[PATCH 0/2] mtd: rawnand: vf610_nfc: fix the OOB of written pages and the command completion

[PATCH 0/2] mtd: rawnand: vf610_nfc: fix the OOB of written pages and the command completion

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

Two pre-existing issues found while checking the Sashiko report Miquel
pointed at on the large-OOB series [1]; they are independent of that
fix, so they come separately.

The first has been there since the ->exec_op() conversion: the ECC page
write transfers the spare area out of the controller SRAM but nothing
ever puts chip->oob_poi there, so every written page gets whatever the
previous transfer left behind as its OOB. The second is as old as the
driver: a command that timed out can still complete cmd_done from its
late interrupt, and the next command then returns before the hardware
is done.

Tested on a Colibri VF50 and a Colibri VF61 on top of the large-OOB v2
series: UBIFS write/read-back intact, clean ECC counters.

[1] https://lore.kernel.org/linux-mtd/20260818114208.2780311-1-mehmet.fide@gmail.com/


Mehmet Fide (2):
  mtd: rawnand: vf610_nfc: write the OOB bytes on page writes
  mtd: rawnand: vf610_nfc: rearm the completion before starting a
    command

 drivers/mtd/nand/raw/vf610_nfc.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.54.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 1/2] mtd: rawnand: vf610_nfc: write the OOB bytes on page writes

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

The ECC page write transfers writesize plus the spare area from the
controller SRAM, but only the data half of the SRAM buffer is filled:
the conversion to ->exec_op() dropped the vf610_nfc_write_buf() call
that used to copy chip->oob_poi, so whatever the previous transfer left
in the spare region of the buffer is programmed into the OOB of every
written page. User OOB data is silently lost and the free OOB bytes of
a freshly written page read back as leftovers of an earlier page.

Copy the spare bytes into the SRAM buffer before starting the program
operation. The copy is unconditional: the NAND core fills chip->oob_poi
with 0xff when the caller writes no OOB, and the ECC engine overwrites
the parity region on its way to the flash, so this also stops the
stale-buffer leak into the free bytes.

Fixes: 1cbe30b0ddc7 ("mtd: rawnand: vf610_nfc: make use of ->exec_op()")
Cc: stable@vger.kernel.org
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
---
 drivers/mtd/nand/raw/vf610_nfc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/nand/raw/vf610_nfc.c b/drivers/mtd/nand/raw/vf610_nfc.c
index ffcf66f96c7f..f831780d6fff 100644
--- a/drivers/mtd/nand/raw/vf610_nfc.c
+++ b/drivers/mtd/nand/raw/vf610_nfc.c
@@ -633,6 +633,9 @@ static int vf610_nfc_write_page(struct nand_chip *chip, const uint8_t *buf,
 	 */
 	vf610_nfc_wr_to_sram(nfc->regs + NFC_MAIN_AREA(0), buf,
 			     mtd->writesize, false);
+	/* Fill the spare area too; oob_poi is 0xff when the caller writes no OOB */
+	vf610_nfc_wr_to_sram(nfc->regs + NFC_MAIN_AREA(0) + mtd->writesize,
+			     chip->oob_poi, vf610_nfc_spare_size(mtd), false);
 
 	code |= COMMAND_RB_HANDSHAKE;
 	cmd2 |= code << CMD_CODE_SHIFT;
-- 
2.54.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

[PATCH 2/2] mtd: rawnand: vf610_nfc: rearm the completion before starting a command

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@screeningeagle.com>

When a command times out, its interrupt may still arrive later and
complete cmd_done. The next command then sees the completion already
done and vf610_nfc_done() returns before the controller has finished,
so the caller reads the SRAM buffer of an unfinished transfer.

Reinitialize the completion before starting the command, so the wait
can only be satisfied by the interrupt of the command it belongs to.

Fixes: 456930d80a2d ("mtd: nand: vf610_nfc: Freescale NFC for VF610, MPC5125 and others")
Cc: stable@vger.kernel.org
Signed-off-by: Mehmet Fide <mehmet.fide@screeningeagle.com>
---
 drivers/mtd/nand/raw/vf610_nfc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/nand/raw/vf610_nfc.c b/drivers/mtd/nand/raw/vf610_nfc.c
index f831780d6fff..f88c7b45bcbc 100644
--- a/drivers/mtd/nand/raw/vf610_nfc.c
+++ b/drivers/mtd/nand/raw/vf610_nfc.c
@@ -291,6 +291,9 @@ static void vf610_nfc_done(struct vf610_nfc *nfc)
 {
 	unsigned long timeout = msecs_to_jiffies(100);
 
+	/* A late interrupt of a timed-out command may have completed this already */
+	reinit_completion(&nfc->cmd_done);
+
 	/*
 	 * Barrier is needed after this write. This write need
 	 * to be done before reading the next register the first
-- 
2.54.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/