Unverified Commit 1b64daa6 authored by Arnd Bergmann's avatar Arnd Bergmann
Browse files

Merge tag 'scmi-smccc-fixes-6.5' of... 

Merge tag 'scmi-smccc-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes

Arm SCMI and SMCCC fixes for v6.5

Set of fixes addressing issues:
1. Possible use of uninitialised results structure in the SMCCC SOC_ID
   driver if the driver fails to complete the initialisation
2. Missed signed error return value handling from simple_write_to_buffer()
   used in scmi_dbg_raw_mode_common_write()
3. The OF node reference obtained is not dropped if node is incompatible
   with "arm,scmi-shmem" in the mailbox as well as SMC transport channel
   setup
4. The possibility of a late response to an in-flight pending transaction
   that could end up triggering the interrupt handler after the SCMI core
   has cleaned up the transport channel as part of core driver remove

* tag 'scmi-smccc-fixes-6.5' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Fix chan_free cleanup on SMC
  firmware: arm_scmi: Drop OF node reference in the transport channel setup
  firmware: arm_scmi: Fix signed error return values handling
  firmware: smccc: Fix use of uninitialised results structure

Link: https://lore.kernel.org/r/20230721114052.3371923-1-sudeep.holla@arm.com


Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
parents f6ad3c13 d1ff11d7

drivers/firmware/arm_scmi/mailbox.c

+3 −1
Original line number Diff line number Diff line
@@ -166,8 +166,10 @@ static int mailbox_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, 
		return -ENOMEM;



	shmem = of_parse_phandle(cdev->of_node, "shmem", idx);

	if (!of_device_is_compatible(shmem, "arm,scmi-shmem"))

	if (!of_device_is_compatible(shmem, "arm,scmi-shmem")) {

		of_node_put(shmem);

		return -ENXIO;

	}



	ret = of_address_to_resource(shmem, 0, &res);

	of_node_put(shmem);

drivers/firmware/arm_scmi/raw_mode.c

+4 −1
Original line number Diff line number Diff line
@@ -818,10 +818,13 @@ static ssize_t scmi_dbg_raw_mode_common_write(struct file *filp, 
	 * before sending it with a single RAW xfer.

	 */

	if (rd->tx_size < rd->tx_req_size) {

		size_t cnt;

		ssize_t cnt;



		cnt = simple_write_to_buffer(rd->tx.buf, rd->tx.len, ppos,

					     buf, count);

		if (cnt < 0)

			return cnt;



		rd->tx_size += cnt;

		if (cnt < count)

			return cnt;

drivers/firmware/arm_scmi/smc.c

+14 −7
Original line number Diff line number Diff line
@@ -40,6 +40,7 @@ 
/**

 * struct scmi_smc - Structure representing a SCMI smc transport

 *

 * @irq: An optional IRQ for completion

 * @cinfo: SCMI channel info

 * @shmem: Transmit/Receive shared memory area

 * @shmem_lock: Lock to protect access to Tx/Rx shared memory area.
@@ -52,6 +53,7 @@ 
 */



struct scmi_smc {

	int irq;

	struct scmi_chan_info *cinfo;

	struct scmi_shared_mem __iomem *shmem;

	/* Protect access to shmem area */
@@ -127,7 +129,7 @@ static int smc_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, 
	struct resource res;

	struct device_node *np;

	u32 func_id;

	int ret, irq;

	int ret;



	if (!tx)

		return -ENODEV;
@@ -137,8 +139,10 @@ static int smc_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, 
		return -ENOMEM;



	np = of_parse_phandle(cdev->of_node, "shmem", 0);

	if (!of_device_is_compatible(np, "arm,scmi-shmem"))

	if (!of_device_is_compatible(np, "arm,scmi-shmem")) {

		of_node_put(np);

		return -ENXIO;

	}



	ret = of_address_to_resource(np, 0, &res);

	of_node_put(np);
@@ -167,11 +171,10 @@ static int smc_chan_setup(struct scmi_chan_info *cinfo, struct device *dev, 
	 * completion of a message is signaled by an interrupt rather than by

	 * the return of the SMC call.

	 */

	irq = of_irq_get_byname(cdev->of_node, "a2p");

	if (irq > 0) {

		ret = devm_request_irq(dev, irq, smc_msg_done_isr,

				       IRQF_NO_SUSPEND,

				       dev_name(dev), scmi_info);

	scmi_info->irq = of_irq_get_byname(cdev->of_node, "a2p");

	if (scmi_info->irq > 0) {

		ret = request_irq(scmi_info->irq, smc_msg_done_isr,

				  IRQF_NO_SUSPEND, dev_name(dev), scmi_info);

		if (ret) {

			dev_err(dev, "failed to setup SCMI smc irq\n");

			return ret;
@@ -193,6 +196,10 @@ static int smc_chan_free(int id, void *p, void *data) 
	struct scmi_chan_info *cinfo = p;

	struct scmi_smc *scmi_info = cinfo->transport_info;



	/* Ignore any possible further reception on the IRQ path */

	if (scmi_info->irq > 0)

		free_irq(scmi_info->irq, scmi_info);



	cinfo->transport_info = NULL;

	scmi_info->cinfo = NULL;

drivers/firmware/smccc/soc_id.c

+2 −3
Original line number Diff line number Diff line
@@ -34,7 +34,6 @@ static struct soc_device_attribute *soc_dev_attr; 


static int __init smccc_soc_init(void)

{

	struct arm_smccc_res res;

	int soc_id_rev, soc_id_version;

	static char soc_id_str[20], soc_id_rev_str[12];

	static char soc_id_jep106_id_str[12];
@@ -49,13 +48,13 @@ static int __init smccc_soc_init(void) 
	}



	if (soc_id_version < 0) {

		pr_err("ARCH_SOC_ID(0) returned error: %lx\n", res.a0);

		pr_err("Invalid SoC Version: %x\n", soc_id_version);

		return -EINVAL;

	}



	soc_id_rev = arm_smccc_get_soc_id_revision();

	if (soc_id_rev < 0) {

		pr_err("ARCH_SOC_ID(1) returned error: %lx\n", res.a0);

		pr_err("Invalid SoC Revision: %x\n", soc_id_rev);

		return -EINVAL;

	}