 daysefi: add dynamic control interface for EFI runtime servicesJunxiao Chang
Add an interface for PREEMPT_RT kernels to dynamically enable or disable EFI runtime services. EFI runtime services are typically disabled on RT systems using kernel parameters such as "noefi" or "efi=disable" to avoid long latency caused by firmware calls. However, this permanently disables EFI runtime services, preventing operations such as UEFI firmware updates. With this change, EFI runtime services can be disabled while real-time workloads are running and re-enabled afterwards, providing low-latency operation without permanently sacrificing firmware functionality. Signed-off-by: Junxiao Chang <junxiao.chang@intel.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
7 daysefi/capsule: Replace kmap_atomic() with kmap_local_page()Danish Khateeb
kmap_atomic() is deprecated in favour of kmap_local_page(), as described in Documentation/mm/highmem.rst. The conversion is safe here: the mapping is created and torn down within a single iteration of the sg_count loop, preserving the strict stack-based ordering that kmap_local_page() requires, and the mapped region is only written to, so neither pagefault_disable() nor preempt_disable() is needed. The surrounding code already sleeps (it allocates the pages with alloc_page(GFP_KERNEL) and later takes capsule_mutex), so there is no atomic context to preserve. Build-tested only. Assisted-by: LLM sparse Signed-off-by: Danish Khateeb <danishkhateeb03@gmail.com> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
8 daysfirmware: Rename google firmware directory to corebootSean Rhodes
Most drivers in drivers/firmware/google are coreboot table drivers rather than Google-specific firmware drivers. Rename the directory to coreboot and update the Kconfig prompt, build path and maintainer entry. Rename the generic firmware Kconfig symbols to CONFIG_COREBOOT_* at the same time so new configurations describe the firmware interface rather than one vendor. Keep the old CONFIG_GOOGLE_* names as transitional symbols so existing configurations keep selecting the same drivers during the rename. Leave defconfig updates to a separate patch so the configuration churn is easy to review independently. Suggested-by: Julius Werner <jwerner@chromium.org> Signed-off-by: Sean Rhodes <sean@starlabs.systems> Link: https://lore.kernel.org/r/0a81e0d8e15c13f6a65c45ce476e37b33564ad61.1788284852.git.sean@starlabs.systems Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
9 daysfirmware: arm_ffa: Tear down driver during shutdownSudeep Holla
The platform core invokes a driver's shutdown callback, rather than its remove callback, while preparing devices for a normal kexec. Without a shutdown callback, the FF-A driver leaves notifications, partition devices, and the RX/TX mapping active before the replacement kernel is booted. Use ffa_remove() for shutdown so the existing cleanup runs before a normal kexec and other orderly system shutdowns. Reported-by: Nat Gurumoorthy <natg@google.com> Closes: https://lore.kernel.org/all/20260729162731.1383875-1-natg@google.com/ Reported-by: Carol L Soto <csoto@nvidia.com> Closes: https://lore.kernel.org/all/20260818224404.3694580-1-csoto@nvidia.com Reported-by: Maxi Saparov <masaparov@coreweave.com> Closes: https://lore.kernel.org/all/20260826222337.73480-1-maxi.saparov@gmail.com Link: https://patch.msgid.link/20260901131112.3437516-1-sudeep.holla@kernel.org Tested-by: Carol L Soto <csoto@nvidia.com> Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
9 daysfirmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPSXixin Liu
scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB). The missing upper bound dates back to the original SCPI DVFS support. Reject zero and out-of-range counts in one check and return -EINVAL. Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Link: https://patch.msgid.link/022802f0b38f.v2.1785200642.git.liuxixin@kylinos.cn Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
9 daysfirmware: arm_scpi: fix device_node leak in scpi_dev_domain_idXixin Liu
