Add Maili platform bindings for SCM, IMEM, AOSS, and PMIC GLINK. Add
Shikra IMEM, RPM SMD, LLCC, and UBWC support, including handling for
firmware-configured LLCC ECC interrupts.
Add the generic Peripheral Authentication Service with SCM and OP-TEE
backends, and migrate the MSM DRM and IPA drivers to it.
Add SCM SMC-call tracepoints and configurable minidump delivery through
always-on SRAM. Correct SCM download-mode pointer ordering and improve
download-mode probe diagnostics.
Rework the UBWC configuration database and add Milos and Shikra
configuration. Add protection-domain mappings for SA8775P and QCS8300,
support newer ICE versions, Hawi subsystem statistics, and SDM850
identification.
Simplify Qualcomm SoC Kconfig selection and architecture dependencies.
Use managed resources in EBI2 and RPMh RSC probe paths to correct cleanup
on failures.
-----BEGIN PGP SIGNATURE-----
iQJCBAABCgAsFiEEBd4DzF816k8JZtUlCx85Pw2ZrcUFAmprfkkOHGJqb3JuQGty
eW8uc2UACgkQCx85Pw2ZrcUUVQ/+NufSVHC2E2W/ZTTVGAWCoB9rvNhPaPCoYrFY
WsefQzhdCk54rzzb1DsVyj/Lh/nKVApdH495TWgWrUpRuq6w0xjHkYKklQNp7Hqt
Lr2GNx90mvQDgvj1RNa++oI8dhpeEv/d7as0xrwQibi85mw/F/jGpHdw7VnfcRF5
XcTIIMtA+M5KWxmTBnwH+pgB5aaEDUED82mifcdOeNgI7l6A20jBdT0MJ8SZBMff
wTMbuSOOEJlNjtcGtFm4EDdpVsoL1s4vAt0PGyVPpGvT2WVE1aGffPS4dMv4kNDU
xFQsh6ST+J25W9r4zib5HB6FivgKcEvkMmZb4ca/bcJGxAEb163Yyay8Z+sz4kNV
qEHjbm7zSfUiKELsFzzaulnLhEghZ6R/CQua+XdXq5J3QgKocqJ3m/a2Mm5rRXHv
XUE+aEy/cJdxxhqan8BZ8Ihn1SkMRCDNWTVopi4H12RtIfXBII/9LEWW8fp66GlW
55TYLjTrdA5V56/NHmm1fsHDP7KojHUTipg9WL07OL/LggJExOvBpBZIoCQPUOR7
bB6jlf8bu00Ecur091+HkFD1ePcT0DTO+1tHdpG2mv27WXVVsFAZmIDp3G64cEn3
vZOVNDEZBjyE/MMqKwd+W0ERERoQnW+YYdtigN5tWmk/+M+/11D/10x6FPr1Q+38
OdidhsU=
=+KlS
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyRQsACgkQmmx57+YA
GNkjJQ//RfK/MpMrLOk4IPiA/+Ek93eXgVqfcXwUTAhg23HddOkOgZugVLi//xv0
flRkb/XbOc6aYOTIdmR6thfFOMkUbRxQl5EqSypNEWsrjsiVKbxmqH801BPPgFRw
KzbmqNNe1O0koJ+p7b6g9kwXzEyF9iyBqjZqfWfbayqcznI1DC8x2Hs8ieBQvsKj
7igqDpLE2XhRuBhIRxOmKb17nvYaAS0/Jxa97Mhic7CEyNmC0EWUWXwJzWDJSBSv
253kTU6JVXcm7BI33lIvkAZbUwMo8wtz6hApJPj+JCELXNho9CTondOMhQ+lLZmx
kZ3yJQRGQS41+nb6BVfVJkqfkErnxRM18sYbMzpEk79mnoN6OtomMypNQozq5U8/
qhA6sgygjL/jI62RCUTmiFhTXgkBXRw/yDiAUihaYWmCExUc/TCXw2Yb1FNk9m5m
k9l4F9ynH1DoFRCtzOzqtO72ZqBnbuELnYZ/AA/mw3bFyHAKeLfmQpREqWfDcJCO
g3me14uHHdWaMcoAICOBv9Obx1blxXU3vx6Fvm7ZJU4yygWvM/8BrroViHRGtUOb
a8vggrcangB6JxMMX3AygpYu0kIBILRXUvsQccavcNkf5p1p0nQhKEgdHpD4n72r
f70dhESEmIOLAxUI+ByQIh6deUJCPbOa/RE4F8QRaoTz8CcZKFc=
=5310
-----END PGP SIGNATURE-----
Merge tag 'qcom-drivers-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
Qualcomm driver updates for v7.3
Add Maili platform bindings for SCM, IMEM, AOSS, and PMIC GLINK. Add
Shikra IMEM, RPM SMD, LLCC, and UBWC support, including handling for
firmware-configured LLCC ECC interrupts.
Add the generic Peripheral Authentication Service with SCM and OP-TEE
backends, and migrate the MSM DRM and IPA drivers to it.
Add SCM SMC-call tracepoints and configurable minidump delivery through
always-on SRAM. Correct SCM download-mode pointer ordering and improve
download-mode probe diagnostics.
Rework the UBWC configuration database and add Milos and Shikra
configuration. Add protection-domain mappings for SA8775P and QCS8300,
support newer ICE versions, Hawi subsystem statistics, and SDM850
identification.
Simplify Qualcomm SoC Kconfig selection and architecture dependencies.
Use managed resources in EBI2 and RPMh RSC probe paths to correct cleanup
on failures.
