From 5af2ccc8ec749d98d3d0bed4b9df25781d7f2d46 Mon Sep 17 00:00:00 2001 From: "Christophe Leroy (CS GROUP)" Date: Fri, 7 Aug 2026 07:35:52 +0200 Subject: [PATCH 01/10] soc: fsl: qe: Fix sparse warnings in GPIO A C=2 build on mpc83xx_defconfig provides following warnings: drivers/soc/fsl/qe/gpio.c:44:34: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:44:34: expected restricted __be32 [usertype] cpdata drivers/soc/fsl/qe/gpio.c:44:34: got unsigned int [usertype] cpdata drivers/soc/fsl/qe/gpio.c:45:34: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:45:34: expected restricted __be32 [usertype] cpdir1 drivers/soc/fsl/qe/gpio.c:45:34: got unsigned int drivers/soc/fsl/qe/gpio.c:46:34: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:46:34: expected restricted __be32 [usertype] cpdir2 drivers/soc/fsl/qe/gpio.c:46:34: got unsigned int drivers/soc/fsl/qe/gpio.c:47:34: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:47:34: expected restricted __be32 [usertype] cppar1 drivers/soc/fsl/qe/gpio.c:47:34: got unsigned int drivers/soc/fsl/qe/gpio.c:48:34: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:48:34: expected restricted __be32 [usertype] cppar2 drivers/soc/fsl/qe/gpio.c:48:34: got unsigned int drivers/soc/fsl/qe/gpio.c:49:33: warning: incorrect type in assignment (different base types) drivers/soc/fsl/qe/gpio.c:49:33: expected restricted __be32 [usertype] cpodr drivers/soc/fsl/qe/gpio.c:49:33: got unsigned int drivers/soc/fsl/qe/gpio.c:297:17: warning: restricted __be32 degrades to integer drivers/soc/fsl/qe/gpio.c:299:17: warning: restricted __be32 degrades to integer drivers/soc/fsl/qe/gpio.c:302:17: warning: restricted __be32 degrades to integer drivers/soc/fsl/qe/gpio.c:304:17: warning: restricted __be32 degrades to integer drivers/soc/fsl/qe/gpio.c:308:18: warning: restricted __be32 degrades to integer drivers/soc/fsl/qe/gpio.c:314:9: warning: restricted __be32 degrades to integer The problem is the 'struct qe_pio_reg' embedded in 'struct qe_gpio_chip' to save register values. As the values are read with ioread32be(), they are now in CPU byte order and can't be stored as-is in a __be32 object. Replace 'struct qe_pio_reg saved_regs' by individual u32 fields. Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608051952.ADkLIB86-lkp@intel.com/ Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202608130908.gEy44F1D-lkp@intel.com/ Link: https://lore.kernel.org/r/6a84b38e766729676b375c93bf54c67ea455288d.1786080840.git.chleroy@kernel.org Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/gpio.c | 38 +++++++++++++++++++------------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c index 5cd59cfbf22f..8e210f8a3b6c 100644 --- a/drivers/soc/fsl/qe/gpio.c +++ b/drivers/soc/fsl/qe/gpio.c @@ -32,8 +32,13 @@ struct qe_gpio_chip { /* shadowed data register to clear/set bits safely */ u32 cpdata; - /* saved_regs used to restore dedicated functions */ - struct qe_pio_regs saved_regs; + /* saved regs used to restore dedicated functions */ + u32 saved_cpodr; + u32 saved_cpdata; + u32 saved_cpdir1; + u32 saved_cpdir2; + u32 saved_cppar1; + u32 saved_cppar2; }; static void qe_gpio_save_regs(struct qe_gpio_chip *qe_gc) @@ -41,12 +46,12 @@ static void qe_gpio_save_regs(struct qe_gpio_chip *qe_gc) struct qe_pio_regs __iomem *regs = qe_gc->regs; qe_gc->cpdata = ioread32be(®s->cpdata); - qe_gc->saved_regs.cpdata = qe_gc->cpdata; - qe_gc->saved_regs.cpdir1 = ioread32be(®s->cpdir1); - qe_gc->saved_regs.cpdir2 = ioread32be(®s->cpdir2); - qe_gc->saved_regs.cppar1 = ioread32be(®s->cppar1); - qe_gc->saved_regs.cppar2 = ioread32be(®s->cppar2); - qe_gc->saved_regs.cpodr = ioread32be(®s->cpodr); + qe_gc->saved_cpdata = qe_gc->cpdata; + qe_gc->saved_cpdir1 = ioread32be(®s->cpdir1); + qe_gc->saved_cpdir2 = ioread32be(®s->cpdir2); + qe_gc->saved_cppar1 = ioread32be(®s->cppar1); + qe_gc->saved_cppar2 = ioread32be(®s->cppar2); + qe_gc->saved_cpodr = ioread32be(®s->cpodr); } static int qe_gpio_get(struct gpio_chip *gc, unsigned int gpio) @@ -284,7 +289,6 @@ void qe_pin_set_dedicated(struct qe_pin *qe_pin) { struct qe_gpio_chip *qe_gc = qe_pin->controller; struct qe_pio_regs __iomem *regs = qe_gc->regs; - struct qe_pio_regs *sregs = &qe_gc->saved_regs; int pin = qe_pin->num; u32 mask1 = 1 << (QE_PIO_PINS - (pin + 1)); u32 mask2 = 0x3 << (QE_PIO_PINS - (pin % (QE_PIO_PINS / 2) + 1) * 2); @@ -294,24 +298,20 @@ void qe_pin_set_dedicated(struct qe_pin *qe_pin) spin_lock_irqsave(&qe_gc->lock, flags); if (second_reg) { - qe_clrsetbits_be32(®s->cpdir2, mask2, - sregs->cpdir2 & mask2); - qe_clrsetbits_be32(®s->cppar2, mask2, - sregs->cppar2 & mask2); + qe_clrsetbits_be32(®s->cpdir2, mask2, qe_gc->saved_cpdir2 & mask2); + qe_clrsetbits_be32(®s->cppar2, mask2, qe_gc->saved_cppar2 & mask2); } else { - qe_clrsetbits_be32(®s->cpdir1, mask2, - sregs->cpdir1 & mask2); - qe_clrsetbits_be32(®s->cppar1, mask2, - sregs->cppar1 & mask2); + qe_clrsetbits_be32(®s->cpdir1, mask2, qe_gc->saved_cpdir1 & mask2); + qe_clrsetbits_be32(®s->cppar1, mask2, qe_gc->saved_cppar1 & mask2); } - if (sregs->cpdata & mask1) + if (qe_gc->saved_cpdata & mask1) qe_gc->cpdata |= mask1; else qe_gc->cpdata &= ~mask1; iowrite32be(qe_gc->cpdata, ®s->cpdata); - qe_clrsetbits_be32(®s->cpodr, mask1, sregs->cpodr & mask1); + qe_clrsetbits_be32(®s->cpodr, mask1, qe_gc->saved_cpodr & mask1); spin_unlock_irqrestore(&qe_gc->lock, flags); } EXPORT_SYMBOL(qe_pin_set_dedicated); From bada60f2d98c7cf252b1f8214e5b6ec96c429588 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Fri, 4 Sep 2026 18:15:36 +0530 Subject: [PATCH 02/10] bus: fsl-mc: fix repeated word 'for' in comment Drop the second 'for', reported by checkpatch.pl as a possible repeated word. Only touches a comment, no code changes. Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Link: https://lore.kernel.org/r/20260904124540.7652-3-hemanth.selam@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-msi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-msi.c b/drivers/bus/fsl-mc/fsl-mc-msi.c index be38b43803de..7d760bfa63c1 100644 --- a/drivers/bus/fsl-mc/fsl-mc-msi.c +++ b/drivers/bus/fsl-mc/fsl-mc-msi.c @@ -57,7 +57,7 @@ static void fsl_mc_write_msi_msg(struct msi_desc *msi_desc, struct msi_msg *msg) } } else { /* - * IRQ is for for a child device of mc_bus_dev + * IRQ is for a child device of mc_bus_dev */ error = dprc_set_obj_irq(mc_bus_dev->mc_io, MC_CMD_FLAG_INTR_DIS | MC_CMD_FLAG_PRI, From f85e5ec18eb104574433caec67f452dd6e02d5de Mon Sep 17 00:00:00 2001 From: Vincent Jardin Date: Fri, 31 Jul 2026 22:13:49 +0200 Subject: [PATCH 03/10] bus: fsl-mc: set dma_mask for the DPRC devices On Layerscape platforms when SMMU is disabled by ATF, the root DPRC probes with its dma_mask pointer unset which leads to a notification: "DMA mask not set" so the device is left with a zero DMA mask instead of a sane default. Let's seed the masks for all cases. It was tested on LX2160A with no SMMU on the MC domain: the warning is gone and the DPAA2 children probe unchanged. Signed-off-by: Vincent Jardin Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260731-for-upstream-fsl-mc-dprc-dma-mask-v2-1-ea7058b90f06@free.fr Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 66a4fa73c5b8..0766ccb68629 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -797,6 +797,10 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, } dev_set_name(&mc_dev->dev, "%s.%d", obj_desc->type, obj_desc->id); + mc_dev->dma_mask = FSL_MC_DEFAULT_DMA_MASK; + mc_dev->dev.dma_mask = &mc_dev->dma_mask; + mc_dev->dev.coherent_dma_mask = mc_dev->dma_mask; + if (strcmp(obj_desc->type, "dprc") == 0) { struct fsl_mc_io *mc_io2; @@ -838,9 +842,6 @@ int fsl_mc_device_add(struct fsl_mc_obj_desc *obj_desc, * parent's ICID. */ mc_dev->icid = parent_mc_dev->icid; - mc_dev->dma_mask = FSL_MC_DEFAULT_DMA_MASK; - mc_dev->dev.dma_mask = &mc_dev->dma_mask; - mc_dev->dev.coherent_dma_mask = mc_dev->dma_mask; } /* From 7e9023a18eec88b716d8d46a29c4207186fbd828 Mon Sep 17 00:00:00 2001 From: Vincent Jardin Date: Wed, 9 Sep 2026 19:04:40 +0200 Subject: [PATCH 04/10] bus: fsl-mc: register the object drivers after misc_class exists Unbinding and re-binding the root DPRC fails with: sysfs: cannot create duplicate filename '/dev/char/10:256' misc_register / fsl_mc_uapi_create_device_file / dprc_setup / dprc_probe It happens when the fsl-mc bus probe is not deferred, without SMMU: - the dprc driver is registered at postcore_initcall, - the DT node is populated at arch_initcall_sync, - the root DPRC probes right there, before misc_init() has registered misc_class at subsys_initcall. misc_register() still succeeds but the device gets no class, so misc_deregister() at unbind cannot find it: the minor is freed while the device and its /sys/dev/char/ link leak, and then the next bind collides on the same minor. Let's move the dprc and allocator drivers registration, and platform_driver_register(), to subsys_initcall_sync, after misc_init() at subsys_initcall. bus_register() and the platform-bus notifier stay at postcore_initcall so that fsl_mc_bus_notifier() still pauses the MC before the SMMU is probed. Cc: stable+noautosel@kernel.org # niche: root DPRC unbind/rebind only Fixes: 2cf1e703f066 ("bus: fsl-mc: add fsl-mc userspace support") Signed-off-by: Vincent Jardin Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20260909-for-upstream-fsl-mc-initcall-order-v2-1-b7a04634fcf1@free.fr Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 40 ++++++++++++++++++++------------- 1 file changed, 24 insertions(+), 16 deletions(-) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 