UBI:
- Support for a per-device wear-leveling threshold
- Various fixes and cleanups of error paths
- Correctly preserve torture flag up wear-leveling
UBIFS:
- Various fixes and cleanups of error paths and kernel-doc
-----BEGIN PGP SIGNATURE-----
iQJmBAABCABQFiEEdgfidid8lnn52cLTZvlZhesYu8EFAmqRnEsbFIAAAAAABAAO
bWFudTIsMi41KzEuMTEsMiwyFhxyaWNoYXJkQHNpZ21hLXN0YXIuYXQACgkQZvlZ
hesYu8HaKhAAuU11eCVhmQk9jpIdaOnFKwokE/PIj23SRz13jc7PWmFbAIHiaVt4
0p1Xd59kPfdFqsfBo6ZgSr+f0cQu2N1MjzZYSmaklG5iJk2+IuMOIvNdve/GFzNg
X86J7yxLtrCq+ULNNgGv0m89G/uYoFP27Su0rAid4D2T5gYEOisXpPw5AhAL6+bS
FLRMlt0QWCAtb66FmSeDgTW042NPoSCZNOsxF35X9hQ6RxvftB8mbggmTummmlgb
K9Nsuwkarterq7JhS4X+RL6aZG7yDPfHVpdCDD6Ui4W0SP59W0oSokikm1myw6Yg
9NH67jUD03s0y/z3QaNiTVPuQXz5dpUyxGzK/FCT8y2aiycCDmwWF0VG8MVMhC0j
TmNiuSWAljweaPSsgF176ISRG63++zwMGtz/JclVlkUwkVKYFbpEv5lcT0EzfCqh
ahBlpM2aCLgJaYExd6LSVKEu0tT3+x+2MJDnRWcZM2OPMuL65IQw5V2lbdJN78Gb
XFX6bfolhneptc2JwQKJx8E72iW7zuFovprTyS/J+TNcceFbfQTTcFt9EFZaXWnh
+wiWm7rL7Xp9t8MA4Sc979oKFJMkAMl3Z6WTUHJWUZicX2hK+3OQaCVNO8LO/izu
nPanrTeBnRiBKuAc5skQN5ywaAD3GgG/5ERWP/tdHkdsx34pcvuPnHQ=
=+fCs
-----END PGP SIGNATURE-----
Merge tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs
Pull UBI and UBIFS updates from Richard Weinberger:
"UBI:
- Support for a per-device wear-leveling threshold
- Various fixes and cleanups of error paths
- Correctly preserve torture flag up wear-leveling
UBIFS:
- Various fixes and cleanups of error paths and kernel-doc"
* tag 'ubifs-for-linus-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/ubifs:
UBI: support per-device wear-leveling threshold
UBI: fix two issues in the ubi.mtd MODULE_PARM_DESC
mtd: ubi: Release device reference on busy detach
ubi: Fix rollback for explicit UBI device numbers
ubifs: fix out-of-bounds read in signature length check
UBI: fastmap: Pass to_be_tortured when reusing old fastmap PEBs
UBI: Preserve torture flag when rescheduling failed erasures
ubifs: ubifs.h: clean up kernel-doc comments
ubifs: key.h: use correct function parameter name
ubifs: debug.h: fix kernel-doc struct prototypes
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
* SPI NAND changes
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is a high load of misc fixes and
hardening changes, and exceptionally no SPI NOR change.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmqK6JQACgkQJWrqGEe9
VoQa/QgAjuWoPOE1euZlAwwAwje44JZn+FfONyIjUeEfq8SFH9nchfyVpEKF95tU
PF3YkhCCKavD0FNeTPpJoAhEYsqomVQmLLhUg+smoj5ii7Rudihpwn1f+7QpYrXS
jdmWCz3YigILWL3B4CE0GWfUR+GhBH8kF+N+5/rcAddC9XC/22Y/rKKQ7LDcC6TM
AH6OT+1J92lX/rSAyym/BHAmqydN6ZNKe4+LY8kghRd01XNBgMx1a2WoZ4RL+v3a
J7sCoG6YCZE7pm9UqPHQfIWHtDyrTbQKy51jgUNyy8TdbTrhiTwuhO5LgYq/WrS0
Y3PGbxWV0tcvRTaYvzNFCKyaZVjIxg==
=dLT3
-----END PGP SIGNATURE-----
Merge tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull mtd updates from Miquel Raynal:
"Raw NAND changes:
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
SPI NAND changes:
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is a high load of misc fixes and
hardening changes, and exceptionally no SPI NOR change"
* tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits)
mtd: rawnand: sunxi: fix H6/H616 controller timings
mtd: rawnand: sunxi: describe tADL and tWHR delays
mtd: rawnand: sunxi: group controller delay tables
mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP
mtd: rawnand: gpmi: add debugfs entry for BCH geometry
mtd: rawnand: validate ONFI extended parameter page sections
mtd: rawnand: sunxi: add H616 MBUS DMA support
mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles
mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition()
mtd: mpc5121_nfc: use platform for irq and ioremap
mtd: mtdoops: free page bitmap when the backing MTD is removed
mtd: mtdswap: Avoid freeing registered blktrans device twice
mtd: afs: validate v2 image info bounds
mtd: intel-dg: Fix runtime PM error path in probe
mtd: nand-omap2: Move omap_nand_ids[] to raw nand driver
mtd: rawnand: add Toshiba TC58NVG1S3H
mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE()
mtd: rawnand: qcom: Add MDM9607 compatible
mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2
mtd: rawnand: qcom: Make "aon" clock optional
...
