[PATCH 0/3] platform/x86: intel: TPMI/PLR PCI unbind issue

[PATCH 0/3] platform/x86: intel: TPMI/PLR PCI unbind issue

[Srinivas Pandruvada]

When VSEC PCI device is unbound from PCI driver interface, PLR driver
causes fault. This needs notifier support for proper cleanup.

First two patches are required for the fix in the patch 3/3. Hence they
also have Fixes and Cc:stable tag.

Srinivas Pandruvada (3):
  platform/x86: intel: Move debugfs register before creating devices
  platform/x86: intel: Add notifiers support
  platform/x86/intel/tpmi/plr: Prevent fault during unbind

 drivers/platform/x86/intel/plr_tpmi.c  | 43 ++++++++++++++++++++++++--
 drivers/platform/x86/intel/vsec_tpmi.c | 29 ++++++++++++++---
 include/linux/intel_tpmi.h             |  6 ++++
 3 files changed, 72 insertions(+), 6 deletions(-)

-- 
2.52.0

[PATCH 1/3] platform/x86: intel: Move debugfs register before creating devices

[Srinivas Pandruvada]

It is possible that the driver handling device is enumerated before
registering debugfs. If the driver wants to access debugfs by calling
tpmi_get_debugfs_dir(), this will return error in this case.

Hence register debugfs before creating devices.

Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: <Stable@vger.kernel.org>
---
 drivers/platform/x86/intel/vsec_tpmi.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/platform/x86/intel/vsec_tpmi.c b/drivers/platform/x86/intel/vsec_tpmi.c
index 7fc6ff8d1040..a38014e81e85 100644
--- a/drivers/platform/x86/intel/vsec_tpmi.c
+++ b/drivers/platform/x86/intel/vsec_tpmi.c
@@ -817,10 +817,6 @@ static int intel_vsec_tpmi_init(struct auxiliary_device *auxdev)
 
 	auxiliary_set_drvdata(auxdev, tpmi_info);
 
-	ret = tpmi_create_devices(tpmi_info);
-	if (ret)
-		return ret;
-
 	/*
 	 * Allow debugfs when security policy allows. Everything this debugfs
 	 * interface provides, can also be done via /dev/mem access. If
@@ -830,6 +826,12 @@ static int intel_vsec_tpmi_init(struct auxiliary_device *auxdev)
 	if (!security_locked_down(LOCKDOWN_DEV_MEM) && capable(CAP_SYS_RAWIO))
 		tpmi_dbgfs_register(tpmi_info);
 
+	ret = tpmi_create_devices(tpmi_info);
+	if (ret) {
+		debugfs_remove_recursive(tpmi_info->dbgfs_dir);
+		return ret;
+	}
+
 	return 0;
 }
 
-- 
2.52.0

[PATCH 2/3] platform/x86: intel: Add notifiers support

[Srinivas Pandruvada]

In some cases a driver using services of vsec_tpmi driver requires some
processing before vsec_tpmi exits. For example a children using debugfs
can't use debugfs as this will be deleted by the vsec_tpmi driver.

This is the case when unbind using PCI driver interface. In this case
the remove callback of vsec_tpmi driver is called first, then remove
callback of its children.

Add support of blocking chain notifiers support. Notify on successful probe
and before clean up in the remove callback.

Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: <Stable@vger.kernel.org>
---
 drivers/platform/x86/intel/vsec_tpmi.c | 19 +++++++++++++++++++
 include/linux/intel_tpmi.h             |  6 ++++++
 2 files changed, 25 insertions(+)

diff --git a/drivers/platform/x86/intel/vsec_tpmi.c b/drivers/platform/x86/intel/vsec_tpmi.c
index a38014e81e85..16fd7aa41f20 100644
--- a/drivers/platform/x86/intel/vsec_tpmi.c
+++ b/drivers/platform/x86/intel/vsec_tpmi.c
@@ -56,6 +56,7 @@
 #include <linux/io.h>
 #include <linux/iopoll.h>
 #include <linux/module.h>
+#include <linux/notifier.h>
 #include <linux/pci.h>
 #include <linux/security.h>
 #include <linux/sizes.h>
@@ -188,6 +189,20 @@ struct tpmi_feature_state {
 /* Used during auxbus device creation */
 static DEFINE_IDA(intel_vsec_tpmi_ida);
 
+static BLOCKING_NOTIFIER_HEAD(tpmi_notify_list);
+
+int tpmi_register_notifier(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_register(&tpmi_notify_list, nb);
+}
+EXPORT_SYMBOL_NS_GPL(tpmi_register_notifier, "INTEL_TPMI");
+
+int tpmi_unregister_notifier(struct notifier_block *nb)
+{
+	return blocking_notifier_chain_unregister(&tpmi_notify_list, nb);
+}
+EXPORT_SYMBOL_NS_GPL(tpmi_unregister_notifier, "INTEL_TPMI");
+
 struct oobmsm_plat_info *tpmi_get_platform_data(struct auxiliary_device *auxdev)
 {
 	struct intel_vsec_device *vsec_dev = auxdev_to_ivdev(auxdev);
@@ -832,6 +847,8 @@ static int intel_vsec_tpmi_init(struct auxiliary_device *auxdev)
 		return ret;
 	}
 
+	blocking_notifier_call_chain(&tpmi_notify_list, TPMI_CORE_INIT, auxdev);
+
 	return 0;
 }
 
@@ -845,6 +862,8 @@ static void tpmi_remove(struct auxiliary_device *auxdev)
 {
 	struct intel_tpmi_info *tpmi_info = auxiliary_get_drvdata(auxdev);
 
+	blocking_notifier_call_chain(&tpmi_notify_list, TPMI_CORE_EXIT, auxdev);
+
 	debugfs_remove_recursive(tpmi_info->dbgfs_dir);
 }
 
diff --git a/include/linux/intel_tpmi.h b/include/linux/intel_tpmi.h
index 94c06bf214fb..15f02422e9ca 100644
--- a/include/linux/intel_tpmi.h
+++ b/include/linux/intel_tpmi.h
@@ -28,6 +28,12 @@ enum intel_tpmi_id {
 	TPMI_INFO_ID = 0x81,	/* Special ID for PCI BDF and Package ID information */
 };
 
+#define TPMI_CORE_INIT	0
+#define TPMI_CORE_EXIT	1
+
+int tpmi_register_notifier(struct notifier_block *nb);
+int tpmi_unregister_notifier(struct notifier_block *nb);
+
 struct oobmsm_plat_info *tpmi_get_platform_data(struct auxiliary_device *auxdev);
 struct resource *tpmi_get_resource_at_index(struct auxiliary_device *auxdev, int index);
 int tpmi_get_resource_count(struct auxiliary_device *auxdev);
-- 
2.52.0

[PATCH 3/3] platform/x86/intel/tpmi/plr: Prevent fault during unbind

[Srinivas Pandruvada]

This driver faults when intel vsec driver unbound from PCI driver
interface. For example:

echo 0000:00:03.1 > /sys/bus/pci/drivers/intel_vsec/unbind

This is caused by accessing plr->dbgfs_dir after vsec_tpmi driver is
removed. Here vsec_tpmi driver is the parent. On unbind, the parent
device remove callback is called first which here will remove debugfs
interface. Hence plr->dbgfs_dir is no longer valid.

Register notifier for TPMI_CORE_EXIT and make this pointer to NULL,
so that debugfs_remove_recursive() is not called with bad plr->dbgfs_dir
pointer.

After notifier is returned the vsec_tpmi driver will call remove debugfs
by calling debugfs_remove_recursive().

Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: <Stable@vger.kernel.org>
---
 drivers/platform/x86/intel/plr_tpmi.c | 43 +++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/drivers/platform/x86/intel/plr_tpmi.c b/drivers/platform/x86/intel/plr_tpmi.c
index 05727169f49c..644df673896b 100644
--- a/drivers/platform/x86/intel/plr_tpmi.c
+++ b/drivers/platform/x86/intel/plr_tpmi.c
@@ -22,6 +22,7 @@
 #include <linux/module.h>
 #include <linux/mod_devicetable.h>
 #include <linux/mutex.h>
+#include <linux/notifier.h>
 #include <linux/seq_file.h>
 #include <linux/sprintf.h>
 #include <linux/types.h>
@@ -60,6 +61,8 @@ struct tpmi_plr {
 	struct tpmi_plr_die *die_info;
 	int num_dies;
 	struct auxiliary_device *auxdev;
+	struct notifier_block nb;
+	struct mutex lock; /* Protect access to dbgfs_dir  */
 };
 
 static const char * const plr_coarse_reasons[] = {
@@ -255,6 +258,30 @@ static ssize_t plr_status_write(struct file *filp, const char __user *ubuf,
 }
 DEFINE_SHOW_STORE_ATTRIBUTE(plr_status);
 
+static int intel_plr_notify(struct notifier_block *self, unsigned long action, void *data)
+{
+	struct tpmi_plr *plr = container_of(self, struct tpmi_plr, nb);
+
+	if (action == TPMI_CORE_EXIT) {
+		guard(mutex)(&plr->lock);
+		plr->dbgfs_dir = NULL;
+	}
+
+	return NOTIFY_DONE;
+}
+
+static int intel_plr_register_notifier(struct notifier_block *nb)
+{
+	nb->notifier_call = intel_plr_notify;
+	nb->priority = 0;
+	return tpmi_register_notifier(nb);
+}
+
+static void intel_plr_unregister_notifier(struct notifier_block *nb)
+{
+	tpmi_unregister_notifier(nb);
+}
+
 static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxiliary_device_id *id)
 {
 	struct oobmsm_plat_info *plat_info;
@@ -282,10 +309,16 @@ static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxilia
 	if (!plr)
 		return -ENOMEM;
 
+	mutex_init(&plr->lock);
+
+	intel_plr_register_notifier(&plr->nb);
+
 	plr->die_info = devm_kcalloc(&auxdev->dev, num_resources, sizeof(*plr->die_info),
 				     GFP_KERNEL);
-	if (!plr->die_info)
-		return -ENOMEM;
+	if (!plr->die_info) {
+		err = -ENOMEM;
+		goto err_notify;
+	}
 
 	plr->num_dies = num_resources;
 	plr->dbgfs_dir = debugfs_create_dir("plr", dentry);
@@ -326,6 +359,9 @@ static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxilia
 
 err:
 	debugfs_remove_recursive(plr->dbgfs_dir);
+err_notify:
+	intel_plr_unregister_notifier(&plr->nb);
+
 	return err;
 }
 
@@ -333,6 +369,9 @@ static void intel_plr_remove(struct auxiliary_device *auxdev)
 {
 	struct tpmi_plr *plr = auxiliary_get_drvdata(auxdev);
 
+	intel_plr_unregister_notifier(&plr->nb);
+
+	guard(mutex)(&plr->lock);
 	debugfs_remove_recursive(plr->dbgfs_dir);
 }
 
-- 
2.52.0

Re: [PATCH 3/3] platform/x86/intel/tpmi/plr: Prevent fault during unbind

[Ilpo Järvinen]

On Wed, 29 Apr 2026, Srinivas Pandruvada wrote:

