From 617a7ed073115016e417b518c68c96057f1bf66c Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Fri, 4 Apr 2025 13:24:07 +0200 Subject: [PATCH 01/11] soc: fsl: Do not enable DPAA2_CONSOLE by default during compile testing Enabling the compile test should not cause automatic enabling of such drivers. Signed-off-by: Krzysztof Kozlowski Acked-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250404112407.255126-1-krzysztof.kozlowski@linaro.org Signed-off-by: Christophe Leroy --- drivers/soc/fsl/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/fsl/Kconfig b/drivers/soc/fsl/Kconfig index a1e0bc8c1757..47870e29c290 100644 --- a/drivers/soc/fsl/Kconfig +++ b/drivers/soc/fsl/Kconfig @@ -36,7 +36,7 @@ config FSL_MC_DPIO config DPAA2_CONSOLE tristate "QorIQ DPAA2 console driver" depends on OF && (ARCH_LAYERSCAPE || COMPILE_TEST) - default y + default ARCH_LAYERSCAPE help Console driver for DPAA2 platforms. Exports 2 char devices, /dev/dpaa2_mc_console and /dev/dpaa2_aiop_console, From d694bf8a9acdbd061596f3e7549bc8cb70750a60 Mon Sep 17 00:00:00 2001 From: Ioana Ciornei Date: Tue, 8 Apr 2025 13:58:09 +0300 Subject: [PATCH 02/11] bus: fsl-mc: fix double-free on mc_dev The blamed commit tried to simplify how the deallocations are done but, in the process, introduced a double-free on the mc_dev variable. In case the MC device is a DPRC, a new mc_bus is allocated and the mc_dev variable is just a reference to one of its fields. In this circumstance, on the error path only the mc_bus should be freed. This commit introduces back the following checkpatch warning which is a false-positive. WARNING: kfree(NULL) is safe and this check is probably not required + if (mc_bus) + kfree(mc_bus); Fixes: a042fbed0290 ("staging: fsl-mc: simplify couple of deallocations") Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250408105814.2837951-2-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index a8be8cf246fb..0c3a38d7f335 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -906,8 +906,10 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, error_cleanup_dev: kfree(mc_dev->regions); - kfree(mc_bus); - kfree(mc_dev); + if (mc_bus) + kfree(mc_bus); + else + kfree(mc_dev); return error; } From dd7d8e012b23de158ca0188239c7a1f2a83b4484 Mon Sep 17 00:00:00 2001 From: Ioana Ciornei Date: Tue, 8 Apr 2025 13:58:10 +0300 Subject: [PATCH 03/11] bus: fsl-mc: do not add a device-link for the UAPI used DPMCP device The fsl-mc bus associated to the root DPRC in a DPAA2 system exports a device file for userspace access to the MC firmware. In case the DPRC's local MC portal (DPMCP) is currently in use, a new DPMCP device is allocated through the fsl_mc_portal_allocate() function. In this case, the call to fsl_mc_portal_allocate() will fail with -EINVAL when trying to add a device link between the root DPRC (consumer) and the newly allocated DPMCP device (supplier). This is because the DPMCP is a dependent of the DPRC device (the bus). Fix this by not adding a device link in case the DPMCP is allocated for the root DPRC's usage. Fixes: afb77422819f ("bus: fsl-mc: automatically add a device_link on fsl_mc_[portal,object]_allocate") Signed-off-by: Ioana Ciornei Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20250408105814.2837951-3-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/mc-io.