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
* SPI NAND changes
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is the usual load of misc fixes and
hardening changes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmp95DkACgkQJWrqGEe9
VoRS+Af+NoNZau3sf27YVygCQT+LWaRQgd1KN2ftk6fbaz+W/V2ZmC5lkSMPyOki
Yln3omlL84lRYIKjZEqq3jZ10V+EPb5x6qFx6uz4OSxvx8LzrQSYCDgMV2hCxNrg
gZSHuEBJb6gsmmACQdU2KqwyUmeVTWrky5+nrj8VPB7Fc1v+fiy63wb6fEWvrfgF
7tH2xZbfQLKuxMIHhli1mPr0Ij9gvUFHa7jNO3w8owv3MLj44xuEAzMmjp2cSqmx
JZGbxkRQMv2Z+kkSVAGkS49ogdZKJ4czabWbsG1BG+GiALFiuqZY1mh/d3wZ5q4f
omeMXnaW+roTjL+C9dewXihsT0PzVQ==
=8+Q/
-----END PGP SIGNATURE-----
Merge tag 'nand/for-7.3' into mtd/next
* Raw NAND changes
- Sunxi: Support added for the H616 compatible
- Qcom: Support added for the MDM9607 compatible
- Support for the Toshiba TC58NVG1S3H part
- GPMI: New debugfs entry to expose the chip geometry
- PL353: Timing updates and software ECC support have been fixed
* SPI NAND changes
- fmsh: Support added for FM25G{01,02}B chips
- HeYangTek: Support added for HYF1GQ4UDACAE
Aside from these main changes, there is the usual load of misc fixes and
hardening changes.
The UBI wear-leveling threshold (CONFIG_MTD_UBI_WL_THRESHOLD) is
currently a compile-time constant shared by all UBI devices. When a
single kernel image must support multiple NAND flashes with different
erase lifetimes, one global threshold cannot suit all devices.
Add a per-device configurable wl_threshold parameter:
- UAPI: add __s32 wl_threshold to struct ubi_attach_req, carved
from the existing padding.
- Module parameter: ubi.mtd gains a new optional token
"wl_threshold":
ubi.mtd=0,0,0,0,0,0,256 ubi.mtd=1,0,0,0,0,0,4096
0 means "use the kernel default", the accepted range is
2-65536.
Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Fix two issues introduced before:
- The parameter format string was missing the enable_fm and
need_resv_pool tokens introduced in an earlier commit.
- The bad-block reservation note was misplaced after Example 5
instead of after Example 3. It was misplaced due to an earlier patch.
Fixes: 83ff59a066 ("UBI: support ubi_num on mtd.ubi command line")
Signed-off-by: Ran Hongyun <ranhongyun1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
ubi_detach_mtd_dev() obtains a device reference through ubi_get_device()
before checking whether the UBI device is busy. The busy return path drops
ubi->ref_count but leaves the device reference held, so the device object
cannot be released after a later detach.
Drop the device reference before returning -EBUSY.
Fixes: 7e84c961b2 ("mtd: ubi: introduce pre-removal notification for UBI volumes")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
ubi_init_attach() rolls back module initialization failures by scanning
ubi_devices[0..i-1], where i is the mtd= parameter index. That assumes
the parameter index matches the UBI device number.
That assumption is not true when mtd= specifies an explicit ubi_num. A
successfully attached device can be stored at a higher ubi_devices[]
slot, and a later failure can miss it during rollback.
Scan the full ubi_devices[] array and detach by the actual array index,
matching the way UBI devices are stored.
Fixes: 83ff59a066 ("UBI: support ubi_num on mtd.ubi command line")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
In ubi_update_fastmap(), when no fresh PEB is available to replace an
old fastmap PEB, the old PEB is reused by erasing it synchronously
via ubi_sync_erase() with the torture flag hardcoded to zero.
