Ajesh Kunhipurayil Vijayan
a60ac5cab1
jffs2: Fix crash due to truncation of csize
...
mounting JFFS2 partition sometimes crashes with this call trace:
[ 1322.240000] Kernel bug detected[#1 ]:
[ 1322.244000] Cpu 2
[ 1322.244000] $ 0 : 0000000000000000 0000000000000018 000000003ff00070 0000000000000001
[ 1322.252000] $ 4 : 0000000000000000 c0000000f3980150 0000000000000000 0000000000010000
[ 1322.260000] $ 8 : ffffffffc09cd5f8 0000000000000001 0000000000000088 c0000000ed300de8
[ 1322.268000] $12 : e5e19d9c5f613a45 ffffffffc046d464 0000000000000000 66227ba5ea67b74e
[ 1322.276000] $16 : c0000000f1769c00 c0000000ed1e0200 c0000000f3980150 0000000000000000
[ 1322.284000] $20 : c0000000f3a80000 00000000fffffffc c0000000ed2cfbd8 c0000000f39818f0
[ 1322.292000] $24 : 0000000000000004 0000000000000000
[ 1322.300000] $28 : c0000000ed2c0000 c0000000ed2cfab8 0000000000010000 ffffffffc039c0b0
[ 1322.308000] Hi : 000000000000023c
[ 1322.312000] Lo : 000000000003f802
[ 1322.316000] epc : ffffffffc039a9f8 check_tn_node+0x88/0x3b0
[ 1322.320000] Not tainted
[ 1322.324000] ra : ffffffffc039c0b0 jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.332000] Status: 5400f8e3 KX SX UX KERNEL EXL IE
[ 1322.336000] Cause : 00800034
[ 1322.340000] PrId : 000c1004 (Netlogic XLP)
[ 1322.344000] Modules linked in:
[ 1322.348000] Process jffs2_gcd_mtd7 (pid: 264, threadinfo=c0000000ed2c0000, task=c0000000f0e68dd8, tls=0000000000000000)
[ 1322.356000] Stack : c0000000f1769e30 c0000000ed010780 c0000000ed010780 c0000000ed300000
c0000000f1769c00 c0000000f3980150 c0000000f3a80000 00000000fffffffc
c0000000ed2cfbd8 ffffffffc039c0b0 ffffffffc09c6340 0000000000001000
0000000000000dec ffffffffc016c9d8 c0000000f39805a0 c0000000f3980180
0000008600000000 0000000000000000 0000000000000000 0000000000000000
0001000000000dec c0000000f1769d98 c0000000ed2cfb18 0000000000010000
0000000000010000 0000000000000044 c0000000f3a80000 c0000000f1769c00
c0000000f3d207a8 c0000000f1769d98 c0000000f1769de0 ffffffffc076f9c0
0000000000000009 0000000000000000 0000000000000000 ffffffffc039cf90
0000000000000017 ffffffffc013fbdc 0000000000000001 000000010003e61c
...
[ 1322.424000] Call Trace:
[ 1322.428000] [<ffffffffc039a9f8>] check_tn_node+0x88/0x3b0
[ 1322.432000] [<ffffffffc039c0b0>] jffs2_do_read_inode_internal+0x1250/0x1e48
[ 1322.440000] [<ffffffffc039cf90>] jffs2_do_crccheck_inode+0x70/0xd0
[ 1322.448000] [<ffffffffc03a1b80>] jffs2_garbage_collect_pass+0x160/0x870
[ 1322.452000] [<ffffffffc03a392c>] jffs2_garbage_collect_thread+0xdc/0x1f0
[ 1322.460000] [<ffffffffc01541c8>] kthread+0xb8/0xc0
[ 1322.464000] [<ffffffffc0106d18>] kernel_thread_helper+0x10/0x18
[ 1322.472000]
[ 1322.472000]
Code: 67bd0050 94a4002c 2c830001 <00038036> de050218 2403fffc 0080a82d 00431824 24630044
[ 1322.480000] ---[ end trace b052bb90e97dfbf5 ]---
The variable csize in structure jffs2_tmp_dnode_info is of type uint16_t, but it
is used to hold the compressed data length(csize) which is declared as uint32_t.
So, when the value of csize exceeds 16bits, it gets truncated when assigned to
tn->csize. This is causing a kernel BUG.
Changing the definition of csize in jffs2_tmp_dnode_info to uint32_t fixes the issue.
