mtd: rawnand: brcmnand: driver and doc updates
v2 cover mtd: rawnand: brcmnand: driver and doc updates
This patch series include the accumulative updates and fixes for the brcmnand driver. The bcmbca SoC related updates are removed from v2 and will be sent through separate patch series.
Changes in v2:
- Use driver static data for ECC level shift
- Handle the remaining unaligned oob data after the oob data write loop
- Remove bcmbca SoC related updates
William Zhang (4):
mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2
controller
mtd: rawnand: brcmnand: Fix potential false time out warning
mtd: rawnand: brcmnand: Fix crash during the panic_write
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob
write
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 107 +++++++++++++++-------- 1 file changed, 71 insertions(+), 36 deletions(-)
Signature · 1 line
2.37.3
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
PATCH v2 1/4 mtd: rawnand: brcmnand: Fix ECC level field setting for v7.2 controller
v7.2 controller has different ECC level field size and shift in the acc control register than its predecessor and successor controller. It needs to be set specifically.
---
Changes in v2:
- Use driver static data for ECC level shift
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 74 +++++++++++++----------- 1 file changed, 41 insertions(+), 33 deletions(-)
drivers/mtd/nand/raw/brcmnand/brcmnand.c +41 -33
@@ -272,6 +272,7 @@ struct brcmnand_controller {const unsigned int *page_sizes;unsigned int page_size_shift;unsigned int max_oob; +u32 ecc_level_shift;u32 features;/* for low-power standby/resume only */
@@ -596,6 +597,34 @@ enum { INTFC_CTLR_READY = BIT(31), }; +/*********************************************************************** +* NAND ACC CONTROL bitfield +* +* Some bits have remained constant throughout hardware revision, while +* others have shifted around. +***********************************************************************/ + +/* Constant for all versions (where supported) */ +enum { +/* See BRCMNAND_HAS_CACHE_MODE */ +ACC_CONTROL_CACHE_MODE =BIT (22 ), + +/* See BRCMNAND_HAS_PREFETCH */ +ACC_CONTROL_PREFETCH =BIT (23 ), + +ACC_CONTROL_PAGE_HIT =BIT (24 ), +ACC_CONTROL_WR_PREEMPT =BIT (25 ), +ACC_CONTROL_PARTIAL_PAGE =BIT (26 ), +ACC_CONTROL_RD_ERASED =BIT (27 ), +ACC_CONTROL_FAST_PGM_RDIN =BIT (28 ), +ACC_CONTROL_WR_ECC =BIT (30 ), +ACC_CONTROL_RD_ECC =BIT (31 ), + +ACC_CONTROL_ECC_SHIFT =16 , +/* Only for v7.2 */ +ACC_CONTROL_ECC_EXT_SHIFT =13 , +}; +static inline bool brcmnand_non_mmio_ops (struct brcmnand_controller *ctrl) {#if IS_ENABLED (CONFIG_MTD_NAND_BRCMNAND_BCMA )
@@ -737,6 +766,12 @@ static int brcmnand_revision_init(struct brcmnand_controller *ctrl)else if (of_property_read_bool (ctrl->dev->of_node,"brcm,nand-has-wp" )) ctrl->features |=BRCMNAND_HAS_WP ; +/* v7.2 has different ecc level shift in the acc register */ +if (ctrl->nand_version ==0x0702 ) + ctrl->ecc_level_shift =ACC_CONTROL_ECC_EXT_SHIFT ; +else + ctrl->ecc_level_shift =ACC_CONTROL_ECC_SHIFT ; +return 0 ; }
@@ -931,30 +966,6 @@ static inline int brcmnand_cmd_shift(struct brcmnand_controller *ctrl)return 0 ; } -/*********************************************************************** -* NAND ACC CONTROL bitfield -* -* Some bits have remained constant throughout hardware revision, while -* others have shifted around. -***********************************************************************/ - -/* Constant for all versions (where supported) */ -enum { -/* See BRCMNAND_HAS_CACHE_MODE */ -ACC_CONTROL_CACHE_MODE =BIT (22 ), - -/* See BRCMNAND_HAS_PREFETCH */ -ACC_CONTROL_PREFETCH =BIT (23 ), - -ACC_CONTROL_PAGE_HIT =BIT (24 ), -ACC_CONTROL_WR_PREEMPT =BIT (25 ), -ACC_CONTROL_PARTIAL_PAGE =BIT (26 ), -ACC_CONTROL_RD_ERASED =BIT (27 ), -ACC_CONTROL_FAST_PGM_RDIN =BIT (28 ), -ACC_CONTROL_WR_ECC =BIT (30 ), -ACC_CONTROL_RD_ECC =BIT (31 ), -}; -static inline u32 brcmnand_spare_area_mask (struct brcmnand_controller *ctrl) {if (ctrl->nand_version ==0x0702 )
