There is an array bounds violation present during clock registration,
triggered by current code by only specific toolchains. This seems to
fail gracefully in v6.0-rc1, using a toolchain build from the riscv-
gnu-toolchain repo and with clang-15, and life carries on. While
converting the driver to use standard clock structs/ops, kernel panics
were seen during boot when built with clang-15:
[ 0.581754] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b1
[ 0.591520] Oops [#1]
[ 0.594045] Modules linked in:
[ 0.597435] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-00011-g8e1459cf4eca #1
[ 0.606188] Hardware name: Microchip PolarFire-SoC Icicle Kit (DT)
[ 0.613012] epc : __clk_register+0x4a6/0x85c
[ 0.617759] ra : __clk_register+0x49e/0x85c
[ 0.622489] epc : ffffffff803faf7c ra : ffffffff803faf74 sp : ffffffc80400b720
[ 0.630466] gp : ffffffff810e93f8 tp : ffffffe77fe60000 t0 : ffffffe77ffb3800
[ 0.638443] t1 : 000000000000000a t2 : ffffffffffffffff s0 : ffffffc80400b7c0
[ 0.646420] s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
[ 0.654396] a2 : 0000000000000001 a3 : 0000000000000000 a4 : 0000000000000000
[ 0.662373] a5 : ffffffff803a5810 a6 : 0000000200000022 a7 : 0000000000000006
[ 0.670350] s2 : ffffffff81099d48 s3 : ffffffff80d6e28e s4 : 0000000000000028
[ 0.678327] s5 : ffffffff810ed3c8 s6 : ffffffff810ed3d0 s7 : ffffffe77ffbc100
[ 0.686304] s8 : ffffffe77ffb1540 s9 : ffffffe77ffb1540 s10: 0000000000000008
[ 0.694281] s11: 0000000000000000 t3 : 00000000000000c6 t4 : 0000000000000007
[ 0.702258] t5 : ffffffff810c78c0 t6 : ffffffe77ff88cd0
[ 0.708125] status: 0000000200000120 badaddr: 00000000000000b1 cause: 000000000000000d
[ 0.716869] [<ffffffff803fb892>] devm_clk_hw_register+0x62/0xaa
[ 0.723420] [<ffffffff80403412>] mpfs_clk_probe+0x1e0/0x244
In v6.0-rc1 and later, this issue is visible without the follow on
patches doing the conversion using toolchains provided by our Yocto
meta layer too.
It fails on "clk_periph_timer" - which uses a different parent, that it
tries to find using the macro:
\#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].cfg.hw)
If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw
which is well beyond the end of the array. Amazingly, builds with GCC
11.1 see no problem here, booting correctly and hooking the parent up
etc. Builds with clang-15 do not, with the above panic.
Change the macro to use specific offsets depending on the parent rather
than the dt-binding's clock IDs.
Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control")
CC: Nathan Chancellor <[email protected]>
Signed-off-by: Conor Dooley <[email protected]>
---
drivers/clk/microchip/clk-mpfs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/microchip/clk-mpfs.c b/drivers/clk/microchip/clk-mpfs.c
index 070c3b896559..f0f9c9a1cc48 100644
--- a/drivers/clk/microchip/clk-mpfs.c
+++ b/drivers/clk/microchip/clk-mpfs.c
@@ -239,6 +239,11 @@ static const struct clk_ops mpfs_clk_cfg_ops = {
.hw.init = CLK_HW_INIT(_name, _parent, &mpfs_clk_cfg_ops, 0), \
}
+#define CLK_CPU_OFFSET 0u
+#define CLK_AXI_OFFSET 1u
+#define CLK_AHB_OFFSET 2u
+#define CLK_RTCREF_OFFSET 3u
+
static struct mpfs_cfg_hw_clock mpfs_cfg_clks[] = {
CLK_CFG(CLK_CPU, "clk_cpu", "clk_msspll", 0, 2, mpfs_div_cpu_axi_table, 0,
REG_CLOCK_CONFIG_CR),
@@ -362,7 +367,7 @@ static const struct clk_ops mpfs_periph_clk_ops = {
_flags), \
}
-#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].hw)
+#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT##_OFFSET].hw)
/*
* Critical clocks:
--
2.36.1
On 09.09.2022 15:31, Conor Dooley wrote:
> There is an array bounds violation present during clock registration,
> triggered by current code by only specific toolchains. This seems to
> fail gracefully in v6.0-rc1, using a toolchain build from the riscv-
> gnu-toolchain repo and with clang-15, and life carries on. While
> converting the driver to use standard clock structs/ops, kernel panics
> were seen during boot when built with clang-15:
>
> [ 0.581754] Unable to handle kernel NULL pointer dereference at virtual address 00000000000000b1
> [ 0.591520] Oops [#1]
> [ 0.594045] Modules linked in:
> [ 0.597435] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 6.0.0-rc1-00011-g8e1459cf4eca #1
> [ 0.606188] Hardware name: Microchip PolarFire-SoC Icicle Kit (DT)
> [ 0.613012] epc : __clk_register+0x4a6/0x85c
> [ 0.617759] ra : __clk_register+0x49e/0x85c
> [ 0.622489] epc : ffffffff803faf7c ra : ffffffff803faf74 sp : ffffffc80400b720
> [ 0.630466] gp : ffffffff810e93f8 tp : ffffffe77fe60000 t0 : ffffffe77ffb3800
> [ 0.638443] t1 : 000000000000000a t2 : ffffffffffffffff s0 : ffffffc80400b7c0
> [ 0.646420] s1 : 0000000000000001 a0 : 0000000000000001 a1 : 0000000000000000
> [ 0.654396] a2 : 0000000000000001 a3 : 0000000000000000 a4 : 0000000000000000
> [ 0.662373] a5 : ffffffff803a5810 a6 : 0000000200000022 a7 : 0000000000000006
> [ 0.670350] s2 : ffffffff81099d48 s3 : ffffffff80d6e28e s4 : 0000000000000028
> [ 0.678327] s5 : ffffffff810ed3c8 s6 : ffffffff810ed3d0 s7 : ffffffe77ffbc100
> [ 0.686304] s8 : ffffffe77ffb1540 s9 : ffffffe77ffb1540 s10: 0000000000000008
> [ 0.694281] s11: 0000000000000000 t3 : 00000000000000c6 t4 : 0000000000000007
> [ 0.702258] t5 : ffffffff810c78c0 t6 : ffffffe77ff88cd0
> [ 0.708125] status: 0000000200000120 badaddr: 00000000000000b1 cause: 000000000000000d
> [ 0.716869] [<ffffffff803fb892>] devm_clk_hw_register+0x62/0xaa
> [ 0.723420] [<ffffffff80403412>] mpfs_clk_probe+0x1e0/0x244
>
> In v6.0-rc1 and later, this issue is visible without the follow on
> patches doing the conversion using toolchains provided by our Yocto
> meta layer too.