* tag 'qcom-drivers-for-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux: (44 commits)
soc: qcom: llcc: Skip ECC interrupt setup on Shikra, pre-configured by DSF
dt-bindings: sram: Document qcom,shikra-imem compatible
net: ipa: Switch to generic PAS TZ APIs
firmware: qcom: scm: Add minidump SRAM support
firmware: qcom: scm: use dev_err_probe() for dload address failure
firmware: qcom: scm: Fix missing smp_load_acquire()
dt-bindings: firmware: qcom,scm: Add minidump SRAM property
drm/msm: Switch to generic PAS TZ APIs
bus: qcom-ebi2: use managed resources for clocks and children
soc: qcom: rpmh-rsc: manage PM notifiers with devres
firmware: qcom: scm: Allow QSEECOM on Honor Magicbook Art 14
firmware: qcom: scm: instrument SMC call path with tracepoints
firmware: qcom: scm: add trace events for the SMC call interface
soc: qcom: Avoid SCM and SPM for cpuidle drivers
soc: qcom: Make important drivers default
soc: qcom: Restrict drivers per ARM/ARM64
soc: qcom: Hide all drivers behind selectable menu
MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service
firmware: qcom: Add a PAS TEE service
firmware: qcom_scm: Migrate to generic PAS service
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Just the one patch adding MODULE_DEVICE_TABLE() where it was previously missing.
-----BEGIN PGP SIGNATURE-----
iJIEABYKADoWIQSoUT1x3bOSX/nAa8ajM9GZTrjhpgUCanGCyhwcYW5kcmV3QGNv
ZGVjb25zdHJ1Y3QuY29tLmF1AAoJEKMz0ZlOuOGmaa0BAKHxu8/ZK3YwE6ATIE3V
pINjZsNdq8LgFRdJItJC2CfCAQDTuKHH1Dqe9xgmFUGqCWIRlnMra6dju6IA1u9+
h4P8Aw==
=UBxv
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyQzYACgkQmmx57+YA
GNl/Kg/+P6332RgWXXMcsEwV4mQk8DUiJUEU4f353MbOs4l85nvc93Jq6MOKYKdL
pHMyvTzFxZKHNMqaRiUEmFuBi/Dthcoe+TOdo6ZaIdb0wOzNbRXIoaoNP4vZUz5u
iskOrt1BX9C7o1GV7LQLlW8jsQGctbLx6MgA2tnEOgIeetLR3QPWSqpUgY9Mczbs
MsXpYPYe56T85Sb4rp3WxdpuIcIRkipv0Ks7E4ZPsZcfBjkM6nVKqielELWCayMM
oGyJvn2OnshbBjynS13jWBdxRlE9+3d2C5BVYdvY40KyaDSOEBYJH5RnD6GLqYwE
kFCh38yz21n+9b9AHf5vWZc7xCX6YCke3H80oDluOuw+D0m5zfqA/3TnmJsFHcwh
fycuA279euiNZaKupkne3opSWtqBzmnrgoRKsZT193UsTxbnIrJgEFa8vE9yj/YY
QlCuHQMbXVxy3jAn8jLJ4wTZWTK1G/2D535n3hrNYiQ9QozqSEdoiMjIMZCyRhWh
rd/cMYYhDQeS17LtjbDdRter0SqANYWz0hTM6SVs+ae63Dwm+z1fdhd8kWcvmigq
GIples8TFTIQp7tfQ5vSOYAsWJsZ6DpQ+yMbFkGvLLc19Dd2X7Asgxo0gTGe0VDc
zp2yUZNEI3jKcew5kOIRCFk5v73diIooS+5kLQ/efP7DYiSBxMI=
=K/cr
-----END PGP SIGNATURE-----
Merge tag 'aspeed-7.3-drivers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux into soc/drivers
aspeed: First batch of driver changes for 7.3
Just the one patch adding MODULE_DEVICE_TABLE() where it was previously missing.
* tag 'aspeed-7.3-drivers-0' of https://git.kernel.org/pub/scm/linux/kernel/git/bmc/linux:
soc: aspeed: add missing MODULE_DEVICE_TABLE()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Various small fixes for multi-socket devices, redundant error prints, a
Kconfig dependency as well as a patch to remove FUSE data as an entropy
source.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEiOrDCAFJzPfAjcif3SOs138+s6EFAmpvcScACgkQ3SOs138+
s6HPdA/9GJuNIlC5yerd/tZUdgTRUCRLe8XlbfAX9vw3wYcxCEoqu082sr1O9HWV
5y70TKrsxrBE5ugibvL3LOSTQ8jCSnvDuyfBFG0ZwJ7u4EtvW70VG4g6ZUkP+DVy
aPdgJZ1Zft4/d3RsmdfZj+MYDyCQvHP9UYCMEBEJLOj8jAK3PuSQy7KrRDzcovBQ
xSlijqYtenrFZzzt0NdshH+rrGtLHrzJXB5itMi//zRLoDCz7AGDSwKJ2NWm+fXU
o6bn1OZRC9TtNocOfKTKzrsUPGjfezhtG8+SKFscOZO6Wqjvth7TwFJ03HNynq2I
5A28x4tNYmuU0+kv5YrvLgZ6PHLbL+gmid4G6GwZtggOJEewvOBih6sNHesVUyAT
QlCol2PonGi9SHMn5N+dU22UZipZe4JF/uoxWRKFzGXPIjkPnvRJVQpKYqmO1Tyw
c3f+TGF4JMGP/z/w3vxT0WgYqQ8ZHwhQdDOwfVX3q/w7Nurn6esBMtO5M0f+As4+
IQxh+/KZ4p8Y250q8M6IWVBy9X+8gCoGcQzw3NIPAhvj3nor+8LG8TecmxzdZcbR
shBuN6OUXTBGvXHMiaEX1QGED1Am/u1Sb1W43HWayh9XOXQZmLE8kOAkMwiSlvzv
u/4euYCvnOYtw/RpSz+a/aUSrZfVs3/5taBc2AssZ3E8WBmEr70=
=2BEF
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpyQmoACgkQmmx57+YA
GNnu/BAAnxdcYeZcENwvkDr7aFtxnmEhdIWly5N2zSMFRRFXVgdVqUiSeKcpiNk8
VV7/ye94Q4sp3oj/DluXJkK3/Ma57rMG/WeXHShtFRalQUc12v7OfD0BgGAieNYW
Vqg2ZgR25FcMhXDE2+g4LrkinWMQC/o/csyVaLQXxWDQL4EqSzAcqQ5yRn3JL3x5
Qs4Zd5aZbcRcpDFzXt1tefAKO2LSXrQM/pOuUo4Yf5ZcnfehAILmQYAR066TV2u3
plOLabOeXNSsYjHhUobLY6OIy5817OWRXgh+khRVAXjf90HX4Y+I68RjlgC/QCWQ
A9XwdxLM1CDDs95m166nTechcI05DysRXdvqTEfRpnNxk08gc6zXYrcvSzWd/kcn
HxdPmsWgZ5Hk4/ikmJPBx8U7UvDwnoBWFSaP1Hv4ZmIk60tLH4JdXRUGivewZnIB
J9g0AbY2IzHI4wJdLrNvgd8xcufr/3SvgX34hT2n1UOnmlbC8uYrzNx9TN8HiZIQ
CFQZzYc8FFWlzE24y0rvGOgQa+Jbj6Vq5+9q3UEslcOZfkEGZYjN+TkL4HLruuL4
8tRRA94fWCa+aE7QZ3l/8OnFsYjHcR46ufjyS0BLxfvx/usaIXyJuaW/tMP2dcbX
2FKi4ZsANBXt+oIz3C5NZu+bexDo3J13PzjYJNyGsH+9Xq32v7Q=
=+3bz
-----END PGP SIGNATURE-----
Merge tag 'tegra-for-7.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux into soc/drivers
soc/tegra: Changes for v7.3-rc1
Various small fixes for multi-socket devices, redundant error prints, a
Kconfig dependency as well as a patch to remove FUSE data as an entropy
source.
