| From 2ce4f4c40f042057d50e5b4372a380c29c24a02c Mon Sep 17 00:00:00 2001 |
| From: Frieder Schrempf <frieder.schrempf@kontron.de> |
| Date: Tue, 18 Feb 2020 10:05:14 +0000 |
| Subject: [PATCH] mtd: spinand: Stop using spinand->oobbuf for buffering bad |
| block markers |
| |
| commit 2148937501ee3d663e0010e519a553fea67ad103 upstream. |
| |
| For reading and writing the bad block markers, spinand->oobbuf is |
| currently used as a buffer for the marker bytes. During the |
| underlying read and write operations to actually get/set the content |
| of the OOB area, the content of spinand->oobbuf is reused and changed |
| by accessing it through spinand->oobbuf and/or spinand->databuf. |
| |
| This is a flaw in the original design of the SPI NAND core and at the |
| latest from 13c15e07eedf ("mtd: spinand: Handle the case where |
| PROGRAM LOAD does not reset the cache") on, it results in not having |
| the bad block marker written at all, as the spinand->oobbuf is |
| cleared to 0xff after setting the marker bytes to zero. |
| |
| To fix it, we now just store the two bytes for the marker on the |
| stack and let the read/write operations copy it from/to the page |
| buffer later. |
| |
| Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de> |
| Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com> |
| Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com> |
| Link: https://lore.kernel.org/linux-mtd/20200218100432.32433-2-frieder.schrempf@kontron.de |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c |
| index 20560c0b1f5d..0c88cc49b8c1 100644 |
| --- a/drivers/mtd/nand/spi/core.c |
| +++ b/drivers/mtd/nand/spi/core.c |
| @@ -568,18 +568,18 @@ static int spinand_mtd_write(struct mtd_info *mtd, loff_t to, |
| static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos) |
| { |
| struct spinand_device *spinand = nand_to_spinand(nand); |
| + u8 marker[2] = { }; |
| struct nand_page_io_req req = { |
| .pos = *pos, |
| - .ooblen = 2, |
| + .ooblen = sizeof(marker), |
| .ooboffs = 0, |
| - .oobbuf.in = spinand->oobbuf, |
| + .oobbuf.in = marker, |
| .mode = MTD_OPS_RAW, |
| }; |
| |
| - memset(spinand->oobbuf, 0, 2); |
| spinand_select_target(spinand, pos->target); |
| spinand_read_page(spinand, &req, false); |
| - if (spinand->oobbuf[0] != 0xff || spinand->oobbuf[1] != 0xff) |
| + if (marker[0] != 0xff || marker[1] != 0xff) |
| return true; |
| |
| return false; |
| @@ -603,11 +603,12 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs) |
| static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos) |
| { |
| struct spinand_device *spinand = nand_to_spinand(nand); |
| + u8 marker[2] = { }; |
| struct nand_page_io_req req = { |
| .pos = *pos, |
| .ooboffs = 0, |
| - .ooblen = 2, |
| - .oobbuf.out = spinand->oobbuf, |
| + .ooblen = sizeof(marker), |
| + .oobbuf.out = marker, |
| }; |
| int ret; |
| |
| @@ -622,7 +623,6 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos) |
| |
| spinand_erase_op(spinand, pos); |
| |
| - memset(spinand->oobbuf, 0, 2); |
| return spinand_write_page(spinand, &req); |
| } |
| |
| -- |
| 2.7.4 |
| |