From f4aff53c90e48360c91b6d902b935ecbaccb0b62 Mon Sep 17 00:00:00 2001 From: Uwe Kleine-König Date: Tue, 2 Dec 2025 15:09:19 +0100 Subject: bus: fsl-mc: Drop error message in probe function MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The driver core already emits an error message when probe fails, see call_driver_probe() in drivers/base/dd.c. So drop the duplicated error message. Signed-off-by: Uwe Kleine-König Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/52c89497f78839446713a9c5456defce97a74c7d.1764684327.git.u.kleine-koenig@baylibre.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 25845c04e562..0f0a5067f109 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -442,14 +442,7 @@ static int fsl_mc_driver_probe(struct device *dev) mc_drv = to_fsl_mc_driver(dev->driver); - error = mc_drv->probe(mc_dev); - if (error < 0) { - if (error != -EPROBE_DEFER) - dev_err(dev, "%s failed: %d\n", __func__, error); - return error; - } - - return 0; + return mc_drv->probe(mc_dev); } static int fsl_mc_driver_remove(struct device *dev) -- cgit v1.2.3 From c8dff80a3108a2cb85ac7ac5b1a75c247ac55fd2 Mon Sep 17 00:00:00 2001 From: Uwe Kleine-König Date: Tue, 2 Dec 2025 15:09:20 +0100 Subject: bus: fsl-mc: Convert to bus callbacks MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit With the eventual goal to drop .probe(), .remove() and .shutdown() from struct device_driver, convert the fsl bus to use bus methods. Other than a driver's shutdown callback the bus shutdown callback is also called for unbound drivers. So check for the device being bound before following the pointer to its driver. Signed-off-by: Uwe Kleine-König Reviewed-by: Greg Kroah-Hartman Tested-by: Ioana Ciornei Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/848fffe5c479d899c04a4c99ccb5f0128ccc942d.1764684327.git.u.kleine-koenig@baylibre.com Link: https://lore.kernel.org/r/20251209115950.3382308-2-u.kleine-koenig@baylibre.com [chleroy: squashed the two patches] Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 70 +++++++++++++++++++---------------------- 1 file changed, 32 insertions(+), 38 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 0f0a5067f109..c08c04047ae2 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -137,6 +137,35 @@ static int fsl_mc_bus_uevent(const struct device *dev, struct kobj_uevent_env *e return 0; } +static int fsl_mc_probe(struct device *dev) +{ + struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); + struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + + if (mc_drv->probe) + return mc_drv->probe(mc_dev); + + return 0; +} + +static void fsl_mc_remove(struct device *dev) +{ + struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); + struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + + if (mc_drv->remove) + mc_drv->remove(mc_dev); +} + +static void fsl_mc_shutdown(struct device *dev) +{ + struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); + struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + + if (dev->driver && mc_drv->shutdown) + mc_drv->shutdown(mc_dev); +} + static int fsl_mc_dma_configure(struct device *dev) { const struct device_driver *drv = READ_ONCE(dev->driver); @@ -314,6 +343,9 @@ const struct bus_type fsl_mc_bus_type = { .name = "fsl-mc", .match = fsl_mc_bus_match, .uevent = fsl_mc_bus_uevent, + .probe = fsl_mc_probe, + .remove = fsl_mc_remove, + .shutdown = fsl_mc_shutdown, .dma_configure = fsl_mc_dma_configure, .dma_cleanup = fsl_mc_dma_cleanup, .dev_groups = fsl_mc_dev_groups, @@ -434,35 +466,6 @@ static const struct