From e637b774416775d09540070ceecf972c59070d90 Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Tue, 29 Sep 2026 14:25:56 +0200 Subject: firmware: arm_scmi: Update ARM_SCMI_HAVE_TRANSPORT rationale Not enabling any transports no longer breaks the build. Fixes: c0397c85b53d0bc6 ("firmware: arm_scmi: Use WARN_ON() to check configured transports") Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/48c4bed8036dcb55f554f513ce2ae61807c5677d.1790684637.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/transports/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/transports/Kconfig b/drivers/firmware/arm_scmi/transports/Kconfig index 0e34fbf25053..6ba0dcb86204 100644 --- a/drivers/firmware/arm_scmi/transports/Kconfig +++ b/drivers/firmware/arm_scmi/transports/Kconfig @@ -5,7 +5,7 @@ config ARM_SCMI_HAVE_TRANSPORT bool help This declares whether at least one SCMI transport has been configured. - Used to trigger a build bug when trying to build SCMI without any + Used to trigger a runtime warning when enabling SCMI without any configured transport. config ARM_SCMI_HAVE_SHMEM -- cgit v1.2.3 From 3b0c8dd5a8d57dd143f31e7a042ad5737663b312 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Mon, 5 Oct 2026 10:53:10 +0100 Subject: firmware: arm_scmi: Avoid protocol devices in exclusive raw mode Since standard protocol devices are created without a driver request, rejecting SCMI driver registration is no longer enough to prevent them from appearing when raw mode is enabled without coexistence. When raw-mode debugfs setup succeeds, scmi_probe() returns success before protocol enumeration, so it does not normally create those devices. That early return is not sufficient: scmi_device_create() is exported and can be called later. Skip protocol-device creation in exclusive raw mode, including named non-transport requests. Keep named transport devices so raw mode can still set up its channels. Share the raw-mode condition and transport name check with the existing bus paths. Cc: Hans de Goede Fixes: aac4e67d6eb9 ("firmware: arm_scmi: Always create devices for standard protocols") Reviewed-by: Hans de Goede Tested-by: Peng Fan #i.MX95 EVK Link: https://patch.msgid.link/20261005-scmi_bus_fixes-v3-1-d9bada32ed38@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/bus.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c index 25197197db8e..f2e2ed56bc32 100644 --- a/drivers/firmware/arm_scmi/bus.c +++ b/drivers/firmware/arm_scmi/bus.c @@ -36,6 +36,12 @@ struct scmi_requested_dev { /* Track globally the SCMI SystemPower protocol device. */ static struct scmi_device *scmi_syspower_registered; +static bool scmi_raw_mode_only(void) +{ + return IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT) && + !IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT_COEX); +} + /** * scmi_protocol_device_request - Helper to request a device * @@ -60,8 +66,7 @@ static int scmi_protocol_device_request(const struct scmi_device_id *id_table) pr_debug("Requesting SCMI device (%s) for protocol %x\n", id_table->name, id_table->protocol_id); - if (IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT) && - !IS_ENABLED(CONFIG_ARM_SCMI_RAW_MODE_SUPPORT_COEX)) { + if (scmi_raw_mode_only()) { pr_warn("SCMI Raw mode active. Rejecting '%s'/0x%02X\n", id_table->name, id_table->protocol_id); return -EINVAL; @@ -210,12 +215,17 @@ scmi_protocol_table_unregister(const struct scmi_device_id *id_table) scmi_protocol_device_unrequest(entry); } -static bool scmi_device_is_transport(const struct scmi_device *scmi_dev) +static bool scmi_device_name_is_transport(const char *name) { - return !strncmp(scmi_dev->name, SCMI_TRANSPORT_DEVNAME_PREFIX, + return !strncmp(name, SCMI_TRANSPORT_DEVNAME_PREFIX, strlen(SCMI_TRANSPORT_DEVNAME_PREFIX)); } +static bool scmi_device_is_transport(const struct scmi_device *scmi_dev) +{ + return scmi_device_name_is_transport(scmi_dev->name); +} + static int __scmi_dev_match_by_id_table(struct scmi_device *scmi_dev, const struct scmi_device_id *id_table, bool skip_transport) @@ -591,6 +601,11 @@ struct scmi_device *scmi_device_create(struct fwnode_handle *fwnode, struct scmi_requested_dev *rdev; struct scmi_device *sdev, *scmi_dev = NULL; + /* Exclusive raw mode still needs transport devices for its channels. */ + if (scmi_raw_mode_only() && + (!name || !scmi_device_name_is_transport(name))) + return NULL; + if (name) return _scmi_device_create(fwnode, parent, protocol, name); -- cgit v1.2.3 From 00e30413150952ba36bda9e691da332a03672ec9 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Mon, 5 Oct 2026 10:53:11 +0100 Subject: firmware: arm_scmi: Skip requests for standard protocol devices The SCMI core creates devices for the standard protocol IDs during protocol enumeration, without waiting for an SCMI driver request. Recording a request for one of these devices also rejects a second driver registering the same protocol/name pair. When the first driver unregisters, unrequesting that pair destroys the core-created device. No other driver can be bound to it at that point, but removing it also removes the device that a later driver could bind to or use for module autoloading. Skip request tracking for standard devices. Keep request tracking and rollback for nonstandard devices unchanged. Reviewed-by: Hans de Goede Tested-by: Peng Fan #i.MX95 EVK Link: https://patch.msgid.link/20261005-scmi_bus_fixes-v3-2-d9bada32ed38@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/bus.c | 77 ++++++++++++++++++++++------------------- 1 file changed, 41 insertions(+), 36 deletions(-) diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c index f2e2ed56bc32..ed5bed545030 100644 --- a/drivers/firmware/arm_scmi/bus.c +++ b/drivers/firmware/arm_scmi/bus.c @@ -186,12 +186,44 @@ static void scmi_protocol_device_unrequest(const struct scmi_device_id *id_table } } +/* Standard protocols table */ +static const struct scmi_device_id scmi_std_id_table[] = { + { SCMI_PROTOCOL_POWER, "genpd" }, + { SCMI_PROTOCOL_SYSTEM, "syspower" }, + { SCMI_PROTOCOL_PERF, "perf" }, + { SCMI_PROTOCOL_PERF, "cpufreq" }, + { SCMI_PROTOCOL_CLOCK, "clocks" }, + { SCMI_PROTOCOL_SENSOR, "hwmon" }, + { SCMI_PROTOCOL_SENSOR, "iiodev" }, + { SCMI_PROTOCOL_RESET, "reset" }, + { SCMI_PROTOCOL_VOLTAGE, "regulator" }, + { SCMI_PROTOCOL_POWERCAP, "powercap" }, + { SCMI_PROTOCOL_PINCTRL, "pinctrl" }, + { SCMI_PROTOCOL_PINCTRL, "pinctrl-imx" }, + { }, +}; + +static bool scmi_device_id_in_std_id_table(const struct scmi_device_id *id) +{ + for (int i = 0; scmi_std_id_table[i].name[0]; i++) { + if (scmi_std_id_table[i].protocol_id == id->protocol_id && + !strcmp(scmi_std_id_table[i].name, id->name)) + return true; + } + + return false; +} + static int scmi_protocol_table_register(const struct scmi_device_id *id_table) { const struct scmi_device_id *entry; int ret; for (entry = id_table; entry->name[0]; entry++) { + /* Skip standard devices as they are created unconditionally */ + if (scmi_device_id_in_std_id_table(entry)) + continue; + ret = scmi_protocol_device_request(entry); if (ret) goto err_unrequest; @@ -200,8 +232,11 @@ static int scmi_protocol_table_register(const struct scmi_device_id *id_table) return 0; err_unrequest: - while (entry != id_table) - scmi_protocol_device_unrequest(--entry); + while (entry != id_table) { + --entry; + if (!scmi_device_id_in_std_id_table(entry)) + scmi_protocol_device_unrequest(entry); + } return ret; } @@ -211,8 +246,10 @@ scmi_protocol_table_unregister(const struct scmi_device_id *id_table) { const struct scmi_device_id *entry; - for (entry = id_table; entry->name[0]; entry++) - scmi_protocol_device_unrequest(entry); + for (entry = id_table; entry->name[0]; entry++) { + if (!scmi_device_id_in_std_id_table(entry)) + scmi_protocol_device_unrequest(entry); + } } static bool scmi_device_name_is_transport(const char *name) @@ -542,34 +579,6 @@ _scmi_device_create(struct fwnode_handle *fwnode, struct device *parent, return sdev; } -/* Standard protocols table */ -static const struct scmi_device_id scmi_std_id_table[] = { - { SCMI_PROTOCOL_POWER, "genpd" }, - { SCMI_PROTOCOL_SYSTEM, "syspower" }, - { SCMI_PROTOCOL_PERF, "perf" }, - { SCMI_PROTOCOL_PERF, "cpufreq" }, - { SCMI_PROTOCOL_CLOCK, "clocks" }, - { SCMI_PROTOCOL_SENSOR, "hwmon" }, - { SCMI_PROTOCOL_SENSOR, "iiodev" }, - { SCMI_PROTOCOL_RESET, "reset" }, - { SCMI_PROTOCOL_VOLTAGE, "regulator" }, - { SCMI_PROTOCOL_POWERCAP, "powercap" }, - { SCMI_PROTOCOL_PINCTRL, "pinctrl" }, - { SCMI_PROTOCOL_PINCTRL, "pinctrl-imx" }, - { }, -}; - -static bool scmi_device_id_in_std_id_table(const struct scmi_device_id *id) -{ - for (int i = 0; scmi_std_id_table[i].name[0]; i++) { - if (scmi_std_id_table[i].protocol_id == id->protocol_id && - !strcmp(scmi_std_id_table[i].name, id->name)) - return true; - } - - return false; -} - /** * scmi_device_create - A method to create one or more SCMI devices * @@ -634,10 +643,6 @@ struct scmi_device *scmi_device_create(struct fwnode_handle *fwnode, /* Walk the list of requested devices for protocol and create them */ list_for_each_entry(rdev, phead, node) { - /* Standard proto matches already have their dev created above */ - if (scmi_device_id_in_std_id_table(rdev->id_table)) - continue; - sdev = _scmi_device_create(fwnode, parent, rdev->id_table->protocol_id, rdev->id_table->name); -- cgit v1.2.3 From 5ac351938cae58c5cd1b356f9d0aae2e243c11ad Mon Sep 17 00:00:00 2001 From: "Rob Herring (Arm)" Date: Mon, 5 Oct 2026 16:05:06 -0500 Subject: arm64: dts: arm: corstone1000-a320: Fix GIC redistributor region size The Arm Corstone1000-A320 has a GICv4 which means the redistributor region should be 4x256KB rather than 512KB. This issue didn't become apparent as SMP was disabled as a work-around in early versions of the FVP. Fixes: 87599f1843d3 ("arm64: dts: arm/corstone1000: Add corstone-1000-a320") Reviewed-by: Liviu Dudau Signed-off-by: Rob Herring (Arm) Link: https://patch.msgid.link/20261005210506.2118052-2-robh@kernel.org Signed-off-by: Sudeep Holla --- arch/arm64/boot/dts/arm/corstone1000-a320.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/boot/dts/arm/corstone1000-a320.dtsi b/arch/arm64/boot/dts/arm/corstone1000-a320.dtsi index f0937914350c..f895a024fc92 100644 --- a/arch/arm64/boot/dts/arm/corstone1000-a320.dtsi +++ b/arch/arm64/boot/dts/arm/corstone1000-a320.dtsi @@ -73,7 +73,7 @@ #size-cells = <1>; interrupt-controller; reg = <0x1c000000 0x10000>, - <0x1c040000 0x80000>; + <0x1c040000 0x100000>; interrupts = ; }; -- cgit v1.2.3 From 685e05f664d64882b466394bbcdae5bfd3e688c4 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Mon, 5 Oct 2026 10:53:12 +0100 Subject: pinctrl: imx: Match the standard SCMI pinctrl device Use the standard "pinctrl" SCMI device name instead of the i.MX-specific "pinctrl-imx" name. Standard devices no longer have exclusive request tracking, so the i.MX and generic pinctrl drivers can register for the same protocol/name pair. Their probe checks select the appropriate driver for the platform. This solves the issue that occurs when both "pinmux" and "pinmux-imx" devices that share the same fwnode as only the first device registered is assigned as the owner of the fwnode. If this owner device fails to probe (e.g., its driver is blocklisted or missing), it never reaches the driver_bound() stage and the system skips cleaning up its supplier links. Even if a alternative device binds successfully, the system still looks to the broken original owner. As a result, all dependent hardware components (I2C, SPI, UART, USB, MMC, PCIe) defer probing forever, halting the boot process. Note that the solution doesn't support same fwnode being shared by multiple devices and associated fw_devlink feature. Cc: Pengutronix Kernel Team Cc: NXP S32 Linux Team Reported-by: Peng Fan Closes: https://lore.kernel.org/all/20260928-driver-core-v1-1-0846bb8e0f32@nxp.com Reviewed-by: Peng Fan Tested-by: Peng Fan #i.MX95 EVK Acked-by: Linus Walleij Link: https://patch.msgid.link/20261005-scmi_bus_fixes-v3-3-d9bada32ed38@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/bus.c | 1 - drivers/pinctrl/freescale/pinctrl-imx-scmi.c | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c index ed5bed545030..eef47d2054cd 100644 --- a/drivers/firmware/arm_scmi/bus.c +++ b/drivers/firmware/arm_scmi/bus.c @@ -199,7 +199,6 @@ static const struct scmi_device_id scmi_std_id_table[] = { { SCMI_PROTOCOL_VOLTAGE, "regulator" }, { SCMI_PROTOCOL_POWERCAP, "powercap" }, { SCMI_PROTOCOL_PINCTRL, "pinctrl" }, - { SCMI_PROTOCOL_PINCTRL, "pinctrl-imx" }, { }, }; diff --git a/drivers/pinctrl/freescale/pinctrl-imx-scmi.c b/drivers/pinctrl/freescale/pinctrl-imx-scmi.c index 613552e35070..b259a526ccc1 100644 --- a/drivers/pinctrl/freescale/pinctrl-imx-scmi.c +++ b/drivers/pinctrl/freescale/pinctrl-imx-scmi.c @@ -354,7 +354,7 @@ static int scmi_pinctrl_imx_probe(struct scmi_device *sdev) } static const struct scmi_device_id scmi_id_table[] = { - { SCMI_PROTOCOL_PINCTRL, "pinctrl-imx" }, + { SCMI_PROTOCOL_PINCTRL, "pinctrl" }, { } }; MODULE_DEVICE_TABLE(scmi, scmi_id_table); -- cgit v1.2.3 From 59d22f7a4dfe9979045391082ad7c8492cb1ad70 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Mon, 5 Oct 2026 10:53:13 +0100 Subject: firmware: arm_scmi: Skip unused performance-domain devices The SCMI performance-domain driver uses the named "perf" device only when its firmware node declares #power-domain-cells. Otherwise its probe returns without registering a provider, while the same SCMI protocol may still be needed by the separate "cpufreq" device. Do not create the "perf" device when the provider property is absent. This avoids an unnecessary device claiming the protocol fwnode and leaves cpufreq creation unchanged. Update the device-creation contract to document that an intentionally omitted named device returns NULL. Reviewed-by: Hans de Goede Tested-by: Peng Fan #i.MX95 EVK Link: https://patch.msgid.link/20261005-scmi_bus_fixes-v3-4-d9bada32ed38@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/bus.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_scmi/bus.c b/drivers/firmware/arm_scmi/bus.c index eef47d2054cd..7613ea2893ef 100644 --- a/drivers/firmware/arm_scmi/bus.c +++ b/drivers/firmware/arm_scmi/bus.c @@ -570,6 +570,11 @@ _scmi_device_create(struct fwnode_handle *fwnode, struct device *parent, { struct scmi_device *sdev; + /* The perf device is only needed when it provides power domains. */ + if (protocol == SCMI_PROTOCOL_PERF && !strcmp(name, "perf") && + !fwnode_property_present(fwnode, "#power-domain-cells")) + return NULL; + sdev = __scmi_device_create(fwnode, parent, protocol, name); if (!sdev) pr_err("(%pfwf) Failed to create device - protocol 0x%x (%s)\n", @@ -596,10 +601,8 @@ _scmi_device_create(struct fwnode_handle *fwnode, struct device *parent, * * Return: The created device (or one of them if @name was NOT provided and * multiple devices were created) or NULL if no device was created; - * note that NULL indicates an error ONLY in case a specific @name - * was provided: when @name param was not provided, a number of devices - * could have been potentially created for a whole protocol, unless no - * device was found to have been requested for that specific protocol. + * note that NULL can also indicate that a named device is not needed + * for this fwnode, or that no device was requested when @name is NULL. */ struct scmi_device *scmi_device_create(struct fwnode_handle *fwnode, struct device *parent, int protocol, -- cgit v1.2.3 From 16ca2aea66b12c898df8d1a3a138ccc3025fe38d Mon Sep 17 00:00:00 2001 From: Geert Uytterhoeven Date: Fri, 16 Oct 2026 10:03:54 +0200 Subject: firmware: arm_scmi: Fix grammar s/thing/things/ Fix grammar in the help text for the ARM_SCMI_RAW_MODE_SUPPORT_COEX