of_parse_phandle_with_args() takes a reference on clkspec.np that must be released with of_node_put(). scpi_dev_domain_id() returned clkspec.args[0] without dropping that reference, so every domain lookup leaked a device node. Paths such as scpi_dvfs_info() / cpufreq init call this per CPU, so the leak accumulates over time. Save the domain id, of_node_put(clkspec.np), then return the saved value. Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> Link: https://patch.msgid.link/84fdd490495b.v2.1785200642.git.liuxixin@kylinos.cn Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
10 daysfirmware: qcom_scm: Remove SCM PAS wrappersSumit Garg
Now since all the Qcom SCM client drivers have been migrated over to generic PAS TZ service, let's drop the exported SCM PAS wrappers. Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans Tested-by: Vignesh Viswanathan <vignesh.viswanathan@oss.qualcomm.com> # IPQ9650 Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260702115835.167602-14-sumit.garg@kernel.org Signed-off-by: Bjorn Andersson <andersson@kernel.org>
10 daysfirmware: qcom: scm: Allow QSEECOM on HP EliteBook X G2q 14 AIJason Pettit
The HP EliteBook X G2q 14" Next Gen AI PC is a Snapdragon X2 Elite (Glymur) laptop whose firmware exposes EFI variables through QSEECOM. Add its board compatible to the QSEECOM allowlist so that EFI variable access (efivarfs) works on this machine. Without it the kernel reports "qseecom: untested machine, skipping" and efivarfs is empty. Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com> Signed-off-by: Jason Pettit <jason.pettit@oss.qualcomm.com> Link: https://lore.kernel.org/r/20260829-glymur-send-v5-3-a11bdf6a4b66@oss.qualcomm.com Signed-off-by: Bjorn Andersson <andersson@kernel.org>
2026-08-25Merge tag 'rproc-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux Pull remoteproc updates from Bjorn Andersson: "Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores executing from dual-port BRAM, with clock and reset control and support for firmware without a resource table. Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends, and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings, and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur. Enable BAM-DMUX child devices for PAS modems and fix PAS memory protection, handover, shutdown, and resource lifetime handling. Harden remoteproc lifecycle handling by attaching asynchronously, stopping crashed processors, synchronizing crash work with removal, and forcing shutdown before device resources are released. Reallocate resources during attach recovery and fix several reference and error-path leaks. Add Xilinx R5 crash detection and move RPU start and stop sequencing into the platform firmware driver. Consolidate write-combining carveout mapping callbacks, use correct I/O-memory accessors, and share optional ELF resource-table handling across drivers. Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and generic remoteproc bindings, and harden resource-table iteration against signed-offset out-of-bounds accesses" * tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (60 commits) remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h remoteproc: fix coding style issues in remoteproc.h MAINTAINERS: add rsc_table.h to remoteproc entry remoteproc: qcom: pas: Add Nord ADSP and CDSP support dt-bindings: remoteproc: qcom,nord-pas: Document Nord PAS remoteproc: qcom: pas: Drop unused dtb_mem_region field remoteproc: qcom: pas: Map/unmap subsystem region before auth_and_reset remoteproc: qcom: pas: Fix the PAS context creation placement remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check remoteproc: qcom: annotate mem_region fields with __iomem arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc dt-bindings: remoteproc: qcom,milos-pas: Move Eliza ADSP to SM8550 schema remoteproc: qcom: pas: Add Eliza CDSP support dt-bindings: remoteproc: qcom,sm8550-pas: Add Eliza CDSP compatible remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side remoteproc: Force shutdown during device removal remoteproc: Prevent crash handling to race with rproc_del() remoteproc: Allow shutdown of crashed processors ...
2026-08-25Merge tag 'char-misc-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ...