device_type *fsl_mc_get_device_type(const char *type) return NULL; } -static int fsl_mc_driver_probe(struct device *dev) -{ - struct fsl_mc_driver *mc_drv; - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - int error; - - mc_drv = to_fsl_mc_driver(dev->driver); - - return mc_drv->probe(mc_dev); -} - -static int fsl_mc_driver_remove(struct device *dev) -{ - struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - - mc_drv->remove(mc_dev); - - return 0; -} - -static void fsl_mc_driver_shutdown(struct device *dev) -{ - struct fsl_mc_driver *mc_drv = to_fsl_mc_driver(dev->driver); - struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); - - mc_drv->shutdown(mc_dev); -} - /* * __fsl_mc_driver_register - registers a child device driver with the * MC bus @@ -479,15 +482,6 @@ int __fsl_mc_driver_register(struct fsl_mc_driver *mc_driver, mc_driver->driver.owner = owner; mc_driver->driver.bus = &fsl_mc_bus_type; - if (mc_driver->probe) - mc_driver->driver.probe = fsl_mc_driver_probe; - - if (mc_driver->remove) - mc_driver->driver.remove = fsl_mc_driver_remove; - - if (mc_driver->shutdown) - mc_driver->driver.shutdown = fsl_mc_driver_shutdown; - error = driver_register(&mc_driver->driver); if (error < 0) { pr_err("driver_register() failed for %s: %d\n", -- cgit v1.2.3 From 148891e95014b5dc5878acefa57f1940c281c431 Mon Sep 17 00:00:00 2001 From: Gui-Dong Han Date: Wed, 3 Dec 2025 01:44:38 +0800 Subject: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the device_lock around the read operation. Fixes: 1f86a00c1159 ("bus/fsl-mc: add support for 'driver_override' in the mc-bus") Cc: stable@vger.kernel.org Signed-off-by: Gui-Dong Han Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20251202174438.12658-1-hanguidong02@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index c08c04047ae2..08b99b0b342f 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -231,8 +231,12 @@ static ssize_t driver_override_show(struct device *dev, struct device_attribute *attr, char *buf) { struct fsl_mc_device *mc_dev = to_fsl_mc_device(dev); + ssize_t len; - return sysfs_emit(buf, "%s\n", mc_dev->driver_override); + device_lock(dev); + len = sysfs_emit(buf, "%s\n", mc_dev->driver_override); + device_unlock(dev); + return len; } static DEVICE_ATTR_RW(driver_override); -- cgit v1.2.3 From 66a4ff38d7b213a1278840a754c6d357e7745b24 Mon Sep 17 00:00:00 2001 From: Krzysztof Kozlowski Date: Fri, 2 Jan 2026 13:47:55 +0100 Subject: soc: fsl: qe: Simplify with scoped for each OF child loop Use scoped for-each loop when iterating over device nodes to make code a bit simpler. Signed-off-by: Krzysztof Kozlowski Acked-by: Herve Codina Link: https://lore.kernel.org/r/20260102124754.64122-2-krzysztof.kozlowski@oss.qualcomm.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/qmc.c | 13 ++----------- 1 file changed, 2 insertions(+), 11 deletions(-) diff --git a/drivers/soc/fsl/qe/qmc.c b/drivers/soc/fsl/qe/qmc.c index da5ea6d35618..c4587b32a59b 100644 --- a/drivers/soc/fsl/qe/qmc.c +++ b/drivers/soc/fsl/qe/qmc.c @@ -1284,31 +1284,26 @@ static unsigned int qmc_nb_chans(struct qmc *qmc) static int qmc_of_parse_chans(struct qmc *qmc, struct device_node *np) { - struct device_node *chan_np; struct qmc_chan *chan; const char *mode; u32 chan_id; u64 ts_mask; int ret; - for_each_available_child_of_node(np, chan_np) { + for_each_available_child_of_node_scoped(np, chan_np) { ret = of_property_read_u32(chan_np, "reg", &chan_id); if (ret) { dev_err(qmc->dev, "%pOF: failed to read reg\n", chan_np); - of_node_put(chan_np); return ret; } if (chan_id > 63) { dev_err(qmc->dev, "%pOF: Invalid chan_id\n", chan_np); - of_node_put(chan_np); return -EINVAL; } chan = devm_kzalloc(qmc->dev, sizeof(*chan), GFP_KERNEL); - if (!chan) { - of_node_put(chan_np); + if (!chan) return -ENOMEM; - } chan->id = chan_id; spin_lock_init(&chan->ts_lock); @@ -1319,7 +1314,6 @@ static int qmc_of_parse_chans(struct qmc *qmc, struct device_node *np) if (ret) { dev_err(qmc->dev, "%pOF: failed to read fsl,tx-ts-mask\n", chan_np); - of_node_put(chan_np); return ret; } chan->tx_ts_mask_avail = ts_mask; @@ -1329,7 +1323,6 @@ static int qmc_of_parse_chans(struct qmc *qmc, struct device_node *np) if (ret) { dev_err(qmc->dev, "%pOF: failed to read fsl,rx-ts-mask\n", chan_np); - of_node_put(chan_np); return ret; } chan->rx_ts_mask_avail = ts_mask; @@ -1340,7 +1333,6 @@ static int qmc_of_parse_chans(struct qmc *qmc, struct device_node *np) if (ret && ret != -EINVAL) { dev_err(qmc->dev, "%pOF: failed to read fsl,operational-mode\n", chan_np); - of_node_put(chan_np); return ret; } if (!strcmp(mode, "transparent")) { @@ -1350,7 +1342,6 @@ static int qmc_of_parse_chans(struct qmc *qmc, struct device_node *np) } else { dev_err(qmc->dev, "%pOF: Invalid fsl,operational-mode (%s)\n", chan_np, mode); - of_node_put(chan_np); return -EINVAL; } -- cgit v1.2.3 From f0bcd784e1b76bc3918433f2bd7e52f56f0dcf22 Mon Sep 17 00:00:00 2001 From: "Christophe Leroy (CS GROUP)" Date: Wed, 7 Jan 2026 17:59:09 +0100 Subject: soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports The QUICC Engine provides interrupts for a few I/O ports. This is handled via a separate interrupt ID and managed via a triplet of dedicated registers hosted by the SoC. Implement an interrupt driver for it so that those IRQs can then be linked to the related GPIOs. Link: https://lore.kernel.org/r/63f19db21a91729d91b3df336a56a7eb4206e561.1767804922.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/Makefile | 2 +- drivers/soc/fsl/qe/qe_ports_ic.c | 142 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 143 insertions(+), 1 deletion(-) create mode 100644 drivers/soc/fsl/qe/qe_ports_ic.c diff --git a/drivers/soc/fsl/qe/Makefile b/drivers/soc/fsl/qe/Makefile index ec8506e13113..901a9c40d5eb 100644 --- a/drivers/soc/fsl/qe/Makefile +++ b/drivers/soc/fsl/qe/Makefile @@ -11,4 +11,4 @@ obj-$(CONFIG_UCC_SLOW) += ucc_slow.o obj-$(CONFIG_UCC_FAST) += ucc_fast.o obj-$(CONFIG_QE_TDM) += qe_tdm.o obj-$(CONFIG_QE_USB) += usb.o -obj-$(CONFIG_QE_GPIO) += gpio.o +obj-$(CONFIG_QE_GPIO) += gpio.o qe_ports_ic.o diff --git a/drivers/soc/fsl/qe/qe_ports_ic.c b/drivers/soc/fsl/qe/qe_ports_ic.c new file mode 100644 index 000000000000..61dd09fec6f6 --- /dev/null +++ b/drivers/soc/fsl/qe/qe_ports_ic.c @@ -0,0 +1,142 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * QUICC ENGINE I/O Ports Interrupt Controller + * + * Copyright (c) 2025 Christophe Leroy CS GROUP France (christophe.leroy@csgroup.eu) + */ + +#include +#include +#include + +/* QE IC registers offset */ +#define CEPIER 0x0c +#define CEPIMR 0x10 +#define CEPICR 0x14 + +struct qepic_data { + void __iomem *reg; + struct irq_domain *host; +}; + +static void qepic_mask(struct irq_data *d) +{ + struct qepic_data *data = irq_data_get_irq_chip_data(d); + + clrbits32(data->reg + CEPIMR, 1 << (31 - irqd_to_hwirq(d))); +} + +static void qepic_unmask(struct irq_data *d) +{ + struct qepic_data *data = irq_data_get_irq_chip_data(d); + + setbits32(data->reg + CEPIMR, 1 << (31 - irqd_to_hwirq(d))); +} + +static void qepic_end(struct irq_data *d) +{ + struct