nand_do_write_ops() determines if it is writing a partial page with the
formula:
	part_pagewr = (column || writelen < (mtd->writesize - 1))

When 'writelen' is exactly 1 byte less than the NAND page size the formula
equates to zero, so the code doesn't process it as a partial write,
although it should.
As a consequence the function remains in the while(1) loop with 'writelen'
becoming 0xffffffff and iterating endlessly.

The bug may not be easy to reproduce in Linux since user space tools
usually force the padding or round-up the write size to a page-size
multiple.
This was discovered in U-Boot where the issue can be reproduced by
writing any size that is 1 byte less than a page-size multiple.
For example, on a NAND with 2K page (0x800):
	=> nand erase.part <partition>
	=> nand write $loadaddr <partition> 7ff

[Editor's note: the bug was added in commit 29072b96, but moved
around in commit 66507c7b ("mtd: nand: Add support to use nand_base
poi databuf as bounce buffer")]

Fixes: 29072b96 ("[MTD] NAND: add subpage write support")
Signed-off-by: Hector Palacios <hector.palacios@digi.com>
Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

For years now we support writing to BCMA SoC serial flash, so don't
describe this driver as providing read-only support anymore.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add support for the Cadence QSPI controller. This controller is
present in the Altera SoCFPGA SoCs and this driver has been tested
on the Cyclone V SoC.
Signed-off-by: Graham Moore <grmoore@opensource.altera.com>
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alan Tull <atull@opensource.altera.com>
Cc: Brian Norris <computersforpeace@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Dinh Nguyen <dinguyen@opensource.altera.com>
Cc: Graham Moore <grmoore@opensource.altera.com>
Cc: Vignesh R <vigneshr@ti.com>
Cc: Yves Vandervennet <yvanderv@opensource.altera.com>
Cc: devicetree@vger.kernel.org
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add binding document for the Cadence QSPI controller.
Signed-off-by: Graham Moore <grmoore@opensource.altera.com>
Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Alan Tull <atull@opensource.altera.com>
Cc: Brian Norris <computersforpeace@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: Dinh Nguyen <dinguyen@opensource.altera.com>
Cc: Graham Moore <grmoore@opensource.altera.com>
Cc: Vignesh R <vigneshr@ti.com>
Cc: Yves Vandervennet <yvanderv@opensource.altera.com>
Cc: devicetree@vger.kernel.org
Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Change the BUG_ON() condition in brcmnand_send_cmd() which checks for
the interrupt status "controller ready" bit to a WARN_ON.

There is no good reason to kill the system when this condition occur
because we could have systems which listed the NAND controller as
available (e.g: from Device Tree), but the NAND chip could be
malfunctioning and not responding.
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Kamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

There is a cut and paste issue here.  The bug is that we are allocating
more memory than necessary for msp_maps.  We should be allocating enough
space for a map_info struct (144 bytes) but we instead allocate enough
for an mtd_info struct (1840 bytes).  It's a small waste.

The other part of this is not harmful but when we allocated msp_flash
then we allocated enough space fro a map_info pointer instead of an
mtd_info pointer.  But since pointers are the same size it works out
fine.

Anyway, I decided to clean up all three allocations a bit to make them
a bit more consistent and clear.

Fixes: 68aa0fa8 ('[MTD] PMC MSP71xx flash/rootfs mappings')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

We check for NULL but then dereference "info->mtd" on the next line.

Fixes: 72169755 ('mtd: maps: sa1100-flash: show parent device in sysfs')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

This driver add support to the new Atmel QSPI controller embedded into
sama5d2x SoCs. It expects a NOR memory to be connected to the QSPI
controller.
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

In case of error, the function dma_request_chan() returns ERR_PTR() and
never returns NULL. The NULL test in the return value check should be
replaced with IS_ERR().

Fixes: aa7abd31 ('mtd: nand: omap2: Support parsing dma channel
information from DT')
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Pull NAND changes from Boris Brezillon:
"""
This pull request contains only one notable change:
* Addition of the MTK NAND controller driver

And a bunch of specific NAND driver improvements/fixes. Here are the
changes that are worth mentioning:
* A few fixes/improvements for the xway NAND controller driver
* A few fixes for the sunxi NAND controller driver
* Support for DMA in the sunxi NAND driver
* Support for the sunxi NAND controller IP embedded in A23/A33 SoCs
* Addition for bitflips detection in erased pages to the brcmnand driver
* Support for new brcmnand IPs
* Update of the OMAP-GPMC binding to support DMA channel description
"""

This patch documents the DT bindings for the driver of the Atmel QSPI
controller embedded inside sama5d2x SoCs.
Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Acked-by: Rob Herring <robh@kernel.org>
Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add hisilicon spi-nor flash controller driver
Signed-off-by: Binquan Peng <pengbinquan@hisilicon.com>
Signed-off-by: Jiancheng Xue <xuejiancheng@hisilicon.com>
Acked-by: Rob Herring <robh@kernel.org>
Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>
Reviewed-by: Jagan Teki <jteki@openedev.com>
Reviewed-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Gigadevice flash support BP{0,1,2,3,4} bits, where BP3 means the same as
the existing supported TB (Top/Bottom), and BP4 means the same as the
not-yet-supported 4K bit used on other flash (e.g., Winbond). Let's
support lock/unlock with the same feature flags as w25q32dw/w25q64dw.

Tested on gd25lq64c, but I checked datasheets for the other 3, to make
sure.

While I was at it, I noticed that these all support dual and quad as
well. I noted them, but can't test them at the moment, since my test
system only supports standard 1x SPI.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add Micron (n25q00a) 1Gbit NOR Flash in the list of supported
devices.
This part is different from n25q00 in Memory Type.
Memory Type for n25q00 - BAh
Memory Type for n25q00a - BBh
Signed-off-by: P L Sai Krishna <lakshmis@xilinx.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

This patch enables IFC NAND support on ARM layerscape platform.
It fixes the dependency to enable NAND. The include files are being modified
to ensure complilation for both PowerPC and ARM architectures.
Signed-off-by: Raghav Dogra <raghav.dogra@nxp.com>
Acked-by: Scott Wood <oss@buserror.net>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Emails will bounce from my imgtec address, so update it to a new one.
Signed-off-by: Harvey Hunt <harvey.hunt@imgtec.com>
Cc: Harvey Hunt <harveyhuntnexus@gmail.com>
Cc: linux-mtd@lists.infradead.org
Cc: linux-kernel@vger.kernel.org
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

I moved the sanity check on ecc->size before the allocation so that we
don't leak memory on error.

Fixes: 05af074a4b73 ('mtd: nand: sunxi: check ecc->size values')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

The NAND controller on some sun8i chips needs its reset line to be
deasserted before they can enter working state.
Signed-off-by: Icenowy Zheng <icenowy@aosc.xyz>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Document the reset lines
Signed-off-by: Icenowy Zheng <icenowy@aosc.xyz>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Instead of using IO_ADDR_W and IO_ADDR_R use an own pointer to the NAND
controller memory area.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

This driver needs a special write_buf and read_buf function, because we
have to read from a specific address to tell the controller this is a
read from the nand controller.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Extract the functions to read and write to the register of the NAND
flash controller.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

The external Bus Unit (EBU) can control different flash devices, but
these NAND flash commands have to be atomic and should not be
interrupted in between. Lock the EBU from the beginning of the command
till the end by moving the lock to the chip select.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

nand_scan() already resets the NAND flash chip, this driver does not
have to call it manually. The xway_reset_chip() functions does the same
as the normal NAND reset function. The waiting for the NAND_WAIT_WR_C
is done in xway_cmd_ctrl().
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

The ->cmd_ctrl() function is adjusting the ->IO_ADDR_W value depending
on the command type each time NAND_CTRL_CHANGE is passed. This is not
only useless but can lead to an ->IO_ADDR_W corruption.

Get rid of this logic and rely on the NAND_CLE and NAND_ALE flags to
deduce the iomem address to write the cmd argument to.
Signed-off-by: John Crispin <john@phrozen.org>
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Instead of hacking this into the plat_nand driver just make this a
normal nand driver.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

This adds some register documentation which should make it easier to
understand how this controller works. In addition it makes now use of
BIT() macro and adds some more defines.
Signed-off-by: Hauke Mehrtens <hauke@hauke-m.de>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Support for NAND biterrors test on platforms without raw write

While the default test mode relies on raw write (mtd_write_oob) to introduce
bit errors into a page, the rewrite test mode doesn't need it.

Changed the overwrite test to use normal writes. The default test mode
is unaffected and still requires raw write as before.
Signed-off-by: Iwo Mergler <Iwo.Mergler@netcommwireless.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Implement ecc->write_subpage() to prevent core code from assigning this
hook to nand_write_subpage_hwecc(). This default implementation tries
to call ecc->hwctl() which in our case is NULL, thus leading to a NULL
pointer dereference.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Verify that the ecc->size value is either 512 or 1024 bytes.
This should always be the case if this field was assigned to the
nand->ecc_step_size_ds value, but can be wrong when the user overloaded
this value with the nand-ecc-step-size DT property.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

Switching to 1k ECC blocks when possible provides better resistance against
concentrated bitflips. Say you have those two configurations:

1/ 16bits/512bytes
2/ 32bits/1024bytes

Both of them require the same amount of ECC bytes (only true for this
specific engine), but the second config allows you to correct the case
where most of your bitflips are concentrated in a single 512bytes portion.

This fact makes the 1k ECC block size more advantageous than the 512bytes
one.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

The column address passed to the RNDOUT operation was missing the page
size offset.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Fixes: 614049a8 ("mtd: nand: sunxi: add support for DMA assisted operations")

Add support for mediatek's SDG1 NFC nand controller embedded in SoC
2701
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Xiaolei Li <xiaolei.li@mediatek.com>

Documentation support for Smart Device Gen1 type of NAND controllers
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez-ortiz@linaro.org>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

In case of error, the function dmaengine_prep_slave_sg() returns NULL
pointer not ERR_PTR(). The IS_ERR() test in the return value check
should be replaced with NULL test.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Fixes: 614049a8 ("mtd: nand: sunxi: add support for DMA assisted operations")
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

This change provides a fix for controller bug where nand
controller could have a possible sticky error after a PIO
followed by a DMA read. The fix retries a read if we see
a uncorr_ecc after read to detect such sticky errors.
The fix applies to only controller version 7.0 and 7.1.
Signed-off-by: Kamal Dasu <kdasu.kdev@gmail.com>
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>

In stm_unlock(), the test to determine whether we've fully unlocked the
flash checks for the lock length to be equal to the flash size. That is
a typo/think-o -- the condition actually means the flash is completely
*locked.* We should be using the inverse condition -- that the lock
length is 0 (i.e., no protection).

The result of this bug is that we never actually turn off the Status
Register Write Disable bit, even if the flash is completely unlocked.
Now we can.

Fixes: 47b8edbf ("mtd: spi-nor: disallow further writes to SR if WP# is low")
Reported-by: Giorgio <giorgio.nicole@arcor.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>

This function compiles to 2554 bytes of machine code.
In C, the function is almost 200 lines long.

It has only one callsite, but forced inlining that much code
makes gcc generate significantly worse code. Let gcc itself decide
what to do.
Signed-off-by: Denys Vlasenko <dvlasenk@redhat.com>
CC: David Woodhouse <David.Woodhouse@intel.com>
CC: Dan Carpenter <dan.carpenter@oracle.com>
CC: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
CC: linux-mtd@lists.infradead.org
CC: linux-kernel@vger.kernel.org
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Replace if condition and BUG() with a BUG_ON having the conditional
expression of the if statement as argument.

The Coccinelle semantic patch used to make this change is as follows:
@@ expression E,f; @@

(
  if (<+... f(...) ...+>) { BUG(); }
|
- if (E) { BUG(); }
+ BUG_ON(E);
)
Signed-off-by: Amitoj Kaur Chawla <amitoj1606@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

drivers/mtd/maps/physmap_of.c: In function ‘of_flash_probe’:
drivers/mtd/maps/physmap_of.c:165:16: warning: variable ‘p’ set but not used [-Wunused-but-set-variable]

This could be a problem if the 'reg' property is not set, since that
means 'count' will be uninitialized.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>