Patched in Tegra support.

11 files changed, 245 insertions, 511 deletions

diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index e469b01d40d..b1e3c26edd6 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -43,6 +43,9 @@ choice
         prompt "Flash cmd/query data swapping"
         depends on MTD_CFI_ADV_OPTIONS
         default MTD_CFI_NOSWAP
+
+config MTD_CFI_NOSWAP
+        bool "NO"
         ---help---
           This option defines the way in which the CPU attempts to arrange
           data bits when writing the 'magic' commands to the chips. Saying
@@ -52,8 +55,12 @@ choice
           Specific arrangements are possible with the BIG_ENDIAN_BYTE and
           LITTLE_ENDIAN_BYTE, if the bytes are reversed.
 
-config MTD_CFI_NOSWAP
-        bool "NO"
+          If you have a LART, on which the data (and address) lines were
+          connected in a fashion which ensured that the nets were as short
+          as possible, resulting in a bit-shuffling which seems utterly
+          random to the untrained eye, you need the LART_ENDIAN_BYTE option.
+
+          Yes, there really exists something sicker than PDP-endian :)
 
 config MTD_CFI_BE_BYTE_SWAP
         bool "BIG_ENDIAN_BYTE"
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 77514430f1f..e1e122f2f92 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -87,7 +87,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **
 
 static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
                      size_t *retlen, void **virt, resource_size_t *phys);
-static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
+static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
 
 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
@@ -262,9 +262,9 @@ static void fixup_st_m28w320cb(struct mtd_info *mtd)
 static void fixup_use_point(struct mtd_info *mtd)
 {
         struct map_info *map = mtd->priv;
-        if (!mtd->_point && map_is_linear(map)) {
-                mtd->_point   = cfi_intelext_point;
-                mtd->_unpoint = cfi_intelext_unpoint;
+        if (!mtd->point && map_is_linear(map)) {
+                mtd->point   = cfi_intelext_point;
+                mtd->unpoint = cfi_intelext_unpoint;
         }
 }
 
@@ -274,8 +274,8 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
         struct cfi_private *cfi = map->fldrv_priv;
         if (cfi->cfiq->BufWriteTimeoutTyp) {
                 printk(KERN_INFO "Using buffer write method\n" );
-                mtd->_write = cfi_intelext_write_buffers;
-                mtd->_writev = cfi_intelext_writev;
+                mtd->write = cfi_intelext_write_buffers;
+                mtd->writev = cfi_intelext_writev;
         }
 }
 
@@ -443,15 +443,15 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
         mtd->type = MTD_NORFLASH;
 
         /* Fill in the default mtd operations */
-        mtd->_erase   = cfi_intelext_erase_varsize;
-        mtd->_read    = cfi_intelext_read;
-        mtd->_write   = cfi_intelext_write_words;
-        mtd->_sync    = cfi_intelext_sync;
-        mtd->_lock    = cfi_intelext_lock;
-        mtd->_unlock  = cfi_intelext_unlock;
-        mtd->_is_locked = cfi_intelext_is_locked;
-        mtd->_suspend = cfi_intelext_suspend;
-        mtd->_resume  = cfi_intelext_resume;
+        mtd->erase   = cfi_intelext_erase_varsize;
+        mtd->read    = cfi_intelext_read;
+        mtd->write   = cfi_intelext_write_words;
+        mtd->sync    = cfi_intelext_sync;
+        mtd->lock    = cfi_intelext_lock;
+        mtd->unlock  = cfi_intelext_unlock;
+        mtd->is_locked = cfi_intelext_is_locked;
+        mtd->suspend = cfi_intelext_suspend;
+        mtd->resume  = cfi_intelext_resume;
         mtd->flags   = MTD_CAP_NORFLASH;
         mtd->name    = map->name;
         mtd->writesize = 1;
@@ -600,12 +600,12 @@ static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
         }
 
 #ifdef CONFIG_MTD_OTP
-        mtd->_read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
-        mtd->_read_user_prot_reg = cfi_intelext_read_user_prot_reg;
-        mtd->_write_user_prot_reg = cfi_intelext_write_user_prot_reg;
-        mtd->_lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
-        mtd->_get_fact_prot_info = cfi_intelext_get_fact_prot_info;
-        mtd->_get_user_prot_info = cfi_intelext_get_user_prot_info;
+        mtd->read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
+        mtd->read_user_prot_reg = cfi_intelext_read_user_prot_reg;
+        mtd->write_user_prot_reg = cfi_intelext_write_user_prot_reg;
+        mtd->lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
+        mtd->get_fact_prot_info = cfi_intelext_get_fact_prot_info;
+        mtd->get_user_prot_info = cfi_intelext_get_user_prot_info;
 #endif
 
         /* This function has the potential to distort the reality
@@ -1017,6 +1017,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
         case FL_READY:
         case FL_STATUS:
         case FL_JEDEC_QUERY:
+                /* We should really make set_vpp() count, rather than doing this */
+                DISABLE_VPP(map);
                 break;
         default:
                 printk(KERN_ERR "%s: put_chip() called with oldstate %d!!\n", map->name, chip->oldstate);
@@ -1322,7 +1324,7 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         int chipnum;
         int ret = 0;
 
-        if (!map->virt)
+        if (!map->virt || (from + len > mtd->size))
                 return -EINVAL;
 
         /* Now lock the chip(s) to POINT state */
@@ -1332,6 +1334,7 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         ofs = from - (chipnum << cfi->chipshift);
 
         *virt = map->virt + cfi->chips[chipnum].start + ofs;
+        *retlen = 0;
         if (phys)
                 *phys = map->phys + cfi->chips[chipnum].start + ofs;
 
@@ -1366,12 +1369,12 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         return 0;
 }
 
-static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
         unsigned long ofs;
-        int chipnum, err = 0;
+        int chipnum;
 
         /* Now unlock the chip(s) POINT state */
 
@@ -1379,7 +1382,7 @@ static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
-        while (len && !err) {
+        while (len) {
                 unsigned long thislen;
                 struct flchip *chip;
 
@@ -1397,10 +1400,8 @@ static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                         chip->ref_point_counter--;
                         if(chip->ref_point_counter == 0)
                                 chip->state = FL_READY;
-                } else {
-                        printk(KERN_ERR "%s: Error: unpoint called on non pointed region\n", map->name);
-                        err = -EINVAL;
-                }
+                } else
+                        printk(KERN_ERR "%s: Warning: unpoint called on non pointed region\n", map->name); /* Should this give an error? */
 
                 put_chip(map, chip, chip->start);
                 mutex_unlock(&chip->mutex);
@@ -1409,8 +1410,6 @@ static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                 ofs = 0;
                 chipnum++;
         }
-
-        return err;
 }
 
 static inline int do_read_onechip(struct map_info *map, struct flchip *chip, loff_t adr, size_t len, u_char *buf)
@@ -1457,6 +1456,8 @@ static int cfi_intelext_read (struct mtd_info *mtd, loff_t from, size_t len, siz
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
+        *retlen = 0;
+
         while (len) {
                 unsigned long thislen;
 
@@ -1550,8 +1551,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, adr);
- out:   DISABLE_VPP(map);
-        put_chip(map, chip, adr);
+ out:   put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -1565,6 +1565,10 @@ static int cfi_intelext_write_words (struct mtd_info *mtd, loff_t to , size_t le
         int chipnum;
         unsigned long ofs;
 
+        *retlen = 0;
+        if (!len)
+                return 0;
+
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
@@ -1790,8 +1794,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, cmd_adr);
- out:   DISABLE_VPP(map);
-        put_chip(map, chip, cmd_adr);
+ out:   put_chip(map, chip, cmd_adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -1810,6 +1813,7 @@ static int cfi_intelext_writev (struct mtd_info *mtd, const struct kvec *vecs,
         for (i = 0; i < count; i++)
                 len += vecs[i].iov_len;
 
+        *retlen = 0;
         if (!len)
                 return 0;
 
@@ -1928,7 +1932,6 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
                         ret = -EIO;
                 } else if (chipstatus & 0x20 && retries--) {
                         printk(KERN_DEBUG "block erase failed at 0x%08lx: status 0x%lx. Retrying...\n", adr, chipstatus);
-                        DISABLE_VPP(map);
                         put_chip(map, chip, adr);
                         mutex_unlock(&chip->mutex);
                         goto retry;
@@ -1941,8 +1944,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, adr);
- out:   DISABLE_VPP(map);
-        put_chip(map, chip, adr);
+ out:   put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -2043,7 +2045,7 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
 {
         struct cfi_private *cfi = map->fldrv_priv;
         struct cfi_pri_intelext *extp = cfi->cmdset_priv;
-        int mdelay;
+        int udelay;
         int ret;
 
         adr += chip->start;
@@ -2072,17 +2074,9 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
          * If Instant Individual Block Locking supported then no need
          * to delay.
          */
-        /*
-         * Unlocking may take up to 1.4 seconds on some Intel flashes. So
-         * lets use a max of 1.5 seconds (1500ms) as timeout.
-         *
-         * See "Clear Block Lock-Bits Time" on page 40 in
-         * "3 Volt Intel StrataFlash Memory" 28F128J3,28F640J3,28F320J3 manual
-         * from February 2003
-         */
-        mdelay = (!extp || !(extp->FeatureSupport & (1 << 5))) ? 1500 : 0;
+        udelay = (!extp || !(extp->FeatureSupport & (1 << 5))) ? 1000000/HZ : 0;
 
-        ret = WAIT_TIMEOUT(map, chip, adr, mdelay, mdelay * 1000);
+        ret = WAIT_TIMEOUT(map, chip, adr, udelay, udelay * 100);
         if (ret) {
                 map_write(map, CMD(0x70), adr);
                 chip->state = FL_STATUS;
@@ -2092,8 +2086,7 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
         }
 
         xip_enable(map, chip, adr);
- out:   DISABLE_VPP(map);
-        put_chip(map, chip, adr);
+out:    put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -2490,7 +2483,7 @@ static int cfi_intelext_suspend(struct mtd_info *mtd)
                            allowed to. Or should we return -EAGAIN, because the upper layers
                            ought to have already shut down anything which was using the device
                            anyway? The latter for now. */
-                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->state);
+                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->oldstate);
                         ret = -EAGAIN;
                 case FL_PM_SUSPENDED:
                         break;
@@ -2533,10 +2526,12 @@ static void cfi_intelext_restore_locks(struct mtd_info *mtd)
                 if (!region->lockmap)
                         continue;
 
-                for_each_clear_bit(block, region->lockmap, region->numblocks) {
+                for (block = 0; block < region->numblocks; block++) {
                         len = region->erasesize;
                         adr = region->offset + block * len;
-                        cfi_intelext_unlock(mtd, adr, len);
+
+                        if (!test_bit(block, region->lockmap))
+                                cfi_intelext_unlock(mtd, adr, len);
                 }
         }
 }
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index b86197286f2..51d79223bc7 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -59,9 +59,6 @@ static void cfi_amdstd_resume (struct mtd_info *);
 static int cfi_amdstd_reboot(struct notifier_block *, unsigned long, void *);
 static int cfi_amdstd_secsi_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 
-static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
-                                  size_t *retlen, const u_char *buf);
-
 static void cfi_amdstd_destroy(struct mtd_info *);
 
 struct mtd_info *cfi_cmdset_0002(struct map_info *, int);
@@ -148,7 +145,8 @@ static void fixup_amd_bootblock(struct mtd_info *mtd)
         if (((major << 8) | minor) < 0x3131) {
                 /* CFI version 1.0 => don't trust bootloc */
 
-                pr_debug("%s: JEDEC Vendor ID is 0x%02X Device ID is 0x%02X\n",
+                DEBUG(MTD_DEBUG_LEVEL1,
+                        "%s: JEDEC Vendor ID is 0x%02X Device ID is 0x%02X\n",
                         map->name, cfi->mfr, cfi->id);
 
                 /* AFAICS all 29LV400 with a bottom boot block have a device ID
@@ -168,7 +166,8 @@ static void fixup_amd_bootblock(struct mtd_info *mtd)
                          * the 8-bit device ID.
                          */
                         (cfi->mfr == CFI_MFR_MACRONIX)) {
-                        pr_debug("%s: Macronix MX29LV400C with bottom boot block"
+                        DEBUG(MTD_DEBUG_LEVEL1,
+                                "%s: Macronix MX29LV400C with bottom boot block"
                                 " detected\n", map->name);
                         extp->TopBottom = 2;    /* bottom boot */
                 } else
@@ -179,7 +178,8 @@ static void fixup_amd_bootblock(struct mtd_info *mtd)
                         extp->TopBottom = 2;    /* bottom boot */
                 }
 
-                pr_debug("%s: AMD CFI PRI V%c.%c has no boot block field;"
+                DEBUG(MTD_DEBUG_LEVEL1,
+                        "%s: AMD CFI PRI V%c.%c has no boot block field;"
                         " deduced %s from Device ID\n", map->name, major, minor,
                         extp->TopBottom == 2 ? "bottom" : "top");
         }
@@ -190,9 +190,17 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
+        struct cfi_pri_amdstd *extp = cfi->cmdset_priv;
+
         if (cfi->cfiq->BufWriteTimeoutTyp) {
-                pr_debug("Using buffer write method\n" );
-                mtd->_write = cfi_amdstd_write_buffers;
+                DEBUG(MTD_DEBUG_LEVEL1, "Using buffer write method\n" );
+                mtd->write = cfi_amdstd_write_buffers;
+
+                if (extp->SiliconRevision >= 0x1C) {
+                        mtd->writesize = 512;
+                        mtd->flags &= ~MTD_BIT_WRITEABLE;
+                        printk(KERN_INFO "Enabling Spansion 65nm mode, writesize = 512 bytes\n");
+                }
         }
 }
 
@@ -231,8 +239,8 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd)
 static void fixup_use_secsi(struct mtd_info *mtd)
 {
         /* Setup for chips with a secsi area */
-        mtd->_read_user_prot_reg = cfi_amdstd_secsi_read;
-        mtd->_read_fact_prot_reg = cfi_amdstd_secsi_read;
+        mtd->read_user_prot_reg = cfi_amdstd_secsi_read;
+        mtd->read_fact_prot_reg = cfi_amdstd_secsi_read;
 }
 
 static void fixup_use_erase_chip(struct mtd_info *mtd)
@@ -241,7 +249,7 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
         struct cfi_private *cfi = map->fldrv_priv;
         if ((cfi->cfiq->NumEraseRegions == 1) &&
                 ((cfi->cfiq->EraseRegionInfo[0] & 0xffff) == 0)) {
-                mtd->_erase = cfi_amdstd_erase_chip;
+                mtd->erase = cfi_amdstd_erase_chip;
         }
 
 }
@@ -252,8 +260,8 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
  */
 static void fixup_use_atmel_lock(struct mtd_info *mtd)
 {
-        mtd->_lock = cfi_atmel_lock;
-        mtd->_unlock = cfi_atmel_unlock;
+        mtd->lock = cfi_atmel_lock;
+        mtd->unlock = cfi_atmel_unlock;
         mtd->flags |= MTD_POWERUP_LOCK;
 }
 
@@ -317,7 +325,7 @@ static void fixup_s29gl064n_sectors(struct mtd_info *mtd)
 
         if ((cfi->cfiq->EraseRegionInfo[0] & 0xffff) == 0x003f) {
                 cfi->cfiq->EraseRegionInfo[0] |= 0x0040;
-                pr_warning("%s: Bad S29GL064N CFI data; adjust from 64 to 128 sectors\n", mtd->name);
+                pr_warning("%s: Bad S29GL064N CFI data, adjust from 64 to 128 sectors\n", mtd->name);
         }
 }
 
@@ -328,23 +336,10 @@ static void fixup_s29gl032n_sectors(struct mtd_info *mtd)
 
         if ((cfi->cfiq->EraseRegionInfo[1] & 0xffff) == 0x007e) {
                 cfi->cfiq->EraseRegionInfo[1] &= ~0x0040;
-                pr_warning("%s: Bad S29GL032N CFI data; adjust from 127 to 63 sectors\n", mtd->name);
+                pr_warning("%s: Bad S29GL032N CFI data, adjust from 127 to 63 sectors\n", mtd->name);
         }
 }
 
-static void fixup_s29ns512p_sectors(struct mtd_info *mtd)
-{
-        struct map_info *map = mtd->priv;
-        struct cfi_private *cfi = map->fldrv_priv;
-
-        /*
-         *  S29NS512P flash uses more than 8bits to report number of sectors,
-         * which is not permitted by CFI.
-         */
-        cfi->cfiq->EraseRegionInfo[0] = 0x020001ff;
-        pr_warning("%s: Bad S29NS512P CFI data; adjust to 512 sectors\n", mtd->name);
-}
-
 /* Used to fix CFI-Tables of chips without Extended Query Tables */
 static struct cfi_fixup cfi_nopri_fixup_table[] = {
         { CFI_MFR_SST, 0x234a, fixup_sst39vf }, /* SST39VF1602 */
@@ -375,7 +370,6 @@ static struct cfi_fixup cfi_fixup_table[] = {
         { CFI_MFR_AMD, 0x1301, fixup_s29gl064n_sectors },
         { CFI_MFR_AMD, 0x1a00, fixup_s29gl032n_sectors },
         { CFI_MFR_AMD, 0x1a01, fixup_s29gl032n_sectors },
-        { CFI_MFR_AMD, 0x3f00, fixup_s29ns512p_sectors },
         { CFI_MFR_SST, 0x536a, fixup_sst38vf640x_sectorsize }, /* SST38VF6402 */
         { CFI_MFR_SST, 0x536b, fixup_sst38vf640x_sectorsize }, /* SST38VF6401 */
         { CFI_MFR_SST, 0x536c, fixup_sst38vf640x_sectorsize }, /* SST38VF6404 */
@@ -431,68 +425,6 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi,
         }
 }
 
-static int is_m29ew(struct cfi_private *cfi)
-{
-        if (cfi->mfr == CFI_MFR_INTEL &&
-            ((cfi->device_type == CFI_DEVICETYPE_X8 && (cfi->id & 0xff) == 0x7e) ||
-             (cfi->device_type == CFI_DEVICETYPE_X16 && cfi->id == 0x227e)))
-                return 1;
-        return 0;
-}
-
-/*
- * From TN-13-07: Patching the Linux Kernel and U-Boot for M29 Flash, page 20:
- * Some revisions of the M29EW suffer from erase suspend hang ups. In
- * particular, it can occur when the sequence
- * Erase Confirm -> Suspend -> Program -> Resume
- * causes a lockup due to internal timing issues. The consequence is that the
- * erase cannot be resumed without inserting a dummy command after programming
- * and prior to resuming. [...] The work-around is to issue a dummy write cycle
- * that writes an F0 command code before the RESUME command.
- */
-static void cfi_fixup_m29ew_erase_suspend(struct map_info *map,
-                                          unsigned long adr)
-{
-        struct cfi_private *cfi = map->fldrv_priv;
-        /* before resume, insert a dummy 0xF0 cycle for Micron M29EW devices */
-        if (is_m29ew(cfi))
-                map_write(map, CMD(0xF0), adr);
-}
-
-/*
- * From TN-13-07: Patching the Linux Kernel and U-Boot for M29 Flash, page 22:
- *
- * Some revisions of the M29EW (for example, A1 and A2 step revisions)
- * are affected by a problem that could cause a hang up when an ERASE SUSPEND
- * command is issued after an ERASE RESUME operation without waiting for a
- * minimum delay.  The result is that once the ERASE seems to be completed
- * (no bits are toggling), the contents of the Flash memory block on which
- * the erase was ongoing could be inconsistent with the expected values
- * (typically, the array value is stuck to the 0xC0, 0xC4, 0x80, or 0x84
- * values), causing a consequent failure of the ERASE operation.
- * The occurrence of this issue could be high, especially when file system
- * operations on the Flash are intensive.  As a result, it is recommended
- * that a patch be applied.  Intensive file system operations can cause many
- * calls to the garbage routine to free Flash space (also by erasing physical
- * Flash blocks) and as a result, many consecutive SUSPEND and RESUME
- * commands can occur.  The problem disappears when a delay is inserted after
- * the RESUME command by using the udelay() function available in Linux.
- * The DELAY value must be tuned based on the customer's platform.
- * The maximum value that fixes the problem in all cases is 500us.
- * But, in our experience, a delay of 30 µs to 50 µs is sufficient
- * in most cases.
- * We have chosen 500µs because this latency is acceptable.
- */
-static void cfi_fixup_m29ew_delay_after_resume(struct cfi_private *cfi)
-{
-        /*
-         * Resolving the Delay After Resume Issue see Micron TN-13-07
-         * Worst case delay must be 500µs but 30-50µs should be ok as well
-         */
-        if (is_m29ew(cfi))
-                cfi_udelay(500);
-}
-
 struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
 {
         struct cfi_private *cfi = map->fldrv_priv;
@@ -508,21 +440,20 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
         mtd->type = MTD_NORFLASH;
 
         /* Fill in the default mtd operations */
-        mtd->_erase   = cfi_amdstd_erase_varsize;
-        mtd->_write   = cfi_amdstd_write_words;
-        mtd->_read    = cfi_amdstd_read;
-        mtd->_sync    = cfi_amdstd_sync;
-        mtd->_suspend = cfi_amdstd_suspend;
-        mtd->_resume  = cfi_amdstd_resume;
+        mtd->erase   = cfi_amdstd_erase_varsize;
+        mtd->write   = cfi_amdstd_write_words;
+        mtd->read    = cfi_amdstd_read;
+        mtd->sync    = cfi_amdstd_sync;
+        mtd->suspend = cfi_amdstd_suspend;
+        mtd->resume  = cfi_amdstd_resume;
         mtd->flags   = MTD_CAP_NORFLASH;
         mtd->name    = map->name;
         mtd->writesize = 1;
         mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
 
-        pr_debug("MTD %s(): write buffer size %d\n", __func__,
-                        mtd->writebufsize);
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): write buffer size %d\n",
+                __func__, mtd->writebufsize);
 
-        mtd->_panic_write = cfi_amdstd_panic_write;
         mtd->reboot_notifier.notifier_call = cfi_amdstd_reboot;
 
         if (cfi->cfi_mode==CFI_MODE_CFI){
@@ -838,10 +769,7 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
 
         switch(chip->oldstate) {
         case FL_ERASING:
-                cfi_fixup_m29ew_erase_suspend(map,
-                        chip->in_progress_block_addr);
                 map_write(map, cfi->sector_erase_cmd, chip->in_progress_block_addr);
-                cfi_fixup_m29ew_delay_after_resume(cfi);
                 chip->oldstate = FL_READY;
                 chip->state = FL_ERASING;
                 break;
@@ -853,6 +781,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
 
         case FL_READY:
         case FL_STATUS:
+                /* We should really make set_vpp() count, rather than doing this */
+                DISABLE_VPP(map);
                 break;
         default:
                 printk(KERN_ERR "MTD: put_chip() called with oldstate %d!!\n", chip->oldstate);
@@ -981,8 +911,6 @@ static void __xipram xip_udelay(struct map_info *map, struct flchip *chip,
                         /* Disallow XIP again */
                         local_irq_disable();
 
-                        /* Correct Erase Suspend Hangups for M29EW */
-                        cfi_fixup_m29ew_erase_suspend(map, adr);
                         /* Resume the write or erase operation */
                         map_write(map, cfi->sector_erase_cmd, adr);
                         chip->state = oldstate;
@@ -1096,9 +1024,13 @@ static int cfi_amdstd_read (struct mtd_info *mtd, loff_t from, size_t len, size_
         int ret = 0;
 
         /* ofs: offset within the first chip that the first read should start */
+
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
+
+        *retlen = 0;
+
         while (len) {
                 unsigned long thislen;
 
@@ -1176,11 +1108,16 @@ static int cfi_amdstd_secsi_read (struct mtd_info *mtd, loff_t from, size_t len,
         int chipnum;
         int ret = 0;
 
+
         /* ofs: offset within the first chip that the first read should start */
+
         /* 8 secsi bytes per chip */
         chipnum=from>>3;
         ofs=from & 7;
 
+
+        *retlen = 0;
+
         while (len) {
                 unsigned long thislen;
 
@@ -1234,7 +1171,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
                 return ret;
         }
 
-        pr_debug("MTD %s(): WRITE 0x%.8lx(0x%.8lx)\n",
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): WRITE 0x%.8lx(0x%.8lx)\n",
                __func__, adr, datum.x[0] );
 
         /*
@@ -1245,7 +1182,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
          */
         oldd = map_read(map, adr);
         if (map_word_equal(map, oldd, datum)) {
-                pr_debug("MTD %s(): NOP\n",
+                DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): NOP\n",
                        __func__);
                 goto op_done;
         }
@@ -1308,7 +1245,6 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         xip_enable(map, chip, adr);
  op_done:
         chip->state = FL_READY;
-        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1326,6 +1262,10 @@ static int cfi_amdstd_write_words(struct mtd_info *mtd, loff_t to, size_t len,
         unsigned long ofs, chipstart;
         DECLARE_WAITQUEUE(wait, current);
 
+        *retlen = 0;
+        if (!len)
+                return 0;
+
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
         chipstart = cfi->chips[chipnum].start;
@@ -1440,21 +1380,18 @@ static int cfi_amdstd_write_words(struct mtd_info *mtd, loff_t to, size_t len,
 }
 
 
-/*
- * FIXME: interleaved mode not tested, and probably not supported!
- */
 static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                                     unsigned long adr, const u_char *buf,
                                     int len)
 {
         struct cfi_private *cfi = map->fldrv_priv;
         unsigned long timeo = jiffies + HZ;
-        /* see comments in do_write_oneword() regarding uWriteTimeo. */
-        unsigned long uWriteTimeout = ( HZ / 1000 ) + 1;
+        /* see comments in do_write_oneword() regarding uWriteTimeout, 20ms */
+        unsigned long uWriteTimeout = (HZ / 50) + 1;
         int ret = -EIO;
         unsigned long cmd_adr;
-        int z, words;
-        map_word datum;
+        int z, words, prolog, epilog, buflen = len;
+        map_word datum, pdat, edat;
 
         adr += chip->start;
         cmd_adr = adr;
@@ -1468,13 +1405,28 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
 
         datum = map_word_load(map, buf);
 
-        pr_debug("MTD %s(): WRITE 0x%.8lx(0x%.8lx)\n",
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): WRITE 0x%.8lx(0x%.8lx)\n",
                __func__, adr, datum.x[0] );
 
         XIP_INVAL_CACHED_RANGE(map, adr, len);
         ENABLE_VPP(map);
         xip_disable(map, chip, cmd_adr);
 
+        /* If start is not bus-aligned, prepend old contents of flash */
+        prolog = (adr & (map_bankwidth(map)-1));
+        if (prolog) {
+                adr -= prolog;
+                cmd_adr -= prolog;
+                len += prolog;
+                pdat = map_read(map, adr);
+        }
+        /* If end is not bus-aligned, append old contents of flash */
+        epilog = ((adr + len) & (map_bankwidth(map)-1));
+        if (epilog) {
+                len += map_bankwidth(map)-epilog;
+                edat = map_read(map, adr + len - map_bankwidth(map));
+        }
+
         cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
         cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL);
 
@@ -1488,8 +1440,21 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         map_write(map, CMD(words - 1), cmd_adr);
         /* Write data */
         z = 0;
+        if (prolog) {
+                datum = map_word_load_partial(map, pdat, buf, prolog,
+                                min_t(int, buflen,
+                                        map_bankwidth(map) - prolog));
+                map_write(map, datum, adr);
+
+                z += map_bankwidth(map);
+                buf += map_bankwidth(map) - prolog;
+        }
         while(z < words * map_bankwidth(map)) {
-                datum = map_word_load(map, buf);
+                if (epilog && z >= (words-1) * map_bankwidth(map))
+                        datum = map_word_load_partial(map, edat,
+                                        buf, 0, epilog);
+                else
+                        datum = map_word_load(map, buf);
                 map_write(map, datum, adr + z);
 
                 z += map_bankwidth(map);
@@ -1536,22 +1501,15 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
                 UDELAY(map, chip, adr, 1);
         }
 
-        /*
-         * Recovery from write-buffer programming failures requires
-         * the write-to-buffer-reset sequence.  Since the last part
-         * of the sequence also works as a normal reset, we can run
-         * the same commands regardless of why we are here.
-         * See e.g.
-         * http://www.spansion.com/Support/Application%20Notes/MirrorBit_Write_Buffer_Prog_Page_Buffer_Read_AN.pdf
-         */
-        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
-                         cfi->device_type, NULL);
-        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi,
-                         cfi->device_type, NULL);
-        cfi_send_gen_cmd(0xF0, cfi->addr_unlock1, chip->start, map, cfi,
-                         cfi->device_type, NULL);
+        /* reset on all failures. */
+        map_write( map, CMD(0xF0), chip->start );
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map,
+                                cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map,
+                                cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xF0, cfi->addr_unlock1, chip->start, map,
+                                cfi, cfi->device_type, NULL);
         xip_enable(map, chip, adr);
-        /* FIXME - should have reset delay before continuing */
 
         printk(KERN_WARNING "MTD %s(): software timeout\n",
                __func__ );
@@ -1559,7 +1517,6 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         ret = -EIO;
  op_done:
         chip->state = FL_READY;
-        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1577,39 +1534,19 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
         int chipnum;
         unsigned long ofs;
 
+        *retlen = 0;
+        if (!len)
+                return 0;
+
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
-        /* If it's not bus-aligned, do the first word write */
-        if (ofs & (map_bankwidth(map)-1)) {
-                size_t local_len = (-ofs)&(map_bankwidth(map)-1);
-                if (local_len > len)
-                        local_len = len;
-                ret = cfi_amdstd_write_words(mtd, ofs + (chipnum<<cfi->chipshift),
-                                             local_len, retlen, buf);
-                if (ret)
-                        return ret;
-                ofs += local_len;
-                buf += local_len;
-                len -= local_len;
-
-                if (ofs >> cfi->chipshift) {
-                        chipnum ++;
-                        ofs = 0;
-                        if (chipnum == cfi->numchips)
-                                return 0;
-                }
-        }
-
-        /* Write buffer is worth it only if more than one word to write... */
-        while (len >= map_bankwidth(map) * 2) {
+        while (len) {
                 /* We must not cross write block boundaries */
                 int size = wbufsize - (ofs & (wbufsize-1));
 
                 if (size > len)
                         size = len;
-                if (size % map_bankwidth(map))
-                        size -= size % map_bankwidth(map);
 
                 ret = do_write_buffer(map, &cfi->chips[chipnum],
                                       ofs, buf, size);
@@ -1629,248 +1566,6 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
                 }
         }
 
-        if (len) {
-                size_t retlen_dregs = 0;
-
-                ret = cfi_amdstd_write_words(mtd, ofs + (chipnum<<cfi->chipshift),
-                                             len, &retlen_dregs, buf);
-
-                *retlen += retlen_dregs;
-                return ret;
-        }
-
-        return 0;
-}
-
-/*
- * Wait for the flash chip to become ready to write data
- *
- * This is only called during the panic_write() path. When panic_write()
- * is called, the kernel is in the process of a panic, and will soon be
- * dead. Therefore we don't take any locks, and attempt to get access
- * to the chip as soon as possible.
- */
-static int cfi_amdstd_panic_wait(struct map_info *map, struct flchip *chip,
-                                 unsigned long adr)
-{
-        struct cfi_private *cfi = map->fldrv_priv;
-        int retries = 10;
-        int i;
-
-        /*
-         * If the driver thinks the chip is idle, and no toggle bits
-         * are changing, then the chip is actually idle for sure.
-         */
-        if (chip->state == FL_READY && chip_ready(map, adr))
-                return 0;
-
-        /*
-         * Try several times to reset the chip and then wait for it
-         * to become idle. The upper limit of a few milliseconds of
-         * delay isn't a big problem: the kernel is dying anyway. It
-         * is more important to save the messages.
-         */
-        while (retries > 0) {
-                const unsigned long timeo = (HZ / 1000) + 1;
-
-                /* send the reset command */
-                map_write(map, CMD(0xF0), chip->start);
-
-                /* wait for the chip to become ready */
-                for (i = 0; i < jiffies_to_usecs(timeo); i++) {
-                        if (chip_ready(map, adr))
-                                return 0;
-
-                        udelay(1);
-                }
-        }
-
-        /* the chip never became ready */
-        return -EBUSY;
-}
-
-/*
- * Write out one word of data to a single flash chip during a kernel panic
- *
- * This is only called during the panic_write() path. When panic_write()
- * is called, the kernel is in the process of a panic, and will soon be
- * dead. Therefore we don't take any locks, and attempt to get access
- * to the chip as soon as possible.
- *
- * The implementation of this routine is intentionally similar to
- * do_write_oneword(), in order to ease code maintenance.
- */
-static int do_panic_write_oneword(struct map_info *map, struct flchip *chip,
-                                  unsigned long adr, map_word datum)
-{
-        const unsigned long uWriteTimeout = (HZ / 1000) + 1;
-        struct cfi_private *cfi = map->fldrv_priv;
-        int retry_cnt = 0;
-        map_word oldd;
-        int ret = 0;
-        int i;
-
-        adr += chip->start;
-
-        ret = cfi_amdstd_panic_wait(map, chip, adr);
-        if (ret)
-                return ret;
-
-        pr_debug("MTD %s(): PANIC WRITE 0x%.8lx(0x%.8lx)\n",
-                        __func__, adr, datum.x[0]);
-
-        /*
-         * Check for a NOP for the case when the datum to write is already
-         * present - it saves time and works around buggy chips that corrupt
-         * data at other locations when 0xff is written to a location that
-         * already contains 0xff.
-         */
-        oldd = map_read(map, adr);
-        if (map_word_equal(map, oldd, datum)) {
-                pr_debug("MTD %s(): NOP\n", __func__);
-                goto op_done;
-        }
-
-        ENABLE_VPP(map);
-
-retry:
-        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
-        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL);
-        cfi_send_gen_cmd(0xA0, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
-        map_write(map, datum, adr);
-
-        for (i = 0; i < jiffies_to_usecs(uWriteTimeout); i++) {
-                if (chip_ready(map, adr))
-                        break;
-
-                udelay(1);
-        }
-
-        if (!chip_good(map, adr, datum)) {
-                /* reset on all failures. */
-                map_write(map, CMD(0xF0), chip->start);
-                /* FIXME - should have reset delay before continuing */
-
-                if (++retry_cnt <= MAX_WORD_RETRIES)
-                        goto retry;
-
-                ret = -EIO;
-        }
-
-op_done:
-        DISABLE_VPP(map);
-        return ret;
-}
-
-/*
- * Write out some data during a kernel panic
- *
- * This is used by the mtdoops driver to save the dying messages from a
- * kernel which has panic'd.
- *
- * This routine ignores all of the locking used throughout the rest of the
- * driver, in order to ensure that the data gets written out no matter what
- * state this driver (and the flash chip itself) was in when the kernel crashed.
- *
- * The implementation of this routine is intentionally similar to
- * cfi_amdstd_write_words(), in order to ease code maintenance.
- */
-static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
-                                  size_t *retlen, const u_char *buf)
-{
-        struct map_info *map = mtd->priv;
-        struct cfi_private *cfi = map->fldrv_priv;
-        unsigned long ofs, chipstart;
-        int ret = 0;
-        int chipnum;
-
-        chipnum = to >> cfi->chipshift;
-        ofs = to - (chipnum << cfi->chipshift);
-        chipstart = cfi->chips[chipnum].start;
-
-        /* If it's not bus aligned, do the first byte write */
-        if (ofs & (map_bankwidth(map) - 1)) {
-                unsigned long bus_ofs = ofs & ~(map_bankwidth(map) - 1);
-                int i = ofs - bus_ofs;
-                int n = 0;
-                map_word tmp_buf;
-
-                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], bus_ofs);
-                if (ret)
-                        return ret;
-
-                /* Load 'tmp_buf' with old contents of flash */
-                tmp_buf = map_read(map, bus_ofs + chipstart);
-
-                /* Number of bytes to copy from buffer */
-                n = min_t(int, len, map_bankwidth(map) - i);
-
-                tmp_buf = map_word_load_partial(map, tmp_buf, buf, i, n);
-
-                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
-                                             bus_ofs, tmp_buf);
-                if (ret)
-                        return ret;
-
-                ofs += n;
-                buf += n;
-                (*retlen) += n;
-                len -= n;
-
-                if (ofs >> cfi->chipshift) {
-                        chipnum++;
-                        ofs = 0;
-                        if (chipnum == cfi->numchips)
-                                return 0;
-                }
-        }
-
-        /* We are now aligned, write as much as possible */
-        while (len >= map_bankwidth(map)) {
-                map_word datum;
-
-                datum = map_word_load(map, buf);
-
-                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
-                                             ofs, datum);
-                if (ret)
-                        return ret;
-
-                ofs += map_bankwidth(map);
-                buf += map_bankwidth(map);
-                (*retlen) += map_bankwidth(map);
-                len -= map_bankwidth(map);
-
-                if (ofs >> cfi->chipshift) {
-                        chipnum++;
-                        ofs = 0;
-                        if (chipnum == cfi->numchips)
-                                return 0;
-
-                        chipstart = cfi->chips[chipnum].start;
-                }
-        }
-
-        /* Write the trailing bytes if any */
-        if (len & (map_bankwidth(map) - 1)) {
-                map_word tmp_buf;
-
-                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], ofs);
-                if (ret)
-                        return ret;
-
-                tmp_buf = map_read(map, ofs + chipstart);
-
-                tmp_buf = map_word_load_partial(map, tmp_buf, buf, 0, len);
-
-                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
-                                             ofs, tmp_buf);
-                if (ret)
-                        return ret;
-
-                (*retlen) += len;
-        }
-
         return 0;
 }
 
