Everything:
Total patches: 213
Fixes: tags: 69
cc:stable patches: 43
Reviews/patch: 2.04
Reviewed rate: 86%
Excluding DAMON:
Total patches: 192
Fixes: tags: 63
cc:stable patches: 39
Reviews/patch: 2.18
Reviewed rate: 89%
Excluding DAMON and selftests:
Total patches: 182
Fixes: tags: 57
cc:stable patches: 39
Reviews/patch: 2.23
Reviewed rate: 89%
Summary of series in this merge:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL"
(Lorenzo Stoakes (ARM)):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner to
avoid its fork-dependent timeout command and document the build and
runtime requirements.
- "mm/collapse: separate a collapse from its callers"
(Kiryl Shutsemau (Meta)):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN"
(Lorenzo Stoakes (ARM)):
Provide a common helper for testing whether a VMA has anonymous reverse
mappings. Document the locking rules, annotate intentional concurrent
reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand (Arm)):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport (Microsoft)):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code and
data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths"
(Muchun Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use pagemap
and page flags instead of VMA-boundary assumptions which fail when glibc
has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their IDs.
Move ID references to reparentable objcgs, with the necessary swap
accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios. Fix
a lookup race and split-failure handling, and handle minimum folio orders
for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can also
express free-memory goals without adding separate metrics. Add the sysfs
interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman Khandual):
Use the generic formatter for arm64 page-table entries, ready for future
wider entries. Move the safe-PTE-update check out of the header to avoid
an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations. Free
backing pages before removing their mappings, and share the teardown with
partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes"
(Karl Mehltretter):
Preserve running DAMOS quota state while validating parameter updates.
Even rejected updates could reset accounting and exceed the quota window;
add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and allocations
spanning vmap zones. These allocations were being missed in diagnostic
output.
- "mm: various (urgent?) fixes" (David Hildenbrand (Arm)):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations on
failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add a
regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to its
new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young. Share
hugetlb folio acquisition code and add a regression test for the
previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit"
(SJ Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current memory
pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and zero
effective quotas, which could stop schemes making progress. Add boundary
tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls. The
DMA API already selects the zone from device limits and ignores the
caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false passes
and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds the
right maintainers. Also label the closing hugetlb_cgroup.h include
guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry fix
stops defrag_mode from spinning under memory.low protection; a reported
file-creation stress test ran 5.7 times faster, with far less memory
pressure. Narrower hugetlb invalidations also spare KVM guests needless
refaults: the reported Redis-in-VM P99 QPS penalty while punching holes
fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree huge-page
races with mremap()/munmap() could lose data or access freed memory, and
MADV_COLD could lose a concurrent write's dirty bit. Another fix
prevents stale migration entries from outliving large folios. On
filesystems with blocks smaller than a page, extending a file by 4 GiB
or more could expose bytes written past the old EOF through mmap instead
of zeroes. That is fixed, along with use-after-free races in
PAGEMAP_SCAN during process exit and in memory-cgroup accounting on
PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A further
fix keeps userfaultfd tracking intact on neighboring mappings. NUMA
binding no longer prevents long-term pins when the chosen node has only
movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes with
memory cgroups disabled at boot, notably in small crash kernels.
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCat66sAAKCRDdBJ7gKXxA
jrQrAP99kgSXRdlmRZbHeRBHQ6KvI4XnLvQ78MDIzZ3zmBaOugEA5jiIsK2/snFD
3VaV0oipVZpuwJkVJE6zFkh0tcHgTAo=
=DHrN
-----END PGP SIGNATURE-----
Merge tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm
Pull more MM updates from Andrew Morton:
- "mm: make VMA flag semantics explicit, eliminate VM_SPECIAL" (Lorenzo
Stoakes):
Replace VM_SPECIAL with helpers describing mapping ownership and
behavior. Enforce the mmap flag rules and convert affected drivers,
removing ambiguous tests shared by driver mappings and ordinary
memory.
- "support kselftest on nommu platform" (Hajime Tazaki):
Add opt-in mmap and mremap tests for NOMMU systems. Teach the runner
to avoid its fork-dependent timeout command and document the build
and runtime requirements.
- "mm/collapse: separate a collapse from its callers" (Kiryl
Shutsemau):
Separate huge-page collapse from caller policy. Replace khugepaged
identity checks with explicit permissions, and separate scanning from
collapse with the mmap_lock drop in one place.
- "mm: implement and use vma_has_anon_rmap(), silence KCSAN" (Lorenzo
Stoakes):
Provide a common helper for testing whether a VMA has anonymous
reverse mappings. Document the locking rules, annotate intentional
concurrent reads for KCSAN, and convert the core MM callers.
- "mm/sparse: remove SECTION_MARKED_PRESENT and further cleanups"
(David Hildenbrand):
Remove SECTION_MARKED_PRESENT in favor of the early-section flag.
Simplify sparse memory initialization, section metadata handling and
related PFN validity checks.
- "sh: remove NUMA and SPARSEMEM support" (Mike Rapoport):
Remove SuperH NUMA and SPARSEMEM support. The extra memory banks have
been unusable since the NO_BOOTMEM conversion, leaving only the code
and data overhead.
- "mm: Unify device DAX and HugeTLB vmemmap population paths" (Muchun
Song):
Unify the generic device DAX and HugeTLB vmemmap population paths and
shared tail-page handling. Remove the duplicate DAX machinery while
retaining the powerpc radix implementation.
- "kselftest: mm: fix some failure of split_huge_page_test" (Yeoreum
Yun):
Fix huge-page split tests racing with khugepaged recollapse. Use
pagemap and page flags instead of VMA-boundary assumptions which fail
when glibc has already enabled THP.
- "memcg: move memcgid refcount to objcg to unpin dying memcgs"
(Bingfang Guo):
Let dying memcgs be freed while swapped-out shmem still holds their
IDs. Move ID references to reparentable objcgs, with the necessary
swap accounting and RCU lifetime changes.
- "mm/truncate: fix data loss when truncating straddling large folios"
(Zhang Yi):
Preserve out-of-range data when truncating straddling large folios.
Fix a lookup race and split-failure handling, and handle minimum
folio orders for the forthcoming ext4 iomap buffered I/O path.
- "mm/damon: introduce damos quota goal target metric complement flag"
(SJ Park):
Let DAMOS quota goals use a metric's complement, so utilization can
also express free-memory goals without adding separate metrics. Add
the sysfs interface, documentation and tests.
- "arm64/mm: Standardize printing for pgtable entries" (Anshuman
Khandual):
Use the generic formatter for arm64 page-table entries, ready for
future wider entries. Move the safe-PTE-update check out of the
header to avoid an include cycle.
- "mm: kmsan: fix iounmap metadata teardown" (Dima Koziuk):
Fix KMSAN metadata leaks on iounmap and failed ioremap allocations.
Free backing pages before removing their mappings, and share the
teardown with partial-allocation cleanup.
- "mm/damon/core: preserve quota state when constructing schemes" (Karl
Mehltretter):
Preserve running DAMOS quota state while validating parameter
updates. Even rejected updates could reset accounting and exceed the
quota window; add tests for both accepted and rejected updates.
- "mm/vmalloc: fix vmalloc_dump_obj VA lookup" (Ye Liu):
Fix vmalloc_dump_obj() lookups for last-page addresses and
allocations spanning vmap zones. These allocations were being missed
in diagnostic output.
- "mm: various (urgent?) fixes" (David Hildenbrand):
Fix mmap charge leaks and hugetlb use-after-free, wrong-address
unmapping, stuck locks and endless faults. Also preserve reservations
on failed mremap and handle stale userfaultfd bits.
- "maple_tree: fix maple_range_64 crashes in RCU mode" (Dimitris
Charisis):
Fix pointer and metadata confusion during RCU destruction of
maple_range_64 nodes, avoiding double frees and invalid accesses. Add
a regression test; no in-tree user currently uses this combination.
- "mm: fix hugetlb NR_HUGETLB accounting on folio migration" (Hongfu
Li):
Fix hugetlb migration and preallocation accounting so /proc/vmstat
retains the correct count and memory.numa_stat follows the folio to
its new node.
- "mm/damon: fix a minor bug, clean code, and add a test" (SJ Park):
Fix 32-bit DAMON age overflow which made old regions look young.
Share hugetlb folio acquisition code and add a regression test for
the previously fixed last-region skipping bug.
- "mm/damon/core: cleanup code, reduce stack usage, and add kunit" (SJ
Park):
Reduce kdamond stack usage and remove unused enums. Add deterministic
PSI quota-goal tests which do not depend on the machine's current
memory pressure.
- "mm/damon: fix the temporal goal tuner's size quota conversion"
(Donggeun Yoo):
Bound the temporal tuner's quota conversion to prevent overflow and
zero effective quotas, which could stop schemes making progress. Add
boundary tests.
- "Don't use GFP_DMA when calling dma_alloc_coherent" (Baoquan He):
Remove redundant GFP_DMA flags from coherent DMA allocation calls.
The DMA API already selects the zone from device limits and ignores
the caller's flag.
- "kselftest: mm: fix intermittent failure khugepaged test" (Yeoreum
Yun):
Propagate child-process failures in the khugepaged tests and prevent
background collapse from racing their checks. This removes false
passes and intermittent failures.
- "MAINTAINERS: cover all hugetlb headers under HUGETLB SUBSYSTEM"
(Enze Li):
Cover all hugetlb headers in MAINTAINERS so get_maintainer.pl finds
the right maintainers. Also label the closing hugetlb_cgroup.h
include guard.
Summary of the 65 singletons in this merge:
The singletons include a few worthwhile performance fixes. Avoiding
unnecessary reverse-map tree updates gave a reported 15.9% improvement
in UnixBench's execl test on a 192-core x86 system. A reclaim retry
fix stops defrag_mode from spinning under memory.low protection; a
reported file-creation stress test ran 5.7 times faster, with far less
memory pressure. Narrower hugetlb invalidations also spare KVM guests
needless refaults: the reported Redis-in-VM P99 QPS penalty while
punching holes fell from 7.09% to 1.45%.
Several fixes prevent lost data or corrupted memory. Lazyfree
huge-page races with mremap()/munmap() could lose data or access freed
memory, and MADV_COLD could lose a concurrent write's dirty bit.
Another fix prevents stale migration entries from outliving large
folios. On filesystems with blocks smaller than a page, extending a
file by 4 GiB or more could expose bytes written past the old EOF
through mmap instead of zeroes. That is fixed, along with
use-after-free races in PAGEMAP_SCAN during process exit and in
memory-cgroup accounting on PREEMPT_RT kernels.
Other fixes stop UFFDIO_MOVE spinning forever on pinned large folios,
which could wedge other memory operations, and stop mremap() leaking
commit charges until allocations fail under strict overcommit. A
further fix keeps userfaultfd tracking intact on neighboring mappings.
NUMA binding no longer prevents long-term pins when the chosen node
has only movable memory, fixing QEMU/VFIO startup and io_uring buffer
registration failures. MGLRU also gets a fix for early-boot crashes
with memory cgroups disabled at boot, notably in small crash kernels.
* tag 'mm-stable-2026-10-25-19-27' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (213 commits)
mm: multi-gen LRU: fix NULL lruvec->pgdat deref with memcg disabled on cmdline
mm/page_counter: use WRITE_ONCE() for emin/elow when parent is the root
mm/memcontrol: publish null pointer before dropping css reference
test_maple_tree: test maple_range_64 node in RCU mode
maple_tree: fix maple_range_64 crashes in RCU mode
mm/vma: avoid broken uffd merge on mremap
tools/testing/shared: catch a failed posix_memalign()
mm/damon/core: remove unreachable damos charge_{target,addr}_from
mm/shrinker: allocate shrinker_info_unit from a dedicated kmem_cache
riscv: mm: exclude invalid THP PMDs from page table check
mm/damon/core: filter out damos address filter-split failed region
fs/proc/task_mmu: pin mm_users in do_pagemap_scan()
mm/mempolicy: apply bind policies against the scoped allocation zone
mm/vmscan: reclaim every zone in per-node proactive reclaim
mm/mremap: correctly uncharge accountable VMAs in error path
mm/mremap: populate calculated fields in vrm state correctly
MAINTAINERS: add an entry for MEMORY MANAGEMENT - MEMORY MAP
mm: bdi: reset min_ratio after the sysfs attributes are gone
mm/page_vma_mapped: continue past nonmatching huge PMDs
selftests/mm: skip hugetlb cgroup v2 tests without the needed controllers
...
