driver core: generalize driver_override infrastructure

drivers/base/dd.c +7 -0

+	new = kstrndup(s, len, GFP_KERNEL);
+	if (!new)
+		return -ENOMEM;
+
+	spin_lock(&dev->driver_override.lock);
+	old = dev->driver_override.name;
+	if (cp != s) {

Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices.

All of them seem to be prone to the bug described in [1].

While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall.

Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally.

In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and a helper, DEVICE_ATTR_DRIVER_OVERRIDE(), to declare the corresponding sysfs store() and show() callbacks.

Until all busses have migrated, keep driver_set_override() in place.

Note that we can't use the device lock for the reasons described in [2].

Link https://bugzilla.kernel.org/show_bug.cgi?id=220789 [1]

Link https://lore.kernel.org/driver-core/[email protected]/ [2] open here

Co-developed-by Gui-Dong Han <[email protected]>

Signed-off-by Gui-Dong Han <[email protected]>

Signed-off-by Danilo Krummrich <[email protected]>

---
 drivers/base/bus.c         | 43 ++++++++++++++++++++++++++-
 drivers/base/core.c        |  2 ++
 drivers/base/dd.c          | 60 ++++++++++++++++++++++++++++++++++++++
 include/linux/device.h     | 54 ++++++++++++++++++++++++++++++++++
 include/linux/device/bus.h |  4 +++
 5 files changed, 162 insertions(+), 1 deletion(-)

drivers/base/bus.c +42 -1

index bb61d8adbab1..c734e7162b74 100644
@@ -504,6 +504,36 @@ int bus_for_each_drv(const struct bus_type *bus, struct device_driver *start,
 }
 EXPORT_SYMBOL_GPL(bus_for_each_drv);
 
+static ssize_t driver_override_store(struct device *dev,
+                                    struct device_attribute *attr,
+                                    const char *buf, size_t count)
+{
+       int ret;
+
+       ret = __device_set_driver_override(dev, buf, count);
+       if (ret)
+               return ret;
+
+       return count;
+}
+
+static ssize_t driver_override_show(struct device *dev,
+                                   struct device_attribute *attr, char *buf)
+{
+       guard(spinlock)(&dev->driver_override.lock);
+       return sysfs_emit(buf, "%s\n", dev->driver_override.name);
+}
+static DEVICE_ATTR_RW(driver_override);
+
+static struct attribute *driver_override_dev_attrs[] = {
+       &dev_attr_driver_override.attr,
+       NULL,
+};
+
+static const struct attribute_group driver_override_dev_group = {
+       .attrs = driver_override_dev_attrs,
+};
+
 /**
  * bus_add_device - add device to bus
  * @dev: device being added

@@ -537,9 +567,15 @@ int bus_add_device(struct device *dev)
        if (error)
                goto out_put;
 
+       if (sp->bus->driver_override) {
+               error = device_add_group(dev, &driver_override_dev_group);
+               if (error)
+                       goto out_groups;
+       }
+
        error = sysfs_create_link(&sp->devices_kset->kobj, &dev->kobj, dev_name(dev));
        if (error)
-               goto out_groups;
+               goto out_override;
 
        error = sysfs_create_link(&dev->kobj, &sp->subsys.kobj, "subsystem");
        if (error)

@@ -550,6 +586,9 @@ int bus_add_device(struct device *dev)
 
 out_subsys:
        sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
+out_override:
+       if (dev->bus->driver_override)
+               device_remove_group(dev, &driver_override_dev_group);
 out_groups:
        device_remove_groups(dev, sp->bus->dev_groups);
 out_put:

@@ -607,6 +646,8 @@ void bus_remove_device(struct device *dev)
 
        sysfs_remove_link(&dev->kobj, "subsystem");
        sysfs_remove_link(&sp->devices_kset->kobj, dev_name(dev));
+       if (dev->bus->driver_override)
+               device_remove_group(dev, &driver_override_dev_group);
        device_remove_groups(dev, dev->bus->dev_groups);
        if (klist_node_attached(&dev->p->knode_bus))
                klist_del(&dev->p->knode_bus);

drivers/base/core.c +2 -0

index 791f9e444df8..09b98f02f559 100644
@@ -2556,6 +2556,7 @@ static void device_release(struct kobject *kobj)
        devres_release_all(dev);
 
        kfree(dev->dma_range_map);
+       kfree(dev->driver_override.name);
 
        if (dev->release)
                dev->release(dev);

