The only user of gpmi_nand_exit() is gpmi_nand_remove(). Move its content
to the caller.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Acked-by: Han Xu <han.xu@nxp.com>
The GPMI driver is wrongly assuming that nand_release() can safely be
called on an uninitialized/unregistered NAND device.
Add a new err_nand_cleanup label in the error path and only execute if
nand_scan_tail() succeeded.
Note that we now call nand_cleanup() instead of nand_release()
(nand_release() is actually grouping the mtd_device_unregister() and
nand_cleanup() in one call) because there's no point in trying to
unregister a device that has never been registered.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Acked-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Add support for i.MX 7 SoC. The i.MX 7 has a slightly different
clock architecture requiring only two clocks to be referenced.
The IP is slightly different compared to i.MX 6, but currently none
of this differences are in use, therefore reuse GPMI_IS_MX6.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Add device specific list of clocks required, and handle all clocks
in a single for loop. This avoids further code duplication when
adding i.MX 7 support.
Signed-off-by: Stefan Agner <stefan@agner.ch>
Reviewed-by: Marek Vasut <marek.vasut@gmail.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
We are going to split <linux/sched/task_stack.h> out of <linux/sched.h>, which
will have to be picked up from other headers and a couple of .c files.
Create a trivial placeholder <linux/sched/task_stack.h> file that just
maps to <linux/sched.h> to make this patch obviously correct and
bisectable.
Include the new header in the files that are going to need it.
Acked-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
change the way to calculate pagesize to get correct free oob space for
legacy_set_geometry function.
Signed-off-by: Han Xu <han.xu@nxp.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
ECC is only calculated for written pages. As erased pages are not
actively written the ECC is always invalid. For this purpose the
Hardware BCH unit is able to check for erased pages and does not raise
an ECC error in this case. This behaviour can be influenced using the
BCH_MODE register which sets the number of allowed bitflips in an erased
page. Unfortunately the unit is not capable of fixing the bitflips in
memory.
To avoid complete software checks for erased pages, we can simply check
buffers with uncorrectable ECC errors because we know that any erased
page with errors is uncorrectable by the BCH unit.
This patch adds the generic nand_check_erased_ecc_chunk() to gpmi-nand
to correct erased pages. To have the valid data in the buffer before
using them, this patch moves the read_page_swap_end() call before the
ECC status checking for-loop.
Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
[Squashed patches by Stefan and Boris to check ECC area]
Tested-by: Stefan Christ <s.christ@phytec.de>
Acked-by: Han xu <han.xu@nxp.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
The core now takes care of parsing generic DT properties in
nand_scan_ident() when nand_set_flash_node() has been called.
Rely on this initialization instead of calling of_get_nand_xxx()
manually.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Han xu <han.xu@nxp.com>
Implementing the mtd_ooblayout_ops interface is the new way of exposing
ECC/OOB layout to MTD users.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Han Xu <han.xu@nxp.com>
Tested-by: Han Xu <han.xu@nxp.com>
The mtd_ooblayout_xxx() helper functions have been added to avoid direct
accesses to the ecclayout field, and thus ease for future reworks.
Use these helpers in all places where the oobfree[] and eccpos[] arrays
where directly accessed.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
fix the raw_buffer pointer double free issue found by coverify.
CID 18344 (#2 of 2): Double free (USE_AFTER_FREE)
3. double_free: Calling gpmi_alloc_dma_buffer frees pointer
this->raw_buffer which has already been freed
Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
By default NAND driver will choose the highest ecc strength that oob
could contain, in this case, for some 8K+744 NAND flash, the ecc
strength will be up to 52bit, which beyonds the i.MX6QDL BCH capability
(40bit).
This patch allows the NAND driver try to use minimum required ecc
strength if it failed to use the highest ecc, even without explicitly
claiming "fsl,use-minimum-ecc" in dts.
Signed-off-by: Han Xu <b45815@freescale.com>
Acked-by: Huang Shijie <shijie.huang@arm.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
i.MX6SX supports deep sleep mode(DSM) that may turn off GPMI/BCH power
during suspend, add gpmi nand suspend/resume function to release DMA
channel in suspend function and re-init GPMI/BCH controller during
resume function.
Although it is not necessary to restore GPMI/BCH registers value for
i.MX6QDL, the code doesn't distinguish different platforms to keep the
code simple.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Han Xu <han.xu@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
New helpers have been added to avoid directly accessing chip->field. Use
them where appropriate.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
[Brian: fixed a few rebase conflicts]
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
mtd_to_nand() now uses the container_of() approach to transform an
mtd_info pointer into a nand_chip one. Drop useless mtd->priv
assignments from NAND controller drivers.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
struct nand_chip now embeds an mtd device. Make use of this mtd instance.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
mtd_to_nand() was recently introduced to avoid direct accesses to the
mtd->priv field. Update all NAND drivers to use it.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
All of these drivers set up a parser data struct just to communicate DT
partition data. This field has been deprecated and is instead supported
by telling nand_scan_ident() about the 'flash_node'.
This patch:
* sets chip->flash_node for those drivers that didn't already (but used
OF partitioning)
* drops the parser data
* switches to the simpler mtd_device_register() where possible, now
that we've eliminated one of the auxiliary parameters
Now that we've assigned chip->flash_node for these drivers, we can
probably rely on nand_dt_init() to do more of the DT parsing for us, but
for now, I don't want to fiddle with each of these drivers. The parsing
is done in duplicate for now on some drivers. I don't think this should
break things. (Famous last words.)
(Rolled in some changes by Boris Brezillon)
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
The ->read_xxx() methods are all passed the page number the NAND controller
is supposed to read, but ->write_xxx() do not have such a parameter.
This is a problem if we want to properly implement data
scrambling/randomization in order to mitigate MLC sensibility to repeated
pattern: to prevent bitflips in adjacent pages in the same block we need
to avoid repeating the same pattern at the same offset in those pages,
hence the randomizer/scrambler engine need to be passed the page value
in order to adapt its seed accordingly.
Moreover, adding the page parameter to the ->write_xxx() methods add some
consistency to the current API.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
CC: Josh Wu <josh.wu@atmel.com>
CC: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
CC: Maxime Ripard <maxime.ripard@free-electrons.com>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Huang Shijie <shijie.huang@arm.com>
CC: Stefan Agner <stefan@agner.ch>
CC: devel@driverdev.osuosl.org
CC: linux-arm-kernel@lists.infradead.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Fix a bug where parent device symlinks aren't shown in sysfs.
While at it, make use of the default owner set by mtdcore.
Signed-off-by: Frans Klaver <fransklaver@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
In case of scan_bbt() failure, we should better propagate it.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
return type of wait_for_completion_timeout is unsigned long not int. The
return variable is renamed to reflect its use and the type adjusted to
unsigned long.
Signed-off-by: Nicholas Mc Guire <hofrat@osadl.org>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Now that we have raw functions properly implemented we can remove this
FIXME.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
mx28evk board has a socket for NAND flash that comes with no NAND flash
populated, and then we get this message on every boot:
[ 1.657603] gpmi-nand 8000c000.gpmi-nand: driver registration failed: -19
which is not very helpful, so get rid of this error message.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Implement raw OOB access functions to retrieve OOB bytes when accessing the
NAND in raw mode.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Several MTD users (either in user or kernel space) expect a valid raw
access support to NAND chip devices.
This is particularly true for testing tools which are often touching the
data stored in a NAND chip in raw mode to artificially generate errors.
The GPMI drivers do not implemenent raw access functions, and thus rely on
default HW_ECC scheme implementation.
The default implementation consider the data and OOB area as properly
separated in their respective NAND section, which is not true for the GPMI
controller.
In this driver/controller some OOB data are stored at the beginning of the
NAND data area (these data are called metadata in the driver), then ECC
bytes are interleaved with data chunk (which is similar to the
HW_ECC_SYNDROME scheme), and eventually the remaining bytes are used as
OOB data.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
With a flash-based BBT there is no reason to move the Factory Bad
Block Marker from the data area buffer (to where it is mapped by the
GPMI NAND controller) to the OOB buffer. Thus, make this feature
configurable via DT. This is required for the Ka-Ro electronics
platforms.
In the original code 'this->swap_block_mark' was synonymous with
'!GPMI_IS_MX23()', so use the latter at the relevant places.
Signed-off-by: Lothar Waßmann <LW@KARO-electronics.de>
Acked-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The gpmi's IP for imx6sx is nearly the same as the gpmi's IP for imx6q,
except the following two new features:
(1) the new BCH contoller has 62-BIT correcting ECC strength
(The BCH for imx6q only has 40-BIT ECC strength).
(2) add the hardware Randomizer support.
This patch does the follow changes:
(1) add a new macro GPMI_IS_MX6SX to represent the imx6sx's gpmi.
(2) add a new macro GPMI_IS_MX6.
We use this macro to initialize the same registers for both
imx6sx and imx6q, and so on.
(3) add a new gpmi_devdata instance, the gpmi_devdata_imx6sx, for
imx6sx.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
More and more chips use the GPMI controller, but these chips may use different
version of the IPs for GPMI and BCH. Different IPs have
different features, such as the BCH's maximum ECC strength:
imx23/imx28 -- the BCH's maximum ECC strength is 20
imx6q -- the BCH's maximum ECC strength is 40
imx6sx -- the BCH's maximum ECC strength is 62
This patch does the following things:
[1] add a new data structure, gpmi_devdata{}, to store the information for
each IP. Besides the IP version, we store the following information:
<1> BCH's maximum ECC strength.
<2> the maximum chain delay in ns used by the EDO mode.
but we may add more information in future.
[2] add the gpmi_devdata_imx{23|28|6q} to replace the gpmi_ids.
[3] simplify the code by using the ECC strength from gpmi_devdata, such as
gpmi_check_ecc() and legacy_set_geometry();
[4] use the maximum chain delay to initialize the EDO mode,
see gpmi_compute_edo_timing().
[5] rewrite the macros, such GPMI_IS_MX{23|28|6Q}.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
1) Why add the subpage read support?
The page size of the nand chip becomes larger and larger, the imx6 has to
supports the 16K page or even bigger page. But sometimes, the upper layer only
needs a small part of the page, such as 512 bytes or less.
For example, ubiattach may only read 64 bytes per page.
2) We only enable the subpage read support when it meets the conditions:
<1> the chip is imx6 (or later chips) which can supports large nand page.
<2> the size of ECC parity is byte aligned.
If the size of ECC parity is not byte aligned, the calling of NAND_CMD_RNDOUT
will fail.
3) What does this patch do?
This patch will fake a virtual small page for the subpage read, and call the
gpmi_ecc_read_page() to do the real work.
In order to fake a virtual small page, the patch changes the BCH registers and
the bch_geometry{}. After the subpage read finished, we will restore them back.
4) Performace:
4.1) Tested with Toshiba TC58NVG2S0F(4096 + 224) with the following command:
#ubiattach /dev/ubi_ctrl -m 4
The detail information of /dev/mtd4 shows below:
--------------------------------------------------------------
#mtdinfo /dev/mtd4
mtd4
Name: test
Type: nand
Eraseblock size: 262144 bytes, 256.0 KiB
Amount of eraseblocks: 1856 (486539264 bytes, 464.0 MiB)
Minimum input/output unit size: 4096 bytes
Sub-page size: 4096 bytes
OOB size: 224 bytes
Character device major/minor: 90:8
Bad blocks are allowed: true
Device is writable: true
--------------------------------------------------------------
4.2) Before this patch:
--------------------------------------------------------------
[ 94.530495] UBI: attaching mtd4 to ubi0
[ 98.928850] UBI: scanning is finished
[ 98.953594] UBI: attached mtd4 (name "test", size 464 MiB) to ubi0
[ 98.958562] UBI: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
[ 98.964076] UBI: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
[ 98.969518] UBI: VID header offset: 4096 (aligned 4096), data offset: 8192
[ 98.975128] UBI: good PEBs: 1856, bad PEBs: 0, corrupted PEBs: 0
[ 98.979843] UBI: user volume: 1, internal volumes: 1, max. volumes count: 128
[ 98.985878] UBI: max/mean erase counter: 2/1, WL threshold: 4096, image sequence number: 2024916145
[ 98.993635] UBI: available PEBs: 0, total reserved PEBs: 1856, PEBs reserved for bad PEB handling: 40
[ 99.001807] UBI: background thread "ubi_bgt0d" started, PID 831
--------------------------------------------------------------
The attach time is about 98.9 - 94.5 = 4.4s
4.3) After this patch:
--------------------------------------------------------------
[ 286.464906] UBI: attaching mtd4 to ubi0
[ 289.186129] UBI: scanning is finished
[ 289.211416] UBI: attached mtd4 (name "test", size 464 MiB) to ubi0
[ 289.216360] UBI: PEB size: 262144 bytes (256 KiB), LEB size: 253952 bytes
[ 289.221858] UBI: min./max. I/O unit sizes: 4096/4096, sub-page size 4096
[ 289.227293] UBI: VID header offset: 4096 (aligned 4096), data offset: 8192
[ 289.232878] UBI: good PEBs: 1856, bad PEBs: 0, corrupted PEBs: 0
[ 289.237628] UBI: user volume: 0, internal volumes: 1, max. volumes count: 128
[ 289.243553] UBI: max/mean erase counter: 1/1, WL threshold: 4096, image sequence number: 2024916145
[ 289.251348] UBI: available PEBs: 1812, total reserved PEBs: 44, PEBs reserved for bad PEB handling: 40
[ 289.259417] UBI: background thread "ubi_bgt0d" started, PID 847
--------------------------------------------------------------
The attach time is about 289.18 - 286.46 = 2.7s
4.4) The conclusion:
We achieve (4.4 - 2.7) / 4.4 = 38.6% faster in the ubiattach.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The nfc_geo->payload_size is equal to the mtd->writesize now,
use the nfc_geo->payload_size to replace the mtd->writesize.
This patch makes preparation for the gpmi's subpage read support.
In the subpage support, the nfc_geo->payload_size maybe smaller then
the mtd->writesize.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The buffer pointer passed from the upper layer may points to
a buffer in the stack or a buffer allocated by vmalloc, and etc..
This patch adds more sanity check to this buffer.
After this patch, if we meet a buffer which is allocated by vmalloc or
a buffer in the stack, we will use our own DMA buffer @data_buffer_dma
to do the DMA operations. If the buffer is not the cases above, we will
map it for DMA operations directly.
Signed-off-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The @data_buffer_dma buffer is used for non ECC read/write.
Currently, the length of the buffer is PAGE_SIZE, but the NAND chip may
has 8K page or 16K page. So we have to extend it for the large page NAND
chips.
The gpmi_alloc_dma_buffer will be called twice. The first time is to
allocate a temporary buffer for scanning the NAND chip; The second time
is to allocate a buffer to store the real page content.
This patch allocates a buffer of PAGE_SIZE size for scanning the NAND
chip when gpmi_alloc_dma_buffer is called the first time, and allocates a
buffer of the real NAND page size for the second time gpmi_alloc_dma_buffer
is called.
Signed-off-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
There are pr_err and dev_err in the gpmi driver now.
It makes people confused.
This patch changes all the pr_err to dev_err except the one
in the gpmi_reset_block(). We also remove the unnecessary
print for OOM message.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Use devm_request_irq to simplify the code.
Also remove the unused fields of structure resources{}.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Use the devm_ioremap_resource to simplify the code.
[Note: as a side effect, this adds a missing call to request_memory().]
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The gpmi_nfc_* is the legacy name. In order to avoid the confusion,
The patch renames the gpmi_nfc_* functions to gpmi_nand_*.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
We do not use the chip->oob_poi in the mx23_write_transcription_stamp.
So remove the unused line.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
We do not scan the BBT after we call the gpmi_pre_bbt_scan,
so it has lost the meaning of existence.
This patch merges this function into gpmi_init_last, and delete it.
This patch does not change any logic.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Using devm_clk_get() can make the code smaller and cleaner.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
In default way, we use the ecc_strength/ecc_step size calculated by ourselves
and use all the OOB area.
This patch adds a new property : "fsl,use-minimum-ecc"
If we enable it, we will firstly try to use the datasheet's minimum required
ECC provided by the MTD layer (the ecc_strength_ds/ecc_step_ds fields
in the nand_chip{}). So we may have free space in the OOB area by using the
minimum ECC, and we may support JFFS2 with some SLC NANDs, such as Micron's
SLC NAND.
If we fail to use the minimum ECC, we will use the legacy method to calculate
the ecc_strength and ecc_step size.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
The imx23 board will check the fingerprint, so it will call the
mx23_check_transcription_stamp. This function will use @chip->buffers->databuf
as its buffer which is allocated in the nand_scan_tail().
Unfortunately, the mx23_check_transcription_stamp is called before the
nand_scan_tail(). So we will meet a NULL pointer bug:
--------------------------------------------------------------------
[ 1.150000] NAND device: Manufacturer ID: 0xec, Chip ID: 0xd7 (Samsung NAND 4GiB 3,3V 8-bit), 4096MiB, page size: 4096, OOB size: 8
[ 1.160000] Unable to handle kernel NULL pointer dereference at virtual address 000005d0
[ 1.170000] pgd = c0004000
[ 1.170000] [000005d0] *pgd=00000000
[ 1.180000] Internal error: Oops: 5 [#1] ARM
[ 1.180000] Modules linked in:
[ 1.180000] CPU: 0 PID: 1 Comm: swapper Not tainted 3.12.0 #89
[ 1.180000] task: c7440000 ti: c743a000 task.ti: c743a000
[ 1.180000] PC is at memcmp+0x10/0x54
[ 1.180000] LR is at gpmi_nand_probe+0x42c/0x894
[ 1.180000] pc : [<c025fcb0>] lr : [<c02f6a68>] psr: 20000053
[ 1.180000] sp : c743be2c ip : 600000d3 fp : ffffffff
[ 1.180000] r10: 000005d0 r9 : c02f5f08 r8 : 00000000
[ 1.180000] r7 : c75858a8 r6 : c75858a8 r5 : c7585b18 r4 : c7585800
[ 1.180000] r3 : 000005d0 r2 : 00000004 r1 : c05c33e4 r0 : 000005d0
[ 1.180000] Flags: nzCv IRQs on FIQs off Mode SVC_32 ISA ARM Segment kernel
[ 1.180000] Control: 0005317f Table: 40004000 DAC: 00000017
[ 1.180000] Process swapper (pid: 1, stack limit = 0xc743a1c0)
--------------------------------------------------------------------
This patch rearrange the init procedure:
Set the NAND_SKIP_BBTSCAN to skip the nand scan firstly, and after we
set the proper settings, we will call the chip->scan_bbt() manually.
Cc: stable@vger.kernel.org # 3.12
Signed-off-by: Huang Shijie <b32955@freescale.com>
Reported-by: Fabio Estevam <festevam@gmail.com>
Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
[1] The gpmi uses the nand_command_lp to issue the commands to NAND chips.
The gpmi issues a DMA operation with gpmi_cmd_ctrl when it handles
a NAND_CMD_NONE control command. So when we read a page(NAND_CMD_READ0)
from the NAND, we may send two DMA operations back-to-back.
If we do not serialize the two DMA operations, we will meet a bug when
1.1) we enable CONFIG_DMA_API_DEBUG, CONFIG_DMADEVICES_DEBUG,
and CONFIG_DEBUG_SG.
1.2) Use the following commands in an UART console and a SSH console:
cmd 1: while true;do dd if=/dev/mtd0 of=/dev/null;done
cmd 1: while true;do dd if=/dev/mmcblk0 of=/dev/null;done
The kernel log shows below:
-----------------------------------------------------------------
kernel BUG at lib/scatterlist.c:28!
Unable to handle kernel NULL pointer dereference at virtual address 00000000
.........................
[<80044a0c>] (__bug+0x18/0x24) from [<80249b74>] (sg_next+0x48/0x4c)
[<80249b74>] (sg_next+0x48/0x4c) from [<80255398>] (debug_dma_unmap_sg+0x170/0x1a4)
[<80255398>] (debug_dma_unmap_sg+0x170/0x1a4) from [<8004af58>] (dma_unmap_sg+0x14/0x6c)
[<8004af58>] (dma_unmap_sg+0x14/0x6c) from [<8027e594>] (mxs_dma_tasklet+0x18/0x1c)
[<8027e594>] (mxs_dma_tasklet+0x18/0x1c) from [<8007d444>] (tasklet_action+0x114/0x164)
-----------------------------------------------------------------
1.3) Assume the two DMA operations is X (first) and Y (second).
The root cause of the bug:
Assume process P issues DMA X, and sleep on the completion
@this->dma_done. X's tasklet callback is dma_irq_callback. It firstly
wake up the process sleeping on the completion @this->dma_done,
and then trid to unmap the scatterlist S. The waked process P will
issue Y in another ARM core. Y initializes S->sg_magic to zero
with sg_init_one(), while dma_irq_callback is unmapping S at the same
time.
See the diagram:
ARM core 0 | ARM core 1
-------------------------------------------------------------
(P issues DMA X, then sleep) --> |
|
(X's tasklet wakes P) --> |
|
| <-- (P begin to issue DMA Y)
|
(X's tasklet unmap the |
scatterlist S with dma_unmap_sg) --> | <-- (Y calls sg_init_one() to init
| scatterlist S)
|
[2] This patch serialize both the X and Y in the following way:
Unmap the DMA scatterlist S firstly, and wake up the process at the end
of the DMA callback, in such a way, Y will be executed after X.
After this patch:
ARM core 0 | ARM core 1
-------------------------------------------------------------
(P issues DMA X, then sleep) --> |
|
(X's tasklet unmap the |
scatterlist S with dma_unmap_sg) --> |
|
(X's tasklet wakes P) --> |
|
| <-- (P begin to issue DMA Y)
|
| <-- (Y calls sg_init_one() to init
| scatterlist S)
|
Cc: stable@vger.kernel.org # 3.2
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
We cannot scan two chips for imx23 and imx28:
imx23: the Ready-Busy1 line is not connected for some board.
imx28: we do not set the pinctrl for Ready-Busy1
So we only scan two chips for imx6.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Using devm_kzalloc() can make the code simpler.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Acked-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Some nand chip has two DIEs in a single chip, such as Micron MT29F32G08QAA.
Each die has its own chip select pin, so this chip acts as two nand
chips.
If we only scan one chip, we may find that we only get 2G for this chip,
but in actually, this chip's size is 4G.
So scan two chips by default.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
We only have one DMA channel : the channel 0.
Use DMA channel 0 to access all the nand chips.
Signed-off-by: Huang Shijie <b32955@freescale.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Boris Brezillon
Stefan Agner
Ingo Molnar
Han Xu
Markus Pargmann
Han Xu
Huang Shijie
Brian Norris
Frans Klaver
Fabio Estevam
Nicholas Mc Guire
Lothar Waßmann
Huang Shijie