Signed-off-by: Ajesh Kunhipurayil Vijayan <ajesh@broadcom.com >
Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Brian Norris <computersforpeace@gmail.com >
2018-07-16 07:22:12 +02:00
Kamlakant Patel
03cba49d2a
jffs2: Fix segmentation fault found in stress test
...
Creating a large file on a JFFS2 partition sometimes crashes with this call
trace:
[ 306.476000] CPU 13 Unable to handle kernel paging request at virtual address c0000000dfff8002, epc == ffffffffc03a80a8, ra == ffffffffc03a8044
[ 306.488000] Oops[#1 ]:
[ 306.488000] Cpu 13
[ 306.492000] $ 0 : 0000000000000000 0000000000000000 0000000000008008 0000000000008007
[ 306.500000] $ 4 : c0000000dfff8002 000000000000009f c0000000e0007cde c0000000ee95fa58
[ 306.508000] $ 8 : 0000000000000001 0000000000008008 0000000000010000 ffffffffffff8002
[ 306.516000] $12 : 0000000000007fa9 000000000000ff0e 000000000000ff0f 80e55930aebb92bb
[ 306.524000] $16 : c0000000e0000000 c0000000ee95fa5c c0000000efc80000 ffffffffc09edd70
[ 306.532000] $20 : ffffffffc2b60000 c0000000ee95fa58 0000000000000000 c0000000efc80000
[ 306.540000] $24 : 0000000000000000 0000000000000004
[ 306.548000] $28 : c0000000ee950000 c0000000ee95f738 0000000000000000 ffffffffc03a8044
[ 306.556000] Hi : 00000000000574a5
[ 306.560000] Lo : 6193b7a7e903d8c9
[ 306.564000] epc : ffffffffc03a80a8 jffs2_rtime_compress+0x98/0x198
[ 306.568000] Tainted: G W
[ 306.572000] ra : ffffffffc03a8044 jffs2_rtime_compress+0x34/0x198
[ 306.580000] Status: 5000f8e3 KX SX UX KERNEL EXL IE
[ 306.584000] Cause : 00800008
[ 306.588000] BadVA : c0000000dfff8002
[ 306.592000] PrId : 000c1100 (Netlogic XLP)
[ 306.596000] Modules linked in:
[ 306.596000] Process dd (pid: 170, threadinfo=c0000000ee950000, task=c0000000ee6e0858, tls=0000000000c47490)
[ 306.608000] Stack : 7c547f377ddc7ee4 7ffc7f967f5d7fae 7f617f507fc37ff4 7e7d7f817f487f5f
7d8e7fec7ee87eb3 7e977ff27eec7f9e 7d677ec67f917f67 7f3d7e457f017ed7
7fd37f517f867eb2 7fed7fd17ca57e1d 7e5f7fe87f257f77 7fd77f0d7ede7fdb
7fba7fef7e197f99 7fde7fe07ee37eb5 7f5c7f8c7fc67f65 7f457fb87f847e93
7f737f3e7d137cd9 7f8e7e9c7fc47d25 7dbb7fac7fb67e52 7ff17f627da97f64
7f6b7df77ffa7ec5 80057ef17f357fb3 7f767fa27dfc7fd5 7fe37e8e7fd07e53
7e227fcf7efb7fa1 7f547e787fa87fcc 7fcb7fc57f5a7ffb 7fc07f6c7ea97e80
7e2d7ed17e587ee0 7fb17f9d7feb7f31 7f607e797e887faa 7f757fdd7c607ff3
7e877e657ef37fbd 7ec17fd67fe67ff7 7ff67f797ff87dc4 7eef7f3a7c337fa6
7fe57fc97ed87f4b 7ebe7f097f0b8003 7fe97e2a7d997cba 7f587f987f3c7fa9
...