qepic_data *data = irq_data_get_irq_chip_data(d); + + out_be32(data->reg + CEPIER, 1 << (31 - irqd_to_hwirq(d))); +} + +static int qepic_set_type(struct irq_data *d, unsigned int flow_type) +{ + struct qepic_data *data = irq_data_get_irq_chip_data(d); + unsigned int vec = (unsigned int)irqd_to_hwirq(d); + + switch (flow_type & IRQ_TYPE_SENSE_MASK) { + case IRQ_TYPE_EDGE_FALLING: + setbits32(data->reg + CEPICR, 1 << (31 - vec)); + return 0; + case IRQ_TYPE_EDGE_BOTH: + case IRQ_TYPE_NONE: + clrbits32(data->reg + CEPICR, 1 << (31 - vec)); + return 0; + } + return -EINVAL; +} + +static struct irq_chip qepic = { + .name = "QEPIC", + .irq_mask = qepic_mask, + .irq_unmask = qepic_unmask, + .irq_eoi = qepic_end, + .irq_set_type = qepic_set_type, +}; + +static int qepic_get_irq(struct irq_desc *desc) +{ + struct qepic_data *data = irq_desc_get_handler_data(desc); + u32 event = in_be32(data->reg + CEPIER); + + if (!event) + return -1; + + return irq_find_mapping(data->host, 32 - ffs(event)); +} + +static void qepic_cascade(struct irq_desc *desc) +{ + generic_handle_irq(qepic_get_irq(desc)); +} + +static int qepic_host_map(struct irq_domain *h, unsigned int virq, irq_hw_number_t hw) +{ + irq_set_chip_data(virq, h->host_data); + irq_set_chip_and_handler(virq, &qepic, handle_fasteoi_irq); + return 0; +} + +static const struct irq_domain_ops qepic_host_ops = { + .map = qepic_host_map, +}; + +static int qepic_probe(struct platform_device *pdev) +{ + struct device *dev = &pdev->dev; + struct qepic_data *data; + int irq; + + data = devm_kzalloc(dev, sizeof(*data), GFP_KERNEL); + if (!data) + return -ENOMEM; + + data->reg = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(data->reg)) + return PTR_ERR(data->reg); + + irq = platform_get_irq(pdev, 0); + if (irq < 0) + return irq; + + data->host = irq_domain_add_linear(dev->of_node, 32, &qepic_host_ops, data); + if (!data->host) + return -ENODEV; + + irq_set_handler_data(irq, data); + irq_set_chained_handler(irq, qepic_cascade); + + return 0; +} + +static const struct of_device_id qepic_match[] = { + { + .compatible = "fsl,mpc8323-qe-ports-ic", + }, + {}, +}; + +static struct platform_driver qepic_driver = { + .driver = { + .name = "qe_ports_ic", + .of_match_table = qepic_match, + }, + .probe = qepic_probe, +}; + +static int __init qepic_init(void) +{ + return platform_driver_register(&qepic_driver); +} +arch_initcall(qepic_init); -- cgit v1.2.3 From 0d069bb381839ba252ecca4031f7eb6f2fc72ab4 Mon Sep 17 00:00:00 2001 From: "Christophe Leroy (CS GROUP)" Date: Wed, 7 Jan 2026 17:59:10 +0100 Subject: dt-bindings: soc: fsl: qe: Add an interrupt controller for QUICC Engine Ports The QUICC Engine provides interrupts for a few I/O ports. This is handled via a separate interrupt ID and managed via a triplet of dedicated registers hosted by the SoC. Implement an interrupt driver for it so that those IRQs can then be linked to the related GPIOs. Acked-by: Conor Dooley Link: https://lore.kernel.org/r/7708243d6cca21004de8b3da87369c06dbee3848.1767804922.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) [moved from bindings/soc/fsl/cpm_qe/ to bindings/interrupt-controller/ while applying] --- .../interrupt-controller/fsl,qe-ports-ic.yaml | 51 ++++++++++++++++++++++ 1 file changed, 51 insertions(+) create mode 100644 Documentation/devicetree/bindings/interrupt-controller/fsl,qe-ports-ic.yaml diff --git a/Documentation/devicetree/bindings/interrupt-controller/fsl,qe-ports-ic.yaml b/Documentation/devicetree/bindings/interrupt-controller/fsl,qe-ports-ic.yaml new file mode 100644 index 000000000000..2b8e7b9c6d7a --- /dev/null +++ b/Documentation/devicetree/bindings/interrupt-controller/fsl,qe-ports-ic.yaml @@ -0,0 +1,51 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/interrupt-controller/fsl,qe-ports-ic.