2026-08-23Merge tag 'efi-next-for-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi Pull EFI updates from Ard Biesheuvel: - Set a timeout for EFI runtime service completions, and declare the firmware wedged if it is exceeded. Note that this requires special handling in case the firmware does return after all - Rate limit the efivarfs statfs() handler as the QueryVariableInfo() runtime service can be costly - Sanity check the size of struct properties_header on Mac/x86 - Tweak the prototype of efi_guid_to_str() * tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Rate limit statfs() handler efi: apple-properties: validate setup data header length efi: make efi_guid_to_str() take a const GUID pointer efi/runtime-wrappers: retire the worker if a wedged call ever returns efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths efi/runtime-wrappers: bound the wait for EFI runtime service calls efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work efi/runtime-wrappers: handle queue_work() failure with goto exit efi/runtime-wrappers: factor out efi_rts_park_worker() efi: fix stale reference to efi_recover_from_page_fault()
2026-08-21Merge tag 'drm-next-2026-08-20' of https://gitlab.freedesktop.org/drm/kernelLinus Torvalds
Pull drm updates from Dave Airlie: "Highlights: - dmemcg eviction support is good for low VRAM things like Steam Machine - AMD adds gfx6-8 modifier support for older GPUs that enables a bunch of wayland stuff - i915/xe has some new hw support but also a lot of display refactoring Everything: perf: - export perf_allow_ APIs for xe udmabuf: - remove default size limit of 64MB rust: - i/o rework (signed tag from driver-core tree) - add registration guard and registration data - fix unbounded lifetimes in ioctl handler args - fix a drm_dev_register race - gem_shmem: add DmaResvGuard helper - gpuvm: require send/sync for driver data - implement send/sync for GpuVaAlloc and GpuVmBo - add SmContext lifetime - rename dma_handle to dma_address - change pci_sriov_get_totalvfs return to unsigned int core: - create drm_of_get_panel_orientation - send per-connector hotplug events - add thunderbolt UBHR tunneling support connector: - add color format property dmem: - introduce a peak file - accept one region per limit - add dmemcg support for eviction gpusvm: - reorg code to give drivers more flexibility atomic: - add create_state callback and helper - add documentation on atomic commit lifetime buddy: - add per-order free - add used block scoreboard - fix UAF - test buffer clearance on resume - add phys_addr->block helper gem: - drop DRIVER_GEM_GPUVA flag ttm: - be more aggressive allocating below protection limit sched: - add test suite for concurrent job submissions hdmi: - hook the color format property in helpers mipi-dsi: - add MIPI_DSI_MODE_DSC_ALL_SLICES_IN_PKT bridge: - add atomic create callbacks - drop atomic reset - display-connector: don't autoenable HPD IRQ - trigger initial HPD for DP - ti-sn65dsi83: remove NO_HFP and NO_HBP mode flags - analogix_dp: switch to DP link training helpers dp: - add support for DSC max delta BPP edid: - parse panel type from DisplayID 2.x Display Parameters sysfb: - improve panel, stride, framebuffer size validation panel: - implement ref counting for struct drm_panel - himax-hx83121a: add backlight regulator support - novatek-nt36672a: Inline panel init sequences - visionox-vtdr6130: enable DSC - novatek-nt37801: Use mipi_dsi_*_multi() functions - samsung-s6d16d0: Fix prepare error handling - support Novatek NT36536 plus DT bindings - sofef00: fix backlight updates - osd101t2587: use mipi_dsi_*_multi interface - panel-edp: adjust timing for AUO displays - panel-lvds: support Opto Logic SCX1001511GGC49 - panel-simple: support Kyocera tcg070wvlq - panel-edp: quirks - AUO B116XAT04.3, CMN N116BCP-EA2, CSW MNB601LS1-8 - BOE NV116WH2-M30, BOE NT116WHM-N21, BOE NV116FH1-M31 - BOE NV116FH1-M30, NV140FHM-N5B, TM156VDXP25 - BOE NE160QDM-NY1, MB116AS01 - new: - Samsung ATNA40HQ08-0, Anbernic TD4310 - Chipone ICNA35XX, Ilitek ILI9488 - Ilitek ILI7807S, Renesas R63419 - MNE001BS6-2, MNF601BS4-1, Sharp LQ120P1JX51 virtio: - add support for save/restore virtio_gpu_objects - abort vq wait on device removal amdgpu: - add color format DRM property - initial compute pipe reset support - add GFX 6-8 modifier support - initial DCN 6.0.0 support - dmemcg eviction support - improved boundary checking for bios parsing - RAS updates and rework - VCN secure submission fixes - 8K panel fix - Display KUNIT tests - parse panel type from DisplayID - Align IP discovery to pci device lifetime - SOC15 register macro cleanups - UVD memory placement fixes - GFX9 mode2 reset fixes - drop unnecessary BUG/BUG_ON - GFX8 soft reset rework - enable soft reset on GFX8 - PSP/SMU 15.0.9 update - VI ASPM fix - userq fixes - amdgpu_vm_get_task_info_pasid lifetime fix - DC CACP support - change system_unbound_wq with system_dfl_wq - Loosen VFCT bios parsing to deal with pci=realloc - SI/SMU7 AC/DC switch fix - VM fence handling fix - GEM close optimisation - Apple Studio Display fixes - DC FRL fixes amdkfd: - initial compute pipe reset support - allow applications to opt out of sigbus on fatal errors - improve CRIU boundary checks - MQD handling rework - move TBA/TMA from system to device memory - avoid topology-lock in kfd_mmap - SVM eviction fixes radeon: - fix unset CONFIG_ACPI build i915: - Novalake (NVL display version 35) timing generator enabling - NVL DC3CO enabling - enable UBHR link rates on thunderbolt tunnels - Reduce Xe3+ PM demand peak bandwidth - enable pipe DMC error interrupts for display 30+ - add kunit tests for DP link config selection - refactor and document DP link recovery - i915/xe driver display probe/remove/suspend/resume/shutdown cleanup and unification - i915/xe display runtime PM unified - Break i915 and xe panic dependency on struct intel_framebuffer - Streamline Pre/Post-CSC LUT loops - drop TGL DC3DO support - CDCLK santization - fix HDMI scrambling enable - fix phys bo pread/pwrite with offset - add missing nospec on parallel submit slot - fix some NULL derefs xe: - drop force_execlist module param - gate observation streams with perf_allow_cpu - skip FORCE_WC and vm_bound check for external dma-bufs - dmemcg eviction support - remove unused NVL-S GuC - TLB invalidation improvements - NVL-S updated PCI-IDs and w/a - madvise: optimise invalidation path - fix infinite gt-reset loop in timeout recovery - update TTM device benefical_order - wait on external BO kernel fences in exec ioctl - add/use more KLV helpers - sriov: disable display in admin only PF mode - add RAS GPU health indicator - optimise TTM populate for DONTNEED BO - drop force_probe for NVL-s - add debugfs for pcode info amdxdna: - disable device buffer export nova: - build nova-core/nova-drm from drivers/gpu - export nova-core rust symbols (workaround) - GSP boot process consolidation - Boot GSP with vGPU enabled - TLV firmware image format support - Hopper/Blackwell fixes and cleanups - I/O projection adoption tyr: - firmware loading and MCU boot - add generic slot manager + MMU - GPU VM support ARM64 LPAE page tables - add kernel buffer object for internal allocations - add parser for Mali CSF - add MCU booting nouveau: - race fixes - check instmem iomapping at first use - add dmemcg support - expose NVDEC channels - add scanline position/head state support for GSP qxl: - convert simple encoder to regular ethosu: - add perf counter support etnaviv: - force flush on power register ops msm: - support DSC configuration with slice_per_pkt > 1 mxsfb: - fix disable sequence panthor: - support sparse mappings rockchip: - switch away from simple helpers - support YUV background color - fix layer config timeout - add edp support for rk3576 - add batch command submission function rocket: - error handling and NULL ptr deref fixes sun4i: - switch away from simple helpers imagination: - mark BXM-4-64 MC1 as support host1x: - support tegra264 tegra: - add DSI for tegra 20/30 v3d: - reduce PM runtime autosuspend delay - scheduler fixes and refactoring - deprecate v3d 3.3 and 4.1 - validate CPU job query boundaries hibmc: - improve plane format handling - switch to gem shmem mediatek: - cec: correct compat for mt7623-8167? exynos: - remove simple dependency - add error handling to encoder paths - take i2c adapter module reference" * tag 'drm-next-2026-08-20' of https://gitlab.freedesktop.org/drm/kernel: (2074 commits) drm/xe/mcr: Take vcs1/vecs1 into account for first media slice drm/xe: Fix a bug in pc_adjust_freq_bounds() drm/xe: Fix xe_device_probe() failure drm/xe/drm_ras: Move has_drm_ras check to drm_ras layer drm/xe/ras: Fix boot-time ras error processing drm/amd/display: make DC_RUN_WITH_PREEMPTION_ENABLED misuse a build error drm/amd/pm: silence uninitialized variable warnings drm/amdgpu: skip BOs being torn down during GTT recovery drm/amdgpu: Reject UVD message with invalid number of h265 refs drm/amdgpu: keep PRT mappings off the vm_bo state lists drm/amdgpu: fix nbif 6.3.1 l1 low power not functional drm/amd/display: fix BT.2020 YCbCr output CSC matrices for DCE drm/amd/display: fix BT.2020 YCbCr limited output CSC matrix drm/amdgpu: Implement insert_end for VCE 3 drm/amdgpu: Fix UVD min buffer sizes drm/amdgpu: Fix UVD decode image min size calculation drm/amdgpu: Fix UVD dpb min size calculation for H264 drm/amdgpu: Reject UVD message with dimensions above 4096 drm/amdgpu: check ASPM on the dGPU host link drm/radeon: fix autosuspend cleanup during teardown ...
