<feed xmlns='http://www.w3.org/2005/Atom'>
<title>blaster4385/linux-IllusionX/drivers/firmware/arm_scmi, branch v6.12.1</title>
<subtitle>Linux kernel with personal config changes for arch linux</subtitle>
<id>http://git.tablaster.dev/blaster4385/linux-IllusionX/atom?h=v6.12.1</id>
<link rel='self' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/atom?h=v6.12.1'/>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/'/>
<updated>2024-11-15T18:20:17Z</updated>
<entry>
<title>Merge tag 'pmdomain-v6.12-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm</title>
<updated>2024-11-15T18:20:17Z</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2024-11-15T18:20:17Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=1b597e1cf0a226ff1a3b0e117238cfe6c5168de9'/>
<id>urn:sha1:1b597e1cf0a226ff1a3b0e117238cfe6c5168de9</id>
<content type='text'>
Pull pmdomain fixes from Ulf Hansson:
 "pmdomain core:
   - Add GENPD_FLAG_DEV_NAME_FW flag to generate unique names

  pmdomain providers:
   - arm: Use FLAG_DEV_NAME_FW to ensure unique names
   - imx93-blk-ctrl: Fix the remove path

  arm_scmi/qcom-cpucp:
   - Report duplicate OPPs as firmware bugs for arm_scmi
   - Skip OPP duplicates for arm_scmi
   - Mark the qcom-cpucp mailbox irq with IRQF_NO_SUSPEND flag"

* tag 'pmdomain-v6.12-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/linux-pm:
  mailbox: qcom-cpucp: Mark the irq with IRQF_NO_SUSPEND flag
  firmware: arm_scmi: Report duplicate opps as firmware bugs
  firmware: arm_scmi: Skip opp duplicates
  pmdomain: imx93-blk-ctrl: correct remove path
  pmdomain: arm: Use FLAG_DEV_NAME_FW to ensure unique names
  pmdomain: core: Add GENPD_FLAG_DEV_NAME_FW flag
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Report duplicate opps as firmware bugs</title>
<updated>2024-11-12T18:45:25Z</updated>
<author>
<name>Sibi Sankar</name>
<email>quic_sibis@quicinc.com</email>
</author>
<published>2024-10-30T12:55:09Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=e2261bb81e0db86c3c866734cf93232a58464ecd'/>
<id>urn:sha1:e2261bb81e0db86c3c866734cf93232a58464ecd</id>
<content type='text'>
Duplicate opps reported by buggy SCP firmware currently show up
as warnings even though the only functional impact is that the
level/index remain inaccessible. Make it less scary for the end
user by using dev_info instead, along with FW_BUG tag.

Suggested-by: Johan Hovold &lt;johan+linaro@kernel.org&gt;
Signed-off-by: Sibi Sankar &lt;quic_sibis@quicinc.com&gt;
Reviewed-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Reviewed-by: Florian Fainelli &lt;florian.fainelli@broadcom.com&gt;
Reviewed-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
Cc: stable@vger.kernel.org
Message-ID: &lt;20241030125512.2884761-4-quic_sibis@quicinc.com&gt;
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Skip opp duplicates</title>
<updated>2024-11-12T18:45:25Z</updated>
<author>
<name>Cristian Marussi</name>
<email>cristian.marussi@arm.com</email>
</author>
<published>2024-10-30T12:55:08Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=5d8a766226587d111620df520dd9239c009cb154'/>
<id>urn:sha1:5d8a766226587d111620df520dd9239c009cb154</id>
<content type='text'>
Buggy firmware can reply with duplicated PERF opps descriptors.

Ensure that the bad duplicates reported by the platform firmware doesn't
get added to the opp-tables.

Reported-by: Johan Hovold &lt;johan+linaro@kernel.org&gt;
Closes: https://lore.kernel.org/lkml/ZoQjAWse2YxwyRJv@hovoldconsulting.com/
Signed-off-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Tested-by: Johan Hovold &lt;johan+linaro@kernel.org&gt;
Reviewed-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
Cc: stable@vger.kernel.org
Message-ID: &lt;20241030125512.2884761-3-quic_sibis@quicinc.com&gt;
Signed-off-by: Ulf Hansson &lt;ulf.hansson@linaro.org&gt;
</content>
</entry>
<entry>
<title>Merge tag 'scmi-fixes-6.12-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into HEAD</title>
<updated>2024-11-01T14:48:07Z</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2024-11-01T14:48:06Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=c3b56da655a6725e58c5c3cd1877a2f781e8b797'/>
<id>urn:sha1:c3b56da655a6725e58c5c3cd1877a2f781e8b797</id>
<content type='text'>
Arm SCMI fixes for v6.12(part 2)

Couple of fixes to address slab-use-after-free in scmi_bus_notifier()
via scmi_dev-&gt;name and possible incorrect clear channel transport
operation on A2P channel if some sort of P2A only messages are initiated
on A2P channel(occurs when stress tested passing /dev/random to the
channel).

