In some of the 'out_not_moved' error paths, lnum may be used
uninitialized. Don't ignore the warning; let's fix it.
This uninitialized variable doesn't have much visible effect in the end,
since we just schedule the PEB for erasure, and its LEB number doesn't
really matter (it just gets printed in debug messages). But let's get it
straight anyway.
Coverity CID #113449
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
If aeb->len >= vol->reserved_pebs, we should not be writing aeb into the
PEB->LEB mapping.
Caught by Coverity, CID #711212.
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
We are completely discarding the earlier value of 'bitflips', which
could reflect a bitflip found in ubi_io_read_vid_hdr(). Let's use the
bitwise OR of header and data 'bitflip' statuses instead.
Coverity CID #1226856
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
commit 0e707ae79ba3 ("UBI: do propagate positive error codes up") seems
to have produced an unintended change in the control flow here.
Completely untested, but it looks obvious.
Caught by Coverity, which didn't like the indentation. CID 1271184.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fastmap can miss a PEB if it is in the protection queue
and not jet in the used tree.
Treat every protected PEB as used.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
UBI uses positive function return codes internally, and should not propagate
them up, except in the place this path fixes. Here is the original bug report
from Dan Carpenter:
The problem is really in ubi_eba_read_leb().
drivers/mtd/ubi/eba.c
412 err = ubi_io_read_vid_hdr(ubi, pnum, vid_hdr, 1);
413 if (err && err != UBI_IO_BITFLIPS) {
414 if (err > 0) {
415 /*
416 * The header is either absent or corrupted.
417 * The former case means there is a bug -
418 * switch to read-only mode just in case.
419 * The latter case means a real corruption - we
420 * may try to recover data. FIXME: but this is
421 * not implemented.
422 */
423 if (err == UBI_IO_BAD_HDR_EBADMSG ||
424 err == UBI_IO_BAD_HDR) {
425 ubi_warn("corrupted VID header at PEB %d, LEB %d:%d",
426 pnum, vol_id, lnum);
427 err = -EBADMSG;
428 } else
429 ubi_ro_mode(ubi);
On this path we return UBI_IO_FF and UBI_IO_FF_BITFLIPS and it
eventually gets passed to ERR_PTR(). We probably dereference the bad
pointer and oops. At that point we've gone read only so it was already
a bad situation...
430 }
431 goto out_free;
432 } else if (err == UBI_IO_BITFLIPS)
433 scrub = 1;
434
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Let's prefix UBI messages with 'ubiX' instead of 'UBI-X' - this is more
consistent with the way we name UBI devices.
Also, commit "32608703 UBI: Extend UBI layer debug/messaging capabilities"
added the function name print to 'ubi_msg()' - lets revert this change, since
these messages are supposed to be just informative messages, and not debugging
messages.
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Conflicts:
drivers/mtd/ubi/ubi.h
Fixed minor conflict.
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The logic of vfree()'ing vol->upd_buf is tied to vol->updating.
In ubi_start_update() vol->updating is set long before vmalloc()'ing
vol->upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol->upd_buf because vol->updating is set.
Fix this by allocating vol->upd_buf directly after setting vol->updating.
Fixes:
[ 31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[ 31.559340] ------------[ cut here ]------------
[ 31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[ 31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[ 31.559345] Modules linked in:
[ 31.565620] 0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[ 31.566347] ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[ 31.567073] 0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[ 31.567793] Call Trace:
[ 31.568034] [<ffffffff818f0497>] dump_stack+0x4e/0x7a
[ 31.568510] [<ffffffff8156f515>] ubi_io_write_vid_hdr+0x155/0x160
[ 31.569084] [<ffffffff8156c10a>] ubi_eba_write_leb+0x23a/0x870
[ 31.569628] [<ffffffff81569b36>] vol_cdev_write+0x226/0x380
[ 31.570155] [<ffffffff81179265>] vfs_write+0xb5/0x1f0
[ 31.570627] [<ffffffff81179f8a>] SyS_pwrite64+0x6a/0xa0
[ 31.571123] [<ffffffff818fde12>] system_call_fastpath+0x16/0x1b
Cc: <stable@vger.kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.
Cc: <stable@vger.kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Conflicts:
drivers/mtd/ubi/wl.c
Fixed small conflict.
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
This is more a cosmetic change than a fix.
By using ubi_eba_atomic_leb_change()
we can guarantee that the first VTBL record is always
correct and we don't really need the second one anymore.
