41 files changed, 2594 insertions, 1282 deletions
diff --git a/Documentation/mtd/nand_ecc.txt b/Documentation/mtd/nand_ecc.txt
new file mode 100644
index 000000000000..bdf93b7f0f24
--- /dev/null
+++ b/Documentation/mtd/nand_ecc.txt
@@ -0,0 +1,714 @@
+Introduction
+============
+Having looked at the linux mtd/nand driver and more specific at nand_ecc.c
+I felt there was room for optimisation. I bashed the code for a few hours
+performing tricks like table lookup removing superfluous code etc.
+After that the speed was increased by 35-40%.
+Still I was not too happy as I felt there was additional room for improvement.
+Bad! I was hooked.
+I decided to annotate my steps in this file. Perhaps it is useful to someone
+or someone learns something from it.
+The problem
+===========
+NAND flash (at least SLC one) typically has sectors of 256 bytes.
+However NAND flash is not extremely reliable so some error detection
+(and sometimes correction) is needed.
+This is done by means of a Hamming code. I'll try to explain it in
+laymans terms (and apologies to all the pro's in the field in case I do
+not use the right terminology, my coding theory class was almost 30
+years ago, and I must admit it was not one of my favourites).
+As I said before the ecc calculation is performed on sectors of 256
+bytes. This is done by calculating several parity bits over the rows and
+columns. The parity used is even parity which means that the parity bit = 1
+if the data over which the parity is calculated is 1 and the parity bit = 0
+if the data over which the parity is calculated is 0. So the total
+number of bits over the data over which the parity is calculated + the
+parity bit is even. (see wikipedia if you can't follow this).
+Parity is often calculated by means of an exclusive or operation,
+sometimes also referred to as xor. In C the operator for xor is ^
+Back to ecc.
+Let's give a small figure:
+byte   0:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp0 rp2 rp4 ... rp14
+byte   1:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp1 rp2 rp4 ... rp14
+byte   2:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp0 rp3 rp4 ... rp14
+byte   3:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp1 rp3 rp4 ... rp14
+byte   4:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp0 rp2 rp5 ... rp14
+....
+byte 254:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp0 rp3 rp5 ... rp15
+byte 255:  bit7 bit6 bit5 bit4 bit3 bit2 bit1 bit0   rp1 rp3 rp5 ... rp15
+           cp1  cp0  cp1  cp0  cp1  cp0  cp1  cp0
+           cp3  cp3  cp2  cp2  cp3  cp3  cp2  cp2
+           cp5  cp5  cp5  cp5  cp4  cp4  cp4  cp4
+This figure represents a sector of 256 bytes.
+cp is my abbreviaton for column parity, rp for row parity.
+Let's start to explain column parity.
+cp0 is the parity that belongs to all bit0, bit2, bit4, bit6.
+so the sum of all bit0, bit2, bit4 and bit6 values + cp0 itself is even.
+Similarly cp1 is the sum of all bit1, bit3, bit5 and bit7.
+cp2 is the parity over bit0, bit1, bit4 and bit5
+cp3 is the parity over bit2, bit3, bit6 and bit7.
+cp4 is the parity over bit0, bit1, bit2 and bit3.
+cp5 is the parity over bit4, bit5, bit6 and bit7.
+Note that each of cp0 .. cp5 is exactly one bit.
+Row parity actually works almost the same.
+rp0 is the parity of all even bytes (0, 2, 4, 6, ... 252, 254)
+rp1 is the parity of all odd bytes (1, 3, 5, 7, ..., 253, 255)
+rp2 is the parity of all bytes 0, 1, 4, 5, 8, 9, ...
+(so handle two bytes, then skip 2 bytes).
+rp3 is covers the half rp2 does not cover (bytes 2, 3, 6, 7, 10, 11, ...)
+for rp4 the rule is cover 4 bytes, skip 4 bytes, cover 4 bytes, skip 4 etc.
+so rp4 calculates parity over bytes 0, 1, 2, 3, 8, 9, 10, 11, 16, ...)
+and rp5 covers the other half, so bytes 4, 5, 6, 7, 12, 13, 14, 15, 20, ..
+The story now becomes quite boring. I guess you get the idea.
+rp6 covers 8 bytes then skips 8 etc
+rp7 skips 8 bytes then covers 8 etc
+rp8 covers 16 bytes then skips 16 etc
+rp9 skips 16 bytes then covers 16 etc
+rp10 covers 32 bytes then skips 32 etc
+rp11 skips 32 bytes then covers 32 etc
+rp12 covers 64 bytes then skips 64 etc
+rp13 skips 64 bytes then covers 64 etc
+rp14 covers 128 bytes then skips 128
+rp15 skips 128 bytes then covers 128
+In the end the parity bits are grouped together in three bytes as
+follows:
+ECC    Bit 7 Bit 6 Bit 5 Bit 4 Bit 3 Bit 2 Bit 1 Bit 0
+ECC 0   rp07  rp06  rp05  rp04  rp03  rp02  rp01  rp00
+ECC 1   rp15  rp14  rp13  rp12  rp11  rp10  rp09  rp08
+ECC 2   cp5   cp4   cp3   cp2   cp1   cp0      1     1
+I detected after writing this that ST application note AN1823
+(http://www.st.com/stonline/books/pdf/docs/10123.pdf) gives a much
+nicer picture.(but they use line parity as term where I use row parity)
+Oh well, I'm graphically challenged, so suffer with me for a moment :-)
+And I could not reuse the ST picture anyway for copyright reasons.
+Attempt 0
+=========
+Implementing the parity calculation is pretty simple.
+In C pseudocode:
+for (i = 0; i < 256; i++)
+{
+    if (i & 0x01)
+       rp1 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp1;
+    else
+       rp0 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp1;
+    if (i & 0x02)
+       rp3 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp3;
+    else
+       rp2 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp2;
+    if (i & 0x04)
+      rp5 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp5;
+    else
+      rp4 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp4;
+    if (i & 0x08)
+      rp7 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp7;
+    else
+      rp6 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp6;
+    if (i & 0x10)
+      rp9 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp9;
+    else
+      rp8 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp8;
+    if (i & 0x20)
+      rp11 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp11;
+    else
+    rp10 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp10;
+    if (i & 0x40)
+      rp13 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp13;
+    else
+      rp12 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp12;
+    if (i & 0x80)
+      rp15 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp15;
+    else
+      rp14 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ bit3 ^ bit2 ^ bit1 ^ bit0 ^ rp14;
+    cp0 = bit6 ^ bit4 ^ bit2 ^ bit0 ^ cp0;
+    cp1 = bit7 ^ bit5 ^ bit3 ^ bit1 ^ cp1;
+    cp2 = bit5 ^ bit4 ^ bit1 ^ bit0 ^ cp2;
+    cp3 = bit7 ^ bit6 ^ bit3 ^ bit2 ^ cp3
+    cp4 = bit3 ^ bit2 ^ bit1 ^ bit0 ^ cp4
+    cp5 = bit7 ^ bit6 ^ bit5 ^ bit4 ^ cp5
+}
+Analysis 0
+==========
+C does have bitwise operators but not really operators to do the above
+efficiently (and most hardware has no such instructions either).
+Therefore without implementing this it was clear that the code above was
+not going to bring me a Nobel prize :-)
+Fortunately the exclusive or operation is commutative, so we can combine
+the values in any order. So instead of calculating all the bits
+individually, let us try to rearrange things.
+For the column parity this is easy. We can just xor the bytes and in the
+end filter out the relevant bits. This is pretty nice as it will bring
+all cp calculation out of the if loop.
+Similarly we can first xor the bytes for the various rows.
+This leads to:
+Attempt 1
+=========
+const char parity[256] = {
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+    0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0
+};
+void ecc1(const unsigned char *buf, unsigned char *code)
+{
+    int i;
+    const unsigned char *bp = buf;
+    unsigned char cur;
+    unsigned char rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
+    unsigned char rp8, rp9, rp10, rp11, rp12, rp13, rp14, rp15;
+    unsigned char par;
+    par = 0;
+    rp0 = 0; rp1 = 0; rp2 = 0; rp3 = 0;
+    rp4 = 0; rp5 = 0; rp6 = 0; rp7 = 0;
+    rp8 = 0; rp9 = 0; rp10 = 0; rp11 = 0;
+    rp12 = 0; rp13 = 0; rp14 = 0; rp15 = 0;
+    for (i = 0; i < 256; i++)
+    {
+        cur = *bp++;
+        par ^= cur;
+        if (i & 0x01) rp1 ^= cur; else rp0 ^= cur;
+        if (i & 0x02) rp3 ^= cur; else rp2 ^= cur;
+        if (i & 0x04) rp5 ^= cur; else rp4 ^= cur;
+        if (i & 0x08) rp7 ^= cur; else rp6 ^= cur;
+        if (i & 0x10) rp9 ^= cur; else rp8 ^= cur;
+        if (i & 0x20) rp11 ^= cur; else rp10 ^= cur;
+        if (i & 0x40) rp13 ^= cur; else rp12 ^= cur;
+        if (i & 0x80) rp15 ^= cur; else rp14 ^= cur;
+    }
+    code[0] =
+        (parity[rp7] << 7) |
+        (parity[rp6] << 6) |
+        (parity[rp5] << 5) |
+        (parity[rp4] << 4) |
+        (parity[rp3] << 3) |
+        (parity[rp2] << 2) |
+        (parity[rp1] << 1) |
+        (parity[rp0]);
+    code[1] =
+        (parity[rp15] << 7) |
+        (parity[rp14] << 6) |
+        (parity[rp13] << 5) |
+        (parity[rp12] << 4) |
+        (parity[rp11] << 3) |
+        (parity[rp10] << 2) |
+        (parity[rp9]  << 1) |
+        (parity[rp8]);
+    code[2] =
+        (parity[par & 0xf0] << 7) |
+        (parity[par & 0x0f] << 6) |
+        (parity[par & 0xcc] << 5) |
+        (parity[par & 0x33] << 4) |
+        (parity[par & 0xaa] << 3) |
+        (parity[par & 0x55] << 2);
+    code[0] = ~code[0];
+    code[1] = ~code[1];
+    code[2] = ~code[2];
+}
+Still pretty straightforward. The last three invert statements are there to
+give a checksum of 0xff 0xff 0xff for an empty flash. In an empty flash
+all data is 0xff, so the checksum then matches.
+I also introduced the parity lookup. I expected this to be the fastest
+way to calculate the parity, but I will investigate alternatives later
+on.
+Analysis 1
+==========
+The code works, but is not terribly efficient. On my system it took
+almost 4 times as much time as the linux driver code. But hey, if it was
+*that* easy this would have been done long before.
+No pain. no gain.
+Fortunately there is plenty of room for improvement.
+In step 1 we moved from bit-wise calculation to byte-wise calculation.
+However in C we can also use the unsigned long data type and virtually
+every modern microprocessor supports 32 bit operations, so why not try
+to write our code in such a way that we process data in 32 bit chunks.
+Of course this means some modification as the row parity is byte by
+byte. A quick analysis:
+for the column parity we use the par variable. When extending to 32 bits
+we can in the end easily calculate p0 and p1 from it.
+(because par now consists of 4 bytes, contributing to rp1, rp0, rp1, rp0
+respectively)
+also rp2 and rp3 can be easily retrieved from par as rp3 covers the
+first two bytes and rp2 the last two bytes.
+Note that of course now the loop is executed only 64 times (256/4).
+And note that care must taken wrt byte ordering. The way bytes are
+ordered in a long is machine dependent, and might affect us.
+Anyway, if there is an issue: this code is developed on x86 (to be
+precise: a DELL PC with a D920 Intel CPU)
+And of course the performance might depend on alignment, but I expect
+that the I/O buffers in the nand driver are aligned properly (and
+otherwise that should be fixed to get maximum performance).
+Let's give it a try...
+Attempt 2
+=========
+extern const char parity[256];
+void ecc2(const unsigned char *buf, unsigned char *code)
+{
+    int i;
+    const unsigned long *bp = (unsigned long *)buf;
+    unsigned long cur;
+    unsigned long rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
+    unsigned long rp8, rp9, rp10, rp11, rp12, rp13, rp14, rp15;
+    unsigned long par;
+    par = 0;
+    rp0 = 0; rp1 = 0; rp2 = 0; rp3 = 0;
+    rp4 = 0; rp5 = 0; rp6 = 0; rp7 = 0;
+    rp8 = 0; rp9 = 0; rp10 = 0; rp11 = 0;
+    rp12 = 0; rp13 = 0; rp14 = 0; rp15 = 0;
+    for (i = 0; i < 64; i++)
+    {
+        cur = *bp++;
+        par ^= cur;
+        if (i & 0x01) rp5 ^= cur; else rp4 ^= cur;
+        if (i & 0x02) rp7 ^= cur; else rp6 ^= cur;
+        if (i & 0x04) rp9 ^= cur; else rp8 ^= cur;
+        if (i & 0x08) rp11 ^= cur; else rp10 ^= cur;
+        if (i & 0x10) rp13 ^= cur; else rp12 ^= cur;
+        if (i & 0x20) rp15 ^= cur; else rp14 ^= cur;
+    }
+    /*
+       we need to adapt the code generation for the fact that rp vars are now
+       long; also the column parity calculation needs to be changed.
+       we'll bring rp4 to 15 back to single byte entities by shifting and
+       xoring
+    */
+    rp4 ^= (rp4 >> 16); rp4 ^= (rp4 >> 8); rp4 &= 0xff;
+    rp5 ^= (rp5 >> 16); rp5 ^= (rp5 >> 8); rp5 &= 0xff;
+    rp6 ^= (rp6 >> 16); rp6 ^= (rp6 >> 8); rp6 &= 0xff;
+    rp7 ^= (rp7 >> 16); rp7 ^= (rp7 >> 8); rp7 &= 0xff;
+    rp8 ^= (rp8 >> 16); rp8 ^= (rp8 >> 8); rp8 &= 0xff;
+    rp9 ^= (rp9 >> 16); rp9 ^= (rp9 >> 8); rp9 &= 0xff;
+    rp10 ^= (rp10 >> 16); rp10 ^= (rp10 >> 8); rp10 &= 0xff;
+    rp11 ^= (rp11 >> 16); rp11 ^= (rp11 >> 8); rp11 &= 0xff;
+    rp12 ^= (rp12 >> 16); rp12 ^= (rp12 >> 8); rp12 &= 0xff;
+    rp13 ^= (rp13 >> 16); rp13 ^= (rp13 >> 8); rp13 &= 0xff;
+    rp14 ^= (rp14 >> 16); rp14 ^= (rp14 >> 8); rp14 &= 0xff;
+    rp15 ^= (rp15 >> 16); rp15 ^= (rp15 >> 8); rp15 &= 0xff;
+    rp3 = (par >> 16); rp3 ^= (rp3 >> 8); rp3 &= 0xff;
+    rp2 = par & 0xffff; rp2 ^= (rp2 >> 8); rp2 &= 0xff;
+    par ^= (par >> 16);
+    rp1 = (par >> 8); rp1 &= 0xff;
+    rp0 = (par & 0xff);
+    par ^= (par >> 8); par &= 0xff;
+    code[0] =
+        (parity[rp7] << 7) |
+        (parity[rp6] << 6) |
+        (parity[rp5] << 5) |
+        (parity[rp4] << 4) |
+        (parity[rp3] << 3) |
+        (parity[rp2] << 2) |
+        (parity[rp1] << 1) |
+        (parity[rp0]);
+    code[1] =
+        (parity[rp15] << 7) |
+        (parity[rp14] << 6) |
+        (parity[rp13] << 5) |
+        (parity[rp12] << 4) |
+        (parity[rp11] << 3) |
+        (parity[rp10] << 2) |
+        (parity[rp9]  << 1) |
+        (parity[rp8]);
+    code[2] =
+        (parity[par & 0xf0] << 7) |
+        (parity[par & 0x0f] << 6) |
+        (parity[par & 0xcc] << 5) |
+        (parity[par & 0x33] << 4) |
+        (parity[par & 0xaa] << 3) |
+        (parity[par & 0x55] << 2);
+    code[0] = ~code[0];
+    code[1] = ~code[1];
+    code[2] = ~code[2];
+}
+The parity array is not shown any more. Note also that for these
+examples I kinda deviated from my regular programming style by allowing
+multiple statements on a line, not using { } in then and else blocks
+with only a single statement and by using operators like ^=
+Analysis 2
+==========
+The code (of course) works, and hurray: we are a little bit faster than
+the linux driver code (about 15%). But wait, don't cheer too quickly.
+THere is more to be gained.
+If we look at e.g. rp14 and rp15 we see that we either xor our data with
+rp14 or with rp15. However we also have par which goes over all data.
+This means there is no need to calculate rp14 as it can be calculated from
+rp15 through rp14 = par ^ rp15;
+(or if desired we can avoid calculating rp15 and calculate it from
+rp14).  That is why some places refer to inverse parity.
+Of course the same thing holds for rp4/5, rp6/7, rp8/9, rp10/11 and rp12/13.
+Effectively this means we can eliminate the else clause from the if
+statements. Also we can optimise the calculation in the end a little bit
+by going from long to byte first. Actually we can even avoid the table
+lookups
+Attempt 3
+=========
+Odd replaced:
+        if (i & 0x01) rp5 ^= cur; else rp4 ^= cur;
+        if (i & 0x02) rp7 ^= cur; else rp6 ^= cur;
+        if (i & 0x04) rp9 ^= cur; else rp8 ^= cur;
+        if (i & 0x08) rp11 ^= cur; else rp10 ^= cur;
+        if (i & 0x10) rp13 ^= cur; else rp12 ^= cur;
+        if (i & 0x20) rp15 ^= cur; else rp14 ^= cur;
+with
+        if (i & 0x01) rp5 ^= cur;
+        if (i & 0x02) rp7 ^= cur;
+        if (i & 0x04) rp9 ^= cur;
+        if (i & 0x08) rp11 ^= cur;
+        if (i & 0x10) rp13 ^= cur;
+        if (i & 0x20) rp15 ^= cur;
+        and outside the loop added:
+    rp4  = par ^ rp5;
+    rp6  = par ^ rp7;
+    rp8  = par ^ rp9;
+    rp10  = par ^ rp11;
+    rp12  = par ^ rp13;
+    rp14  = par ^ rp15;
+And after that the code takes about 30% more time, although the number of
+statements is reduced. This is also reflected in the assembly code.
+Analysis 3
+==========
+Very weird. Guess it has to do with caching or instruction parallellism
+or so. I also tried on an eeePC (Celeron, clocked at 900 Mhz). Interesting
+observation was that this one is only 30% slower (according to time)
+executing the code as my 3Ghz D920 processor.
+Well, it was expected not to be easy so maybe instead move to a
+different track: let's move back to the code from attempt2 and do some
+loop unrolling. This will eliminate a few if statements. I'll try
+different amounts of unrolling to see what works best.
+Attempt 4
+=========
+Unrolled the loop 1, 2, 3 and 4 times.
+For 4 the code starts with:
+    for (i = 0; i < 4; i++)
+    {
+        cur = *bp++;
+        par ^= cur;
+        rp4 ^= cur;
+        rp6 ^= cur;
+        rp8 ^= cur;
+        rp10 ^= cur;
+        if (i & 0x1) rp13 ^= cur; else rp12 ^= cur;
+        if (i & 0x2) rp15 ^= cur; else rp14 ^= cur;
+        cur = *bp++;
+        par ^= cur;
+        rp5 ^= cur;
+        rp6 ^= cur;
+        ...
+Analysis 4
+==========
+Unrolling once gains about 15%
+Unrolling twice keeps the gain at about 15%
+Unrolling three times gives a gain of 30% compared to attempt 2.
+Unrolling four times gives a marginal improvement compared to unrolling
+three times.
+I decided to proceed with a four time unrolled loop anyway. It was my gut
+feeling that in the next steps I would obtain additional gain from it.
+The next step was triggered by the fact that par contains the xor of all
+bytes and rp4 and rp5 each contain the xor of half of the bytes.
+So in effect par = rp4 ^ rp5. But as xor is commutative we can also say
+that rp5 = par ^ rp4. So no need to keep both rp4 and rp5 around. We can
+eliminate rp5 (or rp4, but I already foresaw another optimisation).
+The same holds for rp6/7, rp8/9, rp10/11 rp12/13 and rp14/15.
+Attempt 5
+=========
+Effectively so all odd digit rp assignments in the loop were removed.
+This included the else clause of the if statements.
+Of course after the loop we need to correct things by adding code like:
+    rp5 = par ^ rp4;
+Also the initial assignments (rp5 = 0; etc) could be removed.
+Along the line I also removed the initialisation of rp0/1/2/3.
+Analysis 5
+==========
+Measurements showed this was a good move. The run-time roughly halved
+compared with attempt 4 with 4 times unrolled, and we only require 1/3rd
+of the processor time compared to the current code in the linux kernel.
+However, still I thought there was more. I didn't like all the if
+statements. Why not keep a running parity and only keep the last if
+statement. Time for yet another version!
+Attempt 6
+=========
+THe code within the for loop was changed to:
+    for (i = 0; i < 4; i++)
+    {
+        cur = *bp++; tmppar  = cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= tmppar;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp8 ^= tmppar;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur; rp6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp10 ^= tmppar;
+            cur = *bp++; tmppar ^= cur; rp4 ^= cur; rp6 ^= cur; rp8 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur; rp8 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp4 ^= cur; rp8 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp8 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur; rp6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur;
+            par ^= tmppar;
+        if ((i & 0x1) == 0) rp12 ^= tmppar;
+        if ((i & 0x2) == 0) rp14 ^= tmppar;
+    }
+As you can see tmppar is used to accumulate the parity within a for
+iteration. In the last 3 statements is is added to par and, if needed,
+to rp12 and rp14.
+While making the changes I also found that I could exploit that tmppar
+contains the running parity for this iteration. So instead of having:
+rp4 ^= cur; rp6 = cur;
+I removed the rp6 = cur; statement and did rp6 ^= tmppar; on next
+statement. A similar change was done for rp8 and rp10
+Analysis 6
+==========
+Measuring this code again showed big gain. When executing the original
+linux code 1 million times, this took about 1 second on my system.
+(using time to measure the performance). After this iteration I was back
+to 0.075 sec. Actually I had to decide to start measuring over 10
+million interations in order not to loose too much accuracy. This one
+definitely seemed to be the jackpot!
+There is a little bit more room for improvement though. There are three
+places with statements:
+rp4 ^= cur; rp6 ^= cur;
+It seems more efficient to also maintain a variable rp4_6 in the while
+loop; This eliminates 3 statements per loop. Of course after the loop we
+need to correct by adding:
+    rp4 ^= rp4_6;
+    rp6 ^= rp4_6
+Furthermore there are 4 sequential assingments to rp8. This can be
+encoded slightly more efficient by saving tmppar before those 4 lines
+and later do rp8 = rp8 ^ tmppar ^ notrp8;
+(where notrp8 is the value of rp8 before those 4 lines).
+Again a use of the commutative property of xor.
+Time for a new test!
+Attempt 7
+=========
+The new code now looks like:
+    for (i = 0; i < 4; i++)
+    {
+        cur = *bp++; tmppar  = cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= tmppar;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp8 ^= tmppar;
+        cur = *bp++; tmppar ^= cur; rp4_6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp10 ^= tmppar;
+            notrp8 = tmppar;
+            cur = *bp++; tmppar ^= cur; rp4_6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur;
+            cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur;
+            rp8 = rp8 ^ tmppar ^ notrp8;
+        cur = *bp++; tmppar ^= cur; rp4_6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp6 ^= cur;
+        cur = *bp++; tmppar ^= cur; rp4 ^= cur;
+        cur = *bp++; tmppar ^= cur;
+            par ^= tmppar;
+        if ((i & 0x1) == 0) rp12 ^= tmppar;
+        if ((i & 0x2) == 0) rp14 ^= tmppar;
+    }
+    rp4 ^= rp4_6;
+    rp6 ^= rp4_6;
+Not a big change, but every penny counts :-)
+Analysis 7
+==========
+Acutally this made things worse. Not very much, but I don't want to move
+into the wrong direction. Maybe something to investigate later. Could
+have to do with caching again.
+Guess that is what there is to win within the loop. Maybe unrolling one
+more time will help. I'll keep the optimisations from 7 for now.
+Attempt 8
+=========
+Unrolled the loop one more time.
+Analysis 8
+==========
+This makes things worse. Let's stick with attempt 6 and continue from there.
+Although it seems that the code within the loop cannot be optimised
+further there is still room to optimize the generation of the ecc codes.
+We can simply calcualate the total parity. If this is 0 then rp4 = rp5
+etc. If the parity is 1, then rp4 = !rp5;
+But if rp4 = rp5 we do not need rp5 etc. We can just write the even bits
+in the result byte and then do something like
+    code[0] |= (code[0] << 1);
+Lets test this.
+Attempt 9
+=========
+Changed the code but again this slightly degrades performance. Tried all
+kind of other things, like having dedicated parity arrays to avoid the
+shift after parity[rp7] << 7; No gain.
+Change the lookup using the parity array by using shift operators (e.g.
+replace parity[rp7] << 7 with:
+rp7 ^= (rp7 << 4);
+rp7 ^= (rp7 << 2);
+rp7 ^= (rp7 << 1);
+rp7 &= 0x80;
+No gain.
+The only marginal change was inverting the parity bits, so we can remove
+the last three invert statements.
+Ah well, pity this does not deliver more. Then again 10 million
+iterations using the linux driver code takes between 13 and 13.5
+seconds, whereas my code now takes about 0.73 seconds for those 10
+million iterations. So basically I've improved the performance by a
+factor 18 on my system. Not that bad. Of course on different hardware
+you will get different results. No warranties!
+But of course there is no such thing as a free lunch. The codesize almost
+tripled (from 562 bytes to 1434 bytes). Then again, it is not that much.
+Correcting errors
+=================
+For correcting errors I again used the ST application note as a starter,
+but I also peeked at the existing code.
+The algorithm itself is pretty straightforward. Just xor the given and
+the calculated ecc. If all bytes are 0 there is no problem. If 11 bits
+are 1 we have one correctable bit error. If there is 1 bit 1, we have an
+error in the given ecc code.
+It proved to be fastest to do some table lookups. Performance gain
+introduced by this is about a factor 2 on my system when a repair had to
+be done, and 1% or so if no repair had to be done.
+Code size increased from 330 bytes to 686 bytes for this function.
+(gcc 4.2, -O3)
+Conclusion
+==========
+The gain when calculating the ecc is tremendous. Om my development hardware
+a speedup of a factor of 18 for ecc calculation was achieved. On a test on an
+embedded system with a MIPS core a factor 7 was obtained.
+On  a test with a Linksys NSLU2 (ARMv5TE processor) the speedup was a factor
+5 (big endian mode, gcc 4.1.2, -O3)
+For correction not much gain could be obtained (as bitflips are rare). Then
+again there are also much less cycles spent there.
+It seems there is not much more gain possible in this, at least when
+programmed in C. Of course it might be possible to squeeze something more
+out of it with an assembler program, but due to pipeline behaviour etc
+this is very tricky (at least for intel hw).
+Author: Frans Meulenbroeks
+Copyright (C) 2008 Koninklijke Philips Electronics NV.
diff --git a/arch/arm/plat-omap/include/mach/onenand.h b/arch/arm/plat-omap/include/mach/onenand.h
index d57f20226b28..4649d302c263 100644
--- a/arch/arm/plat-omap/include/mach/onenand.h
+++ b/arch/arm/plat-omap/include/mach/onenand.h
@@ -16,6 +16,10 @@ struct omap_onenand_platform_data {
        int                     gpio_irq;
        struct mtd_partition    *parts;
        int                     nr_parts;
-        int                     (*onenand_setup)(void __iomem *);
+        int                     (*onenand_setup)(void __iomem *, int freq);
        int                     dma_channel;
 };
+int omap2_onenand_rephase(void);
+#define ONENAND_MAX_PARTITIONS 8
diff --git a/drivers/mtd/Kconfig b/drivers/mtd/Kconfig
index 14f11f8b9e5f..a90d50c2c3e5 100644
--- a/drivers/mtd/Kconfig
+++ b/drivers/mtd/Kconfig
@@ -172,6 +172,11 @@ config MTD_CHAR
          memory chips, and also use ioctl() to obtain information about
          the device, or to erase parts of it.
+config HAVE_MTD_OTP
+        bool
+        help
+          Enable access to OTP regions using MTD_CHAR.
 config MTD_BLKDEVS
        tristate "Common interface to block layer for MTD 'translation layers'"
        depends on BLOCK
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index 479d32b57a1e..9401bfec4623 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -154,6 +154,7 @@ config MTD_CFI_I8
 config MTD_OTP
        bool "Protection Registers aka one-time programmable (OTP) bits"
        depends on MTD_CFI_ADV_OPTIONS
+        select HAVE_MTD_OTP
        default n
        help
          This enables support for reading, writing and locking so called
@@ -187,7 +188,7 @@ config MTD_CFI_INTELEXT
          StrataFlash and other parts.
 config MTD_CFI_AMDSTD
-        tristate "Support for AMD/Fujitsu flash chips"
+        tristate "Support for AMD/Fujitsu/Spansion flash chips"
        depends on MTD_GEN_PROBE
        select MTD_CFI_UTIL
        help
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index 5f1b472137a0..5157e3cb4b9e 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -478,6 +478,28 @@ struct mtd_info *cfi_cmdset_0001(struct map_info *map, int primary)
                else
                        cfi->chips[i].erase_time = 2000000;
+                if (cfi->cfiq->WordWriteTimeoutTyp &&
+                    cfi->cfiq->WordWriteTimeoutMax)
+                        cfi->chips[i].word_write_time_max =
+                                1<<(cfi->cfiq->WordWriteTimeoutTyp +
+                                    cfi->cfiq->WordWriteTimeoutMax);
+                else
+                        cfi->chips[i].word_write_time_max = 50000 * 8;
+                if (cfi->cfiq->BufWriteTimeoutTyp &&
+                    cfi->cfiq->BufWriteTimeoutMax)
+                        cfi->chips[i].buffer_write_time_max =
+                                1<<(cfi->cfiq->BufWriteTimeoutTyp +
+                                    cfi->cfiq->BufWriteTimeoutMax);
+                if (cfi->cfiq->BlockEraseTimeoutTyp &&
+                    cfi->cfiq->BlockEraseTimeoutMax)
+                        cfi->chips[i].erase_time_max =
+                                1000<<(cfi->cfiq->BlockEraseTimeoutTyp +
+                                       cfi->cfiq->BlockEraseTimeoutMax);
+                else
+                        cfi->chips[i].erase_time_max = 2000000 * 8;
                cfi->chips[i].ref_point_counter = 0;
                init_waitqueue_head(&(cfi->chips[i].wq));
        }
@@ -1012,7 +1034,7 @@ static void __xipram xip_enable(struct map_info *map, struct flchip *chip,
 static int __xipram xip_wait_for_operation(
                struct map_info *map, struct flchip *chip,
-                unsigned long adr, unsigned int chip_op_time )
+                unsigned long adr, unsigned int chip_op_time_max)
 {
        struct cfi_private *cfi = map->fldrv_priv;
        struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
@@ -1021,7 +1043,7 @@ static int __xipram xip_wait_for_operation(
        flstate_t oldstate, newstate;
        start = xip_currtime();
-        usec = chip_op_time * 8;
+        usec = chip_op_time_max;
        if (usec == 0)
                usec = 500000;
        done = 0;
@@ -1131,8 +1153,8 @@ static int __xipram xip_wait_for_operation(
 #define XIP_INVAL_CACHED_RANGE(map, from, size)  \
        INVALIDATE_CACHED_RANGE(map, from, size)
-#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec) \
+#define INVAL_CACHE_AND_WAIT(map, chip, cmd_adr, inval_adr, inval_len, usec, usec_max) \
-        xip_wait_for_operation(map, chip, cmd_adr, usec)
+        xip_wait_for_operation(map, chip, cmd_adr, usec_max)
 #else
@@ -1144,7 +1166,7 @@ static int __xipram xip_wait_for_operation(
 static int inval_cache_and_wait_for_operation(
                struct map_info *map, struct flchip *chip,
                unsigned long cmd_adr, unsigned long inval_adr, int inval_len,
-                unsigned int chip_op_time)
+                unsigned int chip_op_time, unsigned int chip_op_time_max)
 {
        struct cfi_private *cfi = map->fldrv_priv;
        map_word status, status_OK = CMD(0x80);
@@ -1156,8 +1178,7 @@ static int inval_cache_and_wait_for_operation(
                INVALIDATE_CACHED_RANGE(map, inval_adr, inval_len);
        spin_lock(chip->mutex);
-        /* set our timeout to 8 times the expected delay */
+        timeo = chip_op_time_max;
-        timeo = chip_op_time * 8;
        if (!timeo)
                timeo = 500000;
        reset_timeo = timeo;
@@ -1217,8 +1238,8 @@ static int inval_cache_and_wait_for_operation(
 #endif
-#define WAIT_TIMEOUT(map, chip, adr, udelay) \
+#define WAIT_TIMEOUT(map, chip, adr, udelay, udelay_max) \
-        INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay);
+        INVAL_CACHE_AND_WAIT(map, chip, adr, 0, 0, udelay, udelay_max);
 static int do_point_onechip (struct map_info *map, struct flchip *chip, loff_t adr, size_t len)
@@ -1452,7 +1473,8 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                   adr, map_bankwidth(map),
-                                   chip->word_write_time);
+                                   chip->word_write_time,
+                                   chip->word_write_time_max);
        if (ret) {
                xip_enable(map, chip, adr);
                printk(KERN_ERR "%s: word write error (status timeout)\n", map->name);
@@ -1623,7 +1645,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        chip->state = FL_WRITING_TO_BUFFER;
        map_write(map, write_cmd, cmd_adr);
-        ret = WAIT_TIMEOUT(map, chip, cmd_adr, 0);
+        ret = WAIT_TIMEOUT(map, chip, cmd_adr, 0, 0);
        if (ret) {
                /* Argh. Not ready for write to buffer */
                map_word Xstatus = map_read(map, cmd_adr);
@@ -1640,7 +1662,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        /* Figure out the number of words to write */
        word_gap = (-adr & (map_bankwidth(map)-1));
-        words = (len - word_gap + map_bankwidth(map) - 1) / map_bankwidth(map);
+        words = DIV_ROUND_UP(len - word_gap, map_bankwidth(map));
        if (!word_gap) {
                words--;
        } else {
@@ -1692,7 +1714,8 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, cmd_adr,
                                   initial_adr, initial_len,
-                                   chip->buffer_write_time);
+                                   chip->buffer_write_time,
+                                   chip->buffer_write_time_max);
        if (ret) {
                map_write(map, CMD(0x70), cmd_adr);
                chip->state = FL_STATUS;
@@ -1827,7 +1850,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip,
        ret = INVAL_CACHE_AND_WAIT(map, chip, adr,
                                   adr, len,
-                                   chip->erase_time);
+                                   chip->erase_time,
+                                   chip->erase_time_max);
        if (ret) {
                map_write(map, CMD(0x70), adr);
                chip->state = FL_STATUS;
@@ -2006,7 +2030,7 @@ static int __xipram do_xxlock_oneblock(struct map_info *map, struct flchip *chip
         */
        udelay = (!extp || !(extp->FeatureSupport & (1 << 5))) ? 1000000/HZ : 0;
-        ret = WAIT_TIMEOUT(map, chip, adr, udelay);
+        ret = WAIT_TIMEOUT(map, chip, adr, udelay, udelay * 100);
        if (ret) {
                map_write(map, CMD(0x70), adr);
                chip->state = FL_STATUS;
diff --git a/drivers/mtd/chips/cfi_probe.c b/drivers/mtd/chips/cfi_probe.c
index c418e92e1d92..e63e6749429a 100644
--- a/drivers/mtd/chips/cfi_probe.c
+++ b/drivers/mtd/chips/cfi_probe.c
@@ -44,17 +44,14 @@ do { \
 #define xip_enable(base, map, cfi) \
 do { \
-        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL); \
+        cfi_qry_mode_off(base, map, cfi);               \
-        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL); \
        xip_allowed(base, map); \
 } while (0)
 #define xip_disable_qry(base, map, cfi) \
 do { \
        xip_disable(); \
-        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL); \
+        cfi_qry_mode_on(base, map, cfi); \
-        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL); \
-        cfi_send_gen_cmd(0x98, 0x55, base, map, cfi, cfi->device_type, NULL); \
 } while (0)
 #else
@@ -70,32 +67,6 @@ do { \
   in: interleave,type,mode
   ret: table index, <0 for error
 */
-static int __xipram qry_present(struct map_info *map, __u32 base,
-                                struct cfi_private *cfi)
-{
-        int osf = cfi->interleave * cfi->device_type;   // scale factor
-        map_word val[3];
-        map_word qry[3];
-        qry[0] = cfi_build_cmd('Q', map, cfi);
-        qry[1] = cfi_build_cmd('R', map, cfi);
-        qry[2] = cfi_build_cmd('Y', map, cfi);
-        val[0] = map_read(map, base + osf*0x10);
-        val[1] = map_read(map, base + osf*0x11);
-        val[2] = map_read(map, base + osf*0x12);
-        if (!map_word_equal(map, qry[0], val[0]))
-                return 0;
-        if (!map_word_equal(map, qry[1], val[1]))
-                return 0;
-        if (!map_word_equal(map, qry[2], val[2]))
-                return 0;
-        return 1;       // "QRY" found
-}
 static int __xipram cfi_probe_chip(struct map_info *map, __u32 base,
                                   unsigned long *chip_map, struct cfi_private *cfi)
@@ -116,11 +87,7 @@ static int __xipram cfi_probe_chip(struct map_info *map, __u32 base,
        }
        xip_disable();
-        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        if (!cfi_qry_mode_on(base, map, cfi)) {
-        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
-        cfi_send_gen_cmd(0x98, 0x55, base, map, cfi, cfi->device_type, NULL);
-        if (!qry_present(map,base,cfi)) {
                xip_enable(base, map, cfi);
                return 0;
        }
@@ -141,14 +108,13 @@ static int __xipram cfi_probe_chip(struct map_info *map, __u32 base,
                start = i << cfi->chipshift;
                /* This chip should be in read mode if it's one
                   we've already touched. */
-                if (qry_present(map, start, cfi)) {
+                if (cfi_qry_present(map, start, cfi)) {
                        /* Eep. This chip also had the QRY marker.
                         * Is it an alias for the new one? */
-                        cfi_send_gen_cmd(0xF0, 0, start, map, cfi, cfi->device_type, NULL);
+                        cfi_qry_mode_off(start, map, cfi);
-                        cfi_send_gen_cmd(0xFF, 0, start, map, cfi, cfi->device_type, NULL);
                        /* If the QRY marker goes away, it's an alias */
-                        if (!qry_present(map, start, cfi)) {
+                        if (!cfi_qry_present(map, start, cfi)) {
                                xip_allowed(base, map);
                                printk(KERN_DEBUG "%s: Found an alias at 0x%x for the chip at 0x%lx\n",
                                       map->name, base, start);
@@ -158,10 +124,9 @@ static int __xipram cfi_probe_chip(struct map_info *map, __u32 base,
                         * unfortunate. Stick the new chip in read mode
                         * too and if it's the same, assume it's an alias. */
                        /* FIXME: Use other modes to do a proper check */
-                        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+                        cfi_qry_mode_off(base, map, cfi);
-                        cfi_send_gen_cmd(0xFF, 0, start, map, cfi, cfi->device_type, NULL);
-                        if (qry_present(map, base, cfi)) {
+                        if (cfi_qry_present(map, base, cfi)) {
                                xip_allowed(base, map);
                                printk(KERN_DEBUG "%s: Found an alias at 0x%x for the chip at 0x%lx\n",
                                       map->name, base, start);
@@ -176,8 +141,7 @@ static int __xipram cfi_probe_chip(struct map_info *map, __u32 base,
        cfi->numchips++;
        /* Put it back into Read Mode */
-        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_qry_mode_off(base, map, cfi);
-        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
        xip_allowed(base, map);
        printk(KERN_INFO "%s: Found %d x%d devices at 0x%x in %d-bit bank\n",
@@ -237,9 +201,7 @@ static int __xipram cfi_chip_setup(struct map_info *map,
                          cfi_read_query(map, base + 0xf * ofs_factor);
        /* Put it back into Read Mode */
-        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_qry_mode_off(base, map, cfi);
-        /* ... even if it's an Intel chip */
-        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
        xip_allowed(base, map);
        /* Do any necessary byteswapping */
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index 0ee457018016..34d40e25d312 100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -24,6 +24,66 @@
 #include <linux/mtd/cfi.h>
 #include <linux/mtd/compatmac.h>
+int __xipram cfi_qry_present(struct map_info *map, __u32 base,
+                             struct cfi_private *cfi)
+{
+        int osf = cfi->interleave * cfi->device_type;   /* scale factor */
+        map_word val[3];
+        map_word qry[3];
+        qry[0] = cfi_build_cmd('Q', map, cfi);
+        qry[1] = cfi_build_cmd('R', map, cfi);
+        qry[2] = cfi_build_cmd('Y', map, cfi);
+        val[0] = map_read(map, base + osf*0x10);
+        val[1] = map_read(map, base + osf*0x11);
+        val[2] = map_read(map, base + osf*0x12);
+        if (!map_word_equal(map, qry[0], val[0]))
+                return 0;
+        if (!map_word_equal(map, qry[1], val[1]))
+                return 0;
+        if (!map_word_equal(map, qry[2], val[2]))
+                return 0;
+        return 1;       /* "QRY" found */
+}
+EXPORT_SYMBOL_GPL(cfi_qry_present);
+int __xipram cfi_qry_mode_on(uint32_t base, struct map_info *map,
+                             struct cfi_private *cfi)
+{
+        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x98, 0x55, base, map, cfi, cfi->device_type, NULL);
+        if (cfi_qry_present(map, base, cfi))
+                return 1;
+        /* QRY not found probably we deal with some odd CFI chips */
+        /* Some revisions of some old Intel chips? */
+        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x98, 0x55, base, map, cfi, cfi->device_type, NULL);
+        if (cfi_qry_present(map, base, cfi))
+                return 1;
+        /* ST M29DW chips */
+        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x98, 0x555, base, map, cfi, cfi->device_type, NULL);
+        if (cfi_qry_present(map, base, cfi))
+                return 1;
+        /* QRY not found */
+        return 0;
+}
+EXPORT_SYMBOL_GPL(cfi_qry_mode_on);
+void __xipram cfi_qry_mode_off(uint32_t base, struct map_info *map,
+                               struct cfi_private *cfi)
+{
+        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xFF, 0, base, map, cfi, cfi->device_type, NULL);
+}
+EXPORT_SYMBOL_GPL(cfi_qry_mode_off);
 struct cfi_extquery *
 __xipram cfi_read_pri(struct map_info *map, __u16 adr, __u16 size, const char* name)
 {
@@ -48,8 +108,7 @@ __xipram cfi_read_pri(struct map_info *map, __u16 adr, __u16 size, const char* n
 #endif
        /* Switch it into Query Mode */
-        cfi_send_gen_cmd(0x98, 0x55, base, map, cfi, cfi->device_type, NULL);
+        cfi_qry_mode_on(base, map, cfi);
        /* Read in the Extended Query Table */
        for (i=0; i<size; i++) {
                ((unsigned char *)extp)[i] =
@@ -57,8 +116,7 @@ __xipram cfi_read_pri(struct map_info *map, __u16 adr, __u16 size, const char* n
        }
        /* Make sure it returns to read mode */
-        cfi_send_gen_cmd(0xf0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_qry_mode_off(base, map, cfi);
-        cfi_send_gen_cmd(0xff, 0, base, map, cfi, cfi->device_type, NULL);
 #ifdef CONFIG_MTD_XIP
        (void) map_read(map, base);
diff --git a/drivers/mtd/chips/gen_probe.c b/drivers/mtd/chips/gen_probe.c
index f061885b2812..e2dc96441e05 100644
--- a/drivers/mtd/chips/gen_probe.c
+++ b/drivers/mtd/chips/gen_probe.c
@@ -111,7 +111,7 @@ static struct cfi_private *genprobe_ident_chips(struct map_info *map, struct chi
                max_chips = 1;
        }
-        mapsize = sizeof(long) * ( (max_chips + BITS_PER_LONG-1) / BITS_PER_LONG );
+        mapsize = sizeof(long) * DIV_ROUND_UP(max_chips, BITS_PER_LONG);
        chip_map = kzalloc(mapsize, GFP_KERNEL);
        if (!chip_map) {
                printk(KERN_WARNING "%s: kmalloc failed for CFI chip map\n", map->name);
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 9c613f06623c..6fde0a2e3567 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -59,6 +59,27 @@ config MTD_DATAFLASH
          Sometimes DataFlash chips are packaged inside MMC-format
          cards; at this writing, the MMC stack won't handle those.
+config MTD_DATAFLASH_WRITE_VERIFY
+        bool "Verify DataFlash page writes"
+        depends on MTD_DATAFLASH
+        help
+          This adds an extra check when data is written to the flash.
+          It may help if you are verifying chip setup (timings etc) on
+          your board.  There is a rare possibility that even though the
+          device thinks the write was successful, a bit could have been
+          flipped accidentally due to device wear or something else.
+config MTD_DATAFLASH_OTP
+        bool "DataFlash OTP support (Security Register)"
+        depends on MTD_DATAFLASH
+        select HAVE_MTD_OTP
+        help
+          Newer DataFlash chips (revisions C and D) support 128 bytes of
+          one-time-programmable (OTP) data.  The first half may be written
+          (once) with up to 64 bytes of data, such as a serial number or
+          other key product data.  The second half is programmed with a
+          unique-to-each-chip bit pattern at the factory.
 config MTD_M25P80
        tristate "Support most SPI Flash chips (AT26DF, M25P, W25X, ...)"
        depends on SPI_MASTER && EXPERIMENTAL
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index b35c3333e210..4d3ae085b1d2 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -39,6 +39,7 @@
 #define OPCODE_PP               0x02    /* Page program (up to 256 bytes) */
 #define OPCODE_BE_4K            0x20    /* Erase 4KiB block */
 #define OPCODE_BE_32K           0x52    /* Erase 32KiB block */
+#define OPCODE_BE               0xc7    /* Erase whole flash block */
 #define OPCODE_SE               0xd8    /* Sector erase (usually 64KiB) */
 #define OPCODE_RDID             0x9f    /* Read JEDEC ID */
@@ -133,7 +134,7 @@ static inline int write_enable(struct m25p *flash)
 {
        u8      code = OPCODE_WREN;
-        return spi_write_then_read(flash->spi, &code, 1, NULL, 0);
+        return spi_write(flash->spi, &code, 1);
 }
@@ -161,6 +162,31 @@ static int wait_till_ready(struct m25p *flash)
        return 1;
 }
+/*
+ * Erase the whole flash memory
+ *
+ * Returns 0 if successful, non-zero otherwise.
+ */
+static int erase_block(struct m25p *flash)
+{
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: %s %dKiB\n",
+                        flash->spi->dev.bus_id, __func__,
+                        flash->mtd.size / 1024);
+        /* Wait until finished previous write command. */
+        if (wait_till_ready(flash))
+                return 1;
+        /* Send write enable, then erase commands. */
+        write_enable(flash);
+        /* Set up command buffer. */
+        flash->command[0] = OPCODE_BE;
+        spi_write(flash->spi, flash->command, 1);
+        return 0;
+}
 /*
 * Erase one sector of flash memory at offset ``offset'' which is any
@@ -229,15 +255,21 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         */
        /* now erase those sectors */
-        while (len) {
+        if (len == flash->mtd.size && erase_block(flash)) {
-                if (erase_sector(flash, addr)) {
+                instr->state = MTD_ERASE_FAILED;
-                        instr->state = MTD_ERASE_FAILED;
+                mutex_unlock(&flash->lock);
-                        mutex_unlock(&flash->lock);
+                return -EIO;
-                        return -EIO;
+        } else {
-                }
+                while (len) {
+                        if (erase_sector(flash, addr)) {
+                                instr->state = MTD_ERASE_FAILED;
+                                mutex_unlock(&flash->lock);
+                                return -EIO;
+                        }
-                addr += mtd->erasesize;
+                        addr += mtd->erasesize;
-                len -= mtd->erasesize;
+                        len -= mtd->erasesize;
+                }
        }
        mutex_unlock(&flash->lock);
@@ -437,6 +469,7 @@ struct flash_info {
         * then a two byte device id.
         */
        u32             jedec_id;
+        u16             ext_id;
        /* The size listed here is what works with OPCODE_SE, which isn't
         * necessarily called a "sector" by the vendor.
@@ -456,57 +489,59 @@ struct flash_info {
 static struct flash_info __devinitdata m25p_data [] = {
        /* Atmel -- some are (confusingly) marketed as "DataFlash" */
-        { "at25fs010",  0x1f6601, 32 * 1024, 4, SECT_4K, },
+        { "at25fs010",  0x1f6601, 0, 32 * 1024, 4, SECT_4K, },
-        { "at25fs040",  0x1f6604, 64 * 1024, 8, SECT_4K, },
+        { "at25fs040",  0x1f6604, 0, 64 * 1024, 8, SECT_4K, },
-        { "at25df041a", 0x1f4401, 64 * 1024, 8, SECT_4K, },
+        { "at25df041a", 0x1f4401, 0, 64 * 1024, 8, SECT_4K, },
-        { "at25df641",  0x1f4800, 64 * 1024, 128, SECT_4K, },
+        { "at25df641",  0x1f4800, 0, 64 * 1024, 128, SECT_4K, },
-        { "at26f004",   0x1f0400, 64 * 1024, 8, SECT_4K, },
+        { "at26f004",   0x1f0400, 0, 64 * 1024, 8, SECT_4K, },
-        { "at26df081a", 0x1f4501, 64 * 1024, 16, SECT_4K, },
+        { "at26df081a", 0x1f4501, 0, 64 * 1024, 16, SECT_4K, },
-        { "at26df161a", 0x1f4601, 64 * 1024, 32, SECT_4K, },
+        { "at26df161a", 0x1f4601, 0, 64 * 1024, 32, SECT_4K, },
-        { "at26df321",  0x1f4701, 64 * 1024, 64, SECT_4K, },
+        { "at26df321",  0x1f4701, 0, 64 * 1024, 64, SECT_4K, },
        /* Spansion -- single (large) sector size only, at least
         * for the chips listed here (without boot sectors).
         */
-        { "s25sl004a", 0x010212, 64 * 1024, 8, },
+        { "s25sl004a", 0x010212, 0, 64 * 1024, 8, },
-        { "s25sl008a", 0x010213, 64 * 1024, 16, },
+        { "s25sl008a", 0x010213, 0, 64 * 1024, 16, },
-        { "s25sl016a", 0x010214, 64 * 1024, 32, },
+        { "s25sl016a", 0x010214, 0, 64 * 1024, 32, },
-        { "s25sl032a", 0x010215, 64 * 1024, 64, },
+        { "s25sl032a", 0x010215, 0, 64 * 1024, 64, },
-        { "s25sl064a", 0x010216, 64 * 1024, 128, },
+        { "s25sl064a", 0x010216, 0, 64 * 1024, 128, },
+        { "s25sl12800", 0x012018, 0x0300, 256 * 1024, 64, },
+        { "s25sl12801", 0x012018, 0x0301, 64 * 1024, 256, },
        /* SST -- large erase sizes are "overlays", "sectors" are 4K */
-        { "sst25vf040b", 0xbf258d, 64 * 1024, 8, SECT_4K, },
+        { "sst25vf040b", 0xbf258d, 0, 64 * 1024, 8, SECT_4K, },
-        { "sst25vf080b", 0xbf258e, 64 * 1024, 16, SECT_4K, },
+        { "sst25vf080b", 0xbf258e, 0, 64 * 1024, 16, SECT_4K, },
-        { "sst25vf016b", 0xbf2541, 64 * 1024, 32, SECT_4K, },
+        { "sst25vf016b", 0xbf2541, 0, 64 * 1024, 32, SECT_4K, },
-        { "sst25vf032b", 0xbf254a, 64 * 1024, 64, SECT_4K, },
+        { "sst25vf032b", 0xbf254a, 0, 64 * 1024, 64, SECT_4K, },
        /* ST Microelectronics -- newer production may have feature updates */
-        { "m25p05",  0x202010,  32 * 1024, 2, },
+        { "m25p05",  0x202010,  0, 32 * 1024, 2, },
-        { "m25p10",  0x202011,  32 * 1024, 4, },
+        { "m25p10",  0x202011,  0, 32 * 1024, 4, },
-        { "m25p20",  0x202012,  64 * 1024, 4, },
+        { "m25p20",  0x202012,  0, 64 * 1024, 4, },
-        { "m25p40",  0x202013,  64 * 1024, 8, },
+        { "m25p40",  0x202013,  0, 64 * 1024, 8, },
-        { "m25p80",         0,  64 * 1024, 16, },
+        { "m25p80",         0,  0, 64 * 1024, 16, },
-        { "m25p16",  0x202015,  64 * 1024, 32, },
+        { "m25p16",  0x202015,  0, 64 * 1024, 32, },
-        { "m25p32",  0x202016,  64 * 1024, 64, },
+        { "m25p32",  0x202016,  0, 64 * 1024, 64, },
-        { "m25p64",  0x202017,  64 * 1024, 128, },
+        { "m25p64",  0x202017,  0, 64 * 1024, 128, },
-        { "m25p128", 0x202018, 256 * 1024, 64, },
+        { "m25p128", 0x202018, 0, 256 * 1024, 64, },
-        { "m45pe80", 0x204014,  64 * 1024, 16, },
+        { "m45pe80", 0x204014,  0, 64 * 1024, 16, },
-        { "m45pe16", 0x204015,  64 * 1024, 32, },
+        { "m45pe16", 0x204015,  0, 64 * 1024, 32, },
-        { "m25pe80", 0x208014,  64 * 1024, 16, },
+        { "m25pe80", 0x208014,  0, 64 * 1024, 16, },
-        { "m25pe16", 0x208015,  64 * 1024, 32, SECT_4K, },
+        { "m25pe16", 0x208015,  0, 64 * 1024, 32, SECT_4K, },
        /* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
-        { "w25x10", 0xef3011, 64 * 1024, 2, SECT_4K, },
+        { "w25x10", 0xef3011, 0, 64 * 1024, 2, SECT_4K, },
-        { "w25x20", 0xef3012, 64 * 1024, 4, SECT_4K, },
+        { "w25x20", 0xef3012, 0, 64 * 1024, 4, SECT_4K, },
-        { "w25x40", 0xef3013, 64 * 1024, 8, SECT_4K, },
+        { "w25x40", 0xef3013, 0, 64 * 1024, 8, SECT_4K, },
-        { "w25x80", 0xef3014, 64 * 1024, 16, SECT_4K, },
+        { "w25x80", 0xef3014, 0, 64 * 1024, 16, SECT_4K, },
-        { "w25x16", 0xef3015, 64 * 1024, 32, SECT_4K, },
+        { "w25x16", 0xef3015, 0, 64 * 1024, 32, SECT_4K, },
-        { "w25x32", 0xef3016, 64 * 1024, 64, SECT_4K, },
+        { "w25x32", 0xef3016, 0, 64 * 1024, 64, SECT_4K, },
-        { "w25x64", 0xef3017, 64 * 1024, 128, SECT_4K, },
+        { "w25x64", 0xef3017, 0, 64 * 1024, 128, SECT_4K, },
 };
 static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
@@ -515,6 +550,7 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
        u8                      code = OPCODE_RDID;
        u8                      id[3];
        u32                     jedec;
+        u16                     ext_jedec;
        struct flash_info       *info;
        /* JEDEC also defines an optional "extended device information"
@@ -533,10 +569,14 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
        jedec = jedec << 8;
        jedec |= id[2];
+        ext_jedec = id[3] << 8 | id[4];
        for (tmp = 0, info = m25p_data;
                        tmp < ARRAY_SIZE(m25p_data);
                        tmp++, info++) {
                if (info->jedec_id == jedec)
+                        if (ext_jedec != 0 && info->ext_id != ext_jedec)
+                                continue;
                        return info;
        }
        dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 8bd0dea6885f..6dd9aff8bb2d 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -30,12 +30,10 @@
 * doesn't (yet) use these for any kind of i/o overlap or prefetching.
 *
 * Sometimes DataFlash is packaged in MMC-format cards, although the
- * MMC stack can't use SPI (yet), or distinguish between MMC and DataFlash
+ * MMC stack can't (yet?) distinguish between MMC and DataFlash
 * protocols during enumeration.
 */
-#define CONFIG_DATAFLASH_WRITE_VERIFY
 /* reads can bypass the buffers */
 #define OP_READ_CONTINUOUS      0xE8
 #define OP_READ_PAGE            0xD2
@@ -80,7 +78,8 @@
 */
 #define OP_READ_ID              0x9F
 #define OP_READ_SECURITY        0x77
-#define OP_WRITE_SECURITY       0x9A    /* OTP bits */
+#define OP_WRITE_SECURITY_REVC  0x9A
+#define OP_WRITE_SECURITY       0x9B    /* revision D */
 struct dataflash {
@@ -402,7 +401,7 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
                (void) dataflash_waitready(priv->spi);
-#ifdef  CONFIG_DATAFLASH_WRITE_VERIFY
+#ifdef CONFIG_MTD_DATAFLASH_VERIFY_WRITE
                /* (3) Compare to Buffer1 */
                addr = pageaddr << priv->page_offset;
@@ -431,7 +430,7 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
                } else
                        status = 0;
-#endif  /* CONFIG_DATAFLASH_WRITE_VERIFY */
+#endif  /* CONFIG_MTD_DATAFLASH_VERIFY_WRITE */
                remaining = remaining - writelen;
                pageaddr++;
@@ -451,16 +450,192 @@ static int dataflash_write(struct mtd_info *mtd, loff_t to, size_t len,
 /* ......................................................................... */
+#ifdef CONFIG_MTD_DATAFLASH_OTP
+static int dataflash_get_otp_info(struct mtd_info *mtd,
+                struct otp_info *info, size_t len)
+{
+        /* Report both blocks as identical:  bytes 0..64, locked.
+         * Unless the user block changed from all-ones, we can't
+         * tell whether it's still writable; so we assume it isn't.
+         */
+        info->start = 0;
+        info->length = 64;
+        info->locked = 1;
+        return sizeof(*info);
+}
+static ssize_t otp_read(struct spi_device *spi, unsigned base,
+                uint8_t *buf, loff_t off, size_t len)
+{
+        struct spi_message      m;
+        size_t                  l;
+        uint8_t                 *scratch;
+        struct spi_transfer     t;
+        int                     status;
+        if (off > 64)
+                return -EINVAL;
+        if ((off + len) > 64)
+                len = 64 - off;
+        if (len == 0)
+                return len;
+        spi_message_init(&m);
+        l = 4 + base + off + len;
+        scratch = kzalloc(l, GFP_KERNEL);
+        if (!scratch)
+                return -ENOMEM;
+        /* OUT: OP_READ_SECURITY, 3 don't-care bytes, zeroes
+         * IN:  ignore 4 bytes, data bytes 0..N (max 127)
+         */
+        scratch[0] = OP_READ_SECURITY;
+        memset(&t, 0, sizeof t);
+        t.tx_buf = scratch;
+        t.rx_buf = scratch;
+        t.len = l;
+        spi_message_add_tail(&t, &m);
+        dataflash_waitready(spi);
+        status = spi_sync(spi, &m);
+        if (status >= 0) {
+                memcpy(buf, scratch + 4 + base + off, len);
+                status = len;
+        }
+        kfree(scratch);
+        return status;
+}
+static int dataflash_read_fact_otp(struct mtd_info *mtd,
+                loff_t from, size_t len, size_t *retlen, u_char *buf)
+{
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        int                     status;
+        /* 64 bytes, from 0..63 ... start at 64 on-chip */
+        mutex_lock(&priv->lock);
+        status = otp_read(priv->spi, 64, buf, from, len);
+        mutex_unlock(&priv->lock);
+        if (status < 0)
+                return status;
+        *retlen = status;
+        return 0;
+}
+static int dataflash_read_user_otp(struct mtd_info *mtd,
+                loff_t from, size_t len, size_t *retlen, u_char *buf)
+{
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        int                     status;
+        /* 64 bytes, from 0..63 ... start at 0 on-chip */
+        mutex_lock(&priv->lock);
+        status = otp_read(priv->spi, 0, buf, from, len);
+        mutex_unlock(&priv->lock);
+        if (status < 0)
+                return status;
+        *retlen = status;
+        return 0;
+}
+static int dataflash_write_user_otp(struct mtd_info *mtd,
+                loff_t from, size_t len, size_t *retlen, u_char *buf)
+{
+        struct spi_message      m;
+        const size_t            l = 4 + 64;
+        uint8_t                 *scratch;
+        struct spi_transfer     t;
+        struct dataflash        *priv = (struct dataflash *)mtd->priv;
+        int                     status;
+        if (len > 64)
+                return -EINVAL;
+        /* Strictly speaking, we *could* truncate the write ... but
+         * let's not do that for the only write that's ever possible.
+         */
+        if ((from + len) > 64)
+                return -EINVAL;
+        /* OUT: OP_WRITE_SECURITY, 3 zeroes, 64 data-or-zero bytes
+         * IN:  ignore all
+         */
+        scratch = kzalloc(l, GFP_KERNEL);
+        if (!scratch)
+                return -ENOMEM;
+        scratch[0] = OP_WRITE_SECURITY;
+        memcpy(scratch + 4 + from, buf, len);
+        spi_message_init(&m);
+        memset(&t, 0, sizeof t);
+        t.tx_buf = scratch;
+        t.len = l;
+        spi_message_add_tail(&t, &m);
+        /* Write the OTP bits, if they've not yet been written.
+         * This modifies SRAM buffer1.
+         */
+        mutex_lock(&priv->lock);
+        dataflash_waitready(priv->spi);
+        status = spi_sync(priv->spi, &m);
+        mutex_unlock(&priv->lock);
+        kfree(scratch);
+        if (status >= 0) {
+                status = 0;
+                *retlen = len;
+        }
+        return status;
+}
+static char *otp_setup(struct mtd_info *device, char revision)
+{
+        device->get_fact_prot_info = dataflash_get_otp_info;
+        device->read_fact_prot_reg = dataflash_read_fact_otp;
+        device->get_user_prot_info = dataflash_get_otp_info;
+        device->read_user_prot_reg = dataflash_read_user_otp;
+        /* rev c parts (at45db321c and at45db1281 only!) use a
+         * different write procedure; not (yet?) implemented.
+         */
+        if (revision > 'c')
+                device->write_user_prot_reg = dataflash_write_user_otp;
+        return ", OTP";
+}
+#else
+static char *otp_setup(struct mtd_info *device, char revision)
+{
+        return " (OTP)";
+}
+#endif
+/* ......................................................................... */
 /*
 * Register DataFlash device with MTD subsystem.
 */
 static int __devinit
-add_dataflash(struct spi_device *spi, char *name,
+add_dataflash_otp(struct spi_device *spi, char *name,
-                int nr_pages, int pagesize, int pageoffset)
+                int nr_pages, int pagesize, int pageoffset, char revision)
 {
        struct dataflash                *priv;
        struct mtd_info                 *device;
        struct flash_platform_data      *pdata = spi->dev.platform_data;
+        char                            *otp_tag = "";
        priv = kzalloc(sizeof *priv, GFP_KERNEL);
        if (!priv)
@@ -489,8 +664,12 @@ add_dataflash(struct spi_device *spi, char *name,
        device->write = dataflash_write;
        device->priv = priv;
-        dev_info(&spi->dev, "%s (%d KBytes) pagesize %d bytes\n",
+        if (revision >= 'c')
-                        name, DIV_ROUND_UP(device->size, 1024), pagesize);
+                otp_tag = otp_setup(device, revision);
+        dev_info(&spi->dev, "%s (%d KBytes) pagesize %d bytes%s\n",
+                        name, DIV_ROUND_UP(device->size, 1024),
+                        pagesize, otp_tag);
        dev_set_drvdata(&spi->dev, priv);
        if (mtd_has_partitions()) {
@@ -519,6 +698,14 @@ add_dataflash(struct spi_device *spi, char *name,
        return add_mtd_device(device) == 1 ? -ENODEV : 0;
 }
+static inline int __devinit
+add_dataflash(struct spi_device *spi, char *name,
+                int nr_pages, int pagesize, int pageoffset)
+{
+        return add_dataflash_otp(spi, name, nr_pages, pagesize,
+                        pageoffset, 0);
+}
 struct flash_info {
        char            *name;
@@ -664,13 +851,16 @@ static int __devinit dataflash_probe(struct spi_device *spi)
         * Try to detect dataflash by JEDEC ID.
         * If it succeeds we know we have either a C or D part.
         * D will support power of 2 pagesize option.
+         * Both support the security register, though with different
+         * write procedures.
         */
        info = jedec_probe(spi);
        if (IS_ERR(info))
                return PTR_ERR(info);
        if (info != NULL)
-                return add_dataflash(spi, info->name, info->nr_pages,
+                return add_dataflash_otp(spi, info->name, info->nr_pages,
-                                 info->pagesize, info->pageoffset);
+                                info->pagesize, info->pageoffset,
+                                (info->flags & SUP_POW2PS) ? 'd' : 'c');
        /*
         * Older chips support only legacy commands, identifing
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index df8e00bba07b..3ae76ecc07d7 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -332,30 +332,6 @@ config MTD_CFI_FLAGADM
          Mapping for the Flaga digital module. If you don't have one, ignore
          this setting.
