Commit Graph

1035 Commits

Author SHA1 Message Date
Runyu Xiao
44b8a0bf5f mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()
Use the same guard(mutex) pattern as the other RWW helpers so nor->lock
is released on both the busy and successful return paths.

Fixes: 03e7bb864d ("mtd: spi-nor: use scope-based mutex cleanup helpers")
Cc: stable@vger.kernel.org
Signed-off-by: Runyu Xiao <runyu.xiao@seu.edu.cn>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
[mw: rephrased commit message]
Signed-off-by: Michael Walle <mwalle@kernel.org>
2026-09-14 15:37:24 +02:00
Miquel Raynal
49420dfded * Extend SPI NAND continuous read to Winbond devices, which requires
numerous changes in the spi-{mem,nand} layers such as the need for a
   secondary read operation template.
 
 * Continuous reads in general have also been enhanced/fixed for avoiding
   potential issues at probe time and at block boundaries.
 
 Plus, there is the usual load of misc fixes and improvements.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmo3/ScACgkQJWrqGEe9
 VoSQpAf+Lmra6J3A1kiQAfNdod2Yt7WtOvmc3qRrhuN5yt7h/pgnmIVdii6j+zFQ
 mxmrN5sDSujA5nZnsPb3pcFyLBvfFsh+6LYDzE5zYODDO17TwPOJWR8qYaQVzFyC
 Ml6drEQBssGPVIWoI1jdihNuyY3bMlWXvYgbLkr2qfdzlmRDbdCPXFWLBItT4ZEp
 N+sEHVPB34MbVZRXha0A+H85uvatQ0+8i19V7i4WT1NRT/l85IKDwxUYgV5Ehc4Y
 LDiHW6eN49blRnrQmSZDujTlfz3PILdFRhwJtwBQRru6JC+iSAPcCz1TY0fX/Ys/
 JS8OR5UYkWlBCKxqdvnb2XteLIPqaw==
 =WYxG
 -----END PGP SIGNATURE-----

Merge tag 'nand/for-7.2' into mtd/next

* Extend SPI NAND continuous read to Winbond devices, which requires
  numerous changes in the spi-{mem,nand} layers such as the need for a
  secondary read operation template.

* Continuous reads in general have also been enhanced/fixed for avoiding
  potential issues at probe time and at block boundaries.

Plus, there is the usual load of misc fixes and improvements.
2026-06-21 17:05:45 +02:00
Takahiro Kuwano
df415c5e1d mtd: spi-nor: spansion: add die erase support in s28hx-t
S28Hx-T family has multi-die devices that support die erase opcode.
Update die erase opcode when the device is multi-die.

Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Takahiro Kuwano <takahiro.kuwano@infineon.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-28 15:57:24 +02:00
Takahiro Kuwano
306e443156 mtd: spi-nor: spansion: use die erase for multi-die devices only
Die erase opcode is supported in multi-die devices only. For single die
devices, default chip erase opcode must be used.

In s25hx_t_late_init(), die erase opcode is set only when the device is
multi-die.

Fixes: 461d0babb5 ("mtd: spi-nor: spansion: enable die erase for multi die flashes")
Cc: stable@kernel.org
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Takahiro Kuwano <takahiro.kuwano@infineon.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-28 15:57:24 +02:00
Miquel Raynal
4800798623 mtd: spi-nor: winbond: Add W25Q02NWxxIM CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Unfortunately, this chip also comes with an incorrect BFPT table,
indicating the Control Register cannot be read back. This is wrong,
reading back the register works and has no (observed) side effect. The
datasheet clearly indicates supporting the 35h command and all bits from
the CR are marked readable. QE and CMP bits are inside, and can be
properly read back.

Add a fixup for this, otherwise it would defeat the use of the CMP
feature.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:03 +02:00
Miquel Raynal
eb403cb56e mtd: spi-nor: winbond: Add W25Q01NWxxIM CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:03 +02:00
Miquel Raynal
f468f05f07 mtd: spi-nor: winbond: Add W25Q01NWxxIQ CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Unfortunately, this chip also comes with an incorrect BFPT table,
indicating the Control Register cannot be read back. This is wrong,
reading back the register works and has no (observed) side effect. The
datasheet clearly indicates supporting the 35h command and all bits from
the CR are marked readable. QE and CMP bits are inside, and can be
properly read back.

Add a fixup for this, otherwise it would defeat the use of the CMP
feature.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:03 +02:00
Miquel Raynal
751e4b02c4 mtd: spi-nor: winbond: Add W25H02NWxxAM CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Unfortunately, this chip also comes with an incorrect BFPT table,
indicating the Control Register cannot be read back. This is wrong,
reading back the register works and has no (observed) side effect. The
datasheet clearly indicates supporting the 35h command and all bits from
the CR are marked readable. QE and CMP bits are inside, and can be
properly read back.