But we have to keep the second one to not break anything.
Artem: add a comment
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
If there is more then one UBI device mounted, there is no way to
distinguish between messages from different UBI devices.
Add device number to all ubi layer message types.
The R/O block driver messages were replaced by pr_* since
ubi_device structure is not used by it.
Amended a bit by Artem.
Signed-off-by: Tanya Brokhman <tlinder@codeaurora.org>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Conflicts:
drivers/mtd/ubi/block.c
drivers/mtd/ubi/build.c
drivers/mtd/ubi/cdev.c
drivers/mtd/ubi/debug.c
drivers/mtd/ubi/fastmap.c
drivers/mtd/ubi/io.c
drivers/mtd/ubi/ubi.h
drivers/mtd/ubi/vmt.c
drivers/mtd/ubi/wl.c
Reworked it for barebox.
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
It confused me more than once that the cancel flag of the
work function does not indicate the cancellation of a single work.
In fact it indicates the WL sub-system shutdown and therefore
worker functions have to free their wl_entries too.
That's why you cannot cancel a single work, you can only shutdown
all works.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
There is no need to set err, it will be overwritten in any case
later at:
if (scrub)
err = ubi_wl_scrub_peb(ubi, pnum);
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
I ran into this error after a ubiupdatevol, because I forgot to backport
e9110361a9a4 UBI: fix the volumes tree sorting criteria.
UBI error: process_pool_aeb: orphaned volume in fastmap pool
UBI error: ubi_scan_fastmap: Attach by fastmap failed, doing a full scan!
kmem_cache_destroy ubi_ainf_peb_slab: Slab cache still has objects
CPU: 0 PID: 1 Comm: swapper Not tainted 3.14.18-00053-gf05cac8dbf85 #1
[<c000d298>] (unwind_backtrace) from [<c000baa8>] (show_stack+0x10/0x14)
[<c000baa8>] (show_stack) from [<c01b7a68>] (destroy_ai+0x230/0x244)
[<c01b7a68>] (destroy_ai) from [<c01b8fd4>] (ubi_attach+0x98/0x1ec)
[<c01b8fd4>] (ubi_attach) from [<c01ade90>] (ubi_attach_mtd_dev+0x2b8/0x868)
[<c01ade90>] (ubi_attach_mtd_dev) from [<c038b510>] (ubi_init+0x1dc/0x2ac)
[<c038b510>] (ubi_init) from [<c0008860>] (do_one_initcall+0x94/0x140)
[<c0008860>] (do_one_initcall) from [<c037aadc>] (kernel_init_freeable+0xe8/0x1b0)
[<c037aadc>] (kernel_init_freeable) from [<c02730ac>] (kernel_init+0x8/0xe4)
[<c02730ac>] (kernel_init) from [<c00093f0>] (ret_from_fork+0x14/0x24)
UBI: scanning is finished
Freeing the cache in the error path fixes the Slab error.
Tested on at91sam9g35 (3.14.18+fastmap backports)
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Cc: stable <stable@vger.kernel.org> # 3.10+
Use kfree instead of kmem_cache_free() for barebox.
Signed-off-by: Teresa Remmet <t.remmet@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The 'baudrate' parameter has the wrong value initially, it has to
be set to CONFIG_BAUDRATE. Otherwise a devinfo shows a baudrate of 0
until actively changed.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
drivers/of/device.c has the implementation for of_match_device(), so
also include the header which has the prototype.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The commit
commit 5e335773e0
Author: Sascha Hauer <s.hauer@pengutronix.de>
Date: Tue Mar 29 10:06:46 2016 +0200
imd: use struct imd_header * as argument
introduces additional imd type checks like this
if (!imd_is_string(imd->type))
return NULL;
These checks work incorrectly on any big-endian machine
because the imd->type field needs addition conversion
to little-endian byteorder before use.
Here is the imd command output on big-endian qemu-malta:
barebox:/ imd /dev/nor0.barebox
release: <NULL>
build: <NULL>
This patch fixes the problem by adding necessary conversion
via imd_read_type().
Signed-off-by: Antony Pavlov <antonynpavlov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: 3bd69ad driver: replace dev_request_mem_region with
dev_request_mem_resource
The driver trying to use memory resource, then IO resource.
The ALT register is optional.
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
In commit 4a7534bf07 ("reset-source: Allow different priorities") the
function name changed from reset_source_set to reset_source_set_priority.
