Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'mtd/fixes-for-4.17-rc3' of git://git.infradead.org/linux-mtd
Pull mtd fixes from Boris Brezillon:
- Fix nanddev_mtd_erase() function to match the changes done in
e7bfb3fdbde3 ("mtd: Stop updating erase_info->state and calling
mtd_erase_callback()")
- Fix a memory leak in the Tango NAND controller driver
- Fix read/write to a suspended erase block in the CFI driver
- Fix the DT parsing logic in the Marvell NAND controller driver
* tag 'mtd/fixes-for-4.17-rc3' of git://git.infradead.org/linux-mtd:
mtd: rawnand: marvell: fix the chip-select DT parsing logic
mtd: cfi: cmdset_0002: Do not allow read/write to suspend erase block.
mtd: cfi: cmdset_0001: Workaround Micron Erase suspend bug.
mtd: cfi: cmdset_0001: Do not allow read/write to suspend erase block.
mtd: spi-nor: cadence-quadspi: Fix page fault kernel panic
mtd: nand: Fix nanddev_mtd_erase()
mtd: rawnand: tango: Fix struct clk memory leak
+61
-31
+28
-5
drivers/mtd/chips/cfi_cmdset_0001.c
+28
-5
drivers/mtd/chips/cfi_cmdset_0001.c
···
45
45
#define I82802AB 0x00ad
46
46
#define I82802AC 0x00ac
47
47
#define PF38F4476 0x881c
48
+
#define M28F00AP30 0x8963
48
49
/* STMicroelectronics chips */
49
50
#define M50LPW080 0x002F
50
51
#define M50FLW080A 0x0080
···
374
373
if (cfi->mfr == CFI_MFR_INTEL &&
375
374
cfi->id == PF38F4476 && extp->MinorVersion == '3')
376
375
extp->MinorVersion = '1';
376
+
}
377
+
378
+
static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip)
379
+
{
380
+
/*
381
+
* Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t
382
+
* Erase Supend for their small Erase Blocks(0x8000)
383
+
*/
384
+
if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30)
385
+
return 1;
386
+
return 0;
377
387
}
378
388
379
389
static inline struct cfi_pri_intelext *
···
843
831
(mode == FL_WRITING && (cfip->SuspendCmdSupport & 1))))
844
832
goto sleep;
845
833
834
+
/* Do not allow suspend iff read/write to EB address */
835
+
if ((adr & chip->in_progress_block_mask) ==
836
+
chip->in_progress_block_addr)
837
+
goto sleep;
838
+
839
+
/* do not suspend small EBs, buggy Micron Chips */
840
+
if (cfi_is_micron_28F00AP30(cfi, chip) &&
841
+
(chip->in_progress_block_mask == ~(0x8000-1)))
842
+
goto sleep;
846
843
847
844
/* Erase suspend */
848
-
map_write(map, CMD(0xB0), adr);
845
+
map_write(map, CMD(0xB0), chip->in_progress_block_addr);
849
846
850
847
/* If the flash has finished erasing, then 'erase suspend'
851
848
* appears to make some (28F320) flash devices switch to
852
849
* 'read' mode. Make sure that we switch to 'read status'
853
850
* mode so we get the right data. --rmk
854
851
*/
855
-
map_write(map, CMD(0x70), adr);
852
+
map_write(map, CMD(0x70), chip->in_progress_block_addr);
856
853
chip->oldstate = FL_ERASING;
857
854
chip->state = FL_ERASE_SUSPENDING;
858
855
chip->erase_suspended = 1;
859
856
for (;;) {
860
-
status = map_read(map, adr);
857
+
status = map_read(map, chip->in_progress_block_addr);
861
858
if (map_word_andequal(map, status, status_OK, status_OK))
862
859
break;
863
860
···
1062
1041
sending the 0x70 (Read Status) command to an erasing
1063
1042
chip and expecting it to be ignored, that's what we
1064
1043
do. */
1065
-
map_write(map, CMD(0xd0), adr);
1066
-
map_write(map, CMD(0x70), adr);
1044
+
map_write(map, CMD(0xd0), chip->in_progress_block_addr);
1045
+
map_write(map, CMD(0x70), chip->in_progress_block_addr);
1067
1046
chip->oldstate = FL_READY;
1068
1047
chip->state = FL_ERASING;
1069
1048
break;
···
1954
1933
map_write(map, CMD(0xD0), adr);
1955
1934
chip->state = FL_ERASING;
1956
1935
chip->erase_suspended = 0;
1936
+
chip->in_progress_block_addr = adr;
1937
+
chip->in_progress_block_mask = ~(len - 1);
1957
1938
1958
1939
ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
1959
1940
adr, len,
+6
-3
drivers/mtd/chips/cfi_cmdset_0002.c
+6
-3
drivers/mtd/chips/cfi_cmdset_0002.c
···
816
816
(mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
817
817
goto sleep;
818
818
819
-
/* We could check to see if we're trying to access the sector
820
-
* that is currently being erased. However, no user will try
821
-
* anything like that so we just wait for the timeout. */
