* [PATCH 1/2] mtd: rawnand: macronix: serialize OTP access with NAND operations
2026-11-08 21:23 [PATCH 0/2] mtd: rawnand: serialize OTP and BBT recovery operations James Hilliard
@ 2026-11-08 21:23 ` James Hilliard
2026-11-08 21:23 ` [PATCH 2/2] mtd: rawnand: serialize bad-block marker writes during BBT recovery James Hilliard
1 sibling, 0 replies; 3+ messages in thread
From: James Hilliard @ 2026-11-08 21:23 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Arseniy Krasnov, Boris Brezillon, Kyle Roeschley
Cc: linux-mtd, linux-kernel, James Hilliard, stable
The Macronix OTP callbacks select a target and issue feature and page
commands without taking the chip or controller locks. Normal NAND I/O
can interleave with these commands, use a different target or access
pages while OTP mode is enabled. OTP I/O can also run while the chip
is suspended.
Make the existing NAND serialization helpers available within the raw
NAND core and hold them across the entire OTP transaction, including
restoring normal mode and deselecting the target. This uses the same
lock ordering and suspend handling as normal NAND I/O.
Fixes: e87161321a40 ("mtd: rawnand: macronix: OTP access for MX30LFxG18AC")
Cc: stable@vger.kernel.org
Cc: Arseniy Krasnov <AVKrasnov@sberdevices.ru>
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/internals.h | 2 ++
drivers/mtd/nand/raw/nand_base.c | 4 ++--
drivers/mtd/nand/raw/nand_macronix.c | 2 ++
3 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/internals.h b/drivers/mtd/nand/raw/internals.h
index b8b29341b88c..2668f527e637 100644
--- a/drivers/mtd/nand/raw/internals.h
+++ b/drivers/mtd/nand/raw/internals.h
@@ -81,6 +81,8 @@ extern const struct nand_manufacturer_ops toshiba_nand_manuf_ops;
extern const struct mtd_pairing_scheme dist3_pairing_scheme;
/* Core functions */
+void nand_get_device(struct nand_chip *chip);
+void nand_release_device(struct nand_chip *chip);
const struct nand_manufacturer_desc *nand_get_manufacturer_desc(u8 id);
int nand_bbm_get_next_page(struct nand_chip *chip, int page);
int nand_markbad_bbm(struct nand_chip *chip, loff_t ofs);
diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index a5b278ab9384..f125c529c62d 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -207,7 +207,7 @@ EXPORT_SYMBOL_GPL(nand_deselect_target);
*
* Release chip lock and wake up anyone waiting on the device.
*/
-static void nand_release_device(struct nand_chip *chip)
+void nand_release_device(struct nand_chip *chip)
{
/* Release the controller and the chip */
mutex_unlock(&chip->controller->lock);
@@ -336,7 +336,7 @@ static int nand_isbad_bbm(struct nand_chip *chip, loff_t ofs)
*
* Lock the device and its controller for exclusive access
*/
-static void nand_get_device(struct nand_chip *chip)
+void nand_get_device(struct nand_chip *chip)
{
/* Wait until the device is resumed. */
while (1) {
diff --git a/drivers/mtd/nand/raw/nand_macronix.c b/drivers/mtd/nand/raw/nand_macronix.c
index 03237310852c..4fe7036ae992 100644
--- a/drivers/mtd/nand/raw/nand_macronix.c
+++ b/drivers/mtd/nand/raw/nand_macronix.c
@@ -380,6 +380,7 @@ static int __macronix_30lfxg18ac_rw_otp(struct mtd_info *mtd,
int ret;
nand = mtd_to_nand(mtd);
+ nand_get_device(nand);
nand_select_target(nand, 0);
ret = macronix_30lfxg18ac_otp_enable(nand);
@@ -426,6 +427,7 @@ static int __macronix_30lfxg18ac_rw_otp(struct mtd_info *mtd,
write ? "write" : "read");
nand_deselect_target(nand);
+ nand_release_device(nand);
return ret;
}
--
2.53.0
^ permalink raw reply [flat|nested] 3+ messages in thread* [PATCH 2/2] mtd: rawnand: serialize bad-block marker writes during BBT recovery
2026-11-08 21:23 [PATCH 0/2] mtd: rawnand: serialize OTP and BBT recovery operations James Hilliard
2026-11-08 21:23 ` [PATCH 1/2] mtd: rawnand: macronix: serialize OTP access with NAND operations James Hilliard
@ 2026-11-08 21:23 ` James Hilliard
1 sibling, 0 replies; 3+ messages in thread
From: James Hilliard @ 2026-11-08 21:23 UTC (permalink / raw)
To: Miquel Raynal, Richard Weinberger, Vignesh Raghavendra,
Arseniy Krasnov, Boris Brezillon, Kyle Roeschley
Cc: linux-mtd, linux-kernel, James Hilliard, stable
When erasing or writing a flash-based BBT fails, write_bbt() marks the
failed block bad before trying another reserved block. The erase and
write helpers release the NAND locks before returning, but
mark_bbt_block_bad() calls nand_markbad_bbm() without acquiring them.
A BBT update triggered by a bad-block marking request can therefore
issue the recovery marker commands concurrently with other NAND I/O or
while the chip is suspended. The chip selection and shared page/OOB
buffers are not protected on this path.
Take the chip and controller locks around the recovery marker write,
as nand_block_markbad_lowlevel() already does for normal marker writes.
Fixes: 10ffd570f117 ("mtd: nand_bbt: scan for next free bbt block if writing bbt fails")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
drivers/mtd/nand/raw/nand_bbt.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/mtd/nand/raw/nand_bbt.c b/drivers/mtd/nand/raw/nand_bbt.c
index b0e7592a2ab7..51fe991358d6 100644
--- a/drivers/mtd/nand/raw/nand_bbt.c
+++ b/drivers/mtd/nand/raw/nand_bbt.c
@@ -720,10 +720,12 @@ static void mark_bbt_block_bad(struct nand_chip *this,
loff_t to;
int res;
+ nand_get_device(this);
bbt_mark_entry(this, block, BBT_BLOCK_WORN);
to = (loff_t)block << this->bbt_erase_shift;
res = nand_markbad_bbm(this, to);
+ nand_release_device(this);
if (res)
pr_warn("nand_bbt: error %d while marking block %d bad\n",
res, block);
--
2.53.0
^ permalink raw reply [flat|nested] 3+ messages in thread