* [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write
@ 2019-08-01 9:19 Bastian Krause
2019-08-01 13:16 ` Bastian Krause
2019-08-05 9:34 ` Sascha Hauer
0 siblings, 2 replies; 3+ messages in thread
From: Bastian Krause @ 2019-08-01 9:19 UTC (permalink / raw)
To: barebox; +Cc: Steffen Trumtrar, Bastian Krause
nor->write() simply adds the number of written bytes to the pointer
given. Thus retval is incremented in each loop cycle for each
spi_nor_write() call without ever resetting it. This leads to wrong page
offset/remains calculations and an incorrect number of bytes written to
retlen.
This becomes apparant only if the calling function actually compares len
and retlen (e.g. mtd_peb_write() ). Otherwise wrong data is written:
$ memcpy -s /dev/prng -d prng_data 0 0 10k
$ erase /dev/mtd0.mypart
$ cp prng_data /dev/mtd0.mypart
$ memcmp -s prng_data -d /dev/mtd0.mypart 0 0
memcmp returned "files differ" before, with this patch it returns "OK".
Fixes: c8516869c4 ("spi: Extend the core to ease integration of SPI memory controllers")
Signed-off-by: Bastian Krause <bst@pengutronix.de>
---
drivers/mtd/spi-nor/spi-nor.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
index b2052ce0af..9dbc8302ed 100644
--- a/drivers/mtd/spi-nor/spi-nor.c
+++ b/drivers/mtd/spi-nor/spi-nor.c
@@ -972,6 +972,7 @@ static int spi_nor_write(struct mtd_info *mtd, loff_t to, size_t len,
for (i = 0; i < len; ) {
ssize_t written;
+ retval = 0;
page_offset = (to + i) & (nor->page_size - 1);
page_remain = min_t(size_t, nor->page_size - page_offset,
--
2.20.1
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write
2019-08-01 9:19 [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write Bastian Krause
@ 2019-08-01 13:16 ` Bastian Krause
2019-08-05 9:34 ` Sascha Hauer
1 sibling, 0 replies; 3+ messages in thread
From: Bastian Krause @ 2019-08-01 13:16 UTC (permalink / raw)
To: barebox; +Cc: Steffen Trumtrar
On 8/1/19 11:19 AM, Bastian Krause wrote:
> nor->write() simply adds the number of written bytes to the pointer
> given. Thus retval is incremented in each loop cycle for each
> spi_nor_write() call without ever resetting it. This leads to wrong page
> offset/remains calculations and an incorrect number of bytes written to
> retlen.
Note: this happens only with the cadence-quadspi driver.
Bastian
>
> This becomes apparant only if the calling function actually compares len
> and retlen (e.g. mtd_peb_write() ). Otherwise wrong data is written:
>
> $ memcpy -s /dev/prng -d prng_data 0 0 10k
> $ erase /dev/mtd0.mypart
> $ cp prng_data /dev/mtd0.mypart
> $ memcmp -s prng_data -d /dev/mtd0.mypart 0 0
>
> memcmp returned "files differ" before, with this patch it returns "OK".
>
> Fixes: c8516869c4 ("spi: Extend the core to ease integration of SPI memory controllers")
> Signed-off-by: Bastian Krause <bst@pengutronix.de>
> ---
> drivers/mtd/spi-nor/spi-nor.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c
> index b2052ce0af..9dbc8302ed 100644
> --- a/drivers/mtd/spi-nor/spi-nor.c
> +++ b/drivers/mtd/spi-nor/spi-nor.c
> @@ -972,6 +972,7 @@ static int spi_nor_write(struct mtd_info *mtd, loff_t to, size_t len,
>
> for (i = 0; i < len; ) {
> ssize_t written;
> + retval = 0;
>
> page_offset = (to + i) & (nor->page_size - 1);
> page_remain = min_t(size_t, nor->page_size - page_offset,
>
--
Pengutronix e.K.
Industrial Linux Solutions
http://www.pengutronix.de/
Peiner Str. 6-8, 31137 Hildesheim, Germany
Amtsgericht Hildesheim, HRA 2686
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write
2019-08-01 9:19 [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write Bastian Krause
2019-08-01 13:16 ` Bastian Krause
@ 2019-08-05 9:34 ` Sascha Hauer
1 sibling, 0 replies; 3+ messages in thread
From: Sascha Hauer @ 2019-08-05 9:34 UTC (permalink / raw)
To: Bastian Krause; +Cc: barebox, Steffen Trumtrar
On Thu, Aug 01, 2019 at 11:19:50AM +0200, Bastian Krause wrote:
> nor->write() simply adds the number of written bytes to the pointer
> given. Thus retval is incremented in each loop cycle for each
> spi_nor_write() call without ever resetting it. This leads to wrong page
> offset/remains calculations and an incorrect number of bytes written to
> retlen.
>
> This becomes apparant only if the calling function actually compares len
> and retlen (e.g. mtd_peb_write() ). Otherwise wrong data is written:
>
> $ memcpy -s /dev/prng -d prng_data 0 0 10k
> $ erase /dev/mtd0.mypart
> $ cp prng_data /dev/mtd0.mypart
> $ memcmp -s prng_data -d /dev/mtd0.mypart 0 0
>
> memcmp returned "files differ" before, with this patch it returns "OK".
>
> Fixes: c8516869c4 ("spi: Extend the core to ease integration of SPI memory controllers")
> Signed-off-by: Bastian Krause <bst@pengutronix.de>
> ---
Applied, thanks
Sascha
--
Pengutronix e.K. | |
Industrial Linux Solutions | http://www.pengutronix.de/ |
Peiner Str. 6-8, 31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-08-05 9:34 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-08-01 9:19 [PATCH] mtd: spi-nor: fix page offset/remains calculation in spi_nor_write Bastian Krause
2019-08-01 13:16 ` Bastian Krause
2019-08-05 9:34 ` Sascha Hauer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox