Re: [PATCH] eeprom: at25: convert to spi-mem API

From: Christophe Leroy
Date: Mon Nov 03 2025 - 17:20:14 EST

Next message: Marc Zyngier: "Re: [PATCH v4 1/3] KVM: arm64: VM exit to userspace to handle SEA"
Previous message: Bjorn Helgaas: "[PATCH] PCI: meson: Remove meson_pcie_link_up() timeout, message, speed check"
In reply to: Sverdlin, Alexander: "Re: [PATCH] eeprom: at25: convert to spi-mem API"
Next in thread: Sverdlin, Alexander: "Re: [PATCH] eeprom: at25: convert to spi-mem API"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Le 03/11/2025 à 20:12, Sverdlin, Alexander a écrit :

[Vous ne recevez pas souvent de courriers de alexander.sverdlin@xxxxxxxxxxx. Découvrez pourquoi ceci est important à https://aka.ms/LearnAboutSenderIdentification ]

Hi Christophe,

On Mon, 2025-11-03 at 17:33 +0100, Christophe Leroy wrote:

Replace the RAW SPI accesses with spi-mem API. The latter will fall back to
RAW SPI accesses if spi-mem callbacks are not implemented by a controller
driver.

With this patch (kernel v6.17.1) our powerpc boards are totally
unstable, we get multiple random Oops due to bad memory accesses.

With this commit reverted the board is stable again.

The SPI driver is:

CONFIG_SPI=y
CONFIG_SPI_MASTER=y
CONFIG_SPI_MEM=y
CONFIG_SPI_FSL_LIB=y
CONFIG_SPI_FSL_CPM=y
CONFIG_SPI_FSL_SPI=y

How can we further investigate the issue ?

could you share these "random Oops"?

Sure. At the first place they look unrelated. Something is likely writing in the weed.

Looks like spi-fsl-spi doesn't support spi-mem interface (similar to spi-fsl-lpspi
we use the patch with), so spi-mem falls back to the regular SPI. From this standpoint
it's not that much different from the situation before patch.

But let's look into the splats.

First one:

[ 27.112241] Kernel attempted to read user page (7f) - exploit attempt? (uid: 0)
[ 27.119739] BUG: Kernel NULL pointer dereference on read at 0x0000007f
[ 27.126181] Faulting instruction address: 0xc01af5fc
[ 27.131093] Oops: Kernel access of bad area, sig: 11 [#2]
[ 27.136422] BE PAGE_SIZE=16K CMPC885
[ 27.143594] CPU: 0 UID: 0 PID: 64 Comm: rcS Tainted: G D W 6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7 #17 PREEMPT
[ 27.155385] Tainted: [D]=DIE, [W]=WARN
[ 27.159056] Hardware name: MCR3000_2G 8xx 0x500000 CMPC885
[ 27.164479] NIP: c01af5fc LR: c08c3698 CTR: 00000000
[ 27.169481] REGS: ca173c00 TRAP: 0300 Tainted: G D W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 27.180054] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 95003599 XER: a000bf00
[ 27.187024] DAR: 0000007f DSISR: c0000000
[ 27.187024] GPR00: c08c3d1c ca173cc0 c32b4c80 c2004400 00000cc0 00000cc0 00000100 000039db
[ 27.187024] GPR08: 000039da 00000080 c31ea000 00000004 35003599 100d815e c329a1c0 c11b0000
[ 27.187024] GPR16: c312ac30 c11659ec c11d7f98 c11b01b4 c3284260 c107b85c c312abc0 c1165450
[ 27.187024] GPR24: c11d7f08 c11f0000 00000cc0 ffffffff c08c3698 00000cc0 ffffffff c2004400
[ 27.226870] NIP [c01af5fc] kmem_cache_alloc_noprof+0x54/0x21c
[ 27.232551] LR [c08c3698] mas_dup_build+0x154/0x75c
[ 27.237372] Call Trace:
[ 27.239781] [ca173cc0] [00000001] 0x1 (unreliable)
[ 27.244514] [ca173ce0] [00000000] 0x0
[ 27.248129] [ca173d20] [c08c3d1c] __mt_dup+0x7c/0xf8
[ 27.253034] [ca173d90] [c0188b14] dup_mmap+0xc8/0x690
[ 27.258026] [ca173df0] [c001f8a4] copy_process+0xcd4/0x148c
[ 27.263534] [ca173e70] [c0020188] kernel_clone+0xa4/0x3e8
[ 27.268869] [ca173eb0] [c0020820] sys_clone+0x78/0x9c
[ 27.273861] [ca173f20] [c000ddcc] system_call_exception+0x8c/0x160
[ 27.279971] [ca173f30] [c00110a8] ret_from_syscall+0x0/0x28
[ 27.285479] ---- interrupt: c00 at 0xfca2a6c
[ 27.289696] NIP: 0fca2a6c LR: 0fca7c40 CTR: 0fc6f51c
[ 27.294701] REGS: ca173f40 TRAP: 0c00 Tainted: G D W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 27.305272] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 25005590 XER: a000bf00
[ 27.312587]
[ 27.312587] GPR00: 00000078 7fc30fb0 7795b520 01200011 00000000 00000000 00000000 77954088
[ 27.312587] GPR08: 0000d032 100d4010 100cdd2d 0fc6f51c 59005998 100d815e c0004a68 00000000
[ 27.312587] GPR16: 00000000 7fc467dc 1001041c 10010000 100103ec 10005984 00000000 00000000
[ 27.312587] GPR24: ffffffff 00000000 100d58a4 100d58a4 100d5340 00000000 0fde378c 00000000
[ 27.349679] NIP [0fca2a6c] 0xfca2a6c
[ 27.353207] LR [0fca7c40] 0xfca7c40
[ 27.356649] ---- interrupt: c00
[ 27.359753] Code: 7c9d2378 418201ec 813f0000 81090004 83c90000 81290008 2c1e0000 4182004c 2c090000 38e80001 41820040 813f001c <7d3e482e> 7ca000a6 7c5113a6 815f0000
[ 27.375418] ---[ end trace 0000000000000000 ]---

Second one:

[ 25.086900] Disabling lock debugging due to kernel taint
[ 25.086966] Machine check in kernel mode.
[ 25.086999] Caused by (from SRR1=d032): Data access error at address 7f9aeb94
[ 25.087136] Oops: Machine check, sig: 7 [#1]
[ 25.107454] BE PAGE_SIZE=16K CMPC885
[ 25.114628] CPU: 0 UID: 0 PID: 260 Comm: syslogd Tainted: G M W 6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7 #17 PREEMPT
[ 25.126850] Tainted: [M]=MACHINE_CHECK, [W]=WARN
[ 25.131380] Hardware name: MCR3000_2G 8xx 0x500000 CMPC885
[ 25.136804] NIP: 0fcdbb30 LR: 0fde378c CTR: 00000000
[ 25.141805] REGS: ca22bf40 TRAP: 0200 Tainted: G M W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 25.152378] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 99003398 XER: a000bf00
[ 25.159693] DAR: 7f9aeb94 DSISR: 00000001
[ 25.159693] GPR00: 00000000 7f9aeb70 77d07520 0000004e 0fde378c 29003398 77d004cc 0fcdbb14
[ 25.159693] GPR08: 0000d032 fffff000 00000000 00000000 59003398 100d815e 7fa52560 100d0000
[ 25.159693] GPR16: 100d0000 00000000 ffffffff 00000059 100d0000 11a681f7 11a683f8 11a681f8
[ 25.159693] GPR24: 100d0000 100b4559 100d0178 00000058 11a681f8 00000058 0fde378c 0000004e
[ 25.199453] NIP [0fcdbb30] 0xfcdbb30
[ 25.202982] LR [0fde378c] 0xfde378c
[ 25.206427] Call Trace:
[ 25.208845] ---[ end trace 0000000000000000 ]---

Third one:

[ 25.295400] BUG: Bad page map in process syslogd pte:ffffffff pmd:031c0041
[ 25.302212] addr:7f98c000 vm_flags:00100173 anon_vma:c3278c30 mapping:00000000 index:1fff7
[ 25.310682] file:(null) fault:0x0 mmap:0x0 mmap_prepare: 0x0 read_folio:0x0
[ 25.317750] CPU: 0 UID: 0 PID: 260 Comm: syslogd Tainted: G M D W 6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7 #17 PREEMPT
[ 25.329963] Tainted: [M]=MACHINE_CHECK, [D]=DIE, [W]=WARN
[ 25.335258] Hardware name: MCR3000_2G 8xx 0x500000 CMPC885
[ 25.340684] Call Trace:
[ 25.343090] [ca22bc50] [c08b4d48] dump_stack+0x78/0x94 (unreliable)
[ 25.349373] [ca22bc60] [c017b2c0] print_bad_pte.isra.0+0x134/0x240
[ 25.355483] [ca22bcb0] [c017d374] vm_normal_page+0xc0/0xd0
[ 25.360905] [ca22bcc0] [c017df94] zap_pte_range+0x1ec/0xaf4
[ 25.366413] [ca22bd70] [c017f194] unmap_page_range+0xfc/0x144
[ 25.372093] [ca22bda0] [c017f2d0] unmap_vmas+0x70/0x134
[ 25.377256] [ca22bde0] [c0188244] exit_mmap+0xbc/0x3d0
[ 25.382334] [ca22be80] [c001db84] mmput+0x4c/0x12c
[ 25.387067] [ca22be90] [c0024b54] do_exit+0x20c/0x954
[ 25.392059] [ca22bed0] [c0025324] make_task_dead+0x88/0x164
[ 25.397567] [ca22bee0] [c000a6bc] die+0x204/0x20c
[ 25.402214] [ca22bf10] [c000b4b0] machine_check_exception+0x110/0x264
[ 25.408583] [ca22bf30] [c00031f4] MachineCheck_virt+0x100/0x104
[ 25.414434] ---- interrupt: 200 at 0xfcdbb30
[ 25.418651] NIP: 0fcdbb30 LR: 0fde378c CTR: 00000000
[ 25.423657] REGS: ca22bf40 TRAP: 0200 Tainted: G M D W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 25.434228] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 99003398 XER: a000bf00
[ 25.441543] DAR: 7f9aeb94 DSISR: 00000001
[ 25.441543] GPR00: 00000000 7f9aeb70 77d07520 0000004e 0fde378c 29003398 77d004cc 0fcdbb14
[ 25.441543] GPR08: 0000d032 fffff000 00000000 00000000 59003398 100d815e 7fa52560 100d0000
[ 25.441543] GPR16: 100d0000 00000000 ffffffff 00000059 100d0000 11a681f7 11a683f8 11a681f8
[ 25.441543] GPR24: 100d0000 100b4559 100d0178 00000058 11a681f8 00000058 0fde378c 0000004e
[ 25.481302] NIP [0fcdbb30] 0xfcdbb30
[ 25.484831] LR [0fde378c] 0xfde378c
[ 25.488273] ---- interrupt: 200
[ 25.694562] BUG: Bad page map in process syslogd pte:ffffffff pmd:031c0041
[ 25.701361] addr:7f990000 vm_flags:00100173 anon_vma:c3278c30 mapping:00000000 index:1fff8

Fourth one:

[ 29.366796] Kernel attempted to read user page (24) - exploit attempt? (uid: 0)
[ 29.373925] BUG: Kernel NULL pointer dereference on read at 0x00000024
[ 29.380367] Faulting instruction address: 0xc08cbd0c
[ 29.385279] Oops: Kernel access of bad area, sig: 11 [#1]
[ 29.390607] BE PAGE_SIZE=16K CMPC885
[ 29.397780] CPU: 0 UID: 0 PID: 415 Comm: rm Tainted: G W 6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7 #17 PREEMPT
[ 29.409562] Tainted: [W]=WARN
[ 29.412467] Hardware name: MCR3000_2G 8xx 0x500000 CMPC885
[ 29.417890] NIP: c08cbd0c LR: c08cbcf8 CTR: c08cbc44
[ 29.422892] REGS: ca2f3c80 TRAP: 0300 Tainted: G W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 29.433465] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 99005999 XER: a000bf00
[ 29.440435] DAR: 00000024 DSISR: c0000000
[ 29.440435] GPR00: c08ce480 ca2f3d40 c31c8640 00000000 c31f0800 ffffffff c31f0880 ffffffff
[ 29.440435] GPR08: 00000000 00000000 00000000 ffffffff 0000001f 100d815e 7fab0cc0 100d0000
[ 29.440435] GPR16: 100d0000 00000000 100d442c 100d4430 c334a740 00100000 c31f0880 00000000
[ 29.440435] GPR24: 00000000 00000001 00000004 ff074600 00000009 00000024 ca2f3df8 0e0a2324
[ 29.480281] NIP [c08cbd0c] mas_wr_store_entry+0x508/0xa90
[ 29.485618] LR [c08cbcf8] mas_wr_store_entry+0x4f4/0xa90
[ 29.490869] Call Trace:
[ 29.493278] [ca2f3d40] [000000ca] 0xca (unreliable)
[ 29.498097] [ca2f3d80] [c08ce480] mas_erase+0x63c/0x6c4
[ 29.503261] [ca2f3df0] [c08ce568] mtree_erase+0x60/0x100
[ 29.508510] [ca2f3e40] [c02093f4] simple_offset_remove+0x24/0x40
[ 29.514449] [ca2f3e50] [c0158a10] shmem_unlink+0x4c/0x108
[ 29.519784] [ca2f3ea0] [c01daa98] vfs_unlink+0xc4/0x344
[ 29.524948] [ca2f3ec0] [c01df0d8] do_unlinkat+0x288/0x334
[ 29.530284] [ca2f3f20] [c000ddcc] system_call_exception+0x8c/0x160
[ 29.536394] [ca2f3f30] [c00110a8] ret_from_syscall+0x0/0x28
[ 29.541902] ---- interrupt: c00 at 0xfcdc8c4
[ 29.546118] NIP: 0fcdc8c4 LR: 10098e84 CTR: 0fcda734
[ 29.551124] REGS: ca2f3f40 TRAP: 0c00 Tainted: G W (6.17.1-knld-3.16.4rc3-git8ac3a4-g568c147ca0f7)
[ 29.561695] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 29005590 XER: a000bf00
[ 29.569010]
[ 29.569010] GPR00: 0000000a 7fab0b80 77d3f520 100d4414 10098eb8 29005590 ca2f3ebc 0fccf170
[ 29.569010] GPR08: 0000d032 00000074 005b5d4e 0fcda734 00000003 100d815e 7fab0cc0 100d0000
[ 29.569010] GPR16: 100d0000 00000000 100d442c 100d4430 ffffffff 00000001 00000000 00000000
[ 29.569010] GPR24: 00000000 00000000 00000002 ffffff4d 100b7abc 100d4434 0fde378c 100d4414
[ 29.606102] NIP [0fcdc8c4] 0xfcdc8c4
[ 29.609630] LR [10098e84] 0x10098e84
[ 29.613158] ---- interrupt: c00
[ 29.616261] Code: 57e9063a 418203c0 7d29e430 7d3c4b78 553d103a 7fc3f378 4bff40c5 2c030003 39200000 4082000c 57ff002e 393f00a8 <7d29e82e> 7c09d800 418202a4 7f65db78
[ 29.631927] ---[ end trace 0000000000000000 ]---
[ 29.636486]
[ 29.637947] note: rm[415] exited with irqs disabled

Christophe

Next message: Marc Zyngier: "Re: [PATCH v4 1/3] KVM: arm64: VM exit to userspace to handle SEA"
Previous message: Bjorn Helgaas: "[PATCH] PCI: meson: Remove meson_pcie_link_up() timeout, message, speed check"
In reply to: Sverdlin, Alexander: "Re: [PATCH] eeprom: at25: convert to spi-mem API"
Next in thread: Sverdlin, Alexander: "Re: [PATCH] eeprom: at25: convert to spi-mem API"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]