0766ccb68629..5878eafd8d44 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -1265,35 +1265,43 @@ static int __init fsl_mc_bus_driver_init(void) error = bus_register(&fsl_mc_bus_type); if (error < 0) { pr_err("bus type registration failed: %d\n", error); - goto error_cleanup_cache; + return error; } - error = platform_driver_register(&fsl_mc_bus_driver); - if (error < 0) { - pr_err("platform_driver_register() failed: %d\n", error); + error = bus_register_notifier(&platform_bus_type, &fsl_mc_nb); + if (error < 0) goto error_cleanup_bus; - } + + return 0; + +error_cleanup_bus: + bus_unregister(&fsl_mc_bus_type); + return error; +} +postcore_initcall(fsl_mc_bus_driver_init); + +static int __init fsl_mc_bus_drivers_init(void) +{ + int error; error = dprc_driver_init(); if (error < 0) - goto error_cleanup_driver; + return error; error = fsl_mc_allocator_driver_init(); if (error < 0) goto error_cleanup_dprc_driver; - return bus_register_notifier(&platform_bus_type, &fsl_mc_nb); + error = platform_driver_register(&fsl_mc_bus_driver); + if (error < 0) { + pr_err("platform_driver_register() failed: %d\n", error); + goto error_cleanup_dprc_driver; + } + + return 0; error_cleanup_dprc_driver: dprc_driver_exit(); - -error_cleanup_driver: - platform_driver_unregister(&fsl_mc_bus_driver); - -error_cleanup_bus: - bus_unregister(&fsl_mc_bus_type); - -error_cleanup_cache: return error; } -postcore_initcall(fsl_mc_bus_driver_init); +subsys_initcall_sync(fsl_mc_bus_drivers_init); From 31d42d67c6eb66efc058069f426d69abb48ec0dd Mon Sep 17 00:00:00 2001 From: Bartosz Golaszewski Date: Tue, 8 Sep 2026 11:27:46 +0200 Subject: [PATCH 05/10] soc: fsl: qe: drop GPIOD_FLAGS_BIT_NONEXCLUSIVE The GPIOD_FLAGS_BIT_NONEXCLUSIVE flag for gpiod_get() is deprecated. For actually shared GPIOs, it should be replaced by using the functionality provided by gpio-shared-proxy. The Freescale QUICC Engine GPIO driver uses it as a workaround to access the GPIO descriptor already requested by the caller of qe_pin_request() in order to access the private GPIO chip data. As the existing comment itself states, the user already requested this GPIO and the only user in tree is the FHCI USB driver which does in fact request it, we can safely modify the function to take the *exclusive* GPIO descriptor as argument and stop using the deprecated flag. Signed-off-by: Bartosz Golaszewski Acked-by: Greg Kroah-Hartman Link: https://lore.kernel.org/r/20260908-usb-fhci-drop-gpio-nonexclusive-v1-1-8e405dc67874@oss.qualcomm.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/gpio.c | 29 +++++++---------------------- drivers/usb/host/fhci-hcd.c | 2 +- include/soc/fsl/qe/qe.h | 6 ++++-- 3 files changed, 12 insertions(+), 25 deletions(-) diff --git a/drivers/soc/fsl/qe/gpio.c b/drivers/soc/fsl/qe/gpio.c index 8e210f8a3b6c..1b5a1b134596 100644 --- a/drivers/soc/fsl/qe/gpio.c +++ b/drivers/soc/fsl/qe/gpio.c @@ -201,18 +201,17 @@ struct qe_pin { /** * qe_pin_request - Request a QE pin * @dev: device to get the pin from - * @index: index of the pin in the device tree + * @gpiod: GPIO descriptor associated with this pin * Context: non-atomic * * This function return qe_pin so that you