laptop-kernel/drivers/firmware, branch master

Merge tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes

2026-09-14T15:02:19Z

Arm firmware fixes for v7.3 SCPI fixes address resource leaks and invalid firmware responses, while FF-A gains shutdown cleanup needed for normal kexec. - Release the device node reference acquired during SCPI domain lookup. - Validate SCPI DVFS OPP counts and indices returned by firmware to prevent out-of-bounds accesses and invalid clock rates. - Register the SCPI cpufreq device only once across DVFS providers, preserving the registered device pointer for cleanup and allowing retries after registration failure. - Run FF-A teardown during orderly shutdown so notifications, partition devices and RX/TX mappings are released before a replacement kernel boots through normal kexec. Also includes replacing a literal platform device ID with PLATFORM_DEVID_NONE and correcting an SCMI comment typo. * tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment firmware: arm_ffa: Tear down driver during shutdown clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id Signed-off-by: Arnd Bergmann

Merge branches 'for-next/ffa/fixes' and 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux

2026-09-08T20:04:42Z

* 'for-next/ffa/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_ffa: Tear down driver during shutdown * 'for-next/scmi/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: firmware: arm_scmi: Fix typo "upto" in comment clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq clk: scpi: register scpi-cpufreq once and clear on failure clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id

treewide: refresh kmalloc_obj() conversions

2026-09-05T04:37:00Z

This is another run of the Coccinelle script for converting kmalloc() family of allocations to kmalloc_obj() via the existing rules in scripts/coccinelle/api/kmalloc_objs.cocci This catches both the set of kmalloc() uses added since the first kmalloc_obj() conversions in v7.0 and adds a large group missed in the first pass due to Coccinelle not interacting well with the cleanup.h scoped_...() family of macros[1]. I worked around this with spatch's "--macro-file" argument to a file with all the scoped_...() macros mapped to Coccinelle's YACFE_ITERATOR[2] as that was the closest viable control flow indicator I could find. Build tested allmodconfig on x86, arm64, arm, loongarch, mips, powerpc, riscv, and s390 with no new warnings. Link: https://lore.kernel.org/lkml/202609021314.8A9C0B8@keescook/ [1] Link: https://github.com/coccinelle/coccinelle/blob/master/standard.h [2] Signed-off-by: Kees Cook

firmware: arm_scmi: Fix typo "upto" in comment

2026-09-04T11:06:16Z

Correct "upto" to "up to", reported by scripts/checkpatch.pl using the misspelling list in scripts/spelling.txt. Only touches comments, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://patch.msgid.link/20260904103732.7320-1-hemanth.selam@gmail.com Signed-off-by: Sudeep Holla

firmware: arm_ffa: Tear down driver during shutdown

2026-09-01T16:41:07Z

The platform core invokes a driver's shutdown callback, rather than its remove callback, while preparing devices for a normal kexec. Without a shutdown callback, the FF-A driver leaves notifications, partition devices, and the RX/TX mapping active before the replacement kernel is booted. Use ffa_remove() for shutdown so the existing cleanup runs before a normal kexec and other orderly system shutdowns. Reported-by: Nat Gurumoorthy Closes: https://lore.kernel.org/all/20260729162731.1383875-1-natg@google.com/ Reported-by: Carol L Soto Closes: https://lore.kernel.org/all/20260818224404.3694580-1-csoto@nvidia.com Reported-by: Maxi Saparov Closes: https://lore.kernel.org/all/20260826222337.73480-1-maxi.saparov@gmail.com Link: https://patch.msgid.link/20260901131112.3437516-1-sudeep.holla@kernel.org Tested-by: Carol L Soto Signed-off-by: Sudeep Holla

firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

2026-09-01T10:44:59Z

scpi_dvfs_get_info() already rejected a zero opp_count, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps[]; a bigger count over-reads that array and then sizes the allocated OPP table incorrectly (garbage OPPs / OOB). The missing upper bound dates back to the original SCPI DVFS support. Reject zero and out-of-range counts in one check and return -EINVAL. Fixes: 8cb7cf56c9fe ("firmware: add support for ARM System Control and Power Interface(SCPI) protocol") Signed-off-by: Xixin Liu Link: https://patch.msgid.link/022802f0b38f.v2.1785200642.git.liuxixin@kylinos.cn Signed-off-by: Sudeep Holla

firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id

2026-09-01T10:44:59Z

of_parse_phandle_with_args() takes a reference on clkspec.np that must be released with of_node_put(). scpi_dev_domain_id() returned clkspec.args[0] without dropping that reference, so every domain lookup leaked a device node. Paths such as scpi_dvfs_info() / cpufreq init call this per CPU, so the leak accumulates over time. Save the domain id, of_node_put(clkspec.np), then return the saved value. Signed-off-by: Xixin Liu Link: https://patch.msgid.link/84fdd490495b.v2.1785200642.git.liuxixin@kylinos.cn Signed-off-by: Sudeep Holla

