linux-stable.git/drivers/fpga, branch master Linux kernel stable tree Merge tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc 2026-08-25T16:38:50+00:00 Linus Torvalds torvalds@linux-foundation.org 2026-08-25T16:38:50+00:00 93e4b3076b5f2d853462b9777d083c77fc0b7b23 Pull char/misc/IIO/etc driver updates from Greg KH: "Here is the big set of char, misc, iio, counter, fpga, and other small driver subsystems for 7.3-rc1. Overall, due to some driver removals we only added a bit more code than removed, which was a nice change. Highlights in this merge request are: - Loads of IIO driver updates and additions - binder driver updates (more on that below...) - Removal of the SGI XP and GRU drivers as they are not used anymore and turn out to be pretty insecure overall - Removal of the obsolete ibmasm driver as it's not being used anymore - Coresight driver updates and additions - Mei driver udpates - Counter driver updates - FPGA driver updates - ICC driver updates - lots and lots of other tiny driver updates to resolve reported issues All of these have been in linux-next for a while" * tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits) iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF iio: adc: pac1921: fix wrong channel used in trigger handler read iio: light: gp2ap002: re-enable irq if runtime suspend fails iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes iio: light: apds9306: fix PM reference leak in apds9306_read_data() iio: gyro: mpu3050: fix sign of raw angular velocity readings iio: srf04: fix pm_runtime handling on probe error path iio: adc: ad4080: configure backend data size iio: adc: adi-axi-adc: add data size support for AD408X backend iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable iio: dac: ad5446: fix OF module device table iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask iio: light: opt4001: Reject integration times with a non-zero seconds part iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem() iio: light: opt4001: Fix power down clearing bits of the wrong register iio: light: opt4060: Fix incorrect register name in threshold read error message iio: light: opt4060: Fix pointer type passed to div_u64_rem() iio: light: opt4060: Reject integration times with a non-zero seconds part iio: light: ltrf216a: fix runtime PM reference leak in error path iio: pressure: dps310: fix NULL pointer dereference on ACPI probe ... 
Pull char/misc/IIO/etc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, counter, fpga, and other small
  driver subsystems for 7.3-rc1.

  Overall, due to some driver removals we only added a bit more code
  than removed, which was a nice change. Highlights in this merge
  request are:

   - Loads of IIO driver updates and additions

   - binder driver updates (more on that below...)

   - Removal of the SGI XP and GRU drivers as they are not used anymore
     and turn out to be pretty insecure overall

   - Removal of the obsolete ibmasm driver as it's not being used
     anymore

   - Coresight driver updates and additions

   - Mei driver udpates

   - Counter driver updates

   - FPGA driver updates

   - ICC driver updates

   - lots and lots of other tiny driver updates to resolve reported
     issues

  All of these have been in linux-next for a while"

* tag 'char-misc-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (513 commits)
  iio: chemical: atlas-sensor: use iio_trigger_poll_nested() to fix remove UAF
  iio: adc: pac1921: fix wrong channel used in trigger handler read
  iio: light: gp2ap002: re-enable irq if runtime suspend fails
  iio: light: gp2ap002: Fix unbalanced runtime PM on repeated event writes
  iio: light: apds9306: fix PM reference leak in apds9306_read_data()
  iio: gyro: mpu3050: fix sign of raw angular velocity readings
  iio: srf04: fix pm_runtime handling on probe error path
  iio: adc: ad4080: configure backend data size
  iio: adc: adi-axi-adc: add data size support for AD408X backend
  iio: chemical: atlas-sensor: fix PM reference leak in buffer postenable
  iio: dac: ad5446: fix OF module device table
  iio: light: opt4001: Fix reversed GENMASK() arguments in fault count mask
  iio: light: opt4001: Reject integration times with a non-zero seconds part
  iio: light: opt4001: Fix incompatible pointer type passed to div_u64_rem()
  iio: light: opt4001: Fix power down clearing bits of the wrong register
  iio: light: opt4060: Fix incorrect register name in threshold read error message
  iio: light: opt4060: Fix pointer type passed to div_u64_rem()
  iio: light: opt4060: Reject integration times with a non-zero seconds part
  iio: light: ltrf216a: fix runtime PM reference leak in error path
  iio: pressure: dps310: fix NULL pointer dereference on ACPI probe
  ...
Merge tag 'fpga-for-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga into char-misc-next 2026-08-06T09:06:47+00:00 Greg Kroah-Hartman gregkh@linuxfoundation.org 2026-08-06T09:06:47+00:00 5924b749b3970f83870491880ba2342983551f3c Xu writes: FPGA Manager changes for 7.3-rc1 - Michal replaces the open code by devm_clk_get_prepared() in xilinx fpga driver - Tien Fixes the incorrect usage of stratix10_svc_done() in altera fpga driver - Greg adds error handling for fpga dfl driver - Pan removes redundant dev_err() in xilinx fpga driver - Daisuke fixes a potential out-of-bounds read in altera fpga driver - Ayananta fixes spelling in fpga dfl ABI doc All patches have been reviewed on the mailing list, and have been in the last linux-next releases (as part of our for-next branch). Signed-off-by: Xu Yilun <yilun.xu@intel.com> * tag 'fpga-for-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga: fpga: dfl: fix spelling in sysfs-platform-dfl-port ABI documentation fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write fpga: zynq-fpga: Remove redundant dev_err() fpga: dfl: fme: add error handling fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration fpga: xilinx-pr-decoupler: Use devm_clk_get_prepared() 
Xu writes:

FPGA Manager changes for 7.3-rc1

- Michal replaces the open code by devm_clk_get_prepared() in xilinx
  fpga driver
- Tien Fixes the incorrect usage of stratix10_svc_done() in altera
  fpga driver
- Greg adds error handling for fpga dfl driver
- Pan removes redundant dev_err() in xilinx fpga driver
- Daisuke fixes a potential out-of-bounds read in altera fpga driver
- Ayananta fixes spelling in fpga dfl ABI doc

All patches have been reviewed on the mailing list, and have been in the
last linux-next releases (as part of our for-next branch).

Signed-off-by: Xu Yilun <yilun.xu@intel.com>

* tag 'fpga-for-v7.3-rc1' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/fpga/linux-fpga:
  fpga: dfl: fix spelling in sysfs-platform-dfl-port ABI documentation
  fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write
  fpga: zynq-fpga: Remove redundant dev_err()
  fpga: dfl: fme: add error handling
  fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration
  fpga: xilinx-pr-decoupler: Use devm_clk_get_prepared()
fpga: altera-cvp: Avoid out-of-bounds read in trailing byte write 2026-08-04T09:35:41+00:00 Daisuke Matsuda matsuda@preferred.jp 2026-07-23T08:19:12+00:00 9da70a43b5fea60d758137f7f0ccfe19356cb5bb The trailing byte path in altera_cvp_send_block() dereferences a u32 pointer even when only 1-3 bytes remain in the input buffer. If the buffer ends at a page or scatterlist boundary, this can read past the valid image data and fault. Copy the remaining bytes into a zero-initialized u32 before writing the final word so only valid bytes are read from the input buffer. Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver") Cc: stable@vger.kernel.org Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
The trailing byte path in altera_cvp_send_block() dereferences a u32
pointer even when only 1-3 bytes remain in the input buffer. If the buffer
ends at a page or scatterlist boundary, this can read past the valid image
data and fault.

Copy the remaining bytes into a zero-initialized u32 before writing the
final word so only valid bytes are read from the input buffer.

Fixes: 34d1dc17ce97 ("fpga manager: Add Altera CvP driver")
Cc: stable@vger.kernel.org
Signed-off-by: Daisuke Matsuda <matsuda@preferred.jp>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260723081912.74082-1-dskmtsd@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
fpga: zynq-fpga: Remove redundant dev_err() 2026-07-23T04:45:58+00:00 Pan Chuang panchuang@vivo.com 2026-07-13T13:22:36+00:00 2c972f03ccdda4fe9df4833056c5b4bfd953a61c Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in devm_request_*_irq()"), devm_request_irq() automatically logs detailed error messages on failure. Remove the now-redundant driver-specific dev_err() calls. Signed-off-by: Pan Chuang <panchuang@vivo.com> Reviewed-by: Michal Simek <michal.simek@amd.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260713132237.370272-1-panchuang@vivo.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
Since commit 55b48e23f5c4 ("genirq/devres: Add error handling in
devm_request_*_irq()"), devm_request_irq() automatically logs
detailed error messages on failure. Remove the now-redundant
driver-specific dev_err() calls.

Signed-off-by: Pan Chuang <panchuang@vivo.com>
Reviewed-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260713132237.370272-1-panchuang@vivo.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
fpga: dfl-fme-perf: Use sysfs_emit() for cpumask show 2026-07-22T19:38:37+00:00 Yury Norov ynorov@nvidia.com 2026-07-02T15:47:19+00:00 4f984fbb7078d279ee096a944ea583470297d8dd cpumask_show() is a sysfs show callback. Use sysfs_emit() and cpumask_pr_args() to emit the mask. This prepares for removing cpumap_print_to_pagebuf(). Signed-off-by: Yury Norov <ynorov@nvidia.com> 
cpumask_show() is a sysfs show callback. Use sysfs_emit() and
cpumask_pr_args() to emit the mask.

This prepares for removing cpumap_print_to_pagebuf().

Signed-off-by: Yury Norov <ynorov@nvidia.com>
fpga: dfl: fme: add error handling 2026-07-07T03:39:04+00:00 Griffin Kroah-Hartman griffin@kroah.com 2026-07-06T14:58:21+00:00 b5ba63e247075087ab8a6a087622c762dc4172e9 Add error handling to devm_kasprint in fme_perf_pmu_register(). Assisted-by: gkh_clanker_2000 Fixes: 724142f8c42a ("fpga: dfl: fme: add performance reporting support") Cc: stable@kernel.org Cc: Xu Yilun <yilun.xu@intel.com> Cc: Tom Rix <trix@redhat.com> Cc: Moritz Fischer <mdf@kernel.org> Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [ Yilun: Fix stable tag, add Fixes tag ] Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/2026070620-unwired-clay-f6cc@gregkh Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
Add error handling to devm_kasprint in fme_perf_pmu_register().

