Re: [PATCH 1/3] soc: qcom: Add pmic-gio GIO framework driver

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [Medium] soc: qcom: pmic_gio: UCSI MESSAGE_OUT blocks marked read-only
  in pmic_gio_reg_blocks
- [Medium] soc: qcom: pmic_gio: broken auxiliary_device release lifetime
  in devm_pmic_gio_add_consumer()
--

commit 0534b1e914edfb726f83b9ccdae4428780afd1fd
Author: Fenglin Wu <fenglin.wu@oss.qualcomm.com>

soc: qcom: Add pmic-gio GIO framework driver

This commit adds a transport-agnostic PMIC GIO framework driver that exposes
the SoCCP battery-management firmware register space via regmap, routes
alerts through a virtual IRQ domain, and provides helpers for registering
transports, state notifiers, and auxiliary consumer devices.

> diff --git a/drivers/soc/qcom/pmic_gio.c b/drivers/soc/qcom/pmic_gio.c
> new file mode 100644
> index 0000000000000..7237bf1c549cf
> --- /dev/null
> +++ b/drivers/soc/qcom/pmic_gio.c
[ ... ]
> +static const struct pmic_gio_reg_block pmic_gio_reg_blocks[] = {
[ ... ]
> +	/* USBC */
> +	{ GIO_USBC_IF_VERSION_ADDR, GIO_USBC_IF_VERSION_SIZE, false },
> +	{ GIO_USBC_ALERT_STATUS_ADDR, GIO_USBC_ALERT_STATUS_SIZE, false },
> +	{ GIO_USBC_LAST_ALERT_ADDR, GIO_USBC_LAST_ALERT_SIZE, false },
> +	{ GIO_USBC_UCSI_VERSION_REG, GIO_USBC_UCSI_VERSION_SIZE, false },
> +	{ GIO_USBC_UCSI_CCI_REG, GIO_USBC_UCSI_CCI_SIZE, false },
> +	{ GIO_USBC_UCSI_CONTROL_REG, GIO_USBC_UCSI_CONTROL_SIZE, true },
> +	{ GIO_USBC_UCSI_MESSAGE_IN_REG, GIO_USBC_UCSI_MESSAGE_IN_SIZE, false },
> +	{ GIO_USBC_UCSI_MSGINX_REG, GIO_USBC_UCSI_MSGINX_SIZE, false },
> +	{ GIO_USBC_UCSI_MESSAGE_OUT_REG, GIO_USBC_UCSI_MESSAGE_OUT_SIZE, false },
> +	{ GIO_USBC_UCSI_MSGOUTX_ADDR, GIO_USBC_UCSI_MSGOUTX_SIZE, false },

[Severity: Medium]
Should GIO_USBC_UCSI_MESSAGE_OUT_REG and GIO_USBC_UCSI_MSGOUTX_ADDR have
writeable set to true?  In UCSI, the OS writes outbound command payloads to
MESSAGE_OUT and MSGOUTX before writing CONTROL, but
pmic_gio_regmap_bus_gather_write() and pmic_gio_writeable_reg() reject
writes when writeable is false.

[ ... ]

> +static void pmic_gio_aux_release(struct device *dev)
> +{
> +	of_node_put(dev->of_node);
> +	dev->of_node = NULL;
> +}
> +
> +static void pmic_gio_del_aux_device(void *data)
> +{
> +	struct auxiliary_device *aux = data;
> +
> +	auxiliary_device_delete(aux);
> +	auxiliary_device_uninit(aux);
> +}

[ ... ]

> +int devm_pmic_gio_add_consumer(struct pmic_gio_device *gio, struct auxiliary_device *aux,
> +			       const char *name)
> +{
> +	int ret;
> +
> +	aux->name = name;
> +	aux->dev.parent = gio->dev;
> +	aux->dev.release = pmic_gio_aux_release;
> +	aux->dev.platform_data = gio;
> +	device_set_of_node_from_dev(&aux->dev, gio->dev);
> +	ret = auxiliary_device_init(aux);
> +	if (ret) {
> +		of_node_put(aux->dev.of_node);
> +		aux->dev.of_node = NULL;
> +		return ret;
> +	}
> +
> +	ret = auxiliary_device_add(aux);
> +	if (ret) {
> +		auxiliary_device_uninit(aux);
> +		return ret;
> +	}
> +
> +	return devm_add_action_or_reset(gio->dev, pmic_gio_del_aux_device, aux);
> +}
> +EXPORT_SYMBOL_GPL(devm_pmic_gio_add_consumer);

[Severity: Medium]
Does pmic_gio_aux_release() violate the struct device lifetime rules by not
freeing aux?  A reference-counted struct auxiliary_device must be freed in
its dev.release callback when the last reference drops; if the caller
allocates aux with devm_kzalloc(), unbinding the parent frees aux while a
reference to aux->dev may still be held, causing a use-after-free.

Could devm_pmic_gio_add_consumer() wrap devm_auxiliary_device_create(gio->dev,
name, gio) instead of taking a caller-allocated struct auxiliary_device?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110-gio-framework-rtc-driver-2026-10-12-v1-0-e4164178183a@oss.qualcomm.com?part=1