13 files changed, 922 insertions, 335 deletions
diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
index 3f063108e95f..b1cd7a1a2191 100644
--- a/drivers/mtd/ubi/Kconfig
+++ b/drivers/mtd/ubi/Kconfig
@@ -49,15 +49,16 @@ config MTD_UBI_BEB_RESERVE
          reserved. Leave the default value if unsure.
 config MTD_UBI_GLUEBI
-        bool "Emulate MTD devices"
+        tristate "MTD devices emulation driver (gluebi)"
        default n
        depends on MTD_UBI
        help
-           This option enables MTD devices emulation on top of UBI volumes: for
+           This option enables gluebi - an additional driver which emulates MTD
-           each UBI volumes an MTD device is created, and all I/O to this MTD
+           devices on top of UBI volumes: for each UBI volumes an MTD device is
-           device is redirected to the UBI volume. This is handy to make
+           created, and all I/O to this MTD device is redirected to the UBI
-           MTD-oriented software (like JFFS2) work on top of UBI. Do not enable
+           volume. This is handy to make MTD-oriented software (like JFFS2)
-           this if no legacy software will be used.
+           work on top of UBI. Do not enable this unless you use legacy
+           software.
 source "drivers/mtd/ubi/Kconfig.debug"
 endmenu
diff --git a/drivers/mtd/ubi/Makefile b/drivers/mtd/ubi/Makefile
index dd834e04151b..c9302a5452b0 100644
--- a/drivers/mtd/ubi/Makefile
+++ b/drivers/mtd/ubi/Makefile
@@ -4,4 +4,4 @@ ubi-y += vtbl.o vmt.o upd.o build.o cdev.o kapi.o eba.o io.o wl.o scan.o
 ubi-y += misc.o
 ubi-$(CONFIG_MTD_UBI_DEBUG) += debug.o
-ubi-$(CONFIG_MTD_UBI_GLUEBI) += gluebi.o
+obj-$(CONFIG_MTD_UBI_GLUEBI) += gluebi.o
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 4048db83aef6..286ed594e5a0 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -41,6 +41,7 @@
 #include <linux/miscdevice.h>
 #include <linux/log2.h>
 #include <linux/kthread.h>
+#include <linux/reboot.h>
 #include "ubi.h"
 /* Maximum length of the 'mtd=' parameter */
@@ -122,6 +123,94 @@ static struct device_attribute dev_mtd_num =
        __ATTR(mtd_num, S_IRUGO, dev_attribute_show, NULL);
 /**
+ * ubi_volume_notify - send a volume change notification.
+ * @ubi: UBI device description object
+ * @vol: volume description object of the changed volume
+ * @ntype: notification type to send (%UBI_VOLUME_ADDED, etc)
+ *
+ * This is a helper function which notifies all subscribers about a volume
+ * change event (creation, removal, re-sizing, re-naming, updating). Returns
+ * zero in case of success and a negative error code in case of failure.
+ */
+int ubi_volume_notify(struct ubi_device *ubi, struct ubi_volume *vol, int ntype)
+{
+        struct ubi_notification nt;
+        ubi_do_get_device_info(ubi, &nt.di);
+        ubi_do_get_volume_info(ubi, vol, &nt.vi);
+        return blocking_notifier_call_chain(&ubi_notifiers, ntype, &nt);
+}
+/**
+ * ubi_notify_all - send a notification to all volumes.
+ * @ubi: UBI device description object
+ * @ntype: notification type to send (%UBI_VOLUME_ADDED, etc)
+ * @nb: the notifier to call
+ *
+ * This function walks all volumes of UBI device @ubi and sends the @ntype
+ * notification for each volume. If @nb is %NULL, then all registered notifiers
+ * are called, otherwise only the @nb notifier is called. Returns the number of
+ * sent notifications.
+ */
+int ubi_notify_all(struct ubi_device *ubi, int ntype, struct notifier_block *nb)
+{
+        struct ubi_notification nt;
+        int i, count = 0;
+        ubi_do_get_device_info(ubi, &nt.di);
+        mutex_lock(&ubi->device_mutex);
+        for (i = 0; i < ubi->vtbl_slots; i++) {
+                /*
+                 * Since the @ubi->device is locked, and we are not going to
+                 * change @ubi->volumes, we do not have to lock
+                 * @ubi->volumes_lock.
+                 */
+                if (!ubi->volumes[i])
+                        continue;
+                ubi_do_get_volume_info(ubi, ubi->volumes[i], &nt.vi);
+                if (nb)
+                        nb->notifier_call(nb, ntype, &nt);
+                else
+                        blocking_notifier_call_chain(&ubi_notifiers, ntype,
+                                                     &nt);
+                count += 1;
+        }
+        mutex_unlock(&ubi->device_mutex);
+        return count;
+}
+/**
+ * ubi_enumerate_volumes - send "add" notification for all existing volumes.
+ * @nb: the notifier to call
+ *
+ * This function walks all UBI devices and volumes and sends the
+ * %UBI_VOLUME_ADDED notification for each volume. If @nb is %NULL, then all
+ * registered notifiers are called, otherwise only the @nb notifier is called.
+ * Returns the number of sent notifications.
+ */
+int ubi_enumerate_volumes(struct notifier_block *nb)
+{
+        int i, count = 0;
+        /*
+         * Since the @ubi_devices_mutex is locked, and we are not going to
+         * change @ubi_devices, we do not have to lock @ubi_devices_lock.
+         */
+        for (i = 0; i < UBI_MAX_DEVICES; i++) {
+                struct ubi_device *ubi = ubi_devices[i];
+                if (!ubi)
+                        continue;
+                count += ubi_notify_all(ubi, UBI_VOLUME_ADDED, nb);
+        }
+        return count;
+}
+/**
 * ubi_get_device - get UBI device.
 * @ubi_num: UBI device number
 *
@@ -380,7 +469,7 @@ static void free_user_volumes(struct ubi_device *ubi)
 * @ubi: UBI device description object
 *
 * This function returns zero in case of success and a negative error code in
- * case of failure. Note, this function destroys all volumes if it failes.
+ * case of failure. Note, this function destroys all volumes if it fails.
 */
 static int uif_init(struct ubi_device *ubi)
 {
@@ -633,6 +722,15 @@ static int io_init(struct ubi_device *ubi)
        }
        /*
+         * Set maximum amount of physical erroneous eraseblocks to be 10%.
+         * Erroneous PEB are those which have read errors.
+         */
+        ubi->max_erroneous = ubi->peb_count / 10;
+        if (ubi->max_erroneous < 16)
+                ubi->max_erroneous = 16;
+        dbg_msg("max_erroneous    %d", ubi->max_erroneous);
+        /*
         * It may happen that EC and VID headers are situated in one minimal
         * I/O unit. In this case we can only accept this UBI image in
         * read-only mode.
@@ -726,6 +824,34 @@ static int autoresize(struct ubi_device *ubi, int vol_id)
 }
 /**
+ * ubi_reboot_notifier - halt UBI transactions immediately prior to a reboot.
+ * @n: reboot notifier object
+ * @state: SYS_RESTART, SYS_HALT, or SYS_POWER_OFF
+ * @cmd: pointer to command string for RESTART2
+ *
+ * This function stops the UBI background thread so that the flash device
+ * remains quiescent when Linux restarts the system. Any queued work will be
+ * discarded, but this function will block until do_work() finishes if an
+ * operation is already in progress.
+ *
+ * This function solves a real-life problem observed on NOR flashes when an
+ * PEB erase operation starts, then the system is rebooted before the erase is
+ * finishes, and the boot loader gets confused and dies. So we prefer to finish
+ * the ongoing operation before rebooting.
+ */
+static int ubi_reboot_notifier(struct notifier_block *n, unsigned long state,
+                               void *cmd)
+{
+        struct ubi_device *ubi;
+        ubi = container_of(n, struct ubi_device, reboot_notifier);
+        if (ubi->bgt_thread)
+                kthread_stop(ubi->bgt_thread);
+        ubi_sync(ubi->ubi_num);
+        return NOTIFY_DONE;
+}
+/**
 * ubi_attach_mtd_dev - attach an MTD device.
 * @mtd: MTD device description object
 * @ubi_num: number to assign to the new UBI device
@@ -806,8 +932,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
        mutex_init(&ubi->buf_mutex);
        mutex_init(&ubi->ckvol_mutex);
-        mutex_init(&ubi->mult_mutex);
+        mutex_init(&ubi->device_mutex);
-        mutex_init(&ubi->volumes_mutex);
        spin_lock_init(&ubi->volumes_lock);
        ubi_msg("attaching mtd%d to ubi%d", mtd->index, ubi_num);
@@ -825,7 +950,7 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
        if (!ubi->peb_buf2)
                goto out_free;
-#ifdef CONFIG_MTD_UBI_DEBUG
+#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
        mutex_init(&ubi->dbg_buf_mutex);
        ubi->dbg_peb_buf = vmalloc(ubi->peb_size);
        if (!ubi->dbg_peb_buf)
@@ -872,11 +997,23 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
                ubi->beb_rsvd_pebs);
        ubi_msg("max/mean erase counter: %d/%d", ubi->max_ec, ubi->mean_ec);
+        /*
+         * The below lock makes sure we do not race with 'ubi_thread()' which
+         * checks @ubi->thread_enabled. Otherwise we may fail to wake it up.
+         */
+        spin_lock(&ubi->wl_lock);
        if (!DBG_DISABLE_BGT)
                ubi->thread_enabled = 1;
        wake_up_process(ubi->bgt_thread);
+        spin_unlock(&ubi->wl_lock);
+        /* Flash device priority is 0 - UBI needs to shut down first */
+        ubi->reboot_notifier.priority = 1;
+        ubi->reboot_notifier.notifier_call = ubi_reboot_notifier;
+        register_reboot_notifier(&ubi->reboot_notifier);
        ubi_devices[ubi_num] = ubi;
+        ubi_notify_all(ubi, UBI_VOLUME_ADDED, NULL);
        return ubi_num;
 out_uif:
@@ -892,7 +1029,7 @@ out_detach:
 out_free:
        vfree(ubi->peb_buf1);
        vfree(ubi->peb_buf2);
-#ifdef CONFIG_MTD_UBI_DEBUG
+#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
        vfree(ubi->dbg_peb_buf);
 #endif
        kfree(ubi);
@@ -919,13 +1056,13 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        if (ubi_num < 0 || ubi_num >= UBI_MAX_DEVICES)
                return -EINVAL;
-        spin_lock(&ubi_devices_lock);
+        ubi = ubi_get_device(ubi_num);
-        ubi = ubi_devices[ubi_num];
+        if (!ubi)
-        if (!ubi) {
-                spin_unlock(&ubi_devices_lock);
                return -EINVAL;
-        }
+        spin_lock(&ubi_devices_lock);
+        put_device(&ubi->dev);
+        ubi->ref_count -= 1;
        if (ubi->ref_count) {
                if (!anyway) {
                        spin_unlock(&ubi_devices_lock);
@@ -939,12 +1076,14 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        spin_unlock(&ubi_devices_lock);
        ubi_assert(ubi_num == ubi->ubi_num);
+        ubi_notify_all(ubi, UBI_VOLUME_REMOVED, NULL);
        dbg_msg("detaching mtd%d from ubi%d", ubi->mtd->index, ubi_num);
        /*
         * Before freeing anything, we have to stop the background thread to
         * prevent it from doing anything on this device while we are freeing.
