Using the mtd_nandbiterrs module for testing the driver occasionally
results in weird things like below.
1. swiotlb mapping fails with the following message:
[ 85.926216] qcom_snand 79b0000.spi: swiotlb buffer is full (sz: 4294967294 bytes), total 512 (slots), used 0 (slots)
[ 85.932937] qcom_snand 79b0000.spi: failure in mapping desc
[ 87.999314] qcom_snand 79b0000.spi: failure to write raw page
[ 87.999352] mtd_nandbiterrs: error: write_oob failed (-110)
Rebooting the board after this causes a panic due to a NULL pointer
dereference.
2. If the swiotlb mapping does not fail, rebooting the board may result
in a different panic due to a bad spinlock magic:
[ 256.104459] BUG: spinlock bad magic on CPU#3, procd/2241
[ 256.104488] Unable to handle kernel paging request at virtual address ffffffff0000049b
...
Investigating the issue revealed that these symptoms are results of
memory corruption which is caused by out of bounds access within the
driver.
The driver uses a dynamically allocated structure for BAM transactions,
which structure must have enough space for all possible variations of
different flash operations initiated by the driver. The required space
heavily depends on the actual number of 'codewords' which is calculated
from the pagesize of the actual NAND chip.
Although the qcom_nandc_alloc() function allocates memory for the BAM
transactions during probe, but since the actual number of 'codewords'
is not yet know the allocation is done for one 'codeword' only.
Because of this, whenever the driver does a flash operation, and the
number of the required transactions exceeds the size of the allocated
arrays the driver accesses memory out of the allocated range.
To avoid this, change the code to free the initially allocated BAM
transactions memory, and allocate a new one once the actual number of
'codewords' required for a given NAND chip is known.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Reviewed-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250618-qpic-snand-avoid-mem-corruption-v3-1-319c71296cda@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
A small set of updates that came in during the merge window, we've got:
- Some small fixes for the Broadcom and spi-pci1xxxx drivers
- A change to the QPIC SNAND driver to flag that the error correction
features are less useful than people might be expecting.
- A new device ID for the SOPHGO SG2042.
- The addition of Yang Shen as a Huawei maintainer.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCgAdFiEEreZoqmdXGLWf4p/qJNaLcl1Uh9AFAmhBmMAACgkQJNaLcl1U
h9BvAwf/dkfLLmAUNPhex0hQaj8aKbiN3NWMRbZPApPAdy+s9u3d6zW1BlZI6liK
97PEgxQ1d60lxwKdPiYjhLuJTDGeEDSsGTUI5OXqz2hW08mfYQaRN96xZKwJf67G
8y8u3rEZLbDs0vKorf3TG8KHTj1lBbfl9GwwzEFQlMUNdEDXnBadd+C08PMwIhdR
PYJrARKV3aZ4GhaQwF6JsvLV2JomQ/ALES4RaW8hDgDdzjiqda0fKV0YWDZwa8E1
08Pea9uUr78iAoohqO6rCQBqWCFms8HEpgz2NerY2CGMhrjnA64XTfSyRNp9q2O5
gllrngHhluRPl2vM3JuO3fdiVk+xmA==
=dFS2
-----END PGP SIGNATURE-----
Merge tag 'spi-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi
Pull more spi updates from Mark Brown:
"A small set of updates that came in during the merge window, we've
got:
- Some small fixes for the Broadcom and spi-pci1xxxx drivers
- A change to the QPIC SNAND driver to flag that the error correction
features are less useful than people might be expecting
- A new device ID for the SOPHGO SG2042
- The addition of Yang Shen as a Huawei maintainer"
* tag 'spi-v6.16-merge-window' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
spi: spi-qpic-snand: document the limited bit error reporting capability
spi: bcm63xx-hsspi: fix shared reset
spi: bcm63xx-spi: fix shared reset
MAINTAINERS: Update HiSilicon SFC driver maintainer
MAINTAINERS: Update HiSilicon SPI Controller driver maintainer
spi: dt-bindings: spi-sg2044-nor: Add SOPHGO SG2042
spi: spi-pci1xxxx: Fix Probe failure with Dual SPI instance with INTx interrupts
register a master device. This is a problem that has been there forever:
the "master" device was not always present depending on a number of
heuristics such as the presence of fixed partitions and the absence of a
Kconfig symbol to force its presence. This was a problem for runtime PM
operations which might not have the "master" device available in all
situation.
