github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Arm firmware fixes for v7.3

Browse Source 
SCPI fixes address resource leaks and invalid firmware responses, while
 FF-A gains shutdown cleanup needed for normal kexec.
 
 - Release the device node reference acquired during SCPI domain lookup.
 - Validate SCPI DVFS OPP counts and indices returned by firmware to
   prevent out-of-bounds accesses and invalid clock rates.
 - Register the SCPI cpufreq device only once across DVFS providers,
   preserving the registered device pointer for cleanup and allowing
   retries after registration failure.
 - Run FF-A teardown during orderly shutdown so notifications, partition
   devices and RX/TX mappings are released before a replacement kernel
   boots through normal kexec.
 
 Also includes replacing a literal platform device ID with
 PLATFORM_DEVID_NONE and correcting an SCMI comment typo.
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEunHlEgbzHrJD3ZPhAEG6vDF+4pgFAmqga1IACgkQAEG6vDF+
 4piNYg//fMyEAKgjG0VkVH5/s+saxVFoh9GKhyqunZr39uc9R/ES5hDIY35tTiui
 d4GIoKJlRbas6d/6oK8J669aAMpEP/YIRHQizH59cpkIRIzaFo4rJ+2Cl3CYeHG5
 i6gFIlCdNk0Jv9evv6wQ2PSnkXo4Sgzx1wWBr3KbMUWXafa16bA7gTY7z2xYII1s
 Ocv/VvDnQNlEGVIiMUZI3JAS3Z4CAcxL8iLyDpmwh1ZXNs/OYkDnuY1fWtTbqBir
 anDQnNCM7U4uhvtBFmdXH0A/ySUD39igMmebIUS1z1wSN8Cu67VxmR3yY8sQZdbF
 SEPnQKkY/nBRcMGAf8NBYEo5O1VoCmfxUOnArYfNQlDnWGobPRtNyombPYIu+JcZ
 AsQdKOLbv28R3q+G3yMTOul5bhKSni7txdh7jgTe0kW+qvuzkC42Z5sNP+msCOUv
 oeFAtPVT39qDTMtsF0oKRGiQ9CiXOw7fGdaJk/KZbSMZsQcHWWBgaFngLHX6apW8
 Em8fi+Vazq4lz8gmtnaQPNvskex4OnkmtSYMy93PQBYtUbSO0i7Nzx913VOCHocF
 7GmqXoQG6Jgc4sZJR4ujTFB+xyv1i7xTVgcEp8CeTtzPUgy5l6A2MAec7Wl52Zz9
 Evf6wA2+L6HVoy7L6msDBCzpsTTmaQ+zewsdOMcw33MEC7JrYXA=
 =XE7J
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmqoDIQACgkQmmx57+YA
 GNmLpg//T50aSO0dK31LotTisraS9AGdUWuFLOYmBCeic1eN3SCVq31Q0MFK5+US
 iI1iGjAW/+QJvpr+gSZsmIwaRdxyZwUBda8fanSj/5EEkWE4egQOHnZlkGKTuamO
 Dq5pncqpxiU5m5AAVwYBZf/CrXU8lY+4yjeJESItAFsd2TWUa1tua7GyDRTA0E4n
 8h97fYujgwr/ULMAyaZO11OxqE2Gl7yRGI19iW+V+B8/0Sc+LOstFCORQBWTnsNH
 rQUF/qFH4Czx/mtqvlWWN2roX4/2HyLpAdz1m6idh20ryFJkhvVBlvUFsdmIEQOK
 cPLP1+Auo4MwnSQ+tmRGMXZ7W+f3aXBUUkuZVnqDtGeLuvv+CfYiJBxgteWRlqNR
 FjkRyoi7dTEk06jYJqYy3OEBUKRm/9jgJxnRKgTOeeNLNzRqcb0DU8TqjpsDE6Ie
 K2QlYssVIZk3jgMGFoUvrRxJK4HbH7dWcnJeZHdtljf61Qnf9GcR9EjjGXeyaPz/
 RdduIYHOi/XzTXuaLQcRfJZO6BxMiV5s4tCU/8djy9ZyVa6Sb5kE5q1bzSgW4fyj
 FTttAXx9yyjWHhYdEs3g9Tfg1VewYzoDh0W7gpCe5pYb/CyA7BHH+f64lV7CW+ZF
 lFBI4S55qzAnspl7l/R2WGNT6bPJsesd5Lwmah7Adj/UfwRAl8s=
 =I4bY
 -----END PGP SIGNATURE-----

Merge tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux into arm/fixes

Arm firmware fixes for v7.3

SCPI fixes address resource leaks and invalid firmware responses, while
FF-A gains shutdown cleanup needed for normal kexec.

- Release the device node reference acquired during SCPI domain lookup.
- Validate SCPI DVFS OPP counts and indices returned by firmware to
  prevent out-of-bounds accesses and invalid clock rates.
- Register the SCPI cpufreq device only once across DVFS providers,
  preserving the registered device pointer for cleanup and allowing
  retries after registration failure.
- Run FF-A teardown during orderly shutdown so notifications, partition
  devices and RX/TX mappings are released before a replacement kernel
  boots through normal kexec.

Also includes replacing a literal platform device ID with
PLATFORM_DEVID_NONE and correcting an SCMI comment typo.

* tag 'scmi-ffa-fixes-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux:
  firmware: arm_scmi: Fix typo "upto" in comment
  firmware: arm_ffa: Tear down driver during shutdown
  clk: scpi: use PLATFORM_DEVID_NONE for scpi-cpufreq
  clk: scpi: register scpi-cpufreq once and clear on failure
  clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate
  firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS
  firmware: arm_scpi: fix device_node leak in scpi_dev_domain_id

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This commit is contained in:
Arnd Bergmann 2026-09-14 17:02:16 +02:00
commit 869e97e66d
4 changed files with 16 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/clk/clk-scpi.c
View File

@ -73,7 +73,7 @@ static unsigned long scpi_dvfs_recalc_rate(struct clk_hw *hw,
int idx = clk->scpi_ops->dvfs_get_idx(clk->id);
const struct scpi_opp *opp;
if (idx < 0)
if (idx < 0 || idx >= clk->info->count)
return 0;
opp = clk->info->opps + idx;
@ -272,10 +272,15 @@ static int scpi_clocks_probe(struct platform_device *pdev)
if (match->data != &scpi_dvfs_ops)
continue;
/* Add the virtual cpufreq device if it's DVFS clock provider */
if (cpufreq_dev)
continue;
cpufreq_dev = platform_device_register_simple("scpi-cpufreq",
-1, NULL, 0);
if (IS_ERR(cpufreq_dev))
PLATFORM_DEVID_NONE,
NULL, 0);
if (IS_ERR(cpufreq_dev)) {
pr_warn("unable to register cpufreq device");
cpufreq_dev = NULL;
}
}
return 0;
}

1
drivers/firmware/arm_ffa/driver.c
View File

@ -2225,6 +2225,7 @@ static void ffa_remove(struct platform_device *pdev)
static struct platform_driver ffa_driver = {
.probe = ffa_probe,
.remove = ffa_remove,
.shutdown = ffa_remove,
.driver = {
.name = FFA_PLATFORM_NAME,
},

2
drivers/firmware/arm_scmi/driver.c
View File

@ -477,7 +477,7 @@ void *scmi_notification_instance_data_get(const struct scmi_handle *handle)
* - exactly 'next_token' may be NOT available so pick xfer_id >= next_token
* using find_next_zero_bit() starting from candidate next_token bit
*
* - all tokens ahead upto (MSG_TOKEN_ID_MASK - 1) are used in-flight but we
* - all tokens ahead up to (MSG_TOKEN_ID_MASK - 1) are used in-flight but we
* are plenty of free tokens at start, so try a second pass using
* find_next_zero_bit() and starting from 0.
*

9
drivers/firmware/arm_scpi.c
View File

@ -631,8 +631,8 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)
if (ret)
return ERR_PTR(ret);
if (!buf.opp_count)
return ERR_PTR(-ENOENT);
if (!buf.opp_count || buf.opp_count > MAX_DVFS_OPPS)
return ERR_PTR(-EINVAL);
info = kmalloc_obj(*info);
if (!info)
@ -661,12 +661,15 @@ static struct scpi_dvfs_info *scpi_dvfs_get_info(u8 domain)
static int scpi_dev_domain_id(struct device *dev)
{
struct of_phandle_args clkspec;
int domain;
if (of_parse_phandle_with_args(dev->of_node, "clocks", "#clock-cells",
0, &clkspec))
return -EINVAL;
return clkspec.args[0];
domain = clkspec.args[0];
of_node_put(clkspec.np);
return domain;
}
static struct scpi_dvfs_info *scpi_dvfs_info(struct device *dev)