* [PATCH v10 01/26] mtd: rawnand: sunxi: centralize OOB handling
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 19:13 ` sashiko-bot
2026-11-05 18:55 ` [PATCH v10 02/26] mtd: rawnand: sunxi: share the buffer transfer chunk size James Hilliard
` (24 subsequent siblings)
25 siblings, 1 reply; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
PIO and DMA interpret the same hardware-ECC results, retrieve protected
OOB bytes and check unreadable chunks for erased data in separate paths.
Keeping that policy in both transfer paths makes fixes easy to apply to
one path but miss in the other.
Share the processing through per-chip OOB operations selected at attach.
A read callback consumes one PIO step or a completed DMA batch. A finish
callback handles the OOB tail and returns the largest correction count.
Keep primary ECC-transfer sequencing and DMA ownership in the transfer
functions. Interpretation callbacks may issue supplementary OOB reads or
raw erased-page rereads. Carry the full-page buffer, page, correction
count and whether any chunk was erased in a per-read context.
Move user-data reservation and layout setup behind the same operations.
The existing plain and scrambled-with-plain-BBM modes share geometry and
read handling. Only the scrambled mode transforms the first two user bytes
to compensate hardware randomization and keep the on-flash marker plain.
Preserve fixed and variable user-data allocation, including the older
controllers' extra two-byte reservation when maximizing ECC strength.
This preserves the existing register accesses, transfer ordering, OOB
length selection, error handling and ECC accounting. In particular,
retain DMA's two passes: consume corrected OOB before raw erased-page
rereads. PIO keeps its current parity representation and physical reread
behavior. Spell out the PIO and DMA OOB-read branches so their different
parity reads remain visible. OOB-length fixes, read-error handling and
register-read caching are separate changes.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 554 +++++++++++++++++++++-----------------
1 file changed, 303 insertions(+), 251 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index f41feebe4257..80006d1a33d6 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -256,12 +256,38 @@ struct sunxi_nfc_timings {
s32 tRHW[SUNXI_NFC_TIMING_STEPS];
};
+struct sunxi_nfc_ecc_read;
+
+/* OOB geometry and interpretation; callbacks may issue supplementary reads. */
+struct sunxi_nfc_oob_ops {
+ /* Reserve OOB bytes for nsteps before ecc->steps is initialized. */
+ unsigned int (*min_user_data)(struct nand_chip *nand, int nsteps);
+ /* Install the user-data layout for the selected ECC geometry. */
+ int (*init_user_data)(struct nand_chip *nand, int nsteps);
+ /* Optional symmetric conversion of the on-flash bad-block marker. */
+ void (*transform_bbm)(struct nand_chip *nand, int page, u8 *bbm);
+ /*
+ * first_step is page-relative; status bits use transfer-local slots.
+ * PIO uses slot zero even when first_step is nonzero.
+ * Return zero on success or a negative I/O error.
+ */
+ int (*read_batch)(struct nand_chip *nand, struct sunxi_nfc_ecc_read *read,
+ u32 status, u32 pattern_found, int first_step, int nsteps);
+ /*
+ * Finish remaining OOB; return max bitflips or a negative I/O error.
+ * cur_off is an absolute NAND column, or NULL if unknown.
+ */
+ int (*finish_read)(struct nand_chip *nand, struct sunxi_nfc_ecc_read *read,
+ int *cur_off);
+};
+
/**
* struct sunxi_nand_chip - stores NAND chip device related information
*
* @node: used to store NAND chips into a list
* @nand: base NAND chip structure
* @ecc: ECC controller structure
+ * @oob_ops: OOB geometry and ECC-result interpretation
* @clk_rate: clk_rate required for this NAND chip
* @timing_cfg: TIMING_CFG register value for this NAND chip
* @timing_ctl: TIMING_CTL register value for this NAND chip
@@ -273,6 +299,7 @@ struct sunxi_nand_chip {
struct list_head node;
struct nand_chip nand;
struct sunxi_nand_hw_ecc ecc;
+ const struct sunxi_nfc_oob_ops *oob_ops;
unsigned long clk_rate;
u32 timing_cfg;
u32 timing_ctl;
@@ -908,6 +935,7 @@ static u8 sunxi_nfc_user_data_sz(struct sunxi_nand_chip *sunxi_nand, int step)
return sunxi_nand->user_data_bytes[step];
}
+/* PIO uses register zero; DMA concatenates user data within each transfer. */
static void sunxi_nfc_hw_ecc_get_prot_oob_bytes(struct nand_chip *nand, u8 *oob,
int step, bool bbm, int page,
unsigned int user_data_sz)
@@ -946,8 +974,8 @@ static void sunxi_nfc_hw_ecc_get_prot_oob_bytes(struct nand_chip *nand, u8 *oob,
}
/* De-randomize the Bad Block Marker. */
- if (bbm && (nand->options & NAND_NEED_SCRAMBLING))
- sunxi_nfc_randomize_bbm(nand, page, oob);
+ if (bbm && sunxi_nand->oob_ops->transform_bbm)
+ sunxi_nand->oob_ops->transform_bbm(nand, page, oob);
}
/*
@@ -1007,9 +1035,9 @@ static void sunxi_nfc_hw_ecc_set_prot_oob_bytes(struct nand_chip *nand,
u8 user_data[SUNXI_NFC_MAX_USER_DATA_SZ] = {};
/* Randomize the Bad Block Marker. */
- if (bbm && (nand->options & NAND_NEED_SCRAMBLING)) {
+ if (bbm && sunxi_nand->oob_ops->transform_bbm) {
memcpy(user_data, oob, user_data_sz);
- sunxi_nfc_randomize_bbm(nand, page, user_data);
+ sunxi_nand->oob_ops->transform_bbm(nand, page, user_data);
oob = user_data;
}
@@ -1055,6 +1083,41 @@ static void sunxi_nfc_hw_ecc_update_stats(struct nand_chip *nand,
}
}
+/* Return whether the chunk is erased, and account for its ECC result. */
+static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
+ u8 *data, int data_off,
+ u8 *oob, int oob_off,
+ unsigned int user_data_sz,
+ unsigned int *max_bitflips)
+{
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ unsigned int oob_len = ecc->bytes + user_data_sz;
+ int ret;
+
+ /* Check the physical representation for bitflips in erased pages. */
+ if (nand->options & NAND_NEED_SCRAMBLING)
+ nand_change_read_column_op(nand, data_off, data, ecc->size, false);
+
+ nand_change_read_column_op(nand, oob_off, oob, oob_len, false);
+
+ ret = nand_check_erased_ecc_chunk(data, ecc->size, oob, oob_len, NULL, 0,
+ ecc->strength);
+
+ sunxi_nfc_hw_ecc_update_stats(nand, max_bitflips, ret);
+
+ return ret >= 0;
+}
+
+/* Shared across a read's transfers; buf remains the full-page buffer base. */
+struct sunxi_nfc_ecc_read {
+ u8 *buf;
+ int page;
+ unsigned int max_bitflips;
+ bool oob_required;
+ bool dma;
+ bool has_erased_chunk;
+};
+
static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
int step, u32 status, u32 pattern_found,
bool *erased)
@@ -1094,98 +1157,6 @@ static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
return NFC_ECC_ERR_CNT(step, tmp);
}
-static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
- u8 *data, int data_off,
- u8 *oob, int oob_off,
- int *cur_off,
- unsigned int *max_bitflips,
- int step, bool oob_required, int page)
-{
- struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
- struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
- struct nand_ecc_ctrl *ecc = &nand->ecc;
- int raw_mode = 0;
- u32 pattern_found;
- bool bbm = !step;
- bool erased;
- int ret;
- /* From the controller point of view, we are at step 0 */
- const int nfc_step = 0;
-
- if (*cur_off != data_off)
- nand_change_read_column_op(nand, data_off, NULL, 0, false);
-
- sunxi_nfc_randomizer_read_buf(nand, NULL, ecc->size, false, page);
-
- if (data_off + ecc->size != oob_off)
- nand_change_read_column_op(nand, oob_off, NULL, 0, false);
-
- ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
- if (ret)
- return ret;
-
- sunxi_nfc_set_user_data_len(nfc, user_data_sz, nfc_step);
- sunxi_nfc_randomizer_config(nand, page, false);
- sunxi_nfc_randomizer_enable(nand);
- writel(NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ECC_OP,
- nfc->regs + NFC_REG_CMD);
-
- ret = sunxi_nfc_wait_events(nfc, NFC_CMD_INT_FLAG, false, 0);
- sunxi_nfc_randomizer_disable(nand);
- if (ret)
- return ret;
-
- *cur_off = oob_off + ecc->bytes + user_data_sz;
-
- pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
- pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
-
- ret = sunxi_nfc_hw_ecc_correct(nand, data, oob_required ? oob : NULL,
- nfc_step, readl(nfc->regs + NFC_REG_ECC_ST),
- pattern_found, &erased);
- if (erased)
- return 1;
-
- if (ret < 0) {
- /*
- * Re-read the data with the randomizer disabled to identify
- * bitflips in erased pages.
- */
- if (nand->options & NAND_NEED_SCRAMBLING)
- nand_change_read_column_op(nand, data_off, data,
- ecc->size, false);
- else
- memcpy_fromio(data, nfc->regs + NFC_RAM0_BASE,
- ecc->size);
-
- nand_change_read_column_op(nand, oob_off, oob,
- ecc->bytes + user_data_sz, false);
-
- ret = nand_check_erased_ecc_chunk(data, ecc->size, oob,
- ecc->bytes + user_data_sz,
- NULL, 0, ecc->strength);
- if (ret >= 0)
- raw_mode = 1;
- } else {
- memcpy_fromio(data, nfc->regs + NFC_RAM0_BASE, ecc->size);
-
- if (oob_required) {
- nand_change_read_column_op(nand, oob_off, NULL, 0,
- false);
- sunxi_nfc_randomizer_read_buf(nand, oob, ecc->bytes + user_data_sz,
- true, page);
-
- sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, nfc_step,
- bbm, page, user_data_sz);
- }
- }
-
- sunxi_nfc_hw_ecc_update_stats(nand, max_bitflips, ret);
-
- return raw_mode;
-}
-
/*
* Returns the offset of the OOB for each step.
* (it includes the user data before the ECC data.)
@@ -1241,18 +1212,166 @@ static void sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,
*cur_off = mtd->oobsize + mtd->writesize;
}
-static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, uint8_t *buf,
- int oob_required, int page,
- int nchunks)
+/* Interpret one PIO step or a completed DMA batch before reusing its status. */
+static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read,
+ u32 status, u32 pattern_found,
+ int first_step, int nsteps)
{
- bool randomized = nand->options & NAND_NEED_SCRAMBLING;
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- unsigned int max_bitflips = 0;
- int ret, i, raw_mode = 0;
+ bool randomized = nand->options & NAND_NEED_SCRAMBLING;
+ unsigned int user_data_sz;
+ int i, ret;
+
+ for (i = 0; i < nsteps; i++) {
+ int step = first_step + i;
+ int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, step);
+ u8 *data = read->buf + step * ecc->size;
+ u8 *oob = nand->oob_poi + oob_off;
+ bool erased;
+ int bitflips;
+
+ user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
+ bitflips = sunxi_nfc_hw_ecc_correct(nand,
+ !read->dma || randomized ? data : NULL,
+ read->oob_required ? oob : NULL,
+ i, status, pattern_found, &erased);
+ if (bitflips < 0) {
+ /* Preserve PIO data before the raw erased-page check. */
+ if (!read->dma && !randomized)
+ memcpy_fromio(data, nfc->regs + NFC_RAM0_BASE, ecc->size);
+ continue;
+ }
+
+ if (erased) {
+ read->has_erased_chunk = true;
+ continue;
+ }
+
+ if (!read->dma)
+ memcpy_fromio(data, nfc->regs + NFC_RAM0_BASE, ecc->size);
+
+ if (read->oob_required) {
+ /* Keep the existing PIO and DMA representations of parity. */
+ if (read->dma) {
+ nand_change_read_column_op(nand, mtd->writesize + oob_off,
+ oob, ecc->bytes + user_data_sz, false);
+ } else {
+ nand_change_read_column_op(nand, mtd->writesize + oob_off,
+ NULL, 0, false);
+ sunxi_nfc_randomizer_read_buf(nand, oob,
+ ecc->bytes + user_data_sz,
+ true, read->page);
+ }
+
+ sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, i, !step,
+ read->page, user_data_sz);
+ }
+
+ sunxi_nfc_hw_ecc_update_stats(nand, &read->max_bitflips, bitflips);
+ }
+
+ if (!(status & NFC_ECC_ERR_MSK(nfc)))
+ return 0;
+
+ /* Finish consuming the batch's corrected OOB before raw error rereads. */
+ for (i = 0; i < nsteps; i++) {
+ int step = first_step + i;
+ int data_off, oob_off;
+
+ if (!(status & NFC_ECC_ERR(i)))
+ continue;
+
+ data_off = step * ecc->size;
+ oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, step);
+ user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
+ ret = sunxi_nfc_hw_ecc_read_error(nand, read->buf + data_off, data_off,
+ nand->oob_poi + oob_off,
+ mtd->writesize + oob_off, user_data_sz,
+ &read->max_bitflips);
+ if (ret < 0)
+ return ret;
+ if (ret)
+ read->has_erased_chunk = true;
+ }
+
+ return 0;
+}
+
+static int sunxi_nfc_oob_finish_read(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read, int *cur_off)
+{
+ if (read->oob_required)
+ sunxi_nfc_hw_ecc_read_extra_oob(nand, nand->oob_poi, cur_off,
+ !read->has_erased_chunk, read->page);
+
+ return read->max_bitflips;
+}
+
+static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read,
+ int step, int *cur_off)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ int data_off = step * ecc->size;
+ int oob_off = nand_to_mtd(nand)->writesize + sunxi_get_oob_offset(sunxi_nand, ecc, step);
+ int page = read->page;
+ u32 pattern_found;
+ int ret;
+
+ if (*cur_off != data_off)
+ nand_change_read_column_op(nand, data_off, NULL, 0, false);
+
+ sunxi_nfc_randomizer_read_buf(nand, NULL, ecc->size, false, page);
+
+ if (data_off + ecc->size != oob_off)
+ nand_change_read_column_op(nand, oob_off, NULL, 0, false);
+
+ ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
+ if (ret)
+ return ret;
+
+ sunxi_nfc_set_user_data_len(nfc, user_data_sz, 0);
+ sunxi_nfc_randomizer_config(nand, page, false);
+ sunxi_nfc_randomizer_enable(nand);
+ writel(NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ECC_OP,
+ nfc->regs + NFC_REG_CMD);
+
+ ret = sunxi_nfc_wait_events(nfc, NFC_CMD_INT_FLAG, false, 0);
+ sunxi_nfc_randomizer_disable(nand);
+ if (ret)
+ return ret;
+
+ *cur_off = oob_off + ecc->bytes + user_data_sz;
+
+ pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
+ pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
+
+ return sunxi_nand->oob_ops->read_batch(nand, read,
+ readl(nfc->regs + NFC_REG_ECC_ST),
+ pattern_found, step, 1);
+}
+
+static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
+ int oob_required, int page, int nchunks)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ struct sunxi_nfc_ecc_read read = {
+ .buf = buf,
+ .page = page,
+ .oob_required = oob_required,
+ .dma = true,
+ };
struct scatterlist sg;
+ int ret, i;
u32 status, pattern_found, wait;
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
@@ -1299,83 +1418,12 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, uint8_t *buf
status = readl(nfc->regs + NFC_REG_ECC_ST);
pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
+ ret = sunxi_nand->oob_ops->read_batch(nand, &read, status, pattern_found,
+ 0, nchunks);
+ if (ret)
+ return ret;
- for (i = 0; i < nchunks; i++) {
- int data_off = i * ecc->size;
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, i);
- int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
- u8 *data = buf + data_off;
- u8 *oob = nand->oob_poi + oob_off;
- bool erased;
-
- ret = sunxi_nfc_hw_ecc_correct(nand, randomized ? data : NULL,
- oob_required ? oob : NULL,
- i, status, pattern_found,
- &erased);
-
- /* ECC errors are handled in the second loop. */
- if (ret < 0)
- continue;
-
- if (oob_required && !erased) {
- /* TODO: use DMA to retrieve OOB */
- nand_change_read_column_op(nand,
- mtd->writesize + oob_off,
- oob, ecc->bytes + user_data_sz, false);
-
- sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, i, !i,
- page, user_data_sz);
- }
-
- if (erased)
- raw_mode = 1;
-
- sunxi_nfc_hw_ecc_update_stats(nand, &max_bitflips, ret);
- }
-
- if (status & NFC_ECC_ERR_MSK(nfc)) {
- for (i = 0; i < nchunks; i++) {
- int data_off = i * ecc->size;
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, i);
- int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
- u8 *data = buf + data_off;
- u8 *oob = nand->oob_poi + oob_off;
-
- if (!(status & NFC_ECC_ERR(i)))
- continue;
-
- /*
- * Re-read the data with the randomizer disabled to
- * identify bitflips in erased pages.
- * TODO: use DMA to read page in raw mode
- */
- if (randomized)
- nand_change_read_column_op(nand, data_off,
- data, ecc->size,
- false);
-
- /* TODO: use DMA to retrieve OOB */
- nand_change_read_column_op(nand,
- mtd->writesize + oob_off,
- oob, ecc->bytes + user_data_sz, false);
-
- ret = nand_check_erased_ecc_chunk(data, ecc->size, oob,
- ecc->bytes + user_data_sz,
- NULL, 0,
- ecc->strength);
- if (ret >= 0)
- raw_mode = 1;
-
- sunxi_nfc_hw_ecc_update_stats(nand, &max_bitflips, ret);
- }
- }
-
- if (oob_required)
- sunxi_nfc_hw_ecc_read_extra_oob(nand, nand->oob_poi,
- NULL, !raw_mode,
- page);
-
- return max_bitflips;
+ return sunxi_nand->oob_ops->finish_read(nand, &read, NULL);
}
static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
@@ -1452,11 +1500,13 @@ static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
{
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- unsigned int max_bitflips = 0;
+ struct sunxi_nfc_ecc_read read = {
+ .buf = buf,
+ .page = page,
+ .oob_required = oob_required,
+ };
int ret, i, cur_off = 0;
- bool raw_mode = false;
sunxi_nfc_select_chip(nand, nand->cur_cs);
@@ -1466,28 +1516,15 @@ static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
sunxi_nfc_reset_user_data_len(nfc);
for (i = 0; i < ecc->steps; i++) {
- int data_off = i * ecc->size;
- int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
- u8 *data = buf + data_off;
- u8 *oob = nand->oob_poi + oob_off;
-
- ret = sunxi_nfc_hw_ecc_read_chunk(nand, data, data_off, oob,
- oob_off + mtd->writesize,
- &cur_off, &max_bitflips,
- i, oob_required, page);
+ ret = sunxi_nfc_hw_ecc_read_chunk(nand, &read, i, &cur_off);
if (ret < 0)
return ret;
- else if (ret)
- raw_mode = true;
}
- if (oob_required)
- sunxi_nfc_hw_ecc_read_extra_oob(nand, nand->oob_poi, &cur_off,
- !raw_mode, page);
-
+ ret = sunxi_nand->oob_ops->finish_read(nand, &read, &cur_off);
sunxi_nfc_hw_ecc_disable(nand);
- return max_bitflips;
+ return ret;
}
static int sunxi_nfc_hw_ecc_read_page_dma(struct nand_chip *nand, u8 *buf,
@@ -1513,11 +1550,12 @@ static int sunxi_nfc_hw_ecc_read_subpage(struct nand_chip *nand,
u8 *bufpoi, int page)
{
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
- struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
+ struct sunxi_nfc_ecc_read read = {
+ .buf = bufpoi,
+ .page = page,
+ };
int ret, i, cur_off = 0;
- unsigned int max_bitflips = 0;
sunxi_nfc_select_chip(nand, nand->cur_cs);
@@ -1528,23 +1566,15 @@ static int sunxi_nfc_hw_ecc_read_subpage(struct nand_chip *nand,
sunxi_nfc_reset_user_data_len(nfc);
for (i = data_offs / ecc->size;
i < DIV_ROUND_UP(data_offs + readlen, ecc->size); i++) {
- int data_off = i * ecc->size;
- int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
- u8 *data = bufpoi + data_off;
- u8 *oob = nand->oob_poi + oob_off;
-
- ret = sunxi_nfc_hw_ecc_read_chunk(nand, data, data_off,
- oob,
- oob_off + mtd->writesize,
- &cur_off, &max_bitflips, i,
- false, page);
+ ret = sunxi_nfc_hw_ecc_read_chunk(nand, &read, i, &cur_off);
if (ret < 0)
return ret;
}
+ ret = read.max_bitflips;
sunxi_nfc_hw_ecc_disable(nand);
- return max_bitflips;
+ return ret;
}
static int sunxi_nfc_hw_ecc_read_subpage_dma(struct nand_chip *nand,
@@ -2066,6 +2096,58 @@ static int sunxi_nfc_maximize_user_data(struct nand_chip *nand, uint32_t oobsize
return 0;
}
+static unsigned int sunxi_nfc_oob_min_user_data(struct nand_chip *nand, int nsteps)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ unsigned int size = 0;
+ int i;
+
+ /* Variable lengths reserve the first word, which contains the BBM. */
+ if (nfc->caps->reg_user_data_len)
+ return USER_DATA_SZ;
+
+ for (i = 0; i < nsteps; i++)
+ size += sunxi_nfc_user_data_sz(sunxi_nand, i);
+
+ /* Preserve the older platforms' extra BBM reservation and ECC strength. */
+ if (nfc->caps->legacy_max_strength)
+ size += 2;
+
+ return size;
+}
+
+static int sunxi_nfc_oob_init_user_data(struct nand_chip *nand, int nsteps)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+
+ if (!nfc->caps->reg_user_data_len)
+ return 0;
+
+ /* Prioritize ECC strength, then use the remaining space for user data. */
+ return sunxi_nfc_maximize_user_data(nand, nand_to_mtd(nand)->oobsize,
+ nand->ecc.bytes, nsteps);
+}
+
+/*
+ * Both modes use the same layout and ECC policy. Scrambled transfers also
+ * compensate the first two user bytes to keep the on-flash BBM unmodified.
