20 Oct, 2020

1 commit

  • This reverts commit 4221d38de69f8c1d0e45141ca7737ef0cd17eb58.

    The above commit duplicates the mipi1, mipi1-pwm0, mipi1-i2c and lvds1
    power domain nodes, causing these errors to appear during boot:
    debugfs: Directory 'lvds1' with parent 'pm_genpd' already
    present!
    debugfs: Directory 'mipi1-i2c1' with parent 'pm_genpd'
    already present!
    debugfs: Directory 'mipi1-i2c0' with parent 'pm_genpd'
    already present!
    debugfs: Directory 'mipi1-pwm0' with parent 'pm_genpd'
    already present!
    debugfs: Directory 'mipi1' with parent 'pm_genpd' already
    present!

    Fixes: 0828343304 ("firmware: imx: scu-pd: add mipi lvds1 power
    domains")
    Signed-off-by: Robert Chiras

    Robert Chiras
     

08 Oct, 2020

1 commit

  • * tag 'v5.4.70': (3051 commits)
    Linux 5.4.70
    netfilter: ctnetlink: add a range check for l3/l4 protonum
    ep_create_wakeup_source(): dentry name can change under you...
    ...

    Conflicts:
    arch/arm/mach-imx/pm-imx6.c
    arch/arm64/boot/dts/freescale/imx8mm-evk.dts
    arch/arm64/boot/dts/freescale/imx8mn-ddr4-evk.dts
    drivers/crypto/caam/caamalg.c
    drivers/gpu/drm/imx/dw_hdmi-imx.c
    drivers/gpu/drm/imx/imx-ldb.c
    drivers/gpu/drm/imx/ipuv3/ipuv3-crtc.c
    drivers/mmc/host/sdhci-esdhc-imx.c
    drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
    drivers/net/ethernet/freescale/enetc/enetc.c
    drivers/net/ethernet/freescale/enetc/enetc_pf.c
    drivers/thermal/imx_thermal.c
    drivers/usb/cdns3/ep0.c
    drivers/xen/swiotlb-xen.c
    sound/soc/fsl/fsl_esai.c
    sound/soc/fsl/fsl_sai.c

    Signed-off-by: Jason Liu

    Jason Liu
     

05 Oct, 2020

3 commits

  • The structures used by imx_sc_rm_find_memreg() and
    imx_sc_rm_get_resource_owner() had a "misc" in their name
    but they are for the RM API.

    This patch replaces the "misc" part by "rm".

    Signed-off-by: Franck LENORMAND
    Reviewed-by: Iuliana Prodan
    Reviewed-by: Horia Geantă