Add a fixup for this, otherwise it would defeat the use of the CMP
feature.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:03 +02:00
Miquel Raynal
855599425e mtd: spi-nor: winbond: Add W25H01NWxxAM CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:03 +02:00
Miquel Raynal
591be2ba78 mtd: spi-nor: winbond: Add W25H512NWxxAM CMP locking support
This chip has support for the locking complement (CMP) feature. Add
the relevant bit to enable it.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:02 +02:00
Miquel Raynal
e3fb31d884 mtd: spi-nor: swp: Add support for the complement feature
The current locking implementation allows to select a power of two
number of blocks, which is going to be the protected amount, as well as
telling whether this is the data at the top (end of the device) or the
bottom (beginning of the device). This means at most we can cover half
of the device or the entire device, but nothing in between.

The complement feature allows a much finer grain of configuration, by
allowing to invert what is considered locked and unlocked.

Add support for this feature. The only known position for the CMP bit is
bit 6 of the configuration register.

The locking and unlocking logics are kept unchanged if the CMP bit is
unavailable. Otherwise, once the regular logic has been applied, we
check if we already found an optimal configuration. If not, we try with
the CMP bit set. If the coverage is closer to the request, we use it.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-27 14:36:02 +02:00
Miquel Raynal
f05f0d62c5 mtd: spi-nor: debugfs: Add a locked sectors map
In order to get a very clear view of the sectors being locked, besides
the `params` output giving the ranges, we may want to see a proper map
of the sectors and for each of them, their status. Depending on the use
case, this map may be easier to parse by humans and gives a more acurate
feeling of the situation. At least myself, for the few locking-related
developments I recently went through, I found it very useful to get a
clearer mental model of what was locked/unlocked.

Here is an example of output:

$ cat /sys/kernel/debug/spi-nor/spi0.0/locked-sectors-map
Locked sectors map (x: locked, .: unlocked, unit: 64kiB)
 0x00000000 (#    0): ................ ................ ................ ................
 0x00400000 (#   64): ................ ................ ................ ................
 0x00800000 (#  128): ................ ................ ................ ................
 0x00c00000 (#  192): ................ ................ ................ ................
 0x01000000 (#  256): ................ ................ ................ ................
 0x01400000 (#  320): ................ ................ ................ ................
 0x01800000 (#  384): ................ ................ ................ ................
 0x01c00000 (#  448): ................ ................ ................ ................
 0x02000000 (#  512): ................ ................ ................ ................
 0x02400000 (#  576): ................ ................ ................ ................
 0x02800000 (#  640): ................ ................ ................ ................
 0x02c00000 (#  704): ................ ................ ................ ................
 0x03000000 (#  768): ................ ................ ................ ................
 0x03400000 (#  832): ................ ................ ................ ................
 0x03800000 (#  896): ................ ................ ................ ................
 0x03c00000 (#  960): ................ ................ ................ ..............xx

The output is wrapped at 64 sectors, spaces every 16 sectors are
improving the readability, every line starts by the first sector
offset (hex) and number (decimal).

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
[pratyush@kernel.org: split the debugfs_create_file() into two lines]
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:23:53 +02:00
Miquel Raynal
47eb01f46e mtd: spi-nor: debugfs: Add locking support
The ioctl output may be counter intuitive in some cases. Asking for a
"locked status" over a region that is only partially locked will return
"unlocked" whereas in practice maybe the biggest part is actually
locked.

Knowing what is the real software locking state through debugfs would be
very convenient for development/debugging purposes, hence this proposal
for adding an extra block at the end of the file: a "locked sectors"
array which lists every section, if it is locked or not, showing both
the address ranges and the sizes in numbers of "lock sectors" (which on
small density devices is typically different than erase blocks).

Here is an example of output, what is after the "sector map" is new.

$ cat /sys/kernel/debug/spi-nor/spi0.0/params
name		(null)
id		ef a0 20 00 00 00
size		64.0 MiB
write size	1
page size	256
address nbytes	4
flags		HAS_SR_TB | 4B_OPCODES | HAS_4BAIT | HAS_LOCK | HAS_16BIT_SR | HAS_SR_TB_BIT6 | HAS_4BIT_BP | SOFT_RESET | NO_WP

opcodes
 read		0xec
  dummy cycles	6
 erase		0xdc
 program	0x34
 8D extension	none

protocols
 read		1S-4S-4S
 write		1S-1S-4S
 register	1S-1S-1S

erase commands
 21 (4.00 KiB) [1]
 dc (64.0 KiB) [3]
 c7 (64.0 MiB)

sector map
 region (in hex)   | erase mask | overlaid
 ------------------+------------+---------
 00000000-03ffffff |     [   3] | no

locked sectors
 region (in hex)   | status   | #sectors
 ------------------+----------+---------
 00000000-03ffffff | unlocked | 1024

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:05 +02:00
Miquel Raynal
b7b6347590 mtd: spi-nor: Create a local SR cache
In order to be able to generate debugfs output without having to
actually reach the flash, create a SPI NOR local cache of the status
registers. What matters in our case are all the bits related to sector
locking. As such, in order to make it clear that this cache is not
intended to be used anywhere else, we zero the irrelevant bits.

The cache is initialized once during the early init, and then maintained
every time the write protection scheme is updated.

Suggested-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:05 +02:00
Miquel Raynal
0e00504529 mtd: spi-nor: swp: Cosmetic changes
As a final preparation step for the introduction of CMP support, make
a few more cosmetic changes to simplify the reading of the diff when
adding the CMP feature. In particular, define "min_prot_len" earlier as
it will be reused and move the definition of the "ret" variable at the
end of the stack just because it looks better.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
c672673c4b mtd: spi-nor: swp: Simplify checking the locked/unlocked range
In both the locking/unlocking steps, at the end we verify whether we do
not lock/unlock more than requested (in which case an error must be
returned).

While being possible to do that with very simple mask comparisons, it
does not scale when adding extra locking features such as the CMP
possibility. In order to make these checks slightly easier to read and
more future proof, use existing helpers to read the (future) status
register, extract the covered range, and compare it with very usual
algebric comparisons.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
290e838336 mtd: spi-nor: swp: Create helpers for building the SR register
The status register contains 3 or 4 BP (Block Protect) bits, 0 or 1
TB (Top/Bottom) bit, soon 0 or 1 CMP (Complement) bit. The last BP bit
and the TB bit locations change between vendors. The whole logic of
buildling the content of the status register based on some input
conditions is used two times and soon will be used 4 times.

Create dedicated helpers for these steps.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
ba32a259dd mtd: spi-nor: swp: Create a TB intermediate variable
Ease the future reuse of the tb (Top/Bottom) boolean by creating an
intermediate variable.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
8851f82645 mtd: spi-nor: swp: Rename a mask
"mask" is not very descriptive when we already manipulate two masks, and
soon will manipulate three. Rename it "bp_mask" to align with the
existing "tb_mask" and soon "cmp_mask".

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
82877fd772 mtd: spi-nor: swp: Create a helper that writes SR, CR and checks
There are many helpers already to either read and/or write SR and/or CR,
as well as sometimes check the returned values. In order to be able to
switch from a 1 byte status register to a 2 bytes status register while
keeping the same level of verification, let's introduce a new helper
that writes them both (atomically) and then reads them back (separated)
to compare the values.

In case 2 bytes registers are not supported, we still have the usual
fallback available in the helper being exported to the rest of the core.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
2188bbbb4a mtd: spi-nor: swp: Use a pointer for SR instead of a single byte
At this stage, the Status Register is most often seen as a single
byte. This is subject to change when we will need to read the CMP bit
which is located in the Control Register (kind of secondary status
register). Both will need to be carried.

Change a few prototypes to carry a u8 pointer. This way it also makes it
very clear where we access the first register, and where we will access
the second.

There is no functional change.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
cb3021466d mtd: spi-nor: swp: Clarify a comment
The comment states that some power of two sizes are not supported. This
is very device dependent (based on the size), so modulate a bit the
sentence to make it more accurate.

Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
5eeff82d38 mtd: spi-nor: swp: Explain the MEMLOCK ioctl implementation behaviour
Add more details about how these requests are actually handled in the
SPI NOR core. Their behaviour was not entirely clear to me at first, and
explaining them in plain English sounds the way to go.

Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
461e2f8a2d mtd: spi-nor: debugfs: Enhance output
Align the number of dashes to the bigger column width (the title in this
case) to make the output more pleasant and aligned with what is done
in the "params" file output.

Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
154f375f7d mtd: spi-nor: debugfs: Align variable access with the rest of the file
The "params" variable is used everywhere else, align this particular
line of the file to use "params" directly rather than the "nor" pointer.

Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:04 +02:00
Miquel Raynal
f316b85358 mtd: spi-nor: Make sure the QE bit is kept enabled if useful
Not all chips implement the 4BAIT table which typically indicates the
program capability, while many of them do implement the relevant SFDP
parts indicating the read capabilities. In such a situation, programs
can happen in single mode (1-1-1) and reads in quad mode (1-1-4 or
1-4-4). For the reads to work in such condition, the QE bit must be set.
In case we later use the spi_nor_write_16bit_sr_and_check() helper with
a chip with such configuration, the QE bit would get incorrectly
cleared.

Make sure this doesn't happen by keeping the QE bit under a simpler
condition:
- the quad enable hook is there (no change)
- and at least one of the two protocols is based on quad I/O cycles

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:03 +02:00
Miquel Raynal
a6470e2162 mtd: spi-nor: Drop duplicate Kconfig dependency
I do not think the MTD dependency is needed twice. This is likely a
duplicate coming from a former rebase when the spi-nor core got cleaned
up a while ago. Remove the extra line.

Fixes: b35b9a1036 ("mtd: spi-nor: Move m25p80 code in spi-nor.c")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:03 +02:00
Miquel Raynal
e1d456b26b mtd: spi-nor: swp: Improve locking user experience
In the case of the first block being locked (or the few first blocks),
if the user want to fully unlock the device it has two possibilities:
- either it asks to unlock the entire device, and this works;
- or it asks to unlock just the block(s) that are currently locked,
  which fails.

It fails because the conditions "can_be_top" and "can_be_bottom" are
true. Indeed, in this case, we unlock everything, so the TB bit does not
matter. However in the current implementation, use_top would be true (as
this is the favourite option) and lock_len, which in practice should be
reduced down to 0, is set to "nor->params->size - (ofs + len)" which is
a positive number. This is wrong.

An easy way is to simply add an extra condition. In the unlock() path,
if we can achieve the same result from both sides, it means we unlock
everything and lock_len must simply be 0. A comment is added to clarify
that logic.

Fixes: 3dd8012a8e ("mtd: spi-nor: add TB (Top/Bottom) protect support")
Cc: stable@kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:03 +02:00
Miquel Raynal
829dff8359 mtd: spi-nor: debugfs: Fix the flags list
As mentioned above the spi_nor_option_flags enumeration in core.h, this
list should be kept in sync with the one in the core.

Add the missing flag.

Fixes: 6a42bc97cc ("mtd: spi-nor: core: Allow specifying the byte order in Octal DTR mode")
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2026-05-26 17:21:03 +02:00
Miquel Raynal
7a0d420e42 Aside from preparation changes in the SPI NAND core, the changes carried
here focus on the shared spi-mem layer which is enhanced in order to
 bring two new features:
 
 - The possibility to fill a primary and a secondary operation template
   in the direct mapping structure in order to support continuous reads
   in SPI NAND, which may require two different read operations.
 
 - SPI controllers may indicate possible CS instabilities over long
   transfers by setting a boolean. This capability is related to the
   previous one, the need for it has arised while testing SPI NAND
   continuous reads with the Cadence QSPI controller which cannot, under
   certain conditions, keep the CS asserted for the length of
   an eraseblock-large transfer.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmn4m50ACgkQJWrqGEe9
 VoSUzwf8D7an5inOVMcX2IsbXSkA6vKgrzjc1jG3rGiLrFks/bZyo0R8atp4pUsy
 6WDkJfFyHg6IzU92N/37Kha8rnFp7um9OhfB/z2O/ztyqr9d1yM6QDtenknYr+WH
 BwcuJ8zenyWuIY526Ar04REJ07s8MZpMUhcnUIw/KpvQiS12UR6NHgEaUrmIjtLD
 GCKKFTGOY++9dgObo8ZrkrsLlVUhV5GyvCqUtBNNbADTNAt7j4m6YuyztS7rrmwb
 b33RoZiWmG0szkUsTJJBDH15cMB/4wV2SoGm3wzsACHqJhCy0n9FvSVAXwcRm5l7
 qOLedtMoBIIIIwBbHPsf0SySToy2ag==
 =3qpz
 -----END PGP SIGNATURE-----

Merge tag 'mtd/spi-mem-cont-read-for-7.2' into nand/next

Aside from preparation changes in the SPI NAND core, the changes carried
here focus on the shared spi-mem layer which is enhanced in order to
bring two new features:

- The possibility to fill a primary and a secondary operation template
  in the direct mapping structure in order to support continuous reads
  in SPI NAND, which may require two different read operations.

- SPI controllers may indicate possible CS instabilities over long
  transfers by setting a boolean. This capability is related to the
  previous one, the need for it has arised while testing SPI NAND
  continuous reads with the Cadence QSPI controller which cannot, under
  certain conditions, keep the CS asserted for the length of
  an eraseblock-large transfer.
2026-05-04 15:14:36 +02:00
Miquel Raynal
39d0ea3312 spi: spi-mem: Transform the read operation template
As of now, we only use a single operation template when creating SPI
memory direct mappings. With the idea to extend this possibility to 2,
rename the template to reflect that we are currently setting the
"primary" operation, and create a pointer in the same structure to point
to it.

From a user point of view, the op_tmpl name remains but becomes a
pointer, leading to minor changes in both the SPI NAND and SPI NOR
cores.

There is no functional change.

Acked-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-05-04 15:02:07 +02:00
Tudor Ambarus
e47029b977 mtd: spi-nor: debugfs: fix out-of-bounds read in spi_nor_params_show()
Sashiko noticed an out-of-bounds read [1].

In spi_nor_params_show(), the snor_f_names array is passed to
spi_nor_print_flags() using sizeof(snor_f_names).

Since snor_f_names is an array of pointers, sizeof() returns the total
number of bytes occupied by the pointers
	(element_count * sizeof(void *))
rather than the element count itself. On 64-bit systems, this makes the
passed length 8x larger than intended.

Inside spi_nor_print_flags(), the 'names_len' argument is used to
bounds-check the 'names' array access. An out-of-bounds read occurs
if a flag bit is set that exceeds the array's actual element count
but is within the inflated byte-size count.

Correct this by using ARRAY_SIZE() to pass the actual number of
string pointers in the array.

Cc: stable@vger.kernel.org
Fixes: 0257be79fc ("mtd: spi-nor: expose internal parameters via debugfs")
Closes: https://sashiko.dev/#/patchset/20260417-die-erase-fix-v2-1-73bb7004ebad%40infineon.com [1]
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Reviewed-by: Takahiro Kuwano <takahiro.kuwano@infineon.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-04-27 15:04:11 +02:00
Linus Torvalds
8541d8f725 * MTD changes
mtdconcat finally makes it in, after several years of being merged and
 reverted.
 
 Baikal SoC support is being removed, so MTD bits are being removed as
 well.
 
 All the other changes are misc cleanups.
 
 * NAND changes
 
 The main changes happened in the SunXi driver in order to
 support new versions of the Allwinner NAND controller.
 
 There are also some DT-binding improvements and cleanups.
 
 Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND),
 aside with the usual load of misc changes.
 
 * SPI NOR changes
 
 There is only a collection of bugfixes this time around, with no notable
 changes to the core. Some of the more noteworthy bugfixes listed below.
 
 - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup
   since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for fixing
   mt35xu02gcba") but did not add it due to lack of hardware to test on.
 
 - Fix locking on some Winbond w25q series flashes.
 
 - Fix Auto Address Increment (AAI) writes on SST that flashes that start
   on odd address. The write enable latch needs to be set again after the
   single byte program.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmnikDUACgkQJWrqGEe9
 VoQFDgf/WvlAbHSY1NLNB6tRgNj9n7Y8tDbSLY4nI7PjBJdQeu92PMHTs45TvMLS
 ZYyJ7ew2yf3i5KScMrz7LBGmLocGkUXD6HlFXLSy2uuwNk9REF+zwFpKLF0sLP4P
 mU1ZRukql8VTPrPA3iMJzTn7atya3PtOhAFSXDagUWzIFFdkfynTHJgPBpZYZr0n
 0xyn+uFSJCUJntfR4mPPsXH+IwGfpthI4olWAu/K4TTwZUv9qxlfe9TDEYG8PIJ4
 7DsvG/XqF2gQcWR7+VM5Wsow/EvgKqfvwgTRD2INetwUvYbJCw+xyVQGzN/3IMpR
 AMM1cv2t4dPEPgydrZiLDG5d3jynvQ==
 =sOg7
 -----END PGP SIGNATURE-----

Merge tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

Pull MTD updates from Miquel Raynal:
 "MTD changes:

   - mtdconcat finally makes it in, after several years of being merged
     and reverted

   - Baikal SoC support is being removed, so MTD bits are being removed
     as well

   - misc cleanups

  NAND changes:

   - SunXi driver support for new versions of the Allwinner NAND
     controller.

   - DT-binding improvements and cleanups.

   - A few fixes (Realtek ECC and Winbond SPI NAND), aside with the
     usual load of misc changes.

  SPI NOR fixes:

   - Enable die erase on MT35XU02GCBA. We knew this flash needed this
     fixup since 7f77c561e2 ("mtd: spi-nor: micron-st: add TODO for
     fixing mt35xu02gcba") but did not add it due to lack of hardware to
     test on.

   - Fix locking on some Winbond w25q series flashes.

   - Fix Auto Address Increment (AAI) writes on SST that flashes that
     start on odd address. The write enable latch needs to be set again
     after the single byte program"

* tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (44 commits)
  mtd: spinand: winbond: Declare the QE bit on W25NxxJW
  mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA
  mtd: spi-nor: winbond: Fix locking support for w25q256jw
  mtd: spi-nor: sst: Fix write enable before AAI sequence
  mtd: spi-nor: winbond: Fix locking support for w25q64jvm
  mtd: spi-nor: winbond: Fix locking support for w25q256jwm
  dt-bindings: mtd: mxc-nand: add missing compatible string and ref to nand-controller-legacy.yaml
  dt-bindings: mtd: gpmi-nand: ref to nand-controller-legacy.yaml
  dt-bindings: mtd: refactor NAND bindings and add nand-controller-legacy.yaml
  mtd: spinand: winbond: Clarify when to enable the HS bit
  mtd: rawnand: sunxi: introduce maximize variable user data length
  mtd: rawnand: sunxi: fix typos in comments
  mtd: rawnand: sunxi: change error prone variable name
  mtd: rawnand: sunxi: remove dead code
  mtd: rawnand: sunxi: make the code more self-explanatory
  mtd: rawnand: sunxi: replace hard coded value by a define - take2
  mtd: rawnand: sunxi: do not count BBM bytes twice
  mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob
  mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarification
  mtd: cmdlinepart: use a flexible array member
  ...
2026-04-17 17:57:04 -07:00
Haoyu Lu
cf6788aed0 mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA
The MT35XU02GCBA flash device does not support chip erase according
to its datasheet, but supports die erase. The existing code had a TODO
comment noting that the SPI_NOR_IO_MODE_EN_VOLATILE flag probably needs
to be enabled and the driver implementation needs to be converted to
use die erase.

This patch enables the SPI_NOR_IO_MODE_EN_VOLATILE flag and adds the
mt35_two_die_fixups to the MT35XU02GCBA entry, which includes the
micron_st_nor_two_die_late_init() function that sets up die erase
support.

With these changes, the flash device can properly use die erase
operations instead of chip erase.

Signed-off-by: Haoyu Lu <hechushiguitu666@gmail.com>
Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org>
[pratyush@kernel.org: drop the whole comment instead of just the TODO line]
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-31 15:46:47 +00:00
Eliav Farber
760e8c382c mtd: spi-nor: winbond: Fix locking support for w25q256jw
The Winbond w25q256jw device:
 - Supports lock/unlock via SR.
 - Has Top/Bottom (TB) protect bit.
 - Uses Status Register bit 6 as the Top/Bottom (TB) protect bit.
 - Supports four Block Protect (BP) bits.

Update the flash parameters by enabling SPI_NOR_HAS_LOCK, SPI_NOR_HAS_TB,
SPI_NOR_TB_SR_BIT6 and SPI_NOR_4BIT_BP. Without these flags, the locking
configuration is incorrect.

Reference:
https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1

Signed-off-by: Eliav Farber <farbere@amazon.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30 15:00:34 +00:00
Sanjaikumar V S
a0f64241d3 mtd: spi-nor: sst: Fix write enable before AAI sequence
When writing to SST flash starting at an odd address, a single byte is
first programmed using the byte program (BP) command. After this
operation completes, the flash hardware automatically clears the Write
Enable Latch (WEL) bit.

If an AAI (Auto Address Increment) word program sequence follows, it
requires WEL to be set. Without re-enabling writes, the AAI sequence
fails.

Add spi_nor_write_enable() after the odd-address byte program when more
data needs to be written. Use a local boolean for clarity.

Fixes: b199489d37 ("mtd: spi-nor: add the framework for SPI NOR")
Cc: stable@vger.kernel.org
Signed-off-by: Sanjaikumar V S <sanjaikumar.vs@dicortech.com>
Tested-by: Hendrik Donner <hd@os-cillation.de>
Reviewed-by: Hendrik Donner <hd@os-cillation.de>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30 14:24:38 +00:00
Eliav Farber
5eb1301776 mtd: spi-nor: winbond: Fix locking support for w25q64jvm
The Winbond w25q64jvm supports block protection through the Status
Register (SR) and provides a Top/Bottom (TB) protection bit.

Enable SPI_NOR_HAS_LOCK and SPI_NOR_HAS_TB for this device to
properly describe its locking capabilities.

The device uses Status Register bit 5 as the TB bit and supports only
three Block Protect (BP) bits. Therefore, do not set SPI_NOR_TB_SR_BIT6
or SPI_NOR_4BIT_BP.