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/drivers/bus/fsl-mc/mc-io.c b/drivers/bus/fsl-mc/mc-io.c index a0ad7866cbfc..cd8754763f40 100644 --- a/drivers/bus/fsl-mc/mc-io.c +++ b/drivers/bus/fsl-mc/mc-io.c @@ -214,12 +214,19 @@ int __must_check fsl_mc_portal_allocate(struct fsl_mc_device *mc_dev, if (error < 0) goto error_cleanup_resource; - dpmcp_dev->consumer_link = device_link_add(&mc_dev->dev, - &dpmcp_dev->dev, - DL_FLAG_AUTOREMOVE_CONSUMER); - if (!dpmcp_dev->consumer_link) { - error = -EINVAL; - goto error_cleanup_mc_io; + /* If the DPRC device itself tries to allocate a portal (usually for + * UAPI interaction), don't add a device link between them since the + * DPMCP device is an actual child device of the DPRC and a reverse + * dependency is not allowed. + */ + if (mc_dev != mc_bus_dev) { + dpmcp_dev->consumer_link = device_link_add(&mc_dev->dev, + &dpmcp_dev->dev, + DL_FLAG_AUTOREMOVE_CONSUMER); + if (!dpmcp_dev->consumer_link) { + error = -EINVAL; + goto error_cleanup_mc_io; + } } *new_mc_io = mc_io; From c78230ad34f82c6c0e0e986865073aeeef1f5d30 Mon Sep 17 00:00:00 2001 From: Wan Junjie Date: Tue, 8 Apr 2025 13:58:11 +0300 Subject: [PATCH 04/11] bus: fsl-mc: fix GET/SET_TAILDROP command ids Command ids for taildrop get/set can not pass the check when they are using from the restool user space utility. Correct them according to the user manual. Fixes: d67cc29e6d1f ("bus: fsl-mc: list more commands as accepted through the ioctl") Signed-off-by: Wan Junjie Signed-off-by: Ioana Ciornei Cc: stable@vger.kernel.org Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250408105814.2837951-4-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/fsl-mc-uapi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c index 9c4c1395fcdb..a376ec661653 100644 --- a/drivers/bus/fsl-mc/fsl-mc-uapi.c +++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c @@ -275,13 +275,13 @@ static struct fsl_mc_cmd_desc fsl_mc_accepted_cmds[] = { .size = 8, }, [DPSW_GET_TAILDROP] = { - .cmdid_value = 0x0A80, + .cmdid_value = 0x0A90, .cmdid_mask = 0xFFF0, .token = true, .size = 14, }, [DPSW_SET_TAILDROP] = { - .cmdid_value = 0x0A90, + .cmdid_value = 0x0A80, .cmdid_mask = 0xFFF0, .token = true, .size = 24, From a8c17b9cbf87cb9d98d501a16a47e5fe5839e855 Mon Sep 17 00:00:00 2001 From: Ioana Ciornei Date: Tue, 8 Apr 2025 13:58:12 +0300 Subject: [PATCH 05/11] bus: fsl-mc: add the dprc_get_mem() command to the whitelist Add a new MC command to the list of accepted firmware commands. The DPRC_GET_MEM command can be used to gather information on the internal memory characteristics. Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250408105814.2837951-5-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/fsl-mc-uapi.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/bus/fsl-mc/fsl-mc-uapi.c b/drivers/bus/fsl-mc/fsl-mc-uapi.c index a376ec661653..823969e4159c 100644 --- a/drivers/bus/fsl-mc/fsl-mc-uapi.c +++ b/drivers/bus/fsl-mc/fsl-mc-uapi.c @@ -48,6 +48,7 @@ enum fsl_mc_cmd_index { DPRC_GET_POOL, DPRC_GET_POOL_COUNT, DPRC_GET_CONNECTION, + DPRC_GET_MEM, DPCI_GET_LINK_STATE, DPCI_GET_PEER_ATTR, DPAIOP_GET_SL_VERSION, @@ -194,6 +195,12 @@ static struct fsl_mc_cmd_desc fsl_mc_accepted_cmds[] = { .token = true, .size = 32, }, + [DPRC_GET_MEM] = { + .cmdid_value = 0x16D0, + .cmdid_mask = 0xFFF0, + .token = true, + .size = 12, + }, [DPCI_GET_LINK_STATE] = { .cmdid_value = 0x0E10, From a941bed23c9473665c773453f8a835668af070bf Mon Sep 17 00:00:00 2001 From: Laurentiu Tudor Date: Tue, 8 Apr 2025 13:58:13 +0300 Subject: [PATCH 06/11] bus: fsl-mc: drop useless cleanup This cleanup is actually a no-op because the resources are freed when the device objects are removed from the allocator at driver remove time. Remove the fsl_mc_cleanup_all_resource_pools() function and its call site. Signed-off-by: Laurentiu Tudor Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250408105814.2837951-6-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/dprc-driver.c | 2 -- drivers/bus/fsl-mc/fsl-mc-allocator.c | 21 --------------------- drivers/bus/fsl-mc/fsl-mc-private.h | 2 -- 3 files changed, 25 deletions(-) diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c index 52053f7c6d9a..c63a7e688db6 100644 --- a/drivers/bus/fsl-mc/dprc-driver.c +++ b/drivers/bus/fsl-mc/dprc-driver.c @@ -806,8 +806,6 @@ int dprc_cleanup(struct fsl_mc_device *mc_dev) dev_set_msi_domain(&mc_dev->dev, NULL); } - fsl_mc_cleanup_all_resource_pools(mc_dev); - /* if this step fails we cannot go further with cleanup as there is no way of * communicating with the firmware */ diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c index 6c3beb82dd1b..d2ea59471323 100644 --- a/drivers/bus/fsl-mc/fsl-mc-allocator.c +++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c @@ -555,27 +555,6 @@ void fsl_mc_init_all_resource_pools(struct fsl_mc_device *mc_bus_dev) } } -static void fsl_mc_cleanup_resource_pool(struct fsl_mc_device *mc_bus_dev, - enum fsl_mc_pool_type pool_type) -{ - struct fsl_mc_resource *resource; - struct fsl_mc_resource *next; - struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev); - struct fsl_mc_resource_pool *res_pool = - &mc_bus->resource_pools[pool_type]; - - list_for_each_entry_safe(resource, next, &res_pool->free_list, node) - devm_kfree(&mc_bus_dev->dev, resource); -} - -void fsl_mc_cleanup_all_resource_pools(struct fsl_mc_device *mc_bus_dev) -{ - int pool_type; - - for (pool_type = 0; pool_type < FSL_MC_NUM_POOL_TYPES; pool_type++) - fsl_mc_cleanup_resource_pool(mc_bus_dev, pool_type); -} - /* * fsl_mc_allocator_probe - callback invoked when an allocatable device is * being added to the system diff --git a/drivers/bus/fsl-mc/fsl-mc-private.h b/drivers/bus/fsl-mc/fsl-mc-private.h index e1b7ec3ed1a7..beed4c53533d 100644 --- a/drivers/bus/fsl-mc/fsl-mc-private.h +++ b/drivers/bus/fsl-mc/fsl-mc-private.h @@ -629,8 +629,6 @@ int __init fsl_mc_allocator_driver_init(void); void fsl_mc_init_all_resource_pools(struct fsl_mc_device *mc_bus_dev); -void fsl_mc_cleanup_all_resource_pools(struct fsl_mc_device *mc_bus_dev); - int __must_check fsl_mc_resource_allocate(struct fsl_mc_bus *mc_bus, enum fsl_mc_pool_type pool_type, struct fsl_mc_resource From 23d060136841c58c2f9ee8c08ad945d1879ead4b Mon Sep 17 00:00:00 2001 From: Laurentiu Tudor Date: Tue, 8 Apr 2025 13:58:14 +0300 Subject: [PATCH 07/11] bus: fsl-mc: increase MC_CMD_COMPLETION_TIMEOUT_MS value In case the MC firmware runs in debug mode with extensive prints pushed to the console, the current timeout of 500ms is not enough. Increase the timeout value so that we don't have any chance of wrongly assuming that the firmware is not responding when it's just taking more time. Signed-off-by: Laurentiu Tudor Signed-off-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250408105814.2837951-7-ioana.ciornei@nxp.