[PATCH 1/2] mtd: rawnand: vf610_nfc: write the OOB bytes on page writes

[Mehmet Fide]

From: Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>

The ECC page write transfers writesize plus the spare area from the
controller SRAM, but only the data half of the SRAM buffer is filled:
the conversion to ->exec_op() dropped the vf610_nfc_write_buf() call
that used to copy chip->oob_poi, so whatever the previous transfer left
in the spare region of the buffer is programmed into the OOB of every
written page. User OOB data is silently lost and the free OOB bytes of
a freshly written page read back as leftovers of an earlier page.

Copy the spare bytes into the SRAM buffer before starting the program
operation. The copy is unconditional: the NAND core fills chip->oob_poi
with 0xff when the caller writes no OOB, and the ECC engine overwrites
the parity region on its way to the flash, so this also stops the
stale-buffer leak into the free bytes.

Fixes: 1cbe30b0ddc7 ("mtd: rawnand: vf610_nfc: make use of ->exec_op()")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>
---
 drivers/mtd/nand/raw/vf610_nfc.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/mtd/nand/raw/vf610_nfc.c b/drivers/mtd/nand/raw/vf610_nfc.c
index ffcf66f96c7f..f831780d6fff 100644
--- a/drivers/mtd/nand/raw/vf610_nfc.c
+++ b/drivers/mtd/nand/raw/vf610_nfc.c
@@ -633,6 +633,9 @@ static int vf610_nfc_write_page(struct nand_chip *chip, const uint8_t *buf,
 	 */
 	vf610_nfc_wr_to_sram(nfc->regs + NFC_MAIN_AREA(0), buf,
 			     mtd->writesize, false);
+	/* Fill the spare area too; oob_poi is 0xff when the caller writes no OOB */
+	vf610_nfc_wr_to_sram(nfc->regs + NFC_MAIN_AREA(0) + mtd->writesize,
+			     chip->oob_poi, vf610_nfc_spare_size(mtd), false);
 
 	code |= COMMAND_RB_HANDSHAKE;
 	cmd2 |= code << CMD_CODE_SHIFT;
-- 
2.54.0