We're not initializing the ooblen field. Our users don't care, since
they check that oobbuf == NULL first, but it's good practice to zero
unused fields out.

We can drop the NULL initializations since we're memset()ing the whole
thing.

Noticed by Coverity, CID #200821, #200822
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

TclsRising is always 1.

Caught by Coverity.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: Masahiro Yamada <yamada.m@jp.panasonic.com>

Coverity noticed that these 'ret' assignments weren't being used. Let's
use them.

Note that nand_lock() and nand_unlock() are still not officially used by
any drivers.

Coverity CIDs #1227054 and #1227037
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The PARAM command was long unimplemented and it probably wasn't
noticed because chip probing using only the few bytes returned by the
READID command are good enough in most cases to determine the chip in
use.

Still to notice such a shortcoming earlier in the future would be nice
in case it's something more vital.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The mxc-nand driver never supported the PARAM command to read out the
ONFI parameter page and so always relied on probing my manufacturer and
device id (as provided by the READID command).

This patch implements reading out the first parameter page copy at least
which should be good enough in practise.

This makes the boot log change from

	nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xb1
	nand: Micron NAND 128MiB 1,8V 16-bit

to
	nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xb1
	nand: Micron MT29F1G16ABBDAH4

on my machine.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The mxc-nand controller works pagewise and so usually only sends
commands to the flash chip with column == 0. A request with column != 0
from the upper layer is then fulfilled by indexing appropriately into the
device's RAM buffer.

To be able to access the ONFI marker at offset 0x20 in reply to the
READID command however it's invalid to read 32 bytes starting from
column 0.

So let the function used to send the address cycles send the column
address actually passed instead of 0 and fix all callers to pass 0
instead appropriately. Also add some warnings in case this patch changes
the drivers semantics.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

When the hardware operates in 16 bit mode it always reads 16 bits even
for operations that only have the lower 8 bits defined. So the upper
bits must be discarded. Do this in the read_byte callback instead of
when reading the NAND id to support reading byte wise more than 5 bytes
and at other occations (like reading the ONFI parameter page).
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

At least on i.MX25 (i.e. NFCv2) preset_v2 is called with mtd->writesize
== 0 that is before the connect flash chip is detected. It then
configures for 8 bit ECC mode which needs 26 bytes of OOB per 512 bytes
main section. For flashes with a smaller OOB area issuing a read page
command makes the controller stuck with this config.

Note that this currently doesn't hurt because the first read page
command is issued only after detection is complete and preset is called
once more.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

While extending the mxc-nand driver it happend to me a few times that
the device was stuck and this made the machine hang during boot. So
implement a timeout and print a stack trace the first time this happens
to make it debuggable. The return type of the waiting function is also
changed to int to be able to handle the timeout in the caller.
Signed-off-by: NUwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Currently the driver read NFC command registers to get NFC busy flag.
Actually this flag also can be get by reading HSMC_SR register.

Use the read NFC command registers need mapping a huge memory region.
To save the mapped memory region, we change to check NFC busy flag by
reading HSMC_SR register.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NJosh Wu <josh.wu@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Fix typo, "Unkown" -> "Unknown"
Signed-off-by: NColin Ian King <colin.king@canonical.com>
Acked-by: NJosh Wu <josh.wu@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

s3c2410_nand_probe is not the name of the function.

These prints have little utility, so let's just kill them.
Reported-by: NJulia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

pxa3xx_flash_ids wasn't initialized to 0, which in certain cases could
end up containing corrupted values in its members. Fix this to avoid
possible issues.
Signed-off-by: NAntoine Tenart <antoine.tenart@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

As the devicetree binding doesn't require num_cs to exist or be strictly
positive, and neither does the platform data case, a bug appear when
num_cs is set to 0 and panics the kernel.

The issue is that in alloc_nand_resource(), chip is dereferenced without
having a value assigned when num_cs == 0.

Fix this by returning ENODEV is num_cs == 0.

The panic seen is :
Unable to handle kernel NULL pointer dereference at virtual address 000002b8
pgd = c0004000
[000002b8] *pgd=00000000
Internal error: Oops: 5 [#1] PREEMPT ARM
Modules linked in:
Hardware name: Marvell PXA3xx (Device Tree Support)
task: c3822aa0 ti: c3826000 task.ti: c3826000
PC is at alloc_nand_resource+0x180/0x4a8
LR is at alloc_nand_resource+0xa0/0x4a8
pc : [<c0275b90>]    lr : [<c0275ab0>]    psr: 68000013
sp : c3827d90  ip : 00000000  fp : 00000000
r10: c3862200  r9 : 0000005e  r8 : 00000000
r7 : c3865610  r6 : c3862210  r5 : c3924210  r4 : c3862200
r3 : 00000000  r2 : 00000000  r1 : 00000000  r0 : 00000000
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment kernel
Control: 0000397f  Table: 80004018  DAC: 00000035
Process swapper (pid: 1, stack limit = 0xc3826198)
Stack: (0xc3827d90 to 0xc3828000)
...zip...
[<c0275b90>] (alloc_nand_resource) from [<c0275ff8>] (pxa3xx_nand_probe+0x140/0x978)
[<c0275ff8>] (pxa3xx_nand_probe) from [<c0258c40>] (platform_drv_probe+0x48/0xa4)
[<c0258c40>] (platform_drv_probe) from [<c0257650>] (driver_probe_device+0x80/0x21c)
[<c0257650>] (driver_probe_device) from [<c0257878>] (__driver_attach+0x8c/0x90)
[<c0257878>] (__driver_attach) from [<c0255ec4>] (bus_for_each_dev+0x58/0x88)
[<c0255ec4>] (bus_for_each_dev) from [<c0256ec8>] (bus_add_driver+0xd8/0x1d4)
[<c0256ec8>] (bus_add_driver) from [<c0257f14>] (driver_register+0x78/0xf4)
[<c0257f14>] (driver_register) from [<c00088a8>] (do_one_initcall+0x80/0x1e4)
[<c00088a8>] (do_one_initcall) from [<c048ed08>] (kernel_init_freeable+0xec/0x1b4)
[<c048ed08>] (kernel_init_freeable) from [<c0377d8c>] (kernel_init+0x8/0xe4)
[<c0377d8c>] (kernel_init) from [<c00095f8>] (ret_from_fork+0x14/0x3c)
Code: e503b234 e5953008 e1530001 caffffd1 (e59002b8)
---[ end trace a5770060c8441895 ]---
Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Acked-by: NEzequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Change the handling of the data stage in the driver : don't pump data in
the top-half interrupt, but rather schedule a thread for non dma cases.

This will enable latencies in the data pumping, especially if delays are
required. Moreover platform shall be more reactive as other interrupts
can be served while pumping data.

No throughput degradation was observed, at least on the zylonite
platform, while a slight degradation was being expected.
Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Tested-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The NDDB register holds the data that are needed by the read and write
commands.

However, during a read PIO access, the datasheet specifies that after each 32
bytes read in that register, when BCH is enabled, we have to make sure that the
RDDREQ bit is set in the NDSR register.

This fixes an issue that was seen on the Armada 385, and presumably other mvebu
SoCs, when a read on a newly erased page would end up in the driver reporting a
timeout from the NAND.

Cc: <stable@vger.kernel.org> # v3.14
Signed-off-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: NEzequiel Garcia <ezequiel.garcia@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The intent was to mask away some bits here, not to test true or false.

Fix: 54f531f6 ('mtd: hisilicon: add a new NAND controller driver for hisilicon hip04 Soc')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This patch adds the support for hisilicon 504 NAND controller which is now used
by Hisilicon Soc Hip04.
Signed-off-by: NZhou Wang <wangzhou1@hisilicon.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The PPC_OF is a ppc specific option which is used to mean that the
firmware device tree access functions are available. Since all the
ppc platforms have a device tree, it is aways set to 'y' for ppc.
So it makes no sense to keep a such option in the current kernel.
Replace it with PPC.
Signed-off-by: NKevin Hao <haokexin@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This driver uses NAND_ECC_HW_SYNDROME mode.  The nand_scan_tail()
function would not complain about missing ecc->calculate,
ecc->correct, ecc->hwctl handlers.
Signed-off-by: NMasahiro Yamada <yamada.m@jp.panasonic.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Signed-off-by: NBaruch Siach <baruch@tkos.co.il>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The if and the else branch code are identical - so the condition has no
effect on the effective code. This patch removes the condition and the
duplicated code and updates the documentation as suggested by
Roger Quadros <rogerq@ti.com>.
Acked-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NNicholas Mc Guire <hofrat@osadl.org>
Reviewed-by: NPekon Gupta <pekon@pek-sem.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Use the GPIO descriptor API instead of the deprecated legacy GPIO API to
manage the busy GPIO.

The patch updates both the jz4740 nand driver and the only user of the driver
the qi-lb60 board driver.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Acked-by: NRalf Baechle <ralf@linux-mips.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Previously, we requested that drivers pass ecc.size and ecc.bytes when
using NAND_ECC_SOFT_BCH. However, a driver is likely to only know the ECC
strength required for its NAND, so each driver would need to perform a
strength-to-bytes calculation.

Avoid duplicating this calculation in each driver by asking drivers to
pass ecc.size and ecc.strength so that the strength-to-bytes calculation
need only be implemented once.

This reverts/generalizes this commit:
    mtd: nand: Base BCH ECC bytes on required strength
Signed-off-by: NAaron Sierra <asierra@xes-inc.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The MTD API reports -EUCLEAN only if the maximum number of bitflips
found in any ECC block exceeds a certain threshold. This is done to
avoid excessive -EUCLEAN reports to MTD users, which may induce
additional scrubbing of data, even when the ECC algorithm in use is
perfectly capable of handling the bitflips.

This threshold can be controlled by user-space (via sysfs), to allow
users to determine what they are willing to tolerate in their
application. But it still helps to have sane defaults.

In recent discussion [1], it was pointed out that our default threshold
is equal to the correction strength. That means that we won't actually
report any -EUCLEAN (i.e., "bitflips were corrected") errors until there
are almost too many to handle. It was determined that 3/4 of the
correction strength is probably a better default.

[1] http://lists.infradead.org/pipermail/linux-mtd/2015-January/057259.htmlSigned-off-by: NBrian Norris <computersforpeace@gmail.com>
Acked-by: NHuang Shijie <shijie.huang@intel.com>

Since in SAMA5D4 chip, the PMECC can correct bit flips in erased page.
So we add a DT property to indicate this hardware character.

If the PMECC support correct bitflip erased page (all data are 0xff).
Then we can use the PMECC correct the page and skip the erased page
check.
Signed-off-by: NJosh Wu <josh.wu@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

atmel_nand_pmecc_read_page() will return the total bitflips in this
page. This is incorrect.

As one nand page includes multiple ecc sectors, that will cause the
returned total bitflips exceed ecc capablity.

So this patch will make pmecc_correct() return the max bitflips of all
sectors in the page. That also makes atmel_nand_pmecc_read_page() return
the max bitflips.
Signed-off-by: NJosh Wu <josh.wu@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

There is no path to switch to STATE_DATAOUT_STATUS_M state, and
OPT_SMARTMEDIA is unused.

This is leftover from commit 0be718e5
("mtd: nand: remove a bunch of unused commands").
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Brian Norris <computersforpeace@gmail.com>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

In initialization routine, mtd_info->owner is overwritten by memset()
just after being initialized.  This can be fixed by moving memset() calls
to just before setting mtd_info->owner.  But the memory region is allocated
by kmalloc, so we can fix it by using kzalloc instead of kmalloc.
Signed-off-by: NAkinobu Mita <akinobu.mita@gmail.com>
Cc: Jonathan McDowell <noodles@earth.li>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

commit 3157d1ed ("mtd: denali: remove unnecessary casts") introduced
an error by using a wrong bitmask.

A uint16_t cast was replaced with & 0xff, should be & 0xffff.
Signed-off-by: NGraham Moore <grmoore@opensource.altera.com>
Signed-off-by: NDinh Nguyen <dinguyen@opensource.altera.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Commit 7854d3f7 ("mtd: spelling, capitalization, uniformity") added
a correctly spelled line, but failed to remove the wrongly spelled one.
Commit 064a7694 ("mtd: Fix typo mtd/tests") then fixed the spelling
again, but left the duplication.

Fixes: 7854d3f7 ("mtd: spelling, capitalization, uniformity")
Signed-off-by: NBaruch Siach <baruch@tkos.co.il>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add nand_shutdown to wait for current nand operations to finish and prevent
further operations by changing the nand flash state to FL_SHUTDOWN.

This is addressing a problem observed during reboot tests using UBIFS
root file system: NAND erase operations that are in progress during
system reboot/shutdown are causing partial erased blocks. Although UBI should
be able to detect and recover from this error, this change will avoid
the creation of partial erased blocks on reboot in the middle of a NAND erase
operation.
Signed-off-by: NScott Branden <sbranden@broadcom.com>
Tested-by: NScott Branden <sbranden@broadcom.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Now that we have raw functions properly implemented we can remove this
FIXME.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: NHuang Shijie <shijie.huang@intel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

mx28evk board has a socket for NAND flash that comes with no NAND flash
populated, and then we get this message on every boot:

[    1.657603] gpmi-nand 8000c000.gpmi-nand: driver registration failed: -19

which is not very helpful, so get rid of this error message.
Signed-off-by: NFabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Implement raw OOB access functions to retrieve OOB bytes when accessing the
NAND in raw mode.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Several MTD users (either in user or kernel space) expect a valid raw
access support to NAND chip devices.
This is particularly true for testing tools which are often touching the
data stored in a NAND chip in raw mode to artificially generate errors.

The GPMI drivers do not implemenent raw access functions, and thus rely on
default HW_ECC scheme implementation.
The default implementation consider the data and OOB area as properly
separated in their respective NAND section, which is not true for the GPMI
controller.
In this driver/controller some OOB data are stored at the beginning of the
NAND data area (these data are called metadata in the driver), then ECC
bytes are interleaved with data chunk (which is similar to the
HW_ECC_SYNDROME scheme), and eventually the remaining bytes are used as
OOB data.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add a new function to copy bits (not bytes) from a memory region to
another one.
This function is similar to memcpy except it acts at bit level.
It is needed to implement GPMI raw access functions and adapt to the
hardware ECC engine which does not pad ECC bits to the next byte boundary.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

There is no need to use memcpy32_toio/memcpy32_fromio to transfer data
between memory and NFC sram. As the NFC sram is a also a memory space
not an I/O space, we can just use memcpy().

We remove the __iomem prefix for NFC sram to avoid sparse warnings.
Signed-off-by: NJosh Wu <josh.wu@atmel.com>
Reviewed-by: NBrian Norris <computersforpeace@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This write_page() function is functionally equivalent to the default in
nand_base.c. Its only difference is in subpage programming support,
which cafe_nand.c does not advertise, so the difference is negligible.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>