[PATCH v3 1/3] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND

Mikhail Kshevetskiy posted 3 patches 1 week, 4 days ago
There is a newer version of this series
[PATCH v3 1/3] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
Posted by Mikhail Kshevetskiy 1 week, 4 days ago
We found that some serial console may pull TX line to GROUND during board
boot time. Airoha uses TX line as one of it's BOOT pins. This will lead
to booting in RESERVED boot mode.

It was found that some flashes operates incorrectly in RESERVED mode.
Micron and Skyhigh flashes are definitely affected by the issue,
Winbond flashes are NOT affected.

Details:
--------
DMA reading of odd pages on affected flashes operates incorrectly. Page
reading offset (start of the page) on hardware level is replaced by 0x10.
Thus results in incorrect data reading. Usage of UBI make things even
worse. Any attempt to access UBI leads to ubi damaging. As result OS loading
becomes impossible.

Non-DMA reading is OK.

This patch detects booting in reserved mode, turn off DMA and print big
fat warning.

Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
---
 drivers/spi/spi-airoha-snfi.c | 34 ++++++++++++++++++++++++++++++----
 1 file changed, 30 insertions(+), 4 deletions(-)

diff --git a/drivers/spi/spi-airoha-snfi.c b/drivers/spi/spi-airoha-snfi.c
index 8408aee9c06e..a2f2ae7c60d2 100644
--- a/drivers/spi/spi-airoha-snfi.c
+++ b/drivers/spi/spi-airoha-snfi.c
@@ -1013,6 +1013,11 @@ static const struct spi_controller_mem_ops airoha_snand_mem_ops = {
 	.dirmap_write = airoha_snand_dirmap_write,
 };
 
+static const struct spi_controller_mem_ops airoha_snand_nodma_mem_ops = {
+	.supports_op = airoha_snand_supports_op,
+	.exec_op = airoha_snand_exec_op,
+};
+
 static int airoha_snand_setup(struct spi_device *spi)
 {
 	struct airoha_snand_ctrl *as_ctrl;
@@ -1057,7 +1062,9 @@ static int airoha_snand_probe(struct platform_device *pdev)
 	struct airoha_snand_ctrl *as_ctrl;
 	struct device *dev = &pdev->dev;
 	struct spi_controller *ctrl;
+	bool dma_enable = true;
 	void __iomem *base;
+	u32 sfc_strap;
 	int err;
 
 	ctrl = devm_spi_alloc_host(dev, sizeof(*as_ctrl));
@@ -1092,12 +1099,31 @@ static int airoha_snand_probe(struct platform_device *pdev)
 		return dev_err_probe(dev, PTR_ERR(as_ctrl->spi_clk),
 				     "unable to get spi clk\n");
 
-	err = dma_set_mask(as_ctrl->dev, DMA_BIT_MASK(32));
-	if (err)
-		return err;
+	if (device_is_compatible(dev, "airoha,en7523-snand")) {
+		err = regmap_read(as_ctrl->regmap_ctrl,
+				  REG_SPI_CTRL_SFC_STRAP, &sfc_strap);
+		if (err)
+			return err;
+
+		if (!(sfc_strap & 0x04)) {
+			dma_enable = false;
+			dev_warn(dev, "Detected booting in RESERVED mode (UART_TXD was short to GND).\n");
+			dev_warn(dev, "This mode is known for incorrect DMA reading of some flashes.\n");
+			dev_warn(dev, "Usage of DMA for flash operations will be disabled to prevent data\n");
+			dev_warn(dev, "damage. Unplug your serial console and power cycle the board\n");
+			dev_warn(dev, "to boot with full performance.\n");
+		}
+	}
+
+	if (dma_enable) {
+		err = dma_set_mask(as_ctrl->dev, DMA_BIT_MASK(32));
+		if (err)
+			return err;
+	}
 
 	ctrl->num_chipselect = 2;
-	ctrl->mem_ops = &airoha_snand_mem_ops;
+	ctrl->mem_ops = dma_enable ? &airoha_snand_mem_ops
+				   : &airoha_snand_nodma_mem_ops;
 	ctrl->bits_per_word_mask = SPI_BPW_MASK(8);
 	ctrl->mode_bits = SPI_RX_DUAL;
 	ctrl->setup = airoha_snand_setup;
-- 
2.51.0
Re: [PATCH v3 1/3] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
Posted by AngeloGioacchino Del Regno 1 week, 4 days ago
Il 20/11/25 05:27, Mikhail Kshevetskiy ha scritto:
> We found that some serial console may pull TX line to GROUND during board
> boot time. Airoha uses TX line as one of it's BOOT pins. This will lead
> to booting in RESERVED boot mode.
> 
> It was found that some flashes operates incorrectly in RESERVED mode.
> Micron and Skyhigh flashes are definitely affected by the issue,
> Winbond flashes are NOT affected.
> 
> Details:
> --------
> DMA reading of odd pages on affected flashes operates incorrectly. Page
> reading offset (start of the page) on hardware level is replaced by 0x10.
> Thus results in incorrect data reading. Usage of UBI make things even
> worse. Any attempt to access UBI leads to ubi damaging. As result OS loading
> becomes impossible.
> 
> Non-DMA reading is OK.
> 
> This patch detects booting in reserved mode, turn off DMA and print big
> fat warning.
> 
> Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>

This is important enough to get a Fixes tag.

Please resend with the appropriate one, after which:

Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Re: [PATCH v3 1/3] spi: airoha-snfi: en7523: workaround flash damaging if UART_TXD was short to GND
Posted by Mikhail Kshevetskiy 1 week, 3 days ago
On 11/20/25 13:18, AngeloGioacchino Del Regno wrote:
> Il 20/11/25 05:27, Mikhail Kshevetskiy ha scritto:
>> We found that some serial console may pull TX line to GROUND during
>> board
>> boot time. Airoha uses TX line as one of it's BOOT pins. This will lead
>> to booting in RESERVED boot mode.
>>
>> It was found that some flashes operates incorrectly in RESERVED mode.
>> Micron and Skyhigh flashes are definitely affected by the issue,
>> Winbond flashes are NOT affected.
>>
>> Details:
>> --------
>> DMA reading of odd pages on affected flashes operates incorrectly. Page
>> reading offset (start of the page) on hardware level is replaced by
>> 0x10.
>> Thus results in incorrect data reading. Usage of UBI make things even
>> worse. Any attempt to access UBI leads to ubi damaging. As result OS
>> loading
>> becomes impossible.
>>
>> Non-DMA reading is OK.
>>
>> This patch detects booting in reserved mode, turn off DMA and print big
>> fat warning.
>>
>> Signed-off-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
>
> This is important enough to get a Fixes tag. 


Actually I don't know what version should be mentioned in the Fixes tag.

First of all the issue is en7523 specific, but en7523 was not supported
by the driver before this series. So it looks like no issue was present
early.

Second, we don't actually know when the issue actually appears. It
definitely present in the latest version. I would say:

* with almost 100% probability an issue present since the first driver
  revision
* with a quite small probability an issue appeared within my commits:
    - 70eec454f2d6 ("spi: airoha: avoid setting of page/oob sizes in
      REG_SPI_NFI_PAGEFMT")
    - d1ff30df1d9a ("spi: airoha: reduce the number of modification
      of REG_SPI_NFI_CNFG and REG_SPI_NFI_SECCUS_SIZE registers")
    - fb81b5cecb85 ("spi: airoha: set custom sector size equal to flash
      page size")
    - 902c0ea18a97 ("spi: airoha: avoid reading flash page settings
      from SNFI registers during driver startup")

We start using something similar to 902c0ea18a97 ("spi: airoha: avoid
reading flash page settings from SNFI registers during driver startup")
since June  of 2022. Before this date we was using code similar to what
was before 70eec454f2d6 ("spi: airoha: avoid setting of page/oob sizes
in REG_SPI_NFI_PAGEFMT").

The mentioned issue was fixed in the February of 2024. We never test
old code for the issue presence. 

Regards,
Mikhail Kshevetskiy

>
> Please resend with the appropriate one, after which:
>
> Reviewed-by: AngeloGioacchino Del Regno
> <angelogioacchino.delregno@collabora.com>
>
>