i.MX93 QSPI NOR Flash "read" segfaults with __memcpy_fromio

[eldorr]

Gents,

I have a custom i.MX9-based board with a mt25ql02g QSPI NOR Flash (256 MByte). 
I observe unstable SPI NOR Flash read that every time results in segfault - e.g.

[root@imx93evk /mnt/swbank]# flashcp -A ./mxImage /dev/mtd3

<..... erase, and write always works - but then during "verify" ...>

[ 1156.397511] Internal error: synchronous external abort: 0000000096000010 [#1] PREEMPT SMP
[ 1156.405704] Modules linked in:
[ 1156.408751] CPU: 1 PID: 760 Comm: flashcp Not tainted 6.1.55-g2cb8508dd2db #6
[ 1156.415872] Hardware name: NXP i.MX93 11X11 EVK board (DT)
[ 1156.421342] pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1156.428291] pc : __memcpy_fromio+0x58/0xb0
[ 1156.432390] lr : nxp_fspi_exec_op+0x89c/0xe50
[ 1156.436741] sp : ffff80000aa8b670
[ 1156.440043] x29: ffff80000aa8b6b0 x28: 0000aaaade35f2d0 x27: ffff80000aa8bdc0
[ 1156.447167] x26: ffff00000c1d49c0 x25: ffff0000084dd880 x24: ffff0000084dd580
[ 1156.454291] x23: ffff0000084dd000 x22: 0000000008000000 x21: ffff0000084dd5e8
[ 1156.461415] x20: 0000000000000800 x19: ffff80000aa8ba10 x18: 0000000000000000
[ 1156.468539] x17: 0000000000000000 x16: 00000000000001a0 x15: 0000000000000000
[ 1156.475663] x14: 0000000000000000 x13: 0000000000000002 x12: ffff000027e019a0
[ 1156.482787] x11: 0000000000000004 x10: 000000000000001d x9 : 00000000ffffff00
[ 1156.489911] x8 : 000000000000320a x7 : 0000000000000001 x6 : 0000000000000800
[ 1156.497035] x5 : 00ffffffffffffff x4 : ffff80000cdf0000 x3 : ffff000008870800
[ 1156.504159] x2 : 0000000000000800 x1 : ffff80000cdf0000 x0 : ffff000008870000
[ 1156.511284] Call trace:
[ 1156.513720] __memcpy_fromio+0x58/0xb0
[ 1156.517462] spi_mem_exec_op+0x39c/0x3f0
[ 1156.521380] spi_mem_no_dirmap_read+0xa0/0xc0
[ 1156.525730] spi_mem_dirmap_read+0xd4/0x140
[ 1156.529908] spi_nor_read_data+0x114/0x180
[ 1156.533990] spi_nor_read+0xb4/0x160
[ 1156.537552] mtd_read_oob_std+0x78/0x90
[ 1156.541382] mtd_read_oob+0x8c/0x150
[ 1156.544944] mtd_read+0x68/0xb0
[ 1156.548073] mtdchar_read+0x224/0x2a0
[ 1156.551730] vfs_read+0xc4/0x2c0
[ 1156.554954] ksys_read+0x74/0x110
[ 1156.558256] __arm64_sys_read+0x1c/0x30
[ 1156.562078] invoke_syscall+0x48/0x110
[ 1156.565823] el0_svc_common.constprop.0+0x44/0xf0
[ 1156.570520] do_el0_svc+0x2c/0xd0
[ 1156.573822] el0_svc+0x2c/0x90
[ 1156.576872] el0t_64_sync_handler+0x114/0x120
[ 1156.581214] el0t_64_sync+0x18c/0x190
[ 1156.584868] Code: 927df0c6 910020c6 8b060003 d503201f (f9400085)
[ 1156.590950] ---[ end trace 0000000000000000 ]---
Segmentation fault

The segfault appears to happen during "read-and-verify" of MTD content.
Now; I do not have too much statistics on this but it appears as if the MTD-partitions in the upper (+ 128 MByte upwards towards full) are more error prone, as I have not been able to (re)produce the same error for e.g. mtd0 (U-Boot), mtd1 (env), and the first 96 MByte partition thereafter (mtd2). However; mtd3 and mtd4 always fails.

My .dts patched as follows:

+ pinctrl_flexspi1: flexspi1grp {
+ fsl,pins = <
+ MX93_PAD_SD3_CLK__FLEXSPI1_A_SCLK 0x51e
+ MX93_PAD_SD3_CMD__FLEXSPI1_A_SS0_B 0x51e
+ MX93_PAD_SD3_DATA0__FLEXSPI1_A_DATA00 0x51e
+ MX93_PAD_SD3_DATA1__FLEXSPI1_A_DATA01 0x51e
+ MX93_PAD_SD3_DATA2__FLEXSPI1_A_DATA02 0x51e
+ MX93_PAD_SD3_DATA3__FLEXSPI1_A_DATA03 0x51e
+ >;

and

+&flexspi1 {
+ pinctrl-names = "default";
+ pinctrl-0 = <&pinctrl_flexspi1>;
+ assigned-clock-rates = <80000000>;
+ status = "okay";
+
+ flash: mt25ql02g@0 {
+ compatible = "jedec,spi-nor";
+ #address-cells = <1>;
+ #size-cells = <1>;
+ reg = <0>;
+ spi-max-frequency = <80000000>;
+ spi-tx-bus-width = <4>;
+ spi-rx-bus-width = <4>;
+
+ /* 2 MByte */
+ spl: partition@0 {
+ label = "uboot appl";
+ reg = <0x00000000 0x00200000>;
+ }; //end partition@00000000 (uboot_appl)
+
+ /* 64 KByte */
+ uboot_env: partition@200000 {
+ label = "uboot env";
+ reg = <0x00200000 0x00010000>;
+ }; //end partition@00200000 (uboot_env)
+
+ /* 96 MByte */
+ mx_image_1: partition@210000 {
+ label = "mx image 1";
+ reg = <0x00210000 0x06000000>;
+ }; //end partition@00210000 (mx_image_1)
+
+ /* 96 MByte */
+ mx_image_2: partition@6210000 {
+ label = "mx image 2";
+ reg = <0x06210000 0x06000000>;
+ }; //end partition@6210000 (mx_image_2)
+
+ /* 61 MByte */
+ fs: partition@C210000 {
+ label = "fs";
+ reg = <0x0C210000 0x03DF0000>;
+ }; //end partition@C210000 (fs)
+ }; //end mt25ql02g@0 (flash)
+};

QSPI NOR Flash detection (from dmesg):

[ 0.179377] spi-nor spi0.0: mt25ql02g (262144 Kbytes)
[ 0.179540] 5 fixed-partitions partitions found on MTD device 425e0000.spi
[ 0.179546] Creating 5 MTD partitions on "425e0000.spi":
[ 0.179552] 0x000000000000-0x000000200000 : "uboot appl"
[ 0.180579] 0x000000200000-0x000000210000 : "uboot env"
[ 0.181407] 0x000000210000-0x000006210000 : "mx image 1"
[ 0.182233] 0x000006210000-0x00000c210000 : "mx image 2"
[ 0.183095] 0x00000c210000-0x000010000000 : "fs"

I have tried out 133MHz (max) and now running at 80MHz - still same issue.

Anyone else experienced this ... ar have suggestions as to what is the root cause?

Thanks.