[PATCH 0/6] bus: fsl-mc: fixes and .shutdown() op for dprc driver

[PATCH 0/6] bus: fsl-mc: fixes and .shutdown() op for dprc driver

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

The patch series addresses various issues showing up on DPAA2
driver bring down, fixing scenarios such as kexec, bind/unbind
and halt/reboot. Most notable change is the addition of the
.shutdown() op for the DPRC driver.

Laurentiu Tudor (6):
  bus: fsl-mc: drop useless cleanup
  bus: fsl-mc: fix a use-after-free issue
  bus: fsl-mc: fix double free of the root DPRC fsl-mc device
  bus: fsl-mc: check for null irq array
  bus: fsl-mc: move uapi misc dev create/remove in probe and remove
  bus: fsl-mc: add .shutdown() op for DPRC driver

 drivers/bus/fsl-mc/dprc-driver.c      | 61 ++++++++++++++++++++-------
 drivers/bus/fsl-mc/fsl-mc-allocator.c | 24 -----------
 drivers/bus/fsl-mc/fsl-mc-bus.c       | 34 +++++++++------
 drivers/bus/fsl-mc/fsl-mc-private.h   |  2 -
 4 files changed, 67 insertions(+), 54 deletions(-)

-- 
2.17.1

[PATCH 1/6] bus: fsl-mc: drop useless cleanup

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

This cleanup is actually a no-op because the resources are freed when
the device objects are removed from the allocator at driver remove
time.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/dprc-driver.c      |  2 --
 drivers/bus/fsl-mc/fsl-mc-allocator.c | 24 ------------------------
 drivers/bus/fsl-mc/fsl-mc-private.h   |  2 --
 3 files changed, 28 deletions(-)

diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
index 5e70f9775a0e..36681cf7c42e 100644
--- a/drivers/bus/fsl-mc/dprc-driver.c
+++ b/drivers/bus/fsl-mc/dprc-driver.c
@@ -801,8 +801,6 @@ int dprc_cleanup(struct fsl_mc_device *mc_dev)
 		dev_set_msi_domain(&mc_dev->dev, NULL);
 	}
 
-	fsl_mc_cleanup_all_resource_pools(mc_dev);
-
 	/* if this step fails we cannot go further with cleanup as there is no way of
 	 * communicating with the firmware
 	 */
diff --git a/drivers/bus/fsl-mc/fsl-mc-allocator.c b/drivers/bus/fsl-mc/fsl-mc-allocator.c
index dced427ca8ba..9fa2a8c28a2d 100644
--- a/drivers/bus/fsl-mc/fsl-mc-allocator.c
+++ b/drivers/bus/fsl-mc/fsl-mc-allocator.c
@@ -549,30 +549,6 @@ void fsl_mc_init_all_resource_pools(struct fsl_mc_device *mc_bus_dev)
 	}
 }
 
-static void fsl_mc_cleanup_resource_pool(struct fsl_mc_device *mc_bus_dev,
-					 enum fsl_mc_pool_type pool_type)
-{
-	struct fsl_mc_resource *resource;
-	struct fsl_mc_resource *next;
-	struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_bus_dev);
-	struct fsl_mc_resource_pool *res_pool =
-					&mc_bus->resource_pools[pool_type];
-	int free_count = 0;
-
-	list_for_each_entry_safe(resource, next, &res_pool->free_list, node) {
-		free_count++;
-		devm_kfree(&mc_bus_dev->dev, resource);
-	}
-}
-
-void fsl_mc_cleanup_all_resource_pools(struct fsl_mc_device *mc_bus_dev)
-{
-	int pool_type;
-
-	for (pool_type = 0; pool_type < FSL_MC_NUM_POOL_TYPES; pool_type++)
-		fsl_mc_cleanup_resource_pool(mc_bus_dev, pool_type);
-}
-
 /*
  * fsl_mc_allocator_probe - callback invoked when an allocatable device is
  * being added to the system
diff --git a/drivers/bus/fsl-mc/fsl-mc-private.h b/drivers/bus/fsl-mc/fsl-mc-private.h
index b3520ea1b9f4..450af2bf7de7 100644
--- a/drivers/bus/fsl-mc/fsl-mc-private.h
+++ b/drivers/bus/fsl-mc/fsl-mc-private.h
@@ -635,8 +635,6 @@ void fsl_mc_allocator_driver_exit(void);
 
 void fsl_mc_init_all_resource_pools(struct fsl_mc_device *mc_bus_dev);
 