[ 306.676000] Call Trace:
[ 306.680000] [<ffffffffc03a80a8>] jffs2_rtime_compress+0x98/0x198
[ 306.684000] [<ffffffffc0394f10>] jffs2_selected_compress+0x110/0x230
[ 306.692000] [<ffffffffc039508c>] jffs2_compress+0x5c/0x388
[ 306.696000] [<ffffffffc039dc58>] jffs2_write_inode_range+0xd8/0x388
[ 306.704000] [<ffffffffc03971bc>] jffs2_write_end+0x16c/0x2d0
[ 306.708000] [<ffffffffc01d3d90>] generic_file_buffered_write+0xf8/0x2b8
[ 306.716000] [<ffffffffc01d4e7c>] __generic_file_aio_write+0x1ac/0x350
[ 306.720000] [<ffffffffc01d50a0>] generic_file_aio_write+0x80/0x168
[ 306.728000] [<ffffffffc021f7dc>] do_sync_write+0x94/0xf8
[ 306.732000] [<ffffffffc021ff6c>] vfs_write+0xa4/0x1a0
[ 306.736000] [<ffffffffc02202e8>] SyS_write+0x50/0x90
[ 306.744000] [<ffffffffc0116cc0>] handle_sys+0x180/0x1a0
[ 306.748000]
[ 306.748000]
Code: 020b202d 0205282d 90a50000 <90840000> 14a40038 00000000 0060602d 0000282d 016c5823
[ 306.760000] ---[ end trace 79dd088435be02d0 ]---
Segmentation fault
This crash is caused because the 'positions' is declared as an array of signed
short. The value of position is in the range 0..65535, and will be converted
to a negative number when the position is greater than 32767 and causes a
corruption and crash. Changing the definition to 'unsigned short' fixes this
issue
Signed-off-by: Jayachandran C <jchandra@broadcom.com >
Signed-off-by: Kamlakant Patel <kamlakant.patel@broadcom.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Brian Norris <computersforpeace@gmail.com >
2018-07-16 07:22:11 +02:00
Li Zefan
d60c166556
jffs2: avoid soft-lockup in jffs2_reserve_space_gc()
...
We triggered soft-lockup under stress test on 2.6.34 kernel.
BUG: soft lockup - CPU#1 stuck for 60009ms! [lockf2.test:14488]
...
[<bf09a4d4>] (jffs2_do_reserve_space+0x420/0x440 [jffs2])
[<bf09a528>] (jffs2_reserve_space_gc+0x34/0x78 [jffs2])
[<bf0a1350>] (jffs2_garbage_collect_dnode.isra.3+0x264/0x478 [jffs2])
[<bf0a2078>] (jffs2_garbage_collect_pass+0x9c0/0xe4c [jffs2])
[<bf09a670>] (jffs2_reserve_space+0x104/0x2a8 [jffs2])
[<bf09dc48>] (jffs2_write_inode_range+0x5c/0x4d4 [jffs2])
[<bf097d8c>] (jffs2_write_end+0x198/0x2c0 [jffs2])
[<c00e00a4>] (generic_file_buffered_write+0x158/0x200)
[<c00e14f4>] (__generic_file_aio_write+0x3a4/0x414)
[<c00e15c0>] (generic_file_aio_write+0x5c/0xbc)
[<c012334c>] (do_sync_write+0x98/0xd4)
[<c0123a84>] (vfs_write+0xa8/0x150)
[<c0123d74>] (sys_write+0x3c/0xc0)]
Fix this by adding a cond_resched() in the while loop.
[akpm@linux-foundation.org: don't initialize `ret']
Signed-off-by: Li Zefan <lizefan@huawei.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
2018-07-16 07:22:11 +02:00
Li Zefan
52c50c7854
jffs2: remove from wait queue after schedule()
...
@wait is a local variable, so if we don't remove it from the wait queue
list, later wake_up() may end up accessing invalid memory.
This was spotted by eyes.
Signed-off-by: Li Zefan <lizefan@huawei.com >
Cc: David Woodhouse <dwmw2@infradead.org >
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com >
Cc: <stable@vger.kernel.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Brian Norris <computersforpeace@gmail.com >
2018-07-16 07:22:11 +02:00
Christoph Hellwig
e650f4fc30
jffs2: use generic posix ACL infrastructure
...
Also don't bother to set up a .get_acl method for symlinks as we do not
support access control (ACLs or even mode bits) for symlinks in Linux.
Signed-off-by: Christoph Hellwig <hch@lst.de >
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk >
2018-07-16 07:22:11 +02:00
Cody P Schafer
1465e70c17
fs/jffs2: use rbtree postorder iteration helper instead of opencoding
...
Use rbtree_postorder_for_each_entry_safe() to destroy the rbtree instead
of opencoding an alternate postorder iteration that modifies the tree
Signed-off-by: Cody P Schafer <cody@linux.vnet.ibm.com >
Cc: Michel Lespinasse <walken@google.com >
Cc: Jan Kara <jack@suse.cz >
Cc: David Woodhouse <dwmw2@infradead.org >
Signed-off-by: Andrew Morton <akpm@linux-foundation.org >
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2018-07-16 07:22:11 +02:00
Sebastian Huber
22d9575fd0
linux: Add rbtree_postorder_for_each_entry_safe()
...