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: Freescale QUICC Engine I/O Ports Interrupt Controller + +maintainers: + - Christophe Leroy (CS GROUP) + +properties: + compatible: + enum: + - fsl,mpc8323-qe-ports-ic + + reg: + maxItems: 1 + + interrupt-controller: true + + '#address-cells': + const: 0 + + '#interrupt-cells': + const: 1 + + interrupts: + maxItems: 1 + +required: + - compatible + - reg + - interrupt-controller + - '#address-cells' + - '#interrupt-cells' + - interrupts + +additionalProperties: false + +examples: + - | + interrupt-controller@c00 { + compatible = "fsl,mpc8323-qe-ports-ic"; + reg = <0xc00 0x18>; + interrupt-controller; + #address-cells = <0>; + #interrupt-cells = <1>; + interrupts = <74 0x8>; + interrupt-parent = <&ipic>; + }; -- cgit v1.2.3 From 65d5727645acbc019fd17d47f47b743eb116ff14 Mon Sep 17 00:00:00 2001 From: Chen Ni Date: Mon, 19 Jan 2026 13:57:15 +0800 Subject: soc: fsl: qe: qe_ports_ic: Consolidate chained IRQ handler install/remove The driver currently sets the handler data and the chained handler in two separate steps. This creates a theoretical race window where an interrupt could fire after the handler is set but before the data is assigned, leading to a NULL pointer dereference. Replace the two calls with irq_set_chained_handler_and_data() to set both the handler and its data atomically under the irq_desc->lock. Signed-off-by: Chen Ni Link: https://lore.kernel.org/r/20260119055715.889001-1-nichen@iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/qe_ports_ic.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/soc/fsl/qe/qe_ports_ic.c b/drivers/soc/fsl/qe/qe_ports_ic.c index 61dd09fec6f6..8e2107e2cde5 100644 --- a/drivers/soc/fsl/qe/qe_ports_ic.c +++ b/drivers/soc/fsl/qe/qe_ports_ic.c @@ -114,8 +114,7 @@ static int qepic_probe(struct platform_device *pdev) if (!data->host) return -ENODEV; - irq_set_handler_data(irq, data); - irq_set_chained_handler(irq, qepic_cascade); + irq_set_chained_handler_and_data(irq, qepic_cascade, data); return 0; } -- cgit v1.2.3 From 52f527d0916bcdd7621a0c9e7e599b133294d495 Mon Sep 17 00:00:00 2001 From: Haoxiang Li Date: Sat, 24 Jan 2026 18:20:54 +0800 Subject: bus: fsl-mc: fix an error handling in fsl_mc_device_add() In fsl_mc_device_add(), device_initialize() is called first. put_device() should be called to drop the reference if error occurs. And other resources would be released via put_device -> fsl_mc_device_release. So remove redundant kfree() in error handling path. Fixes: bbf9d17d9875 ("staging: fsl-mc: Freescale Management Complex (fsl-mc) bus driver") Cc: stable@vger.kernel.org Reported-by: Dan Carpenter Closes: https://lore.kernel.org/all/b767348e-d89c-416e-acea-1ebbff3bea20@stanley.mountain/ Signed-off-by: Su Hui Suggested-by: Christophe Leroy (CS GROUP) Signed-off-by: Haoxiang Li Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260124102054.1613093-1-lihaoxiang@isrc.iscas.ac.cn Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 08b99b0b342f..007223549887 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -896,11 +896,7 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, return 0; error_cleanup_dev: - kfree(mc_dev->regions); - if (mc_bus) - kfree(mc_bus); - else - kfree(mc_dev); + put_device(&mc_dev->dev); return error; } -- cgit v1.2.3