summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* Release v2018.10.0v2018.10.0Sascha Hauer2018-10-081-1/+1
| | | | Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* arm: crypto: fix SHA256 shipped assembler codeLucas Stach2018-10-081-1/+1
| | | | | | | | | | | | | | | | Binutils 2.29 changed behavior of the adr instruction to always add the thumb mode switch offset, which breaks usages where the user is interested in the address of an internal symbol, instead of a jump address. Binutils 3.31 fixed this by only adding the offset when interworking is required. As there are toolchains out there with broken binutils, it's better to fix the code to work around the issue by not using the named label. Signed-off-by: Lucas Stach <l.stach@pengutronix.de> Tested-by: Robert Schwebel <r.schwebel@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: socfpga: Arria10: Fix compiler warningSascha Hauer2018-10-081-1/+1
| | | | | | | | | Fixes: arch/arm/mach-socfpga/arria10-xload.c: In function 'arria10_prepare_mmc': arch/arm/mach-socfpga/arria10-xload.c:339:40: warning: dereferencing 'void *' pointer Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: socfpga: Arria10: add missing staticSascha Hauer2018-10-081-1/+1
| | | | | | Avoid "multiple definition of `a10_wait_for_usermode'" Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: ubifs: Do not free memory not allocated by ubifsSascha Hauer2018-09-281-1/+0
| | | | | | | | | Since the switch to dentry cache implementation we no longer allocate the super block, so we must not free it in the error path. Fixes: ("4d2b23bcf9 fs: ubifs: Switch to dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: stat: Do not forget to set errnoSascha Hauer2018-09-261-0/+3
| | | | | | | | stat() needs to set errno correctly when returning with an error. Fixes: b3fbfad7ae ("fs: dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: open: Do not forget to set errnoSascha Hauer2018-09-261-1/+1
| | | | | | | | | When the initial lookup fails in open we have to go to the error path which sets errno correctly rather than returning directly. Fixes: b3fbfad7ae ("fs: dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: ramfs: Free data when file is unlinkedSascha Hauer2018-09-261-1/+23
| | | | | | | | | Since the switch to dentry cache implementation the memory is no longer freed when a file in ramfs is deleted. Fix this. Fixes: b283b72639 ("fs: ramfs: Switch to dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* state: backend_bucket_circular: fix for non power of 2 writesizeLadislav Michl2018-09-261-2/+2
| | | | | | | | | backend_bucket_circular currently assumes writesize is power of 2, which makes it fail on dataflash devices, where this assumption is false. Signed-off-by: Ladislav Michl <ladis@linux-mips.org> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* spi: atmel_spi: fix duplicate const warningLadislav Michl2018-09-261-1/+1
| | | | | Signed-off-by: Ladislav Michl <ladis@linux-mips.org> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ratp: select CMDLINE_EDITINGClément Leger2018-09-261-0/+1
| | | | | | | | ratp seems to send special characters which are not handle correctly without CDMLINE_EDITING. Without this config, commands run via ratp will have an erratic behavior and/or incorrect output. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: i.MX27: Fix NAND boot with newer gccSascha Hauer2018-09-191-1/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a fix for a very weird icache problem when booting from NAND. With a OSELAS-2018.01 toolchain imx27_barebox_boot_nand_external() is compiled like this: 0000063c <imx27_barebox_boot_nand_external>: 63c: e92d4010 push {r4, lr} 640: e1a0200f mov r2, pc 644: e282230a add r2, r2, #671088640 ; 0x28000000 648: e3520b02 cmp r2, #2048 ; 0x800 64c: 9a000012 bls 69c <imx27_barebox_boot_nand_external+0x60> 650: eb000034 bl 728 <imx27_barebox_entry> 654: e592c000 ldr ip, [r2] 658: e2822004 add r2, r2, #4 65c: e580c000 str ip, [r0] 660: e1520001 cmp r2, r1 664: e2820332 add r0, r2, #-939524096 ; 0xc8000000 668: 1afffff9 bne 654 <imx27_barebox_boot_nand_external+0x18> 66c: e1a00003 mov r0, r3 670: e59f2034 ldr r2, [pc, #52] ; 6ac <imx27_barebox_boot_nand_external+0x70> 674: e2401376 sub r1, r0, #-671088639 ; 0xd8000001 678: e59f3030 ldr r3, [pc, #48] ; 6b0 <imx27_barebox_boot_nand_external+0x74> 67c: e1510002 cmp r1, r2 680: 93c004ff bicls r0, r0, #-16777216 ; 0xff000000 684: e1a03a83 lsl r3, r3, #21 688: e1a03aa3 lsr r3, r3, #21 68c: 93c0073e bicls r0, r0, #16252928 ; 0xf80000 690: e283320a add r3, r3, #-1610612736 ; 0xa0000000 694: 9280020a addls r0, r0, #-1610612736 ; 0xa0000000 698: e12fff33 blx r3 69c: e1a03000 mov r3, r0 6a0: e3a02336 mov r2, #-671088640 ; 0xd8000000 6a4: e59f1008 ldr r1, [pc, #8] ; 6b4 <imx27_barebox_boot_nand_external+0x78> 6a8: eaffffec b 660 <imx27_barebox_boot_nand_external+0x24> 