From 1a57b13e6017d2af575f4f42e848aa0b64d4bcf1 Mon Sep 17 00:00:00 2001 From: Stefan Riedmueller Date: Fri, 25 Jun 2021 14:38:21 +0200 Subject: mtd: rawnand: nand_bbt: Skip bad blocks when searching for the BBT in NAND The blocks containing the bad block table can become bad as well. So make sure to skip any blocks that are marked bad when searching for the bad block table. Otherwise in very rare cases where two BBT blocks wear out it might happen that an obsolete BBT is used instead of a newer available version. This only applies to drivers which make use of a bad block marker in flash. Other drivers won't be able to identify bad BBT blocks and thus can't skip these. Signed-off-by: Stefan Riedmueller Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210625123821.207458-1-s.riedmueller@phytec.de --- drivers/mtd/nand/raw/nand_bbt.c | 33 +++++++++++++++++++++++++++++++++ 1 file changed, 33 insertions(+) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c index dced32a126d9..b7ad030225f8 100644 --- a/drivers/mtd/nand/raw/nand_bbt.c +++ b/drivers/mtd/nand/raw/nand_bbt.c @@ -447,6 +447,35 @@ static int scan_block_fast(struct nand_chip *this, struct nand_bbt_descr *bd, return 0; } +/* Check if a potential BBT block is marked as bad */ +static int bbt_block_checkbad(struct nand_chip *this, struct nand_bbt_descr *td, + loff_t offs, uint8_t *buf) +{ + struct nand_bbt_descr *bd = this->badblock_pattern; + + /* + * No need to check for a bad BBT block if the BBM area overlaps with + * the bad block table marker area in OOB since writing a BBM here + * invalidates the bad block table marker anyway. + */ + if (!(td->options & NAND_BBT_NO_OOB) && + td->offs >= bd->offs && td->offs < bd->offs + bd->len) + return 0; + + /* + * There is no point in checking for a bad block marker if writing + * such marker is not supported + */ + if (this->bbt_options & NAND_BBT_NO_OOB_BBM || + this->options & NAND_NO_BBM_QUIRK) + return 0; + + if (scan_block_fast(this, bd, offs, buf) > 0) + return 1; + + return 0; +} + /** * create_bbt - [GENERIC] Create a bad block table by scanning the device * @this: NAND chip object @@ -560,6 +589,10 @@ static int search_bbt(struct nand_chip *this, uint8_t *buf, int actblock = startblock + dir * block; loff_t offs = (loff_t)actblock << this->bbt_erase_shift; + /* Check if block is marked bad */ + if (bbt_block_checkbad(this, td, offs, buf)) + continue; + /* Read first page */ scan_read(this, buf, offs, mtd->writesize, td); if (!check_pattern(buf, scanlen, mtd->writesize, td)) { -- cgit v1.2.3 From 8363dfc845d74b980e109111b82f0a72aa92e47a Mon Sep 17 00:00:00 2001 From: Miquel Raynal Date: Tue, 29 Jun 2021 21:51:57 +0200 Subject: mtd: spinand: Fix comment This is a copy paste error, checking the ECC status finishes a page read here, not a page write. Fixes: 945845b54c9c ("mtd: spinand: Instantiate a SPI-NAND on-die ECC engine") Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210629195157.567828-1-miquel.raynal@bootlin.com --- drivers/mtd/nand/spi/core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c index 446ba8d43fbc..4af32cfcbd96 100644 --- a/drivers/mtd/nand/spi/core.c +++ b/drivers/mtd/nand/spi/core.c @@ -307,7 +307,7 @@ static int spinand_ondie_ecc_finish_io_req(struct nand_device *nand, if (req->type == NAND_PAGE_WRITE) return 0; - /* Finish a page write: check the status, report errors/bitflips */ + /* Finish a page read: check the status, report errors/bitflips */ ret = spinand_check_ecc_status(spinand, engine_conf->status); if (ret == -EBADMSG) mtd->ecc_stats.failed++; -- cgit v1.2.3 From c5b9ee9c361f52cd319135b9ec7fe684d5e2e026 Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Sun, 4 Jul 2021 10:47:05 +0100 Subject: mtd: rawnand: Fix a couple of spelling mistakes in Kconfig There are two spelling mistakes in the Kconfig text. Fix them. Signed-off-by: Colin Ian King Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210704094705.37175-1-colin.king@canonical.com --- drivers/mtd/nand/raw/Kconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/Kconfig b/drivers/mtd/nand/raw/Kconfig index 630728de4b7c..67b7cb67c030 100644 --- a/drivers/mtd/nand/raw/Kconfig +++ b/drivers/mtd/nand/raw/Kconfig @@ -480,9 +480,9 @@ config MTD_NAND_RICOH select MTD_SM_COMMON help Enable support for Ricoh R5C852 xD card reader - You also need to enable ether + You also need to enable either NAND SSFDC (SmartMedia) read only translation layer' or new - expermental, readwrite + experimental, readwrite 'SmartMedia/xD new translation layer' config MTD_NAND_DISKONCHIP -- cgit v1.2.3 From df12a75a2be915e7c419707bc71fba0fa7548d81 Mon Sep 17 00:00:00 2001 From: Daniel Palmer Date: Thu, 17 Jun 2021 20:08:42 +0900 Subject: mtd: spinand: core: Properly fill the OOB area. The comment in spinand_write_to_cache_op() says that spinand_ondie_ecc_prepare_io_req() should 0xff fill the OOB area but it doesn't. This causes the OOB area to get filled with zeros and anytime the first page in a block the bad block marker is cleared and it becomes a bad block on the next boot. This was observed on Longsys FORSEE branded parts and might be specific to these parts. Signed-off-by: Daniel Palmer Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210617110842.2358461-1-daniel@0x0f.com --- drivers/mtd/nand/spi/core.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c index 4af32cfcbd96..2c8685f1f2fa 100644 --- a/drivers/mtd/nand/spi/core.c +++ b/drivers/mtd/nand/spi/core.c @@ -288,6 +288,8 @@ static int spinand_ondie_ecc_prepare_io_req(struct nand_device *nand, struct spinand_device *spinand = nand_to_spinand(nand); bool enable = (req->mode != MTD_OPS_RAW); + memset(spinand->oobbuf, 0xff, nanddev_per_page_oobsize(nand)); + /* Only enable or disable the engine */ return spinand_ecc_enable(spinand, enable); } -- cgit v1.2.3 From 014665ffd7e84bb2f18912f7285190090e218e4c Mon Sep 17 00:00:00 2001 From: Vladimir Molokov Date: Sun, 1 Aug 2021 22:59:09 +0200 Subject: mtd: rawnand: omap: Fix kernel doc warning on 'calcuate' typo Fix a trivial typo which is reported after enabling W=1 level of warnings: drivers/mtd/nand/raw/omap2.c:927: warning: expecting prototype for omap_calcuate_ecc(). Prototype was for omap_calculate_ecc() instead Signed-off-by: Vladimir Molokov Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210801205909.7102-1-vladimir@molokov.se --- drivers/mtd/nand/raw/omap2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/omap2.c b/drivers/mtd/nand/raw/omap2.c index b1839eef5b65..b26d4947af02 100644 --- a/drivers/mtd/nand/raw/omap2.c +++ b/drivers/mtd/nand/raw/omap2.c @@ -911,7 +911,7 @@ static int omap_correct_data(struct nand_chip *chip, u_char *dat, } /** - * omap_calcuate_ecc - Generate non-inverted ECC bytes. + * omap_calculate_ecc - Generate non-inverted ECC bytes. * @chip: NAND chip object * @dat: The pointer to data on which ecc is computed * @ecc_code: The ecc_code buffer -- cgit v1.2.3 From 74a021a632b07dd990e85e815b8757921b23db4b Mon Sep 17 00:00:00 2001 From: Jason Wang Date: Tue, 3 Aug 2021 19:33:00 +0800 Subject: mtd: rawnand: remove never changed ret variable The ret variable used for returning value in the function `meson_nfc_rw_cmd_prepare_and_execute` is never change after initialising. Therefore, we can remove it safely and return 0 at the end of the function. Signed-off-by: Jason Wang Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210803113300.24230-1-wangborong@cdjrlc.com --- drivers/mtd/nand/raw/meson_nand.