[PATCH] [mtd] gpio_flash: fix the bug in handling gpio flash read/write when offset + len from mtd exceeds the window size

[PATCH] [mtd] gpio_flash: fix the bug in handling gpio flash read/write when offset + len from mtd exceeds the window size

[Aaron Wu]

Signed-off-by: Aaron Wu <Aaron.wu@analog.com>

fix the bug in handling gpio flash read/write when offset + len
from mtd exceeds the window size
---
 drivers/mtd/maps/gpio-addr-flash.c |   43 ++++++++++++++++++++++++------------
 1 file changed, 29 insertions(+), 14 deletions(-)

diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index a4c477b..947631a 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -99,22 +99,29 @@ static map_word gf_read(struct map_info *map, unsigned long ofs)
  *	@from: flash offset to copy from
  *	@len:  how much to copy
  *
- * We rely on the MTD layer to chunk up copies such that a single request here
- * will not cross a window size.  This allows us to only wiggle the GPIOs once
- * before falling back to a normal memcpy.  Reading the higher layer code shows
- * that this is indeed the case, but add a BUG_ON() to future proof.
+ *Toggle the correct GPIO according to @from to enable the right flash bank,
+ *still the read offset plus len may execceds the actual Window size,when
+ *this happnes, reverts the value for multiple read until all data is read.
  */
 static void gf_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
 {
 	struct async_state *state = gf_map_info_to_state(map);
 
-	gf_set_gpios(state, from);
+	int this_len;
 
-	/* BUG if operation crosses the win_size */
-	BUG_ON(!((from + len) % state->win_size <= (from + len)));
+	while (len) {
+		if ((from % state->win_size) + len > state->win_size)
+			this_len = state->win_size - (from % state->win_size);
+		else
+			this_len = len;
 
-	/* operation does not cross the win_size, so one shot it */
-	memcpy_fromio(to, map->virt + (from % state->win_size), len);
+		gf_set_gpios(state, from);
+		memcpy_fromio(to, map->virt + (from % state->win_size),
+			 this_len);
+		len -= this_len;
+		from += this_len;
+		to += this_len;
+	}
 }
 
 /**
@@ -147,13 +154,21 @@ static void gf_copy_to(struct map_info *map, unsigned long to,
 {
 	struct async_state *state = gf_map_info_to_state(map);
 
-	gf_set_gpios(state, to);
+	int this_len;
+
+	while (len) {
+		if ((to % state->win_size) + len > state->win_size)
+			this_len = state->win_size - (to % state->win_size);
+		else
+			this_len = len;
 
-	/* BUG if operation crosses the win_size */
-	BUG_ON(!((to + len) % state->win_size <= (to + len)));
+		gf_set_gpios(state, to);
+		memcpy_toio(map->virt + (to % state->win_size), from, len);
 
-	/* operation does not cross the win_size, so one shot it */
-	memcpy_toio(map->virt + (to % state->win_size), from, len);
+		len -= this_len;
+		to += this_len;
+		from += this_len;
+	}
 }
 
 static const char * const part_probe_types[] = {
-- 
1.7.9.5

Re: [PATCH] [mtd] gpio_flash: fix the bug in handling gpio flash read/write when offset + len from mtd exceeds the window size

[Brian Norris]

On Thu, Aug 07, 2014 at 11:43:49AM +0800, Aaron Wu wrote:
> Signed-off-by: Aaron Wu <Aaron.wu@analog.com>
> 
> fix the bug in handling gpio flash read/write when offset + len
> from mtd exceeds the window size

Typically, you should have the commit message comments before the
'Signed-off-by'.

> ---
>  drivers/mtd/maps/gpio-addr-flash.c |   43 ++++++++++++++++++++++++------------
>  1 file changed, 29 insertions(+), 14 deletions(-)
> 
> diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
> index a4c477b..947631a 100644
> --- a/drivers/mtd/maps/gpio-addr-flash.c
> +++ b/drivers/mtd/maps/gpio-addr-flash.c
> @@ -99,22 +99,29 @@ static map_word gf_read(struct map_info *map, unsigned long ofs)
>   *	@from: flash offset to copy from
>   *	@len:  how much to copy
>   *
> - * We rely on the MTD layer to chunk up copies such that a single request here
> - * will not cross a window size.  This allows us to only wiggle the GPIOs once
> - * before falling back to a normal memcpy.  Reading the higher layer code shows
> - * that this is indeed the case, but add a BUG_ON() to future proof.
> + *Toggle the correct GPIO according to @from to enable the right flash bank,
> + *still the read offset plus len may execceds the actual Window size,when
> + *this happnes, reverts the value for multiple read until all data is read.
>   */

The spacing and wording is a little off, so I reworded this. Queued to
l2-mtd.git/next, with the following diff applied:

diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 947631a329f7..2fb346091af2 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -99,9 +99,8 @@ static map_word gf_read(struct map_info *map, unsigned long ofs)
  *	@from: flash offset to copy from
  *	@len:  how much to copy
  *
- *Toggle the correct GPIO according to @from to enable the right flash bank,
- *still the read offset plus len may execceds the actual Window size,when
- *this happnes, reverts the value for multiple read until all data is read.
+ * The "from" region may straddle more than one window, so toggle the GPIOs for
+ * each window region before reading its data.
  */
 static void gf_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
 {

Thanks,
Brian