[QLI2.0] [hamoa-iot-evk] NULL pointer dereference on iris fw load

[sgaud-quic]

Board : hamoa-iot-evk
Kernel : qcom-6.18.y
LAVA : https://lava.infra.foundries.io/scheduler/job/442980

[   14.966056] CPU: 9 UID: 0 PID: 677 Comm: v4l_id Not tainted 6.18.44-g8a24e588aae7-dirty #1 PREEMPT 
[   14.966059] Hardware name: Qualcomm Technologies, Inc. Hamoa IoT EVK (DT)
[   14.966060] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[   14.966062] pc : __iommu_unmap+0x3c/0x1c0
[   14.966068] lr : iommu_unmap+0x50/0xa8
[   14.966069] sp : ffff8000829238e0
[   14.966070] x29: ffff8000829238f0 x28: 0000000000000000 x27: ffff800082923c60
[   14.966073] x26: 0000000000020100 x25: 0000000000000030 x24: 0000000087700000
[   14.966075] x23: ffff800082923948 x22: 0000000000700000 x21: 0000000000000000
[   14.966078] x20: ffff00081de54080 x19: 0000000000000000 x18: 0000000000000000
[   14.966080] x17: 0000000000000001 x16: ffffa6e201058f88 x15: 0000000000000000
[   14.966082] x14: 0000000000000000 x13: deadd00ddeadd00d x12: deadd00ddeadd00d
[   14.966085] x11: 0000000000000000 x10: 0000000000000000 x9 : ffffa6e201058fd8
[   14.966087] x8 : ffff800082923780 x7 : 0000000000000000 x6 : 0000000000000000
[   14.966089] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000
[   14.966091] x2 : 0000000000700000 x1 : 0000000000000000 x0 : ffff00080b7b6040
[   14.966094] Call trace:
[   14.966095]  __iommu_unmap+0x3c/0x1c0 (P)
[   14.966098]  iommu_unmap+0x50/0xa8
[   14.966100]  iris_fw_load+0x20c/0x250 [qcom_iris]
[   14.966109]  iris_core_init+0xc4/0x198 [qcom_iris]
[   14.966113]  iris_open+0x84/0x440 [qcom_iris]
[   14.966118]  v4l2_open+0x7c/0x180 [videodev]
[   14.966130]  chrdev_open+0xbc/0x220
[   14.966133]  do_dentry_open+0x230/0x4e0
[   14.966136]  vfs_open+0x30/0x108
[   14.966138]  path_openat+0x884/0x10e0
[   14.966141]  do_filp_open+0xb0/0x178
[   14.966143]  do_sys_openat2+0x98/0x108
[   14.966145]  __arm64_sys_openat+0x5c/0xc0
[   14.966147]  invoke_syscall.constprop.0+0x48/0xf0
[   14.966152]  el0_svc_common.constprop.0+0xc0/0xf0
[   14.966155]  do_el0_svc+0x24/0x40
[   14.966158]  el0_svc+0x38/0x118
[   14.966161]  el0t_64_sync_handler+0xa0/0xe8
[   14.966163]  el0t_64_sync+0x19c/0x1a0
[   14.966166] Code: aa0303f7 f9432c03 f90007e3 d2800003 (b94002a0) 
[   14.966168] ---[ end trace 0000000000000000 ]---

[yupiwang127]

what's TZ version on this device:[hamoa-iot-evk-04]?

[sgaud-quic]

yupiwang127 please check from the build loaded on device.

[quic-tingweiz]

Firmware used for this job is https://qli-prod-artifacts.qualcomm.com/qcom-prd-gh-artifacts/qualcomm-linux/meta-qcom/35739481295-1/qcom-distro_linux-qcom-6.18/iq-x7181-evk/
Below job ran on same device with same firmware and didn't reproduce this issue.
https://lava.infra.foundries.io/scheduler/job/442924#

[quic-tingweiz]

There is a bug in iris driver that iommu_remap is called when qcom_scm_pas_prepare_and_auth_reset() failed even core->fw.iommu_domain is false and it's not mapped in first place. This needs to be addressed in driver.
https://github.com/qualcomm-linux/kernel/blob/qcom-6.18.y/drivers/media/platform/qcom/iris/iris_firmware.c#L161
The qcom_scm_pas_prepare_and_auth_reset may be related to ADSP crash in this device and some racing condition. That's why it's not stably reproduced on same device with same build.