-void fsl_mc_cleanup_all_resource_pools(struct fsl_mc_device *mc_bus_dev);
-
 int __must_check fsl_mc_resource_allocate(struct fsl_mc_bus *mc_bus,
 					  enum fsl_mc_pool_type pool_type,
 					  struct fsl_mc_resource
-- 
2.17.1

[PATCH 2/6] bus: fsl-mc: fix a use-after-free issue

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

Lets keep a reference to the MC IO object before deleting the
containing device structure, so that we can safely free it.
This fixes the below use-after-free kasan warning:

==================================================================
BUG: KASAN: use-after-free in fsl_mc_bus_remove+0xb8/0x198
Read of size 8 at addr ffff00203a304300 by task reboot/1362

CPU: 8 PID: 1362 Comm: reboot Not tainted 5.14.0-rc1-00218-g23d67ae4b6d7-dirty #111
Hardware name: NXP NXP LX2160ARDB Platform, BIOS EDK II Apr 16 2021
Call trace:
 dump_backtrace+0x0/0x2a4
 show_stack+0x1c/0x30
 dump_stack_lvl+0x68/0x84
 print_address_description.constprop.0+0x74/0x2b8
 kasan_report+0x1e0/0x24c
 __asan_load8+0xa4/0xd0
 fsl_mc_bus_remove+0xb8/0x198
 fsl_mc_bus_shutdown+0x14/0x24
 platform_shutdown+0x44/0x54
 device_shutdown+0x1f0/0x430
 __do_sys_reboot+0x290/0x31c
 __arm64_sys_reboot+0x58/0x70
 invoke_syscall+0x60/0x190
 el0_svc_common+0x84/0x130
 do_el0_svc+0x88/0xa4
 el0_svc+0x24/0x34
 el0t_64_sync_handler+0xa8/0x130
 el0t_64_sync+0x198/0x19c

Allocated by task 7:
 kasan_save_stack+0x2c/0x60
 __kasan_kmalloc+0x90/0xb4
 fsl_mc_device_add+0x104/0x8f0
 fsl_mc_bus_probe+0x400/0x650
 platform_probe+0x90/0x110
 really_probe.part.0+0xec/0x480
 __driver_probe_device+0xd4/0x180
 driver_probe_device+0xf8/0x1e0
 __device_attach_driver+0x120/0x190
 bus_for_each_drv+0xec/0x15c
 __device_attach+0x168/0x250
 device_initial_probe+0x18/0x24
 bus_probe_device+0xec/0x100
 deferred_probe_work_func+0xe8/0x130
 process_one_work+0x3b8/0x650
 worker_thread+0x3cc/0x72c
 kthread+0x1f8/0x210
 ret_from_fork+0x10/0x18

Freed by task 1362:
 kasan_save_stack+0x2c/0x60
 kasan_set_track+0x2c/0x40
 kasan_set_free_info+0x2c/0x50
 __kasan_slab_free+0xdc/0x140
 kfree+0xd4/0x360
 fsl_mc_device_release+0x30/0x40
 device_release+0x54/0x110
 kobject_put+0xac/0x180
 put_device+0x18/0x30
 fsl_mc_device_remove+0x48/0x5c
 fsl_mc_bus_remove+0x84/0x198
 fsl_mc_bus_shutdown+0x14/0x24
 platform_shutdown+0x44/0x54
 device_shutdown+0x1f0/0x430
 __do_sys_reboot+0x290/0x31c
 __arm64_sys_reboot+0x58/0x70
 invoke_syscall+0x60/0x190
 el0_svc_common+0x84/0x130
 do_el0_svc+0x88/0xa4
 el0_svc+0x24/0x34
 el0t_64_sync_handler+0xa8/0x130
 el0t_64_sync+0x198/0x19c