-config MTD_WALNUT
-        tristate "Flash device mapped on IBM 405GP Walnut"
-        depends on MTD_JEDECPROBE && WALNUT && !PPC_MERGE
-        help
-          This enables access routines for the flash chips on the IBM 405GP
-          Walnut board. If you have one of these boards and would like to
-          use the flash chips on it, say 'Y'.
-config MTD_EBONY
-        tristate "Flash devices mapped on IBM 440GP Ebony"
-        depends on MTD_JEDECPROBE && EBONY && !PPC_MERGE
-        help
-          This enables access routines for the flash chips on the IBM 440GP
-          Ebony board. If you have one of these boards and would like to
-          use the flash chips on it, say 'Y'.
-config MTD_OCOTEA
-        tristate "Flash devices mapped on IBM 440GX Ocotea"
-        depends on MTD_CFI && OCOTEA && !PPC_MERGE
-        help
-          This enables access routines for the flash chips on the IBM 440GX
-          Ocotea board. If you have one of these boards and would like to
-          use the flash chips on it, say 'Y'.
 config MTD_REDWOOD
        tristate "CFI Flash devices mapped on IBM Redwood"
        depends on MTD_CFI && ( REDWOOD_4 || REDWOOD_5 || REDWOOD_6 )
@@ -458,13 +434,6 @@ config MTD_CEIVA
          PhotoMax Digital Picture Frame.
          If you have such a device, say 'Y'.
-config MTD_NOR_TOTO
-        tristate "NOR Flash device on TOTO board"
-        depends on ARCH_OMAP && OMAP_TOTO
-        help
-          This enables access to the NOR flash on the Texas Instruments
-          TOTO board.
 config MTD_H720X
        tristate "Hynix evaluation board mappings"
        depends on MTD_CFI && ( ARCH_H7201 || ARCH_H7202 )
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index 6cda6df973e5..6d9ba35caf11 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -50,12 +50,8 @@ obj-$(CONFIG_MTD_REDWOOD)	+= redwood.o
 obj-$(CONFIG_MTD_UCLINUX)       += uclinux.o
 obj-$(CONFIG_MTD_NETtel)        += nettel.o
 obj-$(CONFIG_MTD_SCB2_FLASH)    += scb2_flash.o
-obj-$(CONFIG_MTD_EBONY)         += ebony.o
-obj-$(CONFIG_MTD_OCOTEA)        += ocotea.o
-obj-$(CONFIG_MTD_WALNUT)        += walnut.o
 obj-$(CONFIG_MTD_H720X)         += h720x-flash.o
 obj-$(CONFIG_MTD_SBC8240)       += sbc8240.o
-obj-$(CONFIG_MTD_NOR_TOTO)      += omap-toto-flash.o
 obj-$(CONFIG_MTD_IXP4XX)        += ixp4xx.o
 obj-$(CONFIG_MTD_IXP2000)       += ixp2000.o
 obj-$(CONFIG_MTD_WRSBC8260)     += wr_sbc82xx_flash.o
diff --git a/drivers/mtd/maps/ebony.c b/drivers/mtd/maps/ebony.c
deleted file mode 100644
index d92b7c70d3ed..000000000000
--- a/drivers/mtd/maps/ebony.c
+++ /dev/null
@@ -1,163 +0,0 @@
-/*
- * Mapping for Ebony user flash
- *
- * Matt Porter <mporter@kernel.crashing.org>
- *
- * Copyright 2002-2004 MontaVista Software Inc.
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <asm/ibm44x.h>
-#include <platforms/4xx/ebony.h>
-static struct mtd_info *flash;
-static struct map_info ebony_small_map = {
-        .name =         "Ebony small flash",
-        .size =         EBONY_SMALL_FLASH_SIZE,
-        .bankwidth =    1,
-};
-static struct map_info ebony_large_map = {
-        .name =         "Ebony large flash",
-        .size =         EBONY_LARGE_FLASH_SIZE,
-        .bankwidth =    1,
-};
-static struct mtd_partition ebony_small_partitions[] = {
-        {
-                .name =   "OpenBIOS",
-                .offset = 0x0,
-                .size =   0x80000,
-        }
-};
-static struct mtd_partition ebony_large_partitions[] = {
-        {
-                .name =   "fs",
-                .offset = 0,
-                .size =   0x380000,
-        },
-        {
-                .name =   "firmware",
-                .offset = 0x380000,
-                .size =   0x80000,
-        }
-};
-int __init init_ebony(void)
-{
-        u8 fpga0_reg;
-        u8 __iomem *fpga0_adr;
-        unsigned long long small_flash_base, large_flash_base;
-        fpga0_adr = ioremap64(EBONY_FPGA_ADDR, 16);
-        if (!fpga0_adr)
-                return -ENOMEM;
-        fpga0_reg = readb(fpga0_adr);
-        iounmap(fpga0_adr);
-        if (EBONY_BOOT_SMALL_FLASH(fpga0_reg) &&
-                        !EBONY_FLASH_SEL(fpga0_reg))
-                small_flash_base = EBONY_SMALL_FLASH_HIGH2;
-        else if (EBONY_BOOT_SMALL_FLASH(fpga0_reg) &&
-                        EBONY_FLASH_SEL(fpga0_reg))
-                small_flash_base = EBONY_SMALL_FLASH_HIGH1;
-        else if (!EBONY_BOOT_SMALL_FLASH(fpga0_reg) &&
-                        !EBONY_FLASH_SEL(fpga0_reg))
-                small_flash_base = EBONY_SMALL_FLASH_LOW2;
-        else
-                small_flash_base = EBONY_SMALL_FLASH_LOW1;
-        if (EBONY_BOOT_SMALL_FLASH(fpga0_reg) &&
-                        !EBONY_ONBRD_FLASH_EN(fpga0_reg))
-                large_flash_base = EBONY_LARGE_FLASH_LOW;
-        else
-                large_flash_base = EBONY_LARGE_FLASH_HIGH;
-        ebony_small_map.phys = small_flash_base;
-        ebony_small_map.virt = ioremap64(small_flash_base,
-                                         ebony_small_map.size);
-        if (!ebony_small_map.virt) {
-                printk("Failed to ioremap flash\n");
-                return -EIO;
-        }
-        simple_map_init(&ebony_small_map);
-        flash = do_map_probe("jedec_probe", &ebony_small_map);
-        if (flash) {
-                flash->owner = THIS_MODULE;
-                add_mtd_partitions(flash, ebony_small_partitions,
-                                        ARRAY_SIZE(ebony_small_partitions));
-        } else {
-                printk("map probe failed for flash\n");
-                iounmap(ebony_small_map.virt);
-                return -ENXIO;
-        }
-        ebony_large_map.phys = large_flash_base;
-        ebony_large_map.virt = ioremap64(large_flash_base,
-                                         ebony_large_map.size);
-        if (!ebony_large_map.virt) {
-                printk("Failed to ioremap flash\n");
-                iounmap(ebony_small_map.virt);
-                return -EIO;
-        }
-        simple_map_init(&ebony_large_map);
-        flash = do_map_probe("jedec_probe", &ebony_large_map);
-        if (flash) {
-                flash->owner = THIS_MODULE;
-                add_mtd_partitions(flash, ebony_large_partitions,
-                                        ARRAY_SIZE(ebony_large_partitions));
-        } else {
-                printk("map probe failed for flash\n");
-                iounmap(ebony_small_map.virt);
-                iounmap(ebony_large_map.virt);
-                return -ENXIO;
-        }
-        return 0;
-}
-static void __exit cleanup_ebony(void)
-{
-        if (flash) {
-                del_mtd_partitions(flash);
-                map_destroy(flash);
-        }
-        if (ebony_small_map.virt) {
-                iounmap(ebony_small_map.virt);
-                ebony_small_map.virt = NULL;
-        }
-        if (ebony_large_map.virt) {
-                iounmap(ebony_large_map.virt);
-                ebony_large_map.virt = NULL;
-        }
-}
-module_init(init_ebony);
-module_exit(cleanup_ebony);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Matt Porter <mporter@kernel.crashing.org>");
-MODULE_DESCRIPTION("MTD map and partitions for IBM 440GP Ebony boards");
diff --git a/drivers/mtd/maps/ocotea.c b/drivers/mtd/maps/ocotea.c
deleted file mode 100644
index 5522eac8c980..000000000000
--- a/drivers/mtd/maps/ocotea.c
+++ /dev/null
@@ -1,154 +0,0 @@
-/*
- * Mapping for Ocotea user flash
- *
- * Matt Porter <mporter@kernel.crashing.org>
- *
- * Copyright 2002-2004 MontaVista Software Inc.
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <asm/ibm44x.h>
-#include <platforms/4xx/ocotea.h>
-static struct mtd_info *flash;
-static struct map_info ocotea_small_map = {
-        .name =         "Ocotea small flash",
-        .size =         OCOTEA_SMALL_FLASH_SIZE,
-        .buswidth =     1,
-};
-static struct map_info ocotea_large_map = {
-        .name =         "Ocotea large flash",
-        .size =         OCOTEA_LARGE_FLASH_SIZE,
-        .buswidth =     1,
-};
-static struct mtd_partition ocotea_small_partitions[] = {
-        {
-                .name =   "pibs",
-                .offset = 0x0,
-                .size =   0x100000,
-        }
-};
-static struct mtd_partition ocotea_large_partitions[] = {
-        {
-                .name =   "fs",
-                .offset = 0,
-                .size =   0x300000,
-        },
-        {
-                .name =   "firmware",
-                .offset = 0x300000,
-                .size =   0x100000,
-        }
-};
-int __init init_ocotea(void)
-{
-        u8 fpga0_reg;
-        u8 *fpga0_adr;
-        unsigned long long small_flash_base, large_flash_base;
-        fpga0_adr = ioremap64(OCOTEA_FPGA_ADDR, 16);
-        if (!fpga0_adr)
-                return -ENOMEM;
-        fpga0_reg = readb((unsigned long)fpga0_adr);
-        iounmap(fpga0_adr);
-        if (OCOTEA_BOOT_LARGE_FLASH(fpga0_reg)) {
-                small_flash_base = OCOTEA_SMALL_FLASH_HIGH;
-                large_flash_base = OCOTEA_LARGE_FLASH_LOW;
-        }
-        else {
-                small_flash_base = OCOTEA_SMALL_FLASH_LOW;
-                large_flash_base = OCOTEA_LARGE_FLASH_HIGH;
-        }
-        ocotea_small_map.phys = small_flash_base;
-        ocotea_small_map.virt = ioremap64(small_flash_base,
-                                         ocotea_small_map.size);
-        if (!ocotea_small_map.virt) {
-                printk("Failed to ioremap flash\n");
-                return -EIO;
-        }
-        simple_map_init(&ocotea_small_map);
-        flash = do_map_probe("map_rom", &ocotea_small_map);
-        if (flash) {
-                flash->owner = THIS_MODULE;
-                add_mtd_partitions(flash, ocotea_small_partitions,
-                                        ARRAY_SIZE(ocotea_small_partitions));
-        } else {
-                printk("map probe failed for flash\n");
-                iounmap(ocotea_small_map.virt);
-                return -ENXIO;
-        }
-        ocotea_large_map.phys = large_flash_base;
-        ocotea_large_map.virt = ioremap64(large_flash_base,
-                                         ocotea_large_map.size);
-        if (!ocotea_large_map.virt) {
-                printk("Failed to ioremap flash\n");
-                iounmap(ocotea_small_map.virt);
-                return -EIO;
-        }
-        simple_map_init(&ocotea_large_map);
-        flash = do_map_probe("cfi_probe", &ocotea_large_map);
-        if (flash) {
-                flash->owner = THIS_MODULE;
-                add_mtd_partitions(flash, ocotea_large_partitions,
-                                        ARRAY_SIZE(ocotea_large_partitions));
-        } else {
-                printk("map probe failed for flash\n");
-                iounmap(ocotea_small_map.virt);
-                iounmap(ocotea_large_map.virt);
-                return -ENXIO;
-        }
-        return 0;
-}
-static void __exit cleanup_ocotea(void)
-{
-        if (flash) {
-                del_mtd_partitions(flash);
-                map_destroy(flash);
-        }
-        if (ocotea_small_map.virt) {
-                iounmap((void *)ocotea_small_map.virt);
-                ocotea_small_map.virt = 0;
-        }
-        if (ocotea_large_map.virt) {
-                iounmap((void *)ocotea_large_map.virt);
-                ocotea_large_map.virt = 0;
-        }
-}
-module_init(init_ocotea);
-module_exit(cleanup_ocotea);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Matt Porter <mporter@kernel.crashing.org>");
-MODULE_DESCRIPTION("MTD map and partitions for IBM 440GX Ocotea boards");
diff --git a/drivers/mtd/maps/omap-toto-flash.c b/drivers/mtd/maps/omap-toto-flash.c
deleted file mode 100644
index 0a60ebbc2175..000000000000
--- a/drivers/mtd/maps/omap-toto-flash.c
+++ /dev/null
@@ -1,133 +0,0 @@
-/*
- * NOR Flash memory access on TI Toto board
- *
- * jzhang@ti.com (C) 2003 Texas Instruments.
- *
- *  (C) 2002 MontVista Software, Inc.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/hardware.h>
-#include <asm/io.h>
-#ifndef CONFIG_ARCH_OMAP
-#error This is for OMAP architecture only
-#endif
-//these lines need be moved to a hardware header file
-#define OMAP_TOTO_FLASH_BASE 0xd8000000
-#define OMAP_TOTO_FLASH_SIZE 0x80000
-static struct map_info omap_toto_map_flash = {
-        .name =         "OMAP Toto flash",
-        .bankwidth =    2,
-        .virt =         (void __iomem *)OMAP_TOTO_FLASH_BASE,
-};
-static struct mtd_partition toto_flash_partitions[] = {
-        {
-                .name =         "BootLoader",
-                .size =         0x00040000,     /* hopefully u-boot will stay 128k + 128*/
-                .offset =       0,
-                .mask_flags =   MTD_WRITEABLE,  /* force read-only */
-        }, {
-                .name =         "ReservedSpace",
-                .size =         0x00030000,
-                .offset =       MTDPART_OFS_APPEND,
-                //mask_flags:   MTD_WRITEABLE,  /* force read-only */
-        }, {
-                .name =         "EnvArea",      /* bottom 64KiB for env vars */
-                .size =         MTDPART_SIZ_FULL,
-                .offset =       MTDPART_OFS_APPEND,
-        }
-};
-static struct mtd_partition *parsed_parts;
-static struct mtd_info *flash_mtd;
-static int __init init_flash (void)
-{
-        struct mtd_partition *parts;
-        int nb_parts = 0;
-        int parsed_nr_parts = 0;
-        const char *part_type;
-        /*
-         * Static partition definition selection
-         */
-        part_type = "static";
-        parts = toto_flash_partitions;
-        nb_parts = ARRAY_SIZE(toto_flash_partitions);
-        omap_toto_map_flash.size = OMAP_TOTO_FLASH_SIZE;
-        omap_toto_map_flash.phys = virt_to_phys(OMAP_TOTO_FLASH_BASE);
-        simple_map_init(&omap_toto_map_flash);
-        /*
-         * Now let's probe for the actual flash.  Do it here since
-         * specific machine settings might have been set above.
-         */
-        printk(KERN_NOTICE "OMAP toto flash: probing %d-bit flash bus\n",
-                omap_toto_map_flash.bankwidth*8);
-        flash_mtd = do_map_probe("jedec_probe", &omap_toto_map_flash);
-        if (!flash_mtd)
-                return -ENXIO;
-        if (parsed_nr_parts > 0) {
-                parts = parsed_parts;
-                nb_parts = parsed_nr_parts;
-        }
-        if (nb_parts == 0) {
-                printk(KERN_NOTICE "OMAP toto flash: no partition info available,"
-                        "registering whole flash at once\n");
-                if (add_mtd_device(flash_mtd)){
-            return -ENXIO;
-        }
-        } else {
-                printk(KERN_NOTICE "Using %s partition definition\n",
-                        part_type);
-                return add_mtd_partitions(flash_mtd, parts, nb_parts);
-        }
-        return 0;
-}
-int __init omap_toto_mtd_init(void)
-{
-        int status;
-        if (status = init_flash()) {
-                printk(KERN_ERR "OMAP Toto Flash: unable to init map for toto flash\n");
-        }
-    return status;
-}
-static void  __exit omap_toto_mtd_cleanup(void)
-{
-        if (flash_mtd) {
-                del_mtd_partitions(flash_mtd);
-                map_destroy(flash_mtd);
-                kfree(parsed_parts);
-        }
-}
-module_init(omap_toto_mtd_init);
-module_exit(omap_toto_mtd_cleanup);
-MODULE_AUTHOR("Jian Zhang");
-MODULE_DESCRIPTION("OMAP Toto board map driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/maps/walnut.c b/drivers/mtd/maps/walnut.c
deleted file mode 100644
index e243476c8171..000000000000
--- a/drivers/mtd/maps/walnut.c
+++ /dev/null
@@ -1,122 +0,0 @@
-/*
- * Mapping for Walnut flash
- * (used ebony.c as a "framework")
- *
- * Heikki Lindholm <holindho@infradead.org>
- *
- *
- * This program is free software; you can redistribute  it and/or modify it
- * under  the terms of  the GNU General  Public License as published by the
- * Free Software Foundation;  either version 2 of the  License, or (at your
- * option) any later version.
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <asm/ibm4xx.h>
-#include <platforms/4xx/walnut.h>
-/* these should be in platforms/4xx/walnut.h ? */
-#define WALNUT_FLASH_ONBD_N(x)          (x & 0x02)
-#define WALNUT_FLASH_SRAM_SEL(x)        (x & 0x01)
-#define WALNUT_FLASH_LOW                0xFFF00000
-#define WALNUT_FLASH_HIGH               0xFFF80000
-#define WALNUT_FLASH_SIZE               0x80000
-static struct mtd_info *flash;
-static struct map_info walnut_map = {
-        .name =         "Walnut flash",
-        .size =         WALNUT_FLASH_SIZE,
-        .bankwidth =    1,
-};
-/* Actually, OpenBIOS is the last 128 KiB of the flash - better
- * partitioning could be made */
-static struct mtd_partition walnut_partitions[] = {
-        {
-                .name =   "OpenBIOS",
-                .offset = 0x0,
-                .size =   WALNUT_FLASH_SIZE,
-                /*.mask_flags = MTD_WRITEABLE, */ /* force read-only */
-        }
-};
-int __init init_walnut(void)
-{
-        u8 fpga_brds1;
-        void *fpga_brds1_adr;
-        void *fpga_status_adr;
-        unsigned long flash_base;
-        /* this should already be mapped (platform/4xx/walnut.c) */
-        fpga_status_adr = ioremap(WALNUT_FPGA_BASE, 8);
-        if (!fpga_status_adr)
-                return -ENOMEM;
-        fpga_brds1_adr = fpga_status_adr+5;
-        fpga_brds1 = readb(fpga_brds1_adr);
-        /* iounmap(fpga_status_adr); */
-        if (WALNUT_FLASH_ONBD_N(fpga_brds1)) {
-                printk("The on-board flash is disabled (U79 sw 5)!");
-                iounmap(fpga_status_adr);
-                return -EIO;
-        }
-        if (WALNUT_FLASH_SRAM_SEL(fpga_brds1))
-                flash_base = WALNUT_FLASH_LOW;
-        else
-                flash_base = WALNUT_FLASH_HIGH;
-        walnut_map.phys = flash_base;
-        walnut_map.virt =
-                (void __iomem *)ioremap(flash_base, walnut_map.size);
-        if (!walnut_map.virt) {
-                printk("Failed to ioremap flash.\n");
-                iounmap(fpga_status_adr);
-                return -EIO;
-        }
-        simple_map_init(&walnut_map);
-        flash = do_map_probe("jedec_probe", &walnut_map);
-        if (flash) {
-                flash->owner = THIS_MODULE;
-                add_mtd_partitions(flash, walnut_partitions,
-                                        ARRAY_SIZE(walnut_partitions));
-        } else {
-                printk("map probe failed for flash\n");
-                iounmap(fpga_status_adr);
-                return -ENXIO;
-        }
-        iounmap(fpga_status_adr);
-        return 0;
-}
-static void __exit cleanup_walnut(void)
-{
-        if (flash) {
-                del_mtd_partitions(flash);
-                map_destroy(flash);
-        }
-        if (walnut_map.virt) {
-                iounmap((void *)walnut_map.virt);
-                walnut_map.virt = 0;
-        }
-}
-module_init(init_walnut);
-module_exit(cleanup_walnut);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Heikki Lindholm <holindho@infradead.org>");
-MODULE_DESCRIPTION("MTD map and partitions for IBM 405GP Walnut boards");
diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
index d2f331876e4c..13cc67ad272a 100644
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -350,7 +350,7 @@ static void mtdchar_erase_callback (struct erase_info *instr)
        wake_up((wait_queue_head_t *)instr->priv);
 }
-#if defined(CONFIG_MTD_OTP) || defined(CONFIG_MTD_ONENAND_OTP)
+#ifdef CONFIG_HAVE_MTD_OTP
 static int otp_select_filemode(struct mtd_file_info *mfi, int mode)
 {
        struct mtd_info *mtd = mfi->mtd;
@@ -663,7 +663,7 @@ static int mtd_ioctl(struct inode *inode, struct file *file,
                break;
        }
-#if defined(CONFIG_MTD_OTP) || defined(CONFIG_MTD_ONENAND_OTP)
+#ifdef CONFIG_HAVE_MTD_OTP
        case OTPSELECT:
        {
                int mode;
diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 2972a5edb73d..789842d0e6f2 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -444,7 +444,7 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
                        return -EINVAL;
        }
-        instr->fail_addr = 0xffffffff;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* make a local copy of instr to avoid modifying the caller's struct */
        erase = kmalloc(sizeof (struct erase_info), GFP_KERNEL);
@@ -493,7 +493,7 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
                        /* sanity check: should never happen since
                         * block alignment has been checked above */
                        BUG_ON(err == -EINVAL);
-                        if (erase->fail_addr != 0xffffffff)
+                        if (erase->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
                                instr->fail_addr = erase->fail_addr + offset;
                        break;
                }
diff --git a/drivers/mtd/mtdpart.c b/drivers/mtd/mtdpart.c
index edb90b58a9b1..8e77e36e75ee 100644
--- a/drivers/mtd/mtdpart.c
+++ b/drivers/mtd/mtdpart.c
@@ -214,7 +214,7 @@ static int part_erase(struct mtd_info *mtd, struct erase_info *instr)
        instr->addr += part->offset;
        ret = part->master->erase(part->master, instr);
        if (ret) {
-                if (instr->fail_addr != 0xffffffff)
+                if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
                        instr->fail_addr -= part->offset;
                instr->addr -= part->offset;
        }
@@ -226,7 +226,7 @@ void mtd_erase_callback(struct erase_info *instr)
        if (instr->mtd->erase == part_erase) {
                struct mtd_part *part = PART(instr->mtd);
-                if (instr->fail_addr != 0xffffffff)
+                if (instr->fail_addr != MTD_FAIL_ADDR_UNKNOWN)
                        instr->fail_addr -= part->offset;
                instr->addr -= part->offset;
        }
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 41f361c49b32..8eb2b06cf0d9 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -68,12 +68,6 @@ config MTD_NAND_AMS_DELTA
        help
          Support for NAND flash on Amstrad E3 (Delta).
-config MTD_NAND_TOTO
-        tristate "NAND Flash device on TOTO board"
-        depends on ARCH_OMAP && BROKEN
-        help
-          Support for NAND flash on Texas Instruments Toto platform.
 config MTD_NAND_TS7250
        tristate "NAND Flash device on TS-7250 board"
        depends on MACH_TS72XX
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index b786c5da82da..8540c46ffba9 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -8,7 +8,6 @@ obj-$(CONFIG_MTD_NAND_IDS)		+= nand_ids.o
 obj-$(CONFIG_MTD_NAND_CAFE)             += cafe_nand.o
 obj-$(CONFIG_MTD_NAND_SPIA)             += spia.o
 obj-$(CONFIG_MTD_NAND_AMS_DELTA)        += ams-delta.o
-obj-$(CONFIG_MTD_NAND_TOTO)             += toto.o
 obj-$(CONFIG_MTD_NAND_AUTCPU12)         += autcpu12.o
 obj-$(CONFIG_MTD_NAND_EDB7312)          += edb7312.o
 obj-$(CONFIG_MTD_NAND_AU1550)           += au1550nd.o
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index d1129bae6c27..d303db39c48d 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -801,9 +801,9 @@ static int nand_read_page_swecc(struct mtd_info *mtd, struct nand_chip *chip,
 * nand_read_subpage - [REPLACABLE] software ecc based sub-page read function
 * @mtd:        mtd info structure
 * @chip:       nand chip info structure
- * @dataofs     offset of requested data within the page
+ * @data_offs:  offset of requested data within the page
- * @readlen     data length
+ * @readlen:    data length
- * @buf:        buffer to store read data
+ * @bufpoi:     buffer to store read data
 */
 static int nand_read_subpage(struct mtd_info *mtd, struct nand_chip *chip, uint32_t data_offs, uint32_t readlen, uint8_t *bufpoi)
 {
@@ -2042,7 +2042,7 @@ int nand_erase_nand(struct mtd_info *mtd, struct erase_info *instr,
                return -EINVAL;
        }
-        instr->fail_addr = 0xffffffff;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* Grab the lock and see if the device is available */
        nand_get_device(chip, mtd, FL_ERASING);
diff --git a/drivers/mtd/nand/nand_ecc.c b/drivers/mtd/nand/nand_ecc.c
index 918a806a8471..868147acce2c 100644
--- a/drivers/mtd/nand/nand_ecc.c
+++ b/drivers/mtd/nand/nand_ecc.c
@@ -1,13 +1,18 @@
 /*
- * This file contains an ECC algorithm from Toshiba that detects and
+ * This file contains an ECC algorithm that detects and corrects 1 bit
- * corrects 1 bit errors in a 256 byte block of data.
+ * errors in a 256 byte block of data.
 *
 * drivers/mtd/nand/nand_ecc.c
 *
- * Copyright (C) 2000-2004 Steven J. Hill (sjhill@realitydiluted.com)
+ * Copyright © 2008 Koninklijke Philips Electronics NV.
- *                         Toshiba America Electronics Components, Inc.
+ *                  Author: Frans Meulenbroeks
 *
- * Copyright (C) 2006 Thomas Gleixner <tglx@linutronix.de>
+ * Completely replaces the previous ECC implementation which was written by:
+ *   Steven J. Hill (sjhill@realitydiluted.com)
+ *   Thomas Gleixner (tglx@linutronix.de)
+ *
+ * Information on how this algorithm works and how it was developed
+ * can be found in Documentation/mtd/nand_ecc.txt
 *
 * This file is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
@@ -23,174 +28,475 @@
 * with this file; if not, write to the Free Software Foundation, Inc.,
 * 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA.
 *
- * As a special exception, if other files instantiate templates or use
- * macros or inline functions from these files, or you compile these
- * files and link them with other works to produce a work based on these
- * files, these files do not by themselves cause the resulting work to be
- * covered by the GNU General Public License. However the source code for
- * these files must still be made available in accordance with section (3)
- * of the GNU General Public License.
- *
- * This exception does not invalidate any other reasons why a work based on
- * this file might be covered by the GNU General Public License.
 */
+/*
+ * The STANDALONE macro is useful when running the code outside the kernel
+ * e.g. when running the code in a testbed or a benchmark program.
+ * When STANDALONE is used, the module related macros are commented out
+ * as well as the linux include files.
+ * Instead a private definition of mtd_info is given to satisfy the compiler
+ * (the code does not use mtd_info, so the code does not care)
+ */
+#ifndef STANDALONE
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
 #include <linux/mtd/nand_ecc.h>
+#include <asm/byteorder.h>
+#else
+#include <stdint.h>
+struct mtd_info;
+#define EXPORT_SYMBOL(x)  /* x */
+#define MODULE_LICENSE(x)       /* x */
+#define MODULE_AUTHOR(x)        /* x */
+#define MODULE_DESCRIPTION(x)   /* x */
+#define printk printf
+#define KERN_ERR                ""
+#endif
+/*
+ * invparity is a 256 byte table that contains the odd parity
+ * for each byte. So if the number of bits in a byte is even,
+ * the array element is 1, and when the number of bits is odd
+ * the array eleemnt is 0.
+ */
+static const char invparity[256] = {
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        0, 1, 1, 0, 1, 0, 0, 1, 1, 0, 0, 1, 0, 1, 1, 0,
+        1, 0, 0, 1, 0, 1, 1, 0, 0, 1, 1, 0, 1, 0, 0, 1
+};
+/*
+ * bitsperbyte contains the number of bits per byte
+ * this is only used for testing and repairing parity
+ * (a precalculated value slightly improves performance)
+ */
+static const char bitsperbyte[256] = {
+        0, 1, 1, 2, 1, 2, 2, 3, 1, 2, 2, 3, 2, 3, 3, 4,
+        1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5,
+        1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7,
+        1, 2, 2, 3, 2, 3, 3, 4, 2, 3, 3, 4, 3, 4, 4, 5,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7,
+        2, 3, 3, 4, 3, 4, 4, 5, 3, 4, 4, 5, 4, 5, 5, 6,
+        3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7,
+        3, 4, 4, 5, 4, 5, 5, 6, 4, 5, 5, 6, 5, 6, 6, 7,
+        4, 5, 5, 6, 5, 6, 6, 7, 5, 6, 6, 7, 6, 7, 7, 8,
+};
 /*
- * Pre-calculated 256-way 1 byte column parity
+ * addressbits is a lookup table to filter out the bits from the xor-ed
+ * ecc data that identify the faulty location.
+ * this is only used for repairing parity
+ * see the comments in nand_correct_data for more details
 */
-static const u_char nand_ecc_precalc_table[] = {
+static const char addressbits[256] = {
-        0x00, 0x55, 0x56, 0x03, 0x59, 0x0c, 0x0f, 0x5a, 0x5a, 0x0f, 0x0c, 0x59, 0x03, 0x56, 0x55, 0x00,
+        0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01,
-        0x65, 0x30, 0x33, 0x66, 0x3c, 0x69, 0x6a, 0x3f, 0x3f, 0x6a, 0x69, 0x3c, 0x66, 0x33, 0x30, 0x65,
+        0x02, 0x02, 0x03, 0x03, 0x02, 0x02, 0x03, 0x03,
-        0x66, 0x33, 0x30, 0x65, 0x3f, 0x6a, 0x69, 0x3c, 0x3c, 0x69, 0x6a, 0x3f, 0x65, 0x30, 0x33, 0x66,
+        0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01,
-        0x03, 0x56, 0x55, 0x00, 0x5a, 0x0f, 0x0c, 0x59, 0x59, 0x0c, 0x0f, 0x5a, 0x00, 0x55, 0x56, 0x03,
+        0x02, 0x02, 0x03, 0x03, 0x02, 0x02, 0x03, 0x03,
-        0x69, 0x3c, 0x3f, 0x6a, 0x30, 0x65, 0x66, 0x33, 0x33, 0x66, 0x65, 0x30, 0x6a, 0x3f, 0x3c, 0x69,
+        0x04, 0x04, 0x05, 0x05, 0x04, 0x04, 0x05, 0x05,
-        0x0c, 0x59, 0x5a, 0x0f, 0x55, 0x00, 0x03, 0x56, 0x56, 0x03, 0x00, 0x55, 0x0f, 0x5a, 0x59, 0x0c,
+        0x06, 0x06, 0x07, 0x07, 0x06, 0x06, 0x07, 0x07,
-        0x0f, 0x5a, 0x59, 0x0c, 0x56, 0x03, 0x00, 0x55, 0x55, 0x00, 0x03, 0x56, 0x0c, 0x59, 0x5a, 0x0f,
+        0x04, 0x04, 0x05, 0x05, 0x04, 0x04, 0x05, 0x05,
-        0x6a, 0x3f, 0x3c, 0x69, 0x33, 0x66, 0x65, 0x30, 0x30, 0x65, 0x66, 0x33, 0x69, 0x3c, 0x3f, 0x6a,
+        0x06, 0x06, 0x07, 0x07, 0x06, 0x06, 0x07, 0x07,
-        0x6a, 0x3f, 0x3c, 0x69, 0x33, 0x66, 0x65, 0x30, 0x30, 0x65, 0x66, 0x33, 0x69, 0x3c, 0x3f, 0x6a,
+        0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01,
-        0x0f, 0x5a, 0x59, 0x0c, 0x56, 0x03, 0x00, 0x55, 0x55, 0x00, 0x03, 0x56, 0x0c, 0x59, 0x5a, 0x0f,
+        0x02, 0x02, 0x03, 0x03, 0x02, 0x02, 0x03, 0x03,
-        0x0c, 0x59, 0x5a, 0x0f, 0x55, 0x00, 0x03, 0x56, 0x56, 0x03, 0x00, 0x55, 0x0f, 0x5a, 0x59, 0x0c,
+        0x00, 0x00, 0x01, 0x01, 0x00, 0x00, 0x01, 0x01,
-        0x69, 0x3c, 0x3f, 0x6a, 0x30, 0x65, 0x66, 0x33, 0x33, 0x66, 0x65, 0x30, 0x6a, 0x3f, 0x3c, 0x69,
+        0x02, 0x02, 0x03, 0x03, 0x02, 0x02, 0x03, 0x03,
-        0x03, 0x56, 0x55, 0x00, 0x5a, 0x0f, 0x0c, 0x59, 0x59, 0x0c, 0x0f, 0x5a, 0x00, 0x55, 0x56, 0x03,
+        0x04, 0x04, 0x05, 0x05, 0x04, 0x04, 0x05, 0x05,
-        0x66, 0x33, 0x30, 0x65, 0x3f, 0x6a, 0x69, 0x3c, 0x3c, 0x69, 0x6a, 0x3f, 0x65, 0x30, 0x33, 0x66,
+        0x06, 0x06, 0x07, 0x07, 0x06, 0x06, 0x07, 0x07,
-        0x65, 0x30, 0x33, 0x66, 0x3c, 0x69, 0x6a, 0x3f, 0x3f, 0x6a, 0x69, 0x3c, 0x66, 0x33, 0x30, 0x65,
+        0x04, 0x04, 0x05, 0x05, 0x04, 0x04, 0x05, 0x05,
-        0x00, 0x55, 0x56, 0x03, 0x59, 0x0c, 0x0f, 0x5a, 0x5a, 0x0f, 0x0c, 0x59, 0x03, 0x56, 0x55, 0x00
+        0x06, 0x06, 0x07, 0x07, 0x06, 0x06, 0x07, 0x07,
+        0x08, 0x08, 0x09, 0x09, 0x08, 0x08, 0x09, 0x09,
+        0x0a, 0x0a, 0x0b, 0x0b, 0x0a, 0x0a, 0x0b, 0x0b,
+        0x08, 0x08, 0x09, 0x09, 0x08, 0x08, 0x09, 0x09,
+        0x0a, 0x0a, 0x0b, 0x0b, 0x0a, 0x0a, 0x0b, 0x0b,
+        0x0c, 0x0c, 0x0d, 0x0d, 0x0c, 0x0c, 0x0d, 0x0d,
+        0x0e, 0x0e, 0x0f, 0x0f, 0x0e, 0x0e, 0x0f, 0x0f,
+        0x0c, 0x0c, 0x0d, 0x0d, 0x0c, 0x0c, 0x0d, 0x0d,
+        0x0e, 0x0e, 0x0f, 0x0f, 0x0e, 0x0e, 0x0f, 0x0f,
+        0x08, 0x08, 0x09, 0x09, 0x08, 0x08, 0x09, 0x09,
+        0x0a, 0x0a, 0x0b, 0x0b, 0x0a, 0x0a, 0x0b, 0x0b,
+        0x08, 0x08, 0x09, 0x09, 0x08, 0x08, 0x09, 0x09,
+        0x0a, 0x0a, 0x0b, 0x0b, 0x0a, 0x0a, 0x0b, 0x0b,
+        0x0c, 0x0c, 0x0d, 0x0d, 0x0c, 0x0c, 0x0d, 0x0d,
+        0x0e, 0x0e, 0x0f, 0x0f, 0x0e, 0x0e, 0x0f, 0x0f,
+        0x0c, 0x0c, 0x0d, 0x0d, 0x0c, 0x0c, 0x0d, 0x0d,
+        0x0e, 0x0e, 0x0f, 0x0f, 0x0e, 0x0e, 0x0f, 0x0f
 };
 /**
- * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256-byte block
+ * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
+ *                       block
 * @mtd:        MTD block structure
- * @dat:        raw data
+ * @buf:        input buffer with raw data
- * @ecc_code:   buffer for ECC
+ * @code:       output buffer with ECC
 */
-int nand_calculate_ecc(struct mtd_info *mtd, const u_char *dat,
+int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
-                       u_char *ecc_code)
+                       unsigned char *code)
 {
-        uint8_t idx, reg1, reg2, reg3, tmp1, tmp2;
        int i;
+        const uint32_t *bp = (uint32_t *)buf;
+        /* 256 or 512 bytes/ecc  */
+        const uint32_t eccsize_mult =
+                        (((struct nand_chip *)mtd->priv)->ecc.size) >> 8;
+        uint32_t cur;           /* current value in buffer */
+        /* rp0..rp15..rp17 are the various accumulated parities (per byte) */
+        uint32_t rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
+        uint32_t rp8, rp9, rp10, rp11, rp12, rp13, rp14, rp15, rp16;
+        uint32_t uninitialized_var(rp17);       /* to make compiler happy */
+        uint32_t par;           /* the cumulative parity for all data */
+        uint32_t tmppar;        /* the cumulative parity for this iteration;
+                                   for rp12, rp14 and rp16 at the end of the
+                                   loop */
+        par = 0;
+        rp4 = 0;
+        rp6 = 0;
+        rp8 = 0;
+        rp10 = 0;
+        rp12 = 0;
+        rp14 = 0;
+        rp16 = 0;
+        /*
+         * The loop is unrolled a number of times;
+         * This avoids if statements to decide on which rp value to update
+         * Also we process the data by longwords.
+         * Note: passing unaligned data might give a performance penalty.
+         * It is assumed that the buffers are aligned.
+         * tmppar is the cumulative sum of this iteration.
+         * needed for calculating rp12, rp14, rp16 and par
+         * also used as a performance improvement for rp6, rp8 and rp10
+         */
+        for (i = 0; i < eccsize_mult << 2; i++) {
+                cur = *bp++;
+                tmppar = cur;
+                rp4 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp6 ^= tmppar;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp4 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp8 ^= tmppar;
-        /* Initialize variables */
+                cur = *bp++;
-        reg1 = reg2 = reg3 = 0;
+                tmppar ^= cur;
+                rp4 ^= cur;
+                rp6 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp6 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp4 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp10 ^= tmppar;
-        /* Build up column parity */
+                cur = *bp++;
-        for(i = 0; i < 256; i++) {
+                tmppar ^= cur;
-                /* Get CP0 - CP5 from table */
+                rp4 ^= cur;
-                idx = nand_ecc_precalc_table[*dat++];
+                rp6 ^= cur;
-                reg1 ^= (idx & 0x3f);
+                rp8 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp6 ^= cur;
+                rp8 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp4 ^= cur;
+                rp8 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp8 ^= cur;
-                /* All bit XOR = 1 ? */
+                cur = *bp++;
-                if (idx & 0x40) {
+                tmppar ^= cur;
-                        reg3 ^= (uint8_t) i;
+                rp4 ^= cur;
-                        reg2 ^= ~((uint8_t) i);
+                rp6 ^= cur;
-                }
+                cur = *bp++;
+                tmppar ^= cur;
+                rp6 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                rp4 ^= cur;
+                cur = *bp++;
+                tmppar ^= cur;
+                par ^= tmppar;
+                if ((i & 0x1) == 0)
+                        rp12 ^= tmppar;
+                if ((i & 0x2) == 0)
+                        rp14 ^= tmppar;
+                if (eccsize_mult == 2 && (i & 0x4) == 0)
+                        rp16 ^= tmppar;
        }
-        /* Create non-inverted ECC code from line parity */
+        /*
-        tmp1  = (reg3 & 0x80) >> 0; /* B7 -> B7 */
+         * handle the fact that we use longword operations
-        tmp1 |= (reg2 & 0x80) >> 1; /* B7 -> B6 */
+         * we'll bring rp4..rp14..rp16 back to single byte entities by
-        tmp1 |= (reg3 & 0x40) >> 1; /* B6 -> B5 */
+         * shifting and xoring first fold the upper and lower 16 bits,
-        tmp1 |= (reg2 & 0x40) >> 2; /* B6 -> B4 */
+         * then the upper and lower 8 bits.
-        tmp1 |= (reg3 & 0x20) >> 2; /* B5 -> B3 */
+         */
-        tmp1 |= (reg2 & 0x20) >> 3; /* B5 -> B2 */
+        rp4 ^= (rp4 >> 16);
-        tmp1 |= (reg3 & 0x10) >> 3; /* B4 -> B1 */
+        rp4 ^= (rp4 >> 8);
-        tmp1 |= (reg2 & 0x10) >> 4; /* B4 -> B0 */
+        rp4 &= 0xff;
+        rp6 ^= (rp6 >> 16);
-        tmp2  = (reg3 & 0x08) << 4; /* B3 -> B7 */
+        rp6 ^= (rp6 >> 8);
-        tmp2 |= (reg2 & 0x08) << 3; /* B3 -> B6 */
+        rp6 &= 0xff;
-        tmp2 |= (reg3 & 0x04) << 3; /* B2 -> B5 */
+        rp8 ^= (rp8 >> 16);
-        tmp2 |= (reg2 & 0x04) << 2; /* B2 -> B4 */
+        rp8 ^= (rp8 >> 8);
-        tmp2 |= (reg3 & 0x02) << 2; /* B1 -> B3 */
+        rp8 &= 0xff;
-        tmp2 |= (reg2 & 0x02) << 1; /* B1 -> B2 */
+        rp10 ^= (rp10 >> 16);
-        tmp2 |= (reg3 & 0x01) << 1; /* B0 -> B1 */
+        rp10 ^= (rp10 >> 8);
-        tmp2 |= (reg2 & 0x01) << 0; /* B7 -> B0 */
+        rp10 &= 0xff;
+        rp12 ^= (rp12 >> 16);
-        /* Calculate final ECC code */
+        rp12 ^= (rp12 >> 8);
-#ifdef CONFIG_MTD_NAND_ECC_SMC
+        rp12 &= 0xff;
-        ecc_code[0] = ~tmp2;
+        rp14 ^= (rp14 >> 16);
-        ecc_code[1] = ~tmp1;
+        rp14 ^= (rp14 >> 8);
+        rp14 &= 0xff;
+        if (eccsize_mult == 2) {
+                rp16 ^= (rp16 >> 16);
+                rp16 ^= (rp16 >> 8);
+                rp16 &= 0xff;
+        }
+        /*
+         * we also need to calculate the row parity for rp0..rp3
+         * This is present in par, because par is now
+         * rp3 rp3 rp2 rp2 in little endian and
+         * rp2 rp2 rp3 rp3 in big endian
+         * as well as
+         * rp1 rp0 rp1 rp0 in little endian and
+         * rp0 rp1 rp0 rp1 in big endian
+         * First calculate rp2 and rp3
+         */
+#ifdef __BIG_ENDIAN
+        rp2 = (par >> 16);
+        rp2 ^= (rp2 >> 8);
+        rp2 &= 0xff;
+        rp3 = par & 0xffff;
+        rp3 ^= (rp3 >> 8);
+        rp3 &= 0xff;
 #else
-        ecc_code[0] = ~tmp1;
+        rp3 = (par >> 16);
-        ecc_code[1] = ~tmp2;
+        rp3 ^= (rp3 >> 8);
+        rp3 &= 0xff;
+        rp2 = par & 0xffff;
+        rp2 ^= (rp2 >> 8);
+        rp2 &= 0xff;
 #endif
-        ecc_code[2] = ((~reg1) << 2) | 0x03;
-        return 0;
+        /* reduce par to 16 bits then calculate rp1 and rp0 */
-}
+        par ^= (par >> 16);
-EXPORT_SYMBOL(nand_calculate_ecc);
+#ifdef __BIG_ENDIAN
+        rp0 = (par >> 8) & 0xff;
+        rp1 = (par & 0xff);
+#else
+        rp1 = (par >> 8) & 0xff;
+        rp0 = (par & 0xff);
+#endif
-static inline int countbits(uint32_t byte)
+        /* finally reduce par to 8 bits */
-{
+        par ^= (par >> 8);
-        int res = 0;
+        par &= 0xff;
-        for (;byte; byte >>= 1)
+        /*
-                res += byte & 0x01;
+         * and calculate rp5..rp15..rp17
-        return res;
+         * note that par = rp4 ^ rp5 and due to the commutative property
+         * of the ^ operator we can say:
+         * rp5 = (par ^ rp4);
+         * The & 0xff seems superfluous, but benchmarking learned that
+         * leaving it out gives slightly worse results. No idea why, probably
+         * it has to do with the way the pipeline in pentium is organized.
