Programming the static QoS configuration in qcom_icc_rpmh_probe()
touches NoC registers directly, and nothing in that path clocks or
powers the NoC first.  It has been working only because the
interconnect core used to vote every node to INT_MAX while adding it,
and that vote stays in hardware until sync_state.

Reading the boot-time AMC votes back from RPMh removed that implicit
guarantee: a NoC whose BCMs come out of the bootloader unvoted is now
left unclocked, and the first QoS register access aborts.  On Qualcomm
Nord SoC, the MMSS NoC dies while programming qnm_camnoc_hf, taking the
board down before rootfs:

  Internal error: synchronous external abort: 0000000096001610
    regmap_mmio_read32le+0xc/0xa4
    regmap_update_bits_base+0x64/0x98
    qcom_icc_rpmh_probe+0x44c/0x540

Only install the get_bw() callback for providers that do not program
QoS, i.e. those without a regmap config.  Providers that do program
QoS keep the previous INT_MAX initial votes, so their register
accesses stay safe, and the rest keep the benefit of honouring the
boot-time votes.

Reported-by: Bartosz Golaszewski <brgl@kernel.org>
Fixes: 11a44c6087c6 ("interconnect: qcom: implement get_bw with rpmh_read")
Assisted-by: LLM
Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
---
 drivers/interconnect/qcom/icc-rpmh.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/interconnect/qcom/icc-rpmh.c b/drivers/interconnect/qcom/icc-rpmh.c
index 7f2b5673629b..38c8c3cb9a38 100644
--- a/drivers/interconnect/qcom/icc-rpmh.c
+++ b/drivers/interconnect/qcom/icc-rpmh.c
@@ -310,7 +310,13 @@ int qcom_icc_rpmh_probe(struct platform_device *pdev)
 	provider = &qp->provider;
 	provider->dev = dev;
 	provider->set = qcom_icc_set;
-	provider->get_bw = qcom_icc_get_bw;
+	/*
+	 * Programming the QoS registers below requires the NoC to be clocked,
+	 * which during probe is only guaranteed by the INT_MAX initial votes
+	 * the interconnect core applies when get_bw() is absent.
+	 */
+	if (!desc->config)
+		provider->get_bw = qcom_icc_get_bw;
 	provider->pre_aggregate = qcom_icc_pre_aggregate;
 	provider->aggregate = qcom_icc_aggregate;
 	provider->xlate_extended = qcom_icc_xlate_extended;
-- 
2.43.0

On 26-09-22 10:06:23, Shawn Guo wrote:
> Programming the static QoS configuration in qcom_icc_rpmh_probe()
> touches NoC registers directly, and nothing in that path clocks or
> powers the NoC first.  It has been working only because the
> interconnect core used to vote every node to INT_MAX while adding it,
> and that vote stays in hardware until sync_state.
> 
> Reading the boot-time AMC votes back from RPMh removed that implicit
> guarantee: a NoC whose BCMs come out of the bootloader unvoted is now
> left unclocked, and the first QoS register access aborts.  On Qualcomm
> Nord SoC, the MMSS NoC dies while programming qnm_camnoc_hf, taking the
> board down before rootfs:
> 
>   Internal error: synchronous external abort: 0000000096001610
>     regmap_mmio_read32le+0xc/0xa4
>     regmap_update_bits_base+0x64/0x98
>     qcom_icc_rpmh_probe+0x44c/0x540
> 
> Only install the get_bw() callback for providers that do not program
> QoS, i.e. those without a regmap config.  Providers that do program
> QoS keep the previous INT_MAX initial votes, so their register
> accesses stay safe, and the rest keep the benefit of honouring the
> boot-time votes.
> 
> Reported-by: Bartosz Golaszewski <brgl@kernel.org>
> Fixes: 11a44c6087c6 ("interconnect: qcom: implement get_bw with rpmh_read")
> Assisted-by: LLM
> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>

Reviewed-by: Abel Vesa <abel.vesa@oss.qualcomm.com>

On Tue, 22 Sep 2026 04:06:23 +0200, Shawn Guo
<shengchao.guo@oss.qualcomm.com> said:
> Programming the static QoS configuration in qcom_icc_rpmh_probe()
> touches NoC registers directly, and nothing in that path clocks or
> powers the NoC first.  It has been working only because the
> interconnect core used to vote every node to INT_MAX while adding it,
> and that vote stays in hardware until sync_state.
>
> Reading the boot-time AMC votes back from RPMh removed that implicit
> guarantee: a NoC whose BCMs come out of the bootloader unvoted is now
> left unclocked, and the first QoS register access aborts.  On Qualcomm
> Nord SoC, the MMSS NoC dies while programming qnm_camnoc_hf, taking the
> board down before rootfs:
>
>   Internal error: synchronous external abort: 0000000096001610
>     regmap_mmio_read32le+0xc/0xa4
>     regmap_update_bits_base+0x64/0x98
>     qcom_icc_rpmh_probe+0x44c/0x540
>
> Only install the get_bw() callback for providers that do not program
> QoS, i.e. those without a regmap config.  Providers that do program
> QoS keep the previous INT_MAX initial votes, so their register
> accesses stay safe, and the rest keep the benefit of honouring the
> boot-time votes.
>
> Reported-by: Bartosz Golaszewski <brgl@kernel.org>
> Fixes: 11a44c6087c6 ("interconnect: qcom: implement get_bw with rpmh_read")
> Assisted-by: LLM
> Signed-off-by: Shawn Guo <shengchao.guo@oss.qualcomm.com>
> ---

Reviewed-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>
Tested-by: Bartosz Golaszewski <bartosz.golaszewski@oss.qualcomm.com>