kernel/git/stable/linux.git/drivers/mtd/nand, branch master

Merge tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-08-23T16:11:21+00:00

Pull mtd updates from Miquel Raynal: "Raw NAND changes: - Sunxi: Support added for the H616 compatible - Qcom: Support added for the MDM9607 compatible - Support for the Toshiba TC58NVG1S3H part - GPMI: New debugfs entry to expose the chip geometry - PL353: Timing updates and software ECC support have been fixed SPI NAND changes: - fmsh: Support added for FM25G{01,02}B chips - HeYangTek: Support added for HYF1GQ4UDACAE Aside from these main changes, there is a high load of misc fixes and hardening changes, and exceptionally no SPI NOR change" * tag 'mtd/for-7.3' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: (30 commits) mtd: rawnand: sunxi: fix H6/H616 controller timings mtd: rawnand: sunxi: describe tADL and tWHR delays mtd: rawnand: sunxi: group controller delay tables mtd: maps: remove dead select of MTD_CFI_BE_BYTE_SWAP mtd: rawnand: gpmi: add debugfs entry for BCH geometry mtd: rawnand: validate ONFI extended parameter page sections mtd: rawnand: sunxi: add H616 MBUS DMA support mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles mtd: part: reject MTDPART_OFS_RETAIN in mtd_add_partition() mtd: mpc5121_nfc: use platform for irq and ioremap mtd: mtdoops: free page bitmap when the backing MTD is removed mtd: mtdswap: Avoid freeing registered blktrans device twice mtd: afs: validate v2 image info bounds mtd: intel-dg: Fix runtime PM error path in probe mtd: nand-omap2: Move omap_nand_ids[] to raw nand driver mtd: rawnand: add Toshiba TC58NVG1S3H mtd: nand: realtek-ecc: add missing MODULE_DEVICE_TABLE() mtd: rawnand: qcom: Add MDM9607 compatible mtd: rawnand: qcom: Make has_onfi_read_op separate from qpic_version2 mtd: rawnand: qcom: Make "aon" clock optional ...

Merge tag 'nand/for-7.3' into mtd/next

2026-08-23T12:30:31+00:00

* Raw NAND changes - Sunxi: Support added for the H616 compatible - Qcom: Support added for the MDM9607 compatible - Support for the Toshiba TC58NVG1S3H part - GPMI: New debugfs entry to expose the chip geometry - PL353: Timing updates and software ECC support have been fixed * SPI NAND changes - fmsh: Support added for FM25G{01,02}B chips - HeYangTek: Support added for HYF1GQ4UDACAE Aside from these main changes, there is the usual load of misc fixes and hardening changes.

mtd: rawnand: sunxi: fix H6/H616 controller timings

2026-08-10T14:24:26+00:00

The NAND timing calculation assumes that command and address setup and hold intervals T1-T4, T7 and T11 each take one controller clock. It also uses the original A10 delay encodings for tWB, tADL, tWHR and tRHW. The H6/H616 NDFC defines the setup and hold intervals as two internal clock cycles and uses different delay encodings. Add the H616 timing characteristics and select them through the controller capability data so the clock solver and timing fields match the hardware. Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal

mtd: rawnand: sunxi: describe tADL and tWHR delays

2026-08-10T14:24:26+00:00

The tADL and tWHR timing fields use four encoded delays, but the driver currently derives their values with a shift. This hides the actual controller timing characteristics and lets the clock solver select a 32-cycle delay that the fields cannot encode. Describe the legacy 7, 15, 23 and 31 cycle thresholds explicitly and use the tables for both clock selection and field lookup. This prepares the driver for controllers with different encodings. Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal

mtd: rawnand: sunxi: group controller delay tables

2026-08-10T14:24:26+00:00

The tWB and tRHW timing field encodings are controller properties, but they currently live in standalone lookup tables. Group them in a timing descriptor selected through the controller capability data. Point every existing controller at the legacy values so this is a pure preparation change. Fixes: 88fd4e4deae8 ("mtd: rawnand: sunxi: Add support for H616 nand controller") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal

mtd: rawnand: gpmi: add debugfs entry for BCH geometry

2026-08-07T13:59:37+00:00

Export the BCH geometry parameters via debugfs to aid debugging and provide the necessary information for legacy kobs-ng tool. The debugfs directory "gpmi-nand" is created under the root debugfs tree, exposing: bch_geometry - blob containing the struct bch_geometry fields raw_mode - flag indicating raw mode status The implementation is guarded with #ifdef CONFIG_DEBUG_FS to avoid build failures when debugfs is disabled. Signed-off-by: Han Xu Reviewed-by: Frank Li Signed-off-by: Miquel Raynal

mtd: rawnand: validate ONFI extended parameter page sections

2026-08-07T13:59:22+00:00

nand_flash_detect_ext_param_page() allocates the length declared by the ONFI parameter page, then treats the data as a fixed header followed by variable-length sections. It reads that header and advances over sections without first proving that the fixed page and each current section fit in the allocation. Reject pages shorter than the fixed header, track the remaining variable area while walking sections, and require the ECC section to contain every field read from struct onfi_ext_ecc_info. Use device-scoped diagnostics that identify the malformed ONFI section. Fixes: 6dcbe0cdd83f ("mtd: get the ECC info from the Extended Parameter Page") Cc: stable@vger.kernel.org Signed-off-by: Pengpeng Hou Signed-off-by: Miquel Raynal

mtd: rawnand: sunxi: add H616 MBUS DMA support

2026-08-07T13:54:29+00:00

The H616 NAND controller uses a descriptor-based internal MBUS DMA engine instead of the direct address and count registers used by the A23/A33 controller. Since the driver does not support these descriptors, it currently attempts to request an external rxtx DMA channel and falls back to PIO when none is provided. Add a single-descriptor backend to the existing ECC page DMA paths. Allocate the descriptor coherently, constrain data mappings to the controller's 32-bit address range, program the H6-style data block mask, and request an interrupt for both command and DMA completion. Keep the existing external DMA and legacy MBUS DMA paths unchanged, and fall back to PIO if the descriptor cannot be allocated. With identical kernels except for this patch, running flash_speed -d -b 1906 -c 100 /dev/mtd6 on an H616 board with 2 KiB-page SLC NAND reported: PIO descriptor DMA eraseblock write 3365 KiB/s 4192 KiB/s eraseblock read 6454 KiB/s 16040 KiB/s page write 3254 KiB/s 4021 KiB/s page read 6419 KiB/s 15686 KiB/s Signed-off-by: James Hilliard Signed-off-by: Miquel Raynal

mtd: spinand: fmsh: fix FM25G01B/FM25G02B Quad I/O read dummy cycles

2026-08-07T13:54:21+00:00

The FM25G01B/FM25G02B datasheets specify a single dummy byte for the 0xEB Quad I/O read-from-cache operation, but the generic read_cache_variants set uses two dummy bytes for the 1S-4S-4S variant. The extra dummy byte shifts the data phase and returns corrupted data with no ECC error, breaking boot on boards using these chips. Use a dedicated read-from-cache variant set with ndummy=1 for the 1S-4S-4S (0xEB) operation. FM25G01B datasheet: https://www.fmsh.com/nvm/FM25G01B_ds_eng.pdf FM25G02B datasheet: https://www.fmsh.com/nvm/FM25G02B_ds_eng.pdf Fixes: d5a5c9eb2ee9 ("mtd: spinand: fmsh: add support for FM25G{01,02}B") Cc: stable@vger.kernel.org Signed-off-by: Aleksandr Mineev Signed-off-by: Miquel Raynal

Merge tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux

2026-07-17T16:30:17+00:00

Pull mtd fixes from Miquel Raynal: "Among the most important fixes that we have here, there are: - the revert of the uclinux map driver which was presumed to be no longer used but in fact was - the use of SPI match data to get chip capabilities in the mchp23k256 driver - several fixes addressing the newly introduced virt-concat support - a missing build dependency on ndfc as well as the usual load (if not actually bigger than usual) of uninitialized variables, leaks, double free, and AI fuzzed issues being fixed" * tag 'mtd/fixes-for-7.2-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux: Revert "mtd: maps: remove uclinux map driver" mtd: onenand: samsung: report DMA completion timeouts mtd: rawnand: fsl_ifc: return errors for failed page reads mtd: mchp23k256: use SPI match data for chip caps mtd: rawnand: lpc32xx_slc: fail DMA transfer on completion timeout mtd: rawnand: lpc32xx_mlc: fail DMA transfers on timeout mtd: fix double free and WARN_ON in add_mtd_device() error paths mtd: virt-concat: free duplicate generated name mtd: nand: mtk-ecc: stop on ECC idle timeouts mtd: mtdswap: remove debugfs stats file on teardown mtd: mtdpart: validate partition bounds in mtd_add_partition() mtd: mtdpart: fix uninitialized erasesize on MTDPART_OFS_RETAIN error path mtd: rawnand: ndfc: add CONFIG_OF dependency mtd: spinand: initialize ret in regular page reads mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy() mtd: rawnand: ingenic: handle ECC clock enable failures mtd: nand: ecc-mtk: handle ECC clock enable failures mtd: virt_concat: fix use-after-free in mtd_virt_concat_destroy_joins() mtd: rawnand: ndfc: fix gcc uninitialized var