could use it with the rest of * the QE Pin Multiplexing API. */ -struct qe_pin *qe_pin_request(struct device *dev, int index) +struct qe_pin *qe_pin_request(struct device *dev, struct gpio_desc *gpiod) { + struct gpio_device *gdev; struct qe_pin *qe_pin; struct gpio_chip *gc; - struct gpio_desc *gpiod; - int gpio_num; int err; qe_pin = kzalloc_obj(*qe_pin); @@ -221,34 +220,20 @@ struct qe_pin *qe_pin_request(struct device *dev, int index) return ERR_PTR(-ENOMEM); } - /* - * Request gpio as nonexclusive as it was likely reserved by the - * caller, and we are not planning on controlling it, we only need - * the descriptor to the to the gpio chip structure. - */ - gpiod = gpiod_get_index(dev, NULL, index, - GPIOD_ASIS | GPIOD_FLAGS_BIT_NONEXCLUSIVE); - err = PTR_ERR_OR_ZERO(gpiod); - if (err) - goto err0; - - gc = gpiod_to_chip(gpiod); - gpio_num = desc_to_gpio(gpiod); - /* We no longer need this descriptor */ - gpiod_put(gpiod); - - if (WARN_ON(!gc)) { + gdev = gpiod_to_gpio_device(gpiod); + if (WARN_ON(!gdev)) { err = -ENODEV; goto err0; } + gc = gpio_device_get_chip(gdev); qe_pin->controller = gpiochip_get_data(gc); /* * FIXME: this gets the local offset on the gpio_chip so that the driver * can manipulate pin control settings through its custom API. The real * solution is to create a real pin control driver for this. */ - qe_pin->num = gpio_num - gc->base; + qe_pin->num = desc_to_gpio(gpiod) - gc->base; if (!fwnode_device_is_compatible(gc->fwnode, "fsl,mpc8323-qe-pario-bank")) { dev_dbg(dev, "%s: tried to get a non-qe pin\n", __func__); diff --git a/drivers/usb/host/fhci-hcd.c b/drivers/usb/host/fhci-hcd.c index 71e785f445a3..d572f0c1dffa 100644 --- a/drivers/usb/host/fhci-hcd.c +++ b/drivers/usb/host/fhci-hcd.c @@ -643,7 +643,7 @@ static int of_fhci_probe(struct platform_device *ofdev) } for (j = 0; j < NUM_PINS; j++) { - fhci->pins[j] = qe_pin_request(dev, j); + fhci->pins[j] = qe_pin_request(dev, fhci->gpiods[j]); if (IS_ERR(fhci->pins[j])) { ret = PTR_ERR(fhci->pins[j]); dev_err(dev, "can't get pin %d: %d\n", j, ret); diff --git a/include/soc/fsl/qe/qe.h b/include/soc/fsl/qe/qe.h index 8f967d15e479..7f0e4165c3b0 100644 --- a/include/soc/fsl/qe/qe.h +++ b/include/soc/fsl/qe/qe.h @@ -24,6 +24,7 @@ #include struct device; +struct gpio_desc; #define QE_NUM_OF_SNUM 256 /* There are 256 serial number in QE */ #define QE_NUM_OF_BRGS 16 @@ -193,12 +194,13 @@ static inline int par_io_data_set(u8 port, u8 pin, u8 val) { return -ENOSYS; } */ struct qe_pin; #ifdef CONFIG_QE_GPIO -extern struct qe_pin *qe_pin_request(struct device *dev, int index); +extern struct qe_pin *qe_pin_request(struct device *dev, struct gpio_desc *gpiod); extern void qe_pin_free(struct qe_pin *qe_pin); extern void qe_pin_set_gpio(struct qe_pin *qe_pin); extern void qe_pin_set_dedicated(struct qe_pin *pin); #else -static inline struct qe_pin *qe_pin_request(struct device *dev, int index) +static inline struct qe_pin * +qe_pin_request(struct device *dev, struct gpio_desc *gpiod) { return ERR_PTR(-ENOSYS); } From 46201d760c48e771fa2febfcb0787f22c3b71387 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 15:27:19 +0000 Subject: [PATCH 06/10] soc: fsl: cpm1: tsa: Fix