    Franck LENORMAND
     
  • An error is detected by KASAN:
    [ 3.579068] BUG: KASAN: stack-out-of-bounds in imx_mu_generic_tx+0xf8/0x1e0
    [ 3.586048] Read of size 4 at addr ffff000010097914 by task swapper/0/1
    [ 3.592674]
    [ 3.594186] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.47-00127-gb7b4ad039c70-dirty #152
    [ 3.602556] Hardware name: Freescale i.MX8DXL EVK (DT)
    [ 3.607706] Call trace:
    [ 3.610178] dump_backtrace+0x0/0x200
    [ 3.613854] show_stack+0x14/0x20
    [ 3.617189] dump_stack+0xf4/0x150
    [ 3.620614] print_address_description.isra.9+0x6c/0x3b8
    [ 3.625951] __kasan_report+0x12c/0x23c
    [ 3.629806] kasan_report+0xc/0x18
    [ 3.633230] __asan_load4+0x94/0xb8
    [ 3.636744] imx_mu_generic_tx+0xf8/0x1e0
    [ 3.640776] imx_mu_send_data+0x5c/0x70
    [ 3.644637] msg_submit+0x128/0x1d0
    [ 3.648152] mbox_send_message+0xb8/0x1c8
    [ 3.652180] imx_scu_ipc_write+0x94/0x138
    [ 3.656205] imx_scu_call_rpc+0x160/0x308
    [ 3.660241] imx_sc_rm_get_resource_owner+0x94/0xf0
    [ 3.665139] seco_mu_probe+0x10c/0x638
    [ 3.668914] platform_drv_probe+0x70/0xd8
    [ 3.672945] really_probe+0x174/0x478
    [ 3.676626] driver_probe_device+0x7c/0x148
    [ 3.680832] device_driver_attach+0x94/0xa0
    [ 3.685035] __driver_attach+0xa4/0x110
    [ 3.688893] bus_for_each_dev+0xe8/0x158
    [ 3.692839] driver_attach+0x30/0x40
    [ 3.696432] bus_add_driver+0x234/0x2f0
    [ 3.700292] driver_register+0xbc/0x1d0
    [ 3.704155] __platform_driver_register+0x7c/0x88
    [ 3.708889] seco_mu_driver_init+0x18/0x20
    [ 3.713009] do_one_initcall+0xb4/0x254
    [ 3.716870] kernel_init_freeable+0x24c/0x2f8
    [ 3.721256] kernel_init+0x10/0x118
    [ 3.724761] ret_from_fork+0x10/0x18
    [ 3.728346]
    [ 3.729844] The buggy address belongs to the page:
    [ 3.734658] page:fffffe00002025c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
    [ 3.742943] flags: 0xffff00000000000()
    [ 3.746728] raw: 0ffff00000000000 fffffe00002025c8 fffffe00002025c8 0000000000000000
    [ 3.754506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
    [ 3.762267] page dumped because: kasan: bad access detected
    [ 3.767850]
    [ 3.769354] addr ffff000010097914 is located in stack of task swapper/0/1 at offset 36 in frame:
    [ 3.778162] imx_sc_rm_get_resource_owner+0x0/0xf0
    [ 3.782970]
    [ 3.784472] this frame has 1 object:
    [ 3.788065] [32, 38) 'msg'
    [ 3.788070]
    [ 3.792358] Memory state around the buggy address:
    [ 3.797174] ffff000010097800: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3
    [ 3.804419] ffff000010097880: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
    [ 3.811666] >ffff000010097900: f1 f1 06 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
    [ 3.818899] ^
    [ 3.822669] ffff000010097980: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
    [ 3.829914] ffff000010097a00: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 00 00 00 00 00 00
    [ 3.837151] ==================================================================

    It happens because some structure are not packed as expected by the communication
    protocol with the SCFW:
    - imx_sc_msg_seco_get_build_id
    - imx_sc_msg_seco_sab_msg

    This patch adds the tag "__packed __aligned(4)" to enforce
    the 4 byte alignment of the structures by the compiler

    Fixes: 2ccb9a596aab (SSI-87: firmware: imx: Add APIs required for secvio)
    Fixes: 9edf1255f89b (LF-824: fw: imx: scu: Add SECO API)
    Signed-off-by: Franck LENORMAND
    Reviewed-by: Iuliana Prodan
    Reviewed-by: Horia Geantă