@@ -1896,7 +1591,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
                 return ret;
         }
 
-        pr_debug("MTD %s(): ERASE 0x%.8lx\n",
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): ERASE 0x%.8lx\n",
                __func__, chip->start );
 
         XIP_INVAL_CACHED_RANGE(map, adr, map->size);
@@ -1961,7 +1656,6 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
 
         chip->state = FL_READY;
         xip_enable(map, chip, adr);
-        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1985,7 +1679,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
                 return ret;
         }
 
-        pr_debug("MTD %s(): ERASE 0x%.8lx\n",
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): ERASE 0x%.8lx\n",
                __func__, adr );
 
         XIP_INVAL_CACHED_RANGE(map, adr, len);
@@ -2052,7 +1746,6 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         }
 
         chip->state = FL_READY;
-        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
@@ -2112,7 +1805,8 @@ static int do_atmel_lock(struct map_info *map, struct flchip *chip,
                 goto out_unlock;
         chip->state = FL_LOCKING;
 
-        pr_debug("MTD %s(): LOCK 0x%08lx len %d\n", __func__, adr, len);
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
 
         cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
                          cfi->device_type, NULL);
@@ -2147,7 +1841,8 @@ static int do_atmel_unlock(struct map_info *map, struct flchip *chip,
                 goto out_unlock;
         chip->state = FL_UNLOCKING;
 
-        pr_debug("MTD %s(): LOCK 0x%08lx len %d\n", __func__, adr, len);
+        DEBUG(MTD_DEBUG_LEVEL3, "MTD %s(): LOCK 0x%08lx len %d\n",
+              __func__, adr, len);
 
         cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi,
                          cfi->device_type, NULL);
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 096993f9711..179814a95f3 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -139,9 +139,8 @@ struct mtd_info *cfi_cmdset_0020(struct map_info *map, int primary)
                 }
 
                 /* Do some byteswapping if necessary */
-                extp->FeatureSupport = cfi32_to_cpu(map, extp->FeatureSupport);
-                extp->BlkStatusRegMask = cfi32_to_cpu(map,
-                                                extp->BlkStatusRegMask);
+                extp->FeatureSupport = cfi32_to_cpu(extp->FeatureSupport);
+                extp->BlkStatusRegMask = cfi32_to_cpu(extp->BlkStatusRegMask);
 
 #ifdef DEBUG_CFI_FEATURES
                 /* Tell the user about it in lots of lovely detail */
@@ -228,15 +227,15 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
                 }
 
         /* Also select the correct geometry setup too */
-        mtd->_erase = cfi_staa_erase_varsize;
-        mtd->_read = cfi_staa_read;
-        mtd->_write = cfi_staa_write_buffers;
-        mtd->_writev = cfi_staa_writev;
-        mtd->_sync = cfi_staa_sync;
-        mtd->_lock = cfi_staa_lock;
-        mtd->_unlock = cfi_staa_unlock;
-        mtd->_suspend = cfi_staa_suspend;
-        mtd->_resume = cfi_staa_resume;
+        mtd->erase = cfi_staa_erase_varsize;
+        mtd->read = cfi_staa_read;
+        mtd->write = cfi_staa_write_buffers;
+        mtd->writev = cfi_staa_writev;
+        mtd->sync = cfi_staa_sync;
+        mtd->lock = cfi_staa_lock;
+        mtd->unlock = cfi_staa_unlock;
+        mtd->suspend = cfi_staa_suspend;
+        mtd->resume = cfi_staa_resume;
         mtd->flags = MTD_CAP_NORFLASH & ~MTD_BIT_WRITEABLE;
         mtd->writesize = 8; /* FIXME: Should be 0 for STMicro flashes w/out ECC */
         mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
@@ -394,6 +393,8 @@ static int cfi_staa_read (struct mtd_info *mtd, loff_t from, size_t len, size_t
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
+        *retlen = 0;
+
         while (len) {
                 unsigned long thislen;
 
@@ -615,6 +616,10 @@ static int cfi_staa_write_buffers (struct mtd_info *mtd, loff_t to,
         int chipnum;
         unsigned long ofs;
 
+        *retlen = 0;
+        if (!len)
+                return 0;
+
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
@@ -693,8 +698,7 @@ cfi_staa_writev(struct mtd_info *mtd, const struct kvec *vecs,
                                 continue;
                         }
                         memcpy(buffer+buflen, elem_base, ECCBUF_SIZE-buflen);
-                        ret = mtd_write(mtd, to, ECCBUF_SIZE, &thislen,
-                                        buffer);
+                        ret = mtd->write(mtd, to, ECCBUF_SIZE, &thislen, buffer);
                         totlen += thislen;
                         if (ret || thislen != ECCBUF_SIZE)
                                 goto write_error;
@@ -703,8 +707,7 @@ cfi_staa_writev(struct mtd_info *mtd, const struct kvec *vecs,
                         to += ECCBUF_SIZE;
                 }
                 if (ECCBUF_DIV(elem_len)) { /* write clean aligned data */
-                        ret = mtd_write(mtd, to, ECCBUF_DIV(elem_len),
-                                        &thislen, elem_base);
+                        ret = mtd->write(mtd, to, ECCBUF_DIV(elem_len), &thislen, elem_base);
                         totlen += thislen;
                         if (ret || thislen != ECCBUF_DIV(elem_len))
                                 goto write_error;
@@ -718,7 +721,7 @@ cfi_staa_writev(struct mtd_info *mtd, const struct kvec *vecs,
         }
         if (buflen) { /* flush last page, even if not full */
                 /* This is sometimes intended behaviour, really */
-                ret = mtd_write(mtd, to, buflen, &thislen, buffer);
+                ret = mtd->write(mtd, to, buflen, &thislen, buffer);
                 totlen += thislen;
                 if (ret || thislen != ECCBUF_SIZE)
                         goto write_error;
@@ -898,6 +901,12 @@ static int cfi_staa_erase_varsize(struct mtd_info *mtd,
         int i, first;
         struct mtd_erase_region_info *regions = mtd->eraseregions;
 
+        if (instr->addr > mtd->size)
+                return -EINVAL;
+
+        if ((instr->len + instr->addr) > mtd->size)
+                return -EINVAL;
+
         /* Check that both start and end of the requested erase are
          * aligned with the erasesize at the appropriate addresses.
          */
@@ -1143,6 +1152,9 @@ static int cfi_staa_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         if (len & (mtd->erasesize -1))
                 return -EINVAL;
 
+        if ((len + ofs) > mtd->size)
+                return -EINVAL;
+
         chipnum = ofs >> cfi->chipshift;
         adr = ofs - (chipnum << cfi->chipshift);
 
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index f992418f40a..8e464054a63 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -173,6 +173,12 @@ int cfi_varsize_frob(struct mtd_info *mtd, varsize_frob_t frob,
         int i, first;
         struct mtd_erase_region_info *regions = mtd->eraseregions;
 
+        if (ofs > mtd->size)
+                return -EINVAL;
+
+        if ((len + ofs) > mtd->size)
+                return -EINVAL;
+
         /* Check that both start and end of the requested erase are
          * aligned with the erasesize at the appropriate addresses.
          */
diff --git a/drivers/mtd/chips/chipreg.c b/drivers/mtd/chips/chipreg.c
index 0bbc61ba952..da1f96f385c 100644
--- a/drivers/mtd/chips/chipreg.c
+++ b/drivers/mtd/chips/chipreg.c
@@ -76,7 +76,10 @@ struct mtd_info *do_map_probe(const char *name, struct map_info *map)
         */
         module_put(drv->module);
 
-        return ret;
+        if (ret)
+                return ret;
+
+        return NULL;
 }
 /*
  * Destroy an MTD device which was created for a map device.
diff --git a/drivers/mtd/chips/fwh_lock.h b/drivers/mtd/chips/fwh_lock.h
index 800b0e853e8..5e3cc80128a 100644
--- a/drivers/mtd/chips/fwh_lock.h
+++ b/drivers/mtd/chips/fwh_lock.h
@@ -34,7 +34,8 @@ static int fwh_xxlock_oneblock(struct map_info *map, struct flchip *chip,
 
         /* Refuse the operation if the we cannot look behind the chip */
         if (chip->start < 0x400000) {
-                pr_debug( "MTD %s(): chip->start: %lx wanted >= 0x400000\n",
+                DEBUG( MTD_DEBUG_LEVEL3,
+                        "MTD %s(): chip->start: %lx wanted >= 0x400000\n",
                         __func__, chip->start );
                 return -EIO;
         }
@@ -101,7 +102,7 @@ static void fixup_use_fwh_lock(struct mtd_info *mtd)
 {
         printk(KERN_NOTICE "using fwh lock/unlock method\n");
         /* Setup for the chips with the fwh lock method */
-        mtd->_lock   = fwh_lock_varsize;
-        mtd->_unlock = fwh_unlock_varsize;
+        mtd->lock   = fwh_lock_varsize;
+        mtd->unlock = fwh_unlock_varsize;
 }
 #endif /* FWH_LOCK_H */
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index c443f527a53..ea832ea0e4a 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1914,10 +1914,11 @@ static void jedec_reset(u32 base, struct map_info *map, struct cfi_private *cfi)
          * (oh and incidentaly the jedec spec - 3.5.3.3) the reset
          * sequence is *supposed* to be 0xaa at 0x5555, 0x55 at
          * 0x2aaa, 0xF0 at 0x5555 this will not affect the AMD chips
-         * as they will ignore the writes and don't care what address
+         * as they will ignore the writes and dont care what address
          * the F0 is written to */
         if (cfi->addr_unlock1) {
-                pr_debug( "reset unlock called %x %x \n",
+                DEBUG( MTD_DEBUG_LEVEL3,
+                       "reset unlock called %x %x \n",
                        cfi->addr_unlock1,cfi->addr_unlock2);
                 cfi_send_gen_cmd(0xaa, cfi->addr_unlock1, base, map, cfi, cfi->device_type, NULL);
                 cfi_send_gen_cmd(0x55, cfi->addr_unlock2, base, map, cfi, cfi->device_type, NULL);
@@ -1940,7 +1941,7 @@ static int cfi_jedec_setup(struct map_info *map, struct cfi_private *cfi, int in
         uint8_t uaddr;
 
         if (!(jedec_table[index].devtypes & cfi->device_type)) {
-                pr_debug("Rejecting potential %s with incompatible %d-bit device type\n",
+                DEBUG(MTD_DEBUG_LEVEL1, "Rejecting potential %s with incompatible %d-bit device type\n",
                       jedec_table[index].name, 4 * (1<<cfi->device_type));
                 return 0;
         }
@@ -2020,7 +2021,7 @@ static inline int jedec_match( uint32_t base,
                  * there aren't.
                  */
                 if (finfo->dev_id > 0xff) {
-                        pr_debug("%s(): ID is not 8bit\n",
+                        DEBUG( MTD_DEBUG_LEVEL3, "%s(): ID is not 8bit\n",
                                __func__);
                         goto match_done;
                 }
@@ -2044,10 +2045,12 @@ static inline int jedec_match( uint32_t base,
         }
 
         /* the part size must fit in the memory window */
-        pr_debug("MTD %s(): Check fit 0x%.8x + 0x%.8x = 0x%.8x\n",
+        DEBUG( MTD_DEBUG_LEVEL3,
+               "MTD %s(): Check fit 0x%.8x + 0x%.8x = 0x%.8x\n",
                __func__, base, 1 << finfo->dev_size, base + (1 << finfo->dev_size) );
         if ( base + cfi_interleave(cfi) * ( 1 << finfo->dev_size ) > map->size ) {
-                pr_debug("MTD %s(): 0x%.4x 0x%.4x %dKiB doesn't fit\n",
+                DEBUG( MTD_DEBUG_LEVEL3,
+                       "MTD %s(): 0x%.4x 0x%.4x %dKiB doesn't fit\n",
                        __func__, finfo->mfr_id, finfo->dev_id,
                        1 << finfo->dev_size );
                 goto match_done;
@@ -2058,12 +2061,13 @@ static inline int jedec_match( uint32_t base,
 
         uaddr = finfo->uaddr;
 
