1. 15 Feb, 2019 4 commits
  2. 16 Jan, 2019 1 commit
    • Christian Lamparter's avatar
      mtd: rawnand: qcom: fix memory corruption that causes panic · 6496715c
      Christian Lamparter authored
      commit 81d9bdf5 upstream.
      
      This patch fixes a memory corruption that occurred in the
      qcom-nandc driver since it was converted to nand_scan().
      
      On boot, an affected device will panic from a NPE at a weird place:
      | Unable to handle kernel NULL pointer dereference at virtual address 0
      | pgd = (ptrval)
      | [00000000] *pgd=00000000
      | Internal error: Oops: 80000005 [#1] SMP ARM
      | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.19.9 #0
      | Hardware name: Generic DT based system
      | PC is at   (null)
      | LR is at nand_block_isbad+0x90/0xa4
      | pc : [<00000000>]    lr : [<c0592240>]    psr: 80000013
      | sp : cf839d40  ip : 00000000  fp : cfae9e20
      | r10: cf815810  r9 : 00000000  r8 : 00000000
      | r7 : 00000000  r6 : 00000000  r5 : 00000001  r4 : cf815810
      | r3 : 00000000  r2 : cfae9810  r1 : ffffffff  r0 : cf815810
      | Flags: Nzcv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
      | Control: 10c5387d  Table: 8020406a  DAC: 00000051
      | Process swapper/0 (pid: 1, stack limit = 0x(ptrval))
      | [<c0592240>] (nand_block_isbad) from [<c0580a94>]
      | [<c0580a94>] (allocate_partition) from [<c05811e4>]
      | [<c05811e4>] (add_mtd_partitions) from [<c0581164>]
      | [<c0581164>] (parse_mtd_partitions) from [<c057def4>]
      | [<c057def4>] (mtd_device_parse_register) from [<c059d274>]
      | [<c059d274>] (qcom_nandc_probe) from [<c0567f00>]
      
      The problem is that the nand_scan()'s qcom_nand_attach_chip callback
      is updating the nandc->max_cwperpage from 1 to 4. This causes the
      sg_init_table of clear_bam_transaction() in the driver's
      qcom_nandc_block_bad() to memset much more than what was initially
      allocated by alloc_bam_transaction().
      
      This patch restores the old behavior by reallocating the shared bam
      transaction alloc_bam_transaction() after the chip was identified,
      but before mtd_device_parse_register() (which is an alias for
      mtd_device_register() - see panic) gets called. This fixes the
      corruption and the driver is working again.
      
      Cc: stable@vger.kernel.org
      Fixes: 6a3cec64 ("mtd: rawnand: qcom: convert driver to nand_scan()")
      Signed-off-by: default avatarChristian Lamparter <chunkeey@gmail.com>
      Acked-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      Signed-off-by: default avatarBoris Brezillon <bbrezillon@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6496715c
  3. 09 Jan, 2019 4 commits
  4. 13 Dec, 2018 2 commits
  5. 28 Nov, 2018 2 commits
  6. 20 Nov, 2018 1 commit
    • Tudor.Ambarus@microchip.com's avatar
      mtd: spi-nor: fix selection of uniform erase type in flexible conf · e8828ec1
      Tudor.Ambarus@microchip.com authored
      There are uniform, non-uniform and flexible erase flash configurations.
      
      The non-uniform erase types, are the erase types that can _not_ erase
      the entire flash by their own.
      
      As the code was, in case flashes had flexible erase capabilities
      (support both uniform and non-uniform erase types in the same flash
      configuration) and supported multiple uniform erase type sizes, the
      code did not sort the uniform erase types, and could select a wrong
      erase type size.
      
      Sort the uniform erase mask in case of flexible erase flash
      configurations, in order to select the best uniform erase type size.
      
      Uniform, non-uniform, and flexible configurations with just a valid
      uniform erase type, are not affected by this change.
      
      Uniform erase tested on mx25l3273fm2i-08g and sst26vf064B-104i/sn.
      Non uniform erase tested on sst26vf064B-104i/sn.
      