+ */
+static const struct sunxi_nfc_oob_ops sunxi_nfc_plain_oob_ops = {
+ .min_user_data = sunxi_nfc_oob_min_user_data,
+ .init_user_data = sunxi_nfc_oob_init_user_data,
+ .read_batch = sunxi_nfc_oob_read_batch,
+ .finish_read = sunxi_nfc_oob_finish_read,
+};
+
+static const struct sunxi_nfc_oob_ops sunxi_nfc_scrambled_plain_bbm_oob_ops = {
+ .min_user_data = sunxi_nfc_oob_min_user_data,
+ .init_user_data = sunxi_nfc_oob_init_user_data,
+ .transform_bbm = sunxi_nfc_randomize_bbm,
+ .read_batch = sunxi_nfc_oob_read_batch,
+ .finish_read = sunxi_nfc_oob_finish_read,
+};
+
static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
struct nand_ecc_ctrl *ecc,
struct device_node *np)
@@ -2090,33 +2172,7 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
ecc->size = 1024;
nsectors = mtd->writesize / ecc->size;
- if (!nfc->caps->reg_user_data_len) {
- /*
- * If there's a fixed user data length, subtract it before
- * computing the max ECC strength
- */
-
- for (i = 0; i < nsectors; i++)
- total_user_data_sz += sunxi_nfc_user_data_sz(sunxi_nand, i);
-
- /*
- * The 2 BBM bytes should not be removed from the grand total,
- * because they are part of the USER_DATA_SZ.
- * But we can't modify that for older platform since it may
- * result in a stronger ECC at the end, and break the
- * compatibility.
- */
- if (nfc->caps->legacy_max_strength)
- bytes -= 2;
-
- bytes -= total_user_data_sz;
- } else {
- /*
- * User-data lengths are encoded in four-byte units. Reserve
- * the first word because it contains the two BBM bytes.
- */
- bytes -= USER_DATA_SZ;
- }
+ bytes -= sunxi_nand->oob_ops->min_user_data(nand, nsectors);
/*
* Once all user data has been subtracted, the rest can be used
@@ -2175,20 +2231,12 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
nsectors = mtd->writesize / ecc->size;
- /*
- * The rationale for variable data length is to prioritize maximum ECC
- * strength, and then use the remaining space for user data.
- */
- if (nfc->caps->reg_user_data_len) {
- ret = sunxi_nfc_maximize_user_data(nand, mtd->oobsize,
- ecc->bytes, nsectors);
- if (ret)
- return ret;
- }
+ ret = sunxi_nand->oob_ops->init_user_data(nand, nsectors);
+ if (ret)
+ return ret;
- if (total_user_data_sz == 0)
- for (i = 0; i < nsectors; i++)
- total_user_data_sz += sunxi_nfc_user_data_sz(sunxi_nand, i);
+ for (i = 0; i < nsectors; i++)
+ total_user_data_sz += sunxi_nfc_user_data_sz(sunxi_nand, i);
if (mtd->oobsize < (ecc->bytes * nsectors + total_user_data_sz))
return -EINVAL;
@@ -2232,6 +2280,7 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
static int sunxi_nand_attach_chip(struct nand_chip *nand)
{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
const struct nand_ecc_props *requirements =
nanddev_get_ecc_requirements(&nand->base);
struct nand_ecc_ctrl *ecc = &nand->ecc;
@@ -2254,6 +2303,9 @@ static int sunxi_nand_attach_chip(struct nand_chip *nand)
if (!ecc->size || !ecc->strength)
return -EINVAL;
+ sunxi_nand->oob_ops = nand->options & NAND_NEED_SCRAMBLING ?
+ &sunxi_nfc_scrambled_plain_bbm_oob_ops : &sunxi_nfc_plain_oob_ops;
+
switch (ecc->engine_type) {
case NAND_ECC_ENGINE_TYPE_ON_HOST:
ret = sunxi_nand_hw_ecc_ctrl_init(nand, ecc, np);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* Re: [PATCH v10 01/26] mtd: rawnand: sunxi: centralize OOB handling
2026-11-05 18:55 ` [PATCH v10 01/26] mtd: rawnand: sunxi: centralize OOB handling James Hilliard
@ 2026-11-05 19:13 ` sashiko-bot
0 siblings, 0 replies; 28+ messages in thread
From: sashiko-bot @ 2026-11-05 19:13 UTC (permalink / raw)
To: James Hilliard, Miquel Raynal, Richard Weinberger,
Vignesh Raghavendra, Sebastian Andrzej Siewior, Clark Williams,
Steven Rostedt, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Philipp Zabel
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-sunxi, linux-rt-devel, devicetree, linux-kernel
Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] mtd: rawnand: sunxi: premature oob_ops selection in sunxi_nand_attach_chip()
- [Medium] mtd: rawnand: sunxi: unaddressed maintainer NACK on vendor OOB layout ops
--
commit 8fda5c99d9befa1771418516828f040de60c5845
Author: James Hilliard <james.hilliard1@gmail.com>
mtd: rawnand: sunxi: centralize OOB handling
This commit centralizes hardware ECC result interpretation, protected OOB
retrieval, erased-chunk checking, and user-data layout reservation behind
per-chip sunxi_nfc_oob_ops callbacks for both PIO and DMA paths.
> diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
> index f41feebe42571..80006d1a33d68 100644
> --- a/drivers/mtd/nand/raw/sunxi_nand.c
> +++ b/drivers/mtd/nand/raw/sunxi_nand.c
[ ... ]
> @@ -2066,6 +2096,58 @@ static int sunxi_nfc_maximize_user_data(struct nand_chip *nand, uint32_t oobsize
[ ... ]
> +/*
> + * Both modes use the same layout and ECC policy. Scrambled transfers also
> + * compensate the first two user bytes to keep the on-flash BBM unmodified.
> + */
> +static const struct sunxi_nfc_oob_ops sunxi_nfc_plain_oob_ops = {
> + .min_user_data = sunxi_nfc_oob_min_user_data,
> + .init_user_data = sunxi_nfc_oob_init_user_data,
> + .read_batch = sunxi_nfc_oob_read_batch,
> + .finish_read = sunxi_nfc_oob_finish_read,
> +};
> +
> +static const struct sunxi_nfc_oob_ops sunxi_nfc_scrambled_plain_bbm_oob_ops = {
> + .min_user_data = sunxi_nfc_oob_min_user_data,
> + .init_user_data = sunxi_nfc_oob_init_user_data,
> + .transform_bbm = sunxi_nfc_randomize_bbm,
> + .read_batch = sunxi_nfc_oob_read_batch,
> + .finish_read = sunxi_nfc_oob_finish_read,
> +};
[Severity: Medium]
As reported by Miquel Raynal on v6 [1], the series adding support for the
vendor-specific Allwinner randomized OOB layout was declined due to
maintainability concerns and kernel policy against vendor-specific NAND
layouts, with an invitation to submit only the standalone fixes outside of
the randomized layout support.
Here, sunxi_nfc_plain_oob_ops and sunxi_nfc_scrambled_plain_bbm_oob_ops use
identical callbacks for min_user_data, init_user_data, read_batch, and
finish_read, differing only in transform_bbm. The remaining indirection in
struct sunxi_nfc_oob_ops is only used by the vendor-specific randomized OOB
layout patch later in the series.
Could the PIO and DMA ECC read helpers be shared directly and the standalone
fixes split out without introducing the struct sunxi_nfc_oob_ops vtable?
[ ... ]
> @@ -2254,6 +2303,9 @@ static int sunxi_nand_attach_chip(struct nand_chip *nand)
> if (!ecc->size || !ecc->strength)
> return -EINVAL;
>
> + sunxi_nand->oob_ops = nand->options & NAND_NEED_SCRAMBLING ?
> + &sunxi_nfc_scrambled_plain_bbm_oob_ops : &sunxi_nfc_plain_oob_ops;
[Severity: High]
Does selecting sunxi_nand->oob_ops in sunxi_nand_attach_chip() break bad
block marker compensation for chips that set NAND_NEED_SCRAMBLING during
nand_manufacturer_init()?
In nand_scan_with_ids(), nand_attach() runs before nand_scan_tail():
nand_scan_with_ids()
-> nand_scan_ident()
-> nand_attach()
-> sunxi_nand_attach_chip()
-> nand_scan_tail()
-> nand_manufacturer_init()
For ONFI-compliant chips where nand_onfi_detect() succeeds in nand_detect()
and jumps to ident_done without setting NAND_NEED_SCRAMBLING, the flag can
be set later in nand_manufacturer_init(), such as in
drivers/mtd/nand/raw/nand_toshiba.c:
toshiba_nand_init()
-> tc58teg5dclta00_init()
chip->options |= NAND_NEED_SCRAMBLING;
Because sunxi_nand_attach_chip() runs before nand_manufacturer_init(),
sunxi_nand->oob_ops is latched to sunxi_nfc_plain_oob_ops (where
transform_bbm is NULL). Later, during page and OOB reads and writes,
sunxi_nfc_randomizer_config() and sunxi_nfc_randomizer_enable() dynamically
check nand->options & NAND_NEED_SCRAMBLING and enable hardware scrambling,
while sunxi_nfc_hw_ecc_get_prot_oob_bytes() and
sunxi_nfc_hw_ecc_set_prot_oob_bytes() check sunxi_nand->oob_ops->transform_bbm
and skip calling sunxi_nfc_randomize_bbm().
[1] https://lore.kernel.org/r/871p9v4a1x.fsf@bootlin.com
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261105-submit-sunxi-nand-vendor-oob-layout-v1-v10-0-dca1f6ed29a8@gmail.com?part=1
^ permalink raw reply [flat|nested] 28+ messages in thread
* [PATCH v10 02/26] mtd: rawnand: sunxi: share the buffer transfer chunk size
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
2026-11-05 18:55 ` [PATCH v10 01/26] mtd: rawnand: sunxi: centralize OOB handling James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 03/26] mtd: rawnand: sunxi: avoid duplicate chip setup before page commands James Hilliard
` (23 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
Use one helper to determine how many bytes a buffer read or write can
transfer in a single normal command. Keep the existing SRAM-size limit
and command sequencing unchanged.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 80006d1a33d6..b75984961699 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -659,6 +659,11 @@ static void sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
writel(ctl, nfc->regs + NFC_REG_CTL);
}
+static int sunxi_nfc_buf_chunk_size(struct sunxi_nfc *nfc, int len)
+{
+ return min(len, nfc->caps->sram_size);
+}
+
static void sunxi_nfc_read_buf(struct nand_chip *nand, uint8_t *buf, int len)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
@@ -671,7 +676,7 @@ static void sunxi_nfc_read_buf(struct nand_chip *nand, uint8_t *buf, int len)
while (len > offs) {
bool poll = false;
- cnt = min(len - offs, nfc->caps->sram_size);
+ cnt = sunxi_nfc_buf_chunk_size(nfc, len - offs);
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
@@ -709,7 +714,7 @@ static void sunxi_nfc_write_buf(struct nand_chip *nand, const uint8_t *buf,
while (len > offs) {
bool poll = false;
- cnt = min(len - offs, nfc->caps->sram_size);
+ cnt = sunxi_nfc_buf_chunk_size(nfc, len - offs);
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 03/26] mtd: rawnand: sunxi: avoid duplicate chip setup before page commands
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
2026-11-05 18:55 ` [PATCH v10 01/26] mtd: rawnand: sunxi: centralize OOB handling James Hilliard
2026-11-05 18:55 ` [PATCH v10 02/26] mtd: rawnand: sunxi: share the buffer transfer chunk size James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 04/26] mtd: rawnand: sunxi: reject pages exceeding the ECC step limit James Hilliard
` (22 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
sunxi_nfc_select_chip() programs chip selection, timing and the
spare-area base. The page-read callbacks and PIO page/subpage writers
call it directly, then immediately call nand_read_page_op() or
nand_prog_page_begin_op(). Those helpers dispatch through
sunxi_nfc_exec_op(), which performs the same selection before executing
the command. No controller access between the two selections needs the
first one.
Remove the duplicate calls from those callbacks. Keep selection in the
DMA writer: it accesses registers and prepares DMA before program-begin,
so it cannot rely on the later exec_op() call. This removes redundant
setup only; selection still runs for each executed operation, with no
new cached state to invalidate after resets or chip switches.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index b75984961699..662d96fc2535 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1513,8 +1513,6 @@ static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
};
int ret, i, cur_off = 0;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_read_page_op(nand, page, 0, NULL, 0);
sunxi_nfc_hw_ecc_enable(nand);
@@ -1537,8 +1535,6 @@ static int sunxi_nfc_hw_ecc_read_page_dma(struct nand_chip *nand, u8 *buf,
{
int ret;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_read_page_op(nand, page, 0, NULL, 0);
ret = sunxi_nfc_hw_ecc_read_chunks_dma(nand, buf, oob_required, page,
@@ -1562,8 +1558,6 @@ static int sunxi_nfc_hw_ecc_read_subpage(struct nand_chip *nand,
};
int ret, i, cur_off = 0;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_read_page_op(nand, page, 0, NULL, 0);
sunxi_nfc_hw_ecc_enable(nand);
@@ -1589,8 +1583,6 @@ static int sunxi_nfc_hw_ecc_read_subpage_dma(struct nand_chip *nand,
int nchunks = DIV_ROUND_UP(data_offs + readlen, nand->ecc.size);
int ret;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_read_page_op(nand, page, 0, NULL, 0);
ret = sunxi_nfc_hw_ecc_read_chunks_dma(nand, buf, false, page, nchunks);
@@ -1612,8 +1604,6 @@ static int sunxi_nfc_hw_ecc_write_page(struct nand_chip *nand,
struct nand_ecc_ctrl *ecc = &nand->ecc;
int ret, i, cur_off = 0;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_prog_page_begin_op(nand, page, 0, NULL, 0);
sunxi_nfc_hw_ecc_enable(nand);
@@ -1652,8 +1642,6 @@ static int sunxi_nfc_hw_ecc_write_subpage(struct nand_chip *nand,
struct nand_ecc_ctrl *ecc = &nand->ecc;
int ret, i, cur_off = 0;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
-
nand_prog_page_begin_op(nand, page, 0, NULL, 0);
sunxi_nfc_hw_ecc_enable(nand);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 04/26] mtd: rawnand: sunxi: reject pages exceeding the ECC step limit
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (2 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 03/26] mtd: rawnand: sunxi: avoid duplicate chip setup before page commands James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 05/26] mtd: rawnand: sunxi: use the logical step's OOB length in PIO James Hilliard
` (21 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Sashiko
The controller has 16 ECC status slots on A10/A23 and 32 on H6/H616.
Hardware-ECC setup checks the strength and available OOB space, but does
not check that the page fits those slots. NAND identification can supply
a larger page size, and the NAND core does not enforce this
controller-specific limit.
If enough OOB space is available, an unsupported geometry can pass attach
and reach DMA code that indexes status and user-data registers by ECC
step. H6/H616 also represent enabled data blocks with a 32-bit mask. The
number of steps must fit the controller even when their user data fits
the register bank.
Reject excessive step counts before allocating user-data lengths or
installing the hardware-ECC callbacks. Check the final step size, after
strength maximization and the conversion from 512-byte to 1-KiB steps,
so valid geometries retain their existing layout. This also keeps PIO
fallback from accepting a page that the controller cannot handle.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/sashiko-outbox-173724@kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 662d96fc2535..1a61f608ad91 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -2223,6 +2223,11 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
ecc->bytes = ALIGN(ecc->bytes, 2);
nsectors = mtd->writesize / ecc->size;
+ if (nsectors > nfc->caps->max_ecc_steps) {
+ dev_err(nfc->dev, "unsupported number of ECC steps: %d (max %u)\n",
+ nsectors, nfc->caps->max_ecc_steps);
+ return -EINVAL;
+ }
ret = sunxi_nand->oob_ops->init_user_data(nand, nsectors);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 05/26] mtd: rawnand: sunxi: use the logical step's OOB length in PIO
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (3 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 04/26] mtd: rawnand: sunxi: reject pages exceeding the ECC step limit James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 06/26] mtd: rawnand: sunxi: propagate page-setup and erased-check errors James Hilliard
` (20 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
PIO transfers each logical ECC step through hardware slot zero. On
H6/H616, user-data lengths can differ between logical steps: step zero
can have 32 bytes while a later step has only 16 or none.
sunxi_nfc_hw_ecc_correct() uses the hardware slot to select that length
when filling pattern data. A pattern detected in a later PIO step can
therefore overwrite the following OOB region with step zero's longer
length. The protected-OOB write helper makes the same mistake when
loading slot zero, reading bytes beyond the current step's user data.
Pass the logical step's user-data length explicitly to both helpers.
Separate that length from the user-data register offset: PIO always
starts at register zero, while DMA advances by each preceding step's
length in four-byte words. Update both DMA callers with the helper
contract so variable-length steps continue to use the same registers.
Fixed four-byte layouts and the on-flash geometry are unchanged.
The mismatched logical and hardware indices were found by code inspection
while consolidating the PIO and DMA OOB paths.
Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 106 ++++++++++++--------------------------
1 file changed, 32 insertions(+), 74 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 1a61f608ad91..ae18a7fbca77 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -942,45 +942,22 @@ static u8 sunxi_nfc_user_data_sz(struct sunxi_nand_chip *sunxi_nand, int step)
/* PIO uses register zero; DMA concatenates user data within each transfer. */
static void sunxi_nfc_hw_ecc_get_prot_oob_bytes(struct nand_chip *nand, u8 *oob,
- int step, bool bbm, int page,
+ unsigned int reg_index, bool bbm, int page,
unsigned int user_data_sz)
{
- struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ const struct sunxi_nfc_oob_ops *ops = to_sunxi_nand(nand)->oob_ops;
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
u32 user_data;
+ unsigned int i;
- if (!nfc->caps->reg_user_data_len) {
- /*
- * For A10, the user data for step n is in the nth
- * REG_USER_DATA
- */
- user_data = readl(nfc->regs + NFC_REG_USER_DATA(nfc, step));
- sunxi_nfc_user_data_to_buf(user_data, oob);
- } else {
- /*
- * For H6 NAND controller, the user data for all steps is
- * contained in 32 user data registers, but not at a specific
- * offset for each step, they are just concatenated.