-        pr_debug("MTD %s(): check unlock addrs 0x%.4x 0x%.4x\n",
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): check unlock addrs 0x%.4x 0x%.4x\n",
                __func__, cfi->addr_unlock1, cfi->addr_unlock2 );
         if ( MTD_UADDR_UNNECESSARY != uaddr && MTD_UADDR_DONT_CARE != uaddr
              && ( unlock_addrs[uaddr].addr1 / cfi->device_type != cfi->addr_unlock1 ||
                   unlock_addrs[uaddr].addr2 / cfi->device_type != cfi->addr_unlock2 ) ) {
-                pr_debug("MTD %s(): 0x%.4x 0x%.4x did not match\n",
+                DEBUG( MTD_DEBUG_LEVEL3,
+                        "MTD %s(): 0x%.4x 0x%.4x did not match\n",
                         __func__,
                         unlock_addrs[uaddr].addr1,
                         unlock_addrs[uaddr].addr2);
@@ -2079,13 +2083,15 @@ static inline int jedec_match( uint32_t base,
          * FIXME - write a driver that takes all of the chip info as
          * module parameters, doesn't probe but forces a load.
          */
-        pr_debug("MTD %s(): check ID's disappear when not in ID mode\n",
+        DEBUG( MTD_DEBUG_LEVEL3,
+               "MTD %s(): check ID's disappear when not in ID mode\n",
                __func__ );
         jedec_reset( base, map, cfi );
         mfr = jedec_read_mfr( map, base, cfi );
         id = jedec_read_id( map, base, cfi );
         if ( mfr == cfi->mfr && id == cfi->id ) {
-                pr_debug("MTD %s(): ID 0x%.2x:0x%.2x did not change after reset:\n"
+                DEBUG( MTD_DEBUG_LEVEL3,
+                       "MTD %s(): ID 0x%.2x:0x%.2x did not change after reset:\n"
                        "You might need to manually specify JEDEC parameters.\n",
                         __func__, cfi->mfr, cfi->id );
                 goto match_done;
@@ -2098,7 +2104,7 @@ static inline int jedec_match( uint32_t base,
          * Put the device back in ID mode - only need to do this if we
          * were truly frobbing a real device.
          */
-        pr_debug("MTD %s(): return to ID mode\n", __func__ );
+        DEBUG( MTD_DEBUG_LEVEL3, "MTD %s(): return to ID mode\n", __func__ );
         if (cfi->addr_unlock1) {
                 cfi_send_gen_cmd(0xaa, cfi->addr_unlock1, base, map, cfi, cfi->device_type, NULL);
                 cfi_send_gen_cmd(0x55, cfi->addr_unlock2, base, map, cfi, cfi->device_type, NULL);
@@ -2161,11 +2167,13 @@ static int jedec_probe_chip(struct map_info *map, __u32 base,
 
                 cfi->mfr = jedec_read_mfr(map, base, cfi);
                 cfi->id = jedec_read_id(map, base, cfi);
-                pr_debug("Search for id:(%02x %02x) interleave(%d) type(%d)\n",
+                DEBUG(MTD_DEBUG_LEVEL3,
+                      "Search for id:(%02x %02x) interleave(%d) type(%d)\n",
                         cfi->mfr, cfi->id, cfi_interleave(cfi), cfi->device_type);
                 for (i = 0; i < ARRAY_SIZE(jedec_table); i++) {
                         if ( jedec_match( base, map, cfi, &jedec_table[i] ) ) {
-                                pr_debug("MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
+                                DEBUG( MTD_DEBUG_LEVEL3,
+                                       "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
                                        __func__, cfi->mfr, cfi->id,
                                        cfi->addr_unlock1, cfi->addr_unlock2 );
                                 if (!cfi_jedec_setup(map, cfi, i))
diff --git a/drivers/mtd/chips/map_absent.c b/drivers/mtd/chips/map_absent.c
index f7a5bca92ae..f2b87294687 100644
--- a/drivers/mtd/chips/map_absent.c
+++ b/drivers/mtd/chips/map_absent.c
@@ -55,10 +55,10 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
         mtd->name       = map->name;
         mtd->type       = MTD_ABSENT;
         mtd->size       = map->size;
-        mtd->_erase     = map_absent_erase;
-        mtd->_read      = map_absent_read;
-        mtd->_write     = map_absent_write;
-        mtd->_sync      = map_absent_sync;
+        mtd->erase      = map_absent_erase;
+        mtd->read       = map_absent_read;
+        mtd->write      = map_absent_write;
+        mtd->sync       = map_absent_sync;
         mtd->flags      = 0;
         mtd->erasesize  = PAGE_SIZE;
         mtd->writesize  = 1;
@@ -70,11 +70,13 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
 
 static int map_absent_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf)
 {
+        *retlen = 0;
         return -ENODEV;
 }
 
 static int map_absent_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
+        *retlen = 0;
         return -ENODEV;
 }
 
diff --git a/drivers/mtd/chips/map_ram.c b/drivers/mtd/chips/map_ram.c
index 991c2a1c05d..67640ccb2d4 100644
--- a/drivers/mtd/chips/map_ram.c
+++ b/drivers/mtd/chips/map_ram.c
@@ -64,11 +64,11 @@ static struct mtd_info *map_ram_probe(struct map_info *map)
         mtd->name = map->name;
         mtd->type = MTD_RAM;
         mtd->size = map->size;
-        mtd->_erase = mapram_erase;
-        mtd->_get_unmapped_area = mapram_unmapped_area;
-        mtd->_read = mapram_read;
-        mtd->_write = mapram_write;
-        mtd->_sync = mapram_nop;
+        mtd->erase = mapram_erase;
+        mtd->get_unmapped_area = mapram_unmapped_area;
+        mtd->read = mapram_read;
+        mtd->write = mapram_write;
+        mtd->sync = mapram_nop;
         mtd->flags = MTD_CAP_RAM;
         mtd->writesize = 1;
 
@@ -122,10 +122,14 @@ static int mapram_erase (struct mtd_info *mtd, struct erase_info *instr)
         unsigned long i;
 
         allff = map_word_ff(map);
+
         for (i=0; i<instr->len; i += map_bankwidth(map))
                 map_write(map, allff, instr->addr + i);
+
         instr->state = MTD_ERASE_DONE;
+
         mtd_erase_callback(instr);
+
         return 0;
 }
 
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 47a43cf7e5c..593f73d480d 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -41,11 +41,11 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
         mtd->name = map->name;
         mtd->type = MTD_ROM;
         mtd->size = map->size;
-        mtd->_get_unmapped_area = maprom_unmapped_area;
-        mtd->_read = maprom_read;
-        mtd->_write = maprom_write;
-        mtd->_sync = maprom_nop;
-        mtd->_erase = maprom_erase;
+        mtd->get_unmapped_area = maprom_unmapped_area;
+        mtd->read = maprom_read;
+        mtd->write = maprom_write;
+        mtd->sync = maprom_nop;
+        mtd->erase = maprom_erase;
         mtd->flags = MTD_CAP_ROM;
         mtd->erasesize = map->size;
         mtd->writesize = 1;
@@ -85,7 +85,8 @@ static void maprom_nop(struct mtd_info *mtd)
 
 static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
-        return -EROFS;
+        printk(KERN_NOTICE "maprom_write called\n");
+        return -EIO;
 }
 
 static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)