Hi Linus, linus.walleij@xxxxxxxxxx wrote on Fri, 20 Oct 2023 22:30:29 +0200: > Currently the offset into the device when looking for OTP > bits can go outside of the address of the MTD NOR devices, > and if that memory isn't readable, bad things happen > on the IXP4xx (added prints that illustrate the problem before > the crash): > > cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x00000100 > ixp4xx_copy_from copy from 0x00000100 to 0xc880dd78 > cfi_intelext_otp_walk walk OTP on chip 0 start at reg_prot_offset 0x12000000 > ixp4xx_copy_from copy from 0x12000000 to 0xc880dd78 > 8<--- cut here --- > Unable to handle kernel paging request at virtual address db000000 > [db000000] *pgd=00000000 > (...) > > This happens in this case because the IXP4xx is big endian and > the 32- and 16-bit fields in the struct cfi_intelext_otpinfo are not > properly byteswapped. Compare to how the code in read_pri_intelext() > byteswaps the fields in struct cfi_pri_intelext. > > Adding a small byte swapping loop for the OTP in read_pri_intelext() > and the crash goes away. > > The problem went unnoticed for many years until I enabled > CONFIG_MTD_OTP on the IXP4xx as well, triggering the bug. > > Cc: stable@xxxxxxxxxxxxxxx Would you like to add a Fixes tag as well? Or is this skipped on purpose? > Reviewed-by: Nicolas Pitre <nico@xxxxxxxxxxx> > Signed-off-by: Linus Walleij <linus.walleij@xxxxxxxxxx> > --- > ChangeLog v3->v4: > - Collected Nico's ACK. > - Stalled since june! Has this been missed? Our current organization relies on Vignesh to pick-up (or tell me to pick-up) cfi patches. But he is slightly less active these days, so if I don't get any feedback from him soon I will take it for the next merge window. Sorry for the delay anyway. Cheers, Miquèl
