Locking the flash is most useful if it provides real hardware security.
Otherwise, it's little more than a software permission bit.

A reasonable use case that provides real HW security might be like
follows:

(1) hardware WP# is deasserted
(2) program flash
(3) flash range is protected via status register
(4) hardware WP# is asserted
(5) flash protection range can no longer be changed, until WP# is
    deasserted

In this way, flash protection is co-owned by hardware and software.

Now, one would expect to be able to perform step (3) with
ioctl(MEMLOCK), except that the spi-nor driver does not set the Status
Register Protect bit (a.k.a. Status Register Write Disable (SRWD)), so
even though the range is now locked, it does not satisfy step (5) -- it
can still be changed by a call to ioctl(MEMUNLOCK).

So, let's enable status register protection after the first lock
command, and disable protection only when the flash is fully unlocked.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

There are a few different corner cases to the current logic that seem
undesirable:

* mtd_lock() with offs==0 trips a bounds issue on
  ofs - mtd->erasesize < 0

* mtd_unlock() on the middle of a flash that is already unlocked will
  return -EINVAL

* probably other corner cases

So, let's stop doing "smart" checks like "check the block below us",
let's just do the following:

(a) pass only non-negative offsets/lengths to stm_is_locked_sr()
(b) add a similar stm_is_unlocked_sr() function, so we can check if the
    *entire* range is unlocked (and not just whether some part of it is
    unlocked)

Then armed with (b), we can make lock() and unlock() much more
symmetric:

(c) short-circuit the procedure if there is no work to be done, and
(d) check the entire range above/below

This also aligns well with the structure needed for proper TB
(Top/Bottom) support.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

If, for instance, the entire flash is already unlocked and I try to
mtd_unlock() the entire device, I don't expect to see an EINVAL error.
It should just silently succeed. Ditto for mtd_lock().
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

Fixup a piece leftover by commit 32321e95 ("mtd: spi-nor: wait until
lock/unlock operations are ready"). That commit made us wait for the WIP
bit to settle after lock/unlock operations, but it missed the open-coded
"unlock" that happens at probe() time.

We should probably have this code utilize the unlock() routines in the
future, to avoid duplication, but unfortunately, flash which need to be
unlocked don't all have a proper ->flash_unlock() callback.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Cc: Stas Sergeev <stsp@users.sourceforge.net>
Reviewed-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Tested-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>

nand_bch_init() requires several arguments which could directly be deduced
from the mtd device. Get rid of those useless parameters.

nand_bch_init() is also requiring the caller to provide a proper eccbytes
value, while this value could be deduced from the ecc.size and
ecc.strength value. Fallback to eccbytes calculation when it is set to 0.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

If the MTD device does not have OOB, the mtd->oobsize and mtd->oobavail
fields are set to zero, and we are testing those values in the following
test.
Remove the useless if (!mtd->ecclayout) test.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Currently, all MTD drivers/sublayers exposing an OOB area are
doing the same kind of test to extract the available OOB size
based on the mtd_info and mtd_oob_ops structures.
Move this common logic into an inline function and make use of it.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Suggested-by: NPriit Laes <plaes@plaes.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

ecclayout->oobavail is just redundant with the mtd->oobavail field.
Moreover, it prevents static const definition of ecc layouts since the
NAND framework is calculating this value based on the ecclayout->oobfree
field.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

In commit b70af9be ("mtd: nand: increase ready wait timeout and
report timeouts"), we increased the likelihood of scheduling during
nand_wait(). This makes us more likely to hit the time_before(...)
condition, since a lot of time may pass before we get scheduled again.

Now, the loop was already buggy, since we don't check if the NAND is
ready after exiting the loop; we simply print out a timeout warning. Fix
this by doing a final status check before printing a timeout message.

This isn't actually a critical bug, since the only effect is a false
warning print. But too many prints never hurt anyone, did they? :)

Side note: perhaps I'm not smart enough, but I'm not sure what the best
policy is for this kind of loop; do we busy loop (i.e., no
cond_resched()) to keep the lowest I/O latency (it's not great if the
resched is delaying Richard's system ~400ms)? Or do we allow
rescheduling, to play nice with the rest of the system (since some
operations can take quite a while)?
Reported-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Reviewed-by: NHarvey Hunt <harvey.hunt@imgtec.com>

Fixes this warning:

>> drivers/mtd/bcm63xxpart.c:175:4: note: in expansion of macro 'pr_err'
       pr_err("invalid rootfs address: %*ph\n",
       ^
>> include/linux/kern_levels.h:4:18: warning: field width specifier '*' expects argument of type 'int', but argument 2 has type 'long unsigned int' [-Wformat=]
Reported-by: Nkbuild test robot <fengguang.wu@intel.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

ubifs uses the write buffer size in recovery algorithm. When inspecting
an unclean ubifs recovery fails with writebuf size 64 in mtdram while
recovery on actual mtd device with writebuf size of 1024 succeeds.
So add a parameter for setting this property.
Signed-off-by: NAlexander Stein <alexander.stein@systec-electronic.com>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

With this removal, we don't need to 'get' the second DMA resource
either, as it's also unused.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Acked-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add optional properties for QSPI:
big-endian
if the register is big endian on this platform.
Signed-off-by: NYuan Yao <yao.yuan@nxp.com>
Acked-by: NRob Herring <robh@kernel.org>
Acked-by: NHan xu <han.xu@nxp.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

new compatible string: "fsl,ls2080a-qspi".
Signed-off-by: NYuan Yao <yao.yuan@nxp.com>
Acked-by: NRob Herring <robh@kernel.org>
Acked-by: NHan xu <han.xu@nxp.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

LS1043a and LS2080A in the Layerscape family also support Freescale Quad
SPI, make Quad SPI selectable for these hardwares.
Signed-off-by: NYuan Yao <yao.yuan@nxp.com>
Acked-by: NHan xu <han.xu@nxp.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

LS1021a also support Freescale Quad SPI controller.
Add fsl-quadspi support for ls1021a chip and make SPI_FSL_QUADSPI
selectable for LS1021A SOC hardwares.
Signed-off-by: NYuan Yao <yao.yuan@nxp.com>
Acked-by: NHan xu <han.xu@freescale.com>
Acked-by: NHan xu <han.xu@nxp.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add R/W functions for big- or little-endian registers:
The qSPI controller's endian is independent of the CPU core's endian.
So far, the qSPI have two versions for big-endian and little-endian.
Signed-off-by: NYuan Yao <yao.yuan@nxp.com>
Acked-by: NHan xu <han.xu@freescale.com>
Acked-by: NHan xu <han.xu@nxp.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Micron n25q128axx support subsector (4K) erase so let's update the flags.
Tested on n25q128a13.
Signed-off-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

When the driver is initialized in a pure device-tree platform, the
driver's probe fails allocating the dma channel :
[  525.624435] pxa3xx-nand 43100000.nand: no resource defined for data DMA
[  525.632088] pxa3xx-nand 43100000.nand: alloc nand resource failed

The reason is that the DMA IO resource is not acquired through platform
resources but by OF bindings.

Fix this by ensuring that DMA IO resources are only queried in the non
device-tree case.

Fixes: 8f5ba31a ("mtd: nand: pxa3xx-nand: switch to dmaengine")
Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Acked-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

mtd->priv is no longer pointing to the struct nand_chip it is attached to.
Replace those accesses by mtd_to_nand() calls.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 4be4e03e ("mtd: nand: sunxi: add randomizer support")
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

We need to finish doing the CRC checks before we can allow writes to
happen, and we currently process the inodes in order. This means a call
to jffs2_get_ino_cache() for each possible inode# up to c->highest_ino.

There may be a lot of lookups which fail, if the inode# space is used
sparsely. And the inode# space is *often* used sparsely, if a file
system contains a lot of stuff that was put there in the original
image, followed by lots of creation and deletion of new files.

Instead of processing them numerically with a lookup each time, just
walk the hash buckets instead.

[fix locking typo reported by Dan Carpenter]
Signed-off-by: NDavid Woodhouse <David.Woodhouse@intel.com>

The BRCMNAND controller revision 7.1 is almost 100% compatible with the
previous v6.0 register offset layout, except for the Correctable Error
Reporting Threshold registers. Fix this by adding another table with the
correct offsets for CORR_THRESHOLD and CORR_THRESHOLD_EXT.

Fixes: 27c5b17c ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: NFlorian Fainelli <f.fainelli@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Commit 5942ddbc ("mtd: introduce mtd_block_markbad interface")
incorrectly changed onenand_block_markbad() to call mtd_block_markbad
instead of onenand_chip's block_markbad function. As a result the function
will now recurse and deadlock. Fix by reverting the change.

Fixes: 5942ddbc ("mtd: introduce mtd_block_markbad interface")
Signed-off-by: NAaro Koskinen <aaro.koskinen@iki.fi>
Acked-by: NArtem Bityutskiy <artem.bityutskiy@linux.intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This patch remove the micron_quad_enable() function which force the Quad
SPI mode. However, once this mode is enabled, the Micron memory expect ALL
commands to use the SPI 4-4-4 protocol. Hence a failure does occur when
calling spi_nor_wait_till_ready() right after the update of the Enhanced
Volatile Configuration Register (EVCR) in the micron_quad_enable() as
the SPI controller driver is not aware about the protocol change.

Since there is almost no performance increase using Fast Read 4-4-4
commands instead of Fast Read 1-1-4 commands, we rather keep on using the
Extended SPI mode than enabling the Quad SPI mode.

Let's take the example of the pretty standard use of 8 dummy cycles during
Fast Read operations on 64KB erase sectors:

Fast Read 1-1-4 requires 8 cycles for the command, then 24 cycles for the
3byte address followed by 8 dummy clock cycles and finally 65536*2 cycles
for the read data; so 131112 clock cycles.

On the other hand the Fast Read 4-4-4 would require 2 cycles for the
command, then 6 cycles for the 3byte address followed by 8 dummy clock
cycles and finally 65536*2 cycles for the read data. So 131088 clock
cycles. The theorical bandwidth increase is 0.0%.

Now using Fast Read operations on 512byte pages:
Fast Read 1-1-4 needs 8+24+8+(512*2) = 1064 clock cycles whereas Fast
Read 4-4-4 would requires 2+6+8+(512*2) = 1040 clock cycles. Hence the
theorical bandwidth increase is 2.3%.
Consecutive reads for non sequential pages is not a relevant use case so
The Quad SPI mode is not worth it.

mtd_speedtest seems to confirm these figures.
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@atmel.com>
Fixes: 548cd3ab ("mtd: spi-nor: Add quad I/O support for Micron SPI NOR")
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The Spansion s25fl116k is a 16MBit NOR Flash supporting dual and
quad read operations.
Signed-off-by: NSascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

This commit is needed to properly support the 8-bits ECC configuration
with 4KB pages.

When pages larger than 2 KB are used on platforms using the PXA3xx
NAND controller, the reading/programming operations need to be split
in chunks of 2 KBs or less because the controller FIFO is limited to
about 2 KB (i.e a bit more than 2 KB to accommodate OOB data). Due to
this requirement, the data layout on NAND is a bit strange, with ECC
interleaved with data, at the end of each chunk.

When a 4-bits ECC configuration is used with 4 KB pages, the physical
data layout on the NAND looks like this:

| 2048 data | 32 spare | 30 ECC | 2048 data | 32 spare | 30 ECC |

So the data chunks have an equal size, 2080 bytes for each chunk,
which the driver supports properly.

When a 8-bits ECC configuration is used with 4KB pages, the physical
data layout on the NAND looks like this:

| 1024 data | 30 ECC | 1024 data | 30 ECC | 1024 data | 30 ECC | 1024 data | 30 ECC | 64 spare | 30 ECC |

So, the spare area is stored in its own chunk, which has a different
size than the other chunks. Since OOB is not used by UBIFS, the initial
implementation of the driver has chosen to not support reading this
additional "spare" chunk of data.

Unfortunately, Marvell has chosen to store the BBT signature in the
OOB area. Therefore, if the driver doesn't read this spare area, Linux
has no way of finding the BBT. It thinks there is no BBT, and rewrites
one, which U-Boot does not recognize, causing compatibility problems
between the bootloader and the kernel in terms of NAND usage.

To fix this, this commit implements the support for reading a partial
last chunk. This support is currently only useful for the case of 8
bits ECC with 4 KB pages, but it will be useful in the future to
enable other configurations such as 12 bits and 16 bits ECC with 4 KB
pages, or 8 bits ECC with 8 KB pages, etc. All those configurations
have a "last" chunk that doesn't have the same size as the other
chunks.

In order to implement reading of the last chunk, this commit:

 - Adds a number of new fields to the pxa3xx_nand_info to describe how
   many full chunks and how many chunks we have, the size of full
   chunks and partial chunks, both in terms of data area and spare
   area.

 - Fills in the step_chunk_size and step_spare_size variables to
   describe how much data and spare should be read/written for the
   current read/program step.

 - Reworks the state machine to accommodate doing the additional read
   or program step when a last partial chunk is used.

This commit has been tested on a Marvell Armada 398 DB board, with a
4KB page NAND, tested in both 4 bits ECC and 8 bits ECC
configurations. Robert Jarzmik has tested on some PXA platforms.
Signed-off-by: NThomas Petazzoni <thomas.petazzoni@free-electrons.com>
Tested-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Acked-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

As of commit 876fe76d
"mtd: maps: physmap: Add reference counter to set_vpp()"
the comment in the header file is incorrect and misleading.
Fix it up.

Cc: Russell King <linux@arm.linux.org.uk>
Cc: Paul Parsons <lost.distance@yahoo.com>
Fixes: 876fe76d ("mtd: maps: physmap: Add reference counter to set_vpp()")
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Move the NOR flash layout to a separate function to allow the NAND flash
layout to be supported.
Signed-off-by: NSimon Arlott <simon@fire.lp0.eu>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Strings read from flash could be missing null termination characters, or
not contain valid integers.

Null terminate the strings and check for errors when converting them to
integers.

Also validate that the addresses are at least BCM963XX_EXTENDED_SIZE
because this will be subtracted from them.
Signed-off-by: NSimon Arlott <simon@fire.lp0.eu>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Extract image tag reading and CRC check to a separate function.
Signed-off-by: NSimon Arlott <simon@fire.lp0.eu>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Read nvram directly from flash instead of using the in-memory copy that
mach-bcm63xx has, to remove the dependency on mach-bcm63xx and allow the
parser to work on bmips too.

Rename remaining BCM63XX defines to BCM963XX as these are properties of
the flash layout on the board.

BCM963XX_DEFAULT_PSI_SIZE changes from SZ_64K to 64 because it will be
multiplied by SZ_1K later on.
Signed-off-by: NSimon Arlott <simon@fire.lp0.eu>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

As the SAMA5D2 controller supports the 32-bit ECC strength, accept it
as a valid setting when required by the device tree or the NAND
parameter page.

Then configure the controller to use this new setting.

For the binding:
Acked-by: NRob Herring <robh@kernel.org>
Signed-off-by: NRomain Izard <romain.izard.pro@gmail.com>
Tested-by: NWenyou Yang <wenyou.yang@atmel.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Starting with the SAMA5D2, there is a new revision of the Atmel PMECC
controller that can correct 32 bits in each sector. This controller is
not 100% compatible with the previous revision that corrected a maximum
of 24 bits by sector, as some register addresses overlap.

Using information from the device tree, we can configure the driver to
work with both versions.

For the binding:
Acked-by: NRob Herring <robh@kernel.org>
Tested-by: NWenyou Yang <wenyou.yang@atmel.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NRomain Izard <romain.izard.pro@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Do not mention which chips supporting the PMECC controller, as it a
duplicate of the information in the chips' device trees.

Use common terms when describing the sub-node for the NAND Flash
controller.
Acked-by: NRob Herring <robh@kernel.org>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NRomain Izard <romain.izard.pro@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The NFC controller used to accelerate the NAND transfers on SAMA5 chips
can use either RB_EDGE0 or RB_EDGE3 as its ready/busy interrupt bit.

Use the controller's compatible string to select the correct bit.

For the binding:
Acked-by: NRob Herring <robh@kernel.org>
Reviewed-by: NWenyou Yang <Wenyou.yang@atmel.com>
Tested-by: NWenyou Yang <wenyou.yang@atmel.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: NRomain Izard <romain.izard.pro@gmail.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Replacing the NO_IRQ macro with 0. If there is no interrupt,
returned value will be 0 regardless of what NO_IRQ is defined.
Signed-off-by: NRaghav Dogra <raghav@freescale.com>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Add verbose debug for register accesses. This enables easier debugging
by following where and how hardware is stimulated, and how it answers.
Signed-off-by: NRobert Jarzmik <robert.jarzmik@free.fr>
Acked-by: NEzequiel Garcia <ezequiel@vanguardiasur.com.ar>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Not every arch has io memory nor can this driver ever work
on UML/i386.
So, unbreak the build by fixing the dependencies.
Signed-off-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

Not every arch has io memory.
So, unbreak the build by fixing the dependencies.
Signed-off-by: NRichard Weinberger <richard@nod.at>
Acked-by: NGeert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>

The NAND core layer is already taking care of ecclayout propagation. Remove
this useless assignment.
Signed-off-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: NStefan Agner <stefan@agner.ch>
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>