@@ -3159,6 +3160,7 @@ void device_initialize(struct device *dev)
        kobject_init(&dev->kobj, &device_ktype);
        INIT_LIST_HEAD(&dev->dma_pools);
        mutex_init(&dev->mutex);
+       spin_lock_init(&dev->driver_override.lock);
        lockdep_set_novalidate_class(&dev->mutex);
        spin_lock_init(&dev->devres_lock);
        INIT_LIST_HEAD(&dev->devres_head);

drivers/base/dd.c +60 -0

index 0354f209529c..697e36e63cab 100644
@@ -381,6 +381,66 @@ static void __exit deferred_probe_exit(void)
 }
 __exitcall(deferred_probe_exit);
 
+int __device_set_driver_override(struct device *dev, const char *s, size_t len)
+{
+       const char *new, *old;
+       char *cp;
+
+       if (!s)
+               return -EINVAL;
+
+       /*
+        * The stored value will be used in sysfs show callback (sysfs_emit()),
+        * which has a length limit of PAGE_SIZE and adds a trailing newline.
+        * Thus we can store one character less to avoid truncation during sysfs
+        * show.
+        */
+       if (len >= (PAGE_SIZE - 1))
+               return -EINVAL;
+
+       /*
+        * Compute the real length of the string in case userspace sends us a
+        * bunch of \0 characters like python likes to do.
+        */
+       len = strlen(s);
+
+       if (!len) {
+               /* Empty string passed - clear override */
+               spin_lock(&dev->driver_override.lock);
+               old = dev->driver_override.name;
+               dev->driver_override.name = NULL;
+               spin_unlock(&dev->driver_override.lock);
+               kfree(old);
+
+               return 0;
+       }
+
+       cp = strnchr(s, len, '\n');
+       if (cp)
+               len = cp - s;
+
+       new = kstrndup(s, len, GFP_KERNEL);
+       if (!new)
+               return -ENOMEM;
+
+       spin_lock(&dev->driver_override.lock);
+       old = dev->driver_override.name;
+       if (cp != s) {
+               dev->driver_override.name = new;
+               spin_unlock(&dev->driver_override.lock);
+       } else {
+               /* "\n" passed - clear override */
+               dev->driver_override.name = NULL;
+               spin_unlock(&dev->driver_override.lock);
+
+               kfree(new);
+       }
+       kfree(old);
+
+       return 0;
+}
+EXPORT_SYMBOL_GPL(__device_set_driver_override);
+
 /**
  * device_is_bound() - Check if device is bound to a driver
  * @dev: device to check

include/linux/device.h +54 -0

index 0be95294b6e6..e65d564f01cd 100644
@@ -483,6 +483,8 @@ struct device_physical_location {
  *             on.  This shrinks the "Board Support Packages" (BSPs) and
  *             minimizes board-specific #ifdefs in drivers.
  * @driver_data: Private pointer for driver specific info.
+ * @driver_override: Driver name to force a match.  Do not touch directly; use
+ *                  device_set_driver_override() instead.
  * @links:     Links to suppliers and consumers of this device.
  * @power:     For device power management.
  *             See Documentation/driver-api/pm/devices.rst for details.

@@ -576,6 +578,10 @@ struct device {
                                           core doesn't touch it */
        void            *driver_data;   /* Driver data, set and get with
                                           dev_set_drvdata/dev_get_drvdata */
+       struct {
+               const char      *name;
+               spinlock_t      lock;
+       } driver_override;
        struct mutex            mutex;  /* mutex to synchronize calls to
                                         * its driver.
                                         */

@@ -701,6 +707,54 @@ struct device_link {
 
 #define kobj_to_dev(__kobj)    container_of_const(__kobj, struct device, kobj)
 
+int __device_set_driver_override(struct device *dev, const char *s, size_t len);
+
+/**
+ * device_set_driver_override() - Helper to set or clear driver override.
+ * @dev: Device to change
+ * @s: NUL-terminated string, new driver name to force a match, pass empty
+ *     string to clear it ("" or "\n", where the latter is only for sysfs
+ *     interface).
+ *
+ * Helper to set or clear driver override of a device.
+ *
+ * Returns: 0 on success or a negative error code on failure.
+ */
+static inline int device_set_driver_override(struct device *dev, const char *s)
+{
+       return __device_set_driver_override(dev, s, s ? strlen(s) : 0);
+}
+
+/**
+ * device_has_driver_override() - Check if a driver override has been set.
+ * @dev: device to check
+ *
+ * Returns true if a driver override has been set for this device.
+ */
+static inline bool device_has_driver_override(struct device *dev)
+{
+       guard(spinlock)(&dev->driver_override.lock);
+       return !!dev->driver_override.name;
+}
+
+/**
+ * device_match_driver_override() - Match a driver against the device's driver_override.
+ * @dev: device to check
+ * @drv: driver to match against
+ *
+ * Returns > 0 if a driver override is set and matches the given driver, 0 if a
+ * driver override is set but does not match, or < 0 if a driver override is not
+ * set at all.
+ */
+static inline int device_match_driver_override(struct device *dev,
+                                              const struct device_driver *drv)
+{
+       guard(spinlock)(&dev->driver_override.lock);
+       if (dev->driver_override.name)
+               return !strcmp(dev->driver_override.name, drv->name);
+       return -1;
+}
+
 /**
  * device_iommu_mapped - Returns true when the device DMA is translated
  *                      by an IOMMU

include/linux/device/bus.h +4 -1

index 99c3c83ea520..cda597812324 100644
@@ -63,6 +63,9 @@ struct fwnode_handle;
  *                     this bus.
  * @pm:                Power management operations of this bus, callback the specific
  *             device driver's pm-ops.
+ * @driver_override:   Set to true if this bus supports the driver_override
+ *                     mechanism, which allows userspace to force a specific
+ *                     driver to bind to a device via a sysfs attribute.
  * @need_parent_lock:  When probing or removing a device on this bus, the
  *                     device core should lock the device's parent.
  *

@@ -104,6 +107,7 @@ struct bus_type {
 
        const struct dev_pm_ops *pm;
 
+       bool driver_override;
        bool need_parent_lock;
 };
 
--

2.53.0

Documentation/driver-api/driver-model/binding.rst +36 -0

+Driver Override
+~~~~~~~~~~~~~~~
+
+Userspace may override the standard matching by writing a driver name to
+a device's ``driver_override`` sysfs attribute.  When set, only a driver
+whose name matches the override will be considered during binding.  This
+bypasses all bus-specific matching (OF, ACPI, ID tables, etc.).
+
+The override may be cleared by writing an empty string, which returns
+the device to standard matching rules.  Writing to ``driver_override``
+does not automatically unbind the device from its current driver or
+make any attempt to load the specified driver.
+
+Buses opt into this mechanism by setting the ``driver_override`` flag in
+their ``struct bus_type``::
+
+  const struct bus_type example_bus_type = {
+      ...
+      .driver_override = true,
+  };
+
+When the flag is set, the driver core automatically creates the
+``driver_override`` sysfs attribute for every device on that bus.
+
+The bus's ``match()`` callback should check the override before performing
+its own matching, using ``device_match_driver_override()``::
+
+  static int example_match(struct device *dev, const struct device_driver *drv)
+  {
+      int ret;
+
+      ret = device_match_driver_override(dev, drv);
+      if (ret >= 0)
+          return ret;
+
+      /* Fall through to bus-specific matching... */

Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).

Fixes 8412b410fa5e ("hwmon: Support ADI Fan Control IP")

Signed-off-by Danilo Krummrich <[email protected]>

---

 drivers/hwmon/axi-fan-control.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

drivers/hwmon/axi-fan-control.c +1 -1

index b7bb325c3ad9..01590dfa55e6 100644
@@ -507,7 +507,7 @@ static int axi_fan_control_probe(struct platform_device *pdev)
  	ret = devm_request_threaded_irq(&pdev->dev, ctl->irq, NULL,
  					axi_fan_control_irq_handler,
  					IRQF_ONESHOT | IRQF_TRIGGER_HIGH,
-					pdev->driver_override, ctl);
+					NULL, ctl);
  	if (ret)
  		return dev_err_probe(&pdev->dev, ret,
  				     "failed to request an irq\n");

Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).

Fixes 8412b410fa5e ("hwmon: Support ADI Fan Control IP")

Signed-off-by Danilo Krummrich <[email protected]>

Reviewed-by Nuno Sá <[email protected]>

Quoted 7 lines · Danilo Krummrich

Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).

Fixes 8412b410fa5e ("hwmon: Support ADI Fan Control IP")

Signed-off-by Danilo Krummrich <[email protected]>

Reviewed-by Nuno Sá <[email protected]>

Applied.

Quoted 9 lines · Guenter Roeck

Quoted 7 lines · Danilo Krummrich

Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).

Fixes 8412b410fa5e ("hwmon: Support ADI Fan Control IP")

Signed-off-by Danilo Krummrich <[email protected]>

Reviewed-by Nuno Sá <[email protected]>

Quoted 1 line

Applied.

I need this patch in the driver-core tree, otherwise I can't land patch 4 of this series [1]. :(

Any chance you can drop it from your tree?

[1] https://lore.kernel.org/driver-core/[email protected]/

Quoted 15 lines · Danilo Krummrich

Quoted 10 lines · Guenter Roeck

Quoted 7 lines · Danilo Krummrich

Do not use driver_override as IRQ name, as it is not guaranteed to point to a valid string; use NULL instead (which makes the devm IRQ helpers use dev_name()).

Fixes 8412b410fa5e ("hwmon: Support ADI Fan Control IP")

Signed-off-by Danilo Krummrich <[email protected]>

Reviewed-by Nuno Sá <[email protected]>

Applied.

I need this patch in the driver-core tree, otherwise I can't land patch 4 of this series [1]. :(

Quoted 4 lines

Any chance you can drop it from your tree?

[1] https://lore.kernel.org/driver-core/[email protected]/

Sure, I'll drop it. Please add

Acked-by Guenter Roeck <[email protected]>

sound/soc/samsung/i2s.c +1 -2

-	pdev_sec->driver_override = kstrdup("samsung-i2s", GFP_KERNEL);
-	if (!pdev_sec->driver_override) {
+	ret = device_set_driver_override(&pdev_sec->dev, "samsung

 arch/sh/drivers/platform_early.c |  6 ++++--
 drivers/clk/imx/clk-scu.c        |  3 +--
 drivers/slimbus/qcom-ngd-ctrl.c  |  6 ++----
 sound/soc/samsung/i2s.c          |  6 +++---

Quoted 4 lines · Danilo Krummrich

 arch/sh/drivers/platform_early.c |  6 ++++--
 drivers/clk/imx/clk-scu.c        |  3 +--
 drivers/slimbus/qcom-ngd-ctrl.c  |  6 ++----
 sound/soc/samsung/i2s.c          |  6 +++---

Some ACKs would be appreciated. :)

arch/sh/drivers/platform_early.c +1 -0

index 143747c45206..3cd17bb0be67 100644
@@ -25,10 +25,12 @@ static int platform_match(struct device *dev, struct device_driver *drv)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct platform_driver *pdrv = to_platform_driver(drv);
+	int ret;

(Cc: Bartosz)

Quoted 9 lines · Danilo Krummrich

arch/sh/drivers/platform_early.c +1 -0

index 143747c45206..3cd17bb0be67 100644
@@ -25,10 +25,12 @@ static int platform_match(struct device *dev, struct device_driver *drv)
 {
 	struct platform_device *pdev = to_platform_device(dev);
 	struct platform_driver *pdrv = to_platform_driver(drv);
+	int ret;

arch/sh/drivers/platform_early.c static int platform_match(struct device *dev, struct device_driver *drv) · line 36

Quoted 10 lines

arch/sh/drivers/platform_early.c +3 -2

 
 	/* When driver_override is set, only bind to the matching driver */
-	if (pdev->driver_override)
-		return !strcmp(pdev->driver_override, drv->name);
+	ret = device_match_driver_override(dev, drv);
+	if (ret >= 0)
+		return ret;
 
 	/* Then try to match against the id table */
 	if (pdrv->id_table)

I was just about to pick up this series, but then noticed that checking for driver_override in the platform_early case doesn't make sense in the first place and was accidentally added when the platform_match() callback was copied over in commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh").

Thus, I'm going to drop this hunk and add in the following patch; please let me know if there are any concerns.

commit 39cae4095efda4b00b436c0fc46f21de84128969

Author: Danilo Krummrich <[email protected]>
Date:   Tue Mar 17 00:37:15 2026 +0100

sh: platform_early: remove pdev->driver_override check

In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check.

This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check.

Fixes 507fd01d5333 ("drivers: move the early platform device support to arch/sh")

Signed-off-by Danilo Krummrich <[email protected]>

arch/sh/drivers/platform_early.c +0 -0

index 143747c45206..48ddbc547bd9 100644

Quoted 9 lines · Danilo Krummrich

arch/sh/drivers/platform_early.c +1 -0

index 143747c45206..3cd17bb0be67 100644
@@ -25,10 +25,12 @@ static int platform_match(struct device *dev, struct device_driver *drv)
 {
      struct platform_device *pdev = to_platform_device(dev);
      struct platform_driver *pdrv = to_platform_driver(drv);
+     int ret;

arch/sh/drivers/platform_early.c static int platform_match(struct device *dev, struct device_driver *drv) · line 36

Quoted 10 lines

arch/sh/drivers/platform_early.c +3 -2

 
      /* When driver_override is set, only bind to the matching driver */
-     if (pdev->driver_override)
-             return !strcmp(pdev->driver_override, drv->name);
+     ret = device_match_driver_override(dev, drv);
+     if (ret >= 0)
+             return ret;
 
      /* Then try to match against the id table */
      if (pdrv->id_table)

I was just about to pick up this series, but then noticed that checking for driver_override in the platform_early case doesn't make sense in the first place and was accidentally added when the platform_match() callback was copied over in commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh").

