From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from softlayer.compulab.co.il ([50.23.254.55]:44151 "EHLO compulab.co.il" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751267AbbLJI2t (ORCPT ); Thu, 10 Dec 2015 03:28:49 -0500 Received: from [82.166.188.245] (port=35563 helo=zimbra-mta.compulab.co.il) by softlayer.compulab.co.il with esmtp (Exim 4.86) (envelope-from ) id 1a6wam-0004B6-Iu for stable@vger.kernel.org; Thu, 10 Dec 2015 10:28:48 +0200 Received: from localhost (localhost [127.0.0.1]) by zimbra-mta.compulab.co.il (Postfix) with ESMTP id CC3FF4851CC for ; Thu, 10 Dec 2015 10:28:47 +0200 (IST) Subject: Re: [PATCH v2] wlcore/wl12xx: spi: fix oops on firmware load To: igor.grinberg@compulab.co.il References: <1449733086-17060-1-git-send-email-uri.mashiach@compulab.co.il> Cc: stable@vger.kernel.org From: Uri Mashiach Message-ID: <566937BE.5090100@compulab.co.il> Date: Thu, 10 Dec 2015 10:28:46 +0200 MIME-Version: 1.0 In-Reply-To: <1449733086-17060-1-git-send-email-uri.mashiach@compulab.co.il> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit Sender: stable-owner@vger.kernel.org List-ID: Sorry, sent out by mistake. On 12/10/2015 09:38 AM, Uri Mashiach wrote: > The maximum chunks used by the function is > (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE + 1). > The original commands array had space for > (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) commands. > When the last chunk is used (len > 4 * WSPI_MAX_CHUNK_SIZE), the last > command is stored outside the bounds of the commands array. > > Oops 5 (page fault) is generated during current wl1271 firmware load > attempt: > > root@debian-armhf:~# ifconfig wlan0 up > [ 294.312399] Unable to handle kernel paging request at virtual address > 00203fc4 > [ 294.320173] pgd = de528000 > [ 294.323028] [00203fc4] *pgd=00000000 > [ 294.326916] Internal error: Oops: 5 [#1] SMP ARM > [ 294.331789] Modules linked in: bnep rfcomm bluetooth ipv6 arc4 wl12xx > wlcore mac80211 musb_dsps cfg80211 musb_hdrc usbcore usb_common > wlcore_spi omap_rng rng_core musb_am335x omap_wdt cpufreq_dt thermal_sys > hwmon > [ 294.351838] CPU: 0 PID: 1827 Comm: ifconfig Not tainted > 4.2.0-00002-g3e9ad27-dirty #78 > [ 294.360154] Hardware name: Generic AM33XX (Flattened Device Tree) > [ 294.366557] task: dc9d6d40 ti: de550000 task.ti: de550000 > [ 294.372236] PC is at __spi_validate+0xa8/0x2ac > [ 294.376902] LR is at __spi_sync+0x78/0x210 > [ 294.381200] pc : [] lr : [] psr: 60000013 > [ 294.381200] sp : de551998 ip : de5519d8 fp : 00200000 > [ 294.393242] r10: de551c8c r9 : de5519d8 r8 : de3a9000 > [ 294.398730] r7 : de3a9258 r6 : de3a9400 r5 : de551a48 r4 : > 00203fbc > [ 294.405577] r3 : 00000000 r2 : 00000000 r1 : 00000000 r0 : > de3a9000 > [ 294.412420] Flags: nZCv IRQs on FIQs on Mode SVC_32 ISA ARM > Segment user > [ 294.419918] Control: 10c5387d Table: 9e528019 DAC: 00000015 > [ 294.425954] Process ifconfig (pid: 1827, stack limit = 0xde550218) > [ 294.432437] Stack: (0xde551998 to 0xde552000) > > ... > > [ 294.883613] [] (__spi_validate) from [] > (__spi_sync+0x78/0x210) > [ 294.891670] [] (__spi_sync) from [] > (wl12xx_spi_raw_write+0xfc/0x148 [wlcore_spi]) > [ 294.901661] [] (wl12xx_spi_raw_write [wlcore_spi]) from > [] (wlcore_boot_upload_firmware+0x1ec/0x458 [wlcore]) > [ 294.914038] [] (wlcore_boot_upload_firmware [wlcore]) from > [] (wl12xx_boot+0xc10/0xfac [wl12xx]) > [ 294.925161] [] (wl12xx_boot [wl12xx]) from [] > (wl1271_op_add_interface+0x5b0/0x910 [wlcore]) > [ 294.936364] [] (wl1271_op_add_interface [wlcore]) from > [] (ieee80211_do_open+0x44c/0xf7c [mac80211]) > [ 294.947963] [] (ieee80211_do_open [mac80211]) from > [] (__dev_open+0xa8/0x110) > [ 294.957307] [] (__dev_open) from [] > (__dev_change_flags+0x88/0x148) > [ 294.965713] [] (__dev_change_flags) from [] > (dev_change_flags+0x18/0x48) > [ 294.974576] [] (dev_change_flags) from [] > (devinet_ioctl+0x6b4/0x7d0) > [ 294.983191] [] (devinet_ioctl) from [] > (sock_ioctl+0x1e4/0x2bc) > [ 294.991244] [] (sock_ioctl) from [] > (do_vfs_ioctl+0x420/0x6b0) > [ 294.999208] [] (do_vfs_ioctl) from [] > (SyS_ioctl+0x6c/0x7c) > [ 295.006880] [] (SyS_ioctl) from [] > (ret_fast_syscall+0x0/0x54) > [ 295.014835] Code: e1550004 e2444034 0a00007d e5953018 (e5942008) > [ 295.021544] ---[ end trace 66ed188198f4e24e ]--- > > Signed-off-by: Uri Mashiach > Acked-by: Igor Grinberg > Cc: stable@vger.kernel.org > --- > v1 -> v2: patch apply verification was made into the wireless trees: > wireless-drivers-next wireless-drivers > > drivers/net/wireless/ti/wlcore/spi.c | 10 +++++++--- > 1 file changed, 7 insertions(+), 3 deletions(-) > > diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c > index f1ac283..720e4e4 100644 > --- a/drivers/net/wireless/ti/wlcore/spi.c > +++ b/drivers/net/wireless/ti/wlcore/spi.c > @@ -73,7 +73,10 @@ > */ > #define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) > > -#define WSPI_MAX_NUM_OF_CHUNKS (SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) > +/* Maximum number of SPI write chunks */ > +#define WSPI_MAX_NUM_OF_CHUNKS \ > + ((SPI_AGGR_BUFFER_SIZE / WSPI_MAX_CHUNK_SIZE) + 1) > + > > struct wl12xx_spi_glue { > struct device *dev; > @@ -268,9 +271,10 @@ static int __must_check wl12xx_spi_raw_write(struct device *child, int addr, > void *buf, size_t len, bool fixed) > { > struct wl12xx_spi_glue *glue = dev_get_drvdata(child->parent); > - struct spi_transfer t[2 * (WSPI_MAX_NUM_OF_CHUNKS + 1)]; > + /* SPI write buffers - 2 for each chunk */ > + struct spi_transfer t[2 * WSPI_MAX_NUM_OF_CHUNKS]; > struct spi_message m; > - u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; > + u32 commands[WSPI_MAX_NUM_OF_CHUNKS]; /* 1 command per chunk */ > u32 *cmd; > u32 chunk_len; > int i; > -- Regards, Uri