From 47016b341fc3b3fd4909e058c6fa38f165b53646 Mon Sep 17 00:00:00 2001

From: Thor Thayer <thor.thayer@linux.intel.com>

Date: Mon, 23 Apr 2018 12:45:11 -0500

Subject: [PATCH] mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic

Git-commit: 47016b341fc3b3fd4909e058c6fa38f165b53646

Patch-mainline: v4.17-rc3

References: bsc#1051510

The current Cadence QSPI driver caused a kernel panic when loading

a Root Filesystem from QSPI. The problem was caused by reading more

bytes than needed because the QSPI operated on 4 bytes at a time.

<snip>

[    7.947754] spi_nor_read[1048]:from 0x037cad74, len 1 [bfe07fff]

[    7.956247] cqspi_read[910]:offset 0x58502516, buffer=bfe07fff

[    7.956247]

[    7.966046] Unable to handle kernel paging request at virtual

address bfe08002

[    7.973239] pgd = eebfc000

[    7.975931] [bfe08002] *pgd=2fffb811, *pte=00000000, *ppte=00000000

</snip>

Notice above how only 1 byte needed to be read but by reading 4 bytes

into the end of a mapped page, an unrecoverable page fault occurred.

This patch uses a temporary buffer to hold the 4 bytes read and then

copies only the bytes required into the buffer. A min() function is

used to limit the length to prevent buffer overflows.

Request testing of this patch on other platforms. This was tested

on the Intel Arria10 SoCFPGA DevKit.

Fixes: 0cf1725676a97fc8 ("mtd: spi-nor: cqspi: Fix build on arches missing readsl/writesl")

Signed-off-by: Thor Thayer <thor.thayer@linux.intel.com>

Cc: <stable@vger.kernel.org>

Reviewed-by: Marek Vasut <marek.vasut@gmail.com>

Signed-off-by: Boris Brezillon <boris.brezillon@bootlin.com>

Acked-by: Takashi Iwai <tiwai@suse.de>

---

 drivers/mtd/spi-nor/cadence-quadspi.c |   19 +++++++++++++++++--

 1 file changed, 17 insertions(+), 2 deletions(-)

--- a/drivers/mtd/spi-nor/cadence-quadspi.c

+++ b/drivers/mtd/spi-nor/cadence-quadspi.c

@@ -495,7 +495,9 @@ static int cqspi_indirect_read_execute(s

 	void __iomem *reg_base = cqspi->iobase;

 	void __iomem *ahb_base = cqspi->ahb_base;

 	unsigned int remaining = n_rx;

+	unsigned int mod_bytes = n_rx % 4;

 	unsigned int bytes_to_read = 0;

+	u8 *rxbuf_end = rxbuf + n_rx;

 	int ret = 0;

 	writel(remaining, reg_base + CQSPI_REG_INDIRECTRDBYTES);

@@ -523,11 +525,24 @@ static int cqspi_indirect_read_execute(s

 		}

 		while (bytes_to_read != 0) {

+			unsigned int word_remain = round_down(remaining, 4);

+

 			bytes_to_read *= cqspi->fifo_width;

 			bytes_to_read = bytes_to_read > remaining ?

 					remaining : bytes_to_read;

-			ioread32_rep(ahb_base, rxbuf,

-				     DIV_ROUND_UP(bytes_to_read, 4));

+			bytes_to_read = round_down(bytes_to_read, 4);

+			/* Read 4 byte word chunks then single bytes */

+			if (bytes_to_read) {

+				ioread32_rep(ahb_base, rxbuf,

+					     (bytes_to_read / 4));

+			} else if (!word_remain && mod_bytes) {

+				unsigned int temp = ioread32(ahb_base);

+

+				bytes_to_read = mod_bytes;

+				memcpy(rxbuf, &temp, min((unsigned int)

+							 (rxbuf_end - rxbuf),

+							 bytes_to_read));

+			}

 			rxbuf += bytes_to_read;

 			remaining -= bytes_to_read;

 			bytes_to_read = cqspi_get_rd_sram_level(cqspi);