- */
- unsigned int user_data_off = 0;
- unsigned int reg_off;
- u8 *ptr = oob;
- unsigned int i;
-
- for (i = 0; i < step; i++)
- user_data_off += sunxi_nfc_user_data_sz(sunxi_nand, i);
-
- user_data_off /= 4;
- for (i = 0; i < user_data_sz / 4; i++, ptr += 4) {
- reg_off = NFC_REG_USER_DATA(nfc, user_data_off + i);
- user_data = readl(nfc->regs + reg_off);
- sunxi_nfc_user_data_to_buf(user_data, ptr);
- }
+ for (i = 0; i < user_data_sz / 4; i++) {
+ user_data = readl(nfc->regs + NFC_REG_USER_DATA(nfc, reg_index + i));
+ sunxi_nfc_user_data_to_buf(user_data, oob + i * 4);
}
- /* De-randomize the Bad Block Marker. */
- if (bbm && sunxi_nand->oob_ops->transform_bbm)
- sunxi_nand->oob_ops->transform_bbm(nand, page, oob);
+ /* Undo hardware de-randomization of the plain on-flash BBM. */
+ if (bbm && ops->transform_bbm)
+ ops->transform_bbm(nand, page, oob);
}
/*
@@ -1031,48 +1008,26 @@ static void sunxi_nfc_set_user_data_len(struct sunxi_nfc *nfc,
}
static void sunxi_nfc_hw_ecc_set_prot_oob_bytes(struct nand_chip *nand,
- const u8 *oob, int step,
- bool bbm, int page)
+ const u8 *oob, unsigned int reg_index,
+ bool bbm, int page,
+ unsigned int user_data_sz)
{
+ const struct sunxi_nfc_oob_ops *ops = to_sunxi_nand(nand)->oob_ops;
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
- struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
u8 user_data[SUNXI_NFC_MAX_USER_DATA_SZ] = {};
+ unsigned int i;
- /* Randomize the Bad Block Marker. */
- if (bbm && sunxi_nand->oob_ops->transform_bbm) {
+ /* Compensate hardware randomization so the BBM stays plain on flash. */
+ if (bbm && ops->transform_bbm) {
memcpy(user_data, oob, user_data_sz);
- sunxi_nand->oob_ops->transform_bbm(nand, page, user_data);
+ ops->transform_bbm(nand, page, user_data);
oob = user_data;
}
- if (!nfc->caps->reg_user_data_len) {
- /*
- * For A10, the user data for step n is in the nth
- * REG_USER_DATA
- */
- writel(sunxi_nfc_buf_to_user_data(oob),
- nfc->regs + NFC_REG_USER_DATA(nfc, step));
- } else {
- /*
- * For H6 NAND controller, the user data for all steps is
- * contained in 32 user data registers, but not at a specific
- * offset for each step, they are just concatenated.
- */
- unsigned int user_data_off = 0;
- const u8 *ptr = oob;
- unsigned int i;
-
- for (i = 0; i < step; i++)
- user_data_off += sunxi_nfc_user_data_sz(sunxi_nand, i);
-
- user_data_off /= 4;
- for (i = 0; i < user_data_sz / 4; i++, ptr += 4) {
- writel(sunxi_nfc_buf_to_user_data(ptr),
- nfc->regs + NFC_REG_USER_DATA(nfc, user_data_off + i));
- }
+ for (i = 0; i < user_data_sz / 4; i++) {
+ writel(sunxi_nfc_buf_to_user_data(oob + i * 4),
+ nfc->regs + NFC_REG_USER_DATA(nfc, reg_index + i));
}
-
}
static void sunxi_nfc_hw_ecc_update_stats(struct nand_chip *nand,
@@ -1125,11 +1080,9 @@ struct sunxi_nfc_ecc_read {
static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
int step, u32 status, u32 pattern_found,
- bool *erased)
+ unsigned int user_data_sz, bool *erased)
{
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
- struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
struct nand_ecc_ctrl *ecc = &nand->ecc;
u32 tmp;
@@ -1228,10 +1181,10 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
bool randomized = nand->options & NAND_NEED_SCRAMBLING;
- unsigned int user_data_sz;
+ unsigned int reg_index = 0, user_data_sz;
int i, ret;
- for (i = 0; i < nsteps; i++) {
+ for (i = 0; i < nsteps; i++, reg_index += user_data_sz / 4) {
int step = first_step + i;
int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, step);
u8 *data = read->buf + step * ecc->size;
@@ -1243,7 +1196,8 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
bitflips = sunxi_nfc_hw_ecc_correct(nand,
!read->dma || randomized ? data : NULL,
read->oob_required ? oob : NULL,
- i, status, pattern_found, &erased);
+ i, status, pattern_found,
+ user_data_sz, &erased);
if (bitflips < 0) {
/* Preserve PIO data before the raw erased-page check. */
if (!read->dma && !randomized)
@@ -1272,7 +1226,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
true, read->page);
}
- sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, i, !step,
+ sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, reg_index, !step,
read->page, user_data_sz);
}
@@ -1461,7 +1415,8 @@ static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
sunxi_nfc_randomizer_config(nand, page, false);
sunxi_nfc_randomizer_enable(nand);
sunxi_nfc_set_user_data_len(nfc, user_data_sz, nfc_step);
- sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, nfc_step, bbm, page);
+ sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, nfc_step, bbm, page,
+ user_data_sz);
writel(NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD |
NFC_ACCESS_DIR | NFC_ECC_OP,
@@ -1675,6 +1630,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
struct scatterlist sg;
+ unsigned int reg_index = 0;
u32 wait;
int ret, i;
@@ -1695,8 +1651,10 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
const u8 *oob = nand->oob_poi + oob_off;
- sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, i, !i, page);
+ sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, reg_index, !i, page,
+ user_data_sz);
sunxi_nfc_set_user_data_len(nfc, user_data_sz, i);
+ reg_index += user_data_sz / 4;
}
nand_prog_page_begin_op(nand, page, 0, NULL, 0);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 06/26] mtd: rawnand: sunxi: propagate page-setup and erased-check errors
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (4 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 05/26] mtd: rawnand: sunxi: use the logical step's OOB length in PIO James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 07/26] mtd: rawnand: sunxi: drain interrupts before reusing the completion James Hilliard
` (19 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
The ECC read callbacks ignore nand_read_page_op() failures. A command or
ready timeout can therefore leave the requested page unselected, yet the
driver continues with data transfers and can report success for stale
data. Return the setup error before starting PIO or DMA.
After an ECC error, the driver rereads the physical data and OOB with
randomization disabled to distinguish an erased chunk from corrupt data.
Those rereads can also fail. Do not pass stale buffers to
nand_check_erased_ecc_chunk() or count a transport failure as an ECC
result: return the reread error instead. Successful erased checks retain
their existing statistics and correction-count behavior.
Route PIO read errors through ECC disable. DMA has already released its
transfer resources before interpreting the results, and its caller
retries a failed read in PIO. Restore the corrected/failed counters from
before that DMA attempt so earlier steps are not counted again by the
retry; leave bad-block counters unchanged.
These unchecked returns were found by inspecting the read callbacks and
their NAND-operation helpers.
Fixes: 97d90da8a886 ("mtd: nand: provide several helpers to do common NAND operations")
Fixes: 25f815f66a14 ("mtd: nand: force drivers to explicitly send READ/PROG commands")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 56 ++++++++++++++++++++++++++++++---------
1 file changed, 44 insertions(+), 12 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index ae18a7fbca77..9a7b365e998e 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1043,7 +1043,10 @@ static void sunxi_nfc_hw_ecc_update_stats(struct nand_chip *nand,
}
}
-/* Return whether the chunk is erased, and account for its ECC result. */
+/*
+ * Return 1 for an erased chunk or 0 for an uncorrectable chunk, with ECC
+ * statistics updated in either case. Negative values report transport errors.
+ */
static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
u8 *data, int data_off,
u8 *oob, int oob_off,
@@ -1055,10 +1058,16 @@ static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
int ret;
/* Check the physical representation for bitflips in erased pages. */
- if (nand->options & NAND_NEED_SCRAMBLING)
- nand_change_read_column_op(nand, data_off, data, ecc->size, false);
+ if (nand->options & NAND_NEED_SCRAMBLING) {
+ ret = nand_change_read_column_op(nand, data_off, data,
+ ecc->size, false);
+ if (ret)
+ return ret;
+ }
- nand_change_read_column_op(nand, oob_off, oob, oob_len, false);
+ ret = nand_change_read_column_op(nand, oob_off, oob, oob_len, false);
+ if (ret)
+ return ret;
ret = nand_check_erased_ecc_chunk(data, ecc->size, oob, oob_len, NULL, 0,
ecc->strength);
@@ -1322,6 +1331,7 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
struct sunxi_nfc_ecc_read read = {
.buf = buf,
@@ -1329,6 +1339,8 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
.oob_required = oob_required,
.dma = true,
};
+ unsigned int corrected = mtd->ecc_stats.corrected;
+ unsigned int failed = mtd->ecc_stats.failed;
struct scatterlist sg;
int ret, i;
u32 status, pattern_found, wait;
@@ -1380,9 +1392,19 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
ret = sunxi_nand->oob_ops->read_batch(nand, &read, status, pattern_found,
0, nchunks);
if (ret)
- return ret;
+ goto err_stats;
+
+ ret = sunxi_nand->oob_ops->finish_read(nand, &read, NULL);
+ if (ret < 0)
+ goto err_stats;
+
+ return ret;
- return sunxi_nand->oob_ops->finish_read(nand, &read, NULL);
+err_stats:
+ /* The caller retries the whole read in PIO mode. */
+ mtd->ecc_stats.corrected = corrected;
+ mtd->ecc_stats.failed = failed;
+ return ret;
}
static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
@@ -1468,7 +1490,9 @@ static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
};
int ret, i, cur_off = 0;
- nand_read_page_op(nand, page, 0, NULL, 0);
+ ret = nand_read_page_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
sunxi_nfc_hw_ecc_enable(nand);
@@ -1476,10 +1500,11 @@ static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
for (i = 0; i < ecc->steps; i++) {
ret = sunxi_nfc_hw_ecc_read_chunk(nand, &read, i, &cur_off);
if (ret < 0)
- return ret;
+ goto out;
}
ret = sunxi_nand->oob_ops->finish_read(nand, &read, &cur_off);
+out:
sunxi_nfc_hw_ecc_disable(nand);
return ret;
@@ -1490,7 +1515,9 @@ static int sunxi_nfc_hw_ecc_read_page_dma(struct nand_chip *nand, u8 *buf,
{
int ret;
- nand_read_page_op(nand, page, 0, NULL, 0);
+ ret = nand_read_page_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
ret = sunxi_nfc_hw_ecc_read_chunks_dma(nand, buf, oob_required, page,
nand->ecc.steps);
@@ -1513,7 +1540,9 @@ static int sunxi_nfc_hw_ecc_read_subpage(struct nand_chip *nand,
};
int ret, i, cur_off = 0;
- nand_read_page_op(nand, page, 0, NULL, 0);
+ ret = nand_read_page_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
sunxi_nfc_hw_ecc_enable(nand);
@@ -1522,10 +1551,11 @@ static int sunxi_nfc_hw_ecc_read_subpage(struct nand_chip *nand,
i < DIV_ROUND_UP(data_offs + readlen, ecc->size); i++) {
ret = sunxi_nfc_hw_ecc_read_chunk(nand, &read, i, &cur_off);
if (ret < 0)
- return ret;
+ goto out;
}
ret = read.max_bitflips;
+out:
sunxi_nfc_hw_ecc_disable(nand);
return ret;
@@ -1538,7 +1568,9 @@ static int sunxi_nfc_hw_ecc_read_subpage_dma(struct nand_chip *nand,
int nchunks = DIV_ROUND_UP(data_offs + readlen, nand->ecc.size);
int ret;
- nand_read_page_op(nand, page, 0, NULL, 0);
+ ret = nand_read_page_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
ret = sunxi_nfc_hw_ecc_read_chunks_dma(nand, buf, false, page, nchunks);
if (ret >= 0)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 07/26] mtd: rawnand: sunxi: drain interrupts before reusing the completion
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (5 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 06/26] mtd: rawnand: sunxi: propagate page-setup and erased-check errors James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 08/26] mtd: rawnand: sunxi: stop failed program operations and disable ECC James Hilliard
` (18 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Sashiko
The controller uses one completion for successive interrupt-driven
waits. Some transfers wait for both command completion and DMA
completion. The handler acknowledges each event and masks it, leaving
any outstanding event enabled; it calls complete() when all requested
events have arrived.
sunxi_nfc_interrupt() currently calls complete() before updating those
registers. A successful waiter can wake on another CPU and start the
next operation before the old handler acknowledges status or rewrites
the mask. Move complete() after those updates so waking the waiter
cannot precede the handler's last controller access.
A timeout also needs to exclude an unfinished handler. With PREEMPT_RT,
the flags-zero IRQ request is forced threaded. Near the timeout
boundary, that thread can be preempted after reading status and enable
bits while the waiter times out, clears the device mask and rearms the
next wait. The saved snapshot can then restore an obsolete
remaining-event mask or, if it satisfies the old wait, complete the new
wait. Masking the device does not invalidate the running handler's local
values. Repeating init_completion() can also reset its waitqueue lock
during complete(). This lifetime problem was identified by code
inspection during review.
Initialize the completion once in probe and use reinit_completion() for
each wait. On timeout, call disable_irq() before clearing controller
state so existing handling finishes and no new handler can enter during
cleanup.
The hardware may have finished before the delayed handler runs, or the
handler may complete the wait while disable_irq() drains it. Recheck
status against the remaining enabled events before clearing either
register. Events already acknowledged by the handler no longer appear
in that mask; if none remain, the wait has completed. This also handles
command and DMA events arriving separately without requiring an
already acknowledged status bit to be set again.
Then mask and acknowledge the events, read back the mask to flush those
writes, and re-enable the IRQ line even if the recheck changed the
timeout to success. Keep partial-event handling in the IRQ handler and
leave polling and controller/DMA abort handling unchanged.
This keeps additional synchronization on the timeout path, without a
driver lock in every interrupt and wait. The caller can sleep, this IRQ
is not registered as shared, and the handler does not acquire the
controller mutex held by the caller. The tradeoff is unbounded cleanup
latency and no priority inheritance: a starved IRQ thread can prevent
timeout cleanup from returning and block other operations on the
controller. This is a handler-lifetime boundary, not an RT
recovery-latency guarantee.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260909085434.C8F201F00A3A@smtp.kernel.org
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 38 +++++++++++++++++++++++++++++++-------
1 file changed, 31 insertions(+), 7 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 9a7b365e998e..111094b1c64c 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -401,6 +401,7 @@ struct sunxi_nfc_caps {
* @chips: a list containing all the NAND chips attached to this NAND
* controller
* @complete: a completion object used to wait for NAND controller events
+ * @irq: NAND controller interrupt
* @dmac: the DMA channel attached to the NAND controller
* @use_mdma: use an internal MBUS DMA backend
* @mdma_desc: H6-style MBUS DMA descriptor
@@ -420,6 +421,7 @@ struct sunxi_nfc {
unsigned long clk_rate;
struct list_head chips;
struct completion complete;
+ int irq;
struct dma_chan *dmac;
bool use_mdma;
struct sunxi_nfc_mdma_desc *mdma_desc;
@@ -441,18 +443,20 @@ static irqreturn_t sunxi_nfc_interrupt(int irq, void *dev_id)
if (!(ien & st))
return IRQ_NONE;
- if ((ien & st) == ien)
- complete(&nfc->complete);
-
+ /* Finish updating the interrupt state before waking the next operation. */
writel(st & NFC_INT_MASK, nfc->regs + NFC_REG_ST);
writel(~st & ien & NFC_INT_MASK, nfc->regs + NFC_REG_INT);
+ if ((ien & st) == ien)
+ complete(&nfc->complete);
+
return IRQ_HANDLED;
}
static int sunxi_nfc_wait_events(struct sunxi_nfc *nfc, u32 events,
bool use_polling, unsigned int timeout_ms)
{
+ bool irq_disabled = false;
int ret;
if (events & ~NFC_INT_MASK)
@@ -462,16 +466,28 @@ static int sunxi_nfc_wait_events(struct sunxi_nfc *nfc, u32 events,
timeout_ms = NFC_DEFAULT_TIMEOUT_MS;
if (!use_polling) {
- init_completion(&nfc->complete);
+ reinit_completion(&nfc->complete);
writel(events, nfc->regs + NFC_REG_INT);
ret = wait_for_completion_timeout(&nfc->complete,
msecs_to_jiffies(timeout_ms));
- if (!ret)
- ret = -ETIMEDOUT;
- else
+ if (!ret) {
+ u32 pending, status;
+
+ /* Drain the handler before it can restore an old IRQ mask. */
+ disable_irq(nfc->irq);
+ irq_disabled = true;
+ /*
+ * The handler removes acknowledged events from the mask.
+ * An empty mask means all requested events were acknowledged.
+ */
+ pending = readl(nfc->regs + NFC_REG_INT) & events;
+ status = readl(nfc->regs + NFC_REG_ST);
+ ret = (status & pending) == pending ? 0 : -ETIMEDOUT;
+ } else {
ret = 0;
+ }
writel(0, nfc->regs + NFC_REG_INT);
} else {
@@ -484,6 +500,12 @@ static int sunxi_nfc_wait_events(struct sunxi_nfc *nfc, u32 events,
writel(events & NFC_INT_MASK, nfc->regs + NFC_REG_ST);
+ if (irq_disabled) {
+ /* Flush the mask and acknowledgment before re-enabling the IRQ. */
+ readl(nfc->regs + NFC_REG_INT);
+ enable_irq(nfc->irq);
+ }
+
if (ret)
dev_err(nfc->dev, "wait interrupt timedout\n");
@@ -2657,6 +2679,7 @@ static int sunxi_nfc_probe(struct platform_device *pdev)
nfc->dev = dev;
nand_controller_init(&nfc->controller);
INIT_LIST_HEAD(&nfc->chips);
+ init_completion(&nfc->complete);
nfc->regs = devm_platform_get_and_ioremap_resource(pdev, 0, &r);
if (IS_ERR(nfc->regs))
@@ -2665,6 +2688,7 @@ static int sunxi_nfc_probe(struct platform_device *pdev)
irq = platform_get_irq(pdev, 0);
if (irq < 0)
return irq;
+ nfc->irq = irq;
nfc->caps = of_device_get_match_data(dev);
if (!nfc->caps)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 08/26] mtd: rawnand: sunxi: stop failed program operations and disable ECC
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (6 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 07/26] mtd: rawnand: sunxi: drain interrupts before reusing the completion James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 09/26] mtd: rawnand: sunxi: select the pattern ID for the current ECC step James Hilliard
` (17 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
A page program has three stages: send the setup command and address,
transfer the data with ECC, then send PAGEPROG to commit it and check
the NAND status. The PIO page/subpage and DMA page writers ignore the
return from nand_prog_page_begin_op(). A FIFO or command-completion
timeout can therefore be followed by data transfers and PAGEPROG, with a
later success hiding the original setup failure.
Check setup before enabling ECC or transferring data. DMA preparation
occurs before setup and may already have queued a descriptor and mapped
the buffer, so use its existing abort and cleanup helpers before
returning that error.
The PIO writers also return directly when a chunk reports failure,
leaving ECC enabled for the next controller operation. Route those exits
through ECC disable, preserve the reported error and skip program-end.
