[PATCH v3 0/2] nvmem: airoha: Add support for SMC eFUSE

[PATCH v3 0/2] nvmem: airoha: Add support for SMC eFUSE

[Christian Marangi]

Add simple driver to read eFUSES with SMC commands for
Airoha AN7581.

Changes v3:
- Rebase on top of linux-next
Changes v2:
- Add review tag from Rob
- Rebase on top of linux-next

Christian Marangi (2):
  dt-bindings: nvmem: airoha: add SMC eFuses schema
  nvmem: airoha: Add support for SMC eFUSE

 .../bindings/nvmem/airoha,smc-efuses.yaml     |  65 ++++++++++
 drivers/nvmem/Kconfig                         |  13 ++
 drivers/nvmem/Makefile                        |   2 +
 drivers/nvmem/airoha-smc-efuses.c             | 118 ++++++++++++++++++
 4 files changed, 198 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml
 create mode 100644 drivers/nvmem/airoha-smc-efuses.c

-- 
2.53.0

[PATCH v3 1/2] dt-bindings: nvmem: airoha: add SMC eFuses schema

[Christian Marangi]

Add Airoha SMC eFuses schema to document new Airoha SoC AN7581/AN7583
way of accessing the 2 eFuse bank via the SMC command.

Each eFuse bank expose 64 eFuse cells of 32 bit used to give information
on HW Revision, PHY Calibration,  Device Model, Private Key and
all kind of other info specific to the SoC or the running system.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Reviewed-by: Rob Herring (Arm) <robh@kernel.org>
---
 .../bindings/nvmem/airoha,smc-efuses.yaml     | 65 +++++++++++++++++++
 1 file changed, 65 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml

diff --git a/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml b/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml
new file mode 100644
index 000000000000..e21ce07c4f41
--- /dev/null
+++ b/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml
@@ -0,0 +1,65 @@
+# SPDX-License-Identifier: GPL-2.0-only OR BSD-2-Clause
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/nvmem/airoha,smc-efuses.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Airoha SMC eFuses
+
+description: |
+  Airoha new SoC (AN7581/AN7583) expose banks of eFuse accessible
+  via specific SMC commands.
+
+  2 different bank of eFuse or 64 cells of 32 bit are exposed
+  read-only used to give information on HW Revision, PHY Calibration,
+  Device Model, Private Key...
+
+maintainers:
+  - Christian Marangi <ansuelsmth@gmail.com>
+
+properties:
+  compatible:
+    enum:
+      - airoha,an7581-efuses
+
+  "#address-cells":
+    const: 1
+
+  "#size-cells":
+    const: 0
+
+patternProperties:
+  '^efuse-bank@[0-1]$':
+    type: object
+
+    allOf:
+      - $ref: nvmem.yaml#
+
+    properties:
+      reg:
+        description: Identify the eFuse bank.
+        enum: [0, 1]
+
+    required:
+      - reg
+
+    unevaluatedProperties: false
+
+required:
+  - compatible
+
+additionalProperties: false
+
+examples:
+  - |
+    efuse {
+        compatible = "airoha,an7581-efuses";
+        #address-cells = <1>;
+        #size-cells = <0>;
+
+        efuse-bank@0 {
+           reg = <0>;
+        };
+    };
+
+...
-- 
2.53.0

[PATCH v3 2/2] nvmem: airoha: Add support for SMC eFUSE

[Christian Marangi]

Add support for SMC eFUSE on AN7581 SoC. The SoC have 2 set of 2048 bits of
eFUSE that are used to read calibration value for PCIe, Thermal, USB and
other specific info of the SoC like revision and HW device present.

eFuse value are taken by sending SMC command. ATF is responsible of
validaing the data and rejecting reading protected data (like Private
Key). In such case the SMC command will return non-zero value on a0
register.

Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
---
 drivers/nvmem/Kconfig             |  13 ++++
 drivers/nvmem/Makefile            |   2 +
 drivers/nvmem/airoha-smc-efuses.c | 118 ++++++++++++++++++++++++++++++
 3 files changed, 133 insertions(+)
 create mode 100644 drivers/nvmem/airoha-smc-efuses.c

diff --git a/drivers/nvmem/Kconfig b/drivers/nvmem/Kconfig
index 74ddbd0f79b0..95a399258538 100644
--- a/drivers/nvmem/Kconfig
+++ b/drivers/nvmem/Kconfig
@@ -28,6 +28,19 @@ source "drivers/nvmem/layouts/Kconfig"
 
 # Devices
 
+config NVMEM_AIROHA_SMC_EFUSES
+	tristate "Airoha SMC eFuse support"
+	depends on ARCH_AIROHA || COMPILE_TEST
+	depends on HAVE_ARM_SMCCC
+	default ARCH_AIROHA
+	help
+	  Say y here to enable support for reading eFuses on Airoha AN7581
+	  SoCs. These are e.g. used to store factory programmed
+	  calibration data required for the PCIe or the USB-C PHY or Thermal.
+
+	  This driver can also be built as a module. If so, the module will
+	  be called nvmem-airoha-smc-efuses.
+
 config NVMEM_AN8855_EFUSE
 	tristate "Airoha AN8855 eFuse support"
 	depends on COMPILE_TEST
diff --git a/drivers/nvmem/Makefile b/drivers/nvmem/Makefile
index 7252b8ec88d4..f6f2bc51dee1 100644
--- a/drivers/nvmem/Makefile
+++ b/drivers/nvmem/Makefile
@@ -10,6 +10,8 @@ nvmem_layouts-y			:= layouts.o
 obj-y				+= layouts/
 
 # Devices
+obj-$(CONFIG_NVMEM_AIROHA_SMC_EFUSES)	+= nvmem-airoha-smc-efuses.o
+nvmem-airoha-smc-efuses-y 		:= airoha-smc-efuses.o
 obj-$(CONFIG_NVMEM_AN8855_EFUSE)	+= nvmem-an8855-efuse.o
 nvmem-an8855-efuse-y 			:= an8855-efuse.o
 obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
diff --git a/drivers/nvmem/airoha-smc-efuses.c b/drivers/nvmem/airoha-smc-efuses.c
new file mode 100644
index 000000000000..bb279d149519
--- /dev/null
+++ b/drivers/nvmem/airoha-smc-efuses.c
@@ -0,0 +1,118 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ *  Author: Christian Marangi <ansuelsmth@gmail.com>
+ */
+
+#include <linux/arm-smccc.h>
+#include <linux/mod_devicetable.h>
+#include <linux/module.h>
+#include <linux/nvmem-provider.h>
+#include <linux/platform_device.h>
+#include <linux/of.h>
+#include <linux/regmap.h>
+
+#define AIROHA_SMC_EFUSE_FID		0x82000001
+#define AIROHA_SMC_EFUSE_SUB_ID_READ	0x44414552
+
+#define AIROHA_EFUSE_CELLS		64
+
+struct airoha_efuse_bank_priv {
+	u8 bank_index;
+};
+
+static int airoha_efuse_read(void *context, unsigned int offset,
+			     void *val, size_t bytes)
+{
+	struct regmap *regmap = context;
+
+	return regmap_bulk_read(regmap, offset,
+				val, bytes / sizeof(u32));
+}
+
+static int airoha_efuse_reg_read(void *context, unsigned int offset,
+				 unsigned int *val)
+{
+	struct airoha_efuse_bank_priv *priv = context;
+	struct arm_smccc_res res;
+
+	arm_smccc_1_1_invoke(AIROHA_SMC_EFUSE_FID,
+			     AIROHA_SMC_EFUSE_SUB_ID_READ,
+			     priv->bank_index, offset, 0, 0, 0, 0, &res);
+
+	/* check if SMC reported an error */
+	if (res.a0)
+		return -EIO;
+
+	*val = res.a1;
+	return 0;
+}
+
+static const struct regmap_config airoha_efuse_regmap_config = {
+	.reg_read = airoha_efuse_reg_read,
+	.reg_bits = 32,
+	.val_bits = 32,
+	.reg_stride = 4,
+};
+
+static int airoha_efuse_probe(struct platform_device *pdev)
+{
+	struct device *dev = &pdev->dev;
+	int ret;
+
+	for_each_child_of_node_scoped(dev->of_node, child) {
+		struct nvmem_config airoha_nvmem_config = {
+			.name = "airoha-efuse",
+			.size = AIROHA_EFUSE_CELLS * sizeof(u32),
+			.stride = sizeof(u32),
+			.word_size = sizeof(u32),
+			.reg_read = airoha_efuse_read,
+		};
+		struct airoha_efuse_bank_priv *priv;
+		struct nvmem_device *nvmem;
+		struct regmap *regmap;
+		u32 bank;
+
+		ret = of_property_read_u32(child, "reg", &bank);
+		if (ret)
+			return ret;
+
+		priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+		if (!priv)
+			return -ENOMEM;
+
+		priv->bank_index = bank;
+
+		regmap = devm_regmap_init(dev, NULL, priv,
+					  &airoha_efuse_regmap_config);
+		if (IS_ERR(regmap))
+			return PTR_ERR(regmap);
+
+		airoha_nvmem_config.priv = regmap;
+		airoha_nvmem_config.dev = dev;
+		airoha_nvmem_config.id = bank;
+		nvmem = devm_nvmem_register(dev, &airoha_nvmem_config);
+		if (IS_ERR(nvmem))
+			return PTR_ERR(nvmem);
+	}
+
+	return 0;
+}
+
+static const struct of_device_id airoha_efuse_of_match[] = {
+	{ .compatible = "airoha,an7581-efuses", },
+	{ /* sentinel */ }
+};
+MODULE_DEVICE_TABLE(of, airoha_efuse_of_match);
+
+static struct platform_driver airoha_efuse_driver = {
+	.probe = airoha_efuse_probe,
+	.driver = {
+		.name = "airoha-efuse",
+		.of_match_table = airoha_efuse_of_match,
+	},
+};
+module_platform_driver(airoha_efuse_driver);
+
+MODULE_AUTHOR("Christian Marangi <ansuelsmth@gmail.com>");
+MODULE_DESCRIPTION("Driver for Airoha SMC eFUSEs");
+MODULE_LICENSE("GPL");
-- 
2.53.0

