| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID:
<DU0PR04MB94962212554B76855AA02B31909EA@DU0PR04MB9496.eurprd04.prod.outlook.com>
Date: Thu, 29 Jan 2026 01:53:16 +0000
From: Bough Chen <haibo.chen@....com>
To: Tudor Ambarus <tudor.ambarus@...aro.org>, Pratyush Yadav
<pratyush@...nel.org>, Michael Walle <mwalle@...nel.org>, Miquel Raynal
<miquel.raynal@...tlin.com>, Richard Weinberger <richard@....at>, Vignesh
Raghavendra <vigneshr@...com>
CC: "linux-mtd@...ts.infradead.org" <linux-mtd@...ts.infradead.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"imx@...ts.linux.dev" <imx@...ts.linux.dev>, Han Xu <han.xu@....com>
Subject: RE: [PATCH v3] mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR
sfdp fixup for mt35xu512aba
Gentle ping...
> -----Original Message-----
> From: Bough Chen <haibo.chen@....com>
> Sent: 2025年12月23日 11:01
> To: Tudor Ambarus <tudor.ambarus@...aro.org>; Pratyush Yadav
> <pratyush@...nel.org>; Michael Walle <mwalle@...nel.org>; Miquel Raynal
> <miquel.raynal@...tlin.com>; Richard Weinberger <richard@....at>; Vignesh
> Raghavendra <vigneshr@...com>
> Cc: linux-mtd@...ts.infradead.org; linux-kernel@...r.kernel.org;
> imx@...ts.linux.dev; Han Xu <han.xu@....com>; Bough Chen
> <haibo.chen@....com>
> Subject: [PATCH v3] mtd: spi-nor: micron-st: add SNOR_CMD_PP_8_8_8_DTR
> sfdp fixup for mt35xu512aba
>
> Find two batches mt35xu512aba has different SFDP but with same jedec ID. The
> batch which use the new version of SFDP contain all the necessary information
> to support OCT DTR mode. The batch with old version do not contain the OCT
> DTR command information, but in fact it did support OCT DTR mode.
>
> Current mt35xu512aba_post_sfdp_fixup() add some setting including
> SNOR_CMD_READ_8_8_8_DTR, but still lack SNOR_CMD_PP_8_8_8_DTR.
> Meet issue on the batch mt35xu512aba with old SFDP version. Because no
> SNOR_CMD_PP_8_8_8_DTR, micron_st_nor_octal_dtr_en() will not be called,
> then use SNOR_CMD_READ_8_8_8_DTR will meet issue.
>
> Fixes: 44dd635cd632 ("mtd: spi-nor: micron-st: use SFDP of mt35xu512aba")
> Reviewed-by: Pratyush Yadav <pratyush@...nel.org>
> Signed-off-by: Haibo Chen <haibo.chen@....com>
> ---
> Changes in v3:
> - add comment in the code to explain why this fixup is needed.
> - Link to v2:
> https://lore.kernel.org/r/20251215-nor-v2-1-e75c0451e597@nxp.com
>
> Changes in v2:
> - add 8D pp command in post sfdp fix up for the chip with old SFDP
> - Link to v1:
> https://lore.kernel.org/r/20251212-nor-v1-1-20a5a381979c@nxp.com
> ---
> first part: the batch mt35xu512aba with old version
> 1) This mt35xu512aba with label 0DA15 RW303 (old version) is populated on
> the imx8qm-mek board, was tested at 166MHz using nxp,imx8qxp-fspi SPI
> controller.
> 2) root@...8qmmek:/sys/bus/spi/devices/spi4.0/spi-nor# ls
> jedec_id manufacturer sfdp
> root@...8qmmek:/sys/bus/spi/devices/spi4.0/spi-nor# cat jedec_id
> 2c5b1a
> root@...8qmmek:/sys/bus/spi/devices/spi4.0/spi-nor# cat manufacturer
> micron
> root@...8qmmek:/sys/bus/spi/devices/spi4.0/spi-nor# hexdump -Cv sfdp
> 00000000 53 46 44 50 06 01 01 ff 00 06 01 10 30 00 00 ff
> |SFDP........0...|
> 00000010 84 00 01 02 80 00 00 ff ff ff ff ff ff ff ff ff |................|
> 00000020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
> 00000030 e5 20 8a ff ff ff ff 1f 00 00 00 00 00 00 00 00 |. ..............|
> 00000040 ee ff ff ff ff ff 00 00 ff ff 00 00 0c 20 11 d8 |............. ..|
> 00000050 0f 52 00 00 24 5a 99 00 8b 8e 03 e1 ac 01 27 38
> |.R..$Z........'8|
> 00000060 7a 75 7a 75 fb bd d5 5c 00 00 70 ff 81 b0 38 36
> |zuzu...\..p...86|
> 00000070 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff |................|
> 00000080 43 0e ff ff 21 dc 5c ff |C...!.\.|
> 00000088
> root@...8qmmek:~# sha256sum /sys/bus/spi/devices/spi4.0/spi-nor/sfdp
>
> a2e3b364108c4d8052b26d50f31e7dfac6e4ad96aa3994f19678125ebdf8fb81
> /sys/bus/spi/devices/spi4.0/spi-nor/sfdp
> 3) root@...8qmmek:~# cat /sys/kernel/debug/spi-nor/spi4.0/capabilities
> Supported read modes by the flash
> 1S-1S-1S
> opcode 0x13
> mode cycles 0
> dummy cycles 0
> 8D-8D-8D
> opcode 0xfd
> mode cycles 0
> dummy cycles 20
>
> Supported page program modes by the flash
> 1S-1S-1S
> opcode 0x12
> 8D-8D-8D
> opcode 0x12
>
> root@...8qmmek:~# cat /sys/kernel/debug/spi-nor/spi4.0/params
> name (null)
> id 2c 5b 1a 10 41 00
> size 64.0 MiB
> write size 1
> page size 256
> address nbytes 4
> flags 4B_OPCODES | HAS_4BAIT | HAS_16BIT_SR |
> NO_READ_CR | IO_MODE_EN_VOLATILE | SOFT_RESET
>
> opcodes
> read 0xfd
> dummy cycles 20
> erase 0xdc
> program 0x12
> 8D extension repeat
>
> protocols
> read 8D-8D-8D
> write 8D-8D-8D
> register 8D-8D-8D
>
> erase commands
> 21 (4.00 KiB) [1]
> 5c (32.0 KiB) [2]
> dc (128 KiB) [3]
> c7 (64.0 MiB)
>
> sector map
> region (in hex) | erase mask | overlaid
> ------------------+------------+----------
> 00000000-03ffffff | [ 3] | no
>
> 4)root@...8qmmek:~# dd if=/dev/urandom of=./spi_test bs=1M count=2
> 2+0 records in
> 2+0 records out
> 2097152 bytes (2.1 MB, 2.0 MiB) copied, 0.317497 s, 6.6 MB/s
> root@...8qmmek:~# mtd_debug erase /dev/mtd0 0 2097152
> Erased 2097152 bytes from address 0x00000000 in flash
> root@...8qmmek:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...8qmmek:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
> root@...8qmmek:~# sha256sum spi_read
> 4bda3a28f4ffe603c0ec1258c0034d65a1a0d35ab7bd523a834608adabf03cc5
> spi_read
> root@...8qmmek:~# mtd_debug write /dev/mtd0 0 2097152 spi_test
> Copied 2097152 bytes from spi_test to address 0x00000000 in flash
> root@...8qmmek:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...8qmmek:~# sha256sum spi*
>
> 16b3a0c63252b07501129a0e495e6c8cb8e40598e32bc9a9431838ba95266f3d
> spi_read
>
> 16b3a0c63252b07501129a0e495e6c8cb8e40598e32bc9a9431838ba95266f3d
> spi_test
> root@...8qmmek:~# mtd_debug erase /dev/mtd0 0 2097152
> Erased 2097152 bytes from address 0x00000000 in flash
> root@...8qmmek:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...8qmmek:~# sha256sum spi*
> 4bda3a28f4ffe603c0ec1258c0034d65a1a0d35ab7bd523a834608adabf03cc5
> spi_read
>
> 16b3a0c63252b07501129a0e495e6c8cb8e40598e32bc9a9431838ba95266f3d
> spi_test
> root@...8qmmek:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
> root@...8qmmek:~# mtd_debug info /dev/mtd0
> mtd.type = MTD_NORFLASH
> mtd.flags = MTD_CAP_NORFLASH
> mtd.size = 67108864 (64M)
> mtd.erasesize = 131072 (128K)
> mtd.writesize = 1
> mtd.oobsize = 0
> regions = 0
> root@...8qmmek:~# mtd_debug write /dev/mtd0 0 2097152 spi_test
> Copied 2097152 bytes from spi_test to address 0x00000000 in flash
> root@...8qmmek:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...8qmmek:~# hexdump spi_read -n 20
> 0000000 b6e2 a2b3 1b76 9184 3ee1 02c7 bc1f 23c0
> 0000010 475f 6526
> 0000014
> root@...8qmmek:~# flash_erase /dev/mtd0 0 0
> Erasing 65536 Kibyte @ 0 -- 100 % complete
> root@...8qmmek:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...8qmmek:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
>
> Second part: the batch mt35xu512aba with new version
> 1) This mt35xu512aba with label 4KA17 RW303 (new version) is populated on
> the imx943-evk board, was tested at 200MHz using nxp,imx94-xspi SPI
> controller.
> 2) root@...943evk:~# cat /sys/bus/spi/devices/spi8.0/spi-nor/jedec_id
> 2c5b1a
> root@...943evk:~# cat /sys/bus/spi/devices/spi8.0/spi-nor/manufacturer
> micron
> root@...943evk:/sys/bus/spi/devices/spi8.0/spi-nor# hexdump -Cv sfdp
> 00000000 53 46 44 50 0a 01 03 ff 00 08 01 17 30 00 00 ff
> |SFDP........0...|
> 00000010 84 00 01 02 90 00 00 ff 05 01 01 06 a0 00 00 ff |................|
> 00000020 0a 00 01 08 b0 00 00 ff ff ff ff ff ff ff ff ff |................|
> 00000030 e5 20 8a ff ff ff ff 1f 00 00 00 00 00 00 00 00 |. ..............|
> 00000040 ee ff ff ff ff ff 00 00 ff ff 00 00 0c 20 11 d8 |............. ..|
> 00000050 0f 52 00 00 39 61 99 00 87 8e 03 d3 ac a1 27 3d
> |.R..9a........'=|
> 00000060 7a 75 7a 75 fb bd d5 5c 00 00 70 ff 81 50 f8 a1
> |zuzu...\..p..P..|
> 00000070 2f cb 27 8b 00 00 04 01 00 06 01 00 ff ff ff 8e |/.'.............|
> 00000080 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff |................|
> 00000090 43 0e ff ff 21 dc 5c ff ff ff ff ff ff ff ff ff |C...!.\.........|
> 000000a0 00 0b 80 9e b1 81 b5 85 00 f0 ff 9f 00 0a 00 00 |................|
> 000000b0 00 0a 1a 88 10 00 00 00 ff ff ff ff ff ff ff ff |................|
> 000000c0 00 00 06 01 00 00 00 00 14 01 81 03 00 00 00 00
> |................|
> 000000d0
> root@...943evk:~# sha256sum /sys/bus/spi/devices/spi8.0/spi-nor/sfdp
> 809cbdfc57ae56771e017ff7bfdae7122afcbcbb238f2502420cfe3b2fe20d11
> /sys/bus/spi/devices/spi8.0/spi-nor/sfdp
> 3) root@...943evk:~# cat /sys/kernel/debug/spi-nor/spi8.0/capabilities
> Supported read modes by the flash
> 1S-1S-1S
> opcode 0x13
> mode cycles 0
> dummy cycles 0
> 1S-1S-8S
> opcode 0x7c
> mode cycles 1
> dummy cycles 7
> 1S-8S-8S
> opcode 0xcc
> mode cycles 1
> dummy cycles 15
> 8D-8D-8D
> opcode 0xfd
> mode cycles 0
> dummy cycles 20
>
> Supported page program modes by the flash
> 1S-1S-1S
> opcode 0x12
> 8D-8D-8D
> opcode 0x12
>
> root@...943evk:~# cat /sys/kernel/debug/spi-nor/spi8.0/params
> name (null)
> id 2c 5b 1a 10 41 00
> size 64.0 MiB
> write size 1
> page size 256
> address nbytes 4
> flags 4B_OPCODES | HAS_4BAIT | HAS_16BIT_SR |
> IO_MODE_EN_VOLATILE | SOFT_RESET
>
> opcodes
> read 0xfd
> dummy cycles 20
> erase 0xdc
> program 0x12
> 8D extension repeat
>
> protocols
> read 8D-8D-8D
> write 8D-8D-8D
> register 8D-8D-8D
>
> erase commands
> 21 (4.00 KiB) [1]
> 5c (32.0 KiB) [2]
> dc (128 KiB) [3]
> c7 (64.0 MiB)
>
> sector map
> region (in hex) | erase mask | overlaid
> ------------------+------------+----------
> 00000000-03ffffff | [ 3] | no
>
> 4) root@...943evk:~# dd if=/dev/urandom of=./spi_test bs=1M count=2
> 2+0 records in
> 2+0 records out
> 2097152 bytes (2.1 MB, 2.0 MiB) copied, 0.0216668 s, 96.8 MB/s
> root@...943evk:~# mtd_debug erase /dev/mtd0 0 2097152
> Erased 2097152 bytes from address 0x00000000 in flash
> root@...943evk:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...943evk:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
> root@...943evk:~# sha256sum spi_read
> 4bda3a28f4ffe603c0ec1258c0034d65a1a0d35ab7bd523a834608adabf03cc5
> spi_read
> root@...943evk:~# mtd_debug write /dev/mtd0 0 2097152 spi_test
> Copied 2097152 bytes from spi_test to address 0x00000000 in flash
> root@...943evk:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...943evk:~# sha256sum spi_*
> 8bf13c50e9f106d180e5657e803811e1721c0e092ff46281d5bf30d1b13ac368
> spi_read
> 8bf13c50e9f106d180e5657e803811e1721c0e092ff46281d5bf30d1b13ac368
> spi_test
> root@...943evk:~# mtd_debug erase /dev/mtd0 0 2097152
> Erased 2097152 bytes from address 0x00000000 in flash
> root@...943evk:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...943evk:~# sha256sum spi_*
> 4bda3a28f4ffe603c0ec1258c0034d65a1a0d35ab7bd523a834608adabf03cc5
> spi_read
> 8bf13c50e9f106d180e5657e803811e1721c0e092ff46281d5bf30d1b13ac368
> spi_test
> root@...943evk:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
> root@...943evk:~# mtd_debug info /dev/mtd0
> mtd.type = MTD_NORFLASH
> mtd.flags = MTD_CAP_NORFLASH
> mtd.size = 67108864 (64M)
> mtd.erasesize = 131072 (128K)
> mtd.writesize = 1
> mtd.oobsize = 0
> regions = 0
>
> root@...943evk:~# mtd_debug write /dev/mtd0 0 2097152 spi_test
> Copied 2097152 bytes from spi_test to address 0x00000000 in flash
> root@...943evk:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...943evk:~# hexdump spi_read -n 20
> 0000000 998e 471b fae3 9269 ce52 c6e5 42ae 5143
> 0000010 8f20 c41f
> 0000014
> root@...943evk:~# flash_erase /dev/mtd0 0 0
> Erasing 65536 Kibyte @ 0 -- 100 % complete
> root@...943evk:~# mtd_debug read /dev/mtd0 0 2097152 spi_read
> Copied 2097152 bytes from address 0x00000000 in flash to spi_read
> root@...943evk:~# hexdump spi_read
> 0000000 ffff ffff ffff ffff ffff ffff ffff ffff
> *
> 0200000
> ---
> drivers/mtd/spi-nor/micron-st.c | 11 +++++++++++
> 1 file changed, 11 insertions(+)
>
> diff --git a/drivers/mtd/spi-nor/micron-st.c b/drivers/mtd/spi-nor/micron-st.c
> index
> 88033384a71e5d19f5a26ca91f56a49e3017183a..b35738833a13d447163e37fc
> 769c4832b80cd9d8 100644
> --- a/drivers/mtd/spi-nor/micron-st.c
> +++ b/drivers/mtd/spi-nor/micron-st.c
> @@ -167,6 +167,17 @@ static int mt35xu512aba_post_sfdp_fixup(struct
> spi_nor *nor)
> 0, 20, SPINOR_OP_MT_DTR_RD,
> SNOR_PROTO_8_8_8_DTR);
>
> + /*
> + * Some batches mt35xu512aba do not contain the OCT DTR command
> + * information, but did support OCT DTR mode.
> + * So add the common SNOR_CMD_PP_8_8_8_DTR here, this can also
> + * make sure micron_st_nor_octal_dtr_en() can be called when switch
> + * to OCT DTR mode.
> + */
> + nor->params->hwcaps.mask |= SNOR_HWCAPS_PP_8_8_8_DTR;
> +
> spi_nor_set_pp_settings(&nor->params->page_programs[SNOR_CMD_PP_
> 8_8_8_DTR],
> + SPINOR_OP_PP_4B, SNOR_PROTO_8_8_8_DTR);
> +
> nor->cmd_ext_type = SPI_NOR_EXT_REPEAT;
> nor->params->rdsr_dummy = 8;
> nor->params->rdsr_addr_nbytes = 0;
>
> ---
> base-commit: cc3aa43b44bdb43dfbac0fcb51c56594a11338a8
> change-id: 20251212-nor-2f37cf12eeca
>
> Best regards,
> --
> Haibo Chen <haibo.chen@....com>
Powered by blists - more mailing lists