From 3f7fd751d8a0bd47165d515d6479ec81944fb5d2 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Fri, 20 Mar 2026 20:52:17 -0700 Subject: [PATCH 1/4] firmware: stratix10-svc: kmalloc_array + kzalloc to flex Use a flexible array member to combine allocations. Simplifies memory management. Add __counted_by for extra runtime analysis. Also move counting variable assignment up as required by __counted_by. Signed-off-by: Rosen Penev Signed-off-by: Dinh Nguyen --- drivers/firmware/stratix10-svc.c | 90 +++++++++++++++----------------- 1 file changed, 41 insertions(+), 49 deletions(-) diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index e9e35d67ef96..5a76cf3fc83a 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -240,37 +240,6 @@ struct stratix10_async_ctrl { DECLARE_HASHTABLE(trx_list, ASYNC_TRX_HASH_BITS); }; -/** - * struct stratix10_svc_controller - service controller - * @dev: device - * @chans: array of service channels - * @num_chans: number of channels in 'chans' array - * @num_active_client: number of active service client - * @node: list management - * @genpool: memory pool pointing to the memory region - * @complete_status: state for completion - * @invoke_fn: function to issue secure monitor call or hypervisor call - * @svc: manages the list of client svc drivers - * @sdm_lock: only allows a single command single response to SDM - * @actrl: async control structure - * - * This struct is used to create communication channels for service clients, to - * handle secure monitor or hypervisor call. - */ -struct stratix10_svc_controller { - struct device *dev; - struct stratix10_svc_chan *chans; - int num_chans; - int num_active_client; - struct list_head node; - struct gen_pool *genpool; - struct completion complete_status; - svc_invoke_fn *invoke_fn; - struct stratix10_svc *svc; - struct mutex sdm_lock; - struct stratix10_async_ctrl actrl; -}; - /** * struct stratix10_svc_chan - service communication channel * @ctrl: pointer to service controller which is the provider of this channel @@ -296,6 +265,37 @@ struct stratix10_svc_chan { struct stratix10_async_chan *async_chan; }; +/** + * struct stratix10_svc_controller - service controller + * @dev: device + * @num_chans: number of channels in 'chans' array + * @num_active_client: number of active service client + * @node: list management + * @genpool: memory pool pointing to the memory region + * @complete_status: state for completion + * @invoke_fn: function to issue secure monitor call or hypervisor call + * @svc: manages the list of client svc drivers + * @sdm_lock: only allows a single command single response to SDM + * @actrl: async control structure + * @chans: array of service channels + * + * This struct is used to create communication channels for service clients, to + * handle secure monitor or hypervisor call. + */ +struct stratix10_svc_controller { + struct device *dev; + int num_chans; + int num_active_client; + struct list_head node; + struct gen_pool *genpool; + struct completion complete_status; + svc_invoke_fn *invoke_fn; + struct stratix10_svc *svc; + struct mutex sdm_lock; + struct stratix10_async_ctrl actrl; + struct stratix10_svc_chan chans[] __counted_by(num_chans); +}; + static LIST_HEAD(svc_ctrl); static LIST_HEAD(svc_data_mem); @@ -1901,7 +1901,6 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; struct stratix10_svc_controller *controller; - struct stratix10_svc_chan *chans; struct gen_pool *genpool; struct stratix10_svc_sh_memory *sh_memory; struct stratix10_svc *svc = NULL; @@ -1929,23 +1928,16 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) return PTR_ERR(genpool); /* allocate service controller and supporting channel */ - controller = devm_kzalloc(dev, sizeof(*controller), GFP_KERNEL); + controller = devm_kzalloc(dev, struct_size(controller, chans, SVC_NUM_CHANNEL), + GFP_KERNEL); if (!controller) { ret = -ENOMEM; goto err_destroy_pool; } - chans = devm_kmalloc_array(dev, SVC_NUM_CHANNEL, - sizeof(*chans), GFP_KERNEL | __GFP_ZERO); - if (!chans) { - ret = -ENOMEM; - goto err_destroy_pool; - } - - controller->dev = dev; controller->num_chans = SVC_NUM_CHANNEL; + controller->dev = dev; controller->num_active_client = 0; - controller->chans = chans; controller->genpool = genpool; controller->invoke_fn = invoke_fn; INIT_LIST_HEAD(&controller->node); @@ -1962,16 +1954,16 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) mutex_init(&controller->sdm_lock); for (i = 0; i < SVC_NUM_CHANNEL; i++) { - chans[i].scl = NULL; - chans[i].ctrl = controller; - chans[i].name = (char *)chan_names[i]; - spin_lock_init(&chans[i].lock); - ret = kfifo_alloc(&chans[i].svc_fifo, fifo_size, GFP_KERNEL); + controller->chans[i].scl = NULL; + controller->chans[i].ctrl = controller; + controller->chans[i].name = (char *)chan_names[i]; + spin_lock_init(&controller->chans[i].lock); + ret = kfifo_alloc(&controller->chans[i].svc_fifo, fifo_size, GFP_KERNEL); if (ret) { dev_err(dev, "failed to allocate FIFO %d\n", i); goto err_free_fifos; } - spin_lock_init(&chans[i].svc_fifo_lock); + spin_lock_init(&controller->chans[i].svc_fifo_lock); } list_add_tail(&controller->node, &svc_ctrl); @@ -2015,7 +2007,7 @@ static int stratix10_svc_drv_probe(struct platform_device *pdev) list_del(&controller->node); /* free only the FIFOs that were successfully allocated */ while (i--) - kfifo_free(&chans[i].svc_fifo); + kfifo_free(&controller->chans[i].svc_fifo); stratix10_svc_async_exit(controller); err_destroy_pool: gen_pool_destroy(genpool); From 4b0a32016347bfd6ae9849f21b1b767905f68d14 Mon Sep 17 00:00:00 2001 From: Siew Chin Lim Date: Mon, 6 Sep 2021 09:46:21 +0800 Subject: [PATCH 2/4] firmware: stratix10-svc: change get provision data to async SMC call Change INTEL_SIP_SMC_FCS_GET_PROVISION_DATA's SMC call to async from sync to avoid long runtime which may cause the watchdog timeout issue. Signed-off-by: Richard Gong Signed-off-by: Siew Chin Lim Signed-off-by: Dinh Nguyen --- drivers/firmware/stratix10-svc.c | 4 ++-- include/linux/firmware/intel/stratix10-smc.h | 12 ++++-------- 2 files changed, 6 insertions(+), 10 deletions(-) diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index 5a76cf3fc83a..282211d2612b 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -463,6 +463,7 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data, case COMMAND_FCS_SEND_CERTIFICATE: case COMMAND_FCS_DATA_ENCRYPTION: case COMMAND_FCS_DATA_DECRYPTION: + case COMMAND_FCS_GET_PROVISION_DATA: cb_data->status = BIT(SVC_STATUS_OK); break; case COMMAND_RECONFIG_DATA_SUBMIT: @@ -491,7 +492,6 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data, cb_data->kaddr2 = &res.a2; break; case COMMAND_FCS_RANDOM_NUMBER_GEN: - case COMMAND_FCS_GET_PROVISION_DATA: case COMMAND_POLL_SERVICE_STATUS: cb_data->status = BIT(SVC_STATUS_OK); cb_data->kaddr1 = &res.a1; @@ -674,7 +674,7 @@ static int svc_normal_to_secure_thread(void *data) break; case COMMAND_FCS_GET_PROVISION_DATA: a0 = INTEL_SIP_SMC_FCS_GET_PROVISION_DATA; - a1 = (unsigned long)pdata->paddr; + a1 = 0; a2 = 0; break; /* for HWMON */ diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h index 935dba3633b5..36ea619ea2ad 100644 --- a/include/linux/firmware/intel/stratix10-smc.h +++ b/include/linux/firmware/intel/stratix10-smc.h @@ -605,25 +605,21 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE) /** * Request INTEL_SIP_SMC_FCS_GET_PROVISION_DATA - * Sync call to dump all the fuses and key hashes + * Async call to dump all the fuses and key hashes * * Call register usage: * a0 INTEL_SIP_SMC_FCS_GET_PROVISION_DATA - * a1 the physical address for firmware to write structure of