The buggy address belongs to the object at ffff00203a304000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 768 bytes inside of
 2048-byte region [ffff00203a304000, ffff00203a304800)
The buggy address belongs to the page:
page:00000000c0d8f504 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20ba300
head:00000000c0d8f504 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xbfffc0000010200(slab|head|node=0|zone=2|lastcpupid=0xffff)
raw: 0bfffc0000010200 0000000000000000 dead000000000122 ffff002000002a00
raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00203a304200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff00203a304280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff00203a304300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff00203a304380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff00203a304400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 8fd4a356a86e..8cbac1b4b60e 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1236,14 +1236,16 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 static int fsl_mc_bus_remove(struct platform_device *pdev)
 {
 	struct fsl_mc *mc = platform_get_drvdata(pdev);
+	struct fsl_mc_io *mc_io;
 
 	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
 		return -EINVAL;
 
+	mc_io = mc->root_mc_bus_dev->mc_io;
+
 	fsl_mc_device_remove(mc->root_mc_bus_dev);
 
-	fsl_destroy_mc_io(mc->root_mc_bus_dev->mc_io);
-	mc->root_mc_bus_dev->mc_io = NULL;
+	fsl_destroy_mc_io(mc_io);
 
 	bus_unregister_notifier(&fsl_mc_bus_type, &fsl_mc_nb);
 
-- 
2.17.1

[PATCH 3/6] bus: fsl-mc: fix double free of the root DPRC fsl-mc device

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

By simply calling remove() op from shutdown() op we end up
deleting twice the root DPRC fsl-mc device. This causes various
issues such as the crash below [1], on reboot. Re-arrange the code
in shutdown and remove callbacks so this does not happen any more.

Unable to handle kernel NULL pointer dereference at virtual address 0
Mem abort info:
  ESR = 0x96000006
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x06: level 2 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000006
  CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgdp=00000081086db000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 977 Comm: reboot Not tainted 5.14.0-rc1-00221
Hardware name: Freescale Layerscape 2088A RDB Board (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO BTYPE=--)
pc : sysfs_remove_link_from_group+0x28/0x94
lr : iommu_device_unlink+0x94/0xb4
sp : ffff800012b3b8c0
x29: ffff800012b3b8c0 x28: ffff24f8e061a940 x27: 0000000000000000
x26: 0000000000000000 x25: ffffb43783811228 x24: ffff24f840a882f0
x23: ffff24f8400cf000 x22: 0000000000000003 x21: ffffb43783bb6e10
x20: ffff24f8c9641040 x19: 0000000000000000 x18: ffffffffffffffff
x17: 3236366535672d31 x16: 323230302d316372 x15: ffff800092b3b537
x14: 0000000000000004 x13: 0000000000000000 x12: ffff24f840467af8
x11: ffff24f8404c7d98 x10: ffff24f840467908 x9 : ffff24f840064b98
x8 : ffff24f840467930 x7 : ffff24f8e061a940 x6 : ffff24f840453b30
x5 : 0000000000000001 x4 : 0000000000000000 x3 : ffffb43784442d28
x2 : ffff24f8c9641040 x1 : ffffb43783bb6e10 x0 : 0000000000000000
Call trace:
 sysfs_remove_link_from_group+0x28/0x94
 iommu_device_unlink+0x94/0xb4
 iommu_release_device+0x34/0x94
 iommu_bus_notifier+0xc0/0xd4
 blocking_notifier_call_chain+0x70/0xac
 device_del+0x2f4/0x424
 fsl_mc_device_remove+0x4c/0x80
 __fsl_mc_device_remove+0x14/0x2c
 device_for_each_child+0x5c/0xac
 dprc_remove+0x44/0x70
 fsl_mc_driver_remove+0x4c/0xa0
 __device_release_driver+0x188/0x22c
 device_release_driver+0x30/0x50
 bus_remove_device+0x10c/0x140
 device_del+0x16c/0x424
 fsl_mc_bus_remove+0xb8/0x160
 fsl_mc_bus_shutdown+0x14/0x20
 platform_shutdown+0x28/0x40
 device_shutdown+0x15c/0x360
 __do_sys_reboot+0x218/0x2a0
 __arm64_sys_reboot+0x28/0x34
 invoke_syscall+0x48/0x114
 el0_svc_common+0x40/0xdc
 do_el0_svc+0x2c/0x94
 el0_svc+0x2c/0x54
 el0t_64_sync_handler+0xa8/0x12c
 el0t_64_sync+0x198/0x19c
Code: aa0203f4 f90013f5 aa0103f5 b5000060 (f9400002)
---[ end trace 1a98489358f432bb ]---
/etc/rc6.d/S90reboot: line 15:   977 Segmentation fault      reboot -d -f

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/fsl-mc-bus.c | 30 +++++++++++++++++++-----------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/drivers/bus/fsl-mc/fsl-mc-bus.c b/drivers/bus/fsl-mc/fsl-mc-bus.c
index 8cbac1b4b60e..459947988e0d 100644
--- a/drivers/bus/fsl-mc/fsl-mc-bus.c
+++ b/drivers/bus/fsl-mc/fsl-mc-bus.c
@@ -1230,21 +1230,18 @@ static int fsl_mc_bus_probe(struct platform_device *pdev)
 }
 
 /*
- * fsl_mc_bus_remove - callback invoked when the root MC bus is being
- * removed
+ * fsl_mc_bus_shutdown - callback invoked when the root MC bus is being
+ * shutdown
  */
-static int fsl_mc_bus_remove(struct platform_device *pdev)
+static void fsl_mc_bus_shutdown(struct platform_device *pdev)
 {
 	struct fsl_mc *mc = platform_get_drvdata(pdev);
 	struct fsl_mc_io *mc_io;
 
 	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
-		return -EINVAL;
+		return;
 
 	mc_io = mc->root_mc_bus_dev->mc_io;
-
-	fsl_mc_device_remove(mc->root_mc_bus_dev);
-
 	fsl_destroy_mc_io(mc_io);
 
 	bus_unregister_notifier(&fsl_mc_bus_type, &fsl_mc_nb);
@@ -1258,13 +1255,24 @@ static int fsl_mc_bus_remove(struct platform_device *pdev)
 		       (GCR1_P1_STOP | GCR1_P2_STOP),
 		       mc->fsl_mc_regs + FSL_MC_GCR1);
 	}
-
-	return 0;
 }
 
-static void fsl_mc_bus_shutdown(struct platform_device *pdev)
+/*
+ * fsl_mc_bus_remove - callback invoked when the root MC bus is being
+ * removed
+ */
+static int fsl_mc_bus_remove(struct platform_device *pdev)
 {
-	fsl_mc_bus_remove(pdev);
+	struct fsl_mc *mc = platform_get_drvdata(pdev);
+
+	if (!fsl_mc_is_root_dprc(&mc->root_mc_bus_dev->dev))
+		return -EINVAL;
+
+	fsl_mc_device_remove(mc->root_mc_bus_dev);
+
+	fsl_mc_bus_shutdown(pdev);
+
+	return 0;
 }
 
 static const struct of_device_id fsl_mc_bus_match_table[] = {
-- 
2.17.1

[PATCH 4/6] bus: fsl-mc: check for null irq array

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

In VFIO case, the irq array in the fsl_mc device is not initialized,
so given that in upcoming patches this code will also get called by
VFIO add a check for null in the irq teardown function.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/dprc-driver.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
index 36681cf7c42e..8482c4fca835 100644
--- a/drivers/bus/fsl-mc/dprc-driver.c
+++ b/drivers/bus/fsl-mc/dprc-driver.c
@@ -767,7 +767,12 @@ static int dprc_probe(struct fsl_mc_device *mc_dev)
  */
 static void dprc_teardown_irq(struct fsl_mc_device *mc_dev)
 {
-	struct fsl_mc_device_irq *irq = mc_dev->irqs[0];
+	struct fsl_mc_device_irq *irq;
+
+	if (!mc_dev->irqs)
+		return;
+
+	irq = mc_dev->irqs[0];
 
 	(void)disable_dprc_irq(mc_dev);
 
-- 
2.17.1

[PATCH 5/6] bus: fsl-mc: move uapi misc dev create/remove in probe and remove

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

When devices are owned by VFIO lets not allow user-space to play with
them through the restool management interface thus breaking isolation.
Drop restool misc device creation and destruction from the common
dprc_setup() and dprc_cleanup() functions (shared with fsl-mc VFIO)
and open code it drpc driver's probe and remove ops.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/dprc-driver.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
index 8482c4fca835..82bf3fe09273 100644
--- a/drivers/bus/fsl-mc/dprc-driver.c
+++ b/drivers/bus/fsl-mc/dprc-driver.c
@@ -618,7 +618,6 @@ int dprc_setup(struct fsl_mc_device *mc_dev)
 	struct irq_domain *mc_msi_domain;
 	bool mc_io_created = false;
 	bool msi_domain_set = false;
-	bool uapi_created = false;
 	u16 major_ver, minor_ver;
 	size_t region_size;
 	int error;
@@ -651,11 +650,6 @@ int dprc_setup(struct fsl_mc_device *mc_dev)
 			return error;
 
 		mc_io_created = true;
-	} else {
-		error = fsl_mc_uapi_create_device_file(mc_bus);
-		if (error < 0)
-			return -EPROBE_DEFER;
-		uapi_created = true;
 	}
 
 	mc_msi_domain = fsl_mc_find_msi_domain(&mc_dev->dev);
@@ -713,9 +707,6 @@ int dprc_setup(struct fsl_mc_device *mc_dev)
 		mc_dev->mc_io = NULL;
 	}
 
-	if (uapi_created)
-		fsl_mc_uapi_remove_device_file(mc_bus);
-
 	return error;
 }
 EXPORT_SYMBOL_GPL(dprc_setup);
@@ -734,9 +725,15 @@ static int dprc_probe(struct fsl_mc_device *mc_dev)
 {
 	int error;
 
+	if (fsl_mc_is_root_dprc(&mc_dev->dev)) {
+		error = fsl_mc_uapi_create_device_file(to_fsl_mc_bus(mc_dev));
+		if (error < 0)
+			return -EPROBE_DEFER;
+	}
+
 	error = dprc_setup(mc_dev);
 	if (error < 0)
-		return error;
+		goto uapi_cleanup;
 
 	/*
 	 * Discover MC objects in DPRC object:
@@ -759,6 +756,10 @@ static int dprc_probe(struct fsl_mc_device *mc_dev)
 	device_for_each_child(&mc_dev->dev, NULL, __fsl_mc_device_remove);
 dprc_cleanup:
 	dprc_cleanup(mc_dev);
+uapi_cleanup:
+	if (fsl_mc_is_root_dprc(&mc_dev->dev))
+		fsl_mc_uapi_remove_device_file(to_fsl_mc_bus(mc_dev));
+
 	return error;
 }
 
@@ -792,7 +793,6 @@ static void dprc_teardown_irq(struct fsl_mc_device *mc_dev)
 
 int dprc_cleanup(struct fsl_mc_device *mc_dev)
 {
-	struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_dev);
 	int error;
 
 	/* this function should be called only for DPRCs, it
@@ -821,8 +821,6 @@ int dprc_cleanup(struct fsl_mc_device *mc_dev)
 	if (!fsl_mc_is_root_dprc(&mc_dev->dev)) {
 		fsl_destroy_mc_io(mc_dev->mc_io);
 		mc_dev->mc_io = NULL;
-	} else {
-		fsl_mc_uapi_remove_device_file(mc_bus);
 	}
 
 	return 0;
@@ -854,6 +852,9 @@ static int dprc_remove(struct fsl_mc_device *mc_dev)
 
 	device_for_each_child(&mc_dev->dev, NULL, __fsl_mc_device_remove);
 
+	if (fsl_mc_is_root_dprc(&mc_dev->dev))
+		fsl_mc_uapi_remove_device_file(to_fsl_mc_bus(mc_dev));
+
 	dprc_cleanup(mc_dev);
 
 	dev_info(&mc_dev->dev, "DPRC device unbound from driver");
-- 
2.17.1

[PATCH 6/6] bus: fsl-mc: add .shutdown() op for DPRC driver

[laurentiu.tudor]

From: Laurentiu Tudor <laurentiu.tudor@nxp.com>

In order for kexec scenarios to work, implement a .shutdown() op for
the DPRC driver.

Signed-off-by: Laurentiu Tudor <laurentiu.tudor@nxp.com>
---
 drivers/bus/fsl-mc/dprc-driver.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/drivers/bus/fsl-mc/dprc-driver.c b/drivers/bus/fsl-mc/dprc-driver.c
index 82bf3fe09273..405cd054c2ea 100644
--- a/drivers/bus/fsl-mc/dprc-driver.c
+++ b/drivers/bus/fsl-mc/dprc-driver.c
@@ -861,6 +861,30 @@ static int dprc_remove(struct fsl_mc_device *mc_dev)
 	return 0;
 }
 
+/**
+ * dprc_shutdown - callback invoked when a DPRC should be quiesced
+ *
+ * @mc_dev: Pointer to fsl-mc device representing the DPRC
+ *
+ * Closes the DPRC device in the MC.
+ * It tears down the interrupts that were configured for the DPRC device.
+ * It destroys the interrupt pool associated with this MC bus.
+ */
+static void dprc_shutdown(struct fsl_mc_device *mc_dev)
+{
+	struct fsl_mc_bus *mc_bus = to_fsl_mc_bus(mc_dev);
+
+	if (!is_fsl_mc_bus_dprc(mc_dev))
+		return;
+
+	if (!mc_bus->irq_resources)
+		return;
+
+	dprc_cleanup(mc_dev);
+
+	dev_info(&mc_dev->dev, "DPRC device shutdown");
+}
+
 static const struct fsl_mc_device_id match_id_table[] = {
 	{
 	 .vendor = FSL_MC_VENDOR_FREESCALE,
@@ -877,6 +901,7 @@ static struct fsl_mc_driver dprc_driver = {
 	.match_id_table = match_id_table,
 	.probe = dprc_probe,
 	.remove = dprc_remove,
+	.shutdown = dprc_shutdown,
 };
 
 int __init dprc_driver_init(void)
-- 
2.17.1

Re: [PATCH 0/6] bus: fsl-mc: fixes and .shutdown() op for dprc driver

[Ioana Ciornei]

On Tue, Feb 08, 2022 at 04:59:22PM +0200, laurentiu.tudor@nxp.com wrote:
> From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
> 
> The patch series addresses various issues showing up on DPAA2
> driver bring down, fixing scenarios such as kexec, bind/unbind
> and halt/reboot. Most notable change is the addition of the
> .shutdown() op for the DPRC driver.
> 
> Laurentiu Tudor (6):
>   bus: fsl-mc: drop useless cleanup
>   bus: fsl-mc: fix a use-after-free issue
>   bus: fsl-mc: fix double free of the root DPRC fsl-mc device
>   bus: fsl-mc: check for null irq array
>   bus: fsl-mc: move uapi misc dev create/remove in probe and remove
>   bus: fsl-mc: add .shutdown() op for DPRC driver
> 

Reviewed-by: Ioana Ciornei <ioana.ciornei@nxp.com>

Re: [PATCH 0/6] bus: fsl-mc: fixes and .shutdown() op for dprc driver

[Diana Madalina Craciun]

Reviewed-by: Diana Craciun <diana.craciun@oss.nxp.com>

On 2/8/2022 4:59 PM, laurentiu.tudor@nxp.com wrote:
> From: Laurentiu Tudor <laurentiu.tudor@nxp.com>
>
> The patch series addresses various issues showing up on DPAA2
> driver bring down, fixing scenarios such as kexec, bind/unbind
> and halt/reboot. Most notable change is the addition of the
> .shutdown() op for the DPRC driver.
>
> Laurentiu Tudor (6):
>    bus: fsl-mc: drop useless cleanup
>    bus: fsl-mc: fix a use-after-free issue
>    bus: fsl-mc: fix double free of the root DPRC fsl-mc device
>    bus: fsl-mc: check for null irq array
>    bus: fsl-mc: move uapi misc dev create/remove in probe and remove
>    bus: fsl-mc: add .shutdown() op for DPRC driver
>
>   drivers/bus/fsl-mc/dprc-driver.c      | 61 ++++++++++++++++++++-------
>   drivers/bus/fsl-mc/fsl-mc-allocator.c | 24 -----------
>   drivers/bus/fsl-mc/fsl-mc-bus.c       | 34 +++++++++------
>   drivers/bus/fsl-mc/fsl-mc-private.h   |  2 -
>   4 files changed, 67 insertions(+), 54 deletions(-)
>