Merge tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux

2026-08-25T21:03:31Z

Pull remoteproc updates from Bjorn Andersson: "Add a remoteproc driver and binding for AMD MicroBlaze/V soft cores executing from dual-port BRAM, with clock and reset control and support for firmware without a resource table. Introduce a generic Qualcomm PAS service with SCM and OP-TEE backends, and migrate the PAS, MSS, and WCNSS remoteproc drivers to it. Add Nord ADSP and CDSP support, Eliza CDSP support, Maili ADSP/CDSP bindings, and late-attach SoCCP support for Kaanapali, Hawi, Maili, and Glymur. Enable BAM-DMUX child devices for PAS modems and fix PAS memory protection, handover, shutdown, and resource lifetime handling. Harden remoteproc lifecycle handling by attaching asynchronously, stopping crashed processors, synchronizing crash work with removal, and forcing shutdown before device resources are released. Reallocate resources during attach recovery and fix several reference and error-path leaks. Add Xilinx R5 crash detection and move RPU start and stop sequencing into the platform firmware driver. Consolidate write-combining carveout mapping callbacks, use correct I/O-memory accessors, and share optional ELF resource-table handling across drivers. Convert the TI Wakeup M3 binding to DT schema, correct Qualcomm and generic remoteproc bindings, and harden resource-table iteration against signed-offset out-of-bounds accesses" * tag 'rproc-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (60 commits) remoteproc: fix OOB read via signed offset in rsc_table_for_each_entry() remoteproc: replace BSD blurb with SPDX identifier in rsc_table.h remoteproc: replace BSD blurb with SPDX identifier in remoteproc.h remoteproc: fix coding style issues in remoteproc.h MAINTAINERS: add rsc_table.h to remoteproc entry remoteproc: qcom: pas: Add Nord ADSP and CDSP support dt-bindings: remoteproc: qcom,nord-pas: Document Nord PAS remoteproc: qcom: pas: Drop unused dtb_mem_region field remoteproc: qcom: pas: Map/unmap subsystem region before auth_and_reset remoteproc: qcom: pas: Fix the PAS context creation placement remoteproc: qcom: pas: Guard dtb metadata release with dtb_pas_id check remoteproc: qcom: annotate mem_region fields with __iomem arm64: dts: qcom: eliza: Add fallback compatible for ADSP remoteproc dt-bindings: remoteproc: qcom,milos-pas: Move Eliza ADSP to SM8550 schema remoteproc: qcom: pas: Add Eliza CDSP support dt-bindings: remoteproc: qcom,sm8550-pas: Add Eliza CDSP compatible remoteproc: qcom: q6v5: Request shutdown if crash is triggered host-side remoteproc: Force shutdown during device removal remoteproc: Prevent crash handling to race with rproc_del() remoteproc: Allow shutdown of crashed processors ...

Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc

2026-08-25T16:38:50Z

Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ...

Merge tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi

2026-08-23T16:24:34Z

Pull EFI updates from Ard Biesheuvel: - Set a timeout for EFI runtime service completions, and declare the firmware wedged if it is exceeded. Note that this requires special handling in case the firmware does return after all - Rate limit the efivarfs statfs() handler as the QueryVariableInfo() runtime service can be costly - Sanity check the size of struct properties_header on Mac/x86 - Tweak the prototype of efi_guid_to_str() * tag 'efi-next-for-v7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/efi/efi: efivarfs: Rate limit statfs() handler efi: apple-properties: validate setup data header length efi: make efi_guid_to_str() take a const GUID pointer efi/runtime-wrappers: retire the worker if a wedged call ever returns efi/runtime-wrappers: honour EFI_RUNTIME_SERVICES in the non-blocking paths efi/runtime-wrappers: bound the wait for EFI runtime service calls efi/runtime-wrappers: check EFI_RUNTIME_SERVICES before using efi_rts_work efi/runtime-wrappers: handle queue_work() failure with goto exit efi/runtime-wrappers: factor out efi_rts_park_worker() efi: fix stale reference to efi_recover_from_page_fault()