From 8696502b0aa96bcbb1f1e78ae117726378823ae8 Mon Sep 17 00:00:00 2001 From: James Hilliard Date: Tue, 11 Aug 2026 00:01:59 -0600 Subject: [PATCH 01/38] mtd: rawnand: sunxi: propagate user-data allocation errors sunxi_nfc_maximize_user_data() returns -ENOMEM when its per-step length array cannot be allocated, but the caller ignores that error. The NULL array then makes sunxi_nfc_user_data_sz() report the fixed four-byte fallback, which is not the layout that the variable-length setup calculated. Return the setup error so an allocation failure cannot silently select and validate a different OOB layout. Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length") Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/sunxi_nand.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c index 45ccbce91551..108161fe10cb 100644 --- a/drivers/mtd/nand/raw/sunxi_nand.c +++ b/drivers/mtd/nand/raw/sunxi_nand.c @@ -2072,6 +2072,7 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand, int total_user_data_sz = 0; int nsectors; int ecc_mode; + int ret; int i; if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) { @@ -2169,9 +2170,12 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand, * The rationale for variable data length is to prioritize maximum ECC * strength, and then use the remaining space for user data. */ - if (nfc->caps->reg_user_data_len) - sunxi_nfc_maximize_user_data(nand, mtd->oobsize, ecc->bytes, - nsectors); + if (nfc->caps->reg_user_data_len) { + ret = sunxi_nfc_maximize_user_data(nand, mtd->oobsize, + ecc->bytes, nsectors); + if (ret) + return ret; + } if (total_user_data_sz == 0) for (i = 0; i < nsectors; i++) From bde8fd880d84627072c224729c818306c4b30d58 Mon Sep 17 00:00:00 2001 From: James Hilliard Date: Tue, 11 Aug 2026 00:02:00 -0600 Subject: [PATCH 02/38] mtd: rawnand: sunxi: reserve a full user-data word for BBM H6/H616 protected user-data lengths are encoded in four-byte units, but ECC maximization reserves only the two bad block marker bytes. A strength leaving fewer than four bytes therefore selects a zero-byte first user-data section. The OOB layout then subtracts the two marker bytes from that unsigned zero length, and the controller has no protected user-data word in which to store the marker. Reserve one complete user-data word while maximizing ECC, reject configurations which produce no ECC sectors or a shorter first section, and make the OOB iterator bounds-safe. Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length") Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/sunxi_nand.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c index 108161fe10cb..01a0d0fa7b62 100644 --- a/drivers/mtd/nand/raw/sunxi_nand.c +++ b/drivers/mtd/nand/raw/sunxi_nand.c @@ -1991,7 +1991,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section, struct nand_chip *nand = mtd_to_nand(mtd); struct nand_ecc_ctrl *ecc = &nand->ecc; struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand); - unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, section); + unsigned int user_data_sz; /* * The controller does not provide access to OOB bytes @@ -2000,6 +2000,8 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section, if (section >= ecc->steps) return -ERANGE; + user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, section); + /* * The first 2 bytes are used for BB markers, hence we * only have user_data_sz - 2 bytes available in the first user data @@ -2007,7 +2009,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section, */ if (section == 0) { oobregion->offset = 2; - oobregion->length = user_data_sz - 2; + oobregion->length = user_data_sz > 2 ? user_data_sz - 2 : 0; return 0; } @@ -2041,6 +2043,9 @@ static int sunxi_nfc_maximize_user_data(struct nand_chip *nand, uint32_t oobsize int remaining_bytes = oobsize - (ecc_bytes * nsectors); int i, step; + if (nsectors <= 0) + return -EINVAL; + sunxi_nand->user_data_bytes = devm_kzalloc(nfc->dev, nsectors, GFP_KERNEL); if (!sunxi_nand->user_data_bytes) @@ -2056,6 +2061,8 @@ static int sunxi_nfc_maximize_user_data(struct nand_chip *nand, uint32_t oobsize if (sunxi_nand->user_data_bytes[step] == 0) break; } + if (sunxi_nand->user_data_bytes[0] < USER_DATA_SZ) + return -EINVAL; return 0; } @@ -2103,10 +2110,10 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand, bytes -= total_user_data_sz; } else { /* - * remove at least the BBM size before computing the - * max ECC + * User-data lengths are encoded in four-byte units. Reserve + * the first word because it contains the two BBM bytes. */ - bytes -= 2; + bytes -= USER_DATA_SZ; } /* From a8596bb7148136b9e83980900d508d0ef86507ef Mon Sep 17 00:00:00 2001 From: James Hilliard Date: Tue, 11 Aug 2026 00:02:01 -0600 Subject: [PATCH 03/38] mtd: rawnand: sunxi: use a stack buffer for BBM randomization Variable protected user-data lengths replaced the original four-byte stack buffer with a heap allocation before compensating the bad block marker. The allocation is unchecked, and a zero length returns ZERO_SIZE_PTR which sunxi_nfc_randomize_bbm() dereferences. The controller supports at most 32 protected user-data bytes per ECC step, so use a zero-initialized buffer of that bounded size. This removes the allocation failure path and keeps zero-sized invalid layouts from dereferencing ZERO_SIZE_PTR. Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length") Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/sunxi_nand.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c index 01a0d0fa7b62..83666dd6cb2a 100644 --- a/drivers/mtd/nand/raw/sunxi_nand.c +++ b/drivers/mtd/nand/raw/sunxi_nand.c @@ -222,6 +222,7 @@ * USER_DATA_LEN registers. */ #define USER_DATA_SZ 4 +#define SUNXI_NFC_MAX_USER_DATA_SZ 32 /** * struct sunxi_nand_chip_sel - stores information related to NAND Chip Select @@ -1003,11 +1004,10 @@ static void sunxi_nfc_hw_ecc_set_prot_oob_bytes(struct nand_chip *nand, struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller); struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand); unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step); - u8 *user_data = NULL; + u8 user_data[SUNXI_NFC_MAX_USER_DATA_SZ] = {}; /* Randomize the Bad Block Marker. */ if (bbm && (nand->options & NAND_NEED_SCRAMBLING)) { - user_data = kmalloc(user_data_sz, GFP_KERNEL); memcpy(user_data, oob, user_data_sz); sunxi_nfc_randomize_bbm(nand, page, user_data); oob = user_data; @@ -1040,7 +1040,6 @@ static void sunxi_nfc_hw_ecc_set_prot_oob_bytes(struct nand_chip *nand, } } - kfree(user_data); } static void sunxi_nfc_hw_ecc_update_stats(struct nand_chip *nand, From c9e20e213bb051d02711155de0dc4759de2faddf Mon Sep 17 00:00:00 2001 From: bui duc phuc Date: Wed, 12 Aug 2026 17:37:28 +0700 Subject: [PATCH 04/38] mtd: rawnand: brcmnand: Propagate errors from optional IRQ lookup platform_get_irq_optional() returns a positive IRQ number on success or a negative error code on failure. For an optional IRQ, -ENXIO indicates that no optional IRQ is available, in which case the driver falls back to using the ctlrdy IRQ. Other errors should be propagated so that the caller can handle them appropriately. Treat -ENXIO as the only case where the driver falls back to the ctlrdy IRQ, and propagate all other errors returned by platform_get_irq_optional(). Signed-off-by: bui duc phuc Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/brcmnand/brcmnand.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c index 5b9dadd5405e..4a1f5e736a1c 100644 --- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c +++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c @@ -3272,6 +3272,8 @@ static int brcmnand_edu_setup(struct platform_device *pdev) ctrl->edu_irq = platform_get_irq_optional(pdev, 1); if (ctrl->edu_irq < 0) { + if (ctrl->edu_irq != -ENXIO) + return ctrl->edu_irq; dev_warn(dev, "FLASH EDU enabled, using ctlrdy irq\n"); } else { From ea609469a3e37fc731636c7be6bc3e8983b2070b Mon Sep 17 00:00:00 2001 From: Dominique Martinet Date: Mon, 17 Aug 2026 05:29:17 +0000 Subject: [PATCH 05/38] mtd: spinand: winbond: add support for W25N04LW MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for Winbond W25N04LW 4Gbit SPI-NAND: > 1.8V 4G-bit > Raw serial SLC NAND flash memory > Dual/Quad SPI with 104MHz > buffer read, continuous read & sequential read Highlights copied from datasheet: – Page size: 4,352 Bytes (4096 + 256 Bytes) – Block size: 64 pages (256K + 16K Bytes) - Built-in 8-Bit ECC for memory array – ECC status bits indicate ECC results – Bad Block Management and LUT access – Software and Hardware Write-Protect – Power Supply Lock-Down and OTP protection – Unique ID and Parameter page – Ten 4KB OTP pages per die – Read Level Setting for Read Retry The 4096+256 byte page layout is as follow: - 4096 bytes ECC protected "main memory array", subdivided in 8 512 bytes sectors - 128 bytes spare array, subdivided in 8 16 bytes sectors as follow: - 2 bytes bad block marker (no ECC protection) - 2 bytes "user data II" (no ECC protection) - 12 bytes "user data I" (ECC protected) - 128 bytes parity array, subdivided in 8 16 bytes sectors: - 13 bytes ECC for main data and user data - 3 unused bytes This commit does not support most advanced features such as continuous read, LUT management and OTP pages, and only provides basic usage. OOB layout was kept compatible with previous models (exposing both user data I and II), dependent on mtd->oobsize. Co-developed-by: Daisuke Mizobuchi Signed-off-by: Daisuke Mizobuchi Signed-off-by: Dominique Martinet Signed-off-by: Miquel Raynal --- drivers/mtd/nand/spi/winbond.c | 35 +++++++++++++++++++++++++++++++--- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/spi/winbond.c b/drivers/mtd/nand/spi/winbond.c index 9b78c1e6cbc9..a1807fa9ae03 100644 --- a/drivers/mtd/nand/spi/winbond.c +++ b/drivers/mtd/nand/spi/winbond.c @@ -314,10 +314,18 @@ static int w25n01kv_ooblayout_ecc(struct mtd_info *mtd, int section, static int w25n02kv_ooblayout_ecc(struct mtd_info *mtd, int section, struct mtd_oob_region *region) { - if (section > 3) + int num_sections = 4; + int offset = 64; + + if (mtd->oobsize == 256) { + num_sections = 8; + offset = 128; + } + + if (section >= num_sections) return -ERANGE; - region->offset = 64 + (16 * section); + region->offset = offset + (16 * section); region->length = 13; return 0; @@ -326,9 +334,21 @@ static int w25n02kv_ooblayout_ecc(struct mtd_info *mtd, int section, static int w25n02kv_ooblayout_free(struct mtd_info *mtd, int section, struct mtd_oob_region *region) { - if (section > 3) + int num_sections = 4; + + if (mtd->oobsize == 256) + num_sections = 8; + + if (section >= num_sections) return -ERANGE; + /* + * For at least W25N04KW and W25N04LW, this region is actually + * split in two: + * ECC-protected "User Data I" at + 4 offset, length 12 + * unprotected "User Data II" at + 2 offset, length 2 + * This returns the full region for backwards compatibility. + */ region->offset = (16 * section) + 2; region->length = 14; @@ -768,6 +788,15 @@ static const struct spinand_info winbond_spinand_table[] = { &update_cache_variants), 0, SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)), + SPINAND_INFO("W25N04LW", /* 1.8V */ + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xb2, 0x23), + NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&read_cache_variants, + &write_cache_variants, + &update_cache_variants), + 0, + SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)), SPINAND_INFO("W35N04JW", /* 1.8V */ SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xdf, 0x23), NAND_MEMORG(1, 4096, 128, 64, 512, 10, 1, 4, 1), From 09ec4fe9036ed0a0293518dc11f2480423d1139a Mon Sep 17 00:00:00 2001 From: Triet Hoang Date: Sat, 22 Aug 2026 04:59:56 +0000 Subject: [PATCH 06/38] mtd: rawnand: stm32_fmc2: Convert to DEFINE_SIMPLE_DEV_PM_OPS() Convert the deprecated SIMPLE_DEV_PM_OPS to DEFINE_SIMPLE_DEV_PM_OPS and pm_sleep_ptr(). This lets us drop the __maybe_unused annotations from its suspend and resume callbacks, also reduces kernel size in case CONFIG_PM or CONFIG_PM_SLEEP is disabled. Signed-off-by: Triet Hoang Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/stm32_fmc2_nand.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/nand/raw/stm32_fmc2_nand.c b/drivers/mtd/nand/raw/stm32_fmc2_nand.c index c08d6b176372..9f42f8ab3212 100644 --- a/drivers/mtd/nand/raw/stm32_fmc2_nand.c +++ b/drivers/mtd/nand/raw/stm32_fmc2_nand.c @@ -2076,7 +2076,7 @@ static void stm32_fmc2_nfc_remove(struct platform_device *pdev) stm32_fmc2_nfc_wp_enable(nand); } -static int __maybe_unused stm32_fmc2_nfc_suspend(struct device *dev) +static int stm32_fmc2_nfc_suspend(struct device *dev) { struct stm32_fmc2_nfc *nfc = dev_get_drvdata(dev); struct stm32_fmc2_nand *nand = &nfc->nand; @@ -2090,7 +2090,7 @@ static int __maybe_unused stm32_fmc2_nfc_suspend(struct device *dev) return 0; } -static int __maybe_unused stm32_fmc2_nfc_resume(struct device *dev) +static int stm32_fmc2_nfc_resume(struct device *dev) { struct stm32_fmc2_nfc *nfc = dev_get_drvdata(dev); struct stm32_fmc2_nand *nand = &nfc->nand; @@ -2118,7 +2118,7 @@ static int __maybe_unused stm32_fmc2_nfc_resume(struct device *dev) return 0; } -static SIMPLE_DEV_PM_OPS(stm32_fmc2_nfc_pm_ops, stm32_fmc2_nfc_suspend, +static DEFINE_SIMPLE_DEV_PM_OPS(stm32_fmc2_nfc_pm_ops, stm32_fmc2_nfc_suspend, stm32_fmc2_nfc_resume); static const struct stm32_fmc2_nfc_data stm32_fmc2_nfc_mp1_data = { @@ -2153,7 +2153,7 @@ static struct platform_driver stm32_fmc2_nfc_driver = { .driver = { .name = "stm32_fmc2_nfc", .of_match_table = stm32_fmc2_nfc_match, - .pm = &stm32_fmc2_nfc_pm_ops, + .pm = pm_sleep_ptr(&stm32_fmc2_nfc_pm_ops), }, }; module_platform_driver(stm32_fmc2_nfc_driver); From c469391db15839b2d1b1294eb4a5e5c36ab5ac7a Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Sat, 22 Aug 2026 16:03:34 -0700 Subject: [PATCH 07/38] mtd: nand: omap2: Fix kernel-doc parameter warning kernel-doc interprets inline comments in the omap_compare_ecc() parameter list as part of the prototype, causing it to miss ecc_data2 and report its documentation as excess. Remove the inline comments; the parameter descriptions are already provided by the kernel-doc tags. Assisted-by: Codex:GPT-5.6-luna Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/omap2.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/drivers/mtd/nand/raw/omap2.c b/drivers/mtd/nand/raw/omap2.c index 552f36da79fc..4909e62dc11e 100644 --- a/drivers/mtd/nand/raw/omap2.c +++ b/drivers/mtd/nand/raw/omap2.c @@ -666,9 +666,7 @@ static void gen_true_ecc(u8 *ecc_buf) * If there is no error, %0 is returned. If there is an error but it * was corrected, %1 is returned. Otherwise, %-1 is returned. */ -static int omap_compare_ecc(u8 *ecc_data1, /* read from NAND memory */ - u8 *ecc_data2, /* read from register */ - u8 *page_data) +static int omap_compare_ecc(u8 *ecc_data1, u8 *ecc_data2, u8 *page_data) { uint i; u8 tmp0_bit[8], tmp1_bit[8], tmp2_bit[8]; From 0d66f9895f286d2fab396a71e6efeb95c4a7e5a6 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 24 Aug 2026 13:21:20 -0700 Subject: [PATCH 08/38] mtd: rawnand: ndfc: use devm_platform_ioremap_resource() Replace the open-coded of_iomap()/iounmap() with the managed devm_platform_ioremap_resource() helper. This fixes a mapping leak on driver remove (the old code never called iounmap()) and simplifies the error path by dropping the manual cleanup in ndfc_probe(). There is no overlapping memory-region concern introduced by this change: each supported board DT describes a single ndfc node with a unique 0x2000 register region, and the EBC parent uses dcr-reg rather than a MEM reg resource, so the newly added request_mem_region() cannot conflict with an existing reservation. Distinct chip selects map to distinct 64-bit physical addresses, so CS instances do not overlap. Fixes: a808ad3b0d28 ("[MTD] [NAND] ndfc driver") Cc: stable@vger.kernel.org Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/ndfc.c | 21 ++++++++------------- 1 file changed, 8 insertions(+), 13 deletions(-) diff --git a/drivers/mtd/nand/raw/ndfc.c b/drivers/mtd/nand/raw/ndfc.c index a48274297d3b..d6db04d48c45 100644 --- a/drivers/mtd/nand/raw/ndfc.c +++ b/drivers/mtd/nand/raw/ndfc.c @@ -185,10 +185,15 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc, static int ndfc_probe(struct platform_device *ofdev) { struct ndfc_controller *ndfc; + void __iomem *ndfcbase; const __be32 *reg; u32 ccr; u32 cs; - int err, len = 0; + int len = 0; + + ndfcbase = devm_platform_ioremap_resource(ofdev, 0); + if (IS_ERR(ndfcbase)) + return PTR_ERR(ndfcbase); /* Read the reg property to get the chip select */ reg = of_get_property(ofdev->dev.of_node, "reg", &len); @@ -210,11 +215,7 @@ static int ndfc_probe(struct platform_device *ofdev) ndfc->ofdev = ofdev; dev_set_drvdata(&ofdev->dev, ndfc); - ndfc->ndfcbase = of_iomap(ofdev->dev.of_node, 0); - if (!ndfc->ndfcbase) { - dev_err(&ofdev->dev, "failed to get memory\n"); - return -EIO; - } + ndfc->ndfcbase = ndfcbase; ccr = NDFC_CCR_BS(ndfc->chip_select); @@ -232,13 +233,7 @@ static int ndfc_probe(struct platform_device *ofdev) iowrite32be(be32_to_cpup(reg), ndfc->ndfcbase + offset); } - err = ndfc_chip_init(ndfc, ofdev->dev.of_node); - if (err) { - iounmap(ndfc->ndfcbase); - return err; - } - - return 0; + return ndfc_chip_init(ndfc, ofdev->dev.of_node); } static void ndfc_remove(struct platform_device *ofdev) From f4f2a54cfef7cd23a54b8427a00c2dae83ffaf2e Mon Sep 17 00:00:00 2001 From: Bill Lee Date: Thu, 27 Aug 2026 15:39:12 -0500 Subject: [PATCH 09/38] mtd: spinand: add support for ISSI SPI NAND flash Add a new manufacturer driver for ISSI SPI NAND devices (manufacturer ID 0x9d). The following devices are supported: - IS37/IS38SMW01G8B: 1Gb, 1.8V - IS37/IS38SMW02G8B: 2Gb, 1.8V - IS37/IS38SML04G8B: 4Gb, 3.3V, 2-die stacked - IS37/IS38SMW04G8B: 4Gb, 1.8V, 2-die stacked Signed-off-by: Bill Lee Signed-off-by: Jeff Kim Signed-off-by: Han Xu Link: https://patch.msgid.link/20260825-spinand_issi-v1-1-d81bdd7c212d@nxp.com Signed-off-by: Miquel Raynal --- drivers/mtd/nand/spi/Makefile | 2 +- drivers/mtd/nand/spi/core.c | 1 + drivers/mtd/nand/spi/issi.c | 187 ++++++++++++++++++++++++++++++++++ include/linux/mtd/spinand.h | 1 + 4 files changed, 190 insertions(+), 1 deletion(-) create mode 100644 drivers/mtd/nand/spi/issi.c diff --git a/drivers/mtd/nand/spi/Makefile b/drivers/mtd/nand/spi/Makefile index b5ccb44860df..f6b2a094fafc 100644 --- a/drivers/mtd/nand/spi/Makefile +++ b/drivers/mtd/nand/spi/Makefile @@ -1,5 +1,5 @@ # SPDX-License-Identifier: GPL-2.0 spinand-objs := core.o otp.o spinand-objs += alliancememory.o ato.o dosilicon.o esmt.o fmsh.o foresee.o gigadevice.o heyangtek.o -spinand-objs += macronix.o micron.o paragon.o skyhigh.o toshiba.o winbond.o xtx.o +spinand-objs += issi.o macronix.o micron.o paragon.o skyhigh.o toshiba.o winbond.o xtx.o obj-$(CONFIG_MTD_SPI_NAND) += spinand.o diff --git a/drivers/mtd/nand/spi/core.c b/drivers/mtd/nand/spi/core.c index 8bf9301f25e7..86a8d759682b 100644 --- a/drivers/mtd/nand/spi/core.c +++ b/drivers/mtd/nand/spi/core.c @@ -1360,6 +1360,7 @@ static const struct spinand_manufacturer *spinand_manufacturers[] = { &foresee_spinand_manufacturer, &gigadevice_spinand_manufacturer, &heyangtek_spinand_manufacturer, + &issi_spinand_manufacturer, ¯onix_spinand_manufacturer, µn_spinand_manufacturer, ¶gon_spinand_manufacturer, diff --git a/drivers/mtd/nand/spi/issi.c b/drivers/mtd/nand/spi/issi.c new file mode 100644 index 000000000000..122b3a6e2f62 --- /dev/null +++ b/drivers/mtd/nand/spi/issi.c @@ -0,0 +1,187 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (c) 2026 ISSI + * + * Authors: + * Bill Lee + * Jeff Kim + * Co-Author: + * Han Xu + */ + +#include +#include +#include +#include + +#define SPINAND_MFR_ISSI 0x9d + +#define ISSI_STATUS_ECC_MASK GENMASK(6, 4) +#define ISSI_STATUS_ECC_NO_BITFLIPS 0 +#define ISSI_STATUS_ECC_1TO3_BITFLIPS 1 +#define ISSI_STATUS_ECC_UNCOR_ERROR 2 +#define ISSI_STATUS_ECC_4TO6_BITFLIPS 3 +#define ISSI_STATUS_ECC_7TO8_BITFLIPS 5 + +/* + * As per datasheet, die selection is done by the 7th bit of Drive + * Strength Register (Address 0xD0). + */ +#define ISSI_DIE_SELECT_REG 0xD0 +#define ISSI_SELECT_DIE_MASK BIT(7) +#define ISSI_SELECT_DIE(x) ((x) << 7) + +static SPINAND_OP_VARIANTS( + quadio_read_cache_variants, + SPINAND_PAGE_READ_FROM_CACHE_1S_1S_4S_OP(0, 1, NULL, 0, 0), + SPINAND_PAGE_READ_FROM_CACHE_1S_1S_2S_OP(0, 1, NULL, 0, 0), + SPINAND_PAGE_READ_FROM_CACHE_FAST_1S_1S_1S_OP(0, 1, NULL, 0, 0), + SPINAND_PAGE_READ_FROM_CACHE_1S_1S_1S_OP(0, 1, NULL, 0, 0)); + +static SPINAND_OP_VARIANTS(x4_write_cache_variants, + SPINAND_PROG_LOAD_1S_1S_4S_OP(true, 0, NULL, 0), + SPINAND_PROG_LOAD_1S_1S_1S_OP(true, 0, NULL, 0)); + +static SPINAND_OP_VARIANTS(x4_update_cache_variants, + SPINAND_PROG_LOAD_1S_1S_4S_OP(false, 0, NULL, 0), + SPINAND_PROG_LOAD_1S_1S_1S_OP(false, 0, NULL, 0)); + +static int issi_8_ooblayout_ecc(struct mtd_info *mtd, int section, + struct mtd_oob_region *region) +{ + if (section) + return -ERANGE; + + region->offset = mtd->oobsize / 2; + region->length = mtd->oobsize / 2; + + return 0; +} + +static int issi_8_ooblayout_free(struct mtd_info *mtd, int section, + struct mtd_oob_region *region) +{ + if (section) + return -ERANGE; + + /* Reserve 2 bytes for the BBM. */ + region->offset = 2; + region->length = (mtd->oobsize / 2) - 2; + + return 0; +} + +static const struct mtd_ooblayout_ops issi_8_ooblayout = { + .ecc = issi_8_ooblayout_ecc, + .free = issi_8_ooblayout_free, +}; + +static int issi_select_target(struct spinand_device *spinand, + unsigned int target) +{ + int ret; + u8 regval; + + if (target > 1) + return -EINVAL; + + ret = spinand_read_reg_op(spinand, ISSI_DIE_SELECT_REG, ®val); + if (ret) + return ret; + + regval &= ~ISSI_SELECT_DIE_MASK; + regval |= ISSI_SELECT_DIE(target); + + return spinand_write_reg_op(spinand, ISSI_DIE_SELECT_REG, regval); +} + +static int issi_8_ecc_get_status(struct spinand_device *spinand, u8 status) +{ + switch (FIELD_GET(ISSI_STATUS_ECC_MASK, status)) { + case ISSI_STATUS_ECC_NO_BITFLIPS: + return 0; + + case ISSI_STATUS_ECC_1TO3_BITFLIPS: + return 3; + + case ISSI_STATUS_ECC_4TO6_BITFLIPS: + return 6; + + case ISSI_STATUS_ECC_7TO8_BITFLIPS: + return 8; + + case ISSI_STATUS_ECC_UNCOR_ERROR: + return -EBADMSG; + default: + break; + } + + return -EINVAL; +} + +static const struct spinand_info issi_spinand_table[] = { + /* IS37/38SMW01G8B 1Gb 1.8V */ + SPINAND_INFO("IS37/38SMW01G8B", + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x15), + NAND_MEMORG(1, 2048, 128, 64, 1024, 40, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&quadio_read_cache_variants, + &x4_write_cache_variants, + &x4_update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&issi_8_ooblayout, issi_8_ecc_get_status), + SPINAND_SELECT_TARGET(issi_select_target)), + + /* IS37/38SMW02G8B 2Gb 1.8V */ + SPINAND_INFO("IS37/38SMW02G8B", + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x25), + NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&quadio_read_cache_variants, + &x4_write_cache_variants, + &x4_update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&issi_8_ooblayout, issi_8_ecc_get_status), + SPINAND_SELECT_TARGET(issi_select_target)), + + /* IS37/38SML04G8B 4Gb 3.3V */ + SPINAND_INFO("IS37/38SML04G8", + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x34), + NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 2), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&quadio_read_cache_variants, + &x4_write_cache_variants, + &x4_update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&issi_8_ooblayout, issi_8_ecc_get_status), + SPINAND_SELECT_TARGET(issi_select_target)), + + /* IS37/38SMW04G8B 4Gb 1.8V */ + SPINAND_INFO("IS37/38SMW04G8B", + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0x35), + NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 2), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS(&quadio_read_cache_variants, + &x4_write_cache_variants, + &x4_update_cache_variants), + SPINAND_HAS_QE_BIT, + SPINAND_ECCINFO(&issi_8_ooblayout, issi_8_ecc_get_status), + SPINAND_SELECT_TARGET(issi_select_target)), +}; + +static int issi_spinand_init(struct spinand_device *spinand) +{ + return 0; +} + +static const struct spinand_manufacturer_ops issi_spinand_manuf_ops = { + .init = issi_spinand_init, +}; + +const struct spinand_manufacturer issi_spinand_manufacturer = { + .id = SPINAND_MFR_ISSI, + .name = "ISSI", + .chips = issi_spinand_table, + .nchips = ARRAY_SIZE(issi_spinand_table), + .ops = &issi_spinand_manuf_ops, +}; diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index 5f4c00ae72a7..b42407b69db3 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -438,6 +438,7 @@ extern const struct spinand_manufacturer fmsh_spinand_manufacturer; extern const struct spinand_manufacturer foresee_spinand_manufacturer; extern const struct spinand_manufacturer gigadevice_spinand_manufacturer; extern const struct spinand_manufacturer heyangtek_spinand_manufacturer; +extern const struct spinand_manufacturer issi_spinand_manufacturer; extern const struct spinand_manufacturer macronix_spinand_manufacturer; extern const struct spinand_manufacturer micron_spinand_manufacturer; extern const struct spinand_manufacturer paragon_spinand_manufacturer; From e18c514e9c1ff330bec87fd62341251d041e7443 Mon Sep 17 00:00:00 2001 From: Vladimir Zapolskiy Date: Thu, 3 Sep 2026 14:24:23 +0300 Subject: [PATCH 10/38] mtd: rawnand: lpc32xx_slc: Remove platform data support Since NXP LPC32xx SoC support in the Linux kernel strictly depends on device tree support, the unused platform data support can be removed from the NAND SLC driver. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/lpc32xx_slc.c | 21 ++------------------- include/linux/mtd/lpc32xx_slc.h | 17 ----------------- 2 files changed, 2 insertions(+), 36 deletions(-) delete mode 100644 include/linux/mtd/lpc32xx_slc.h diff --git a/drivers/mtd/nand/raw/lpc32xx_slc.c b/drivers/mtd/nand/raw/lpc32xx_slc.c index 10c8080207f4..b4d90afa9267 100644 --- a/drivers/mtd/nand/raw/lpc32xx_slc.c +++ b/drivers/mtd/nand/raw/lpc32xx_slc.c @@ -25,7 +25,6 @@ #include #include #include -#include #define LPC32XX_MODNAME "lpc32xx-nand" @@ -213,7 +212,6 @@ struct lpc32xx_nand_cfg_slc { struct lpc32xx_nand_host { struct nand_chip nand_chip; - struct lpc32xx_slc_platform_data *pdata; struct clk *clk; struct gpio_desc *wp_gpio; void __iomem *io_base; @@ -727,24 +725,11 @@ static int lpc32xx_nand_write_page_raw_syndrome(struct nand_chip *chip, static int lpc32xx_nand_dma_setup(struct lpc32xx_nand_host *host) { struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); - dma_cap_mask_t mask; host->dma_chan = dma_request_chan(mtd->dev.parent, "rx-tx"); if (IS_ERR(host->dma_chan)) { - /* fallback to request using platform data */ - if (!host->pdata || !host->pdata->dma_filter) { - dev_err(mtd->dev.parent, "no DMA platform data\n"); - return -ENOENT; - } - - dma_cap_zero(mask); - dma_cap_set(DMA_SLAVE, mask); - host->dma_chan = dma_request_channel(mask, host->pdata->dma_filter, "nand-slc"); - - if (!host->dma_chan) { - dev_err(mtd->dev.parent, "Failed to request DMA channel\n"); - return -EBUSY; - } + dev_err(mtd->dev.parent, "Failed to request DMA channel\n"); + return PTR_ERR(host->dma_chan); } return 0; @@ -873,8 +858,6 @@ static int lpc32xx_nand_probe(struct platform_device *pdev) gpiod_set_consumer_name(host->wp_gpio, "NAND WP"); - host->pdata = dev_get_platdata(&pdev->dev); - chip = &host->nand_chip; mtd = nand_to_mtd(chip); nand_set_controller_data(chip, host); diff --git a/include/linux/mtd/lpc32xx_slc.h b/include/linux/mtd/lpc32xx_slc.h deleted file mode 100644 index a044b806566b..000000000000 --- a/include/linux/mtd/lpc32xx_slc.h +++ /dev/null @@ -1,17 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * Platform data for LPC32xx SoC SLC NAND controller - * - * Copyright © 2012 Roland Stigge - */ - -#ifndef __LINUX_MTD_LPC32XX_SLC_H -#define __LINUX_MTD_LPC32XX_SLC_H - -#include - -struct lpc32xx_slc_platform_data { - dma_filter_fn dma_filter; -}; - -#endif /* __LINUX_MTD_LPC32XX_SLC_H */ From def559a215699aa2f2d8ef98f30156b9d562a154 Mon Sep 17 00:00:00 2001 From: Vladimir Zapolskiy Date: Thu, 3 Sep 2026 14:24:24 +0300 Subject: [PATCH 11/38] mtd: rawnand: lpc32xx_mlc: Remove platform data support Since NXP LPC32xx SoC support in the Linux kernel strictly depends on device tree support, the unused platform data support can be removed from the NAND MLC driver. Signed-off-by: Vladimir Zapolskiy Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/lpc32xx_mlc.c | 21 ++------------------- include/linux/mtd/lpc32xx_mlc.h | 17 ----------------- 2 files changed, 2 insertions(+), 36 deletions(-) delete mode 100644 include/linux/mtd/lpc32xx_mlc.h diff --git a/drivers/mtd/nand/raw/lpc32xx_mlc.c b/drivers/mtd/nand/raw/lpc32xx_mlc.c index 8f6a89d9ba83..8436015edcb4 100644 --- a/drivers/mtd/nand/raw/lpc32xx_mlc.c +++ b/drivers/mtd/nand/raw/lpc32xx_mlc.c @@ -26,7 +26,6 @@ #include #include #include -#include #include #include #include @@ -174,7 +173,6 @@ static struct nand_bbt_descr lpc32xx_nand_bbt_mirror = { struct lpc32xx_nand_host { struct platform_device *pdev; struct nand_chip nand_chip; - struct lpc32xx_mlc_platform_data *pdata; struct clk *clk; struct gpio_desc *wp_gpio; void __iomem *io_base; @@ -580,24 +578,11 @@ static void lpc32xx_ecc_enable(struct nand_chip *chip, int mode) static int lpc32xx_dma_setup(struct lpc32xx_nand_host *host) { struct mtd_info *mtd = nand_to_mtd(&host->nand_chip); - dma_cap_mask_t mask; host->dma_chan = dma_request_chan(mtd->dev.parent, "rx-tx"); if (IS_ERR(host->dma_chan)) { - /* fallback to request using platform data */ - if (!host->pdata || !host->pdata->dma_filter) { - dev_err(mtd->dev.parent, "no DMA platform data\n"); - return -ENOENT; - } - - dma_cap_zero(mask); - dma_cap_set(DMA_SLAVE, mask); - host->dma_chan = dma_request_channel(mask, host->pdata->dma_filter, "nand-mlc"); - - if (!host->dma_chan) { - dev_err(mtd->dev.parent, "Failed to request DMA channel\n"); - return -EBUSY; - } + dev_err(mtd->dev.parent, "Failed to request DMA channel\n"); + return PTR_ERR(host->dma_chan); } /* @@ -736,8 +721,6 @@ static int lpc32xx_nand_probe(struct platform_device *pdev) gpiod_set_consumer_name(host->wp_gpio, "NAND WP"); - host->pdata = dev_get_platdata(&pdev->dev); - /* link the private data structures */ nand_set_controller_data(nand_chip, host); nand_set_flash_node(nand_chip, pdev->dev.of_node); diff --git a/include/linux/mtd/lpc32xx_mlc.h b/include/linux/mtd/lpc32xx_mlc.h deleted file mode 100644 index 35e971be0950..000000000000 --- a/include/linux/mtd/lpc32xx_mlc.h +++ /dev/null @@ -1,17 +0,0 @@ -/* SPDX-License-Identifier: GPL-2.0-only */ -/* - * Platform data for LPC32xx SoC MLC NAND controller - * - * Copyright © 2012 Roland Stigge - */ - -#ifndef __LINUX_MTD_LPC32XX_MLC_H -#define __LINUX_MTD_LPC32XX_MLC_H - -#include - -struct lpc32xx_mlc_platform_data { - dma_filter_fn dma_filter; -}; - -#endif /* __LINUX_MTD_LPC32XX_MLC_H */ From a3c84084a73e170374b7dd493947efdef4ee57bc Mon Sep 17 00:00:00 2001 From: James Hilliard Date: Fri, 4 Sep 2026 19:05:37 -0600 Subject: [PATCH 12/38] mtd: rawnand: sunxi: reject ECC maximization on small pages When nand-ecc-maximize is set, the driver selects a 1024-byte ECC step and divides the available OOB bytes by the resulting number of steps. A NAND with a smaller page therefore produces zero steps and a division by zero. The older controllers also provide a 512-byte ECC block mode, but the hardware documentation describes that as an ECC block size within NAND pages whose supported sizes start at 1024 bytes. It does not document a 512-byte NAND page mode. Reject pages smaller than 1024 bytes before deriving the step count. This prevents the division by zero at the point where the incompatible maximized geometry is selected without changing explicitly configured 512-byte ECC block handling. Fixes: 4796d8655915 ("mtd: nand: sunxi: Support ECC maximization") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/sunxi_nand.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c index 83666dd6cb2a..c84f304fb749 100644 --- a/drivers/mtd/nand/raw/sunxi_nand.c +++ b/drivers/mtd/nand/raw/sunxi_nand.c @@ -2084,6 +2084,9 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand, if (nanddev->ecc.user_conf.flags & NAND_ECC_MAXIMIZE_STRENGTH) { int bytes = mtd->oobsize; + if (mtd->writesize < 1024) + return -EINVAL; + ecc->size = 1024; nsectors = mtd->writesize / ecc->size; From c56d52865624ca236c44838ef9366a8597b6af6c Mon Sep 17 00:00:00 2001 From: James Hilliard Date: Fri, 4 Sep 2026 16:17:58 -0600 Subject: [PATCH 13/38] mtd: rawnand: sunxi: fix free OOB section offsets The sunxi hardware ECC OOB layout places protected user data before the ECC bytes for every step. Since variable user-data lengths were introduced, free sections after the first use sunxi_get_ecc_offset(), which skips the protected user data and points at the ECC bytes instead. As a result, the MTD free-OOB interface addresses ECC bytes rather than the protected user data for those sections. Use sunxi_get_oob_offset() to point each free section at the beginning of its protected user data. Keep the special two-byte offset for section zero to reserve the bad block marker. Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c index c84f304fb749..f41feebe4257 100644 --- a/drivers/mtd/nand/raw/sunxi_nand.c +++ b/drivers/mtd/nand/raw/sunxi_nand.c @@ -2013,7 +2013,7 @@ static int sunxi_nand_ooblayout_free(struct mtd_info *mtd, int section, return 0; } - oobregion->offset = sunxi_get_ecc_offset(sunxi_nand, ecc, section); + oobregion->offset = sunxi_get_oob_offset(sunxi_nand, ecc, section); oobregion->length = user_data_sz; return 0; From 2b7e16d565af2b4715290d9de513187a7374b2ed Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 7 Sep 2026 23:03:27 -0700 Subject: [PATCH 14/38] mtd: rawnand: fsl_ifc: use devm_platform_get_and_ioremap_resource Replace the manual of_address_to_resource(), ioremap(), and iounmap() in the probe/remove paths with devm_platform_get_and_ioremap_resource() so the resource is managed and released automatically on probe failure and driver removal. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/fsl_ifc_nand.c | 30 +++++++++-------------------- 1 file changed, 9 insertions(+), 21 deletions(-) diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c index a88ac2cfaccd..315263c94497 100644 --- a/drivers/mtd/nand/raw/fsl_ifc_nand.c +++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c @@ -12,7 +12,6 @@ #include #include #include -#include #include #include #include @@ -969,9 +968,6 @@ static int fsl_ifc_chip_remove(struct fsl_ifc_mtd *priv) kfree(mtd->name); - if (priv->vbase) - iounmap(priv->vbase); - ifc_nand_ctrl->chips[priv->bank] = NULL; return 0; @@ -996,12 +992,12 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) { struct fsl_ifc_runtime __iomem *ifc; struct fsl_ifc_mtd *priv; - struct resource res; + struct resource *res; + void __iomem *vbase; static const char *part_probe_types[] = { "cmdlinepart", "RedBoot", "ofpart", NULL }; int ret; int bank; - struct device_node *node = dev->dev.of_node; struct mtd_info *mtd; if (!fsl_ifc_ctrl_dev || !fsl_ifc_ctrl_dev->rregs) @@ -1009,15 +1005,13 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) ifc = fsl_ifc_ctrl_dev->rregs; /* get, allocate and map the memory resource */ - ret = of_address_to_resource(node, 0, &res); - if (ret) { - dev_err(&dev->dev, "%s: failed to get resource\n", __func__); - return ret; - } + vbase = devm_platform_get_and_ioremap_resource(dev, 0, &res); + if (IS_ERR(vbase)) + return PTR_ERR(vbase); /* find which chip select it is connected to */ for (bank = 0; bank < fsl_ifc_ctrl_dev->banks; bank++) { - if (match_bank(fsl_ifc_ctrl_dev->gregs, bank, res.start)) + if (match_bank(fsl_ifc_ctrl_dev->gregs, bank, res->start)) break; } @@ -1054,13 +1048,7 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) priv->bank = bank; priv->ctrl = fsl_ifc_ctrl_dev; priv->dev = &dev->dev; - - priv->vbase = ioremap(res.start, resource_size(&res)); - if (!priv->vbase) { - dev_err(priv->dev, "%s: failed to map chip region\n", __func__); - ret = -ENOMEM; - goto err; - } + priv->vbase = vbase; dev_set_drvdata(priv->dev, priv); @@ -1076,7 +1064,7 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) &ifc->ifc_nand.nand_evter_intr_en); mtd = nand_to_mtd(&priv->chip); - mtd->name = kasprintf(GFP_KERNEL, "%llx.flash", (u64)res.start); + mtd->name = kasprintf(GFP_KERNEL, "%llx.flash", (u64)res->start); if (!mtd->name) { ret = -ENOMEM; goto err; @@ -1098,7 +1086,7 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) goto cleanup_nand; dev_info(priv->dev, "IFC NAND device at 0x%llx, bank %d\n", - (unsigned long long)res.start, priv->bank); + (unsigned long long)res->start, priv->bank); return 0; From 7e874b1750a40f3dc9a629aeb72eba09c77f77e9 Mon Sep 17 00:00:00 2001 From: Karl Mehltretter Date: Wed, 9 Sep 2026 08:40:55 +0200 Subject: [PATCH 15/38] mtd: spinand: Fix spinand_manufacturer_ops kernel-doc The kernel-doc heading for struct spinand_manufacturer_ops misspells and truncates its name as manufacurer_ops. As a result, kernel-doc cannot match the comment to the structure declaration. Use the structure's actual name. Fixes: 7529df465248 ("mtd: nand: Add core infrastructure to support SPI NANDs") Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Miquel Raynal --- include/linux/mtd/spinand.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/linux/mtd/spinand.h b/include/linux/mtd/spinand.h index b42407b69db3..d7c99fcfb85e 100644 --- a/include/linux/mtd/spinand.h +++ b/include/linux/mtd/spinand.h @@ -399,7 +399,7 @@ struct spinand_devid { }; /** - * struct manufacurer_ops - SPI NAND manufacturer specific operations + * struct spinand_manufacturer_ops - SPI NAND manufacturer specific operations * @init: initialize a SPI NAND device * @cleanup: cleanup a SPI NAND device * From 5e73728a875a91fb2c7dc527f7391da0205f85b1 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Wed, 9 Sep 2026 15:35:21 -0700 Subject: [PATCH 16/38] mtd: rawnand: ndfc: use devm_kasprintf for mtd name Convert the mtd->name allocation from kasprintf() plus a manual kfree() in the error path and in ndfc_remove() to the managed devm_kasprintf() helper. The name is now released automatically with the device, removing the need for explicit cleanup. Assisted-by: opencode:hy3-free Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/ndfc.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/nand/raw/ndfc.c b/drivers/mtd/nand/raw/ndfc.c index d6db04d48c45..d7b119028a71 100644 --- a/drivers/mtd/nand/raw/ndfc.c +++ b/drivers/mtd/nand/raw/ndfc.c @@ -162,8 +162,8 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc, return -ENODEV; nand_set_flash_node(chip, flash_np); - mtd->name = kasprintf(GFP_KERNEL, "%s.%pOFn", dev_name(&ndfc->ofdev->dev), - flash_np); + mtd->name = devm_kasprintf(&ndfc->ofdev->dev, GFP_KERNEL, "%s.%pOFn", + dev_name(&ndfc->ofdev->dev), flash_np); if (!mtd->name) { ret = -ENOMEM; goto err; @@ -177,8 +177,6 @@ static int ndfc_chip_init(struct ndfc_controller *ndfc, err: of_node_put(flash_np); - if (ret) - kfree(mtd->name); return ret; } @@ -246,7 +244,6 @@ static void ndfc_remove(struct platform_device *ofdev) ret = mtd_device_unregister(mtd); WARN_ON(ret); nand_cleanup(chip); - kfree(mtd->name); } static const struct of_device_id ndfc_match[] = { From 44c7b273e6b06fad31f2ca166307a41705ef15dd Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Wed, 9 Sep 2026 15:38:13 -0700 Subject: [PATCH 17/38] mtd: rawnand: fsl_ifc: use devm_kasprintf for mtd name Replace the manual kasprintf() in probe with devm_kasprintf() so the name is freed automatically on driver removal, and drop the now unnecessary kfree() in fsl_ifc_chip_remove() and its leftover mtd local. Assisted-by: opencode:big-pickle Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/fsl_ifc_nand.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c index 315263c94497..be6bbc1c184d 100644 --- a/drivers/mtd/nand/raw/fsl_ifc_nand.c +++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c @@ -964,10 +964,6 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv) static int fsl_ifc_chip_remove(struct fsl_ifc_mtd *priv) { - struct mtd_info *mtd = nand_to_mtd(&priv->chip); - - kfree(mtd->name); - ifc_nand_ctrl->chips[priv->bank] = NULL; return 0; @@ -1064,7 +1060,7 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) &ifc->ifc_nand.nand_evter_intr_en); mtd = nand_to_mtd(&priv->chip); - mtd->name = kasprintf(GFP_KERNEL, "%llx.flash", (u64)res->start); + mtd->name = devm_kasprintf(priv->dev, GFP_KERNEL, "%llx.flash", (u64)res->start); if (!mtd->name) { ret = -ENOMEM; goto err; From 01947ecc37bdead7d2e1f199185b936820b90eda Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Nuno=20S=C3=A1?= Date: Wed, 23 Sep 2026 14:52:29 +0100 Subject: [PATCH 18/38] mtd: spinand: winbond: Add support for W25N08LW MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add support for the W25N08LW, a 1.8V 8Gbit SPI-NAND made of two 4Gbit LUNs, with 4096-byte pages and 256 bytes of spare area. The chip reuses the KV ECC status helper, but needs its own OOB layout because the geometry of its spare area differs from the existing Winbond parts. Only half of it is visible while the internal ECC is enabled, so the ECC region is reported as inaccessible and just the free bytes are exposed. Assisted-by: Claude:Opus-5 Signed-off-by: Nuno Sá Signed-off-by: Miquel Raynal --- drivers/mtd/nand/spi/winbond.c | 52 ++++++++++++++++++++++++++++++++++ 1 file changed, 52 insertions(+) diff --git a/drivers/mtd/nand/spi/winbond.c b/drivers/mtd/nand/spi/winbond.c index a1807fa9ae03..810975808c97 100644 --- a/drivers/mtd/nand/spi/winbond.c +++ b/drivers/mtd/nand/spi/winbond.c @@ -211,6 +211,13 @@ static SPINAND_OP_VARIANTS(read_cache_variants, SPINAND_PAGE_READ_FROM_CACHE_FAST_1S_1S_1S_OP(0, 1, NULL, 0, 0), SPINAND_PAGE_READ_FROM_CACHE_1S_1S_1S_OP(0, 1, NULL, 0, 0)); +static SPINAND_OP_VARIANTS(cont_read_cache_variants, + WINBOND_CONT_READ_FROM_CACHE_1S_4S_4S_OP(6, NULL, 0, 0), + WINBOND_CONT_READ_FROM_CACHE_1S_1S_4S_OP(4, NULL, 0, 0), + WINBOND_CONT_READ_FROM_CACHE_1S_2S_2S_OP(4, NULL, 0, 0), + WINBOND_CONT_READ_FROM_CACHE_1S_1S_2S_OP(4, NULL, 0, 0), + WINBOND_CONT_READ_FROM_CACHE_FAST_1S_1S_1S_OP(4, NULL, 0, 0)); + static SPINAND_OP_VARIANTS(write_cache_variants, SPINAND_PROG_LOAD_1S_1S_4S_OP(true, 0, NULL, 0), SPINAND_PROG_LOAD_1S_1S_1S_OP(true, 0, NULL, 0)); @@ -365,6 +372,39 @@ static const struct mtd_ooblayout_ops w25n02kv_ooblayout = { .free = w25n02kv_ooblayout_free, }; +static int w25n08lw_ooblayout_ecc(struct mtd_info *mtd, int section, + struct mtd_oob_region *region) +{ + /* + * With ecc enabled the parity bits are not accessible. So we can + * only see page + 128. Without ecc the full page + 256 is accessible. + * To make it simple just return the area as not accessible. + */ + return -ERANGE; +} + +static int w25n08lw_ooblayout_free(struct mtd_info *mtd, int section, + struct mtd_oob_region *region) +{ + if (section > 7) + return -ERANGE; + + /* + * Only expose the ECC protected "User Data I" bytes. The "User Data II" + * bytes at offset + 2 are not covered by the on-die ECC engine, and the + * first two bytes of the section hold the BBM. + */ + region->offset = (16 * section) + 4; + region->length = 12; + + return 0; +} + +static const struct mtd_ooblayout_ops w25n08lw_ooblayout = { + .ecc = w25n08lw_ooblayout_ecc, + .free = w25n08lw_ooblayout_free, +}; + static int w25n01jw_ooblayout_ecc(struct mtd_info *mtd, int section, struct mtd_oob_region *region) { @@ -810,6 +850,18 @@ static const struct spinand_info winbond_spinand_table[] = { SPINAND_ECCINFO(&w35n01jw_ooblayout, w25w35nxxjw_ecc_get_status), SPINAND_CONFIGURE_CHIP(w35n0xjw_vcr_cfg), SPINAND_CONT_READ(w35n0xjw_set_cont_read)), + /* 8G-bit densities */ + SPINAND_INFO("W25N08LW", /* 2x4G-bit 1.8V */ + SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xb3, 0x24), + NAND_MEMORG(1, 4096, 256, 64, 2048, 40, 1, 2, 1), + NAND_ECCREQ(8, 512), + SPINAND_INFO_OP_VARIANTS_WITH_CONT(&read_cache_variants, + &write_cache_variants, + &update_cache_variants, + &cont_read_cache_variants), + 0, + SPINAND_ECCINFO(&w25n08lw_ooblayout, w25n02kv_ecc_get_status), + SPINAND_CONT_READ(w25n0xjw_set_cont_read)), }; static int winbond_spinand_init(struct spinand_device *spinand) From 8a485a40f45a19c5fcafb5cbee7387c2762af7c4 Mon Sep 17 00:00:00 2001 From: Guangshuo Li Date: Wed, 16 Sep 2026 00:45:37 +0800 Subject: [PATCH 19/38] mtd: rawnand: nuvoton: fix clock cleanup on probe failure ma35_nand_probe() gets and enables the NAND clock with devm_clk_get_enabled(), but the ma35_nand_chips_init() failure path also calls clk_disable() before returning. devm_clk_get_enabled() registers a managed cleanup that calls clk_disable_unprepare() on probe failure and driver removal. Calling clk_disable() explicitly first drops the clock enable count, so the managed cleanup attempts to disable the clock again and triggers the clock framework warning for an already disabled clock. Remove the redundant clk_disable() and let the managed clock cleanup handle the clock state. This issue was found by manual code inspection. Fixes: 5abb5d414d55 ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c index 1a285cd8fad6..f659d3a6b9ef 100644 --- a/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c +++ b/drivers/mtd/nand/raw/nuvoton-ma35d1-nand-controller.c @@ -993,7 +993,6 @@ static int ma35_nand_probe(struct platform_device *pdev) ret = ma35_nand_chips_init(&pdev->dev, nand); if (ret) { dev_err(&pdev->dev, "failed to init NAND chips\n"); - clk_disable(nand->clk); return ret; } From 94edcda45d888c3bb1310de11e10e4537c166f00 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 10:29:24 +0000 Subject: [PATCH 20/38] mtd: rawnand: atmel: Fix MCK clock leak in atmel_nand_controller_init() atmel_nand_controller_init() takes a reference to the MCK clock with of_clk_get() and keeps it in nc->mck for the lifetime of the controller. If the "atmel,smc" phandle is missing or the SMC regmap cannot be obtained afterwards, the error path jumps to out_release_dma which only releases the DMA channel, so the clock reference is leaked. The callers return the error directly and never run atmel_nand_controller_cleanup(), where the clock is normally put. Release the reference on those error paths. The path on which of_clk_get() itself fails keeps jumping to out_release_dma, as nc->mck only holds an error pointer there. Fixes: f9ce2eddf176 ("mtd: nand: atmel: Add ->setup_data_interface() hooks") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/atmel/nand-controller.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/mtd/nand/raw/atmel/nand-controller.c b/drivers/mtd/nand/raw/atmel/nand-controller.c index 8a19408abb63..0bdbcbb50d94 100644 --- a/drivers/mtd/nand/raw/atmel/nand-controller.c +++ b/drivers/mtd/nand/raw/atmel/nand-controller.c @@ -2085,7 +2085,7 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, if (!np) { dev_err(dev, "Missing or invalid atmel,smc property\n"); ret = -EINVAL; - goto out_release_dma; + goto out_put_mck; } nc->smc = syscon_node_to_regmap(np); @@ -2093,11 +2093,13 @@ static int atmel_nand_controller_init(struct atmel_nand_controller *nc, if (IS_ERR(nc->smc)) { ret = PTR_ERR(nc->smc); dev_err(dev, "Could not get SMC regmap (err = %d)\n", ret); - goto out_release_dma; + goto out_put_mck; } return 0; +out_put_mck: + clk_put(nc->mck); out_release_dma: if (nc->dmac) dma_release_channel(nc->dmac); From e97c701c09d3d8f23397f68478c7e2c7eaf87528 Mon Sep 17 00:00:00 2001 From: Peter-Simon Dieterich Date: Thu, 17 Sep 2026 15:00:42 +0200 Subject: [PATCH 21/38] mtd: rawnand: esmt: Disable broken timings feature on GD9FU2G8F3A GigaDevice and ESMT share JEDEC manufacturer ID 0xc8, so GigaDevice raw NAND chips are handled by the ESMT manufacturer code. The GD9FU2G8F3A advertises SET/GET_FEATURES support in its parameter page, but its implementation of the timing mode feature is broken: GET_FEATURES(TIMING_MODE) reads back a value that does not match the mode previously written, which causes the following error during boot: nand: timing mode 5 not acknowledged by the NAND chip and falls back to timing mode 0. GigaDevice confirmed that the chip is compatible with all timing modes advertised in its parameter page, that SET_FEATURE(TIMING_MODE) is not required to enter them, and that it may be ignored by the chip. The timing mode is therefore a host-side concern only, and the readback value carries no information. Unflag the feature for this model so the core configures the controller and skips both the SET and GET, mirroring what nand_macronix.c does for the MX30LF AC series. Tested on a custom board with an imx6ull using gpmi-nand, this restores timing mode 5 operation and sequential reads improve from 7 MiB/s to 20 MiB/s. Signed-off-by: Peter-Simon Dieterich Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/nand_esmt.c | 34 ++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) diff --git a/drivers/mtd/nand/raw/nand_esmt.c b/drivers/mtd/nand/raw/nand_esmt.c index 4412c407aef3..117b110fc54a 100644 --- a/drivers/mtd/nand/raw/nand_esmt.c +++ b/drivers/mtd/nand/raw/nand_esmt.c @@ -3,6 +3,9 @@ * Copyright (C) 2018 Toradex AG * * Author: Marcel Ziswiler + * + * ESMT and GigaDevice share the same JEDEC manufacturer ID (0xc8), so this + * file handles chips from both vendors. */ #include @@ -38,6 +41,35 @@ static void esmt_nand_decode_id(struct nand_chip *chip) nanddev_set_ecc_requirements(base, &requirements); } +/* + * GigaDevice GD9FU2G8F3A does not implement the timing mode feature: + * GET_FEATURES does not report the mode that was written, and + * SET_FEATURES is ignored, even though the parameter page advertises + * support. The vendor confirmed the chip works at every advertised + * timing mode without being told, so unflag the feature and configure + * the host side only. + */ +static void esmt_nand_fix_broken_get_timings(struct nand_chip *chip) +{ + int i; + static const char * const broken_get_timings[] = { + "GD9FU2G8F3A", + }; + + if (!chip->parameters.supports_set_get_features) + return; + + i = match_string(broken_get_timings, ARRAY_SIZE(broken_get_timings), + chip->parameters.model); + if (i < 0) + return; + + bitmap_clear(chip->parameters.get_feature_list, + ONFI_FEATURE_ADDR_TIMING_MODE, 1); + bitmap_clear(chip->parameters.set_feature_list, + ONFI_FEATURE_ADDR_TIMING_MODE, 1); +} + static int esmt_nand_init(struct nand_chip *chip) { if (nand_is_slc(chip)) @@ -50,6 +82,8 @@ static int esmt_nand_init(struct nand_chip *chip) chip->options |= NAND_BBM_FIRSTPAGE | NAND_BBM_SECONDPAGE | NAND_BBM_LASTPAGE; + esmt_nand_fix_broken_get_timings(chip); + return 0; } From c62b598ac7f650c963ca00a19f161e99e899498e Mon Sep 17 00:00:00 2001 From: Peter-Simon Dieterich Date: Thu, 17 Sep 2026 15:00:43 +0200 Subject: [PATCH 22/38] mtd: rawnand: Reflect that ESMT and GigaDevice share ID 0xc8 JEDEC manufacturer ID 0xc8 is used by both ESMT and GigaDevice, so nand_esmt.c handles chips from both vendors. Chips from either vendor are currently reported as "ESMT", which is misleading when debugging a GigaDevice part. Rename the manufacturer entry to "ESMT/GigaDevice" and document the collision next to the NAND_MFR_ESMT definition. The only behavioural change is the manufacturer name printed at detection time. Signed-off-by: Peter-Simon Dieterich Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/internals.h | 1 + drivers/mtd/nand/raw/nand_ids.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/mtd/nand/raw/internals.h b/drivers/mtd/nand/raw/internals.h index b7162ced9efa..b8b29341b88c 100644 --- a/drivers/mtd/nand/raw/internals.h +++ b/drivers/mtd/nand/raw/internals.h @@ -19,6 +19,7 @@ #define NAND_MFR_AMD 0x01 #define NAND_MFR_ATO 0x9b #define NAND_MFR_EON 0x92 +/* ESMT and GigaDevice share the same manufacturer ID. */ #define NAND_MFR_ESMT 0xc8 #define NAND_MFR_FUJITSU 0x04 #define NAND_MFR_HYNIX 0xad diff --git a/drivers/mtd/nand/raw/nand_ids.c b/drivers/mtd/nand/raw/nand_ids.c index 08707ce9d7c0..9b2dd246398f 100644 --- a/drivers/mtd/nand/raw/nand_ids.c +++ b/drivers/mtd/nand/raw/nand_ids.c @@ -185,7 +185,7 @@ static const struct nand_manufacturer_desc nand_manufacturer_descs[] = { {NAND_MFR_AMD, "AMD/Spansion", &amd_nand_manuf_ops}, {NAND_MFR_ATO, "ATO"}, {NAND_MFR_EON, "Eon"}, - {NAND_MFR_ESMT, "ESMT", &esmt_nand_manuf_ops}, + {NAND_MFR_ESMT, "ESMT/GigaDevice", &esmt_nand_manuf_ops}, {NAND_MFR_FUJITSU, "Fujitsu"}, {NAND_MFR_HYNIX, "Hynix", &hynix_nand_manuf_ops}, {NAND_MFR_INTEL, "Intel"}, From 55c5b6d5f59f59a8c98a7effc3195226cc20175c Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Sun, 20 Sep 2026 22:16:18 +0200 Subject: [PATCH 23/38] mtd: nand: qpic_common: drop stray empty line from struct 'bam_transaction' Drop a superfluous empty line from the end of the 'bam_positions' structure group within the 'bam_transaction' structure. No functional changes. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- include/linux/mtd/nand-qpic-common.h | 1 - 1 file changed, 1 deletion(-) diff --git a/include/linux/mtd/nand-qpic-common.h b/include/linux/mtd/nand-qpic-common.h index 437448995187..0f40964eefe7 100644 --- a/include/linux/mtd/nand-qpic-common.h +++ b/include/linux/mtd/nand-qpic-common.h @@ -262,7 +262,6 @@ struct bam_transaction { u32 tx_sgl_start; u32 rx_sgl_pos; u32 rx_sgl_start; - ); }; From 8e301fd598806b9480b00a2c16314140de7c4db6 Mon Sep 17 00:00:00 2001 From: "Rob Herring (Arm)" Date: Fri, 25 Sep 2026 11:30:44 -0500 Subject: [PATCH 24/38] dt-bindings: mtd: arasan: Add "power-domains" for ZynqMP ZynqMP NAND controller nodes use "power-domains" property already, so add it to the schema. As ZynqMP is the only supported platform currently, no need for a conditional schema. Assisted-by: LLM Signed-off-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal --- .../devicetree/bindings/mtd/arasan,nand-controller.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/Documentation/devicetree/bindings/mtd/arasan,nand-controller.yaml b/Documentation/devicetree/bindings/mtd/arasan,nand-controller.yaml index b90d3b48c2f2..7154245b00e3 100644 --- a/Documentation/devicetree/bindings/mtd/arasan,nand-controller.yaml +++ b/Documentation/devicetree/bindings/mtd/arasan,nand-controller.yaml @@ -35,6 +35,9 @@ properties: interrupts: maxItems: 1 + power-domains: + maxItems: 1 + required: - compatible - reg From 19961db84d806c8a7f6cbe457e752ae62bf65ee4 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:10 +0200 Subject: [PATCH 25/38] mtd: rawnand: qcom: make check_flash_errors() more generic The function gets a 'qcom_nand_host' pointer as a parameter but it is only used to extract the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index d7642db2e2df..12bfb14cd9a3 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -449,10 +449,9 @@ struct read_stats { }; /* reads back FLASH_STATUS register set by the controller */ -static int check_flash_errors(struct qcom_nand_host *host, int cw_cnt) +static int qcom_nandc_check_flash_errors(struct qcom_nand_controller *nandc, + int cw_cnt) { - struct nand_chip *chip = &host->chip; - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); int i; qcom_nandc_dev_to_mem(nandc, true); @@ -538,7 +537,7 @@ qcom_nandc_read_cw_raw(struct mtd_info *mtd, struct nand_chip *chip, return ret; } - return check_flash_errors(host, 1); + return qcom_nandc_check_flash_errors(nandc, 1); } /* @@ -1181,7 +1180,7 @@ static int qcom_nandc_block_bad(struct nand_chip *chip, loff_t ofs) if (ret) goto err; - if (check_flash_errors(host, 1)) { + if (qcom_nandc_check_flash_errors(nandc, 1)) { dev_warn(nandc->dev, "error when trying to read BBM\n"); goto err; } From 5c80d1392cb6d3f8f78c3c8e6b80c884d07e47db Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:11 +0200 Subject: [PATCH 26/38] mtd: rawnand: qcom: make config_nand_page_read() more generic The function gets a 'nand_chip' pointer as a parameter but it is only used to extract a pointer to the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes intended. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index 12bfb14cd9a3..c65a8416c3f5 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -305,10 +305,8 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read, i * Helper to prepare DMA descriptors for configuring registers * before reading a NAND page. */ -static void config_nand_page_read(struct nand_chip *chip) +static void qcom_nandc_config_page_read(struct qcom_nand_controller *nandc) { - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); - qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); if (!nandc->props->qpic_version2) @@ -357,7 +355,9 @@ static void config_nand_single_cw_page_read(struct nand_chip *chip, bool use_ecc, int cw) { - config_nand_page_read(chip); + struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); + + qcom_nandc_config_page_read(nandc); config_nand_cw_read(chip, use_ecc, cw); } @@ -490,7 +490,7 @@ qcom_nandc_read_cw_raw(struct mtd_info *mtd, struct nand_chip *chip, qcom_clear_bam_transaction(nandc); set_address(host, host->cw_size * cw, page); update_rw_regs(host, 1, true, raw_cw); - config_nand_page_read(chip); + qcom_nandc_config_page_read(nandc); data_size1 = mtd->writesize - host->cw_size * (ecc->steps - 1); oob_size1 = host->bbm_size; @@ -727,7 +727,7 @@ static int read_page_ecc(struct qcom_nand_host *host, u8 *data_buf, u8 *data_buf_start = data_buf, *oob_buf_start = oob_buf; int i, ret; - config_nand_page_read(chip); + qcom_nandc_config_page_read(nandc); /* queue cmd descs for each codeword */ for (i = 0; i < ecc->steps; i++) { From ee88ebffcd2abf7730e2e9ff638de5c04f3d19c6 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:12 +0200 Subject: [PATCH 27/38] mtd: rawnand: qcom: make config_nand_page_write() more generic The function gets a 'nand_chip' pointer as a parameter but it is only used to extract a pointer to the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes intended. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index c65a8416c3f5..1f3c00823309 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -365,10 +365,8 @@ config_nand_single_cw_page_read(struct nand_chip *chip, * Helper to prepare DMA descriptors used to configure registers needed for * before writing a NAND page. */ -static void config_nand_page_write(struct nand_chip *chip) +static void qcom_nandc_config_page_write(struct qcom_nand_controller *nandc) { - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); - qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); if (!nandc->props->qpic_version2) @@ -989,7 +987,7 @@ static int qcom_nandc_write_page(struct nand_chip *chip, const u8 *buf, host->use_ecc = true; update_rw_regs(host, ecc->steps, false, 0); - config_nand_page_write(chip); + qcom_nandc_config_page_write(nandc); for (i = 0; i < ecc->steps; i++) { int data_size, oob_size; @@ -1059,7 +1057,7 @@ static int qcom_nandc_write_page_raw(struct nand_chip *chip, host->use_ecc = false; update_rw_regs(host, ecc->steps, false, 0); - config_nand_page_write(chip); + qcom_nandc_config_page_write(nandc); for (i = 0; i < ecc->steps; i++) { int data_size1, data_size2, oob_size1, oob_size2; @@ -1143,7 +1141,7 @@ static int qcom_nandc_write_oob(struct nand_chip *chip, int page) set_address(host, host->cw_size * (ecc->steps - 1), page); update_rw_regs(host, 1, false, 0); - config_nand_page_write(chip); + qcom_nandc_config_page_write(nandc); qcom_write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, data_size + oob_size, 0); config_nand_cw_write(chip); @@ -1219,7 +1217,7 @@ static int qcom_nandc_block_markbad(struct nand_chip *chip, loff_t ofs) set_address(host, host->cw_size * (ecc->steps - 1), page); update_rw_regs(host, 1, false, ecc->steps - 1); - config_nand_page_write(chip); + qcom_nandc_config_page_write(nandc); qcom_write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, host->cw_size, 0); config_nand_cw_write(chip); From e4ff0d7c53a981690ae31d49f59efcbfeeef395f Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:13 +0200 Subject: [PATCH 28/38] mtd: rawnand: qcom: make config_nand_cw_write() more generic The function gets a 'nand_chip' pointer as a parameter but it is only used to extract a pointer to the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes intended. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index 1f3c00823309..99fbf5458083 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -378,10 +378,8 @@ static void qcom_nandc_config_page_write(struct qcom_nand_controller *nandc) * Helper to prepare DMA descriptors for configuring registers * before writing each codeword in NAND page. */ -static void config_nand_cw_write(struct nand_chip *chip) +static void qcom_nandc_config_cw_write(struct qcom_nand_controller *nandc) { - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); - qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL); qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL); @@ -1018,7 +1016,7 @@ static int qcom_nandc_write_page(struct nand_chip *chip, const u8 *buf, oob_buf, oob_size, 0); } - config_nand_cw_write(chip); + qcom_nandc_config_cw_write(nandc); data_buf += data_size; oob_buf += oob_size; @@ -1094,7 +1092,7 @@ static int qcom_nandc_write_page_raw(struct nand_chip *chip, qcom_write_data_dma(nandc, reg_off, oob_buf, oob_size2, 0); oob_buf += oob_size2; - config_nand_cw_write(chip); + qcom_nandc_config_cw_write(nandc); } ret = qcom_submit_descs(nandc); @@ -1144,7 +1142,7 @@ static int qcom_nandc_write_oob(struct nand_chip *chip, int page) qcom_nandc_config_page_write(nandc); qcom_write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, data_size + oob_size, 0); - config_nand_cw_write(chip); + qcom_nandc_config_cw_write(nandc); ret = qcom_submit_descs(nandc); if (ret) { @@ -1220,7 +1218,7 @@ static int qcom_nandc_block_markbad(struct nand_chip *chip, loff_t ofs) qcom_nandc_config_page_write(nandc); qcom_write_data_dma(nandc, FLASH_BUF_ACC, nandc->data_buffer, host->cw_size, 0); - config_nand_cw_write(chip); + qcom_nandc_config_cw_write(nandc); ret = qcom_submit_descs(nandc); if (ret) { From 137b9f25879245ad9825dbb6dff548b124b18b98 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:14 +0200 Subject: [PATCH 29/38] mtd: rawnand: qcom: make nandc_set_read_loc_first() more generic The function gets a 'nand_chip' pointer as a parameter but it is only used to extract a pointer to the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes intended. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index 99fbf5458083..96a1a5a03de8 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -150,8 +150,8 @@ static bool qcom_nandc_is_last_cw(struct nand_ecc_ctrl *ecc, int cw) } /** - * nandc_set_read_loc_first() - to set read location first register - * @chip: NAND Private Flash Chip Data + * qcom_nandc_set_read_loc_first() - to set read location first register + * @nandc: NAND controller's private data * @reg_base: location register base * @cw_offset: code word offset * @read_size: code word read length @@ -159,11 +159,10 @@ static bool qcom_nandc_is_last_cw(struct nand_ecc_ctrl *ecc, int cw) * * This function will set location register value */ -static void nandc_set_read_loc_first(struct nand_chip *chip, - int reg_base, u32 cw_offset, - u32 read_size, u32 is_last_read_loc) +static void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc) { - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); __le32 locreg_val; u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | @@ -230,8 +229,9 @@ static void nandc_set_read_loc(struct nand_chip *chip, int cw, int reg, return nandc_set_read_loc_last(chip, reg_base, cw_offset, read_size, is_last_read_loc); else - return nandc_set_read_loc_first(chip, reg_base, cw_offset, - read_size, is_last_read_loc); + return qcom_nandc_set_read_loc_first(nandc, reg_base, cw_offset, + read_size, + is_last_read_loc); } /* helper to configure address register values */ @@ -1918,7 +1918,7 @@ static int qcom_param_page_type_exec(struct nand_chip *chip, const struct nand_ if (nandc->props->qpic_version2) nandc_set_read_loc_last(chip, reg_base, 0, len, 1); else - nandc_set_read_loc_first(chip, reg_base, 0, len, 1); + qcom_nandc_set_read_loc_first(nandc, reg_base, 0, len, 1); if (!nandc->props->has_onfi_read_op) { qcom_write_reg_dma(nandc, &nandc->regs->vld, NAND_DEV_CMD_VLD, 1, 0); From cd93990ef5d5262e50b2a0d306a49e1a21019ac5 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:15 +0200 Subject: [PATCH 30/38] mtd: rawnand: qcom: make nandc_set_read_loc_last() more generic The function gets a 'nand_chip' pointer as a parameter but it is only used to extract a pointer to the nand controller's private structure from that. In order to make the function more generic, change the declaration to get a 'qcom_nandc_controller' pointer directly, and update the callers accordingly. While at it, also change the function name to use a 'qcom_nandc' prefix. No functional changes intended. This is in preparation of moving the function into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index 96a1a5a03de8..cc1e64ac4245 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -181,8 +181,8 @@ static void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, } /** - * nandc_set_read_loc_last - to set read location last register - * @chip: NAND Private Flash Chip Data + * qcom_nandc_set_read_loc_last - to set read location last register + * @nandc: NAND controller's private data * @reg_base: location register base * @cw_offset: code word offset * @read_size: code word read length @@ -190,11 +190,10 @@ static void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, * * This function will set location last register value */ -static void nandc_set_read_loc_last(struct nand_chip *chip, - int reg_base, u32 cw_offset, - u32 read_size, u32 is_last_read_loc) +static void qcom_nandc_set_read_loc_last(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc) { - struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); __le32 locreg_val; u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | @@ -226,8 +225,9 @@ static void nandc_set_read_loc(struct nand_chip *chip, int cw, int reg, reg_base += reg * 4; if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) - return nandc_set_read_loc_last(chip, reg_base, cw_offset, - read_size, is_last_read_loc); + return qcom_nandc_set_read_loc_last(nandc, reg_base, cw_offset, + read_size, + is_last_read_loc); else return qcom_nandc_set_read_loc_first(nandc, reg_base, cw_offset, read_size, @@ -1916,7 +1916,7 @@ static int qcom_param_page_type_exec(struct nand_chip *chip, const struct nand_ len = nand_subop_get_data_len(subop, op_id); if (nandc->props->qpic_version2) - nandc_set_read_loc_last(chip, reg_base, 0, len, 1); + qcom_nandc_set_read_loc_last(nandc, reg_base, 0, len, 1); else qcom_nandc_set_read_loc_first(nandc, reg_base, 0, len, 1); From 555d48e52026f3e60f0b9acd1ee08c106d442a02 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:16 +0200 Subject: [PATCH 31/38] mtd: rawnand: qcom: rename 'nand_stats' structure Give 'read_stats' structure a 'qcom_nandc' prefix to indicate that it corresponds to the Qualcomm NAND driver. The definition is going to be moved into a common header this helps to avoid global namespace pollution/collision. No functional changes. This is in preparation of moving the declaration into the 'nand-qpic-common.h' header to allow reusing it from the 'spi-qpic-snand' driver. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index cc1e64ac4245..99fe2c434ce7 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -438,7 +438,7 @@ static bool erased_chunk_check_and_fixup(u8 *data_buf, int data_len) return true; } -struct read_stats { +struct qcom_nandc_read_stats { __le32 flash; __le32 buffer; __le32 erased_cw; @@ -619,12 +619,12 @@ static int parse_read_errors(struct qcom_nand_host *host, u8 *data_buf, struct mtd_info *mtd = nand_to_mtd(chip); struct nand_ecc_ctrl *ecc = &chip->ecc; unsigned int max_bitflips = 0, uncorrectable_cws = 0; - struct read_stats *buf; + struct qcom_nandc_read_stats *buf; bool flash_op_err = false, erased; int i; u8 *data_buf_start = data_buf, *oob_buf_start = oob_buf; - buf = (struct read_stats *)nandc->reg_read_buf; + buf = (struct qcom_nandc_read_stats *)nandc->reg_read_buf; qcom_nandc_dev_to_mem(nandc, true); for (i = 0; i < ecc->steps; i++, buf++) { From cfae2182fa7b0f0e3caee02fa6acf5dc77410efc Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Fri, 25 Sep 2026 21:06:17 +0200 Subject: [PATCH 32/38] mtd: rawnand: qcom: move common code to the 'qpic_common' module The 'qpic_common' module provides some generic functions which are usable by both the 'qcom_nandc' and by the 'spi-qpic-snand' driver. Move more code from the 'qcom_nandc' driver to there in order to allow using those also from the 'spi-qpic-snand' driver. No functional changes. Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/qpic_common.c | 131 +++++++++++++++++++++++++++ drivers/mtd/nand/raw/qcom_nandc.c | 131 --------------------------- include/linux/mtd/nand-qpic-common.h | 17 ++++ 3 files changed, 148 insertions(+), 131 deletions(-) diff --git a/drivers/mtd/nand/qpic_common.c b/drivers/mtd/nand/qpic_common.c index 4f3e4dd766da..91ae970734f8 100644 --- a/drivers/mtd/nand/qpic_common.c +++ b/drivers/mtd/nand/qpic_common.c @@ -775,5 +775,136 @@ int qcom_nandc_alloc(struct qcom_nand_controller *nandc) } EXPORT_SYMBOL(qcom_nandc_alloc); +/* reads back FLASH_STATUS register set by the controller */ +int qcom_nandc_check_flash_errors(struct qcom_nand_controller *nandc, + int cw_cnt) +{ + int i; + + qcom_nandc_dev_to_mem(nandc, true); + + for (i = 0; i < cw_cnt; i++) { + u32 flash = le32_to_cpu(nandc->reg_read_buf[i]); + + if (flash & (FS_OP_ERR | FS_MPU_ERR)) + return -EIO; + } + + return 0; +} +EXPORT_SYMBOL(qcom_nandc_check_flash_errors); + +/* + * Helper to prepare DMA descriptors for configuring registers + * before reading a NAND page. + */ +void qcom_nandc_config_page_read(struct qcom_nand_controller *nandc) +{ + qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); + qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); + if (!nandc->props->qpic_version2) + qcom_write_reg_dma(nandc, &nandc->regs->ecc_buf_cfg, NAND_EBI2_ECC_BUF_CFG, 1, 0); + qcom_write_reg_dma(nandc, &nandc->regs->erased_cw_detect_cfg_clr, + NAND_ERASED_CW_DETECT_CFG, 1, 0); + qcom_write_reg_dma(nandc, &nandc->regs->erased_cw_detect_cfg_set, + NAND_ERASED_CW_DETECT_CFG, 1, NAND_ERASED_CW_SET | NAND_BAM_NEXT_SGL); +} +EXPORT_SYMBOL(qcom_nandc_config_page_read); + +/* + * Helper to prepare DMA descriptors used to configure registers needed for + * before writing a NAND page. + */ +void qcom_nandc_config_page_write(struct qcom_nand_controller *nandc) +{ + qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); + qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); + if (!nandc->props->qpic_version2) + qcom_write_reg_dma(nandc, &nandc->regs->ecc_buf_cfg, NAND_EBI2_ECC_BUF_CFG, 1, + NAND_BAM_NEXT_SGL); +} +EXPORT_SYMBOL(qcom_nandc_config_page_write); + +/* + * Helper to prepare DMA descriptors for configuring registers + * before writing each codeword in NAND page. + */ +void qcom_nandc_config_cw_write(struct qcom_nand_controller *nandc) +{ + qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL); + qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL); + + qcom_read_reg_dma(nandc, NAND_FLASH_STATUS, 1, NAND_BAM_NEXT_SGL); + + qcom_write_reg_dma(nandc, &nandc->regs->clrflashstatus, NAND_FLASH_STATUS, 1, 0); + qcom_write_reg_dma(nandc, &nandc->regs->clrreadstatus, NAND_READ_STATUS, 1, + NAND_BAM_NEXT_SGL); +} +EXPORT_SYMBOL(qcom_nandc_config_cw_write); + +/** + * qcom_nandc_set_read_loc_first() - to set read location first register + * @nandc: NAND controller's private data + * @reg_base: location register base + * @cw_offset: code word offset + * @read_size: code word read length + * @is_last_read_loc: is this the last read location + * + * This function will set location register value + */ +void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc) +{ + __le32 locreg_val; + u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | + FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | + FIELD_PREP(READ_LOCATION_LAST_MASK, is_last_read_loc); + + locreg_val = cpu_to_le32(val); + + if (reg_base == NAND_READ_LOCATION_0) + nandc->regs->read_location0 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_1) + nandc->regs->read_location1 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_2) + nandc->regs->read_location2 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_3) + nandc->regs->read_location3 = locreg_val; +} +EXPORT_SYMBOL(qcom_nandc_set_read_loc_first); + +/** + * qcom_nandc_set_read_loc_last - to set read location last register + * @nandc: NAND controller's private data + * @reg_base: location register base + * @cw_offset: code word offset + * @read_size: code word read length + * @is_last_read_loc: is this the last read location + * + * This function will set location last register value + */ +void qcom_nandc_set_read_loc_last(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc) +{ + __le32 locreg_val; + u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | + FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | + FIELD_PREP(READ_LOCATION_LAST_MASK, is_last_read_loc); + + locreg_val = cpu_to_le32(val); + + if (reg_base == NAND_READ_LOCATION_LAST_CW_0) + nandc->regs->read_location_last0 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_LAST_CW_1) + nandc->regs->read_location_last1 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_LAST_CW_2) + nandc->regs->read_location_last2 = locreg_val; + else if (reg_base == NAND_READ_LOCATION_LAST_CW_3) + nandc->regs->read_location_last3 = locreg_val; +} +EXPORT_SYMBOL(qcom_nandc_set_read_loc_last); + MODULE_DESCRIPTION("QPIC controller common api"); MODULE_LICENSE("GPL"); diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index 99fe2c434ce7..d65c0101f471 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -149,68 +149,6 @@ static bool qcom_nandc_is_last_cw(struct nand_ecc_ctrl *ecc, int cw) return cw == (ecc->steps - 1); } -/** - * qcom_nandc_set_read_loc_first() - to set read location first register - * @nandc: NAND controller's private data - * @reg_base: location register base - * @cw_offset: code word offset - * @read_size: code word read length - * @is_last_read_loc: is this the last read location - * - * This function will set location register value - */ -static void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, - int reg_base, u32 cw_offset, - u32 read_size, u32 is_last_read_loc) -{ - __le32 locreg_val; - u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | - FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | - FIELD_PREP(READ_LOCATION_LAST_MASK, is_last_read_loc); - - locreg_val = cpu_to_le32(val); - - if (reg_base == NAND_READ_LOCATION_0) - nandc->regs->read_location0 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_1) - nandc->regs->read_location1 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_2) - nandc->regs->read_location2 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_3) - nandc->regs->read_location3 = locreg_val; -} - -/** - * qcom_nandc_set_read_loc_last - to set read location last register - * @nandc: NAND controller's private data - * @reg_base: location register base - * @cw_offset: code word offset - * @read_size: code word read length - * @is_last_read_loc: is this the last read location - * - * This function will set location last register value - */ -static void qcom_nandc_set_read_loc_last(struct qcom_nand_controller *nandc, - int reg_base, u32 cw_offset, - u32 read_size, u32 is_last_read_loc) -{ - __le32 locreg_val; - u32 val = FIELD_PREP(READ_LOCATION_OFFSET_MASK, cw_offset) | - FIELD_PREP(READ_LOCATION_SIZE_MASK, read_size) | - FIELD_PREP(READ_LOCATION_LAST_MASK, is_last_read_loc); - - locreg_val = cpu_to_le32(val); - - if (reg_base == NAND_READ_LOCATION_LAST_CW_0) - nandc->regs->read_location_last0 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_LAST_CW_1) - nandc->regs->read_location_last1 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_LAST_CW_2) - nandc->regs->read_location_last2 = locreg_val; - else if (reg_base == NAND_READ_LOCATION_LAST_CW_3) - nandc->regs->read_location_last3 = locreg_val; -} - /* helper to configure location register values */ static void nandc_set_read_loc(struct nand_chip *chip, int cw, int reg, u32 cw_offset, u32 read_size, u32 is_last_read_loc) @@ -301,22 +239,6 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read, i host->cw_data : host->cw_size, 1); } -/* - * Helper to prepare DMA descriptors for configuring registers - * before reading a NAND page. - */ -static void qcom_nandc_config_page_read(struct qcom_nand_controller *nandc) -{ - qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); - qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); - if (!nandc->props->qpic_version2) - qcom_write_reg_dma(nandc, &nandc->regs->ecc_buf_cfg, NAND_EBI2_ECC_BUF_CFG, 1, 0); - qcom_write_reg_dma(nandc, &nandc->regs->erased_cw_detect_cfg_clr, - NAND_ERASED_CW_DETECT_CFG, 1, 0); - qcom_write_reg_dma(nandc, &nandc->regs->erased_cw_detect_cfg_set, - NAND_ERASED_CW_DETECT_CFG, 1, NAND_ERASED_CW_SET | NAND_BAM_NEXT_SGL); -} - /* * Helper to prepare DMA descriptors for configuring registers * before reading each codeword in NAND page. @@ -361,35 +283,6 @@ config_nand_single_cw_page_read(struct nand_chip *chip, config_nand_cw_read(chip, use_ecc, cw); } -/* - * Helper to prepare DMA descriptors used to configure registers needed for - * before writing a NAND page. - */ -static void qcom_nandc_config_page_write(struct qcom_nand_controller *nandc) -{ - qcom_write_reg_dma(nandc, &nandc->regs->addr0, NAND_ADDR0, 2, 0); - qcom_write_reg_dma(nandc, &nandc->regs->cfg0, NAND_DEV0_CFG0, 3, 0); - if (!nandc->props->qpic_version2) - qcom_write_reg_dma(nandc, &nandc->regs->ecc_buf_cfg, NAND_EBI2_ECC_BUF_CFG, 1, - NAND_BAM_NEXT_SGL); -} - -/* - * Helper to prepare DMA descriptors for configuring registers - * before writing each codeword in NAND page. - */ -static void qcom_nandc_config_cw_write(struct qcom_nand_controller *nandc) -{ - qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL); - qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL); - - qcom_read_reg_dma(nandc, NAND_FLASH_STATUS, 1, NAND_BAM_NEXT_SGL); - - qcom_write_reg_dma(nandc, &nandc->regs->clrflashstatus, NAND_FLASH_STATUS, 1, 0); - qcom_write_reg_dma(nandc, &nandc->regs->clrreadstatus, NAND_READ_STATUS, 1, - NAND_BAM_NEXT_SGL); -} - /* * when using BCH ECC, the HW flags an error in NAND_FLASH_STATUS if it read * an erased CW, and reports an erased CW in NAND_ERASED_CW_DETECT_STATUS. @@ -438,30 +331,6 @@ static bool erased_chunk_check_and_fixup(u8 *data_buf, int data_len) return true; } -struct qcom_nandc_read_stats { - __le32 flash; - __le32 buffer; - __le32 erased_cw; -}; - -/* reads back FLASH_STATUS register set by the controller */ -static int qcom_nandc_check_flash_errors(struct qcom_nand_controller *nandc, - int cw_cnt) -{ - int i; - - qcom_nandc_dev_to_mem(nandc, true); - - for (i = 0; i < cw_cnt; i++) { - u32 flash = le32_to_cpu(nandc->reg_read_buf[i]); - - if (flash & (FS_OP_ERR | FS_MPU_ERR)) - return -EIO; - } - - return 0; -} - /* performs raw read for one codeword */ static int qcom_nandc_read_cw_raw(struct mtd_info *mtd, struct nand_chip *chip, diff --git a/include/linux/mtd/nand-qpic-common.h b/include/linux/mtd/nand-qpic-common.h index 0f40964eefe7..f31fd18d837f 100644 --- a/include/linux/mtd/nand-qpic-common.h +++ b/include/linux/mtd/nand-qpic-common.h @@ -457,6 +457,12 @@ struct qcom_nandc_props { bool use_codeword_fixup; }; +struct qcom_nandc_read_stats { + __le32 flash; + __le32 buffer; + __le32 erased_cw; +}; + void qcom_free_bam_transaction(struct qcom_nand_controller *nandc); struct bam_transaction *qcom_alloc_bam_transaction(struct qcom_nand_controller *nandc); void qcom_clear_bam_transaction(struct qcom_nand_controller *nandc); @@ -482,5 +488,16 @@ int qcom_submit_descs(struct qcom_nand_controller *nandc); void qcom_clear_read_regs(struct qcom_nand_controller *nandc); void qcom_nandc_unalloc(struct qcom_nand_controller *nandc); int qcom_nandc_alloc(struct qcom_nand_controller *nandc); +int qcom_nandc_check_flash_errors(struct qcom_nand_controller *nandc, + int cw_cnt); +void qcom_nandc_config_page_read(struct qcom_nand_controller *nandc); +void qcom_nandc_config_page_write(struct qcom_nand_controller *nandc); +void qcom_nandc_config_cw_write(struct qcom_nand_controller *nandc); +void qcom_nandc_set_read_loc_first(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc); +void qcom_nandc_set_read_loc_last(struct qcom_nand_controller *nandc, + int reg_base, u32 cw_offset, + u32 read_size, u32 is_last_read_loc); #endif From 94623942a66e031826756f9c92dbde9a12e2b4d2 Mon Sep 17 00:00:00 2001 From: Gabor Juhos Date: Mon, 28 Sep 2026 09:01:53 +0200 Subject: [PATCH 33/38] mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read() On QPIC v2 controllers, when the last codeword is being read, the read location values must be programmed into the READ_LOCATION_LAST_CW_* registers. Prior to commit 8c52932da5e6 ("mtd: rawnand: qcom: cleanup qcom_nandc driver"), the config_nand_cw_read() function did it right, but since then it always writes the read location values to the READ_LOCATION_* registers even if the actual codeword is the last one. Change the function to always configure the registers corresponding to the actual codeword to restore the correct behaviour. Cc: stable@vger.kernel.org Fixes: 8c52932da5e6 ("mtd: rawnand: qcom: cleanup qcom_nandc driver") Signed-off-by: Gabor Juhos Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/qcom_nandc.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/mtd/nand/raw/qcom_nandc.c b/drivers/mtd/nand/raw/qcom_nandc.c index d65c0101f471..2d98f79b492d 100644 --- a/drivers/mtd/nand/raw/qcom_nandc.c +++ b/drivers/mtd/nand/raw/qcom_nandc.c @@ -248,14 +248,16 @@ config_nand_cw_read(struct nand_chip *chip, bool use_ecc, int cw) { struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); struct nand_ecc_ctrl *ecc = &chip->ecc; - __le32 *reg = &nandc->regs->read_location0; + int reg_base = NAND_READ_LOCATION_0; - if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) + if (nandc->props->qpic_version2 && qcom_nandc_is_last_cw(ecc, cw)) { reg = &nandc->regs->read_location_last0; + reg_base = NAND_READ_LOCATION_LAST_CW_0; + } if (nandc->props->supports_bam) - qcom_write_reg_dma(nandc, reg, NAND_READ_LOCATION_0, 4, NAND_BAM_NEXT_SGL); + qcom_write_reg_dma(nandc, reg, reg_base, 4, NAND_BAM_NEXT_SGL); qcom_write_reg_dma(nandc, &nandc->regs->cmd, NAND_FLASH_CMD, 1, NAND_BAM_NEXT_SGL); qcom_write_reg_dma(nandc, &nandc->regs->exec, NAND_EXEC_CMD, 1, NAND_BAM_NEXT_SGL); From 104f277e8a469f71ac3c74a0e9ebb8bf64c3fa06 Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Mon, 28 Sep 2026 13:07:29 -0700 Subject: [PATCH 34/38] mtd: rawnand: fsl_ifc: allocate shared ctrl with devm_kzalloc Allocate the shared fsl_ifc_nand_ctrl structure against the controller device, which outlives all NAND child devices, so it is freed automatically. This drops the manual kfree() and the broken chip counter that was decremented in remove() but never incremented anywhere, leaking the structure and leaving the freed pointer in ctrl->nand on re-probe. Assisted-by: LLM Signed-off-by: Rosen Penev Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/fsl_ifc_nand.