2026-08-20Merge tag 'bitmap-for-7.3' of https://github.com/norov/linuxLinus Torvalds
Pull bitmap updates from Yury Norov: "The usual set of fixes, cleanups and performance improvements together with a couple of new tests: - bitmap_find_next_zero_area_off() optimization (Sunyi) - bitmap_find_next_zero_area_off(): return size when no zero area is found (Yury) - bitmap vs IDA vs Maple Tree performance test (Yury) - get rid of cpumap_print_to_pagebuf() (Yury) - use nr_node_ids in __nodemask_pr_numnodes() (Li RongQing) - bitops: make the *_bit_le functions use unsigned long (Benjamin) - bitmap scatter & gather test fix (Christophe) - use __ASSEMBLER__ in bitmap header files (Thomas)" * tag 'bitmap-for-7.3' of https://github.com/norov/linux: (25 commits) lib: test bitmap vs IDA vs Maple Tree performance for region allocations bitmap: Return size when no zero area is found media: s5p-mfc: Treat bitmap size as allocation failure crypto: ccp: Treat bitmap size as allocation failure powerpc/msi: Treat bitmap size as allocation failure ARM: dma-mapping: Treat bitmap size as allocation failure bitmap: drop bitmap_next_set_region() nodemask: reduce bitmap width to nr_node_ids in __nodemask_pr_numnodes() bitmap: Properly initialise destination bitmap for scatter & gather test lib/bitmap-str: get rid of cpumap_print_to_pagebuf() perf: Use sysfs_emit() for cpumask show callbacks PCI/sysfs: Use sysfs_emit() for cpumask show callbacks RDMA/hfi1: Use sysfs_emit() for cpumask show helper hwtracing: hisi_ptt: Use sysfs_emit() for cpumask show fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show devfreq: Use sysfs_emit() for cpumask show callbacks cpu: Use sysfs_emit() for cpumask show callback x86/events: Use sysfs_emit() for cpumask show callbacks powerpc: Use sysfs_emit() for cpumask show callbacks arm: Use sysfs_emit() for cpumask show callbacks ...
2026-08-20efi: apple-properties: validate setup data header lengthPengpeng Hou
map_properties() remaps the Apple properties setup_data payload and then reads the properties header fields. Reject a truncated payload before checking the header version and length fields. Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn> Reviewed-by: Lukas Wunner <lukas@wunner.de> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: retire the worker if a wedged call ever returnsBreno Leitao
When __efi_queue_work() times out it disables runtime services and returns, but the kworker is still blocked inside firmware. If the firmware eventually unblocks, efi_call_rts() would run its tail on an efi_rts_work that the timed-out caller has long abandoned: signalling a stale completion and clearing efi_runtime_lock_owner that may by then belong to another caller. If runtime services have been disabled by the time the call returns, park the worker with efi_rts_park_worker() instead, so it never touches efi_rts_work again or returns to the workqueue. Suggested-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking pathsBreno Leitao
Three wrappers call firmware directly instead of going through __efi_queue_work(), and none of them check whether runtime services are still enabled: virt_efi_set_variable_nb(), virt_efi_query_variable_info_nb() and virt_efi_reset_system(). Once a hang has cleared EFI_RUNTIME_SERVICES - or efi_recover_from_page_fault() has cleared it on a firmware page fault - these paths still enter the (possibly wedged) firmware, e.g. an EFI pstore write through the non-blocking SetVariable() variant, in violation of UEFI's non-reentrancy rules. reset_system() is reachable too: efi_reboot() only gates it on the static efi_rt_services_supported() mask, which does not track the runtime disable. Check efi_enabled(EFI_RUNTIME_SERVICES) in each before calling into firmware. Test it after taking efi_runtime_lock rather than before: the bit is only ever cleared at runtime while that lock is held, so checking it under the lock avoids racing with a concurrent timeout that clears the bit and drops the lock. Suggested-by: Ard Biesheuvel <ardb@kernel.org> Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: bound the wait for EFI runtime service callsBreno Leitao
When an EFI runtime service hangs in firmware, the efi_rts_wq worker is stuck inside the call and cannot be cancelled. __efi_queue_work() then waits on the completion forever while holding efi_runtime_lock, so every later EFI caller is wedged until reboot; the only symptom is a "workqueue lockup" and tasks piling up on the semaphore. Replace wait_for_completion() with wait_for_completion_timeout() bounded by EFI_RTS_TIMEOUT (120 seconds). On timeout, clear EFI_RUNTIME_SERVICES and return EFI_ABORTED so later callers fail fast at the entry check instead of each paying another 120 seconds. The wedged worker is intentionally leaked and keeps ownership of efi_rts_work. A worker that only starts running after the timeout would otherwise dereference efi_rts_work.args, now pointing into the caller's freed stack frame, and hand stale pointers to firmware. Park it with efi_rts_park_worker() at the entry of efi_call_rts() when runtime services are already disabled, before it touches args or enters firmware. Known limitation: a worker already inside firmware when the timeout fires still holds efi_rts_args pointing into the caller's stack frame; if firmware unblocks afterwards and writes the output buffers, they land in reused memory. Firmware hung this long rarely recovers; a follow-up could bounce the buffers through kmalloc. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_workBreno Leitao