Assisted-by: gkh_clanker_2000
Fixes: 724142f8c42a ("fpga: dfl: fme: add performance reporting support")
Cc: stable@kernel.org
Cc: Xu Yilun <yilun.xu@intel.com>
Cc: Tom Rix <trix@redhat.com>
Cc: Moritz Fischer <mdf@kernel.org>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Yilun: Fix stable tag, add Fixes tag ]
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/2026070620-unwired-clay-f6cc@gregkh
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
fpga: stratix10-soc: Fix SVC mailbox handling during reconfiguration 2026-07-07T03:16:59+00:00 Tien Sung Ang tien.sung.ang@altera.com 2026-06-30T06:57:19+00:00 c14a8b15c87b49efc3ef898cec8ac7c30336a080 Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration. Do not call stratix10_svc_done() at the end of write_init() on success, so the SVC session remains active through write() and write_complete(). Call stratix10_svc_done() on failure in write_init() and write() so the shared SVC mailbox is released when reconfiguration aborts, allowing coexistence with other SVC clients such as soc64-hwmon. Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver") Cc: stable@vger.kernel.org # 5.1+ Signed-off-by: Tien Sung Ang <tien.sung.ang@altera.com> Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
Fix incorrect stratix10_svc_done() usage during FPGA reconfiguration.

Do not call stratix10_svc_done() at the end of write_init() on success, so
the SVC session remains active through write() and write_complete(). Call
stratix10_svc_done() on failure in write_init() and write() so the shared
SVC mailbox is released when reconfiguration aborts, allowing coexistence
with other SVC clients such as soc64-hwmon.

Fixes: e7eef1d7633a ("fpga: add intel stratix10 soc fpga manager driver")
Cc: stable@vger.kernel.org # 5.1+
Signed-off-by: Tien Sung Ang <tien.sung.ang@altera.com>
Signed-off-by: Tze Yee Ng <tze.yee.ng@altera.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/8768ce3260489c9febdfce08e27d03f5f5ed9c33.1782801986.git.tze.yee.ng@altera.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
fpga: xilinx-pr-decoupler: Use devm_clk_get_prepared() 2026-07-07T03:13:23+00:00 Michal Simek michal.simek@amd.com 2026-06-23T09:01:27+00:00 08303f16480e24705dc4ffc7f2d89c2afbd33a58 The driver keeps the "aclk" clock prepared but disabled in its idle state, toggling only the atomic clk_enable()/clk_disable() around register accesses in the bridge enable_set/enable_show callbacks. At probe time this was open-coded as clk_prepare_enable() immediately followed by clk_disable(), leaving the clock prepared, with a matching clk_unprepare() in the error path and in remove(). devm_clk_get_prepared() expresses exactly this: it gets and prepares the clock and unprepares it automatically on driver detach. Use it to drop the manual prepare/disable dance, the error-path unprepare, and the now-empty clock teardown in remove(). Signed-off-by: Michal Simek <michal.simek@amd.com> Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/8ca8ee5ba720b608a41f842d2b743302e5500ad0.1782205286.git.michal.simek@amd.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
The driver keeps the "aclk" clock prepared but disabled in its idle
state, toggling only the atomic clk_enable()/clk_disable() around
register accesses in the bridge enable_set/enable_show callbacks.

At probe time this was open-coded as clk_prepare_enable() immediately
followed by clk_disable(), leaving the clock prepared, with a matching
clk_unprepare() in the error path and in remove().

devm_clk_get_prepared() expresses exactly this: it gets and prepares the
clock and unprepares it automatically on driver detach.

Use it to drop the manual prepare/disable dance, the error-path
unprepare, and the now-empty clock teardown in remove().

Signed-off-by: Michal Simek <michal.simek@amd.com>
Reviewed-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/8ca8ee5ba720b608a41f842d2b743302e5500ad0.1782205286.git.michal.simek@amd.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03T05:38:17+00:00 Uwe Kleine-König (The Capable Hub) u.kleine-koenig@baylibre.com 2026-06-30T09:24:36+00:00 995832b2cebe6969d1b42635db698803ee31294d Replace the #include of <linux/mod_devicetable.h> by the more specific <linux/device-id/*.h> where applicable. For most cases the include can be dropped completely, only a few drivers need one or two headers added. Acked-by: Danilo Krummrich <dakr@kernel.org> Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp> Acked-by: Bjorn Helgaas <bhelgaas@google.com> Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com> 
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header() 2026-06-01T04:29:40+00:00 Sebastian Alba Vives sebasjosue84@gmail.com 2026-05-18T19:07:42+00:00 43a1974da6bc7ce8f4d1dc1d03d56997428c29c3 mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL. Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com> Reviewed-by: Xu Yilun <yilun.xu@intel.com> Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com> 
mpf_ops_parse_header() reads header_size from the bitstream at
MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression
*(buf + header_size - 1) reads one byte before the buffer start.

Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core
guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET.
The only real gap is the zero header_size case, which cannot be
resolved by providing a larger buffer, so return -EINVAL.

Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>