symbol. Signed-off-by: Geert Uytterhoeven Link: https://patch.msgid.link/5128072dc75dbf239dff6c967a88060a4d64b3c0.1792137751.git.geert+renesas@glider.be Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/Kconfig b/drivers/firmware/arm_scmi/Kconfig index 783c24a20e29..9f6241efd592 100644 --- a/drivers/firmware/arm_scmi/Kconfig +++ b/drivers/firmware/arm_scmi/Kconfig @@ -52,7 +52,7 @@ config ARM_SCMI_RAW_MODE_SUPPORT_COEX Allow SCMI Raw transmission mode to coexist with normal SCMI stack. This will allow regular SCMI drivers to register with the core and - operate normally, thing which could make an SCMI test suite using the + operate normally, things which could make an SCMI test suite using the SCMI Raw mode support unreliable. If unsure, say N. config ARM_SCMI_DEBUG_COUNTERS -- cgit v1.2.3 From 8ab2e426762d199ce8b799d029edafbfb981f5c6 Mon Sep 17 00:00:00 2001 From: David Cemin Date: Tue, 20 Oct 2026 15:09:01 -0700 Subject: firmware: arm_ffa: Compare notify_id when looking up notifier callbacks The notifier callbacks are kept in a hash table keyed by notification ID, but struct notifier_cb_info does not store the ID and none of the lookup helpers compare it. hash_for_each_possible() walks the whole bucket, so any two IDs that hash to the same bucket are treated as the same registration. With the 64-bucket table, hash_32() maps IDs 2 and 36 to the same bucket. A driver that requests notifications sequentially therefore fails at the 37th request: ARM FF-A: Failed to register callback for 36 - -22 because update_notifier_cb() finds the node registered for ID 2 and rejects the new registration as a duplicate. The same lookup is used on the delivery path, so a notification for a colliding ID can also be dispatched to the callback registered for the other ID. Store the notification ID in the node and compare it in all three lookup helpers. This was found on an arm64 laptop whose embedded controller partition declares 38 notifications: the EC driver failed to probe and every EC event (AC, battery, lid, hotkeys) was lost. Fixes: e0573444edbf ("firmware: arm_ffa: Add interfaces to request notification callbacks") Fixes: c10debfe7f02 ("firmware: arm_ffa: Add support for {un,}registration of framework notifications") Signed-off-by: David Cemin Link: https://patch.msgid.link/20261020220902.611138-1-dcemin@nvidia.com Signed-off-by: Sudeep Holla --- drivers/firmware/arm_ffa/driver.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/firmware/arm_ffa/driver.c b/drivers/firmware/arm_ffa/driver.c index 28abc808fd32..ae8cc3a2ba2e 100644 --- a/drivers/firmware/arm_ffa/driver.c +++ b/drivers/firmware/arm_ffa/driver.c @@ -1223,6 +1223,7 @@ struct notifier_cb_info { ffa_fwk_notifier_cb fwk_cb; ffa_notifier_cb cb; void *cb_data; + u16 notify_id; }; static int @@ -1302,7 +1303,8 @@ notifier_hnode_get_by_vmid(u16 notify_id, int vmid) struct notifier_cb_info *node; hash_for_each_possible(drv_info->notifier_hash, node, hnode, notify_id) - if (node->fwk_cb && vmid == node->dev->vm_id) + if (node->notify_id == notify_id && node->fwk_cb && + vmid == node->dev->vm_id) return node; return NULL; @@ -1317,7 +1319,8 @@ notifier_hnode_get_by_vmid_uuid(u16 notify_id, int vmid, const uuid_t *uuid) return notifier_hnode_get_by_vmid(notify_id, vmid); hash_for_each_possible(drv_info->notifier_hash, node, hnode, notify_id) - if (node->fwk_cb && vmid == node->dev->vm_id && + if (node->notify_id == notify_id && node->fwk_cb && + vmid == node->dev->vm_id && uuid_equal(&node->dev->uuid, uuid)) return node; @@ -1330,7 +1333,8 @@ notifier_hnode_get_by_type(u16 notify_id, enum notify_type type) struct notifier_cb_info *node; hash_for_each_possible(drv_info->notifier_hash, node, hnode, notify_id) - if (node->cb && type == ffa_notify_type_get(node->dev->vm_id)) + if (node->notify_id == notify_id && node->cb && + type == ffa_notify_type_get(node->dev->vm_id)) return node; return NULL; @@ -1422,6 +1426,7 @@ static int __ffa_notify_request(struct ffa_device *dev, bool is_per_vcpu, cb_info->dev = dev; cb_info->cb_data = cb_data; + cb_info->notify_id = notify_id; if (is_framework) cb_info->fwk_cb = cb; else -- cgit v1.2.3 From 6cc03818814aa98c3584a346b82165f1b561f2b7 Mon Sep 17 00:00:00 2001 From: Julian Braha Date: Tue, 20 Oct 2026 23:28:16 +0100 Subject: firmware: smccc: Provide stubs for HAVE_ARM_SMCCC_DISCOVERY=n Add fallbacks for callers to avoid needing #ifdef guards when HAVE_ARM_SMCCC_DISCOVERY is disabled (32-bit arm). Fixes: 35727af2b15d ("irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4") Suggested-by: Marc Zyngier Signed-off-by: Julian Braha Reviewed-by: Marc Zyngier Link: https://patch.msgid.link/20261020222817.1231643-2-julianbraha@gmail.com Signed-off-by: Sudeep Holla --- include/linux/arm-smccc.h | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h index 4de81848fe2e..75f9d3f1723b 100644 --- a/include/linux/arm-smccc.h +++ b/include/linux/arm-smccc.h @@ -324,6 +324,7 @@ enum arm_smccc_conduit { SMCCC_CONDUIT_HVC, }; +#ifdef CONFIG_HAVE_ARM_SMCCC_DISCOVERY /** * arm_smccc_1_1_get_conduit() * @@ -363,6 +364,12 @@ s32 arm_smccc_get_soc_id_version(void); * When ARM_SMCCC_ARCH_SOC_ID is not present, returns SMCCC_RET_NOT_SUPPORTED. */ s32 arm_smccc_get_soc_id_revision(void); +#else /* CONFIG_HAVE_ARM_SMCCC_DISCOVERY */ +#define arm_smccc_1_1_get_conduit() SMCCC_CONDUIT_NONE +#define arm_smccc_get_version() 0 +#define arm_smccc_get_soc_id_version() SMCCC_RET_NOT_SUPPORTED +#define arm_smccc_get_soc_id_revision() SMCCC_RET_NOT_SUPPORTED +#endif /* CONFIG_HAVE_ARM_SMCCC_DISCOVERY */ #ifndef __ASSEMBLY__ -- cgit v1.2.3 From 40b097fdfd00516ba9a568ccc10e9f166358ddca Mon Sep 17 00:00:00 2001 From: Julian Braha Date: Tue, 20 Oct 2026 23:28:17 +0100 Subject: irqchip/gic-v3: Select HAVE_ARM_SMCCC_DISCOVERY only on arm64 ARM_PSCI_FW is always enabled for arm64, and the GICv3 driver only uses HAVE_ARM_SMCCC_DISCOVERY to identify the NVIDIA T241, which is arm64 anyway. For ARM_GIC_V3, let's only select HAVE_ARM_SMCCC_DISCOVERY on arm64. Fixes: 35727af2b15d ("irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4") Suggested-by: Marc Zyngier Reviewed-by: Marc Zyngier Acked-by: Thomas Gleixner Signed-off-by: Julian Braha Link: https://patch.msgid.link/20261020222817.1231643-3-julianbraha@gmail.com Signed-off-by: Sudeep Holla --- drivers/irqchip/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/irqchip/Kconfig b/drivers/irqchip/Kconfig index 20b77fbc51ee..dae023fed7d6 100644 --- a/drivers/irqchip/Kconfig +++ b/drivers/irqchip/Kconfig @@ -37,7 +37,7 @@ config ARM_GIC_V3 bool select IRQ_DOMAIN_HIERARCHY select GENERIC_IRQ_EFFECTIVE_AFF_MASK if SMP - select HAVE_ARM_SMCCC_DISCOVERY + select HAVE_ARM_SMCCC_DISCOVERY if ARM64 select IRQ_MSI_IOMMU config ARM_GIC_ITS_PARENT -- cgit v1.2.3 From 7f73b4cb4b3afff60577e5ddc532fd026b55d4e5 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Mon, 26 Oct 2026 10:55:10 +0000 Subject: firmware: arm_scmi: Drop redundant ACPI configuration guard Commit 98b9bfb659a9 ("ACPI: bus: Use acpi/acpi_bus.h without CONFIG_ACPI") makes the ACPI bus helpers and their stubs available through linux/acpi.h for all configurations. Drop the local CONFIG_ACPI conditional around scmi_acpi_device_hid(). ACPI_COMPANION() returns NULL when ACPI is disabled, so the existing "unknown" fallback preserves the current behavior. Fixes: 17b3cdaa7ab4 ("firmware: arm_scmi: Fall back to ACPI HID when "compatible" is absent") Link: https://patch.msgid.link/20261026105510.1778073-1-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/driver.