6ac: 0007fffe .word 0x0007fffe 6b0: 00000604 .word 0x00000604 6b4: d8000800 .word 0xd8000800 From 0x64c the code jumps to 0x69c and then back to 0x660. The jump to 0x69c triggers a icache line fetch which works fine, but then when the function continues and the code enters the same instruction cache line at 0x680 again then only garbage is executed, most of the time we end up in an endless loop and the CPU jumps back somewhere at the beginning of the function. I have carefully added nops right before the out of line code block. When there are enough nops to move the block to the next cache line then the code works again. That of course is no solution to the problem. Since I am out of ideas what the real issue is let's just disable the icache in this function and re-enable it in the next function. This seems to solve the problem. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Tested-by: Florian Bäuerle <florian.baeuerle@allegion.com>
* ARM: radxa-rock: Fix passing device tree to kernelSascha Hauer2018-09-181-3/+1
| | | | | | | The device tree can be passed in global.bootm.oftree. This used to be "oftree -f" / "oftree -l" which no longer works. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: i.MX28: Add APBH clk supportOleksij Rempel2018-09-181-0/+1
| | | | | | | | | | i.MX28 fails to use DMA and NAND because it cannot find its clock. Add the clock for APBH. Fixes: 6eb2ba6f1b ("dma: apbh: Enable clock as a part of probing") Signed-off-by: Oleksij Rempel <o.rempel@pengutronix.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* net: mdio: Do not warn about invalid PHY addressSascha Hauer2018-09-181-4/+4
| | | | | | | | | | | | | | | | of_mdiobus_register is now called with nodes from ethernet devices. Their child nodes are not necessarily phy nodes. For am335x devices we get several warnings now: miibus0: /ocp/ethernet@4a100000/mdio@4a101000 PHY address 1242566656 is too large miibus0: /ocp/ethernet@4a100000/slave@4a100200 has invalid PHY address miibus0: /ocp/ethernet@4a100000/slave@4a100300 has invalid PHY address miibus0: /ocp/ethernet@4a100000/cpsw-phy-sel@44e10650 PHY address 1155597904 is too large None of the nodes is a phy node, so silence the warnings and turn them into dev_dbg. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: omap: xload: Fix network boot filenameSascha Hauer2018-09-181-2/+5
| | | | | | | | | | | | The dhcp code no longer exports the "bootfile" environment variable. It now uses global.dhcp.bootfile. Since global variable support is not necessarily part of the MLO we instead use struct dhcp_result * to get the bootfile information. Fixes: 528298b702 ("net: dhcp: rework") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Tested-by: Dennis Menschel <menschel-d@posteo.de>
* pci_of_match_device: don't crash on MIPS MaltaAntony Pavlov2018-09-171-1/+1
| | | | | | | | In arch/mips/mach-malta/pci.c PCI controller is instantiated without dt and struct pci_controller parent field is NULL. Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* MIPS: fix PCI quirk infrastructure buildAntony Pavlov2018-09-171-0/+11
| | | | | | | | | | | | | | | | | | | | | | | | | The commit fc2c618c2038 ("pci: add quirk infrastructure") adds necessary ld-script changes only for ARM architecture. As a result, qemu-malta build fails: LD barebox drivers/built-in.o: In function `pci_fixup_device': (.text.pci_fixup_device+0x30): undefined reference to `__end_pci_fixups_enable' (.text.pci_fixup_device+0x38): undefined reference to `__end_pci_fixups_enable' (.text.pci_fixup_device+0x34): undefined reference to `__start_pci_fixups_enable' (.text.pci_fixup_device+0x3c): undefined reference to `__start_pci_fixups_enable' (.text.pci_fixup_device+0x70): undefined reference to `__end_pci_fixups_header' (.text.pci_fixup_device+0x78): undefined reference to `__end_pci_fixups_header' (.text.pci_fixup_device+0x74): undefined reference to `__start_pci_fixups_header' (.text.pci_fixup_device+0x80): undefined reference to `__start_pci_fixups_header' (.text.pci_fixup_device+0x2c): undefined reference to `__end_pci_fixups_early' (.text.pci_fixup_device+0x88): undefined reference to `__end_pci_fixups_early' (.text.pci_fixup_device+0x84): undefined reference to `__start_pci_fixups_early' (.text.pci_fixup_device+0x90): undefined reference to `__start_pci_fixups_early' make: *** [Makefile:767: barebox] Error 1 Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* ARM: Multi PBL: Fix image calculation for certain toolchainsSascha Hauer2018-09-174-5/+6
| | | | | | | | | | | | | The current way to calculate the compressed image position works with the OSELAS toolchains, but not with the Debian/Ubuntu toolchains. For these toolchains &image_end_marker already returns the correct address, adding global_variable_offset() to it is wrong. The solution seems to be to put the image_end_marker into a different object file so that the compiler cannot play any tricks to resolve the address internally in the object file. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: devfs: fix r/w permissionsSascha Hauer2018-09-171-1/+6
