summaryrefslogtreecommitdiff
path: root/drivers/rpmsg
AgeCommit message (Collapse)Author
2022-05-19Merge remote-tracking branch 'gh-fslc/5.4-2.3.x-imx' into toradex_5.4-2.3.x-imxPhilippe Schenker
2022-05-19Merge tag 'v5.4.193' into update-to-2.3.7__5.4-2.3.x-imxPhilippe Schenker
This is the 5.4.193 stable release Conflicts: arch/arm64/boot/dts/freescale/fsl-ls1028a-qds.dts drivers/edac/synopsys_edac.c drivers/mmc/host/sdhci-esdhc-imx.c drivers/mmc/host/sdhci.c drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c sound/soc/codecs/msm8916-wcd-analog.c
2022-05-18MLK-25649-7 rpmsg: imx: Add support for identifying SCU wakeup source from sysfsRanjani Vaidyanathan
Consolidate SCU wakeup defines in the header file. Signed-off-by: Ranjani Vaidyanathan <ranjani.vaidyanathan@nxp.com> (cherry picked from commit d7b1dd90185df67fe1e713ff439fc898201cb8c8) (cherry picked from commit 5693275abe2a558f7a433bba23eb8ae35bd30749)
2022-02-01rpmsg: char: Fix race between the release of rpmsg_eptdev and cdevMatthias Kaehlcke
commit 7a534ae89e34e9b51acb5a63dd0f88308178b46a upstream. struct rpmsg_eptdev contains a struct cdev. The current code frees the rpmsg_eptdev struct in rpmsg_eptdev_destroy(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_eptdev could be freed before the cdev is entirely released. The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20220110104706.v6.2.Idde68b05b88d4a2e6e54766c653f3a6d9e419ce6@changeid Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-02-01rpmsg: char: Fix race between the release of rpmsg_ctrldev and cdevSujit Kautkar
commit b7fb2dad571d1e21173c06cef0bced77b323990a upstream. struct rpmsg_ctrldev contains a struct cdev. The current code frees the rpmsg_ctrldev struct in rpmsg_ctrldev_release_device(), but the cdev is a managed object, therefore its release is not predictable and the rpmsg_ctrldev could be freed before the cdev is entirely released, as in the backtrace below. [ 93.625603] ODEBUG: free active (active state 0) object type: timer_list hint: delayed_work_timer_fn+0x0/0x7c [ 93.636115] WARNING: CPU: 0 PID: 12 at lib/debugobjects.c:488 debug_print_object+0x13c/0x1b0 [ 93.644799] Modules linked in: veth xt_cgroup xt_MASQUERADE rfcomm algif_hash algif_skcipher af_alg uinput ip6table_nat fuse uvcvideo videobuf2_vmalloc venus_enc venus_dec videobuf2_dma_contig hci_uart btandroid btqca snd_soc_rt5682_i2c bluetooth qcom_spmi_temp_alarm snd_soc_rt5682v [ 93.715175] CPU: 0 PID: 12 Comm: kworker/0:1 Tainted: G B 5.4.163-lockdep #26 [ 93.723855] Hardware name: Google Lazor (rev3 - 8) with LTE (DT) [ 93.730055] Workqueue: events kobject_delayed_cleanup [ 93.735271] pstate: 60c00009 (nZCv daif +PAN +UAO) [ 93.740216] pc : debug_print_object+0x13c/0x1b0 [ 93.744890] lr : debug_print_object+0x13c/0x1b0 [ 93.749555] sp : ffffffacf5bc7940 [ 93.752978] x29: ffffffacf5bc7940 x28: dfffffd000000000 [ 93.758448] x27: ffffffacdb11a800 x26: dfffffd000000000 [ 93.763916] x25: ffffffd0734f856c x24: dfffffd000000000 [ 93.769389] x23: 0000000000000000 x22: ffffffd0733c35b0 [ 93.774860] x21: ffffffd0751994a0 x20: ffffffd075ec27c0 [ 93.780338] x19: ffffffd075199100 x18: 00000000000276e0 [ 93.785814] x17: 0000000000000000 x16: dfffffd000000000 [ 93.791291] x15: ffffffffffffffff x14: 6e6968207473696c [ 93.796768] x13: 0000000000000000 x12: ffffffd075e2b000 [ 93.802244] x11: 0000000000000001 x10: 0000000000000000 [ 93.807723] x9 : d13400dff1921900 x8 : d13400dff1921900 [ 93.813200] x7 : 0000000000000000 x6 : 0000000000000000 [ 93.818676] x5 : 0000000000000080 x4 : 0000000000000000 [ 93.824152] x3 : ffffffd0732a0fa4 x2 : 0000000000000001 [ 93.829628] x1 : ffffffacf5bc7580 x0 : 0000000000000061 [ 93.835104] Call trace: [ 93.837644] debug_print_object+0x13c/0x1b0 [ 93.841963] __debug_check_no_obj_freed+0x25c/0x3c0 [ 93.846987] debug_check_no_obj_freed+0x18/0x20 [ 93.851669] slab_free_freelist_hook+0xbc/0x1e4 [ 93.856346] kfree+0xfc/0x2f4 [ 93.859416] rpmsg_ctrldev_release_device+0x78/0xb8 [ 93.864445] device_release+0x84/0x168 [ 93.868310] kobject_cleanup+0x12c/0x298 [ 93.872356] kobject_delayed_cleanup+0x10/0x18 [ 