Manivannan writes:

MHI Host
--------

- Add SAHARA channel support in the pci_generic driver for Foxconn products.
  This allows capturing crashdump (ramdump) using the in-kernel sahara client
  driver.

- Add support for devices with no M3 state. Some devices do not support the
  M3 power state due to hardware issues. For those devices, MHI bus will now
  run the full host-side suspend/resume sequence but skip the device-side
  M3/M0 handshake, so any transfer queued by clients during suspend is
  deferred until resume.

- Set 'mhi_cntrl->no_m3' flag in the pci_generic driver for the QDU100 device
  so that the MHI bus also skips the M3 transition during system suspend.
  Earlier, the flag was only used to disable runtime PM, but the system
  suspend path was still transitioning the device to M3.

- Fix sys error transition latency by polling for the state transition in
  mhi_pm_sys_error_transition() instead of waiting up to 24 seconds for an
  interrupt from the device. Since a device that has been reset (e.g., via
  AT!RESET) is not guaranteed to raise one.

- Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET in
  mhi_soc_reset() so that the reset actually reaches the device before the
  caller's post-reset delay begins.

- Fix controller cleanup on EDL sysfs failure in mhi_register_controller().
  The error path was leaving the device registered when sysfs_create_file()
  failed.

MHI Endpoint
------------

- Add mhi_cntrl->flush_async() callback to drain the in-flight async DMA
  read/write operations issued through the MHI controller driver. This is
  used by the MHI EP stack before disconnect to avoid UAF where a late DMA
  completion could invoke a now-invalid xfer_cb().

- Implement the flush_async() callback in the PCI EPF MHI controller driver
  by waiting for the in-flight DMA operations to complete and then flushing
  the DMA workqueue. Since I'm the maintainer for this PCI EPF driver, I'm
  taking this patch through MHI tree due to dependency.

- Flush the in-flight async transfers before notifying disconnect in
  mhi_ep_abort_transfer() to fix a UAF, where a success callback delivered
  after the -ENOTCONN notification could reference resources already freed
  by the client.

- Fix device refcount leak in the error path of mhi_ep_create_device() when
  dev_set_name() or device_add() fails.

Common
------

- Clean up kernel-doc warnings in include/linux/mhi.h.

- Add Jeff Hugo as the Reviewer of MHI bus.

* tag 'mhi-for-v7.3' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/mani/mhi:
  PCI: epf-mhi: Implement mhi_cntrl->flush_async() to flush DMA read/write
  bus: mhi: ep: Flush async transfers before notifying disconnect in mhi_ep_abort_transfer()
  bus: mhi: ep: Add mhi_cntrl->flush_async() callback to flush the async read/write
  bus: mhi: Clean up some kernel-doc warnings
  bus: mhi: host: Fix controller cleanup on EDL sysfs failure
  bus: mhi: pci_generic: Add SAHARA channel support for Foxconn products
  bus: mhi: host: pci_generic: Set 'mhi_cntrl->no_m3' flag
  bus: mhi: host: Add support for devices with no M3 state
  bus: mhi: host: Flush the posted write after writing to MHI_SOC_RESET_REQ_OFFSET
  MAINTAINERS: Add Jeff Hugo as the Reviewer of MHI bus
  bus: mhi: ep: Fix device refcount leak in the error path of MHI device creation
  bus: mhi: core: Fix sys error transition latency

Clean up some kernel-doc comments and warnings:
- use correct format for struct members
- add one struct member description
- add one function parameter description
- mark one enum as private
- add a leading '*' on one kernel-doc line

