linux-stable.git/drivers/misc/eeprom, branch linux-5.17.y

eeprom: at25: Use DMA safe buffers

2022-05-09T07:16:14+00:00

commit 5b47b751b760ee1c74a51660fd096aa148a362cd upstream.

Reading EEPROM fails with following warning:

[   16.357496] ------------[ cut here ]------------
[   16.357529] fsl_spi b01004c0.spi: rejecting DMA map of vmalloc memory
[   16.357698] WARNING: CPU: 0 PID: 371 at include/linux/dma-mapping.h:326 fsl_spi_cpm_bufs+0x2a0/0x2d8
[   16.357775] CPU: 0 PID: 371 Comm: od Not tainted 5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty #109
[   16.357806] NIP:  c03fbc9c LR: c03fbc9c CTR: 00000000
[   16.357825] REGS: e68d9b20 TRAP: 0700   Not tainted  (5.16.11-s3k-dev-01743-g19beecbfe9d6-dirty)
[   16.357849] MSR:  00029032   CR: 24002282  XER: 00000000
[   16.357931]
[   16.357931] GPR00: c03fbc9c e68d9be0 c26d06a0 00000039 00000001 c0d36364 c0e96428 00000027
[   16.357931] GPR08: 00000001 00000000 00000023 3fffc000 24002282 100d3dd6 100a2ffc 00000000
[   16.357931] GPR16: 100cd280 100b0000 00000000 aff54f7e 100d0000 100d0000 00000001 100cf328
[   16.357931] GPR24: 100cf328 00000000 00000003 e68d9e30 c156b410 e67ab4c0 e68d9d38 c24ab278
[   16.358253] NIP [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8
[   16.358292] LR [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8
[   16.358325] Call Trace:
[   16.358336] [e68d9be0] [c03fbc9c] fsl_spi_cpm_bufs+0x2a0/0x2d8 (unreliable)
[   16.358388] [e68d9c00] [c03fcb44] fsl_spi_bufs.isra.0+0x94/0x1a0
[   16.358436] [e68d9c20] [c03fd970] fsl_spi_do_one_msg+0x254/0x3dc
[   16.358483] [e68d9cb0] [c03f7e50] __spi_pump_messages+0x274/0x8a4
[   16.358529] [e68d9ce0] [c03f9d30] __spi_sync+0x344/0x378
[   16.358573] [e68d9d20] [c03fb52c] spi_sync+0x34/0x60
[   16.358616] [e68d9d30] [c03b4dec] at25_ee_read+0x138/0x1a8
[   16.358667] [e68d9e50] [c04a8fb8] bin_attr_nvmem_read+0x98/0x110
[   16.358725] [e68d9e60] [c0204b14] kernfs_fop_read_iter+0xc0/0x1fc
[   16.358774] [e68d9e80] [c0168660] vfs_read+0x284/0x410
[   16.358821] [e68d9f00] [c016925c] ksys_read+0x6c/0x11c
[   16.358863] [e68d9f30] [c00160e0] ret_from_syscall+0x0/0x28
...
[   16.359608] ---[ end trace a4ce3e34afef0cb5 ]---
[   16.359638] fsl_spi b01004c0.spi: unable to map tx dma

This is due to the AT25 driver using buffers on stack, which is not
possible with CONFIG_VMAP_STACK.

As mentionned in kernel Documentation (Documentation/spi/spi-summary.rst):

  - Follow standard kernel rules, and provide DMA-safe buffers in
    your messages.  That way controller drivers using DMA aren't forced
    to make extra copies unless the hardware requires it (e.g. working
    around hardware errata that force the use of bounce buffering).

Modify the driver to use a buffer located in the at25 device structure
which is allocated via kmalloc during probe.

Protect writes in this new buffer with the driver's mutex.

Fixes: b587b13a4f67 ("[PATCH] SPI eeprom driver")
Cc: stable 
Signed-off-by: Christophe Leroy 
Link: https://lore.kernel.org/r/230a9486fc68ea0182df46255e42a51099403642.1648032613.git.christophe.leroy@csgroup.eu
Signed-off-by: Greg Kroah-Hartman

eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX

2022-02-04T15:27:44+00:00

Commit effa453168a7 ("i2c: i801: Don't silently correct invalid transfer
size") revealed that ee1004_eeprom_read() did not properly limit how
many bytes to read at once.

In particular, i2c_smbus_read_i2c_block_data_or_emulated() takes the
length to read as an u8.  If count == 256 after taking into account the
offset and page boundary, the cast to u8 overflows.  And this is common
when user space tries to read the entire EEPROM at once.

To fix it, limit each read to I2C_SMBUS_BLOCK_MAX (32) bytes, already
the maximum length i2c_smbus_read_i2c_block_data_or_emulated() allows.

Fixes: effa453168a7 ("i2c: i801: Don't silently correct invalid transfer size")
Cc: stable@vger.kernel.org
Reviewed-by: Heiner Kallweit 
Signed-off-by: Jonas Malaco 
Link: https://lore.kernel.org/r/20220203165024.47767-1-jonas@protocubo.io
Signed-off-by: Greg Kroah-Hartman

eeprom: at25: Restore missing allocation

2022-01-22T12:32:48+00:00

The at25 driver regressed in v5.17-rc1 due to a broken conflict
resolution: the allocation of the object was accidentally removed. Restore
it.