93.876948] process_one_work+0x578/0x92c [ 93.881086] worker_thread+0x804/0xcf8 [ 93.884963] kthread+0x2a8/0x314 [ 93.888303] ret_from_fork+0x10/0x18 The cdev_device_add/del() API was created to address this issue (see commit '233ed09d7fda ("chardev: add helper function to register char devs with a struct device")'), use it instead of cdev add/del(). Fixes: c0cdc19f84a4 ("rpmsg: Driver for user space endpoint interface") Signed-off-by: Sujit Kautkar <sujitka@chromium.org> Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Mathieu Poirier <mathieu.poirier@linaro.org> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Reviewed-by: Stephen Boyd <swboyd@chromium.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Link: https://lore.kernel.org/r/20220110104706.v6.1.Iaac908f3e3149a89190ce006ba166e2d3fd247a3@changeid Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-27rpmsg: core: Clean up resources on announce_create failure.Arnaud Pouliquen
commit 8066c615cb69b7da8a94f59379847b037b3a5e46 upstream. During the rpmsg_dev_probe, if rpdev->ops->announce_create returns an error, the rpmsg device and default endpoint should be freed before exiting the function. Fixes: 5e619b48677c ("rpmsg: Split rpmsg core and virtio backend") Suggested-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Arnaud Pouliquen <arnaud.pouliquen@foss.st.com> Reviewed-by: Bjorn Andersson <bjorn.andersson@linaro.org> Cc: stable <stable@vger.kernel.org> Link: https://lore.kernel.org/r/20211206190758.10004-1-arnaud.pouliquen@foss.st.com Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-11-10LF-2108 rpmsg: imx: fix the pointer conversion loses bits issueRichard Zhu
Fix the pointer conversion loses bits issue reported by Coverity below. CID 5433934 (#2 of 4): Parse warning (PW.POINTER_CONVERSION_LOSES_BITS) 1. pointer_conversion_loses_bits: conversion from pointer to smaller integer Related-to: ELB-4064 Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com> Reviewed-by: Jun Li <jun.li@nxp.com> Signed-off-by: Ming Liu <ming.liu@toradex.com> (cherry picked from commit 7c9a5a31bc27549bd5d5ea70654d881885eb25d5)
2021-07-15rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()Jia-Ju Bai
[ Upstream commit 26594c6bbb60c6bc87e3762a86ceece57d164c66 ] When idr_find() returns NULL to intent, no error return code of qcom_glink_rx_data() is assigned. To fix this bug, ret is assigned with -ENOENT in this case. Fixes: 64f95f87920d ("rpmsg: glink: Use the local intents when receiving data") Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Link: https://lore.kernel.org/r/20210306133624.17237-1-baijiaju1990@gmail.com Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-19Merge tag 'v5.4.120' into 5.4-2.3.x-imxAndrey Zhizhikin
This is the 5.4.120 stable release Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
2021-05-19rpmsg: qcom_glink_native: fix error return code of qcom_glink_rx_data()Jia-Ju Bai
[ Upstream commit 26594c6bbb60c6bc87e3762a86ceece57d164c66 ] When idr_find() returns NULL to intent, no error return code of qcom_glink_rx_data() is assigned. To fix this bug, ret is assigned with -ENOENT in this case. Fixes: 64f95f87920d ("rpmsg: glink: Use the local intents when receiving data") Reported-by: TOTE Robot <oslab@tsinghua.edu.cn> Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Link: https://lore.kernel.org/r/20210306133624.17237-1-baijiaju1990@gmail.com Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-27rpmsg: virtio rpmsg: compilation error and warningsIgor Opaniuk
1. Fix this compilation error: /workdir/oe/tmp-glibc/work-shared/verdin-imx8mm/kernel-source/drivers/ rpmsg/virtio_rpmsg_bus.c:1106:23: error: redeclaration of 'newch' with no linkage struct rpmsg_device *newch; ^~~~~ /workdir/oe/tmp-glibc/work-shared/verdin-imx8mm/kernel-source/drivers/ rpmsg/virtio_rpmsg_bus.c:1101:23: note: previous declaration of 'newch' was here struct rpmsg_device *newch; 2. Fix warnings that are reproduced when RPMsg char device support is disabled. Fixes: 1172ee2e ("rpmsg: virtio rpmsg: Add RPMsg char driver support") Signed-off-by: Igor Opaniuk <igor.opaniuk@toradex.com> (cherry picked from commit 1f734be74f1d17ac072edbb6d333cd5041157ef0)
