[PATCH 0/3] mtd: spinand: Fix reading and writing of bad block markers

[PATCH 0/3] mtd: spinand: Fix reading and writing of bad block markers

[Schrempf Frieder]

From: Frieder Schrempf <frieder.schrempf@kontron.de>

We were pointed to the issue of bad block markers not being saved to flash on
one of our boards with SPI NAND flash. After a bit of investigation it seems
like there are two overlapping bugs in the original framework that cause silent
failure when writing a bad block marker.

This set contains fixes for both of these issues and one more fix (patch 2) that
should not affect the actual behavior of the driver.

Frieder Schrempf (3):
  mtd: spinand: Stop using spinand->oobbuf for buffering bad block
    markers
  mtd: spinand: Explicitly use MTD_OPS_RAW to write the bad block marker
    to OOB
  mtd: spinand: Wait for the erase op to finish before writing a bad
    block marker

 drivers/mtd/nand/spi/core.c | 67 +++++++++++++++++++------------------
 1 file changed, 34 insertions(+), 33 deletions(-)

-- 
2.17.1

[PATCH 1/3] mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers

[Schrempf Frieder]

From: Frieder Schrempf <frieder.schrempf@kontron.de>

For reading and writing the bad block markers, spinand->oobbuf is
currently used as a buffer for the marker bytes. During the
underlying read and write operations to actually get/set the content
of the OOB area, the content of spinand->oobbuf is reused and changed
by accessing it through spinand->oobbuf and/or spinand->databuf.

This is a flaw in the original design of the SPI MEM core and at the
latest from 13c15e07eedf ("mtd: spinand: Handle the case where
PROGRAM LOAD does not reset the cache") on, it results in not having
the bad block marker written at all, as the spinand->oobbuf is
cleared to 0xff after setting the marker bytes to zero.

To fix it, we now just store the two bytes for the marker on the
stack and let the read/write operations copy it from/to the page
buffer later.

Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Cc: stable@vger.kernel.org
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
---
 drivers/mtd/nand/spi/core.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 89f6beefb01c..5d267a67a5f7 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -568,18 +568,18 @@ static int spinand_mtd_write(struct mtd_info *mtd, loff_t to,
 static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
 {
 	struct spinand_device *spinand = nand_to_spinand(nand);
+	u8 marker[] = { 0, 0 };
 	struct nand_page_io_req req = {
 		.pos = *pos,
 		.ooblen = 2,
 		.ooboffs = 0,
-		.oobbuf.in = spinand->oobbuf,
+		.oobbuf.in = marker,
 		.mode = MTD_OPS_RAW,
 	};
 
-	memset(spinand->oobbuf, 0, 2);
 	spinand_select_target(spinand, pos->target);
 	spinand_read_page(spinand, &req, false);
-	if (spinand->oobbuf[0] != 0xff || spinand->oobbuf[1] != 0xff)
+	if (marker[0] != 0xff || marker[1] != 0xff)
 		return true;
 
 	return false;
@@ -603,11 +603,12 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
 static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
 {
 	struct spinand_device *spinand = nand_to_spinand(nand);
+	u8 marker[] = { 0, 0 };
 	struct nand_page_io_req req = {
 		.pos = *pos,
 		.ooboffs = 0,
 		.ooblen = 2,
-		.oobbuf.out = spinand->oobbuf,
+		.oobbuf.out = marker,
 	};
 	int ret;
 
@@ -622,7 +623,6 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
 
 	spinand_erase_op(spinand, pos);
 
-	memset(spinand->oobbuf, 0, 2);
 	return spinand_write_page(spinand, &req);
 }
 
-- 
2.17.1

[PATCH 2/3] mtd: spinand: Explicitly use MTD_OPS_RAW to write the bad block marker to OOB

[Schrempf Frieder]

From: Frieder Schrempf <frieder.schrempf@kontron.de>

When writing the bad block marker to the OOB area the access mode
should be set to MTD_OPS_RAW as it is done for reading the marker.
Currently this only works because req.mode is initialized to
MTD_OPS_PLACE_OOB (0) and spinand_write_to_cache_op() checks for
req.mode != MTD_OPS_AUTO_OOB.

Fix this by explicitly setting req.mode to MTD_OPS_RAW.

Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
---
 drivers/mtd/nand/spi/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 5d267a67a5f7..925db6269861 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -609,6 +609,7 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
 		.ooboffs = 0,
 		.ooblen = 2,
 		.oobbuf.out = marker,
+		.mode = MTD_OPS_RAW,
 	};
 	int ret;
 
-- 
2.17.1

[PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[Schrempf Frieder]

From: Frieder Schrempf <frieder.schrempf@kontron.de>

Currently when marking a block, we use spinand_erase_op() to erase
the block before writing the marker to the OOB area without waiting
for the operation to succeed. This can lead to the marking failing
silently and no bad block marker being written to the flash.

To fix this we reuse the spinand_erase() function, that already does
everything we need to do before actually writing the marker.

Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
Cc: stable@vger.kernel.org
Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
---
 drivers/mtd/nand/spi/core.c | 56 ++++++++++++++++++-------------------
 1 file changed, 28 insertions(+), 28 deletions(-)

diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
index 925db6269861..8a69d13639e2 100644
--- a/drivers/mtd/nand/spi/core.c
+++ b/drivers/mtd/nand/spi/core.c
@@ -600,6 +600,32 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
 	return ret;
 }
 
+static int __spinand_erase(struct nand_device *nand, const struct nand_pos *pos,
+			   bool hard_fail)
+{
+	struct spinand_device *spinand = nand_to_spinand(nand);
+	u8 status;
+	int ret;
+
+	ret = spinand_select_target(spinand, pos->target);
+	if (ret)
+		return ret;
+
+	ret = spinand_write_enable_op(spinand);
+	if (ret)
+		return ret;
+
+	ret = spinand_erase_op(spinand, pos);
+	if (ret && hard_fail)
+		return ret;
+
+	ret = spinand_wait(spinand, &status);
+	if (!ret && (status & STATUS_ERASE_FAILED))
+		ret = -EIO;
+
+	return ret;
+}
+
 static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
 {
 	struct spinand_device *spinand = nand_to_spinand(nand);
@@ -614,16 +640,10 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
 	int ret;
 
 	/* Erase block before marking it bad. */
-	ret = spinand_select_target(spinand, pos->target);
-	if (ret)
-		return ret;
-
-	ret = spinand_write_enable_op(spinand);
+	ret = __spinand_erase(nand, pos, false);
 	if (ret)
 		return ret;
 
-	spinand_erase_op(spinand, pos);
-
 	return spinand_write_page(spinand, &req);
 }
 
@@ -644,27 +664,7 @@ static int spinand_mtd_block_markbad(struct mtd_info *mtd, loff_t offs)
 
 static int spinand_erase(struct nand_device *nand, const struct nand_pos *pos)
 {
-	struct spinand_device *spinand = nand_to_spinand(nand);
-	u8 status;
-	int ret;
-
-	ret = spinand_select_target(spinand, pos->target);
-	if (ret)
-		return ret;
-
-	ret = spinand_write_enable_op(spinand);
-	if (ret)
-		return ret;
-
-	ret = spinand_erase_op(spinand, pos);
-	if (ret)
-		return ret;
-
-	ret = spinand_wait(spinand, &status);
-	if (!ret && (status & STATUS_ERASE_FAILED))
-		ret = -EIO;
-
-	return ret;
+	return __spinand_erase(nand, pos, true);
 }
 
 static int spinand_mtd_erase(struct mtd_info *mtd,
-- 
2.17.1

Re: [PATCH 1/3] mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers

[Schrempf Frieder]

On 11.02.20 17:35, Schrempf Frieder wrote:
> From: Frieder Schrempf <frieder.schrempf@kontron.de>
> 
> For reading and writing the bad block markers, spinand->oobbuf is
> currently used as a buffer for the marker bytes. During the
> underlying read and write operations to actually get/set the content
> of the OOB area, the content of spinand->oobbuf is reused and changed
> by accessing it through spinand->oobbuf and/or spinand->databuf.
> 
> This is a flaw in the original design of the SPI MEM core and at the