         */
+        unregister_reboot_notifier(&ubi->reboot_notifier);
        if (ubi->bgt_thread)
                kthread_stop(ubi->bgt_thread);
@@ -961,7 +1100,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        put_mtd_device(ubi->mtd);
        vfree(ubi->peb_buf1);
        vfree(ubi->peb_buf2);
-#ifdef CONFIG_MTD_UBI_DEBUG
+#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
        vfree(ubi->dbg_peb_buf);
 #endif
        ubi_msg("mtd%d is detached from ubi%d", ubi->mtd->index, ubi->ubi_num);
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index f8e0f68f2186..f237ddbb2713 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -113,7 +113,8 @@ static int vol_cdev_open(struct inode *inode, struct file *file)
        else
                mode = UBI_READONLY;
-        dbg_gen("open volume %d, mode %d", vol_id, mode);
+        dbg_gen("open device %d, volume %d, mode %d",
+                ubi_num, vol_id, mode);
        desc = ubi_open_volume(ubi_num, vol_id, mode);
        if (IS_ERR(desc))
@@ -128,7 +129,8 @@ static int vol_cdev_release(struct inode *inode, struct file *file)
        struct ubi_volume_desc *desc = file->private_data;
        struct ubi_volume *vol = desc->vol;
-        dbg_gen("release volume %d, mode %d", vol->vol_id, desc->mode);
+        dbg_gen("release device %d, volume %d, mode %d",
+                vol->ubi->ubi_num, vol->vol_id, desc->mode);
        if (vol->updating) {
                ubi_warn("update of volume %d not finished, volume is damaged",
@@ -393,7 +395,7 @@ static ssize_t vol_cdev_write(struct file *file, const char __user *buf,
                        vol->corrupted = 1;
                }
                vol->checked = 1;
-                ubi_gluebi_updated(vol);
+                ubi_volume_notify(ubi, vol, UBI_VOLUME_UPDATED);
                revoke_exclusive(desc, UBI_READWRITE);
        }
@@ -558,7 +560,7 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
                break;
        }
-        /* Set volume property command*/
+        /* Set volume property command */
        case UBI_IOCSETPROP:
        {
                struct ubi_set_prop_req req;
@@ -571,9 +573,9 @@ static long vol_cdev_ioctl(struct file *file, unsigned int cmd,
                }
                switch (req.property) {
                case UBI_PROP_DIRECT_WRITE:
-                        mutex_lock(&ubi->volumes_mutex);
+                        mutex_lock(&ubi->device_mutex);
                        desc->vol->direct_writes = !!req.value;
-                        mutex_unlock(&ubi->volumes_mutex);
+                        mutex_unlock(&ubi->device_mutex);
                        break;
                default:
                        err = -EINVAL;
@@ -810,9 +812,9 @@ static int rename_volumes(struct ubi_device *ubi,
                        re->desc->vol->vol_id, re->desc->vol->name);
        }
-        mutex_lock(&ubi->volumes_mutex);
+        mutex_lock(&ubi->device_mutex);
        err = ubi_rename_volumes(ubi, &rename_list);
-        mutex_unlock(&ubi->volumes_mutex);
+        mutex_unlock(&ubi->device_mutex);
 out_free:
        list_for_each_entry_safe(re, re1, &rename_list, list) {
@@ -856,9 +858,9 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                if (err)
                        break;
-                mutex_lock(&ubi->volumes_mutex);
+                mutex_lock(&ubi->device_mutex);
                err = ubi_create_volume(ubi, &req);
-                mutex_unlock(&ubi->volumes_mutex);
+                mutex_unlock(&ubi->device_mutex);
                if (err)
                        break;
@@ -887,9 +889,9 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                        break;
                }
-                mutex_lock(&ubi->volumes_mutex);
+                mutex_lock(&ubi->device_mutex);
                err = ubi_remove_volume(desc, 0);
-                mutex_unlock(&ubi->volumes_mutex);
+                mutex_unlock(&ubi->device_mutex);
                /*
                 * The volume is deleted (unless an error occurred), and the
@@ -926,9 +928,9 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                pebs = div_u64(req.bytes + desc->vol->usable_leb_size - 1,
                               desc->vol->usable_leb_size);
-                mutex_lock(&ubi->volumes_mutex);
+                mutex_lock(&ubi->device_mutex);
                err = ubi_resize_volume(desc, pebs);
-                mutex_unlock(&ubi->volumes_mutex);
+                mutex_unlock(&ubi->device_mutex);
                ubi_close_volume(desc);
                break;
        }
@@ -952,9 +954,7 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                        break;
                }
-                mutex_lock(&ubi->mult_mutex);
                err = rename_volumes(ubi, req);
-                mutex_unlock(&ubi->mult_mutex);
                kfree(req);
                break;
        }
diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c
index 25def348e5ba..0f2034c3ed2f 100644
--- a/drivers/mtd/ubi/eba.c
+++ b/drivers/mtd/ubi/eba.c
@@ -419,8 +419,9 @@ retry:
                                 * not implemented.
                                 */
                                if (err == UBI_IO_BAD_VID_HDR) {
-                                        ubi_warn("bad VID header at PEB %d, LEB"
+                                        ubi_warn("corrupted VID header at PEB "
-                                                 "%d:%d", pnum, vol_id, lnum);
+                                                 "%d, LEB %d:%d", pnum, vol_id,
+                                                 lnum);
                                        err = -EBADMSG;
                                } else
                                        ubi_ro_mode(ubi);
@@ -940,6 +941,33 @@ write_error:
 }
 /**
+ * is_error_sane - check whether a read error is sane.
+ * @err: code of the error happened during reading
+ *
+ * This is a helper function for 'ubi_eba_copy_leb()' which is called when we
+ * cannot read data from the target PEB (an error @err happened). If the error
+ * code is sane, then we treat this error as non-fatal. Otherwise the error is
+ * fatal and UBI will be switched to R/O mode later.
+ *
+ * The idea is that we try not to switch to R/O mode if the read error is
+ * something which suggests there was a real read problem. E.g., %-EIO. Or a
+ * memory allocation failed (-%ENOMEM). Otherwise, it is safer to switch to R/O
+ * mode, simply because we do not know what happened at the MTD level, and we
+ * cannot handle this. E.g., the underlying driver may have become crazy, and
+ * it is safer to switch to R/O mode to preserve the data.
+ *
+ * And bear in mind, this is about reading from the target PEB, i.e. the PEB
+ * which we have just written.
+ */
+static int is_error_sane(int err)
+{
+        if (err == -EIO || err == -ENOMEM || err == UBI_IO_BAD_VID_HDR ||
+            err == -ETIMEDOUT)
+                return 0;
+        return 1;
+}
+/**
 * ubi_eba_copy_leb - copy logical eraseblock.
 * @ubi: UBI device description object
 * @from: physical eraseblock number from where to copy
@@ -950,12 +978,7 @@ write_error:
 * physical eraseblock @to. The @vid_hdr buffer may be changed by this
 * function. Returns:
 *   o %0 in case of success;
- *   o %1 if the operation was canceled because the volume is being deleted
+ *   o %MOVE_CANCEL_RACE, %MOVE_TARGET_WR_ERR, %MOVE_CANCEL_BITFLIPS, etc;
- *        or because the PEB was put meanwhile;
- *   o %2 if the operation was canceled because there was a write error to the
- *        target PEB;
- *   o %-EAGAIN if the operation was canceled because a bit-flip was detected
- *     in the target PEB;
 *   o a negative error code in case of failure.
 */
 int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
@@ -968,7 +991,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
        vol_id = be32_to_cpu(vid_hdr->vol_id);
        lnum = be32_to_cpu(vid_hdr->lnum);
-        dbg_eba("copy LEB %d:%d, PEB %d to PEB %d", vol_id, lnum, from, to);
+        dbg_wl("copy LEB %d:%d, PEB %d to PEB %d", vol_id, lnum, from, to);
        if (vid_hdr->vol_type == UBI_VID_STATIC) {
                data_size = be32_to_cpu(vid_hdr->data_size);
@@ -986,13 +1009,12 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
         * be locked in 'ubi_wl_put_peb()' and wait for the WL worker to finish.
         */
        vol = ubi->volumes[idx];
+        spin_unlock(&ubi->volumes_lock);
        if (!vol) {
                /* No need to do further work, cancel */
-                dbg_eba("volume %d is being removed, cancel", vol_id);
+                dbg_wl("volume %d is being removed, cancel", vol_id);
-                spin_unlock(&ubi->volumes_lock);
+                return MOVE_CANCEL_RACE;
-                return 1;
        }
-        spin_unlock(&ubi->volumes_lock);
        /*
         * We do not want anybody to write to this logical eraseblock while we
@@ -1004,12 +1026,13 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
         * (@from). This task locks the LEB and goes sleep in the
         * 'ubi_wl_put_peb()' function on the @ubi->move_mutex. In turn, we are
         * holding @ubi->move_mutex and go sleep on the LEB lock. So, if the
-         * LEB is already locked, we just do not move it and return %1.
+         * LEB is already locked, we just do not move it and return
+         * %MOVE_CANCEL_RACE, which means that UBI will re-try, but later.
         */
        err = leb_write_trylock(ubi, vol_id, lnum);
        if (err) {
-                dbg_eba("contention on LEB %d:%d, cancel", vol_id, lnum);
+                dbg_wl("contention on LEB %d:%d, cancel", vol_id, lnum);
-                return err;
+                return MOVE_CANCEL_RACE;
        }
        /*
@@ -1018,25 +1041,26 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
         * cancel it.
         */
        if (vol->eba_tbl[lnum] != from) {
-                dbg_eba("LEB %d:%d is no longer mapped to PEB %d, mapped to "
+                dbg_wl("LEB %d:%d is no longer mapped to PEB %d, mapped to "
-                        "PEB %d, cancel", vol_id, lnum, from,
+                       "PEB %d, cancel", vol_id, lnum, from,
-                        vol->eba_tbl[lnum]);
+                       vol->eba_tbl[lnum]);
-                err = 1;
+                err = MOVE_CANCEL_RACE;
                goto out_unlock_leb;
        }
        /*
         * OK, now the LEB is locked and we can safely start moving it. Since
-         * this function utilizes the @ubi->peb1_buf buffer which is shared
+         * this function utilizes the @ubi->peb_buf1 buffer which is shared
-         * with some other functions, so lock the buffer by taking the
+         * with some other functions - we lock the buffer by taking the
         * @ubi->buf_mutex.
         */
        mutex_lock(&ubi->buf_mutex);
-        dbg_eba("read %d bytes of data", aldata_size);
+        dbg_wl("read %d bytes of data", aldata_size);
        err = ubi_io_read_data(ubi, ubi->peb_buf1, from, 0, aldata_size);
        if (err && err != UBI_IO_BITFLIPS) {
                ubi_warn("error %d while reading data from PEB %d",
                         err, from);
+                err = MOVE_SOURCE_RD_ERR;
                goto out_unlock_buf;
        }
@@ -1059,7 +1083,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
        cond_resched();
        /*
-         * It may turn out to me that the whole @from physical eraseblock
+         * It may turn out to be that the whole @from physical eraseblock
         * contains only 0xFF bytes. Then we have to only write the VID header
         * and do not write any data. This also means we should not set
         * @vid_hdr->copy_flag, @vid_hdr->data_size, and @vid_hdr->data_crc.
@@ -1074,7 +1098,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
        err = ubi_io_write_vid_hdr(ubi, to, vid_hdr);
        if (err) {
                if (err == -EIO)
-                        err = 2;
+                        err = MOVE_TARGET_WR_ERR;
                goto out_unlock_buf;
        }
@@ -1083,10 +1107,13 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
        /* Read the VID header back and check if it was written correctly */
        err = ubi_io_read_vid_hdr(ubi, to, vid_hdr, 1);
        if (err) {
-                if (err != UBI_IO_BITFLIPS)
+                if (err != UBI_IO_BITFLIPS) {
-                        ubi_warn("cannot read VID header back from PEB %d", to);
+                        ubi_warn("error %d while reading VID header back from "
-                else
+                                  "PEB %d", err, to);
-                        err = -EAGAIN;
+                        if (is_error_sane(err))
+                                err = MOVE_TARGET_RD_ERR;
+                } else
+                        err = MOVE_CANCEL_BITFLIPS;
                goto out_unlock_buf;
        }
@@ -1094,7 +1121,7 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
                err = ubi_io_write_data(ubi, ubi->peb_buf1, to, 0, aldata_size);
                if (err) {
                        if (err == -EIO)
-                                err = 2;
+                                err = MOVE_TARGET_WR_ERR;
                        goto out_unlock_buf;
                }
@@ -1107,11 +1134,13 @@ int ubi_eba_copy_leb(struct ubi_device *ubi, int from, int to,
                err = ubi_io_read_data(ubi, ubi->peb_buf2, to, 0, aldata_size);
                if (err) {
-                        if (err != UBI_IO_BITFLIPS)
+                        if (err != UBI_IO_BITFLIPS) {
-                                ubi_warn("cannot read data back from PEB %d",
+                                ubi_warn("error %d while reading data back "
-                                         to);
+                                         "from PEB %d", err, to);
-                        else
+                                if (is_error_sane(err))
-                                err = -EAGAIN;
+                                        err = MOVE_TARGET_RD_ERR;
+                        } else
+                                err = MOVE_CANCEL_BITFLIPS;
                        goto out_unlock_buf;
                }
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index 49cd55ade9c8..95aaac03f938 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -19,17 +19,71 @@
 */
 /*
- * This file includes implementation of fake MTD devices for each UBI volume.
+ * This is a small driver which implements fake MTD devices on top of UBI
- * This sounds strange, but it is in fact quite useful to make MTD-oriented
+ * volumes. This sounds strange, but it is in fact quite useful to make
- * software (including all the legacy software) to work on top of UBI.
+ * MTD-oriented software (including all the legacy software) work on top of
+ * UBI.
 *
 * Gluebi emulates MTD devices of "MTD_UBIVOLUME" type. Their minimal I/O unit
- * size (mtd->writesize) is equivalent to the UBI minimal I/O unit. The
+ * size (@mtd->writesize) is equivalent to the UBI minimal I/O unit. The
 * eraseblock size is equivalent to the logical eraseblock size of the volume.
 */
+#include <linux/err.h>
+#include <linux/list.h>
+#include <linux/sched.h>
 #include <linux/math64.h>
-#include "ubi.h"
+#include <linux/module.h>
+#include <linux/mutex.h>
+#include <linux/mtd/ubi.h>
+#include <linux/mtd/mtd.h>
+#include "ubi-media.h"
+#define err_msg(fmt, ...)                                   \
+        printk(KERN_DEBUG "gluebi (pid %d): %s: " fmt "\n", \
+               current->pid, __func__, ##__VA_ARGS__)
+/**
+ * struct gluebi_device - a gluebi device description data structure.
+ * @mtd: emulated MTD device description object
+ * @refcnt: gluebi device reference count
+ * @desc: UBI volume descriptor
+ * @ubi_num: UBI device number this gluebi device works on
+ * @vol_id: ID of UBI volume this gluebi device works on
+ * @list: link in a list of gluebi devices
+ */
+struct gluebi_device {
+        struct mtd_info mtd;
+        int refcnt;
+        struct ubi_volume_desc *desc;
+        int ubi_num;
+        int vol_id;
+        struct list_head list;
+};
+/* List of all gluebi devices */
+static LIST_HEAD(gluebi_devices);
+static DEFINE_MUTEX(devices_mutex);
+/**
+ * find_gluebi_nolock - find a gluebi device.
+ * @ubi_num: UBI device number
+ * @vol_id: volume ID
+ *
+ * This function seraches for gluebi device corresponding to UBI device
+ * @ubi_num and UBI volume @vol_id. Returns the gluebi device description
+ * object in case of success and %NULL in case of failure. The caller has to
+ * have the &devices_mutex locked.
+ */
+static struct gluebi_device *find_gluebi_nolock(int ubi_num, int vol_id)
+{
+        struct gluebi_device *gluebi;
+        list_for_each_entry(gluebi, &gluebi_devices, list)
+                if (gluebi->ubi_num == ubi_num && gluebi->vol_id == vol_id)
+                        return gluebi;
+        return NULL;
+}
 /**
 * gluebi_get_device - get MTD device reference.
@@ -41,15 +95,18 @@
 */
 static int gluebi_get_device(struct mtd_info *mtd)
 {
-        struct ubi_volume *vol;
+        struct gluebi_device *gluebi;
+        int ubi_mode = UBI_READONLY;
-        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
+        if (!try_module_get(THIS_MODULE))
+                return -ENODEV;
-        /*
+        if (mtd->flags & MTD_WRITEABLE)
-         * We do not introduce locks for gluebi reference count because the
+                ubi_mode = UBI_READWRITE;
-         * get_device()/put_device() calls are already serialized at MTD.
-         */
+        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        if (vol->gluebi_refcount > 0) {
+        mutex_lock(&devices_mutex);
+        if (gluebi->refcnt > 0) {
                /*
                 * The MTD device is already referenced and this is just one
                 * more reference. MTD allows many users to open the same
@@ -58,7 +115,8 @@ static int gluebi_get_device(struct mtd_info *mtd)
                 * open the UBI volume again - just increase the reference
                 * counter and return.
                 */
-                vol->gluebi_refcount += 1;
+                gluebi->refcnt += 1;
+                mutex_unlock(&devices_mutex);
                return 0;
        }
@@ -66,11 +124,15 @@ static int gluebi_get_device(struct mtd_info *mtd)
         * This is the first reference to this UBI volume via the MTD device
         * interface. Open the corresponding volume in read-write mode.
         */
-        vol->gluebi_desc = ubi_open_volume(vol->ubi->ubi_num, vol->vol_id,
+        gluebi->desc = ubi_open_volume(gluebi->ubi_num, gluebi->vol_id,
-                                           UBI_READWRITE);
+                                       ubi_mode);
-        if (IS_ERR(vol->gluebi_desc))
+        if (IS_ERR(gluebi->desc)) {
-                return PTR_ERR(vol->gluebi_desc);
+                mutex_unlock(&devices_mutex);
-        vol->gluebi_refcount += 1;
+                module_put(THIS_MODULE);
+                return PTR_ERR(gluebi->desc);
+        }
+        gluebi->refcnt += 1;
+        mutex_unlock(&devices_mutex);
        return 0;
 }
@@ -83,13 +145,15 @@ static int gluebi_get_device(struct mtd_info *mtd)
 */
 static void gluebi_put_device(struct mtd_info *mtd)
 {
-        struct ubi_volume *vol;
+        struct gluebi_device *gluebi;
-        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
+        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        vol->gluebi_refcount -= 1;
+        mutex_lock(&devices_mutex);
-        ubi_assert(vol->gluebi_refcount >= 0);
+        gluebi->refcnt -= 1;
-        if (vol->gluebi_refcount == 0)
+        if (gluebi->refcnt == 0)
-                ubi_close_volume(vol->gluebi_desc);
+                ubi_close_volume(gluebi->desc);
+        module_put(THIS_MODULE);
+        mutex_unlock(&devices_mutex);
 }
 /**
@@ -107,16 +171,12 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
                       size_t *retlen, unsigned char *buf)
 {
        int err = 0, lnum, offs, total_read;
-        struct ubi_volume *vol;
+        struct gluebi_device *gluebi;
-        struct ubi_device *ubi;
-        dbg_gen("read %zd bytes from offset %lld", len, from);
        if (len < 0 || from < 0 || from + len > mtd->size)
                return -EINVAL;
-        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
+        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        ubi = vol->ubi;
        lnum = div_u64_rem(from, mtd->erasesize, &offs);
        total_read = len;
@@ -126,7 +186,7 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
                if (to_read > total_read)
                        to_read = total_read;
-                err = ubi_eba_read_leb(ubi, vol, lnum, buf, offs, to_read, 0);
+                err = ubi_read(gluebi->desc, lnum, buf, offs, to_read);
                if (err)
                        break;
@@ -152,21 +212,17 @@ static int gluebi_read(struct mtd_info *mtd, loff_t from, size_t len,
 * case of failure.
 */
 static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
-                       size_t *retlen, const u_char *buf)
+                        size_t *retlen, const u_char *buf)
 {
        int err = 0, lnum, offs, total_written;
-        struct ubi_volume *vol;
+        struct gluebi_device *gluebi;
-        struct ubi_device *ubi;
-        dbg_gen("write %zd bytes to offset %lld", len, to);
        if (len < 0 || to < 0 || len + to > mtd->size)
                return -EINVAL;
-        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
+        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        ubi = vol->ubi;
-        if (ubi->ro_mode)
+        if (!(mtd->flags & MTD_WRITEABLE))
                return -EROFS;
        lnum = div_u64_rem(to, mtd->erasesize, &offs);
@@ -181,8 +237,7 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
                if (to_write > total_written)
                        to_write = total_written;
-                err = ubi_eba_write_leb(ubi, vol, lnum, buf, offs, to_write,
+                err = ubi_write(gluebi->desc, lnum, buf, offs, to_write);
-                                        UBI_UNKNOWN);
                if (err)
                        break;
@@ -207,41 +262,36 @@ static int gluebi_write(struct mtd_info *mtd, loff_t to, size_t len,
 static int gluebi_erase(struct mtd_info *mtd, struct erase_info *instr)
 {
        int err, i, lnum, count;
-        struct ubi_volume *vol;
+        struct gluebi_device *gluebi;
-        struct ubi_device *ubi;
-        dbg_gen("erase %llu bytes at offset %llu", (unsigned long long)instr->len,
-                 (unsigned long long)instr->addr);
        if (instr->addr < 0 || instr->addr > mtd->size - mtd->erasesize)
                return -EINVAL;
        if (instr->len < 0 || instr->addr + instr->len > mtd->size)
                return -EINVAL;
        if (mtd_mod_by_ws(instr->addr, mtd) || mtd_mod_by_ws(instr->len, mtd))
                return -EINVAL;
        lnum = mtd_div_by_eb(instr->addr, mtd);
        count = mtd_div_by_eb(instr->len, mtd);
-        vol = container_of(mtd, struct ubi_volume, gluebi_mtd);
+        gluebi = container_of(mtd, struct gluebi_device, mtd);
-        ubi = vol->ubi;
-        if (ubi->ro_mode)
+        if (!(mtd->flags & MTD_WRITEABLE))
                return -EROFS;
-        for (i = 0; i < count; i++) {
+        for (i = 0; i < count - 1; i++) {
-                err = ubi_eba_unmap_leb(ubi, vol, lnum + i);
+                err = ubi_leb_unmap(gluebi->desc, lnum + i);
                if (err)
                        goto out_err;
        }
        /*
         * MTD erase operations are synchronous, so we have to make sure the
         * physical eraseblock is wiped out.