      Fixes: 5390a8df ("mtd: spi-nor: add support to non-uniform SFDP SPI NOR flash memories")
      Signed-off-by: default avatarTudor Ambarus <tudor.ambarus@microchip.com>
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      e8828ec1
  7. 19 Nov, 2018 1 commit
    • Thor Thayer's avatar
      mtd: spi-nor: Fix Cadence QSPI page fault kernel panic · a6a66f80
      Thor Thayer authored
      The current Cadence QSPI driver caused a kernel panic sporadically
      when writing to QSPI. The problem was caused by writing more bytes
      than needed because the QSPI operated on 4 bytes at a time.
      <snip>
      [   11.202044] Unable to handle kernel paging request at virtual address bffd3000
      [   11.209254] pgd = e463054d
      [   11.211948] [bffd3000] *pgd=2fffb811, *pte=00000000, *ppte=00000000
      [   11.218202] Internal error: Oops: 7 [#1] SMP ARM
      [   11.222797] Modules linked in:
      [   11.225844] CPU: 1 PID: 1317 Comm: systemd-hwdb Not tainted 4.17.7-d0c45cd44a8f
      [   11.235796] Hardware name: Altera SOCFPGA Arria10
      [   11.240487] PC is at __raw_writesl+0x70/0xd4
      [   11.244741] LR is at cqspi_write+0x1a0/0x2cc
      </snip>
      On a page boundary limit the number of bytes copied from the tx buffer
      to remain within the page.
      
      This patch uses a temporary buffer to hold the 4 bytes to write and then
      copies only the bytes required from the tx buffer.
      Reported-by: default avatarAdrian Amborzewicz <adrian.ambrozewicz@intel.com>
      Signed-off-by: default avatarThor Thayer <thor.thayer@linux.intel.com>
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      a6a66f80
  8. 18 Nov, 2018 2 commits
    • Olof Johansson's avatar
      mtd: rawnand: qcom: Namespace prefix some commands · 33bf5519
      Olof Johansson authored
      PAGE_READ is used by RISC-V arch code included through mm headers,
      and it makes sense to bring in a prefix on these in the driver.
      
      drivers/mtd/nand/raw/qcom_nandc.c:153: warning: "PAGE_READ" redefined
       #define PAGE_READ   0x2
      In file included from include/linux/memremap.h:7,
                       from include/linux/mm.h:27,
                       from include/linux/scatterlist.h:8,
                       from include/linux/dma-mapping.h:11,
                       from drivers/mtd/nand/raw/qcom_nandc.c:17:
      arch/riscv/include/asm/pgtable.h:48: note: this is the location of the previous definition
      
      Caught by riscv allmodconfig.
      Signed-off-by: Olof Johansson's avatarOlof Johansson <olof@lixom.net>
      Reviewed-by: default avatarMiquel Raynal <miquel.raynal@bootlin.com>
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      33bf5519
    • Johan Hovold's avatar
      mtd: rawnand: atmel: fix OF child-node lookup · 5d1e9c22
      Johan Hovold authored
      Use the new of_get_compatible_child() helper to lookup the nfc child
      node instead of using of_find_compatible_node(), which searches the
      entire tree from a given start node and thus can return an unrelated
      (i.e. non-child) node.
      
      This also addresses a potential use-after-free (e.g. after probe
      deferral) as the tree-wide helper drops a reference to its first
      argument (i.e. the node of the device being probed).
      
      While at it, also fix a related nfc-node reference leak.
      
      Fixes: f88fc122 ("mtd: nand: Cleanup/rework the atmel_nand driver")
      Cc: stable <stable@vger.kernel.org>     # 4.11
      Cc: Nicolas Ferre <nicolas.ferre@microchip.com>
      Cc: Josh Wu <rainyfeeling@outlook.com>
      Cc: Boris Brezillon <boris.brezillon@bootlin.com>
      Signed-off-by: default avatarJohan Hovold <johan@kernel.org>
      Signed-off-by: default avatarBoris Brezillon <boris.brezillon@bootlin.com>
      5d1e9c22
  9. 13 Nov, 2018 4 commits
  10. 06 Nov, 2018 1 commit
  11. 05 Nov, 2018 4 commits
  12. 31 Oct, 2018 1 commit
  13. 23 Oct, 2018 1 commit
  14. 16 Oct, 2018 1 commit
    • Jens Axboe's avatar
      mtd_blkdevs: convert to blk-mq · 891b7c5f
      Jens Axboe authored
      Straight forward conversion, using an internal list to enable the
      driver to pull requests at will.
      
      Dynamically allocate the tag set to avoid having to pull in the
      block headers for blktrans.h, since various mtd drivers use
      block conflicting names for defines and functions.
      
      Cc: David Woodhouse <dwmw2@infradead.org>
      Cc: linux-mtd@lists.infradead.org
      Tested-by: default avatarRichard Weinberger <richard@nod.at>
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      891b7c5f
  15. 12 Oct, 2018 2 commits
  16. 08 Oct, 2018 9 commits