mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00

'commit18bcb4aa54
("mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`")' introduced a bug where only one byte of data is written, regardless of the number of bytes passed to sst_nor_write_data(), causing a kernel crash during the write operation. Ensure the correct number of bytes are written as passed to sst_nor_write_data(). Call trace: [ 57.400180] ------------[ cut here ]------------ [ 57.404842] While writing 2 byte written 1 bytes [ 57.409493] WARNING: CPU: 0 PID: 737 at drivers/mtd/spi-nor/sst.c:187 sst_nor_write_data+0x6c/0x74 [ 57.418464] Modules linked in: [ 57.421517] CPU: 0 UID: 0 PID: 737 Comm: mtd_debug Not tainted 6.12.0-g5ad04afd91f9 #30 [ 57.429517] Hardware name: Xilinx Versal A2197 Processor board revA - x-prc-02 revA (DT) [ 57.437600] pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) [ 57.444557] pc : sst_nor_write_data+0x6c/0x74 [ 57.448911] lr : sst_nor_write_data+0x6c/0x74 [ 57.453264] sp : ffff80008232bb40 [ 57.456570] x29: ffff80008232bb40 x28: 0000000000010000 x27: 0000000000000001 [ 57.463708] x26: 000000000000ffff x25: 0000000000000000 x24: 0000000000000000 [ 57.470843] x23: 0000000000010000 x22: ffff80008232bbf0 x21: ffff000816230000 [ 57.477978] x20: ffff0008056c0080 x19: 0000000000000002 x18: 0000000000000006 [ 57.485112] x17: 0000000000000000 x16: 0000000000000000 x15: ffff80008232b580 [ 57.492246] x14: 0000000000000000 x13: ffff8000816d1530 x12: 00000000000004a4 [ 57.499380] x11: 000000000000018c x10: ffff8000816fd530 x9 : ffff8000816d1530 [ 57.506515] x8 : 00000000fffff7ff x7 : ffff8000816fd530 x6 : 0000000000000001 [ 57.513649] x5 : 0000000000000000 x4 : 0000000000000000 x3 : 0000000000000000 [ 57.520782] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff0008049b0000 [ 57.527916] Call trace: [ 57.530354] sst_nor_write_data+0x6c/0x74 [ 57.534361] sst_nor_write+0xb4/0x18c [ 57.538019] mtd_write_oob_std+0x7c/0x88 [ 57.541941] mtd_write_oob+0x70/0xbc [ 57.545511] mtd_write+0x68/0xa8 [ 57.548733] mtdchar_write+0x10c/0x290 [ 57.552477] vfs_write+0xb4/0x3a8 [ 57.555791] ksys_write+0x74/0x10c [ 57.559189] __arm64_sys_write+0x1c/0x28 [ 57.563109] invoke_syscall+0x54/0x11c [ 57.566856] el0_svc_common.constprop.0+0xc0/0xe0 [ 57.571557] do_el0_svc+0x1c/0x28 [ 57.574868] el0_svc+0x30/0xcc [ 57.577921] el0t_64_sync_handler+0x120/0x12c [ 57.582276] el0t_64_sync+0x190/0x194 [ 57.585933] ---[ end trace 0000000000000000 ]--- Cc: stable@vger.kernel.org Fixes:18bcb4aa54
("mtd: spi-nor: sst: Factor out common write operation to `sst_nor_write_data()`") Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org> Reviewed-by: Bence Csókás <csokas.bence@prolan.hu> [pratyush@kernel.org: add Cc stable tag] Signed-off-by: Pratyush Yadav <pratyush@kernel.org> Link: https://lore.kernel.org/r/20250213054546.2078121-1-amit.kumar-mahapatra@amd.com
272 lines
6.2 KiB
C
272 lines
6.2 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2005, Intec Automation Inc.
|
|
* Copyright (C) 2014, Freescale Semiconductor, Inc.
|
|
*/
|
|
|
|
#include <linux/mtd/spi-nor.h>
|
|
|
|
#include "core.h"
|
|
|
|
/* SST flash_info mfr_flag. Used to specify SST byte programming. */
|
|
#define SST_WRITE BIT(0)
|
|
|
|
#define SST26VF_CR_BPNV BIT(3)
|
|
|
|
static int sst26vf_nor_lock(struct spi_nor *nor, loff_t ofs, u64 len)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static int sst26vf_nor_unlock(struct spi_nor *nor, loff_t ofs, u64 len)
|
|
{
|
|
int ret;
|
|
|
|
/* We only support unlocking the entire flash array. */
|
|
if (ofs != 0 || len != nor->params->size)
|
|
return -EINVAL;
|
|
|
|
ret = spi_nor_read_cr(nor, nor->bouncebuf);
|
|
if (ret)
|
|
return ret;
|
|
|
|
if (!(nor->bouncebuf[0] & SST26VF_CR_BPNV)) {
|
|
dev_dbg(nor->dev, "Any block has been permanently locked\n");
|
|
return -EINVAL;
|
|
}
|
|
|
|
return spi_nor_global_block_unlock(nor);
|
|
}
|
|
|
|
static int sst26vf_nor_is_locked(struct spi_nor *nor, loff_t ofs, u64 len)
|
|
{
|
|
return -EOPNOTSUPP;
|
|
}
|
|
|
|
static const struct spi_nor_locking_ops sst26vf_nor_locking_ops = {
|
|
.lock = sst26vf_nor_lock,
|
|
.unlock = sst26vf_nor_unlock,
|
|
.is_locked = sst26vf_nor_is_locked,
|
|
};
|
|
|
|
static int sst26vf_nor_late_init(struct spi_nor *nor)
|
|
{
|
|
nor->params->locking_ops = &sst26vf_nor_locking_ops;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct spi_nor_fixups sst26vf_nor_fixups = {
|
|
.late_init = sst26vf_nor_late_init,
|
|
};
|
|
|
|
static const struct flash_info sst_nor_parts[] = {
|
|
{
|
|
.id = SNOR_ID(0x62, 0x16, 0x12),
|
|
.name = "sst25wf020a",
|
|
.size = SZ_256K,
|
|
.flags = SPI_NOR_HAS_LOCK,
|
|
.no_sfdp_flags = SECT_4K,
|
|
}, {
|
|
.id = SNOR_ID(0x62, 0x16, 0x13),
|
|
.name = "sst25wf040b",
|
|
.size = SZ_512K,
|
|
.flags = SPI_NOR_HAS_LOCK,
|
|
.no_sfdp_flags = SECT_4K,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x01),
|
|
.name = "sst25wf512",
|
|
.size = SZ_64K,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x02),
|
|
.name = "sst25wf010",
|
|
.size = SZ_128K,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x03),
|
|
.name = "sst25wf020",
|
|
.size = SZ_256K,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x04),
|
|
.name = "sst25wf040",
|
|
.size = SZ_512K,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x05),
|
|
.name = "sst25wf080",
|
|
.size = SZ_1M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x41),
|
|
.name = "sst25vf016b",
|
|
.size = SZ_2M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x4a),
|
|
.name = "sst25vf032b",
|
|
.size = SZ_4M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x4b),
|
|
.name = "sst25vf064c",
|
|
.size = SZ_8M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_4BIT_BP | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x8d),
|
|
.name = "sst25vf040b",
|
|
.size = SZ_512K,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x25, 0x8e),
|
|
.name = "sst25vf080b",
|
|
.size = SZ_1M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K,
|
|
.mfr_flags = SST_WRITE,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x26, 0x41),
|
|