Fixes these warnings:
Warning: include/linux/mhi.h:108 struct member 'target_link_speed' not
 described in 'mhi_link_info'
Warning: include/linux/mhi.h:108 struct member 'target_link_width' not
 described in 'mhi_link_info'
Warning: ../include/linux/mhi.h:159 Enum value 'MHI_STATE_MAX' not
 described in enum 'mhi_state'
Warning: ../include/linux/mhi.h:212 bad line: for UL channels, multiple
 of 8 ring elements for DL channels
Warning: ../include/linux/mhi.h:236 struct member 'wake_capable' not
 described in 'mhi_channel_config'
Warning: ../include/linux/mhi.h:449 struct member 'M0' not described
 in 'mhi_controller'
Warning: ../include/linux/mhi.h:449 struct member 'M2' not described
 in 'mhi_controller'
Warning: ../include/linux/mhi.h:449 struct member 'M3' not described
 in 'mhi_controller'
Warning: ../include/linux/mhi.h:528 struct member 'id_table' not described
 in 'mhi_driver'
Warning: ../include/linux/mhi.h:543 function parameter 'mhi_cntrl' not
 described in 'mhi_free_controller'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>

MHI bus transitions the device into M3 state during suspend and back to M0
state during resume. But due to hardware issues, some devices do not
support M3 state. To support these devices properly, MHI bus needs to skip
transitioning the device to M3 during suspend and back to M0 during resume.

For this purpose, introduce the 'mhi_cntrl->no_m3' flag and allow it to be
set by the MHI controller drivers. Once set, this flag lets the MHI bus
skip transitioning the device to M3/M0 during suspend/resume.

But, simply skipping suspend/resume for such devices is not sufficient, as
it leaves the MHI host in M0 state with device access enabled. Client
drivers that do not implement PM callbacks (for instance, the non-freezable
rx_refill worker in mhi_net driver) could then keep ringing channel
doorbells and issue MMIO to the device even after the controller driver has
disabled it and moved it to D3 during its own suspend, resulting in access
to a powered down device.

So instead of skipping the entire suspend/resume operation, run the full
host suspend/resume sequence but without the device-side M state handshake.
During suspend, only transition the host to M3 without sending the MHICTRL
M3 command or waiting for the device M3 event. During resume, bring the
host back to M0 through mhi_pm_m0_transition() without sending the MHICTRL
M0 command.

With the host in M3, all device access is gated by MHI_DB_ACCESS_VALID()
and MHI_REG_ACCESS_VALID(), so any transfer queued by the clients during
suspend is deferred until resume, where mhi_pm_m0_transition() rings the
pending doorbells.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>

<linux/mod_devicetable.h> is included in a many files:

	$ git grep '<linux/mod_devicetable.h>' ef0c9f75a195 | wc -l
	1598

; some of them are widely used headers. To stop mixing up different and
unrelated driver( type)s let the subsystem headers only use the subset
of the recently split <linux/mod_devicetable.h> that are relevant for
them.

The fallout (I hope) is addressed in the previous commits that handle
sources relying on e.g. <linux/i2c.h> pulling in the full legacy header
and thus providing pci_device_id.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Link: https://patch.msgid.link/199fe46b624ba07fb9bd3e0cd6ff13757932cb5f.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>

Change kzalloc + kzalloc to just kzalloc with a flexible array member.

Add __counted_by for extra runtime analysis when requested.

Move counting assignment immediately after allocation as required by
__counted_by.

Move mhi_buf definition as a complete definition as needed for flex
arrays. It's not a pointer anymore.

Signed-off-by: Rosen Penev <rosenp@gmail.com>
[mani: squashed https://lore.kernel.org/mhi/20260317-mhi-invalid-free-mhi-buffers-v1-1-8418a3ad604f@oss.qualcomm.com]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Link: https://patch.msgid.link/20260312045921.7663-1-rosenp@gmail.com

Now that the only user of the 'auto_queue' feature, (QRTR) has been
converted to manage the buffers on its own, drop the code related to it.

Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@oss.qualcomm.com>
Reviewed-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Jeff Hugo <jeff.hugo@oss.qualcomm.com>
Link: https://patch.msgid.link/20251218-qrtr-fix-v2-2-c7499bfcfbe0@oss.qualcomm.com

mhi_device_get() and mhi_queue_dma() haven't been used since 2020's
commit 189ff97cca53 ("bus: mhi: core: Add support for data transfer")
added them.