| | | | | | | | | The real r/w flags were lost in the switch to dentry cache implementation. Restore them. Fixes: 9137c41915 ("fs: devfs: Switch to dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* fs: devfs: Create device files as character devicesSascha Hauer2018-09-171-2/+2
| | | | | | | | | | | | Without this files in /dev/ appear as regular files. copy_file() stumbles upon this as it tries a truncate() on that files which then fails. Create the files as character devices so that copy_file() works as expected. Fixes: 9137c41915 ("fs: devfs: Switch to dentry cache implementation") Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Tested-by: Giorgio Dal Molin <giorgio.nicole@arcor.de>
* Merge branch 'for-next/usb'Sascha Hauer2018-09-113-31/+31
|\
| * USB: host: hub: Adjust device speed after every port resetAndrey Smirnov2018-08-293-20/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To account for the possibility of a device coming out of second reset operating at different speed compared to first, move the code that stores device speed to be a part of hub_port_reset(). This way any speed change happening as a result of port reset could be accounted for. The above behaviour was observed on i.MX51 ZII RDU1, on USBH2 port connected to SMSC2660 USB Hub/SD card reader. For reasons unclear, first reset would put it into Full Speed mode whereas second would result in switch to High Speed. Artifically disabling second reset would result in the device operating at Full Speed. Not doing second speed adjustement on that board result would result in un-processed control transfer and failure to execute usb_set_address(). Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * USB: host: hub: rename function argumentSascha Hauer2018-08-292-12/+12
| | | | | | | | | | | | | | | | Rename struct usb_device *dev function argument to usb_port_reset() to "hub" as the next patch will add another struct usb_device * argument to that function. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * USB: host: hub: Make sure to remove dangling pointersAndrey Smirnov2018-08-291-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | When the call to usb_new_device() in usb_hub_port_connect_change() fails and corresponding USB device is freed with usb_free_device(), we need to make sure that the pointer to it stored in dev->children[port] is removed as well, lest we risk usage-after-free. This issue was observed when working with a device for which usb_set_address() would fail and trying to do "usb" right afterwards. Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
* | Merge branch 'for-next/ubi'Sascha Hauer2018-09-1115-707/+1419
|\ \
| * | ubi: Initialize Fastmap checkmapping correctlyRichard Weinberger2018-08-311-10/+10
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We cannot do it last, otherwithse it will be skipped for dynamic volumes. Reported-by: Lachmann, Juergen <juergen.lachmann@harman.com> Fixes: 34653fd8c46e ("ubi: fastmap: Check each mapping only once") Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | mtd: ubi: Update ubi-media.h to dual licenseLionel Debieve2018-08-311-15/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Update license template using SPDX. Move the global layout of UBI headers to dual license helping UBI to be the standard solution for raw NAND management. Signed-off-by: Lionel Debieve <lionel.debieve@st.com> Acked-by: Thomas Gleixner <tglx@linutronix.de> Acked-by: Artem Bityutskiy <dedekind1@gmail.com> Acked-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed conflict] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Detect EBA mismatches on-the-flyRichard Weinberger2018-08-311-0/+17
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Now we have the machinery to detect EBA mismatches on-the-fly by comparing the in-memory volume ID and LEB number with the found VID header. This helps to detect malfunction of Fastmap. Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Check each mapping only onceRichard Weinberger2018-08-315-1/+51
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Maintain a bitmap to keep track of which LEB->PEB mapping was checked already. That way we have to read back VID headers only once. Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed Conflict] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Correctly handle interrupted erasures in EBARichard Weinberger2018-08-311-1/+87
