Merge tag 'tags/nand-fixes-for-4.8-rc8' of git://git.infradead.org/linux-ubifs

Pull MTD fixes from Richard Weinberger:
 "NAND Fixes for 4.8-rc8.

  This contains fixes for bugs which got introduced in -rc1.  Usually
  Brian takes NAND patches from Boris, but since Brian is very busy
  these days with other stuff and Boris is not yet member of the
  kernel.org web of trust I stepped in.

  Boris will be in Berlin at ELCE, I'll sign his key and hopefully other
  Kernel developers too such that he can issue his own pull requests
  soon.

  Summary:

   - Fix a wrong OOB layout definition in the mxc driver
   - Fix incorrect ECC handling in the mtk driver"

* tag 'tags/nand-fixes-for-4.8-rc8' of git://git.infradead.org/linux-ubifs:
  mtd: nand: mxc: fix obiwan error in mxc_nand_v[12]_ooblayout_free() functions
  mtd: nand: fix chances to create incomplete ECC data when writing
  mtd: nand: fix generating over-boundary ECC data when writing

3 files changed, 14 insertions, 7 deletions

diff --git a/drivers/mtd/nand/mtk_ecc.c b/drivers/mtd/nand/mtk_ecc.c
index 25a4fbd4d24a..d54f666417e1 100644
--- a/drivers/mtd/nand/mtk_ecc.c
+++ b/drivers/mtd/nand/mtk_ecc.c
@@ -366,7 +366,8 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
                    u8 *data, u32 bytes)
 {
         dma_addr_t addr;
-        u32 *p, len, i;
+        u8 *p;
+        u32 len, i, val;
         int ret = 0;
 
         addr = dma_map_single(ecc->dev, data, bytes, DMA_TO_DEVICE);
@@ -392,11 +393,14 @@ int mtk_ecc_encode(struct mtk_ecc *ecc, struct mtk_ecc_config *config,
 
         /* Program ECC bytes to OOB: per sector oob = FDM + ECC + SPARE */
         len = (config->strength * ECC_PARITY_BITS + 7) >> 3;
-        p = (u32 *)(data + bytes);
+        p = data + bytes;
 
         /* write the parity bytes generated by the ECC back to the OOB region */
-        for (i = 0; i < len; i++)
-                p[i] = readl(ecc->regs + ECC_ENCPAR(i));
+        for (i = 0; i < len; i++) {
+                if ((i % 4) == 0)
+                        val = readl(ecc->regs + ECC_ENCPAR(i / 4));
+                p[i] = (val >> ((i % 4) * 8)) & 0xff;
+        }
 timeout:
 
         dma_unmap_single(ecc->dev, addr, bytes, DMA_TO_DEVICE);
diff --git a/drivers/mtd/nand/mtk_nand.c b/drivers/mtd/nand/mtk_nand.c
index ddaa2acb9dd7..5223a2182ee4 100644
--- a/drivers/mtd/nand/mtk_nand.c
+++ b/drivers/mtd/nand/mtk_nand.c
@@ -93,6 +93,9 @@
 #define         NFI_FSM_MASK            (0xf << 16)
 #define NFI_ADDRCNTR            (0x70)
 #define         CNTR_MASK               GENMASK(16, 12)
+#define         ADDRCNTR_SEC_SHIFT      (12)
+#define         ADDRCNTR_SEC(val) \
+                (((val) & CNTR_MASK) >> ADDRCNTR_SEC_SHIFT)
 #define NFI_STRADDR             (0x80)
 #define NFI_BYTELEN             (0x84)
 #define NFI_CSEL                (0x90)
@@ -699,7 +702,7 @@ static int mtk_nfc_do_write_page(struct mtd_info *mtd, struct nand_chip *chip,
         }
 
         ret = readl_poll_timeout_atomic(nfc->regs + NFI_ADDRCNTR, reg,
-                                        (reg & CNTR_MASK) >= chip->ecc.steps,
+                                        ADDRCNTR_SEC(reg) >= chip->ecc.steps,
                                         10, MTK_TIMEOUT);
         if (ret)
                 dev_err(dev, "hwecc write timeout\n");
@@ -902,7 +905,7 @@ static int mtk_nfc_read_subpage(struct mtd_info *mtd, struct nand_chip *chip,
                 dev_warn(nfc->dev, "read ahb/dma done timeout\n");
 
         rc = readl_poll_timeout_atomic(nfc->regs + NFI_BYTELEN, reg,
-                                       (reg & CNTR_MASK) >= sectors, 10,
+                                       ADDRCNTR_SEC(reg) >= sectors, 10,
                                        MTK_TIMEOUT);
         if (rc < 0) {
                 dev_err(nfc->dev, "subpage done timeout\n");
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 5173fadc9a4e..57cbe2b83849 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -943,7 +943,7 @@ static int mxc_v2_ooblayout_free(struct mtd_info *mtd, int section,
         struct nand_chip *nand_chip = mtd_to_nand(mtd);
         int stepsize = nand_chip->ecc.bytes == 9 ? 16 : 26;
 
-        if (section > nand_chip->ecc.steps)
+        if (section >= nand_chip->ecc.steps)
                 return -ERANGE;
 
         if (!section) {