fuse and - * key hashes - * a2-a7 not used + * a1-a7 not used * * Return status: * a0 INTEL_SIP_SMC_STATUS_OK, INTEL_SIP_SMC_FCS_ERROR or * INTEL_SIP_SMC_FCS_REJECTED - * a1 mailbox error - * a2 physical address for the structure of fuse and key hashes - * a3 the size of structure + * a1-a3 not used * */ #define INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA 94 #define INTEL_SIP_SMC_FCS_GET_PROVISION_DATA \ - INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA) + INTEL_SIP_SMC_STD_CALL_VAL(INTEL_SIP_SMC_FUNCID_FCS_GET_PROVISION_DATA) /** * Request INTEL_SIP_SMC_HWMON_READTEMP From 30b1f763bfc1b0db42f58904ec378066cc886c44 Mon Sep 17 00:00:00 2001 From: Dinh Nguyen Date: Fri, 15 May 2026 17:15:55 -0500 Subject: [PATCH 3/4] firmware: stratix10-rsu: avoid blocking reboot_image sysfs when busy Writes to the reboot_image sysfs attribute went through rsu_send_msg(), which unconditionally takes priv->lock with mutex_lock(). If another RSU operation is in flight (e.g. a DCMF status query from probe or a concurrent sysfs read path), userspace writers get stuck in the kernel waiting on the mutex instead of being told the device is busy. Split rsu_send_msg() into an inner __rsu_send_msg_locked() helper that performs the SMC transaction with the caller holding priv->lock, plus two thin wrappers: rsu_send_msg() preserves the original blocking behaviour for existing callers, and rsu_try_send_msg() uses mutex_trylock() and returns -EBUSY immediately when the lock is held. Use rsu_try_send_msg() from reboot_image_store() so the write returns -EBUSY without blocking when an RSU operation is already running. Userspace can retry on -EBUSY. No functional change for other sysfs attributes. This keeps blocking rsu_send_msg() for existing callers, add rsu_try_send_msg() with -EBUSY only for reboot_image_store(). That matches the original goal (avoid a second reboot_image write blocking behind priv->lock) without changing sysfs behaviour for the other attributes. The earlier idea of using mutex_trylock() in all of rsu_send_msg() and returning -EAGAIN would have been harder to justify for userspace (echo does not retry on that). Tze Yee tested the patch on an Agilex SoC devkit. [Test 1] Idle reboot_image write (success path) Result: # insmod stratix10-rsu.ko # echo 0x01000000 > .../reboot_image # echo "exit=$?" exit=0 # ./rsu_client --log VERSION: 0x00000202 STATE: 0x00000000 CURRENT IMAGE: 0x0000000001000000 FAIL IMAGE: 0x0000000000000000 ERROR LOC: 0x00000000 ERROR DETAILS: 0x00000000 RETRY COUNTER: 0x00000000 Operation completed [Test 2] reboot_image while priv->lock is held (-EBUSY path) To get a deterministic busy window without flooding the service layer, add a local debug helper (module parameter debug_hold_lock_sec + kthread that holds priv->lock for N seconds after probe). Result: # insmod stratix10-rsu.ko debug_hold_lock_sec=60 [ 121.220904] stratix10-rsu stratix10-rsu.0: TEST: RSU lock held for 60 s - try reboot_image now # echo 0x01000000 > .../reboot_image -sh: echo: write error: Device or resource busy # echo "during hold: exit=$?" during hold: exit=1 [ 183.268706] stratix10-rsu stratix10-rsu.0: TEST: RSU lock released # echo 0x01000000 > .../reboot_image # echo "after release: exit=$?" after release: exit=0 Together, these results match the intended behaviour: reboot_image fails fast with -EBUSY when the RSU mutex is already held, and succeeds once the lock is available. Assisted-by: Claude:claude-opus-4-7 Tested-by: Tze Yee Ng Signed-off-by: Dinh Nguyen --- drivers/firmware/stratix10-rsu.c | 85 +++++++++++++++++++++++++++----- 1 file changed, 73 insertions(+), 12 deletions(-) diff --git a/drivers/firmware/stratix10-rsu.c b/drivers/firmware/stratix10-rsu.c index e1912108a0fe..018a933943fb 100644 --- a/drivers/firmware/stratix10-rsu.c +++ b/drivers/firmware/stratix10-rsu.c @@ -244,27 +244,26 @@ static void rsu_async_get_spt_table_callback(struct device *dev, } /** - * rsu_send_msg() - send a message to Intel service layer + * __rsu_send_msg_locked() - send a message to Intel service layer * @priv: pointer to rsu private data * @command: RSU status or update command * @arg: the request argument, the bitstream address or notify status * @callback: function pointer for the callback (status or update) * - * Start an Intel service layer transaction to perform the SMC call that - * is necessary to get RSU boot log or set the address of bitstream to - * boot after reboot. + * Perform the actual SMC transaction. The caller must hold @priv->lock. * - * Returns 0 on success or -ETIMEDOUT on error. + * Returns 0 on success or a negative errno on failure. */ -static int rsu_send_msg(struct stratix10_rsu_priv *priv, - enum stratix10_svc_command_code command, - unsigned long arg, - rsu_callback callback) +static int __rsu_send_msg_locked(struct stratix10_rsu_priv *priv, + enum stratix10_svc_command_code command, + unsigned long arg, + rsu_callback callback) { struct stratix10_svc_client_msg msg; int ret; - mutex_lock(&priv->lock); + lockdep_assert_held(&priv->lock); + reinit_completion(&priv->completion); priv->client.receive_cb = callback; @@ -293,6 +292,59 @@ static int rsu_send_msg(struct stratix10_rsu_priv *priv, status_done: stratix10_svc_done(priv->chan); + return ret; +} + +/** + * rsu_send_msg() - send a message to Intel service layer + * @priv: pointer to rsu private data + * @command: RSU status or update command + * @arg: the request argument, the bitstream address or notify status + * @callback: function pointer for the callback (status or update) + * + * Start an Intel service layer transaction to perform the SMC call that + * is necessary to get RSU boot log or set the address of bitstream to + * boot after reboot. This call will block until the RSU lock can be + * acquired. + * + * Returns 0 on success or a negative errno on failure. + */ +static int rsu_send_msg(struct stratix10_rsu_priv *priv, + enum stratix10_svc_command_code command, + unsigned long arg, + rsu_callback callback) +{ + int ret; + + mutex_lock(&priv->lock); + ret = __rsu_send_msg_locked(priv, command, arg, callback); + mutex_unlock(&priv->lock); + return ret; +} + +/** + * rsu_try_send_msg() - non-blocking variant of rsu_send_msg() + * @priv: pointer to rsu private data + * @command: RSU status or update command + * @arg: the request argument, the bitstream address or notify status + * @callback: function pointer for the callback (status or update) + * + * Same as rsu_send_msg() but returns -EBUSY immediately when another + * RSU operation is already in flight, instead of waiting for the lock. + * + * Returns 0 on success, -EBUSY if the RSU is busy, or another negative + * errno on failure. + */ +static int rsu_try_send_msg(struct stratix10_rsu_priv *priv, + enum stratix10_svc_command_code command, + unsigned long arg, + rsu_callback callback) +{ + int ret; + + if (!mutex_trylock(&priv->lock)) + return -EBUSY; + ret = __rsu_send_msg_locked(priv, command, arg, callback); mutex_unlock(&priv->lock); return ret; } @@ -595,8 +647,17 @@ static ssize_t reboot_image_store(struct device *dev, if (ret) return ret; - ret = rsu_send_msg(priv, COMMAND_RSU_UPDATE, - address, rsu_command_callback); + /* + * Use the non-blocking variant so a write to this sysfs attribute + * does not stall the caller while another RSU operation is in + * flight. Userspace can retry on -EBUSY. + */ + ret = rsu_try_send_msg(priv, COMMAND_RSU_UPDATE, + address, rsu_command_callback); + if (ret == -EBUSY) { + dev_dbg(dev, "RSU busy, reboot_image write rejected\n"); + return ret; + } if (ret) { dev_err(dev, "Error, RSU update returned %i\n", ret); return ret; From 71e6a19fe2669faf7dcb96ba8a4fde927485e60e Mon Sep 17 00:00:00 2001 From: Tze Yee Ng Date: Tue, 2 Jun 2026 22:28:42 -0700 Subject: [PATCH 4/4] firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version Add entry in Stratix10 service layer that allow client to retrieve the ATF version at runtime, which is useful for system diagnostics, compatibility checks, and ensuring the correct secure firmware is in use. The change introduces: - A new service command definition in the Stratix10 service layer to initiate the ATF version query. - A corresponding macro definition in the header file to expose the command ID for use by other components. The service layer uses a Secure Monitor Call (SMC) to communicate with the ATF and retrieve the version string, which can then be logged or validated by client application. Signed-off-by: Tze Yee Ng Signed-off-by: Dinh Nguyen --- drivers/firmware/stratix10-svc.c | 12 ++++++++++++ include/linux/firmware/intel/stratix10-smc.h | 19 +++++++++++++++++++ .../firmware/intel/stratix10-svc-client.h | 7 ++++++- 3 files changed, 37 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/stratix10-svc.c b/drivers/firmware/stratix10-svc.c index 282211d2612b..00e134e663c8 100644 --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -486,6 +486,12 @@ static void svc_thread_recv_status_ok(struct stratix10_svc_data *p_data, cb_data->kaddr1 = &res.a1; cb_data->kaddr2 = &res.a2; break; + case COMMAND_SMC_ATF_BUILD_VER: + cb_data->status = BIT(SVC_STATUS_OK); + cb_data->kaddr1 = &res.a1; + cb_data->kaddr2 = &res.a2; + cb_data->kaddr3 = &res.a3; + break; case COMMAND_RSU_DCMF_VERSION: cb_data->status = BIT(SVC_STATUS_OK); cb_data->kaddr1 = &res.a1; @@ -704,6 +710,12 @@ static int svc_normal_to_secure_thread(void *data) a1 = 0; a2 = 0; break; + case COMMAND_SMC_ATF_BUILD_VER: + a0 = INTEL_SIP_SMC_ATF_BUILD_VER; + a1 = 0; + a2 = 0; + a3 = 0; + break; case COMMAND_MBOX_SEND_CMD: a0 = INTEL_SIP_SMC_MBOX_SEND_CMD; a1 = pdata->arg[0]; diff --git a/include/linux/firmware/intel/stratix10-smc.h b/include/linux/firmware/intel/stratix10-smc.h index 36ea619ea2ad..9116512169dc 100644 --- a/include/linux/firmware/intel/stratix10-smc.h +++ b/include/linux/firmware/intel/stratix10-smc.h @@ -514,6 +514,25 @@ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_FUNCID_FPGA_CONFIG_COMPLETED_WRITE) #define INTEL_SIP_SMC_SVC_VERSION \ INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_SVC_FUNCID_VERSION) +/** + * Request INTEL_SIP_SMC_ATF_BUILD_VER + * + * Sync call used to query the ATF Build Version + * + * Call register usage: + * a0 INTEL_SIP_SMC_ATF_BUILD_VER + * a1-a7 not used + * + * Return status: + * a0 INTEL_SIP_SMC_STATUS_OK + * a1 Major + * a2 Minor + * a3 Patch + */ +#define INTEL_SIP_SMC_ATF_BUILD_VERSION 155 +#define INTEL_SIP_SMC_ATF_BUILD_VER \ + INTEL_SIP_SMC_FAST_CALL_VAL(INTEL_SIP_SMC_ATF_BUILD_VERSION) + /** * SMC call protocol for FPGA Crypto Service (FCS) * FUNCID starts from 90 diff --git a/include/linux/firmware/intel/stratix10-svc-client.h b/include/linux/firmware/intel/stratix10-svc-client.h index 91013161e9db..3edd93502bf8 100644 --- a/include/linux/firmware/intel/stratix10-svc-client.h +++ b/include/linux/firmware/intel/stratix10-svc-client.h @@ -154,6 +154,10 @@ struct stratix10_svc_chan; * * @COMMAND_HWMON_READVOLT: query the voltage from the hardware monitor, * return status is SVC_STATUS_OK or SVC_STATUS_ERROR + * + * @COMMAND_SMC_ATF_BUILD_VER: Non-mailbox SMC ATF Build Version, + * return status is SVC_STATUS_OK + * */ enum stratix10_svc_command_code { /* for FPGA */ @@ -187,7 +191,8 @@ enum stratix10_svc_command_code { COMMAND_SMC_SVC_VERSION = 200, /* for HWMON */ COMMAND_HWMON_READTEMP, - COMMAND_HWMON_READVOLT + COMMAND_HWMON_READVOLT, + COMMAND_SMC_ATF_BUILD_VER }; /**