NAND chips require a bit of time to take the NAND operation into
account and set the BUSY bit in the STATUS reg. Make sure we don't poll
the STATUS reg too early in nand_soft_waitrdy().

Fixes: 8878b126 ("mtd: nand: add ->exec_op() implementation")
Cc: <stable@vger.kernel.org>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Acked-by: NMiquel Raynal <miquel.raynal@bootlin.com>

One layout supported by the Marvell NAND controller supports NAND pages
of 2048 bytes, all handled in one single chunk when using BCH with a
strength of 4-bit per 512 bytes. In this case, instead of the generic
XTYPE_WRITE_DISPATCH/XTYPE_LAST_NAKED_RW couple, the controller expects
to receive XTYPE_MONOLITHIC_RW.

This fixes problems at boot like:

[    1.315475] Scanning device for bad blocks
[    3.203108] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    3.209564] nand_bbt: error while writing BBT block -110
[    4.243106] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    5.283106] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    5.289562] nand_bbt: error -110 while marking block 2047 bad
[    6.323106] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    6.329559] nand_bbt: error while writing BBT block -110
[    7.363106] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    8.403105] marvell-nfc f10d0000.flash: Timeout waiting for RB signal
[    8.409559] nand_bbt: error -110 while marking block 2046 bad
...

Fixes: 02f26ecf ("mtd: nand: add reworked Marvell NAND controller driver")
Cc: stable@vger.kernel.org
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Tested-by: NChris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

marvell_nfc_wait_op() expects the delay to be expressed in milliseconds
but nand_sdr_timings uses picoseconds. Use PSEC_TO_MSEC when passing
tPROG_max to marvell_nfc_wait_op().

Fixes: 02f26ecf ("mtd: nand: add reworked Marvell NAND controller driver")
Cc: stable@vger.kernel.org
Signed-off-by: NChris Packham <chris.packham@alliedtelesis.co.nz>
Reviewed-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

dma_map_single does not work for vmalloc-ed buffers,
so disable DMA in this case.
Signed-off-by: NLadislav Michl <ladis@linux-mips.org>
Reported-by: N"H. Nikolaus Schaller" <hns@goldelico.com>
Tested-by: N"H. Nikolaus Schaller" <hns@goldelico.com>
Reviewed-by: NPeter Ujfalusi <peter.ujfalusi@ti.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

The block responsible of parsing the DT for the number of chip-select
lines uses an 'if/else if/else if' block. The content of the second and
third 'else if' conditions are:
        1/ the actual condition to enter the sub-block and
        2/ the operation to do in this sub-block.

        [...]
        else if (condition1_to_enter && action1() == failed)
                raise_error();
        else if (condition2_to_enter && action2() == failed)
                raise_error();
        [...]

In case of failure, the sub-block is entered and an error raised.
Otherwise, in case of success, the code would continue erroneously in
the next 'else if' statement because it did not failed (and did not
enter the first 'else if' sub-block).

The first 'else if' refers to legacy bindings while the second 'else if'
refers to new bindings. The second 'else if', which is entered
erroneously, checks for the 'reg' property, which, for old bindings,
does not mean anything because it would not be the number of CS
available, but the regular register map of almost any DT node. This
being said, the content of the 'reg' property being the register map
offset and length, it has '2' values, so the number of CS in this
situation is assumed to be '2'.

When running nand_scan_ident() with 2 CS, the core will check for an
array of chips. It will first issue a RESET and then a READ_ID. Of
course this will trigger two timeouts because there is no chip in front
of the second CS:

[    1.367460] marvell-nfc f2720000.nand: Timeout on CMDD (NDSR: 0x00000080)
[    1.474292] marvell-nfc f2720000.nand: Timeout on CMDD (NDSR: 0x00000280)

Indeed, this is harmless and the core will then assume there is only one
valid CS.

Fix the logic in the whole block by entering each sub-block just on the
'is legacy' condition, doing the action inside the sub-block. This way,
when the action succeeds, the whole block is left.

Furthermore, for both the old bindings and the new bindings the same
logic was applied to retrieve the number of CS lines:
using of_get_property() to get a size in bytes, converted in the actual
number of lines by dividing it per sizeof(u32) (4 bytes).

This is fine for the 'reg' property which is a list of the CS IDs but
not for the 'num-cs' property which is directly the value of the number
of CS.

Anyway, no existing DT uses another value than 'num-cs = <1>' and no
other value has ever been supported by the old driver (pxa3xx_nand.c).
Remove this condition and apply a number of 1 CS anyway, as already
described in the bindings.

Finally, the 'reg' property of a 'nand' node (with the new bindings)
gives the IDs of each CS line in use. marvell_nand.c driver first look
at the number of CS lines that are present in this property.

Better use of_property_count_elems_of_size() than dividing by 4 the size
of the number of bytes returned by of_get_property().

Fixes: 02f26ecf ("mtd: nand: add reworked Marvell NAND controller driver")
Cc: stable@vger.kernel.org
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Tested-by: NChris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Currently it is possible to read and/or write to suspend EB's.
Writing /dev/mtdX or /dev/mtdblockX from several processes may
break the flash state machine.

Taken from cfi_cmdset_0001 driver.
Signed-off-by: NJoakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Some Micron chips does not work well wrt Erase suspend for
boot blocks. This avoids the issue by not allowing Erase suspend
for the boot blocks for the 28F00AP30(1GBit) chip.
Signed-off-by: NJoakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Currently it is possible to read and/or write to suspend EB's.
Writing /dev/mtdX or /dev/mtdblockX from several processes may
break the flash state machine.
Signed-off-by: NJoakim Tjernlund <joakim.tjernlund@infinera.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

The current Cadence QSPI driver caused a kernel panic when loading
a Root Filesystem from QSPI. The problem was caused by reading more
bytes than needed because the QSPI operated on 4 bytes at a time.
<snip>
[    7.947754] spi_nor_read[1048]:from 0x037cad74, len 1 [bfe07fff]
[    7.956247] cqspi_read[910]:offset 0x58502516, buffer=bfe07fff
[    7.956247]
[    7.966046] Unable to handle kernel paging request at virtual
address bfe08002
[    7.973239] pgd = eebfc000
[    7.975931] [bfe08002] *pgd=2fffb811, *pte=00000000, *ppte=00000000
</snip>
Notice above how only 1 byte needed to be read but by reading 4 bytes
into the end of a mapped page, an unrecoverable page fault occurred.

This patch uses a temporary buffer to hold the 4 bytes read and then
copies only the bytes required into the buffer. A min() function is
used to limit the length to prevent buffer overflows.

Request testing of this patch on other platforms. This was tested
on the Intel Arria10 SoCFPGA DevKit.

Fixes: 0cf17256 ("mtd: spi-nor: cqspi: Fix build on arches missing readsl/writesl")
Signed-off-by: NThor Thayer <thor.thayer@linux.intel.com>
Cc: <stable@vger.kernel.org>
Reviewed-by: NMarek Vasut <marek.vasut@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Commit e7bfb3fd ("mtd: Stop updating erase_info->state and calling
mtd_erase_callback()") removed the einfo->state field and the
MTD_ERASE_XXX macros. At the same time, the generic NAND layer was added
and made sure to update the erase info state.

It did not result in a build failure after merging the nand/for-4.17
branch in mtd/next because the generic NAND layer is not selected yet.
Let's fix that before a config option starts selecting MTD_NAND_CORE.

Fixes: e7bfb3fd ("mtd: Stop updating erase_info->state and calling mtd_erase_callback()")
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Use devm_clk_get() to let Linux manage struct clk memory.

Fixes: 6956e238 ("add tango NAND flash controller support")
Cc: stable@vger.kernel.org
Reported-by: NXidong Wang <wangxidong_97@163.com>
Signed-off-by: NMarc Gonzalez <marc_gonzalez@sigmadesigns.com>
Reviewed-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

While UBI and UBIFS seem to work at first sight with MLC NAND, you will
most likely lose all your data upon a power-cut or due to read/write
disturb.
In order to protect users from bad surprises, refuse to attach to MLC
NAND.

Cc: stable@vger.kernel.org
Signed-off-by: NRichard Weinberger <richard@nod.at>
Acked-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Acked-by: NArtem Bityutskiy <dedekind1@gmail.com>

When opening a device with write access, ubiblock_open returns an error
code. Currently, this error code is -EPERM, but this is not the right
value.

The open function for other block devices returns -EROFS when opening
read-only devices with FMODE_WRITE set. When used with dm-verity, the
veritysetup userspace tool is expecting EROFS, and refuses to use the
ubiblock device.

Use -EROFS for ubiblock as well. As a result, veritysetup accepts the
ubiblock device as valid.

Cc: stable@vger.kernel.org
Fixes: 9d54c8a3 (UBI: R/O block driver on top of UBI volumes)
Signed-off-by: NRomain Izard <romain.izard.pro@gmail.com>
Signed-off-by: NRichard Weinberger <richard@nod.at>

At this point UBI volumes have already been free()'ed and fastmap can no
longer access these data structures.
Reported-by: NMartin Townsend <mtownsend1973@gmail.com>
Fixes: 74cdaf24 ("UBI: Fastmap: Fix memory leaks while closing the WL sub-system")
Cc: stable@vger.kernel.org
Signed-off-by: NRichard Weinberger <richard@nod.at>

Currently on a imx6sx-sdb board, which has two SPI NOR chips connected
to QSPI2 the following output from /proc/mtd is seen:

dev:    size   erasesize  name
mtd0: 01000000 00010000 "21e4000.qspi"
mtd1: 01000000 00010000 "21e4000.qspi"

Attempts to partition them on the kernel command line result in both
chips with identical (and identically named) partitions, which is
an inconvenient behavior.

Assign a different mtd->name for each mtd device to avoid this problem.

After this change the output from /proc/mtd becomes:

dev:    size   erasesize  name
mtd0: 01000000 00010000 "21e4000.qspi-0"
mtd1: 01000000 00010000 "21e4000.qspi-1"

In order to keep mtdparts compatibility keep the mtd->name
unchanged when a single SPI NOR is present.
Reported-by: NDavid Wolfe <david.wolfe@nxp.com>
Signed-off-by: NFabio Estevam <fabio.estevam@nxp.com>
Reviewed-by: NBoris Brezillon <boris.brezillon@free-electrons.com>
Acked-by: NHan Xu <han.xu@nxp.com>
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@wedev4u.fr>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

In core.c, some function descriptions do not match function
definitions. Just fix these mismatches.
Signed-off-by: NXiaolei Li <xiaolei.li@mediatek.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

It turns out that the loop where we read manufacturer
jedec_read_mfd() can under some circumstances get a
CFI_MFR_CONTINUATION repeatedly, making the loop go
over all banks and eventually hit the end of the
map and crash because of an access violation:

Unable to handle kernel paging request at virtual address c4980000
pgd = (ptrval)
[c4980000] *pgd=03808811, *pte=00000000, *ppte=00000000
Internal error: Oops: 7 [#1] PREEMPT ARM
CPU: 0 PID: 1 Comm: swapper Not tainted 4.16.0-rc1+ #150
Hardware name: Gemini (Device Tree)
PC is at jedec_probe_chip+0x6ec/0xcd0
LR is at 0x4
pc : [<c03a2bf4>]    lr : [<00000004>]    psr: 60000013
sp : c382dd18  ip : 0000ffff  fp : 00000000
r10: c0626388  r9 : 00020000  r8 : c0626340
r7 : 00000000  r6 : 00000001  r5 : c3a71afc  r4 : c382dd70
r3 : 00000001  r2 : c4900000  r1 : 00000002  r0 : 00080000
Flags: nZCv  IRQs on  FIQs on  Mode SVC_32  ISA ARM  Segment none
Control: 0000397f  Table: 00004000  DAC: 00000053
Process swapper (pid: 1, stack limit = 0x(ptrval))

Fix this by breaking the loop with a return 0 if
the offset exceeds the map size.

Fixes: 5c9c11e1 ("[MTD] [NOR] Add support for flash chips with ID in bank other than 0")
Cc: <stable@vger.kernel.org>
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

get_sectorsize() was not using the appropriate macro to extract the
ECC sector size from the config cache, which led to buggy ECC when
using 1024 byte sectors.

Fixes: f88fc122 ("mtd: nand: Cleanup/rework the atmel_nand driver")
Cc: <stable@vger.kernel.org>
Reported-by: NOlivier Schonken <olivier.schonken@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Acked-by: NNicolas Ferre <nicolas.ferre@microchip.com>
Tested-by: NOlivier Schonken <olivier.schonken@gmail.com>

platform_driver_register() takes care of assigning driver->bus
to &platform_bus_type, no need to explicitly assign it in the driver.
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Acked-by: NHan Xu <han.xu@nxp.com>
Signed-off-by: NCyrille Pitchen <cyrille.pitchen@wedev4u.fr>

The core clock field was badly named ->ecc_clk which might lead to some
confusion. Rename it ->core_clk.
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Acked-by: NMiquel Raynal <miquel.raynal@bootlin.com>

Prepare the migration of the lpc32xx_slc driver to use nand_scan() by
cleaning the error path in the probe function.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_parse_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_parse_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_parse_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_parse_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_parse_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

An error after nand_scan_tail() should trigger a nand_cleanup().
The helper mtd_device_register() returns an error code that should
be checked and nand_cleanup() called accordingly.
Signed-off-by: NMiquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

This mode is not used by any existing setup and should not be used
because it overwrites the BBMs. Let's just remove it before someone
starts using it.
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>
Acked-by: NMaxime Ripard <maxime.ripard@bootlin.com>
Tested-by: NMiquel Raynal <miquel.raynal@bootlin.com>

On Armada 7K/8K we need to explicitly enable the register clock. This
clock is optional because not all the SoCs using this IP need it but at
least for Armada 7K/8K it is actually mandatory.

The binding documentation is updated accordingly.
Signed-off-by: NGregory CLEMENT <gregory.clement@bootlin.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

The kernel.h macro DIV_ROUND_UP performs the computation
(((n) + (d) - 1) / (d)) but is perhaps more readable.
Signed-off-by: NArushi Singhal <arushisinghal19971997@gmail.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

In mtdcore.c, some function descriptions do not match function
definitions. Just fix these mismatches.
Signed-off-by: NXiaolei Li <xiaolei.li@mediatek.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

It is not necessary for all device's maps to be CFI_HOST_ENDIAN.
Maps device can be Big endian or little endian.

Currently it is being taken care using CONFIG_MTD_CFI_LE_BYTE_SWAP or
CONFIG_MTD_CFI_BE_BYTE_SWAP i.e. compile time.

Now update struct map_info's swap field based on device characteristics
defined in device tree.
Signed-off-by: NJagdish Gediya <jagdish.gediya@nxp.com>
Signed-off-by: NPrabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

In the commit 2c77c57d ("mtd: move code adding master MTD out of
mtd_add_device_partitions()") behavior of mtd_device_parse_register()
has very slightly changed. It's a pretty non-significant order change
to match updated function behavior.
Signed-off-by: NRafał Miłecki <rafal@milecki.pl>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

This adds the JEDEC IDs for Eon EN29LV400A variants
EN29LV400AB and EN29LV400AT. This chip is found in the
D-Link DNS-313.
Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

This allows using this parser with any flash driver that takes care of
setting of_node (using mtd_set_of_node helper) correctly. Up to now
support for "fixed-partitions" DT compatibility string was working only
with flash drivers that were specifying "ofpart" (manually or by letting
mtd use the default set of parsers).

This matches existing bindings documentation.
Signed-off-by: NRafał Miłecki <rafal@milecki.pl>
Reviewed-by: NBrian Norris <computersforpeace@gmail.com>
Tested-by: NBrian Norris <computersforpeace@gmail.com>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Type "ofpart" means that OF should be used to get partitioning info and
this driver supports "fixed-partitions" binding only. Renaming it should
lead to less confusion especially when parsers for new compatibility
strings start to appear.
Signed-off-by: NRafał Miłecki <rafal@milecki.pl>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

In order to properly support compatibility strings as described in the
bindings/mtd/partition.txt "ofpart" type should be treated as an
indication for looking into OF. MTD should check "compatible" property
and search for a matching parser rather than blindly trying the one
supporting "fixed-partitions".

It also means that existing "fixed-partitions" parser should get renamed
to use a more meaningful name.

This commit achievies that aim by introducing a new mtd_part_of_parse().
It works by looking for a matching parser for every string in the
"compatibility" property (starting with the most specific one).

Please note that driver-specified parsers still take a precedence. It's
assumed that driver providing a parser type has a good reason for that
(e.g. having platform data with device-specific info). Also doing
otherwise could break existing setups. The same applies to using default
parsers (including "cmdlinepart") as some overwrite DT data with cmdline
argument.

Partition parsers can now provide an of_match_table to enable
flash<-->parser matching via device tree as documented in the
mtd/partition.txt.

This support is currently limited to built-in parsers as it uses
request_module() and friends. This should be sufficient for most cases
though as compiling parsers as modules isn't a common choice.
Signed-off-by: NBrian Norris <computersforpeace@gmail.com>
Signed-off-by: NRafał Miłecki <rafal@milecki.pl>
Tested-by: NPeter Rosin <peda@axentia.se>
Reviewed-by: NRichard Weinberger <richard@nod.at>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>

Due to missing information in Hardware manual, current
implementation doesn't read ECCSTAT0 and ECCSTAT1 registers
for IFC 2.0.

Add support to read ECCSTAT0 and ECCSTAT1 registers during
ecccheck for IFC 2.0.

Fixes: 65644147 ("mtd: nand: ifc: Fix location of eccstat registers for IFC V1.0")
Cc: stable@vger.kernel.org # v3.18+
Signed-off-by: NJagdish Gediya <jagdish.gediya@nxp.com>
Reviewed-by: NPrabhakar Kushwaha <prabhakar.kushwaha@nxp.com>
Signed-off-by: NBoris Brezillon <boris.brezillon@bootlin.com>