Re: [PATCH v3 1/2] dt-bindings: nvmem: airoha: add SMC eFuses schema

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Medium] The `compatible` property enum omits the AN7583 SoC despite the commit message claiming support.
- [Medium] The `#address-cells` and `#size-cells` properties are missing from the `required` list.
--

commit e333b70b463993a4fe3c97641d9aaa8019a4117c
Author: Christian Marangi <ansuelsmth@gmail.com>

dt-bindings: nvmem: airoha: add SMC eFuses schema

Add Airoha SMC eFuses schema to document new Airoha SoC AN7581/AN7583
way of accessing the 2 eFuse bank via the SMC command.

> diff --git a/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml b/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml
> new file mode 100644
> index 0000000000000..e21ce07c4f411
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/nvmem/airoha,smc-efuses.yaml

[ ... ]

> +properties:
> +  compatible:
> +    enum:
> +      - airoha,an7581-efuses

The commit message mentions this schema supports both the AN7581 and AN7583
SoCs. Should airoha,an7583-efuses be included in this enum, or is there a
reason only the AN7581 compatible string is listed?

> +
> +  "#address-cells":
> +    const: 1
> +
> +  "#size-cells":
> +    const: 0

[ ... ]

> +    required:
> +      - reg
> +
> +    unevaluatedProperties: false
> +
> +required:
> +  - compatible

Since the schema defines child nodes (efuse-bank@[0-1]) that use the reg
property, should #address-cells and #size-cells be added to this required
list to ensure the device tree is structurally valid?

> +
> +additionalProperties: false

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518142042.8331-1-ansuelsmth@gmail.com?part=1

Re: [PATCH v3 2/2] nvmem: airoha: Add support for SMC eFUSE

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Missing device tree node linkage for NVMEM devices causes DT cell parsing failure and consumer resolution errors.
- [Low] Multiple unnamed regmaps registered on the same device cause debugfs collisions.
--

commit 50a12b4fbba5f61d8cd4d5c2c71e0f517760d0ef
Author: Christian Marangi <ansuelsmth@gmail.com>

nvmem: airoha: Add support for SMC eFUSE

This commit adds support for SMC eFUSE on the AN7581 SoC. It reads
calibration and specific SoC information via SMC commands, while
relying on ATF to validate the data and reject protected reads.

