From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from outbound1.mail.transip.nl (outbound1.mail.transip.nl [149.210.149.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8DCA2D0C64; Sun, 31 May 2026 04:09:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=149.210.149.72 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780200567; cv=none; b=W+/0UpcIfjI4VdwsclXZ0y4ZlU57A4gYOs5sHgbtZmV5sK7vnpR3gGdoGOCPo4Lg3OHHFc9d4j0nw5NiOde+xjTI/qeicZlE8cFOoI5D5Le+fVCbukEDzNZuqhf7EdeUP3u/oE6Lkgtm+9wv66q+pjF2HjZJUVMq+ADlPJ7+0Kk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780200567; c=relaxed/simple; bh=8jFx2EfHA/j1MYHywm1IJI7M7Nx1G4RjikfGNeK1t+Q=; h=From:To:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=VXUKPr91Ffz73xdZhhb3ZXxYNsKwYxGnzJkdAAZMmgB24gazRp33KuWL5wj69RqRzA1icoqbDvdRtApiNel6rbXLluKSKfjdgBaF3jDknSGK6oPjwYnLdOE90dwcVN5IYVsMULPirvWxgeyzFiqf8LVAK6XgHByWERMscb2gu/s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=herrie.org; spf=pass smtp.mailfrom=herrie.org; dkim=pass (2048-bit key) header.d=herrie.org header.i=@herrie.org header.b=dh7LQijA; arc=none smtp.client-ip=149.210.149.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=herrie.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=herrie.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=herrie.org header.i=@herrie.org header.b="dh7LQijA" Received: from submission1.mail.transip.nl (unknown [10.100.4.70]) by outbound1.mail.transip.nl (Postfix) with ESMTP id 4gSkB06z75zRhjc; Sun, 31 May 2026 06:09:12 +0200 (CEST) Received: from herrie-desktop.. (180-93-184-31.ftth.glasoperator.nl [31.184.93.180]) by submission1.mail.transip.nl (Postfix) with ESMTPA id 4gSkB00f6FzJjhXx; Sun, 31 May 2026 06:09:12 +0200 (CEST) From: Herman van Hazendonk To: Bjorn Andersson , Clark Williams , Conor Dooley , devicetree@vger.kernel.org, Konrad Dybcio , Krzysztof Kozlowski , linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-rt-devel@lists.linux.dev, Rob Herring , Sebastian Andrzej Siewior , Steven Rostedt , Thomas Gleixner , van Hazendonk Subject: [PATCH v2 0/2] irqchip: add MSM8x60 MPM wakeup interrupt controller Date: Sun, 31 May 2026 06:09:09 +0200 Message-ID: X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: devicetree@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Scanned-By: ClueGetter at submission1.mail.transip.nl DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; s=transip-a; d=herrie.org; t=1780200552; h=from:subject:to:references: in-reply-to:date:mime-version; bh=n6KVD8QjDPvusnMvLoUlxwwYj06x0h+adODibnesU8A=; b=dh7LQijAqAVXTgLeLbLSzbPINlCxAzrM44NwUjGguEN7MP0mo4wPV8kYjCl5RczpaxtVt3 UHE8tc03jpotyhMoyMc++9MY+NaHYECSVyEkNU0ADHOCBqlOniVwJnWTZElNSHCFSoStc5 Gz2yJ/9LDA608o1wjXdRUbR9HOaD4vH8nMY+e4HesDXw5MYOBu2tSnDiOAgmfoLv985gGP H2REXNT3xQiVzNkcv8JQKZlO4ur4tI+tT9u0WnGaelf78tQTy0sVSeaPIOPLjJihhhljFn vzNw7t4wITvZlvjUpCw18gs8tivcFKFqiWh068hdYg3zS2b2/ubbKpYhrTsV8g== X-Report-Abuse-To: abuse@transip.nl Hi all, Self-review (with Sashiko AI assist) caught eight real issues in v1 before maintainer review reached them; re-rolling promptly. v1: https://lore.kernel.org/linux-arm-msm/cover.1780148149.git.github.com@herrie.org/ v2 changes: - PREEMPT_RT: drop the syscon regmap and ioremap the vMPM sub-region of the RPM control block directly. The IRQ core invokes the irqchip mask/unmask/set_type/set_wake callbacks with the irq_desc raw_spinlock_t held, and syscon regmaps use a sleepable spinlock_t that becomes an rt_mutex on PREEMPT_RT. Direct MMIO (readl_relaxed/writel_relaxed) is what every other SoC irqchip in tree does for the same reason (qcom-pdc, gic-v3, ...). - RPM doorbell: after every vMPM register write, send a message through the qcom-apcs-ipc mailbox. v1 acquired the mailbox channel but never used it, so the RPM kept running with its cached enable / detect / polarity state and our configuration changes had no effect. - Teardown order: v1 used devm_request_irq() and then called irq_domain_remove() manually in ->remove(); the devres-managed handler outlives the domain, so an IRQ arriving in the removal window would dereference a freed domain. Switch to plain request_irq() / free_irq() and remove in strict reverse-init order (free_irq, free mailbox, irq_domain_remove). - .irq_set_wake: implement it (toggle the MPM enable bit + delegate to irq_chip_set_wake_parent for the GIC) and drop IRQCHIP_SKIP_SET_WAKE. v1 declared SKIP and provided no callback, so enable_irq_wake() was a silent no-op for every consumer. - Clear-before-dispatch: in the IPC IRQ handler, write CLEAR for the pending bits before calling generic_handle_domain_irq() for each pin. v1 cleared after the handler returned, racing against a fresh edge latched during dispatch and silently dropping it. - DT pin-map bounds check: validate each qcom,mpm-pin-map pin entry against MSM8660_MPM_PIN_COUNT before storing it, so a malformed DT cannot induce out-of-bounds register accesses in later set_type/enable paths. - Consumer API lifetime: msm8660_mpm_get() now takes a consumer device argument and establishes a DL_FLAG_AUTOREMOVE_CONSUMER device link to the MPM device. Without this, an unbind of the MPM driver would free the devres-managed struct while consumers still hold pointers, causing UAF on the next call. - regmap_read return check: moot now that we use readl_relaxed, but the original Sashiko finding (uninitialised val on regmap error) is closed. DT binding: drop qcom,rpm-syscon and qcom,mpm-offset; replace with a single reg property pointing at the vMPM window inside the RPM control block. dt_binding_check passes on the example. Driver passes checkpatch with zero warnings or errors. Thanks, Herman Herman van Hazendonk (2): dt-bindings: interrupt-controller: qcom: add msm8660-mpm irqchip: add MSM8x60 MPM wakeup interrupt controller driver .../qcom,msm8660-mpm.yaml | 122 +++ drivers/irqchip/Kconfig | 23 + drivers/irqchip/Makefile | 1 + drivers/irqchip/irq-msm8660-mpm.c | 740 ++++++++++++++++++ include/soc/qcom/msm8660-mpm.h | 83 ++ 5 files changed, 969 insertions(+) create mode 100644 Documentation/devicetree/bindings/interrupt-controller/qcom,msm8660-mpm.yaml create mode 100644 drivers/irqchip/irq-msm8660-mpm.c create mode 100644 include/soc/qcom/msm8660-mpm.h -- 2.43.0