lkml.org 
[lkml]   [2023]   [Oct]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v4] mtd: cfi_cmdset_0001: Byte swap OTP info
On Mon, Oct 23, 2023 at 10:25 AM Miquel Raynal
<miquel.raynal@bootlin.com> wrote:

> linus.walleij@linaro.org wrote on Fri, 20 Oct 2023 22:30:29 +0200:
>
> > Currently the offset into the device when looking for OTP
> > bits can go outside of the address of the MTD NOR devices,
> > and if that memory isn't readable, bad things happen
> > on the IXP4xx (added prints that illustrate the problem before
> > the crash):
> >
> > cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100
> > ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78
> > cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000
> > ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78
> > 8<--- cut here ---
> > Unable to handle kernel paging request at virtual address db000000
> > [db000000] *pgd=00000000
> > (...)
> >
> > This happens in this case because the IXP4xx is big endian and
> > the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not
> > properly byteswapped. Compare to how the code in read_pri_intelext()
> > byteswaps the fields in struct cfi_pri_intelext.
> >
> > Adding a small byte swapping loop for the OTP in read_pri_intelext()
> > and the crash goes away.
> >
> > The problem went unnoticed for many years until I enabled
> > CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug.
> >
> > Cc: stable@vger.kernel.org
>
> Would you like to add a Fixes tag as well? Or is this skipped on
> purpose?

Yes the actual commit predates existing git history... :/

Git blame looks like that:

^1da177e4c3f4 (Linus Torvalds 2005-04-16 15:20:36 -0700 423)
^1da177e4c3f4 (Linus Torvalds 2005-04-16 15:20:36 -0700 424)
/* Protection Register info */
b359ed5184aeb (Jean-Philippe Brucker 2020-04-17 16:23:26 +0200 425)
if (extp->NumProtectionFields)
b359ed5184aeb (Jean-Philippe Brucker 2020-04-17 16:23:26 +0200 426)
extra_size += (extp->NumProtectionFields - 1) *
b359ed5184aeb (Jean-Philippe Brucker 2020-04-17 16:23:26 +0200 427)
sizeof(struct cfi_intelext_otpinfo);

Jean-Philippe's patch is not the root cause AFAICT, but something
predating it, and predating git history.

The fix easily applies to all maintained stable kernels.

> > Reviewed-by: Nicolas Pitre <nico@fluxnic.net>
> > Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
> > ---
> > ChangeLog v3->v4:
> > - Collected Nico's ACK.
> > - Stalled since june! Has this been missed?
>
> Our current organization relies on Vignesh to pick-up (or tell me to
> pick-up) cfi patches. But he is slightly less active these days, so if I
> don't get any feedback from him soon I will take it for the next merge
> window.
>
> Sorry for the delay anyway.

No worries it's not like the patch is urgent.

Yours,
Linus Walleij

\
 
 \ /
  Last update: 2023-10-23 10:37    [W:0.114 / U:0.028 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site