This should be SPI NAND, of course.            ^

> latest from 13c15e07eedf ("mtd: spinand: Handle the case where
> PROGRAM LOAD does not reset the cache") on, it results in not having
> the bad block marker written at all, as the spinand->oobbuf is
> cleared to 0xff after setting the marker bytes to zero.
> 
> To fix it, we now just store the two bytes for the marker on the
> stack and let the read/write operations copy it from/to the page
> buffer later.
> 
> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> ---
>   drivers/mtd/nand/spi/core.c | 10 +++++-----
>   1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
> index 89f6beefb01c..5d267a67a5f7 100644
> --- a/drivers/mtd/nand/spi/core.c
> +++ b/drivers/mtd/nand/spi/core.c
> @@ -568,18 +568,18 @@ static int spinand_mtd_write(struct mtd_info *mtd, loff_t to,
>   static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
>   {
>   	struct spinand_device *spinand = nand_to_spinand(nand);
> +	u8 marker[] = { 0, 0 };
>   	struct nand_page_io_req req = {
>   		.pos = *pos,
>   		.ooblen = 2,
>   		.ooboffs = 0,
> -		.oobbuf.in = spinand->oobbuf,
> +		.oobbuf.in = marker,
>   		.mode = MTD_OPS_RAW,
>   	};
>   
> -	memset(spinand->oobbuf, 0, 2);
>   	spinand_select_target(spinand, pos->target);
>   	spinand_read_page(spinand, &req, false);
> -	if (spinand->oobbuf[0] != 0xff || spinand->oobbuf[1] != 0xff)
> +	if (marker[0] != 0xff || marker[1] != 0xff)
>   		return true;
>   
>   	return false;
> @@ -603,11 +603,12 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
>   static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>   {
>   	struct spinand_device *spinand = nand_to_spinand(nand);
> +	u8 marker[] = { 0, 0 };
>   	struct nand_page_io_req req = {
>   		.pos = *pos,
>   		.ooboffs = 0,
>   		.ooblen = 2,
> -		.oobbuf.out = spinand->oobbuf,
> +		.oobbuf.out = marker,
>   	};
>   	int ret;
>   
> @@ -622,7 +623,6 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>   
>   	spinand_erase_op(spinand, pos);
>   
> -	memset(spinand->oobbuf, 0, 2);
>   	return spinand_write_page(spinand, &req);
>   }
>   
> 

Re: [PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[Miquel Raynal]

Hi Frieder,

Schrempf Frieder <frieder.schrempf@kontron.de> wrote on Tue, 11 Feb
2020 16:35:53 +0000:

> From: Frieder Schrempf <frieder.schrempf@kontron.de>
> 
> Currently when marking a block, we use spinand_erase_op() to erase
> the block before writing the marker to the OOB area without waiting
> for the operation to succeed. This can lead to the marking failing
> silently and no bad block marker being written to the flash.
> 
> To fix this we reuse the spinand_erase() function, that already does
> everything we need to do before actually writing the marker.
> 

Thanks a lot for this series!

Yet I don't really understand the point of waiting for the erasure if
it failed: we don't really care as programming (1 -> 0) cells is always
possible. Are you sure this lead to an error?

Also, why just not calling spinand_erase() instead of
spinand_erase_op() from spinand_markbad()?

> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> ---
>  drivers/mtd/nand/spi/core.c | 56 ++++++++++++++++++-------------------
>  1 file changed, 28 insertions(+), 28 deletions(-)
> 
> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
> index 925db6269861..8a69d13639e2 100644
> --- a/drivers/mtd/nand/spi/core.c
> +++ b/drivers/mtd/nand/spi/core.c
> @@ -600,6 +600,32 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
>  	return ret;
>  }
>  
> +static int __spinand_erase(struct nand_device *nand, const struct nand_pos *pos,
> +			   bool hard_fail)
> +{
> +	struct spinand_device *spinand = nand_to_spinand(nand);
> +	u8 status;
> +	int ret;
> +
> +	ret = spinand_select_target(spinand, pos->target);
> +	if (ret)
> +		return ret;
> +
> +	ret = spinand_write_enable_op(spinand);
> +	if (ret)
> +		return ret;
> +
> +	ret = spinand_erase_op(spinand, pos);
> +	if (ret && hard_fail)
> +		return ret;
> +
> +	ret = spinand_wait(spinand, &status);
> +	if (!ret && (status & STATUS_ERASE_FAILED))
> +		ret = -EIO;
> +
> +	return ret;
> +}
> +
>  static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>  {
>  	struct spinand_device *spinand = nand_to_spinand(nand);
> @@ -614,16 +640,10 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>  	int ret;
>  
>  	/* Erase block before marking it bad. */
> -	ret = spinand_select_target(spinand, pos->target);
> -	if (ret)
> -		return ret;
> -
> -	ret = spinand_write_enable_op(spinand);
> +	ret = __spinand_erase(nand, pos, false);
>  	if (ret)
>  		return ret;
>  
> -	spinand_erase_op(spinand, pos);
> -
>  	return spinand_write_page(spinand, &req);
>  }
>  
> @@ -644,27 +664,7 @@ static int spinand_mtd_block_markbad(struct mtd_info *mtd, loff_t offs)
>  
>  static int spinand_erase(struct nand_device *nand, const struct nand_pos *pos)
>  {
> -	struct spinand_device *spinand = nand_to_spinand(nand);
> -	u8 status;
> -	int ret;
> -
> -	ret = spinand_select_target(spinand, pos->target);
> -	if (ret)
> -		return ret;
> -
> -	ret = spinand_write_enable_op(spinand);
> -	if (ret)
> -		return ret;
> -
> -	ret = spinand_erase_op(spinand, pos);
> -	if (ret)
> -		return ret;
> -
> -	ret = spinand_wait(spinand, &status);
> -	if (!ret && (status & STATUS_ERASE_FAILED))
> -		ret = -EIO;
> -
> -	return ret;
> +	return __spinand_erase(nand, pos, true);
>  }
>  
>  static int spinand_mtd_erase(struct mtd_info *mtd,