However, old_fm->to_be_tortured[] may be non-zero: it is set during
fastmap scanning when ubi_io_read_data()/ubi_io_read_ec_hdr() reports
UBI_IO_BITFLIPS, meaning the PEB showed signs of bit decay and should
be tortured to verify it is still reliable.
When the old PEB is instead returned to the WL sub-system via
ubi_wl_put_fm_peb(), the to_be_tortured flag is honored. The
synchronous reuse path is inconsistent: it silently skips the torture
test for PEBs that exhibited bit-flips.
Fix it by passing &old_fm->to_be_tortured[i] to ubi_sync_erase().
Fixes: dbb7d2a88d ("UBI: Add fastmap core")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
In __erase_worker(), when ubi_sync_erase() returns -EINTR, -ENOMEM,
-EAGAIN, or -EBUSY, the physical eraseblock is rescheduled for erasure
via schedule_erase() with the torture flag hardcoded to 0. This
unconditionally drops the torture request.
If the error occurred before torture_peb() completed (e.g., -ENOMEM
from the ec_hdr allocation in ubi_sync_erase(), errors from
self_check_not_bad()/nor_erase_prepare() in ubi_io_sync_erase(), or
torture_peb() failing mid-test because its internal do_sync_erase()/
ubi_io_read()/ubi_io_write() returned one of the above error codes),
the torture test was never finished. Such a PEB may reach the free
pool without being tortured, defeating the purpose of the torture
test for detecting marginally-bad eraseblocks.
If the error occurred after torture_peb() succeeded (the final
do_sync_erase() in ubi_io_sync_erase() or ubi_io_write_ec_hdr() in
ubi_sync_erase() failed), the torture has already been done and need
not be repeated.
Pass the torture flag by pointer to ubi_sync_erase() and
ubi_io_sync_erase(), and clear it to zero once torture_peb() has
completed successfully. __erase_worker() then forwards the updated
wl_wrk->torture to schedule_erase(): torture already done is dropped,
torture not completed is preserved across the reschedule.
Fixes: 784c145444 ("UBI: fix error handling in erase worker")
Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
The NAND timing calculation assumes that command and address setup and
hold intervals T1-T4, T7 and T11 each take one controller clock. It also
uses the original A10 delay encodings for tWB, tADL, tWHR and tRHW.
The H6/H616 NDFC defines the setup and hold intervals as two internal
clock cycles and uses different delay encodings. Add the H616 timing
characteristics and select them through the controller capability data so
the clock solver and timing fields match the hardware.
Fixes: 88fd4e4dea ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The tADL and tWHR timing fields use four encoded delays, but the driver
currently derives their values with a shift. This hides the actual
controller timing characteristics and lets the clock solver select a
32-cycle delay that the fields cannot encode.
Describe the legacy 7, 15, 23 and 31 cycle thresholds explicitly and use
the tables for both clock selection and field lookup. This prepares the
driver for controllers with different encodings.
Fixes: 88fd4e4dea ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The tWB and tRHW timing field encodings are controller properties, but
they currently live in standalone lookup tables.
Group them in a timing descriptor selected through the controller
capability data. Point every existing controller at the legacy values so
this is a pure preparation change.
Fixes: 88fd4e4dea ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
'select' does not work on config options in a 'choice', so currently it is
possible to enable MTD_PHYSMAP_IXP4XX without MTD_CFI_BE_BYTE_SWAP.
From a previous conversation, it was decided to remove the select entirely:
https://lore.kernel.org/all/c6268184-4904-49d9-b14f-0e11dce8bdad@app.fastmail.com/
This dead select was found by kconfirm, a static analysis tool for Kconfig.
Signed-off-by: Julian Braha <julianbraha@gmail.com>
Link: $URL [1]"
Acked-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Export the BCH geometry parameters via debugfs to aid debugging and
provide the necessary information for legacy kobs-ng tool. The debugfs
directory "gpmi-nand" is created under the root debugfs tree, exposing:
bch_geometry - blob containing the struct bch_geometry fields
raw_mode - flag indicating raw mode status
The implementation is guarded with #ifdef CONFIG_DEBUG_FS to avoid
build failures when debugfs is disabled.
Signed-off-by: Han Xu <han.xu@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
nand_flash_detect_ext_param_page() allocates the length declared by the
ONFI parameter page, then treats the data as a fixed header followed by
variable-length sections. It reads that header and advances over sections
without first proving that the fixed page and each current section fit in
the allocation.
Reject pages shorter than the fixed header, track the remaining variable
area while walking sections, and require the ECC section to contain every
field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics
that identify the malformed ONFI section.
Fixes: 6dcbe0cdd8 ("mtd: get the ECC info from the Extended Parameter Page")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The H616 NAND controller uses a descriptor-based internal MBUS DMA
engine instead of the direct address and count registers used by the
A23/A33 controller. Since the driver does not support these descriptors,
it currently attempts to request an external rxtx DMA channel and falls
back to PIO when none is provided.
Add a single-descriptor backend to the existing ECC page DMA paths.
Allocate the descriptor coherently, constrain data mappings to the
controller's 32-bit address range, program the H6-style data block mask,
and request an interrupt for both command and DMA completion. Keep the
existing external DMA and legacy MBUS DMA paths unchanged, and fall back
to PIO if the descriptor cannot be allocated.
With identical kernels except for this patch, running
flash_speed -d -b 1906 -c 100 /dev/mtd6 on an H616 board with 2 KiB-page
SLC NAND reported:
PIO descriptor DMA
eraseblock write 3365 KiB/s 4192 KiB/s
eraseblock read 6454 KiB/s 16040 KiB/s
page write 3254 KiB/s 4021 KiB/s
page read 6419 KiB/s 15686 KiB/s
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The FM25G01B/FM25G02B datasheets specify a single dummy byte for the
0xEB Quad I/O read-from-cache operation, but the generic
read_cache_variants set uses two dummy bytes for the 1S-4S-4S variant.
The extra dummy byte shifts the data phase and returns corrupted data
with no ECC error, breaking boot on boards using these chips.
Use a dedicated read-from-cache variant set with ndummy=1 for the
1S-4S-4S (0xEB) operation.
FM25G01B datasheet: https://www.fmsh.com/nvm/FM25G01B_ds_eng.pdf
FM25G02B datasheet: https://www.fmsh.com/nvm/FM25G02B_ds_eng.pdf
Fixes: d5a5c9eb2e ("mtd: spinand: fmsh: add support for FM25G{01,02}B")
Cc: stable@vger.kernel.org
Signed-off-by: Aleksandr Mineev <sanderrrs@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
- the revert of the uclinux map driver which was presumably no longer
used but in fact was
- the use of SPI match data to get chip capabilities in the mchp23k256
driver
- several fixes addressing the newly introduced virt-concat support
- a missing build dependency on ndfc
There is as well the usual load (if not actually bigger than ususal) of
uninitialized variables, leaks, double free, and AI fuzzed issues being
fixed.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmpaTeQACgkQJWrqGEe9
VoQ0/Af7BpZ9gxFZrgiXBdQ/XcVDfsrP7YP/3D3SLlB7ynwPHrq0YvMdBs8CCp+b
YbTDqBrt0+T1YeZ4igWu50bGSjAz0mLztE2r09/uwrG9YO+B0s98jXRFEqnaOMMf
2ghhrIKr2RB9OPJaigmtdzQij1UAjCIFpWxEz4XLytXQ5oxnzP2j50JyeVxifb1R
3KDw0KBibngn3I5MUQ4OHCg4+6Krf0rtjo8yZWB6LKgVlCcy3eEbYGZMn3YI3T6T
xsOa8KxkBLf2BeAFu2nDp0e/5vEfaVk9fCnRElBDz3kEdJ6LR6k45mLpqfB+U9HN
DhWZswONu0y54xHAmyauVWyYBK/DHg==
=SD+E
-----END PGP SIGNATURE-----
Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull mtd fixes from Miquel Raynal:
"Among the most important fixes that we have here, there are:
- the revert of the uclinux map driver which was presumed to
be no longer used but in fact was
- the use of SPI match data to get chip capabilities in the
mchp23k256 driver
- several fixes addressing the newly introduced virt-concat
support
- a missing build dependency on ndfc
as well as the usual load (if not actually bigger than usual) of
uninitialized variables, leaks, double free, and AI fuzzed issues
being fixed"
* tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
Revert "mtd: maps: remove uclinux map driver"
mtd: onenand: samsung: report DMA completion timeouts
mtd: rawnand: fsl_ifc: return errors for failed page reads
mtd: mchp23k256: use SPI match data for chip caps
mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout
mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout
mtd: fix double free and WARN_ON in add_mtd_device() error paths
mtd: virt-concat: free duplicate generated name
mtd: nand: mtk-ecc: stop on ECC idle timeouts
mtd: mtdswap: remove debugfs stats file on teardown
mtd: mtdpart: validate partition bounds in mtd_add_partition()
mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path
mtd: rawnand: ndfc: add CONFIG_OF dependency
mtd: spinand: initialize ret in regular page reads
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy()
mtd: rawnand: ingenic: handle ECC clock enable failures
mtd: nand: ecc-mtk: handle ECC clock enable failures
mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins()
mtd: rawnand: ndfc: fix gcc uninitialized var
mtd_add_partition() does not reject the special offset value
MTDPART_OFS_RETAIN (-3), which leads to a WARN_ON in
add_mtd_device() when called through the BLKPG ioctl on NAND
devices. The RETAIN value depends on cur_offset being the end of
the previous partition, but in the dynamic partition path
cur_offset equals the offset argument itself, causing undefined
behavior.
Commit 5daa7b2149 ("mtd: prepare partition add and del functions
for ioctl requests") introduced mtd_add_partition() and correctly
rejected MTDPART_OFS_APPEND (-1) and MTDPART_OFS_NXTBLK (-2),
since those special offsets rely on cur_offset tracking the
previous partition's end. However, commit 1a31368bf9 ("mtd: add a flags
for partitions which should just leave smth. after them")
later added MTDPART_OFS_RETAIN (-3) for the static
partition table path without updating mtd_add_partition() to
also reject this value.
With offset=-3 passed via BLKPG, the RETAIN size calculation in
allocate_partition() underflows (parent_size - 0xFFFFFFFFFFFFFFFD
= parent_size + 3). If the underflow result does not appear to
leave enough space, allocate_partition() jumps to out_register via
goto, skipping erasesize initialization. This results in
erasesize=0, which triggers:
WARN_ON((!mtd->erasesize || !master->_erase) &&
!(mtd->flags & MTD_NO_ERASE))
in add_mtd_device(). If the underflow result appears to leave
enough space, a bogus partition size is calculated, but the
"out of reach" sanity check catches the invalid offset and
creates a disabled empty partition (offset=0, size=0) instead
of returning an error.
Fix this by adding MTDPART_OFS_RETAIN to the rejection list in
mtd_add_partition(), consistent with the existing handling of
APPEND and NXTBLK.
Fixes: 1a31368bf9 ("mtd: add a flags for partitions which should just leave smth. after them")
Signed-off-by: zhouminqiang <zhouminqiang2@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Replace the open-coded of_address_to_resource() plus devm_request_mem_region()
and devm_ioremap() sequence with a single devm_platform_ioremap_resource()
call, which folds the resource lookup, region reservation and mapping into
one step and returns an ERR_PTR on failure, checked with IS_ERR() and
propagated via PTR_ERR().
Switch IRQ acquisition from irq_of_parse_and_map() to platform_get_irq(),
which only retrieves the interrupt the OF/platform core has already set up
rather than transferring mapping ownership to the driver. Drop the now
unneeded of_irq.h include.
This is behaviorally equivalent: the driver already reserved the region
with devm_request_mem_region(), so the non-overlapping reg requirement of
devm_platform_ioremap_resource() was already satisfied.
Drop the now-unused regs_paddr / regs_size locals, which previously only
fed the open-coded request/ioremap calls. Keep the linux/of_address.h
include, as of_iomap() is still used elsewhere in the driver.
Built for PowerPC (mpc512x_defconfig + CONFIG_MTD_NAND_MPC5121_NFC) with
LLVM=1; drivers/mtd/nand/raw/mpc5121_nfc.o compiles cleanly.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtdoops_notify_add() allocates oops_page_used when the configured MTD
device is registered. mtdoops_notify_remove() detaches from that device
but leaves the bitmap allocated. If the same MTD device is later
registered again, the add path allocates a new bitmap and overwrites the
old pointer, leaking one vmalloc allocation per remove/add cycle.
This is only visible when the backing MTD device can disappear and be
registered again while mtdoops remains loaded, so the usual static MTD
case does not expose it.
Free the bitmap after unregistering the dumper and flushing the pending
workers, then clear the pointer and page count before a later attach can
allocate fresh state. Clearing the pointer also keeps the module exit
path from freeing the same bitmap a second time after a remove event.
Fixes: be95745f01 ("mtd: mtdoops: keep track of used/unused pages in an array")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
In mtdswap_add_mtd(), debugfs setup failure after successful blktrans
registration can free mbd_dev twice.
add_mtd_blktrans_dev() initializes the blktrans device reference and
publishes the disk. Once that succeeds, del_mtd_blktrans_dev() tears the
disk down and drops the blktrans reference; when that reference reaches
zero, blktrans_dev_release() frees the mtd_blktrans_dev.
The debugfs failure path called del_mtd_blktrans_dev(mbd_dev), then fell
through the common cleanup label and called kfree(mbd_dev) again. Clear
the local pointer after deregistration so the common cleanup can still
release the mtdswap state without freeing the blktrans object twice.
This issue was found by a static analysis checker and confirmed by
manual source review.
Fixes: e8e3edb95c ("mtd: create per-device and module-scope debugfs entries")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The AFS v2 parser uses footer[8] to locate the image information block
inside the current erase block, then uses the image information
region_count to walk entries from a fixed local array. The footer offset
and region count come from flash contents and are not checked against the
erase block or the local image-info array before use.
Reject v2 entries whose image information offset would underflow the
erase block calculation, and reject region counts that cannot fit in the
local image-info array before walking region entries.
Fixes: b7cf5e2830 ("mtd: afs: add v2 partition parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Acked-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
intel_dg_mtd_probe() allocates region names before enabling runtime PM
and before calling pm_runtime_resume_and_get().
If kasprintf() fails while building a region name, the error path jumps
to err, which calls pm_runtime_put(). At that point there has not been a
successful pm_runtime_resume_and_get() call to balance, so the runtime PM
usage count can underflow.
Jump to err_norpm from the kasprintf() failure path, as the runtime PM
reference has not been acquired yet.
Fixes: 779c59274d ("mtd: intel-dg: Fix accessing regions before setting nregions")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Reviewed-by: Raag Jadav <raag.jadav@intel.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Defining a static array in a header results in each .c file that
includes the header (here: drivers/memory/omap-gpmc.c and
drivers/mtd/nand/raw/omap2.c) to contain a copy of that array when
compiled to an object file.
With sizeof(struct of_device_id[3]) ≥ 588 having omap_nand_ids[] twice
just to do two string comparisons is quite some bloat. So move
omap_nand_ids[] to the nand driver which actually needs that array for
its module meta data and do the compatible check by hand.
bloat-o-meter reports for drivers/memory/omap-gpmc.o (ARCH=arm):
add/remove: 1/2 grow/shrink: 1/0 up/down: 28/-588 (-560)
Function old new delta
gpmc_probe_generic_child 2108 2136 +28
omap_nand_ids 588 - -588
Total: Before=18114, After=17554, chg -3.09%
(drivers/mtd/nand/raw/omap2.o doesn't change).
This allows to drop <linux/mod_devicetable.h> from
include/linux/platform_data/mtd-nand-omap2.h (which is my original
motivation for this change). Note that this header isn't needed in the
two drivers because omap-gpmc.c doesn't use any device id struct and for
the nand driver omap2.c of_device_id is already provided via
<linux/platform_device.h>.
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Without a full-ID entry, the non-ONFI TC58NVG1S3H falls back to the
generic 0xda extended-ID decoding. It is therefore identified only as a
generic 256 MiB Toshiba NAND. Without a model-specific interface
configuration, the core leaves it in the conservative reset timing mode.
Add its full five-byte ID with the datasheet geometry, OOB size and ECC
requirements. Its interface timings match the mode-4-derived profile
already used by the related TH58NVG2S3HBAI4 and TH58NVG3S0HBAI4, so
share that profile and select it for the new model.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The Realtek external ECC engine driver has an OF match table wired into
its platform driver, but the table is not exported with
MODULE_DEVICE_TABLE().
When the driver is built as a module, the missing OF module alias
prevents automatic module loading from the compatible string.
Add the missing MODULE_DEVICE_TABLE() entry.
Fixes: 3148d0e5b1 ("mtd: nand: realtek-ecc: Add Realtek external ECC engine support")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
MDM9607 has QPIC v1.5 that supports the OP_PAGE_READ_ONFI_READ command, but
is missing the rest of the hardware changes in QPIC v2. Add the new
qcom,mdm9607-nand compatible and set it to use has_onfi_read_op without
also setting qpic_version2.
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
QPIC v1.5 requires using the OP_PAGE_READ_ONFI_READ command, but is missing
the rest of the hardware changes that are currently covered by the QPIC v2
(qpic_version2) check in the driver. Split that into an extra
has_onfi_read_op feature flag so it can be separately enabled.
No functional change.
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Some SoCs (e.g. MDM9607, SDX55) have only a single separately controllable
clock for the NAND controller. The actual clocks in the hardware are
managed by the firmware and turned on all together when needed. In this
case, there is no separate "aon" clock that can be described in the device
tree from the OS point of view.
Make the second "aon" clock optional to avoid an error when it is missing.
For platforms that really need it, the dt-bindings are responsible for
validating that.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
RedBoot FIS partition names are stored in a fixed 16-byte field that is
expected to be NUL-terminated. parse_redboot_partitions() used strlen()
to size the names area and later copied the same field with strcpy(), so
a malformed table entry without a terminator could make both operations
read beyond the descriptor.
Validate each accepted FIS name with strnlen() before adding it to the
partition list.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The comment above makes it clear that this is a single element for
legacy handling. Clarify that with struct_size and avoid manual pointer
math.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The uclinux MTD map driver is still actively used on ColdFire (m68k)
platforms. The ColdFire startup code in arch/m68k/coldfire/head.S copies
an attached filesystem blob to _bss_stop, and the uclinux driver picks
it up from there. Most ColdFire defconfigs enable CONFIG_MTD_UCLINUX, as
the driver seems to serve as a replacement for CONFIG_BLK_DEV_INITRD on
these non-MMU targets.
The driver was removed as part of a series cleaning up AMD Élan specific
drivers, but unlike the other three drivers in that series, this driver
seemed to not be as Élan specific (nor unused) as initially thought.
This reverts commit c584b8a7ad.
Reported-by: Greg Ungerer <gregungerer@westnet.com.au>
Closes: https://lore.kernel.org/all/b55ac37f-4523-46d0-8e77-3a17d7235ffe@westnet.com.au/
Acked-by: Arnd Bergmann <arnd@kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The S5PC110 OneNAND DMA helpers have bounded waits for transfer
completion. The polling helper falls out of its timeout loop and returns
success, and the IRQ helper ignores wait_for_completion_timeout().
Return -ETIMEDOUT when the DMA transfer-done bit or completion does not
arrive before the timeout so callers can treat the buffer transfer as
failed.
Fixes: e23abf4b77 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
fsl_ifc_run_command() logs controller timeout and other non-OPC
completion states in ctrl->nand_stat. fsl_ifc_read_page() then only
increments the ECC failure counter for non-OPC status and still returns
max_bitflips, which can be zero.
Return -ETIMEDOUT when the command did not complete at all and -EIO for
other non-OPC read completions so the NAND core does not treat a failed
page read as a clean page.
Fixes: 82771882d9 ("NAND Machine support for Integrated Flash Controller")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The driver stores chip capacity information in both the OF match table
and the SPI id table. Probe currently uses of_device_get_match_data(),
so a non-OF SPI modalias match falls back to mchp23k256_caps even when
the SPI id table selected a different part.
Use spi_get_device_match_data() so SPI id-table driver_data is consumed
when OF match data is absent. This keeps the existing default fallback
while avoiding the wrong MTD geometry for id-table-only matches.
Fixes: 4379075a87 ("mtd: mchp23k256: Add support for mchp23lcv1024")
Cc: stable@vger.kernel.org
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
lpc32xx_xmit_dma() waits for the DMA completion callback but ignores
wait_for_completion_timeout(). A timed out DMA transfer is therefore
unmapped and reported as successful to the NAND read/write path.
Return -ETIMEDOUT when the completion wait expires. Terminate the DMA
channel before unmapping the scatterlist so the timed out transfer cannot
continue to access the buffer after the error is returned.
Fixes: 2944a44da0 ("mtd: add LPC32xx SLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
lpc32xx_xmit_dma() starts a DMA transfer and waits up to one second
for its completion, but it ignores the wait result and returns success
after unmapping the buffer.
A timed out read can therefore return success with incomplete data, and
a timed out write can continue the NAND operation without proof that the
DMA payload reached the controller.
Terminate the DMA channel on timeout, unmap the scatterlist through the
existing cleanup path, and return -ETIMEDOUT to the NAND read/write
callers. Initialize the shared cleanup-path result before using it for
dmaengine_prep_slave_sg() failures.
Fixes: 70f7cb78ec ("mtd: add LPC32xx MLC NAND driver")
Cc: stable@vger.kernel.org
Reviewed-by: Vladimir Zapolskiy <vz@kernel.org>
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
When device_register() or mtd_nvmem_add() fails inside
add_mtd_device() for a partition, the error handling triggers
mtd_release() via put_device() or device_unregister(). mtd_release()
calls release_mtd_partition() which frees the mtd_info structure.
However, callers such as mtd_add_partition() and add_mtd_partitions()
also call free_partition() in their error paths, resulting in a double
free.
Additionally, release_mtd_partition() hits WARN_ON(!list_empty(
&mtd->part.node)) because the partition node is still linked in the
parent's partitions list when the release callback fires from the
add_mtd_device() error path.
Fix this by overriding dev->type and dev->release before put_device()
in the error paths, so that device_release() invokes a no-op function
instead of mtd_release(). For the mtd_nvmem_add() failure case,
device_unregister() is replaced with device_del() to separate the
device removal from the final kobject reference drop, allowing the
override to take effect before put_device() is called.
The callers' error paths (list_del + free_partition) remain the sole
owners of mtd_info lifetime on add_mtd_device() failure, which is the
expected contract.
The normal partition teardown path is not affected: del_mtd_device()
goes through kref_put() -> mtd_device_release() -> device_unregister()
with dev->type still set to &mtd_devtype, so mtd_release() ->
release_mtd_partition() continues to work correctly for the regular
removal case.
Reported-by: syzbot+e9c76b56dc05023b8117@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e9c76b56dc05023b8117
Fixes: 19bfa9ebeb ("mtd: use refcount to prevent corruption")
Signed-off-by: Xue Lei <Xue.Lei@windriver.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Every MTD registration runs mtd_virt_concat_create_join(). Once a
virtual concat has already been registered, the function builds the same
name again and takes the equal-name branch. That branch skips to the
next item without freeing the newly allocated string.
Free the temporary name before continuing.
Fixes: 43db6366fc ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Signed-off-by: Xu Rao <raoxu@uniontech.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.
Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
mtk_ecc_wait_idle() logs when the encoder or decoder does not become
idle, but returns void. Callers can therefore configure a non-idle ECC
engine or read parity bytes after an unconfirmed encoder idle state.
Return the idle poll result and propagate it from the enable and encode
paths that require the engine to be idle before continuing.
Fixes: 1d6b1e4649 ("mtd: mediatek: driver for MTK Smart Device")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtdswap_add_debugfs() creates an mtdswap_stats debugfs file under the
per-MTD debugfs directory, but mtdswap_remove_dev() never removes it
before freeing the mtdswap_dev.
Store the returned dentry and remove it during device teardown before the
driver-private state is freed.
Fixes: a321590246 ("mtd: Add mtdswap block driver")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
They are partially incorrect since "software" engine does not mean
hamming, the "none" cae is also falling into this print, and on-die
means there is some kind of hardware support; we prefer to use the
wording on-host vs. on-die.
Fix all those prints.
Fixes: 1e06dbfdfb ("mtd: rawnand: pl353: Add message about ECC mode")
Signed-off-by: Miquel Raynal (DAVE) <miquel.raynal@bootlin.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Any access not using the hardware ECC engine should be monolithic
because the controller has its very own way of handling the end of a
transaction during operation configuration, so we cannot easily make
repeated reads.
This has the side effect of fixing support for software ECC engines.
Suggested-by: Andrea Scian <andrea.scian@dave.eu>
Cc: stable@vger.kernel.org
Fixes: 08d8c62164 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
Signed-off-by: Miquel Raynal (DAVE) <miquel.raynal@bootlin.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
If several CE are wired, we would write the registers for every chip one
after the other, and reselect the correct timings for the first chip the
use wants to use after probe. This is not exactly efficient and could
slightly be improved since we already have a helper that applies the
configuration if there is a chip change. Instead of programming the
registers in ->setup_interface(), let's just drop the pointer to the
chip and let the nand_select_target() helper do its magic.
Cc: Olivier Sobrie <olivier@sobrie.be>
Signed-off-by: Miquel Raynal (DAVE) <miquel.raynal@bootlin.com>
Acked-by: Olivier Sobrie <olivier@sobrie.be>
Tested-by: Olivier Sobrie <olivier@sobrie.be>
Acked-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The HeYangTek HYF1GQ4UDACAE is a 1 Gbit (128 MiB) SLC SPI-NAND with
2048 + 64 byte pages and on-die 4-bit / 512-byte ECC; its JEDEC
manufacturer ID is 0xc9. The die is GD5F1GQ4-compatible, so the OOB
layout is taken from the in-tree gd5fxgq4xa. The die exposes only a
coarse 2-bit ECC status with no fine-grained bitflip-count register, so
the status is decoded into a representative number of corrected bitflips.
It is found, among others, on some Keenetic KN-3411 (Buddy 6) units.
Datasheet:
https://www.heyangtek.cn/previewfile.jsp?file=ABUIABA9GAAgwsvRnwYo-eDpsgc
Signed-off-by: Aleksei Sviridkin <f@lex.la>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtd_add_partition() checks that 'length' is positive but does not
validate that 'offset + length' fits within the parent partition's
size. A userspace caller using the BLKPG_ADD_PARTITION ioctl can
supply a crafted large 'length' value that passes the length <= 0
check, causing add_mtd_device() to fire a WARN_ON() when it detects
the oversized partition.
Fix this by adding explicit bounds checks before allocate_partition()
is called:
- Reject negative or out-of-range offsets.
- Use u64 arithmetic to safely check offset + length <= parent_size,
avoiding potential signed integer overflow.
Reported-by: syzbot+3ae80219c633aca5431c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
When parsing partition layouts, if a partition requested with
MTDPART_OFS_RETAIN runs out of space, the allocator jumps directly
to 'out_register' to preserve partition numbering.
However, this jump bypasses child->erasesize initialization, leaving
it at zero. When add_mtd_device() is later called on this child, the
registration fails and triggers a WARN_ON() due to the zero ->erasesize.
Fix this by zeroing out child->part.offset and child->part.size, and
initializing child->erasesize to parent->erasesize. This is the exact
same pattern already used just a few lines below in the "out of reach"
error check (child->part.offset >= parent_size) to safely register a
disabled partition.
Reported-by: syzbot+3ae80219c633aca5431c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=3ae80219c633aca5431c
Signed-off-by: Nikolay Ivchenko <nivchenko.dev@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