> This driver faults when intel vsec driver unbound from PCI driver
> interface. For example:
> 
> echo 0000:00:03.1 > /sys/bus/pci/drivers/intel_vsec/unbind
> 
> This is caused by accessing plr->dbgfs_dir after vsec_tpmi driver is
> removed. Here vsec_tpmi driver is the parent. On unbind, the parent
> device remove callback is called first which here will remove debugfs
> interface. Hence plr->dbgfs_dir is no longer valid.
> 
> Register notifier for TPMI_CORE_EXIT and make this pointer to NULL,
> so that debugfs_remove_recursive() is not called with bad plr->dbgfs_dir
> pointer.
> 
> After notifier is returned the vsec_tpmi driver will call remove debugfs
> by calling debugfs_remove_recursive().
> 
> Fixes: 811f67c51636 ("platform/x86/intel/tpmi: Add new auxiliary driver for performance limits")
> Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> Cc: <Stable@vger.kernel.org>
> ---
>  drivers/platform/x86/intel/plr_tpmi.c | 43 +++++++++++++++++++++++++--
>  1 file changed, 41 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/platform/x86/intel/plr_tpmi.c b/drivers/platform/x86/intel/plr_tpmi.c
> index 05727169f49c..644df673896b 100644
> --- a/drivers/platform/x86/intel/plr_tpmi.c
> +++ b/drivers/platform/x86/intel/plr_tpmi.c
> @@ -22,6 +22,7 @@
>  #include <linux/module.h>
>  #include <linux/mod_devicetable.h>
>  #include <linux/mutex.h>
> +#include <linux/notifier.h>
>  #include <linux/seq_file.h>
>  #include <linux/sprintf.h>
>  #include <linux/types.h>
> @@ -60,6 +61,8 @@ struct tpmi_plr {
>  	struct tpmi_plr_die *die_info;
>  	int num_dies;
>  	struct auxiliary_device *auxdev;
> +	struct notifier_block nb;
> +	struct mutex lock; /* Protect access to dbgfs_dir  */

Extra whitespace.

Move the comment slightly more right as there's place.

>  };
>  
>  static const char * const plr_coarse_reasons[] = {
> @@ -255,6 +258,30 @@ static ssize_t plr_status_write(struct file *filp, const char __user *ubuf,
>  }
>  DEFINE_SHOW_STORE_ATTRIBUTE(plr_status);
>  
> +static int intel_plr_notify(struct notifier_block *self, unsigned long action, void *data)
> +{
> +	struct tpmi_plr *plr = container_of(self, struct tpmi_plr, nb);
> +
> +	if (action == TPMI_CORE_EXIT) {
> +		guard(mutex)(&plr->lock);
> +		plr->dbgfs_dir = NULL;
> +	}
> +
> +	return NOTIFY_DONE;
> +}
> +
> +static int intel_plr_register_notifier(struct notifier_block *nb)
> +{
> +	nb->notifier_call = intel_plr_notify;
> +	nb->priority = 0;
> +	return tpmi_register_notifier(nb);
> +}
> +
> +static void intel_plr_unregister_notifier(struct notifier_block *nb)
> +{
> +	tpmi_unregister_notifier(nb);
> +}
> +
>  static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxiliary_device_id *id)
>  {
>  	struct oobmsm_plat_info *plat_info;
> @@ -282,10 +309,16 @@ static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxilia
>  	if (!plr)
>  		return -ENOMEM;
>  
> +	mutex_init(&plr->lock);

This lacks pairing destroy, but you can probably use devm_mutex_init() as 
there's devm_*() below.

> +
> +	intel_plr_register_notifier(&plr->nb);
> +
>  	plr->die_info = devm_kcalloc(&auxdev->dev, num_resources, sizeof(*plr->die_info),
>  				     GFP_KERNEL);
> -	if (!plr->die_info)
> -		return -ENOMEM;
> +	if (!plr->die_info) {
> +		err = -ENOMEM;
> +		goto err_notify;
> +	}
>  
>  	plr->num_dies = num_resources;
>  	plr->dbgfs_dir = debugfs_create_dir("plr", dentry);
> @@ -326,6 +359,9 @@ static int intel_plr_probe(struct auxiliary_device *auxdev, const struct auxilia
>  
>  err:
>  	debugfs_remove_recursive(plr->dbgfs_dir);
> +err_notify:
> +	intel_plr_unregister_notifier(&plr->nb);
> +
>  	return err;
>  }
>  
> @@ -333,6 +369,9 @@ static void intel_plr_remove(struct auxiliary_device *auxdev)
>  {
>  	struct tpmi_plr *plr = auxiliary_get_drvdata(auxdev);
>  
> +	intel_plr_unregister_notifier(&plr->nb);
> +
> +	guard(mutex)(&plr->lock);
>  	debugfs_remove_recursive(plr->dbgfs_dir);
>  }
>  
> 

-- 
 i.