Reference:
https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q64JV.1

Signed-off-by: Eliav Farber <farbere@amazon.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30 14:07:11 +00:00
Eliav Farber
0f0b444be3 mtd: spi-nor: winbond: Fix locking support for w25q256jwm
The Winbond w25q256jwm device supports four Block Protect (BP) bits and
uses Status Register bit 6 as the Top/Bottom (TB) protect bit.

Update the flash parameters by enabling SPI_NOR_4BIT_BP and
SPI_NOR_TB_SR_BIT6. Without these flags, the locking configuration is
incorrect.

Reference:
https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1

Signed-off-by: Eliav Farber <farbere@amazon.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30 14:06:45 +00:00
Miquel Raynal
16dec014db mtd: spi-nor: Rename spi_nor_spimem_check_op()
This helper really is just a little helper for internal purposes, and is
I/O operation oriented, despite its name. It has already been misused
in commit 5008c3ec3f ("mtd: spi-nor: core: Check read CR support"), so
rename it to clarify its purpose: it is only useful for reads and page
programs.

Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-18 18:08:18 +01:00
Miquel Raynal
ac512cd351 mtd: spi-nor: Fix RDCR controller capability core check
Commit 5008c3ec3f ("mtd: spi-nor: core: Check read CR support") adds a
controller check to make sure the core will not use CR reads on
controllers not supporting them. The approach is valid but the fix is
incorrect. Unfortunately, the author could not catch it, because the
expected behavior was met. The patch indeed drops the RDCR capability,
but it does it for all controllers!

The issue comes from the use of spi_nor_spimem_check_op() which is an
internal helper dedicated to check read/write operations only, despite
its generic name.

This helper looks for the biggest number of address bytes that can be
used for a page operation and tries 4 then 3. It then calls the usual
spi-mem helpers to do the checks. These will always fail because there
is now an inconsistency: the address cycles are forced to 4 (then 3)
bytes, but the bus width during the address cycles rightfully remains
0. There is a non-zero address length but a zero address bus width,
which is an invalid combination.

The correct check in this case is to directly call spi_mem_supports_op()
which doesn't messes up with the operation content.

Fixes: 5008c3ec3f ("mtd: spi-nor: core: Check read CR support")
Cc: stable@vger.kernel.org
Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Acked-by: Takahiro Kuwano <takahiro.kuwano@infineon.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-18 18:08:12 +01:00
Shiji Yang
94645aa41b mtd: spi-nor: swp: check SR_TB flag when getting tb_mask
When the chip does not support top/bottom block protect, the tb_mask
must be set to 0, otherwise SR1 bit5 will be unexpectedly modified.

Signed-off-by: Shiji Yang <yangshiji66@outlook.com>
Fixes: 3dd8012a8e ("mtd: spi-nor: add TB (Top/Bottom) protect support")
Reviewed-by: Michael Walle <mwalle@kernel.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13 11:13:46 +00:00
Haibo Chen
6d660fba6a mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for mt35xu512aba
Find two batches mt35xu512aba has different SFDP but with same
jedec ID. The batch which use the new version of SFDP contain
all the necessary information to support OCT DTR mode. The batch
with old version do not contain the OCT DTR command information,
but in fact it did support OCT DTR mode.

Current mt35xu512aba_post_sfdp_fixup() add some setting including
SNOR_CMD_READ_8_8_8_DTR, but still lack SNOR_CMD_PP_8_8_8_DTR. Meet
issue on the batch mt35xu512aba with old SFDP version. Because no
SNOR_CMD_PP_8_8_8_DTR, micron_st_nor_octal_dtr_en() will not be
called, then use SNOR_CMD_READ_8_8_8_DTR will meet issue.

Fixes: 44dd635cd6 ("mtd: spi-nor: micron-st: use SFDP of mt35xu512aba")
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Michael Walle <mwalle@kernel.org>
[pratyush@kernel.org: touch up the comment a bit]
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13 10:54:21 +00:00
Jonas Gorski
3620d67b48 mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentation
After commit 5273cc6df9 ("mtd: spi-nor: core: Call
spi_nor_post_sfdp_fixups() only when SFDP is defined")
spi_nor_post_sfdp_fixups() isn't called anymore if no SFDP is detected.

Update the documentation accordingly.

Fixes: 5273cc6df9 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13 10:47:18 +00:00
Haibo Chen
756564a536 mtd: spi-nor: core: correct the op.dummy.nbytes when check read operations
When check read operation, need to setting the op.dummy.nbytes based
on current read operation rather than the nor->read_proto.

Fixes: 0e30f47232 ("mtd: spi-nor: add support for DTR protocol")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13 10:28:17 +00:00
Linus Torvalds
bf4afc53b7 Convert 'alloc_obj' family to use the new default GFP_KERNEL argument
This was done entirely with mindless brute force, using

    git grep -l '\<k[vmz]*alloc_objs*(.*, GFP_KERNEL)' |
        xargs sed -i 's/\(alloc_objs*(.*\), GFP_KERNEL)/\1)/'

to convert the new alloc_obj() users that had a simple GFP_KERNEL
argument to just drop that argument.

Note that due to the extreme simplicity of the scripting, any slightly
more complex cases spread over multiple lines would not be triggered:
they definitely exist, but this covers the vast bulk of the cases, and
the resulting diff is also then easier to check automatically.

For the same reason the 'flex' versions will be done as a separate
conversion.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-02-21 17:09:51 -08:00
Kees Cook
69050f8d6d treewide: Replace kmalloc with kmalloc_obj for non-scalar types
This is the result of running the Coccinelle script from
scripts/coccinelle/api/kmalloc_objs.cocci. The script is designed to
avoid scalar types (which need careful case-by-case checking), and
instead replace kmalloc-family calls that allocate struct or union
object instances:

Single allocations:	kmalloc(sizeof(TYPE), ...)
are replaced with:	kmalloc_obj(TYPE, ...)

Array allocations:	kmalloc_array(COUNT, sizeof(TYPE), ...)
are replaced with:	kmalloc_objs(TYPE, COUNT, ...)

Flex array allocations:	kmalloc(struct_size(PTR, FAM, COUNT), ...)
are replaced with:	kmalloc_flex(*PTR, FAM, COUNT, ...)

(where TYPE may also be *VAR)

The resulting allocations no longer return "void *", instead returning
"TYPE *".

Signed-off-by: Kees Cook <kees@kernel.org>
2026-02-21 01:02:28 -08:00
Dan Carpenter
6c7860aa28 mtd: spi-nor: hisi-sfc: fix refcounting bug in hisi_spi_nor_register_all()
This was converted to a _scoped() loop but this of_node_put() was
accidentally left behind which is a double free.

Fixes: aa8cb72c20 ("mtd: spi-nor: hisi-sfc: Simplify with scoped for each OF child loop")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-06 15:22:42 +01:00
Krzysztof Kozlowski
aa8cb72c20 mtd: spi-nor: hisi-sfc: Simplify with scoped for each OF child loop
Use scoped for-each loop when iterating over device nodes to make code a
bit simpler.

Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Acked-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-01-19 11:13:43 +01:00
Jakub Czapiga
5008c3ec3f mtd: spi-nor: core: Check read CR support
Some SPI controllers like Intel's one on the PCI bus do not support
opcode 35h. This opcode is used to read the Configuration Register on
SPI-NOR chips that have 16-bit Status Register configured regardless
of the controller support for it. Adding a check call in the setup step
allows disabling use of the 35h opcode and falling back to the manual
Status Registers management.

Before:
openat(AT_FDCWD, "/dev/mtd0", O_RDWR)   = 4
ioctl(4, MIXER_WRITE(6) or MEMUNLOCK, {start=0, length=0x2000000}) = -1
EOPNOTSUPP

After:
openat(AT_FDCWD, "/dev/mtd0", O_RDWR)   = 4
ioctl(4, MIXER_WRITE(6) or MEMUNLOCK, {start=0, length=0x2000000}) = 0
ioctl(4, MIXER_WRITE(5) or MEMLOCK, {start=0x1800000, length=0x800000}) = 0

Suggested-by: Adeel Arshad <adeel.arshad@intel.com>
Signed-off-by: Jakub Czapiga <czapiga@google.com>
Reviewed-by: Pratyush Yadav <pratyush@kernel.org>
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2025-11-18 13:33:18 +01:00
Haibo Chen
7f77c561e2 mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba
The MT35XU02GCBA flash device does not support chip erase, according to
its datasheet. It supports die erase, which means the current driver
implementation will likely need to be converted to use die erase.

Furthermore, similar to the MT35XU01GBBA, the
SPI_NOR_IO_MODE_EN_VOLATILE flag probably needs to be enabled.

Currently no active contributor has access to this hardware so there is
no way of testing the fixes. Add a TODO item on the flash entry so
someone with the flash can test that the support is indeed broken and
send the fixes.

Link: https://datasheet.octopart.com/MT35XU02GCBA1G12-0AAT-Micron-datasheet-138896808.pdf
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
[pratyush@kernel.org: refactor the comment and commit message to make
the purpose of the comment clearer]
Signed-off-by: Pratyush Yadav <pratyush@kernel.org>
2025-11-18 13:04:32 +01:00