2021-01-27rpmsg: virtio rpmsg: Add RPMsg char driver supportIgor Opaniuk
virtio rpmsg was not implemented to use RPMsg char driver. Each virtio ns announcement will create a new RPMsg device which is supposed to bound to a RPMsg driver. It doesn't support dynamic endpoints with name service per RPMsg device. With RPMsg char driver, you can have multiple endpoints per RPMsg device. Here is the change from this patch: * Introduce a macro to indicate if want to use RPMsg char driver for virtio RPMsg. The RPMsg device can either be bounded to a simple RPMsg driver or the RPMsg char driver. * Create Virtio RPMsg char device when the virtio RPMsg driver is probed. * when there is a remote service announced, keep it in the virtio proc remote services list. * when there is an endpoint created, bind it to a remote service from the remote services list. If the service doesn't exist yet, create one and mark the service address as ANY. That patch ported to our 4.14 kernel + additional fixes added [1]. Example of usage from userspace app: ``` char data_buf [] = {'a', 'b', 'c', 'd', '\0'}; struct rpmsg_endpoint_info ept_info = {"rpmsg-openamp-demo-channel", 0x2, 0x1}; int fd = open("/dev/rpmsg_ctrl0", O_RDWR); /* create endpoint interface */ ioctl(fd, RPMSG_CREATE_EPT_IOCTL, &ept_info); /* create endpoint */ int fd_ept = open("/dev/rpmsg0", O_RDWR); /* receive data from remote device */ read(fd_ept, &data_buf, sizeof(data_buf)); /* send data to remote device */ write(fd_ept, &data_buf, sizeof(data_buf)); /* destroy endpoint */ ioctl(fd_ept, RPMSG_DESTROY_EPT_IOCTL); close(fd_ept); close(fd); ``` [1] https://patchwork.kernel.org/patch/10145779/ Signed-off-by: Wendy Liang <jliang@xilinx.com> Signed-off-by: Igor Opaniuk <igor.opaniuk@toradex.com> (cherry picked from commit 06ab53a559eddc27d0c45e4935a65a19820714a2)
2021-01-27rpmsg: imx: Disable character echoing by defaultAndri Schmidt
Signed-off-by: Andri Schmidt <a.schmidt@scewo.ch> Signed-off-by: Stefan Agner <stefan.agner@toradex.com> (cherry picked from commit c80a948e97e28f9104c836318bf375b025755b81)
2021-01-27rpmsg: imx: return ENOTTY if no tty connectedStefan Agner
Return ENOTTY if no reader is using the TTY. Note that the VirtIO transport used by RPmsg currently does not use the return value of this callback, hence currently will not influence operation in any way. Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> (cherry picked from commit 1539fc20dc96a438c860014aa98f250f70fc6bd7) Conflicts: drivers/rpmsg/imx_rpmsg_tty.c Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2021-01-27rpmsg: imx: do not push data when no reader is availableStefan Agner
Pushing data while there is no reader seems to lock/crash the TTY layer in some way. Especially when a reader gets attached again, the kernel crashes with Unable to handle kernel paging request at virtual address 00002248 Also use tty_insert_flip_string which handels the copying and TTY buffer resizing if necessary. Signed-off-by: Stefan Agner <stefan.agner@toradex.com> Acked-by: Marcel Ziswiler <marcel.ziswiler@toradex.com> (cherry picked from commit 5aba75e2c61d4044bed21730b7c471822860fac1) (cherry picked from commit db0da7d68e090eb2150b267df2d9d9b4d9edf52f) Changed to non void function: add required return value. Signed-off-by: Max Krummenacher <max.krummenacher@toradex.com>
2021-01-11Merge tag 'v5.4.75' into 5.4-2.3.x-imxAndrey Zhizhikin
This is the 5.4.75 stable release Conflicts: - drivers/i2c/busses/i2c-imx.c: Drop NXP changes, which are covered by commit [2c58d5e0c754c] from upstream. - drivers/net/can/flexcan.c: Keep NXP implementation, patch [ca10989632d88] from upstream is covered in the NXP tree. - drivers/usb/host/xhci.h: Fix merge fuzz for upstream commit [2600a131e1f61]. Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
2021-01-11Merge tag 'v5.4.73' into 5.4-2.3.x-imxAndrey Zhizhikin