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fastmap cannot track the LEB unmap operation, therefore it can happen that after an interrupted erasure the mapping still looks good from Fastmap's point of view, while reading from the PEB will cause an ECC error and confuses the upper layer. Instead of teaching users of UBI how to deal with that, we read back the VID header and check for errors. If the PEB is empty or shows ECC errors we fixup the mapping and schedule the PEB for erasure. Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Cc: <stable@vger.kernel.org> Reported-by: martin bayern <Martinbayern@outlook.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed compile issue] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | mtd: ubi: wl: Fix error return code in ubi_wl_init()Wei Yongjun2018-08-311-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix to return error code -ENOMEM from the kmem_cache_alloc() error handling case instead of 0, as done elsewhere in this function. Fixes: f78e5623f45b ("ubi: fastmap: Erase outdated anchor PEBs during attach") Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed conflicts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: Fix copy/paste error in function documentationSascha Hauer2018-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The function documentation of leb_write_trylock is copied from leb_write_lock. Replace the function name with the correct one. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: Fastmap: Fix typoSascha Hauer2018-08-313-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix misspelling of 'available' in function name. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed conficts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Erase outdated anchor PEBs during attachSascha Hauer2018-08-311-20/+57
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The fastmap update code might erase the current fastmap anchor PEB in case it doesn't find any new free PEB. When a power cut happens in this situation we must not have any outdated fastmap anchor PEB on the device, because that would be used to attach during next boot. The easiest way to make that sure is to erase all outdated fastmap anchor PEBs synchronously during attach. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Reviewed-by: Richard Weinberger <richard@nod.at> Fixes: dbb7d2a88d2a ("UBI: Add fastmap core") Cc: <stable@vger.kernel.org> Signed-off-by: Richard Weinberger <richard@nod.at> [Fixed conflicts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Clean up the initialization of pointer pColin Ian King2018-08-311-2/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The pointer p is being initialized with one value and a few lines later being set to a newer replacement value. Clean up the code by using the latter assignment to p as the initial value. Cleans up clang warning: drivers/mtd/ubi/fastmap.c:217:19: warning: Value stored to 'p' during its initialization is never read Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | UBI: Fix two typos in commentsUwe Kleine-König2018-08-311-2/+2
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: fix spelling mistake: "invalidiate" -> "invalidate"Colin Ian King2018-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Trivial fix to spelling mistake in ubi_err error message Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: pr_err() strings should end with newlinesBen Dooks2018-08-311-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In ubi_attach_mtd_dev() the pr_err() calls should have their messgaes terminated with a new-line to avoid other messages being concatenated onto the end. Signed-off-by: Ben Dooks <ben.dooks@codethink.co.uk> Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflics] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Fix slab corruptionRabin Vincent2018-08-311-4/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Booting with UBI fastmap and SLUB debugging enabled results in the following splats. The problem is that ubi_scan_fastmap() moves the fastmap blocks from the scan_ai (allocated in scan_fast()) to the ai allocated in ubi_attach(). This results in two problems: - When the scan_ai is freed, aebs which were allocated from its slab cache are still in use. - When the other ai is being destroyed in destroy_ai(), the arguments to kmem_cache_free() call are incorrect since aebs on its ->fastmap list were allocated with a slab cache from a differnt ai. Fix this by making a copy of the aebs in ubi_scan_fastmap() instead of moving them. ============================================================================= BUG ubi_aeb_slab_cache (Not tainted): Objects remaining in ubi_aeb_slab_cache on __kmem_cache_shutdown() ----------------------------------------------------------------------------- INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000080 CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8026c47c>] (slab_err+0x78/0x88) [<8026c47c>] (slab_err) from [<802735bc>] (__kmem_cache_shutdown+0x180/0x3e0) [<802735bc>] (__kmem_cache_shutdown) from [<8024e13c>] (shutdown_cache+0x1c/0x60) [<8024e13c>] (shutdown_cache) from [<8024ed64>] (kmem_cache_destroy+0x19c/0x20c) [<8024ed64>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) INFO: Object 0xb33d7e88 @offset=3720 INFO: Allocated in scan_peb+0x608/0x81c age=72 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c kmem_cache_destroy ubi_aeb_slab_cache: Slab cache still has objects CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8024ed80>] (kmem_cache_destroy+0x1b8/0x20c) [<8024ed80>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) cache_from_obj: Wrong slab cache. ubi_aeb_slab_cache but object is from ubi_aeb_slab_cache ------------[ cut here ]------------ WARNING: CPU: 1 PID: 118 at mm/slab.h:354 kmem_cache_free+0x39c/0x450 Modules linked in: CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80120e40>] (__warn+0xf4/0x10c) [<80120e40>] (__warn) from [<80120f20>] (warn_slowpath_null+0x28/0x30) [<80120f20>] (warn_slowpath_null) from [<80271fe0>] (kmem_cache_free+0x39c/0x450) [<80271fe0>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) ---[ end trace 2bd8396277fd0a0b ]--- ============================================================================= BUG ubi_aeb_slab_cache (Tainted: G B W ): page slab pointer corrupt. ----------------------------------------------------------------------------- INFO: Allocated in scan_peb+0x608/0x81c age=104 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000081 INFO: Object 0xb33d7e88 @offset=3720 fp=0xb33d7da0 Redzone b33d7e80: cc cc cc cc cc cc cc cc ........ Object b33d7e88: 02 00 00 00 01 00 00 00 00 f0 ff 7f ff ff ff ff ................ Object b33d7e98: 00 00 00 00 00 00 00 00 bd 16 00 00 00 00 00 00 ................ Object b33d7ea8: 00 01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 ................ Redzone b33d7eb8: cc cc cc cc .... Padding b33d7f60: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 1 PID: 118 Comm: ubiattach Tainted: G B W 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80271770>] (free_debug_processing+0x320/0x3c4) [<80271770>] (free_debug_processing) from [<80271ad0>] (__slab_free+0x2bc/0x430) [<80271ad0>] (__slab_free) from [<80272024>] (kmem_cache_free+0x3e0/0x450) [<80272024>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) FIX ubi_aeb_slab_cache: Object at 0xb33d7e88 not freed Signed-off-by: Rabin Vincent <rabinv@axis.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi/upd: Always flush after prepared for an updateSebastian Siewior2018-08-311-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In commit 6afaf8a484cb ("UBI: flush wl before clearing update marker") I managed to trigger and fix a similar bug. Now here is another version of which I assumed it wouldn't matter back then but it turns out UBI has a check for it and will error out like this: |ubi0 warning: validate_vid_hdr: inconsistent used_ebs |ubi0 error: validate_vid_hdr: inconsistent VID header at PEB 592 All you need to trigger this is? "ubiupdatevol /dev/ubi0_0 file" + a powercut in the middle of the operation. ubi_start_update() sets the update-marker and puts all EBs on the erase list. After that userland can proceed to write new data while the old EB aren't erased completely. A powercut at this point is usually not that much of a tragedy. UBI won't give read access to the static volume because it has the update marker. It will most likely set the corrupted flag because it misses some EBs. So we are all good. Unless the size of the image that has been written differs from the old image in the magnitude of at least one EB. In that case UBI will find two different values for `used_ebs' and refuse to attach the image with the error message mentioned above. So in order not to get in the situation, the patch will ensure that we wait until everything is removed before it tries to write any data. The alternative would be to detect such a case and remove all EBs at the attached time after we processed the volume-table and see the update-marker set. The patch looks bigger and I doubt it is worth it since usually the write() will wait from time to time for a new EB since usually there not that many spare EB that can be used. Cc: stable@vger.kernel.org Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | UBI: Fix typosAndrew F. Davis2018-08-313-4/+3