Keep the successful setup/transfer/confirm sequence unchanged; this
patch does not add a new controller-reset or NAND-abort policy.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Fixes: 25f815f66a14 ("mtd: nand: force drivers to explicitly send READ/PROG commands")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 29 ++++++++++++++++++++++-------
1 file changed, 22 insertions(+), 7 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 111094b1c64c..02aa02d2cdb9 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1611,9 +1611,11 @@ static int sunxi_nfc_hw_ecc_write_page(struct nand_chip *nand,
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- int ret, i, cur_off = 0;
+ int ret = 0, i, cur_off = 0;
- nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
sunxi_nfc_hw_ecc_enable(nand);
@@ -1628,14 +1630,17 @@ static int sunxi_nfc_hw_ecc_write_page(struct nand_chip *nand,
oob_off + mtd->writesize,
&cur_off, i, page);
if (ret)
- return ret;
+ goto out;
}
if (oob_required || (nand->options & NAND_NEED_SCRAMBLING))
sunxi_nfc_hw_ecc_write_extra_oob(nand, nand->oob_poi,
&cur_off, page);
+out:
sunxi_nfc_hw_ecc_disable(nand);
+ if (ret)
+ return ret;
return nand_prog_page_end_op(nand);
}
@@ -1649,9 +1654,11 @@ static int sunxi_nfc_hw_ecc_write_subpage(struct nand_chip *nand,
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- int ret, i, cur_off = 0;
+ int ret = 0, i, cur_off = 0;
- nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ if (ret)
+ return ret;
sunxi_nfc_hw_ecc_enable(nand);
@@ -1667,10 +1674,13 @@ static int sunxi_nfc_hw_ecc_write_subpage(struct nand_chip *nand,
oob_off + mtd->writesize,
&cur_off, i, page);
if (ret)
- return ret;
+ goto out;
}
+out:
sunxi_nfc_hw_ecc_disable(nand);
+ if (ret)
+ return ret;
return nand_prog_page_end_op(nand);
}
@@ -1711,7 +1721,12 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
reg_index += user_data_sz / 4;
}
- nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ if (ret) {
+ sunxi_nfc_dma_op_abort(nfc);
+ sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
+ return ret;
+ }
sunxi_nfc_hw_ecc_enable(nand);
sunxi_nfc_randomizer_config(nand, page, false);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 09/26] mtd: rawnand: sunxi: select the pattern ID for the current ECC step
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (7 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 08/26] mtd: rawnand: sunxi: stop failed program operations and disable ECC James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 10/26] mtd: rawnand: sunxi: preserve synthesized zero-pattern data and OOB James Hilliard
` (16 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
ECC exception mode recognizes physical all-zero and all-ones data
blocks. For each hardware ECC step, a pattern-found bit says whether
this happened and the corresponding pattern-ID bit distinguishes zero
from 0xff. The correction helper checks the current step's pattern-found
bit but always reads pattern-ID bit zero.
PIO processes one step at a time in hardware slot zero, so it is
unaffected. DMA processes several steps at once. For example, if step
one is all 0xff but pattern-ID bit zero is clear, the helper treats step
one as all zero. On scrambled DMA reads it fills that step's main data
with zeros and reports success. Requested OOB is also filled using the
wrong pattern. Conversely, a zero step can be classified as erased when
bit zero is set.
Test BIT(step) in the pattern-ID register, matching the error and
pattern-found bits already selected for that hardware step.
Fixes: 614049a8d904 ("mtd: nand: sunxi: add support for DMA assisted operations")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 02aa02d2cdb9..e952d7f6abef 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1125,7 +1125,7 @@ static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
if (pattern_found & BIT(step)) {
u8 pattern;
- if (unlikely(!(readl(nfc->regs + NFC_REG_PAT_ID(nfc)) & 0x1))) {
+ if (unlikely(!(readl(nfc->regs + NFC_REG_PAT_ID(nfc)) & BIT(step)))) {
pattern = 0x0;
} else {
pattern = 0xff;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 10/26] mtd: rawnand: sunxi: preserve synthesized zero-pattern data and OOB
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (8 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 09/26] mtd: rawnand: sunxi: select the pattern ID for the current ECC step James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 11/26] mtd: rawnand: sunxi: propagate buffer and column transfer errors James Hilliard
` (15 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Sashiko
ECC exception mode recognizes physical all-zero and all-ones chunks.
sunxi_nfc_hw_ecc_correct() fills their data and requested OOB buffers with
the detected pattern, but sets its erased flag only for all-ones chunks.
The caller skips normal buffer retrieval only when that flag is set. For
an all-zero chunk, PIO therefore overwrites the synthesized zeros with
SRAM contents. With scrambling enabled, those contents are descrambled
data rather than the physical zero pattern, yet the read reports success.
Requested OOB is also reloaded after synthesis, in both PIO and DMA.
After checking for ECC errors, skip buffer retrieval for either detected
pattern. Keep the erased flag separate: only all-ones chunks may set the
page's has_erased_chunk state, which controls randomization when reading
the trailing OOB. Preserve that state if an earlier chunk was erased.
ECC-error steps still take the existing raw reread and erased-page check.
Fixes: cc6822fb756b ("mtd: nand: sunxi: move some ECC related operations to their own functions")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/sashiko-outbox-172123@kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index e952d7f6abef..e79fe46926d8 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1236,8 +1236,9 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
continue;
}
- if (erased) {
- read->has_erased_chunk = true;
+ /* Both patterns are already filled; only all-ones is erased. */
+ if (pattern_found & BIT(i)) {
+ read->has_erased_chunk |= erased;
continue;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 11/26] mtd: rawnand: sunxi: propagate buffer and column transfer errors
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (9 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 10/26] mtd: rawnand: sunxi: preserve synthesized zero-pattern data and OOB James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 12/26] mtd: rawnand: sunxi: avoid a second program confirm for OOB writes James Hilliard
` (14 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
sunxi_nfc_read_buf() and sunxi_nfc_write_buf() move data through
controller SRAM, waiting for FIFO space and transfer completion. On
timeout they stop their loop but return void, so their callers cannot
distinguish a complete transfer from a partial one. The hardware-ECC
paths also ignore some NAND column-change errors, including extra-OOB
transfers performed after DMA. Reads can thus succeed with incomplete
data or bytes from the wrong column; writes can issue PAGEPROG after
failing to transfer all the intended bytes.
Return the transfer status through the randomizer and OOB helpers to the
page callbacks. A read with a NULL destination still fills controller
SRAM for ECC and must report errors even though it does not copy to
memory. Disable the randomizer after either transfer outcome, and use
the page callbacks' error exits to disable ECC and skip program-end.
Update a tracked OOB column only after the requested transfer succeeds.
Keep transport status separate from the maximum corrected-bit count:
zero from a successful OOB read must not erase a positive correction
result. If an OOB read after DMA fails, restore that attempt's
corrected/failed counters before the caller retries the page in PIO.
Leave successful command sequences and the returned OOB representation
unchanged.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 174 +++++++++++++++++++++++++-------------
1 file changed, 117 insertions(+), 57 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index e79fe46926d8..f003da59cbe7 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -686,7 +686,7 @@ static int sunxi_nfc_buf_chunk_size(struct sunxi_nfc *nfc, int len)
return min(len, nfc->caps->sram_size);
}
-static void sunxi_nfc_read_buf(struct nand_chip *nand, uint8_t *buf, int len)
+static int sunxi_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(sunxi_nand->nand.controller);
@@ -702,7 +702,7 @@ static void sunxi_nfc_read_buf(struct nand_chip *nand, uint8_t *buf, int len)
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
- break;
+ return ret;
writel(cnt, nfc->regs + NFC_REG_CNT);
tmp = NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD;
@@ -714,17 +714,19 @@ static void sunxi_nfc_read_buf(struct nand_chip *nand, uint8_t *buf, int len)
ret = sunxi_nfc_wait_events(nfc, NFC_CMD_INT_FLAG, poll, 0);
if (ret)
- break;
+ return ret;
if (buf)
memcpy_fromio(buf + offs, nfc->regs + NFC_RAM0_BASE,
cnt);
offs += cnt;
}
+
+ return 0;
}
-static void sunxi_nfc_write_buf(struct nand_chip *nand, const uint8_t *buf,
- int len)
+static int sunxi_nfc_write_buf(struct nand_chip *nand, const u8 *buf,
+ int len)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(sunxi_nand->nand.controller);
@@ -740,7 +742,7 @@ static void sunxi_nfc_write_buf(struct nand_chip *nand, const uint8_t *buf,
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
- break;
+ return ret;
writel(cnt, nfc->regs + NFC_REG_CNT);
memcpy_toio(nfc->regs + NFC_RAM0_BASE, buf + offs, cnt);
@@ -754,10 +756,12 @@ static void sunxi_nfc_write_buf(struct nand_chip *nand, const uint8_t *buf,
ret = sunxi_nfc_wait_events(nfc, NFC_CMD_INT_FLAG, poll, 0);
if (ret)
- break;
+ return ret;
offs += cnt;
}
+
+ return 0;
}
/* These seed values have been extracted from Allwinner's BSP */
@@ -907,23 +911,31 @@ static void sunxi_nfc_randomize_bbm(struct nand_chip *nand, int page, u8 *bbm)
bbm[1] ^= sunxi_nfc_randomizer_step(state, 8);
}
-static void sunxi_nfc_randomizer_write_buf(struct nand_chip *nand,
- const uint8_t *buf, int len,
- bool ecc, int page)
+static int sunxi_nfc_randomizer_write_buf(struct nand_chip *nand,
+ const u8 *buf, int len,
+ bool ecc, int page)
{
+ int ret;
+
sunxi_nfc_randomizer_config(nand, page, ecc);
sunxi_nfc_randomizer_enable(nand);
- sunxi_nfc_write_buf(nand, buf, len);
+ ret = sunxi_nfc_write_buf(nand, buf, len);
sunxi_nfc_randomizer_disable(nand);
+
+ return ret;
}
-static void sunxi_nfc_randomizer_read_buf(struct nand_chip *nand, uint8_t *buf,
- int len, bool ecc, int page)
+static int sunxi_nfc_randomizer_read_buf(struct nand_chip *nand, u8 *buf,
+ int len, bool ecc, int page)
{
+ int ret;
+
sunxi_nfc_randomizer_config(nand, page, ecc);
sunxi_nfc_randomizer_enable(nand);
- sunxi_nfc_read_buf(nand, buf, len);
+ ret = sunxi_nfc_read_buf(nand, buf, len);
sunxi_nfc_randomizer_disable(nand);
+
+ return ret;
}
static void sunxi_nfc_hw_ecc_enable(struct nand_chip *nand)
@@ -1174,31 +1186,39 @@ static int sunxi_get_ecc_offset(struct sunxi_nand_chip *sunxi_nand,
sunxi_nfc_user_data_sz(sunxi_nand, step);
}
-static void sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,
- u8 *oob, int *cur_off,
- bool randomize, int page)
+static int sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,
+ u8 *oob, int *cur_off,
+ bool randomize, int page)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
int offset = sunxi_get_oob_offset(sunxi_nand, ecc, ecc->steps);
int len = mtd->oobsize - offset;
+ int ret;
if (len <= 0)
- return;
+ return 0;
- if (!cur_off || *cur_off != (offset + mtd->writesize))
- nand_change_read_column_op(nand, mtd->writesize + offset,
- NULL, 0, false);
+ if (!cur_off || *cur_off != (offset + mtd->writesize)) {
+ ret = nand_change_read_column_op(nand, mtd->writesize + offset,
+ NULL, 0, false);
+ if (ret)
+ return ret;
+ }
if (!randomize)
- sunxi_nfc_read_buf(nand, oob + offset, len);
+ ret = sunxi_nfc_read_buf(nand, oob + offset, len);
else
- sunxi_nfc_randomizer_read_buf(nand, oob + offset, len,
- false, page);
+ ret = sunxi_nfc_randomizer_read_buf(nand, oob + offset, len,
+ false, page);
+ if (ret)
+ return ret;
if (cur_off)
*cur_off = mtd->oobsize + mtd->writesize;
+
+ return 0;
}
/* Interpret one PIO step or a completed DMA batch before reusing its status. */
@@ -1248,14 +1268,22 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
if (read->oob_required) {
/* Keep the existing PIO and DMA representations of parity. */
if (read->dma) {
- nand_change_read_column_op(nand, mtd->writesize + oob_off,
- oob, ecc->bytes + user_data_sz, false);
+ ret = nand_change_read_column_op(nand, mtd->writesize + oob_off,
+ oob, ecc->bytes + user_data_sz,
+ false);
+ if (ret)
+ return ret;
} else {
- nand_change_read_column_op(nand, mtd->writesize + oob_off,
- NULL, 0, false);
- sunxi_nfc_randomizer_read_buf(nand, oob,
- ecc->bytes + user_data_sz,
- true, read->page);
+ ret = nand_change_read_column_op(nand, mtd->writesize + oob_off,
+ NULL, 0, false);
+ if (ret)
+ return ret;
+
+ ret = sunxi_nfc_randomizer_read_buf(nand, oob,
+ ecc->bytes + user_data_sz,
+ true, read->page);
+ if (ret)
+ return ret;
}
sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, reg_index, !step,
@@ -1295,9 +1323,14 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
static int sunxi_nfc_oob_finish_read(struct nand_chip *nand,
struct sunxi_nfc_ecc_read *read, int *cur_off)
{
- if (read->oob_required)
- sunxi_nfc_hw_ecc_read_extra_oob(nand, nand->oob_poi, cur_off,
- !read->has_erased_chunk, read->page);
+ int ret;
+
+ if (read->oob_required) {
+ ret = sunxi_nfc_hw_ecc_read_extra_oob(nand, nand->oob_poi, cur_off,
+ !read->has_erased_chunk, read->page);
+ if (ret)
+ return ret;
+ }
return read->max_bitflips;
}
@@ -1316,13 +1349,21 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
u32 pattern_found;
int ret;
- if (*cur_off != data_off)
- nand_change_read_column_op(nand, data_off, NULL, 0, false);
+ if (*cur_off != data_off) {
+ ret = nand_change_read_column_op(nand, data_off, NULL, 0, false);
+ if (ret)
+ return ret;
+ }
- sunxi_nfc_randomizer_read_buf(nand, NULL, ecc->size, false, page);
+ ret = sunxi_nfc_randomizer_read_buf(nand, NULL, ecc->size, false, page);
+ if (ret)
+ return ret;
- if (data_off + ecc->size != oob_off)
- nand_change_read_column_op(nand, oob_off, NULL, 0, false);
+ if (data_off + ecc->size != oob_off) {
+ ret = nand_change_read_column_op(nand, oob_off, NULL, 0, false);
+ if (ret)
+ return ret;
+ }
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
@@ -1445,13 +1486,21 @@ static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
/* From the controller point of view, we are at step 0 */
const int nfc_step = 0;
- if (data_off != *cur_off)
- nand_change_write_column_op(nand, data_off, NULL, 0, false);
+ if (data_off != *cur_off) {
+ ret = nand_change_write_column_op(nand, data_off, NULL, 0, false);
+ if (ret)
+ return ret;
+ }
- sunxi_nfc_randomizer_write_buf(nand, data, ecc->size, false, page);
+ ret = sunxi_nfc_randomizer_write_buf(nand, data, ecc->size, false, page);
+ if (ret)
+ return ret;
- if (data_off + ecc->size != oob_off)
- nand_change_write_column_op(nand, oob_off, NULL, 0, false);
+ if (data_off + ecc->size != oob_off) {
+ ret = nand_change_write_column_op(nand, oob_off, NULL, 0, false);
+ if (ret)
+ return ret;
+ }
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
@@ -1477,27 +1526,35 @@ static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
return 0;
}
-static void sunxi_nfc_hw_ecc_write_extra_oob(struct nand_chip *nand,
- u8 *oob, int *cur_off,
- int page)
+static int sunxi_nfc_hw_ecc_write_extra_oob(struct nand_chip *nand,
+ u8 *oob, int *cur_off,
+ int page)
{
struct mtd_info *mtd = nand_to_mtd(nand);
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
int offset = sunxi_get_oob_offset(sunxi_nand, ecc, ecc->steps);
int len = mtd->oobsize - offset;
+ int ret;
if (len <= 0)
- return;
+ return 0;
- if (!cur_off || *cur_off != offset)
- nand_change_write_column_op(nand, offset + mtd->writesize,
- NULL, 0, false);
+ if (!cur_off || *cur_off != offset) {
+ ret = nand_change_write_column_op(nand, offset + mtd->writesize,
+ NULL, 0, false);
+ if (ret)
+ return ret;
+ }
- sunxi_nfc_randomizer_write_buf(nand, oob + offset, len, false, page);
+ ret = sunxi_nfc_randomizer_write_buf(nand, oob + offset, len, false, page);
+ if (ret)
+ return ret;
if (cur_off)
*cur_off = mtd->oobsize + mtd->writesize;
+
+ return 0;
}
static int sunxi_nfc_hw_ecc_read_page(struct nand_chip *nand, uint8_t *buf,
@@ -1635,8 +1692,8 @@ static int sunxi_nfc_hw_ecc_write_page(struct nand_chip *nand,
}
if (oob_required || (nand->options & NAND_NEED_SCRAMBLING))
- sunxi_nfc_hw_ecc_write_extra_oob(nand, nand->oob_poi,
- &cur_off, page);
+ ret = sunxi_nfc_hw_ecc_write_extra_oob(nand, nand->oob_poi,
+ &cur_off, page);
out:
sunxi_nfc_hw_ecc_disable(nand);
@@ -1759,10 +1816,13 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
if (ret)
return ret;
- if (oob_required || (nand->options & NAND_NEED_SCRAMBLING))
+ if (oob_required || (nand->options & NAND_NEED_SCRAMBLING)) {
/* TODO: use DMA to transfer extra OOB bytes ? */
- sunxi_nfc_hw_ecc_write_extra_oob(nand, nand->oob_poi,
- NULL, page);
+ ret = sunxi_nfc_hw_ecc_write_extra_oob(nand, nand->oob_poi,
+ NULL, page);
+ if (ret)
+ return ret;
+ }
return nand_prog_page_end_op(nand);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 12/26] mtd: rawnand: sunxi: avoid a second program confirm for OOB writes
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (10 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 11/26] mtd: rawnand: sunxi: propagate buffer and column transfer errors James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 13/26] mtd: rawnand: sunxi: use page reads to reposition small-page NAND James Hilliard
` (13 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
The hardware-ECC OOB writer fills the main-data buffer with 0xff and
calls the selected page writer to program it together with the requested
OOB. Both the PIO and DMA page writers already finish with
nand_prog_page_end_op(), which sends PAGEPROG, waits and checks NAND
status. The OOB wrapper then calls that helper again, sending a second
program confirm without another setup or data transfer. A failure of
that extra command is returned even though the actual write has already
succeeded.
Return the page writer's result directly. It remains responsible for the
single program confirm and status check, including on the
bad-block-marker write path. Raw OOB writes use separate callbacks and
are unchanged.
Fixes: 25f815f66a14 ("mtd: nand: force drivers to explicitly send READ/PROG commands")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 7 +------
1 file changed, 1 insertion(+), 6 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index f003da59cbe7..5f57c5998f03 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1841,15 +1841,10 @@ static int sunxi_nfc_hw_ecc_write_oob(struct nand_chip *nand, int page)
{
struct mtd_info *mtd = nand_to_mtd(nand);
u8 *buf = nand_get_data_buf(nand);
- int ret;
memset(buf, 0xff, mtd->writesize);
- ret = nand->ecc.write_page(nand, buf, 1, page);
- if (ret)
- return ret;
- /* Send command to program the OOB data */
- return nand_prog_page_end_op(nand);
+ return nand->ecc.write_page(nand, buf, 1, page);
}
static const struct sunxi_nfc_timings sun4i_a10_nfc_timings = {
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 13/26] mtd: rawnand: sunxi: use page reads to reposition small-page NAND
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (11 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 12/26] mtd: rawnand: sunxi: avoid a second program confirm for OOB writes James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 14/26] mtd: rawnand: sunxi: bound DMA batches by the user-data register bank James Hilliard
` (12 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Sashiko
The hardware-ECC reader moves between main data and OOB, and rereads raw
bytes when checking a possibly erased ECC step. It uses
nand_change_read_column_op(), which sends large-page random-output
commands and rejects NAND pages of 512 bytes or less. For a small-page
geometry accepted by hardware-ECC setup, these reads therefore fail when
they need to reposition, rather than using the small-page read commands.
Add a read-column helper that uses nand_read_page_op() on small pages.
The core selects READ0, READ1 or READOOB for the requested column and
sends the row address again. Pass the page number through the
erased-check path as well, and preserve errors from the resulting
operation. Keep the existing random-column operation for larger pages.
Select PIO for small pages even when DMA is available: the DMA PAGE_OP
sequencer uses large-page random-column commands internally.
This corrects read-side repositioning only; the write-column helper still
rejects small pages. Software-ECC and raw callbacks are unchanged.
This is a command-path correction found by inspection, not a claim that
ordinary 512+16 NAND becomes supported. The existing controller-ECC
limits still apply: it needs 512-byte ECC support and at least 28 parity
bytes plus four user-data bytes, so 512+16 remains rejected. No
small-page hardware validation is claimed.