Do that change in EXPORT_SYMBOL() accordingly.
reset_source_set still exists but is a static inline now.
Fixes: 4a7534bf07 ("reset-source: Allow different priorities")
Signed-off-by: Alexander Stein <alexander.stein@systec-electronic.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Fixes: b1374a6 usb: fastboot: drop CONFIG_COMMAND_SUPPORT dependency
The correct config option to depend on is CONFIG_COMMAND_SUPPORT,
not CONFIG_COMMAND.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
First of all the reset values of MMC interfaces are differently between
Quad and DualLite/Solo SoM.
Register VEND_SPEC2(0xC8)
Quad: 0x0
DualLite: 0x00000006
default: 0x00000006 (from i.MX6 Reference Manual)
Furthermore the ROM Code of Quad and DualLite uses the MMC interfaces
differently when it loads the bootloader from that device:
Register DLL_CTRL(0x60) Bit 25 FBCLK_SEL (0x48)
Quad: 0x0 0
DualLite: 0x01000021 1
Since the linux kernel and barebox driver doesn't reset all registers,
the MMC interface is in an inconsistent state, which leads to boot
failures for some eMMC devices on the i.MX6 DualLite SoM. The errors
look like:
mmcblk3: error -110 sending stop command, original cmd response 0x900, card status 0x400900
mmcblk3: error -84 transferring data, sector 24578, nr 2, cmd response 0x900, card status 0x0
mmcblk3: retrying using single block read
mmcblk3: error -84 transferring data, sector 24578, nr 2, cmd response 0x900, card status 0x0
blk_update_request: I/O error, dev mmcblk3, sector 24578
It's sufficient to reset register DLL_CTRL and bit FBCLK_SEL. Register
VEND_SPEC2 has no effect.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Some network devices, especially when connected to a switch, are
connected via a fixed link. This patch adds support for a fixed phy
configured through device tree.
TODO: Add support for the "speed" and "full-duplex" properties.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Tested-by: Wjatscheslaw Stoljarski <wjatscheslaw.stoljarski@kiwigrid.com>
For the phyCORE-i.MX6 add an automount command for the first partition
on the eMMC device.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The bootm code now can handle the adding of the root= option itself,
so drop the code and let bootm do it.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
It becomes a common case that the Kernel is loaded from the filesystem
which later becomes the rootfs. This adds a possibility to let bootm
automatically append the root= option to the kernel command line. This
is done when global.bootm.appendroot is true.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The settings in GPR8 are dependent upon the particular layout of the
hardware platform. As such, they should be configurable via the device
tree.
Look up PHY Tx driver settings from the device tree. Fall back to the
original hard-coded values if they are not specified in the device tree.
[Andrey Smirnov: port to Barebox codebase]
Signed-off-by: Justin Waters <justin.waters@timesys.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Acked-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Remove the remnants of the workaround for erratum ERR005184 which was never
completely implemented. The checks alone don't carry any value as we don't
act properly on the result.
A workaround should be added to the lane speed change in establish_link
later.
[Andrey Smirnov: port to Barebox codebase]
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
This adds the PHY reset into a common error path of
imx6_pcie_establish_link(), deduplicating some of the debug prints. Also
reduce the severity of the "no-link" message in the one place where it is
expected to be hit when no peripheral is attached.
[Andrey Smirnov: port to Barebox codebase]
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Enable NOR for phyCORE-i.MX6 DualLite and Quad eMMC variants.
Furthermore add an extra 'status = "disabled"' in the flash node. It
has no functional effect, because the SPI bus node 'ecspi1' is disabled,
too.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Some phyCORE-i.MX6 variants have eMMC instead of a NAND chip. Provide an
update_handler for them.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
The extra environment folder for the phyCORE-i.MX6 had the suffix
'-mira'. That's the name of a baseboard. Since the bootloader is generic
for all baseboards, use a generic suffix for the environment folder.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Update RAM calibration values in the flashheader file for phyCORE-i.MX6
DualLite/Solo. These are verified and tested in the climatic chamber for
commercial, extended commercial, industrial and automotive i.MX6
variants.
Signed-off-by: Stefan Christ <s.christ@phytec.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Brian Norris
Richard Weinberger
Artem Bityutskiy
Tanya Brokhman
Richard Genoud
Sascha Hauer
Antony Pavlov
Alexander Shiyan
Stefan Christ
Alexander Stein
Andrey Smirnov