Update #3465 .
2018-07-16 07:22:11 +02:00
Sebastian Huber
0cb425704b
linux: Simplify <linux/rbtree.h>
...
Remove the placeholder struct rb_node and use RBTree_Node directly via
some C pre-processor defines to adjust the member names.
Update #3465 .
2018-07-16 07:22:11 +02:00
Sebastian Huber
877aeab6d2
linux: Install <linux/rbtree.h>
...
This makes it possible to test this API.
Update #3465 .
2018-07-16 07:22:11 +02:00
Sebastian Huber
6539beab82
score: Add postorder tree iteration support
...
Update #3465 .
2018-07-16 07:22:06 +02:00
Amaan Cheval
cf811a4eb2
x86_64/console: Add NS16550 polled console driver
...
This addition allows us to successfully run the sample hello.exe test.
Updates #2898 .
2018-07-11 15:23:43 -05:00
Amaan Cheval
76c03152e1
bsp/x86_64: Minimal bootable BSP
...
Current state:
- Basic context initialization and switching code.
- Stubbed console (empty functions).
- Mostly functional linker script (may need tweaks if we ever want to move
away from the large code model (see: CPU_CFLAGS).
- Fully functional boot, by using FreeBSD's bootloader to load RTEMS's ELF for
UEFI-awareness.
In short, the current state with this commit lets us boot, go through the system
initialization functions, and then call user application's Init task too.
Updates #2898 .
2018-07-11 15:22:44 -05:00
Sebastian Huber
1a192398bf
bsp/riscv: Add console support for NS16550 devices
...
Update #3433 .
2018-07-06 14:27:39 +02:00
Sebastian Huber
31f90a2ff4
bsp/riscv: Simplify printk() support
...
This is a prepartion to add NS16550 driver support to the console
driver.
Update #3433 .
2018-07-06 14:27:29 +02:00
Sebastian Huber
bca36d986b
riscv: Add LADDR assembler define
...
An address must be loaded to a register according to the code model.
Add LADDR define for use in assembler code.
Update #3433 .
2018-07-06 13:46:46 +02:00
Sebastian Huber
dd32e2b2d0
riscv: Implement CPU counter
...
Update #3433 .
2018-07-06 13:46:46 +02:00
Sebastian Huber
6418c91d5a
Update config.guess and config.sub
...
Update via:
wget -O config.guess 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.guess;hb=HEAD '
wget -O config.sub 'https://git.savannah.gnu.org/gitweb/?p=config.git;a=blob_plain;f=config.sub;hb=HEAD '
Update #3433 .
2018-07-06 10:06:02 +02:00
Sebastian Huber
fc5cc9af10
bsps/arm: Include missing header file
2018-07-05 08:54:57 +02:00
Sebastian Huber
d3dff40e5e
bsps: Update headers.am
2018-07-05 07:26:49 +02:00
Sebastian Huber
e755782bde
riscv: Clear reservations
...
See also RISC-V User-Level ISA V2.3, comment in section 8.2
"Load-Reserved/Store-Conditional Instructions".
Update #3433 .
2018-07-05 07:12:24 +02:00
Sebastian Huber
77fbbd620f
posix: Check for new <pthread.h> prototypes
...
Update #3342 .
Update #3343 .
2018-07-05 07:10:04 +02:00
Sebastian Huber
e07b51a710
riscv: Fix fcsr initialization
...
Update #3433 .
2018-07-02 15:21:36 +02:00
Sebastian Huber
b36bf5bda8
score: Increase PER_CPU_CONTROL_SIZE_APPROX
...
Increase the PER_CPU_CONTROL_SIZE_APPROX on 64-bit targets.
Update #3433 .
2018-06-29 12:55:28 +02:00
Sebastian Huber
79d69aef54
riscv: Fix SMP context switch support
...
Update #3433 .
2018-06-29 12:08:16 +02:00
Sebastian Huber
109bc1c74b
riscv: Add SMP context switch support
...
Update #3433 .
2018-06-29 10:04:38 +02:00
Sebastian Huber
52352387cc
riscv: Add floating-point support
...
Update #3433 .
2018-06-29 10:04:38 +02:00
Sebastian Huber
995e91e847
riscv: Fix global construction
...
Update #3433 .
2018-06-29 10:04:38 +02:00
Sebastian Huber
694e79a0b7
riscv: Add TLS support
...