>
> It fails on "clk_periph_timer" - which uses a different parent, that it
> tries to find using the macro:
> \#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].cfg.hw)
>
> If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw
> which is well beyond the end of the array. Amazingly, builds with GCC
> 11.1 see no problem here, booting correctly and hooking the parent up
> etc. Builds with clang-15 do not, with the above panic.
>
> Change the macro to use specific offsets depending on the parent rather
> than the dt-binding's clock IDs.
>
> Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control")
> CC: Nathan Chancellor <[email protected]>
> Signed-off-by: Conor Dooley <[email protected]>
Reviewed-by: Claudiu Beznea <[email protected]>
> ---
> drivers/clk/microchip/clk-mpfs.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/clk/microchip/clk-mpfs.c b/drivers/clk/microchip/clk-mpfs.c
> index 070c3b896559..f0f9c9a1cc48 100644
> --- a/drivers/clk/microchip/clk-mpfs.c
> +++ b/drivers/clk/microchip/clk-mpfs.c
> @@ -239,6 +239,11 @@ static const struct clk_ops mpfs_clk_cfg_ops = {
> .hw.init = CLK_HW_INIT(_name, _parent, &mpfs_clk_cfg_ops, 0), \
> }
>
> +#define CLK_CPU_OFFSET 0u
> +#define CLK_AXI_OFFSET 1u
> +#define CLK_AHB_OFFSET 2u
> +#define CLK_RTCREF_OFFSET 3u
> +
> static struct mpfs_cfg_hw_clock mpfs_cfg_clks[] = {
> CLK_CFG(CLK_CPU, "clk_cpu", "clk_msspll", 0, 2, mpfs_div_cpu_axi_table, 0,
> REG_CLOCK_CONFIG_CR),
> @@ -362,7 +367,7 @@ static const struct clk_ops mpfs_periph_clk_ops = {
> _flags), \
> }
>
> -#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT].hw)
> +#define PARENT_CLK(PARENT) (&mpfs_cfg_clks[CLK_##PARENT##_OFFSET].hw)
>
> /*
> * Critical clocks:
Quoting Conor Dooley (2022-09-09 05:31:10)
> There is an array bounds violation present during clock registration,
> triggered by current code by only specific toolchains. This seems to
> fail gracefully in v6.0-rc1, using a toolchain build from the riscv-
> gnu-toolchain repo and with clang-15, and life carries on. While
> converting the driver to use standard clock structs/ops, kernel panics
> were seen during boot when built with clang-15:
>
[...]
>
> If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw
> which is well beyond the end of the array. Amazingly, builds with GCC
> 11.1 see no problem here, booting correctly and hooking the parent up
> etc. Builds with clang-15 do not, with the above panic.
>
> Change the macro to use specific offsets depending on the parent rather
> than the dt-binding's clock IDs.
>
> Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control")
> CC: Nathan Chancellor <[email protected]>
> Signed-off-by: Conor Dooley <[email protected]>
> ---
I'll merge this patch over to clk-fixes as well.
Quoting Stephen Boyd (2022-09-28 17:30:28)
> Quoting Conor Dooley (2022-09-09 05:31:10)
> > There is an array bounds violation present during clock registration,
> > triggered by current code by only specific toolchains. This seems to
> > fail gracefully in v6.0-rc1, using a toolchain build from the riscv-
> > gnu-toolchain repo and with clang-15, and life carries on. While
> > converting the driver to use standard clock structs/ops, kernel panics
> > were seen during boot when built with clang-15:
> >
> [...]
> >
> > If parent is RTCREF, so the macro becomes: &mpfs_cfg_clks[33].cfg.hw
> > which is well beyond the end of the array. Amazingly, builds with GCC
> > 11.1 see no problem here, booting correctly and hooking the parent up
> > etc. Builds with clang-15 do not, with the above panic.
> >
> > Change the macro to use specific offsets depending on the parent rather
> > than the dt-binding's clock IDs.
> >
> > Fixes: 1c6a7ea32b8c ("clk: microchip: mpfs: add RTCREF clock control")
> > CC: Nathan Chancellor <[email protected]>
> > Signed-off-by: Conor Dooley <[email protected]>
> > ---
>
> I'll merge this patch over to clk-fixes as well.
Great I see it's already split out and on fixes branch. Thanks!