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/meson_nand.c b/drivers/mtd/nand/raw/meson_nand.c index 817bddccb775..ac3be92872d0 100644 --- a/drivers/mtd/nand/raw/meson_nand.c +++ b/drivers/mtd/nand/raw/meson_nand.c @@ -580,7 +580,7 @@ static int meson_nfc_rw_cmd_prepare_and_execute(struct nand_chip *nand, u32 *addrs = nfc->cmdfifo.rw.addrs; u32 cs = nfc->param.chip_select; u32 cmd0, cmd_num, row_start; - int ret = 0, i; + int i; cmd_num = sizeof(struct nand_rw_cmd) / sizeof(int); @@ -620,7 +620,7 @@ static int meson_nfc_rw_cmd_prepare_and_execute(struct nand_chip *nand, meson_nfc_cmd_idle(nfc, nfc->timing.tadl); } - return ret; + return 0; } static int meson_nfc_write_page_sub(struct nand_chip *nand, -- cgit v1.2.3 From 6bc219b7b2cdd9d45ea15926d32c5e5c1d63881e Mon Sep 17 00:00:00 2001 From: Ezequiel Garcia Date: Sun, 1 Aug 2021 20:45:07 -0300 Subject: mtdblock: Update old JFFS2 mention in Kconfig JFFS2 can be mounted without 'mtdblock' since a really, really long time. Some git-log archaeology shows that in 2006 it was possible to use 'root=' to mount a JFFS2 rootfs: commit e9482b4374e2596e6f3f1ab30c4ea469f4ac6311 Author: Joern Engel Date: Tue May 30 14:25:46 2006 +0200 [MTD] Allow alternate JFFS2 mount variant for root filesystem. With this patch, "root=mtd3" and "root=mtd:foo" work for a JFFS2 rootfs. However, there are still plenty of tutorials that mention mtdblock, so users are still taking this route. Update the Kconfig to reflect this is no longer needed. Signed-off-by: Ezequiel Garcia Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210801234509.18774-6-ezequiel@collabora.com --- drivers/mtd/Kconfig | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig index 8bab6f8718a9..3a1f87def25b 100644 --- a/drivers/mtd/Kconfig +++ b/drivers/mtd/Kconfig @@ -45,10 +45,9 @@ config MTD_BLOCK on RAM chips in this manner. This block device is a user of MTD devices performing that function. - At the moment, it is also required for the Journalling Flash File - System(s) to obtain a handle on the MTD device when it's mounted - (although JFFS and JFFS2 don't actually use any of the functionality - of the mtdblock device). + Note that mounting a JFFS2 filesystem doesn't require using mtdblock. + It's possible to mount a rootfs using the MTD device on the "root=" + bootargs as "root=mtd2" or "root=mtd:name_of_device". Later, it may be extended to perform read/erase/modify/write cycles on flash chips to emulate a smaller block size. Needless to say, -- cgit v1.2.3 From 42ba8c3b426342b39341e1b7a97f2387821bff86 Mon Sep 17 00:00:00 2001 From: Ezequiel Garcia Date: Sun, 1 Aug 2021 20:45:08 -0300 Subject: mtdblock: Add comment about UBI block devices There is a surprisingly large number of tutorials that suggest using mtdblock to mount SquashFS filesystems on flash devices, including NAND devices. Given this approach is suboptimal than using UBI, and given the UBI block device layer was introduced many years ago specifically with this use case in mind, add a small comment inviting users and developers to consider UBI block. Signed-off-by: Ezequiel Garcia Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210801234509.18774-7-ezequiel@collabora.com --- drivers/mtd/Kconfig | 3 +++ 1 file changed, 3 insertions(+) (limited to 'drivers/mtd') diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig index 3a1f87def25b..796a2eccbef0 100644 --- a/drivers/mtd/Kconfig +++ b/drivers/mtd/Kconfig @@ -69,6 +69,9 @@ config MTD_BLOCK_RO You do not need this option for use with the DiskOnChip devices. For those, enable NFTL support (CONFIG_NFTL) instead. +comment "Note that in some cases UBI block is preferred. See MTD_UBI_BLOCK." + depends on MTD_BLOCK || MTD_BLOCK_RO + config FTL tristate "FTL (Flash Translation Layer) support" depends on BLOCK -- cgit v1.2.3 From 6f802696c2faf0119781fc3b7977a4eedf9ab239 Mon Sep 17 00:00:00 2001 From: Jaime Liao Date: Mon, 9 Aug 2021 09:27:52 +0800 Subject: mtd: spinand: macronix: Add Quad support for serial NAND flash Adding FLAG "SPINAND_HAS_QE_BIT" for Quad mode support on Macronix Serial Flash. Validated via normal(default) and QUAD mode by read, erase, read back, on Xilinx Zynq PicoZed FPGA board which included Macronix SPI Host(drivers/spi/spi-mxic.c). Signed-off-by: Jaime Liao Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/1628472472-32008-1-git-send-email-jaimeliao@mxic.com.tw --- drivers/mtd/nand/spi/macronix.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/spi/macronix.c b/drivers/mtd/nand/spi/macronix.c index a9890350db02..3f31f1381a62 100644 --- a/drivers/mtd/nand/spi/macronix.c +++ b/drivers/mtd/nand/spi/macronix.c @@ -126,7 +126,7 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, mx35lf1ge4ab_ecc_get_status)), SPINAND_INFO("MX35LF4GE4AD", @@ -136,7 +136,7 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, mx35lf1ge4ab_ecc_get_status)), SPINAND_INFO("MX35LF1G24AD", @@ -146,16 +146,16 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL)), SPINAND_INFO("MX35LF2G24AD", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x24), - NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1), + NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 2, 1, 1), NAND_ECCREQ(8, 512), SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL)), SPINAND_INFO("MX35LF4G24AD", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x35), @@ -164,7 +164,7 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, NULL)), SPINAND_INFO("MX31LF1GE4BC", SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x1e), @@ -173,7 +173,7 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0 /*SPINAND_HAS_QE_BIT*/, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, mx35lf1ge4ab_ecc_get_status)), SPINAND_INFO("MX31UF1GE4BC", @@ -183,7 +183,7 @@ static const struct spinand_info macronix_spinand_table[] = { SPINAND_INFO_OP_VARIANTS(&read_cache_variants, &write_cache_variants, &update_cache_variants), - 0 /*SPINAND_HAS_QE_BIT*/, + SPINAND_HAS_QE_BIT, SPINAND_ECCINFO(&mx35lfxge4ab_ooblayout, mx35lf1ge4ab_ecc_get_status)), -- cgit v1.2.3 From e07403a8c6be01857ff75060b2df9a1aa8320fe5 Mon Sep 17 00:00:00 2001 From: Ezequiel Garcia Date: Sun, 1 Aug 2021 20:45:09 -0300 Subject: mtdblock: Warn if added for a NAND device There is a surprisingly large number of tutorials that suggest using mtdblock to mount SquashFS filesystems on flash devices, including NAND devices. This approach is suboptimal than using UBI. If the flash device is NAND, this is specially true, due to wear leveling, bit-flips and badblocks. In this case UBI is strongly preferred, so be nice to users and print a warning suggesting to consider UBI block, if mtdblock is added for a NAND device. Signed-off-by: Ezequiel Garcia Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210801234509.18774-8-ezequiel@collabora.com --- drivers/mtd/mtdblock.c | 4 ++++ drivers/mtd/mtdblock_ro.c | 4 ++++ 2 files changed, 8 insertions(+) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtdblock.c b/drivers/mtd/mtdblock.c index a80809543793..03e3de3a5d79 100644 --- a/drivers/mtd/mtdblock.c +++ b/drivers/mtd/mtdblock.c @@ -322,6 +322,10 @@ static void mtdblock_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) if (!(mtd->flags & MTD_WRITEABLE)) dev->mbd.readonly = 1; + if (mtd_type_is_nand(mtd)) + pr_warn("%s: MTD device '%s' is NAND, please consider using UBI block devices instead.\n", + tr->name, mtd->name); + if (add_mtd_blktrans_dev(&dev->mbd)) kfree(dev); } diff --git a/drivers/mtd/mtdblock_ro.c b/drivers/mtd/mtdblock_ro.c index d92914f73d52..7c51952ce55d 100644 --- a/drivers/mtd/mtdblock_ro.c +++ b/drivers/mtd/mtdblock_ro.c @@ -46,6 +46,10 @@ static void mtdblock_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) dev->tr = tr; dev->readonly = 1; + if (mtd_type_is_nand(mtd)) + pr_warn("%s: MTD device '%s' is NAND, please consider using UBI block devices instead.\n", + tr->name, mtd->name); + if (add_mtd_blktrans_dev(dev)) kfree(dev); } -- cgit v1.2.3 From e03a81213a9c9dd4f4f45c09a777323dff84827f Mon Sep 17 00:00:00 2001 From: Sean Young Date: Sat, 7 Aug 2021 22:45:34 +0100 Subject: mtd: rfd_ftl: allow use of MTD_RAM for testing purposes This allows the rfd_ftl to be used with the mtdram module, so we can test different mtd sizes and test the rfd_ftl on machines without a physical nor flash device. Signed-off-by: Sean Young Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-2-sean@mess.org --- drivers/mtd/rfd_ftl.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 6e0d5ce9b010..7b243f2b2fa3 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -720,7 +720,8 @@ static void rfd_ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) { struct partition *part; - if (mtd->type != MTD_NORFLASH || mtd->size > UINT_MAX) + if ((mtd->type != MTD_NORFLASH && mtd->type != MTD_RAM) || + mtd->size > UINT_MAX) return; part = kzalloc(sizeof(struct partition), GFP_KERNEL); -- cgit v1.2.3 From a3a447848a153d0dae63d02ceb94b02fb43ec899 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Sat, 7 Aug 2021 22:45:35 +0100 Subject: mtd: rfd_ftl: add discard support I proposed this change 16 years ago before discard was a feature in the block layer: https://lwn.net/Articles/162776/ Now that the block layer has discard, we can finally merge this change. Discard is also known as trim. By implementing discard, both fstrim and the discard filesystem option can be used. Implementing discard in the ftl means that when files are removed, there is less data in the ftl mapping. This means less stuff to move around for erasing and also less erasing to do; this means improved wear levelling and improved performance. Signed-off-by: Sean Young Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-3-sean@mess.org --- drivers/mtd/rfd_ftl.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+) (limited to 'drivers/mtd') diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 7b243f2b2fa3..7f5f6d247cae 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -705,6 +705,34 @@ err: return rc; } +static int rfd_ftl_discardsect(struct mtd_blktrans_dev *dev, + unsigned long sector, unsigned int nr_sects) +{ + struct partition *part = (struct partition *)dev; + u_long addr; + int rc; + + while (nr_sects) { + if (sector >= part->sector_count) + return -EIO; + + addr = part->sector_map[sector]; + + if (addr != -1) { + rc = mark_sector_deleted(part, addr); + if (rc) + return rc; + + part->sector_map[sector] = -1; + } + + sector++; + nr_sects--; + } + + return 0; +} + static int rfd_ftl_getgeo(struct mtd_blktrans_dev *dev, struct hd_geometry *geo) { struct partition *part = (struct partition*)dev; @@ -786,6 +814,7 @@ static struct mtd_blktrans_ops rfd_ftl_tr = { .readsect = rfd_ftl_readsect, .writesect = rfd_ftl_writesect, + .discard = rfd_ftl_discardsect, .getgeo = rfd_ftl_getgeo, .add_mtd = rfd_ftl_add_mtd, .remove_dev = rfd_ftl_remove_dev, -- cgit v1.2.3 From d056f8cd2fc29fbfb45f936cc1ac36ff67d7db93 Mon Sep 17 00:00:00 2001 From: Sean Young Date: Sat, 7 Aug 2021 22:45:37 +0100 Subject: mtd: rfd_ftl: fix use-after-free del_mtd_blktrans_dev() will kfree part, so after this call both part and dev point to freed memory. Move the call to avoid use-after-free. Signed-off-by: Sean Young Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-5-sean@mess.org --- drivers/mtd/rfd_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 7f5f6d247cae..52be9f1fa9a2 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -800,10 +800,10 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) part->mbd.mtd->name, i, part->blocks[i].erases); } - del_mtd_blktrans_dev(dev); vfree(part->sector_map); kfree(part->header_cache); kfree(part->blocks); + del_mtd_blktrans_dev(dev); } static struct mtd_blktrans_ops rfd_ftl_tr = { -- cgit v1.2.3 From fa451399d65a06747379ab1e246faf0b28e1c05f Mon Sep 17 00:00:00 2001 From: Sean Young Date: Sat, 7 Aug 2021 22:45:38 +0100 Subject: mtd: rfd_ftl: use container_of() rather than cast The container_of() is much more readable and also safer. Signed-off-by: Sean Young Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210807214538.14484-6-sean@mess.org --- drivers/mtd/rfd_ftl.