[PATCH v2] platform/chrome: cros_ec_ishtp: report EC_HOST_EVENT_PANIC to userspace

From: Scott Collyer

Date: Wed Oct 28 2026 - 18:08:58 EST


When the ISH firmware encounters a fatal exception, it resets and sends
EC_HOST_EVENT_PANIC over the ISHTP MKBP channel. Register an
event_notifier callback in cros_ec_ishtp to log the panic, invoke the
panic_notifier chain, and emit an ERROR=PANIC uevent so userspace crash
collectors can capture the panic dump and handle recovery.

Signed-off-by: Scott Collyer <scollyer@xxxxxxxxxx>
---
Changes in v2:
- Move EC_HOST_EVENT_PANIC handling from cros_ec.c into an event_notifier
in cros_ec_ishtp.c as suggested by Tzung-Bi Shih.
- Drop kernel_restart() and instead invoke panic_notifier and emit an
ERROR=PANIC uevent so userspace can collect the crash and handle
recovery without forcing a kernel reboot.

drivers/platform/chrome/cros_ec_ishtp.c | 43 ++++++++++++++++++++++++-
1 file changed, 42 insertions(+), 1 deletion(-)

diff --git a/drivers/platform/chrome/cros_ec_ishtp.c b/drivers/platform/chrome/cros_ec_ishtp.c
index 3766cef81fe8..ea7d4c61ffc2 100644
--- a/drivers/platform/chrome/cros_ec_ishtp.c
+++ b/drivers/platform/chrome/cros_ec_ishtp.c
@@ -8,7 +8,9 @@
// (ISH-TP).

#include <linux/delay.h>
+#include <linux/kobject.h>
#include <linux/module.h>
+#include <linux/notifier.h>
#include <linux/pci.h>
#include <linux/platform_data/cros_ec_commands.h>
#include <linux/platform_data/cros_ec_proto.h>
@@ -117,6 +119,7 @@ struct response_info {
* @work_ishtp_reset: Work queue reset handling.
* @work_ec_evt: Work queue for EC events.
* @ec_dev: CrOS EC MFD device.
+ * @notifier: Notifier block for CrOS EC events.
*
* This structure is used to store per client data.
*/
@@ -133,6 +136,7 @@ struct ishtp_cl_data {
struct work_struct work_ishtp_reset;
struct work_struct work_ec_evt;
struct cros_ec_device *ec_dev;
+ struct notifier_block notifier;
};

/**
@@ -538,10 +542,32 @@ static int cros_ec_pkt_xfer_ish(struct cros_ec_device *ec_dev,
return rv;
}

+static int cros_ec_ishtp_event(struct notifier_block *nb,
+ unsigned long queued_during_suspend,
+ void *data)
+{
+ struct ishtp_cl_data *client_data =
+ container_of(nb, struct ishtp_cl_data, notifier);
+ struct cros_ec_device *ec_dev = data;
+ u32 host_event = cros_ec_get_host_event(ec_dev);
+
+ if (host_event & EC_HOST_EVENT_MASK(EC_HOST_EVENT_PANIC)) {
+ static const char * const panic_env[] = { "ERROR=PANIC", NULL };
+
+ dev_emerg(cl_data_to_dev(client_data), "CrOS ISH Panic Reported\n");
+ blocking_notifier_call_chain(&ec_dev->panic_notifier, 0, ec_dev);
+ kobject_uevent_env(&ec_dev->dev->kobj, KOBJ_CHANGE, (char **)panic_env);
+ return NOTIFY_OK;
+ }
+
+ return NOTIFY_DONE;
+}
+
static int cros_ec_dev_init(struct ishtp_cl_data *client_data)
{
struct cros_ec_device *ec_dev;
struct device *dev = cl_data_to_dev(client_data);
+ int rv;

ec_dev = cros_ec_device_alloc(dev);
if (!ec_dev)
@@ -555,7 +581,20 @@ static int cros_ec_dev_init(struct ishtp_cl_data *client_data)
ec_dev->pkt_xfer = cros_ec_pkt_xfer_ish;
ec_dev->phys_name = dev_name(dev);

- return cros_ec_register(ec_dev);
+ rv = cros_ec_register(ec_dev);
+ if (rv)
+ return rv;
+
+ client_data->notifier.notifier_call = cros_ec_ishtp_event;
+ rv = blocking_notifier_chain_register(&ec_dev->event_notifier,
+ &client_data->notifier);
+ if (rv) {
+ dev_warn(dev, "failed to setup event notifier: %d\n", rv);
+ cros_ec_unregister(ec_dev);
+ return rv;
+ }
+
+ return 0;
}

static void reset_handler(struct work_struct *work)
@@ -665,6 +704,8 @@ static void cros_ec_ishtp_remove(struct ishtp_cl_device *cl_device)
struct ishtp_cl *cros_ish_cl = ishtp_get_drvdata(cl_device);
struct ishtp_cl_data *client_data = ishtp_get_client_data(cros_ish_cl);

+ blocking_notifier_chain_unregister(&client_data->ec_dev->event_notifier,
+ &client_data->notifier);
cancel_work_sync(&client_data->work_ishtp_reset);
cancel_work_sync(&client_data->work_ec_evt);
cros_ec_unregister(client_data->ec_dev);
--
2.56.0.313.g2479322e68-goog