On device remove, when testing the cmtd field of an of_flash
struct to decide whether it is a concatenated device or not,
we get a false positive on cmtd == NULL, and dereference it
subsequently. This may occur if of_flash_remove() is called
from the cleanup path of of_flash_probe().

Instead, test for NULL first, and only then perform the test
for a concatenated device.
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

This will allow spi-nor users to plainly use JEDEC to detect flash chip.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Implement raw OOB access functions to retrieve OOB bytes when accessing the
NAND in raw mode.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Several MTD users (either in user or kernel space) expect a valid raw
access support to NAND chip devices.
This is particularly true for testing tools which are often touching the
data stored in a NAND chip in raw mode to artificially generate errors.

The GPMI drivers do not implemenent raw access functions, and thus rely on
default HW_ECC scheme implementation.
The default implementation consider the data and OOB area as properly
separated in their respective NAND section, which is not true for the GPMI
controller.
In this driver/controller some OOB data are stored at the beginning of the
NAND data area (these data are called metadata in the driver), then ECC
bytes are interleaved with data chunk (which is similar to the
HW_ECC_SYNDROME scheme), and eventually the remaining bytes are used as
OOB data.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add a new function to copy bits (not bytes) from a memory region to
another one.
This function is similar to memcpy except it acts at bit level.
It is needed to implement GPMI raw access functions and adapt to the
hardware ECC engine which does not pad ECC bits to the next byte boundary.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Tested-by: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

write_enable() was being duplicated to both m25p80.c and fsl-quadspi.c.
But this should be handled within the spi-nor abstraction layer.

At the same time, let's add write_disable() after erasing, so we don't
leave the flash in a write-enabled state afterward.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Huang Shijie <shijie.huang@intel.com>

We need to store the six bytes ID for s25fl128s, since it shares the same
five bytes with s25fl129p1.

This patch adds a macro INFO6 which is used for the six bytes ID flash, and adds
a new item for the s25fl128s.
Signed-off-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

The "id" array contains all the information about the JEDEC and the
manufacturer ID info. This patch removes the jedec_id/ext_id from
flash_info.
Signed-off-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

This patch adds the id/id_len fields for flash_info{}, and rewrite the
INFO to fill them. And at last, we read out 6 bytes in the spi_nor_read_id(),
and we use these new fields to parse out the correct flash_info.
Signed-off-by: Huang Shijie <shijie.huang@intel.com>
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Cc: David Woodhouse <dwmw2@infradead.org>
Cc: linux-mtd@lists.infradead.org
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

There is no need to use memcpy32_toio/memcpy32_fromio to transfer data
between memory and NFC sram. As the NFC sram is a also a memory space
not an I/O space, we can just use memcpy().

We remove the __iomem prefix for NFC sram to avoid sparse warnings.
Signed-off-by: Josh Wu <josh.wu@atmel.com>
Reviewed-by: Brian Norris <computersforpeace@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

This write_page() function is functionally equivalent to the default in
nand_base.c. Its only difference is in subpage programming support,
which cafe_nand.c does not advertise, so the difference is negligible.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Signed-off-by: Knut Wohlrab <knut.wohlrab@de.bosch.com>
Signed-off-by: Alison Chaiken <alison_chaiken@mentor.com>
Reviewed-by: Jagannadha Sutradharudu Teki <jagannadh.teki@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

As stated in a5b7616c, "mtd: m25p80,spi-nor: Fix module aliases for
m25p80", m25p_ids[] in m25p80.c needs to be kept in sync with
spi_nor_ids[] in spi-nor.c. The change here corrects a misalignment.

(We were missing m25px80 and we had a duplicate w25q128.)
Signed-off-by: Alison Chaiken <alison_chaiken@mentor.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: <stable@vger.kernel.org> # 3.18+

There are a few small issues with the timeout loop in
spi_nor_wait_till_ready():

 * The first operation should not be a reschedule; we should check the
   status register at least once to see if we're complete!

 * We should check the status register one last time after declaring the
   deadline has passed, to prevent a premature timeout error (this is
   theoretically possible if we sleep for a long time after the previous
   status register check).

 * Add an error message, so it's obvious if we ever hit a timeout.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Acked-by: Huang Shijie <shijie.huang@intel.com>
Reviewed-by: Ezequiel Garcia <ezequiel@vanguardiasur.com.ar>

The functions kfree() and pci_dev_put() test whether their argument is NULL
and then return immediately. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

3430LDP has NAND flash with 32 bytes OOB size which is sufficient to hold
BCH8 codes but the small page check introduced in
commit b491da72 ("mtd: nand: omap: clean-up ecc layout for BCH ecc schemes")
considers anything below 64 bytes unsuitable for BCH4/8/16. There is another
bug in that code where it doesn't skip the check for OMAP_ECC_HAM1_CODE_SW.

Get rid of that small page check code as it is insufficient and redundant
because we are checking for OOB available bytes vs ecc layout before calling
nand_scan_tail().

Fixes: b491da72 ("mtd: nand: omap: clean-up ecc layout for BCH ecc schemes")
Reported-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Tested with ATO AFND1G08U3, 128MiB NAND.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

It may be useful info, e.g. if someone wants to use ubinize.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Fixes warning:

   drivers/mtd/tests/oobtest.c: In function 'memcmpshow':
   drivers/mtd/tests/oobtest.c:129: warning: format '%x' expects type 'unsigned int', but argument 3 has type 'size_t'
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Roger Quadros <rogerq@ti.com>
Cc: Sekhar Nori <nsekhar@ti.com>

read_page_raw and write_page_raw method description is not clear enough.
It clearly specifies that ECC correction should not be involved but does
not talk about specific layout (by layout I mean where in-band and
out-of-band data are stored on the NAND media) used by NAND/ECC
controllers.

Those specific layouts might impact MTD users and thus should be hidden (as
already done in the standard NAND_ECC_HW_SYNDROME implementation).

Clearly state this constraint in the nand_ecc_ctrl struct documentation.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

It is common for NAND devices to have bitflip errors.
Add a bitflip_limit parameter to specify how many bitflips per
page we can tolerate without flagging an error.
By default zero bitflips are tolerated.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add a function memcmpshow() that compares the 2 data buffers
and shows the address:offset and data bytes on comparison failure.
This function  does not break at a comparison failure but runs the
check for the whole data buffer.

Use memcmpshow() instead of memcmp() for all the verification paths.
Signed-off-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Freescale's QorIQ T Series processors support 8 IFC chip selects
within a memory map backward compatible with previous P Series
processors which supported only 4 chip selects.
Signed-off-by: Aaron Sierra <asierra@xes-inc.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

If there is no PMECC lookup table stored in ROM, or lookup table offset is
not specified, PMECC driver should build it in DDR by itself.

That make the PMECC driver work for some board which doesn't have PMECC
lookup table in ROM.

The PMECC use the BCH algorithm, so based on the build_gf_tables()
function in lib/bch.c, we can build the Galois Field lookup table.

For more information can refer to section 5.4 of PMECC controller
application note:
	http://www.atmel.com/images/doc11127.pdfSigned-off-by: Josh Wu <josh.wu@atmel.com>
Cc: devicetree@vger.kernel.org
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

The driver was also using own method to do 32bit copy, turns out
we have a kernel API so use that instead
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

The ->PUtable[] array has "->nb_blocks" number of elemetns so this
comparison should be ">=" instead of ">".  Otherwise it could result in
a minor read beyond the end of an array.
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Add sst25wf080 to the spi-nor device id table.
Signed-off-by: Harini Katakam <harinik@xilinx.com>
Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Tested with this particular FRAM chip
Signed-off-by: Rostislav Lisovy <lisovy@merica.cz>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

The AM335x Technical Reference Manual (spruh73j.pdf) says
"Because the ECC engine includes only one accumulation context,
it can be allocated to only one chip-select at a time ... "
(7.1.3.3.12.3). Since the commit 97a288ba ("ARM: omap2+:
gpmc-nand: Use dynamic platform_device_alloc()") gpmc-nand
driver supports multiple NAND flash devices connected to
the single controller.
Use global 'struct nand_hw_control' among multiple NAND
instances to synchronize the access to the single ECC Engine.

Tested with custom AM335x board using 2x NAND flash chips.
Signed-off-by: Rostislav Lisovy <lisovy@merica.cz>
Acked-by: Roger Quadros <rogerq@ti.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

Because n25q032 is the Micron SPI chip, move it to Micron
devices list group. In order that know which Micron SPI
chips have been support at a glance.
Signed-off-by: Chunhe Lan <Chunhe.Lan@freescale.com>
Cc: Brian Norris <computersforpeace@gmail.com>
Cc: Marek Vasut <marex@denx.de>
Cc: Huang Shijie <shijie8@gmail.com>
Acked-by: Marek Vasut <marex@denx.de>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

We are trying to remove the legacy tx_dma and rx_dma fields from the
spi_transfer structure. Currently dataflash uses tx_dma but only to make
sure that it's set to 0 so we can remove this use by replacing with a
zero initialisation of the entire spi_transfer struct.
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

We don't need to expose a 'wait-till-ready' interface to drivers. Status
register polling should be handled by the core spi-nor.c library, and as
of now, I see no need to provide a special driver-specific hook for it.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>

spi-nor.c should be taking care of these now.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Cc: Huang Shijie <b32955@freescale.com>
Reviewed-by: Marek Vasut <marex@denx.de>

spi-nor.c should be taking care of these now.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>

We shouldn't have *every* function checking if a previous write is
complete; this should be done synchronously after each write/erase.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>

The error label was unused here. It looks like we're missing at least
one case that should be doing 'goto write_err'.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Acked-by: Huang Shijie <shijie8@gmail.com>

These functions were near-carbon-copies due to a small per-flash quirk.
Let's add a new spi_nor::flags bitfield to support these types of
quirks.
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Reviewed-by: Marek Vasut <marex@denx.de>
Cc: Graham Moore <grmoore@altera.com>
Cc: Huang Shijie <shijie8@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

The help text of CONFIG_MTD_OF_PARTS refers to additional documentation
in booting-without-of.txt but this documentation was moved to another
file in commit efcc2da3 (Stefan Roese:
Factor MTD physmap bindings out of booting-without-of). This updates the
help text to point to the right place.
Signed-off-by: Michal Sojka <sojkam1@fel.cvut.cz>
[Brian: fixed doc reference]
Signed-off-by: Brian Norris <computersforpeace@gmail.com>