[U-Boot] [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board

Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
commit 3d296365e4e8823c7c0d4b568fa7accfae4bf895 (refs/bisect/bad) Author: Faiz Abbas faiz_abbas@ti.com Date: Tue Jun 11 00:43:34 2019 +0530
mmc: sdhci: Add support for sdhci-caps-mask
Add Support for masking some bits in the capabilities register of a host controller.
Also remove the redundant readl() into caps1.
Signed-off-by: Faiz Abbas faiz_abbas@ti.com Reviewed-by: Tom Rini trini@konsulko.com
Until that commit the behavior was the following:
U-Boot SPL 2019.07-00351-g889a4dfc55 (Jul 31 2019 - 20:01:41 +0300) mmc boot Trying to boot from MMC1 spl_load_image_fat_os: error reading image system.dtb, err - -2 spl_load_image_fat: error reading image u-boot.img, err - -2 SPL: failed to boot from all boot devices ### ERROR ### Please RESET the board ###
There were no u-boot.img at the SD card while testing, so this error message is expected here. 5456935a1da3 ("ARM: zynq: Add configuration for Z-turn board") was applied at the top of every testing commit to allow the board initialization in SPL.
What could be wrong with that commit and how could I fix the board?

Subject: [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board
Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
https://gitlab.denx.de/u-boot/custodians/u-boot-mmc/commit/41a9fab8dac841afb...
Would this patch help?
Regards, Peng.
commit 3d296365e4e8823c7c0d4b568fa7accfae4bf895 (refs/bisect/bad) Author: Faiz Abbas faiz_abbas@ti.com Date: Tue Jun 11 00:43:34 2019 +0530
mmc: sdhci: Add support for sdhci-caps-mask Add Support for masking some bits in the capabilities register of a host controller. Also remove the redundant readl() into caps1. Signed-off-by: Faiz Abbas <faiz_abbas@ti.com> Reviewed-by: Tom Rini <trini@konsulko.com>
Until that commit the behavior was the following:
U-Boot SPL 2019.07-00351-g889a4dfc55 (Jul 31 2019 - 20:01:41 +0300) mmc boot Trying to boot from MMC1 spl_load_image_fat_os: error reading image system.dtb, err - -2 spl_load_image_fat: error reading image u-boot.img, err - -2 SPL: failed to boot from all boot devices ### ERROR ### Please RESET the board ###
There were no u-boot.img at the SD card while testing, so this error message is expected here. 5456935a1da3 ("ARM: zynq: Add configuration for Z-turn board") was applied at the top of every testing commit to allow the board initialization in SPL.
What could be wrong with that commit and how could I fix the board?
-- With best regards, Matwey V. Kornilov

Hi,
On 01/08/19 7:51 AM, Peng Fan wrote:
Subject: [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board
Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
https://gitlab.denx.de/u-boot/custodians/u-boot-mmc/commit/41a9fab8dac841afb...
Would this patch help?
Yeah, this mostly looks like a NULL pointer access issue.
Thanks, Faiz

Hi all,
чт, 1 авг. 2019 г. в 09:48, Faiz Abbas faiz_abbas@ti.com:
Hi,
On 01/08/19 7:51 AM, Peng Fan wrote:
Subject: [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board
Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
https://gitlab.denx.de/u-boot/custodians/u-boot-mmc/commit/41a9fab8dac841afb...
Would this patch help?
Yeah, this mostly looks like a NULL pointer access issue.
Unfortunately, 41a9fab8 doesn't help me.... :-( Behavior remains the same.
Thanks, Faiz

Hi Matwey,
On 01/08/19 1:03 PM, Matwey V. Kornilov wrote:
Hi all,
чт, 1 авг. 2019 г. в 09:48, Faiz Abbas faiz_abbas@ti.com:
Hi,
On 01/08/19 7:51 AM, Peng Fan wrote:
Subject: [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board
Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
https://gitlab.denx.de/u-boot/custodians/u-boot-mmc/commit/41a9fab8dac841afb...
Would this patch help?
Yeah, this mostly looks like a NULL pointer access issue.
Unfortunately, 41a9fab8 doesn't help me.... :-( Behavior remains the same.
You need to implement the same thing with your driver (I assume you are using zynq_sdhci.c?). sdhci_setup_cfg() requires a valid host->mmc->dev. Move that assignment to above the sdhci_set_cfg() call in your driver.
Thanks, Faiz

чт, 1 авг. 2019 г. в 10:40, Faiz Abbas faiz_abbas@ti.com:
Hi Matwey,
On 01/08/19 1:03 PM, Matwey V. Kornilov wrote:
Hi all,
чт, 1 авг. 2019 г. в 09:48, Faiz Abbas faiz_abbas@ti.com:
Hi,
On 01/08/19 7:51 AM, Peng Fan wrote:
Subject: [BISECTED] [BUG]: MMC initialization hang at Zynq Z-turn board
Hello,
I am running Zynq Z-turn board and I face the following issue with MMC initialization in SPL. With u-boot master, I see the message similar to the following:
U-Boot SPL 2019.07-00352-gb5f3eb3393 (Jul 31 2019 - 20:03:42 +0300) mmc boot Trying to boot from MMC1
Then, the u-boot waits forever. I've tried to add debug prints and found that execution is stalled somewhere inside mmc_init(). Using bisect I've found that the following broken commit is the following:
https://gitlab.denx.de/u-boot/custodians/u-boot-mmc/commit/41a9fab8dac841afb...
Would this patch help?
Yeah, this mostly looks like a NULL pointer access issue.
Unfortunately, 41a9fab8 doesn't help me.... :-( Behavior remains the same.
You need to implement the same thing with your driver (I assume you are using zynq_sdhci.c?). sdhci_setup_cfg() requires a valid host->mmc->dev. Move that assignment to above the sdhci_set_cfg() call in your driver.
Now it works. Thank you a lot! I'll prepare fixing patch for zynq_sdhci.c shortly.
Thanks, Faiz

Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com --- drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
+ host->mmc = &plat->mmc; + host->mmc->dev = dev; + host->mmc->priv = host; + ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ); - host->mmc = &plat->mmc; if (ret) return ret; - host->mmc->priv = host; - host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);

Subject: [PATCH] mmc: zynq_sdhci: fix uninitialized pointer deref on probe
Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com
drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
- host->mmc = &plat->mmc;
- host->mmc->dev = dev;
- host->mmc->priv = host;
- ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ);
host->mmc = &plat->mmc; if (ret) return ret;
host->mmc->priv = host;
host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);
Reviewed-by: Peng Fan peng.fan@nxp.com
-- 2.16.4

On 01. 08. 19 17:00, Matwey V. Kornilov wrote:
Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com
drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
- host->mmc = &plat->mmc;
- host->mmc->dev = dev;
- host->mmc->priv = host;
- ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ);
host->mmc = &plat->mmc; if (ret) return ret;
host->mmc->priv = host;
host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);
Would be good to mentioned that this was tested on Z-turn board.
Anyway I have tested it on zcu102 and issue is not visible there but it is visible on zc706. That's why I expect this is issue only for Zynq device.
Anyway Tested-by: Michal Simek michal.simek@xilinx.com (on zcu102/zc706)
Peng: Feel free to take it via your tree or I will take it.
Thanks, Michal

Subject: Re: [PATCH] mmc: zynq_sdhci: fix uninitialized pointer deref on probe
On 01. 08. 19 17:00, Matwey V. Kornilov wrote:
Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com
drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
- host->mmc = &plat->mmc;
- host->mmc->dev = dev;
- host->mmc->priv = host;
- ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ);
host->mmc = &plat->mmc; if (ret) return ret;
host->mmc->priv = host;
host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);
Would be good to mentioned that this was tested on Z-turn board.
Anyway I have tested it on zcu102 and issue is not visible there but it is visible on zc706. That's why I expect this is issue only for Zynq device.
Anyway Tested-by: Michal Simek michal.simek@xilinx.com (on zcu102/zc706)
Peng: Feel free to take it via your tree or I will take it.
I'll take it.
Thanks, Peng.
Thanks, Michal

On 02. 08. 19 11:23, Peng Fan wrote:
Subject: Re: [PATCH] mmc: zynq_sdhci: fix uninitialized pointer deref on probe
On 01. 08. 19 17:00, Matwey V. Kornilov wrote:
Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com
drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
- host->mmc = &plat->mmc;
- host->mmc->dev = dev;
- host->mmc->priv = host;
- ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ);
host->mmc = &plat->mmc; if (ret) return ret;
host->mmc->priv = host;
host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);
Would be good to mentioned that this was tested on Z-turn board.
Anyway I have tested it on zcu102 and issue is not visible there but it is visible on zc706. That's why I expect this is issue only for Zynq device.
Anyway Tested-by: Michal Simek michal.simek@xilinx.com (on zcu102/zc706)
Peng: Feel free to take it via your tree or I will take it.
I'll take it.
thx. M

Subject: [PATCH] mmc: zynq_sdhci: fix uninitialized pointer deref on probe
Since commit 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") sdhci_setup_cfg() expects a valid sdhci_host mmc field. Move the mmc field initialization before sdhci_setup_cfg() call to avoid crash on mmc pointer dereference.
[this patch is based on commit 41a9fab8dac8 ("mmc: mv_sdhci: fix uninitialized pointer deref on probe") by Baruch Siach]
Fixes: 3d296365e4e8 ("mmc: sdhci: Add support for sdhci-caps-mask") Cc: Faiz Abbas faiz_abbas@ti.com Cc: Baruch Siach baruch@tkos.co.il Signed-off-by: Matwey V. Kornilov matwey.kornilov@gmail.com
drivers/mmc/zynq_sdhci.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/mmc/zynq_sdhci.c b/drivers/mmc/zynq_sdhci.c index c525084250..3225a7ac93 100644 --- a/drivers/mmc/zynq_sdhci.c +++ b/drivers/mmc/zynq_sdhci.c @@ -242,13 +242,14 @@ static int arasan_sdhci_probe(struct udevice *dev)
host->max_clk = clock;
- host->mmc = &plat->mmc;
- host->mmc->dev = dev;
- host->mmc->priv = host;
- ret = sdhci_setup_cfg(&plat->cfg, host, plat->f_max, CONFIG_ZYNQ_SDHCI_MIN_FREQ);
host->mmc = &plat->mmc; if (ret) return ret;
host->mmc->priv = host;
host->mmc->dev = dev; upriv->mmc = host->mmc;
return sdhci_probe(dev);
Applied to mmc/master.
Thanks, Peng.
-- 2.16.4
participants (4)
-
Faiz Abbas
-
Matwey V. Kornilov
-
Michal Simek
-
Peng Fan