105 files changed, 4034 insertions, 2603 deletions
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 82d1e4de475b..4521b1ecce45 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -4,7 +4,7 @@
 # Core functionality.
 obj-$(CONFIG_MTD)               += mtd.o
-mtd-y                           := mtdcore.o mtdsuper.o mtdbdi.o
+mtd-y                           := mtdcore.o mtdsuper.o
 mtd-$(CONFIG_MTD_PARTITIONS)    += mtdpart.o
 obj-$(CONFIG_MTD_CONCAT)        += mtdconcat.o
diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig
index 9408099eec48..35c6a23b183b 100644
--- a/drivers/mtd/chips/Kconfig
+++ b/drivers/mtd/chips/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/chips/Kconfig
 menu "RAM/ROM/Flash chip drivers"
        depends on MTD!=n
@@ -242,4 +240,3 @@ config MTD_XIP
          then say N.
 endmenu
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index e7563a9872d0..5fbf29e1e64f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -43,15 +43,17 @@
 // debugging, turns off buffer write mode if set to 1
 #define FORCE_WORD_WRITE 0
-#define MANUFACTURER_INTEL      0x0089
+/* Intel chips */
 #define I82802AB        0x00ad
 #define I82802AC        0x00ac
 #define PF38F4476       0x881c
-#define MANUFACTURER_ST         0x0020
+/* STMicroelectronics chips */
 #define M50LPW080       0x002F
 #define M50FLW080A      0x0080
 #define M50FLW080B      0x0081
+/* Atmel chips */
 #define AT49BV640D      0x02de
+#define AT49BV640DT     0x02db
 static int cfi_intelext_read (struct mtd_info *, loff_t, size_t, size_t *, u_char *);
 static int cfi_intelext_write_words(struct mtd_info *, loff_t, size_t, size_t *, const u_char *);
@@ -199,6 +201,16 @@ static void fixup_convert_atmel_pri(struct mtd_info *mtd, void *param)
        cfi->cfiq->BufWriteTimeoutMax = 0;
 }
+static void fixup_at49bv640dx_lock(struct mtd_info *mtd, void *param)
+{
+        struct map_info *map = mtd->priv;
+        struct cfi_private *cfi = map->fldrv_priv;
+        struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
+        cfip->FeatureSupport |= (1 << 5);
+        mtd->flags |= MTD_POWERUP_LOCK;
+}
 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
 /* Some Intel Strata Flash prior to FPO revision C has bugs in this area */
 static void fixup_intel_strataflash(struct mtd_info *mtd, void* param)
@@ -283,6 +295,8 @@ static void fixup_unlock_powerup_lock(struct mtd_info *mtd, void *param)
 static struct cfi_fixup cfi_fixup_table[] = {
        { CFI_MFR_ATMEL, CFI_ID_ANY, fixup_convert_atmel_pri, NULL },
+        { CFI_MFR_ATMEL, AT49BV640D, fixup_at49bv640dx_lock, NULL },
+        { CFI_MFR_ATMEL, AT49BV640DT, fixup_at49bv640dx_lock, NULL },
 #ifdef CMDSET0001_DISABLE_ERASE_SUSPEND_ON_WRITE
        { CFI_MFR_ANY, CFI_ID_ANY, fixup_intel_strataflash, NULL },
 #endif
@@ -294,16 +308,16 @@ static struct cfi_fixup cfi_fixup_table[] = {
 #endif
        { CFI_MFR_ST, 0x00ba, /* M28W320CT */ fixup_st_m28w320ct, NULL },
        { CFI_MFR_ST, 0x00bb, /* M28W320CB */ fixup_st_m28w320cb, NULL },
-        { MANUFACTURER_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock, NULL, },
+        { CFI_MFR_INTEL, CFI_ID_ANY, fixup_unlock_powerup_lock, NULL, },
        { 0, 0, NULL, NULL }
 };
 static struct cfi_fixup jedec_fixup_table[] = {
-        { MANUFACTURER_INTEL, I82802AB,   fixup_use_fwh_lock, NULL, },
+        { CFI_MFR_INTEL, I82802AB,   fixup_use_fwh_lock, NULL, },
-        { MANUFACTURER_INTEL, I82802AC,   fixup_use_fwh_lock, NULL, },
+        { CFI_MFR_INTEL, I82802AC,   fixup_use_fwh_lock, NULL, },
-        { MANUFACTURER_ST,    M50LPW080,  fixup_use_fwh_lock, NULL, },
+        { CFI_MFR_ST,    M50LPW080,  fixup_use_fwh_lock, NULL, },
-        { MANUFACTURER_ST,    M50FLW080A, fixup_use_fwh_lock, NULL, },
+        { CFI_MFR_ST,    M50FLW080A, fixup_use_fwh_lock, NULL, },
-        { MANUFACTURER_ST,    M50FLW080B, fixup_use_fwh_lock, NULL, },
+        { CFI_MFR_ST,    M50FLW080B, fixup_use_fwh_lock, NULL, },
        { 0, 0, NULL, NULL }
 };
 static struct cfi_fixup fixup_table[] = {
@@ -319,7 +333,7 @@ static struct cfi_fixup fixup_table[] = {
 static void cfi_fixup_major_minor(struct cfi_private *cfi,
                                                struct cfi_pri_intelext *extp)
 {
-        if (cfi->mfr == MANUFACTURER_INTEL &&
+        if (cfi->mfr == CFI_MFR_INTEL &&
                        cfi->id == PF38F4476 && extp->MinorVersion == '3')
                extp->MinorVersion = '1';
 }
@@ -2235,7 +2249,7 @@ static int cfi_intelext_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
        /* Some chips have OTP located in the _top_ partition only.
           For example: Intel 28F256L18T (T means top-parameter device) */
-        if (cfi->mfr == MANUFACTURER_INTEL) {
+        if (cfi->mfr == CFI_MFR_INTEL) {
                switch (cfi->id) {
                case 0x880b:
                case 0x880c:
@@ -2564,6 +2578,7 @@ static int cfi_intelext_reset(struct mtd_info *mtd)
                if (!ret) {
                        map_write(map, CMD(0xff), chip->start);
                        chip->state = FL_SHUTDOWN;
+                        put_chip(map, chip, chip->start);
                }
                spin_unlock(chip->mutex);
        }
diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c
index 94bb61e19047..f3600e8d5382 100644
--- a/drivers/mtd/chips/cfi_cmdset_0002.c
+++ b/drivers/mtd/chips/cfi_cmdset_0002.c
@@ -490,10 +490,6 @@ static struct mtd_info *cfi_amdstd_setup(struct mtd_info *mtd)
        }
 #endif
-        /* FIXME: erase-suspend-program is broken.  See
-           http://lists.infradead.org/pipermail/linux-mtd/2003-December/009001.html */
-        printk(KERN_NOTICE "cfi_cmdset_0002: Disabling erase-suspend-program due to code brokenness.\n");
        __module_get(THIS_MODULE);
        return mtd;
@@ -573,7 +569,6 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                        if (time_after(jiffies, timeo)) {
                                printk(KERN_ERR "Waiting for chip to be ready timed out.\n");
-                                spin_unlock(chip->mutex);
                                return -EIO;
                        }
                        spin_unlock(chip->mutex);
@@ -589,15 +584,9 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr
                return 0;
        case FL_ERASING:
-                if (mode == FL_WRITING) /* FIXME: Erase-suspend-program appears broken. */
+                if (!cfip || !(cfip->EraseSuspend & (0x1|0x2)) ||
-                        goto sleep;
+                    !(mode == FL_READY || mode == FL_POINT ||
+                    (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))))
-                if (!(   mode == FL_READY
-                      || mode == FL_POINT
-                      || !cfip
-                      || (mode == FL_WRITING && (cfip->EraseSuspend & 0x2))
-                      || (mode == FL_WRITING && (cfip->EraseSuspend & 0x1)
-                    )))
                        goto sleep;
                /* We could check to see if we're trying to access the sector
diff --git a/drivers/mtd/chips/cfi_util.c b/drivers/mtd/chips/cfi_util.c
index c5a84fda5410..ca584d0380b4 100755..100644
--- a/drivers/mtd/chips/cfi_util.c
+++ b/drivers/mtd/chips/cfi_util.c
@@ -71,6 +71,13 @@ int __xipram cfi_qry_mode_on(uint32_t base, struct map_info *map,
        cfi_send_gen_cmd(0x98, 0x555, base, map, cfi, cfi->device_type, NULL);
        if (cfi_qry_present(map, base, cfi))
                return 1;
+        /* some old SST chips, e.g. 39VF160x/39VF320x */
+        cfi_send_gen_cmd(0xF0, 0, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0xAA, 0x5555, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x55, 0x2AAA, base, map, cfi, cfi->device_type, NULL);
+        cfi_send_gen_cmd(0x98, 0x5555, base, map, cfi, cfi->device_type, NULL);
+        if (cfi_qry_present(map, base, cfi))
+                return 1;
        /* QRY not found */
        return 0;
 }
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index 736a3be265f2..8db1148dfa47 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -142,8 +142,8 @@
 /* ST - www.st.com */
 #define M29F800AB       0x0058
-#define M29W800DT       0x00D7
+#define M29W800DT       0x22D7
-#define M29W800DB       0x005B
+#define M29W800DB       0x225B
 #define M29W400DT       0x00EE
 #define M29W400DB       0x00EF
 #define M29W160DT       0x22C4
@@ -226,7 +226,7 @@ struct unlock_addr {
 * exists, but is for MTD_UADDR_NOT_SUPPORTED - and, therefore,
 * should not be used.  The  problem is that structures with
 * initializers have extra fields initialized to 0.  It is _very_
- * desireable to have the unlock address entries for unsupported
+ * desirable to have the unlock address entries for unsupported
 * data widths automatically initialized - that means that
 * MTD_UADDR_NOT_SUPPORTED must be 0 and the first entry here
 * must go unused.
@@ -1575,7 +1575,7 @@ static const struct amd_flash_info jedec_table[] = {
                .dev_id         = M29W800DT,
                .name           = "ST M29W800DT",
                .devtypes       = CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
-                .uaddr          = MTD_UADDR_0x5555_0x2AAA,      /* ???? */
+                .uaddr          = MTD_UADDR_0x0AAA_0x0555,
                .dev_size       = SIZE_1MiB,
                .cmd_set        = P_ID_AMD_STD,
                .nr_regions     = 4,
@@ -1590,7 +1590,7 @@ static const struct amd_flash_info jedec_table[] = {
                .dev_id         = M29W800DB,
                .name           = "ST M29W800DB",
                .devtypes       = CFI_DEVICETYPE_X16|CFI_DEVICETYPE_X8,
-                .uaddr          = MTD_UADDR_0x5555_0x2AAA,      /* ???? */
+                .uaddr          = MTD_UADDR_0x0AAA_0x0555,
                .dev_size       = SIZE_1MiB,
                .cmd_set        = P_ID_AMD_STD,
                .nr_regions     = 4,
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index c222514bb70d..35081ce77fbd 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/maps/Kconfig
 menu "Self-contained MTD device drivers"
        depends on MTD!=n
@@ -308,4 +306,3 @@ config MTD_DOCPROBE_55AA
          you have managed to wipe the first block.
 endmenu
diff --git a/drivers/mtd/devices/block2mtd.c b/drivers/mtd/devices/block2mtd.c
index 8c295f40d2ac..ce6424008ed9 100644
--- a/drivers/mtd/devices/block2mtd.c
+++ b/drivers/mtd/devices/block2mtd.c
@@ -17,6 +17,7 @@
 #include <linux/buffer_head.h>
 #include <linux/mutex.h>
 #include <linux/mount.h>
+#include <linux/slab.h>
 #define ERROR(fmt, args...) printk(KERN_ERR "block2mtd: " fmt "\n" , ## args)
 #define INFO(fmt, args...) printk(KERN_INFO "block2mtd: " fmt "\n" , ## args)
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 4c19269de91a..81e49a9b017e 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -21,7 +21,9 @@
 #include <linux/interrupt.h>
 #include <linux/mutex.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
+#include <linux/mod_devicetable.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/partitions.h>
@@ -29,9 +31,6 @@
 #include <linux/spi/spi.h>
 #include <linux/spi/flash.h>
-#define FLASH_PAGESIZE          256
 /* Flash opcodes. */
 #define OPCODE_WREN             0x06    /* Write enable */
 #define OPCODE_RDSR             0x05    /* Read status register */
@@ -61,7 +60,7 @@
 /* Define max times to check status register before we give up. */
 #define MAX_READY_WAIT_JIFFIES  (40 * HZ)       /* M25P16 specs 40s max chip erase */
-#define CMD_SIZE                4
+#define MAX_CMD_SIZE            4
 #ifdef CONFIG_M25PXX_USE_FAST_READ
 #define OPCODE_READ     OPCODE_FAST_READ
@@ -78,8 +77,10 @@ struct m25p {
        struct mutex            lock;
        struct mtd_info         mtd;
        unsigned                partitioned:1;
+        u16                     page_size;
+        u16                     addr_width;
        u8                      erase_opcode;
-        u8                      command[CMD_SIZE + FAST_READ_DUMMY_BYTE];
+        u8                      *command;
 };
 static inline struct m25p *mtd_to_m25p(struct mtd_info *mtd)
@@ -198,6 +199,19 @@ static int erase_chip(struct m25p *flash)
        return 0;
 }
+static void m25p_addr2cmd(struct m25p *flash, unsigned int addr, u8 *cmd)
+{
+        /* opcode is in cmd[0] */
+        cmd[1] = addr >> (flash->addr_width * 8 -  8);
+        cmd[2] = addr >> (flash->addr_width * 8 - 16);
+        cmd[3] = addr >> (flash->addr_width * 8 - 24);
+}
+static int m25p_cmdsz(struct m25p *flash)
+{
+        return 1 + flash->addr_width;
+}
 /*
 * Erase one sector of flash memory at offset ``offset'' which is any
 * address within the sector which should be erased.
@@ -219,11 +233,9 @@ static int erase_sector(struct m25p *flash, u32 offset)
        /* Set up command buffer. */
        flash->command[0] = flash->erase_opcode;
-        flash->command[1] = offset >> 16;
+        m25p_addr2cmd(flash, offset, flash->command);
-        flash->command[2] = offset >> 8;
-        flash->command[3] = offset;
-        spi_write(flash->spi, flash->command, CMD_SIZE);
+        spi_write(flash->spi, flash->command, m25p_cmdsz(flash));
        return 0;
 }
@@ -325,7 +337,7 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
         * Should add 1 byte DUMMY_BYTE.
         */
        t[0].tx_buf = flash->command;
-        t[0].len = CMD_SIZE + FAST_READ_DUMMY_BYTE;
+        t[0].len = m25p_cmdsz(flash) + FAST_READ_DUMMY_BYTE;
        spi_message_add_tail(&t[0], &m);
        t[1].rx_buf = buf;
@@ -352,13 +364,11 @@ static int m25p80_read(struct mtd_info *mtd, loff_t from, size_t len,
        /* Set up the write data buffer. */
        flash->command[0] = OPCODE_READ;
-        flash->command[1] = from >> 16;
+        m25p_addr2cmd(flash, from, flash->command);
-        flash->command[2] = from >> 8;
-        flash->command[3] = from;
        spi_sync(flash->spi, &m);
-        *retlen = m.actual_length - CMD_SIZE - FAST_READ_DUMMY_BYTE;
+        *retlen = m.actual_length - m25p_cmdsz(flash) - FAST_READ_DUMMY_BYTE;
        mutex_unlock(&flash->lock);
@@ -396,7 +406,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
        memset(t, 0, (sizeof t));
        t[0].tx_buf = flash->command;
-        t[0].len = CMD_SIZE;
+        t[0].len = m25p_cmdsz(flash);
        spi_message_add_tail(&t[0], &m);
        t[1].tx_buf = buf;
@@ -414,41 +424,36 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
        /* Set up the opcode in the write buffer. */
        flash->command[0] = OPCODE_PP;
-        flash->command[1] = to >> 16;
+        m25p_addr2cmd(flash, to, flash->command);
-        flash->command[2] = to >> 8;
-        flash->command[3] = to;
-        /* what page do we start with? */
+        page_offset = to & (flash->page_size - 1);
-        page_offset = to % FLASH_PAGESIZE;
        /* do all the bytes fit onto one page? */
-        if (page_offset + len <= FLASH_PAGESIZE) {
+        if (page_offset + len <= flash->page_size) {
                t[1].len = len;
                spi_sync(flash->spi, &m);
-                *retlen = m.actual_length - CMD_SIZE;
+                *retlen = m.actual_length - m25p_cmdsz(flash);
        } else {
                u32 i;
                /* the size of data remaining on the first page */
-                page_size = FLASH_PAGESIZE - page_offset;
+                page_size = flash->page_size - page_offset;
                t[1].len = page_size;
                spi_sync(flash->spi, &m);
-                *retlen = m.actual_length - CMD_SIZE;
+                *retlen = m.actual_length - m25p_cmdsz(flash);
-                /* write everything in PAGESIZE chunks */
+                /* write everything in flash->page_size chunks */
                for (i = page_size; i < len; i += page_size) {
                        page_size = len - i;
-                        if (page_size > FLASH_PAGESIZE)
+                        if (page_size > flash->page_size)
-                                page_size = FLASH_PAGESIZE;
+                                page_size = flash->page_size;
                        /* write the next page to flash */
-                        flash->command[1] = (to + i) >> 16;
+                        m25p_addr2cmd(flash, to + i, flash->command);
-                        flash->command[2] = (to + i) >> 8;
-                        flash->command[3] = (to + i);
                        t[1].tx_buf = buf + i;
                        t[1].len = page_size;
@@ -460,7 +465,7 @@ static int m25p80_write(struct mtd_info *mtd, loff_t to, size_t len,
                        spi_sync(flash->spi, &m);
                        if (retlen)
-                                *retlen += m.actual_length - CMD_SIZE;
+                                *retlen += m.actual_length - m25p_cmdsz(flash);
                }
        }
@@ -492,7 +497,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
        memset(t, 0, (sizeof t));
        t[0].tx_buf = flash->command;
-        t[0].len = CMD_SIZE;
+        t[0].len = m25p_cmdsz(flash);
        spi_message_add_tail(&t[0], &m);
        t[1].tx_buf = buf;
@@ -511,9 +516,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
        /* Start write from odd address. */
        if (actual) {
                flash->command[0] = OPCODE_BP;
-                flash->command[1] = to >> 16;
+                m25p_addr2cmd(flash, to, flash->command);
-                flash->command[2] = to >> 8;
-                flash->command[3] = to;
                /* write one byte. */
                t[1].len = 1;
@@ -521,17 +524,15 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
                ret = wait_till_ready(flash);
                if (ret)
                        goto time_out;
-                *retlen += m.actual_length - CMD_SIZE;
+                *retlen += m.actual_length - m25p_cmdsz(flash);
        }
        to += actual;
        flash->command[0] = OPCODE_AAI_WP;
-        flash->command[1] = to >> 16;
+        m25p_addr2cmd(flash, to, flash->command);
-        flash->command[2] = to >> 8;
-        flash->command[3] = to;
        /* Write out most of the data here. */
-        cmd_sz = CMD_SIZE;
+        cmd_sz = m25p_cmdsz(flash);
        for (; actual < len - 1; actual += 2) {
                t[0].len = cmd_sz;
                /* write two bytes. */
@@ -555,10 +556,8 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
        if (actual != len) {
                write_enable(flash);
                flash->command[0] = OPCODE_BP;
-                flash->command[1] = to >> 16;
+                m25p_addr2cmd(flash, to, flash->command);
-                flash->command[2] = to >> 8;
+                t[0].len = m25p_cmdsz(flash);
-                flash->command[3] = to;
-                t[0].len = CMD_SIZE;
                t[1].len = 1;
                t[1].tx_buf = buf + actual;
@@ -566,7 +565,7 @@ static int sst_write(struct mtd_info *mtd, loff_t to, size_t len,
                ret = wait_till_ready(flash);
                if (ret)
                        goto time_out;
-                *retlen += m.actual_length - CMD_SIZE;
+                *retlen += m.actual_length - m25p_cmdsz(flash);
                write_disable(flash);
        }
@@ -582,8 +581,6 @@ time_out:
 */
 struct flash_info {
-        char            *name;
        /* JEDEC id zero means "no ID" (most older chips); otherwise it has
         * a high byte of zero plus three data bytes: the manufacturer id,
         * then a two byte device id.
@@ -597,87 +594,119 @@ struct flash_info {
        unsigned        sector_size;
        u16             n_sectors;
+        u16             page_size;
+        u16             addr_width;
        u16             flags;
 #define SECT_4K         0x01            /* OPCODE_BE_4K works uniformly */
+#define M25P_NO_ERASE   0x02            /* No erase command needed */
 };
+#define INFO(_jedec_id, _ext_id, _sector_size, _n_sectors, _flags)      \
+        ((kernel_ulong_t)&(struct flash_info) {                         \
+                .jedec_id = (_jedec_id),                                \
+                .ext_id = (_ext_id),                                    \
+                .sector_size = (_sector_size),                          \
+                .n_sectors = (_n_sectors),                              \
+                .page_size = 256,                                       \
+                .addr_width = 3,                                        \
+                .flags = (_flags),                                      \
+        })
+#define CAT25_INFO(_sector_size, _n_sectors, _page_size, _addr_width)   \
+        ((kernel_ulong_t)&(struct flash_info) {                         \
+                .sector_size = (_sector_size),                          \
+                .n_sectors = (_n_sectors),                              \
+                .page_size = (_page_size),                              \
+                .addr_width = (_addr_width),                            \
+                .flags = M25P_NO_ERASE,                                 \
+        })
 /* NOTE: double check command sets and memory organization when you add
 * more flash chips.  This current list focusses on newer chips, which
 * have been converging on command sets which including JEDEC ID.
 */
-static struct flash_info __devinitdata m25p_data [] = {
+static const struct spi_device_id m25p_ids[] = {
        /* Atmel -- some are (confusingly) marketed as "DataFlash" */
-        { "at25fs010",  0x1f6601, 0, 32 * 1024, 4, SECT_4K, },
+        { "at25fs010",  INFO(0x1f6601, 0, 32 * 1024,   4, SECT_4K) },
-        { "at25fs040",  0x1f6604, 0, 64 * 1024, 8, SECT_4K, },
+        { "at25fs040",  INFO(0x1f6604, 0, 64 * 1024,   8, SECT_4K) },
-        { "at25df041a", 0x1f4401, 0, 64 * 1024, 8, SECT_4K, },
+        { "at25df041a", INFO(0x1f4401, 0, 64 * 1024,   8, SECT_4K) },
-        { "at25df641",  0x1f4800, 0, 64 * 1024, 128, SECT_4K, },
+        { "at25df641",  INFO(0x1f4800, 0, 64 * 1024, 128, SECT_4K) },
-        { "at26f004",   0x1f0400, 0, 64 * 1024, 8, SECT_4K, },
+        { "at26f004",   INFO(0x1f0400, 0, 64 * 1024,  8, SECT_4K) },
-        { "at26df081a", 0x1f4501, 0, 64 * 1024, 16, SECT_4K, },
+        { "at26df081a", INFO(0x1f4501, 0, 64 * 1024, 16, SECT_4K) },
-        { "at26df161a", 0x1f4601, 0, 64 * 1024, 32, SECT_4K, },
+        { "at26df161a", INFO(0x1f4601, 0, 64 * 1024, 32, SECT_4K) },
-        { "at26df321",  0x1f4701, 0, 64 * 1024, 64, SECT_4K, },
+        { "at26df321",  INFO(0x1f4701, 0, 64 * 1024, 64, SECT_4K) },
        /* Macronix */
-        { "mx25l3205d", 0xc22016, 0, 64 * 1024, 64, },
+        { "mx25l4005a",  INFO(0xc22013, 0, 64 * 1024,   8, SECT_4K) },
-        { "mx25l6405d", 0xc22017, 0, 64 * 1024, 128, },
+        { "mx25l3205d",  INFO(0xc22016, 0, 64 * 1024,  64, 0) },
-        { "mx25l12805d", 0xc22018, 0, 64 * 1024, 256, },
+        { "mx25l6405d",  INFO(0xc22017, 0, 64 * 1024, 128, 0) },
-        { "mx25l12855e", 0xc22618, 0, 64 * 1024, 256, },
+        { "mx25l12805d", INFO(0xc22018, 0, 64 * 1024, 256, 0) },
+        { "mx25l12855e", INFO(0xc22618, 0, 64 * 1024, 256, 0) },
        /* Spansion -- single (large) sector size only, at least
         * for the chips listed here (without boot sectors).
         */
-        { "s25sl004a", 0x010212, 0, 64 * 1024, 8, },
+        { "s25sl004a",  INFO(0x010212,      0,  64 * 1024,   8, 0) },
-        { "s25sl008a", 0x010213, 0, 64 * 1024, 16, },
+        { "s25sl008a",  INFO(0x010213,      0,  64 * 1024,  16, 0) },
-        { "s25sl016a", 0x010214, 0, 64 * 1024, 32, },
+        { "s25sl016a",  INFO(0x010214,      0,  64 * 1024,  32, 0) },
-        { "s25sl032a", 0x010215, 0, 64 * 1024, 64, },
+        { "s25sl032a",  INFO(0x010215,      0,  64 * 1024,  64, 0) },
-        { "s25sl064a", 0x010216, 0, 64 * 1024, 128, },
+        { "s25sl064a",  INFO(0x010216,      0,  64 * 1024, 128, 0) },
-        { "s25sl12800", 0x012018, 0x0300, 256 * 1024, 64, },
+        { "s25sl12800", INFO(0x012018, 0x0300, 256 * 1024,  64, 0) },
-        { "s25sl12801", 0x012018, 0x0301, 64 * 1024, 256, },
+        { "s25sl12801", INFO(0x012018, 0x0301,  64 * 1024, 256, 0) },
-        { "s25fl129p0", 0x012018, 0x4d00, 256 * 1024, 64, },
+        { "s25fl129p0", INFO(0x012018, 0x4d00, 256 * 1024,  64, 0) },
-        { "s25fl129p1", 0x012018, 0x4d01, 64 * 1024, 256, },
+        { "s25fl129p1", INFO(0x012018, 0x4d01,  64 * 1024, 256, 0) },
        /* SST -- large erase sizes are "overlays", "sectors" are 4K */
-        { "sst25vf040b", 0xbf258d, 0, 64 * 1024, 8, SECT_4K, },
+        { "sst25vf040b", INFO(0xbf258d, 0, 64 * 1024,  8, SECT_4K) },
-        { "sst25vf080b", 0xbf258e, 0, 64 * 1024, 16, SECT_4K, },
+        { "sst25vf080b", INFO(0xbf258e, 0, 64 * 1024, 16, SECT_4K) },
-        { "sst25vf016b", 0xbf2541, 0, 64 * 1024, 32, SECT_4K, },
+        { "sst25vf016b", INFO(0xbf2541, 0, 64 * 1024, 32, SECT_4K) },
-        { "sst25vf032b", 0xbf254a, 0, 64 * 1024, 64, SECT_4K, },
+        { "sst25vf032b", INFO(0xbf254a, 0, 64 * 1024, 64, SECT_4K) },
-        { "sst25wf512",  0xbf2501, 0, 64 * 1024, 1, SECT_4K, },
+        { "sst25wf512",  INFO(0xbf2501, 0, 64 * 1024,  1, SECT_4K) },
-        { "sst25wf010",  0xbf2502, 0, 64 * 1024, 2, SECT_4K, },
+        { "sst25wf010",  INFO(0xbf2502, 0, 64 * 1024,  2, SECT_4K) },
-        { "sst25wf020",  0xbf2503, 0, 64 * 1024, 4, SECT_4K, },
+        { "sst25wf020",  INFO(0xbf2503, 0, 64 * 1024,  4, SECT_4K) },
-        { "sst25wf040",  0xbf2504, 0, 64 * 1024, 8, SECT_4K, },
+        { "sst25wf040",  INFO(0xbf2504, 0, 64 * 1024,  8, SECT_4K) },
        /* ST Microelectronics -- newer production may have feature updates */
-        { "m25p05",  0x202010,  0, 32 * 1024, 2, },
+        { "m25p05",  INFO(0x202010,  0,  32 * 1024,   2, 0) },
-        { "m25p10",  0x202011,  0, 32 * 1024, 4, },
+        { "m25p10",  INFO(0x202011,  0,  32 * 1024,   4, 0) },
-        { "m25p20",  0x202012,  0, 64 * 1024, 4, },
+        { "m25p20",  INFO(0x202012,  0,  64 * 1024,   4, 0) },
-        { "m25p40",  0x202013,  0, 64 * 1024, 8, },
+        { "m25p40",  INFO(0x202013,  0,  64 * 1024,   8, 0) },
-        { "m25p80",         0,  0, 64 * 1024, 16, },
+        { "m25p80",  INFO(0x202014,  0,  64 * 1024,  16, 0) },
-        { "m25p16",  0x202015,  0, 64 * 1024, 32, },
+        { "m25p16",  INFO(0x202015,  0,  64 * 1024,  32, 0) },
-        { "m25p32",  0x202016,  0, 64 * 1024, 64, },
+        { "m25p32",  INFO(0x202016,  0,  64 * 1024,  64, 0) },
-        { "m25p64",  0x202017,  0, 64 * 1024, 128, },
+        { "m25p64",  INFO(0x202017,  0,  64 * 1024, 128, 0) },
-        { "m25p128", 0x202018, 0, 256 * 1024, 64, },
+        { "m25p128", INFO(0x202018,  0, 256 * 1024,  64, 0) },
-        { "m45pe10", 0x204011,  0, 64 * 1024, 2, },
+        { "m45pe10", INFO(0x204011,  0, 64 * 1024,    2, 0) },
-        { "m45pe80", 0x204014,  0, 64 * 1024, 16, },
+        { "m45pe80", INFO(0x204014,  0, 64 * 1024,   16, 0) },
-        { "m45pe16", 0x204015,  0, 64 * 1024, 32, },
+        { "m45pe16", INFO(0x204015,  0, 64 * 1024,   32, 0) },
-        { "m25pe80", 0x208014,  0, 64 * 1024, 16, },
+        { "m25pe80", INFO(0x208014,  0, 64 * 1024, 16,       0) },
-        { "m25pe16", 0x208015,  0, 64 * 1024, 32, SECT_4K, },
+        { "m25pe16", INFO(0x208015,  0, 64 * 1024, 32, SECT_4K) },
        /* Winbond -- w25x "blocks" are 64K, "sectors" are 4KiB */
-        { "w25x10", 0xef3011, 0, 64 * 1024, 2, SECT_4K, },
+        { "w25x10", INFO(0xef3011, 0, 64 * 1024,  2,  SECT_4K) },
-        { "w25x20", 0xef3012, 0, 64 * 1024, 4, SECT_4K, },
+        { "w25x20", INFO(0xef3012, 0, 64 * 1024,  4,  SECT_4K) },
-        { "w25x40", 0xef3013, 0, 64 * 1024, 8, SECT_4K, },
+        { "w25x40", INFO(0xef3013, 0, 64 * 1024,  8,  SECT_4K) },
-        { "w25x80", 0xef3014, 0, 64 * 1024, 16, SECT_4K, },
+        { "w25x80", INFO(0xef3014, 0, 64 * 1024,  16, SECT_4K) },
-        { "w25x16", 0xef3015, 0, 64 * 1024, 32, SECT_4K, },
+        { "w25x16", INFO(0xef3015, 0, 64 * 1024,  32, SECT_4K) },
-        { "w25x32", 0xef3016, 0, 64 * 1024, 64, SECT_4K, },
+        { "w25x32", INFO(0xef3016, 0, 64 * 1024,  64, SECT_4K) },
-        { "w25x64", 0xef3017, 0, 64 * 1024, 128, SECT_4K, },
+        { "w25x64", INFO(0xef3017, 0, 64 * 1024, 128, SECT_4K) },
+        /* Catalyst / On Semiconductor -- non-JEDEC */
+        { "cat25c11", CAT25_INFO(  16, 8, 16, 1) },
+        { "cat25c03", CAT25_INFO(  32, 8, 16, 2) },
+        { "cat25c09", CAT25_INFO( 128, 8, 32, 2) },
+        { "cat25c17", CAT25_INFO( 256, 8, 32, 2) },
+        { "cat25128", CAT25_INFO(2048, 8, 64, 2) },
+        { },
 };
+MODULE_DEVICE_TABLE(spi, m25p_ids);
-static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
+static const struct spi_device_id *__devinit jedec_probe(struct spi_device *spi)
 {
        int                     tmp;
        u8                      code = OPCODE_RDID;
@@ -702,18 +731,24 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
        jedec = jedec << 8;
        jedec |= id[2];
+        /*
+         * Some chips (like Numonyx M25P80) have JEDEC and non-JEDEC variants,
+         * which depend on technology process. Officially RDID command doesn't
+         * exist for non-JEDEC chips, but for compatibility they return ID 0.
+         */
+        if (jedec == 0)
+                return NULL;
        ext_jedec = id[3] << 8 | id[4];
-        for (tmp = 0, info = m25p_data;
+        for (tmp = 0; tmp < ARRAY_SIZE(m25p_ids) - 1; tmp++) {
-                        tmp < ARRAY_SIZE(m25p_data);
+                info = (void *)m25p_ids[tmp].driver_data;
-                        tmp++, info++) {
                if (info->jedec_id == jedec) {
                        if (info->ext_id != 0 && info->ext_id != ext_jedec)
                                continue;
-                        return info;
+                        return &m25p_ids[tmp];
                }
        }
-        dev_err(&spi->dev, "unrecognized JEDEC id %06x\n", jedec);
        return NULL;
 }
@@ -725,6 +760,7 @@ static struct flash_info *__devinit jedec_probe(struct spi_device *spi)
 */
 static int __devinit m25p_probe(struct spi_device *spi)
 {
+        const struct spi_device_id      *id = spi_get_device_id(spi);
        struct flash_platform_data      *data;
        struct m25p                     *flash;
        struct flash_info               *info;
@@ -737,50 +773,65 @@ static int __devinit m25p_probe(struct spi_device *spi)
         */
        data = spi->dev.platform_data;
        if (data && data->type) {
-                for (i = 0, info = m25p_data;
+                const struct spi_device_id *plat_id;
-                                i < ARRAY_SIZE(m25p_data);
-                                i++, info++) {
-                        if (strcmp(data->type, info->name) == 0)
-                                break;
-                }
-                /* unrecognized chip? */
+                for (i = 0; i < ARRAY_SIZE(m25p_ids) - 1; i++) {
-                if (i == ARRAY_SIZE(m25p_data)) {
+                        plat_id = &m25p_ids[i];
-                        DEBUG(MTD_DEBUG_LEVEL0, "%s: unrecognized id %s\n",
+                        if (strcmp(data->type, plat_id->name))
-                                        dev_name(&spi->dev), data->type);
+                                continue;
-                        info = NULL;
+                        break;
-                /* recognized; is that chip really what's there? */
-                } else if (info->jedec_id) {
-                        struct flash_info       *chip = jedec_probe(spi);
-                        if (!chip || chip != info) {
-                                dev_warn(&spi->dev, "found %s, expected %s\n",
-                                                chip ? chip->name : "UNKNOWN",
-                                                info->name);
-                                info = NULL;
-                        }
                }
-        } else
-                info = jedec_probe(spi);
-        if (!info)
+                if (plat_id)
-                return -ENODEV;
+                        id = plat_id;
+                else
+                        dev_warn(&spi->dev, "unrecognized id %s\n", data->type);
+        }
+        info = (void *)id->driver_data;
+        if (info->jedec_id) {
+                const struct spi_device_id *jid;
+                jid = jedec_probe(spi);
+                if (!jid) {
+                        dev_info(&spi->dev, "non-JEDEC variant of %s\n",
+                                 id->name);
+                } else if (jid != id) {
+                        /*
+                         * JEDEC knows better, so overwrite platform ID. We
+                         * can't trust partitions any longer, but we'll let
+                         * mtd apply them anyway, since some partitions may be
+                         * marked read-only, and we don't want to lose that
+                         * information, even if it's not 100% accurate.
+                         */
+                        dev_warn(&spi->dev, "found %s, expected %s\n",
+                                 jid->name, id->name);
+                        id = jid;
+                        info = (void *)jid->driver_data;
+                }
+        }
        flash = kzalloc(sizeof *flash, GFP_KERNEL);
        if (!flash)
                return -ENOMEM;
+        flash->command = kmalloc(MAX_CMD_SIZE + FAST_READ_DUMMY_BYTE, GFP_KERNEL);
+        if (!flash->command) {
+                kfree(flash);
+                return -ENOMEM;
+        }
        flash->spi = spi;
        mutex_init(&flash->lock);
        dev_set_drvdata(&spi->dev, flash);
        /*
-         * Atmel serial flash tend to power up
+         * Atmel and SST serial flash tend to power
-         * with the software protection bits set
+         * up with the software protection bits set
         */
-        if (info->jedec_id >> 16 == 0x1f) {
+        if (info->jedec_id >> 16 == 0x1f ||
+            info->jedec_id >> 16 == 0xbf) {
                write_enable(flash);
                write_sr(flash, 0);
        }
@@ -812,9 +863,14 @@ static int __devinit m25p_probe(struct spi_device *spi)
                flash->mtd.erasesize = info->sector_size;
        }
+        if (info->flags & M25P_NO_ERASE)
+                flash->mtd.flags |= MTD_NO_ERASE;
        flash->mtd.dev.parent = &spi->dev;
+        flash->page_size = info->page_size;
+        flash->addr_width = info->addr_width;
-        dev_info(&spi->dev, "%s (%lld Kbytes)\n", info->name,
+        dev_info(&spi->dev, "%s (%lld Kbytes)\n", id->name,
                        (long long)flash->mtd.size >> 10);
        DEBUG(MTD_DEBUG_LEVEL2,
@@ -888,8 +944,10 @@ static int __devexit m25p_remove(struct spi_device *spi)
                status = del_mtd_partitions(&flash->mtd);
        else
                status = del_mtd_device(&flash->mtd);
-        if (status == 0)
+        if (status == 0) {
+                kfree(flash->command);
                kfree(flash);
+        }
        return 0;
 }
@@ -900,6 +958,7 @@ static struct spi_driver m25p80_driver = {
                .bus    = &spi_bus_type,
                .owner  = THIS_MODULE,
        },
+        .id_table       = m25p_ids,
        .probe  = m25p_probe,
        .remove = __devexit_p(m25p_remove),
diff --git a/drivers/mtd/devices/mtd_dataflash.c b/drivers/mtd/devices/mtd_dataflash.c
index 93e3627be74c..19817404ce7d 100644
--- a/drivers/mtd/devices/mtd_dataflash.c
+++ b/drivers/mtd/devices/mtd_dataflash.c
@@ -636,6 +636,7 @@ add_dataflash_otp(struct spi_device *spi, char *name,
        struct mtd_info                 *device;
        struct flash_platform_data      *pdata = spi->dev.platform_data;
        char                            *otp_tag = "";
+        int                             err = 0;
        priv = kzalloc(sizeof *priv, GFP_KERNEL);
        if (!priv)
@@ -693,13 +694,23 @@ add_dataflash_otp(struct spi_device *spi, char *name,
                if (nr_parts > 0) {
                        priv->partitioned = 1;
-                        return add_mtd_partitions(device, parts, nr_parts);
+                        err = add_mtd_partitions(device, parts, nr_parts);
+                        goto out;
                }
        } else if (pdata && pdata->nr_parts)
                dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
                                pdata->nr_parts, device->name);
-        return add_mtd_device(device) == 1 ? -ENODEV : 0;
+        if (add_mtd_device(device) == 1)
+                err = -ENODEV;
+out:
+        if (!err)
+                return 0;
+        dev_set_drvdata(&spi->dev, NULL);
+        kfree(priv);
+        return err;
 }
 static inline int __devinit
@@ -932,8 +943,10 @@ static int __devexit dataflash_remove(struct spi_device *spi)
                status = del_mtd_partitions(&flash->mtd);
        else
                status = del_mtd_device(&flash->mtd);
-        if (status == 0)
+        if (status == 0) {
+                dev_set_drvdata(&spi->dev, NULL);
                kfree(flash);
+        }
        return status;
 }
diff --git a/drivers/mtd/devices/slram.c b/drivers/mtd/devices/slram.c
index 3aa05cd18ea1..592016a0668f 100644
--- a/drivers/mtd/devices/slram.c
+++ b/drivers/mtd/devices/slram.c
@@ -18,7 +18,7 @@
                to specify the offset instead of the absolute address
  NOTE:
-  With slram it's only possible to map a contigous memory region. Therfore
+  With slram it's only possible to map a contiguous memory region. Therefore
  if there's a device mapped somewhere in the region specified slram will
  fail to load (see kernel log if modprobe fails).
diff --git a/drivers/mtd/devices/sst25l.c b/drivers/mtd/devices/sst25l.c
index 0a11721f146e..fe17054ee2fe 100644
--- a/drivers/mtd/devices/sst25l.c
+++ b/drivers/mtd/devices/sst25l.c
@@ -20,6 +20,7 @@
 #include <linux/device.h>
 #include <linux/mutex.h>
 #include <linux/interrupt.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/mtd/mtd.h>
diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 8aca5523a337..8aca5523a337 100755..100644
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
diff --git a/drivers/mtd/internal.h b/drivers/mtd/internal.h
deleted file mode 100644
index c658fe7216b5..000000000000
--- a/drivers/mtd/internal.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/* Internal MTD definitions
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-/*
- * mtdbdi.c
- */
-extern struct backing_dev_info mtd_bdi_unmappable;
-extern struct backing_dev_info mtd_bdi_ro_mappable;
-extern struct backing_dev_info mtd_bdi_rw_mappable;
diff --git a/drivers/mtd/lpddr/Kconfig b/drivers/mtd/lpddr/Kconfig
index 5a401d8047ab..265f969817e3 100644
--- a/drivers/mtd/lpddr/Kconfig
+++ b/drivers/mtd/lpddr/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/chips/Kconfig
 menu "LPDDR flash memory drivers"
        depends on MTD!=n
@@ -20,4 +18,3 @@ config MTD_QINFO_PROBE
            families of devices. This serves similar purpose of CFI on legacy
            Flash products
 endmenu
diff --git a/drivers/mtd/lpddr/lpddr_cmds.c b/drivers/mtd/lpddr/lpddr_cmds.c
index e22ca49583e7..a73ee12aad81 100644
--- a/drivers/mtd/lpddr/lpddr_cmds.c
+++ b/drivers/mtd/lpddr/lpddr_cmds.c
@@ -26,6 +26,7 @@
 */
 #include <linux/mtd/pfow.h>
 #include <linux/mtd/qinfo.h>
+#include <linux/slab.h>
 static int lpddr_read(struct mtd_info *mtd, loff_t adr, size_t len,
                                        size_t *retlen, u_char *buf);
diff --git a/drivers/mtd/maps/Kconfig b/drivers/mtd/maps/Kconfig
index 14be0755d7cd..aa2807d0ce72 100644
--- a/drivers/mtd/maps/Kconfig
+++ b/drivers/mtd/maps/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/maps/Kconfig
 menu "Mapping drivers for chip access"
        depends on MTD!=n
@@ -253,12 +251,6 @@ config MTD_NETtel
        help
          Support for flash chips on NETtel/SecureEdge/SnapGear boards.
-config MTD_ALCHEMY
-        tristate "AMD Alchemy Pb1xxx/Db1xxx/RDK MTD support"
-        depends on SOC_AU1X00 && MTD_PARTITIONS && MTD_CFI
-        help
-          Flash memory access on AMD Alchemy Pb/Db/RDK Reference Boards
 config MTD_DILNETPC
        tristate "CFI Flash device mapped on DIL/Net PC"
        depends on X86 && MTD_CONCAT && MTD_PARTITIONS && MTD_CFI_INTELEXT && BROKEN
@@ -361,12 +353,6 @@ config MTD_SA1100
          the SA1100 and SA1110, including the Assabet and the Compaq iPAQ.
          If you have such a board, say 'Y'.
-config MTD_IPAQ
-        tristate "CFI Flash device mapped on Compaq/HP iPAQ"
-        depends on IPAQ_HANDHELD && MTD_CFI
-        help
-          This provides a driver for the on-board flash of the iPAQ.
 config MTD_DC21285
        tristate "CFI Flash device mapped on DC21285 Footbridge"
        depends on MTD_CFI && ARCH_FOOTBRIDGE && MTD_COMPLEX_MAPPINGS
@@ -389,9 +375,9 @@ config MTD_IXP2000
        depends on MTD_CFI && MTD_COMPLEX_MAPPINGS && ARCH_IXP2000
        help
          This enables MTD access to flash devices on platforms based
-          on Intel's IXP2000 family of network processors such as the
+          on Intel's IXP2000 family of network processors. If you have an
-          IXDP425 and Coyote. If you have an IXP2000 based board and
+          IXP2000 based board and would like to use the flash chips on it,
-          would like to use the flash chips on it, say 'Y'.
+          say 'Y'.
 config MTD_FORTUNET
        tristate "CFI Flash device mapped on the FortuNet board"
@@ -436,15 +422,6 @@ config MTD_H720X
          This enables access to the flash chips on the Hynix evaluation boards.
          If you have such a board, say 'Y'.
-config MTD_OMAP_NOR
-        tristate "TI OMAP board mappings"
-        depends on MTD_CFI && ARCH_OMAP
-        help
-          This enables access to the NOR flash chips on TI OMAP-based
-          boards defining flash platform devices and flash platform data.
-          These boards include the Innovator, H2, H3, OSK, Perseus2, and
-          more.  If you have such a board, say 'Y'.
 # This needs CFI or JEDEC, depending on the cards found.
 config MTD_PCI
        tristate "PCI MTD driver"
@@ -557,4 +534,21 @@ config MTD_VMU
          To build this as a module select M here, the module will be called
          vmu-flash.
+config MTD_PISMO
+        tristate "MTD discovery driver for PISMO modules"
+        depends on I2C
+        depends on ARCH_VERSATILE
+        help
+          This driver allows for discovery of PISMO modules - see
+          <http://www.pismoworld.org/>.  These are small modules containing
+          up to five memory devices (eg, SRAM, flash, DOC) described by an
+          I2C EEPROM.
+          This driver does not create any MTD maps itself; instead it
+          creates MTD physmap and MTD SRAM platform devices.  If you
+          enable this option, you should consider enabling MTD_PHYSMAP
+          and/or MTD_PLATRAM according to the devices on your module.
+          When built as a module, it will be called pismo.ko
 endmenu
diff --git a/drivers/mtd/maps/Makefile b/drivers/mtd/maps/Makefile
index ae2f6dbe43c3..bb035cd54c72 100644
--- a/drivers/mtd/maps/Makefile
+++ b/drivers/mtd/maps/Makefile
@@ -24,12 +24,12 @@ obj-$(CONFIG_MTD_CEIVA)		+= ceiva.o
 obj-$(CONFIG_MTD_OCTAGON)       += octagon-5066.o
 obj-$(CONFIG_MTD_PHYSMAP)       += physmap.o
 obj-$(CONFIG_MTD_PHYSMAP_OF)    += physmap_of.o
+obj-$(CONFIG_MTD_PISMO)         += pismo.o
 obj-$(CONFIG_MTD_PMC_MSP_EVM)   += pmcmsp-flash.o
 obj-$(CONFIG_MTD_PCMCIA)        += pcmciamtd.o
 obj-$(CONFIG_MTD_RPXLITE)       += rpxlite.o
 obj-$(CONFIG_MTD_TQM8XXL)       += tqm8xxl.o
 obj-$(CONFIG_MTD_SA1100)        += sa1100-flash.o
-obj-$(CONFIG_MTD_IPAQ)          += ipaq-flash.o
 obj-$(CONFIG_MTD_SBC_GXX)       += sbc_gxx.o
 obj-$(CONFIG_MTD_SC520CDP)      += sc520cdp.o
 obj-$(CONFIG_MTD_NETSC520)      += netsc520.o
@@ -40,7 +40,6 @@ obj-$(CONFIG_MTD_SCx200_DOCFLASH)+= scx200_docflash.o
 obj-$(CONFIG_MTD_DBOX2)         += dbox2-flash.o
 obj-$(CONFIG_MTD_SOLUTIONENGINE)+= solutionengine.o
 obj-$(CONFIG_MTD_PCI)           += pci.o
-obj-$(CONFIG_MTD_ALCHEMY)       += alchemy-flash.o
 obj-$(CONFIG_MTD_AUTCPU12)      += autcpu12-nvram.o
 obj-$(CONFIG_MTD_EDB7312)       += edb7312.o
 obj-$(CONFIG_MTD_IMPA7)         += impa7.o
@@ -55,7 +54,6 @@ obj-$(CONFIG_MTD_IXP2000)	+= ixp2000.o
 obj-$(CONFIG_MTD_WRSBC8260)     += wr_sbc82xx_flash.o
 obj-$(CONFIG_MTD_DMV182)        += dmv182.o
 obj-$(CONFIG_MTD_PLATRAM)       += plat-ram.o
-obj-$(CONFIG_MTD_OMAP_NOR)      += omap_nor.o
 obj-$(CONFIG_MTD_INTEL_VR_NOR)  += intel_vr_nor.o
 obj-$(CONFIG_MTD_BFIN_ASYNC)    += bfin-async-flash.o
 obj-$(CONFIG_MTD_RBTX4939)      += rbtx4939-flash.o
diff --git a/drivers/mtd/maps/alchemy-flash.c b/drivers/mtd/maps/alchemy-flash.c
deleted file mode 100644
index 845ad4f2a542..000000000000
--- a/drivers/mtd/maps/alchemy-flash.c
+++ /dev/null
@@ -1,166 +0,0 @@
-/*
- * Flash memory access on AMD Alchemy evaluation boards
- *
- * (C) 2003, 2004 Pete Popov <ppopov@embeddedalley.com>
- */
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#ifdef CONFIG_MIPS_PB1000
-#define BOARD_MAP_NAME "Pb1000 Flash"
-#define BOARD_FLASH_SIZE 0x00800000 /* 8MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_PB1500
-#define BOARD_MAP_NAME "Pb1500 Flash"
-#define BOARD_FLASH_SIZE 0x04000000 /* 64MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_PB1100
-#define BOARD_MAP_NAME "Pb1100 Flash"
-#define BOARD_FLASH_SIZE 0x04000000 /* 64MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_PB1550
-#define BOARD_MAP_NAME "Pb1550 Flash"
-#define BOARD_FLASH_SIZE 0x08000000 /* 128MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_PB1200
-#define BOARD_MAP_NAME "Pb1200 Flash"
-#define BOARD_FLASH_SIZE 0x08000000 /* 128MB */
-#define BOARD_FLASH_WIDTH 2 /* 16-bits */
-#endif
-#ifdef CONFIG_MIPS_DB1000
-#define BOARD_MAP_NAME "Db1000 Flash"
-#define BOARD_FLASH_SIZE 0x02000000 /* 32MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_DB1500
-#define BOARD_MAP_NAME "Db1500 Flash"
-#define BOARD_FLASH_SIZE 0x02000000 /* 32MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_DB1100
-#define BOARD_MAP_NAME "Db1100 Flash"
-#define BOARD_FLASH_SIZE 0x02000000 /* 32MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_DB1550
-#define BOARD_MAP_NAME "Db1550 Flash"
-#define BOARD_FLASH_SIZE 0x08000000 /* 128MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#endif
-#ifdef CONFIG_MIPS_DB1200
-#define BOARD_MAP_NAME "Db1200 Flash"
-#define BOARD_FLASH_SIZE 0x04000000 /* 64MB */
-#define BOARD_FLASH_WIDTH 2 /* 16-bits */
-#endif
-#ifdef CONFIG_MIPS_BOSPORUS
-#define BOARD_MAP_NAME "Bosporus Flash"
-#define BOARD_FLASH_SIZE 0x01000000 /* 16MB */
-#define BOARD_FLASH_WIDTH 2 /* 16-bits */
-#endif
-#ifdef CONFIG_MIPS_MIRAGE
-#define BOARD_MAP_NAME "Mirage Flash"
-#define BOARD_FLASH_SIZE 0x04000000 /* 64MB */
-#define BOARD_FLASH_WIDTH 4 /* 32-bits */
-#define USE_LOCAL_ACCESSORS /* why? */
-#endif
-static struct map_info alchemy_map = {
-        .name = BOARD_MAP_NAME,
-};
-static struct mtd_partition alchemy_partitions[] = {
-        {
-                .name = "User FS",
-                .size = BOARD_FLASH_SIZE - 0x00400000,
-                .offset = 0x0000000
-        },{
-                .name = "YAMON",
-                .size = 0x0100000,
-                .offset = MTDPART_OFS_APPEND,
-                .mask_flags = MTD_WRITEABLE
-        },{
-                .name = "raw kernel",
-                .size = (0x300000 - 0x40000), /* last 256KB is yamon env */
-                .offset = MTDPART_OFS_APPEND,
-        }
-};
-static struct mtd_info *mymtd;
-static int __init alchemy_mtd_init(void)
-{
-        struct mtd_partition *parts;
-        int nb_parts = 0;
-        unsigned long window_addr;
-        unsigned long window_size;
-        /* Default flash buswidth */
-        alchemy_map.bankwidth = BOARD_FLASH_WIDTH;
-        window_addr = 0x20000000 - BOARD_FLASH_SIZE;
-        window_size = BOARD_FLASH_SIZE;
-        /*
-         * Static partition definition selection
-         */
-        parts = alchemy_partitions;
-        nb_parts = ARRAY_SIZE(alchemy_partitions);
-        alchemy_map.size = window_size;
-        /*
-         * Now let's probe for the actual flash.  Do it here since
-         * specific machine settings might have been set above.
-         */
-        printk(KERN_NOTICE BOARD_MAP_NAME ": probing %d-bit flash bus\n",
-                        alchemy_map.bankwidth*8);
-        alchemy_map.virt = ioremap(window_addr, window_size);
-        mymtd = do_map_probe("cfi_probe", &alchemy_map);
-        if (!mymtd) {
-                iounmap(alchemy_map.virt);
-                return -ENXIO;
-        }
-        mymtd->owner = THIS_MODULE;
-        add_mtd_partitions(mymtd, parts, nb_parts);
-        return 0;
-}
-static void __exit alchemy_mtd_cleanup(void)
-{
-        if (mymtd) {
-                del_mtd_partitions(mymtd);
-                map_destroy(mymtd);
-                iounmap(alchemy_map.virt);
-        }
-}
-module_init(alchemy_mtd_init);
-module_exit(alchemy_mtd_cleanup);
-MODULE_AUTHOR("Embedded Alley Solutions, Inc");
-MODULE_DESCRIPTION(BOARD_MAP_NAME " MTD driver");
-MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 237733d094c4..19fe92db0c46 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -8,6 +8,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
diff --git a/drivers/mtd/maps/bfin-async-flash.c b/drivers/mtd/maps/bfin-async-flash.c
index a7c808b577d3..c0fd99b0c525 100644
--- a/drivers/mtd/maps/bfin-async-flash.c
+++ b/drivers/mtd/maps/bfin-async-flash.c
@@ -22,6 +22,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #include <asm/blackfin.h>
diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c
index 424f17d6ffd1..ddb462bea9b5 100644
--- a/drivers/mtd/maps/ck804xrom.c
+++ b/drivers/mtd/maps/ck804xrom.c
@@ -11,6 +11,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c
index 11a2f57df9cf..d12c93dc1aad 100644
--- a/drivers/mtd/maps/esb2rom.c
+++ b/drivers/mtd/maps/esb2rom.c
@@ -14,6 +14,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
diff --git a/drivers/mtd/maps/gpio-addr-flash.c b/drivers/mtd/maps/gpio-addr-flash.c
index 1ad5caf9fe69..32e89d773b4e 100644
--- a/drivers/mtd/maps/gpio-addr-flash.c
+++ b/drivers/mtd/maps/gpio-addr-flash.c
@@ -23,6 +23,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/physmap.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/types.h>
 #define pr_devinit(fmt, args...) ({ static const __devinitconst char __fmt[] = fmt; printk(__fmt, ## args); })
diff --git a/drivers/mtd/maps/ichxrom.c b/drivers/mtd/maps/ichxrom.c
index c32bc28920b3..f102bf243a74 100644
--- a/drivers/mtd/maps/ichxrom.c
+++ b/drivers/mtd/maps/ichxrom.c
@@ -8,6 +8,7 @@
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/map.h>
diff --git a/drivers/mtd/maps/intel_vr_nor.c b/drivers/mtd/maps/intel_vr_nor.c
index 1e7814ae212a..fc1998512eb4 100644
--- a/drivers/mtd/maps/intel_vr_nor.c
+++ b/drivers/mtd/maps/intel_vr_nor.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/mtd/mtd.h>
diff --git a/drivers/mtd/maps/ipaq-flash.c b/drivers/mtd/maps/ipaq-flash.c
deleted file mode 100644
index 76708e796b70..000000000000
--- a/drivers/mtd/maps/ipaq-flash.c
+++ /dev/null
@@ -1,460 +0,0 @@
-/*
- * Flash memory access on iPAQ Handhelds (either SA1100 or PXA250 based)
- *
- * (C) 2000 Nicolas Pitre <nico@fluxnic.net>
- * (C) 2002 Hewlett-Packard Company <jamey.hicks@hp.com>
- * (C) 2003 Christian Pellegrin <chri@ascensit.com>, <chri@infis.univ.ts.it>: concatenation of multiple flashes
- */
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/spinlock.h>
-#include <linux/init.h>
-#include <linux/slab.h>
-#include <asm/page.h>
-#include <asm/mach-types.h>
-#include <asm/system.h>
-#include <asm/errno.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#ifdef CONFIG_MTD_CONCAT
-#include <linux/mtd/concat.h>
-#endif
-#include <mach/hardware.h>
-#include <mach/h3600.h>
-#include <asm/io.h>
-#ifndef CONFIG_IPAQ_HANDHELD
-#error This is for iPAQ Handhelds only
-#endif
-#ifdef CONFIG_SA1100_JORNADA56X
-static void jornada56x_set_vpp(struct map_info *map, int vpp)
-{
-        if (vpp)
-                GPSR = GPIO_GPIO26;
-        else
-                GPCR = GPIO_GPIO26;
-        GPDR |= GPIO_GPIO26;
-}
-#endif
-#ifdef CONFIG_SA1100_JORNADA720
-static void jornada720_set_vpp(struct map_info *map, int vpp)
-{
-        if (vpp)
-                PPSR |= 0x80;
-        else
-                PPSR &= ~0x80;
-        PPDR |= 0x80;
-}
-#endif
-#define MAX_IPAQ_CS 2           /* Number of CS we are going to test */
-#define IPAQ_MAP_INIT(X) \
-        { \
-                name:           "IPAQ flash " X, \
-        }
-static struct map_info ipaq_map[MAX_IPAQ_CS] = {
-        IPAQ_MAP_INIT("bank 1"),
-        IPAQ_MAP_INIT("bank 2")
-};
-static struct mtd_info *my_sub_mtd[MAX_IPAQ_CS] = {
-        NULL,
-        NULL
-};
-/*
- * Here are partition information for all known IPAQ-based devices.
- * See include/linux/mtd/partitions.h for definition of the mtd_partition
- * structure.
- *
- * The *_max_flash_size is the maximum possible mapped flash size which
- * is not necessarily the actual flash size.  It must be no more than
- * the value specified in the "struct map_desc *_io_desc" mapping
- * definition for the corresponding machine.
- *
- * Please keep these in alphabetical order, and formatted as per existing
- * entries.  Thanks.
- */
-#ifdef CONFIG_IPAQ_HANDHELD
-static unsigned long h3xxx_max_flash_size = 0x04000000;
-static struct mtd_partition h3xxx_partitions[] = {
-        {
-                name:           "H3XXX boot firmware",
-#ifndef CONFIG_LAB
-                size:           0x00040000,
-#else
-                size:           0x00080000,
-#endif
-                offset:         0,
-#ifndef CONFIG_LAB
-                mask_flags:     MTD_WRITEABLE,  /* force read-only */
-#endif
-        },
-        {
-                name:           "H3XXX root jffs2",
-#ifndef CONFIG_LAB
-                size:           0x2000000 - 2*0x40000, /* Warning, this is fixed later */
-                offset:         0x00040000,
-#else
-                size:           0x2000000 - 0x40000 - 0x80000, /* Warning, this is fixed later */
-                offset:         0x00080000,
-#endif
-        },
-        {
-                name:           "asset",
-                size:           0x40000,
-                offset:         0x2000000 - 0x40000, /* Warning, this is fixed later */
-                mask_flags:     MTD_WRITEABLE,  /* force read-only */
-        }
-};
-#ifndef CONFIG_MTD_CONCAT
-static struct mtd_partition h3xxx_partitions_bank2[] = {
-        /* this is used only on 2 CS machines when concat is not present */
-        {
-                name:           "second H3XXX root jffs2",
-                size:           0x1000000 - 0x40000, /* Warning, this is fixed later */
-                offset:         0x00000000,
-        },
-        {
-                name:           "second asset",
-                size:           0x40000,
-                offset:         0x1000000 - 0x40000, /* Warning, this is fixed later */
-                mask_flags:     MTD_WRITEABLE,  /* force read-only */
-        }
-};
-#endif
-static DEFINE_SPINLOCK(ipaq_vpp_lock);
-static void h3xxx_set_vpp(struct map_info *map, int vpp)
-{
-        static int nest = 0;
-        spin_lock(&ipaq_vpp_lock);
-        if (vpp)
-                nest++;
-        else
-                nest--;
-        if (nest)
-                assign_h3600_egpio(IPAQ_EGPIO_VPP_ON, 1);
-        else
-                assign_h3600_egpio(IPAQ_EGPIO_VPP_ON, 0);
-        spin_unlock(&ipaq_vpp_lock);
-}
-#endif
-#if defined(CONFIG_SA1100_JORNADA56X) || defined(CONFIG_SA1100_JORNADA720)
-static unsigned long jornada_max_flash_size = 0x02000000;
-static struct mtd_partition jornada_partitions[] = {
-        {
-                name:           "Jornada boot firmware",
-                size:           0x00040000,
-                offset:         0,
-                mask_flags:     MTD_WRITEABLE,  /* force read-only */
-        }, {
-                name:           "Jornada root jffs2",
-                size:           MTDPART_SIZ_FULL,
-                offset:         0x00040000,
-        }
-};
-#endif
-static struct mtd_partition *parsed_parts;
-static struct mtd_info *mymtd;
-static unsigned long cs_phys[] = {
-#ifdef CONFIG_ARCH_SA1100
-        SA1100_CS0_PHYS,
-        SA1100_CS1_PHYS,
-        SA1100_CS2_PHYS,
-        SA1100_CS3_PHYS,
-        SA1100_CS4_PHYS,
-        SA1100_CS5_PHYS,
-#else
-        PXA_CS0_PHYS,
-        PXA_CS1_PHYS,
-        PXA_CS2_PHYS,
-        PXA_CS3_PHYS,
-        PXA_CS4_PHYS,
-        PXA_CS5_PHYS,
-#endif
-};
-static const char *part_probes[] = { "cmdlinepart", "RedBoot", NULL };
-static int __init h1900_special_case(void);
-static int __init ipaq_mtd_init(void)
-{
-        struct mtd_partition *parts = NULL;
-        int nb_parts = 0;
-        int parsed_nr_parts = 0;
-        const char *part_type;
-        int i; /* used when we have >1 flash chips */
-        unsigned long tot_flashsize = 0; /* used when we have >1 flash chips */
-        /* Default flash bankwidth */
-        // ipaq_map.bankwidth = (MSC0 & MSC_RBW) ? 2 : 4;
-        if (machine_is_h1900())
-        {
-                /* For our intents, the h1900 is not a real iPAQ, so we special-case it. */
-                return h1900_special_case();
-        }
-        if (machine_is_h3100() || machine_is_h1900())
-                for(i=0; i<MAX_IPAQ_CS; i++)
-                        ipaq_map[i].bankwidth = 2;
-        else
-                for(i=0; i<MAX_IPAQ_CS; i++)
-                        ipaq_map[i].bankwidth = 4;
-        /*
-         * Static partition definition selection
-         */
-        part_type = "static";
-        simple_map_init(&ipaq_map[0]);
-        simple_map_init(&ipaq_map[1]);
-#ifdef CONFIG_IPAQ_HANDHELD
-        if (machine_is_ipaq()) {
-                parts = h3xxx_partitions;
-                nb_parts = ARRAY_SIZE(h3xxx_partitions);
-                for(i=0; i<MAX_IPAQ_CS; i++) {
-                        ipaq_map[i].size = h3xxx_max_flash_size;
-                        ipaq_map[i].set_vpp = h3xxx_set_vpp;
-                        ipaq_map[i].phys = cs_phys[i];
-                        ipaq_map[i].virt = ioremap(cs_phys[i], 0x04000000);
-                        if (machine_is_h3100 () || machine_is_h1900())
-                                ipaq_map[i].bankwidth = 2;
-                }
-                if (machine_is_h3600()) {
-                        /* No asset partition here */
-                        h3xxx_partitions[1].size += 0x40000;
-                        nb_parts--;
-                }
-        }
-#endif
-#ifdef CONFIG_ARCH_H5400
-        if (machine_is_h5400()) {
-                ipaq_map[0].size = 0x02000000;
-                ipaq_map[1].size = 0x02000000;
-                ipaq_map[1].phys = 0x02000000;
-                ipaq_map[1].virt = ipaq_map[0].virt + 0x02000000;
-        }
-#endif
-#ifdef CONFIG_ARCH_H1900
-        if (machine_is_h1900()) {
-                ipaq_map[0].size = 0x00400000;
-                ipaq_map[1].size = 0x02000000;
-                ipaq_map[1].phys = 0x00080000;
-                ipaq_map[1].virt = ipaq_map[0].virt + 0x00080000;
-        }
-#endif
-#ifdef CONFIG_SA1100_JORNADA56X
-        if (machine_is_jornada56x()) {
-                parts = jornada_partitions;
-                nb_parts = ARRAY_SIZE(jornada_partitions);
-                ipaq_map[0].size = jornada_max_flash_size;
-                ipaq_map[0].set_vpp = jornada56x_set_vpp;
-                ipaq_map[0].virt = (__u32)ioremap(0x0, 0x04000000);
-        }
-#endif
-#ifdef CONFIG_SA1100_JORNADA720
-        if (machine_is_jornada720()) {
-                parts = jornada_partitions;
-                nb_parts = ARRAY_SIZE(jornada_partitions);
-                ipaq_map[0].size = jornada_max_flash_size;
-                ipaq_map[0].set_vpp = jornada720_set_vpp;
-        }
-#endif
-        if (machine_is_ipaq()) { /* for iPAQs only */
-                for(i=0; i<MAX_IPAQ_CS; i++) {
-                        printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with CFI.\n", ipaq_map[i].bankwidth*8, ipaq_map[i].virt);
-                        my_sub_mtd[i] = do_map_probe("cfi_probe", &ipaq_map[i]);
-                        if (!my_sub_mtd[i]) {
-                                printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with JEDEC.\n", ipaq_map[i].bankwidth*8, ipaq_map[i].virt);
-                                my_sub_mtd[i] = do_map_probe("jedec_probe", &ipaq_map[i]);
-                        }
-                        if (!my_sub_mtd[i]) {
-                                printk(KERN_NOTICE "iPAQ flash: failed to find flash.\n");
-                                if (i)
-                                        break;
-                                else
-                                        return -ENXIO;
-                        } else
-                                printk(KERN_NOTICE "iPAQ flash: found %d bytes\n", my_sub_mtd[i]->size);
-                        /* do we really need this debugging? --joshua 20030703 */
-                        // printk("my_sub_mtd[%d]=%p\n", i, my_sub_mtd[i]);
-                        my_sub_mtd[i]->owner = THIS_MODULE;
-                        tot_flashsize += my_sub_mtd[i]->size;
-                }
-#ifdef CONFIG_MTD_CONCAT
-                /* fix the asset location */
-#       ifdef CONFIG_LAB
-                h3xxx_partitions[1].size = tot_flashsize - 0x40000 - 0x80000 /* extra big boot block */;
-#       else
-                h3xxx_partitions[1].size = tot_flashsize - 2 * 0x40000;
-#       endif
-                h3xxx_partitions[2].offset = tot_flashsize - 0x40000;
-                /* and concat the devices */
-                mymtd = mtd_concat_create(&my_sub_mtd[0], i,
-                                          "ipaq");
-                if (!mymtd) {
-                        printk("Cannot create iPAQ concat device\n");
-                        return -ENXIO;
-                }
-#else
-                mymtd = my_sub_mtd[0];
-                /*
-                 *In the very near future, command line partition parsing
-                 * will use the device name as 'mtd-id' instead of a value
-                 * passed to the parse_cmdline_partitions() routine. Since
-                 * the bootldr says 'ipaq', make sure it continues to work.
-                 */
-                mymtd->name = "ipaq";
-                if ((machine_is_h3600())) {
-#       ifdef CONFIG_LAB
-                        h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x80000;
-#       else
-                        h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x40000;
-#       endif
-                        nb_parts = 2;
-                } else {
-#       ifdef CONFIG_LAB
-                        h3xxx_partitions[1].size = my_sub_mtd[0]->size - 0x40000 - 0x80000; /* extra big boot block */
-#       else
-                        h3xxx_partitions[1].size = my_sub_mtd[0]->size - 2*0x40000;
-#       endif
-                        h3xxx_partitions[2].offset = my_sub_mtd[0]->size - 0x40000;
-                }
-                if (my_sub_mtd[1]) {
-#       ifdef CONFIG_LAB
-                        h3xxx_partitions_bank2[0].size = my_sub_mtd[1]->size - 0x80000;
-#       else
-                        h3xxx_partitions_bank2[0].size = my_sub_mtd[1]->size - 0x40000;
-#       endif
-                        h3xxx_partitions_bank2[1].offset = my_sub_mtd[1]->size - 0x40000;
-                }
-#endif
-        }
-        else {
-                /*
-                 * Now let's probe for the actual flash.  Do it here since
-                 * specific machine settings might have been set above.
-                 */
-                printk(KERN_NOTICE "IPAQ flash: probing %d-bit flash bus, window=%lx\n", ipaq_map[0].bankwidth*8, ipaq_map[0].virt);
-                mymtd = do_map_probe("cfi_probe", &ipaq_map[0]);
-                if (!mymtd)
-                        return -ENXIO;
-                mymtd->owner = THIS_MODULE;
-        }
-        /*
-         * Dynamic partition selection stuff (might override the static ones)
-         */
-         i = parse_mtd_partitions(mymtd, part_probes, &parsed_parts, 0);
-         if (i > 0) {
-                 nb_parts = parsed_nr_parts = i;
-                 parts = parsed_parts;
-                 part_type = "dynamic";
-         }
-         if (!parts) {
-                 printk(KERN_NOTICE "IPAQ flash: no partition info available, registering whole flash at once\n");
-                 add_mtd_device(mymtd);
-#ifndef CONFIG_MTD_CONCAT
-                 if (my_sub_mtd[1])
-                         add_mtd_device(my_sub_mtd[1]);
-#endif
-         } else {
-                 printk(KERN_NOTICE "Using %s partition definition\n", part_type);
-                 add_mtd_partitions(mymtd, parts, nb_parts);
-#ifndef CONFIG_MTD_CONCAT
-                 if (my_sub_mtd[1])
-                         add_mtd_partitions(my_sub_mtd[1], h3xxx_partitions_bank2, ARRAY_SIZE(h3xxx_partitions_bank2));
-#endif
-         }
-         return 0;
-}
-static void __exit ipaq_mtd_cleanup(void)
-{
-        int i;
-        if (mymtd) {
-                del_mtd_partitions(mymtd);
-#ifndef CONFIG_MTD_CONCAT
-                if (my_sub_mtd[1])
-                        del_mtd_partitions(my_sub_mtd[1]);
-#endif
-                map_destroy(mymtd);
-#ifdef CONFIG_MTD_CONCAT
-                for(i=0; i<MAX_IPAQ_CS; i++)
-#else
-                        for(i=1; i<MAX_IPAQ_CS; i++)
-#endif
-                        {
-                                if (my_sub_mtd[i])
-                                        map_destroy(my_sub_mtd[i]);
-                        }
-                kfree(parsed_parts);
-        }
-}
-static int __init h1900_special_case(void)
-{
-        /* The iPAQ h1900 is a special case - it has weird ROM. */
-        simple_map_init(&ipaq_map[0]);
-        ipaq_map[0].size = 0x80000;
-        ipaq_map[0].set_vpp = h3xxx_set_vpp;
-        ipaq_map[0].phys = 0x0;
-        ipaq_map[0].virt = ioremap(0x0, 0x04000000);
-        ipaq_map[0].bankwidth = 2;
-        printk(KERN_NOTICE "iPAQ flash: probing %d-bit flash bus, window=%lx with JEDEC.\n", ipaq_map[0].bankwidth*8, ipaq_map[0].virt);
-        mymtd = do_map_probe("jedec_probe", &ipaq_map[0]);
-        if (!mymtd)
-                return -ENODEV;
-        add_mtd_device(mymtd);
-        printk(KERN_NOTICE "iPAQ flash: registered h1910 flash\n");
-        return 0;
-}
-module_init(ipaq_mtd_init);
-module_exit(ipaq_mtd_cleanup);
-MODULE_AUTHOR("Jamey Hicks");
-MODULE_DESCRIPTION("IPAQ CFI map driver");
-MODULE_LICENSE("MIT");
diff --git a/drivers/mtd/maps/ixp4xx.c b/drivers/mtd/maps/ixp4xx.c
index 7214b876feba..7b0515297411 100644
--- a/drivers/mtd/maps/ixp4xx.c
+++ b/drivers/mtd/maps/ixp4xx.c
@@ -210,7 +210,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
         * not attempt to do a direct access on us.
         */
        info->map.phys = NO_XIP;
-        info->map.size = dev->resource->end - dev->resource->start + 1;
+        info->map.size = resource_size(dev->resource);
        /*
         * We only support 16-bit accesses for now. If and when
@@ -224,7 +224,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
        info->map.copy_from = ixp4xx_copy_from,
        info->res = request_mem_region(dev->resource->start,
-                        dev->resource->end - dev->resource->start + 1,
+                        resource_size(dev->resource),
                        "IXP4XXFlash");
        if (!info->res) {
                printk(KERN_ERR "IXP4XXFlash: Could not reserve memory region\n");
@@ -233,7 +233,7 @@ static int ixp4xx_flash_probe(struct platform_device *dev)
        }
        info->map.virt = ioremap(dev->resource->start,
-                                 dev->resource->end - dev->resource->start + 1);
+                                 resource_size(dev->resource));
        if (!info->map.virt) {
                printk(KERN_ERR "IXP4XXFlash: Failed to ioremap region\n");
                err = -EIO;
diff --git a/drivers/mtd/maps/octagon-5066.c b/drivers/mtd/maps/octagon-5066.c
index 2b2e45093218..23fe1786770f 100644
--- a/drivers/mtd/maps/octagon-5066.c
+++ b/drivers/mtd/maps/octagon-5066.c
@@ -24,7 +24,6 @@
   ##################################################################### */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <asm/io.h>
diff --git a/drivers/mtd/maps/omap_nor.c b/drivers/mtd/maps/omap_nor.c
deleted file mode 100644
index a24478102b11..000000000000
--- a/drivers/mtd/maps/omap_nor.c
+++ /dev/null
@@ -1,188 +0,0 @@
-/*
- * Flash memory support for various TI OMAP boards
- *
- * Copyright (C) 2001-2002 MontaVista Software Inc.
- * Copyright (C) 2003-2004 Texas Instruments
- * Copyright (C) 2004 Nokia Corporation
- *
- *      Assembled using driver code copyright the companies above
- *      and written by David Brownell, Jian Zhang <jzhang@ti.com>,
- *      Tony Lindgren <tony@atomide.com> and others.
- *
- * This program is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License as published by the
- * Free Software Foundation; either version 2 of the License, or (at your
- * option) any later version.
- *
- * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
- * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
- * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN
- * NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
- * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
- * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
- * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
- * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- *
- * You should have received a copy of the  GNU General Public License along
- * with this program; if not, write  to the Free Software Foundation, Inc.,
- * 675 Mass Ave, Cambridge, MA 02139, USA.
- */
-#include <linux/platform_device.h>
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/ioport.h>
-#include <linux/slab.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/map.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <mach/hardware.h>
-#include <asm/mach/flash.h>
-#include <mach/tc.h>
-#ifdef CONFIG_MTD_PARTITIONS
-static const char *part_probes[] = { /* "RedBoot", */ "cmdlinepart", NULL };
-#endif
-struct omapflash_info {
-        struct mtd_partition    *parts;
-        struct mtd_info         *mtd;
-        struct map_info         map;
-};
-static void omap_set_vpp(struct map_info *map, int enable)
-{
-        static int      count;
-        u32 l;
-        if (cpu_class_is_omap1()) {
-                if (enable) {
-                        if (count++ == 0) {
-                                l = omap_readl(EMIFS_CONFIG);
-                                l |= OMAP_EMIFS_CONFIG_WP;
-                                omap_writel(l, EMIFS_CONFIG);
-                        }
-                } else {
-                        if (count && (--count == 0)) {
-                                l = omap_readl(EMIFS_CONFIG);
-                                l &= ~OMAP_EMIFS_CONFIG_WP;
-                                omap_writel(l, EMIFS_CONFIG);
-                        }
-                }
-        }
-}
-static int __init omapflash_probe(struct platform_device *pdev)
-{
-        int err;
-        struct omapflash_info *info;
-        struct flash_platform_data *pdata = pdev->dev.platform_data;
-        struct resource *res = pdev->resource;
-        unsigned long size = res->end - res->start + 1;
-        info = kzalloc(sizeof(struct omapflash_info), GFP_KERNEL);
-        if (!info)
-                return -ENOMEM;
-        if (!request_mem_region(res->start, size, "flash")) {
-                err = -EBUSY;
-                goto out_free_info;
-        }
-        info->map.virt          = ioremap(res->start, size);
-        if (!info->map.virt) {
-                err = -ENOMEM;
-                goto out_release_mem_region;
-        }
-        info->map.name          = dev_name(&pdev->dev);
-        info->map.phys          = res->start;
-        info->map.size          = size;
-        info->map.bankwidth     = pdata->width;
-        info->map.set_vpp       = omap_set_vpp;
-        simple_map_init(&info->map);
-        info->mtd = do_map_probe(pdata->map_name, &info->map);
-        if (!info->mtd) {
-                err = -EIO;
-                goto out_iounmap;
-        }
-        info->mtd->owner = THIS_MODULE;
-        info->mtd->dev.parent = &pdev->dev;
-#ifdef CONFIG_MTD_PARTITIONS
-        err = parse_mtd_partitions(info->mtd, part_probes, &info->parts, 0);
-        if (err > 0)
-                add_mtd_partitions(info->mtd, info->parts, err);
-        else if (err <= 0 && pdata->parts)
-                add_mtd_partitions(info->mtd, pdata->parts, pdata->nr_parts);
-        else
-#endif
-                add_mtd_device(info->mtd);
-        platform_set_drvdata(pdev, info);
-        return 0;
-out_iounmap:
-        iounmap(info->map.virt);
-out_release_mem_region:
-        release_mem_region(res->start, size);
-out_free_info:
-        kfree(info);
-        return err;
-}
-static int __exit omapflash_remove(struct platform_device *pdev)
-{
-        struct omapflash_info *info = platform_get_drvdata(pdev);
-        platform_set_drvdata(pdev, NULL);
-        if (info) {
-                if (info->parts) {
-                        del_mtd_partitions(info->mtd);
-                        kfree(info->parts);
-                } else
-                        del_mtd_device(info->mtd);
-                map_destroy(info->mtd);
-                release_mem_region(info->map.phys, info->map.size);
-                iounmap((void __iomem *) info->map.virt);
-                kfree(info);
-        }
-        return 0;
-}
-static struct platform_driver omapflash_driver = {
-        .remove = __exit_p(omapflash_remove),
-        .driver = {
-                .name   = "omapflash",
-                .owner  = THIS_MODULE,
-        },
-};
-static int __init omapflash_init(void)
-{
-        return platform_driver_probe(&omapflash_driver, omapflash_probe);
-}
-static void __exit omapflash_exit(void)
-{
-        platform_driver_unregister(&omapflash_driver);
-}
-module_init(omapflash_init);
-module_exit(omapflash_exit);
-MODULE_LICENSE("GPL");
-MODULE_DESCRIPTION("MTD NOR map driver for TI OMAP boards");
-MODULE_ALIAS("platform:omapflash");
diff --git a/drivers/mtd/maps/pcmciamtd.c b/drivers/mtd/maps/pcmciamtd.c
index d600c2deff73..689d6a79ffc0 100644
--- a/drivers/mtd/maps/pcmciamtd.c
+++ b/drivers/mtd/maps/pcmciamtd.c
@@ -118,11 +118,9 @@ static caddr_t remap_window(struct map_info *map, unsigned long to)
                DEBUG(2, "Remapping window from 0x%8.8x to 0x%8.8x",
                      dev->offset, mrq.CardOffset);
                mrq.Page = 0;
-                ret = pcmcia_map_mem_page(win, &mrq);
+                ret = pcmcia_map_mem_page(dev->p_dev, win, &mrq);
-                if (ret != 0) {
+                if (ret != 0)
-                        cs_error(dev->p_dev, MapMemPage, ret);
                        return NULL;
-                }
                dev->offset = mrq.CardOffset;
        }
        return dev->win_base + (to & (dev->win_size-1));
@@ -327,8 +325,6 @@ static void pcmciamtd_set_vpp(struct map_info *map, int on)
        DEBUG(2, "dev = %p on = %d vpp = %d\n", dev, on, dev->vpp);
        ret = pcmcia_modify_configuration(link, &mod);
-        if (ret != 0)
-                cs_error(link, ModifyConfiguration, ret);
 }
@@ -348,107 +344,116 @@ static void pcmciamtd_release(struct pcmcia_device *link)
                        iounmap(dev->win_base);
                        dev->win_base = NULL;
                }
-                pcmcia_release_window(link->win);
+                pcmcia_release_window(link, link->win);
        }
        pcmcia_disable_device(link);
 }
-static void card_settings(struct pcmciamtd_dev *dev, struct pcmcia_device *link, int *new_name)
+#ifdef CONFIG_MTD_DEBUG
+static int pcmciamtd_cistpl_format(struct pcmcia_device *p_dev,
+                                tuple_t *tuple,
+                                void *priv_data)
 {
-        int rc;
-        tuple_t tuple;
        cisparse_t parse;
-        u_char buf[64];
-        tuple.Attributes = 0;
-        tuple.TupleData = (cisdata_t *)buf;
-        tuple.TupleDataMax = sizeof(buf);
-        tuple.TupleOffset = 0;
-        tuple.DesiredTuple = RETURN_FIRST_TUPLE;
-        rc = pcmcia_get_first_tuple(link, &tuple);
-        while (rc == 0) {
-                rc = pcmcia_get_tuple_data(link, &tuple);
-                if (rc != 0) {
-                        cs_error(link, GetTupleData, rc);
-                        break;
-                }
-                rc = pcmcia_parse_tuple(&tuple, &parse);
-                if (rc != 0) {
-                        cs_error(link, ParseTuple, rc);
-                        break;
-                }
-                switch(tuple.TupleCode) {
+        if (!pcmcia_parse_tuple(tuple, &parse)) {
-                case  CISTPL_FORMAT: {
+                cistpl_format_t *t = &parse.format;
-                        cistpl_format_t *t = &parse.format;
+                (void)t; /* Shut up, gcc */
-                        (void)t; /* Shut up, gcc */
+                DEBUG(2, "Format type: %u, Error Detection: %u, offset = %u, length =%u",
-                        DEBUG(2, "Format type: %u, Error Detection: %u, offset = %u, length =%u",
+                        t->type, t->edc, t->offset, t->length);
-                              t->type, t->edc, t->offset, t->length);
+        }
-                        break;
+        return -ENOSPC;
+}
-                }
+static int pcmciamtd_cistpl_jedec(struct pcmcia_device *p_dev,
+                                tuple_t *tuple,
+                                void *priv_data)
+{
+        cisparse_t parse;
+        int i;
-                case CISTPL_DEVICE: {
+        if (!pcmcia_parse_tuple(tuple, &parse)) {
-                        cistpl_device_t *t = &parse.device;
+                cistpl_jedec_t *t = &parse.jedec;
-                        int i;
+                for (i = 0; i < t->nid; i++)
-                        DEBUG(2, "Common memory:");
+                        DEBUG(2, "JEDEC: 0x%02x 0x%02x", t->id[i].mfr, t->id[i].info);
-                        dev->pcmcia_map.size = t->dev[0].size;
+        }
-                        for(i = 0; i < t->ndev; i++) {
+        return -ENOSPC;
-                                DEBUG(2, "Region %d, type = %u", i, t->dev[i].type);
+}
-                                DEBUG(2, "Region %d, wp = %u", i, t->dev[i].wp);
+#endif
-                                DEBUG(2, "Region %d, speed = %u ns", i, t->dev[i].speed);
-                                DEBUG(2, "Region %d, size = %u bytes", i, t->dev[i].size);
-                        }
-                        break;
-                }
-                case CISTPL_VERS_1: {
+static int pcmciamtd_cistpl_device(struct pcmcia_device *p_dev,
-                        cistpl_vers_1_t *t = &parse.version_1;
+                                tuple_t *tuple,
-                        int i;
+                                void *priv_data)
-                        if(t->ns) {
+{
-                                dev->mtd_name[0] = '\0';
+        struct pcmciamtd_dev *dev = priv_data;
-                                for(i = 0; i < t->ns; i++) {
+        cisparse_t parse;
-                                        if(i)
+        cistpl_device_t *t = &parse.device;
-                                                strcat(dev->mtd_name, " ");
+        int i;
-                                        strcat(dev->mtd_name, t->str+t->ofs[i]);
-                                }
-                        }
-                        DEBUG(2, "Found name: %s", dev->mtd_name);
-                        break;
-                }
-                case CISTPL_JEDEC_C: {
+        if (pcmcia_parse_tuple(tuple, &parse))
-                        cistpl_jedec_t *t = &parse.jedec;
+                return -EINVAL;
-                        int i;
-                        for(i = 0; i < t->nid; i++) {
+        DEBUG(2, "Common memory:");
-                                DEBUG(2, "JEDEC: 0x%02x 0x%02x", t->id[i].mfr, t->id[i].info);
+        dev->pcmcia_map.size = t->dev[0].size;
-                        }
+        /* from here on: DEBUG only */
-                        break;
+        for (i = 0; i < t->ndev; i++) {
-                }
+                DEBUG(2, "Region %d, type = %u", i, t->dev[i].type);
+                DEBUG(2, "Region %d, wp = %u", i, t->dev[i].wp);
+                DEBUG(2, "Region %d, speed = %u ns", i, t->dev[i].speed);
+                DEBUG(2, "Region %d, size = %u bytes", i, t->dev[i].size);
+        }
+        return 0;
+}
-                case CISTPL_DEVICE_GEO: {
+static int pcmciamtd_cistpl_geo(struct pcmcia_device *p_dev,
-                        cistpl_device_geo_t *t = &parse.device_geo;
+                                tuple_t *tuple,
-                        int i;
+                                void *priv_data)
-                        dev->pcmcia_map.bankwidth = t->geo[0].buswidth;
+{
-                        for(i = 0; i < t->ngeo; i++) {
+        struct pcmciamtd_dev *dev = priv_data;
-                                DEBUG(2, "region: %d bankwidth = %u", i, t->geo[i].buswidth);
+        cisparse_t parse;
-                                DEBUG(2, "region: %d erase_block = %u", i, t->geo[i].erase_block);
+        cistpl_device_geo_t *t = &parse.device_geo;
-                                DEBUG(2, "region: %d read_block = %u", i, t->geo[i].read_block);
+        int i;
-                                DEBUG(2, "region: %d write_block = %u", i, t->geo[i].write_block);
-                                DEBUG(2, "region: %d partition = %u", i, t->geo[i].partition);
-                                DEBUG(2, "region: %d interleave = %u", i, t->geo[i].interleave);
-                        }
-                        break;
-                }
-                default:
+        if (pcmcia_parse_tuple(tuple, &parse))
-                        DEBUG(2, "Unknown tuple code %d", tuple.TupleCode);
+                return -EINVAL;
-                }
+        dev->pcmcia_map.bankwidth = t->geo[0].buswidth;
+        /* from here on: DEBUG only */
+        for (i = 0; i < t->ngeo; i++) {
+                DEBUG(2, "region: %d bankwidth = %u", i, t->geo[i].buswidth);
+                DEBUG(2, "region: %d erase_block = %u", i, t->geo[i].erase_block);
+                DEBUG(2, "region: %d read_block = %u", i, t->geo[i].read_block);
+                DEBUG(2, "region: %d write_block = %u", i, t->geo[i].write_block);
+                DEBUG(2, "region: %d partition = %u", i, t->geo[i].partition);
+                DEBUG(2, "region: %d interleave = %u", i, t->geo[i].interleave);
+        }
+        return 0;
+}
+static void card_settings(struct pcmciamtd_dev *dev, struct pcmcia_device *link, int *new_name)
+{
+        int i;
-                rc = pcmcia_get_next_tuple(link, &tuple);
+        if (p_dev->prod_id[0]) {
+                dev->mtd_name[0] = '\0';
+                for (i = 0; i < 4; i++) {
+                        if (i)
+                                strcat(dev->mtd_name, " ");
+                        if (p_dev->prod_id[i])
+                                strcat(dev->mtd_name, p_dev->prod_id[i]);
+                }
+                DEBUG(2, "Found name: %s", dev->mtd_name);
        }
+#ifdef CONFIG_MTD_DEBUG
+        pcmcia_loop_tuple(p_dev, CISTPL_FORMAT, pcmciamtd_cistpl_format, NULL);
+        pcmcia_loop_tuple(p_dev, CISTPL_JEDEC_C, pcmciamtd_cistpl_jedec, NULL);
+#endif
+        pcmcia_loop_tuple(p_dev, CISTPL_DEVICE, pcmciamtd_cistpl_device, dev);
+        pcmcia_loop_tuple(p_dev, CISTPL_DEVICE_GEO, pcmciamtd_cistpl_geo, dev);
        if(!dev->pcmcia_map.size)
                dev->pcmcia_map.size = MAX_PCMCIA_ADDR;
@@ -481,16 +486,12 @@ static void card_settings(struct pcmciamtd_dev *dev, struct pcmcia_device *link,
 * MTD device available to the system.
 */
-#define CS_CHECK(fn, ret) \
-do { last_fn = (fn); if ((last_ret = (ret)) != 0) goto cs_failed; } while (0)
 static int pcmciamtd_config(struct pcmcia_device *link)
 {
        struct pcmciamtd_dev *dev = link->priv;
        struct mtd_info *mtd = NULL;
        cs_status_t status;
        win_req_t req;
-        int last_ret = 0, last_fn = 0;
        int ret;
        int i;
        static char *probes[] = { "jedec_probe", "cfi_probe" };
@@ -529,7 +530,7 @@ static int pcmciamtd_config(struct pcmcia_device *link)
                int ret;
                DEBUG(2, "requesting window with size = %dKiB memspeed = %d",
                      req.Size >> 10, req.AccessSpeed);
-                ret = pcmcia_request_window(&link, &req, &link->win);
+                ret = pcmcia_request_window(link, &req, &link->win);
                DEBUG(2, "ret = %d dev->win_size = %d", ret, dev->win_size);
                if(ret) {
                        req.Size >>= 1;
@@ -577,7 +578,6 @@ static int pcmciamtd_config(struct pcmcia_device *link)
        DEBUG(2, "Setting Configuration");
        ret = pcmcia_request_configuration(link, &link->conf);
        if (ret != 0) {
-                cs_error(link, RequestConfiguration, ret);
                if (dev->win_base) {
                        iounmap(dev->win_base);
                        dev->win_base = NULL;
@@ -652,8 +652,7 @@ static int pcmciamtd_config(struct pcmcia_device *link)
        link->dev_node = &dev->node;
        return 0;
- cs_failed:
+ failed:
-        cs_error(link, last_fn, last_ret);
        err("CS Error, exiting");
        pcmciamtd_release(link);
        return -ENODEV;
diff --git a/drivers/mtd/maps/physmap.c b/drivers/mtd/maps/physmap.c
index 380648e9051a..d9603f7f9652 100644
--- a/drivers/mtd/maps/physmap.c
+++ b/drivers/mtd/maps/physmap.c
@@ -48,23 +48,22 @@ static int physmap_flash_remove(struct platform_device *dev)
        if (info->cmtd) {
 #ifdef CONFIG_MTD_PARTITIONS
-                if (info->nr_parts || physmap_data->nr_parts)
+                if (info->nr_parts || physmap_data->nr_parts) {
                        del_mtd_partitions(info->cmtd);
-                else
+                        if (info->nr_parts)
+                                kfree(info->parts);
+                } else {
                        del_mtd_device(info->cmtd);
+                }
 #else
                del_mtd_device(info->cmtd);
 #endif
-        }
-#ifdef CONFIG_MTD_PARTITIONS
-        if (info->nr_parts)
-                kfree(info->parts);
-#endif
 #ifdef CONFIG_MTD_CONCAT
-        if (info->cmtd != info->mtd[0])
+                if (info->cmtd != info->mtd[0])
-                mtd_concat_destroy(info->cmtd);
+                        mtd_concat_destroy(info->cmtd);
 #endif
+        }
        for (i = 0; i < MAX_RESOURCES; i++) {
                if (info->mtd[i] != NULL)
@@ -130,7 +129,7 @@ static int physmap_flash_probe(struct platform_device *dev)
                                                 info->map[i].size);
                if (info->map[i].virt == NULL) {
                        dev_err(&dev->dev, "Failed to ioremap flash region\n");
-                        err = EIO;
+                        err = -EIO;
                        goto err_out;
                }
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index 61e4eb48bb2d..101ee6ead05c 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -23,6 +23,7 @@
 #include <linux/mtd/concat.h>
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/slab.h>
 struct of_flash_list {
        struct mtd_info *mtd;
diff --git a/drivers/mtd/maps/pismo.c b/drivers/mtd/maps/pismo.c
new file mode 100644
index 000000000000..60c068db452d
--- /dev/null
+++ b/drivers/mtd/maps/pismo.c
@@ -0,0 +1,321 @@
+/*
+ * PISMO memory driver - http://www.pismoworld.org/
+ *
+ * For ARM Realview and Versatile platforms
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License.
+ */
+#include <linux/init.h>
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/slab.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/mutex.h>
+#include <linux/mtd/physmap.h>
+#include <linux/mtd/plat-ram.h>
+#include <linux/mtd/pismo.h>
+#define PISMO_NUM_CS    5
+struct pismo_cs_block {
+        u8      type;
+        u8      width;
+        __le16  access;
+        __le32  size;
+        u32     reserved[2];
+        char    device[32];
+} __packed;
+struct pismo_eeprom {
+        struct pismo_cs_block cs[PISMO_NUM_CS];
+        char    board[15];
+        u8      sum;
+} __packed;
+struct pismo_mem {
+        phys_addr_t base;
+        u32     size;
+        u16     access;
+        u8      width;
+        u8      type;
+};
+struct pismo_data {
+        struct i2c_client       *client;
+        void                    (*vpp)(void *, int);
+        void                    *vpp_data;
+        struct platform_device  *dev[PISMO_NUM_CS];
+};
+/* FIXME: set_vpp could do with a better calling convention */
+static struct pismo_data *vpp_pismo;
+static DEFINE_MUTEX(pismo_mutex);
+static int pismo_setvpp_probe_fix(struct pismo_data *pismo)
+{
+        mutex_lock(&pismo_mutex);
+        if (vpp_pismo) {
+                mutex_unlock(&pismo_mutex);
+                kfree(pismo);
+                return -EBUSY;
+        }
+        vpp_pismo = pismo;
+        mutex_unlock(&pismo_mutex);
+        return 0;
+}
+static void pismo_setvpp_remove_fix(struct pismo_data *pismo)
+{
+        mutex_lock(&pismo_mutex);
+        if (vpp_pismo == pismo)
+                vpp_pismo = NULL;
+        mutex_unlock(&pismo_mutex);
+}
+static void pismo_set_vpp(struct map_info *map, int on)
+{
+        struct pismo_data *pismo = vpp_pismo;
+        pismo->vpp(pismo->vpp_data, on);
+}
+/* end of hack */
+static unsigned int __devinit pismo_width_to_bytes(unsigned int width)
+{
+        width &= 15;
+        if (width > 2)
+                return 0;
+        return 1 << width;
+}
+static int __devinit pismo_eeprom_read(struct i2c_client *client, void *buf,
+        u8 addr, size_t size)
+{
+        int ret;
+        struct i2c_msg msg[] = {
+                {
+                        .addr = client->addr,
+                        .len = sizeof(addr),
+                        .buf = &addr,
+                }, {
+                        .addr = client->addr,
+                        .flags = I2C_M_RD,
+                        .len = size,
+                        .buf = buf,
+                },
+        };
+        ret = i2c_transfer(client->adapter, msg, ARRAY_SIZE(msg));
+        return ret == ARRAY_SIZE(msg) ? size : -EIO;
+}
+static int __devinit pismo_add_device(struct pismo_data *pismo, int i,
+        struct pismo_mem *region, const char *name, void *pdata, size_t psize)
+{
+        struct platform_device *dev;
+        struct resource res = { };
+        phys_addr_t base = region->base;
+        int ret;
+        if (base == ~0)
+                return -ENXIO;
+        res.start = base;
+        res.end = base + region->size - 1;
+        res.flags = IORESOURCE_MEM;
+        dev = platform_device_alloc(name, i);
+        if (!dev)
+                return -ENOMEM;
+        dev->dev.parent = &pismo->client->dev;
+        do {
+                ret = platform_device_add_resources(dev, &res, 1);
+                if (ret)
+                        break;
+                ret = platform_device_add_data(dev, pdata, psize);
+                if (ret)
+                        break;
+                ret = platform_device_add(dev);
+                if (ret)
+                        break;
+                pismo->dev[i] = dev;
+                return 0;
+        } while (0);
+        platform_device_put(dev);
+        return ret;
+}
+static int __devinit pismo_add_nor(struct pismo_data *pismo, int i,
+        struct pismo_mem *region)
+{
+        struct physmap_flash_data data = {
+                .width = region->width,
+        };
+        if (pismo->vpp)
+                data.set_vpp = pismo_set_vpp;
+        return pismo_add_device(pismo, i, region, "physmap-flash",
+                &data, sizeof(data));
+}
+static int __devinit pismo_add_sram(struct pismo_data *pismo, int i,
+        struct pismo_mem *region)
+{
+        struct platdata_mtd_ram data = {
+                .bankwidth = region->width,
+        };
+        return pismo_add_device(pismo, i, region, "mtd-ram",
+                &data, sizeof(data));
+}
+static void __devinit pismo_add_one(struct pismo_data *pismo, int i,
+        const struct pismo_cs_block *cs, phys_addr_t base)
+{
+        struct device *dev = &pismo->client->dev;
+        struct pismo_mem region;
+        region.base = base;
+        region.type = cs->type;
+        region.width = pismo_width_to_bytes(cs->width);
+        region.access = le16_to_cpu(cs->access);
+        region.size = le32_to_cpu(cs->size);
+        if (region.width == 0) {
+                dev_err(dev, "cs%u: bad width: %02x, ignoring\n", i, cs->width);
+                return;
+        }
+        /*
+         * FIXME: may need to the platforms memory controller here, but at
+         * the moment we assume that it has already been correctly setup.
+         * The memory controller can also tell us the base address as well.
+         */
+        dev_info(dev, "cs%u: %.32s: type %02x access %u00ps size %uK\n",
+                i, cs->device, region.type, region.access, region.size / 1024);
+        switch (region.type) {
+        case 0:
+                break;
+        case 1:
+                /* static DOC */
+                break;
+        case 2:
+                /* static NOR */
+                pismo_add_nor(pismo, i, &region);
+                break;
+        case 3:
+                /* static RAM */
+                pismo_add_sram(pismo, i, &region);
+                break;
+        }
+}
+static int __devexit pismo_remove(struct i2c_client *client)
+{
+        struct pismo_data *pismo = i2c_get_clientdata(client);
+        int i;
+        for (i = 0; i < ARRAY_SIZE(pismo->dev); i++)
+                platform_device_unregister(pismo->dev[i]);
+        /* FIXME: set_vpp needs saner arguments */
+        pismo_setvpp_remove_fix(pismo);
+        kfree(pismo);
+        return 0;
+}
+static int __devinit pismo_probe(struct i2c_client *client,
+                                 const struct i2c_device_id *id)
+{
+        struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent);
+        struct pismo_pdata *pdata = client->dev.platform_data;
+        struct pismo_eeprom eeprom;
+        struct pismo_data *pismo;
+        int ret, i;
+        if (!i2c_check_functionality(adapter, I2C_FUNC_I2C)) {
+                dev_err(&client->dev, "functionality mismatch\n");
+                return -EIO;
+        }
+        pismo = kzalloc(sizeof(*pismo), GFP_KERNEL);
+        if (!pismo)
+                return -ENOMEM;
+        /* FIXME: set_vpp needs saner arguments */
+        ret = pismo_setvpp_probe_fix(pismo);
+        if (ret)
+                return ret;
+        pismo->client = client;
+        if (pdata) {
+                pismo->vpp = pdata->set_vpp;
+                pismo->vpp_data = pdata->vpp_data;
+        }
+        i2c_set_clientdata(client, pismo);
+        ret = pismo_eeprom_read(client, &eeprom, 0, sizeof(eeprom));
+        if (ret < 0) {
+                dev_err(&client->dev, "error reading EEPROM: %d\n", ret);
+                return ret;
+        }
+        dev_info(&client->dev, "%.15s board found\n", eeprom.board);
+        for (i = 0; i < ARRAY_SIZE(eeprom.cs); i++)
+                if (eeprom.cs[i].type != 0xff)
+                        pismo_add_one(pismo, i, &eeprom.cs[i],
+                                      pdata->cs_addrs[i]);
+        return 0;
+}
+static const struct i2c_device_id pismo_id[] = {
+        { "pismo" },
+        { },
+};
+MODULE_DEVICE_TABLE(i2c, pismo_id);
+static struct i2c_driver pismo_driver = {
+        .driver = {
+                .name   = "pismo",
+                .owner  = THIS_MODULE,
+        },
+        .probe          = pismo_probe,
+        .remove         = __devexit_p(pismo_remove),
+        .id_table       = pismo_id,
+};
+static int __init pismo_init(void)
+{
+        BUILD_BUG_ON(sizeof(struct pismo_cs_block) != 48);
+        BUILD_BUG_ON(sizeof(struct pismo_eeprom) != 256);
+        return i2c_add_driver(&pismo_driver);
+}
+module_init(pismo_init);
+static void __exit pismo_exit(void)
+{
+        i2c_del_driver(&pismo_driver);
+}
+module_exit(pismo_exit);
+MODULE_AUTHOR("Russell King <linux@arm.linux.org.uk>");
+MODULE_DESCRIPTION("PISMO memory driver");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/maps/plat-ram.c b/drivers/mtd/maps/plat-ram.c
index dafb91944e70..76a76be5a7bd 100644
--- a/drivers/mtd/maps/plat-ram.c
+++ b/drivers/mtd/maps/plat-ram.c
@@ -4,7 +4,7 @@
 *      http://www.simtec.co.uk/products/SWLINUX/
 *      Ben Dooks <ben@simtec.co.uk>
 *
- * Generic platfrom device based RAM map
+ * Generic platform device based RAM map
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c
index c8fd8da4bc87..acb13fa5001c 100644
--- a/drivers/mtd/maps/pmcmsp-flash.c
+++ b/drivers/mtd/maps/pmcmsp-flash.c
@@ -28,6 +28,7 @@
 *  675 Mass Ave, Cambridge, MA 02139, USA.
 */
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
diff --git a/drivers/mtd/maps/pxa2xx-flash.c b/drivers/mtd/maps/pxa2xx-flash.c
index 74fa075c838a..91dc6331053f 100644
--- a/drivers/mtd/maps/pxa2xx-flash.c
+++ b/drivers/mtd/maps/pxa2xx-flash.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/init.h>
 #include <linux/platform_device.h>
@@ -20,14 +21,23 @@
 #include <asm/io.h>
 #include <mach/hardware.h>
-#include <asm/cacheflush.h>
 #include <asm/mach/flash.h>
+#define CACHELINESIZE   32
 static void pxa2xx_map_inval_cache(struct map_info *map, unsigned long from,
                                      ssize_t len)
 {
-        flush_ioremap_region(map->phys, map->cached, from, len);
+        unsigned long start = (unsigned long)map->cached + from;
+        unsigned long end = start + len;
+        start &= ~(CACHELINESIZE - 1);
+        while (start < end) {
+                /* invalidate D cache line */
+                asm volatile ("mcr p15, 0, %0, c7, c6, 1" : : "r" (start));
+                start += CACHELINESIZE;
+        }
 }
 struct pxa2xx_flash_info {
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index d7a47574d21e..f3af87e08ecd 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -248,7 +248,7 @@ static void sa1100_destroy(struct sa_info *info, struct flash_platform_data *pla
                plat->exit();
 }
-static struct sa_info *__init
+static struct sa_info *__devinit
 sa1100_setup_mtd(struct platform_device *pdev, struct flash_platform_data *plat)
 {
        struct sa_info *info;
diff --git a/drivers/mtd/maps/sbc_gxx.c b/drivers/mtd/maps/sbc_gxx.c
index 1b1c0b7e11ef..04b2781fc627 100644
--- a/drivers/mtd/maps/sbc_gxx.c
+++ b/drivers/mtd/maps/sbc_gxx.c
@@ -45,7 +45,6 @@ separate MTD devices.
 // Includes
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <asm/io.h>
diff --git a/drivers/mtd/maps/sun_uflash.c b/drivers/mtd/maps/sun_uflash.c
index fd7a1017399a..fadc4c45b455 100644
--- a/drivers/mtd/maps/sun_uflash.c
+++ b/drivers/mtd/maps/sun_uflash.c
@@ -15,6 +15,7 @@
 #include <linux/ioport.h>
 #include <linux/of.h>
 #include <linux/of_device.h>
+#include <linux/slab.h>
 #include <asm/prom.h>
 #include <asm/uaccess.h>
 #include <asm/io.h>
diff --git a/drivers/mtd/maps/vmax301.c b/drivers/mtd/maps/vmax301.c
index 6d452dcdfe34..6adaa6acc193 100644
--- a/drivers/mtd/maps/vmax301.c
+++ b/drivers/mtd/maps/vmax301.c
@@ -16,7 +16,6 @@
   ##################################################################### */
 #include <linux/module.h>
-#include <linux/slab.h>
 #include <linux/ioport.h>
 #include <linux/init.h>
 #include <linux/spinlock.h>
diff --git a/drivers/mtd/maps/vmu-flash.c b/drivers/mtd/maps/vmu-flash.c
index 1f73297e7776..4afc167731ef 100644
--- a/drivers/mtd/maps/vmu-flash.c
+++ b/drivers/mtd/maps/vmu-flash.c
@@ -8,6 +8,7 @@
 * GNU General Public Licence
 */
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/delay.h>
 #include <linux/maple.h>
@@ -612,16 +613,15 @@ static int __devinit vmu_connect(struct maple_device *mdev)
        test_flash_data = be32_to_cpu(mdev->devinfo.function);
        /* Need to count how many bits are set - to find out which
-         * function_data element has details of the memory card:
+         * function_data element has details of the memory card
-         * using Brian Kernighan's/Peter Wegner's method */
+         */
-        for (c = 0; test_flash_data; c++)
+        c = hweight_long(test_flash_data);
-                test_flash_data &= test_flash_data - 1;
        basic_flash_data = be32_to_cpu(mdev->devinfo.function_data[c - 1]);
        card = kmalloc(sizeof(struct memcard), GFP_KERNEL);
        if (!card) {
-                error = ENOMEM;
+                error = -ENOMEM;
                goto fail_nomem;
        }
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index 8ca17a3e96ea..c82e09bbc5fd 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -59,12 +59,14 @@ static int do_blktrans_request(struct mtd_blktrans_ops *tr,
                for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                        if (tr->readsect(dev, block, buf))
                                return -EIO;
+                rq_flush_dcache_pages(req);
                return 0;
        case WRITE:
                if (!tr->writesect)
                        return -EIO;
+                rq_flush_dcache_pages(req);
                for (; nsect > 0; nsect--, block++, buf += tr->blksize)
                        if (tr->writesect(dev, block, buf))
                                return -EIO;
@@ -82,9 +84,6 @@ static int mtd_blktrans_thread(void *arg)
        struct request_queue *rq = tr->blkcore_priv->rq;
        struct request *req = NULL;
-        /* we might get involved when memory gets low, so use PF_MEMALLOC */
-        current->flags |= PF_MEMALLOC;
        spin_lock_irq(rq->queue_lock);
        while (!kthread_should_stop()) {
@@ -379,7 +378,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
        tr->blkcore_priv->thread = kthread_run(mtd_blktrans_thread, tr,
                        "%sd", tr->name);
        if (IS_ERR(tr->blkcore_priv->thread)) {
-                int ret = PTR_ERR(tr->blkcore_priv->thread);
+                ret = PTR_ERR(tr->blkcore_priv->thread);
                blk_cleanup_queue(tr->blkcore_priv->rq);
                unregister_blkdev(tr->major, tr->name);
                kfree(tr->blkcore_priv);
diff --git a/drivers/mtd/mtdbdi.c b/drivers/mtd/mtdbdi.c
deleted file mode 100644
index 5ca5aed0b225..000000000000
--- a/drivers/mtd/mtdbdi.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/* MTD backing device capabilities
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-#include <linux/backing-dev.h>
-#include <linux/mtd/mtd.h>
-#include "internal.h"
-/*
- * backing device capabilities for non-mappable devices (such as NAND flash)
- * - permits private mappings, copies are taken of the data
- */
-struct backing_dev_info mtd_bdi_unmappable = {
-        .capabilities   = BDI_CAP_MAP_COPY,
-};
-/*
- * backing device capabilities for R/O mappable devices (such as ROM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_ro_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
-};
-/*
- * backing device capabilities for writable mappable devices (such as RAM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_rw_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
-                           BDI_CAP_WRITE_MAP),
-};
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 467a4f177bfb..b177e750efc3 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -2,12 +2,14 @@
 * Core registration and callback routines for MTD
 * drivers and users.
 *
+ * bdi bits are:
+ * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
 */
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/ptrace.h>
-#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/major.h>
@@ -17,11 +19,39 @@
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
 #include <linux/proc_fs.h>
+#include <linux/backing-dev.h>
 #include <linux/mtd/mtd.h>
-#include "internal.h"
 #include "mtdcore.h"
+/*
+ * backing device capabilities for non-mappable devices (such as NAND flash)
+ * - permits private mappings, copies are taken of the data
+ */
+struct backing_dev_info mtd_bdi_unmappable = {
+        .capabilities   = BDI_CAP_MAP_COPY,
+};
+/*
+ * backing device capabilities for R/O mappable devices (such as ROM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_ro_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
+};
+/*
+ * backing device capabilities for writable mappable devices (such as RAM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_rw_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
+                           BDI_CAP_WRITE_MAP),
+};
 static int mtd_cls_suspend(struct device *dev, pm_message_t state);
 static int mtd_cls_resume(struct device *dev);
@@ -447,7 +477,7 @@ struct mtd_info *get_mtd_device(struct mtd_info *mtd, int num)
                for (i=0; i< MAX_MTD_DEVICES; i++)
                        if (mtd_table[i] == mtd)
                                ret = mtd_table[i];
-        } else if (num < MAX_MTD_DEVICES) {
+        } else if (num >= 0 && num < MAX_MTD_DEVICES) {
                ret = mtd_table[num];
                if (mtd && mtd != ret)
                        ret = NULL;
@@ -629,20 +659,55 @@ done:
 /*====================================================================*/
 /* Init code */
+static int __init mtd_bdi_init(struct backing_dev_info *bdi, const char *name)
+{
+        int ret;
+        ret = bdi_init(bdi);
+        if (!ret)
+                ret = bdi_register(bdi, NULL, name);
+        if (ret)
+                bdi_destroy(bdi);
+        return ret;
+}
 static int __init init_mtd(void)
 {
        int ret;
        ret = class_register(&mtd_class);
+        if (ret)
+                goto err_reg;
+        ret = mtd_bdi_init(&mtd_bdi_unmappable, "mtd-unmap");
+        if (ret)
+                goto err_bdi1;
+        ret = mtd_bdi_init(&mtd_bdi_ro_mappable, "mtd-romap");
+        if (ret)
+                goto err_bdi2;
+        ret = mtd_bdi_init(&mtd_bdi_rw_mappable, "mtd-rwmap");
+        if (ret)
+                goto err_bdi3;
-        if (ret) {
-                pr_err("Error registering mtd class: %d\n", ret);
-                return ret;
-        }
 #ifdef CONFIG_PROC_FS
        if ((proc_mtd = create_proc_entry( "mtd", 0, NULL )))
                proc_mtd->read_proc = mtd_read_proc;
 #endif /* CONFIG_PROC_FS */
        return 0;
+err_bdi3:
+        bdi_destroy(&mtd_bdi_ro_mappable);
+err_bdi2:
+        bdi_destroy(&mtd_bdi_unmappable);
+err_bdi1:
+        class_unregister(&mtd_class);
+err_reg:
+        pr_err("Error registering mtd class or bdi: %d\n", ret);
+        return ret;
 }
 static void __exit cleanup_mtd(void)
@@ -652,6 +717,9 @@ static void __exit cleanup_mtd(void)
                remove_proc_entry( "mtd", NULL);
 #endif /* CONFIG_PROC_FS */
        class_unregister(&mtd_class);
+        bdi_destroy(&mtd_bdi_unmappable);
+        bdi_destroy(&mtd_bdi_ro_mappable);
+        bdi_destroy(&mtd_bdi_rw_mappable);
 }
 module_init(init_mtd);
diff --git a/drivers/mtd/mtdoops.c b/drivers/mtd/mtdoops.c
index 1060337c06df..92e12df0917f 100644
--- a/drivers/mtd/mtdoops.c
+++ b/drivers/mtd/mtdoops.c
@@ -29,14 +29,34 @@
 #include <linux/sched.h>
 #include <linux/wait.h>
 #include <linux/delay.h>
-#include <linux/spinlock.h>
 #include <linux/interrupt.h>
 #include <linux/mtd/mtd.h>
+#include <linux/kmsg_dump.h>
+/* Maximum MTD partition size */
+#define MTDOOPS_MAX_MTD_SIZE (8 * 1024 * 1024)
 #define MTDOOPS_KERNMSG_MAGIC 0x5d005d00
-#define OOPS_PAGE_SIZE 4096
+#define MTDOOPS_HEADER_SIZE   8
+static unsigned long record_size = 4096;
+module_param(record_size, ulong, 0400);
+MODULE_PARM_DESC(record_size,
+                "record size for MTD OOPS pages in bytes (default 4096)");
+static char mtddev[80];
+module_param_string(mtddev, mtddev, 80, 0400);
+MODULE_PARM_DESC(mtddev,
+                "name or index number of the MTD device to use");
+static int dump_oops = 1;
+module_param(dump_oops, int, 0600);
+MODULE_PARM_DESC(dump_oops,
+                "set to 1 to dump oopses, 0 to only dump panics (default 1)");
 static struct mtdoops_context {
+        struct kmsg_dumper dump;
        int mtd_index;
        struct work_struct work_erase;
        struct work_struct work_write;
@@ -44,28 +64,43 @@ static struct mtdoops_context {
        int oops_pages;
        int nextpage;
        int nextcount;
-        char *name;
+        unsigned long *oops_page_used;
        void *oops_buf;
-        /* writecount and disabling ready are spin lock protected */
-        spinlock_t writecount_lock;
-        int ready;
-        int writecount;
 } oops_cxt;
+static void mark_page_used(struct mtdoops_context *cxt, int page)
+{
+        set_bit(page, cxt->oops_page_used);
+}
+static void mark_page_unused(struct mtdoops_context *cxt, int page)
+{
+        clear_bit(page, cxt->oops_page_used);
+}
+static int page_is_used(struct mtdoops_context *cxt, int page)
+{
+        return test_bit(page, cxt->oops_page_used);
+}
 static void mtdoops_erase_callback(struct erase_info *done)
 {
        wait_queue_head_t *wait_q = (wait_queue_head_t *)done->priv;
        wake_up(wait_q);
 }
-static int mtdoops_erase_block(struct mtd_info *mtd, int offset)
+static int mtdoops_erase_block(struct mtdoops_context *cxt, int offset)
 {
+        struct mtd_info *mtd = cxt->mtd;
+        u32 start_page_offset = mtd_div_by_eb(offset, mtd) * mtd->erasesize;
+        u32 start_page = start_page_offset / record_size;
+        u32 erase_pages = mtd->erasesize / record_size;
        struct erase_info erase;
        DECLARE_WAITQUEUE(wait, current);
        wait_queue_head_t wait_q;
        int ret;
+        int page;
        init_waitqueue_head(&wait_q);
        erase.mtd = mtd;
@@ -81,25 +116,24 @@ static int mtdoops_erase_block(struct mtd_info *mtd, int offset)
        if (ret) {
                set_current_state(TASK_RUNNING);
                remove_wait_queue(&wait_q, &wait);
-                printk (KERN_WARNING "mtdoops: erase of region [0x%llx, 0x%llx] "
+                printk(KERN_WARNING "mtdoops: erase of region [0x%llx, 0x%llx] on \"%s\" failed\n",
-                                     "on \"%s\" failed\n",
+                       (unsigned long long)erase.addr,
-                        (unsigned long long)erase.addr, (unsigned long long)erase.len, mtd->name);
+                       (unsigned long long)erase.len, mtddev);
                return ret;
        }
        schedule();  /* Wait for erase to finish. */
        remove_wait_queue(&wait_q, &wait);
+        /* Mark pages as unused */
+        for (page = start_page; page < start_page + erase_pages; page++)
+                mark_page_unused(cxt, page);
        return 0;
 }
 static void mtdoops_inc_counter(struct mtdoops_context *cxt)
 {
-        struct mtd_info *mtd = cxt->mtd;
-        size_t retlen;
-        u32 count;
-        int ret;
        cxt->nextpage++;
        if (cxt->nextpage >= cxt->oops_pages)
                cxt->nextpage = 0;
@@ -107,25 +141,13 @@ static void mtdoops_inc_counter(struct mtdoops_context *cxt)
        if (cxt->nextcount == 0xffffffff)
                cxt->nextcount = 0;
-        ret = mtd->read(mtd, cxt->nextpage * OOPS_PAGE_SIZE, 4,
+        if (page_is_used(cxt, cxt->nextpage)) {
-                        &retlen, (u_char *) &count);
-        if ((retlen != 4) || ((ret < 0) && (ret != -EUCLEAN))) {
-                printk(KERN_ERR "mtdoops: Read failure at %d (%td of 4 read)"
-                                ", err %d.\n", cxt->nextpage * OOPS_PAGE_SIZE,
-                                retlen, ret);
                schedule_work(&cxt->work_erase);
                return;
        }
-        /* See if we need to erase the next block */
+        printk(KERN_DEBUG "mtdoops: ready %d, %d (no erase)\n",
-        if (count != 0xffffffff) {
+               cxt->nextpage, cxt->nextcount);
-                schedule_work(&cxt->work_erase);
-                return;
-        }
-        printk(KERN_DEBUG "mtdoops: Ready %d, %d (no erase)\n",
-                        cxt->nextpage, cxt->nextcount);
-        cxt->ready = 1;
 }
 /* Scheduled work - when we can't proceed without erasing a block */
@@ -140,47 +162,47 @@ static void mtdoops_workfunc_erase(struct work_struct *work)
        if (!mtd)
                return;
-        mod = (cxt->nextpage * OOPS_PAGE_SIZE) % mtd->erasesize;
+        mod = (cxt->nextpage * record_size) % mtd->erasesize;
        if (mod != 0) {
-                cxt->nextpage = cxt->nextpage + ((mtd->erasesize - mod) / OOPS_PAGE_SIZE);
+                cxt->nextpage = cxt->nextpage + ((mtd->erasesize - mod) / record_size);
                if (cxt->nextpage >= cxt->oops_pages)
                        cxt->nextpage = 0;
        }
        while (mtd->block_isbad) {
-                ret = mtd->block_isbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+                ret = mtd->block_isbad(mtd, cxt->nextpage * record_size);
                if (!ret)
                        break;
                if (ret < 0) {
-                        printk(KERN_ERR "mtdoops: block_isbad failed, aborting.\n");
+                        printk(KERN_ERR "mtdoops: block_isbad failed, aborting\n");
                        return;
                }
 badblock:
-                printk(KERN_WARNING "mtdoops: Bad block at %08x\n",
+                printk(KERN_WARNING "mtdoops: bad block at %08lx\n",
-                                cxt->nextpage * OOPS_PAGE_SIZE);
+                       cxt->nextpage * record_size);
                i++;
-                cxt->nextpage = cxt->nextpage + (mtd->erasesize / OOPS_PAGE_SIZE);
+                cxt->nextpage = cxt->nextpage + (mtd->erasesize / record_size);
                if (cxt->nextpage >= cxt->oops_pages)
                        cxt->nextpage = 0;
-                if (i == (cxt->oops_pages / (mtd->erasesize / OOPS_PAGE_SIZE))) {
+                if (i == cxt->oops_pages / (mtd->erasesize / record_size)) {
-                        printk(KERN_ERR "mtdoops: All blocks bad!\n");
+                        printk(KERN_ERR "mtdoops: all blocks bad!\n");
                        return;
                }
        }
        for (j = 0, ret = -1; (j < 3) && (ret < 0); j++)
-                ret = mtdoops_erase_block(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+                ret = mtdoops_erase_block(cxt, cxt->nextpage * record_size);
        if (ret >= 0) {
-                printk(KERN_DEBUG "mtdoops: Ready %d, %d \n", cxt->nextpage, cxt->nextcount);
+                printk(KERN_DEBUG "mtdoops: ready %d, %d\n",
-                cxt->ready = 1;
+                       cxt->nextpage, cxt->nextcount);
                return;
        }
-        if (mtd->block_markbad && (ret == -EIO)) {
+        if (mtd->block_markbad && ret == -EIO) {
-                ret = mtd->block_markbad(mtd, cxt->nextpage * OOPS_PAGE_SIZE);
+                ret = mtd->block_markbad(mtd, cxt->nextpage * record_size);
                if (ret < 0) {
-                        printk(KERN_ERR "mtdoops: block_markbad failed, aborting.\n");
+                        printk(KERN_ERR "mtdoops: block_markbad failed, aborting\n");
                        return;
                }
        }
@@ -191,36 +213,37 @@ static void mtdoops_write(struct mtdoops_context *cxt, int panic)
 {
        struct mtd_info *mtd = cxt->mtd;
        size_t retlen;
+        u32 *hdr;
        int ret;
-        if (cxt->writecount < OOPS_PAGE_SIZE)
+        /* Add mtdoops header to the buffer */
-                memset(cxt->oops_buf + cxt->writecount, 0xff,
+        hdr = cxt->oops_buf;
-                                        OOPS_PAGE_SIZE - cxt->writecount);
+        hdr[0] = cxt->nextcount;
+        hdr[1] = MTDOOPS_KERNMSG_MAGIC;
        if (panic)
-                ret = mtd->panic_write(mtd, cxt->nextpage * OOPS_PAGE_SIZE,
+                ret = mtd->panic_write(mtd, cxt->nextpage * record_size,
-                                        OOPS_PAGE_SIZE, &retlen, cxt->oops_buf);
+                                        record_size, &retlen, cxt->oops_buf);
        else
-                ret = mtd->write(mtd, cxt->nextpage * OOPS_PAGE_SIZE,
+                ret = mtd->write(mtd, cxt->nextpage * record_size,
-                                        OOPS_PAGE_SIZE, &retlen, cxt->oops_buf);
+                                        record_size, &retlen, cxt->oops_buf);
-        cxt->writecount = 0;
-        if ((retlen != OOPS_PAGE_SIZE) || (ret < 0))
+        if (retlen != record_size || ret < 0)
-                printk(KERN_ERR "mtdoops: Write failure at %d (%td of %d written), err %d.\n",
+                printk(KERN_ERR "mtdoops: write failure at %ld (%td of %ld written), error %d\n",
-                        cxt->nextpage * OOPS_PAGE_SIZE, retlen, OOPS_PAGE_SIZE, ret);
+                       cxt->nextpage * record_size, retlen, record_size, ret);
+        mark_page_used(cxt, cxt->nextpage);
+        memset(cxt->oops_buf, 0xff, record_size);
        mtdoops_inc_counter(cxt);
 }
 static void mtdoops_workfunc_write(struct work_struct *work)
 {
        struct mtdoops_context *cxt =
                        container_of(work, struct mtdoops_context, work_write);
        mtdoops_write(cxt, 0);
-}                                       
+}
 static void find_next_position(struct mtdoops_context *cxt)
 {
@@ -230,28 +253,33 @@ static void find_next_position(struct mtdoops_context *cxt)
        size_t retlen;
        for (page = 0; page < cxt->oops_pages; page++) {
-                ret = mtd->read(mtd, page * OOPS_PAGE_SIZE, 8, &retlen, (u_char *) &count[0]);
+                /* Assume the page is used */
-                if ((retlen != 8) || ((ret < 0) && (ret != -EUCLEAN))) {
+                mark_page_used(cxt, page);
-                        printk(KERN_ERR "mtdoops: Read failure at %d (%td of 8 read)"
+                ret = mtd->read(mtd, page * record_size, MTDOOPS_HEADER_SIZE,
-                                ", err %d.\n", page * OOPS_PAGE_SIZE, retlen, ret);
+                                &retlen, (u_char *) &count[0]);
+                if (retlen != MTDOOPS_HEADER_SIZE ||
+                                (ret < 0 && ret != -EUCLEAN)) {
+                        printk(KERN_ERR "mtdoops: read failure at %ld (%td of %d read), err %d\n",
+                               page * record_size, retlen,
+                               MTDOOPS_HEADER_SIZE, ret);
                        continue;
                }
-                if (count[1] != MTDOOPS_KERNMSG_MAGIC)
+                if (count[0] == 0xffffffff && count[1] == 0xffffffff)
-                        continue;
+                        mark_page_unused(cxt, page);
                if (count[0] == 0xffffffff)
                        continue;
                if (maxcount == 0xffffffff) {
                        maxcount = count[0];
                        maxpos = page;
-                } else if ((count[0] < 0x40000000) && (maxcount > 0xc0000000)) {
+                } else if (count[0] < 0x40000000 && maxcount > 0xc0000000) {
                        maxcount = count[0];
                        maxpos = page;
-                } else if ((count[0] > maxcount) && (count[0] < 0xc0000000)) {
+                } else if (count[0] > maxcount && count[0] < 0xc0000000) {
                        maxcount = count[0];
                        maxpos = page;
-                } else if ((count[0] > maxcount) && (count[0] > 0xc0000000)
+                } else if (count[0] > maxcount && count[0] > 0xc0000000
-                                        && (maxcount > 0x80000000)) {
+                                        && maxcount > 0x80000000) {
                        maxcount = count[0];
                        maxpos = page;
                }
@@ -269,187 +297,170 @@ static void find_next_position(struct mtdoops_context *cxt)
        mtdoops_inc_counter(cxt);
 }
+static void mtdoops_do_dump(struct kmsg_dumper *dumper,
-static void mtdoops_notify_add(struct mtd_info *mtd)
+                enum kmsg_dump_reason reason, const char *s1, unsigned long l1,
+                const char *s2, unsigned long l2)
 {
-        struct mtdoops_context *cxt = &oops_cxt;
+        struct mtdoops_context *cxt = container_of(dumper,
+                        struct mtdoops_context, dump);
+        unsigned long s1_start, s2_start;
+        unsigned long l1_cpy, l2_cpy;
+        char *dst;
+        /* Only dump oopses if dump_oops is set */
+        if (reason == KMSG_DUMP_OOPS && !dump_oops)
+                return;
-        if (cxt->name && !strcmp(mtd->name, cxt->name))
+        dst = cxt->oops_buf + MTDOOPS_HEADER_SIZE; /* Skip the header */
-                cxt->mtd_index = mtd->index;
+        l2_cpy = min(l2, record_size - MTDOOPS_HEADER_SIZE);
+        l1_cpy = min(l1, record_size - MTDOOPS_HEADER_SIZE - l2_cpy);
-        if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
+        s2_start = l2 - l2_cpy;
-                return;
+        s1_start = l1 - l1_cpy;
-        if (mtd->size < (mtd->erasesize * 2)) {
+        memcpy(dst, s1 + s1_start, l1_cpy);
-                printk(KERN_ERR "MTD partition %d not big enough for mtdoops\n",
+        memcpy(dst + l1_cpy, s2 + s2_start, l2_cpy);
-                                mtd->index);
-                return;
-        }
-        if (mtd->erasesize < OOPS_PAGE_SIZE) {
+        /* Panics must be written immediately */
-                printk(KERN_ERR "Eraseblock size of MTD partition %d too small\n",
+        if (reason != KMSG_DUMP_OOPS) {
-                                mtd->index);
+                if (!cxt->mtd->panic_write)
+                        printk(KERN_ERR "mtdoops: Cannot write from panic without panic_write\n");
+                else
+                        mtdoops_write(cxt, 1);
                return;
        }
-        cxt->mtd = mtd;
+        /* For other cases, schedule work to write it "nicely" */
-        if (mtd->size > INT_MAX)
+        schedule_work(&cxt->work_write);
-                cxt->oops_pages = INT_MAX / OOPS_PAGE_SIZE;
-        else
-                cxt->oops_pages = (int)mtd->size / OOPS_PAGE_SIZE;
-        find_next_position(cxt);
-        printk(KERN_INFO "mtdoops: Attached to MTD device %d\n", mtd->index);
 }
-static void mtdoops_notify_remove(struct mtd_info *mtd)
+static void mtdoops_notify_add(struct mtd_info *mtd)
 {
        struct mtdoops_context *cxt = &oops_cxt;
+        u64 mtdoops_pages = div_u64(mtd->size, record_size);
+        int err;
-        if ((mtd->index != cxt->mtd_index) || cxt->mtd_index < 0)
+        if (!strcmp(mtd->name, mtddev))
-                return;
+                cxt->mtd_index = mtd->index;
-        cxt->mtd = NULL;
-        flush_scheduled_work();
-}
-static void mtdoops_console_sync(void)
-{
-        struct mtdoops_context *cxt = &oops_cxt;
-        struct mtd_info *mtd = cxt->mtd;
-        unsigned long flags;
-        if (!cxt->ready || !mtd || cxt->writecount == 0)
+        if (mtd->index != cxt->mtd_index || cxt->mtd_index < 0)
                return;
-        /* 
+        if (mtd->size < mtd->erasesize * 2) {
-         *  Once ready is 0 and we've held the lock no further writes to the 
+                printk(KERN_ERR "mtdoops: MTD partition %d not big enough for mtdoops\n",
-         *  buffer will happen
+                       mtd->index);
-         */
-        spin_lock_irqsave(&cxt->writecount_lock, flags);
-        if (!cxt->ready) {
-                spin_unlock_irqrestore(&cxt->writecount_lock, flags);
                return;
        }
-        cxt->ready = 0;
+        if (mtd->erasesize < record_size) {
-        spin_unlock_irqrestore(&cxt->writecount_lock, flags);
+                printk(KERN_ERR "mtdoops: eraseblock size of MTD partition %d too small\n",
+                       mtd->index);
-        if (mtd->panic_write && in_interrupt())
-                /* Interrupt context, we're going to panic so try and log */
-                mtdoops_write(cxt, 1);
-        else
-                schedule_work(&cxt->work_write);
-}
-static void
-mtdoops_console_write(struct console *co, const char *s, unsigned int count)
-{
-        struct mtdoops_context *cxt = co->data;
-        struct mtd_info *mtd = cxt->mtd;
-        unsigned long flags;
-        if (!oops_in_progress) {
-                mtdoops_console_sync();
                return;
        }
+        if (mtd->size > MTDOOPS_MAX_MTD_SIZE) {
-        if (!cxt->ready || !mtd)
+                printk(KERN_ERR "mtdoops: mtd%d is too large (limit is %d MiB)\n",
+                       mtd->index, MTDOOPS_MAX_MTD_SIZE / 1024 / 1024);
                return;
+        }
-        /* Locking on writecount ensures sequential writes to the buffer */
+        /* oops_page_used is a bit field */
-        spin_lock_irqsave(&cxt->writecount_lock, flags);
+        cxt->oops_page_used = vmalloc(DIV_ROUND_UP(mtdoops_pages,
+                        BITS_PER_LONG));
-        /* Check ready status didn't change whilst waiting for the lock */
+        if (!cxt->oops_page_used) {
-        if (!cxt->ready) {
+                printk(KERN_ERR "mtdoops: could not allocate page array\n");
-                spin_unlock_irqrestore(&cxt->writecount_lock, flags);
                return;
        }
-        if (cxt->writecount == 0) {
+        cxt->dump.dump = mtdoops_do_dump;
-                u32 *stamp = cxt->oops_buf;
+        err = kmsg_dump_register(&cxt->dump);
-                *stamp++ = cxt->nextcount;
+        if (err) {
-                *stamp = MTDOOPS_KERNMSG_MAGIC;
+                printk(KERN_ERR "mtdoops: registering kmsg dumper failed, error %d\n", err);
-                cxt->writecount = 8;
+                vfree(cxt->oops_page_used);
+                cxt->oops_page_used = NULL;
+                return;
        }
-        if ((count + cxt->writecount) > OOPS_PAGE_SIZE)
+        cxt->mtd = mtd;
-                count = OOPS_PAGE_SIZE - cxt->writecount;
+        cxt->oops_pages = (int)mtd->size / record_size;
+        find_next_position(cxt);
-        memcpy(cxt->oops_buf + cxt->writecount, s, count);
+        printk(KERN_INFO "mtdoops: Attached to MTD device %d\n", mtd->index);
-        cxt->writecount += count;
-        spin_unlock_irqrestore(&cxt->writecount_lock, flags);
-        if (cxt->writecount == OOPS_PAGE_SIZE)
-                mtdoops_console_sync();
 }
-static int __init mtdoops_console_setup(struct console *co, char *options)
+static void mtdoops_notify_remove(struct mtd_info *mtd)
 {
-        struct mtdoops_context *cxt = co->data;
+        struct mtdoops_context *cxt = &oops_cxt;
-        if (cxt->mtd_index != -1 || cxt->name)
+        if (mtd->index != cxt->mtd_index || cxt->mtd_index < 0)
-                return -EBUSY;
+                return;
-        if (options) {
-                cxt->name = kstrdup(options, GFP_KERNEL);
-                return 0;
-        }
-        if (co->index == -1)
-                return -EINVAL;
-        cxt->mtd_index = co->index;
+        if (kmsg_dump_unregister(&cxt->dump) < 0)
-        return 0;
+                printk(KERN_WARNING "mtdoops: could not unregister kmsg_dumper\n");
+        cxt->mtd = NULL;
+        flush_scheduled_work();
 }
 static struct mtd_notifier mtdoops_notifier = {
        .add    = mtdoops_notify_add,
        .remove = mtdoops_notify_remove,
 };
-static struct console mtdoops_console = {
+static int __init mtdoops_init(void)
-        .name           = "ttyMTD",
-        .write          = mtdoops_console_write,
-        .setup          = mtdoops_console_setup,
-        .unblank        = mtdoops_console_sync,
-        .index          = -1,
-        .data           = &oops_cxt,
-};
-static int __init mtdoops_console_init(void)
 {
        struct mtdoops_context *cxt = &oops_cxt;
+        int mtd_index;
+        char *endp;
+        if (strlen(mtddev) == 0) {
+                printk(KERN_ERR "mtdoops: mtd device (mtddev=name/number) must be supplied\n");
+                return -EINVAL;
+        }
+        if ((record_size & 4095) != 0) {
+                printk(KERN_ERR "mtdoops: record_size must be a multiple of 4096\n");
+                return -EINVAL;
+        }
+        if (record_size < 4096) {
+                printk(KERN_ERR "mtdoops: record_size must be over 4096 bytes\n");
+                return -EINVAL;
+        }
+        /* Setup the MTD device to use */
        cxt->mtd_index = -1;
-        cxt->oops_buf = vmalloc(OOPS_PAGE_SIZE);
+        mtd_index = simple_strtoul(mtddev, &endp, 0);
-        spin_lock_init(&cxt->writecount_lock);
+        if (*endp == '\0')
+                cxt->mtd_index = mtd_index;
+        if (cxt->mtd_index > MAX_MTD_DEVICES) {
+                printk(KERN_ERR "mtdoops: invalid mtd device number (%u) given\n",
+                                mtd_index);
+                return -EINVAL;
+        }
+        cxt->oops_buf = vmalloc(record_size);
        if (!cxt->oops_buf) {
-                printk(KERN_ERR "Failed to allocate mtdoops buffer workspace\n");
+                printk(KERN_ERR "mtdoops: failed to allocate buffer workspace\n");
                return -ENOMEM;
        }
+        memset(cxt->oops_buf, 0xff, record_size);
        INIT_WORK(&cxt->work_erase, mtdoops_workfunc_erase);
        INIT_WORK(&cxt->work_write, mtdoops_workfunc_write);
-        register_console(&mtdoops_console);
        register_mtd_user(&mtdoops_notifier);
        return 0;
 }
-static void __exit mtdoops_console_exit(void)
+static void __exit mtdoops_exit(void)
 {
        struct mtdoops_context *cxt = &oops_cxt;
        unregister_mtd_user(&mtdoops_notifier);
-        unregister_console(&mtdoops_console);
-        kfree(cxt->name);
        vfree(cxt->oops_buf);
+        vfree(cxt->oops_page_used);
 }
-subsys_initcall(mtdoops_console_init);
+module_init(mtdoops_init);
-module_exit(mtdoops_console_exit);
+module_exit(mtdoops_exit);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Richard Purdie <rpurdie@openedhand.com>");
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index af8b42e0a55b..7c003191fca4 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -13,6 +13,7 @@
 #include <linux/mtd/super.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 /*
 * compare superblocks to see if they're equivalent
@@ -44,6 +45,7 @@ static int get_sb_mtd_set(struct super_block *sb, void *_mtd)
        sb->s_mtd = mtd;
        sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
+        sb->s_bdi = mtd->backing_dev_info;
        return 0;
 }
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 2fda0b615246..42e5ea49e975 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/nand/Kconfig
 menuconfig MTD_NAND
        tristate "NAND Device Support"
        depends on MTD
@@ -203,6 +201,22 @@ config MTD_NAND_S3C2410_CLKSTOP
          when the is NAND chip selected or released, but will save
          approximately 5mA of power when there is nothing happening.
+config MTD_NAND_BCM_UMI
+        tristate "NAND Flash support for BCM Reference Boards"
+        depends on ARCH_BCMRING && MTD_NAND
+        help
+          This enables the NAND flash controller on the BCM UMI block.
+          No board specfic support is done by this driver, each board
+          must advertise a platform_device for the driver to attach.
+config MTD_NAND_BCM_UMI_HWCS
+        bool "BCM UMI NAND Hardware CS"
+        depends on MTD_NAND_BCM_UMI
+        help
+          Enable the use of the BCM UMI block's internal CS using NAND.
+          This should only be used if you know the external NAND CS can toggle.
 config MTD_NAND_DISKONCHIP
        tristate "DiskOnChip 2000, Millennium and Millennium Plus (NAND reimplementation) (EXPERIMENTAL)"
        depends on EXPERIMENTAL
@@ -277,14 +291,6 @@ config MTD_NAND_SHARPSL
        tristate "Support for NAND Flash on Sharp SL Series (C7xx + others)"
        depends on ARCH_PXA
-config MTD_NAND_BASLER_EXCITE
-        tristate  "Support for NAND Flash on Basler eXcite"
-        depends on BASLER_EXCITE
-        help
-          This enables the driver for the NAND flash device found on the
-          Basler eXcite Smart Camera. If built as a module, the driver
-          will be named excite_nandflash.
 config MTD_NAND_CAFE
        tristate "NAND support for OLPC CAFÉ chip"
        depends on PCI
@@ -358,7 +364,7 @@ endchoice
 config MTD_NAND_PXA3xx
        tristate "Support for NAND flash devices on PXA3xx"
-        depends on MTD_NAND && PXA3xx
+        depends on MTD_NAND && (PXA3xx || ARCH_MMP)
        help
          This enables the driver for the NAND flash device found on
          PXA3xx processors
@@ -438,7 +444,7 @@ config MTD_NAND_FSL_UPM
 config MTD_NAND_MXC
        tristate "MXC NAND support"
-        depends on ARCH_MX2 || ARCH_MX3
+        depends on ARCH_MX2 || ARCH_MX25 || ARCH_MX3
        help
          This enables the driver for the NAND flash controller on the
          MXC processors.
@@ -451,10 +457,10 @@ config MTD_NAND_NOMADIK
 config MTD_NAND_SH_FLCTL
        tristate "Support for NAND on Renesas SuperH FLCTL"
-        depends on MTD_NAND && SUPERH && CPU_SUBTYPE_SH7723
+        depends on MTD_NAND && (SUPERH || ARCH_SHMOBILE)
        help
          Several Renesas SuperH CPU has FLCTL. This option enables support
-          for NAND Flash using FLCTL. This driver support SH7723.
+          for NAND Flash using FLCTL.
 config MTD_NAND_DAVINCI
        tristate "Support NAND on DaVinci SoC"
diff --git a/drivers/mtd/nand/Makefile b/drivers/mtd/nand/Makefile
index 6950d3dabf10..1407bd144015 100644
--- a/drivers/mtd/nand/Makefile
+++ b/drivers/mtd/nand/Makefile
@@ -27,7 +27,6 @@ obj-$(CONFIG_MTD_NAND_ATMEL)		+= atmel_nand.o
 obj-$(CONFIG_MTD_NAND_GPIO)             += gpio.o
 obj-$(CONFIG_MTD_NAND_OMAP2)            += omap2.o
 obj-$(CONFIG_MTD_NAND_CM_X270)          += cmx270_nand.o
-obj-$(CONFIG_MTD_NAND_BASLER_EXCITE)    += excite_nandflash.o
 obj-$(CONFIG_MTD_NAND_PXA3xx)           += pxa3xx_nand.o
 obj-$(CONFIG_MTD_NAND_TMIO)             += tmio_nand.o
 obj-$(CONFIG_MTD_NAND_PLATFORM)         += plat_nand.o
@@ -42,5 +41,6 @@ obj-$(CONFIG_MTD_NAND_SOCRATES)		+= socrates_nand.o
 obj-$(CONFIG_MTD_NAND_TXX9NDFMC)        += txx9ndfmc.o
 obj-$(CONFIG_MTD_NAND_W90P910)          += w90p910_nand.o
 obj-$(CONFIG_MTD_NAND_NOMADIK)          += nomadik_nand.o
+obj-$(CONFIG_MTD_NAND_BCM_UMI)          += bcm_umi_nand.o nand_bcm_umi.o
 nand-objs := nand_base.o nand_bbt.o
diff --git a/drivers/mtd/nand/alauda.c b/drivers/mtd/nand/alauda.c
index 6d9649159a18..2d6773281fd9 100644
--- a/drivers/mtd/nand/alauda.c
+++ b/drivers/mtd/nand/alauda.c
@@ -372,15 +372,6 @@ static int alauda_read_oob(struct mtd_info *mtd, loff_t from, void *oob)
        return __alauda_read_page(mtd, from, ignore_buf, oob);
 }
-static int popcount8(u8 c)
-{
-        int ret = 0;
-        for ( ; c; c>>=1)
-                ret += c & 1;
-        return ret;
-}
 static int alauda_isbad(struct mtd_info *mtd, loff_t ofs)
 {
        u8 oob[16];
@@ -391,7 +382,7 @@ static int alauda_isbad(struct mtd_info *mtd, loff_t ofs)
                return err;
        /* A block is marked bad if two or more bits are zero */
-        return popcount8(oob[5]) >= 7 ? 0 : 1;
+        return hweight8(oob[5]) >= 7 ? 0 : 1;
 }
 static int alauda_bounce_read(struct mtd_info *mtd, loff_t from, size_t len,
diff --git a/drivers/mtd/nand/ams-delta.c b/drivers/mtd/nand/ams-delta.c
index 005b91f096f2..2548e1065bf8 100644
--- a/drivers/mtd/nand/ams-delta.c
+++ b/drivers/mtd/nand/ams-delta.c
@@ -25,7 +25,7 @@
 #include <mach/hardware.h>
 #include <asm/sizes.h>
 #include <mach/gpio.h>
-#include <mach/board-ams-delta.h>
+#include <plat/board-ams-delta.h>
 /*
 * MTD structure for E3 (Delta)
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index f8e9975c86e5..524e6c9e0672 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -192,7 +192,6 @@ static int atmel_nand_calculate(struct mtd_info *mtd,
 {
        struct nand_chip *nand_chip = mtd->priv;
        struct atmel_nand_host *host = nand_chip->priv;
-        uint32_t *eccpos = nand_chip->ecc.layout->eccpos;
        unsigned int ecc_value;
        /* get the first 2 ECC bytes */
@@ -464,7 +463,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
        if (host->board->det_pin) {
                if (gpio_get_value(host->board->det_pin)) {
                        printk(KERN_INFO "No SmartMedia card inserted.\n");
-                        res = ENXIO;
+                        res = -ENXIO;
                        goto err_no_card;
                }
        }
@@ -535,7 +534,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
        if ((!partitions) || (num_partitions == 0)) {
                printk(KERN_ERR "atmel_nand: No partitions defined, or unsupported device.\n");
-                res = ENXIO;
+                res = -ENXIO;
                goto err_no_partitions;
        }
diff --git a/drivers/mtd/nand/au1550nd.c b/drivers/mtd/nand/au1550nd.c
index 92c334ff4508..43d46e424040 100644
--- a/drivers/mtd/nand/au1550nd.c
+++ b/drivers/mtd/nand/au1550nd.c
@@ -19,6 +19,7 @@
 #include <asm/io.h>
 #include <asm/mach-au1x00/au1xxx.h>
+#include <asm/mach-db1x00/bcsr.h>
 /*
 * MTD structure for NAND controller
@@ -475,7 +476,8 @@ static int __init au1xxx_nand_init(void)
        /* set gpio206 high */
        au_writel(au_readl(GPIO2_DIR) & ~(1 << 6), GPIO2_DIR);
-        boot_swapboot = (au_readl(MEM_STSTAT) & (0x7 << 1)) | ((bcsr->status >> 6) & 0x1);
+        boot_swapboot = (au_readl(MEM_STSTAT) & (0x7 << 1)) | ((bcsr_read(BCSR_STATUS) >> 6) & 0x1);
        switch (boot_swapboot) {
        case 0:
        case 2:
diff --git a/drivers/mtd/nand/bcm_umi_bch.c b/drivers/mtd/nand/bcm_umi_bch.c
new file mode 100644
index 000000000000..a930666d0687
--- /dev/null
+++ b/drivers/mtd/nand/bcm_umi_bch.c
@@ -0,0 +1,213 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+/* ---- Include Files ---------------------------------------------------- */
+#include "nand_bcm_umi.h"
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+/* ---- Private Function Prototypes -------------------------------------- */
+static int bcm_umi_bch_read_page_hwecc(struct mtd_info *mtd,
+        struct nand_chip *chip, uint8_t *buf, int page);
+static void bcm_umi_bch_write_page_hwecc(struct mtd_info *mtd,
+        struct nand_chip *chip, const uint8_t *buf);
+/* ---- Private Variables ------------------------------------------------ */
+/*
+** nand_hw_eccoob
+** New oob placement block for use with hardware ecc generation.
+*/
+static struct nand_ecclayout nand_hw_eccoob_512 = {
+        /* Reserve 5 for BI indicator */
+        .oobfree = {
+#if (NAND_ECC_NUM_BYTES > 3)
+                    {.offset = 0, .length = 2}
+#else
+                    {.offset = 0, .length = 5},
+                    {.offset = 6, .length = 7}
+#endif
+                    }
+};
+/*
+** We treat the OOB for a 2K page as if it were 4 512 byte oobs,
+** except the BI is at byte 0.
+*/
+static struct nand_ecclayout nand_hw_eccoob_2048 = {
+        /* Reserve 0 as BI indicator */
+        .oobfree = {
+#if (NAND_ECC_NUM_BYTES > 10)
+                    {.offset = 1, .length = 2},
+#elif (NAND_ECC_NUM_BYTES > 7)
+                    {.offset = 1, .length = 5},
+                    {.offset = 16, .length = 6},
+                    {.offset = 32, .length = 6},
+                    {.offset = 48, .length = 6}
+#else
+                    {.offset = 1, .length = 8},
+                    {.offset = 16, .length = 9},
+                    {.offset = 32, .length = 9},
+                    {.offset = 48, .length = 9}
+#endif
+                    }
+};
+/* We treat the OOB for a 4K page as if it were 8 512 byte oobs,
+ * except the BI is at byte 0. */
+static struct nand_ecclayout nand_hw_eccoob_4096 = {
+        /* Reserve 0 as BI indicator */
+        .oobfree = {
+#if (NAND_ECC_NUM_BYTES > 10)
+                    {.offset = 1, .length = 2},
+                    {.offset = 16, .length = 3},
+                    {.offset = 32, .length = 3},
+                    {.offset = 48, .length = 3},
+                    {.offset = 64, .length = 3},
+                    {.offset = 80, .length = 3},
+                    {.offset = 96, .length = 3},
+                    {.offset = 112, .length = 3}
+#else
+                    {.offset = 1, .length = 5},
+                    {.offset = 16, .length = 6},
+                    {.offset = 32, .length = 6},
+                    {.offset = 48, .length = 6},
+                    {.offset = 64, .length = 6},
+                    {.offset = 80, .length = 6},
+                    {.offset = 96, .length = 6},
+                    {.offset = 112, .length = 6}
+#endif
+                    }
+};
+/* ---- Private Functions ------------------------------------------------ */
+/* ==== Public Functions ================================================= */
+/****************************************************************************
+*
+*  bcm_umi_bch_read_page_hwecc - hardware ecc based page read function
+*  @mtd:        mtd info structure
+*  @chip:       nand chip info structure
+*  @buf:        buffer to store read data
+*
+***************************************************************************/
+static int bcm_umi_bch_read_page_hwecc(struct mtd_info *mtd,
+                                       struct nand_chip *chip, uint8_t * buf,
+                                                 int page)
+{
+        int sectorIdx = 0;
+        int eccsize = chip->ecc.size;
+        int eccsteps = chip->ecc.steps;
+        uint8_t *datap = buf;
+        uint8_t eccCalc[NAND_ECC_NUM_BYTES];
+        int sectorOobSize = mtd->oobsize / eccsteps;
+        int stat;
+        for (sectorIdx = 0; sectorIdx < eccsteps;
+                        sectorIdx++, datap += eccsize) {
+                if (sectorIdx > 0) {
+                        /* Seek to page location within sector */
+                        chip->cmdfunc(mtd, NAND_CMD_RNDOUT, sectorIdx * eccsize,
+                                      -1);
+                }
+                /* Enable hardware ECC before reading the buf */
+                nand_bcm_umi_bch_enable_read_hwecc();
+                /* Read in data */
+                bcm_umi_nand_read_buf(mtd, datap, eccsize);
+                /* Pause hardware ECC after reading the buf */
+                nand_bcm_umi_bch_pause_read_ecc_calc();
+                /* Read the OOB ECC */
+                chip->cmdfunc(mtd, NAND_CMD_RNDOUT,
+                              mtd->writesize + sectorIdx * sectorOobSize, -1);
+                nand_bcm_umi_bch_read_oobEcc(mtd->writesize, eccCalc,
+                                             NAND_ECC_NUM_BYTES,
+                                             chip->oob_poi +
+                                             sectorIdx * sectorOobSize);
+                /* Correct any ECC detected errors */
+                stat =
+                    nand_bcm_umi_bch_correct_page(datap, eccCalc,
+                                                  NAND_ECC_NUM_BYTES);
+                /* Update Stats */
+                if (stat < 0) {
+#if defined(NAND_BCM_UMI_DEBUG)
+                        printk(KERN_WARNING "%s uncorr_err sectorIdx=%d\n",
+                               __func__, sectorIdx);
+                        printk(KERN_WARNING
+                               "%s data %02x %02x %02x %02x "
+                                         "%02x %02x %02x %02x\n",
+                               __func__, datap[0], datap[1], datap[2], datap[3],
+                               datap[4], datap[5], datap[6], datap[7]);
+                        printk(KERN_WARNING
+                               "%s ecc  %02x %02x %02x %02x "
+                                         "%02x %02x %02x %02x %02x %02x "
+                                         "%02x %02x %02x\n",
+                               __func__, eccCalc[0], eccCalc[1], eccCalc[2],
+                               eccCalc[3], eccCalc[4], eccCalc[5], eccCalc[6],
+                               eccCalc[7], eccCalc[8], eccCalc[9], eccCalc[10],
+                               eccCalc[11], eccCalc[12]);
+                        BUG();
+#endif
+                        mtd->ecc_stats.failed++;
+                } else {
+#if defined(NAND_BCM_UMI_DEBUG)
+                        if (stat > 0) {
+                                printk(KERN_INFO
+                                       "%s %d correctable_errors detected\n",
+                                       __func__, stat);
+                        }
+#endif
+                        mtd->ecc_stats.corrected += stat;
+                }
+        }
+        return 0;
+}
+/****************************************************************************
+*
+*  bcm_umi_bch_write_page_hwecc - hardware ecc based page write function
+*  @mtd:        mtd info structure
+*  @chip:       nand chip info structure
+*  @buf:        data buffer
+*
+***************************************************************************/
+static void bcm_umi_bch_write_page_hwecc(struct mtd_info *mtd,
+        struct nand_chip *chip, const uint8_t *buf)
+{
+        int sectorIdx = 0;
+        int eccsize = chip->ecc.size;
+        int eccsteps = chip->ecc.steps;
+        const uint8_t *datap = buf;
+        uint8_t *oobp = chip->oob_poi;
+        int sectorOobSize = mtd->oobsize / eccsteps;
+        for (sectorIdx = 0; sectorIdx < eccsteps;
+             sectorIdx++, datap += eccsize, oobp += sectorOobSize) {
+                /* Enable hardware ECC before writing the buf */
+                nand_bcm_umi_bch_enable_write_hwecc();
+                bcm_umi_nand_write_buf(mtd, datap, eccsize);
+                nand_bcm_umi_bch_write_oobEcc(mtd->writesize, oobp,
+                                              NAND_ECC_NUM_BYTES);
+        }
+        bcm_umi_nand_write_buf(mtd, chip->oob_poi, mtd->oobsize);
+}
diff --git a/drivers/mtd/nand/bcm_umi_nand.c b/drivers/mtd/nand/bcm_umi_nand.c
new file mode 100644
index 000000000000..c997f98eeb3d
--- /dev/null
+++ b/drivers/mtd/nand/bcm_umi_nand.c
@@ -0,0 +1,582 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+/* ---- Include Files ---------------------------------------------------- */
+#include <linux/version.h>
+#include <linux/module.h>
+#include <linux/types.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+#include <linux/ioport.h>
+#include <linux/device.h>
+#include <linux/delay.h>
+#include <linux/err.h>
+#include <linux/io.h>
+#include <linux/platform_device.h>
+#include <linux/mtd/mtd.h>
+#include <linux/mtd/nand.h>
+#include <linux/mtd/nand_ecc.h>
+#include <linux/mtd/partitions.h>
+#include <asm/mach-types.h>
+#include <asm/system.h>
+#include <mach/reg_nand.h>
+#include <mach/reg_umi.h>
+#include "nand_bcm_umi.h"
+#include <mach/memory_settings.h>
+#define USE_DMA 1
+#include <mach/dma.h>
+#include <linux/dma-mapping.h>
+#include <linux/completion.h>
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+static const __devinitconst char gBanner[] = KERN_INFO \
+        "BCM UMI MTD NAND Driver: 1.00\n";
+#ifdef CONFIG_MTD_PARTITIONS
+const char *part_probes[] = { "cmdlinepart", NULL };
+#endif
+#if NAND_ECC_BCH
+static uint8_t scan_ff_pattern[] = { 0xff };
+static struct nand_bbt_descr largepage_bbt = {
+        .options = 0,
+        .offs = 0,
+        .len = 1,
+        .pattern = scan_ff_pattern
+};
+#endif
+/*
+** Preallocate a buffer to avoid having to do this every dma operation.
+** This is the size of the preallocated coherent DMA buffer.
+*/
+#if USE_DMA
+#define DMA_MIN_BUFLEN  512
+#define DMA_MAX_BUFLEN  PAGE_SIZE
+#define USE_DIRECT_IO(len)      (((len) < DMA_MIN_BUFLEN) || \
+        ((len) > DMA_MAX_BUFLEN))
+/*
+ * The current NAND data space goes from 0x80001900 to 0x80001FFF,
+ * which is only 0x700 = 1792 bytes long. This is too small for 2K, 4K page
+ * size NAND flash. Need to break the DMA down to multiple 1Ks.
+ *
+ * Need to make sure REG_NAND_DATA_PADDR + DMA_MAX_LEN < 0x80002000
+ */
+#define DMA_MAX_LEN             1024
+#else /* !USE_DMA */
+#define DMA_MIN_BUFLEN          0
+#define DMA_MAX_BUFLEN          0
+#define USE_DIRECT_IO(len)      1
+#endif
+/* ---- Private Function Prototypes -------------------------------------- */
+static void bcm_umi_nand_read_buf(struct mtd_info *mtd, u_char * buf, int len);
+static void bcm_umi_nand_write_buf(struct mtd_info *mtd, const u_char * buf,
+                                   int len);
+/* ---- Private Variables ------------------------------------------------ */
+static struct mtd_info *board_mtd;
+static void __iomem *bcm_umi_io_base;
+static void *virtPtr;
+static dma_addr_t physPtr;
+static struct completion nand_comp;
+/* ---- Private Functions ------------------------------------------------ */
+#if NAND_ECC_BCH
+#include "bcm_umi_bch.c"
+#else
+#include "bcm_umi_hamming.c"
+#endif
+#if USE_DMA
+/* Handler called when the DMA finishes. */
+static void nand_dma_handler(DMA_Device_t dev, int reason, void *userData)
+{
+        complete(&nand_comp);
+}
+static int nand_dma_init(void)
+{
+        int rc;
+        rc = dma_set_device_handler(DMA_DEVICE_NAND_MEM_TO_MEM,
+                nand_dma_handler, NULL);
+        if (rc != 0) {
+                printk(KERN_ERR "dma_set_device_handler failed: %d\n", rc);
+                return rc;
+        }
+        virtPtr =
+            dma_alloc_coherent(NULL, DMA_MAX_BUFLEN, &physPtr, GFP_KERNEL);
+        if (virtPtr == NULL) {
+                printk(KERN_ERR "NAND - Failed to allocate memory for DMA buffer\n");
+                return -ENOMEM;
+        }
+        return 0;
+}
+static void nand_dma_term(void)
+{
+        if (virtPtr != NULL)
+                dma_free_coherent(NULL, DMA_MAX_BUFLEN, virtPtr, physPtr);
+}
+static void nand_dma_read(void *buf, int len)
+{
+        int offset = 0;
+        int tmp_len = 0;
+        int len_left = len;
+        DMA_Handle_t hndl;
+        if (virtPtr == NULL)
+                panic("nand_dma_read: virtPtr == NULL\n");
+        if ((void *)physPtr == NULL)
+                panic("nand_dma_read: physPtr == NULL\n");
+        hndl = dma_request_channel(DMA_DEVICE_NAND_MEM_TO_MEM);
+        if (hndl < 0) {
+                printk(KERN_ERR
+                       "nand_dma_read: unable to allocate dma channel: %d\n",
+                       (int)hndl);
+                panic("\n");
+        }
+        while (len_left > 0) {
+                if (len_left > DMA_MAX_LEN) {
+                        tmp_len = DMA_MAX_LEN;
+                        len_left -= DMA_MAX_LEN;
+                } else {
+                        tmp_len = len_left;
+                        len_left = 0;
+                }
+                init_completion(&nand_comp);
+                dma_transfer_mem_to_mem(hndl, REG_NAND_DATA_PADDR,
+                                        physPtr + offset, tmp_len);
+                wait_for_completion(&nand_comp);
+                offset += tmp_len;
+        }
+        dma_free_channel(hndl);
+        if (buf != NULL)
+                memcpy(buf, virtPtr, len);
+}
+static void nand_dma_write(const void *buf, int len)
+{
+        int offset = 0;
+        int tmp_len = 0;
+        int len_left = len;
+        DMA_Handle_t hndl;
+        if (buf == NULL)
+                panic("nand_dma_write: buf == NULL\n");
+        if (virtPtr == NULL)
+                panic("nand_dma_write: virtPtr == NULL\n");
+        if ((void *)physPtr == NULL)
+                panic("nand_dma_write: physPtr == NULL\n");
+        memcpy(virtPtr, buf, len);
+        hndl = dma_request_channel(DMA_DEVICE_NAND_MEM_TO_MEM);
+        if (hndl < 0) {
+                printk(KERN_ERR
+                       "nand_dma_write: unable to allocate dma channel: %d\n",
+                       (int)hndl);
+                panic("\n");
+        }
+        while (len_left > 0) {
+                if (len_left > DMA_MAX_LEN) {
+                        tmp_len = DMA_MAX_LEN;
+                        len_left -= DMA_MAX_LEN;
+                } else {
+                        tmp_len = len_left;
+                        len_left = 0;
+                }
+                init_completion(&nand_comp);
+                dma_transfer_mem_to_mem(hndl, physPtr + offset,
+                                        REG_NAND_DATA_PADDR, tmp_len);
+                wait_for_completion(&nand_comp);
+                offset += tmp_len;
+        }
+        dma_free_channel(hndl);
+}
+#endif
+static int nand_dev_ready(struct mtd_info *mtd)
+{
+        return nand_bcm_umi_dev_ready();
+}
+/****************************************************************************
+*
+*  bcm_umi_nand_inithw
+*
+*   This routine does the necessary hardware (board-specific)
+*   initializations.  This includes setting up the timings, etc.
+*
+***************************************************************************/
+int bcm_umi_nand_inithw(void)
+{
+        /* Configure nand timing parameters */
+        REG_UMI_NAND_TCR &= ~0x7ffff;
+        REG_UMI_NAND_TCR |= HW_CFG_NAND_TCR;
+#if !defined(CONFIG_MTD_NAND_BCM_UMI_HWCS)
+        /* enable software control of CS */
+        REG_UMI_NAND_TCR |= REG_UMI_NAND_TCR_CS_SWCTRL;
+#endif
+        /* keep NAND chip select asserted */
+        REG_UMI_NAND_RCSR |= REG_UMI_NAND_RCSR_CS_ASSERTED;
+        REG_UMI_NAND_TCR &= ~REG_UMI_NAND_TCR_WORD16;
+        /* enable writes to flash */
+        REG_UMI_MMD_ICR |= REG_UMI_MMD_ICR_FLASH_WP;
+        writel(NAND_CMD_RESET, bcm_umi_io_base + REG_NAND_CMD_OFFSET);
+        nand_bcm_umi_wait_till_ready();
+#if NAND_ECC_BCH
+        nand_bcm_umi_bch_config_ecc(NAND_ECC_NUM_BYTES);
+#endif
+        return 0;
+}
+/* Used to turn latch the proper register for access. */
+static void bcm_umi_nand_hwcontrol(struct mtd_info *mtd, int cmd,
+                                   unsigned int ctrl)
+{
+        /* send command to hardware */
+        struct nand_chip *chip = mtd->priv;
+        if (ctrl & NAND_CTRL_CHANGE) {
+                if (ctrl & NAND_CLE) {
+                        chip->IO_ADDR_W = bcm_umi_io_base + REG_NAND_CMD_OFFSET;
+                        goto CMD;
+                }
+                if (ctrl & NAND_ALE) {
+                        chip->IO_ADDR_W =
+                            bcm_umi_io_base + REG_NAND_ADDR_OFFSET;
+                        goto CMD;
+                }
+                chip->IO_ADDR_W = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+        }
+CMD:
+        /* Send command to chip directly */
+        if (cmd != NAND_CMD_NONE)
+                writeb(cmd, chip->IO_ADDR_W);
+}
+static void bcm_umi_nand_write_buf(struct mtd_info *mtd, const u_char * buf,
+                                   int len)
+{
+        if (USE_DIRECT_IO(len)) {
+                /* Do it the old way if the buffer is small or too large.
+                 * Probably quicker than starting and checking dma. */
+                int i;
+                struct nand_chip *this = mtd->priv;
+                for (i = 0; i < len; i++)
+                        writeb(buf[i], this->IO_ADDR_W);
+        }
+#if USE_DMA
+        else
+                nand_dma_write(buf, len);
+#endif
+}
+static void bcm_umi_nand_read_buf(struct mtd_info *mtd, u_char * buf, int len)
+{
+        if (USE_DIRECT_IO(len)) {
+                int i;
+                struct nand_chip *this = mtd->priv;
+                for (i = 0; i < len; i++)
+                        buf[i] = readb(this->IO_ADDR_R);
+        }
+#if USE_DMA
+        else
+                nand_dma_read(buf, len);
+#endif
+}
+static uint8_t readbackbuf[NAND_MAX_PAGESIZE];
+static int bcm_umi_nand_verify_buf(struct mtd_info *mtd, const u_char * buf,
+                                   int len)
+{
+        /*
+         * Try to readback page with ECC correction. This is necessary
+         * for MLC parts which may have permanently stuck bits.
+         */
+        struct nand_chip *chip = mtd->priv;
+        int ret = chip->ecc.read_page(mtd, chip, readbackbuf, 0);
+        if (ret < 0)
+                return -EFAULT;
+        else {
+                if (memcmp(readbackbuf, buf, len) == 0)
+                        return 0;
+                return -EFAULT;
+        }
+        return 0;
+}
+static int __devinit bcm_umi_nand_probe(struct platform_device *pdev)
+{
+        struct nand_chip *this;
+        struct resource *r;
+        int err = 0;
+        printk(gBanner);
+        /* Allocate memory for MTD device structure and private data */
+        board_mtd =
+            kmalloc(sizeof(struct mtd_info) + sizeof(struct nand_chip),
+                    GFP_KERNEL);
+        if (!board_mtd) {
+                printk(KERN_WARNING
+                       "Unable to allocate NAND MTD device structure.\n");
+                return -ENOMEM;
+        }
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!r)
+                return -ENXIO;
+        /* map physical address */
+        bcm_umi_io_base = ioremap(r->start, r->end - r->start + 1);
+        if (!bcm_umi_io_base) {
+                printk(KERN_ERR "ioremap to access BCM UMI NAND chip failed\n");
+                kfree(board_mtd);
+                return -EIO;
+        }
+        /* Get pointer to private data */
+        this = (struct nand_chip *)(&board_mtd[1]);
+        /* Initialize structures */
+        memset((char *)board_mtd, 0, sizeof(struct mtd_info));
+        memset((char *)this, 0, sizeof(struct nand_chip));
+        /* Link the private data with the MTD structure */
+        board_mtd->priv = this;
+        /* Initialize the NAND hardware.  */
+        if (bcm_umi_nand_inithw() < 0) {
+                printk(KERN_ERR "BCM UMI NAND chip could not be initialized\n");
+                iounmap(bcm_umi_io_base);
+                kfree(board_mtd);
+                return -EIO;
+        }
+        /* Set address of NAND IO lines */
+        this->IO_ADDR_W = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+        this->IO_ADDR_R = bcm_umi_io_base + REG_NAND_DATA8_OFFSET;
+        /* Set command delay time, see datasheet for correct value */
+        this->chip_delay = 0;
+        /* Assign the device ready function, if available */
+        this->dev_ready = nand_dev_ready;
+        this->options = 0;
+        this->write_buf = bcm_umi_nand_write_buf;
+        this->read_buf = bcm_umi_nand_read_buf;
+        this->verify_buf = bcm_umi_nand_verify_buf;
+        this->cmd_ctrl = bcm_umi_nand_hwcontrol;
+        this->ecc.mode = NAND_ECC_HW;
+        this->ecc.size = 512;
+        this->ecc.bytes = NAND_ECC_NUM_BYTES;
+#if NAND_ECC_BCH
+        this->ecc.read_page = bcm_umi_bch_read_page_hwecc;
+        this->ecc.write_page = bcm_umi_bch_write_page_hwecc;
+#else
+        this->ecc.correct = nand_correct_data512;
+        this->ecc.calculate = bcm_umi_hamming_get_hw_ecc;
+        this->ecc.hwctl = bcm_umi_hamming_enable_hwecc;
+#endif
+#if USE_DMA
+        err = nand_dma_init();
+        if (err != 0)
+                return err;
+#endif
+        /* Figure out the size of the device that we have.
+         * We need to do this to figure out which ECC
+         * layout we'll be using.
+         */
+        err = nand_scan_ident(board_mtd, 1);
+        if (err) {
+                printk(KERN_ERR "nand_scan failed: %d\n", err);
+                iounmap(bcm_umi_io_base);
+                kfree(board_mtd);
+                return err;
+        }
+        /* Now that we know the nand size, we can setup the ECC layout */
+        switch (board_mtd->writesize) { /* writesize is the pagesize */
+        case 4096:
+                this->ecc.layout = &nand_hw_eccoob_4096;
+                break;
+        case 2048:
+                this->ecc.layout = &nand_hw_eccoob_2048;
+                break;
+        case 512:
+                this->ecc.layout = &nand_hw_eccoob_512;
+                break;
+        default:
+                {
+                        printk(KERN_ERR "NAND - Unrecognized pagesize: %d\n",
+                                         board_mtd->writesize);
+                        return -EINVAL;
+                }
+        }
+#if NAND_ECC_BCH
+        if (board_mtd->writesize > 512) {
+                if (this->options & NAND_USE_FLASH_BBT)
+                        largepage_bbt.options = NAND_BBT_SCAN2NDPAGE;
+                this->badblock_pattern = &largepage_bbt;
+        }
+#endif
+        /* Now finish off the scan, now that ecc.layout has been initialized. */
+        err = nand_scan_tail(board_mtd);
+        if (err) {
+                printk(KERN_ERR "nand_scan failed: %d\n", err);
+                iounmap(bcm_umi_io_base);
+                kfree(board_mtd);
+                return err;
+        }
+        /* Register the partitions */
+        {
+                int nr_partitions;
+                struct mtd_partition *partition_info;
+                board_mtd->name = "bcm_umi-nand";
+                nr_partitions =
+                    parse_mtd_partitions(board_mtd, part_probes,
+                                         &partition_info, 0);
+                if (nr_partitions <= 0) {
+                        printk(KERN_ERR "BCM UMI NAND: Too few partitions - %d\n",
+                               nr_partitions);
+                        iounmap(bcm_umi_io_base);
+                        kfree(board_mtd);
+                        return -EIO;
+                }
+                add_mtd_partitions(board_mtd, partition_info, nr_partitions);
+        }
+        /* Return happy */
+        return 0;
+}
+static int bcm_umi_nand_remove(struct platform_device *pdev)
+{
+#if USE_DMA
+        nand_dma_term();
+#endif
+        /* Release resources, unregister device */
+        nand_release(board_mtd);
+        /* unmap physical address */
+        iounmap(bcm_umi_io_base);
+        /* Free the MTD device structure */
+        kfree(board_mtd);
+        return 0;
+}
+#ifdef CONFIG_PM
+static int bcm_umi_nand_suspend(struct platform_device *pdev,
+                                pm_message_t state)
+{
+        printk(KERN_ERR "MTD NAND suspend is being called\n");
+        return 0;
+}
+static int bcm_umi_nand_resume(struct platform_device *pdev)
+{
+        printk(KERN_ERR "MTD NAND resume is being called\n");
+        return 0;
+}
+#else
+#define bcm_umi_nand_suspend   NULL
+#define bcm_umi_nand_resume    NULL
+#endif
+static struct platform_driver nand_driver = {
+        .driver = {
+                   .name = "bcm-nand",
+                   .owner = THIS_MODULE,
+                   },
+        .probe = bcm_umi_nand_probe,
+        .remove = bcm_umi_nand_remove,
+        .suspend = bcm_umi_nand_suspend,
+        .resume = bcm_umi_nand_resume,
+};
+static int __init nand_init(void)
+{
+        return platform_driver_register(&nand_driver);
+}
+static void __exit nand_exit(void)
+{
+        platform_driver_unregister(&nand_driver);
+}
+module_init(nand_init);
+module_exit(nand_exit);
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Broadcom");
+MODULE_DESCRIPTION("BCM UMI MTD NAND driver");
diff --git a/drivers/mtd/nand/cafe_nand.c b/drivers/mtd/nand/cafe_nand.c
index c828d9ac7bd7..e5a9f9ccea60 100644
--- a/drivers/mtd/nand/cafe_nand.c
+++ b/drivers/mtd/nand/cafe_nand.c
@@ -20,6 +20,7 @@
 #include <linux/delay.h>
 #include <linux/interrupt.h>
 #include <linux/dma-mapping.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #define CAFE_NAND_CTRL1         0x00
diff --git a/drivers/mtd/nand/cmx270_nand.c b/drivers/mtd/nand/cmx270_nand.c
index 826cacffcefc..6e6495278258 100644
--- a/drivers/mtd/nand/cmx270_nand.c
+++ b/drivers/mtd/nand/cmx270_nand.c
@@ -20,6 +20,7 @@
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
+#include <linux/slab.h>
 #include <linux/gpio.h>
 #include <asm/io.h>
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index f13f5b9afaf7..76e2dc8e62f7 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -32,6 +32,7 @@
 #include <linux/io.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
+#include <linux/slab.h>
 #include <mach/nand.h>
@@ -591,6 +592,8 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
        /* options such as NAND_USE_FLASH_BBT or 16-bit widths */
        info->chip.options      = pdata->options;
+        info->chip.bbt_td       = pdata->bbt_td;
+        info->chip.bbt_md       = pdata->bbt_md;
        info->ioaddr            = (uint32_t __force) vaddr;
@@ -599,7 +602,7 @@ static int __init nand_davinci_probe(struct platform_device *pdev)
        info->mask_chipsel      = pdata->mask_chipsel;
        /* use nandboot-capable ALE/CLE masks by default */
-        info->mask_ale          = pdata->mask_cle ? : MASK_ALE;
+        info->mask_ale          = pdata->mask_ale ? : MASK_ALE;
        info->mask_cle          = pdata->mask_cle ? : MASK_CLE;
        /* Set address of hardware control function */
diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index e51c1ed7ac18..47067bc98248 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c
@@ -23,6 +23,7 @@
 #include <linux/delay.h>
 #include <linux/rslib.h>
 #include <linux/moduleparam.h>
+#include <linux/slab.h>
 #include <asm/io.h>
 #include <linux/mtd/mtd.h>
@@ -1056,7 +1057,7 @@ static struct nand_ecclayout doc200x_oobinfo = {
 };
 /* Find the (I)NFTL Media Header, and optionally also the mirror media header.
-   On sucessful return, buf will contain a copy of the media header for
+   On successful return, buf will contain a copy of the media header for
   further processing.  id is the string to scan for, and will presumably be
   either "ANAND" or "BNAND".  If findmirror=1, also look for the mirror media
   header.  The page #s of the found media headers are placed in mh0_page and
diff --git a/drivers/mtd/nand/excite_nandflash.c b/drivers/mtd/nand/excite_nandflash.c
deleted file mode 100644
index 72446fb48d4b..000000000000
--- a/drivers/mtd/nand/excite_nandflash.c
+++ /dev/null
@@ -1,248 +0,0 @@
-/*
-*  Copyright (C) 2005 - 2007 by Basler Vision Technologies AG
-*  Author: Thomas Koeller <thomas.koeller.qbaslerweb.com>
-*  Original code by Thies Moeller <thies.moeller@baslerweb.com>
-*
-*  This program is free software; you can redistribute it and/or modify
-*  it under the terms of the GNU General Public License as published by
-*  the Free Software Foundation; either version 2 of the License, or
-*  (at your option) any later version.
-*
-*  This program is distributed in the hope that it will be useful,
-*  but WITHOUT ANY WARRANTY; without even the implied warranty of
-*  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-*  GNU General Public License for more details.
-*
-*  You should have received a copy of the GNU General Public License
-*  along with this program; if not, write to the Free Software
-*  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
-*/
-#include <linux/module.h>
-#include <linux/types.h>
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/ioport.h>
-#include <linux/platform_device.h>
-#include <linux/delay.h>
-#include <linux/err.h>
-#include <linux/mtd/mtd.h>
-#include <linux/mtd/nand.h>
-#include <linux/mtd/nand_ecc.h>
-#include <linux/mtd/partitions.h>
-#include <asm/io.h>
-#include <asm/rm9k-ocd.h>
-#include <excite_nandflash.h>
-#define EXCITE_NANDFLASH_VERSION "0.1"
-/* I/O register offsets */
-#define EXCITE_NANDFLASH_DATA_BYTE   0x00
-#define EXCITE_NANDFLASH_STATUS_BYTE 0x0c
-#define EXCITE_NANDFLASH_ADDR_BYTE   0x10
-#define EXCITE_NANDFLASH_CMD_BYTE    0x14
-/* prefix for debug output */
-static const char module_id[] = "excite_nandflash";
-/*
- * partition definition
- */
-static const struct mtd_partition partition_info[] = {
-        {
-                .name = "eXcite RootFS",
-                .offset = 0,
-                .size = MTDPART_SIZ_FULL
-        }
-};
-static inline const struct resource *
-excite_nand_get_resource(struct platform_device *d, unsigned long flags,
-                         const char *basename)
-{
-        char buf[80];
-        if (snprintf(buf, sizeof buf, "%s_%u", basename, d->id) >= sizeof buf)
-                return NULL;
-        return platform_get_resource_byname(d, flags, buf);
-}
-static inline void __iomem *
-excite_nand_map_regs(struct platform_device *d, const char *basename)
-{
-        void *result = NULL;
-        const struct resource *const r =
-            excite_nand_get_resource(d, IORESOURCE_MEM, basename);
-        if (r)
-                result = ioremap_nocache(r->start, r->end + 1 - r->start);
-        return result;
-}
-/* controller and mtd information */
-struct excite_nand_drvdata {
-        struct mtd_info board_mtd;
-        struct nand_chip board_chip;
-        void __iomem *regs;
-        void __iomem *tgt;
-};
-/* Control function */
-static void excite_nand_control(struct mtd_info *mtd, int cmd,
-                                       unsigned int ctrl)
-{
-        struct excite_nand_drvdata * const d =
-            container_of(mtd, struct excite_nand_drvdata, board_mtd);
-        switch (ctrl) {
-        case NAND_CTRL_CHANGE | NAND_CTRL_CLE:
-                d->tgt = d->regs + EXCITE_NANDFLASH_CMD_BYTE;
-                break;
-        case NAND_CTRL_CHANGE | NAND_CTRL_ALE:
-                d->tgt = d->regs + EXCITE_NANDFLASH_ADDR_BYTE;
-                break;
-        case NAND_CTRL_CHANGE | NAND_NCE:
-                d->tgt = d->regs + EXCITE_NANDFLASH_DATA_BYTE;
-                break;
-        }
-        if (cmd != NAND_CMD_NONE)
-                __raw_writeb(cmd, d->tgt);
-}
-/* Return 0 if flash is busy, 1 if ready */
-static int excite_nand_devready(struct mtd_info *mtd)
-{
-        struct excite_nand_drvdata * const drvdata =
-            container_of(mtd, struct excite_nand_drvdata, board_mtd);
-        return __raw_readb(drvdata->regs + EXCITE_NANDFLASH_STATUS_BYTE);
-}
-/*
- * Called by device layer to remove the driver.
- * The binding to the mtd and all allocated
- * resources are released.
- */
-static int __exit excite_nand_remove(struct platform_device *dev)
-{
-        struct excite_nand_drvdata * const this = platform_get_drvdata(dev);
-        platform_set_drvdata(dev, NULL);
-        if (unlikely(!this)) {
-                printk(KERN_ERR "%s: called %s without private data!!",
-                       module_id, __func__);
-                return -EINVAL;
-        }
-        /* first thing we need to do is release our mtd
-         * then go through freeing the resource used
-         */
-        nand_release(&this->board_mtd);
-        /* free the common resources */
-        iounmap(this->regs);
-        kfree(this);
-        DEBUG(MTD_DEBUG_LEVEL1, "%s: removed\n", module_id);
-        return 0;
-}
-/*
- * Called by device layer when it finds a device matching
- * one our driver can handle. This code checks to see if
- * it can allocate all necessary resources then calls the
- * nand layer to look for devices.
-*/
-static int __init excite_nand_probe(struct platform_device *pdev)
-{
-        struct excite_nand_drvdata *drvdata;    /* private driver data */
-        struct nand_chip *board_chip;   /* private flash chip data */
-        struct mtd_info *board_mtd;     /* mtd info for this board */
-        int scan_res;
-        drvdata = kzalloc(sizeof(*drvdata), GFP_KERNEL);
-        if (unlikely(!drvdata)) {
-                printk(KERN_ERR "%s: no memory for drvdata\n",
-                       module_id);
-                return -ENOMEM;
-        }
-        /* bind private data into driver */
-        platform_set_drvdata(pdev, drvdata);
-        /* allocate and map the resource */
-        drvdata->regs =
-                excite_nand_map_regs(pdev, EXCITE_NANDFLASH_RESOURCE_REGS);
-        if (unlikely(!drvdata->regs)) {
-                printk(KERN_ERR "%s: cannot reserve register region\n",
-                       module_id);
-                kfree(drvdata);
-                return -ENXIO;
-        }
-        
-        drvdata->tgt = drvdata->regs + EXCITE_NANDFLASH_DATA_BYTE;
-        /* initialise our chip */
-        board_chip = &drvdata->board_chip;
-        board_chip->IO_ADDR_R = board_chip->IO_ADDR_W =
-                drvdata->regs + EXCITE_NANDFLASH_DATA_BYTE;
-        board_chip->cmd_ctrl = excite_nand_control;
-        board_chip->dev_ready = excite_nand_devready;
-        board_chip->chip_delay = 25;
-        board_chip->ecc.mode = NAND_ECC_SOFT;
-        /* link chip to mtd */
-        board_mtd = &drvdata->board_mtd;
-        board_mtd->priv = board_chip;
-        DEBUG(MTD_DEBUG_LEVEL2, "%s: device scan\n", module_id);
-        scan_res = nand_scan(&drvdata->board_mtd, 1);
-        if (likely(!scan_res)) {
-                DEBUG(MTD_DEBUG_LEVEL2, "%s: register partitions\n", module_id);
-                add_mtd_partitions(&drvdata->board_mtd, partition_info,
-                                   ARRAY_SIZE(partition_info));
-        } else {
-                iounmap(drvdata->regs);
-                kfree(drvdata);
-                printk(KERN_ERR "%s: device scan failed\n", module_id);
-                return -EIO;
-        }
-        return 0;
-}
-static struct platform_driver excite_nand_driver = {
-        .driver = {
-                .name = "excite_nand",
-                .owner          = THIS_MODULE,
-        },
-        .probe = excite_nand_probe,
-        .remove = __devexit_p(excite_nand_remove)
-};
-static int __init excite_nand_init(void)
-{
-        pr_info("Basler eXcite nand flash driver Version "
-                EXCITE_NANDFLASH_VERSION "\n");
-        return platform_driver_register(&excite_nand_driver);
-}
-static void __exit excite_nand_exit(void)
-{
-        platform_driver_unregister(&excite_nand_driver);
-}
-module_init(excite_nand_init);
-module_exit(excite_nand_exit);
-MODULE_AUTHOR("Thomas Koeller <thomas.koeller@baslerweb.com>");
-MODULE_DESCRIPTION("Basler eXcite NAND-Flash driver");
-MODULE_LICENSE("GPL");
-MODULE_VERSION(EXCITE_NANDFLASH_VERSION)
diff --git a/drivers/mtd/nand/fsl_elbc_nand.c b/drivers/mtd/nand/fsl_elbc_nand.c
index ddd37d2554ed..ae30fb6eed97 100644
--- a/drivers/mtd/nand/fsl_elbc_nand.c
+++ b/drivers/mtd/nand/fsl_elbc_nand.c
@@ -237,12 +237,15 @@ static int fsl_elbc_run_command(struct mtd_info *mtd)
        ctrl->use_mdr = 0;
-        dev_vdbg(ctrl->dev,
+        if (ctrl->status != LTESR_CC) {
-                 "fsl_elbc_run_command: stat=%08x mdr=%08x fmr=%08x\n",
+                dev_info(ctrl->dev,
-                 ctrl->status, ctrl->mdr, in_be32(&lbc->fmr));
+                         "command failed: fir %x fcr %x status %x mdr %x\n",
+                         in_be32(&lbc->fir), in_be32(&lbc->fcr),
+                         ctrl->status, ctrl->mdr);
+                return -EIO;
+        }
-        /* returns 0 on success otherwise non-zero) */
+        return 0;
-        return ctrl->status == LTESR_CC ? 0 : -EIO;
 }
 static void fsl_elbc_do_read(struct nand_chip *chip, int oob)
@@ -253,17 +256,17 @@ static void fsl_elbc_do_read(struct nand_chip *chip, int oob)
        if (priv->page_size) {
                out_be32(&lbc->fir,
-                         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
                         (FIR_OP_CA  << FIR_OP1_SHIFT) |
                         (FIR_OP_PA  << FIR_OP2_SHIFT) |
-                         (FIR_OP_CW1 << FIR_OP3_SHIFT) |
+                         (FIR_OP_CM1 << FIR_OP3_SHIFT) |
                         (FIR_OP_RBW << FIR_OP4_SHIFT));
                out_be32(&lbc->fcr, (NAND_CMD_READ0 << FCR_CMD0_SHIFT) |
                                    (NAND_CMD_READSTART << FCR_CMD1_SHIFT));
        } else {
                out_be32(&lbc->fir,
-                         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
                         (FIR_OP_CA  << FIR_OP1_SHIFT) |
                         (FIR_OP_PA  << FIR_OP2_SHIFT) |
                         (FIR_OP_RBW << FIR_OP3_SHIFT));
@@ -332,7 +335,7 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
        case NAND_CMD_READID:
                dev_vdbg(ctrl->dev, "fsl_elbc_cmdfunc: NAND_CMD_READID.\n");
-                out_be32(&lbc->fir, (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                out_be32(&lbc->fir, (FIR_OP_CM0 << FIR_OP0_SHIFT) |
                                    (FIR_OP_UA  << FIR_OP1_SHIFT) |
                                    (FIR_OP_RBW << FIR_OP2_SHIFT));
                out_be32(&lbc->fcr, NAND_CMD_READID << FCR_CMD0_SHIFT);
@@ -359,16 +362,20 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
                dev_vdbg(ctrl->dev, "fsl_elbc_cmdfunc: NAND_CMD_ERASE2.\n");
                out_be32(&lbc->fir,
-                         (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                         (FIR_OP_CM0 << FIR_OP0_SHIFT) |
                         (FIR_OP_PA  << FIR_OP1_SHIFT) |
-                         (FIR_OP_CM1 << FIR_OP2_SHIFT));
+                         (FIR_OP_CM2 << FIR_OP2_SHIFT) |
+                         (FIR_OP_CW1 << FIR_OP3_SHIFT) |
+                         (FIR_OP_RS  << FIR_OP4_SHIFT));
                out_be32(&lbc->fcr,
                         (NAND_CMD_ERASE1 << FCR_CMD0_SHIFT) |
-                         (NAND_CMD_ERASE2 << FCR_CMD1_SHIFT));
+                         (NAND_CMD_STATUS << FCR_CMD1_SHIFT) |
+                         (NAND_CMD_ERASE2 << FCR_CMD2_SHIFT));
                out_be32(&lbc->fbcr, 0);
                ctrl->read_bytes = 0;
+                ctrl->use_mdr = 1;
                fsl_elbc_run_command(mtd);
                return;
@@ -383,40 +390,41 @@ static void fsl_elbc_cmdfunc(struct mtd_info *mtd, unsigned int command,
                ctrl->column = column;
                ctrl->oob = 0;
+                ctrl->use_mdr = 1;
-                if (priv->page_size) {
+                fcr = (NAND_CMD_STATUS   << FCR_CMD1_SHIFT) |
-                        fcr = (NAND_CMD_SEQIN << FCR_CMD0_SHIFT) |
+                      (NAND_CMD_SEQIN    << FCR_CMD2_SHIFT) |
-                              (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT);
+                      (NAND_CMD_PAGEPROG << FCR_CMD3_SHIFT);
+                if (priv->page_size) {
                        out_be32(&lbc->fir,
-                                 (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                                 (FIR_OP_CM2 << FIR_OP0_SHIFT) |
                                 (FIR_OP_CA  << FIR_OP1_SHIFT) |
                                 (FIR_OP_PA  << FIR_OP2_SHIFT) |
                                 (FIR_OP_WB  << FIR_OP3_SHIFT) |
-                                 (FIR_OP_CW1 << FIR_OP4_SHIFT));
+                                 (FIR_OP_CM3 << FIR_OP4_SHIFT) |
+                                 (FIR_OP_CW1 << FIR_OP5_SHIFT) |
+                                 (FIR_OP_RS  << FIR_OP6_SHIFT));
                } else {
-                        fcr = (NAND_CMD_PAGEPROG << FCR_CMD1_SHIFT) |
-                              (NAND_CMD_SEQIN << FCR_CMD2_SHIFT);
                        out_be32(&lbc->fir,
-                                 (FIR_OP_CW0 << FIR_OP0_SHIFT) |
+                                 (FIR_OP_CM0 << FIR_OP0_SHIFT) |
                                 (FIR_OP_CM2 << FIR_OP1_SHIFT) |
                                 (FIR_OP_CA  << FIR_OP2_SHIFT) |
                                 (FIR_OP_PA  << FIR_OP3_SHIFT) |
                                 (FIR_OP_WB  << FIR_OP4_SHIFT) |
-                                 (FIR_OP_CW1 << FIR_OP5_SHIFT));
+                                 (FIR_OP_CM3 << FIR_OP5_SHIFT) |
+                                 (FIR_OP_CW1 << FIR_OP6_SHIFT) |
+                                 (FIR_OP_RS  << FIR_OP7_SHIFT));
                        if (column >= mtd->writesize) {
                                /* OOB area --> READOOB */
                                column -= mtd->writesize;
                                fcr |= NAND_CMD_READOOB << FCR_CMD0_SHIFT;
                                ctrl->oob = 1;
-                        } else if (column < 256) {
+                        } else {
+                                WARN_ON(column != 0);
                                /* First 256 bytes --> READ0 */
                                fcr |= NAND_CMD_READ0 << FCR_CMD0_SHIFT;
-                        } else {
-                                /* Second 256 bytes --> READ1 */
-                                fcr |= NAND_CMD_READ1 << FCR_CMD0_SHIFT;
                        }
                }
@@ -628,22 +636,6 @@ static int fsl_elbc_wait(struct mtd_info *mtd, struct nand_chip *chip)
 {
        struct fsl_elbc_mtd *priv = chip->priv;
        struct fsl_elbc_ctrl *ctrl = priv->ctrl;
-        struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
-        if (ctrl->status != LTESR_CC)
-                return NAND_STATUS_FAIL;
-        /* Use READ_STATUS command, but wait for the device to be ready */
-        ctrl->use_mdr = 0;
-        out_be32(&lbc->fir,
-                 (FIR_OP_CW0 << FIR_OP0_SHIFT) |
-                 (FIR_OP_RBW << FIR_OP1_SHIFT));
-        out_be32(&lbc->fcr, NAND_CMD_STATUS << FCR_CMD0_SHIFT);
-        out_be32(&lbc->fbcr, 1);
-        set_addr(mtd, 0, 0, 0);
-        ctrl->read_bytes = 1;
-        fsl_elbc_run_command(mtd);
        if (ctrl->status != LTESR_CC)
                return NAND_STATUS_FAIL;
@@ -651,8 +643,7 @@ static int fsl_elbc_wait(struct mtd_info *mtd, struct nand_chip *chip)
        /* The chip always seems to report that it is
         * write-protected, even when it is not.
         */
-        setbits8(ctrl->addr, NAND_STATUS_WP);
+        return (ctrl->mdr & 0xff) | NAND_STATUS_WP;
-        return fsl_elbc_read_byte(mtd);
 }
 static int fsl_elbc_chip_init_tail(struct mtd_info *mtd)
@@ -946,6 +937,13 @@ static int __devinit fsl_elbc_ctrl_init(struct fsl_elbc_ctrl *ctrl)
 {
        struct fsl_lbc_regs __iomem *lbc = ctrl->regs;
+        /*
+         * NAND transactions can tie up the bus for a long time, so set the
+         * bus timeout to max by clearing LBCR[BMT] (highest base counter
+         * value) and setting LBCR[BMTPS] to the highest prescaler value.
+         */
+        clrsetbits_be32(&lbc->lbcr, LBCR_BMT, 15);
        /* clear event registers */
        setbits32(&lbc->ltesr, LTESR_NAND_MASK);
        out_be32(&lbc->lteatr, 0);
diff --git a/drivers/mtd/nand/fsl_upm.c b/drivers/mtd/nand/fsl_upm.c
index d120cd8d7267..4b96296af321 100644
--- a/drivers/mtd/nand/fsl_upm.c
+++ b/drivers/mtd/nand/fsl_upm.c
@@ -21,6 +21,7 @@
 #include <linux/of_platform.h>
 #include <linux/of_gpio.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <asm/fsl_lbc.h>
 #define FSL_UPM_WAIT_RUN_PATTERN  0x1
@@ -112,7 +113,7 @@ static void fun_select_chip(struct mtd_info *mtd, int mchip_nr)
        if (mchip_nr == -1) {
                chip->cmd_ctrl(mtd, NAND_CMD_NONE, 0 | NAND_CTRL_CHANGE);
-        } else if (mchip_nr >= 0) {
+        } else if (mchip_nr >= 0 && mchip_nr < NAND_MAX_CHIPS) {
                fun->mchip_number = mchip_nr;
                chip->IO_ADDR_R = fun->io_base + fun->mchip_offsets[mchip_nr];
                chip->IO_ADDR_W = chip->IO_ADDR_R;
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index 65b26d5a5c0d..b2900d8406d3 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -33,9 +33,13 @@
 #include <asm/mach/flash.h>
 #include <mach/mxc_nand.h>
+#include <mach/hardware.h>
 #define DRIVER_NAME "mxc_nand"
+#define nfc_is_v21()            (cpu_is_mx25() || cpu_is_mx35())
+#define nfc_is_v1()             (cpu_is_mx31() || cpu_is_mx27())
 /* Addresses for NFC registers */
 #define NFC_BUF_SIZE            0xE00
 #define NFC_BUF_ADDR            0xE04
@@ -46,24 +50,14 @@
 #define NFC_RSLTMAIN_AREA       0xE0E
 #define NFC_RSLTSPARE_AREA      0xE10
 #define NFC_WRPROT              0xE12
-#define NFC_UNLOCKSTART_BLKADDR 0xE14
+#define NFC_V1_UNLOCKSTART_BLKADDR      0xe14
-#define NFC_UNLOCKEND_BLKADDR   0xE16
+#define NFC_V1_UNLOCKEND_BLKADDR        0xe16
+#define NFC_V21_UNLOCKSTART_BLKADDR     0xe20
+#define NFC_V21_UNLOCKEND_BLKADDR       0xe22
 #define NFC_NF_WRPRST           0xE18
 #define NFC_CONFIG1             0xE1A
 #define NFC_CONFIG2             0xE1C
-/* Addresses for NFC RAM BUFFER Main area 0 */
-#define MAIN_AREA0              0x000
-#define MAIN_AREA1              0x200
-#define MAIN_AREA2              0x400
-#define MAIN_AREA3              0x600
-/* Addresses for NFC SPARE BUFFER Spare area 0 */
-#define SPARE_AREA0             0x800
-#define SPARE_AREA1             0x810
-#define SPARE_AREA2             0x820
-#define SPARE_AREA3             0x830
 /* Set INT to 0, FCMD to 1, rest to 0 in NFC_CONFIG2 Register
 * for Command operation */
 #define NFC_CMD            0x1
@@ -106,48 +100,66 @@ struct mxc_nand_host {
        struct mtd_partition    *parts;
        struct device           *dev;
+        void                    *spare0;
+        void                    *main_area0;
+        void                    *main_area1;
+        void __iomem            *base;
        void __iomem            *regs;
-        int                     spare_only;
        int                     status_request;
-        int                     pagesize_2k;
-        uint16_t                col_addr;
        struct clk              *clk;
        int                     clk_act;
        int                     irq;
        wait_queue_head_t       irq_waitq;
-};
-/* Define delays in microsec for NAND device operations */
-#define TROP_US_DELAY   2000
-/* Macros to get byte and bit positions of ECC */
-#define COLPOS(x)  ((x) >> 3)
-#define BITPOS(x) ((x) & 0xf)
-/* Define single bit Error positions in Main & Spare area */
+        uint8_t                 *data_buf;
-#define MAIN_SINGLEBIT_ERROR 0x4
+        unsigned int            buf_start;
-#define SPARE_SINGLEBIT_ERROR 0x1
+        int                     spare_len;
-/* OOB placement block for use with hardware ecc generation */
-static struct nand_ecclayout nand_hw_eccoob_8 = {
-        .eccbytes = 5,
-        .eccpos = {6, 7, 8, 9, 10},
-        .oobfree = {{0, 5}, {11, 5}, }
 };
-static struct nand_ecclayout nand_hw_eccoob_16 = {
+/* OOB placement block for use with hardware ecc generation */
+static struct nand_ecclayout nandv1_hw_eccoob_smallpage = {
        .eccbytes = 5,
        .eccpos = {6, 7, 8, 9, 10},
-        .oobfree = {{0, 5}, {11, 5}, }
+        .oobfree = {{0, 5}, {12, 4}, }
 };
-static struct nand_ecclayout nand_hw_eccoob_64 = {
+static struct nand_ecclayout nandv1_hw_eccoob_largepage = {
        .eccbytes = 20,
        .eccpos = {6, 7, 8, 9, 10, 22, 23, 24, 25, 26,
                   38, 39, 40, 41, 42, 54, 55, 56, 57, 58},
        .oobfree = {{2, 4}, {11, 10}, {27, 10}, {43, 10}, {59, 5}, }
 };
+/* OOB description for 512 byte pages with 16 byte OOB */
+static struct nand_ecclayout nandv2_hw_eccoob_smallpage = {
+        .eccbytes = 1 * 9,
+        .eccpos = {
+                 7,  8,  9, 10, 11, 12, 13, 14, 15
+        },
+        .oobfree = {
+                {.offset = 0, .length = 5}
+        }
+};
+/* OOB description for 2048 byte pages with 64 byte OOB */
+static struct nand_ecclayout nandv2_hw_eccoob_largepage = {
+        .eccbytes = 4 * 9,
+        .eccpos = {
+                 7,  8,  9, 10, 11, 12, 13, 14, 15,
+                23, 24, 25, 26, 27, 28, 29, 30, 31,
+                39, 40, 41, 42, 43, 44, 45, 46, 47,
+                55, 56, 57, 58, 59, 60, 61, 62, 63
+        },
+        .oobfree = {
+                {.offset = 2, .length = 4},
+                {.offset = 16, .length = 7},
+                {.offset = 32, .length = 7},
+                {.offset = 48, .length = 7}
+        }
+};
 #ifdef CONFIG_MTD_PARTITIONS
 static const char *part_probes[] = { "RedBoot", "cmdlinepart", NULL };
 #endif
@@ -170,10 +182,10 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
 /* This function polls the NANDFC to wait for the basic operation to
 * complete by checking the INT bit of config2 register.
 */
-static void wait_op_done(struct mxc_nand_host *host, int max_retries,
+static void wait_op_done(struct mxc_nand_host *host, int useirq)
-                                uint16_t param, int useirq)
 {
        uint32_t tmp;
+        int max_retries = 2000;
        if (useirq) {
                if ((readw(host->regs + NFC_CONFIG2) & NFC_INT) == 0) {
@@ -200,8 +212,8 @@ static void wait_op_done(struct mxc_nand_host *host, int max_retries,
                        udelay(1);
                }
                if (max_retries < 0)
-                        DEBUG(MTD_DEBUG_LEVEL0, "%s(%d): INT not set\n",
+                        DEBUG(MTD_DEBUG_LEVEL0, "%s: INT not set\n",
-                              __func__, param);
+                              __func__);
        }
 }
@@ -215,7 +227,7 @@ static void send_cmd(struct mxc_nand_host *host, uint16_t cmd, int useirq)
        writew(NFC_CMD, host->regs + NFC_CONFIG2);
        /* Wait for operation to complete */
-        wait_op_done(host, TROP_US_DELAY, cmd, useirq);
+        wait_op_done(host, useirq);
 }
 /* This function sends an address (or partial address) to the
@@ -229,82 +241,47 @@ static void send_addr(struct mxc_nand_host *host, uint16_t addr, int islast)
        writew(NFC_ADDR, host->regs + NFC_CONFIG2);
        /* Wait for operation to complete */
-        wait_op_done(host, TROP_US_DELAY, addr, islast);
+        wait_op_done(host, islast);
 }
-/* This function requests the NANDFC to initate the transfer
+static void send_page(struct mtd_info *mtd, unsigned int ops)
- * of data currently in the NANDFC RAM buffer to the NAND device. */
-static void send_prog_page(struct mxc_nand_host *host, uint8_t buf_id,
-                        int spare_only)
 {
-        DEBUG(MTD_DEBUG_LEVEL3, "send_prog_page (%d)\n", spare_only);
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
-        /* NANDFC buffer 0 is used for page read/write */
+        int bufs, i;
-        writew(buf_id, host->regs + NFC_BUF_ADDR);
-        /* Configure spare or page+spare access */
-        if (!host->pagesize_2k) {
-                uint16_t config1 = readw(host->regs + NFC_CONFIG1);
-                if (spare_only)
-                        config1 |= NFC_SP_EN;
-                else
-                        config1 &= ~(NFC_SP_EN);
-                writew(config1, host->regs + NFC_CONFIG1);
-        }
-        writew(NFC_INPUT, host->regs + NFC_CONFIG2);
+        if (nfc_is_v1() && mtd->writesize > 512)
+                bufs = 4;
+        else
+                bufs = 1;
-        /* Wait for operation to complete */
+        for (i = 0; i < bufs; i++) {
-        wait_op_done(host, TROP_US_DELAY, spare_only, true);
-}
-/* Requests NANDFC to initated the transfer of data from the
+                /* NANDFC buffer 0 is used for page read/write */
- * NAND device into in the NANDFC ram buffer. */
+                writew(i, host->regs + NFC_BUF_ADDR);
-static void send_read_page(struct mxc_nand_host *host, uint8_t buf_id,
-                int spare_only)
-{
-        DEBUG(MTD_DEBUG_LEVEL3, "send_read_page (%d)\n", spare_only);
-        /* NANDFC buffer 0 is used for page read/write */
+                writew(ops, host->regs + NFC_CONFIG2);
-        writew(buf_id, host->regs + NFC_BUF_ADDR);
-        /* Configure spare or page+spare access */
+                /* Wait for operation to complete */
-        if (!host->pagesize_2k) {
+                wait_op_done(host, true);
-                uint32_t config1 = readw(host->regs + NFC_CONFIG1);
-                if (spare_only)
-                        config1 |= NFC_SP_EN;
-                else
-                        config1 &= ~NFC_SP_EN;
-                writew(config1, host->regs + NFC_CONFIG1);
        }
-        writew(NFC_OUTPUT, host->regs + NFC_CONFIG2);
-        /* Wait for operation to complete */
-        wait_op_done(host, TROP_US_DELAY, spare_only, true);
 }
 /* Request the NANDFC to perform a read of the NAND device ID. */
 static void send_read_id(struct mxc_nand_host *host)
 {
        struct nand_chip *this = &host->nand;
-        uint16_t tmp;
        /* NANDFC buffer 0 is used for device ID output */
        writew(0x0, host->regs + NFC_BUF_ADDR);
-        /* Read ID into main buffer */
-        tmp = readw(host->regs + NFC_CONFIG1);
-        tmp &= ~NFC_SP_EN;
-        writew(tmp, host->regs + NFC_CONFIG1);
        writew(NFC_ID, host->regs + NFC_CONFIG2);
        /* Wait for operation to complete */
-        wait_op_done(host, TROP_US_DELAY, 0, true);
+        wait_op_done(host, true);
        if (this->options & NAND_BUSWIDTH_16) {
-                void __iomem *main_buf = host->regs + MAIN_AREA0;
+                void __iomem *main_buf = host->main_area0;
                /* compress the ID info */
                writeb(readb(main_buf + 2), main_buf + 1);
                writeb(readb(main_buf + 4), main_buf + 2);
@@ -312,15 +289,16 @@ static void send_read_id(struct mxc_nand_host *host)
                writeb(readb(main_buf + 8), main_buf + 4);
                writeb(readb(main_buf + 10), main_buf + 5);
        }
+        memcpy(host->data_buf, host->main_area0, 16);
 }
 /* This function requests the NANDFC to perform a read of the
 * NAND device status and returns the current status. */
 static uint16_t get_dev_status(struct mxc_nand_host *host)
 {
-        void __iomem *main_buf = host->regs + MAIN_AREA1;
+        void __iomem *main_buf = host->main_area1;
        uint32_t store;
-        uint16_t ret, tmp;
+        uint16_t ret;
        /* Issue status request to NAND device */
        /* store the main area1 first word, later do recovery */
@@ -329,15 +307,10 @@ static uint16_t get_dev_status(struct mxc_nand_host *host)
         * corruption of read/write buffer on status requests. */
        writew(1, host->regs + NFC_BUF_ADDR);
-        /* Read status into main buffer */
-        tmp = readw(host->regs + NFC_CONFIG1);
-        tmp &= ~NFC_SP_EN;
-        writew(tmp, host->regs + NFC_CONFIG1);
        writew(NFC_STATUS, host->regs + NFC_CONFIG2);
        /* Wait for operation to complete */
-        wait_op_done(host, TROP_US_DELAY, 0, true);
+        wait_op_done(host, true);
        /* Status is placed in first word of main buffer */
        /* get status, then recovery area 1 data */
@@ -397,32 +370,14 @@ static u_char mxc_nand_read_byte(struct mtd_info *mtd)
 {
        struct nand_chip *nand_chip = mtd->priv;
        struct mxc_nand_host *host = nand_chip->priv;
-        uint8_t ret = 0;
+        uint8_t ret;
-        uint16_t col, rd_word;
-        uint16_t __iomem *main_buf = host->regs + MAIN_AREA0;
-        uint16_t __iomem *spare_buf = host->regs + SPARE_AREA0;
        /* Check for status request */
        if (host->status_request)
                return get_dev_status(host) & 0xFF;
-        /* Get column for 16-bit access */
+        ret = *(uint8_t *)(host->data_buf + host->buf_start);
-        col = host->col_addr >> 1;
+        host->buf_start++;
-        /* If we are accessing the spare region */
-        if (host->spare_only)
-                rd_word = readw(&spare_buf[col]);
-        else
-                rd_word = readw(&main_buf[col]);
-        /* Pick upper/lower byte of word from RAM buffer */
-        if (host->col_addr & 0x1)
-                ret = (rd_word >> 8) & 0xFF;
-        else
-                ret = rd_word & 0xFF;
-        /* Update saved column address */
-        host->col_addr++;
        return ret;
 }
@@ -431,33 +386,10 @@ static uint16_t mxc_nand_read_word(struct mtd_info *mtd)
 {
        struct nand_chip *nand_chip = mtd->priv;
        struct mxc_nand_host *host = nand_chip->priv;
-        uint16_t col, rd_word, ret;
+        uint16_t ret;
-        uint16_t __iomem *p;
-        DEBUG(MTD_DEBUG_LEVEL3,
-              "mxc_nand_read_word(col = %d)\n", host->col_addr);
-        col = host->col_addr;
-        /* Adjust saved column address */
-        if (col < mtd->writesize && host->spare_only)
-                col += mtd->writesize;
-        if (col < mtd->writesize)
+        ret = *(uint16_t *)(host->data_buf + host->buf_start);
-                p = (host->regs + MAIN_AREA0) + (col >> 1);
+        host->buf_start += 2;
-        else
-                p = (host->regs + SPARE_AREA0) + ((col - mtd->writesize) >> 1);
-        if (col & 1) {
-                rd_word = readw(p);
-                ret = (rd_word >> 8) & 0xff;
-                rd_word = readw(&p[1]);
-                ret |= (rd_word << 8) & 0xff00;
-        } else
-                ret = readw(p);
-        /* Update saved column address */
-        host->col_addr = col + 2;
        return ret;
 }
@@ -470,94 +402,14 @@ static void mxc_nand_write_buf(struct mtd_info *mtd,
 {
        struct nand_chip *nand_chip = mtd->priv;
        struct mxc_nand_host *host = nand_chip->priv;
-        int n, col, i = 0;
+        u16 col = host->buf_start;
+        int n = mtd->oobsize + mtd->writesize - col;
-        DEBUG(MTD_DEBUG_LEVEL3,
-              "mxc_nand_write_buf(col = %d, len = %d)\n", host->col_addr,
-              len);
-        col = host->col_addr;
-        /* Adjust saved column address */
+        n = min(n, len);
-        if (col < mtd->writesize && host->spare_only)
-                col += mtd->writesize;
-        n = mtd->writesize + mtd->oobsize - col;
+        memcpy(host->data_buf + col, buf, n);
-        n = min(len, n);
-        DEBUG(MTD_DEBUG_LEVEL3,
-              "%s:%d: col = %d, n = %d\n", __func__, __LINE__, col, n);
-        while (n) {
-                void __iomem *p;
-                if (col < mtd->writesize)
-                        p = host->regs + MAIN_AREA0 + (col & ~3);
-                else
-                        p = host->regs + SPARE_AREA0 -
-                                                mtd->writesize + (col & ~3);
-                DEBUG(MTD_DEBUG_LEVEL3, "%s:%d: p = %p\n", __func__,
-                      __LINE__, p);
-                if (((col | (int)&buf[i]) & 3) || n < 16) {
-                        uint32_t data = 0;
-                        if (col & 3 || n < 4)
-                                data = readl(p);
-                        switch (col & 3) {
-                        case 0:
-                                if (n) {
-                                        data = (data & 0xffffff00) |
-                                            (buf[i++] << 0);
-                                        n--;
-                                        col++;
-                                }
-                        case 1:
-                                if (n) {
-                                        data = (data & 0xffff00ff) |
-                                            (buf[i++] << 8);
-                                        n--;
-                                        col++;
-                                }
-                        case 2:
-                                if (n) {
-                                        data = (data & 0xff00ffff) |
-                                            (buf[i++] << 16);
-                                        n--;
-                                        col++;
-                                }
-                        case 3:
-                                if (n) {
-                                        data = (data & 0x00ffffff) |
-                                            (buf[i++] << 24);
-                                        n--;
-                                        col++;
-                                }
-                        }
-                        writel(data, p);
-                } else {
-                        int m = mtd->writesize - col;
-                        if (col >= mtd->writesize)
+        host->buf_start += n;
-                                m += mtd->oobsize;
-                        m = min(n, m) & ~3;
-                        DEBUG(MTD_DEBUG_LEVEL3,
-                              "%s:%d: n = %d, m = %d, i = %d, col = %d\n",
-                              __func__,  __LINE__, n, m, i, col);
-                        memcpy(p, &buf[i], m);
-                        col += m;
-                        i += m;
-                        n -= m;
-                }
-        }
-        /* Update saved column address */
-        host->col_addr = col;
 }
 /* Read the data buffer from the NAND Flash. To read the data from NAND
@@ -568,75 +420,14 @@ static void mxc_nand_read_buf(struct mtd_info *mtd, u_char *buf, int len)
 {
        struct nand_chip *nand_chip = mtd->priv;
        struct mxc_nand_host *host = nand_chip->priv;
-        int n, col, i = 0;
+        u16 col = host->buf_start;
+        int n = mtd->oobsize + mtd->writesize - col;
-        DEBUG(MTD_DEBUG_LEVEL3,
-              "mxc_nand_read_buf(col = %d, len = %d)\n", host->col_addr, len);
-        col = host->col_addr;
-        /* Adjust saved column address */
+        n = min(n, len);
-        if (col < mtd->writesize && host->spare_only)
-                col += mtd->writesize;
-        n = mtd->writesize + mtd->oobsize - col;
+        memcpy(buf, host->data_buf + col, len);
-        n = min(len, n);
-        while (n) {
-                void __iomem *p;
-                if (col < mtd->writesize)
-                        p = host->regs + MAIN_AREA0 + (col & ~3);
-                else
-                        p = host->regs + SPARE_AREA0 -
-                                        mtd->writesize + (col & ~3);
-                if (((col | (int)&buf[i]) & 3) || n < 16) {
-                        uint32_t data;
-                        data = readl(p);
-                        switch (col & 3) {
-                        case 0:
-                                if (n) {
-                                        buf[i++] = (uint8_t) (data);
-                                        n--;
-                                        col++;
-                                }
-                        case 1:
-                                if (n) {
-                                        buf[i++] = (uint8_t) (data >> 8);
-                                        n--;
-                                        col++;
-                                }
-                        case 2:
-                                if (n) {
-                                        buf[i++] = (uint8_t) (data >> 16);
-                                        n--;
-                                        col++;
-                                }
-                        case 3:
-                                if (n) {
-                                        buf[i++] = (uint8_t) (data >> 24);
-                                        n--;
-                                        col++;
-                                }
-                        }
-                } else {
-                        int m = mtd->writesize - col;
-                        if (col >= mtd->writesize)
-                                m += mtd->oobsize;
-                        m = min(n, m) & ~3;
-                        memcpy(&buf[i], p, m);
-                        col += m;
-                        i += m;
-                        n -= m;
-                }
-        }
-        /* Update saved column address */
-        host->col_addr = col;
+        host->buf_start += len;
 }
 /* Used by the upper layer to verify the data in NAND Flash
@@ -654,23 +445,6 @@ static void mxc_nand_select_chip(struct mtd_info *mtd, int chip)
        struct nand_chip *nand_chip = mtd->priv;
        struct mxc_nand_host *host = nand_chip->priv;
-#ifdef CONFIG_MTD_NAND_MXC_FORCE_CE
-        if (chip > 0) {
-                DEBUG(MTD_DEBUG_LEVEL0,
-                      "ERROR:  Illegal chip select (chip = %d)\n", chip);
-                return;
-        }
-        if (chip == -1) {
-                writew(readw(host->regs + NFC_CONFIG1) & ~NFC_CE,
-                                host->regs + NFC_CONFIG1);
-                return;
-        }
-        writew(readw(host->regs + NFC_CONFIG1) | NFC_CE,
-                        host->regs + NFC_CONFIG1);
-#endif
        switch (chip) {
        case -1:
                /* Disable the NFC clock */
@@ -692,94 +466,40 @@ static void mxc_nand_select_chip(struct mtd_info *mtd, int chip)
        }
 }
-/* Used by the upper layer to write command to NAND Flash for
+/*
- * different operations to be carried out on NAND Flash */
+ * Function to transfer data to/from spare area.
-static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
+ */
-                                int column, int page_addr)
+static void copy_spare(struct mtd_info *mtd, bool bfrom)
 {
-        struct nand_chip *nand_chip = mtd->priv;
+        struct nand_chip *this = mtd->priv;
-        struct mxc_nand_host *host = nand_chip->priv;
+        struct mxc_nand_host *host = this->priv;
-        int useirq = true;
+        u16 i, j;
+        u16 n = mtd->writesize >> 9;
-        DEBUG(MTD_DEBUG_LEVEL3,
+        u8 *d = host->data_buf + mtd->writesize;
-              "mxc_nand_command (cmd = 0x%x, col = 0x%x, page = 0x%x)\n",
+        u8 *s = host->spare0;
-              command, column, page_addr);
+        u16 t = host->spare_len;
-        /* Reset command state information */
+        j = (mtd->oobsize / n >> 1) << 1;
-        host->status_request = false;
+        if (bfrom) {
-        /* Command pre-processing step */
+                for (i = 0; i < n - 1; i++)
-        switch (command) {
+                        memcpy(d + i * j, s + i * t, j);
-        case NAND_CMD_STATUS:
+                /* the last section */
-                host->col_addr = 0;
+                memcpy(d + i * j, s + i * t, mtd->oobsize - i * j);
-                host->status_request = true;
+        } else {
-                break;
+                for (i = 0; i < n - 1; i++)
+                        memcpy(&s[i * t], &d[i * j], j);
-        case NAND_CMD_READ0:
-                host->col_addr = column;
-                host->spare_only = false;
-                useirq = false;
-                break;
-        case NAND_CMD_READOOB:
-                host->col_addr = column;
-                host->spare_only = true;
-                useirq = false;
-                if (host->pagesize_2k)
-                        command = NAND_CMD_READ0; /* only READ0 is valid */
-                break;
-        case NAND_CMD_SEQIN:
-                if (column >= mtd->writesize) {
-                        /*
-                         * FIXME: before send SEQIN command for write OOB,
-                         * We must read one page out.
-                         * For K9F1GXX has no READ1 command to set current HW
-                         * pointer to spare area, we must write the whole page
-                         * including OOB together.
-                         */
-                        if (host->pagesize_2k)
-                                /* call ourself to read a page */
-                                mxc_nand_command(mtd, NAND_CMD_READ0, 0,
-                                                page_addr);
-                        host->col_addr = column - mtd->writesize;
-                        host->spare_only = true;
-                        /* Set program pointer to spare region */
-                        if (!host->pagesize_2k)
-                                send_cmd(host, NAND_CMD_READOOB, false);
-                } else {
-                        host->spare_only = false;
-                        host->col_addr = column;
-                        /* Set program pointer to page start */
-                        if (!host->pagesize_2k)
-                                send_cmd(host, NAND_CMD_READ0, false);
-                }
-                useirq = false;
-                break;
-        case NAND_CMD_PAGEPROG:
-                send_prog_page(host, 0, host->spare_only);
-                if (host->pagesize_2k) {
-                        /* data in 4 areas datas */
-                        send_prog_page(host, 1, host->spare_only);
-                        send_prog_page(host, 2, host->spare_only);
-                        send_prog_page(host, 3, host->spare_only);
-                }
-                break;
-        case NAND_CMD_ERASE1:
+                /* the last section */
-                useirq = false;
+                memcpy(&s[i * t], &d[i * j], mtd->oobsize - i * j);
-                break;
        }
+}
-        /* Write out the command to the device. */
+static void mxc_do_addr_cycle(struct mtd_info *mtd, int column, int page_addr)
-        send_cmd(host, command, useirq);
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
        /* Write out column address, if necessary */
        if (column != -1) {
@@ -787,11 +507,11 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                 * MXC NANDFC can only perform full page+spare or
                 * spare-only read/write.  When the upper layers
                 * layers perform a read/write buf operation,
-                 * we will used the saved column adress to index into
+                 * we will used the saved column address to index into
                 * the full page.
                 */
                send_addr(host, 0, page_addr == -1);
-                if (host->pagesize_2k)
+                if (mtd->writesize > 512)
                        /* another col addr cycle for 2k page */
                        send_addr(host, 0, false);
        }
@@ -801,7 +521,7 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                /* paddr_0 - p_addr_7 */
                send_addr(host, (page_addr & 0xff), false);
-                if (host->pagesize_2k) {
+                if (mtd->writesize > 512) {
                        if (mtd->size >= 0x10000000) {
                                /* paddr_8 - paddr_15 */
                                send_addr(host, (page_addr >> 8) & 0xff, false);
@@ -820,52 +540,136 @@ static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
                                send_addr(host, (page_addr >> 8) & 0xff, true);
                }
        }
+}
+/* Used by the upper layer to write command to NAND Flash for
+ * different operations to be carried out on NAND Flash */
+static void mxc_nand_command(struct mtd_info *mtd, unsigned command,
+                                int column, int page_addr)
+{
+        struct nand_chip *nand_chip = mtd->priv;
+        struct mxc_nand_host *host = nand_chip->priv;
+        DEBUG(MTD_DEBUG_LEVEL3,
+              "mxc_nand_command (cmd = 0x%x, col = 0x%x, page = 0x%x)\n",
+              command, column, page_addr);
+        /* Reset command state information */
+        host->status_request = false;
-        /* Command post-processing step */
+        /* Command pre-processing step */
        switch (command) {
-        case NAND_CMD_RESET:
+        case NAND_CMD_STATUS:
+                host->buf_start = 0;
+                host->status_request = true;
+                send_cmd(host, command, true);
+                mxc_do_addr_cycle(mtd, column, page_addr);
                break;
-        case NAND_CMD_READOOB:
        case NAND_CMD_READ0:
-                if (host->pagesize_2k) {
+        case NAND_CMD_READOOB:
-                        /* send read confirm command */
+                if (command == NAND_CMD_READ0)
+                        host->buf_start = column;
+                else
+                        host->buf_start = column + mtd->writesize;
+                if (mtd->writesize > 512)
+                        command = NAND_CMD_READ0; /* only READ0 is valid */
+                send_cmd(host, command, false);
+                mxc_do_addr_cycle(mtd, column, page_addr);
+                if (mtd->writesize > 512)
                        send_cmd(host, NAND_CMD_READSTART, true);
-                        /* read for each AREA */
-                        send_read_page(host, 0, host->spare_only);
+                send_page(mtd, NFC_OUTPUT);
-                        send_read_page(host, 1, host->spare_only);
-                        send_read_page(host, 2, host->spare_only);
+                memcpy(host->data_buf, host->main_area0, mtd->writesize);
-                        send_read_page(host, 3, host->spare_only);
+                copy_spare(mtd, true);
-                } else
-                        send_read_page(host, 0, host->spare_only);
                break;
-        case NAND_CMD_READID:
+        case NAND_CMD_SEQIN:
-                host->col_addr = 0;
+                if (column >= mtd->writesize) {
-                send_read_id(host);
+                        /*
+                         * FIXME: before send SEQIN command for write OOB,
+                         * We must read one page out.
+                         * For K9F1GXX has no READ1 command to set current HW
+                         * pointer to spare area, we must write the whole page
+                         * including OOB together.
+                         */
+                        if (mtd->writesize > 512)
+                                /* call ourself to read a page */
+                                mxc_nand_command(mtd, NAND_CMD_READ0, 0,
+                                                page_addr);
+                        host->buf_start = column;
+                        /* Set program pointer to spare region */
+                        if (mtd->writesize == 512)
+                                send_cmd(host, NAND_CMD_READOOB, false);
+                } else {
+                        host->buf_start = column;
+                        /* Set program pointer to page start */
+                        if (mtd->writesize == 512)
+                                send_cmd(host, NAND_CMD_READ0, false);
+                }
+                send_cmd(host, command, false);
+                mxc_do_addr_cycle(mtd, column, page_addr);
                break;
        case NAND_CMD_PAGEPROG:
+                memcpy(host->main_area0, host->data_buf, mtd->writesize);
+                copy_spare(mtd, false);
+                send_page(mtd, NFC_INPUT);
+                send_cmd(host, command, true);
+                mxc_do_addr_cycle(mtd, column, page_addr);
                break;
-        case NAND_CMD_STATUS:
+        case NAND_CMD_READID:
+                send_cmd(host, command, true);
+                mxc_do_addr_cycle(mtd, column, page_addr);
+                send_read_id(host);
+                host->buf_start = column;
                break;
+        case NAND_CMD_ERASE1:
        case NAND_CMD_ERASE2:
+                send_cmd(host, command, false);
+                mxc_do_addr_cycle(mtd, column, page_addr);
                break;
        }
 }
-/* Define some generic bad / good block scan pattern which are used
+/*
- * while scanning a device for factory marked good / bad blocks. */
+ * The generic flash bbt decriptors overlap with our ecc
-static uint8_t scan_ff_pattern[] = { 0xff, 0xff };
+ * hardware, so define some i.MX specific ones.
+ */
+static uint8_t bbt_pattern[] = { 'B', 'b', 't', '0' };
+static uint8_t mirror_pattern[] = { '1', 't', 'b', 'B' };
+static struct nand_bbt_descr bbt_main_descr = {
+        .options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
+            | NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
+        .offs = 0,
+        .len = 4,
+        .veroffs = 4,
+        .maxblocks = 4,
+        .pattern = bbt_pattern,
+};
-static struct nand_bbt_descr smallpage_memorybased = {
+static struct nand_bbt_descr bbt_mirror_descr = {
-        .options = NAND_BBT_SCAN2NDPAGE,
+        .options = NAND_BBT_LASTBLOCK | NAND_BBT_CREATE | NAND_BBT_WRITE
-        .offs = 5,
+            | NAND_BBT_2BIT | NAND_BBT_VERSION | NAND_BBT_PERCHIP,
-        .len = 1,
+        .offs = 0,
-        .pattern = scan_ff_pattern
+        .len = 4,
+        .veroffs = 4,
+        .maxblocks = 4,
+        .pattern = mirror_pattern,
 };
 static int __init mxcnd_probe(struct platform_device *pdev)
@@ -877,12 +681,16 @@ static int __init mxcnd_probe(struct platform_device *pdev)
        struct resource *res;
        uint16_t tmp;
        int err = 0, nr_parts = 0;
+        struct nand_ecclayout *oob_smallpage, *oob_largepage;
        /* Allocate memory for MTD device structure and private data */
-        host = kzalloc(sizeof(struct mxc_nand_host), GFP_KERNEL);
+        host = kzalloc(sizeof(struct mxc_nand_host) + NAND_MAX_PAGESIZE +
+                        NAND_MAX_OOBSIZE, GFP_KERNEL);
        if (!host)
                return -ENOMEM;
+        host->data_buf = (uint8_t *)(host + 1);
        host->dev = &pdev->dev;
        /* structures must be linked */
        this = &host->nand;
@@ -890,7 +698,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
        mtd->priv = this;
        mtd->owner = THIS_MODULE;
        mtd->dev.parent = &pdev->dev;
-        mtd->name = "mxc_nand";
+        mtd->name = DRIVER_NAME;
        /* 50 us command delay time */
        this->chip_delay = 5;
@@ -920,62 +728,93 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                goto eres;
        }
-        host->regs = ioremap(res->start, res->end - res->start + 1);
+        host->base = ioremap(res->start, resource_size(res));
-        if (!host->regs) {
+        if (!host->base) {
                err = -ENOMEM;
                goto eres;
        }
+        host->main_area0 = host->base;
+        host->main_area1 = host->base + 0x200;
+        if (nfc_is_v21()) {
+                host->regs = host->base + 0x1000;
+                host->spare0 = host->base + 0x1000;
+                host->spare_len = 64;
+                oob_smallpage = &nandv2_hw_eccoob_smallpage;
+                oob_largepage = &nandv2_hw_eccoob_largepage;
+        } else if (nfc_is_v1()) {
+                host->regs = host->base;
+                host->spare0 = host->base + 0x800;
+                host->spare_len = 16;
+                oob_smallpage = &nandv1_hw_eccoob_smallpage;
+                oob_largepage = &nandv1_hw_eccoob_largepage;
+        } else
+                BUG();
+        /* disable interrupt and spare enable */
        tmp = readw(host->regs + NFC_CONFIG1);
        tmp |= NFC_INT_MSK;
+        tmp &= ~NFC_SP_EN;
        writew(tmp, host->regs + NFC_CONFIG1);
        init_waitqueue_head(&host->irq_waitq);
        host->irq = platform_get_irq(pdev, 0);
-        err = request_irq(host->irq, mxc_nfc_irq, 0, "mxc_nd", host);
+        err = request_irq(host->irq, mxc_nfc_irq, 0, DRIVER_NAME, host);
        if (err)
                goto eirq;
+        /* Reset NAND */
+        this->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
+        /* preset operation */
+        /* Unlock the internal RAM Buffer */
+        writew(0x2, host->regs + NFC_CONFIG);
+        /* Blocks to be unlocked */
+        if (nfc_is_v21()) {
+                writew(0x0, host->regs + NFC_V21_UNLOCKSTART_BLKADDR);
+                writew(0xffff, host->regs + NFC_V21_UNLOCKEND_BLKADDR);
+                this->ecc.bytes = 9;
+        } else if (nfc_is_v1()) {
+                writew(0x0, host->regs + NFC_V1_UNLOCKSTART_BLKADDR);
+                writew(0x4000, host->regs + NFC_V1_UNLOCKEND_BLKADDR);
+                this->ecc.bytes = 3;
+        } else
+                BUG();
+        /* Unlock Block Command for given address range */
+        writew(0x4, host->regs + NFC_WRPROT);
+        this->ecc.size = 512;
+        this->ecc.layout = oob_smallpage;
        if (pdata->hw_ecc) {
                this->ecc.calculate = mxc_nand_calculate_ecc;
                this->ecc.hwctl = mxc_nand_enable_hwecc;
                this->ecc.correct = mxc_nand_correct_data;
                this->ecc.mode = NAND_ECC_HW;
-                this->ecc.size = 512;
-                this->ecc.bytes = 3;
                tmp = readw(host->regs + NFC_CONFIG1);
                tmp |= NFC_ECC_EN;
                writew(tmp, host->regs + NFC_CONFIG1);
        } else {
-                this->ecc.size = 512;
-                this->ecc.bytes = 3;
-                this->ecc.layout = &nand_hw_eccoob_8;
                this->ecc.mode = NAND_ECC_SOFT;
                tmp = readw(host->regs + NFC_CONFIG1);
                tmp &= ~NFC_ECC_EN;
                writew(tmp, host->regs + NFC_CONFIG1);
        }
-        /* Reset NAND */
-        this->cmdfunc(mtd, NAND_CMD_RESET, -1, -1);
-        /* preset operation */
-        /* Unlock the internal RAM Buffer */
-        writew(0x2, host->regs + NFC_CONFIG);
-        /* Blocks to be unlocked */
-        writew(0x0, host->regs + NFC_UNLOCKSTART_BLKADDR);
-        writew(0x4000, host->regs + NFC_UNLOCKEND_BLKADDR);
-        /* Unlock Block Command for given address range */
-        writew(0x4, host->regs + NFC_WRPROT);
        /* NAND bus width determines access funtions used by upper layer */
-        if (pdata->width == 2) {
+        if (pdata->width == 2)
                this->options |= NAND_BUSWIDTH_16;
-                this->ecc.layout = &nand_hw_eccoob_16;
+        if (pdata->flash_bbt) {
+                this->bbt_td = &bbt_main_descr;
+                this->bbt_md = &bbt_mirror_descr;
+                /* update flash based bbt */
+                this->options |= NAND_USE_FLASH_BBT;
        }
        /* first scan to find the device and get the page size */
@@ -984,38 +823,8 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                goto escan;
        }
-        if (mtd->writesize == 2048) {
+        if (mtd->writesize == 2048)
-                host->pagesize_2k = 1;
+                this->ecc.layout = oob_largepage;
-                this->badblock_pattern = &smallpage_memorybased;
-        }
-        if (this->ecc.mode == NAND_ECC_HW) {
-                switch (mtd->oobsize) {
-                case 8:
-                        this->ecc.layout = &nand_hw_eccoob_8;
-                        break;
-                case 16:
-                        this->ecc.layout = &nand_hw_eccoob_16;
-                        break;
-                case 64:
-                        this->ecc.layout = &nand_hw_eccoob_64;
-                        break;
-                default:
-                        /* page size not handled by HW ECC */
-                        /* switching back to soft ECC */
-                        this->ecc.size = 512;
-                        this->ecc.bytes = 3;
-                        this->ecc.layout = &nand_hw_eccoob_8;
-                        this->ecc.mode = NAND_ECC_SOFT;
-                        this->ecc.calculate = NULL;
-                        this->ecc.correct = NULL;
-                        this->ecc.hwctl = NULL;
-                        tmp = readw(host->regs + NFC_CONFIG1);
-                        tmp &= ~NFC_ECC_EN;
-                        writew(tmp, host->regs + NFC_CONFIG1);
-                        break;
-                }
-        }
        /* second phase scan */
        if (nand_scan_tail(mtd)) {
@@ -1043,7 +852,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
 escan:
        free_irq(host->irq, host);
 eirq:
-        iounmap(host->regs);
+        iounmap(host->base);
 eres:
        clk_put(host->clk);
 eclk:
@@ -1062,7 +871,7 @@ static int __devexit mxcnd_remove(struct platform_device *pdev)
        nand_release(&host->mtd);
        free_irq(host->irq, host);
-        iounmap(host->regs);
+        iounmap(host->base);
        kfree(host);
        return 0;
@@ -1113,7 +922,7 @@ static struct platform_driver mxcnd_driver = {
        .driver = {
                   .name = DRIVER_NAME,
                   },
-        .remove = __exit_p(mxcnd_remove),
+        .remove = __devexit_p(mxcnd_remove),
        .suspend = mxcnd_suspend,
        .resume = mxcnd_resume,
 };
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 2957cc70da3d..8f2958fe2148 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -428,6 +428,28 @@ static int nand_block_checkbad(struct mtd_info *mtd, loff_t ofs, int getchip,
        return nand_isbad_bbt(mtd, ofs, allowbbt);
 }
+/**
+ * panic_nand_wait_ready - [GENERIC] Wait for the ready pin after commands.
+ * @mtd:        MTD device structure
+ * @timeo:      Timeout
+ *
+ * Helper function for nand_wait_ready used when needing to wait in interrupt
+ * context.
+ */
+static void panic_nand_wait_ready(struct mtd_info *mtd, unsigned long timeo)
+{
+        struct nand_chip *chip = mtd->priv;
+        int i;
+        /* Wait for the device to get ready */
+        for (i = 0; i < timeo; i++) {
+                if (chip->dev_ready(mtd))
+                        break;
+                touch_softlockup_watchdog();
+                mdelay(1);
+        }
+}
 /*
 * Wait for the ready pin, after a command
 * The timeout is catched later.
@@ -437,6 +459,10 @@ void nand_wait_ready(struct mtd_info *mtd)
        struct nand_chip *chip = mtd->priv;
        unsigned long timeo = jiffies + 2;
+        /* 400ms timeout */
+        if (in_interrupt() || oops_in_progress)
+                return panic_nand_wait_ready(mtd, 400);
        led_trigger_event(nand_led_trigger, LED_FULL);
        /* wait until command is processed or timeout occures */
        do {
@@ -672,6 +698,22 @@ static void nand_command_lp(struct mtd_info *mtd, unsigned int command,
 }
 /**
+ * panic_nand_get_device - [GENERIC] Get chip for selected access
+ * @chip:       the nand chip descriptor
+ * @mtd:        MTD device structure
+ * @new_state:  the state which is requested
+ *
+ * Used when in panic, no locks are taken.
+ */
+static void panic_nand_get_device(struct nand_chip *chip,
+                      struct mtd_info *mtd, int new_state)
+{
+        /* Hardware controller shared among independend devices */
+        chip->controller->active = chip;
+        chip->state = new_state;
+}
+/**
 * nand_get_device - [GENERIC] Get chip for selected access
 * @chip:       the nand chip descriptor
 * @mtd:        MTD device structure
@@ -698,8 +740,14 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
                return 0;
        }
        if (new_state == FL_PM_SUSPENDED) {
-                spin_unlock(lock);
+                if (chip->controller->active->state == FL_PM_SUSPENDED) {
-                return (chip->state == FL_PM_SUSPENDED) ? 0 : -EAGAIN;
+                        chip->state = FL_PM_SUSPENDED;
+                        spin_unlock(lock);
+                        return 0;
+                } else {
+                        spin_unlock(lock);
+                        return -EAGAIN;
+                }
        }
        set_current_state(TASK_UNINTERRUPTIBLE);
        add_wait_queue(wq, &wait);
@@ -710,6 +758,32 @@ nand_get_device(struct nand_chip *chip, struct mtd_info *mtd, int new_state)
 }
 /**
+ * panic_nand_wait - [GENERIC]  wait until the command is done
+ * @mtd:        MTD device structure
+ * @chip:       NAND chip structure
+ * @timeo:      Timeout
+ *
+ * Wait for command done. This is a helper function for nand_wait used when
+ * we are in interrupt context. May happen when in panic and trying to write
+ * an oops trough mtdoops.
+ */
+static void panic_nand_wait(struct mtd_info *mtd, struct nand_chip *chip,
+                            unsigned long timeo)
+{
+        int i;
+        for (i = 0; i < timeo; i++) {
+                if (chip->dev_ready) {
+                        if (chip->dev_ready(mtd))
+                                break;
+                } else {
+                        if (chip->read_byte(mtd) & NAND_STATUS_READY)
+                                break;
+                }
+                mdelay(1);
+        }
+}
+/**
 * nand_wait - [DEFAULT]  wait until the command is done
 * @mtd:        MTD device structure
 * @chip:       NAND chip structure
@@ -740,15 +814,19 @@ static int nand_wait(struct mtd_info *mtd, struct nand_chip *chip)
        else
                chip->cmdfunc(mtd, NAND_CMD_STATUS, -1, -1);
-        while (time_before(jiffies, timeo)) {
+        if (in_interrupt() || oops_in_progress)
-                if (chip->dev_ready) {
+                panic_nand_wait(mtd, chip, timeo);
-                        if (chip->dev_ready(mtd))
+        else {
-                                break;
+                while (time_before(jiffies, timeo)) {
-                } else {
+                        if (chip->dev_ready) {
-                        if (chip->read_byte(mtd) & NAND_STATUS_READY)
+                                if (chip->dev_ready(mtd))
-                                break;
+                                        break;
+                        } else {
+                                if (chip->read_byte(mtd) & NAND_STATUS_READY)
+                                        break;
+                        }
+                        cond_resched();
                }
-                cond_resched();
        }
        led_trigger_event(nand_led_trigger, LED_OFF);
@@ -1949,6 +2027,45 @@ static int nand_do_write_ops(struct mtd_info *mtd, loff_t to,
 }
 /**
+ * panic_nand_write - [MTD Interface] NAND write with ECC
+ * @mtd:        MTD device structure
+ * @to:         offset to write to
+ * @len:        number of bytes to write
+ * @retlen:     pointer to variable to store the number of written bytes
+ * @buf:        the data to write
+ *
+ * NAND write with ECC. Used when performing writes in interrupt context, this
+ * may for example be called by mtdoops when writing an oops while in panic.
+ */
+static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len,
+                            size_t *retlen, const uint8_t *buf)
+{
+        struct nand_chip *chip = mtd->priv;
+        int ret;
+        /* Do not allow reads past end of device */
+        if ((to + len) > mtd->size)
+                return -EINVAL;
+        if (!len)
+                return 0;
+        /* Wait for the device to get ready.  */
+        panic_nand_wait(mtd, chip, 400);
+        /* Grab the device.  */
+        panic_nand_get_device(chip, mtd, FL_WRITING);
+        chip->ops.len = len;
+        chip->ops.datbuf = (uint8_t *)buf;
+        chip->ops.oobbuf = NULL;
+        ret = nand_do_write_ops(mtd, to, &chip->ops);
+        *retlen = chip->ops.retlen;
+        return ret;
+}
+/**
 * nand_write - [MTD Interface] NAND write with ECC
 * @mtd:        MTD device structure
 * @to:         offset to write to
@@ -2645,7 +2762,8 @@ int nand_scan_ident(struct mtd_info *mtd, int maxchips)
        type = nand_get_flash_type(mtd, chip, busw, &nand_maf_id);
        if (IS_ERR(type)) {
-                printk(KERN_WARNING "No NAND device found!!!\n");
+                if (!(chip->options & NAND_SCAN_SILENT_NODEV))
+                        printk(KERN_WARNING "No NAND device found.\n");
                chip->select_chip(mtd, -1);
                return PTR_ERR(type);
        }
@@ -2877,6 +2995,7 @@ int nand_scan_tail(struct mtd_info *mtd)
        mtd->unpoint = NULL;
        mtd->read = nand_read;
        mtd->write = nand_write;
+        mtd->panic_write = panic_nand_write;
        mtd->read_oob = nand_read_oob;
        mtd->write_oob = nand_write_oob;
        mtd->sync = nand_sync;
diff --git a/drivers/mtd/nand/nand_bcm_umi.c b/drivers/mtd/nand/nand_bcm_umi.c
new file mode 100644
index 000000000000..46a6bc9c4b74
--- /dev/null
+++ b/drivers/mtd/nand/nand_bcm_umi.c
@@ -0,0 +1,149 @@
+/*****************************************************************************
+* Copyright 2004 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+/* ---- Include Files ---------------------------------------------------- */
+#include <mach/reg_umi.h>
+#include "nand_bcm_umi.h"
+#ifdef BOOT0_BUILD
+#include <uart.h>
+#endif
+/* ---- External Variable Declarations ----------------------------------- */
+/* ---- External Function Prototypes ------------------------------------- */
+/* ---- Public Variables ------------------------------------------------- */
+/* ---- Private Constants and Types -------------------------------------- */
+/* ---- Private Function Prototypes -------------------------------------- */
+/* ---- Private Variables ------------------------------------------------ */
+/* ---- Private Functions ------------------------------------------------ */
+#if NAND_ECC_BCH
+/****************************************************************************
+*  nand_bch_ecc_flip_bit - Routine to flip an errored bit
+*
+*  PURPOSE:
+*     This is a helper routine that flips the bit (0 -> 1 or 1 -> 0) of the
+*     errored bit specified
+*
+*  PARAMETERS:
+*     datap - Container that holds the 512 byte data
+*     errorLocation - Location of the bit that needs to be flipped
+*
+*  RETURNS:
+*     None
+****************************************************************************/
+static void nand_bcm_umi_bch_ecc_flip_bit(uint8_t *datap, int errorLocation)
+{
+        int locWithinAByte = (errorLocation & REG_UMI_BCH_ERR_LOC_BYTE) >> 0;
+        int locWithinAWord = (errorLocation & REG_UMI_BCH_ERR_LOC_WORD) >> 3;
+        int locWithinAPage = (errorLocation & REG_UMI_BCH_ERR_LOC_PAGE) >> 5;
+        uint8_t errorByte = 0;
+        uint8_t byteMask = 1 << locWithinAByte;
+        /* BCH uses big endian, need to change the location
+         * bits to little endian */
+        locWithinAWord = 3 - locWithinAWord;
+        errorByte = datap[locWithinAPage * sizeof(uint32_t) + locWithinAWord];
+#ifdef BOOT0_BUILD
+        puthexs("\nECC Correct Offset: ",
+                locWithinAPage * sizeof(uint32_t) + locWithinAWord);
+        puthexs(" errorByte:", errorByte);
+        puthex8(" Bit: ", locWithinAByte);
+#endif
+        if (errorByte & byteMask) {
+                /* bit needs to be cleared */
+                errorByte &= ~byteMask;
+        } else {
+                /* bit needs to be set */
+                errorByte |= byteMask;
+        }
+        /* write back the value with the fixed bit */
+        datap[locWithinAPage * sizeof(uint32_t) + locWithinAWord] = errorByte;
+}
+/****************************************************************************
+*  nand_correct_page_bch - Routine to correct bit errors when reading NAND
+*
+*  PURPOSE:
+*     This routine reads the BCH registers to determine if there are any bit
+*     errors during the read of the last 512 bytes of data + ECC bytes.  If
+*     errors exists, the routine fixes it.
+*
+*  PARAMETERS:
+*     datap - Container that holds the 512 byte data
+*
+*  RETURNS:
+*     0 or greater = Number of errors corrected
+*                    (No errors are found or errors have been fixed)
+*    -1 = Error(s) cannot be fixed
+****************************************************************************/
+int nand_bcm_umi_bch_correct_page(uint8_t *datap, uint8_t *readEccData,
+                                  int numEccBytes)
+{
+        int numErrors;
+        int errorLocation;
+        int idx;
+        uint32_t regValue;
+        /* wait for read ECC to be valid */
+        regValue = nand_bcm_umi_bch_poll_read_ecc_calc();
+        /*
+         * read the control status register to determine if there
+         * are error'ed bits
+         * see if errors are correctible
+         */
+        if ((regValue & REG_UMI_BCH_CTRL_STATUS_UNCORR_ERR) > 0) {
+                int i;
+                for (i = 0; i < numEccBytes; i++) {
+                        if (readEccData[i] != 0xff) {
+                                /* errors cannot be fixed, return -1 */
+                                return -1;
+                        }
+                }
+                /* If ECC is unprogrammed then we can't correct,
+                 * assume everything OK */
+                return 0;
+        }
+        if ((regValue & REG_UMI_BCH_CTRL_STATUS_CORR_ERR) == 0) {
+                /* no errors */
+                return 0;
+        }
+        /*
+         * Fix errored bits by doing the following:
+         * 1. Read the number of errors in the control and status register
+         * 2. Read the error location registers that corresponds to the number
+         *    of errors reported
+         * 3. Invert the bit in the data
+         */
+        numErrors = (regValue & REG_UMI_BCH_CTRL_STATUS_NB_CORR_ERROR) >> 20;
+        for (idx = 0; idx < numErrors; idx++) {
+                errorLocation =
+                    REG_UMI_BCH_ERR_LOC_ADDR(idx) & REG_UMI_BCH_ERR_LOC_MASK;
+                /* Flip bit */
+                nand_bcm_umi_bch_ecc_flip_bit(datap, errorLocation);
+        }
+        /* Errors corrected */
+        return numErrors;
+}
+#endif
diff --git a/drivers/mtd/nand/nand_bcm_umi.h b/drivers/mtd/nand/nand_bcm_umi.h
new file mode 100644
index 000000000000..7cec2cd97854
--- /dev/null
+++ b/drivers/mtd/nand/nand_bcm_umi.h
@@ -0,0 +1,358 @@
+/*****************************************************************************
+* Copyright 2003 - 2009 Broadcom Corporation.  All rights reserved.
+*
+* Unless you and Broadcom execute a separate written software license
+* agreement governing use of this software, this software is licensed to you
+* under the terms of the GNU General Public License version 2, available at
+* http://www.broadcom.com/licenses/GPLv2.php (the "GPL").
+*
+* Notwithstanding the above, under no circumstances may you combine this
+* software in any way with any other Broadcom software provided under a
+* license other than the GPL, without Broadcom's express prior written
+* consent.
+*****************************************************************************/
+#ifndef NAND_BCM_UMI_H
+#define NAND_BCM_UMI_H
+/* ---- Include Files ---------------------------------------------------- */
+#include <mach/reg_umi.h>
+#include <mach/reg_nand.h>
+#include <cfg_global.h>
+/* ---- Constants and Types ---------------------------------------------- */
+#if (CFG_GLOBAL_CHIP_FAMILY == CFG_GLOBAL_CHIP_FAMILY_BCMRING)
+#define NAND_ECC_BCH (CFG_GLOBAL_CHIP_REV > 0xA0)
+#else
+#define NAND_ECC_BCH 0
+#endif
+#define CFG_GLOBAL_NAND_ECC_BCH_NUM_BYTES       13
+#if NAND_ECC_BCH
+#ifdef BOOT0_BUILD
+#define NAND_ECC_NUM_BYTES 13
+#else
+#define NAND_ECC_NUM_BYTES CFG_GLOBAL_NAND_ECC_BCH_NUM_BYTES
+#endif
+#else
+#define NAND_ECC_NUM_BYTES 3
+#endif
+#define NAND_DATA_ACCESS_SIZE 512
+/* ---- Variable Externs ------------------------------------------ */
+/* ---- Function Prototypes --------------------------------------- */
+int nand_bcm_umi_bch_correct_page(uint8_t *datap, uint8_t *readEccData,
+                                  int numEccBytes);
+/* Check in device is ready */
+static inline int nand_bcm_umi_dev_ready(void)
+{
+        return REG_UMI_NAND_RCSR & REG_UMI_NAND_RCSR_RDY;
+}
+/* Wait until device is ready */
+static inline void nand_bcm_umi_wait_till_ready(void)
+{
+        while (nand_bcm_umi_dev_ready() == 0)
+                ;
+}
+/* Enable Hamming ECC */
+static inline void nand_bcm_umi_hamming_enable_hwecc(void)
+{
+        /* disable and reset ECC, 512 byte page */
+        REG_UMI_NAND_ECC_CSR &= ~(REG_UMI_NAND_ECC_CSR_ECC_ENABLE |
+                REG_UMI_NAND_ECC_CSR_256BYTE);
+        /* enable ECC */
+        REG_UMI_NAND_ECC_CSR |= REG_UMI_NAND_ECC_CSR_ECC_ENABLE;
+}
+#if NAND_ECC_BCH
+/* BCH ECC specifics */
+#define ECC_BITS_PER_CORRECTABLE_BIT 13
+/* Enable BCH Read ECC */
+static inline void nand_bcm_umi_bch_enable_read_hwecc(void)
+{
+        /* disable and reset ECC */
+        REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID;
+        /* Turn on ECC */
+        REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN;
+}
+/* Enable BCH Write ECC */
+static inline void nand_bcm_umi_bch_enable_write_hwecc(void)
+{
+        /* disable and reset ECC */
+        REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID;
+        /* Turn on ECC */
+        REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_WR_EN;
+}
+/* Config number of BCH ECC bytes */
+static inline void nand_bcm_umi_bch_config_ecc(uint8_t numEccBytes)
+{
+        uint32_t nValue;
+        uint32_t tValue;
+        uint32_t kValue;
+        uint32_t numBits = numEccBytes * 8;
+        /* disable and reset ECC */
+        REG_UMI_BCH_CTRL_STATUS =
+            REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID |
+            REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID;
+        /* Every correctible bit requires 13 ECC bits */
+        tValue = (uint32_t) (numBits / ECC_BITS_PER_CORRECTABLE_BIT);
+        /* Total data in number of bits for generating and computing BCH ECC */
+        nValue = (NAND_DATA_ACCESS_SIZE + numEccBytes) * 8;
+        /* K parameter is used internally.  K = N - (T * 13) */
+        kValue = nValue - (tValue * ECC_BITS_PER_CORRECTABLE_BIT);
+        /* Write the settings */
+        REG_UMI_BCH_N = nValue;
+        REG_UMI_BCH_T = tValue;
+        REG_UMI_BCH_K = kValue;
+}
+/* Pause during ECC read calculation to skip bytes in OOB */
+static inline void nand_bcm_umi_bch_pause_read_ecc_calc(void)
+{
+        REG_UMI_BCH_CTRL_STATUS =
+            REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN |
+            REG_UMI_BCH_CTRL_STATUS_PAUSE_ECC_DEC;
+}
+/* Resume during ECC read calculation after skipping bytes in OOB */
+static inline void nand_bcm_umi_bch_resume_read_ecc_calc(void)
+{
+        REG_UMI_BCH_CTRL_STATUS = REG_UMI_BCH_CTRL_STATUS_ECC_RD_EN;
+}
+/* Poll read ECC calc to check when hardware completes */
+static inline uint32_t nand_bcm_umi_bch_poll_read_ecc_calc(void)
+{
+        uint32_t regVal;
+        do {
+                /* wait for ECC to be valid */
+                regVal = REG_UMI_BCH_CTRL_STATUS;
+        } while ((regVal & REG_UMI_BCH_CTRL_STATUS_RD_ECC_VALID) == 0);
+        return regVal;
+}
+/* Poll write ECC calc to check when hardware completes */
+static inline void nand_bcm_umi_bch_poll_write_ecc_calc(void)
+{
+        /* wait for ECC to be valid */
+        while ((REG_UMI_BCH_CTRL_STATUS & REG_UMI_BCH_CTRL_STATUS_WR_ECC_VALID)
+               == 0)
+                ;
+}
+/* Read the OOB and ECC, for kernel write OOB to a buffer */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+static inline void nand_bcm_umi_bch_read_oobEcc(uint32_t pageSize,
+        uint8_t *eccCalc, int numEccBytes, uint8_t *oobp)
+#else
+static inline void nand_bcm_umi_bch_read_oobEcc(uint32_t pageSize,
+        uint8_t *eccCalc, int numEccBytes)
+#endif
+{
+        int eccPos = 0;
+        int numToRead = 16;     /* There are 16 bytes per sector in the OOB */
+        /* ECC is already paused when this function is called */
+        if (pageSize == NAND_DATA_ACCESS_SIZE) {
+                while (numToRead > numEccBytes) {
+                        /* skip free oob region */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp++ = REG_NAND_DATA8;
+#else
+                        REG_NAND_DATA8;
+#endif
+                        numToRead--;
+                }
+                /* read ECC bytes before BI */
+                nand_bcm_umi_bch_resume_read_ecc_calc();
+                while (numToRead > 11) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp = REG_NAND_DATA8;
+                        eccCalc[eccPos++] = *oobp;
+                        oobp++;
+#else
+                        eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+                }
+                nand_bcm_umi_bch_pause_read_ecc_calc();
+                if (numToRead == 11) {
+                        /* read BI */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp++ = REG_NAND_DATA8;
+#else
+                        REG_NAND_DATA8;
+#endif
+                        numToRead--;
+                }
+                /* read ECC bytes */
+                nand_bcm_umi_bch_resume_read_ecc_calc();
+                while (numToRead) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp = REG_NAND_DATA8;
+                        eccCalc[eccPos++] = *oobp;
+                        oobp++;
+#else
+                        eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+                        numToRead--;
+                }
+        } else {
+                /* skip BI */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                *oobp++ = REG_NAND_DATA8;
+#else
+                REG_NAND_DATA8;
+#endif
+                numToRead--;
+                while (numToRead > numEccBytes) {
+                        /* skip free oob region */
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp++ = REG_NAND_DATA8;
+#else
+                        REG_NAND_DATA8;
+#endif
+                        numToRead--;
+                }
+                /* read ECC bytes */
+                nand_bcm_umi_bch_resume_read_ecc_calc();
+                while (numToRead) {
+#if defined(__KERNEL__) && !defined(STANDALONE)
+                        *oobp = REG_NAND_DATA8;
+                        eccCalc[eccPos++] = *oobp;
+                        oobp++;
+#else
+                        eccCalc[eccPos++] = REG_NAND_DATA8;
+#endif
+                        numToRead--;
+                }
+        }
+}
+/* Helper function to write ECC */
+static inline void NAND_BCM_UMI_ECC_WRITE(int numEccBytes, int eccBytePos,
+                                          uint8_t *oobp, uint8_t eccVal)
+{
+        if (eccBytePos <= numEccBytes)
+                *oobp = eccVal;
+}
+/* Write OOB with ECC */
+static inline void nand_bcm_umi_bch_write_oobEcc(uint32_t pageSize,
+                                                 uint8_t *oobp, int numEccBytes)
+{
+        uint32_t eccVal = 0xffffffff;
+        /* wait for write ECC to be valid */
+        nand_bcm_umi_bch_poll_write_ecc_calc();
+        /*
+         ** Get the hardware ecc from the 32-bit result registers.
+         ** Read after 512 byte accesses. Format B3B2B1B0
+         ** where B3 = ecc3, etc.
+         */
+        if (pageSize == NAND_DATA_ACCESS_SIZE) {
+                /* Now fill in the ECC bytes */
+                if (numEccBytes >= 13)
+                        eccVal = REG_UMI_BCH_WR_ECC_3;
+                /* Usually we skip CM in oob[0,1] */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 15, &oobp[0],
+                        (eccVal >> 16) & 0xff);
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 14, &oobp[1],
+                        (eccVal >> 8) & 0xff);
+                /* Write ECC in oob[2,3,4] */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 13, &oobp[2],
+                        eccVal & 0xff); /* ECC 12 */
+                if (numEccBytes >= 9)
+                        eccVal = REG_UMI_BCH_WR_ECC_2;
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 12, &oobp[3],
+                        (eccVal >> 24) & 0xff); /* ECC11 */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 11, &oobp[4],
+                        (eccVal >> 16) & 0xff); /* ECC10 */
+                /* Always Skip BI in oob[5] */
+        } else {
+                /* Always Skip BI in oob[0] */
+                /* Now fill in the ECC bytes */
+                if (numEccBytes >= 13)
+                        eccVal = REG_UMI_BCH_WR_ECC_3;
+                /* Usually skip CM in oob[1,2] */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 15, &oobp[1],
+                        (eccVal >> 16) & 0xff);
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 14, &oobp[2],
+                        (eccVal >> 8) & 0xff);
+                /* Write ECC in oob[3-15] */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 13, &oobp[3],
+                        eccVal & 0xff); /* ECC12 */
+                if (numEccBytes >= 9)
+                        eccVal = REG_UMI_BCH_WR_ECC_2;
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 12, &oobp[4],
+                        (eccVal >> 24) & 0xff); /* ECC11 */
+                NAND_BCM_UMI_ECC_WRITE(numEccBytes, 11, &oobp[5],
+                        (eccVal >> 16) & 0xff); /* ECC10 */
+        }
+        /* Fill in the remainder of ECC locations */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 10, &oobp[6],
+                (eccVal >> 8) & 0xff);  /* ECC9 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 9, &oobp[7],
+                eccVal & 0xff); /* ECC8 */
+        if (numEccBytes >= 5)
+                eccVal = REG_UMI_BCH_WR_ECC_1;
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 8, &oobp[8],
+                (eccVal >> 24) & 0xff); /* ECC7 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 7, &oobp[9],
+                (eccVal >> 16) & 0xff); /* ECC6 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 6, &oobp[10],
+                (eccVal >> 8) & 0xff);  /* ECC5 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 5, &oobp[11],
+                eccVal & 0xff); /* ECC4 */
+        if (numEccBytes >= 1)
+                eccVal = REG_UMI_BCH_WR_ECC_0;
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 4, &oobp[12],
+                (eccVal >> 24) & 0xff); /* ECC3 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 3, &oobp[13],
+                (eccVal >> 16) & 0xff); /* ECC2 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 2, &oobp[14],
+                (eccVal >> 8) & 0xff);  /* ECC1 */
+        NAND_BCM_UMI_ECC_WRITE(numEccBytes, 1, &oobp[15],
+                eccVal & 0xff); /* ECC0 */
+}
+#endif
+#endif /* NAND_BCM_UMI_H */
diff --git a/drivers/mtd/nand/nand_ecc.c b/drivers/mtd/nand/nand_ecc.c
index db7ae9d6a296..271b8e735e8f 100644
--- a/drivers/mtd/nand/nand_ecc.c
+++ b/drivers/mtd/nand/nand_ecc.c
@@ -150,20 +150,19 @@ static const char addressbits[256] = {
 };
 /**
- * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
+ * __nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
 *                       block
- * @mtd:        MTD block structure
 * @buf:        input buffer with raw data
+ * @eccsize:    data bytes per ecc step (256 or 512)
 * @code:       output buffer with ECC
 */
-int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
+void __nand_calculate_ecc(const unsigned char *buf, unsigned int eccsize,
                       unsigned char *code)
 {
        int i;
        const uint32_t *bp = (uint32_t *)buf;
        /* 256 or 512 bytes/ecc  */
-        const uint32_t eccsize_mult =
+        const uint32_t eccsize_mult = eccsize >> 8;
-                        (((struct nand_chip *)mtd->priv)->ecc.size) >> 8;
        uint32_t cur;           /* current value in buffer */
        /* rp0..rp15..rp17 are the various accumulated parities (per byte) */
        uint32_t rp0, rp1, rp2, rp3, rp4, rp5, rp6, rp7;
@@ -412,6 +411,22 @@ int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
                    (invparity[par & 0x55] << 2) |
                    (invparity[rp17] << 1) |
                    (invparity[rp16] << 0);
+}
+EXPORT_SYMBOL(__nand_calculate_ecc);
+/**
+ * nand_calculate_ecc - [NAND Interface] Calculate 3-byte ECC for 256/512-byte
+ *                       block
+ * @mtd:        MTD block structure
+ * @buf:        input buffer with raw data
+ * @code:       output buffer with ECC
+ */
+int nand_calculate_ecc(struct mtd_info *mtd, const unsigned char *buf,
+                       unsigned char *code)
+{
+        __nand_calculate_ecc(buf,
+                        ((struct nand_chip *)mtd->priv)->ecc.size, code);
        return 0;
 }
 EXPORT_SYMBOL(nand_calculate_ecc);
@@ -475,7 +490,7 @@ int __nand_correct_data(unsigned char *buf,
                 *
                 * The b2 shift is there to get rid of the lowest two bits.
                 * We could also do addressbits[b2] >> 1 but for the
-                 * performace it does not make any difference
+                 * performance it does not make any difference
                 */
                if (eccsize_mult == 1)
                        byte_addr = (addressbits[b1] << 4) + addressbits[b0];
diff --git a/drivers/mtd/nand/nandsim.c b/drivers/mtd/nand/nandsim.c
index cd0711b83ac4..7281000fef2d 100644
--- a/drivers/mtd/nand/nandsim.c
+++ b/drivers/mtd/nand/nandsim.c
@@ -161,7 +161,7 @@ MODULE_PARM_DESC(overridesize,   "Specifies the NAND Flash size overriding the I
 MODULE_PARM_DESC(cache_file,     "File to use to cache nand pages instead of memory");
 /* The largest possible page size */
-#define NS_LARGEST_PAGE_SIZE    2048
+#define NS_LARGEST_PAGE_SIZE    4096
 /* The prefix for simulator output */
 #define NS_OUTPUT_PREFIX "[nandsim]"
@@ -259,7 +259,8 @@ MODULE_PARM_DESC(cache_file,     "File to use to cache nand pages instead of mem
 #define OPT_SMARTMEDIA   0x00000010 /* SmartMedia technology chips */
 #define OPT_AUTOINCR     0x00000020 /* page number auto inctimentation is possible */
 #define OPT_PAGE512_8BIT 0x00000040 /* 512-byte page chips with 8-bit bus width */
-#define OPT_LARGEPAGE    (OPT_PAGE2048) /* 2048-byte page chips */
+#define OPT_PAGE4096     0x00000080 /* 4096-byte page chips */
+#define OPT_LARGEPAGE    (OPT_PAGE2048 | OPT_PAGE4096) /* 2048 & 4096-byte page chips */
 #define OPT_SMALLPAGE    (OPT_PAGE256  | OPT_PAGE512)  /* 256 and 512-byte page chips */
 /* Remove action bits ftom state */
@@ -588,6 +589,8 @@ static int init_nandsim(struct mtd_info *mtd)
                        ns->options |= OPT_PAGE512_8BIT;
        } else if (ns->geom.pgsz == 2048) {
                ns->options |= OPT_PAGE2048;
+        } else if (ns->geom.pgsz == 4096) {
+                ns->options |= OPT_PAGE4096;
        } else {
                NS_ERR("init_nandsim: unknown page size %u\n", ns->geom.pgsz);
                return -EIO;
diff --git a/drivers/mtd/nand/ndfc.c b/drivers/mtd/nand/ndfc.c
index 40b5658bdbe6..b983cae8c298 100644
--- a/drivers/mtd/nand/ndfc.c
+++ b/drivers/mtd/nand/ndfc.c
@@ -28,6 +28,7 @@
 #include <linux/mtd/nand_ecc.h>
 #include <linux/mtd/partitions.h>
 #include <linux/mtd/ndfc.h>
+#include <linux/slab.h>
 #include <linux/mtd/mtd.h>
 #include <linux/of_platform.h>
 #include <asm/io.h>
diff --git a/drivers/mtd/nand/nomadik_nand.c b/drivers/mtd/nand/nomadik_nand.c
index 7c302d55910e..1f6f741af5da 100644
--- a/drivers/mtd/nand/nomadik_nand.c
+++ b/drivers/mtd/nand/nomadik_nand.c
@@ -30,6 +30,7 @@
 #include <linux/platform_device.h>
 #include <linux/mtd/partitions.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <mach/nand.h>
 #include <mach/fsmc.h>
@@ -216,7 +217,7 @@ static int nomadik_nand_resume(struct device *dev)
        return 0;
 }
-static struct dev_pm_ops nomadik_nand_pm_ops = {
+static const struct dev_pm_ops nomadik_nand_pm_ops = {
        .suspend = nomadik_nand_suspend,
        .resume = nomadik_nand_resume,
 };
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 090ab87086b5..7545568fce47 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -17,10 +17,11 @@
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
 #include <linux/io.h>
+#include <linux/slab.h>
-#include <mach/dma.h>
+#include <plat/dma.h>
-#include <mach/gpmc.h>
+#include <plat/gpmc.h>
-#include <mach/nand.h>
+#include <plat/nand.h>
 #define GPMC_IRQ_STATUS         0x18
 #define GPMC_ECC_CONFIG         0x1F4
@@ -30,12 +31,8 @@
 #define DRIVER_NAME     "omap2-nand"
-/* size (4 KiB) for IO mapping */
-#define NAND_IO_SIZE    SZ_4K
 #define NAND_WP_OFF     0
 #define NAND_WP_BIT     0x00000010
-#define WR_RD_PIN_MONITORING    0x00600000
 #define GPMC_BUF_FULL   0x00000001
 #define GPMC_BUF_EMPTY  0x00000000
@@ -882,8 +879,6 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
        struct omap_nand_info           *info;
        struct omap_nand_platform_data  *pdata;
        int                             err;
-        unsigned long                   val;
        pdata = pdev->dev.platform_data;
        if (pdata == NULL) {
@@ -905,28 +900,14 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
        info->gpmc_cs           = pdata->cs;
        info->gpmc_baseaddr     = pdata->gpmc_baseaddr;
        info->gpmc_cs_baseaddr  = pdata->gpmc_cs_baseaddr;
+        info->phys_base         = pdata->phys_base;
        info->mtd.priv          = &info->nand;
        info->mtd.name          = dev_name(&pdev->dev);
        info->mtd.owner         = THIS_MODULE;
-        err = gpmc_cs_request(info->gpmc_cs, NAND_IO_SIZE, &info->phys_base);
+        info->nand.options      |= pdata->devsize ? NAND_BUSWIDTH_16 : 0;
-        if (err < 0) {
+        info->nand.options      |= NAND_SKIP_BBTSCAN;
-                dev_err(&pdev->dev, "Cannot request GPMC CS\n");
-                goto out_free_info;
-        }
-        /* Enable RD PIN Monitoring Reg */
-        if (pdata->dev_ready) {
-                val  = gpmc_cs_read_reg(info->gpmc_cs, GPMC_CS_CONFIG1);
-                val |= WR_RD_PIN_MONITORING;
-                gpmc_cs_write_reg(info->gpmc_cs, GPMC_CS_CONFIG1, val);
-        }
-        val  = gpmc_cs_read_reg(info->gpmc_cs, GPMC_CS_CONFIG7);
-        val &= ~(0xf << 8);
-        val |=  (0xc & 0xf) << 8;
-        gpmc_cs_write_reg(info->gpmc_cs, GPMC_CS_CONFIG7, val);
        /* NAND write protect off */
        omap_nand_wp(&info->mtd, NAND_WP_OFF);
@@ -934,7 +915,7 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
        if (!request_mem_region(info->phys_base, NAND_IO_SIZE,
                                pdev->dev.driver->name)) {
                err = -EBUSY;
-                goto out_free_cs;
+                goto out_free_info;
        }
        info->nand.IO_ADDR_R = ioremap(info->phys_base, NAND_IO_SIZE);
@@ -963,11 +944,6 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
                info->nand.chip_delay = 50;
        }
-        info->nand.options  |= NAND_SKIP_BBTSCAN;
-        if ((gpmc_cs_read_reg(info->gpmc_cs, GPMC_CS_CONFIG1) & 0x3000)
-                                                                == 0x1000)
-                info->nand.options  |= NAND_BUSWIDTH_16;
        if (use_prefetch) {
                /* copy the virtual address of nand base for fifo access */
                info->nand_pref_fifo_add = info->nand.IO_ADDR_R;
@@ -1043,8 +1019,6 @@ static int __devinit omap_nand_probe(struct platform_device *pdev)
 out_release_mem_region:
        release_mem_region(info->phys_base, NAND_IO_SIZE);
-out_free_cs:
-        gpmc_cs_free(info->gpmc_cs);
 out_free_info:
        kfree(info);
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index f59c07427af3..d60fc5719fef 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -60,7 +60,13 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
        }
        buf64 = (uint64_t *)buf;
        while (i < len/8) {
-                uint64_t x;
+                /*
+                 * Since GCC has no proper constraint (PR 43518)
+                 * force x variable to r2/r3 registers as ldrd instruction
+                 * requires first register to be even.
+                 */
+                register uint64_t x asm ("r2");
                asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                buf64[i++] = x;
        }
diff --git a/drivers/mtd/nand/plat_nand.c b/drivers/mtd/nand/plat_nand.c
index 4e16c6f5bdd5..8d467315f02b 100644
--- a/drivers/mtd/nand/plat_nand.c
+++ b/drivers/mtd/nand/plat_nand.c
@@ -34,7 +34,12 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
 {
        struct platform_nand_data *pdata = pdev->dev.platform_data;
        struct plat_nand_data *data;
-        int res = 0;
+        struct resource *res;
+        int err = 0;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        if (!res)
+                return -ENXIO;
        /* Allocate memory for the device structure (and zero it) */
        data = kzalloc(sizeof(struct plat_nand_data), GFP_KERNEL);
@@ -43,12 +48,18 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
                return -ENOMEM;
        }
-        data->io_base = ioremap(pdev->resource[0].start,
+        if (!request_mem_region(res->start, resource_size(res),
-                                pdev->resource[0].end - pdev->resource[0].start + 1);
+                                dev_name(&pdev->dev))) {
+                dev_err(&pdev->dev, "request_mem_region failed\n");
+                err = -EBUSY;
+                goto out_free;
+        }
+        data->io_base = ioremap(res->start, resource_size(res));
        if (data->io_base == NULL) {
                dev_err(&pdev->dev, "ioremap failed\n");
-                kfree(data);
+                err = -EIO;
-                return -EIO;
+                goto out_release_io;
        }
        data->chip.priv = &data;
@@ -74,24 +85,24 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
        /* Handle any platform specific setup */
        if (pdata->ctrl.probe) {
-                res = pdata->ctrl.probe(pdev);
+                err = pdata->ctrl.probe(pdev);
-                if (res)
+                if (err)
                        goto out;
        }
        /* Scan to find existance of the device */
        if (nand_scan(&data->mtd, 1)) {
-                res = -ENXIO;
+                err = -ENXIO;
                goto out;
        }
 #ifdef CONFIG_MTD_PARTITIONS
        if (pdata->chip.part_probe_types) {
-                res = parse_mtd_partitions(&data->mtd,
+                err = parse_mtd_partitions(&data->mtd,
                                        pdata->chip.part_probe_types,
                                        &data->parts, 0);
-                if (res > 0) {
+                if (err > 0) {
-                        add_mtd_partitions(&data->mtd, data->parts, res);
+                        add_mtd_partitions(&data->mtd, data->parts, err);
                        return 0;
                }
        }
@@ -99,14 +110,14 @@ static int __devinit plat_nand_probe(struct platform_device *pdev)
                pdata->chip.set_parts(data->mtd.size, &pdata->chip);
        if (pdata->chip.partitions) {
                data->parts = pdata->chip.partitions;
-                res = add_mtd_partitions(&data->mtd, data->parts,
+                err = add_mtd_partitions(&data->mtd, data->parts,
                        pdata->chip.nr_partitions);
        } else
 #endif
-        res = add_mtd_device(&data->mtd);
+        err = add_mtd_device(&data->mtd);
-        if (!res)
+        if (!err)
-                return res;
+                return err;
        nand_release(&data->mtd);
 out:
@@ -114,8 +125,11 @@ out:
                pdata->ctrl.remove(pdev);
        platform_set_drvdata(pdev, NULL);
        iounmap(data->io_base);
+out_release_io:
+        release_mem_region(res->start, resource_size(res));
+out_free:
        kfree(data);
-        return res;
+        return err;
 }
 /*
@@ -125,6 +139,9 @@ static int __devexit plat_nand_remove(struct platform_device *pdev)
 {
        struct plat_nand_data *data = platform_get_drvdata(pdev);
        struct platform_nand_data *pdata = pdev->dev.platform_data;
+        struct resource *res;
+        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        nand_release(&data->mtd);
 #ifdef CONFIG_MTD_PARTITIONS
@@ -134,6 +151,7 @@ static int __devexit plat_nand_remove(struct platform_device *pdev)
        if (pdata->ctrl.remove)
                pdata->ctrl.remove(pdev);
        iounmap(data->io_base);
+        release_mem_region(res->start, resource_size(res));
        kfree(data);
        return 0;
diff --git a/drivers/mtd/nand/pxa3xx_nand.c b/drivers/mtd/nand/pxa3xx_nand.c
index 6ea520ae2410..5d55152162cf 100644
--- a/drivers/mtd/nand/pxa3xx_nand.c
+++ b/drivers/mtd/nand/pxa3xx_nand.c
@@ -9,6 +9,7 @@
 * published by the Free Software Foundation.
 */
+#include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/interrupt.h>
 #include <linux/platform_device.h>
@@ -20,9 +21,10 @@
 #include <linux/mtd/partitions.h>
 #include <linux/io.h>
 #include <linux/irq.h>
+#include <linux/slab.h>
 #include <mach/dma.h>
-#include <mach/pxa3xx_nand.h>
+#include <plat/pxa3xx_nand.h>
 #define CHIP_DELAY_TIMEOUT      (2 * HZ/10)
@@ -84,10 +86,6 @@
 #define NDCB0_CMD1_MASK         (0xff)
 #define NDCB0_ADDR_CYC_SHIFT    (16)
-/* dma-able I/O address for the NAND data and commands */
-#define NDCB0_DMA_ADDR          (0x43100048)
-#define NDDB_DMA_ADDR           (0x43100040)
 /* macros for registers read/write */
 #define nand_writel(info, off, val)     \
        __raw_writel((val), (info)->mmio_base + (off))
@@ -123,6 +121,7 @@ struct pxa3xx_nand_info {
        struct clk              *clk;
        void __iomem            *mmio_base;
+        unsigned long           mmio_phys;
        unsigned int            buf_start;
        unsigned int            buf_count;
@@ -228,13 +227,35 @@ static struct pxa3xx_nand_flash samsung512MbX16 = {
        .chip_id        = 0x46ec,
 };
+static struct pxa3xx_nand_flash samsung2GbX8 = {
+        .timing         = &samsung512MbX16_timing,
+        .cmdset         = &smallpage_cmdset,
+        .page_per_block = 64,
+        .page_size      = 2048,
+        .flash_width    = 8,
+        .dfc_width      = 8,
+        .num_blocks     = 2048,
+        .chip_id        = 0xdaec,
+};
+static struct pxa3xx_nand_flash samsung32GbX8 = {
+        .timing         = &samsung512MbX16_timing,
+        .cmdset         = &smallpage_cmdset,
+        .page_per_block = 128,
+        .page_size      = 4096,
+        .flash_width    = 8,
+        .dfc_width      = 8,
+        .num_blocks     = 8192,
+        .chip_id        = 0xd7ec,
+};
 static struct pxa3xx_nand_timing micron_timing = {
        .tCH    = 10,
        .tCS    = 25,
        .tWH    = 15,
        .tWP    = 25,
        .tRH    = 15,
-        .tRP    = 25,
+        .tRP    = 30,
        .tR     = 25000,
        .tWHR   = 60,
        .tAR    = 10,
@@ -262,6 +283,28 @@ static struct pxa3xx_nand_flash micron1GbX16 = {
        .chip_id        = 0xb12c,
 };
+static struct pxa3xx_nand_flash micron4GbX8 = {
+        .timing         = &micron_timing,
+        .cmdset         = &largepage_cmdset,
+        .page_per_block = 64,
+        .page_size      = 2048,
+        .flash_width    = 8,
+        .dfc_width      = 8,
+        .num_blocks     = 4096,
+        .chip_id        = 0xdc2c,
+};
+static struct pxa3xx_nand_flash micron4GbX16 = {
+        .timing         = &micron_timing,
+        .cmdset         = &largepage_cmdset,
+        .page_per_block = 64,
+        .page_size      = 2048,
+        .flash_width    = 16,
+        .dfc_width      = 16,
+        .num_blocks     = 4096,
+        .chip_id        = 0xcc2c,
+};
 static struct pxa3xx_nand_timing stm2GbX16_timing = {
        .tCH = 10,
        .tCS = 35,
@@ -287,8 +330,12 @@ static struct pxa3xx_nand_flash stm2GbX16 = {
 static struct pxa3xx_nand_flash *builtin_flash_types[] = {
        &samsung512MbX16,
+        &samsung2GbX8,
+        &samsung32GbX8,
        &micron1GbX8,
        &micron1GbX16,
+        &micron4GbX8,
+        &micron4GbX16,
        &stm2GbX16,
 };
 #endif /* CONFIG_MTD_NAND_PXA3xx_BUILTIN */
@@ -489,7 +536,7 @@ static int handle_data_pio(struct pxa3xx_nand_info *info)
        switch (info->state) {
        case STATE_PIO_WRITING:
                __raw_writesl(info->mmio_base + NDDB, info->data_buff,
-                                info->data_size << 2);
+                                DIV_ROUND_UP(info->data_size, 4));
                enable_int(info, NDSR_CS0_BBD | NDSR_CS0_CMDD);
@@ -501,7 +548,7 @@ static int handle_data_pio(struct pxa3xx_nand_info *info)
                break;
        case STATE_PIO_READING:
                __raw_readsl(info->mmio_base + NDDB, info->data_buff,
-                                info->data_size << 2);
+                                DIV_ROUND_UP(info->data_size, 4));
                break;
        default:
                printk(KERN_ERR "%s: invalid state %d\n", __func__,
@@ -523,11 +570,11 @@ static void start_data_dma(struct pxa3xx_nand_info *info, int dir_out)
        if (dir_out) {
                desc->dsadr = info->data_buff_phys;
-                desc->dtadr = NDDB_DMA_ADDR;
+                desc->dtadr = info->mmio_phys + NDDB;
                desc->dcmd |= DCMD_INCSRCADDR | DCMD_FLOWTRG;
        } else {
                desc->dtadr = info->data_buff_phys;
-                desc->dsadr = NDDB_DMA_ADDR;
+                desc->dsadr = info->mmio_phys + NDDB;
                desc->dcmd |= DCMD_INCTRGADDR | DCMD_FLOWSRC;
        }
@@ -669,6 +716,7 @@ static void pxa3xx_nand_cmdfunc(struct mtd_info *mtd, unsigned command,
                /* disable HW ECC to get all the OOB data */
                info->buf_count = mtd->writesize + mtd->oobsize;
                info->buf_start = mtd->writesize + column;
+                memset(info->data_buff, 0xFF, info->buf_count);
                if (prepare_read_prog_cmd(info, cmdset->read1, column, page_addr))
                        break;
@@ -1239,13 +1287,17 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
                ret = -ENODEV;
                goto fail_free_res;
        }
+        info->mmio_phys = r->start;
        ret = pxa3xx_nand_init_buff(info);
        if (ret)
                goto fail_free_io;
-        ret = request_irq(IRQ_NAND, pxa3xx_nand_irq, IRQF_DISABLED,
+        /* initialize all interrupts to be disabled */
-                                pdev->name, info);
+        disable_int(info, NDSR_MASK);
+        ret = request_irq(irq, pxa3xx_nand_irq, IRQF_DISABLED,
+                          pdev->name, info);
        if (ret < 0) {
                dev_err(&pdev->dev, "failed to request IRQ\n");
                goto fail_free_buf;
@@ -1271,7 +1323,7 @@ static int pxa3xx_nand_probe(struct platform_device *pdev)
        return add_mtd_partitions(mtd, pdata->parts, pdata->nr_parts);
 fail_free_irq:
-        free_irq(IRQ_NAND, info);
+        free_irq(irq, info);
 fail_free_buf:
        if (use_dma) {
                pxa_free_dma(info->data_dma_ch);
@@ -1296,12 +1348,15 @@ static int pxa3xx_nand_remove(struct platform_device *pdev)
        struct mtd_info *mtd = platform_get_drvdata(pdev);
        struct pxa3xx_nand_info *info = mtd->priv;
        struct resource *r;
+        int irq;
        platform_set_drvdata(pdev, NULL);
        del_mtd_device(mtd);
        del_mtd_partitions(mtd);
-        free_irq(IRQ_NAND, info);
+        irq = platform_get_irq(pdev, 0);
+        if (irq >= 0)
+                free_irq(irq, info);
        if (use_dma) {
                pxa_free_dma(info->data_dma_ch);
                dma_free_writecombine(&pdev->dev, info->data_buff_size,
diff --git a/drivers/mtd/nand/s3c2410.c b/drivers/mtd/nand/s3c2410.c
index 11dc7e69c4fb..fa6e9c7fe511 100644
--- a/drivers/mtd/nand/s3c2410.c
+++ b/drivers/mtd/nand/s3c2410.c
@@ -774,7 +774,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
        chip->select_chip  = s3c2410_nand_select_chip;
        chip->chip_delay   = 50;
        chip->priv         = nmtd;
-        chip->options      = 0;
+        chip->options      = set->options;
        chip->controller   = &info->controller;
        switch (info->cpu_type) {
@@ -875,7 +875,7 @@ static void s3c2410_nand_init_chip(struct s3c2410_nand_info *info,
 * @info: The controller instance.
 * @nmtd: The driver version of the MTD instance.
 *
- * This routine is called after the chip probe has succesfully completed
+ * This routine is called after the chip probe has successfully completed
 * and the relevant per-chip information updated. This call ensure that
 * we update the internal state accordingly.
 *
diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c
index 02bef21f2e4b..34752fce0793 100644
--- a/drivers/mtd/nand/sh_flctl.c
+++ b/drivers/mtd/nand/sh_flctl.c
@@ -1,10 +1,10 @@
 /*
 * SuperH FLCTL nand controller
 *
- * Copyright © 2008 Renesas Solutions Corp.
+ * Copyright (c) 2008 Renesas Solutions Corp.
- * Copyright © 2008 Atom Create Engineering Co., Ltd.
+ * Copyright (c) 2008 Atom Create Engineering Co., Ltd.
 *
- * Based on fsl_elbc_nand.c, Copyright © 2006-2007 Freescale Semiconductor
+ * Based on fsl_elbc_nand.c, Copyright (c) 2006-2007 Freescale Semiconductor
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
@@ -26,6 +26,7 @@
 #include <linux/delay.h>
 #include <linux/io.h>
 #include <linux/platform_device.h>
+#include <linux/slab.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
@@ -75,6 +76,11 @@ static void start_translation(struct sh_flctl *flctl)
        writeb(TRSTRT, FLTRCR(flctl));
 }
+static void timeout_error(struct sh_flctl *flctl, const char *str)
+{
+        dev_err(&flctl->pdev->dev, "Timeout occured in %s\n", str);
+}
 static void wait_completion(struct sh_flctl *flctl)
 {
        uint32_t timeout = LOOP_TIMEOUT_MAX;
@@ -87,7 +93,7 @@ static void wait_completion(struct sh_flctl *flctl)
                udelay(1);
        }
-        printk(KERN_ERR "wait_completion(): Timeout occured \n");
+        timeout_error(flctl, __func__);
        writeb(0x0, FLTRCR(flctl));
 }
@@ -100,6 +106,8 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr)
                addr = page_addr;       /* ERASE1 */
        } else if (page_addr != -1) {
                /* SEQIN, READ0, etc.. */
+                if (flctl->chip.options & NAND_BUSWIDTH_16)
+                        column >>= 1;
                if (flctl->page_size) {
                        addr = column & 0x0FFF;
                        addr |= (page_addr & 0xff) << 16;
@@ -132,7 +140,7 @@ static void wait_rfifo_ready(struct sh_flctl *flctl)
                        return;
                udelay(1);
        }
-        printk(KERN_ERR "wait_rfifo_ready(): Timeout occured \n");
+        timeout_error(flctl, __func__);
 }
 static void wait_wfifo_ready(struct sh_flctl *flctl)
@@ -146,7 +154,7 @@ static void wait_wfifo_ready(struct sh_flctl *flctl)
                        return;
                udelay(1);
        }
-        printk(KERN_ERR "wait_wfifo_ready(): Timeout occured \n");
+        timeout_error(flctl, __func__);
 }
 static int wait_recfifo_ready(struct sh_flctl *flctl, int sector_number)
@@ -198,7 +206,7 @@ static int wait_recfifo_ready(struct sh_flctl *flctl, int sector_number)
                writel(0, FL4ECCCR(flctl));
        }
-        printk(KERN_ERR "wait_recfifo_ready(): Timeout occured \n");
+        timeout_error(flctl, __func__);
        return 1;       /* timeout */
 }
@@ -214,7 +222,7 @@ static void wait_wecfifo_ready(struct sh_flctl *flctl)
                        return;
                udelay(1);
        }
-        printk(KERN_ERR "wait_wecfifo_ready(): Timeout occured \n");
+        timeout_error(flctl, __func__);
 }
 static void read_datareg(struct sh_flctl *flctl, int offset)
@@ -275,7 +283,7 @@ static void write_fiforeg(struct sh_flctl *flctl, int rlen, int offset)
 static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_val)
 {
        struct sh_flctl *flctl = mtd_to_flctl(mtd);
-        uint32_t flcmncr_val = readl(FLCMNCR(flctl));
+        uint32_t flcmncr_val = readl(FLCMNCR(flctl)) & ~SEL_16BIT;
        uint32_t flcmdcr_val, addr_len_bytes = 0;
        /* Set SNAND bit if page size is 2048byte */
@@ -297,6 +305,8 @@ static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_va
        case NAND_CMD_READOOB:
                addr_len_bytes = flctl->rw_ADRCNT;
                flcmdcr_val |= CDSRC_E;
+                if (flctl->chip.options & NAND_BUSWIDTH_16)
+                        flcmncr_val |= SEL_16BIT;
                break;
        case NAND_CMD_SEQIN:
                /* This case is that cmd is READ0 or READ1 or READ00 */
@@ -305,6 +315,8 @@ static void set_cmd_regs(struct mtd_info *mtd, uint32_t cmd, uint32_t flcmcdr_va
        case NAND_CMD_PAGEPROG:
                addr_len_bytes = flctl->rw_ADRCNT;
                flcmdcr_val |= DOCMD2_E | CDSRC_E | SELRW;
+                if (flctl->chip.options & NAND_BUSWIDTH_16)
+                        flcmncr_val |= SEL_16BIT;
                break;
        case NAND_CMD_READID:
                flcmncr_val &= ~SNAND_E;
@@ -523,6 +535,8 @@ static void flctl_cmdfunc(struct mtd_info *mtd, unsigned int command,
                set_addr(mtd, 0, page_addr);
                flctl->read_bytes = mtd->writesize + mtd->oobsize;
+                if (flctl->chip.options & NAND_BUSWIDTH_16)
+                        column >>= 1;
                flctl->index += column;
                goto read_normal_exit;
@@ -686,6 +700,18 @@ static uint8_t flctl_read_byte(struct mtd_info *mtd)
        return data;
 }
+static uint16_t flctl_read_word(struct mtd_info *mtd)
+{
+       struct sh_flctl *flctl = mtd_to_flctl(mtd);
+       int index = flctl->index;
+       uint16_t data;
+       uint16_t *buf = (uint16_t *)&flctl->done_buff[index];
+       data = *buf;
+       flctl->index += 2;
+       return data;
+}
 static void flctl_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
 {
        int i;
@@ -769,38 +795,36 @@ static int flctl_chip_init_tail(struct mtd_info *mtd)
        return 0;
 }
-static int __init flctl_probe(struct platform_device *pdev)
+static int __devinit flctl_probe(struct platform_device *pdev)
 {
        struct resource *res;
        struct sh_flctl *flctl;
        struct mtd_info *flctl_mtd;
        struct nand_chip *nand;
        struct sh_flctl_platform_data *pdata;
-        int ret;
+        int ret = -ENXIO;
        pdata = pdev->dev.platform_data;
        if (pdata == NULL) {
-                printk(KERN_ERR "sh_flctl platform_data not found.\n");
+                dev_err(&pdev->dev, "no platform data defined\n");
-                return -ENODEV;
+                return -EINVAL;
        }
        flctl = kzalloc(sizeof(struct sh_flctl), GFP_KERNEL);
        if (!flctl) {
-                printk(KERN_ERR "Unable to allocate NAND MTD dev structure.\n");
+                dev_err(&pdev->dev, "failed to allocate driver data\n");
                return -ENOMEM;
        }
        res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
        if (!res) {
-                printk(KERN_ERR "%s: resource not found.\n", __func__);
+                dev_err(&pdev->dev, "failed to get I/O memory\n");
-                ret = -ENODEV;
                goto err;
        }
-        flctl->reg = ioremap(res->start, res->end - res->start + 1);
+        flctl->reg = ioremap(res->start, resource_size(res));
        if (flctl->reg == NULL) {
-                printk(KERN_ERR "%s: ioremap error.\n", __func__);
+                dev_err(&pdev->dev, "failed to remap I/O memory\n");
-                ret = -ENOMEM;
                goto err;
        }
@@ -808,6 +832,7 @@ static int __init flctl_probe(struct platform_device *pdev)
        flctl_mtd = &flctl->mtd;
        nand = &flctl->chip;
        flctl_mtd->priv = nand;
+        flctl->pdev = pdev;
        flctl->hwecc = pdata->has_hwecc;
        flctl_register_init(flctl, pdata->flcmncr_val);
@@ -825,6 +850,11 @@ static int __init flctl_probe(struct platform_device *pdev)
        nand->select_chip = flctl_select_chip;
        nand->cmdfunc = flctl_cmdfunc;
+        if (pdata->flcmncr_val & SEL_16BIT) {
+                nand->options |= NAND_BUSWIDTH_16;
+                nand->read_word = flctl_read_word;
+        }
        ret = nand_scan_ident(flctl_mtd, 1);
        if (ret)
                goto err;
@@ -846,7 +876,7 @@ err:
        return ret;
 }
-static int __exit flctl_remove(struct platform_device *pdev)
+static int __devexit flctl_remove(struct platform_device *pdev)
 {
        struct sh_flctl *flctl = platform_get_drvdata(pdev);
diff --git a/drivers/mtd/nand/tmio_nand.c b/drivers/mtd/nand/tmio_nand.c
index 92c73344a669..fa28f01ae009 100644
--- a/drivers/mtd/nand/tmio_nand.c
+++ b/drivers/mtd/nand/tmio_nand.c
@@ -37,6 +37,7 @@
 #include <linux/mtd/nand.h>
 #include <linux/mtd/nand_ecc.h>
 #include <linux/mtd/partitions.h>
+#include <linux/slab.h>
 /*--------------------------------------------------------------------------*/
diff --git a/drivers/mtd/nand/txx9ndfmc.c b/drivers/mtd/nand/txx9ndfmc.c
index 73af8324d0d0..863513c3b69a 100644
--- a/drivers/mtd/nand/txx9ndfmc.c
+++ b/drivers/mtd/nand/txx9ndfmc.c
@@ -429,11 +429,10 @@ static int __exit txx9ndfmc_remove(struct platform_device *dev)
                chip = mtd->priv;
                txx9_priv = chip->priv;
+                nand_release(mtd);
 #ifdef CONFIG_MTD_PARTITIONS
-                del_mtd_partitions(mtd);
                kfree(drvdata->parts[i]);
 #endif
-                del_mtd_device(mtd);
                kfree(txx9_priv->mtdname);
                kfree(txx9_priv);
        }
diff --git a/drivers/mtd/ofpart.c b/drivers/mtd/ofpart.c
index 62d6a78c4eee..4f0d635674f3 100644
--- a/drivers/mtd/ofpart.c
+++ b/drivers/mtd/ofpart.c
@@ -17,6 +17,7 @@
 #include <linux/init.h>
 #include <linux/of.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/mtd/partitions.h>
 int __devinit of_mtd_parse_partitions(struct device *dev,
diff --git a/drivers/mtd/onenand/Kconfig b/drivers/mtd/onenand/Kconfig
index a38f580c2bb3..3a9f15784600 100644
--- a/drivers/mtd/onenand/Kconfig
+++ b/drivers/mtd/onenand/Kconfig
@@ -1,7 +1,3 @@
-#
-# linux/drivers/mtd/onenand/Kconfig
-#
 menuconfig MTD_ONENAND
        tristate "OneNAND Device Support"
        depends on MTD
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index 0108ed42e877..fd406348fdfd 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -34,15 +34,16 @@
 #include <linux/delay.h>
 #include <linux/dma-mapping.h>
 #include <linux/io.h>
+#include <linux/slab.h>
 #include <asm/mach/flash.h>
-#include <mach/gpmc.h>
+#include <plat/gpmc.h>
-#include <mach/onenand.h>
+#include <plat/onenand.h>
 #include <mach/gpio.h>
-#include <mach/dma.h>
+#include <plat/dma.h>
-#include <mach/board.h>
+#include <plat/board.h>
 #define DRIVER_NAME "omap2-onenand"
@@ -112,10 +113,24 @@ static int omap2_onenand_wait(struct mtd_info *mtd, int state)
        unsigned long timeout;
        u32 syscfg;
-        if (state == FL_RESETING) {
+        if (state == FL_RESETING || state == FL_PREPARING_ERASE ||
-                int i;
+            state == FL_VERIFYING_ERASE) {
+                int i = 21;
+                unsigned int intr_flags = ONENAND_INT_MASTER;
-                for (i = 0; i < 20; i++) {
+                switch (state) {
+                case FL_RESETING:
+                        intr_flags |= ONENAND_INT_RESET;
+                        break;
+                case FL_PREPARING_ERASE:
+                        intr_flags |= ONENAND_INT_ERASE;
+                        break;
+                case FL_VERIFYING_ERASE:
+                        i = 101;
+                        break;
+                }
+                while (--i) {
                        udelay(1);
                        intr = read_reg(c, ONENAND_REG_INTERRUPT);
                        if (intr & ONENAND_INT_MASTER)
@@ -126,7 +141,7 @@ static int omap2_onenand_wait(struct mtd_info *mtd, int state)
                        wait_err("controller error", state, ctrl, intr);
                        return -EIO;
                }
-                if (!(intr & ONENAND_INT_RESET)) {
+                if ((intr & intr_flags) != intr_flags) {
                        wait_err("timeout", state, ctrl, intr);
                        return -EIO;
                }
diff --git a/drivers/mtd/onenand/onenand_base.c b/drivers/mtd/onenand/onenand_base.c
index ff66e4330aa7..32f0ed33afe0 100644
--- a/drivers/mtd/onenand/onenand_base.c
+++ b/drivers/mtd/onenand/onenand_base.c
@@ -1,17 +1,19 @@
 /*
 *  linux/drivers/mtd/onenand/onenand_base.c
 *
- *  Copyright (C) 2005-2007 Samsung Electronics
+ *  Copyright © 2005-2009 Samsung Electronics
+ *  Copyright © 2007 Nokia Corporation
+ *
 *  Kyungmin Park <kyungmin.park@samsung.com>
 *
 *  Credits:
 *      Adrian Hunter <ext-adrian.hunter@nokia.com>:
 *      auto-placement support, read-while load support, various fixes
- *      Copyright (C) Nokia Corporation, 2007
 *
 *      Vishak G <vishak.g at samsung.com>, Rohit Hagargundgi <h.rohit at samsung.com>
 *      Flex-OneNAND support
- *      Copyright (C) Samsung Electronics, 2008
+ *      Amul Kumar Saha <amul.saha at samsung.com>
+ *      OTP support
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
@@ -21,6 +23,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/moduleparam.h>
+#include <linux/slab.h>
 #include <linux/init.h>
 #include <linux/sched.h>
 #include <linux/delay.h>
@@ -32,6 +35,13 @@
 #include <asm/io.h>
+/*
+ * Multiblock erase if number of blocks to erase is 2 or more.
+ * Maximum number of blocks for simultaneous erase is 64.
+ */
+#define MB_ERASE_MIN_BLK_COUNT 2
+#define MB_ERASE_MAX_BLK_COUNT 64
 /* Default Flex-OneNAND boundary and lock respectively */
 static int flex_bdry[MAX_DIES * 2] = { -1, 0, -1, 0 };
@@ -43,6 +53,18 @@ MODULE_PARM_DESC(flex_bdry,	"SLC Boundary information for Flex-OneNAND"
                                "    : 0->Set boundary in unlocked status"
                                "    : 1->Set boundary in locked status");
+/* Default OneNAND/Flex-OneNAND OTP options*/
+static int otp;
+module_param(otp, int, 0400);
+MODULE_PARM_DESC(otp,   "Corresponding behaviour of OneNAND in OTP"
+                        "Syntax : otp=LOCK_TYPE"
+                        "LOCK_TYPE : Keys issued, for specific OTP Lock type"
+                        "          : 0 -> Default (No Blocks Locked)"
+                        "          : 1 -> OTP Block lock"
+                        "          : 2 -> 1st Block lock"
+                        "          : 3 -> BOTH OTP Block and 1st Block lock");
 /**
 *  onenand_oob_128 - oob info for Flex-Onenand with 4KB page
 *  For now, we expose only 64 out of 80 ecc bytes
@@ -339,6 +361,8 @@ static int onenand_command(struct mtd_info *mtd, int cmd, loff_t addr, size_t le
                break;
        case ONENAND_CMD_ERASE:
+        case ONENAND_CMD_MULTIBLOCK_ERASE:
+        case ONENAND_CMD_ERASE_VERIFY:
        case ONENAND_CMD_BUFFERRAM:
        case ONENAND_CMD_OTP_ACCESS:
                block = onenand_block(this, addr);
@@ -483,7 +507,7 @@ static int onenand_wait(struct mtd_info *mtd, int state)
                if (interrupt & flags)
                        break;
-                if (state != FL_READING)
+                if (state != FL_READING && state != FL_PREPARING_ERASE)
                        cond_resched();
        }
        /* To get correct interrupt status in timeout case */
@@ -500,25 +524,40 @@ static int onenand_wait(struct mtd_info *mtd, int state)
                int ecc = onenand_read_ecc(this);
                if (ecc) {
                        if (ecc & ONENAND_ECC_2BIT_ALL) {
-                                printk(KERN_ERR "onenand_wait: ECC error = 0x%04x\n", ecc);
+                                printk(KERN_ERR "%s: ECC error = 0x%04x\n",
+                                        __func__, ecc);
                                mtd->ecc_stats.failed++;
                                return -EBADMSG;
                        } else if (ecc & ONENAND_ECC_1BIT_ALL) {
-                                printk(KERN_DEBUG "onenand_wait: correctable ECC error = 0x%04x\n", ecc);
+                                printk(KERN_DEBUG "%s: correctable ECC error = 0x%04x\n",
+                                        __func__, ecc);
                                mtd->ecc_stats.corrected++;
                        }
                }
        } else if (state == FL_READING) {
-                printk(KERN_ERR "onenand_wait: read timeout! ctrl=0x%04x intr=0x%04x\n", ctrl, interrupt);
+                printk(KERN_ERR "%s: read timeout! ctrl=0x%04x intr=0x%04x\n",
+                        __func__, ctrl, interrupt);
+                return -EIO;
+        }
+        if (state == FL_PREPARING_ERASE && !(interrupt & ONENAND_INT_ERASE)) {
+                printk(KERN_ERR "%s: mb erase timeout! ctrl=0x%04x intr=0x%04x\n",
+                       __func__, ctrl, interrupt);
+                return -EIO;
+        }
+        if (!(interrupt & ONENAND_INT_MASTER)) {
+                printk(KERN_ERR "%s: timeout! ctrl=0x%04x intr=0x%04x\n",
+                       __func__, ctrl, interrupt);
                return -EIO;
        }
        /* If there's controller error, it's a real error */
        if (ctrl & ONENAND_CTRL_ERROR) {
-                printk(KERN_ERR "onenand_wait: controller error = 0x%04x\n",
+                printk(KERN_ERR "%s: controller error = 0x%04x\n",
-                        ctrl);
+                        __func__, ctrl);
                if (ctrl & ONENAND_CTRL_LOCK)
-                        printk(KERN_ERR "onenand_wait: it's locked error.\n");
+                        printk(KERN_ERR "%s: it's locked error.\n", __func__);
                return -EIO;
        }
@@ -1015,7 +1054,8 @@ static int onenand_recover_lsb(struct mtd_info *mtd, loff_t addr, int status)
        /* We are attempting to reread, so decrement stats.failed
         * which was incremented by onenand_wait due to read failure
         */
-        printk(KERN_INFO "onenand_recover_lsb: Attempting to recover from uncorrectable read\n");
+        printk(KERN_INFO "%s: Attempting to recover from uncorrectable read\n",
+                __func__);
        mtd->ecc_stats.failed--;
        /* Issue the LSB page recovery command */
@@ -1046,7 +1086,8 @@ static int onenand_mlc_read_ops_nolock(struct mtd_info *mtd, loff_t from,
        int ret = 0;
        int writesize = this->writesize;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_mlc_read_ops_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+              __func__, (unsigned int) from, (int) len);
        if (ops->mode == MTD_OOB_AUTO)
                oobsize = this->ecclayout->oobavail;
@@ -1057,7 +1098,8 @@ static int onenand_mlc_read_ops_nolock(struct mtd_info *mtd, loff_t from,
        /* Do not allow reads past end of device */
        if (from + len > mtd->size) {
-                printk(KERN_ERR "onenand_mlc_read_ops_nolock: Attempt read beyond end of device\n");
+                printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+                        __func__);
                ops->retlen = 0;
                ops->oobretlen = 0;
                return -EINVAL;
@@ -1146,7 +1188,8 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
        int ret = 0, boundary = 0;
        int writesize = this->writesize;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_ops_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+                        __func__, (unsigned int) from, (int) len);
        if (ops->mode == MTD_OOB_AUTO)
                oobsize = this->ecclayout->oobavail;
@@ -1157,7 +1200,8 @@ static int onenand_read_ops_nolock(struct mtd_info *mtd, loff_t from,
        /* Do not allow reads past end of device */
        if ((from + len) > mtd->size) {
-                printk(KERN_ERR "onenand_read_ops_nolock: Attempt read beyond end of device\n");
+                printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+                        __func__);
                ops->retlen = 0;
                ops->oobretlen = 0;
                return -EINVAL;
@@ -1275,7 +1319,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
        from += ops->ooboffs;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_read_oob_nolock: from = 0x%08x, len = %i\n", (unsigned int) from, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %i\n",
+                __func__, (unsigned int) from, (int) len);
        /* Initialize return length value */
        ops->oobretlen = 0;
@@ -1288,7 +1333,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
        column = from & (mtd->oobsize - 1);
        if (unlikely(column >= oobsize)) {
-                printk(KERN_ERR "onenand_read_oob_nolock: Attempted to start read outside oob\n");
+                printk(KERN_ERR "%s: Attempted to start read outside oob\n",
+                        __func__);
                return -EINVAL;
        }
@@ -1296,7 +1342,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
        if (unlikely(from >= mtd->size ||
                     column + len > ((mtd->size >> this->page_shift) -
                                     (from >> this->page_shift)) * oobsize)) {
-                printk(KERN_ERR "onenand_read_oob_nolock: Attempted to read beyond end of device\n");
+                printk(KERN_ERR "%s: Attempted to read beyond end of device\n",
+                        __func__);
                return -EINVAL;
        }
@@ -1319,7 +1366,8 @@ static int onenand_read_oob_nolock(struct mtd_info *mtd, loff_t from,
                        ret = onenand_recover_lsb(mtd, from, ret);
                if (ret && ret != -EBADMSG) {
-                        printk(KERN_ERR "onenand_read_oob_nolock: read failed = 0x%x\n", ret);
+                        printk(KERN_ERR "%s: read failed = 0x%x\n",
+                                __func__, ret);
                        break;
                }
@@ -1450,20 +1498,21 @@ static int onenand_bbt_wait(struct mtd_info *mtd, int state)
        if (interrupt & ONENAND_INT_READ) {
                int ecc = onenand_read_ecc(this);
                if (ecc & ONENAND_ECC_2BIT_ALL) {
-                        printk(KERN_INFO "onenand_bbt_wait: ecc error = 0x%04x"
+                        printk(KERN_WARNING "%s: ecc error = 0x%04x, "
-                                ", controller error 0x%04x\n", ecc, ctrl);
+                                "controller error 0x%04x\n",
+                                __func__, ecc, ctrl);
                        return ONENAND_BBT_READ_ECC_ERROR;
                }
        } else {
-                printk(KERN_ERR "onenand_bbt_wait: read timeout!"
+                printk(KERN_ERR "%s: read timeout! ctrl=0x%04x intr=0x%04x\n",
-                        "ctrl=0x%04x intr=0x%04x\n", ctrl, interrupt);
+                        __func__, ctrl, interrupt);
                return ONENAND_BBT_READ_FATAL_ERROR;
        }
        /* Initial bad block case: 0x2400 or 0x0400 */
        if (ctrl & ONENAND_CTRL_ERROR) {
-                printk(KERN_DEBUG "onenand_bbt_wait: "
+                printk(KERN_DEBUG "%s: controller error = 0x%04x\n",
-                        "controller error = 0x%04x\n", ctrl);
+                        __func__, ctrl);
                return ONENAND_BBT_READ_ERROR;
        }
@@ -1487,14 +1536,16 @@ int onenand_bbt_read_oob(struct mtd_info *mtd, loff_t from,
        size_t len = ops->ooblen;
        u_char *buf = ops->oobbuf;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_bbt_read_oob: from = 0x%08x, len = %zi\n", (unsigned int) from, len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: from = 0x%08x, len = %zi\n",
+                __func__, (unsigned int) from, len);
        /* Initialize return value */
        ops->oobretlen = 0;
        /* Do not allow reads past end of device */
        if (unlikely((from + len) > mtd->size)) {
-                printk(KERN_ERR "onenand_bbt_read_oob: Attempt read beyond end of device\n");
+                printk(KERN_ERR "%s: Attempt read beyond end of device\n",
+                        __func__);
                return ONENAND_BBT_READ_FATAL_ERROR;
        }
@@ -1661,21 +1712,23 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
        /* Wait for any existing operation to clear */
        onenand_panic_wait(mtd);
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_panic_write: to = 0x%08x, len = %i\n",
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
-              (unsigned int) to, (int) len);
+                __func__, (unsigned int) to, (int) len);
        /* Initialize retlen, in case of early exit */
        *retlen = 0;
        /* Do not allow writes past end of device */
        if (unlikely((to + len) > mtd->size)) {
-                printk(KERN_ERR "onenand_panic_write: Attempt write to past end of device\n");
+                printk(KERN_ERR "%s: Attempt write to past end of device\n",
+                        __func__);
                return -EINVAL;
        }
        /* Reject writes, which are not page aligned */
        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
-                printk(KERN_ERR "onenand_panic_write: Attempt to write not page aligned data\n");
+                printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
+                        __func__);
                return -EINVAL;
        }
@@ -1711,7 +1764,7 @@ static int onenand_panic_write(struct mtd_info *mtd, loff_t to, size_t len,
                }
                if (ret) {
-                        printk(KERN_ERR "onenand_panic_write: write failed %d\n", ret);
+                        printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
                        break;
                }
@@ -1792,7 +1845,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
        u_char *oobbuf;
        int ret = 0;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_ops_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
+                __func__, (unsigned int) to, (int) len);
        /* Initialize retlen, in case of early exit */
        ops->retlen = 0;
@@ -1800,13 +1854,15 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
        /* Do not allow writes past end of device */
        if (unlikely((to + len) > mtd->size)) {
-                printk(KERN_ERR "onenand_write_ops_nolock: Attempt write to past end of device\n");
+                printk(KERN_ERR "%s: Attempt write to past end of device\n",
+                        __func__);
                return -EINVAL;
        }
        /* Reject writes, which are not page aligned */
        if (unlikely(NOTALIGNED(to) || NOTALIGNED(len))) {
-                printk(KERN_ERR "onenand_write_ops_nolock: Attempt to write not page aligned data\n");
+                printk(KERN_ERR "%s: Attempt to write not page aligned data\n",
+                        __func__);
                return -EINVAL;
        }
@@ -1879,7 +1935,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
                        onenand_update_bufferram(mtd, prev, !ret && !prev_subpage);
                        if (ret) {
                                written -= prevlen;
-                                printk(KERN_ERR "onenand_write_ops_nolock: write failed %d\n", ret);
+                                printk(KERN_ERR "%s: write failed %d\n",
+                                        __func__, ret);
                                break;
                        }
@@ -1887,7 +1944,8 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
                                /* Only check verify write turn on */
                                ret = onenand_verify(mtd, buf - len, to - len, len);
                                if (ret)
-                                        printk(KERN_ERR "onenand_write_ops_nolock: verify failed %d\n", ret);
+                                        printk(KERN_ERR "%s: verify failed %d\n",
+                                                __func__, ret);
                                break;
                        }
@@ -1905,14 +1963,16 @@ static int onenand_write_ops_nolock(struct mtd_info *mtd, loff_t to,
                        /* In partial page write we don't update bufferram */
                        onenand_update_bufferram(mtd, to, !ret && !subpage);
                        if (ret) {
-                                printk(KERN_ERR "onenand_write_ops_nolock: write failed %d\n", ret);
+                                printk(KERN_ERR "%s: write failed %d\n",
+                                        __func__, ret);
                                break;
                        }
                        /* Only check verify write turn on */
                        ret = onenand_verify(mtd, buf, to, thislen);
                        if (ret) {
-                                printk(KERN_ERR "onenand_write_ops_nolock: verify failed %d\n", ret);
+                                printk(KERN_ERR "%s: verify failed %d\n",
+                                        __func__, ret);
                                break;
                        }
@@ -1968,7 +2028,8 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
        to += ops->ooboffs;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_write_oob_nolock: to = 0x%08x, len = %i\n", (unsigned int) to, (int) len);
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: to = 0x%08x, len = %i\n",
+                __func__, (unsigned int) to, (int) len);
        /* Initialize retlen, in case of early exit */
        ops->oobretlen = 0;
@@ -1981,14 +2042,15 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
        column = to & (mtd->oobsize - 1);
        if (unlikely(column >= oobsize)) {
-                printk(KERN_ERR "onenand_write_oob_nolock: Attempted to start write outside oob\n");
+                printk(KERN_ERR "%s: Attempted to start write outside oob\n",
+                        __func__);
                return -EINVAL;
        }
        /* For compatibility with NAND: Do not allow write past end of page */
        if (unlikely(column + len > oobsize)) {
-                printk(KERN_ERR "onenand_write_oob_nolock: "
+                printk(KERN_ERR "%s: Attempt to write past end of page\n",
-                      "Attempt to write past end of page\n");
+                        __func__);
                return -EINVAL;
        }
@@ -1996,7 +2058,8 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
        if (unlikely(to >= mtd->size ||
                     column + len > ((mtd->size >> this->page_shift) -
                                     (to >> this->page_shift)) * oobsize)) {
-                printk(KERN_ERR "onenand_write_oob_nolock: Attempted to write past end of device\n");
+                printk(KERN_ERR "%s: Attempted to write past end of device\n",
+                       __func__);
                return -EINVAL;
        }
@@ -2038,13 +2101,14 @@ static int onenand_write_oob_nolock(struct mtd_info *mtd, loff_t to,
                ret = this->wait(mtd, FL_WRITING);
                if (ret) {
-                        printk(KERN_ERR "onenand_write_oob_nolock: write failed %d\n", ret);
+                        printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
                        break;
                }
                ret = onenand_verify_oob(mtd, oobbuf, to);
                if (ret) {
-                        printk(KERN_ERR "onenand_write_oob_nolock: verify failed %d\n", ret);
+                        printk(KERN_ERR "%s: verify failed %d\n",
+                                __func__, ret);
                        break;
                }
@@ -2140,78 +2204,186 @@ static int onenand_block_isbad_nolock(struct mtd_info *mtd, loff_t ofs, int allo
        return bbm->isbad_bbt(mtd, ofs, allowbbt);
 }
+static int onenand_multiblock_erase_verify(struct mtd_info *mtd,
+                                           struct erase_info *instr)
+{
+        struct onenand_chip *this = mtd->priv;
+        loff_t addr = instr->addr;
+        int len = instr->len;
+        unsigned int block_size = (1 << this->erase_shift);
+        int ret = 0;
+        while (len) {
+                this->command(mtd, ONENAND_CMD_ERASE_VERIFY, addr, block_size);
+                ret = this->wait(mtd, FL_VERIFYING_ERASE);
+                if (ret) {
+                        printk(KERN_ERR "%s: Failed verify, block %d\n",
+                               __func__, onenand_block(this, addr));
+                        instr->state = MTD_ERASE_FAILED;
+                        instr->fail_addr = addr;
+                        return -1;
+                }
+                len -= block_size;
+                addr += block_size;
+        }
+        return 0;
+}
 /**
- * onenand_erase - [MTD Interface] erase block(s)
+ * onenand_multiblock_erase - [Internal] erase block(s) using multiblock erase
 * @param mtd           MTD device structure
 * @param instr         erase instruction
+ * @param region        erase region
 *
- * Erase one ore more blocks
+ * Erase one or more blocks up to 64 block at a time
 */
-static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
+static int onenand_multiblock_erase(struct mtd_info *mtd,
+                                    struct erase_info *instr,
+                                    unsigned int block_size)
 {
        struct onenand_chip *this = mtd->priv;
-        unsigned int block_size;
        loff_t addr = instr->addr;
-        loff_t len = instr->len;
+        int len = instr->len;
-        int ret = 0, i;
+        int eb_count = 0;
-        struct mtd_erase_region_info *region = NULL;
+        int ret = 0;
-        loff_t region_end = 0;
+        int bdry_block = 0;
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_erase: start = 0x%012llx, len = %llu\n", (unsigned long long) instr->addr, (unsigned long long) instr->len);
+        instr->state = MTD_ERASING;
-        /* Do not allow erase past end of device */
+        if (ONENAND_IS_DDP(this)) {
-        if (unlikely((len + addr) > mtd->size)) {
+                loff_t bdry_addr = this->chipsize >> 1;
-                printk(KERN_ERR "onenand_erase: Erase past end of device\n");
+                if (addr < bdry_addr && (addr + len) > bdry_addr)
-                return -EINVAL;
+                        bdry_block = bdry_addr >> this->erase_shift;
        }
-        if (FLEXONENAND(this)) {
+        /* Pre-check bbs */
-                /* Find the eraseregion of this address */
+        while (len) {
-                i = flexonenand_region(mtd, addr);
+                /* Check if we have a bad block, we do not erase bad blocks */
-                region = &mtd->eraseregions[i];
+                if (onenand_block_isbad_nolock(mtd, addr, 0)) {
+                        printk(KERN_WARNING "%s: attempt to erase a bad block "
+                               "at addr 0x%012llx\n",
+                               __func__, (unsigned long long) addr);
+                        instr->state = MTD_ERASE_FAILED;
+                        return -EIO;
+                }
+                len -= block_size;
+                addr += block_size;
+        }
-                block_size = region->erasesize;
+        len = instr->len;
-                region_end = region->offset + region->erasesize * region->numblocks;
+        addr = instr->addr;
-                /* Start address within region must align on block boundary.
+        /* loop over 64 eb batches */
-                 * Erase region's start offset is always block start address.
+        while (len) {
-                 */
+                struct erase_info verify_instr = *instr;
-                if (unlikely((addr - region->offset) & (block_size - 1))) {
+                int max_eb_count = MB_ERASE_MAX_BLK_COUNT;
-                        printk(KERN_ERR "onenand_erase: Unaligned address\n");
-                        return -EINVAL;
+                verify_instr.addr = addr;
+                verify_instr.len = 0;
+                /* do not cross chip boundary */
+                if (bdry_block) {
+                        int this_block = (addr >> this->erase_shift);
+                        if (this_block < bdry_block) {
+                                max_eb_count = min(max_eb_count,
+                                                   (bdry_block - this_block));
+                        }
                }
-        } else {
-                block_size = 1 << this->erase_shift;
-                /* Start address must align on block boundary */
+                eb_count = 0;
-                if (unlikely(addr & (block_size - 1))) {
-                        printk(KERN_ERR "onenand_erase: Unaligned address\n");
+                while (len > block_size && eb_count < (max_eb_count - 1)) {
-                        return -EINVAL;
+                        this->command(mtd, ONENAND_CMD_MULTIBLOCK_ERASE,
+                                      addr, block_size);
+                        onenand_invalidate_bufferram(mtd, addr, block_size);
+                        ret = this->wait(mtd, FL_PREPARING_ERASE);
+                        if (ret) {
+                                printk(KERN_ERR "%s: Failed multiblock erase, "
+                                       "block %d\n", __func__,
+                                       onenand_block(this, addr));
+                                instr->state = MTD_ERASE_FAILED;
+                                instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
+                                return -EIO;
+                        }
+                        len -= block_size;
+                        addr += block_size;
+                        eb_count++;
+                }
+                /* last block of 64-eb series */
+                cond_resched();
+                this->command(mtd, ONENAND_CMD_ERASE, addr, block_size);
+                onenand_invalidate_bufferram(mtd, addr, block_size);
+                ret = this->wait(mtd, FL_ERASING);
+                /* Check if it is write protected */
+                if (ret) {
+                        printk(KERN_ERR "%s: Failed erase, block %d\n",
+                               __func__, onenand_block(this, addr));
+                        instr->state = MTD_ERASE_FAILED;
+                        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
+                        return -EIO;
+                }
+                len -= block_size;
+                addr += block_size;
+                eb_count++;
+                /* verify */
+                verify_instr.len = eb_count * block_size;
+                if (onenand_multiblock_erase_verify(mtd, &verify_instr)) {
+                        instr->state = verify_instr.state;
+                        instr->fail_addr = verify_instr.fail_addr;
+                        return -EIO;
                }
-        }
-        /* Length must align on block boundary */
-        if (unlikely(len & (block_size - 1))) {
-                printk(KERN_ERR "onenand_erase: Length not block aligned\n");
-                return -EINVAL;
        }
+        return 0;
+}
-        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
-        /* Grab the lock and see if the device is available */
+/**
-        onenand_get_device(mtd, FL_ERASING);
+ * onenand_block_by_block_erase - [Internal] erase block(s) using regular erase
+ * @param mtd           MTD device structure
+ * @param instr         erase instruction
+ * @param region        erase region
+ * @param block_size    erase block size
+ *
+ * Erase one or more blocks one block at a time
+ */
+static int onenand_block_by_block_erase(struct mtd_info *mtd,
+                                        struct erase_info *instr,
+                                        struct mtd_erase_region_info *region,
+                                        unsigned int block_size)
+{
+        struct onenand_chip *this = mtd->priv;
+        loff_t addr = instr->addr;
+        int len = instr->len;
+        loff_t region_end = 0;
+        int ret = 0;
+        if (region) {
+                /* region is set for Flex-OneNAND */
+                region_end = region->offset + region->erasesize * region->numblocks;
+        }
-        /* Loop through the blocks */
        instr->state = MTD_ERASING;
+        /* Loop through the blocks */
        while (len) {
                cond_resched();
                /* Check if we have a bad block, we do not erase bad blocks */
                if (onenand_block_isbad_nolock(mtd, addr, 0)) {
-                        printk (KERN_WARNING "onenand_erase: attempt to erase a bad block at addr 0x%012llx\n", (unsigned long long) addr);
+                        printk(KERN_WARNING "%s: attempt to erase a bad block "
+                                        "at addr 0x%012llx\n",
+                                        __func__, (unsigned long long) addr);
                        instr->state = MTD_ERASE_FAILED;
-                        goto erase_exit;
+                        return -EIO;
                }
                this->command(mtd, ONENAND_CMD_ERASE, addr, block_size);
@@ -2221,11 +2393,11 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                ret = this->wait(mtd, FL_ERASING);
                /* Check, if it is write protected */
                if (ret) {
-                        printk(KERN_ERR "onenand_erase: Failed erase, block %d\n",
+                        printk(KERN_ERR "%s: Failed erase, block %d\n",
-                                                 onenand_block(this, addr));
+                                __func__, onenand_block(this, addr));
                        instr->state = MTD_ERASE_FAILED;
                        instr->fail_addr = addr;
-                        goto erase_exit;
+                        return -EIO;
                }
                len -= block_size;
@@ -2241,25 +2413,88 @@ static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
                        if (len & (block_size - 1)) {
                                /* FIXME: This should be handled at MTD partitioning level. */
-                                printk(KERN_ERR "onenand_erase: Unaligned address\n");
+                                printk(KERN_ERR "%s: Unaligned address\n",
-                                goto erase_exit;
+                                        __func__);
+                                return -EIO;
                        }
                }
+        }
+        return 0;
+}
+/**
+ * onenand_erase - [MTD Interface] erase block(s)
+ * @param mtd           MTD device structure
+ * @param instr         erase instruction
+ *
+ * Erase one or more blocks
+ */
+static int onenand_erase(struct mtd_info *mtd, struct erase_info *instr)
+{
+        struct onenand_chip *this = mtd->priv;
+        unsigned int block_size;
+        loff_t addr = instr->addr;
+        loff_t len = instr->len;
+        int ret = 0;
+        struct mtd_erase_region_info *region = NULL;
+        loff_t region_offset = 0;
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: start=0x%012llx, len=%llu\n", __func__,
+              (unsigned long long) instr->addr, (unsigned long long) instr->len);
+        /* Do not allow erase past end of device */
+        if (unlikely((len + addr) > mtd->size)) {
+                printk(KERN_ERR "%s: Erase past end of device\n", __func__);
+                return -EINVAL;
+        }
+        if (FLEXONENAND(this)) {
+                /* Find the eraseregion of this address */
+                int i = flexonenand_region(mtd, addr);
+                region = &mtd->eraseregions[i];
+                block_size = region->erasesize;
+                /* Start address within region must align on block boundary.
+                 * Erase region's start offset is always block start address.
+                 */
+                region_offset = region->offset;
+        } else
+                block_size = 1 << this->erase_shift;
+        /* Start address must align on block boundary */
+        if (unlikely((addr - region_offset) & (block_size - 1))) {
+                printk(KERN_ERR "%s: Unaligned address\n", __func__);
+                return -EINVAL;
+        }
+        /* Length must align on block boundary */
+        if (unlikely(len & (block_size - 1))) {
+                printk(KERN_ERR "%s: Length not block aligned\n", __func__);
+                return -EINVAL;
        }
-        instr->state = MTD_ERASE_DONE;
+        instr->fail_addr = MTD_FAIL_ADDR_UNKNOWN;
-erase_exit:
+        /* Grab the lock and see if the device is available */
+        onenand_get_device(mtd, FL_ERASING);
-        ret = instr->state == MTD_ERASE_DONE ? 0 : -EIO;
+        if (region || instr->len < MB_ERASE_MIN_BLK_COUNT * block_size) {
+                /* region is set for Flex-OneNAND (no mb erase) */
+                ret = onenand_block_by_block_erase(mtd, instr,
+                                                   region, block_size);
+        } else {
+                ret = onenand_multiblock_erase(mtd, instr, block_size);
+        }
        /* Deselect and wake up anyone waiting on the device */
        onenand_release_device(mtd);
        /* Do call back function */
-        if (!ret)
+        if (!ret) {
+                instr->state = MTD_ERASE_DONE;
                mtd_erase_callback(instr);
+        }
        return ret;
 }
@@ -2272,7 +2507,7 @@ erase_exit:
 */
 static void onenand_sync(struct mtd_info *mtd)
 {
-        DEBUG(MTD_DEBUG_LEVEL3, "onenand_sync: called\n");
+        DEBUG(MTD_DEBUG_LEVEL3, "%s: called\n", __func__);
        /* Grab the lock and see if the device is available */
        onenand_get_device(mtd, FL_SYNCING);
@@ -2406,7 +2641,8 @@ static int onenand_do_lock_cmd(struct mtd_info *mtd, loff_t ofs, size_t len, int
                /* Check lock status */
                status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
                if (!(status & wp_status_mask))
-                        printk(KERN_ERR "wp status = 0x%x\n", status);
+                        printk(KERN_ERR "%s: wp status = 0x%x\n",
+                                __func__, status);
                return 0;
        }
@@ -2435,7 +2671,8 @@ static int onenand_do_lock_cmd(struct mtd_info *mtd, loff_t ofs, size_t len, int
                /* Check lock status */
                status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
                if (!(status & wp_status_mask))
-                        printk(KERN_ERR "block = %d, wp status = 0x%x\n", block, status);
+                        printk(KERN_ERR "%s: block = %d, wp status = 0x%x\n",
+                                __func__, block, status);
        }
        return 0;
@@ -2502,7 +2739,8 @@ static int onenand_check_lock_status(struct onenand_chip *this)
                /* Check lock status */
                status = this->read_word(this->base + ONENAND_REG_WP_STATUS);
                if (!(status & ONENAND_WP_US)) {
-                        printk(KERN_ERR "block = %d, wp status = 0x%x\n", block, status);
+                        printk(KERN_ERR "%s: block = %d, wp status = 0x%x\n",
+                                __func__, block, status);
                        return 0;
                }
        }
@@ -2557,6 +2795,208 @@ static void onenand_unlock_all(struct mtd_info *mtd)
 #ifdef CONFIG_MTD_ONENAND_OTP
+/**
+ * onenand_otp_command - Send OTP specific command to OneNAND device
+ * @param mtd    MTD device structure
+ * @param cmd    the command to be sent
+ * @param addr   offset to read from or write to
+ * @param len    number of bytes to read or write
+ */
+static int onenand_otp_command(struct mtd_info *mtd, int cmd, loff_t addr,
+                                size_t len)
+{
+        struct onenand_chip *this = mtd->priv;
+        int value, block, page;
+        /* Address translation */
+        switch (cmd) {
+        case ONENAND_CMD_OTP_ACCESS:
+                block = (int) (addr >> this->erase_shift);
+                page = -1;
+                break;
+        default:
+                block = (int) (addr >> this->erase_shift);
+                page = (int) (addr >> this->page_shift);
+                if (ONENAND_IS_2PLANE(this)) {
+                        /* Make the even block number */
+                        block &= ~1;
+                        /* Is it the odd plane? */
+                        if (addr & this->writesize)
+                                block++;
+                        page >>= 1;
+                }
+                page &= this->page_mask;
+                break;
+        }
+        if (block != -1) {
+                /* Write 'DFS, FBA' of Flash */
+                value = onenand_block_address(this, block);
+                this->write_word(value, this->base +
+                                ONENAND_REG_START_ADDRESS1);
+        }
+        if (page != -1) {
+                /* Now we use page size operation */
+                int sectors = 4, count = 4;
+                int dataram;
+                switch (cmd) {
+                default:
+                        if (ONENAND_IS_2PLANE(this) && cmd == ONENAND_CMD_PROG)
+                                cmd = ONENAND_CMD_2X_PROG;
+                        dataram = ONENAND_CURRENT_BUFFERRAM(this);
+                        break;
+                }
+                /* Write 'FPA, FSA' of Flash */
+                value = onenand_page_address(page, sectors);
+                this->write_word(value, this->base +
+                                ONENAND_REG_START_ADDRESS8);
+                /* Write 'BSA, BSC' of DataRAM */
+                value = onenand_buffer_address(dataram, sectors, count);
+                this->write_word(value, this->base + ONENAND_REG_START_BUFFER);
+        }
+        /* Interrupt clear */
+        this->write_word(ONENAND_INT_CLEAR, this->base + ONENAND_REG_INTERRUPT);
+        /* Write command */
+        this->write_word(cmd, this->base + ONENAND_REG_COMMAND);
+        return 0;
+}
+/**
+ * onenand_otp_write_oob_nolock - [Internal] OneNAND write out-of-band, specific to OTP
+ * @param mtd           MTD device structure
+ * @param to            offset to write to
+ * @param len           number of bytes to write
+ * @param retlen        pointer to variable to store the number of written bytes
+ * @param buf           the data to write
+ *
+ * OneNAND write out-of-band only for OTP
+ */
+static int onenand_otp_write_oob_nolock(struct mtd_info *mtd, loff_t to,
+                                    struct mtd_oob_ops *ops)
+{
+        struct onenand_chip *this = mtd->priv;
+        int column, ret = 0, oobsize;
+        int written = 0;
+        u_char *oobbuf;
+        size_t len = ops->ooblen;
+        const u_char *buf = ops->oobbuf;
+        int block, value, status;
+        to += ops->ooboffs;
+        /* Initialize retlen, in case of early exit */
+        ops->oobretlen = 0;
+        oobsize = mtd->oobsize;
+        column = to & (mtd->oobsize - 1);
+        oobbuf = this->oob_buf;
+        /* Loop until all data write */
+        while (written < len) {
+                int thislen = min_t(int, oobsize, len - written);
+                cond_resched();
+                block = (int) (to >> this->erase_shift);
+                /*
+                 * Write 'DFS, FBA' of Flash
+                 * Add: F100h DQ=DFS, FBA
+                 */
+                value = onenand_block_address(this, block);
+                this->write_word(value, this->base +
+                                ONENAND_REG_START_ADDRESS1);
+                /*
+                 * Select DataRAM for DDP
+                 * Add: F101h DQ=DBS
+                 */
+                value = onenand_bufferram_address(this, block);
+                this->write_word(value, this->base +
+                                ONENAND_REG_START_ADDRESS2);
+                ONENAND_SET_NEXT_BUFFERRAM(this);
+                /*
+                 * Enter OTP access mode
+                 */
+                this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
+                this->wait(mtd, FL_OTPING);
+                /* We send data to spare ram with oobsize
+                 * to prevent byte access */
+                memcpy(oobbuf + column, buf, thislen);
+                /*
+                 * Write Data into DataRAM
+                 * Add: 8th Word
+                 * in sector0/spare/page0
+                 * DQ=XXFCh
+                 */
+                this->write_bufferram(mtd, ONENAND_SPARERAM,
+                                        oobbuf, 0, mtd->oobsize);
+                onenand_otp_command(mtd, ONENAND_CMD_PROGOOB, to, mtd->oobsize);
+                onenand_update_bufferram(mtd, to, 0);
+                if (ONENAND_IS_2PLANE(this)) {
+                        ONENAND_SET_BUFFERRAM1(this);
+                        onenand_update_bufferram(mtd, to + this->writesize, 0);
+                }
+                ret = this->wait(mtd, FL_WRITING);
+                if (ret) {
+                        printk(KERN_ERR "%s: write failed %d\n", __func__, ret);
+                        break;
+                }
+                /* Exit OTP access mode */
+                this->command(mtd, ONENAND_CMD_RESET, 0, 0);
+                this->wait(mtd, FL_RESETING);
+                status = this->read_word(this->base + ONENAND_REG_CTRL_STATUS);
+                status &= 0x60;
+                if (status == 0x60) {
+                        printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+                        printk(KERN_DEBUG "1st Block\tLOCKED\n");
+                        printk(KERN_DEBUG "OTP Block\tLOCKED\n");
+                } else if (status == 0x20) {
+                        printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+                        printk(KERN_DEBUG "1st Block\tLOCKED\n");
+                        printk(KERN_DEBUG "OTP Block\tUN-LOCKED\n");
+                } else if (status == 0x40) {
+                        printk(KERN_DEBUG "\nBLOCK\tSTATUS\n");
+                        printk(KERN_DEBUG "1st Block\tUN-LOCKED\n");
+                        printk(KERN_DEBUG "OTP Block\tLOCKED\n");
+                } else {
+                        printk(KERN_DEBUG "Reboot to check\n");
+                }
+                written += thislen;
+                if (written == len)
+                        break;
+                to += mtd->writesize;
+                buf += thislen;
+                column = 0;
+        }
+        ops->oobretlen = written;
+        return ret;
+}
 /* Internal OTP operation */
 typedef int (*otp_op_t)(struct mtd_info *mtd, loff_t form, size_t len,
                size_t *retlen, u_char *buf);
@@ -2659,11 +3099,11 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
        struct mtd_oob_ops ops;
        int ret;
-        /* Enter OTP access mode */
-        this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
-        this->wait(mtd, FL_OTPING);
        if (FLEXONENAND(this)) {
+                /* Enter OTP access mode */
+                this->command(mtd, ONENAND_CMD_OTP_ACCESS, 0, 0);
+                this->wait(mtd, FL_OTPING);
                /*
                 * For Flex-OneNAND, we write lock mark to 1st word of sector 4 of
                 * main area of page 49.
@@ -2674,19 +3114,19 @@ static int do_otp_lock(struct mtd_info *mtd, loff_t from, size_t len,
                ops.oobbuf = NULL;
                ret = onenand_write_ops_nolock(mtd, mtd->writesize * 49, &ops);
                *retlen = ops.retlen;
+                /* Exit OTP access mode */
+                this->command(mtd, ONENAND_CMD_RESET, 0, 0);
+                this->wait(mtd, FL_RESETING);
        } else {
                ops.mode = MTD_OOB_PLACE;
                ops.ooblen = len;
                ops.oobbuf = buf;
                ops.ooboffs = 0;
-                ret = onenand_write_oob_nolock(mtd, from, &ops);
+                ret = onenand_otp_write_oob_nolock(mtd, from, &ops);
                *retlen = ops.oobretlen;
        }
-        /* Exit OTP access mode */
-        this->command(mtd, ONENAND_CMD_RESET, 0, 0);
-        this->wait(mtd, FL_RESETING);
        return ret;
 }
@@ -2717,16 +3157,21 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
        if (density < ONENAND_DEVICE_DENSITY_512Mb)
                otp_pages = 20;
        else
-                otp_pages = 10;
+                otp_pages = 50;
        if (mode == MTD_OTP_FACTORY) {
                from += mtd->writesize * otp_pages;
-                otp_pages = 64 - otp_pages;
+                otp_pages = ONENAND_PAGES_PER_BLOCK - otp_pages;
        }
        /* Check User/Factory boundary */
-        if (((mtd->writesize * otp_pages) - (from + len)) < 0)
+        if (mode == MTD_OTP_USER) {
-                return 0;
+                if (mtd->writesize * otp_pages < from + len)
+                        return 0;
+        } else {
+                if (mtd->writesize * otp_pages <  len)
+                        return 0;
+        }
        onenand_get_device(mtd, FL_OTPING);
        while (len > 0 && otp_pages > 0) {
@@ -2749,13 +3194,12 @@ static int onenand_otp_walk(struct mtd_info *mtd, loff_t from, size_t len,
                        *retlen += sizeof(struct otp_info);
                } else {
                        size_t tmp_retlen;
-                        int size = len;
                        ret = action(mtd, from, len, &tmp_retlen, buf);
-                        buf += size;
+                        buf += tmp_retlen;
-                        len -= size;
+                        len -= tmp_retlen;
-                        *retlen += size;
+                        *retlen += tmp_retlen;
                        if (ret)
                                break;
@@ -2868,21 +3312,11 @@ static int onenand_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
        u_char *buf = FLEXONENAND(this) ? this->page_buf : this->oob_buf;
        size_t retlen;
        int ret;
+        unsigned int otp_lock_offset = ONENAND_OTP_LOCK_OFFSET;
        memset(buf, 0xff, FLEXONENAND(this) ? this->writesize
                                                 : mtd->oobsize);
        /*
-         * Note: OTP lock operation
-         *       OTP block : 0xXXFC
-         *       1st block : 0xXXF3 (If chip support)
-         *       Both      : 0xXXF0 (If chip support)
-         */
-        if (FLEXONENAND(this))
-                buf[FLEXONENAND_OTP_LOCK_OFFSET] = 0xFC;
-        else
-                buf[ONENAND_OTP_LOCK_OFFSET] = 0xFC;
-        /*
         * Write lock mark to 8th word of sector0 of page0 of the spare0.
         * We write 16 bytes spare area instead of 2 bytes.
         * For Flex-OneNAND, we write lock mark to 1st word of sector 4 of
@@ -2892,10 +3326,30 @@ static int onenand_lock_user_prot_reg(struct mtd_info *mtd, loff_t from,
        from = 0;
        len = FLEXONENAND(this) ? mtd->writesize : 16;
+        /*
+         * Note: OTP lock operation
+         *       OTP block : 0xXXFC                     XX 1111 1100
+         *       1st block : 0xXXF3 (If chip support)   XX 1111 0011
+         *       Both      : 0xXXF0 (If chip support)   XX 1111 0000
+         */
+        if (FLEXONENAND(this))
+                otp_lock_offset = FLEXONENAND_OTP_LOCK_OFFSET;
+        /* ONENAND_OTP_AREA | ONENAND_OTP_BLOCK0 | ONENAND_OTP_AREA_BLOCK0 */
+        if (otp == 1)
+                buf[otp_lock_offset] = 0xFC;
+        else if (otp == 2)
+                buf[otp_lock_offset] = 0xF3;
+        else if (otp == 3)
+                buf[otp_lock_offset] = 0xF0;
+        else if (otp != 0)
+                printk(KERN_DEBUG "[OneNAND] Invalid option selected for OTP\n");
        ret = onenand_otp_walk(mtd, from, len, &retlen, buf, do_otp_lock, MTD_OTP_USER);
        return ret ? : retlen;
 }
 #endif  /* CONFIG_MTD_ONENAND_OTP */
 /**
@@ -3172,7 +3626,8 @@ static int flexonenand_check_blocks_erased(struct mtd_info *mtd, int start, int
                                break;
                if (i != mtd->oobsize) {
-                        printk(KERN_WARNING "Block %d not erased.\n", block);
+                        printk(KERN_WARNING "%s: Block %d not erased.\n",
+                                __func__, block);
                        return 1;
                }
        }
@@ -3204,8 +3659,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
        blksperdie >>= ONENAND_IS_DDP(this) ? 1 : 0;
        if (boundary >= blksperdie) {
-                printk(KERN_ERR "flexonenand_set_boundary: Invalid boundary value. "
+                printk(KERN_ERR "%s: Invalid boundary value. "
-                                "Boundary not changed.\n");
+                                "Boundary not changed.\n", __func__);
                return -EINVAL;
        }
@@ -3214,7 +3669,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
        new = boundary + (die * this->density_mask);
        ret = flexonenand_check_blocks_erased(mtd, min(old, new) + 1, max(old, new));
        if (ret) {
-                printk(KERN_ERR "flexonenand_set_boundary: Please erase blocks before boundary change\n");
+                printk(KERN_ERR "%s: Please erase blocks "
+                                "before boundary change\n", __func__);
                return ret;
        }
@@ -3227,12 +3683,12 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
        thisboundary = this->read_word(this->base + ONENAND_DATARAM);
        if ((thisboundary >> FLEXONENAND_PI_UNLOCK_SHIFT) != 3) {
-                printk(KERN_ERR "flexonenand_set_boundary: boundary locked\n");
+                printk(KERN_ERR "%s: boundary locked\n", __func__);
                ret = 1;
                goto out;
        }
-        printk(KERN_INFO "flexonenand_set_boundary: Changing die %d boundary: %d%s\n",
+        printk(KERN_INFO "Changing die %d boundary: %d%s\n",
                        die, boundary, lock ? "(Locked)" : "(Unlocked)");
        addr = die ? this->diesize[0] : 0;
@@ -3243,7 +3699,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
        this->command(mtd, ONENAND_CMD_ERASE, addr, 0);
        ret = this->wait(mtd, FL_ERASING);
        if (ret) {
-                printk(KERN_ERR "flexonenand_set_boundary: Failed PI erase for Die %d\n", die);
+                printk(KERN_ERR "%s: Failed PI erase for Die %d\n",
+                       __func__, die);
                goto out;
        }
@@ -3251,7 +3708,8 @@ int flexonenand_set_boundary(struct mtd_info *mtd, int die,
        this->command(mtd, ONENAND_CMD_PROG, addr, 0);
        ret = this->wait(mtd, FL_WRITING);
        if (ret) {
-                printk(KERN_ERR "flexonenand_set_boundary: Failed PI write for Die %d\n", die);
+                printk(KERN_ERR "%s: Failed PI write for Die %d\n",
+                        __func__, die);
                goto out;
        }
@@ -3408,8 +3866,8 @@ static void onenand_resume(struct mtd_info *mtd)
        if (this->state == FL_PM_SUSPENDED)
                onenand_release_device(mtd);
        else
-                printk(KERN_ERR "resume() called for the chip which is not"
+                printk(KERN_ERR "%s: resume() called for the chip which is not "
-                                "in suspended state\n");
+                                "in suspended state\n", __func__);
 }
 /**
@@ -3464,7 +3922,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        if (!this->page_buf) {
                this->page_buf = kzalloc(mtd->writesize, GFP_KERNEL);
                if (!this->page_buf) {
-                        printk(KERN_ERR "onenand_scan(): Can't allocate page_buf\n");
+                        printk(KERN_ERR "%s: Can't allocate page_buf\n",
+                                __func__);
                        return -ENOMEM;
                }
                this->options |= ONENAND_PAGEBUF_ALLOC;
@@ -3472,7 +3931,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
        if (!this->oob_buf) {
                this->oob_buf = kzalloc(mtd->oobsize, GFP_KERNEL);
                if (!this->oob_buf) {
-                        printk(KERN_ERR "onenand_scan(): Can't allocate oob_buf\n");
+                        printk(KERN_ERR "%s: Can't allocate oob_buf\n",
+                                __func__);
                        if (this->options & ONENAND_PAGEBUF_ALLOC) {
                                this->options &= ~ONENAND_PAGEBUF_ALLOC;
                                kfree(this->page_buf);
@@ -3505,8 +3965,8 @@ int onenand_scan(struct mtd_info *mtd, int maxchips)
                break;
        default:
-                printk(KERN_WARNING "No OOB scheme defined for oobsize %d\n",
+                printk(KERN_WARNING "%s: No OOB scheme defined for oobsize %d\n",
-                        mtd->oobsize);
+                        __func__, mtd->oobsize);
                mtd->subpage_sft = 0;
                /* To prevent kernel oops */
                this->ecclayout = &onenand_oob_32;
diff --git a/drivers/mtd/onenand/onenand_sim.c b/drivers/mtd/onenand/onenand_sim.c
index f6e3c8aebd3a..8b246061d511 100644
--- a/drivers/mtd/onenand/onenand_sim.c
+++ b/drivers/mtd/onenand/onenand_sim.c
@@ -16,6 +16,7 @@
 */
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/mtd/tests/Makefile b/drivers/mtd/tests/Makefile
index c1d501335006..b44dcab940d8 100644
--- a/drivers/mtd/tests/Makefile
+++ b/drivers/mtd/tests/Makefile
@@ -5,3 +5,4 @@ obj-$(CONFIG_MTD_TESTS) += mtd_speedtest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_stresstest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_subpagetest.o
 obj-$(CONFIG_MTD_TESTS) += mtd_torturetest.o
+obj-$(CONFIG_MTD_TESTS) += mtd_nandecctest.o
diff --git a/drivers/mtd/tests/mtd_nandecctest.c b/drivers/mtd/tests/mtd_nandecctest.c
new file mode 100644
index 000000000000..70d6d7d0d656
--- /dev/null
+++ b/drivers/mtd/tests/mtd_nandecctest.c
@@ -0,0 +1,86 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/list.h>
+#include <linux/random.h>
+#include <linux/string.h>
+#include <linux/bitops.h>
+#include <linux/jiffies.h>
+#include <linux/mtd/nand_ecc.h>
+#if defined(CONFIG_MTD_NAND) || defined(CONFIG_MTD_NAND_MODULE)
+static void inject_single_bit_error(void *data, size_t size)
+{
+        unsigned long offset = random32() % (size * BITS_PER_BYTE);
+        __change_bit(offset, data);
+}
+static unsigned char data[512];
+static unsigned char error_data[512];
+static int nand_ecc_test(const size_t size)
+{
+        unsigned char code[3];
+        unsigned char error_code[3];
+        char testname[30];
+        BUG_ON(sizeof(data) < size);
+        sprintf(testname, "nand-ecc-%zu", size);
+        get_random_bytes(data, size);
+        memcpy(error_data, data, size);
+        inject_single_bit_error(error_data, size);
+        __nand_calculate_ecc(data, size, code);
+        __nand_calculate_ecc(error_data, size, error_code);
+        __nand_correct_data(error_data, code, error_code, size);
+        if (!memcmp(data, error_data, size)) {
+                printk(KERN_INFO "mtd_nandecctest: ok - %s\n", testname);
+                return 0;
+        }
+        printk(KERN_ERR "mtd_nandecctest: not ok - %s\n", testname);
+        printk(KERN_DEBUG "hexdump of data:\n");
+        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 4,
+                        data, size, false);
+        printk(KERN_DEBUG "hexdump of error data:\n");
+        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 16, 4,
+                        error_data, size, false);
+        return -1;
+}
+#else
+static int nand_ecc_test(const size_t size)
+{
+        return 0;
+}
+#endif
+static int __init ecc_test_init(void)
+{
+        srandom32(jiffies);
+        nand_ecc_test(256);
+        nand_ecc_test(512);
+        return 0;
+}
+static void __exit ecc_test_exit(void)
+{
+}
+module_init(ecc_test_init);
+module_exit(ecc_test_exit);
+MODULE_DESCRIPTION("NAND ECC function test module");
+MODULE_AUTHOR("Akinobu Mita");
+MODULE_LICENSE("GPL");
diff --git a/drivers/mtd/tests/mtd_oobtest.c b/drivers/mtd/tests/mtd_oobtest.c
index 5553cd4eab20..dec92ae6111a 100644
--- a/drivers/mtd/tests/mtd_oobtest.c
+++ b/drivers/mtd/tests/mtd_oobtest.c
@@ -25,6 +25,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_oobtest: "
@@ -343,7 +344,6 @@ static int scan_for_bad_eraseblocks(void)
                printk(PRINT_PREF "error: cannot allocate memory\n");
                return -ENOMEM;
        }
-        memset(bbt, 0 , ebcnt);
        printk(PRINT_PREF "scanning for bad eraseblocks\n");
        for (i = 0; i < ebcnt; ++i) {
@@ -392,7 +392,6 @@ static int __init mtd_oobtest_init(void)
               mtd->writesize, ebcnt, pgcnt, mtd->oobsize);
        err = -ENOMEM;
-        mtd->erasesize = mtd->erasesize;
        readbuf = kmalloc(mtd->erasesize, GFP_KERNEL);
        if (!readbuf) {
                printk(PRINT_PREF "error: cannot allocate memory\n");
@@ -476,18 +475,10 @@ static int __init mtd_oobtest_init(void)
        use_len_max = mtd->ecclayout->oobavail;
        vary_offset = 1;
        simple_srand(5);
-        printk(PRINT_PREF "writing OOBs of whole device\n");
-        for (i = 0; i < ebcnt; ++i) {
+        err = write_whole_device();
-                if (bbt[i])
+        if (err)
-                        continue;
+                goto out;
-                err = write_eraseblock(i);
-                if (err)
-                        goto out;
-                if (i % 256 == 0)
-                        printk(PRINT_PREF "written up to eraseblock %u\n", i);
-                cond_resched();
-        }
-        printk(PRINT_PREF "written %u eraseblocks\n", i);
        /* Check all eraseblocks */
        use_offset = 0;
diff --git a/drivers/mtd/tests/mtd_pagetest.c b/drivers/mtd/tests/mtd_pagetest.c
index 103cac480fee..921a85df9196 100644
--- a/drivers/mtd/tests/mtd_pagetest.c
+++ b/drivers/mtd/tests/mtd_pagetest.c
@@ -25,6 +25,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_pagetest: "
@@ -523,6 +524,7 @@ static int __init mtd_pagetest_init(void)
        do_div(tmp, mtd->erasesize);
        ebcnt = tmp;
        pgcnt = mtd->erasesize / mtd->writesize;
+        pgsize = mtd->writesize;
        printk(PRINT_PREF "MTD device size %llu, eraseblock size %u, "
               "page size %u, count of eraseblocks %u, pages per "
diff --git a/drivers/mtd/tests/mtd_readtest.c b/drivers/mtd/tests/mtd_readtest.c
index 79fc4530987b..7107fccbc7de 100644
--- a/drivers/mtd/tests/mtd_readtest.c
+++ b/drivers/mtd/tests/mtd_readtest.c
@@ -24,6 +24,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_readtest: "
@@ -147,6 +148,10 @@ static int scan_for_bad_eraseblocks(void)
        }
        memset(bbt, 0 , ebcnt);
+        /* NOR flash does not implement block_isbad */
+        if (mtd->block_isbad == NULL)
+                return 0;
        printk(PRINT_PREF "scanning for bad eraseblocks\n");
        for (i = 0; i < ebcnt; ++i) {
                bbt[i] = is_block_bad(i) ? 1 : 0;
@@ -184,7 +189,7 @@ static int __init mtd_readtest_init(void)
        tmp = mtd->size;
        do_div(tmp, mtd->erasesize);
        ebcnt = tmp;
-        pgcnt = mtd->erasesize / mtd->writesize;
+        pgcnt = mtd->erasesize / pgsize;
        printk(PRINT_PREF "MTD device size %llu, eraseblock size %u, "
               "page size %u, count of eraseblocks %u, pages per "
diff --git a/drivers/mtd/tests/mtd_speedtest.c b/drivers/mtd/tests/mtd_speedtest.c
index 141363a7e805..56ca62bb96bf 100644
--- a/drivers/mtd/tests/mtd_speedtest.c
+++ b/drivers/mtd/tests/mtd_speedtest.c
@@ -24,6 +24,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_speedtest: "
@@ -301,6 +302,10 @@ static int scan_for_bad_eraseblocks(void)
        }
        memset(bbt, 0 , ebcnt);
+        /* NOR flash does not implement block_isbad */
+        if (mtd->block_isbad == NULL)
+                goto out;
        printk(PRINT_PREF "scanning for bad eraseblocks\n");
        for (i = 0; i < ebcnt; ++i) {
                bbt[i] = is_block_bad(i) ? 1 : 0;
@@ -309,6 +314,7 @@ static int scan_for_bad_eraseblocks(void)
                cond_resched();
        }
        printk(PRINT_PREF "scanned %d eraseblocks, %d are bad\n", i, bad);
+out:
        goodebcnt = ebcnt - bad;
        return 0;
 }
@@ -340,7 +346,7 @@ static int __init mtd_speedtest_init(void)
        tmp = mtd->size;
        do_div(tmp, mtd->erasesize);
        ebcnt = tmp;
-        pgcnt = mtd->erasesize / mtd->writesize;
+        pgcnt = mtd->erasesize / pgsize;
        printk(PRINT_PREF "MTD device size %llu, eraseblock size %u, "
               "page size %u, count of eraseblocks %u, pages per "
diff --git a/drivers/mtd/tests/mtd_stresstest.c b/drivers/mtd/tests/mtd_stresstest.c
index 63920476b57a..3854afec56d0 100644
--- a/drivers/mtd/tests/mtd_stresstest.c
+++ b/drivers/mtd/tests/mtd_stresstest.c
@@ -24,6 +24,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/vmalloc.h>
@@ -227,6 +228,10 @@ static int scan_for_bad_eraseblocks(void)
        }
        memset(bbt, 0 , ebcnt);
+        /* NOR flash does not implement block_isbad */
+        if (mtd->block_isbad == NULL)
+                return 0;
        printk(PRINT_PREF "scanning for bad eraseblocks\n");
        for (i = 0; i < ebcnt; ++i) {
                bbt[i] = is_block_bad(i) ? 1 : 0;
@@ -265,7 +270,7 @@ static int __init mtd_stresstest_init(void)
        tmp = mtd->size;
        do_div(tmp, mtd->erasesize);
        ebcnt = tmp;
-        pgcnt = mtd->erasesize / mtd->writesize;
+        pgcnt = mtd->erasesize / pgsize;
        printk(PRINT_PREF "MTD device size %llu, eraseblock size %u, "
               "page size %u, count of eraseblocks %u, pages per "
diff --git a/drivers/mtd/tests/mtd_subpagetest.c b/drivers/mtd/tests/mtd_subpagetest.c
index 5b889724268e..700237a3d120 100644
--- a/drivers/mtd/tests/mtd_subpagetest.c
+++ b/drivers/mtd/tests/mtd_subpagetest.c
@@ -24,6 +24,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_subpagetest: "
diff --git a/drivers/mtd/tests/mtd_torturetest.c b/drivers/mtd/tests/mtd_torturetest.c
index 631a0ab3a33c..5c6c3d248901 100644
--- a/drivers/mtd/tests/mtd_torturetest.c
+++ b/drivers/mtd/tests/mtd_torturetest.c
@@ -28,6 +28,7 @@
 #include <linux/moduleparam.h>
 #include <linux/err.h>
 #include <linux/mtd/mtd.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #define PRINT_PREF KERN_INFO "mtd_torturetest: "
diff --git a/drivers/mtd/ubi/Kconfig b/drivers/mtd/ubi/Kconfig
index b1cd7a1a2191..0a8c7ea764ae 100644
--- a/drivers/mtd/ubi/Kconfig
+++ b/drivers/mtd/ubi/Kconfig
@@ -1,5 +1,3 @@
-# drivers/mtd/ubi/Kconfig
 menu "UBI - Unsorted block images"
        depends on MTD
diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c
index 14cec04c34f9..55c726dde942 100644
--- a/drivers/mtd/ubi/build.c
+++ b/drivers/mtd/ubi/build.c
@@ -37,12 +37,14 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/stringify.h>
+#include <linux/namei.h>
 #include <linux/stat.h>
 #include <linux/miscdevice.h>
 #include <linux/log2.h>
 #include <linux/kthread.h>
 #include <linux/reboot.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include "ubi.h"
 /* Maximum length of the 'mtd=' parameter */
@@ -50,7 +52,8 @@
 /**
 * struct mtd_dev_param - MTD device parameter description data structure.
- * @name: MTD device name or number string
+ * @name: MTD character device node path, MTD device name, or MTD device number
+ *        string
 * @vid_hdr_offs: VID header offset
 */
 struct mtd_dev_param {
@@ -59,10 +62,10 @@ struct mtd_dev_param {
 };
 /* Numbers of elements set in the @mtd_dev_param array */
-static int mtd_devs;
+static int __initdata mtd_devs;
 /* MTD devices specification parameters */
-static struct mtd_dev_param mtd_dev_param[UBI_MAX_DEVICES];
+static struct mtd_dev_param __initdata mtd_dev_param[UBI_MAX_DEVICES];
 /* Root UBI "class" object (corresponds to '/<sysfs>/class/ubi/') */
 struct class *ubi_class;
@@ -87,7 +90,8 @@ DEFINE_MUTEX(ubi_devices_mutex);
 static DEFINE_SPINLOCK(ubi_devices_lock);
 /* "Show" method for files in '/<sysfs>/class/ubi/' */
-static ssize_t ubi_version_show(struct class *class, char *buf)
+static ssize_t ubi_version_show(struct class *class, struct class_attribute *attr,
+                                char *buf)
 {
        return sprintf(buf, "%d\n", UBI_VERSION);
 }
@@ -363,11 +367,13 @@ static void dev_release(struct device *dev)
 /**
 * ubi_sysfs_init - initialize sysfs for an UBI device.
 * @ubi: UBI device description object
+ * @ref: set to %1 on exit in case of failure if a reference to @ubi->dev was
+ *       taken
 *
 * This function returns zero in case of success and a negative error code in
 * case of failure.
 */
-static int ubi_sysfs_init(struct ubi_device *ubi)
+static int ubi_sysfs_init(struct ubi_device *ubi, int *ref)
 {
        int err;
@@ -379,6 +385,7 @@ static int ubi_sysfs_init(struct ubi_device *ubi)
        if (err)
                return err;
+        *ref = 1;
        err = device_create_file(&ubi->dev, &dev_eraseblock_size);
        if (err)
                return err;
@@ -434,7 +441,7 @@ static void ubi_sysfs_close(struct ubi_device *ubi)
 }
 /**
- * kill_volumes - destroy all volumes.
+ * kill_volumes - destroy all user volumes.
 * @ubi: UBI device description object
 */
 static void kill_volumes(struct ubi_device *ubi)
@@ -447,36 +454,29 @@ static void kill_volumes(struct ubi_device *ubi)
 }
 /**
- * free_user_volumes - free all user volumes.
- * @ubi: UBI device description object
- *
- * Normally the volumes are freed at the release function of the volume device
- * objects. However, on error paths the volumes have to be freed before the
- * device objects have been initialized.
- */
-static void free_user_volumes(struct ubi_device *ubi)
-{
-        int i;
-        for (i = 0; i < ubi->vtbl_slots; i++)
-                if (ubi->volumes[i]) {
-                        kfree(ubi->volumes[i]->eba_tbl);
-                        kfree(ubi->volumes[i]);
-                }
-}
-/**
 * uif_init - initialize user interfaces for an UBI device.
 * @ubi: UBI device description object
+ * @ref: set to %1 on exit in case of failure if a reference to @ubi->dev was
+ *       taken, otherwise set to %0
+ *
+ * This function initializes various user interfaces for an UBI device. If the
+ * initialization fails at an early stage, this function frees all the
+ * resources it allocated, returns an error, and @ref is set to %0. However,
+ * if the initialization fails after the UBI device was registered in the
+ * driver core subsystem, this function takes a reference to @ubi->dev, because
+ * otherwise the release function ('dev_release()') would free whole @ubi
+ * object. The @ref argument is set to %1 in this case. The caller has to put
+ * this reference.
 *
 * This function returns zero in case of success and a negative error code in
- * case of failure. Note, this function destroys all volumes if it fails.
+ * case of failure.
 */
-static int uif_init(struct ubi_device *ubi)
+static int uif_init(struct ubi_device *ubi, int *ref)
 {
        int i, err;
        dev_t dev;
+        *ref = 0;
        sprintf(ubi->ubi_name, UBI_NAME_STR "%d", ubi->ubi_num);
        /*
@@ -504,7 +504,7 @@ static int uif_init(struct ubi_device *ubi)
                goto out_unreg;
        }
-        err = ubi_sysfs_init(ubi);
+        err = ubi_sysfs_init(ubi, ref);
        if (err)
                goto out_sysfs;
@@ -522,6 +522,8 @@ static int uif_init(struct ubi_device *ubi)
 out_volumes:
        kill_volumes(ubi);
 out_sysfs:
+        if (*ref)
+                get_device(&ubi->dev);
        ubi_sysfs_close(ubi);
        cdev_del(&ubi->cdev);
 out_unreg:
@@ -875,7 +877,7 @@ static int ubi_reboot_notifier(struct notifier_block *n, unsigned long state,
 int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
 {
        struct ubi_device *ubi;
-        int i, err, do_free = 1;
+        int i, err, ref = 0;
        /*
         * Check if we already have the same MTD device attached.
@@ -975,9 +977,9 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
                        goto out_detach;
        }
-        err = uif_init(ubi);
+        err = uif_init(ubi, &ref);
        if (err)
-                goto out_nofree;
+                goto out_detach;
        ubi->bgt_thread = kthread_create(ubi_thread, ubi, ubi->bgt_name);
        if (IS_ERR(ubi->bgt_thread)) {
@@ -1025,12 +1027,8 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, int vid_hdr_offset)
 out_uif:
        uif_close(ubi);
-out_nofree:
-        do_free = 0;
 out_detach:
        ubi_wl_close(ubi);
-        if (do_free)
-                free_user_volumes(ubi);
        free_internal_volumes(ubi);
        vfree(ubi->vtbl);
 out_free:
@@ -1039,7 +1037,10 @@ out_free:
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
        vfree(ubi->dbg_peb_buf);
 #endif
-        kfree(ubi);
+        if (ref)
+                put_device(&ubi->dev);
+        else
+                kfree(ubi);
        return err;
 }
@@ -1096,7 +1097,7 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
        /*
         * Get a reference to the device in order to prevent 'dev_release()'
-         * from freeing @ubi object.
+         * from freeing the @ubi object.
         */
        get_device(&ubi->dev);
@@ -1116,13 +1117,50 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway)
 }
 /**
- * find_mtd_device - open an MTD device by its name or number.
+ * open_mtd_by_chdev - open an MTD device by its character device node path.
- * @mtd_dev: name or number of the device
+ * @mtd_dev: MTD character device node path
+ *
+ * This helper function opens an MTD device by its character node device path.
+ * Returns MTD device description object in case of success and a negative
+ * error code in case of failure.
+ */
+static struct mtd_info * __init open_mtd_by_chdev(const char *mtd_dev)
+{
+        int err, major, minor, mode;
+        struct path path;
+        /* Probably this is an MTD character device node path */
+        err = kern_path(mtd_dev, LOOKUP_FOLLOW, &path);
+        if (err)
+                return ERR_PTR(err);
+        /* MTD device number is defined by the major / minor numbers */
+        major = imajor(path.dentry->d_inode);
+        minor = iminor(path.dentry->d_inode);
+        mode = path.dentry->d_inode->i_mode;
+        path_put(&path);
+        if (major != MTD_CHAR_MAJOR || !S_ISCHR(mode))
+                return ERR_PTR(-EINVAL);
+        if (minor & 1)
+                /*
+                 * Just do not think the "/dev/mtdrX" devices support is need,
+                 * so do not support them to avoid doing extra work.
+                 */
+                return ERR_PTR(-EINVAL);
+        return get_mtd_device(NULL, minor / 2);
+}
+/**
+ * open_mtd_device - open MTD device by name, character device path, or number.
+ * @mtd_dev: name, character device node path, or MTD device device number
 *
 * This function tries to open and MTD device described by @mtd_dev string,
- * which is first treated as an ASCII number, and if it is not true, it is
+ * which is first treated as ASCII MTD device number, and if it is not true, it
- * treated as MTD device name. Returns MTD device description object in case of
+ * is treated as MTD device name, and if that is also not true, it is treated
- * success and a negative error code in case of failure.
+ * as MTD character device node path. Returns MTD device description object in
+ * case of success and a negative error code in case of failure.
 */
 static struct mtd_info * __init open_mtd_device(const char *mtd_dev)
 {
@@ -1137,6 +1175,9 @@ static struct mtd_info * __init open_mtd_device(const char *mtd_dev)
                 * MTD device name.
                 */
                mtd = get_mtd_device_nm(mtd_dev);
+                if (IS_ERR(mtd) && PTR_ERR(mtd) == -ENODEV)
+                        /* Probably this is an MTD character device node path */
+                        mtd = open_mtd_by_chdev(mtd_dev);
        } else
                mtd = get_mtd_device(NULL, mtd_num);
@@ -1352,13 +1393,15 @@ static int __init ubi_mtd_param_parse(const char *val, struct kernel_param *kp)
 module_param_call(mtd, ubi_mtd_param_parse, NULL, NULL, 000);
 MODULE_PARM_DESC(mtd, "MTD devices to attach. Parameter format: "
-                      "mtd=<name|num>[,<vid_hdr_offs>].\n"
+                      "mtd=<name|num|path>[,<vid_hdr_offs>].\n"
                      "Multiple \"mtd\" parameters may be specified.\n"
-                      "MTD devices may be specified by their number or name.\n"
+                      "MTD devices may be specified by their number, name, or "
+                      "path to the MTD character device node.\n"
                      "Optional \"vid_hdr_offs\" parameter specifies UBI VID "
-                      "header position and data starting position to be used "
+                      "header position to be used by UBI.\n"
-                      "by UBI.\n"
+                      "Example 1: mtd=/dev/mtd0 - attach MTD device "
-                      "Example: mtd=content,1984 mtd=4 - attach MTD device"
+                      "/dev/mtd0.\n"
+                      "Example 2: mtd=content,1984 mtd=4 - attach MTD device "
                      "with name \"content\" using VID header offset 1984, and "
                      "MTD device number 4 with default VID header offset.");
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index f237ddbb2713..72ebb3f06b86 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -37,6 +37,7 @@
 #include <linux/module.h>
 #include <linux/stat.h>
+#include <linux/slab.h>
 #include <linux/ioctl.h>
 #include <linux/capability.h>
 #include <linux/uaccess.h>
@@ -853,7 +854,6 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                        break;
                }
-                req.name[req.name_len] = '\0';
                err = verify_mkvol_req(ubi, &req);
                if (err)
                        break;
diff --git a/drivers/mtd/ubi/debug.h b/drivers/mtd/ubi/debug.h
index f30bcb372c05..17a107129726 100644
--- a/drivers/mtd/ubi/debug.h
+++ b/drivers/mtd/ubi/debug.h
@@ -96,8 +96,11 @@ void ubi_dbg_dump_flash(struct ubi_device *ubi, int pnum, int offset, int len);
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
 int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len);
+int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+                        int offset, int len);
 #else
 #define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
 #endif
 #ifdef CONFIG_MTD_UBI_DEBUG_DISABLE_BGT
@@ -176,6 +179,7 @@ static inline int ubi_dbg_is_erase_failure(void)
 #define ubi_dbg_is_write_failure() 0
 #define ubi_dbg_is_erase_failure() 0
 #define ubi_dbg_check_all_ff(ubi, pnum, offset, len) 0
+#define ubi_dbg_check_write(ubi, buf, pnum, offset, len) 0
 #endif /* !CONFIG_MTD_UBI_DEBUG */
 #endif /* !__UBI_DEBUG_H__ */
diff --git a/drivers/mtd/ubi/gluebi.c b/drivers/mtd/ubi/gluebi.c
index b5e478fa2661..9aa81584c8a2 100644
--- a/drivers/mtd/ubi/gluebi.c
+++ b/drivers/mtd/ubi/gluebi.c
@@ -31,6 +31,7 @@
 #include <linux/err.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #include <linux/sched.h>
 #include <linux/math64.h>
 #include <linux/module.h>
diff --git a/drivers/mtd/ubi/io.c b/drivers/mtd/ubi/io.c
index 8aa51e7a6a7d..533b1a4b9af1 100644
--- a/drivers/mtd/ubi/io.c
+++ b/drivers/mtd/ubi/io.c
@@ -88,6 +88,7 @@
 #include <linux/crc32.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
@@ -143,7 +144,7 @@ int ubi_io_read(const struct ubi_device *ubi, void *buf, int pnum, int offset,
        err = paranoid_check_not_bad(ubi, pnum);
        if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
        addr = (loff_t)pnum * ubi->peb_size + offset;
 retry:
@@ -236,12 +237,12 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
        err = paranoid_check_not_bad(ubi, pnum);
        if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
        /* The area we are writing to has to contain all 0xFF bytes */
        err = ubi_dbg_check_all_ff(ubi, pnum, offset, len);
        if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
        if (offset >= ubi->leb_start) {
                /*
@@ -250,10 +251,10 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
                 */
                err = paranoid_check_peb_ec_hdr(ubi, pnum);
                if (err)
-                        return err > 0 ? -EINVAL : err;
+                        return err;
                err = paranoid_check_peb_vid_hdr(ubi, pnum);
                if (err)
-                        return err > 0 ? -EINVAL : err;
+                        return err;
        }
        if (ubi_dbg_is_write_failure()) {
@@ -273,6 +274,21 @@ int ubi_io_write(struct ubi_device *ubi, const void *buf, int pnum, int offset,
        } else
                ubi_assert(written == len);
+        if (!err) {
+                err = ubi_dbg_check_write(ubi, buf, pnum, offset, len);
+                if (err)
+                        return err;
+                /*
+                 * Since we always write sequentially, the rest of the PEB has
+                 * to contain only 0xFF bytes.
+                 */
+                offset += len;
+                len = ubi->peb_size - offset;
+                if (len)
+                        err = ubi_dbg_check_all_ff(ubi, pnum, offset, len);
+        }
        return err;
 }
@@ -348,7 +364,7 @@ retry:
        err = ubi_dbg_check_all_ff(ubi, pnum, 0, ubi->peb_size);
        if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
        if (ubi_dbg_is_erase_failure() && !err) {
                dbg_err("cannot erase PEB %d (emulated)", pnum);
@@ -542,7 +558,7 @@ int ubi_io_sync_erase(struct ubi_device *ubi, int pnum, int torture)
        err = paranoid_check_not_bad(ubi, pnum);
        if (err != 0)
-                return err > 0 ? -EINVAL : err;
+                return err;
        if (ubi->ro_mode) {
                ubi_err("read-only mode");
@@ -819,7 +835,7 @@ int ubi_io_write_ec_hdr(struct ubi_device *ubi, int pnum,
        err = paranoid_check_ec_hdr(ubi, pnum, ec_hdr);
        if (err)
-                return -EINVAL;
+                return err;
        err = ubi_io_write(ubi, ec_hdr, pnum, 0, ubi->ec_hdr_alsize);
        return err;
@@ -1083,7 +1099,7 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
        err = paranoid_check_peb_ec_hdr(ubi, pnum);
        if (err)
-                return err > 0 ? -EINVAL : err;
+                return err;
        vid_hdr->magic = cpu_to_be32(UBI_VID_HDR_MAGIC);
        vid_hdr->version = UBI_VERSION;
@@ -1092,7 +1108,7 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
        err = paranoid_check_vid_hdr(ubi, pnum, vid_hdr);
        if (err)
-                return -EINVAL;
+                return err;
        p = (char *)vid_hdr - ubi->vid_hdr_shift;
        err = ubi_io_write(ubi, p, pnum, ubi->vid_hdr_aloffset,
@@ -1107,8 +1123,8 @@ int ubi_io_write_vid_hdr(struct ubi_device *ubi, int pnum,
 * @ubi: UBI device description object
 * @pnum: physical eraseblock number to check
 *
- * This function returns zero if the physical eraseblock is good, a positive
+ * This function returns zero if the physical eraseblock is good, %-EINVAL if
- * number if it is bad and a negative error code if an error occurred.
+ * it is bad and a negative error code if an error occurred.
 */
 static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
 {
@@ -1120,7 +1136,7 @@ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
        ubi_err("paranoid check failed for PEB %d", pnum);
        ubi_dbg_dump_stack();
-        return err;
+        return err > 0 ? -EINVAL : err;
 }
 /**
@@ -1130,7 +1146,7 @@ static int paranoid_check_not_bad(const struct ubi_device *ubi, int pnum)
 * @ec_hdr: the erase counter header to check
 *
 * This function returns zero if the erase counter header contains valid
- * values, and %1 if not.
+ * values, and %-EINVAL if not.
 */
 static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
                                 const struct ubi_ec_hdr *ec_hdr)
@@ -1156,7 +1172,7 @@ static int paranoid_check_ec_hdr(const struct ubi_device *ubi, int pnum,
 fail:
        ubi_dbg_dump_ec_hdr(ec_hdr);
        ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 /**
@@ -1164,8 +1180,8 @@ fail:
 * @ubi: UBI device description object
 * @pnum: the physical eraseblock number to check
 *
- * This function returns zero if the erase counter header is all right, %1 if
+ * This function returns zero if the erase counter header is all right and and
- * not, and a negative error code if an error occurred.
+ * a negative error code if not or if an error occurred.
 */
 static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
 {
@@ -1188,7 +1204,7 @@ static int paranoid_check_peb_ec_hdr(const struct ubi_device *ubi, int pnum)
                ubi_err("paranoid check failed for PEB %d", pnum);
                ubi_dbg_dump_ec_hdr(ec_hdr);
                ubi_dbg_dump_stack();
-                err = 1;
+                err = -EINVAL;
                goto exit;
        }
@@ -1206,7 +1222,7 @@ exit:
 * @vid_hdr: the volume identifier header to check
 *
 * This function returns zero if the volume identifier header is all right, and
- * %1 if not.
+ * %-EINVAL if not.
 */
 static int paranoid_check_vid_hdr(const struct ubi_device *ubi, int pnum,
                                  const struct ubi_vid_hdr *vid_hdr)
@@ -1233,7 +1249,7 @@ fail:
        ubi_err("paranoid check failed for PEB %d", pnum);
        ubi_dbg_dump_vid_hdr(vid_hdr);
        ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
@@ -1243,7 +1259,7 @@ fail:
 * @pnum: the physical eraseblock number to check
 *
 * This function returns zero if the volume identifier header is all right,
- * %1 if not, and a negative error code if an error occurred.
+ * and a negative error code if not or if an error occurred.
 */
 static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
 {
@@ -1270,7 +1286,7 @@ static int paranoid_check_peb_vid_hdr(const struct ubi_device *ubi, int pnum)
                ubi_err("paranoid check failed for PEB %d", pnum);
                ubi_dbg_dump_vid_hdr(vid_hdr);
                ubi_dbg_dump_stack();
-                err = 1;
+                err = -EINVAL;
                goto exit;
        }
@@ -1282,6 +1298,61 @@ exit:
 }
 /**
+ * ubi_dbg_check_write - make sure write succeeded.
+ * @ubi: UBI device description object
+ * @buf: buffer with data which were written
+ * @pnum: physical eraseblock number the data were written to
+ * @offset: offset within the physical eraseblock the data were written to
+ * @len: how many bytes were written
+ *
+ * This functions reads data which were recently written and compares it with
+ * the original data buffer - the data have to match. Returns zero if the data
+ * match and a negative error code if not or in case of failure.
+ */
+int ubi_dbg_check_write(struct ubi_device *ubi, const void *buf, int pnum,
+                        int offset, int len)
+{
+        int err, i;
+        mutex_lock(&ubi->dbg_buf_mutex);
+        err = ubi_io_read(ubi, ubi->dbg_peb_buf, pnum, offset, len);
+        if (err)
+                goto out_unlock;
+        for (i = 0; i < len; i++) {
+                uint8_t c = ((uint8_t *)buf)[i];
+                uint8_t c1 = ((uint8_t *)ubi->dbg_peb_buf)[i];
+                int dump_len;
+                if (c == c1)
+                        continue;
+                ubi_err("paranoid check failed for PEB %d:%d, len %d",
+                        pnum, offset, len);
+                ubi_msg("data differ at position %d", i);
+                dump_len = max_t(int, 128, len - i);
+                ubi_msg("hex dump of the original buffer from %d to %d",
+                        i, i + dump_len);
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+                               buf + i, dump_len, 1);
+                ubi_msg("hex dump of the read buffer from %d to %d",
+                        i, i + dump_len);
+                print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
+                               ubi->dbg_peb_buf + i, dump_len, 1);
+                ubi_dbg_dump_stack();
+                err = -EINVAL;
+                goto out_unlock;
+        }
+        mutex_unlock(&ubi->dbg_buf_mutex);
+        return 0;
+out_unlock:
+        mutex_unlock(&ubi->dbg_buf_mutex);
+        return err;
+}
+/**
 * ubi_dbg_check_all_ff - check that a region of flash is empty.
 * @ubi: UBI device description object
 * @pnum: the physical eraseblock number to check
@@ -1289,8 +1360,8 @@ exit:
 * @len: the length of the region to check
 *
 * This function returns zero if only 0xFF bytes are present at offset
- * @offset of the physical eraseblock @pnum, %1 if not, and a negative error
+ * @offset of the physical eraseblock @pnum, and a negative error code if not
- * code if an error occurred.
+ * or if an error occurred.
 */
 int ubi_dbg_check_all_ff(struct ubi_device *ubi, int pnum, int offset, int len)
 {
@@ -1321,7 +1392,7 @@ fail:
        ubi_msg("hex dump of the %d-%d region", offset, offset + len);
        print_hex_dump(KERN_DEBUG, "", DUMP_PREFIX_OFFSET, 32, 1,
                       ubi->dbg_peb_buf, len, 1);
-        err = 1;
+        err = -EINVAL;
 error:
        ubi_dbg_dump_stack();
        mutex_unlock(&ubi->dbg_buf_mutex);
diff --git a/drivers/mtd/ubi/kapi.c b/drivers/mtd/ubi/kapi.c
index 88a72e9c8beb..17f287decc36 100644
--- a/drivers/mtd/ubi/kapi.c
+++ b/drivers/mtd/ubi/kapi.c
@@ -22,6 +22,9 @@
 #include <linux/module.h>
 #include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/namei.h>
+#include <linux/fs.h>
 #include <asm/div64.h>
 #include "ubi.h"
@@ -280,6 +283,43 @@ struct ubi_volume_desc *ubi_open_volume_nm(int ubi_num, const char *name,
 EXPORT_SYMBOL_GPL(ubi_open_volume_nm);
 /**
+ * ubi_open_volume_path - open UBI volume by its character device node path.
+ * @pathname: volume character device node path
+ * @mode: open mode
+ *
+ * This function is similar to 'ubi_open_volume()', but opens a volume the path
+ * to its character device node.
+ */
+struct ubi_volume_desc *ubi_open_volume_path(const char *pathname, int mode)
+{
+        int error, ubi_num, vol_id, mod;
+        struct inode *inode;
+        struct path path;
+        dbg_gen("open volume %s, mode %d", pathname, mode);
+        if (!pathname || !*pathname)
+                return ERR_PTR(-EINVAL);
+        error = kern_path(pathname, LOOKUP_FOLLOW, &path);
+        if (error)
+                return ERR_PTR(error);
+        inode = path.dentry->d_inode;
+        mod = inode->i_mode;
+        ubi_num = ubi_major2num(imajor(inode));
+        vol_id = iminor(inode) - 1;
+        path_put(&path);
+        if (!S_ISCHR(mod))
+                return ERR_PTR(-EINVAL);
+        if (vol_id >= 0 && ubi_num >= 0)
+                return ubi_open_volume(ubi_num, vol_id, mode);
+        return ERR_PTR(-ENODEV);
+}
+EXPORT_SYMBOL_GPL(ubi_open_volume_path);
+/**
 * ubi_close_volume - close UBI volume.
 * @desc: volume descriptor
 */
diff --git a/drivers/mtd/ubi/scan.c b/drivers/mtd/ubi/scan.c
index 90af61a2c3e4..dc5f688699da 100644
--- a/drivers/mtd/ubi/scan.c
+++ b/drivers/mtd/ubi/scan.c
@@ -41,6 +41,7 @@
 */
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/crc32.h>
 #include <linux/math64.h>
 #include "ubi.h"
@@ -974,11 +975,8 @@ struct ubi_scan_info *ubi_scan(struct ubi_device *ubi)
                        seb->ec = si->mean_ec;
        err = paranoid_check_si(ubi, si);
-        if (err) {
+        if (err)
-                if (err > 0)
-                        err = -EINVAL;
                goto out_vidh;
-        }
        ubi_free_vid_hdr(ubi, vidh);
        kfree(ech);
@@ -1086,8 +1084,8 @@ void ubi_scan_destroy_si(struct ubi_scan_info *si)
 * @ubi: UBI device description object
 * @si: scanning information
 *
- * This function returns zero if the scanning information is all right, %1 if
+ * This function returns zero if the scanning information is all right, and a
- * not and a negative error code if an error occurred.
+ * negative error code if not or if an error occurred.
 */
 static int paranoid_check_si(struct ubi_device *ubi, struct ubi_scan_info *si)
 {
@@ -1346,7 +1344,7 @@ bad_vid_hdr:
 out:
        ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */
diff --git a/drivers/mtd/ubi/ubi.h b/drivers/mtd/ubi/ubi.h
index 1af08178defd..5176d4886518 100644
--- a/drivers/mtd/ubi/ubi.h
+++ b/drivers/mtd/ubi/ubi.h
@@ -34,6 +34,7 @@
 #include <linux/fs.h>
 #include <linux/cdev.h>
 #include <linux/device.h>
+#include <linux/slab.h>
 #include <linux/string.h>
 #include <linux/vmalloc.h>
 #include <linux/notifier.h>
diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c
index 74fdc40c8627..425bf5a3edd4 100644
--- a/drivers/mtd/ubi/upd.c
+++ b/drivers/mtd/ubi/upd.c
@@ -147,12 +147,15 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol,
        }
        if (bytes == 0) {
+                err = ubi_wl_flush(ubi);
+                if (err)
+                        return err;
                err = clear_update_marker(ubi, vol, 0);
                if (err)
                        return err;
-                err = ubi_wl_flush(ubi);
+                vol->updating = 0;
-                if (!err)
+                return 0;
-                        vol->updating = 0;
        }
        vol->upd_buf = vmalloc(ubi->leb_size);
@@ -362,16 +365,16 @@ int ubi_more_update_data(struct ubi_device *ubi, struct ubi_volume *vol,
        ubi_assert(vol->upd_received <= vol->upd_bytes);
        if (vol->upd_received == vol->upd_bytes) {
+                err = ubi_wl_flush(ubi);
+                if (err)
+                        return err;
                /* The update is finished, clear the update marker */
                err = clear_update_marker(ubi, vol, vol->upd_bytes);
                if (err)
                        return err;
-                err = ubi_wl_flush(ubi);
+                vol->updating = 0;
-                if (err == 0) {
+                err = to_write;
-                        vol->updating = 0;
+                vfree(vol->upd_buf);
-                        err = to_write;
-                        vfree(vol->upd_buf);
-                }
        }
        return err;
diff --git a/drivers/mtd/ubi/vmt.c b/drivers/mtd/ubi/vmt.c
index ab64cb56df6e..e42afab9a9fe 100644
--- a/drivers/mtd/ubi/vmt.c
+++ b/drivers/mtd/ubi/vmt.c
@@ -25,6 +25,7 @@
 #include <linux/err.h>
 #include <linux/math64.h>
+#include <linux/slab.h>
 #include "ubi.h"
 #ifdef CONFIG_MTD_UBI_DEBUG_PARANOID
diff --git a/drivers/mtd/ubi/vtbl.c b/drivers/mtd/ubi/vtbl.c
index 1afc61e7455d..cd90ff3b76b1 100644
--- a/drivers/mtd/ubi/vtbl.c
+++ b/drivers/mtd/ubi/vtbl.c
@@ -58,6 +58,7 @@
 #include <linux/crc32.h>
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <asm/div64.h>
 #include "ubi.h"
@@ -566,6 +567,7 @@ static int init_volumes(struct ubi_device *ubi, const struct ubi_scan_info *si,
                vol->reserved_pebs = be32_to_cpu(vtbl[i].reserved_pebs);
                vol->alignment = be32_to_cpu(vtbl[i].alignment);
                vol->data_pad = be32_to_cpu(vtbl[i].data_pad);
+                vol->upd_marker = vtbl[i].upd_marker;
                vol->vol_type = vtbl[i].vol_type == UBI_VID_DYNAMIC ?
                                        UBI_DYNAMIC_VOLUME : UBI_STATIC_VOLUME;
                vol->name_len = be16_to_cpu(vtbl[i].name_len);
diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c
index 600c7229d5cf..f64ddabd4ac8 100644
--- a/drivers/mtd/ubi/wl.c
+++ b/drivers/mtd/ubi/wl.c
@@ -464,7 +464,7 @@ retry:
                                   ubi->peb_size - ubi->vid_hdr_aloffset);
        if (err) {
                ubi_err("new PEB %d does not contain all 0xFF bytes", e->pnum);
-                return err > 0 ? -EINVAL : err;
+                return err;
        }
        return e->pnum;
@@ -513,7 +513,7 @@ static int sync_erase(struct ubi_device *ubi, struct ubi_wl_entry *e,
        dbg_wl("erase PEB %d, old EC %llu", e->pnum, ec);
        err = paranoid_check_ec(ubi, e->pnum, e->ec);
-        if (err > 0)
+        if (err)
                return -EINVAL;
        ec_hdr = kzalloc(ubi->ec_hdr_alsize, GFP_NOFS);
@@ -1572,8 +1572,7 @@ void ubi_wl_close(struct ubi_device *ubi)
 * @ec: the erase counter to check
 *
 * This function returns zero if the erase counter of physical eraseblock @pnum
- * is equivalent to @ec, %1 if not, and a negative error code if an error
+ * is equivalent to @ec, and a negative error code if not or if an error occurred.
- * occurred.
 */
 static int paranoid_check_ec(struct ubi_device *ubi, int pnum, int ec)
 {
@@ -1611,8 +1610,8 @@ out_free:
 * @e: the wear-leveling entry to check
 * @root: the root of the tree
 *
- * This function returns zero if @e is in the @root RB-tree and %1 if it is
+ * This function returns zero if @e is in the @root RB-tree and %-EINVAL if it
- * not.
+ * is not.
 */
 static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
                                     struct rb_root *root)
@@ -1623,7 +1622,7 @@ static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
        ubi_err("paranoid check failed for PEB %d, EC %d, RB-tree %p ",
                e->pnum, e->ec, root);
        ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 /**
@@ -1632,7 +1631,7 @@ static int paranoid_check_in_wl_tree(struct ubi_wl_entry *e,
 * @ubi: UBI device description object
 * @e: the wear-leveling entry to check
 *
- * This function returns zero if @e is in @ubi->pq and %1 if it is not.
+ * This function returns zero if @e is in @ubi->pq and %-EINVAL if it is not.
 */
 static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
 {
@@ -1647,6 +1646,6 @@ static int paranoid_check_in_pq(struct ubi_device *ubi, struct ubi_wl_entry *e)
        ubi_err("paranoid check failed for PEB %d, EC %d, Protect queue",
                e->pnum, e->ec);
        ubi_dbg_dump_stack();
-        return 1;
+        return -EINVAL;
 }
 #endif /* CONFIG_MTD_UBI_DEBUG_PARANOID */