+         *
+         * Thus, perform leb_erase instead of leb_unmap operation - leb_erase
+         * will wait for the end of operations
         */
-        err = ubi_wl_flush(ubi);
+        err = ubi_leb_erase(gluebi->desc, lnum + i);
        if (err)
                goto out_err;
@@ -256,28 +306,38 @@ out_err:
 }
 /**
- * ubi_create_gluebi - initialize gluebi for an UBI volume.
+ * gluebi_create - create a gluebi device for an UBI volume.
- * @ubi: UBI device description object
+ * @di: UBI device description object
- * @vol: volume description object
+ * @vi: UBI volume description object
 *
- * This function is called when an UBI volume is created in order to create
+ * This function is called when a new UBI volume is created in order to create
 * corresponding fake MTD device. Returns zero in case of success and a
 * negative error code in case of failure.
 */
-int ubi_create_gluebi(struct ubi_device *ubi, struct ubi_volume *vol)
+static int gluebi_create(struct ubi_device_info *di,
+                         struct ubi_volume_info *vi)
 {
-        struct mtd_info *mtd = &vol->gluebi_mtd;
+        struct gluebi_device *gluebi, *g;
+        struct mtd_info *mtd;
-        mtd->name = kmemdup(vol->name, vol->name_len + 1, GFP_KERNEL);
+        gluebi = kzalloc(sizeof(struct gluebi_device), GFP_KERNEL);
-        if (!mtd->name)
+        if (!gluebi)
                return -ENOMEM;
+        mtd = &gluebi->mtd;
+        mtd->name = kmemdup(vi->name, vi->name_len + 1, GFP_KERNEL);
+        if (!mtd->name) {
+                kfree(gluebi);
+                return -ENOMEM;
+        }
+        gluebi->vol_id = vi->vol_id;
        mtd->type = MTD_UBIVOLUME;
-        if (!ubi->ro_mode)
+        if (!di->ro_mode)
                mtd->flags = MTD_WRITEABLE;
-        mtd->writesize  = ubi->min_io_size;
        mtd->owner      = THIS_MODULE;
-        mtd->erasesize  = vol->usable_leb_size;
+        mtd->writesize  = di->min_io_size;
+        mtd->erasesize  = vi->usable_leb_size;
        mtd->read       = gluebi_read;
        mtd->write      = gluebi_write;
        mtd->erase      = gluebi_erase;
@@ -285,60 +345,196 @@ int ubi_create_gluebi(struct ubi_device *ubi, struct ubi_volume *vol)
        mtd->put_device = gluebi_put_device;
        /*
-         * In case of dynamic volume, MTD device size is just volume size. In
+         * In case of dynamic a volume, MTD device size is just volume size. In
         * case of a static volume the size is equivalent to the amount of data
         * bytes.
         */
-        if (vol->vol_type == UBI_DYNAMIC_VOLUME)
+        if (vi->vol_type == UBI_DYNAMIC_VOLUME)
-                mtd->size = (long long)vol->usable_leb_size * vol->reserved_pebs;
+                mtd->size = (unsigned long long)vi->usable_leb_size * vi->size;
        else
-                mtd->size = vol->used_bytes;
+                mtd->size = vi->used_bytes;
+        /* Just a sanity check - make sure this gluebi device does not exist */
+        mutex_lock(&devices_mutex);
+        g = find_gluebi_nolock(vi->ubi_num, vi->vol_id);
+        if (g)
+                err_msg("gluebi MTD device %d form UBI device %d volume %d "
+                        "already exists", g->mtd.index, vi->ubi_num,
+                        vi->vol_id);
+        mutex_unlock(&devices_mutex);
        if (add_mtd_device(mtd)) {
-                ubi_err("cannot not add MTD device");
+                err_msg("cannot add MTD device");
                kfree(mtd->name);
+                kfree(gluebi);
                return -ENFILE;
        }
-        dbg_gen("added mtd%d (\"%s\"), size %llu, EB size %u",
+        mutex_lock(&devices_mutex);
-                mtd->index, mtd->name, (unsigned long long)mtd->size, mtd->erasesize);
+        list_add_tail(&gluebi->list, &gluebi_devices);
+        mutex_unlock(&devices_mutex);
        return 0;
 }
 /**
- * ubi_destroy_gluebi - close gluebi for an UBI volume.
+ * gluebi_remove - remove a gluebi device.
- * @vol: volume description object
+ * @vi: UBI volume description object
 *
- * This function is called when an UBI volume is removed in order to remove
+ * This function is called when an UBI volume is removed and it removes
 * corresponding fake MTD device. Returns zero in case of success and a
 * negative error code in case of failure.
 */
-int ubi_destroy_gluebi(struct ubi_volume *vol)
+static int gluebi_remove(struct ubi_volume_info *vi)
 {
-        int err;
+        int err = 0;
-        struct mtd_info *mtd = &vol->gluebi_mtd;
+        struct mtd_info *mtd;
+        struct gluebi_device *gluebi;
+        mutex_lock(&devices_mutex);
+        gluebi = find_gluebi_nolock(vi->ubi_num, vi->vol_id);
+        if (!gluebi) {
+                err_msg("got remove notification for unknown UBI device %d "
+                        "volume %d", vi->ubi_num, vi->vol_id);
+                err = -ENOENT;
+        } else if (gluebi->refcnt)
+                err = -EBUSY;
+        else
+                list_del(&gluebi->list);
+        mutex_unlock(&devices_mutex);
+        if (err)
+                return err;
-        dbg_gen("remove mtd%d", mtd->index);
+        mtd = &gluebi->mtd;
        err = del_mtd_device(mtd);
-        if (err)
+        if (err) {
+                err_msg("cannot remove fake MTD device %d, UBI device %d, "
+                        "volume %d, error %d", mtd->index, gluebi->ubi_num,
+                        gluebi->vol_id, err);
+                mutex_lock(&devices_mutex);
+                list_add_tail(&gluebi->list, &gluebi_devices);
+                mutex_unlock(&devices_mutex);
                return err;
+        }
        kfree(mtd->name);
+        kfree(gluebi);
        return 0;
 }
 /**
- * ubi_gluebi_updated - UBI volume was updated notifier.
+ * gluebi_updated - UBI volume was updated notifier.
- * @vol: volume description object
+ * @vi: volume info structure
 *
- * This function is called every time an UBI volume is updated. This function
+ * This function is called every time an UBI volume is updated. It does nothing
- * does nothing if volume @vol is dynamic, and changes MTD device size if the
+ * if te volume @vol is dynamic, and changes MTD device size if the
 * volume is static. This is needed because static volumes cannot be read past
- * data they contain.
+ * data they contain. This function returns zero in case of success and a
+ * negative error code in case of error.
+ */
+static int gluebi_updated(struct ubi_volume_info *vi)
+{
+        struct gluebi_device *gluebi;
+        mutex_lock(&devices_mutex);
+        gluebi = find_gluebi_nolock(vi->ubi_num, vi->vol_id);
+        if (!gluebi) {
+                mutex_unlock(&devices_mutex);
+                err_msg("got update notification for unknown UBI device %d "
+                        "volume %d", vi->ubi_num, vi->vol_id);
+                return -ENOENT;
+        }
+        if (vi->vol_type == UBI_STATIC_VOLUME)
+                gluebi->mtd.size = vi->used_bytes;
+        mutex_unlock(&devices_mutex);
+        return 0;
+}
+/**
+ * gluebi_resized - UBI volume was re-sized notifier.
+ * @vi: volume info structure
+ *
+ * This function is called every time an UBI volume is re-size. It changes the
+ * corresponding fake MTD device size. This function returns zero in case of
+ * success and a negative error code in case of error.
+ */
+static int gluebi_resized(struct ubi_volume_info *vi)
+{
+        struct gluebi_device *gluebi;
+        mutex_lock(&devices_mutex);
+        gluebi = find_gluebi_nolock(vi->ubi_num, vi->vol_id);
+        if (!gluebi) {
+                mutex_unlock(&devices_mutex);
+                err_msg("got update notification for unknown UBI device %d "
+                        "volume %d", vi->ubi_num, vi->vol_id);
+                return -ENOENT;
+        }
+        gluebi->mtd.size = vi->used_bytes;
+        mutex_unlock(&devices_mutex);
+        return 0;
+}
+/**
+ * gluebi_notify - UBI notification handler.
+ * @nb: registered notifier block
+ * @l: notification type
+ * @ptr: pointer to the &struct ubi_notification object
 */
-void ubi_gluebi_updated(struct ubi_volume *vol)
+static int gluebi_notify(struct notifier_block *nb, unsigned long l,
+                         void *ns_ptr)
 {
-        struct mtd_info *mtd = &vol->gluebi_mtd;
+        struct ubi_notification *nt = ns_ptr;
+        switch (l) {
+        case UBI_VOLUME_ADDED:
+                gluebi_create(&nt->di, &nt->vi);
+                break;
+        case UBI_VOLUME_REMOVED:
+                gluebi_remove(&nt->vi);
+                break;
+        case UBI_VOLUME_RESIZED:
+                gluebi_resized(&nt->vi);
+                break;
+        case UBI_VOLUME_UPDATED:
+                gluebi_updated(&nt->vi);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
+}
-        if (vol->vol_type == UBI_STATIC_VOLUME)
+static struct notifier_block gluebi_notifier = {
-                mtd->size = vol->used_bytes;
+        .notifier_call  = gluebi_notify,
+};
+static int __init ubi_gluebi_init(void)
+{
+        return ubi_register_volume_notifier(&gluebi_notifier, 0);
 }
+static void __exit ubi_gluebi_exit(void)
+{
+        struct gluebi_device *gluebi, *g;
+        list_for_each_entry_safe(gluebi, g, &gluebi_devices, list) {
+                int err;
+                struct mtd_info *mtd = &gluebi->mtd;
+                err = del_mtd_device(mtd);
+                if (err)
+                        err_msg("error %d while removing gluebi MTD device %d, "
+                                "UBI device %d, volume %d - ignoring", err,
+                                mtd->index, gluebi->ubi_num, gluebi->vol_id);
+                kfree(mtd->name);
+                kfree(gluebi);
+        }
+        ubi_unregister_volume_notifier(&gluebi_notifier);
+}
+module_init(ubi_gluebi_init);
+module_exit(ubi_gluebi_exit);
+MODULE_DESCRIPTION("MTD emulation layer over UBI volumes");
+MODULE_AUTHOR("Artem Bityutskiy, Joern Engel");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index fe81039f2a7c..effaff28bab1 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -100,6 +100,7 @@ static int paranoid_check_vid_hdr(const struct ubi_device *ubi, int pnum,
                                  const struct ubi_vid_hdr *vid_hdr);
 static int paranoid_check_all_ff(struct ubi_device *ubi, int pnum, int offset,
                                 int len);
+static int paranoid_check_empty(struct ubi_device *ubi, int pnum);
 #else
 #define paranoid_check_not_bad(ubi, pnum) 0
 #define paranoid_check_peb_ec_hdr(ubi, pnum)  0
@@ -107,6 +108,7 @@ static int paranoid_check_all_ff(struct ubi_device *ubi, int pnum, int offset,
 #define paranoid_check_peb_vid_hdr(ubi, pnum) 0
 #define paranoid_check_vid_hdr(ubi, pnum, vid_hdr) 0
 #define paranoid_check_all_ff(ubi, pnum, offset, len) 0
+#define paranoid_check_empty(ubi, pnum) 0
 #endif
 /**
@@ -670,11 +672,6 @@ int ubi_io_read_ec_hdr(struct ubi_device *ubi, int pnum,
                if (read_err != -EBADMSG &&
                    check_pattern(ec_hdr, 0xFF, UBI_EC_HDR_SIZE)) {
                        /* The physical eraseblock is supposedly empty */
-                        /*
-                         * The below is just a paranoid check, it has to be
-                         * compiled out if paranoid checks are disabled.
