Aaron Durbin (adurbin@chromium.org) just uploaded a new patch set to gerrit, which you can find at https://review.coreboot.org/17910
-gerrit
commit a6efeaa5699826f6d7d8cc8209a3a9cb877c9c73 Author: Aaron Durbin adurbin@chromium.org Date: Sat Dec 17 13:16:07 2016 -0600
drivers/spi: fix flash writes at page boundaries
There was an assumption that all SPI controllers could consume a full page of data to write. However, that assumption doesn't hold when spi_crop_chunk() indicates sizes smaller than page size. If the requested offset isn't page aligned from the start then writes will fail corrupting data since a page boundary isn't honored.
The spansion driver still looks very broken as page_addr isn't recalculated. Therefore that code seems to assume the write requests are within a single page.
Change-Id: I93e24a5a717adcee45a017c164bd960f4592ad50 Signed-off-by: Aaron Durbin adurbin@chromium.org --- src/drivers/spi/adesto.c | 3 +-- src/drivers/spi/atmel.c | 3 +-- src/drivers/spi/eon.c | 3 +-- src/drivers/spi/gigadevice.c | 3 +-- src/drivers/spi/macronix.c | 3 +-- src/drivers/spi/spansion.c | 3 +-- src/drivers/spi/sst.c | 3 +-- src/drivers/spi/stmicro.c | 3 +-- src/drivers/spi/winbond.c | 3 +-- 9 files changed, 9 insertions(+), 18 deletions(-)
diff --git a/src/drivers/spi/adesto.c b/src/drivers/spi/adesto.c index 52a74f9..d286bd6 100644 --- a/src/drivers/spi/adesto.c +++ b/src/drivers/spi/adesto.c @@ -93,9 +93,9 @@ static int adesto_write(const struct spi_flash *flash, u32 offset, size_t len, u8 cmd[4];
page_size = 1 << stm->params->l2_page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -127,7 +127,6 @@ static int adesto_write(const struct spi_flash *flash, u32 offset, size_t len, goto out;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/atmel.c b/src/drivers/spi/atmel.c index feb1a6d..39cc95e 100644 --- a/src/drivers/spi/atmel.c +++ b/src/drivers/spi/atmel.c @@ -121,9 +121,9 @@ static int atmel_write(const struct spi_flash *flash, u32 offset, size_t len, u8 cmd[4];
page_size = 1 << stm->params->l2_page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -155,7 +155,6 @@ static int atmel_write(const struct spi_flash *flash, u32 offset, size_t len, goto out;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/eon.c b/src/drivers/spi/eon.c index f6db9e3..eb71c62 100644 --- a/src/drivers/spi/eon.c +++ b/src/drivers/spi/eon.c @@ -91,9 +91,9 @@ static int eon_write(const struct spi_flash *flash, u8 cmd[4];
page_size = 1 << eon->params->page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -128,7 +128,6 @@ static int eon_write(const struct spi_flash *flash, }
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/gigadevice.c b/src/drivers/spi/gigadevice.c index 84d19a6..ed3d8bf 100644 --- a/src/drivers/spi/gigadevice.c +++ b/src/drivers/spi/gigadevice.c @@ -132,9 +132,9 @@ static int gigadevice_write(const struct spi_flash *flash, u32 offset, u8 cmd[4];
page_size = 1 << stm->params->l2_page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -169,7 +169,6 @@ static int gigadevice_write(const struct spi_flash *flash, u32 offset, goto out;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/macronix.c b/src/drivers/spi/macronix.c index 0e3d028..6d143ef 100644 --- a/src/drivers/spi/macronix.c +++ b/src/drivers/spi/macronix.c @@ -160,9 +160,9 @@ static int macronix_write(const struct spi_flash *flash, u32 offset, size_t len, u8 cmd[4];
page_size = mcx->params->page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -194,7 +194,6 @@ static int macronix_write(const struct spi_flash *flash, u32 offset, size_t len, break;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/spansion.c b/src/drivers/spi/spansion.c index 091f7ae..dfce6d0 100644 --- a/src/drivers/spi/spansion.c +++ b/src/drivers/spi/spansion.c @@ -215,9 +215,9 @@ static int spansion_write(const struct spi_flash *flash, u32 offset, size_t len,
page_size = spsn->params->page_size; page_addr = offset / page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr);
cmd[0] = CMD_S25FLXX_PP; @@ -249,7 +249,6 @@ static int spansion_write(const struct spi_flash *flash, u32 offset, size_t len, break;
page_addr++; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/sst.c b/src/drivers/spi/sst.c index 70999a6..e571454 100644 --- a/src/drivers/spi/sst.c +++ b/src/drivers/spi/sst.c @@ -171,7 +171,6 @@ static int sst_write_256(const struct spi_flash *flash, u32 offset, size_t len, u8 cmd[4];
page_size = 256; - byte_addr = offset % page_size;
/* If the data is not word aligned, write out leading single byte */ actual = offset % 2; @@ -193,6 +192,7 @@ static int sst_write_256(const struct spi_flash *flash, u32 offset, size_t len, cmd[3] = offset;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -224,7 +224,6 @@ static int sst_write_256(const struct spi_flash *flash, u32 offset, size_t len, break;
offset += chunk_len; - byte_addr = 0; }
done: diff --git a/src/drivers/spi/stmicro.c b/src/drivers/spi/stmicro.c index 93d545f..79782e4 100644 --- a/src/drivers/spi/stmicro.c +++ b/src/drivers/spi/stmicro.c @@ -189,9 +189,9 @@ static int stmicro_write(const struct spi_flash *flash, u8 cmd[4];
page_size = stm->params->page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -223,7 +223,6 @@ static int stmicro_write(const struct spi_flash *flash, goto out;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH diff --git a/src/drivers/spi/winbond.c b/src/drivers/spi/winbond.c index 74c6e81..d071b9f 100644 --- a/src/drivers/spi/winbond.c +++ b/src/drivers/spi/winbond.c @@ -151,9 +151,9 @@ static int winbond_write(const struct spi_flash *flash, u32 offset, size_t len, u8 cmd[4];
page_size = 1 << stm->params->l2_page_size; - byte_addr = offset % page_size;
for (actual = 0; actual < len; actual += chunk_len) { + byte_addr = offset % page_size; chunk_len = min(len - actual, page_size - byte_addr); chunk_len = spi_crop_chunk(sizeof(cmd), chunk_len);
@@ -185,7 +185,6 @@ static int winbond_write(const struct spi_flash *flash, u32 offset, size_t len, goto out;
offset += chunk_len; - byte_addr = 0; }
#if CONFIG_DEBUG_SPI_FLASH