Thanks,
Miquèl

Re: [PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[Boris Brezillon]

On Mon, 17 Feb 2020 11:39:19 +0100
Miquel Raynal <miquel.raynal@bootlin.com> wrote:

> Hi Frieder,
> 
> Schrempf Frieder <frieder.schrempf@kontron.de> wrote on Tue, 11 Feb
> 2020 16:35:53 +0000:
> 
> > From: Frieder Schrempf <frieder.schrempf@kontron.de>
> > 
> > Currently when marking a block, we use spinand_erase_op() to erase
> > the block before writing the marker to the OOB area without waiting
> > for the operation to succeed. This can lead to the marking failing
> > silently and no bad block marker being written to the flash.
> > 
> > To fix this we reuse the spinand_erase() function, that already does
> > everything we need to do before actually writing the marker.
> >   
> 
> Thanks a lot for this series!
> 
> Yet I don't really understand the point of waiting for the erasure if
> it failed: we don't really care as programming (1 -> 0) cells is always
> possible. Are you sure this lead to an error?

Actually, I think I already pointed out that we should probably write
the BBM without erasing the block. IIRC, this logic has been copied
from rawnand where some controllers don't disable the ECC engine when
doing raw accesses, leading to ECC errors if the block is not erased
before BBMs are programmed. Assuming we don't let such drivers being
merged in spinand, this erase operation can be dropped.

> 
> Also, why just not calling spinand_erase() instead of
> spinand_erase_op() from spinand_markbad()?
> 
> > Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
> > Cc: stable@vger.kernel.org
> > Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> > ---
> >  drivers/mtd/nand/spi/core.c | 56 ++++++++++++++++++-------------------
> >  1 file changed, 28 insertions(+), 28 deletions(-)
> > 
> > diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
> > index 925db6269861..8a69d13639e2 100644
> > --- a/drivers/mtd/nand/spi/core.c
> > +++ b/drivers/mtd/nand/spi/core.c
> > @@ -600,6 +600,32 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
> >  	return ret;
> >  }
> >  
> > +static int __spinand_erase(struct nand_device *nand, const struct nand_pos *pos,
> > +			   bool hard_fail)

I hate those __ prefix. Please find a more descriptive name
(spinand_erase_block() or spinand_erase_and_wait()?)

> > +{
> > +	struct spinand_device *spinand = nand_to_spinand(nand);
> > +	u8 status;
> > +	int ret;
> > +
> > +	ret = spinand_select_target(spinand, pos->target);
> > +	if (ret)
> > +		return ret;
> > +
> > +	ret = spinand_write_enable_op(spinand);
> > +	if (ret)
> > +		return ret;
> > +
> > +	ret = spinand_erase_op(spinand, pos);
> > +	if (ret && hard_fail)
> > +		return ret;
> > +
> > +	ret = spinand_wait(spinand, &status);
> > +	if (!ret && (status & STATUS_ERASE_FAILED))
> > +		ret = -EIO;
> > +
> > +	return ret;
> > +}
> > +
> >  static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
> >  {
> >  	struct spinand_device *spinand = nand_to_spinand(nand);
> > @@ -614,16 +640,10 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
> >  	int ret;
> >  
> >  	/* Erase block before marking it bad. */
> > -	ret = spinand_select_target(spinand, pos->target);
> > -	if (ret)
> > -		return ret;
> > -
> > -	ret = spinand_write_enable_op(spinand);
> > +	ret = __spinand_erase(nand, pos, false);
> >  	if (ret)
> >  		return ret;
> >  
> > -	spinand_erase_op(spinand, pos);
> > -
> >  	return spinand_write_page(spinand, &req);
> >  }
> >  
> > @@ -644,27 +664,7 @@ static int spinand_mtd_block_markbad(struct mtd_info *mtd, loff_t offs)
> >  
> >  static int spinand_erase(struct nand_device *nand, const struct nand_pos *pos)
> >  {
> > -	struct spinand_device *spinand = nand_to_spinand(nand);
> > -	u8 status;
> > -	int ret;
> > -
> > -	ret = spinand_select_target(spinand, pos->target);
> > -	if (ret)
> > -		return ret;
> > -
> > -	ret = spinand_write_enable_op(spinand);
> > -	if (ret)
> > -		return ret;
> > -
> > -	ret = spinand_erase_op(spinand, pos);
> > -	if (ret)
> > -		return ret;
> > -
> > -	ret = spinand_wait(spinand, &status);
> > -	if (!ret && (status & STATUS_ERASE_FAILED))
> > -		ret = -EIO;
> > -
> > -	return ret;
> > +	return __spinand_erase(nand, pos, true);
> >  }
> >  
> >  static int spinand_mtd_erase(struct mtd_info *mtd,  
> 
> Thanks,
> Miquèl

Re: [PATCH 1/3] mtd: spinand: Stop using spinand->oobbuf for buffering bad block markers

[Boris Brezillon]

On Tue, 11 Feb 2020 16:35:33 +0000
Schrempf Frieder <frieder.schrempf@kontron.de> wrote:

> From: Frieder Schrempf <frieder.schrempf@kontron.de>
> 
> For reading and writing the bad block markers, spinand->oobbuf is
> currently used as a buffer for the marker bytes. During the
> underlying read and write operations to actually get/set the content
> of the OOB area, the content of spinand->oobbuf is reused and changed
> by accessing it through spinand->oobbuf and/or spinand->databuf.
> 
> This is a flaw in the original design of the SPI MEM core and at the
> latest from 13c15e07eedf ("mtd: spinand: Handle the case where
> PROGRAM LOAD does not reset the cache") on, it results in not having
> the bad block marker written at all, as the spinand->oobbuf is
> cleared to 0xff after setting the marker bytes to zero.
> 
> To fix it, we now just store the two bytes for the marker on the
> stack and let the read/write operations copy it from/to the page
> buffer later.
> 
> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
> Cc: stable@vger.kernel.org
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
> ---
>  drivers/mtd/nand/spi/core.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
> index 89f6beefb01c..5d267a67a5f7 100644
> --- a/drivers/mtd/nand/spi/core.c
> +++ b/drivers/mtd/nand/spi/core.c
> @@ -568,18 +568,18 @@ static int spinand_mtd_write(struct mtd_info *mtd, loff_t to,
>  static bool spinand_isbad(struct nand_device *nand, const struct nand_pos *pos)
>  {
>  	struct spinand_device *spinand = nand_to_spinand(nand);
> +	u8 marker[] = { 0, 0 };

How about

	u8 marker[2] = { };

?

>  	struct nand_page_io_req req = {
>  		.pos = *pos,
>  		.ooblen = 2,

		.ooblen = sizeof(marker),

>  		.ooboffs = 0,
> -		.oobbuf.in = spinand->oobbuf,
> +		.oobbuf.in = marker,
>  		.mode = MTD_OPS_RAW,
>  	};
>  
> -	memset(spinand->oobbuf, 0, 2);
>  	spinand_select_target(spinand, pos->target);
>  	spinand_read_page(spinand, &req, false);
> -	if (spinand->oobbuf[0] != 0xff || spinand->oobbuf[1] != 0xff)
> +	if (marker[0] != 0xff || marker[1] != 0xff)
>  		return true;
>  
>  	return false;
> @@ -603,11 +603,12 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
>  static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>  {
>  	struct spinand_device *spinand = nand_to_spinand(nand);
> +	u8 marker[] = { 0, 0 };
>  	struct nand_page_io_req req = {
>  		.pos = *pos,
>  		.ooboffs = 0,
>  		.ooblen = 2,
> -		.oobbuf.out = spinand->oobbuf,
> +		.oobbuf.out = marker,

Ditto.

>  	};
>  	int ret;
>  
> @@ -622,7 +623,6 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>  
>  	spinand_erase_op(spinand, pos);
>  
> -	memset(spinand->oobbuf, 0, 2);
>  	return spinand_write_page(spinand, &req);
>  }
>  

With these minor things addressed

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>

Re: [PATCH 2/3] mtd: spinand: Explicitly use MTD_OPS_RAW to write the bad block marker to OOB

[Boris Brezillon]

On Tue, 11 Feb 2020 16:35:43 +0000
Schrempf Frieder <frieder.schrempf@kontron.de> wrote:

> From: Frieder Schrempf <frieder.schrempf@kontron.de>
> 
> When writing the bad block marker to the OOB area the access mode
> should be set to MTD_OPS_RAW as it is done for reading the marker.
> Currently this only works because req.mode is initialized to
> MTD_OPS_PLACE_OOB (0) and spinand_write_to_cache_op() checks for
> req.mode != MTD_OPS_AUTO_OOB.
> 
> Fix this by explicitly setting req.mode to MTD_OPS_RAW.
> 
> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>

Reviewed-by: Boris Brezillon <boris.brezillon@collabora.com>

> ---
>  drivers/mtd/nand/spi/core.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
> index 5d267a67a5f7..925db6269861 100644
> --- a/drivers/mtd/nand/spi/core.c
> +++ b/drivers/mtd/nand/spi/core.c
> @@ -609,6 +609,7 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>  		.ooboffs = 0,
>  		.ooblen = 2,
>  		.oobbuf.out = marker,
> +		.mode = MTD_OPS_RAW,
>  	};
>  	int ret;
>  

Re: [PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[Schrempf Frieder]

Hi Miquel,

On 17.02.20 11:39, Miquel Raynal wrote:
> Hi Frieder,
> 
> Schrempf Frieder <frieder.schrempf@kontron.de> wrote on Tue, 11 Feb
> 2020 16:35:53 +0000:
> 
>> From: Frieder Schrempf <frieder.schrempf@kontron.de>
>>
>> Currently when marking a block, we use spinand_erase_op() to erase
>> the block before writing the marker to the OOB area without waiting
>> for the operation to succeed. This can lead to the marking failing
>> silently and no bad block marker being written to the flash.
>>
>> To fix this we reuse the spinand_erase() function, that already does
>> everything we need to do before actually writing the marker.
>>
> 
> Thanks a lot for this series!
> 
> Yet I don't really understand the point of waiting for the erasure if
> it failed: we don't really care as programming (1 -> 0) cells is always
> possible. Are you sure this lead to an error?

We don't care about the result of the erase operation, but I think we 
still need to wait for it to be done and the STATUS_BUSY bit to be 
cleared. Otherwise it seems like the program operation to set the marker 
can get ignored by the chip. At least that's my explanation for the 
behavior I was observing.

> 
> Also, why just not calling spinand_erase() instead of
> spinand_erase_op() from spinand_markbad()?

Yeah, that's wrong. I was thinking, that spinand_erase_op() would return 
an error if the erase failed on the flash level (which should have been 
ignored in this case). The current code suggested this as it doesn't 
handle the return value of spinand_erase_op().

But in fact the success of the erase operation is only checked in 
spinand_erase() after waiting for the flash to be ready. So I think we 
can use spinand_erase(), but instead of ignoring the return value of 
spinand_erase_op(), we need to ignore the 'status & STATUS_ERASE_FAILED' 
check.

Thanks,
Frieder

> 
>> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
>> ---
>>   drivers/mtd/nand/spi/core.c | 56 ++++++++++++++++++-------------------
>>   1 file changed, 28 insertions(+), 28 deletions(-)
>>
>> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
>> index 925db6269861..8a69d13639e2 100644
>> --- a/drivers/mtd/nand/spi/core.c
>> +++ b/drivers/mtd/nand/spi/core.c
>> @@ -600,6 +600,32 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
>>   	return ret;
>>   }
>>   
>> +static int __spinand_erase(struct nand_device *nand, const struct nand_pos *pos,
>> +			   bool hard_fail)
>> +{
>> +	struct spinand_device *spinand = nand_to_spinand(nand);
>> +	u8 status;
>> +	int ret;
>> +
>> +	ret = spinand_select_target(spinand, pos->target);
>> +	if (ret)
>> +		return ret;
>> +
>> +	ret = spinand_write_enable_op(spinand);
>> +	if (ret)
>> +		return ret;
>> +
>> +	ret = spinand_erase_op(spinand, pos);
>> +	if (ret && hard_fail)
>> +		return ret;
>> +
>> +	ret = spinand_wait(spinand, &status);
>> +	if (!ret && (status & STATUS_ERASE_FAILED))
>> +		ret = -EIO;
>> +
>> +	return ret;
>> +}
>> +
>>   static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>>   {
>>   	struct spinand_device *spinand = nand_to_spinand(nand);
>> @@ -614,16 +640,10 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>>   	int ret;
>>   
>>   	/* Erase block before marking it bad. */
>> -	ret = spinand_select_target(spinand, pos->target);
>> -	if (ret)
>> -		return ret;
>> -
>> -	ret = spinand_write_enable_op(spinand);
>> +	ret = __spinand_erase(nand, pos, false);
>>   	if (ret)
>>   		return ret;
>>   
>> -	spinand_erase_op(spinand, pos);
>> -
>>   	return spinand_write_page(spinand, &req);
>>   }
>>   
>> @@ -644,27 +664,7 @@ static int spinand_mtd_block_markbad(struct mtd_info *mtd, loff_t offs)
>>   
>>   static int spinand_erase(struct nand_device *nand, const struct nand_pos *pos)
>>   {
>> -	struct spinand_device *spinand = nand_to_spinand(nand);
>> -	u8 status;
>> -	int ret;
>> -
>> -	ret = spinand_select_target(spinand, pos->target);
>> -	if (ret)
>> -		return ret;
>> -
>> -	ret = spinand_write_enable_op(spinand);
>> -	if (ret)
>> -		return ret;
>> -
>> -	ret = spinand_erase_op(spinand, pos);
>> -	if (ret)
>> -		return ret;
>> -
>> -	ret = spinand_wait(spinand, &status);
>> -	if (!ret && (status & STATUS_ERASE_FAILED))
>> -		ret = -EIO;
>> -
>> -	return ret;
>> +	return __spinand_erase(nand, pos, true);
>>   }
>>   
>>   static int spinand_mtd_erase(struct mtd_info *mtd,
> 
> Thanks,
> Miquèl
> 

Re: [PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[Schrempf Frieder]

Hi Boris,

On 17.02.20 12:14, Boris Brezillon wrote:
> On Mon, 17 Feb 2020 11:39:19 +0100
> Miquel Raynal <miquel.raynal@bootlin.com> wrote:
> 
>> Hi Frieder,
>>
>> Schrempf Frieder <frieder.schrempf@kontron.de> wrote on Tue, 11 Feb
>> 2020 16:35:53 +0000:
>>
>>> From: Frieder Schrempf <frieder.schrempf@kontron.de>
>>>
>>> Currently when marking a block, we use spinand_erase_op() to erase
>>> the block before writing the marker to the OOB area without waiting
>>> for the operation to succeed. This can lead to the marking failing
>>> silently and no bad block marker being written to the flash.
>>>
>>> To fix this we reuse the spinand_erase() function, that already does
>>> everything we need to do before actually writing the marker.
>>>    
>>
>> Thanks a lot for this series!
>>
>> Yet I don't really understand the point of waiting for the erasure if
>> it failed: we don't really care as programming (1 -> 0) cells is always
>> possible. Are you sure this lead to an error?
> 
> Actually, I think I already pointed out that we should probably write
> the BBM without erasing the block. IIRC, this logic has been copied
> from rawnand where some controllers don't disable the ECC engine when
> doing raw accesses, leading to ECC errors if the block is not erased
> before BBMs are programmed. Assuming we don't let such drivers being
> merged in spinand, this erase operation can be dropped.

You're probably right, we could also just write the BBM without erasing 
the block. I will try if this works in my setup and update the patch.

> 
>>
>> Also, why just not calling spinand_erase() instead of
>> spinand_erase_op() from spinand_markbad()?
>>
>>> Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs")
>>> Cc: stable@vger.kernel.org
>>> Signed-off-by: Frieder Schrempf <frieder.schrempf@kontron.de>
>>> ---
>>>   drivers/mtd/nand/spi/core.c | 56 ++++++++++++++++++-------------------
>>>   1 file changed, 28 insertions(+), 28 deletions(-)
>>>
>>> diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c
>>> index 925db6269861..8a69d13639e2 100644
>>> --- a/drivers/mtd/nand/spi/core.c
>>> +++ b/drivers/mtd/nand/spi/core.c
>>> @@ -600,6 +600,32 @@ static int spinand_mtd_block_isbad(struct mtd_info *mtd, loff_t offs)
>>>   	return ret;
>>>   }
>>>   
>>> +static int __spinand_erase(struct nand_device *nand, const struct nand_pos *pos,
>>> +			   bool hard_fail)
> 
> I hate those __ prefix. Please find a more descriptive name
> (spinand_erase_block() or spinand_erase_and_wait()?)

Actually I was expecting this comment ;)
And I totally agree. I was just lazy to come up with a name.
If we follow the approach without erase, I can get rid of this anyway.

