[PATCH 0/5] mtd: maps: lantiq-flash: support boot loaders using the EBU endianness swap

[PATCH 0/5] mtd: maps: lantiq-flash: support boot loaders using the EBU endianness swap

[Simon Wunderlich]

Some Lantiq boards, like the bintec elmeg RS123 and RS353, have a boot
loader that enables the EBU's own endianness swapping for the NOR flash
chip select. lantiq-flash then fails to probe the flash. Patch 4 lets
such boards opt in to honouring that bit with a new
"lantiq,ebu-swap-check" property. The bit only works on VR9 from
revision 1.2 and on AR10, so the driver cannot rely on it on every SoC.
The property follows Hauke's review of an earlier attempt at this fix
in 2017 [1].

While porting the change from OpenWrt to mainline I noticed that
lantiq-flash dereferences a NULL pointer on probe since v6.6. Patch 1
fixes that and can go to mtd/fixes on its own. OpenWrt never ran into
it because it carries a downstream rework of the probe function.

Patch 2 documents the "lantiq,nor" binding, which was never documented,
together with the new property. Patch 3 exports ltq_ebu_membase so that
lantiq-flash still builds as a module. It would need an Acked-by from
Thomas to go through the MTD tree together with patch 4. Patch 5
renames the NOR node of the only in-tree user, danube_easy50712.dts, so
that it validates against the new binding. It is meant for the MIPS
tree and does not depend on the other patches.

The EBU swap change is used in OpenWrt on the RS123 with a 6.18 kernel,
on top of OpenWrt's reworked probe function. The series itself is
build-tested on mtd/next for XWAY (built-in and as a module) and Falcon
with W=1, the binding passes dt_binding_check and dt-check-style, and
danube_easy50712.dtb passes dtbs_check against it.

[1] https://lists.infradead.org/pipermail/linux-mtd/2017-January/071818.html

Simon Wunderlich (5):
  mtd: maps: lantiq-flash: fix NULL pointer dereference on probe
  dt-bindings: mtd: Add lantiq,nor
  mips: lantiq: xway: sysctrl: export ltq_ebu_membase
  mtd: maps: lantiq-flash: honour the EBU's own endianness swap
  mips: lantiq: danube: rename NOR node on EASY50712 reference board

 .../devicetree/bindings/mtd/lantiq,nor.yaml   | 79 +++++++++++++++++++
 .../mips/boot/dts/lantiq/danube_easy50712.dts |  2 +-
 arch/mips/lantiq/xway/sysctrl.c               |  1 +
 drivers/mtd/maps/lantiq-flash.c               | 39 +++++++--
 4 files changed, 112 insertions(+), 9 deletions(-)
 create mode 100644 Documentation/devicetree/bindings/mtd/lantiq,nor.yaml


base-commit: 0ef71adafaa9b36a06dd5b823aebcd2fa9b9b9c2
-- 
2.47.3

[PATCH 1/5] mtd: maps: lantiq-flash: fix NULL pointer dereference on probe

[Simon Wunderlich]

Since commit 6145e07e9c77 ("mtd: lantiq-flash: Use
devm_platform_get_and_ioremap_resource()"), ltq_mtd_probe() stores the
ioremapped address in ltq_mtd->map->virt before ltq_mtd->map is
allocated. ltq_mtd comes from devm_kzalloc(), so map is still NULL at
that point and the probe dereferences a NULL pointer on every board
with a "lantiq,nor" node.

Allocate the map before mapping the resource.

Found by code inspection while porting a lantiq-flash change from
OpenWrt, which replaces this probe function downstream.

Fixes: 6145e07e9c77 ("mtd: lantiq-flash: Use devm_platform_get_and_ioremap_resource()")
Cc: stable@vger.kernel.org
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 drivers/mtd/maps/lantiq-flash.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c
index 80d467eba92a..5c2ace302b50 100644
--- a/drivers/mtd/maps/lantiq-flash.c
+++ b/drivers/mtd/maps/lantiq-flash.c
@@ -118,15 +118,15 @@ ltq_mtd_probe(struct platform_device *pdev)
 
 	platform_set_drvdata(pdev, ltq_mtd);
 
-	ltq_mtd->map->virt = devm_platform_get_and_ioremap_resource(pdev, 0, &ltq_mtd->res);
-	if (IS_ERR(ltq_mtd->map->virt))
-		return PTR_ERR(ltq_mtd->map->virt);
-
 	ltq_mtd->map = devm_kzalloc(&pdev->dev, sizeof(struct map_info),
 				    GFP_KERNEL);
 	if (!ltq_mtd->map)
 		return -ENOMEM;
 
+	ltq_mtd->map->virt = devm_platform_get_and_ioremap_resource(pdev, 0, &ltq_mtd->res);
+	if (IS_ERR(ltq_mtd->map->virt))
+		return PTR_ERR(ltq_mtd->map->virt);
+
 	ltq_mtd->map->phys = ltq_mtd->res->start;
 	ltq_mtd->map->size = resource_size(ltq_mtd->res);
 
-- 
2.47.3

[PATCH 2/5] dt-bindings: mtd: Add lantiq,nor

[Simon Wunderlich]

The NOR flash on the External Bus Unit (EBU) of Lantiq SoCs is handled
by the lantiq-flash driver and used by danube_easy50712.dts, but its
binding was never documented.

Add a schema for it, including a new optional lantiq,ebu-swap-check
property. Some boot loaders, like the BOSS bootmonitor on the bintec
elmeg RS123 and RS353, enable the EBU's own endianness swapping for the
flash chip select (EBU_BUSCON0 bit 30), and the flash then appears at
its unswapped addresses. Whether that bit can be trusted depends on the
SoC: it only works on VR9 (xRX200) from revision 1.2 and on AR10
(xRX300), and Falcon has no such register. A board property instead of
a list of SoC revisions in the driver was requested in the review of an
earlier attempt at this. The property does not state the bit's value,
so a board keeps working with either boot loader setting.

Link: https://lists.infradead.org/pipermail/linux-mtd/2017-January/071749.html
Link: https://lists.infradead.org/pipermail/linux-mtd/2017-January/071818.html
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 .../devicetree/bindings/mtd/lantiq,nor.yaml   | 79 +++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 Documentation/devicetree/bindings/mtd/lantiq,nor.yaml

diff --git a/Documentation/devicetree/bindings/mtd/lantiq,nor.yaml b/Documentation/devicetree/bindings/mtd/lantiq,nor.yaml
new file mode 100644
index 000000000000..e6f2be1245dc
--- /dev/null
+++ b/Documentation/devicetree/bindings/mtd/lantiq,nor.yaml
@@ -0,0 +1,79 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/mtd/lantiq,nor.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Lantiq SoC NOR flash on the External Bus Unit
+
+maintainers:
+  - Simon Wunderlich <sw@simonwunderlich.de>
+
+description:
+  Parallel CFI NOR flash on chip select 0 of the External Bus Unit (EBU) of
+  Lantiq SoCs. Depending on how the EBU is configured, the address lines of
+  the flash are swapped, so the chip is not accessible as a plain
+  memory-mapped CFI flash.
+
+allOf:
+  - $ref: mtd.yaml#
+
+properties:
+  compatible:
+    const: lantiq,nor
+
+  reg:
+    maxItems: 1
+
+  bank-width:
+    description: Width (in bytes) of the flash bank.
+    $ref: /schemas/types.yaml#/definitions/uint32
+    const: 2
+
+  lantiq,ebu-swap-check:
+    type: boolean
+    description:
+      The EBU's own endianness swapping for chip select 0 (EBU_BUSCON0 bit
+      30) is usable on this board and may have been enabled by the boot
+      loader. When it is enabled, the flash appears at its unswapped
+      addresses. The bit only works on VR9 (xRX200) from revision 1.2 and on
+      AR10 (xRX300), so this property must only be set on boards with one of
+      these SoCs.
+
+required:
+  - compatible
+  - reg
+  - bank-width
+
+unevaluatedProperties: false
+
+examples:
+  - |
+    bus {
+        #address-cells = <2>;
+        #size-cells = <1>;
+
+        flash@0 {
+            compatible = "lantiq,nor";
+            reg = <0 0x0 0x2000000>;
+            bank-width = <2>;
+            lantiq,ebu-swap-check;
+
+            partitions {
+                compatible = "fixed-partitions";
+                #address-cells = <1>;
+                #size-cells = <1>;
+
+                partition@0 {
+                    reg = <0x0 0x40000>;
+                    label = "boot";
+                    read-only;
+                };
+
+                partition@40000 {
+                    reg = <0x40000 0x1fc0000>;
+                    label = "firmware";
+                };
+            };
+        };
+    };
-- 
2.47.3

[PATCH 3/5] mips: lantiq: xway: sysctrl: export ltq_ebu_membase

[Simon Wunderlich]

The lantiq-flash driver, which can be built as a module, is about to
read an EBU register with ltq_ebu_r32(), which uses ltq_ebu_membase.
Export it like ebu_lock, so that the module still links.

Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 arch/mips/lantiq/xway/sysctrl.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index dd187726e3b2..90902ca3f83a 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -149,6 +149,7 @@ static u32 pmu_clk_cr_b[] = {
 static void __iomem *pmu_membase;
 void __iomem *ltq_cgu_membase;
 void __iomem *ltq_ebu_membase;
+EXPORT_SYMBOL_GPL(ltq_ebu_membase);
 
 static u32 ifccr = CGU_IFCCR;
 static u32 pcicr = CGU_PCICR;
-- 
2.47.3

[PATCH 4/5] mtd: maps: lantiq-flash: honour the EBU's own endianness swap

[Simon Wunderlich]

The driver swaps address bit 1 while probing the chip and afterwards
swizzles the CFI unlock addresses, to compensate for the EBU/PCI
endianness swapping that boot loaders enable on Lantiq boards.

Boot loaders that instead enable the EBU's own endianness swapping for
the flash chip select (EBU_BUSCON0 bit 30) present the chip at its
unswapped addresses. With the driver's software swap on top, the CFI
query returns garbage and probing fails, leaving the board without MTD.
The bintec elmeg RS123 and RS353 (BOSS bootmonitor) are such boards.

Measured on the RS123, CFI ident at 0x10/0x11/0x12 with bit 30 set:

  unswapped: 0051 0052 0059   ("QRY")
  swapped:   8f5b 0000 3c11   (garbage)

Clearing bit 30 before probing is not an option either: probing then
succeeds, but all data comes back halfword-swapped relative to what the
boot loader wrote and reads (the firmware header shows up as
"LDTE CATseloyedE"), so neither the MAC address in the boot partition
nor a kernel image written from Linux would be usable.

Skip the software swap when the boot loader enabled the hardware swap.
The bit only works on VR9 (xRX200) from revision 1.2 and on AR10
(xRX300), so it is only read when the flash node carries
"lantiq,ebu-swap-check", as requested in the review of the 2017
submission of this fix. Falcon has no EBU of this kind, so the access
is compiled in only for XWAY SoCs.

Based on that patch by Sebastien Decourriere.

Link: https://lists.infradead.org/pipermail/linux-mtd/2017-January/071749.html
Link: https://lists.infradead.org/pipermail/linux-mtd/2017-January/071818.html
Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 drivers/mtd/maps/lantiq-flash.c | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/drivers/mtd/maps/lantiq-flash.c b/drivers/mtd/maps/lantiq-flash.c
index 5c2ace302b50..7ee447227425 100644
--- a/drivers/mtd/maps/lantiq-flash.c
+++ b/drivers/mtd/maps/lantiq-flash.c
@@ -29,8 +29,17 @@
  * map. The workaround involves swapping all addresses whilst probing the chip.
  * Once probing is complete we stop swapping the addresses but swizzle the
  * unlock addresses to ensure that access to the NOR device works correctly.
+ *
+ * Some boot loaders instead enable the EBU's own endianness swapping for the
+ * flash chip select (EBU_BUSCON0 bit 30). The chip then answers at its
+ * unswapped addresses and none of the above is needed. The bit only works on
+ * VR9 from revision 1.2 and on AR10, so boards ask the driver to honour it
+ * with the "lantiq,ebu-swap-check" property. Falcon has no EBU of this kind,
+ * so the register is only read on XWAY SoCs.
  */
 
+#define EBU_ENDIAN_SWAP		BIT(30)
+
 enum {
 	LTQ_NOR_PROBING,
 	LTQ_NOR_NORMAL
@@ -105,11 +114,21 @@ ltq_copy_to(struct map_info *map, unsigned long to,
 	spin_unlock_irqrestore(&ebu_lock, flags);
 }
 
+static bool ltq_mtd_ebu_swap(struct platform_device *pdev)
+{
+#ifdef CONFIG_SOC_TYPE_XWAY
+	if (of_property_read_bool(pdev->dev.of_node, "lantiq,ebu-swap-check"))
+		return ltq_ebu_r32(LTQ_EBU_BUSCON0) & EBU_ENDIAN_SWAP;
+#endif
+	return false;
+}
+
 static int
 ltq_mtd_probe(struct platform_device *pdev)
 {
 	struct ltq_mtd *ltq_mtd;
 	struct cfi_private *cfi;
+	bool hw_swap;
 	int err;
 
 	ltq_mtd = devm_kzalloc(&pdev->dev, sizeof(struct ltq_mtd), GFP_KERNEL);
@@ -137,7 +156,9 @@ ltq_mtd_probe(struct platform_device *pdev)
 	ltq_mtd->map->copy_from = ltq_copy_from;
 	ltq_mtd->map->copy_to = ltq_copy_to;
 
-	ltq_mtd->map->map_priv_1 = LTQ_NOR_PROBING;
+	hw_swap = ltq_mtd_ebu_swap(pdev);
+
+	ltq_mtd->map->map_priv_1 = hw_swap ? LTQ_NOR_NORMAL : LTQ_NOR_PROBING;
 	ltq_mtd->mtd = do_map_probe("cfi_probe", ltq_mtd->map);
 	ltq_mtd->map->map_priv_1 = LTQ_NOR_NORMAL;
 
@@ -149,9 +170,11 @@ ltq_mtd_probe(struct platform_device *pdev)
 	ltq_mtd->mtd->dev.parent = &pdev->dev;
 	mtd_set_of_node(ltq_mtd->mtd, pdev->dev.of_node);
 
-	cfi = ltq_mtd->map->fldrv_priv;
-	cfi->addr_unlock1 ^= 1;
-	cfi->addr_unlock2 ^= 1;
+	if (!hw_swap) {
+		cfi = ltq_mtd->map->fldrv_priv;
+		cfi->addr_unlock1 ^= 1;
+		cfi->addr_unlock2 ^= 1;
+	}
 
 	err = mtd_device_register(ltq_mtd->mtd, NULL, 0);
 	if (err) {
-- 
2.47.3

[PATCH 5/5] mips: lantiq: danube: rename NOR node on EASY50712 reference board

[Simon Wunderlich]

This fixes the following warning with the new lantiq,nor binding:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: nor-boot@0 (lantiq,nor): $nodename:0: 'nor-boot@0' does not match '^(flash|.*sram|nand)(@.*)?$'
	from schema $id: http://devicetree.org/schemas/mtd/lantiq,nor.yaml

The MTD device name comes from the driver and not from the node name,
and the board uses a built-in DTB, so only the name of the platform
device changes.

Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
---
 arch/mips/boot/dts/lantiq/danube_easy50712.dts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/boot/dts/lantiq/danube_easy50712.dts b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
index c9f7886f57b8..456d5d090c7f 100644
--- a/arch/mips/boot/dts/lantiq/danube_easy50712.dts
+++ b/arch/mips/boot/dts/lantiq/danube_easy50712.dts
@@ -25,7 +25,7 @@ localbus@0 {
 				1 0 0x4000000 0x4000010>; /* addsel1 */
 			compatible = "lantiq,localbus", "simple-bus";
 
-			nor-boot@0 {
+			flash@0 {
 				compatible = "lantiq,nor";
 				bank-width = <2>;
 				reg = <0 0x0 0x2000000>;
-- 
2.47.3