* tag 'tegra-for-7.3-soc' of git://git.kernel.org/pub/scm/linux/kernel/git/tegra/linux:
soc/tegra: Add PM dependency to SOC_TEGRA_PMC Kconfig
soc/tegra: fuse: Use device-specific instance in suspend/resume
soc/tegra: fuse: Do not use fuse data as entropy source
soc/tegra: cbb: Remove redundant dev_err()
soc/tegra: pmc: Don't register sys-off handler for multi-socket devices
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Andrew Jeffery <andrew@codeconstruct.com.au>
kconfiglint reports:
K006: config SOC_TEGRA_PMC selects PM_GENERIC_DOMAINS which depends on PM,
but SOC_TEGRA_PMC does not depend on PM
SOC_TEGRA_PMC is an internal bool symbol (no prompt) that is selected by
ARCH_TEGRA_*_SOC options to enable the Power Management Controller driver.
It was originally introduced in commit 5e7d4c6529 ("soc/tegra: Implement
Tegra186 PMC support") as a bare `bool` with no
selects of its own.
Over time, additional selects were added:
- Commit 5098e2b95e ("soc/tegra: pmc: Select GENERIC_PINCONF") added
select GENERIC_PINCONF
- Commit 28dbe82310 ("soc/tegra: pmc: Select IRQ_DOMAIN_HIERARCHY") added
select IRQ_DOMAIN_HIERARCHY
- Commit f880ee9e96 ("soc/tegra: pmc: Add core power domain") added select PM_OPP and select PM_GENERIC_DOMAINS to
support core power domain voltage scaling
PM_GENERIC_DOMAINS is defined in kernel/power/Kconfig as:
config PM_GENERIC_DOMAINS
bool
depends on PM
When commit f880ee9e96 ("soc/tegra: pmc: Add core power domain") added
the select, it did not add a corresponding `depends on PM` to
SOC_TEGRA_PMC. This was not a functional problem because all callers of
SOC_TEGRA_PMC are inside `if ARCH_TEGRA` blocks, and both the ARM32
definition (arch/arm/mach-tegra/Kconfig) and the ARM64 definition
(arch/arm64/Kconfig.platforms) of ARCH_TEGRA select PM. Thus PM is always
enabled when SOC_TEGRA_PMC is selected in practice.
However, the dependency chain is implicit rather than explicit. Add
`depends on PM` to SOC_TEGRA_PMC to make the requirement explicit and
prevent a theoretical misconfiguration if SOC_TEGRA_PMC were ever selected
outside the ARCH_TEGRA context.
Assisted-by: Claude:claude-opus-4-6 kconfiglint
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Avoid using the default fuse instance in suspend/resume callbacks, as it
always runs the suspend/resume callbacks for the default instance rather
than the device’s own.
Get the correct fuse instance by using `dev_get_drvdata()`.
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Fuse values are static and device-unique but not secret. Using them as an
entropy source weakens the overall randomness pool because the data is
constant and externally observable over the device’s lifetime.
Stop feeding fuse data into the kernel’s randomness subsystem.
Signed-off-by: Kartik Rajput <kkartik@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
This adds a fix for a missing error check in mtk-socinfo, and
also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver.
Besides from that, this also reworks how the MMSYS tables are
specified with the macro, separating the component's hardware
instance from the actual type, resolving a prerequirement for
the restructuring of mediatek-drm.
-----BEGIN PGP SIGNATURE-----
iLoEABYKAGIWIQQn3Xxr56ypAcSHzXSaNgTPrZeEeAUCamsBiRsUgAAAAAAEAA5t
YW51MiwyLjUrMS4xMiwyLDIoHGFuZ2Vsb2dpb2FjY2hpbm8uZGVscmVnbm9AY29s
bGFib3JhLmNvbQAKCRCaNgTPrZeEeFUuAQCcdpIBGxycSOIoG5uxijcx8w7uhmf9
FJMPm4LiDF5LgwD/bn2CqDMCrkNQysoErQkhVlOczLbKJSQ69QGFuSGLlwo=
=TyOH
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmprF7wACgkQmmx57+YA
GNnb0BAAg54DnXer5nJLPZyqfKbgscGZbVLFW2X9k/Cx1utJpVW4ozxRCUTK4sb4
15t+wUOSsdzj1ZIYCccZR3QtqBxbPRnLECHeP/tEqf0+4Qu0jOaYXIstIVsrInkr
zDtXFReq0D+2V8Nf46gw7zi65q2xZUbNSeJTUgy3s5miOaB0w1/as6c97SJzzZgU
DqLEmo/gi74+k3PfYcgLiJJXJSYba8qtGUorrJbXvil+wWPbcDIpokpt7V/ktGjE
jVBdtHNR0IhpMZUjK/4CUi2EgQHpnGeSLN0je3O9PfdUVcIvauwd2Fy5RUSfOk8x
Hs877b4OcJry+fAS1Hw+/v2f1nlMyMcfuPll+8GHkP11c511M55o3zbYR0RKlrtz
DT12QiSTHyLir+4fdTyh808hBJw8B2CPt59AtHbTT1YNAFfqOmo/5EmYlCOIiFNk
WRYz7lQRLY2ElOgUQAtmAS4LiPg7aen0bICIggFdK68abdUfon7oSanxkYxEL1By
0+/fQMbOlotlJar5cyi5l1/bKshs8IIm/+aLXFsqtIBZHbKXo6Z9NXM3HDXOj1oK
II+sfmw8GxfmGVQbLUCns3J4IlVUqndw10Bad8u2djLruWeL9AgfkRQZqOTEi1B2
4BL6aB4H9Co0amwb1mPUFh7atfLgqaQkf623Lis6i+hqR5+4cGc=
=Ew69
-----END PGP SIGNATURE-----
Merge tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux into soc/drivers
MediaTek SoC driver updates
This adds a fix for a missing error check in mtk-socinfo, and
also a missing MODULE_DEVICE_TABLE() in the mtk-dvfsrc driver.