The SPI NAND subsystem has seen the introduction of DTR operations (the
equivalent of DDR transfers), which involved quite a few preparation
patches for clarifying macro names.
In the raw NAND subsystem, the brcmnand driver has been "fixed" for old
legacy SoCs with an update of the ->exec_op() hook, there has been the
introduction of a new controller driver named Loongson-1, and the
Qualcomm driver has received quite a few misc fixes as well as a new
compatible.
Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP
table fixups for Macronix MX25L3255E have been merged.
Aside from this, there is the usual load of misc improvement, fixes,
and yaml conversion.
-----BEGIN PGP SIGNATURE-----
iQEzBAABCAAdFiEE9HuaYnbmDhq/XIDIJWrqGEe9VoQFAmg91NEACgkQJWrqGEe9
VoR8egf+JPTtykQ+Bip9bHStgfpxi0+OKL81PUuPBsbs5C546u5t6ZRhoPsU+KqL
ZTyUk3ys7HcSwZCuiS9V6ea6TNV1FvAVZm+ONpkuPnU60++z8YfVr8ZvtgT0IUXx
COi+5ksdsTFZMyRG+VybRKnYNrTYB7j7CqVL8ifxq1XYWnYdhjy5PH4DgAKnBhGL
523kN2eR85AhvJ4aulsKbcqQQYKvJIQbhjAKklA3yQVarDmoOdiSmndoZlRy+MDu
B9DaRMvRRa/g1nI0stvR9K7FtdSrMYTg4kowR9jPRx0zEZXFFsZbASgcC+3G7HdK
7rLFWrN+G6fitcEjeAnfyV+sKF48LA==
=tW1t
-----END PGP SIGNATURE-----
Merge tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux
Pull MTD updates from Miquel Raynal:
"A big core MTD change is the introduction of a new class to always
register a master device. This is a problem that has been there
forever: the "master" device was not always present depending on a
number of heuristics such as the presence of fixed partitions and the
absence of a Kconfig symbol to force its presence. This was a problem
for runtime PM operations which might not have the "master" device
available in all situation.
The SPI NAND subsystem has seen the introduction of DTR operations
(the equivalent of DDR transfers), which involved quite a few
preparation patches for clarifying macro names.
In the raw NAND subsystem, the brcmnand driver has been "fixed" for
old legacy SoCs with an update of the ->exec_op() hook, there has been
the introduction of a new controller driver named Loongson-1, and the
Qualcomm driver has received quite a few misc fixes as well as a new
compatible.
Finally, Macornix SPI NOR entries have been cleaned-up and some SFDP
table fixups for Macronix MX25L3255E have been merged.
Aside from this, there is the usual load of misc improvement, fixes,
and yaml conversion"
* tag 'mtd/for-6.16' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (42 commits)
mtd: rawnand: brcmnand: legacy exec_op implementation
mtd: rawnand: sunxi: Add randomizer configuration in sunxi_nfc_hw_ecc_write_chunk
mtd: nand: brcmnand: fix NAND timeout when accessing eMMC
mtd: nand: sunxi: Add randomizer configuration before randomizer enable
mtd: spinand: esmt: fix id code for F50D1G41LB
mtd: rawnand: brcmnand: remove unused parameters
mtd: core: always create master device
mtd: rawnand: loongson1: Fix inconsistent refcounting in ls1x_nand_chip_init()
mtd: rawnand: loongson1: Fix error code in ls1x_nand_dma_transfer()
mtd: rawnand: qcom: Fix read len for onfi param page
mtd: rawnand: qcom: Fix last codeword read in qcom_param_page_type_exec()
mtd: rawnand: qcom: Pass 18 bit offset from NANDc base to BAM base
dt-bindings: mtd: qcom,nandc: Document the SDX75 NAND controller
mtd: bcm47xxnflash: Add error handling for bcm47xxnflash_ops_bcm4706_ctl_cmd()
mtd: rawnand: Use non-hybrid PCI devres API
mtd: nand: ecc-mxic: Fix use of uninitialized variable ret
mtd: spinand: winbond: Add support for W35N02JW and W35N04JW chips
mtd: spinand: winbond: Add octal support
mtd: spinand: winbond: Add support for W35N01JW in single mode
mtd: spinand: winbond: Rename DTR variants
...
The QPIC hardware is not capable of reporting the exact number of the
corrected bit errors, it only reports the number of the corrected bytes.
Document this behaviour in the code, and also issue a warning message
to inform the user about it.
No functional changes.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250527-qpic-snand-limited-biterr-caps-v1-1-61f7cf87be1e@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge series from Gabor Juhos <j4g8y7@gmail.com>:
The two patches in the series are extending the usage of FIELD_PREP()
macro and predefined bitmasks usage in the driver.
When submitting of the descriptors fails, it is quite likely that
the register read buffer contains no valid data. Even if the data
is valid the function returns with an error code anyway.
Change the code to return early if qcom_submit_descs() fails to
avoid superfluously copying possibly invalid data.
Also change the return statement at the end of the function to use
zero value to indicate success obviusly.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250515-qpic-snand-early-error-v1-1-681c87611213@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The qcom_spi_check_error() function determines the errors of a previous
page read operation solely by using the cached register values in the
register read buffer. The data pointed by the 'data_buf' and the 'oob_buf'
parameters are not used for that at all.
Remove the superfluous parameters of the function along with the related
local variables to simplify the code. Also, remove the variables from the
caller functions which became unused due to the change.
Note:
Althought the similar parse_read_errors() function in the 'qcom_nand'
driver has the same parameters, but that function passes down the
pointers to check_for_erased_page() at the end of the function.
It is not clear, that a similar call is missing here, or the superfluous
parameters are simply leftovers of the development process. Nevertheless,
if additional code is needed, the parameters can be added back later.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250520-qpic-snand-superfluous-params-v1-1-86dd4963e90f@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The qcom_spi_check_raw_flash_errors() function can be used to
verify the flash status after raw operations.
Move the function slightly up in the code and change the
qcom_spi_read_last_cw() function to call it instead of using
an open coded implementation of the same check.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250514-qpic-snand-error-check-v1-1-c0ebd3aae72a@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Large part of the code uses the FIELD_PREP() macro already to construct
values to be written to hardware registers. Change the code to use also
the macro for more registers of which the corresponding bitmasks are
defined already.
This makes the code more readable. It also syncs the affected
codes with their counterparts in the 'qcom_nandc' driver, so it
makes it easier to spot the differences between the two
implementations.
No functional changes intended.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Link: https://patch.msgid.link/20250515-qpic-snand-use-bitmasks-v1-2-11729aeae73b@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Change the code to use the already defined CW_PER_PAGE_MASK
bitmask along with the FIELD_PREP() macro instead of using
magic values.
This makes the code more readable. It also syncs the affected
codes with their counterparts in the 'qcom_nandc' driver, so it
makes it easier to spot the differences between the two
implementations.
No functional changes intended.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Link: https://patch.msgid.link/20250515-qpic-snand-use-bitmasks-v1-1-11729aeae73b@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Merge series from Haibo Chen <haibo.chen@nxp.com>:
PATCH1/3/4 to clean up the code, make the code more readable
PATCH2 add the runtime pm support
PATCH5 use devm_add_action_or_reset() to replace remove() callback, this can avoid
oops when do bind/unbind test
The precomputed value for the NAND_READ_LOCATION_2 register should be
stored in 'snandc->regs->read_location2'.
Fix the qcom_spi_set_read_loc_first() function accordingly.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Link: https://patch.msgid.link/20250428-qpic-snand-readloc2-fix-v1-1-50ce0877ff72@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The BAM command descriptor provides only 18 bits to specify the BAM
register offset. Additionally, in the BAM command descriptor, the BAM
register offset is supposed to be specified as "(NANDc base - BAM base)
+ reg_off". Since, the BAM controller expecting the value in the form of
"NANDc base - BAM base", so that added a new field 'bam_offset' in the NAND
properties structure and use it while preparing the command descriptor.
Previously, the driver was specifying the NANDc base address in the BAM
command descriptor.
Cc: stable@vger.kernel.org
Fixes: 8d6b6d7e13 ("mtd: nand: qcom: support for command descriptor formation")
Tested-by: Lakshmi Sowjanya D <quic_laksd@quicinc.com>
Signed-off-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Acked-by: Mark Brown <broonie@kernel.org>
Tested-by: Gabor Juhos <j4g8y7@gmail.com> # on IPQ9574
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
The qcom_spi_block_erase() function returns with error in case of
failure. Change the qcom_spi_send_cmdaddr() function to propagate
these errors to the callers instead of returning with success.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Link: https://patch.msgid.link/20250423-qpic-snand-propagate-error-v1-1-4b26ed45fdb5@gmail.com
Reviewed-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
The qcom_spi_ecc_init_ctx_pipelined() function allocates zeroed
memory for the OOB buffer, then it fills the buffer with '0xff'
bytes right after the allocation. In this case zeroing the memory
during allocation is superfluous, so use kmalloc() instead of
kzalloc() to avoid that.
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250320-qpic-snand-kmalloc-v1-1-94e267550675@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
SPI_QPIC_SNAND is the only driver that selects MTD instead of depending
on it, which could lead to circular dependencies. Moreover, as
SPI_QPIC_SNAND is bool, this forces MTD (and various related symbols) to
be built-in, as can be seen in an allmodconfig kernel.
Except for a missing semicolon, there is no reason why SPI_QPIC_SNAND
cannot be tristate; all MODULE_*() boilerplate is already present.
Hence make SPI_QPIC_SNAND tristate, let it depend on MTD, and add the
missing semicolon.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/b63db431cbf35223a4400e44c296293d32c4543c.1742998909.git.geert+renesas@glider.be
Signed-off-by: Mark Brown <broonie@kernel.org>
When the allocation of the OOB buffer fails, the
qcom_spi_ecc_init_ctx_pipelined() function returns without freeing
the memory allocated for 'ecc_cfg' thus it can cause a memory leak.
Call kfree() to free 'ecc_cfg' before returning from the function
to avoid that.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://patch.msgid.link/20250313-qpic-snand-memleak-fix-v1-1-e54e78d1da3a@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
The ECC_CFG_ECC_DISABLE define is BIT(0). It's supposed to be used
directly instead of used as a shifter.
Fixes: 7304d19090 ("spi: spi-qpic: add driver for QCOM SPI NAND flash Interface")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/2f4b0a0b-2c03-41c0-8a4a-3d789a83832d@stanley.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
This driver implements support for the SPI-NAND mode of QCOM NAND Flash
Interface as a SPI-MEM controller with pipelined ECC capability.
Co-developed-by: Sricharan Ramabadhran <quic_srichara@quicinc.com>
Signed-off-by: Sricharan Ramabadhran <quic_srichara@quicinc.com>
Co-developed-by: Varadarajan Narayanan <quic_varada@quicinc.com>
Signed-off-by: Varadarajan Narayanan <quic_varada@quicinc.com>
Signed-off-by: Md Sadre Alam <quic_mdalam@quicinc.com>
Link: https://patch.msgid.link/20250224111414.2809669-3-quic_mdalam@quicinc.com
Signed-off-by: Mark Brown <broonie@kernel.org>