    Franck LENORMAND
     
  • An error is detected by KASAN:
    [ 3.579068] BUG: KASAN: stack-out-of-bounds in imx_mu_generic_tx+0xf8/0x1e0
    [ 3.586048] Read of size 4 at addr ffff000010097914 by task swapper/0/1
    [ 3.592674]
    [ 3.594186] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.4.47-00127-gb7b4ad039c70-dirty #152
    [ 3.602556] Hardware name: Freescale i.MX8DXL EVK (DT)
    [ 3.607706] Call trace:
    [ 3.610178] dump_backtrace+0x0/0x200
    [ 3.613854] show_stack+0x14/0x20
    [ 3.617189] dump_stack+0xf4/0x150
    [ 3.620614] print_address_description.isra.9+0x6c/0x3b8
    [ 3.625951] __kasan_report+0x12c/0x23c
    [ 3.629806] kasan_report+0xc/0x18
    [ 3.633230] __asan_load4+0x94/0xb8
    [ 3.636744] imx_mu_generic_tx+0xf8/0x1e0
    [ 3.640776] imx_mu_send_data+0x5c/0x70
    [ 3.644637] msg_submit+0x128/0x1d0
    [ 3.648152] mbox_send_message+0xb8/0x1c8
    [ 3.652180] imx_scu_ipc_write+0x94/0x138
    [ 3.656205] imx_scu_call_rpc+0x160/0x308
    [ 3.660241] imx_sc_rm_get_resource_owner+0x94/0xf0
    [ 3.665139] seco_mu_probe+0x10c/0x638
    [ 3.668914] platform_drv_probe+0x70/0xd8
    [ 3.672945] really_probe+0x174/0x478
    [ 3.676626] driver_probe_device+0x7c/0x148
    [ 3.680832] device_driver_attach+0x94/0xa0
    [ 3.685035] __driver_attach+0xa4/0x110
    [ 3.688893] bus_for_each_dev+0xe8/0x158
    [ 3.692839] driver_attach+0x30/0x40
    [ 3.696432] bus_add_driver+0x234/0x2f0
    [ 3.700292] driver_register+0xbc/0x1d0
    [ 3.704155] __platform_driver_register+0x7c/0x88
    [ 3.708889] seco_mu_driver_init+0x18/0x20
    [ 3.713009] do_one_initcall+0xb4/0x254
    [ 3.716870] kernel_init_freeable+0x24c/0x2f8
    [ 3.721256] kernel_init+0x10/0x118
    [ 3.724761] ret_from_fork+0x10/0x18
    [ 3.728346]
    [ 3.729844] The buggy address belongs to the page:
    [ 3.734658] page:fffffe00002025c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0
    [ 3.742943] flags: 0xffff00000000000()
    [ 3.746728] raw: 0ffff00000000000 fffffe00002025c8 fffffe00002025c8 0000000000000000
    [ 3.754506] raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
    [ 3.762267] page dumped because: kasan: bad access detected
    [ 3.767850]
    [ 3.769354] addr ffff000010097914 is located in stack of task swapper/0/1 at offset 36 in frame:
    [ 3.778162] imx_sc_rm_get_resource_owner+0x0/0xf0
    [ 3.782970]
    [ 3.784472] this frame has 1 object:
    [ 3.788065] [32, 38) 'msg'
    [ 3.788070]
    [ 3.792358] Memory state around the buggy address:
    [ 3.797174] ffff000010097800: 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3
    [ 3.804419] ffff000010097880: f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
    [ 3.811666] >ffff000010097900: f1 f1 06 f2 f2 f2 00 00 00 00 00 00 00 00 00 00
    [ 3.818899] ^
    [ 3.822669] ffff000010097980: 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 f2
    [ 3.829914] ffff000010097a00: f2 f2 f2 f2 f2 f2 04 f2 f2 f2 00 00 00 00 00 00
    [ 3.837151] ==================================================================

    It happens because some structure are not packed as expected by the communication
    protocol with the SCFW:
    - imx_sc_msg_rm_get_resource_owner
    - imx_sc_msg_rm_find_memreg

    This patch adds the tag "__packed __aligned(4)" to enforce
    the 4 byte alignment of the structures by the compiler

    Fixes: 10237c7bcb17 (LF-824: fw: imx: scu: Add missing APIs)
    Signed-off-by: Franck LENORMAND
    Reviewed-by: Iuliana Prodan
    Reviewed-by: Horia Geantă

    Franck LENORMAND
     

23 Sep, 2020

1 commit


22 Sep, 2020

1 commit


13 Aug, 2020

1 commit


24 Jun, 2020

1 commit

  • [ Upstream commit 89f12d6509bff004852c51cb713a439a86816b24 ]

    'chan_name' is malloced in imx_scu_probe() and should be freed
    before leaving from the error handling cases, otherwise it will
    cause memory leak.

    Fixes: edbee095fafb ("firmware: imx: add SCU firmware driver support")
    Signed-off-by: Wei Yongjun
    Reviewed-by: Dong Aisheng
    Signed-off-by: Shawn Guo
    Signed-off-by: Sasha Levin

    Wei Yongjun
     

19 Jun, 2020

1 commit

  • * tag 'v5.4.47': (2193 commits)
    Linux 5.4.47
    KVM: arm64: Save the host's PtrAuth keys in non-preemptible context
    KVM: arm64: Synchronize sysreg state on injecting an AArch32 exception
    ...

    Conflicts:
    arch/arm/boot/dts/imx6qdl.dtsi
    arch/arm/mach-imx/Kconfig
    arch/arm/mach-imx/common.h
    arch/arm/mach-imx/suspend-imx6.S
    arch/arm64/boot/dts/freescale/imx8qxp-mek.dts
    arch/powerpc/include/asm/cacheflush.h
    drivers/cpufreq/imx6q-cpufreq.c
    drivers/dma/imx-sdma.c
    drivers/edac/synopsys_edac.c
    drivers/firmware/imx/imx-scu.c
    drivers/net/ethernet/freescale/fec.h
    drivers/net/ethernet/freescale/fec_main.c
    drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
    drivers/net/phy/phy_device.c
    drivers/perf/fsl_imx8_ddr_perf.c
    drivers/usb/cdns3/gadget.c
    drivers/usb/dwc3/gadget.c
    include/uapi/linux/dma-buf.h

    Signed-off-by: Jason Liu

    Jason Liu
     

17 Jun, 2020

3 commits

  • [ Upstream commit f5f27b79eab80de0287c243a22169e4876b08d5e ]

    The header of the message to send can be changed if the
    response is longer than the request:
    - 1st word, the header is sent
    - the remaining words of the message are sent
    - the response is received asynchronously during the
    execution of the loop, changing the size field in
    the header
    - the for loop test the termination condition using
    the corrupted header

    It is the case for the API build_info which has just a
    header as request but 3 words in response.

    This issue is fixed storing the header locally instead of
    using a pointer on it.

    Fixes: edbee095fafb (firmware: imx: add SCU firmware driver support)

    Signed-off-by: Franck LENORMAND
    Reviewed-by: Leonard Crestez
    Signed-off-by: Leonard Crestez
    Cc: stable@vger.kernel.org
    Reviewed-by: Dong Aisheng
    Signed-off-by: Shawn Guo
    Signed-off-by: Sasha Levin

    Franck LENORMAND
     
  • [ Upstream commit f25a066d1a07affb7bea4e5d9c179c3338338e23 ]

    Current imx-scu requires four TX and four RX to communicate with
    SCU. This is low efficient and causes lots of mailbox interrupts.

    With imx-mailbox driver could support one TX to use all four transmit
    registers and one RX to use all four receive registers, imx-scu
    could use one TX and one RX.

    Signed-off-by: Peng Fan
    Signed-off-by: Shawn Guo
    Signed-off-by: Sasha Levin

    Peng Fan
     
  • [ Upstream commit cf0fd404455ce13850cc15423a3c2958933de384 ]

    The imx_scu_call_rpc function returns the result inside the
    same "msg" struct containing the transmitted message. This is
    implemented by holding a pointer to msg (which is usually on the stack)
    in sc_imx_rpc and writing to it from imx_scu_rx_callback.

    This means that if the have_resp parameter is incorrect or SCU sends an
    unexpected response for any reason the most likely result is kernel stack
    corruption.

    Fix this by only setting sc_imx_rpc.msg for the duration of the
    imx_scu_call_rpc call and warning in imx_scu_rx_callback if unset.

    Print the unexpected response data to help debugging.