-                         */
                        err = paranoid_check_all_ff(ubi, pnum, 0,
                                                    ubi->peb_size);
                        if (err)
@@ -902,7 +899,7 @@ bad:
 * o %UBI_IO_BITFLIPS if the CRC is correct, but bit-flips were detected
 *   and corrected by the flash driver; this is harmless but may indicate that
 *   this eraseblock may become bad soon;
- * o %UBI_IO_BAD_VID_HRD if the volume identifier header is corrupted (a CRC
+ * o %UBI_IO_BAD_VID_HDR if the volume identifier header is corrupted (a CRC
 *   error detected);
 * o %UBI_IO_PEB_FREE if the physical eraseblock is free (i.e., there is no VID
 *   header there);
@@ -955,8 +952,7 @@ int ubi_io_read_vid_hdr(struct ubi_device *ubi, int pnum,
                         * The below is just a paranoid check, it has to be
                         * compiled out if paranoid checks are disabled.
                         */
-                        err = paranoid_check_all_ff(ubi, pnum, ubi->leb_start,
+                        err = paranoid_check_empty(ubi, pnum);
-                                                    ubi->leb_size);
                        if (err)
                                return err > 0 ? UBI_IO_BAD_VID_HDR : err;
@@ -1280,4 +1276,74 @@ error:
        return err;
 }
+/**
+ * paranoid_check_empty - whether a PEB is empty.
+ * @ubi: UBI device description object
+ * @pnum: the physical eraseblock number to check
+ *
+ * This function makes sure PEB @pnum is empty, which means it contains only
+ * %0xFF data bytes. Returns zero if the PEB is empty, %1 if not, and a
+ * negative error code in case of failure.
+ *
+ * Empty PEBs have the EC header, and do not have the VID header. The caller of
+ * this function should have already made sure the PEB does not have the VID
+ * header. However, this function re-checks that, because it is possible that
+ * the header and data has already been written to the PEB.
+ *
+ * Let's consider a possible scenario. Suppose there are 2 tasks - A and B.
+ * Task A is in 'wear_leveling_worker()'. It is reading VID header of PEB X to
+ * find which LEB it corresponds to. PEB X is currently unmapped, and has no
+ * VID header. Task B is trying to write to PEB X.
+ *
+ * Task A: in 'ubi_io_read_vid_hdr()': reads the VID header from PEB X. The
+ *         read data contain all 0xFF bytes;
+ * Task B: writes VID header and some data to PEB X;
+ * Task A: assumes PEB X is empty, calls 'paranoid_check_empty()'. And if we
+ *         do not re-read the VID header, and do not cancel the checking if it
+ *         is there, we fail.
+ */
+static int paranoid_check_empty(struct ubi_device *ubi, int pnum)
+{
+        int err, offs = ubi->vid_hdr_aloffset, len = ubi->vid_hdr_alsize;
+        size_t read;
+        uint32_t magic;
+        const struct ubi_vid_hdr *vid_hdr;
+        mutex_lock(&ubi->dbg_buf_mutex);
+        err = ubi->mtd->read(ubi->mtd, offs, len, &read, ubi->dbg_peb_buf);
+        if (err && err != -EUCLEAN) {
+                ubi_err("error %d while reading %d bytes from PEB %d:%d, "
+                        "read %zd bytes", err, len, pnum, offs, read);
+                goto error;
+        }
+        vid_hdr = ubi->dbg_peb_buf;
+        magic = be32_to_cpu(vid_hdr->magic);
+        if (magic == UBI_VID_HDR_MAGIC)
+                /* The PEB contains VID header, so it is not empty */
+                goto out;
+        err = check_pattern(ubi->dbg_peb_buf, 0xFF, len);
+        if (err == 0) {
+                ubi_err("flash region at PEB %d:%d, length %d does not "
+                        "contain all 0xFF bytes", pnum, offs, len);
+                goto fail;
+        }
+out:
+        mutex_unlock(&ubi->dbg_buf_mutex);
+        return 0;
+fail:
+        ubi_err("paranoid check failed for PEB %d", pnum);
+        ubi_msg("hex dump of the %d-%d region", offs, offs + len);
+        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+                       ubi->dbg_peb_buf, len, 1);
+        err = 1;
+error:
+        ubi_dbg_dump_stack();
+        mutex_unlock(&ubi->dbg_buf_mutex);
+        return err;
+}
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 4abbe573fa40..88a72e9c8beb 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -26,6 +26,24 @@
 #include "ubi.h"
 /**
+ * ubi_do_get_device_info - get information about UBI device.
+ * @ubi: UBI device description object
+ * @di: the information is stored here
+ *
+ * This function is the same as 'ubi_get_device_info()', but it assumes the UBI
+ * device is locked and cannot disappear.
+ */
+void ubi_do_get_device_info(struct ubi_device *ubi, struct ubi_device_info *di)
+{
+        di->ubi_num = ubi->ubi_num;
+        di->leb_size = ubi->leb_size;
+        di->min_io_size = ubi->min_io_size;
+        di->ro_mode = ubi->ro_mode;
+        di->cdev = ubi->cdev.dev;
+}
+EXPORT_SYMBOL_GPL(ubi_do_get_device_info);
+/**
 * ubi_get_device_info - get information about UBI device.
 * @ubi_num: UBI device number
 * @di: the information is stored here
@@ -39,33 +57,24 @@ int ubi_get_device_info(int ubi_num, struct ubi_device_info *di)
        if (ubi_num < 0 || ubi_num >= UBI_MAX_DEVICES)
                return -EINVAL;
        ubi = ubi_get_device(ubi_num);
        if (!ubi)
                return -ENODEV;
+        ubi_do_get_device_info(ubi, di);
-        di->ubi_num = ubi->ubi_num;
-        di->leb_size = ubi->leb_size;
-        di->min_io_size = ubi->min_io_size;
-        di->ro_mode = ubi->ro_mode;
-        di->cdev = ubi->cdev.dev;
        ubi_put_device(ubi);
        return 0;
 }
 EXPORT_SYMBOL_GPL(ubi_get_device_info);
 /**
- * ubi_get_volume_info - get information about UBI volume.
+ * ubi_do_get_volume_info - get information about UBI volume.
- * @desc: volume descriptor
+ * @ubi: UBI device description object
+ * @vol: volume description object
 * @vi: the information is stored here
 */
-void ubi_get_volume_info(struct ubi_volume_desc *desc,
+void ubi_do_get_volume_info(struct ubi_device *ubi, struct ubi_volume *vol,
-                         struct ubi_volume_info *vi)
+                            struct ubi_volume_info *vi)
 {
-        const struct ubi_volume *vol = desc->vol;
-        const struct ubi_device *ubi = vol->ubi;
        vi->vol_id = vol->vol_id;
        vi->ubi_num = ubi->ubi_num;
        vi->size = vol->reserved_pebs;
@@ -79,6 +88,17 @@ void ubi_get_volume_info(struct ubi_volume_desc *desc,
        vi->name = vol->name;
        vi->cdev = vol->cdev.dev;
 }
+/**
+ * ubi_get_volume_info - get information about UBI volume.
+ * @desc: volume descriptor
+ * @vi: the information is stored here
+ */
+void ubi_get_volume_info(struct ubi_volume_desc *desc,
+                         struct ubi_volume_info *vi)
+{
+        ubi_do_get_volume_info(desc->vol->ubi, desc->vol, vi);
+}
 EXPORT_SYMBOL_GPL(ubi_get_volume_info);
 /**
@@ -106,7 +126,7 @@ struct ubi_volume_desc *ubi_open_volume(int ubi_num, int vol_id, int mode)
        struct ubi_device *ubi;
        struct ubi_volume *vol;
-        dbg_gen("open device %d volume %d, mode %d", ubi_num, vol_id, mode);
+        dbg_gen("open device %d, volume %d, mode %d", ubi_num, vol_id, mode);
        if (ubi_num < 0 || ubi_num >= UBI_MAX_DEVICES)
                return ERR_PTR(-EINVAL);
@@ -196,6 +216,8 @@ out_free:
        kfree(desc);
 out_put_ubi:
        ubi_put_device(ubi);
+        dbg_err("cannot open device %d, volume %d, error %d",
+                ubi_num, vol_id, err);
        return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(ubi_open_volume);
@@ -215,7 +237,7 @@ struct ubi_volume_desc *ubi_open_volume_nm(int ubi_num, const char *name,
        struct ubi_device *ubi;
        struct ubi_volume_desc *ret;
-        dbg_gen("open volume %s, mode %d", name, mode);
+        dbg_gen("open device %d, volume %s, mode %d", ubi_num, name, mode);
        if (!name)
                return ERR_PTR(-EINVAL);
@@ -266,7 +288,8 @@ void ubi_close_volume(struct ubi_volume_desc *desc)
        struct ubi_volume *vol = desc->vol;
        struct ubi_device *ubi = vol->ubi;
-        dbg_gen("close volume %d, mode %d", vol->vol_id, desc->mode);
+        dbg_gen("close device %d, volume %d, mode %d",
+                ubi->ubi_num, vol->vol_id, desc->mode);
        spin_lock(&ubi->volumes_lock);
        switch (desc->mode) {
@@ -558,7 +581,7 @@ int ubi_leb_unmap(struct ubi_volume_desc *desc, int lnum)
 EXPORT_SYMBOL_GPL(ubi_leb_unmap);
 /**
- * ubi_leb_map - map logical erasblock to a physical eraseblock.
+ * ubi_leb_map - map logical eraseblock to a physical eraseblock.
 * @desc: volume descriptor
 * @lnum: logical eraseblock number
 * @dtype: expected data type
@@ -656,3 +679,59 @@ int ubi_sync(int ubi_num)
        return 0;
 }
 EXPORT_SYMBOL_GPL(ubi_sync);
+BLOCKING_NOTIFIER_HEAD(ubi_notifiers);
+/**
+ * ubi_register_volume_notifier - register a volume notifier.
+ * @nb: the notifier description object
+ * @ignore_existing: if non-zero, do not send "added" notification for all
+ *                   already existing volumes
+ *
+ * This function registers a volume notifier, which means that
+ * 'nb->notifier_call()' will be invoked when an UBI  volume is created,
+ * removed, re-sized, re-named, or updated. The first argument of the function
+ * is the notification type. The second argument is pointer to a
+ * &struct ubi_notification object which describes the notification event.
+ * Using UBI API from the volume notifier is prohibited.
+ *
+ * This function returns zero in case of success and a negative error code
+ * in case of failure.
+ */
+int ubi_register_volume_notifier(struct notifier_block *nb,
+                                 int ignore_existing)
+{
+        int err;
+        err = blocking_notifier_chain_register(&ubi_notifiers, nb);
+        if (err != 0)
+                return err;
+        if (ignore_existing)
+                return 0;
+        /*
+         * We are going to walk all UBI devices and all volumes, and
+         * notify the user about existing volumes by the %UBI_VOLUME_ADDED
+         * event. We have to lock the @ubi_devices_mutex to make sure UBI
+         * devices do not disappear.