Apart from this, there are fixes to address missing "arm" prefix in the
recently added property max-rx-timeout-ms which was missed in the review
but was identified when further additions to the same binding were
getting reviewed.

* tag 'scmi-fixes-6.12-2' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Use vendor string in max-rx-timeout-ms
  dt-bindings: firmware: arm,scmi: Add missing vendor string
  firmware: arm_scmi: Reject clear channel request on A2P
  firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()

Link: https://lore.kernel.org/r/20241031172734.3109140-1-sudeep.holla@arm.com
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Use vendor string in max-rx-timeout-ms</title>
<updated>2024-10-28T14:49:27Z</updated>
<author>
<name>Cristian Marussi</name>
<email>cristian.marussi@arm.com</email>
</author>
<published>2024-10-28T12:01:51Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=54962707f8b8b53812d3d7fca279a68c6e18faae'/>
<id>urn:sha1:54962707f8b8b53812d3d7fca279a68c6e18faae</id>
<content type='text'>
The original optional property was missing a vendor string prefix; this
has been rectified.

Fix the naming of such optional property in code too.

Cc: Peng Fan &lt;peng.fan@nxp.com&gt;
Fixes: 1780e411ef94 ("firmware: arm_scmi: Use max-rx-timeout-ms from devicetree")
Signed-off-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Message-Id: &lt;20241028120151.1301177-8-cristian.marussi@arm.com&gt;
Signed-off-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Reject clear channel request on A2P</title>
<updated>2024-10-22T08:55:28Z</updated>
<author>
<name>Cristian Marussi</name>
<email>cristian.marussi@arm.com</email>
</author>
<published>2024-10-21T17:15:44Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=a0a18e91eb3a6ef75a6de69dc00f206b913e3848'/>
<id>urn:sha1:a0a18e91eb3a6ef75a6de69dc00f206b913e3848</id>
<content type='text'>
The clear channel transport operation is supposed to be called exclusively
on the P2A channel from the agent, since it relinquishes the ownership of
the channel to the platform, after this latter has initiated some sort of
P2A communication.

Make sure that, if it is ever called on a A2P, is logged and ignored.

Signed-off-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Reviewed-by: Florian Fainelli &lt;florian.fainelli@broadcom.com&gt;
Message-Id: &lt;20241021171544.2579551-1-cristian.marussi@arm.com&gt;
Signed-off-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier()</title>
<updated>2024-10-22T08:53:51Z</updated>
<author>
<name>Xinqi Zhang</name>
<email>quic_xinqzhan@quicinc.com</email>
</author>
<published>2024-10-16T06:13:38Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=295416091e44806760ccf753aeafdafc0ae268f3'/>
<id>urn:sha1:295416091e44806760ccf753aeafdafc0ae268f3</id>
<content type='text'>
The scmi_dev-&gt;name is released prematurely in __scmi_device_destroy(),
which causes slab-use-after-free when accessing scmi_dev-&gt;name in
scmi_bus_notifier(). So move the release of scmi_dev-&gt;name to
scmi_device_release() to avoid slab-use-after-free.

  |  BUG: KASAN: slab-use-after-free in strncmp+0xe4/0xec
  |  Read of size 1 at addr ffffff80a482bcc0 by task swapper/0/1
  |
  |  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 6.6.38-debug #1
  |  Hardware name: Qualcomm Technologies, Inc. SA8775P Ride (DT)
  |  Call trace:
  |   dump_backtrace+0x94/0x114
  |   show_stack+0x18/0x24
  |   dump_stack_lvl+0x48/0x60
  |   print_report+0xf4/0x5b0
  |   kasan_report+0xa4/0xec
  |   __asan_report_load1_noabort+0x20/0x2c
  |   strncmp+0xe4/0xec
  |   scmi_bus_notifier+0x5c/0x54c
  |   notifier_call_chain+0xb4/0x31c
  |   blocking_notifier_call_chain+0x68/0x9c
  |   bus_notify+0x54/0x78
  |   device_del+0x1bc/0x840
  |   device_unregister+0x20/0xb4
  |   __scmi_device_destroy+0xac/0x280
  |   scmi_device_destroy+0x94/0xd0
  |   scmi_chan_setup+0x524/0x750
  |   scmi_probe+0x7fc/0x1508
  |   platform_probe+0xc4/0x19c
  |   really_probe+0x32c/0x99c
  |   __driver_probe_device+0x15c/0x3c4
  |   driver_probe_device+0x5c/0x170
  |   __driver_attach+0x1c8/0x440
  |   bus_for_each_dev+0xf4/0x178
  |   driver_attach+0x3c/0x58
  |   bus_add_driver+0x234/0x4d4
  |   driver_register+0xf4/0x3c0
  |   __platform_driver_register+0x60/0x88
  |   scmi_driver_init+0xb0/0x104
  |   do_one_initcall+0xb4/0x664
  |   kernel_init_freeable+0x3c8/0x894
  |   kernel_init+0x24/0x1e8
  |   ret_from_fork+0x10/0x20
  |
  |  Allocated by task 1:
  |   kasan_save_stack+0x2c/0x54
  |   kasan_set_track+0x2c/0x40
  |   kasan_save_alloc_info+0x24/0x34
  |   __kasan_kmalloc+0xa0/0xb8
  |   __kmalloc_node_track_caller+0x6c/0x104
  |   kstrdup+0x48/0x84
  |   kstrdup_const+0x34/0x40
  |   __scmi_device_create.part.0+0x8c/0x408
  |   scmi_device_create+0x104/0x370
  |   scmi_chan_setup+0x2a0/0x750
  |   scmi_probe+0x7fc/0x1508
  |   platform_probe+0xc4/0x19c
  |   really_probe+0x32c/0x99c
  |   __driver_probe_device+0x15c/0x3c4
  |   driver_probe_device+0x5c/0x170
  |   __driver_attach+0x1c8/0x440
  |   bus_for_each_dev+0xf4/0x178
  |   driver_attach+0x3c/0x58
  |   bus_add_driver+0x234/0x4d4
  |   driver_register+0xf4/0x3c0
  |   __platform_driver_register+0x60/0x88
  |   scmi_driver_init+0xb0/0x104
  |   do_one_initcall+0xb4/0x664
  |   kernel_init_freeable+0x3c8/0x894
  |   kernel_init+0x24/0x1e8
  |   ret_from_fork+0x10/0x20
  |
  |  Freed by task 1:
  |   kasan_save_stack+0x2c/0x54
  |   kasan_set_track+0x2c/0x40
  |   kasan_save_free_info+0x38/0x5c
  |   __kasan_slab_free+0xe8/0x164
  |   __kmem_cache_free+0x11c/0x230
  |   kfree+0x70/0x130
  |   kfree_const+0x20/0x40
  |   __scmi_device_destroy+0x70/0x280
  |   scmi_device_destroy+0x94/0xd0
  |   scmi_chan_setup+0x524/0x750
  |   scmi_probe+0x7fc/0x1508
  |   platform_probe+0xc4/0x19c
  |   really_probe+0x32c/0x99c
  |   __driver_probe_device+0x15c/0x3c4
  |   driver_probe_device+0x5c/0x170
  |   __driver_attach+0x1c8/0x440
  |   bus_for_each_dev+0xf4/0x178
  |   driver_attach+0x3c/0x58
  |   bus_add_driver+0x234/0x4d4
  |   driver_register+0xf4/0x3c0
  |   __platform_driver_register+0x60/0x88
  |   scmi_driver_init+0xb0/0x104
  |   do_one_initcall+0xb4/0x664
  |   kernel_init_freeable+0x3c8/0x894
  |   kernel_init+0x24/0x1e8
  |   ret_from_fork+0x10/0x20

Fixes: ee7a9c9f67c5 ("firmware: arm_scmi: Add support for multiple device per protocol")
Signed-off-by: Xinqi Zhang &lt;quic_xinqzhan@quicinc.com&gt;
Reviewed-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Reviewed-by: Bjorn Andersson &lt;andersson@kernel.org&gt;
Message-Id: &lt;20241016-fix-arm-scmi-slab-use-after-free-v2-1-1783685ef90d@quicinc.com&gt;
Signed-off-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
</content>
</entry>
<entry>
<title>Merge tag 'scmi-fixes-6.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes</title>
<updated>2024-10-15T20:39:43Z</updated>
<author>
<name>Arnd Bergmann</name>
<email>arnd@arndb.de</email>
</author>
<published>2024-10-15T20:39:42Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=1b59d6c19c2ca4e705effee5c2f68fd8ab307c90'/>
<id>urn:sha1:1b59d6c19c2ca4e705effee5c2f68fd8ab307c90</id>
<content type='text'>
Arm SCMI fixes for v6.12

Couple of fixes to address the issues found and reported on Broadcom
STB platforms following the recent refactor of all the SCMI transports
as standalone drivers.

One of the issue is that the effective timeout value is much less than
the intended value due to the way mailbox messages are queues in the
mailbox framework. Since we block or serialise the shmem access anyway,
there is no point in utilizing mailbox queues. The issue is fixed with
exclusive lock on the channel when sending the message.

The other issues is actually non-issue for upstream, but the workaround
is just changing the link order of the transport drivers which enables
Broadcom STB platforms to run both upstream and custom downstream kernel
without any device tree changes. So pushing this to help them test upstream
seamlessly as it has no practical or theoretical impact for others.

There is also a fix to address possible double freeing of the name string
in scmi_debugfs_common_cleanup() when devm_add_action_or_reset() fails.

* tag 'scmi-fixes-6.12' of https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Queue in scmi layer for mailbox implementation
  firmware: arm_scmi: Give SMC transport precedence over mailbox
  firmware: arm_scmi: Fix the double free in scmi_debugfs_common_setup()

Link: https://lore.kernel.org/r/20241015185128.1000604-1-sudeep.holla@arm.com
Signed-off-by: Arnd Bergmann &lt;arnd@arndb.de&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Queue in scmi layer for mailbox implementation</title>
<updated>2024-10-14T20:36:46Z</updated>
<author>
<name>Justin Chen</name>
<email>justin.chen@broadcom.com</email>
</author>
<published>2024-10-14T16:07:17Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=da1642bc97c4ef67f347edcd493bd0a52f88777b'/>
<id>urn:sha1:da1642bc97c4ef67f347edcd493bd0a52f88777b</id>
<content type='text'>
send_message() does not block in the MBOX implementation. This is
because the mailbox layer has its own queue. However, this confuses
the per xfer timeouts as they all start their timeout ticks in
parallel.

Consider a case where the xfer timeout is 30ms and a SCMI transaction
takes 25ms:

  | 0ms: Message #0 is queued in mailbox layer and sent out, then sits
  |      at scmi_wait_for_message_response() with a timeout of 30ms
  | 1ms: Message #1 is queued in mailbox layer but not sent out yet.
  |      Since send_message() doesn't block, it also sits at
  |      scmi_wait_for_message_response() with a timeout of 30ms
  |  ...
  | 25ms: Message #0 is completed, txdone is called and message #1 is sent
  | 31ms: Message #1 times out since the count started at 1ms. Even though
  |       it has only been inflight for 6ms.

Fixes: 5c8a47a5a91d ("firmware: arm_scmi: Make scmi core independent of the transport type")
Signed-off-by: Justin Chen &lt;justin.chen@broadcom.com&gt;
Message-Id: &lt;20241014160717.1678953-1-justin.chen@broadcom.com&gt;
Reviewed-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Tested-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Signed-off-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
</content>
</entry>
<entry>
<title>firmware: arm_scmi: Give SMC transport precedence over mailbox</title>
<updated>2024-10-11T15:52:42Z</updated>
<author>
<name>Florian Fainelli</name>
<email>florian.fainelli@broadcom.com</email>
</author>
<published>2024-10-07T23:54:13Z</published>
<link rel='alternate' type='text/html' href='http://git.tablaster.dev/blaster4385/linux-IllusionX/commit/?id=db8f0b8088865150e4c9a8b8ffc9abdfd58bc4f7'/>
<id>urn:sha1:db8f0b8088865150e4c9a8b8ffc9abdfd58bc4f7</id>
<content type='text'>
Broadcom STB platforms have for historical reasons included both
"arm,scmi-smc" and "arm,scmi" in their SCMI Device Tree node compatible
string, in that order.

After the commit b53515fa177c ("firmware: arm_scmi: Make MBOX transport
a standalone driver") and with a kernel configuration that enables both
the SMC and the mailbox transports, we would probe the mailbox transport,
but fail to complete since we would not have a mailbox driver available.

With each SCMI transport being a platform driver with its own set of
compatible strings to match, rather than an unique platform driver entry
point, we no longer match from most specific to least specific. There is
also no simple way for the mailbox driver to return -ENODEV and let
another platform driver attempt probing. This leads to a platform with
no SCMI provider, therefore all drivers depending upon SCMI resources
are put on deferred probe forever.

By keeping the SMC transport objects linked first, we can let the
platform driver match the compatible string and probe successfully with
no adverse effects on platforms using the mailbox transport.

This is just the workaround to the issue observed which doesn't have any
impact on the other platforms.

Fixes: b53515fa177c ("firmware: arm_scmi: Make MBOX transport a standalone driver")
Signed-off-by: Florian Fainelli &lt;florian.fainelli@broadcom.com&gt;
Message-Id: &lt;20241007235413.507860-1-florian.fainelli@broadcom.com&gt;
Reviewed-by: Cristian Marussi &lt;cristian.marussi@arm.com&gt;
Signed-off-by: Sudeep Holla &lt;sudeep.holla@arm.com&gt;
</content>
</entry>
</feed>