This is the 5.4.73 stable release Conflicts: - arch/arm/boot/dts/imx6sl.dtsi: Commit [a1767c90194e2] in NXP tree is now covered with commit [5c4c2f437cead] from upstream. - drivers/gpu/drm/mxsfb/mxsfb_drv.c: Resolve merge hunk for patch [ed8b90d303cf0] from upstream - drivers/media/i2c/ov5640.c: Patch [aa4bb8b8838ff] in NXP tree is now covered by patches [79ec0578c7e0a] and [b2f8546056b35] from upstream. Changes from NXP patch [99aa4c8c18984] are covered in upstream version as well. - drivers/net/ethernet/freescale/fec_main.c: Fix merge fuzz for patch [9e70485b40c83] from upstream. - drivers/usb/cdns3/gadget.c: Keep NXP version of the file, upstream version is not compatible. - drivers/usb/dwc3/core.c: - drivers/usb/dwc3/core.h: Fix merge fuzz of patch [08045050c6bd2] together wth NXP patch [b30e41dc1e494] - sound/soc/fsl/fsl_sai.c: - sound/soc/fsl/fsl_sai.h: Commit [2ea70e51eb72a] in NXP tree is now covered with commit [1ad7f52fe6683] from upstream. Signed-off-by: Andrey Zhizhikin <andrey.zhizhikin@leica-geosystems.com>
2020-11-05rpmsg: glink: Use complete_all for open statesChris Lew
[ Upstream commit 4fcdaf6e28d11e2f3820d54dd23cd12a47ddd44e ] The open_req and open_ack completion variables are the state variables to represet a remote channel as open. Use complete_all so there are no races with waiters and using completion_done. Signed-off-by: Chris Lew <clew@codeaurora.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org> Link: https://lore.kernel.org/r/1593017121-7953-2-git-send-email-deesin@codeaurora.org Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-10-29rpmsg: smd: Fix a kobj leak in in qcom_smd_parse_edge()Dan Carpenter
[ Upstream commit e69ee0cf655e8e0c4a80f4319e36019b74f17639 ] We need to call of_node_put(node) on the error paths for this function. Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20200908071841.GA294938@mwanda Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
2020-03-08Merge tag 'v5.4.24' into imx_5.4.yJason Liu
Merge Linux stable release v5.4.24 into imx_5.4.y * tag 'v5.4.24': (3306 commits) Linux 5.4.24 blktrace: Protect q->blk_trace with RCU kvm: nVMX: VMWRITE checks unsupported field before read-only field ... Signed-off-by: Jason Liu <jason.hui.liu@nxp.com> Conflicts: arch/arm/boot/dts/imx6sll-evk.dts arch/arm/boot/dts/imx7ulp.dtsi arch/arm64/boot/dts/freescale/fsl-ls1028a.dtsi drivers/clk/imx/clk-composite-8m.c drivers/gpio/gpio-mxc.c drivers/irqchip/Kconfig drivers/mmc/host/sdhci-of-esdhc.c drivers/mtd/nand/raw/gpmi-nand/gpmi-nand.c drivers/net/can/flexcan.c drivers/net/ethernet/freescale/dpaa/dpaa_eth.c drivers/net/ethernet/mscc/ocelot.c drivers/net/ethernet/stmicro/stmmac/stmmac_main.c drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c drivers/net/phy/realtek.c drivers/pci/controller/mobiveil/pcie-mobiveil-host.c drivers/perf/fsl_imx8_ddr_perf.c drivers/tee/optee/shm_pool.c drivers/usb/cdns3/gadget.c kernel/sched/cpufreq.c net/core/xdp.c sound/soc/fsl/fsl_esai.c sound/soc/fsl/fsl_sai.c sound/soc/sof/core.c sound/soc/sof/imx/Kconfig sound/soc/sof/loader.c
2020-01-14rpmsg: char: release allocated memoryNavid Emamdoost
commit bbe692e349e2a1edf3fe0a29a0e05899c9c94d51 upstream. In rpmsg_eptdev_write_iter, if copy_from_iter_full fails the allocated buffer needs to be released. Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Cc: Ben Hutchings <ben.hutchings@codethink.co.uk> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Free pending deferred work on removeBjorn Andersson
commit 278bcb7300f61785dba63840bd2a8cf79f14554c upstream. By just cancelling the deferred rx worker during GLINK instance teardown any pending deferred commands are leaked, so free them. Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") Cc: stable@vger.kernel.org Acked-by: Chris Lew <clew@codeaurora.org> Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Don't send pending rx_done during removeBjorn Andersson
commit c3dadc19b7564c732598b30d637c6f275c3b77b6 upstream. Attempting to transmit rx_done messages after the GLINK instance is being torn down will cause use after free and memory leaks. So cancel the intent_work and free up the pending intents. With this there are no concurrent accessors of the channel left during qcom_glink_native_remove() and there is therefor no need to hold the spinlock during this operation - which would prohibit the use of cancel_work_sync() in the release function. So remove this. Fixes: 1d2ea36eead9 ("rpmsg: glink: Add rx done command") Cc: stable@vger.kernel.org Acked-by: Chris Lew <clew@codeaurora.org> Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Fix rpmsg_register_device err handlingChris Lew
commit f7e714988edaffe6ac578318e99501149b067ba0 upstream. The device release function is set before registering with rpmsg. If rpmsg registration fails, the framework will call device_put(), which invokes the release function. The channel create logic does not need to free rpdev if rpmsg_register_device() fails and release is called. Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") Cc: stable@vger.kernel.org Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Chris Lew <clew@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Put an extra reference during cleanupChris Lew
commit b646293e272816dd0719529dcebbd659de0722f7 upstream. In a remote processor crash scenario, there is no guarantee the remote processor sent close requests before it went into a bad state. Remove the reference that is normally handled by the close command in the so channel resources can be released. Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") Cc: stable@vger.kernel.org Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Chris Lew <clew@codeaurora.org> Reported-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Fix use after free in open_ack TIMEOUT caseArun Kumar Neelakantam
commit ac74ea01860170699fb3b6ea80c0476774c8e94f upstream. Extra channel reference put when remote sending OPEN_ACK after timeout causes use-after-free while handling next remote CLOSE command. Remove extra reference put in timeout case to avoid use-after-free. Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver") Cc: stable@vger.kernel.org Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Fix reuse intents memory leak issueArun Kumar Neelakantam
commit b85f6b601407347f5425c4c058d1b7871f5bf4f0 upstream. Memory allocated for re-usable intents are not freed during channel cleanup which causes memory leak in system. Check and free all re-usable memory to avoid memory leak. Fixes: 933b45da5d1d ("rpmsg: glink: Add support for TX intents") Cc: stable@vger.kernel.org Acked-By: Chris Lew <clew@codeaurora.org> Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Reported-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-12-21rpmsg: glink: Set tail pointer to 0 at end of FIFOChris Lew
commit 4623e8bf1de0b86e23a56cdb39a72f054e89c3bd upstream. When wrapping around the FIFO, the remote expects the tail pointer to be reset to 0 on the edge case where the tail equals the FIFO length. Fixes: caf989c350e8 ("rpmsg: glink: Introduce glink smem based transport") Cc: stable@vger.kernel.org Signed-off-by: Chris Lew <clew@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-11-25LF-44 rpmsg: imx: add the rpmsg tty demoRichard Zhu
Add the rpmsg tty demo for iMX AMP platforms. Use the "echo <string> > /dev/*RPMSG*", after insmod the module. Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com> Acked-by: Fugang Duan <fugang.duan@nxp.com>
2019-11-25rpmsg: imx: enable the tx_block mechanism in the flowRichard Zhu
- Enable the tx_block mechanism to make sure that every transmission is complete when mailbox is used. - Refine the data exchange in the rpmsg_rx_callback and some info messages and codes comments. Signed-off-by: Robin Gong <yibin.gong@nxp.com> Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
2019-11-25rpmsg: imx_rpmsg: add partition reset notifyRobin Gong
Add partition reset notify if m4 reset so that rpmsg channel could re-create again while m4 come back. Signed-off-by: Robin Gong <yibin.gong@nxp.com>
2019-11-25rpmsg: imx: bug fix and clean up the codesRichard Zhu
- Clean up the codes, move the tx/rx mailbox initializations into one function. - Fix the mu msg data exchange bug. - Fix to stop autoload pingpong test module. Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
2019-11-25rpmsg: imx: extend the rpmsg support for imx8qm and so onRichard Zhu