+         */
+        mutex_lock(&ubi_devices_mutex);
+        ubi_enumerate_volumes(nb);
+        mutex_unlock(&ubi_devices_mutex);
+        return err;
+}
+EXPORT_SYMBOL_GPL(ubi_register_volume_notifier);
+/**
+ * ubi_unregister_volume_notifier - unregister the volume notifier.
+ * @nb: the notifier description object
+ *
+ * This function unregisters volume notifier @nm and returns zero in case of
+ * success and a negative error code in case of failure.
+ */
+int ubi_unregister_volume_notifier(struct notifier_block *nb)
+{
+        return blocking_notifier_chain_unregister(&ubi_notifiers, nb);
+}
+EXPORT_SYMBOL_GPL(ubi_unregister_volume_notifier);
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index c055511bb1b2..28acd133c997 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -36,6 +36,7 @@
 #include <linux/device.h>
 #include <linux/string.h>
 #include <linux/vmalloc.h>
+#include <linux/notifier.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/ubi.h>
@@ -100,6 +101,28 @@ enum {
        UBI_IO_BITFLIPS
 };
+/*
+ * Return codes of the 'ubi_eba_copy_leb()' function.
+ *
+ * MOVE_CANCEL_RACE: canceled because the volume is being deleted, the source
+ *                   PEB was put meanwhile, or there is I/O on the source PEB
+ * MOVE_SOURCE_RD_ERR: canceled because there was a read error from the source
+ *                     PEB
+ * MOVE_TARGET_RD_ERR: canceled because there was a read error from the target
+ *                     PEB
+ * MOVE_TARGET_WR_ERR: canceled because there was a write error to the target
+ *                     PEB
+ * MOVE_CANCEL_BITFLIPS: canceled because a bit-flip was detected in the
+ *                       target PEB
+ */
+enum {
+        MOVE_CANCEL_RACE = 1,
+        MOVE_SOURCE_RD_ERR,
+        MOVE_TARGET_RD_ERR,
+        MOVE_TARGET_WR_ERR,
+        MOVE_CANCEL_BITFLIPS,
+};
 /**
 * struct ubi_wl_entry - wear-leveling entry.
 * @u.rb: link in the corresponding (free/used) RB-tree
@@ -208,10 +231,6 @@ struct ubi_volume_desc;
 * @changing_leb: %1 if the atomic LEB change ioctl command is in progress
 * @direct_writes: %1 if direct writes are enabled for this volume
 *
- * @gluebi_desc: gluebi UBI volume descriptor
- * @gluebi_refcount: reference count of the gluebi MTD device
- * @gluebi_mtd: MTD device description object of the gluebi MTD device
- *
 * The @corrupted field indicates that the volume's contents is corrupted.
 * Since UBI protects only static volumes, this field is not relevant to
 * dynamic volumes - it is user's responsibility to assure their data
@@ -255,17 +274,6 @@ struct ubi_volume {
        unsigned int updating:1;
        unsigned int changing_leb:1;
        unsigned int direct_writes:1;
-#ifdef CONFIG_MTD_UBI_GLUEBI
-        /*
-         * Gluebi-related stuff may be compiled out.
-         * Note: this should not be built into UBI but should be a separate
-         * ubimtd driver which works on top of UBI and emulates MTD devices.
-         */
-        struct ubi_volume_desc *gluebi_desc;
-        int gluebi_refcount;
-        struct mtd_info gluebi_mtd;
-#endif
 };
 /**
@@ -305,9 +313,9 @@ struct ubi_wl_entry;
 * @vtbl_slots: how many slots are available in the volume table
 * @vtbl_size: size of the volume table in bytes
 * @vtbl: in-RAM volume table copy
- * @volumes_mutex: protects on-flash volume table and serializes volume
+ * @device_mutex: protects on-flash volume table and serializes volume
- *                 changes, like creation, deletion, update, re-size,
+ *                creation, deletion, update, re-size, re-name and set
- *                 re-name and set property
+ *                property
 *
 * @max_ec: current highest erase counter value
 * @mean_ec: current mean erase counter value
@@ -318,14 +326,15 @@ struct ubi_wl_entry;
 * @alc_mutex: serializes "atomic LEB change" operations
 *
 * @used: RB-tree of used physical eraseblocks
+ * @erroneous: RB-tree of erroneous used physical eraseblocks
 * @free: RB-tree of free physical eraseblocks
 * @scrub: RB-tree of physical eraseblocks which need scrubbing
 * @pq: protection queue (contain physical eraseblocks which are temporarily
 *      protected from the wear-leveling worker)
 * @pq_head: protection queue head
 * @wl_lock: protects the @used, @free, @pq, @pq_head, @lookuptbl, @move_from,
- *           @move_to, @move_to_put @erase_pending, @wl_scheduled and @works
+ *           @move_to, @move_to_put @erase_pending, @wl_scheduled, @works,
- *           fields
+ *           @erroneous, and @erroneous_peb_count fields
 * @move_mutex: serializes eraseblock moves
 * @work_sem: synchronizes the WL worker with use tasks
 * @wl_scheduled: non-zero if the wear-leveling was scheduled
@@ -339,12 +348,15 @@ struct ubi_wl_entry;
 * @bgt_thread: background thread description object
 * @thread_enabled: if the background thread is enabled
 * @bgt_name: background thread name
+ * @reboot_notifier: notifier to terminate background thread before rebooting
 *
 * @flash_size: underlying MTD device size (in bytes)
 * @peb_count: count of physical eraseblocks on the MTD device
 * @peb_size: physical eraseblock size
 * @bad_peb_count: count of bad physical eraseblocks
 * @good_peb_count: count of good physical eraseblocks
+ * @erroneous_peb_count: count of erroneous physical eraseblocks in @erroneous
+ * @max_erroneous: maximum allowed amount of erroneous physical eraseblocks
 * @min_io_size: minimal input/output unit size of the underlying MTD device
 * @hdrs_min_io_size: minimal I/O unit size used for VID and EC headers
 * @ro_mode: if the UBI device is in read-only mode
@@ -366,7 +378,6 @@ struct ubi_wl_entry;
 * @peb_buf2: another buffer of PEB size used for different purposes
 * @buf_mutex: protects @peb_buf1 and @peb_buf2
 * @ckvol_mutex: serializes static volume checking when opening
- * @mult_mutex: serializes operations on multiple volumes, like re-naming
 * @dbg_peb_buf: buffer of PEB size used for debugging
 * @dbg_buf_mutex: protects @dbg_peb_buf
 */
@@ -389,7 +400,7 @@ struct ubi_device {
        int vtbl_slots;
        int vtbl_size;
        struct ubi_vtbl_record *vtbl;
-        struct mutex volumes_mutex;
+        struct mutex device_mutex;
        int max_ec;
        /* Note, mean_ec is not updated run-time - should be fixed */
@@ -403,6 +414,7 @@ struct ubi_device {
        /* Wear-leveling sub-system's stuff */
        struct rb_root used;
+        struct rb_root erroneous;
        struct rb_root free;
        struct rb_root scrub;
        struct list_head pq[UBI_PROT_QUEUE_LEN];
@@ -420,6 +432,7 @@ struct ubi_device {
        struct task_struct *bgt_thread;
        int thread_enabled;
        char bgt_name[sizeof(UBI_BGT_NAME_PATTERN)+2];
+        struct notifier_block reboot_notifier;
        /* I/O sub-system's stuff */
        long long flash_size;
@@ -427,6 +440,8 @@ struct ubi_device {
        int peb_size;
        int bad_peb_count;
        int good_peb_count;
+        int erroneous_peb_count;
+        int max_erroneous;
        int min_io_size;
        int hdrs_min_io_size;
        int ro_mode;
@@ -444,8 +459,7 @@ struct ubi_device {
        void *peb_buf2;
        struct mutex buf_mutex;
        struct mutex ckvol_mutex;
-        struct mutex mult_mutex;
+#ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
-#ifdef CONFIG_MTD_UBI_DEBUG
        void *dbg_peb_buf;
        struct mutex dbg_buf_mutex;
 #endif
@@ -457,6 +471,7 @@ extern const struct file_operations ubi_cdev_operations;
 extern const struct file_operations ubi_vol_cdev_operations;
 extern struct class *ubi_class;
 extern struct mutex ubi_devices_mutex;
+extern struct blocking_notifier_head ubi_notifiers;
 /* vtbl.c */
 int ubi_change_vtbl_record(struct ubi_device *ubi, int idx,
@@ -489,17 +504,6 @@ int ubi_calc_data_len(const struct ubi_device *ubi, const void *buf,
 int ubi_check_volume(struct ubi_device *ubi, int vol_id);
 void ubi_calculate_reserved(struct ubi_device *ubi);
-/* gluebi.c */
-#ifdef CONFIG_MTD_UBI_GLUEBI
-int ubi_create_gluebi(struct ubi_device *ubi, struct ubi_volume *vol);
-int ubi_destroy_gluebi(struct ubi_volume *vol);
-void ubi_gluebi_updated(struct ubi_volume *vol);
-#else
-#define ubi_create_gluebi(ubi, vol) 0
-#define ubi_destroy_gluebi(vol) 0
-#define ubi_gluebi_updated(vol)
-#endif
 /* eba.c */
 int ubi_eba_unmap_leb(struct ubi_device *ubi, struct ubi_volume *vol,
                      int lnum);
@@ -549,6 +553,16 @@ struct ubi_device *ubi_get_device(int ubi_num);
 void ubi_put_device(struct ubi_device *ubi);
 struct ubi_device *ubi_get_by_major(int major);
 int ubi_major2num(int major);
+int ubi_volume_notify(struct ubi_device *ubi, struct ubi_volume *vol,
+                      int ntype);
+int ubi_notify_all(struct ubi_device *ubi, int ntype,
+                   struct notifier_block *nb);
+int ubi_enumerate_volumes(struct notifier_block *nb);
+/* kapi.c */
+void ubi_do_get_device_info(struct ubi_device *ubi, struct ubi_device_info *di);
+void ubi_do_get_volume_info(struct ubi_device *ubi, struct ubi_volume *vol,
+                            struct ubi_volume_info *vi);
 /*
 * ubi_rb_for_each_entry - walk an RB-tree.
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 6b4d1ae891ae..74fdc40c8627 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -68,10 +68,10 @@ static int set_update_marker(struct ubi_device *ubi, struct ubi_volume *vol)
               sizeof(struct ubi_vtbl_record));
        vtbl_rec.upd_marker = 1;
-        mutex_lock(&ubi->volumes_mutex);
+        mutex_lock(&ubi->device_mutex);
        err = ubi_change_vtbl_record(ubi, vol->vol_id, &vtbl_rec);
-        mutex_unlock(&ubi->volumes_mutex);
        vol->upd_marker = 1;
+        mutex_unlock(&ubi->device_mutex);
        return err;
 }
@@ -109,10 +109,10 @@ static int clear_update_marker(struct ubi_device *ubi, struct ubi_volume *vol,
                        vol->last_eb_bytes = vol->usable_leb_size;
        }
-        mutex_lock(&ubi->volumes_mutex);
+        mutex_lock(&ubi->device_mutex);
        err = ubi_change_vtbl_record(ubi, vol->vol_id, &vtbl_rec);
-        mutex_unlock(&ubi->volumes_mutex);
        vol->upd_marker = 0;
+        mutex_unlock(&ubi->device_mutex);
        return err;
 }
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index df5483562b7a..ab64cb56df6e 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -198,7 +198,7 @@ static void volume_sysfs_close(struct ubi_volume *vol)
 * %UBI_VOL_NUM_AUTO, this function automatically assign ID to the new volume
 * and saves it in @req->vol_id. Returns zero in case of success and a negative
 * error code in case of failure. Note, the caller has to have the
- * @ubi->volumes_mutex locked.
+ * @ubi->device_mutex locked.
 */
 int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
 {
@@ -232,8 +232,8 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                req->vol_id = vol_id;
        }
-        dbg_gen("volume ID %d, %llu bytes, type %d, name %s",
+        dbg_gen("create device %d, volume %d, %llu bytes, type %d, name %s",
-                vol_id, (unsigned long long)req->bytes,
+                ubi->ubi_num, vol_id, (unsigned long long)req->bytes,
                (int)req->vol_type, req->name);
        /* Ensure that this volume does not exist */
@@ -317,10 +317,6 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
                goto out_mapping;
        }
-        err = ubi_create_gluebi(ubi, vol);
-        if (err)
-                goto out_cdev;
        vol->dev.release = vol_release;
        vol->dev.parent = &ubi->dev;
        vol->dev.devt = dev;
@@ -330,7 +326,7 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        err = device_register(&vol->dev);
        if (err) {
                ubi_err("cannot register device");
-                goto out_gluebi;
+                goto out_cdev;
        }
        err = volume_sysfs_init(ubi, vol);
@@ -358,7 +354,9 @@ int ubi_create_volume(struct ubi_device *ubi, struct ubi_mkvol_req *req)
        ubi->vol_count += 1;
        spin_unlock(&ubi->volumes_lock);
-        err = paranoid_check_volumes(ubi);
+        ubi_volume_notify(ubi, vol, UBI_VOLUME_ADDED);
+        if (paranoid_check_volumes(ubi))
+                dbg_err("check failed while creating volume %d", vol_id);
        return err;
 out_sysfs:
@@ -373,10 +371,6 @@ out_sysfs:
        do_free = 0;
        get_device(&vol->dev);
        volume_sysfs_close(vol);
-out_gluebi:
-        if (ubi_destroy_gluebi(vol))
-                dbg_err("cannot destroy gluebi for volume %d:%d",
-                        ubi->ubi_num, vol_id);
 out_cdev:
        cdev_del(&vol->cdev);
 out_mapping:
@@ -403,7 +397,7 @@ out_unlock:
 *
 * This function removes volume described by @desc. The volume has to be opened
 * in "exclusive" mode. Returns zero in case of success and a negative error
- * code in case of failure. The caller has to have the @ubi->volumes_mutex
+ * code in case of failure. The caller has to have the @ubi->device_mutex
 * locked.
 */
 int ubi_remove_volume(struct ubi_volume_desc *desc, int no_vtbl)
@@ -412,7 +406,7 @@ int ubi_remove_volume(struct ubi_volume_desc *desc, int no_vtbl)
        struct ubi_device *ubi = vol->ubi;
        int i, err, vol_id = vol->vol_id, reserved_pebs = vol->reserved_pebs;
-        dbg_gen("remove UBI volume %d", vol_id);
+        dbg_gen("remove device %d, volume %d", ubi->ubi_num, vol_id);
        ubi_assert(desc->mode == UBI_EXCLUSIVE);
        ubi_assert(vol == ubi->volumes[vol_id]);
@@ -431,10 +425,6 @@ int ubi_remove_volume(struct ubi_volume_desc *desc, int no_vtbl)
        ubi->volumes[vol_id] = NULL;
        spin_unlock(&ubi->volumes_lock);
-        err = ubi_destroy_gluebi(vol);
-        if (err)
-                goto out_err;
        if (!no_vtbl) {
                err = ubi_change_vtbl_record(ubi, vol_id, NULL);
                if (err)
@@ -465,8 +455,10 @@ int ubi_remove_volume(struct ubi_volume_desc *desc, int no_vtbl)
        ubi->vol_count -= 1;
        spin_unlock(&ubi->volumes_lock);
-        if (!no_vtbl)
+        ubi_volume_notify(ubi, vol, UBI_VOLUME_REMOVED);
-                err = paranoid_check_volumes(ubi);
+        if (!no_vtbl && paranoid_check_volumes(ubi))
+                dbg_err("check failed while removing volume %d", vol_id);
        return err;
 out_err:
@@ -485,7 +477,7 @@ out_unlock:
 *
 * This function re-sizes the volume and returns zero in case of success, and a
 * negative error code in case of failure. The caller has to have the
- * @ubi->volumes_mutex locked.
+ * @ubi->device_mutex locked.
 */
 int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
 {
@@ -498,8 +490,8 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
        if (ubi->ro_mode)
                return -EROFS;
-        dbg_gen("re-size volume %d to from %d to %d PEBs",
+        dbg_gen("re-size device %d, volume %d to from %d to %d PEBs",
-                vol_id, vol->reserved_pebs, reserved_pebs);
+                ubi->ubi_num, vol_id, vol->reserved_pebs, reserved_pebs);
        if (vol->vol_type == UBI_STATIC_VOLUME &&
            reserved_pebs < vol->used_ebs) {
@@ -587,7 +579,9 @@ int ubi_resize_volume(struct ubi_volume_desc *desc, int reserved_pebs)
                        (long long)vol->used_ebs * vol->usable_leb_size;
        }
-        err = paranoid_check_volumes(ubi);
+        ubi_volume_notify(ubi, vol, UBI_VOLUME_RESIZED);
+        if (paranoid_check_volumes(ubi))
+                dbg_err("check failed while re-sizing volume %d", vol_id);
        return err;
 out_acc:
@@ -632,11 +626,12 @@ int ubi_rename_volumes(struct ubi_device *ubi, struct list_head *rename_list)
                        vol->name_len = re->new_name_len;
                        memcpy(vol->name, re->new_name, re->new_name_len + 1);
                        spin_unlock(&ubi->volumes_lock);
+                        ubi_volume_notify(ubi, vol, UBI_VOLUME_RENAMED);
                }
        }
-        if (!err)
+        if (!err && paranoid_check_volumes(ubi))
-                err = paranoid_check_volumes(ubi);
+                ;
        return err;
 }
@@ -667,10 +662,6 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)
                return err;
        }
-        err = ubi_create_gluebi(ubi, vol);
-        if (err)
-                goto out_cdev;
        vol->dev.release = vol_release;
        vol->dev.parent = &ubi->dev;
        vol->dev.devt = dev;
@@ -678,21 +669,19 @@ int ubi_add_volume(struct ubi_device *ubi, struct ubi_volume *vol)
        dev_set_name(&vol->dev, "%s_%d", ubi->ubi_name, vol->vol_id);
        err = device_register(&vol->dev);
        if (err)
-                goto out_gluebi;
+                goto out_cdev;
        err = volume_sysfs_init(ubi, vol);
        if (err) {
                cdev_del(&vol->cdev);
-                err = ubi_destroy_gluebi(vol);
                volume_sysfs_close(vol);
                return err;
        }
-        err = paranoid_check_volumes(ubi);
+        if (paranoid_check_volumes(ubi))
+                dbg_err("check failed while adding volume %d", vol_id);
        return err;
-out_gluebi:
-        err = ubi_destroy_gluebi(vol);
 out_cdev:
        cdev_del(&vol->cdev);
        return err;
@@ -708,12 +697,9 @@ out_cdev:
 */
 void ubi_free_volume(struct ubi_device *ubi, struct ubi_volume *vol)
 {
-        int err;
        dbg_gen("free volume %d", vol->vol_id);
        ubi->volumes[vol->vol_id] = NULL;
-        err = ubi_destroy_gluebi(vol);
        cdev_del(&vol->cdev);
        volume_sysfs_close(vol);
 }
@@ -868,6 +854,7 @@ fail:
        if (vol)
                ubi_dbg_dump_vol_info(vol);
        ubi_dbg_dump_vtbl_record(&ubi->vtbl[vol_id], vol_id);
+        dump_stack();
        spin_unlock(&ubi->volumes_lock);
        return -EINVAL;
 }
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 891534f8210d..2b2472300610 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -55,8 +55,8 @@
 *
 * As it was said, for the UBI sub-system all physical eraseblocks are either
 * "free" or "used". Free eraseblock are kept in the @wl->free RB-tree, while
- * used eraseblocks are kept in @wl->used or @wl->scrub RB-trees, or
+ * used eraseblocks are kept in @wl->used, @wl->erroneous, or @wl->scrub
- * (temporarily) in the @wl->pq queue.
+ * RB-trees, as well as (temporarily) in the @wl->pq queue.
 *
 * When the WL sub-system returns a physical eraseblock, the physical
 * eraseblock is protected from being moved for some "time". For this reason,
@@ -83,6 +83,8 @@
 * used. The former state corresponds to the @wl->free tree. The latter state
 * is split up on several sub-states:
 * o the WL movement is allowed (@wl->used tree);
+ * o the WL movement is disallowed (@wl->erroneous) because the PEB is
+ *   erroneous - e.g., there was a read error;
 * o the WL movement is temporarily prohibited (@wl->pq queue);
 * o scrubbing is needed (@wl->scrub tree).
 *
@@ -653,7 +655,8 @@ static int schedule_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
 static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                                int cancel)
 {
-        int err, scrubbing = 0, torture = 0;
+        int err, scrubbing = 0, torture = 0, protect = 0, erroneous = 0;
+        int vol_id = -1, uninitialized_var(lnum);
        struct ubi_wl_entry *e1, *e2;
        struct ubi_vid_hdr *vid_hdr;
@@ -738,68 +741,78 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                        /*
                         * We are trying to move PEB without a VID header. UBI
                         * always write VID headers shortly after the PEB was
-                         * given, so we have a situation when it did not have
+                         * given, so we have a situation when it has not yet
-                         * chance to write it down because it was preempted.
+                         * had a chance to write it, because it was preempted.
-                         * Just re-schedule the work, so that next time it will
+                         * So add this PEB to the protection queue so far,
-                         * likely have the VID header in place.
+                         * because presumably more data will be written there
+                         * (including the missing VID header), and then we'll
+                         * move it.
                         */
                        dbg_wl("PEB %d has no VID header", e1->pnum);
+                        protect = 1;
                        goto out_not_moved;
                }
                ubi_err("error %d while reading VID header from PEB %d",
                        err, e1->pnum);
-                if (err > 0)
-                        err = -EIO;
                goto out_error;
        }
+        vol_id = be32_to_cpu(vid_hdr->vol_id);
+        lnum = be32_to_cpu(vid_hdr->lnum);
        err = ubi_eba_copy_leb(ubi, e1->pnum, e2->pnum, vid_hdr);
        if (err) {
-                if (err == -EAGAIN)
+                if (err == MOVE_CANCEL_RACE) {
+                        /*
+                         * The LEB has not been moved because the volume is
+                         * being deleted or the PEB has been put meanwhile. We
+                         * should prevent this PEB from being selected for
+                         * wear-leveling movement again, so put it to the
+                         * protection queue.
+                         */
+                        protect = 1;
                        goto out_not_moved;
-                if (err < 0)
+                }
-                        goto out_error;
-                if (err == 2) {
+                if (err == MOVE_CANCEL_BITFLIPS || err == MOVE_TARGET_WR_ERR ||
-                        /* Target PEB write error, torture it */
+                    err == MOVE_TARGET_RD_ERR) {
+                        /*
+                         * Target PEB had bit-flips or write error - torture it.