| | | | | | | | | | | | | | | | | | | | | Signed-off-by: Andrew F. Davis <afd@ti.com> Signed-off-by: Jiri Kosina <jkosina@suse.cz> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fastmap: Fix add_vol() return value test in ubi_attach_fastmap()Boris Brezillon2018-08-311-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit e96a8a3bb671 ("UBI: Fastmap: Do not add vol if it already exists") introduced a bug by changing the possible error codes returned by add_vol(): - this function no longer returns NULL in case of allocation failure but return ERR_PTR(-ENOMEM) - when a duplicate entry in the volume RB tree is found it returns ERR_PTR(-EEXIST) instead of ERR_PTR(-EINVAL) Fix the tests done on add_vol() return val to match this new behavior. Fixes: e96a8a3bb671 ("UBI: Fastmap: Do not add vol if it already exists") Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Acked-by: Sheng Yong <shengyong1@huawei.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | UBI: Fix crash in try_recover_peb()Geert Uytterhoeven2018-08-311-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | drivers/mtd/ubi/eba.c: In function ‘try_recover_peb’: drivers/mtd/ubi/eba.c:744: warning: ‘vid_hdr’ is used uninitialized in this function The pointer vid_hdr is indeed not initialized, leading to a crash when it is dereferenced. Fix this by obtaining the pointer from the VID buffer, like is done everywhere else. Fixes: 3291b52f9ff0acc8 ("UBI: introduce the VID buffer concept") Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: fix swapped arguments to call to ubi_alloc_aebColin Ian King2018-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Static analysis by CoverityScan detected the ec and pnum arguments are in the wrong order on a call to ubi_alloc_aeb. Swap the order to fix this. Fixes: 91f4285fe389a27 ("UBI: provide helpers to allocate and free aeb elements") Signed-off-by: Colin Ian King <colin.king@canonical.com> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: Fix Fastmap's update_vol()Richard Weinberger2018-08-311-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Usually Fastmap is free to consider every PEB in one of the pools as newer than the existing PEB. Since PEBs in a pool are by definition newer than everything else. But update_vol() missed the case that a pool can contain more than one candidate. Cc: <stable@vger.kernel.org> Fixes: dbb7d2a88d ("UBI: Add fastmap core") Signed-off-by: Richard Weinberger <richard@nod.at> Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflict] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: Fix races around ubi_refill_pools()Richard Weinberger2018-08-312-8/+11
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When writing a new Fastmap the first thing that happens is refilling the pools in memory. At this stage it is possible that new PEBs from the new pools get already claimed and written with data. If this happens before the new Fastmap data structure hits the flash and we face power cut the freshly written PEB will not scanned and unnoticed. Solve the issue by locking the pools until Fastmap is written. Cc: <stable@vger.kernel.org> Fixes: dbb7d2a88d ("UBI: Add fastmap core") Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflicts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | ubi: Deal with interrupted erasures in WLRichard Weinberger2018-08-311-2/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When Fastmap is used we can face here an -EBADMSG since Fastmap cannot know about unmaps. If the erasure was interrupted the PEB may show ECC errors and UBI would go to ro-mode as it assumes that the PEB was check during attach time, which is not the case with Fastmap. Cc: <stable@vger.kernel.org> Fixes: dbb7d2a88d ("UBI: Add fastmap core") Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflict] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | UBI: introduce the VID buffer conceptBoris Brezillon2018-08-317-142/+218
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently, all VID headers are allocated and freed using the ubi_zalloc_vid_hdr() and ubi_free_vid_hdr() function. These functions make sure to align allocation on ubi->vid_hdr_alsize and adjust the vid_hdr pointer to match the ubi->vid_hdr_shift requirements. This works fine, but is a bit convoluted. Moreover, the future introduction of LEB consolidation (needed to support MLC/TLC NANDs) will allows a VID buffer to contain more than one VID header. Hence the creation of a ubi_vid_io_buf struct to attach extra information to the VID header. We currently only store the actual pointer of the underlying buffer, but will soon add the number of VID headers contained in the buffer. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflicts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
| * | UBI: hide EBA internalsBoris Brezillon2018-08-314-50/+164
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Create a private ubi_eba_table struct to hide EBA internals and provide helpers to allocate, destroy, copy and assing an EBA table to a volume. Now that external EBA users are using helpers to query/modify the EBA state we can safely change the internal representation, which will be needed to support the LEB consolidation concept. Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com> Signed-off-by: Richard Weinberger <richard@nod.at> [Fix conflicts] Signed-off-by: Teresa Remmet <t.remmet@phytec.de> Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
generated by cgit v1.2.3 (git 2.39.1) at 2024-04-23 18:36:06 +0000