    Signed-off-by: Leonard Crestez
    Acked-by: Anson Huang
    Signed-off-by: Shawn Guo
    Signed-off-by: Sasha Levin

    Leonard Crestez
     

11 Jun, 2020

3 commits


30 May, 2020

1 commit


22 May, 2020

2 commits


24 Apr, 2020

1 commit


23 Apr, 2020

1 commit

  • At boot, the driver can print error messages because it has been
    deferred so they should not be printed.
    The driver also prints the version of the SECO which is not useful.

    This patch fixes the print of messages due to defer and remove the
    print of the SECO version.

    Signed-off-by: Franck LENORMAND
    Reviewed-by: Horia Geantă

    Franck LENORMAND
     

22 Apr, 2020

2 commits


09 Apr, 2020

1 commit


30 Mar, 2020

1 commit


14 Mar, 2020

2 commits

  • The Security Violation module requires SC API for the SECO, RM, MISC
    and IRQ.

    This patch does:
    - imx-scu-irq: Allow reuse of imx_scu_irq_get_status
    - seco:
    - Add imx_sc_seco_secvio_enable
    - Add imx_sc_seco_secvio_config
    - Add imx_sc_seco_secvio_dgo_config

    Signed-off-by: Franck LENORMAND

    Franck LENORMAND
     
  • The implementation was limiting the size of a message which can be
    received to 4 but soem response can be bigger. For example the
    response of the 'sc_seco_secvio_config' API is 6 words.

    This patch removes this limitation relying on the count of word
    received instead of the index of the chan.
    It does so by duplicating imx_scu_call_rpc as imx_scu_call_big_rpc
    in order to cahnge the RX method using imx_scu_big_rx_callback
    instead of imx_scu_rx_callback.

    Signed-off-by: Franck LENORMAND

    Franck LENORMAND
     

12 Mar, 2020

5 commits

  • commit f5bfeff44612d304deb100065a9f712309dc2783 upstream.

    The imx SC api strongly assumes that messages are composed out of
    4-bytes words but some of our message structs have odd sizeofs.

    This produces many oopses with CONFIG_KASAN=y.

    Fix by marking with __aligned(4).

    Fixes: d90bf296ae18 ("firmware: imx: Add support to start/stop a CPU")
    Signed-off-by: Leonard Crestez
    Signed-off-by: Shawn Guo
    Signed-off-by: Greg Kroah-Hartman

    Leonard Crestez
     
  • commit 7c1a1c814ccc858633c761951c2546041202b24e upstream.

    The imx SC api strongly assumes that messages are composed out of
    4-bytes words but some of our message structs have odd sizeofs.

    This produces many oopses with CONFIG_KASAN=y.

    Fix by marking with __aligned(4).

    Fixes: c800cd7824bd ("firmware: imx: add SCU power domain driver")
    Signed-off-by: Leonard Crestez
    Signed-off-by: Shawn Guo
    Signed-off-by: Greg Kroah-Hartman

    Leonard Crestez
     
  • commit 1e6a4eba693ac72e6f91b4252458c933110e5f4c upstream.

    The imx SC api strongly assumes that messages are composed out of
    4-bytes words but some of our message structs have odd sizeofs.

    This produces many oopses with CONFIG_KASAN=y:

    BUG: KASAN: stack-out-of-bounds in imx_mu_send_data+0x108/0x1f0

    It shouldn't cause an issues in normal use because these structs are
    always allocated on the stack.

    Fixes: 15e1f2bc8b3b ("firmware: imx: add misc svc support")
    Signed-off-by: Leonard Crestez
    Signed-off-by: Shawn Guo
    Signed-off-by: Greg Kroah-Hartman

    Leonard Crestez
     
  • commit 26d0fba29c96241de8a9d16f045b1de49875884c upstream.

    SCU requires that all messages words are written sequentially but linux MU
    driver implements multiple independent channels for each register so ordering
    between different channels must be ensured by SCU API interface.