Besides from that, this also reworks how the MMSYS tables are
specified with the macro, separating the component's hardware
instance from the actual type, resolving a prerequirement for
the restructuring of mediatek-drm.
* tag 'mtk-soc-for-v7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/mediatek/linux:
soc: mediatek: add missing MODULE_DEVICE_TABLE()
soc: mediatek: mtk-mmsys: Use MMSYS_ROUTE() in default routing table
soc: mediatek: mtk-mmsys: Rework routes to specify component ID
soc: mediatek: mtk-socinfo Add error handling in devm_kasprintf()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
All of the mtk_mmsys_routes tables for all SoCs were converted to
use the MMSYS_ROUTE() macro but the default one used for MT2701,
MT2712 and SoCs from that generation was not: convert this one as
well.
This brings no functional change.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
In preparation for a refactoring of multimedia related MediaTek
drivers, including mmsys, mutex and mediatek-drm, rework all of
the MMSYS routes to specify a hardware component instance number
(or "SubID") alongside the hardware component type.
This also is one step of preparation towards the removal of the
catch-all mtk_ddp_comp_id enumeration and towards the migration
from a predefined-coupling static hardware component IDSubID
mapping (carrying around a very long enumeration and also some
multiple big arrays in mediatek-drm) to a more flexible map of
Component ID (Type) decoupled from Component SubID (HW Instance)
as then, anyway, techniques to handle components are always the
same on a type basis.
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnqlgQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1+MtD/9M66W36D7KaI9tnHLxVO+2h+VZV73Q9+jI