Update #3433 .
2018-06-29 10:04:38 +02:00
Sebastian Huber
afb60eb183
riscv: Remove dead code
...
Update #3433 .
2018-06-29 10:04:38 +02:00
Sebastian Huber
e43994dfbb
riscv: Optimize context switch and interrupts
...
Save/restore non-volatile registers in _CPU_Context_switch().
Save/restore volatile registers in _ISR_Handler().
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
a8188730bf
riscv: Fix _CPU_Context_Initialize() prototype
...
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
dffc08c0e9
riscv: Fix interrupt save/restore
...
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
40f81ce634
riscv: Implement _CPU_Context_validate()
...
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
71af1a4bb2
riscv: Make some CPU port defines visible to asm
...
Move SREG and LREG assembler defines to <rtems/score/asm.h>.
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
8f035cb85a
riscv: Implement _CPU_Context_volatile_clobber()
...
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
b706b4a3c0
riscv: Remove mstatus from thread context
...
The mstatus register contains no thread-specific state which must be
saved/restored during a context switch. Machine interrupts (MIE) must
be enabled during a context switch.
Create separate CPU_Interrupt_frame structure.
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
2987c4f27a
riscv: Remove x8 initialization
...
The RISC-V psABI
https://github.com/riscv/riscv-elf-psabi-doc/blob/master/riscv-elf.md
does not mention that this is a frame pointer.
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
04698ebd49
riscv: Properly align the thread stack
...
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
a49a3c8eed
riscv: Do not clear thread context
...
Do not clear the complete thread context. Initialize only the necessary
members. The Context_Control::is_executing member must be preserved
across _CPU_Context_Initialize() calls.
Update #3433 .
2018-06-29 10:04:37 +02:00
Sebastian Huber
9510742e7f
riscv: Fix CPU_STACK_ALIGNMENT
...
According to the RISC-V psABI
https://github.com/riscv/riscv-elf-psabi-doc/blob/master/riscv-elf.md
the stack alignment is 128 bits (16 bytes).
Update #3433 .
2018-06-29 10:04:36 +02:00
Sebastian Huber
98f051efed
riscv: Remove RISCV_GCC_RED_ZONE_SIZE
...
The current ABI says that there is no stack red zone:
https://github.com/riscv/riscv-elf-psabi-doc/blob/master/riscv-elf.md
"Procedures must not rely upon the persistence of stack-allocated data
whose addresses lie below the stack pointer."
Update #3433 .
2018-06-29 10:04:36 +02:00
Sebastian Huber
9704d86f86
riscv: Enable interrupts during dispatch after ISR
...
The code sequence is derived from the ARM code
(see _ARMV4_Exception_interrupt).
Update #2751 .
Update #3433 .
2018-06-29 10:04:32 +02:00
Sebastian Huber
0fd8287b2b
riscv: Add _CPU_Get_current_per_CPU_control()
...
Update #3433 .
2018-06-28 15:03:23 +02:00
Sebastian Huber
3be4478f5a
riscv: Avoid namespace pollution
...
Remove <rtems/score/riscv-utility.h> include from <rtems/score/cpu.h>
(which is visible via <rtems.h> for example).
Update #3433 .
2018-06-28 15:03:23 +02:00
Sebastian Huber
bc3bdf2438
riscv: Optimize and fix interrupt disable/enable
...
Use the atomic read and clear operation to disable interrupts.
Do not write the complete mstatus. Instead, set only the MIE bit
depending on the level parameter.
Update #3433 .
2018-06-28 15:03:20 +02:00
Sebastian Huber
ff7b10479b
bsp/riscv: Remove bsp_interrupt_handler_default()
...
It duplicated the default implementation.
Update #3433 .
2018-06-28 15:03:19 +02:00
Sebastian Huber
cdfed94f34
bsp/riscv: Rework clock driver
...
Use device tree provided timebase frequency. Do not write to read-only
mtime register.
Update #3433 .
2018-06-28 15:03:19 +02:00
Sebastian Huber
1232cd4690
bsp/riscv: Add device tree support for console
...
Update #3433 .
2018-06-28 15:02:13 +02:00
Sebastian Huber
c558cc4b00
bsp/riscv: Fix vector table for lp64
...
Update #3433 .
2018-06-28 15:02:13 +02:00
Sebastian Huber
5f5c450aa4
bsp/riscv: Add SMP startup synchronization
...
Update #3433 .
2018-06-28 15:02:13 +02:00