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index 52be9f1fa9a2..af20a0a71108 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -239,7 +239,7 @@ err: static int rfd_ftl_readsect(struct mtd_blktrans_dev *dev, u_long sector, char *buf) { - struct partition *part = (struct partition*)dev; + struct partition *part = container_of(dev, struct partition, mbd); u_long addr; size_t retlen; int rc; @@ -600,7 +600,7 @@ static int find_free_sector(const struct partition *part, const struct block *bl static int do_writesect(struct mtd_blktrans_dev *dev, u_long sector, char *buf, ulong *old_addr) { - struct partition *part = (struct partition*)dev; + struct partition *part = container_of(dev, struct partition, mbd); struct block *block; u_long addr; int i; @@ -666,7 +666,7 @@ err: static int rfd_ftl_writesect(struct mtd_blktrans_dev *dev, u_long sector, char *buf) { - struct partition *part = (struct partition*)dev; + struct partition *part = container_of(dev, struct partition, mbd); u_long old_addr; int i; int rc = 0; @@ -708,7 +708,7 @@ err: static int rfd_ftl_discardsect(struct mtd_blktrans_dev *dev, unsigned long sector, unsigned int nr_sects) { - struct partition *part = (struct partition *)dev; + struct partition *part = container_of(dev, struct partition, mbd); u_long addr; int rc; @@ -735,7 +735,7 @@ static int rfd_ftl_discardsect(struct mtd_blktrans_dev *dev, static int rfd_ftl_getgeo(struct mtd_blktrans_dev *dev, struct hd_geometry *geo) { - struct partition *part = (struct partition*)dev; + struct partition *part = container_of(dev, struct partition, mbd); geo->heads = 1; geo->sectors = SECTORS_PER_TRACK; @@ -792,7 +792,7 @@ out: static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) { - struct partition *part = (struct partition*)dev; + struct partition *part = container_of(dev, struct partition, mbd); int i; for (i=0; itotal_blocks; i++) { @@ -803,7 +803,7 @@ static void rfd_ftl_remove_dev(struct mtd_blktrans_dev *dev) vfree(part->sector_map); kfree(part->header_cache); kfree(part->blocks); - del_mtd_blktrans_dev(dev); + del_mtd_blktrans_dev(&part->mbd); } static struct mtd_blktrans_ops rfd_ftl_tr = { -- cgit v1.2.3 From 60d0607998d6080db7af1d5bd8c9391f766fe697 Mon Sep 17 00:00:00 2001 From: Lukas Bulwahn Date: Tue, 17 Aug 2021 12:45:31 +0200 Subject: mtd: maps: remove dead MTD map driver for PMC-Sierra MSP boards Commit 1b00767fd8e1 ("MIPS: Remove PMC MSP71xx platform") removes the config PMC_MSP in ./arch/mips/Kconfig. Hence, since then, the corresponding MTD map driver for PMC-Sierra MSP boards is dead code. Remove this dead driver. Signed-off-by: Lukas Bulwahn Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210817104531.12675-1-lukas.bulwahn@gmail.com --- drivers/mtd/maps/Kconfig | 23 ---- drivers/mtd/maps/Makefile | 1 - drivers/mtd/maps/pmcmsp-flash.c | 227 ---------------------------------------- 3 files changed, 251 deletions(-) delete mode 100644 drivers/mtd/maps/pmcmsp-flash.c (limited to 'drivers/mtd') diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig index 6650acbc961e..aaa164b977fe 100644 --- a/drivers/mtd/maps/Kconfig +++ b/drivers/mtd/maps/Kconfig @@ -127,29 +127,6 @@ config MTD_PHYSMAP_GPIO_ADDR Extend the physmap driver to allow flashes to be partially physically addressed and assisted by GPIOs. -config MTD_PMC_MSP_EVM - tristate "CFI Flash device mapped on PMC-Sierra MSP" - depends on PMC_MSP && MTD_CFI - help - This provides a 'mapping' driver which supports the way - in which user-programmable flash chips are connected on the - PMC-Sierra MSP eval/demo boards. - -choice - prompt "Maximum mappable memory available for flash IO" - depends on MTD_PMC_MSP_EVM - default MSP_FLASH_MAP_LIMIT_32M - -config MSP_FLASH_MAP_LIMIT_32M - bool "32M" - -endchoice - -config MSP_FLASH_MAP_LIMIT - hex - default "0x02000000" - depends on MSP_FLASH_MAP_LIMIT_32M - config MTD_SUN_UFLASH tristate "Sun Microsystems userflash support" depends on SPARC && MTD_CFI && PCI diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile index 79f018cf412f..11fea9c8d561 100644 --- a/drivers/mtd/maps/Makefile +++ b/drivers/mtd/maps/Makefile @@ -25,7 +25,6 @@ physmap-objs-$(CONFIG_MTD_PHYSMAP_IXP4XX) += physmap-ixp4xx.o physmap-objs := $(physmap-objs-y) obj-$(CONFIG_MTD_PHYSMAP) += physmap.o obj-$(CONFIG_MTD_PISMO) += pismo.o -obj-$(CONFIG_MTD_PMC_MSP_EVM) += pmcmsp-flash.o obj-$(CONFIG_MTD_PCMCIA) += pcmciamtd.o obj-$(CONFIG_MTD_SA1100) += sa1100-flash.o obj-$(CONFIG_MTD_SBC_GXX) += sbc_gxx.o diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c deleted file mode 100644 index 2051f28ddac6..000000000000 --- a/drivers/mtd/maps/pmcmsp-flash.c +++ /dev/null @@ -1,227 +0,0 @@ -/* - * Mapping of a custom board with both AMD CFI and JEDEC flash in partitions. - * Config with both CFI and JEDEC device support. - * - * Basically physmap.c with the addition of partitions and - * an array of mapping info to accommodate more than one flash type per board. - * - * Copyright 2005-2007 PMC-Sierra, Inc. - * - * This program is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License as published by the - * Free Software Foundation; either version 2 of the License, or (at your - * option) any later version. - * - * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED - * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF - * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN - * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, - * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT - * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF - * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON - * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT - * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF - * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - * - * You should have received a copy of the GNU General Public License along - * with this program; if not, write to the Free Software Foundation, Inc., - * 675 Mass Ave, Cambridge, MA 02139, USA. - */ - -#include -#include -#include -#include -#include -#include -#include - -#include - -#include -#include - - -static struct mtd_info **msp_flash; -static struct mtd_partition **msp_parts; -static struct map_info *msp_maps; -static int fcnt; - -#define DEBUG_MARKER printk(KERN_NOTICE "%s[%d]\n", __func__, __LINE__) - -static int __init init_msp_flash(void) -{ - int i, j, ret = -ENOMEM; - int offset, coff; - char *env; - int pcnt; - char flash_name[] = "flash0"; - char part_name[] = "flash0_0"; - unsigned addr, size; - - /* If ELB is disabled by "ful-mux" mode, we can't get at flash */ - if ((*DEV_ID_REG & DEV_ID_SINGLE_PC) && - (*ELB_1PC_EN_REG & SINGLE_PCCARD)) { - printk(KERN_NOTICE "Single PC Card mode: no flash access\n"); - return -ENXIO; - } - - /* examine the prom environment for flash devices */ - for (fcnt = 0; (env = prom_getenv(flash_name)); fcnt++) - flash_name[5] = '0' + fcnt + 1; - - if (fcnt < 1) - return -ENXIO; - - printk(KERN_NOTICE "Found %d PMC flash devices\n", fcnt); - - msp_flash = kcalloc(fcnt, sizeof(*msp_flash), GFP_KERNEL); - if (!msp_flash) - return -ENOMEM; - - msp_parts = kcalloc(fcnt, sizeof(*msp_parts), GFP_KERNEL); - if (!msp_parts) - goto free_msp_flash; - - msp_maps = kcalloc(fcnt, sizeof(*msp_maps), GFP_KERNEL); - if (!msp_maps) - goto free_msp_parts; - - /* loop over the flash devices, initializing each */ - for (i = 0; i < fcnt; i++) { - /* examine the prom environment for flash partititions */ - part_name[5] = '0' + i; - part_name[7] = '0'; - for (pcnt = 0; (env = prom_getenv(part_name)); pcnt++) - part_name[7] = '0' + pcnt + 1; - - if (pcnt == 0) { - printk(KERN_NOTICE "Skipping flash device %d " - "(no partitions defined)\n", i); - continue; - } - - msp_parts[i] = kcalloc(pcnt, sizeof(struct mtd_partition), - GFP_KERNEL); - if (!msp_parts[i]) - goto cleanup_loop; - - /* now initialize the devices proper */ - flash_name[5] = '0' + i; - env = prom_getenv(flash_name); - - if (sscanf(env, "%x:%x", &addr, &size) < 2) { - ret = -ENXIO; - kfree(msp_parts[i]); - goto cleanup_loop; - } - addr = CPHYSADDR(addr); - - printk(KERN_NOTICE - "MSP flash device \"%s\": 0x%08x at 0x%08x\n", - flash_name, size, addr); - /* This must matchs the actual size of the flash chip */ - msp_maps[i].size = size; - msp_maps[i].phys = addr; - - /* - * Platforms have a specific limit of the size of memory - * which may be mapped for flash: - */ - if (size > CONFIG_MSP_FLASH_MAP_LIMIT) - size = CONFIG_MSP_FLASH_MAP_LIMIT; - - msp_maps[i].virt = ioremap(addr, size); - if (msp_maps[i].virt == NULL) { - ret = -ENXIO; - kfree(msp_parts[i]); - goto cleanup_loop; - } - - msp_maps[i].bankwidth = 1; - msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL); - if (!msp_maps[i].name) { - iounmap(msp_maps[i].virt); - kfree(msp_parts[i]); - goto cleanup_loop; - } - - for (j = 0; j < pcnt; j++) { - part_name[5] = '0' + i; - part_name[7] = '0' + j; - - env = prom_getenv(part_name); - - if (sscanf(env, "%x:%x:%n", &offset, &size, - &coff) < 2) { - ret = -ENXIO; - kfree(msp_maps[i].name); - iounmap(msp_maps[i].virt); - kfree(msp_parts[i]); - goto cleanup_loop; - } - - msp_parts[i][j].size = size; - msp_parts[i][j].offset = offset; - msp_parts[i][j].name = env + coff; - } - - /* now probe and add the device */ - simple_map_init(&msp_maps[i]); - msp_flash[i] = do_map_probe("cfi_probe", &msp_maps[i]); - if (msp_flash[i]) { - msp_flash[i]->owner = THIS_MODULE; - mtd_device_register(msp_flash[i], msp_parts[i], pcnt); - } else { - printk(KERN_ERR "map probe failed for flash\n"); - ret = -ENXIO; - kfree(msp_maps[i].name); - iounmap(msp_maps[i].virt); - kfree(msp_parts[i]); - goto cleanup_loop; - } - } - - return 0; - -cleanup_loop: - while (i--) { - mtd_device_unregister(msp_flash[i]); - map_destroy(msp_flash[i]); - kfree(msp_maps[i].name); - iounmap(msp_maps[i].virt); - kfree(msp_parts[i]); - } - kfree(msp_maps); -free_msp_parts: - kfree(msp_parts); -free_msp_flash: - kfree(msp_flash); - return ret; -} - -static void __exit cleanup_msp_flash(void) -{ - int i; - - for (i = 0; i < fcnt; i++) { - mtd_device_unregister(msp_flash[i]); - map_destroy(msp_flash[i]); - iounmap((void *)msp_maps[i].virt); - - /* free the memory */ - kfree(msp_maps[i].name); - kfree(msp_parts[i]); - } - - kfree(msp_flash); - kfree(msp_parts); - kfree(msp_maps); -} - -MODULE_AUTHOR("PMC-Sierra, Inc"); -MODULE_DESCRIPTION("MTD map driver for PMC-Sierra MSP boards"); -MODULE_LICENSE("GPL"); - -module_init(init_msp_flash); -module_exit(cleanup_msp_flash); -- cgit v1.2.3 From f9e109a209a8e01e16f37e1252304f1eb3908be4 Mon Sep 17 00:00:00 2001 From: Zhihao Cheng Date: Tue, 17 Aug 2021 19:48:56 +0800 Subject: mtd: mtdconcat: Judge callback existence based on the master Since commit 46b5889cc2c5("mtd: implement proper partition handling") applied, mtd partition device won't hold some callback functions, such as _block_isbad, _block_markbad, etc. Besides, function mtd_block_isbad() will get mtd device's master mtd device, then invokes master mtd device's callback function. So, following process may result mtd_block_isbad() always return 0, even though mtd device has bad blocks: 1. Split a mtd device into 3 partitions: PA, PB, PC [ Each mtd partition device won't has callback function _block_isbad(). ] 2. Concatenate PA and PB as a new mtd device PN [ mtd_concat_create() finds out each subdev has no callback function _block_isbad(), so PN won't be assigned callback function concat_block_isbad(). ] Then, mtd_block_isbad() checks "!master->_block_isbad" is true, will always return 0. Reproducer: // reproduce.c static int __init init_diy_module(void) { struct mtd_info *mtd[2]; struct mtd_info *mtd_combine = NULL; mtd[0] = get_mtd_device_nm("NAND simulator partition 0"); if (!mtd[0]) { pr_err("cannot find mtd1\n"); return -EINVAL; } mtd[1] = get_mtd_device_nm("NAND simulator partition 1"); if (!mtd[1]) { pr_err("cannot find mtd2\n"); return -EINVAL; } put_mtd_device(mtd[0]); put_mtd_device(mtd[1]); mtd_combine = mtd_concat_create(mtd, 2, "Combine mtd"); if (mtd_combine == NULL) { pr_err("combine failed\n"); return -EINVAL; } mtd_device_register(mtd_combine, NULL, 0); pr_info("Combine success\n"); return 0; } 1. ID="0x20,0xac,0x00,0x15" 2. modprobe nandsim id_bytes=$ID parts=50,100 badblocks=100 3. insmod reproduce.ko 4. flash_erase /dev/mtd3 0 0 libmtd: error!: MEMERASE64 ioctl failed for eraseblock 100 (mtd3) error 5 (Input/output error) // Should be "flash_erase: Skipping bad block at 00c80000" Fixes: 46b5889cc2c54bac ("mtd: implement proper partition handling") Signed-off-by: Zhihao Cheng Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-2-chengzhihao1@huawei.com --- drivers/mtd/mtdconcat.c | 27 +++++++++++++++++++-------- 1 file changed, 19 insertions(+), 8 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c index 6e4d0017c0bd..af51eee6b5e8 100644 --- a/drivers/mtd/mtdconcat.c +++ b/drivers/mtd/mtdconcat.c @@ -641,6 +641,7 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c int i; size_t size; struct mtd_concat *concat; + struct mtd_info *subdev_master = NULL; uint32_t max_erasesize, curr_erasesize; int num_erase_region; int max_writebufsize = 0; @@ -679,17 +680,19 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c concat->mtd.subpage_sft = subdev[0]->subpage_sft; concat->mtd.oobsize = subdev[0]->oobsize; concat->mtd.oobavail = subdev[0]->oobavail; - if (subdev[0]->_writev) + + subdev_master = mtd_get_master(subdev[0]); + if (subdev_master->_writev) concat->mtd._writev = concat_writev; - if (subdev[0]->_read_oob) + if (subdev_master->_read_oob) concat->mtd._read_oob = concat_read_oob; - if (subdev[0]->_write_oob) + if (subdev_master->_write_oob) concat->mtd._write_oob = concat_write_oob; - if (subdev[0]->_block_isbad) + if (subdev_master->_block_isbad) concat->mtd._block_isbad = concat_block_isbad; - if (subdev[0]->_block_markbad) + if (subdev_master->_block_markbad) concat->mtd._block_markbad = concat_block_markbad; - if (subdev[0]->_panic_write) + if (subdev_master->_panic_write) concat->mtd._panic_write = concat_panic_write; concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks; @@ -721,14 +724,22 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c subdev[i]->flags & MTD_WRITEABLE; } + subdev_master = mtd_get_master(subdev[i]); concat->mtd.size += subdev[i]->size; concat->mtd.ecc_stats.badblocks += subdev[i]->ecc_stats.badblocks; if (concat->mtd.writesize != subdev[i]->writesize || concat->mtd.subpage_sft != subdev[i]->subpage_sft || concat->mtd.oobsize != subdev[i]->oobsize || - !concat->mtd._read_oob != !subdev[i]->_read_oob || - !concat->mtd._write_oob != !subdev[i]->_write_oob) { + !concat->mtd._read_oob != !subdev_master->_read_oob || + !concat->mtd._write_oob != !subdev_master->_write_oob) { + /* + * Check against subdev[i] for data members, because + * subdev's attributes may be different from master + * mtd device. Check against subdev's master mtd + * device for callbacks, because the existence of + * subdev's callbacks is decided by master mtd device. + */ kfree(concat); printk("Incompatible OOB or ECC data on \"%s\"\n", subdev[i]->name); -- cgit v1.2.3 From a89d69a44e282be95ae76125dddc79515541efeb Mon Sep 17 00:00:00 2001 From: Zhihao Cheng Date: Tue, 17 Aug 2021 19:48:57 +0800 Subject: mtd: mtdconcat: Check _read, _write callbacks existence before assignment Since 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() as wrappers around mtd_{read,write}_oob()") don't allow _write|_read and _write_oob|_read_oob existing at the same time, we should check the existence of callbacks "_read and _write" from subdev's master device (We can trust master device since it has been registered) before assigning, otherwise following warning occurs while making concatenated device: WARNING: CPU: 2 PID: 6728 at drivers/mtd/mtdcore.c:595 add_mtd_device+0x7f/0x7b0 Fixes: 2431c4f5b46c3 ("mtd: Implement mtd_{read,write}() around ...") Signed-off-by: Zhihao Cheng Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210817114857.2784825-3-chengzhihao1@huawei.com --- drivers/mtd/mtdconcat.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c index af51eee6b5e8..f685a581df48 100644 --- a/drivers/mtd/mtdconcat.c +++ b/drivers/mtd/mtdconcat.c @@ -694,6 +694,10 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c concat->mtd._block_markbad = concat_block_markbad; if (subdev_master->_panic_write) concat->mtd._panic_write = concat_panic_write; + if (subdev_master->_read) + concat->mtd._read = concat_read; + if (subdev_master->_write) + concat->mtd._write = concat_write; concat->mtd.ecc_stats.badblocks = subdev[0]->ecc_stats.badblocks; @@ -755,8 +759,6 @@ struct mtd_info *mtd_concat_create(struct mtd_info *subdev[], /* subdevices to c concat->mtd.name = name; concat->mtd._erase = concat_erase; - concat->mtd._read = concat_read; - concat->mtd._write = concat_write; concat->mtd._sync = concat_sync; concat->mtd._lock = concat_lock; concat->mtd._unlock = concat_unlock; -- cgit v1.2.3 From 0792ec82175ec45a0f45af6e0f2d3cb49c527cd4 Mon Sep 17 00:00:00 2001 From: Evgeny Novikov Date: Tue, 17 Aug 2021 12:29:30 +0300 Subject: mtd: rawnand: intel: Fix error handling in probe ebu_nand_probe() did not invoke ebu_dma_cleanup() and clk_disable_unprepare() on some error handling paths. The patch fixes that. Found by Linux Driver Verification project (linuxtesting.org). Fixes: 0b1039f016e8 ("mtd: rawnand: Add NAND controller support on Intel LGM SoC") Signed-off-by: Evgeny Novikov Co-developed-by: Kirill Shilimanov Signed-off-by: Kirill Shilimanov Co-developed-by: Anton Vasilyev Signed-off-by: Anton Vasilyev Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210817092930.23040-1-novikov@ispras.ru --- drivers/mtd/nand/raw/intel-nand-controller.c | 27 ++++++++++++++++++--------- 1 file changed, 18 insertions(+), 9 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c index 8b49fd56cf96..29e8a546dcd6 100644 --- a/drivers/mtd/nand/raw/intel-nand-controller.c +++ b/drivers/mtd/nand/raw/intel-nand-controller.c @@ -631,19 +631,26 @@ static int ebu_nand_probe(struct platform_device *pdev) ebu_host->clk_rate = clk_get_rate(ebu_host->clk); ebu_host->dma_tx = dma_request_chan(dev, "tx"); - if (IS_ERR(ebu_host->dma_tx)) - return dev_err_probe(dev, PTR_ERR(ebu_host->dma_tx), - "failed to request DMA tx chan!.\n"); + if (IS_ERR(ebu_host->dma_tx)) { + ret = dev_err_probe(dev, PTR_ERR(ebu_host->dma_tx), + "failed to request DMA tx chan!.\n"); + goto err_disable_unprepare_clk; + } ebu_host->dma_rx = dma_request_chan(dev, "rx"); - if (IS_ERR(ebu_host->dma_rx)) - return dev_err_probe(dev, PTR_ERR(ebu_host->dma_rx), - "failed to request DMA rx chan!.\n"); + if (IS_ERR(ebu_host->dma_rx)) { + ret = dev_err_probe(dev, PTR_ERR(ebu_host->dma_rx), + "failed to request DMA rx chan!.\n"); + ebu_host->dma_rx = NULL; + goto err_cleanup_dma; + } resname = devm_kasprintf(dev, GFP_KERNEL, "addr_sel%d", cs); res = platform_get_resource_byname(pdev, IORESOURCE_MEM, resname); - if (!res) - return -EINVAL; + if (!res) { + ret = -EINVAL; + goto err_cleanup_dma; + } ebu_host->cs[cs].addr_sel = res->start; writel(ebu_host->cs[cs].addr_sel | EBU_ADDR_MASK(5) | EBU_ADDR_SEL_REGEN, ebu_host->ebu + EBU_ADDR_SEL(cs)); @@ -653,7 +660,8 @@ static int ebu_nand_probe(struct platform_device *pdev) mtd = nand_to_mtd(&ebu_host->chip); if (!mtd->name) { dev_err(ebu_host->dev, "NAND label property is mandatory\n"); - return -EINVAL; + ret = -EINVAL; + goto err_cleanup_dma; } mtd->dev.parent = dev; @@ -681,6 +689,7 @@ err_clean_nand: nand_cleanup(&ebu_host->chip); err_cleanup_dma: ebu_dma_cleanup(ebu_host); +err_disable_unprepare_clk: clk_disable_unprepare(ebu_host->clk); return ret; -- cgit v1.2.3 From 799ae31c58ae766a4ce9b198658b286ecaf2c575 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:52 +0200 Subject: mtd_blkdevs: don't hold del_mtd_blktrans_dev in blktrans_{open, release} There is nothing that this protects against except for slightly reducing the window when new opens can appear just before calling del_gendisk. Reported-by: Guenter Roeck Signed-off-by: Christoph Hellwig Tested-by: Guenter Roeck Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-2-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 5 ----- 1 file changed, 5 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 6ce4bc57f919..94d42ba01b2f 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -207,7 +207,6 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) if (!dev) return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ - mutex_lock(&mtd_table_mutex); mutex_lock(&dev->lock); if (dev->open) @@ -233,7 +232,6 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) unlock: dev->open++; mutex_unlock(&dev->lock); - mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); return ret; @@ -244,7 +242,6 @@ error_put: module_put(dev->tr->owner); kref_put(&dev->ref, blktrans_dev_release); mutex_unlock(&dev->lock); - mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); return ret; } @@ -256,7 +253,6 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) if (!dev) return; - mutex_lock(&mtd_table_mutex); mutex_lock(&dev->lock); if (--dev->open) @@ -272,7 +268,6 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) } unlock: mutex_unlock(&dev->lock); - mutex_unlock(&mtd_table_mutex); blktrans_dev_put(dev); } -- cgit v1.2.3 From f214eebf8de4d2e412a35ff140687d88f056143a Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:53 +0200 Subject: mtd_blkdevs: use lockdep_assert_held Use lockdep_assert_held to ensure mtd_table_mutex is held instead of mutex_trylock games. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-3-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 94d42ba01b2f..5981fd026c87 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -310,10 +310,7 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new) struct gendisk *gd; int ret; - if (mutex_trylock(&mtd_table_mutex)) { - mutex_unlock(&mtd_table_mutex); - BUG(); - } + lockdep_assert_held(&mtd_table_mutex); mutex_lock(&blktrans_ref_mutex); list_for_each_entry(d, &tr->devs, list) { @@ -443,10 +440,7 @@ int del_mtd_blktrans_dev(struct mtd_blktrans_dev *old) { unsigned long flags; - if (mutex_trylock(&mtd_table_mutex)) { - mutex_unlock(&mtd_table_mutex); - BUG(); - } + lockdep_assert_held(&mtd_table_mutex); if (old->disk_attributes) sysfs_remove_group(&disk_to_dev(old->disk)->kobj, -- cgit v1.2.3 From ffd18c97fcb6bf37bb749cfc53c5e698017cbc95 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:54 +0200 Subject: mtd/ftl: don't cast away the type when calling add_mtd_blktrans_dev Pass the actual mtd_blktrans_dev instead of casting the containing structure to void *. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-4-hch@lst.de --- drivers/mtd/ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/ftl.c b/drivers/mtd/ftl.c index 9b33c082179d..f655d2905270 100644 --- a/drivers/mtd/ftl.c +++ b/drivers/mtd/ftl.c @@ -1029,7 +1029,7 @@ static void ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) partition->mbd.tr = tr; partition->mbd.devnum = -1; - if (!add_mtd_blktrans_dev((void *)partition)) + if (!add_mtd_blktrans_dev(&partition->mbd)) return; } -- cgit v1.2.3 From a0faf5fdfb9967b33eda5eafcb55470180216af3 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:55 +0200 Subject: mtd/rfd_ftl: don't cast away the type when calling add_mtd_blktrans_dev Pass the actual mtd_blktrans_dev instead of casting the containing structure to void *. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-5-hch@lst.de --- drivers/mtd/rfd_ftl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/rfd_ftl.c b/drivers/mtd/rfd_ftl.c index af20a0a71108..c546f8c5f24d 100644 --- a/drivers/mtd/rfd_ftl.c +++ b/drivers/mtd/rfd_ftl.c @@ -783,7 +783,7 @@ static void rfd_ftl_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd) printk(KERN_INFO PREFIX "name: '%s' type: %d flags %x\n", mtd->name, mtd->type, mtd->flags); - if (!add_mtd_blktrans_dev((void*)part)) + if (!add_mtd_blktrans_dev(&part->mbd)) return; } out: -- cgit v1.2.3 From 89843828399ec825f8ec3e614634a428a951a2b3 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:56 +0200 Subject: mtd_blkdevs: simplify blktrans_dev_get ->private_data is set before the disk is added and never cleared, so don't bother trying to handle a NULL pointer there. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-6-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 17 ++--------------- 1 file changed, 2 insertions(+), 15 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 5981fd026c87..eb15a84cb650 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -39,16 +39,12 @@ static void blktrans_dev_release(struct kref *kref) static struct mtd_blktrans_dev *blktrans_dev_get(struct gendisk *disk) { - struct mtd_blktrans_dev *dev; + struct mtd_blktrans_dev *dev = disk->private_data; mutex_lock(&blktrans_ref_mutex); - dev = disk->private_data; - - if (!dev) - goto unlock; kref_get(&dev->ref); -unlock: mutex_unlock(&blktrans_ref_mutex); + return dev; } @@ -204,9 +200,6 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk); int ret = 0; - if (!dev) - return -ERESTARTSYS; /* FIXME: busy loop! -arnd*/ - mutex_lock(&dev->lock); if (dev->open) @@ -250,9 +243,6 @@ static void blktrans_release(struct gendisk *disk, fmode_t mode) { struct mtd_blktrans_dev *dev = blktrans_dev_get(disk); - if (!dev) - return; - mutex_lock(&dev->lock); if (--dev->open) @@ -276,9 +266,6 @@ static int blktrans_getgeo(struct block_device *bdev, struct hd_geometry *geo) struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk); int ret = -ENXIO; - if (!dev) - return ret; - mutex_lock(&dev->lock); if (!dev->mtd) -- cgit v1.2.3 From 560a3915e3df09125d7b20088a177b2872d2d680 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:57 +0200 Subject: mtd_blkdevs: remove blktrans_ref_mutex blktrans_ref_mutex is not actually needed. The kref is serialized internally, and devnum assignment in add_mtd_blktrans_dev happens before the disk is added and thus any of the block_device_operations methods otherwise using it are called. It is also already serialized by the global mtd_table_mutex. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-7-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index eb15a84cb650..84bcad1b7408 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -23,7 +23,6 @@ #include "mtdcore.h" static LIST_HEAD(blktrans_majors); -static DEFINE_MUTEX(blktrans_ref_mutex); static void blktrans_dev_release(struct kref *kref) { @@ -41,18 +40,13 @@ static struct mtd_blktrans_dev *blktrans_dev_get(struct gendisk *disk) { struct mtd_blktrans_dev *dev = disk->private_data; - mutex_lock(&blktrans_ref_mutex); kref_get(&dev->ref); - mutex_unlock(&blktrans_ref_mutex); - return dev; } static void blktrans_dev_put(struct mtd_blktrans_dev *dev) { - mutex_lock(&blktrans_ref_mutex); kref_put(&dev->ref, blktrans_dev_release); - mutex_unlock(&blktrans_ref_mutex); } @@ -299,7 +293,6 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new) lockdep_assert_held(&mtd_table_mutex); - mutex_lock(&blktrans_ref_mutex); list_for_each_entry(d, &tr->devs, list) { if (new->devnum == -1) { /* Use first free number */ @@ -311,7 +304,6 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new) } } else if (d->devnum == new->devnum) { /* Required number taken */ - mutex_unlock(&blktrans_ref_mutex); return -EBUSY; } else if (d->devnum > new->devnum) { /* Required number was free */ @@ -329,14 +321,11 @@ int add_mtd_blktrans_dev(struct mtd_blktrans_dev *new) * minor numbers and that the disk naming code below can cope * with this number. */ if (new->devnum > (MINORMASK >> tr->part_bits) || - (tr->part_bits && new->devnum >= 27 * 26)) { - mutex_unlock(&blktrans_ref_mutex); + (tr->part_bits && new->devnum >= 27 * 26)) return ret; - } list_add_tail(&new->list, &tr->devs); added: - mutex_unlock(&blktrans_ref_mutex); mutex_init(&new->lock); kref_init(&new->ref); -- cgit v1.2.3 From 37b143d12b5f099bb4375162303ff1df1692cc5e Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:58 +0200 Subject: mtd_blkdevs: simplify blktrans_getgeo No need to grab a mtd_blktrans_dev given that ->open already holds one and ->getgeo can only be called on an open disk. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-8-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index 84bcad1b7408..e8eb4d801b15 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -257,7 +257,7 @@ unlock: static int blktrans_getgeo(struct block_device *bdev, struct hd_geometry *geo) { - struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk); + struct mtd_blktrans_dev *dev = bdev->bd_disk->private_data; int ret = -ENXIO; mutex_lock(&dev->lock); @@ -268,7 +268,6 @@ static int blktrans_getgeo(struct block_device *bdev, struct hd_geometry *geo) ret = dev->tr->getgeo ? dev->tr->getgeo(dev, geo) : -ENOTTY; unlock: mutex_unlock(&dev->lock); - blktrans_dev_put(dev); return ret; } -- cgit v1.2.3 From ee28b42006c37aaeb68c83300fe5608db662082f Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 23 Aug 2021 09:33:59 +0200 Subject: mtd_blkdevs: simplify the refcounting in blktrans_{open, release} Always grab a reference to the mtd_blktrans_dev in ->open instead of just on the first open, and do away with the additional temporary references in ->open and ->release. Signed-off-by: Christoph Hellwig Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20210823073359.705281-9-hch@lst.de --- drivers/mtd/mtd_blkdevs.c | 18 ++++-------------- 1 file changed, 4 insertions(+), 14 deletions(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c index e8eb4d801b15..12c1803284c7 100644 --- a/drivers/mtd/mtd_blkdevs.c +++ b/drivers/mtd/mtd_blkdevs.c @@ -36,14 +36,6 @@ static void blktrans_dev_release(struct kref *kref) kfree(dev); } -static struct mtd_blktrans_dev *blktrans_dev_get(struct gendisk *disk) -{ - struct mtd_blktrans_dev *dev = disk->private_data; - - kref_get(&dev->ref); - return dev; -} - static void blktrans_dev_put(struct mtd_blktrans_dev *dev) { kref_put(&dev->ref, blktrans_dev_release); @@ -191,15 +183,16 @@ static blk_status_t mtd_queue_rq(struct blk_mq_hw_ctx *hctx, static int blktrans_open(struct block_device *bdev, fmode_t mode) { - struct mtd_blktrans_dev *dev = blktrans_dev_get(bdev->bd_disk); + struct mtd_blktrans_dev *dev = bdev->bd_disk->private_data; int ret = 0; + kref_get(&dev->ref); + mutex_lock(&dev->lock); if (dev->open) goto unlock; - kref_get(&dev->ref); __module_get(dev->tr->owner); if (!dev->mtd) @@ -219,7 +212,6 @@ static int blktrans_open(struct block_device *bdev, fmode_t mode) unlock: dev->open++; mutex_unlock(&dev->lock); - blktrans_dev_put(dev); return ret; error_release: @@ -227,7 +219,6 @@ error_release: dev->tr->release(dev); error_put: module_put(dev->tr->owner); - kref_put(&dev->ref, blktrans_dev_release); mutex_unlock(&dev->lock); blktrans_dev_put(dev); return ret; @@ -235,14 +226,13 @@ error_put: static void blktrans_release(struct gendisk *disk, fmode_t mode) { - struct mtd_blktrans_dev *dev = blktrans_dev_get(disk); + struct mtd_blktrans_dev *dev = disk->private_data; mutex_lock(&dev->lock); if (--dev->open) goto unlock; - kref_put(&dev->ref, blktrans_dev_release); module_put(dev->tr->owner); if (dev->mtd) { -- cgit v1.2.3 From 6b430c7595e4eb95fae8fb54adc3c3ce002e75ae Mon Sep 17 00:00:00 2001 From: Christophe JAILLET Date: Sat, 21 Aug 2021 09:58:45 +0200 Subject: mtd: rawnand: cafe: Fix a resource leak in the error handling path of 'cafe_nand_probe()' MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit A successful 'init_rs_non_canonical()' call should be balanced by a corresponding 'free_rs()' call in the error handling path of the probe, as already done in the remove function. Update the error handling path accordingly. Fixes: 8c61b7a7f4d4 ("[MTD] [NAND] Use rslib for CAFÉ ECC") Signed-off-by: Christophe JAILLET Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/fd313d3fb787458bcc73189e349f481133a2cdc9.1629532640.git.christophe.jaillet@wanadoo.fr --- drivers/mtd/nand/raw/cafe_nand.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'drivers/mtd') diff --git a/drivers/mtd/nand/raw/cafe_nand.c b/drivers/mtd/nand/raw/cafe_nand.c index d0e8ffd55c22..9dbf031716a6 100644 --- a/drivers/mtd/nand/raw/cafe_nand.c +++ b/drivers/mtd/nand/raw/cafe_nand.c @@ -751,7 +751,7 @@ static int cafe_nand_probe(struct pci_dev *pdev, "CAFE NAND", mtd); if (err) { dev_warn(&pdev->dev, "Could not register IRQ %d\n", pdev->irq); - goto out_ior; + goto out_free_rs; } /* Disable master reset, enable NAND clock */ @@ -795,6 +795,8 @@ static int cafe_nand_probe(struct pci_dev *pdev, /* Disable NAND IRQ in global IRQ mask register */ cafe_writel(cafe, ~1 & cafe_readl(cafe, GLOBAL_IRQ_MASK), GLOBAL_IRQ_MASK); free_irq(pdev->irq, mtd); + out_free_rs: + free_rs(cafe->rs); out_ior: pci_iounmap(pdev, cafe->mmio); out_free_mtd: -- cgit v1.2.3