[MTD] NAND: Fix breakage all over the place

Following problems are addressed:

- wrong status caused early break out of nand_wait()
- removed the bogus status check in nand_wait() which
  is a relict of the abandoned support for interrupted
  erase.
- status check moved to the correct place in read_oob
- oob support for syndrom based ecc with strange layouts
- use given offset in the AUTOOOB based oob operations

Partially based on a patch from Vitaly Vool <vwool@ru.mvista.com>
Thanks to Savin Zlobec <savin@epico.si> for tracking down the
status problem.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>

4 files changed, 231 insertions, 88 deletions

diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index 5dd0b8d72c8b..aa18d45b264b 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -504,12 +504,12 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                         return ret;
 
                 ops.len = buf.length;
-                ops.ooblen = mtd->oobsize;
+                ops.ooblen = buf.length;
                 ops.ooboffs = buf.start & (mtd->oobsize - 1);
                 ops.datbuf = NULL;
                 ops.mode = MTD_OOB_PLACE;
 
-                if (ops.ooboffs && ops.len > (ops.ooblen - ops.ooboffs))
+                if (ops.ooboffs && ops.len > (mtd->oobsize - ops.ooboffs))
                         return -EINVAL;
 
                 ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);
@@ -553,12 +553,12 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                         return ret;
 
                 ops.len = buf.length;
-                ops.ooblen = mtd->oobsize;
+                ops.ooblen = buf.length;
                 ops.ooboffs = buf.start & (mtd->oobsize - 1);
                 ops.datbuf = NULL;
                 ops.mode = MTD_OOB_PLACE;
 
-                if (ops.ooboffs && ops.len > (ops.ooblen - ops.ooboffs))
+                if (ops.ooboffs && ops.len > (mtd->oobsize - ops.ooboffs))
                         return -EINVAL;
 
                 ops.oobbuf = kmalloc(buf.length, GFP_KERNEL);
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 463e12ced1b3..6107f532855b 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -464,7 +464,7 @@ static void __init doc2000_count_chips(struct mtd_info *mtd)
         printk(KERN_DEBUG "Detected %d chips per floor.\n", i);
 }
 
-static int doc200x_wait(struct mtd_info *mtd, struct nand_chip *this, int state)
+static int doc200x_wait(struct mtd_info *mtd, struct nand_chip *this)
 {
         struct doc_priv *doc = this->priv;
 
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index e74678e928cf..27083ed0a017 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -501,7 +501,6 @@ static void nand_command(struct mtd_info *mtd, unsigned int command,
         case NAND_CMD_ERASE2:
         case NAND_CMD_SEQIN:
         case NAND_CMD_STATUS:
-                chip->cmd_ctrl(mtd, NAND_CMD_NONE, NAND_NCE);
                 return;
 
         case NAND_CMD_RESET:
@@ -595,6 +594,7 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
         case NAND_CMD_ERASE1:
         case NAND_CMD_ERASE2:
         case NAND_CMD_SEQIN:
+        case NAND_CMD_RNDIN:
         case NAND_CMD_STATUS:
         case NAND_CMD_DEPLETE1:
                 return;
@@ -621,6 +621,14 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
                 while (!(chip->read_byte(mtd) & NAND_STATUS_READY)) ;
                 return;
 
+        case NAND_CMD_RNDOUT:
+                /* No ready / busy check necessary */
+                chip->cmd_ctrl(mtd, NAND_CMD_RNDOUTSTART,
+                               NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
+                chip->cmd_ctrl(mtd, NAND_CMD_NONE,
+                               NAND_NCE | NAND_CTRL_CHANGE);
+                return;
+
         case NAND_CMD_READ0:
                 chip->cmd_ctrl(mtd, NAND_CMD_READSTART,
                                NAND_NCE | NAND_CLE | NAND_CTRL_CHANGE);
@@ -689,18 +697,17 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
  * nand_wait - [DEFAULT]  wait until the command is done
  * @mtd:        MTD device structure
  * @this:       NAND chip structure
- * @state:      state to select the max. timeout value
  *
  * Wait for command done. This applies to erase and program only
  * Erase can take up to 400ms and program up to 20ms according to
  * general NAND and SmartMedia specs
  *
 */
-static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip, int state)
+static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip)
 {
 
         unsigned long timeo = jiffies;
-        int status;
+        int status, state = chip->state;
 
         if (state == FL_ERASING)
                 timeo += (HZ * 400) / 1000;
@@ -719,10 +726,6 @@ static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip, int state)
                 chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
 
         while (time_before(jiffies, timeo)) {
-                /* Check, if we were interrupted */
-                if (chip->state != state)
-                        return 0;
-
                 if (chip->dev_ready) {
                         if (chip->dev_ready(mtd))
                                 break;
@@ -909,12 +912,25 @@ static uint8_t *nand_transfer_oob(struct nand_chip *chip, uint8_t *oob,
 
         case MTD_OOB_AUTO: {
                 struct nand_oobfree *free = chip->ecc.layout->oobfree;
-                size_t bytes;
+                uint32_t boffs = 0, roffs = ops->ooboffs;
+                size_t bytes = 0;
 
                 for(; free->length && len; free++, len -= bytes) {
-                        bytes = min_t(size_t, len, free->length);
-
-                        memcpy(oob, chip->oob_poi + free->offset, bytes);
+                        /* Read request not from offset 0 ? */
+                        if (unlikely(roffs)) {
+                                if (roffs >= free->length) {
+                                        roffs -= free->length;
+                                        continue;
+                                }
+                                boffs = free->offset + roffs;
+                                bytes = min_t(size_t, len,
+                                              (free->length - roffs));
+                                roffs = 0;
+                        } else {
+                                bytes = min_t(size_t, len, free->length);
+                                boffs = free->offset;
+                        }
+                        memcpy(oob, chip->oob_poi + boffs, bytes);
                         oob += bytes;
                 }
                 return oob;
@@ -1084,6 +1100,145 @@ static int nand_read(struct mtd_info *mtd, loff_t from, size_t len,
 }
 
 /**
+ * nand_read_oob_std - [REPLACABLE] the most common OOB data read function
+ * @mtd:        mtd info structure
+ * @chip:       nand chip info structure
+ * @page:       page number to read
+ * @sndcmd:     flag whether to issue read command or not
+ */
+static int nand_read_oob_std(struct mtd_info *mtd, struct nand_chip *chip,
+                             int page, int sndcmd)
+{