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260913041642.E28F81F000FF@smtp.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 40 ++++++++++++++++++++++++---------------
1 file changed, 25 insertions(+), 15 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 5f57c5998f03..931d437e196b 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1077,6 +1077,16 @@ static void sunxi_nfc_hw_ecc_update_stats(struct nand_chip *nand,
}
}
+static int sunxi_nfc_read_column(struct nand_chip *nand, int page,
+ unsigned int column, void *buf, unsigned int len)
+{
+ /* Small-page NAND needs a new READ0/READ1/READOOB and the page address. */
+ if (nand_to_mtd(nand)->writesize <= 512)
+ return nand_read_page_op(nand, page, column, buf, len);
+
+ return nand_change_read_column_op(nand, column, buf, len, false);
+}
+
/*
* Return 1 for an erased chunk or 0 for an uncorrectable chunk, with ECC
* statistics updated in either case. Negative values report transport errors.
@@ -1085,7 +1095,7 @@ static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
u8 *data, int data_off,
u8 *oob, int oob_off,
unsigned int user_data_sz,
- unsigned int *max_bitflips)
+ unsigned int *max_bitflips, int page)
{
struct nand_ecc_ctrl *ecc = &nand->ecc;
unsigned int oob_len = ecc->bytes + user_data_sz;
@@ -1093,13 +1103,12 @@ static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
/* Check the physical representation for bitflips in erased pages. */
if (nand->options & NAND_NEED_SCRAMBLING) {
- ret = nand_change_read_column_op(nand, data_off, data,
- ecc->size, false);
+ ret = sunxi_nfc_read_column(nand, page, data_off, data, ecc->size);
if (ret)
return ret;
}
- ret = nand_change_read_column_op(nand, oob_off, oob, oob_len, false);
+ ret = sunxi_nfc_read_column(nand, page, oob_off, oob, oob_len);
if (ret)
return ret;
@@ -1201,8 +1210,8 @@ static int sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,
return 0;
if (!cur_off || *cur_off != (offset + mtd->writesize)) {
- ret = nand_change_read_column_op(nand, mtd->writesize + offset,
- NULL, 0, false);
+ ret = sunxi_nfc_read_column(nand, page, mtd->writesize + offset,
+ NULL, 0);
if (ret)
return ret;
}
@@ -1268,14 +1277,14 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
if (read->oob_required) {
/* Keep the existing PIO and DMA representations of parity. */
if (read->dma) {
- ret = nand_change_read_column_op(nand, mtd->writesize + oob_off,
- oob, ecc->bytes + user_data_sz,
- false);
+ ret = sunxi_nfc_read_column(nand, read->page,
+ mtd->writesize + oob_off,
+ oob, ecc->bytes + user_data_sz);
if (ret)
return ret;
} else {
- ret = nand_change_read_column_op(nand, mtd->writesize + oob_off,
- NULL, 0, false);
+ ret = sunxi_nfc_read_column(nand, read->page,
+ mtd->writesize + oob_off, NULL, 0);
if (ret)
return ret;
@@ -1310,7 +1319,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
ret = sunxi_nfc_hw_ecc_read_error(nand, read->buf + data_off, data_off,
nand->oob_poi + oob_off,
mtd->writesize + oob_off, user_data_sz,
- &read->max_bitflips);
+ &read->max_bitflips, read->page);
if (ret < 0)
return ret;
if (ret)
@@ -1350,7 +1359,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
int ret;
if (*cur_off != data_off) {
- ret = nand_change_read_column_op(nand, data_off, NULL, 0, false);
+ ret = sunxi_nfc_read_column(nand, page, data_off, NULL, 0);
if (ret)
return ret;
}
@@ -1360,7 +1369,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
return ret;
if (data_off + ecc->size != oob_off) {
- ret = nand_change_read_column_op(nand, oob_off, NULL, 0, false);
+ ret = sunxi_nfc_read_column(nand, page, oob_off, NULL, 0);
if (ret)
return ret;
}
@@ -2326,7 +2335,8 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
ecc->write_oob = sunxi_nfc_hw_ecc_write_oob;
mtd_set_ooblayout(mtd, &sunxi_nand_ooblayout_ops);
- if (nfc->dmac || nfc->use_mdma) {
+ /* The DMA page sequencer uses large-page random-column commands. */
+ if (mtd->writesize > 512 && (nfc->dmac || nfc->use_mdma)) {
ecc->read_page = sunxi_nfc_hw_ecc_read_page_dma;
ecc->read_subpage = sunxi_nfc_hw_ecc_read_subpage_dma;
ecc->write_page = sunxi_nfc_hw_ecc_write_page_dma;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 14/26] mtd: rawnand: sunxi: bound DMA batches by the user-data register bank
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (12 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 13/26] mtd: rawnand: sunxi: use page reads to reposition small-page NAND James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 15/26] mtd: rawnand: sunxi: send all address cycles in split operations James Hilliard
` (11 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Sashiko
H6/H616 store ECC-protected OOB metadata, called user data, in 32
four-byte registers. The fields for successive ECC steps are
concatenated in that 128-byte bank. However, the existing allocator
fills the OOB space left after parity, allowing up to 32 user-data bytes
per step without limiting the page total. A whole-page DMA transfer can
exceed the bank. For example, 16 KiB main data plus 1280 OOB bytes with
BCH40/1024 leaves 160 user-data bytes; with 1664 OOB bytes it allocates
512. Register accesses then extend beyond the user-data bank.
PIO can handle these layouts because it reuses register zero for each
step. Capping the page's allocation would instead move parity offsets on
flash and break compatibility with pages written through PIO. Split DMA
transfers without changing that allocation or the logical main-data and
OOB offsets.
Fill the first batch up to the 128-byte limit. Transfer each remaining
step in a separate batch, using hardware slot and user-data register
zero after explicitly selecting its main column and spare-area base.
PAGE_OP generates later main-data columns from hardware slot numbers,
not relative to the selected initial column. A multi-slot batch starting
partway through a page would therefore revisit an earlier column.
Single-slot later batches avoid those generated column changes. Pages
that already fit keep one DMA batch.
Program length fields from the batch's logical starting step, and
consume its protected OOB and ECC status before reusing the registers.
Keep erased state, correction counts and trailing OOB handling
page-wide. On a failed DMA read, discard all partial statistics before
the existing PIO retry.
Use one page-read setup or program-begin for the whole page, and send
program-end only after every batch and any trailing OOB succeed. A write
may fall back to PIO only if DMA preparation fails before its first
batch; never retry a write after part of the page has been transferred.
Raw access and the OOB layout reported to MTD remain unchanged.
Fixes: 54dcd6aa69db ("mtd: rawnand: sunxi: introduce maximize variable user data length")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/r/20260909085138.9A98A1F00A3D@smtp.kernel.org
Closes: https://lore.kernel.org/r/20260914031929.2E7091F000FF@smtp.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 202 ++++++++++++++++++++++++++------------
1 file changed, 139 insertions(+), 63 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 931d437e196b..54377f1789a3 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -54,6 +54,7 @@
#define NFC_REG_H6_RDATA_1 0x004C
#define NFC_REG_A10_USER_DATA 0x0050
#define NFC_REG_H6_USER_DATA 0x0080
+#define NFC_H6_USER_DATA_REGS 32
#define NFC_REG_USER_DATA(nfc, x) (nfc->caps->reg_user_data + ((x) * 4))
#define NFC_REG_H6_USER_DATA_LEN 0x0070
/* A USER_DATA_LEN register can hold the length of 8 USER_DATA registers */
@@ -974,7 +975,36 @@ static u8 sunxi_nfc_user_data_sz(struct sunxi_nand_chip *sunxi_nand, int step)
return sunxi_nand->user_data_bytes[step];
}
-/* PIO uses register zero; DMA concatenates user data within each transfer. */
+/* Keep the on-flash layout, but fit each DMA batch in the user-data bank. */
+static int sunxi_nfc_dma_batch_steps(struct nand_chip *nand,
+ int first_step, int end_step)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ unsigned int user_data_sz = 0;
+ int i;
+
+ if (!nfc->caps->reg_user_data_len)
+ return end_step - first_step;
+
+ /*
+ * PAGE_OP generates main-data columns from hardware slot zero, not
+ * from the initial column. Use only slot zero after the first batch,
+ * so the explicit column change selects each remaining logical step.
+ */
+ if (first_step)
+ return 1;
+
+ for (i = first_step; i < end_step; i++) {
+ user_data_sz += sunxi_nfc_user_data_sz(sunxi_nand, i);
+ if (user_data_sz > NFC_H6_USER_DATA_REGS * sizeof(u32))
+ break;
+ }
+
+ return i - first_step;
+}
+
+/* PIO uses register zero; DMA concatenates user data within each batch. */
static void sunxi_nfc_hw_ecc_get_prot_oob_bytes(struct nand_chip *nand, u8 *oob,
unsigned int reg_index, bool bbm, int page,
unsigned int user_data_sz)
@@ -1399,30 +1429,32 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
pattern_found, step, 1);
}
-static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
- int oob_required, int page, int nchunks)
+static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read,
+ int first_step, int nchunks)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- struct sunxi_nfc_ecc_read read = {
- .buf = buf,
- .page = page,
- .oob_required = oob_required,
- .dma = true,
- };
- unsigned int corrected = mtd->ecc_stats.corrected;
- unsigned int failed = mtd->ecc_stats.failed;
struct scatterlist sg;
+ int page = read->page;
int ret, i;
u32 status, pattern_found, wait;
+ if (first_step) {
+ ret = sunxi_nfc_read_column(nand, page, first_step * ecc->size,
+ NULL, 0);
+ if (ret)
+ return ret;
+ }
+
ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
if (ret)
return ret;
- ret = sunxi_nfc_dma_op_prepare(nfc, buf, ecc->size, nchunks,
+ ret = sunxi_nfc_dma_op_prepare(nfc, read->buf + first_step * ecc->size,
+ ecc->size, nchunks,
DMA_FROM_DEVICE, &sg);
if (ret)
return ret;
@@ -1430,7 +1462,12 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
sunxi_nfc_hw_ecc_enable(nand);
sunxi_nfc_reset_user_data_len(nfc);
for (i = 0; i < nchunks; i++)
- sunxi_nfc_set_user_data_len(nfc, sunxi_nfc_user_data_sz(sunxi_nand, i), i);
+ sunxi_nfc_set_user_data_len(nfc,
+ sunxi_nfc_user_data_sz(sunxi_nand, first_step + i), i);
+ /* exec_op() restores the page's spare base during column changes. */
+ if (first_step)
+ writel(mtd->writesize + sunxi_get_oob_offset(sunxi_nand, ecc, first_step),
+ nfc->regs + NFC_REG_SPARE_AREA(nfc));
sunxi_nfc_randomizer_config(nand, page, false);
sunxi_nfc_randomizer_enable(nand);
@@ -1462,10 +1499,32 @@ static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
status = readl(nfc->regs + NFC_REG_ECC_ST);
pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
- ret = sunxi_nand->oob_ops->read_batch(nand, &read, status, pattern_found,
- 0, nchunks);
- if (ret)
- goto err_stats;
+
+ return sunxi_nand->oob_ops->read_batch(nand, read, status, pattern_found,
+ first_step, nchunks);
+}
+
+static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
+ int oob_required, int page, int nchunks)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct mtd_info *mtd = nand_to_mtd(nand);
+ struct sunxi_nfc_ecc_read read = {
+ .buf = buf,
+ .page = page,
+ .oob_required = oob_required,
+ .dma = true,
+ };
+ unsigned int corrected = mtd->ecc_stats.corrected;
+ unsigned int failed = mtd->ecc_stats.failed;
+ int first_step, batch_steps, ret;
+
+ for (first_step = 0; first_step < nchunks; first_step += batch_steps) {
+ batch_steps = sunxi_nfc_dma_batch_steps(nand, first_step, nchunks);
+ ret = sunxi_nfc_hw_ecc_read_batch_dma(nand, &read, first_step, batch_steps);
+ if (ret)
+ goto err_stats;
+ }
ret = sunxi_nand->oob_ops->finish_read(nand, &read, NULL);
if (ret < 0)
@@ -1759,71 +1818,88 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
{
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
struct scatterlist sg;
- unsigned int reg_index = 0;
u32 wait;
- int ret, i;
+ int first_step, batch_steps, ret, i;
sunxi_nfc_select_chip(nand, nand->cur_cs);
- ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
- if (ret)
- return ret;
+ for (first_step = 0; first_step < ecc->steps; first_step += batch_steps) {
+ unsigned int reg_index = 0;
- ret = sunxi_nfc_dma_op_prepare(nfc, buf, ecc->size, ecc->steps,
- DMA_TO_DEVICE, &sg);
- if (ret)
- goto pio_fallback;
+ batch_steps = sunxi_nfc_dma_batch_steps(nand, first_step, ecc->steps);
+ ret = sunxi_nfc_wait_cmd_fifo_empty(nfc);
+ if (ret)
+ return ret;
- sunxi_nfc_reset_user_data_len(nfc);
- for (i = 0; i < ecc->steps; i++) {
- unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, i);
- int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
- const u8 *oob = nand->oob_poi + oob_off;
+ ret = sunxi_nfc_dma_op_prepare(nfc, buf + first_step * ecc->size,
+ ecc->size, batch_steps, DMA_TO_DEVICE, &sg);
+ if (ret) {
+ /* Only retry before any part of the page has been transferred. */
+ if (first_step)
+ return ret;
+ goto pio_fallback;
+ }
- sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, reg_index, !i, page,
- user_data_sz);
- sunxi_nfc_set_user_data_len(nfc, user_data_sz, i);
- reg_index += user_data_sz / 4;
- }
+ sunxi_nfc_reset_user_data_len(nfc);
+ for (i = first_step; i < first_step + batch_steps; i++) {
+ unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, i);
+ int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
+ const u8 *oob = nand->oob_poi + oob_off;
- ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
- if (ret) {
- sunxi_nfc_dma_op_abort(nfc);
- sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
- return ret;
- }
+ sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, reg_index, !i,
+ page, user_data_sz);
+ sunxi_nfc_set_user_data_len(nfc, user_data_sz, i - first_step);
+ reg_index += user_data_sz / 4;
+ }
- sunxi_nfc_hw_ecc_enable(nand);
- sunxi_nfc_randomizer_config(nand, page, false);
- sunxi_nfc_randomizer_enable(nand);
+ if (first_step)
+ ret = nand_change_write_column_op(nand, first_step * ecc->size,
+ NULL, 0, false);
+ else
+ ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
+ if (ret) {
+ sunxi_nfc_dma_op_abort(nfc);
+ sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
+ return ret;
+ }
- writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
- nfc->regs + NFC_REG_WCMD_SET);
+ /* exec_op() restores the page's spare base during column changes. */
+ if (first_step)
+ writel(mtd->writesize + sunxi_get_oob_offset(sunxi_nand, ecc, first_step),
+ nfc->regs + NFC_REG_SPARE_AREA(nfc));
+ sunxi_nfc_hw_ecc_enable(nand);
+ sunxi_nfc_randomizer_config(nand, page, false);
+ sunxi_nfc_randomizer_enable(nand);
- wait = NFC_CMD_INT_FLAG;
+ writel((NAND_CMD_RNDIN << 8) | NAND_CMD_PAGEPROG,
+ nfc->regs + NFC_REG_WCMD_SET);
- if (nfc->use_mdma)
- wait |= NFC_DMA_INT_FLAG;
- else
- dma_async_issue_pending(nfc->dmac);
+ wait = NFC_CMD_INT_FLAG;
- writel(NFC_PAGE_OP | NFC_DATA_SWAP_METHOD |
- NFC_DATA_TRANS | NFC_ACCESS_DIR,
- nfc->regs + NFC_REG_CMD);
+ if (nfc->use_mdma)
+ wait |= NFC_DMA_INT_FLAG;
+ else
+ dma_async_issue_pending(nfc->dmac);
- ret = sunxi_nfc_wait_events(nfc, wait, false, 0);
- if (ret)
- sunxi_nfc_dma_op_abort(nfc);
+ writel(NFC_PAGE_OP | NFC_DATA_SWAP_METHOD |
+ NFC_DATA_TRANS | NFC_ACCESS_DIR,
+ nfc->regs + NFC_REG_CMD);
- sunxi_nfc_randomizer_disable(nand);
- sunxi_nfc_hw_ecc_disable(nand);
+ ret = sunxi_nfc_wait_events(nfc, wait, false, 0);
+ if (ret)
+ sunxi_nfc_dma_op_abort(nfc);
- sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
+ sunxi_nfc_randomizer_disable(nand);
+ sunxi_nfc_hw_ecc_disable(nand);
- if (ret)
- return ret;
+ sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
+
+ if (ret)
+ return ret;
+ }
if (oob_required || (nand->options & NAND_NEED_SCRAMBLING)) {
/* TODO: use DMA to transfer extra OOB bytes ? */
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 15/26] mtd: rawnand: sunxi: send all address cycles in split operations
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (13 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 14/26] mtd: rawnand: sunxi: bound DMA batches by the user-data register bank James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 16/26] mtd: rawnand: sunxi: propagate chip clock setup errors James Hilliard
` (10 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
nand_subop_get_num_addr_cyc() returns the number of cycles in the current
suboperation, not the end offset in the original address instruction.
Comparing that count with the start offset plus the loop index drops
cycles when the parser splits an address instruction.
For example, an instruction with ten address cycles is accepted by the
parser and split into eight cycles followed by two. The second
suboperation starts at offset eight, so the old loop sends no address
at all while reporting success.
Use the returned count as the loop bound and retain the start offset only
when indexing the original address buffer. The parser limits each
suboperation to the eight cycles supported by the address registers.
Fixes: df5057999f8c ("mtd: rawnand: sunxi: Migrate to ->exec_op()")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 54377f1789a3..0b92bbe19c0a 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -2518,7 +2518,7 @@ static int sunxi_nfc_exec_subop(struct nand_chip *nand,
case NAND_OP_ADDR_INSTR:
remaining = nand_subop_get_num_addr_cyc(subop, i);
start = nand_subop_get_addr_start_off(subop, i);
- for (j = 0; j < 8 && j + start < remaining; j++) {
+ for (j = 0; j < remaining; j++) {
u32 addr = instr->ctx.addr.addrs[j + start];
addrs[j / 4] |= addr << (j % 4) * 8;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 16/26] mtd: rawnand: sunxi: propagate chip clock setup errors
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (14 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 15/26] mtd: rawnand: sunxi: send all address cycles in split operations James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 17/26] mtd: rawnand: sunxi: limit buffer transfers to the command byte count James Hilliard
` (9 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
Chip selection ignores clk_set_rate() failures and caches the requested
rate anyway. It then installs timing registers calculated for that rate
and proceeds with the NAND operation. Subsequent selections do not retry
the rate change because the cache already matches the requested rate.