+                         */
                        torture = 1;
                        goto out_not_moved;
                }
-                /*
+                if (err == MOVE_SOURCE_RD_ERR) {
-                 * The LEB has not been moved because the volume is being
+                        /*
-                 * deleted or the PEB has been put meanwhile. We should prevent
+                         * An error happened while reading the source PEB. Do
-                 * this PEB from being selected for wear-leveling movement
+                         * not switch to R/O mode in this case, and give the
-                 * again, so put it to the protection queue.
+                         * upper layers a possibility to recover from this,
-                 */
+                         * e.g. by unmapping corresponding LEB. Instead, just
+                         * put this PEB to the @ubi->erroneous list to prevent
-                dbg_wl("canceled moving PEB %d", e1->pnum);
+                         * UBI from trying to move it over and over again.
-                ubi_assert(err == 1);
+                         */
+                        if (ubi->erroneous_peb_count > ubi->max_erroneous) {
-                ubi_free_vid_hdr(ubi, vid_hdr);
+                                ubi_err("too many erroneous eraseblocks (%d)",
-                vid_hdr = NULL;
+                                        ubi->erroneous_peb_count);
+                                goto out_error;
-                spin_lock(&ubi->wl_lock);
+                        }
-                prot_queue_add(ubi, e1);
+                        erroneous = 1;
-                ubi_assert(!ubi->move_to_put);
+                        goto out_not_moved;
-                ubi->move_from = ubi->move_to = NULL;
+                }
-                ubi->wl_scheduled = 0;
-                spin_unlock(&ubi->wl_lock);
-                e1 = NULL;
+                if (err < 0)
-                err = schedule_erase(ubi, e2, 0);
-                if (err)
                        goto out_error;
-                mutex_unlock(&ubi->move_mutex);
-                return 0;
+                ubi_assert(0);
        }
        /* The PEB has been successfully moved */
-        ubi_free_vid_hdr(ubi, vid_hdr);
-        vid_hdr = NULL;
        if (scrubbing)
-                ubi_msg("scrubbed PEB %d, data moved to PEB %d",
+                ubi_msg("scrubbed PEB %d (LEB %d:%d), data moved to PEB %d",
-                        e1->pnum, e2->pnum);
+                        e1->pnum, vol_id, lnum, e2->pnum);
+        ubi_free_vid_hdr(ubi, vid_hdr);
        spin_lock(&ubi->wl_lock);
        if (!ubi->move_to_put) {
@@ -812,8 +825,10 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
        err = schedule_erase(ubi, e1, 0);
        if (err) {
-                e1 = NULL;
+                kmem_cache_free(ubi_wl_entry_slab, e1);
-                goto out_error;
+                if (e2)
+                        kmem_cache_free(ubi_wl_entry_slab, e2);
+                goto out_ro;
        }
        if (e2) {
@@ -821,10 +836,13 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
                 * Well, the target PEB was put meanwhile, schedule it for
                 * erasure.
                 */
-                dbg_wl("PEB %d was put meanwhile, erase", e2->pnum);
+                dbg_wl("PEB %d (LEB %d:%d) was put meanwhile, erase",
+                       e2->pnum, vol_id, lnum);
                err = schedule_erase(ubi, e2, 0);
-                if (err)
+                if (err) {
-                        goto out_error;
+                        kmem_cache_free(ubi_wl_entry_slab, e2);
+                        goto out_ro;
+                }
        }
        dbg_wl("done");
@@ -837,11 +855,19 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk,
         * have been changed, schedule it for erasure.
         */
 out_not_moved:
-        dbg_wl("canceled moving PEB %d", e1->pnum);
+        if (vol_id != -1)
-        ubi_free_vid_hdr(ubi, vid_hdr);
+                dbg_wl("cancel moving PEB %d (LEB %d:%d) to PEB %d (%d)",
-        vid_hdr = NULL;
+                       e1->pnum, vol_id, lnum, e2->pnum, err);
+        else
+                dbg_wl("cancel moving PEB %d to PEB %d (%d)",
+                       e1->pnum, e2->pnum, err);
        spin_lock(&ubi->wl_lock);
-        if (scrubbing)
+        if (protect)
+                prot_queue_add(ubi, e1);
+        else if (erroneous) {
+                wl_tree_add(e1, &ubi->erroneous);
+                ubi->erroneous_peb_count += 1;
+        } else if (scrubbing)
                wl_tree_add(e1, &ubi->scrub);
        else
                wl_tree_add(e1, &ubi->used);
@@ -850,32 +876,36 @@ out_not_moved:
        ubi->wl_scheduled = 0;
        spin_unlock(&ubi->wl_lock);
-        e1 = NULL;
+        ubi_free_vid_hdr(ubi, vid_hdr);
        err = schedule_erase(ubi, e2, torture);
-        if (err)
+        if (err) {
-                goto out_error;
+                kmem_cache_free(ubi_wl_entry_slab, e2);
+                goto out_ro;
+        }
        mutex_unlock(&ubi->move_mutex);
        return 0;
 out_error:
-        ubi_err("error %d while moving PEB %d to PEB %d",
+        if (vol_id != -1)
-                err, e1->pnum, e2->pnum);
+                ubi_err("error %d while moving PEB %d to PEB %d",
+                        err, e1->pnum, e2->pnum);
-        ubi_free_vid_hdr(ubi, vid_hdr);
+        else
+                ubi_err("error %d while moving PEB %d (LEB %d:%d) to PEB %d",
+                        err, e1->pnum, vol_id, lnum, e2->pnum);
        spin_lock(&ubi->wl_lock);
        ubi->move_from = ubi->move_to = NULL;
        ubi->move_to_put = ubi->wl_scheduled = 0;
        spin_unlock(&ubi->wl_lock);
-        if (e1)
+        ubi_free_vid_hdr(ubi, vid_hdr);
-                kmem_cache_free(ubi_wl_entry_slab, e1);
+        kmem_cache_free(ubi_wl_entry_slab, e1);
-        if (e2)
+        kmem_cache_free(ubi_wl_entry_slab, e2);
-                kmem_cache_free(ubi_wl_entry_slab, e2);
-        ubi_ro_mode(ubi);
+out_ro:
+        ubi_ro_mode(ubi);
        mutex_unlock(&ubi->move_mutex);
-        return err;
+        ubi_assert(err != 0);
+        return err < 0 ? err : -EIO;
 out_cancel:
        ubi->wl_scheduled = 0;
@@ -1015,7 +1045,7 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                /*
                 * If this is not %-EIO, we have no idea what to do. Scheduling
                 * this physical eraseblock for erasure again would cause
-                 * errors again and again. Well, lets switch to RO mode.
+                 * errors again and again. Well, lets switch to R/O mode.
                 */
                goto out_ro;
        }
@@ -1043,10 +1073,9 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
                ubi_err("no reserved physical eraseblocks");
                goto out_ro;
        }
        spin_unlock(&ubi->volumes_lock);
-        ubi_msg("mark PEB %d as bad", pnum);
+        ubi_msg("mark PEB %d as bad", pnum);
        err = ubi_io_mark_bad(ubi, pnum);
        if (err)
                goto out_ro;
@@ -1056,7 +1085,9 @@ static int erase_worker(struct ubi_device *ubi, struct ubi_work *wl_wrk,
        ubi->bad_peb_count += 1;
        ubi->good_peb_count -= 1;
        ubi_calculate_reserved(ubi);
-        if (ubi->beb_rsvd_pebs == 0)
+        if (ubi->beb_rsvd_pebs)
+                ubi_msg("%d PEBs left in the reserve", ubi->beb_rsvd_pebs);
+        else
                ubi_warn("last PEB from the reserved pool was used");
        spin_unlock(&ubi->volumes_lock);
@@ -1125,6 +1156,13 @@ retry:
                } else if (in_wl_tree(e, &ubi->scrub)) {
                        paranoid_check_in_wl_tree(e, &ubi->scrub);
                        rb_erase(&e->u.rb, &ubi->scrub);
+                } else if (in_wl_tree(e, &ubi->erroneous)) {
+                        paranoid_check_in_wl_tree(e, &ubi->erroneous);
+                        rb_erase(&e->u.rb, &ubi->erroneous);
+                        ubi->erroneous_peb_count -= 1;
+                        ubi_assert(ubi->erroneous_peb_count >= 0);
+                        /* Erroneous PEBs should be tortured */
+                        torture = 1;
                } else {
                        err = prot_queue_del(ubi, e->pnum);
                        if (err) {
@@ -1373,7 +1411,7 @@ int ubi_wl_init_scan(struct ubi_device *ubi, struct ubi_scan_info *si)
        struct ubi_scan_leb *seb, *tmp;
        struct ubi_wl_entry *e;
-        ubi->used = ubi->free = ubi->scrub = RB_ROOT;
+        ubi->used = ubi->erroneous = ubi->free = ubi->scrub = RB_ROOT;
        spin_lock_init(&ubi->wl_lock);
        mutex_init(&ubi->move_mutex);
        init_rwsem(&ubi->work_sem);
@@ -1511,6 +1549,7 @@ void ubi_wl_close(struct ubi_device *ubi)
        cancel_pending(ubi);
        protection_queue_destroy(ubi);
        tree_destroy(&ubi->used);
+        tree_destroy(&ubi->erroneous);
        tree_destroy(&ubi->free);
        tree_destroy(&ubi->scrub);
        kfree(ubi->lookuptbl);
diff --git a/include/linux/mtd/ubi.h b/include/linux/mtd/ubi.h
index 6316fafe5c2a..6913b71d9ab2 100644
--- a/include/linux/mtd/ubi.h
+++ b/include/linux/mtd/ubi.h
@@ -132,6 +132,39 @@ struct ubi_device_info {
        dev_t cdev;
 };
+/*
+ * enum - volume notification types.
+ * @UBI_VOLUME_ADDED: volume has been added
+ * @UBI_VOLUME_REMOVED: start volume volume
+ * @UBI_VOLUME_RESIZED: volume size has been re-sized
+ * @UBI_VOLUME_RENAMED: volume name has been re-named
+ * @UBI_VOLUME_UPDATED: volume name has been updated
+ *
+ * These constants define which type of event has happened when a volume
+ * notification function is invoked.
+ */
+enum {
+        UBI_VOLUME_ADDED,
+        UBI_VOLUME_REMOVED,
+        UBI_VOLUME_RESIZED,
+        UBI_VOLUME_RENAMED,
+        UBI_VOLUME_UPDATED,
+};
+/*
+ * struct ubi_notification - UBI notification description structure.
+ * @di: UBI device description object
+ * @vi: UBI volume description object
+ *
+ * UBI notifiers are called with a pointer to an object of this type. The
+ * object describes the notification. Namely, it provides a description of the
+ * UBI device and UBI volume the notification informs about.
+ */
+struct ubi_notification {
+        struct ubi_device_info di;
+        struct ubi_volume_info vi;
+};
 /* UBI descriptor given to users when they open UBI volumes */
 struct ubi_volume_desc;
@@ -141,6 +174,10 @@ void ubi_get_volume_info(struct ubi_volume_desc *desc,
 struct ubi_volume_desc *ubi_open_volume(int ubi_num, int vol_id, int mode);
 struct ubi_volume_desc *ubi_open_volume_nm(int ubi_num, const char *name,
                                           int mode);
+int ubi_register_volume_notifier(struct notifier_block *nb,
+                                 int ignore_existing);
+int ubi_unregister_volume_notifier(struct notifier_block *nb);
 void ubi_close_volume(struct ubi_volume_desc *desc);
 int ubi_leb_read(struct ubi_volume_desc *desc, int lnum, char *buf, int offset,
                 int len, int check);