Siy6LaytoSX9Zz3jYYeLT8AFCm2ykbydGfIWOBw8lWKrc5tSlQhE/zFrl8fcigr6
7xvHbHPoUa/cv8yxDn0v0JPQtnbKyRz6+vNuYPSTGFsLCqavMEPlq3PGNz43j5rG
6TgbpE2HC1K0fhuYMkootj/O4QLVN0RbUbAjYmdbxY35/z5pPq/5lAvOZU9GdI9d
l+rICXNJy9ZMPw9u5HR8IEDiV9dH+Znwk7jkGxIzyDpSxi4FW9jrfui124aqFDCU
qc97cBzYZ1mf7FK1zkfT3KRZ/TaAxl49kxbOB4WzOxDDtZ866ciSN2OGtvMmFlzd
5jnHj7b7hnm5L1U59GPDZD940qNFydK/2cgS1x4bc0aPsT324NxV/m0TuzIro91Z
xwbllGGfHmEC5Rl1WthrrXZPBTkM23KJAdvA9d4M/yPv6tEMJsAkqwKcoiV+wPeQ
hhtuyH2bCw+UZZ7rxN0gAuT8hdj1bexuminZilixCBAZkNymV9njiueipNEL9Hb0
2bfTKE84plPjjQ8ijgoAZ/Sefv/6at51gEwYjWZnX66huzkp3w8pXj2MhkG7lgmv
DC5hWpOU/kFNCamePeQUeJ9hwbdPCy13NDkjmuh0s6Ouzy9DpuIxCmE4U8cID5MQ
x+Rh4YbWPQ==
=xeyD
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFiQACgkQmmx57+YA
GNlYKw/+KxY6PubRpNhKHivaGqFBFgD+GlPaJNRMkFgXYIiUz6CDwnFK0v9XozOr
UfwrfIDGBvdq0XrNJmiRPW68A4PhGV9MP7Tq3iwEFr/hjRCgjylGNe92znzTIHat
oJtB96EdAPd+Dgr5vuZ923yA9t3zGf1Ns5YqlLos7xGWDBzXuAKmQVbf7j7exLg5
FwjabWAwHsf3le13WYsEY4TleqHMYuspLnsIVSQXJwiX4Ex67ndKcwQdIECY7eYs
y7790ofY67mBa2y+JRiybCMCk6KbgBxtbDb1jL/GJ8zde4mpoX7hdJ8u6hMIdOMJ
5lpHL0m31nuKyzIsBAAKcdKJviNL09d8yy+RzU1/DT84kVxz6eFsxfj+NR6inHKE
ZsBZS7oJRoRpMxCLxvnE44PVFCnCuv517CqvDfvEyCMx2pKmUl3C2O1CgE5mIK2n
FqgbuTy4rQLw7pKR3HF+qEyhyHYiuARWftVuXPWf8NHCPNSb37x50HjC4FYJPcOq
rP9fKAlqxHd4CQ0WlUx1J0mmp5USmYj9xbc2aUS/g1bJ1GaWfSuT/a7wZuI57769
HIc2Mqv9G+3LaEd2UNCods7QXW3zZTK80qm8WyEm4PddSX/9K6R/gzCzl0CwMfCe
/qFewzZTL9SJ4F3MRiefc897g7+JMtrg5+xNbZyIInUGJQsR3sA=
=rMXV
-----END PGP SIGNATURE-----
Merge tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux into soc/drivers
Samsung SoC drivers for v7.3
1. Fix very old leak of OF node in PMU driver.
2. Few cleanups and new bindings for ExynosAutov920 HSI0 syscon.
* tag 'samsung-drivers-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux:
dt-bindings: samsung: exynos-pmu: Narrow allowed reboot modes
dt-bindings: samsung: exynos-pmu: Restrict children with unevaluatedProperties
dt-bindings: soc: samsung: exynos-sysreg: Add hsi0 for ExynosAutov920
soc: samsung: exynos-pmu: fix of_node refcount leak in exynos_get_pmu_regmap()
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
-----BEGIN PGP SIGNATURE-----
iQJEBAABCgAuFiEE3dJiKD0RGyM7briowTdm5oaLg9cFAmpnrDcQHGtyemtAa2Vy
bmVsLm9yZwAKCRDBN2bmhouD1xaMD/wPkFz7Vj8UDRDbMVjdk0VoYmawxFc83r0P
kwdrp7OxSwH7Js+HANgs8zYFYbIRSVFkkHyAi5aekTaXBzXohwdtiW4t3qHynmtX
wBvAF4xZLxLsII+OZU8wbTJw6ZWJscM6AloW1TZPVOiOJ6m7kKBztMkl7US/hwKR
3hbCMT5zXRz/MCniq1cH3hT3KUQLopcT6vclJrz+kaHfoQN6T6TE23teaciKOYUB
tvjQk1eWZ7gRUdqnvflZHTuSyx+VvVxrukIy8d7IljEGEsWDSoQmxfrNTCwRZwrB
OIqVj6+ZhygJKpb/LdxCNjvZqUCiaCr6vlMMhkQ08HHS+EW3tmqkCJuwkoODr2G0
l+EhL24rBJeIQGstRhNV43q4YstCZB5u0ZO7ixxFxdZ74PYDFFLlbxJZ/wyPLaYf
jala4+STTOyuy13eCf90OUPosgPWFGJyb2ouJlZJuquJv4XBzNF/ukguEMDLS0S8
JDOL9WIHIwNd7d2bDwbTS3zL5qvwhFpa2Z2LfjARnLXiZjClzhIR+HCe+lmLSSvr
4sANn7m1ouwKBtBO+WqLgf7tvEY+v5TVwNCHiIsI6t4yxetCp/HUN+1sHiD4hOs0
40IMvl3wM89ET0fLo1VWoN5lC06n0bdREsgstL2AFHcRAnHBaFcldtR3jW8AsyFh
hXvNH/iFdw==
=s70S
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpqFI4ACgkQmmx57+YA
GNmmRw//WkrjLuFY7GzUoqxrYJe4glU14C956miHhS45Nio+NUN2Aa8ArymsPyl4
vukxkI9Ej6oQGZI5m8CLHDPP7W7yUJ+z3JzCly1QuxkGD7wSUd6/ih7WfWWAPDfD
xUbuk3/h0wal6apCpCUaWEczfn68FTr33fVd24S4VdwA18nYnabXDI/0XXgItg7F
956KUPt7FxOm6XmQB6xrCW4ry2hm2gwo+isMxjDGoIQXaQWPhi6A2ahvpm8ECFvI
bQx8vJZKHz6P9erhPLMxtkTcghaVg2i8aUqQR7cOtGYLkL45XlyNoyRH3FaL34Mg
7neHNg4H/tynyWFt9WEARdpsunJySeUuYpZ5+po5DUXuMUlz0vS2FeOsJ05ocnpR
KRSblMjflHtwYJ4NbCSf8c10TF8bp8Os8JN7wGG7fI9cXbM3/Ih+bWRF275VQuIX
Ko6qCvv4UzcndseAb1NFIYnrKHhaNGb1TmP7bQA59BB43DSrjaUTug99+UVd2HXa
bnMrtxIsu8pRB7mmaiCMtqyoeH+dt8vb/7JGyf6x4Xyqgnme0kAQatMGwqKLXM3y
G06IJqTsbO++xlrkZy0hHriRTFQRC2wIKYd6jqoZ8XZg7k8KvVQYjLoLcDyIqhBc
2vuNtFSBOPiLPLPkA4aYJVwQsuTyfuQBH2LNBy4pOkoU0g+IxyE=
=YFm3
-----END PGP SIGNATURE-----
Merge tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
Memory controller drivers for v7.3
1. Few improvements: STM32 OMM, Tegra MC and JZ4780-nemc.
2. Refactor Tegra MC interconnect code to better represent actual
hardware in multi-socket NUMA cases.
* tag 'memory-controller-drv-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl:
memory: jz4780-nemc: Use dev_err_probe() for clock error
memory: tegra: Guard against NULL mc_regs in IRQ handler
memory: tegra: add multi-socket support to the memory interconnect
memory: stm32_omm: initialize ret in stm32_omm_set_amcr
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
A collection of SCMI core and transport fixes addressing resource
lifetimes, teardown races and error handling. Most of these issues
are reported by Sashiko as existing issues while reviewing new feature
additions to SCMI.
The changes:
- publish channel state before mailbox and SMC callbacks can run,
- quiesce notification work before tearing down transport channels,
- fix partial channel setup and mailbox allocation cleanup,
- make IDR iteration and shared-channel teardown safe,
- correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;,
- harden requested-device registration and removal against races and
partial failures,
- reject out-of-range DT protocol IDs, and
- simplify notification allocations using flexible arrays.