@@ -967,18 +978,15 @@ static inline u32 brcmnand_spare_area_mask(struct brcmnand_controller *ctrl)return GENMASK (4 ,0 ); } -#define NAND_ACC_CONTROL_ECC_SHIFT 16 -#define NAND_ACC_CONTROL_ECC_EXT_SHIFT 13 -static inline u32 brcmnand_ecc_level_mask (struct brcmnand_controller *ctrl) {u32 mask = (ctrl->nand_version >=0x0600 ) ?0x1f :0x0f ; - mask <<=NAND_ACC_CONTROL_ECC_SHIFT ; + mask <<=ACC_CONTROL_ECC_SHIFT ;/* v7.2 includes additional ECC levels */ -if (ctrl->nand_version >=0x0702 ) - mask |=0x7 <<NAND_ACC_CONTROL_ECC_EXT_SHIFT ; +if (ctrl->nand_version ==0x0702 ) + mask |=0x7 <<ACC_CONTROL_ECC_EXT_SHIFT ;return mask; }
@@ -992,8 +1000,8 @@ static void brcmnand_set_ecc_enabled(struct brcmnand_host *host, int en)if (en) { acc_control |= ecc_flags;/* enable RD/WR ECC */ - acc_control |= host->hwcfg.ecc_level - <<NAND_ACC_CONTROL_ECC_SHIFT ; + acc_control &= ~brcmnand_ecc_level_mask (ctrl); + acc_control |= host->hwcfg.ecc_level << ctrl->ecc_level_shift; }else { acc_control &= ~ecc_flags;/* disable RD/WR ECC */ acc_control &= ~brcmnand_ecc_level_mask (ctrl);
@@ -2561,7 +2569,7 @@ static int brcmnand_set_cfg(struct brcmnand_host *host, tmp &= ~brcmnand_ecc_level_mask (ctrl); tmp &= ~brcmnand_spare_area_mask (ctrl);if (ctrl->nand_version >=0x0302 ) { - tmp |= cfg->ecc_level <<NAND_ACC_CONTROL_ECC_SHIFT ; + tmp |= cfg->ecc_level << ctrl->ecc_level_shift; tmp |= cfg->spare_area_size; }nand_writereg (ctrl, acc_control_offs, tmp);
Signature · 1 line
2.37.3
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
PATCH v2 2/4 mtd: rawnand: brcmnand: Fix potential false time out warning
In reply to William ZhangIf system is busy during the command status polling function, the driver may not get the chance to poll the status register till the end of time out and return the premature status. Do a final check after time out happens to ensure reading the correct status.
---
Changes in v2: None
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 8 ++++++++ 1 file changed, 8 insertions(+)
drivers/mtd/nand/raw/brcmnand/brcmnand.c +8 -0
@@ -1080,6 +1080,14 @@ static int bcmnand_ctrl_poll_status(struct brcmnand_controller *ctrl,cpu_relax (); }while (time_after (limit, jiffies)); +/* +* do a final check after time out in case CPU is busy and driver does +* not get the enough time to poll to avoid false alarm +*/ + val =brcmnand_read_reg (ctrl,BRCMNAND_INTFC_STATUS ); +if ((val & mask) == expected_val) +return 0 ; +dev_warn (ctrl->dev,"timeout on status poll (expected %x got %x)\n" , expected_val, val & mask);
Signature · 1 line
2.37.3
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
PATCH v2 3/4 mtd: rawnand: brcmnand: Fix crash during the panic_write
In reply to William ZhangDuring the panic write path to execute another nand command, if there is a pending command, we should wait for the command instead of calling BUG_ON so we don't crash while crashing.
---
Changes in v2: None
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-)
drivers/mtd/nand/raw/brcmnand/brcmnand.c +11 -1
@@ -1608,7 +1608,17 @@ static void brcmnand_send_cmd(struct brcmnand_host *host, int cmd)dev_dbg (ctrl->dev,"send native cmd %d addr 0x%llx\n" , cmd, cmd_addr); -BUG_ON (ctrl->cmd_pending !=0 ); +/* +* If we came here through _panic_write and there is a pending +* command, try to wait for it. If it times out, rather than +* hitting BUG_ON, just return so we don't crash while crashing. +*/ +if (oops_in_progress) { +if (ctrl->cmd_pending && +bcmnand_ctrl_poll_status (ctrl,NAND_CTRL_RDY ,NAND_CTRL_RDY ,0 )) +return ; + }else +BUG_ON (ctrl->cmd_pending !=0 ); ctrl->cmd_pending = cmd; ret =bcmnand_ctrl_poll_status (ctrl,NAND_CTRL_RDY ,NAND_CTRL_RDY ,0 );
Signature · 1 line
2.37.3
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
PATCH v2 4/4 mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
In reply to William ZhangWhen the oob buffer length is not in multiple of words, the oob write function does out-of-bounds read on the oob source buffer at the last iteration. Fix that by always checking length limit on the oob buffer read and fill with 0xff when reaching the end of the buffer to the oob registers.
---
Changes in v2:
- Handle the remaining unaligned oob data after the oob data write loop
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/mtd/nand/raw/brcmnand/brcmnand.c +11 -2
@@ -1477,19 +1477,28 @@ static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i, const u8 *oob, int sas, int sector_1k) { int tbytes = sas << sector_1k; -int j; +int j, k =0 ; +u32 last =0xffffffff ; +u8 *plast = (u8 *)&last;/* Adjust OOB values for 1K sector size */ if (sector_1k && (i &0x01 )) tbytes =max (0 , tbytes - (int )ctrl->max_oob); tbytes =min_t (int, tbytes, ctrl->max_oob); -for (j =0 ; j < tbytes; j +=4 ) +for (j =0 ; (j +3 ) < tbytes; j +=4 )oob_reg_write (ctrl, j, (oob[j +0 ] <<24 ) | (oob[j +1 ] <<16 ) | (oob[j +2 ] <<8 ) | (oob[j +3 ] <<0 )); + +while (j < tbytes) + plast[k++] = oob[j++]; + +if (tbytes &0x3 ) +oob_reg_write (ctrl, (tbytes & ~0x3 ),cpu_to_be32 (last)); +return tbytes; }
Signature · 1 line
2.37.3
______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/
kernel test robot
build botRe: [PATCH v2 4/4] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
kernel test robot noticed the following build warnings:
Hi William,
kernel test robot noticed the following build warnings:
[auto build test WARNING on mtd/nand/next]
[also build test WARNING on linus/master v6.4-rc7 next-20230619] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/William-Zhang/mtd-rawnand-brcmnand-Fix-ECC-level-field-setting-for-v7-2-controller/20230617-103050 base: https://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux.git nand/next patch link: https://lore.kernel.org/r/20230617022920.67173-5-william.zhang%40broadcom.com patch subject: [PATCH v2 4/4] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write config: arm64-randconfig-s043-20230619 (https://download.01.org/0day-ci/archive/20230620/[email protected]/config) compiler: aarch64-linux-gcc (GCC) 12.3.0 reproduce: (https://download.01.org/0day-ci/archive/20230620/[email protected]/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/
sparse warnings: (new ones prefixed by >>)
>> drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned int [usertype] data @@ got restricted __be32 [usertype] @@
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: expected unsigned int [usertype] data
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1500:54: sparse: got restricted __be32 [usertype]
drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:1836:42: sparse: sparse: cast to restricted __be32 drivers/mtd/nand/raw/brcmnand/brcmnand.c:2065:41: sparse: sparse: dubious: x | !y
vim +1500 drivers/mtd/nand/raw/brcmnand/brcmnand.c
1468
1469 /*
1470 * write_oob_to_regs - write data to OOB registers
1471 * @i: sub-page sector index
1472 * @oob: buffer to write from
1473 * @sas: spare area sector size (i.e., OOB size per FLASH_CACHE)
1474 * @sector_1k: 1 for 1KiB sectors, 0 for 512B, other values are illegal
1475 */
1476 static int write_oob_to_regs(struct brcmnand_controller *ctrl, int i,
1477 const u8 *oob, int sas, int sector_1k)
1478 {
1479 int tbytes = sas << sector_1k;
1480 int j, k = 0;
1481 u32 last = 0xffffffff;
1482 u8 *plast = (u8 *)&last;
1483
1484 /* Adjust OOB values for 1K sector size */
1485 if (sector_1k && (i & 0x01))
1486 tbytes = max(0, tbytes - (int)ctrl->max_oob);
1487 tbytes = min_t(int, tbytes, ctrl->max_oob);
1488
1489 for (j = 0; (j + 3) < tbytes; j += 4)
1490 oob_reg_write(ctrl, j,
1491 (oob[j + 0] << 24) | 1492 (oob[j + 1] << 16) | 1493 (oob[j + 2] << 8) | 1494 (oob[j + 3] << 0)); 1495 1496 while (j < tbytes) 1497 plast[k++] = oob[j++]; 1498 1499 if (tbytes & 0x3) > 1500 oob_reg_write(ctrl, (tbytes & ~0x3), cpu_to_be32(last));
1501
1502 return tbytes;
1503 }
1504
Signature · 2 lines
0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki