summaryrefslogtreecommitdiffstats
path: root/drivers/mtd
AgeCommit message (Collapse)AuthorLines
10 daysMerge tag 'mtd/for-7.1' of ↵Linus Torvalds-309/+779
git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux Pull MTD updates from Miquel Raynal: "MTD changes: - mtdconcat finally makes it in, after several years of being merged and reverted - Baikal SoC support is being removed, so MTD bits are being removed as well - misc cleanups NAND changes: - SunXi driver support for new versions of the Allwinner NAND controller. - DT-binding improvements and cleanups. - A few fixes (Realtek ECC and Winbond SPI NAND), aside with the usual load of misc changes. SPI NOR fixes: - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup since 7f77c561e227 ("mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba") but did not add it due to lack of hardware to test on. - Fix locking on some Winbond w25q series flashes. - Fix Auto Address Increment (AAI) writes on SST that flashes that start on odd address. The write enable latch needs to be set again after the single byte program" * tag 'mtd/for-7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (44 commits) mtd: spinand: winbond: Declare the QE bit on W25NxxJW mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBA mtd: spi-nor: winbond: Fix locking support for w25q256jw mtd: spi-nor: sst: Fix write enable before AAI sequence mtd: spi-nor: winbond: Fix locking support for w25q64jvm mtd: spi-nor: winbond: Fix locking support for w25q256jwm dt-bindings: mtd: mxc-nand: add missing compatible string and ref to nand-controller-legacy.yaml dt-bindings: mtd: gpmi-nand: ref to nand-controller-legacy.yaml dt-bindings: mtd: refactor NAND bindings and add nand-controller-legacy.yaml mtd: spinand: winbond: Clarify when to enable the HS bit mtd: rawnand: sunxi: introduce maximize variable user data length mtd: rawnand: sunxi: fix typos in comments mtd: rawnand: sunxi: change error prone variable name mtd: rawnand: sunxi: remove dead code mtd: rawnand: sunxi: make the code more self-explanatory mtd: rawnand: sunxi: replace hard coded value by a define - take2 mtd: rawnand: sunxi: do not count BBM bytes twice mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oob mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarification mtd: cmdlinepart: use a flexible array member ...
10 daysMerge tag 'nand/for-7.1' into mtd/nextMiquel Raynal-110/+351
The main changes happened in the SunXi driver in order to support new versions of the Allwinner NAND controller. There are also some DT-binding improvements and cleanups. Finally a couple of actual fixes (Realtek ECC and Winbond SPI NAND), aside with the usual load of misc changes.
10 daysMerge tag 'spi-nor/for-7.1' into mtd/nextMiquel Raynal-17/+35
SPI NOR changes for 7.1 There is only a collection of bugfixes this time around, with no notable changes to the core. Some of the more noteworthy bugfixes listed below. - Enable die erase on MT35XU02GCBA. We knew this flash needed this fixup since 7f77c561e227 ("mtd: spi-nor: micron-st: add TODO for fixing mt35xu02gcba") but did not add it due to lack of hardware to test on. - Fix locking on some Winbond w25q series flashes. - Fix Auto Address Increment (AAI) writes on SST that flashes that start on odd address. The write enable latch needs to be set again after the single byte program.
11 daysMerge tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linuxLinus Torvalds-1/+23
Pull MIPS updates from Thomas Bogendoerfer: - Support for Mobileye EyeQ6Lplus - Cleanups and fixes * tag 'mips_7.1' of git://git.kernel.org/pub/scm/linux/kernel/git/mips/linux: (30 commits) MIPS/mtd: Handle READY GPIO in generic NAND platform data MIPS/input: Move RB532 button to GPIO descriptors MIPS: validate DT bootargs before appending them MIPS: Alchemy: Remove unused forward declaration MAINTAINERS: Mobileye: Add EyeQ6Lplus files MIPS: config: add eyeq6lplus_defconfig MIPS: Add Mobileye EyeQ6Lplus evaluation board dts MIPS: Add Mobileye EyeQ6Lplus SoC dtsi clk: eyeq: Add Mobileye EyeQ6Lplus OLB clk: eyeq: Adjust PLL accuracy computation clk: eyeq: Skip post-divisor when computing PLL frequency pinctrl: eyeq5: Add Mobileye EyeQ6Lplus OLB pinctrl: eyeq5: Use match data reset: eyeq: Add Mobileye EyeQ6Lplus OLB MIPS: Add Mobileye EyeQ6Lplus support dt-bindings: soc: mobileye: Add EyeQ6Lplus OLB dt-bindings: mips: Add Mobileye EyeQ6Lplus SoC MIPS: dts: loongson64g-package: Switch to Loongson UART driver mips: pci-mt7620: rework initialization procedure mips: pci-mt7620: add more register init values ...
2026-04-13MIPS/mtd: Handle READY GPIO in generic NAND platform dataLinus Walleij-1/+23
The callbacks into the MIPS RB532 platform to read the GPIO pin indicating that the NAND chip is ready are oldschool and does not assign GPIOs as properties to the NAND device. Add a capability to the generic platform NAND chip driver to use a GPIO line to detect if a NAND chip is ready and override the platform-local drv_ready() callback with this check if the GPIO is present. This makes it possible to drop the legacy include header <linux/gpio.h> from the RB532 devices. Signed-off-by: Linus Walleij <linusw@kernel.org> Acked-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
2026-04-10mtd: spinand: winbond: Declare the QE bit on W25NxxJWMiquel Raynal-2/+2
Factory default for this bit is "set" (at least on the chips I have), but we must make sure it is actually set by Linux explicitly, as the bit is writable by an earlier stage. Fixes: 6a804fb72de5 ("mtd: spinand: winbond: add support for serial NAND flash") Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-04-05mtdchar: replace deprecated mmap hook with mmap_prepare, clean upLorenzo Stoakes (Oracle)-18/+3
Replace the deprecated mmap callback with mmap_prepare. Commit f5cf8f07423b ("mtd: Disable mtdchar mmap on MMU systems") commented out the CONFIG_MMU part of this function back in 2012, so after ~14 years it's probably reasonable to remove this altogether rather than updating dead code. Link: https://lkml.kernel.org/r/d036855c21962c58ace0eb24ecd6d973d77424fe.1774045440.git.ljs@kernel.org Signed-off-by: Lorenzo Stoakes (Oracle) <ljs@kernel.org> Acked-by: Richard Weinberger <richard@nod.at> Acked-by: Vlastimil Babka (SUSE) <vbabka@kernel.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Alexandre Torgue <alexandre.torgue@foss.st.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: Arnd Bergmann <arnd@arndb.de> Cc: Bodo Stroesser <bostroesser@gmail.com> Cc: Christian Brauner <brauner@kernel.org> Cc: Clemens Ladisch <clemens@ladisch.de> Cc: David Hildenbrand <david@kernel.org> Cc: David Howells <dhowells@redhat.com> Cc: Dexuan Cui <decui@microsoft.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: Haiyang Zhang <haiyangz@microsoft.com> Cc: Jan Kara <jack@suse.cz> Cc: Jann Horn <jannh@google.com> Cc: Jonathan Corbet <corbet@lwn.net> Cc: K. Y. Srinivasan <kys@microsoft.com> Cc: Liam Howlett <liam.howlett@oracle.com> Cc: Long Li <longli@microsoft.com> Cc: Marc Dionne <marc.dionne@auristor.com> Cc: "Martin K. Petersen" <martin.petersen@oracle.com> Cc: Maxime Coquelin <mcoquelin.stm32@gmail.com> Cc: Michal Hocko <mhocko@suse.com> Cc: Mike Rapoport <rppt@kernel.org> Cc: Miquel Raynal <miquel.raynal@bootlin.com> Cc: Pedro Falcato <pfalcato@suse.de> Cc: Ryan Roberts <ryan.roberts@arm.com> Cc: Suren Baghdasaryan <surenb@google.com> Cc: Vignesh Raghavendra <vigneshr@ti.com> Cc: Wei Liu <wei.liu@kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
2026-03-31mtd: spi-nor: micron-st: Enable die erase support for MT35XU02GCBAHaoyu Lu-13/+4
The MT35XU02GCBA flash device does not support chip erase according to its datasheet, but supports die erase. The existing code had a TODO comment noting that the SPI_NOR_IO_MODE_EN_VOLATILE flag probably needs to be enabled and the driver implementation needs to be converted to use die erase. This patch enables the SPI_NOR_IO_MODE_EN_VOLATILE flag and adds the mt35_two_die_fixups to the MT35XU02GCBA entry, which includes the micron_st_nor_two_die_late_init() function that sets up die erase support. With these changes, the flash device can properly use die erase operations instead of chip erase. Signed-off-by: Haoyu Lu <hechushiguitu666@gmail.com> Reviewed-by: Pratyush Yadav (Google) <pratyush@kernel.org> [pratyush@kernel.org: drop the whole comment instead of just the TODO line] Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30mtd: spi-nor: winbond: Fix locking support for w25q256jwEliav Farber-0/+1
The Winbond w25q256jw device: - Supports lock/unlock via SR. - Has Top/Bottom (TB) protect bit. - Uses Status Register bit 6 as the Top/Bottom (TB) protect bit. - Supports four Block Protect (BP) bits. Update the flash parameters by enabling SPI_NOR_HAS_LOCK, SPI_NOR_HAS_TB, SPI_NOR_TB_SR_BIT6 and SPI_NOR_4BIT_BP. Without these flags, the locking configuration is incorrect. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1 Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Michael Walle <mwalle@kernel.org> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30mtd: spi-nor: sst: Fix write enable before AAI sequenceSanjaikumar V S-0/+13
When writing to SST flash starting at an odd address, a single byte is first programmed using the byte program (BP) command. After this operation completes, the flash hardware automatically clears the Write Enable Latch (WEL) bit. If an AAI (Auto Address Increment) word program sequence follows, it requires WEL to be set. Without re-enabling writes, the AAI sequence fails. Add spi_nor_write_enable() after the odd-address byte program when more data needs to be written. Use a local boolean for clarity. Fixes: b199489d37b2 ("mtd: spi-nor: add the framework for SPI NOR") Cc: stable@vger.kernel.org Signed-off-by: Sanjaikumar V S <sanjaikumar.vs@dicortech.com> Tested-by: Hendrik Donner <hd@os-cillation.de> Reviewed-by: Hendrik Donner <hd@os-cillation.de> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30mtd: spi-nor: winbond: Fix locking support for w25q64jvmEliav Farber-0/+1
The Winbond w25q64jvm supports block protection through the Status Register (SR) and provides a Top/Bottom (TB) protection bit. Enable SPI_NOR_HAS_LOCK and SPI_NOR_HAS_TB for this device to properly describe its locking capabilities. The device uses Status Register bit 5 as the TB bit and supports only three Block Protect (BP) bits. Therefore, do not set SPI_NOR_TB_SR_BIT6 or SPI_NOR_4BIT_BP. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q64JV.1 Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Michael Walle <mwalle@kernel.org> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-30mtd: spi-nor: winbond: Fix locking support for w25q256jwmEliav Farber-1/+1
The Winbond w25q256jwm device supports four Block Protect (BP) bits and uses Status Register bit 6 as the Top/Bottom (TB) protect bit. Update the flash parameters by enabling SPI_NOR_4BIT_BP and SPI_NOR_TB_SR_BIT6. Without these flags, the locking configuration is incorrect. Reference: https://www.winbond.com/hq/support/documentation/levelOne.jsp?__locale=en&DocNo=DA00-W25Q256JW.1 Signed-off-by: Eliav Farber <farbere@amazon.com> Reviewed-by: Michael Walle <mwalle@kernel.org> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-25mtd: spinand: winbond: Clarify when to enable the HS bitMiquel Raynal-5/+8
Above 104MHz when in fast dual or quad I/O reads, the delay between address and data cycles is too short. It is possible to reach higher frequencies, up to 166MHz, by adding a few more dummy cycles through the setting of the HS bit. Improve the condition for enabling this bit, and also make sure we set it at soon as we go over 104MHz. Fixes: f1a91175faaa ("mtd: spinand: winbond: Enable high-speed modes on w25n0xjw") Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: introduce maximize variable user data lengthRichard Genoud-62/+255
In Allwinner SoCs, user data can be added in OOB before each ECC data. For older SoCs like A10, the user data size was the size of a register (4 bytes) and was mandatory before each ECC step. So, the A10 OOB Layout is: [4Bytes USER_DATA_STEP0] [ECC_STEP0 bytes] [4bytes USER_DATA_STEP1] [ECC_STEP1 bytes] ... NB: the BBM is stored at the beginning of the USER_DATA_STEP0. Now, for H6/H616 NAND flash controller, this user data can have a different size for each step. So, we are maximizing the user data length to use as many OOB bytes as possible. Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller") Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: fix typos in commentsRichard Genoud-2/+2
Fix lenghts -> lengths and chuncks -> chunks Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: change error prone variable nameRichard Genoud-5/+6
In sunxi_nand_hw_ecc_ctrl_init(), i is used as a loop index variable and at the same time as the value used to set ECC mode in ECC control register. To prevent it from being re-used as a loop variable, let's change the naming to ecc_mode. No functional change. Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: remove dead codeRichard Genoud-14/+7
sunxi_nand_ooblayout_free() is only used in a code path where engine_type == NAND_ECC_ENGINE_TYPE_ON_HOST So the other cases can be removed. Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: make the code more self-explanatoryRichard Genoud-8/+11
In sunxi_nfc_hw_ecc_{read,write}_chunk(), the ECC step was forced to 0, the reason is not trivial to get when reading the code. The explanation is that, from the NAND flash controller perspective, we are indeed at step 0 for user data length and ECC errors. Just add a const value with an explanation to clarify things. Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: replace hard coded value by a define - take2Richard Genoud-2/+2
The user data length (4) has been replaced almost all over the file, but 2 places were forgotten. The user data is placed before the ECC, for each step. So, in sunxi_nfc_hw_ecc_read_extra_oob(), the offset of the user data in OOB is indeed ((ecc->bytes + USER_DATA_SZ) * ecc->steps); And in sunxi_nand_ooblayout_ecc(), the offset of the ECC chunk in OOB is the same offset plus the current user data size: section * (ecc->bytes + USER_DATA_SZ) + USER_DATA_SZ; Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: do not count BBM bytes twiceRichard Genoud-3/+20
BBM is already part of USER_DATA section, so we should not remove it twice This was working ok because we are on the safe size, advertising that there was 2 bytes less available than in reality. But we can't change old platforms, since it may lead to a different ECC strength, so, introduce a legacy flag for old platforms, and switch the new platforms to the correct count. Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: fix sunxi_nfc_hw_ecc_read_extra_oobRichard Genoud-3/+3
When dumping the OOB, the bytes at the end where actually copied from the beginning of the OOB instead of current_offset. That leads to something like: OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b instead of: OOB: ff ff ff ff ff ff ff ff ea 19 00 3a 83 db aa 8d OOB: 99 09 c8 9a 90 36 35 7d aa 15 13 07 3d 97 b2 a4 OOB: a8 bb 19 b3 07 e9 f6 25 52 d7 1a 23 e2 7e 0a e4 OOB: 52 8a 09 d2 1a 86 3d cf b4 99 43 13 d3 90 33 0b OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff OOB: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff (example with BCH16, user data [8,0], no scrambling) *cur_off (offset from the beginning of the page) was compared to offset (offset from the beginning of the OOB), and then, the nand_change_read_column_op() sets the current position to the beginning of the OOB instead of OOB+offset Fixes: 15d6f118285f ("mtd: rawnand: sunxi: Stop supporting ECC_HW_SYNDROME mode") Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com> Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-25mtd: rawnand: sunxi: sunxi_nand_ooblayout_free code clarificationRichard Genoud-2/+2
The available length is really USER_DATA_LEN - 2 instead of just 2 (the user data length minus the BBM length) USER_DATA_LEN being 4, that doesn't change anything now, but if USER_DATA_LEN changes, it will. Signed-off-by: Richard Genoud <richard.genoud@bootlin.com> Reviewed-by: Chen-Yu Tsai <wens@kernel.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-18mtd: rawnand: pl353: make sure optimal timings are appliedOlivier Sobrie-0/+3
Timings of the nand are adjusted by pl35x_nfc_setup_interface() but actually applied by the pl35x_nand_select_target() function. If there is only one nand chip, the pl35x_nand_select_target() will only apply the timings once since the test at its beginning will always be true after the first call to this function. As a result, the hardware will keep using the default timings set at boot to detect the nand chip, not the optimal ones. With this patch, we program directly the new timings when pl35x_nfc_setup_interface() is called. Fixes: 08d8c62164a3 ("mtd: rawnand: pl353: Add support for the ARM PL353 SMC NAND controller") Signed-off-by: Olivier Sobrie <olivier@sobrie.be> Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-18mtd: spi-nor: Rename spi_nor_spimem_check_op()Miquel Raynal-6/+6
This helper really is just a little helper for internal purposes, and is I/O operation oriented, despite its name. It has already been misused in commit 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support"), so rename it to clarify its purpose: it is only useful for reads and page programs. Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-18mtd: spi-nor: Fix RDCR controller capability core checkMiquel Raynal-1/+1
Commit 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support") adds a controller check to make sure the core will not use CR reads on controllers not supporting them. The approach is valid but the fix is incorrect. Unfortunately, the author could not catch it, because the expected behavior was met. The patch indeed drops the RDCR capability, but it does it for all controllers! The issue comes from the use of spi_nor_spimem_check_op() which is an internal helper dedicated to check read/write operations only, despite its generic name. This helper looks for the biggest number of address bytes that can be used for a page operation and tries 4 then 3. It then calls the usual spi-mem helpers to do the checks. These will always fail because there is now an inconsistency: the address cycles are forced to 4 (then 3) bytes, but the bus width during the address cycles rightfully remains 0. There is a non-zero address length but a zero address bus width, which is an invalid combination. The correct check in this case is to directly call spi_mem_supports_op() which doesn't messes up with the operation content. Fixes: 5008c3ec3f89 ("mtd: spi-nor: core: Check read CR support") Cc: stable@vger.kernel.org Acked-by: Tudor Ambarus <tudor.ambarus@linaro.org> Acked-by: Takahiro Kuwano <takahiro.kuwano@infineon.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-17mtd: cmdlinepart: use a flexible array memberRosen Penev-2/+1
This is already allocated properly. It's just using an extra pointer. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16mtd: parsers: ofpart: call of_node_get() for dedicated subpartitionsCosmin Tanislav-1/+1
In order to parse sub-partitions, add_mtd_partitions() calls parse_mtd_partitions() for all previously found partitions. Each partition will end up being passed to parse_fixed_partitions(), and its of_node will be treated as the ofpart_node. Commit 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") added of_node_put() calls for ofpart_node on all exit paths. In the case where the partition passed to parse_fixed_partitions() has a parent, it is treated as a dedicated partitions node, and of_node_put() is wrongly called for it, even if of_node_get() was not called explicitly. On repeated bind / unbinds of the MTD, the extra of_node_put() ends up decrementing the refcount down to 0, which should never happen, resulting in the following error: OF: ERROR: of_node_release() detected bad of_node_put() on /soc/spi@80007000/flash@0/partitions/partition@0 Call of_node_get() to balance the call to of_node_put() done for dedicated partitions nodes. Fixes: 7cce81df7d26 ("mtd: parsers: ofpart: fix OF node refcount leak in parse_fixed_partitions()") Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16mtd: parsers: ofpart: call of_node_put() only in ofpart_fail pathCosmin Tanislav-1/+1
ofpart_none can only be reached after the for_each_child_of_node() loop finishes. for_each_child_of_node() correctly calls of_node_put() for all device nodes it iterates over as long as we don't break or jump out of the loop. Calling of_node_put() inside the ofpart_none path will wrongly decrement the ref count of the last node in the for_each_child_of_node() loop. Move the call to of_node_put() under the ofpart_fail label to fix this. Fixes: ebd5a74db74e ("mtd: ofpart: Check availability of reg property instead of name property") Signed-off-by: Cosmin Tanislav <cosmin-gabriel.tanislav.xa@renesas.com> Tested-by: Tommaso Merciai <tommaso.merciai.xr@bp.renesas.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-16mtd: physmap: Drop leftovers of removed code for Baikal SoCAndy Shevchenko-4/+0
The previous clean up killed the driver along with dropping some calls but missed one place to drop. Do it here. Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603121229.PPSg4X8q-lkp@intel.com/ Reported-by: Mark Brown <broonie@kernel.org> Closes: https://lore.kernel.org/r/abK8KXC70RC2K_fW@sirena.org.uk Fixes: 16d68d10f5b93 "(mtd: physmap: physmap-bt1-rom: Remove not-going-to-be-supported code for Baikal SoC)" Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-13mtd: spi-nor: swp: check SR_TB flag when getting tb_maskShiji Yang-1/+3
When the chip does not support top/bottom block protect, the tb_mask must be set to 0, otherwise SR1 bit5 will be unexpectedly modified. Signed-off-by: Shiji Yang <yangshiji66@outlook.com> Fixes: 3dd8012a8eeb ("mtd: spi-nor: add TB (Top/Bottom) protect support") Reviewed-by: Michael Walle <mwalle@kernel.org> Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR sfdp fixup for mt35xu512abaHaibo Chen-0/+10
Find two batches mt35xu512aba has different SFDP but with same jedec ID. The batch which use the new version of SFDP contain all the necessary information to support OCT DTR mode. The batch with old version do not contain the OCT DTR command information, but in fact it did support OCT DTR mode. Current mt35xu512aba_post_sfdp_fixup() add some setting including SNOR_CMD_READ_8_8_8_DTR, but still lack SNOR_CMD_PP_8_8_8_DTR. Meet issue on the batch mt35xu512aba with old SFDP version. Because no SNOR_CMD_PP_8_8_8_DTR, micron_st_nor_octal_dtr_en() will not be called, then use SNOR_CMD_READ_8_8_8_DTR will meet issue. Fixes: 44dd635cd632 ("mtd: spi-nor: micron-st: use SFDP of mt35xu512aba") Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Reviewed-by: Michael Walle <mwalle@kernel.org> [pratyush@kernel.org: touch up the comment a bit] Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13mtd: spi-nor: update spi_nor_fixups::post_sfdp() documentationJonas Gorski-1/+1
After commit 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") spi_nor_post_sfdp_fixups() isn't called anymore if no SFDP is detected. Update the documentation accordingly. Fixes: 5273cc6df984 ("mtd: spi-nor: core: Call spi_nor_post_sfdp_fixups() only when SFDP is defined") Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-13mtd: spi-nor: core: correct the op.dummy.nbytes when check read operationsHaibo Chen-1/+1
When check read operation, need to setting the op.dummy.nbytes based on current read operation rather than the nor->read_proto. Fixes: 0e30f47232ab ("mtd: spi-nor: add support for DTR protocol") Signed-off-by: Haibo Chen <haibo.chen@nxp.com> Reviewed-by: Pratyush Yadav <pratyush@kernel.org> Signed-off-by: Pratyush Yadav (Google) <pratyush@kernel.org>
2026-03-11mtd: rawnand: ifc: set chip->of_node to nand@0 child node if presentFrank Li-1/+9
The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: rawnand: mxc: set chip->of_node to nand@0 child node if presentFrank Li-1/+9
The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: rawnand: gpmi: set chip->of_node to nand@0 child node if presentFrank Li-1/+10
The nand-controller.yaml binding requires a child node (e.g. nand@0) under the NAND controller. However, the driver currently assigns the controller's of_node directly to the NAND chip. Search for the first child node with the "nand" prefix and assign it to chip->of_node. This filters out properties such as "partition" that may be placed under the controller node in some older DTS files. Fall back to using the controller's of_node if no suitable child node is found to maintain backward compatibility. This issue went unnoticed because the default behavior works for most NAND chips. Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: nand: Use scoped_guard for mutex in nand_resumeRichard Lyu-9/+10
Refactor nand_resume() to use scoped_guard() instead of explicit mutex_lock/unlock. This improves code safety by ensuring the mutex is always released through the RAII-based cleanup infrastructure. The behavior is functionally equivalent. The mutex is released at the end of the scoped block, after which wake_up_all() is called to preserve the original locking semantics. Signed-off-by: Richard Lyu <richard.lyu@suse.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: rawnand: brcmnand: skip DMA during panic writeKamal Dasu-4/+2
When oops_panic_write is set, the driver disables interrupts and switches to PIO polling mode but still falls through into the DMA path. DMA cannot be used reliably in panic context, so make the DMA path an else branch to ensure only PIO is used during panic writes. Fixes: c1ac2dc34b51 ("mtd: rawnand: brcmnand: When oops in progress use pio and interrupt polling") Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com> Reviewed-by: William Zhang <william.zhang@broadcom.com> Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: rawnand: serialize lock/unlock against other NAND operationsKamal Dasu-2/+12
nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area without holding the NAND device lock. On controllers that implement SET_FEATURES via multiple low-level PIO commands, these can race with concurrent UBI/UBIFS background erase/write operations that hold the device lock, resulting in cmd_pending conflicts on the NAND controller. Add nand_get_device()/nand_release_device() around the lock/unlock operations to serialize them against all other NAND controller access. Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation") Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com> Reviewed-by: William Zhang <william.zhang@broadcom.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: docg3: fix use-after-free in docg3_release()James Kim-2/+1
In docg3_release(), the docg3 pointer is obtained from cascade->floors[0]->priv before the loop that calls doc_release_device() on each floor. doc_release_device() frees the docg3 struct via kfree(docg3) at line 1881. After the loop, docg3->cascade->bch dereferences the already-freed pointer. Fix this by accessing cascade->bch directly, which is equivalent since docg3->cascade points back to the same cascade struct, and is already available as a local variable. This also removes the now-unused docg3 local variable. Fixes: c8ae3f744ddc ("lib/bch: Rework a little bit the exported function names") Cc: stable@vger.kernel.org Signed-off-by: James Kim <james010kim@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: concat: replace alloc + calloc with 1 allocRosen Penev-11/+2
A flex array can be used to reduce the allocation to 1. And actually mtdconcat was using the pointer + 1 trick to point to the overallocated area. Better alternatives exist. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: virt_concat: use single allocation for nodeRosen Penev-9/+2
Simpler to reason about and avoids having to free nodes separately. Also add __counted_by attribute for extra runtime analysis. Signed-off-by: Rosen Penev <rosenp@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: virt_concat: fix kdoc textLuca Ceresoli-1/+1
The function name in the kdoc comment is different from the name of the function being documented, fix it. Fixes: 43db6366fc2d ("mtd: Add driver for concatenating devices") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202603041232.fNDHNtUa-lkp@intel.com/ Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: physmap_of_gemini: Fix disabled pinctrl state checkChen Ni-1/+1
The condition for checking the disabled pinctrl state incorrectly checks gf->enabled_state instead of gf->disabled_state. This causes misleading error messages and could lead to incorrect behavior when only one of the pinctrl states is defined. Fix the condition to properly check gf->disabled_state. Fixes: 9d3b5086f6d4 ("mtd: physmap_of_gemini: Handle pin control") Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Linus Walleij <linusw@kernel.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-03-11mtd: physmap: physmap-bt1-rom: Remove not-going-to-be-supported code for ↵Andy Shevchenko-155/+0
Baikal SoC As noticed in the discussion [1] the Baikal SoC and platforms are not going to be finalized, hence remove stale code. Link: https://lore.kernel.org/lkml/22b92ddf-6321-41b5-8073-f9c7064d3432@infradead.org/ [1] Reviewed-by: Randy Dunlap <rdunlap@infradead.org> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-25mtd: rawnand: cafe: Use generic power managementVaibhav Gupta-2/+5
Switch from PCI power management to the generic power management framework so the pci_driver hooks can eventually be retired. Signed-off-by: Vaibhav Gupta <vaibhavgupta40@gmail.com> Reviewed-by: Bjorn Helgaas <bhelgaas@google.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-25mtd: rawnand: cadence: Fix error check for dma_alloc_coherent() in ↵Chen Ni-1/+1
cadence_nand_init() Fix wrong variable used for error checking after dma_alloc_coherent() call. The function checks cdns_ctrl->dma_cdma_desc instead of cdns_ctrl->cdma_desc, which could lead to incorrect error handling. Fixes: ec4ba01e894d ("mtd: rawnand: Add new Cadence NAND driver to MTD subsystem") Cc: stable@vger.kernel.org Signed-off-by: Chen Ni <nichen@iscas.ac.cn> Reviewed-by: Alok Tiwari <alok.a.tiwari@oracle.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-25mtd: Avoid boot crash in RedBoot partition table parserFinn Thain-3/+3
Given CONFIG_FORTIFY_SOURCE=y and a recent compiler, commit 439a1bcac648 ("fortify: Use __builtin_dynamic_object_size() when available") produces the warning below and an oops. Searching for RedBoot partition table in 50000000.flash at offset 0x7e0000 ------------[ cut here ]------------ WARNING: lib/string_helpers.c:1035 at 0xc029e04c, CPU#0: swapper/0/1 memcmp: detected buffer overflow: 15 byte read of buffer size 14 Modules linked in: CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.19.0 #1 NONE As Kees said, "'names' is pointing to the final 'namelen' many bytes of the allocation ... 'namelen' could be basically any length at all. This fortify warning looks legit to me -- this code used to be reading beyond the end of the allocation." Since the size of the dynamic allocation is calculated with strlen() we can use strcmp() instead of memcmp() and remain within bounds. Cc: Kees Cook <kees@kernel.org> Cc: stable@vger.kernel.org Cc: linux-hardening@vger.kernel.org Link: https://lore.kernel.org/all/202602151911.AD092DFFCD@keescook/ Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Kees Cook <kees@kernel.org> Signed-off-by: Finn Thain <fthain@linux-m68k.org> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-25mtd: nand: realtek-ecc: relax OOB size check to minimumAhmed Naseef-8/+10
The ECC engine strictly validates that flash OOB size equals exactly 64 bytes. However, some NAND chips have a larger physical OOB while vendor firmware only uses the first 64 bytes for the ECC layout. For example the Macronix MX35LF1G24AD found in the Netlink HG323DAC has 128 byte physical OOB but vendor firmware only uses the first 64 bytes (24 bytes free + 40 bytes BCH6 parity), leaving bytes 64-127 unused. Since the engine only operates on the first 64 bytes of OOB regardless of the physical size, change the check from exact match to minimum size. Flash with OOB >= 64 bytes works correctly with the engine's 64-byte layout. Suggested-by: Markus Stockhausen <markus.stockhausen@gmx.de> Signed-off-by: Ahmed Naseef <naseefkm@gmail.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
2026-02-25mtd: Add driver for concatenating devicesAmit Kumar Mahapatra-0/+400
Introducing CONFIG_MTD_VIRT_CONCAT to separate the legacy flow from the new approach, where only the concatenated partition is registered as an MTD device, while the individual partitions that form it are not registered independently, as they are typically not required by the user. CONFIG_MTD_VIRT_CONCAT is a boolean configuration option that depends on CONFIG_MTD_PARTITIONED_MASTER. When enabled, it allows flash nodes to be exposed as individual MTD devices along with the other partitions. The solution focuses on fixed-partitions description only as it depends on device boundaries. It supports multiple sets of concatenated devices, each comprising two or more partitions. flash@0 { reg = <0>; partitions { compatible = "fixed-partitions"; part0@0 { part-concat-next = <&flash0_part1>; label = "part0_0"; reg = <0x0 0x800000>; }; flash0_part1: part1@800000 { label = "part0_1"; reg = <800000 0x800000>; }; part2@1000000 { part-concat-next = <&flash1_part0>; label = "part0_2"; reg = <0x800000 0x800000>; }; }; }; flash@1 { reg = <1>; partitions { compatible = "fixed-partitions"; flash1_part0: part1@0 { label = "part1_0"; reg = <0x0 0x800000>; }; part1@800000 { label = "part1_1"; reg = <0x800000 0x800000>; }; }; }; The partitions that gets created are flash@0 part0_0-part0_1-concat flash@1 part1_1 part0_2-part1_0-concat Suggested-by: Bernhard Frauendienst <kernel@nospam.obeliks.de> Suggested-by: Miquel Raynal <miquel.raynal@bootlin.com> Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com> Signed-off-by: Luca Ceresoli <luca.ceresoli@bootlin.com> Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>