This was found when building under CONFIG_FORTIFY_SOURCE=y and
-Warray-bounds, which complained about strncpy() being used against an
empty object:

In function 'strncpy',
    inlined from 'at25_fw_to_chip.constprop' at drivers/misc/eeprom/at25.c:312:2:
./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
   48 | #define __underlying_strncpy    __builtin_strncpy
      |                                 ^
./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
   59 |         return __underlying_strncpy(p, q, size);
      |                ^~~~~~~~~~~~~~~~~~~~
In function 'strncpy',
    inlined from 'at25_fram_to_chip' at drivers/misc/eeprom/at25.c:373:2,
    inlined from 'at25_probe' at drivers/misc/eeprom/at25.c:453:10:
./include/linux/fortify-string.h:48:33: warning: '__builtin_strncpy' offset [0, 9] is out of the bounds [0, 0] [-Warray-bounds]
   48 | #define __underlying_strncpy    __builtin_strncpy
      |                                 ^
./include/linux/fortify-string.h:59:16: note: in expansion of macro '__underlying_strncpy'
   59 |         return __underlying_strncpy(p, q, size);
      |                ^~~~~~~~~~~~~~~~~~~~

Link: https://lore.kernel.org/lkml/CAHp75VdqK7h63fz-cPaQ2MGaVdaR2f1Fb5kKCZidUG3RwLsAVA@mail.gmail.com/
Fixes: af40d16042d6 ("Merge v5.15-rc5 into char-misc-next")
Cc: Arnd Bergmann 
Cc: Jiri Prchal 
Reviewed-by: Andy Shevchenko 
Signed-off-by: Kees Cook 
Link: https://lore.kernel.org/r/20220118182003.3385019-1-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman

Merge branch 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux

2022-01-14T15:19:38+00:00

Pull i2c updates from Wolfram Sang:
 "Mostly driver updates and refactorization.

  The removal of the XLR driver and the i801 refactoring stand out a
  little. In the core, we enabled async suspend/resume for I2C
  controllers and their clients. No issues were reported during the test
  phase in -next. We will see how this goes for mainline"

* 'i2c/for-mergewindow' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux: (54 commits)
  i2c: sh_mobile: remove unneeded semicolon
  i2c: riic: Use platform_get_irq() to get the interrupt
  i2c: sh_mobile: Use platform_get_irq_optional() to get the interrupt
  i2c: bcm2835: Use platform_get_irq() to get the interrupt
  i2c: aspeed: Remove unused includes
  dt-bindings: i2c: aspeed: Drop stray '#interrupt-cells'
  i2c: sh_mobile: update to new DMAENGINE API when terminating
  i2c: rcar: update to new DMAENGINE API when terminating
  i2c: exynos5: Fix getting the optional clock
  i2c: designware-pci: Convert to use dev_err_probe()
  i2c: designware-pci: use __maybe_unused for PM functions
  i2c: designware-pci: Group MODULE_*() macros
  i2c: designware-pci: Add a note about struct dw_scl_sda_cfg usage
  i2c: designware-pci: Fix to change data types of hcnt and lcnt parameters
  i2c: designware: Do not complete i2c read without RX_FULL interrupt
  eeprom: at24: Add support for 24c1025 EEPROM
  dt-bindings: at24: add at24c1025
  i2c: tegra: use i2c_timings for bus clock freq
  dt-bindings: at24: Rework special case compatible handling
  i2c: i801: Don't clear status flags twice in interrupt mode
  ...

eeprom: at24: Add support for 24c1025 EEPROM

2021-12-13T13:42:39+00:00

Microchip EEPROM 24xx1025 is like a 24c1024. The only difference
between them is that the I2C address bit used to select between the
two banks is bit 2 for the 1025 and not bit 0 as in the 1024.

Signed-off-by: Maxim Kochetkov 
Signed-off-by: Bartosz Golaszewski

Merge v5.15-rc5 into char-misc-next

2021-12-13T09:17:10+00:00

We need the fixes in here as well, and also resolve some merge conflicts
in:
	drivers/misc/eeprom/at25.c

Signed-off-by: Greg Kroah-Hartman

misc: at25: Align comment style

2021-12-03T13:26:15+00:00

Make multi-line comment style aligned.
While at it, drop filename from the file.

Acked-by: Arnd Bergmann 
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20211125213203.86693-11-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

misc: at25: Replace commas by spaces in the ID tables

2021-12-03T13:26:15+00:00

For better readability replace commas by spaces in the ID tables.

Acked-by: Arnd Bergmann 
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20211125213203.86693-10-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

misc: at25: Reorganize headers for better maintenance

2021-12-03T13:26:15+00:00

Split headers to three groups and sort alphabetically in each of them.

Acked-by: Arnd Bergmann 
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20211125213203.86693-9-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman

misc: at25: Factor out at_fram_to_chip()

2021-12-03T13:26:15+00:00

In the similar way as it's done for EEPROM, factor out
a new helper function for FRAM.

Acked-by: Arnd Bergmann 
Signed-off-by: Andy Shevchenko 
Link: https://lore.kernel.org/r/20211125213203.86693-8-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman