We recently switched from allocating ->rq using blk_init_queue() to
use blk_mq_init_queue() so we need to update the error handling to
check for IS_ERR() instead of NULL.

Fixes: ff1f48ee ('UBI: Block: Add blk-mq support')
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NRichard Weinberger <richard@nod.at>

If one ubi volume is corrupted but another is not, it should be
possible to initialize that ubiblock from a kernel commandline which
includes both of them. This patch changes the error handling behavior
in initializing ubiblock to ensure that all parameters are attempted
even if one fails. If there is a failure, it is logged on dmesg.
It also makes error messages more descriptive by including the
name of the UBI volume that failed.

Tested: Formatted ubi volume /dev/ubi5_0 in a corrupt way and
dev/ubi3_0 properly and included "ubi.block=5,0 ubi.block=3,0" on
the kernel command line. At boot, I see the following in the console:
[   21.082420] UBI error: ubiblock_create_from_param: block: can't open volume on ubi5_0, err=-19
[   21.084268] UBI: ubiblock3_0 created from ubi3:0(rootfs)
Signed-off-by: NDan Ehrenberg <dehrenberg@chromium.org>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: NRichard Weinberger <richard@nod.at>

Signed-off-by: NRichard Weinberger <richard@nod.at>

Running mtd-utils/tests/ubi-tests/io_basic.c could cause
soft lockup or watchdog reset. It is because *updatevol*
will perform ubi_check_volume() after updating finish
and this function will full scan the updated lebs if the
volume is initialized as STATIC_VOLUME.

This patch adds *cond_resched()* in the loop of lebs scan
to avoid soft lockup.

Helped by Richard Weinberger <richard@nod.at>

[ 2158.067096] INFO: rcu_sched self-detected stall on CPU { 1}  (t=2101 jiffies g=1606 c=1605 q=56)
[ 2158.172867] CPU: 1 PID: 2073 Comm: io_basic Tainted: G           O 3.10.53 #21
[ 2158.172898] [<c000f624>] (unwind_backtrace+0x0/0x120) from [<c000c294>] (show_stack+0x10/0x14)
[ 2158.172918] [<c000c294>] (show_stack+0x10/0x14) from [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660)
[ 2158.172936] [<c008ac3c>] (rcu_check_callbacks+0x1c0/0x660) from [<c002b480>] (update_process_times+0x38/0x64)
[ 2158.172953] [<c002b480>] (update_process_times+0x38/0x64) from [<c005ff38>] (tick_sched_handle+0x54/0x60)
[ 2158.172966] [<c005ff38>] (tick_sched_handle+0x54/0x60) from [<c00601ac>] (tick_sched_timer+0x44/0x74)
[ 2158.172978] [<c00601ac>] (tick_sched_timer+0x44/0x74) from [<c003f348>] (__run_hrtimer+0xc8/0x1b8)
[ 2158.172992] [<c003f348>] (__run_hrtimer+0xc8/0x1b8) from [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4)
[ 2158.173007] [<c003fd9c>] (hrtimer_interrupt+0x128/0x2a4) from [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30)
[ 2158.173022] [<c0246f1c>] (arch_timer_handler_virt+0x28/0x30) from [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124)
[ 2158.173036] [<c0086214>] (handle_percpu_devid_irq+0x9c/0x124) from [<c0082bd8>] (generic_handle_irq+0x20/0x30)
[ 2158.173049] [<c0082bd8>] (generic_handle_irq+0x20/0x30) from [<c000969c>] (handle_IRQ+0x64/0x8c)
[ 2158.173060] [<c000969c>] (handle_IRQ+0x64/0x8c) from [<c0008544>] (gic_handle_irq+0x3c/0x60)
[ 2158.173074] [<c0008544>] (gic_handle_irq+0x3c/0x60) from [<c02f0f80>] (__irq_svc+0x40/0x50)
[ 2158.173083] Exception stack(0xc4043c98 to 0xc4043ce0)
[ 2158.173092] 3c80:                                                       c4043ce4 00000019
[ 2158.173102] 3ca0: 1f8a865f c050ad10 1f8a864c 00000031 c04b5970 0003ebce 00000000 f3550000
[ 2158.173113] 3cc0: bf00bc68 00000800 0003ebce c4043ce0 c0186d14 c0186cb8 80000013 ffffffff
[ 2158.173130] [<c02f0f80>] (__irq_svc+0x40/0x50) from [<c0186cb8>] (read_current_timer+0x4/0x38)
[ 2158.173145] [<c0186cb8>] (read_current_timer+0x4/0x38) from [<1f8a865f>] (0x1f8a865f)
[ 2183.927097] BUG: soft lockup - CPU#1 stuck for 22s! [io_basic:2073]
[ 2184.002229] Modules linked in: nandflash(O) [last unloaded: nandflash]
Signed-off-by: NWang Kai <morgan.wang@huawei.com>
Signed-off-by: Nhujianyang <hujianyang@huawei.com>
Signed-off-by: NRichard Weinberger <richard@nod.at>

Fastmap can miss a PEB if it is in the protection queue
and not jet in the used tree.
Treat every protected PEB as used.
Signed-off-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

UBI uses positive function return codes internally, and should not propagate
them up, except in the place this path fixes. Here is the original bug report
from Dan Carpenter:

The problem is really in ubi_eba_read_leb().

drivers/mtd/ubi/eba.c
   412                  err = ubi_io_read_vid_hdr(ubi, pnum, vid_hdr, 1);
   413                  if (err && err != UBI_IO_BITFLIPS) {
   414                          if (err > 0) {
   415                                  /*
   416                                   * The header is either absent or corrupted.
   417                                   * The former case means there is a bug -
   418                                   * switch to read-only mode just in case.
   419                                   * The latter case means a real corruption - we
   420                                   * may try to recover data. FIXME: but this is
   421                                   * not implemented.
   422                                   */
   423                                  if (err == UBI_IO_BAD_HDR_EBADMSG ||
   424                                      err == UBI_IO_BAD_HDR) {
   425                                          ubi_warn("corrupted VID header at PEB %d, LEB %d:%d",
   426                                                   pnum, vol_id, lnum);
   427                                          err = -EBADMSG;
   428                                  } else
   429                                          ubi_ro_mode(ubi);

On this path we return UBI_IO_FF and UBI_IO_FF_BITFLIPS and it
eventually gets passed to ERR_PTR().  We probably dereference the bad
pointer and oops.  At that point we've gone read only so it was already
a bad situation...

   430                          }
   431                          goto out_free;
   432                  } else if (err == UBI_IO_BITFLIPS)
   433                          scrub = 1;
   434
Reported-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

Let's prefix UBI messages with 'ubiX' instead of 'UBI-X' - this is more
consistent with the way we name UBI devices.

Also, commit "32608703 UBI: Extend UBI layer debug/messaging capabilities"
added the function name print to 'ubi_msg()' - lets revert this change, since
these messages are supposed to be just informative messages, and not debugging
messages.
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

Some cosmetic fixes to the patch "UBI: Extend UBI layer debug/messaging
capabilities".
Signed-off-by: NTanya Brokhman <tlinder@codeaurora.org>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

Convert the driver to blk-mq.
Beside of moving to the modern block interface this change boosts
also the performance of the driver.

nand: device found, Manufacturer ID: 0x2c, Chip ID: 0xda
nand: Micron NAND 256MiB 3,3V 8-bit
nand: 256MiB, SLC, page size: 2048, OOB size: 64

root@debian-armhf:~# dd if=/dev/ubiblock0_0 of=/dev/zero bs=1M
243+1 records in
243+1 records out
255080448 bytes (255 MB) copied, 4.39295 s, 58.1 MB/s

vs.

root@debian-armhf:~# dd if=/dev/ubiblock0_0 of=/dev/zero bs=1M
243+1 records in
243+1 records out
255080448 bytes (255 MB) copied, 2.87676 s, 88.7 MB/s

Cc: hch@infradead.org
Cc: axboe@fb.com
Cc: tom.leiming@gmail.com
Signed-off-by: NRichard Weinberger <richard@nod.at>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Reviewed-by: NJens Axboe <axboe@fb.com>
Acked-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

Adds a new set of functions to deal with scatter gather.
ubi_eba_read_leb_sg() will read from a LEB into a scatter gather list.
The new data structure struct ubi_sgl will be used within UBI to
hold the scatter gather list itself and metadata to have a cursor
within the list.
Signed-off-by: NRichard Weinberger <richard@nod.at>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

By using UBI_METAONLY in rename_volumes() it is now possible to rename
an UBI volume atomically while it is open for writing.
This is useful for firmware upgrades.

Cc: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Cc: Andrew Murray <amurray@embedded-bits.co.uk>
Signed-off-by: NRichard Weinberger <richard@nod.at>
Tested-by: NGuido Martínez <guido@vanguardiasur.com.ar>
Reviewed-by: NGuido Martínez <guido@vanguardiasur.com.ar>
Tested-by: NChristoph Fritz <chf.fritz@googlemail.com>
Tested-by: NAndrew Murray <amurray@embedded-bits.co.uk>

UBI_METAONLY is a new open mode for UBI volumes, it indicates
that only meta data is being changed.
Meta data in terms of UBI volumes means data which is stored in the
UBI volume table but not on the volume itself.
While it does not interfere with UBI_READONLY and UBI_READWRITE
it is not allowed to use UBI_METAONLY together with UBI_EXCLUSIVE.

Cc: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Cc: Andrew Murray <amurray@embedded-bits.co.uk>
Signed-off-by: NRichard Weinberger <richard@nod.at>
Tested-by: NGuido Martínez <guido@vanguardiasur.com.ar>
Reviewed-by: NGuido Martínez <guido@vanguardiasur.com.ar>
Tested-by: NChristoph Fritz <chf.fritz@googlemail.com>
Tested-by: NAndrew Murray <amurray@embedded-bits.co.uk>

The torture test should quit once it actually induces an error in the
flash. This step was accidentally removed during refactoring.

Without this fix, the torturetest just continues infinitely, or until
the maximum cycle count is reached. e.g.:

   ...
   [ 7619.218171] mtd_test: error -5 while erasing EB 100
   [ 7619.297981] mtd_test: error -5 while erasing EB 100
   [ 7619.377953] mtd_test: error -5 while erasing EB 100
   [ 7619.457998] mtd_test: error -5 while erasing EB 100
   [ 7619.537990] mtd_test: error -5 while erasing EB 100
   ...

Fixes: 6cf78358 ("mtd: mtd_torturetest: use mtd_test helpers")
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: Akinobu Mita <akinobu.mita@gmail.com>
Cc: <stable@vger.kernel.org>

On device remove, when testing the cmtd field of an of_flash
struct to decide whether it is a concatenated device or not,
we get a false positive on cmtd == NULL, and dereference it
subsequently. This may occur if of_flash_remove() is called
from the cleanup path of of_flash_probe().

Instead, test for NULL first, and only then perform the test
for a concatenated device.
Signed-off-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This will allow spi-nor users to plainly use JEDEC to detect flash chip.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Implement raw OOB access functions to retrieve OOB bytes when accessing the
NAND in raw mode.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Several MTD users (either in user or kernel space) expect a valid raw
access support to NAND chip devices.
This is particularly true for testing tools which are often touching the
data stored in a NAND chip in raw mode to artificially generate errors.

The GPMI drivers do not implemenent raw access functions, and thus rely on
default HW_ECC scheme implementation.
The default implementation consider the data and OOB area as properly
separated in their respective NAND section, which is not true for the GPMI
controller.
In this driver/controller some OOB data are stored at the beginning of the
NAND data area (these data are called metadata in the driver), then ECC
bytes are interleaved with data chunk (which is similar to the
HW_ECC_SYNDROME scheme), and eventually the remaining bytes are used as
OOB data.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add a new function to copy bits (not bytes) from a memory region to
another one.
This function is similar to memcpy except it acts at bit level.
It is needed to implement GPMI raw access functions and adapt to the
hardware ECC engine which does not pad ECC bits to the next byte boundary.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: NHuang Shijie <shijie8@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

write_enable() was being duplicated to both m25p80.c and fsl-quadspi.c.
But this should be handled within the spi-nor abstraction layer.

At the same time, let's add write_disable() after erasing, so we don't
leave the flash in a write-enabled state afterward.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Acked-by: NHuang Shijie <shijie.huang@intel.com>

We need to store the six bytes ID for s25fl128s, since it shares the same
five bytes with s25fl129p1.

This patch adds a macro INFO6 which is used for the six bytes ID flash, and adds
a new item for the s25fl128s.
Signed-off-by: NHuang Shijie <shijie.huang@intel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The "id" array contains all the information about the JEDEC and the
manufacturer ID info. This patch removes the jedec_id/ext_id from
flash_info.
Signed-off-by: NHuang Shijie <shijie.huang@intel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This patch adds the id/id_len fields for flash_info{}, and rewrite the
INFO to fill them. And at last, we read out 6 bytes in the spi_nor_read_id(),
and we use these new fields to parse out the correct flash_info.
Signed-off-by: NHuang Shijie <shijie.huang@intel.com>
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Signed-off-by: NGu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

There is no need to use memcpy32_toio/memcpy32_fromio to transfer data
between memory and NFC sram. As the NFC sram is a also a memory space
not an I/O space, we can just use memcpy().

We remove the __iomem prefix for NFC sram to avoid sparse warnings.
Signed-off-by: NJosh Wu <josh.wu@atmel.com>
Reviewed-by: NBrian Norris <computersforpeace@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This write_page() function is functionally equivalent to the default in
nand_base.c. Its only difference is in subpage programming support,
which cafe_nand.c does not advertise, so the difference is negligible.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Signed-off-by: NKnut Wohlrab <knut.wohlrab@de.bosch.com>
Signed-off-by: NAlison Chaiken <alison_chaiken@mentor.com>
Reviewed-by: NJagannadha Sutradharudu Teki <jagannadh.teki@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

As stated in a5b7616c, "mtd: m25p80,spi-nor: Fix module aliases for
m25p80", m25p_ids[] in m25p80.c needs to be kept in sync with
spi_nor_ids[] in spi-nor.c. The change here corrects a misalignment.

(We were missing m25px80 and we had a duplicate w25q128.)
Signed-off-by: NAlison Chaiken <alison_chaiken@mentor.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: <stable@vger.kernel.org> # 3.18+

There are a few small issues with the timeout loop in
spi_nor_wait_till_ready():

 * The first operation should not be a reschedule; we should check the
   status register at least once to see if we're complete!

 * We should check the status register one last time after declaring the
   deadline has passed, to prevent a premature timeout error (this is
   theoretically possible if we sleep for a long time after the previous
   status register check).

 * Add an error message, so it's obvious if we ever hit a timeout.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Acked-by: NHuang Shijie <shijie.huang@intel.com>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

The functions kfree() and pci_dev_put() test whether their argument is NULL
and then return immediately. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: NMarkus Elfring <elfring@users.sourceforge.net>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

3430LDP has NAND flash with 32 bytes OOB size which is sufficient to hold
BCH8 codes but the small page check introduced in
commit b491da72 ("mtd: nand: omap: clean-up ecc layout for BCH ecc schemes")
considers anything below 64 bytes unsuitable for BCH4/8/16. There is another
bug in that code where it doesn't skip the check for OMAP_ECC_HAM1_CODE_SW.

Get rid of that small page check code as it is insufficient and redundant
because we are checking for OOB available bytes vs ecc layout before calling
nand_scan_tail().

Fixes: b491da72 ("mtd: nand: omap: clean-up ecc layout for BCH ecc schemes")
Reported-by: NTony Lindgren <tony@atomide.com>
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Tested with ATO AFND1G08U3, 128MiB NAND.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

It may be useful info, e.g. if someone wants to use ubinize.
Signed-off-by: NRafał Miłecki <zajec5@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Fixes warning:

   drivers/mtd/tests/oobtest.c: In function 'memcmpshow':
   drivers/mtd/tests/oobtest.c:129: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'size_t'
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: Roger Quadros <rogerq@ti.com>
Cc: Sekhar Nori <nsekhar@ti.com>

It is common for NAND devices to have bitflip errors.
Add a bitflip_limit parameter to specify how many bitflips per
page we can tolerate without flagging an error.
By default zero bitflips are tolerated.
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NSekhar Nori <nsekhar@ti.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add a function memcmpshow() that compares the 2 data buffers
and shows the address:offset and data bytes on comparison failure.
This function  does not break at a comparison failure but runs the
check for the whole data buffer.

Use memcmpshow() instead of memcmp() for all the verification paths.
Signed-off-by: NRoger Quadros <rogerq@ti.com>
Signed-off-by: NSekhar Nori <nsekhar@ti.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The logic of vfree()'ing vol->upd_buf is tied to vol->updating.
In ubi_start_update() vol->updating is set long before vmalloc()'ing
vol->upd_buf. If we encounter a write failure in ubi_start_update()
before vmalloc() the UBI device release function will try to vfree()
vol->upd_buf because vol->updating is set.
Fix this by allocating vol->upd_buf directly after setting vol->updating.

Fixes:
[   31.559338] UBI warning: vol_cdev_release: update of volume 2 not finished, volume is damaged
[   31.559340] ------------[ cut here ]------------
[   31.559343] WARNING: CPU: 1 PID: 2747 at mm/vmalloc.c:1446 __vunmap+0xe3/0x110()
[   31.559344] Trying to vfree() nonexistent vm area (ffffc90001f2b000)
[   31.559345] Modules linked in:
[   31.565620]  0000000000000bba ffff88002a0cbdb0 ffffffff818f0497 ffff88003b9ba148
[   31.566347]  ffff88002a0cbde0 ffffffff8156f515 ffff88003b9ba148 0000000000000bba
[   31.567073]  0000000000000000 0000000000000000 ffff88002a0cbe88 ffffffff8156c10a
[   31.567793] Call Trace:
[   31.568034]  [<ffffffff818f0497>] dump_stack+0x4e/0x7a
[   31.568510]  [<ffffffff8156f515>] ubi_io_write_vid_hdr+0x155/0x160
[   31.569084]  [<ffffffff8156c10a>] ubi_eba_write_leb+0x23a/0x870
[   31.569628]  [<ffffffff81569b36>] vol_cdev_write+0x226/0x380
[   31.570155]  [<ffffffff81179265>] vfs_write+0xb5/0x1f0
[   31.570627]  [<ffffffff81179f8a>] SyS_pwrite64+0x6a/0xa0
[   31.571123]  [<ffffffff818fde12>] system_call_fastpath+0x16/0x1b

Cc: <stable@vger.kernel.org>
Signed-off-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

If the erase worker is unable to erase a PEB it will
free the ubi_wl_entry itself.
The failing ubi_wl_entry must not free()'d again after
do_sync_erase() returns.

Cc: <stable@vger.kernel.org>
Signed-off-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

This is more a cosmetic change than a fix.
By using ubi_eba_atomic_leb_change()
we can guarantee that the first VTBL record is always
correct and we don't really need the second one anymore.
But we have to keep the second one to not break anything.

Artem: add a comment
Signed-off-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

If there is more then one UBI device mounted, there is no way to
distinguish between messages from different UBI devices.
Add device number to all ubi layer message types.

The R/O block driver messages were replaced by pr_* since
ubi_device structure is not used by it.

Amended a bit by Artem.
Signed-off-by: NTanya Brokhman <tlinder@codeaurora.org>
Signed-off-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>

Freescale's QorIQ T Series processors support 8 IFC chip selects
within a memory map backward compatible with previous P Series
processors which supported only 4 chip selects.
Signed-off-by: NAaron Sierra <asierra@xes-inc.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>