[PATCH v2 0/2] pmdomain: imx: build the SCU power domain driver as a module

[PATCH v2 0/2] pmdomain: imx: build the SCU power domain driver as a module

[Zhipeng.wang_1]

From: Zhipeng Wang <zhipeng.wang_1@nxp.com>

This series makes the i.MX SCU power domain driver buildable as a
loadable module, which is required for Android devices using the
Generic Kernel Image (GKI) where SoC-specific drivers must be modules.

Patch 1 exports of_stdout (which the driver references to find the
console's power domain) from the OF core with EXPORT_SYMBOL_GPL().

Patch 2 converts CONFIG_IMX_SCU_PD from bool to tristate and adds
MODULE_DEVICE_TABLE() for autoloading. Only module_init() is provided
without module_exit(), since the provider cannot be safely removed at
runtime.

Because of the cross-subsystem dependency (patch 1 touches drivers/of,
patch 2 touches drivers/pmdomain), I would suggest taking the whole
series through one tree.

Changes in v2:
- Drop module_platform_driver() which provides module_exit() and could
  lead to use-after-free on module unload. Use module_init() only, so
  the module cannot be unloaded. (Sashiko bot)

Zhipeng Wang (2):
  of: export of_stdout symbol
  pmdomain: imx: scu-pd: allow building as a module

 drivers/of/base.c             | 1 +
 drivers/pmdomain/imx/Kconfig  | 2 +-
 drivers/pmdomain/imx/scu-pd.c | 8 +++++++-
 3 files changed, 9 insertions(+), 2 deletions(-)

-- 
2.34.1

[PATCH v2 1/2] of: export of_stdout symbol

[Zhipeng.wang_1]

From: Zhipeng Wang <zhipeng.wang_1@nxp.com>

of_stdout is declared extern in include/linux/of.h alongside of_root
and of_chosen, but unlike those two it is not exported, preventing
modules from referencing it.

Export it with EXPORT_SYMBOL_GPL() so drivers that need the stdout
device node can be built as modules.

Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
---
 drivers/of/base.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/of/base.c b/drivers/of/base.c
index 6e7a42dedad3..a25c95800719 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -39,6 +39,7 @@ struct device_node *of_chosen;
 EXPORT_SYMBOL(of_chosen);
 struct device_node *of_aliases;
 struct device_node *of_stdout;
+EXPORT_SYMBOL_GPL(of_stdout);
 static const char *of_stdout_options;
 
 struct kset *of_kset;
-- 
2.34.1

[PATCH v2 2/2] pmdomain: imx: scu-pd: allow building as a module

[Zhipeng.wang_1]

From: Zhipeng Wang <zhipeng.wang_1@nxp.com>

Convert CONFIG_IMX_SCU_PD from bool to tristate to allow building as a
loadable module. This is needed on Android devices using the Generic
Kernel Image (GKI), where SoC-specific drivers must be built as modules
rather than built into the core kernel image.

For i.MX8Q devices running Android with a GKI kernel, the SCU power
domain driver must be loadable. Without tristate support, power domains
cannot be properly initialized, preventing these systems from
functioning under GKI.

Add MODULE_DEVICE_TABLE() for OF-based module autoloading. Only
module_init() is provided without a corresponding module_exit(),
because the SCU power domain provider is a system-level resource that
cannot be safely removed at runtime.

Signed-off-by: Zhipeng Wang <zhipeng.wang_1@nxp.com>
---
 drivers/pmdomain/imx/Kconfig  | 2 +-
 drivers/pmdomain/imx/scu-pd.c | 8 +++++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/pmdomain/imx/Kconfig b/drivers/pmdomain/imx/Kconfig
index 00203615c65e..472e9dec6bd4 100644
--- a/drivers/pmdomain/imx/Kconfig
+++ b/drivers/pmdomain/imx/Kconfig
@@ -21,7 +21,7 @@ config IMX9_BLK_CTRL
 	depends on PM_GENERIC_DOMAINS
 
 config IMX_SCU_PD
-	bool "IMX SCU Power Domain driver"
+	tristate "IMX SCU Power Domain driver"
 	depends on IMX_SCU
 	help
 	  The System Controller Firmware (SCFW) based power domain driver.
diff --git a/drivers/pmdomain/imx/scu-pd.c b/drivers/pmdomain/imx/scu-pd.c
index 3ec33667a308..24353e203491 100644
--- a/drivers/pmdomain/imx/scu-pd.c
+++ b/drivers/pmdomain/imx/scu-pd.c
@@ -531,6 +531,7 @@ static const struct of_device_id imx_sc_pd_match[] = {
 	{ .compatible = "fsl,scu-pd", &imx8qxp_scu_pd},
 	{ /* sentinel */ }
 };
+MODULE_DEVICE_TABLE(of, imx_sc_pd_match);
 
 static struct platform_driver imx_sc_pd_driver = {
 	.driver = {
@@ -540,7 +541,12 @@ static struct platform_driver imx_sc_pd_driver = {
 	},
 	.probe = imx_sc_pd_probe,
 };
-builtin_platform_driver(imx_sc_pd_driver);
+
+static int __init imx_sc_pd_driver_init(void)
+{
+	return platform_driver_register(&imx_sc_pd_driver);
+}
+module_init(imx_sc_pd_driver_init);
 
 MODULE_AUTHOR("Dong Aisheng <aisheng.dong@nxp.com>");
 MODULE_DESCRIPTION("IMX SCU Power Domain driver");
-- 
2.34.1

Re: [PATCH v2 2/2] pmdomain: imx: scu-pd: allow building as a module

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Changing IMX_SCU_PD to a tristate exposes a critical probe order race condition with the SCU clock driver, leading to unpowered hardware and system crashes.
--

--- Patch [2]: [PATCH v2 2/2] pmdomain: imx: scu-pd: allow building as a module ---
commit d3bf08bb865becc5d6316a0d9e70a9dbcc5e5ef3
Author: Zhipeng Wang <zhipeng.wang_1@nxp.com>

pmdomain: imx: scu-pd: allow building as a module

This commit converts CONFIG_IMX_SCU_PD to tristate to allow building as a
loadable module, which is required for Android Generic Kernel Image (GKI)
support. It adds MODULE_DEVICE_TABLE and a module_init function since the
driver cannot be safely removed.

> diff --git a/drivers/pmdomain/imx/Kconfig b/drivers/pmdomain/imx/Kconfig
> index 00203615c65e9..472e9dec6bd4e 100644
> --- a/drivers/pmdomain/imx/Kconfig
> +++ b/drivers/pmdomain/imx/Kconfig
> @@ -21,7 +21,7 @@ config IMX9_BLK_CTRL
>  	depends on PM_GENERIC_DOMAINS
>  
>  config IMX_SCU_PD
> -	bool "IMX SCU Power Domain driver"
> +	tristate "IMX SCU Power Domain driver"

[Severity: High]
Does allowing this driver to be built as a module expose a probe order
race condition with the SCU clock driver?

If the power domain driver is loaded asynchronously after the SCU clock
driver (clk-imx8qxp), the clock-controller DT node lacks a power-domains
property, so fw_devlink cannot enforce the correct probe order.

In this scenario, the clock driver manually looks up the power domain
provider using of_find_compatible_node() and calls of_genpd_add_device().
If the power domain driver has not probed yet, genpd_get_from_provider()
will fail and return -ENOENT.

The clock driver ignores this error in imx_clk_scu_alloc_dev() and
registers the clock device without attaching it to the PM domain. When
the clock is later requested, the Common Clock Framework's
pm_runtime_resume_and_get() will succeed passively because there is no
attached PM domain.

Can this lead to system crashes or hardware access faults due to
accessing unpowered hardware?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722032321.2693300-1-Zhipeng.wang_1@oss.nxp.com?part=2