When a caller is not interested in the returned message, the ret_payload pointer
is set to NULL in the u-boot-sources. In this case, under EL3, the memory from
address 0x0 would be overwritten by xilinx_pm_request with the returned IPI
message, damaging the original data under this address. The patch, in case
ret_payload is NULL, assigns the pointer to the array holding the IPI message
being sent.
Signed-off-by: Adrian Fiergolski <adrian.fiergol...@fastree3d.com>
---
Follow Michhals suggestion regarding log formatting.
Clean the code.
drivers/firmware/firmware-zynqmp.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/firmware-zynqmp.c
b/drivers/firmware/firmware-zynqmp.c
index d4dc856baf..a69294dfc5 100644
--- a/drivers/firmware/firmware-zynqmp.c
+++ b/drivers/firmware/firmware-zynqmp.c
@@ -154,6 +154,8 @@ U_BOOT_DRIVER(zynqmp_power) = {
int __maybe_unused xilinx_pm_request(u32 api_id, u32 arg0, u32 arg1, u32 arg2,
u32 arg3, u32 *ret_payload)
{
+ int ret;
+
debug("%s at EL%d, API ID: 0x%0x\n", __func__, current_el(), api_id);
if (IS_ENABLED(CONFIG_SPL_BUILD) || current_el() == 3) {
@@ -165,6 +167,12 @@ int __maybe_unused xilinx_pm_request(u32 api_id, u32 arg0,
u32 arg1, u32 arg2,
*/
u32 regs[] = {api_id, arg0, arg1, arg2, arg3};
+ /*
+ * Use regs array in case ret_payload is NULL
+ */
+ if (ret_payload == NULL)
+ ret_payload = regs;
+
if (api_id == PM_FPGA_LOAD) {
/* Swap addr_hi/low because of incompatibility */
u32 temp = regs[1];
@@ -174,6 +182,8 @@ int __maybe_unused xilinx_pm_request(u32 api_id, u32 arg0,
u32 arg1, u32 arg2,
}
ipi_req(regs, PAYLOAD_ARG_CNT, ret_payload, PAYLOAD_ARG_CNT);
+
+ ret = ret_payload[0];
#else
return -EPERM;
#endif
@@ -198,8 +208,9 @@ int __maybe_unused xilinx_pm_request(u32 api_id, u32 arg0,
u32 arg1, u32 arg2,
ret_payload[4] = (u32)regs.regs[2];
}
+ ret = (ret_payload) ? ret_payload[0] : 0;
}
- return (ret_payload) ? ret_payload[0] : 0;
+ return ret;
}
static const struct udevice_id zynqmp_firmware_ids[] = {
--
2.33.0