Return the clock error before changing the controller configuration and
update the cached rate only after a successful clock change. Propagate
the error through exec_op() and the DMA page-write path so neither issues
a command with timings for a clock rate that was not installed.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 32 ++++++++++++++++++++++----------
1 file changed, 22 insertions(+), 10 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 0b92bbe19c0a..7c80f52c517d 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -651,16 +651,25 @@ static void sunxi_nfc_dma_op_abort(struct sunxi_nfc *nfc)
dmaengine_terminate_all(nfc->dmac);
}
-static void sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
+static int sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
{
struct mtd_info *mtd = nand_to_mtd(nand);
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
struct sunxi_nfc *nfc = to_sunxi_nfc(sunxi_nand->nand.controller);
struct sunxi_nand_chip_sel *sel;
u32 ctl;
+ int ret;
if (cs >= sunxi_nand->nsels)
- return;
+ return -EINVAL;
+
+ if (nfc->clk_rate != sunxi_nand->clk_rate) {
+ ret = clk_set_rate(nfc->mod_clk, sunxi_nand->clk_rate);
+ if (ret)
+ return ret;
+
+ nfc->clk_rate = sunxi_nand->clk_rate;
+ }
ctl = readl(nfc->regs + NFC_REG_CTL) &
~(NFC_PAGE_SHIFT_MSK | NFC_CE_SEL_MSK | NFC_RB_SEL_MSK | NFC_EN);
@@ -672,14 +681,11 @@ static void sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
writel(mtd->writesize, nfc->regs + NFC_REG_SPARE_AREA(nfc));
- if (nfc->clk_rate != sunxi_nand->clk_rate) {
- clk_set_rate(nfc->mod_clk, sunxi_nand->clk_rate);
- nfc->clk_rate = sunxi_nand->clk_rate;
- }
-
writel(sunxi_nand->timing_ctl, nfc->regs + NFC_REG_TIMING_CTL);
writel(sunxi_nand->timing_cfg, nfc->regs + NFC_REG_TIMING_CFG);
writel(ctl, nfc->regs + NFC_REG_CTL);
+
+ return 0;
}
static int sunxi_nfc_buf_chunk_size(struct sunxi_nfc *nfc, int len)
@@ -1824,7 +1830,9 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
u32 wait;
int first_step, batch_steps, ret, i;
- sunxi_nfc_select_chip(nand, nand->cur_cs);
+ ret = sunxi_nfc_select_chip(nand, nand->cur_cs);
+ if (ret)
+ return ret;
for (first_step = 0; first_step < ecc->steps; first_step += batch_steps) {
unsigned int reg_index = 0;
@@ -2627,9 +2635,13 @@ static int sunxi_nfc_exec_op(struct nand_chip *nand,
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
const struct nand_op_parser *parser;
+ int ret;
- if (!check_only)
- sunxi_nfc_select_chip(nand, op->cs);
+ if (!check_only) {
+ ret = sunxi_nfc_select_chip(nand, op->cs);
+ if (ret)
+ return ret;
+ }
if (sunxi_nand->sels[op->cs].rb >= 0)
parser = &sunxi_nfc_op_parser;
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 17/26] mtd: rawnand: sunxi: limit buffer transfers to the command byte count
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (15 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 16/26] mtd: rawnand: sunxi: propagate chip clock setup errors James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 18/26] mtd: rawnand: sunxi: skip unavailable NAND child nodes James Hilliard
` (8 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
The H616 capabilities advertise an 8 KiB SRAM size, but the normal-command
byte counter still holds only ten bits, with zero encoding 1024 bytes.
sunxi_nfc_read_buf() and sunxi_nfc_write_buf() use the SRAM size as their
chunk limit and advance the buffer offset by the requested count. A count
above 1024 therefore transfers fewer bytes than the helpers account for.
The operation parser already splits data transfers at 1024 bytes, but the
extra-OOB helpers call the buffer helpers directly. A sufficiently large
unprotected OOB tail can thus be read or written incompletely while the
page operation returns success.
Limit each buffer transfer to both the SRAM size and the command byte
count. Share that limit with the operation parser. Existing 1 KiB SRAM
controllers retain their chunking, and larger buffers are transferred
using successive commands.
Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 13 ++++++++-----
1 file changed, 8 insertions(+), 5 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 7c80f52c517d..636a04f49418 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -89,6 +89,9 @@
#define NFC_RAM0_BASE 0x0400
#define NFC_RAM1_BASE 0x0800
+/* Maximum byte count for a normal data-transfer command. */
+#define NFC_MAX_BYTE_COUNT 1024
+
/* define bit use in NFC_CTL */
#define NFC_EN BIT(0)
#define NFC_RESET BIT(1)
@@ -690,7 +693,7 @@ static int sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
static int sunxi_nfc_buf_chunk_size(struct sunxi_nfc *nfc, int len)
{
- return min(len, nfc->caps->sram_size);
+ return min3(len, nfc->caps->sram_size, NFC_MAX_BYTE_COUNT);
}
static int sunxi_nfc_read_buf(struct nand_chip *nand, u8 *buf, int len)
@@ -2606,11 +2609,11 @@ static const struct nand_op_parser sunxi_nfc_op_parser = NAND_OP_PARSER(
NAND_OP_PARSER_PAT_ADDR_ELEM(true, 8),
NAND_OP_PARSER_PAT_CMD_ELEM(true),
NAND_OP_PARSER_PAT_WAITRDY_ELEM(true),
- NAND_OP_PARSER_PAT_DATA_IN_ELEM(true, 1024)),
+ NAND_OP_PARSER_PAT_DATA_IN_ELEM(true, NFC_MAX_BYTE_COUNT)),
NAND_OP_PARSER_PATTERN(sunxi_nfc_exec_subop,
NAND_OP_PARSER_PAT_CMD_ELEM(true),
NAND_OP_PARSER_PAT_ADDR_ELEM(true, 8),
- NAND_OP_PARSER_PAT_DATA_OUT_ELEM(true, 1024),
+ NAND_OP_PARSER_PAT_DATA_OUT_ELEM(true, NFC_MAX_BYTE_COUNT),
NAND_OP_PARSER_PAT_CMD_ELEM(true),
NAND_OP_PARSER_PAT_WAITRDY_ELEM(true)),
);
@@ -2620,11 +2623,11 @@ static const struct nand_op_parser sunxi_nfc_norb_op_parser = NAND_OP_PARSER(
NAND_OP_PARSER_PAT_CMD_ELEM(true),
NAND_OP_PARSER_PAT_ADDR_ELEM(true, 8),
NAND_OP_PARSER_PAT_CMD_ELEM(true),
- NAND_OP_PARSER_PAT_DATA_IN_ELEM(true, 1024)),
+ NAND_OP_PARSER_PAT_DATA_IN_ELEM(true, NFC_MAX_BYTE_COUNT)),
NAND_OP_PARSER_PATTERN(sunxi_nfc_exec_subop,
NAND_OP_PARSER_PAT_CMD_ELEM(true),
NAND_OP_PARSER_PAT_ADDR_ELEM(true, 8),
- NAND_OP_PARSER_PAT_DATA_OUT_ELEM(true, 1024),
+ NAND_OP_PARSER_PAT_DATA_OUT_ELEM(true, NFC_MAX_BYTE_COUNT),
NAND_OP_PARSER_PAT_CMD_ELEM(true)),
NAND_OP_PARSER_PATTERN(sunxi_nfc_soft_waitrdy,
NAND_OP_PARSER_PAT_WAITRDY_ELEM(false)),
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 18/26] mtd: rawnand: sunxi: skip unavailable NAND child nodes
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (16 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 17/26] mtd: rawnand: sunxi: limit buffer transfers to the command byte count James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 19/26] mtd: rawnand: sunxi: scan all chips before registering MTD devices James Hilliard
` (7 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
sunxi_nand_chips_init() scans every child of the controller node,
including those marked disabled or reserved. Neither the chip setup nor
the NAND scan path checks availability, so these children are still
probed and registered. If an unavailable child describes an absent chip,
its scan failure can also prevent the other chips from being used.
Iterate over available children so unavailable nodes are skipped before
claiming their chip selects or issuing NAND commands. Keep the scoped
iterator so node references are released on both normal and error exits.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 636a04f49418..3de9ed6795fe 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -2771,7 +2771,7 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
struct device_node *np = dev->of_node;
int ret;
- for_each_child_of_node_scoped(np, nand_np) {
+ for_each_available_child_of_node_scoped(np, nand_np) {
ret = sunxi_nand_chip_init(dev, nfc, nand_np);
if (ret) {
sunxi_nand_chips_cleanup(nfc);
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 19/26] mtd: rawnand: sunxi: scan all chips before registering MTD devices
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (17 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 18/26] mtd: rawnand: sunxi: skip unavailable NAND child nodes James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 20/26] dt-bindings: mtd: sunxi: require the H616 AHB reset James Hilliard
` (6 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
sunxi_nand_chips_init() scans and registers each NAND child before
starting the next one. Registering the first MTD device allows users to
access it while the next child is being identified on the same NFC.
Normal NAND I/O holds the controller mutex, but nand_scan_ident() does
not take it. Its RESET and READ ID operations can therefore change the
shared chip select and timing while an operation on an already
registered chip is in progress. The normal I/O can likewise interfere
with identification.
Scan all chips before registering any MTD devices. Add each successfully
scanned chip to the controller's list and track whether its MTD has been
registered, so a scan or registration failure cleans up every scanned
chip and unregisters only the devices that were successfully registered.
Fixes: 1fef62c1423b ("mtd: nand: add sunxi NAND flash controller support")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 3de9ed6795fe..e1306d14ab3a 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -298,6 +298,7 @@ struct sunxi_nfc_oob_ops {
* @nsels: number of CS lines required by the NAND chip
* @sels: array of CS lines descriptions
* @user_data_bytes: array of user data lengths for all ECC steps
+ * @registered: whether the MTD device has been registered
*/
struct sunxi_nand_chip {
struct list_head node;
@@ -308,6 +309,7 @@ struct sunxi_nand_chip {
u32 timing_cfg;
u32 timing_ctl;
u8 *user_data_bytes;
+ bool registered;
int nsels;
struct sunxi_nand_chip_sel sels[] __counted_by(nsels);
};
@@ -2672,8 +2674,10 @@ static void sunxi_nand_chips_cleanup(struct sunxi_nfc *nfc)
struct sunxi_nand_chip,
node);
chip = &sunxi_nand->nand;
- ret = mtd_device_unregister(nand_to_mtd(chip));
- WARN_ON(ret);
+ if (sunxi_nand->registered) {
+ ret = mtd_device_unregister(nand_to_mtd(chip));
+ WARN_ON(ret);
+ }
nand_cleanup(chip);
list_del(&sunxi_nand->node);
}
@@ -2754,13 +2758,6 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
if (ret)
return ret;
- ret = mtd_device_register(mtd, NULL, 0);
- if (ret) {
- dev_err(dev, "failed to register mtd device: %d\n", ret);
- nand_cleanup(nand);
- return ret;
- }
-
list_add_tail(&sunxi_nand->node, &nfc->chips);
return 0;
@@ -2768,6 +2765,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
{
+ struct sunxi_nand_chip *sunxi_nand;
struct device_node *np = dev->of_node;
int ret;
@@ -2779,6 +2777,18 @@ static int sunxi_nand_chips_init(struct device *dev, struct sunxi_nfc *nfc)
}
}
+ /* NAND identification must finish before MTD users can access the NFC. */
+ list_for_each_entry(sunxi_nand, &nfc->chips, node) {
+ ret = mtd_device_register(nand_to_mtd(&sunxi_nand->nand), NULL, 0);
+ if (ret) {
+ dev_err(dev, "failed to register mtd device: %d\n", ret);
+ sunxi_nand_chips_cleanup(nfc);
+ return ret;
+ }
+
+ sunxi_nand->registered = true;
+ }
+
return 0;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 20/26] dt-bindings: mtd: sunxi: require the H616 AHB reset
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (18 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 19/26] mtd: rawnand: sunxi: scan all chips before registering MTD devices James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 21/26] mtd: rawnand: sunxi: reset the H616 data path after DMA aborts James Hilliard
` (5 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
The H616 NAND controller needs its AHB reset to stop internal DMA and
restore data ordering after an aborted transfer. The controller's soft
reset alone can leave the next read displaced.
Require resets and reset-names for the H616 compatible so the binding
describes the reset needed for recovery. The existing H616 SoC description
already provides the named AHB reset.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml | 3 +++
1 file changed, 3 insertions(+)
diff --git a/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml b/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
index 9d061e2216cb..ccf616fabc91 100644
--- a/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
+++ b/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
@@ -119,6 +119,9 @@ allOf:
minItems: 4
clock-names:
minItems: 4
+ required:
+ - resets
+ - reset-names
examples:
- |
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 21/26] mtd: rawnand: sunxi: reset the H616 data path after DMA aborts
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (19 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 20/26] dt-bindings: mtd: sunxi: require the H616 AHB reset James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 22/26] mtd: rawnand: sunxi: reuse ECC status within each transfer James Hilliard
` (4 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
Resetting an active H616 MDMA read with NFC_CTL.RESET can leave the first
1 KiB of the next read displaced. Both raw and ECC reads are affected,
including reads for which ECC reports success. Reissuing the NAND read
command and restoring the visible controller configuration do not correct
the internal data-path state. The DMA read error path can therefore return
incorrect data when it retries through PIO.
Pulse the controller's exclusive AHB reset after stopping an H616 DMA
operation. Drain interrupts before resetting the registers and clear the
pending events before accepting another command. The next operation
selects its chip and restores the page layout and timings; reads retry
from a fresh whole-page setup, while interrupted writes return an error.
Require the AHB reset at probe and exercise the same reset operation before
accepting transfers. Perform the AHB reset before releasing the DMA
mapping. This relies on the H616 CCU reset callback, which asserts
and deasserts the reset through register updates and returns success. The
reset handle pins the provider module, and the CCU driver suppresses sysfs
unbinding.
Propagate unexpected reset errors, leave the IRQ disabled and reject
subsequent commands. Avoid register access after failed recovery. Error
propagation is not a substitute for stopping DMA if the supported reset
provider contract is violated.
Select the stronger recovery through H616 capability data, leaving older
controllers' abort sequences unchanged.
Fixes: 5ee37db34637 ("mtd: rawnand: sunxi: add H616 MBUS DMA support")
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 90 +++++++++++++++++++++++++++++++++------
1 file changed, 76 insertions(+), 14 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index e1306d14ab3a..e8286dc360ac 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -335,6 +335,7 @@ struct sunxi_nfc_mdma_desc {
* @has_ecc_block_512: If the ECC can handle 512B or only 1024B chunks
* @has_ecc_clk: If the controller needs an ECC clock.
* @has_mbus_clk: If the controller needs a mbus clock.
+ * @needs_bus_reset: Aborted DMA needs an AHB reset to restore data ordering
* @legacy_max_strength:If the maximize strength function was off by 2 bytes
* NB: this should not be used in new controllers
* @reg_io_data: I/O data register
@@ -368,6 +369,7 @@ struct sunxi_nfc_caps {
bool has_ecc_block_512;
bool has_ecc_clk;
bool has_mbus_clk;
+ bool needs_bus_reset;
bool legacy_max_strength;
unsigned int reg_io_data;
unsigned int reg_ecc_err_cnt;
@@ -412,6 +414,7 @@ struct sunxi_nfc_caps {
* @use_mdma: use an internal MBUS DMA backend
* @mdma_desc: H6-style MBUS DMA descriptor
* @mdma_desc_dma: DMA address of @mdma_desc
+ * @recovery_failed: reject further operations after unsuccessful recovery
* @caps: NAND Controller capabilities
*/
struct sunxi_nfc {
@@ -432,6 +435,7 @@ struct sunxi_nfc {
bool use_mdma;
struct sunxi_nfc_mdma_desc *mdma_desc;
dma_addr_t mdma_desc_dma;
+ bool recovery_failed;
const struct sunxi_nfc_caps *caps;
};
@@ -644,16 +648,50 @@ static void sunxi_nfc_dma_op_cleanup(struct sunxi_nfc *nfc,
struct scatterlist *sg)
{
dma_unmap_sg(nfc->dev, sg, 1, ddir);
+ /* Do not access controller registers after failed recovery. */
+ if (nfc->recovery_failed)
+ return;
+
writel(readl(nfc->regs + NFC_REG_CTL) & ~NFC_RAM_METHOD,
nfc->regs + NFC_REG_CTL);
}
-static void sunxi_nfc_dma_op_abort(struct sunxi_nfc *nfc)
+static int sunxi_nfc_dma_op_abort(struct sunxi_nfc *nfc)
{
- if (nfc->use_mdma)
- sunxi_nfc_rst(nfc);
- else
- dmaengine_terminate_all(nfc->dmac);
+ int ret;
+
+ if (!nfc->caps->needs_bus_reset) {
+ if (nfc->use_mdma)
+ sunxi_nfc_rst(nfc);
+ else
+ dmaengine_terminate_all(nfc->dmac);
+ return 0;
+ }
+
+ /* Drain the handler before resetting its registers. */
+ disable_irq(nfc->irq);
+ writel(0, nfc->regs + NFC_REG_INT);
+ readl(nfc->regs + NFC_REG_INT);
+
+ /* A soft reset alone can leave the first subsequent read displaced. */
+ sunxi_nfc_rst(nfc);
+ ret = reset_control_reset(nfc->reset);
+ if (ret)
+ goto failed;
+
+ writel(0, nfc->regs + NFC_REG_INT);
+ writel(NFC_INT_MASK, nfc->regs + NFC_REG_ST);
+ readl(nfc->regs + NFC_REG_INT);
+ enable_irq(nfc->irq);
+
+ /* The next operation selects the chip and restores its timing and layout. */
+ return 0;
+
+failed:
+ /* Keep the IRQ disabled and reject commands after failed recovery. */
+ nfc->recovery_failed = true;
+ dev_err(nfc->dev, "NAND controller recovery failed: %d\n", ret);
+ return ret;
}
static int sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
@@ -665,6 +703,9 @@ static int sunxi_nfc_select_chip(struct nand_chip *nand, unsigned int cs)
u32 ctl;
int ret;
+ if (nfc->recovery_failed)
+ return -EIO;
+
if (cs >= sunxi_nand->nsels)
return -EINVAL;
@@ -1496,8 +1537,14 @@ static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
nfc->regs + NFC_REG_CMD);
ret = sunxi_nfc_wait_events(nfc, wait, false, 0);
- if (ret)
- sunxi_nfc_dma_op_abort(nfc);
+ if (ret) {
+ int abort_ret = sunxi_nfc_dma_op_abort(nfc);
+
+ if (abort_ret) {
+ sunxi_nfc_dma_op_cleanup(nfc, DMA_FROM_DEVICE, &sg);
+ return abort_ret;
+ }
+ }
sunxi_nfc_randomizer_disable(nand);
sunxi_nfc_hw_ecc_disable(nand);
@@ -1874,9 +1921,10 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
else
ret = nand_prog_page_begin_op(nand, page, 0, NULL, 0);
if (ret) {
- sunxi_nfc_dma_op_abort(nfc);
+ int abort_ret = sunxi_nfc_dma_op_abort(nfc);
+
sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
- return ret;
+ return abort_ret ?: ret;
}
/* exec_op() restores the page's spare base during column changes. */
@@ -1902,8 +1950,14 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
nfc->regs + NFC_REG_CMD);
ret = sunxi_nfc_wait_events(nfc, wait, false, 0);
- if (ret)
- sunxi_nfc_dma_op_abort(nfc);
+ if (ret) {
+ int abort_ret = sunxi_nfc_dma_op_abort(nfc);
+
+ if (abort_ret) {
+ sunxi_nfc_dma_op_cleanup(nfc, DMA_TO_DEVICE, &sg);
+ return abort_ret;
+ }
+ }
sunxi_nfc_randomizer_disable(nand);
sunxi_nfc_hw_ecc_disable(nand);
@@ -2904,11 +2958,18 @@ static int sunxi_nfc_probe(struct platform_device *pdev)
}
}
- nfc->reset = devm_reset_control_get_optional_exclusive(dev, "ahb");
+ if (nfc->caps->needs_bus_reset)
+ nfc->reset = devm_reset_control_get_exclusive(dev, "ahb");
+ else
+ nfc->reset = devm_reset_control_get_optional_exclusive(dev, "ahb");
if (IS_ERR(nfc->reset))
- return PTR_ERR(nfc->reset);
+ return dev_err_probe(dev, PTR_ERR(nfc->reset), "failed to get AHB reset\n");
- ret = reset_control_deassert(nfc->reset);
+ /* Exercise the recovery reset operation before accepting DMA transfers. */
+ if (nfc->caps->needs_bus_reset)
+ ret = reset_control_reset(nfc->reset);
+ else
+ ret = reset_control_deassert(nfc->reset);
if (ret) {
dev_err(dev, "reset err %d\n", ret);
return ret;
@@ -3021,6 +3082,7 @@ static const struct sunxi_nfc_caps sunxi_nfc_h616_caps = {
.has_mdma_desc = true,
.has_ecc_clk = true,
.has_mbus_clk = true,
+ .needs_bus_reset = true,
.reg_io_data = NFC_REG_A23_IO_DATA,
.reg_ecc_err_cnt = NFC_REG_H6_ECC_ERR_CNT,
.reg_user_data = NFC_REG_H6_USER_DATA,
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 22/26] mtd: rawnand: sunxi: reuse ECC status within each transfer
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (20 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 21/26] mtd: rawnand: sunxi: reset the H616 data path after DMA aborts James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 23/26] mtd: rawnand: sunxi: avoid redundant column changes for extra OOB James Hilliard
` (3 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
A completed DMA batch leaves one ECC status bitmap and one pattern
bitmap for all its steps. Four consecutive steps also share a packed
correction-counter register. Reading the pattern ID for every matching
step and the counter word for every corrected step repeats MMIO accesses
to the same completed result.
Snapshot status and pattern information once per completed transfer.
Reuse the status read when the controller places pattern-found bits in
the same register, and read the pattern ID only when a non-error step
needs it. Use a cached accessor so a reader can request pattern IDs
without knowing whether the initial snapshot already fetched them.
Cache each packed counter word while consuming its steps.
Keep the snapshot local to a single transfer and invalidate the cached
counter before processing it. Consume lazily read fields before starting
another ECC transfer; each PIO step and DMA batch gets a fresh snapshot.
The ECC decisions and returned correction counts are unchanged, as is
the page layout; only redundant register reads are removed.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 108 ++++++++++++++++++++++++++++----------
1 file changed, 80 insertions(+), 28 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index e8286dc360ac..11fdc10c7f14 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -261,6 +261,7 @@ struct sunxi_nfc_timings {
};
struct sunxi_nfc_ecc_read;
+struct sunxi_nfc_ecc_snapshot;
/* OOB geometry and interpretation; callbacks may issue supplementary reads. */
struct sunxi_nfc_oob_ops {
@@ -276,7 +277,7 @@ struct sunxi_nfc_oob_ops {
* Return zero on success or a negative I/O error.
*/
int (*read_batch)(struct nand_chip *nand, struct sunxi_nfc_ecc_read *read,
- u32 status, u32 pattern_found, int first_step, int nsteps);
+ struct sunxi_nfc_ecc_snapshot *snapshot, int first_step, int nsteps);
/*
* Finish remaining OOB; return max bitflips or a negative I/O error.
* cur_off is an absolute NAND column, or NULL if unknown.
@@ -1212,23 +1213,82 @@ struct sunxi_nfc_ecc_read {
bool has_erased_chunk;
};
+/*
+ * Transfer-local ECC result cache. Pattern IDs and correction counts may be
+ * read lazily, so finish consuming them before the next ECC transfer.
+ */
+struct sunxi_nfc_ecc_snapshot {
+ u32 status;
+ u32 pattern_found;
+ u32 pattern_id;
+ u32 count_reg;
+ u32 count;
+ bool pattern_id_valid;
+};
+
+static void sunxi_nfc_hw_ecc_read_pattern_id(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_snapshot *snapshot)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+
+ /* Zero is a valid pattern ID, so track whether it has been read. */
+ if (snapshot->pattern_id_valid)
+ return;
+
+ snapshot->pattern_id = readl(nfc->regs + NFC_REG_PAT_ID(nfc));
+ snapshot->pattern_id_valid = true;
+}
+
+static void sunxi_nfc_hw_ecc_read_status(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_snapshot *snapshot)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ u32 pattern_found;
+
+ pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
+ snapshot->pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
+ if (nfc->caps->reg_pat_found == NFC_REG_ECC_ST)
+ snapshot->status = pattern_found;
+ else
+ snapshot->status = readl(nfc->regs + NFC_REG_ECC_ST);
+ snapshot->pattern_id_valid = false;
+ if (snapshot->pattern_found & ~snapshot->status)
+ sunxi_nfc_hw_ecc_read_pattern_id(nand, snapshot);
+ /* A new operation, including every PIO step, invalidates the count word. */
+ snapshot->count_reg = ~0U;
+}
+
+static unsigned int
+sunxi_nfc_hw_ecc_read_count(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_snapshot *snapshot, int step)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ u32 reg = NFC_REG_ECC_ERR_CNT(nfc, step);
+
+ /* Four consecutive DMA steps share one error-counter register. */
+ if (snapshot->count_reg != reg) {
+ snapshot->count = readl(nfc->regs + reg);
+ snapshot->count_reg = reg;
+ }
+
+ return NFC_ECC_ERR_CNT(step, snapshot->count);
+}
+
static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
- int step, u32 status, u32 pattern_found,
+ int step, struct sunxi_nfc_ecc_snapshot *snapshot,
unsigned int user_data_sz, bool *erased)
{
- struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct nand_ecc_ctrl *ecc = &nand->ecc;
- u32 tmp;
*erased = false;
- if (status & NFC_ECC_ERR(step))
+ if (snapshot->status & NFC_ECC_ERR(step))
return -EBADMSG;
- if (pattern_found & BIT(step)) {
+ if (snapshot->pattern_found & BIT(step)) {
u8 pattern;
- if (unlikely(!(readl(nfc->regs + NFC_REG_PAT_ID(nfc)) & BIT(step)))) {
+ if (unlikely(!(snapshot->pattern_id & BIT(step)))) {
pattern = 0x0;
} else {
pattern = 0xff;
@@ -1244,9 +1304,7 @@ static int sunxi_nfc_hw_ecc_correct(struct nand_chip *nand, u8 *data, u8 *oob,
return 0;
}
- tmp = readl(nfc->regs + NFC_REG_ECC_ERR_CNT(nfc, step));
-
- return NFC_ECC_ERR_CNT(step, tmp);
+ return sunxi_nfc_hw_ecc_read_count(nand, snapshot, step);
}
/*
@@ -1315,7 +1373,7 @@ static int sunxi_nfc_hw_ecc_read_extra_oob(struct nand_chip *nand,
/* Interpret one PIO step or a completed DMA batch before reusing its status. */
static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
struct sunxi_nfc_ecc_read *read,
- u32 status, u32 pattern_found,
+ struct sunxi_nfc_ecc_snapshot *snapshot,
int first_step, int nsteps)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
@@ -1338,8 +1396,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
bitflips = sunxi_nfc_hw_ecc_correct(nand,
!read->dma || randomized ? data : NULL,
read->oob_required ? oob : NULL,
- i, status, pattern_found,
- user_data_sz, &erased);
+ i, snapshot, user_data_sz, &erased);
if (bitflips < 0) {
/* Preserve PIO data before the raw erased-page check. */
if (!read->dma && !randomized)
@@ -1348,7 +1405,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
}
/* Both patterns are already filled; only all-ones is erased. */
- if (pattern_found & BIT(i)) {
+ if (snapshot->pattern_found & BIT(i)) {
read->has_erased_chunk |= erased;
continue;
}
@@ -1384,7 +1441,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
sunxi_nfc_hw_ecc_update_stats(nand, &read->max_bitflips, bitflips);
}
- if (!(status & NFC_ECC_ERR_MSK(nfc)))
+ if (!(snapshot->status & NFC_ECC_ERR_MSK(nfc)))
return 0;
/* Finish consuming the batch's corrected OOB before raw error rereads. */
@@ -1392,7 +1449,7 @@ static int sunxi_nfc_oob_read_batch(struct nand_chip *nand,
int step = first_step + i;
int data_off, oob_off;
- if (!(status & NFC_ECC_ERR(i)))
+ if (!(snapshot->status & NFC_ECC_ERR(i)))
continue;
data_off = step * ecc->size;
@@ -1434,10 +1491,10 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct nand_ecc_ctrl *ecc = &nand->ecc;
+ struct sunxi_nfc_ecc_snapshot snapshot;
int data_off = step * ecc->size;
int oob_off = nand_to_mtd(nand)->writesize + sunxi_get_oob_offset(sunxi_nand, ecc, step);
int page = read->page;
- u32 pattern_found;
int ret;
if (*cur_off != data_off) {
@@ -1473,12 +1530,9 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
*cur_off = oob_off + ecc->bytes + user_data_sz;
- pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
- pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
+ sunxi_nfc_hw_ecc_read_status(nand, &snapshot);
- return sunxi_nand->oob_ops->read_batch(nand, read,
- readl(nfc->regs + NFC_REG_ECC_ST),
- pattern_found, step, 1);
+ return sunxi_nand->oob_ops->read_batch(nand, read, &snapshot, step, 1);
}
static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
@@ -1489,10 +1543,11 @@ static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
struct mtd_info *mtd = nand_to_mtd(nand);
struct nand_ecc_ctrl *ecc = &nand->ecc;
+ struct sunxi_nfc_ecc_snapshot snapshot;
struct scatterlist sg;
int page = read->page;
int ret, i;
- u32 status, pattern_found, wait;
+ u32 wait;
if (first_step) {
ret = sunxi_nfc_read_column(nand, page, first_step * ecc->size,
@@ -1554,12 +1609,9 @@ static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
if (ret)
return ret;
- status = readl(nfc->regs + NFC_REG_ECC_ST);
- pattern_found = readl(nfc->regs + nfc->caps->reg_pat_found);
- pattern_found = field_get(NFC_ECC_PAT_FOUND_MSK(nfc), pattern_found);
+ sunxi_nfc_hw_ecc_read_status(nand, &snapshot);
- return sunxi_nand->oob_ops->read_batch(nand, read, status, pattern_found,
- first_step, nchunks);
+ return sunxi_nand->oob_ops->read_batch(nand, read, &snapshot, first_step, nchunks);
}
static int sunxi_nfc_hw_ecc_read_chunks_dma(struct nand_chip *nand, u8 *buf,
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 23/26] mtd: rawnand: sunxi: avoid redundant column changes for extra OOB
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (21 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 22/26] mtd: rawnand: sunxi: reuse ECC status within each transfer James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 24/26] mtd: rawnand: sunxi: reduce user-data length register accesses James Hilliard
` (2 subsequent siblings)
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
Extra OOB is the spare-area tail after the last ECC step's protected
user data and parity. The PIO write loop tracks cur_off as an absolute
NAND column, starting at zero in the main-data area. The extra-OOB
helper instead compares it with an offset relative to the OOB start. It
therefore requests a column change even when the last step has already
reached the tail.
Add mtd->writesize to the comparison, as the read helper already does.
The comparison and the column-change command then refer to the same
byte. Keep the command when the cursor differs or is unknown, including
the DMA path, which passes no cursor. No transferred data or OOB layout
changes.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 11fdc10c7f14..c9135c8abf54 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -1718,7 +1718,7 @@ static int sunxi_nfc_hw_ecc_write_extra_oob(struct nand_chip *nand,
if (len <= 0)
return 0;
- if (!cur_off || *cur_off != offset) {
+ if (!cur_off || *cur_off != (offset + mtd->writesize)) {
ret = nand_change_write_column_op(nand, offset + mtd->writesize,
NULL, 0, false);
if (ret)
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 24/26] mtd: rawnand: sunxi: reduce user-data length register accesses
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (22 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 23/26] mtd: rawnand: sunxi: avoid redundant column changes for extra OOB James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 25/26] dt-bindings: mtd: sunxi: Add randomized OOB flag James Hilliard
2026-11-05 18:55 ` [PATCH v10 26/26] mtd: rawnand: sunxi: support the Allwinner randomized OOB format James Hilliard
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
H6/H616 pack eight ECC steps' user-data length codes into each 32-bit
register. DMA currently clears all these registers, then
read-modify-writes one field per step, repeatedly accessing the same
words. Code zero means no user data; the other codes select lengths from
the controller's table.
Build each packed value in memory and write it once per DMA batch,
including zeros for unused slots. Take each length from the batch's
logical step but encode it in the corresponding batch-local hardware
slot. Rewrite every register on each batch rather than caching values
across resets or changes of chip.
Share the encoding with a PIO setter. PIO always uses hardware slot
zero, and its page callbacks clear all length registers before the chunk
loop. It can therefore write the slot-zero code directly, without a
read-modify-write. Keep the page-level clearing so unused slots are also
cleared after a DMA-to-PIO fallback. Older controllers without length
registers remain unaffected, and the chosen lengths and on-flash layout
do not change.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 79 +++++++++++++++++++++++++--------------
1 file changed, 50 insertions(+), 29 deletions(-)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index c9135c8abf54..814331e16bce 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -57,7 +57,7 @@
#define NFC_H6_USER_DATA_REGS 32
#define NFC_REG_USER_DATA(nfc, x) (nfc->caps->reg_user_data + ((x) * 4))
#define NFC_REG_H6_USER_DATA_LEN 0x0070
-/* A USER_DATA_LEN register can hold the length of 8 USER_DATA registers */
+/* Each USER_DATA_LEN register holds eight 4-bit ECC-step user-data length codes. */
#define NFC_REG_USER_DATA_LEN_CAPACITY 8
#define NFC_REG_USER_DATA_LEN(nfc, step) \
(nfc->caps->reg_user_data_len + \
@@ -1093,35 +1093,60 @@ static void sunxi_nfc_reset_user_data_len(struct sunxi_nfc *nfc)
writel(0, nfc->regs + NFC_REG_USER_DATA_LEN(nfc, i));
}
-static void sunxi_nfc_set_user_data_len(struct sunxi_nfc *nfc,
- int len, int step)
+static int sunxi_nfc_user_data_len_code(struct sunxi_nfc *nfc, int len)
{
- bool found = false;
- u32 val;
int i;
+ for (i = 0; i < nfc->caps->nuser_data_tab; i++) {
+ if (len == nfc->caps->user_data_len_tab[i])
+ return i;
+ }
+
+ dev_warn(nfc->dev, "Unsupported length for user data reg: %d\n", len);
+ return -EINVAL;
+}
+
+static void sunxi_nfc_set_user_data_len_pio(struct sunxi_nfc *nfc, int len)
+{
+ int code;
+
/* not all SoCs have this register */
if (!nfc->caps->reg_user_data_len)
return;
- for (i = 0; i < nfc->caps->nuser_data_tab; i++) {
- if (len == nfc->caps->user_data_len_tab[i]) {
- found = true;
- break;
- }
- }
-
- if (!found) {
- dev_warn(nfc->dev,
- "Unsupported length for user data reg: %d\n", len);
+ code = sunxi_nfc_user_data_len_code(nfc, len);
+ if (code < 0)
return;
- }
- val = readl(nfc->regs + NFC_REG_USER_DATA_LEN(nfc, step));
+ /* PIO uses slot zero; the page callback clears all other slots. */
+ writel(FIELD_PREP(NFC_USER_DATA_LEN_MSK(0), code),
+ nfc->regs + NFC_REG_USER_DATA_LEN(nfc, 0));
+}
+
+static void sunxi_nfc_set_user_data_len_dma(struct nand_chip *nand,
+ int first_step, int nchunks)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ int first, step, len, code;
+ u32 val;
+
+ if (!nfc->caps->reg_user_data_len)
+ return;
- val &= ~NFC_USER_DATA_LEN_MSK(step);
- val |= field_prep(NFC_USER_DATA_LEN_MSK(step), i);
- writel(val, nfc->regs + NFC_REG_USER_DATA_LEN(nfc, step));
+ /* Write each packed register once, including zeroes for unused slots. */
+ for (first = 0; first < nfc->caps->max_ecc_steps;
+ first += NFC_REG_USER_DATA_LEN_CAPACITY) {
+ val = 0;
+ for (step = first; step < nchunks &&
+ step < first + NFC_REG_USER_DATA_LEN_CAPACITY; step++) {
+ len = sunxi_nfc_user_data_sz(sunxi_nand, first_step + step);
+ code = sunxi_nfc_user_data_len_code(nfc, len);
+ if (code >= 0)
+ val |= field_prep(NFC_USER_DATA_LEN_MSK(step), code);
+ }
+ writel(val, nfc->regs + NFC_REG_USER_DATA_LEN(nfc, first));
+ }
}
static void sunxi_nfc_hw_ecc_set_prot_oob_bytes(struct nand_chip *nand,
@@ -1517,7 +1542,7 @@ static int sunxi_nfc_hw_ecc_read_chunk(struct nand_chip *nand,
if (ret)
return ret;
- sunxi_nfc_set_user_data_len(nfc, user_data_sz, 0);
+ sunxi_nfc_set_user_data_len_pio(nfc, user_data_sz);
sunxi_nfc_randomizer_config(nand, page, false);
sunxi_nfc_randomizer_enable(nand);
writel(NFC_DATA_TRANS | NFC_DATA_SWAP_METHOD | NFC_ECC_OP,
@@ -1546,7 +1571,7 @@ static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
struct sunxi_nfc_ecc_snapshot snapshot;
struct scatterlist sg;
int page = read->page;
- int ret, i;
+ int ret;
u32 wait;
if (first_step) {
@@ -1567,10 +1592,7 @@ static int sunxi_nfc_hw_ecc_read_batch_dma(struct nand_chip *nand,
return ret;
sunxi_nfc_hw_ecc_enable(nand);
- sunxi_nfc_reset_user_data_len(nfc);
- for (i = 0; i < nchunks; i++)
- sunxi_nfc_set_user_data_len(nfc,
- sunxi_nfc_user_data_sz(sunxi_nand, first_step + i), i);
+ sunxi_nfc_set_user_data_len_dma(nand, first_step, nchunks);
/* exec_op() restores the page's spare base during column changes. */
if (first_step)
writel(mtd->writesize + sunxi_get_oob_offset(sunxi_nand, ecc, first_step),
@@ -1686,7 +1708,7 @@ static int sunxi_nfc_hw_ecc_write_chunk(struct nand_chip *nand,
sunxi_nfc_randomizer_config(nand, page, false);
sunxi_nfc_randomizer_enable(nand);
- sunxi_nfc_set_user_data_len(nfc, user_data_sz, nfc_step);
+ sunxi_nfc_set_user_data_len_pio(nfc, user_data_sz);
sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, nfc_step, bbm, page,
user_data_sz);
@@ -1955,7 +1977,7 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
goto pio_fallback;
}
- sunxi_nfc_reset_user_data_len(nfc);
+ sunxi_nfc_set_user_data_len_dma(nand, first_step, batch_steps);
for (i = first_step; i < first_step + batch_steps; i++) {
unsigned int user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, i);
int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
@@ -1963,7 +1985,6 @@ static int sunxi_nfc_hw_ecc_write_page_dma(struct nand_chip *nand,
sunxi_nfc_hw_ecc_set_prot_oob_bytes(nand, oob, reg_index, !i,
page, user_data_sz);
- sunxi_nfc_set_user_data_len(nfc, user_data_sz, i - first_step);
reg_index += user_data_sz / 4;
}
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 25/26] dt-bindings: mtd: sunxi: Add randomized OOB flag
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (23 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 24/26] mtd: rawnand: sunxi: reduce user-data length register accesses James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
2026-11-05 18:55 ` [PATCH v10 26/26] mtd: rawnand: sunxi: support the Allwinner randomized OOB format James Hilliard
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree, Conor Dooley
Allwinner NAND firmware writes the bad-block marker as part of the
controller's randomizer stream. The mainline driver compensates those
two bytes so that the physical marker instead remains plain, even when
the rest of the page is scrambled. On H6/H616, the firmware also places
a fixed amount of ECC-protected user data before the first parity
region, whereas mainline distributes available OOB space among the ECC
steps.
Add an opt-in property selecting that firmware page format for the
configured controller hardware-ECC geometry. It identifies how existing
flash contents must be interpreted, rather than changing the format of
all NAND attached to a controller compatible. Without it, retain the
mainline marker representation and protected-OOB placement.
The property applies to normal ECC transfers. Raw operations still
bypass ECC and randomization and expose physical main and OOB bytes,
including the physical randomized marker.
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
.../devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml b/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
index ccf616fabc91..4ed99054a8ab 100644
--- a/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
+++ b/Documentation/devicetree/bindings/mtd/allwinner,sun4i-a10-nand.yaml
@@ -79,6 +79,16 @@ patternProperties:
minimum: 0
maximum: 1
+ allwinner,randomized-oob:
+ type: boolean
+ description:
+ Select the normal-page format used by Allwinner NAND firmware for
+ the configured controller hardware-ECC geometry. Normal page
+ transfers use the controller randomizer, the bad block marker remains
+ in its data stream instead of being compensated to stay plain on
+ flash, and protected user data uses the controller-specific placement
+ expected by the firmware.
+
unevaluatedProperties: false
required:
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread* [PATCH v10 26/26] mtd: rawnand: sunxi: support the Allwinner randomized OOB format
2026-11-05 18:55 [PATCH v10 00/26] mtd: rawnand: sunxi: fix transfers and support randomized OOB James Hilliard
` (24 preceding siblings ...)
2026-11-05 18:55 ` [PATCH v10 25/26] dt-bindings: mtd: sunxi: Add randomized OOB flag James Hilliard
@ 2026-11-05 18:55 ` James Hilliard
25 siblings, 0 replies; 28+ messages in thread
From: James Hilliard @ 2026-11-05 18:55 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Sebastian Andrzej Siewior, Clark Williams, Steven Rostedt,
Rob Herring, Krzysztof Kozlowski, Conor Dooley, Philipp Zabel,
James Hilliard
Cc: Chen-Yu Tsai, Jernej Skrabec, Samuel Holland, Maxime Ripard,
Richard Genoud, Boris Brezillon, Masahiro Yamada, Brian Norris,
linux-mtd, linux-arm-kernel, linux-sunxi, linux-kernel,
linux-rt-devel, devicetree
Normal hardware-ECC reads also decode protected OOB, including the
bad-block marker and metadata used in bad-block-table scans. Allwinner
firmware leaves the marker in the randomizer stream, but the existing
driver compensates it to keep a plain physical marker. On H6/H616,
firmware also packs protected user data before the first parity region
rather than maximizing its allocation across the page. Those mismatches
prevent normal ECC reads from interpreting firmware-formatted pages and
their markers.
Honor allwinner,randomized-oob through a separate operations table
selected by an opt-in attach helper. Enable scrambling for normal
controller-ECC transfers and omit marker compensation. Reject software
or disabled ECC, and reject a step larger than the page before the core
can fall back to software ECC. Without the property, keep the existing
operations and geometry, including the plain marker on otherwise
scrambled NAND.
For H6/H616, reserve four user-data bytes per ECC step, capped at 16
bytes per page, and put the entire reservation in step zero. Later steps
have only parity. For a two-step page, eight user-data bytes precede both
steps' parity, instead of four bytes before each step's parity. This is
the stored format, not the controller's user-data capacity: increasing
the reservation would move parity and prevent decoding existing pages.
Apply the same reservation when maximizing ECC strength so strength
selection and actual layout agree. Older controllers retain their fixed
four-byte user-data field per step.
An erased page physically contains 0xff, which the randomizer turns into
non-0xff decoded bytes. Select the Allwinner firmware's
controller-specific erased-page predicate instead of the generic
bit-count check. Apply it to ECC-decoded protected bytes re-encoded with
the OOB randomizer stream. This is not a raw reread: bytes corrected by
ECC retain their corrected values. Older controllers require eight exact
0xff bytes, with a four-byte shortcut at block page zero and pages 127
modulo 128 for 1 KiB steps. The H6-generation predicate requires byte zero
and at least nine of ten bytes to be 0xff. This tolerates one non-0xff
byte among bytes one through nine, but never the marker byte. These are
byte-based format rules, not a count of erased-page bitflips against the
ECC strength. Replacing them with the generic test would change which
pages are accepted as erased.
ECC exception mode can suppress errors for uniform physical data.
Include pattern-found steps in classification even without an ECC-error
bit, and ignore their correction counters. Keep decoded bytes until the
page-wide decision: an all-zero physical page takes precedence over the
spare check and returns zeroed data/OOB with ECC failures; an accepted
erased page returns all 0xff. Other failures retain decoded main and
protected OOB so bad-block and table scans can still inspect the marker
or signature.
Read complete pages for subpage requests because these checks classify a
whole page. Collect status during each PIO step or DMA batch, and defer
statistics until requested OOB reads succeed. Read unprotected OOB only
when requested, combining adjacent parity/tail ranges without crossing
protected user data. Preserve each step's randomizer phase and the
existing PIO/DMA representation of parity. Decode the unprotected tail
with the page seed restarted at each NORMAL write-command boundary,
using the same chunk-size helper as the writer. Raw reads may combine
parity and tail bytes, so their command boundaries do not determine the
tail's stored randomizer phase. Raw callbacks remain unchanged.
All format policy is in the new callbacks and attach helper. Apart from
the opt-in dispatch, existing functions are unchanged: geometry
allocation, marker compensation, status collection and PIO/DMA transfer
sequencing continue to serve the existing operations tables as before.
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/sunxi_nand.c | 338 ++++++++++++++++++++++++++++++++++++++
1 file changed, 338 insertions(+)
diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
index 814331e16bce..a91edea879d2 100644
--- a/drivers/mtd/nand/raw/sunxi_nand.c
+++ b/drivers/mtd/nand/raw/sunxi_nand.c
@@ -363,6 +363,8 @@ struct sunxi_nfc_mdma_desc {
* @nuser_data_tab: Size of @user_data_len_tab
* @sram_size: Size of the NAND controller SRAM
* @timings: Controller timing characteristics
+ * @spare_is_erased: Allwinner randomized-OOB erased-page check on
+ * re-encoded protected OOB bytes
*/
struct sunxi_nfc_caps {
bool has_mdma;
@@ -392,6 +394,7 @@ struct sunxi_nfc_caps {
unsigned int max_ecc_steps;
int sram_size;
const struct sunxi_nfc_timings *timings;
+ bool (*spare_is_erased)(struct nand_chip *nand, const u8 *spare, int page);
};
/**
@@ -1228,8 +1231,16 @@ static int sunxi_nfc_hw_ecc_read_error(struct nand_chip *nand,
return ret >= 0;
}
+struct sunxi_nfc_allwinner_oob_status {
+ u32 error_steps;
+ u32 zero_steps;
+ unsigned int corrected;
+ unsigned int max_bitflips;
+};
+
/* Shared across a read's transfers; buf remains the full-page buffer base. */
struct sunxi_nfc_ecc_read {
+ struct sunxi_nfc_allwinner_oob_status allwinner_oob;
u8 *buf;
int page;
unsigned int max_bitflips;
@@ -2449,6 +2460,305 @@ static const struct sunxi_nfc_oob_ops sunxi_nfc_scrambled_plain_bbm_oob_ops = {
.finish_read = sunxi_nfc_oob_finish_read,
};
+/* Allwinner randomized-OOB format, selected only by allwinner,randomized-oob. */
+/* Firmware metadata limit, not the controller's user-data register capacity. */
+#define SUNXI_NFC_H6_ALLWINNER_OOB_MAX_USER_DATA_SZ 16
+
+static void sunxi_nfc_randomize_buf(u16 state, u8 *buf, unsigned int len)
+{
+ while (len--) {
+ *buf++ ^= state;
+ state = sunxi_nfc_randomizer_step(state, 8);
+ }
+}
+
+static void
+sunxi_nfc_allwinner_oob_record_status(struct nand_chip *nand,
+ struct sunxi_nfc_allwinner_oob_status *result,
+ int logical_step, int hw_step,
+ struct sunxi_nfc_ecc_snapshot *snapshot)
+{
+ u32 count;
+
+ if ((snapshot->pattern_found & BIT(hw_step)) &&
+ !(snapshot->pattern_id & BIT(hw_step)))
+ result->zero_steps |= BIT(logical_step);
+
+ /*
+ * Exception mode can suppress the ECC error for a physical pattern.
+ * Classify these steps with the Allwinner randomized-OOB page check too,
+ * and do not use their correction counters. Keep their decoded data until
+ * then.
+ */
+ if ((snapshot->status & NFC_ECC_ERR(hw_step)) ||
+ (snapshot->pattern_found & BIT(hw_step))) {
+ result->error_steps |= BIT(logical_step);
+ return;
+ }
+
+ count = sunxi_nfc_hw_ecc_read_count(nand, snapshot, hw_step);
+ result->corrected += count;
+ result->max_bitflips = max(result->max_bitflips, count);
+}
+
+static bool sun4i_a10_nfc_spare_is_erased(struct nand_chip *nand,
+ const u8 *spare, int page)
+{
+ struct mtd_info *mtd = nand_to_mtd(nand);
+ unsigned int block_page = page % mtd_div_by_ws(mtd->erasesize, mtd);
+
+ /*
+ * Older Allwinner firmware recognizes exact four-byte erased
+ * signatures on page zero and pages 127 modulo 128. With their
+ * 1 KiB ECC steps these correspond to four physical 0xff bytes.
+ * Other pages require all eight spare bytes to be 0xff.
+ */
+ if (nand->ecc.size == 1024 &&
+ (!block_page || block_page % 128 == 127) &&
+ !memchr_inv(spare, 0xff, USER_DATA_SZ))
+ return true;
+
+ return !memchr_inv(spare, 0xff, 8);
+}
+
+static bool sun50i_h6_nfc_spare_is_erased(struct nand_chip *nand,
+ const u8 *spare, int page)
+{
+ unsigned int erased = 0;
+ int i;
+
+ /* Keep the marker byte erased; tolerate one other non-0xff byte. */
+ for (i = 0; i < 10; i++)
+ erased += spare[i] == 0xff;
+
+ return spare[0] == 0xff && erased >= 9;
+}
+
+static bool sunxi_nfc_allwinner_oob_spare_is_erased(struct nand_chip *nand,
+ int page)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ u16 state = sunxi_nfc_randomizer_state(nand, page, true);
+ u8 spare[10];
+ unsigned int len, pos = 0;
+ int i, off;
+
+ /*
+ * Re-encode ECC-decoded protected OOB for the firmware's spare check.
+ * This is not a raw reread: ECC-corrected bytes stay corrected. Each
+ * step restarts the OOB randomizer; H6/H616 pack the entire prefix in
+ * step zero. Pad unavailable bytes with 0xff.
+ */
+ memset(spare, 0xff, sizeof(spare));
+ for (i = 0; i < ecc->steps && pos < sizeof(spare); i++) {
+ len = min_t(unsigned int, sunxi_nfc_user_data_sz(sunxi_nand, i),
+ sizeof(spare) - pos);
+ off = sunxi_get_oob_offset(sunxi_nand, ecc, i);
+ memcpy(spare + pos, nand->oob_poi + off, len);
+ sunxi_nfc_randomize_buf(state, spare + pos, len);
+ pos += len;
+ }
+
+ return nfc->caps->spare_is_erased(nand, spare, page);
+}
+
+static int sunxi_nfc_allwinner_oob_read_unprotected(struct nand_chip *nand,
+ bool dma, int page)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct mtd_info *mtd = nand_to_mtd(nand);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ unsigned int len, off;
+ u16 state;
+ int ret, i;
+
+ for (i = 0; i < ecc->steps; i++) {
+ off = sunxi_get_ecc_offset(sunxi_nand, ecc, i);
+ len = ecc->bytes;
+ /* Keep decoded user data, but combine adjacent parity regions. */
+ while (i + 1 < ecc->steps &&
+ !sunxi_nfc_user_data_sz(sunxi_nand, i + 1)) {
+ len += ecc->bytes;
+ i++;
+ }
+ if (i + 1 == ecc->steps)
+ len = mtd->oobsize - off;
+
+ ret = sunxi_nfc_read_column(nand, page, mtd->writesize + off,
+ nand->oob_poi + off, len);
+ if (ret)
+ return ret;
+ }
+
+ /* Preserve each path's normal representation of ECC bytes. */
+ if (!dma) {
+ for (i = 0; i < ecc->steps; i++) {
+ len = sunxi_nfc_user_data_sz(sunxi_nand, i);
+ off = sunxi_get_ecc_offset(sunxi_nand, ecc, i);
+ state = sunxi_nfc_randomizer_state(nand, page, true);
+ state = sunxi_nfc_randomizer_step(state, len * 8 + 15);
+ sunxi_nfc_randomize_buf(state, nand->oob_poi + off,
+ ecc->bytes);
+ }
+ }
+
+ off = sunxi_get_oob_offset(sunxi_nand, ecc, ecc->steps);
+ len = mtd->oobsize - off;
+ if (len) {
+ /* Each NORMAL write command restarts the tail's randomizer. */
+ state = sunxi_nfc_randomizer_state(nand, page, false);
+ state = sunxi_nfc_randomizer_step(state, 15);
+ while (len) {
+ unsigned int cnt = sunxi_nfc_buf_chunk_size(nfc, len);
+
+ sunxi_nfc_randomize_buf(state, nand->oob_poi + off, cnt);
+ off += cnt;
+ len -= cnt;
+ }
+ }
+
+ return 0;
+}
+
+static int sunxi_nfc_allwinner_oob_read_batch(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read,
+ struct sunxi_nfc_ecc_snapshot *snapshot,
+ int first_step, int nsteps)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ unsigned int reg_index = 0, user_data_sz;
+ int i;
+
+ /* Page classification also needs pattern IDs for steps with ECC errors. */
+ if (snapshot->pattern_found)
+ sunxi_nfc_hw_ecc_read_pattern_id(nand, snapshot);
+
+ for (i = 0; i < nsteps; i++, reg_index += user_data_sz / 4) {
+ int step = first_step + i;
+ int oob_off = sunxi_get_oob_offset(sunxi_nand, ecc, step);
+ u8 *oob = nand->oob_poi + oob_off;
+
+ user_data_sz = sunxi_nfc_user_data_sz(sunxi_nand, step);
+ sunxi_nfc_allwinner_oob_record_status(nand, &read->allwinner_oob,
+ step, i, snapshot);
+ if (!read->dma)
+ memcpy_fromio(read->buf + step * ecc->size,
+ nfc->regs + NFC_RAM0_BASE, ecc->size);
+ /* Page classification needs protected OOB even for data-only reads. */
+ sunxi_nfc_hw_ecc_get_prot_oob_bytes(nand, oob, reg_index, !step,
+ read->page, user_data_sz);
+ }
+
+ return 0;
+}
+
+static int sunxi_nfc_allwinner_oob_finish_read(struct nand_chip *nand,
+ struct sunxi_nfc_ecc_read *read,
+ int *cur_off)
+{
+ struct sunxi_nfc_allwinner_oob_status *result = &read->allwinner_oob;
+ u8 *buf = read->buf;
+ bool oob_required = read->oob_required;
+ bool dma = read->dma;
+ int page = read->page;
+ struct mtd_info *mtd = nand_to_mtd(nand);
+ struct nand_ecc_ctrl *ecc = &nand->ecc;
+ int ret;
+
+ /*
+ * Allwinner firmware treats an all-zero physical page as bad, even without
+ * ECC errors. This takes precedence over the spare-byte heuristic.
+ */
+ if (result->zero_steps == GENMASK(ecc->steps - 1, 0)) {
+ memset(buf, 0, mtd->writesize);
+ memset(nand->oob_poi, 0, mtd->oobsize);
+ mtd->ecc_stats.failed += ecc->steps;
+ return 0;
+ }
+
+ if (result->error_steps && sunxi_nfc_allwinner_oob_spare_is_erased(nand, page)) {
+ memset(buf, 0xff, mtd->writesize);
+ memset(nand->oob_poi, 0xff, mtd->oobsize);
+ return 0;
+ }
+
+ /*
+ * Keep the original decoded main and protected OOB bytes on ECC failure.
+ * BBT pattern scans inspect them even when an ECC error is reported.
+ * Read the remaining OOB only when requested, not to classify the page.
+ */
+ if (oob_required) {
+ ret = sunxi_nfc_allwinner_oob_read_unprotected(nand, dma, page);
+ if (ret)
+ return ret;
+ }
+
+ mtd->ecc_stats.corrected += result->corrected;
+ mtd->ecc_stats.failed += hweight32(result->error_steps);
+
+ return result->max_bitflips;
+}
+
+static int sunxi_nfc_allwinner_oob_read_subpage(struct nand_chip *nand,
+ u32 data_offs, u32 readlen,
+ u8 *buf, int page)
+{
+ return nand->ecc.read_page(nand, buf, false, page);
+}
+
+static unsigned int sunxi_nfc_h6_allwinner_oob_user_data_sz(int nsectors)
+{
+ return min(nsectors * USER_DATA_SZ,
+ SUNXI_NFC_H6_ALLWINNER_OOB_MAX_USER_DATA_SZ);
+}
+
+static unsigned int sunxi_nfc_allwinner_oob_min_user_data(struct nand_chip *nand,
+ int nsteps)
+{
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+
+ if (!nfc->caps->reg_user_data_len)
+ return sunxi_nfc_oob_min_user_data(nand, nsteps);
+
+ return sunxi_nfc_h6_allwinner_oob_user_data_sz(nsteps);
+}
+
+static int sunxi_nfc_allwinner_oob_init_user_data(struct nand_chip *nand, int nsteps)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+
+ /* Do not let the core fall back to software ECC for this format. */
+ if (nsteps <= 0)
+ return -EINVAL;
+
+ if (!nfc->caps->reg_user_data_len)
+ return 0;
+
+ sunxi_nand->user_data_bytes = devm_kzalloc(nfc->dev, nsteps, GFP_KERNEL);
+ if (!sunxi_nand->user_data_bytes)
+ return -ENOMEM;
+
+ /*
+ * H6/H616 pack all protected user data before step-zero parity.
+ * This prefix fixes the parity offsets on firmware-written pages.
+ */
+ sunxi_nand->user_data_bytes[0] = sunxi_nfc_h6_allwinner_oob_user_data_sz(nsteps);
+ return 0;
+}
+
+static const struct sunxi_nfc_oob_ops sunxi_nfc_allwinner_oob_ops = {
+ .min_user_data = sunxi_nfc_allwinner_oob_min_user_data,
+ .init_user_data = sunxi_nfc_allwinner_oob_init_user_data,
+ .read_batch = sunxi_nfc_allwinner_oob_read_batch,
+ .finish_read = sunxi_nfc_allwinner_oob_finish_read,
+};
+
static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
struct nand_ecc_ctrl *ecc,
struct device_node *np)
@@ -2585,6 +2895,28 @@ static int sunxi_nand_hw_ecc_ctrl_init(struct nand_chip *nand,
return 0;
}
+static int sunxi_nfc_allwinner_oob_attach_chip(struct nand_chip *nand,
+ struct device_node *np)
+{
+ struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
+ struct sunxi_nfc *nfc = to_sunxi_nfc(nand->controller);
+ int ret;
+
+ if (nand->ecc.engine_type != NAND_ECC_ENGINE_TYPE_ON_HOST)
+ return dev_err_probe(nfc->dev, -EINVAL,
+ "Allwinner OOB format requires controller ECC\n");
+
+ sunxi_nand->oob_ops = &sunxi_nfc_allwinner_oob_ops;
+ nand->options |= NAND_NEED_SCRAMBLING | NAND_NO_SUBPAGE_WRITE;
+ ret = sunxi_nand_hw_ecc_ctrl_init(nand, &nand->ecc, np);
+ if (ret)
+ return ret;
+
+ /* This format's spare and all-zero checks classify the whole page. */
+ nand->ecc.read_subpage = sunxi_nfc_allwinner_oob_read_subpage;
+ return 0;
+}
+
static int sunxi_nand_attach_chip(struct nand_chip *nand)
{
struct sunxi_nand_chip *sunxi_nand = to_sunxi_nand(nand);
@@ -2610,6 +2942,9 @@ static int sunxi_nand_attach_chip(struct nand_chip *nand)
if (!ecc->size || !ecc->strength)
return -EINVAL;
+ if (of_property_read_bool(np, "allwinner,randomized-oob"))
+ return sunxi_nfc_allwinner_oob_attach_chip(nand, np);
+
sunxi_nand->oob_ops = nand->options & NAND_NEED_SCRAMBLING ?
&sunxi_nfc_scrambled_plain_bbm_oob_ops : &sunxi_nfc_plain_oob_ops;
@@ -3126,6 +3461,7 @@ static const struct sunxi_nfc_caps sunxi_nfc_a10_caps = {
.max_ecc_steps = 16,
.sram_size = 1024,
.timings = &sun4i_a10_nfc_timings,
+ .spare_is_erased = sun4i_a10_nfc_spare_is_erased,
};
static const struct sunxi_nfc_caps sunxi_nfc_a23_caps = {
@@ -3149,6 +3485,7 @@ static const struct sunxi_nfc_caps sunxi_nfc_a23_caps = {
.max_ecc_steps = 16,
.sram_size = 1024,
.timings = &sun4i_a10_nfc_timings,
+ .spare_is_erased = sun4i_a10_nfc_spare_is_erased,
};
static const struct sunxi_nfc_caps sunxi_nfc_h616_caps = {
@@ -3176,6 +3513,7 @@ static const struct sunxi_nfc_caps sunxi_nfc_h616_caps = {
.max_ecc_steps = 32,
.sram_size = 8192,
.timings = &sun50i_h616_nfc_timings,
+ .spare_is_erased = sun50i_h6_nfc_spare_is_erased,
};
static const struct of_device_id sunxi_nfc_ids[] = {
--
2.53.0
^ permalink raw reply related [flat|nested] 28+ messages in thread