> diff --git a/drivers/nvmem/airoha-smc-efuses.c b/drivers/nvmem/airoha-smc-efuses.c
> new file mode 100644
> index 0000000000000..bb279d1495196
> --- /dev/null
> +++ b/drivers/nvmem/airoha-smc-efuses.c
[ ... ]
> +static int airoha_efuse_probe(struct platform_device *pdev)
> +{
> +	struct device *dev = &pdev->dev;
> +	int ret;
> +
> +	for_each_child_of_node_scoped(dev->of_node, child) {
[ ... ]
> +		priv->bank_index = bank;
> +
> +		regmap = devm_regmap_init(dev, NULL, priv,
> +					  &airoha_efuse_regmap_config);

Is there a risk of debugfs collisions here? devm_regmap_init() is called
for each eFuse bank using the same parent dev.

Since airoha_efuse_regmap_config does not define a name, will the regmap
core attempt to create duplicate debugfs directories under the parent
device's name, triggering a warning?

> +		if (IS_ERR(regmap))
> +			return PTR_ERR(regmap);
> +
> +		airoha_nvmem_config.priv = regmap;
> +		airoha_nvmem_config.dev = dev;
> +		airoha_nvmem_config.id = bank;
> +		nvmem = devm_nvmem_register(dev, &airoha_nvmem_config);

Does this sequence break NVMEM consumer resolution and device tree cell parsing?

The airoha_nvmem_config.of_node field is not set, so the NVMEM core will
default to using the parent device's of_node. This means consumers
requesting the child bank via a phandle might fail to find it, and the
NVMEM core might incorrectly parse the parent node's properties instead of
the child's cells.

If we assign airoha_nvmem_config.of_node = child, could this lead to a
use-after-free?

The for_each_child_of_node_scoped() macro automatically drops the reference
to child at the end of the loop, and the NVMEM subsystem does not acquire
its own reference when copying config.of_node. Does the driver need to
explicitly call of_node_get(child) and handle cleanup on unbind?

> +		if (IS_ERR(nvmem))
> +			return PTR_ERR(nvmem);
> +	}
> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518142042.8331-1-ansuelsmth@gmail.com?part=2

Re: [PATCH v3 2/2] nvmem: airoha: Add support for SMC eFUSE

[Srinivas Kandagatla]

On 5/18/26 3:20 PM, Christian Marangi wrote:
> Add support for SMC eFUSE on AN7581 SoC. The SoC have 2 set of 2048 bits of
> eFUSE that are used to read calibration value for PCIe, Thermal, USB and
> other specific info of the SoC like revision and HW device present.
> 
> eFuse value are taken by sending SMC command. ATF is responsible of
> validaing the data and rejecting reading protected data (like Private
> Key). In such case the SMC command will return non-zero value on a0
> register.
> 
> Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
> ---
>  drivers/nvmem/Kconfig             |  13 ++++
>  drivers/nvmem/Makefile            |   2 +
>  drivers/nvmem/airoha-smc-efuses.c | 118 ++++++++++++++++++++++++++++++
>  3 files changed, 133 insertions(+)
>  create mode 100644 drivers/nvmem/airoha-smc-efuses.c
> 
> diff --git a/drivers/nvmem/Kconfig b/drivers/nvmem/Kconfig
> index 74ddbd0f79b0..95a399258538 100644
> --- a/drivers/nvmem/Kconfig
> +++ b/drivers/nvmem/Kconfig
> @@ -28,6 +28,19 @@ source "drivers/nvmem/layouts/Kconfig"
>  
>  # Devices
>  
> +config NVMEM_AIROHA_SMC_EFUSES
> +	tristate "Airoha SMC eFuse support"
> +	depends on ARCH_AIROHA || COMPILE_TEST
> +	depends on HAVE_ARM_SMCCC
> +	default ARCH_AIROHA
> +	help
> +	  Say y here to enable support for reading eFuses on Airoha AN7581
> +	  SoCs. These are e.g. used to store factory programmed
> +	  calibration data required for the PCIe or the USB-C PHY or Thermal.
> +
> +	  This driver can also be built as a module. If so, the module will
> +	  be called nvmem-airoha-smc-efuses.
> +
>  config NVMEM_AN8855_EFUSE
>  	tristate "Airoha AN8855 eFuse support"
>  	depends on COMPILE_TEST
> diff --git a/drivers/nvmem/Makefile b/drivers/nvmem/Makefile
> index 7252b8ec88d4..f6f2bc51dee1 100644
> --- a/drivers/nvmem/Makefile
> +++ b/drivers/nvmem/Makefile
> @@ -10,6 +10,8 @@ nvmem_layouts-y			:= layouts.o
>  obj-y				+= layouts/
>  
>  # Devices
> +obj-$(CONFIG_NVMEM_AIROHA_SMC_EFUSES)	+= nvmem-airoha-smc-efuses.o
> +nvmem-airoha-smc-efuses-y 		:= airoha-smc-efuses.o
>  obj-$(CONFIG_NVMEM_AN8855_EFUSE)	+= nvmem-an8855-efuse.o
>  nvmem-an8855-efuse-y 			:= an8855-efuse.o
>  obj-$(CONFIG_NVMEM_APPLE_EFUSES)	+= nvmem-apple-efuses.o
> diff --git a/drivers/nvmem/airoha-smc-efuses.c b/drivers/nvmem/airoha-smc-efuses.c
> new file mode 100644
> index 000000000000..bb279d149519
> --- /dev/null
> +++ b/drivers/nvmem/airoha-smc-efuses.c
> @@ -0,0 +1,118 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + *  Author: Christian Marangi <ansuelsmth@gmail.com>
> + */
> +
> +#include <linux/arm-smccc.h>
> +#include <linux/mod_devicetable.h>
> +#include <linux/module.h>
> +#include <linux/nvmem-provider.h>
> +#include <linux/platform_device.h>
> +#include <linux/of.h>
> +#include <linux/regmap.h>
> +
> +#define AIROHA_SMC_EFUSE_FID		0x82000001
> +#define AIROHA_SMC_EFUSE_SUB_ID_READ	0x44414552
> +
> +#define AIROHA_EFUSE_CELLS		64
> +
> +struct airoha_efuse_bank_priv {
> +	u8 bank_index;
> +};
> +
> +static int airoha_efuse_read(void *context, unsigned int offset,
> +			     void *val, size_t bytes)
> +{
> +	struct regmap *regmap = context;
> +
> +	return regmap_bulk_read(regmap, offset,
> +				val, bytes / sizeof(u32));
> +}
> +
> +static int airoha_efuse_reg_read(void *context, unsigned int offset,
> +				 unsigned int *val)
> +{
> +	struct airoha_efuse_bank_priv *priv = context;
> +	struct arm_smccc_res res;
> +
> +	arm_smccc_1_1_invoke(AIROHA_SMC_EFUSE_FID,
> +			     AIROHA_SMC_EFUSE_SUB_ID_READ,
> +			     priv->bank_index, offset, 0, 0, 0, 0, &res);
> +
> +	/* check if SMC reported an error */
> +	if (res.a0)
> +		return -EIO;
> +
> +	*val = res.a1;
> +	return 0;
> +}
> +
> +static const struct regmap_config airoha_efuse_regmap_config = {
> +	.reg_read = airoha_efuse_reg_read,
> +	.reg_bits = 32,
> +	.val_bits = 32,
> +	.reg_stride = 4,
> +};
> +
> +static int airoha_efuse_probe(struct platform_device *pdev)
> +{
> +	struct device *dev = &pdev->dev;
> +	int ret;
> +
> +	for_each_child_of_node_scoped(dev->of_node, child) {
> +		struct nvmem_config airoha_nvmem_config = {
> +			.name = "airoha-efuse",
> +			.size = AIROHA_EFUSE_CELLS * sizeof(u32),
> +			.stride = sizeof(u32),
> +			.word_size = sizeof(u32),
> +			.reg_read = airoha_efuse_read,
> +		};
> +		struct airoha_efuse_bank_priv *priv;
> +		struct nvmem_device *nvmem;
> +		struct regmap *regmap;
> +		u32 bank;
> +
> +		ret = of_property_read_u32(child, "reg", &bank);
> +		if (ret)
> +			return ret;
> +
> +		priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
> +		if (!priv)
> +			return -ENOMEM;
> +
> +		priv->bank_index = bank;

bank is 32 bit value now stored in 8 bit variable.

can we make bank_index 32 bit wide?