+         */
+        rp5 = (par ^ rp4) & 0xff;
+        rp7 = (par ^ rp6) & 0xff;
+        rp9 = (par ^ rp8) & 0xff;
+        rp11 = (par ^ rp10) & 0xff;
+        rp13 = (par ^ rp12) & 0xff;
+        rp15 = (par ^ rp14) & 0xff;
+        if (eccsize_mult == 2)
+                rp17 = (par ^ rp16) & 0xff;
+        /*
+         * Finally calculate the ecc bits.
+         * Again here it might seem that there are performance optimisations
+         * possible, but benchmarks showed that on the system this is developed
+         * the code below is the fastest
+         */
+#ifdef CONFIG_MTD_NAND_ECC_SMC
+        code[0] =
+            (invparity[rp7] << 7) |
+            (invparity[rp6] << 6) |
+            (invparity[rp5] << 5) |
+            (invparity[rp4] << 4) |
+            (invparity[rp3] << 3) |
+            (invparity[rp2] << 2) |
+            (invparity[rp1] << 1) |
+            (invparity[rp0]);
+        code[1] =
+            (invparity[rp15] << 7) |
+            (invparity[rp14] << 6) |
+            (invparity[rp13] << 5) |
+            (invparity[rp12] << 4) |
+            (invparity[rp11] << 3) |
+            (invparity[rp10] << 2) |
+            (invparity[rp9] << 1)  |
+            (invparity[rp8]);
+#else
+        code[1] =
+            (invparity[rp7] << 7) |
+            (invparity[rp6] << 6) |
+            (invparity[rp5] << 5) |
+            (invparity[rp4] << 4) |
+            (invparity[rp3] << 3) |
+            (invparity[rp2] << 2) |
+            (invparity[rp1] << 1) |
+            (invparity[rp0]);
+        code[0] =
+            (invparity[rp15] << 7) |
+            (invparity[rp14] << 6) |
+            (invparity[rp13] << 5) |
+            (invparity[rp12] << 4) |
+            (invparity[rp11] << 3) |
+            (invparity[rp10] << 2) |
+            (invparity[rp9] << 1)  |
+            (invparity[rp8]);
+#endif
+        if (eccsize_mult == 1)
+                code[2] =
+                    (invparity[par & 0xf0] << 7) |
+                    (invparity[par & 0x0f] << 6) |
+                    (invparity[par & 0xcc] << 5) |
+                    (invparity[par & 0x33] << 4) |
+                    (invparity[par & 0xaa] << 3) |
+                    (invparity[par & 0x55] << 2) |
+                    3;
+        else
+                code[2] =
+                    (invparity[par & 0xf0] << 7) |
+                    (invparity[par & 0x0f] << 6) |
+                    (invparity[par & 0xcc] << 5) |
+                    (invparity[par & 0x33] << 4) |
+                    (invparity[par & 0xaa] << 3) |
+                    (invparity[par & 0x55] << 2) |
+                    (invparity[rp17] << 1) |
+                    (invparity[rp16] << 0);
+        return 0;
 }
+EXPORT_SYMBOL(nand_calculate_ecc);
 /**
 * nand_correct_data - [NAND Interface] Detect and correct bit error(s)
 * @mtd:        MTD block structure
- * @dat:        raw data read from the chip
+ * @buf:        raw data read from the chip
 * @read_ecc:   ECC from the chip
 * @calc_ecc:   the ECC calculated from raw data
 *
- * Detect and correct a 1 bit error for 256 byte block
+ * Detect and correct a 1 bit error for 256/512 byte block
 */
-int nand_correct_data(struct mtd_info *mtd, u_char *dat,
+int nand_correct_data(struct mtd_info *mtd, unsigned char *buf,
-                      u_char *read_ecc, u_char *calc_ecc)
+                      unsigned char *read_ecc, unsigned char *calc_ecc)
 {
-        uint8_t s0, s1, s2;
+        unsigned char b0, b1, b2;
+        unsigned char byte_addr, bit_addr;
+        /* 256 or 512 bytes/ecc  */
+        const uint32_t eccsize_mult =
+                        (((struct nand_chip *)mtd->priv)->ecc.size) >> 8;
+        /*
+         * b0 to b2 indicate which bit is faulty (if any)
+         * we might need the xor result  more than once,
+         * so keep them in a local var
+        */
 #ifdef CONFIG_MTD_NAND_ECC_SMC
-        s0 = calc_ecc[0] ^ read_ecc[0];
+        b0 = read_ecc[0] ^ calc_ecc[0];
-        s1 = calc_ecc[1] ^ read_ecc[1];
+        b1 = read_ecc[1] ^ calc_ecc[1];
-        s2 = calc_ecc[2] ^ read_ecc[2];
 #else
-        s1 = calc_ecc[0] ^ read_ecc[0];
+        b0 = read_ecc[1] ^ calc_ecc[1];
-        s0 = calc_ecc[1] ^ read_ecc[1];
+        b1 = read_ecc[0] ^ calc_ecc[0];
-        s2 = calc_ecc[2] ^ read_ecc[2];
 #endif
-        if ((s0 | s1 | s2) == 0)
+        b2 = read_ecc[2] ^ calc_ecc[2];
-                return 0;
-        /* Check for a single bit error */
-        if( ((s0 ^ (s0 >> 1)) & 0x55) == 0x55 &&
-            ((s1 ^ (s1 >> 1)) & 0x55) == 0x55 &&
-            ((s2 ^ (s2 >> 1)) & 0x54) == 0x54) {
-                uint32_t byteoffs, bitnum;
+        /* check if there are any bitfaults */
-                byteoffs = (s1 << 0) & 0x80;
+        /* repeated if statements are slightly more efficient than switch ... */
-                byteoffs |= (s1 << 1) & 0x40;
+        /* ordered in order of likelihood */
-                byteoffs |= (s1 << 2) & 0x20;
-                byteoffs |= (s1 << 3) & 0x10;
-                byteoffs |= (s0 >> 4) & 0x08;
+        if ((b0 | b1 | b2) == 0)
-                byteoffs |= (s0 >> 3) & 0x04;
+                return 0;       /* no error */
-                byteoffs |= (s0 >> 2) & 0x02;
-                byteoffs |= (s0 >> 1) & 0x01;
-                bitnum = (s2 >> 5) & 0x04;
-                bitnum |= (s2 >> 4) & 0x02;
-                bitnum |= (s2 >> 3) & 0x01;
-                dat[byteoffs] ^= (1 << bitnum);
+        if ((((b0 ^ (b0 >> 1)) & 0x55) == 0x55) &&
+            (((b1 ^ (b1 >> 1)) & 0x55) == 0x55) &&
+            ((eccsize_mult == 1 && ((b2 ^ (b2 >> 1)) & 0x54) == 0x54) ||
+             (eccsize_mult == 2 && ((b2 ^ (b2 >> 1)) & 0x55) == 0x55))) {
+        /* single bit error */
+                /*
+                 * rp17/rp15/13/11/9/7/5/3/1 indicate which byte is the faulty
+                 * byte, cp 5/3/1 indicate the faulty bit.
+                 * A lookup table (called addressbits) is used to filter
+                 * the bits from the byte they are in.
+                 * A marginal optimisation is possible by having three
+                 * different lookup tables.
+                 * One as we have now (for b0), one for b2
+                 * (that would avoid the >> 1), and one for b1 (with all values
+                 * << 4). However it was felt that introducing two more tables
+                 * hardly justify the gain.
+                 *
+                 * The b2 shift is there to get rid of the lowest two bits.
+                 * We could also do addressbits[b2] >> 1 but for the
+                 * performace it does not make any difference
+                 */
+                if (eccsize_mult == 1)
+                        byte_addr = (addressbits[b1] << 4) + addressbits[b0];
+                else
+                        byte_addr = (addressbits[b2 & 0x3] << 8) +
+                                    (addressbits[b1] << 4) + addressbits[b0];
+                bit_addr = addressbits[b2 >> 2];
+                /* flip the bit */
+                buf[byte_addr] ^= (1 << bit_addr);
                return 1;
-        }
-        if(countbits(s0 | ((uint32_t)s1 << 8) | ((uint32_t)s2 <<16)) == 1)
+        }
-                return 1;
+        /* count nr of bits; use table lookup, faster than calculating it */
+        if ((bitsperbyte[b0] + bitsperbyte[b1] + bitsperbyte[b2]) == 1)
+                return 1;       /* error in ecc data; no action needed */
-        return -EBADMSG;
+        printk(KERN_ERR "uncorrectable error : ");
+        return -1;
 }
 EXPORT_SYMBOL(nand_correct_data);
 MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Steven J. Hill <sjhill@realitydiluted.com>");
+MODULE_AUTHOR("Frans Meulenbroeks <fransmeulenbroeks@gmail.com>");
 MODULE_DESCRIPTION("Generic NAND ECC support");
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index 556e8131ecdc..ae7c57781a68 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -38,7 +38,6 @@
 #include <linux/delay.h>
 #include <linux/list.h>
 #include <linux/random.h>
-#include <asm/div64.h>
 /* Default simulator parameters values */
 #if !defined(CONFIG_NANDSIM_FIRST_ID_BYTE)  || \
diff --git a/drivers/mtd/nand/toto.c b/drivers/mtd/nand/toto.c
deleted file mode 100644
index bbf492e6830d..000000000000
--- a/drivers/mtd/nand/toto.c
+++ /dev/null
@@ -1,206 +0,0 @@
-/*
- *  drivers/mtd/nand/toto.c
- *
- *  Copyright (c) 2003 Texas Instruments
- *
- *  Derived from drivers/mtd/autcpu12.c
- *
- *  Copyright (c) 2002 Thomas Gleixner <tgxl@linutronix.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 as
- * published by the Free Software Foundation.
- *
- *  Overview:
- *   This is a device driver for the NAND flash device found on the
- *   TI fido board. It supports 32MiB and 64MiB cards
- */
-#include <linux/slab.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/delay.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/nand.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <asm/arch/hardware.h>
-#include <asm/sizes.h>
-#include <asm/arch/toto.h>
-#include <asm/arch-omap1510/hardware.h>
-#include <asm/arch/gpio.h>
-#define CONFIG_NAND_WORKAROUND 1
-/*
- * MTD structure for TOTO board
- */
-static struct mtd_info *toto_mtd = NULL;
-static unsigned long toto_io_base = OMAP_FLASH_1_BASE;
-/*
- * Define partitions for flash devices
- */
-static struct mtd_partition partition_info64M[] = {
-        { .name =       "toto kernel partition 1",
-          .offset =     0,
-          .size =       2 * SZ_1M },
-        { .name =       "toto file sys partition 2",
-          .offset =     2 * SZ_1M,
-          .size =       14 * SZ_1M },
-        { .name =       "toto user partition 3",
-          .offset =     16 * SZ_1M,
-          .size =       16 * SZ_1M },
-        { .name =       "toto devboard extra partition 4",
-          .offset =     32 * SZ_1M,
-          .size =       32 * SZ_1M },
-};
-static struct mtd_partition partition_info32M[] = {
-        { .name =       "toto kernel partition 1",
-          .offset =     0,
-          .size =       2 * SZ_1M },
-        { .name =       "toto file sys partition 2",
-          .offset =     2 * SZ_1M,
-          .size =       14 * SZ_1M },
-        { .name =       "toto user partition 3",
-          .offset =     16 * SZ_1M,
-          .size =       16 * SZ_1M },
-};
-#define NUM_PARTITIONS32M 3
-#define NUM_PARTITIONS64M 4
-/*
- *      hardware specific access to control-lines
- *
- *      ctrl:
- *      NAND_NCE: bit 0 -> bit 14 (0x4000)
- *      NAND_CLE: bit 1 -> bit 12 (0x1000)
- *      NAND_ALE: bit 2 -> bit 1  (0x0002)
- */
-static void toto_hwcontrol(struct mtd_info *mtd, int cmd,
-                           unsigned int ctrl)
-{
-        struct nand_chip *chip = mtd->priv;
-        if (ctrl & NAND_CTRL_CHANGE) {
-                unsigned long bits;
-                /* hopefully enough time for tc make proceding write to clear */
-                udelay(1);
-                bits = (~ctrl & NAND_NCE) << 14;
-                bits |= (ctrl & NAND_CLE) << 12;
-                bits |= (ctrl & NAND_ALE) >> 1;
-#warning Wild guess as gpiosetout() is nowhere defined in the kernel source - tglx
-                gpiosetout(0x5002, bits);
-#ifdef CONFIG_NAND_WORKAROUND
-                /* "some" dev boards busted, blue wired to rts2 :( */
-                rts2setout(2, (ctrl & NAND_CLE) << 1);
-#endif
-                /* allow time to ensure gpio state to over take memory write */
-                udelay(1);
-        }
-        if (cmd != NAND_CMD_NONE)
-                writeb(cmd, chip->IO_ADDR_W);
-}
-/*
- * Main initialization routine
- */
-static int __init toto_init(void)
-{
-        struct nand_chip *this;
-        int err = 0;
-        /* Allocate memory for MTD device structure and private data */
-        toto_mtd = kmalloc(sizeof(struct mtd_info) + sizeof(struct nand_chip), GFP_KERNEL);
-        if (!toto_mtd) {
-                printk(KERN_WARNING "Unable to allocate toto NAND MTD device structure.\n");
-                err = -ENOMEM;
-                goto out;
-        }
-        /* Get pointer to private data */
-        this = (struct nand_chip *)(&toto_mtd[1]);
-        /* Initialize structures */
-        memset(toto_mtd, 0, sizeof(struct mtd_info));
-        memset(this, 0, sizeof(struct nand_chip));
-        /* Link the private data with the MTD structure */
-        toto_mtd->priv = this;
-        toto_mtd->owner = THIS_MODULE;
-        /* Set address of NAND IO lines */
-        this->IO_ADDR_R = toto_io_base;
-        this->IO_ADDR_W = toto_io_base;
-        this->cmd_ctrl = toto_hwcontrol;
-        this->dev_ready = NULL;
-        /* 25 us command delay time */
-        this->chip_delay = 30;
-        this->ecc.mode = NAND_ECC_SOFT;
-        /* Scan to find existance of the device */
-        if (nand_scan(toto_mtd, 1)) {
-                err = -ENXIO;
-                goto out_mtd;
-        }
-        /* Register the partitions */
-        switch (toto_mtd->size) {
-        case SZ_64M:
-                add_mtd_partitions(toto_mtd, partition_info64M, NUM_PARTITIONS64M);
-                break;
-        case SZ_32M:
-                add_mtd_partitions(toto_mtd, partition_info32M, NUM_PARTITIONS32M);
-                break;
-        default:{
-                        printk(KERN_WARNING "Unsupported Nand device\n");
-                        err = -ENXIO;
-                        goto out_buf;
-                }
-        }
-        gpioreserve(NAND_MASK); /* claim our gpios */
-        archflashwp(0, 0);      /* open up flash for writing */
-        goto out;
- out_mtd:
-        kfree(toto_mtd);
- out:
-        return err;
-}
-module_init(toto_init);
-/*
- * Clean up routine
- */
-static void __exit toto_cleanup(void)
-{
-        /* Release resources, unregister device */
-        nand_release(toto_mtd);
-        /* Free the MTD device structure */
-        kfree(toto_mtd);
-        /* stop flash writes */
-        archflashwp(0, 1);
-        /* release gpios to system */
-        gpiorelease(NAND_MASK);
-}
-module_exit(toto_cleanup);
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Richard Woodruff <r-woodruff2@ti.com>");
-MODULE_DESCRIPTION("Glue layer for NAND flash on toto board");
diff --git a/drivers/mtd/onenand/Kconfig b/drivers/mtd/onenand/Kconfig
index cb41cbca64f7..79fa79e8f8de 100644
--- a/drivers/mtd/onenand/Kconfig
+++ b/drivers/mtd/onenand/Kconfig
@@ -27,8 +27,16 @@ config MTD_ONENAND_GENERIC
        help
          Support for OneNAND flash via platform device driver.
+config MTD_ONENAND_OMAP2
+        tristate "OneNAND on OMAP2/OMAP3 support"
+        depends on MTD_ONENAND && (ARCH_OMAP2 || ARCH_OMAP3)
+        help
+          Support for a OneNAND flash device connected to an OMAP2/OMAP3 CPU
+          via the GPMC memory controller.
 config MTD_ONENAND_OTP
        bool "OneNAND OTP Support"
+        select HAVE_MTD_OTP
        help
          One Block of the NAND Flash Array memory is reserved as
          a One-Time Programmable Block memory area.
diff --git a/drivers/mtd/onenand/Makefile b/drivers/mtd/onenand/Makefile
index 4d2eacfd7e11..64b6cc61a520 100644
--- a/drivers/mtd/onenand/Makefile
+++ b/drivers/mtd/onenand/Makefile
@@ -7,6 +7,7 @@ obj-$(CONFIG_MTD_ONENAND)		+= onenand.o
 # Board specific.
 obj-$(CONFIG_MTD_ONENAND_GENERIC)       += generic.o
+obj-$(CONFIG_MTD_ONENAND_OMAP2)         += omap2.o
 # Simulator
 obj-$(CONFIG_MTD_ONENAND_SIM)           += onenand_sim.o
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
new file mode 100644
index 000000000000..34b42533f4bb
--- /dev/null
+++ b/drivers/mtd/onenand/omap2.c
@@ -0,0 +1,782 @@
+/*
+ *  linux/drivers/mtd/onenand/omap2.c
+ *
+ *  OneNAND driver for OMAP2 / OMAP3
+ *
+ *  Copyright © 2005-2006 Nokia Corporation
+ *
+ *  Author: Jarkko Lavinen <jarkko.lavinen@nokia.com> and Juha Yrjölä
+ *  IRQ and DMA support written by Timo Teras
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; see the file COPYING. If not, write to the Free Software
+ * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
+ *
+ */
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/onenand.h>
+#include <linux/mtd/partitions.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/delay.h>
+#include <asm/io.h>
+#include <asm/mach/flash.h>
+#include <asm/arch/gpmc.h>
+#include <asm/arch/onenand.h>
+#include <asm/arch/gpio.h>
+#include <asm/arch/gpmc.h>
+#include <asm/arch/pm.h>
+#include <linux/dma-mapping.h>
+#include <asm/dma-mapping.h>
+#include <asm/arch/dma.h>
+#include <asm/arch/board.h>
+#define DRIVER_NAME "omap2-onenand"
+#define ONENAND_IO_SIZE         SZ_128K
+#define ONENAND_BUFRAM_SIZE     (1024 * 5)
+struct omap2_onenand {
+        struct platform_device *pdev;
+        int gpmc_cs;
+        unsigned long phys_base;
+        int gpio_irq;
+        struct mtd_info mtd;
+        struct mtd_partition *parts;
+        struct onenand_chip onenand;
+        struct completion irq_done;
+        struct completion dma_done;
+        int dma_channel;
+        int freq;
+        int (*setup)(void __iomem *base, int freq);
+};
+static void omap2_onenand_dma_cb(int lch, u16 ch_status, void *data)
+{
+        struct omap2_onenand *c = data;
+        complete(&c->dma_done);
+}
+static irqreturn_t omap2_onenand_interrupt(int irq, void *dev_id)
+{
+        struct omap2_onenand *c = dev_id;
+        complete(&c->irq_done);
+        return IRQ_HANDLED;
+}
+static inline unsigned short read_reg(struct omap2_onenand *c, int reg)
+{
+        return readw(c->onenand.base + reg);
+}
+static inline void write_reg(struct omap2_onenand *c, unsigned short value,
+                             int reg)
+{
+        writew(value, c->onenand.base + reg);
+}
+static void wait_err(char *msg, int state, unsigned int ctrl, unsigned int intr)
+{
+        printk(KERN_ERR "onenand_wait: %s! state %d ctrl 0x%04x intr 0x%04x\n",
+               msg, state, ctrl, intr);
+}
+static void wait_warn(char *msg, int state, unsigned int ctrl,
+                      unsigned int intr)
+{
+        printk(KERN_WARNING "onenand_wait: %s! state %d ctrl 0x%04x "
+               "intr 0x%04x\n", msg, state, ctrl, intr);
+}
+static int omap2_onenand_wait(struct mtd_info *mtd, int state)
+{
+        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
+        unsigned int intr = 0;
+        unsigned int ctrl;
+        unsigned long timeout;
+        u32 syscfg;
+        if (state == FL_RESETING) {
+                int i;
+                for (i = 0; i < 20; i++) {
+                        udelay(1);
+                        intr = read_reg(c, ONENAND_REG_INTERRUPT);
+                        if (intr & ONENAND_INT_MASTER)
+                                break;
+                }
+                ctrl = read_reg(c, ONENAND_REG_CTRL_STATUS);
+                if (ctrl & ONENAND_CTRL_ERROR) {
+                        wait_err("controller error", state, ctrl, intr);
+                        return -EIO;
+                }
+                if (!(intr & ONENAND_INT_RESET)) {
+                        wait_err("timeout", state, ctrl, intr);
+                        return -EIO;
+                }
+                return 0;
+        }
+        if (state != FL_READING) {
+                int result;
+                /* Turn interrupts on */
+                syscfg = read_reg(c, ONENAND_REG_SYS_CFG1);
+                if (!(syscfg & ONENAND_SYS_CFG1_IOBE)) {
+                        syscfg |= ONENAND_SYS_CFG1_IOBE;
+                        write_reg(c, syscfg, ONENAND_REG_SYS_CFG1);
+                        if (cpu_is_omap34xx())
+                                /* Add a delay to let GPIO settle */
+                                syscfg = read_reg(c, ONENAND_REG_SYS_CFG1);
+                }
+                INIT_COMPLETION(c->irq_done);
+                if (c->gpio_irq) {
+                        result = omap_get_gpio_datain(c->gpio_irq);
+                        if (result == -1) {
+                                ctrl = read_reg(c, ONENAND_REG_CTRL_STATUS);
+                                intr = read_reg(c, ONENAND_REG_INTERRUPT);
+                                wait_err("gpio error", state, ctrl, intr);
+                                return -EIO;
+                        }
+                } else
+                        result = 0;
+                if (result == 0) {
+                        int retry_cnt = 0;
+retry:
+                        result = wait_for_completion_timeout(&c->irq_done,
+                                                    msecs_to_jiffies(20));
+                        if (result == 0) {
+                                /* Timeout after 20ms */
+                                ctrl = read_reg(c, ONENAND_REG_CTRL_STATUS);
+                                if (ctrl & ONENAND_CTRL_ONGO) {
+                                        /*
+                                         * The operation seems to be still going
+                                         * so give it some more time.
+                                         */
+                                        retry_cnt += 1;
+                                        if (retry_cnt < 3)
+                                                goto retry;
+                                        intr = read_reg(c,
+                                                        ONENAND_REG_INTERRUPT);
+                                        wait_err("timeout", state, ctrl, intr);
+                                        return -EIO;
+                                }
+                                intr = read_reg(c, ONENAND_REG_INTERRUPT);
+                                if ((intr & ONENAND_INT_MASTER) == 0)
+                                        wait_warn("timeout", state, ctrl, intr);
+                        }
+                }
+        } else {
+                /* Turn interrupts off */
+                syscfg = read_reg(c, ONENAND_REG_SYS_CFG1);
+                syscfg &= ~ONENAND_SYS_CFG1_IOBE;
+                write_reg(c, syscfg, ONENAND_REG_SYS_CFG1);
+                timeout = jiffies + msecs_to_jiffies(20);
+                while (time_before(jiffies, timeout)) {
+                        intr = read_reg(c, ONENAND_REG_INTERRUPT);
+                        if (intr & ONENAND_INT_MASTER)
+                                break;
+                }
+        }
+        intr = read_reg(c, ONENAND_REG_INTERRUPT);
+        ctrl = read_reg(c, ONENAND_REG_CTRL_STATUS);
+        if (intr & ONENAND_INT_READ) {
+                int ecc = read_reg(c, ONENAND_REG_ECC_STATUS);
+                if (ecc) {
+                        unsigned int addr1, addr8;
+                        addr1 = read_reg(c, ONENAND_REG_START_ADDRESS1);
+                        addr8 = read_reg(c, ONENAND_REG_START_ADDRESS8);
+                        if (ecc & ONENAND_ECC_2BIT_ALL) {
+                                printk(KERN_ERR "onenand_wait: ECC error = "
+                                       "0x%04x, addr1 %#x, addr8 %#x\n",
+                                       ecc, addr1, addr8);
+                                mtd->ecc_stats.failed++;
+                                return -EBADMSG;
+                        } else if (ecc & ONENAND_ECC_1BIT_ALL) {
+                                printk(KERN_NOTICE "onenand_wait: correctable "
+                                       "ECC error = 0x%04x, addr1 %#x, "
+                                       "addr8 %#x\n", ecc, addr1, addr8);
+                                mtd->ecc_stats.corrected++;
+                        }
+                }
+        } else if (state == FL_READING) {
+                wait_err("timeout", state, ctrl, intr);
+                return -EIO;
+        }
+        if (ctrl & ONENAND_CTRL_ERROR) {
+                wait_err("controller error", state, ctrl, intr);
+                if (ctrl & ONENAND_CTRL_LOCK)
+                        printk(KERN_ERR "onenand_wait: "
+                                        "Device is write protected!!!\n");
+                return -EIO;
+        }
+        if (ctrl & 0xFE9F)
+                wait_warn("unexpected controller status", state, ctrl, intr);
+        return 0;
+}
+static inline int omap2_onenand_bufferram_offset(struct mtd_info *mtd, int area)
+{
+        struct onenand_chip *this = mtd->priv;
+        if (ONENAND_CURRENT_BUFFERRAM(this)) {
+                if (area == ONENAND_DATARAM)
+                        return mtd->writesize;
+                if (area == ONENAND_SPARERAM)
+                        return mtd->oobsize;
+        }
+        return 0;
+}
+#if defined(CONFIG_ARCH_OMAP3) || defined(MULTI_OMAP2)
+static int omap3_onenand_read_bufferram(struct mtd_info *mtd, int area,
+                                        unsigned char *buffer, int offset,
+                                        size_t count)
+{
+        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
+        struct onenand_chip *this = mtd->priv;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset;
+        unsigned long timeout;
+        void *buf = (void *)buffer;
+        size_t xtra;
+        volatile unsigned *done;
+        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
+        if (bram_offset & 3 || (size_t)buf & 3 || count < 384)
+                goto out_copy;
+        if (buf >= high_memory) {
+                struct page *p1;
+                if (((size_t)buf & PAGE_MASK) !=
+                    ((size_t)(buf + count - 1) & PAGE_MASK))
+                        goto out_copy;
+                p1 = vmalloc_to_page(buf);
+                if (!p1)
+                        goto out_copy;
+                buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK);
+        }
+        xtra = count & 3;
+        if (xtra) {
+                count -= xtra;
+                memcpy(buf + count, this->base + bram_offset + count, xtra);
+        }
+        dma_src = c->phys_base + bram_offset;
+        dma_dst = dma_map_single(&c->pdev->dev, buf, count, DMA_FROM_DEVICE);
+        if (dma_mapping_error(&c->pdev->dev, dma_dst)) {
+                dev_err(&c->pdev->dev,
+                        "Couldn't DMA map a %d byte buffer\n",
+                        count);
+                goto out_copy;
+        }
+        omap_set_dma_transfer_params(c->dma_channel, OMAP_DMA_DATA_TYPE_S32,
+                                     count >> 2, 1, 0, 0, 0);
+        omap_set_dma_src_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                dma_src, 0, 0);
+        omap_set_dma_dest_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                 dma_dst, 0, 0);
+        INIT_COMPLETION(c->dma_done);
+        omap_start_dma(c->dma_channel);
+        timeout = jiffies + msecs_to_jiffies(20);
+        done = &c->dma_done.done;
+        while (time_before(jiffies, timeout))
+                if (*done)
+                        break;
+        dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_FROM_DEVICE);
+        if (!*done) {
+                dev_err(&c->pdev->dev, "timeout waiting for DMA\n");
+                goto out_copy;
+        }
+        return 0;
+out_copy:
+        memcpy(buf, this->base + bram_offset, count);
+        return 0;
+}
+static int omap3_onenand_write_bufferram(struct mtd_info *mtd, int area,
+                                         const unsigned char *buffer,
+                                         int offset, size_t count)
+{
+        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
+        struct onenand_chip *this = mtd->priv;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset;
+        unsigned long timeout;
+        void *buf = (void *)buffer;
+        volatile unsigned *done;
+        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
+        if (bram_offset & 3 || (size_t)buf & 3 || count < 384)
+                goto out_copy;
+        /* panic_write() may be in an interrupt context */
+        if (in_interrupt())
+                goto out_copy;
+        if (buf >= high_memory) {
+                struct page *p1;
+                if (((size_t)buf & PAGE_MASK) !=
+                    ((size_t)(buf + count - 1) & PAGE_MASK))
+                        goto out_copy;
+                p1 = vmalloc_to_page(buf);
+                if (!p1)
+                        goto out_copy;
+                buf = page_address(p1) + ((size_t)buf & ~PAGE_MASK);
+        }
+        dma_src = dma_map_single(&c->pdev->dev, buf, count, DMA_TO_DEVICE);
+        dma_dst = c->phys_base + bram_offset;
+        if (dma_mapping_error(&c->pdev->dev, dma_dst)) {
+                dev_err(&c->pdev->dev,
+                        "Couldn't DMA map a %d byte buffer\n",
+                        count);
+                return -1;
+        }
+        omap_set_dma_transfer_params(c->dma_channel, OMAP_DMA_DATA_TYPE_S32,
+                                     count >> 2, 1, 0, 0, 0);
+        omap_set_dma_src_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                dma_src, 0, 0);
+        omap_set_dma_dest_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                 dma_dst, 0, 0);
+        INIT_COMPLETION(c->dma_done);
+        omap_start_dma(c->dma_channel);
+        timeout = jiffies + msecs_to_jiffies(20);
+        done = &c->dma_done.done;
+        while (time_before(jiffies, timeout))
+                if (*done)
+                        break;
+        dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_TO_DEVICE);
+        if (!*done) {
+                dev_err(&c->pdev->dev, "timeout waiting for DMA\n");
+                goto out_copy;
+        }
+        return 0;
+out_copy:
+        memcpy(this->base + bram_offset, buf, count);
+        return 0;
+}
+#else
+int omap3_onenand_read_bufferram(struct mtd_info *mtd, int area,
+                                 unsigned char *buffer, int offset,
+                                 size_t count);
+int omap3_onenand_write_bufferram(struct mtd_info *mtd, int area,
+                                  const unsigned char *buffer,
+                                  int offset, size_t count);
+#endif
+#if defined(CONFIG_ARCH_OMAP2) || defined(MULTI_OMAP2)
+static int omap2_onenand_read_bufferram(struct mtd_info *mtd, int area,
+                                        unsigned char *buffer, int offset,
+                                        size_t count)
+{
+        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
+        struct onenand_chip *this = mtd->priv;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset;
+        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
+        /* DMA is not used.  Revisit PM requirements before enabling it. */
+        if (1 || (c->dma_channel < 0) ||
+            ((void *) buffer >= (void *) high_memory) || (bram_offset & 3) ||
+            (((unsigned int) buffer) & 3) || (count < 1024) || (count & 3)) {
+                memcpy(buffer, (__force void *)(this->base + bram_offset),
+                       count);
+                return 0;
+        }
+        dma_src = c->phys_base + bram_offset;
+        dma_dst = dma_map_single(&c->pdev->dev, buffer, count,
+                                 DMA_FROM_DEVICE);
+        if (dma_mapping_error(&c->pdev->dev, dma_dst)) {
+                dev_err(&c->pdev->dev,
+                        "Couldn't DMA map a %d byte buffer\n",
+                        count);
+                return -1;
+        }
+        omap_set_dma_transfer_params(c->dma_channel, OMAP_DMA_DATA_TYPE_S32,
+                                     count / 4, 1, 0, 0, 0);
+        omap_set_dma_src_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                dma_src, 0, 0);
+        omap_set_dma_dest_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                 dma_dst, 0, 0);
+        INIT_COMPLETION(c->dma_done);
+        omap_start_dma(c->dma_channel);
+        wait_for_completion(&c->dma_done);
+        dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_FROM_DEVICE);
+        return 0;
+}
+static int omap2_onenand_write_bufferram(struct mtd_info *mtd, int area,
+                                         const unsigned char *buffer,
+                                         int offset, size_t count)
+{
+        struct omap2_onenand *c = container_of(mtd, struct omap2_onenand, mtd);
+        struct onenand_chip *this = mtd->priv;
+        dma_addr_t dma_src, dma_dst;
+        int bram_offset;
+        bram_offset = omap2_onenand_bufferram_offset(mtd, area) + area + offset;
+        /* DMA is not used.  Revisit PM requirements before enabling it. */
+        if (1 || (c->dma_channel < 0) ||
+            ((void *) buffer >= (void *) high_memory) || (bram_offset & 3) ||
+            (((unsigned int) buffer) & 3) || (count < 1024) || (count & 3)) {
+                memcpy((__force void *)(this->base + bram_offset), buffer,
+                       count);
+                return 0;
+        }
+        dma_src = dma_map_single(&c->pdev->dev, (void *) buffer, count,
+                                 DMA_TO_DEVICE);
+        dma_dst = c->phys_base + bram_offset;
+        if (dma_mapping_error(&c->pdev->dev, dma_dst)) {
+                dev_err(&c->pdev->dev,
+                        "Couldn't DMA map a %d byte buffer\n",
+                        count);
+                return -1;
+        }
+        omap_set_dma_transfer_params(c->dma_channel, OMAP_DMA_DATA_TYPE_S16,
+                                     count / 2, 1, 0, 0, 0);
+        omap_set_dma_src_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                dma_src, 0, 0);
+        omap_set_dma_dest_params(c->dma_channel, 0, OMAP_DMA_AMODE_POST_INC,
+                                 dma_dst, 0, 0);
+        INIT_COMPLETION(c->dma_done);
+        omap_start_dma(c->dma_channel);
+        wait_for_completion(&c->dma_done);
+        dma_unmap_single(&c->pdev->dev, dma_dst, count, DMA_TO_DEVICE);
+        return 0;
+}
+#else
+int omap2_onenand_read_bufferram(struct mtd_info *mtd, int area,
+                                 unsigned char *buffer, int offset,
+                                 size_t count);
+int omap2_onenand_write_bufferram(struct mtd_info *mtd, int area,
+                                  const unsigned char *buffer,
+                                  int offset, size_t count);
+#endif
+static struct platform_driver omap2_onenand_driver;
+static int __adjust_timing(struct device *dev, void *data)
+{
+        int ret = 0;
+        struct omap2_onenand *c;
+        c = dev_get_drvdata(dev);
+        BUG_ON(c->setup == NULL);
+        /* DMA is not in use so this is all that is needed */
+        /* Revisit for OMAP3! */
+        ret = c->setup(c->onenand.base, c->freq);
+        return ret;
+}
+int omap2_onenand_rephase(void)
+{
+        return driver_for_each_device(&omap2_onenand_driver.driver, NULL,
+                                      NULL, __adjust_timing);
+}
+static void __devexit omap2_onenand_shutdown(struct platform_device *pdev)
+{
+        struct omap2_onenand *c = dev_get_drvdata(&pdev->dev);
+        /* With certain content in the buffer RAM, the OMAP boot ROM code
+         * can recognize the flash chip incorrectly. Zero it out before
+         * soft reset.
+         */
+        memset((__force void *)c->onenand.base, 0, ONENAND_BUFRAM_SIZE);
+}
+static int __devinit omap2_onenand_probe(struct platform_device *pdev)
+{
+        struct omap_onenand_platform_data *pdata;
+        struct omap2_onenand *c;
+        int r;
+        pdata = pdev->dev.platform_data;
+        if (pdata == NULL) {
+                dev_err(&pdev->dev, "platform data missing\n");
+                return -ENODEV;
+        }
+        c = kzalloc(sizeof(struct omap2_onenand), GFP_KERNEL);
+        if (!c)
+                return -ENOMEM;
+        init_completion(&c->irq_done);
+        init_completion(&c->dma_done);
+        c->gpmc_cs = pdata->cs;
+        c->gpio_irq = pdata->gpio_irq;
+        c->dma_channel = pdata->dma_channel;
+        if (c->dma_channel < 0) {
+                /* if -1, don't use DMA */
+                c->gpio_irq = 0;
+        }
+        r = gpmc_cs_request(c->gpmc_cs, ONENAND_IO_SIZE, &c->phys_base);
+        if (r < 0) {
+                dev_err(&pdev->dev, "Cannot request GPMC CS\n");
+                goto err_kfree;
+        }
+        if (request_mem_region(c->phys_base, ONENAND_IO_SIZE,
+                               pdev->dev.driver->name) == NULL) {
+                dev_err(&pdev->dev, "Cannot reserve memory region at 0x%08lx, "
+                        "size: 0x%x\n", c->phys_base, ONENAND_IO_SIZE);
+                r = -EBUSY;
+                goto err_free_cs;
+        }
+        c->onenand.base = ioremap(c->phys_base, ONENAND_IO_SIZE);
+        if (c->onenand.base == NULL) {
+                r = -ENOMEM;
+                goto err_release_mem_region;
+        }
+        if (pdata->onenand_setup != NULL) {
+                r = pdata->onenand_setup(c->onenand.base, c->freq);
+                if (r < 0) {
+                        dev_err(&pdev->dev, "Onenand platform setup failed: "
+                                "%d\n", r);
+                        goto err_iounmap;
+                }
+                c->setup = pdata->onenand_setup;
+        }
+        if (c->gpio_irq) {
+                if ((r = omap_request_gpio(c->gpio_irq)) < 0) {
+                        dev_err(&pdev->dev,  "Failed to request GPIO%d for "
+                                "OneNAND\n", c->gpio_irq);
+                        goto err_iounmap;
+        }
+        omap_set_gpio_direction(c->gpio_irq, 1);
+        if ((r = request_irq(OMAP_GPIO_IRQ(c->gpio_irq),
+                             omap2_onenand_interrupt, IRQF_TRIGGER_RISING,
+                             pdev->dev.driver->name, c)) < 0)
+                goto err_release_gpio;
+        }
+        if (c->dma_channel >= 0) {
+                r = omap_request_dma(0, pdev->dev.driver->name,
+                                     omap2_onenand_dma_cb, (void *) c,
+                                     &c->dma_channel);
+                if (r == 0) {
+                        omap_set_dma_write_mode(c->dma_channel,
+                                                OMAP_DMA_WRITE_NON_POSTED);
+                        omap_set_dma_src_data_pack(c->dma_channel, 1);
+                        omap_set_dma_src_burst_mode(c->dma_channel,
+                                                    OMAP_DMA_DATA_BURST_8);
+                        omap_set_dma_dest_data_pack(c->dma_channel, 1);
+                        omap_set_dma_dest_burst_mode(c->dma_channel,
+                                                     OMAP_DMA_DATA_BURST_8);
+                } else {
+                        dev_info(&pdev->dev,
+                                 "failed to allocate DMA for OneNAND, "
+                                 "using PIO instead\n");
+                        c->dma_channel = -1;
+                }
+        }
+        dev_info(&pdev->dev, "initializing on CS%d, phys base 0x%08lx, virtual "
+                 "base %p\n", c->gpmc_cs, c->phys_base,
+                 c->onenand.base);
+        c->pdev = pdev;
+        c->mtd.name = pdev->dev.bus_id;
+        c->mtd.priv = &c->onenand;
+        c->mtd.owner = THIS_MODULE;
+        if (c->dma_channel >= 0) {
+                struct onenand_chip *this = &c->onenand;
+                this->wait = omap2_onenand_wait;
+                if (cpu_is_omap34xx()) {
+                        this->read_bufferram = omap3_onenand_read_bufferram;
+                        this->write_bufferram = omap3_onenand_write_bufferram;
+                } else {
+                        this->read_bufferram = omap2_onenand_read_bufferram;
+                        this->write_bufferram = omap2_onenand_write_bufferram;
+                }
+        }
+        if ((r = onenand_scan(&c->mtd, 1)) < 0)
+                goto err_release_dma;
+        switch ((c->onenand.version_id >> 4) & 0xf) {
+        case 0:
+                c->freq = 40;
+                break;
+        case 1:
+                c->freq = 54;
+                break;
+        case 2:
+                c->freq = 66;
+                break;
+        case 3:
+                c->freq = 83;
+                break;
+        }
+#ifdef CONFIG_MTD_PARTITIONS
+        if (pdata->parts != NULL)
+                r = add_mtd_partitions(&c->mtd, pdata->parts,
+                                       pdata->nr_parts);
+        else
+#endif
+                r = add_mtd_device(&c->mtd);
+        if (r < 0)
+                goto err_release_onenand;
+        platform_set_drvdata(pdev, c);
+        return 0;
+err_release_onenand:
+        onenand_release(&c->mtd);
+err_release_dma:
+        if (c->dma_channel != -1)
+                omap_free_dma(c->dma_channel);
+        if (c->gpio_irq)
+                free_irq(OMAP_GPIO_IRQ(c->gpio_irq), c);
+err_release_gpio:
+        if (c->gpio_irq)
+                omap_free_gpio(c->gpio_irq);
+err_iounmap:
+        iounmap(c->onenand.base);
+err_release_mem_region:
+        release_mem_region(c->phys_base, ONENAND_IO_SIZE);
+err_free_cs:
+        gpmc_cs_free(c->gpmc_cs);
+err_kfree:
+        kfree(c);
+        return r;
+}
+static int __devexit omap2_onenand_remove(struct platform_device *pdev)
+{
+        struct omap2_onenand *c = dev_get_drvdata(&pdev->dev);
+        BUG_ON(c == NULL);
+#ifdef CONFIG_MTD_PARTITIONS
+        if (c->parts)
+                del_mtd_partitions(&c->mtd);
+        else
+                del_mtd_device(&c->mtd);
+#else
+        del_mtd_device(&c->mtd);
+#endif
+        onenand_release(&c->mtd);
+        if (c->dma_channel != -1)
+                omap_free_dma(c->dma_channel);
+        omap2_onenand_shutdown(pdev);
+        platform_set_drvdata(pdev, NULL);
+        if (c->gpio_irq) {
+                free_irq(OMAP_GPIO_IRQ(c->gpio_irq), c);
+                omap_free_gpio(c->gpio_irq);
+        }
+        iounmap(c->onenand.base);
+        release_mem_region(c->phys_base, ONENAND_IO_SIZE);
+        kfree(c);
+        return 0;
+}
+static struct platform_driver omap2_onenand_driver = {
+        .probe          = omap2_onenand_probe,
+        .remove         = omap2_onenand_remove,
+        .shutdown       = omap2_onenand_shutdown,
+        .driver         = {
+                .name   = DRIVER_NAME,
+                .owner  = THIS_MODULE,
+        },
+};
+static int __init omap2_onenand_init(void)
+{
+        printk(KERN_INFO "OneNAND driver initializing\n");
+        return platform_driver_register(&omap2_onenand_driver);
+}
+static void __exit omap2_onenand_exit(void)
+{
+        platform_driver_unregister(&omap2_onenand_driver);
+}
+module_init(omap2_onenand_init);
+module_exit(omap2_onenand_exit);
+MODULE_ALIAS(DRIVER_NAME);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Jarkko Lavinen <jarkko.lavinen@nokia.com>");
+MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3");
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index 926cf3a4135d..90ed319f26e6 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -1794,7 +1794,7 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                return -EINVAL;
        }
-        instr->fail_addr = 0xffffffff;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        /* Grab the lock and see if the device is available */
        onenand_get_device(mtd, FL_ERASING);
diff --git a/drivers/mtd/ssfdc.c b/drivers/mtd/ssfdc.c
index a5f3d60047d4..33a5d6ed6f18 100644
--- a/drivers/mtd/ssfdc.c
+++ b/drivers/mtd/ssfdc.c
@@ -321,8 +321,7 @@ static void ssfdcr_add_mtd(struct mtd_blktrans_ops *tr, struct mtd_info *mtd)
        DEBUG(MTD_DEBUG_LEVEL1,
                "SSFDC_RO: cis_block=%d,erase_size=%d,map_len=%d,n_zones=%d\n",
                ssfdc->cis_block, ssfdc->erase_size, ssfdc->map_len,
-                (ssfdc->map_len + MAX_PHYS_BLK_PER_ZONE - 1) /
+                DIV_ROUND_UP(ssfdc->map_len, MAX_PHYS_BLK_PER_ZONE));
-                MAX_PHYS_BLK_PER_ZONE);
        /* Set geometry */
        ssfdc->heads = 16;
diff --git a/fs/Kconfig b/fs/Kconfig
index abccb5dab9a8..b7c88e1f0161 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -1136,195 +1136,7 @@ config EFS_FS
          To compile the EFS file system support as a module, choose M here: the
          module will be called efs.
-config JFFS2_FS
+source "fs/jffs2/Kconfig"
-        tristate "Journalling Flash File System v2 (JFFS2) support"
-        select CRC32
-        depends on MTD
-        help
-          JFFS2 is the second generation of the Journalling Flash File System
-          for use on diskless embedded devices. It provides improved wear
-          levelling, compression and support for hard links. You cannot use
-          this on normal block devices, only on 'MTD' devices.
-          Further information on the design and implementation of JFFS2 is
-          available at <http://sources.redhat.com/jffs2/>.
-config JFFS2_FS_DEBUG
-        int "JFFS2 debugging verbosity (0 = quiet, 2 = noisy)"
-        depends on JFFS2_FS
-        default "0"
-        help
-          This controls the amount of debugging messages produced by the JFFS2
-          code. Set it to zero for use in production systems. For evaluation,
-          testing and debugging, it's advisable to set it to one. This will
-          enable a few assertions and will print debugging messages at the
-          KERN_DEBUG loglevel, where they won't normally be visible. Level 2
-          is unlikely to be useful - it enables extra debugging in certain
-          areas which at one point needed debugging, but when the bugs were
-          located and fixed, the detailed messages were relegated to level 2.
-          If reporting bugs, please try to have available a full dump of the
-          messages at debug level 1 while the misbehaviour was occurring.
-config JFFS2_FS_WRITEBUFFER
-        bool "JFFS2 write-buffering support"
-        depends on JFFS2_FS
-        default y
-        help
-          This enables the write-buffering support in JFFS2.
-          This functionality is required to support JFFS2 on the following
-          types of flash devices:
-            - NAND flash
-            - NOR flash with transparent ECC
-            - DataFlash
-config JFFS2_FS_WBUF_VERIFY
-        bool "Verify JFFS2 write-buffer reads"
-        depends on JFFS2_FS_WRITEBUFFER
-        default n
-        help
-          This causes JFFS2 to read back every page written through the
-          write-buffer, and check for errors.
-config JFFS2_SUMMARY
-        bool "JFFS2 summary support (EXPERIMENTAL)"
-        depends on JFFS2_FS && EXPERIMENTAL
-        default n
-        help
-          This feature makes it possible to use summary information
-          for faster filesystem mount.
-          The summary information can be inserted into a filesystem image
-          by the utility 'sumtool'.
-          If unsure, say 'N'.
-config JFFS2_FS_XATTR
-        bool "JFFS2 XATTR support (EXPERIMENTAL)"
-        depends on JFFS2_FS && EXPERIMENTAL
-        default n
-        help
-          Extended attributes are name:value pairs associated with inodes by
-          the kernel or by users (see the attr(5) manual page, or visit
-          <http://acl.bestbits.at/> for details).
-          If unsure, say N.
-config JFFS2_FS_POSIX_ACL
-        bool "JFFS2 POSIX Access Control Lists"
-        depends on JFFS2_FS_XATTR
-        default y
-        select FS_POSIX_ACL
-        help
-          Posix Access Control Lists (ACLs) support permissions for users and
-          groups beyond the owner/group/world scheme.
-          To learn more about Access Control Lists, visit the Posix ACLs for
-          Linux website <http://acl.bestbits.at/>.
-          If you don't know what Access Control Lists are, say N
-config JFFS2_FS_SECURITY
-        bool "JFFS2 Security Labels"
-        depends on JFFS2_FS_XATTR
-        default y
-        help
-          Security labels support alternative access control models
-          implemented by security modules like SELinux.  This option
-          enables an extended attribute handler for file security
-          labels in the jffs2 filesystem.
-          If you are not using a security module that requires using
-          extended attributes for file security labels, say N.
-config JFFS2_COMPRESSION_OPTIONS
-        bool "Advanced compression options for JFFS2"
-        depends on JFFS2_FS
-        default n
-        help
-          Enabling this option allows you to explicitly choose which
-          compression modules, if any, are enabled in JFFS2. Removing
-          compressors can mean you cannot read existing file systems,
-          and enabling experimental compressors can mean that you
-          write a file system which cannot be read by a standard kernel.
-          If unsure, you should _definitely_ say 'N'.
-config JFFS2_ZLIB
-        bool "JFFS2 ZLIB compression support" if JFFS2_COMPRESSION_OPTIONS
-        select ZLIB_INFLATE
-        select ZLIB_DEFLATE
-        depends on JFFS2_FS
-        default y
-        help
-          Zlib is designed to be a free, general-purpose, legally unencumbered,
-          lossless data-compression library for use on virtually any computer
-          hardware and operating system. See <http://www.gzip.org/zlib/> for
-          further information.
-          Say 'Y' if unsure.
-config JFFS2_LZO
-        bool "JFFS2 LZO compression support" if JFFS2_COMPRESSION_OPTIONS
-        select LZO_COMPRESS
-        select LZO_DECOMPRESS
-        depends on JFFS2_FS
-        default n
-        help
-          minilzo-based compression. Generally works better than Zlib.
-          This feature was added in July, 2007. Say 'N' if you need
-          compatibility with older bootloaders or kernels.
-config JFFS2_RTIME
-        bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
-        depends on JFFS2_FS
-        default y
-        help
-          Rtime does manage to recompress already-compressed data. Say 'Y' if unsure.
-config JFFS2_RUBIN
-        bool "JFFS2 RUBIN compression support" if JFFS2_COMPRESSION_OPTIONS
-        depends on JFFS2_FS
-        default n
-        help
-          RUBINMIPS and DYNRUBIN compressors. Say 'N' if unsure.
-choice
-        prompt "JFFS2 default compression mode" if JFFS2_COMPRESSION_OPTIONS
-        default JFFS2_CMODE_PRIORITY
-        depends on JFFS2_FS
-        help
-          You can set here the default compression mode of JFFS2 from
-          the available compression modes. Don't touch if unsure.
-config JFFS2_CMODE_NONE
-        bool "no compression"
-        help
-          Uses no compression.
-config JFFS2_CMODE_PRIORITY
-        bool "priority"
-        help
-          Tries the compressors in a predefined order and chooses the first
-          successful one.
-config JFFS2_CMODE_SIZE
-        bool "size (EXPERIMENTAL)"
-        help
-          Tries all compressors and chooses the one which has the smallest
-          result.
-config JFFS2_CMODE_FAVOURLZO
-        bool "Favour LZO"
-        help
-          Tries all compressors and chooses the one which has the smallest
-          result but gives some preference to LZO (which has faster
-          decompression) at the expense of size.
-endchoice
 # UBIFS File system configuration
 source "fs/ubifs/Kconfig"
diff --git a/fs/jffs2/Kconfig b/fs/jffs2/Kconfig
new file mode 100644
index 000000000000..6ae169cd8faa
--- /dev/null
+++ b/fs/jffs2/Kconfig
@@ -0,0 +1,188 @@
+config JFFS2_FS
+        tristate "Journalling Flash File System v2 (JFFS2) support"
+        select CRC32
+        depends on MTD
+        help
+          JFFS2 is the second generation of the Journalling Flash File System
+          for use on diskless embedded devices. It provides improved wear
+          levelling, compression and support for hard links. You cannot use
+          this on normal block devices, only on 'MTD' devices.
+          Further information on the design and implementation of JFFS2 is
+          available at <http://sources.redhat.com/jffs2/>.
+config JFFS2_FS_DEBUG
+        int "JFFS2 debugging verbosity (0 = quiet, 2 = noisy)"
+        depends on JFFS2_FS
+        default "0"
+        help
+          This controls the amount of debugging messages produced by the JFFS2
+          code. Set it to zero for use in production systems. For evaluation,
+          testing and debugging, it's advisable to set it to one. This will
+          enable a few assertions and will print debugging messages at the
+          KERN_DEBUG loglevel, where they won't normally be visible. Level 2
+          is unlikely to be useful - it enables extra debugging in certain
+          areas which at one point needed debugging, but when the bugs were
+          located and fixed, the detailed messages were relegated to level 2.
+          If reporting bugs, please try to have available a full dump of the
+          messages at debug level 1 while the misbehaviour was occurring.
+config JFFS2_FS_WRITEBUFFER
+        bool "JFFS2 write-buffering support"
+        depends on JFFS2_FS
+        default y
+        help
+          This enables the write-buffering support in JFFS2.
+          This functionality is required to support JFFS2 on the following
+          types of flash devices:
+            - NAND flash
+            - NOR flash with transparent ECC
+            - DataFlash
+config JFFS2_FS_WBUF_VERIFY
+        bool "Verify JFFS2 write-buffer reads"
+        depends on JFFS2_FS_WRITEBUFFER
+        default n
+        help
+          This causes JFFS2 to read back every page written through the
+          write-buffer, and check for errors.
+config JFFS2_SUMMARY
+        bool "JFFS2 summary support (EXPERIMENTAL)"
+        depends on JFFS2_FS && EXPERIMENTAL
+        default n
+        help
+          This feature makes it possible to use summary information
+          for faster filesystem mount.
+          The summary information can be inserted into a filesystem image
+          by the utility 'sumtool'.
+          If unsure, say 'N'.
+config JFFS2_FS_XATTR
+        bool "JFFS2 XATTR support (EXPERIMENTAL)"
+        depends on JFFS2_FS && EXPERIMENTAL
+        default n
+        help
+          Extended attributes are name:value pairs associated with inodes by
+          the kernel or by users (see the attr(5) manual page, or visit
+          <http://acl.bestbits.at/> for details).
+          If unsure, say N.
+config JFFS2_FS_POSIX_ACL
+        bool "JFFS2 POSIX Access Control Lists"
+        depends on JFFS2_FS_XATTR
+        default y
+        select FS_POSIX_ACL
+        help
+          Posix Access Control Lists (ACLs) support permissions for users and
+          groups beyond the owner/group/world scheme.
+          To learn more about Access Control Lists, visit the Posix ACLs for
+          Linux website <http://acl.bestbits.at/>.
+          If you don't know what Access Control Lists are, say N
+config JFFS2_FS_SECURITY
+        bool "JFFS2 Security Labels"
+        depends on JFFS2_FS_XATTR
+        default y
+        help
+          Security labels support alternative access control models
+          implemented by security modules like SELinux.  This option
+          enables an extended attribute handler for file security
+          labels in the jffs2 filesystem.
+          If you are not using a security module that requires using
+          extended attributes for file security labels, say N.
+config JFFS2_COMPRESSION_OPTIONS
+        bool "Advanced compression options for JFFS2"
+        depends on JFFS2_FS
+        default n
+        help
+          Enabling this option allows you to explicitly choose which
+          compression modules, if any, are enabled in JFFS2. Removing
+          compressors can mean you cannot read existing file systems,
+          and enabling experimental compressors can mean that you
+          write a file system which cannot be read by a standard kernel.
+          If unsure, you should _definitely_ say 'N'.
+config JFFS2_ZLIB
+        bool "JFFS2 ZLIB compression support" if JFFS2_COMPRESSION_OPTIONS
+        select ZLIB_INFLATE
+        select ZLIB_DEFLATE
+        depends on JFFS2_FS
+        default y
+        help
+          Zlib is designed to be a free, general-purpose, legally unencumbered,
+          lossless data-compression library for use on virtually any computer
+          hardware and operating system. See <http://www.gzip.org/zlib/> for
+          further information.
+          Say 'Y' if unsure.
+config JFFS2_LZO
+        bool "JFFS2 LZO compression support" if JFFS2_COMPRESSION_OPTIONS
+        select LZO_COMPRESS
+        select LZO_DECOMPRESS
+        depends on JFFS2_FS
+        default n
+        help
+          minilzo-based compression. Generally works better than Zlib.
+          This feature was added in July, 2007. Say 'N' if you need
+          compatibility with older bootloaders or kernels.
+config JFFS2_RTIME
+        bool "JFFS2 RTIME compression support" if JFFS2_COMPRESSION_OPTIONS
+        depends on JFFS2_FS
+        default y
+        help
+          Rtime does manage to recompress already-compressed data. Say 'Y' if unsure.
+config JFFS2_RUBIN
+        bool "JFFS2 RUBIN compression support" if JFFS2_COMPRESSION_OPTIONS
+        depends on JFFS2_FS
+        default n
+        help
+          RUBINMIPS and DYNRUBIN compressors. Say 'N' if unsure.
+choice
+        prompt "JFFS2 default compression mode" if JFFS2_COMPRESSION_OPTIONS
+        default JFFS2_CMODE_PRIORITY
+        depends on JFFS2_FS
+        help
+          You can set here the default compression mode of JFFS2 from
+          the available compression modes. Don't touch if unsure.
+config JFFS2_CMODE_NONE
+        bool "no compression"
+        help
+          Uses no compression.
+config JFFS2_CMODE_PRIORITY
+        bool "priority"
+        help
+          Tries the compressors in a predefined order and chooses the first
+          successful one.
+config JFFS2_CMODE_SIZE
+        bool "size (EXPERIMENTAL)"
+        help
+          Tries all compressors and chooses the one which has the smallest
+          result.
+config JFFS2_CMODE_FAVOURLZO
+        bool "Favour LZO"
+        help
+          Tries all compressors and chooses the one which has the smallest
+          result but gives some preference to LZO (which has faster
+          decompression) at the expense of size.
+endchoice
diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c
index cd219ef55254..b1aaae823a52 100644
--- a/fs/jffs2/dir.c
+++ b/fs/jffs2/dir.c
@@ -311,7 +311,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char
        /* FIXME: If you care. We'd need to use frags for the target
           if it grows much more than this */
        if (targetlen > 254)
-                return -EINVAL;
+                return -ENAMETOOLONG;
        ri = jffs2_alloc_raw_inode();
diff --git a/fs/jffs2/erase.c b/fs/jffs2/erase.c
index dddb2a6c9e2c..259461b910af 100644
--- a/fs/jffs2/erase.c
+++ b/fs/jffs2/erase.c
@@ -68,7 +68,7 @@ static void jffs2_erase_block(struct jffs2_sb_info *c,
        instr->len = c->sector_size;
        instr->callback = jffs2_erase_callback;
        instr->priv = (unsigned long)(&instr[1]);
-        instr->fail_addr = 0xffffffff;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
        ((struct erase_priv_struct *)instr->priv)->jeb = jeb;
        ((struct erase_priv_struct *)instr->priv)->c = c;
@@ -175,7 +175,7 @@ static void jffs2_erase_failed(struct jffs2_sb_info *c, struct jffs2_eraseblock
 {
        /* For NAND, if the failure did not occur at the device level for a
           specific physical page, don't bother updating the bad block table. */
-        if (jffs2_cleanmarker_oob(c) && (bad_offset != 0xffffffff)) {
+        if (jffs2_cleanmarker_oob(c) && (bad_offset != MTD_FAIL_ADDR_UNKNOWN)) {
                /* We had a device-level failure to erase.  Let's see if we've
                   failed too many times. */
                if (!jffs2_write_nand_badblock(c, jeb, bad_offset)) {
diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c
index 086c43830221..89e9b735d8df 100644
--- a/fs/jffs2/fs.c
+++ b/fs/jffs2/fs.c
@@ -207,6 +207,8 @@ int jffs2_statfs(struct dentry *dentry, struct kstatfs *buf)
        buf->f_files = 0;
        buf->f_ffree = 0;
        buf->f_namelen = JFFS2_MAX_NAME_LEN;
+        buf->f_fsid.val[0] = JFFS2_SUPER_MAGIC;
+        buf->f_fsid.val[1] = c->mtd->index;
        spin_lock(&c->erase_completion_lock);
        avail = c->dirty_size + c->free_size;
diff --git a/include/linux/mtd/cfi.h b/include/linux/mtd/cfi.h
index d6fb115f5a07..ee5124ec319e 100644
--- a/include/linux/mtd/cfi.h
+++ b/include/linux/mtd/cfi.h
@@ -12,6 +12,7 @@
 #include <linux/mtd/flashchip.h>
 #include <linux/mtd/map.h>
 #include <linux/mtd/cfi_endian.h>
+#include <linux/mtd/xip.h>
 #ifdef CONFIG_MTD_CFI_I1
 #define cfi_interleave(cfi) 1
@@ -430,7 +431,6 @@ static inline uint32_t cfi_send_gen_cmd(u_char cmd, uint32_t cmd_addr, uint32_t
 {
        map_word val;
        uint32_t addr = base + cfi_build_cmd_addr(cmd_addr, cfi_interleave(cfi), type);
        val = cfi_build_cmd(cmd, map, cfi);
        if (prev_val)
@@ -483,6 +483,13 @@ static inline void cfi_udelay(int us)
        }
 }
+int __xipram cfi_qry_present(struct map_info *map, __u32 base,
+                             struct cfi_private *cfi);
+int __xipram cfi_qry_mode_on(uint32_t base, struct map_info *map,
+                             struct cfi_private *cfi);
+void __xipram cfi_qry_mode_off(uint32_t base, struct map_info *map,
+                               struct cfi_private *cfi);
 struct cfi_extquery *cfi_read_pri(struct map_info *map, uint16_t adr, uint16_t size,
                             const char* name);
 struct cfi_fixup {
diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h
index 08dd131301c1..d4f38c5fd44e 100644
--- a/include/linux/mtd/flashchip.h
+++ b/include/linux/mtd/flashchip.h
@@ -73,6 +73,10 @@ struct flchip {
        int buffer_write_time;
        int erase_time;
+        int word_write_time_max;
+        int buffer_write_time_max;
+        int erase_time_max;
        void *priv;
 };
diff --git a/include/linux/mtd/mtd.h b/include/linux/mtd/mtd.h
index 922636548558..eae26bb6430a 100644
--- a/include/linux/mtd/mtd.h
+++ b/include/linux/mtd/mtd.h
@@ -25,8 +25,10 @@
 #define MTD_ERASE_DONE          0x08
 #define MTD_ERASE_FAILED        0x10
+#define MTD_FAIL_ADDR_UNKNOWN 0xffffffff
 /* If the erase fails, fail_addr might indicate exactly which block failed.  If
-   fail_addr = 0xffffffff, the failure was not at the device level or was not
+   fail_addr = MTD_FAIL_ADDR_UNKNOWN, the failure was not at the device level or was not
   specific to any particular block. */
 struct erase_info {
        struct mtd_info *mtd;
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 81774e5facf4..733d3f3b4eb8 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -248,6 +248,7 @@ struct nand_hw_control {
 * @read_page_raw:      function to read a raw page without ECC
 * @write_page_raw:     function to write a raw page without ECC
 * @read_page:  function to read a page according to the ecc generator requirements
+ * @read_subpage:       function to read parts of the page covered by ECC.
 * @write_page: function to write a page according to the ecc generator requirements
 * @read_oob:   function to read chip OOB data
 * @write_oob:  function to write chip OOB data
diff --git a/include/linux/mtd/onenand_regs.h b/include/linux/mtd/onenand_regs.h
index d1b310c92eb4..0c6bbe28f38c 100644
--- a/include/linux/mtd/onenand_regs.h
+++ b/include/linux/mtd/onenand_regs.h
@@ -152,6 +152,8 @@
 #define ONENAND_SYS_CFG1_INT            (1 << 6)
 #define ONENAND_SYS_CFG1_IOBE           (1 << 5)
 #define ONENAND_SYS_CFG1_RDY_CONF       (1 << 4)
+#define ONENAND_SYS_CFG1_HF             (1 << 2)
+#define ONENAND_SYS_CFG1_SYNC_WRITE     (1 << 1)
 /*
 * Controller Status Register F240h (R)