Thus, I'm going to drop this hunk and add in the following patch; please let me know if there are any concerns.

commit 39cae4095efda4b00b436c0fc46f21de84128969

Author: Danilo Krummrich <[email protected]>
Date:   Tue Mar 17 00:37:15 2026 +0100

sh: platform_early: remove pdev->driver_override check

In commit 507fd01d5333 ("drivers: move the early platform device support to arch/sh") platform_match() was copied over to the sh platform_early code, accidentally including the driver_override check.

This check does not make sense for platform_early, as sysfs is not even available in first place at this point in the boot process, hence remove the check.

Fixes 507fd01d5333 ("drivers: move the early platform device support to arch/sh")

Signed-off-by Danilo Krummrich <[email protected]>

arch/sh/drivers/platform_early.c +0 -0

index 143747c45206..48ddbc547bd9 100644

Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices.

All of them seem to be prone to the bug described in [1].

While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall.

Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally.

In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and a helper, DEVICE_ATTR_DRIVER_OVERRIDE(), to declare the corresponding sysfs store() and show() callbacks.

Until all busses have migrated, keep driver_set_override() in place.

Note that we can't use the device lock for the reasons described in [2].

This patch series includes the migration of the platform bus; patches for all other affected busses still need to be extracted as a follow-up of the WIP treewide patch in [3].

[1] https://bugzilla.kernel.org/show_bug.cgi?id=220789
[2] https://lore.kernel.org/driver-core/[email protected]/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/dakr/linux.git/log/?h=driver_override

Changes in v2:
- Drop DEVICE_ATTR_DRIVER_OVERRIDE() and make driver_override a struct bus_type feature instead.
- Add driver_override documentation in .../driver-model/binding.rst.
- Move kfree(dev->driver_override.name) before release().
- hwmon: axi-fan: Use NULL instead of dev_name() in devm_request_threaded_irq().

Danilo Krummrich (4):
driver core: generalize driver_override in struct device
docs: driver-model: document driver_override
hwmon: axi-fan: don't use driver_override as IRQ name driver core: platform: use generic driver_override infrastructure

 .../driver-api/driver-model/binding.rst       | 48 +++++++++++++++
 arch/sh/drivers/platform_early.c              |  6 +-
 drivers/base/bus.c                            | 43 ++++++++++++-
 drivers/base/core.c                           |  2 +
 drivers/base/dd.c                             | 60 +++++++++++++++++++
 drivers/base/platform.c                       | 37 ++----------
 drivers/bus/simple-pm-bus.c                   |  4 +-
 drivers/clk/imx/clk-scu.c                     |  3 +-
 drivers/hwmon/axi-fan-control.c               |  2 +-
 drivers/slimbus/qcom-ngd-ctrl.c               |  6 +-
 include/linux/device.h                        | 54 +++++++++++++++++
 include/linux/device/bus.h                    |  4 ++
 include/linux/platform_device.h               |  5 --
 sound/soc/samsung/i2s.c                       |  6 +-
 14 files changed, 228 insertions(+), 52 deletions(-)

base-commit: 11439c4635edd669ae435eec308f4ab8a0804808 --
2.53.0

Currently, there are 12 busses (including platform and PCI) that duplicate the driver_override logic for their individual devices.

All of them seem to be prone to the bug described in [1].

While this could be solved for every bus individually using a separate lock, solving this in the driver-core generically results in less (and cleaner) changes overall.

Thus, move driver_override to struct device, provide corresponding accessors for busses and handle locking with a separate lock internally.

In particular, add device_set_driver_override(), device_has_driver_override(), device_match_driver_override() and a helper, DEVICE_ATTR_DRIVER_OVERRIDE(), to declare the corresponding sysfs store() and show() callbacks.

Until all busses have migrated, keep driver_set_override() in place.

Note that we can't use the device lock for the reasons described in [2].

This patch series includes the migration of the platform bus; patches for all other affected busses still need to be extracted as a follow-up of the WIP treewide patch in [3].

[1] https://bugzilla.kernel.org/show_bug.cgi?id=220789
[2] https://lore.kernel.org/driver-core/[email protected]/
[3] https://git.kernel.org/pub/scm/linux/kernel/git/dakr/linux.git/log/?h=driver_override

driver core: generalize driver_override in struct device

docs: driver-model: document driver_override
hwmon: axi-fan: don't use driver_override as IRQ name

driver core: platform: use generic driver_override infrastructure