Move the EFI_RUNTIME_SERVICES check to the top of __efi_queue_work() and return directly, so a caller that finds runtime services disabled returns without touching the shared efi_rts_work. No functional change. This prepares for bounding the wait, where a timeout will clear EFI_RUNTIME_SERVICES while the leaked worker still owns efi_rts_work; a later caller must then bail out before reinitialising it. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: handle queue_work() failure with goto exitBreno Leitao
Convert the queue_work() failure path in __efi_queue_work() to a goto exit instead of falling through to the wait and the WARN_ON_ONCE(status == EFI_ABORTED) below it. A failed queue_work() leaves the status at its initial EFI_ABORTED, so that warning would fire even though no call ran; it is meant for a completed call that returned EFI_ABORTED. No change for the common (successful enqueue) path. This also prepares __efi_queue_work() for the timeout handling added later. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20efi/runtime-wrappers: factor out efi_rts_park_worker()Breno Leitao
x86's efi_crash_gracefully_on_page_fault() ends in an infinite schedule() loop so the kworker that faulted in firmware never runs efi_rts_wq again. A later change needs the same "park this worker forever" primitive on the runtime service timeout path, so factor the loop into a shared efi_rts_park_worker() and call it from the x86 page-fault handler. No functional change. Signed-off-by: Breno Leitao <leitao@debian.org> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
2026-08-20BackMerge tag 'v7.2' into drm-nextDave Airlie
Linux 7.2 There was a lot of conflicts this round between fixes and next, and I'd like to get the merge resolutions that we have in drm-tip. Signed-off-by: Dave Airlie <airlied@redhat.com>
2026-08-19Merge tag 'sound-7.3-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound Pull sound updates from Takashi Iwai: "It was a fairly busy development cycle - the changes spread over from the core side to leaf drivers, with lots of cleanups and enhancements. Here we go, some highlights: ALSA core: - Extension of ALSA control component list ABI - Locking optimization and RCU conversion of ALSA sequencer core - A few hardening fixes for UMP and sequencer core - Drop __bitwise and __force prefix from UAPI definitions ASoC: - Automatic DAI format selection code deployment across many drivers - Sorting of register default tables to prevent ordering issues in many drivers - Lots of code cleanups and refactoring - Updates in Qualcomm driver stack - New platforms: AMD ACP7.B/F, Cirrus Logic CS35L62, Loongson 2K0300, Meson GX, Qualcomm LPI MI2S, SM8475, WSA855X, Realtek RT1321 VA1/2 and RT766/7 HD-audio: - Support for AW88399 HD-audio side codec for Lenovo Legion laptops - Support for Hygon and Lisuan HDMI controllers - Robustness fixes for wild device binding - Lots of quirks/fixups: Realtek and Conexant codecs for ASUS, Lenovo, Acer, etc USB-audio: - Support for Pioneer DJ DJM-S11 - Scarlett2/FCP private URB notification fixes - Extended quirk_flags to 64bit - Hardening fixes for 6fire, bcd2000, usx2y - Device-specific quirks for Mackie, Valeton, SPACETOUCH General: - Auto-cleanup for put_device() and firmware loading across multiple platforms" * tag 'sound-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (791 commits) ALSA: hda: Fix connection list comparison in proc output ALSA: docs: fix dead link to Intel HD-audio spec ALSA: usb-audio: Add delay quirk for SPACETOUCH USB Audio ALSA: hda: Add Lisuan HDMI controller and codec support ALSA: hda/realtek: Fix Lenovo Yoga Slim 7 14AKP10 quirk ordering ALSA: hda/tas2781: Add hardware stabilization delay during firmware load retries ALSA: hda/realtek: Fix mute LED for HP Victus 15-fa1xxx (MB 8C3F) ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A515-57 ASoC: tas2783-sdw: do not treat read-only Controls as writable ASoC: SOF: validate topology volume range before allocation ASoC: cs35l56: Use IRQ provided by the SoundWire core soundwire: bus_type: Create IRQ mapping before calling driver probe() ASoC: cs35l56: Move cs35l56_irq_request() after cs35l56_irq() ASoC: cs35l56: Request IRQ in cs35l56_common_probe() ALSA: core: Fix use-after-free in snd_card_do_free() ALSA: hda/realtek: Drop duplicate quirk for Lenovo 0x17aa:0x38df ALSA: usb-audio: Rename the Audient iD14 monitor mix volume control ASoC: tas2781: Refactor calibration start kcontrol creation to separate helper ASoC: dt-bindings: es8316: Fix supply property constraints ALSA: seq: midi: Serialize input teardown with event_input ...