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/firmware/arm_scmi/driver.c b/drivers/firmware/arm_scmi/driver.c index 599d77abc4a9..97985be0f9cf 100644 --- a/drivers/firmware/arm_scmi/driver.c +++ b/drivers/firmware/arm_scmi/driver.c @@ -3107,11 +3107,7 @@ static void scmi_debugfs_common_cleanup(void *d) static const char *scmi_acpi_device_hid(struct acpi_device *adev) { -#ifdef CONFIG_ACPI return adev ? acpi_device_hid(adev) : "unknown"; -#else - return "unknown"; -#endif } static struct scmi_debug_info *scmi_debugfs_common_setup(struct scmi_info *info) -- cgit v1.2.3 From 3baf579ba76613f65b03f43a2f2642340e5fb717 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Wed, 28 Oct 2026 13:05:00 +0000 Subject: firmware: arm_scmi: imx: Track copied syslog words The MISC syslog iterator records the number of returned words plus firmware-reported remaining words in the caller's size output. The debugfs consumer uses that value to dump its fixed-size buffer. A malformed or inconsistent response can therefore make it read beyond the copied data and allocation. Return the accumulated number of words copied into the caller's buffer instead. The generic iterator bounds this count to the initial buffer capacity before processing each response. Reported-by: Sashiko Closes: https://sashiko.dev/#/bug/linux-67e325a9-473e-450a-a2a0-bf4c0c720624 Fixes: 4fa62e80c7db ("firmware: arm_scmi: imx: Support getting syslog of MISC protocol") Reviewed-by: Peng Fan Link: https://patch.msgid.link/20261028130502.2999676-1-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c index 637973fb45e6..0c708b2dd496 100644 --- a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c +++ b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c @@ -438,7 +438,7 @@ static int iter_misc_syslog_update_state(struct scmi_iterator_state *st, st->num_returned = RETURNED(r->numlogflags); st->num_remaining = REMAINING(r->numlogflags); - *p->size = st->num_returned + st->num_remaining; + *p->size = st->desc_index + st->num_returned; return 0; } -- cgit v1.2.3 From 4e3652a0ac715ba7387b072b72eaff76e761aaf9 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Wed, 28 Oct 2026 13:05:01 +0000 Subject: firmware: arm_scmi: imx: Validate MISC control response size scmi_imx_misc_ctrl_get() uses @num to report the number of values returned by firmware, but it did not retain the caller's value as the capacity of @val. A response with more values than the caller allocated was copied into @val unchecked. For example, the MQS regmap callback supplies storage for one value. Retain the input capacity and reject responses exceeding it before copying, then update @num only after a successful copy. Document the in/out @num contract of the exported helper. Reported-by: Sashiko Closes: https://sashiko.dev/#/bug/linux-6897b44a-57fb-4964-95f8-447d0ce526e4 Fixes: 61c9f03e22fc ("firmware: arm_scmi: Add initial support for i.MX MISC protocol") Reviewed-by: Peng Fan Link: https://patch.msgid.link/20261028130502.2999676-2-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c | 16 ++++++++++++---- include/linux/firmware/imx/sm.h | 6 ++++++ 2 files changed, 18 insertions(+), 4 deletions(-) diff --git a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c index 0c708b2dd496..f00f7acba845 100644 --- a/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c +++ b/drivers/firmware/arm_scmi/vendors/imx/imx-sm-misc.c @@ -273,10 +273,16 @@ static int scmi_imx_misc_ctrl_get(const struct scmi_protocol_handle *ph, { struct scmi_imx_misc_ctrl_get_out *out; struct scmi_xfer *t; + u32 num_values, max_values; int ret, i; int max_msg_size = ph->hops->get_max_msg_size(ph); int max_num = (max_msg_size - sizeof(*out)) / sizeof(__le32); + if (!num || !val || !