kernel/linux.git/drivers/fpga, branch v7.2-rc1

fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()

2026-06-01T04:29:40+00:00

mpf_ops_parse_header() reads header_size from the bitstream at MPF_HEADER_SIZE_OFFSET (24). When header_size is zero, the expression *(buf + header_size - 1) reads one byte before the buffer start. Since initial_header_size is set to 71 in mpf_ops, the fpga-mgr core guarantees the buffer is large enough to reach MPF_HEADER_SIZE_OFFSET. The only real gap is the zero header_size case, which cannot be resolved by providing a larger buffer, so return -EINVAL. Fixes: 5f8d4a900830 ("fpga: microchip-spi: add Microchip MPF FPGA manager") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260518190742.61426-4-sebasjosue84@gmail.com Signed-off-by: Xu Yilun

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

2026-06-01T04:29:13+00:00

afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX. Fixes: fa8dda1edef9 ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260518190742.61426-3-sebasjosue84@gmail.com Signed-off-by: Xu Yilun

fpga: dfl: add bounds check in dfh_get_param_size()

2026-06-01T04:28:33+00:00

dfh_get_param_size() can return a parameter size larger than the feature region because the loop bounds check is evaluated before incrementing size. If the EOP (End of Parameters) bit is set in the same iteration, the inflated size is returned without re-validation against max. This can cause create_feature_instance() to call memcpy_fromio() with a size exceeding the ioremap'd region when a malicious FPGA device provides crafted DFHv1 parameter headers. Add a bounds check after the size increment to ensure the accumulated size never exceeds the feature boundary. Fixes: 4747ab89b4a6 ("fpga: dfl: add basic support for DFHv1") Cc: stable@vger.kernel.org Signed-off-by: Sebastian Alba Vives Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260518190742.61426-2-sebasjosue84@gmail.com Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: simplify with spi_get_device_match_data()

2026-05-11T15:28:28+00:00

Use spi_get_device_match_data() helper to simplify a bit the driver. Signed-off-by: Andy Shevchenko Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260510090556.1582900-1-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: Don't use "proxy" headers

2026-05-11T15:28:18+00:00

Update header inclusions to follow IWYU (Include What You Use) principle. Signed-off-by: Andy Shevchenko Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260508082716.1156192-4-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: Drop of_match_ptr() protection

2026-05-11T15:28:09+00:00

Limiting the scope of devicetree support to CONFIG_OF prevents use of this driver with ACPI via PRP0001. Drop the dependency. Signed-off-by: Andy Shevchenko Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260508082716.1156192-3-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun

fpga: lattice-sysconfig-spi: Fix the terminator entries in ID tables

2026-05-11T15:27:54+00:00

The whole purpose of the terminator entry is to be the last one. The trailing comma makes this statement prone to failure. On top of that the style is used for the entries is unusual. Standardize this all by moving terminator entries to their own lines and drop trailing commas. Signed-off-by: Andy Shevchenko Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260508082716.1156192-2-andriy.shevchenko@linux.intel.com Signed-off-by: Xu Yilun

fpga-mgr: Add Efinix SPI programming driver

2026-05-04T11:30:18+00:00

Add a new driver for loading binary firmware to configuration RAM using "SPI passive mode" on Efinix FPGAs. Efinix passive SPI configuration requires chip select to remain asserted from reset until the complete bitstream and trailing idle clocks have been transferred, so the driver keeps CS active with cs_change and locks the SPI bus for the duration of configuration. Signed-off-by: Ian Dannapel Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260416144237.373852-4-iansdannapel@gmail.com Signed-off-by: Xu Yilun

fpga: ts73xx-fpga: add OF match table for device tree probing

2026-05-04T11:28:18+00:00

The ts73xx-fpga driver currently only matches by platform device name, which prevents it from being probed when the device is described in a device tree. Add an of_device_id table so the driver can match against the "technologic,ts7300-fpga" compatible string. The TS-7350 and TS-7390 use different FPGAs with a different programming interface, so while the driver is named "ts73xx-fpga", it doesn't apply to them. Signed-off-by: Phil Pemberton Reviewed-by: Florian Fainelli Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260409122016.3940462-3-philpem@philpem.me.uk Signed-off-by: Xu Yilun

fpga: region: fix use-after-free in child_regions_with_firmware()

2026-05-04T11:27:05+00:00

Move of_node_put(child_region) after the error print to avoid accessing freed memory when pr_err() references child_region. Fixes: 0fa20cdfcc1f ("fpga: fpga-region: device tree control for FPGA") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang [ Yilun: Fix the Fixes tag ] Reviewed-by: Xu Yilun Link: https://lore.kernel.org/r/20260408154534.404327-1-vulab@iscas.ac.cn Signed-off-by: Xu Yilun