From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794062988; b=lD9/QwORqkRs7imWGGO5Zxh7ivrLsl/r5Ci9sPXCLYxy7duteIjRYK28b5Ekn5m8lKIl iW3i13I5T6fnCeEIKO28R0NQ1rn0iU/XaTUN0m2hRxhFwYcwKSCR+sIPhFiV8qAL+fDr7 7nwKpw1ytQsGWvqFlfW/g0X0rdyCwN6v6LTXl1OIU/SuOYH/RVHCzTqi++/asxn4Xkk9v SniiwIijjwsWNcCkCXxy88WXjr4uZPUGdGofr7iH7iQHTd9g78sGi/w/8m3gH13T86AI9 mu+N4Sc6TerNxTlMFR+aMdaAyyhQkB49C1vDKqDIzdAgHQQO5TBS35qrXp3aC9kzZHQ== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794062988; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=aVJaY6OakKoxV1PCilijmo2HyVfRF0yHsvahVXV20uA=; b=Iv9WFIlBNc/QVSXHwLH/QlzzLJEmzUZao1kpZ07y1H1XGMa+rSOUD2gMmd+D2Zn7n7hF zGO2vnTgYW3NT9e5cGxPxyftZzHviJZ3nqw4d/BiJIMHEJtw2altQ97FwNmB79VYRsKVo 3yYI7ofMH+sU5GKGckTGZ9AL5BJJXRA6zhwSnisAhMOeXx5zW/Aesh9Op4Z/GO0ctMzSq v3jKKfmL6UO2HwXlHExjATJ0DirkjF0H6mspQiEF1bK+rkERHJFkXHh5TYtIgSmVVIEzC aMNppW6EsMdCQzIHfIAMKVcUHLTtllm5lyj0X4LnZG/qPYpLgEIyXI0qstuBByDmlQA== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=IbV2nZU7; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C5596606A326; Sat, 7 Nov 2026 14:49:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=IbV2nZU7 Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15DE91F008A1; Sat, 7 Nov 2026 14:49:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1794062987; bh=aVJaY6OakKoxV1PCilijmo2HyVfRF0yHsvahVXV20uA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=IbV2nZU759AmLFQZPD4mBPVQkgeBOP40F3Z02Sr/pNq19XQTYcgrndMzfG1jAUDnV 7B5jQnQgEU714y4aP3NZRO2xyZoVrnu77jL1kfO0cqGoWcH+zzX2f/bw3/ODMpYVQE FeM0ZuHsUM0tm21xL4aFRVc85llfEqx04TNnykz8= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Orgad Shaneh , Miquel Raynal , Sasha Levin Subject: [PATCH 6.18 246/869] mtd: cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device Date: Sat, 7 Nov 2026 08:48:48 -0500 Message-ID: <20261107134900.132542660@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261107134852.069646174@linuxfoundation.org> References: <20261107134852.069646174@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Orgad Shaneh [ Upstream commit cfc5ebc9540e29f8f96db88bbfa261139e5afedb ] The Write to Buffer command takes the number of words to program minus one, and do_write_buffer() sends that count as a single bus word: map_write(map, CMD(words - 1), cmd_adr); CMD() replicates the value into every device lane, so each device reads the count off its own data lines - eight of them on an x8 part. A count that does not fit in eight bits is truncated there, which limits one Write to Buffer to 256 words on an x8 device, however large a buffer the chip advertises in its CFI query. The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8) advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers() split the data into 512-byte chunks and do_write_buffer() sent a count of 511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the program when the 257th arrived. Chunks below 256 bytes - the leading partial chunk of a write - completed normally, so only the full-size ones failed: MTD do_write_buffer_wait(): software timeout, address:0x03278bff. jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68 jffs2: No space for garbage collection. Aborting GC thread Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from MaxBufWriteSize before the fixups run. The clamp deliberately keys off the device width rather than the part, even though the driver already recognises this one in is_m29ew(): the ceiling comes from the width of a device's data bus, not from the chip, so any x8 device advertising a larger buffer is told a count it cannot receive. The M29EW is only where it was found. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-5 Signed-off-by: Orgad Shaneh Signed-off-by: Miquel Raynal Signed-off-by: Sasha Levin --- drivers/mtd/chips/cfi_cmdset_0002.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c index 7c91429a670bb..c8a82b1592c9d 100644 --- a/drivers/mtd/chips/cfi_cmdset_0002.c +++ b/drivers/mtd/chips/cfi_cmdset_0002.c @@ -283,6 +283,21 @@ static void fixup_use_write_buffers(struct mtd_info *mtd) pr_debug("Using buffer write method\n"); mtd->_write = cfi_amdstd_write_buffers; } + + /* + * The word count of the Write to Buffer command is a single bus + * word per device, so an x8 device can be told to program at most + * 256 bytes however large a buffer it advertises - including when + * several of them are interleaved on a wider bus, where CMD() + * replicates the count into each device's lane and it is truncated + * there. + */ + if (cfi->device_type == CFI_DEVICETYPE_X8 && + cfi->cfiq->MaxBufWriteSize > 8) { + cfi->cfiq->MaxBufWriteSize = 8; + mtd->writebufsize = cfi_interleave(cfi) << + cfi->cfiq->MaxBufWriteSize; + } } #endif /* !FORCE_WORD_WRITE */ -- 2.53.0