clock leak in tsa_of_parse_tdms() The error cleanup loop puts l1rsync_clk and l1rclk_clk a second time and never puts l1tsync_clk or l1tclk_clk, because the branches that guard the transmit clocks use the receive clock field names. Use the matching field in each branch so every clock acquired by tsa_of_parse_tdms() is released exactly once. Fixes: 1d4ba0b81c1c ("soc: fsl: cpm1: Add support for TSA") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Reviewed-by: Herve Codina Link: https://lore.kernel.org/r/20260917152719.2160395-1-vulab@iscas.ac.cn [chleroy: Fixed the same in tsa_remove()] Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/qe/tsa.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/soc/fsl/qe/tsa.c b/drivers/soc/fsl/qe/tsa.c index 4a88e54d25b9..502e2ffe8689 100644 --- a/drivers/soc/fsl/qe/tsa.c +++ b/drivers/soc/fsl/qe/tsa.c @@ -865,12 +865,12 @@ static int tsa_of_parse_tdms(struct tsa *tsa, struct device_node *np) clk_put(tsa->tdm[i].l1rclk_clk); } if (tsa->tdm[i].l1tsync_clk) { - clk_disable_unprepare(tsa->tdm[i].l1rsync_clk); - clk_put(tsa->tdm[i].l1rsync_clk); + clk_disable_unprepare(tsa->tdm[i].l1tsync_clk); + clk_put(tsa->tdm[i].l1tsync_clk); } if (tsa->tdm[i].l1tclk_clk) { - clk_disable_unprepare(tsa->tdm[i].l1rclk_clk); - clk_put(tsa->tdm[i].l1rclk_clk); + clk_disable_unprepare(tsa->tdm[i].l1tclk_clk); + clk_put(tsa->tdm[i].l1tclk_clk); } } return ret; @@ -1039,12 +1039,12 @@ static void tsa_remove(struct platform_device *pdev) clk_put(tsa->tdm[i].l1rclk_clk); } if (tsa->tdm[i].l1tsync_clk) { - clk_disable_unprepare(tsa->tdm[i].l1rsync_clk); - clk_put(tsa->tdm[i].l1rsync_clk); + clk_disable_unprepare(tsa->tdm[i].l1tsync_clk); + clk_put(tsa->tdm[i].l1tsync_clk); } if (tsa->tdm[i].l1tclk_clk) { - clk_disable_unprepare(tsa->tdm[i].l1rclk_clk); - clk_put(tsa->tdm[i].l1rclk_clk); + clk_disable_unprepare(tsa->tdm[i].l1tclk_clk); + clk_put(tsa->tdm[i].l1tclk_clk); } } } From 4258e8f44462463d618f6b4f24a46b35f36cfd0f Mon Sep 17 00:00:00 2001 From: Vincent Jardin Date: Wed, 30 Sep 2026 22:15:48 +0200 Subject: [PATCH 07/10] bus: fsl-mc: drop the fwnode links of the dpmacs nodes A DPMAC node under dpmacs/ is never the fwnode of any device: the fsl-mc bus creates dpmac.N objects without one, then dpaa2-mac finds its node in dpmacs/ at connect time. fw_devlink therefore attaches the supplier links of those nodes (phys, ...) to the nearest ancestor device, the fsl-mc bus, as SYNC_STATE_ONLY proxies. device_link_add() refuses such a link once the consumer has probed, and fw_devlink logs the refusal as an error. On an LX2160A board with 4x25G DPMACs for which phys = <&serdes_1 N>, the Serdes PHY binds after the bus and then at every boot it shows: fsl_mc_bus 80c000000.fsl-mc: Failed to create device link (0x180) with supplier 1ea0000.phy for /soc/fsl-mc@80c000000/dpmacs/ethernet@3 once per port! To fix it, when the root MC bus probes, purge the fwnode links of every child of its dpmacs node, so fw_devlink has no supplier link left to proxy to the bus and no longer tries to create those device links. Signed-off-by: Vincent Jardin Reviewed-by: Ioana Ciornei Tested-by: Ioana Ciornei # LX2160ARDB Link: https://lore.kernel.org/r/20260930-for-upstream-fsl-mc-dpmac-fwnode-links-v2-1-13f7b6ef000f@free.fr Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/bus/fsl-mc/fsl-mc-bus.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c index 5878eafd8d44..0c37b6780c84 100644 --- a/drivers/bus/fsl-mc/fsl-mc-bus.c +++ b/drivers/bus/fsl-mc/fsl-mc-bus.c @@ -11,6 +11,7 @@ #define pr_fmt(fmt) "fsl-mc: " fmt #include +#include #include #include #include @@ -1033,6 +1034,20 @@ static int fsl_mc_firmware_check(struct platform_device *pdev) return 0; } +static void fsl_mc_purge_dpmac_fwnode_links(struct device *dev) +{ + struct device_node *dpmacs, *child; + + dpmacs = of_get_child_by_name(dev->of_node, "dpmacs"); + if (!dpmacs) + return; + + for_each_child_of_node(dpmacs, child) + fwnode_links_purge(of_fwnode_handle(child)); + + of_node_put(dpmacs); +} + /* * fsl_mc_bus_probe - callback invoked when the root MC bus is being * added @@ -1134,6 +1149,8 @@ static int fsl_mc_bus_probe(struct platform_device *pdev) &mc->num_translation_ranges); if (error < 0) goto error_cleanup_mc_io; + + fsl_mc_purge_dpmac_fwnode_links(&pdev->dev); } error = dprc_get_container_id(mc_io, 0, &container_id); From 7aed976c4207bda126f41475eebaf8162b6a0ce4 Mon Sep 17 00:00:00 2001 From: Bill Wendling Date: Tue, 22 Sep 2026 22:35:38 +0000 Subject: [PATCH 08/10] bus: fsl-mc: Annotate fsl_mc_io.portal_virt_addr with __counted_by_ptr The GCC and Clang compilers provide the __counted_by_ptr attribute, which is used by KASAN and compiler bounds-checking to detect out-of-bounds accesses to pointer fields. In "struct fsl_mc_io", the "portal_virt_addr" pointer points to the MC command portal virtual address. The size of this allocated portal in bytes is tracked by the "portal_size" field within the same structure. Annotate the "portal_virt_addr" pointer field with "__counted_by_ptr(portal_size)" to enable compiler bounds-checking and harden against potential out-of-bounds accesses. Cc: codemender-patching+linux@google.com Assisted-by: LLM Signed-off-by: Bill Wendling Reviewed-by: Ioana Ciornei Reviewed-by: Gustavo A. R. Silva Link: https://lore.kernel.org/r/20260922223538.2287676-1-morbo@google.com Signed-off-by: Christophe Leroy (CS GROUP) --- include/linux/fsl/mc.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/fsl/mc.h b/include/linux/fsl/mc.h index c25f0f7e6dd4..0b2c0eb9b605 100644 --- a/include/linux/fsl/mc.h +++ b/include/linux/fsl/mc.h @@ -336,7 +336,7 @@ struct fsl_mc_io { u16 flags; u32 portal_size; phys_addr_t portal_phys_addr; - void __iomem *portal_virt_addr; + void __iomem *portal_virt_addr __counted_by_ptr(portal_size); struct fsl_mc_device *dpmcp_dev; union { /* From 45ecea8c55521d424513178fb612cefffb09a9f5 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Fri, 2 Oct 2026 15:48:01 -0400 Subject: [PATCH 09/10] soc: fsl: dpio: Fix cleanup on IRQ registration failure IRQ registration happens after dpaa2_io_create(), but its failure path only releases the IRQ resources and the MC portal. The I/O object stays allocated and published in the service list and per-CPU lookup table, while devres unmaps its portal registers after probe fails. Call dpaa2_io_down() on IRQ registration failure to remove the object from those lookup structures and free it. Reorder the error labels so that a failed dpaa2_io_create() still skips this cleanup. Remove unregister_dpio_irq_handlers() from the probe error path, since no IRQ handler or affinity hint has been installed when registration fails. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: fe8fe7723a3a ("soc: fsl: dpio: register dpio irq handlers after dpio create") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20261002194802.375497-2-mhun512@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/dpio/dpio-driver.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c index d5198ffc4455..8d3134622a28 100644 --- a/drivers/soc/fsl/dpio/dpio-driver.c +++ b/drivers/soc/fsl/dpio/dpio-driver.c @@ -244,9 +244,9 @@ static int dpaa2_dpio_probe(struct fsl_mc_device *dpio_dev) return 0; -err_dpaa2_io_create: - unregister_dpio_irq_handlers(dpio_dev); err_register_dpio_irq: + dpaa2_io_down(priv->io); +err_dpaa2_io_create: fsl_mc_free_irqs(dpio_dev); err_allocate_irqs: dpio_disable(dpio_dev->mc_io, 0, dpio_dev->mc_handle); From a7831c657c90e8f9165f6bbe0cc56262fee075e8 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Fri, 2 Oct 2026 15:48:02 -0400 Subject: [PATCH 10/10] soc: fsl: dpio: Free the IRQ before releasing the I/O object The DPIO interrupt handler accesses priv->io, but dpaa2_dpio_remove() releases that object before tearing down the interrupts. The IRQ was requested with devm_request_irq(), and unregister_dpio_irq_handlers() only clears its affinity hint. fsl_mc_free_irqs() returns IRQ resources to the MC resource pool without freeing the handler. An interrupt can therefore access the freed I/O object before devres releases the IRQ. Explicitly free the managed IRQ in unregister_dpio_irq_handlers() before returning its resource to the pool, and perform IRQ teardown before releasing the I/O object. This also waits for an in-flight handler while the object is still valid. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 993fec7e11ca ("bus: fsl-mc: dpio: add the DPAA2 DPIO object driver") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Reviewed-by: Ioana Ciornei Link: https://lore.kernel.org/r/20261002194802.375497-3-mhun512@gmail.com Signed-off-by: Christophe Leroy (CS GROUP) --- drivers/soc/fsl/dpio/dpio-driver.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/soc/fsl/dpio/dpio-driver.c b/drivers/soc/fsl/dpio/dpio-driver.c index 8d3134622a28..d8f28fb7c37a 100644 --- a/drivers/soc/fsl/dpio/dpio-driver.c +++ b/drivers/soc/fsl/dpio/dpio-driver.c @@ -88,6 +88,7 @@ static void unregister_dpio_irq_handlers(struct fsl_mc_device *dpio_dev) /* clear the affinity hint */ irq_set_affinity_hint(irq->virq, NULL); + devm_free_irq(&dpio_dev->dev, irq->virq, &dpio_dev->dev); } static int register_dpio_irq_handlers(struct fsl_mc_device *dpio_dev, int cpu) @@ -276,10 +277,10 @@ static void dpaa2_dpio_remove(struct fsl_mc_device *dpio_dev) priv = dev_get_drvdata(dev); cpu = dpaa2_io_get_cpu(priv->io); - dpaa2_io_down(priv->io); - dpio_teardown_irqs(dpio_dev); + dpaa2_io_down(priv->io); + cpumask_set_cpu(cpu, cpus_unused_mask); err = dpio_open(dpio_dev->mc_io, 0, dpio_dev->obj_desc.id,