    Wait for tx_done before every send to ensure that no queueing happens at the
    mailbox channel level.

    Fixes: edbee095fafb ("firmware: imx: add SCU firmware driver support")
    Signed-off-by: Leonard Crestez
    Cc:
    Reviewed-by: Peng Fan
    Reviewed-by:: Oleksij Rempel
    Signed-off-by: Shawn Guo
    Signed-off-by: Greg Kroah-Hartman

    Leonard Crestez
     
  • Signed-off-by: Franck LENORMAND

    Franck LENORMAND
     

05 Mar, 2020

1 commit


04 Mar, 2020

1 commit


26 Feb, 2020

3 commits

  • SCU requires that all messages words are written sequentially but linux MU
    driver implements multiple independent channels for each register so ordering
    between different channels must be ensured by SCU API interface.

    Wait for tx_done before every send to ensure that no queueing happens at the
    mailbox channel level.

    Reported-by: Franck LENORMAND
    Acked-by: Ye Li
    [ Based on initial work from Franck LENORMAND ]
    Signed-off-by: Leonard Crestez
    Signed-off-by: Dong Aisheng

    (cherry picked from commit f7021eaa04ecb71b85ae8b653d673e44a7cbcfc4)

    Leonard Crestez
     
  • The header of the message to send can be changed if the
    response is longer than the request:
    - 1st word, the header is sent
    - the remaining words of the message are sent
    - the response is received asynchronously during the
    execution of the loop, changing the size field in
    the header
    - the for loop test the termination condition using
    the corrupted header

    It is the case for the API build_info which has just a
    header as request but 3 words in response.

    This issue is fixed storing the header locally instead of
    using a pointer on it.

    Fixes: edbee095fafb (firmware: imx: add SCU firmware driver support)

    Signed-off-by: Franck LENORMAND
    Reviewed-by: Leonard Crestez
    Signed-off-by: Dong Aisheng
    (cherry picked from commit fb0ad9322eb4477f30f41852bb8673b80a89a8d0)

    Franck LENORMAND
     
  • The imx SC api strongly assumes that messages are composed out of
    4-bytes words but some of our message structs have sizeof "6" and "7".

    This produces many oopses with CONFIG_KASAN=y:

    BUG: KASAN: stack-out-of-bounds in imx_mu_send_data+0x108/0x1f0

    It shouldn't cause an issues in normal use because these structs are
    always allocated on the stack.

    Also upstream: https://patchwork.kernel.org/patch/11376909/

    Reported-by: Iuliana Prodan
    Signed-off-by: Leonard Crestez
    Reviewed-by: Jason Liu
    Reviewed-by: Aisheng Dong
    Signed-off-by: Dong Aisheng
    (cherry picked from commit 8ca6d9eb2725152404a5764fc8916f77ee82aa29)

    Leonard Crestez
     

22 Feb, 2020

1 commit


21 Feb, 2020

2 commits

  • IMX DSP device is created by SOF layer. The current call to
    devm_of_platform_populate is not needed and it doesn't produce
    any effects.

    Fixes: ffbf23d50353915d ("firmware: imx: Add DSP IPC protocol interface)
    Signed-off-by: Daniel Baluta
    Signed-off-by: Shawn Guo

    Daniel Baluta
     
  • This patch adds the driver to interact with the different
    APIs exposed by the SECO using a shared Messaging Unit.

    The driver exposes some char devices in user space allowing
    a user to send message to the SECO and read its response.

    The driver uses the mailbox framework instead of directly
    configuring the MU.

    Signed-off-by: Stephane Dion
    Signed-off-by: Silvano di Ninno
    Signed-off-by: Franck LENORMAND

    (cherry picked from commit 4985109d60164c842ee5d189621455db349b5212)
    (cherry picked from commit eb721810fdc309b6a32a7a64c7686eaa6052cdc7)
    (cherry picked from commit 4956bbf43349ab40a6a60765752a904d11bfcd18)

    Silvano di Ninno