- Some important fixes were brought to the virt-concat driver.
- An INT0800 firmware-flash map driver was added.
- mtdblock: prevent reclaim I/O during request processing.
- cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
Raw NAND:
- The Qualcomm controller driver has been cleaned up again.
- Arasan and IBM have been improved/created.
- Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken
timings feature on GD9FU2G8F3A.
- Platform data support has been dropped from the lpc32xx drivers.
SPI NAND:
- Heyangtek uses two bytes for the BBM like every other device.
- Winbond: Add support for W25N04LW and W25N08LW.
- Support for ISSI SPI NAND flashes.
SPI NOR:
- Support for new Macronix and (lots of) Winbond flash devices
- The addition of the Winbond flashes was accompanied by a big rewrite
of the status register handling. There were many small helper
functions to enable quad I/O mode in many different ways. That's now
consolidated in one generic function.
- The SFPD handling was reworked. It used to be only parsed for flashes
present in the in-kernel database which had any of the multi-I/O bit
set - or with the addition of generic flash driver for any unknown
flashes. This left a gap where SFDP wasn't handled and it turns out
newer flashes (with SFDP support) will reused IDs of just these old
flashed. With the rework, SFDP is tried to be parsed for any flashes
and will amend the information which is already present in the
in-kernel database.
- SFDP size limit was increased to 16KiB. There are flashes which have
some larger gaps between tables and thus exceeds the former 4KiB
limit.
- Flash fixups are getting more and more common. Due to this, the fixups
are now a separate list (per manufacturer) instead of being attached
to a specific flash. A new .match() callback makes them more flexible,
when one is applied.
- 1-1-8 and 1-8-8 modes are now supported with larger flashes which
needs 4byte addresses.
Then there is the load of API updates and misc AI fixes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmrbkigACgkQJWrqGEe9
VoRBUwf7BuPGKsMuEp7FEIaXEWUjW7vjRY5LTSuRvFzx7TvcY8tJuApaJYKL8MVp
x9pyr1bBKqO4f2GjvfjjqSZEX1ZcoPrhvyXs50yX4s+BHyRgEo3beYQ/hMn90/uL
6CN24MrlaGAnvrci7ZKY2ueZ882y7Zdqfgl9rrDXV6wyAM/O2um6Fy4eGogKAy9M
TqmD5EMXb9qwFGqcEeZ2FS/xZGa1Rea+2gxa9E2W0ZoWjC/W9yYJ/skvxNcC4mFv
Ey8o6KMVHMEVcdD949A7Vls45PXi5vkn/FYwoWxOpaInjKW/u/QNB9Vd6cmhBWIY
3TgO9TBMUC10JxDjyifcTb6LsZ0Cqg==
=5LzC
-----END PGP SIGNATURE-----
Merge tag 'mtd/for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull MTD updates from Miquel Raynal:
"Core MTD:
- Fixes to the virt-concat driver
- Added INT0800 firmware-flash map driver
- mtdblock: prevent reclaim I/O during request processing
- cfi_cmdset_0002: cap the write-buffer chunk at 256 bytes on an x8 device
Raw NAND:
- Clean up the Qualcomm controller driver again
- Improve / create Arasan and IBM
- Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken
timings feature on GD9FU2G8F3A
- Drop platform data support from the lpc32xx drivers
SPI NAND:
- Heyangtek uses two bytes for the BBM like every other device
- Winbond: Add support for W25N04LW and W25N08LW
- Support for ISSI SPI NAND flashes
SPI NOR:
- Support for new Macronix and (lots of) Winbond flash devices
- Rewrite the status register handling. There were many small helper
functions to enable quad I/O mode in many different ways. That's
now consolidated in one generic function.
- Rework the SFPD handling. It used to be only parsed for flashes
present in the in-kernel database which had any of the multi-I/O
bit set - or with the addition of generic flash driver for any
unknown flashes. This left a gap where SFDP wasn't handled and it
turns out newer flashes (with SFDP support) will reused IDs of just
these old flashed. With the rework, SFDP is tried to be parsed for
any flashes and will amend the information which is already present
in the in-kernel database.
- Increase SFDP size limit to 16KiB. There are flashes which have
some larger gaps between tables and thus exceeds the former 4KiB
limit.
- Flash fixups are getting more and more common. Due to this, the
fixups are now a separate list (per manufacturer) instead of being
attached to a specific flash. A new .match() callback makes them
more flexible, when one is applied.
- Support 1-1-8 and 1-8-8 modes with larger flashes which need 4byte
addresses
Then there is the load of API updates and misc AI fixes"
* tag 'mtd/for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (155 commits)
mtd: spi-nor: sfdp: reduce stack usage in spi_nor_parse_sfdp()
mtd: spi-nor: sfdp: fix missing kernel-doc
mtd: parsers: qcom: fix offset/size overflow on large partitions
mtd: spinand: heyangtek: Reserve both bad block marker bytes
mtd: rawnand: pl353: fix clk reference leak in pl35x_nfc_setup_interface()
mtd: nand: use dmaengine_submit() instead of ->tx_submit()
dt-bindings: mtd: convert IBM NDFC binding to YAML
mtd: rawnand: fsl_ifc: allocate shared ctrl with devm_kzalloc
mtd: rawnand: qcom: fix read location register usage in config_nand_cw_read()
mtd: rawnand: qcom: move common code to the 'qpic_common' module
mtd: rawnand: qcom: rename 'nand_stats' structure
mtd: rawnand: qcom: make nandc_set_read_loc_last() more generic
mtd: rawnand: qcom: make nandc_set_read_loc_first() more generic
mtd: rawnand: qcom: make config_nand_cw_write() more generic
mtd: rawnand: qcom: make config_nand_page_write() more generic
mtd: rawnand: qcom: make config_nand_page_read() more generic
mtd: rawnand: qcom: make check_flash_errors() more generic
dt-bindings: mtd: arasan: Add "power-domains" for ZynqMP
mtd: virt-concat: unlink discarded items before freeing
mtd: virt-concat: unlink concat node before freeing it
...
dma_alloc_coherent() allocates the DMA buffer with the device's addressing
limitation in mind; the DMA core picks the zone from the device's coherent
DMA mask and ignores GFP_DMA passed by the caller. Use GFP_KERNEL instead
so the allocation may reclaim as usual for probe-time allocations.
Link: https://lore.kernel.org/20260903111836.1777265-13-hebaoquan@kylinos.cn
Signed-off-by: Baoquan He <hebaoquan@kylinos.cn>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Harry Yoo <harry@kernel.org>
SPI NOR changes for 7.4
- Support for new Macronix and (lots of) Winbond flash devices
- The addition of the Winbond flashes was accompanied by a big rewrite of the
status register handling. There were many small helper functions to enable
quad I/O mode in many different ways. That's now consolidated in one generic
function.
- The SFPD handling was reworked. It used to be only parsed for flashes present
in the in-kernel database which had any of the multi-I/O bit set - or with the
addition of generic flash driver for any unknown flashes. This left a gap
where SFDP wasn't handled and it turns out newer flashes (with SFDP support)
will reused IDs of just these old flashed. With the rework, SFDP is tried to
be parsed for any flashes and will amend the information which is already
present in the in-kernel database.
- SFDP size limit was increased to 16KiB. There are flashes which have some
larger gaps between tables and thus exceeds the former 4KiB limit.
- Flash fixups are getting more and more common. Due to this, the fixups are now
a separate list (per manufacturer) instead of being attached to a specific
flash. A new .match() callback makes them more flexible, when one is applied.
- 1-1-8 and 1-8-8 modes are now supported with larger flashes which needs 4byte
addresses.
- The Qualcomm controller driver has been cleaned up again.
- Arasan and IBM have been improved/created.
- Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken
timings feature on GD9FU2G8F3A.
- Platform data support has been dropped from the lpc32xx drivers.
SPI NAND:
- Heyangtek uses two bytes for the BBM like every other device.
- Winbond: Add support for W25N04LW and W25N08LW.
- Support for ISSI SPI NAND flashes.
Then there is the load of API updates and misc AI fixes.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmrbj2oACgkQJWrqGEe9
VoRTzwf+NmPfqwnoCAzGjX6FpvDHfM8GHW5MjmqqAZ0ogX3lOyj+ysCqa4LgQbJO
w2KPGE5zy3K4NmcXYlpjH9kJ0HReQltDL5/C3pb6vMDzWm6TRlScdeG/BYYiHf0q
lCQEPZA6gbd1Jwp0is6Q6QEJR3JfuAZACL+4Dv6sBLAPf1/f5Q0mJ/v3br/rL0rM
01cLr39DhzeKMSKUR9TVYayCU0VoLOvNEmZOHB/v4UGF7vWP0vLv4hTygBGXl8oP
S7pJzSytuB4edre7MKbEl49APeDw4fXiSnjKCcmZ6i3Xv15SnLcxJLQybZePtUSF
7bLGL7MEvB2Vi34k2koO7uP0ipWdyQ==
=+FCW
-----END PGP SIGNATURE-----
Merge tag 'nand/for-7.4' into mtd/next
Raw NAND:
- The Qualcomm controller driver has been cleaned up again.
- Arasan and IBM have been improved/created.
- Reflect that ESMT and GigaDevice share ID 0xc8, and disable broken
timings feature on GD9FU2G8F3A.
- Platform data support has been dropped from the lpc32xx drivers.
SPI NAND:
- Heyangtek uses two bytes for the BBM like every other device.
- Winbond: Add support for W25N04LW and W25N08LW.
- Support for ISSI SPI NAND flashes.
Then there is the load of API updates and misc AI fixes.
ubi_get_ec_info() checks the user's erase_counters array with
access_ok() and then fills it one entry at a time with __put_user(),
taking the wear-leveling lock for each entry in between. Each of those
accesses enables and disables user access on its own, so the up-front
check saves nothing.
Use put_user(). The access_ok() stays, so a bad array still fails
before anything is written.
This is part of getting rid of __get_user() and __put_user() entirely.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Two large spi_nor_flash_parameter structures on a function stack
are really too much, and this can exceed an otherwise reasonable
frame limit:
drivers/mtd/spi-nor/sfdp.c: In function 'spi_nor_parse_sfdp':
drivers/mtd/spi-nor/sfdp.c:1717:1: error: the frame size of 1600 bytes is larger than 1536 bytes [-Werror=frame-larger-than=]
Allocate both rollback copies on the heap and use structure copies
for type safety.
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Suggested-by: David Laight <david.laight.linux@gmail.com>
Fixes: d20029474a ("mtd: spi-nor: push the rollback mechanism into the sfdp module")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
Commit 69d9d7dabb ("mtd: spi-nor: move spi_nor_post_bfpt_fixups() into
sfdp") added the kernel-doc but missed one description for bfpt. Fix it.
While at it, also add documentation for the return value.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202610040802.yD5XKM5i-lkp@intel.com/
Fixes: 69d9d7dabb ("mtd: spi-nor: move spi_nor_post_bfpt_fixups() into sfdp")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
In parse_qcomsmem_part() the partition offset and size are computed as
parts[j].offset = le32_to_cpu(pentry->offset) * mtd->erasesize;
parts[j].size = le32_to_cpu(pentry->length) * mtd->erasesize;
Both le32_to_cpu() and mtd->erasesize are 32-bit (u32). The multiply is
therefore evaluated in 32-bit arithmetic and the product is truncated to
32 bits before being widened and stored into the 64-bit (u64)
parts[j].offset / parts[j].size fields, so the 64-bit destinations are
never used at their full width.
The SMEM partition table is firmware-provided and the per-entry offset
and length are not bounds-checked against the device geometry (only
numparts is capped). On a sufficiently large flash, a partition whose
(offset|length) * erasesize is >= 2^32 gets a silently truncated
offset/size and is mapped to the wrong region of the master MTD, which
can overlap or extend into an unintended area.
Cast one operand to u64 so the multiplication is performed in 64-bit and
the result fits the 64-bit fields without truncation.
Found by static analysis tool CodeQL.
Fixes: 803eb124e1 ("mtd: parsers: Add Qcom SMEM parser")
Cc: stable@vger.kernel.org
Assisted-by: LLM codeql
Signed-off-by: Weigang He <geoffreyhe2@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Keep the two bytes read by the SPI-NAND bad-block check out of the free
OOB region. This is a separate MTD fix, compiled but not exercised
through OOB writes on hardware.
Assisted-by: LLM
Signed-off-by: Navid Ghahremani <ghahramani.navid@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
pl35x_nfc_setup_interface() obtains a reference to the SMC "memclk" with
of_clk_get_by_name() and only uses it to read the clock rate. The
reference is never released: the function has many early return paths
and no clk_put() call anywhere, so the clock reference is leaked.
The hook is invoked repeatedly by the NAND core (nand_reset(),
nand_setup_interface() and the NAND_DATA_IFACE_CHECK_ONLY mode probing
loops), so the reference count keeps growing.
Release the clock reference with clk_put() as soon as its rate has been
read.
Fixes: 08d8c62164 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller")
Assisted-by: DeepSeek-V4.1-Flash
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Replace direct dma_async_tx_descriptor->tx_submit() calls with the
proper dmaengine_submit() API wrapper.
Assisted-by: LLM
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Allocate the shared fsl_ifc_nand_ctrl structure against the controller
device, which outlives all NAND child devices, so it is freed
automatically. This drops the manual kfree() and the broken chip
counter that was decremented in remove() but never incremented
anywhere, leaking the structure and leaving the freed pointer in
ctrl->nand on re-probe.
Assisted-by: LLM
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
On QPIC v2 controllers, when the last codeword is being read, the read
location values must be programmed into the READ_LOCATION_LAST_CW_*
registers. Prior to commit 8c52932da5 ("mtd: rawnand: qcom: cleanup
qcom_nandc driver"), the config_nand_cw_read() function did it right,
but since then it always writes the read location values to the
READ_LOCATION_* registers even if the actual codeword is the last one.
Change the function to always configure the registers corresponding to
the actual codeword to restore the correct behaviour.
Cc: stable@vger.kernel.org
Fixes: 8c52932da5 ("mtd: rawnand: qcom: cleanup qcom_nandc driver")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The 'qpic_common' module provides some generic functions which are
usable by both the 'qcom_nandc' and by the 'spi-qpic-snand' driver.
Move more code from the 'qcom_nandc' driver to there in order to
allow using those also from the 'spi-qpic-snand' driver.
No functional changes.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Give 'read_stats' structure a 'qcom_nandc' prefix to indicate that
it corresponds to the Qualcomm NAND driver. The definition is going
to be moved into a common header this helps to avoid global namespace
pollution/collision.
No functional changes. This is in preparation of moving the declaration
into the 'nand-qpic-common.h' header to allow reusing it from the
'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'nand_chip' pointer as a parameter but it is
only used to extract a pointer to the nand controller's private
structure from that.
In order to make the function more generic, change the declaration
to get a 'qcom_nandc_controller' pointer directly, and update the
callers accordingly. While at it, also change the function name to
use a 'qcom_nandc' prefix.
No functional changes intended. This is in preparation of moving
the function into the 'qpic_common' code to allow reusing it from
the 'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'nand_chip' pointer as a parameter but it is
only used to extract a pointer to the nand controller's private
structure from that.
In order to make the function more generic, change the declaration
to get a 'qcom_nandc_controller' pointer directly, and update the
callers accordingly. While at it, also change the function name to
use a 'qcom_nandc' prefix.
No functional changes intended. This is in preparation of moving
the function into the 'qpic_common' code to allow reusing it from
the 'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'nand_chip' pointer as a parameter but it is
only used to extract a pointer to the nand controller's private
structure from that.
In order to make the function more generic, change the declaration
to get a 'qcom_nandc_controller' pointer directly, and update the
callers accordingly. While at it, also change the function name to
use a 'qcom_nandc' prefix.
No functional changes intended. This is in preparation of moving
the function into the 'qpic_common' code to allow reusing it from
the 'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'nand_chip' pointer as a parameter but it is
only used to extract a pointer to the nand controller's private
structure from that.
In order to make the function more generic, change the declaration
to get a 'qcom_nandc_controller' pointer directly, and update the
callers accordingly. While at it, also change the function name to
use a 'qcom_nandc' prefix.
No functional changes intended. This is in preparation of moving
the function into the 'qpic_common' code to allow reusing it from
the 'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'nand_chip' pointer as a parameter but it is
only used to extract a pointer to the nand controller's private
structure from that.
In order to make the function more generic, change the declaration
to get a 'qcom_nandc_controller' pointer directly, and update the
callers accordingly. While at it, also change the function name to
use a 'qcom_nandc' prefix.
No functional changes intended. This is in preparation of moving
the function into the 'qpic_common' code to allow reusing it from
the 'spi-qpic-snand' driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The function gets a 'qcom_nand_host' pointer as a parameter but it is
only used to extract the nand controller's private structure from that.
In order to make the function more generic, change the declaration to
get a 'qcom_nandc_controller' pointer directly, and update the callers
accordingly.
While at it, also change the function name to use a 'qcom_nandc' prefix.
No functional changes. This is in preparation of moving the function
into the 'qpic_common' code to allow reusing it from the 'spi-qpic-snand'
driver.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
SPI NAND.
There are also a couple of behavioral fixes (mutex issue in SPI-NOR,
spurious bitflips on vf610_nfc, OOB bytes count in SPI NAND and
cfi_cmdset stack usage).
The rest is mostly AI fuzzing results.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmq2jKYACgkQJWrqGEe9
VoQF9wf/YKgt7426T84TBS694LkaEtN75AnH5kRvdUGllcrmKMradZj1ucpNRpH4
lozVHfU88Ry923J9R9/KFChsiE27WxmQ523Ht9sHraTxybwpUuNGX4j9xz20U/6E
XFAEFIFnIWMX1oAG+6d5x57jddRmR8qVntMTLCp08B1oozRDZRvkXjRAQXHhI7wp
OuRIUm/E0KGEsfU0CzB3g0LYeL5V0eySEOg15PXSXfrpPBX1npkkcynoui02nCCB
eGMfghgOHnoFcqF0PTfXrbBJraJbjixbaUn2dVCMkUnNiUy2SjKGdxpUoAgn2FYL
/WwvIBfNwn3GT7K/xJea/efHnMRdig==
=P0Hj
-----END PGP SIGNATURE-----
Merge tag 'mtd/fixes-for-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull MTD fixes from Miquel Raynal:
"The most important set of fixes are around the handling of the QE bit
in SPI NAND.
There are also a couple of behavioral fixes (mutex issue in SPI-NOR,
spurious bitflips on vf610_nfc, OOB bytes count in SPI NAND and
cfi_cmdset stack usage).
The rest is mostly AI fuzzing results"
* tag 'mtd/fixes-for-7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:
mtd: spinand: Do not update the QE bit on devices without one
mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()
mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ
mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages
mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB
mtd: spinand: fix zero oobavail when no ECC engine is used
mtd: spinand: fix NULL pointer dereference with no ECC engine
mtd: mtd_intel_dg: reset poll counter for each erase
mtd: cfi_cmdset_0001: shrink do_write_buffer() stack frame
mtd: core: call _get_device() with the master MTD
mtd: core: avoid double-free of OTP NVMEM device
mtd: spinand: Enable QE on all dies
mtd: block2mtd: Fix divide error when erase_size is zero
Commit be0b86c648 ("mtd: spinand: Gather all the bus interface
steps in one single function") moved quad-enable setup into
spinand_configure_chip(). The new code only determines whether quad
mode is needed when SPINAND_HAS_QE_BIT is set, but calls
spinand_init_quad_enable() unconditionally. This clears configuration
register bit 0 on devices without a QE bit.
That bit is not universally a QE bit. On the Winbond W25N02KV it is
H-DIS, which disables the active-low HOLD function. Clearing H-DIS
enables HOLD during single and dual I/O operations. If IO3 is not kept
high, the flash can pause a command and ignore clock and data.
H-DIS is not restored by the FFh reset command, allowing the incorrect
state to survive an SoC warm reboot while the flash remains powered.
Before the refactoring, spinand_init_quad_enable() returned without
touching the configuration register on devices without
SPINAND_HAS_QE_BIT. Restore that behavior by only calling the helper
when the flag is set.
Return zero explicitly once SSDR configuration completes, as all errors
are returned immediately. This avoids returning an uninitialized value
when neither optional configuration step runs.
The regression was reproduced on a JioRouter JIDU6401 with an MT7986
SoC and a W25N02KV. With Linux 6.18.44, sysupgrade failed and the
following warm reboot hung in BL2. With this change applied, both
sysupgrade and warm reboot completed successfully.
Fixes: be0b86c648 ("mtd: spinand: Gather all the bus interface steps in one single function")
Cc: stable@vger.kernel.org
Suggested-by: Miquel Raynal <miquel.raynal@bootlin.com>
Assisted-by: LLM
Signed-off-by: Sagnik Sasmal <sagnik@sagnik.me>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtd_virt_concat_destroy_items() frees each item without removing it
from concat_node_list. list_for_each_entry_safe() protects the
current traversal, but concat_node_list still points to the freed
items afterward.
The function also unwinds errors from mtd_virt_concat_node_create().
A later initialization can traverse a freed item in
mtd_is_part_concat(), causing a use-after-free.
Unlink each item before freeing it.
Fixes: 43db6366fc ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtd_virt_concat_create_item() links each new mtd_virt_concat_node to
concat_node_list. mtd_virt_concat_destroy() later frees the node after
destroying its concatenated MTD device, but fails to unlink it. A later
list traversal dereferences the freed node, causing a use-after-free.
Remove the node from concat_node_list before freeing it.
Fixes: 43db6366fc ("mtd: Add driver for concatenating devices")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6, smatch
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
CONCAT() currently recovers the enclosing struct mtd_concat by casting
its embedded struct mtd_info pointer. This assumes mtd remains the first
member of the structure.
Use container_of_const() with the named member to make the relationship
explicit and preserve any const qualifier.
Suggested-by: Luca Ceresoli <luca.ceresoli@bootlin.com>
Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Add a read-only mapping driver that binds the ACPI INT0800 "Intel
82802 firmware hub" device and exposes the system firmware flash as an
MTD ROM device.
On x86 machines the boot flash is decoded into the physical address
space below 4 GB, so a plain ioremap() of the declared resource window
is sufficient for reads - no SPI or LPC controller access is needed.
The window may be larger than the real flash; undecoded holes read as
0xff.
This gives userspace a clean, safe way to read firmware flash contents
without flashrom or relaxed /dev/mem access - for firmware analysis,
and for extracting option ROMs stored inside EFI firmware volumes
(e.g. the NVIDIA VBIOS on EFI-booted Apple machines, which can then be
fed to nouveau via nouveau.config=NvBios=). There is deliberately no
write or erase support.
Tested on a MacBookPro4,1 (ICH8M): /dev/mtd0 reads are byte-identical
to a flashrom dump of the 2 MiB SST25VF016B, except for live NVRAM
variable-store regions.
Signed-off-by: Stephen Bancroft <stevereaver@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The blktrans request callbacks run under dev->lock and may allocate
memory with GFP_KERNEL. For example, mtdblock_writesect() uses vmalloc()
to allocate its eraseblock cache. Direct reclaim can then recurse into
block I/O and deadlock on resources held by the request being processed.
syzbot reports a circular locking dependency involving the device mutex
and fs_reclaim.
Commit d5ba1c8ffd ("mtd: don't use PF_MEMALLOC") removed PF_MEMALLOC
from the MTD request thread. That flag had prevented direct reclaim,
so its removal made allocations during request processing eligible for
reclaim without excluding I/O.
Wrap request processing in mtd_queue_rq() in a NOIO scope. This covers
both the request and background callbacks, including allocations made
by lower MTD drivers, and prevents reclaim from initiating filesystem
or block I/O.
Fixes: d5ba1c8ffd ("mtd: don't use PF_MEMALLOC")
Assisted-by: Codex:gpt-6-astra
Reported-by: syzbot+e08e0a15269eefa87790@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=e08e0a15269eefa87790
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Replace direct dma_chan::device::dev access with the proper
dmaengine_get_dma_device() for consumer API.
chan->device->dev is not always the device used for DMA mapping.
Some DMA engines support per-channel IOMMU mappings, so different
channels may use different DMA devices. dmaengine_get_dma_device()
returns the correct device for each channel.
This also prepares for making the DMA engine provider data structures
private. DMA consumers should not access DMA engine internals directly.
Assisted-by: LLM
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The code checks whether master has get_wunit() but still calls
it on the child. Fix this.
Fixes: 46b5889cc2 ("mtd: implement proper partition handling")
Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtd_get_sb() is called with a reference to the MTD device already
taken by the caller. When sget_dev() fails, the function returns the
error without dropping that reference, so the device is never released
and its refcount never reaches zero. Every mount attempt on an MTD
device whose superblock cannot be set up leaks a reference.
Restore the put_mtd_device() that the fs_context conversion dropped on
this path.
Fixes: 0f07100410 ("mtd: Provide fs_context-aware mount_mtd() replacement")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The PIIX4 PM device reference taken with pci_get_device() is dropped
again before the iobase resource is allocated. If pci_assign_resource()
fails, the error path calls pci_dev_put() on pm_dev a second time,
releasing a reference that is no longer owned and underflowing the
reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
init_l440gx() takes a single reference on the PIIX4 ISA bridge with
pci_get_device() and drops it again right after the lookups, before
the flash window is set up. The pci_assign_resource() failure path
then calls pci_dev_put() on the same device a second time, releasing a
reference that is no longer owned and underflowing the reference count.
Remove the extra pci_dev_put().
Fixes: dd8e9ed6ed ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
init_amd76xrom() obtains the PCI device with pci_get_device() and
hands the reference over to amd76xrom_init_one(), which stores it in
window->pdev. When reserving the ROM window fails, that function
returns -EBUSY directly instead of going through amd76xrom_cleanup(),
so the reference is neither released nor cleared.
Drop the reference and clear window->pdev on that path.
Fixes: dd8e9ed6ed ("[MTD] Switch to pci_get_device and do ref counting")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The Write to Buffer command takes the number of words to program minus
one, and do_write_buffer() sends that count as a single bus word:
map_write(map, CMD(words - 1), cmd_adr);
CMD() replicates the value into every device lane, so each device reads
the count off its own data lines - eight of them on an x8 part. A count
that does not fit in eight bits is truncated there, which limits one
Write to Buffer to 256 words on an x8 device, however large a buffer the
chip advertises in its CFI query.
The M29EW on a Cavium Octeon CN6335 board (an x16 part strapped to x8)
advertises MaxBufWriteSize = 512 bytes, so cfi_amdstd_write_buffers()
split the data into 512-byte chunks and do_write_buffer() sent a count of
511. The chip saw 511 & 0xff = 255, expected 256 bytes, and aborted the
program when the 257th arrived. Chunks below 256 bytes - the leading
partial chunk of a write - completed normally, so only the full-size ones
failed:
MTD do_write_buffer_wait(): software timeout, address:0x03278bff.
jffs2: Write of 4164 bytes at 0x02c789b4 failed. returned -5, retlen 68
jffs2: No space for garbage collection. Aborting GC thread
Clamp MaxBufWriteSize for x8 devices in the write-buffer fixup, and
recompute mtd->writebufsize, which cfi_cmdset_0002_setup() derives from
MaxBufWriteSize before the fixups run.
The clamp deliberately keys off the device width rather than the part,
even though the driver already recognises this one in is_m29ew(): the
ceiling comes from the width of a device's data bus, not from the chip,
so any x8 device advertising a larger buffer is told a count it cannot
receive. The M29EW is only where it was found.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-5
Signed-off-by: Orgad Shaneh <orgads@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
mtd_pci_probe() leaves the PCI device enabled on later probe failure and
mtd_pci_remove() does not disable it either. Use pcim_enable_device() to
release the enable reference after the existing map and region cleanup.
The imbalance is already present in the initial Git import.
This issue was identified during our ongoing static-analysis research
while reviewing kernel code.
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Co-developed-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Ijae Kim <ae878000@gmail.com>
Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
JEDEC manufacturer ID 0xc8 is used by both ESMT and GigaDevice, so
nand_esmt.c handles chips from both vendors. Chips from either
vendor are currently reported as "ESMT", which is misleading when
debugging a GigaDevice part.
Rename the manufacturer entry to "ESMT/GigaDevice" and document the
collision next to the NAND_MFR_ESMT definition. The only behavioural
change is the manufacturer name printed at detection time.
Signed-off-by: Peter-Simon Dieterich <peter-simon.dieterich@vaillant-group.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
GigaDevice and ESMT share JEDEC manufacturer ID 0xc8, so GigaDevice raw
NAND chips are handled by the ESMT manufacturer code.
The GD9FU2G8F3A advertises SET/GET_FEATURES support in its parameter
page, but its implementation of the timing mode feature is broken:
GET_FEATURES(TIMING_MODE) reads back a value that does not match the
mode previously written, which causes the following error during
boot:
nand: timing mode 5 not acknowledged by the NAND chip
and falls back to timing mode 0.
GigaDevice confirmed that the chip is compatible with all timing modes
advertised in its parameter page, that SET_FEATURE(TIMING_MODE) is not
required to enter them, and that it may be ignored by the chip. The
timing mode is therefore a host-side concern only, and the readback
value carries no information.
Unflag the feature for this model so the core configures the
controller and skips both the SET and GET, mirroring what
nand_macronix.c does for the MX30LF AC series.
Tested on a custom board with an imx6ull using gpmi-nand, this
restores timing mode 5 operation and sequential reads improve from
7 MiB/s to 20 MiB/s.
Signed-off-by: Peter-Simon Dieterich <peter-simon.dieterich@vaillant-group.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
atmel_nand_controller_init() takes a reference to the MCK clock with
of_clk_get() and keeps it in nc->mck for the lifetime of the
controller. If the "atmel,smc" phandle is missing or the SMC regmap
cannot be obtained afterwards, the error path jumps to out_release_dma
which only releases the DMA channel, so the clock reference is leaked.
The callers return the error directly and never run
atmel_nand_controller_cleanup(), where the clock is normally put.
Release the reference on those error paths. The path on which
of_clk_get() itself fails keeps jumping to out_release_dma, as nc->mck
only holds an error pointer there.
Fixes: f9ce2eddf1 ("mtd: nand: atmel: Add ->setup_data_interface() hooks")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
ma35_nand_probe() gets and enables the NAND clock with
devm_clk_get_enabled(), but the ma35_nand_chips_init() failure path
also calls clk_disable() before returning.
devm_clk_get_enabled() registers a managed cleanup that calls
clk_disable_unprepare() on probe failure and driver removal. Calling
clk_disable() explicitly first drops the clock enable count, so the
managed cleanup attempts to disable the clock again and triggers the
clock framework warning for an already disabled clock.
Remove the redundant clk_disable() and let the managed clock cleanup
handle the clock state.
This issue was found by manual code inspection.
Fixes: 5abb5d414d ("mtd: rawnand: nuvoton: add new driver for the Nuvoton MA35 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Add support for the W25N08LW, a 1.8V 8Gbit SPI-NAND made of two
4Gbit LUNs, with 4096-byte pages and 256 bytes of spare area.
The chip reuses the KV ECC status helper, but needs its own OOB
layout because the geometry of its spare area differs from the
existing Winbond parts. Only half of it is visible while the
internal ECC is enabled, so the ECC region is reported as
inaccessible and just the free bytes are exposed.
Assisted-by: Claude:Opus-5
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Replace the manual kasprintf() in probe with devm_kasprintf() so the
name is freed automatically on driver removal, and drop the now
unnecessary kfree() in fsl_ifc_chip_remove() and its leftover mtd
local.
Assisted-by: opencode:big-pickle
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Convert the mtd->name allocation from kasprintf() plus a manual kfree()
in the error path and in ndfc_remove() to the managed
devm_kasprintf() helper. The name is now released automatically with
the device, removing the need for explicit cleanup.
Assisted-by: opencode:hy3-free
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Commit af2792abd4 ("mtd: spi-nor: sfdp: get the 1-1-8 and 1-8-8
protocol from SFDP") taught the core to discover octal read support
from BFPT, but the 4-Byte Address Instruction Table parser was never
extended accordingly.
Parse the 1-1-8 and 1-8-8 page program bits of 4BAIT DWORD1 and set the
corresponding 4-byte opcodes, so that octal writes stay available once
the flash switches to the 4-byte address instruction set.
This is in preparation of adding support for the ISSI IS25WX01G, a
1 Gbit octal flash which is beyond the 3-byte address range and
advertises 4-byte 1-1-8 and 1-8-8 page program instructions.
Signed-off-by: Nuno Sá <nuno.sa@analog.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
There is an ID collision with chips of same density from the JW family
(which it self conflicted with yet another family). Chips are very
similar in practice, it is mostly a matter of electrical differences
(mostly power consumption being lower) as well as the addition of inline
ECC capability.
16 bytes chunks are protected against single errors. In case a
non-aligned write happens, ECC is locally disabled until the next erase.
Another significant difference is that PW chips identify themselves as
supporting the new SFDP (rev F) QER field which forces an alternate
write SR2 opcode (0x31).
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
There is an ID collision with chips of same density from the JW family
(which it self conflicted with yet another family). Chips are very
similar in practice, it is mostly a matter of electrical differences
(mostly power consumption being lower) as well as the addition of inline
ECC capability.
16 bytes chunks are protected against single errors. In case a
non-aligned write happens, ECC is locally disabled until the next erase.
Another significant difference is that PW chips identify themselves as
supporting the new SFDP (rev F) QER field which forces an alternate
write SR2 opcode (0x31).
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
There is an ID collision with chips of same density from the JW family
(which it self conflicted with yet another family). Chips are very
similar in practice, it is mostly a matter of electrical differences
(mostly power consumption being lower) as well as the addition of inline
ECC capability.
16 bytes chunks are protected against single errors. In case a
non-aligned write happens, ECC is locally disabled until the next erase.
Another significant difference is that PW chips identify themselves as
supporting the new SFDP (rev F) QER field which forces an alternate
write SR2 opcode (0x31).
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
There is an ID collision with chips of same density from the JW family
(which it self conflicted with yet another family). Chips are very
similar in practice, it is mostly a matter of electrical differences
(mostly power consumption being lower) as well as the addition of inline
ECC capability.
Unlike the other (bigger) densities from the PW family, this part has no
ECC support.
Another significant difference is that PW chips identify themselves as
supporting the new SFDP (rev F) QER field which forces an alternate
write SR2 opcode (0x31).
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Michael Walle <mwalle@kernel.org>
