From b2be1327a6ed74fbf7e1ac0bc6ca57750f7ebe07 Mon Sep 17 00:00:00 2001 From: Xiaolei Wang Date: Thu, 19 Jun 2025 14:21:08 +0800 Subject: [PATCH 1/6] clk: imx: Fix an out-of-bounds access in dispmix_csr_clk_dev_data When num_parents is 4, __clk_register() occurs an out-of-bounds when accessing parent_names member. Use ARRAY_SIZE() instead of hardcode number here. BUG: KASAN: global-out-of-bounds in __clk_register+0x1844/0x20d8 Read of size 8 at addr ffff800086988e78 by task kworker/u24:3/59 Hardware name: NXP i.MX95 19X19 board (DT) Workqueue: events_unbound deferred_probe_work_func Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x8c/0xcc print_report+0x398/0x5fc kasan_report+0xd4/0x114 __asan_report_load8_noabort+0x20/0x2c __clk_register+0x1844/0x20d8 clk_hw_register+0x44/0x110 __clk_hw_register_mux+0x284/0x3a8 imx95_bc_probe+0x4f4/0xa70 Fixes: 5224b189462f ("clk: imx: add i.MX95 BLK CTL clk driver") Cc: stable@vger.kernel.org Reviewed-by: Frank Li Signed-off-by: Xiaolei Wang Link: https://lore.kernel.org/r/20250619062108.2016511-1-xiaolei.wang@windriver.com Signed-off-by: Stephen Boyd --- drivers/clk/imx/clk-imx95-blk-ctl.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/clk/imx/clk-imx95-blk-ctl.c b/drivers/clk/imx/clk-imx95-blk-ctl.c index 25974947ad0c..cc2ee2be1819 100644 --- a/drivers/clk/imx/clk-imx95-blk-ctl.c +++ b/drivers/clk/imx/clk-imx95-blk-ctl.c @@ -219,11 +219,15 @@ static const struct imx95_blk_ctl_dev_data lvds_csr_dev_data = { .clk_reg_offset = 0, }; +static const char * const disp_engine_parents[] = { + "videopll1", "dsi_pll", "ldb_pll_div7" +}; + static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { [IMX95_CLK_DISPMIX_ENG0_SEL] = { .name = "disp_engine0_sel", - .parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", }, - .num_parents = 4, + .parent_names = disp_engine_parents, + .num_parents = ARRAY_SIZE(disp_engine_parents), .reg = 0, .bit_idx = 0, .bit_width = 2, @@ -232,8 +236,8 @@ static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { }, [IMX95_CLK_DISPMIX_ENG1_SEL] = { .name = "disp_engine1_sel", - .parent_names = (const char *[]){"videopll1", "dsi_pll", "ldb_pll_div7", }, - .num_parents = 4, + .parent_names = disp_engine_parents, + .num_parents = ARRAY_SIZE(disp_engine_parents), .reg = 0, .bit_idx = 2, .bit_width = 2, From 0b0cd1857b783711b4bdfb8eb513c263b8a84f6d Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Mon, 7 Jul 2025 10:24:37 +0800 Subject: [PATCH 2/6] dt-bindings: clock: Add support for i.MX94 LVDS/DISPLAY CSR Add i.MX94 LVDS/DISPLAY CSR compatible string. Add clock index for the two CSRs. Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-1-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa --- .../bindings/clock/nxp,imx95-blk-ctl.yaml | 2 ++ include/dt-bindings/clock/nxp,imx94-clock.h | 13 +++++++++++++ 2 files changed, 15 insertions(+) create mode 100644 include/dt-bindings/clock/nxp,imx94-clock.h diff --git a/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml b/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml index d0291bfff23a..27403b4c52d6 100644 --- a/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml +++ b/Documentation/devicetree/bindings/clock/nxp,imx95-blk-ctl.yaml @@ -13,6 +13,8 @@ properties: compatible: items: - enum: + - nxp,imx94-display-csr + - nxp,imx94-lvds-csr - nxp,imx95-camera-csr - nxp,imx95-display-csr - nxp,imx95-hsio-blk-ctl diff --git a/include/dt-bindings/clock/nxp,imx94-clock.h b/include/dt-bindings/clock/nxp,imx94-clock.h new file mode 100644 index 