819
+
/* Do not allow suspend iff read/write to EB address */
820
+
if ((adr & chip->in_progress_block_mask) ==
821
+
chip->in_progress_block_addr)
822
+
goto sleep;
822
823
823
824
/* Erase suspend */
824
825
/* It's harmless to issue the Erase-Suspend and Erase-Resume
···
2268
2267
chip->state = FL_ERASING;
2269
2268
chip->erase_suspended = 0;
2270
2269
chip->in_progress_block_addr = adr;
2270
+
chip->in_progress_block_mask = ~(map->size - 1);
2271
2271
2272
2272
INVALIDATE_CACHE_UDELAY(map, chip,
2273
2273
adr, map->size,
···
2358
2356
chip->state = FL_ERASING;
2359
2357
chip->erase_suspended = 0;
2360
2358
chip->in_progress_block_addr = adr;
2359
+
chip->in_progress_block_mask = ~(len - 1);
2361
2360
2362
2361
INVALIDATE_CACHE_UDELAY(map, chip,
2363
2362
adr, len,
-3
drivers/mtd/nand/core.c
-3
drivers/mtd/nand/core.c
···
162
162
ret = nanddev_erase(nand, &pos);
163
163
if (ret) {
164
164
einfo->fail_addr = nanddev_pos_to_offs(nand, &pos);
165
-
einfo->state = MTD_ERASE_FAILED;
166
165
167
166
return ret;
168
167
}
169
168
170
169
nanddev_pos_next_eraseblock(nand, &pos);
171
170
}
172
-
173
-
einfo->state = MTD_ERASE_DONE;
174
171
175
172
return 0;
176
173
}
+8
-17
drivers/mtd/nand/raw/marvell_nand.c
+8
-17
drivers/mtd/nand/raw/marvell_nand.c
···
2299
2299
/*
2300
2300
* The legacy "num-cs" property indicates the number of CS on the only
2301
2301
* chip connected to the controller (legacy bindings does not support
2302
-
* more than one chip). CS are only incremented one by one while the RB
2303
-
* pin is always the #0.
2302
+
* more than one chip). The CS and RB pins are always the #0.
2304
2303
*
2305
2304
* When not using legacy bindings, a couple of "reg" and "nand-rb"
2306
2305
* properties must be filled. For each chip, expressed as a subnode,
2307
2306
* "reg" points to the CS lines and "nand-rb" to the RB line.
2308
2307
*/
2309
-
if (pdata) {
2308
+
if (pdata || nfc->caps->legacy_of_bindings) {
2310
2309
nsels = 1;
2311
-
} else if (nfc->caps->legacy_of_bindings &&
2312
-
!of_get_property(np, "num-cs", &nsels)) {
2313
-
dev_err(dev, "missing num-cs property\n");
2314
-
return -EINVAL;
2315
-
} else if (!of_get_property(np, "reg", &nsels)) {
2316
-
dev_err(dev, "missing reg property\n");
2317
-
return -EINVAL;
2318
-
}
2319
-
2320
-
if (!pdata)
2321
-
nsels /= sizeof(u32);
2322
-
if (!nsels) {
2323
-
dev_err(dev, "invalid reg property size\n");
2324
-
return -EINVAL;
2310
+
} else {
2311
+
nsels = of_property_count_elems_of_size(np, "reg", sizeof(u32));
2312
+
if (nsels <= 0) {
2313
+
dev_err(dev, "missing/invalid reg property\n");
2314
+
return -EINVAL;
2315
+
}
2325
2316
}
2326
2317
2327
2318
/* Alloc the nand chip structure */
+1
-1
drivers/mtd/nand/raw/tango_nand.c
+1
-1
drivers/mtd/nand/raw/tango_nand.c
+17
-2
drivers/mtd/spi-nor/cadence-quadspi.c
+17
-2
drivers/mtd/spi-nor/cadence-quadspi.c
···
501
501
void __iomem *reg_base = cqspi->iobase;
502
502
void __iomem *ahb_base = cqspi->ahb_base;
503
503
unsigned int remaining = n_rx;
504
+
unsigned int mod_bytes = n_rx % 4;
504
505
unsigned int bytes_to_read = 0;
506
+
u8 *rxbuf_end = rxbuf + n_rx;
505
507
int ret = 0;
506
508
507
509
writel(from_addr, reg_base + CQSPI_REG_INDIRECTRDSTARTADDR);
···
532
530
}
533
531
534
532
while (bytes_to_read != 0) {
533
+
unsigned int word_remain = round_down(remaining, 4);
534
+
535
535
bytes_to_read *= cqspi->fifo_width;
536
536
bytes_to_read = bytes_to_read > remaining ?
537
537
remaining : bytes_to_read;
538
-
ioread32_rep(ahb_base, rxbuf,
539
-
DIV_ROUND_UP(bytes_to_read, 4));
538
+
bytes_to_read = round_down(bytes_to_read, 4);
539
+
/* Read 4 byte word chunks then single bytes */
540
+
if (bytes_to_read) {
541
+
ioread32_rep(ahb_base, rxbuf,
542
+
(bytes_to_read / 4));
543
+
} else if (!word_remain && mod_bytes) {
544
+
unsigned int temp = ioread32(ahb_base);
545
+
546
+
bytes_to_read = mod_bytes;
547
+
memcpy(rxbuf, &temp, min((unsigned int)
548
+
(rxbuf_end - rxbuf),
549
+
bytes_to_read));
550
+
}
540
551
rxbuf += bytes_to_read;
541
552
remaining -= bytes_to_read;
542
553
bytes_to_read = cqspi_get_rd_sram_level(cqspi);
+1
include/linux/mtd/flashchip.h
+1
include/linux/mtd/flashchip.h