Remove them.

Note that mhi_queue_dma_sync() is used and has been left.

Signed-off-by: Dr. David Alan Gilbert <linux@treblig.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20250127215859.261105-1-linux@treblig.org
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

Pull driver core updates from Greg KH:
 "Here is the big set of driver core changes for 6.11-rc1.

  Lots of stuff in here, with not a huge diffstat, but apis are evolving
  which required lots of files to be touched. Highlights of the changes
  in here are:

   - platform remove callback api final fixups (Uwe took many releases
     to get here, finally!)

   - Rust bindings for basic firmware apis and initial driver-core
     interactions.

     It's not all that useful for a "write a whole driver in rust" type
     of thing, but the firmware bindings do help out the phy rust
     drivers, and the driver core bindings give a solid base on which
     others can start their work.

     There is still a long way to go here before we have a multitude of
     rust drivers being added, but it's a great first step.

   - driver core const api changes.

     This reached across all bus types, and there are some fix-ups for
     some not-common bus types that linux-next and 0-day testing shook
     out.

     This work is being done to help make the rust bindings more safe,
     as well as the C code, moving toward the end-goal of allowing us to
     put driver structures into read-only memory. We aren't there yet,
     but are getting closer.

   - minor devres cleanups and fixes found by code inspection

   - arch_topology minor changes

   - other minor driver core cleanups

  All of these have been in linux-next for a very long time with no
  reported problems"

* tag 'driver-core-6.11-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (55 commits)
  ARM: sa1100: make match function take a const pointer
  sysfs/cpu: Make crash_hotplug attribute world-readable
  dio: Have dio_bus_match() callback take a const *
  zorro: make match function take a const pointer
  driver core: module: make module_[add|remove]_driver take a const *
  driver core: make driver_find_device() take a const *
  driver core: make driver_[create|remove]_file take a const *
  firmware_loader: fix soundness issue in `request_internal`
  firmware_loader: annotate doctests as `no_run`
  devres: Correct code style for functions that return a pointer type
  devres: Initialize an uninitialized struct member
  devres: Fix memory leakage caused by driver API devm_free_percpu()
  devres: Fix devm_krealloc() wasting memory
  driver core: platform: Switch to use kmemdup_array()
  driver core: have match() callback in struct bus_type take a const *
  MAINTAINERS: add Rust device abstractions to DRIVER CORE
  device: rust: improve safety comments
  MAINTAINERS: add Danilo as FIRMWARE LOADER maintainer
  MAINTAINERS: add Rust FW abstractions to FIRMWARE LOADER
  firmware: rust: improve safety comments
  ...

MHI devices usually have a product/device name to identify each device
uniquely. So let's specify that name in 'struct mhi_controller' so that the
client drivers can use this name to uniquely identify the devices and apply
any device specific quirks.

Signed-off-by: Slark Xiao <slark_xiao@163.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20240701021216.17734-2-slark_xiao@163.com
[mani: reworked subject and description]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>

In the match() callback, the struct device_driver * should not be
changed, so change the function callback to be a const *.  This is one
step of many towards making the driver core safe to have struct
device_driver in read-only memory.

Because the match() callback is in all busses, all busses are modified
to handle this properly.  This does entail switching some container_of()
calls to container_of_const() to properly handle the constant *.

For some busses, like PCI and USB and HV, the const * is cast away in
the match callback as those busses do want to modify those structures at
this point in time (they have a local lock in the driver structure.)
That will have to be changed in the future if they wish to have their
struct device * in read-only-memory.

Cc: Rafael J. Wysocki <rafael@kernel.org>
Reviewed-by: Alex Elder <elder@kernel.org>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Link: https://lore.kernel.org/r/2024070136-wrongdoer-busily-01e8@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>