- extend the rpmsg support for imx8qm/imx7ulp/imx7d/imx6sx Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
2019-11-25rpmsg: imx: add the initial imx rpmsg supportRichard Zhu
Based on "virtio_rpmsg_bus" driver, This patch-set is used to set up the communication mechanism between A core and M core on i.MX AMP SOCs. Add the initial imx rpmsg support glue driver and one pingpong demo, demonstrated the data transactions between A core and remote M core. Distributed framework is used in IMX RPMSG implementation, refer to the following requirements: - The CAN functions contained in M core and RTOS should be ready and complete functional in 50ms after AMP system is turned on. - Partition reset. System wouldn't be stalled by the exceptions (e.x the reset triggered by the system hang) occurred at the other side. And the RPMSG mechanism should be recovered automactilly after the partition reset is completed. In this scenario, the M core and RTOS would be kicked off by bootloader firstly, then A core and Linux would be loaded later. Both M core/RTOS and A core/Linux are running independly. One physical memory region used to store the vring is mandatory required to pre-reserved and well-knowned by both A core and M core Signed-off-by: Richard Zhu <hongxing.zhu@nxp.com>
2019-09-17rpmsg: glink-smem: Name the edge based on parent remoteprocBjorn Andersson
Naming the glink edge device on the parent of_node short name causes collisions when multiple remoteproc instances with only different unit address are described on the platform_bus in DeviceTree. Base the edge's name on the parent remoteproc's name instead, to ensure that it's unique. Reviewed-by: Niklas Cassel <niklas.cassel@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-08-29rpmsg: glink: Use struct_size() helperGustavo A. R. Silva
One of the more common cases of allocation size calculations is finding the size of a structure that has a zero-sized array at the end, along with memory for some number of elements for that array. For example: struct { ... struct intent_pair intents[]; } __packed * msg; Make use of the struct_size() helper instead of an open-coded version in order to avoid any potential type mistakes. So, replace the following form: sizeof(*msg) + sizeof(struct intent_pair) * count with: struct_size(msg, intents, count) This code was detected with the help of Coccinelle. Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-08-27rpmsg: virtio_rpmsg_bus: replace "%p" with "%pK"Suman Anna
The virtio_rpmsg_bus driver uses the "%p" format-specifier for printing the vring buffer address. This prints only a hashed pointer even for previliged users. Use "%pK" instead so that the address can be printed during debug using kptr_restrict sysctl. Signed-off-by: Suman Anna <s-anna@ti.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-08-26rpmsg: core: fix commentsPierre-Louis Bossart
Minor typos, grammar and copy/paste issues. Fix for consistency. No functional or semantic change. Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-05-21rpmsg: core: Make remove handler for rpmsg driver optional.Pi-Hsun Shih
Most other bus (for example, SPI, i2c) have the remove handler for driver optional. Make remove handler for rpmsg driver optional too. Signed-off-by: Pi-Hsun Shih <pihsun@chromium.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-02-20rpmsg: virtio: change header file sort styleLoic Pallardy
Make header files alphabetical order. Signed-off-by: Loic Pallardy <loic.pallardy@st.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2019-02-20rpmsg: virtio: allocate buffer from parentLoic Pallardy
Remoteproc is now capable to create one specific sub-device per virtio link to associate a dedicated memory pool. This implies to change device used by virtio_rpmsg for buffer allocation from grand-parent to parent. Signed-off-by: Loic Pallardy <loic.pallardy@st.com> Reviewed-by: Anup Patel <anup@brainfault.org> Tested-by: Anup Patel <anup@brainfault.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-10-03rpmsg: glink: smem: Support rx peak for size less than 4 bytesArun Kumar Neelakantam