Thanks,
Frieder

> 
>>> +{
>>> +	struct spinand_device *spinand = nand_to_spinand(nand);
>>> +	u8 status;
>>> +	int ret;
>>> +
>>> +	ret = spinand_select_target(spinand, pos->target);
>>> +	if (ret)
>>> +		return ret;
>>> +
>>> +	ret = spinand_write_enable_op(spinand);
>>> +	if (ret)
>>> +		return ret;
>>> +
>>> +	ret = spinand_erase_op(spinand, pos);
>>> +	if (ret && hard_fail)
>>> +		return ret;
>>> +
>>> +	ret = spinand_wait(spinand, &status);
>>> +	if (!ret && (status & STATUS_ERASE_FAILED))
>>> +		ret = -EIO;
>>> +
>>> +	return ret;
>>> +}
>>> +
>>>   static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>>>   {
>>>   	struct spinand_device *spinand = nand_to_spinand(nand);
>>> @@ -614,16 +640,10 @@ static int spinand_markbad(struct nand_device *nand, const struct nand_pos *pos)
>>>   	int ret;
>>>   
>>>   	/* Erase block before marking it bad. */
>>> -	ret = spinand_select_target(spinand, pos->target);
>>> -	if (ret)
>>> -		return ret;
>>> -
>>> -	ret = spinand_write_enable_op(spinand);
>>> +	ret = __spinand_erase(nand, pos, false);
>>>   	if (ret)
>>>   		return ret;
>>>   
>>> -	spinand_erase_op(spinand, pos);
>>> -
>>>   	return spinand_write_page(spinand, &req);
>>>   }
>>>   
>>> @@ -644,27 +664,7 @@ static int spinand_mtd_block_markbad(struct mtd_info *mtd, loff_t offs)
>>>   
>>>   static int spinand_erase(struct nand_device *nand, const struct nand_pos *pos)
>>>   {
>>> -	struct spinand_device *spinand = nand_to_spinand(nand);
>>> -	u8 status;
>>> -	int ret;
>>> -
>>> -	ret = spinand_select_target(spinand, pos->target);
>>> -	if (ret)
>>> -		return ret;
>>> -
>>> -	ret = spinand_write_enable_op(spinand);
>>> -	if (ret)
>>> -		return ret;
>>> -
>>> -	ret = spinand_erase_op(spinand, pos);
>>> -	if (ret)
>>> -		return ret;
>>> -
>>> -	ret = spinand_wait(spinand, &status);
>>> -	if (!ret && (status & STATUS_ERASE_FAILED))
>>> -		ret = -EIO;
>>> -
>>> -	return ret;
>>> +	return __spinand_erase(nand, pos, true);
>>>   }
>>>   
>>>   static int spinand_mtd_erase(struct mtd_info *mtd,
>>
>> Thanks,
>> Miquèl
> 

RE: [PATCH 3/3] mtd: spinand: Wait for the erase op to finish before writing a bad block marker

[David Laight]

From: Schrempf Frieder
> Sent: 17 February 2020 11:19
> > Schrempf Frieder <frieder.schrempf@kontron.de> wrote on Tue, 11 Feb
> > 2020 16:35:53 +0000:
> >
> >> From: Frieder Schrempf <frieder.schrempf@kontron.de>
> >>
> >> Currently when marking a block, we use spinand_erase_op() to erase
> >> the block before writing the marker to the OOB area without waiting
> >> for the operation to succeed. This can lead to the marking failing
> >> silently and no bad block marker being written to the flash.
> >>
> >> To fix this we reuse the spinand_erase() function, that already does
> >> everything we need to do before actually writing the marker.
> >>
> >
> > Thanks a lot for this series!
> >
> > Yet I don't really understand the point of waiting for the erasure if
> > it failed: we don't really care as programming (1 -> 0) cells is always
> > possible. Are you sure this lead to an error?
> 
> We don't care about the result of the erase operation, but I think we
> still need to wait for it to be done and the STATUS_BUSY bit to be
> cleared. Otherwise it seems like the program operation to set the marker
> can get ignored by the chip. At least that's my explanation for the
> behavior I was observing.

Serial flash devices won't allow any accesses while an erase or write
in in progress.
So while you don't need to wait for either to finish, you do need
to remember that one is 'pending' and wait for it to finish
before any further accesses (apart from reads of the status register).

How many writes you can do to an area (that clear 1s) and the size
of the area will be device dependant.
IIRC one device I've used allows 2 writes to each 16bit word.
This allows either two separate byte writes or one write of
a 16bit (or 32bit) value followed by a second write of all 0s
the 'erase' the value without doing a erase-rewrite cycle.

	David

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)