mtd: rawnand: serialize lock/unlock against other NAND operations

[PATCH] mtd: rawnand: serialize lock/unlock against other NAND operations

Posted by Kamal Dasu 1 month ago

nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
without holding the NAND device lock. On controllers that implement
SET_FEATURES via multiple low-level PIO commands, these can race with
concurrent UBI/UBIFS background erase/write operations that hold the
device lock, resulting in cmd_pending conflicts on the NAND controller.

Add nand_get_device()/nand_release_device() around the lock/unlock
operations to serialize them against all other NAND controller access.

Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation")
Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
---
 drivers/mtd/nand/raw/nand_base.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
index 38429363251c..dfd8361bdd36 100644
--- a/drivers/mtd/nand/raw/nand_base.c
+++ b/drivers/mtd/nand/raw/nand_base.c
@@ -4737,11 +4737,16 @@ static void nand_shutdown(struct mtd_info *mtd)
 static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
 	struct nand_chip *chip = mtd_to_nand(mtd);
+	int ret;
 
 	if (!chip->ops.lock_area)
 		return -ENOTSUPP;
 
-	return chip->ops.lock_area(chip, ofs, len);
+	nand_get_device(chip);
+	ret = chip->ops.lock_area(chip, ofs, len);
+	nand_release_device(chip);
+
+	return ret;
 }
 
 /**
@@ -4753,11 +4758,16 @@ static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 static int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
 {
 	struct nand_chip *chip = mtd_to_nand(mtd);
+	int ret;
 
 	if (!chip->ops.unlock_area)
 		return -ENOTSUPP;
 
-	return chip->ops.unlock_area(chip, ofs, len);
+	nand_get_device(chip);
+	ret = chip->ops.unlock_area(chip, ofs, len);
+	nand_release_device(chip);
+
+	return ret;
 }
 
 /* Set default functions */
-- 
2.34.1

Re: [PATCH] mtd: rawnand: serialize lock/unlock against other NAND operations

Posted by Miquel Raynal 4 weeks, 1 day ago

On Thu, 05 Mar 2026 14:49:06 -0500, Kamal Dasu wrote:
> nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
> without holding the NAND device lock. On controllers that implement
> SET_FEATURES via multiple low-level PIO commands, these can race with
> concurrent UBI/UBIFS background erase/write operations that hold the
> device lock, resulting in cmd_pending conflicts on the NAND controller.
> 
> Add nand_get_device()/nand_release_device() around the lock/unlock
> operations to serialize them against all other NAND controller access.
> 
> [...]

Applied to mtd/fixes, thanks!

[1/1] mtd: rawnand: serialize lock/unlock against other NAND operations
      commit: bab2bc6e850a697a23b9e5f0e21bb8c187615e95

Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).

Kind regards,
Miquèl

Re: [PATCH] mtd: rawnand: serialize lock/unlock against other NAND operations

Posted by William Zhang 1 month ago

On Thu, Mar 5, 2026 at 11:49 AM Kamal Dasu <kamal.dasu@broadcom.com> wrote:
>
> nand_lock() and nand_unlock() call into chip->ops.lock_area/unlock_area
> without holding the NAND device lock. On controllers that implement
> SET_FEATURES via multiple low-level PIO commands, these can race with
> concurrent UBI/UBIFS background erase/write operations that hold the
> device lock, resulting in cmd_pending conflicts on the NAND controller.
>
> Add nand_get_device()/nand_release_device() around the lock/unlock
> operations to serialize them against all other NAND controller access.
>
> Fixes: 92270086b7e5 ("mtd: rawnand: Add support for manufacturer specific lock/unlock operation")
> Signed-off-by: Kamal Dasu <kamal.dasu@broadcom.com>
> ---
>  drivers/mtd/nand/raw/nand_base.c | 14 ++++++++++++--
>  1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/mtd/nand/raw/nand_base.c b/drivers/mtd/nand/raw/nand_base.c
> index 38429363251c..dfd8361bdd36 100644
> --- a/drivers/mtd/nand/raw/nand_base.c
> +++ b/drivers/mtd/nand/raw/nand_base.c
> @@ -4737,11 +4737,16 @@ static void nand_shutdown(struct mtd_info *mtd)
>  static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
>  {
>         struct nand_chip *chip = mtd_to_nand(mtd);
> +       int ret;
>
>         if (!chip->ops.lock_area)
>                 return -ENOTSUPP;
>
> -       return chip->ops.lock_area(chip, ofs, len);
> +       nand_get_device(chip);
> +       ret = chip->ops.lock_area(chip, ofs, len);
> +       nand_release_device(chip);
> +
> +       return ret;
>  }
>
>  /**
> @@ -4753,11 +4758,16 @@ static int nand_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
>  static int nand_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
>  {
>         struct nand_chip *chip = mtd_to_nand(mtd);
> +       int ret;
>
>         if (!chip->ops.unlock_area)
>                 return -ENOTSUPP;
>
> -       return chip->ops.unlock_area(chip, ofs, len);
> +       nand_get_device(chip);
> +       ret = chip->ops.unlock_area(chip, ofs, len);
> +       nand_release_device(chip);
> +
> +       return ret;
>  }
>
>  /* Set default functions */
> --
> 2.34.1
>
Reviewed-by: William Zhang <william.zhang@broadcom.com>