.name = "sst26vf016b",
|
|
.size = SZ_2M,
|
|
.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x26, 0x42),
|
|
.name = "sst26vf032b",
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.fixups = &sst26vf_nor_fixups,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x26, 0x43),
|
|
.name = "sst26vf064b",
|
|
.size = SZ_8M,
|
|
.flags = SPI_NOR_HAS_LOCK | SPI_NOR_SWP_IS_VOLATILE,
|
|
.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
|
|
.fixups = &sst26vf_nor_fixups,
|
|
}, {
|
|
.id = SNOR_ID(0xbf, 0x26, 0x51),
|
|
.name = "sst26wf016b",
|
|
.size = SZ_2M,
|
|
.no_sfdp_flags = SECT_4K | SPI_NOR_DUAL_READ | SPI_NOR_QUAD_READ,
|
|
}
|
|
};
|
|
|
|
static int sst_nor_write_data(struct spi_nor *nor, loff_t to, size_t len,
|
|
const u_char *buf)
|
|
{
|
|
u8 op = (len == 1) ? SPINOR_OP_BP : SPINOR_OP_AAI_WP;
|
|
int ret;
|
|
|
|
nor->program_opcode = op;
|
|
ret = spi_nor_write_data(nor, to, len, buf);
|
|
if (ret < 0)
|
|
return ret;
|
|
WARN(ret != len, "While writing %zu byte written %i bytes\n", len, ret);
|
|
|
|
return spi_nor_wait_till_ready(nor);
|
|
}
|
|
|
|
static int sst_nor_write(struct mtd_info *mtd, loff_t to, size_t len,
|
|
size_t *retlen, const u_char *buf)
|
|
{
|
|
struct spi_nor *nor = mtd_to_spi_nor(mtd);
|
|
size_t actual = 0;
|
|
int ret;
|
|
|
|
dev_dbg(nor->dev, "to 0x%08x, len %zd\n", (u32)to, len);
|
|
|
|
ret = spi_nor_prep_and_lock(nor);
|
|
if (ret)
|
|
return ret;
|
|
|
|
ret = spi_nor_write_enable(nor);
|
|
if (ret)
|
|
goto out;
|
|
|
|
nor->sst_write_second = false;
|
|
|
|
/* Start write from odd address. */
|
|
if (to % 2) {
|
|
/* write one byte. */
|
|
ret = sst_nor_write_data(nor, to, 1, buf);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
to++;
|
|
actual++;
|
|
}
|
|
|
|
/* Write out most of the data here. */
|
|
for (; actual < len - 1; actual += 2) {
|
|
/* write two bytes. */
|
|
ret = sst_nor_write_data(nor, to, 2, buf + actual);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
to += 2;
|
|
nor->sst_write_second = true;
|
|
}
|
|
nor->sst_write_second = false;
|
|
|
|
ret = spi_nor_write_disable(nor);
|
|
if (ret)
|
|
goto out;
|
|
|
|
ret = spi_nor_wait_till_ready(nor);
|
|
if (ret)
|
|
goto out;
|
|
|
|
/* Write out trailing byte if it exists. */
|
|
if (actual != len) {
|
|
ret = spi_nor_write_enable(nor);
|
|
if (ret)
|
|
goto out;
|
|
|
|
ret = sst_nor_write_data(nor, to, 1, buf + actual);
|
|
if (ret < 0)
|
|
goto out;
|
|
|
|
actual += 1;
|
|
|
|
ret = spi_nor_write_disable(nor);
|
|
}
|
|
out:
|
|
*retlen += actual;
|
|
spi_nor_unlock_and_unprep(nor);
|
|
return ret;
|
|
}
|
|
|
|
static int sst_nor_late_init(struct spi_nor *nor)
|
|
{
|
|
if (nor->info->mfr_flags & SST_WRITE)
|
|
nor->mtd._write = sst_nor_write;
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct spi_nor_fixups sst_nor_fixups = {
|
|
.late_init = sst_nor_late_init,
|
|
};
|
|
|
|
const struct spi_nor_manufacturer spi_nor_sst = {
|
|
.name = "sst",
|
|
.parts = sst_nor_parts,
|
|
.nparts = ARRAY_SIZE(sst_nor_parts),
|
|
.fixups = &sst_nor_fixups,
|
|
};
|