leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

mtd: gpio_flash: handle case where offset + len exceeds the window size

Browse Source 
Fix the bug in handling gpio flash read/write when offset + len
from MTD exceeds the window size

Signed-off-by: Aaron Wu <Aaron.wu@analog.com>

[Brian: made some commentary edits. Also note that the BUG_ON() was
provably false for all non-negative inputs (since x % y <= x), so we
dropped it.]

Signed-off-by: Brian Norris <computersforpeace@gmail.com>
This commit is contained in:
Aaron Wu
2014-08-07 11:43:49 +08:00
committed by Brian Norris
parent bd8898db3e
commit 02f8a24e7b
1 changed files with 28 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

44
drivers/mtd/maps/gpio-addr-flash.c
View File

@@ -99,22 +99,28 @@ static map_word gf_read(struct map_info *map, unsigned long ofs)
* @from: flash offset to copy from * @from: flash offset to copy from
* @len: how much to copy * @len: how much to copy
* *
* We rely on the MTD layer to chunk up copies such that a single request here * The "from" region may straddle more than one window, so toggle the GPIOs for
* will not cross a window size. This allows us to only wiggle the GPIOs once * each window region before reading its data.
* before falling back to a normal memcpy. Reading the higher layer code shows
* that this is indeed the case, but add a BUG_ON() to future proof.
*/ */
static void gf_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len) static void gf_copy_from(struct map_info *map, void *to, unsigned long from, ssize_t len)
{ {
struct async_state *state = gf_map_info_to_state(map); struct async_state *state = gf_map_info_to_state(map);
int this_len;
while (len) {
if ((from % state->win_size) + len > state->win_size)
this_len = state->win_size - (from % state->win_size);
else
this_len = len;
gf_set_gpios(state, from); gf_set_gpios(state, from);
memcpy_fromio(to, map->virt + (from % state->win_size),
/* BUG if operation crosses the win_size */ this_len);
BUG_ON(!((from + len) % state->win_size <= (from + len))); len -= this_len;
from += this_len;
/* operation does not cross the win_size, so one shot it */ to += this_len;
memcpy_fromio(to, map->virt + (from % state->win_size), len); }
} }
/** /**
@@ -147,13 +153,21 @@ static void gf_copy_to(struct map_info *map, unsigned long to,
{ {
struct async_state *state = gf_map_info_to_state(map); struct async_state *state = gf_map_info_to_state(map);
int this_len;
while (len) {
if ((to % state->win_size) + len > state->win_size)
this_len = state->win_size - (to % state->win_size);
else
this_len = len;
gf_set_gpios(state, to); gf_set_gpios(state, to);
/* BUG if operation crosses the win_size */
BUG_ON(!((to + len) % state->win_size <= (to + len)));
/* operation does not cross the win_size, so one shot it */
memcpy_toio(map->virt + (to % state->win_size), from, len); memcpy_toio(map->virt + (to % state->win_size), from, len);
len -= this_len;
to += this_len;
from += this_len;
}
} }
static const char * const part_probe_types[] = { static const char * const part_probe_types[] = {