The current rx peak function fails to read the data if size is less than 4bytes. Use memcpy_fromio to support data reads of size less than 4 bytes. Cc: stable@vger.kernel.org Fixes: f0beb4ba9b18 ("rpmsg: glink: Remove chunk size word align warning") Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-09-27rpmsg: smd: fix memory leak on channel createColin Ian King
Currently a failed allocation of channel->name leads to an immediate return without freeing channel. Fix this by setting ret to -ENOMEM and jumping to an exit path that kfree's channel. Detected by CoverityScan, CID#1473692 ("Resource Leak") Fixes: 53e2822e56c7 ("rpmsg: Introduce Qualcomm SMD backend") Cc: stable@vger.kernel.org Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-09-01rpmsg: glink: Remove chunk size word align warningChris Lew
It is possible for the chunk sizes coming from the non RPM remote procs to not be word aligned. Remove the alignment warning and continue to read from the FIFO so execution is not stalled. Signed-off-by: Chris Lew <clew@codeaurora.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-08-27rpmsg: Convert to using %pOFn instead of device_node.nameRob Herring
In preparation to remove the node name pointer from struct device_node, convert printf users to use the %pOFn format specifier. Cc: Ohad Ben-Cohen <ohad@wizery.com> Cc: Bjorn Andersson <bjorn.andersson@linaro.org> Cc: linux-remoteproc@vger.kernel.org Signed-off-by: Rob Herring <robh@kernel.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-08-27rpmsg: char: Migrate to iter versions of read and writeBjorn Andersson
In order to be able to use the aio interface for writing to a rpmsg_char the write_iter function must be implemented, so migrate to iter version for read and write functions. Regular read and write uses the iter methods if present and is as such unaffected. Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-07-30rpmsg: Add compat ioctl for rpmsg char driverArun Kumar Neelakantam
Add compat ioctl callback to support 32bit user space applications. Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-07-30rpmsg: glink: Store edge name for glink deviceChris Lew
Channels may need to identify the edge their channel was probed for. Store the edge name by reading the label property from device tree or default to the node name. Signed-off-by: Chris Lew <clew@codeaurora.org> Signed-off-by: Arun Kumar Neelakantam <aneela@codeaurora.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-07-30rpmsg: core: add support to power domains for devicesSrinivas Kandagatla
Some of the rpmsg devices need to switch on power domains to communicate with remote processor. For example on Qualcomm DB820c platform LPASS power domain needs to switched on for any kind of audio services. This patch adds the missing power domain support in rpmsg core. Without this patch attempting to play audio via QDSP on DB820c would reboot the system. Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
2018-07-30rpmsg: smd: fix kerneldoc warningsSrinivas Kandagatla
This patch fixes below kerneldoc warnings qcom_smd.c:141: warning: Function parameter or member 'dev' not described in 'qcom_smd_edge' qcom_smd.c:141: warning: Function parameter or member 'name' not described in 'qcom_smd_edge' qcom_smd.c:141: warning: Function parameter or member 'new_channel_event' not described in 'qcom_smd_edge' qcom_smd.c:222: warning: Function parameter or member 'qsept' not described in 'qcom_smd_channel' qcom_smd.c:222: warning: Function parameter or member 'registered' not described in 'qcom_smd_channel' qcom_smd.c:222: warning: Function parameter or member 'state_change_event' not described in 'qcom_smd_channel' qcom_smd.c:222: warning: Function parameter or member 'drvdata' not described in 'qcom_smd_channel' qcom_smd.c:737: warning: Function parameter or member 'wait' not described in '__qcom_smd_send' Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org> Signed-off-by: Bjorn Andersson <bjorn.andersson@linaro.org>
generated by cgit v1.2.3 (git 2.0.4) at 2024-06-10 10:16:22 +0000