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/mc-sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bus/fsl-mc/mc-sys.c b/drivers/bus/fsl-mc/mc-sys.c index f2052cd0a051..b22c59d57c8f 100644 --- a/drivers/bus/fsl-mc/mc-sys.c +++ b/drivers/bus/fsl-mc/mc-sys.c @@ -19,7 +19,7 @@ /* * Timeout in milliseconds to wait for the completion of an MC command */ -#define MC_CMD_COMPLETION_TIMEOUT_MS 500 +#define MC_CMD_COMPLETION_TIMEOUT_MS 15000 /* * usleep_range() min and max values used to throttle down polling From 152f33ee30ee6a7f4c15bedd7529dc5945315547 Mon Sep 17 00:00:00 2001 From: Robin Murphy Date: Fri, 25 Apr 2025 14:39:28 +0100 Subject: [PATCH 08/11] bus: fsl_mc: Fix driver_managed_dma check Since it's not currently safe to take device_lock() in the IOMMU probe path, that can race against really_probe() setting dev->driver before attempting to bind. The race itself isn't so bad, since we're only concerned with dereferencing dev->driver itself anyway, but sadly my attempt to implement the check with minimal churn leads to a kind of TOCTOU issue, where dev->driver becomes valid after to_fsl_mc_driver(NULL) is already computed, and thus the check fails to work as intended. Will and I both hit this with the platform bus, but the pattern here is the same, so fix it for correctness too. Reported-by: Will McVicker Fixes: bcb81ac6ae3c ("iommu: Get DT/ACPI parsing into the proper probe path") Signed-off-by: Robin Murphy Reviewed-by: Will McVicker Link: https://lore.kernel.org/r/20250425133929.646493-3-robin.murphy@arm.com Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 0c3a38d7f335..7671bd158545 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -139,9 +139,9 @@ static int fsl_mc_bus_uevent(const struct device *dev, struct kobj_uevent_env *e static int fsl_mc_dma_configure(struct device *dev) { + const struct device_driver *drv = READ_ONCE(dev->driver); struct device *dma_dev = dev; struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); u32 input_id = mc_dev->icid; int ret; @@ -153,8 +153,8 @@ static int fsl_mc_dma_configure(struct device *dev) else ret = acpi_dma_configure_id(dev, DEV_DMA_COHERENT, &input_id); - /* @mc_drv may not be valid when we're called from the IOMMU layer */ - if (!ret && dev->driver && !mc_drv->driver_managed_dma) { + /* @drv may not be valid when we're called from the IOMMU layer */ + if (!ret && drv && !to_fsl_mc_driver(drv)->driver_managed_dma) { ret = iommu_device_use_default_domain(dev); if (ret) arch_teardown_dma_ops(dev); From 5ddac92be4209f29ec26b3ec59a08fc76afe9ab1 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Fri, 25 Apr 2025 23:20:41 -0700 Subject: [PATCH 09/11] soc: fsl: qbman: Remove const from portal->cgrs allocation type In preparation for making the kmalloc family of allocators type aware, we need to make sure that the returned type from the allocation matches the type of the variable being assigned. (Before, the allocator would always return "void *", which can be implicitly cast to any pointer type.) The assigned type is "struct qman_cgrs *", but the returned type, while technically matching, is const qualified. As there is no general way to remove const qualifiers, adjust the allocation type to match the assignment. Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20250426062040.work.047-kees@kernel.org Signed-off-by: Christophe Leroy --- drivers/soc/fsl/qbman/qman.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c index 4dc8aba33d9b..9be240999f87 100644 --- a/drivers/soc/fsl/qbman/qman.c +++ b/drivers/soc/fsl/qbman/qman.c @@ -1270,7 +1270,7 @@ static int qman_create_portal(struct qman_portal *portal, qm_dqrr_set_ithresh(p, QMAN_PIRQ_DQRR_ITHRESH); qm_mr_set_ithresh(p, QMAN_PIRQ_MR_ITHRESH); qm_out(p, QM_REG_ITPR, QMAN_PIRQ_IPERIOD); - portal->cgrs = kmalloc_array(2, sizeof(*cgrs), GFP_KERNEL); + portal->cgrs = kmalloc_array(2, sizeof(*portal->cgrs), GFP_KERNEL); if (!portal->cgrs) goto fail_cgrs; /* initial snapshot is no-depletion */ From 61ddf5faa7cc091b409936d571ec1af34ce487a1 Mon Sep 17 00:00:00 2001 From: Thorsten Blum Date: Tue, 29 Apr 2025 12:41:48 +0200 Subject: [PATCH 10/11] bus: fsl-mc: Use strscpy() instead of strscpy_pad() Both destination buffers are already zero-initialized, making strscpy() sufficient for safely copying 'obj_type'. The additional NUL-padding performed by strscpy_pad() is unnecessary. If the destination buffer has a fixed length, strscpy() automatically determines its size using sizeof() when the argument is omitted. This makes the explicit size arguments unnecessary. No functional changes intended. Signed-off-by: Thorsten Blum Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20250429104149.66334-1-thorsten.blum@linux.dev Signed-off-by: Christophe Leroy --- drivers/bus/fsl-mc/dprc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/bus/fsl-mc/dprc.c b/drivers/bus/fsl-mc/dprc.c index dd1b5c0fb7e2..38d40c09b719 100644 --- a/drivers/bus/fsl-mc/dprc.c +++ b/drivers/bus/fsl-mc/dprc.c @@ -489,7 +489,7 @@ int dprc_set_obj_irq(struct fsl_mc_io *mc_io, cmd_params->irq_addr = cpu_to_le64(irq_cfg->paddr); cmd_params->irq_num = cpu_to_le32(irq_cfg->irq_num); cmd_params->obj_id = cpu_to_le32(obj_id); - strscpy_pad(cmd_params->obj_type, obj_type, 16); + strscpy(cmd_params->obj_type, obj_type); /* send command to mc*/ return mc_send_command(mc_io, &cmd); @@ -561,7 +561,7 @@ int dprc_get_obj_region(struct fsl_mc_io *mc_io, cmd_params = (struct dprc_cmd_get_obj_region *)cmd.params; cmd_params->obj_id = cpu_to_le32(obj_id); cmd_params->region_index = region_index; - strscpy_pad(cmd_params->obj_type, obj_type, 16); + strscpy(cmd_params->obj_type, obj_type); /* send command to mc*/ err = mc_send_command(mc_io, &cmd); From 695d702f42bf4bd335e30f542ca710af081ee2a3 Mon Sep 17 00:00:00 2001 From: Chen Ni Date: Thu, 15 May 2025 16:39:19 +0800 Subject: [PATCH 11/11] soc: fsl: qe: Consolidate chained IRQ handler install/remove Chained irq handlers usually set up handler data as well. irq_set_chained_handler_and_data() can set both under irq_desc->lock. Replace the two calls with one. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20250515083919.3811473-1-nichen@iscas.ac.cn Signed-off-by: Christophe Leroy --- drivers/soc/fsl/qe/qe_ic.c | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/drivers/soc/fsl/qe/qe_ic.c b/drivers/soc/fsl/qe/qe_ic.c index 77bf0e83ffcc..bd74942c7374 100644 --- a/drivers/soc/fsl/qe/qe_ic.c +++ b/drivers/soc/fsl/qe/qe_ic.c @@ -455,13 +455,11 @@ static int qe_ic_init(struct platform_device *pdev) qe_ic_write(qe_ic->regs, QEIC_CICR, 0); - irq_set_handler_data(qe_ic->virq_low, qe_ic); - irq_set_chained_handler(qe_ic->virq_low, low_handler); + irq_set_chained_handler_and_data(qe_ic->virq_low, low_handler, qe_ic); - if (high_handler) { - irq_set_handler_data(qe_ic->virq_high, qe_ic); - irq_set_chained_handler(qe_ic->virq_high, high_handler); - } + if (high_handler) + irq_set_chained_handler_and_data(qe_ic->virq_high, + high_handler, qe_ic); return 0; } static const struct of_device_id qe_ic_ids[] = {