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmpjMg8ACgkQAEG6vDF+
4pg3Kw/+N09f4Zd1c8xwQi5NEfwv8uEKRE73VSAL18aNn89mGj6J1cGOs1NWHJ0b
bKDOuhoJWYynHDGbaZGFVLhh3l2Jj2yE+Hr9sq2nOHktA7HFqSVV5ea8RuRD/XHt
3rNIX6UBLSEp7N40ehkwD506zr3eRcfwtUwS8taEvl0NWNKrPJ+TpMxN3LBGWzBq
oXaD7642Mb9rDyApuwOGWlHitDPU1qQv5JrLLWP8/Nx4PQlb1TX6171FXvrMdjdx
qKUiUBZM9Q9w4gaKgnIEcq0KCBWdxa5ZKPupZTUzt60NEpkemjYcmjxoJFDIArGC
013Z/dXhynkigaEjfvWPhoNaoLx1Q3NTk5ChljaKLizI6sE0N02wuax8rHIuKSnL
fhbyNcpmsEgiVwnX4zw6l44AakWHx8qkE3avtx0yks+joAWt8ERzIHCd+uWF1z15
b18humBSxcs3DmmejH8JMMCTpL7OxI3PHtdntttXWpvM43/pZnO6vF23Nfo0KQ3q
ZrOD15W4qQ8M9nGKmpaa6f6tDPoWuULLcMhMHZo3FLdOYa5lnGtAs1Rj7MvJ5I0b
u8/t4P2hoCskSVN973P51ZA3r1NI9ZK+uZ3Krq9TFEvgI5ZZQTfDoz6Zc4q9/ERV
80k8/wRP8vCjBM2mQ+WVlWG1gJEq487t6bBPfQVeHmS+/BI0g+s=
=w04g
-----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmpjjIsACgkQmmx57+YA
GNmWgQ//e5oKyKC8Ac6vcjbRbwb6joIX0u0N8slFoKi3rano2Hb0e0TOLSywjCq8
w2G/n5tBjZKfp9RSqSWY0lZHjZhyyokosiSldtr8rX6v0LLQurHIPHakFHI0uW1h
1iquU37P+TJ8C/EcBHcG/3jrvMGPO2PFln7+XVNE2eG2Q79E26NcU9sNoLJeBTlt
AZrwpJ9jnUnay+zbc5jtqxqN50cam5I+lNNu+sZmDd67rN+wOUX68yn8vE6Buk+5
li1Ni0W6sKTbMchx+G56ibqnvTcLnouD5wvSNcgJOVycYsykzMB6pSKgqnUGqBTu
uHtvRJ1/Nzp+iQqdiGnzGw4x4bB7tackKIQtOww2wUYuE9KY+OCmnieS3hPpg/Od
kRBHrxaZ6fyfb++Mw+Ze5gwFEwhQDI0UgGAqu7DsSAuWefcCdPTo4ia9G+HGS1ID
80SNS/GdUmtLdCfsVIqOtvOY2TKwgfsqBWgimyF2apl3nQgbAUkjUlLTUTIFbhXo
em2oi6yLQVvte3HGc5r9NbmBnO3KRYIXYRU+t73bOBYeAKNdIPsA357dcrx/5MnN
eGli+DrKk/oC1zrvl9OjpAcD83enZ76EPHKRav8zGAnYQ1sLS+GweJsbSg9Yj4Dq
XbJGb8LM7mCFefrDvZKOVSWy5DMazHiofguPBOSgEnqASdp+Ydo=
=JO1v
-----END PGP SIGNATURE-----
Merge tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into soc/drivers
Arm SCMI updates/fixes for v7.3
A collection of SCMI core and transport fixes addressing resource
lifetimes, teardown races and error handling. Most of these issues
are reported by Sashiko as existing issues while reviewing new feature
additions to SCMI.
The changes:
- publish channel state before mailbox and SMC callbacks can run,
- quiesce notification work before tearing down transport channels,
- fix partial channel setup and mailbox allocation cleanup,
- make IDR iteration and shared-channel teardown safe,
- correct SCMI device, OF node, handle, bus ID and SystemPower lifetimes;,
- harden requested-device registration and removal against races and
partial failures,
- reject out-of-range DT protocol IDs, and
- simplify notification allocations using flexible arrays.
* tag 'scmi-updates-7.3' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux: (25 commits)
firmware: arm_scmi: Unrequest devices if driver registration fails
firmware: arm_scmi: Roll back partial protocol table registration
firmware: arm_scmi: Fix requested device removal race
firmware: arm_scmi: Fix transport device teardown lookup
firmware: arm_scmi: Fix SCMI device destroy lifetimes
firmware: arm_scmi: Unwind P2A receiver mailbox setup failure
firmware: arm_scmi: Unwind TX receiver mailbox setup failure
firmware: arm_scmi: Fix OF node reference handling
firmware: arm_scmi: Clear SystemPower flag on create failure
firmware: arm_scmi: Drop handle on protocol bind failures
firmware: arm_scmi: Protect device request lookup with RCU
firmware: arm_scmi: Use channel ID for transport teardown
firmware: arm_scmi: Reject out of range DT protocol IDs
firmware: arm_scmi: Avoid IDR updates while cleaning channels
firmware: arm_scmi: Free transport channel on IDR failure
firmware: arm_scmi: Clean up channels on setup failure
firmware: arm_scmi: Quiesce notifications before teardown
firmware: arm_scmi: Unregister device notifier before IDR teardown
firmware: arm_scmi: Publish channel state before callbacks
firmware: arm_scmi: Simplify notification allocations
...
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Message-ID: <20260704122324.80274-1-pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
The driver has an OF match table wired to .of_match_table, but does
not export the table with MODULE_DEVICE_TABLE().
Add the missing MODULE_DEVICE_TABLE(of, ...) entry so module alias
information is generated for OF based module autoloading.
This is a source-level fix. It does not claim dynamic hardware
reproduction; the evidence is the driver-owned match table, its use by
the platform driver, and the missing module alias publication.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Message-ID: <20260704121851.63805-1-pengpeng@iscas.ac.cn>
Signed-off-by: Linus Walleij <linusw@kernel.org>
scmi_driver_register() requests protocol devices before registering the
driver. If driver_register() fails, those requests remain in the global
IDR and retain pointers to the module's ID table. Once the failed module
load releases that storage, later request matching or SCMI device creation
can dereference the stale pointers.
Unrequest the complete protocol table before returning the registration
failure. At this point table registration succeeded, so every entry is
owned by the current registration attempt.
Fixes: d3cd7c525f ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-2-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_protocol_table_register() can leave earlier requests registered when
a later entry in the same ID table fails. Each request retains a pointer
to the driver's ID table, so a failed module load can leave a dangling
pointer after the module storage is released.
Unrequest only the successfully registered prefix, in reverse order,
before returning the failure. Leave the failed entry and the remaining
entries untouched because matching requests can be owned by another
driver.
Fixes: 2858f6e5f0 ("firmware: arm_scmi: Add multiple protocols registration support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722173521.2184378-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_protocol_device_unrequest() drops scmi_requested_devices_mtx while
notifying listeners but continues to retain the per-protocol list head.
When two SCMI drivers for the same protocol unregister concurrently, one
thread can remove the final request and free the list head while the other
is running its notifier. The latter then dereferences the freed list head
after reacquiring the mutex and can free it a second time.
Complete the list and IDR updates, including freeing an empty list head,
before dropping the mutex. Keep the blocking notifier outside the critical
section and retain only the detached request across the callback.
Fixes: d3cd7c525f ("firmware: arm_scmi: Refactor protocol device creation")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260722095250.2011630-1-sudeep.holla@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
On Shikra, the DDR System Firmware (DSF) configures ECC interrupt
routing before the kernel driver probes — it enables Tag/Data RAM
interrupts and programs error thresholds in the LLCC interrupt-enable
registers.
Set irq_configured in shikra_cfg so that qcom_llcc_edac_probe() skips
calling qcom_llcc_core_setup(), which would otherwise overwrite the
firmware-managed register state with redundant writes.
Signed-off-by: Faiyaz Mohammed <faiyaz.mohammed@oss.qualcomm.com>
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Reviewed-by: Komal Bajaj <komal.bajaj@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260713-shikra-edac-v2-1-22fcb3ca9fb9@qti.qualcomm.com
[bjorn: Changed subject prefix]
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
knav_queue_probe() creates the global qmss debugfs file whose show
callback reads the global knav_qdev state. knav_queue_remove() tears
down the queue manager resources but leaves the debugfs file published.
Save the debugfs dentry in struct knav_device and remove it during
teardown before the resources used by the show callback are released.
While touching the debugfs_create_file() call, spell the unchanged read-
only file mode as 0444.
Fixes: 41f93af900 ("soc: ti: add Keystone Navigator QMSS driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260706144706.96313-1-pengpeng@iscas.ac.cn
Signed-off-by: Nishanth Menon <nm@ti.com>
Switch ipa client driver over to generic PAS TZ APIs. Generic PAS TZ
service allows to support multiple TZ implementation backends like QTEE
based SCM PAS service, OP-TEE based PAS service and any further future TZ
backend service.
Reviewed-by: Alex Elder <elder@riscstar.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Acked-by: Alex Elder <elder@riscstar.com>
Link: https://lore.kernel.org/r/20260702115835.167602-12-sumit.garg@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
The kernel does not permit a device to register multiple sys-off
handlers for non-default priority levels. Hence, for multi-socket Tegra
devices, registering the sys-off handler in the Tegra PMC driver (which
uses the low priority level) more than once fails.
The Tegra PMC sys-off handler is supported for all current generations
of the Tegra SoC, however, it is only used as a low priority handler if
everything else fails. For example, on Tegra264 the EFI reboot handler
is called to restart the device. Therefore, for multi-socket devices,
skip the registering of the sys-off handler to because this is not
critical.
Signed-off-by: Jon Hunter <jonathanh@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
SCMI transport devices are deliberately excluded from normal SCMI bus
matching so protocol drivers cannot bind to the internal transport
children. However, scmi_device_destroy() uses the same protocol/name
lookup to find devices that must be unregistered during channel teardown.
Split the match helper so driver matching still skips transport devices,
while explicit child lookup can find them for teardown. Use a shared
transport-device name prefix macro for both matching and name generation.
Since transport-device names are derived from direction and protocol ID,
reject duplicate protocol channel setup before creating or finding a
transport device. This prevents malformed firmware with duplicate
protocol child nodes from reusing an existing transport device and then
destroying it when the duplicate IDR insertion fails.
Fixes: 9593804c44 ("firmware: arm_scmi: Exclude transport devices from bus matching")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-16-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_child_dev_find() drops the reference returned by
device_find_child() before returning the scmi_device pointer. A
concurrent unregister can then release the device while the destroy path
is still using the returned pointer.
Make the lookup helper return the device_find_child() reference and keep
it until scmi_device_destroy() has finished unregistering the child.
Also split device_unregister() in __scmi_device_destroy() so the SCMI bus
ID is not made reusable until after device_del() has removed the old
scmi_dev.N name from sysfs. This avoids a new SCMI device reusing the
same ID while the old device is still registered.
The final device release callback is also a possible cleanup path when
SCMI children are deleted by driver core recursion rather than
__scmi_device_destroy(). Release the SCMI bus ID from a common helper
used by destroy, register-failure and final-release paths, and clear
scmi_dev->id after freeing it so the final release cannot free the same
ID again.
Fixes: 9ca67840c0 ("firmware: arm_scmi: Balance device refcount when destroying devices")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-15-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
mailbox_chan_setup() can request an additional P2A receiver channel after
successfully acquiring the primary P2A channel. If that later request
fails, the function returns immediately and leaves the primary channel
allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: fa8b28ba22 ("firmware: arm_scmi: Add support for platform to agent channel completion")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-14-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
mailbox_chan_setup() can request an additional unidirectional TX
receiver channel after successfully acquiring the primary channel. If
that second request fails, the function returns immediately and leaves
the primary channel allocated.
Unwind the primary mailbox channel before returning the error so probe
deferral or other setup failures do not leave the channel busy for later
probe attempts.
Fixes: 9f68ff79ec ("firmware: arm_scmi: Add support for unidirectional mailbox channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-13-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI devices store the DT node in dev.of_node through
device_set_node(), but that helper only assigns the fwnode and
of_node pointers without taking an OF node reference.
Take a reference when assigning the node and release it from the
SCMI device release path. With the device owning that reference,
remove the separate channel-side get/put pair from the core driver.
Fixes: 96da4a99ce ("firmware: arm_scmi: Set fwnode for the scmi_device")
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-12-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
__scmi_device_create() reserves the singleton SystemPower protocol device
before registering the SCMI device. If any later step fails, a stale
reservation can make a later retry reject SystemPower device creation
permanently, for example after probe deferral.
A plain global boolean is not enough to track the reservation. A delayed
final release of an older SystemPower device could clear the boolean after
a newer device has already claimed it, breaking the singleton guarantee for
the active device.
Track the reservation with the scmi_device pointer itself. Claim it with
cmpxchg(NULL, scmi_dev) after allocating the device object, and release it
with cmpxchg(scmi_dev, NULL) from the common cleanup helper. This lets the
create-failure, explicit destroy and final release paths clear only the
reservation owned by the device being cleaned up.
Fixes: 2c3e674465 ("firmware: arm_scmi: Refactor device create/destroy helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-11-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The SCMI bus notifier acquires an SCMI handle when the driver core emits
BUS_NOTIFY_BIND_DRIVER, before invoking the protocol driver probe
callback. The protocol probe path only checks whether sdev->handle is
set.
If device_link_add() fails after the handle has been acquired, the
protocol device can still bind with a valid handle but without the
dependency link to the SCMI parent. A concurrent parent unbind can then
miss the child and tear down the SCMI instance while the child still
holds a handle into it.
If the protocol driver probe later fails, for example with
-EPROBE_DEFER, the driver core emits BUS_NOTIFY_DRIVER_NOT_BOUND rather
than BUS_NOTIFY_UNBOUND_DRIVER. The SCMI notifier only released the
handle on BUS_NOTIFY_UNBOUND_DRIVER, so each failed protocol-device bind
leaked the SCMI instance users refcount and left sdev->handle set after
the failed probe.
Make the link helper report failure and drop the acquired handle if the
link cannot be created. Also handle BUS_NOTIFY_DRIVER_NOT_BOUND in the
same cleanup path used for unbind so failed probes balance the earlier
BUS_NOTIFY_BIND_DRIVER acquisition.
Fixes: 971fc0665f ("firmware: arm_scmi: Move handle get/set helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-10-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The SCMI device request notifier looks up protocol OF nodes from the
active_protocols IDR. The IDR lookup can run concurrently with protocol
activation while probe is still registering protocols and creating their
SCMI devices.
Wrap the lookup in an RCU read-side critical section as required by the
IDR API for lockless readers.
Fixes: 53b8c25df7 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-9-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI protocols can share the BASE transport channel when firmware does
not describe a dedicated channel for the protocol. In that case multiple
IDR entries can point at the same scmi_chan_info, whose owning transport
device was created with cinfo->id.
scmi_chan_destroy() used the IDR iterator key when destroying the
transport device. If an alias entry is visited before the owning channel
entry, the lookup can miss the device because the iterator key does not
match the protocol ID used when the transport device was created. The
code then clears cinfo->dev, so the later owning entry skips teardown and
leaks the transport device.
Destroy the transport device using cinfo->id, which is the protocol ID
that owns the channel and was used when creating the transport device.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-8-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
SCMI protocol IDs carried in message headers are limited by
MSG_PROTOCOL_ID_MASK. The DT parsing paths noticed protocol IDs
outside that range, but only logged an error and then kept processing
the invalid value.
That lets a malformed 32-bit DT reg value reach helpers which take a u8
protocol ID, where it can be truncated and/or treated as a different
protocol.
For channel setup, two different out-of-range values can also be used as
distinct IDR keys while aliasing the generated SCMI protocol identity.
Skip DT protocol nodes whose reg value does not fit the SCMI protocol ID
field before setting up channels or creating protocol devices.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-7-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_cleanup_channels() walks the TX/RX channel IDRs with
idr_for_each() to free transport resources and destroy the dedicated
transport devices before calling idr_destroy().
The destroy callback removed each entry from the same IDR being walked.
That is not needed for this cleanup path, and it is unsafe because
idr_for_each() has not advanced its radix-tree iterator while the
callback is running. Removing the current entry from the callback can
invalidate the iterator state. The callback also cannot be protected by
rcu_read_lock(), because scmi_device_destroy() may sleep.
Leave IDR teardown to the following idr_destroy() call and keep the
callback limited to device destruction.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-6-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
If transport channel setup succeeds but the following IDR insertion fails,
the error path destroys the transport device and frees the channel info
without invoking the transport cleanup callback.
Call chan_free() before destroying the device so transport specific
resources such as IRQs, mailbox channels and mapped shared memory are
released consistently with the normal teardown path.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-5-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_channels_setup() can fail after the common BASE channel or earlier
protocol channels have already been registered in the TX/RX IDRs.
Route this failure through the existing channel cleanup label so the
transport channels, transport devices and IDR state created before the
failure are released before the probe error path frees the SCMI instance
ID.
Fixes: 05a2801d8b ("firmware: arm_scmi: Use dedicated devices to initialize channels")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-4-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
scmi_notification_exit() clears and releases the notification instance,
but transport callbacks can still deliver incoming notifications until
the TX/RX channels are freed. During remove, an RX interrupt in that
window can enter scmi_notify() while notification state is being torn
down and then dereference freed memory. The same ordering exists on the
probe error path after notification initialization.
The notification late-init worker has a separate lifetime issue: protocol
event registration queues ni->init_work on the system workqueue, so
destroying ni->notify_wq does not drain that work. If the devres group is
released while init_work is still pending or running, the late-init worker
can dereference the freed notification instance.
Quiesce the notification core before TX/RX channels are torn down, then
clean up the channels before releasing the notification core resources.
Use disable_work_sync() so future late-init queueing is rejected and any
already queued or running late-init work has completed before channel
teardown starts.
Fixes: 1e7cbfaa66 ("firmware: arm_scmi: Free mailbox channels if probe fails")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-3-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
The requested-devices notifier looks up protocol fwnodes from the
active_protocols IDR. During remove, unregister the notifier before
releasing and destroying active_protocols so no notifier callback can race
with the IDR teardown.
Keep the bus notifier registered until after the protocol state is torn
down, matching the existing remove ordering for SCMI bus users.
Fixes: 53b8c25df7 ("firmware: arm_scmi: Add common notifier helpers")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Link: https://patch.msgid.link/20260714-scmi_core_fixes-v6-2-3afe499d46e3@kernel.org
Signed-off-by: Sudeep Holla <sudeep.holla@kernel.org>