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c index be6bbc1c184d..cc75b6a67e07 100644 --- a/drivers/mtd/nand/raw/fsl_ifc_nand.c +++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c @@ -49,7 +49,6 @@ struct fsl_ifc_nand_ctrl { unsigned int index; /* Pointer to next byte to 'read' */ unsigned int oob; /* Non zero if operating on OOB data */ unsigned int eccread; /* Non zero for a full-page ECC read */ - unsigned int counter; /* counter for the initializations */ unsigned int max_bitflips; /* Saved during READ0 cmd */ }; @@ -1023,15 +1022,13 @@ static int fsl_ifc_nand_probe(struct platform_device *dev) mutex_lock(&fsl_ifc_nand_mutex); if (!fsl_ifc_ctrl_dev->nand) { - ifc_nand_ctrl = kzalloc_obj(*ifc_nand_ctrl); + ifc_nand_ctrl = devm_kzalloc(fsl_ifc_ctrl_dev->dev, sizeof(*ifc_nand_ctrl), + GFP_KERNEL); if (!ifc_nand_ctrl) { mutex_unlock(&fsl_ifc_nand_mutex); return -ENOMEM; } - ifc_nand_ctrl->read_bytes = 0; - ifc_nand_ctrl->index = 0; - ifc_nand_ctrl->addr = NULL; fsl_ifc_ctrl_dev->nand = ifc_nand_ctrl; nand_controller_init(&ifc_nand_ctrl->controller); @@ -1105,14 +1102,6 @@ static void fsl_ifc_nand_remove(struct platform_device *dev) nand_cleanup(chip); fsl_ifc_chip_remove(priv); - - mutex_lock(&fsl_ifc_nand_mutex); - ifc_nand_ctrl->counter--; - if (!ifc_nand_ctrl->counter) { - fsl_ifc_ctrl_dev->nand = NULL; - kfree(ifc_nand_ctrl); - } - mutex_unlock(&fsl_ifc_nand_mutex); } static const struct of_device_id fsl_ifc_nand_match[] = { From 0d1644566a1caaf71c8bf2a6689176e61749a85f Mon Sep 17 00:00:00 2001 From: Rosen Penev Date: Fri, 25 Sep 2026 18:48:02 -0700 Subject: [PATCH 35/38] dt-bindings: mtd: convert IBM NDFC binding to YAML The NDFC NAND flash controller was only described in a legacy text file, so dtbs_check reported "failed to match any schema with compatible: ['ibm,ndfc']" for the ndfc nodes of the bluestone, canyonlands, eiger, glacier, sequoia and warp device trees. Convert the binding to the YAML format so those nodes match the generic nand-controller-legacy schema. Describe the node's reg, ccr and bank-settings properties, along with its "nand" chip node which carries the legacy partition layout. The "nand" chip node carries no unit address, so the "nand@[a-f0-9]" pattern of nand-controller-legacy.yaml never matches it and raw-nand-chip.yaml is never applied. Describe it with mtd.yaml, nand-property.yaml and raw-nand-property.yaml instead, the way the controller level does, so that both the deprecated partition@ nodes and a modern "partitions" subnode are accepted. The node name does not matter, the driver picks the first child of the controller node. Assisted-by: LLM Signed-off-by: Rosen Penev Reviewed-by: Rob Herring (Arm) Signed-off-by: Miquel Raynal --- .../devicetree/bindings/mtd/ibm,ndfc.txt | 39 ------ .../devicetree/bindings/mtd/ibm,ndfc.yaml | 128 ++++++++++++++++++ 2 files changed, 128 insertions(+), 39 deletions(-) delete mode 100644 Documentation/devicetree/bindings/mtd/ibm,ndfc.txt create mode 100644 Documentation/devicetree/bindings/mtd/ibm,ndfc.yaml diff --git a/Documentation/devicetree/bindings/mtd/ibm,ndfc.txt b/Documentation/devicetree/bindings/mtd/ibm,ndfc.txt deleted file mode 100644 index 869f0b5f16e8..000000000000 --- a/Documentation/devicetree/bindings/mtd/ibm,ndfc.txt +++ /dev/null @@ -1,39 +0,0 @@ -AMCC NDFC (NanD Flash Controller) - -Required properties: -- compatible : "ibm,ndfc". -- reg : should specify chip select and size used for the chip (0x2000). - -Optional properties: -- ccr : NDFC config and control register value (default 0). -- bank-settings : NDFC bank configuration register value (default 0). - -Notes: -- partition(s) - follows the OF MTD standard for partitions - -Example: - -ndfc@1,0 { - compatible = "ibm,ndfc"; - reg = <0x00000001 0x00000000 0x00002000>; - ccr = <0x00001000>; - bank-settings = <0x80002222>; - #address-cells = <1>; - #size-cells = <1>; - - nand { - #address-cells = <1>; - #size-cells = <1>; - - partition@0 { - label = "kernel"; - reg = <0x00000000 0x00200000>; - }; - partition@200000 { - label = "root"; - reg = <0x00200000 0x03E00000>; - }; - }; -}; - - diff --git a/Documentation/devicetree/bindings/mtd/ibm,ndfc.yaml b/Documentation/devicetree/bindings/mtd/ibm,ndfc.yaml new file mode 100644 index 000000000000..d5c392001ad3 --- /dev/null +++ b/Documentation/devicetree/bindings/mtd/ibm,ndfc.yaml @@ -0,0 +1,128 @@ +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause) +%YAML 1.2 +--- +$id: http://devicetree.org/schemas/mtd/ibm,ndfc.yaml# +$schema: http://devicetree.org/meta-schemas/core.yaml# + +title: IBM/AMCC NDFC (NAND Flash Controller) + +maintainers: + - Miquel Raynal + - Richard Weinberger + +description: | + The NDFC is the NAND flash controller integrated into the IBM/AMCC + PowerPC 44x SoCs. + +allOf: + - $ref: nand-controller-legacy.yaml# + +properties: + compatible: + const: ibm,ndfc + + reg: + description: Chip select and size used for the chip. + maxItems: 1 + + ccr: + description: NDFC config and control register value. + $ref: /schemas/types.yaml#/definitions/uint32 + + bank-settings: + description: NDFC bank configuration register value. + $ref: /schemas/types.yaml#/definitions/uint32 + + nand: + type: object + description: | + NAND chip attached to the controller. The driver picks the first + child of the controller node, so this node is not required to be + named "nand@". + + allOf: + - $ref: mtd.yaml# + - $ref: nand-property.yaml# + - $ref: raw-nand-property.yaml# + + properties: + "#address-cells": + const: 1 + "#size-cells": + const: 1 + + patternProperties: + "^partition@[0-9a-f]+$": + $ref: /schemas/mtd/partitions/partition.yaml#/$defs/partition-node + deprecated: true + + unevaluatedProperties: false + +required: + - compatible + - reg + +unevaluatedProperties: false + +examples: + - | + ebc { + #address-cells = <2>; + #size-cells = <1>; + + ndfc@1,0 { + compatible = "ibm,ndfc"; + reg = <0x00000001 0x00000000 0x00002000>; + ccr = <0x00001000>; + bank-settings = <0x80002222>; + #address-cells = <1>; + #size-cells = <1>; + + nand { + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "kernel"; + reg = <0x00000000 0x00200000>; + }; + partition@200000 { + label = "root"; + reg = <0x00200000 0x03e00000>; + }; + }; + }; + }; + - | + ebc { + #address-cells = <2>; + #size-cells = <1>; + + ndfc@1,0 { + compatible = "ibm,ndfc"; + reg = <0x00000001 0x00000000 0x00002000>; + #address-cells = <1>; + #size-cells = <1>; + + nand { + #address-cells = <1>; + #size-cells = <1>; + + partitions { + compatible = "fixed-partitions"; + #address-cells = <1>; + #size-cells = <1>; + + partition@0 { + label = "kernel"; + reg = <0x00000000 0x00200000>; + }; + partition@200000 { + label = "root"; + reg = <0x00200000 0x03e00000>; + }; + }; + }; + }; + }; +... From 8bef0196a4e21d4415091de2b6c498320e03ada2 Mon Sep 17 00:00:00 2001 From: Frank Li Date: Fri, 2 Oct 2026 16:16:07 -0400 Subject: [PATCH 36/38] mtd: nand: use dmaengine_submit() instead of ->tx_submit() Replace direct dma_async_tx_descriptor->tx_submit() calls with the proper dmaengine_submit() API wrapper. Assisted-by: LLM Signed-off-by: Frank Li Signed-off-by: Miquel Raynal --- drivers/mtd/nand/onenand/onenand_omap2.c | 4 ++-- drivers/mtd/nand/raw/fsmc_nand.c | 2 +- drivers/mtd/nand/raw/intel-nand-controller.c | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/mtd/nand/onenand/onenand_omap2.c b/drivers/mtd/nand/onenand/onenand_omap2.c index 0793251ada3b..644498187d8f 100644 --- a/drivers/mtd/nand/onenand/onenand_omap2.c +++ b/drivers/mtd/nand/onenand/onenand_omap2.c @@ -340,9 +340,9 @@ static inline int omap2_onenand_dma_transfer(struct omap2_onenand *c, tx->callback = omap2_onenand_dma_complete_func; tx->callback_param = &c->dma_done; - cookie = tx->tx_submit(tx); + cookie = dmaengine_submit(tx); if (dma_submit_error(cookie)) { - dev_err(&c->pdev->dev, "Failed to do DMA tx_submit\n"); + dev_err(&c->pdev->dev, "Failed to do dmaengine_submit\n"); return -EIO; } diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c index b13b2b0c3f30..0b1817cdfc5a 100644 --- a/drivers/mtd/nand/raw/fsmc_nand.c +++ b/drivers/mtd/nand/raw/fsmc_nand.c @@ -524,7 +524,7 @@ static int dma_xfer(struct fsmc_nand_data *host, void *buffer, int len, tx->callback = dma_complete; tx->callback_param = host; - cookie = tx->tx_submit(tx); + cookie = dmaengine_submit(tx); ret = dma_submit_error(cookie); if (ret) { diff --git a/drivers/mtd/nand/raw/intel-nand-controller.c b/drivers/mtd/nand/raw/intel-nand-controller.c index 01cefdaf115d..477a427dac1f 100644 --- a/drivers/mtd/nand/raw/intel-nand-controller.c +++ b/drivers/mtd/nand/raw/intel-nand-controller.c @@ -322,7 +322,7 @@ static int ebu_dma_start(struct ebu_nand_controller *ebu_host, u32 dir, tx->callback = callback; tx->callback_param = ebu_host; - cookie = tx->tx_submit(tx); + cookie = dmaengine_submit(tx); ret = dma_submit_error(cookie); if (ret) { From 1ce45f0e74d60e8279ed380c97047e6c351aee1b Mon Sep 17 00:00:00 2001 From: Haotian Zhang Date: Fri, 9 Oct 2026 14:06:10 +0800 Subject: [PATCH 37/38] mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface() pl35x_nfc_setup_interface() obtains a reference to the SMC "memclk" with of_clk_get_by_name() and only uses it to read the clock rate. The reference is never released: the function has many early return paths and no clk_put() call anywhere, so the clock reference is leaked. The hook is invoked repeatedly by the NAND core (nand_reset(), nand_setup_interface() and the NAND_DATA_IFACE_CHECK_ONLY mode probing loops), so the reference count keeps growing. Release the clock reference with clk_put() as soon as its rate has been read. Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller") Assisted-by: DeepSeek-V4.1-Flash Signed-off-by: Haotian Zhang Signed-off-by: Miquel Raynal --- drivers/mtd/nand/raw/pl35x-nand-controller.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/mtd/nand/raw/pl35x-nand-controller.c b/drivers/mtd/nand/raw/pl35x-nand-controller.c index bd89aaadd1b2..26b61d856143 100644 --- a/drivers/mtd/nand/raw/pl35x-nand-controller.c +++ b/drivers/mtd/nand/raw/pl35x-nand-controller.c @@ -807,6 +807,7 @@ static int pl35x_nfc_setup_interface(struct nand_chip *chip, int cs, * macro to convert from one to the other. */ period_ns = NSEC_PER_SEC / clk_get_rate(mclk); + clk_put(mclk); /* * PL35X SMC needs one extra read cycle in SDR Mode 5. This is not From 30daaf3e7897b4a8d9b72e5b0c86dd6e2a4d7d85 Mon Sep 17 00:00:00 2001 From: Navid Ghahremani Date: Sat, 10 Oct 2026 13:59:25 +0100 Subject: [PATCH 38/38] mtd: spinand: heyangtek: Reserve both bad block marker bytes Keep the two bytes read by the SPI-NAND bad-block check out of the free OOB region. This is a separate MTD fix, compiled but not exercised through OOB writes on hardware. Assisted-by: LLM Signed-off-by: Navid Ghahremani Signed-off-by: Miquel Raynal --- drivers/mtd/nand/spi/heyangtek.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/nand/spi/heyangtek.c b/drivers/mtd/nand/spi/heyangtek.c index 7fc50fd3de08..76d97ae9702c 100644 --- a/drivers/mtd/nand/spi/heyangtek.c +++ b/drivers/mtd/nand/spi/heyangtek.c @@ -35,8 +35,8 @@ static SPINAND_OP_VARIANTS(update_cache_variants, /* * HYF1GQ4UDACAE is a GD5F1GQ4-compatible die, so the OOB layout is taken * from gd5fxgq4xa: the on-die ECC parity occupies bytes 8..15 of each - * 16-byte section, the bad block marker sits in byte 0 and the remaining - * bytes are exposed as free. + * 16-byte section, and the remaining bytes are exposed as free, except the + * two bytes that spinand_isbad() reads as the bad block marker. */ static int hyf1gq4_ooblayout_ecc(struct mtd_info *mtd, int section, struct mtd_oob_region *region) @@ -60,9 +60,9 @@ static int hyf1gq4_ooblayout_free(struct mtd_info *mtd, int section, region->offset = 16 * section; region->length = 8; } else { - /* section 0 has one byte reserved for the bad block marker */ - region->offset = 1; - region->length = 7; + /* section 0 has two bytes reserved for the bad block marker */ + region->offset = 2; + region->length = 6; } return 0;