[U-Boot] fsl_elbc_nand bug

[U-Boot] fsl_elbc_nand bug

[Andrei Yakimov]

Hi, 
 I just found, if NAND ONFI parameter page first copy is 
bad, u-boot will never read extra copes: 

fsl_elbc_nand.c: 
 342                 out_be32(&lbc->fbcr, 256);  
 343                 ctrl->read_bytes = 256;

this code cause "read beyond buffer" error message:
 
nand_base.c:
   chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
3243         for (i = 0; i < 3; i++) {
3244                 for (j = 0; j < sizeof(*p); j++)
3245                         ((uint8_t *)p)[j] = chip->read_byte(mtd);
3246                 if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
3247                                 le16_to_cpu(p->crc)) {
3248                         break;
3249                 }
3250         }

Unfortunately I do not working with latest u-boot now,
so can not provide a patch,  read size should be increased to
at least 768 ( 3 copy mandatory for ONFI spec). Linux kernel should be
updated too.

I am also not expert for other NAND controllers drivers.

But first copy of ONFI parameter page CAN GO BAD. I seen it my self.

Andrei

[U-Boot] fsl_elbc_nand bug

[Scott Wood]

On Fri, 2015-05-15 at 14:48 -0700, Andrei Yakimov wrote:
> Hi, 
>  I just found, if NAND ONFI parameter page first copy is 
> bad, u-boot will never read extra copes: 
> 
> fsl_elbc_nand.c: 
>  342                 out_be32(&lbc->fbcr, 256);  
>  343                 ctrl->read_bytes = 256;
> 
> this code cause "read beyond buffer" error message:
>  
> nand_base.c:
>    chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
> 3243         for (i = 0; i < 3; i++) {
> 3244                 for (j = 0; j < sizeof(*p); j++)
> 3245                         ((uint8_t *)p)[j] = chip->read_byte(mtd);
> 3246                 if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
> 3247                                 le16_to_cpu(p->crc)) {
> 3248                         break;
> 3249                 }
> 3250         }
> 
> Unfortunately I do not working with latest u-boot now,
> so can not provide a patch,  read size should be increased to
> at least 768 ( 3 copy mandatory for ONFI spec). Linux kernel should be
> updated too.

Could you send a patch (both here and Linux)?  Especially since you have
a test case. :-)

Though a better fix than just increasing the byte count would be to add
a read_id() callback so that the NAND subsystem can actually tell the
driver how much data it's expecting, rather than forcing it to go
through cmdfunc that makes high-level drivers (poorly) emulate
low-level hardware.

> I am also not expert for other NAND controllers drivers.

At least IFC will have the same issue.

-Scott

[U-Boot] fsl_elbc_nand bug

[Andrei Yakimov]

I will try, It will take a while due to I am not working with 
latest code. I do have a chip with first 2 parameter blocks 
corrupted. So I can test it. I can not send it to Linux - 
I am not subscribed to any Linux mailing lists.
As of  patch structure:

1) separate READID and PARAM command.
2) READID will read 5 bytes as per ONFI spec.
3) PARAM command will read 768 bytes as per ONFI spec.

I will check is path to send read size are valid
for this command - but it will affect every NAND driver,
It is dangers changing. First approach is save, will
not eliminate other divers problems if they exist.
  

I will update only fsl_elbc_nand driver.

This is least invasive patch.

Should I get just master for generation of this patch?

Andrei.

On Mon, 2015-05-18 at 16:17 -0500, Scott Wood wrote:
> On Fri, 2015-05-15 at 14:48 -0700, Andrei Yakimov wrote:
> > Hi, 
> >  I just found, if NAND ONFI parameter page first copy is 
> > bad, u-boot will never read extra copes: 
> > 
> > fsl_elbc_nand.c: 
> >  342                 out_be32(&lbc->fbcr, 256);  
> >  343                 ctrl->read_bytes = 256;
> > 
> > this code cause "read beyond buffer" error message:
> >  
> > nand_base.c:
> >    chip->cmdfunc(mtd, NAND_CMD_PARAM, 0, -1);
> > 3243         for (i = 0; i < 3; i++) {
> > 3244                 for (j = 0; j < sizeof(*p); j++)
> > 3245                         ((uint8_t *)p)[j] = chip->read_byte(mtd);
> > 3246                 if (onfi_crc16(ONFI_CRC_BASE, (uint8_t *)p, 254) ==
> > 3247                                 le16_to_cpu(p->crc)) {
> > 3248                         break;
> > 3249                 }
> > 3250         }
> > 
> > Unfortunately I do not working with latest u-boot now,
> > so can not provide a patch,  read size should be increased to
> > at least 768 ( 3 copy mandatory for ONFI spec). Linux kernel should be
> > updated too.
> 
> Could you send a patch (both here and Linux)?  Especially since you have
> a test case. :-)
> 
> Though a better fix than just increasing the byte count would be to add
> a read_id() callback so that the NAND subsystem can actually tell the
> driver how much data it's expecting, rather than forcing it to go
> through cmdfunc that makes high-level drivers (poorly) emulate
> low-level hardware.
> 
> > I am also not expert for other NAND controllers drivers.
> 
> At least IFC will have the same issue.
> 
> -Scott
> 
> 

[U-Boot] fsl_elbc_nand bug

[Scott Wood]

On Mon, 2015-05-18 at 15:10 -0700, Andrei Yakimov wrote:
> I will try, It will take a while due to I am not working with 
> latest code. I do have a chip with first 2 parameter blocks 
> corrupted. So I can test it. I can not send it to Linux - 
> I am not subscribed to any Linux mailing lists.

You don't need to be subscribed to a list to send a patch (but it does
need to be based on the latest upstream tree).

> As of  patch structure:
> 
> 1) separate READID and PARAM command.
> 2) READID will read 5 bytes as per ONFI spec.
> 3) PARAM command will read 768 bytes as per ONFI spec.

> I will check is path to send read size are valid
> for this command - but it will affect every NAND driver,

It wouldn't affect every NAND driver.  There should be a default
implementation that calls cmdfunc, so that things work the same way as
now unless a driver overrides it.

-Scott