Change the BUG_ON() condition in brcmnand_send_cmd() which checks for
the interrupt status "controller ready" bit to a WARN_ON.

There is no good reason to kill the system when this condition occur
because we could have systems which listed the NAND controller as
available (e.g: from Device Tree), but the NAND chip could be
malfunctioning and not responding.
Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
Acked-by: NBrian Norris <computersforpeace@gmail.com>
Reviewed-by: NKamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

There is a cut and paste issue here.  The bug is that we are allocating
more memory than necessary for msp_maps.  We should be allocating enough
space for a map_info struct (144 bytes) but we instead allocate enough
for an mtd_info struct (1840 bytes).  It's a small waste.

The other part of this is not harmful but when we allocated msp_flash
then we allocated enough space fro a map_info pointer instead of an
mtd_info pointer.  But since pointers are the same size it works out
fine.

Anyway, I decided to clean up all three allocations a bit to make them
a bit more consistent and clear.

Fixes: 68aa0fa8 ('[MTD] PMC MSP71xx flash/rootfs mappings')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

We check for NULL but then dereference "info->mtd" on the next line.

Fixes: 72169755 ('mtd: maps: sa1100-flash: show parent device in sysfs')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This driver add support to the new Atmel QSPI controller embedded into
sama5d2x SoCs. It expects a NOR memory to be connected to the QSPI
controller.
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

In case of error, the function dma_request_chan() returns ERR_PTR() and
never returns NULL. The NULL test in the return value check should be
replaced with IS_ERR().

Fixes: aa7abd31 ('mtd: nand: omap2: Support parsing dma channel
information from DT')
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Pull NAND changes from Boris Brezillon:
"""
This pull request contains only one notable change:
* Addition of the MTK NAND controller driver

And a bunch of specific NAND driver improvements/fixes. Here are the
changes that are worth mentioning:
* A few fixes/improvements for the xway NAND controller driver
* A few fixes for the sunxi NAND controller driver
* Support for DMA in the sunxi NAND driver
* Support for the sunxi NAND controller IP embedded in A23/A33 SoCs
* Addition for bitflips detection in erased pages to the brcmnand driver
* Support for new brcmnand IPs
* Update of the OMAP-GPMC binding to support DMA channel description
"""

This patch documents the DT bindings for the driver of the Atmel QSPI
controller embedded inside sama5d2x SoCs.
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: NRob Herring <robh@kernel.org>
Acked-by: NNicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add hisilicon spi-nor flash controller driver
Signed-off-by: NBinquan Peng <pengbinquan@hisilicon.com>
Signed-off-by: NJiancheng Xue <xuejiancheng@hisilicon.com>
Acked-by: NRob Herring <robh@kernel.org>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Reviewed-by: NJagan Teki <jteki@openedev.com>
Reviewed-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Gigadevice flash support BP{0,1,2,3,4} bits, where BP3 means the same as
the existing supported TB (Top/Bottom), and BP4 means the same as the
not-yet-supported 4K bit used on other flash (e.g., Winbond). Let's
support lock/unlock with the same feature flags as w25q32dw/w25q64dw.

Tested on gd25lq64c, but I checked datasheets for the other 3, to make
sure.

While I was at it, I noticed that these all support dual and quad as
well. I noted them, but can't test them at the moment, since my test
system only supports standard 1x SPI.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add Micron (n25q00a) 1Gbit NOR Flash in the list of supported
devices.
This part is different from n25q00 in Memory Type.
Memory Type for n25q00 - BAh
Memory Type for n25q00a - BBh
Signed-off-by: NP L Sai Krishna <lakshmis@xilinx.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This patch enables IFC NAND support on ARM layerscape platform.
It fixes the dependency to enable NAND. The include files are being modified
to ensure complilation for both PowerPC and ARM architectures.
Signed-off-by: NRaghav Dogra <raghav.dogra@nxp.com>
Acked-by: NScott Wood <oss@buserror.net>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Emails will bounce from my imgtec address, so update it to a new one.
Signed-off-by: NHarvey Hunt <harvey.hunt@imgtec.com>
Cc: Harvey Hunt <harveyhuntnexus@gmail.com>
Cc: linux-mtd@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

I moved the sanity check on ecc->size before the allocation so that we
don't leak memory on error.

Fixes: 05af074a4b73 ('mtd: nand: sunxi: check ecc->size values')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

The NAND controller on some sun8i chips needs its reset line to be
deasserted before they can enter working state.
Signed-off-by: NIcenowy Zheng <icenowy@aosc.xyz>
Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Document the reset lines
Signed-off-by: NIcenowy Zheng <icenowy@aosc.xyz>
Acked-by: NMaxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Instead of using IO_ADDR_W and IO_ADDR_R use an own pointer to the NAND
controller memory area.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

This driver needs a special write_buf and read_buf function, because we
have to read from a specific address to tell the controller this is a
read from the nand controller.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Extract the functions to read and write to the register of the NAND
flash controller.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

The external Bus Unit (EBU) can control different flash devices, but
these NAND flash commands have to be atomic and should not be
interrupted in between. Lock the EBU from the beginning of the command
till the end by moving the lock to the chip select.
Signed-off-by: NJohn Crispin <john@phrozen.org>
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

nand_scan() already resets the NAND flash chip, this driver does not
have to call it manually. The xway_reset_chip() functions does the same
as the normal NAND reset function. The waiting for the NAND_WAIT_WR_C
is done in xway_cmd_ctrl().
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

The ->cmd_ctrl() function is adjusting the ->IO_ADDR_W value depending
on the command type each time NAND_CTRL_CHANGE is passed. This is not
only useless but can lead to an ->IO_ADDR_W corruption.

Get rid of this logic and rely on the NAND_CLE and NAND_ALE flags to
deduce the iomem address to write the cmd argument to.
Signed-off-by: NJohn Crispin <john@phrozen.org>
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Instead of hacking this into the plat_nand driver just make this a
normal nand driver.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

This adds some register documentation which should make it easier to
understand how this controller works. In addition it makes now use of
BIT() macro and adds some more defines.
Signed-off-by: NHauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Support for NAND biterrors test on platforms without raw write

While the default test mode relies on raw write (mtd_write_oob) to introduce
bit errors into a page, the rewrite test mode doesn't need it.

Changed the overwrite test to use normal writes. The default test mode
is unaffected and still requires raw write as before.
Signed-off-by: NIwo Mergler <Iwo.Mergler@netcommwireless.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Implement ecc->write_subpage() to prevent core code from assigning this
hook to nand_write_subpage_hwecc(). This default implementation tries
to call ecc->hwctl() which in our case is NULL, thus leading to a NULL
pointer dereference.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Verify that the ecc->size value is either 512 or 1024 bytes.
This should always be the case if this field was assigned to the
nand->ecc_step_size_ds value, but can be wrong when the user overloaded
this value with the nand-ecc-step-size DT property.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

Switching to 1k ECC blocks when possible provides better resistance against
concentrated bitflips. Say you have those two configurations:

1/ 16bits/512bytes
2/ 32bits/1024bytes

Both of them require the same amount of ECC bytes (only true for this
specific engine), but the second config allows you to correct the case
where most of your bitflips are concentrated in a single 512bytes portion.

This fact makes the 1k ECC block size more advantageous than the 512bytes
one.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

The column address passed to the RNDOUT operation was missing the page
size offset.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 614049a8 ("mtd: nand: sunxi: add support for DMA assisted operations")

Add support for mediatek's SDG1 NFC nand controller embedded in SoC
2701
Signed-off-by: NJorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NXiaolei Li <xiaolei.li@mediatek.com>

Documentation support for Smart Device Gen1 type of NAND controllers
Signed-off-by: NJorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

In case of error, the function dmaengine_prep_slave_sg() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.
Signed-off-by: NWei Yongjun <yongjun_wei@trendmicro.com.cn>
Fixes: 614049a8 ("mtd: nand: sunxi: add support for DMA assisted operations")
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

This change provides a fix for controller bug where nand
controller could have a possible sticky error after a PIO
followed by a DMA read. The fix retries a read if we see
a uncorr_ecc after read to detect such sticky errors.
The fix applies to only controller version 7.0 and 7.1.
Signed-off-by: NKamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

In stm_unlock(), the test to determine whether we've fully unlocked the
flash checks for the lock length to be equal to the flash size. That is
a typo/think-o -- the condition actually means the flash is completely
*locked.* We should be using the inverse condition -- that the lock
length is 0 (i.e., no protection).

The result of this bug is that we never actually turn off the Status
Register Write Disable bit, even if the flash is completely unlocked.
Now we can.

Fixes: 47b8edbf ("mtd: spi-nor: disallow further writes to SR if WP# is low")
Reported-by: NGiorgio <giorgio.nicole@arcor.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>

This function compiles to 2554 bytes of machine code.
In C, the function is almost 200 lines long.

It has only one callsite, but forced inlining that much code
makes gcc generate significantly worse code. Let gcc itself decide
what to do.
Signed-off-by: NDenys Vlasenko <dvlasenk@redhat.com>
CC: David Woodhouse <David.Woodhouse@intel.com>
CC: Dan Carpenter <dan.carpenter@oracle.com>
CC: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
CC: linux-mtd@lists.infradead.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Replace if condition and BUG() with a BUG_ON having the conditional
expression of the if statement as argument.

The Coccinelle semantic patch used to make this change is as follows:
@@ expression E,f; @@

(
  if (<+... f(...) ...+>) { BUG(); }
|
- if (E) { BUG(); }
+ BUG_ON(E);
)
Signed-off-by: NAmitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

drivers/mtd/maps/physmap_of.c: In function ‘of_flash_probe’:
drivers/mtd/maps/physmap_of.c:165:16: warning: variable ‘p’ set but not used [-Wunused-but-set-variable]

This could be a problem if the 'reg' property is not set, since that
means 'count' will be uninitialized.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The "tmp_retlen" variable can be uninitialized if action() fails.  It's
harmless except for the static checker warning.  I have moved the error
handling earlier to fix it.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This has been unused, except as the condition for a fatal error, since
commit c13cbf3b ("[MTD] mtdram: Quick cleanup of the driver:") in
2.6.13 (!).
Signed-off-by: NBen Hutchings <ben@decadent.org.uk>
Acked-by: NJesper Nilsson <jesper.nilsson@axis.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Check for erased page bitflips in a page. And if well within
threshold return data as all 0xff. Apply sw check for controller
version < 7.2. Controller vesion >= 7.2 has hw support.
Signed-off-by: NKamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>

I got device with ESMT (Elite Semiconductor Memory Technology Inc)
F59L1G81MA flash that was detected as:
[    0.852034] nand: device found, Manufacturer ID: 0xc8, Chip ID: 0xd1
[    0.858402] nand: Unknown NAND 128MiB 3,3V 8-bit
[    0.863031] nand: 128MiB, SLC, page size: 2048, OOB size: 64

According to the F59L1G81MA datasheet (and Read Id documentation) C8h is
a "Maker Code" which should mean ESMT. Add it to fix above "Unknown".
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>