000000000000..c4ba13352b99 --- /dev/null +++ b/include/dt-bindings/clock/nxp,imx94-clock.h @@ -0,0 +1,13 @@ +/* SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) */ +/* + * Copyright 2025 NXP + */ + +#ifndef __DT_BINDINGS_CLOCK_IMX94_H +#define __DT_BINDINGS_CLOCK_IMX94_H + +#define IMX94_CLK_DISPMIX_CLK_SEL 0 + +#define IMX94_CLK_DISPMIX_LVDS_CLK_GATE 0 + +#endif /* __DT_BINDINGS_CLOCK_IMX94_H */ From b08217a257215ed9130fce93d35feba66b49bf0a Mon Sep 17 00:00:00 2001 From: Laurentiu Palcu Date: Mon, 7 Jul 2025 10:24:38 +0800 Subject: [PATCH 3/6] clk: imx95-blk-ctl: Fix synchronous abort When enabling runtime PM for clock suppliers that also belong to a power domain, the following crash is thrown: error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP Workqueue: events_unbound deferred_probe_work_func pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : clk_mux_get_parent+0x60/0x90 lr : clk_core_reparent_orphans_nolock+0x58/0xd8 Call trace: clk_mux_get_parent+0x60/0x90 clk_core_reparent_orphans_nolock+0x58/0xd8 of_clk_add_hw_provider.part.0+0x90/0x100 of_clk_add_hw_provider+0x1c/0x38 imx95_bc_probe+0x2e0/0x3f0 platform_probe+0x70/0xd8 Enabling runtime PM without explicitly resuming the device caused the power domain cut off after clk_register() is called. As a result, a crash happens when the clock hardware provider is added and attempts to access the BLK_CTL register. Fix this by using devm_pm_runtime_enable() instead of pm_runtime_enable() and getting rid of the pm_runtime_disable() in the cleanup path. Fixes: 5224b189462f ("clk: imx: add i.MX95 BLK CTL clk driver") Reviewed-by: Frank Li Reviewed-by: Abel Vesa Signed-off-by: Laurentiu Palcu Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-2-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa --- drivers/clk/imx/clk-imx95-blk-ctl.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/drivers/clk/imx/clk-imx95-blk-ctl.c b/drivers/clk/imx/clk-imx95-blk-ctl.c index cc2ee2be1819..86bdcd217531 100644 --- a/drivers/clk/imx/clk-imx95-blk-ctl.c +++ b/drivers/clk/imx/clk-imx95-blk-ctl.c @@ -342,8 +342,10 @@ static int imx95_bc_probe(struct platform_device *pdev) if (!clk_hw_data) return -ENOMEM; - if (bc_data->rpm_enabled) - pm_runtime_enable(&pdev->dev); + if (bc_data->rpm_enabled) { + devm_pm_runtime_enable(&pdev->dev); + pm_runtime_resume_and_get(&pdev->dev); + } clk_hw_data->num = bc_data->num_clks; hws = clk_hw_data->hws; @@ -383,8 +385,10 @@ static int imx95_bc_probe(struct platform_device *pdev) goto cleanup; } - if (pm_runtime_enabled(bc->dev)) + if (pm_runtime_enabled(bc->dev)) { + pm_runtime_put_sync(&pdev->dev); clk_disable_unprepare(bc->clk_apb); + } return 0; @@ -395,9 +399,6 @@ cleanup: clk_hw_unregister(hws[i]); } - if (bc_data->rpm_enabled) - pm_runtime_disable(&pdev->dev); - return ret; } From 88768d6f8c13ede81b248177fed3ac285499f77c Mon Sep 17 00:00:00 2001 From: Sandor Yu Date: Mon, 7 Jul 2025 10:24:39 +0800 Subject: [PATCH 4/6] clk: imx95-blk-ctl: Rename lvds and displaymix csr blk Rename i.MX95 lvds and displaymix csr blk drvdata in order to add support for i.MX943. Signed-off-by: Sandor Yu Signed-off-by: Laurentiu Palcu Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-3-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa --- drivers/clk/imx/clk-imx95-blk-ctl.c | 30 ++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/drivers/clk/imx/clk-imx95-blk-ctl.c b/drivers/clk/imx/clk-imx95-blk-ctl.c index 86bdcd217531..c62d61c3444b 100644 --- a/drivers/clk/imx/clk-imx95-blk-ctl.c +++ b/drivers/clk/imx/clk-imx95-blk-ctl.c @@ -156,7 +156,7 @@ static const struct imx95_blk_ctl_dev_data camblk_dev_data = { .clk_reg_offset = 0, }; -static const struct imx95_blk_ctl_clk_dev_data lvds_clk_dev_data[] = { +static const struct imx95_blk_ctl_clk_dev_data imx95_lvds_clk_dev_data[] = { [IMX95_CLK_DISPMIX_LVDS_PHY_DIV] = { .name = "ldb_phy_div", .parent_names = (const char *[]){ "ldbpll", }, @@ -213,21 +213,21 @@ static const struct imx95_blk_ctl_clk_dev_data lvds_clk_dev_data[] = { }, }; -static const struct imx95_blk_ctl_dev_data lvds_csr_dev_data = { - .num_clks = ARRAY_SIZE(lvds_clk_dev_data), - .clk_dev_data = lvds_clk_dev_data, +static const struct imx95_blk_ctl_dev_data imx95_lvds_csr_dev_data = { + .num_clks = ARRAY_SIZE(imx95_lvds_clk_dev_data), + .clk_dev_data = imx95_lvds_clk_dev_data, .clk_reg_offset = 0, }; -static const char * const disp_engine_parents[] = { +static const char * const imx95_disp_engine_parents[] = { "videopll1", "dsi_pll", "ldb_pll_div7" }; -static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { +static const struct imx95_blk_ctl_clk_dev_data imx95_dispmix_csr_clk_dev_data[] = { [IMX95_CLK_DISPMIX_ENG0_SEL] = { .name = "disp_engine0_sel", - .parent_names = disp_engine_parents, - .num_parents = ARRAY_SIZE(disp_engine_parents), + .parent_names = imx95_disp_engine_parents, + .num_parents = ARRAY_SIZE(imx95_disp_engine_parents), .reg = 0, .bit_idx = 0, .bit_width = 2, @@ -236,8 +236,8 @@ static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { }, [IMX95_CLK_DISPMIX_ENG1_SEL] = { .name = "disp_engine1_sel", - .parent_names = disp_engine_parents, - .num_parents = ARRAY_SIZE(disp_engine_parents), + .parent_names = imx95_disp_engine_parents, + .num_parents = ARRAY_SIZE(imx95_disp_engine_parents), .reg = 0, .bit_idx = 2, .bit_width = 2, @@ -246,9 +246,9 @@ static const struct imx95_blk_ctl_clk_dev_data dispmix_csr_clk_dev_data[] = { } }; -static const struct imx95_blk_ctl_dev_data dispmix_csr_dev_data = { - .num_clks = ARRAY_SIZE(dispmix_csr_clk_dev_data), - .clk_dev_data = dispmix_csr_clk_dev_data, +static const struct imx95_blk_ctl_dev_data imx95_dispmix_csr_dev_data = { + .num_clks = ARRAY_SIZE(imx95_dispmix_csr_clk_dev_data), + .clk_dev_data = imx95_dispmix_csr_clk_dev_data, .clk_reg_offset = 0, }; @@ -469,8 +469,8 @@ static const struct dev_pm_ops imx95_bc_pm_ops = { static const struct of_device_id imx95_bc_of_match[] = { { .compatible = "nxp,imx95-camera-csr", .data = &camblk_dev_data }, { .compatible = "nxp,imx95-display-master-csr", }, - { .compatible = "nxp,imx95-lvds-csr", .data = &lvds_csr_dev_data }, - { .compatible = "nxp,imx95-display-csr", .data = &dispmix_csr_dev_data }, + { .compatible = "nxp,imx95-display-csr", .data = &imx95_dispmix_csr_dev_data }, + { .compatible = "nxp,imx95-lvds-csr", .data = &imx95_lvds_csr_dev_data }, { .compatible = "nxp,imx95-hsio-blk-ctl", .data = &hsio_blk_ctl_dev_data }, { .compatible = "nxp,imx95-vpu-csr", .data = &vpublk_dev_data }, { .compatible = "nxp,imx95-netcmix-blk-ctrl", .data = &netcmix_dev_data}, From 9678bc7661cb34bec4be92685039eec68ca67dad Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Mon, 7 Jul 2025 10:24:40 +0800 Subject: [PATCH 5/6] clk: imx95-blk-ctl: Add clock for i.MX94 LVDS/Display CSR i.MX94 BLK CTL LVDS CSR's LVDS_PHY_CLOCK_CONTRL register controls the clock gating logic of LVDS units. Display CSR's DISPLAY_ENGINES_CLOCK_CONTROL register controls the selection of the clock feeding the display engine. Add clock gate support for the two CSRs. Reviewed-by: Abel Vesa Signed-off-by: Peng Fan Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-4-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa --- drivers/clk/imx/clk-imx95-blk-ctl.c | 50 ++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/drivers/clk/imx/clk-imx95-blk-ctl.c b/drivers/clk/imx/clk-imx95-blk-ctl.c index c62d61c3444b..7e88877a6245 100644 --- a/drivers/clk/imx/clk-imx95-blk-ctl.c +++ b/drivers/clk/imx/clk-imx95-blk-ctl.c @@ -1,8 +1,9 @@ // SPDX-License-Identifier: GPL-2.0 /* - * Copyright 2024 NXP + * Copyright 2024-2025 NXP */ +#include #include #include #include @@ -300,6 +301,51 @@ static const struct imx95_blk_ctl_dev_data hsio_blk_ctl_dev_data = { .clk_reg_offset = 0, }; +static const struct imx95_blk_ctl_clk_dev_data imx94_lvds_clk_dev_data[] = { + [IMX94_CLK_DISPMIX_LVDS_CLK_GATE] = { + .name = "lvds_clk_gate", + .parent_names = (const char *[]){ "ldbpll", }, + .num_parents = 1, + .reg = 0, + .bit_idx = 1, + .bit_width = 1, + .type = CLK_GATE, + .flags = CLK_SET_RATE_PARENT, + .flags2 = CLK_GATE_SET_TO_DISABLE, + }, +}; + +static const struct imx95_blk_ctl_dev_data imx94_lvds_csr_dev_data = { + .num_clks = ARRAY_SIZE(imx94_lvds_clk_dev_data), + .clk_dev_data = imx94_lvds_clk_dev_data, + .clk_reg_offset = 0, + .rpm_enabled = true, +}; + +static const char * const imx94_disp_engine_parents[] = { + "disppix", "ldb_pll_div7" +}; + +static const struct imx95_blk_ctl_clk_dev_data imx94_dispmix_csr_clk_dev_data[] = { + [IMX94_CLK_DISPMIX_CLK_SEL] = { + .name = "disp_clk_sel", + .parent_names = imx94_disp_engine_parents, + .num_parents = ARRAY_SIZE(imx94_disp_engine_parents), + .reg = 0, + .bit_idx = 1, + .bit_width = 1, + .type = CLK_MUX, + .flags = CLK_SET_RATE_NO_REPARENT | CLK_SET_RATE_PARENT, + }, +}; + +static const struct imx95_blk_ctl_dev_data imx94_dispmix_csr_dev_data = { + .num_clks = ARRAY_SIZE(imx94_dispmix_csr_clk_dev_data), + .clk_dev_data = imx94_dispmix_csr_clk_dev_data, + .clk_reg_offset = 0, + .rpm_enabled = true, +}; + static int imx95_bc_probe(struct platform_device *pdev) { struct device *dev = &pdev->dev; @@ -467,6 +513,8 @@ static const struct dev_pm_ops imx95_bc_pm_ops = { }; static const struct of_device_id imx95_bc_of_match[] = { + { .compatible = "nxp,imx94-display-csr", .data = &imx94_dispmix_csr_dev_data }, + { .compatible = "nxp,imx94-lvds-csr", .data = &imx94_lvds_csr_dev_data }, { .compatible = "nxp,imx95-camera-csr", .data = &camblk_dev_data }, { .compatible = "nxp,imx95-display-master-csr", }, { .compatible = "nxp,imx95-display-csr", .data = &imx95_dispmix_csr_dev_data }, From c78865241ecffaff7ce5db00ed5b71c1a70c0ff1 Mon Sep 17 00:00:00 2001 From: Peng Fan Date: Mon, 7 Jul 2025 10:24:41 +0800 Subject: [PATCH 6/6] MAINTAINERS: Update i.MX Clock Entry Update file match pattern to include nxp,imx* and fsl,imx*. Signed-off-by: Peng Fan Reviewed-by: Abel Vesa Link: https://lore.kernel.org/r/20250707-imx95-blk-ctl-7-1-v3-5-c1b676ec13be@nxp.com Signed-off-by: Abel Vesa --- MAINTAINERS | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/MAINTAINERS b/MAINTAINERS index a92290fffa16..ee0c28fb20ee 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -17951,9 +17951,9 @@ L: linux-clk@vger.kernel.org L: imx@lists.linux.dev S: Maintained T: git git://git.kernel.org/pub/scm/linux/kernel/git/abelvesa/linux.git clk/imx -F: Documentation/devicetree/bindings/clock/imx* +F: Documentation/devicetree/bindings/clock/*imx* F: drivers/clk/imx/ -F: include/dt-bindings/clock/imx* +F: include/dt-bindings/clock/*imx* NXP PF8100/PF8121A/PF8200 PMIC REGULATOR DEVICE DRIVER M: Jagan Teki