mtd: nand: davinci: Fix unaligned 16-bit NAND read
Subsystems (2)
PATCH 1/1 mtd: nand: davinci: Fix unaligned 16-bit NAND read
This patch fixes a rare bug when reading from 16-bit NAND flashes, by not allowing 8-bit read accesses within nand_davinci_read_buf().
In certain situations, an non 16-bit aligned buffer is passed to nand_davinci_read_buf(), which causes 8-bit accesses to be performed. However, the NAND will be returning 16-bit words, and half of these will be discarded.
This was observed when running mtd_stresstest.ko, which would report ECC errors when reading from a non 16-bit aligned offset into a page, and reading at least one subsequent page in the same read.
--- drivers/mtd/nand/davinci_nand.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)
drivers/mtd/nand/davinci_nand.c +13 -1
@@ -442,12 +442,24 @@ static int nand_davinci_correct_4bit(struct mtd_info *mtd,static void nand_davinci_read_buf (struct mtd_info *mtd,uint8_t *buf,int len) {struct nand_chip *chip =mtd_to_nand (mtd); +u16 tmp;if ((0x03 & ((unsigned )buf)) ==0 && (0x03 & len) ==0 )ioread32_rep (chip->IO_ADDR_R, buf, len >>2 );else if ((0x01 & ((unsigned )buf)) ==0 && (0x01 & len) ==0 )ioread16_rep (chip->IO_ADDR_R, buf, len >>1 ); -else +else if (chip->options &NAND_BUSWIDTH_16 ) { +/* +* if NAND buswidth is 16 then 8 bit accesses +* will silently discard half the data +*/ + len /=2 ; +while (len--) { + tmp =ioread16 (chip->IO_ADDR_R); +memcpy (buf, &tmp,sizeof (u16)); + buf +=sizeof (u16); + } + }else ioread8_rep (chip->IO_ADDR_R, buf, len); }
Signature · 1 line
2.1.4
Hi Michael,
Quoted 33 lines · On Fri, 21 Oct 2016 10:26:05 +0100 Ville Michael Baillie…
This patch fixes a rare bug when reading from 16-bit NAND flashes, by not allowing 8-bit read accesses within
nand_davinci_read_buf().In certain situations, an non 16-bit aligned buffer is passed to
nand_davinci_read_buf(), which causes 8-bit accesses to be performed. However, the NAND will be returning 16-bit words, and half of these will be discarded.This was observed when running mtd_stresstest.ko, which would report ECC errors when reading from a non 16-bit aligned offset into a page, and reading at least one subsequent page in the same read.
Signed-off-by Ville Michael Baillie <[email protected]>--- drivers/mtd/nand/davinci_nand.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-)drivers/mtd/nand/davinci_nand.c +2
-1@@ -442,12 +442,24 @@ static int nand_davinci_correct_4bit(struct mtd_info *mtd,static void nand_davinci_read_buf (struct mtd_info *mtd,uint8_t *buf,int len) {struct nand_chip *chip =mtd_to_nand (mtd); +u16 tmp;if ((0x03 & ((unsigned )buf)) ==0 && (0x03 & len) ==0 )ioread32_rep (chip->IO_ADDR_R, buf, len >>2 );else if ((0x01 & ((unsigned )buf)) ==0 && (0x01 & len) ==0 )ioread16_rep (chip->IO_ADDR_R, buf, len >>1 ); -else +else if (chip->options &NAND_BUSWIDTH_16 ) {
drivers/mtd/nand/davinci_nand.c static int nand_davinci_correct_4bit(struct mtd_info *mtd, · line 461
Quoted 10 lines
drivers/mtd/nand/davinci_nand.c +10
-0+/* +* if NAND buswidth is 16 then 8 bit accesses +* will silently discard half the data +*/ + len /=2 ; +while (len--) { + tmp =ioread16 (chip->IO_ADDR_R); +memcpy (buf, &tmp,sizeof (u16)); + buf +=sizeof (u16); + }
Hm, you're not checking the len alignment here. Not sure this is safe to assume len will always be a multiple of 2 bytes.
How about doing the following instead:
/* Use ioread16_rep for aligned accesses. */
if (IS_ALIGNED(addr, sizeof(u16))) {
ioread16_rep(chip->IO_ADDR_R, buf, len >> 1);
buf += len & ~0x1;
len &= 0x1;
}
/*
* Now handle unaligned accesses.
* Warning: in case of unaligned len, we are consuming
* one extra byte, which is then discarded. It's fine
* as long as the caller does not call ->read_buf()
* twice without re-issuing a command in the middle.
* Otherwise, this means we lost one byte.
*/
for (; len > 0; len -= sizeof(u16)) {
u16 tmp;
tmp = ioread16(chip->IO_ADDR_R);
memcpy(buf, &tmp,
len < sizeof(u16) ? len : sizeof(u16));
buf += sizeof(u16);
}drivers/mtd/nand/davinci_nand.c static int nand_davinci_correct_4bit(struct mtd_info *mtd, · line 463
Quoted 2 lines
drivers/mtd/nand/davinci_nand.c +1
-0+ }else ioread8_rep (chip->IO_ADDR_R, buf, len);
} else {
ioread8_rep(chip->IO_ADDR_R, buf, len);
}Quoted 2 lines
drivers/mtd/nand/davinci_nand.c +0
-0}