*num) + return -EINVAL; + + max_values = *num; + ret = scmi_imx_misc_ctrl_validate_id(ph, ctrl_id); if (ret) return ret; @@ -290,16 +296,18 @@ static int scmi_imx_misc_ctrl_get(const struct scmi_protocol_handle *ph, ret = ph->xops->do_xfer(ph, t); if (!ret) { out = t->rx.buf; - *num = le32_to_cpu(out->num); + num_values = le32_to_cpu(out->num); - if (*num >= max_num || - *num * sizeof(__le32) > t->rx.len - sizeof(__le32)) { + if (num_values > max_values || num_values >= max_num || + num_values * sizeof(__le32) > t->rx.len - sizeof(__le32)) { ph->xops->xfer_put(ph, t); return -EINVAL; } - for (i = 0; i < *num; i++) + for (i = 0; i < num_values; i++) val[i] = le32_to_cpu(out->val[i]); + + *num = num_values; } ph->xops->xfer_put(ph, t); diff --git a/include/linux/firmware/imx/sm.h b/include/linux/firmware/imx/sm.h index ba5d93bd6158..0aec7da0ae78 100644 --- a/include/linux/firmware/imx/sm.h +++ b/include/linux/firmware/imx/sm.h @@ -29,6 +29,12 @@ #define SCMI_IMX952_CTRL_BYPASS_AUDMIX 8U /* WAKE AUDMIX */ #if IS_ENABLED(CONFIG_IMX_SCMI_MISC_DRV) +/** + * scmi_imx_misc_ctrl_get() - Read an i.MX MISC control + * @id: Control identifier + * @num: On entry, capacity of @val in words; on return, words read + * @val: Buffer for the control value + */ int scmi_imx_misc_ctrl_get(u32 id, u32 *num, u32 *val); int scmi_imx_misc_ctrl_set(u32 id, u32 val); #else -- cgit v1.2.3 From b9bb2eb88037a3823e7abd096b54d0a07d428f90 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Wed, 28 Oct 2026 13:05:02 +0000 Subject: firmware: arm_scmi: Unregister notifier on enable failure scmi_notifier_register() adds the caller's notifier block before enabling the corresponding event at the platform. If enablement fails, the caller receives an error and can free its notifier block. A concurrent registration can retain and later enable the handler, leaving the failed caller's block in its notification chain. Event delivery can then dereference the freed block. Remove the notifier block before dropping the handler reference when event enablement fails. Reported-by: Sashiko Closes: https://sashiko.dev/#/bug/linux-c3c9437c-ba1a-4db6-837f-cb0950d89018 Fixes: e7c215f358a3 ("firmware: arm_scmi: Add notification callbacks-registration") Reviewed-by: Peng Fan Link: https://patch.msgid.link/20261028130502.2999676-3-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/notify.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/notify.c b/drivers/firmware/arm_scmi/notify.c index fb60fb07c0ed..e5de0d29c346 100644 --- a/drivers/firmware/arm_scmi/notify.c +++ b/drivers/firmware/arm_scmi/notify.c @@ -1395,8 +1395,10 @@ static int scmi_notifier_register(const struct scmi_handle *handle, /* Enable events for not pending handlers */ if (!IS_HNDL_PENDING(hndl)) { ret = scmi_event_handler_enable_events(hndl); - if (ret) + if (ret) { + blocking_notifier_chain_unregister(&hndl->chain, nb); scmi_put_handler(ni, hndl); + } } return ret; -- cgit v1.2.3 From 38b6268eae651de1ca31c48b912a55ae3e706b94 Mon Sep 17 00:00:00 2001 From: Sudeep Holla Date: Wed, 28 Oct 2026 15:32:03 +0000 Subject: firmware: arm_scmi: Free mailbox state on mapping failure mailbox_chan_setup() allocates its private state from the SCMI base device before mapping the shared-memory area. If mapping fails while setting up an optional RX channel, the core ignores the RX failure and keeps the base device bound, retaining that devres allocation. Release the private mailbox state before returning the mapping error. Reported-by: Sashiko Closes: https://sashiko.dev/#/bug/linux-fda9bcb5-8255-4157-bbf7-d720bbd86605 Fixes: 1ebc28e9357c ("firmware: arm_scmi: Introduce setup_shmem_iomap") Link: https://patch.msgid.link/20261028153203.3305067-1-sudeep.holla@kernel.org Signed-off-by: Sudeep Holla --- drivers/firmware/arm_scmi/transports/mailbox.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/firmware/arm_scmi/transports/mailbox.c b/drivers/firmware/arm_scmi/transports/mailbox.c index 56af2cb0f424..49c472e2ba27 100644 --- a/drivers/firmware/arm_scmi/transports/mailbox.c +++ b/drivers/firmware/arm_scmi/transports/mailbox.c @@ -206,8 +206,11 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, smbox->shmem = core->shmem->setup_iomap(cinfo, dev, tx, NULL, &smbox->io_ops); - if (IS_ERR(smbox->shmem)) - return PTR_ERR(smbox->shmem); + if (IS_ERR(smbox->shmem)) { + ret = PTR_ERR(smbox->shmem); + devm_kfree(dev, smbox); + return ret; + } cl = &smbox->cl; cl->dev = cdev; -- cgit v1.2.3