2026-08-19Merge tag 'chrome-platform-firmware-v7.3' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux Pull chrome platform firmware updates from Tzung-Bi Shih: "Fixes: - Don't map no-map memory regions for CBMEM entries - Check bound of coreboot table entries Cleanups: - Fix typo in docs" * tag 'chrome-platform-firmware-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/chrome-platform/linux: firmware: coreboot: Validate table bounds firmware: coreboot: Skip no-map CBMEM entries docs: ABI: testing: Fix typo
2026-08-18Merge tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/socLinus Torvalds
Pull ARM SoC platform updates from Arnd Bergmann: "The 32-bit Arm platforms are a bit more interesting this time: I refreshed an earlier series to mark code as deprecated that does have the tendency of getting in the way of cleanups and new features but has close to zero users. Among these are: - 22 of the remaining 28 legacy board files that predate the current devicetree based descriptions, using old chips from Intel and Marvell. The remaining six board files are for TI OMAP1 and Samsung s3c64xx chips and all still have known users. - support for Cortex-M3/M4/M7 and ARM1136r0 CPU cores and the 25 machines based on these. These all use devicetree but the CPU support causes disproportional work. Most of them are just reference boards, the notable exceptions being the Nokia N800/N810 tablet and the Buglabs BUG platform. - be8, be32, oabi and iwmmxt userspace binaries, which were mostly associated with the platforms now scheduled for removal and are increasingly problematic to support with modern toolchains. Nothing is actually removed at this point, to ensure that any remaining users continue to have the 7.3-LTS for a while longer. Patches for removal are currently being tested. Other updates include a continued work to convert GPIO number based interfaces to descriptors, a patch to restore little-endian mode on the one Arm platform (ixp4xx) that only worked in big-endian mode recently, and some minor cleanups and bugfixes" * tag 'soc-arm-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (41 commits) MAINTAINERS: Drop redundant lists from various Samsung entries ARM: tegra: Replace __ASSEMBLY__ with __ASSEMBLER__ ARM: tegra: Fix OF node reference leaks in IRQ init ARM: lpc32xx: remove a few manually populated OF devices ARM: lpc32xx: only run SoC init on LPC32xx hardware firmware: imx: scu: manage mailbox channels and global handle ARM: sa1100: h3xxx: convert gpio-keys to use software nodes ARM: sa1100: collie: convert gpio-keys to use software nodes ARM: sa1100: assabet: convert gpio-keys to use software nodes gpio: sa1100: register software node for GPIO controller ARM: ixp4xx: Relax endianness ARM: replace linux/gpio.h inclusions soc: imx9: devm_kasprintf error handling ARM: mark mv78xx0 support as deprecated ARM: mark axxia platform as deprecated ARM: mark Cortex-M3/M4/M7 based boards as deprecated ARM: mark footbridge as deprecated ARM: mark RiscPC as deprecated ARM: mark mach-sa1100 as deprecated ARM: orion5x: mark all board files as deprecated ...
generated by cgit v1.2.3 (git 2.39.1) at 2026-09-10 10:48:15 +0000