Merge tag 'for-linus-3.4' of git://git.infradead.org/mtd-2.6

Pull MTD changes from David Woodhouse:
 - Artem's cleanup of the MTD API continues apace.
 - Fixes and improvements for ST FSMC and SuperH FLCTL NAND, amongst
   others.
 - More work on DiskOnChip G3, new driver for DiskOnChip G4.
 - Clean up debug/warning printks in JFFS2 to use pr_<level>.

Fix up various trivial conflicts, largely due to changes in calling
conventions for things like dmaengine_prep_slave_sg() (new inline
wrapper to hide new parameter, clashing with rewrite of previously last
parameter that used to be an 'append' flag, and is now a bitmap of
'unsigned long flags').

(Also some header file fallout - like so many merges this merge window -
and silly conflicts with sparse fixes)

* tag 'for-linus-3.4' of git://git.infradead.org/mtd-2.6: (120 commits)
  mtd: docg3 add protection against concurrency
  mtd: docg3 refactor cascade floors structure
  mtd: docg3 increase write/erase timeout
  mtd: docg3 fix inbound calculations
  mtd: nand: gpmi: fix function annotations
  mtd: phram: fix section mismatch for phram_setup
  mtd: unify initialization of erase_info->fail_addr
  mtd: support ONFI multi lun NAND
  mtd: sm_ftl: fix typo in major number.
  mtd: add device-tree support to spear_smi
  mtd: spear_smi: Remove default partition information from driver
  mtd: Add device-tree support to fsmc_nand
  mtd: fix section mismatch for doc_probe_device
  mtd: nand/fsmc: Remove sparse warnings and errors
  mtd: nand/fsmc: Add DMA support
  mtd: nand/fsmc: Access the NAND device word by word whenever possible
  mtd: nand/fsmc: Use dev_err to report error scenario
  mtd: nand/fsmc: Use devm routines
  mtd: nand/fsmc: Modify fsmc driver to accept nand timing parameters via platform
  mtd: fsmc_nand: add pm callbacks to support hibernation
  ...

8 files changed, 319 insertions, 127 deletions

diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 9bcd1f415f43..dbbd2edfb812 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -87,7 +87,7 @@ static int cfi_intelext_partition_fixup(struct mtd_info *, struct cfi_private **
 
 static int cfi_intelext_point (struct mtd_info *mtd, loff_t from, size_t len,
                      size_t *retlen, void **virt, resource_size_t *phys);
-static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
+static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len);
 
 static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
 static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr, int mode);
@@ -262,9 +262,9 @@ static void fixup_st_m28w320cb(struct mtd_info *mtd)
 static void fixup_use_point(struct mtd_info *mtd)
 {
         struct map_info *map = mtd->priv;
-        if (!mtd->point && map_is_linear(map)) {
-                mtd->point   = cfi_intelext_point;
-                mtd->unpoint = cfi_intelext_unpoint;
+        if (!mtd->_point && map_is_linear(map)) {
+                mtd->_point   = cfi_intelext_point;
+                mtd->_unpoint = cfi_intelext_unpoint;
         }
 }
 
@@ -274,8 +274,8 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
         struct cfi_private *cfi = map->fldrv_priv;
         if (cfi->cfiq->BufWriteTimeoutTyp) {
                 printk(KERN_INFO "Using buffer write method\n" );
-                mtd->write = cfi_intelext_write_buffers;
-                mtd->writev = cfi_intelext_writev;
+                mtd->_write = cfi_intelext_write_buffers;
+                mtd->_writev = cfi_intelext_writev;
         }
 }
 
@@ -443,15 +443,15 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
         mtd->type = MTD_NORFLASH;
 
         /* Fill in the default mtd operations */
-        mtd->erase   = cfi_intelext_erase_varsize;
-        mtd->read    = cfi_intelext_read;
-        mtd->write   = cfi_intelext_write_words;
-        mtd->sync    = cfi_intelext_sync;
-        mtd->lock    = cfi_intelext_lock;
-        mtd->unlock  = cfi_intelext_unlock;
-        mtd->is_locked = cfi_intelext_is_locked;
-        mtd->suspend = cfi_intelext_suspend;
-        mtd->resume  = cfi_intelext_resume;
+        mtd->_erase   = cfi_intelext_erase_varsize;
+        mtd->_read    = cfi_intelext_read;
+        mtd->_write   = cfi_intelext_write_words;
+        mtd->_sync    = cfi_intelext_sync;
+        mtd->_lock    = cfi_intelext_lock;
+        mtd->_unlock  = cfi_intelext_unlock;
+        mtd->_is_locked = cfi_intelext_is_locked;
+        mtd->_suspend = cfi_intelext_suspend;
+        mtd->_resume  = cfi_intelext_resume;
         mtd->flags   = MTD_CAP_NORFLASH;
         mtd->name    = map->name;
         mtd->writesize = 1;
@@ -600,12 +600,12 @@ static struct mtd_info *cfi_intelext_setup(struct mtd_info *mtd)
         }
 
 #ifdef CONFIG_MTD_OTP
-        mtd->read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
-        mtd->read_user_prot_reg = cfi_intelext_read_user_prot_reg;
-        mtd->write_user_prot_reg = cfi_intelext_write_user_prot_reg;
-        mtd->lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
-        mtd->get_fact_prot_info = cfi_intelext_get_fact_prot_info;
-        mtd->get_user_prot_info = cfi_intelext_get_user_prot_info;
+        mtd->_read_fact_prot_reg = cfi_intelext_read_fact_prot_reg;
+        mtd->_read_user_prot_reg = cfi_intelext_read_user_prot_reg;
+        mtd->_write_user_prot_reg = cfi_intelext_write_user_prot_reg;
+        mtd->_lock_user_prot_reg = cfi_intelext_lock_user_prot_reg;
+        mtd->_get_fact_prot_info = cfi_intelext_get_fact_prot_info;
+        mtd->_get_user_prot_info = cfi_intelext_get_user_prot_info;
 #endif
 
         /* This function has the potential to distort the reality
@@ -1017,8 +1017,6 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
         case FL_READY:
         case FL_STATUS:
         case FL_JEDEC_QUERY:
-                /* We should really make set_vpp() count, rather than doing this */
-                DISABLE_VPP(map);
                 break;
         default:
                 printk(KERN_ERR "%s: put_chip() called with oldstate %d!!\n", map->name, chip->oldstate);
@@ -1324,7 +1322,7 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         int chipnum;
         int ret = 0;
 
-        if (!map->virt || (from + len > mtd->size))
+        if (!map->virt)
                 return -EINVAL;
 
         /* Now lock the chip(s) to POINT state */
@@ -1334,7 +1332,6 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         ofs = from - (chipnum << cfi->chipshift);
 
         *virt = map->virt + cfi->chips[chipnum].start + ofs;
-        *retlen = 0;
         if (phys)
                 *phys = map->phys + cfi->chips[chipnum].start + ofs;
 
@@ -1369,12 +1366,12 @@ static int cfi_intelext_point(struct mtd_info *mtd, loff_t from, size_t len,
         return 0;
 }
 
-static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
+static int cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
 {
         struct map_info *map = mtd->priv;
         struct cfi_private *cfi = map->fldrv_priv;
         unsigned long ofs;
-        int chipnum;
+        int chipnum, err = 0;
 
         /* Now unlock the chip(s) POINT state */
 
@@ -1382,7 +1379,7 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
-        while (len) {
+        while (len && !err) {
                 unsigned long thislen;
                 struct flchip *chip;
 
@@ -1400,8 +1397,10 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                         chip->ref_point_counter--;
                         if(chip->ref_point_counter == 0)
                                 chip->state = FL_READY;
-                } else
-                        printk(KERN_ERR "%s: Warning: unpoint called on non pointed region\n", map->name); /* Should this give an error? */
+                } else {
+                        printk(KERN_ERR "%s: Error: unpoint called on non pointed region\n", map->name);
+                        err = -EINVAL;
+                }
 
                 put_chip(map, chip, chip->start);
                 mutex_unlock(&chip->mutex);
@@ -1410,6 +1409,8 @@ static void cfi_intelext_unpoint(struct mtd_info *mtd, loff_t from, size_t len)
                 ofs = 0;
                 chipnum++;
         }
+
+        return err;
 }
 
 static inline int do_read_onechip(struct map_info *map, struct flchip *chip, loff_t adr, size_t len, u_char *buf)
@@ -1456,8 +1457,6 @@ static int cfi_intelext_read (struct mtd_info *mtd, loff_t from, size_t len, siz
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
-        *retlen = 0;
-
         while (len) {
                 unsigned long thislen;
 
@@ -1551,7 +1550,8 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, adr);
- out:   put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -1565,10 +1565,6 @@ static int cfi_intelext_write_words (struct mtd_info *mtd, loff_t to , size_t le
         int chipnum;
         unsigned long ofs;
 
-        *retlen = 0;
-        if (!len)
-                return 0;
-
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
@@ -1794,7 +1790,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, cmd_adr);
- out:   put_chip(map, chip, cmd_adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, cmd_adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -1813,7 +1810,6 @@ static int cfi_intelext_writev (struct mtd_info *mtd, const struct kvec *vecs,
         for (i = 0; i < count; i++)
                 len += vecs[i].iov_len;
 
-        *retlen = 0;
         if (!len)
                 return 0;
 
@@ -1932,6 +1928,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
                         ret = -EIO;
                 } else if (chipstatus & 0x20 && retries--) {
                         printk(KERN_DEBUG "block erase failed at 0x%08lx: status 0x%lx. Retrying...\n", adr, chipstatus);
+                        DISABLE_VPP(map);
                         put_chip(map, chip, adr);
                         mutex_unlock(&chip->mutex);
                         goto retry;
@@ -1944,7 +1941,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         }
 
         xip_enable(map, chip, adr);
- out:   put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -2086,7 +2084,8 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
         }
 
         xip_enable(map, chip, adr);
-out:    put_chip(map, chip, adr);
+ out:   DISABLE_VPP(map);
+        put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
 }
@@ -2483,7 +2482,7 @@ static int cfi_intelext_suspend(struct mtd_info *mtd)
                            allowed to. Or should we return -EAGAIN, because the upper layers
                            ought to have already shut down anything which was using the device
                            anyway? The latter for now. */
-                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->oldstate);
+                        printk(KERN_NOTICE "Flash device refused suspend due to active operation (state %d)\n", chip->state);
                         ret = -EAGAIN;
                 case FL_PM_SUSPENDED:
                         break;
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 8d70895a58d6..d02592e6a0f0 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -59,6 +59,9 @@ static void cfi_amdstd_resume (struct mtd_info *);
 static int cfi_amdstd_reboot(struct notifier_block *, unsigned long, void *);
 static int cfi_amdstd_secsi_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 
+static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
+                                  size_t *retlen, const u_char *buf);
+
 static void cfi_amdstd_destroy(struct mtd_info *);
 
 struct mtd_info *cfi_cmdset_0002(struct map_info *, int);
@@ -189,7 +192,7 @@ static void fixup_use_write_buffers(struct mtd_info *mtd)
         struct cfi_private *cfi = map->fldrv_priv;
         if (cfi->cfiq->BufWriteTimeoutTyp) {
                 pr_debug("Using buffer write method\n" );
-                mtd->write = cfi_amdstd_write_buffers;
+                mtd->_write = cfi_amdstd_write_buffers;
         }
 }
 
@@ -228,8 +231,8 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd)
 static void fixup_use_secsi(struct mtd_info *mtd)
 {
         /* Setup for chips with a secsi area */
-        mtd->read_user_prot_reg = cfi_amdstd_secsi_read;
-        mtd->read_fact_prot_reg = cfi_amdstd_secsi_read;
+        mtd->_read_user_prot_reg = cfi_amdstd_secsi_read;
+        mtd->_read_fact_prot_reg = cfi_amdstd_secsi_read;
 }
 
 static void fixup_use_erase_chip(struct mtd_info *mtd)
@@ -238,7 +241,7 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
         struct cfi_private *cfi = map->fldrv_priv;
         if ((cfi->cfiq->NumEraseRegions == 1) &&
                 ((cfi->cfiq->EraseRegionInfo[0] & 0xffff) == 0)) {
-                mtd->erase = cfi_amdstd_erase_chip;
+                mtd->_erase = cfi_amdstd_erase_chip;
         }
 
 }
@@ -249,8 +252,8 @@ static void fixup_use_erase_chip(struct mtd_info *mtd)
  */
 static void fixup_use_atmel_lock(struct mtd_info *mtd)
 {
-        mtd->lock = cfi_atmel_lock;
-        mtd->unlock = cfi_atmel_unlock;
+        mtd->_lock = cfi_atmel_lock;
+        mtd->_unlock = cfi_atmel_unlock;
         mtd->flags |= MTD_POWERUP_LOCK;
 }
 
@@ -429,12 +432,12 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
         mtd->type = MTD_NORFLASH;
 
         /* Fill in the default mtd operations */
-        mtd->erase   = cfi_amdstd_erase_varsize;
-        mtd->write   = cfi_amdstd_write_words;
-        mtd->read    = cfi_amdstd_read;
-        mtd->sync    = cfi_amdstd_sync;
-        mtd->suspend = cfi_amdstd_suspend;
-        mtd->resume  = cfi_amdstd_resume;
+        mtd->_erase   = cfi_amdstd_erase_varsize;
+        mtd->_write   = cfi_amdstd_write_words;
+        mtd->_read    = cfi_amdstd_read;
+        mtd->_sync    = cfi_amdstd_sync;
+        mtd->_suspend = cfi_amdstd_suspend;
+        mtd->_resume  = cfi_amdstd_resume;
         mtd->flags   = MTD_CAP_NORFLASH;
         mtd->name    = map->name;
         mtd->writesize = 1;
@@ -443,6 +446,7 @@ struct mtd_info *cfi_cmdset_0002(struct map_info *map, int primary)
         pr_debug("MTD %s(): write buffer size %d\n", __func__,
                         mtd->writebufsize);
 
+        mtd->_panic_write = cfi_amdstd_panic_write;
         mtd->reboot_notifier.notifier_call = cfi_amdstd_reboot;
 
         if (cfi->cfi_mode==CFI_MODE_CFI){
@@ -770,8 +774,6 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad
 
         case FL_READY:
         case FL_STATUS:
-                /* We should really make set_vpp() count, rather than doing this */
-                DISABLE_VPP(map);
                 break;
         default:
                 printk(KERN_ERR "MTD: put_chip() called with oldstate %d!!\n", chip->oldstate);
@@ -1013,13 +1015,9 @@ static int cfi_amdstd_read (struct mtd_info *mtd, loff_t from, size_t len, size_
         int ret = 0;
 
         /* ofs: offset within the first chip that the first read should start */
-
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
-
-        *retlen = 0;
-
         while (len) {
                 unsigned long thislen;
 
@@ -1097,16 +1095,11 @@ static int cfi_amdstd_secsi_read (struct mtd_info *mtd, loff_t from, size_t len,
         int chipnum;
         int ret = 0;
 
-
         /* ofs: offset within the first chip that the first read should start */
-
         /* 8 secsi bytes per chip */
         chipnum=from>>3;
         ofs=from & 7;
 
-
-        *retlen = 0;
-
         while (len) {
                 unsigned long thislen;
 
@@ -1234,6 +1227,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
         xip_enable(map, chip, adr);
  op_done:
         chip->state = FL_READY;
+        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1251,10 +1245,6 @@ static int cfi_amdstd_write_words(struct mtd_info *mtd, loff_t to, size_t len,
         unsigned long ofs, chipstart;
         DECLARE_WAITQUEUE(wait, current);
 
-        *retlen = 0;
-        if (!len)
-                return 0;
-
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
         chipstart = cfi->chips[chipnum].start;
@@ -1476,6 +1466,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
         ret = -EIO;
  op_done:
         chip->state = FL_READY;
+        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1493,10 +1484,6 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
         int chipnum;
         unsigned long ofs;
 
-        *retlen = 0;
-        if (!len)
-                return 0;
-
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
@@ -1562,6 +1549,238 @@ static int cfi_amdstd_write_buffers(struct mtd_info *mtd, loff_t to, size_t len,
         return 0;
 }
 
+/*
+ * Wait for the flash chip to become ready to write data
+ *
+ * This is only called during the panic_write() path. When panic_write()
+ * is called, the kernel is in the process of a panic, and will soon be
+ * dead. Therefore we don't take any locks, and attempt to get access
+ * to the chip as soon as possible.
+ */
+static int cfi_amdstd_panic_wait(struct map_info *map, struct flchip *chip,
+                                 unsigned long adr)
+{
+        struct cfi_private *cfi = map->fldrv_priv;
+        int retries = 10;
+        int i;
+
+        /*
+         * If the driver thinks the chip is idle, and no toggle bits
+         * are changing, then the chip is actually idle for sure.
+         */
+        if (chip->state == FL_READY && chip_ready(map, adr))
+                return 0;
+
+        /*
+         * Try several times to reset the chip and then wait for it
+         * to become idle. The upper limit of a few milliseconds of
+         * delay isn't a big problem: the kernel is dying anyway. It
+         * is more important to save the messages.
+         */
+        while (retries > 0) {
+                const unsigned long timeo = (HZ / 1000) + 1;
+
+                /* send the reset command */
+                map_write(map, CMD(0xF0), chip->start);
+
+                /* wait for the chip to become ready */
+                for (i = 0; i < jiffies_to_usecs(timeo); i++) {
+                        if (chip_ready(map, adr))
+                                return 0;
+
+                        udelay(1);
+                }
+        }
+
+        /* the chip never became ready */
+        return -EBUSY;
+}
+
+/*
+ * Write out one word of data to a single flash chip during a kernel panic
+ *
+ * This is only called during the panic_write() path. When panic_write()
+ * is called, the kernel is in the process of a panic, and will soon be
+ * dead. Therefore we don't take any locks, and attempt to get access
+ * to the chip as soon as possible.
+ *
+ * The implementation of this routine is intentionally similar to
+ * do_write_oneword(), in order to ease code maintenance.
+ */
+static int do_panic_write_oneword(struct map_info *map, struct flchip *chip,
+                                  unsigned long adr, map_word datum)
+{
+        const unsigned long uWriteTimeout = (HZ / 1000) + 1;
+        struct cfi_private *cfi = map->fldrv_priv;
+        int retry_cnt = 0;
+        map_word oldd;
+        int ret = 0;
+        int i;
+
+        adr += chip->start;
+
+        ret = cfi_amdstd_panic_wait(map, chip, adr);
+        if (ret)
+                return ret;
+
+        pr_debug("MTD %s(): PANIC WRITE 0x%.8lx(0x%.8lx)\n",
+                        __func__, adr, datum.x[0]);
+
+        /*
+         * Check for a NOP for the case when the datum to write is already
+         * present - it saves time and works around buggy chips that corrupt
+         * data at other locations when 0xff is written to a location that
+         * already contains 0xff.
+         */
+        oldd = map_read(map, adr);
+        if (map_word_equal(map, oldd, datum)) {
+                pr_debug("MTD %s(): NOP\n", __func__);
+                goto op_done;
+        }
+
+        ENABLE_VPP(map);
+
+retry:
+        cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xA0, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL);
+        map_write(map, datum, adr);
+
+        for (i = 0; i < jiffies_to_usecs(uWriteTimeout); i++) {
+                if (chip_ready(map, adr))
+                        break;
+
+                udelay(1);
+        }
+
+        if (!chip_good(map, adr, datum)) {
+                /* reset on all failures. */
+                map_write(map, CMD(0xF0), chip->start);
+                /* FIXME - should have reset delay before continuing */
+
+                if (++retry_cnt <= MAX_WORD_RETRIES)
+                        goto retry;
+
+                ret = -EIO;
+        }
+
+op_done:
+        DISABLE_VPP(map);
+        return ret;
+}
+
+/*
+ * Write out some data during a kernel panic
+ *
+ * This is used by the mtdoops driver to save the dying messages from a
+ * kernel which has panic'd.
+ *
+ * This routine ignores all of the locking used throughout the rest of the
+ * driver, in order to ensure that the data gets written out no matter what
+ * state this driver (and the flash chip itself) was in when the kernel crashed.
+ *
+ * The implementation of this routine is intentionally similar to
+ * cfi_amdstd_write_words(), in order to ease code maintenance.
+ */
+static int cfi_amdstd_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
+                                  size_t *retlen, const u_char *buf)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        unsigned long ofs, chipstart;
+        int ret = 0;
+        int chipnum;
+
+        chipnum = to >> cfi->chipshift;
+        ofs = to - (chipnum << cfi->chipshift);
+        chipstart = cfi->chips[chipnum].start;
+
+        /* If it's not bus aligned, do the first byte write */
+        if (ofs & (map_bankwidth(map) - 1)) {
+                unsigned long bus_ofs = ofs & ~(map_bankwidth(map) - 1);
+                int i = ofs - bus_ofs;
+                int n = 0;
+                map_word tmp_buf;
+
+                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], bus_ofs);
+                if (ret)
+                        return ret;
+
+                /* Load 'tmp_buf' with old contents of flash */
+                tmp_buf = map_read(map, bus_ofs + chipstart);
+
+                /* Number of bytes to copy from buffer */
+                n = min_t(int, len, map_bankwidth(map) - i);
+
+                tmp_buf = map_word_load_partial(map, tmp_buf, buf, i, n);
+
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             bus_ofs, tmp_buf);
+                if (ret)
+                        return ret;
+
+                ofs += n;
+                buf += n;
+                (*retlen) += n;
+                len -= n;
+
+                if (ofs >> cfi->chipshift) {
+                        chipnum++;
+                        ofs = 0;
+                        if (chipnum == cfi->numchips)
+                                return 0;
+                }
+        }
+
+        /* We are now aligned, write as much as possible */
+        while (len >= map_bankwidth(map)) {
+                map_word datum;
+
+                datum = map_word_load(map, buf);
+
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             ofs, datum);
+                if (ret)
+                        return ret;
+
+                ofs += map_bankwidth(map);
+                buf += map_bankwidth(map);
+                (*retlen) += map_bankwidth(map);
+                len -= map_bankwidth(map);
+
+                if (ofs >> cfi->chipshift) {
+                        chipnum++;
+                        ofs = 0;
+                        if (chipnum == cfi->numchips)
+                                return 0;
+
+                        chipstart = cfi->chips[chipnum].start;
+                }
+        }
+
+        /* Write the trailing bytes if any */
+        if (len & (map_bankwidth(map) - 1)) {
+                map_word tmp_buf;
+
+                ret = cfi_amdstd_panic_wait(map, &cfi->chips[chipnum], ofs);
+                if (ret)
+                        return ret;
+
+                tmp_buf = map_read(map, ofs + chipstart);
+
+                tmp_buf = map_word_load_partial(map, tmp_buf, buf, 0, len);
+
+                ret = do_panic_write_oneword(map, &cfi->chips[chipnum],
+                                             ofs, tmp_buf);
+                if (ret)
+                        return ret;
+
+                (*retlen) += len;
+        }
+
+        return 0;
+}
+
 
 /*
  * Handle devices with one erase region, that only implement
@@ -1649,6 +1868,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip)
 
         chip->state = FL_READY;
         xip_enable(map, chip, adr);
+        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
 
@@ -1739,6 +1959,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
         }
 
         chip->state = FL_READY;
+        DISABLE_VPP(map);
         put_chip(map, chip, adr);
         mutex_unlock(&chip->mutex);
         return ret;
diff --git a/drivers/mtd/chips/cfi_cmdset_0020.c b/drivers/mtd/chips/cfi_cmdset_0020.c
index 85e80180b65b..096993f9711e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0020.c
+++ b/drivers/mtd/chips/cfi_cmdset_0020.c
@@ -228,15 +228,15 @@ static struct mtd_info *cfi_staa_setup(struct map_info *map)
                 }
 
         /* Also select the correct geometry setup too */
-        mtd->erase = cfi_staa_erase_varsize;
-        mtd->read = cfi_staa_read;
-        mtd->write = cfi_staa_write_buffers;
-        mtd->writev = cfi_staa_writev;
-        mtd->sync = cfi_staa_sync;
-        mtd->lock = cfi_staa_lock;
-        mtd->unlock = cfi_staa_unlock;
-        mtd->suspend = cfi_staa_suspend;
-        mtd->resume = cfi_staa_resume;
+        mtd->_erase = cfi_staa_erase_varsize;
+        mtd->_read = cfi_staa_read;
+        mtd->_write = cfi_staa_write_buffers;
+        mtd->_writev = cfi_staa_writev;
+        mtd->_sync = cfi_staa_sync;
+        mtd->_lock = cfi_staa_lock;
+        mtd->_unlock = cfi_staa_unlock;
+        mtd->_suspend = cfi_staa_suspend;
+        mtd->_resume = cfi_staa_resume;
         mtd->flags = MTD_CAP_NORFLASH & ~MTD_BIT_WRITEABLE;
         mtd->writesize = 8; /* FIXME: Should be 0 for STMicro flashes w/out ECC */
         mtd->writebufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
@@ -394,8 +394,6 @@ static int cfi_staa_read (struct mtd_info *mtd, loff_t from, size_t len, size_t
         chipnum = (from >> cfi->chipshift);
         ofs = from - (chipnum <<  cfi->chipshift);
 
-        *retlen = 0;
-
         while (len) {
                 unsigned long thislen;
 
@@ -617,10 +615,6 @@ static int cfi_staa_write_buffers (struct mtd_info *mtd, loff_t to,
         int chipnum;
         unsigned long ofs;
 
-        *retlen = 0;
-        if (!len)
-                return 0;
-
         chipnum = to >> cfi->chipshift;
         ofs = to  - (chipnum << cfi->chipshift);
 
@@ -904,12 +898,6 @@ static int cfi_staa_erase_varsize(struct mtd_info *mtd,
         int i, first;
         struct mtd_erase_region_info *regions = mtd->eraseregions;
 
-        if (instr->addr > mtd->size)
-                return -EINVAL;
-
-        if ((instr->len + instr->addr) > mtd->size)
-                return -EINVAL;
-
         /* Check that both start and end of the requested erase are
          * aligned with the erasesize at the appropriate addresses.
          */
@@ -1155,9 +1143,6 @@ static int cfi_staa_lock(struct mtd_info *mtd, loff_t ofs, uint64_t len)
         if (len & (mtd->erasesize -1))
                 return -EINVAL;
 
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
-
         chipnum = ofs >> cfi->chipshift;
         adr = ofs - (chipnum << cfi->chipshift);
 
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index 8e464054a631..f992418f40a8 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -173,12 +173,6 @@ int cfi_varsize_frob(struct mtd_info *mtd, varsize_frob_t frob,
         int i, first;
         struct mtd_erase_region_info *regions = mtd->eraseregions;
 
-        if (ofs > mtd->size)
-                return -EINVAL;
-
-        if ((len + ofs) > mtd->size)
-                return -EINVAL;
-
         /* Check that both start and end of the requested erase are
          * aligned with the erasesize at the appropriate addresses.
          */
diff --git a/drivers/mtd/chips/fwh_lock.h b/drivers/mtd/chips/fwh_lock.h
index 89c6595454a5..800b0e853e86 100644
--- a/drivers/mtd/chips/fwh_lock.h
+++ b/drivers/mtd/chips/fwh_lock.h
@@ -101,7 +101,7 @@ static void fixup_use_fwh_lock(struct mtd_info *mtd)
 {
         printk(KERN_NOTICE "using fwh lock/unlock method\n");
         /* Setup for the chips with the fwh lock method */
-        mtd->lock   = fwh_lock_varsize;
-        mtd->unlock = fwh_unlock_varsize;
+        mtd->_lock   = fwh_lock_varsize;
+        mtd->_unlock = fwh_unlock_varsize;
 }
 #endif /* FWH_LOCK_H */
diff --git a/drivers/mtd/chips/map_absent.c b/drivers/mtd/chips/map_absent.c
index f2b872946871..f7a5bca92aef 100644
--- a/drivers/mtd/chips/map_absent.c
+++ b/drivers/mtd/chips/map_absent.c
@@ -55,10 +55,10 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
         mtd->name       = map->name;
         mtd->type       = MTD_ABSENT;
         mtd->size       = map->size;
-        mtd->erase      = map_absent_erase;
-        mtd->read       = map_absent_read;
-        mtd->write      = map_absent_write;
-        mtd->sync       = map_absent_sync;
+        mtd->_erase     = map_absent_erase;
+        mtd->_read      = map_absent_read;
+        mtd->_write     = map_absent_write;
+        mtd->_sync      = map_absent_sync;
         mtd->flags      = 0;
         mtd->erasesize  = PAGE_SIZE;
         mtd->writesize  = 1;
@@ -70,13 +70,11 @@ static struct mtd_info *map_absent_probe(struct map_info *map)
 
 static int map_absent_read(struct mtd_info *mtd, loff_t from, size_t len, size_t *retlen, u_char *buf)
 {
-        *retlen = 0;
         return -ENODEV;
 }
 
 static int map_absent_write(struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
-        *retlen = 0;
         return -ENODEV;
 }
 
diff --git a/drivers/mtd/chips/map_ram.c b/drivers/mtd/chips/map_ram.c
index 67640ccb2d41..991c2a1c05d3 100644
--- a/drivers/mtd/chips/map_ram.c
+++ b/drivers/mtd/chips/map_ram.c
@@ -64,11 +64,11 @@ static struct mtd_info *map_ram_probe(struct map_info *map)
         mtd->name = map->name;
         mtd->type = MTD_RAM;
         mtd->size = map->size;
-        mtd->erase = mapram_erase;
-        mtd->get_unmapped_area = mapram_unmapped_area;
-        mtd->read = mapram_read;
-        mtd->write = mapram_write;
-        mtd->sync = mapram_nop;
+        mtd->_erase = mapram_erase;
+        mtd->_get_unmapped_area = mapram_unmapped_area;
+        mtd->_read = mapram_read;
+        mtd->_write = mapram_write;
+        mtd->_sync = mapram_nop;
         mtd->flags = MTD_CAP_RAM;
         mtd->writesize = 1;
 
@@ -122,14 +122,10 @@ static int mapram_erase (struct mtd_info *mtd, struct erase_info *instr)
         unsigned long i;
 
         allff = map_word_ff(map);
-
         for (i=0; i<instr->len; i += map_bankwidth(map))
                 map_write(map, allff, instr->addr + i);
-
         instr->state = MTD_ERASE_DONE;
-
         mtd_erase_callback(instr);
-
         return 0;
 }
 
diff --git a/drivers/mtd/chips/map_rom.c b/drivers/mtd/chips/map_rom.c
index 593f73d480d2..47a43cf7e5c6 100644
--- a/drivers/mtd/chips/map_rom.c
+++ b/drivers/mtd/chips/map_rom.c
@@ -41,11 +41,11 @@ static struct mtd_info *map_rom_probe(struct map_info *map)
         mtd->name = map->name;
         mtd->type = MTD_ROM;
         mtd->size = map->size;
-        mtd->get_unmapped_area = maprom_unmapped_area;
-        mtd->read = maprom_read;
-        mtd->write = maprom_write;
-        mtd->sync = maprom_nop;
-        mtd->erase = maprom_erase;
+        mtd->_get_unmapped_area = maprom_unmapped_area;
+        mtd->_read = maprom_read;
+        mtd->_write = maprom_write;
+        mtd->_sync = maprom_nop;
+        mtd->_erase = maprom_erase;
         mtd->flags = MTD_CAP_ROM;
         mtd->erasesize = map->size;
         mtd->writesize = 1;
@@ -85,8 +85,7 @@ static void maprom_nop(struct mtd_info *mtd)
 
 static int maprom_write (struct mtd_info *mtd, loff_t to, size_t len, size_t *retlen, const u_char *buf)
 {
-        printk(KERN_NOTICE "maprom_write called\n");
-        return -EIO;
+        return -EROFS;
 }
 
 static int maprom_erase (struct mtd_info *mtd, struct erase_info *info)